Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

PC Privacy Dock and other malware installed, cannot remove


  • This topic is locked This topic is locked
15 replies to this topic

#1 Payton209

Payton209

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:04:54 AM

Posted 04 June 2015 - 11:26 PM

Hello,
 
My computer's been infected with various adware/malware.  I uninstalled some, but can't uninstall others (such as PC Privacy Dock, and others).
 
I ran MalwareBytes, it found some stuff and cleaned it.  I installed SpyHunter and it found a bunch of stuff, but I did not use it to clean.  I then installed Adware. The first time I ran it, it ran for about 20 minutes and the screen when black.  I rebooted the computer and started the scan again and again the screen went black after a few minutes.  I then came here for help.
 
FRST.txt log file posted below. Addition.txt file is attached.
 
Thank you.
 
 
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:03-06-2015
Ran by payton (administrator) on PANDAS on 04-06-2015 21:07:50
Running from C:\Users\payton\Desktop
Loaded Profiles: payton (Available Profiles: payton)
Platform: Windows 8.1 (X64) OS Language: English (United States)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
 
==================== Processes (Whitelisted) =================
 
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 
() C:\Program Files\Hewlett-Packard\SimplePass\cachesrvr.exe
(Softex Inc.) C:\Program Files\Hewlett-Packard\SimplePass\OmniServ.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RTKAUDIOSERVICE64.EXE
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPWMISVC.exe
(Intel® Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee\SiteAdvisor\mcsacore.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mfemms.exe
(McAfee, Inc.) C:\Windows\System32\mfevtps.exe
(McAfee, Inc.) C:\Windows\System32\mfevtps.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\AMCore\mcshield.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(arvato digital services llc) C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
(McAfee, Inc.) C:\Program Files\mcafee\MSC\McAPExe.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20856_x64__8wekyb3d8bbwe\livecomm.exe
() C:\Program Files\Hewlett-Packard\SimplePass\opvapp.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Integrated Clock Controller Service\ICCProxy.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\SimplePass\HPSmplPass.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBroker.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBrokerDsktop.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
(Spotify Ltd) C:\Users\payton\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPMSGSVC.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe
(Dropbox, Inc.) C:\Users\payton\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Wondershare) C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\YouCam\YouCamService.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\IPC\AdobeIPCBroker.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS\Adobe Desktop Service.exe
() C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HEX\Adobe CEF Helper.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HEX\Adobe CEF Helper.exe
(McAfee, Inc.) C:\Program Files\mcafee\MAT\McPvTray.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\FWService\IntelMeFWService.exe
(Intuit Inc.) C:\Program Files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\CSP\1.5.450.0\McCSPServiceHost.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmprph.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\Platform\McUICnt.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\Platform\CommonBuild\McCBEntAndInstru.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\Platform\McUICnt.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(TeamViewer GmbH) C:\Users\payton\AppData\Local\Temp\TeamViewer\TeamViewer.exe
(TeamViewer GmbH) C:\Users\payton\AppData\Local\Temp\TeamViewer\tv_w32.exe
(TeamViewer GmbH) C:\Users\payton\AppData\Local\Temp\TeamViewer\tv_x64.exe
(TeamViewer GmbH) C:\Users\payton\AppData\Local\Temp\TeamViewer\TeamViewer_Desktop.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\WWAHost.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
 
 
==================== Registry (Whitelisted) ==================
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7204568 2014-05-02] (Realtek Semiconductor)
HKLM\...\Run: [SimplePass] => C:\Program Files\Hewlett-Packard\SimplePass\HPSmplPass.exe [2758200 2013-10-14] (Hewlett-Packard)
HKLM\...\Run: [OPBHOBroker] => C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBroker.exe [155704 2013-10-14] (Hewlett-Packard)
HKLM\...\Run: [OPBHOBrokerDesktop] => C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBrokerDsktop.exe [155704 2013-10-14] (Hewlett-Packard)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2780912 2013-09-19] (Synaptics Incorporated)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [169768 2015-04-07] (Apple Inc.)
HKLM-x32\...\Run: [HPMessageService] => C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPMSGSVC.exe [1045304 2013-10-08] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [mcpltui_exe] => C:\Program Files\Common Files\McAfee\Platform\mcuicnt.exe [719272 2015-04-02] (McAfee, Inc.)
HKLM-x32\...\Run: [Wondershare Helper Compact.exe] => C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe [1994752 2014-02-20] (Wondershare)
HKLM-x32\...\Run: [Adobe Creative Cloud] => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe [2584240 2015-05-08] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-10-02] (Apple Inc.)
HKLM-x32\...\Run: [amd_dc_opt] => C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe [77824 2008-07-22] (AMD)
HKLM\...\RunOnce: [NCPluginUpdater] => C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\NCPluginUpdater.exe [21720 2014-10-07] (Hewlett-Packard)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer: [NoFolderOptions] 0
HKLM\...\Policies\Explorer: [NoControlPanel] 0
HKU\S-1-5-21-3211262294-3724246191-2359105936-1001\...\Run: [Power2GoExpress8] => NA
HKU\S-1-5-21-3211262294-3724246191-2359105936-1001\...\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [43816 2015-04-26] (Apple Inc.)
HKU\S-1-5-21-3211262294-3724246191-2359105936-1001\...\Run: [ApplePhotoStreams] => C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [43816 2015-04-26] (Apple Inc.)
HKU\S-1-5-21-3211262294-3724246191-2359105936-1001\...\Run: [Spotify Web Helper] => C:\Users\payton\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1676344 2014-12-18] (Spotify Ltd)
HKU\S-1-5-21-3211262294-3724246191-2359105936-1001\...\Run: [Google Update] => C:\Users\payton\AppData\Local\Google\Update\GoogleUpdate.exe [107848 2015-04-27] (Google Inc.)
HKU\S-1-5-21-3211262294-3724246191-2359105936-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [31283328 2015-04-17] (Skype Technologies S.A.)
HKU\S-1-5-21-3211262294-3724246191-2359105936-1001\...\Policies\Explorer: [NoFolderOptions] 0
HKU\S-1-5-21-3211262294-3724246191-2359105936-1001\...\Policies\Explorer: [NoControlPanel] 0
HKU\S-1-5-21-3211262294-3724246191-2359105936-1001\...\MountPoints2: {611cc282-e51d-11e3-8277-c4346b42ec7f} - "F:\VZW_Software_upgrade_assistant.exe" 
HKU\S-1-5-21-3211262294-3724246191-2359105936-1001\...\MountPoints2: {c3acf10c-4053-11e4-8296-c4346b42ec7f} - "F:\LaunchU3.exe" -a
HKU\S-1-5-21-3211262294-3724246191-2359105936-1001\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\Bubbles.scr [788480 2014-10-28] (Microsoft Corporation)
AppInit_DLLs: C:\PROGRA~2\SEARCH~1\SEARCH~1\bin\SPVC64~1.DLL => C:\PROGRA~2\SEARCH~1\SEARCH~1\bin\SPVC64~1.DLL File not found
AppInit_DLLs-x32: C:\PROGRA~2\SEARCH~1\SEARCH~1\bin\SPVC32~1.DLL => "C:\PROGRA~2\SEARCH~1\SEARCH~1\bin\SPVC32~1.DLL" File not found
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\GoPro Importer.lnk [2015-04-22]
ShortcutTarget: GoPro Importer.lnk -> C:\Users\payton\Desktop\GoPro\Tools\Importer\GoPro Importer.exe (No File)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Install SafeKey IE RunOnce.lnk [2014-05-01]
ShortcutTarget: Install SafeKey IE RunOnce.lnk -> C:\Program Files (x86)\Common Files\lpuninstall.exe (McAfee)
Startup: C:\Users\payton\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2015-03-05]
ShortcutTarget: Dropbox.lnk -> C:\Users\payton\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ AccExtIco1] -> {AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2015-04-16] ()
ShellIconOverlayIdentifiers: [ AccExtIco2] -> {853B7E05-C47D-4985-909A-D0DC5C6D7303} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2015-04-16] ()
ShellIconOverlayIdentifiers: [ AccExtIco3] -> {42D38F2E-98E9-4382-B546-E24E4D6D04BB} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2015-04-16] ()
ShellIconOverlayIdentifiers: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  No File
ShellIconOverlayIdentifiers: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  No File
ShellIconOverlayIdentifiers: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  No File
ShellIconOverlayIdentifiers: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\payton\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-03-04] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\payton\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-03-04] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\payton\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-03-04] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\payton\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-03-04] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\payton\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-03-04] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\payton\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-03-04] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\payton\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-03-04] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\payton\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-03-04] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  No File
ShellIconOverlayIdentifiers-x32: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  No File
ShellIconOverlayIdentifiers-x32: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  No File
ShellIconOverlayIdentifiers-x32: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  No File
ShellIconOverlayIdentifiers-x32: [ SkyDrivePro1 (ErrorConflict)] -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2015-04-14] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ SkyDrivePro2 (SyncInProgress)] -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2015-04-14] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ SkyDrivePro3 (InSync)] -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2015-04-14] (Microsoft Corporation)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
 
==================== Internet (Whitelisted) ====================
 
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-3211262294-3724246191-2359105936-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled
ProxyServer: [.DEFAULT] => http=127.0.0.1:13081
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/HPNOT14/1
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/HPNOT14/1
HKU\S-1-5-21-3211262294-3724246191-2359105936-1001\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-3211262294-3724246191-2359105936-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/HPNOT14/1
SearchScopes: HKLM -> {31090377-0740-419E-BEFC-A56E50500D5B} URL = 
SearchScopes: HKU\S-1-5-21-3211262294-3724246191-2359105936-1001 -> DefaultScope {7B29E2D8-BAFF-4975-A584-801BFB95D005} URL = https://search.yahoo.com/search?fr=mcafee&type=C011US91014D20140501&p={searchTerms}
SearchScopes: HKU\S-1-5-21-3211262294-3724246191-2359105936-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?FORM=UP97DF&PC=UP97&q={searchTerms}&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-3211262294-3724246191-2359105936-1001 -> {7B29E2D8-BAFF-4975-A584-801BFB95D005} URL = https://search.yahoo.com/search?fr=mcafee&type=C011US91014D20140501&p={searchTerms}
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2015-03-10] (Microsoft Corporation)
BHO: McAfee SafeKey Vault -> {9DB059B3-DD36-4a55-846C-59BE42A1202A} -> C:\Program Files (x86)\SafeKey\LPToolbar_x64.dll [2014-05-01] (McAfee)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2015-05-01] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2015-04-14] (Microsoft Corporation)
BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll [2013-08-28] (Hewlett-Packard)
BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\Office15\OCHelper.dll [2015-03-03] (Microsoft Corporation)
BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\ssv.dll [2015-03-20] (Oracle Corporation)
BHO-x32: McAfee SafeKey Vault -> {9DB059B3-DD36-4a55-846C-59BE42A1202A} -> C:\Program Files (x86)\SafeKey\LPToolbar.dll [2014-05-01] (McAfee)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2015-05-01] (Microsoft Corporation)
BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2015-04-14] (Microsoft Corporation)
BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\jp2ssv.dll [2015-03-20] (Oracle Corporation)
BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll [2013-08-28] (Hewlett-Packard)
Toolbar: HKLM - McAfee SafeKey - {61D700C1-7D8D-43c5-9C13-4FF85157CFE6} - C:\Program Files (x86)\SafeKey\LPToolbar_x64.dll [2014-05-01] (McAfee)
Toolbar: HKLM-x32 - McAfee SafeKey - {61D700C1-7D8D-43c5-9C13-4FF85157CFE6} - C:\Program Files (x86)\SafeKey\LPToolbar.dll [2014-05-01] (McAfee)
Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll [2015-04-01] (McAfee, Inc.)
Handler-x32: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll [2015-04-01] (McAfee, Inc.)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2015-02-03] (Microsoft Corporation)
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll [2015-04-01] (McAfee, Inc.)
Handler-x32: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll [2015-04-01] (McAfee, Inc.)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2015-05-01] (Microsoft Corporation)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2015-05-01] (Microsoft Corporation)
Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files\mcafee\MSC\McSnIePl64.dll [2015-04-07] (McAfee, Inc.)
Filter-x32: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files (x86)\McAfee\MSC\McSnIePl.dll [2015-04-07] (McAfee, Inc.)
Tcpip\Parameters: [DhcpNameServer] 75.75.75.75 75.75.76.76
 
FireFox:
========
FF ProfilePath: C:\Users\payton\AppData\Roaming\Mozilla\Firefox\Profiles\dwdc9ic9.default
FF DefaultSearchEngine: Secure Search
FF SearchEngineOrder.1: Secure Search
FF Plugin: @mcafee.com/MSC,version=10 -> c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL [2015-04-07] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-16] ( Microsoft Corporation)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll [2015-05-08] (Adobe Systems)
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\windows\SysWOW64\Adobe\Director\np32dsw_1204144.dll [2013-09-05] (Adobe Systems, Inc.)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-10-30] ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-09-16] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-09-16] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.40.2 -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\dtplugin\npDeployJava1.dll [2015-03-20] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.40.2 -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\plugin2\npjp2.dll [2015-03-20] (Oracle Corporation)
FF Plugin-x32: @mcafee.com/MSC,version=10 -> c:\PROGRA~2\mcafee\msc\NPMCSN~1.DLL [2015-04-07] ()
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2015-02-17] (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2014-05-01] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3508.0205 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2013-02-05] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-14] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-14] (Google Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll [2015-05-08] (Adobe Systems)
FF Plugin HKU\S-1-5-21-3211262294-3724246191-2359105936-1001: @citrixonline.com/appdetectorplugin -> C:\Users\payton\AppData\Local\Citrix\Plugins\104\npappdetector.dll [2015-06-03] (Citrix Online)
FF Plugin HKU\S-1-5-21-3211262294-3724246191-2359105936-1001: @tools.google.com/Google Update;version=3 -> C:\Users\payton\AppData\Local\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-18] (Google Inc.)
FF Plugin HKU\S-1-5-21-3211262294-3724246191-2359105936-1001: @tools.google.com/Google Update;version=9 -> C:\Users\payton\AppData\Local\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-18] (Google Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\McSiteAdvisor.xml [2014-09-19]
FF Extension: Hawker - C:\Users\payton\AppData\Roaming\Mozilla\Firefox\Profiles\dwdc9ic9.default\Extensions\{B5643E87-4502-60E2-A32A-6E126145609B} [2015-06-02]
FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK
FF Extension: McAfee Anti-Spam Thunderbird Extension - C:\Program Files\McAfee\MSK [2014-05-01]
FF Extension: No Name - C:\Users\payton\AppData\Roaming\Mozilla\Firefox\Profiles\dwdc9ic9.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} [not found]
FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [not found]
 
Chrome: 
=======
CHR Profile: C:\Users\payton\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (BetterTTV) - C:\Users\payton\AppData\Local\Google\Chrome\User Data\Default\Extensions\ajopnjidmegmdimjlfnijceegpefgped [2015-05-09]
CHR Extension: (Google Cast) - C:\Users\payton\AppData\Local\Google\Chrome\User Data\Default\Extensions\boadgeojelhgndaghljhdicfkmllpafd [2015-04-27]
CHR Extension: (No Name) - C:\Users\payton\AppData\Local\Google\Chrome\User Data\Default\Extensions\dlbemabjbfhjcccahjioenmkgimjbbkd [2015-06-04]
CHR Extension: (AdBlock) - C:\Users\payton\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2015-03-05]
CHR Extension: (Bookmark Manager) - C:\Users\payton\AppData\Local\Google\Chrome\User Data\Default\Extensions\gmlllbghnfkpflemihljekbapjopfjik [2015-04-16]
CHR Extension: (Hangouts) - C:\Users\payton\AppData\Local\Google\Chrome\User Data\Default\Extensions\knipolnnllmklapflnccelgolnpehhpl [2015-03-23]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\payton\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-13]
CHR Extension: (Google Wallet) - C:\Users\payton\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-04-29]
CHR HKLM\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - C:\Program Files (x86)\McAfee\SiteAdvisor\McChPlg.crx [2015-04-03]
CHR HKU\S-1-5-21-3211262294-3724246191-2359105936-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [bakijjialdiiboeaknfpmflphhmljfkd] - https://clients2.google.com/service/update2/crx
CHR HKU\S-1-5-21-3211262294-3724246191-2359105936-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [dhdgffkkebhmkfjojejmpbldmpobfkfo] - http://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [agbnjankikoaabjkmfbaceggjliabkbn] - C:\Program Files (x86)\SafeKey\lpchrome.crx [2014-05-01]
CHR HKLM-x32\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - C:\Program Files (x86)\McAfee\SiteAdvisor\McChPlg.crx [2015-04-03]
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2015-05-01]
 
==================== Services (Whitelisted) =================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77128 2015-01-20] (Apple Inc.)
S3 BthHFSrv; C:\Windows\System32\BthHFSrv.dll [324608 2014-10-28] (Microsoft Corporation)
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1394816 2015-05-01] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1772672 2015-05-01] (Microsoft Corporation)
R2 Cachedrv server; C:\Program Files\Hewlett-Packard\SimplePass\cachesrvr.exe [109568 2013-10-14] () [File not signed]
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2736824 2015-04-07] (Microsoft Corporation)
S3 FLEXnet Licensing Service; C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [654848 2014-05-26] (Macrovision Europe Ltd.) [File not signed]
R2 HomeNetSvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [340744 2015-04-02] (McAfee, Inc.)
R2 HP Support Assistant Service; C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [92160 2013-11-04] (Hewlett-Packard Company) [File not signed]
R2 HPWMISVC; C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPWMISVC.exe [1039160 2013-10-08] (Hewlett-Packard Development Company, L.P.)
R2 Intel® Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [747520 2013-08-27] (Intel® Corporation) [File not signed]
S3 Intel® Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [828376 2013-08-27] (Intel® Corporation)
R2 Intel® ME Service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\FWService\IntelMeFWService.exe [131544 2013-09-16] (Intel Corporation)
S3 iumsvc; C:\Program Files (x86)\Intel\Intel® Update Manager\bin\iumsvc.exe [174368 2014-02-28] ()
R2 jhi_service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [169432 2013-09-16] (Intel Corporation)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation)
R2 McAfee SiteAdvisor Service; C:\Program Files (x86)\McAfee\SiteAdvisor\McSACore.exe [155368 2015-04-01] (McAfee, Inc.)
R2 McAPExe; C:\Program Files\McAfee\MSC\McAPExe.exe [753768 2015-04-07] (McAfee, Inc.)
R2 mccspsvc; C:\Program Files\Common Files\McAfee\CSP\1.5.450.0\McCSPServiceHost.exe [207344 2015-04-08] (McAfee, Inc.)
R2 McMPFSvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [340744 2015-04-02] (McAfee, Inc.)
R2 McNaiAnn; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [340744 2015-04-02] (McAfee, Inc.)
S3 McODS; C:\Program Files\mcafee\VirusScan\mcods.exe [612688 2015-04-09] (McAfee, Inc.)
R2 mcpltsvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [340744 2015-04-02] (McAfee, Inc.)
R2 McProxy; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [340744 2015-04-02] (McAfee, Inc.)
R2 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [232656 2015-02-17] (McAfee, Inc.)
R2 mfemms; C:\Program Files\Common Files\McAfee\SystemCore\\mfemms.exe [372144 2015-04-06] (McAfee, Inc.)
R2 mfevtp; C:\Windows\system32\mfevtps.exe [250672 2015-02-17] (McAfee, Inc.)
S4 MSK80Service; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [340744 2015-04-02] (McAfee, Inc.)
R2 omniserv; C:\Program Files\Hewlett-Packard\SimplePass\OmniServ.exe [87552 2013-10-14] (Softex Inc.) [File not signed]
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2014-05-18] ()
R2 PSI_SVC_2_x64; C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe [337776 2013-09-13] (arvato digital services llc)
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [289496 2013-08-22] (Realtek Semiconductor)
S3 w3logsvc; C:\Windows\system32\inetsrv\w3logsvc.dll [76800 2013-08-25] (Microsoft Corporation)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366520 2015-02-03] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2015-02-03] (Microsoft Corporation)
 
==================== Drivers (Whitelisted) ====================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
R3 cfwids; C:\Windows\System32\drivers\cfwids.sys [68784 2015-02-17] (McAfee, Inc.)
R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [91912 2013-11-12] (CyberLink)
R3 CMUSBDAC; C:\Windows\system32\DRIVERS\CMUSBDAC.sys [358400 2013-05-09] (C-Media Inc.)
R3 ElgatoGC658Y; C:\Windows\System32\Drivers\ElgatoGC658.sys [50288 2012-11-12] (UB658)
S3 HipShieldK; C:\Windows\System32\drivers\HipShieldK.sys [197704 2013-09-23] (McAfee, Inc.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-04-14] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64216 2015-04-14] (Malwarebytes Corporation)
R2 McPvDrv; C:\Windows\system32\drivers\McPvDrv.sys [76064 2015-03-27] (McAfee, Inc.)
R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [99288 2013-09-16] (Intel Corporation)
R3 mfeaack; C:\Windows\System32\drivers\mfeaack.sys [401736 2015-02-17] (McAfee, Inc.)
R3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [337888 2015-02-17] (McAfee, Inc.)
R0 mfedisk; C:\Windows\System32\DRIVERS\mfedisk.sys [101872 2015-02-17] (McAfee, Inc.)
S0 mfeelamk; C:\Windows\System32\drivers\mfeelamk.sys [80160 2015-02-13] (McAfee, Inc.)
R3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [488000 2015-02-17] (McAfee, Inc.)
R0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [864072 2015-02-17] (McAfee, Inc.)
R3 mfencbdc; C:\Windows\System32\DRIVERS\mfencbdc.sys [482600 2015-01-16] (McAfee, Inc.)
S3 mfencrk; C:\Windows\System32\DRIVERS\mfencrk.sys [100720 2015-01-16] (McAfee, Inc.)
R0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [340448 2015-02-17] (McAfee, Inc.)
S3 RSP2STOR; C:\Windows\system32\DRIVERS\RtsP2Stor.sys [290520 2013-08-26] (Realtek Semiconductor Corp.)
R3 RTWlanE; C:\Windows\system32\DRIVERS\rtwlane.sys [3068120 2014-05-01] (Realtek Semiconductor Corporation                           )
S3 SmbDrv; C:\Windows\System32\drivers\Smb_driver_AMDASF.sys [30448 2013-09-19] (Synaptics Incorporated)
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [34544 2013-09-19] (Synaptics Incorporated)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2015-02-03] (Microsoft Corporation)
R3 WirelessButtonDriver; C:\Windows\System32\drivers\WirelessButtonDriver64.sys [20800 2013-07-22] (Hewlett-Packard Development Company, L.P.)
S3 xusb22; C:\Windows\System32\drivers\xusb22.sys [87040 2014-03-18] (Microsoft Corporation)
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]
 
==================== NetSvcs (Whitelisted) ===================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
 
==================== One Month Created files and folders ========
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2015-06-04 21:07 - 2015-06-04 21:08 - 00035518 _____ C:\Users\payton\Desktop\FRST.txt
2015-06-04 21:07 - 2015-06-04 21:07 - 00000000 ____D C:\FRST
2015-06-04 21:03 - 2015-06-04 21:03 - 02108928 _____ (Farbar) C:\Users\payton\Desktop\FRST64.exe
2015-06-04 21:01 - 2015-06-04 21:02 - 00000000 ____D C:\Users\payton\Desktop\fix computer
2015-06-04 20:24 - 2015-06-04 20:24 - 08009728 _____ (TeamViewer GmbH) C:\Users\payton\Downloads\TeamViewer_Setup_en.exe
2015-06-04 20:24 - 2015-06-04 20:24 - 00000000 ____D C:\Users\payton\AppData\Roaming\TeamViewer
2015-06-04 20:00 - 2015-06-04 20:07 - 00018944 ___SH C:\Users\payton\Downloads\Thumbs.db
2015-06-04 11:50 - 2015-06-04 14:27 - 00000000 ____D C:\AdwCleaner
2015-06-04 11:49 - 2015-06-04 11:49 - 02231296 _____ C:\Users\payton\Downloads\adwcleaner_4.206.exe
2015-06-04 11:35 - 2015-06-04 11:35 - 00297680 _____ (Citrix Online) C:\Users\payton\Downloads\GoToAssist Launcher.exe
2015-06-03 19:53 - 2015-06-04 11:54 - 00000000 ____D C:\Program Files (x86)\Citrix
2015-06-03 19:52 - 2015-06-03 19:52 - 00000000 ____D C:\Users\payton\AppData\Local\Citrix
2015-06-03 19:01 - 2015-06-03 19:05 - 00000000 ____D C:\Users\payton\Downloads\MC
2015-06-03 19:00 - 2015-06-03 19:04 - 00000000 ____D C:\Users\payton\Downloads\installers
2015-06-03 18:59 - 2015-06-04 17:07 - 00000000 ____D C:\Users\payton\Downloads\things
2015-06-03 18:59 - 2015-06-03 18:59 - 00000000 ____D C:\Users\payton\Downloads\Adobe CC
2015-06-03 12:35 - 2015-06-03 12:35 - 00000000 _____ C:\autoexec.bat
2015-06-03 01:29 - 2015-06-04 12:54 - 00003218 _____ C:\Windows\PFRO.log
2015-06-02 19:45 - 2015-06-04 20:26 - 00822567 _____ C:\Windows\WindowsUpdate.log
2015-06-02 19:17 - 2015-06-04 20:19 - 00010422 _____ C:\Windows\setupact.log
2015-06-02 17:45 - 2015-06-02 17:45 - 00001085 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2015-06-02 17:44 - 2015-06-02 18:29 - 00000112 _____ C:\ProgramData\5LgejDF.dat
2015-06-02 17:27 - 2013-08-22 06:25 - 00000824 _____ C:\Windows\system32\Drivers\etc\hp.bak
2015-06-02 17:26 - 2015-06-02 17:26 - 00004304 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskUserM_1_7_22_478699874-4155726479-3780505679-3006UA__3634343933313033342d2d5b50342a4155456c5a236c
2015-06-02 17:25 - 2015-06-02 17:25 - 00026428 _____ C:\Windows\System32\Tasks\CloudLARAMIE
2015-06-02 17:20 - 2015-06-02 17:20 - 00003980 _____ C:\Windows\System32\Tasks\LaunchPreSignup
2015-06-02 16:45 - 2015-06-02 16:45 - 00001288 _____ C:\Users\payton\Desktop\Adobe Creative Cloud.lnk
2015-06-02 16:34 - 2015-06-03 19:03 - 00000000 ____D C:\Users\payton\Downloads\PS Fonts and Brushes
2015-06-02 00:18 - 2015-06-02 00:18 - 00000000 ____D C:\Users\payton\Documents\My Picturs
2015-06-01 23:42 - 2015-06-01 23:42 - 00000000 ____D C:\ProgramData\Reprise
2015-05-30 14:08 - 2015-06-03 18:58 - 00000000 ____D C:\Users\payton\Downloads\PS textures
2015-05-26 14:45 - 2015-05-26 14:45 - 00001117 _____ C:\Users\payton\Downloads\Game Capture HD.lnk
2015-05-23 14:16 - 2015-03-27 10:08 - 00076064 _____ (McAfee, Inc.) C:\Windows\system32\Drivers\McPvDrv.sys
2015-05-23 14:15 - 2013-09-23 13:49 - 00197704 _____ (McAfee, Inc.) C:\Windows\system32\Drivers\HipShieldK.sys
2015-05-20 20:42 - 2015-05-20 20:42 - 00000000 ____D C:\Windows\SysWOW64\AGEIA
2015-05-20 20:42 - 2015-05-20 20:42 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
2015-05-20 20:42 - 2015-05-20 20:42 - 00000000 ____D C:\Program Files (x86)\AMD
2015-05-20 20:42 - 2015-05-20 20:42 - 00000000 ____D C:\Program Files (x86)\AGEIA Technologies
2015-05-20 20:42 - 2008-07-12 08:18 - 04992520 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_39.dll
2015-05-20 20:42 - 2008-07-12 08:18 - 03851784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_39.dll
2015-05-20 20:42 - 2008-07-12 08:18 - 01942552 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_39.dll
2015-05-20 20:42 - 2008-07-12 08:18 - 01493528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_39.dll
2015-05-20 20:42 - 2008-07-12 08:18 - 00540688 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_39.dll
2015-05-20 20:42 - 2008-07-12 08:18 - 00467984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_39.dll
2015-05-20 20:34 - 2015-05-20 20:34 - 00000221 _____ C:\Users\payton\Desktop\Moonbase Alpha.url
2015-05-17 19:17 - 2015-05-17 19:17 - 00000219 _____ C:\Users\payton\Desktop\Counter-Strike Global Offensive.url
2015-05-12 19:04 - 2015-04-30 13:35 - 00124112 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-05-12 19:04 - 2015-04-30 13:35 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2015-05-12 18:55 - 2015-05-12 18:55 - 00000222 _____ C:\Users\payton\Desktop\Heroes & Generals.url
2015-05-12 14:54 - 2015-04-30 16:05 - 00429568 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-05-12 14:54 - 2015-04-30 15:48 - 00358912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-05-12 14:54 - 2015-04-09 17:34 - 02256896 _____ (Microsoft Corporation) C:\Windows\system32\dwmcore.dll
2015-05-12 14:54 - 2015-04-09 17:11 - 01943040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmcore.dll
2015-05-12 14:54 - 2015-03-17 10:26 - 00467776 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\USBHUB3.SYS
2015-05-12 14:54 - 2015-03-08 19:02 - 00057856 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\bthhfenum.sys
2015-05-12 14:53 - 2015-04-24 14:32 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\UtcResources.dll
2015-05-12 14:53 - 2015-04-21 10:14 - 24971776 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-05-12 14:53 - 2015-04-21 09:50 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-05-12 14:53 - 2015-04-21 09:50 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-05-12 14:53 - 2015-04-21 09:49 - 02885120 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-05-12 14:53 - 2015-04-21 09:37 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-05-12 14:53 - 2015-04-21 09:35 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-05-12 14:53 - 2015-04-21 09:31 - 06025728 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-05-12 14:53 - 2015-04-21 09:24 - 19691008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-05-12 14:53 - 2015-04-21 09:13 - 00107520 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2015-05-12 14:53 - 2015-04-21 09:11 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-05-12 14:53 - 2015-04-21 09:09 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-05-12 14:53 - 2015-04-21 09:08 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-05-12 14:53 - 2015-04-21 09:07 - 00145408 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2015-05-12 14:53 - 2015-04-21 09:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-05-12 14:53 - 2015-04-21 09:04 - 02278400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-05-12 14:53 - 2015-04-21 08:59 - 01032704 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll
2015-05-12 14:53 - 2015-04-21 08:58 - 00664576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-05-12 14:53 - 2015-04-21 08:52 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2015-05-12 14:53 - 2015-04-21 08:49 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-05-12 14:53 - 2015-04-21 08:49 - 00720384 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-05-12 14:53 - 2015-04-21 08:49 - 00374272 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-05-12 14:53 - 2015-04-21 08:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-05-12 14:53 - 2015-04-21 08:40 - 14401536 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-05-12 14:53 - 2015-04-21 08:38 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-05-12 14:53 - 2015-04-21 08:37 - 00128000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2015-05-12 14:53 - 2015-04-21 08:36 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-05-12 14:53 - 2015-04-21 08:32 - 00880128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll
2015-05-12 14:53 - 2015-04-21 08:31 - 04305920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-05-12 14:53 - 2015-04-21 08:28 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2015-05-12 14:53 - 2015-04-21 08:27 - 02352128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-05-12 14:53 - 2015-04-21 08:26 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-05-12 14:53 - 2015-04-21 08:26 - 00327168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-05-12 14:53 - 2015-04-21 08:25 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-05-12 14:53 - 2015-04-21 08:17 - 12828672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-05-12 14:53 - 2015-04-21 08:15 - 01547264 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-05-12 14:53 - 2015-04-21 08:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-05-12 14:53 - 2015-04-21 08:02 - 01882112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-05-12 14:53 - 2015-04-21 07:58 - 01310208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-05-12 14:53 - 2015-04-21 07:56 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-05-12 14:53 - 2015-04-13 15:48 - 04180480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-05-12 14:53 - 2015-04-09 18:00 - 01996800 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2015-05-12 14:53 - 2015-04-09 17:50 - 01387008 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2015-05-12 14:53 - 2015-04-09 17:26 - 01560576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2015-05-12 14:53 - 2015-04-08 15:55 - 00410128 _____ (Microsoft Corporation) C:\Windows\system32\services.exe
2015-05-12 14:53 - 2015-04-02 17:35 - 00445440 _____ (Microsoft Corporation) C:\Windows\system32\PhotoMetadataHandler.dll
2015-05-12 14:53 - 2015-04-02 17:14 - 00364544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PhotoMetadataHandler.dll
2015-05-12 14:53 - 2015-04-01 15:22 - 02985984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dbgeng.dll
2015-05-12 14:53 - 2015-04-01 15:20 - 04417536 _____ (Microsoft Corporation) C:\Windows\system32\dbgeng.dll
2015-05-12 14:53 - 2015-03-31 20:45 - 01491456 _____ (Microsoft Corporation) C:\Windows\system32\dbghelp.dll
2015-05-12 14:53 - 2015-03-31 19:31 - 01207296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dbghelp.dll
2015-05-12 14:53 - 2015-03-19 18:56 - 00080384 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ahcache.sys
2015-05-12 14:53 - 2015-03-12 21:03 - 00239424 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\sdbus.sys
2015-05-12 14:53 - 2015-03-12 21:03 - 00154432 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\dumpsd.sys
2015-05-12 14:53 - 2015-03-12 19:02 - 00316416 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\udfs.sys
2015-05-12 14:53 - 2015-03-12 18:11 - 02162176 _____ (Microsoft Corporation) C:\Windows\system32\SRH.dll
2015-05-12 14:53 - 2015-03-12 17:39 - 01812992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SRH.dll
2015-05-12 14:53 - 2015-03-12 17:29 - 00410017 _____ C:\Windows\system32\ApnDatabase.xml
2015-05-12 14:53 - 2015-03-10 18:49 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\sdbinst.exe
2015-05-12 14:53 - 2015-03-10 18:09 - 00021504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sdbinst.exe
2015-05-12 14:53 - 2015-03-05 19:47 - 01696256 _____ (Microsoft Corporation) C:\Windows\system32\wevtsvc.dll
2015-05-12 14:53 - 2015-03-04 16:09 - 01429504 _____ (Microsoft Corporation) C:\Windows\system32\diagtrack.dll
2015-05-12 14:53 - 2015-03-03 18:32 - 00172544 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.Input.Inking.dll
2015-05-12 14:53 - 2015-03-03 18:12 - 00141824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.Input.Inking.dll
2015-05-12 14:53 - 2015-02-17 16:19 - 00186368 _____ (Microsoft Corporation) C:\Windows\system32\dpapisrv.dll
2015-05-12 14:53 - 2015-01-29 17:53 - 02819584 _____ (Microsoft Corporation) C:\Windows\system32\SettingsHandlers.dll
2015-05-12 14:53 - 2014-11-13 23:58 - 00116736 _____ (Microsoft Corporation) C:\Windows\system32\SystemSettingsDatabase.dll
2015-05-12 14:52 - 2015-03-29 22:47 - 00561928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2015-05-12 14:52 - 2015-03-26 20:27 - 00445440 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2015-05-12 14:52 - 2015-03-26 19:50 - 00324096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2015-05-12 14:52 - 2015-03-26 19:48 - 01441792 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-05-12 14:52 - 2015-03-05 20:08 - 02067968 _____ (Microsoft Corporation) C:\Windows\system32\wpdshext.dll
2015-05-12 14:52 - 2015-03-05 19:43 - 01969664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wpdshext.dll
2015-05-07 15:40 - 2015-05-07 15:40 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Elgato
2015-05-07 15:39 - 2015-05-07 15:39 - 00000000 ____D C:\Users\payton\AppData\Local\ub65x
2015-05-07 15:38 - 2015-05-07 15:38 - 00000000 ____D C:\Program Files (x86)\Elgato
 
==================== One Month Modified files and folders ========
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2015-06-04 21:00 - 2013-08-22 08:36 - 00000000 ____D C:\Windows\system32\sru
2015-06-04 20:55 - 2015-04-27 19:45 - 00000926 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3211262294-3724246191-2359105936-1001UA.job
2015-06-04 20:55 - 2015-04-27 19:45 - 00000874 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3211262294-3724246191-2359105936-1001Core.job
2015-06-04 20:43 - 2014-04-29 21:29 - 00003922 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{2E2667F1-CEA4-4181-B141-121DBEDA2DB3}
2015-06-04 20:37 - 2014-04-29 21:44 - 00000916 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore1cf642ee844f055.job
2015-06-04 20:37 - 2014-04-29 21:39 - 00000920 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-06-04 20:22 - 2014-11-03 18:15 - 00000000 ____D C:\Users\payton\AppData\Roaming\Skype
2015-06-04 20:13 - 2014-04-29 21:26 - 00003598 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3211262294-3724246191-2359105936-1001
2015-06-04 20:07 - 2013-08-22 08:36 - 00000000 ____D C:\Windows\AppReadiness
2015-06-04 20:02 - 2014-05-01 21:59 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee
2015-06-04 15:37 - 2014-08-14 16:24 - 00004970 _____ C:\Windows\System32\Tasks\Microsoft Office 15 Sync Maintenance for PANDAS-payton pandas
2015-06-04 15:27 - 2014-05-01 21:59 - 00000000 __RSD C:\Users\payton\Documents\McAfee Vaults
2015-06-04 15:26 - 2015-03-05 19:54 - 00000000 ___RD C:\Users\payton\Dropbox
2015-06-04 15:26 - 2014-06-20 06:56 - 00000000 ____D C:\Users\payton\AppData\Roaming\Dropbox
2015-06-04 15:26 - 2014-05-26 14:37 - 00000000 ____D C:\Users\payton\AppData\Local\Adobe
2015-06-04 15:26 - 2014-05-03 12:46 - 00000000 ___RD C:\Users\payton\OneDrive
2015-06-04 15:22 - 2013-08-22 07:45 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-06-04 15:21 - 2013-08-22 06:25 - 00786432 ___SH C:\Windows\system32\config\BBI
2015-06-04 15:13 - 2014-05-26 19:50 - 00000000 ____D C:\Program Files\Adobe
2015-06-04 15:13 - 2014-05-26 19:45 - 00000000 ____D C:\Program Files\Common Files\Adobe
2015-06-04 15:13 - 2014-05-26 14:27 - 00000000 ____D C:\ProgramData\Adobe
2015-06-04 15:01 - 2014-04-29 21:20 - 00000000 ____D C:\Users\payton
2015-06-03 20:23 - 2014-06-24 12:18 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\InstallConverter
2015-06-03 20:18 - 2013-11-09 12:28 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Communication and Chat
2015-06-03 19:57 - 2014-07-14 11:40 - 00000000 ____D C:\Users\payton\AppData\Roaming\OBS
2015-06-03 19:03 - 2015-02-12 19:14 - 00000000 ____D C:\Users\payton\Downloads\PhotoShop
2015-06-03 14:43 - 2013-08-25 23:09 - 00956476 _____ C:\Windows\system32\PerfStringBackup.INI
2015-06-03 13:24 - 2013-08-22 07:44 - 05224264 _____ C:\Windows\system32\FNTCACHE.DAT
2015-06-03 12:20 - 2014-05-02 18:40 - 00136408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-06-03 11:47 - 2014-04-07 22:52 - 00000000 ____D C:\Intel
2015-06-03 11:27 - 2015-02-23 15:39 - 00000000 ____D C:\Users\payton\Documents\My Games
2015-06-03 01:40 - 2014-05-26 14:27 - 00000000 ____D C:\Program Files (x86)\Adobe
2015-06-03 01:17 - 2014-04-07 22:51 - 00012878 _____ C:\Windows\DPINST.LOG
2015-06-03 01:11 - 2013-08-31 19:03 - 00000000 ___HD C:\SYSTEM.SAV
2015-06-02 17:45 - 2014-05-02 18:39 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-06-02 17:45 - 2014-05-02 18:39 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2015-06-02 16:49 - 2014-05-26 19:32 - 00000000 ____D C:\ProgramData\Package Cache
2015-06-02 16:45 - 2014-07-05 01:44 - 00001300 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Creative Cloud.lnk
2015-06-02 09:07 - 2014-08-24 00:36 - 00000000 ____D C:\Users\payton\AppData\Roaming\Spotify
2015-06-02 09:03 - 2014-08-24 00:36 - 00000000 ____D C:\Users\payton\AppData\Local\Spotify
2015-06-01 16:55 - 2014-07-03 17:19 - 00000000 ____D C:\ProgramData\SmartSound Software Inc
2015-06-01 13:33 - 2014-05-01 22:56 - 00003166 _____ C:\Windows\System32\Tasks\HPCeeScheduleForpayton
2015-06-01 13:33 - 2014-05-01 22:56 - 00000350 _____ C:\Windows\Tasks\HPCeeScheduleForpayton.job
2015-05-29 16:54 - 2014-04-30 17:46 - 00000000 ____D C:\Users\payton\AppData\Roaming\.minecraft
2015-05-29 15:08 - 2013-08-22 06:25 - 00262144 ___SH C:\Windows\system32\config\ELAM
2015-05-28 14:44 - 2015-02-12 19:03 - 00000000 ___RD C:\Program Files (x86)\Skype
2015-05-28 13:31 - 2014-05-01 21:56 - 00000052 _____ C:\Windows\SysWOW64\DOErrors.log
2015-05-28 13:31 - 2014-05-01 21:55 - 00000000 _____ C:\Windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt
2015-05-26 17:08 - 2014-04-29 22:46 - 00000000 ____D C:\Program Files (x86)\Steam
2015-05-25 18:45 - 2014-04-29 21:23 - 00000000 ____D C:\Users\payton\Documents\Youcam
2015-05-23 14:16 - 2014-05-01 21:51 - 00000000 ____D C:\Program Files\Common Files\McAfee
2015-05-23 14:14 - 2013-08-22 08:36 - 00000000 ___HD C:\Windows\ELAMBKUP
2015-05-21 14:41 - 2014-08-14 16:24 - 00003094 _____ C:\Windows\System32\Tasks\Microsoft OneDrive Auto Update Task-S-1-5-21-3211262294-3724246191-2359105936-1001
2015-05-20 22:20 - 2014-06-08 19:06 - 00000000 ____D C:\Users\about_000
2015-05-20 20:42 - 2014-07-03 17:27 - 00000000 ____D C:\Users\payton\AppData\Local\Downloaded Installations
2015-05-20 20:42 - 2013-11-09 12:30 - 00293238 _____ C:\Windows\DirectX.log
2015-05-20 14:48 - 2014-09-25 16:05 - 00000000 ____D C:\Users\payton\AppData\Local\Microsoft Help
2015-05-20 14:47 - 2014-05-15 17:01 - 00000000 ____D C:\Users\payton\AppData\Local\3B9416E8-1A48-44D3-9A98-9C7B988BE999.aplzod
2015-05-20 14:47 - 2014-04-29 21:21 - 00000000 ____D C:\Users\payton\AppData\Local\Packages
2015-05-19 16:50 - 2013-08-22 08:20 - 00000000 ____D C:\Windows\CbsTemp
2015-05-19 16:46 - 2015-04-04 11:07 - 00000000 ___SD C:\Windows\SysWOW64\GWX
2015-05-19 16:46 - 2015-04-04 11:07 - 00000000 ___SD C:\Windows\system32\GWX
2015-05-19 14:50 - 2014-05-01 00:08 - 00000000 ____D C:\Program Files\Microsoft Office 15
2015-05-18 20:50 - 2015-04-27 19:45 - 00003874 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3211262294-3724246191-2359105936-1001UA
2015-05-18 20:50 - 2015-04-27 19:45 - 00003494 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3211262294-3724246191-2359105936-1001Core
2015-05-14 20:32 - 2014-04-29 21:44 - 00003656 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore1cf642ee844f055
2015-05-14 20:32 - 2014-04-29 21:39 - 00003892 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-05-12 21:08 - 2013-08-22 08:36 - 00000000 ___RD C:\Windows\ImmersiveControlPanel
2015-05-12 19:12 - 2013-08-22 08:36 - 00000000 ____D C:\Windows\rescache
2015-05-12 19:04 - 2013-08-22 06:36 - 00000000 ____D C:\Windows\system32\AdvancedInstallers
2015-05-12 15:44 - 2014-05-04 16:05 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2015-05-12 15:44 - 2014-05-04 16:05 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2015-05-12 15:40 - 2014-05-02 18:08 - 00000000 ____D C:\Windows\system32\MRT
2015-05-12 15:40 - 2013-08-22 12:12 - 00000000 ____D C:\Program Files\Windows Journal
2015-05-12 15:32 - 2014-05-02 18:08 - 140425016 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-05-12 15:26 - 2014-05-04 16:05 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2015-05-09 10:28 - 2015-03-05 19:54 - 00001076 _____ C:\Users\payton\Desktop\Dropbox.lnk
2015-05-09 10:28 - 2014-06-20 06:58 - 00000000 ____D C:\Users\payton\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-05-07 15:41 - 2014-04-29 21:21 - 00000000 ____D C:\Users\payton\AppData\Local\VirtualStore
2015-05-07 15:40 - 2014-04-29 22:50 - 00000000 ____D C:\Program Files\Elgato
2015-05-05 10:59 - 2015-03-11 14:27 - 00792568 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-05-05 10:59 - 2015-03-11 14:27 - 00178168 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
 
==================== Files in the root of some directories =======
 
2014-05-01 21:58 - 2014-05-01 21:58 - 27093992 _____ (McAfee) C:\Program Files (x86)\Common Files\lpuninstall.exe
2015-02-16 21:21 - 2015-02-16 21:24 - 0001456 _____ () C:\Users\payton\AppData\Local\Adobe Save for Web 12.0 Prefs
2014-06-05 02:51 - 2014-06-05 02:51 - 0001456 _____ () C:\Users\payton\AppData\Local\Adobe Save for Web 13.0 Prefs
2014-07-15 04:18 - 2014-07-15 04:18 - 0002708 _____ () C:\Users\payton\AppData\Local\recently-used.xbel
2015-06-02 17:44 - 2015-06-02 18:29 - 0000112 _____ () C:\ProgramData\5LgejDF.dat
2015-04-14 22:09 - 2015-04-14 23:38 - 0000469 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.400.32.bc
 
Files to move or delete:
====================
C:\ProgramData\5LgejDF.dat
C:\Users\payton\dgderapi.dll
C:\Users\payton\DIFxAPI.dll
 
 
Some files in TEMP:
====================
C:\Users\payton\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp3ppjwt.dll
C:\Users\payton\AppData\Local\Temp\Quarantine.exe
C:\Users\payton\AppData\Local\Temp\sqlite3.dll
 
 
==================== Bamital & volsnap Check =================
 
(There is no automatic fix for files that do not pass verification.)
 
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
 
LastRegBack: 2015-06-03 11:34
 
==================== End of log ============================
 


BC AdBot (Login to Remove)

 


#2 nasdaq

nasdaq

  • Malware Response Team
  • 39,569 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:07:54 AM

Posted 07 June 2015 - 09:53 AM

Hello, Welcome to BleepingComputer.
I'm nasdaq and will be helping you.

If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed.
===



Open notepad (Start =>All Programs => Accessories => Notepad). Please copy the entire contents of the code box below.
 
start

CreateRestorePoint:
CloseProcesses:

AppInit_DLLs: C:\PROGRA~2\SEARCH~1\SEARCH~1\bin\SPVC64~1.DLL => C:\PROGRA~2\SEARCH~1\SEARCH~1\bin\SPVC64~1.DLL File not found
AppInit_DLLs-x32: C:\PROGRA~2\SEARCH~1\SEARCH~1\bin\SPVC32~1.DLL => "C:\PROGRA~2\SEARCH~1\SEARCH~1\bin\SPVC32~1.DLL" File not found
ShortcutTarget: GoPro Importer.lnk -> C:\Users\payton\Desktop\GoPro\Tools\Importer\GoPro Importer.exe (No File)
ShellIconOverlayIdentifiers: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  No File
ShellIconOverlayIdentifiers: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  No File
ShellIconOverlayIdentifiers: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  No File
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  No File
ShellIconOverlayIdentifiers-x32: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  No File
ShellIconOverlayIdentifiers-x32: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  No File
ShellIconOverlayIdentifiers-x32: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  No File
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-3211262294-3724246191-2359105936-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled
ProxyServer: [.DEFAULT] => http=127.0.0.1:13081
FF Extension: Hawker - C:\Users\payton\AppData\Roaming\Mozilla\Firefox\Profiles\dwdc9ic9.default\Extensions\{B5643E87-4502-60E2-A32A-6E126145609B} [2015-06-02]
FF Extension: No Name - C:\Users\payton\AppData\Roaming\Mozilla\Firefox\Profiles\dwdc9ic9.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} [not found]
FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [not found]
CHR Extension: (No Name) - C:\Users\payton\AppData\Local\Google\Chrome\User Data\Default\Extensions\dlbemabjbfhjcccahjioenmkgimjbbkd [2015-06-04]
CHR HKU\S-1-5-21-3211262294-3724246191-2359105936-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [bakijjialdiiboeaknfpmflphhmljfkd] - https://clients2.google.com/service/update2/crx
CHR HKU\S-1-5-21-3211262294-3724246191-2359105936-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [dhdgffkkebhmkfjojejmpbldmpobfkfo] - http://clients2.google.com/service/update2/crx
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]
C:\Users\payton\AppData\Roaming\Mozilla\Firefox\Profiles\dwdc9ic9.default\Extensions\{B5643E87-4502-60E2-A32A-6E126145609B}
C:\Users\payton\AppData\Local\Google\Chrome\User Data\Default\Extensions\dlbemabjbfhjcccahjioenmkgimjbbkd

End
Save the files as fixlist.txt in the same folder where the Farbar tool is running from.
The location is listed in the 3rd line of the Farbar log you have submitted.

Run FRST and click Fix only once and wait.

Restart the computer normally to reset the registry.

The tool will create a log (Fixlog.txt) please post it to your reply.
===

Move the adwcleaner_4.206.exe file from your Downloads folders to your Desktop.
C:\Users\payton\Downloads\adwcleaner_4.206.exe
When done right click on the .exe file and run it as an administrator.
Post to the log if you can.
===

How is the computer running now?

#3 Payton209

Payton209
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:04:54 AM

Posted 08 June 2015 - 12:17 AM

Here is the Fixlog.exe

 

Fix result of Farbar Recovery Scan Tool (x64) Version:03-06-2015
Ran by payton at 2015-06-08 11:01:52 Run:1
Running from C:\Users\payton\Desktop
Loaded Profiles: payton (Available Profiles: payton)
Boot Mode: Normal
==============================================
 
fixlist content:
*****************
start
 
CreateRestorePoint:
CloseProcesses:
 
AppInit_DLLs: C:\PROGRA~2\SEARCH~1\SEARCH~1\bin\SPVC64~1.DLL => C:\PROGRA~2\SEARCH~1\SEARCH~1\bin\SPVC64~1.DLL File not found
AppInit_DLLs-x32: C:\PROGRA~2\SEARCH~1\SEARCH~1\bin\SPVC32~1.DLL => "C:\PROGRA~2\SEARCH~1\SEARCH~1\bin\SPVC32~1.DLL" File not found
ShortcutTarget: GoPro Importer.lnk -> C:\Users\payton\Desktop\GoPro\Tools\Importer\GoPro Importer.exe (No File)
ShellIconOverlayIdentifiers: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  No File
ShellIconOverlayIdentifiers: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  No File
ShellIconOverlayIdentifiers: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  No File
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  No File
ShellIconOverlayIdentifiers-x32: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  No File
ShellIconOverlayIdentifiers-x32: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  No File
ShellIconOverlayIdentifiers-x32: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  No File
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-3211262294-3724246191-2359105936-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled
ProxyServer: [.DEFAULT] => http=127.0.0.1:13081
FF Extension: Hawker - C:\Users\payton\AppData\Roaming\Mozilla\Firefox\Profiles\dwdc9ic9.default\Extensions\{B5643E87-4502-60E2-A32A-6E126145609B} [2015-06-02]
FF Extension: No Name - C:\Users\payton\AppData\Roaming\Mozilla\Firefox\Profiles\dwdc9ic9.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} [not found]
FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [not found]
CHR Extension: (No Name) - C:\Users\payton\AppData\Local\Google\Chrome\User Data\Default\Extensions\dlbemabjbfhjcccahjioenmkgimjbbkd [2015-06-04]
CHR HKU\S-1-5-21-3211262294-3724246191-2359105936-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [bakijjialdiiboeaknfpmflphhmljfkd] - https://clients2.google.com/service/update2/crx
CHR HKU\S-1-5-21-3211262294-3724246191-2359105936-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [dhdgffkkebhmkfjojejmpbldmpobfkfo] - http://clients2.google.com/service/update2/crx
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]
C:\Users\payton\AppData\Roaming\Mozilla\Firefox\Profiles\dwdc9ic9.default\Extensions\{B5643E87-4502-60E2-A32A-6E126145609B}
C:\Users\payton\AppData\Local\Google\Chrome\User Data\Default\Extensions\dlbemabjbfhjcccahjioenmkgimjbbkd
 
End
*****************
 
Restore point was successfully created.
Processes closed successfully.
"C:\PROGRA~2\SEARCH~1\SEARCH~1\bin\SPVC64~1.DLL" => value data removed successfully.
"C:\PROGRA~2\SEARCH~1\SEARCH~1\bin\SPVC32~1.DLL" => value data removed successfully.
C:\Users\payton\Desktop\GoPro\Tools\Importer\GoPro Importer.exe not found.
"HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ SkyDrive1" => key removed successfully
HKCR\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A} => key not found. 
"HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ SkyDrive2" => key removed successfully
HKCR\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => key not found. 
"HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ SkyDrive3" => key removed successfully
HKCR\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524} => key not found. 
"HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\00avast" => key removed successfully
HKCR\CLSID\{472083B0-C522-11CF-8763-00608CC02F24} => key not found. 
"HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ SkyDrive1" => key removed successfully
HKCR\Wow6432Node\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A} => key not found. 
"HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ SkyDrive2" => key removed successfully
HKCR\Wow6432Node\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => key not found. 
"HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ SkyDrive3" => key removed successfully
HKCR\Wow6432Node\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524} => key not found. 
C:\Windows\system32\GroupPolicy\Machine => moved successfully.
C:\Windows\system32\GroupPolicy\GPT.ini => moved successfully.
C:\Windows\SysWOW64\GroupPolicy\GPT.ini => moved successfully.
"HKLM\SOFTWARE\Policies\Google" => key removed successfully
"HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer" => key removed successfully
"HKU\S-1-5-21-3211262294-3724246191-2359105936-1001\SOFTWARE\Policies\Microsoft\Internet Explorer" => key removed successfully
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable => value removed successfully
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer => value removed successfully
C:\Users\payton\AppData\Roaming\Mozilla\Firefox\Profiles\dwdc9ic9.default\Extensions\{B5643E87-4502-60E2-A32A-6E126145609B} => moved successfully.
C:\Users\payton\AppData\Roaming\Mozilla\Firefox\Profiles\dwdc9ic9.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} not found.
C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} not found.
C:\Users\payton\AppData\Local\Google\Chrome\User Data\Default\Extensions\dlbemabjbfhjcccahjioenmkgimjbbkd => moved successfully.
"HKU\S-1-5-21-3211262294-3724246191-2359105936-1001\SOFTWARE\Google\Chrome\Extensions\bakijjialdiiboeaknfpmflphhmljfkd" => key removed successfully
"HKU\S-1-5-21-3211262294-3724246191-2359105936-1001\SOFTWARE\Google\Chrome\Extensions\dhdgffkkebhmkfjojejmpbldmpobfkfo" => key removed successfully
EagleX64 => Service removed successfully
"C:\Users\payton\AppData\Roaming\Mozilla\Firefox\Profiles\dwdc9ic9.default\Extensions\{B5643E87-4502-60E2-A32A-6E126145609B}" => File/Folder not found.
"C:\Users\payton\AppData\Local\Google\Chrome\User Data\Default\Extensions\dlbemabjbfhjcccahjioenmkgimjbbkd" => File/Folder not found.
 
 
The system needed a reboot.. 
 
==== End of Fixlog 11:02:38 ====

Edited by Payton209, 08 June 2015 - 01:16 PM.


#4 Payton209

Payton209
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:04:54 AM

Posted 08 June 2015 - 01:26 PM

I'm going to run the Adwcleaner right now. I'll post the results when it's finished. 



#5 Payton209

Payton209
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:04:54 AM

Posted 08 June 2015 - 04:26 PM

Final results from the Adwcleaner scan.

 

# AdwCleaner v4.206 - Logfile created 08/06/2015 at 14:13:01
# Updated 01/06/2015 by Xplode
# Database : 2015-06-05.1 [Server]
# Operating system : Windows 8.1  (x64)
# Username : payton - PANDAS
# Running from : C:\Users\payton\Desktop\adwcleaner_4.206.exe
# Option : Cleaning
 
***** [ Services ] *****
 
 
***** [ Files / Folders ] *****
 
Folder Deleted : C:\Users\payton\AppData\Local\Google\Chrome\User Data\Default\Extensions\dlbemabjbfhjcccahjioenmkgimjbbkd
 
***** [ Scheduled tasks ] *****
 
Task Deleted : LaunchApp
Task Deleted : LaunchPreSignup
Task Deleted : amiupdaterExd
Task Deleted : amiupdaterExi
Task Deleted : PCPrivacyDock_Start
Task Deleted : PCPrivacyDock_Popup
Task Deleted : PCPrivacyDock_Master
 
***** [ Shortcuts ] *****
 
 
***** [ Registry ] *****
 
Key Deleted : HKLM\SOFTWARE\Classes\Record\{37AC0F3B-749F-3B22-811B-5A019EED2E85}
Key Deleted : HKLM\SOFTWARE\Classes\Record\{4392A6CC-7940-310E-8E16-799A8D93A438}
Key Deleted : HKLM\SOFTWARE\Classes\Record\{66DF7821-ED6D-3534-893C-0E89E74B0F91}
Key Deleted : HKLM\SOFTWARE\Classes\Record\{755CAFCC-F016-3B06-8F22-945EAA3AD10D}
Key Deleted : HKLM\SOFTWARE\Classes\Record\{76552F88-640C-314D-82B6-0D8A740907F7}
Key Deleted : HKLM\SOFTWARE\Classes\Record\{05660A04-00F1-3A04-AB3B-BC1074B84D67}
Key Deleted : HKLM\SOFTWARE\Classes\Record\{903F9872-E87F-3B74-83B0-DBE10073B29D}
Key Deleted : HKLM\SOFTWARE\Classes\Record\{9558EEB4-CDA6-3778-B53B-98076F0A1E90}
Key Deleted : HKLM\SOFTWARE\Classes\Record\{B25AA9BA-FD52-3E5E-BFE3-9B106779DA6E}
Key Deleted : HKLM\SOFTWARE\Classes\Record\{C852CF9F-37DC-35AC-926A-7E6CFFF7C501}
Key Deleted : HKLM\SOFTWARE\Classes\Record\{C9777796-4378-3C90-B52D-7238FFFC2A5C}
Key Deleted : HKLM\SOFTWARE\Classes\Record\{DB1BC8B2-FDBF-30E7-BE1C-AFF9160059E6}
Key Deleted : HKLM\SOFTWARE\Classes\Record\{F3D5729C-7DEB-3850-A026-D0E323ECFEF5}
Key Deleted : HKLM\SOFTWARE\Classes\Record\{FEC70973-CB8B-351C-8047-CAE1274CE249}
Key Deleted : HKLM\SOFTWARE\5da059a482fd494db3f252126fbc3d5b
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{5A4E3A41-FA55-4BDA-AED7-CEBE6E7BCB52}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{6E993643-8FBC-44FE-BC85-D318495C4D96}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{4E6354DE-9115-4AEE-BD21-C46C3E8A49DB}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{FC073BDA-C115-4A1D-9DF9-9B5C461482E5}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{A2D733A7-73B0-4C6B-B0C7-06A432950B66}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{4E6354DE-9115-4AEE-BD21-C46C3E8A49DB}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{FC073BDA-C115-4A1D-9DF9-9B5C461482E5}
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{31090377-0740-419E-BEFC-A56E50500D5B}
Key Deleted : HKCU\Software\Conduit
Key Deleted : HKCU\Software\IM
Key Deleted : HKCU\Software\RegisteredApplicationsEx
Key Deleted : HKCU\Software\Tutorials
Key Deleted : HKCU\Software\Appscion
Key Deleted : HKCU\Software\Hawker
Key Deleted : HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}
Key Deleted : HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}
Key Deleted : HKLM\SOFTWARE\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
Key Deleted : HKLM\SOFTWARE\{6791A2F3-FC80-475C-A002-C014AF797E9C}
Key Deleted : HKLM\SOFTWARE\InstallCore
Key Deleted : HKLM\SOFTWARE\SPPDCOM
Key Deleted : HKLM\SOFTWARE\PCTechHotline
Key Deleted : HKLM\SOFTWARE\Hawker
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{8B114619-78B7-1CFF-55EF-74266954F883}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{AD11DADE-C597-45D9-D8C5-1D2EB0B89613}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{374CF14E-17AB-463A-A4AD-31138D4DF8E7}
Data Deleted : HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyServer] - hxxp=127.0.0.1:13081
Data Deleted : HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyEnable] - 1
Data Deleted : HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyOverride] - <-loopback>
Data Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyOverride] - <-loopback>
 
***** [ Web browsers ] *****
 
-\\ Internet Explorer v11.0.9600.17416
 
 
-\\ Mozilla Firefox v
 
 
-\\ Google Chrome v43.0.2357.81
 
[C:\Users\payton\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [Search Provider] : hxxp://search.aol.com/aol/search?q={searchTerms}
[C:\Users\payton\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [Search Provider] : hxxp://www.ask.com/web?q={searchTerms}
 
-\\ Comodo Dragon v
 
 
-\\ Chrome Canary v
 
 
*************************
 
AdwCleaner[R0].txt - [8092 bytes] - [04/06/2015 11:50:55]
AdwCleaner[R1].txt - [8151 bytes] - [04/06/2015 11:54:26]
AdwCleaner[R2].txt - [5867 bytes] - [04/06/2015 12:58:18]
AdwCleaner[R3].txt - [5862 bytes] - [04/06/2015 14:24:51]
AdwCleaner[R4].txt - [5736 bytes] - [08/06/2015 11:20:50]
AdwCleaner[R5].txt - [5795 bytes] - [08/06/2015 11:27:07]
AdwCleaner[R6].txt - [5854 bytes] - [08/06/2015 11:59:31]
AdwCleaner[S0].txt - [2969 bytes] - [04/06/2015 12:17:37]
AdwCleaner[S1].txt - [515 bytes] - [04/06/2015 13:05:21]
AdwCleaner[S2].txt - [391 bytes] - [04/06/2015 14:27:14]
AdwCleaner[S3].txt - [5391 bytes] - [08/06/2015 14:13:01]
 
########## EOF - C:\AdwCleaner\AdwCleaner[S3].txt - [5450  bytes] ##########


#6 nasdaq

nasdaq

  • Malware Response Team
  • 39,569 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:07:54 AM

Posted 09 June 2015 - 08:54 AM

How is the computer running now?

#7 Payton209

Payton209
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:04:54 AM

Posted 09 June 2015 - 02:46 PM

It's running a lot better, thank you, but grillaprice is still showing up in Control Panel\All Control Panel Items\Programs and Features.



#8 nasdaq

nasdaq

  • Malware Response Team
  • 39,569 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:07:54 AM

Posted 10 June 2015 - 07:11 AM


If you stried to remove the program via the Add/Remove programs list and you are informed that it's not available then leave it alone.

This is just a dead entry in the Registry and is not causing any problems.
===


If all is well.

To learn more about how to protect yourself while on the internet read this little guide best security practices keep safe.
http://www.bleepingcomputer.com/forums/t/407147/answers-to-common-security-questions-best-practices/
===

#9 Payton209

Payton209
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:04:54 AM

Posted 10 June 2015 - 09:15 AM

Okay, thank you for all your time and help.


Edited by Payton209, 10 June 2015 - 09:16 AM.


#10 Payton209

Payton209
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:04:54 AM

Posted 11 June 2015 - 07:40 PM

Hi,
 
I tried removing grillaprice from the Control Panel.  It launches the browser to http://gorillauninstallation.com/uninstaller3.html, which Chrome detects as being a malicious site.  Since I'm trying to clean my computer I didn't go to the site.  I also found several registry entries for grillaprice, so it's still somewhere on my system.
 
I also ran MalwareBytes again.  It found 2 items and quarantined them:
 
Registry Values: 1
PUM.Bad.Proxy, HKU\S-1-5-18\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS|ProxyServer, http=127.0.0.1:13081, Quarantined, [d796bffa3c4e3df9fddb9be4a3625aa6]
 
Files: 1
PUP.Optional.CloudScout.A, C:\Windows\System32\Tasks\CloudLARAMIE, Quarantined, [d19cdedb2e5cfc3a9d771f6a33d21de3],
 
 
The computer continues to run good.


#11 nasdaq

nasdaq

  • Malware Response Team
  • 39,569 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:07:54 AM

Posted 12 June 2015 - 07:04 AM

Lets search the Registry.

Please run the Farbar Recovery Scan Tool. Enter grillaprice in the Search Box.
Click the Search Registry button, post the content of the Search.txt file in your next reply.


<<<>>>

#12 Payton209

Payton209
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:04:54 AM

Posted 12 June 2015 - 01:39 PM

Here it is.

 

Farbar Recovery Scan Tool (x64) Version:03-06-2015
Ran by payton at 2015-06-12 11:39:00
Running from C:\Users\payton\Desktop
Boot Mode: Normal
 
================== Search Registry: "Grillaprice" ===========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\GrillaPrice]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\grillaprice]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\grillaprice]
"DisplayName"="grillaprice"
[HKEY_USERS\S-1-5-21-3211262294-3724246191-2359105936-1001\Software\Microsoft\Windows\CurrentVersion\Applets\Regedit]
"LastKey"="Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\grillaprice"
 
====== End of Search ======


#13 nasdaq

nasdaq

  • Malware Response Team
  • 39,569 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:07:54 AM

Posted 13 June 2015 - 07:50 AM

Copy the text IN THE QUOTE BOX below to notepad. Save it as fixme.reg to your desktop.
Be sure the "Save as" type is set to "all files" Once you have saved Right click the .reg file and allow it to merge with the registry.

Windows Registry Editor Version 5.00

[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\GrillaPrice]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\grillaprice]
[HKEY_USERS\S-1-5-21-3211262294-3724246191-2359105936-1001\Software\Microsoft\Windows\CurrentVersion\Applets\Regedit]
"LastKey"=-


Restart the when completed.

You can delete the fixme.reg file when done.
===

How is it now?

#14 Payton209

Payton209
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:04:54 AM

Posted 13 June 2015 - 11:14 PM

Grillaprice was removed, thank you. I'm going to see how the computer runs for a day or two and then let you know.


Edited by Payton209, 13 June 2015 - 11:16 PM.


#15 Payton209

Payton209
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:04:54 AM

Posted 15 June 2015 - 11:31 PM

The computer is running great! Thank you again for you time.






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users