Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

AdwCleaner Registry Edits Broke Laptop ... Need Help Restoring


  • This topic is locked This topic is locked
2 replies to this topic

#1 tonyshoraka

tonyshoraka

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:12:56 PM

Posted 19 July 2015 - 09:58 PM

I just ran AdwCleaner and it suggested a number of actions, including a number of registry edits (Key deletions). After a reboot my laptop won't do anything!

 

I get a bunch of error messages that sound real serious ... some are Windows System errors ... I can't connect to the internet ... my wifi adapter is DEAD ... and the list goes on ...

 

I suspect that the cause of all of these is that I either downloaded/ran a bogus version of AdwCleaner ... or that the genuine AdwCleaner incorrectly identified registry issues.

 

I'm pasting the contents of TWO log files below (FRST.txt and AdwCleaner log) and attaching Addition.txt

 

Any help would be MOST appreciated!

 

 

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:18-07-2015 01
Ran by Aries2 (administrator) on ARIES2-HP on 19-07-2015 22:36:14
Running from H:\Cleanup & Recovery
Loaded Profiles: Aries2 (Available Profiles: Aries2 & Tony)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: English (United States)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
 
==================== Processes (Whitelisted) =================
 
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgrsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgcsrva.exe
(HP) C:\Program Files (x86)\HP SimplePass 2011\TrueSuiteService.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
(HP) C:\Program Files (x86)\HP SimplePass 2011\TouchControl.exe
(HP) C:\Program Files (x86)\HP SimplePass 2011\BioMonitor.exe
(Greatis Software, LLC) C:\Program Files (x86)\BootRacer\BootRacerServ.exe
(Hewlett-Packard Company) C:\Windows\System32\hpservice.exe
(SurfRight B.V.) C:\Program Files\HitmanPro\hmpsched.exe
(Andrea Electronics Corporation) C:\Program Files\IDT\WDM\AESTSr64.exe
() C:\ProgramData\Aircard Connection\OnlineUpdate\ouc.exe
(Intel® Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\Apoint.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgwdsvc.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\ApMsgFwd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
() C:\Program Files\Hewlett-Packard\HP LaunchBox\HPTaskBar1.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\HP LaunchBox\HPTaskBar2.exe
() C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\ApntEx.exe
(Google Inc.) C:\Users\Aries2\AppData\Local\Google\Update\GoogleUpdate.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office14\GROOVEMN.EXE
(Google Inc.) C:\Users\Aries2\AppData\Local\Google\Chrome\Application\chrome.exe
(Dropbox, Inc.) C:\Users\Aries2\AppData\Local\Dropbox\Update\DropboxUpdate.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgemca.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
(Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\acrotray.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgui.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe
(Elias Fotinis) C:\Program Files (x86)\DeskPins\DeskPins.exe
(Evernote Corp., 305 Walnut Street, Redwood City, CA 94063) C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE
() C:\ProgramData\DatacardService\HWDeviceService64.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\BrownyInd\Brother\BrIndicator.exe
(Huawei Technologies Co., Ltd.) C:\ProgramData\DatacardService\DCSHelper.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe
() C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe
(Intel® Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Splashtop Inc.) C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
(Splashtop Inc.) C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRServer.exe
(Splashtop Inc.) C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRFeature.exe
(Spotflux) C:\Program Files (x86)\Spotflux\services\SpotfluxUpdateService.exe
(Splashtop Inc.) C:\Program Files (x86)\Splashtop\Splashtop Software Updater\SSUService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
(Macrovision Europe Ltd.) C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\BrYNSvc.exe
(Cubic Reality Software) C:\Program Files (x86)\CubicExplorer\CubicExplorer.exe
() C:\Users\Aries2\Desktop\Cleanup & Recovery\adwcleaner_4.208.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
(Cubic Reality Software) C:\Program Files (x86)\CubicExplorer\CubicExplorer.exe
(Microsoft Corporation) C:\Windows\System32\wbem\WMIADAP.exe
 
 
==================== Registry (Whitelisted) ==================
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 
HKLM\...\Run: [IntelPAN] => C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe [1935120 2011-05-02] (Intel® Corporation)
HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [1128448 2011-05-27] (IDT, Inc.)
HKLM\...\Run: [Apoint] => C:\Program Files\Apoint2K\Apoint.exe [569200 2011-02-18] (Alps Electric Co., Ltd.)
HKLM\...\Run: [SetDefault] => C:\Program Files\Hewlett-Packard\HP LaunchBox\SetDefault.exe [42808 2011-06-27] (Hewlett-Packard Development Company, L.P.)
HKLM\...\Run: [BCSSync] => C:\Program Files\Microsoft Office\Office14\BCSSync.exe [108144 2012-11-05] (Microsoft Corporation)
HKLM\...\Run: [CDAServer] => C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe [456704 2012-02-20] ()
HKLM\...\Run: [BoxSync] => C:\Program Files\Box\Box Sync\BoxSync.exe [5816048 2015-06-25] (Box, Inc.)
HKLM-x32\...\Run: [HPQuickWebProxy] => C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe [168504 2011-06-28] (Hewlett-Packard Company)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [40336 2015-04-29] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [HP CoolSense] => C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe [1342008 2011-08-26] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [HP Quick Launch] => C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [587320 2011-06-14] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [Acrobat Assistant 8.0] => C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe [624248 2007-05-10] (Adobe Systems Inc.)
HKLM-x32\...\Run: [HPOSD] => C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe [379960 2011-08-19] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [AVG_UI] => C:\Program Files (x86)\AVG\AVG2015\avgui.exe [3730344 2015-06-30] (AVG Technologies CZ, s.r.o.)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [BrStsMon00] => C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe [4509184 2012-12-27] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [BrStsInd00] => C:\Program Files (x86)\BrownyInd\Brother\BrIndicator.exe [1885184 2012-12-18] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [CleanPage_Service] => C:\Program Files (x86)\Readonweb\CleanPage\CleanPage_Service.exe [1159976 2011-05-25] (Readonweb, LLC)
HKLM-x32\...\Run: [BrMfcWnd] => C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe [1159168 2009-05-26] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [ControlCenter3] => C:\Program Files (x86)\Brother\ControlCenter3\brctrcen.exe [114688 2008-12-24] (Brother Industries, Ltd.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer\Run: [BootRacer] => C:\Program Files (x86)\BootRacer\Bootrace.exe [3901200 2015-03-24] (Greatis Software)
HKU\S-1-5-21-3497853935-4128478283-4285659389-1000\...\Run: [Google Update] => C:\Users\Aries2\AppData\Local\Google\Update\GoogleUpdate.exe [107912 2014-10-15] (Google Inc.)
HKU\S-1-5-21-3497853935-4128478283-4285659389-1000\...\Run: [GoogleDriveSync] => C:\Program Files (x86)\Google\Drive\googledrivesync.exe [22012688 2015-06-20] (Google)
HKU\S-1-5-21-3497853935-4128478283-4285659389-1000\...\Run: [OfficeSyncProcess] => C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE [911032 2015-03-18] (Microsoft Corporation)
HKU\S-1-5-21-3497853935-4128478283-4285659389-1000\...\Run: [GrooveMonitor] => C:\Program Files\Microsoft Office\Office14\GROOVEMN.EXE [1373888 2013-03-06] (Microsoft Corporation)
HKU\S-1-5-21-3497853935-4128478283-4285659389-1000\...\Run: [C8F00DD99F2CF6D2CEE12DBE94C7BC04CB5C9FE5._service_run] => C:\Users\Aries2\AppData\Local\Google\Chrome\Application\chrome.exe [813896 2015-07-13] (Google Inc.)
HKU\S-1-5-21-3497853935-4128478283-4285659389-1000\...\Run: [Box Edit] => C:\Users\Aries2\AppData\Local\Box\Box Edit\Box Edit.exe [481816 2014-07-24] (Box)
HKU\S-1-5-21-3497853935-4128478283-4285659389-1000\...\Run: [OneDrive] => C:\Users\Aries2\AppData\Local\Microsoft\OneDrive\OneDrive.exe [382664 2015-05-21] (Microsoft Corporation)
HKU\S-1-5-21-3497853935-4128478283-4285659389-1000\...\Run: [Dropbox Update] => C:\Users\Aries2\AppData\Local\Dropbox\Update\DropboxUpdate.exe [134512 2015-05-17] (Dropbox, Inc.)
HKU\S-1-5-21-3497853935-4128478283-4285659389-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [8358680 2015-06-01] (Piriform Ltd)
HKU\S-1-5-18\...\RunOnce: [Report] => \AdwCleaner\AdwCleaner[S1].txt
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Install LastPass FF RunOnce.lnk [2014-11-08]
ShortcutTarget: Install LastPass FF RunOnce.lnk -> C:\Program Files (x86)\Common Files\lpuninstall.exe ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Install LastPass IE RunOnce.lnk [2014-11-08]
ShortcutTarget: Install LastPass IE RunOnce.lnk -> C:\Program Files (x86)\Common Files\lpuninstall.exe ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\PhraseExpress.lnk [2014-11-04]
ShortcutTarget: PhraseExpress.lnk -> C:\Program Files (x86)\PhraseExpress\phraseexpress.exe (Bartels Media GmbH)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\PrivateTunnel.lnk [2013-12-18]
ShortcutTarget: PrivateTunnel.lnk -> C:\Program Files (x86)\OpenVPN Technologies\PrivateTunnel\core\ovpntray.exe ()
Startup: C:\Users\Aries2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DeskPins.lnk [2014-08-03]
ShortcutTarget: DeskPins.lnk -> C:\Program Files (x86)\DeskPins\DeskPins.exe (Elias Fotinis)
Startup: C:\Users\Aries2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EvernoteClipper.lnk [2015-06-13]
ShortcutTarget: EvernoteClipper.lnk -> C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)
Startup: C:\Users\Aries2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Screen Clipper and Launcher.lnk [2014-08-11]
ShortcutTarget: OneNote 2010 Screen Clipper and Launcher.lnk -> C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation)
ShellIconOverlayIdentifiers: [    BoxSyncFileLocked] -> {2a607da5-abe8-358e-a881-c0f5faf2d3a5} => C:\Windows\system32\mscoree.dll [2010-11-20] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [    BoxSyncFileLockedByOther] -> {f7d2951f-0b6b-346c-99ec-69cffc30a364} => C:\Windows\system32\mscoree.dll [2010-11-20] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [    BoxSyncNotSynced] -> {5ea95e3d-3e46-3812-b03c-49785fa67d41} => C:\Windows\system32\mscoree.dll [2010-11-20] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [    BoxSyncProblem] -> {a88b7184-bfa1-3d14-8efb-2225df9699bc} => C:\Windows\system32\mscoree.dll [2010-11-20] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [    BoxSyncSynced] -> {c89f9943-8f58-3eca-bd55-a658f53b2f48} => C:\Windows\system32\mscoree.dll [2010-11-20] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Aries2\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll [2015-07-16] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Aries2\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll [2015-07-16] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt3] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Aries2\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll [2015-07-16] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt4] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Aries2\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll [2015-07-16] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt5] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Aries2\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll [2015-07-16] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt6] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Aries2\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll [2015-07-16] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt7] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Aries2\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll [2015-07-16] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt8] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Aries2\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll [2015-07-16] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => C:\Users\Aries2\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\amd64\FileSyncShell64.dll [2015-05-21] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => C:\Users\Aries2\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\amd64\FileSyncShell64.dll [2015-05-21] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => C:\Users\Aries2\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\amd64\FileSyncShell64.dll [2015-05-21] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Aries2\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll [2015-07-16] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Aries2\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll [2015-07-16] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt3] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Aries2\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll [2015-07-16] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt4] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Aries2\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll [2015-07-16] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt5] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Aries2\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll [2015-07-16] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt6] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Aries2\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll [2015-07-16] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt7] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Aries2\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll [2015-07-16] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt8] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Aries2\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll [2015-07-16] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => C:\Users\Aries2\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\FileSyncShell.dll [2015-05-21] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => C:\Users\Aries2\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\FileSyncShell.dll [2015-05-21] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => C:\Users\Aries2\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\FileSyncShell.dll [2015-05-21] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Aries2\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll [2015-07-16] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Aries2\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll [2015-07-16] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Aries2\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll [2015-07-16] (Dropbox, Inc.)
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
 
==================== Internet (Whitelisted) ====================
 
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/?ocid=iehp
HKU\S-1-5-21-3497853935-4128478283-4285659389-1000\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/ncr
SearchScopes: HKLM-x32 -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = http://search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKLM-x32 -> {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = http://en.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-3497853935-4128478283-4285659389-1000 -> {B8E95DE7-4C81-41C5-BD1A-0B59A6C9E412} URL = http://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us2-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation)
BHO: LastPass Vault -> {95D9ECF5-2A4D-4550-BE49-70D42F71296E} -> C:\Program Files (x86)\LastPass\LPToolbar_x64.dll [2015-07-19] (LastPass)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL [2014-01-23] (Microsoft Corporation)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation)
BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll [2015-02-20] (Oracle Corporation)
BHO-x32: Evernote extension -> {92EF2EAD-A7CE-4424-B0DB-499CF856608E} -> C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll [2015-07-01] (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)
BHO-x32: LastPass Vault -> {95D9ECF5-2A4D-4550-BE49-70D42F71296E} -> C:\Program Files (x86)\LastPass\LPToolbar.dll [2015-07-19] (LastPass)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL [2014-01-22] (Microsoft Corporation)
BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL [2015-06-16] (Microsoft Corporation)
BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll [2015-02-20] (Oracle Corporation)
BHO-x32: CleanPageBHO Class -> {F097E5AB-4C45-4e41-8BAD-34D785BEC6BB} -> C:\Program Files (x86)\Readonweb\CleanPage\CleanPage.dll [2011-05-25] (Readonweb, LLC)
Toolbar: HKLM - LastPass Toolbar - {9f6b5cc3-5c7b-4b5c-97af-19dec1e380e5} - C:\Program Files (x86)\LastPass\LPToolbar_x64.dll [2015-07-19] (LastPass)
Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll [2007-05-10] (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - ReadonwebToolbar - {B6283D8C-01AB-11DB-9D6F-E11AAB065F98} - C:\Program Files (x86)\Readonweb\CleanPage\ReadonwebToolbar.dll [2011-05-25] (Readonweb, LLC)
Toolbar: HKLM-x32 - LastPass Toolbar - {9f6b5cc3-5c7b-4b5c-97af-19dec1e380e5} - C:\Program Files (x86)\LastPass\LPToolbar.dll [2015-07-19] (LastPass)
Toolbar: HKU\.DEFAULT -> No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} -  No File
Toolbar: HKU\S-1-5-21-3497853935-4128478283-4285659389-1000 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File
Toolbar: HKU\S-1-5-21-3497853935-4128478283-4285659389-1000 -> No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} -  No File
DPF: HKLM-x32 {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} http://qtinstall.apple.com/qtactivex/qtplugin.cab
DPF: HKLM-x32 {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} http://h20614.www2.hp.com/ediags/gmd/Install/Cab/hpdetect118.cab
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553530000} http://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG2012\avgpp.dll No File
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL [2015-02-17] (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)
Winsock: Missing Catalog9 entry, broken internet access. <===== ATTENTION.
Winsock: Missing Catalog9-x64 entry, broken internet access. <===== ATTENTION.
Tcpip\..\Interfaces\{244EB26F-BF32-40AB-A545-860A0F5ACDF4}: [NameServer] 115.178.58.10 115.178.58.26
Tcpip\..\Interfaces\{573C7C62-4BD6-410C-99FA-614715352D9C}: [DhcpNameServer] 192.168.10.1
Tcpip\..\Interfaces\{838E6669-1992-4099-B3C4-13AB305765D6}: [NameServer] 8.8.8.8,8.8.4.4
Tcpip\..\Interfaces\{DDE26360-B79E-4D5F-9CBE-6FDD47AA5644}: [DhcpNameServer] 44.0.0.252
 
FireFox:
========
FF ProfilePath: C:\Users\Aries2\AppData\Roaming\Mozilla\Firefox\Profiles\tfipvbzx.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_18_0_0_209.dll [2015-07-14] ()
FF Plugin: @lastpass.com/NPLastPass -> C:\Program Files (x86)\LastPass\nplastpass64.dll [2014-11-08] (LastPass)
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-16] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~2\Office15\NPSPWRAP.DLL [2014-01-23] (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_18_0_0_209.dll [2015-07-14] ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1213153.dll [2014-06-24] (Adobe Systems, Inc.)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2011-11-14] ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2013-10-07] (Google)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll [2014-01-06] (Google, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll [2015-02-20] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll [2015-02-20] (Oracle Corporation)
FF Plugin-x32: @lastpass.com/NPLastPass -> C:\Program Files (x86)\LastPass\nplastpass64.dll [2014-11-08] (LastPass)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL [2014-01-22] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2010-11-10] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2010-11-10] (Microsoft Corporation)
FF Plugin-x32: @rim.com/npappworld -> C:\Program Files (x86)\Research In Motion Limited\BlackBerry App World Browser Plugin\npappworld.dll [2012-03-21] ()
FF Plugin-x32: @RIM.com/WebSLLauncher,version=1.0 -> C:\Program Files (x86)\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll [2011-05-26] ()
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-16] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-16] (Google Inc.)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\5\NP_wtapp.dll [2012-04-17] ()
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll [2015-04-29] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-3497853935-4128478283-4285659389-1000: @citrix.com/CitrixOmegaPlugin -> C:\Users\Aries2\AppData\Roaming\Citrix\CitrixOmegaPlugin\0.1.0.84\npCitrixOmegaPlugin.dll [2013-11-07] (Citrix)
FF Plugin HKU\S-1-5-21-3497853935-4128478283-4285659389-1000: @citrixonline.com/appdetectorplugin -> C:\Users\Aries2\AppData\Local\Citrix\Plugins\104\npappdetector.dll [2013-07-09] (Citrix Online)
FF Plugin HKU\S-1-5-21-3497853935-4128478283-4285659389-1000: @talk.google.com/GoogleTalkPlugin -> C:\Users\Aries2\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll [2015-04-17] (Google)
FF Plugin HKU\S-1-5-21-3497853935-4128478283-4285659389-1000: @talk.google.com/O1DPlugin -> C:\Users\Aries2\AppData\Roaming\Mozilla\plugins\npo1d.dll [2015-04-17] (Google)
FF Plugin HKU\S-1-5-21-3497853935-4128478283-4285659389-1000: @tools.google.com/Google Update;version=3 -> C:\Users\Aries2\AppData\Local\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-16] (Google Inc.)
FF Plugin HKU\S-1-5-21-3497853935-4128478283-4285659389-1000: @tools.google.com/Google Update;version=9 -> C:\Users\Aries2\AppData\Local\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-16] (Google Inc.)
FF Plugin HKU\S-1-5-21-3497853935-4128478283-4285659389-1000: @zoom.us/ZoomVideoPlugin -> C:\Users\Aries2\AppData\Roaming\Zoom\bin\npzoomplugin.dll [2014-04-17] (Zoom Video Communications, Inc.)
FF Plugin HKU\S-1-5-21-3497853935-4128478283-4285659389-1000: box.com/BoxEdit -> C:\Users\Aries2\AppData\Local\Box\Box Edit\npBoxEdit.dll [2014-07-24] (Box)
FF Plugin ProgramFiles/Appdata: C:\Users\Aries2\AppData\Roaming\mozilla\plugins\npgoogletalk.dll [2015-04-17] (Google)
FF Plugin ProgramFiles/Appdata: C:\Users\Aries2\AppData\Roaming\mozilla\plugins\npo1d.dll [2015-04-17] (Google)
FF Extension: LastPass - C:\Users\Aries2\AppData\Roaming\Mozilla\Firefox\Profiles\tfipvbzx.default\Extensions\support@lastpass.com [2014-11-08]
FF Extension: Evernote Web Clipper - C:\Users\Aries2\AppData\Roaming\Mozilla\Firefox\Profiles\tfipvbzx.default\Extensions\{E0B8C461-F8FB-49b4-8373-FE32E9252800} [2014-06-10]
FF Extension: Disconnect - C:\Users\Aries2\AppData\Roaming\Mozilla\Firefox\Profiles\tfipvbzx.default\Extensions\2.0@disconnect.me.xpi [2013-12-30]
FF Extension: TrueSuite Website Logon - C:\Program Files (x86)\Mozilla Firefox\extensions\websitelogon@truesuite.com [2015-02-17]
FF Extension: No Name - C:\Users\Aries2\AppData\Roaming\Mozilla\Firefox\Profiles\tfipvbzx.default\extensions\isreaditlater@ideashower.com [not found]
 
Chrome: 
=======
CHR Profile: C:\Users\Aries2\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Drive) - C:\Users\Aries2\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-02-06]
CHR Extension: (OneTab) - C:\Users\Aries2\AppData\Local\Google\Chrome\User Data\Default\Extensions\chphlpgkkbolifaimnlloiipkdnihall [2015-05-01]
CHR Extension: (Unlimited Free VPN - betternet) - C:\Users\Aries2\AppData\Local\Google\Chrome\User Data\Default\Extensions\gjknjjomckknofjidppipffbpoekiipm [2015-05-27]
CHR Extension: (Website Logon) - C:\Users\Aries2\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdhihajbmafmgilcciomnamcjfkdhikl [2015-02-06]
CHR Extension: (LastPass: Free Password Manager) - C:\Users\Aries2\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdokiejnpimakedhajhdlcegeplioahd [2015-02-06]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Aries2\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-11]
CHR Extension: (Google Wallet) - C:\Users\Aries2\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-02-06]
CHR Extension: (Evernote Web Clipper) - C:\Users\Aries2\AppData\Local\Google\Chrome\User Data\Default\Extensions\pioclpoplcdbaefihamjohnefbikjilc [2015-04-03]
CHR HKLM\...\Chrome\Extension: [hdokiejnpimakedhajhdlcegeplioahd] - http://clients2.google.com/service/update2/crx
CHR HKU\S-1-5-21-3497853935-4128478283-4285659389-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [apdfllckaahabafndbhieahigkjlhalf] - C:\Users\Aries2\AppData\Local\Google\Drive\user_default\apdfllckaahabafndbhieahigkjlhalf_live.crx [2013-05-03]
CHR HKLM-x32\...\Chrome\Extension: [hdhihajbmafmgilcciomnamcjfkdhikl] - C:\Program Files (x86)\HP SimplePass 2011\tschrome.crx [2011-04-14]
CHR HKLM-x32\...\Chrome\Extension: [hdokiejnpimakedhajhdlcegeplioahd] - http://clients2.google.com/service/update2/crx
StartMenuInternet: Google Chrome - C:\Users\Aries2\AppData\Local\Google\Chrome\Application\chrome.exe
 
==================== Services (Whitelisted) =================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
S2 Aircard Connection. RunOuc; C:\Program Files (x86)\Aircard Connection\UpdateDog\ouc.exe [657504 2012-11-12] ()
S2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2015\avgidsagent.exe [3518376 2015-06-30] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files (x86)\AVG\AVG2015\avgwdsvc.exe [314304 2015-06-30] (AVG Technologies CZ, s.r.o.)
R2 BootRacerServ; C:\Program Files (x86)\BootRacer\BootRacerServ.exe [65296 2014-04-30] (Greatis Software, LLC)
S3 BoxSyncUpdateService; C:\Program Files\Box\Box Sync\SyncUpdaterService.exe [28184 2014-09-18] (Box, Inc.)
R3 BrYNSvc; C:\Program Files (x86)\Browny02\BrYNSvc.exe [282112 2012-10-26] (Brother Industries, Ltd.) [File not signed]
S2 CGVPNCliService; C:\Program Files\CyberGhost 5\Service.exe [63968 2015-05-21] (CyberGhost S.R.L)
R3 FLEXnet Licensing Service; C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [654848 2012-06-23] (Macrovision Europe Ltd.) [File not signed]
R2 HitmanProScheduler; C:\Program Files\HitmanPro\hmpsched.exe [127752 2015-07-19] (SurfRight B.V.)
S2 HPSupportSolutionsFrameworkService; C:\Program Files (x86)\Hp\Common\HPSupportSolutionsFrameworkService.exe [89864 2014-12-11] (Hewlett-Packard Company)
R2 HWDeviceService64.exe; C:\ProgramData\DatacardService\HWDeviceService64.exe [346976 2011-03-14] ()
R2 IconMan_R; C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [2375168 2011-03-07] (Realsil Microelectronics Inc.) [File not signed]
S2 KVPNCSvc; C:\Program Files (x86)\Kerio\VPN Client\kvpncsvc.exe [1429504 2013-03-23] (Kerio Technologies Inc.) [File not signed]
S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1133880 2015-06-18] (Malwarebytes Corporation)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [340240 2011-05-02] ()
S2 OpenVPNAccessClient; C:\Program Files (x86)\OpenVPN Technologies\PrivateTunnel\core\capiws.exe [24064 2012-12-14] () [File not signed]
S3 OpenVPNService; C:\Program Files (x86)\OpenVPN\bin\openvpnserv.exe [33080 2014-12-01] (The OpenVPN Project)
R2 PassThru Service; C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe [167424 2012-12-07] () [File not signed]
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [60416 2009-06-22] (Hewlett-Packard) [File not signed]
S2 SpotfluxConnectionManager; C:\Program Files (x86)\Spotflux\services\SpotfluxConnectionManager.exe [102912 2014-10-31] (Spotflux) [File not signed]
R2 SpotfluxUpdateService; C:\Program Files (x86)\Spotflux\services\SpotfluxUpdateService.exe [20992 2014-10-31] (Spotflux) [File not signed]
S2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [5495056 2015-06-18] (TeamViewer GmbH)
S3 wifimansvc; C:\Program Files (x86)\Aircard Connection\eap\wifimansvc.exe [605696 2012-11-23] () [File not signed]
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
 
==================== Drivers (Whitelisted) ====================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [162784 2015-03-11] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [293296 2015-06-26] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [253408 2015-05-12] (AVG Technologies CZ, s.r.o.)
R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [259040 2015-06-16] (AVG Technologies CZ, s.r.o.)
R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [378336 2015-05-07] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [226784 2015-06-10] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [40928 2015-03-20] (AVG Technologies CZ, s.r.o.)
R1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [281568 2015-05-12] (AVG Technologies CZ, s.r.o.)
S3 bcm; C:\Windows\System32\DRIVERS\drxvi314_64.sys [382464 2011-04-26] (Beceem communications pvt ltd.) [File not signed]
S3 bcmbusctr; C:\Windows\System32\DRIVERS\BcmBusCtr_64.sys [60416 2011-04-26] (Beceem communications pvt ltd.) [File not signed]
S3 BthAvrcp; C:\Windows\System32\DRIVERS\BthAvrcp.sys [29184 2009-08-13] (CSR, plc)
R1 epp64; C:\EEK\bin\epp64.sys [136456 2015-07-19] (Emsisoft GmbH)
S3 huawei_wwanecm; C:\Windows\System32\DRIVERS\ew_juwwanecm.sys [241152 2012-12-03] (Huawei Technologies Co., Ltd.)
S3 kvnet; C:\Windows\System32\DRIVERS\kvnet.sys [30208 2013-03-05] (Kerio Technologies Inc.)
S3 mbamchameleon; C:\Windows\system32\drivers\mbamchameleon.sys [107736 2015-07-03] (Malwarebytes Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-06-18] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-06-18] (Malwarebytes Corporation)
S3 NPF; C:\Windows\System32\drivers\NPF.sys [35344 2012-06-05] (CACE Technologies, Inc.)
S3 NPF; C:\Windows\SysWOW64\drivers\NPF.sys [35344 2012-06-05] (CACE Technologies, Inc.)
S3 RimUsb; C:\Windows\System32\Drivers\RimUsb_AMD64.sys [74752 2011-07-25] (Research In Motion Limited)
R3 RimVSerPort; C:\Windows\System32\DRIVERS\RimSerial_AMD64.sys [44032 2011-07-20] (Research in Motion Ltd)
R3 tapoas; C:\Windows\System32\DRIVERS\tapoas.sys [30720 2012-07-15] (The OpenVPN Project)
R3 tapSF0901; C:\Windows\System32\DRIVERS\tapSF0901.sys [39104 2014-10-31] (Spotflux, Inc.)
U3 TrueSight; C:\Windows\System32\drivers\TrueSight.sys [37624 2015-07-19] ()
 
==================== NetSvcs (Whitelisted) ===================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
 
==================== One Month Created files and folders ========
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2015-07-19 22:36 - 2015-07-19 22:36 - 00000000 ____D C:\FRST
2015-07-19 20:53 - 2015-07-19 20:53 - 00012872 _____ (SurfRight B.V.) C:\Windows\system32\bootdelete.exe
2015-07-19 17:59 - 2015-07-19 17:59 - 00000000 ___HD C:\OneDriveTemp
2015-07-19 17:04 - 2015-07-19 18:00 - 00000000 ____D C:\Users\Aries2\Desktop\Cleanup & Recovery
2015-07-19 17:04 - 2015-07-19 17:13 - 00002360 _____ C:\Users\Aries2\Desktop\Rkill.txt
2015-07-19 17:04 - 2015-07-19 14:34 - 00000755 _____ C:\Users\Aries2\Desktop\Start Emsisoft Emergency Kit.lnk
2015-07-19 14:34 - 2015-07-19 14:40 - 00000000 ____D C:\EEK
2015-07-19 12:32 - 2015-07-19 17:38 - 00031496 _____ C:\Windows\system32\.crusader
2015-07-19 11:24 - 2015-07-19 14:09 - 00001897 _____ C:\Users\Public\Desktop\HitmanPro.lnk
2015-07-19 11:24 - 2015-07-19 11:24 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HitmanPro
2015-07-19 11:24 - 2015-07-19 11:24 - 00000000 ____D C:\Program Files\HitmanPro
2015-07-19 11:23 - 2015-07-19 12:33 - 00000000 ____D C:\ProgramData\HitmanPro
2015-07-19 10:46 - 2015-07-19 14:17 - 00037624 _____ C:\Windows\system32\Drivers\TrueSight.sys
2015-07-19 10:46 - 2015-07-19 10:54 - 00000000 ____D C:\ProgramData\RogueKiller
2015-07-19 10:35 - 2015-07-19 10:35 - 00000000 ____D C:\Users\Tony\Documents\PhraseExpress
2015-07-19 09:37 - 2015-07-19 10:35 - 00000000 ____D C:\Users\Tony\AppData\Roaming\PhraseExpress
2015-07-19 09:37 - 2015-07-19 10:24 - 00025147 _____ C:\Users\Tony\ovpntray.log
2015-07-19 09:37 - 2015-07-19 09:40 - 00000000 ____D C:\Users\Tony\AppData\Roaming\PrivateTunnel
2015-07-19 09:37 - 2015-07-19 09:38 - 00000000 ____D C:\Users\Tony\AppData\Roaming\Samsung
2015-07-19 09:37 - 2015-07-19 09:38 - 00000000 ____D C:\Users\Tony\AppData\Roaming\hpqLog
2015-07-19 09:37 - 2015-07-19 09:37 - 00000000 ____D C:\Users\Tony\AppData\Roaming\AVG2015
2015-07-19 09:36 - 2015-07-19 10:07 - 00003926 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{EC16F621-82C8-4FF3-A12A-4BA34FB2D75A}
2015-07-19 09:36 - 2015-07-19 09:36 - 00001417 _____ C:\Users\Tony\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-07-19 09:35 - 2015-07-19 09:38 - 00000000 ____D C:\Users\Tony\AppData\Roaming\Adobe
2015-07-19 09:35 - 2015-07-19 09:37 - 00000000 ____D C:\Users\Tony
2015-07-19 09:35 - 2015-07-19 09:35 - 00000258 __RSH C:\Users\Tony\ntuser.pol
2015-07-19 09:35 - 2015-07-19 09:35 - 00000020 ___SH C:\Users\Tony\ntuser.ini
2015-07-19 09:35 - 2015-07-19 09:35 - 00000000 ____D C:\Users\Tony\AppData\Roaming\Intel
2015-07-19 09:35 - 2014-11-10 06:29 - 00000000 ____D C:\Users\Tony\AppData\Roaming\Macromedia
2015-07-19 09:35 - 2014-05-15 09:43 - 00002104 _____ C:\Users\Tony\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft OneDrive.lnk
2015-07-19 09:35 - 2012-10-13 09:00 - 00000000 ____D C:\Users\Tony\AppData\Roaming\TuneUp Software
2015-07-19 09:35 - 2012-08-01 15:12 - 00000000 ____D C:\Users\Tony\AppData\LocalGoogle
2015-07-19 09:35 - 2009-07-14 00:54 - 00000000 ___RD C:\Users\Tony\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2015-07-19 09:35 - 2009-07-14 00:49 - 00000000 ___RD C:\Users\Tony\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2015-07-19 03:51 - 2015-07-19 05:03 - 00000000 ____D C:\Users\TEMP\AppData\Roaming\CubicExplorer
2015-07-19 03:50 - 2015-07-19 03:50 - 00000000 ____D C:\Users\TEMP\AppData\Roaming\AVG2015
2015-07-18 16:23 - 2015-07-18 16:23 - 00000000 ____D C:\Users\Default\AppData\Roaming\Adobe
2015-07-18 16:23 - 2015-07-18 16:23 - 00000000 ____D C:\Users\Default User\AppData\Roaming\Adobe
2015-07-18 16:12 - 2015-07-18 16:23 - 00000000 ____D C:\Windows\system32\%LOCALAPPDATA%
2015-07-18 13:09 - 2015-07-18 16:56 - 00000000 ____D C:\Users\TEMP\AppData\Roaming\PrivateTunnel
2015-07-18 13:08 - 2015-07-19 13:51 - 00008960 _____ C:\Users\TEMP\ovpntray.log
2015-07-18 13:02 - 2015-07-18 13:05 - 00000258 __RSH C:\Users\TEMP\ntuser.pol
2015-07-18 13:01 - 2015-07-19 12:34 - 00000000 ____D C:\Users\TEMP
2015-07-18 13:01 - 2015-07-18 13:38 - 00000000 ___RD C:\Users\TEMP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2015-07-18 13:01 - 2015-07-18 13:38 - 00000000 ___RD C:\Users\TEMP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2015-07-18 13:01 - 2015-07-18 13:38 - 00000000 ____D C:\Users\TEMP\AppData\Roaming\Intel
2015-07-18 13:01 - 2014-11-10 06:29 - 00000000 ____D C:\Users\TEMP\AppData\Roaming\Macromedia
2015-07-18 13:01 - 2014-05-15 09:43 - 00002104 _____ C:\Users\TEMP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft OneDrive.lnk
2015-07-18 13:01 - 2012-10-13 09:00 - 00000000 ____D C:\Users\TEMP\AppData\Roaming\TuneUp Software
2015-07-18 13:01 - 2012-08-01 15:12 - 00000000 ____D C:\Users\TEMP\AppData\LocalGoogle
2015-07-18 09:23 - 2015-07-18 09:24 - 03076852 _____ C:\Users\Aries2\Downloads\teamviewer_authentication_rejected.zip.vir
2015-07-18 01:54 - 2015-07-18 01:54 - 13095136 _____ (Microsoft Corporation) C:\Users\Aries2\Downloads\Silverlight_x64.exe
2015-07-18 00:47 - 2015-07-18 00:47 - 00000000 ____D C:\Users\Aries2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-07-15 02:40 - 2015-07-09 13:58 - 03154944 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2015-07-15 02:40 - 2015-07-09 13:58 - 02603008 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2015-07-15 02:40 - 2015-07-09 13:58 - 00696320 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2015-07-15 02:40 - 2015-07-09 13:58 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2015-07-15 02:40 - 2015-07-09 13:58 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2015-07-15 02:40 - 2015-07-09 13:58 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2015-07-15 02:40 - 2015-07-09 13:58 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2015-07-15 02:40 - 2015-07-09 13:58 - 00037888 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2015-07-15 02:40 - 2015-07-09 13:58 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2015-07-15 02:40 - 2015-07-09 13:58 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2015-07-15 02:40 - 2015-07-09 13:58 - 00012288 _____ (Microsoft Corporation) C:\Windows\system32\wu.upgrade.ps.dll
2015-07-15 02:40 - 2015-07-09 13:43 - 00566784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2015-07-15 02:40 - 2015-07-09 13:43 - 00173056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2015-07-15 02:40 - 2015-07-09 13:43 - 00093184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2015-07-15 02:40 - 2015-07-09 13:43 - 00030208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2015-07-15 02:40 - 2015-07-09 13:42 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2015-07-15 02:40 - 2015-07-02 17:21 - 19877376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-07-15 02:40 - 2015-07-02 17:08 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-07-15 02:40 - 2015-07-02 16:50 - 02279424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-07-15 02:40 - 2015-07-02 16:49 - 25193984 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-07-15 02:40 - 2015-07-02 16:46 - 00479232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-07-15 02:40 - 2015-07-02 16:40 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-07-15 02:40 - 2015-07-02 16:23 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-07-15 02:40 - 2015-07-02 16:19 - 12855296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-07-15 02:40 - 2015-07-02 16:12 - 00615936 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-07-15 02:40 - 2015-07-02 15:55 - 01310720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-07-15 02:40 - 2015-07-02 15:20 - 14453248 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-07-15 02:40 - 2015-07-02 14:59 - 01545728 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-07-15 02:40 - 2015-06-26 22:47 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-07-15 02:40 - 2015-06-26 22:43 - 05923840 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-07-15 02:40 - 2015-06-26 21:58 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-07-15 02:40 - 2015-06-26 21:39 - 04520448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-07-15 02:40 - 2015-06-25 14:09 - 00389832 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-07-15 02:40 - 2015-06-25 13:43 - 00342736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-07-15 02:40 - 2015-06-25 04:57 - 03207168 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-07-15 02:40 - 2015-06-20 16:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-07-15 02:40 - 2015-06-20 15:50 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-07-15 02:40 - 2015-06-20 15:49 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-07-15 02:40 - 2015-06-20 15:49 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-07-15 02:40 - 2015-06-20 15:49 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-07-15 02:40 - 2015-06-20 15:48 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-07-15 02:40 - 2015-06-20 15:40 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-07-15 02:40 - 2015-06-20 15:39 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-07-15 02:40 - 2015-06-20 15:34 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-07-15 02:40 - 2015-06-20 15:34 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-07-15 02:40 - 2015-06-20 15:34 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-07-15 02:40 - 2015-06-20 15:25 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-07-15 02:40 - 2015-06-20 15:21 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-07-15 02:40 - 2015-06-20 15:13 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-07-15 02:40 - 2015-06-20 15:08 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-07-15 02:40 - 2015-06-20 15:07 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-07-15 02:40 - 2015-06-20 15:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-07-15 02:40 - 2015-06-20 14:48 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-07-15 02:40 - 2015-06-20 14:48 - 00720384 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-07-15 02:40 - 2015-06-20 14:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-07-15 02:40 - 2015-06-20 14:46 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-07-15 02:40 - 2015-06-20 14:26 - 02427392 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-07-15 02:40 - 2015-06-20 14:02 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-07-15 02:40 - 2015-06-19 14:25 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-07-15 02:40 - 2015-06-19 14:25 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-07-15 02:40 - 2015-06-19 14:24 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-07-15 02:40 - 2015-06-19 14:24 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-07-15 02:40 - 2015-06-19 14:23 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-07-15 02:40 - 2015-06-19 14:17 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-07-15 02:40 - 2015-06-19 14:16 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-07-15 02:40 - 2015-06-19 14:13 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-07-15 02:40 - 2015-06-19 14:13 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-07-15 02:40 - 2015-06-19 14:03 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-07-15 02:40 - 2015-06-19 13:57 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-07-15 02:40 - 2015-06-19 13:53 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-07-15 02:40 - 2015-06-19 13:52 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-07-15 02:40 - 2015-06-19 13:51 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-07-15 02:40 - 2015-06-19 13:40 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-07-15 02:40 - 2015-06-19 13:40 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-07-15 02:40 - 2015-06-19 13:39 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-07-15 02:40 - 2015-06-19 13:15 - 01951232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-07-15 02:40 - 2015-06-19 13:11 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-07-15 02:40 - 2015-06-17 13:47 - 00404992 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2015-07-15 02:40 - 2015-06-17 13:37 - 00312320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2015-07-15 02:40 - 2015-06-01 20:07 - 00254976 _____ (Microsoft Corporation) C:\Windows\system32\cewmdm.dll
2015-07-15 02:40 - 2015-06-01 19:47 - 00210432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cewmdm.dll
2015-07-15 02:39 - 2015-07-09 13:59 - 00017856 _____ (Microsoft Corporation) C:\Windows\system32\CompatTelRunner.exe
2015-07-15 02:39 - 2015-07-09 13:58 - 01085440 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-07-15 02:39 - 2015-07-09 13:58 - 00765440 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-07-15 02:39 - 2015-07-09 13:58 - 00726528 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-07-15 02:39 - 2015-07-09 13:58 - 00433664 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-07-15 02:39 - 2015-07-09 13:58 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-07-15 02:39 - 2015-07-09 13:58 - 00067584 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2015-07-15 02:39 - 2015-07-09 13:50 - 01145856 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-07-15 02:39 - 2015-07-04 14:07 - 02087424 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll
2015-07-15 02:39 - 2015-07-04 13:48 - 01414656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ole32.dll
2015-07-15 02:39 - 2015-07-03 14:05 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2015-07-15 02:39 - 2015-07-03 14:05 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2015-07-15 02:39 - 2015-07-03 14:05 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2015-07-15 02:39 - 2015-07-03 14:05 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2015-07-15 02:39 - 2015-07-03 13:56 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2015-07-15 02:39 - 2015-07-03 13:56 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2015-07-15 02:39 - 2015-07-03 13:56 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2015-07-15 02:39 - 2015-07-03 13:55 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2015-07-15 02:39 - 2015-07-03 12:52 - 00372224 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2015-07-15 02:39 - 2015-07-03 12:42 - 00299008 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2015-07-15 02:39 - 2015-07-01 16:56 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-07-15 02:39 - 2015-07-01 16:56 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-07-15 02:39 - 2015-07-01 16:49 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-07-15 02:39 - 2015-07-01 16:49 - 01216512 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2015-07-15 02:39 - 2015-07-01 16:49 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-07-15 02:39 - 2015-07-01 16:49 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-07-15 02:39 - 2015-07-01 16:49 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-07-15 02:39 - 2015-07-01 16:49 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-07-15 02:39 - 2015-07-01 16:49 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-07-15 02:39 - 2015-07-01 16:49 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-07-15 02:39 - 2015-07-01 16:49 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-07-15 02:39 - 2015-07-01 16:49 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-07-15 02:39 - 2015-07-01 16:49 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-07-15 02:39 - 2015-07-01 16:48 - 00044032 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2015-07-15 02:39 - 2015-07-01 16:48 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-07-15 02:39 - 2015-07-01 16:47 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-07-15 02:39 - 2015-07-01 16:47 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-07-15 02:39 - 2015-07-01 16:43 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-07-15 02:39 - 2015-07-01 16:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-07-15 02:39 - 2015-07-01 16:39 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-07-15 02:39 - 2015-07-01 16:30 - 00552960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-07-15 02:39 - 2015-07-01 16:30 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-07-15 02:39 - 2015-07-01 16:30 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-07-15 02:39 - 2015-07-01 16:30 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-07-15 02:39 - 2015-07-01 16:30 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-07-15 02:39 - 2015-07-01 16:30 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-07-15 02:39 - 2015-07-01 16:30 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll
2015-07-15 02:39 - 2015-07-01 16:30 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-07-15 02:39 - 2015-07-01 16:30 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-07-15 02:39 - 2015-07-01 16:29 - 00665088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2015-07-15 02:39 - 2015-07-01 16:29 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-07-15 02:39 - 2015-07-01 16:29 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-07-15 02:39 - 2015-07-01 16:27 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-07-15 02:39 - 2015-07-01 16:26 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-07-15 02:39 - 2015-07-01 16:24 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-07-15 02:39 - 2015-07-01 15:27 - 00159232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2015-07-15 02:39 - 2015-07-01 15:26 - 00290816 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2015-07-15 02:39 - 2015-07-01 15:26 - 00129024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2015-07-15 02:39 - 2015-06-15 17:50 - 00112064 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2015-07-15 02:39 - 2015-06-15 17:45 - 03242496 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2015-07-15 02:39 - 2015-06-15 17:45 - 01941504 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2015-07-15 02:39 - 2015-06-15 17:45 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2015-07-15 02:39 - 2015-06-15 17:45 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll
2015-07-15 02:39 - 2015-06-15 17:44 - 00128000 _____ (Microsoft Corporation) C:\Windows\system32\msiexec.exe
2015-07-15 02:39 - 2015-06-15 17:43 - 02364416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2015-07-15 02:39 - 2015-06-15 17:43 - 01805824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2015-07-15 02:39 - 2015-06-15 17:43 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll
2015-07-15 02:39 - 2015-06-15 17:42 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msiexec.exe
2015-07-15 02:39 - 2015-06-15 17:42 - 00025088 _____ (Microsoft Corporation) C:\Windows\system32\msimsg.dll
2015-07-15 02:39 - 2015-06-15 17:37 - 00025088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msimsg.dll
2015-07-15 02:39 - 2015-04-27 15:23 - 01480192 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2015-07-15 02:39 - 2015-04-27 15:23 - 00229376 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2015-07-15 02:39 - 2015-04-27 15:23 - 00188416 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2015-07-15 02:39 - 2015-04-27 15:23 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2015-07-15 02:39 - 2015-04-27 15:05 - 00179200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2015-07-15 02:39 - 2015-04-27 15:04 - 01174528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2015-07-15 02:39 - 2015-04-27 15:04 - 00143872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2015-07-15 02:39 - 2015-04-27 15:04 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2015-07-13 04:09 - 2015-07-13 04:09 - 00002794 _____ C:\Windows\System32\Tasks\CCleanerSkipUAC
2015-07-13 04:09 - 2015-07-13 04:09 - 00000822 _____ C:\Users\Public\Desktop\CCleaner.lnk
2015-07-13 04:09 - 2015-07-13 04:09 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2015-07-13 04:09 - 2015-07-13 04:09 - 00000000 ____D C:\Program Files\CCleaner
2015-07-13 04:08 - 2015-07-13 04:09 - 06565736 _____ (Piriform Ltd) C:\Users\Aries2\Downloads\ccsetup507 (1).exe
2015-07-11 17:37 - 2015-07-11 17:38 - 10113976 _____ (SurfRight B.V.) C:\Users\Aries2\Downloads\HitmanPro.exe
2015-07-11 16:38 - 2015-07-11 16:38 - 01187824 _____ (Uniblue Systems Limited ) C:\Users\Aries2\Downloads\pcmechanicpm.exe
2015-07-11 13:17 - 2015-07-11 13:17 - 04197016 _____ (Kaspersky Lab ZAO) C:\Users\Aries2\Downloads\tdsskiller.exe
2015-07-11 11:54 - 2015-07-11 11:55 - 17116390 _____ C:\Users\Aries2\Downloads\unhackme.zip
2015-07-11 11:52 - 2015-07-19 21:44 - 00000000 ____D C:\ProgramData\BootRacer
2015-07-11 11:49 - 2015-07-19 21:42 - 00053248 ____H C:\Users\Public\Documents\bootracer.his
2015-07-11 01:34 - 2015-07-19 21:44 - 00000459 ____H C:\Users\Public\Documents\bootracer.ini
2015-07-11 01:34 - 2015-07-19 21:42 - 00048509 ____H C:\Users\Public\Documents\bootracer.log
2015-07-11 01:33 - 2015-07-19 21:39 - 00000000 ____D C:\Program Files (x86)\BootRacer
2015-07-11 01:33 - 2015-07-11 01:33 - 00000000 ____D C:\Users\Aries2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BootRacer
2015-07-11 01:32 - 2015-07-11 01:32 - 00000000 ___HD C:\Users\Aries2\Downloads\.ptmp501428
2015-07-11 01:31 - 2015-07-11 01:32 - 04727148 _____ C:\Users\Aries2\Downloads\bootracer_free.zip
2015-07-11 00:38 - 2015-07-19 21:36 - 00000000 ____D C:\AdwCleaner
2015-07-11 00:13 - 2015-07-11 00:14 - 02248704 _____ C:\Users\Aries2\Desktop\adwcleaner_4.208.exe
2015-07-11 00:00 - 2015-07-11 00:00 - 06565736 _____ (Piriform Ltd) C:\Users\Aries2\Downloads\ccsetup507.exe
2015-07-03 22:46 - 2015-07-03 22:46 - 00659456 _____ (Speed Guide Inc.) C:\Users\Aries2\Desktop\TCPOptimizer_v308.exe
2015-07-03 22:21 - 2015-07-11 12:25 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2015-07-03 22:19 - 2015-07-03 22:20 - 00000000 ____D C:\Users\Aries2\Desktop\mbar
2015-07-03 22:19 - 2015-07-03 22:19 - 16502728 _____ (Malwarebytes Corp.) C:\Users\Aries2\Downloads\mbar-1.09.1.1004.exe
2015-07-03 05:29 - 2015-07-03 05:29 - 00075526 _____ C:\Users\Aries2\Downloads\request-payment-form.xlsx
2015-07-01 23:11 - 2015-07-01 23:11 - 09326048 _____ (TeamViewer GmbH) C:\Users\Aries2\Downloads\teamviewer_setup.exe
2015-07-01 04:55 - 2015-07-01 04:55 - 00000000 ____D C:\Users\Aries2\Desktop\New folder
2015-07-01 04:55 - 2015-07-01 04:55 - 00000000 ____D C:\Users\Aries2\Desktop\CrystalDiskInfo
2015-07-01 04:51 - 2015-07-01 04:51 - 04300826 _____ C:\Users\Aries2\Downloads\CrystalDiskInfo6_5_2.zip
2015-06-26 09:49 - 2015-06-26 09:49 - 00293296 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgidsdrivera.sys
2015-06-24 09:49 - 2015-06-24 09:49 - 00000000 ____D C:\Program Files\Common Files\AV
2015-06-23 06:47 - 2015-06-23 06:47 - 00421888 _____ C:\Users\Aries2\Downloads\WM-Netherlands-2013-P.Point-Consultant-Workshop-Section-2-PPR-and-Selection_Final.ppt
 
==================== One Month Modified files and folders ========
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2015-07-19 21:51 - 2009-07-14 00:45 - 00032064 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-07-19 21:51 - 2009-07-14 00:45 - 00032064 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-07-19 21:46 - 2011-12-05 20:51 - 01356029 _____ C:\Windows\WindowsUpdate.log
2015-07-19 21:38 - 2009-07-14 00:51 - 00115167 _____ C:\Windows\setupact.log
2015-07-19 21:36 - 2014-05-15 09:43 - 00000000 ___RD C:\Users\Aries2\OneDrive
2015-07-19 21:36 - 2013-12-18 11:02 - 00007796 _____ C:\Users\Aries2\ovpntray.log
2015-07-19 21:02 - 2013-03-21 08:28 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-07-19 20:51 - 2011-12-14 00:37 - 00000912 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3497853935-4128478283-4285659389-1000UA.job
2015-07-19 20:44 - 2015-05-17 13:07 - 00000922 _____ C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-3497853935-4128478283-4285659389-1000UA.job
2015-07-19 20:24 - 2015-04-10 18:42 - 00004966 _____ C:\Windows\System32\Tasks\Microsoft Office 15 Sync Maintenance for Aries2-HP-Aries2 Aries2-HP
2015-07-19 19:51 - 2011-12-14 00:42 - 00000000 ____D C:\ProgramData\MFAData
2015-07-19 18:59 - 2014-08-09 17:27 - 00113880 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-07-19 17:59 - 2015-05-20 13:59 - 00000468 _____ C:\Windows\BRWMARK.INI
2015-07-19 17:59 - 2012-07-07 21:18 - 00000000 ___RD C:\Users\Aries2\Google Drive
2015-07-19 17:59 - 2011-12-12 23:12 - 00000000 ____D C:\Users\Aries2
2015-07-19 17:41 - 2012-06-12 09:44 - 00000266 _____ C:\Windows\Tasks\AutoKMS.job
2015-07-19 17:41 - 2009-07-14 01:08 - 00032594 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2015-07-19 17:41 - 2009-07-14 01:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-07-19 17:40 - 2014-11-04 14:41 - 00000000 ____D C:\Users\Aries2\Documents\PhraseExpress
2015-07-19 16:18 - 2009-07-14 01:09 - 00000000 ____D C:\Windows\System32\Tasks\WPD
2015-07-19 14:38 - 2010-11-20 23:47 - 01140728 _____ C:\Windows\PFRO.log
2015-07-19 13:52 - 2009-07-14 00:45 - 00024576 _____ C:\Windows\system32\umstartup.etl
2015-07-19 09:51 - 2011-12-14 00:37 - 00000860 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3497853935-4128478283-4285659389-1000Core.job
2015-07-19 09:38 - 2014-11-08 04:08 - 00000000 ____D C:\Program Files (x86)\LastPass
2015-07-19 09:36 - 2009-07-14 00:57 - 00001547 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2015-07-19 07:35 - 2009-07-14 01:13 - 00782510 _____ C:\Windows\system32\PerfStringBackup.INI
2015-07-19 05:42 - 2012-06-12 08:16 - 00000000 ____D C:\ProgramData\Microsoft Help
2015-07-18 16:23 - 2009-07-13 23:20 - 00000000 ____D C:\Windows\system32\NDF
2015-07-18 16:16 - 2013-09-28 14:58 - 00000000 ____D C:\Program Files (x86)\totalcmd
2015-07-18 16:10 - 2012-07-10 14:22 - 00000000 ____D C:\Program Files (x86)\TeamViewer
2015-07-18 13:38 - 2015-04-07 03:02 - 00000000 ___SD C:\Windows\system32\GWX
2015-07-18 13:38 - 2012-06-23 17:35 - 00000000 ____D C:\ProgramData\FLEXnet
2015-07-18 13:38 - 2012-06-12 08:20 - 00000000 ____D C:\Windows\System32\Tasks\OfficeSoftwareProtectionPlatform
2015-07-18 13:38 - 2009-07-13 23:20 - 00000000 ____D C:\Windows\registration
2015-07-18 08:48 - 2012-11-30 05:08 - 00000000 ___RD C:\Users\Aries2\Dropbox
2015-07-18 08:48 - 2012-11-30 05:05 - 00000000 ____D C:\Users\Aries2\AppData\Roaming\Dropbox
2015-07-18 03:29 - 2011-12-12 23:14 - 00003934 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{9D4ACFA2-4A0A-4B26-8A1A-7B74C8A36A5D}
2015-07-18 00:44 - 2015-05-17 13:07 - 00000870 _____ C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-3497853935-4128478283-4285659389-1000Core.job
2015-07-18 00:39 - 2015-05-17 13:07 - 00003898 _____ C:\Windows\System32\Tasks\DropboxUpdateTaskUserS-1-5-21-3497853935-4128478283-4285659389-1000UA
2015-07-18 00:39 - 2015-05-17 13:07 - 00003502 _____ C:\Windows\System32\Tasks\DropboxUpdateTaskUserS-1-5-21-3497853935-4128478283-4285659389-1000Core
2015-07-17 05:52 - 2012-07-07 21:16 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive
2015-07-17 03:01 - 2015-04-07 03:02 - 00000000 ___SD C:\Windows\SysWOW64\GWX
2015-07-16 09:46 - 2012-06-30 23:59 - 00003894 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-07-16 09:46 - 2012-06-30 23:59 - 00003642 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-07-16 09:46 - 2012-06-30 23:59 - 00000898 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-07-16 09:46 - 2012-06-30 23:59 - 00000894 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-07-16 09:46 - 2011-12-14 00:37 - 00003888 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3497853935-4128478283-4285659389-1000UA
2015-07-16 09:46 - 2011-12-14 00:37 - 00003492 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3497853935-4128478283-4285659389-1000Core
2015-07-15 11:49 - 2015-05-26 02:04 - 00003886 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task
2015-07-15 04:38 - 2009-07-13 23:20 - 00000000 ____D C:\Windows\rescache
2015-07-15 04:01 - 2009-07-14 00:45 - 00469648 _____ C:\Windows\system32\FNTCACHE.DAT
2015-07-15 03:56 - 2014-12-10 23:14 - 00000000 ____D C:\Windows\system32\appraiser
2015-07-15 03:56 - 2014-05-08 03:00 - 00000000 ___SD C:\Windows\system32\CompatTel
2015-07-15 03:56 - 2009-07-13 23:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2015-07-15 03:24 - 2013-07-13 03:00 - 00000000 ____D C:\Windows\system32\MRT
2015-07-14 23:02 - 2013-03-21 08:28 - 00003768 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-07-14 23:02 - 2012-03-31 08:30 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-07-14 23:02 - 2011-11-10 18:38 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-07-14 21:45 - 2011-12-14 00:51 - 00000052 _____ C:\Windows\SysWOW64\DOErrors.log
2015-07-11 04:32 - 2012-07-10 14:26 - 00000000 ____D C:\Users\Aries2\AppData\Roaming\TeamViewer
2015-07-10 10:19 - 2014-06-19 03:47 - 00000000 ____D C:\Users\Aries2\AppData\Roaming\ViberPC
2015-07-08 03:29 - 2012-06-09 17:56 - 00000000 _____ C:\Windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt
2015-07-07 05:27 - 2015-04-25 02:14 - 00000965 _____ C:\Users\Public\Desktop\AVG 2015.lnk
2015-07-07 05:27 - 2014-03-31 09:41 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG
2015-07-04 00:16 - 2011-12-30 15:15 - 00000000 ____D C:\Program Files (x86)\MALWAREBYTES ANTI-MALWARE
2015-07-04 00:15 - 2009-07-13 23:20 - 00000000 ____D C:\Windows\Resources
2015-07-04 00:14 - 2009-07-14 01:32 - 00000000 ____D C:\Windows\system32\FxsTmp
2015-07-03 22:20 - 2014-08-09 17:25 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-07-03 22:13 - 2014-08-09 17:25 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-07-03 21:55 - 2011-11-10 18:38 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Productivity and Tools
2015-07-03 08:43 - 2011-12-23 10:23 - 130333168 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-07-02 14:56 - 2013-12-16 17:07 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Box Sync
2015-06-25 13:23 - 2012-06-20 06:00 - 00000000 ____D C:\Users\Aries2\Documents\eFax Messenger 4.4
2015-06-25 10:45 - 2015-05-19 12:48 - 00000971 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 10.lnk
2015-06-24 09:10 - 2014-06-19 03:47 - 00001002 _____ C:\Users\Aries2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Viber.lnk
2015-06-24 09:10 - 2014-06-19 03:47 - 00000994 _____ C:\Users\Aries2\Desktop\Viber.lnk
 
==================== Files in the root of some directories =======
 
2014-01-08 21:36 - 2014-06-22 12:07 - 0003728 _____ () C:\Program Files (x86)\Mozilla Firefoxavg-secure-search.xml
2014-11-08 04:10 - 2014-11-08 04:25 - 14147584 _____ () C:\Program Files (x86)\Common Files\lpuninstall.exe
2013-10-12 03:42 - 2013-10-12 03:42 - 0000076 _____ () C:\Users\Aries2\AppData\Roaming\mbam.context.scan
2012-04-23 21:08 - 2012-05-17 00:57 - 0000231 _____ () C:\Users\Aries2\AppData\Roaming\Rim.Desktop.Exception.log
2012-04-23 21:05 - 2012-04-23 21:05 - 0001153 _____ () C:\Users\Aries2\AppData\Roaming\Rim.Desktop.HttpServerSetup.log
2012-04-23 21:08 - 2012-05-17 00:57 - 0000308 _____ () C:\Users\Aries2\AppData\Roaming\Rim.DesktopHelper.Exception.log
2012-04-23 21:10 - 2015-03-31 15:37 - 0010752 _____ () C:\Users\Aries2\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2012-02-19 22:10 - 2012-02-19 22:11 - 0000084 _____ () C:\Users\Aries2\AppData\Local\DVDPATH.TXT
2014-03-24 03:15 - 2014-11-03 22:03 - 0004096 ____H () C:\Users\Aries2\AppData\Local\keyfile3.drm
2015-03-18 22:05 - 2015-03-18 22:05 - 0000787 _____ () C:\Users\Aries2\AppData\Local\recently-used.xbel
2013-10-03 23:35 - 2013-10-03 23:35 - 0007625 _____ () C:\Users\Aries2\AppData\Local\Resmon.ResmonCfg
2014-11-10 06:05 - 2014-11-10 06:05 - 0000095 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.400.32.bc
2014-11-10 06:05 - 2014-11-10 06:05 - 0000089 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.400.64.bc
 
==================== Bamital & volsnap Check =================
 
(There is no automatic fix for files that do not pass verification.)
 
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
 
LastRegBack: 2015-07-13 14:49
 
==================== End of log ============================
 
# AdwCleaner v4.208 - Logfile created 19/07/2015 at 21:36:28
# Updated 09/07/2015 by Xplode
# Database : 2015-07-15.1 [Server]
# Operating system : Windows 7 Home Premium Service Pack 1 (x64)
# Username : Aries2 - ARIES2-HP
# Running from : C:\Users\Aries2\Desktop\Cleanup & Recovery\adwcleaner_4.208.exe
# Option : Cleaning
 
***** [ Services ] *****
 
 
***** [ Files / Folders ] *****
 
Folder Deleted : C:\Users\Aries2\AppData\Local\AVG Secure Search
Folder Deleted : C:\Users\Aries2\AppData\LocalLow\AVG Secure Search
Folder Deleted : C:\Users\Tony\AppData\Local\AVG Secure Search
Folder Deleted : C:\Users\Tony\AppData\LocalLow\AVG Secure Search
Folder Deleted : C:\Users\Aries2\AppData\Roaming\Mozilla\Firefox\Profiles\tfipvbzx.default\Extensions\isreaditlater@ideashower.com
Folder Deleted : C:\Users\Aries2\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmjegmlicamnimmfhcmpkclmigmmcbeh
File Deleted : C:\Program Files (x86)\Mozilla Firefox\browser\searchplugins\avg-secure-search.xml
File Deleted : C:\Users\Aries2\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\user.js
File Deleted : C:\Users\Aries2\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.bleepcrawler.com_0.localstorage
File Deleted : C:\Users\Aries2\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.bleepcrawler.com_0.localstorage-journal
 
***** [ Scheduled tasks ] *****
 
 
***** [ Shortcuts ] *****
 
 
***** [ Registry ] *****
 
Value Deleted : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [Avg@toolbar]
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof
Key Deleted : HKCU\Software\Google\Chrome\Extensions\lmjegmlicamnimmfhcmpkclmigmmcbeh
Key Deleted : HKCU\Software\d2dcddb76abe49
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{F25AF245-4A81-40DC-92F9-E9021F207706}
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}]
Key Deleted : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Deleted : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}
Key Deleted : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{D43B3890-80C7-4010-A95D-1E77B5924DC3}
Key Deleted : HKCU\Software\AVG Secure Search
Key Deleted : HKCU\Software\Avg Secure Update
Key Deleted : HKCU\Software\AppDataLow\Toolbar
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\deskpins.en.softonic.com
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\softonic.com
Data Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyServer] - 101.100.1.130:8080
Data Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyOverride] - localhost
 
***** [ Web browsers ] *****
 
-\\ Internet Explorer v11.0.9600.17909
 
 
-\\ Mozilla Firefox v33.0.3 (x86 en-US)
 
 
-\\ Google Chrome v
 
 
*************************
 
AdwCleaner[R0].txt - [10907 bytes] - [11/07/2015 00:39:00]
AdwCleaner[R1].txt - [6657 bytes] - [19/07/2015 14:10:35]
AdwCleaner[R2].txt - [1609 bytes] - [19/07/2015 14:22:11]
AdwCleaner[R3].txt - [4706 bytes] - [19/07/2015 20:53:53]
AdwCleaner[R4].txt - [4614 bytes] - [19/07/2015 21:07:27]
AdwCleaner[S0].txt - [6875 bytes] - [19/07/2015 14:12:57]
AdwCleaner[S1].txt - [1687 bytes] - [19/07/2015 14:23:34]
AdwCleaner[S2].txt - [4057 bytes] - [19/07/2015 21:36:28]
 
########## EOF - C:\AdwCleaner\AdwCleaner[S2].txt - [4116  bytes] ##########
 
 
 


BC AdBot (Login to Remove)

 


#2 nasdaq

nasdaq

  • Malware Response Team
  • 39,551 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:12:56 PM

Posted 21 July 2015 - 08:45 AM

Hello, Welcome to BleepingComputer.
I'm nasdaq and will be helping you.

If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed.
===

 

Winsock: Missing Catalog9 entry, broken internet access. <===== ATTENTION.
Winsock: Missing Catalog9-x64 entry, broken internet access. <===== ATTENTION.

This is the reason you lost your internet. The damage was not caused by AdwCleaner.

SRService.exe Tracks your surfing habits
Normally I would see a service named SplashtopRemoteService which is not listed on your log.
Something removed that service and may have cause the problem.

===

Open notepad (Start =>All Programs => Accessories => Notepad). Please copy the entire contents of the code box below.
 
start

CreateRestorePoint:
CloseProcesses:

(Splashtop Inc.) C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
(Splashtop Inc.) C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRServer.exe
(Splashtop Inc.) C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRFeature.exe
(Splashtop Inc.) C:\Program Files (x86)\Splashtop\Splashtop Software Updater\SSUService.exe
HKLM-x32\...\Run: [] => [X]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
SearchScopes: HKLM-x32 -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = http://search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKLM-x32 -> {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = http://en.wikipedia.org/wiki/Special:Search?search={searchTerms}
Toolbar: HKU\.DEFAULT -> No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} -  No File
Toolbar: HKU\S-1-5-21-3497853935-4128478283-4285659389-1000 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File
Toolbar: HKU\S-1-5-21-3497853935-4128478283-4285659389-1000 -> No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} -  No File
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG2012\avgpp.dll No File
Winsock: Missing Catalog9 entry, broken internet access. <===== ATTENTION.
Winsock: Missing Catalog9-x64 entry, broken internet access. <===== ATTENTION.
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Extension: No Name - C:\Users\Aries2\AppData\Roaming\Mozilla\Firefox\Profiles\tfipvbzx.default\extensions\isreaditlater@ideashower.com [not found]
CHR HKLM\...\Chrome\Extension: [hdokiejnpimakedhajhdlcegeplioahd] - http://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [hdokiejnpimakedhajhdlcegeplioahd] - http://clients2.google.com/service/update2/crx
C:\Program Files (x86)\Splashtop

End
Save the files as fixlist.txt in the same folder where the Farbar tool is running from.
The location is listed in the 3rd line of the Farbar log you have submitted.

Run FRST and click Fix only once and wait.

Restart the computer normally to reset the registry.

The tool will create a log (Fixlog.txt) please post it to your reply.
===

How is the computer running now?

p.s.
You have saved many programs in this \temp folder C:\Users\TEMP\

Some cleanup tools would normally delete all the files in a \temp folder.
It this is the case I suggest you create a folder name it My_Downloaded_Programs and move all the programs you wish to save in it.

#3 nasdaq

nasdaq

  • Malware Response Team
  • 39,551 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:12:56 PM

Posted 26 July 2015 - 07:35 AM

Due to the lack of feedback, this topic is now closed.

In the event you still have problems, please send me or any Moderator a Private Message and ask them to reopen this topic within the next 5 days.

Please include a link to your topic in the Private Message. Thank you.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users