Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Hijacked browser, efix pop ups and ads by info.


  • This topic is locked This topic is locked
2 replies to this topic

#1 snowman123

snowman123

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:08:09 PM

Posted 06 February 2015 - 12:08 AM

Hi,

 

My Firefox has been hijacked. I get new windows and tabs opening by themselves sending me to efix.com and hotlinks (I think thats the right term?) pop up all over the place. I posted this in the "am I infected?" section here. They suggested I follow the prep guide and post logs here.

 

I started off with REVO, then ran most of the known good anti virus and malware programs, however the issue has persisted. That said it seems to be localised to Firefox, because I got Chrome the other day and its fine.

 

Thanks.

 

Note: cant seem to upload addition.txt, so I've pasted it at the bottom

 

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 05-02-2015
Ran by Nathan (administrator) on NATHAN-PC on 06-02-2015 17:35:11
Running from C:\Users\Nathan\Downloads
Loaded Profiles: Nathan (Available profiles: Nathan)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: English (United States)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgrsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgcsrva.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\WTabletServiceCon.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(brother Industries Ltd) C:\Windows\SysWOW64\brsvc01a.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(brother Industries Ltd) C:\Windows\SysWOW64\brss01a.exe
(SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCore64.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AI Suite II\AsRoutineController.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AI Suite II\DIGI+ VRM\PowerControlHelp.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AI Suite II\EPU\EPUHelp.exe
(Disc Soft Ltd) C:\Program Files (x86)\DAEMON Tools Pro\DTShellHlp.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AI Suite II\AI Suite II.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
() C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.5.202.7299\AdAwareTray.exe
(SUPERAntiSpyware) C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgui.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
() C:\Program Files (x86)\ASUS\AXSP\1.00.18\atkexComSvc.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AAHM\1.00.20\aaHMSvc.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.13\AsSysCtrlService.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AsusFanControlService\1.01.10\AsusFanControlService.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgidsagent.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgwdsvc.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgnsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgemca.exe
(Reprise Software Inc.) C:\Program Files (x86)\The Foundry\LicensingTools7.0\bin\RLM\rlm.foundry.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AI Suite II\Sensor\AlertHelper\AlertHelper.exe
(Reprise Software Inc.) C:\Program Files (x86)\The Foundry\LicensingTools7.0\bin\RLM\rlm.foundry.exe
(Side Effects Software Inc.) C:\Windows\System32\sesinetd.exe
(Side Effects Software Inc.) C:\Windows\System32\hserver.exe
() C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.5.202.7299\AdAwareService.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Sierra Wireless, Inc.) C:\Program Files (x86)\Sierra Wireless Inc\Common\SwiCardDetect64.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
(RealVNC Ltd) C:\Program Files\RealVNC\VNC Server\vncserver.exe
(RealVNC Ltd) C:\Program Files\RealVNC\VNC Server\vncserver.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(RealVNC Ltd) C:\Program Files\RealVNC\VNC Server\vncserver.exe
(Microsoft Corporation) C:\Windows\System32\taskmgr.exe
(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe
(Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\Pen_TabletUser.exe
(Wacom Technology) C:\Program Files\Tablet\Pen\WacomHost.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\Pen_TouchUser.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\Pen_Tablet.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\tv_w32.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\tv_x64.exe
(Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6548112 2012-06-12] (Realtek Semiconductor)
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1331288 2014-08-22] (Microsoft Corporation)
HKLM\...\Run: [] => [X]
HKLM\...\Run: [AdAwareTray] => C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.5.202.7299\AdAwareTray.exe [8947008 2014-12-18] ()
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.)
HKLM-x32\...\Run: [AVG_UI] => C:\Program Files (x86)\AVG\AVG2015\avgui.exe [3674576 2015-01-06] (AVG Technologies CZ, s.r.o.)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5227112 2015-02-01] (AVAST Software)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-2331779183-1848979938-1968265387-1000\...\Run: [AdobeBridge] => [X]
HKU\S-1-5-21-2331779183-1848979938-1968265387-1000\...\Run: [Spybot-S&D Cleaning] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDCleaner.exe [4566952 2014-06-24] (Safer-Networking Ltd.)
HKU\S-1-5-21-2331779183-1848979938-1968265387-1000\...\Run: [SUPERAntiSpyware] => C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [7780120 2015-01-23] (SUPERAntiSpyware)
HKU\S-1-5-21-2331779183-1848979938-1968265387-1000\...\MountPoints2: G - G:\dvdcheck.exe
HKU\S-1-5-21-2331779183-1848979938-1968265387-1000\...\MountPoints2: {121f21ad-ff0b-11e3-afa5-50465dabf687} - G:\setup.exe
HKU\S-1-5-21-2331779183-1848979938-1968265387-1000\...\MountPoints2: {91c830ea-91c3-11e2-9c24-50465dabf687} - E:\Startme.exe
HKU\S-1-5-21-2331779183-1848979938-1968265387-1000\...\MountPoints2: {9fdec553-8792-11e2-b4da-806e6f6e6963} - D:\Bin\ASSETUP.exe
AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [174856 2014-11-04] (NVIDIA Corporation)
AppInit_DLLs-x32: c:\windows\syswow64\nvinit.dll => c:\windows\syswow64\nvinit.dll [156840 2014-11-04] (NVIDIA Corporation)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKU\S-1-5-21-2331779183-1848979938-1968265387-1000\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Adobe PDF Conversion Toolbar Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: SmartSelect Class -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKU\S-1-5-21-2331779183-1848979938-1968265387-1000 -> No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} -  No File
Filter-x32: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.254 0.0.0.0

FireFox:
========
FF ProfilePath: C:\Users\Nathan\AppData\Roaming\Mozilla\Firefox\Profiles\4rb3alfo.default-1422256307346
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_235.dll ()
FF Plugin: @java.com/DTPlugin,version=10.45.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.45.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @wacom.com/wtPlugin,version=2.1.0.2 -> C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll (Wacom)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_235.dll ()
FF Plugin-x32: @Citrix.com/npican -> C:\Program Files (x86)\Citrix\ICA Client\npicaN.dll (Citrix Systems, Inc.)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 -> C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Acrobat -> C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll (Adobe Systems)
FF Plugin HKU\S-1-5-21-2331779183-1848979938-1968265387-1000: ubisoft.com/uplaypc -> C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll No File
FF Plugin HKU\S-1-5-21-2331779183-1848979938-1968265387-1000: wacom.com/WacomTabletPlugin -> C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll (Wacom)
FF Extension: rssiconjasnapakacom - C:\Users\Nathan\AppData\Roaming\Mozilla\Firefox\Profiles\4rb3alfo.default-1422256307346\Extensions\rssicon@jasnapaka.com [2015-01-28]
FF Extension: Bitdefender QuickScan - C:\Users\Nathan\AppData\Roaming\Mozilla\Firefox\Profiles\4rb3alfo.default-1422256307346\Extensions\{e001c731-5e37-4538-a5cb-8168736a2360} [2015-02-01]
FF Extension: Adblock Plus Pop-up Addon - C:\Users\Nathan\AppData\Roaming\Mozilla\Firefox\Profiles\4rb3alfo.default-1422256307346\Extensions\adblockpopups@jessehakanen.net.xpi [2015-02-06]
FF Extension: Adblock Plus - C:\Users\Nathan\AppData\Roaming\Mozilla\Firefox\Profiles\4rb3alfo.default-1422256307346\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2015-02-06]
FF HKLM-x32\...\Firefox\Extensions: [web2pdfextension@web2pdf.adobedotcom] - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn
FF Extension: Adobe Acrobat - Create PDF - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn [2013-05-10]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2015-02-01]

Chrome:
=======
CHR Profile: C:\Users\Nathan\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Slides) - C:\Users\Nathan\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-02-06]
CHR Extension: (Google Docs) - C:\Users\Nathan\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-08-16]
CHR Extension: (Google Drive) - C:\Users\Nathan\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-08-16]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Nathan\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2015-02-06]
CHR Extension: (YouTube) - C:\Users\Nathan\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-08-16]
CHR Extension: (Google Search) - C:\Users\Nathan\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-08-16]
CHR Extension: (Google Sheets) - C:\Users\Nathan\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-02-06]
CHR Extension: (Avast Online Security) - C:\Users\Nathan\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2015-02-06]
CHR Extension: (Reddit Enhancement Suite) - C:\Users\Nathan\AppData\Local\Google\Chrome\User Data\Default\Extensions\kbmfpngjjgdllneeigpgjifpgocmfgmb [2015-02-06]
CHR Extension: (Google Wallet) - C:\Users\Nathan\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-31]
CHR Extension: (Gmail) - C:\Users\Nathan\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-08-16]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-02-01]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [172344 2014-07-23] (SUPERAntiSpyware.com)
R2 asComSvc; C:\Program Files (x86)\ASUS\AXSP\1.00.18\atkexComSvc.exe [918448 2013-03-09] () [File not signed]
R2 asHmComSvc; C:\Program Files (x86)\ASUS\AAHM\1.00.20\aaHMSvc.exe [951936 2012-06-01] (ASUSTeK Computer Inc.)
R2 AsSysCtrlService; C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.13\AsSysCtrlService.exe [149120 2012-02-17] (ASUSTeK Computer Inc.)
R2 AsusFanControlService; C:\Program Files (x86)\ASUS\AsusFanControlService\1.01.10\AsusFanControlService.exe [1475744 2012-05-25] (ASUSTeK Computer Inc.)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2015-02-01] (AVAST Software)
R2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2015\avgidsagent.exe [3440080 2015-01-06] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files (x86)\AVG\AVG2015\avgwdsvc.exe [309232 2015-01-06] (AVG Technologies CZ, s.r.o.)
R2 Brother XP spl Service; C:\Windows\SysWOW64\brsvc01a.exe [57344 2004-06-14] (brother Industries Ltd) [File not signed]
S2 Foundry FLEXlm Server; C:\Program Files (x86)\The Foundry\\LicensingTools7.0\bin\FLEXlm\lmgrd.foundry.exe [1392016 2012-10-30] (Acresso Software Inc.)
R2 Foundry License Server; C:\Program Files (x86)\The Foundry\\LicensingTools7.0\bin\RLM\rlm.foundry.exe [1474560 2014-12-03] (Reprise Software Inc.) [File not signed]
R2 HoudiniLicenseServer; C:\Windows\system32\sesinetd.exe [2937344 2014-11-01] (Side Effects Software Inc.) [File not signed]
R2 HoudiniServer; C:\Windows\system32\hserver.exe [2910208 2014-11-01] (Side Effects Software Inc.) [File not signed]
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed]
R2 LavasoftAdAwareService11; C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.5.202.7299\AdAwareService.exe [713568 2014-12-18] ()
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23784 2014-08-22] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [368624 2014-08-22] (Microsoft Corporation)
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)
S4 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)
R2 SwiCardDetectSvc; C:\Program Files (x86)\Sierra Wireless Inc\Common\SwiCardDetect64.exe [307568 2010-09-22] (Sierra Wireless, Inc.)
S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]
R2 vncserver; C:\Program Files\RealVNC\VNC Server\vncserver.exe [4774208 2013-03-04] (RealVNC Ltd)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
R2 WTabletServiceCon; C:\Program Files\Tablet\Pen\WTabletServiceCon.exe [619904 2012-12-11] (Wacom Technology, Corp.)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13440 2010-08-24] ()
R1 AsUpIO; C:\Windows\SysWow64\drivers\AsUpIO.sys [14464 2010-08-03] ()
R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2015-02-01] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [87912 2015-02-01] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2015-02-01] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2015-02-01] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1050432 2015-02-01] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [436624 2015-02-01] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [116728 2015-02-01] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [267632 2015-02-01] ()
R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [153368 2014-06-18] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [260888 2014-12-08] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [203544 2014-11-18] (AVG Technologies CZ, s.r.o.)
R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [243480 2014-08-28] (AVG Technologies CZ, s.r.o.)
R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [313624 2014-07-18] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [124184 2014-10-05] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [31512 2014-06-18] (AVG Technologies CZ, s.r.o.)
R1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [274200 2014-10-10] (AVG Technologies CZ, s.r.o.)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2014-07-19] (Disc Soft Ltd)
R3 gzflt; C:\Program Files\Lavasoft\Ad-Aware Antivirus\Antimalware Engine\3.0.0.56\gzflt.sys [150256 2014-10-09] (BitDefender LLC)
R3 ISCT; C:\Windows\System32\DRIVERS\ISCTD64.sys [46568 2013-01-19] ()
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-02-06] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [269008 2014-07-17] (Microsoft Corporation)
R1 networx; C:\Windows\System32\drivers\networx.sys [41976 2013-07-20] (NetFilterSDK.com)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [125584 2014-07-17] (Microsoft Corporation)
S3 PCTINDIS5X64; C:\Windows\system32\PCTINDIS5X64.SYS [43032 2011-04-26] (Smith Micro Inc.)
S3 RTCore64; C:\Program Files (x86)\MSI Afterburner\RTCore64.sys [13368 2013-01-23] ()
R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-23] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-13] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
S3 Trufos; C:\Windows\System32\DRIVERS\Trufos.sys [389240 2014-10-09] (BitDefender S.R.L.)
S3 usbrndis6; C:\Windows\System32\DRIVERS\usb80236.sys [19968 2013-02-12] (Microsoft Corporation)
S3 vhidmini; C:\Windows\System32\DRIVERS\vjoy.sys [15104 2012-10-15] (Headsoft)
S4 NVHDA; system32\drivers\nvhda64v.sys [X]
S3 WinRing0_1_2_0; \??\C:\Users\Nathan\Downloads\RealTemp_370\WinRing0x64.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-06 17:35 - 2015-02-06 17:35 - 00028146 _____ () C:\Users\Nathan\Downloads\FRST.txt
2015-02-06 17:33 - 2015-02-06 17:35 - 00000000 ____D () C:\FRST
2015-02-06 17:32 - 2015-02-06 17:32 - 02131968 _____ (Farbar) C:\Users\Nathan\Downloads\FRST64.exe
2015-02-06 07:07 - 2015-02-06 07:07 - 00880208 _____ (Google Inc.) C:\Users\Nathan\Downloads\ChromeSetup.exe
2015-02-01 20:16 - 2015-02-01 20:16 - 00000000 ____D () C:\Users\Nathan\AppData\Roaming\Dropbox
2015-02-01 20:09 - 2015-02-05 20:00 - 00000000 ____D () C:\Users\Nathan\AppData\Roaming\Luxology
2015-02-01 20:09 - 2015-02-01 20:09 - 00000000 ____D () C:\Users\Nathan\AppData\Roaming\Kits
2015-02-01 20:05 - 2015-02-01 20:05 - 01189893 _____ () C:\Users\Nathan\Documents\ContainerShip.ma
2015-02-01 20:05 - 2015-02-01 20:05 - 00001964 _____ () C:\Users\Public\Desktop\Avast Free Antivirus.lnk
2015-02-01 20:05 - 2015-02-01 20:05 - 00000000 ____D () C:\Users\Nathan\AppData\Roaming\AVAST Software
2015-02-01 20:05 - 2015-02-01 20:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVAST Software
2015-02-01 20:03 - 2015-02-06 06:56 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2015-02-01 20:03 - 2015-02-01 20:04 - 01050432 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys
2015-02-01 20:03 - 2015-02-01 20:04 - 00087912 _____ (AVAST Software) C:\Windows\system32\Drivers\aswmonflt.sys
2015-02-01 20:03 - 2015-02-01 20:03 - 00436624 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2015-02-01 20:03 - 2015-02-01 20:03 - 00364512 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2015-02-01 20:03 - 2015-02-01 20:03 - 00267632 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2015-02-01 20:03 - 2015-02-01 20:03 - 00116728 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys
2015-02-01 20:03 - 2015-02-01 20:03 - 00093568 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2015-02-01 20:03 - 2015-02-01 20:03 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2015-02-01 20:03 - 2015-02-01 20:03 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2015-02-01 20:03 - 2015-02-01 20:03 - 00029208 _____ () C:\Windows\system32\Drivers\aswHwid.sys
2015-02-01 20:02 - 2015-02-01 20:02 - 00001081 _____ () C:\Users\Public\Desktop\MODO 801_SP3.lnk
2015-02-01 20:02 - 2015-02-01 20:02 - 00000000 ____D () C:\Users\Nathan\AppData\Local\Luxology
2015-02-01 20:02 - 2015-02-01 20:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Luxology
2015-02-01 20:00 - 2015-02-01 20:00 - 00000000 ____D () C:\Program Files\AVAST Software
2015-02-01 19:58 - 2015-02-01 19:59 - 02194432 _____ () C:\Users\Nathan\Downloads\AdwCleaner(1).exe
2015-02-01 19:57 - 2015-02-01 20:00 - 00000000 ____D () C:\ProgramData\AVAST Software
2015-02-01 19:57 - 2015-02-01 19:57 - 00000000 ____D () C:\Program Files\Luxology
2015-02-01 19:56 - 2015-02-01 19:56 - 00000000 ____D () C:\Users\Nathan\Downloads\MODO_801_SP3_win
2015-02-01 19:56 - 2015-02-01 19:56 - 00000000 ____D () C:\Users\Nathan\AppData\Roaming\AVG2015
2015-02-01 19:55 - 2015-02-01 19:56 - 05006864 _____ (AVAST Software) C:\Users\Nathan\Downloads\avast_free_antivirus_setup_online.exe
2015-02-01 19:54 - 2015-02-01 19:54 - 00000965 _____ () C:\Users\Public\Desktop\AVG 2015.lnk
2015-02-01 19:54 - 2015-02-01 19:54 - 00000000 ____D () C:\Users\Nathan\AppData\Roaming\TuneUp Software
2015-02-01 19:54 - 2015-02-01 19:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG
2015-02-01 19:53 - 2015-02-01 19:55 - 00000000 ____D () C:\ProgramData\AVG2015
2015-02-01 19:53 - 2015-02-01 19:53 - 00000000 ___HD () C:\$AVG
2015-02-01 19:53 - 2015-02-01 19:53 - 00000000 ____D () C:\Program Files (x86)\AVG
2015-02-01 19:50 - 2015-02-06 09:29 - 00000000 ____D () C:\ProgramData\MFAData
2015-02-01 19:50 - 2015-02-01 20:03 - 00000000 ____D () C:\Users\Nathan\AppData\Local\Avg2015
2015-02-01 19:50 - 2015-02-01 19:50 - 00000000 ____D () C:\Users\Nathan\AppData\Local\MFAData
2015-02-01 19:47 - 2015-02-01 19:47 - 03044736 _____ (Enigma Software Group USA, LLC.) C:\Users\Nathan\Downloads\SpyHunter-Installer(1).exe
2015-02-01 18:42 - 2015-02-01 19:09 - 296461257 _____ () C:\Users\Nathan\Downloads\MODO_801_SP3_win.zip
2015-02-01 18:08 - 2015-02-01 18:08 - 00000000 ____D () C:\SUPERDelete
2015-02-01 18:06 - 2015-02-01 18:06 - 00218112 _____ (Soeperman Enterprises Ltd.) C:\Users\Nathan\Downloads\HijackThis.exe
2015-02-01 17:52 - 2015-02-01 17:52 - 00000000 ____D () C:\Users\Nathan\AppData\Roaming\QuickScan
2015-02-01 17:50 - 2015-02-01 17:50 - 04637504 _____ (AVG Technologies) C:\Users\Nathan\Downloads\avg_free_stb_all_2015_5557_cnet.exe
2015-02-01 17:46 - 2015-02-01 17:48 - 00000000 ____D () C:\Program Files (x86)\SpywareBlaster
2015-02-01 17:46 - 2015-02-01 17:46 - 04095448 _____ (BrightFort LLC ) C:\Users\Nathan\Downloads\spywareblastersetup50.exe
2015-02-01 17:46 - 2015-02-01 17:46 - 00001083 _____ () C:\Users\Public\Desktop\SpywareBlaster.lnk
2015-02-01 17:46 - 2015-02-01 17:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SpywareBlaster
2015-02-01 17:46 - 2015-02-01 17:46 - 00000000 ____D () C:\ProgramData\Licenses
2015-02-01 17:46 - 2009-03-24 12:52 - 00129872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSSTDFMT.DLL
2015-02-01 17:37 - 2015-02-06 09:37 - 00000512 _____ () C:\Windows\Tasks\SUPERAntiSpyware Scheduled Task d6a8530a-40c0-4018-8a3a-e0567125b7a5.job
2015-02-01 17:37 - 2015-02-02 10:54 - 00000512 _____ () C:\Windows\Tasks\SUPERAntiSpyware Scheduled Task 3cef288e-bd8e-41e4-8d51-9c4deca67e8b.job
2015-02-01 17:37 - 2015-02-01 17:37 - 00003590 _____ () C:\Windows\System32\Tasks\SUPERAntiSpyware Scheduled Task 3cef288e-bd8e-41e4-8d51-9c4deca67e8b
2015-02-01 17:37 - 2015-02-01 17:37 - 00003516 _____ () C:\Windows\System32\Tasks\SUPERAntiSpyware Scheduled Task d6a8530a-40c0-4018-8a3a-e0567125b7a5
2015-02-01 17:37 - 2015-02-01 17:37 - 00000000 ____D () C:\Users\Nathan\AppData\Roaming\SUPERAntiSpyware.com
2015-02-01 17:34 - 2015-02-06 15:10 - 00000000 ____D () C:\Program Files\SUPERAntiSpyware
2015-02-01 17:34 - 2015-02-01 17:37 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware
2015-02-01 17:34 - 2015-02-01 17:34 - 00001808 _____ () C:\Users\Public\Desktop\SUPERAntiSpyware Professional.lnk
2015-02-01 17:34 - 2015-02-01 17:34 - 00000000 ____D () C:\ProgramData\SUPERAntiSpyware.com
2015-02-01 17:33 - 2015-02-01 17:33 - 21204096 _____ (SUPERAntiSpyware) C:\Users\Nathan\Downloads\SUPERAntiSpyware.exe
2015-02-01 08:59 - 2015-02-01 08:59 - 00000000 _____ () C:\autoexec.bat
2015-02-01 08:58 - 2015-02-01 08:58 - 03044736 _____ (Enigma Software Group USA, LLC.) C:\Users\Nathan\Downloads\SpyHunter-Installer.exe
2015-01-29 20:30 - 2015-01-29 20:30 - 00043664 _____ () C:\Windows\system32\Drivers\hitmanpro37.sys
2015-01-29 19:18 - 2015-01-29 20:24 - 00006462 _____ () C:\Windows\system32\.crusader
2015-01-28 21:38 - 2015-01-28 21:38 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-01-28 21:31 - 2015-01-28 21:31 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HitmanPro
2015-01-28 21:30 - 2015-01-29 19:18 - 00000000 ____D () C:\ProgramData\HitmanPro
2015-01-28 21:30 - 2015-01-28 21:31 - 00000000 ____D () C:\Program Files\HitmanPro
2015-01-28 21:29 - 2015-01-28 21:29 - 11225840 _____ (SurfRight B.V.) C:\Users\Nathan\Downloads\HitmanPro_x64.exe
2015-01-26 20:29 - 2015-01-26 20:29 - 02194432 _____ () C:\Users\Nathan\Downloads\adwcleaner_4.109.exe
2015-01-26 20:13 - 2015-01-26 20:13 - 00753184 _____ () C:\Users\Nathan\Downloads\Adware-Removal-Tool-v3.9.1.exe
2015-01-26 20:13 - 2015-01-26 20:13 - 00290304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\subinacl.exe
2015-01-26 20:13 - 2015-01-26 20:13 - 00000000 ____D () C:\Program Files\Adware-Removal-Tool
2015-01-26 08:07 - 2015-01-26 08:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2015-01-26 08:06 - 2015-01-26 08:06 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2015-01-26 08:06 - 2015-01-26 08:06 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2015-01-24 16:30 - 2015-01-26 20:11 - 00000000 ____D () C:\Users\Nathan\Desktop\Old Firefox Data
2015-01-24 15:37 - 2015-01-24 15:38 - 00000000 ____D () C:\Users\Nathan\Desktop\documents-export-2015-01-23
2015-01-24 15:36 - 2015-01-24 15:36 - 05609201 _____ () C:\Users\Nathan\Desktop\documents-export-2015-01-23.zip
2015-01-23 22:40 - 2015-02-06 15:13 - 00002321 _____ () C:\Users\Public\Desktop\Ad-Aware Antivirus.lnk
2015-01-23 22:40 - 2015-01-23 22:40 - 00000000 ____D () C:\Users\Nathan\AppData\Roaming\Lavasoft
2015-01-23 22:40 - 2015-01-23 22:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lavasoft
2015-01-23 22:38 - 2015-01-23 22:38 - 00000000 ____D () C:\Program Files\Lavasoft
2015-01-23 22:35 - 2015-01-23 22:35 - 01924232 _____ () C:\Users\Nathan\Downloads\Adaware_Installer.exe
2015-01-23 22:35 - 2015-01-23 22:35 - 00000000 ____D () C:\ProgramData\Lavasoft
2015-01-23 07:14 - 2015-01-23 07:14 - 00001106 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2015-01-22 22:06 - 2015-01-23 06:52 - 00000258 __RSH () C:\ProgramData\ntuser.pol
2015-01-22 22:01 - 2015-02-01 20:03 - 00000000 ____D () C:\Program Files (x86)\4a72ec18-1f09-4664-9169-a2a1468323dc
2015-01-22 22:01 - 2015-01-22 22:01 - 00000000 ____D () C:\Users\Public\Documents\ShopperPro
2015-01-22 22:00 - 2015-02-02 06:40 - 00000000 ____D () C:\Program Files (x86)\e5e0e76a-cc95-49c2-8bd7-d7c0e5f52a0d
2015-01-22 21:51 - 2015-02-06 15:41 - 00001338 _____ () C:\Windows\Tasks\JSAH.job
2015-01-22 21:51 - 2015-01-22 21:51 - 00004368 _____ () C:\Windows\System32\Tasks\JSAH
2015-01-22 21:50 - 2015-02-06 15:38 - 00001690 _____ () C:\Windows\Tasks\POAKKAVK.job
2015-01-22 21:50 - 2015-02-01 20:03 - 00000000 ____D () C:\Program Files (x86)\9c5fdb0c-8735-46ce-b500-815a0ee0185b
2015-01-22 21:50 - 2015-01-22 21:50 - 00004720 _____ () C:\Windows\System32\Tasks\POAKKAVK
2015-01-17 15:48 - 2015-01-17 15:48 - 00000000 ____D () C:\Windows\8A809006C25A4A3A9DAB94659BCDB107.TMP
2015-01-16 06:45 - 2014-12-19 16:06 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2015-01-16 06:45 - 2014-12-19 14:46 - 00141312 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2015-01-16 06:45 - 2014-12-12 18:35 - 05553592 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-01-16 06:45 - 2014-12-12 18:31 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-01-16 06:45 - 2014-12-12 18:31 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-01-16 06:45 - 2014-12-12 18:31 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-01-16 06:45 - 2014-12-12 18:11 - 03971512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-01-16 06:45 - 2014-12-12 18:11 - 03916728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-01-16 06:45 - 2014-12-12 18:07 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-01-16 06:45 - 2014-12-12 06:47 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2015-01-16 06:45 - 2014-12-06 17:17 - 00303616 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll
2015-01-16 06:45 - 2014-12-06 16:50 - 00156672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncsi.dll
2015-01-16 06:45 - 2014-12-06 16:50 - 00052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll
2015-01-13 15:11 - 2015-01-16 22:06 - 04578960 _____ () C:\Users\Nathan\Desktop\TechnicLauncher.exe
2015-01-13 07:44 - 2015-01-17 18:50 - 00000000 ____D () C:\Users\Nathan\Desktop\New folder
2015-01-12 15:58 - 2015-01-12 16:16 - 00000000 ____D () C:\Users\Nathan\Desktop\DickPics
2015-01-12 15:58 - 2015-01-12 16:08 - 00000000 ____D () C:\Users\Nathan\Desktop\Camera

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-06 17:13 - 2013-03-08 15:08 - 00000898 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-02-06 16:36 - 2013-03-08 14:56 - 01085575 _____ () C:\Windows\WindowsUpdate.log
2015-02-06 15:20 - 2009-07-14 17:45 - 00029136 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-02-06 15:20 - 2009-07-14 17:45 - 00029136 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-02-06 15:15 - 2014-11-14 10:21 - 00000000 ____D () C:\Program Files (x86)\Steam
2015-02-06 15:12 - 2013-05-08 10:30 - 00000000 ____D () C:\temp
2015-02-06 15:11 - 2013-07-29 15:41 - 00000000 ____D () C:\ProgramData\Reprise
2015-02-06 15:10 - 2013-03-08 15:08 - 00000894 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-02-06 15:09 - 2014-12-20 18:50 - 00268024 _____ () C:\Windows\PFRO.log
2015-02-06 15:09 - 2014-12-20 18:50 - 00006085 _____ () C:\Windows\setupact.log
2015-02-06 15:09 - 2013-03-28 11:02 - 00000202 _____ () C:\Windows\Tasks\AutoKMS.job
2015-02-06 15:09 - 2013-03-08 15:28 - 00000000 ____D () C:\ProgramData\NVIDIA
2015-02-06 15:09 - 2009-07-14 18:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-02-06 15:08 - 2014-11-19 08:42 - 00000000 ____D () C:\AdwCleaner
2015-02-06 15:05 - 2014-11-18 14:05 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-02-06 15:00 - 2014-12-19 16:07 - 00004150 _____ () C:\Users\Nathan\Desktop\button.bmp
2015-02-06 15:00 - 2014-11-19 08:36 - 00000669 _____ () C:\Users\Nathan\Desktop\settings.ini
2015-02-06 14:45 - 2014-11-17 14:27 - 00000000 ____D () C:\Users\Nathan\AppData\Roaming\Spotify
2015-02-06 14:40 - 2014-11-17 14:27 - 00000000 ____D () C:\Users\Nathan\AppData\Local\Spotify
2015-02-06 07:08 - 2013-03-08 15:08 - 00003894 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-02-06 07:08 - 2013-03-08 15:08 - 00003642 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-02-06 07:05 - 2013-03-14 14:42 - 00000000 ____D () C:\Users\Nathan\AppData\Local\Adobe
2015-02-02 00:43 - 2013-03-14 16:26 - 00000000 ____D () C:\Users\Nathan\Downloads\Adobe CS6 Products Activator [MART!K]
2015-02-01 21:33 - 2009-07-14 16:20 - 00000000 ____D () C:\Program Files\Common Files\System
2015-02-01 20:03 - 2014-08-28 21:50 - 00000000 ____D () C:\Program Files (x86)\Abbequerque Inc
2015-02-01 20:03 - 2013-03-14 17:40 - 00000000 ____D () C:\Program Files (x86)\Adobe
2015-02-01 18:32 - 2014-10-28 21:19 - 00000000 ____D () C:\ProgramData\Samsung
2015-02-01 18:25 - 2013-03-08 15:10 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2015-02-01 18:17 - 2013-03-22 19:45 - 00007628 _____ () C:\Users\Nathan\AppData\Local\resmon.resmoncfg
2015-02-01 18:13 - 2013-10-01 22:05 - 00000000 ____D () C:\Program Files (x86)\Image-Line
2015-02-01 18:12 - 2013-10-01 22:07 - 00000000 ____D () C:\Users\Nathan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Image-Line
2015-02-01 18:11 - 2013-10-01 22:08 - 00000000 ____D () C:\Program Files (x86)\VstPlugins
2015-02-01 18:10 - 2013-03-14 16:23 - 00000000 ____D () C:\Users\Nathan\Downloads\Adobe.CS6.crack.by.LaeN0R
2015-02-01 17:55 - 2013-04-09 18:42 - 00000000 ____D () C:\ProgramData\TEMP
2015-01-29 19:20 - 2013-09-25 22:17 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-01-26 20:31 - 2014-12-19 07:50 - 00001053 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2015-01-26 20:31 - 2013-09-25 22:17 - 00001065 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-01-26 20:31 - 2013-03-08 15:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-01-26 20:17 - 2013-03-08 14:56 - 00001417 _____ () C:\Users\Nathan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-01-24 06:48 - 2013-03-28 11:02 - 00000202 _____ () C:\Windows\Tasks\AutoKMSDaily.job
2015-01-23 18:08 - 2013-08-12 12:30 - 00000000 ____D () C:\Users\Nathan\AppData\Local\CRE
2015-01-23 07:14 - 2014-11-18 14:04 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-01-23 07:14 - 2014-11-18 14:04 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2015-01-23 06:58 - 2013-08-16 19:39 - 00000000 ____D () C:\Users\Nathan\AppData\Roaming\transmission
2015-01-23 06:53 - 2009-07-14 15:34 - 00000580 _____ () C:\Windows\win.ini
2015-01-23 06:42 - 2013-10-17 08:12 - 00000110 _____ () C:\Windows\wininit.ini
2015-01-22 22:06 - 2009-07-14 16:20 - 00000000 ___HD () C:\Windows\system32\GroupPolicy
2015-01-22 22:06 - 2009-07-14 16:20 - 00000000 ____D () C:\Windows\SysWOW64\GroupPolicy
2015-01-22 21:35 - 2014-07-19 19:23 - 00000000 ____D () C:\Users\Nathan\AppData\Roaming\DAEMON Tools Pro
2015-01-17 22:15 - 2013-04-11 17:15 - 00000000 ____D () C:\ProgramData\Package Cache
2015-01-17 21:57 - 2013-03-13 15:17 - 00000000 ____D () C:\Users\Nathan\AppData\Roaming\vlc
2015-01-17 19:57 - 2009-07-14 18:13 - 00782510 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-01-17 15:48 - 2014-12-29 14:07 - 00018895 _____ () C:\Windows\DirectX.log
2015-01-16 22:06 - 2014-01-05 14:50 - 00000000 ____D () C:\Users\Nathan\AppData\Roaming\.technic
2015-01-16 21:36 - 2014-11-24 17:15 - 00007891 _____ () C:\Windows\BRRBCOM.INI
2015-01-16 06:53 - 2013-07-27 23:47 - 00000000 ____D () C:\Windows\system32\MRT
2015-01-16 06:47 - 2013-03-08 15:37 - 113365784 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-01-13 13:54 - 2013-03-13 15:17 - 00000000 ____D () C:\Users\Nathan\AppData\Roaming\Winamp

==================== Files in the root of some directories =======

2013-06-15 22:06 - 2013-06-15 22:06 - 0000288 _____ () C:\Users\Nathan\AppData\Roaming\.backup.dm
2013-07-30 22:15 - 2014-11-17 08:13 - 0000132 _____ () C:\Users\Nathan\AppData\Roaming\Adobe OpenEXR Format CS6 Prefs
2013-04-02 17:16 - 2014-10-06 20:07 - 0000132 _____ () C:\Users\Nathan\AppData\Roaming\Adobe PNG Format CS6 Prefs
2014-02-22 11:56 - 2014-09-07 11:39 - 0000132 _____ () C:\Users\Nathan\AppData\Roaming\Adobe Targa Format CS6 Prefs
2013-08-22 16:11 - 2013-08-22 23:19 - 0000093 _____ () C:\Users\Nathan\AppData\Roaming\ARCompanion.log
2014-10-13 21:37 - 2014-10-30 21:39 - 0000642 _____ () C:\Users\Nathan\AppData\Roaming\Contact Sheet II.xml
2014-10-13 21:37 - 2014-10-30 21:40 - 0014208 _____ () C:\Users\Nathan\AppData\Roaming\ContactSheetII.log
2014-09-01 21:18 - 2014-09-01 21:18 - 0002086 _____ () C:\Users\Nathan\AppData\Roaming\JSAH
2014-09-01 21:18 - 2014-09-01 21:18 - 0001248 _____ () C:\Users\Nathan\AppData\Roaming\POAKKAVK
2013-05-10 11:07 - 2014-07-19 16:43 - 0000600 _____ () C:\Users\Nathan\AppData\Roaming\winscp.rnd
2013-03-22 18:02 - 2013-03-25 10:02 - 0001456 _____ () C:\Users\Nathan\AppData\Local\Adobe Save for Web 13.0 Prefs
2013-05-10 11:02 - 2013-10-09 23:14 - 0000600 _____ () C:\Users\Nathan\AppData\Local\PUTTY.RND
2013-03-22 19:45 - 2015-02-01 18:17 - 0007628 _____ () C:\Users\Nathan\AppData\Local\resmon.resmoncfg

Some content of TEMP:
====================
C:\Users\Nathan\AppData\Local\Temp\Quarantine.exe
C:\Users\Nathan\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-02-06 08:11

==================== End Of Log ============================

 

 

 

 

 

Addition.txt

 

 

 

 

 

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 05-02-2015
Ran by Nathan at 2015-02-06 17:35:57
Running from C:\Users\Nathan\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Microsoft Security Essentials (Enabled - Up to date) {4F35CFC4-45A3-FC37-EF17-759A02E39AB1}
AV: Ad-Aware Antivirus (Enabled - Up to date) {D87B6541-12A1-DAEA-0033-9B8057AAB996}
AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AV: AVG AntiVirus Free Edition 2015 (Enabled - Up to date) {4D41356F-32AD-7C42-C820-63775EE4F413}
AS: Microsoft Security Essentials (Enabled - Up to date) {F4542E20-6399-F3B9-D5A7-4EE87964D00C}
AS: Ad-Aware Antivirus (Enabled - Up to date) {631A84A5-349B-D564-3A83-A0F22C2DF32B}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Out of date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
AS: AVG AntiVirus Free Edition 2015 (Enabled - Up to date) {F620D48B-1497-73CC-F290-58052563BEAE}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
FW: Ad-Aware Firewall (Disabled) {E040E464-58CE-DBB2-2B6C-32B5A979FEED}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)


7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Ad-Aware Antivirus (HKLM\...\{A5C0392D-46A7-4CB3-800B-5794909453BD}_AdAwareUpdater) (Version: 11.5.202.7299 - Lavasoft)
AdAwareInstaller (Version: 11.5.202.7299 - Lavasoft) Hidden
AdAwareUpdater (Version: 11.5.202.7299 - Lavasoft) Hidden
Adobe Acrobat X Pro - English, Français, Deutsch (HKLM-x32\...\{AC76BA86-1033-F400-7760-000000000005}) (Version: 10.1.7 - Adobe Systems)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 3.1.0.4880 - Adobe Systems Incorporated)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.235 - Adobe Systems Incorporated)
Adobe Help Manager (HKLM-x32\...\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 4.0.244 - Adobe Systems Incorporated)
Adobe Photoshop Lightroom 3.6 64-bit (HKLM\...\{D4F66BBA-D79E-4F11-9B06-70C3D75A2958}) (Version: 3.6.1 - Adobe)
AI Suite II (HKLM-x32\...\{34D3688E-A737-44C5-9E2A-FF73618728E1}) (Version: 2.00.01 - ASUSTeK Computer Inc.)
Antichamber (HKLM-x32\...\Steam App 219890) (Version:  - Alexander Bruce)
AntimalwareEngine (Version: 3.0.0.56 - Lavasoft) Hidden
Apple Application Support (HKLM-x32\...\{5D09C772-ECB3-442B-9CC6-B4341C78FDC2}) (Version: 2.3.4 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{2F72F540-1F60-4266-9506-952B21D6640D}) (Version: 6.1.0.13 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
ASIO4ALL (HKLM-x32\...\ASIO4ALL) (Version: 2.10 - Michael Tippach)
Autodesk Backburner 2013.0.0 (HKLM-x32\...\{3D347E6D-5A03-4342-B5BA-6A771885F379}) (Version: 2013.0.0 - Autodesk, Inc.)
Autodesk DirectConnect 2013 64-bit (HKLM\...\Autodesk DirectConnect 2013 64-bit) (Version: 7.0.28.0 - Autodesk)
Autodesk DirectConnect 2013 64-bit (Version: 7.0.28.0 - Autodesk) Hidden
Autodesk FBX Plug-in 2013.1 - Maya 2013 64-bit (HKLM\...\Autodesk FBX Plug-in 2013.1 - Maya 2013 64-bit) (Version:  - Autodesk)
Autodesk MatchMover 2013 64-bit (HKLM\...\{5B77A046-DAD6-4F19-A8B9-4E5B3EAD2C24}) (Version: 14.00.0000 - Autodesk)
Autodesk Maya 2013 64-bit (HKLM\...\Autodesk Maya 2013 64-bit) (Version: 15.0.0.0 - Autodesk)
Autodesk Maya 2013 64-bit (Version: 15.0.0.0 - Autodesk) Hidden
Avast Free Antivirus (HKLM-x32\...\Avast) (Version: 10.0.2208 - AVAST Software)
AVG 2015 (HKLM\...\AVG) (Version: 2015.0.5646 - AVG Technologies)
AVG 2015 (Version: 15.0.4281 - AVG Technologies) Hidden
AVG 2015 (Version: 15.0.5646 - AVG Technologies) Hidden
bl (x32 Version: 1.0.0 - Your Company Name) Hidden
Blackmagic Fusion (HKLM\...\{44A1D808-679A-4F32-B11C-A0B765B8FFB7}) (Version: 7.50.1477 - Blackmagic Design)
Blender (HKLM\...\Blender) (Version: 2.66a - Blender Foundation)
BOINC (HKLM\...\{CFA4E1F2-090A-4335-A60B-98D8EC69E841}) (Version: 7.4.27 - Space Sciences Laboratory, U.C. Berkeley)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Borderlands 2 (HKLM-x32\...\Steam App 49520) (Version:  - Gearbox Software)
CCleaner (HKLM\...\CCleaner) (Version: 3.28 - Piriform)
Chunky (HKLM\...\Chunky) (Version:  - )
Citrix Receiver (HKLM-x32\...\CitrixOnlinePluginPackWeb) (Version: 14.0.1.4 - Citrix Systems, Inc.)
Composite 2013 64-bit (HKLM\...\{2F808931-D235-4FC7-90CD-F8A890C97B2F}) (Version: 8.0.0 - Autodesk)
Crysis® (HKLM-x32\...\{000E79B7-E725-4F01-870A-C12942B7F8E4}) (Version: 1.00.0000 - Electronic Arts)
DAEMON Tools Pro (HKLM-x32\...\DAEMON Tools Pro) (Version: 5.5.0.0388 - Disc Soft Ltd)
DaVinci Resolve (HKLM\...\{F095138E-9690-4B73-8E3F-CF26E7B3895B}) (Version: 10.1.5013 - Blackmagic Design)
DCS A-10C (HKLM\...\DCS A-10C_is1) (Version: 1.1.0.5 - )
DCS World (HKLM\...\DCS World_is1) (Version: 1.2.10.30996 - Eagle Dynamics)
DVD Shrink 3.2 (HKLM-x32\...\DVD Shrink_is1) (Version:  - DVD Shrink)
EZdok Camera for Microsoft Flight Simulator X (HKLM-x32\...\EZdok Camera for Microsoft Flight Simulator X) (Version:  - )
f.lux (HKU\S-1-5-21-2331779183-1848979938-1968265387-1000\...\Flux) (Version:  - )
FLT 7.0v2 (HKLM-x32\...\FLT 7.0v2_is1) (Version:  - The Foundry)
Foxit Reader (HKLM-x32\...\Foxit Reader_is1) (Version: 5.4.5.124 - Foxit Corporation)
Fraps (HKLM-x32\...\Fraps) (Version:  - )
Furnace 4.2v5 (64 bit) for Nuke (HKLM\...\Furnace for Nuke_is1) (Version:  - The Foundry)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 40.0.2214.111 - Google Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.26.9 - Google Inc.) Hidden
HandBrake 0.9.8 (HKLM-x32\...\HandBrake) (Version: 0.9.8 - )
HitmanPro 3.7 (HKLM\...\HitmanPro37) (Version: 3.7.9.234 - SurfRight B.V.)
Houdini 13.0.582 (HKLM\...\Houdini 13.0.582) (Version: 13.0.582 - Side Effects Software)
Intel® IPP Run-Time Installer 5.3 Update 4 for Windows* on IA-32 (HKLM-x32\...\{754854DC-2E0A-49D8-A1A1-426C1F9B1459}) (Version: 5.3.4.087 - Intel Corporation)
Intel® Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.17.10.2932 - Intel Corporation)
Intel® Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.1.0.1006 - Intel Corporation)
J_Ops (HKLM-x32\...\103A18BE-9E32-44C9-8BFB-933B7772CE5C) (Version: 2.1v1 - com.blogspot.major-kong.j_ops)
Java 7 Update 25 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217025FF}) (Version: 7.0.250 - Oracle)
Java 7 Update 45 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86417045FF}) (Version: 7.0.450 - Oracle)
Logitech Gaming Software 5.10 (HKLM\...\{1444D2EE-C7AD-44A8-844F-2634B49353D1}) (Version: 5.10.127 - Logitech)
Malwarebytes Anti-Malware version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Maxwell 2 (HKLM-x32\...\Maxwell 2) (Version:  - )
Maxwell Plug-in for After Effects (HKLM-x32\...\Maxwell Plug-in for After Effects) (Version:  - )
Maxwell Plugin for Maya (HKLM-x32\...\MaxwellMaya) (Version: 2.7.15 - Next Limit)
Maxwell Plug-in for Photoshop (HKLM-x32\...\Maxwell Plug-in for Photoshop) (Version:  - )
Maxwell Shell Extension (x64) (HKLM\...\{3F532222-A793-4362-876B-72F56C60EF9C}) (Version: 2.7.0 - Next Limit Technologies)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Flight Simulator X (HKLM-x32\...\InstallShield_{9527A496-5DF9-412A-ADC7-168BA5379CA6}) (Version: 10.0.61355.0 - Microsoft Game Studios)
Microsoft Office Professional 2010 (HKLM-x32\...\Office14.SingleImage) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.6.305.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{A49F249F-0C91-497F-86DF-B2585E8E76B7}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (HKLM\...\{350AA351-21FA-3270-8B7A-835434E766AD}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729 (HKLM\...\{4FFA2088-8317-3B14-93CD-4C699DB37843}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (HKLM-x32\...\{a1909659-0a08-4554-8af1-2175904903a1}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (HKLM-x32\...\{95716cce-fc71-413f-8ad5-56c2892d4b3a}) (Version: 11.0.60610.1 - Microsoft Corporation)
Minecraft Editor 64 bits (HKLM\...\{2FE2E868-170C-4A17-BE0C-D4F13D8E7844}) (Version: 1.8.1 - Axialmedia)
MiniTool Power Data Recovery (HKLM-x32\...\MiniTool Power Data Recovery_is1) (Version:  - MiniTool Solution Ltd.)
Mozilla Firefox 35.0.1 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 35.0.1 (x86 en-US)) (Version: 35.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 34.0.5 - Mozilla)
MRT Hidden Copy (HKLM-x32\...\{9352D1CF-7ED5-41FD-82F7-6704497943DE}) (Version: 1.0.0 - MRT Software)
MSI Afterburner 2.3.1 (HKLM-x32\...\Afterburner) (Version: 2.3.1 - MSI Co., LTD)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 4.0 SP2 Parser and SDK (HKLM-x32\...\{716E0306-8318-4364-8B8F-0CC4E9376BAC}) (Version: 4.20.9818.0 - Microsoft Corporation)
My Game Long Name (HKLM\...\UDK-3fcdab84-edf3-4435-b3d1-568858936edb) (Version:  - Epic Games, Inc.)
Nero DiscSpeed 10 (HKLM-x32\...\{34490F4E-48D0-492E-8249-B48BECF0537C}) (Version: 6.0.11400.18.100 - Nero AG)
Nero Express 10 (HKLM-x32\...\{70550193-1C22-445C-8FA4-564E155DB1A7}) (Version: 10.0.12300.23.100 - Nero AG)
Nero Multimedia Suite 10 Essentials (HKLM-x32\...\{7D0A13FA-56BC-4755-8BAF-45A69BA6A5C8}) (Version: 10.0.10300 - Nero AG)
NetWorx 5.2.9 (HKLM\...\NetWorx_is1) (Version:  - Softperfect Research)
Nuke 7.0v9 (HKLM\...\Nuke 7.0v9_is1) (Version:  - The Foundry)
Nuke 9.0v1 (HKLM\...\Nuke 9.0v1_is1) (Version:  - The Foundry)
NVIDIA 3D Vision Controller Driver 344.65 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 344.65 - NVIDIA Corporation)
NVIDIA 3D Vision Driver 344.65 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 344.65 - NVIDIA Corporation)
NVIDIA Graphics Driver 344.65 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 344.65 - NVIDIA Corporation)
NVIDIA PhysX System Software 9.14.0702 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.14.0702 - NVIDIA Corporation)
Ocula 3.0v3 for Nuke 7.0 (HKLM\...\Ocula 3.0v3 for Nuke 7.0_is1) (Version:  - The Foundry)
Online Plug-in (x32 Version: 14.0.1.4 - Citrix Systems, Inc.) Hidden
PDF Settings CS6 (x32 Version: 11.0 - Adobe Systems Incorporated) Hidden
ph (x32 Version: 1.0.0 - Your Company Name) Hidden
PMDG 747-400/400F for FSX (HKLM-x32\...\{EDCEE320-0FB3-4197-9F86-8C1CCF2278FB}) (Version: 2.10.0040 - Precision Manuals Development Group)
Portal 2 (HKLM-x32\...\Postal 2_is1) (Version:  - )
PTGui Pro 10.0.7 (HKLM-x32\...\PTGui) (Version:  - New House Internet Services B.V.)
Q.U.B.E: Director's Cut (HKLM-x32\...\Steam App 239430) (Version:  - Toxic Games)
QuickTime (HKLM-x32\...\{AF0CE7C0-A3E4-4D73-988B-B29187EC6E9A}) (Version: 7.73.80.64 - Apple Inc.)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.61.612.2012 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6657 - Realtek Semiconductor Corp.)
ReNamer (HKLM-x32\...\ReNamer_is1) (Version: 5.76 - Denis Kozlov)
RollingShutter 1.0v1 (64 bit) for Nuke (HKLM\...\RollingShutter for Nuke_is1) (Version:  - The Foundry)
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.33.0 - SAMSUNG Electronics Co., Ltd.)
Self-service Plug-in (x32 Version: 4.0.1.41859 - Citrix Systems, Inc.) Hidden
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version:  - Microsoft)
Silhouette v4.5 (64 Bit) (HKLM-x32\...\Silhouette v4.5 (64 Bit)) (Version: 4.5.4 - SilhouetteFX, LLC)
Silhouette v4.5 (64 Bit) (Version: 4.5.4 - SilhouetteFX, LLC) Hidden
Sins of a Solar Empire®: Rebellion (HKLM-x32\...\Steam App 204880) (Version:  - Ironclad Games)
Spotify (HKU\S-1-5-21-2331779183-1848979938-1968265387-1000\...\Spotify) (Version: 0.9.15.27.g87efe634 - Spotify AB)
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.4.40 - Safer-Networking Ltd.)
SpywareBlaster 5.0 (HKLM-x32\...\SpywareBlaster_is1) (Version: 5.0.0 - BrightFort LLC)
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
SUPERAntiSpyware (HKLM\...\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}) (Version: 6.0.1170 - SUPERAntiSpyware.com)
TeamViewer 9 (HKLM-x32\...\TeamViewer 9) (Version: 9.0.32494 - TeamViewer)
Telecom NZ Connect Me (HKLM\...\{35026A82-F328-4771-AB5F-E0126EFE70A2}) (Version: 1.01.0013.0 - Telecom NZ)
TeraCopy 2.27 (HKLM\...\TeraCopy_is1) (Version:  - Code Sector)
Terragen 3 (HKLM\...\{0A4ABB5B-B544-4A7A-86A6-2FF13BEF062B}) (Version: 3.0.04 - Planetside Software)
The Foundry MODO 801_SP3 build 77509 (HKLM-x32\...\801_SP3_64) (Version:  - )
The Sims™ 3 (HKLM-x32\...\Steam App 47890) (Version:  - The Sims Studio)
Visual Studio 2012 x64 Redistributables (HKLM\...\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)
Visual Studio 2012 x86 Redistributables (HKLM-x32\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
VLC media player 2.1.3 (HKLM-x32\...\VLC media player) (Version: 2.1.3 - VideoLAN)
VNC Mirror Driver 1.8.0 (HKLM\...\VNCMirror_is1) (Version: 1.8.0 - RealVNC Ltd.)
VNC Printer Driver 1.8.0 (HKLM\...\VNCPrinter_is1) (Version: 1.8.0 - RealVNC Ltd.)
VNC Server 5.0.5 (HKLM\...\RealVNC_is1) (Version: 5.0.5 - RealVNC Ltd)
VNC Viewer 5.0.5 (HKLM\...\RealVNCViewer_is1) (Version: 5.0.5 - RealVNC Ltd)
V-Ray for Maya 2013 for x64 (HKLM\...\V-Ray for Maya 2013 for x64) (Version: 2.30.01 - Chaos Software Ltd)
Wacom (HKLM\...\Pen Tablet Driver) (Version: 5.3.2-1 - Wacom Technology Corp.)
WebTablet FB Plugin 64 bit (HKLM\...\Wacom WebTabletPlugin for Internet Explorer and Netscape) (Version: 2.1.0.2 - Wacom Technology Corp.)
Wilco Airbus Evolution vol. 1 (HKLM-x32\...\Wilco Airbus Evolution vol. 1) (Version:  - )
Winamp (HKLM-x32\...\Winamp) (Version: 5.7 Beta - Nullsoft, Inc)
Winamp Detector Plug-in (HKU\S-1-5-21-2331779183-1848979938-1968265387-1000\...\Winamp Detect) (Version: 1.0.0.1 - Nullsoft, Inc)
WinSCP 5.1.4 (HKLM-x32\...\winscp3_is1) (Version: 5.1.4 - Martin Prikryl)
XMind 2012 (v3.3.1) (HKLM-x32\...\XMind_is1) (Version: 3.3.1.201212250029 - XMind Ltd.)
Zero Assumption Recovery Version 9 (HKLM-x32\...\Zero Assumption Recovery_is1) (Version:  - )

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-2331779183-1848979938-1968265387-1000_Classes\CLSID\{092dfa86-5807-5a94-bf3b-5a53ba9e5308}\InprocServer32 -> C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll (Wacom)
CustomCLSID: HKU\S-1-5-21-2331779183-1848979938-1968265387-1000_Classes\CLSID\{D45F043D-F17F-4e8a-8435-70971D9FA46D}\InprocServer32 -> C:\Program Files\Blender Foundation\Blender\BlendThumb64.dll ()

==================== Restore Points  =========================

01-02-2015 20:00:29 avast! antivirus system restore point
02-02-2015 11:11:04 Windows Update
05-02-2015 19:41:23 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2015-02-01 08:59 - 2015-02-01 08:59 - 00000000 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {06E508B0-E386-4EE3-AC31-4A3767AB26A8} - System32\Tasks\{FD0CA877-0AD2-4B24-A816-863AF2FD1031} => pcalua.exe -a C:\Users\Nathan\Downloads\revouninstaller\revouninstaller-portable\Revouninstaller.exe -d C:\Users\Nathan\Downloads\revouninstaller\revouninstaller-portable
Task: {07A15EC5-E9D6-49DE-B308-F4EE3893B8FE} - System32\Tasks\SUPERAntiSpyware Scheduled Task 3cef288e-bd8e-41e4-8d51-9c4deca67e8b => C:\Program Files\SUPERAntiSpyware\SASTask.exe [2013-11-08] (SUPERAdBlocker.com)
Task: {11CD15EF-50BA-461F-85D2-8914A0CD9F9E} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-11-07] (Google Inc.)
Task: {13EEFDFE-B157-481C-BA1A-FF9EDFA5D1DA} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {1B449EA9-693C-4D17-AD6B-F1D81404451D} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-02-26] (Piriform Ltd)
Task: {2F472FA5-7E71-4B74-A9A2-263531FF814B} - System32\Tasks\SUPERAntiSpyware Scheduled Task d6a8530a-40c0-4018-8a3a-e0567125b7a5 => C:\Program Files\SUPERAntiSpyware\SASTask.exe [2013-11-08] (SUPERAdBlocker.com)
Task: {5F98632A-A7C3-487D-8DD6-46B19EE26B84} - System32\Tasks\ASUS\ASUS DigiPowerControl Help => C:\Program Files (x86)\ASUS\AI Suite II\DIGI+ VRM\PowerControlHelp.exe [2012-07-23] (ASUSTeK Computer Inc.)
Task: {744BEAAA-FD09-4834-BEC1-F06531636020} - System32\Tasks\ASUS\ASUS AI Suite II Execute => C:\Program Files (x86)\ASUS\AI Suite II\AsRoutineController.exe [2012-03-13] (ASUSTeK Computer Inc.)
Task: {80D13539-9A80-409E-8E54-DB3D4764C537} - \Microsoft\Windows\Maintenance\SMupdate2 No Task File <==== ATTENTION
Task: {85603E28-8B7C-432D-B7D4-B54BA28D6819} - System32\Tasks\{D7C993A2-B22C-41F4-8299-E9CB03970473} => pcalua.exe -a C:\Users\Nathan\Downloads\forge-1.7.2-10.12.0.967-installer-win.exe -d C:\Users\Nathan\Downloads
Task: {9809B686-0532-47F4-986D-138C848DB34A} - System32\Tasks\AutoKMS => C:\Windows\AutoKMS.exe
Task: {99EF065D-C2D6-411D-87FE-00D3F5D39236} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDScan.exe
Task: {A0F460FC-21BB-4246-8CDE-D0A7A00F8982} - System32\Tasks\AdobeAAMUpdater-1.0-Nathan-PC-Nathan => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2012-09-20] (Adobe Systems Incorporated)
Task: {A127A95E-BF7D-41BF-ACCD-250ED2253BCE} - \Microsoft\Windows\Multimedia\SMupdate3 No Task File <==== ATTENTION
Task: {A79E403F-CBD2-4F55-92C5-D8B0AE72FCDF} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-11-07] (Google Inc.)
Task: {A7FAE742-C1CC-4095-9B52-2E54BA014A7D} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2015-02-01] (AVAST Software)
Task: {ABD09D8C-F9D6-4D16-A10E-836E55C98040} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDUpdate.exe
Task: {C12D1845-3EE7-48FC-B497-1023A49E4FA3} - System32\Tasks\JSAH => C:\Users\Nathan\AppData\Roaming\JSAH.exe <==== ATTENTION
Task: {C2DCEDE6-C8DF-4ECB-9706-A60CA605CFFD} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDImmunize.exe
Task: {D745B5F0-2F9A-42A8-B6A5-9C379CE4AF59} - System32\Tasks\{7654C427-B8DC-4250-92CC-C01FC317F881} => pcalua.exe -a "F:\Borderlands(DIRECT PLAY with all 4 DLC's)\Binaries\SetupHelper.exe" -d "F:\Borderlands(DIRECT PLAY with all 4 DLC's)\Binaries"
Task: {E5AEC42A-27EF-4DF0-9BFF-915D9D16CBAE} - System32\Tasks\POAKKAVK => C:\Users\Nathan\AppData\Roaming\POAKKAVK.exe <==== ATTENTION
Task: {F77F4A69-F914-486D-B626-711FDD2D5D5B} - System32\Tasks\AutoKMSDaily => C:\Windows\AutoKMS.exe
Task: C:\Windows\Tasks\AutoKMS.job => C:\Windows\AutoKMS.exe
Task: C:\Windows\Tasks\AutoKMSDaily.job => C:\Windows\AutoKMS.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\JSAH.job => C:\Users\Nathan\AppData\Roaming\JSAH.exe <==== ATTENTION
Task: C:\Windows\Tasks\POAKKAVK.job => C:\Users\Nathan\AppData\Roaming\POAKKAVK.exe <==== ATTENTION
Task: C:\Windows\Tasks\SUPERAntiSpyware Scheduled Task 3cef288e-bd8e-41e4-8d51-9c4deca67e8b.job => C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
Task: C:\Windows\Tasks\SUPERAntiSpyware Scheduled Task d6a8530a-40c0-4018-8a3a-e0567125b7a5.job => C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

==================== Loaded Modules (whitelisted) ==============

2013-03-08 15:28 - 2014-11-04 11:02 - 00116880 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2012-12-14 03:42 - 2012-12-14 03:42 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2014-12-18 15:21 - 2014-12-18 15:21 - 08947008 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.5.202.7299\AdAwareTray.exe
2014-12-18 15:21 - 2014-12-18 15:21 - 03396400 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.5.202.7299\RCF.dll
2014-12-18 15:22 - 2014-12-18 15:22 - 00125792 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.5.202.7299\boost_filesystem-vc100-mt-1_57.dll
2014-12-18 15:22 - 2014-12-18 15:22 - 00024408 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.5.202.7299\boost_system-vc100-mt-1_57.dll
2014-12-18 15:22 - 2014-12-18 15:22 - 00055648 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.5.202.7299\boost_date_time-vc100-mt-1_57.dll
2014-12-18 15:22 - 2014-12-18 15:22 - 00107352 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.5.202.7299\boost_thread-vc100-mt-1_57.dll
2014-12-18 15:22 - 2014-12-18 15:22 - 00033624 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.5.202.7299\boost_chrono-vc100-mt-1_57.dll
2014-12-18 15:22 - 2014-12-18 15:22 - 00500056 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.5.202.7299\boost_locale-vc100-mt-1_57.dll
2014-12-18 15:21 - 2014-12-18 15:21 - 02130752 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.5.202.7299\HtmlFramework.dll
2014-12-18 15:21 - 2014-12-18 15:21 - 00066872 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.5.202.7299\DllStorage.dll
2014-12-18 15:21 - 2014-12-18 15:21 - 00869712 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.5.202.7299\AdAwareTrayDefaultSkin.dll
2014-12-18 15:21 - 2014-12-18 15:21 - 00811328 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.5.202.7299\Localization.dll
2013-03-09 14:04 - 2013-03-09 14:04 - 00918448 _____ () C:\Program Files (x86)\ASUS\AXSP\1.00.18\atkexComSvc.exe
2014-12-18 15:09 - 2014-12-18 15:09 - 00713568 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.5.202.7299\AdAwareService.exe
2014-12-18 15:21 - 2014-12-18 15:21 - 12716368 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.5.202.7299\AdAwareServiceKernel.dll
2014-12-18 15:22 - 2014-12-18 15:22 - 00786264 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.5.202.7299\boost_regex-vc100-mt-1_57.dll
2014-12-18 15:21 - 2014-12-18 15:21 - 00736584 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.5.202.7299\AdAwareActivation.dll
2014-12-18 15:21 - 2014-12-18 15:21 - 00474968 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.5.202.7299\AdAwareApplicationUpdater.dll
2014-12-18 15:21 - 2014-12-18 15:21 - 00812360 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.5.202.7299\AdAwareGamingMode.dll
2014-12-18 15:21 - 2014-12-18 15:21 - 00099136 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.5.202.7299\AdAwareReset.dll
2014-12-18 15:21 - 2014-12-18 15:21 - 00119616 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.5.202.7299\AdAwareTime.dll
2014-12-18 15:21 - 2014-12-18 15:21 - 00957784 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.5.202.7299\AdAwareDefinitionsUpdater.dll
2014-12-18 15:21 - 2014-12-18 15:21 - 00867688 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.5.202.7299\AdAwareDefinitionsUpdaterScheduler.dll
2014-12-18 15:21 - 2014-12-18 15:21 - 01107272 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.5.202.7299\AdAwareIgnoreList.dll
2014-12-18 15:21 - 2014-12-18 15:21 - 00248648 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.5.202.7299\AdAwareQuarantine.dll
2014-12-18 15:21 - 2014-12-18 15:21 - 01009496 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.5.202.7299\AdAwareAntiMalwareEngine.dll
2014-12-18 15:21 - 2014-12-18 15:21 - 00212824 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.5.202.7299\AdAwareAntiRootkitEngine.dll
2014-12-18 15:21 - 2014-12-18 15:21 - 01171280 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.5.202.7299\AdAwareScannerHistory.dll
2014-12-18 15:21 - 2014-12-18 15:21 - 01295680 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.5.202.7299\AdAwareScanner.dll
2014-12-18 15:22 - 2014-12-18 15:22 - 00035160 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.5.202.7299\boost_timer-vc100-mt-1_57.dll
2014-12-18 15:21 - 2014-12-18 15:21 - 00975704 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.5.202.7299\AdAwareScannerScheduler.dll
2014-12-18 15:21 - 2014-12-18 15:21 - 01091416 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.5.202.7299\AdAwareRealTimeProtection.dll
2014-12-18 15:21 - 2014-12-18 15:21 - 00229200 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.5.202.7299\AdAwareIncompatibles.dll
2014-12-18 15:21 - 2014-12-18 15:21 - 00894280 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.5.202.7299\AdAwareAntiSpam.dll
2014-12-18 15:21 - 2014-12-18 15:21 - 00849232 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.5.202.7299\AdAwareAntiPhishing.dll
2014-12-18 15:21 - 2014-12-18 15:21 - 03096912 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.5.202.7299\AdAwareParentalControl.dll
2014-12-18 15:21 - 2014-12-18 15:21 - 02953040 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.5.202.7299\AdAwareWebProtection.dll
2014-12-18 15:21 - 2014-12-18 15:21 - 01251664 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.5.202.7299\AdAwareEmailProtection.dll
2014-12-18 15:22 - 2014-12-18 15:22 - 00053600 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.5.202.7299\boost_iostreams-vc100-mt-1_57.dll
2014-12-18 15:21 - 2014-12-18 15:21 - 01289048 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.5.202.7299\AdAwareNetworkProtection.dll
2014-12-18 15:21 - 2014-12-18 15:21 - 00968000 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.5.202.7299\AdAwarePromo.dll
2014-12-18 15:21 - 2014-12-18 15:21 - 00360776 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.5.202.7299\AdAwareFeedback.dll
2014-12-18 15:21 - 2014-12-18 15:21 - 02785112 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.5.202.7299\AdAwareThreatWorkAlliance.dll
2014-12-18 15:21 - 2014-12-18 15:21 - 01228608 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.5.202.7299\AdAwarePinCode.dll
2014-12-18 15:21 - 2014-12-18 15:21 - 00968000 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.5.202.7299\AdAwareNotice.dll
2014-12-18 15:21 - 2014-12-18 15:21 - 00957256 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.5.202.7299\AdAwareAvcEngine.dll
2014-12-18 15:21 - 2014-12-18 15:21 - 01177960 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.5.202.7299\AdAwareRealTimeProtectionHistory.dll
2014-12-18 15:21 - 2014-12-18 15:21 - 00152896 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.5.202.7299\SecurityCenter.dll
2013-03-14 18:23 - 2012-12-11 13:07 - 01184640 _____ () C:\Program Files\Tablet\Pen\libxml2.dll
2015-02-06 07:08 - 2015-02-04 21:53 - 01450312 _____ () C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.111\libglesv2.dll
2015-02-06 07:08 - 2015-02-04 21:53 - 00205128 _____ () C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.111\libegl.dll
2015-02-06 07:08 - 2015-02-04 21:53 - 10864456 _____ () C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.111\pdf.dll
2015-02-06 07:08 - 2015-02-04 21:53 - 26771784 _____ () C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.111\PepperFlash\pepflashplayer.dll
2015-02-06 11:11 - 2015-02-06 11:11 - 02913280 _____ () C:\Program Files\AVAST Software\Avast\defs\15020501\algo.dll
2012-10-11 21:56 - 2012-10-11 21:56 - 00087952 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2012-10-11 21:56 - 2012-10-11 21:56 - 01242512 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2014-07-19 19:49 - 2014-07-20 07:21 - 00003132 _____ () C:\Program Files (x86)\DAEMON Tools Pro\MSIMG32.dll
2013-03-09 13:41 - 2011-07-12 19:14 - 00147456 _____ () C:\Program Files (x86)\ASUS\AI Suite II\AssistFunc.dll
2013-03-09 13:41 - 2010-10-05 08:22 - 00253952 _____ () C:\Program Files (x86)\ASUS\AI Suite II\pngio.dll
2013-03-09 13:41 - 2012-03-21 12:07 - 00972288 _____ () C:\Program Files (x86)\ASUS\AI Suite II\BarGadget\BarGadget.dll
2013-03-09 13:41 - 2012-05-25 10:33 - 00883712 _____ () C:\Program Files (x86)\ASUS\AI Suite II\Sensor\Sensor.dll
2013-03-09 13:41 - 2012-05-28 21:27 - 01622528 _____ () C:\Program Files (x86)\ASUS\AI Suite II\Sensor Graph\SensorGraph.dll
2013-03-09 13:41 - 2011-09-19 20:18 - 01243136 _____ () C:\Program Files (x86)\ASUS\AI Suite II\Settings\Settings.dll
2013-03-09 13:41 - 2011-07-21 09:06 - 00846848 _____ () C:\Program Files (x86)\ASUS\AI Suite II\Splitter\Splitter.dll
2013-03-09 13:41 - 2011-10-14 20:03 - 00885248 _____ () C:\Program Files (x86)\ASUS\AI Suite II\TabGadget\TabGadget.dll
2013-03-09 13:39 - 2010-08-23 15:17 - 00662016 ____R () C:\Program Files (x86)\ASUS\AAHM\1.00.20\aaHMLib.dll
2013-03-09 13:41 - 2010-10-05 08:22 - 00208896 _____ () C:\Program Files (x86)\ASUS\AI Suite II\ImageHelper.dll
2014-11-19 07:20 - 2014-05-13 12:04 - 00109400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2014-11-19 07:20 - 2014-05-13 12:04 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2014-11-19 07:20 - 2014-05-13 12:04 - 00167768 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2015-02-01 20:03 - 2015-02-01 20:03 - 38562088 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2013-03-09 14:04 - 2015-02-06 15:10 - 00026112 _____ () C:\Program Files (x86)\ASUS\AXSP\1.00.18\PEbiosinterface32.dll
2013-03-09 14:04 - 2013-03-09 14:04 - 00104448 _____ () C:\Program Files (x86)\ASUS\AXSP\1.00.18\ATKEX.dll
2013-03-09 13:41 - 2009-08-12 20:15 - 00253952 _____ () C:\Program Files (x86)\ASUS\AI Suite II\Sensor\AlertHelper\pngio.dll
2014-11-19 07:20 - 2012-08-23 10:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2014-11-19 07:20 - 2012-04-03 17:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll
2014-11-14 10:22 - 2014-12-02 10:31 - 02396672 _____ () C:\Program Files (x86)\Steam\libavcodec-56.dll
2014-11-14 10:22 - 2014-12-02 10:31 - 00442880 _____ () C:\Program Files (x86)\Steam\libavutil-54.dll
2014-11-14 10:22 - 2014-12-02 10:31 - 00479744 _____ () C:\Program Files (x86)\Steam\libavformat-56.dll
2014-11-14 10:22 - 2014-12-02 10:31 - 00332800 _____ () C:\Program Files (x86)\Steam\libavresample-2.dll
2014-11-14 10:23 - 2014-11-12 07:47 - 00774656 _____ () C:\Program Files (x86)\Steam\SDL2.dll
2015-01-22 21:57 - 2014-12-02 13:29 - 05002752 _____ () C:\Program Files (x86)\Steam\v8.dll
2015-01-22 21:57 - 2014-12-02 13:29 - 01612800 _____ () C:\Program Files (x86)\Steam\icui18n.dll
2015-01-22 21:57 - 2014-12-02 13:29 - 01210368 _____ () C:\Program Files (x86)\Steam\icuuc.dll
2014-11-14 10:23 - 2015-01-24 11:34 - 02227904 _____ () C:\Program Files (x86)\Steam\video.dll
2014-11-14 10:22 - 2014-12-02 10:31 - 00485888 _____ () C:\Program Files (x86)\Steam\libswscale-3.dll
2014-11-14 10:23 - 2015-01-24 11:33 - 00696512 _____ () C:\Program Files (x86)\Steam\bin\chromehtml.DLL
2014-11-14 10:23 - 2015-01-16 12:42 - 34641288 _____ () C:\Program Files (x86)\Steam\bin\libcef.dll
2014-11-14 10:23 - 2015-01-16 12:42 - 01709960 _____ () C:\Program Files (x86)\Steam\bin\ffmpegsumo.dll
2014-10-29 15:15 - 2014-10-29 15:15 - 00172544 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\1eeea3ab8d69ec722bdcb28b8eb8dd75\IsdiInterop.ni.dll
2013-03-08 15:12 - 2012-02-01 16:25 - 00059904 _____ () C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IsdiInterop.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\ProgramData\TEMP:5C321E34
AlternateDataStreams: C:\Users\Nathan\Cookies:z6Rx73XDj2OjqJG7cBc
AlternateDataStreams: C:\Users\Nathan\Local Settings:rZpcPRgDcrRmregRKwbHNrViLyS
AlternateDataStreams: C:\Users\Nathan\AppData\Local:rZpcPRgDcrRmregRKwbHNrViLyS
AlternateDataStreams: C:\Users\Nathan\AppData\Local\Application Data:rZpcPRgDcrRmregRKwbHNrViLyS
AlternateDataStreams: C:\Users\Nathan\AppData\Local\k4Kb81AnxYO35Gc:LP3m96TmTWKh0B7TcqXQUg05Gku87
AlternateDataStreams: C:\Users\Nathan\AppData\Local\XuDiep6tq:An4dQYekZgVdmxh07M8qeKxS
AlternateDataStreams: C:\Users\Public\Documents\SilhouetteFX:B3140EBF-2369-41e7-8EBF-4EB5CFC8C0F2

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Other Registry Areas =====================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-2331779183-1848979938-1968265387-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Nathan\AppData\Roaming\Mozilla\Firefox\Desktop Background.bmp

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\Services: Bonjour Service => 2
MSCONFIG\Services: MozillaMaintenance => 3
MSCONFIG\Services: PCSUService => 2
MSCONFIG\Services: SDUpdateService => 2
MSCONFIG\startupreg: Acrobat Assistant 8.0 => "C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe"
MSCONFIG\startupreg: Adobe Acrobat Speed Launcher => "C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe"
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: AdobeAAMUpdater-1.0 => "C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"
MSCONFIG\startupreg: AdobeCS6ServiceManager => "C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" -launchedbylogin
MSCONFIG\startupreg: APSDaemon => "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
MSCONFIG\startupreg: boincmgr => "C:\Program Files\BOINC\boincmgr.exe" /a /s
MSCONFIG\startupreg: boinctray => "C:\Program Files\BOINC\boinctray.exe"
MSCONFIG\startupreg: CitrixReceiver => "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Citrix\Receiver Updater.lnk"
MSCONFIG\startupreg: ConnectionCenter => "C:\Program Files (x86)\Citrix\ICA Client\concentr.exe" /startup
MSCONFIG\startupreg: DAEMON Tools Pro Agent => "C:\Program Files (x86)\DAEMON Tools Pro\DTAgent.exe" -autorun
MSCONFIG\startupreg: F.lux => "C:\Users\Nathan\AppData\Local\FluxSoftware\Flux\flux.exe" /noshow
MSCONFIG\startupreg: IAStorIcon => C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIconLaunch.exe "C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe" 60
MSCONFIG\startupreg: iTunesHelper => "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
MSCONFIG\startupreg: KiesPreload => C:\Program Files (x86)\Samsung\Kies\Kies.exe /preload
MSCONFIG\startupreg: KiesTrayAgent => C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
MSCONFIG\startupreg: MRT Hidden Copy => "C:\Program Files (x86)\MRT Software\MRT Hidden Copy\MRT Hidden Copy.exe"
MSCONFIG\startupreg: NetWorx => "C:\Program Files\NetWorx\networx.exe" /auto
MSCONFIG\startupreg: PCSpeedUp => C:\Program Files (x86)\PC Speed Up\PCSUNotifier.exe
MSCONFIG\startupreg: QuickTime Task => "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
MSCONFIG\startupreg: Redirector => "C:\Program Files (x86)\Citrix\ICA Client\redirector.exe" /startup
MSCONFIG\startupreg: Spotify Web Helper => "C:\Users\Nathan\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe"
MSCONFIG\startupreg: Start WingMan Profiler => C:\Program Files\Logitech\Gaming Software\LWEMon.exe /noui
MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
MSCONFIG\startupreg: SwitchBoard => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe

==================== Accounts: =============================

Administrator (S-1-5-21-2331779183-1848979938-1968265387-500 - Administrator - Disabled)
Guest (S-1-5-21-2331779183-1848979938-1968265387-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-2331779183-1848979938-1968265387-1003 - Limited - Enabled)
Nathan (S-1-5-21-2331779183-1848979938-1968265387-1000 - Administrator - Enabled) => C:\Users\Nathan

==================== Faulty Device Manager Devices =============

Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft Teredo Tunneling Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.

Name:
Description:
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (02/06/2015 03:12:18 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/06/2015 03:10:52 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: lmgrd.foundry.exe, version: 10.8.7.0, time stamp: 0x47fe34e0
Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
Exception code: 0xc0000005
Fault offset: 0x00000000
Faulting process id: 0x1308
Faulting application start time: 0xlmgrd.foundry.exe0
Faulting application path: lmgrd.foundry.exe1
Faulting module path: lmgrd.foundry.exe2
Report Id: lmgrd.foundry.exe3

Error: (02/06/2015 08:13:04 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Activation context generation failed for "Microsoft.VC80.DebugCRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"1".
Dependent Assembly Microsoft.VC80.DebugCRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0" could not be found.
Please use sxstrace.exe for detailed diagnosis.

Error: (02/06/2015 06:57:59 AM) (Source: WTabletServiceCon) (EventID: 1) (User: )
Description: Prefs: Failed to get user path

Error: (02/06/2015 06:56:40 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/06/2015 06:55:20 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: lmgrd.foundry.exe, version: 10.8.7.0, time stamp: 0x47fe34e0
Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
Exception code: 0xc0000005
Fault offset: 0x00000000
Faulting process id: 0xfa8
Faulting application start time: 0xlmgrd.foundry.exe0
Faulting application path: lmgrd.foundry.exe1
Faulting module path: lmgrd.foundry.exe2
Report Id: lmgrd.foundry.exe3

Error: (02/05/2015 07:22:10 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/05/2015 07:20:40 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: lmgrd.foundry.exe, version: 10.8.7.0, time stamp: 0x47fe34e0
Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
Exception code: 0xc0000005
Fault offset: 0x00000000
Faulting process id: 0xe90
Faulting application start time: 0xlmgrd.foundry.exe0
Faulting application path: lmgrd.foundry.exe1
Faulting module path: lmgrd.foundry.exe2
Report Id: lmgrd.foundry.exe3

Error: (02/05/2015 07:14:34 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: lmgrd.foundry.exe, version: 10.8.7.0, time stamp: 0x47fe34e0
Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
Exception code: 0xc0000005
Fault offset: 0x00000000
Faulting process id: 0xba0
Faulting application start time: 0xlmgrd.foundry.exe0
Faulting application path: lmgrd.foundry.exe1
Faulting module path: lmgrd.foundry.exe2
Report Id: lmgrd.foundry.exe3

Error: (02/02/2015 11:37:07 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Activation context generation failed for "Microsoft.VC80.DebugCRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"1".
Dependent Assembly Microsoft.VC80.DebugCRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0" could not be found.
Please use sxstrace.exe for detailed diagnosis.


System errors:
=============
Error: (02/06/2015 03:13:48 PM) (Source: WMPNetworkSvc) (EventID: 14332) (User: )
Description: WMPNetworkSvc0x80004005

Error: (02/06/2015 08:48:33 AM) (Source: bowser) (EventID: 8003) (User: )
Description: The master browser has received a server announcement from the computer GERTRUDE
that believes that it is the master browser for the domain on transport NetBT_Tcpip_{3A141612-C2EA-4B8A-BDD9-C4617FB29DF6}.
The master browser is stopping or an election is being forced.

Error: (02/05/2015 07:19:40 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: The previous system shutdown at 7:15:40 p.m. on ‎5/‎02/‎2015 was unexpected.

Error: (02/02/2015 10:15:18 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {60A90A2F-858D-42AF-8929-82BE9D99E8A1}

Error: (02/02/2015 11:05:31 AM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: The Windows Update service hung on starting.

Error: (02/02/2015 11:02:55 AM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: The Windows Search service hung on starting.

Error: (02/02/2015 10:55:49 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Spybot-S&D 2 Scanner Service service failed to start due to the following error:
%%1053

Error: (02/02/2015 10:55:49 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the Spybot-S&D 2 Scanner Service service to connect.

Error: (02/01/2015 08:59:03 AM) (Source: Microsoft-Windows-DNS-Client) (EventID: 1012) (User: NT AUTHORITY)
Description: There was an error while attempting to read the local hosts file.

Error: (02/01/2015 08:59:00 AM) (Source: Microsoft-Windows-DNS-Client) (EventID: 1012) (User: NT AUTHORITY)
Description: There was an error while attempting to read the local hosts file.


Microsoft Office Sessions:
=========================
Error: (02/06/2015 03:12:18 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/06/2015 03:10:52 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: lmgrd.foundry.exe10.8.7.047fe34e0unknown0.0.0.000000000c000000500000000130801d041b2187d756fC:\Program Files (x86)\The Foundry\LicensingTools7.0\bin\FLEXlm\lmgrd.foundry.exeunknown5fb6a589-ada5-11e4-b7a8-0c0c0c0c0c01

Error: (02/06/2015 08:13:04 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.VC80.DebugCRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"C:\Program Files\Autodesk\Composite 2013\python\lib\distutils\command\wininst-8_d.exe

Error: (02/06/2015 06:57:59 AM) (Source: WTabletServiceCon) (EventID: 1) (User: )
Description: Prefs: Failed to get user path

Error: (02/06/2015 06:56:40 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/06/2015 06:55:20 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: lmgrd.foundry.exe10.8.7.047fe34e0unknown0.0.0.000000000c000000500000000fa801d0416cdb79aa79C:\Program Files (x86)\The Foundry\LicensingTools7.0\bin\FLEXlm\lmgrd.foundry.exeunknown260e2b55-ad60-11e4-9f5b-0c0c0c0c0c01

Error: (02/05/2015 07:22:10 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/05/2015 07:20:40 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: lmgrd.foundry.exe10.8.7.047fe34e0unknown0.0.0.000000000c000000500000000e9001d0410bd40373aaC:\Program Files (x86)\The Foundry\LicensingTools7.0\bin\FLEXlm\lmgrd.foundry.exeunknown1b24d600-acff-11e4-9d6e-0c0c0c0c0c01

Error: (02/05/2015 07:14:34 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: lmgrd.foundry.exe10.8.7.047fe34e0unknown0.0.0.000000000c000000500000000ba001d0410af87acaf5C:\Program Files (x86)\The Foundry\LicensingTools7.0\bin\FLEXlm\lmgrd.foundry.exeunknown40c357ee-acfe-11e4-9cd1-0c0c0c0c0c01

Error: (02/02/2015 11:37:07 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.VC80.DebugCRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"C:\Program Files\Autodesk\Composite 2013\python\lib\distutils\command\wininst-8_d.exe


==================== Memory info ===========================

Processor: Intel® Core™ i7-3770 CPU @ 3.40GHz
Percentage of memory in use: 25%
Total physical RAM: 16263.91 MB
Available physical RAM: 12122.49 MB
Total Pagefile: 32826 MB
Available Pagefile: 28419.54 MB
Total Virtual: 8192 MB
Available Virtual: 8191.81 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:465.66 GB) (Free:32.52 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 8BA692E1)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=465.7 GB) - (Type=07 NTFS)

==================== End Of Log ============================



BC AdBot (Login to Remove)

 


#2 Jo*

Jo*

  • Malware Response Team
  • 3,304 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Germany
  • Local time:08:09 AM

Posted 10 February 2015 - 06:41 AM

:welcome:

Hello snowman123,

my name is Jo and I will help you with your computer problems.


Please follow these guidelines:
  • Logs can take a while to research, so please be patient.
  • Read and follow the instructions in the sequence they are posted.
  • print or copy & save instructions.
  • back up all your private data / important files on another (external) drive before using our tools.
  • Do not install / uninstall any applications, unless otherwise instructed.
  • Use only that tools you have been instructed to use.
  • Copy and Paste the log files inside your post, unless otherwise instructed.
  • Ask for clarification, if you have any questions.
  • Stay with this topic til you get the all clean post.
  • My first language is not english. So please do not use slang or idioms. It could be hard for me to read. Thanks for your understanding.

***


Download Security Check by screen317 from here or here.
  • Save it to your Desktop.
  • Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
    Vista / Windows 7/8 users right-click and select Run As Administrator.
  • A Notepad document should open automatically called checkup.txt; please post the contents of that document.

***


Please download Malwarebytes Anti-Rootkit and save it to your desktop.
  • Be sure to print out and follow the instructions provided on that same page.
  • Caution: This is a beta version so please be sure to read the disclaimer and back up all your data before using.
  • Scan your system for malware
With some infections, you may see two messages boxes.
  • 'Could not load protection driver'. Click 'OK'.
  • 'Could not load DDA driver'. Click 'Yes' to this message, to allow the driver to load after a restart. Allow the computer to restart. Continue with the rest of these instructions.
  • If malware is found - do not press the Clean up button, please go to the MBAR folder and then copy/paste the contents of the MBAR-log-***.txt file to your next reply.
  • If there is no malware found, please let me know as well.

***


Please download AdwCleaner by Xplode and save to your Desktop.
Double-click AdwCleaner.exe
Vista / Windows 7/8 users right-click and select Run As Administrator.
  • Click on the Scan button.
  • AdwCleaner will begin...be patient as the scan may take some time to complete.
    When the scan has finished, the actual line should say "Pending. Please uncheck elements you do not want to remove" => scan is complete.
  • After the scan has finished, click on the Report button...a logfile (AdwCleaner[R0].txt) will open in Notepad for review.
  • The contents of the log file may be confusing. Unless you see a program name that you know should not be removed, don't worry about it.
    If you see an entry you want to keep, let me know about it.
  • Copy and paste the contents of that logfile in your next reply.
  • A copy of all logfiles are saved in the C:\AdwCleaner folder which was created when running the tool.

***


Graduate of the WTT Classroom
Cheers,
Jo
If I have been helping you, and I have not replied to your latest post in 36 hours please send me a PM.


#3 Jo*

Jo*

  • Malware Response Team
  • 3,304 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Germany
  • Local time:08:09 AM

Posted 14 February 2015 - 04:29 AM

Due to the lack of feedback, this topic is now closed.

In the event you still have problems, please send me or any Moderator a Private Message and ask them to reopen this topic within the next 5 days.

Please include a link to your topic in the Private Message. Thank you.

Graduate of the WTT Classroom
Cheers,
Jo
If I have been helping you, and I have not replied to your latest post in 36 hours please send me a PM.





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users