Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Computer slow and firefox keeps crashing


  • This topic is locked This topic is locked
43 replies to this topic

#1 insaniak

insaniak

  • Members
  • 198 posts
  • OFFLINE
  •  
  • Local time:10:16 AM

Posted 26 February 2016 - 10:26 AM

I found alot of stuff  with malwarebytes, i just want to make sure its all clean

 

 

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:24-02-2016
Ran by LailaMichel (administrator) on LAILAMICHEL-PC (26-02-2016 12:22:47)
Running from C:\Users\LailaMichel\Downloads
Loaded Profiles: LailaMichel (Available Profiles: LailaMichel)
Platform: Windows 7 Home Premium Service Pack 1 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avpui.exe
(AnchorFree Inc.) C:\Program Files (x86)\Hotspot Shield\bin\cmw_srv.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\tv_w32.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\tv_x64.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Desktop.exe
(Enigma Software Group USA, LLC.) C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter4.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [IntelPAN] => C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe [1935120 2011-05-02] (Intel® Corporation)
HKLM\...\Run: [Apoint] => C:\Program Files\Apoint\Apoint.exe [226672 2011-07-12] (Alps Electric Co., Ltd.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11490408 2011-07-12] (Realtek Semiconductor)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [157480 2014-10-15] (Apple Inc.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-3448637700-3732790023-3482431723-1000\...\Run: [BingSvc] => C:\Users\LailaMichel\AppData\Local\Microsoft\BingSvc\BingSvc.exe [144008 2015-11-13] (© 2015 Microsoft Corporation)
HKU\S-1-5-21-3448637700-3732790023-3482431723-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [50385536 2015-12-17] (Skype Technologies S.A.)
HKU\S-1-5-21-3448637700-3732790023-3482431723-1000\...\Run: [uTorrent] => C:\Users\LailaMichel\AppData\Roaming\uTorrent\uTorrent.exe [2065944 2016-02-13] (BitTorrent Inc.)
HKU\S-1-5-21-3448637700-3732790023-3482431723-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7063832 2014-11-21] (Piriform Ltd)
ShellIconOverlayIdentifiers: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\LailaMichel\AppData\Roaming\Dropbox\bin\DropboxExt64.33.dll [2016-02-16] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\LailaMichel\AppData\Roaming\Dropbox\bin\DropboxExt64.33.dll [2016-02-16] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\LailaMichel\AppData\Roaming\Dropbox\bin\DropboxExt64.33.dll [2016-02-16] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\LailaMichel\AppData\Roaming\Dropbox\bin\DropboxExt64.33.dll [2016-02-16] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\LailaMichel\AppData\Roaming\Dropbox\bin\DropboxExt64.33.dll [2016-02-16] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\LailaMichel\AppData\Roaming\Dropbox\bin\DropboxExt64.33.dll [2016-02-16] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\LailaMichel\AppData\Roaming\Dropbox\bin\DropboxExt64.33.dll [2016-02-16] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\LailaMichel\AppData\Roaming\Dropbox\bin\DropboxExt64.33.dll [2016-02-16] (Dropbox, Inc.)
BootExecute: autocheck autochk * sdnclean64.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{D08C2EB7-7A01-49C1-B9A4-FE916387A1C7}: [DhcpNameServer] 192.168.1.1

Internet Explorer:
==================
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\S-1-5-21-3448637700-3732790023-3482431723-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-3448637700-3732790023-3482431723-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
BHO-x32: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll [2014-04-20] (Kaspersky Lab ZAO)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL [2010-01-21] (Microsoft Corporation)
BHO-x32: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll [2014-10-09] (Kaspersky Lab ZAO)
BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_73\bin\ssv.dll [2016-02-24] (Oracle Corporation)
BHO-x32: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\OnlineBanking\online_banking_bho.dll [2014-04-20] (Kaspersky Lab ZAO)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2016-01-08] (Microsoft Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2010-01-16] (Microsoft Corporation)
BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_73\bin\jp2ssv.dll [2016-02-24] (Oracle Corporation)
BHO-x32: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\UrlAdvisor\klwtbbho.dll [2014-04-20] (Kaspersky Lab ZAO)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2016-01-08] (Microsoft Corporation)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2016-01-08] (Microsoft Corporation)

FireFox:
========
FF ProfilePath: C:\Users\LailaMichel\AppData\Roaming\Mozilla\Firefox\Profiles\z238ncl6.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_20_0_0_306.dll [2016-02-12] ()
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_20_0_0_306.dll [2016-02-12] ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-02-18] ()
FF Plugin-x32: @java.com/DTPlugin,version=11.73.2 -> C:\Program Files (x86)\Java\jre1.8.0_73\bin\dtplugin\npDeployJava1.dll [2016-02-24] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.73.2 -> C:\Program Files (x86)\Java\jre1.8.0_73\bin\plugin2\npjp2.dll [2016-02-24] (Oracle Corporation)
FF Plugin-x32: @kaspersky.com/content_blocker -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com [2014-10-09] ()
FF Plugin-x32: @kaspersky.com/online_banking -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com [2014-10-09] ()
FF Plugin-x32: @kaspersky.com/virtual_keyboard -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com [2014-10-09] ()
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-01-10] (Microsoft Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-12-18] (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\LailaMichel\AppData\Roaming\Mozilla\Firefox\Profiles\z238ncl6.default\searchplugins\bing-.xml [2015-11-14]
FF Extension: Adblock Plus - C:\Users\LailaMichel\AppData\Roaming\Mozilla\Firefox\Profiles\z238ncl6.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2016-02-24]
FF Extension: Hotspot Shield Extension - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\afproxy@anchorfree.com [2016-02-12] [not signed]
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2015-05-01] [not signed]
FF HKLM-x32\...\Firefox\Extensions: [content_blocker@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com
FF Extension: Dangerous Websites Blocker - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com [2014-10-09] [not signed]
FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com
FF Extension: Virtual Keyboard - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com [2014-10-09] [not signed]
FF HKLM-x32\...\Firefox\Extensions: [url_advisor@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\url_advisor@kaspersky.com
FF Extension: Kaspersky URL Advisor - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\url_advisor@kaspersky.com [2014-10-09] [not signed]
FF HKLM-x32\...\Firefox\Extensions: [anti_banner@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\anti_banner@kaspersky.com
FF Extension: Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\anti_banner@kaspersky.com [2014-10-09] [not signed]
FF HKLM-x32\...\Firefox\Extensions: [online_banking@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com
FF Extension: Safe Money - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com [2014-10-09] [not signed]

Chrome:
=======
CHR HKLM\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - hxxps://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho
CHR HKLM-x32\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - hxxps://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AVP15.0.0; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [233552 2014-04-20] (Kaspersky Lab ZAO)
S2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1433216 2016-01-08] (Microsoft Corporation)
S2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1773696 2016-01-08] (Microsoft Corporation)
R2 hshld; C:\Program Files (x86)\Hotspot Shield\bin\cmw_srv.exe [2442368 2016-02-17] (AnchorFree Inc.)
S3 HssTrayService; C:\Program Files (x86)\Hotspot Shield\bin\HssTrayService.EXE [103176 2016-02-18] ()
S2 IconMan_R; C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [2375168 2011-07-12] (Realsil Microelectronics Inc.) [File not signed]
S2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1513784 2015-10-05] (Malwarebytes)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1135416 2015-10-05] (Malwarebytes)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [340240 2011-05-02] ()
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)
S2 SpyHunter 4 Service; C:\Program Files\Enigma Software Group\SpyHunter\SH4Service.exe [1042304 2016-02-26] (Enigma Software Group USA, LLC.)
R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [6940944 2016-02-16] (TeamViewer GmbH)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2014-09-20] (Disc Soft Ltd)
S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3286016 2009-06-11] (Broadcom Corporation)
S3 EsgScanner; C:\Windows\System32\DRIVERS\EsgScanner.sys [22704 2016-02-26] ()
U5 gobi3kserial; C:\Windows\System32\Drivers\gobi3kserial.sys [233984 2010-12-13] (QUALCOMM Incorporated)
R1 HssDRV6; C:\Windows\System32\DRIVERS\hssdrv6.sys [44744 2014-05-17] (AnchorFree Inc.)
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [457824 2014-02-20] (Kaspersky Lab ZAO)
R3 klflt; C:\Windows\System32\DRIVERS\klflt.sys [141320 2014-10-09] (Kaspersky Lab ZAO)
R1 klhk; C:\Windows\System32\DRIVERS\klhk.sys [243808 2014-04-10] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [793800 2014-10-09] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [30304 2014-02-25] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [28768 2014-03-28] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29280 2013-08-08] (Kaspersky Lab ZAO)
R1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [55904 2014-03-25] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [179296 2014-03-26] (Kaspersky Lab ZAO)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-10-05] (Malwarebytes)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [192216 2016-02-25] (Malwarebytes)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-10-05] (Malwarebytes Corporation)
R3 taphss6; C:\Windows\System32\DRIVERS\taphss6.sys [42184 2014-05-17] (Anchorfree Inc.)
U3 TrueSight; C:\Windows\System32\drivers\TrueSight.sys [24688 2016-02-26] ()

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-02-26 12:22 - 2016-02-26 12:24 - 00017351 _____ C:\Users\LailaMichel\Downloads\FRST.txt
2016-02-26 12:21 - 2016-02-26 12:22 - 00000000 ____D C:\FRST
2016-02-26 12:21 - 2016-02-26 12:21 - 00000000 ____D C:\Users\LailaMichel\Desktop\FRST64
2016-02-26 12:20 - 2016-02-26 12:20 - 02371072 _____ (Farbar) C:\Users\LailaMichel\Downloads\FRST64.exe
2016-02-26 12:12 - 2016-02-26 12:12 - 00000000 ____D C:\Users\LailaMichel\AppData\Local\CrashDumps
2016-02-26 11:26 - 2016-02-26 11:26 - 00000000 _____ C:\autoexec.bat
2016-02-26 11:25 - 2016-02-26 11:25 - 00003362 _____ C:\Windows\System32\Tasks\SpyHunter4Startup
2016-02-26 11:25 - 2016-02-26 11:25 - 00001087 _____ C:\Users\LailaMichel\Desktop\SpyHunter.lnk
2016-02-26 11:25 - 2016-02-26 11:25 - 00000000 ____D C:\Users\LailaMichel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter
2016-02-26 11:25 - 2016-02-26 11:25 - 00000000 ____D C:\Users\LailaMichel\AppData\Roaming\Enigma Software Group
2016-02-26 11:24 - 2016-02-26 11:25 - 00000000 ____D C:\sh4ldr
2016-02-26 10:55 - 2016-02-26 12:10 - 00000000 ____D C:\ProgramData\HitmanPro
2016-02-26 10:53 - 2016-02-26 10:53 - 00448512 _____ (OldTimer Tools) C:\Users\LailaMichel\Downloads\TFC(1).exe
2016-02-26 10:52 - 2016-02-26 12:11 - 00000000 ____D C:\ProgramData\RogueKiller
2016-02-26 10:52 - 2016-02-26 10:52 - 00024688 _____ C:\Windows\system32\Drivers\TrueSight.sys
2016-02-26 10:51 - 2016-02-26 10:51 - 24835768 _____ (SUPERAntiSpyware) C:\Users\LailaMichel\Downloads\SUPERAntiSpyware.exe
2016-02-26 10:50 - 2016-02-26 10:50 - 00448512 _____ (OldTimer Tools) C:\Users\LailaMichel\Downloads\TFC.exe
2016-02-26 10:47 - 2016-02-26 10:55 - 11441744 _____ (SurfRight B.V.) C:\Users\LailaMichel\Downloads\HitmanPro_x64.exe
2016-02-26 10:46 - 2016-02-26 10:47 - 20959304 _____ C:\Users\LailaMichel\Downloads\RogueKiller.exe
2016-02-26 10:44 - 2016-02-26 10:44 - 00022704 _____ C:\Windows\system32\Drivers\EsgScanner.sys
2016-02-26 10:43 - 2016-02-26 10:43 - 00000000 ____D C:\Program Files\Enigma Software Group
2016-02-26 09:27 - 2016-02-26 09:27 - 00000000 ____D C:\Users\LailaMichel\AppData\Local\CrashRpt
2016-02-26 09:26 - 2016-02-26 09:27 - 03234688 _____ (Enigma Software Group USA, LLC.) C:\Users\LailaMichel\Downloads\SpyHunter-Installer-k.com
2016-02-26 07:57 - 2016-02-26 08:23 - 713664149 ____R C:\Users\LailaMichel\Downloads\Younger.S02E07.720p.HDTV.x264-ALTEREGO[eztv].mkv
2016-02-26 07:56 - 2016-02-26 08:19 - 545456799 ____R C:\Users\LailaMichel\Downloads\Younger.S02E06.720p.HDTV.x264-ALTEREGO[eztv].mkv
2016-02-26 07:44 - 2016-02-26 07:44 - 00000000 ____D C:\Users\LailaMichel\AppData\LocalLow\uTorrent
2016-02-25 22:39 - 2016-02-25 22:39 - 00023764 _____ C:\ComboFix.txt
2016-02-25 22:09 - 2011-06-26 10:45 - 00256000 _____ C:\Windows\PEV.exe
2016-02-25 22:09 - 2010-11-07 21:20 - 00208896 _____ C:\Windows\MBR.exe
2016-02-25 22:09 - 2009-04-20 08:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2016-02-25 22:09 - 2000-08-31 04:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2016-02-25 22:09 - 2000-08-31 04:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2016-02-25 22:09 - 2000-08-31 04:00 - 00098816 _____ C:\Windows\sed.exe
2016-02-25 22:09 - 2000-08-31 04:00 - 00080412 _____ C:\Windows\grep.exe
2016-02-25 22:09 - 2000-08-31 04:00 - 00068096 _____ C:\Windows\zip.exe
2016-02-25 22:07 - 2016-02-25 22:39 - 00000000 ____D C:\Qoobox
2016-02-25 22:06 - 2016-02-25 22:34 - 00000000 ____D C:\Windows\erdnt
2016-02-25 22:01 - 2016-02-25 22:01 - 00005119 _____ C:\Users\LailaMichel\Desktop\JRT.txt
2016-02-25 21:55 - 2016-02-25 21:55 - 01609216 _____ (Malwarebytes) C:\Users\LailaMichel\Downloads\JRT.exe
2016-02-25 21:53 - 2016-02-25 21:53 - 01511936 _____ C:\Users\LailaMichel\Downloads\AdwCleaner.exe
2016-02-25 21:53 - 2016-02-25 21:53 - 00000000 ____D C:\AdwCleaner
2016-02-25 21:32 - 2016-02-25 21:32 - 00000000 ____D C:\Program Files (x86)\ESET
2016-02-25 21:31 - 2016-02-25 21:31 - 00000971 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 11.lnk
2016-02-25 21:30 - 2016-02-25 21:30 - 02870984 _____ (ESET) C:\Users\LailaMichel\Downloads\esetsmartinstaller_enu.exe
2016-02-25 21:23 - 2016-02-26 07:48 - 566072057 ____R C:\Users\LailaMichel\Downloads\Younger.S02E08.720p.HDTV.x264-ALTEREGO[eztv].mkv
2016-02-25 20:08 - 2016-02-26 08:30 - 336987563 ____R C:\Users\LailaMichel\Downloads\Girlfriends.Guide.to.Divorce.S02E03.HDTV.x264-KILLERS[eztv].mp4
2016-02-24 07:59 - 2016-02-24 07:59 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\7E7E7AA9.sys
2016-02-24 06:47 - 2016-02-24 06:47 - 05658013 ____R (Swearware) C:\Users\LailaMichel\Desktop\ComboFix.exe
2016-02-24 06:38 - 2016-02-25 20:54 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2016-02-24 06:37 - 2016-02-24 06:37 - 00001106 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2016-02-24 06:37 - 2016-02-24 06:37 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2016-02-24 06:37 - 2016-02-24 06:37 - 00000000 ____D C:\ProgramData\Malwarebytes
2016-02-24 06:37 - 2016-02-24 06:37 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2016-02-24 06:37 - 2015-10-05 09:50 - 00109272 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamchameleon.sys
2016-02-24 06:37 - 2015-10-05 09:50 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2016-02-24 06:37 - 2015-10-05 09:50 - 00025816 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys
2016-02-24 06:35 - 2016-02-24 06:35 - 00165072 _____ C:\Users\LailaMichel\Downloads\JavaRa-2.6.1.1.zip
2016-02-24 06:33 - 2016-02-24 06:34 - 22908888 _____ (Malwarebytes ) C:\Users\LailaMichel\Downloads\mbam-setup-2.2.0.1024.exe
2016-02-24 06:31 - 2015-07-28 17:52 - 00821920 _____ (Safer-Networking Ltd. ) C:\Users\Public\Desktop\Post Win10 Spybot-install.exe
2016-02-24 06:29 - 2016-02-24 06:29 - 00000000 ____D C:\Users\LailaMichel\AppData\Roaming\addpcs
2016-02-24 06:23 - 2016-02-24 06:23 - 02073320 _____ C:\Users\LailaMichel\Downloads\TempFileCleaner_4.4.0_Setup.exe
2016-02-20 12:14 - 2016-02-20 12:14 - 00000000 ____D C:\Users\LailaMichel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2016-02-12 10:49 - 2016-02-13 20:12 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2016-02-10 18:40 - 2016-02-06 14:48 - 25839104 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2016-02-10 18:40 - 2016-02-06 14:32 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2016-02-10 18:40 - 2016-02-06 14:24 - 02887680 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2016-02-10 18:40 - 2016-02-06 14:11 - 00615936 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2016-02-10 18:40 - 2016-02-06 14:10 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2016-02-10 18:40 - 2016-02-06 14:01 - 20366848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2016-02-10 18:40 - 2016-02-06 13:54 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2016-02-10 18:40 - 2016-02-06 13:43 - 02280448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2016-02-10 18:40 - 2016-02-06 13:38 - 00476160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2016-02-10 18:40 - 2016-02-06 13:37 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2016-02-10 18:40 - 2016-02-06 13:32 - 14458368 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2016-02-10 18:40 - 2016-02-06 13:16 - 12857856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2016-02-10 18:40 - 2016-02-06 13:09 - 01547264 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2016-02-10 18:40 - 2016-02-06 12:54 - 01312256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2016-02-10 18:40 - 2016-01-16 23:06 - 00025024 _____ (Microsoft Corporation) C:\Windows\system32\CompatTelRunner.exe
2016-02-10 18:40 - 2016-01-16 22:54 - 01162240 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2016-02-10 18:40 - 2016-01-11 23:05 - 03169792 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2016-02-10 18:40 - 2016-01-11 23:05 - 00192512 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2016-02-10 18:40 - 2016-01-11 23:05 - 00098816 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2016-02-10 18:40 - 2016-01-11 22:52 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2016-02-10 18:40 - 2016-01-11 22:47 - 00174080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2016-02-10 18:40 - 2016-01-11 22:26 - 02610176 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2016-02-10 18:40 - 2016-01-11 22:24 - 00709120 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2016-02-10 18:40 - 2016-01-11 22:23 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2016-02-10 18:40 - 2016-01-11 22:23 - 00037888 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2016-02-10 18:40 - 2016-01-11 22:23 - 00037888 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2016-02-10 18:40 - 2016-01-11 22:23 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2016-02-10 18:40 - 2016-01-11 22:23 - 00012288 _____ (Microsoft Corporation) C:\Windows\system32\wu.upgrade.ps.dll
2016-02-10 18:40 - 2016-01-11 22:14 - 00573440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2016-02-10 18:40 - 2016-01-11 22:14 - 00093696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2016-02-10 18:40 - 2016-01-11 22:14 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2016-02-10 18:40 - 2016-01-11 22:14 - 00030208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2016-02-10 18:40 - 2016-01-11 18:08 - 01362944 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2016-02-10 18:40 - 2016-01-11 18:08 - 00696320 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2016-02-10 18:40 - 2016-01-11 18:08 - 00677376 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2016-02-10 18:40 - 2016-01-11 18:08 - 00499200 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2016-02-10 18:40 - 2016-01-11 18:08 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2016-02-10 18:40 - 2016-01-07 21:53 - 03211776 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2016-02-10 18:40 - 2016-01-06 23:02 - 00275456 _____ (Microsoft Corporation) C:\Windows\system32\InkEd.dll
2016-02-10 18:40 - 2016-01-06 23:02 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\jnwmon.dll
2016-02-10 18:40 - 2016-01-06 22:41 - 00216064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InkEd.dll
2016-02-10 18:39 - 2016-01-23 00:31 - 00387784 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2016-02-10 18:39 - 2016-01-23 00:10 - 00341200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2016-02-10 18:39 - 2016-01-22 10:56 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2016-02-10 18:39 - 2016-01-22 10:41 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2016-02-10 18:39 - 2016-01-22 10:40 - 00571904 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2016-02-10 18:39 - 2016-01-22 10:40 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2016-02-10 18:39 - 2016-01-22 10:40 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2016-02-10 18:39 - 2016-01-22 10:40 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2016-02-10 18:39 - 2016-01-22 10:33 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2016-02-10 18:39 - 2016-01-22 10:32 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2016-02-10 18:39 - 2016-01-22 10:29 - 06052352 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2016-02-10 18:39 - 2016-01-22 10:27 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2016-02-10 18:39 - 2016-01-22 10:27 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2016-02-10 18:39 - 2016-01-22 10:27 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2016-02-10 18:39 - 2016-01-22 10:20 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2016-02-10 18:39 - 2016-01-22 10:17 - 00489984 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2016-02-10 18:39 - 2016-01-22 10:09 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2016-02-10 18:39 - 2016-01-22 10:08 - 00107520 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2016-02-10 18:39 - 2016-01-22 10:05 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2016-02-10 18:39 - 2016-01-22 10:04 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2016-02-10 18:39 - 2016-01-22 10:02 - 00496640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2016-02-10 18:39 - 2016-01-22 10:02 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2016-02-10 18:39 - 2016-01-22 10:02 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2016-02-10 18:39 - 2016-01-22 10:01 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2016-02-10 18:39 - 2016-01-22 10:01 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2016-02-10 18:39 - 2016-01-22 10:00 - 00152064 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2016-02-10 18:39 - 2016-01-22 10:00 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2016-02-10 18:39 - 2016-01-22 09:55 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2016-02-10 18:39 - 2016-01-22 09:55 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2016-02-10 18:39 - 2016-01-22 09:51 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2016-02-10 18:39 - 2016-01-22 09:51 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2016-02-10 18:39 - 2016-01-22 09:50 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2016-02-10 18:39 - 2016-01-22 09:48 - 00718336 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2016-02-10 18:39 - 2016-01-22 09:47 - 00798208 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2016-02-10 18:39 - 2016-01-22 09:46 - 02123264 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2016-02-10 18:39 - 2016-01-22 09:46 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2016-02-10 18:39 - 2016-01-22 09:43 - 00416256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2016-02-10 18:39 - 2016-01-22 09:39 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2016-02-10 18:39 - 2016-01-22 09:38 - 00091136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2016-02-10 18:39 - 2016-01-22 09:37 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2016-02-10 18:39 - 2016-01-22 09:35 - 04611072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2016-02-10 18:39 - 2016-01-22 09:35 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2016-02-10 18:39 - 2016-01-22 09:34 - 00279040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2016-02-10 18:39 - 2016-01-22 09:33 - 00130048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2016-02-10 18:39 - 2016-01-22 09:31 - 02597376 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2016-02-10 18:39 - 2016-01-22 09:27 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2016-02-10 18:39 - 2016-01-22 09:25 - 00687104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2016-02-10 18:39 - 2016-01-22 09:24 - 02050560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2016-02-10 18:39 - 2016-01-22 09:24 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2016-02-10 18:39 - 2016-01-22 09:08 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2016-02-10 18:39 - 2016-01-22 09:07 - 02120704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2016-02-10 18:39 - 2016-01-22 09:02 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2016-02-10 18:39 - 2016-01-07 21:42 - 00141312 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2016-02-10 18:38 - 2016-01-16 23:01 - 02085888 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll
2016-02-10 18:38 - 2016-01-16 22:36 - 01413632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ole32.dll
2016-02-10 18:37 - 2016-01-22 10:27 - 05573056 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2016-02-10 18:37 - 2016-01-22 10:27 - 00154560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2016-02-10 18:37 - 2016-01-22 10:27 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2016-02-10 18:37 - 2016-01-22 10:24 - 01733592 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2016-02-10 18:37 - 2016-01-22 10:20 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2016-02-10 18:37 - 2016-01-22 10:20 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2016-02-10 18:37 - 2016-01-22 10:20 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2016-02-10 18:37 - 2016-01-22 10:20 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2016-02-10 18:37 - 2016-01-22 10:20 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2016-02-10 18:37 - 2016-01-22 10:20 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2016-02-10 18:37 - 2016-01-22 10:20 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2016-02-10 18:37 - 2016-01-22 10:20 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2016-02-10 18:37 - 2016-01-22 10:20 - 00028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2016-02-10 18:37 - 2016-01-22 10:20 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2016-02-10 18:37 - 2016-01-22 10:19 - 01214464 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2016-02-10 18:37 - 2016-01-22 10:19 - 00344064 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2016-02-10 18:37 - 2016-01-22 10:19 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2016-02-10 18:37 - 2016-01-22 10:18 - 00961024 _____ (Microsoft Corporation) C:\Windows\system32\CPFilters.dll
2016-02-10 18:37 - 2016-01-22 10:18 - 00723968 _____ (Microsoft Corporation) C:\Windows\system32\EncDec.dll
2016-02-10 18:37 - 2016-01-22 10:18 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2016-02-10 18:37 - 2016-01-22 10:17 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2016-02-10 18:37 - 2016-01-22 10:17 - 00312320 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2016-02-10 18:37 - 2016-01-22 10:17 - 00159744 _____ (Microsoft Corporation) C:\Windows\system32\mtxoci.dll
2016-02-10 18:37 - 2016-01-22 10:16 - 01461248 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2016-02-10 18:37 - 2016-01-22 10:16 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2016-02-10 18:37 - 2016-01-22 10:16 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2016-02-10 18:37 - 2016-01-22 10:15 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2016-02-10 18:37 - 2016-01-22 10:15 - 00730112 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2016-02-10 18:37 - 2016-01-22 10:15 - 00422400 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2016-02-10 18:37 - 2016-01-22 10:13 - 03993536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2016-02-10 18:37 - 2016-01-22 10:13 - 03938752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2016-02-10 18:37 - 2016-01-22 10:13 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2016-02-10 18:37 - 2016-01-22 10:13 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2016-02-10 18:37 - 2016-01-22 10:13 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2016-02-10 18:37 - 2016-01-22 10:12 - 00880128 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2016-02-10 18:37 - 2016-01-22 10:12 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2016-02-10 18:37 - 2016-01-22 10:12 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2016-02-10 18:37 - 2016-01-22 10:12 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2016-02-10 18:37 - 2016-01-22 10:12 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2016-02-10 18:37 - 2016-01-22 10:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2016-02-10 18:37 - 2016-01-22 10:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2016-02-10 18:37 - 2016-01-22 10:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2016-02-10 18:37 - 2016-01-22 10:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2016-02-10 18:37 - 2016-01-22 10:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2016-02-10 18:37 - 2016-01-22 10:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2016-02-10 18:37 - 2016-01-22 10:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2016-02-10 18:37 - 2016-01-22 10:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2016-02-10 18:37 - 2016-01-22 10:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2016-02-10 18:37 - 2016-01-22 10:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2016-02-10 18:37 - 2016-01-22 10:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2016-02-10 18:37 - 2016-01-22 10:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2016-02-10 18:37 - 2016-01-22 10:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2016-02-10 18:37 - 2016-01-22 10:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2016-02-10 18:37 - 2016-01-22 10:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2016-02-10 18:37 - 2016-01-22 10:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2016-02-10 18:37 - 2016-01-22 10:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2016-02-10 18:37 - 2016-01-22 10:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2016-02-10 18:37 - 2016-01-22 10:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2016-02-10 18:37 - 2016-01-22 10:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2016-02-10 18:37 - 2016-01-22 10:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2016-02-10 18:37 - 2016-01-22 10:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2016-02-10 18:37 - 2016-01-22 10:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2016-02-10 18:37 - 2016-01-22 10:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2016-02-10 18:37 - 2016-01-22 10:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2016-02-10 18:37 - 2016-01-22 10:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2016-02-10 18:37 - 2016-01-22 10:09 - 01314328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2016-02-10 18:37 - 2016-01-22 10:06 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2016-02-10 18:37 - 2016-01-22 10:06 - 00665088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2016-02-10 18:37 - 2016-01-22 10:06 - 00275456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2016-02-10 18:37 - 2016-01-22 10:06 - 00171520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2016-02-10 18:37 - 2016-01-22 10:06 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2016-02-10 18:37 - 2016-01-22 10:06 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2016-02-10 18:37 - 2016-01-22 10:06 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2016-02-10 18:37 - 2016-01-22 10:06 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2016-02-10 18:37 - 2016-01-22 10:05 - 00251392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2016-02-10 18:37 - 2016-01-22 10:05 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2016-02-10 18:37 - 2016-01-22 10:04 - 00642048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\CPFilters.dll
2016-02-10 18:37 - 2016-01-22 10:04 - 00535040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\EncDec.dll
2016-02-10 18:37 - 2016-01-22 10:02 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2016-02-10 18:37 - 2016-01-22 10:02 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2016-02-10 18:37 - 2016-01-22 10:02 - 00223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2016-02-10 18:37 - 2016-01-22 10:02 - 00176128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msorcl32.dll
2016-02-10 18:37 - 2016-01-22 10:02 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2016-02-10 18:37 - 2016-01-22 10:02 - 00114176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mtxoci.dll
2016-02-10 18:37 - 2016-01-22 10:02 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2016-02-10 18:37 - 2016-01-22 09:59 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2016-02-10 18:37 - 2016-01-22 09:59 - 00642560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2016-02-10 18:37 - 2016-01-22 09:59 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2016-02-10 18:37 - 2016-01-22 09:59 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2016-02-10 18:37 - 2016-01-22 09:59 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2016-02-10 18:37 - 2016-01-22 09:59 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2016-02-10 18:37 - 2016-01-22 09:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2016-02-10 18:37 - 2016-01-22 09:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2016-02-10 18:37 - 2016-01-22 09:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2016-02-10 18:37 - 2016-01-22 09:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2016-02-10 18:37 - 2016-01-22 09:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2016-02-10 18:37 - 2016-01-22 09:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2016-02-10 18:37 - 2016-01-22 09:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2016-02-10 18:37 - 2016-01-22 09:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2016-02-10 18:37 - 2016-01-22 09:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2016-02-10 18:37 - 2016-01-22 09:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2016-02-10 18:37 - 2016-01-22 09:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2016-02-10 18:37 - 2016-01-22 09:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2016-02-10 18:37 - 2016-01-22 09:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2016-02-10 18:37 - 2016-01-22 09:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2016-02-10 18:37 - 2016-01-22 09:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2016-02-10 18:37 - 2016-01-22 09:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2016-02-10 18:37 - 2016-01-22 09:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2016-02-10 18:37 - 2016-01-22 09:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2016-02-10 18:37 - 2016-01-22 09:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2016-02-10 18:37 - 2016-01-22 09:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2016-02-10 18:37 - 2016-01-22 09:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2016-02-10 18:37 - 2016-01-22 09:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2016-02-10 18:37 - 2016-01-22 09:13 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2016-02-10 18:37 - 2016-01-22 09:07 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2016-02-10 18:37 - 2016-01-22 09:07 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2016-02-10 18:37 - 2016-01-22 09:05 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2016-02-10 18:37 - 2016-01-22 08:59 - 00159232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2016-02-10 18:37 - 2016-01-22 08:58 - 00290816 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2016-02-10 18:37 - 2016-01-22 08:58 - 00129024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2016-02-10 18:37 - 2016-01-22 08:57 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2016-02-10 18:37 - 2016-01-22 08:57 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2016-02-10 18:37 - 2016-01-22 08:53 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2016-02-10 18:37 - 2016-01-22 08:53 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2016-02-10 18:37 - 2016-01-22 08:53 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2016-02-10 18:37 - 2016-01-22 08:53 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2016-02-10 18:37 - 2016-01-22 08:51 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll
2016-02-10 18:37 - 2016-01-22 08:51 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2016-02-10 18:37 - 2016-01-22 08:51 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2016-02-10 18:37 - 2016-01-22 08:51 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2016-02-10 18:37 - 2016-01-22 08:51 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2016-02-10 18:36 - 2016-01-22 10:19 - 14179840 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2016-02-10 18:36 - 2016-01-22 10:05 - 12877824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2016-02-10 18:36 - 2016-01-22 09:19 - 03231232 _____ (Microsoft Corporation) C:\Windows\explorer.exe
2016-02-10 18:35 - 2016-01-22 10:15 - 01866752 _____ (Microsoft Corporation) C:\Windows\system32\ExplorerFrame.dll
2016-02-10 18:35 - 2016-01-22 10:12 - 01940992 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2016-02-10 18:35 - 2016-01-22 10:00 - 01498624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ExplorerFrame.dll
2016-02-10 18:35 - 2016-01-22 09:59 - 01805824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2016-02-10 18:35 - 2016-01-22 09:12 - 02973184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\explorer.exe

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-02-26 12:17 - 2014-08-24 10:26 - 00001512 _____ C:\Users\sony\Desktop\baptisim of laila.lnk
2016-02-26 12:16 - 2014-08-24 22:14 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2016-02-26 12:08 - 2014-08-25 00:45 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2016-02-26 11:27 - 2015-08-26 08:21 - 00000942 _____ C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-3448637700-3732790023-3482431723-1000UA.job
2016-02-26 10:52 - 2009-07-14 08:45 - 00031760 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2016-02-26 10:52 - 2009-07-14 08:45 - 00031760 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2016-02-26 10:44 - 2009-07-14 07:20 - 00000000 ____D C:\Windows\inf
2016-02-26 09:26 - 2014-08-24 10:29 - 00000000 ____D C:\Users\LailaMichel\AppData\Roaming\uTorrent
2016-02-26 09:22 - 2014-08-24 10:42 - 00000000 ____D C:\Users\LailaMichel\AppData\Roaming\Skype
2016-02-26 08:26 - 2015-08-26 08:21 - 00000890 _____ C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-3448637700-3732790023-3482431723-1000Core.job
2016-02-26 07:44 - 2014-08-24 09:10 - 00109296 _____ C:\Users\LailaMichel\AppData\Local\GDIPFONTCACHEV1.DAT
2016-02-25 22:39 - 2014-08-24 10:26 - 00000000 ____D C:\Users\sony
2016-02-25 22:39 - 2009-07-14 09:09 - 00000000 ____D C:\Windows\System32\Tasks\WPD
2016-02-25 22:24 - 2009-07-14 06:34 - 00000215 _____ C:\Windows\system.ini
2016-02-25 22:12 - 2014-08-24 08:57 - 00000000 ____D C:\Program Files (x86)\TeamViewer
2016-02-24 17:31 - 2014-08-24 09:38 - 00000000 ____D C:\Users\LailaMichel\Desktop\CV's
2016-02-24 16:49 - 2009-07-14 09:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-02-24 06:45 - 2014-08-24 22:20 - 00000000 ____D C:\Windows\pss
2016-02-24 06:43 - 2014-08-24 22:20 - 00000000 ____D C:\ProgramData\Oracle
2016-02-24 06:43 - 2014-08-24 22:16 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2016-02-24 06:43 - 2014-08-24 22:16 - 00000000 ____D C:\Program Files (x86)\Java
2016-02-24 06:43 - 2014-08-24 09:38 - 00000000 ____D C:\Users\LailaMichel\Desktop\JavaRa-2.6
2016-02-24 06:42 - 2016-01-25 08:26 - 00000000 ____D C:\Users\LailaMichel\.oracle_jre_usage
2016-02-24 06:41 - 2014-08-24 22:16 - 00097888 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2016-02-24 06:31 - 2015-09-24 10:49 - 00000000 ____D C:\Program Files\Common Files\AV
2016-02-24 06:31 - 2014-08-24 09:41 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2016-02-22 16:49 - 2014-08-24 22:00 - 00000000 ____D C:\ProgramData\Hotspot Shield
2016-02-22 16:48 - 2014-08-24 22:00 - 00000000 ____D C:\Program Files (x86)\Hotspot Shield
2016-02-21 20:19 - 2014-08-27 09:35 - 00000000 ____D C:\Windows\Minidump
2016-02-21 20:18 - 2014-10-06 19:53 - 00000000 ___RD C:\Users\LailaMichel\Dropbox
2016-02-21 20:17 - 2014-10-06 19:47 - 00000000 ____D C:\Users\LailaMichel\AppData\Roaming\Dropbox
2016-02-17 04:00 - 2009-07-14 07:20 - 00000000 ____D C:\Windows\rescache
2016-02-13 20:20 - 2009-07-14 09:13 - 00781790 _____ C:\Windows\system32\PerfStringBackup.INI
2016-02-13 20:12 - 2014-08-24 09:34 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2016-02-13 20:12 - 2009-07-14 08:45 - 00409192 _____ C:\Windows\system32\FNTCACHE.DAT
2016-02-13 20:08 - 2014-12-11 06:44 - 00000000 ____D C:\Windows\system32\appraiser
2016-02-13 20:08 - 2014-08-24 13:26 - 00000000 ___SD C:\Windows\system32\CompatTel
2016-02-13 20:08 - 2011-04-12 12:28 - 00000000 ____D C:\Program Files\Windows Journal
2016-02-13 09:36 - 2014-08-24 14:15 - 00000000 ____D C:\Windows\system32\MRT
2016-02-13 09:29 - 2014-08-24 14:15 - 146614896 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2016-02-12 19:35 - 2014-08-24 22:14 - 00796864 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2016-02-12 19:35 - 2014-08-24 22:14 - 00142528 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2016-02-12 19:35 - 2014-08-24 22:14 - 00003768 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater

Some files in TEMP:
====================
C:\Users\LailaMichel\AppData\Local\Temp\dllnt_dump.dll


==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2016-02-19 20:02

==================== End of FRST.txt ============================



BC AdBot (Login to Remove)

 


#2 mAL_rEm018

mAL_rEm018

  • Malware Response Team
  • 308 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:06:16 PM

Posted 26 February 2016 - 12:11 PM

Please note that all instructions given are customised for this computer only, the tools used may cause damage if used on a computer with different infections.

If you think you have similar problems, please post a log in the Malware Removal forum and wait for help.

Failure to post replies within 4 days will result in this thread being closed.


Hello insaniak,

My name is mAL_rEm018, but feel free to call me mAL.  I will be helping you with your malware related problems. :)

Please be aware that removing Malware is a potentially hazardous undertaking. I will take care not to knowingly suggest courses of action that might damage your computer. However it is impossible for me to foresee all interactions that may happen between the software on your computer and those we'll use to clear you of infection, and I cannot guarantee the safety of your system. It is possible that we might encounter situations where the only recourse is to re-format and re-install your operating system, or to necessitate you taking your computer to a repair shop.


Because of this, I advise you to backup any personal files and folders before you start.


Cobian Backup
DriveImage XML


To make sure everything goes smoothly, I would like you to observe the following rules:

  • You must have Administrator rights, permissions for this computer.
  • Please reply to this thread.  Do not start another topic.
  • Perform all actions in the order given.
  • If you don't know, stop and ask!
  • DO NOT run any other fix or removal tools unless instructed to do so!
  • Don't attempt to install any new software (other than those I ask you to) until your computer is clean.
  • DO NOT post for help at any other forum.  Applying fixes from multiple help sites can cause problems.
  • I advise you to print the instructions if possible, since your internet connection might not be available during some of the fixes.
  • Absence of symptoms does not mean that everything is clear, therefore stick with this topic until I give you the "all clear".

While I review the log you have posted, please do the following..


  • Please rerun FRST as you did before, make sure to check the Addition.txt box before clicking Scan.  Once the scan is over, a window entitled "Addition.txt" will open.  Please post the contents of Addition.txt in your next reply.

Teacher at the Malware Removal University.

Member of UNITE

 

Failure to post replies within 4 days will result in this thread being closed


#3 insaniak

insaniak
  • Topic Starter

  • Members
  • 198 posts
  • OFFLINE
  •  
  • Local time:10:16 AM

Posted 26 February 2016 - 05:32 PM

Additional scan result of Farbar Recovery Scan Tool (x64) Version:24-02-2016
Ran by LailaMichel (2016-02-26 12:24:56)
Running from C:\Users\LailaMichel\Downloads
Windows 7 Home Premium Service Pack 1 (X64) (2014-08-24 04:42:12)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-3448637700-3732790023-3482431723-500 - Administrator - Disabled)
Guest (S-1-5-21-3448637700-3732790023-3482431723-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-3448637700-3732790023-3482431723-1002 - Limited - Enabled)
LailaMichel (S-1-5-21-3448637700-3732790023-3482431723-1000 - Administrator - Enabled) => C:\Users\LailaMichel

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Kaspersky Internet Security (Enabled - Up to date) {B41C7598-35F6-4D89-7D0E-7ADE69B4047B}
AS: Kaspersky Internet Security (Enabled - Up to date) {0F7D947C-13CC-4207-47BE-41AC12334EC6}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Up to date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
FW: Kaspersky Internet Security (Enabled) {8C27F4BD-7F99-4CD1-5651-D3EB97674300}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

µTorrent (HKU\S-1-5-21-3448637700-3732790023-3482431723-1000\...\uTorrent) (Version: 3.4.5.41712 - BitTorrent Inc.)
Adobe Flash Player 20 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 20.0.0.306 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.14) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.14 - Adobe Systems Incorporated)
Alps Pointing-device for VAIO (HKLM\...\{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}) (Version:  - ALPS ELECTRIC CO., LTD.)
Apple Application Support (HKLM-x32\...\{83CAF0DE-8D3B-4C37-A631-2B8F16EC3031}) (Version: 3.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{BDD99690-3541-4619-9D2A-3CDDB3E15F9E}) (Version: 8.0.5.6 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
ATI Catalyst Install Manager (HKLM\...\{3A4170BE-09B7-5658-285E-6D35E9C87101}) (Version: 3.0.829.0 - ATI Technologies, Inc.)
AuthenTec WinBio FingerPrint Software (HKLM\...\{20F5F93B-9A27-4508-87B0-BFD7494FBEC4}) (Version: 3.1.0.80 - AuthenTec, Inc.)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
CCleaner (HKLM\...\CCleaner) (Version: 5.00 - Piriform)
DAEMON Tools Lite (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.49.1.0356 - Disc Soft Ltd)
Dropbox (HKU\S-1-5-21-3448637700-3732790023-3482431723-1000\...\Dropbox) (Version: 3.14.7 - Dropbox, Inc.)
ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version:  - )
Hotspot Shield 5.2.1 (HKLM-x32\...\HotspotShield) (Version: 5.2.1 - AnchorFree Inc.)
Hotspot Shield 5.2.1 Embedded (x32 Version: 5.2.1.0 - Buildbot) Hidden
HW Gobi 3000 Driver 1.07.00.00 (HKLM-x32\...\HW Gobi 3000 Driver) (Version: 1.07.00.00 - Huawei technologies Co., Ltd.)
Intel PROSet Wireless (x32 Version:  - ) Hidden
Intel® Display Audio Driver (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 6.14.00.3074 - Intel Corporation)
Intel® Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 7.0.0.1144 - Intel Corporation)
Intel® PROSet/Wireless WiFi Software (HKLM\...\{3C41721F-AF0F-4086-AA1C-4C7F29076228}) (Version: 14.01.1000 - Intel Corporation)
iTunes (HKLM\...\{2ABBBD91-91E5-4AD7-929A-FE15D1DC0576}) (Version: 12.0.1.26 - Apple Inc.)
Java 8 Update 73 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218073F0}) (Version: 8.0.730.2 - Oracle Corporation)
Kaspersky Internet Security (HKLM-x32\...\InstallWIX_{653C1B5A-3287-47B1-8613-0745D4E771C4}) (Version: 15.0.0.463 - Kaspersky Lab)
Kaspersky Internet Security (x32 Version: 15.0.0.463 - Kaspersky Lab) Hidden
MagicDisc 2.7.106 (HKLM-x32\...\MagicDisc 2.7.106) (Version:  - )
Malwarebytes Anti-Malware version 2.2.0.1024 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.0.1024 - Malwarebytes)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (HKLM-x32\...\Office14.PROPLUS) (Version: 14.0.4734.1000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Mozilla Firefox 44.0.2 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 44.0.2 (x86 en-US)) (Version: 44.0.2 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 44.0.2.5884 - Mozilla)
PX Profile Update (x32 Version: 1.00.1. - AMD) Hidden
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.40.126.2011 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6225 - Realtek Semiconductor Corp.)
Realtek PCIE Card Reader (HKLM-x32\...\{C1594429-8296-4652-BF54-9DBE4932A44C}) (Version: 6.1.7600.80 - Realtek Semiconductor Corp.)
Renesas Electronics USB 3.0 Host Controller Driver (HKLM-x32\...\InstallShield_{5442DAB8-7177-49E1-8B22-09A049EA5996}) (Version: 2.1.16.0 - Renesas Electronics Corporation)
Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 2.1.16.0 - Renesas Electronics Corporation) Hidden
Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 8.0.0.9103 - Microsoft Corporation)
Skype™ 7.17 (HKLM-x32\...\{FC965A47-4839-40CA-B618-18F486F042C6}) (Version: 7.17.105 - Skype Technologies S.A.)
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.4.40 - Safer-Networking Ltd.)
SpyHunter 4 (HKLM-x32\...\SpyHunter) (Version: 4.21.18.4608 - Enigma Software Group, LLC)
TeamViewer 11 (HKLM-x32\...\TeamViewer) (Version: 11.0.55321 - TeamViewer)
Unlocker 1.9.2 (HKLM\...\Unlocker) (Version: 1.9.2 - Cedrick Collomb)
Windows Driver Package - Atheros Communications Inc. (athr) Net  (03/11/2011 9.2.0.316) (HKLM\...\DEEBF3DD97A309C0E7791804AA8D9A15B1172EED) (Version: 03/11/2011 9.2.0.316 - Atheros Communications Inc.)
Windows Driver Package - Sony Corporation (SFEP) HIDClass  (11/27/2009 8.0.1.2) (HKLM\...\4E827A70BAA738C408DBDD024BCACE5085D946F1) (Version: 11/27/2009 8.0.1.2 - Sony Corporation)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-3448637700-3732790023-3482431723-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\LailaMichel\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3448637700-3732790023-3482431723-1000_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\LailaMichel\AppData\Roaming\Dropbox\bin\DropboxExt64.33.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3448637700-3732790023-3482431723-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\LailaMichel\AppData\Roaming\Dropbox\bin\DropboxExt64.33.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3448637700-3732790023-3482431723-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\LailaMichel\AppData\Roaming\Dropbox\bin\DropboxExt64.33.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3448637700-3732790023-3482431723-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\LailaMichel\AppData\Roaming\Dropbox\bin\DropboxExt64.33.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3448637700-3732790023-3482431723-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\LailaMichel\AppData\Roaming\Dropbox\bin\DropboxExt64.33.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3448637700-3732790023-3482431723-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\LailaMichel\AppData\Roaming\Dropbox\bin\DropboxExt64.33.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3448637700-3732790023-3482431723-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\LailaMichel\AppData\Roaming\Dropbox\bin\DropboxExt64.33.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3448637700-3732790023-3482431723-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\LailaMichel\AppData\Roaming\Dropbox\bin\DropboxExt64.33.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3448637700-3732790023-3482431723-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\LailaMichel\AppData\Roaming\Dropbox\bin\DropboxExt64.33.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3448637700-3732790023-3482431723-1000_Classes\CLSID\{FBC9D74C-AF55-4309-9FB2-C426E071637F}\InprocServer32 -> C:\Users\LailaMichel\AppData\Roaming\Dropbox\bin\DropboxExt64.33.dll (Dropbox, Inc.)

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {18E8E268-AFD1-44A7-906A-0AD75307483D} - System32\Tasks\DropboxUpdateTaskUserS-1-5-21-3448637700-3732790023-3482431723-1000UA => C:\Users\LailaMichel\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2015-08-26] (Dropbox, Inc.)
Task: {355BE67B-A239-45DB-B915-E118BA22A6A2} - \4CEFD9B73D6C-1CRMOI2 -> No File <==== ATTENTION
Task: {384210D3-1D92-4BA4-9719-95C769231365} - System32\Tasks\SpyHunter4Startup => C:\Program Files\Enigma Software Group\SpyHunter\Spyhunter4.exe [2016-02-26] (Enigma Software Group USA, LLC.)
Task: {3A469656-FDFF-4C19-852E-11A21EFD9E90} - System32\Tasks\Microsoft\Windows\Setup\xtgt\refreshxtgtconfig => C:\Windows\system32\XTgt\XTgtMgr.exe [2015-10-05] (Microsoft Corporation)
Task: {4D77B6B4-976C-4DDF-83A6-C9E6CAEBC69C} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2016-02-12] (Adobe Systems Incorporated)
Task: {6B883E48-768A-4D9B-8ECE-F6D334047977} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe [2014-06-24] (Safer-Networking Ltd.)
Task: {71152AAC-60A4-4269-8CCD-89F497985571} - System32\Tasks\Kaspersky_Upgrade_Launcher_{278ADC42-419D-4547-A6CA-5B74BE0AD901} => C:\Program Files\Common Files\AV\Kaspersky Lab\upgrade_launcher.exe [2015-11-13] (AO Kaspersky Lab)
Task: {958A7B13-CFBF-4DA4-B28C-A7E123D49619} - System32\Tasks\DropboxUpdateTaskUserS-1-5-21-3448637700-3732790023-3482431723-1000Core => C:\Users\LailaMichel\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2015-08-26] (Dropbox, Inc.)
Task: {99DADF87-8AC4-44F8-B83F-BB4A4FD0DE30} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe [2014-06-24] (Safer-Networking Ltd.)
Task: {BD8DE4F7-9DC5-4464-AFE2-9EF1EE1921F1} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe [2014-06-27] (Safer-Networking Ltd.)
Task: {D1CA1E55-1FFE-4C5D-847B-B13E6ECEEB91} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {D43C44EC-C258-42F2-9114-85FFBF7D8E93} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-12-13] (Adobe Systems Incorporated)
Task: {E2B3E047-5F75-4E22-9F61-CE7B769E1443} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-11-21] (Piriform Ltd)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-3448637700-3732790023-3482431723-1000Core.job => C:\Users\LailaMichel\AppData\Local\Dropbox\Update\DropboxUpdate.exe
Task: C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-3448637700-3732790023-3482431723-1000UA.job => C:\Users\LailaMichel\AppData\Local\Dropbox\Update\DropboxUpdate.exe

==================== Shortcuts =============================

(The entries could be listed to be restored or removed.)

==================== Loaded Modules (Whitelisted) ==============

2010-01-09 20:17 - 2010-01-09 20:17 - 04254560 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF
2010-01-21 01:40 - 2010-01-21 01:40 - 08794464 _____ () C:\Program Files\Microsoft Office\Office14\1033\GrooveIntlResource.dll
2014-03-06 15:00 - 2014-03-06 15:00 - 01269952 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\kpcengine.2.3.dll
2016-02-17 23:43 - 2016-02-17 23:43 - 00166528 _____ () C:\Program Files (x86)\Hotspot Shield\bin\CrashRpt1403.dll
2016-02-04 05:52 - 2016-02-04 05:52 - 00280143 _____ () C:\Program Files (x86)\Hotspot Shield\bin\libidn-11.dll
2009-03-28 00:02 - 2009-03-28 00:02 - 01554920 _____ () C:\Program Files (x86)\Hotspot Shield\bin\libeay32.dll
2009-03-28 00:02 - 2009-03-28 00:02 - 00332254 _____ () C:\Program Files (x86)\Hotspot Shield\bin\libssl32.dll
2014-10-11 13:06 - 2014-10-11 13:06 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2014-10-11 13:05 - 2014-10-11 13:05 - 01044776 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2014-08-24 09:41 - 2014-05-13 12:04 - 00109400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2014-08-24 09:41 - 2014-05-13 12:04 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2014-08-24 09:41 - 2014-05-13 12:04 - 00167768 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2014-08-24 09:41 - 2012-08-23 10:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2014-08-24 09:41 - 2012-04-03 17:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll
2010-01-09 20:18 - 2010-01-09 20:18 - 04254560 _____ () C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
2010-01-21 01:34 - 2010-01-21 01:34 - 08793952 _____ () C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveIntlResource.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)


==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

IE restricted site: HKU\.DEFAULT\...\007guard.com -> install.007guard.com
IE restricted site: HKU\.DEFAULT\...\008i.com -> 008i.com
IE restricted site: HKU\.DEFAULT\...\008k.com -> www.008k.com
IE restricted site: HKU\.DEFAULT\...\00hq.com -> www.00hq.com
IE restricted site: HKU\.DEFAULT\...\010402.com -> 010402.com
IE restricted site: HKU\.DEFAULT\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\.DEFAULT\...\0scan.com -> www.0scan.com
IE restricted site: HKU\.DEFAULT\...\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\.DEFAULT\...\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\.DEFAULT\...\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\.DEFAULT\...\1001namen.com -> www.1001namen.com
IE restricted site: HKU\.DEFAULT\...\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\.DEFAULT\...\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\.DEFAULT\...\10sek.com -> www.10sek.com
IE restricted site: HKU\.DEFAULT\...\12-26.net -> user1.12-26.net
IE restricted site: HKU\.DEFAULT\...\12-27.net -> user1.12-27.net
IE restricted site: HKU\.DEFAULT\...\123fporn.info -> www.123fporn.info
IE restricted site: HKU\.DEFAULT\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\.DEFAULT\...\123moviedownload.com -> www.123moviedownload.com
IE restricted site: HKU\.DEFAULT\...\123simsen.com -> www.123simsen.com

There are 7865 more sites.

IE restricted site: HKU\S-1-5-21-3448637700-3732790023-3482431723-1000\...\007guard.com -> install.007guard.com
IE restricted site: HKU\S-1-5-21-3448637700-3732790023-3482431723-1000\...\008i.com -> 008i.com
IE restricted site: HKU\S-1-5-21-3448637700-3732790023-3482431723-1000\...\008k.com -> www.008k.com
IE restricted site: HKU\S-1-5-21-3448637700-3732790023-3482431723-1000\...\00hq.com -> www.00hq.com
IE restricted site: HKU\S-1-5-21-3448637700-3732790023-3482431723-1000\...\010402.com -> 010402.com
IE restricted site: HKU\S-1-5-21-3448637700-3732790023-3482431723-1000\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\S-1-5-21-3448637700-3732790023-3482431723-1000\...\0scan.com -> www.0scan.com
IE restricted site: HKU\S-1-5-21-3448637700-3732790023-3482431723-1000\...\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\S-1-5-21-3448637700-3732790023-3482431723-1000\...\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\S-1-5-21-3448637700-3732790023-3482431723-1000\...\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\S-1-5-21-3448637700-3732790023-3482431723-1000\...\1001namen.com -> www.1001namen.com
IE restricted site: HKU\S-1-5-21-3448637700-3732790023-3482431723-1000\...\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\S-1-5-21-3448637700-3732790023-3482431723-1000\...\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\S-1-5-21-3448637700-3732790023-3482431723-1000\...\10sek.com -> www.10sek.com
IE restricted site: HKU\S-1-5-21-3448637700-3732790023-3482431723-1000\...\12-26.net -> user1.12-26.net
IE restricted site: HKU\S-1-5-21-3448637700-3732790023-3482431723-1000\...\12-27.net -> user1.12-27.net
IE restricted site: HKU\S-1-5-21-3448637700-3732790023-3482431723-1000\...\123fporn.info -> www.123fporn.info
IE restricted site: HKU\S-1-5-21-3448637700-3732790023-3482431723-1000\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\S-1-5-21-3448637700-3732790023-3482431723-1000\...\123moviedownload.com -> www.123moviedownload.com
IE restricted site: HKU\S-1-5-21-3448637700-3732790023-3482431723-1000\...\123simsen.com -> www.123simsen.com

There are 7863 more sites.


==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 06:34 - 2016-02-25 22:24 - 00000027 ____N C:\Windows\system32\Drivers\etc\hosts

127.0.0.1       localhost

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-3448637700-3732790023-3482431723-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\LailaMichel\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.1.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\startupfolder: C:^Users^LailaMichel^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Dropbox.lnk => C:\Windows\pss\Dropbox.lnk.Startup
MSCONFIG\startupfolder: C:^Users^LailaMichel^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^MagicDisc.lnk => C:\Windows\pss\MagicDisc.lnk.Startup
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: BCSSync => "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" /DelayServices
MSCONFIG\startupreg: CCleaner Monitoring => "C:\Program Files\CCleaner\CCleaner64.exe" /MONITOR
MSCONFIG\startupreg: DAEMON Tools Lite => "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
MSCONFIG\startupreg: Dropbox Update => "C:\Users\LailaMichel\AppData\Local\Dropbox\Update\DropboxUpdate.exe" /c
MSCONFIG\startupreg: GBMHome9Agent => C:\Program Files\Genie9\Genie Backup Manager\GBMAgent.exe
MSCONFIG\startupreg: HotKeysCmds => C:\Windows\system32\hkcmd.exe
MSCONFIG\startupreg: IgfxTray => C:\Windows\system32\igfxtray.exe
MSCONFIG\startupreg: SDTray => "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe"
MSCONFIG\startupreg: Skype => "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
MSCONFIG\startupreg: SpybotPostWindows10UpgradeReInstall => "C:\Program Files\Common Files\AV\Spybot - Search and Destroy\Test.exe"
MSCONFIG\startupreg: StartCCC => "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
MSCONFIG\startupreg: uTorrent => "C:\Users\LailaMichel\AppData\Roaming\uTorrent\uTorrent.exe"  /MINIMIZED

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [{2FCAA65A-108C-4445-98A3-E59E0EFD0D5C}] => (Allow) C:\Users\LailaMichel\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{4AA156E0-70E1-447A-A0D9-D6E768FC307E}] => (Allow) C:\Users\LailaMichel\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{2E820BCD-163B-4311-96E7-DBF64BCC88CE}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{BD778298-17BB-4FB7-9D30-A230F59DED1B}] => (Allow) C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe
FirewallRules: [{AF5F1426-E063-4FE2-AEC0-3368F8F5FA8A}] => (Allow) C:\Users\LailaMichel\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{CE637312-9A53-40FA-BDD6-6FC08FDFDDF6}] => (Allow) C:\Users\LailaMichel\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{A7A2D905-EEBC-4984-9FFF-1C9ACFE96056}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{38D0C798-89B9-4965-B2B3-C64101034E93}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{FD3E5468-5F4B-4821-BCA4-56B34B03D14A}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{9B069858-E8F2-4ABE-AEC6-C62F51CA358B}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{9F426532-CFEF-45ED-B462-D2EC2AA31B56}] => (Allow) C:\Program Files (x86)\iTunes\iTunes.exe
FirewallRules: [{64E5D23A-24E5-48A2-9568-5F4CC2C2D0DA}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{EBB38FB5-9ED7-40E0-8769-9009EC389B7C}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{6BB7531A-CB27-4D7C-B385-3F76CA8F340A}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{4C9E4D13-6A25-4F4B-8437-4640A70D2357}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{60AF2823-A04C-41C5-B20B-C968ADE2184F}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{A988A03D-9F80-4DA6-ACCA-A611644F6D5C}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{58DD39B5-93DE-47A5-9BF9-D80831078769}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{EC3293F9-9473-443D-9A52-F021DD608609}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe] => Enabled:Spybot - Search & Destroy tray access
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe] => Enabled:Spybot-S&D 2 Scanner Service
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe] => Enabled:Spybot-S&D 2 Updater
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe] => Enabled:Spybot-S&D 2 Background update service

==================== Restore Points =========================

23-02-2016 17:48:05 Windows Update
25-02-2016 21:56:51 JRT Pre-Junkware Removal
26-02-2016 12:08:54 Checkpoint by HitmanPro

==================== Faulty Device Manager Devices =============

Name: Realtek PCIE CardReader
Description: Realtek PCIE CardReader
Class Guid: {4d36e970-e325-11ce-bfc1-08002be10318}
Manufacturer: Realtek Semiconduct Corp.
Service: RSPCIESTOR
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (02/26/2016 12:11:47 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: plugin-container.exe, version: 44.0.2.5884, time stamp: 0x56bbf417
Faulting module name: mozglue.dll, version: 44.0.2.5884, time stamp: 0x56bbe58e
Exception code: 0x80000003
Fault offset: 0x0000ed3b
Faulting process id: 0x192c
Faulting application start time: 0xplugin-container.exe0
Faulting application path: plugin-container.exe1
Faulting module path: plugin-container.exe2
Report Id: plugin-container.exe3

Error: (02/26/2016 12:11:44 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: plugin-container.exe, version: 44.0.2.5884, time stamp: 0x56bbf417
Faulting module name: mozglue.dll, version: 44.0.2.5884, time stamp: 0x56bbe58e
Exception code: 0x80000003
Fault offset: 0x0000ed3b
Faulting process id: 0x368c
Faulting application start time: 0xplugin-container.exe0
Faulting application path: plugin-container.exe1
Faulting module path: plugin-container.exe2
Report Id: plugin-container.exe3

Error: (02/26/2016 12:11:43 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: plugin-container.exe, version: 44.0.2.5884, time stamp: 0x56bbf417
Faulting module name: mozglue.dll, version: 44.0.2.5884, time stamp: 0x56bbe58e
Exception code: 0x80000003
Fault offset: 0x0000ed3b
Faulting process id: 0x39c4
Faulting application start time: 0xplugin-container.exe0
Faulting application path: plugin-container.exe1
Faulting module path: plugin-container.exe2
Report Id: plugin-container.exe3

Error: (02/26/2016 09:57:48 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: Activation context generation failed for "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest1".Error in manifest or policy file "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest2" on line C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest3.
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest.
Component 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d.manifest.

Error: (02/26/2016 09:27:38 AM) (Source: ESENT) (EventID: 455) (User: )
Description: DllHost (15800) WebCacheLocal: Error -1811 occurred while opening logfile C:\Users\LailaMichel\AppData\Local\Microsoft\Windows\WebCache\V010003F.log.

Error: (02/26/2016 09:24:20 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: Activation context generation failed for "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest1".Error in manifest or policy file "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest2" on line C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest3.
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest.
Component 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d.manifest.

Error: (02/26/2016 09:24:06 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: Activation context generation failed for "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest1".Error in manifest or policy file "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest2" on line C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest3.
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest.
Component 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d.manifest.

Error: (02/26/2016 07:43:56 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 9167383

Error: (02/26/2016 07:43:56 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 9167383

Error: (02/26/2016 07:43:56 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second


System errors:
=============
Error: (02/26/2016 10:52:59 AM) (Source: Application Popup) (EventID: 1060) (User: )
Description: \??\C:\Windows\System32\drivers\TrueSight.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.

Error: (02/26/2016 10:38:41 AM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT AUTHORITY)
Description: WLAN Extensibility Module has stopped unexpectedly.

Module Path: C:\Windows\System32\IWMSSvc.dll

Error: (02/26/2016 10:25:56 AM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT AUTHORITY)
Description: WLAN Extensibility Module has stopped unexpectedly.

Module Path: C:\Windows\System32\IWMSSvc.dll

Error: (02/26/2016 09:28:22 AM) (Source: Service Control Manager) (EventID: 7032) (User: )
Description: The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Spybot-S&D 2 Scanner Service service, but this action failed with the following error:
%%1056

Error: (02/26/2016 09:27:22 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The Skype Click to Call Updater service terminated unexpectedly.  It has done this 1 time(s).

Error: (02/26/2016 09:27:22 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Spybot-S&D 2 Scanner Service service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 60000 milliseconds: Restart the service.

Error: (02/26/2016 09:27:17 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The IconMan_R service terminated unexpectedly.  It has done this 1 time(s).

Error: (02/26/2016 09:27:14 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Hotspot Shield Service service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 0 milliseconds: Restart the service.

Error: (02/26/2016 09:27:14 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The Skype Click to Call PNR Service service terminated unexpectedly.  It has done this 1 time(s).

Error: (02/26/2016 09:27:14 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Spybot-S&D 2 Updating Service service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 60000 milliseconds: Restart the service.


CodeIntegrity:
===================================
  Date: 2016-02-25 22:20:19.099
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2016-02-25 22:20:19.049
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2014-10-16 06:05:26.727
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\ELAMBKUP\klelam.sys because the set of per-page image hashes could not be found on the system.

  Date: 2014-10-16 06:05:26.727
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\ELAMBKUP\klelam.sys because the set of per-page image hashes could not be found on the system.

  Date: 2014-10-16 06:05:26.727
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\ELAMBKUP\klelam.sys because the set of per-page image hashes could not be found on the system.

  Date: 2014-10-16 06:05:26.707
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\KLELAMX64\klelam.sys because the set of per-page image hashes could not be found on the system.

  Date: 2014-10-16 06:05:26.707
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\KLELAMX64\klelam.sys because the set of per-page image hashes could not be found on the system.

  Date: 2014-10-16 06:05:26.647
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\KLELAMX64\klelam.sys because the set of per-page image hashes could not be found on the system.

  Date: 2014-10-14 17:14:02.690
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\ELAMBKUP\klelam.sys because the set of per-page image hashes could not be found on the system.

  Date: 2014-10-14 17:14:02.690
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\ELAMBKUP\klelam.sys because the set of per-page image hashes could not be found on the system.


==================== Memory info ===========================

Processor: Intel® Core™ i3-2330M CPU @ 2.20GHz
Percentage of memory in use: 58%
Total physical RAM: 4011.86 MB
Available physical RAM: 1676.26 MB
Total Virtual: 8021.93 MB
Available Virtual: 4711.41 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:452.76 GB) (Free:257.6 GB) NTFS
Drive g: (System Reserved) (Fixed) (Total:0.1 GB) (Free:0.06 GB) NTFS ==>[system with boot components (obtained from drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: BD84D993)
Partition 1: (Not Active) - (Size=12.9 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=452.8 GB) - (Type=07 NTFS)

==================== End of Addition.txt ============================



#4 mAL_rEm018

mAL_rEm018

  • Malware Response Team
  • 308 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:06:16 PM

Posted 27 February 2016 - 04:32 PM

Hello insaniak,

Please answer the following questions:

  • Did you install the following program?

    TeamViewer 11


Backup your registry using TCRB


  • Please download TCRB to your Desktop.
  • Open Tweaking.com Registry Backup.
  • Click on the Backup Registry tab and ensure that all options are checked.
  • Press on Backup Now.
  • Wait until the backup is complete and exit the program.

SpyHunter 4 (HKLM-x32\...\SpyHunter) (Version: 4.21.18.4608 - Enigma Software Group, LLC)

I do not recommend SpyHunter because of the reasons outlined HERE. Since there exist good free alternatives I strongly suggest you remove it. If you wish to do so, then follow the same instructions as outlined below.


Removing a program in Windows 7

  • Click the Star Menu and select Control Panel.
  • Click Programs, then Programs and Features.
  • Select the following programs:

    µTorrent

  • Select Uninstall.
  • When prompted select Yes.
  • Answer any questions attentively.
  • When the process is finished, please restart your computer.

Note: you can only remove one program at a time.


It is clear from the logs that you've supplied that you have made several attempts at self-help prior to coming here to Bleeping Computer. It appears you've run a number of tools, and I need to see the logs that those tools created.

That does not mean I want you to run those tools again, it means I need to see the logs that were created when you ran them earlier.

Each will have created a report, and unless you have deleted them, or moved them, then they should be in the following locations ....


 

  • C:\ComboFix.txt
  • C:\AdwCleaner[C1].txt

 

.... if they are not in those locations, then please run a search for them to see if they are present somewhere else on your machine.

If you can't find them, then please let me know.

Next..
 

I found alot of stuff  with malwarebytes,


I need to see a scan log from a previous run of MBAM, please do the following:

  • Start MBAM... Press the History icon on the top panel.
  • From the left side select the option:
    • Application Logs
  • Double click on the requested (by date) log... the log display automatically.  (Do not use the Select box)
  • When viewing the log, press the Copy to Clipboard button.
  • Please copy and paste viewed log contents in your next reply.
    Be sure to post the complete log... including the top portion showing MBAM's database version and your operating system.
  • Exit MBAM when done.

Using the default History Settings ... Log files can be found in these locations:
Windows Vista, Win 7, Win 8 or 8.1: C:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware\Logs


-----------------------------------------
In your next reply, I would like to see..

  • Did you have trouble performing any of the steps?
  • Answer to my question.
  • C:\ComboFix.txt
  • C:\AdwCleaner[C1].txt
  • MBAM Log

Please post each log separately to prevent it being cut off by the forum post size limiter.
Check each after you've posted it to make sure it's all present, if any log is cut off you'll have to post it in sections....

 


Teacher at the Malware Removal University.

Member of UNITE

 

Failure to post replies within 4 days will result in this thread being closed


#5 insaniak

insaniak
  • Topic Starter

  • Members
  • 198 posts
  • OFFLINE
  •  
  • Local time:10:16 AM

Posted 28 February 2016 - 09:29 PM

Yes I did

 

For some reason none of the logs show the objects it found when scanning.

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 2/25/2016
Scan Time: 6:21 AM
Logfile: MBam Scan Log.txt
Administrator: Yes

Version: 2.2.0.1024
Malware Database: v2016.02.24.09
Rootkit Database: v2016.02.17.01
License: Trial
Malware Protection: Enabled
Malicious Website Protection: Enabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: LailaMichel

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 384198
Time Elapsed: 45 min, 55 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 0
(No malicious items detected)

Physical Sectors: 0
(No malicious items detected)


(end)

 

 

 

ComboFix 16-02-23.01 - LailaMichel 02/25/2016  22:11:45.1.4 - x64
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.1.1033.18.4012.1602 [GMT 4:00]
Running from: c:\users\LailaMichel\Desktop\ComboFix.exe
AV: Kaspersky Internet Security *Disabled/Updated* {B41C7598-35F6-4D89-7D0E-7ADE69B4047B}
FW: Kaspersky Internet Security *Disabled* {8C27F4BD-7F99-4CD1-5651-D3EB97674300}
SP: Kaspersky Internet Security *Disabled/Updated* {0F7D947C-13CC-4207-47BE-41AC12334EC6}
SP: Spybot - Search and Destroy *Enabled/Updated* {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\Roaming
c:\users\LailaMichel\AppData\Roaming\chrome-extension.localstorage
.
.
(((((((((((((((((((((((((   Files Created from 2016-01-25 to 2016-02-25  )))))))))))))))))))))))))))))))
.
.
2016-02-25 18:24 . 2016-02-25 18:24    --------    d-----w-    c:\users\Default\AppData\Local\temp
2016-02-25 17:53 . 2016-02-25 17:53    --------    d-----w-    C:\AdwCleaner
2016-02-25 17:32 . 2016-02-25 17:32    --------    d-----w-    c:\program files (x86)\ESET
2016-02-25 06:11 . 2016-02-25 06:11    --------    d-----w-    c:\users\LailaMichel\AppData\Local\Diagnostics
2016-02-25 04:32 . 2016-02-25 04:32    75888    ----a-w-    c:\programdata\Microsoft\Windows Defender\Definition Updates\{FFB5DAF3-80A6-4547-B114-D780753D3D1B}\offreg.2124.dll
2016-02-24 03:59 . 2016-02-24 03:59    192216    ----a-w-    c:\windows\system32\drivers\7E7E7AA9.sys
2016-02-24 02:38 . 2016-02-25 16:54    192216    ----a-w-    c:\windows\system32\drivers\MBAMSwissArmy.sys
2016-02-24 02:37 . 2016-02-24 02:37    --------    d-----w-    c:\program files (x86)\Malwarebytes Anti-Malware
2016-02-24 02:37 . 2016-02-24 02:37    --------    d-----w-    c:\programdata\Malwarebytes
2016-02-24 02:37 . 2015-10-05 05:50    63704    ----a-w-    c:\windows\system32\drivers\mwac.sys
2016-02-24 02:37 . 2015-10-05 05:50    109272    ----a-w-    c:\windows\system32\drivers\mbamchameleon.sys
2016-02-24 02:37 . 2015-10-05 05:50    25816    ----a-w-    c:\windows\system32\drivers\mbam.sys
2016-02-24 02:34 . 2016-02-24 02:34    75888    ----a-w-    c:\programdata\Microsoft\Windows Defender\Definition Updates\{FFB5DAF3-80A6-4547-B114-D780753D3D1B}\offreg.6376.dll
2016-02-24 02:29 . 2016-02-24 02:29    --------    d-----w-    c:\users\LailaMichel\AppData\Roaming\addpcs
2016-02-24 02:28 . 2016-02-24 02:28    --------    d-----w-    c:\program files\Temp File Cleaner
2016-02-23 13:49 . 2015-11-25 11:02    11154520    ----a-w-    c:\programdata\Microsoft\Windows Defender\Definition Updates\{FFB5DAF3-80A6-4547-B114-D780753D3D1B}\mpengine.dll
2016-02-10 14:39 . 2016-01-07 17:42    141312    ----a-w-    c:\windows\system32\drivers\mrxdav.sys
2016-02-10 14:38 . 2016-01-16 19:01    2085888    ----a-w-    c:\windows\system32\ole32.dll
2016-02-10 14:38 . 2016-01-16 18:36    1413632    ----a-w-    c:\windows\SysWow64\ole32.dll
2016-02-10 14:36 . 2016-01-22 06:19    14179840    ----a-w-    c:\windows\system32\shell32.dll
2016-02-10 14:36 . 2016-01-22 05:19    3231232    ----a-w-    c:\windows\explorer.exe
2016-02-10 14:35 . 2016-01-22 06:15    1866752    ----a-w-    c:\windows\system32\ExplorerFrame.dll
2016-02-10 14:35 . 2016-01-22 06:12    1940992    ----a-w-    c:\windows\system32\authui.dll
2016-02-10 14:35 . 2016-01-22 06:00    1498624    ----a-w-    c:\windows\SysWow64\ExplorerFrame.dll
2016-02-10 14:35 . 2016-01-22 05:59    1805824    ----a-w-    c:\windows\SysWow64\authui.dll
2016-02-10 14:35 . 2016-01-22 05:12    2973184    ----a-w-    c:\windows\SysWow64\explorer.exe
.
.
.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2016-02-24 02:41 . 2014-08-24 18:16    97888    ----a-w-    c:\windows\SysWow64\WindowsAccessBridge-32.dll
2016-02-13 05:29 . 2014-08-24 10:15    146614896    ----a-w-    c:\windows\system32\MRT.exe
2016-02-12 15:35 . 2014-08-24 18:14    796864    ----a-w-    c:\windows\SysWow64\FlashPlayerApp.exe
2016-02-12 15:35 . 2014-08-24 18:14    142528    ----a-w-    c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2016-01-22 05:59 . 2016-02-10 14:37    44032    ----a-w-    c:\windows\apppatch\acwow64.dll
2015-12-08 21:54 . 2016-01-15 05:01    1620992    ----a-w-    c:\windows\SysWow64\WMVDECOD.DLL
2015-12-08 21:54 . 2016-01-15 05:01    902144    ----a-w-    c:\windows\SysWow64\WMADMOD.DLL
2015-12-08 21:54 . 2016-01-15 05:01    739328    ----a-w-    c:\windows\SysWow64\WMSPDMOD.DLL
2015-12-08 21:54 . 2016-01-15 05:01    541184    ----a-w-    c:\windows\SysWow64\WMVSDECD.DLL
2015-12-08 21:54 . 2016-01-15 05:01    815616    ----a-w-    c:\windows\SysWow64\WMADMOE.DLL
2015-12-08 21:54 . 2016-01-15 05:01    740352    ----a-w-    c:\windows\SysWow64\wmpmde.dll
2015-12-08 21:54 . 2016-01-15 05:01    665088    ----a-w-    c:\windows\SysWow64\WMVXENCD.DLL
2015-12-08 21:54 . 2016-01-15 05:01    1568768    ----a-w-    c:\windows\SysWow64\WMVENCOD.DLL
2015-12-08 21:54 . 2016-01-15 05:01    358400    ----a-w-    c:\windows\SysWow64\WMVSENCD.DLL
2015-12-08 21:54 . 2016-01-15 05:01    1325056    ----a-w-    c:\windows\SysWow64\WMSPDMOE.DLL
2015-12-08 21:54 . 2016-01-15 05:01    2285056    ----a-w-    c:\windows\SysWow64\msmpeg2vdec.dll
2015-12-08 21:54 . 2016-01-15 05:01    154112    ----a-w-    c:\windows\SysWow64\VIDRESZR.DLL
2015-12-08 21:53 . 2016-01-15 05:01    206848    ----a-w-    c:\windows\SysWow64\RESAMPLEDMO.DLL
2015-12-08 21:53 . 2016-01-15 05:02    509952    ----a-w-    c:\windows\SysWow64\qedit.dll
2015-12-08 21:53 . 2016-01-15 05:01    1329664    ----a-w-    c:\windows\SysWow64\quartz.dll
2015-12-08 21:53 . 2016-01-15 05:01    519680    ----a-w-    c:\windows\SysWow64\qdvd.dll
2015-12-08 21:53 . 2016-01-15 05:01    206848    ----a-w-    c:\windows\SysWow64\qasf.dll
2015-12-08 21:53 . 2016-01-15 05:01    970240    ----a-w-    c:\windows\SysWow64\msmpeg2adec.dll
2015-12-08 21:53 . 2016-01-15 05:01    829952    ----a-w-    c:\windows\SysWow64\MSMPEG2ENC.DLL
2015-12-08 21:53 . 2016-01-15 05:01    241152    ----a-w-    c:\windows\SysWow64\MPG4DECD.DLL
2015-12-08 21:53 . 2016-01-15 05:01    241152    ----a-w-    c:\windows\SysWow64\MP43DECD.DLL
2015-12-08 21:53 . 2016-01-15 05:01    415744    ----a-w-    c:\windows\SysWow64\MP4SDECD.DLL
2015-12-08 21:53 . 2016-01-15 05:01    79872    ----a-w-    c:\windows\SysWow64\MP3DMOD.DLL
2015-12-08 21:53 . 2016-01-15 05:01    3209728    ----a-w-    c:\windows\SysWow64\mf.dll
2015-12-08 21:53 . 2016-01-15 05:01    609280    ----a-w-    c:\windows\SysWow64\MFWMAAEC.DLL
2015-12-08 21:53 . 2016-01-15 05:01    354816    ----a-w-    c:\windows\SysWow64\mfplat.dll
2015-12-08 21:53 . 2016-01-15 05:01    53248    ----a-w-    c:\windows\SysWow64\mfvdsp.dll
2015-12-08 21:53 . 2016-01-15 05:01    103424    ----a-w-    c:\windows\SysWow64\mfps.dll
2015-12-08 21:53 . 2016-01-15 05:01    4608    ----a-w-    c:\windows\SysWow64\ksuser.dll
2015-12-08 21:53 . 2016-01-15 05:01    489984    ----a-w-    c:\windows\SysWow64\evr.dll
2015-12-08 21:53 . 2016-01-15 05:02    67584    ----a-w-    c:\windows\SysWow64\devenum.dll
2015-12-08 21:53 . 2016-01-15 05:01    153600    ----a-w-    c:\windows\SysWow64\COLORCNV.DLL
2015-12-08 21:53 . 2016-01-15 05:01    50176    ----a-w-    c:\windows\SysWow64\rrinstaller.exe
2015-12-08 21:53 . 2016-01-15 05:01    23040    ----a-w-    c:\windows\SysWow64\mfpmp.exe
2015-12-08 21:53 . 2016-01-15 05:01    193536    ----a-w-    c:\windows\SysWow64\ksproxy.ax
2015-12-08 21:52 . 2016-01-15 04:58    312320    ----a-w-    c:\windows\SysWow64\gdi32.dll
2015-12-08 21:50 . 2016-01-15 05:01    2048    ----a-w-    c:\windows\SysWow64\mferror.dll
2015-12-08 19:07 . 2016-01-15 05:01    1888768    ----a-w-    c:\windows\system32\WMVDECOD.DLL
2015-12-08 19:07 . 2016-01-15 05:01    1232896    ----a-w-    c:\windows\system32\WMADMOD.DLL
2015-12-08 19:07 . 2016-01-15 05:01    978944    ----a-w-    c:\windows\system32\WMSPDMOD.DLL
2015-12-08 19:07 . 2016-01-15 05:01    666112    ----a-w-    c:\windows\system32\WMVSDECD.DLL
2015-12-08 19:07 . 2016-01-15 05:01    1153024    ----a-w-    c:\windows\system32\WMADMOE.DLL
2015-12-08 19:07 . 2016-01-15 05:01    1026048    ----a-w-    c:\windows\system32\wmpmde.dll
2015-12-08 19:07 . 2016-01-15 05:01    642048    ----a-w-    c:\windows\system32\WMVXENCD.DLL
2015-12-08 19:07 . 2016-01-15 05:01    1955328    ----a-w-    c:\windows\system32\WMVENCOD.DLL
2015-12-08 19:07 . 2016-01-15 05:01    1575424    ----a-w-    c:\windows\system32\WMSPDMOE.DLL
2015-12-08 19:07 . 2016-01-15 05:01    447488    ----a-w-    c:\windows\system32\WMVSENCD.DLL
2015-12-08 19:07 . 2016-01-15 05:01    1393152    ----a-w-    c:\windows\system32\WMALFXGFXDSP.dll
2015-12-08 19:07 . 2016-01-15 05:01    2777088    ----a-w-    c:\windows\system32\msmpeg2vdec.dll
2015-12-08 19:07 . 2016-01-15 05:01    292352    ----a-w-    c:\windows\system32\VIDRESZR.DLL
2015-12-08 19:07 . 2016-01-15 05:01    378880    ----a-w-    c:\windows\system32\SysFxUI.dll
2015-12-08 19:07 . 2016-01-15 05:01    225792    ----a-w-    c:\windows\system32\RESAMPLEDMO.DLL
2015-12-08 19:07 . 2016-01-15 05:02    624640    ----a-w-    c:\windows\system32\qedit.dll
2015-12-08 19:07 . 2016-01-15 05:01    1573888    ----a-w-    c:\windows\system32\quartz.dll
2015-12-08 19:07 . 2016-01-15 05:01    371712    ----a-w-    c:\windows\system32\qdvd.dll
2015-12-08 19:07 . 2016-01-15 05:01    254464    ----a-w-    c:\windows\system32\qasf.dll
2015-12-08 19:07 . 2016-01-15 05:01    1307136    ----a-w-    c:\windows\system32\msmpeg2adec.dll
2015-12-08 19:07 . 2016-01-15 05:01    1160192    ----a-w-    c:\windows\system32\MSMPEG2ENC.DLL
2015-12-08 19:07 . 2016-01-15 05:01    4121600    ----a-w-    c:\windows\system32\mf.dll
2015-12-08 19:07 . 2016-01-15 05:01    1010688    ----a-w-    c:\windows\system32\mcmde.dll
2015-12-08 19:07 . 2016-01-15 05:01    653824    ----a-w-    c:\windows\system32\MP4SDECD.DLL
2015-12-08 19:07 . 2016-01-15 05:01    484864    ----a-w-    c:\windows\system32\MFWMAAEC.DLL
2015-12-08 19:07 . 2016-01-15 05:01    432128    ----a-w-    c:\windows\system32\mfplat.dll
2015-12-08 19:07 . 2016-01-15 05:01    224768    ----a-w-    c:\windows\system32\MPG4DECD.DLL
2015-12-08 19:07 . 2016-01-15 05:01    223744    ----a-w-    c:\windows\system32\MP43DECD.DLL
2015-12-08 19:07 . 2016-01-15 05:01    100864    ----a-w-    c:\windows\system32\MP3DMOD.DLL
2015-12-08 19:07 . 2016-01-15 05:01    70144    ----a-w-    c:\windows\system32\mfvdsp.dll
2015-12-08 19:07 . 2016-01-15 05:01    206848    ----a-w-    c:\windows\system32\mfps.dll
2015-12-08 19:07 . 2016-01-15 05:01    5120    ----a-w-    c:\windows\system32\ksuser.dll
2015-12-08 19:07 . 2016-01-15 05:01    632320    ----a-w-    c:\windows\system32\evr.dll
2015-12-08 19:07 . 2016-01-15 04:58    405504    ----a-w-    c:\windows\system32\gdi32.dll
2015-12-08 19:07 . 2016-01-15 05:02    76288    ----a-w-    c:\windows\system32\devenum.dll
2015-12-08 19:07 . 2016-01-15 05:01    189952    ----a-w-    c:\windows\system32\COLORCNV.DLL
2015-12-08 19:07 . 2016-01-15 05:01    55808    ----a-w-    c:\windows\system32\rrinstaller.exe
2015-12-08 19:06 . 2016-01-15 05:01    24576    ----a-w-    c:\windows\system32\mfpmp.exe
2015-12-08 19:06 . 2016-01-15 05:01    250880    ----a-w-    c:\windows\system32\ksproxy.ax
2015-12-08 19:04 . 2016-01-15 05:01    2048    ----a-w-    c:\windows\system32\mferror.dll
2015-12-08 18:54 . 2016-01-15 05:01    116736    ----a-w-    c:\windows\system32\drivers\drmk.sys
2015-12-08 18:12 . 2016-01-15 05:01    230400    ----a-w-    c:\windows\system32\drivers\portcls.sys
2015-12-08 18:11 . 2016-01-15 05:01    5632    ----a-w-    c:\windows\system32\drivers\drmkaud.sys
2015-12-02 09:18 . 2010-11-21 03:27    301728    ------w-    c:\windows\system32\MpSigStub.exe
.
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BingSvc"="c:\users\LailaMichel\AppData\Local\Microsoft\BingSvc\BingSvc.exe" [2015-11-13 144008]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2015-12-16 50385536]
"uTorrent"="c:\users\LailaMichel\AppData\Roaming\uTorrent\uTorrent.exe" [2016-02-13 2065944]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2014-10-15 157480]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute    REG_MULTI_SZ       autocheck autochk *\0\0sdnclean64.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes Anti-Malware\mbamservice.exe;c:\program files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 MBAMWebAccessControl;MBAMWebAccessControl;c:\windows\system32\drivers\mwac.sys;c:\windows\SYSNATIVE\drivers\mwac.sys [x]
R3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe [x]
R3 RSPCIESTOR;Realtek PCIE CardReader Driver;c:\windows\system32\DRIVERS\RtsPStor.sys;c:\windows\SYSNATIVE\DRIVERS\RtsPStor.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys;c:\windows\SYSNATIVE\DRIVERS\dtsoftbus01.sys [x]
S1 HssDRV6;Hotspot Shield Routing Driver 6;c:\windows\system32\DRIVERS\hssdrv6.sys;c:\windows\SYSNATIVE\DRIVERS\hssdrv6.sys [x]
S1 klhk;klhk;c:\windows\system32\DRIVERS\klhk.sys;c:\windows\SYSNATIVE\DRIVERS\klhk.sys [x]
S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys;c:\windows\SYSNATIVE\DRIVERS\klim6.sys [x]
S1 klpd;klpd;c:\windows\system32\DRIVERS\klpd.sys;c:\windows\SYSNATIVE\DRIVERS\klpd.sys [x]
S1 kltdi;kltdi;c:\windows\system32\DRIVERS\kltdi.sys;c:\windows\SYSNATIVE\DRIVERS\kltdi.sys [x]
S1 kneps;kneps;c:\windows\system32\DRIVERS\kneps.sys;c:\windows\SYSNATIVE\DRIVERS\kneps.sys [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 AVP15.0.0;Kaspersky Anti-Virus Service 15.0.0;c:\program files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe;c:\program files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [x]
S2 c2cautoupdatesvc;Skype Click to Call Updater;c:\program files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe;c:\program files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [x]
S2 c2cpnrsvc;Skype Click to Call PNR Service;c:\program files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe;c:\program files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [x]
S2 DiagTrack;Diagnostics Tracking Service;c:\windows\System32\svchost.exe;c:\windows\SYSNATIVE\svchost.exe [x]
S2 hshld;Hotspot Shield Service;c:\program files (x86)\Hotspot Shield\bin\cmw_srv.exe;c:\program files (x86)\Hotspot Shield\bin\cmw_srv.exe [x]
S2 IconMan_R;IconMan_R;c:\program files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe;c:\program files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [x]
S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe;c:\program files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [x]
S2 SDScannerService;Spybot-S&D 2 Scanner Service;c:\program files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe;c:\program files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [x]
S2 SDUpdateService;Spybot-S&D 2 Updating Service;c:\program files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe;c:\program files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [x]
S2 SDWSCService;Spybot-S&D 2 Security Center Service;c:\program files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe;c:\program files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [x]
S2 UNS;Intel® Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [x]
S3 ATSwpWDF;AuthenTec TruePrint WBF Driver;c:\windows\system32\DRIVERS\ATSwpWDF.sys;c:\windows\SYSNATIVE\DRIVERS\ATSwpWDF.sys [x]
S3 IntcDAud;Intel® Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
S3 intelkmd;intelkmd;c:\windows\system32\DRIVERS\igdpmd64.sys;c:\windows\SYSNATIVE\DRIVERS\igdpmd64.sys [x]
S3 klflt;Kaspersky Lab Kernel DLL;c:\windows\system32\DRIVERS\klflt.sys;c:\windows\SYSNATIVE\DRIVERS\klflt.sys [x]
S3 klkbdflt;Kaspersky Lab KLKBDFLT;c:\windows\system32\DRIVERS\klkbdflt.sys;c:\windows\SYSNATIVE\DRIVERS\klkbdflt.sys [x]
S3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\DRIVERS\klmouflt.sys;c:\windows\SYSNATIVE\DRIVERS\klmouflt.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\MBAMSwissArmy.sys;c:\windows\SYSNATIVE\drivers\MBAMSwissArmy.sys [x]
S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3hub.sys [x]
S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3xhc.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
S3 SFEP;Sony Firmware Extension Parser;c:\windows\system32\DRIVERS\SFEP.sys;c:\windows\SYSNATIVE\DRIVERS\SFEP.sys [x]
S3 taphss6;Anchorfree HSS VPN Adapter;c:\windows\system32\DRIVERS\taphss6.sys;c:\windows\SYSNATIVE\DRIVERS\taphss6.sys [x]
.
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - MBAMSWISSARMY
.
Contents of the 'Scheduled Tasks' folder
.
2016-02-25 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-08-24 15:35]
.
2016-02-25 c:\windows\Tasks\DropboxUpdateTaskUserS-1-5-21-3448637700-3732790023-3482431723-1000Core.job
- c:\users\LailaMichel\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2015-08-26 04:21]
.
2016-02-25 c:\windows\Tasks\DropboxUpdateTaskUserS-1-5-21-3448637700-3732790023-3482431723-1000UA.job
- c:\users\LailaMichel\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2015-08-26 04:21]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt1"]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2016-02-16 18:37    236352    ----a-w-    c:\users\LailaMichel\AppData\Roaming\Dropbox\bin\DropboxExt64.33.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt2"]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2016-02-16 18:37    236352    ----a-w-    c:\users\LailaMichel\AppData\Roaming\Dropbox\bin\DropboxExt64.33.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt3"]
@="{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}]
2016-02-16 18:37    236352    ----a-w-    c:\users\LailaMichel\AppData\Roaming\Dropbox\bin\DropboxExt64.33.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt4"]
@="{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}]
2016-02-16 18:37    236352    ----a-w-    c:\users\LailaMichel\AppData\Roaming\Dropbox\bin\DropboxExt64.33.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt5"]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2016-02-16 18:37    236352    ----a-w-    c:\users\LailaMichel\AppData\Roaming\Dropbox\bin\DropboxExt64.33.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt6"]
@="{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}]
2016-02-16 18:37    236352    ----a-w-    c:\users\LailaMichel\AppData\Roaming\Dropbox\bin\DropboxExt64.33.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt7"]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2016-02-16 18:37    236352    ----a-w-    c:\users\LailaMichel\AppData\Roaming\Dropbox\bin\DropboxExt64.33.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt8"]
@="{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}]
2016-02-16 18:37    236352    ----a-w-    c:\users\LailaMichel\AppData\Roaming\Dropbox\bin\DropboxExt64.33.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IntelPAN"="c:\program files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" [2011-05-02 1935120]
"Persistence"="c:\windows\system32\igfxpers.exe" [2011-07-12 416024]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-07-12 11490408]
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.com/
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: Add to Anti-Banner - c:\program files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\ie_banner_deny.htm
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\LailaMichel\AppData\Roaming\Mozilla\Firefox\Profiles\z238ncl6.default\
.
- - - - ORPHANS REMOVED - - - -
.
Notify-SDWinLogon - SDWinLogon.dll
HKLM-Run-Apoint - c:\program files (x86)\Apoint\Apoint.exe
AddRemove-Unlocker Packages - c:\users\LailaMichel\AppData\Roaming\0F1L1I1P0H1L1E1E1F\Unlocker Packages\uninstaller.exe
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2016-02-25  22:38:48
ComboFix-quarantined-files.txt  2016-02-25 18:38
.
Pre-Run: 277,020,827,648 bytes free
Post-Run: 276,714,770,432 bytes free
.
- - End Of File - - 7D7A8FF585CEDE4C1F7D0DAF8E387E1B
A36C5E4F47E84449FF07ED3517B43A31
 

 

 

 

# AdwCleaner v5.036 - Logfile created 25/02/2016 at 21:53:35
# Updated 22/02/2016 by Xplode
# Database : 2016-02-24.1 [Server]
# Operating system : Windows 7 Home Premium Service Pack 1 (x64)
# Username : LailaMichel - LAILAMICHEL-PC
# Running from : C:\Users\LailaMichel\Downloads\AdwCleaner.exe
# Option : Scan
# Support : http://toolslib.net/forum

***** [ Services ] *****


***** [ Folders ] *****

Folder Found : C:\Users\LailaMichel\AppData\Roaming\ext
Folder Found : C:\Users\LailaMichel\AppData\Roaming\RHEng

***** [ Files ] *****

File Found : C:\Users\LailaMichel\AppData\Roaming\Mozilla\Firefox\Profiles\z238ncl6.default\invalidprefs.js
File Found : C:\Users\LailaMichel\AppData\Roaming\Mozilla\Firefox\Profiles\z238ncl6.default\user.js

***** [ DLL ] *****


***** [ Shortcuts ] *****


***** [ Scheduled tasks ] *****


***** [ Registry ] *****


***** [ Web browsers ] *****


*************************

C:\AdwCleaner\AdwCleaner[S1].txt - [959 bytes] - [25/02/2016 21:53:35]

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [1031 bytes] ##########
 



#6 mAL_rEm018

mAL_rEm018

  • Malware Response Team
  • 308 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:06:16 PM

Posted 29 February 2016 - 12:39 AM

Hello insaniak,
 

Did you install the following program?

TeamViewer 11

 

You never answered this question.  Please let me know in your next reply.



For some reason none of the logs show the objects it found when scanning.

You did nothing wrong. :)  The timestamp in the MBAM log you provided is 2/25/2016 at 6:21 AM.
 

I found alot of stuff  with malwarebytes,

Did this happen prior to the time/date mentioned above?

We will soon start to "clean" your computer.  I just want to make sure that I have every information necessary before we begin. :)

 

Thank you,

mAL

 


Teacher at the Malware Removal University.

Member of UNITE

 

Failure to post replies within 4 days will result in this thread being closed


#7 insaniak

insaniak
  • Topic Starter

  • Members
  • 198 posts
  • OFFLINE
  •  
  • Local time:10:16 AM

Posted 29 February 2016 - 01:21 AM

I did install teamviewer

 

and i believe it was on the 23 or 24 but i didnt see any logs for those dates.



#8 Oh My!

Oh My!

    Adware and Spyware and Malware.....


  • Malware Response Instructor
  • 37,466 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:07:16 AM

Posted 29 February 2016 - 10:15 PM

Greetings,

I will be stepping in for mAL_rEm018 to assist you with your issues. I would like you to remove 2 programs while we work together, if you have not yet done so.

===================================================

Uninstalling a Program using Add/Remove Program

--------------------

I recommend the uninstalling of the below listed program(s).
  • Press windows key Windows_Logo_key.gif + r on your keyboard at the same time
  • Type appwiz.cpl and press Enter
  • A list of installed programs will be displayed
  • Uninstall the following by clicking on the program(s) below (and any other similar names) and selecting Remove or Uninstall

Spybot
SpyHunter 4

  • Reboot your computer
===================================================

Farbar's Recovery Scan Tool - Run Fix in Normal or Safe Mode

--------------------
  • Press the Windows key Windows_Logo_key.gif + r on your keyboard at the same time. Type in notepad and press Enter
  • Please copy and paste the contents of the below code box into the open notepad and save it to your desktop (<<<Important) as fixlist.txt
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\S-1-5-21-3448637700-3732790023-3482431723-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
Task: {355BE67B-A239-45DB-B915-E118BA22A6A2} - \4CEFD9B73D6C-1CRMOI2 -> No File <==== ATTENTION
emptytemp:
  • Launch FRST and press the Fix button just once and wait, the program will automatically launch fixlist.txt.
  • The tool will create a log on the desktop called Fixlog.txt. Please copy and paste the contents of the file in your reply.
===================================================

Running Firefox in Browser Safe Mode

--------------------
  • Press the windows key Windows_Logo_key.gif + r on your keyboard at the same time
  • Copy and paste the following into the run box and press Enter

firefox --safe-mode

  • Select Start in Safe Mode
  • Please report how Firefox is running
===================================================

Things I would like to see in your next reply. Please be sure to copy and paste any requested log information unless you are asked to attach it. :thumbsup2:
  • Were you able to remove the programs?
  • Fixlog
  • How does Firefox perform in Safe Mode?

Gary
 
If I do not reply within 24 hours please send me a Personal Message.

"May you be richly rewarded by the Lord, the God of Israel, under whose wings you have come to take refuge."

#9 insaniak

insaniak
  • Topic Starter

  • Members
  • 198 posts
  • OFFLINE
  •  
  • Local time:10:16 AM

Posted 02 March 2016 - 11:50 PM

I removed the programs no problems

 

FIrefox does seem to run faster in safe mode thats for sure alot less clunky and more responsive

 

Fix result of Farbar Recovery Scan Tool (x64) Version:02-03-2016
Ran by LailaMichel (2016-03-03 08:41:09) Run:1
Running from C:\Users\LailaMichel\Desktop
Loaded Profiles: LailaMichel (Available Profiles: LailaMichel)
Boot Mode: Normal
==============================================

fixlist content:
*****************
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\S-1-5-21-3448637700-3732790023-3482431723-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
Task: {355BE67B-A239-45DB-B915-E118BA22A6A2} - \4CEFD9B73D6C-1CRMOI2 -> No File <==== ATTENTION
emptytemp:
*****************

HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SDWinLogon => key not found.
"HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer" => key removed successfully
"HKU\S-1-5-21-3448637700-3732790023-3482431723-1000\SOFTWARE\Policies\Microsoft\Internet Explorer" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{355BE67B-A239-45DB-B915-E118BA22A6A2}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{355BE67B-A239-45DB-B915-E118BA22A6A2}" => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\4CEFD9B73D6C-1CRMOI2 => key not found.
EmptyTemp: => 9.4 GB temporary data Removed.


The system needed a reboot.

==== End of Fixlog 08:42:10 ====



#10 Oh My!

Oh My!

    Adware and Spyware and Malware.....


  • Malware Response Instructor
  • 37,466 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:07:16 AM

Posted 03 March 2016 - 09:42 AM

Very good, thank you.

I would like you to start Firefox normally to see if you still have issues. It is possible one or both of the 2 programs you uninstalled may been affecting the browser. If Firefox doesn't run properly then please complete the following steps.

===================================================

Manually Troubleshooting Firefox Add-Ons

-------------------
  • Launch Firefox normally
  • Click Tools, then Add-ons
  • Disable half of the Add-ons, restart Firefox, then check for symptoms
  • If the symptoms remain, disable an additional Add-on, restart Firefox, then check for symptoms. Repeat as necessary
  • If the symptoms disappear after disabling half of the Add-ons, Enable an Add-on, restart Firefox and check for symptoms. Repeat as necessary
  • Report the results in your reply
===================================================

Things I would like to see in your next reply. Please be sure to copy and paste any requested log information unless you are asked to attach it. :thumbsup2:
  • Results?

Gary
 
If I do not reply within 24 hours please send me a Personal Message.

"May you be richly rewarded by the Lord, the God of Israel, under whose wings you have come to take refuge."

#11 insaniak

insaniak
  • Topic Starter

  • Members
  • 198 posts
  • OFFLINE
  •  
  • Local time:10:16 AM

Posted 03 March 2016 - 11:51 AM

I disabled all the add-ons and its still the same issues with firefox



#12 Oh My!

Oh My!

    Adware and Spyware and Malware.....


  • Malware Response Instructor
  • 37,466 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:07:16 AM

Posted 03 March 2016 - 02:59 PM

Can you tell me if Firefox still works properly if you boot the browser into Safe Mode?

Please do this.

===================================================

Determining Firefox Sync Status

-------------------
  • Launch Firefox
  • In the address bar type about:preferences#sync
  • Report what is indicated next to Manage Account under the Firefox Account heading
  • Report whether or not all boxes are checked under Sync across all devices
===================================================

Zoek by Smeenk - Running Commands and Performing a Scan

--------------------
  • Download Zoek and save it to your Desktop
  • Right click the icon, select Run as Admistrator, and wait for the Program to appear on your Desktop (may take 15 seconds or so)
  • Verify Scan All Users is selected
  • Click More Options and place a check mark in the following boxes:

Do a Deep Scan
Auto Clean

  • Click Run Script and wait patiently for the program to run
  • Do not use your computer while the scan is running
  • When completed a zoek-results.txt report will appear on your desktop. You can also locate it in your C:\ directory. Copy and paste the contents in your reply
===================================================

Things I would like to see in your next reply. Please be sure to copy and paste any requested log information unless you are asked to attach it. :thumbsup2:
  • Firefox work in Safe Mode?
  • Firefox sync information
  • Zoek report

Gary
 
If I do not reply within 24 hours please send me a Personal Message.

"May you be richly rewarded by the Lord, the God of Israel, under whose wings you have come to take refuge."

#13 Oh My!

Oh My!

    Adware and Spyware and Malware.....


  • Malware Response Instructor
  • 37,466 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:07:16 AM

Posted 05 March 2016 - 09:49 PM

Greetings,

===================================================

3 Day Bump

It has been more than 3 days since my last post.
  • Do you still need help with this?
  • If after 48hrs you have not replied to this thread then it will have to be closed.

Gary
 
If I do not reply within 24 hours please send me a Personal Message.

"May you be richly rewarded by the Lord, the God of Israel, under whose wings you have come to take refuge."

#14 insaniak

insaniak
  • Topic Starter

  • Members
  • 198 posts
  • OFFLINE
  •  
  • Local time:10:16 AM

Posted 06 March 2016 - 01:46 AM

I still need help

 

There was nothing synced in firefox and nothing check it said I had to create an account

 

No Log from Zoek came up when I scanned it



#15 Oh My!

Oh My!

    Adware and Spyware and Malware.....


  • Malware Response Instructor
  • 37,466 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:07:16 AM

Posted 06 March 2016 - 09:49 AM

Can you tell me if Firefox still works properly if you boot the browser into Safe Mode?

 

For the Zoek log look for something like C:\zoek-results2016......


Gary
 
If I do not reply within 24 hours please send me a Personal Message.

"May you be richly rewarded by the Lord, the God of Israel, under whose wings you have come to take refuge."




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users