Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Process Hidden


  • This topic is locked This topic is locked
7 replies to this topic

#1 hspawn

hspawn

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:05:19 PM

Posted 10 October 2014 - 01:08 AM

I scanned with roguekiller and detected process hidden with ID 1328 and 3092 but i think it changes from time to time and now i dont know how to fix/delete this. Any suggestions?

 

DDS (Ver_2012-11-20.01) - NTFS_AMD64
Internet Explorer: 11.0.9600.17280  BrowserJavaVersion: 10.67.2
Run by Joao at 6:59:52 on 2014-10-10
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.351.2070.18.8183.5290 [GMT 1:00]
.
AV: Panda Free Antivirus *Enabled/Updated* {3456760B-FDAA-FFFD-06C2-7BB528D2066C}
SP: Panda Free Antivirus *Enabled/Updated* {8F3797EF-DB90-F073-3C72-40C753554CD1}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: ZoneAlarm Free Firewall Firewall *Enabled* {1B8D532F-88B1-B2AD-ED22-AED92687A1D2}
FW: Panda Firewall *Disabled* {0C6DF72E-B7C5-FEA5-2D9D-D280D6014117}
.
============== Running Processes ===============
.
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k NetworkService
C:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exe
C:\Windows\system32\atieclxx.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Program Files (x86)\Panda Security\Panda Security Protection\PSANHost.exe
C:\Program Files (x86)\Panda Security\Panda Devices Agent\AgentSvc.exe
C:\Windows\SysWOW64\PnkBstrA.exe
C:\Program Files (x86)\Panda Security\Panda Security Protection\PSUAService.exe
C:\Program Files (x86)\CheckPoint\ZoneAlarm\ZaPrivacyService.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system\HsMgr64.exe
C:\Windows\SysWOW64\HsMgr.exe
C:\Program Files\ASUS Xonar DG Audio\Customapp\ASUSAUDIOCENTER.EXE
C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
C:\Program Files (x86)\CheckPoint\ZoneAlarm\zatray.exe
C:\Program Files (x86)\Panda Security\Panda Security Protection\PSUAMain.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallMonitor.exe
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
C:\Program Files\MPC-HC\mpc-hc64.exe
C:\Program Files (x86)\Steam\steam.exe
C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
C:\Program Files (x86)\Common Files\Steam\SteamService.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\System32\cscript.exe
.
============== Pseudo HJT Report ===============
.
mWinlogon: Userinit = userinit.exe,
BHO: Lync Browser Helper: {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll
BHO: Java™ Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL
BHO: Webroot Filtering Extension: {C9C42510-9B41-42c1-9DCD-7282A2D07C61} - LocalServer32 - <no file>
BHO: Microsoft SkyDrive Pro Browser Helper: {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL
BHO: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
uRun: [AdobeBridge] <no file>
mRun: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
mRun: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe" MSRun
mRun: [NUSB3MON] "C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe"
mRun: [ZoneAlarm] "C:\Program Files (x86)\CheckPoint\ZoneAlarm\zatray.exe"
mRun: [PSUAMain] "C:\Program Files (x86)\Panda Security\Panda Security Protection\PSUAMain.exe" /LaunchSysTray
mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mPolicies-Explorer: NoActiveDesktop = dword:1
mPolicies-Explorer: NoActiveDesktopChanges = dword:1
mPolicies-System: ConsentPromptBehaviorAdmin = dword:5
mPolicies-System: ConsentPromptBehaviorUser = dword:3
mPolicies-System: EnableUIADesktopToggle = dword:0
IE: E&xport to Microsoft Excel - C:\PROGRA~1\MICROS~3\Office15\EXCEL.EXE/3000
IE: Se&nd to OneNote - C:\PROGRA~1\MICROS~3\Office15\ONBttnIE.dll/105
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office15\ONBttnIE.dll
IE: {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll
IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files (x86)\Microsoft Office\Office15\ONBttnIELinkedNotes.dll
TCP: NameServer = 192.168.1.254 192.168.1.254
TCP: Interfaces\{6E77591C-11DD-458A-B7EF-BADCB77B0B07} : DHCPNameServer = 192.168.1.254 192.168.1.254
TCP: Interfaces\{6E77591C-11DD-458A-B7EF-BADCB77B0B07}\65F6461666F6E656D2432354145373 : DHCPNameServer = 192.168.1.254 192.168.1.254
Filter: text/xml - {807583E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE15\MSOXMLMF.DLL
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files (x86)\Microsoft Office\Office15\MSOSB.DLL
SSODL: WebCheck - <orphaned>
x64-BHO: ExplorerWnd Helper: {10921475-03CE-4E04-90CE-E2E7EF20C814} - C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallExplorer64.dll
x64-BHO: Lync Browser Helper: {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\Office15\OCHelper.dll
x64-BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL
x64-BHO: Webroot Filtering Extension: {C9C42510-9B41-42c1-9DCD-7282A2D07C61} - LocalServer32 - <no file>
x64-BHO: Microsoft SkyDrive Pro Browser Helper: {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL
x64-Run: [Cmaudio8788GX64] C:\Windows\system\HsMgr64.exe Envoke
x64-Run: [Cmaudio8788GX] C:\Windows\syswow64\HsMgr.exe Envoke
x64-Run: [Cmaudio8788] C:\Windows\syswow64\RunDll32.exe C:\Windows\Syswow64\cmicnfgp.dll,CMICtrlWnd
x64-Run: [AdobeAAMUpdater-1.0] "C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"
x64-IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files\Microsoft Office\Office15\ONBttnIE.dll
x64-IE: {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\Office15\OCHelper.dll
x64-IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files\Microsoft Office\Office15\ONBttnIELinkedNotes.dll
x64-Filter: text/xml - {807583E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE15\MSOXMLMF.DLL
x64-Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL
x64-SSODL: WebCheck - <orphaned>
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\Joao\AppData\Roaming\Mozilla\Firefox\Profiles\srkse157.default\
FF - prefs.js: browser.search.selectedEngine - Wikipedia (en)
FF - prefs.js: browser.startup.homepage - www.google.com
FF - prefs.js: network.proxy.type - 0
FF - plugin: C:\PROGRA~2\MICROS~2\Office15\NPSPWRAP.DLL
FF - plugin: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll
FF - plugin: C:\Program Files (x86)\Java\jre7\bin\dtplugin\npdeployJava1.dll
FF - plugin: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll
FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrlui.dll
FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npMeetingJoinPluginOC.dll
FF - plugin: C:\Users\Joao\AppData\Roaming\ACEStream\player\npace_plugin.dll
FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll
.
============= SERVICES / DRIVERS ===============
.
R0 PxHlpa64;PxHlpa64;C:\Windows\System32\drivers\PxHlpa64.sys [2014-1-31 56208]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;C:\Windows\System32\drivers\dtsoftbus01.sys [2014-1-18 283064]
R1 NNSALPC;NNSALPC;C:\Windows\System32\drivers\NNSAlpc.sys [2014-6-4 96800]
R1 NNSHTTP;NNSHTTP;C:\Windows\System32\drivers\NNSHttp.sys [2014-6-18 162336]
R1 NNSHTTPS;NNSHTTPS;C:\Windows\System32\drivers\NNSHttps.sys [2014-6-4 112160]
R1 NNSIDS;NNSIDS;C:\Windows\System32\drivers\NNSIds.sys [2014-6-4 115232]
R1 NNSNAHSL;Network Activity Hook Server LightWeight Filter Driver;C:\Windows\System32\drivers\NNSNAHSL.sys [2014-1-16 46336]
R1 NNSPICC;NNSPICC;C:\Windows\System32\drivers\NNSpicc.sys [2014-6-4 95776]
R1 NNSPIHSW;NNSPIHSW;C:\Windows\System32\drivers\NNSPihsw.sys [2014-6-4 70176]
R1 NNSPOP3;NNSPOP3;C:\Windows\System32\drivers\NNSPop3.sys [2014-6-4 125984]
R1 NNSPROT;NNSPROT;C:\Windows\System32\drivers\NNSProt.sys [2014-6-4 306720]
R1 NNSPRV;NNSPRV;C:\Windows\System32\drivers\NNSPrv.sys [2014-6-4 169504]
R1 NNSSMTP;NNSSMTP;C:\Windows\System32\drivers\NNSSmtp.sys [2014-6-4 115744]
R1 NNSSTRM;NNSSTRM;C:\Windows\System32\drivers\NNSStrm.sys [2014-6-4 261152]
R1 NNSTLSC;NNSTLSC;C:\Windows\System32\drivers\NNStlsc.sys [2014-6-4 109088]
R1 PSINKNC;PSINKNC;C:\Windows\System32\drivers\PSINKNC.sys [2014-7-24 195616]
R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\System32\atiesrxx.exe [2014-7-9 239616]
R2 NanoServiceMain;Panda Free Antivirus Service;C:\Program Files (x86)\Panda Security\Panda Security Protection\PSANHost.exe [2014-7-24 141560]
R2 PandaAgent;Panda Devices Agent;C:\Program Files (x86)\Panda Security\Panda Devices Agent\AgentSvc.exe [2014-7-23 61688]
R2 PSINAflt;PSINAflt;C:\Windows\System32\drivers\PSINAflt.sys [2014-7-24 160800]
R2 PSINFile;PSINFile;C:\Windows\System32\drivers\PSINFile.sys [2014-7-24 120352]
R2 PSINProc;PSINProc;C:\Windows\System32\drivers\PSINProc.sys [2014-7-24 122400]
R2 PSINProt;PSINProt;C:\Windows\System32\drivers\PSINProt.sys [2014-7-24 132128]
R2 PSINReg;PSINReg;C:\Windows\System32\drivers\PSINReg.sys [2014-7-24 106016]
R2 PSUAService;Panda Product Service;C:\Program Files (x86)\Panda Security\Panda Security Protection\PSUAService.exe [2014-7-24 38136]
R2 ZAPrivacyService;ZoneAlarm Privacy Service;C:\Program Files (x86)\CheckPoint\ZoneAlarm\ZAPrivacyService.exe [2014-8-13 96272]
R3 AtiHDAudioService;AMD Function Driver for HD Audio Service;C:\Windows\System32\drivers\AtihdW76.sys [2014-6-21 94720]
R3 cmudaxp;ASUS Xonar DG Audio Interface;C:\Windows\System32\drivers\cmudaxp.sys [2013-11-25 2725376]
R3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;C:\Windows\System32\drivers\nusb3hub.sys [2010-11-19 80384]
R3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;C:\Windows\System32\drivers\nusb3xhc.sys [2010-11-19 181248]
R3 PSKMAD;PSKMAD;C:\Windows\System32\drivers\PSKMAD.sys [2014-10-5 60400]
R3 RTL8167;Controlador Realtek 8167 NT;C:\Windows\System32\drivers\Rt64win7.sys [2009-6-10 187392]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2013-9-11 105144]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2013-9-11 124088]
S2 LiveUpdateSvc;LiveUpdate;C:\Program Files (x86)\IObit\LiveUpdate\LiveUpdate.exe [2014-10-3 2281248]
S3 IEEtwCollectorService;Internet Explorer ETW Collector Service;C:\Windows\System32\ieetwcollector.exe [2014-9-26 111616]
S3 MBAMSwissArmy;MBAMSwissArmy;C:\Windows\System32\drivers\MBAMSwissArmy.sys [2014-9-28 122584]
S3 MBAMWebAccessControl;MBAMWebAccessControl;C:\Windows\System32\drivers\mwac.sys [2014-9-28 63704]
S3 ose64;Office 64 Source Engine;C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2014-1-23 178760]
S3 SwitchBoard;SwitchBoard;C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-2-19 517096]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2014-2-17 56832]
S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\System32\drivers\TsUsbGD.sys [2010-11-21 31232]
S3 WatAdminSvc;Serviço de Tecnologias de Activação do Windows;C:\Windows\System32\Wat\WatAdminSvc.exe [2013-11-16 1255736]
.
=============== File Associations ===============
.
FileExt: .txt: Applications\notepad++.exe="C:\Program Files (x86)\Notepad++\notepad++.exe" "%1" [UserChoice]
.
=============== Created Last 30 ================
.
2014-10-09 23:40:52    37624    ----a-w-    C:\Windows\System32\drivers\TrueSight.sys
2014-10-09 23:24:56    --------    d-----w-    C:\ProgramData\RogueKiller
2014-10-08 11:16:54    11578928    ----a-w-    C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{6CF391F2-3F70-4448-A239-AE6565085B18}\mpengine.dll
2014-10-05 09:00:36    60400    ----a-w-    C:\Windows\System32\drivers\PSKMAD.sys
2014-10-03 05:56:55    --------    d-----w-    C:\Users\Joao\AppData\Roaming\ProductData
2014-10-03 05:55:37    --------    d-----w-    C:\ProgramData\IObit
2014-10-03 05:55:34    --------    d-----w-    C:\ProgramData\ProductData
2014-10-03 05:55:25    --------    d-----w-    C:\Program Files (x86)\IObit
2014-10-03 05:54:55    --------    d-----w-    C:\Users\Joao\AppData\Roaming\IObit
2014-10-02 09:42:49    --------    d-----w-    C:\Program Files\MPC-HC
2014-10-01 11:54:33    519680    ----a-w-    C:\Windows\SysWow64\qdvd.dll
2014-10-01 11:54:33    371712    ----a-w-    C:\Windows\System32\qdvd.dll
2014-09-29 11:14:33    --------    d-----w-    C:\Users\Joao\AppData\Roaming\Riot Games
2014-09-28 10:10:02    --------    d-----w-    C:\Users\Joao\AppData\Roaming\Panda Security
2014-09-28 10:09:32    --------    d-----w-    C:\Program Files (x86)\Panda Security
2014-09-28 10:08:26    --------    d-----w-    C:\ProgramData\Panda Security
2014-09-28 04:46:27    --------    d-----w-    C:\Users\Joao\AppData\Local\SlimWare Utilities Inc
2014-09-28 04:44:34    --------    d-----w-    C:\Program Files (x86)\SlimCleaner
2014-09-28 04:42:13    3231696    ----a-w-    C:\Program Files (x86)\Mozilla Firefox\d3dcompiler_46.dll
2014-09-28 03:01:52    122584    ----a-w-    C:\Windows\System32\drivers\MBAMSwissArmy.sys
2014-09-28 02:59:48    91352    ----a-w-    C:\Windows\System32\drivers\mbamchameleon.sys
2014-09-28 02:59:48    63704    ----a-w-    C:\Windows\System32\drivers\mwac.sys
2014-09-28 02:59:48    25816    ----a-w-    C:\Windows\System32\drivers\mbam.sys
2014-09-28 02:59:48    --------    d-----w-    C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-09-27 18:54:27    --------    d-----w-    C:\Program Files (x86)\CheckPoint
2014-09-27 18:53:47    --------    d-----w-    C:\ProgramData\CheckPoint
2014-09-27 01:23:55    7168    ----a-w-    C:\Windows\SysWow64\KBDYAK.DLL
2014-09-27 01:23:55    7168    ----a-w-    C:\Windows\System32\KBDYAK.DLL
2014-09-27 01:23:55    7168    ----a-w-    C:\Windows\System32\KBDBASH.DLL
2014-09-27 01:23:55    6656    ----a-w-    C:\Windows\SysWow64\KBDBASH.DLL
2014-09-26 13:21:13    --------    d-----w-    C:\Users\Joao\AppData\Local\Ubisoft
2014-09-26 10:47:34    2777088    ----a-w-    C:\Windows\System32\msmpeg2vdec.dll
2014-09-26 10:47:34    2285056    ----a-w-    C:\Windows\SysWow64\msmpeg2vdec.dll
2014-09-26 08:40:32    --------    d-----w-    C:\OETemp
2014-09-26 07:56:00    793600    ----a-w-    C:\Windows\SysWow64\TSWorkspace.dll
2014-09-26 07:56:00    1031168    ----a-w-    C:\Windows\System32\TSWorkspace.dll
2014-09-26 07:55:39    2565120    ----a-w-    C:\Windows\System32\d3d10warp.dll
2014-09-26 07:55:38    1987584    ----a-w-    C:\Windows\SysWow64\d3d10warp.dll
2014-09-26 07:55:35    2048    ----a-w-    C:\Windows\SysWow64\tzres.dll
2014-09-26 07:55:35    2048    ----a-w-    C:\Windows\System32\tzres.dll
2014-09-26 07:55:03    96768    ----a-w-    C:\Windows\SysWow64\sspicli.dll
2014-09-26 07:55:03    728064    ----a-w-    C:\Windows\System32\kerberos.dll
2014-09-26 07:55:03    550912    ----a-w-    C:\Windows\SysWow64\kerberos.dll
2014-09-26 07:55:03    22016    ----a-w-    C:\Windows\SysWow64\secur32.dll
2014-09-26 07:55:03    1460736    ----a-w-    C:\Windows\System32\lsasrv.dll
2014-09-25 13:23:24    --------    d-----w-    C:\Users\Joao\AppData\Local\Ubisoft Game Launcher
2014-09-25 11:41:39    --------    d-----w-    C:\AdwCleaner
2014-09-24 00:31:40    --------    d-----w-    C:\Program Files (x86)\Tor Browser
2014-09-16 18:14:12    --------    d-----w-    C:\Program Files (x86)\Origin Games
2014-09-16 18:13:12    --------    d-----w-    C:\Users\Joao\AppData\Roaming\Origin
2014-09-16 18:13:10    --------    d-----w-    C:\Users\Joao\AppData\Local\Origin
2014-09-16 18:12:20    --------    d-----w-    C:\Program Files (x86)\Origin
2014-09-14 22:04:36    --------    d-----w-    C:\Users\Joao\AppData\Local\SKIDROW
2014-09-12 09:43:10    227728    ----a-w-    C:\Program Files (x86)\Mozilla Firefox\plugins\nppdf32.dll
2014-09-11 21:45:53    --------    d-----w-    C:\Users\Joao\AppData\Local\Supraball_Launcher
2014-09-10 07:31:33    --------    d-----w-    C:\ProgramData\WRData
.
==================== Find3M  ====================
.
2014-09-18 02:48:28    71344    ----a-w-    C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2014-09-18 02:48:28    701104    ----a-w-    C:\Windows\SysWow64\FlashPlayerApp.exe
2014-09-15 08:06:02    278152    ------w-    C:\Windows\System32\MpSigStub.exe
2014-08-23 02:07:00    404480    ----a-w-    C:\Windows\System32\gdi32.dll
2014-08-23 01:45:55    311808    ----a-w-    C:\Windows\SysWow64\gdi32.dll
2014-08-23 00:59:01    3163648    ----a-w-    C:\Windows\System32\win32k.sys
2014-08-18 22:29:49    2724864    ----a-w-    C:\Windows\System32\mshtml.tlb
2014-08-18 22:29:35    4096    ----a-w-    C:\Windows\System32\ieetwcollectorres.dll
2014-08-18 22:19:53    5833728    ----a-w-    C:\Windows\System32\jscript9.dll
2014-08-18 22:15:34    547328    ----a-w-    C:\Windows\System32\vbscript.dll
2014-08-18 22:15:09    66048    ----a-w-    C:\Windows\System32\iesetup.dll
2014-08-18 22:14:38    48640    ----a-w-    C:\Windows\System32\ieetwproxystub.dll
2014-08-18 22:14:10    83968    ----a-w-    C:\Windows\System32\MshtmlDac.dll
2014-08-18 22:08:55    4232704    ----a-w-    C:\Windows\SysWow64\jscript9.dll
2014-08-18 22:03:47    139264    ----a-w-    C:\Windows\System32\ieUnatt.exe
2014-08-18 22:03:37    111616    ----a-w-    C:\Windows\System32\ieetwcollector.exe
2014-08-18 22:03:01    758272    ----a-w-    C:\Windows\System32\jscript9diag.dll
2014-08-18 21:57:44    2724864    ----a-w-    C:\Windows\SysWow64\mshtml.tlb
2014-08-18 21:56:17    940032    ----a-w-    C:\Windows\System32\MsSpellCheckingFacility.exe
2014-08-18 21:46:26    454656    ----a-w-    C:\Windows\SysWow64\vbscript.dll
2014-08-18 21:45:23    61952    ----a-w-    C:\Windows\SysWow64\iesetup.dll
2014-08-18 21:45:12    72704    ----a-w-    C:\Windows\System32\JavaScriptCollectionAgent.dll
2014-08-18 21:44:44    51200    ----a-w-    C:\Windows\SysWow64\ieetwproxystub.dll
2014-08-18 21:44:09    61952    ----a-w-    C:\Windows\SysWow64\MshtmlDac.dll
2014-08-18 21:36:07    112128    ----a-w-    C:\Windows\SysWow64\ieUnatt.exe
2014-08-18 21:35:24    597504    ----a-w-    C:\Windows\SysWow64\jscript9diag.dll
2014-08-18 21:23:17    2104832    ----a-w-    C:\Windows\System32\inetcpl.cpl
2014-08-18 21:23:16    1249280    ----a-w-    C:\Windows\System32\mshtmlmedia.dll
2014-08-18 21:22:48    60416    ----a-w-    C:\Windows\SysWow64\JavaScriptCollectionAgent.dll
2014-08-18 21:15:13    2310656    ----a-w-    C:\Windows\System32\wininet.dll
2014-08-18 21:08:54    2014208    ----a-w-    C:\Windows\SysWow64\inetcpl.cpl
2014-08-18 21:07:44    1068032    ----a-w-    C:\Windows\SysWow64\mshtmlmedia.dll
2014-08-18 20:46:48    1812992    ----a-w-    C:\Windows\SysWow64\wininet.dll
2014-08-13 09:16:02    450456    ----a-w-    C:\Windows\System32\drivers\vsdatant.sys
2014-08-08 00:06:27    98216    ----a-w-    C:\Windows\SysWow64\WindowsAccessBridge-32.dll
2014-07-25 01:35:46    875688    ----a-w-    C:\Windows\SysWow64\msvcr120_clr0400.dll
2014-07-24 22:47:06    869544    ----a-w-    C:\Windows\System32\msvcr120_clr0400.dll
2014-07-24 18:24:04    132128    ----a-w-    C:\Windows\System32\drivers\PSINProt.sys
2014-07-24 18:24:04    106016    ----a-w-    C:\Windows\System32\drivers\PSINReg.sys
2014-07-24 18:24:03    195616    ----a-w-    C:\Windows\System32\drivers\PSINKNC.sys
2014-07-24 18:24:03    122400    ----a-w-    C:\Windows\System32\drivers\PSINProc.sys
2014-07-24 18:24:03    120352    ----a-w-    C:\Windows\System32\drivers\PSINFile.sys
2014-07-24 18:24:02    160800    ----a-w-    C:\Windows\System32\drivers\PSINAflt.sys
2014-07-14 02:02:45    1216000    ----a-w-    C:\Windows\System32\rpcrt4.dll
2014-07-14 01:40:58    664064    ----a-w-    C:\Windows\SysWow64\rpcrt4.dll
.
============= FINISH:  7:00:35,90 ===============
 

Attached Files


Edited by hspawn, 10 October 2014 - 01:15 AM.


BC AdBot (Login to Remove)

 


#2 nasdaq

nasdaq

  • Malware Response Team
  • 38,955 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:12:19 PM

Posted 13 October 2014 - 01:16 PM

Hello, Welcome to BleepingComputer.
I'm nasdaq and will be helping you.

If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed.
===

Download Malwarebytes' Anti-Malware from Here

Double-click mbam-setup-2.X.X.XXXX.exe to install the application (X's are the current version number).
  • Make sure a checkmark is placed next to Launch Malwarebytes' Anti-Malware, then click Finish.
  • Once MBAM opens, when it says Your databases are out of date, click the Fix Now button.
  • Click the Settings tab at the top, and then in the left column, select Detections and Protections, and if not already checked place a checkmark in the selection box for Scan for rootkits.
  • Click the Scan tab at the top of the program window, select Threat Scan and click the Scan Now button.
  • If you receive a message that updates are available, click the Update Now button (the update will be downloaded, installed, and the scan will start).
  • The scan may take some time to finish,so please be patient.
  • If potential threats are detected, ensure that Quarantine is selected as the Action for all the listed items, and click the Apply Actions button.
  • While still on the Scan tab, click the link for View detailed log, and in the window that opens click the Export button, select Text file (*.txt), and save the log to your Desktop.
  • The log is automatically saved by MBAM and can also be viewed by clicking the History tab and then selecting Application Logs.
POST THE LOG FOR MY REVIEW.

Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately.

===

Please download AdwCleaner by Xplode onto your Desktop.
  • Close all open programs and internet browsers.
  • Double click on AdwCleaner.exe to run the tool.
  • Click the Scan button and wait for the process to complete.
  • Click the Report button and the report will open in Notepad.
IMPORTANT
  • If you click the Clean button all items listed in the report will be removed.
If you find some false positive items or programs that you wish to keep, Close the AdwCleaner windows.
  • Close all open programs and internet browsers.
  • Double click on AdwCleaner.exe to run the tool.
  • Click the Scan button and wait for the process to complete.
  • Check off the element(s) you wish to keep.
  • Click on the Clean button follow the prompts.
  • A log file will automatically open after the scan has finished.
  • Please post the content of that log file with your next answer.
  • You can find the log file at C:\AdwCleaner[Sn].txt (n is a number).
===

Download the version of this tool for your operating system.
Farbar Recovery Scan Tool (64 bit)
Farbar Recovery Scan Tool (32 bit)
and save it to a folder on your computer's Desktop.
Double-click to run it. When the tool opens click Yes to disclaimer.
Press Scan button.
It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.
===

Please paste the logs in your next reply DO NOT ATTACH THEM unless specified.
To attach a file select the "More Reply Option" and follow the instructions.

What problems do you have with this computer?

Wait for further instructions.

#3 hspawn

hspawn
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:05:19 PM

Posted 14 October 2014 - 02:40 PM

MBAM log:
 
Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 14-10-2014
Scan Time: 17:39:42
Logfile: 1.txt
Administrator: Yes

Version: 2.00.2.1012
Malware Database: v2014.10.14.09
Rootkit Database: v2014.10.11.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: Joao

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 310579
Time Elapsed: 7 min, 31 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 0
(No malicious items detected)

Physical Sectors: 0
(No malicious items detected)


(end)
 
---------------
 
AdwCleaner log:
 
# AdwCleaner v4.000 - Report created 14/10/2014 at 17:55:32
# Updated 12/10/2014 by Xplode
# Database : 2014-10-13.5
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
# Username : Joao - JOÃO-PC
# Running from : C:\Users\Joao\Desktop\adwcleaner_4.000.exe
# Option : Scan

***** [ Services ] *****


***** [ Files / Folders ] *****


***** [ Scheduled Tasks ] *****


***** [ Shortcuts ] *****


***** [ Registry ] *****


***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.17280


-\\ Mozilla Firefox v32.0.3 (x86 en-US)


*************************

AdwCleaner[R0].txt - [1140 octets] - [25/09/2014 12:41:59]
AdwCleaner[R1].txt - [1201 octets] - [26/09/2014 00:01:16]
AdwCleaner[R2].txt - [988 octets] - [26/09/2014 00:08:19]
AdwCleaner[R3].txt - [1047 octets] - [26/09/2014 06:14:14]
AdwCleaner[R4].txt - [1108 octets] - [27/09/2014 05:13:47]
AdwCleaner[R5].txt - [1174 octets] - [27/09/2014 05:16:49]
AdwCleaner[R6].txt - [3041 octets] - [04/10/2014 01:52:37]
AdwCleaner[R7].txt - [3107 octets] - [04/10/2014 01:59:04]
AdwCleaner[R8].txt - [1349 octets] - [12/10/2014 23:00:54]
AdwCleaner[R9].txt - [1149 octets] - [14/10/2014 17:55:32]
AdwCleaner[S0].txt - [1180 octets] - [26/09/2014 00:05:49]
AdwCleaner[S1].txt - [3214 octets] - [04/10/2014 02:08:02]
AdwCleaner[S2].txt - [1403 octets] - [12/10/2014 23:04:01]

########## EOF - C:\AdwCleaner\AdwCleaner[R9].txt - [1389 octets] ##########
 
Farbar log:
 
FRST:
 
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 12-10-2014 02
Ran by Joao (administrator) on JOÃO-PC on 14-10-2014 18:15:31
Running from C:\Users\Joao\Desktop
Loaded Profile: Joao (Available profiles: Joao)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Português (Portugal)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Check Point Software Technologies Ltd.) C:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exe
(Panda Security, S.L.) C:\Program Files (x86)\Panda Security\Panda Security Protection\PSANHost.exe
(Panda Security, S.L.) C:\Program Files (x86)\Panda Security\Panda Devices Agent\AgentSvc.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Panda Security, S.L.) C:\Program Files (x86)\Panda Security\Panda Security Protection\PSUAService.exe
(Check Point Software Technologies, Ltd.) C:\Program Files (x86)\CheckPoint\ZoneAlarm\ZAPrivacyService.exe
() C:\Windows\system\HsMgr64.exe
() C:\Windows\SysWOW64\HsMgr.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(CMedia) C:\Program Files\ASUS Xonar DG Audio\Customapp\AsusAudioCenter.exe
(Check Point Software Technologies Ltd.) C:\Program Files (x86)\CheckPoint\ZoneAlarm\zatray.exe
(Panda Security, S.L.) C:\Program Files (x86)\Panda Security\Panda Security Protection\PSUAMain.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_15_0_0_152.exe
(IObit) C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallMonitor.exe
(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe
(Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
(Sports Interactive) C:\Program Files (x86)\Steam\SteamApps\common\Football Manager 2012\fm.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_15_0_0_152.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_15_0_0_152.exe
(Don HO don.h@free.fr) C:\Program Files (x86)\Notepad++\notepad++.exe
(Microsoft Corporation) C:\Windows\SysWOW64\wbem\WmiPrvSE.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Cmaudio8788GX64] => C:\Windows\system\HsMgr64.exe [282112 2008-07-11] ()
HKLM\...\Run: [Cmaudio8788GX] => C:\Windows\syswow64\HsMgr.exe [200704 2008-07-11] ()
HKLM\...\Run: [Cmaudio8788] => C:\Windows\syswow64\RunDll32.exe C:\Windows\Syswow64\cmicnfgp.dll,CMICtrlWnd
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [446392 2012-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SwitchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [NUSB3MON] => C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-11-17] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [ZoneAlarm] => C:\Program Files (x86)\CheckPoint\ZoneAlarm\zatray.exe [137352 2014-08-13] (Check Point Software Technologies Ltd.)
HKLM-x32\...\Run: [PSUAMain] => C:\Program Files (x86)\Panda Security\Panda Security Protection\PSUAMain.exe [37624 2014-07-24] (Panda Security, S.L.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-25] (Oracle Corporation)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [767200 2014-09-15] (Advanced Micro Devices, Inc.)
HKU\S-1-5-21-2382355001-1013221568-367977049-1004\...\Run: [AdobeBridge] => [X]
HKU\S-1-5-21-2382355001-1013221568-367977049-1004\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3675352 2013-10-28] (Disc Soft Ltd)
HKU\S-1-5-21-2382355001-1013221568-367977049-1004\...\MountPoints2: F - F:\setup.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/pt-pt/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xF198B90763E3CF01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = pt-PT
BHO: ExplorerWnd Helper -> {10921475-03CE-4E04-90CE-E2E7EF20C814} -> C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallExplorer64.dll (IObit)
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)
BHO: Webroot Filtering Extension -> {C9C42510-9B41-42c1-9DCD-7282A2D07C61} ->  No File
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Webroot Filtering Extension -> {C9C42510-9B41-42c1-9DCD-7282A2D07C61} ->  No File
BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.254 192.168.1.254

FireFox:
========
FF ProfilePath: C:\Users\Joao\AppData\Roaming\Mozilla\Firefox\Profiles\srkse157.default
FF DefaultSearchEngine: Wikipedia (en)
FF SelectedSearchEngine: Wikipedia (en)
FF Homepage: www.google.com
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_152.dll ()
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~3\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
FF Plugin-x32: @esn/npbattlelog,version=2.3.2 -> C:\Program Files (x86)\Battlelog Web Plugins\2.3.2\npbattlelog.dll No File
FF Plugin-x32: @esn/npbattlelog,version=2.4.0 -> C:\Program Files (x86)\Battlelog Web Plugins\2.4.0\npbattlelog.dll No File
FF Plugin-x32: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~2\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @acestream.net/acestreamplugin,version=2.2.10-next -> C:\Users\Joao\AppData\Roaming\ACEStream\player\npace_plugin.dll (Innovative Digital Technologies)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Extension: Corretor para Português de Portugal - C:\Users\Joao\AppData\Roaming\Mozilla\Firefox\Profiles\srkse157.default\Extensions\pt-PT@dictionaries.addons.mozilla.org [2014-10-03]
FF Extension: Flash and Video Download - C:\Users\Joao\AppData\Roaming\Mozilla\Firefox\Profiles\srkse157.default\Extensions\{bee6eb20-01e0-ebd1-da83-080329fb9a3a} [2014-10-13]
FF Extension: Ghostery - C:\Users\Joao\AppData\Roaming\Mozilla\Firefox\Profiles\srkse157.default\Extensions\firefox@ghostery.com.xpi [2014-07-10]
FF Extension: Self-Destructing Cookies - C:\Users\Joao\AppData\Roaming\Mozilla\Firefox\Profiles\srkse157.default\Extensions\jid0-9XfBwUWnvPx4wWsfBWMCm4Jj69E@jetpack.xpi [2014-07-10]
FF Extension: Adblock Plus - C:\Users\Joao\AppData\Roaming\Mozilla\Firefox\Profiles\srkse157.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-07-09]
FF HKLM-x32\...\Firefox\Extensions: [webrootsecure@webroot.com] - C:\ProgramData\WRData\PKG\FIREFOX\WebrootSecure_SocketServer

Chrome:
=======

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S2 LiveUpdateSvc; C:\Program Files (x86)\IObit\LiveUpdate\LiveUpdate.exe [2281248 2014-10-03] (IObit)
R2 NanoServiceMain; C:\Program Files (x86)\Panda Security\Panda Security Protection\PSANHost.exe [141560 2014-07-24] (Panda Security, S.L.)
R2 PandaAgent; C:\Program Files (x86)\Panda Security\Panda Devices Agent\AgentSvc.exe [61688 2014-07-23] (Panda Security, S.L.)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2014-06-14] ()
R2 PSUAService; C:\Program Files (x86)\Panda Security\Panda Security Protection\PSUAService.exe [38136 2014-07-24] (Panda Security, S.L.)
S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]
R2 vsmon; C:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exe [3596752 2014-08-13] (Check Point Software Technologies Ltd.)
R2 ZAPrivacyService; C:\Program Files (x86)\CheckPoint\ZoneAlarm\ZaPrivacyService.exe [96272 2014-08-13] (Check Point Software Technologies, Ltd.)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 cmudaxp; C:\Windows\System32\drivers\cmudaxp.sys [2725376 2011-03-10] (C-Media Inc)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2014-01-18] (Disc Soft Ltd)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-05-12] (Malwarebytes Corporation)
R1 NNSALPC; C:\Windows\System32\DRIVERS\NNSAlpc.sys [96800 2014-06-04] (Panda Security, S.L.)
R1 NNSHTTP; C:\Windows\System32\DRIVERS\NNSHttp.sys [162336 2014-06-18] (Panda Security, S.L.)
R1 NNSHTTPS; C:\Windows\System32\DRIVERS\NNSHttps.sys [112160 2014-06-04] (Panda Security, S.L.)
R1 NNSIDS; C:\Windows\System32\DRIVERS\NNSIds.sys [115232 2014-06-04] (Panda Security, S.L.)
R1 NNSNAHSL; C:\Windows\System32\DRIVERS\NNSNAHSL.sys [46336 2014-01-16] (Panda Security, S.L.)
R1 NNSPICC; C:\Windows\System32\DRIVERS\NNSPicc.sys [95776 2014-06-04] (Panda Security, S.L.)
R1 NNSPIHSW; C:\Windows\System32\DRIVERS\NNSPihsw.sys [70176 2014-06-04] (Panda Security, S.L.)
R1 NNSPOP3; C:\Windows\System32\DRIVERS\NNSPop3.sys [125984 2014-06-04] (Panda Security, S.L.)
R1 NNSPROT; C:\Windows\System32\DRIVERS\NNSProt.sys [306720 2014-06-04] (Panda Security, S.L.)
R1 NNSPRV; C:\Windows\System32\DRIVERS\NNSPrv.sys [169504 2014-06-04] (Panda Security, S.L.)
R1 NNSSMTP; C:\Windows\System32\DRIVERS\NNSSmtp.sys [115744 2014-06-04] (Panda Security, S.L.)
R1 NNSSTRM; C:\Windows\System32\DRIVERS\NNSStrm.sys [261152 2014-06-04] (Panda Security, S.L.)
R1 NNSTLSC; C:\Windows\System32\DRIVERS\NNSTlsc.sys [109088 2014-06-04] (Panda Security, S.L.)
R2 PSINAflt; C:\Windows\System32\DRIVERS\PSINAflt.sys [160800 2014-07-24] (Panda Security, S.L.)
R2 PSINFile; C:\Windows\System32\DRIVERS\PSINFile.sys [120352 2014-07-24] (Panda Security, S.L.)
R1 PSINKNC; C:\Windows\System32\DRIVERS\psinknc.sys [195616 2014-07-24] (Panda Security, S.L.)
R2 PSINProc; C:\Windows\System32\DRIVERS\PSINProc.sys [122400 2014-07-24] (Panda Security, S.L.)
R2 PSINProt; C:\Windows\System32\DRIVERS\PSINProt.sys [132128 2014-07-24] (Panda Security, S.L.)
R2 PSINReg; C:\Windows\System32\DRIVERS\PSINReg.sys [106016 2014-07-24] (Panda Security, S.L.)
R3 PSKMAD; C:\Windows\System32\DRIVERS\PSKMAD.sys [60400 2014-03-25] (Panda Security, S.L.)
S2 tandpl; C:\Windows\SysWOW64\drivers\tandpl.sys [4736 2003-04-19] () [File not signed]
R1 Vsdatant; C:\Windows\System32\DRIVERS\vsdatant.sys [450456 2014-08-13] (Check Point Software Technologies Ltd.)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-14 18:15 - 2014-10-14 18:15 - 00014752 _____ () C:\Users\Joao\Desktop\FRST.txt
2014-10-14 18:14 - 2014-10-14 18:15 - 00000000 ____D () C:\FRST
2014-10-14 17:57 - 2014-10-14 17:58 - 02110464 _____ (Farbar) C:\Users\Joao\Desktop\FRST64.exe
2014-10-14 17:47 - 2014-10-14 17:47 - 00001050 _____ () C:\Users\Joao\Desktop\MBAM.txt
2014-10-14 00:37 - 2014-10-14 00:37 - 00000000 ____D () C:\Users\Joao\AppData\Roaming\Steam
2014-10-13 22:07 - 2014-10-13 22:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Alien Isolation
2014-10-13 22:06 - 2014-10-13 22:06 - 00001020 _____ () C:\Users\Joao\Desktop\Alien Isolation.lnk
2014-10-13 21:55 - 2014-10-13 22:19 - 00000000 ____D () C:\Program Files (x86)\Alien Isolation
2014-10-13 20:16 - 2014-10-13 20:16 - 00112456 _____ () C:\Users\Joao\AppData\Local\GDIPFONTCACHEV1.DAT
2014-10-13 20:11 - 2014-10-13 20:11 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-10-13 20:11 - 2014-10-13 20:11 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-10-12 23:00 - 2014-10-12 23:00 - 01976320 _____ () C:\Users\Joao\Desktop\adwcleaner_4.000.exe
2014-10-12 17:28 - 2014-10-12 17:28 - 00000000 ____D () C:\ProgramData\ATI
2014-10-12 17:28 - 2014-10-12 17:28 - 00000000 ____D () C:\Program Files (x86)\AMD AVT
2014-10-12 17:26 - 2014-10-12 17:26 - 00056548 _____ () C:\Windows\SysWOW64\CCCInstall_201410121726383212.log
2014-10-12 17:26 - 2014-10-12 17:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Catalyst Control Center
2014-10-12 17:25 - 2014-10-12 17:25 - 00000000 ____D () C:\Program Files (x86)\ATI Technologies
2014-10-12 14:45 - 2014-03-25 14:15 - 00060400 _____ (Panda Security, S.L.) C:\Windows\system32\Drivers\PSKMAD.sys
2014-10-11 17:18 - 2014-10-11 17:18 - 00001316 _____ () C:\Users\Public\Desktop\Dragon Age Origins.lnk
2014-10-11 17:18 - 2014-10-11 17:18 - 00000000 ____D () C:\Users\Joao\Documents\BioWare
2014-10-11 17:18 - 2014-10-11 17:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dragon Age Origins
2014-10-11 17:17 - 2014-10-11 17:17 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation
2014-10-10 16:21 - 2014-10-14 15:32 - 00000000 ____D () C:\Users\Joao\AppData\Local\CrashDumps
2014-10-10 07:00 - 2014-10-10 07:00 - 00021122 _____ () C:\Users\Joao\Desktop\dds.txt
2014-10-10 07:00 - 2014-10-10 07:00 - 00007548 _____ () C:\Users\Joao\Desktop\attach.txt
2014-10-10 06:58 - 2014-10-10 06:58 - 00688992 ____R (Swearware) C:\Users\Joao\Desktop\dds.com
2014-10-10 00:40 - 2014-10-13 20:04 - 00037624 _____ () C:\Windows\system32\Drivers\TrueSight.sys
2014-10-10 00:24 - 2014-10-10 00:25 - 00000000 ____D () C:\ProgramData\RogueKiller
2014-10-09 22:00 - 2014-10-10 17:38 - 18495064 _____ () C:\Users\Joao\Desktop\RogueKiller.exe
2014-10-07 15:25 - 2014-10-07 15:25 - 00000222 _____ () C:\Users\Joao\Desktop\Ghost Recon Phantoms.url
2014-10-06 20:27 - 2014-10-06 20:53 - 00000616 _____ () C:\Users\Joao\.swfinfo
2014-10-03 06:56 - 2014-10-03 06:56 - 00000000 ____D () C:\Users\Joao\AppData\Roaming\ProductData
2014-10-03 06:55 - 2014-10-14 15:30 - 00000000 ____D () C:\ProgramData\ProductData
2014-10-03 06:55 - 2014-10-03 06:56 - 00000000 ____D () C:\ProgramData\IObit
2014-10-03 06:55 - 2014-10-03 06:55 - 00002884 _____ () C:\Windows\System32\Tasks\Uninstaller_SkipUac_Joao
2014-10-03 06:55 - 2014-10-03 06:55 - 00001228 _____ () C:\Users\Public\Desktop\IObit Uninstaller.lnk
2014-10-03 06:55 - 2014-10-03 06:55 - 00000000 ____D () C:\Program Files (x86)\IObit
2014-10-03 06:54 - 2014-10-03 06:54 - 00000000 ____D () C:\Users\Joao\AppData\Roaming\IObit
2014-10-02 10:42 - 2014-10-02 10:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MPC-HC x64
2014-10-02 10:42 - 2014-10-02 10:42 - 00000000 ____D () C:\Program Files\MPC-HC
2014-10-01 12:54 - 2014-09-25 03:08 - 00371712 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2014-10-01 12:54 - 2014-09-25 02:40 - 00519680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll
2014-09-29 12:14 - 2014-09-29 12:19 - 00000000 ____D () C:\Users\Joao\AppData\Roaming\Riot Games
2014-09-29 01:06 - 2014-10-14 15:32 - 00003758 _____ () C:\Windows\System32\Tasks\AutoKMS
2014-09-28 11:10 - 2014-09-28 11:10 - 00000000 ____D () C:\Users\Joao\AppData\Roaming\Panda Security
2014-09-28 11:09 - 2014-10-13 20:10 - 00000000 ____D () C:\Program Files (x86)\Panda Security
2014-09-28 11:09 - 2014-09-28 11:09 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Panda Free Antivirus
2014-09-28 11:08 - 2014-09-28 11:10 - 00000000 ____D () C:\ProgramData\Panda Security
2014-09-28 05:46 - 2014-09-28 05:46 - 00000000 ____D () C:\Users\Joao\AppData\Local\SlimWare Utilities Inc
2014-09-28 05:44 - 2014-09-29 18:33 - 00002467 _____ () C:\Users\Public\Desktop\SlimCleaner.lnk
2014-09-28 05:44 - 2014-09-29 18:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SlimCleaner
2014-09-28 05:44 - 2014-09-28 05:46 - 00000000 ____D () C:\Program Files (x86)\SlimCleaner
2014-09-28 05:44 - 2014-09-28 05:44 - 00003010 _____ () C:\Windows\System32\Tasks\SlimCleaner Run
2014-09-28 05:44 - 2014-09-28 05:44 - 00000000 ____D () C:\Users\Public\Documents\Downloaded Installers
2014-09-28 04:01 - 2014-10-14 16:48 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-09-28 04:01 - 2014-09-28 04:01 - 00001102 _____ () C:\Users\Public\Desktop\Malwarebytes.lnk
2014-09-28 04:01 - 2014-09-28 04:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-09-28 03:59 - 2014-09-28 04:01 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-09-28 03:59 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-09-28 03:59 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-09-28 03:59 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-09-27 19:56 - 2014-09-27 19:56 - 00431395 _____ () C:\Windows\system32\Drivers\vsconfig.xml
2014-09-27 19:56 - 2014-09-27 19:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Check Point
2014-09-27 19:54 - 2014-09-27 19:56 - 00000000 ____D () C:\Program Files (x86)\CheckPoint
2014-09-27 19:53 - 2014-09-27 19:53 - 00000000 ____D () C:\ProgramData\CheckPoint
2014-09-27 02:23 - 2014-07-09 03:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDYAK.DLL
2014-09-27 02:23 - 2014-07-09 03:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDTAT.DLL
2014-09-27 02:23 - 2014-07-09 03:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU1.DLL
2014-09-27 02:23 - 2014-07-09 03:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDBASH.DLL
2014-09-27 02:23 - 2014-07-09 03:03 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU.DLL
2014-09-27 02:23 - 2014-07-09 02:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDYAK.DLL
2014-09-27 02:23 - 2014-07-09 02:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDTAT.DLL
2014-09-27 02:23 - 2014-07-09 02:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU1.DLL
2014-09-27 02:23 - 2014-07-09 02:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU.DLL
2014-09-27 02:23 - 2014-07-09 02:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDBASH.DLL
2014-09-27 02:23 - 2014-07-08 23:38 - 00419992 _____ () C:\Windows\system32\locale.nls
2014-09-27 02:23 - 2014-07-08 23:30 - 00419992 _____ () C:\Windows\SysWOW64\locale.nls
2014-09-26 14:21 - 2014-09-26 14:21 - 00000000 ____D () C:\Users\Joao\AppData\Local\Ubisoft
2014-09-26 11:56 - 2014-08-19 19:05 - 00374968 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-09-26 11:56 - 2014-08-19 18:39 - 00327872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-09-26 11:56 - 2014-08-19 00:01 - 23591424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-09-26 11:56 - 2014-08-18 23:29 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-09-26 11:56 - 2014-08-18 23:29 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-09-26 11:56 - 2014-08-18 23:26 - 17455104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-09-26 11:56 - 2014-08-18 23:20 - 02793984 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-09-26 11:56 - 2014-08-18 23:19 - 05833728 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-09-26 11:56 - 2014-08-18 23:15 - 00547328 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-09-26 11:56 - 2014-08-18 23:15 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-09-26 11:56 - 2014-08-18 23:14 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-09-26 11:56 - 2014-08-18 23:14 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-09-26 11:56 - 2014-08-18 23:08 - 04232704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-09-26 11:56 - 2014-08-18 23:08 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-09-26 11:56 - 2014-08-18 23:08 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-09-26 11:56 - 2014-08-18 23:05 - 00596480 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-09-26 11:56 - 2014-08-18 23:03 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-09-26 11:56 - 2014-08-18 23:03 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-09-26 11:56 - 2014-08-18 23:03 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-09-26 11:56 - 2014-08-18 22:57 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-09-26 11:56 - 2014-08-18 22:56 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-09-26 11:56 - 2014-08-18 22:51 - 00446464 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-09-26 11:56 - 2014-08-18 22:46 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-09-26 11:56 - 2014-08-18 22:45 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-09-26 11:56 - 2014-08-18 22:45 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-09-26 11:56 - 2014-08-18 22:44 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-09-26 11:56 - 2014-08-18 22:44 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-09-26 11:56 - 2014-08-18 22:42 - 02185728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-09-26 11:56 - 2014-08-18 22:40 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-09-26 11:56 - 2014-08-18 22:39 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-09-26 11:56 - 2014-08-18 22:39 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-09-26 11:56 - 2014-08-18 22:39 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-09-26 11:56 - 2014-08-18 22:38 - 00289280 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-09-26 11:56 - 2014-08-18 22:37 - 00440320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-09-26 11:56 - 2014-08-18 22:36 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-09-26 11:56 - 2014-08-18 22:35 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-09-26 11:56 - 2014-08-18 22:27 - 00365056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-09-26 11:56 - 2014-08-18 22:25 - 00727040 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-09-26 11:56 - 2014-08-18 22:25 - 00707072 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-09-26 11:56 - 2014-08-18 22:23 - 02104832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-09-26 11:56 - 2014-08-18 22:23 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-09-26 11:56 - 2014-08-18 22:22 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-09-26 11:56 - 2014-08-18 22:19 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-09-26 11:56 - 2014-08-18 22:17 - 00243200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-09-26 11:56 - 2014-08-18 22:17 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-09-26 11:56 - 2014-08-18 22:16 - 13588480 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-09-26 11:56 - 2014-08-18 22:15 - 11769856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-09-26 11:56 - 2014-08-18 22:15 - 02310656 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-09-26 11:56 - 2014-08-18 22:09 - 00603136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-09-26 11:56 - 2014-08-18 22:08 - 02014208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-09-26 11:56 - 2014-08-18 22:07 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-09-26 11:56 - 2014-08-18 21:55 - 01447424 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-09-26 11:56 - 2014-08-18 21:46 - 01812992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-09-26 11:56 - 2014-08-18 21:38 - 01190400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-09-26 11:56 - 2014-08-18 21:38 - 00775168 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-09-26 11:56 - 2014-08-18 21:36 - 00678400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-09-26 11:47 - 2014-06-27 03:08 - 02777088 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll
2014-09-26 11:47 - 2014-06-27 02:45 - 02285056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msmpeg2vdec.dll
2014-09-26 09:40 - 2014-09-26 09:40 - 00000000 ____D () C:\OETemp
2014-09-26 08:56 - 2014-08-01 12:53 - 01031168 _____ (Microsoft Corporation) C:\Windows\system32\TSWorkspace.dll
2014-09-26 08:56 - 2014-08-01 12:35 - 00793600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSWorkspace.dll
2014-09-26 08:55 - 2014-09-09 23:11 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-09-26 08:55 - 2014-09-09 22:47 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2014-09-26 08:55 - 2014-07-07 03:06 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-09-26 08:55 - 2014-07-07 03:06 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-09-26 08:55 - 2014-07-07 02:40 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-09-26 08:55 - 2014-07-07 02:40 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-09-26 08:55 - 2014-07-07 02:39 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-09-26 08:55 - 2014-06-24 04:29 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2014-09-26 08:55 - 2014-06-24 03:59 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2014-09-26 08:35 - 2014-09-28 11:03 - 00001912 _____ () C:\Windows\epplauncher.mif
2014-09-25 22:44 - 2014-09-25 22:44 - 00000230 _____ () C:\Users\Joao\Desktop\Far Cry 3.url
2014-09-25 14:23 - 2014-09-25 14:25 - 00000000 ____D () C:\Users\Joao\AppData\Local\Ubisoft Game Launcher
2014-09-25 14:23 - 2014-09-25 14:23 - 00001201 _____ () C:\Users\Joao\Desktop\Uplay.lnk
2014-09-25 14:23 - 2014-09-25 14:23 - 00000000 ____D () C:\Users\Joao\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Ubisoft
2014-09-25 14:23 - 2014-09-25 14:23 - 00000000 ____D () C:\Program Files (x86)\Ubisoft
2014-09-25 12:41 - 2014-10-14 17:56 - 00000000 ____D () C:\AdwCleaner
2014-09-24 01:32 - 2014-09-24 01:32 - 00001073 _____ () C:\Users\Joao\Desktop\Tor.lnk
2014-09-24 01:31 - 2014-09-24 01:31 - 00000000 ____D () C:\Program Files (x86)\Tor Browser
2014-09-16 19:14 - 2014-10-08 19:41 - 00000000 ____D () C:\Program Files (x86)\Origin Games
2014-09-16 19:13 - 2014-10-08 18:54 - 00000000 ____D () C:\Users\Joao\AppData\Roaming\Origin
2014-09-16 19:13 - 2014-09-16 19:14 - 00000000 ____D () C:\Users\Joao\AppData\Local\Origin
2014-09-16 19:12 - 2014-10-11 17:05 - 00000000 ____D () C:\Program Files (x86)\Origin
2014-09-16 19:12 - 2014-09-16 19:12 - 00000979 _____ () C:\Users\Public\Desktop\Origin.lnk
2014-09-16 19:12 - 2014-09-16 19:12 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Origin
2014-09-15 23:32 - 2014-09-15 23:32 - 00078432 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atimpc64.dll
2014-09-15 23:32 - 2014-09-15 23:32 - 00078432 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\amdpcom64.dll
2014-09-15 23:32 - 2014-09-15 23:32 - 00071704 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\atimpc32.dll
2014-09-15 23:32 - 2014-09-15 23:32 - 00071704 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\amdpcom32.dll
2014-09-15 23:29 - 2014-09-15 23:29 - 00293088 _____ (Advanced Micro Devices) C:\Windows\system32\Drivers\amdacpksd.sys
2014-09-15 23:26 - 2014-09-15 23:26 - 16750080 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\Drivers\atikmdag.sys
2014-09-15 23:18 - 2014-09-15 23:18 - 00235008 _____ () C:\Windows\system32\clinfo.exe
2014-09-15 23:18 - 2014-09-15 23:18 - 00098816 _____ (Advanced Micro Devices Inc.) C:\Windows\system32\OpenVideo64.dll
2014-09-15 23:17 - 2014-09-15 23:17 - 33867264 _____ (Advanced Micro Devices Inc.) C:\Windows\system32\amdocl64.dll
2014-09-15 23:17 - 2014-09-15 23:17 - 28770304 _____ (Advanced Micro Devices Inc.) C:\Windows\SysWOW64\amdocl.dll
2014-09-15 23:17 - 2014-09-15 23:17 - 00086528 _____ (Advanced Micro Devices Inc.) C:\Windows\system32\OVDecode64.dll
2014-09-15 23:17 - 2014-09-15 23:17 - 00083456 _____ (Advanced Micro Devices Inc.) C:\Windows\SysWOW64\OpenVideo.dll
2014-09-15 23:17 - 2014-09-15 23:17 - 00073216 _____ (Advanced Micro Devices Inc.) C:\Windows\SysWOW64\OVDecode.dll
2014-09-15 23:16 - 2014-09-15 23:16 - 00065024 _____ (Khronos Group) C:\Windows\system32\OpenCL.dll
2014-09-15 23:16 - 2014-09-15 23:16 - 00058880 _____ (Khronos Group) C:\Windows\SysWOW64\OpenCL.dll
2014-09-15 23:13 - 2014-09-15 23:13 - 27918336 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\atio6axx.dll
2014-09-15 23:09 - 2014-09-15 23:09 - 05639168 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\amdmantle64.dll
2014-09-15 23:09 - 2014-09-15 23:09 - 00127488 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\mantle64.dll
2014-09-15 23:09 - 2014-09-15 23:09 - 00113664 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\mantle32.dll
2014-09-15 23:09 - 2014-09-15 23:09 - 00048128 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\amdmmcl6.dll
2014-09-15 23:09 - 2014-09-15 23:09 - 00037888 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\amdmmcl.dll
2014-09-15 23:08 - 2014-09-15 23:08 - 23375360 _____ (Advanced Micro Devices, Inc.) C:\Windows\SysWOW64\atioglxx.dll
2014-09-15 23:07 - 2014-09-15 23:07 - 15716352 _____ (Advanced Micro Devices Inc.) C:\Windows\system32\aticaldd64.dll
2014-09-15 23:07 - 2014-09-15 23:07 - 03437632 _____ () C:\Windows\system32\atiumd6a.cap
2014-09-15 23:07 - 2014-09-15 23:07 - 00609272 _____ () C:\Windows\SysWOW64\atiapfxx.blb
2014-09-15 23:07 - 2014-09-15 23:07 - 00609272 _____ () C:\Windows\system32\atiapfxx.blb
2014-09-15 23:07 - 2014-09-15 23:07 - 00367104 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\atiapfxx.exe
2014-09-15 23:07 - 2014-09-15 23:07 - 00062464 _____ (Advanced Micro Devices Inc.) C:\Windows\system32\aticalrt64.dll
2014-09-15 23:07 - 2014-09-15 23:07 - 00055808 _____ (Advanced Micro Devices Inc.) C:\Windows\system32\aticalcl64.dll
2014-09-15 23:07 - 2014-09-15 23:07 - 00052224 _____ (Advanced Micro Devices Inc.) C:\Windows\SysWOW64\aticalrt.dll
2014-09-15 23:07 - 2014-09-15 23:07 - 00049152 _____ (Advanced Micro Devices Inc.) C:\Windows\SysWOW64\aticalcl.dll
2014-09-15 23:06 - 2014-09-15 23:06 - 14302208 _____ (Advanced Micro Devices Inc.) C:\Windows\SysWOW64\aticaldd.dll
2014-09-15 23:05 - 2014-09-15 23:05 - 04480000 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\amdmantle32.dll
2014-09-15 23:03 - 2014-09-15 23:03 - 03471376 _____ () C:\Windows\SysWOW64\atiumdva.cap
2014-09-15 23:03 - 2014-09-15 23:03 - 00619008 _____ (AMD) C:\Windows\system32\atieclxx.exe
2014-09-15 23:03 - 2014-09-15 23:03 - 00239616 _____ (AMD) C:\Windows\system32\atiesrxx.exe
2014-09-15 23:03 - 2014-09-15 23:03 - 00190976 _____ (AMD) C:\Windows\system32\atitmm64.dll
2014-09-15 23:03 - 2014-09-15 23:03 - 00091648 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\mantleaxl64.dll
2014-09-15 23:03 - 2014-09-15 23:03 - 00085504 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\mantleaxl32.dll
2014-09-15 23:03 - 2014-09-15 23:03 - 00031232 _____ (AMD) C:\Windows\system32\atimuixx.dll
2014-09-15 22:59 - 2014-09-15 22:59 - 00900608 _____ (Advanced Micro Devices, Inc.) C:\Windows\SysWOW64\atiadlxy.dll
2014-09-15 22:59 - 2014-09-15 22:59 - 00827392 _____ (AMD) C:\Windows\system32\coinst_14.30.dll
2014-09-15 22:59 - 2014-09-15 22:59 - 00576000 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\Drivers\atikmpag.sys
2014-09-15 22:59 - 2014-09-15 22:59 - 00146944 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atig6txx.dll
2014-09-15 22:59 - 2014-09-15 22:59 - 00133632 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\atigktxx.dll
2014-09-15 22:59 - 2014-09-15 22:59 - 00075264 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atig6pxx.dll
2014-09-15 22:59 - 2014-09-15 22:59 - 00069632 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\atiglpxx.dll
2014-09-15 22:59 - 2014-09-15 22:59 - 00069632 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atiglpxx.dll
2014-09-15 22:58 - 2014-09-15 22:58 - 00043520 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\Drivers\ati2erec.dll
2014-09-15 18:21 - 2014-09-15 18:21 - 00051200 _____ () C:\Windows\system32\kdbsdk64.dll
2014-09-15 18:19 - 2014-09-15 18:19 - 00038912 _____ () C:\Windows\SysWOW64\kdbsdk32.dll
2014-09-14 23:04 - 2014-09-14 23:04 - 00000000 ____D () C:\Users\Joao\AppData\Local\SKIDROW

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-14 18:07 - 2014-08-20 18:31 - 00000000 ____D () C:\Users\Joao\AppData\Roaming\.ACEStream
2014-10-14 15:37 - 2009-07-14 05:45 - 00021888 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-10-14 15:37 - 2009-07-14 05:45 - 00021888 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-10-14 15:33 - 2013-11-22 16:25 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-10-14 15:33 - 2013-11-16 20:28 - 01786681 _____ () C:\Windows\WindowsUpdate.log
2014-10-14 15:28 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-10-14 15:28 - 2009-07-14 05:51 - 00055916 _____ () C:\Windows\setupact.log
2014-10-14 03:32 - 2014-07-09 03:19 - 00000000 ____D () C:\Users\Joao\AppData\Roaming\uTorrent
2014-10-14 03:25 - 2013-11-18 14:57 - 00000000 ____D () C:\Users\Joao\Downloads Completed
2014-10-13 21:52 - 2014-01-18 18:13 - 00000000 ____D () C:\Users\Joao\AppData\Roaming\DAEMON Tools Lite
2014-10-13 20:15 - 2014-05-07 03:26 - 00000000 ____D () C:\Windows\Minidump
2014-10-13 20:11 - 2014-08-26 20:23 - 00000000 ____D () C:\Users\Joao\AppData\Local\Adobe
2014-10-13 20:09 - 2013-11-17 03:14 - 00000000 ____D () C:\Windows\SysWOW64\Macromed
2014-10-12 23:05 - 2010-11-21 04:47 - 00199160 _____ () C:\Windows\PFRO.log
2014-10-12 17:28 - 2013-11-17 03:52 - 00000000 ____D () C:\ProgramData\AMD
2014-10-12 17:25 - 2013-11-17 03:46 - 00000000 ____D () C:\Program Files\ATI Technologies
2014-10-12 16:58 - 2013-11-17 03:46 - 00000000 ____D () C:\AMD
2014-10-11 17:40 - 2014-03-01 00:51 - 00000000 ____D () C:\ProgramData\Origin
2014-10-11 17:18 - 2014-05-23 16:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2014-10-11 17:16 - 2013-11-27 20:44 - 00591738 _____ () C:\Windows\DirectX.log
2014-10-06 20:27 - 2013-11-17 19:07 - 00000000 ____D () C:\Users\Joao
2014-10-04 21:01 - 2014-08-20 18:32 - 00000000 ___HD () C:\_acestream_cache_
2014-10-03 09:11 - 2014-08-02 00:03 - 00000112 _____ () C:\Users\Joao\Desktop\Exercício.txt
2014-09-29 19:32 - 2014-08-07 17:25 - 00000000 ____D () C:\Users\Joao\AppData\Local\Google
2014-09-29 18:32 - 2014-07-09 01:03 - 00000000 ____D () C:\Users\Joao\AppData\Roaming\Mozilla
2014-09-29 01:05 - 2009-07-14 05:45 - 05052688 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-09-28 06:15 - 2013-11-16 20:24 - 00000000 ____D () C:\Windows\Panther
2014-09-28 05:42 - 2014-06-02 21:40 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-09-27 02:16 - 2014-08-12 02:05 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-09-26 11:55 - 2014-04-12 02:51 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013
2014-09-26 11:55 - 2014-04-12 02:48 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-09-26 11:53 - 2014-02-26 17:01 - 01619858 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-09-26 11:53 - 2013-11-17 03:49 - 01619858 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2014-09-26 11:53 - 2011-04-12 13:55 - 00720612 _____ () C:\Windows\system32\prfh0816.dat
2014-09-26 11:53 - 2011-04-12 13:55 - 00152564 _____ () C:\Windows\system32\prfc0816.dat
2014-09-26 11:52 - 2013-11-16 21:29 - 00000000 ____D () C:\Windows\system32\MRT
2014-09-26 11:48 - 2013-11-16 21:29 - 101694776 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-09-26 09:40 - 2014-07-18 14:29 - 00000000 ____D () C:\ProgramData\Package Cache
2014-09-15 23:31 - 2014-07-09 16:52 - 09254184 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\atidxx32.dll
2014-09-15 23:31 - 2014-07-09 16:52 - 00126848 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\atiuxpag.dll
2014-09-15 23:31 - 2014-07-09 16:52 - 00118096 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atiu9p64.dll
2014-09-15 23:31 - 2014-07-09 16:51 - 08296296 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atiumd64.dll
2014-09-15 23:31 - 2014-07-09 16:51 - 08044976 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atiumd6a.dll
2014-09-15 23:31 - 2013-10-08 15:01 - 01335544 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\aticfx64.dll
2014-09-15 23:31 - 2013-10-08 15:01 - 01113576 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\aticfx32.dll
2014-09-15 23:31 - 2013-10-08 15:01 - 00144328 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atiuxp64.dll
2014-09-15 23:31 - 2013-10-08 15:01 - 00100032 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\atiu9pag.dll
2014-09-15 23:31 - 2013-10-08 15:00 - 10826488 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atidxx64.dll
2014-09-15 23:31 - 2013-10-08 15:00 - 07207592 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\atiumdva.dll
2014-09-15 23:31 - 2013-10-08 15:00 - 07028336 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\atiumdag.dll
2014-09-15 23:03 - 2014-07-09 16:24 - 00442368 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\atidemgy.dll
2014-09-15 22:59 - 2014-07-09 16:20 - 01210880 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\atiadlxx.dll
2014-09-15 09:06 - 2010-11-21 04:27 - 00278152 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-09-15 00:19 - 2014-09-10 08:31 - 00000000 ____D () C:\ProgramData\WRData

Some content of TEMP:
====================
C:\Users\Joao\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-10-06 13:45

==================== End Of Log ============================
 
I dont know if i have something in my PC. I scanned with rougue killer and detected 2 hidden processes.Attached File  Addition.txt   44.41KB   2 downloads


Edited by hspawn, 14 October 2014 - 02:43 PM.


#4 hspawn

hspawn
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:05:19 PM

Posted 14 October 2014 - 02:42 PM

.


Edited by hspawn, 14 October 2014 - 02:43 PM.


#5 nasdaq

nasdaq

  • Malware Response Team
  • 38,955 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:12:19 PM

Posted 15 October 2014 - 10:52 AM


Open notepad (Start =>All Programs => Accessories => Notepad). Please copy the entire contents of the code box below.

start

HKU\S-1-5-21-2382355001-1013221568-367977049-1004\...\Run: [AdobeBridge] => [X]
BHO: Webroot Filtering Extension -> {C9C42510-9B41-42c1-9DCD-7282A2D07C61} ->  No File
BHO-x32: Webroot Filtering Extension -> {C9C42510-9B41-42c1-9DCD-7282A2D07C61} ->  No File
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @esn/npbattlelog,version=2.3.2 -> C:\Program Files (x86)\Battlelog Web Plugins\2.3.2\npbattlelog.dll No File
FF Plugin-x32: @esn/npbattlelog,version=2.4.0 -> C:\Program Files (x86)\Battlelog Web Plugins\2.4.0\npbattlelog.dll No File
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
AlternateDataStreams: C:\Users\Joao\Cookies:ii8GPYOcsGjDlRdH6JWgPKb5O
AlternateDataStreams: C:\Users\Joao\Cookies:jS8FNFWZm5gLlXnvgHSQ3T

End
Save the files as fixlist.txt into the same folder as FRST

Run FRST and click Fix only once and wait.

Restart the computer normally to reset the registry.

The tool will create a log (Fixlog.txt) please post it to your reply.
===

I don't know if i have something in my PC. I scanned with rougue killer and detected 2 hidden processes


Please post the log for my review.

How is the computer performing?

#6 hspawn

hspawn
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:05:19 PM

Posted 15 October 2014 - 10:06 PM

Sorry but i had FRST in my desktop and not in a folder and i think it didnt gave me the fixlog

 

Second time gave me this:

 

 

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 15-10-2014 02
Ran by Joao at 2014-10-16 04:03:30 Run:1
Running from C:\Users\Joao\Desktop\FRST64
Loaded Profile: Joao (Available profiles: Joao)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
start

HKU\S-1-5-21-2382355001-1013221568-367977049-1004\...\Run: [AdobeBridge] => [X]
BHO: Webroot Filtering Extension -> {C9C42510-9B41-42c1-9DCD-7282A2D07C61} ->  No File
BHO-x32: Webroot Filtering Extension -> {C9C42510-9B41-42c1-9DCD-7282A2D07C61} ->  No File
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @esn/npbattlelog,version=2.3.2 -> C:\Program Files (x86)\Battlelog Web Plugins\2.3.2\npbattlelog.dll No File
FF Plugin-x32: @esn/npbattlelog,version=2.4.0 -> C:\Program Files (x86)\Battlelog Web Plugins\2.4.0\npbattlelog.dll No File
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
AlternateDataStreams: C:\Users\Joao\Cookies:ii8GPYOcsGjDlRdH6JWgPKb5O
AlternateDataStreams: C:\Users\Joao\Cookies:jS8FNFWZm5gLlXnvgHSQ3T

End
*****************

HKU\S-1-5-21-2382355001-1013221568-367977049-1004\Software\Microsoft\Windows\CurrentVersion\Run\\AdobeBridge => value deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C9C42510-9B41-42c1-9DCD-7282A2D07C61}" => Key deleted successfully.
"HKCR\CLSID\{C9C42510-9B41-42c1-9DCD-7282A2D07C61}" => Key deleted successfully.
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C9C42510-9B41-42c1-9DCD-7282A2D07C61}" => Key deleted successfully.
"HKCR\Wow6432Node\CLSID\{C9C42510-9B41-42c1-9DCD-7282A2D07C61}" => Key deleted successfully.
"HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE" => Key deleted successfully.
"HKLM\Software\Wow6432Node\MozillaPlugins\@esn/npbattlelog,version=2.3.2" => Key deleted successfully.
"HKLM\Software\Wow6432Node\MozillaPlugins\@esn/npbattlelog,version=2.4.0" => Key deleted successfully.
"HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE" => Key deleted successfully.
"HKLM\Software\Wow6432Node\MozillaPlugins\@pandonetworks.com/PandoWebPlugin" => Key deleted successfully.
"C:\Users\Joao\Cookies" => ":ii8GPYOcsGjDlRdH6JWgPKb5O" ADS not found.
"C:\Users\Joao\Cookies" => ":jS8FNFWZm5gLlXnvgHSQ3T" ADS not found.

==== End of Fixlog ====

 

The PC is fine. I was just curious about this.


Edited by hspawn, 15 October 2014 - 11:48 PM.


#7 nasdaq

nasdaq

  • Malware Response Team
  • 38,955 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:12:19 PM

Posted 17 October 2014 - 01:36 PM

If all is well.

To learn more about how to protect yourself while on the internet read this little guide Best security practices Keep safe.
http://www.bleepingcomputer.com/forums/t/407147/answers-to-common-security-questions-best-practices/
===

#8 nasdaq

nasdaq

  • Malware Response Team
  • 38,955 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:12:19 PM

Posted 23 October 2014 - 10:05 AM

It appears that this issue is resolved, therefore I am closing the topic. If that is not the case and you need or wish to continue with this topic, please send me or any Moderator a Personal Message (PM) that you would like this topic re-opened.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users