Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Many Problems and Malwarebytes Logs


  • This topic is locked This topic is locked
37 replies to this topic

#1 Jespinosa101

Jespinosa101

  • Members
  • 54 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:58 PM

Posted 06 August 2014 - 06:05 PM

Hi I'm Jespinosa101 and my PC issues are that I accidentally downloaded a trojan and I tried to delete it which I thought it was but it was not. Then my PC started saying adware detected so I deleted them from my PC and my internet speed got a bit faster and then I decided to use malwarebytes and did a full scan of my computer and it detected alot of PuP and harmful things so then I delete them using malwarebytes and it said to restart my pc to fully get rid of them so I do restart my pc but then it goes into automatic repair mode and I try to get out of it but it keeps on going to the automatic repair screen  doing the automatic repair loop and then I try to restore my pc to one of my downloads and then I get back to my login screen through that system restore from my downloads. Now I'm afraid to restart my PC and to use malwarebytes then I start to post on bleeping computer. Here's the link to the topic.

 

http://www.bleepingcomputer.com/forums/t/542930/many-problems-and-malwarebytes/?hl=%2Bmany+%2Bproblem+%2Band+%2Bmalwarebytes

 

Now heres the Farbar Recovery Scan tool logs

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 05-08-2014
Ran by jespi_000 (ATTENTION: The logged in user is not administrator) on JOSHUA_COMPUTER on 06-08-2014 16:41:01
Running from C:\Users\jespi_000\Downloads
Platform: Windows 8 (X64) OS Language: English (United States)
Internet Explorer Version 10
Boot Mode: Normal
 
The only official download link for FRST:
Download link from any site other than Bleeping Computer is unpermitted or outdated.
 
==================== Processes (Whitelisted) =================
 
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\Platform\McUICnt.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe\LiveComm.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPMSGSVC.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee\SiteAdvisor\McChHost.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee\SiteAdvisor\saUI.exe
(McAfee, Inc.) C:\Program Files\McAfee\MAT\McPvTray.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Microsoft Corporation) C:\Windows\System32\msfeedssync.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
 
 
==================== Registry (Whitelisted) ==================
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642656 2013-03-14] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [93296 2012-07-13] (CyberLink Corp.)
HKLM-x32\...\Run: [HPMessageService] => C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPMSGSVC.exe [1045304 2013-02-25] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [mobilegeni daemon] => C:\Program Files (x86)\Mobogenie\DaemonProcess.exe
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-04-23] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2012-04-18] (Apple Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [mcpltui_exe] => C:\Program Files\McAfee.com\Agent\mcagent.exe [537992 2014-04-25] (McAfee, Inc.)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-05-26] (Apple Inc.)
HKLM-x32\...\RunOnce: [Deal-Dropper-repairJob] => wscript.exe "C:\Users\Greg\AppData\Local\Deal-Dropper\repair.js" "Deal-Dropper-repairJob"
HKLM\...\Policies\Explorer: [NoFolderOptions] 0
HKLM\...\Policies\Explorer: [NoControlPanel] 0
SSODL: EldosMountNotificator - {5FF49FE8-B332-4CB9-B102-FB6951629E55} - C:\Windows\system32\CbFsMntNtf3.dll (EldoS Corporation)
SSODL-x32: EldosMountNotificator - {5FF49FE8-B332-4CB9-B102-FB6951629E55} - C:\Windows\SysWow64\CbFsMntNtf3.dll (EldoS Corporation)
ShellIconOverlayIdentifiers:  SkyDrive1 -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  No File
ShellIconOverlayIdentifiers:  SkyDrive2 -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  No File
ShellIconOverlayIdentifiers:  SkyDrive3 -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  No File
ShellIconOverlayIdentifiers:  SkyDrivePro1 (ErrorConflict) -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
ShellIconOverlayIdentifiers:  SkyDrivePro2 (SyncInProgress) -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
ShellIconOverlayIdentifiers:  SkyDrivePro3 (InSync) -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
ShellIconOverlayIdentifiers: EldosIconOverlay -> {5BB532A2-BF14-4CCC-86B7-71B81EF6F8BC} => C:\Windows\system32\CbFsMntNtf3.dll (EldoS Corporation)
ShellIconOverlayIdentifiers: MOBK -> {3c3f3c1a-9153-7c05-f938-622e7003894d} => C:\Program Files (x86)\McAfee Online Backup\MOBKshell.dll (McAfee, Inc.)
ShellIconOverlayIdentifiers: MOBK2 -> {e6ea1d7d-144e-b977-98c4-84c53c1a69d0} => C:\Program Files (x86)\McAfee Online Backup\MOBKshell.dll (McAfee, Inc.)
ShellIconOverlayIdentifiers: MOBK3 -> {b4caf489-1eec-c617-49ad-8d7088598c06} => C:\Program Files (x86)\McAfee Online Backup\MOBKshell.dll (McAfee, Inc.)
ShellIconOverlayIdentifiers-x32:  SkyDrive1 -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  No File
ShellIconOverlayIdentifiers-x32:  SkyDrive2 -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  No File
ShellIconOverlayIdentifiers-x32:  SkyDrive3 -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  No File
ShellIconOverlayIdentifiers-x32: EldosIconOverlay -> {5BB532A2-BF14-4CCC-86B7-71B81EF6F8BC} => C:\Windows\SysWow64\CbFsMntNtf3.dll (EldoS Corporation)
 
==================== Internet (Whitelisted) ====================
 
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/HPNOT13/1
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/HPNOT13/1
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/HPNOT13/1
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
SearchScopes: HKLM - {77AA745B-F4F8-45DA-9B14-61D2D95054C8} URL = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=CPNTDFJS
SearchScopes: HKLM - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.com/rover/1/711-154371-11896-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
SearchScopes: HKLM-x32 - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=CPNTDFJS
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=CPNTDFJS
SearchScopes: HKLM-x32 - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.com/rover/1/711-154371-11896-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
SearchScopes: HKCU - DefaultScope {6D8147CE-0169-41BB-8CA9-E3A2AAC60943} URL = http://search.yahoo.com/search?fr=mcafee&type=A011US0&p={SearchTerms}
SearchScopes: HKCU - {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = 
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=CPNTDFJS
SearchScopes: HKCU - {0EF0C717-AADA-4FD3-8A8F-EE233F0DA6A9} URL = http://www.google.com/search?q={searchTerms}
SearchScopes: HKCU - {6D8147CE-0169-41BB-8CA9-E3A2AAC60943} URL = http://search.yahoo.com/search?fr=mcafee&type=A011US0&p={SearchTerms}
SearchScopes: HKCU - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.com/rover/1/711-154371-11896-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO: Deal-Dropper BHO -> {41708E47-E97E-4051-A609-B88B398BCC94} -> C:\Program Files (x86)\Deal-Dropper\FrameworkBHO64.dll ()
BHO: McAfee SiteAdvisor BHO -> {B164E929-A1B6-4A06-B104-2CD0E90A88FF} -> c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Deal-Dropper BHO -> {41708E47-E97E-4051-A609-B88B398BCC94} -> C:\Program Files (x86)\Deal-Dropper\FrameworkBHO.dll ()
BHO-x32: Jump Flip -> {6db9fdfe-b718-4962-be0c-0a5fce7f7f7b} -> C:\Program Files (x86)\Jump Flip\JumpFlipbho.dll ()
BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: McAfee SiteAdvisor BHO -> {B164E929-A1B6-4A06-B104-2CD0E90A88FF} -> c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
BHO-x32: Consumer Input DCA BHO -> {B49699FC-1665-4414-A1CB-C4A2A4A13EEC} -> C:\Program Files (x86)\Consumer Input\InternetExplorer\dca-bho.dll ()
BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
Toolbar: HKLM - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
Toolbar: HKLM-x32 - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File
Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
Handler-x32: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation)
Handler-x32: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files\McAfee\MSC\McSnIePl64.dll (McAfee, Inc.)
Filter-x32: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files (x86)\McAfee\MSC\McSnIePl.dll (McAfee, Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
 
FireFox:
========
FF Plugin: @mcafee.com/MSC,version=10 -> c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1211151.dll (Adobe Systems, Inc.)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @mcafee.com/MSC,version=10 -> c:\PROGRA~2\mcafee\msc\NPMCSN~1.DLL ()
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()
FF Plugin HKCU: @nsroblox.roblox.com/launcher - C:\Users\jespi_000\AppData\Local\Roblox\Versions\version-459b702c887942d4\\NPRobloxProxy.dll ( ROBLOX Corporation)
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\jespi_000\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF HKLM-x32\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files (x86)\McAfee\SiteAdvisor
FF Extension: McAfee SiteAdvisor - C:\Program Files (x86)\McAfee\SiteAdvisor [2014-04-05]
FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK
FF Extension: McAfee Anti-Spam Thunderbird Extension - C:\Program Files\McAfee\MSK [2014-04-05]
 
Chrome: 
=======
CHR HomePage: hxxp://www.google.com/
CHR StartupUrls: "https://www.google.com/"
CHR Extension: (Google Docs) - C:\Users\jespi_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-12-23]
CHR Extension: (Google Drive) - C:\Users\jespi_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-12-23]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\jespi_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-05-22]
CHR Extension: (YouTube) - C:\Users\jespi_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-12-23]
CHR Extension: (Attack on Titan Theme for 1440x900) - C:\Users\jespi_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\cebjcpbckgdhefehkcfjeaddcjnkhlke [2014-05-19]
CHR Extension: (Google Search) - C:\Users\jespi_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-12-23]
CHR Extension: (SiteAdvisor) - C:\Users\jespi_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho [2014-04-09]
CHR Extension: (Google Wallet) - C:\Users\jespi_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-12-23]
CHR Extension: (Gmail) - C:\Users\jespi_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-12-23]
CHR Extension: (Extutil) - C:\Users\JESPI_~1\AppData\Local\Temp\D7ADFCCA-EE7E-442C-9999-C4D14FEF360B [2014-04-21]
CHR Extension: (Managera) - C:\Users\JESPI_~1\AppData\Local\Temp\38fdaae5-8e0e-493c-88ec-e05c3be06e42 [2014-04-21]
CHR HKLM\...\Chrome\Extension: [pflphaooapbgpeakohlggbpidpppgdff] - C:\Users\Greg\AppData\Local\mysearchdial-speeddial.crx [2014-04-21]
CHR HKLM-x32\...\Chrome\Extension: [hphehadppenpmajgnkjdcopcfijjegaf] - C:\Program Files (x86)\Jump Flip\hphehadppenpmajgnkjdcopcfijjegaf.crx [2014-04-21]
CHR HKLM-x32\...\Chrome\Extension: [pflphaooapbgpeakohlggbpidpppgdff] - C:\Users\Greg\AppData\Local\mysearchdial-speeddial.crx [2014-04-21]
 
==================== Services (Whitelisted) =================
 
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 
R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [361984 2013-03-14] (Advanced Micro Devices, Inc.) [File not signed]
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2356408 2014-06-19] (Microsoft Corporation)
S2 consumerinput_update; C:\Program Files (x86)\Consumer Input\Update\ConsumerInputUpdate.exe [106296 2014-01-14] (ConsumerInput)
S3 consumerinput_updatem; C:\Program Files (x86)\Consumer Input\Update\ConsumerInputUpdate.exe [106296 2014-01-14] (ConsumerInput)
R2 HomeNetSvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
R2 HP Support Assistant Service; C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [86528 2012-09-27] (Hewlett-Packard Company) [File not signed]
R2 HPWMISVC; C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPWMISVC.exe [1039160 2013-02-01] (Hewlett-Packard Development Company, L.P.)
R2 lmhosts; C:\Windows\system32\svchost.exe [29696 2013-06-01] (Microsoft Corporation)
R2 McAfee SiteAdvisor Service; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
R2 McAPExe; C:\Program Files\McAfee\MSC\McAPExe.exe [178528 2014-04-25] (McAfee, Inc.)
R2 McMPFSvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
R2 McNaiAnn; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
S3 McODS; C:\Program Files\McAfee\VirusScan\mcods.exe [603424 2014-06-12] (McAfee, Inc.)
R2 mcpltsvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
R2 McProxy; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
R2 mfecore; C:\Program Files\Common Files\McAfee\AMCore\mcshield.exe [1041192 2014-06-18] (McAfee, Inc.)
R2 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [219752 2014-06-20] (McAfee, Inc.)
R2 mfevtp; C:\Windows\system32\mfevtps.exe [189912 2014-06-20] (McAfee, Inc.)
R2 MOBKbackup; C:\Program Files (x86)\McAfee Online Backup\MOBKbackup.exe [231224 2010-04-13] (McAfee, Inc.)
R2 MSK80Service; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
R2 NlaSvc; C:\Windows\System32\svchost.exe [29696 2013-06-01] (Microsoft Corporation)
R2 nsi; C:\Windows\system32\svchost.exe [29696 2013-06-01] (Microsoft Corporation)
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [239176 2013-03-04] (Realtek Semiconductor)
S3 TunngleService; C:\Program Files (x86)\Tunngle\TnglCtrl.exe [758224 2013-11-06] (Tunngle.net GmbH)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16056 2014-03-29] (Microsoft Corporation)
 
==================== Drivers (Whitelisted) ====================
 
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 
R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdW86.sys [94208 2013-02-14] (Advanced Micro Devices)
R3 cbfs3; C:\Windows\System32\drivers\cbfs3.sys [352144 2012-04-09] (EldoS Corporation)
R3 cfwids; C:\Windows\System32\drivers\cfwids.sys [72128 2014-06-20] (McAfee, Inc.)
R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [92536 2012-06-25] (CyberLink)
S3 HipShieldK; C:\Windows\System32\drivers\HipShieldK.sys [197704 2013-09-23] (McAfee, Inc.)
R2 McPvDrv; C:\Windows\system32\drivers\McPvDrv.sys [74560 2013-09-09] (McAfee, Inc.)
R3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [181704 2014-06-20] (McAfee, Inc.)
R3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [313544 2014-06-20] (McAfee, Inc.)
S0 mfeelamk; C:\Windows\System32\drivers\mfeelamk.sys [70600 2014-06-20] (McAfee, Inc.)
R3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [523792 2014-06-20] (McAfee, Inc.)
R0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [786296 2014-06-20] (McAfee, Inc.)
R3 mfencbdc; C:\Windows\system32\DRIVERS\mfencbdc.sys [444720 2014-06-18] (McAfee, Inc.)
S3 mfencrk; C:\Windows\system32\DRIVERS\mfencrk.sys [96592 2014-06-18] (McAfee, Inc.)
R0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [348552 2014-06-20] (McAfee, Inc.)
R1 MOBKFilter; C:\Windows\System32\DRIVERS\MOBK.sys [66040 2010-04-13] (Mozy, Inc.)
R3 RSP2STOR; C:\Windows\system32\DRIVERS\RtsP2Stor.sys [288328 2013-01-23] (Realtek Semiconductor Corp.)
S3 SmbDrv; C:\Windows\System32\drivers\Smb_driver_AMDASF.sys [29424 2013-05-07] (Synaptics Incorporated)
S3 SmbDrvI; C:\Windows\System32\drivers\Smb_driver_Intel.sys [33008 2013-05-07] (Synaptics Incorporated)
R3 tap0901t; C:\Windows\system32\DRIVERS\tap0901t.sys [31232 2009-09-16] (Tunngle.net)
R3 WirelessButtonDriver; C:\Windows\System32\drivers\WirelessButtonDriver64.sys [20800 2012-08-31] (Hewlett-Packard Development Company, L.P.)
S1 hlnfd; system32\drivers\hlnfd.sys [X]
 
==================== NetSvcs (Whitelisted) ===================
 
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
 
 
==================== One Month Created Files and Folders ========
 
(If an entry is included in the fixlist, the file\folder will be moved.)
 
2014-08-06 16:41 - 2014-08-06 16:44 - 00022957 _____ () C:\Users\jespi_000\Downloads\FRST.txt
2014-08-06 16:40 - 2014-08-06 16:41 - 00000000 ____D () C:\FRST
2014-08-06 16:39 - 2014-08-06 16:40 - 02094080 _____ (Farbar) C:\Users\jespi_000\Downloads\FRST64.exe
2014-08-06 16:38 - 2014-08-06 16:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee
2014-07-21 21:00 - 2014-07-22 02:44 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-07-21 21:00 - 2014-07-21 21:00 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-07-15 23:03 - 2014-07-22 02:42 - 00000000 ____D () C:\Users\jespi_000\Documents\ArmA 2
2014-07-15 23:03 - 2014-07-20 16:58 - 00000000 ____D () C:\Users\jespi_000\AppData\Local\ArmA 2 Free
2014-07-11 14:24 - 2014-07-22 02:43 - 00000000 ____D () C:\Users\jespi_000\AppData\Local\LogMeIn Hamachi
2014-07-11 14:24 - 2014-07-11 14:24 - 00000000 ____D () C:\Users\jespi_000\AppData\Local\LogMeIn
2014-07-11 14:24 - 2014-07-11 14:24 - 00000000 ____D () C:\ProgramData\LogMeIn
2014-07-11 14:21 - 2014-07-22 02:44 - 00000000 ____D () C:\Program Files (x86)\LogMeIn Hamachi
 
==================== One Month Modified Files and Folders =======
 
(If an entry is included in the fixlist, the file\folder will be moved.)
 
2014-08-06 16:48 - 2014-01-14 19:37 - 00000390 _____ () C:\Windows\Tasks\CIMT_S-1-5-21-3436019999-1338614278-3438539980-1002.job
2014-08-06 16:44 - 2014-08-06 16:41 - 00022957 _____ () C:\Users\jespi_000\Downloads\FRST.txt
2014-08-06 16:43 - 2014-01-13 21:50 - 00000374 _____ () C:\Windows\Tasks\bench-S-1-5-21-3436019999-1338614278-3438539980-1002.job
2014-08-06 16:41 - 2014-08-06 16:40 - 00000000 ____D () C:\FRST
2014-08-06 16:41 - 2014-01-14 19:36 - 00000998 _____ () C:\Windows\Tasks\ConsumerInputUpdateTaskMachineUA.job
2014-08-06 16:41 - 2012-07-26 01:28 - 00941114 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-08-06 16:40 - 2014-08-06 16:39 - 02094080 _____ (Farbar) C:\Users\jespi_000\Downloads\FRST64.exe
2014-08-06 16:40 - 2014-01-23 09:56 - 00000926 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-08-06 16:40 - 2014-01-23 09:56 - 00000922 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-08-06 16:38 - 2014-08-06 16:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee
2014-08-06 16:38 - 2014-04-05 15:25 - 00001851 _____ () C:\Users\Public\Desktop\McAfee Total Protection.lnk
2014-08-06 16:36 - 2014-04-05 15:40 - 00000000 __RSD () C:\Users\jespi_000\Documents\McAfee Vaults
2014-08-06 16:34 - 2014-01-14 19:36 - 00000994 _____ () C:\Windows\Tasks\ConsumerInputUpdateTaskMachineCore.job
2014-08-06 16:34 - 2012-07-26 02:12 - 00000000 ____D () C:\Windows\system32\sru
2014-07-30 13:01 - 2012-08-03 16:23 - 00477298 _____ () C:\Windows\PFRO.log
2014-07-30 13:01 - 2012-07-26 01:22 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-07-30 13:00 - 2012-07-26 01:59 - 00000000 ____D () C:\Windows\CbsTemp
2014-07-30 12:57 - 2013-11-29 19:43 - 01471412 _____ () C:\Windows\WindowsUpdate.log
2014-07-30 12:55 - 2014-04-05 15:21 - 00000000 ____D () C:\Program Files (x86)\McAfee
2014-07-22 16:42 - 2014-04-14 20:45 - 00002190 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-07-22 16:34 - 2014-01-01 11:49 - 00000000 ____D () C:\Program Files (x86)\MyPC Backup
2014-07-22 16:21 - 2013-11-29 19:42 - 00000000 ____D () C:\Users\Greg
2014-07-22 16:12 - 2014-01-02 09:38 - 00050543 _____ () C:\Users\jespi_000\daemonprocess.txt
2014-07-22 15:54 - 2014-04-20 14:16 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-07-22 15:53 - 2014-04-05 15:09 - 00000000 ____D () C:\Program Files\Common Files\McAfee
2014-07-22 15:53 - 2012-07-26 02:12 - 00000000 ___HD () C:\Windows\ELAMBKUP
2014-07-22 02:47 - 2012-07-26 02:12 - 00000000 __RHD () C:\Users\Public\Libraries
2014-07-22 02:47 - 2012-07-26 02:12 - 00000000 ____D () C:\Windows\WinStore
2014-07-22 02:47 - 2012-07-26 01:52 - 00000000 ____D () C:\Program Files\Windows Journal
2014-07-22 02:46 - 2014-01-23 09:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2014-07-22 02:46 - 2014-01-13 09:24 - 00000000 ____D () C:\Users\Greg\AppData\Roaming\Oxy
2014-07-22 02:46 - 2014-01-01 11:49 - 00000000 ____D () C:\Users\Greg\AppData\Roaming\newnext.me
2014-07-22 02:46 - 2012-07-26 02:12 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
2014-07-22 02:46 - 2012-07-26 02:12 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
2014-07-22 02:44 - 2014-07-21 21:00 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-07-22 02:44 - 2014-07-11 14:21 - 00000000 ____D () C:\Program Files (x86)\LogMeIn Hamachi
2014-07-22 02:44 - 2014-04-05 15:22 - 00000000 ____D () C:\Program Files (x86)\McAfee.com
2014-07-22 02:44 - 2014-01-14 19:35 - 00000000 ____D () C:\Program Files (x86)\Consumer Input
2014-07-22 02:44 - 2014-01-13 21:50 - 00000000 ____D () C:\Program Files (x86)\Bench
2014-07-22 02:44 - 2014-01-01 11:48 - 00000000 ____D () C:\Program Files (x86)\Jump Flip
2014-07-22 02:43 - 2014-07-11 14:24 - 00000000 ____D () C:\Users\jespi_000\AppData\Local\LogMeIn Hamachi
2014-07-22 02:42 - 2014-07-15 23:03 - 00000000 ____D () C:\Users\jespi_000\Documents\ArmA 2
2014-07-22 02:41 - 2012-07-26 02:12 - 00000000 ____D () C:\Windows\registration
2014-07-22 02:41 - 2012-07-25 23:38 - 00000000 ____D () C:\Windows\system32\Sysprep
2014-07-22 02:40 - 2014-04-05 15:09 - 00000000 ____D () C:\ProgramData\McAfee
2014-07-22 02:40 - 2014-02-27 09:46 - 00000000 ____D () C:\Users\jespi_000\AppData\Roaming\.minecraft
2014-07-22 01:17 - 2014-01-13 21:50 - 00000374 _____ () C:\Windows\Tasks\bench-sys.job
2014-07-22 00:49 - 2013-11-29 20:27 - 00000000 ____D () C:\Users\jespi_000
2014-07-21 21:00 - 2014-07-21 21:00 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-07-20 16:58 - 2014-07-15 23:03 - 00000000 ____D () C:\Users\jespi_000\AppData\Local\ArmA 2 Free
2014-07-18 13:52 - 2012-07-26 02:12 - 00000000 ____D () C:\Windows\AUInstallAgent
2014-07-17 20:50 - 2014-01-10 19:26 - 00248832 ___SH () C:\Users\jespi_000\Downloads\Thumbs.db
2014-07-15 23:05 - 2013-06-01 12:41 - 00044965 _____ () C:\Windows\DirectX.log
2014-07-13 14:54 - 2013-12-03 11:27 - 00000000 ____D () C:\Windows\system32\MRT
2014-07-11 14:24 - 2014-07-11 14:24 - 00000000 ____D () C:\Users\jespi_000\AppData\Local\LogMeIn
2014-07-11 14:24 - 2014-07-11 14:24 - 00000000 ____D () C:\ProgramData\LogMeIn
2014-07-10 12:34 - 2014-04-05 13:12 - 00000000 ____D () C:\Program Files\Microsoft Office 15
 
Some content of TEMP:
====================
C:\Users\jespi_000\AppData\Local\Temp\COMAP.EXE
C:\Users\jespi_000\AppData\Local\Temp\htmlayout.dll
C:\Users\jespi_000\AppData\Local\Temp\SPSetup.exe
 
 
==================== Bamital & volsnap Check =================
 
(There is no automatic fix for files that do not pass verification.)
 
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
==================== End Of Log ============================


BC AdBot (Login to Remove)

 


#2 Jespinosa101

Jespinosa101
  • Topic Starter

  • Members
  • 54 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:58 PM

Posted 06 August 2014 - 06:13 PM

Now here's the addition.txt log from the Farbar Recover Scan Tool

Thanks in advance really appreciate it 

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 05-08-2014
Ran by jespi_000 at 2014-08-06 16:48:40
Running from C:\Users\jespi_000\Downloads
Boot Mode: Normal
==========================================================
 
 
==================== Security Center ========================
 
(If an entry is included in the fixlist, it will be removed.)
 
AV: McAfee Anti-Virus and Anti-Spyware (Enabled - Up to date) {ADA629C7-7F48-5689-624A-3B76997E0892}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: McAfee Anti-Virus and Anti-Spyware (Enabled - Up to date) {16C7C823-5972-5907-58FA-0004E2F9422F}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: McAfee Firewall (Enabled) {959DA8E2-3527-57D1-4915-924367AD4FE9}
 
==================== Installed Programs ======================
 
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 
4 Elements II (x32 Version: 2.2.0.98 - WildTangent) Hidden
7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Adobe Shockwave Player 12.1 (HKLM-x32\...\Adobe Shockwave Player) (Version: 12.1.1.151 - Adobe Systems, Inc.)
Airport Mania (x32 Version: 2.2.0.95 - WildTangent) Hidden
AMD Catalyst Install Manager (HKLM\...\{CB4C08E3-800F-65F6-9C00-06814A6B7CE7}) (Version: 8.0.911.0 - Advanced Micro Devices, Inc.)
AMD Fuel (Version: 2013.0313.2330.40379 - Advanced Micro Devices, Inc.) Hidden
AMD VISION Engine Control Center (x32 Version: 2013.0313.2330.40379 - Advanced Micro Devices, Inc.) Hidden
Apple Application Support (HKLM-x32\...\{D9DAD0FF-495A-472B-9F10-BAE430A26682}) (Version: 3.0.3 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{787136D2-F0F8-4625-AA3F-72D7795AC842}) (Version: 7.1.1.3 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Arma 2: Operation Arrowhead Demo (HKLM-x32\...\Steam App 33970) (Version:  - Bohemia Interactive)
Azteca (x32 Version: 2.2.0.97 - WildTangent) Hidden
Bejeweled 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Bounce Symphony (x32 Version: 2.2.0.97 - WildTangent) Hidden
Build-a-lot (x32 Version: 2.2.0.98 - WildTangent) Hidden
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Graphics Previews Common (x32 Version: 2013.0313.2330.40379 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2013.0313.2330.40379 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2013.0313.2330.40379 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Standard (x32 Version: 2013.0313.2329.40379 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Traditional (x32 Version: 2013.0313.2329.40379 - Advanced Micro Devices, Inc.) Hidden
CCC Help Czech (x32 Version: 2013.0313.2329.40379 - Advanced Micro Devices, Inc.) Hidden
CCC Help Danish (x32 Version: 2013.0313.2329.40379 - Advanced Micro Devices, Inc.) Hidden
CCC Help Dutch (x32 Version: 2013.0313.2329.40379 - Advanced Micro Devices, Inc.) Hidden
CCC Help English (x32 Version: 2013.0313.2329.40379 - Advanced Micro Devices, Inc.) Hidden
CCC Help Finnish (x32 Version: 2013.0313.2329.40379 - Advanced Micro Devices, Inc.) Hidden
CCC Help French (x32 Version: 2013.0313.2329.40379 - Advanced Micro Devices, Inc.) Hidden
CCC Help German (x32 Version: 2013.0313.2329.40379 - Advanced Micro Devices, Inc.) Hidden
CCC Help Greek (x32 Version: 2013.0313.2329.40379 - Advanced Micro Devices, Inc.) Hidden
CCC Help Hungarian (x32 Version: 2013.0313.2329.40379 - Advanced Micro Devices, Inc.) Hidden
CCC Help Italian (x32 Version: 2013.0313.2329.40379 - Advanced Micro Devices, Inc.) Hidden
CCC Help Japanese (x32 Version: 2013.0313.2329.40379 - Advanced Micro Devices, Inc.) Hidden
CCC Help Korean (x32 Version: 2013.0313.2329.40379 - Advanced Micro Devices, Inc.) Hidden
CCC Help Norwegian (x32 Version: 2013.0313.2329.40379 - Advanced Micro Devices, Inc.) Hidden
CCC Help Polish (x32 Version: 2013.0313.2329.40379 - Advanced Micro Devices, Inc.) Hidden
CCC Help Portuguese (x32 Version: 2013.0313.2329.40379 - Advanced Micro Devices, Inc.) Hidden
CCC Help Russian (x32 Version: 2013.0313.2329.40379 - Advanced Micro Devices, Inc.) Hidden
CCC Help Spanish (x32 Version: 2013.0313.2329.40379 - Advanced Micro Devices, Inc.) Hidden
CCC Help Swedish (x32 Version: 2013.0313.2329.40379 - Advanced Micro Devices, Inc.) Hidden
CCC Help Thai (x32 Version: 2013.0313.2329.40379 - Advanced Micro Devices, Inc.) Hidden
CCC Help Turkish (x32 Version: 2013.0313.2329.40379 - Advanced Micro Devices, Inc.) Hidden
ccc-utility64 (Version: 2013.0313.2330.40379 - Advanced Micro Devices, Inc.) Hidden
Consumer Input Update Helper (x32 Version: 1.3.25.131 - Compete Inc.) Hidden
Cradle Of Egypt Collector's Edition (x32 Version: 2.2.0.110 - WildTangent) Hidden
Cradle of Rome 2 (x32 Version: 2.2.0.98 - WildTangent) Hidden
Curse at Twilight (x32 Version: 3.0.2.32 - WildTangent) Hidden
CyberLink LabelPrint (HKLM-x32\...\InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.5.3.5901 - CyberLink Corp.)
CyberLink LabelPrint (x32 Version: 2.5.3.5901 - CyberLink Corp.) Hidden
CyberLink Media Suite 10 (HKLM-x32\...\InstallShield_{1FBF6C24-C1fD-4101-A42B-0C564F9E8E79}) (Version: 10.0.3.2608 - CyberLink Corp.)
CyberLink Media Suite 10 (x32 Version: 10.0.3.2608 - CyberLink Corp.) Hidden
CyberLink Power2Go 8 (HKLM-x32\...\InstallShield_{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}) (Version: 8.0.3.2527 - CyberLink Corp.)
CyberLink Power2Go 8 (x32 Version: 8.0.3.2527 - CyberLink Corp.) Hidden
CyberLink PowerDVD (HKLM-x32\...\InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}) (Version: 10.0.8.5108 - CyberLink Corp.)
CyberLink PowerDVD (x32 Version: 10.0.8.5108 - CyberLink Corp.) Hidden
CyberLink YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 3.5.6.6119 - CyberLink Corp.)
CyberLink YouCam (x32 Version: 3.5.6.6119 - CyberLink Corp.) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Delicious: Emily's Childhood Memories Premium Edition (x32 Version: 3.0.2.32 - WildTangent) Hidden
Energy Star (HKLM-x32\...\{FC0ADA4D-8FA5-4452-8AFF-F0A0BAC97EF7}) (Version: 1.0.9 - Hewlett-Packard Company)
Farm Frenzy (x32 Version: 2.2.0.98 - WildTangent) Hidden
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 36.0.1985.125 - Google Inc.)
Governor of Poker 2 Premium Edition (x32 Version: 2.2.0.110 - WildTangent) Hidden
Hewlett-Packard ACLM.NET v1.2.1.1 (x32 Version: 1.00.0000 - Hewlett-Packard Company) Hidden
House of 1000 Doors: Family Secrets (x32 Version: 2.2.0.98 - WildTangent) Hidden
HP Customer Experience Enhancements (x32 Version: 6.0.1.7 - Hewlett-Packard) Hidden
HP Documentation (HKLM-x32\...\{8C1ADF61-4F87-44BC-804C-C20FC70D98BB}) (Version: 1.4.0.0 - Hewlett-Packard)
HP MyRoom (HKLM-x32\...\{9C35EDE5-4B0F-45E7-A438-314BA889948E}) (Version: 9.0.0.0 - Hewlett-Packard Company)
HP Postscript Converter (Version: 4.0.4100 - Hewlett-Packard) Hidden
HP Quick Start (HKLM-x32\...\{574F0207-8E98-46CD-8F79-318348C98C46}) (Version: 1.0.4660.30220 - Hewlett-Packard)
HP Recovery Manager (x32 Version: 9.00 - Hewlett-Packard) Hidden
HP Registration Service (HKLM\...\{D1E8F2D7-7794-4245-B286-87ED86C1893C}) (Version: 1.2.6317.4309 - Hewlett-Packard)
HP Support Assistant (HKLM-x32\...\{EE202411-2C26-49E8-9784-1BC1DBF7DE96}) (Version: 7.0.39.15 - Hewlett-Packard Company)
HP System Event Utility (HKLM-x32\...\{B2F0406F-1609-489A-8626-7DB46776AB57}) (Version: 1.0.5 - Hewlett-Packard Company)
HP Utility Center (HKLM\...\{73237EBB-B26F-4628-8754-4EFE563D72E9}) (Version: 2.1.5 - Hewlett-Packard Company)
HP Wireless Button Driver (HKLM-x32\...\{941DE69D-6CEE-4171-8F1F-3D7E352AA498}) (Version: 1.0.6.1 - Hewlett-Packard Company)
iExplorer 3.2.5.2 (HKLM-x32\...\{7FD8B0C1-CDDA-4B4D-A577-B2E3570EA3A3}_is1) (Version:  - Macroplant LLC)
iTunes (HKLM\...\{5A68A656-979F-4168-8795-E2E368AA4DC2}) (Version: 11.2.2.3 - Apple Inc.)
Java 7 Update 51 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217045FF}) (Version: 7.0.510 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
Jewel Match 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden
Luxor Evolved (x32 Version: 2.2.0.98 - WildTangent) Hidden
Mah Jong Medley (x32 Version: 2.2.0.95 - WildTangent) Hidden
Mahjongg Dimensions Deluxe: Tiles in Time (x32 Version: 2.2.0.98 - WildTangent) Hidden
McAfee Online Backup (Version: 1.16.4.0 - McAfee, Inc.) Hidden
McAfee Online Backup (x32 Version:  - McAfee, Inc.) Hidden
McAfee Total Protection (HKLM-x32\...\MSC) (Version: 12.8.958 - McAfee, Inc.)
Microsoft App Update for microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe (x64) (Version: 1.0.0.0 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Office 365 - en-us (HKLM\...\O365HomePremRetail - en-us) (Version: 15.0.4631.1002 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.30319 (HKLM-x32\...\{196BB40D-1578-3D01-B289-BEFC77A11A1E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (HKLM-x32\...\{95716cce-fc71-413f-8ad5-56c2892d4b3a}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.61030 (Version: 11.0.61030 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.61030 (Version: 11.0.61030 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.60610 (x32 Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.60610 (x32 Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (x32 Version: 12.0.21005 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (x32 Version: 12.0.21005 - Microsoft Corporation) Hidden
Movie Maker (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT110 (x32 Version: 16.4.1108.0727 - Microsoft) Hidden
MSVCRT110_amd64 (Version: 16.4.1109.0912 - Microsoft) Hidden
Mystery P.I. - Curious Case of Counterfeit Cove (x32 Version: 2.2.0.98 - WildTangent) Hidden
NVIDIA PhysX (HKLM-x32\...\{8B922CF8-8A6C-41CE-A858-F1755D7F5D29}) (Version: 9.12.1031 - NVIDIA Corporation)
OEM Application Profile (HKLM-x32\...\{C89A97B6-F991-EBB5-77B7-927BCF420EBE}) (Version: 1.00.0000 - Advanced Micro Devices, Inc.)
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4631.1002 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4631.1002 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4631.1002 - Microsoft Corporation) Hidden
Peggle Nights (x32 Version: 2.2.0.98 - WildTangent) Hidden
Photo Gallery (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.98 - WildTangent) Hidden
Polar Bowler (x32 Version: 2.2.0.97 - WildTangent) Hidden
Qualcomm Atheros Driver Installation Program (HKLM-x32\...\{C3A32068-8AB1-4327-BB16-BED9C6219DC7}) (Version: 10.0 - Qualcomm Atheros)
QuickTime (HKLM-x32\...\{0E64B098-8018-4256-BA23-C316A43AD9B0}) (Version: 7.72.80.56 - Apple Inc.)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.10.1226.2012 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6849 - Realtek Semiconductor Corp.)
Realtek PCIE Card Reader (HKLM-x32\...\{0D61A55C-3ADC-409F-BF5B-A1766D1F5944}) (Version: 6.2.9200.29053 - Realtek Semiconductor Corp.)
Roads of Rome 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden
ROBLOX Player for jespi_000 (HKCU\...\{373B1718-8CC5-4567-8EE2-9033AD08A680}) (Version:  - ROBLOX Corporation)
Royal Envoy 2 Collector's Edition (x32 Version: 3.0.2.32 - WildTangent) Hidden
Steam (HKLM-x32\...\Steam) (Version:  - Valve Corporation)
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 16.6.1.3 - Synaptics Incorporated)
Tales of Lagoona (x32 Version: 2.2.0.110 - WildTangent) Hidden
Team Fortress 2 (HKLM-x32\...\Steam App 440) (Version:  - Valve)
Tunngle beta (HKLM-x32\...\Tunngle beta_is1) (Version:  - Tunngle.net GmbH)
Unity Web Player (HKCU\...\UnityWebPlayer) (Version:  - Unity Technologies ApS)
Update Installer for WildTangent Games App (x32 Version:  - WildTangent) Hidden
Vacation Quest™ - Australia (x32 Version: 3.0.2.32 - WildTangent) Hidden
Warframe (HKLM-x32\...\Steam App 230410) (Version:  - Digital Extremes)
WildTangent Games (HKLM-x32\...\WildTangent wildgames Master Uninstall) (Version: 1.0.4.0 - WildTangent)
WildTangent Games App (HP Games) (x32 Version: 4.0.10.5 - WildTangent) Hidden
Windows Live Communications Platform (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3505.0912 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
WinRAR 5.01 (32-bit) (HKLM-x32\...\WinRAR archiver) (Version: 5.01.0 - win.rar GmbH)
Youda Jewel Shop (x32 Version: 3.0.2.32 - WildTangent) Hidden
Zuma's Revenge (x32 Version: 2.2.0.98 - WildTangent) Hidden
 
==================== Custom CLSID (selected items): ==========================
 
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
 
 
==================== Restore Points  =========================
 
Could not list Restore Points. Check "winmgmt" service or repair WMI.
 
 
==================== Hosts content: ==========================
 
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 
2012-07-25 23:26 - 2012-07-25 23:26 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
 
==================== Scheduled Tasks (whitelisted) =============
 
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
 
Task: C:\Windows\Tasks\bench-S-1-5-21-3436019999-1338614278-3438539980-1002.job => ?
Task: C:\Windows\Tasks\bench-sys.job => ?
Task: C:\Windows\Tasks\CIMT_S-1-5-21-3436019999-1338614278-3438539980-1002.job => ?
Task: C:\Windows\Tasks\ConsumerInputUpdateTaskMachineCore.job => ?
Task: C:\Windows\Tasks\ConsumerInputUpdateTaskMachineUA.job => ?
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => ?
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => ?
 
==================== Loaded Modules (whitelisted) =============
 
2014-07-10 12:20 - 2014-05-20 10:19 - 08892072 _____ () C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\1033\GrooveIntlResource.dll
2013-03-14 00:41 - 2013-03-14 00:41 - 00103424 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Proxy.Native.dll
 
==================== Alternate Data Streams (whitelisted) =========
 
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
 
 
==================== Safe Mode (whitelisted) ===================
 
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\McMPFSvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MCODS => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefire => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefirek => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefirek.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfehidk => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfehidk.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfevtp => ""="Driver"
 
==================== EXE Association (whitelisted) =============
 
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
 
 
==================== MSCONFIG/TASK MANAGER disabled items =========
 
(Currently there is no automatic fix for this section.)
 
HKLM\...\StartupApproved\Run32: => "APSDaemon"
HKLM\...\StartupApproved\Run32: => "SunJavaUpdateSched"
 
==================== Faulty Device Manager Devices =============
 
 
==================== Event log errors: =========================
 
Application errors:
==================
Error: (08/06/2014 04:49:42 PM) (Source: ESENT) (EventID: 454) (User: )
Description: SettingSyncHost (2632) {FD3262DD-D315-4A41-8FC8-9A0C26CC0D1E}: Database recovery/restore failed with unexpected error -1216.
 
Error: (08/06/2014 04:49:42 PM) (Source: ESENT) (EventID: 494) (User: )
Description: SettingSyncHost (2632) {FD3262DD-D315-4A41-8FC8-9A0C26CC0D1E}: Database recovery failed with error -1216 because it encountered references to a database, 'C:\Users\jespi_000\AppData\Local\Microsoft\Windows\SettingSync\metastore\meta.edb', which is no longer present. The database was not brought to a Clean Shutdown state before it was removed (or possibly moved or renamed). The database engine will not permit recovery to complete for this instance until the missing database is re-instated. If the database is truly no longer available and no longer required, procedures for recovering from this error are available in the Microsoft Knowledge Base or by following the "more information" link at the bottom of this message.
 
Error: (08/06/2014 04:49:12 PM) (Source: ESENT) (EventID: 454) (User: )
Description: SettingSyncHost (2632) {A1A0DFE3-F9D2-4A23-986B-48B73CB19D2E}: Database recovery/restore failed with unexpected error -1216.
 
Error: (08/06/2014 04:49:12 PM) (Source: ESENT) (EventID: 494) (User: )
Description: SettingSyncHost (2632) {A1A0DFE3-F9D2-4A23-986B-48B73CB19D2E}: Database recovery failed with error -1216 because it encountered references to a database, 'C:\Users\jespi_000\AppData\Local\Microsoft\Windows\SettingSync\metastore\meta.edb', which is no longer present. The database was not brought to a Clean Shutdown state before it was removed (or possibly moved or renamed). The database engine will not permit recovery to complete for this instance until the missing database is re-instated. If the database is truly no longer available and no longer required, procedures for recovering from this error are available in the Microsoft Knowledge Base or by following the "more information" link at the bottom of this message.
 
Error: (08/06/2014 04:48:41 PM) (Source: ESENT) (EventID: 454) (User: )
Description: SettingSyncHost (2632) {3F371E01-B232-4E6E-9C0D-0792DDCC184C}: Database recovery/restore failed with unexpected error -1216.
 
Error: (08/06/2014 04:48:41 PM) (Source: ESENT) (EventID: 494) (User: )
Description: SettingSyncHost (2632) {3F371E01-B232-4E6E-9C0D-0792DDCC184C}: Database recovery failed with error -1216 because it encountered references to a database, 'C:\Users\jespi_000\AppData\Local\Microsoft\Windows\SettingSync\metastore\meta.edb', which is no longer present. The database was not brought to a Clean Shutdown state before it was removed (or possibly moved or renamed). The database engine will not permit recovery to complete for this instance until the missing database is re-instated. If the database is truly no longer available and no longer required, procedures for recovering from this error are available in the Microsoft Knowledge Base or by following the "more information" link at the bottom of this message.
 
Error: (08/06/2014 04:48:15 PM) (Source: ESENT) (EventID: 454) (User: )
Description: SettingSyncHost (2632) {6D244874-56F5-4072-A63D-2A1CC6977278}: Database recovery/restore failed with unexpected error -1216.
 
Error: (08/06/2014 04:48:15 PM) (Source: ESENT) (EventID: 494) (User: )
Description: SettingSyncHost (2632) {6D244874-56F5-4072-A63D-2A1CC6977278}: Database recovery failed with error -1216 because it encountered references to a database, 'C:\Users\jespi_000\AppData\Local\Microsoft\Windows\SettingSync\metastore\meta.edb', which is no longer present. The database was not brought to a Clean Shutdown state before it was removed (or possibly moved or renamed). The database engine will not permit recovery to complete for this instance until the missing database is re-instated. If the database is truly no longer available and no longer required, procedures for recovering from this error are available in the Microsoft Knowledge Base or by following the "more information" link at the bottom of this message.
 
Error: (08/06/2014 04:48:02 PM) (Source: ESENT) (EventID: 454) (User: )
Description: SettingSyncHost (2632) {9CA5673C-4746-4020-A012-E47998DB20DE}: Database recovery/restore failed with unexpected error -1216.
 
Error: (08/06/2014 04:48:02 PM) (Source: ESENT) (EventID: 494) (User: )
Description: SettingSyncHost (2632) {9CA5673C-4746-4020-A012-E47998DB20DE}: Database recovery failed with error -1216 because it encountered references to a database, 'C:\Users\jespi_000\AppData\Local\Microsoft\Windows\SettingSync\metastore\meta.edb', which is no longer present. The database was not brought to a Clean Shutdown state before it was removed (or possibly moved or renamed). The database engine will not permit recovery to complete for this instance until the missing database is re-instated. If the database is truly no longer available and no longer required, procedures for recovering from this error are available in the Microsoft Knowledge Base or by following the "more information" link at the bottom of this message.
 
 
System errors:
=============
Error: (08/06/2014 04:47:08 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The McAfee SiteAdvisor Service service failed to start due to the following error: 
%%1053
 
Error: (08/06/2014 04:47:08 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the McAfee SiteAdvisor Service service to connect.
 
Error: (08/06/2014 04:47:07 PM) (Source: DCOM) (EventID: 10005) (User: NT AUTHORITY)
Description: 1053McAfee SiteAdvisor ServiceUnavailable{5A90F5EE-16B8-4C2A-81B3-FD5329BA477C}
 
Error: (08/06/2014 04:47:07 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The McAfee SiteAdvisor Service service failed to start due to the following error: 
%%1053
 
Error: (08/06/2014 04:47:07 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the McAfee SiteAdvisor Service service to connect.
 
Error: (08/06/2014 04:35:31 PM) (Source: DCOM) (EventID: 10010) (User: NT AUTHORITY)
Description: {209500FC-6B45-4693-8871-6296C4843751}
 
Error: (07/30/2014 01:01:52 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The ConsumerInput Update Service (consumerinput_update) service failed to start due to the following error: 
%%1053
 
Error: (07/30/2014 01:01:52 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the ConsumerInput Update Service (consumerinput_update) service to connect.
 
Error: (07/30/2014 01:01:33 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: The previous system shutdown at 12:50:22 PM on ‎7/‎30/‎2014 was unexpected.
 
Error: (07/30/2014 00:57:26 PM) (Source: DCOM) (EventID: 10010) (User: NT AUTHORITY)
Description: {6DFC2D17-579D-4C1C-93B7-B05B7DCCD766}
 
 
Microsoft Office Sessions:
=========================
Error: (08/06/2014 04:49:42 PM) (Source: ESENT) (EventID: 454) (User: )
Description: SettingSyncHost2632{FD3262DD-D315-4A41-8FC8-9A0C26CC0D1E}: -1216
 
Error: (08/06/2014 04:49:42 PM) (Source: ESENT) (EventID: 494) (User: )
Description: SettingSyncHost2632{FD3262DD-D315-4A41-8FC8-9A0C26CC0D1E}: -1216C:\Users\jespi_000\AppData\Local\Microsoft\Windows\SettingSync\metastore\meta.edb
 
Error: (08/06/2014 04:49:12 PM) (Source: ESENT) (EventID: 454) (User: )
Description: SettingSyncHost2632{A1A0DFE3-F9D2-4A23-986B-48B73CB19D2E}: -1216
 
Error: (08/06/2014 04:49:12 PM) (Source: ESENT) (EventID: 494) (User: )
Description: SettingSyncHost2632{A1A0DFE3-F9D2-4A23-986B-48B73CB19D2E}: -1216C:\Users\jespi_000\AppData\Local\Microsoft\Windows\SettingSync\metastore\meta.edb
 
Error: (08/06/2014 04:48:41 PM) (Source: ESENT) (EventID: 454) (User: )
Description: SettingSyncHost2632{3F371E01-B232-4E6E-9C0D-0792DDCC184C}: -1216
 
Error: (08/06/2014 04:48:41 PM) (Source: ESENT) (EventID: 494) (User: )
Description: SettingSyncHost2632{3F371E01-B232-4E6E-9C0D-0792DDCC184C}: -1216C:\Users\jespi_000\AppData\Local\Microsoft\Windows\SettingSync\metastore\meta.edb
 
Error: (08/06/2014 04:48:15 PM) (Source: ESENT) (EventID: 454) (User: )
Description: SettingSyncHost2632{6D244874-56F5-4072-A63D-2A1CC6977278}: -1216
 
Error: (08/06/2014 04:48:15 PM) (Source: ESENT) (EventID: 494) (User: )
Description: SettingSyncHost2632{6D244874-56F5-4072-A63D-2A1CC6977278}: -1216C:\Users\jespi_000\AppData\Local\Microsoft\Windows\SettingSync\metastore\meta.edb
 
Error: (08/06/2014 04:48:02 PM) (Source: ESENT) (EventID: 454) (User: )
Description: SettingSyncHost2632{9CA5673C-4746-4020-A012-E47998DB20DE}: -1216
 
Error: (08/06/2014 04:48:02 PM) (Source: ESENT) (EventID: 494) (User: )
Description: SettingSyncHost2632{9CA5673C-4746-4020-A012-E47998DB20DE}: -1216C:\Users\jespi_000\AppData\Local\Microsoft\Windows\SettingSync\metastore\meta.edb
 
 
==================== Memory info =========================== 
 
Percentage of memory in use: 66%
Total physical RAM: 3682.26 MB
Available physical RAM: 1243.14 MB
Total Pagefile: 5410.26 MB
Available Pagefile: 2668.52 MB
Total Virtual: 8192 MB
Available Virtual: 8191.79 MB
 
==================== Drives ================================
 
Drive c: (Windows) (Fixed) (Total:443.03 GB) (Free:383.02 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (RECOVERY) (Fixed) (Total:21.96 GB) (Free:2.23 GB) NTFS ==>[System with boot components (obtained from reading drive)]
 
==================== MBR & Partition Table ==================
 
==================== End Of Log ============================

Edited by Jespinosa101, 06 August 2014 - 06:14 PM.


#3 HelpBot

HelpBot

    Bleepin' Binary Bot


  • Bots
  • 12,769 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:08:58 PM

Posted 11 August 2014 - 06:10 PM

Hello and welcome to Bleeping Computer!

I am HelpBot: an automated program designed to help the Bleeping Computer Staff better assist you! This message contains very important information, so please read through all of it before doing anything.

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

To help Bleeping Computer better assist you please perform the following steps:

***************************************************

step1.gif In order to continue receiving help at BleepingComputer.com, YOU MUST tell me if you still need help or if your issue has already been resolved on your own or through another resource! To tell me this, please click on the following link and follow the instructions there.

CLICK THIS LINK >>> http://www.bleepingcomputer.com/logreply/543566 <<< CLICK THIS LINK



If you no longer need help, then all you needed to do was the previous instructions of telling me so. You can skip the rest of this post. If you do need help please continue with Step 2 below.

***************************************************

step2.gifIf you still need help, I would like you to post a Reply to this topic (click the "Add Reply" button in the lower right hand of this page). In that reply, please include the following information:

  • If you have not done so already, include a clear description of the problems you're having, along with any steps you may have performed so far.
  • A new DDS log. For your convenience, you will find the instructions for generating these logs repeated at the bottom of this post.
    • Please do this even if you have previously posted logs for us.
    • If you were unable to produce the logs originally please try once more.
    • If you are unable to create a log please provide detailed information about your installed Windows Operating System including the Version, Edition and if it is a 32bit or a 64bit system.
    • If you are unsure about any of these characteristics just post what you can and we will guide you.
  • Please tell us if you have your original Windows CD/DVD available.
  • Upon completing the above steps and posting a reply, another staff member will review your topic and do their best to resolve your issues.

Thank you for your patience, and again sorry for the delay.

***************************************************

We need to see some information about what is happening in your machine. Please perform the following scan again:

  • Download DDS by sUBs from the following link if you no longer have it available and save it to your destop.

    DDS.com Download Link
  • Double click on the DDS icon, allow it to run.
  • A small box will open, with an explanation about the tool. No input is needed, the scan is running.
  • Notepad will open with the results.
  • Follow the instructions that pop up for posting the results.
  • Close the program window, and delete the program from your desktop.
Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet.

Information on A/V control can be found HERE.

As I am just a silly little program running on the BleepingComputer.com servers, please do not send me private messages as I do not know how to read and reply to them! Thanks!

#4 Jespinosa101

Jespinosa101
  • Topic Starter

  • Members
  • 54 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:58 PM

Posted 11 August 2014 - 10:35 PM

Hi and yes I do still need help my problem is that I accidentally downloaded a Trojan and I tried to delete it which I thought it was deleted but after a period of time about a few months my pc starts to get slower and slower then my pc says I got adware so I deleted some suspicious files from my pc and my internet or searching speed gets faster but not fast as used to so then I decide to use malwarebytes because I heard it was pretty good so I do a full scan and I get a lot of pup stuff on my scan so I delete them and it says to reboot my pc so I do as it said and then my pc says automatic repair and then after a few minutes my pc says diagnosing pc and then I get a blue screen saying sorry pc couldn't repair your computer and then it starts doing the automatic repair loop and then to get out of the loop I do a system restore to one of my downloads and it gets out of the loop and back to the windows login screen and now I'm afraid to restart my pc and afraid to use malwarebytes due to the automatic repair loop thing. I cant post a DDS log due to it not being compatible to my pc if you'd like me to post a farbar recovery scan just tell me and I will do a scan and post the logs and I have no CDs or DVDs my pc did not come with them

Thanks in advance
Jespinosa101

#5 nasdaq

nasdaq

  • Malware Response Team
  • 40,749 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:07:58 PM

Posted 13 August 2014 - 12:39 PM

Hello, Welcome to BleepingComputer.
I'm nasdaq and will be helping you.

If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed.
===

Open notepad (Start =>All Programs => Accessories => Notepad). Please copy the entire contents of the code box below.
 
start
HKLM-x32\...\Run: [mobilegeni daemon] => C:\Program Files (x86)\Mobogenie\DaemonProcess.exe
HKLM-x32\...\RunOnce: [Deal-Dropper-repairJob] => wscript.exe "C:\Users\Greg\AppData\Local\Deal-Dropper\repair.js" "Deal-Dropper-repairJob"
ShellIconOverlayIdentifiers:  SkyDrive1 -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  No File
ShellIconOverlayIdentifiers:  SkyDrive2 -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  No File
ShellIconOverlayIdentifiers:  SkyDrive3 -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  No File
ShellIconOverlayIdentifiers-x32:  SkyDrive1 -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  No File
ShellIconOverlayIdentifiers-x32:  SkyDrive2 -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  No File
ShellIconOverlayIdentifiers-x32:  SkyDrive3 -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  No File
SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=irmsd0101&cd=2XzuyEtN2Y1L1Qzuzy0C0ByCyDyEyEtBtB0AyCtDzztDyBzytN0D0Tzu0CyBtAtCtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1B1P1R&cr=1643944114&ir=
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=irmsd0101&cd=2XzuyEtN2Y1L1Qzuzy0C0ByCyDyEyEtBtB0AyCtDzztDyBzytN0D0Tzu0CyBtAtCtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1B1P1R&cr=1643944114&ir=
SearchScopes: HKLM-x32 - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=CPNTDFJS
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=CPNTDFJS
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=CPNTDFJS
BHO: Deal-Dropper BHO -> {41708E47-E97E-4051-A609-B88B398BCC94} -> C:\Program Files (x86)\Deal-Dropper\FrameworkBHO64.dll ()
BHO-x32: Deal-Dropper BHO -> {41708E47-E97E-4051-A609-B88B398BCC94} -> C:\Program Files (x86)\Deal-Dropper\FrameworkBHO.dll ()
BHO-x32: Jump Flip -> {6db9fdfe-b718-4962-be0c-0a5fce7f7f7b} -> C:\Program Files (x86)\Jump Flip\JumpFlipbho.dll ()
BHO-x32: Consumer Input DCA BHO -> {B49699FC-1665-4414-A1CB-C4A2A4A13EEC} -> C:\Program Files (x86)\Consumer Input\InternetExplorer\dca-bho.dll ()
Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File
CHR Extension: (Extutil) - C:\Users\JESPI_~1\AppData\Local\Temp\D7ADFCCA-EE7E-442C-9999-C4D14FEF360B [2014-04-21]
CHR Extension: (Managera) - C:\Users\JESPI_~1\AppData\Local\Temp\38fdaae5-8e0e-493c-88ec-e05c3be06e42 [2014-04-21]
CHR HKLM\...\Chrome\Extension: [pflphaooapbgpeakohlggbpidpppgdff] - C:\Users\Greg\AppData\Local\mysearchdial-speeddial.crx [2014-04-21]
CHR HKLM-x32\...\Chrome\Extension: [hphehadppenpmajgnkjdcopcfijjegaf] - C:\Program Files (x86)\Jump Flip\hphehadppenpmajgnkjdcopcfijjegaf.crx [2014-04-21]
CHR HKLM-x32\...\Chrome\Extension: [pflphaooapbgpeakohlggbpidpppgdff] - C:\Users\Greg\AppData\Local\mysearchdial-speeddial.crx [2014-04-21]
S2 consumerinput_update; C:\Program Files (x86)\Consumer Input\Update\ConsumerInputUpdate.exe [106296 2014-01-14] (ConsumerInput)
S3 consumerinput_updatem; C:\Program Files (x86)\Consumer Input\Update\ConsumerInputUpdate.exe [106296 2014-01-14] (ConsumerInput)
S1 hlnfd; system32\drivers\hlnfd.sys [X]
C:\Program Files (x86)\Mobogenie
C:\Program Files (x86)\Deal-Dropper
C:\Program Files (x86)\Jump Flip
C:\Program Files (x86)\Consumer Input
C:\Users\JESPI_~1\AppData\Local\Temp\38fdaae5-8e0e-493c-88ec-e05c3be06e42
C:\Users\JESPI_~1\AppData\Local\Temp\D7ADFCCA-EE7E-442C-9999-C4D14FEF360B
C:\Users\Greg\AppData\Local\mysearchdial-speeddial.crx

End
Save the files as fixlist.txt into the same folder as FRST

Run FRST and click Fix only once and wait.

Restart the computer normally to reset the registry.

The tool will create a log (Fixlog.txt) please post it to your reply.


Please download AdwCleaner by Xplode onto your Desktop.
  • Close all open programs and internet browsers.
  • Double click on AdwCleaner.exe to run the tool.
  • Click the Scan button and wait for the process to complete.
  • Click the Report button and the report will open in Notepad.
IMPORTANT
  • If you click the Clean button all items listed in the report will be removed.
If you find some false positive items or programs that you wish to keep, Close the AdwCleaner windows.
  • Close all open programs and internet browsers.
  • Double click on AdwCleaner.exe to run the tool.
  • Click the Scan button and wait for the process to complete.
  • Check off the element(s) you wish to keep.
  • Click on the Clean button follow the prompts.
  • A log file will automatically open after the scan has finished.
  • Please post the content of that log file with your next answer.
  • You can find the log file at C:\AdwCleaner[Sn].txt (n is a number).
===

Please paste the logs in your next reply DO NOT ATTACH THEM unless specified.
To attach a file select the "More Reply Option" and follow the instructions.

Let me know what problem persists.

#6 Jespinosa101

Jespinosa101
  • Topic Starter

  • Members
  • 54 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:58 PM

Posted 13 August 2014 - 04:48 PM

I'm afraid of restarting and getting automatic repair is there any history of that happening to the FRST or the AdwCleaner when people restart oh and I believe I got a rootkit because I did a scan with mcafee and it said rootkit but it did not see it as a threat or a problem

Edited by Jespinosa101, 13 August 2014 - 04:59 PM.


#7 Jespinosa101

Jespinosa101
  • Topic Starter

  • Members
  • 54 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:58 PM

Posted 13 August 2014 - 05:17 PM

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 13-08-2014 01
Ran by jespi_000 at 2014-08-13 16:09:12 Run:1
Running from C:\Users\jespi_000\Downloads\FRST
Boot Mode: Normal
==============================================
 
Content of fixlist:
*****************
start
HKLM-x32\...\Run: [mobilegeni daemon] => C:\Program Files (x86)\Mobogenie\DaemonProcess.exe
HKLM-x32\...\RunOnce: [Deal-Dropper-repairJob] => wscript.exe "C:\Users\Greg\AppData\Local\Deal-Dropper\repair.js" "Deal-Dropper-repairJob"
ShellIconOverlayIdentifiers:  SkyDrive1 -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  No File
ShellIconOverlayIdentifiers:  SkyDrive2 -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  No File
ShellIconOverlayIdentifiers:  SkyDrive3 -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  No File
ShellIconOverlayIdentifiers-x32:  SkyDrive1 -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  No File
ShellIconOverlayIdentifiers-x32:  SkyDrive2 -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  No File
ShellIconOverlayIdentifiers-x32:  SkyDrive3 -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  No File
SearchScopes: HKLM-x32 - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=CPNTDFJS
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=CPNTDFJS
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=CPNTDFJS
BHO: Deal-Dropper BHO -> {41708E47-E97E-4051-A609-B88B398BCC94} -> C:\Program Files (x86)\Deal-Dropper\FrameworkBHO64.dll ()
BHO-x32: Deal-Dropper BHO -> {41708E47-E97E-4051-A609-B88B398BCC94} -> C:\Program Files (x86)\Deal-Dropper\FrameworkBHO.dll ()
BHO-x32: Jump Flip -> {6db9fdfe-b718-4962-be0c-0a5fce7f7f7b} -> C:\Program Files (x86)\Jump Flip\JumpFlipbho.dll ()
BHO-x32: Consumer Input DCA BHO -> {B49699FC-1665-4414-A1CB-C4A2A4A13EEC} -> C:\Program Files (x86)\Consumer Input\InternetExplorer\dca-bho.dll ()
Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File
CHR Extension: (Extutil) - C:\Users\JESPI_~1\AppData\Local\Temp\D7ADFCCA-EE7E-442C-9999-C4D14FEF360B [2014-04-21]
CHR Extension: (Managera) - C:\Users\JESPI_~1\AppData\Local\Temp\38fdaae5-8e0e-493c-88ec-e05c3be06e42 [2014-04-21]
CHR HKLM\...\Chrome\Extension: [pflphaooapbgpeakohlggbpidpppgdff] - C:\Users\Greg\AppData\Local\mysearchdial-speeddial.crx [2014-04-21]
CHR HKLM-x32\...\Chrome\Extension: [hphehadppenpmajgnkjdcopcfijjegaf] - C:\Program Files (x86)\Jump Flip\hphehadppenpmajgnkjdcopcfijjegaf.crx [2014-04-21]
CHR HKLM-x32\...\Chrome\Extension: [pflphaooapbgpeakohlggbpidpppgdff] - C:\Users\Greg\AppData\Local\mysearchdial-speeddial.crx [2014-04-21]
S2 consumerinput_update; C:\Program Files (x86)\Consumer Input\Update\ConsumerInputUpdate.exe [106296 2014-01-14] (ConsumerInput)
S3 consumerinput_updatem; C:\Program Files (x86)\Consumer Input\Update\ConsumerInputUpdate.exe [106296 2014-01-14] (ConsumerInput)
S1 hlnfd; system32\drivers\hlnfd.sys [X]
C:\Program Files (x86)\Mobogenie
C:\Program Files (x86)\Deal-Dropper
C:\Program Files (x86)\Jump Flip
C:\Program Files (x86)\Consumer Input
C:\Users\JESPI_~1\AppData\Local\Temp\38fdaae5-8e0e-493c-88ec-e05c3be06e42
C:\Users\JESPI_~1\AppData\Local\Temp\D7ADFCCA-EE7E-442C-9999-C4D14FEF360B
C:\Users\Greg\AppData\Local\mysearchdial-speeddial.crx
 
End
*****************
 
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\mobilegeni daemon => Value could not be deleted.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\\Deal-Dropper-repairJob => Value could not be deleted.
"HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ SkyDrive1" => Error deleting key. The key could be protected.
"HKCR\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}" => Key not found.
"HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ SkyDrive2" => Error deleting key. The key could be protected.
"HKCR\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}" => Key not found.
"HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ SkyDrive3" => Error deleting key. The key could be protected.
"HKCR\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}" => Key not found.
"HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ SkyDrive1" => Error deleting key. The key could be protected.
"HKCR\Wow6432Node\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}" => Key not found.
"HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ SkyDrive2" => Error deleting key. The key could be protected.
"HKCR\Wow6432Node\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}" => Key not found.
"HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ SkyDrive3" => Error deleting key. The key could be protected.
"HKCR\Wow6432Node\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}" => Key not found.
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Error setting value.
 
"HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes"
 
Listing permissions failed. Access Denied.
"HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" => Error deleting key. The key could be protected.
"HKCR\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" => Key not found.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Error setting value.
 
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes"
 
Listing permissions failed. Access Denied.
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" => Error deleting key. The key could be protected.
"HKCR\Wow6432Node\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" => Key not found.
"HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" => Key not found.
"HKCR\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" => Key not found.
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{41708E47-E97E-4051-A609-B88B398BCC94}" => Error deleting key. The key could be protected.
"HKCR\CLSID\{41708E47-E97E-4051-A609-B88B398BCC94}" => Error deleting key. The key could be protected.
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{41708E47-E97E-4051-A609-B88B398BCC94}" => Error deleting key. The key could be protected.
"HKCR\Wow6432Node\CLSID\{41708E47-E97E-4051-A609-B88B398BCC94}" => Key not found.
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6db9fdfe-b718-4962-be0c-0a5fce7f7f7b}" => Error deleting key. The key could be protected.
"HKCR\Wow6432Node\CLSID\{6db9fdfe-b718-4962-be0c-0a5fce7f7f7b}" => Key not found.
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B49699FC-1665-4414-A1CB-C4A2A4A13EEC}" => Error deleting key. The key could be protected.
"HKCR\Wow6432Node\CLSID\{B49699FC-1665-4414-A1CB-C4A2A4A13EEC}" => Key not found.
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} => value deleted successfully.
"HKCR\CLSID\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}" => Key not found.
C:\Users\JESPI_~1\AppData\Local\Temp\D7ADFCCA-EE7E-442C-9999-C4D14FEF360B => Moved successfully.
C:\Users\JESPI_~1\AppData\Local\Temp\38fdaae5-8e0e-493c-88ec-e05c3be06e42 => Moved successfully.
"HKLM\SOFTWARE\Google\Chrome\Extensions\pflphaooapbgpeakohlggbpidpppgdff" => Error deleting key. The key could be protected.
"C:\Users\Greg\AppData\Local\mysearchdial-speeddial.crx" => File/Directory not found.
"HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\hphehadppenpmajgnkjdcopcfijjegaf" => Error deleting key. The key could be protected.
"C:\Program Files (x86)\Jump Flip\hphehadppenpmajgnkjdcopcfijjegaf.crx" => File/Directory not found.
"HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\pflphaooapbgpeakohlggbpidpppgdff" => Error deleting key. The key could be protected.
"C:\Users\Greg\AppData\Local\mysearchdial-speeddial.crx" => File/Directory not found.
consumerinput_update => Error deleting Service
consumerinput_updatem => Error deleting Service
hlnfd => Error deleting Service
"C:\Program Files (x86)\Mobogenie" => File/Directory not found.
 
"C:\Program Files (x86)\Deal-Dropper" directory move:
 
Could not move "C:\Program Files (x86)\Deal-Dropper\background.html" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Deal-Dropper\config.xml" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Deal-Dropper\extension_info.json" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Deal-Dropper\FrameworkBHO.dll" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Deal-Dropper\FrameworkBHO64.dll" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Deal-Dropper\FrameworkEngine.exe" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Deal-Dropper\icon.ico" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Deal-Dropper\icons\button.png" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Deal-Dropper\icons\icon100.png" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Deal-Dropper\icons\icon128.png" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Deal-Dropper\icons\icon32.png" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Deal-Dropper\icons\icon48.png" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Deal-Dropper\framework-ui\browser_button.js" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Deal-Dropper\framework-ui\context_menu.js" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Deal-Dropper\framework-ui\context_menu_item_handler.html" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Deal-Dropper\framework-ui\framework_api.js" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Deal-Dropper\framework-ui\notification.html" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Deal-Dropper\framework-ui\notifications.js" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Deal-Dropper\framework-ui\options.js" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Deal-Dropper\framework-ui\ui_base.js" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Deal-Dropper\framework-ui\theme\bubble\bottom-left.png" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Deal-Dropper\framework-ui\theme\bubble\bottom-middle.png" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Deal-Dropper\framework-ui\theme\bubble\bottom-right.png" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Deal-Dropper\framework-ui\theme\bubble\middle-left.png" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Deal-Dropper\framework-ui\theme\bubble\middle-right.png" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Deal-Dropper\framework-ui\theme\bubble\tail-bottom.png" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Deal-Dropper\framework-ui\theme\bubble\tail-left.png" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Deal-Dropper\framework-ui\theme\bubble\tail-right.png" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Deal-Dropper\framework-ui\theme\bubble\tail-top.png" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Deal-Dropper\framework-ui\theme\bubble\top-left.png" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Deal-Dropper\framework-ui\theme\bubble\top-middle.png" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Deal-Dropper\framework-ui\theme\bubble\top-right.png" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Deal-Dropper\framework\backgroundscript_engine.js" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Deal-Dropper\framework\base.js" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Deal-Dropper\framework\browser.js" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Deal-Dropper\framework\console.js" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Deal-Dropper\framework\framework.js" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Deal-Dropper\framework\global.js" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Deal-Dropper\framework\i18n.js" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Deal-Dropper\framework\initialize.js" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Deal-Dropper\framework\invoke_async.js" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Deal-Dropper\framework\io.js" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Deal-Dropper\framework\json2.js" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Deal-Dropper\framework\lang.js" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Deal-Dropper\framework\legacy.js" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Deal-Dropper\framework\message_target.js" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Deal-Dropper\framework\messaging.js" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Deal-Dropper\framework\storage.js" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Deal-Dropper\framework\timer.js" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Deal-Dropper\framework\updater.js" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Deal-Dropper\framework\userscript_client.js" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Deal-Dropper\framework\userscript_engine.js" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Deal-Dropper\framework\utils.js" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Deal-Dropper\framework\xhr.js" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Deal-Dropper\CanvasFramework\canvasscript_engine.js" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Deal-Dropper\CanvasFramework\canvas_bg.js" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Deal-Dropper\CanvasFramework\md5.js" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Deal-Dropper\CanvasFramework\registry.js" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Deal-Dropper\CanvasFramework\webrequest.js" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Deal-Dropper\AppFramework\appAPI_bg.js" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Deal-Dropper\AppFramework\appAPI_browseraction.js" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Deal-Dropper\AppFramework\appAPI_common.js" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Deal-Dropper\AppFramework\appAPI_content.js" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Deal-Dropper\AppFramework\appAPI_settings.js" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Deal-Dropper\AppFramework\appAPI_webrequest.js" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Deal-Dropper\AppFramework\jquery.min.js" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Deal-Dropper" directory. => Scheduled to move on reboot.
 
 
"C:\Program Files (x86)\Jump Flip" directory move:
 
Could not move "C:\Program Files (x86)\Jump Flip\JumpFlip.ico" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Jump Flip\JumpFlipBHO.dll" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Jump Flip\JumpFlipUninstall.exe" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Jump Flip\sqlite3.exe" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Jump Flip\updateJumpFlip.exe" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Jump Flip" directory. => Scheduled to move on reboot.
 
 
"C:\Program Files (x86)\Consumer Input" directory move:
 
Could not move "C:\Program Files (x86)\Consumer Input\CIuninstall.exe" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Consumer Input\CIuninstall.ico" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Consumer Input\Update\ConsumerInputUpdate.exe" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Consumer Input\Update\Install\{6D07A288-AE9F-4575-8040-B01F4429FA62}\ciff-3.2.0-749.exe" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Consumer Input\Update\Download\{C7B061F6-380E-4545-86E3-400E3156FD28}\0.0.0.0\ciff-3.2.0-749.exe" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Consumer Input\Update\Download\{C7B061F6-380E-4545-86E3-400E3156FD28}\0.0.0.0\ciff-3.2.0-928.exe" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Consumer Input\Update\Download\{B3F80DB8-951F-4A2A-BE2F-ED6F4FF63B98}\0.0.0.0\MonitoringTool-3.2.1-712.exe" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Consumer Input\Update\Download\{B3F80DB8-951F-4A2A-BE2F-ED6F4FF63B98}\0.0.0.0\MonitoringTool-3.2.1-820.exe" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Consumer Input\Update\Download\{B3F80DB8-951F-4A2A-BE2F-ED6F4FF63B98}\0.0.0.0\MonitoringTool-3.2.1-888.exe" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Consumer Input\Update\Download\{B3F80DB8-951F-4A2A-BE2F-ED6F4FF63B98}\0.0.0.0\MonitoringTool-3.2.1-951.exe" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Consumer Input\Update\Download\{1138A907-2253-45D6-99C1-843A0AC58730}\0.0.0.0\ciie-3.2.0-12007.exe" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Consumer Input\Update\Download\{1138A907-2253-45D6-99C1-843A0AC58730}\0.0.0.0\ciie-3.2.0-12153.exe" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Consumer Input\Update\1.3.25.131\ConsumerInputCrashHandler.exe" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Consumer Input\Update\1.3.25.131\ConsumerInputUpdate.exe" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Consumer Input\Update\1.3.25.131\ConsumerInputUpdateBroker.exe" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Consumer Input\Update\1.3.25.131\ConsumerInputUpdateHelper.msi" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Consumer Input\Update\1.3.25.131\ConsumerInputUpdateOnDemand.exe" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Consumer Input\Update\1.3.25.131\goopdate.dll" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Consumer Input\Update\1.3.25.131\goopdateres_de.dll" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Consumer Input\Update\1.3.25.131\goopdateres_en.dll" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Consumer Input\Update\1.3.25.131\goopdateres_es-419.dll" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Consumer Input\Update\1.3.25.131\goopdateres_es.dll" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Consumer Input\Update\1.3.25.131\goopdateres_fr.dll" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Consumer Input\Update\1.3.25.131\goopdateres_ja.dll" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Consumer Input\Update\1.3.25.131\goopdateres_zh-CN.dll" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Consumer Input\Update\1.3.25.131\psmachine.dll" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Consumer Input\Update\1.3.25.131\psuser.dll" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Consumer Input\Monitoring\cinm-host.exe" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Consumer Input\Monitoring\cookie-retriever.exe" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Consumer Input\Monitoring\dca-monitoring.exe" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Consumer Input\Monitoring\uninstall.exe" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Consumer Input\Monitoring\uninstall.ico" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Consumer Input\InternetExplorer\cookie-retriever.exe" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Consumer Input\InternetExplorer\cpturlpassthru.dll" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Consumer Input\InternetExplorer\dca-bho.dll" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Consumer Input\InternetExplorer\dca-host.exe" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Consumer Input\InternetExplorer\dca.js" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Consumer Input\InternetExplorer\logger.dll" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Consumer Input\InternetExplorer\mozjs185-1.0.dll" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Consumer Input\InternetExplorer\uninstall.exe" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Consumer Input\InternetExplorer\uninstall.ico" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Consumer Input\Firefox\uninstall.exe" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Consumer Input\Firefox\uninstall.ico" => Scheduled to move on reboot.
Could not move "C:\Program Files (x86)\Consumer Input" directory. => Scheduled to move on reboot.
 
"C:\Users\JESPI_~1\AppData\Local\Temp\38fdaae5-8e0e-493c-88ec-e05c3be06e42" => File/Directory not found.
"C:\Users\JESPI_~1\AppData\Local\Temp\D7ADFCCA-EE7E-442C-9999-C4D14FEF360B" => File/Directory not found.
"C:\Users\Greg\AppData\Local\mysearchdial-speeddial.crx" => File/Directory not found.


#8 Jespinosa101

Jespinosa101
  • Topic Starter

  • Members
  • 54 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:58 PM

Posted 13 August 2014 - 05:19 PM

I was able to do that scan and now I will see about the AdwCleaner scan if I can do that



#9 Jespinosa101

Jespinosa101
  • Topic Starter

  • Members
  • 54 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:58 PM

Posted 13 August 2014 - 05:52 PM

Here's the AdwCleaner Log

 

# AdwCleaner v3.305 - Report created 13/08/2014 at 16:46:48
# Updated 14/08/2014 by Xplode
# Operating System : Windows 8  (64 bits)
# Username : Greg - JOSHUA_COMPUTER
# Running from : C:\Users\jespi_000\Downloads\adwcleaner_3.305.exe
# Option : Scan
 
***** [ Services ] *****
 
Service Found : hlnfd
 
***** [ Files / Folders ] *****
 
File Found : C:\Users\Greg\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Weather Alerts.lnk
File Found : C:\Users\Greg\daemonprocess.txt
File Found : C:\Users\jespi_000\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.superfish.com_0.localstorage-journal
File Found : C:\Users\jespi_000\daemonprocess.txt
File Found : C:\Users\Public\Desktop\eBay.lnk
Folder Found : C:\Program Files (x86)\Bench
Folder Found : C:\Program Files (x86)\Jump Flip
Folder Found : C:\Program Files (x86)\MyPC Backup
Folder Found : C:\Program Files (x86)\Webinternetsecurity
Folder Found : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Webinternetsecurity
Folder Found : C:\Users\Greg\AppData\Local\genienext
Folder Found : C:\Users\Greg\AppData\Local\Local_Weather_LLC
Folder Found : C:\Users\Greg\AppData\Local\Mobogenie
Folder Found : C:\Users\Greg\AppData\Local\Oxy
Folder Found : C:\Users\Greg\AppData\LocalLow\Mysearchdial
Folder Found : C:\Users\Greg\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Oxy
Folder Found : C:\Users\Greg\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Weather Alerts
Folder Found : C:\Users\Greg\AppData\Roaming\newnext.me
Folder Found : C:\Users\Greg\AppData\Roaming\Oxy
Folder Found : C:\Users\Greg\Documents\Mobogenie
Folder Found : C:\Users\jespi_000\AppData\Roaming\Oxy
Folder Found : C:\Windows\SysWOW64\SearchProtect
 
***** [ Scheduled Tasks ] *****
 
Task Found : bench-sys
Task Found : Oxy
Task Found : bench-S-1-5-21-3436019999-1338614278-3438539980-1002
Task Found : bench-sys
 
***** [ Shortcuts ] *****
 
 
***** [ Registry ] *****
 
Key Found : HKCU\Software\AppDataLow\Software\Compete
Key Found : HKCU\Software\Compete
Key Found : HKCU\Software\Conduit
Key Found : HKCU\Software\Escolade
Key Found : HKCU\Software\Google\Chrome\Extensions\pflphaooapbgpeakohlggbpidpppgdff
Key Found : HKCU\Software\InstallCore
Key Found : HKCU\Software\Jump Flip
Key Found : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\conduit.com
Key Found : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\superfish.com
Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}
Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{77AA745B-F4F8-45DA-9B14-61D2D95054C8}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{6DB9FDFE-B718-4962-BE0C-0A5FCE7F7F7B}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{B49699FC-1665-4414-A1CB-C4A2A4A13EEC}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{6DB9FDFE-B718-4962-BE0C-0A5FCE7F7F7B}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{B49699FC-1665-4414-A1CB-C4A2A4A13EEC}
Key Found : [x64] HKCU\Software\Compete
Key Found : [x64] HKCU\Software\Conduit
Key Found : [x64] HKCU\Software\Escolade
Key Found : [x64] HKCU\Software\InstallCore
Key Found : [x64] HKCU\Software\Jump Flip
Key Found : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}
Key Found : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{77AA745B-F4F8-45DA-9B14-61D2D95054C8}
Key Found : HKLM\Software\Bench
Key Found : HKLM\SOFTWARE\Classes\AppID\{A57F7191-1E7F-4852-BAAF-F80A43E2687A}
Key Found : HKLM\SOFTWARE\Classes\AppID\{C292AD0A-C11F-479B-B8DB-743E72D283B0}
Key Found : HKLM\SOFTWARE\Classes\AppID\{DD7C44CC-0F60-4FD9-A38F-5CF30D698AC2}
Key Found : HKLM\SOFTWARE\Classes\AppID\CptUrlPassthru.DLL
Key Found : HKLM\SOFTWARE\Classes\AppID\dca-bho.DLL
Key Found : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{4AA46D49-459F-4358-B4D1-169048547C23}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{60260024-AA48-4A2F-84DA-2C2DCB24AAD0}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{6DB9FDFE-B718-4962-BE0C-0A5FCE7F7F7B}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{B49699FC-1665-4414-A1CB-C4A2A4A13EEC}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{D40753C7-8A59-4C1F-BE88-C300F4624D5B}
Key Found : HKLM\SOFTWARE\Classes\CptUrlPassthru.hxxpMonitor
Key Found : HKLM\SOFTWARE\Classes\CptUrlPassthru.hxxpMonitor.1
Key Found : HKLM\SOFTWARE\Classes\dcabho.Dca
Key Found : HKLM\SOFTWARE\Classes\dcabho.Dca.1
Key Found : HKLM\SOFTWARE\Classes\Interface\{15527BF5-9729-49DC-889C-9F956983154C}
Key Found : HKLM\SOFTWARE\Classes\Interface\{237FDFDB-3722-470E-8BA8-90196DABE967}
Key Found : HKLM\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}
Key Found : HKLM\SOFTWARE\Classes\Interface\{DD05B915-F77B-474A-9D42-9FEEAF5475C4}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{7BAB653D-88FB-4F60-AFC2-8E6FD59FAFF3}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{A57F7191-1E7F-4852-BAAF-F80A43E2687A}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{C292AD0A-C11F-479B-B8DB-743E72D283B0}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{DCABB943-792E-44C4-9029-ECBEE6265AF9}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{F126C9FC-9299-40F2-BD42-C59023AD1E7F}
Key Found : HKLM\Software\CompeteInc
Key Found : HKLM\SOFTWARE\Google\Chrome\Extensions\hphehadppenpmajgnkjdcopcfijjegaf
Key Found : HKLM\SOFTWARE\Google\Chrome\Extensions\pflphaooapbgpeakohlggbpidpppgdff
Key Found : HKLM\SOFTWARE\Google\Chrome\NativeMessagingHosts\com.bench.nmhost
Key Found : HKLM\Software\Jump Flip
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{74F475FA-6C75-43BD-AAB9-ECDA6184F600}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\MobogenieAdd
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6DB9FDFE-B718-4962-BE0C-0A5FCE7F7F7B}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B49699FC-1665-4414-A1CB-C4A2A4A13EEC}
Key Found : HKLM\Software\mysearchdial
Key Found : [x64] HKLM\SOFTWARE\Classes\CLSID\{4AA46D49-459F-4358-B4D1-169048547C23}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{15527BF5-9729-49DC-889C-9F956983154C}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{237FDFDB-3722-470E-8BA8-90196DABE967}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{DD05B915-F77B-474A-9D42-9FEEAF5475C4}
Key Found : [x64] HKLM\SOFTWARE\Google\Chrome\Extensions\pflphaooapbgpeakohlggbpidpppgdff
Key Found : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{77AA745B-F4F8-45DA-9B14-61D2D95054C8}
Value Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [NextLive]
Value Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [mobilegeni daemon]
 
***** [ Browsers ] *****
 
-\\ Internet Explorer v10.0.9200.17028
 
Setting Found : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page] - hxxp://search.conduit.com/?ctid=CT3321521&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=2&UP=SP0F94719E-BAA1-402A-8DEB-BC469A8C3DC3&SSPV=
Setting Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURls [Tabs] - hxxp://start.mysearchdial.com/?f=2&a=irmsd0101&cd=2XzuyEtN2Y1L1Qzuzy0C0ByCyDyEyEtBtB0AyCtDzztDyBzytN0D0Tzu0CyBtAtCtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1B1P1R&cr=1643944114&ir=
 
*************************
 
AdwCleaner[R0].txt - [7585 octets] - [13/08/2014 16:46:48]
 
########## EOF - \AdwCleaner\AdwCleaner[R0].txt - [7645 octets] ##########


#10 Jespinosa101

Jespinosa101
  • Topic Starter

  • Members
  • 54 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:58 PM

Posted 13 August 2014 - 06:00 PM

Would you like me to press the clean button on the AdwCleaner tool

#11 Jespinosa101

Jespinosa101
  • Topic Starter

  • Members
  • 54 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:58 PM

Posted 13 August 2014 - 09:15 PM

Ok I just pressed the clean button on the AdwCleaner and I rebooted my PC and it deleted all Adware files my searching and internet speed it so much faster thanks! My PC is still infected though with a rootkit and some malware thank you for helping me so far you rock man! Oh also is there another log you want me to post from the AdwCleaner.


Edited by Jespinosa101, 13 August 2014 - 09:16 PM.


#12 nasdaq

nasdaq

  • Malware Response Team
  • 40,749 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:07:58 PM

Posted 14 August 2014 - 08:47 AM

Please download ComboFix from any of the links below, and save it to your desktop. For information regarding this download, please visit this web page: http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Link 1
Link 2


* IMPORTANT !!! Save ComboFix.exe to your Desktop

IMPORTANT....

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

3. Do not install any other programs until this if fixed.


How to : Disable Anti-virus and Firewall...
http://www.bleepingcomputer.com/forums/topic114351.html

Double click on ComboFix.exe & follow the prompts.
  • When finished, it will produce a report for you.
  • Please post the C:\ComboFix.txt
Note:
Do not mouse click ComboFix's window while it's running. That may cause it to stall


Note: If you have difficulty properly disabling your protective programs, refer to this link --> http://www.bleepingcomputer.com/forums/topic114351.html

Note: If after running ComboFix you get this error message "Illegal operation attempted on a registry key that has been marked for deletion." when attempting to run a program all you need to do is restart the computer to reset the registry.
==============

Run the Farbar tool again and post a fresh FRST log for my review.

#13 Jespinosa101

Jespinosa101
  • Topic Starter

  • Members
  • 54 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:58 PM

Posted 14 August 2014 - 05:25 PM

Hey I checked the combofix download and saw that it is only compatible with windows 7, windows xp, and windows vista but not windows 8 and I'm running on a hp windows 8 laptop. Is the combofix able to run on windows 8 and work properly?



#14 Jespinosa101

Jespinosa101
  • Topic Starter

  • Members
  • 54 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:58 PM

Posted 14 August 2014 - 05:55 PM

Here's the Far bar recovery scan tool log

 

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-08-2014 01
Ran by jespi_000 (ATTENTION: The logged in user is not administrator) on JOSHUA_COMPUTER on 14-08-2014 16:39:05
Running from C:\Users\jespi_000\Downloads\FRST
Platform: Windows 8 (X64) OS Language: English (United States)
Internet Explorer Version 10
Boot Mode: Normal
 
The only official download link for FRST:
Download link from any site other than Bleeping Computer is unpermitted or outdated.
 
==================== Processes (Whitelisted) =================
 
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe\LiveComm.exe
(McAfee, Inc.) C:\Program Files\McAfee\MAT\McPvTray.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPMSGSVC.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee\SiteAdvisor\McChHost.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee\SiteAdvisor\saUI.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\Platform\McUICnt.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
 
 
==================== Registry (Whitelisted) ==================
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642656 2013-03-14] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [93296 2012-07-13] (CyberLink Corp.)
HKLM-x32\...\Run: [HPMessageService] => C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPMSGSVC.exe [1045304 2013-02-25] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-04-23] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2012-04-18] (Apple Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [mcpltui_exe] => C:\Program Files\McAfee.com\Agent\mcagent.exe [537992 2014-04-25] (McAfee, Inc.)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-05-26] (Apple Inc.)
HKLM-x32\...\RunOnce: [Deal-Dropper-repairJob] => wscript.exe "C:\Users\Greg\AppData\Local\Deal-Dropper\repair.js" "Deal-Dropper-repairJob"
HKLM\...\Policies\Explorer: [NoFolderOptions] 0
HKLM\...\Policies\Explorer: [NoControlPanel] 0
SSODL: EldosMountNotificator - {5FF49FE8-B332-4CB9-B102-FB6951629E55} - C:\Windows\system32\CbFsMntNtf3.dll (EldoS Corporation)
SSODL-x32: EldosMountNotificator - {5FF49FE8-B332-4CB9-B102-FB6951629E55} - C:\Windows\SysWow64\CbFsMntNtf3.dll (EldoS Corporation)
ShellIconOverlayIdentifiers:  SkyDrive1 -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  No File
ShellIconOverlayIdentifiers:  SkyDrive2 -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  No File
ShellIconOverlayIdentifiers:  SkyDrive3 -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  No File
ShellIconOverlayIdentifiers: EldosIconOverlay -> {5BB532A2-BF14-4CCC-86B7-71B81EF6F8BC} => C:\Windows\system32\CbFsMntNtf3.dll (EldoS Corporation)
ShellIconOverlayIdentifiers: MOBK -> {3c3f3c1a-9153-7c05-f938-622e7003894d} => C:\Program Files (x86)\McAfee Online Backup\MOBKshell.dll (McAfee, Inc.)
ShellIconOverlayIdentifiers: MOBK2 -> {e6ea1d7d-144e-b977-98c4-84c53c1a69d0} => C:\Program Files (x86)\McAfee Online Backup\MOBKshell.dll (McAfee, Inc.)
ShellIconOverlayIdentifiers: MOBK3 -> {b4caf489-1eec-c617-49ad-8d7088598c06} => C:\Program Files (x86)\McAfee Online Backup\MOBKshell.dll (McAfee, Inc.)
ShellIconOverlayIdentifiers-x32:  SkyDrive1 -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  No File
ShellIconOverlayIdentifiers-x32:  SkyDrive2 -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  No File
ShellIconOverlayIdentifiers-x32:  SkyDrive3 -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  No File
ShellIconOverlayIdentifiers-x32: EldosIconOverlay -> {5BB532A2-BF14-4CCC-86B7-71B81EF6F8BC} => C:\Windows\SysWow64\CbFsMntNtf3.dll (EldoS Corporation)
 
==================== Internet (Whitelisted) ====================
 
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/HPNOT13/1
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/HPNOT13/1
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/HPNOT13/1
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
SearchScopes: HKLM - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.com/rover/1/711-154371-11896-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
SearchScopes: HKLM-x32 - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.com/rover/1/711-154371-11896-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO: Deal-Dropper BHO -> {41708E47-E97E-4051-A609-B88B398BCC94} -> C:\Program Files (x86)\Deal-Dropper\FrameworkBHO64.dll ()
BHO: McAfee SiteAdvisor BHO -> {B164E929-A1B6-4A06-B104-2CD0E90A88FF} -> c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Deal-Dropper BHO -> {41708E47-E97E-4051-A609-B88B398BCC94} -> C:\Program Files (x86)\Deal-Dropper\FrameworkBHO.dll ()
BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: McAfee SiteAdvisor BHO -> {B164E929-A1B6-4A06-B104-2CD0E90A88FF} -> c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
Toolbar: HKLM - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
Toolbar: HKLM-x32 - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
Handler-x32: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation)
Handler-x32: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files\McAfee\MSC\McSnIePl64.dll (McAfee, Inc.)
Filter-x32: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files (x86)\McAfee\MSC\McSnIePl.dll (McAfee, Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
 
FireFox:
========
FF Plugin: @mcafee.com/MSC,version=10 -> c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1211151.dll (Adobe Systems, Inc.)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @mcafee.com/MSC,version=10 -> c:\PROGRA~2\mcafee\msc\NPMCSN~1.DLL ()
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()
FF Plugin HKCU: @nsroblox.roblox.com/launcher -> C:\Users\jespi_000\AppData\Local\Roblox\Versions\version-459b702c887942d4\\NPRobloxProxy.dll ( ROBLOX Corporation)
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\jespi_000\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF HKLM-x32\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files (x86)\McAfee\SiteAdvisor
FF Extension: McAfee SiteAdvisor - C:\Program Files (x86)\McAfee\SiteAdvisor [2014-04-05]
FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK
FF Extension: McAfee Anti-Spam Thunderbird Extension - C:\Program Files\McAfee\MSK [2014-04-05]
 
Chrome: 
=======
CHR HomePage: hxxp://www.google.com/
CHR StartupUrls: "https://www.google.com/"
CHR Extension: (Google Docs) - C:\Users\jespi_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-12-23]
CHR Extension: (Google Drive) - C:\Users\jespi_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-12-23]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\jespi_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-05-22]
CHR Extension: (YouTube) - C:\Users\jespi_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-12-23]
CHR Extension: (Attack on Titan Theme for 1440x900) - C:\Users\jespi_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\cebjcpbckgdhefehkcfjeaddcjnkhlke [2014-05-19]
CHR Extension: (Google Search) - C:\Users\jespi_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-12-23]
CHR Extension: (SiteAdvisor) - C:\Users\jespi_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho [2014-04-09]
CHR Extension: (Google Wallet) - C:\Users\jespi_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-12-23]
CHR Extension: (Gmail) - C:\Users\jespi_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-12-23]
 
==================== Services (Whitelisted) =================
 
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 
R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [361984 2013-03-14] (Advanced Micro Devices, Inc.) [File not signed]
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2356912 2014-07-19] (Microsoft Corporation)
S2 consumerinput_update; C:\Program Files (x86)\Consumer Input\Update\ConsumerInputUpdate.exe [106296 2014-01-14] (ConsumerInput)
S3 consumerinput_updatem; C:\Program Files (x86)\Consumer Input\Update\ConsumerInputUpdate.exe [106296 2014-01-14] (ConsumerInput)
R2 HomeNetSvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
R2 HP Support Assistant Service; C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [86528 2012-09-27] (Hewlett-Packard Company) [File not signed]
R2 HPWMISVC; C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPWMISVC.exe [1039160 2013-02-01] (Hewlett-Packard Development Company, L.P.)
R2 lmhosts; C:\Windows\system32\svchost.exe [29696 2013-06-01] (Microsoft Corporation)
R2 McAfee SiteAdvisor Service; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
R2 McAPExe; C:\Program Files\McAfee\MSC\McAPExe.exe [178528 2014-04-25] (McAfee, Inc.)
R2 McMPFSvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
R2 McNaiAnn; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
S3 McODS; C:\Program Files\McAfee\VirusScan\mcods.exe [603424 2014-06-12] (McAfee, Inc.)
R2 mcpltsvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
R2 McProxy; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
R2 mfecore; C:\Program Files\Common Files\McAfee\AMCore\mcshield.exe [1041192 2014-06-18] (McAfee, Inc.)
R2 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [219752 2014-06-20] (McAfee, Inc.)
R2 mfevtp; C:\Windows\system32\mfevtps.exe [189912 2014-06-20] (McAfee, Inc.)
R2 MOBKbackup; C:\Program Files (x86)\McAfee Online Backup\MOBKbackup.exe [231224 2010-04-13] (McAfee, Inc.)
R2 MSK80Service; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
R2 NlaSvc; C:\Windows\System32\svchost.exe [29696 2013-06-01] (Microsoft Corporation)
R2 nsi; C:\Windows\system32\svchost.exe [29696 2013-06-01] (Microsoft Corporation)
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [239176 2013-03-04] (Realtek Semiconductor)
S3 TunngleService; C:\Program Files (x86)\Tunngle\TnglCtrl.exe [758224 2013-11-06] (Tunngle.net GmbH)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16056 2014-03-29] (Microsoft Corporation)
S2 0112261408055030mcinstcleanup; C:\Windows\TEMP\011226~1.EXE -cleanup -nolog [X]
 
==================== Drivers (Whitelisted) ====================
 
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 
R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdW86.sys [94208 2013-02-14] (Advanced Micro Devices)
R3 cbfs3; C:\Windows\System32\drivers\cbfs3.sys [352144 2012-04-09] (EldoS Corporation)
R3 cfwids; C:\Windows\System32\drivers\cfwids.sys [72128 2014-06-20] (McAfee, Inc.)
R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [92536 2012-06-25] (CyberLink)
S3 HipShieldK; C:\Windows\System32\drivers\HipShieldK.sys [197704 2013-09-23] (McAfee, Inc.)
R2 McPvDrv; C:\Windows\system32\drivers\McPvDrv.sys [74560 2013-09-09] (McAfee, Inc.)
R3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [181704 2014-06-20] (McAfee, Inc.)
R3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [313544 2014-06-20] (McAfee, Inc.)
S0 mfeelamk; C:\Windows\System32\drivers\mfeelamk.sys [70600 2014-06-20] (McAfee, Inc.)
R3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [523792 2014-06-20] (McAfee, Inc.)
R0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [786296 2014-06-20] (McAfee, Inc.)
R3 mfencbdc; C:\Windows\system32\DRIVERS\mfencbdc.sys [444720 2014-06-18] (McAfee, Inc.)
S3 mfencrk; C:\Windows\system32\DRIVERS\mfencrk.sys [96592 2014-06-18] (McAfee, Inc.)
R0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [348552 2014-06-20] (McAfee, Inc.)
R1 MOBKFilter; C:\Windows\System32\DRIVERS\MOBK.sys [66040 2010-04-13] (Mozy, Inc.)
R3 RSP2STOR; C:\Windows\system32\DRIVERS\RtsP2Stor.sys [288328 2013-01-23] (Realtek Semiconductor Corp.)
S3 SmbDrv; C:\Windows\System32\drivers\Smb_driver_AMDASF.sys [29424 2013-05-07] (Synaptics Incorporated)
S3 SmbDrvI; C:\Windows\System32\drivers\Smb_driver_Intel.sys [33008 2013-05-07] (Synaptics Incorporated)
R3 tap0901t; C:\Windows\system32\DRIVERS\tap0901t.sys [31232 2009-09-16] (Tunngle.net)
R3 WirelessButtonDriver; C:\Windows\System32\drivers\WirelessButtonDriver64.sys [20800 2012-08-31] (Hewlett-Packard Development Company, L.P.)
 
==================== NetSvcs (Whitelisted) ===================
 
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
 
 
==================== One Month Created Files and Folders ========
 
(If an entry is included in the fixlist, the file\folder will be moved.)
 
2014-08-14 16:27 - 2014-08-14 16:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee
2014-08-13 20:02 - 2014-08-13 20:02 - 00422944 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-08-13 16:46 - 2014-08-14 16:17 - 00000000 ____D () C:\AdwCleaner
2014-08-13 16:44 - 2014-08-13 16:45 - 01356107 _____ () C:\Users\jespi_000\Downloads\adwcleaner_3.305.exe
2014-08-13 16:15 - 2014-06-26 14:53 - 00703968 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-08-13 16:15 - 2014-06-26 14:53 - 00105440 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-08-13 16:08 - 2014-08-14 16:39 - 00000000 ____D () C:\Users\jespi_000\Downloads\FRST
2014-08-12 18:16 - 2014-08-12 18:16 - 00012052 _____ () C:\Users\jespi_000\Desktop\Bell Schedule Joshua.xlsx
2014-08-12 12:54 - 2014-08-12 13:15 - 00009553 _____ () C:\Users\jespi_000\Downloads\Bell Schedule Joshua (1).xlsx
2014-08-12 12:46 - 2014-08-12 15:30 - 00010985 _____ () C:\Users\jespi_000\Downloads\Bell Schedule Joshua.xlsx
2014-08-06 17:12 - 2014-06-17 17:27 - 01440256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\osk.exe
2014-08-06 17:12 - 2014-06-17 17:24 - 01557504 _____ (Microsoft Corporation) C:\Windows\system32\osk.exe
2014-08-06 17:12 - 2014-06-10 22:18 - 04038144 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-06 17:11 - 2014-06-02 16:33 - 00265216 _____ (Microsoft Corporation) C:\Windows\system32\InkEd.dll
2014-08-06 17:11 - 2014-05-29 17:31 - 00452608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SHCore.dll
2014-08-06 17:11 - 2014-05-29 17:03 - 00588288 _____ (Microsoft Corporation) C:\Windows\system32\SHCore.dll
2014-08-06 17:11 - 2014-05-29 17:02 - 01281536 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-08-06 17:11 - 2014-05-29 17:02 - 00439808 _____ (Microsoft Corporation) C:\Windows\system32\lsm.dll
2014-08-06 17:08 - 2014-06-18 20:12 - 02239488 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-08-06 17:08 - 2014-06-18 20:12 - 01366528 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-08-06 17:08 - 2014-06-18 20:11 - 19277312 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-08-06 17:08 - 2014-06-18 20:10 - 15369728 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-08-06 17:08 - 2014-06-18 20:10 - 03959296 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-08-06 17:08 - 2014-06-18 20:10 - 02650624 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-08-06 17:08 - 2014-06-18 20:10 - 00255488 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-08-06 17:08 - 2014-06-18 18:53 - 14368768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-08-06 17:08 - 2014-06-18 18:52 - 13732352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-08-06 17:08 - 2014-06-18 18:52 - 02863616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-08-06 17:08 - 2014-06-18 18:52 - 02051072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-08-06 17:08 - 2014-06-18 18:52 - 00226816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-08-06 17:07 - 2014-06-18 20:12 - 00915968 _____ (Microsoft Corporation) C:\Windows\system32\uxtheme.dll
2014-08-06 17:07 - 2014-06-18 20:12 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\UXInit.dll
2014-08-06 17:07 - 2014-06-18 20:12 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-08-06 17:07 - 2014-06-18 20:11 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-08-06 17:07 - 2014-06-18 20:11 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-08-06 17:07 - 2014-06-18 20:10 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-08-06 17:07 - 2014-06-18 20:10 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-08-06 17:07 - 2014-06-18 20:10 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-08-06 17:07 - 2014-06-18 20:10 - 00281600 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-08-06 17:07 - 2014-06-18 20:10 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2014-08-06 17:07 - 2014-06-18 20:10 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-08-06 17:07 - 2014-06-18 20:10 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-08-06 17:07 - 2014-06-18 20:10 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-08-06 17:07 - 2014-06-18 20:09 - 01508864 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-08-06 17:07 - 2014-06-18 18:53 - 01766400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-08-06 17:07 - 2014-06-18 18:53 - 01141760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-08-06 17:07 - 2014-06-18 18:53 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-08-06 17:07 - 2014-06-18 18:53 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-08-06 17:07 - 2014-06-18 18:53 - 00080896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-08-06 17:07 - 2014-06-18 18:53 - 00044032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UXInit.dll
2014-08-06 17:07 - 2014-06-18 18:52 - 01440768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-08-06 17:07 - 2014-06-18 18:52 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2014-08-06 17:07 - 2014-06-18 18:52 - 00357888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-08-06 17:07 - 2014-06-18 18:52 - 00226816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-08-06 17:07 - 2014-06-18 18:52 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2014-08-06 17:07 - 2014-06-18 18:52 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-08-06 17:07 - 2014-06-18 18:52 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-08-06 17:07 - 2014-06-18 18:52 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-08-06 17:07 - 2014-06-18 18:33 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-08-06 17:07 - 2014-06-18 18:30 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-08-06 17:07 - 2014-06-18 16:05 - 00534528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\uxtheme.dll
2014-08-06 17:07 - 2014-05-29 16:24 - 00576512 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2014-08-06 17:03 - 2014-06-06 08:06 - 00596480 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-08-06 17:03 - 2014-06-06 04:17 - 00497152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2014-08-06 16:40 - 2014-08-14 16:39 - 00000000 ____D () C:\FRST
2014-07-21 21:00 - 2014-07-22 02:44 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-07-21 21:00 - 2014-07-21 21:00 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-07-15 23:03 - 2014-07-22 02:42 - 00000000 ____D () C:\Users\jespi_000\Documents\ArmA 2
2014-07-15 23:03 - 2014-07-20 16:58 - 00000000 ____D () C:\Users\jespi_000\AppData\Local\ArmA 2 Free
 
==================== One Month Modified Files and Folders =======
 
(If an entry is included in the fixlist, the file\folder will be moved.)
 
2014-08-14 16:41 - 2014-01-23 09:56 - 00000926 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-08-14 16:41 - 2014-01-14 19:37 - 00000390 _____ () C:\Windows\Tasks\CIMT_S-1-5-21-3436019999-1338614278-3438539980-1002.job
2014-08-14 16:41 - 2014-01-14 19:36 - 00000998 _____ () C:\Windows\Tasks\ConsumerInputUpdateTaskMachineUA.job
2014-08-14 16:39 - 2014-08-13 16:08 - 00000000 ____D () C:\Users\jespi_000\Downloads\FRST
2014-08-14 16:39 - 2014-08-06 16:40 - 00000000 ____D () C:\FRST
2014-08-14 16:35 - 2013-11-29 19:43 - 01365298 _____ () C:\Windows\WindowsUpdate.log
2014-08-14 16:34 - 2012-07-26 01:59 - 00000000 ____D () C:\Windows\CbsTemp
2014-08-14 16:27 - 2014-08-14 16:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee
2014-08-14 16:27 - 2014-04-05 15:25 - 00001851 _____ () C:\Users\Public\Desktop\McAfee Total Protection.lnk
2014-08-14 16:17 - 2014-08-13 16:46 - 00000000 ____D () C:\AdwCleaner
2014-08-14 16:14 - 2014-01-23 09:56 - 00000922 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-08-14 16:13 - 2014-04-05 15:40 - 00000000 __RSD () C:\Users\jespi_000\Documents\McAfee Vaults
2014-08-14 16:13 - 2014-01-14 19:36 - 00000994 _____ () C:\Windows\Tasks\ConsumerInputUpdateTaskMachineCore.job
2014-08-14 16:12 - 2012-07-26 02:12 - 00000000 ____D () C:\Windows\system32\sru
2014-08-13 20:07 - 2012-07-26 01:28 - 00941114 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-08-13 20:02 - 2014-08-13 20:02 - 00422944 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-08-13 20:02 - 2012-08-03 16:23 - 00479374 _____ () C:\Windows\PFRO.log
2014-08-13 20:02 - 2012-07-26 01:22 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-08-13 20:00 - 2013-11-29 20:27 - 00000000 ____D () C:\Users\jespi_000
2014-08-13 20:00 - 2013-11-29 19:42 - 00000000 ____D () C:\Users\Greg
2014-08-13 16:45 - 2014-08-13 16:44 - 01356107 _____ () C:\Users\jespi_000\Downloads\adwcleaner_3.305.exe
2014-08-13 16:32 - 2012-07-26 02:12 - 00000000 ____D () C:\Windows\AUInstallAgent
2014-08-13 16:10 - 2012-07-26 02:12 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
2014-08-13 16:10 - 2012-07-26 02:12 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
2014-08-13 16:10 - 2012-07-26 01:52 - 00000000 ____D () C:\Program Files\Windows Journal
2014-08-12 18:16 - 2014-08-12 18:16 - 00012052 _____ () C:\Users\jespi_000\Desktop\Bell Schedule Joshua.xlsx
2014-08-12 15:30 - 2014-08-12 12:46 - 00010985 _____ () C:\Users\jespi_000\Downloads\Bell Schedule Joshua.xlsx
2014-08-12 14:48 - 2014-04-14 20:45 - 00002190 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-08-12 14:07 - 2013-11-29 20:27 - 00000000 ____D () C:\Users\jespi_000\AppData\Local\Packages
2014-08-12 13:26 - 2012-07-26 01:21 - 00038211 _____ () C:\Windows\setupact.log
2014-08-12 13:15 - 2014-08-12 12:54 - 00009553 _____ () C:\Users\jespi_000\Downloads\Bell Schedule Joshua (1).xlsx
2014-08-06 16:57 - 2014-04-05 13:12 - 00000000 ____D () C:\Program Files\Microsoft Office 15
2014-07-30 12:55 - 2014-04-05 15:21 - 00000000 ____D () C:\Program Files (x86)\McAfee
2014-07-22 15:54 - 2014-04-20 14:16 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-07-22 15:53 - 2014-04-05 15:09 - 00000000 ____D () C:\Program Files\Common Files\McAfee
2014-07-22 15:53 - 2012-07-26 02:12 - 00000000 ___HD () C:\Windows\ELAMBKUP
2014-07-22 02:47 - 2012-07-26 02:12 - 00000000 __RHD () C:\Users\Public\Libraries
2014-07-22 02:47 - 2012-07-26 02:12 - 00000000 ____D () C:\Windows\WinStore
2014-07-22 02:46 - 2014-01-23 09:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2014-07-22 02:44 - 2014-07-21 21:00 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-07-22 02:44 - 2014-07-11 14:21 - 00000000 ____D () C:\Program Files (x86)\LogMeIn Hamachi
2014-07-22 02:44 - 2014-04-05 15:22 - 00000000 ____D () C:\Program Files (x86)\McAfee.com
2014-07-22 02:44 - 2014-01-14 19:35 - 00000000 ____D () C:\Program Files (x86)\Consumer Input
2014-07-22 02:43 - 2014-07-11 14:24 - 00000000 ____D () C:\Users\jespi_000\AppData\Local\LogMeIn Hamachi
2014-07-22 02:42 - 2014-07-15 23:03 - 00000000 ____D () C:\Users\jespi_000\Documents\ArmA 2
2014-07-22 02:41 - 2012-07-26 02:12 - 00000000 ____D () C:\Windows\registration
2014-07-22 02:41 - 2012-07-25 23:38 - 00000000 ____D () C:\Windows\system32\Sysprep
2014-07-22 02:40 - 2014-04-05 15:09 - 00000000 ____D () C:\ProgramData\McAfee
2014-07-22 02:40 - 2014-02-27 09:46 - 00000000 ____D () C:\Users\jespi_000\AppData\Roaming\.minecraft
2014-07-21 21:00 - 2014-07-21 21:00 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-07-20 16:58 - 2014-07-15 23:03 - 00000000 ____D () C:\Users\jespi_000\AppData\Local\ArmA 2 Free
2014-07-17 20:50 - 2014-01-10 19:26 - 00248832 ___SH () C:\Users\jespi_000\Downloads\Thumbs.db
2014-07-15 23:05 - 2013-06-01 12:41 - 00044965 _____ () C:\Windows\DirectX.log
 
Some content of TEMP:
====================
C:\Users\jespi_000\AppData\Local\Temp\COMAP.EXE
C:\Users\jespi_000\AppData\Local\Temp\htmlayout.dll
C:\Users\jespi_000\AppData\Local\Temp\SPSetup.exe
 
 
==================== Bamital & volsnap Check =================
 
(There is no automatic fix for files that do not pass verification.)
 
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
 
ATTENTION: ==> Could not access BCD, see Addition.txt for additional information.
 
==================== End Of Log ============================


#15 Jespinosa101

Jespinosa101
  • Topic Starter

  • Members
  • 54 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:58 PM

Posted 14 August 2014 - 09:40 PM

Here is the Combofix log oh and the log was found in the windows c drive
also when I did the scan it took some time but also at the end it showed the Combofix log and then when I
closed it there was a black screen with the toolbar but with no applications so I did a force shutdown and turned it back on 
and I got my stuff showing again finally is my pc now clean because my pc seems pretty fast now and thanks for helping me!
ComboFix 14-08-15.01 - Greg 08/14/2014  19:22:54.1.2 - x64
Microsoft Windows 8  6.2.9200.0.1252.1.1033.18.3682.2130 [GMT -6:00]
Running from: c:\users\jespi_000\Downloads\ComboFix.exe
AV: McAfee Anti-Virus and Anti-Spyware *Disabled/Updated* {ADA629C7-7F48-5689-624A-3B76997E0892}
AV: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: McAfee Firewall *Disabled* {959DA8E2-3527-57D1-4915-924367AD4FE9}
SP: McAfee Anti-Virus and Anti-Spyware *Disabled/Updated* {16C7C823-5972-5907-58FA-0004E2F9422F}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\Deal-Dropper\FrAMeworkbho64.dll
c:\users\Greg\AppData\Local\Microsoft\Windows\Temporary Internet Files\Jump Flip_iels
.
.
(((((((((((((((((((((((((   Files Created from 2014-07-15 to 2014-08-15  )))))))))))))))))))))))))))))))
.
.
2014-08-15 02:16 . 2014-08-15 02:16 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-08-15 02:15 . 2014-08-15 02:15 -------- d-----w- c:\users\Greg\AppData\Local\temp
2014-08-14 22:35 . 2014-08-14 22:35 262312 ----a-w- c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10244.bin
2014-08-13 22:46 . 2014-08-14 22:17 -------- d-----w- C:\AdwCleaner
2014-08-13 22:15 . 2014-06-26 20:53 703968 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2014-08-13 22:15 . 2014-06-26 20:53 105440 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-08-06 23:12 . 2014-06-11 14:47 3262464 ----a-w- c:\program files\Common Files\Microsoft Shared\ink\tipskins.dll
2014-08-06 23:12 . 2014-06-11 04:18 4038144 ----a-w- c:\windows\system32\win32k.sys
2014-08-06 23:12 . 2014-06-17 23:27 1440256 ----a-w- c:\windows\SysWow64\osk.exe
2014-08-06 23:12 . 2014-06-17 23:24 1557504 ----a-w- c:\windows\system32\osk.exe
2014-08-06 23:12 . 2014-06-11 16:00 394624 ----a-w- c:\program files\Common Files\Microsoft Shared\ink\TabTip.exe
2014-08-06 23:12 . 2014-06-11 14:47 92672 ----a-w- c:\program files\Common Files\Microsoft Shared\ink\TipBand.dll
2014-08-06 23:12 . 2014-06-11 14:47 1616896 ----a-w- c:\program files\Common Files\Microsoft Shared\ink\tabskb.dll
2014-08-06 23:08 . 2014-06-19 02:11 19277312 ----a-w- c:\windows\system32\mshtml.dll
2014-08-06 23:08 . 2014-06-19 02:10 15369728 ----a-w- c:\windows\system32\ieframe.dll
2014-08-06 23:08 . 2014-06-19 02:10 3959296 ----a-w- c:\windows\system32\jscript9.dll
2014-08-06 23:08 . 2014-06-19 02:10 255488 ----a-w- c:\windows\system32\iedkcs32.dll
2014-08-06 23:08 . 2014-06-19 02:10 2650624 ----a-w- c:\windows\system32\iertutil.dll
2014-08-06 23:08 . 2014-06-19 00:52 2863616 ----a-w- c:\windows\SysWow64\jscript9.dll
2014-08-06 23:08 . 2014-06-19 02:12 2239488 ----a-w- c:\windows\system32\wininet.dll
2014-08-06 23:08 . 2014-06-19 02:12 1366528 ----a-w- c:\windows\system32\urlmon.dll
2014-08-06 23:03 . 2014-06-06 14:06 596480 ----a-w- c:\windows\system32\qedit.dll
2014-08-06 23:03 . 2014-06-06 10:17 497152 ----a-w- c:\windows\SysWow64\qedit.dll
2014-08-06 22:40 . 2014-08-14 22:59 -------- d-----w- C:\FRST
2014-07-22 03:00 . 2014-07-22 08:44 -------- d-----w- c:\program files (x86)\Malwarebytes Anti-Malware
2014-07-22 03:00 . 2014-07-22 03:00 -------- d-----w- c:\programdata\Malwarebytes
2014-07-16 05:03 . 2014-07-20 22:58 -------- d-----w- c:\users\jespi_000\AppData\Local\ArmA 2 Free
.
.
.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-06-20 16:38 . 2014-01-27 14:43 72128 ----a-w- c:\windows\system32\drivers\cfwids.sys
2014-06-20 16:31 . 2014-01-27 14:37 348552 ----a-w- c:\windows\system32\drivers\mfewfpk.sys
2014-06-20 16:30 . 2014-04-05 21:09 189912 ----a-w- c:\windows\system32\mfevtps.exe
2014-06-20 16:26 . 2013-12-05 22:41 786296 ----a-w- c:\windows\system32\drivers\mfehidk.sys
2014-06-20 16:23 . 2014-01-27 14:31 523792 ----a-w- c:\windows\system32\drivers\mfefirek.sys
2014-06-20 16:21 . 2014-01-27 14:30 313544 ----a-w- c:\windows\system32\drivers\mfeavfk.sys
2014-06-20 16:20 . 2013-12-05 22:36 181704 ----a-w- c:\windows\system32\drivers\mfeapfk.sys
2014-06-20 16:09 . 2014-01-27 14:15 70600 ----a-w- c:\windows\system32\drivers\mfeelamk.sys
2014-06-18 23:10 . 2013-12-03 17:27 95414520 ----a-w- c:\windows\system32\MRT.exe
2014-06-18 09:12 . 2014-06-18 09:12 11336 ----a-w- c:\windows\system32\drivers\mfeclnrk.sys
2014-06-18 09:12 . 2014-06-18 09:12 96592 ----a-w- c:\windows\system32\drivers\mfencrk.sys
2014-06-18 09:11 . 2014-06-18 09:11 444720 ----a-w- c:\windows\system32\drivers\mfencbdc.sys
2014-06-03 08:41 . 2014-04-05 19:16 589008 ----a-w- c:\programdata\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe
.
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{41708E47-E97E-4051-A609-B88B398BCC94}]
2013-12-16 22:11 258088 ----a-w- c:\program files (x86)\Deal-Dropper\FrameworkBHO.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive1]
@="{F241C880-6982-4CE5-8CF7-7085BA96DA5A}"
[HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]
2014-04-05 19:23 220632 ----a-w- c:\users\Greg\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\SkyDriveShell.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive2]
@="{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}"
[HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]
2014-04-05 19:23 220632 ----a-w- c:\users\Greg\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\SkyDriveShell.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive3]
@="{BBACC218-34EA-4666-9D7A-C78F2274A524}"
[HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]
2014-04-05 19:23 220632 ----a-w- c:\users\Greg\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\SkyDriveShell.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\EldosIconOverlay]
@="{5BB532A2-BF14-4CCC-86B7-71B81EF6F8BC}"
[HKEY_CLASSES_ROOT\CLSID\{5BB532A2-BF14-4CCC-86B7-71B81EF6F8BC}]
2012-04-09 23:27 158224 ----a-w- c:\windows\SysWOW64\CbFsMntNtf3.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2013-03-14 642656]
"RemoteControl10"="c:\program files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe" [2012-07-13 93296]
"HPMessageService"="c:\program files (x86)\Hewlett-Packard\HP System Event\HPMSGSVC.exe" [2013-02-25 1045304]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2014-04-23 43848]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-04-19 421888]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336]
"mcpltui_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2014-04-26 537992]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2014-05-27 152392]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce]
"Deal-Dropper-repairJob"="wscript.exe" [2012-07-26 131584]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"EnableUIADesktopToggle"= 0 (0x0)
"EnableCursorSuppression"= 1 (0x1)
"ConsentPromptBehaviorUser"= 3 (0x3)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc]
@=""
.
R0 mfeelamk;McAfee Inc. mfeelamk;c:\windows\system32\drivers\mfeelamk.sys;c:\windows\SYSNATIVE\drivers\mfeelamk.sys [x]
R2 0112261408055030mcinstcleanup;McAfee Application Installer Cleanup (0112261408055030);c:\windows\TEMP\011226~1.EXE;c:\windows\TEMP\011226~1.EXE [x]
R2 consumerinput_update;ConsumerInput Update Service (consumerinput_update);c:\program files (x86)\Consumer Input\Update\ConsumerInputUpdate.exe;c:\program files (x86)\Consumer Input\Update\ConsumerInputUpdate.exe [x]
R3 consumerinput_updatem;ConsumerInput Update Service (consumerinput_updatem);c:\program files (x86)\Consumer Input\Update\ConsumerInputUpdate.exe;c:\program files (x86)\Consumer Input\Update\ConsumerInputUpdate.exe [x]
R3 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [x]
R3 HipShieldK;McAfee Inc. HipShieldK;c:\windows\system32\drivers\HipShieldK.sys;c:\windows\SYSNATIVE\drivers\HipShieldK.sys [x]
R3 iaStorA;iaStorA;c:\windows\System32\drivers\iaStorA.sys;c:\windows\SYSNATIVE\drivers\iaStorA.sys [x]
R3 mfencrk;McAfee Inc. mfencrk;c:\windows\system32\DRIVERS\mfencrk.sys;c:\windows\SYSNATIVE\DRIVERS\mfencrk.sys [x]
R3 SmbDrv;SmbDrv;c:\windows\System32\drivers\Smb_driver_AMDASF.sys;c:\windows\SYSNATIVE\drivers\Smb_driver_AMDASF.sys [x]
R3 SmbDrvI;SmbDrvI;c:\windows\System32\drivers\Smb_driver_Intel.sys;c:\windows\SYSNATIVE\drivers\Smb_driver_Intel.sys [x]
R3 TunngleService;TunngleService;c:\program files (x86)\Tunngle\TnglCtrl.exe;c:\program files (x86)\Tunngle\TnglCtrl.exe [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\System32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
R3 WUDFWpdMtp;WUDFWpdMtp;c:\windows\system32\DRIVERS\WUDFRd.sys;c:\windows\SYSNATIVE\DRIVERS\WUDFRd.sys [x]
S0 amd_sata;amd_sata;c:\windows\System32\drivers\amd_sata.sys;c:\windows\SYSNATIVE\drivers\amd_sata.sys [x]
S0 amd_xata;amd_xata;c:\windows\System32\drivers\amd_xata.sys;c:\windows\SYSNATIVE\drivers\amd_xata.sys [x]
S0 mfewfpk;McAfee Inc. mfewfpk;c:\windows\system32\drivers\mfewfpk.sys;c:\windows\SYSNATIVE\drivers\mfewfpk.sys [x]
S1 CLVirtualDrive;CLVirtualDrive;c:\windows\system32\DRIVERS\CLVirtualDrive.sys;c:\windows\SYSNATIVE\DRIVERS\CLVirtualDrive.sys [x]
S1 MOBKFilter;MOBKFilter;c:\windows\system32\DRIVERS\MOBK.sys;c:\windows\SYSNATIVE\DRIVERS\MOBK.sys [x]
S2 AERTFilters;Andrea RT Filters Service;c:\program files\Realtek\Audio\HDA\AERTSr64.EXE;c:\program files\Realtek\Audio\HDA\AERTSr64.EXE [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [x]
S2 ClickToRunSvc;Microsoft Office ClickToRun Service;c:\program files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe;c:\program files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [x]
S2 HomeNetSvc;McAfee Home Network;c:\program files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe;c:\program files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [x]
S2 HP Support Assistant Service;HP Support Assistant Service;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [x]
S2 HPWMISVC;HPWMISVC;c:\program files (x86)\Hewlett-Packard\HP System Event\HPWMISVC.exe;c:\program files (x86)\Hewlett-Packard\HP System Event\HPWMISVC.exe [x]
S2 IconMan_R;IconMan_R;c:\program files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe;c:\program files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [x]
S2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe;c:\program files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [x]
S2 McAPExe;McAfee AP Service;c:\program files\McAfee\MSC\McAPExe.exe;c:\program files\McAfee\MSC\McAPExe.exe [x]
S2 McMPFSvc;McAfee Personal Firewall Service;c:\program files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe;c:\program files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [x]
S2 McNaiAnn;McAfee VirusScan Announcer;c:\program files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe;c:\program files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [x]
S2 mcpltsvc;McAfee Platform Services;c:\program files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe;c:\program files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [x]
S2 McPvDrv;McPvDrv Driver;c:\windows\system32\drivers\McPvDrv.sys;c:\windows\SYSNATIVE\drivers\McPvDrv.sys [x]
S2 mfecore;McAfee Anti-Malware Core;c:\program files\Common Files\McAfee\AMCore\mcshield.exe;c:\program files\Common Files\McAfee\AMCore\mcshield.exe [x]
S2 mfefire;McAfee Firewall Core Service;c:\program files\Common Files\McAfee\SystemCore\\mfefire.exe;c:\program files\Common Files\McAfee\SystemCore\\mfefire.exe [x]
S2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe;c:\windows\SYSNATIVE\mfevtps.exe [x]
S2 MOBKbackup;McAfee Online Backup;c:\program files (x86)\McAfee Online Backup\MOBKbackup.exe;c:\program files (x86)\McAfee Online Backup\MOBKbackup.exe [x]
S2 RtkAudioService;Realtek Audio Service;c:\program files\Realtek\Audio\HDA\RtkAudioService64.exe;c:\program files\Realtek\Audio\HDA\RtkAudioService64.exe [x]
S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW86.sys;c:\windows\SYSNATIVE\drivers\AtihdW86.sys [x]
S3 cbfs3;EldoS Callback File System driver v3;c:\windows\System32\drivers\cbfs3.sys;c:\windows\SYSNATIVE\drivers\cbfs3.sys [x]
S3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys;c:\windows\SYSNATIVE\drivers\cfwids.sys [x]
S3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys;c:\windows\SYSNATIVE\drivers\mfefirek.sys [x]
S3 mfencbdc;McAfee Inc. mfencbdc;c:\windows\system32\DRIVERS\mfencbdc.sys;c:\windows\SYSNATIVE\DRIVERS\mfencbdc.sys [x]
S3 RSP2STOR;Realtek PCIE CardReader Driver - P2;c:\windows\system32\DRIVERS\RtsP2Stor.sys;c:\windows\SYSNATIVE\DRIVERS\RtsP2Stor.sys [x]
S3 RTL8168;Realtek 8168 NT Driver;c:\windows\system32\DRIVERS\Rt630x64.sys;c:\windows\SYSNATIVE\DRIVERS\Rt630x64.sys [x]
S3 tap0901t;TAP-Win32 Adapter V9 (Tunngle);c:\windows\system32\DRIVERS\tap0901t.sys;c:\windows\SYSNATIVE\DRIVERS\tap0901t.sys [x]
S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys;c:\windows\SYSNATIVE\DRIVERS\usbfilter.sys [x]
S3 WirelessButtonDriver;HP Wireless Button Driver Service;c:\windows\System32\drivers\WirelessButtonDriver64.sys;c:\windows\SYSNATIVE\drivers\WirelessButtonDriver64.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
apphost REG_MULTI_SZ   apphostsvc
iissvcs REG_MULTI_SZ   w3svc was
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2014-08-12 20:40 1104200 ----a-w- c:\program files (x86)\Google\Chrome\Application\36.0.1985.143\Installer\chrmstp.exe
.
Contents of the 'Scheduled Tasks' folder
.
2014-08-15 c:\windows\Tasks\CIMT_S-1-5-21-3436019999-1338614278-3438539980-1002.job
- c:\program files (x86)\Consumer Input\Monitoring\dca-monitoring.exe [2014-05-22 14:44]
.
2014-08-15 c:\windows\Tasks\ConsumerInputUpdateTaskMachineCore.job
- c:\program files (x86)\Consumer Input\Update\ConsumerInputUpdate.exe [2014-01-15 01:35]
.
2014-08-15 c:\windows\Tasks\ConsumerInputUpdateTaskMachineUA.job
- c:\program files (x86)\Consumer Input\Update\ConsumerInputUpdate.exe [2014-01-15 01:35]
.
2014-08-15 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2014-01-23 15:55]
.
2014-08-15 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2014-01-23 15:55]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive1]
@="{F241C880-6982-4CE5-8CF7-7085BA96DA5A}"
[HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]
2014-04-05 19:23 244696 ----a-w- c:\users\Greg\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive2]
@="{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}"
[HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]
2014-04-05 19:23 244696 ----a-w- c:\users\Greg\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive3]
@="{BBACC218-34EA-4666-9D7A-C78F2274A524}"
[HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]
2014-04-05 19:23 244696 ----a-w- c:\users\Greg\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro1 (ErrorConflict)]
@="{8BA85C75-763B-4103-94EB-9470F12FE0F7}"
[HKEY_CLASSES_ROOT\CLSID\{8BA85C75-763B-4103-94EB-9470F12FE0F7}]
2014-06-10 10:07 2335960 ----a-w- c:\program files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\grooveex.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro2 (SyncInProgress)]
@="{CD55129A-B1A1-438E-A425-CEBC7DC684EE}"
[HKEY_CLASSES_ROOT\CLSID\{CD55129A-B1A1-438E-A425-CEBC7DC684EE}]
2014-06-10 10:07 2335960 ----a-w- c:\program files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\grooveex.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro3 (InSync)]
@="{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}"
[HKEY_CLASSES_ROOT\CLSID\{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}]
2014-06-10 10:07 2335960 ----a-w- c:\program files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\grooveex.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\EldosIconOverlay]
@="{5BB532A2-BF14-4CCC-86B7-71B81EF6F8BC}"
[HKEY_CLASSES_ROOT\CLSID\{5BB532A2-BF14-4CCC-86B7-71B81EF6F8BC}]
2012-04-09 23:27 190480 ----a-w- c:\windows\System32\CbFsMntNtf3.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\MOBK]
@="{3c3f3c1a-9153-7c05-f938-622e7003894d}"
[HKEY_CLASSES_ROOT\CLSID\{3c3f3c1a-9153-7c05-f938-622e7003894d}]
2010-04-14 02:11 3816248 ----a-w- c:\program files (x86)\McAfee Online Backup\MOBKshell.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\MOBK2]
@="{e6ea1d7d-144e-b977-98c4-84c53c1a69d0}"
[HKEY_CLASSES_ROOT\CLSID\{e6ea1d7d-144e-b977-98c4-84c53c1a69d0}]
2010-04-14 02:11 3816248 ----a-w- c:\program files (x86)\McAfee Online Backup\MOBKshell.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\MOBK3]
@="{b4caf489-1eec-c617-49ad-8d7088598c06}"
[HKEY_CLASSES_ROOT\CLSID\{b4caf489-1eec-c617-49ad-8d7088598c06}]
2010-04-14 02:11 3816248 ----a-w- c:\program files (x86)\McAfee Online Backup\MOBKshell.dll
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com
uLocal Page = c:\windows\system32\blank.htm
mStart Page = about:blank
mLocal Page = c:\windows\SysWOW64\blank.htm
TCP: DhcpNameServer = 192.168.1.1
.
- - - - ORPHANS REMOVED - - - -
.
AddRemove-Webinternetsecurity - c:\program files (x86)\Webinternetsecurity\uninstall.webinternetsecurity.exe
AddRemove-{EE202411-2C26-49E8-9784-1BC1DBF7DE96} - c:\program files (x86)\InstallShield Installation Information\{EE202411-2C26-49E8-9784-1BC1DBF7DE96}\setup.exe
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-3436019999-1338614278-3438539980-1005CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\Software\Microsoft\Internet Explorer\SearchScopes]
@DACL=(02 0000)
"DefaultScope"="{A4157B0E-4E0C-480A-B38E-EF2401C079E1}"
"KnownProvidersUpgradeTime"=hex:70,7c,0a,d8,84,8d,cf,01
"Version"=dword:00000003
"UpgradeTime"=hex:31,99,cc,d8,84,8d,cf,01
.
[HKEY_USERS\S-1-5-21-3436019999-1338614278-3438539980-1005CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\Software\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}]
@DACL=(02 0000)
.
[HKEY_USERS\S-1-5-21-3436019999-1338614278-3438539980-1005CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]
@DACL=(02 0000)
"DisplayName"="Bing"
"FaviconPath"="c:\\Program Files (x86)\\Online Services\\Bing_icon\\favicon.ico"
"ShowSearchSuggestions"=dword:00000001
"SortIndex"=dword:00000001
"Deleted"=dword:00000001
.
[HKEY_USERS\S-1-5-21-3436019999-1338614278-3438539980-1005CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\Software\Microsoft\Internet Explorer\SearchScopes\{0EF0C717-AADA-4FD3-8A8F-EE233F0DA6A9}]
@DACL=(02 0000)
"DisplayName"="Google"
"Codepage"=dword:0000fde9
"FaviconPath"="c:\\Users\\jespi_000\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0EF0C717-AADA-4FD3-8A8F-EE233F0DA6A9}.ico"
"TopResultURLFallback"=""
.
[HKEY_USERS\S-1-5-21-3436019999-1338614278-3438539980-1005CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\Software\Microsoft\Internet Explorer\SearchScopes\{A4157B0E-4E0C-480A-B38E-EF2401C079E1}]
@DACL=(02 0000)
"DisplayName"="Secure Search"
"OSDFileURL"="c:\\Users\\JESPI_~1\\AppData\\Local\\Temp\\McSiteAdvisor.xml"
"ShowSearchSuggestions"=dword:00000001
"FaviconPath"="c:\\PROGRA~2\\McAfee\\SITEAD~1\\Scripts\\favicon.ico"
.
[HKEY_USERS\S-1-5-21-3436019999-1338614278-3438539980-1005CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\Software\Microsoft\Internet Explorer\SearchScopes\{AA3F748D-E134-4B59-9954-88D79A6E4882}]
@DACL=(02 0000)
"DisplayName"="Amazon Search Suggestions"
"FaviconPath"="c:\\Program Files (x86)\\Online Services\\Amazon\\amazon.ico"
"ShowSearchSuggestions"=dword:00000001
"SortIndex"=dword:00000004
.
[HKEY_USERS\S-1-5-21-3436019999-1338614278-3438539980-1005CsiTool-CreateHive-{00000000-0000-0000-0000-000000000000}\Software\Microsoft\Internet Explorer\SearchScopes\{D944BB61-2E34-4DBF-A683-47E505C587DC}]
@DACL=(02 0000)
"DisplayName"="eBay"
"FaviconPath"="c:\\Users\\jespi_000\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{D944BB61-2E34-4DBF-A683-47E505C587DC}.ico"
"ShowSearchSuggestions"=dword:00000000
"SortIndex"=dword:00000004
"URL"="http://rover.ebay.com/rover/1/711-154371-11896-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}"
.
[HKEY_USERS\S-1-5-21-3436019999-1338614278-3438539980-1005_Classes\CLSID]
@DACL=(02 0000)
.
[HKEY_USERS\S-1-5-21-3436019999-1338614278-3438539980-1005_Classes\CLSID\{D9AC5E73-BB10-467b-B884-AA1E475C51F5}]
@DACL=(02 0000)
@="SynTPCpl0"
"LocalizedString"="Synaptics TouchPad V7.5"
"System.ApplicationName"="Synaptics.SynTPCpl0"
"System.ControlPanel.Category"="2"
"System.Software.TasksFileUrl"="c:\\ProgramData\\Synaptics\\SynTP\\SynTPCpl0.xml"
.
[HKEY_LOCAL_MACHINE\software\McAfee]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
   00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
@SACL=(02 0000)
.
Completion time: 2014-08-14  20:24:35
ComboFix-quarantined-files.txt  2014-08-15 02:24
.
Pre-Run: 409,794,301,952 bytes free
Post-Run: 409,591,943,168 bytes free
.
- - End Of File - - 1C05912C927B3171B091D447BA1E6185
5FB38429D5D77768867C76DCBDB35194





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users