Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

pop up website adultyum.info


  • This topic is locked This topic is locked
28 replies to this topic

#1 voicesinmyhead

voicesinmyhead

  • Members
  • 16 posts
  • OFFLINE
  •  
  • Local time:01:49 AM

Posted 24 March 2015 - 06:03 AM

Can anyone help me to fix this? Any help would be appreciated. Thanks.



BC AdBot (Login to Remove)

 


#2 deeprybka

deeprybka

  • Malware Response Team
  • 5,198 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Germany
  • Local time:07:49 PM

Posted 24 March 2015 - 06:34 AM

Hi & :welcome: to Bleeping Computer Forums!
My name is Jürgen and I will be assisting you with your Malware related problems. :warrior:

Before we move on, please read the following points carefully: :exclame:
  • My native language isn't English. So please do not use slang or idioms. It could be hard for me to read. Thanks for your understanding.
  • Please read my instructions completely. If there is anything that you do not understand kindly ask before proceeding.
  • Perform everything in the correct order. Sometimes one step requires the previous one.
  • If you have any problems while you are follow my instructions, Stop there and tell me the exact nature of your problem.
  • Do not run any other scans without instruction or Add/ Remove Software unless I tell you to do so. This would change the output of our tools and could be confusing for me.
  • Post all Logfiles as a reply rather than as an attachment unless I specifically ask you. If you can not post all logfiles in one reply, feel free to use more posts.
  • If I don't hear from you within 5 days from this initial or any subsequent post, then this thread will be closed.
  • If I don't reply within 24 hours please PM me!
  • Stay with me. I will give you some advice about prevention after the cleanup process. Absence of symptoms does not always mean the computer is clean.
Step 1

Please run a FRST scan. This will help us diagnose your problem.

frst.pngfrstscan.png
Please download Farbar Recovery Scan Tool and save it to your Desktop.
(If you are not sure which version (32-/64-bit) applies to your system, download and try to start both of them as just the right one will run.)
  • Start FRST with administator privileges.
  • Make sure the option Addition.txt is checked and press the Scan button.
  • When finished, FRST will produce two logs (FRST.txt and Addition.txt) in the same directory the tool was run from.
  • Please copy and paste these logs in your next reply.

regards,
deeprybka
:busy:
Neminem laede, immo omnes, quantum potes, iuva. Arthur Schopenhauer
 
unite_blue.png
asap.png

#3 voicesinmyhead

voicesinmyhead
  • Topic Starter

  • Members
  • 16 posts
  • OFFLINE
  •  
  • Local time:01:49 AM

Posted 24 March 2015 - 06:43 AM

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-03-2015
Ran by Roberto C. Victoria (administrator) on OVETH_VICTORIA on 24-03-2015 19:40:42
Running from \\OVETH_VICTORIA\Users\Roberto C. Victoria\Downloads
Loaded Profiles: Roberto C. Victoria &  (Available profiles: Roberto C. Victoria)
Platform: Windows 7 Ultimate Service Pack 1 (X64) OS Language: English (United States)
Internet Explorer Version 8 (Default browser: Chrome)
Boot Mode: Normal
 
==================== Processes (Whitelisted) =================
 
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 
(AMD) C:\Windows\System32\atiesrxx.exe
(SurfRight B.V.) C:\Program Files\HitmanPro\hmpsched.exe
(AMD) C:\Windows\System32\atieclxx.exe
(BlueStack Systems, Inc.) C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Ralink Technology, Corp.) C:\Program Files (x86)\Ralink\Common\RaUI.exe
(BlueStack Systems, Inc.) C:\Program Files (x86)\BlueStacks\HD-UpdaterService.exe
(Intel® Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\Jhi_service.exe
() C:\Program Files (x86)\Winamp\winampa.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Ralink Technology, Corp.) C:\Program Files (x86)\Ralink\Common\RaRegistry.exe
(Ralink Technology, Corp.) C:\Program Files (x86)\Ralink\Common\RaRegistry64.exe
() C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe
(Farbar) \\OVETH_VICTORIA\Users\Roberto C. Victoria\Downloads\FRST64.exe
 
 
==================== Registry (Whitelisted) ==================
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6843024 2012-10-29] (Realtek Semiconductor)
HKLM\...\Run: [Domino] => C:\Windows\Domino.exe
HKLM\...\Run: [VMSnap3] => C:\Windows\VMSnap3.exe
HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [31016 2006-10-27] (Microsoft Corporation)
HKLM-x32\...\Run: [WinampAgent] => C:\Program Files (x86)\Winamp\winampa.exe [33792 2005-11-16] ()
HKLM-x32\...\Run: [UpdatePDRShortCut] => C:\Program Files (x86)\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe [218408 2008-12-03] (CyberLink Corp.)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [676608 2013-08-30] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [amd_dc_opt] => C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe [77824 2008-07-22] (AMD)
HKLM-x32\...\Run: [APSDaemon] => "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2011-10-24] (Apple Inc.)
HKU\S-1-5-21-4123428590-2453437171-1252692713-1000\...\Run: [Facebook Update] => C:\Users\Roberto C. Victoria\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2014-05-27] (Facebook Inc.)
HKU\S-1-5-21-4123428590-2453437171-1252692713-1000\...\Run: [Boot computer] => wscript.exe //B "C:\Users\ROBERT~1.VIC\AppData\Local\Temp\Boot computer.vbs" <===== ATTENTION
HKU\S-1-5-21-4123428590-2453437171-1252692713-1000\...\Run: [WTFast Tray] => C:\Program Files (x86)\WTFast\WTFast.exe [4726872 2015-03-18] (AAA Internet Publishing, Inc.)
HKU\S-1-5-21-4123428590-2453437171-1252692713-1000\...\MountPoints2: {4bdd317d-fee5-11e3-b68b-ac220b27fba4} - E:\AutoRun.exe
HKU\S-1-5-21-4123428590-2453437171-1252692713-1000\...\MountPoints2: {941784d2-40cd-11e4-8f2f-ac220b27fba4} - E:\Startme.exe
HKU\S-1-5-21-4123428590-2453437171-1252692713-1000\...\MountPoints2: {b2807b9a-a9ef-11e4-a59b-ac220b27fba4} - G:\AutoRun.exe
HKU\S-1-5-21-4123428590-2453437171-1252692713-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\ssText3d.scr [333824 2010-11-21] (Microsoft Corporation)
HKU\S-1-5-21-4123428590-2453437171-1252692713-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [Facebook Update] => C:\Users\Roberto C. Victoria\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2014-05-27] (Facebook Inc.)
HKU\S-1-5-21-4123428590-2453437171-1252692713-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [Boot computer] => wscript.exe //B "C:\Users\ROBERT~1.VIC\AppData\Local\Temp\Boot computer.vbs" <===== ATTENTION
HKU\S-1-5-21-4123428590-2453437171-1252692713-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [WTFast Tray] => C:\Program Files (x86)\WTFast\WTFast.exe [4726872 2015-03-18] (AAA Internet Publishing, Inc.)
HKU\S-1-5-21-4123428590-2453437171-1252692713-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {4bdd317d-fee5-11e3-b68b-ac220b27fba4} - E:\AutoRun.exe
HKU\S-1-5-21-4123428590-2453437171-1252692713-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {941784d2-40cd-11e4-8f2f-ac220b27fba4} - E:\Startme.exe
HKU\S-1-5-21-4123428590-2453437171-1252692713-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {b2807b9a-a9ef-11e4-a59b-ac220b27fba4} - G:\AutoRun.exe
HKU\S-1-5-21-4123428590-2453437171-1252692713-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\ssText3d.scr [333824 2010-11-21] (Microsoft Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Ralink Wireless Utility.lnk
ShortcutTarget: Ralink Wireless Utility.lnk -> C:\Program Files (x86)\Ralink\Common\RaUI.exe (Ralink Technology, Corp.)
Startup: C:\Users\Roberto C. Victoria\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Boot computer.vbs ()
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  No File
BootExecute: autocheck autochk * bootdelete
 
==================== Internet (Whitelisted) ====================
 
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.msn.com/spbasic.htm
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-4123428590-2453437171-1252692713-1000\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie
HKU\S-1-5-21-4123428590-2453437171-1252692713-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://ph.msn.com/?rd=1&ucc=PH&dcc=PH&opt=0&ocid=iehp
HKU\S-1-5-21-4123428590-2453437171-1252692713-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie
HKU\S-1-5-21-4123428590-2453437171-1252692713-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://ph.msn.com/?rd=1&ucc=PH&dcc=PH&opt=0&ocid=iehp
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\.DEFAULT -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-4123428590-2453437171-1252692713-1000 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = http://www.bing.com/search?FORM=UP94DF&PC=UP94&q={searchTerms}&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-4123428590-2453437171-1252692713-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = http://www.bing.com/search?FORM=UP94DF&PC=UP94&q={searchTerms}&src=IE-SearchBox
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> c:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18] (Microsoft Corporation)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2006-10-27] (Microsoft Corporation)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> c:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18] (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
 
FireFox:
========
FF ProfilePath: C:\Users\Roberto C. Victoria\AppData\Roaming\Mozilla\Firefox\Profiles\wm9rrhp4.default
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll [2012-06-06] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2012-06-06] (Intel Corporation)
FF Plugin-x32: @t.garena.com/garenatalk -> C:\Program Files (x86)\Garena Plus\bbtalk\plugins\npPlugin\npGarenaTalkPlugin.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-03-18] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-03-18] (Google Inc.)
FF Plugin HKU\S-1-5-21-4123428590-2453437171-1252692713-1000: @Skype Limited.com/Facebook Video Calling Plugin -> C:\Users\Roberto C. Victoria\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll [2014-07-24] (Skype Limited)
FF Plugin HKU\S-1-5-21-4123428590-2453437171-1252692713-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0: @Skype Limited.com/Facebook Video Calling Plugin -> C:\Users\Roberto C. Victoria\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll [2014-07-24] (Skype Limited)
FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [Not Found]
 
Chrome: 
=======
CHR Profile: C:\Users\Roberto C. Victoria\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Drive) - C:\Users\Roberto C. Victoria\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-03-18]
CHR Extension: (YouTube) - C:\Users\Roberto C. Victoria\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-03-18]
CHR Extension: (Google Search) - C:\Users\Roberto C. Victoria\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-03-18]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Roberto C. Victoria\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-18]
CHR Extension: (Google Wallet) - C:\Users\Roberto C. Victoria\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-03-18]
CHR Extension: (Gmail) - C:\Users\Roberto C. Victoria\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-03-18]
 
==================== Services (Whitelisted) =================
 
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 
S2 BstHdAndroidSvc; C:\Program Files (x86)\BlueStacks\HD-Service.exe [409304 2014-12-12] (BlueStack Systems, Inc.)
R2 BstHdLogRotatorSvc; C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe [388824 2014-12-12] (BlueStack Systems, Inc.)
R2 BstHdUpdaterSvc; C:\Program Files (x86)\BlueStacks\HD-UpdaterService.exe [786136 2014-12-12] (BlueStack Systems, Inc.)
R2 HitmanProScheduler; C:\Program Files\HitmanPro\hmpsched.exe [127752 2015-03-24] (SurfRight B.V.)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [166720 2012-06-25] (Intel Corporation)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1080120 2015-03-17] (Malwarebytes Corporation)
S3 RaMediaServer; C:\Program Files (x86)\Ralink\Common\RaMediaServer.exe [625728 2011-08-18] ()
R2 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [247152 2009-04-17] ()
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2009-07-14] (Microsoft Corporation)
 
==================== Drivers (Whitelisted) ====================
 
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 
R2 BstHdDrv; C:\Program Files (x86)\BlueStacks\HD-Hypervisor-amd64.sys [122072 2014-12-12] (BlueStack Systems)
R4 IOMap; C:\Windows\system32\drivers\IOMap64.sys [23680 2013-01-25] (ASUSTeK Computer Inc.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-03-17] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [136408 2015-03-24] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-03-17] (Malwarebytes Corporation)
S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [54784 2014-08-15] (Apple, Inc.) [File not signed]
S3 vvftav303; C:\Windows\System32\drivers\vvftav303.sys [308096 2007-06-23] (Vimicro Corporation)
S3 ZSMC0303; C:\Windows\System32\Drivers\usbVM303.sys [1494656 2007-03-25] (Vimicro Corporation)
S3 hxsyol; \??\C:\AeriaGames\AuraKingdom\avital\hxsy64.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
 
==================== NetSvcs (Whitelisted) ===================
 
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
 
 
==================== One Month Created Files and Folders ========
 
(If an entry is included in the fixlist, the file\folder will be moved.)
 
2015-03-24 19:40 - 2015-03-24 19:41 - 00016670 _____ () C:\Users\Roberto C. Victoria\Downloads\FRST.txt
2015-03-24 18:37 - 2015-03-24 18:54 - 00014958 _____ () C:\Users\Roberto C. Victoria\Downloads\Result.txt
2015-03-24 18:37 - 2015-03-24 18:37 - 00402944 _____ (Farbar) C:\Users\Roberto C. Victoria\Downloads\MiniToolBox.exe
2015-03-24 18:30 - 2015-03-24 18:29 - 00077926 _____ () C:\Users\Roberto C. Victoria\Desktop\Fixlist.txt
2015-03-24 18:27 - 2015-03-24 19:40 - 00000000 ____D () C:\FRST
2015-03-24 18:26 - 2015-03-24 18:27 - 02095616 _____ (Farbar) C:\Users\Roberto C. Victoria\Downloads\FRST64.exe
2015-03-24 18:15 - 2015-03-24 18:15 - 00014674 _____ () C:\Windows\system32\.crusader
2015-03-24 18:10 - 2015-03-24 18:10 - 00000085 _____ () C:\Windows\wininit.ini
2015-03-24 18:04 - 2015-03-24 18:04 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking
2015-03-24 18:03 - 2015-03-24 18:16 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2015-03-24 18:03 - 2015-03-24 18:15 - 00000000 ____D () C:\ProgramData\HitmanPro
2015-03-24 18:03 - 2015-03-24 18:10 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2015-03-24 18:03 - 2015-03-24 18:03 - 00001897 _____ () C:\Users\Public\Desktop\HitmanPro.lnk
2015-03-24 18:03 - 2015-03-24 18:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HitmanPro
2015-03-24 18:03 - 2015-03-24 18:03 - 00000000 ____D () C:\Program Files\HitmanPro
2015-03-24 17:57 - 2015-03-24 18:55 - 00000000 ____D () C:\AdwCleaner
2015-03-24 17:55 - 2015-03-24 17:56 - 10995632 _____ (SurfRight B.V.) C:\Users\Roberto C. Victoria\Downloads\HitmanPro_x64.exe
2015-03-24 17:55 - 2015-03-24 17:56 - 02168320 _____ () C:\Users\Roberto C. Victoria\Downloads\adwcleaner_4.113.exe
2015-03-24 17:49 - 2015-03-24 17:59 - 46525608 _____ (Safer-Networking Ltd. ) C:\Users\Roberto C. Victoria\Downloads\spybot-2.4.exe
2015-03-24 15:01 - 2015-03-24 15:03 - 00000000 ____D () C:\Users\Roberto C. Victoria\AppData\Roaming\Dropbox
2015-03-24 14:52 - 2015-03-24 19:31 - 00136408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-03-24 14:52 - 2015-03-24 14:52 - 00001106 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2015-03-24 14:52 - 2015-03-24 14:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-03-24 14:52 - 2015-03-24 14:52 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-03-24 14:52 - 2015-03-24 14:52 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2015-03-24 14:52 - 2015-03-17 06:15 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-03-24 14:52 - 2015-03-17 06:15 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-03-24 14:52 - 2015-03-17 06:15 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-03-24 14:50 - 2015-03-24 18:32 - 00000000 ____D () C:\ProgramData\AVAST Software
2015-03-24 14:50 - 2015-03-24 14:52 - 21540440 _____ (Malwarebytes Corporation ) C:\Users\Roberto C. Victoria\Downloads\mbam-setup-2.1.4.1018.exe
2015-03-24 14:50 - 2015-03-24 14:50 - 05475064 _____ (Avast Software s.r.o.) C:\Users\Roberto C. Victoria\Downloads\avast_free_antivirus_setup_online.exe
2015-03-24 00:16 - 2015-03-24 14:47 - 00000000 ____D () C:\Users\Roberto C. Victoria\Downloads\How I Met Your Mother - Season 6
2015-03-23 19:21 - 2015-03-23 19:21 - 00000983 _____ () C:\Users\Public\Desktop\WTFast.lnk
2015-03-23 19:21 - 2015-03-23 19:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WTFast
2015-03-23 19:21 - 2015-03-23 19:21 - 00000000 ____D () C:\Program Files (x86)\WTFast
2015-03-23 19:21 - 2014-10-15 15:18 - 00079464 _____ (Initex) C:\Windows\system32\WTFastDrv.dll
2015-03-23 19:21 - 2014-10-15 15:18 - 00072296 _____ (Initex) C:\Windows\SysWOW64\WTFastDrv.dll
2015-03-23 16:53 - 2015-03-24 00:23 - 00000000 ____D () C:\Users\Roberto C. Victoria\Downloads\The.Walking.Dead.S05E15.PROPER.HDTV.x264-BATV[ettv]
2015-03-23 16:52 - 2015-03-23 16:52 - 00034172 _____ () C:\Users\Roberto C. Victoria\Downloads\[kickass.to]the.walking.dead.s05e15.proper.hdtv.x264.batv.ettv.torrent
2015-03-23 14:59 - 2015-03-23 15:00 - 06006032 _____ (Initex & AAA Internet Publishing ) C:\Users\Roberto C. Victoria\Downloads\WTFastSetup.3.5.5.428.exe
2015-03-22 21:44 - 2015-03-22 21:46 - 00000000 ____D () C:\Users\Roberto C. Victoria\Desktop\New folder
2015-03-22 21:32 - 2015-03-22 21:33 - 00000000 ____D () C:\Users\Roberto C. Victoria\AppData\Roaming\GoPro
2015-03-22 21:32 - 2015-03-22 21:32 - 00000000 ____D () C:\Users\Roberto C. Victoria\AppData\Local\GoPro
2015-03-22 21:31 - 2015-03-22 21:32 - 00000000 ____D () C:\Users\Public\CineForm
2015-03-22 21:31 - 2015-03-22 21:31 - 00000000 ____D () C:\Program Files\DIFX
2015-03-22 21:31 - 2015-03-22 21:31 - 00000000 ____D () C:\Program Files (x86)\CineForm
2015-03-22 21:29 - 2015-03-24 19:05 - 00008750 _____ () C:\Windows\DPINST.LOG
2015-03-22 01:22 - 2015-03-22 01:22 - 00000000 ____D () C:\Users\Roberto C. Victoria\Downloads\Love.Rosie.2014.BDRip.X264-AMIABLE[et]
2015-03-22 01:21 - 2015-03-22 01:21 - 00066948 _____ () C:\Users\Roberto C. Victoria\Downloads\[kickass.to]love.rosie.2014.bdrip.x264.amiable.torrent
2015-03-20 19:27 - 2015-03-21 22:51 - 00000000 ____D () C:\Users\Roberto C. Victoria\Downloads\Focus.2015.HC.HDRip.XViD.AC3-juggs[ETRG]
2015-03-20 19:26 - 2015-03-20 19:26 - 00115079 _____ () C:\Users\Roberto C. Victoria\Downloads\[kickass.to]focus.2015.hc.hdrip.xvid.ac3.juggs.etrg.torrent
2015-03-20 09:13 - 2015-03-20 09:13 - 00000000 ____D () C:\Users\Roberto C. Victoria\Desktop\ClashBot 5.8
2015-03-19 15:57 - 2015-03-19 15:57 - 00002303 _____ () C:\Users\Roberto C. Victoria\Desktop\Chrome App Launcher.lnk
2015-03-19 15:57 - 2015-03-19 15:57 - 00000000 ____D () C:\Users\Roberto C. Victoria\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-03-19 15:33 - 2015-03-19 15:33 - 00000000 ____D () C:\Program Files (x86)\AutoIt3
2015-03-18 18:59 - 2015-03-21 18:07 - 00002235 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2015-03-18 18:59 - 2015-03-18 18:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-03-18 18:57 - 2015-03-24 19:02 - 00000924 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-03-18 18:57 - 2015-03-24 19:02 - 00000920 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-03-18 18:57 - 2015-03-18 18:57 - 00003920 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-03-18 18:57 - 2015-03-18 18:57 - 00003668 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-03-18 18:55 - 2015-03-18 18:57 - 00000000 ____D () C:\Users\Roberto C. Victoria\AppData\Local\Deployment
2015-03-18 09:38 - 2015-03-11 18:48 - 122905856 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-03-18 09:35 - 2015-03-18 09:37 - 41840320 _____ (Microsoft Corporation) C:\Users\Roberto C. Victoria\Downloads\Windows-KB890830-x64-V5.22.exe
2015-03-17 04:34 - 2015-03-20 01:13 - 00000000 ____D () C:\Users\Roberto C. Victoria\Downloads\The.Big.Bang.Theory.S05.Season.5.720p.5.1Ch.BluRay.ReEnc-DeeJayAhmed
2015-03-17 04:32 - 2015-03-17 07:11 - 00000000 ____D () C:\Users\Roberto C. Victoria\Downloads\The.Big.Bang.Theory.S04.Season.4.720p.5.1Ch.BluRay.ReEnc-DeeJayAhmed
2015-03-16 13:47 - 2015-03-17 07:56 - 00000000 ____D () C:\Users\Roberto C. Victoria\Downloads\The.Walking.Dead.S05E14.HDTV.x264-KILLERS[ettv]
2015-03-15 14:15 - 2015-03-24 15:37 - 00000000 ____D () C:\Users\Roberto C. Victoria\Desktop\ClashBot 5.7.3
2015-03-15 14:15 - 2015-03-15 14:15 - 00000000 ____D () C:\Users\Roberto C. Victoria\AppData\Local\AutoIt v3
2015-03-15 14:14 - 2015-03-19 15:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3
2015-03-15 14:11 - 2015-03-15 14:12 - 11878040 _____ (AutoIt Team) C:\Users\Roberto C. Victoria\Downloads\autoit-v3-setup.exe
2015-03-15 13:49 - 2015-03-17 07:56 - 00000000 ____D () C:\Users\Roberto C. Victoria\Downloads\Into the Woods (2014)
2015-03-15 11:55 - 2015-03-17 04:42 - 00000000 ____D () C:\Users\Roberto C. Victoria\Downloads\Agents.of.S.H.I.E.L.D.S01E01-22.WEB-DL.x264.AAC
2015-03-15 01:08 - 2015-03-17 07:56 - 00000000 ____D () C:\Users\Roberto C. Victoria\Downloads\The.Cobbler.2014.HDRip.XviD.AC3-EVO
2015-03-13 18:55 - 2015-03-13 18:55 - 00000011 _____ () C:\Users\Roberto C. Victoria\Desktop\ref number.txt
2015-03-12 00:19 - 2015-03-17 04:42 - 00000000 ____D () C:\Users\Roberto C. Victoria\Downloads\Exodus Gods and Kings (2014)
2015-03-11 20:30 - 2015-03-11 21:56 - 00000000 ____D () C:\Users\Roberto C. Victoria\Downloads\Fifty Shades of Grey 2015 UNCUT HC HDRIP x264 AC3 TiTAN
2015-03-09 15:35 - 2015-03-09 15:35 - 00000000 ____H () C:\Users\Roberto C. Victoria\AppData\Local\BIT4A58.tmp
2015-03-09 15:35 - 2015-03-09 15:35 - 00000000 _____ () C:\Users\Roberto C. Victoria\AppData\Local\{3112A20D-9C36-4238-906A-64F22A9FFBE1}
2015-03-08 07:12 - 2015-03-08 07:13 - 00000000 _____ () C:\Users\Roberto C. Victoria\AppData\Local\{0E2829C2-447E-4A9C-AB9C-6727AB37AD1D}
2015-03-02 16:11 - 2015-03-02 18:39 - 00000000 ____D () C:\Users\Roberto C. Victoria\Downloads\The Italian Job (2003)
2015-03-01 15:16 - 2015-03-19 12:15 - 00000000 ____D () C:\Users\Roberto C. Victoria\Desktop\IXDL
2015-02-25 02:54 - 2015-02-25 02:55 - 01164030 _____ () C:\Users\Roberto C. Victoria\Downloads\ixdl.zip
2015-02-23 07:02 - 2015-02-23 07:02 - 00000000 ____H () C:\Users\Roberto C. Victoria\AppData\Local\BITE6A7.tmp
2015-02-23 07:02 - 2015-02-23 07:02 - 00000000 _____ () C:\Users\Roberto C. Victoria\AppData\Local\{AB6CE8E7-42B8-45B6-85B2-5AF6BBBD4B43}
 
==================== One Month Modified Files and Folders =======
 
(If an entry is included in the fixlist, the file\folder will be moved.)
 
2015-03-24 19:39 - 2014-02-02 12:50 - 00000000 ____D () C:\Program Files (x86)\Steam
2015-03-24 19:15 - 2014-04-23 19:47 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-03-24 19:04 - 2009-07-14 12:45 - 00023680 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-03-24 19:04 - 2009-07-14 12:45 - 00023680 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-03-24 19:00 - 2014-02-02 01:11 - 01180322 _____ () C:\Windows\WindowsUpdate.log
2015-03-24 18:56 - 2009-07-14 13:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-03-24 18:56 - 2009-07-14 12:51 - 00138310 _____ () C:\Windows\setupact.log
2015-03-24 18:47 - 2009-07-14 11:20 - 00000000 ____D () C:\Windows\system32\NDF
2015-03-24 18:32 - 2010-11-21 11:47 - 00945530 _____ () C:\Windows\PFRO.log
2015-03-24 17:50 - 2014-05-27 08:45 - 00000984 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-4123428590-2453437171-1252692713-1000UA.job
2015-03-24 15:32 - 2009-07-14 11:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2015-03-24 05:57 - 2014-02-28 16:59 - 00000000 ____D () C:\Users\Roberto C. Victoria\AppData\Roaming\uTorrent
2015-03-24 00:23 - 2014-11-30 05:59 - 00402944 ___SH () C:\Users\Roberto C. Victoria\Downloads\Thumbs.db
2015-03-23 08:50 - 2014-05-27 08:45 - 00000962 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-4123428590-2453437171-1252692713-1000Core.job
2015-03-22 23:34 - 2009-07-14 13:13 - 00778150 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-03-22 21:55 - 2014-02-07 12:48 - 00000000 ____D () C:\Users\Roberto C. Victoria\AppData\Local\CrashDumps
2015-03-22 21:36 - 2014-02-01 10:01 - 00000000 ____D () C:\ProgramData\Package Cache
2015-03-19 15:33 - 2010-11-21 15:16 - 00000000 ____D () C:\Windows\ShellNew
2015-03-19 14:44 - 2014-09-13 05:21 - 00000000 ____D () C:\Users\Roberto C. Victoria\AppData\Local\Unity
2015-03-19 12:29 - 2014-03-17 14:43 - 00000000 ____D () C:\Users\Roberto C. Victoria\AppData\Roaming\Skype
2015-03-18 19:00 - 2014-02-01 09:53 - 00000000 ____D () C:\Users\Roberto C. Victoria\AppData\Local\Google
2015-03-18 18:59 - 2014-02-01 09:50 - 00000000 ____D () C:\Program Files (x86)\Google
2015-03-18 18:55 - 2014-02-20 00:34 - 00000000 ____D () C:\Users\Roberto C. Victoria\AppData\Local\Apps\2.0
2015-03-18 09:25 - 2014-02-01 09:50 - 00000000 ____D () C:\ProgramData\Google
2015-03-18 09:21 - 2014-04-08 11:44 - 00000000 ____D () C:\Program Files (x86)\Garena Plus
2015-03-17 13:21 - 2014-12-14 16:02 - 00000000 ____D () C:\Users\Roberto C. Victoria\AppData\Roaming\OBS
2015-03-14 08:21 - 2009-07-14 11:20 - 00000000 ___HD () C:\Windows\system32\GroupPolicy
2015-03-13 22:23 - 2014-12-14 16:01 - 00000000 ____D () C:\Program Files (x86)\OBS
2015-03-10 17:56 - 2009-07-14 13:08 - 00032560 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-03-01 15:56 - 2014-02-20 00:27 - 00007597 _____ () C:\Users\Roberto C. Victoria\AppData\Local\resmon.resmoncfg
2015-03-01 15:48 - 2014-02-01 09:53 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2015-03-01 15:44 - 2014-02-01 09:52 - 00000000 ____D () C:\ProgramData\Apple
2015-03-01 15:41 - 2014-11-08 12:47 - 00000000 ____D () C:\ProgramData\E1864A66-75E3-486a-BD95-D1B7D99A84A7
2015-02-27 16:30 - 2015-02-03 16:25 - 00000000 ____D () C:\Users\Roberto C. Victoria\Downloads\Big.Hero.6.2014.DVDSCR.XviD.AC3-EVO
2015-02-25 16:07 - 2015-02-19 10:59 - 00000000 ____D () C:\Users\Roberto C. Victoria\Downloads\Divergent (2014)
2015-02-25 16:07 - 2015-02-03 14:51 - 00000000 ____D () C:\Users\Roberto C. Victoria\Downloads\Gone Girl (2014)
2015-02-25 16:07 - 2015-02-02 06:53 - 00000000 ____D () C:\Users\Roberto C. Victoria\Downloads\Taken.3.2014.READNFO.HDRip.XviD.AC3-EVO
2015-02-25 16:07 - 2015-01-29 02:13 - 00000000 ____D () C:\Users\Roberto C. Victoria\Downloads\The Internship (2013)
2015-02-25 16:07 - 2015-01-25 15:07 - 00000000 ____D () C:\Users\Roberto C. Victoria\Downloads\Seventh.Son.2014.CAM.XviD-TODE
2015-02-24 04:17 - 2010-11-21 11:27 - 00295552 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
 
==================== Files in the root of some directories =======
 
2014-04-08 12:48 - 2014-04-08 12:48 - 0045270 _____ () C:\Users\Roberto C. Victoria\AppData\Roaming\room_v3.dat
2015-01-12 07:36 - 2015-01-12 07:37 - 0001181 _____ () C:\Users\Roberto C. Victoria\AppData\Roaming\trace_FilterInstaller.1.txt
2015-01-12 07:36 - 2015-01-12 07:45 - 0000919 _____ () C:\Users\Roberto C. Victoria\AppData\Roaming\trace_FilterInstaller.txt
2015-01-12 07:36 - 2015-01-12 07:45 - 0000000 _____ () C:\Users\Roberto C. Victoria\AppData\Roaming\trace_FilterInstaller.txt-CRT.txt
2015-03-09 15:35 - 2015-03-09 15:35 - 0000000 ____H () C:\Users\Roberto C. Victoria\AppData\Local\BIT4A58.tmp
2015-02-23 07:02 - 2015-02-23 07:02 - 0000000 ____H () C:\Users\Roberto C. Victoria\AppData\Local\BITE6A7.tmp
2015-02-17 23:25 - 2015-02-17 23:25 - 0002632 _____ () C:\Users\Roberto C. Victoria\AppData\Local\recently-used.xbel
2014-02-20 00:27 - 2015-03-01 15:56 - 0007597 _____ () C:\Users\Roberto C. Victoria\AppData\Local\resmon.resmoncfg
2015-03-08 07:12 - 2015-03-08 07:13 - 0000000 _____ () C:\Users\Roberto C. Victoria\AppData\Local\{0E2829C2-447E-4A9C-AB9C-6727AB37AD1D}
2015-03-09 15:35 - 2015-03-09 15:35 - 0000000 _____ () C:\Users\Roberto C. Victoria\AppData\Local\{3112A20D-9C36-4238-906A-64F22A9FFBE1}
2014-10-31 19:30 - 2014-10-31 19:30 - 0000000 _____ () C:\Users\Roberto C. Victoria\AppData\Local\{4ED82A27-F6FA-44AE-A41A-89FEF9D095BC}
2015-02-23 07:02 - 2015-02-23 07:02 - 0000000 _____ () C:\Users\Roberto C. Victoria\AppData\Local\{AB6CE8E7-42B8-45B6-85B2-5AF6BBBD4B43}
2014-12-08 15:39 - 2014-10-09 15:39 - 0000032 ____R () C:\ProgramData\hash.dat
 
Files to move or delete:
====================
C:\ProgramData\hash.dat
 
 
Some content of TEMP:
====================
C:\Users\Roberto C. Victoria\AppData\Local\Temp\ose00000.exe
C:\Users\Roberto C. Victoria\AppData\Local\Temp\Quarantine.exe
C:\Users\Roberto C. Victoria\AppData\Local\Temp\sqlite3.dll
C:\Users\Roberto C. Victoria\AppData\Local\Temp\_is77DD.exe
C:\Users\Roberto C. Victoria\AppData\Local\Temp\_is8C18.exe
 
 
==================== Bamital & volsnap Check =================
 
(There is no automatic fix for files that do not pass verification.)
 
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
 
LastRegBack: 2015-03-15 12:24
 
==================== End Of Log ============================
 
 
 
 
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 11-03-2015
Ran by Roberto C. Victoria at 2015-03-24 19:41:46
Running from \\OVETH_VICTORIA\Users\Roberto C. Victoria\Downloads
Boot Mode: Normal
==========================================================
 
 
==================== Security Center ========================
 
(If an entry is included in the fixlist, it will be removed.)
 
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 
==================== Installed Programs ======================
 
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 
µTorrent (HKU\S-1-5-21-4123428590-2453437171-1252692713-1000\...\uTorrent) (Version: 3.4.2.37754 - BitTorrent Inc.)
µTorrent (HKU\S-1-5-21-4123428590-2453437171-1252692713-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\uTorrent) (Version: 3.4.2.37754 - BitTorrent Inc.)
Adobe Flash Player 11 ActiveX (HKLM-x32\...\{E94EFAB6-653F-4837-9E8A-F6377CA1EC0D}) (Version: 11.8.800.175 - Adobe Systems Incorporated)
AMD Catalyst Install Manager (HKLM\...\{EDC0E654-60C7-758D-6B81-C8D3ACCEDEE5}) (Version: 8.0.915.0 - Advanced Micro Devices, Inc.)
ASUS Product Register Program (HKLM-x32\...\{C87D79F6-F813-4812-B7A9-CCCAAB8B1188}) (Version: 1.0.020 - ASUSTek Computer Inc.)
AutoIt v3.3.12.0 (HKLM-x32\...\AutoItv3) (Version: 3.3.12.0 - AutoIt Team)
BlueStacks App Player (HKLM-x32\...\BlueStacks App Player) (Version: 0.9.7.4101 - BlueStack Systems, Inc.)
BlueStacks Notification Center (HKLM-x32\...\{FDB8F715-FC8D-4C20-B614-E0361BB69A17}) (Version: 0.9.7.4101 - BlueStack Systems, Inc.)
Cisco EAP-FAST Module (HKLM-x32\...\{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}) (Version: 2.2.14 - Cisco Systems, Inc.)
Cisco LEAP Module (HKLM-x32\...\{51C7AD07-C3F6-4635-8E8A-231306D810FE}) (Version: 1.0.19 - Cisco Systems, Inc.)
Cisco PEAP Module (HKLM-x32\...\{ED5776D5-59B4-46B7-AF81-5F2D94D7C640}) (Version: 1.1.6 - Cisco Systems, Inc.)
Counter-Strike: Global Offensive (HKLM-x32\...\Steam App 730) (Version:  - Valve)
CyberLink PowerDirector (HKLM-x32\...\InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}) (Version: 8.0.2220 - CyberLink Corp.)
Dota 2 (HKLM-x32\...\Steam App 570) (Version:  - Valve)
Dota 2 Test (HKLM-x32\...\Steam App 205790) (Version:  - )
Dual-Core Optimizer (HKLM-x32\...\{9FD6F1A8-5550-46AF-8509-271DF0E768B5}) (Version: 1.1.4.0169 - AMD)
ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version:  - )
Facebook Video Calling 3.1.0.521 (HKLM-x32\...\{2091F234-EB58-4B80-8C96-8EB78C808CF7}) (Version: 3.1.521 - Skype Limited)
Foxit Reader (HKLM-x32\...\Foxit Reader) (Version:  - )
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 41.0.2272.101 - Google Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.26.9 - Google Inc.) Hidden
H1Z1 (HKLM-x32\...\Steam App 295110) (Version:  - Sony Online Entertainment)
HitmanPro 3.7 (HKLM\...\HitmanPro37) (Version: 3.7.9.238 - SurfRight B.V.)
Intel® Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1252 - Intel Corporation)
Malwarebytes Anti-Malware version 2.1.4.1018 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.4.1018 - Malwarebytes Corporation)
Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended (HKLM\...\Microsoft .NET Framework 4 Extended) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft Games for Windows - LIVE Redistributable (HKLM-x32\...\{F2508213-9989-4E85-A078-72BE483917EF}) (Version: 3.5.88.0 - Microsoft Corporation)
Microsoft Games for Windows Marketplace (HKLM-x32\...\{4CB0307C-565E-4441-86BE-0DF2E4FB828C}) (Version: 3.5.50.0 - Microsoft Corporation)
Microsoft Office Enterprise 2007 (HKLM-x32\...\ENTERPRISE) (Version: 12.0.4518.1014 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{3C3D696B-0DB7-3C6D-A356-3DB8CE541918}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\...\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)
NBA 2K15 (HKLM-x32\...\TkJBMksxNQ==_is1) (Version: 1 - )
NVIDIA PhysX (HKLM-x32\...\{80407BA7-7763-4395-AB98-5233F1B34E65}) (Version: 9.13.1220 - NVIDIA Corporation)
Open Broadcaster Software (HKLM-x32\...\Open Broadcaster Software) (Version:  - )
OpenAL (HKLM-x32\...\OpenAL) (Version:  - )
QuickTime (HKLM-x32\...\{7BE15435-2D3E-4B58-867F-9C75BED0208C}) (Version: 7.71.80.42 - Apple Inc.)
Ralink RT2870 Wireless LAN Card (HKLM-x32\...\{28DA7D8B-F9A4-4F18-8AA0-551B1E084D0D}) (Version: 1.5.14.0 - Ralink)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.67.1226.2012 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6767 - Realtek Semiconductor Corp.)
Skype™ 6.20 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 6.20.104 - Skype Technologies S.A.)
Steam (HKLM-x32\...\Steam) (Version:  - Valve Corporation)
VLC media player 1.1.7 (HKLM-x32\...\VLC media player) (Version: 1.1.7 - VideoLAN)
Winamp (remove only) (HKLM-x32\...\Winamp) (Version:  - )
Windows Live ID Sign-in Assistant (HKLM\...\{9B48B0AC-C813-4174-9042-476A887592C7}) (Version: 6.500.3165.0 - Microsoft Corporation)
WinRAR 5.01 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.01.0 - win.rar GmbH)
WTFast 3.5 (HKLM-x32\...\{12B4121D-5221-4AFC-9EDC-63B0CA139856}_is1) (Version: 3.5.5.428 - Initex & AAA Internet Publishing)
 
==================== Custom CLSID (selected items): ==========================
 
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
 
 
==================== Restore Points  =========================
 
18-03-2015 09:14:06 Removed Bonjour
18-03-2015 09:15:08 Removed Apple Mobile Device Support
18-03-2015 09:15:54 Removed Apple Software Update
18-03-2015 09:25:09 Removed Google Toolbar for Internet Explorer
22-03-2015 02:40:58 Windows Update
22-03-2015 21:26:54 Installed Microsoft Visual C++ 2005 Redistributable (x64)
22-03-2015 21:28:03 Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501
22-03-2015 21:28:17 Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005
22-03-2015 21:28:37 Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005
22-03-2015 21:28:58 Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005
22-03-2015 21:31:46 Device Driver Package Install: GoPro
22-03-2015 21:35:34 Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005
22-03-2015 21:36:02 Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501
22-03-2015 21:38:49 Removed Microsoft Visual C++ 2005 Redistributable (x64)
22-03-2015 21:39:42 Removed Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
24-03-2015 14:51:54 avast! antivirus system restore point
24-03-2015 18:14:19 Checkpoint by HitmanPro
24-03-2015 18:15:10 Checkpoint by HitmanPro
24-03-2015 18:20:07 avast! antivirus system restore point
24-03-2015 18:30:47 Restore Point Created by FRST
 
==================== Hosts content: ==========================
 
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 
2009-07-14 10:34 - 2009-06-11 05:00 - 00000824 ____N C:\Windows\system32\Drivers\etc\hosts
 
==================== Scheduled Tasks (whitelisted) =============
 
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
 
Task: {3C3EFDA9-F92E-484D-A953-DC86DA47C3AD} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-4123428590-2453437171-1252692713-1000Core => C:\Users\Roberto C. Victoria\AppData\Local\Facebook\Update\FacebookUpdate.exe [2014-05-27] (Facebook Inc.)
Task: {3F9001F6-35B4-47CE-B494-99CBCDFBE6A0} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-4123428590-2453437171-1252692713-1000UA => C:\Users\Roberto C. Victoria\AppData\Local\Facebook\Update\FacebookUpdate.exe [2014-05-27] (Facebook Inc.)
Task: {627C4AB4-C783-4342-B89C-ACEB74D181F7} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-04-23] (Adobe Systems Incorporated)
Task: {8C947C9A-38E0-4348-8A70-887C63E79C8F} - System32\Tasks\{9006ED57-0EFB-47EF-8211-7B8D8132A103} => pcalua.exe -a "C:\Users\Roberto C. Victoria\AppData\Roaming\istartsurf\UninstallManager.exe" -c -ptid=epom
Task: {98163A41-D3AB-4C31-93F2-FD28A0808355} - System32\Tasks\ASUS\ASUS Product Register Service => C:\Program Files (x86)\ASUS\APRP\aprp.exe [2013-01-25] (ASUSTek Computer Inc.)
Task: {E2A0E877-E31F-477D-B793-DADE47E92CAF} - System32\Tasks\FlashDrv => C:\Users\Roberto C. Victoria\AppData\Roaming\hwz.exe
Task: {EC3EFDBF-07DB-495D-8174-19808B5649A8} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-03-18] (Google Inc.)
Task: {FC4C35C0-C191-4FF7-A040-0039EE60BAA4} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-03-18] (Google Inc.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-4123428590-2453437171-1252692713-1000Core.job => C:\Users\Roberto C. Victoria\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-4123428590-2453437171-1252692713-1000UA.job => C:\Users\Roberto C. Victoria\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
 
==================== Loaded Modules (whitelisted) ==============
 
2005-11-16 03:31 - 2005-11-16 03:31 - 00033792 _____ () C:\Program Files (x86)\Winamp\winampa.exe
2014-02-01 09:53 - 2009-04-17 18:01 - 00247152 ____N () C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
2014-02-01 10:22 - 2011-09-15 16:55 - 01066856 _____ () C:\Program Files (x86)\Ralink\Common\RaWLAPI.dll
2015-03-21 18:07 - 2015-03-14 18:12 - 01174856 _____ () C:\Program Files (x86)\Google\Chrome\Application\41.0.2272.101\libglesv2.dll
2015-03-21 18:07 - 2015-03-14 18:12 - 00080200 _____ () C:\Program Files (x86)\Google\Chrome\Application\41.0.2272.101\libegl.dll
2015-03-21 18:07 - 2015-03-14 18:12 - 09278792 _____ () C:\Program Files (x86)\Google\Chrome\Application\41.0.2272.101\pdf.dll
2014-02-02 12:06 - 2012-06-25 10:41 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\ACE.dll
2015-03-21 18:07 - 2015-03-14 18:12 - 14974280 _____ () C:\Program Files (x86)\Google\Chrome\Application\41.0.2272.101\PepperFlash\pepflashplayer.dll
 
==================== Alternate Data Streams (whitelisted) =========
 
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
 
 
==================== Safe Mode (whitelisted) ===================
 
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 
 
==================== EXE Association (whitelisted) ===============
 
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
 
 
==================== Other Areas ============================
 
(Currently there is no automatic fix for this section.)
 
HKU\S-1-5-21-4123428590-2453437171-1252692713-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Roberto C. Victoria\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
HKU\S-1-5-21-4123428590-2453437171-1252692713-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Control Panel\Desktop\\Wallpaper -> C:\Users\Roberto C. Victoria\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.1.1
 
==================== MSCONFIG/TASK MANAGER disabled items ==
 
(Currently there is no automatic fix for this section.)
 
MSCONFIG\startupfolder: C:^Users^Roberto C. Victoria^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^MagicDisc.lnk => C:\Windows\pss\MagicDisc.lnk.Startup
MSCONFIG\startupreg: Akamai NetSession Interface => "C:\Users\Roberto C. Victoria\AppData\Local\Akamai\netsession_win.exe"
MSCONFIG\startupreg: BlueStacks Agent => C:\Program Files (x86)\BlueStacks\HD-Agent.exe
MSCONFIG\startupreg: GarenaPlus => "C:\Program Files (x86)\Garena Plus\GarenaMessenger.exe" -autolaunch
MSCONFIG\startupreg: VMSnap3 => C:\Windows\VMSnap3.exe
MSCONFIG\startupreg: WTFast Tray => "C:\Program Files (x86)\WTFast\WTFast.exe" trayonly
 
==================== Accounts: =============================
 
Administrator (S-1-5-21-4123428590-2453437171-1252692713-500 - Administrator - Disabled)
Guest (S-1-5-21-4123428590-2453437171-1252692713-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-4123428590-2453437171-1252692713-1002 - Limited - Enabled)
Roberto C. Victoria (S-1-5-21-4123428590-2453437171-1252692713-1000 - Administrator - Enabled) => C:\Users\Roberto C. Victoria
 
==================== Faulty Device Manager Devices =============
 
Name: PC Camera
Description: PC Camera
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
 
 
==================== Event log errors: =========================
 
Application errors:
==================
Error: (03/24/2015 07:30:58 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Activation context generation failed for "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1".Error in manifest or policy file "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" on line C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Component 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
 
Error: (03/24/2015 06:57:59 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
Error: (03/24/2015 06:57:36 PM) (Source: BstHdAndroidSvc) (EventID: 0) (User: )
Description: Service cannot be started. System.ApplicationException: Cannot start service.  Service did not stop gracefully the last time it was run.
   at BlueStacks.hyperDroid.Service.Service.OnStart(String[] args)
   at System.ServiceProcess.ServiceBase.ServiceQueuedMainCallback(Object state)
 
Error: (03/24/2015 06:45:38 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
Error: (03/24/2015 06:45:19 PM) (Source: BstHdAndroidSvc) (EventID: 0) (User: )
Description: Service cannot be started. System.ApplicationException: Cannot start service.  Service did not stop gracefully the last time it was run.
   at BlueStacks.hyperDroid.Service.Service.OnStart(String[] args)
   at System.ServiceProcess.ServiceBase.ServiceQueuedMainCallback(Object state)
 
Error: (03/24/2015 06:34:05 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
Error: (03/24/2015 06:33:44 PM) (Source: BstHdAndroidSvc) (EventID: 0) (User: )
Description: Service cannot be started. System.ApplicationException: Cannot start service.  Service did not stop gracefully the last time it was run.
   at BlueStacks.hyperDroid.Service.Service.OnStart(String[] args)
   at System.ServiceProcess.ServiceBase.ServiceQueuedMainCallback(Object state)
 
Error: (03/24/2015 06:30:47 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.
 
 
Details:
AddLegacyDriverFiles: Unable to back up image of binary avast! VM Monitor.
 
System Error:
The system cannot find the file specified.
.
 
Error: (03/24/2015 06:30:47 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.
 
 
Details:
AddLegacyDriverFiles: Unable to back up image of binary aswSP.
 
System Error:
The system cannot find the file specified.
.
 
Error: (03/24/2015 06:30:47 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.
 
 
Details:
AddLegacyDriverFiles: Unable to back up image of binary aswSnx.
 
System Error:
The system cannot find the file specified.
.
 
 
System errors:
=============
Error: (03/24/2015 07:25:01 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Steam Client Service service failed to start due to the following error: 
%%1053
 
Error: (03/24/2015 07:25:01 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the Steam Client Service service to connect.
 
Error: (03/24/2015 07:24:38 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Steam Client Service service failed to start due to the following error: 
%%1053
 
Error: (03/24/2015 07:24:38 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the Steam Client Service service to connect.
 
Error: (03/24/2015 06:57:52 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The Peer Networking Grouping service depends on the Peer Name Resolution Protocol service which failed to start because of the following error: 
%%-2140993535
 
Error: (03/24/2015 06:57:52 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: The Peer Name Resolution Protocol service terminated with the following error: 
%%-2140993535
 
Error: (03/24/2015 06:57:52 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The Peer Networking Grouping service depends on the Peer Name Resolution Protocol service which failed to start because of the following error: 
%%-2140993535
 
Error: (03/24/2015 06:57:52 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: The Peer Name Resolution Protocol service terminated with the following error: 
%%-2140993535
 
Error: (03/24/2015 06:57:52 PM) (Source: PNRPSvc) (EventID: 102) (User: )
Description: 0x80630801
 
Error: (03/24/2015 06:57:52 PM) (Source: PNRPSvc) (EventID: 102) (User: )
Description: 0x80630801
 
 
Microsoft Office Sessions:
=========================
 
==================== Memory info =========================== 
 
Processor: Intel® Core™ i3-3240 CPU @ 3.40GHz
Percentage of memory in use: 50%
Total physical RAM: 4043.36 MB
Available physical RAM: 2018.06 MB
Total Pagefile: 8084.91 MB
Available Pagefile: 5628.38 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB
 
==================== Drives ================================
 
Drive c: () (Fixed) (Total:465.66 GB) (Free:146.81 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
 
==================== MBR & Partition Table ==================
 
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: D24E0E1F)
Partition 1: (Active) - (Size=465.7 GB) - (Type=07 NTFS)
 
==================== End Of Log ============================
 
 
 
 
 


#4 deeprybka

deeprybka

  • Malware Response Team
  • 5,198 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Germany
  • Local time:07:49 PM

Posted 24 March 2015 - 07:06 AM

Hi,

 
warning.gif P2P warning

Going over your logs I noticed that you have µTorrent installed.

  • Avoid gaming sites, pirated software, cracking tools, keygens, and peer-to-peer (P2P) file sharing programs.
  • They are a security risk which can make your computer susceptible to a wide variety of malware infections, remote attacks, exposure of personal information, and identity theft. Many malicious worms and Trojans spread across P2P file sharing networks, gaming and underground sites.
  • Users visiting such pages may see innocuous-looking banner ads containing code which can trigger pop-up ads and malicious Flash ads that install viruses, Trojans and spyware. Ads are a target for hackers because they offer a stealthy way to distribute malware to a wide range of Internet users.
  • The best way to reduce the risk of infection is to avoid these types of web sites and not use any P2P applications.

It is pretty much certain that if you continue to use P2P programs, you will get infected again.
I would recommend that you uninstall µTorrent, however that choice is up to you. If you choose to remove these programs, you can do so via  hidden2.png > Control Panel > Add/Remove Programs.

If you wish to keep it, please do not use it until your computer is cleaned.


Step 1

frst.pngfrstfix.png

Press thew7.png + R on your keyboard at the same time. Type notepad and click OK.

  • Copy the entire content of the codebox below and paste into the notepad document:
    CloseProcesses:
    HKU\S-1-5-21-4123428590-2453437171-1252692713-1000\...\Run: [Boot computer] => wscript.exe //B "C:\Users\ROBERT~1.VIC\AppData\Local\Temp\Boot computer.vbs" <===== ATTENTION
    HKU\S-1-5-21-4123428590-2453437171-1252692713-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [Boot computer] => wscript.exe //B "C:\Users\ROBERT~1.VIC\AppData\Local\Temp\Boot computer.vbs" 
    Startup: C:\Users\Roberto C. Victoria\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Boot computer.vbs ()
    "C:\Users\ROBERT~1.VIC\AppData\Local\Temp\Boot computer.vbs"
    SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
    SearchScopes: HKU\.DEFAULT -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = 
    SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
    SearchScopes: HKU\S-1-5-19-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
    SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
    SearchScopes: HKU\S-1-5-20-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
    File: "C:\Users\Roberto C. Victoria\AppData\Roaming\hwz.exe"
    
  • Click File, Save As and type fixlist.txt as the File Name.

Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

  • Right-click on FRST.gif icon and select RunAsAdmin.jpg Run as Administrator to start the tool.
    (XP users click run after receipt of Windows Security Warning - Open File).
  • Press the Fix button just once and wait.
  • If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
  • When finished FRST will generate a log on the Desktop, called Fixlog.txt.

Please post it to your reply.


Step 2

Do you know how to make zip files? :)
 

  • Locate the file or folder that you want to compress.
  • Right-click the file or folder, point to Send to, and then click Compressed (zipped) folder.
    A new compressed folder is created in the same location. To rename it, right-click the folder, click Rename, and then type the new name.

 
I want you to do following:

Please search for that folder and create a zip-files of it. Please upload the zip-file to my channel.

C:\FRST\Quarantine

 
Thank you!

Step 3

frst.pngfrstscan.png

Start FRST with administator privileges.

  • Press the Scan button.
  • When finished, FRST will produce a log (FRST.txt) in the same directory the tool was run from.
    Please copy and paste the log in your next reply.

Edited by deeprybka, 24 March 2015 - 07:06 AM.

regards,
deeprybka
:busy:
Neminem laede, immo omnes, quantum potes, iuva. Arthur Schopenhauer
 
unite_blue.png
asap.png

#5 voicesinmyhead

voicesinmyhead
  • Topic Starter

  • Members
  • 16 posts
  • OFFLINE
  •  
  • Local time:01:49 AM

Posted 24 March 2015 - 07:22 AM

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 11-03-2015
Ran by Roberto C. Victoria at 2015-03-24 20:11:50 Run:2
Running from \\OVETH_VICTORIA\Users\Roberto C. Victoria\Downloads
Loaded Profiles: Roberto C. Victoria (Available profiles: Roberto C. Victoria)
Boot Mode: Normal
==============================================
 
Content of fixlist:
*****************
CloseProcesses:
HKU\S-1-5-21-4123428590-2453437171-1252692713-1000\...\Run: [Boot computer] => wscript.exe //B "C:\Users\ROBERT~1.VIC\AppData\Local\Temp\Boot computer.vbs" <===== ATTENTION
HKU\S-1-5-21-4123428590-2453437171-1252692713-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [Boot computer] => wscript.exe //B "C:\Users\ROBERT~1.VIC\AppData\Local\Temp\Boot computer.vbs" 
Startup: C:\Users\Roberto C. Victoria\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Boot computer.vbs ()
"C:\Users\ROBERT~1.VIC\AppData\Local\Temp\Boot computer.vbs"
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\.DEFAULT -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
File: "C:\Users\Roberto C. Victoria\AppData\Roaming\hwz.exe"
*****************
 
Processes closed successfully.
HKU\S-1-5-21-4123428590-2453437171-1252692713-1000\Software\Microsoft\Windows\CurrentVersion\Run\\Boot computer => value deleted successfully.
HKU\S-1-5-21-4123428590-2453437171-1252692713-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Windows\CurrentVersion\Run\\Boot computer => Value not found.
C:\Users\Roberto C. Victoria\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Boot computer.vbs => Moved successfully.
"C:\Users\ROBERT~1.VIC\AppData\Local\Temp\Boot computer.vbs" => File/Directory not found.
HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
"HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}" => Key deleted successfully.
HKCR\CLSID\{6A1806CD-94D4-4689-BA73-E35EA1EA9990} => Key not found. 
HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
HKU\S-1-5-19-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value not found.
HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
HKU\S-1-5-20-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value not found.
 
========================= File: "C:\Users\Roberto C. Victoria\AppData\Roaming\hwz.exe" ========================
 
"C:\Users\Roberto C. Victoria\AppData\Roaming\hwz.exe" not found.
====== End Of File: ======
 
 
 
The system needed a reboot. 
 
==== End of Fixlog 20:11:51 ====
 
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-03-2015
Ran by Roberto C. Victoria (administrator) on OVETH_VICTORIA on 24-03-2015 20:20:05
Running from \\OVETH_VICTORIA\Users\Roberto C. Victoria\Downloads
Loaded Profiles: Roberto C. Victoria (Available profiles: Roberto C. Victoria)
Platform: Windows 7 Ultimate Service Pack 1 (X64) OS Language: English (United States)
Internet Explorer Version 8 (Default browser: Chrome)
Boot Mode: Normal
 
==================== Processes (Whitelisted) =================
 
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 
(AMD) C:\Windows\System32\atiesrxx.exe
(SurfRight B.V.) C:\Program Files\HitmanPro\hmpsched.exe
(AMD) C:\Windows\System32\atieclxx.exe
(SurfRight B.V.) C:\Program Files\HitmanPro\HitmanPro.exe
(BlueStack Systems, Inc.) C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(BlueStack Systems, Inc.) C:\Program Files (x86)\BlueStacks\HD-UpdaterService.exe
(Intel® Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\Jhi_service.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Ralink Technology, Corp.) C:\Program Files (x86)\Ralink\Common\RaRegistry.exe
(Ralink Technology, Corp.) C:\Program Files (x86)\Ralink\Common\RaRegistry64.exe
() C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Farbar) \\OVETH_VICTORIA\Users\Roberto C. Victoria\Downloads\FRST64.exe
 
 
==================== Registry (Whitelisted) ==================
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6843024 2012-10-29] (Realtek Semiconductor)
HKLM\...\Run: [Domino] => C:\Windows\Domino.exe
HKLM\...\Run: [VMSnap3] => C:\Windows\VMSnap3.exe
HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [31016 2006-10-27] (Microsoft Corporation)
HKLM-x32\...\Run: [WinampAgent] => C:\Program Files (x86)\Winamp\winampa.exe [33792 2005-11-16] ()
HKLM-x32\...\Run: [UpdatePDRShortCut] => C:\Program Files (x86)\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe [218408 2008-12-03] (CyberLink Corp.)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [676608 2013-08-30] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [amd_dc_opt] => C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe [77824 2008-07-22] (AMD)
HKLM-x32\...\Run: [APSDaemon] => "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2011-10-24] (Apple Inc.)
HKU\S-1-5-21-4123428590-2453437171-1252692713-1000\...\Run: [Facebook Update] => C:\Users\Roberto C. Victoria\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2014-05-27] (Facebook Inc.)
HKU\S-1-5-21-4123428590-2453437171-1252692713-1000\...\Run: [WTFast Tray] => C:\Program Files (x86)\WTFast\WTFast.exe [4726872 2015-03-18] (AAA Internet Publishing, Inc.)
HKU\S-1-5-21-4123428590-2453437171-1252692713-1000\...\MountPoints2: {4bdd317d-fee5-11e3-b68b-ac220b27fba4} - E:\AutoRun.exe
HKU\S-1-5-21-4123428590-2453437171-1252692713-1000\...\MountPoints2: {941784d2-40cd-11e4-8f2f-ac220b27fba4} - E:\Startme.exe
HKU\S-1-5-21-4123428590-2453437171-1252692713-1000\...\MountPoints2: {b2807b9a-a9ef-11e4-a59b-ac220b27fba4} - G:\AutoRun.exe
HKU\S-1-5-21-4123428590-2453437171-1252692713-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\ssText3d.scr [333824 2010-11-21] (Microsoft Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Ralink Wireless Utility.lnk
ShortcutTarget: Ralink Wireless Utility.lnk -> C:\Program Files (x86)\Ralink\Common\RaUI.exe (Ralink Technology, Corp.)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  No File
BootExecute: autocheck autochk * bootdelete
 
==================== Internet (Whitelisted) ====================
 
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.msn.com/spbasic.htm
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-4123428590-2453437171-1252692713-1000\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie
HKU\S-1-5-21-4123428590-2453437171-1252692713-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://ph.msn.com/?rd=1&ucc=PH&dcc=PH&opt=0&ocid=iehp
SearchScopes: HKU\S-1-5-21-4123428590-2453437171-1252692713-1000 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = http://www.bing.com/search?FORM=UP94DF&PC=UP94&q={searchTerms}&src=IE-SearchBox
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> c:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18] (Microsoft Corporation)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2006-10-27] (Microsoft Corporation)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> c:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18] (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
 
FireFox:
========
FF ProfilePath: C:\Users\Roberto C. Victoria\AppData\Roaming\Mozilla\Firefox\Profiles\wm9rrhp4.default
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll [2012-06-06] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2012-06-06] (Intel Corporation)
FF Plugin-x32: @t.garena.com/garenatalk -> C:\Program Files (x86)\Garena Plus\bbtalk\plugins\npPlugin\npGarenaTalkPlugin.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-03-18] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-03-18] (Google Inc.)
FF Plugin HKU\S-1-5-21-4123428590-2453437171-1252692713-1000: @Skype Limited.com/Facebook Video Calling Plugin -> C:\Users\Roberto C. Victoria\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll [2014-07-24] (Skype Limited)
FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [Not Found]
 
Chrome: 
=======
CHR Profile: C:\Users\Roberto C. Victoria\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Drive) - C:\Users\Roberto C. Victoria\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-03-18]
CHR Extension: (YouTube) - C:\Users\Roberto C. Victoria\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-03-18]
CHR Extension: (Google Search) - C:\Users\Roberto C. Victoria\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-03-18]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Roberto C. Victoria\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-18]
CHR Extension: (Google Wallet) - C:\Users\Roberto C. Victoria\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-03-18]
CHR Extension: (Gmail) - C:\Users\Roberto C. Victoria\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-03-18]
 
==================== Services (Whitelisted) =================
 
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 
S2 BstHdAndroidSvc; C:\Program Files (x86)\BlueStacks\HD-Service.exe [409304 2014-12-12] (BlueStack Systems, Inc.)
R2 BstHdLogRotatorSvc; C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe [388824 2014-12-12] (BlueStack Systems, Inc.)
R2 BstHdUpdaterSvc; C:\Program Files (x86)\BlueStacks\HD-UpdaterService.exe [786136 2014-12-12] (BlueStack Systems, Inc.)
R2 HitmanProScheduler; C:\Program Files\HitmanPro\hmpsched.exe [127752 2015-03-24] (SurfRight B.V.)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [166720 2012-06-25] (Intel Corporation)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1080120 2015-03-17] (Malwarebytes Corporation)
S3 RaMediaServer; C:\Program Files (x86)\Ralink\Common\RaMediaServer.exe [625728 2011-08-18] ()
R2 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [247152 2009-04-17] ()
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2009-07-14] (Microsoft Corporation)
 
==================== Drivers (Whitelisted) ====================
 
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 
R2 BstHdDrv; C:\Program Files (x86)\BlueStacks\HD-Hypervisor-amd64.sys [122072 2014-12-12] (BlueStack Systems)
R3 hitmanpro37; C:\Windows\system32\drivers\hitmanpro37.sys [43664 2015-03-24] ()
R4 IOMap; C:\Windows\system32\drivers\IOMap64.sys [23680 2013-01-25] (ASUSTeK Computer Inc.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-03-17] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-03-17] (Malwarebytes Corporation)
S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [54784 2014-08-15] (Apple, Inc.) [File not signed]
S3 vvftav303; C:\Windows\System32\drivers\vvftav303.sys [308096 2007-06-23] (Vimicro Corporation)
S3 ZSMC0303; C:\Windows\System32\Drivers\usbVM303.sys [1494656 2007-03-25] (Vimicro Corporation)
S3 hxsyol; \??\C:\AeriaGames\AuraKingdom\avital\hxsy64.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
 
==================== NetSvcs (Whitelisted) ===================
 
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
 
 
==================== One Month Created Files and Folders ========
 
(If an entry is included in the fixlist, the file\folder will be moved.)
 
2015-03-24 20:16 - 2015-03-24 20:16 - 00043664 _____ () C:\Windows\system32\Drivers\hitmanpro37.sys
2015-03-24 19:41 - 2015-03-24 19:42 - 00021858 _____ () C:\Users\Roberto C. Victoria\Downloads\Addition.txt
2015-03-24 19:40 - 2015-03-24 20:20 - 00013034 _____ () C:\Users\Roberto C. Victoria\Downloads\FRST.txt
2015-03-24 18:37 - 2015-03-24 18:54 - 00014958 _____ () C:\Users\Roberto C. Victoria\Downloads\Result.txt
2015-03-24 18:37 - 2015-03-24 18:37 - 00402944 _____ (Farbar) C:\Users\Roberto C. Victoria\Downloads\MiniToolBox.exe
2015-03-24 18:30 - 2015-03-24 18:29 - 00077926 _____ () C:\Users\Roberto C. Victoria\Desktop\Fixlist.txt
2015-03-24 18:27 - 2015-03-24 20:20 - 00000000 ____D () C:\FRST
2015-03-24 18:26 - 2015-03-24 18:27 - 02095616 _____ (Farbar) C:\Users\Roberto C. Victoria\Downloads\FRST64.exe
2015-03-24 18:15 - 2015-03-24 18:15 - 00014674 _____ () C:\Windows\system32\.crusader
2015-03-24 18:10 - 2015-03-24 18:10 - 00000085 _____ () C:\Windows\wininit.ini
2015-03-24 18:04 - 2015-03-24 18:04 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking
2015-03-24 18:03 - 2015-03-24 18:16 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2015-03-24 18:03 - 2015-03-24 18:15 - 00000000 ____D () C:\ProgramData\HitmanPro
2015-03-24 18:03 - 2015-03-24 18:10 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2015-03-24 18:03 - 2015-03-24 18:03 - 00001897 _____ () C:\Users\Public\Desktop\HitmanPro.lnk
2015-03-24 18:03 - 2015-03-24 18:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HitmanPro
2015-03-24 18:03 - 2015-03-24 18:03 - 00000000 ____D () C:\Program Files\HitmanPro
2015-03-24 17:57 - 2015-03-24 18:55 - 00000000 ____D () C:\AdwCleaner
2015-03-24 17:55 - 2015-03-24 17:56 - 10995632 _____ (SurfRight B.V.) C:\Users\Roberto C. Victoria\Downloads\HitmanPro_x64.exe
2015-03-24 17:55 - 2015-03-24 17:56 - 02168320 _____ () C:\Users\Roberto C. Victoria\Downloads\adwcleaner_4.113.exe
2015-03-24 17:49 - 2015-03-24 17:59 - 46525608 _____ (Safer-Networking Ltd. ) C:\Users\Roberto C. Victoria\Downloads\spybot-2.4.exe
2015-03-24 15:01 - 2015-03-24 15:03 - 00000000 ____D () C:\Users\Roberto C. Victoria\AppData\Roaming\Dropbox
2015-03-24 14:52 - 2015-03-24 19:31 - 00136408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-03-24 14:52 - 2015-03-24 14:52 - 00001106 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2015-03-24 14:52 - 2015-03-24 14:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-03-24 14:52 - 2015-03-24 14:52 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-03-24 14:52 - 2015-03-24 14:52 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2015-03-24 14:52 - 2015-03-17 06:15 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-03-24 14:52 - 2015-03-17 06:15 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-03-24 14:52 - 2015-03-17 06:15 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-03-24 14:50 - 2015-03-24 18:32 - 00000000 ____D () C:\ProgramData\AVAST Software
2015-03-24 14:50 - 2015-03-24 14:52 - 21540440 _____ (Malwarebytes Corporation ) C:\Users\Roberto C. Victoria\Downloads\mbam-setup-2.1.4.1018.exe
2015-03-24 14:50 - 2015-03-24 14:50 - 05475064 _____ (Avast Software s.r.o.) C:\Users\Roberto C. Victoria\Downloads\avast_free_antivirus_setup_online.exe
2015-03-24 00:16 - 2015-03-24 14:47 - 00000000 ____D () C:\Users\Roberto C. Victoria\Downloads\How I Met Your Mother - Season 6
2015-03-23 19:21 - 2015-03-23 19:21 - 00000983 _____ () C:\Users\Public\Desktop\WTFast.lnk
2015-03-23 19:21 - 2015-03-23 19:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WTFast
2015-03-23 19:21 - 2015-03-23 19:21 - 00000000 ____D () C:\Program Files (x86)\WTFast
2015-03-23 19:21 - 2014-10-15 15:18 - 00079464 _____ (Initex) C:\Windows\system32\WTFastDrv.dll
2015-03-23 19:21 - 2014-10-15 15:18 - 00072296 _____ (Initex) C:\Windows\SysWOW64\WTFastDrv.dll
2015-03-23 16:53 - 2015-03-24 00:23 - 00000000 ____D () C:\Users\Roberto C. Victoria\Downloads\The.Walking.Dead.S05E15.PROPER.HDTV.x264-BATV[ettv]
2015-03-23 16:52 - 2015-03-23 16:52 - 00034172 _____ () C:\Users\Roberto C. Victoria\Downloads\[kickass.to]the.walking.dead.s05e15.proper.hdtv.x264.batv.ettv.torrent
2015-03-23 14:59 - 2015-03-23 15:00 - 06006032 _____ (Initex & AAA Internet Publishing ) C:\Users\Roberto C. Victoria\Downloads\WTFastSetup.3.5.5.428.exe
2015-03-22 21:44 - 2015-03-22 21:46 - 00000000 ____D () C:\Users\Roberto C. Victoria\Desktop\New folder
2015-03-22 21:32 - 2015-03-22 21:33 - 00000000 ____D () C:\Users\Roberto C. Victoria\AppData\Roaming\GoPro
2015-03-22 21:32 - 2015-03-22 21:32 - 00000000 ____D () C:\Users\Roberto C. Victoria\AppData\Local\GoPro
2015-03-22 21:31 - 2015-03-22 21:32 - 00000000 ____D () C:\Users\Public\CineForm
2015-03-22 21:31 - 2015-03-22 21:31 - 00000000 ____D () C:\Program Files\DIFX
2015-03-22 21:31 - 2015-03-22 21:31 - 00000000 ____D () C:\Program Files (x86)\CineForm
2015-03-22 21:29 - 2015-03-24 19:05 - 00008750 _____ () C:\Windows\DPINST.LOG
2015-03-22 01:22 - 2015-03-22 01:22 - 00000000 ____D () C:\Users\Roberto C. Victoria\Downloads\Love.Rosie.2014.BDRip.X264-AMIABLE[et]
2015-03-22 01:21 - 2015-03-22 01:21 - 00066948 _____ () C:\Users\Roberto C. Victoria\Downloads\[kickass.to]love.rosie.2014.bdrip.x264.amiable.torrent
2015-03-20 19:27 - 2015-03-21 22:51 - 00000000 ____D () C:\Users\Roberto C. Victoria\Downloads\Focus.2015.HC.HDRip.XViD.AC3-juggs[ETRG]
2015-03-20 19:26 - 2015-03-20 19:26 - 00115079 _____ () C:\Users\Roberto C. Victoria\Downloads\[kickass.to]focus.2015.hc.hdrip.xvid.ac3.juggs.etrg.torrent
2015-03-20 09:13 - 2015-03-20 09:13 - 00000000 ____D () C:\Users\Roberto C. Victoria\Desktop\ClashBot 5.8
2015-03-19 15:57 - 2015-03-19 15:57 - 00002303 _____ () C:\Users\Roberto C. Victoria\Desktop\Chrome App Launcher.lnk
2015-03-19 15:57 - 2015-03-19 15:57 - 00000000 ____D () C:\Users\Roberto C. Victoria\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-03-19 15:33 - 2015-03-19 15:33 - 00000000 ____D () C:\Program Files (x86)\AutoIt3
2015-03-18 18:59 - 2015-03-21 18:07 - 00002235 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2015-03-18 18:59 - 2015-03-18 18:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-03-18 18:57 - 2015-03-24 20:13 - 00000920 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-03-18 18:57 - 2015-03-24 20:02 - 00000924 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-03-18 18:57 - 2015-03-18 18:57 - 00003920 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-03-18 18:57 - 2015-03-18 18:57 - 00003668 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-03-18 18:55 - 2015-03-18 18:57 - 00000000 ____D () C:\Users\Roberto C. Victoria\AppData\Local\Deployment
2015-03-18 09:38 - 2015-03-11 18:48 - 122905856 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-03-18 09:35 - 2015-03-18 09:37 - 41840320 _____ (Microsoft Corporation) C:\Users\Roberto C. Victoria\Downloads\Windows-KB890830-x64-V5.22.exe
2015-03-17 04:34 - 2015-03-20 01:13 - 00000000 ____D () C:\Users\Roberto C. Victoria\Downloads\The.Big.Bang.Theory.S05.Season.5.720p.5.1Ch.BluRay.ReEnc-DeeJayAhmed
2015-03-17 04:32 - 2015-03-17 07:11 - 00000000 ____D () C:\Users\Roberto C. Victoria\Downloads\The.Big.Bang.Theory.S04.Season.4.720p.5.1Ch.BluRay.ReEnc-DeeJayAhmed
2015-03-16 13:47 - 2015-03-17 07:56 - 00000000 ____D () C:\Users\Roberto C. Victoria\Downloads\The.Walking.Dead.S05E14.HDTV.x264-KILLERS[ettv]
2015-03-15 14:15 - 2015-03-24 15:37 - 00000000 ____D () C:\Users\Roberto C. Victoria\Desktop\ClashBot 5.7.3
2015-03-15 14:15 - 2015-03-15 14:15 - 00000000 ____D () C:\Users\Roberto C. Victoria\AppData\Local\AutoIt v3
2015-03-15 14:14 - 2015-03-19 15:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3
2015-03-15 14:11 - 2015-03-15 14:12 - 11878040 _____ (AutoIt Team) C:\Users\Roberto C. Victoria\Downloads\autoit-v3-setup.exe
2015-03-15 13:49 - 2015-03-17 07:56 - 00000000 ____D () C:\Users\Roberto C. Victoria\Downloads\Into the Woods (2014)
2015-03-15 11:55 - 2015-03-17 04:42 - 00000000 ____D () C:\Users\Roberto C. Victoria\Downloads\Agents.of.S.H.I.E.L.D.S01E01-22.WEB-DL.x264.AAC
2015-03-15 01:08 - 2015-03-17 07:56 - 00000000 ____D () C:\Users\Roberto C. Victoria\Downloads\The.Cobbler.2014.HDRip.XviD.AC3-EVO
2015-03-13 18:55 - 2015-03-13 18:55 - 00000011 _____ () C:\Users\Roberto C. Victoria\Desktop\ref number.txt
2015-03-12 00:19 - 2015-03-17 04:42 - 00000000 ____D () C:\Users\Roberto C. Victoria\Downloads\Exodus Gods and Kings (2014)
2015-03-11 20:30 - 2015-03-11 21:56 - 00000000 ____D () C:\Users\Roberto C. Victoria\Downloads\Fifty Shades of Grey 2015 UNCUT HC HDRIP x264 AC3 TiTAN
2015-03-09 15:35 - 2015-03-09 15:35 - 00000000 ____H () C:\Users\Roberto C. Victoria\AppData\Local\BIT4A58.tmp
2015-03-09 15:35 - 2015-03-09 15:35 - 00000000 _____ () C:\Users\Roberto C. Victoria\AppData\Local\{3112A20D-9C36-4238-906A-64F22A9FFBE1}
2015-03-08 07:12 - 2015-03-08 07:13 - 00000000 _____ () C:\Users\Roberto C. Victoria\AppData\Local\{0E2829C2-447E-4A9C-AB9C-6727AB37AD1D}
2015-03-02 16:11 - 2015-03-02 18:39 - 00000000 ____D () C:\Users\Roberto C. Victoria\Downloads\The Italian Job (2003)
2015-03-01 15:16 - 2015-03-19 12:15 - 00000000 ____D () C:\Users\Roberto C. Victoria\Desktop\IXDL
2015-02-25 02:54 - 2015-02-25 02:55 - 01164030 _____ () C:\Users\Roberto C. Victoria\Downloads\ixdl.zip
2015-02-23 07:02 - 2015-02-23 07:02 - 00000000 ____H () C:\Users\Roberto C. Victoria\AppData\Local\BITE6A7.tmp
2015-02-23 07:02 - 2015-02-23 07:02 - 00000000 _____ () C:\Users\Roberto C. Victoria\AppData\Local\{AB6CE8E7-42B8-45B6-85B2-5AF6BBBD4B43}
 
==================== One Month Modified Files and Folders =======
 
(If an entry is included in the fixlist, the file\folder will be moved.)
 
2015-03-24 20:15 - 2014-04-23 19:47 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-03-24 20:12 - 2009-07-14 13:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-03-24 20:12 - 2009-07-14 12:51 - 00138366 _____ () C:\Windows\setupact.log
2015-03-24 20:11 - 2014-02-02 01:11 - 01183751 _____ () C:\Windows\WindowsUpdate.log
2015-03-24 19:51 - 2014-03-17 14:43 - 00000000 ____D () C:\Users\Roberto C. Victoria\AppData\Roaming\Skype
2015-03-24 19:39 - 2014-02-02 12:50 - 00000000 ____D () C:\Program Files (x86)\Steam
2015-03-24 19:04 - 2009-07-14 12:45 - 00023680 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-03-24 19:04 - 2009-07-14 12:45 - 00023680 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-03-24 18:47 - 2009-07-14 11:20 - 00000000 ____D () C:\Windows\system32\NDF
2015-03-24 18:32 - 2010-11-21 11:47 - 00945530 _____ () C:\Windows\PFRO.log
2015-03-24 17:50 - 2014-05-27 08:45 - 00000984 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-4123428590-2453437171-1252692713-1000UA.job
2015-03-24 15:32 - 2009-07-14 11:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2015-03-24 05:57 - 2014-02-28 16:59 - 00000000 ____D () C:\Users\Roberto C. Victoria\AppData\Roaming\uTorrent
2015-03-24 00:23 - 2014-11-30 05:59 - 00402944 ___SH () C:\Users\Roberto C. Victoria\Downloads\Thumbs.db
2015-03-23 08:50 - 2014-05-27 08:45 - 00000962 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-4123428590-2453437171-1252692713-1000Core.job
2015-03-22 23:34 - 2009-07-14 13:13 - 00778150 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-03-22 21:55 - 2014-02-07 12:48 - 00000000 ____D () C:\Users\Roberto C. Victoria\AppData\Local\CrashDumps
2015-03-22 21:36 - 2014-02-01 10:01 - 00000000 ____D () C:\ProgramData\Package Cache
2015-03-19 15:33 - 2010-11-21 15:16 - 00000000 ____D () C:\Windows\ShellNew
2015-03-19 14:44 - 2014-09-13 05:21 - 00000000 ____D () C:\Users\Roberto C. Victoria\AppData\Local\Unity
2015-03-18 19:00 - 2014-02-01 09:53 - 00000000 ____D () C:\Users\Roberto C. Victoria\AppData\Local\Google
2015-03-18 18:59 - 2014-02-01 09:50 - 00000000 ____D () C:\Program Files (x86)\Google
2015-03-18 18:55 - 2014-02-20 00:34 - 00000000 ____D () C:\Users\Roberto C. Victoria\AppData\Local\Apps\2.0
2015-03-18 09:25 - 2014-02-01 09:50 - 00000000 ____D () C:\ProgramData\Google
2015-03-18 09:21 - 2014-04-08 11:44 - 00000000 ____D () C:\Program Files (x86)\Garena Plus
2015-03-17 13:21 - 2014-12-14 16:02 - 00000000 ____D () C:\Users\Roberto C. Victoria\AppData\Roaming\OBS
2015-03-14 08:21 - 2009-07-14 11:20 - 00000000 ___HD () C:\Windows\system32\GroupPolicy
2015-03-13 22:23 - 2014-12-14 16:01 - 00000000 ____D () C:\Program Files (x86)\OBS
2015-03-10 17:56 - 2009-07-14 13:08 - 00032560 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-03-01 15:56 - 2014-02-20 00:27 - 00007597 _____ () C:\Users\Roberto C. Victoria\AppData\Local\resmon.resmoncfg
2015-03-01 15:48 - 2014-02-01 09:53 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2015-03-01 15:44 - 2014-02-01 09:52 - 00000000 ____D () C:\ProgramData\Apple
2015-03-01 15:41 - 2014-11-08 12:47 - 00000000 ____D () C:\ProgramData\E1864A66-75E3-486a-BD95-D1B7D99A84A7
2015-02-27 16:30 - 2015-02-03 16:25 - 00000000 ____D () C:\Users\Roberto C. Victoria\Downloads\Big.Hero.6.2014.DVDSCR.XviD.AC3-EVO
2015-02-25 16:07 - 2015-02-19 10:59 - 00000000 ____D () C:\Users\Roberto C. Victoria\Downloads\Divergent (2014)
2015-02-25 16:07 - 2015-02-03 14:51 - 00000000 ____D () C:\Users\Roberto C. Victoria\Downloads\Gone Girl (2014)
2015-02-25 16:07 - 2015-02-02 06:53 - 00000000 ____D () C:\Users\Roberto C. Victoria\Downloads\Taken.3.2014.READNFO.HDRip.XviD.AC3-EVO
2015-02-25 16:07 - 2015-01-29 02:13 - 00000000 ____D () C:\Users\Roberto C. Victoria\Downloads\The Internship (2013)
2015-02-25 16:07 - 2015-01-25 15:07 - 00000000 ____D () C:\Users\Roberto C. Victoria\Downloads\Seventh.Son.2014.CAM.XviD-TODE
2015-02-24 04:17 - 2010-11-21 11:27 - 00295552 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
 
==================== Files in the root of some directories =======
 
2014-04-08 12:48 - 2014-04-08 12:48 - 0045270 _____ () C:\Users\Roberto C. Victoria\AppData\Roaming\room_v3.dat
2015-01-12 07:36 - 2015-01-12 07:37 - 0001181 _____ () C:\Users\Roberto C. Victoria\AppData\Roaming\trace_FilterInstaller.1.txt
2015-01-12 07:36 - 2015-01-12 07:45 - 0000919 _____ () C:\Users\Roberto C. Victoria\AppData\Roaming\trace_FilterInstaller.txt
2015-01-12 07:36 - 2015-01-12 07:45 - 0000000 _____ () C:\Users\Roberto C. Victoria\AppData\Roaming\trace_FilterInstaller.txt-CRT.txt
2015-03-09 15:35 - 2015-03-09 15:35 - 0000000 ____H () C:\Users\Roberto C. Victoria\AppData\Local\BIT4A58.tmp
2015-02-23 07:02 - 2015-02-23 07:02 - 0000000 ____H () C:\Users\Roberto C. Victoria\AppData\Local\BITE6A7.tmp
2015-02-17 23:25 - 2015-02-17 23:25 - 0002632 _____ () C:\Users\Roberto C. Victoria\AppData\Local\recently-used.xbel
2014-02-20 00:27 - 2015-03-01 15:56 - 0007597 _____ () C:\Users\Roberto C. Victoria\AppData\Local\resmon.resmoncfg
2015-03-08 07:12 - 2015-03-08 07:13 - 0000000 _____ () C:\Users\Roberto C. Victoria\AppData\Local\{0E2829C2-447E-4A9C-AB9C-6727AB37AD1D}
2015-03-09 15:35 - 2015-03-09 15:35 - 0000000 _____ () C:\Users\Roberto C. Victoria\AppData\Local\{3112A20D-9C36-4238-906A-64F22A9FFBE1}
2014-10-31 19:30 - 2014-10-31 19:30 - 0000000 _____ () C:\Users\Roberto C. Victoria\AppData\Local\{4ED82A27-F6FA-44AE-A41A-89FEF9D095BC}
2015-02-23 07:02 - 2015-02-23 07:02 - 0000000 _____ () C:\Users\Roberto C. Victoria\AppData\Local\{AB6CE8E7-42B8-45B6-85B2-5AF6BBBD4B43}
2014-12-08 15:39 - 2014-10-09 15:39 - 0000032 ____R () C:\ProgramData\hash.dat
 
Files to move or delete:
====================
C:\ProgramData\hash.dat
 
 
Some content of TEMP:
====================
C:\Users\Roberto C. Victoria\AppData\Local\Temp\ose00000.exe
C:\Users\Roberto C. Victoria\AppData\Local\Temp\Quarantine.exe
C:\Users\Roberto C. Victoria\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Roberto C. Victoria\AppData\Local\Temp\sqlite3.dll
C:\Users\Roberto C. Victoria\AppData\Local\Temp\_is77DD.exe
C:\Users\Roberto C. Victoria\AppData\Local\Temp\_is8C18.exe
 
 
==================== Bamital & volsnap Check =================
 
(There is no automatic fix for files that do not pass verification.)
 
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
 
LastRegBack: 2015-03-15 12:24
 
==================== End Of Log ============================

Btw i uninstalled utorrent and won't use such programs like those neither would do p2p.



#6 deeprybka

deeprybka

  • Malware Response Team
  • 5,198 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Germany
  • Local time:07:49 PM

Posted 24 March 2015 - 07:27 AM

What about the upload?


regards,
deeprybka
:busy:
Neminem laede, immo omnes, quantum potes, iuva. Arthur Schopenhauer
 
unite_blue.png
asap.png

#7 voicesinmyhead

voicesinmyhead
  • Topic Starter

  • Members
  • 16 posts
  • OFFLINE
  •  
  • Local time:01:49 AM

Posted 24 March 2015 - 07:29 AM

I did upload it. Want me to do it again?



#8 voicesinmyhead

voicesinmyhead
  • Topic Starter

  • Members
  • 16 posts
  • OFFLINE
  •  
  • Local time:01:49 AM

Posted 24 March 2015 - 07:33 AM

Your file was successfully submitted. Please let the user helping you know that you have submitted the file.



#9 deeprybka

deeprybka

  • Malware Response Team
  • 5,198 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Germany
  • Local time:07:49 PM

Posted 24 March 2015 - 07:38 AM

OK. Thank you!

How is the computer running?


regards,
deeprybka
:busy:
Neminem laede, immo omnes, quantum potes, iuva. Arthur Schopenhauer
 
unite_blue.png
asap.png

#10 voicesinmyhead

voicesinmyhead
  • Topic Starter

  • Members
  • 16 posts
  • OFFLINE
  •  
  • Local time:01:49 AM

Posted 24 March 2015 - 07:41 AM

Im getting unwanted advertisement in the program im playing, and it doesnt suppose to have ads like this. http://i.imgur.com/86nrOlq.jpg 

 

EDIT: On my phone im not getting transferred to adultyuminfo anymore. 

EDIT: Do you want me to run another FRST scan? Im still getting some ads on the program i play.


Edited by voicesinmyhead, 24 March 2015 - 08:16 AM.


#11 voicesinmyhead

voicesinmyhead
  • Topic Starter

  • Members
  • 16 posts
  • OFFLINE
  •  
  • Local time:01:49 AM

Posted 24 March 2015 - 08:26 AM

Im getting pop-ups again. 



#12 voicesinmyhead

voicesinmyhead
  • Topic Starter

  • Members
  • 16 posts
  • OFFLINE
  •  
  • Local time:01:49 AM

Posted 24 March 2015 - 09:39 AM

Additional info, while using browser i noticed the bottomleft of the screen having "waiting for adultcamera.info"



#13 deeprybka

deeprybka

  • Malware Response Team
  • 5,198 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Germany
  • Local time:07:49 PM

Posted 24 March 2015 - 12:20 PM

Step 1

v21logo.PNG

Scan with Malwarebytes Anti-Malware.

  • Please open Malwarebytes Anti-Malware and update the database.
  • Click "Settings" [1] and go to "Detection and Protection" [2]
  • Make sure "Scan for Rootkits" is checked.
  • Click on Dashboard [3], then click on Scan Now [4] to start the scan.
    :exclame: If Malware or Potentially Unwanted Programs [PUPs] are found, you will receive a prompt:
    m21p.png
  • Click on "Remove Selected" [5].
  • Then click "Save Results" [6] and select
    m21p4.png
  • Return to our forum. Paste your log into your next reply and then click Finish [7].

mbamv21.gif



Step 2


Scan with esetlogo.pngOnline Scanner.

  • Start installer.pngwith administartor privileges.
  • Select the option Yes, I accept the Terms of Use and click on Start.
  • Choose the following settings:

settings.png

  • Click on Start. The virus signature database will begin to download. This may take some time.
  • When completed the Online Scan will begin automatically.
    Note: This scan might take a long time! Please be patient.
  • When completed select Uninstall application on close if you so wish, but make sure you copy the logfile first!
  • Now click on Finish
  • A log filelog.pngis created at logpath.png
    Copy and paste the content of this log file in your next reply.

esetlog.png

eset.gif


regards,
deeprybka
:busy:
Neminem laede, immo omnes, quantum potes, iuva. Arthur Schopenhauer
 
unite_blue.png
asap.png

#14 voicesinmyhead

voicesinmyhead
  • Topic Starter

  • Members
  • 16 posts
  • OFFLINE
  •  
  • Local time:01:49 AM

Posted 24 March 2015 - 09:30 PM

Malwarebytes Anti-Malware
www.malwarebytes.org
 
Scan Date: 3/25/2015
Scan Time: 9:26:33 AM
Logfile: 
Administrator: Yes
 
Version: 2.01.4.1018
Malware Database: v2015.03.24.09
Rootkit Database: v2015.02.25.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled
 
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: Roberto C. Victoria
 
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 415747
Time Elapsed: 20 min, 59 sec
 
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled
 
Processes: 0
(No malicious items detected)
 
Modules: 0
 
 
 
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=87e8bd99fbb97c418a29ebb4a36bb1b6
# engine=17495
# end=finished
# remove_checked=true
# archives_checked=false
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-03-18 06:07:07
# local_time=2014-03-19 02:07:07 (+0800, China Standard Time)
# country="United States"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=3591 16777213 100 91 1455323 157759012 0 0
# compatibility_mode=5893 16776574 100 94 104007616 146795877 0 0
# scanned=151529
# found=1
# cleaned=1
# scan_time=2553
sh=949382E751987B199BB9D17989848F8CBE8FA045 ft=1 fh=c394361ae6df9cdc vn="a variant of Win32/Packed.VMProtect.AAA trojan (cleaned by deleting - quarantined)" ac=C fn="C:\Program Files (x86)\WB Games\Batman Arkham City GOTY\Binaries\Win32\buddha.dll"
ESETSmartInstaller@High as downloader log:
Can not open internetESETSmartInstaller@High as downloader log:
Can not open internet# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=87e8bd99fbb97c418a29ebb4a36bb1b6
# engine=17555
# end=finished
# remove_checked=false
# archives_checked=false
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-03-22 09:35:56
# local_time=2014-03-22 05:35:56 (+0800, China Standard Time)
# country="United States"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=3591 16777213 100 91 1770252 158073941 0 0
# compatibility_mode=5893 16776574 100 94 104322545 147110806 0 0
# scanned=124554
# found=0
# cleaned=0
# scan_time=2263
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=87e8bd99fbb97c418a29ebb4a36bb1b6
# engine=17594
# end=stopped
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-03-25 03:28:38
# local_time=2014-03-25 11:28:38 (+0800, China Standard Time)
# country="United States"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=3591 16777213 100 91 2007414 158311103 0 0
# compatibility_mode=5893 16776574 100 94 104559707 147347968 0 0
# scanned=128705
# found=14
# cleaned=13
# scan_time=6626
sh=0000000000000000000000000000000000000000 ft=- fh=0000000000000000 vn="a variant of Win32/HackTool.Crack.BQ potentially unsafe application" ac=I fn="C:\Users\Roberto C. Victoria\Downloads\Saints.Row.IV-RELOADED\rld-saints4.iso"
sh=144AD18DA0C3EADBEB1495FDEA01A37FCEF59CEF ft=1 fh=69fe12774fa2e3ab vn="a variant of Win32/HackTool.Crack.BQ potentially unsafe application (deleted - quarantined)" ac=C fn="C:\Program Files (x86)\Saints Row IV\steam_api.dll"
sh=C15F72BFF8A4165FD02C86E9828EA1EBD3E6C785 ft=1 fh=8e65d34befd30553 vn="Win32/GameTool.AE potentially unsafe application (deleted - quarantined)" ac=C fn="C:\Program Files (x86)\WB Games\Batman Arkham City GOTY\Binaries\Win32\batmanac.exe"
sh=F89D0D35647789000A23E8BD1E557BEE519A6BAE ft=1 fh=4f81c51847428f3f vn="Win32/Toolbar.Conduit potentially unwanted application (deleted - quarantined)" ac=C fn="C:\Users\Roberto C. Victoria\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7MVYJ10N\statisticsstub[1].exe"
sh=19ABA6684BCC412F05765360E6E827B8BCE95DF5 ft=1 fh=63ef31a0a9eaeb81 vn="Win32/Conduit.SearchProtect.J potentially unwanted application (deleted - quarantined)" ac=C fn="C:\Users\Roberto C. Victoria\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\88O0QX3Q\utorrentcontrol_v6[1].exe"
sh=4C265AAF9AE88D06269ADD7034D63A115606DDFA ft=1 fh=3189627c07c08170 vn="Win32/Toolbar.Conduit.S potentially unwanted application (deleted - quarantined)" ac=C fn="C:\Users\Roberto C. Victoria\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I12UCRGW\conduitinstaller[1].exe"
sh=1426B95F2619E462F812F6807C88694DF9FBECE7 ft=1 fh=a10496de67a69999 vn="Win32/Toolbar.Conduit.S potentially unwanted application (deleted - quarantined)" ac=C fn="C:\Users\Roberto C. Victoria\AppData\Local\Temp\utt789D.tmp.exe"
sh=19ABA6684BCC412F05765360E6E827B8BCE95DF5 ft=1 fh=63ef31a0a9eaeb81 vn="Win32/Conduit.SearchProtect.J potentially unwanted application (deleted - quarantined)" ac=C fn="C:\Users\Roberto C. Victoria\AppData\Local\Temp\ct3289075\chLogic.exe"
sh=F89D0D35647789000A23E8BD1E557BEE519A6BAE ft=1 fh=4f81c51847428f3f vn="Win32/Toolbar.Conduit potentially unwanted application (deleted - quarantined)" ac=C fn="C:\Users\Roberto C. Victoria\AppData\Local\Temp\ct3289075\statisticsStub.exe"
sh=4C265AAF9AE88D06269ADD7034D63A115606DDFA ft=1 fh=3189627c07c08170 vn="Win32/Toolbar.Conduit.S potentially unwanted application (deleted - quarantined)" ac=C fn="C:\Users\Roberto C. Victoria\AppData\Local\Temp\ct3289075\stub.exe"
sh=E85071E9CF98E0110258558A4E2FC97BA314C742 ft=1 fh=2466bd484c5ce74d vn="a variant of MSIL/HackTool.WinActivator.A potentially unsafe application (deleted - quarantined)" ac=C fn="C:\Users\Roberto C. Victoria\Desktop\Windows7 Activator\Crack\Other Loader & Activator\Loader.exe"
sh=55936E2E6F22B344D582AE38E284E0CD3B9872D6 ft=1 fh=28f58ddc2a10fec0 vn="a variant of Win32/Packed.FlyStudio potentially unwanted application (deleted - quarantined)" ac=C fn="C:\Users\Roberto C. Victoria\Desktop\Windows7 Activator\Crack\SLIC Dump ToolKit v2.0\SLIC_Dump_ToolKit.EXE"
sh=F12715F4574C8A76035C88749E4D1B7A02D134D9 ft=1 fh=3fadd3c9f7b7ed28 vn="Win32/OutBrowse.M potentially unwanted application (deleted - quarantined)" ac=C fn="C:\Users\Roberto C. Victoria\Downloads\Installer.exe"
sh=C71A427C7E8CF8C8D78A8AC10F733D238239EACA ft=1 fh=4b77fa41e9bae0fa vn="a variant of Win32/Toolbar.Widgi.B potentially unwanted application (deleted - quarantined)" ac=C fn="C:\Users\Roberto C. Victoria\Downloads\YTDSetup.exe"
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=87e8bd99fbb97c418a29ebb4a36bb1b6
# engine=17615
# end=stopped
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-03-26 12:10:02
# local_time=2014-03-26 08:10:02 (+0800, China Standard Time)
# country="United States"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=3591 16777213 100 91 2081898 158385587 0 0
# compatibility_mode=5893 16776574 100 94 104634191 147422452 0 0
# scanned=128442
# found=1
# cleaned=0
# scan_time=4134
sh=0000000000000000000000000000000000000000 ft=- fh=0000000000000000 vn="a variant of Win32/HackTool.Crack.BQ potentially unsafe application" ac=I fn="C:\Users\Roberto C. Victoria\Downloads\Saints.Row.IV-RELOADED\rld-saints4.iso"
ESETSmartInstaller@High as downloader log:
all ok
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=87e8bd99fbb97c418a29ebb4a36bb1b6
# engine=17739
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-04-03 02:21:20
# local_time=2014-04-03 10:21:20 (+0800, China Standard Time)
# country="United States"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=5893 16776573 100 94 105376469 148164730 0 0
# scanned=125814
# found=0
# cleaned=0
# scan_time=1900
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=87e8bd99fbb97c418a29ebb4a36bb1b6
# engine=17766
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-04-05 01:47:04
# local_time=2014-04-05 09:47:04 (+0800, China Standard Time)
# country="United States"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=5893 16776573 100 94 105547213 148335474 0 0
# scanned=126952
# found=0
# cleaned=0
# scan_time=1840
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=87e8bd99fbb97c418a29ebb4a36bb1b6
# engine=17802
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-04-08 09:38:21
# local_time=2014-04-09 05:38:21 (+0800, China Standard Time)
# country="United States"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=5893 16776573 100 94 105834690 148622951 0 0
# scanned=128293
# found=0
# cleaned=0
# scan_time=1906
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=87e8bd99fbb97c418a29ebb4a36bb1b6
# engine=17898
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-04-15 04:25:42
# local_time=2014-04-16 12:25:42 (+0800, China Standard Time)
# country="United States"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=5893 16776573 100 94 106420731 149208992 0 0
# scanned=129177
# found=1
# cleaned=1
# scan_time=2207
sh=AFF6A0B931E685F3EDFA8F1A40C61D5E22F53664 ft=1 fh=c3679581e85d90a2 vn="Win32/Somoto.N potentially unwanted application (deleted - quarantined)" ac=C fn="C:\Users\Roberto C. Victoria\AppData\Local\Google\Chrome\User Data\Default\File System\003\t\00\00000000"
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=87e8bd99fbb97c418a29ebb4a36bb1b6
# engine=17961
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-04-20 05:52:37
# local_time=2014-04-21 01:52:37 (+0800, China Standard Time)
# country="United States"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=5893 16776573 100 94 106857946 149646207 0 0
# scanned=134293
# found=0
# cleaned=0
# scan_time=1936
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=87e8bd99fbb97c418a29ebb4a36bb1b6
# engine=18018
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-04-24 02:56:19
# local_time=2014-04-24 10:56:19 (+0800, China Standard Time)
# country="United States"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=5893 16776573 100 94 107192968 149981229 0 0
# scanned=127263
# found=0
# cleaned=0
# scan_time=1941
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=87e8bd99fbb97c418a29ebb4a36bb1b6
# engine=18102
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-05-01 04:18:37
# local_time=2014-05-02 12:18:37 (+0800, China Standard Time)
# country="United States"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=5893 16776573 100 94 107802706 150590967 0 0
# scanned=43336
# found=0
# cleaned=0
# scan_time=787
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=87e8bd99fbb97c418a29ebb4a36bb1b6
# engine=18168
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-05-07 01:34:53
# local_time=2014-05-07 09:34:53 (+0800, China Standard Time)
# country="United States"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=5893 16776573 100 94 108311282 151099543 0 0
# scanned=130132
# found=0
# cleaned=0
# scan_time=2036
ESETSmartInstaller@High as downloader log:
Can not open internetESETSmartInstaller@High as downloader log:
Can not open internet# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7587
# api_version=3.0.2
# EOSSerial=87e8bd99fbb97c418a29ebb4a36bb1b6
# engine=18618
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-06-08 03:13:42
# local_time=2014-06-08 11:13:42 (+0800, China Standard Time)
# country="United States"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 0 153870272 0 0
# scanned=139686
# found=7
# cleaned=7
# scan_time=2663
sh=27738781BF4ABC06E4BC5DEB2D8BFE91BAB5FA3D ft=0 fh=0000000000000000 vn="a variant of Win32/Toolbar.Conduit.AH potentially unwanted application (deleted - quarantined)" ac=C fn="C:\Users\Roberto C. Victoria\AppData\Local\CRE\cflheckfmhopnialghigdlggahiomebp.crx"
sh=6863112048ED20CD2C0605D7E8A7D6FCAA0D3591 ft=1 fh=69741d3a7390f0e9 vn="a variant of Win32/Toolbar.Conduit.AH potentially unwanted application (deleted - quarantined)" ac=C fn="C:\Users\Roberto C. Victoria\AppData\Local\NativeMessaging\CT3289075\1_0_1_5\TBMessagingHost.exe"
sh=9C0EEA6ED5C24FF7402A524F5E8B57D9F1071C09 ft=1 fh=31ddce437a8f4067 vn="a variant of Win32/Conduit.SearchProtect.N potentially unwanted application (deleted - quarantined)" ac=C fn="C:\Users\Roberto C. Victoria\AppData\Local\tbccint\Chrome\CT3289075\CHUninstaller.exe"
sh=91F440A8F2A0FFC91EDA87FE5410B93141B1C6B0 ft=1 fh=1ce5d7cf83504dfe vn="Win32/Toolbar.Conduit.AF potentially unwanted application (deleted - quarantined)" ac=C fn="C:\Users\Roberto C. Victoria\AppData\Local\Temp\ct3289075\ctbe.exe"
sh=27738781BF4ABC06E4BC5DEB2D8BFE91BAB5FA3D ft=0 fh=0000000000000000 vn="a variant of Win32/Toolbar.Conduit.AH potentially unwanted application (deleted - quarantined)" ac=C fn="C:\Users\Roberto C. Victoria\AppData\Local\Temp\NativeMessaging\CT3289075.crx"
sh=6863112048ED20CD2C0605D7E8A7D6FCAA0D3591 ft=1 fh=69741d3a7390f0e9 vn="a variant of Win32/Toolbar.Conduit.AH potentially unwanted application (deleted - quarantined)" ac=C fn="C:\Users\Roberto C. Victoria\AppData\Local\Temp\NativeMessaging\CT3289075\nativeMessaging\TBMessagingHost.exe"
sh=6863112048ED20CD2C0605D7E8A7D6FCAA0D3591 ft=1 fh=69741d3a7390f0e9 vn="a variant of Win32/Toolbar.Conduit.AH potentially unwanted application (deleted - quarantined)" ac=C fn="C:\Users\Roberto C. Victoria\AppData\Local\Temp\TestIfExeExist\CT3289075\nativeMessaging\TBMessagingHost.exe"
ESETSmartInstaller@High as downloader log:
Can not open internetESETSmartInstaller@High as downloader log:
Can not open internet# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7587
# api_version=3.0.2
# EOSSerial=87e8bd99fbb97c418a29ebb4a36bb1b6
# engine=18771
# end=finished
# remove_checked=false
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-06-18 04:58:03
# local_time=2014-06-19 12:58:03 (+0800, China Standard Time)
# country="United States"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 0 154740533 0 0
# scanned=140173
# found=0
# cleaned=0
# scan_time=1772
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7587
# api_version=3.0.2
# EOSSerial=87e8bd99fbb97c418a29ebb4a36bb1b6
# engine=18828
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-06-22 10:53:03
# local_time=2014-06-23 06:53:03 (+0800, China Standard Time)
# country="United States"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 274068 155107433 0 0
# scanned=140192
# found=0
# cleaned=0
# scan_time=2303
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7587
# api_version=3.0.2
# EOSSerial=87e8bd99fbb97c418a29ebb4a36bb1b6
# engine=18938
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-06-29 04:44:00
# local_time=2014-06-30 12:44:00 (+0800, China Standard Time)
# country="United States"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 8261 155690090 0 0
# scanned=132713
# found=0
# cleaned=0
# scan_time=2069
ESETSmartInstaller@High as downloader log:
Can not open internetESETSmartInstaller@High as downloader log:
Can not open internetESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=87e8bd99fbb97c418a29ebb4a36bb1b6
# engine=19418
# end=stopped
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-07-30 12:30:46
# local_time=2014-07-30 08:30:46 (+0800, China Standard Time)
# country="United States"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 611035 158353296 0 0
# scanned=137275
# found=3
# cleaned=2
# scan_time=2795
sh=4BFBE6CFB81BAC58D8491B4E4FCB5D8CEC5F314A ft=0 fh=0000000000000000 vn="a variant of Win32/Toolbar.Conduit.B potentially unwanted application" ac=I fn="C:\Users\Roberto C. Victoria\Downloads\CS_Xtreme_V6.rar"
sh=F8077DD45F59D8964156896E305312CD109D75F8 ft=1 fh=07b2413872c62cbb vn="a variant of Win32/Bundled.Toolbar.Ask.G potentially unsafe application (deleted - quarantined)" ac=C fn="C:\Program Files (x86)\AskBarDis\bar\bin\askBar.dll"
sh=2E520FBD3FE988FB085B7331A9AECF591630574B ft=1 fh=526a30f969bfb710 vn="a variant of Win32/Bundled.Toolbar.Ask.G potentially unsafe application (deleted - quarantined)" ac=C fn="C:\Program Files (x86)\AskBarDis\bar\bin\askPopStp.dll"
ESETSmartInstaller@High as downloader log:
Can not open internetESETSmartInstaller@High as downloader log:
Can not open internet# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=87e8bd99fbb97c418a29ebb4a36bb1b6
# engine=19418
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-07-30 01:30:55
# local_time=2014-07-30 09:30:55 (+0800, China Standard Time)
# country="United States"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 614644 158356905 0 0
# scanned=137562
# found=1
# cleaned=1
# scan_time=3455
sh=4BFBE6CFB81BAC58D8491B4E4FCB5D8CEC5F314A ft=0 fh=0000000000000000 vn="a variant of Win32/Toolbar.Conduit.B potentially unwanted application (deleted - quarantined)" ac=C fn="C:\Users\Roberto C. Victoria\Downloads\CS_Xtreme_V6.rar"
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=87e8bd99fbb97c418a29ebb4a36bb1b6
# engine=20019
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-09-05 05:24:44
# local_time=2014-09-06 01:24:44 (+0800, China Standard Time)
# country="United States"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 3379 161567734 0 0
# scanned=126776
# found=24
# cleaned=22
# scan_time=2969
sh=6148DAB05D76E4FCEF4B394B0F60D9ADB2E2AB1E ft=1 fh=c71c0011346812ac vn="Win32/ELEX.AV potentially unwanted application" ac=I fn="C:\Users\All Users\IePluginServices\PluginService.exe"
sh=77918B0878255FC1383E41084977C8CF7CD463D9 ft=1 fh=c71c00119ea191b0 vn="a variant of Win32/ELEX.AM potentially unwanted application" ac=I fn="C:\Users\All Users\WindowsMangerProtect\ProtectWindowsManager.exe"
sh=15ED5B6C5946E85E7A5C77F4A7689E4E76CCBAFB ft=1 fh=c71c0011fe889422 vn="Win32/Thinknice.E potentially unwanted application (deleted - quarantined)" ac=C fn="C:\Program Files (x86)\SupTab\DpInterface32.dll"
sh=8FF07C7F0E7320A1EB53CADD4D30D3154FF33BBA ft=1 fh=f622fe8cae001c0b vn="Win64/Thinknice.F potentially unwanted application (deleted - quarantined)" ac=C fn="C:\Program Files (x86)\SupTab\DpInterface64.dll"
sh=532A232C336AB1E5D65E829DFA191A71B96E2CC6 ft=1 fh=c71c001152b88659 vn="Win32/Thinknice.E potentially unwanted application (deleted - quarantined)" ac=C fn="C:\Program Files (x86)\SupTab\HpUI.exe"
sh=12EBF6FC8AD543662053CA101C2D5DA175137EB2 ft=1 fh=c71c00119e5c1a87 vn="Win32/Thinknice.E potentially unwanted application (deleted - quarantined)" ac=C fn="C:\Program Files (x86)\SupTab\Loader32.exe"
sh=8F0ABE23DDA3F9DC04497B1A4F455AF8CE9D45B8 ft=1 fh=787e176d56997de7 vn="Win64/Thinknice.E potentially unwanted application (deleted (after the next restart) - quarantined)" ac=C fn="C:\Program Files (x86)\SupTab\Loader64.exe"
sh=9E99BBE4E9F6026A66DB442D589FF049D44E43E9 ft=1 fh=c71c001149569c6f vn="Win32/ELEX.AV potentially unwanted application (deleted - quarantined)" ac=C fn="C:\Program Files (x86)\SupTab\RSHP.exe"
sh=55B49E6175EC153F5F6D595F7E36CF04D61C70AC ft=1 fh=c71c0011122aac36 vn="Win32/Thinknice.E potentially unwanted application (deleted - quarantined)" ac=C fn="C:\Program Files (x86)\SupTab\SearchProtect32.dll"
sh=B1740CE6528491D6914E0015C836A3A8E31A28E9 ft=1 fh=667e6cf17acea18e vn="Win64/Thinknice.F potentially unwanted application (deleted - quarantined)" ac=C fn="C:\Program Files (x86)\SupTab\SearchProtect64.dll"
sh=6148DAB05D76E4FCEF4B394B0F60D9ADB2E2AB1E ft=1 fh=c71c0011346812ac vn="Win32/ELEX.AV potentially unwanted application (deleted - quarantined)" ac=C fn="C:\Program Files (x86)\SupTab\SupIePluginServiceUpdate.exe"
sh=03DBFA1572019E6B0A7745CA443E74CCA8FEEFFD ft=1 fh=c71c0011e74d8dee vn="Win32/Thinknice.B potentially unwanted application (deleted - quarantined)" ac=C fn="C:\Program Files (x86)\SupTab\SupTab.dll"
sh=E9BEAFD5EF09360852ECDCC4312188064742E51A ft=1 fh=c71c0011421e8e27 vn="Win32/Thinknice.E potentially unwanted application (deleted - quarantined)" ac=C fn="C:\Program Files (x86)\SupTab\uninstall.exe"
sh=E3C659B9CAA4B5CFF2906CA02EB3F178906A2416 ft=1 fh=c71c00117f5fd915 vn="Win32/Thinknice.E potentially unwanted application (deleted - quarantined)" ac=C fn="C:\Program Files (x86)\SupTab\WindowsSupportDll32.dll"
sh=8B488C388E304F78CA88312A651D07494469D292 ft=1 fh=8013085d4e45f122 vn="Win64/Thinknice.D potentially unwanted application (deleted (after the next restart) - quarantined)" ac=C fn="C:\Program Files (x86)\SupTab\WindowsSupportDll64.dll"
sh=6148DAB05D76E4FCEF4B394B0F60D9ADB2E2AB1E ft=1 fh=c71c0011346812ac vn="Win32/ELEX.AV potentially unwanted application (deleted (after the next restart) - quarantined)" ac=C fn="C:\ProgramData\IePluginServices\PluginService.exe"
sh=77918B0878255FC1383E41084977C8CF7CD463D9 ft=1 fh=c71c00119ea191b0 vn="a variant of Win32/ELEX.AM potentially unwanted application (deleted - quarantined)" ac=C fn="C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe"
sh=833CAD3E4AE4F649A74510BA74EC65DC2D5C7753 ft=1 fh=250c58550bbf6ff7 vn="a variant of Win32/4Shared.U potentially unwanted application (deleted - quarantined)" ac=C fn="C:\Users\Roberto C. Victoria\AppData\Local\Google\Chrome\User Data\Default\File System\004\t\00\00000000"
sh=58C1D37324A5C9B7BAB774D454999D5C0381BC4E ft=1 fh=94d3261ca93bdcc1 vn="a variant of Win32/Toolbar.Conduit.AJ potentially unwanted application (deleted - quarantined)" ac=C fn="C:\Users\Roberto C. Victoria\AppData\Local\tbccint\Chrome\CT3289075\UninstallerUI.exe"
sh=0000000000000000000000000000000000000000 ft=- fh=0000000000000000 vn="VBS/Agent.NDH worm (cleaned by deleting (after the next restart) - quarantined)" ac=C fn="C:\Users\Roberto C. Victoria\AppData\Local\Temp\Boot computer.vbs"
sh=AF7351F6A5DA98E57430615DB06E2C15DA184119 ft=1 fh=43bad33fb8ca1fa7 vn="a variant of Win32/ELEX.AT potentially unwanted application (deleted - quarantined)" ac=C fn="C:\Users\Roberto C. Victoria\AppData\Local\Temp\UNTB28D.tmp.exe"
sh=D401DE8EB53AF53CED22EDD1593EBA2B6BFA167F ft=1 fh=5eaa9956739b0c55 vn="Win32/Flashbot.A worm (cleaned by deleting - quarantined)" ac=C fn="C:\Users\Roberto C. Victoria\AppData\Roaming\hwz.exe"
sh=14900456C388D8B5419CB0BDCD5918BFD754FE45 ft=0 fh=0000000000000000 vn="VBS/Agent.NDH worm (cleaned by deleting - quarantined)" ac=C fn="C:\Users\Roberto C. Victoria\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Boot computer.vbs"
sh=833CAD3E4AE4F649A74510BA74EC65DC2D5C7753 ft=1 fh=250c58550bbf6ff7 vn="a variant of Win32/4Shared.U potentially unwanted application (deleted - quarantined)" ac=C fn="C:\Users\Roberto C. Victoria\Downloads\God's Not Dead (201...0p BrRip x264 - YIFY.exe"
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=87e8bd99fbb97c418a29ebb4a36bb1b6
# engine=20070
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-09-09 12:11:19
# local_time=2014-09-09 08:11:19 (+0800, China Standard Time)
# country="United States"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 0 161894529 0 0
# scanned=139036
# found=2
# cleaned=2
# scan_time=3046
sh=0000000000000000000000000000000000000000 ft=- fh=0000000000000000 vn="VBS/Agent.NDH worm (cleaned by deleting (after the next restart) - quarantined)" ac=C fn="C:\Users\Roberto C. Victoria\AppData\Local\Temp\Boot computer.vbs"
sh=14900456C388D8B5419CB0BDCD5918BFD754FE45 ft=0 fh=0000000000000000 vn="VBS/Agent.NDH worm (cleaned by deleting - quarantined)" ac=C fn="C:\Users\Roberto C. Victoria\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Boot computer.vbs"
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=87e8bd99fbb97c418a29ebb4a36bb1b6
# engine=20100
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-09-11 05:18:21
# local_time=2014-09-11 01:18:21 (+0800, China Standard Time)
# country="United States"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 0 162042551 0 0
# scanned=138138
# found=0
# cleaned=0
# scan_time=2709
ESETSmartInstaller@High as downloader log:
Can not open internetESETSmartInstaller@High as downloader log:
Can not open internet# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=87e8bd99fbb97c418a29ebb4a36bb1b6
# engine=20133
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-09-13 01:21:07
# local_time=2014-09-13 09:21:07 (+0800, China Standard Time)
# country="United States"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 14419 162201117 0 0
# scanned=140614
# found=0
# cleaned=0
# scan_time=2566
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=87e8bd99fbb97c418a29ebb4a36bb1b6
# engine=20139
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-09-13 02:05:59
# local_time=2014-09-13 10:05:59 (+0800, China Standard Time)
# country="United States"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 60311 162247009 0 0
# scanned=140301
# found=0
# cleaned=0
# scan_time=3014
ESETSmartInstaller@High as downloader log:
Can not open internetESETSmartInstaller@High as downloader log:
Can not open internet# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=87e8bd99fbb97c418a29ebb4a36bb1b6
# engine=20154
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-09-15 05:58:05
# local_time=2014-09-15 01:58:05 (+0800, China Standard Time)
# country="United States"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 203836 162390534 0 0
# scanned=118873
# found=0
# cleaned=0
# scan_time=2495
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=87e8bd99fbb97c418a29ebb4a36bb1b6
# engine=20187
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-09-17 12:25:23
# local_time=2014-09-17 08:25:23 (+0800, China Standard Time)
# country="United States"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 43549 162543373 0 0
# scanned=144080
# found=0
# cleaned=0
# scan_time=2263
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=87e8bd99fbb97c418a29ebb4a36bb1b6
# engine=20202
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-09-17 10:13:35
# local_time=2014-09-18 06:13:35 (+0800, China Standard Time)
# country="United States"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 122041 162621865 0 0
# scanned=144463
# found=0
# cleaned=0
# scan_time=2793
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=87e8bd99fbb97c418a29ebb4a36bb1b6
# engine=20283
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-09-24 06:51:51
# local_time=2014-09-25 02:51:51 (+0800, China Standard Time)
# country="United States"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 364690 163214561 0 0
# scanned=46863
# found=0
# cleaned=0
# scan_time=936
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=87e8bd99fbb97c418a29ebb4a36bb1b6
# engine=20301
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-09-25 07:27:02
# local_time=2014-09-26 03:27:02 (+0800, China Standard Time)
# country="United States"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 76975 163303072 0 0
# scanned=144727
# found=1
# cleaned=1
# scan_time=2832
sh=420CE901B4933C2A04D5E242E6ECDC016A8188FB ft=1 fh=fd26318b8a28963f vn="Win32/Somoto.Q potentially unwanted application (deleted - quarantined)" ac=C fn="C:\Users\Roberto C. Victoria\AppData\Local\Temp\UNTB28F.tmp.exe"
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=87e8bd99fbb97c418a29ebb4a36bb1b6
# engine=20343
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-09-29 08:26:06
# local_time=2014-09-29 04:26:06 (+0800, China Standard Time)
# country="United States"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 37255 163609016 0 0
# scanned=145332
# found=0
# cleaned=0
# scan_time=2274
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=87e8bd99fbb97c418a29ebb4a36bb1b6
# engine=20373
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-09-30 07:05:48
# local_time=2014-10-01 03:05:48 (+0800, China Standard Time)
# country="United States"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 74429 163733798 0 0
# scanned=147487
# found=0
# cleaned=0
# scan_time=3052
ESETSmartInstaller@High as downloader log:
Can not open internetESETSmartInstaller@High as downloader log:
Can not open internet# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=87e8bd99fbb97c418a29ebb4a36bb1b6
# engine=20457
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-10-06 08:07:40
# local_time=2014-10-06 04:07:40 (+0800, China Standard Time)
# country="United States"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 421284 164212710 0 0
# scanned=146403
# found=0
# cleaned=0
# scan_time=2810
ESETSmartInstaller@High as downloader log:
all ok
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=87e8bd99fbb97c418a29ebb4a36bb1b6
# engine=20502
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-10-08 03:44:33
# local_time=2014-10-08 11:44:33 (+0800, China Standard Time)
# country="United States"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 621497 164412923 0 0
# scanned=146838
# found=0
# cleaned=0
# scan_time=2276
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=87e8bd99fbb97c418a29ebb4a36bb1b6
# engine=20544
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-10-11 06:44:04
# local_time=2014-10-11 02:44:04 (+0800, China Standard Time)
# country="United States"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 0 164639693 0 0
# scanned=123973
# found=0
# cleaned=0
# scan_time=2565
ESETSmartInstaller@High as downloader log:
Can not open internetESETSmartInstaller@High as downloader log:
Can not open internetCan not open internetESETSmartInstaller@High as downloader log:
Can not open internetCan not open internetESETSmartInstaller@High as downloader log:
Can not open internetCan not open internetESETSmartInstaller@High as downloader log:
Can not open internet# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=87e8bd99fbb97c418a29ebb4a36bb1b6
# engine=20544
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-10-11 06:53:42
# local_time=2014-10-11 02:53:42 (+0800, China Standard Time)
# country="United States"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 0 164640272 0 0
# scanned=20264
# found=0
# cleaned=0
# scan_time=400
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=87e8bd99fbb97c418a29ebb4a36bb1b6
# engine=20547
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-10-11 10:29:05
# local_time=2014-10-11 06:29:05 (+0800, China Standard Time)
# country="United States"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 0 164653195 0 0
# scanned=138888
# found=0
# cleaned=0
# scan_time=2306
ESETSmartInstaller@High as downloader log:
Can not open internetESETSmartInstaller@High as downloader log:
Can not open internetCan not open internetESETSmartInstaller@High as downloader log:
Can not open internetCan not open internetESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=87e8bd99fbb97c418a29ebb4a36bb1b6
# engine=20628
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-10-16 11:50:30
# local_time=2014-10-16 07:50:30 (+0800, China Standard Time)
# country="United States"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 0 165090080 0 0
# scanned=15715
# found=0
# cleaned=0
# scan_time=718
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=87e8bd99fbb97c418a29ebb4a36bb1b6
# engine=20628
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-10-16 01:19:07
# local_time=2014-10-16 09:19:07 (+0800, China Standard Time)
# country="United States"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 0 165095396 0 0
# scanned=141811
# found=0
# cleaned=0
# scan_time=3735
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=87e8bd99fbb97c418a29ebb4a36bb1b6
# engine=20646
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-10-17 09:11:14
# local_time=2014-10-17 05:11:14 (+0800, China Standard Time)
# country="United States"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 43882 165166924 0 0
# scanned=141622
# found=0
# cleaned=0
# scan_time=1983
ESETSmartInstaller@High as downloader log:
Can not open internetESETSmartInstaller@High as downloader log:
Can not open internet# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=87e8bd99fbb97c418a29ebb4a36bb1b6
# engine=20673
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-10-19 03:54:50
# local_time=2014-10-19 11:54:50 (+0800, China Standard Time)
# country="United States"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 6218 165363940 0 0
# scanned=144956
# found=0
# cleaned=0
# scan_time=2199
ESETSmartInstaller@High as downloader log:
Can not open internetESETSmartInstaller@High as downloader log:
Can not open internet# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=87e8bd99fbb97c418a29ebb4a36bb1b6
# engine=20912
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-11-03 08:34:01
# local_time=2014-11-04 04:34:01 (+0800, China Standard Time)
# country="United States"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 725746 166676691 0 0
# scanned=145147
# found=0
# cleaned=0
# scan_time=2399
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=87e8bd99fbb97c418a29ebb4a36bb1b6
# engine=20987
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-11-08 01:53:52
# local_time=2014-11-08 09:53:52 (+0800, China Standard Time)
# country="United States"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 0 167041482 0 0
# scanned=144976
# found=0
# cleaned=0
# scan_time=2126
ESETSmartInstaller@High as downloader log:
Can not open internetESETSmartInstaller@High as downloader log:
Can not open internet# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=87e8bd99fbb97c418a29ebb4a36bb1b6
# engine=21032
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-11-11 06:07:46
# local_time=2014-11-11 02:07:46 (+0800, China Standard Time)
# country="United States"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 0 167315916 0 0
# scanned=39059
# found=0
# cleaned=0
# scan_time=1721
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=87e8bd99fbb97c418a29ebb4a36bb1b6
# engine=21041
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-11-11 06:55:33
# local_time=2014-11-12 02:55:33 (+0800, China Standard Time)
# country="United States"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 0 167361983 0 0
# scanned=149626
# found=0
# cleaned=0
# scan_time=2648
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=87e8bd99fbb97c418a29ebb4a36bb1b6
# engine=21200
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-11-21 12:52:50
# local_time=2014-11-21 08:52:50 (+0800, China Standard Time)
# country="United States"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 0 168204220 0 0
# scanned=149419
# found=0
# cleaned=0
# scan_time=2578
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=87e8bd99fbb97c418a29ebb4a36bb1b6
# engine=21659
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-12-22 04:14:12
# local_time=2014-12-22 12:14:12 (+0800, China Standard Time)
# country="United States"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 0 170851502 0 0
# scanned=178243
# found=0
# cleaned=0
# scan_time=3029
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=87e8bd99fbb97c418a29ebb4a36bb1b6
# engine=21905
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2015-01-10 11:13:34
# local_time=2015-01-11 07:13:34 (+0800, China Standard Time)
# country="United States"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 4914 172561464 0 0
# scanned=164205
# found=0
# cleaned=0
# scan_time=2928
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=87e8bd99fbb97c418a29ebb4a36bb1b6
# engine=22037
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2015-01-19 01:34:26
# local_time=2015-01-19 09:34:26 (+0800, China Standard Time)
# country="United States"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 0 173304316 0 0
# scanned=167580
# found=1
# cleaned=1
# scan_time=2896
sh=25EDBD6C091AD196964EDCA209BA138AEFCFB7A1 ft=1 fh=550a6581427d6b90 vn="a variant of Win32/Bundled.Toolbar.Google.C potentially unsafe application (deleted - quarantined)" ac=C fn="C:\Users\Roberto C. Victoria\Downloads\vxlsetup.exe"
ESETSmartInstaller@High as downloader log:
Can not open internetESETSmartInstaller@High as downloader log:
Can not open internet# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=87e8bd99fbb97c418a29ebb4a36bb1b6
# engine=22121
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2015-01-24 03:46:32
# local_time=2015-01-24 11:46:32 (+0800, China Standard Time)
# country="United States"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 44521 173701042 0 0
# scanned=168337
# found=0
# cleaned=0
# scan_time=2871
ESETSmartInstaller@High as downloader log:
Can not open internetESETSmartInstaller@High as downloader log:
Can not open internet# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=87e8bd99fbb97c418a29ebb4a36bb1b6
# engine=22191
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2015-01-28 06:58:48
# local_time=2015-01-29 02:58:48 (+0800, China Standard Time)
# country="United States"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 16531 174101378 0 0
# scanned=167406
# found=0
# cleaned=0
# scan_time=3129
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=87e8bd99fbb97c418a29ebb4a36bb1b6
# engine=22245
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2015-02-01 09:57:33
# local_time=2015-02-01 05:57:33 (+0800, China Standard Time)
# country="United States"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 40312 174414503 0 0
# scanned=168248
# found=0
# cleaned=0
# scan_time=3086
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=87e8bd99fbb97c418a29ebb4a36bb1b6
# engine=22356
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2015-02-07 02:49:39
# local_time=2015-02-07 10:49:39 (+0800, China Standard Time)
# country="United States"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 56727 174950429 0 0
# scanned=137907
# found=0
# cleaned=0
# scan_time=2750
ESETSmartInstaller@High as downloader log:
Can not open internetESETSmartInstaller@High as downloader log:
Can not open internetCan not open internetESETSmartInstaller@High as downloader log:
Can not open internet# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=87e8bd99fbb97c418a29ebb4a36bb1b6
# engine=22695
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2015-03-01 08:48:28
# local_time=2015-03-01 04:48:28 (+0800, China Standard Time)
# country="United States"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 0 176829557 0 0
# scanned=167138
# found=0
# cleaned=0
# scan_time=4451
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=87e8bd99fbb97c418a29ebb4a36bb1b6
# engine=22917
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2015-03-15 05:21:50
# local_time=2015-03-16 01:21:50 (+0800, China Standard Time)
# country="United States"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 0 178069960 0 0
# scanned=166774
# found=0
# cleaned=0
# scan_time=2976
ESETSmartInstaller@High as downloader log:
all ok
ESETSmartInstaller@High as downloader log:
Can not open internetESETSmartInstaller@High as downloader log:
Can not open internet# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=87e8bd99fbb97c418a29ebb4a36bb1b6
# engine=22992
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2015-03-20 04:33:22
# local_time=2015-03-20 12:33:22 (+0800, China Standard Time)
# country="United States"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 0 178455852 0 0
# scanned=170673
# found=0
# cleaned=0
# scan_time=2388
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=87e8bd99fbb97c418a29ebb4a36bb1b6
# engine=23013
# end=finished
# remove_checked=false
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-03-21 01:28:21
# local_time=2015-03-21 09:28:21 (+0800, China Standard Time)
# country="United States"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 0 178574349 0 0
# scanned=12706
# found=0
# cleaned=0
# scan_time=2294
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=87e8bd99fbb97c418a29ebb4a36bb1b6
# engine=23016
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2015-03-21 06:01:27
# local_time=2015-03-22 02:01:27 (+0800, China Standard Time)
# country="United States"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 0 178590737 0 0
# scanned=169726
# found=0
# cleaned=0
# scan_time=2294
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=87e8bd99fbb97c418a29ebb4a36bb1b6
# engine=23025
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2015-03-22 02:26:22
# local_time=2015-03-22 10:26:22 (+0800, China Standard Time)
# country="United States"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 0 178664232 0 0
# scanned=170742
# found=0
# cleaned=0
# scan_time=3072
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=87e8bd99fbb97c418a29ebb4a36bb1b6
# engine=23040
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2015-03-23 05:03:14
# local_time=2015-03-24 01:03:14 (+0800, China Standard Time)
# country="United States"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 0 178760044 0 0
# scanned=170554
# found=0
# cleaned=0
# scan_time=2252
ESETSmartInstaller@High as downloader log:
Can not open internetESETSmartInstaller@High as downloader log:
Can not open internet# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=87e8bd99fbb97c418a29ebb4a36bb1b6
# engine=23055
# end=finished
# remove_checked=false
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-03-24 03:07:02
# local_time=2015-03-24 11:07:02 (+0800, China Standard Time)
# country="United States"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 0 178839472 0 0
# scanned=167948
# found=0
# cleaned=0
# scan_time=1803
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=87e8bd99fbb97c418a29ebb4a36bb1b6
# engine=23064
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2015-03-25 02:29:42
# local_time=2015-03-25 10:29:42 (+0800, China Standard Time)
# country="United States"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 0 178880432 0 0
# scanned=168316
# found=0
# cleaned=0
# scan_time=2354
 
(No malicious items detected)
 
Registry Keys: 0
(No malicious items detected)
 
Registry Values: 0
(No malicious items detected)
 
Registry Data: 0
(No malicious items detected)
 
Folders: 0
(No malicious items detected)
 
Files: 0
(No malicious items detected)
 
Physical Sectors: 0
(No malicious items detected)
 
 
(end)


#15 deeprybka

deeprybka

  • Malware Response Team
  • 5,198 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Germany
  • Local time:07:49 PM

Posted 25 March 2015 - 03:58 AM

goGMWSt.gifCRACKED SOFTWARE WARNING

Participating in the use of cracked/pirated/keygen software is not only illegal but also a security risk. Were you aware your machine has cracked software installed? I do not approve of nor support illegal software.

Malware authors promote and release cracked software to spread their infections. I strongly recommend you refrain from participating in this activity; your computer will be repeatedly infected otherwise. Simply visiting a cracked software site can result in infection via drive-by exploits of vulnerable software.

Cracked software will make your computer susceptible to a smörgåsbord of malware infections, remote attacks, exposure of personal information, and identity theft. In some instances an infection may cause so much damage to your system that recovery is not possible and the only option is to reformat your Hard Drive and reinstall your Operating System. Please read the following articles for more information.Please reset your router to factory settings and update the firmware.
regards,
deeprybka
:busy:
Neminem laede, immo omnes, quantum potes, iuva. Arthur Schopenhauer
 
unite_blue.png
asap.png




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users