Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Hello! *32 overload, slow processing!


  • This topic is locked This topic is locked
19 replies to this topic

#1 cjmilam

cjmilam

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:12:32 AM

Posted 07 January 2015 - 06:19 PM

First, hello! and thank you for being here! been looking over the sight and wow are you guys awesome!  Enuff kissass though,  ive attached logs for ya,  in a nutshell I get tons of *32 processes,  I get anywhere from 30-99% processing spikes,  it slows WoW/mudbox/gimp  to a crawl even tho fps reads 100 locked.  any help would be so greatly appreciated!

 

*attaching farbar files in a moment.



BC AdBot (Login to Remove)

 


#2 cjmilam

cjmilam
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:12:32 AM

Posted 07 January 2015 - 06:22 PM

FRST

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 07-01-2015
Ran by User (administrator) on USER-PC on 07-01-2015 18:16:45
Running from C:\Users\User\Desktop
Loaded Profile: User (Available profiles: User)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: English (United States)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Microsoft Corporation) C:\Program Files\Microsoft IntelliType Pro\itype.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Avast Software) C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\ng\ngservice.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [7981088 2009-07-20] (Realtek Semiconductor)
HKLM\...\Run: [itype] => c:\Program Files\Microsoft IntelliType Pro\itype.exe [1873288 2011-08-01] (Microsoft Corporation)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5226600 2015-01-03] (AVAST Software)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-2424769105-595088613-2816330089-1001\...\Run: [AdobeBridge] => [X]
HKU\S-1-5-21-2424769105-595088613-2816330089-1001\...\MountPoints2: {25fa6d0e-7580-11e2-a36d-0030675775ac} - E:\VZW_Software_upgrade_assistant.exe
HKU\S-1-5-21-2424769105-595088613-2816330089-1001\...\MountPoints2: {2a28b1cd-5b09-11e1-a026-0030675775ac} - E:\TL-Bootstrap.exe
HKU\S-1-5-21-2424769105-595088613-2816330089-1001\...\MountPoints2: {3bef3232-3a68-11e0-8e73-003067577bc6} - E:\LaunchU3.exe -a
HKU\S-1-5-21-2424769105-595088613-2816330089-1001\...\MountPoints2: {556285fa-6999-11e2-8bcf-0030675775ac} - G:\setup.exe -a
HKU\S-1-5-21-2424769105-595088613-2816330089-1001\...\MountPoints2: {58dcf67a-a385-11e0-990f-806e6f6e6963} - E:\setup.exe -a
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software)
BootExecute: autocheck autochk * sdnclean64.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyEnable: [S-1-5-19] => Internet Explorer proxy is enabled.
ProxyEnable: [S-1-5-20] => Internet Explorer proxy is enabled.
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com
HKU\S-1-5-21-2424769105-595088613-2816330089-1001\Software\Microsoft\Internet Explorer\Main,Search Page = http://downloads.phpnuke.org/en/index.php?rvs=hompag
HKU\S-1-5-21-2424769105-595088613-2816330089-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/?ocid=iehp
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
SearchScopes: HKLM-x32 -> {76F59ABB-4189-47FE-BDCE-75EA12F87F67} URL = http://downloads.phpnuke.org/en/index.php?rvs=hompag
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
Toolbar: HKLM - No Name - !{B922D405-6D13-4A2B-AE89-08A030DA4402} -  No File
Toolbar: HKLM-x32 - No Name - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} -  No File
Toolbar: HKLM-x32 - No Name - !{B922D405-6D13-4A2B-AE89-08A030DA4402} -  No File
Toolbar: HKU\S-1-5-21-2424769105-595088613-2816330089-1001 -> No Name - {113342CD-3031-4EE9-9288-2C58857D3A3D} -  No File
DPF: HKLM-x32 {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} http://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab
DPF: HKLM-x32 {140E4DF8-9E14-4A34-9577-C77561ED7883} https://s3.amazonaws.com/content.systemrequirementslab.com/global/bin/srldetect_cyri_4.1.72.0_x.cab
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 208.180.42.68 208.180.42.100
Tcpip\..\Interfaces\{124DA3AB-566C-4EAD-A64D-A6980B297DB6}: [NameServer] 8.8.8.8,8.8.8.8

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
FF Plugin-x32: @rocketlife.com/RocketLife Secure Plug-In Layer;version=1.0.5 -> C:\ProgramData\Visan\plugins\npRLSecurePluginLayer.dll (RocketLife, LLP)
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2015-01-03]
FF Extension: No Name - C:\Program Files (x86)\WebexpEnhancedV1\WebexpEnhancedV1alpha350\ff [Not Found]
FF Extension: No Name - C:\Program Files (x86)\VideoPlayerV3\VideoPlayerV3beta659\ff [Not Found]

Chrome: 
=======
CHR HKLM-x32\...\Chrome\Extension: [badgdiliogdgpeiifplgjbbnlieepbci] - C:\Program Files (x86)\WebexpEnhancedV1\WebexpEnhancedV1alpha350\ch\WebexpEnhancedV1alpha350.crx [Not Found]
CHR HKLM-x32\...\Chrome\Extension: [ddolhdhpaddmpfojmboenilinbagcgdl] - C:\Program Files (x86)\VideoPlayerV3\VideoPlayerV3beta659\ch\VideoPlayerV3beta659.crx [Not Found]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2015-01-03] (AVAST Software)
R3 AvastVBoxSvc; C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe [4012248 2015-01-03] (Avast Software)
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2015-01-03] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [83280 2015-01-03] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2015-01-03] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2015-01-03] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1050432 2015-01-03] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [436624 2015-01-03] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [116728 2015-01-03] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [267632 2015-01-03] ()
R1 BIOS; C:\Windows\system32\drivers\BIOS64.sys [14136 2006-10-31] (BIOSTAR Group)
R1 BIOS; C:\Windows\SysWOW64\drivers\BIOS64.sys [14136 2006-10-31] (BIOSTAR Group)
R1 BS_I2cIo; C:\Windows\system32\drivers\BS_I2cIo.sys [15408 2008-06-16] (BIOSTAR Group)
R1 BS_I2cIo; C:\Windows\SysWOW64\drivers\BS_I2cIo.sys [17024 2008-06-16] (BIOSTAR Group) [File not signed]
S3 SSMO3v2Filter; C:\Windows\System32\drivers\MO3v2Driver.sys [23040 2010-11-22] (Sagatek Co. Ltd.) [File not signed]
S3 SWDUMon; C:\Windows\System32\DRIVERS\SWDUMon.sys [16152 2014-01-25] ()
R2 VBoxAswDrv; C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [271752 2015-01-03] (Avast Software)
S3 NVIDIAHWAccess; \??\C:\Users\User\AppData\Roaming\NVIDIA\HWAccess.sys [X]
S4 nvvad_WaveExtensible; system32\drivers\nvvad64v.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-07 18:16 - 2015-01-07 18:17 - 00011780 _____ () C:\Users\User\Desktop\FRST.txt
2015-01-07 18:08 - 2015-01-07 18:08 - 00000197 _____ () C:\Windows\system32\2015-01-07-23-08-41.014-AvastVBoxSVC.exe-3648.log
2015-01-07 17:43 - 2015-01-07 18:05 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2015-01-07 17:41 - 2015-01-07 18:01 - 00000000 ____D () C:\Users\User\Desktop\mbar
2015-01-07 17:40 - 2015-01-07 17:40 - 16448208 _____ (Malwarebytes Corp.) C:\Users\User\Desktop\mbar-1.08.2.1001.exe
2015-01-07 17:25 - 2015-01-07 18:16 - 00000000 ____D () C:\FRST
2015-01-07 17:22 - 2015-01-07 17:22 - 02124288 _____ (Farbar) C:\Users\User\Desktop\FRST64.exe
2015-01-07 17:06 - 2015-01-07 17:07 - 00000197 _____ () C:\Windows\system32\2015-01-07-22-06-57.036-AvastVBoxSVC.exe-3680.log
2015-01-06 17:58 - 2015-01-06 17:59 - 00000197 _____ () C:\Windows\system32\2015-01-06-22-58-59.072-AvastVBoxSVC.exe-3812.log
2015-01-05 18:32 - 2015-01-05 18:32 - 00000197 _____ () C:\Windows\system32\2015-01-05-23-32-28.068-AvastVBoxSVC.exe-3692.log
2015-01-04 16:23 - 2015-01-04 16:23 - 00000197 _____ () C:\Windows\system32\2015-01-04-21-23-20.045-AvastVBoxSVC.exe-3996.log
2015-01-04 13:39 - 2015-01-04 13:41 - 00000000 ____D () C:\Users\User\AppData\Local\._LiveCode_
2015-01-04 13:39 - 2015-01-04 13:39 - 00000000 ____D () C:\Users\User\AppData\Roaming\Acreon
2015-01-04 13:39 - 2014-12-04 03:45 - 03870720 _____ (Acreon Inc.) C:\Users\User\Desktop\WowMatrix.exe
2015-01-04 13:27 - 2015-01-04 13:27 - 00000197 _____ () C:\Windows\system32\2015-01-04-18-27-11.061-AvastVBoxSVC.exe-4032.log
2015-01-04 13:23 - 2015-01-07 18:05 - 00003304 _____ () C:\Windows\PFRO.log
2015-01-04 11:55 - 2015-01-04 11:55 - 00005316 _____ () C:\Windows\DPINST.LOG
2015-01-04 11:53 - 2015-01-04 11:54 - 00000000 ____D () C:\AdobeTemp
2015-01-04 11:48 - 2015-01-04 11:48 - 00000557 _____ () C:\Windows\WindowsUpdate.log
2015-01-04 10:49 - 2015-01-04 10:49 - 00000197 _____ () C:\Windows\system32\2015-01-04-15-49-45.017-AvastVBoxSVC.exe-3476.log
2015-01-04 02:24 - 2015-01-04 02:24 - 00000197 _____ () C:\Windows\system32\2015-01-04-07-24-36.051-AvastVBoxSVC.exe-4196.log
2015-01-04 02:20 - 2015-01-07 18:05 - 00000560 _____ () C:\Windows\setupact.log
2015-01-04 02:20 - 2015-01-04 02:23 - 02983888 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-01-04 02:20 - 2015-01-04 02:20 - 00000000 _____ () C:\Windows\setuperr.log
2015-01-04 02:14 - 2015-01-04 02:14 - 00176128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ie4uinit.exe
2015-01-04 02:13 - 2015-01-04 02:13 - 03223152 _____ (VMware, Inc.) C:\Windows\SysWOW64\vm3dgl.dll
2015-01-04 02:13 - 2015-01-04 02:13 - 00219248 _____ (VMware, Inc.) C:\Windows\SysWOW64\vm3dum.dll
2015-01-04 02:11 - 2015-01-04 03:06 - 00063088 _____ (VMware, Inc.) C:\Windows\SysWOW64\vsocklib.dll
2015-01-04 02:11 - 2015-01-04 03:06 - 00053360 _____ (VMware, Inc.) C:\Windows\SysWOW64\vmGuestLib.dll
2015-01-04 02:11 - 2015-01-04 03:06 - 00050800 _____ (VMware, Inc.) C:\Windows\SysWOW64\vmhgfs.dll
2015-01-04 02:11 - 2015-01-04 03:06 - 00034416 _____ (VMware, Inc.) C:\Windows\SysWOW64\vmGuestLibJava.dll
2015-01-04 02:11 - 2015-01-04 03:05 - 00606208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstime.dll
2015-01-04 02:11 - 2015-01-04 03:05 - 00229376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieaksie.dll
2015-01-04 02:11 - 2015-01-04 03:05 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieakui.dll
2015-01-04 02:11 - 2015-01-04 03:05 - 00126976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieakeng.dll
2015-01-04 02:11 - 2015-01-04 03:05 - 00018432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\corpol.dll
2015-01-04 02:10 - 2015-01-04 03:05 - 00131584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aaclient.dll
2015-01-04 02:10 - 2015-01-04 03:05 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\admparse.dll
2015-01-04 01:52 - 2015-01-04 01:52 - 00000000 ____D () C:\ProgramData\Weskysoft
2015-01-04 01:48 - 2015-01-04 01:48 - 00108568 _____ () C:\Users\User\AppData\Local\GDIPFONTCACHEV1.DAT
2015-01-04 01:48 - 2015-01-04 01:48 - 00000000 ____D () C:\Program Files (x86)\DLLSuite
2015-01-03 22:14 - 2015-01-03 22:14 - 00000197 _____ () C:\Windows\system32\2015-01-04-03-14-51.011-AvastVBoxSVC.exe-4004.log
2015-01-03 19:39 - 2015-01-03 19:39 - 00000197 _____ () C:\Windows\system32\2015-01-04-00-39-43.084-AvastVBoxSVC.exe-4060.log
2015-01-03 18:32 - 2015-01-03 18:32 - 00000197 _____ () C:\Windows\system32\2015-01-03-23-32-29.055-AvastVBoxSVC.exe-3320.log
2015-01-03 18:29 - 2015-01-03 18:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
2015-01-03 18:24 - 2015-01-03 18:24 - 00000197 _____ () C:\Windows\system32\2015-01-03-23-24-25.056-AvastVBoxSVC.exe-3888.log
2015-01-03 18:24 - 2014-07-02 12:44 - 00609240 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe
2015-01-03 18:12 - 2015-01-03 18:12 - 00000197 _____ () C:\Windows\system32\2015-01-03-23-12-04.093-AvastVBoxSVC.exe-3288.log
2015-01-03 17:07 - 2015-01-03 17:08 - 00000197 _____ () C:\Windows\system32\2015-01-03-22-07-57.098-AvastVBoxSVC.exe-4000.log
2015-01-03 17:01 - 2015-01-03 17:01 - 00000197 _____ () C:\Windows\system32\2015-01-03-22-01-13.045-AvastVBoxSVC.exe-3828.log
2015-01-03 16:30 - 2015-01-03 16:30 - 00000000 ____D () C:\Users\User\Documents\ProcAlyzer Dumps
2015-01-03 16:01 - 2015-01-03 16:27 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2015-01-03 16:01 - 2015-01-03 16:03 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2015-01-03 16:01 - 2015-01-03 16:01 - 00001391 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
2015-01-03 16:01 - 2015-01-03 16:01 - 00001379 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2015-01-03 16:01 - 2015-01-03 16:01 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking
2015-01-03 16:01 - 2015-01-03 16:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
2015-01-03 16:01 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe
2015-01-03 15:42 - 2015-01-03 15:43 - 00000247 _____ () C:\Windows\system32\2015-01-03-20-42-57.090-aswFe.exe-12728.log
2015-01-03 15:36 - 2015-01-03 15:42 - 00000247 _____ () C:\Windows\system32\2015-01-03-20-36-53.032-aswFe.exe-4260.log
2015-01-03 15:36 - 2015-01-03 15:36 - 00000197 _____ () C:\Windows\system32\2015-01-03-20-36-49.074-AvastVBoxSVC.exe-4892.log
2015-01-03 15:28 - 2015-01-03 15:28 - 00000000 ____D () C:\Windows\SysWOW64\vbox
2015-01-03 15:28 - 2015-01-03 15:28 - 00000000 ____D () C:\Windows\system32\vbox
2015-01-03 15:25 - 2015-01-03 15:25 - 00000000 ____D () C:\Users\User\AppData\Roaming\AVAST Software
2015-01-03 15:18 - 2015-01-03 15:22 - 01050432 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys
2015-01-03 15:18 - 2015-01-03 15:18 - 00436624 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2015-01-03 15:18 - 2015-01-03 15:18 - 00364512 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2015-01-03 15:18 - 2015-01-03 15:18 - 00267632 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2015-01-03 15:18 - 2015-01-03 15:18 - 00116728 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys
2015-01-03 15:18 - 2015-01-03 15:18 - 00093568 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2015-01-03 15:18 - 2015-01-03 15:18 - 00083280 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2015-01-03 15:18 - 2015-01-03 15:18 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2015-01-03 15:18 - 2015-01-03 15:18 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2015-01-03 15:18 - 2015-01-03 15:18 - 00029208 _____ () C:\Windows\system32\Drivers\aswHwid.sys
2015-01-03 15:16 - 2015-01-03 15:16 - 00000000 ____D () C:\Program Files\AVAST Software
2015-01-03 15:14 - 2015-01-03 15:16 - 00000000 ____D () C:\ProgramData\AVAST Software
2015-01-03 14:31 - 2015-01-03 15:13 - 00000000 ____D () C:\Users\User\AppData\Roaming\Gegyyq
2015-01-03 14:30 - 2015-01-03 14:30 - 00000761 _____ () C:\Windows\system32\Drivers\etc\hosts.txt
2015-01-03 13:44 - 2015-01-03 15:23 - 00000000 ____D () C:\ProgramData\SecTaskMan
2015-01-03 13:44 - 2015-01-03 13:44 - 00001158 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spy Protector.lnk
2015-01-03 13:44 - 2015-01-03 13:44 - 00001147 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Security Task Manager.lnk
2015-01-03 13:44 - 2015-01-03 13:44 - 00000000 ____D () C:\Users\User\AppData\Local\SecTaskMan
2015-01-03 13:44 - 2015-01-03 13:44 - 00000000 ____D () C:\Program Files (x86)\Security Task Manager
2015-01-02 20:21 - 2015-01-03 15:13 - 00000000 ____D () C:\ProgramData\RiriWtuzk
2015-01-01 19:17 - 2015-01-01 19:17 - 00003424 ____N () C:\bootsqm.dat
2014-12-29 23:59 - 2014-12-29 23:59 - 00000000 ____D () C:\Users\User\AppData\Local\NVIDIA
2014-12-29 23:27 - 2014-08-19 22:15 - 00075040 _____ (Khronos Group) C:\Windows\system32\OpenCL.dll
2014-12-29 23:27 - 2014-08-19 22:15 - 00061912 _____ (Khronos Group) C:\Windows\SysWOW64\OpenCL.dll
2014-12-29 23:27 - 2014-07-02 13:55 - 06783776 _____ (NVIDIA Corporation) C:\Windows\system32\nvcpl.dll
2014-12-29 23:27 - 2014-07-02 13:55 - 03522392 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvc64.dll
2014-12-29 23:27 - 2014-07-02 13:55 - 02559960 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvcr.dll
2014-12-29 23:27 - 2014-07-02 13:55 - 00935368 _____ (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
2014-12-29 23:27 - 2014-07-02 13:55 - 00386520 _____ (NVIDIA Corporation) C:\Windows\system32\nvmctray.dll
2014-12-29 23:27 - 2014-07-02 13:55 - 00062808 _____ (NVIDIA Corporation) C:\Windows\system32\nvshext.dll
2014-12-29 23:27 - 2014-07-02 05:14 - 03826628 _____ () C:\Windows\system32\nvcoproc.bin
2014-12-29 23:04 - 2014-12-13 05:08 - 01895056 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6434709.dll
2014-12-29 23:04 - 2014-12-13 05:08 - 01556624 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6434709.dll
2014-12-28 12:34 - 2014-12-28 12:34 - 00000000 ____D () C:\ProgramData\HitmanPro
2014-12-28 11:57 - 2014-12-28 11:57 - 00000000 _____ () C:\autoexec.bat
2014-12-28 10:52 - 2015-01-07 17:43 - 00135384 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-12-28 10:51 - 2015-01-07 17:41 - 00096472 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-12-28 10:51 - 2014-12-28 10:51 - 00001102 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-12-28 10:51 - 2014-12-28 10:51 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-12-28 10:51 - 2014-12-28 10:51 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-12-28 10:51 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-12-28 10:43 - 2014-12-28 10:43 - 00009948 _____ () C:\Users\User\Documents\reg.reg
2014-12-17 17:29 - 2014-12-13 00:09 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-12-17 17:29 - 2014-12-12 22:33 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-12-09 18:15 - 2014-12-09 18:15 - 00000000 ____D () C:\Windows\system32\appraiser
2014-12-09 18:06 - 2014-10-17 21:05 - 04121600 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll
2014-12-09 18:06 - 2014-10-17 20:33 - 03209728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll
2014-12-09 18:06 - 2014-07-06 21:06 - 00206848 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll
2014-12-09 18:06 - 2014-07-06 21:06 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\rrinstaller.exe
2014-12-09 18:06 - 2014-07-06 21:06 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\mfpmp.exe
2014-12-09 18:06 - 2014-07-06 21:02 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\mferror.dll
2014-12-09 18:06 - 2014-07-06 20:40 - 00103424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfps.dll
2014-12-09 18:06 - 2014-07-06 20:39 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rrinstaller.exe
2014-12-09 18:06 - 2014-07-06 20:39 - 00023040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfpmp.exe
2014-12-09 18:06 - 2014-07-06 20:37 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mferror.dll
2014-12-09 17:27 - 2014-12-03 21:50 - 00830976 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2014-12-09 17:27 - 2014-12-03 21:50 - 00741376 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2014-12-09 17:27 - 2014-12-03 21:50 - 00413184 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2014-12-09 17:27 - 2014-12-03 21:50 - 00396800 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2014-12-09 17:27 - 2014-12-03 21:50 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-12-09 17:27 - 2014-12-03 21:50 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2014-12-09 17:27 - 2014-12-03 21:44 - 01083392 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-12-09 17:27 - 2014-12-01 18:28 - 01232040 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe
2014-12-09 17:27 - 2014-11-10 22:09 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2014-12-09 17:27 - 2014-11-10 21:44 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2014-12-09 17:27 - 2014-11-10 20:46 - 00119296 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdx.sys
2014-12-09 17:26 - 2014-11-26 20:43 - 00389296 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-12-09 17:26 - 2014-11-26 20:10 - 00342200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-12-09 17:26 - 2014-11-21 22:13 - 25059840 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-12-09 17:26 - 2014-11-21 22:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-12-09 17:26 - 2014-11-21 22:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-12-09 17:26 - 2014-11-21 21:50 - 00580096 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-12-09 17:26 - 2014-11-21 21:50 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-12-09 17:26 - 2014-11-21 21:49 - 02885120 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-12-09 17:26 - 2014-11-21 21:49 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-12-09 17:26 - 2014-11-21 21:48 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-12-09 17:26 - 2014-11-21 21:41 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-12-09 17:26 - 2014-11-21 21:40 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-12-09 17:26 - 2014-11-21 21:37 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-12-09 17:26 - 2014-11-21 21:35 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-12-09 17:26 - 2014-11-21 21:34 - 06039552 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-12-09 17:26 - 2014-11-21 21:34 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-12-09 17:26 - 2014-11-21 21:26 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-12-09 17:26 - 2014-11-21 21:22 - 19749376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-12-09 17:26 - 2014-11-21 21:22 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-12-09 17:26 - 2014-11-21 21:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-12-09 17:26 - 2014-11-21 21:14 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-12-09 17:26 - 2014-11-21 21:09 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-12-09 17:26 - 2014-11-21 21:08 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-12-09 17:26 - 2014-11-21 21:07 - 00501248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-12-09 17:26 - 2014-11-21 21:07 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-12-09 17:26 - 2014-11-21 21:06 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-12-09 17:26 - 2014-11-21 21:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-12-09 17:26 - 2014-11-21 21:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-12-09 17:26 - 2014-11-21 21:01 - 02277888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-12-09 17:26 - 2014-11-21 20:59 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-12-09 17:26 - 2014-11-21 20:58 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-12-09 17:26 - 2014-11-21 20:56 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-12-09 17:26 - 2014-11-21 20:54 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-12-09 17:26 - 2014-11-21 20:49 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-12-09 17:26 - 2014-11-21 20:49 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-12-09 17:26 - 2014-11-21 20:47 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-12-09 17:26 - 2014-11-21 20:46 - 02125312 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-12-09 17:26 - 2014-11-21 20:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-12-09 17:26 - 2014-11-21 20:43 - 14412800 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-12-09 17:26 - 2014-11-21 20:40 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-12-09 17:26 - 2014-11-21 20:36 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-12-09 17:26 - 2014-11-21 20:35 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-12-09 17:26 - 2014-11-21 20:33 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-12-09 17:26 - 2014-11-21 20:29 - 04299264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-12-09 17:26 - 2014-11-21 20:28 - 02358272 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-12-09 17:26 - 2014-11-21 20:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-12-09 17:26 - 2014-11-21 20:22 - 02052096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-12-09 17:26 - 2014-11-21 20:21 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-12-09 17:26 - 2014-11-21 20:15 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-12-09 17:26 - 2014-11-21 20:13 - 12836864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-12-09 17:26 - 2014-11-21 20:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-12-09 17:26 - 2014-11-21 20:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-12-09 17:26 - 2014-11-21 19:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-12-09 17:26 - 2014-11-21 19:54 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-12-09 17:25 - 2014-11-07 22:16 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-12-09 17:25 - 2014-11-07 21:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2014-12-09 17:25 - 2014-10-29 21:03 - 00165888 _____ (Microsoft Corporation) C:\Windows\system32\charmap.exe
2014-12-09 17:25 - 2014-10-29 20:45 - 00155136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\charmap.exe
2014-12-09 17:25 - 2014-10-02 21:12 - 02020352 _____ (Microsoft Corporation) C:\Windows\system32\WsmSvc.dll
2014-12-09 17:25 - 2014-10-02 21:12 - 00346624 _____ (Microsoft Corporation) C:\Windows\system32\WSManMigrationPlugin.dll
2014-12-09 17:25 - 2014-10-02 21:12 - 00310272 _____ (Microsoft Corporation) C:\Windows\system32\WsmWmiPl.dll
2014-12-09 17:25 - 2014-10-02 21:12 - 00181248 _____ (Microsoft Corporation) C:\Windows\system32\WsmAuto.dll
2014-12-09 17:25 - 2014-10-02 21:11 - 00266240 _____ (Microsoft Corporation) C:\Windows\system32\WSManHTTPConfig.exe
2014-12-09 17:25 - 2014-10-02 20:45 - 01177088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmSvc.dll
2014-12-09 17:25 - 2014-10-02 20:45 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSManMigrationPlugin.dll
2014-12-09 17:25 - 2014-10-02 20:45 - 00214016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmWmiPl.dll
2014-12-09 17:25 - 2014-10-02 20:45 - 00145920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmAuto.dll
2014-12-09 17:25 - 2014-10-02 20:44 - 00198656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSManHTTPConfig.exe

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-07 18:13 - 2009-07-13 23:45 - 00023568 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-01-07 18:13 - 2009-07-13 23:45 - 00023568 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-01-07 18:05 - 2011-02-17 02:12 - 00000000 ____D () C:\ProgramData\NVIDIA
2015-01-07 18:05 - 2009-07-14 00:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-01-07 18:04 - 2009-07-14 00:08 - 00032562 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-01-07 18:03 - 2011-02-22 22:49 - 00000000 ____D () C:\Users\User\Desktop\Junk
2015-01-07 17:57 - 2012-02-10 23:31 - 00000336 _____ () C:\Windows\Tasks\HP Photo Creations Communicator.job
2015-01-07 17:18 - 2013-11-29 19:41 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-01-07 17:06 - 2014-09-08 20:35 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2015-01-06 20:56 - 2011-02-22 15:09 - 00003918 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{3CA4DA99-5C52-4C3D-9015-8BC1B492778E}
2015-01-06 18:00 - 2014-02-25 09:54 - 00000000 ____D () C:\Users\User\AppData\Local\Battle.net
2015-01-04 13:23 - 2011-06-30 20:59 - 00000000 ____D () C:\Program Files (x86)\Motorola
2015-01-04 12:50 - 2014-01-25 15:50 - 00000428 _____ () C:\Windows\Tasks\SlimCleaner Plus (Scheduled Scan - User).job
2015-01-04 12:00 - 2011-07-14 20:11 - 00000000 ____D () C:\Program Files (x86)\Cakewalk
2015-01-04 11:57 - 2014-02-04 21:40 - 00000000 __SHD () C:\Windows\SysWOW64\AI_RecycleBin
2015-01-04 11:56 - 2011-12-01 17:48 - 00000000 ____D () C:\Users\User\AppData\Roaming\SteelSeries
2015-01-04 11:56 - 2011-02-17 02:07 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2015-01-04 11:54 - 2012-03-14 20:13 - 00000000 ____D () C:\ProgramData\Adobe
2015-01-04 11:54 - 2012-03-14 20:13 - 00000000 ____D () C:\Program Files (x86)\Adobe
2015-01-04 11:54 - 2011-02-17 13:46 - 00000000 ____D () C:\Users\User\AppData\Roaming\Adobe
2015-01-04 11:53 - 2012-03-14 20:13 - 00000000 ____D () C:\Program Files\Common Files\Adobe
2015-01-04 11:49 - 2012-03-14 20:20 - 00000000 ____D () C:\Program Files\Adobe
2015-01-04 11:45 - 2014-02-04 16:05 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-01-04 11:44 - 2014-08-16 19:33 - 00000000 ____D () C:\Users\User\AppData\Local\Glyph
2015-01-04 11:43 - 2011-08-09 22:27 - 00000000 ____D () C:\Users\User\AppData\Roaming\Philipp Winterberg
2015-01-04 01:48 - 2011-02-24 00:56 - 00007589 _____ () C:\Users\User\AppData\Local\Resmon.ResmonCfg
2015-01-03 18:24 - 2012-03-11 03:00 - 00000000 ____D () C:\Temp
2015-01-03 18:24 - 2011-02-17 02:12 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation
2015-01-03 16:27 - 2011-08-13 21:16 - 00000582 _____ () C:\Windows\WinInit.Ini
2015-01-03 16:19 - 2014-02-25 09:54 - 00000000 ____D () C:\Users\User\AppData\Roaming\Battle.net
2015-01-03 16:19 - 2011-02-23 19:15 - 00000000 ____D () C:\Users\User\AppData\Roaming\Ventrilo
2015-01-03 16:19 - 2011-02-17 03:14 - 00000000 ____D () C:\Program Files\Alwil Software
2015-01-03 16:18 - 2009-07-13 22:20 - 00000000 ____D () C:\Windows\registration
2015-01-03 15:13 - 2011-05-28 13:45 - 00000000 ____D () C:\Users\User\AppData\Local\The Witcher 2
2015-01-03 15:13 - 2011-02-23 17:58 - 00000000 ____D () C:\Windows\PCHEALTH
2015-01-02 21:06 - 2012-02-04 20:59 - 00000000 ____D () C:\Windows\EBFB1375E8DE43DD84303E43485E19F8.TMP
2015-01-01 18:32 - 2009-07-13 22:20 - 00000000 ____D () C:\Windows\system32\NDF
2015-01-01 17:29 - 2011-03-20 22:50 - 00000000 ____D () C:\Users\User\Desktop\pics
2014-12-29 23:48 - 2011-02-17 02:10 - 00000000 ____D () C:\Program Files\NVIDIA Corporation
2014-12-29 23:27 - 2011-02-17 02:12 - 00000000 ____D () C:\ProgramData\NVIDIA Corporation
2014-12-29 23:27 - 2009-07-13 22:20 - 00000000 ____D () C:\Windows\Help
2014-12-29 23:23 - 2011-08-17 20:54 - 00000000 ____D () C:\Users\User\AppData\Roaming\NVIDIA
2014-12-29 23:22 - 2013-11-16 03:59 - 00000000 ____D () C:\Users\User\AppData\Local\NVIDIA Corporation
2014-12-28 12:17 - 2014-01-25 15:49 - 00000000 ____D () C:\Users\Public\Documents\Downloaded Installers
2014-12-28 11:03 - 2009-07-14 00:32 - 00000000 ____D () C:\Windows\addins
2014-12-28 10:51 - 2014-01-19 12:57 - 00000000 ____D () C:\Users\User\AppData\Roaming\Malwarebytes
2014-12-28 10:51 - 2014-01-19 12:56 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-12-26 20:04 - 2011-12-23 23:04 - 00000000 ____D () C:\Users\User\AppData\Local\Deployment
2014-12-25 10:52 - 2014-05-17 12:06 - 00000000 ____D () C:\Users\User\Desktop\M
2014-12-19 22:10 - 2009-07-13 22:20 - 00000000 ____D () C:\Windows\rescache
2014-12-18 17:58 - 2012-09-25 20:15 - 00000000 ____D () C:\Program Files (x86)\World of Warcraft
2014-12-10 17:21 - 2014-02-25 09:53 - 00000000 ____D () C:\Program Files (x86)\Battle.net
2014-12-09 18:15 - 2014-05-10 20:19 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-12-09 18:15 - 2009-07-13 22:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-12-09 18:15 - 2009-07-13 22:20 - 00000000 ____D () C:\Windows\AppCompat
2014-12-09 18:08 - 2013-11-16 03:07 - 00000000 ____D () C:\Windows\system32\MRT
2014-12-09 18:07 - 2011-02-17 02:27 - 112710672 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

Files to move or delete:
====================
C:\Users\User\setup.exe


Some content of TEMP:
====================
C:\Users\User\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpjrvhnk.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-01-01 13:53

==================== End Of Log ============================


#3 cjmilam

cjmilam
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:12:32 AM

Posted 07 January 2015 - 06:23 PM

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 07-01-2015
Ran by User at 2015-01-07 18:17:23
Running from C:\Users\User\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Up to date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 1.1.0.5790 - Adobe Systems Inc.)
Adobe Flash Player 11 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 11.9.900.170 - Adobe Systems Incorporated)
Adobe Flash Player 14 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 14.0.0.145 - Adobe Systems Incorporated)
Adobe Media Player (HKLM-x32\...\com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 1.1 - Adobe Systems Incorporated)
Advertising Center (x32 Version: 0.0.0.2 - Nero AG) Hidden
Avast Free Antivirus (HKLM-x32\...\Avast) (Version: 10.0.2208 - AVAST Software)
Battle.net (HKLM-x32\...\Battle.net) (Version:  - Blizzard Entertainment)
CBR Reader (HKLM-x32\...\{EDAAC216-AC73-4152-9654-E12FE5A69F5D}_is1) (Version:  - cbrreader.com)
CCleaner (HKLM\...\CCleaner) (Version: 4.14 - Piriform)
Crysis(R) SP Demo (HKLM-x32\...\{92AF2F5A-4407-4A03-A80A-5A2582264746}) (Version: 1.00.0000 - Electronic Arts)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Diablo III (HKLM-x32\...\Diablo III) (Version:  - Blizzard Entertainment)
Diablo III Beta (HKLM-x32\...\Diablo III Beta) (Version:  - Blizzard Entertainment)
GIMP 2.8.4 (HKLM\...\GIMP-2_is1) (Version: 2.8.4 - The GIMP Team)
GPL Ghostscript Fonts (HKLM-x32\...\GPL Ghostscript Fonts) (Version:  - )
Hearthstone (HKLM-x32\...\Hearthstone) (Version:  - Blizzard Entertainment)
HP Deskjet 2050 J510 series Basic Device Software (HKLM\...\{F2C07BE3-0F88-4D0C-957B-3557699981E9}) (Version: 22.50.231.0 - Hewlett-Packard Co.)
HP Deskjet 2050 J510 series Help (HKLM-x32\...\{7A3DF2E2-CF13-44FB-A93E-F71D5381DB3F}) (Version: 140.0.61.61 - Hewlett Packard)
HP Deskjet 2050 J510 series Product Improvement Study (HKLM\...\{EF48631A-7F45-430A-8AD3-B41CFB1D7596}) (Version: 22.50.231.0 - Hewlett-Packard Co.)
HP Photo Creations (HKLM-x32\...\HP Photo Creations) (Version: 1.0.0.11502 - HP Photo Creations Powered by RocketLife)
HP Update (HKLM-x32\...\{B0069CFA-5BB9-4C03-B1C6-89CE290E5AFE}) (Version: 5.002.006.003 - Hewlett-Packard)
ImagXpress (x32 Version: 7.0.74.0 - Nero AG) Hidden
Java 7 Update 45 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217017FF}) (Version: 7.0.450 - Oracle)
Lexmark Toolbar (HKLM-x32\...\{1017A80C-6F09-4548-A84D-EDD6AC9525F0}) (Version: 4.0.53.0 - )
Light Artist 1.5 (HKLM-x32\...\Light Artist_is1) (Version:  - )
Malwarebytes Anti-Malware version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Messenger Companion (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Games for Windows - LIVE Redistributable (HKLM-x32\...\{59E4543A-D49D-4489-B445-473D763C79AF}) (Version: 2.0.672.0 - Microsoft Corporation)
Microsoft IntelliType Pro 8.2 (HKLM\...\Microsoft IntelliType Pro 8.2) (Version: 8.20.468.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.20913.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (HKLM\...\{350AA351-21FA-3270-8B7A-835434E766AD}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
MotoHelper MergeModules (x32 Version: 1.2.0 - Motorola) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Nero 9 Essentials (HKLM-x32\...\{2093cfe2-89a6-4b9c-8224-c1960b921195}) (Version:  - Nero AG)
NVIDIA 3D Vision Driver 340.52 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 340.52 - NVIDIA Corporation)
NVIDIA Graphics Driver 340.52 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 340.52 - NVIDIA Corporation)
NVIDIA HD Audio Driver 1.3.30.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.30.1 - NVIDIA Corporation)
NVIDIA Update 10.4.0 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 10.4.0 - NVIDIA Corporation)
OpenOffice.org 3.2 (HKLM-x32\...\{5A13987D-55F4-4271-A40E-76AC9B1B38FD}) (Version: 3.2.9502 - OpenOffice.org)
paint.net (HKLM\...\{3F5F509B-E226-417C-8CD1-CAAE756C328A}) (Version: 4.0.0 - dotPDN LLC)
PDF Writer (HKLM-x32\...\PDF Writer) (Version:  - )
PDFCreator (HKLM-x32\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.2.3 - Frank Heindörfer, Philip Chinery)
QuickTime (HKLM-x32\...\{57752979-A1C9-4C02-856B-FBB27AC4E02C}) (Version: 7.69.80.9 - Apple Inc.)
Realtek 8136 8168 8169 Ethernet Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 1.00.0005 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5898 - Realtek Semiconductor Corp.)
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.24.999 - SAMSUNG Electronics Co., Ltd.)
Security Task Manager 2.0 (HKLM-x32\...\Security Task Manager) (Version: 2.0 - Neuber Software)
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.4.40 - Safer-Networking Ltd.)
StarCraft II (HKLM-x32\...\StarCraft II) (Version:  - Blizzard Entertainment)
StencylWorks (HKLM-x32\...\StencylWorks) (Version: 1.3.4 - Stencyl, LLC)
Text-To-Speech-Runtime (HKLM-x32\...\{7B3F0113-E63C-4D6D-AF19-111A3165CCA2}) (Version: 1.0.0.0 - Magix Development GmbH)
Tseries BIOS Update (HKLM-x32\...\{E8626A59-FD0E-449C-A23A-C52FC0733629}) (Version:  - )
Ulead Photo Express 2.0 SE (HKLM-x32\...\Ulead Photo Express 2.0 SE) (Version:  - )
Ventrilo Client for Windows x64 (HKLM\...\{EEB3F6BB-318D-4CE5-989F-8191FCBFB578}) (Version: 3.0.7.0 - Flagship Industries, Inc.)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3538.0513 - Microsoft Corporation)
WinRAR 4.01 (64-bit) (HKLM\...\WinRAR archiver) (Version: 4.01.0 - win.rar GmbH)
World of Warcraft (HKLM-x32\...\World of Warcraft) (Version:  - Blizzard Entertainment)
World of Warcraft Public Test (HKLM-x32\...\World of Warcraft Public Test) (Version:  - Blizzard Entertainment)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-2424769105-595088613-2816330089-1001_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe /autoplay No File
CustomCLSID: HKU\S-1-5-21-2424769105-595088613-2816330089-1001_Classes\CLSID\{3b46f007-2c46-469d-8a46-3c6d5b38fcd4}\InprocServer32 -> C:\Windows\system32\dfshim.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2424769105-595088613-2816330089-1001_Classes\CLSID\{65e6d232-df44-4a31-99f9-e2180003ee62}\InprocServer32 -> C:\Windows\system32\dfshim.dll (Microsoft Corporation)

==================== Restore Points  =========================

29-12-2014 23:45:27 Windows Update
02-01-2015 20:17:31 avast! Free Antivirus Setup
03-01-2015 13:46:26 Uninstall "avast! snxhk"
03-01-2015 13:46:59 avast! Free Antivirus Setup
03-01-2015 15:16:35 avast! antivirus system restore point
04-01-2015 11:55:45 Removed World of Warcraft(R): Cataclysm(TM) MMO Gaming Mouse
04-01-2015 11:56:43 Removed Blackthorne
04-01-2015 11:57:03 Removed League of Legends
04-01-2015 11:58:33 Removed Path of Exile
04-01-2015 11:58:55 Removed Nitro Reader 3
04-01-2015 12:00:25 Removed System Requirements Lab
07-01-2015 18:01:01 Malwarebytes Anti-Rootkit Restore Point

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-13 21:34 - 2015-01-03 14:30 - 00001497 _RASH C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost
185.53.9.209 www.google-analytics.com.
185.53.9.209 google-analytics.com.
185.53.9.209 connect.facebook.net.
85.25.79.99 www.google-analytics.com.
85.25.79.99 google-analytics.com.
85.25.79.99 connect.facebook.net.
162.247.13.85 www.google-analytics.com.
162.247.13.85 google-analytics.com.
162.247.13.85 connect.facebook.net.


==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {047EDEA1-D5CD-4BAF-8195-0698A4346836} - System32\Tasks\4596 => Wscript.exe C:\Users\User\AppData\Local\Temp\launchie.vbs //B <==== ATTENTION
Task: {0D552FCF-A3C5-4A75-BC17-AF0866465D3B} - System32\Tasks\{957BB649-0216-4EEA-92FE-9399929DBB6E} => pcalua.exe -a "C:\Users\User\Desktop\MAGIX Music Maker 14- fraxing-\MAGIX Music Maker 14- fraxing-\music_maker_14_fraxing.exe" -d "C:\Users\User\Desktop\MAGIX Music Maker 14- fraxing-\MAGIX Music Maker 14- fraxing-"
Task: {11CA0F48-832F-4E2D-99A0-B12E166A8C06} - System32\Tasks\{B8F139F6-F873-4F99-9B7A-55741D7A986C} => pcalua.exe -a "C:\Users\User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UDILPNKN\setup.exe" -d C:\Users\User\Desktop
Task: {150165B9-4BD8-458F-8176-1E083524DAD7} - System32\Tasks\SlimCleaner Plus (Scheduled Scan - User) => C:\Program Files\SlimCleaner Plus\SlimCleanerPlus.exe
Task: {1CA48105-F844-452A-AADC-506C6C465EAC} - System32\Tasks\{F740B723-FC09-4BF3-B609-731EB566135E} => pcalua.exe -a "C:\Program Files (x86)\Steam\steam.exe" -c steam://uninstall/22350
Task: {3B6AADA9-1F96-4AB8-A17B-A22CD35C1454} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2015-01-03] (AVAST Software)
Task: {3F739531-B85E-43A7-B293-085064EB9E12} - System32\Tasks\{EC08772C-BC39-4E15-809C-6B597DE32E9B} => C:\Program Files (x86)\Skype\\Phone\Skype.exe
Task: {48301FB1-8BFB-4765-B028-109343EAD302} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDImmunize.exe
Task: {4FAC5796-B5DF-4B38-AC5A-56832D98F5AE} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-05-20] (Piriform Ltd)
Task: {5D89CAFC-5A29-4C9C-8637-22ADD36C3D01} - System32\Tasks\{16A54F92-2ACE-4774-B780-BE638EC003AD} => pcalua.exe -a "C:\Users\User\Desktop\Setup DT 1.09.exe" -d C:\Users\User\Desktop
Task: {7C3CA56D-40E0-494A-9729-75F516C8FEEC} - System32\Tasks\{FCEE3F2F-C3B6-4E38-8823-87CCB147B031} => pcalua.exe -a C:\Windows\IsUninst.exe -c -f"C:\Program Files (x86)\Ulead Systems\Ulead Photo Express 2 SE\Uninst.isu"
Task: {8BDD524B-B9C8-4EED-8057-E6CE14553525} - System32\Tasks\0 => Iexplore.exe  <==== ATTENTION
Task: {9ACDDC57-53C2-4397-A680-A83CDF44DD32} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-07-22] (Adobe Systems Incorporated)
Task: {A953BAD0-41DF-43F8-A965-D27056268DEA} - System32\Tasks\HPCustParticipation HP Deskjet 2050 J510 series => C:\Program Files\HP\HP Deskjet 2050 J510 series\Bin\HPCustPartic.exe [2010-11-16] (Hewlett-Packard Co.)
Task: {AA5159EF-1E3D-4299-AE32-4DECF699F96E} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDUpdate.exe
Task: {C32E6A24-A819-4EC1-B00F-8BB30F8AD5AB} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDScan.exe
Task: {E54BEE07-8EAD-4BEC-95F8-3BB2BA9C21FD} - System32\Tasks\Microsoft_Hardware_Launch_IType_exe => c:\Program Files\Microsoft IntelliType Pro\IType.exe [2011-08-01] (Microsoft Corporation)
Task: {EB4CD130-04AD-485C-AC98-CB555A9CFBEC} - System32\Tasks\HP Photo Creations Communicator => C:\ProgramData\HP Photo Creations\Communicator.exe [2013-04-12] ()
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\HP Photo Creations Communicator.job => C:\ProgramData\HP Photo Creations\Communicator.exe
Task: C:\Windows\Tasks\SlimCleaner Plus (Scheduled Scan - User).job => C:\Program Files\SlimCleaner Plus\SlimCleanerPlus.exe

==================== Loaded Modules (whitelisted) =============

2014-12-29 23:27 - 2014-07-02 13:55 - 00116568 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2011-08-13 20:10 - 2009-04-17 08:17 - 00045568 _____ () C:\Windows\System32\LXDMPMON.DLL
2011-08-13 20:10 - 2007-04-09 09:59 - 00069632 _____ () C:\Windows\System32\LXDMOEM.DLL
2012-01-21 04:47 - 2005-03-12 01:07 - 00087040 _____ () C:\Windows\System32\pdfcmnnt.dll
2015-01-03 15:17 - 2015-01-03 15:17 - 00388208 _____ () C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxDDU.dll
2015-01-03 15:17 - 2015-01-03 15:17 - 05851328 _____ () C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxRT.dll
2015-01-07 17:06 - 2015-01-07 17:06 - 02909696 _____ () C:\Program Files\AVAST Software\Avast\defs\15010701\algo.dll
2015-01-03 15:17 - 2015-01-03 15:17 - 04495336 _____ () C:\Program Files\AVAST Software\Avast\ng\vbox\x86\VBoxRT-x86.dll
2015-01-03 15:18 - 2015-01-03 15:18 - 38562088 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2015-01-03 16:01 - 2014-05-13 12:04 - 00109400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2015-01-03 16:01 - 2014-05-13 12:04 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2015-01-03 16:01 - 2014-05-13 12:04 - 00167768 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2015-01-03 16:01 - 2012-08-23 10:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2015-01-03 16:01 - 2012-04-03 17:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

MSCONFIG\Services: AdobeFlashPlayerUpdateSvc => 3
MSCONFIG\Services: FLEXnet Licensing Service => 3
MSCONFIG\Services: FLEXnet Licensing Service 64 => 3
MSCONFIG\Services: MotoHelper => 2
MSCONFIG\Services: Nero BackItUp Scheduler 4.0 => 2
MSCONFIG\Services: NitroReaderDriverReadSpool3 => 2
MSCONFIG\Services: NvNetworkService => 2
MSCONFIG\Services: NvStreamSvc => 2
MSCONFIG\Services: NVSvc => 2
MSCONFIG\Services: Stereo Service => 2
MSCONFIG\Services: TabletInputService => 3
MSCONFIG\Services: TapiSrv => 3
MSCONFIG\Services: wuauserv => 2
MSCONFIG\startupreg: AdobeCS4ServiceManager => "C:\Program Files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
MSCONFIG\startupreg: Akamai NetSession Interface => "C:\Users\User\AppData\Local\Akamai\netsession_win.exe"
MSCONFIG\startupreg: avast => "C:\Program Files\Alwil Software\Avast5\avastUI.exe" /nogui
MSCONFIG\startupreg: EzPrint => "C:\Program Files (x86)\Lexmark 2300 Series\ezprint.exe"
MSCONFIG\startupreg: HP Software Update => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe
MSCONFIG\startupreg: LXCGCATS => rundll32 \3\LXCGtime.dll,RunDLLEntry
MSCONFIG\startupreg: lxcgmon.exe => "C:\Program Files (x86)\Lexmark 2300 Series\lxcgmon.exe"
MSCONFIG\startupreg: NvBackend => "C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe"
MSCONFIG\startupreg: PCSpeedUp => C:\Program Files (x86)\PC Speed Up\PCSpeedUp.lnk
MSCONFIG\startupreg: QuickTime Task => "C:\Program Files (x86)\QuickTime\qttask.exe" -atboottime
MSCONFIG\startupreg: RGSC => C:\Program Files (x86)\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe /silent
MSCONFIG\startupreg: SteelSeries World of Warcraft Cataclysm MMO Gaming Mouse => "C:\Program Files (x86)\SteelSeries\World of Warcraft Cataclysm MMO Gaming Mouse\WoWMHID2.exe"
MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

========================= Accounts: ==========================

Administrator (S-1-5-21-2424769105-595088613-2816330089-500 - Administrator - Disabled)
Guest (S-1-5-21-2424769105-595088613-2816330089-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-2424769105-595088613-2816330089-1002 - Limited - Enabled)
User (S-1-5-21-2424769105-595088613-2816330089-1001 - Administrator - Enabled) => C:\Users\User

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (01/07/2015 05:53:22 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: iexplore.exe, version: 11.0.9600.17496, time stamp: 0x4a5bc5e1
Faulting module name: MSHTML.dll, version: 11.0.9600.17496, time stamp: 0x546ff2f9
Exception code: 0xc00000fd
Fault offset: 0x0011fb5c
Faulting process id: 0x23c4
Faulting application start time: 0xiexplore.exe0
Faulting application path: iexplore.exe1
Faulting module path: iexplore.exe2
Report Id: iexplore.exe3

Error: (01/07/2015 05:29:13 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: iexplore.exe, version: 11.0.9600.17496, time stamp: 0x4a5bc959
Faulting module name: MSHTML.dll, version: 11.0.9600.17496, time stamp: 0x546ff2f9
Exception code: 0xc00000fd
Fault offset: 0x0011fb5c
Faulting process id: 0x6dc
Faulting application start time: 0xiexplore.exe0
Faulting application path: iexplore.exe1
Faulting module path: iexplore.exe2
Report Id: iexplore.exe3

Error: (01/04/2015 00:57:15 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program Wow-64.exe version 6.0.3.19342 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

Process ID: 1fe4

Start Time: 01d02847bf6303af

Termination Time: 4

Application Path: C:\Program Files (x86)\World of Warcraft\Wow-64.exe

Report Id: 160c54c8-943b-11e4-8247-0030675775ac

Error: (01/04/2015 10:48:55 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: iexplore.exe, version: 11.0.9600.17496, time stamp: 0x4a5bc6b7
Faulting module name: MSHTML.dll, version: 11.0.9600.17496, time stamp: 0x546ff2f9
Exception code: 0xc00000fd
Fault offset: 0x001202bc
Faulting process id: 0x11bc
Faulting application start time: 0xiexplore.exe0
Faulting application path: iexplore.exe1
Faulting module path: iexplore.exe2
Report Id: iexplore.exe3

Error: (01/04/2015 03:16:20 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: iexplore.exe, version: 11.0.9600.17496, time stamp: 0x4a5bc100
Faulting module name: MSHTML.dll, version: 11.0.9600.17496, time stamp: 0x546ff2f9
Exception code: 0xc0000005
Fault offset: 0x0026aaed
Faulting process id: 0x1f38
Faulting application start time: 0xiexplore.exe0
Faulting application path: iexplore.exe1
Faulting module path: iexplore.exe2
Report Id: iexplore.exe3

Error: (01/04/2015 02:26:41 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program Wow-64.exe version 6.0.3.19342 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

Process ID: 10f4

Start Time: 01d027efb48b1f16

Termination Time: 32

Application Path: C:\Program Files (x86)\World of Warcraft\Wow-64.exe

Report Id: 02cef21a-93e3-11e4-86e0-0030675775ac

Error: (01/04/2015 02:17:27 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program DLLSuite.exe version 2013.0.0.2113 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

Process ID: 2820

Start Time: 01d027ea753ee44b

Termination Time: 6

Application Path: C:\Program Files (x86)\DLLSuite\2014\DLLSuite.exe

Report Id: b948f062-93e1-11e4-97ad-0030675775ac


System errors:
=============
Error: (01/07/2015 06:13:17 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Spybot-S&D 2 Security Center Service service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 60000 milliseconds: Restart the service.

Error: (01/07/2015 06:13:12 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Spybot-S&D 2 Updating Service service terminated unexpectedly.  It has done this 2 time(s).  The following corrective action will be taken in 60000 milliseconds: Restart the service.

Error: (01/07/2015 06:06:46 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Spybot-S&D 2 Updating Service service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 60000 milliseconds: Restart the service.

Error: (01/07/2015 06:06:40 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The NVIDIA Stereoscopic 3D Driver Service service terminated unexpectedly.  It has done this 1 time(s).

Error: (01/07/2015 06:06:40 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Spybot-S&D 2 Scanner Service service failed to start due to the following error: 
%%1053

Error: (01/07/2015 06:06:40 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the Spybot-S&D 2 Scanner Service service to connect.

Error: (01/07/2015 06:06:10 PM) (Source: NetBT) (EventID: 4321) (User: )
Description: The name "USER-PC        :20" could not be registered on the interface with IP address 192.168.1.102.
The computer with the IP address 192.168.1.108 did not allow the name to be claimed by
this computer.

Error: (01/07/2015 06:06:10 PM) (Source: Server) (EventID: 2505) (User: )
Description: The server could not bind to the transport \Device\NetBT_Tcpip_{124DA3AB-566C-4EAD-A64D-A6980B297DB6} because another computer on the network has the same name.  The server could not start.

Error: (01/07/2015 06:06:08 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Spybot-S&D 2 Scanner Service service failed to start due to the following error: 
%%1053

Error: (01/07/2015 06:06:08 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the Spybot-S&D 2 Scanner Service service to connect.


Microsoft Office Sessions:
=========================
Error: (01/07/2015 05:53:22 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: iexplore.exe11.0.9600.174964a5bc5e1MSHTML.dll11.0.9600.17496546ff2f9c00000fd0011fb5c23c401d02acc00ef768cC:\Program Files\Internet Explorer\iexplore.exeC:\Windows\system32\MSHTML.dllfa8c4858-96bf-11e4-b028-0030675775ac

Error: (01/07/2015 05:29:13 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: iexplore.exe11.0.9600.174964a5bc959MSHTML.dll11.0.9600.17496546ff2f9c00000fd0011fb5c6dc01d02ac85e27e96cC:\Program Files\Internet Explorer\iexplore.exeC:\Windows\system32\MSHTML.dll9ad730bb-96bc-11e4-b028-0030675775ac

Error: (01/04/2015 00:57:15 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Wow-64.exe6.0.3.193421fe401d02847bf6303af4C:\Program Files (x86)\World of Warcraft\Wow-64.exe160c54c8-943b-11e4-8247-0030675775ac

Error: (01/04/2015 10:48:55 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: iexplore.exe11.0.9600.174964a5bc6b7MSHTML.dll11.0.9600.17496546ff2f9c00000fd001202bc11bc01d02835d38f1e7cC:\Program Files\Internet Explorer\iexplore.exeC:\Windows\system32\MSHTML.dll2ffd2414-9429-11e4-8247-0030675775ac

Error: (01/04/2015 03:16:20 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: iexplore.exe11.0.9600.174964a5bc100MSHTML.dll11.0.9600.17496546ff2f9c00000050026aaed1f3801d027f60dbe4553C:\Program Files\Internet Explorer\iexplore.exeC:\Windows\system32\MSHTML.dllf5e55687-93e9-11e4-86e0-0030675775ac

Error: (01/04/2015 02:26:41 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Wow-64.exe6.0.3.1934210f401d027efb48b1f1632C:\Program Files (x86)\World of Warcraft\Wow-64.exe02cef21a-93e3-11e4-86e0-0030675775ac

Error: (01/04/2015 02:17:27 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: DLLSuite.exe2013.0.0.2113282001d027ea753ee44b6C:\Program Files (x86)\DLLSuite\2014\DLLSuite.exeb948f062-93e1-11e4-97ad-0030675775ac


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i3 CPU 550 @ 3.20GHz
Percentage of memory in use: 19%
Total physical RAM: 8183.12 MB
Available physical RAM: 6560.76 MB
Total Pagefile: 16364.41 MB
Available Pagefile: 14566.96 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:465.66 GB) (Free:194.29 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 9687D9B5)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=465.7 GB) - (Type=07 NTFS)

==================== End Of Log ============================


#4 Jo*

Jo*

  • Malware Response Team
  • 3,408 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Germany
  • Local time:07:32 AM

Posted 09 January 2015 - 04:37 AM

:welcome:

Hello cjmilam,

my name is Jo and I will help you with your computer problems.


Please follow these guidelines:
  • Logs can take a while to research, so please be patient.
  • Read and follow the instructions in the sequence they are posted.
  • print or copy & save instructions.
  • back up all your private data / important files on another (external) drive before using our tools.
  • Do not install / uninstall any applications, unless otherwise instructed.
  • Use only that tools you have been instructed to use.
  • Copy and Paste the log files inside your post, unless otherwise instructed.
  • Ask for clarification, if you have any questions.
  • Stay with this topic til you get the all clean post.
  • My first language is not english. So please do not use slang or idioms. It could be hard for me to read. Thanks for your understanding.

***


1. Download Security Check by screen317 from here or here.
  • Save it to your Desktop.
  • Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
    Vista / Windows 7/8 users right-click and select Run As Administrator.
  • A Notepad document should open automatically called checkup.txt; please post the contents of that document.

***


2. Open notepad. Please copy the contents of the code box below. To do this highlight the contents of the box and right click on it. Paste this into the open notepad.
Save it in the same location as / FSRT / FSRT64 (usually your desktop) as fixlist.txt

 
start
EmptyTemp:
Hosts:
Task: {047EDEA1-D5CD-4BAF-8195-0698A4346836} - System32\Tasks\4596 => Wscript.exe C:\Users\User\AppData\Local\Temp\launchie.vbs //B <==== ATTENTION
end

NOTICE: This script was written specifically for this user, for use on that particular machine.
Running this on another machine may cause damage to your operating system


Run FRST / FSRT64 again like we did before but this time press the Fix button just once and wait.
The tool will make a log (Fixlog.txt) please post it to your reply.



***




***


Graduate of the WTT Classroom
Cheers,
Jo
If I have been helping you, and I have not replied to your latest post in 36 hours please send me a PM.


#5 cjmilam

cjmilam
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:12:32 AM

Posted 09 January 2015 - 05:12 PM

 Results of screen317's Security Check version 0.99.93 
 Windows 7 Service Pack 1 x64 (UAC is disabled!) 
 Internet Explorer 11 
``````````````Antivirus/Firewall Check:``````````````
 Windows Firewall Enabled! 
 Windows Firewall Disabled! 
avast! Antivirus  
 Antivirus up to date!  
`````````Anti-malware/Other Utilities Check:`````````
 Spybot - Search & Destroy
 Java 7 Update 45 
 Java version 32-bit out of Date!
  Adobe Flash Player 11.9.900.170 Flash Player out of Date! 
````````Process Check: objlist.exe by Laurent```````` 
 Spybot Teatimer.exe is disabled!
 AVAST Software Avast AvastSvc.exe 
 AVAST Software Avast avastui.exe 
 AVAST Software Avast ng vbox\AvastVBoxSVC.exe
 AVAST Software Avast ng ngservice.exe
`````````````````System Health check`````````````````
 Total Fragmentation on Drive C: 0%
````````````````````End of Log``````````````````````
 



#6 cjmilam

cjmilam
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:12:32 AM

Posted 09 January 2015 - 05:28 PM

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 07-01-2015
Ran by User at 2015-01-09 17:12:20 Run:1
Running from C:\Users\User\Desktop
Loaded Profile: User (Available profiles: User)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
start
EmptyTemp:
Hosts:
Task: {047EDEA1-D5CD-4BAF-8195-0698A4346836} - System32\Tasks\4596 => Wscript.exe C:\Users\User\AppData\Local\Temp\launchie.vbs //B <==== ATTENTION
end

*****************

C:\Windows\System32\Drivers\etc\hosts => Moved successfully.
Hosts was reset successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{047EDEA1-D5CD-4BAF-8195-0698A4346836}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{047EDEA1-D5CD-4BAF-8195-0698A4346836}" => Key deleted successfully.
C:\Windows\System32\Tasks\4596 => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\4596" => Key deleted successfully.
EmptyTemp: => Removed 3.5 GB temporary data.

The system needed a reboot.

==== End of Fixlog 17:16:49 ====



#7 Jo*

Jo*

  • Malware Response Team
  • 3,408 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Germany
  • Local time:07:32 AM

Posted 09 January 2015 - 05:53 PM

Hello cjmilam,

Please download Malwarebytes Anti-Rootkit and save it to your desktop.
  • Be sure to print out and follow the instructions provided on that same page.
  • Caution: This is a beta version so please be sure to read the disclaimer and back up all your data before using.
  • Scan your system for malware
With some infections, you may see two messages boxes.
  • 'Could not load protection driver'. Click 'OK'.
  • 'Could not load DDA driver'. Click 'Yes' to this message, to allow the driver to load after a restart. Allow the computer to restart. Continue with the rest of these instructions.
  • If malware is found - do not press the Clean up button, please go to the MBAR folder and then copy/paste the contents of the MBAR-log-***.txt file to your next reply.
  • If there is no malware found, please let me know as well.

***


Please download AdwCleaner by Xplode and save to your Desktop.
Double-click AdwCleaner.exe
Vista / Windows 7/8 users right-click and select Run As Administrator.
  • Click on the Scan button.
  • AdwCleaner will begin...be patient as the scan may take some time to complete.
    When the scan has finished, the actual line should say "Pending. Please uncheck elements you do not want to remove" => scan is complete.
  • After the scan has finished, click on the Report button...a logfile (AdwCleaner[R0].txt) will open in Notepad for review.
  • The contents of the log file may be confusing. Unless you see a program name that you know should not be removed, don't worry about it.
    If you see an entry you want to keep, let me know about it.
  • Copy and paste the contents of that logfile in your next reply.
  • A copy of all logfiles are saved in the C:\AdwCleaner folder which was created when running the tool.

***


Graduate of the WTT Classroom
Cheers,
Jo
If I have been helping you, and I have not replied to your latest post in 36 hours please send me a PM.


#8 cjmilam

cjmilam
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:12:32 AM

Posted 09 January 2015 - 06:46 PM

# AdwCleaner v4.107 - Report created 09/01/2015 at 18:41:18
# Updated 07/01/2015 by Xplode
# Database : 2015-01-03.1 [Live]
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
# Username : User - USER-PC
# Running from : C:\Users\User\Desktop\AdwCleaner.exe
# Option : Scan

***** [ Services ] *****

***** [ Files / Folders ] *****

File Found : C:\Program Files (x86)\PDFCreator\Toolbar\pdfforge Toolbar_setup.exe
File Found : C:\Users\User\AppData\LocalLow\SkwConfig.bin
Folder Found : C:\Program Files (x86)\Conduit
Folder Found : C:\Program Files (x86)\iLivid
Folder Found : C:\Program Files (x86)\MSR
Folder Found : C:\Program Files (x86)\PC Drivers HeadQuarters
Folder Found : C:\Program Files (x86)\pc speed up
Folder Found : C:\ProgramData\apn
Folder Found : C:\ProgramData\Ask
Folder Found : C:\ProgramData\Conduit
Folder Found : C:\ProgramData\PC Drivers HeadQuarters
Folder Found : C:\ProgramData\SecTaskMan
Folder Found : C:\ProgramData\Tarma Installer
Folder Found : C:\ProgramData\WPM
Folder Found : C:\Users\User\AppData\Local\emaze
Folder Found : C:\Users\User\AppData\Local\Ilivid Player
Folder Found : C:\Users\User\AppData\Local\OpenCandy
Folder Found : C:\Users\User\AppData\Local\PackageAware
Folder Found : C:\Users\User\AppData\Local\SecTaskMan
Folder Found : C:\Users\User\AppData\LocalLow\Conduit
Folder Found : C:\Users\User\AppData\Roaming\v9

***** [ Scheduled Tasks ] *****

***** [ Shortcuts ] *****

***** [ Registry ] *****

Key Found : HKCU\Software\AppDataLow\Software\Conduit
Key Found : HKCU\Software\AppDataLow\Software\searchqutoolbar
Key Found : HKCU\Software\AppDataLow\Software\Smartbar
Key Found : HKCU\Software\AppDataLow\Software\SmartBar
Key Found : HKCU\Software\Conduit
Key Found : HKCU\Software\IM
Key Found : HKCU\Software\Mozilla\Extends
Key Found : HKCU\Software\Offerbox
Key Found : HKCU\Software\visualbee
Key Found : HKCU\Software\YahooPartnerToolbar
Key Found : [x64] HKCU\Software\Conduit
Key Found : [x64] HKCU\Software\IM
Key Found : [x64] HKCU\Software\Offerbox
Key Found : [x64] HKCU\Software\visualbee
Key Found : [x64] HKCU\Software\YahooPartnerToolbar
Key Found : HKLM\SOFTWARE\Classes\.bdc
Key Found : HKLM\SOFTWARE\Classes\.bgl
Key Found : HKLM\SOFTWARE\Classes\Applications\ilividsetupv1.exe
Key Found : HKLM\SOFTWARE\Classes\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Key Found : HKLM\SOFTWARE\Classes\Installer\Features\DF917BEA0BDE9E345B42099FC7E14699
Key Found : HKLM\SOFTWARE\Classes\Installer\Products\DF917BEA0BDE9E345B42099FC7E14699
Key Found : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Key Found : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{6C9945B7-1D19-46CB-88C0-45A24DF6CD6E}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{84B9B044-17C0-48FB-A300-C9747D5DF29C}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{93E3D79C-0786-48FF-9329-93BC9F6DC2B3}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
Key Found : HKLM\SOFTWARE\Conduit
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Key Found : HKLM\SOFTWARE\Uniblue
Key Found : HKLM\SOFTWARE\Uniblue\DriverScanner
Key Found : HKLM\SOFTWARE\VBMZ
Key Found : HKLM\SOFTWARE\visualbee
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{0FCE4F01-64EC-42F1-83E1-1E08D38605D2}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{1A2A195A-A0F9-4006-AF02-3F05EEFDE792}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{22511E2E-7970-414E-BC7C-28D16C4AF54D}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{23C5311E-016D-4999-BCB1-499898429D6C}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{2C4B6DB8-6413-403B-A038-16A352CFE8B9}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{2D9DB233-DC4B-4677-946C-5FA5ABCF506B}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{3AE76A17-C344-4A83-81CE-65EFEE41E42D}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{3F607E46-0D3C-4442-B1DE-DE7FA4768F5C}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{46803190-228D-470E-90FE-F5E0CEA9C4F2}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{4C0A69B0-CE97-42B7-86FC-08280C99C74D}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{4E9EB4D5-C929-4005-AC62-1856B1DA5A24}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{5180FE16-2E09-497B-9C8B-5A6F029ECECB}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{8FAF962C-3EDE-405E-B1D0-62B8235C6044}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{A4F6E1B3-469E-46EF-A936-FBA9D5EFD2B9}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{C1F5E799-B218-4C32-B189-3C389BA140BB}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{C97AF157-6A27-4F57-9D47-E2D3E4761B77}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{ED0D2C81-7DB5-4599-B7C0-1033418B5672}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{F60C9408-3110-4C98-A139-ABE1EE1111DD}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{FE0273D1-99DF-4AC0-87D5-1371C6271785}
Key Found : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\00E944CB89111313EAF35A0553F547F9
Key Found : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0E12F736682067FDE4D1158D5940A82E
Key Found : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1A24B5BB8521B03E0C8D908F5ABC0AE6
Key Found : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2B0D56C4F4C46D844A57FFED6F0D2852
Key Found : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\49D4375FE41653242AEA4C969E4E65E0
Key Found : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\53F55AF3F4049ED3FA6EA6F88E414E24
Key Found : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\68E4BF4B11615E03C97732FD581AB607
Key Found : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6AA0923513360135B272E8289C5F13FA
Key Found : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6F7467AF8F29C134CBBAB394ECCFDE96
Key Found : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8CE3DDAB2D152683FBCEB4866BCD2B0F
Key Found : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\922525DCC5199162F8935747CA3D8E59
Key Found : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\AF6CE16AFEA5C9A39B766468A8B35C21
Key Found : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BCDA179D619B91648538E3394CAC94CC
Key Found : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D677B1A9671D4D4004F6F2A4469E86EA
Key Found : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DD1402A9DD4215A43ABDE169A41AFA0E
Key Found : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E36E114A0EAD2AD46B381D23AD69CDDF
Key Found : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EF8E618DB3AEDFBB384561B5C548F65E
Key Found : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FB1E44269B58F433A8C8E671E37CFDCF
Key Found : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\DF917BEA0BDE9E345B42099FC7E14699
Key Found : [x64] HKLM\SOFTWARE\Tarma Installer

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.17496

*************************

AdwCleaner[R0].txt - [8238 octets] - [09/01/2015 18:41:18]

########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [8298 octets] ##########


That is th ADW scan report,  do I now clean with it ?  also Malware found nothing,  but I had ran that rootkit prior to coming here and it removed two items.



#9 Jo*

Jo*

  • Malware Response Team
  • 3,408 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Germany
  • Local time:07:32 AM

Posted 10 January 2015 - 04:57 AM

Hello cjmilam,

Double click on AdwCleaner.exe to run the tool again.
Vista / Windows 7/8 users right-click and select Run As Administrator.
  • Click on the Scan button.
  • AdwCleaner will begin to scan your computer like it did before.
  • When the scan has finished, the actual line should say "Pending. Please uncheck elements you do not want to remove". Look through the scan results and uncheck any entries that you do not wish to remove.
  • This time, click on the Clean button.
  • Press OK when asked to close all programs and follow the onscreen prompts.
  • Press OK again to allow AdwCleaner to restart the computer and complete the removal process.
  • After rebooting, a logfile report (AdwCleaner[S0].txt) will open automatically.
  • Copy and paste the contents of that logfile in your next reply.
  • A copy of that logfile will also be saved in the C:\AdwCleaner folder.

***


Please download Junkware Removal Tool from HERE and save it to your desktop.
Shutdown your antivirus to avoid any potential conflicts.
Double click JRT.exe to run the tool.
Vista / Windows 7/8 users right-click and select Run As Administrator.
  • JRT will begin to backup your registry and start scanning your system.
  • Please be patient as this can take a while to complete depending on your system's specifications.
  • On completion, the log JRT.txt is saved on your desktop and will automatically open.
Enable your antivirus!
Post the contents of JRT.txt into your next reply.


***


Run the Farbar Recovery Scan Tool again.
  • Double-click to run FSRT / FSRT64. When the tool opens click Yes to disclaimer.
  • Press Scan button.
  • It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
  • The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

***


How the computer is running now?


***


Graduate of the WTT Classroom
Cheers,
Jo
If I have been helping you, and I have not replied to your latest post in 36 hours please send me a PM.


#10 cjmilam

cjmilam
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:12:32 AM

Posted 11 January 2015 - 06:12 PM

Things are running much,  much better!  I will be attaching the logs you have asked for asap.  Is it recommended to keep the tools ive gotten from you and using them on occasional with my usual pc check up practices?  if so how often would you suggest? Thanks so much for you help,  from looking at my logs, can you recommend any further adjustments to enhance my pcs performance? 

 

thank you!


Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 07-01-2015
Ran by User (administrator) on USER-PC on 11-01-2015 18:08:26
Running from C:\Users\User\Desktop
Loaded Profile: User (Available profiles: User)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: English (United States)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Microsoft Corporation) C:\Program Files\Microsoft IntelliType Pro\itype.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Avast Software) C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\ng\ngservice.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [7981088 2009-07-20] (Realtek Semiconductor)
HKLM\...\Run: [itype] => c:\Program Files\Microsoft IntelliType Pro\itype.exe [1873288 2011-08-01] (Microsoft Corporation)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5227112 2015-01-09] (AVAST Software)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-2424769105-595088613-2816330089-1001\...\Run: [AdobeBridge] => [X]
HKU\S-1-5-21-2424769105-595088613-2816330089-1001\...\MountPoints2: {25fa6d0e-7580-11e2-a36d-0030675775ac} - E:\VZW_Software_upgrade_assistant.exe
HKU\S-1-5-21-2424769105-595088613-2816330089-1001\...\MountPoints2: {2a28b1cd-5b09-11e1-a026-0030675775ac} - E:\TL-Bootstrap.exe
HKU\S-1-5-21-2424769105-595088613-2816330089-1001\...\MountPoints2: {3bef3232-3a68-11e0-8e73-003067577bc6} - E:\LaunchU3.exe -a
HKU\S-1-5-21-2424769105-595088613-2816330089-1001\...\MountPoints2: {556285fa-6999-11e2-8bcf-0030675775ac} - G:\setup.exe -a
HKU\S-1-5-21-2424769105-595088613-2816330089-1001\...\MountPoints2: {58dcf67a-a385-11e0-990f-806e6f6e6963} - E:\setup.exe -a
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software)
BootExecute: autocheck autochk * sdnclean64.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyEnable: [S-1-5-19] => Internet Explorer proxy is enabled.
ProxyEnable: [S-1-5-20] => Internet Explorer proxy is enabled.
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com
HKU\S-1-5-21-2424769105-595088613-2816330089-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/?ocid=iehp
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
Toolbar: HKLM - No Name - !{B922D405-6D13-4A2B-AE89-08A030DA4402} -  No File
Toolbar: HKLM-x32 - No Name - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} -  No File
Toolbar: HKLM-x32 - No Name - !{B922D405-6D13-4A2B-AE89-08A030DA4402} -  No File
Toolbar: HKU\S-1-5-21-2424769105-595088613-2816330089-1001 -> No Name - {113342CD-3031-4EE9-9288-2C58857D3A3D} -  No File
DPF: HKLM-x32 {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} http://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab
DPF: HKLM-x32 {140E4DF8-9E14-4A34-9577-C77561ED7883} https://s3.amazonaws.com/content.systemrequirementslab.com/global/bin/srldetect_cyri_4.1.72.0_x.cab
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Tcpip\Parameters: [DhcpNameServer] 208.180.42.68 208.180.42.100
Tcpip\..\Interfaces\{124DA3AB-566C-4EAD-A64D-A6980B297DB6}: [NameServer] 8.8.8.8,8.8.8.8

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
FF Plugin-x32: @rocketlife.com/RocketLife Secure Plug-In Layer;version=1.0.5 -> C:\ProgramData\Visan\plugins\npRLSecurePluginLayer.dll (RocketLife, LLP)
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2015-01-03]
FF Extension: No Name - C:\Program Files (x86)\WebexpEnhancedV1\WebexpEnhancedV1alpha350\ff [Not Found]
FF Extension: No Name - C:\Program Files (x86)\VideoPlayerV3\VideoPlayerV3beta659\ff [Not Found]

Chrome:
=======
CHR HKLM-x32\...\Chrome\Extension: [badgdiliogdgpeiifplgjbbnlieepbci] - C:\Program Files (x86)\WebexpEnhancedV1\WebexpEnhancedV1alpha350\ch\WebexpEnhancedV1alpha350.crx [Not Found]
CHR HKLM-x32\...\Chrome\Extension: [ddolhdhpaddmpfojmboenilinbagcgdl] - C:\Program Files (x86)\VideoPlayerV3\VideoPlayerV3beta659\ch\VideoPlayerV3beta659.crx [Not Found]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2015-01-03] (AVAST Software)
R3 AvastVBoxSvc; C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe [4012248 2015-01-03] (Avast Software)
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2015-01-03] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [83280 2015-01-03] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2015-01-03] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2015-01-03] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1050432 2015-01-03] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [436624 2015-01-03] (AVAST Software)
S2 aswStm; C:\Windows\system32\drivers\aswStm.sys [116728 2015-01-03] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [267632 2015-01-03] ()
R1 BIOS; C:\Windows\system32\drivers\BIOS64.sys [14136 2006-10-31] (BIOSTAR Group)
R1 BIOS; C:\Windows\SysWOW64\drivers\BIOS64.sys [14136 2006-10-31] (BIOSTAR Group)
R1 BS_I2cIo; C:\Windows\system32\drivers\BS_I2cIo.sys [15408 2008-06-16] (BIOSTAR Group)
R1 BS_I2cIo; C:\Windows\SysWOW64\drivers\BS_I2cIo.sys [17024 2008-06-16] (BIOSTAR Group) [File not signed]
S3 SSMO3v2Filter; C:\Windows\System32\drivers\MO3v2Driver.sys [23040 2010-11-22] (Sagatek Co. Ltd.) [File not signed]
S3 SWDUMon; C:\Windows\System32\DRIVERS\SWDUMon.sys [16152 2014-01-25] ()
R2 VBoxAswDrv; C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [271752 2015-01-03] (Avast Software)
S3 NVIDIAHWAccess; \??\C:\Users\User\AppData\Roaming\NVIDIA\HWAccess.sys [X]
S4 nvvad_WaveExtensible; system32\drivers\nvvad64v.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)

==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-11 18:08 - 2015-01-11 18:08 - 00011844 _____ () C:\Users\User\Desktop\FRST.txt
2015-01-11 18:07 - 2015-01-11 18:07 - 00001863 _____ () C:\Users\User\Desktop\JRT.txt
2015-01-11 18:05 - 2015-01-11 18:05 - 00000000 ____D () C:\Windows\ERUNT
2015-01-11 18:03 - 2015-01-11 18:03 - 01707939 _____ (Thisisu) C:\Users\User\Desktop\JRT.exe
2015-01-11 17:55 - 2015-01-11 17:55 - 00000197 _____ () C:\Windows\system32\2015-01-11-22-55-52.061-AvastVBoxSVC.exe-3240.log
2015-01-11 11:21 - 2015-01-11 11:21 - 00000197 _____ () C:\Windows\system32\2015-01-11-16-21-20.013-AvastVBoxSVC.exe-3564.log
2015-01-10 20:10 - 2015-01-10 20:10 - 00000197 _____ () C:\Windows\system32\2015-01-11-01-10-52.050-AvastVBoxSVC.exe-3760.log
2015-01-09 21:50 - 2015-01-09 21:50 - 00000197 _____ () C:\Windows\system32\2015-01-10-02-50-20.059-AvastVBoxSVC.exe-3456.log
2015-01-09 18:50 - 2015-01-09 18:50 - 00008761 _____ () C:\Users\User\Desktop\AdwCleaner[S0].txt
2015-01-09 18:41 - 2015-01-09 18:49 - 00000000 ____D () C:\AdwCleaner
2015-01-09 18:22 - 2015-01-09 18:22 - 02191360 _____ () C:\Users\User\Desktop\AdwCleaner.exe
2015-01-09 17:20 - 2015-01-09 17:20 - 00000197 _____ () C:\Windows\system32\2015-01-09-22-20-15.059-AvastVBoxSVC.exe-2784.log
2015-01-09 17:05 - 2015-01-09 17:05 - 00852504 _____ () C:\Users\User\Desktop\SecurityCheck.exe
2015-01-09 16:57 - 2015-01-09 16:58 - 00000197 _____ () C:\Windows\system32\2015-01-09-21-57-55.052-AvastVBoxSVC.exe-3520.log
2015-01-08 21:17 - 2015-01-08 21:17 - 00000197 _____ () C:\Windows\system32\2015-01-09-02-17-27.028-AvastVBoxSVC.exe-3584.log
2015-01-07 18:08 - 2015-01-07 18:08 - 00000197 _____ () C:\Windows\system32\2015-01-07-23-08-41.014-AvastVBoxSVC.exe-3648.log
2015-01-07 17:43 - 2015-01-09 18:40 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2015-01-07 17:41 - 2015-01-09 18:40 - 00000000 ____D () C:\Users\User\Desktop\mbar
2015-01-07 17:40 - 2015-01-07 17:40 - 16448208 _____ (Malwarebytes Corp.) C:\Users\User\Desktop\mbar-1.08.2.1001.exe
2015-01-07 17:25 - 2015-01-11 18:08 - 00000000 ____D () C:\FRST
2015-01-07 17:22 - 2015-01-07 17:22 - 02124288 _____ (Farbar) C:\Users\User\Desktop\FRST64.exe
2015-01-07 17:06 - 2015-01-07 17:07 - 00000197 _____ () C:\Windows\system32\2015-01-07-22-06-57.036-AvastVBoxSVC.exe-3680.log
2015-01-06 17:58 - 2015-01-06 17:59 - 00000197 _____ () C:\Windows\system32\2015-01-06-22-58-59.072-AvastVBoxSVC.exe-3812.log
2015-01-05 18:32 - 2015-01-05 18:32 - 00000197 _____ () C:\Windows\system32\2015-01-05-23-32-28.068-AvastVBoxSVC.exe-3692.log
2015-01-04 16:23 - 2015-01-04 16:23 - 00000197 _____ () C:\Windows\system32\2015-01-04-21-23-20.045-AvastVBoxSVC.exe-3996.log
2015-01-04 13:39 - 2015-01-04 13:41 - 00000000 ____D () C:\Users\User\AppData\Local\._LiveCode_
2015-01-04 13:39 - 2015-01-04 13:39 - 00000000 ____D () C:\Users\User\AppData\Roaming\Acreon
2015-01-04 13:39 - 2014-12-04 03:45 - 03870720 _____ (Acreon Inc.) C:\Users\User\Desktop\WowMatrix.exe
2015-01-04 13:27 - 2015-01-04 13:27 - 00000197 _____ () C:\Windows\system32\2015-01-04-18-27-11.061-AvastVBoxSVC.exe-4032.log
2015-01-04 13:23 - 2015-01-09 18:50 - 00003610 _____ () C:\Windows\PFRO.log
2015-01-04 11:55 - 2015-01-04 11:55 - 00005316 _____ () C:\Windows\DPINST.LOG
2015-01-04 11:53 - 2015-01-04 11:54 - 00000000 ____D () C:\AdobeTemp
2015-01-04 11:48 - 2015-01-10 20:11 - 00002699 _____ () C:\Windows\WindowsUpdate.log
2015-01-04 10:49 - 2015-01-04 10:49 - 00000197 _____ () C:\Windows\system32\2015-01-04-15-49-45.017-AvastVBoxSVC.exe-3476.log
2015-01-04 02:24 - 2015-01-04 02:24 - 00000197 _____ () C:\Windows\system32\2015-01-04-07-24-36.051-AvastVBoxSVC.exe-4196.log
2015-01-04 02:20 - 2015-01-11 17:53 - 00001008 _____ () C:\Windows\setupact.log
2015-01-04 02:20 - 2015-01-04 02:23 - 02983888 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-01-04 02:20 - 2015-01-04 02:20 - 00000000 _____ () C:\Windows\setuperr.log
2015-01-04 02:14 - 2015-01-04 02:14 - 00176128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ie4uinit.exe
2015-01-04 02:13 - 2015-01-04 02:13 - 03223152 _____ (VMware, Inc.) C:\Windows\SysWOW64\vm3dgl.dll
2015-01-04 02:13 - 2015-01-04 02:13 - 00219248 _____ (VMware, Inc.) C:\Windows\SysWOW64\vm3dum.dll
2015-01-04 02:11 - 2015-01-04 03:06 - 00063088 _____ (VMware, Inc.) C:\Windows\SysWOW64\vsocklib.dll
2015-01-04 02:11 - 2015-01-04 03:06 - 00053360 _____ (VMware, Inc.) C:\Windows\SysWOW64\vmGuestLib.dll
2015-01-04 02:11 - 2015-01-04 03:06 - 00050800 _____ (VMware, Inc.) C:\Windows\SysWOW64\vmhgfs.dll
2015-01-04 02:11 - 2015-01-04 03:06 - 00034416 _____ (VMware, Inc.) C:\Windows\SysWOW64\vmGuestLibJava.dll
2015-01-04 02:11 - 2015-01-04 03:05 - 00606208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstime.dll
2015-01-04 02:11 - 2015-01-04 03:05 - 00229376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieaksie.dll
2015-01-04 02:11 - 2015-01-04 03:05 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieakui.dll
2015-01-04 02:11 - 2015-01-04 03:05 - 00126976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieakeng.dll
2015-01-04 02:11 - 2015-01-04 03:05 - 00018432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\corpol.dll
2015-01-04 02:10 - 2015-01-04 03:05 - 00131584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aaclient.dll
2015-01-04 02:10 - 2015-01-04 03:05 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\admparse.dll
2015-01-04 01:52 - 2015-01-04 01:52 - 00000000 ____D () C:\ProgramData\Weskysoft
2015-01-04 01:48 - 2015-01-04 01:48 - 00108568 _____ () C:\Users\User\AppData\Local\GDIPFONTCACHEV1.DAT
2015-01-04 01:48 - 2015-01-04 01:48 - 00000000 ____D () C:\Program Files (x86)\DLLSuite
2015-01-03 22:14 - 2015-01-03 22:14 - 00000197 _____ () C:\Windows\system32\2015-01-04-03-14-51.011-AvastVBoxSVC.exe-4004.log
2015-01-03 19:39 - 2015-01-03 19:39 - 00000197 _____ () C:\Windows\system32\2015-01-04-00-39-43.084-AvastVBoxSVC.exe-4060.log
2015-01-03 18:32 - 2015-01-03 18:32 - 00000197 _____ () C:\Windows\system32\2015-01-03-23-32-29.055-AvastVBoxSVC.exe-3320.log
2015-01-03 18:29 - 2015-01-03 18:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
2015-01-03 18:24 - 2015-01-03 18:24 - 00000197 _____ () C:\Windows\system32\2015-01-03-23-24-25.056-AvastVBoxSVC.exe-3888.log
2015-01-03 18:24 - 2014-07-02 12:44 - 00609240 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe
2015-01-03 18:12 - 2015-01-03 18:12 - 00000197 _____ () C:\Windows\system32\2015-01-03-23-12-04.093-AvastVBoxSVC.exe-3288.log
2015-01-03 17:07 - 2015-01-03 17:08 - 00000197 _____ () C:\Windows\system32\2015-01-03-22-07-57.098-AvastVBoxSVC.exe-4000.log
2015-01-03 17:01 - 2015-01-03 17:01 - 00000197 _____ () C:\Windows\system32\2015-01-03-22-01-13.045-AvastVBoxSVC.exe-3828.log
2015-01-03 16:30 - 2015-01-03 16:30 - 00000000 ____D () C:\Users\User\Documents\ProcAlyzer Dumps
2015-01-03 16:01 - 2015-01-03 16:27 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2015-01-03 16:01 - 2015-01-03 16:03 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2015-01-03 16:01 - 2015-01-03 16:01 - 00001391 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
2015-01-03 16:01 - 2015-01-03 16:01 - 00001379 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2015-01-03 16:01 - 2015-01-03 16:01 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking
2015-01-03 16:01 - 2015-01-03 16:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
2015-01-03 16:01 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe
2015-01-03 15:42 - 2015-01-03 15:43 - 00000247 _____ () C:\Windows\system32\2015-01-03-20-42-57.090-aswFe.exe-12728.log
2015-01-03 15:36 - 2015-01-03 15:42 - 00000247 _____ () C:\Windows\system32\2015-01-03-20-36-53.032-aswFe.exe-4260.log
2015-01-03 15:36 - 2015-01-03 15:36 - 00000197 _____ () C:\Windows\system32\2015-01-03-20-36-49.074-AvastVBoxSVC.exe-4892.log
2015-01-03 15:28 - 2015-01-03 15:28 - 00000000 ____D () C:\Windows\SysWOW64\vbox
2015-01-03 15:28 - 2015-01-03 15:28 - 00000000 ____D () C:\Windows\system32\vbox
2015-01-03 15:25 - 2015-01-03 15:25 - 00000000 ____D () C:\Users\User\AppData\Roaming\AVAST Software
2015-01-03 15:18 - 2015-01-03 15:22 - 01050432 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys
2015-01-03 15:18 - 2015-01-03 15:18 - 00436624 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2015-01-03 15:18 - 2015-01-03 15:18 - 00364512 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2015-01-03 15:18 - 2015-01-03 15:18 - 00267632 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2015-01-03 15:18 - 2015-01-03 15:18 - 00116728 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys
2015-01-03 15:18 - 2015-01-03 15:18 - 00093568 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2015-01-03 15:18 - 2015-01-03 15:18 - 00083280 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2015-01-03 15:18 - 2015-01-03 15:18 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2015-01-03 15:18 - 2015-01-03 15:18 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2015-01-03 15:18 - 2015-01-03 15:18 - 00029208 _____ () C:\Windows\system32\Drivers\aswHwid.sys
2015-01-03 15:16 - 2015-01-03 15:16 - 00000000 ____D () C:\Program Files\AVAST Software
2015-01-03 15:14 - 2015-01-03 15:16 - 00000000 ____D () C:\ProgramData\AVAST Software
2015-01-03 14:31 - 2015-01-03 15:13 - 00000000 ____D () C:\Users\User\AppData\Roaming\Gegyyq
2015-01-03 14:30 - 2015-01-03 14:30 - 00000761 _____ () C:\Windows\system32\Drivers\etc\hosts.txt
2015-01-03 13:44 - 2015-01-03 13:44 - 00001158 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spy Protector.lnk
2015-01-03 13:44 - 2015-01-03 13:44 - 00001147 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Security Task Manager.lnk
2015-01-03 13:44 - 2015-01-03 13:44 - 00000000 ____D () C:\Program Files (x86)\Security Task Manager
2015-01-02 20:21 - 2015-01-03 15:13 - 00000000 ____D () C:\ProgramData\RiriWtuzk
2014-12-29 23:59 - 2014-12-29 23:59 - 00000000 ____D () C:\Users\User\AppData\Local\NVIDIA
2014-12-29 23:27 - 2014-08-19 22:15 - 00075040 _____ (Khronos Group) C:\Windows\system32\OpenCL.dll
2014-12-29 23:27 - 2014-08-19 22:15 - 00061912 _____ (Khronos Group) C:\Windows\SysWOW64\OpenCL.dll
2014-12-29 23:27 - 2014-07-02 13:55 - 06783776 _____ (NVIDIA Corporation) C:\Windows\system32\nvcpl.dll
2014-12-29 23:27 - 2014-07-02 13:55 - 03522392 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvc64.dll
2014-12-29 23:27 - 2014-07-02 13:55 - 02559960 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvcr.dll
2014-12-29 23:27 - 2014-07-02 13:55 - 00935368 _____ (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
2014-12-29 23:27 - 2014-07-02 13:55 - 00386520 _____ (NVIDIA Corporation) C:\Windows\system32\nvmctray.dll
2014-12-29 23:27 - 2014-07-02 13:55 - 00062808 _____ (NVIDIA Corporation) C:\Windows\system32\nvshext.dll
2014-12-29 23:27 - 2014-07-02 05:14 - 03826628 _____ () C:\Windows\system32\nvcoproc.bin
2014-12-29 23:04 - 2014-12-13 05:08 - 01895056 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6434709.dll
2014-12-29 23:04 - 2014-12-13 05:08 - 01556624 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6434709.dll
2014-12-28 12:34 - 2014-12-28 12:34 - 00000000 ____D () C:\ProgramData\HitmanPro
2014-12-28 11:57 - 2014-12-28 11:57 - 00000000 _____ () C:\autoexec.bat
2014-12-28 10:52 - 2015-01-09 18:22 - 00135384 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-12-28 10:51 - 2015-01-09 18:21 - 00096472 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-12-28 10:51 - 2014-12-28 10:51 - 00001102 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-12-28 10:51 - 2014-12-28 10:51 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-12-28 10:51 - 2014-12-28 10:51 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-12-28 10:51 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-12-28 10:43 - 2014-12-28 10:43 - 00009948 _____ () C:\Users\User\Documents\reg.reg
2014-12-17 17:29 - 2014-12-13 00:09 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-12-17 17:29 - 2014-12-12 22:33 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-11 18:00 - 2014-02-25 09:54 - 00000000 ____D () C:\Users\User\AppData\Local\Battle.net
2015-01-11 18:00 - 2009-07-13 23:45 - 00023568 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-01-11 18:00 - 2009-07-13 23:45 - 00023568 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-01-11 17:57 - 2012-02-10 23:31 - 00000336 _____ () C:\Windows\Tasks\HP Photo Creations Communicator.job
2015-01-11 17:53 - 2011-02-17 02:12 - 00000000 ____D () C:\ProgramData\NVIDIA
2015-01-11 17:53 - 2009-07-14 00:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-01-11 15:18 - 2013-11-29 19:41 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-01-11 12:50 - 2014-01-25 15:50 - 00000428 _____ () C:\Windows\Tasks\SlimCleaner Plus (Scheduled Scan - User).job
2015-01-11 11:20 - 2014-09-08 20:35 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2015-01-11 00:09 - 2011-02-22 15:09 - 00003918 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{3CA4DA99-5C52-4C3D-9015-8BC1B492778E}
2015-01-09 18:49 - 2011-05-12 17:15 - 00000987 _____ () C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-01-09 17:18 - 2013-11-29 19:41 - 00003768 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-01-09 17:18 - 2013-01-05 12:04 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-01-09 17:18 - 2011-05-15 11:54 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-01-07 18:04 - 2009-07-14 00:08 - 00032562 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-01-07 18:03 - 2011-02-22 22:49 - 00000000 ____D () C:\Users\User\Desktop\Junk
2015-01-04 13:23 - 2011-06-30 20:59 - 00000000 ____D () C:\Program Files (x86)\Motorola
2015-01-04 12:00 - 2011-07-14 20:11 - 00000000 ____D () C:\Program Files (x86)\Cakewalk
2015-01-04 11:56 - 2011-12-01 17:48 - 00000000 ____D () C:\Users\User\AppData\Roaming\SteelSeries
2015-01-04 11:56 - 2011-02-17 02:07 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2015-01-04 11:54 - 2012-03-14 20:13 - 00000000 ____D () C:\ProgramData\Adobe
2015-01-04 11:54 - 2012-03-14 20:13 - 00000000 ____D () C:\Program Files (x86)\Adobe
2015-01-04 11:54 - 2011-02-17 13:46 - 00000000 ____D () C:\Users\User\AppData\Roaming\Adobe
2015-01-04 11:53 - 2012-03-14 20:13 - 00000000 ____D () C:\Program Files\Common Files\Adobe
2015-01-04 11:49 - 2012-03-14 20:20 - 00000000 ____D () C:\Program Files\Adobe
2015-01-04 11:45 - 2014-02-04 16:05 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-01-04 11:44 - 2014-08-16 19:33 - 00000000 ____D () C:\Users\User\AppData\Local\Glyph
2015-01-04 11:43 - 2011-08-09 22:27 - 00000000 ____D () C:\Users\User\AppData\Roaming\Philipp Winterberg
2015-01-04 01:48 - 2011-02-24 00:56 - 00007589 _____ () C:\Users\User\AppData\Local\Resmon.ResmonCfg
2015-01-03 18:24 - 2012-03-11 03:00 - 00000000 ____D () C:\Temp
2015-01-03 18:24 - 2011-02-17 02:12 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation
2015-01-03 16:19 - 2014-02-25 09:54 - 00000000 ____D () C:\Users\User\AppData\Roaming\Battle.net
2015-01-03 16:19 - 2011-02-23 19:15 - 00000000 ____D () C:\Users\User\AppData\Roaming\Ventrilo
2015-01-03 16:19 - 2011-02-17 03:14 - 00000000 ____D () C:\Program Files\Alwil Software
2015-01-03 16:18 - 2009-07-13 22:20 - 00000000 ____D () C:\Windows\registration
2015-01-03 15:13 - 2011-05-28 13:45 - 00000000 ____D () C:\Users\User\AppData\Local\The Witcher 2
2015-01-03 15:13 - 2011-02-23 17:58 - 00000000 ____D () C:\Windows\PCHEALTH
2015-01-02 21:06 - 2012-02-04 20:59 - 00000000 ____D () C:\Windows\EBFB1375E8DE43DD84303E43485E19F8.TMP
2015-01-01 18:32 - 2009-07-13 22:20 - 00000000 ____D () C:\Windows\system32\NDF
2015-01-01 17:29 - 2011-03-20 22:50 - 00000000 ____D () C:\Users\User\Desktop\pics
2014-12-29 23:48 - 2011-02-17 02:10 - 00000000 ____D () C:\Program Files\NVIDIA Corporation
2014-12-29 23:27 - 2011-02-17 02:12 - 00000000 ____D () C:\ProgramData\NVIDIA Corporation
2014-12-29 23:27 - 2009-07-13 22:20 - 00000000 ____D () C:\Windows\Help
2014-12-29 23:23 - 2011-08-17 20:54 - 00000000 ____D () C:\Users\User\AppData\Roaming\NVIDIA
2014-12-29 23:22 - 2013-11-16 03:59 - 00000000 ____D () C:\Users\User\AppData\Local\NVIDIA Corporation
2014-12-28 12:17 - 2014-01-25 15:49 - 00000000 ____D () C:\Users\Public\Documents\Downloaded Installers
2014-12-28 11:03 - 2009-07-14 00:32 - 00000000 ____D () C:\Windows\addins
2014-12-28 10:51 - 2014-01-19 12:57 - 00000000 ____D () C:\Users\User\AppData\Roaming\Malwarebytes
2014-12-28 10:51 - 2014-01-19 12:56 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-12-26 20:04 - 2011-12-23 23:04 - 00000000 ____D () C:\Users\User\AppData\Local\Deployment
2014-12-25 10:52 - 2014-05-17 12:06 - 00000000 ____D () C:\Users\User\Desktop\M
2014-12-19 22:10 - 2009-07-13 22:20 - 00000000 ____D () C:\Windows\rescache
2014-12-18 17:58 - 2012-09-25 20:15 - 00000000 ____D () C:\Program Files (x86)\World of Warcraft

Files to move or delete:
====================
C:\Users\User\setup.exe

Some content of TEMP:
====================
C:\Users\User\AppData\Local\Temp\Quarantine.exe
C:\Users\User\AppData\Local\Temp\sqlite3.dll

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2015-01-07 20:07

==================== End Of Log ============================



#11 cjmilam

cjmilam
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:12:32 AM

Posted 11 January 2015 - 06:15 PM

# AdwCleaner v4.107 - Report created 09/01/2015 at 18:49:23
# Updated 07/01/2015 by Xplode
# Database : 2015-01-03.1 [Live]
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
# Username : User - USER-PC
# Running from : C:\Users\User\Desktop\AdwCleaner.exe
# Option : Clean

***** [ Services ] *****


***** [ Files / Folders ] *****

Folder Deleted : C:\ProgramData\apn
Folder Deleted : C:\ProgramData\Ask
Folder Deleted : C:\ProgramData\Conduit
Folder Deleted : C:\ProgramData\SecTaskMan
Folder Deleted : C:\ProgramData\Tarma Installer
Folder Deleted : C:\ProgramData\WPM
Folder Deleted : C:\ProgramData\PC Drivers HeadQuarters
Folder Deleted : C:\Program Files (x86)\Conduit
Folder Deleted : C:\Program Files (x86)\iLivid
Folder Deleted : C:\Program Files (x86)\MSR
Folder Deleted : C:\Program Files (x86)\pc speed up
Folder Deleted : C:\Program Files (x86)\PC Drivers HeadQuarters
Folder Deleted : C:\Users\User\AppData\Local\emaze
Folder Deleted : C:\Users\User\AppData\Local\Ilivid Player
Folder Deleted : C:\Users\User\AppData\Local\OpenCandy
Folder Deleted : C:\Users\User\AppData\Local\PackageAware
Folder Deleted : C:\Users\User\AppData\Local\SecTaskMan
Folder Deleted : C:\Users\User\AppData\LocalLow\Conduit
Folder Deleted : C:\Users\User\AppData\Roaming\v9
File Deleted : C:\Program Files (x86)\PDFCreator\Toolbar\pdfforge Toolbar_setup.exe
File Deleted : C:\Users\User\AppData\LocalLow\SkwConfig.bin

***** [ Scheduled Tasks ] *****


***** [ Shortcuts ] *****

Shortcut Disinfected : C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
Shortcut Disinfected : C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk

***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Classes\.bdc
Key Deleted : HKLM\SOFTWARE\Classes\.bgl
Key Deleted : HKLM\SOFTWARE\Classes\Applications\ilividsetupv1.exe
Key Deleted : HKCU\Software\Mozilla\Extends
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{6C9945B7-1D19-46CB-88C0-45A24DF6CD6E}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{84B9B044-17C0-48FB-A300-C9747D5DF29C}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{93E3D79C-0786-48FF-9329-93BC9F6DC2B3}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{0FCE4F01-64EC-42F1-83E1-1E08D38605D2}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{1A2A195A-A0F9-4006-AF02-3F05EEFDE792}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{22511E2E-7970-414E-BC7C-28D16C4AF54D}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{23C5311E-016D-4999-BCB1-499898429D6C}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{2C4B6DB8-6413-403B-A038-16A352CFE8B9}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{2D9DB233-DC4B-4677-946C-5FA5ABCF506B}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{3AE76A17-C344-4A83-81CE-65EFEE41E42D}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{3F607E46-0D3C-4442-B1DE-DE7FA4768F5C}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{46803190-228D-470E-90FE-F5E0CEA9C4F2}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{4C0A69B0-CE97-42B7-86FC-08280C99C74D}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{4E9EB4D5-C929-4005-AC62-1856B1DA5A24}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{5180FE16-2E09-497B-9C8B-5A6F029ECECB}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{8FAF962C-3EDE-405E-B1D0-62B8235C6044}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{A4F6E1B3-469E-46EF-A936-FBA9D5EFD2B9}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{C1F5E799-B218-4C32-B189-3C389BA140BB}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{C97AF157-6A27-4F57-9D47-E2D3E4761B77}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{ED0D2C81-7DB5-4599-B7C0-1033418B5672}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{F60C9408-3110-4C98-A139-ABE1EE1111DD}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{FE0273D1-99DF-4AC0-87D5-1371C6271785}
Key Deleted : HKCU\Software\Conduit
Key Deleted : HKCU\Software\IM
Key Deleted : HKCU\Software\Offerbox
Key Deleted : HKCU\Software\visualbee
Key Deleted : HKCU\Software\YahooPartnerToolbar
Key Deleted : HKCU\Software\AppDataLow\Software\Conduit
Key Deleted : HKCU\Software\AppDataLow\Software\searchqutoolbar
Key Deleted : HKCU\Software\AppDataLow\Software\SmartBar
Key Deleted : HKLM\SOFTWARE\Conduit
Key Deleted : HKLM\SOFTWARE\Uniblue
Key Deleted : HKLM\SOFTWARE\VBMZ
Key Deleted : HKLM\SOFTWARE\visualbee
Key Deleted : [x64] HKLM\SOFTWARE\Tarma Installer
Key Deleted : HKLM\SOFTWARE\Classes\Installer\Features\DF917BEA0BDE9E345B42099FC7E14699
Key Deleted : HKLM\SOFTWARE\Classes\Installer\Products\DF917BEA0BDE9E345B42099FC7E14699
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\00E944CB89111313EAF35A0553F547F9
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0E12F736682067FDE4D1158D5940A82E
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1A24B5BB8521B03E0C8D908F5ABC0AE6
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2B0D56C4F4C46D844A57FFED6F0D2852
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\49D4375FE41653242AEA4C969E4E65E0
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\53F55AF3F4049ED3FA6EA6F88E414E24
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\68E4BF4B11615E03C97732FD581AB607
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6AA0923513360135B272E8289C5F13FA
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6F7467AF8F29C134CBBAB394ECCFDE96
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8CE3DDAB2D152683FBCEB4866BCD2B0F
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\922525DCC5199162F8935747CA3D8E59
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\AF6CE16AFEA5C9A39B766468A8B35C21
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BCDA179D619B91648538E3394CAC94CC
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D677B1A9671D4D4004F6F2A4469E86EA
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DD1402A9DD4215A43ABDE169A41AFA0E
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E36E114A0EAD2AD46B381D23AD69CDDF
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EF8E618DB3AEDFBB384561B5C548F65E
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FB1E44269B58F433A8C8E671E37CFDCF
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\DF917BEA0BDE9E345B42099FC7E14699

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.17496


*************************

AdwCleaner[R0].txt - [8570 octets] - [09/01/2015 18:41:18]
AdwCleaner[S0].txt - [8449 octets] - [09/01/2015 18:49:23]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [8509 octets] ##########
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 07-01-2015
Ran by User at 2015-01-11 18:09:08
Running from C:\Users\User\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: avast! Antivirus (Disabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Up to date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
AS: avast! Antivirus (Disabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 1.1.0.5790 - Adobe Systems Inc.)
Adobe Flash Player 11 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 11.9.900.170 - Adobe Systems Incorporated)
Adobe Flash Player 15 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 15.0.0.246 - Adobe Systems Incorporated)
Adobe Media Player (HKLM-x32\...\com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 1.1 - Adobe Systems Incorporated)
Advertising Center (x32 Version: 0.0.0.2 - Nero AG) Hidden
Avast Free Antivirus (HKLM-x32\...\Avast) (Version: 10.0.2208 - AVAST Software)
Battle.net (HKLM-x32\...\Battle.net) (Version: - Blizzard Entertainment)
CBR Reader (HKLM-x32\...\{EDAAC216-AC73-4152-9654-E12FE5A69F5D}_is1) (Version: - cbrreader.com)
CCleaner (HKLM\...\CCleaner) (Version: 4.14 - Piriform)
Crysis® SP Demo (HKLM-x32\...\{92AF2F5A-4407-4A03-A80A-5A2582264746}) (Version: 1.00.0000 - Electronic Arts)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Diablo III (HKLM-x32\...\Diablo III) (Version: - Blizzard Entertainment)
Diablo III Beta (HKLM-x32\...\Diablo III Beta) (Version: - Blizzard Entertainment)
GIMP 2.8.4 (HKLM\...\GIMP-2_is1) (Version: 2.8.4 - The GIMP Team)
GPL Ghostscript Fonts (HKLM-x32\...\GPL Ghostscript Fonts) (Version: - )
Hearthstone (HKLM-x32\...\Hearthstone) (Version: - Blizzard Entertainment)
HP Deskjet 2050 J510 series Basic Device Software (HKLM\...\{F2C07BE3-0F88-4D0C-957B-3557699981E9}) (Version: 22.50.231.0 - Hewlett-Packard Co.)
HP Deskjet 2050 J510 series Help (HKLM-x32\...\{7A3DF2E2-CF13-44FB-A93E-F71D5381DB3F}) (Version: 140.0.61.61 - Hewlett Packard)
HP Deskjet 2050 J510 series Product Improvement Study (HKLM\...\{EF48631A-7F45-430A-8AD3-B41CFB1D7596}) (Version: 22.50.231.0 - Hewlett-Packard Co.)
HP Photo Creations (HKLM-x32\...\HP Photo Creations) (Version: 1.0.0.11502 - HP Photo Creations Powered by RocketLife)
HP Update (HKLM-x32\...\{B0069CFA-5BB9-4C03-B1C6-89CE290E5AFE}) (Version: 5.002.006.003 - Hewlett-Packard)
ImagXpress (x32 Version: 7.0.74.0 - Nero AG) Hidden
Java 7 Update 45 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217017FF}) (Version: 7.0.450 - Oracle)
Lexmark Toolbar (HKLM-x32\...\{1017A80C-6F09-4548-A84D-EDD6AC9525F0}) (Version: 4.0.53.0 - )
Light Artist 1.5 (HKLM-x32\...\Light Artist_is1) (Version: - )
Malwarebytes Anti-Malware version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Messenger Companion (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Games for Windows - LIVE Redistributable (HKLM-x32\...\{59E4543A-D49D-4489-B445-473D763C79AF}) (Version: 2.0.672.0 - Microsoft Corporation)
Microsoft IntelliType Pro 8.2 (HKLM\...\Microsoft IntelliType Pro 8.2) (Version: 8.20.468.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.20913.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (HKLM\...\{350AA351-21FA-3270-8B7A-835434E766AD}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
MotoHelper MergeModules (x32 Version: 1.2.0 - Motorola) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Nero 9 Essentials (HKLM-x32\...\{2093cfe2-89a6-4b9c-8224-c1960b921195}) (Version: - Nero AG)
NVIDIA 3D Vision Driver 340.52 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 340.52 - NVIDIA Corporation)
NVIDIA Graphics Driver 340.52 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 340.52 - NVIDIA Corporation)
NVIDIA HD Audio Driver 1.3.30.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.30.1 - NVIDIA Corporation)
NVIDIA Update 10.4.0 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 10.4.0 - NVIDIA Corporation)
OpenOffice.org 3.2 (HKLM-x32\...\{5A13987D-55F4-4271-A40E-76AC9B1B38FD}) (Version: 3.2.9502 - OpenOffice.org)
paint.net (HKLM\...\{3F5F509B-E226-417C-8CD1-CAAE756C328A}) (Version: 4.0.0 - dotPDN LLC)
PDF Writer (HKLM-x32\...\PDF Writer) (Version: - )
PDFCreator (HKLM-x32\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.2.3 - Frank Heindörfer, Philip Chinery)
QuickTime (HKLM-x32\...\{57752979-A1C9-4C02-856B-FBB27AC4E02C}) (Version: 7.69.80.9 - Apple Inc.)
Realtek 8136 8168 8169 Ethernet Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 1.00.0005 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5898 - Realtek Semiconductor Corp.)
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.24.999 - SAMSUNG Electronics Co., Ltd.)
Security Task Manager 2.0 (HKLM-x32\...\Security Task Manager) (Version: 2.0 - Neuber Software)
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.4.40 - Safer-Networking Ltd.)
StarCraft II (HKLM-x32\...\StarCraft II) (Version: - Blizzard Entertainment)
StencylWorks (HKLM-x32\...\StencylWorks) (Version: 1.3.4 - Stencyl, LLC)
Text-To-Speech-Runtime (HKLM-x32\...\{7B3F0113-E63C-4D6D-AF19-111A3165CCA2}) (Version: 1.0.0.0 - Magix Development GmbH)
Tseries BIOS Update (HKLM-x32\...\{E8626A59-FD0E-449C-A23A-C52FC0733629}) (Version: - )
Ulead Photo Express 2.0 SE (HKLM-x32\...\Ulead Photo Express 2.0 SE) (Version: - )
Ventrilo Client for Windows x64 (HKLM\...\{EEB3F6BB-318D-4CE5-989F-8191FCBFB578}) (Version: 3.0.7.0 - Flagship Industries, Inc.)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3538.0513 - Microsoft Corporation)
WinRAR 4.01 (64-bit) (HKLM\...\WinRAR archiver) (Version: 4.01.0 - win.rar GmbH)
World of Warcraft (HKLM-x32\...\World of Warcraft) (Version: - Blizzard Entertainment)
World of Warcraft Public Test (HKLM-x32\...\World of Warcraft Public Test) (Version: - Blizzard Entertainment)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-2424769105-595088613-2816330089-1001_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe /autoplay No File
CustomCLSID: HKU\S-1-5-21-2424769105-595088613-2816330089-1001_Classes\CLSID\{3b46f007-2c46-469d-8a46-3c6d5b38fcd4}\InprocServer32 -> C:\Windows\system32\dfshim.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2424769105-595088613-2816330089-1001_Classes\CLSID\{65e6d232-df44-4a31-99f9-e2180003ee62}\InprocServer32 -> C:\Windows\system32\dfshim.dll (Microsoft Corporation)

==================== Restore Points =========================

29-12-2014 23:45:27 Windows Update
02-01-2015 20:17:31 avast! Free Antivirus Setup
03-01-2015 13:46:26 Uninstall "avast! snxhk"
03-01-2015 13:46:59 avast! Free Antivirus Setup
03-01-2015 15:16:35 avast! antivirus system restore point
04-01-2015 11:55:45 Removed World of Warcraft®: Cataclysm™ MMO Gaming Mouse
04-01-2015 11:56:43 Removed Blackthorne
04-01-2015 11:57:03 Removed League of Legends
04-01-2015 11:58:33 Removed Path of Exile
04-01-2015 11:58:55 Removed Nitro Reader 3
04-01-2015 12:00:25 Removed System Requirements Lab
07-01-2015 18:01:01 Malwarebytes Anti-Rootkit Restore Point

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-13 21:34 - 2015-01-09 17:12 - 00000035 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {0D552FCF-A3C5-4A75-BC17-AF0866465D3B} - System32\Tasks\{957BB649-0216-4EEA-92FE-9399929DBB6E} => pcalua.exe -a "C:\Users\User\Desktop\MAGIX Music Maker 14- fraxing-\MAGIX Music Maker 14- fraxing-\music_maker_14_fraxing.exe" -d "C:\Users\User\Desktop\MAGIX Music Maker 14- fraxing-\MAGIX Music Maker 14- fraxing-"
Task: {11CA0F48-832F-4E2D-99A0-B12E166A8C06} - System32\Tasks\{B8F139F6-F873-4F99-9B7A-55741D7A986C} => pcalua.exe -a "C:\Users\User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UDILPNKN\setup.exe" -d C:\Users\User\Desktop
Task: {150165B9-4BD8-458F-8176-1E083524DAD7} - System32\Tasks\SlimCleaner Plus (Scheduled Scan - User) => C:\Program Files\SlimCleaner Plus\SlimCleanerPlus.exe
Task: {1CA48105-F844-452A-AADC-506C6C465EAC} - System32\Tasks\{F740B723-FC09-4BF3-B609-731EB566135E} => pcalua.exe -a "C:\Program Files (x86)\Steam\steam.exe" -c steam://uninstall/22350
Task: {3B6AADA9-1F96-4AB8-A17B-A22CD35C1454} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2015-01-03] (AVAST Software)
Task: {3F739531-B85E-43A7-B293-085064EB9E12} - System32\Tasks\{EC08772C-BC39-4E15-809C-6B597DE32E9B} => C:\Program Files (x86)\Skype\\Phone\Skype.exe
Task: {48301FB1-8BFB-4765-B028-109343EAD302} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDImmunize.exe
Task: {4FAC5796-B5DF-4B38-AC5A-56832D98F5AE} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-05-20] (Piriform Ltd)
Task: {5D89CAFC-5A29-4C9C-8637-22ADD36C3D01} - System32\Tasks\{16A54F92-2ACE-4774-B780-BE638EC003AD} => pcalua.exe -a "C:\Users\User\Desktop\Setup DT 1.09.exe" -d C:\Users\User\Desktop
Task: {7C3CA56D-40E0-494A-9729-75F516C8FEEC} - System32\Tasks\{FCEE3F2F-C3B6-4E38-8823-87CCB147B031} => pcalua.exe -a C:\Windows\IsUninst.exe -c -f"C:\Program Files (x86)\Ulead Systems\Ulead Photo Express 2 SE\Uninst.isu"
Task: {8BDD524B-B9C8-4EED-8057-E6CE14553525} - System32\Tasks\0 => Iexplore.exe <==== ATTENTION
Task: {9ACDDC57-53C2-4397-A680-A83CDF44DD32} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-01-09] (Adobe Systems Incorporated)
Task: {A953BAD0-41DF-43F8-A965-D27056268DEA} - System32\Tasks\HPCustParticipation HP Deskjet 2050 J510 series => C:\Program Files\HP\HP Deskjet 2050 J510 series\Bin\HPCustPartic.exe [2010-11-16] (Hewlett-Packard Co.)
Task: {AA5159EF-1E3D-4299-AE32-4DECF699F96E} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDUpdate.exe
Task: {C32E6A24-A819-4EC1-B00F-8BB30F8AD5AB} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDScan.exe
Task: {E54BEE07-8EAD-4BEC-95F8-3BB2BA9C21FD} - System32\Tasks\Microsoft_Hardware_Launch_IType_exe => c:\Program Files\Microsoft IntelliType Pro\IType.exe [2011-08-01] (Microsoft Corporation)
Task: {EB4CD130-04AD-485C-AC98-CB555A9CFBEC} - System32\Tasks\HP Photo Creations Communicator => C:\ProgramData\HP Photo Creations\Communicator.exe [2013-04-12] ()
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\HP Photo Creations Communicator.job => C:\ProgramData\HP Photo Creations\Communicator.exe
Task: C:\Windows\Tasks\SlimCleaner Plus (Scheduled Scan - User).job => C:\Program Files\SlimCleaner Plus\SlimCleanerPlus.exe

==================== Loaded Modules (whitelisted) =============

2014-12-29 23:27 - 2014-07-02 13:55 - 00116568 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2011-08-13 20:10 - 2009-04-17 08:17 - 00045568 _____ () C:\Windows\System32\LXDMPMON.DLL
2011-08-13 20:10 - 2007-04-09 09:59 - 00069632 _____ () C:\Windows\System32\LXDMOEM.DLL
2012-01-21 04:47 - 2005-03-12 01:07 - 00087040 _____ () C:\Windows\System32\pdfcmnnt.dll
2015-01-03 15:17 - 2015-01-03 15:17 - 00388208 _____ () C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxDDU.dll
2015-01-03 15:17 - 2015-01-03 15:17 - 05851328 _____ () C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxRT.dll
2015-01-11 15:23 - 2015-01-11 15:23 - 02909696 _____ () C:\Program Files\AVAST Software\Avast\defs\15011101\algo.dll
2015-01-03 15:17 - 2015-01-03 15:17 - 04495336 _____ () C:\Program Files\AVAST Software\Avast\ng\vbox\x86\VBoxRT-x86.dll
2015-01-03 15:18 - 2015-01-03 15:18 - 38562088 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2015-01-03 16:01 - 2014-05-13 12:04 - 00109400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2015-01-03 16:01 - 2014-05-13 12:04 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2015-01-03 16:01 - 2014-05-13 12:04 - 00167768 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2015-01-03 16:01 - 2012-08-23 10:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2015-01-03 16:01 - 2012-04-03 17:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

MSCONFIG\Services: AdobeFlashPlayerUpdateSvc => 3
MSCONFIG\Services: FLEXnet Licensing Service => 3
MSCONFIG\Services: FLEXnet Licensing Service 64 => 3
MSCONFIG\Services: MotoHelper => 2
MSCONFIG\Services: Nero BackItUp Scheduler 4.0 => 2
MSCONFIG\Services: NitroReaderDriverReadSpool3 => 2
MSCONFIG\Services: NvNetworkService => 2
MSCONFIG\Services: NvStreamSvc => 2
MSCONFIG\Services: NVSvc => 2
MSCONFIG\Services: Stereo Service => 2
MSCONFIG\Services: TabletInputService => 3
MSCONFIG\Services: TapiSrv => 3
MSCONFIG\Services: wuauserv => 2
MSCONFIG\startupreg: AdobeCS4ServiceManager => "C:\Program Files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
MSCONFIG\startupreg: Akamai NetSession Interface => "C:\Users\User\AppData\Local\Akamai\netsession_win.exe"
MSCONFIG\startupreg: avast => "C:\Program Files\Alwil Software\Avast5\avastUI.exe" /nogui
MSCONFIG\startupreg: EzPrint => "C:\Program Files (x86)\Lexmark 2300 Series\ezprint.exe"
MSCONFIG\startupreg: HP Software Update => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe
MSCONFIG\startupreg: LXCGCATS => rundll32 \3\LXCGtime.dll,RunDLLEntry
MSCONFIG\startupreg: lxcgmon.exe => "C:\Program Files (x86)\Lexmark 2300 Series\lxcgmon.exe"
MSCONFIG\startupreg: NvBackend => "C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe"
MSCONFIG\startupreg: PCSpeedUp => C:\Program Files (x86)\PC Speed Up\PCSpeedUp.lnk
MSCONFIG\startupreg: QuickTime Task => "C:\Program Files (x86)\QuickTime\qttask.exe" -atboottime
MSCONFIG\startupreg: RGSC => C:\Program Files (x86)\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe /silent
MSCONFIG\startupreg: SteelSeries World of Warcraft Cataclysm MMO Gaming Mouse => "C:\Program Files (x86)\SteelSeries\World of Warcraft Cataclysm MMO Gaming Mouse\WoWMHID2.exe"
MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

========================= Accounts: ==========================

Administrator (S-1-5-21-2424769105-595088613-2816330089-500 - Administrator - Disabled)
Guest (S-1-5-21-2424769105-595088613-2816330089-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-2424769105-595088613-2816330089-1002 - Limited - Enabled)
User (S-1-5-21-2424769105-595088613-2816330089-1001 - Administrator - Enabled) => C:\Users\User

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================

System errors:
=============

Microsoft Office Sessions:
=========================

==================== Memory info ===========================

Processor: Intel® Core™ i3 CPU 550 @ 3.20GHz
Percentage of memory in use: 19%
Total physical RAM: 8183.12 MB
Available physical RAM: 6551.03 MB
Total Pagefile: 16364.41 MB
Available Pagefile: 14581.37 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:465.66 GB) (Free:195.07 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 9687D9B5)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=465.7 GB) - (Type=07 NTFS)

==================== End Of Log ============================

#12 Jo*

Jo*

  • Malware Response Team
  • 3,408 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Germany
  • Local time:07:32 AM

Posted 12 January 2015 - 04:33 AM

Hello cjmilam,

you can use AdwCleaner and MalwareBytes Free once per month.

Important Note: Your version of Java is out of date. Older versions have vulnerabilities that malicious sites can use to exploit and infect your system.

- Kaspersky Lab report: Evaluating the threat level of software vulnerabilities
- Microsoft: Unprecedented Wave of Java Exploitation
- Ghosts of Java Haunt Users

Please follow these steps to remove older version Java components and update:
  • Download the latest version of Java Runtime Environment (JRE) Version 8 and save it to your desktop.
  • Under "Java Platform, Standard Edition"...click the "Download JRE" button to the right.
  • Read the License Agreement, and then check the box that says: "Accept License Agreement".
  • From the list, select (click on) the download link for your operating system (Windows x86 Offline: jre-8u25-windows-i586.exe or Windows x64: jre-8u25-windows-x64.exe) and save the file to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Go to StartBtn.gif > Control Panel, double-click on Add/Remove Programs or Programs and Features in Vista/Windows 7/8 and remove all older versions of Java.
  • Check (highlight) any item with Java Runtime Environment (JRE or J2SE) in the name.
  • Click the Remove or Change/Remove button and follow the onscreen instructions for the Java uninstaller.
  • Repeat as many times as necessary to remove each Java version.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-8u25-windows-i586.exe (or jre-8u25-windows-x64.exe for 64-bit) to install the newest version.
  • If using Windows 7/8 or Vista and the installer refuses to launch due to insufficient user permissions, then Run As Administrator.
  • When the Java Setup - Welcome window opens, click the Install > button.
  • If offered any unwanted software or toolbars during installation, just uncheck the box before continuing unless you want it. The McAfee Security Scan Plus may be installed unless you uncheck the McAfee installation box when updating Java.
-- Java is updated frequently. If you want to be automatically notified of future updates, just turn on the Java Automatic Update feature and you will not have to remember to update when Java releases a new version.

Note: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications but it's not necessary. To disable the JQS service if you don't want to use it:
  • Go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter.
  • Click Ok and reboot your computer.

---


Malwarebytes' Anti-Malware
If this program is already installed: Skip the installation and run only the scan!
Download and install: Please download Malwarebytes Anti-Malware to your desktop.
  • Double-click mb3-setup-1878.1878-3.5.1.2522.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to the following:
    • Launch Malwarebytes Anti-Malware
    • A 14 day trial of the Premium features is pre-selected. You may deselect this if you wish, and it will not diminish the scanning and removal capabilities of the program.
  • Click Finish.
  • On the Dashboard, click the 'Update Now >>' link
  • After the update completes, click the 'Scan Now >>' button.
  • Or, on the Dashboard, click the Scan Now >> button.
  • If an update is available, click the Update Now button.
  • A Threat Scan will begin.
  • When the scan is complete, if there have been detections, click Apply Actions to allow MBAM to clean what was detected.
  • In most cases, a restart will be required.
  • Wait for the prompt to restart the computer to appear, then click on Yes.
How to get logs: (Export log to save as txt)
  • After the restart once you are back at your desktop, open MBAM once more.
  • Click on the History tab > Application Logs.
  • Double click on the scan log which shows the Date and time of the scan just performed.
  • Click 'Export'.
  • Click 'Text file (*.txt)'
  • In the Save File dialog box which appears, click on Desktop.
  • In the File name: box type a name for your scan log.
  • A message box named 'File Saved' should appear stating "Your file has been successfully exported".
  • Click Ok
  • Attach that saved log to your next reply.
(Copy to clipboard for pasting into forum replies or tickets)
  • After the restart once you are back at your desktop, open MBAM once more.
  • Click on the History tab > Application Logs.
  • Double click on the scan log which shows the Date and time of the scan just performed.
  • Click 'Copy to Clipboard'
  • Paste the contents of the clipboard into your reply.

---


ESET Online Scanner

Connect any existing external hard drives and / or other removable media.

Note:
It is recommended to disable onboard antivirus program and antispyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your antivirus along with your antispyware programs.



If this program is already installed: Skip the installation and run only the scan!
  • Hold down Control and click on the following link to open ESET OnlineScan in a new window.
    ESET OnlineScan
  • Click the esetOnline.png button.
  • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
  • Click on esetSmartInstall.png to download the ESET Smart Installer. Save it to your desktop.
  • Double click on the esetSmartInstallDesktopIcon.png icon on your desktop.
  • Check esetAcceptTerms.png
  • Click the esetStart.png button.
  • Accept any security warnings from your browser.
  • Check esetScanArchives.png
  • Make sure that the option "Remove found threats" is Unchecked
  • Push the Start button.
  • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
  • When the scan completes, push esetListThreats.png
  • Push esetExport.png, and save the file to your desktop using a unique name, such as MyEsetScan. Alternatively, look for report in C:\Program Files\ESET\ESET Online Scanner\log.txt. Include the contents of this report in your next reply.
  • Push the Back button.
  • Select Uninstall application on close check box and push esetFinish.png

---


How the computer is running now?


---


Graduate of the WTT Classroom
Cheers,
Jo
If I have been helping you, and I have not replied to your latest post in 36 hours please send me a PM.


#13 cjmilam

cjmilam
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:12:32 AM

Posted 13 January 2015 - 06:13 PM

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 1/13/2015
Scan Time: 5:12:39 PM
Logfile: mbam milam.txt
Administrator: Yes

Version: 2.00.4.1028
Malware Database: v2015.01.13.17
Rootkit Database: v2015.01.07.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: User

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 330040
Time Elapsed: 14 min, 3 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Warn
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 0
(No malicious items detected)

Physical Sectors: 0
(No malicious items detected)


(end)


#14 cjmilam

cjmilam
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:12:32 AM

Posted 13 January 2015 - 06:15 PM

WHen trying to run Eset I get step two error 2002,  and the program will not go any further.

also when downloading I noticed the program page goes completely gray for the duration,  it does not look like a natural working webpage.



#15 Jo*

Jo*

  • Malware Response Team
  • 3,408 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Germany
  • Local time:07:32 AM

Posted 14 January 2015 - 03:47 AM

Please run the F-Secure Online Scanner
Follow the Instruction here for installation.
Accept the License Agreement.
Once the ActiveX installs, Click Full System Scan
Once the download completes, the scan will begin automatically. The scan will take some time to finish, so please be patient.
When the scan completes, click the Automatic cleaning (recommended) button.
Click the Show Report button and Copy&Paste the entire report in your next reply.

Graduate of the WTT Classroom
Cheers,
Jo
If I have been helping you, and I have not replied to your latest post in 36 hours please send me a PM.





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users