Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Browser hijack, constant redirects, multiple unknown programs installed


  • This topic is locked This topic is locked
6 replies to this topic

#1 Spriz89

Spriz89

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:09:10 AM

Posted 01 April 2016 - 03:44 PM

After someone tried downloading a codec for a movie downloaded with utorrent multiple useless programs/adware was installed. When opening chrome (or any browser) the default search engine is changed and clicking on any button redirects to various sites (button meaning forward, back, new tab etc.)

I uninstalled everything that was not needed, ran multiple programs both in safe mode and normal (programs include: hijackthis, adaware, MBAM, MBAR, TDSSKiller, RKill, SUPERAntiSpyware).

As of now things seem to be fine but I am not sure if my system is completely clean or not.

The Addition log and FRST logs I am posting are logs from after everything I did on my own. In other words they are current and nothing has been done since.

FRST Log

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:05-03-2016 01
Ran by Marylin (administrator) on MARYLIN-PC (01-04-2016 01:46:10)
Running from C:\Users\Marylin\Desktop
Loaded Profiles: Marylin (Available Profiles: Marylin)
Platform: Microsoft Windows 7 Ultimate Service Pack 1 (X86) Language: English (United States)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Malwarebytes) C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe
(Malwarebytes) C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe
(Malwarebytes) C:\Program Files\Malwarebytes Anti-Malware\mbam.exe
(Secunia) C:\Program Files\Secunia\PSI\psi_tray.exe
(Secunia) C:\Program Files\Secunia\PSI\psia.exe
(Secunia) C:\Program Files\Secunia\PSI\sua.exe
(SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCore.exe
(SUPERAntiSpyware) C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe


==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKU\S-1-5-21-4123228527-1891097784-1595506361-1000\...\Run: [SUPERAntiSpyware] => C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [6825888 2016-02-29] (SUPERAntiSpyware)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk [2016-03-31]
ShortcutTarget: Secunia PSI Tray.lnk -> C:\Program Files\Secunia\PSI\psi_tray.exe (Secunia)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [122128 2015-08-12] (Apple Inc.)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 75.75.75.75 75.75.76.76
Tcpip\..\Interfaces\{758DC421-E592-4795-8C30-2591A71F2B33}: [DhcpNameServer] 75.75.75.75 75.75.76.76
Tcpip\..\Interfaces\{F4D71AFB-E884-4996-9771-C568EAF6B875}: [DhcpNameServer] 172.20.10.1

Internet Explorer:
==================
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction disabled [No File]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-12] ( Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-03-25] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-03-25] (Google Inc.)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2015-12-18] (Adobe Systems Inc.)

Chrome:
=======
CHR HomePage: Profile 2 -> hxxp://%66%65%65%64.%73%6E%61%70%64%6F.%63%6F%6D/?p=mKO_AwFzXIpYRYEqQao2TxTGptbOxpBNf02kLCqe19CEfHQritkTECO9PyYX_KM7hR61HvUEuynKaYC7ADAWAFbDywv-8AXRpCL8Z7yKACXYleNWYkyq4m6S9Q5Sk_4kX4DQIyaO4hk5er-BPagzMZagc6G2jK_HJyN0V2RNvmJcca4bDFwja86JrA6iAhWjOcXAtWUCoYA,
CHR StartupUrls: Profile 2 -> "hxxp://google.com/"
CHR Profile: C:\Users\Marylin\AppData\Local\Google\Chrome\User Data\Default
CHR Profile: C:\Users\Marylin\AppData\Local\Google\Chrome\User Data\Profile 2
CHR Extension: (Google Drive) - C:\Users\Marylin\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-03-23]
CHR Extension: (YouTube) - C:\Users\Marylin\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-03-23]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Marylin\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-03-23]
CHR Extension: (Gmail) - C:\Users\Marylin\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-03-23]

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE.EXE [142648 2014-07-22] (SUPERAntiSpyware.com)
S4 CLPSLauncher; C:\Program Files\Common Files\COMODO\launcher_service.exe [78384 2016-02-08] (Comodo Security Solutions, Inc.)
S4 GeekBuddyRSP; C:\Program Files\Common Files\COMODO\GeekBuddyRSP.exe [2486832 2016-02-08] (Comodo Security Solutions, Inc.)
R2 MBAMScheduler; C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe [1514464 2016-03-10] (Malwarebytes)
R2 MBAMService; C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe [1136608 2016-03-10] (Malwarebytes)
R2 Secunia PSI Agent; C:\Program Files\Secunia\PSI\PSIA.exe [1570520 2016-02-02] (Secunia)
R2 Secunia Update Agent; C:\Program Files\Secunia\PSI\sua.exe [837848 2016-02-02] (Secunia)
S4 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-26] (Microsoft Corporation)
S4 BitTorrent; "C:\Program Files\BitTorrent\BitTorrent.exe" /s iid=5760379 did=APSnapdoAMRev sid=3 ref=6829e0ab-840d-ead6-cdec-d440babe59e9-PolicyMac id=70a37232d2b892016d4ca6104a8b2fcd8372a029bc5fd0b99483df74ca8197fb [X]
S4 Getfexi; "C:\Users\Marylin\AppData\Roaming\YvihnoEol\Laheno.exe" -cms [X]

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 asmthub3; C:\Windows\system32\drivers\asmthub3.sys [110920 2012-11-08] (ASMedia Technology Inc)
S3 asmtxhci; C:\Windows\system32\drivers\asmtxhci.sys [333128 2012-11-08] (ASMedia Technology Inc)
S3 EtronHub3; C:\Windows\System32\Drivers\EtronHub3.sys [65152 2012-07-24] (Etron Technology Inc)
S3 EtronSTOR; C:\Windows\System32\Drivers\EtronSTOR.sys [32512 2012-07-24] (Etron Technology Inc)
S3 EtronXHCI; C:\Windows\System32\Drivers\EtronXHCI.sys [88832 2012-07-24] (Etron Technology Inc)
S3 iusb3hub; C:\Windows\system32\drivers\iusb3hub.sys [359560 2012-12-20] (Intel Corporation)
S3 iusb3xhc; C:\Windows\system32\drivers\iusb3xhc.sys [792712 2012-12-20] (Intel Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [24448 2016-03-10] (Malwarebytes)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [170200 2016-04-01] (Malwarebytes)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [53120 2016-03-10] (Malwarebytes Corporation)
S3 nusb3hub; C:\Windows\system32\drivers\nusb3hub.sys [73984 2011-10-25] (Renesas Electronics Corporation)
S3 nusb3xhc; C:\Windows\system32\drivers\nusb3xhc.sys [165120 2011-10-25] (Renesas Electronics Corporation)
R3 PSI; C:\Windows\System32\DRIVERS\psi_mf_x86.sys [16024 2016-02-02] (Secunia)
R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS [12880 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS [67664 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
U0 yttq; C:\Windows\System32\drivers\svwemgnx.sys [52440 2016-03-31] (Malwarebytes)
S3 avchv; system32\DRIVERS\avchv.sys [X]
R4 gzflt; \??\C:\Program Files\Lavasoft\Ad-Aware Antivirus\Antimalware Engine\3.0.99.0\gzflt.sys [X]
S0 MPCBase; System32\drivers\MPCBase.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-04-01 00:50 - 2016-04-01 00:50 - 00000017 _____ C:\ProgramData\adaware-installer-reboot-required.tmp
2016-03-31 23:54 - 2016-03-31 23:54 - 00000000 ____D C:\SUPERDelete
2016-03-31 23:48 - 2016-03-31 23:48 - 00000514 _____ C:\Windows\Tasks\SUPERAntiSpyware Scheduled Task d991d341-7736-400e-88aa-19e1e72fb24f.job
2016-03-31 23:48 - 2016-03-31 23:48 - 00000514 _____ C:\Windows\Tasks\SUPERAntiSpyware Scheduled Task 14f628af-f8bd-44ec-bf7f-5c97d4535483.job
2016-03-31 23:47 - 2016-03-31 23:47 - 00001965 _____ C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
2016-03-31 23:47 - 2016-03-31 23:47 - 00000000 ____D C:\Users\Marylin\AppData\Roaming\SUPERAntiSpyware.com
2016-03-31 23:47 - 2016-03-31 23:47 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware
2016-03-31 23:46 - 2016-03-31 23:47 - 00000000 ____D C:\Program Files\SUPERAntiSpyware
2016-03-31 23:46 - 2016-03-31 23:46 - 00000000 ____D C:\ProgramData\SUPERAntiSpyware.com
2016-03-31 23:42 - 2016-03-31 23:46 - 00400300 _____ C:\TDSSKiller.3.1.0.9_31.03.2016_23.42.36_log.txt
2016-03-31 23:42 - 2016-03-31 23:42 - 00052440 _____ (Malwarebytes) C:\Windows\system32\Drivers\svwemgnx.sys
2016-03-31 20:24 - 2016-03-31 21:33 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2016-03-31 20:22 - 2016-03-31 21:22 - 00000000 ____D C:\Users\Marylin\Desktop\mbar
2016-03-31 20:20 - 2016-03-31 20:21 - 00201578 _____ C:\TDSSKiller.3.1.0.9_31.03.2016_20.20.16_log.txt
2016-03-31 20:14 - 2016-03-31 20:14 - 00028739 _____ C:\Users\Marylin\Desktop\Addition.txt
2016-03-31 20:12 - 2016-04-01 01:46 - 00008790 _____ C:\Users\Marylin\Desktop\FRST.txt
2016-03-31 20:12 - 2016-04-01 01:46 - 00000000 ____D C:\FRST
2016-03-31 20:11 - 2016-03-31 20:12 - 04727984 _____ (Kaspersky Lab ZAO) C:\Users\Marylin\Desktop\tdsskiller.exe
2016-03-31 20:10 - 2016-03-31 20:10 - 01725440 _____ (Farbar) C:\Users\Marylin\Desktop\FRST.exe
2016-03-31 19:59 - 2016-03-31 19:59 - 00001031 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Secunia PSI.lnk
2016-03-31 19:59 - 2016-03-31 19:59 - 00000000 ____D C:\Program Files\Secunia
2016-03-31 19:57 - 2016-03-31 19:57 - 04002104 _____ (Secunia) C:\Users\Marylin\Desktop\PSISetup.exe
2016-03-31 19:52 - 2016-03-31 19:56 - 25203560 _____ (SUPERAntiSpyware) C:\Users\Marylin\Desktop\SUPERAntiSpyware.exe
2016-03-31 19:51 - 2016-03-31 19:55 - 16563352 _____ (Malwarebytes Corp.) C:\Users\Marylin\Desktop\mbar-1.09.3.1001.exe
2016-03-29 01:22 - 2016-03-29 01:22 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2016-03-29 01:20 - 2016-04-01 01:12 - 00170200 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2016-03-29 01:19 - 2016-03-31 20:22 - 00094936 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamchameleon.sys
2016-03-29 01:19 - 2016-03-29 01:54 - 00001064 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2016-03-29 01:19 - 2016-03-29 01:22 - 00000000 ____D C:\Program Files\Malwarebytes Anti-Malware
2016-03-29 01:19 - 2016-03-29 01:19 - 00000000 ____D C:\ProgramData\Malwarebytes
2016-03-29 01:19 - 2016-03-10 14:09 - 00053120 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2016-03-29 01:19 - 2016-03-10 14:08 - 00024448 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys
2016-03-29 01:16 - 2016-03-29 01:17 - 22908888 _____ (Malwarebytes ) C:\Users\Marylin\Desktop\mbam-setup-bc.1878-2.2.0.1024.exe
2016-03-29 01:08 - 2016-04-01 01:01 - 00002970 _____ C:\Users\Marylin\Desktop\Rkill.txt
2016-03-29 01:08 - 2016-03-29 01:08 - 02032072 _____ (Bleeping Computer, LLC) C:\Users\Marylin\Desktop\rkill.com
2016-03-29 00:23 - 2016-03-29 00:23 - 00307075 _____ C:\Users\Marylin\Desktop\HijackThis.zip
2016-03-25 23:24 - 2016-03-31 19:28 - 00000000 ____D C:\Users\Marylin\Desktop\backups
2016-03-25 23:08 - 2016-03-29 01:18 - 00002444 _____ C:\Users\Marylin\Desktop\hijackthis log.txt
2016-03-25 01:44 - 2016-03-25 23:20 - 00000000 ____D C:\Users\Marylin\Downloads\backups
2016-03-25 01:40 - 2016-03-25 01:40 - 00388608 _____ (Trend Micro Inc.) C:\Users\Marylin\Desktop\HijackThis.exe
2016-03-25 01:32 - 2016-03-30 12:39 - 00002141 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2016-03-25 01:32 - 2016-03-30 12:39 - 00002129 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2016-03-25 01:30 - 2016-04-01 01:35 - 00000888 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2016-03-25 01:30 - 2016-04-01 01:35 - 00000884 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2016-03-25 01:23 - 2016-03-25 01:23 - 00000000 ____D C:\Windows\system32\appmgmt
2016-03-24 00:29 - 2016-03-24 00:29 - 00000000 ____D C:\Program Files\assimilates
2016-03-23 22:42 - 2016-03-23 22:42 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_avchv_01009.Wdf
2016-03-23 22:14 - 2016-03-23 22:14 - 00000000 ____D C:\Intel
2016-03-23 22:03 - 2016-03-23 22:03 - 00000000 ____D C:\Users\Marylin\AppData\Local\ElevatedDiagnostics
2016-03-23 22:02 - 2016-03-23 22:02 - 02085168 _____ C:\Users\Marylin\Downloads\Adaware_Installer (1).exe
2016-03-23 21:54 - 2016-03-31 21:33 - 00512440 _____ C:\Windows\ntbtlog.txt
2016-03-23 21:44 - 2016-03-23 21:44 - 00000000 ____D C:\Windows\system32\databases-incognito
2016-03-23 21:43 - 2016-03-23 21:43 - 00000000 ____D C:\Users\Marylin\AppData\Roaming\Macromedia
2016-03-22 20:11 - 2016-03-22 20:11 - 00000000 ____D C:\Program Files\Lavasoft
2016-03-22 20:04 - 2016-03-22 20:04 - 00000000 ____D C:\Program Files\Common Files\Lavasoft
2016-03-22 19:59 - 2016-03-22 19:59 - 02085168 _____ C:\Users\Marylin\Downloads\Adaware_Installer.exe
2016-03-22 19:35 - 2016-03-22 19:42 - 00000000 ____D C:\Windows\system32\biup
2016-03-22 19:35 - 2016-03-22 19:35 - 00000000 ____D C:\Windows\system32\qidx
2016-03-22 19:15 - 2016-03-29 01:47 - 00000000 ____D C:\ProgramData\sulpnar
2016-03-22 19:15 - 2016-03-25 00:58 - 00000000 ____D C:\Program Files\Common Files\50lx1wp4
2016-03-22 17:16 - 2016-03-29 01:47 - 00000000 ____D C:\Users\Marylin\AppData\Roaming\Icuceeagis
2016-03-22 17:16 - 2016-03-24 00:55 - 00000000 ____D C:\Users\Marylin\AppData\Roaming\DorpHiraf
2016-03-22 17:15 - 2016-03-25 00:58 - 00000000 ____D C:\Program Files\Common Files\rbqhoetq
2016-03-22 02:35 - 2016-03-22 02:35 - 00000000 ____D C:\Users\Marylin\AppData\Roaming\c
2016-03-22 02:18 - 2016-03-22 02:18 - 00000000 __RSH C:\MSDOS.SYS
2016-03-22 02:18 - 2016-03-22 02:18 - 00000000 __RSH C:\IO.SYS
2016-03-22 01:54 - 2016-03-29 01:48 - 00000000 ____D C:\Users\Marylin\AppData\LocalLow\Company
2016-03-22 01:54 - 2016-03-22 01:54 - 00000055 _____ C:\Windows\key.ini
2016-03-22 01:54 - 2016-03-22 01:54 - 00000000 ____D C:\uninst
2016-03-22 01:53 - 2016-03-29 01:47 - 00000000 ____D C:\Users\Marylin\AppData\Roaming\Qelqa
2016-03-22 01:53 - 2016-03-22 17:17 - 00000000 ____D C:\Users\Marylin\AppData\Local\Tempfolder
2016-03-22 01:52 - 2016-03-22 01:52 - 00000014 _____ C:\Users\Marylin\AppData\Local\74597490.txt
2016-03-22 01:48 - 2016-03-22 01:48 - 00000000 ____D C:\Users\Marylin\AppData\Roaming\Mozilla
2016-03-22 01:46 - 2016-03-23 22:24 - 00000000 ____D C:\Program Files\Common Files\COMODO
2016-03-22 01:46 - 2016-03-22 19:42 - 00000000 ___HD C:\ProgramData\ldi
2016-03-22 01:45 - 2016-03-22 01:45 - 06493696 _____ C:\Users\Marylin\AppData\Roaming\agent.dat
2016-03-22 01:45 - 2016-03-22 01:45 - 01622132 _____ C:\Users\Marylin\AppData\Roaming\Jaydax.tst
2016-03-22 01:45 - 2016-03-22 01:45 - 00018432 _____ C:\Users\Marylin\AppData\Roaming\Main.dat
2016-03-22 01:44 - 2016-03-22 18:19 - 00000000 ____D C:\Users\Marylin\AppData\Roaming\WTools
2016-03-22 01:44 - 2016-03-22 01:44 - 00072707 _____ C:\Users\Marylin\AppData\Roaming\Span-Phase.tst
2016-03-22 01:43 - 2016-03-22 18:17 - 00000000 ____D C:\Users\Marylin\AppData\Roaming\Store
2016-03-22 01:42 - 2016-03-22 01:42 - 00631808 _____ C:\Windows\ldi.dat
2016-03-22 01:41 - 2016-03-22 01:41 - 00127488 _____ C:\Users\Marylin\AppData\Roaming\Installer.dat
2016-03-22 01:40 - 2016-04-01 01:45 - 00000346 ____H C:\Windows\Tasks\QYLDYCSFYANFTLRJ.job
2016-03-22 01:39 - 2016-03-23 22:39 - 00000000 ____D C:\Users\Marylin\AppData\Local\Setup Wizard
2016-03-22 00:50 - 2016-03-22 00:50 - 00041719 _____ C:\Windows\transcendentalist.exe
2016-03-22 00:50 - 2016-03-22 00:50 - 00009216 _____ (benji) C:\Windows\beets.exe
2016-03-22 00:50 - 2016-03-22 00:50 - 00000019 _____ C:\Windows\system32\6780877.bat
2016-03-21 02:07 - 2016-03-21 02:18 - 00000000 ____D C:\Users\Marylin\Desktop\Happy Gilmore (1996)
2016-03-18 02:42 - 2016-03-18 03:09 - 892068999 _____ C:\Users\Marylin\Desktop\Vinyl.S01E01.HDTV.x264-KILLERS[eztv].mp4
2016-03-17 22:00 - 2016-03-17 22:00 - 00000000 _____ C:\Users\Marylin\AppData\Local\ok223.txt
2016-03-14 02:31 - 2016-03-22 19:42 - 00000000 ____D C:\Users\Marylin\Desktop\[ www.torrenting.com ] - Shark.Tank.S06E05.HDTV.XviD-AFG
2016-03-11 02:26 - 2016-03-11 02:42 - 428405806 _____ C:\Users\Marylin\Desktop\The.Big.Bang.Theory.S09E18.720p.HDTV.X264-DIMENSION[eztv].mkv
2016-03-09 18:32 - 2016-02-09 02:50 - 00021504 _____ (Microsoft Corporation) C:\Windows\system32\seclogon.dll
2016-03-09 18:32 - 2016-02-04 11:41 - 00296448 _____ (Microsoft Corporation) C:\Windows\system32\mfds.dll
2016-03-09 18:32 - 2016-02-04 10:46 - 02387456 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2016-03-09 18:32 - 2016-02-03 10:59 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBSTOR.SYS
2016-03-09 18:31 - 2016-02-12 11:39 - 02956288 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2016-03-09 18:31 - 2016-02-12 11:39 - 00174080 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2016-03-09 18:31 - 2016-02-12 11:26 - 00073728 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2016-03-09 18:31 - 2016-02-12 11:07 - 02062848 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2016-03-09 18:31 - 2016-02-12 11:06 - 00573440 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2016-03-09 18:31 - 2016-02-12 11:05 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2016-03-09 18:31 - 2016-02-12 11:05 - 00093696 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2016-03-09 18:31 - 2016-02-12 11:05 - 00035840 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2016-03-09 18:31 - 2016-02-12 11:05 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2016-03-09 18:31 - 2016-02-12 11:05 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2016-03-09 18:31 - 2016-02-12 11:05 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\wu.upgrade.ps.dll
2016-03-09 18:31 - 2016-02-11 11:44 - 03994560 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2016-03-09 18:31 - 2016-02-11 11:44 - 03938240 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2016-03-09 18:31 - 2016-02-11 11:44 - 00138176 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2016-03-09 18:31 - 2016-02-11 11:44 - 00067520 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2016-03-09 18:31 - 2016-02-11 11:41 - 01310232 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2016-03-09 18:31 - 2016-02-11 11:38 - 00171520 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2016-03-09 18:31 - 2016-02-11 11:38 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2016-03-09 18:31 - 2016-02-11 11:37 - 00654336 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2016-03-09 18:31 - 2016-02-11 11:37 - 00400896 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2016-03-09 18:31 - 2016-02-11 11:37 - 00251392 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2016-03-09 18:31 - 2016-02-11 11:37 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2016-03-09 18:31 - 2016-02-11 11:37 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2016-03-09 18:31 - 2016-02-11 11:37 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2016-03-09 18:31 - 2016-02-11 11:35 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2016-03-09 18:31 - 2016-02-11 11:35 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2016-03-09 18:31 - 2016-02-11 11:35 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2016-03-09 18:31 - 2016-02-11 11:34 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2016-03-09 18:31 - 2016-02-11 11:33 - 01060864 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2016-03-09 18:31 - 2016-02-11 11:33 - 00553472 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2016-03-09 18:31 - 2016-02-11 11:31 - 00038912 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2016-03-09 18:31 - 2016-02-11 11:31 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2016-03-09 18:31 - 2016-02-11 11:30 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2016-03-09 18:31 - 2016-02-11 11:30 - 00642560 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2016-03-09 18:31 - 2016-02-11 11:30 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2016-03-09 18:31 - 2016-02-11 10:43 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2016-03-09 18:31 - 2016-02-11 10:37 - 00262656 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2016-03-09 18:31 - 2016-02-11 10:32 - 00225792 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2016-03-09 18:31 - 2016-02-11 10:32 - 00124416 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2016-03-09 18:31 - 2016-02-11 10:32 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2016-03-09 18:31 - 2016-02-11 10:31 - 00036352 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2016-03-09 18:31 - 2016-02-11 10:30 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2016-03-09 18:31 - 2016-02-11 10:30 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2016-03-09 18:31 - 2016-02-11 10:30 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2016-03-09 18:31 - 2016-02-08 23:10 - 00341200 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2016-03-09 18:31 - 2016-02-08 13:51 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2016-03-09 18:31 - 2016-02-08 13:39 - 00496640 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2016-03-09 18:31 - 2016-02-08 13:38 - 00047616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2016-03-09 18:31 - 2016-02-08 13:32 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2016-03-09 18:31 - 2016-02-08 13:31 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2016-03-09 18:31 - 2016-02-08 13:28 - 00620032 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2016-03-09 18:31 - 2016-02-08 13:28 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2016-03-09 18:31 - 2016-02-08 13:28 - 00102912 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2016-03-09 18:31 - 2016-02-08 13:23 - 00667648 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2016-03-09 18:31 - 2016-02-08 13:20 - 00416256 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2016-03-09 18:31 - 2016-02-08 13:16 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2016-03-09 18:31 - 2016-02-08 13:15 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2016-03-09 18:31 - 2016-02-08 13:10 - 00130048 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2016-03-09 18:31 - 2016-02-08 13:03 - 00230400 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2016-03-09 18:31 - 2016-02-08 13:02 - 00687104 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2016-03-09 18:31 - 2016-02-08 13:02 - 00684032 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2016-03-09 18:31 - 2016-02-08 13:01 - 02050560 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2016-03-09 18:31 - 2016-02-08 12:39 - 01311744 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2016-03-09 18:31 - 2016-02-08 12:38 - 00710144 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2016-03-09 18:31 - 2016-02-03 11:49 - 00572416 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2016-03-09 18:31 - 2016-02-03 11:49 - 00090624 _____ (Microsoft Corporation) C:\Windows\system32\olepro32.dll
2016-03-09 18:31 - 2016-02-03 11:43 - 00067584 _____ (Microsoft Corporation) C:\Windows\system32\asycfilt.dll
2016-03-09 18:30 - 2016-02-08 14:05 - 20352512 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2016-03-09 18:30 - 2016-02-08 13:51 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2016-03-09 18:30 - 2016-02-08 13:39 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2016-03-09 18:30 - 2016-02-08 13:38 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2016-03-09 18:30 - 2016-02-08 13:37 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2016-03-09 18:30 - 2016-02-08 13:34 - 02280448 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2016-03-09 18:30 - 2016-02-08 13:30 - 00476160 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2016-03-09 18:30 - 2016-02-08 13:28 - 00663552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2016-03-09 18:30 - 2016-02-08 13:13 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2016-03-09 18:30 - 2016-02-08 13:12 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2016-03-09 18:30 - 2016-02-08 13:11 - 00279040 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2016-03-09 18:30 - 2016-02-08 13:10 - 04611072 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2016-03-09 18:30 - 2016-02-08 13:02 - 13012480 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2016-03-09 18:30 - 2016-02-08 13:01 - 01155072 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2016-03-09 18:30 - 2016-02-08 12:43 - 02121216 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2016-03-09 18:29 - 2016-02-09 02:51 - 12625408 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2016-03-09 18:29 - 2016-02-09 02:51 - 11411456 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2016-03-09 18:29 - 2016-02-09 02:13 - 00008192 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll
2016-03-09 18:29 - 2016-02-09 02:13 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx
2016-03-09 18:29 - 2016-02-09 02:13 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll
2016-03-09 18:29 - 2016-02-05 11:44 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2016-03-09 18:29 - 2016-02-05 11:44 - 00026112 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2016-03-09 18:29 - 2016-02-05 11:42 - 00010240 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2016-03-09 18:29 - 2016-02-05 10:43 - 00299520 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2016-03-09 18:29 - 2016-02-05 10:43 - 00034304 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2016-03-09 02:38 - 2016-03-09 02:58 - 00000000 ____D C:\Users\Marylin\Desktop\K-PAX (2001)
2016-03-09 02:38 - 2016-03-09 02:38 - 00014172 _____ C:\Users\Marylin\Downloads\-_demonoid.pw_-K_PAX_(2001)_720p_HDTV_x264_650MB_YIFY_10910189.4908 (1).TORRENT
2016-03-09 02:37 - 2016-03-09 02:37 - 00014172 _____ C:\Users\Marylin\Downloads\-_demonoid.pw_-K_PAX_(2001)_720p_HDTV_x264_650MB_YIFY_10910189.4908.TORRENT
2016-03-08 00:50 - 2016-03-08 00:54 - 00000000 ____D C:\Users\Marylin\Desktop\The Pursuit of Happyness (2006)
2016-03-07 02:49 - 2016-03-08 00:50 - 00000000 ____D C:\Users\Marylin\Desktop\[ www.torrenting.com ] - Shark.Tank.S06E02.HDTV.XviD-AFG
2016-03-05 03:43 - 2016-03-05 04:01 - 00000000 ____D C:\Users\Marylin\Desktop\Mortal Kombat (1995)
2016-03-04 02:35 - 2016-03-04 02:40 - 291834345 _____ C:\Users\Marylin\Desktop\Shark.Tank.S07E20.HDTV.x264-UAV[eztv].mp4
2016-03-04 02:34 - 2016-03-04 02:40 - 296675179 _____ C:\Users\Marylin\Desktop\Shark.Tank.S07E19.HDTV.x264-UAV[eztv].mp4
2016-03-03 02:27 - 2016-03-03 02:56 - 281369257 _____ C:\Users\Marylin\Desktop\Shark.Tank.S07E17.HDTV.x264-UAV[eztv].mp4
2016-03-03 02:27 - 2016-03-03 02:50 - 297212639 _____ C:\Users\Marylin\Desktop\Shark.Tank.S07E18.HDTV.x264-UAV[eztv].mp4

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-04-01 01:00 - 2014-03-18 22:20 - 00000000 ____D C:\Program Files\Southpark Stick of Truth
2016-04-01 00:49 - 2009-07-13 19:37 - 00000000 ____D C:\Windows\inf
2016-03-31 23:42 - 2009-07-13 21:52 - 00000000 ____D C:\Windows\Offline Web Pages
2016-03-31 21:44 - 2009-07-13 21:34 - 00026576 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2016-03-31 21:44 - 2009-07-13 21:34 - 00026576 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2016-03-31 21:34 - 2009-07-13 21:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-03-29 01:54 - 2016-01-27 03:48 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2016-03-29 01:54 - 2016-01-27 03:48 - 00002017 _____ C:\Users\Public\Desktop\Acrobat Reader DC.lnk
2016-03-29 01:54 - 2015-10-27 18:25 - 00001753 _____ C:\Users\Public\Desktop\iTunes.lnk
2016-03-29 01:54 - 2015-08-25 02:49 - 00002519 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk
2016-03-29 01:54 - 2014-11-18 01:39 - 00001070 _____ C:\Users\Public\Desktop\OpenOffice 4.1.0.lnk
2016-03-29 01:54 - 2014-07-26 22:42 - 00001151 _____ C:\Users\Public\Desktop\Peggle.lnk
2016-03-29 01:54 - 2014-03-17 23:18 - 00001417 _____ C:\Users\Marylin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2016-03-29 01:54 - 2014-03-17 22:49 - 00001345 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk
2016-03-29 01:54 - 2014-03-17 22:49 - 00001326 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk
2016-03-29 01:54 - 2009-07-13 21:46 - 00001515 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2016-03-29 01:54 - 2009-07-13 21:46 - 00001282 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Default Programs.lnk
2016-03-29 01:54 - 2009-07-13 21:42 - 00001330 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sidebar.lnk
2016-03-29 01:54 - 2009-07-13 21:42 - 00001246 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XPS Viewer.lnk
2016-03-29 01:54 - 2009-07-13 21:42 - 00001210 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Fax and Scan.lnk
2016-03-29 01:54 - 2009-07-13 21:37 - 00001266 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Windows Update.lnk
2016-03-26 00:36 - 2010-11-20 14:01 - 00726316 _____ C:\Windows\system32\PerfStringBackup.INI
2016-03-25 23:21 - 2014-10-05 21:01 - 00000000 ____D C:\Users\Marylin\AppData\Roaming\Skype
2016-03-25 01:32 - 2014-03-17 23:27 - 00000000 ____D C:\Program Files\Google
2016-03-25 01:29 - 2014-03-17 23:27 - 00000000 ____D C:\Users\Marylin\AppData\Local\Deployment
2016-03-23 22:24 - 2015-11-25 14:31 - 00000000 ___RD C:\Program Files\Skype
2016-03-23 22:24 - 2015-10-27 18:24 - 00000000 ____D C:\Program Files\iTunes
2016-03-23 22:24 - 2015-10-27 18:20 - 00000000 ____D C:\Program Files\Bonjour
2016-03-23 22:24 - 2015-10-27 18:14 - 00000000 ____D C:\Program Files\Apple Software Update
2016-03-23 22:24 - 2011-04-11 19:24 - 00000000 ___RD C:\Users\Public\Recorded TV
2016-03-23 22:24 - 2011-04-11 19:24 - 00000000 ____D C:\Program Files\Windows Journal
2016-03-23 22:24 - 2009-07-13 21:52 - 00000000 ____D C:\Program Files\Windows Sidebar
2016-03-23 22:24 - 2009-07-13 21:52 - 00000000 ____D C:\Program Files\Windows Photo Viewer
2016-03-23 22:24 - 2009-07-13 21:52 - 00000000 ____D C:\Program Files\Windows Defender
2016-03-23 22:24 - 2009-07-13 21:52 - 00000000 ____D C:\Program Files\DVD Maker
2016-03-23 22:24 - 2009-07-13 19:37 - 00000000 ____D C:\Windows\system32\Setup
2016-03-23 22:24 - 2009-07-13 19:37 - 00000000 ____D C:\Windows\system32\com
2016-03-23 22:24 - 2009-07-13 19:37 - 00000000 ____D C:\Windows\system32\AdvancedInstallers
2016-03-23 22:24 - 2009-07-13 19:37 - 00000000 ____D C:\Windows\servicing
2016-03-23 22:24 - 2009-07-13 19:37 - 00000000 ____D C:\Windows\registration
2016-03-23 22:23 - 2015-04-30 01:02 - 00000000 ____D C:\Program Files\Canon
2016-03-23 22:11 - 2015-05-08 15:51 - 00000000 ____D C:\Users\Marylin\AppData\Roaming\Canon
2016-03-23 21:38 - 2014-03-17 23:18 - 00000000 ____D C:\Users\Marylin
2016-03-22 19:42 - 2009-07-13 19:37 - 00000000 ____D C:\Windows\system32\NDF
2016-03-22 02:05 - 2009-07-13 19:37 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
2016-03-22 02:02 - 2015-08-25 02:47 - 00000000 ____D C:\Program Files\Common Files\Apple
2016-03-22 02:00 - 2016-01-27 03:47 - 00000000 ____D C:\Program Files\Common Files\Adobe
2016-03-22 01:48 - 2009-07-13 19:04 - 00000505 _____ C:\Windows\win.ini
2016-03-10 23:06 - 2016-02-12 00:08 - 00000000 ____D C:\Windows\rescache
2016-03-10 22:17 - 2009-07-13 21:33 - 00286472 _____ C:\Windows\system32\FNTCACHE.DAT
2016-03-10 20:14 - 2015-06-04 12:07 - 00000000 ____D C:\Windows\system32\MRT
2016-03-10 20:09 - 2014-03-17 23:02 - 141270216 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2016-03-04 20:07 - 2015-08-25 02:51 - 00000000 ____D C:\Users\Marylin\AppData\Roaming\Apple Computer

==================== Files in the root of some directories =======

2016-03-22 01:45 - 2016-03-22 01:45 - 6493696 _____ () C:\Users\Marylin\AppData\Roaming\agent.dat
2016-03-22 01:41 - 2016-03-22 01:41 - 0127488 _____ () C:\Users\Marylin\AppData\Roaming\Installer.dat
2016-03-22 01:45 - 2016-03-22 01:45 - 1622132 _____ () C:\Users\Marylin\AppData\Roaming\Jaydax.tst
2016-03-22 01:45 - 2016-03-22 01:45 - 0018432 _____ () C:\Users\Marylin\AppData\Roaming\Main.dat
2016-03-22 01:44 - 2016-03-22 01:44 - 0072707 _____ () C:\Users\Marylin\AppData\Roaming\Span-Phase.tst
2016-03-22 01:52 - 2016-03-22 01:52 - 0000014 _____ () C:\Users\Marylin\AppData\Local\74597490.txt
2016-03-17 22:00 - 2016-03-17 22:00 - 0000000 _____ () C:\Users\Marylin\AppData\Local\ok223.txt
2016-02-16 11:47 - 2016-02-16 11:47 - 0006656 _____ () C:\Users\Marylin\AppData\Local\tinstall.exe
2016-02-16 11:46 - 2016-02-16 11:46 - 0007168 _____ () C:\Users\Marylin\AppData\Local\tinstall4.exe
2016-04-01 00:50 - 2016-04-01 00:50 - 0000017 _____ () C:\ProgramData\adaware-installer-reboot-required.tmp

Some files in TEMP:
====================
C:\Users\Marylin\AppData\Local\Temp\uninstall.exe


==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2016-03-29 04:19

==================== End of FRST.txt ============================

Attached Files


Edited by Spriz89, 01 April 2016 - 04:01 PM.


BC AdBot (Login to Remove)

 


#2 nasdaq

nasdaq

  • Malware Response Team
  • 38,593 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:12:10 PM

Posted 02 April 2016 - 09:02 AM

Hello, Welcome to BleepingComputer.
I'm nasdaq and will be helping you.

If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed.
===

Windows Defender should be enabled.
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

For your added security I suggest you install Microsoft Security Essentials.
It an upgrade from Windows defender.

Link.
http://windows.microsoft.com/en-CA/windows/security-essentials-download

When install MSE will disable Windows Defender as both cannot run simultaneously.
===


Press the windows key Windows_Logo_key.gif+ r on your keyboard at the same time. This will open the RUN BOX.
Type Notepad and and click the OK key.

Please copy the entire contents of the code box below to a new file.


Start

CreateRestorePoint:
EmptyTemp:
CloseProcesses:

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction disabled [No File]
CHR HomePage: Profile 2 -> hxxp://%66%65%65%64.%73%6E%61%70%64%6F.%63%6F%6D/?p=mKO_AwFzXIpYRYEqQao2TxTGptbOxpBNf02kLCqe19CEfHQritkTECO9PyYX_KM7hR61HvUEuynKaYC7ADAWAFbDywv-8AXRpCL8Z7yKACXYleNWYkyq4m6S9Q5Sk_4kX4DQIyaO4hk5er-BPagzMZagc6G2jK_HJyN0V2RNvmJcca4bDFwja86JrA6iAhWjOcXAtWUCoYA,
CHR Extension: (Chrome Web Store Payments) - C:\Users\Marylin\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-03-23]
S4 BitTorrent; "C:\Program Files\BitTorrent\BitTorrent.exe" /s iid=5760379 did=APSnapdoAMRev sid=3 ref=6829e0ab-840d-ead6-cdec-d440babe59e9-PolicyMac id=70a37232d2b892016d4ca6104a8b2fcd8372a029bc5fd0b99483df74ca8197fb [X]
S4 Getfexi; "C:\Users\Marylin\AppData\Roaming\YvihnoEol\Laheno.exe" -cms [X]
U0 yttq; C:\Windows\System32\drivers\svwemgnx.sys [52440 2016-03-31] (Malwarebytes)
S3 avchv; system32\DRIVERS\avchv.sys [X]
R4 gzflt; \??\C:\Program Files\Lavasoft\Ad-Aware Antivirus\Antimalware Engine\3.0.99.0\gzflt.sys [X]
S0 MPCBase; System32\drivers\MPCBase.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
C:\Users\Marylin\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\nmmhkkegccagdldgiimedpiccmgmieda
C:\Windows\System32\drivers\svwemgnx.sys
C:\ProgramData\Service7609
CustomCLSID: HKU\S-1-5-21-4123228527-1891097784-1595506361-1000_Classes\CLSID\{7c6e29bc-8b8b-4c3d-859e-af6cd158be0f}\InprocServer32 -> %SystemDrive%\Users\Marylin\AppData\Roaming\Microsoft\MSXML2\msxml4.dll => No File
CustomCLSID: HKU\S-1-5-21-4123228527-1891097784-1595506361-1000_Classes\CLSID\{88d969c0-f192-11d4-a65f-0040963251e5}\InprocServer32 -> %SystemDrive%\Users\Marylin\AppData\Roaming\Microsoft\MSXML2\msxml4.dll => No File
CustomCLSID: HKU\S-1-5-21-4123228527-1891097784-1595506361-1000_Classes\CLSID\{88d969c1-f192-11d4-a65f-0040963251e5}\InprocServer32 -> %SystemDrive%\Users\Marylin\AppData\Roaming\Microsoft\MSXML2\msxml4.dll => No File
CustomCLSID: HKU\S-1-5-21-4123228527-1891097784-1595506361-1000_Classes\CLSID\{88d969c2-f192-11d4-a65f-0040963251e5}\InprocServer32 -> %SystemDrive%\Users\Marylin\AppData\Roaming\Microsoft\MSXML2\msxml4.dll => No File
CustomCLSID: HKU\S-1-5-21-4123228527-1891097784-1595506361-1000_Classes\CLSID\{88d969c3-f192-11d4-a65f-0040963251e5}\InprocServer32 -> %SystemDrive%\Users\Marylin\AppData\Roaming\Microsoft\MSXML2\msxml4.dll => No File
CustomCLSID: HKU\S-1-5-21-4123228527-1891097784-1595506361-1000_Classes\CLSID\{88d969c4-f192-11d4-a65f-0040963251e5}\InprocServer32 -> %SystemDrive%\Users\Marylin\AppData\Roaming\Microsoft\MSXML2\msxml4.dll => No File
CustomCLSID: HKU\S-1-5-21-4123228527-1891097784-1595506361-1000_Classes\CLSID\{88d969c5-f192-11d4-a65f-0040963251e5}\InprocServer32 -> %SystemDrive%\Users\Marylin\AppData\Roaming\Microsoft\MSXML2\msxml4.dll => No File
CustomCLSID: HKU\S-1-5-21-4123228527-1891097784-1595506361-1000_Classes\CLSID\{88d969c6-f192-11d4-a65f-0040963251e5}\InprocServer32 -> %SystemDrive%\Users\Marylin\AppData\Roaming\Microsoft\MSXML2\msxml4.dll => No File
CustomCLSID: HKU\S-1-5-21-4123228527-1891097784-1595506361-1000_Classes\CLSID\{88d969c8-f192-11d4-a65f-0040963251e5}\InprocServer32 -> %SystemDrive%\Users\Marylin\AppData\Roaming\Microsoft\MSXML2\msxml4.dll => No File
CustomCLSID: HKU\S-1-5-21-4123228527-1891097784-1595506361-1000_Classes\CLSID\{88d969c9-f192-11d4-a65f-0040963251e5}\InprocServer32 -> %SystemDrive%\Users\Marylin\AppData\Roaming\Microsoft\MSXML2\msxml4.dll => No File
CustomCLSID: HKU\S-1-5-21-4123228527-1891097784-1595506361-1000_Classes\CLSID\{88d969ca-f192-11d4-a65f-0040963251e5}\InprocServer32 -> %SystemDrive%\Users\Marylin\AppData\Roaming\Microsoft\MSXML2\msxml4.dll => No File
CustomCLSID: HKU\S-1-5-21-4123228527-1891097784-1595506361-1000_Classes\CLSID\{88d969d6-f192-11d4-a65f-0040963251e5}\InprocServer32 -> %SystemDrive%\Users\Marylin\AppData\Roaming\Microsoft\MSXML2\msxml4.dll => No File
Task: {3873FCDF-BE8E-4B67-A3A5-5D2D278D4CC6} - \QYLDYCSFYANFTLRJ -> No File <==== ATTENTION
Task: {6D1D464B-DAE9-4891-B791-EB3FB619002E} - \{050E0F47-0B7A-040D-7E11-7E040B091109} -> No File <==== ATTENTION
Task: {721F93BF-8674-4FC9-9D27-11475479BD37} - \ALARM -> No File <==== ATTENTION
Task: {874EF56D-3C5A-40B0-9C3B-C0D41EB0DED9} - \Adobe Acrobat Update Task -> No File <==== ATTENTION
Task: C:\Windows\Tasks\QYLDYCSFYANFTLRJ.job => C:\ProgramData\Service7609\Service7609.exe <==== ATTENTION

End
Save the file as fixlist.txt in the same folder where the Farbar tool is running from.
The location is listed in the 3rd line of the Farbar log you have submitted.

Run FRST and click Fix only once and wait.

Restart the computer normally to reset the registry.

The tool will create a log (Fixlog.txt) please post it to your reply.

Please post the log and let me know what problem persists with this computer.

#3 Spriz89

Spriz89
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:09:10 AM

Posted 03 April 2016 - 03:38 AM

Fix result of Farbar Recovery Scan Tool (x86) Version:05-03-2016 01
Ran by Marylin (2016-04-03 01:31:39) Run:1
Running from C:\Users\Marylin\Desktop\Anitvirus Stuff\FRST
Loaded Profiles: Marylin (Available Profiles: Marylin)
Boot Mode: Normal
 
==============================================
 
fixlist content:
*****************
 
Start
 
CreateRestorePoint:
EmptyTemp:
CloseProcesses:
 
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction disabled [No File]
CHR HomePage: Profile 2 -> hxxp://%66%65%65%64.%73%6E%61%70%64%6F.%63%6F%6D/?p=mKO_AwFzXIpYRYEqQao2TxTGptbOxpBNf02kLCqe19CEfHQritkTECO9PyYX_KM7hR61HvUEuynKaYC7ADAWAFbDywv-8AXRpCL8Z7yKACXYleNWYkyq4m6S9Q5Sk_4kX4DQIyaO4hk5er-BPagzMZagc6G2jK_HJyN0V2RNvmJcca4bDFwja86JrA6iAhWjOcXAtWUCoYA,
CHR Extension: (Chrome Web Store Payments) - C:\Users\Marylin\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-03-23]
S4 BitTorrent; "C:\Program Files\BitTorrent\BitTorrent.exe" /s iid=5760379 did=APSnapdoAMRev sid=3 ref=6829e0ab-840d-ead6-cdec-d440babe59e9-PolicyMac id=70a37232d2b892016d4ca6104a8b2fcd8372a029bc5fd0b99483df74ca8197fb [X]
S4 Getfexi; "C:\Users\Marylin\AppData\Roaming\YvihnoEol\Laheno.exe" -cms [X]
U0 yttq; C:\Windows\System32\drivers\svwemgnx.sys [52440 2016-03-31] (Malwarebytes)
S3 avchv; system32\DRIVERS\avchv.sys [X]
R4 gzflt; \??\C:\Program Files\Lavasoft\Ad-Aware Antivirus\Antimalware Engine\3.0.99.0\gzflt.sys [X]
S0 MPCBase; System32\drivers\MPCBase.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
C:\Users\Marylin\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\nmmhkkegccagdldgiimedpiccmgmieda
C:\Windows\System32\drivers\svwemgnx.sys
C:\ProgramData\Service7609
CustomCLSID: HKU\S-1-5-21-4123228527-1891097784-1595506361-1000_Classes\CLSID\{7c6e29bc-8b8b-4c3d-859e-af6cd158be0f}\InprocServer32 -> %SystemDrive%\Users\Marylin\AppData\Roaming\Microsoft\MSXML2\msxml4.dll => No File
CustomCLSID: HKU\S-1-5-21-4123228527-1891097784-1595506361-1000_Classes\CLSID\{88d969c0-f192-11d4-a65f-0040963251e5}\InprocServer32 -> %SystemDrive%\Users\Marylin\AppData\Roaming\Microsoft\MSXML2\msxml4.dll => No File
CustomCLSID: HKU\S-1-5-21-4123228527-1891097784-1595506361-1000_Classes\CLSID\{88d969c1-f192-11d4-a65f-0040963251e5}\InprocServer32 -> %SystemDrive%\Users\Marylin\AppData\Roaming\Microsoft\MSXML2\msxml4.dll => No File
CustomCLSID: HKU\S-1-5-21-4123228527-1891097784-1595506361-1000_Classes\CLSID\{88d969c2-f192-11d4-a65f-0040963251e5}\InprocServer32 -> %SystemDrive%\Users\Marylin\AppData\Roaming\Microsoft\MSXML2\msxml4.dll => No File
CustomCLSID: HKU\S-1-5-21-4123228527-1891097784-1595506361-1000_Classes\CLSID\{88d969c3-f192-11d4-a65f-0040963251e5}\InprocServer32 -> %SystemDrive%\Users\Marylin\AppData\Roaming\Microsoft\MSXML2\msxml4.dll => No File
CustomCLSID: HKU\S-1-5-21-4123228527-1891097784-1595506361-1000_Classes\CLSID\{88d969c4-f192-11d4-a65f-0040963251e5}\InprocServer32 -> %SystemDrive%\Users\Marylin\AppData\Roaming\Microsoft\MSXML2\msxml4.dll => No File
CustomCLSID: HKU\S-1-5-21-4123228527-1891097784-1595506361-1000_Classes\CLSID\{88d969c5-f192-11d4-a65f-0040963251e5}\InprocServer32 -> %SystemDrive%\Users\Marylin\AppData\Roaming\Microsoft\MSXML2\msxml4.dll => No File
CustomCLSID: HKU\S-1-5-21-4123228527-1891097784-1595506361-1000_Classes\CLSID\{88d969c6-f192-11d4-a65f-0040963251e5}\InprocServer32 -> %SystemDrive%\Users\Marylin\AppData\Roaming\Microsoft\MSXML2\msxml4.dll => No File
CustomCLSID: HKU\S-1-5-21-4123228527-1891097784-1595506361-1000_Classes\CLSID\{88d969c8-f192-11d4-a65f-0040963251e5}\InprocServer32 -> %SystemDrive%\Users\Marylin\AppData\Roaming\Microsoft\MSXML2\msxml4.dll => No File
CustomCLSID: HKU\S-1-5-21-4123228527-1891097784-1595506361-1000_Classes\CLSID\{88d969c9-f192-11d4-a65f-0040963251e5}\InprocServer32 -> %SystemDrive%\Users\Marylin\AppData\Roaming\Microsoft\MSXML2\msxml4.dll => No File
CustomCLSID: HKU\S-1-5-21-4123228527-1891097784-1595506361-1000_Classes\CLSID\{88d969ca-f192-11d4-a65f-0040963251e5}\InprocServer32 -> %SystemDrive%\Users\Marylin\AppData\Roaming\Microsoft\MSXML2\msxml4.dll => No File
CustomCLSID: HKU\S-1-5-21-4123228527-1891097784-1595506361-1000_Classes\CLSID\{88d969d6-f192-11d4-a65f-0040963251e5}\InprocServer32 -> %SystemDrive%\Users\Marylin\AppData\Roaming\Microsoft\MSXML2\msxml4.dll => No File
Task: {3873FCDF-BE8E-4B67-A3A5-5D2D278D4CC6} - \QYLDYCSFYANFTLRJ -> No File <==== ATTENTION
Task: {6D1D464B-DAE9-4891-B791-EB3FB619002E} - \{050E0F47-0B7A-040D-7E11-7E040B091109} -> No File <==== ATTENTION
Task: {721F93BF-8674-4FC9-9D27-11475479BD37} - \ALARM -> No File <==== ATTENTION
Task: {874EF56D-3C5A-40B0-9C3B-C0D41EB0DED9} - \Adobe Acrobat Update Task -> No File <==== ATTENTION
Task: C:\Windows\Tasks\QYLDYCSFYANFTLRJ.job => C:\ProgramData\Service7609\Service7609.exe <==== ATTENTION
 
End
*****************
 
Restore point was successfully created.
Processes closed successfully.
"HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer" => key removed successfully.
Chrome HomePage => removed successfully.
C:\Users\Marylin\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\nmmhkkegccagdldgiimedpiccmgmieda => not found.
BitTorrent => service removed successfully.
Getfexi => service removed successfully.
yttq => service not found.
avchv => service removed successfully.
gzflt => service not found.
MPCBase => service removed successfully.
VGPU => service removed successfully.
"C:\Users\Marylin\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\nmmhkkegccagdldgiimedpiccmgmieda" => not found.
"C:\Windows\System32\drivers\svwemgnx.sys" => not found.
"C:\ProgramData\Service7609" => not found.
"HKU\S-1-5-21-4123228527-1891097784-1595506361-1000_Classes\CLSID\{7c6e29bc-8b8b-4c3d-859e-af6cd158be0f}" => key removed successfully.
"HKU\S-1-5-21-4123228527-1891097784-1595506361-1000_Classes\CLSID\{88d969c0-f192-11d4-a65f-0040963251e5}" => key removed successfully.
"HKU\S-1-5-21-4123228527-1891097784-1595506361-1000_Classes\CLSID\{88d969c1-f192-11d4-a65f-0040963251e5}" => key removed successfully.
"HKU\S-1-5-21-4123228527-1891097784-1595506361-1000_Classes\CLSID\{88d969c2-f192-11d4-a65f-0040963251e5}" => key removed successfully.
"HKU\S-1-5-21-4123228527-1891097784-1595506361-1000_Classes\CLSID\{88d969c3-f192-11d4-a65f-0040963251e5}" => key removed successfully.
"HKU\S-1-5-21-4123228527-1891097784-1595506361-1000_Classes\CLSID\{88d969c4-f192-11d4-a65f-0040963251e5}" => key removed successfully.
"HKU\S-1-5-21-4123228527-1891097784-1595506361-1000_Classes\CLSID\{88d969c5-f192-11d4-a65f-0040963251e5}" => key removed successfully.
"HKU\S-1-5-21-4123228527-1891097784-1595506361-1000_Classes\CLSID\{88d969c6-f192-11d4-a65f-0040963251e5}" => key removed successfully.
"HKU\S-1-5-21-4123228527-1891097784-1595506361-1000_Classes\CLSID\{88d969c8-f192-11d4-a65f-0040963251e5}" => key removed successfully.
"HKU\S-1-5-21-4123228527-1891097784-1595506361-1000_Classes\CLSID\{88d969c9-f192-11d4-a65f-0040963251e5}" => key removed successfully.
"HKU\S-1-5-21-4123228527-1891097784-1595506361-1000_Classes\CLSID\{88d969ca-f192-11d4-a65f-0040963251e5}" => key removed successfully.
"HKU\S-1-5-21-4123228527-1891097784-1595506361-1000_Classes\CLSID\{88d969d6-f192-11d4-a65f-0040963251e5}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{3873FCDF-BE8E-4B67-A3A5-5D2D278D4CC6}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3873FCDF-BE8E-4B67-A3A5-5D2D278D4CC6}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\QYLDYCSFYANFTLRJ" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{6D1D464B-DAE9-4891-B791-EB3FB619002E}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{6D1D464B-DAE9-4891-B791-EB3FB619002E}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{050E0F47-0B7A-040D-7E11-7E040B091109}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{721F93BF-8674-4FC9-9D27-11475479BD37}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{721F93BF-8674-4FC9-9D27-11475479BD37}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\ALARM" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{874EF56D-3C5A-40B0-9C3B-C0D41EB0DED9}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{874EF56D-3C5A-40B0-9C3B-C0D41EB0DED9}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Adobe Acrobat Update Task" => key removed successfully.
C:\Windows\Tasks\QYLDYCSFYANFTLRJ.job => moved successfully
EmptyTemp: => 381.8 MB temporary data Removed.
 
 
The system needed a reboot.
 
==== End of Fixlog 01:32:21 ====


#4 nasdaq

nasdaq

  • Malware Response Team
  • 38,593 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:12:10 PM

Posted 03 April 2016 - 07:39 AM

How is the computer running now?

#5 Spriz89

Spriz89
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:09:10 AM

Posted 03 April 2016 - 01:35 PM

Well previously when I made attempts on my own it seemed fine but after a short time something would go wrong, meaning for a few hours browser worked great and then one pop up or redirect led to 50 more which lead to all sorts of adware and whatnot..

Anyway, as of now everything is functioning properly. I will post an update at the end of the day.

Thank you.

#6 nasdaq

nasdaq

  • Malware Response Team
  • 38,593 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:12:10 PM

Posted 04 April 2016 - 06:35 AM

If all is well.

To learn more about how to protect yourself while on the internet read this little guide best security practices keep safe.
http://www.bleepingcomputer.com/forums/t/407147/answers-to-common-security-questions-best-practices/

#7 nasdaq

nasdaq

  • Malware Response Team
  • 38,593 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:12:10 PM

Posted 10 April 2016 - 07:30 AM

It appears that this issue is resolved, therefore I am closing the topic. If that is not the case and you need or wish to continue with this topic, please send me or any Moderator a Personal Message (PM) that you would like this topic re-opened.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users