Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Slow PC on start-up 3


  • Please log in to reply
8 replies to this topic

#1 SociallyAwkward

SociallyAwkward

  • Members
  • 72 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:South Africa
  • Local time:02:04 AM

Posted 13 January 2017 - 01:55 AM

So I've made two topics below about a slow PC, which is slow for around 3-5 mins and then runs fine. Emmisoft and Malwarebytes found some malware and i want to be sure that i am totally disinfected. I was advised to start a new topic here and post two logs.

 

topic 1 : https://www.bleepingcomputer.com/forums/t/637088/slow-pc-on-start-up/?view=getnewpost

 

topic 2 : https://www.bleepingcomputer.com/forums/t/637112/slow-pc-on-start-up-2/

 

 

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 12-01-2017
Ran by Mikey (administrator) on MIKEY-PC (13-01-2017 08:35:07)
Running from C:\Users\Mikey\Downloads
Loaded Profiles: Mikey (Available Profiles: Mikey)
Platform: Windows 7 Ultimate Service Pack 1 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
 
==================== Processes (Whitelisted) =================
 
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Bitdefender) C:\Program Files\Bitdefender\Bitdefender Device Management\DevMgmtService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Emsisoft Ltd) C:\Program Files\Emsisoft Anti-Malware\a2service.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\afwServ.exe
(Qualcomm Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AdminService.exe
(Intel® Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
() C:\Program Files\Intel\Intel® Smart Connect Technology Agent\iSCTAgent.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\Jhi_service.exe
() C:\Program Files (x86)\MSI\OTPService\OTPService.exe
(Emsisoft Ltd) C:\Program Files\Emsisoft Anti-Malware\a2guard.exe
(MSI) C:\Program Files (x86)\MSI\Super-Charger\ChargeService.exe
(Bitdefender) C:\Program Files\Bitdefender Agent\ProductAgentService.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.32.7\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.32.7\GoogleCrashHandler64.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(Emsisoft Ltd) C:\Program Files\Emsisoft Anti-Malware\a2start.exe
(Vodafone) C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\VmbService.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\alg.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\CompatTelRunner.exe
(Microsoft Corporation) C:\Windows\System32\CompatTelRunner.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
 
==================== Registry (Whitelisted) ====================
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 
HKLM\...\Run: [emsisoft anti-malware] => c:\program files\emsisoft anti-malware\a2guard.exe [8140696 2017-01-12] (Emsisoft Ltd)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [9080768 2017-01-02] (AVAST Software)
HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
HKU\S-1-5-21-2014530170-318503234-4003923440-1000\...\Policies\Explorer: [NoInternetOpenWith] 1
HKU\S-1-5-21-2014530170-318503234-4003923440-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\scrnsave.scr [11264 2009-07-14] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2017-01-02] (AVAST Software)
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
 
==================== Internet (Whitelisted) ====================
 
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{11660182-55F6-41EC-A38C-009FD2B3E790}: [DhcpNameServer] 192.168.9.1 192.168.9.1
Tcpip\..\Interfaces\{2230F4F5-E5D0-4365-8907-C1304079E6BE}: [NameServer] 77.234.40.79
Tcpip\..\Interfaces\{F0DDDCCC-6802-4A28-A68A-FDCA500E07E7}: [DhcpNameServer] 192.168.0.1
 
Internet Explorer:
==================
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\S-1-5-21-2014530170-318503234-4003923440-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = 
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-2014530170-318503234-4003923440-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-2014530170-318503234-4003923440-1000\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
SearchScopes: HKU\S-1-5-21-2014530170-318503234-4003923440-1000 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.co.za/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7MSIM_enZA610
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office15\OCHelper.dll [2016-02-09] (Microsoft Corporation)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2017-01-02] (AVAST Software)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL [2014-01-23] (Microsoft Corporation)
BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll [2016-02-09] (Microsoft Corporation)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2017-01-02] (AVAST Software)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL [2014-01-22] (Microsoft Corporation)
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL [2014-04-01] (Microsoft Corporation)
Handler: tmbp - {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\Module\20002\7.5.1137\7.5.1137\TmBpIe32.dll No File
Handler: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\Module\20004\2.5.1331\6.8.1094\TmIEPlg32.dll No File
 
FireFox:
========
FF HKLM\...\Firefox\Extensions: [tmbepff-7.5@trendmicro.com] - C:\Program Files\Trend Micro\AMSP\Module\20002\7.5.1137\7.5.1137\firefoxextension => not found
FF HKLM\...\Firefox\Extensions: [sp@avast.com] - C:\Program Files\AVAST Software\Avast\SafePrice\FF
FF Extension: (Avast SafePrice) - C:\Program Files\AVAST Software\Avast\SafePrice\FF [2017-01-02]
FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: (Avast Online Security) - C:\Program Files\AVAST Software\Avast\WebRep\FF [2017-01-02]
FF HKLM-x32\...\Firefox\Extensions: [tmbepff-7.5@trendmicro.com] - C:\Program Files\Trend Micro\AMSP\Module\20002\7.5.1137\7.5.1137\firefoxextension => not found
FF HKLM-x32\...\Firefox\Extensions: [{22C7F6C6-8D67-4534-92B5-529A0EC09405}] - C:\Program Files\Trend Micro\AMSP\module\20004\FxExt\firefoxextension => not found
FF HKLM-x32\...\Firefox\Extensions: [sp@avast.com] - C:\Program Files\AVAST Software\Avast\SafePrice\FF
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~2\Office15\NPSPWRAP.DLL [2014-01-23] (Microsoft Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll [2012-06-06] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2012-06-06] (Intel Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2016-03-15] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL [2014-01-22] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-17] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-17] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.2.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.2.4 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2016-12-23] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll [2016-03-15] (Microsoft Corporation)
 
Chrome: 
=======
CHR DefaultProfile: Profile 2
CHR Profile: C:\Users\Mikey\AppData\Local\Google\Chrome\User Data\ChromeDefaultData [2017-01-12] <==== ATTENTION
CHR Profile: C:\Users\Mikey\AppData\Local\Google\Chrome\User Data\Default [2017-01-12]
CHR Extension: (Adblock Plus) - C:\Users\Mikey\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2016-10-26]
CHR Extension: (Bitdefender Wallet) - C:\Users\Mikey\AppData\Local\Google\Chrome\User Data\Default\Extensions\dhhejlifdlcgcmogbggeomfodgklfaem [2016-11-13]
CHR Extension: (Blur) - C:\Users\Mikey\AppData\Local\Google\Chrome\User Data\Default\Extensions\epanfjkfahimkgomnigadpkobaefekcd [2016-12-15]
CHR Extension: (AVG Do Not Track) - C:\Users\Mikey\AppData\Local\Google\Chrome\User Data\Default\Extensions\epojjbofkhffmihobdncmbhdocjljhpi [2014-12-21]
CHR Extension: (Avira Browser Safety) - C:\Users\Mikey\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2017-01-02]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Mikey\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-04-04]
CHR Extension: (Chrome Media Router) - C:\Users\Mikey\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2016-12-15]
CHR Profile: C:\Users\Mikey\AppData\Local\Google\Chrome\User Data\Profile 2 [2017-01-13]
CHR Extension: (Google Docs) - C:\Users\Mikey\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\aohghmighlieiainnegkcijnfilokake [2017-01-02]
CHR Extension: (Google Drive) - C:\Users\Mikey\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\apdfllckaahabafndbhieahigkjlhalf [2017-01-02]
CHR Extension: (YouTube) - C:\Users\Mikey\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2017-01-02]
CHR Extension: (Adblock Plus) - C:\Users\Mikey\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2017-01-02]
CHR Extension: (Avast SafePrice) - C:\Users\Mikey\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\eofcbnmajmjmplflapaojjnihcjkigck [2017-01-03]
CHR Extension: (Blur) - C:\Users\Mikey\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\epanfjkfahimkgomnigadpkobaefekcd [2017-01-05]
CHR Extension: (Google Sheets) - C:\Users\Mikey\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2017-01-02]
CHR Extension: (Google Docs Offline) - C:\Users\Mikey\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2017-01-02]
CHR Extension: (AdBlock) - C:\Users\Mikey\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2017-01-02]
CHR Extension: (Avast Online Security) - C:\Users\Mikey\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\gomekmidlodglbbmalcneegieacbdmki [2017-01-03]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Mikey\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-01-02]
CHR Extension: (Gmail) - C:\Users\Mikey\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2017-01-02]
CHR Extension: (Chrome Media Router) - C:\Users\Mikey\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-01-02]
CHR Profile: C:\Users\Mikey\AppData\Local\Google\Chrome\User Data\System Profile [2017-01-12]
CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - hxxps://clients2.google.com/service/update2/crx
 
==================== Services (Whitelisted) ====================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
R2 a2AntiMalware; C:\Program Files\Emsisoft Anti-Malware\a2service.exe [9461280 2017-01-12] (Emsisoft Ltd)
R2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [216192 2012-08-31] (Qualcomm Atheros Commnucations) [File not signed]
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [197128 2017-01-02] (AVAST Software)
R2 avast! Firewall; C:\Program Files\AVAST Software\Avast\afwServ.exe [223600 2017-01-02] (AVAST Software)
R2 DevMgmtService; C:\Program Files\Bitdefender\Bitdefender Device Management\DevMgmtService.exe [100448 2016-11-29] (Bitdefender)
R2 ISCTAgent; C:\Program Files\Intel\Intel® Smart Connect Technology Agent\iSCTAgent.exe [149032 2012-08-16] ()
R2 jhi_service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [164736 2012-11-07] (Intel Corporation)
S3 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [4317648 2016-12-14] (Malwarebytes)
R2 MSI_OTPService; C:\Program Files (x86)\MSI\OTPService\OTPService.exe [252432 2012-04-12] ()
R2 MSI_SuperCharger; C:\Program Files (x86)\MSI\Super-Charger\ChargeService.exe [143416 2012-10-25] (MSI)
R2 ProductAgentService; C:\Program Files\Bitdefender Agent\ProductAgentService.exe [1100392 2016-10-28] (Bitdefender)
R2 VmbService; C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\VmbService.exe [8704 2013-09-05] (Vodafone) [File not signed]
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
S2 WsAppService; C:\Program Files (x86)\Wondershare\WAF\2.3.2.219\WsAppService.exe [440832 2016-12-07] (Wondershare) [File not signed]
S3 WsDrvInst; C:\Program Files (x86)\Wondershare\dr.fone toolkit for Android\Library\DriverInstaller\DriverInstall.exe [124560 2016-12-13] (Wondershare)
S2 Clocrydreveward; C:\Program Files (x86)\Ghjakgherither\Njtmanager.dll [X]
 
===================== Drivers (Whitelisted) ======================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
S3 androidusb; C:\Windows\System32\Drivers\wsadb.sys [40720 2017-01-07] (Google Inc)
S3 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [37656 2017-01-02] (AVAST Software)
R1 aswKbd; C:\Windows\system32\drivers\aswKbd.sys [37144 2017-01-02] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [108816 2017-01-02] (AVAST Software)
R3 aswNetNd6; C:\Windows\System32\DRIVERS\aswNetNd6.sys [28312 2017-01-02] (AVAST Software)
R1 aswNetSec; C:\Windows\system32\drivers\aswNetSec.sys [453192 2017-01-02] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [103064 2017-01-02] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [74544 2017-01-02] (AVAST Software)
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [969184 2017-01-02] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [513632 2017-01-02] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [163416 2017-01-02] (AVAST Software)
S3 aswTap; C:\Windows\System32\DRIVERS\aswTap.sys [44640 2017-01-02] (The OpenVPN Project)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [293352 2017-01-02] (AVAST Software)
S3 BTATH_LWFLT; C:\Windows\System32\DRIVERS\btath_lwflt.sys [77464 2012-08-31] (Qualcomm Atheros)
R1 epp; C:\PROGRAM FILES\EMSISOFT ANTI-MALWARE\epp.sys [124552 2016-11-23] (Emsisoft Ltd)
R1 ESProtectionDriver; C:\Windows\system32\drivers\mbae64.sys [77416 2016-12-14] ()
R3 ikbevent; C:\Windows\System32\DRIVERS\ikbevent.sys [20968 2012-08-16] ()
R3 imsevent; C:\Windows\System32\DRIVERS\imsevent.sys [19944 2012-08-16] ()
R3 ISCT; C:\Windows\System32\DRIVERS\ISCTD64.sys [46016 2012-08-16] ()
S3 MBAMFarflt; C:\Windows\system32\drivers\farflt.sys [102856 2017-01-12] (Malwarebytes)
S3 MBAMProtection; C:\Windows\system32\drivers\mbam.sys [43968 2017-01-12] (Malwarebytes)
R0 MBAMSwissArmy; C:\Windows\System32\drivers\MBAMSwissArmy.sys [250816 2017-01-12] (Malwarebytes)
S3 MBAMWebProtection; C:\Windows\system32\drivers\mwac.sys [81696 2017-01-12] (Malwarebytes)
R3 NTIOLib_1_0_3; C:\Program Files (x86)\MSI\Super-Charger\NTIOLib_X64.sys [13368 2012-10-25] (MSI)
R3 NTIOLib_1_0_T; C:\Program Files (x86)\MSI\OTPService\NTIOLib_X64.sys [14136 2009-10-06] (MSI)
R3 rusb3hub; C:\Windows\System32\DRIVERS\rusb3hub.sys [101376 2011-11-21] (Renesas Electronics Corporation)
R3 rusb3xhc; C:\Windows\System32\DRIVERS\rusb3xhc.sys [217088 2011-11-21] (Renesas Electronics Corporation)
R0 TMEBC; C:\Windows\System32\DRIVERS\TMEBC64.sys [46392 2012-08-24] (Trend Micro Inc.)
R1 tmtdi; C:\Windows\System32\DRIVERS\tmtdi.sys [105744 2012-05-02] (Trend Micro Inc.)
R1 WiseUnlock; C:\Windows\WiseUnlock64.sys [12240 2015-05-11] (WiseCleaner.com)
R3 WPRO_41_2001; C:\Windows\System32\drivers\WPRO_41_2001.sys [34752 2017-01-13] ()
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 MBfilt; system32\drivers\MBfilt64.sys [X]
S3 MSICDSetup; \??\D:\CDriver64.sys [X]
S3 NTIOLib_1_0_C; \??\D:\NTIOLib_X64.sys [X]
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
 
==================== NetSvcs (Whitelisted) ===================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
 
==================== One Month Created files and folders ========
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2017-01-13 08:35 - 2017-01-13 08:35 - 00020602 _____ C:\Users\Mikey\Downloads\FRST.txt
2017-01-13 08:32 - 2017-01-13 08:32 - 02419200 _____ (Farbar) C:\Users\Mikey\Downloads\FRST64.exe
2017-01-13 08:21 - 2017-01-13 08:21 - 00094656 _____ (CACE Technologies) C:\Windows\system32\WPRO_41_2001woem.tmp
2017-01-12 21:26 - 2017-01-12 22:07 - 00000000 ____D C:\ProgramData\Emsisoft
2017-01-12 21:05 - 2017-01-13 08:25 - 00000000 ____D C:\Program Files\Emsisoft Anti-Malware
2017-01-12 21:05 - 2017-01-12 21:05 - 00000896 _____ C:\Users\Public\Desktop\Emsisoft Anti-Malware.lnk
2017-01-12 21:05 - 2017-01-12 21:05 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Emsisoft Anti-Malware
2017-01-12 20:59 - 2017-01-12 21:05 - 228173432 _____ (Emsisoft Ltd. ) C:\Users\Mikey\Downloads\EmsisoftAntiMalwareSetup_bc.exe
2017-01-12 20:50 - 2017-01-12 20:50 - 00020100 _____ C:\ComboFix.txt
2017-01-12 20:37 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2017-01-12 20:37 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2017-01-12 20:37 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2017-01-12 20:37 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2017-01-12 20:37 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2017-01-12 20:37 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2017-01-12 20:37 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2017-01-12 20:37 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2017-01-12 20:32 - 2017-01-12 20:50 - 00000000 ____D C:\Qoobox
2017-01-12 20:30 - 2017-01-12 20:35 - 201324617 _____ (Emsisoft Ltd. ) C:\Users\Mikey\Downloads\Unconfirmed 466407.crdownload
2017-01-12 20:25 - 2017-01-12 20:26 - 00214840 _____ C:\TDSSKiller.3.1.0.12_12.01.2017_20.25.28_log.txt
2017-01-12 20:22 - 2017-01-12 20:56 - 00000558 _____ C:\Users\Mikey\Desktop\JRT.txt
2017-01-12 20:14 - 2017-01-13 08:35 - 00000000 ____D C:\FRST
2017-01-12 19:05 - 2017-01-12 20:53 - 00000000 ____D C:\AdwCleaner
2017-01-12 18:39 - 2017-01-12 18:40 - 12492740 _____ C:\Users\Mikey\Downloads\AncientEgypt.themepack
2017-01-12 18:39 - 2017-01-12 18:40 - 07035835 _____ C:\Users\Mikey\Downloads\AutumnColorJapan.themepack
2017-01-12 17:22 - 2017-01-12 17:22 - 01673544 _____ ( ) C:\Users\Mikey\Downloads\cpu-z_1.78-en.exe
2017-01-12 17:14 - 2017-01-12 17:14 - 00001007 _____ C:\Users\Mikey\Desktop\SpeedFan.lnk
2017-01-12 17:13 - 2017-01-12 17:14 - 03086696 _____ C:\Users\Mikey\Downloads\instspeedfan452.exe
2017-01-11 17:30 - 2017-01-11 17:30 - 05618832 _____ C:\Users\Mikey\Downloads\p95v2810.win64.zip
2017-01-11 16:55 - 2017-01-11 16:55 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Speccy
2017-01-11 16:55 - 2017-01-11 16:55 - 00000000 ____D C:\Program Files\Speccy
2017-01-11 16:09 - 2017-01-11 16:09 - 00001793 _____ C:\Users\Mikey\Downloads\Until 24.01.2021.avastlic
2017-01-10 19:28 - 2017-01-10 19:28 - 00001750 _____ C:\Users\Mikey\Downloads\Avast VPN License.avastvpn
2017-01-10 18:52 - 2017-01-10 18:52 - 00000136 _____ C:\Users\Mikey\Downloads\Avast Cleanup license - luqueenterprises.com.rar
2017-01-10 15:26 - 2017-01-12 20:41 - 00000000 ____D C:\Users\Mikey\AppData\Roaming\WinSnare
2017-01-10 15:21 - 2017-01-10 15:21 - 00000000 ____D C:\Program Files (x86)\cz8tgwq9
2017-01-07 10:24 - 2017-01-07 10:24 - 00000000 ____D C:\DrFoneCache
2017-01-07 09:40 - 2017-01-07 09:40 - 00000000 ____D C:\Users\Mikey\Documents\Wondershare
2017-01-07 09:15 - 2017-01-07 13:21 - 00000000 ____D C:\DrFoneForAndroid
2017-01-07 09:06 - 2017-01-07 09:06 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_wsadb_01009.Wdf
2017-01-07 09:01 - 2017-01-07 09:01 - 00040720 _____ (Google Inc) C:\Windows\system32\Drivers\wsadb.sys
2017-01-07 08:58 - 2016-09-27 16:28 - 00000232 _____ C:\Windows\SysWOW64\dllhost.exe.config
2017-01-07 08:55 - 2017-01-07 08:57 - 00000000 ____D C:\Users\Public\Documents\Wondershare
2017-01-07 08:54 - 2017-01-07 08:54 - 01164432 _____ C:\Users\Mikey\Downloads\drfone-for-android_setup_full1464.exe
2017-01-03 11:15 - 2017-01-03 11:15 - 00000000 ____D C:\Users\Mikey\AppData\Roaming\Bitdefender
2017-01-03 00:02 - 2017-01-03 00:02 - 00001793 _____ C:\Users\Mikey\Downloads\Файл лицензии для Avast Premier до 24.01.2021 года (1).avastlic
2017-01-02 23:58 - 2017-01-02 23:58 - 00001793 _____ C:\Users\Mikey\Downloads\Файл лицензии для Avast Premier до 24.01.2021 года.avastlic
2017-01-02 23:34 - 2017-01-03 11:20 - 00003890 _____ C:\Windows\System32\Tasks\SafeZone scheduled Autoupdate 1483392868
2017-01-02 23:34 - 2017-01-02 23:34 - 00001043 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast SafeZone Browser.lnk
2017-01-02 23:33 - 2017-01-02 23:33 - 00037144 _____ (AVAST Software) C:\Windows\system32\Drivers\aswKbd.sys
2017-01-02 23:30 - 2017-01-12 21:06 - 00081696 _____ (Malwarebytes) C:\Windows\system32\Drivers\mwac.sys
2017-01-02 23:30 - 2017-01-12 21:05 - 00102856 _____ (Malwarebytes) C:\Windows\system32\Drivers\farflt.sys
2017-01-02 23:30 - 2017-01-12 21:05 - 00043968 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys
2017-01-02 23:30 - 2017-01-03 12:01 - 00176064 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMChameleon.sys
2017-01-02 23:29 - 2017-01-12 21:05 - 00250816 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2017-01-02 23:29 - 2017-01-02 23:29 - 00001922 _____ C:\Users\Public\Desktop\Avast Premier.lnk
2017-01-02 23:29 - 2017-01-02 23:29 - 00000000 ____D C:\Users\Mikey\AppData\Roaming\AVAST Software
2017-01-02 23:29 - 2017-01-02 23:29 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVAST Software
2017-01-02 23:28 - 2017-01-02 23:28 - 00001867 _____ C:\Users\Public\Desktop\Malwarebytes.lnk
2017-01-02 23:28 - 2017-01-02 23:28 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
2017-01-02 23:28 - 2017-01-02 23:28 - 00000000 ____D C:\Program Files\Malwarebytes
2017-01-02 23:28 - 2016-12-14 12:55 - 00077416 _____ C:\Windows\system32\Drivers\mbae64.sys
2017-01-02 23:27 - 2017-01-02 23:28 - 00969184 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys
2017-01-02 23:27 - 2017-01-02 23:28 - 00513632 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys
2017-01-02 23:27 - 2017-01-02 23:28 - 00293352 _____ (AVAST Software) C:\Windows\system32\Drivers\aswvmm.sys
2017-01-02 23:27 - 2017-01-02 23:26 - 00453192 _____ (AVAST Software) C:\Windows\system32\Drivers\aswNetSec.sys
2017-01-02 23:27 - 2017-01-02 23:26 - 00163416 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys
2017-01-02 23:27 - 2017-01-02 23:26 - 00108816 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2017-01-02 23:27 - 2017-01-02 23:26 - 00103064 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2017-01-02 23:27 - 2017-01-02 23:26 - 00074544 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRvrt.sys
2017-01-02 23:27 - 2017-01-02 23:26 - 00037656 _____ (AVAST Software) C:\Windows\system32\Drivers\aswHwid.sys
2017-01-02 23:26 - 2017-01-02 23:27 - 54199488 _____ (Malwarebytes ) C:\Users\Mikey\Downloads\mb3-setup-consumer-3.0.5.1299.exe
2017-01-02 23:26 - 2017-01-02 23:26 - 00391496 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2017-01-02 23:26 - 2017-01-02 23:26 - 00053208 _____ (AVAST Software) C:\Windows\avastSS.scr
2017-01-02 23:26 - 2017-01-02 23:26 - 00044640 _____ (The OpenVPN Project) C:\Windows\system32\Drivers\aswTap.sys
2017-01-02 23:26 - 2017-01-02 23:26 - 00028312 _____ (AVAST Software) C:\Windows\system32\Drivers\aswNetNd6.sys
2017-01-02 23:24 - 2017-01-02 23:33 - 00000000 ____D C:\Program Files\AVAST Software
2017-01-02 23:23 - 2017-01-02 23:33 - 00000000 ____D C:\ProgramData\AVAST Software
2017-01-02 23:23 - 2017-01-02 23:23 - 06306272 _____ (AVAST Software) C:\Users\Mikey\Downloads\avast_premier_antivirus_setup_online.exe
2017-01-02 21:32 - 2017-01-02 21:32 - 00006010 _____ C:\Windows\System32\Tasks\Serkersyphakdom Reports
2017-01-02 21:32 - 2017-01-02 21:32 - 00000000 ____D C:\Program Files\XBox
2017-01-02 21:31 - 2017-01-12 12:32 - 00000000 ____D C:\Program Files (x86)\Clemot
2017-01-02 21:31 - 2017-01-02 21:51 - 00000000 ____D C:\Users\Mikey\AppData\Roaming\Chuferck
2017-01-02 21:31 - 2017-01-02 21:34 - 00000000 ____D C:\Users\Mikey\AppData\Local\Msispareqock
 
==================== One Month Modified files and folders ========
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2017-01-13 08:29 - 2009-07-14 06:45 - 00052704 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2017-01-13 08:29 - 2009-07-14 06:45 - 00052704 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2017-01-13 08:23 - 2016-01-29 22:40 - 00000374 _____ C:\Windows\system32\Drivers\etc\hosts.ics
2017-01-13 08:22 - 2016-04-17 20:54 - 00000000 ____D C:\Program Files\Bitdefender Agent
2017-01-13 08:21 - 2015-03-01 17:06 - 00034752 _____ C:\Windows\system32\Drivers\WPRO_41_2001.sys
2017-01-13 08:20 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2017-01-12 21:09 - 2016-10-23 18:20 - 00000359 _____ C:\Users\Mikey\Desktop\New Text Document.txt
2017-01-12 20:50 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\inf
2017-01-12 20:45 - 2009-07-14 04:34 - 00000215 _____ C:\Windows\system.ini
2017-01-12 20:41 - 2015-02-13 22:58 - 00000000 ____D C:\Windows\erdnt
2017-01-12 20:12 - 2014-12-19 08:10 - 00000000 ____D C:\Windows\pss
2017-01-12 17:23 - 2015-03-01 19:02 - 00000869 _____ C:\Users\Public\Desktop\CPUID CPU-Z.lnk
2017-01-12 17:21 - 2016-08-03 12:42 - 00000000 ____D C:\Users\Mikey\Desktop\s5 things
2017-01-12 17:19 - 2009-07-14 01:28 - 00006656 _____ C:\Windows\system32\lpcio.dll
2017-01-12 17:16 - 2016-02-27 22:55 - 00000000 ____D C:\Program Files (x86)\SpeedFan
2017-01-12 17:14 - 2016-02-27 22:55 - 00000045 _____ C:\Windows\SysWOW64\initdebug.nfo
2017-01-12 11:23 - 2009-07-14 07:13 - 00006218 _____ C:\Windows\system32\PerfStringBackup.INI
2017-01-12 09:45 - 2009-07-14 07:08 - 00032604 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2017-01-11 16:06 - 2016-07-23 17:14 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2017-01-11 16:04 - 2015-01-02 08:47 - 00004476 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task
2017-01-10 19:13 - 2014-08-29 21:06 - 00000000 ____D C:\Users\Mikey
2017-01-10 15:21 - 2014-10-18 19:14 - 00004180 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2017-01-07 13:00 - 2009-07-14 06:45 - 00460312 _____ C:\Windows\system32\FNTCACHE.DAT
2017-01-07 08:58 - 2016-01-23 10:33 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wondershare
2017-01-07 08:58 - 2014-11-29 17:07 - 00000000 ____D C:\ProgramData\Wondershare
2017-01-07 08:58 - 2014-11-29 17:06 - 00000000 ____D C:\Program Files (x86)\Wondershare
2017-01-07 08:58 - 2014-08-30 07:16 - 00119312 _____ C:\Users\Mikey\AppData\Local\GDIPFONTCACHEV1.DAT
2017-01-05 21:33 - 2014-10-18 18:57 - 00000000 ____D C:\Users\Mikey\AppData\Roaming\vlc
2017-01-03 12:26 - 2014-11-01 19:24 - 00000000 ____D C:\Users\Mikey\AppData\Local\CrashDumps
2017-01-03 12:26 - 2014-11-01 18:52 - 00000000 ____D C:\Users\Mikey\AppData\Roaming\BitTorrent
2017-01-02 23:40 - 2015-04-20 08:53 - 00001066 _____ C:\Users\Public\Desktop\VLC media player.lnk
2017-01-02 23:28 - 2015-02-13 15:16 - 00000000 ____D C:\ProgramData\Malwarebytes
2017-01-02 22:41 - 2016-11-13 20:46 - 00000000 ____D C:\Program Files\Bitdefender
2017-01-02 22:11 - 2016-04-17 22:48 - 00154463 _____ C:\bdlog.txt
2017-01-02 21:52 - 2016-11-13 21:01 - 00001185 _____ C:\Users\Public\Desktop\Wise Force Deleter.lnk
2017-01-02 21:52 - 2016-11-02 07:31 - 00001003 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Arduino.lnk
2017-01-02 21:52 - 2016-11-02 07:31 - 00000985 _____ C:\Users\Public\Desktop\Arduino.lnk
2017-01-02 21:52 - 2016-07-23 17:14 - 00002041 _____ C:\Users\Public\Desktop\Acrobat Reader DC.lnk
2017-01-02 21:52 - 2016-06-02 15:34 - 00002217 _____ C:\Users\Public\Desktop\The Witcher 2 - Assassins of Kings Enhanced Edition.lnk
2017-01-02 21:52 - 2015-12-11 12:30 - 00001686 _____ C:\Users\Mikey\Desktop\SkyrimLauncher.exe - Shortcut.lnk
2017-01-02 21:52 - 2015-06-13 18:16 - 00000556 _____ C:\Users\Public\Desktop\Fraps.lnk
2017-01-02 21:52 - 2015-04-08 09:50 - 00001115 _____ C:\Users\Public\Desktop\Popcorn Time.lnk
2017-01-02 21:52 - 2015-02-14 13:01 - 00002195 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2017-01-02 21:52 - 2015-02-14 13:01 - 00002177 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2017-01-02 21:52 - 2014-12-28 17:40 - 00000860 _____ C:\Users\Public\Desktop\CCleaner.lnk
2017-01-02 21:52 - 2014-11-01 18:53 - 00000813 _____ C:\Users\Mikey\AppData\Roaming\Microsoft\Windows\Start Menu\BitTorrent.lnk
2017-01-02 21:52 - 2014-10-18 21:10 - 00001904 _____ C:\Users\Public\Desktop\GTA San Andreas.lnk
2017-01-02 21:52 - 2014-10-18 19:01 - 00001004 _____ C:\Users\Public\Desktop\CPUID HWMonitorPro.lnk
2017-01-02 21:52 - 2014-08-30 05:22 - 00001345 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk
2017-01-02 21:52 - 2014-08-30 05:22 - 00001326 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk
2017-01-02 21:52 - 2014-08-29 21:10 - 00001389 _____ C:\Users\Mikey\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2017-01-02 21:52 - 2009-07-14 07:01 - 00001282 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Default Programs.lnk
2017-01-02 21:52 - 2009-07-14 06:57 - 00001547 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2017-01-02 21:52 - 2009-07-14 06:57 - 00001330 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sidebar.lnk
2017-01-02 21:52 - 2009-07-14 06:57 - 00001246 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XPS Viewer.lnk
2017-01-02 21:52 - 2009-07-14 06:54 - 00001210 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Fax and Scan.lnk
2017-01-02 21:52 - 2009-07-14 06:49 - 00001266 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Windows Update.lnk
2017-01-02 21:51 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\LiveKernelReports
2017-01-02 21:48 - 2014-10-18 21:26 - 00000000 ____D C:\Users\Mikey\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
2017-01-02 21:34 - 2016-11-13 19:51 - 00000000 _____ C:\TOSTACK
2016-12-24 16:23 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\config\RegBack
2016-12-21 19:57 - 2015-06-13 18:15 - 00000000 ____D C:\Fraps
2016-12-21 17:09 - 2016-02-27 17:42 - 00524288 ___SH C:\Windows\system32\config\components{13e8603c-dd68-11e5-abcf-d43d7e93dead}.TMContainer00000000000000000002.regtrans-ms
2016-12-21 17:09 - 2016-02-27 17:42 - 00065536 ___SH C:\Windows\system32\config\components{13e8603c-dd68-11e5-abcf-d43d7e93dead}.TM.blf
2016-12-17 17:50 - 2015-11-19 08:40 - 00003330 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2016-12-17 17:50 - 2015-11-19 08:40 - 00003202 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2016-12-14 18:05 - 2014-08-30 05:20 - 00000000 ____D C:\Windows\Prefetch
 
==================== Files in the root of some directories =======
 
2014-08-29 21:45 - 2014-08-29 21:45 - 0000036 _____ () C:\Users\Mikey\AppData\Local\housecall.guid.cache
2015-04-12 14:27 - 2015-04-12 14:27 - 0007605 _____ () C:\Users\Mikey\AppData\Local\Resmon.ResmonCfg
 
==================== Bamital & volsnap ======================
 
(There is no automatic fix for files that do not pass verification.)
 
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
 
LastRegBack: 2016-12-24 16:23
 
==================== End of FRST.txt ============================
 
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 12-01-2017
Ran by Mikey (13-01-2017 08:35:25)
Running from C:\Users\Mikey\Downloads
Windows 7 Ultimate Service Pack 1 (X64) (2014-08-29 19:06:05)
Boot Mode: Normal
==========================================================
 
 
==================== Accounts: =============================
 
Administrator (S-1-5-21-2014530170-318503234-4003923440-500 - Administrator - Disabled)
Guest (S-1-5-21-2014530170-318503234-4003923440-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-2014530170-318503234-4003923440-1002 - Limited - Enabled)
Mikey (S-1-5-21-2014530170-318503234-4003923440-1000 - Administrator - Enabled) => C:\Users\Mikey
 
==================== Security Center ========================
 
(If an entry is included in the fixlist, it will be removed.)
 
AV: Emsisoft Anti-Malware (Enabled - Up to date) {701CB209-EBBC-AADC-11E6-DE73E7AF4C9D}
AV: Avast Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AV: Malwarebytes (Disabled - Up to date) {23007AD3-69FE-687C-2629-D584AFFAF72B}
AS: Emsisoft Anti-Malware (Enabled - Up to date) {CB7D53ED-CD86-A552-2B56-E5019C280620}
AS: Malwarebytes (Disabled - Up to date) {98619B37-4FC4-67F2-1C99-EEF6D47DBD96}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Avast Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
FW: Avast Antivirus (Enabled) {2F96FC65-F07D-9D1E-5A6E-3DA5C487EAF0}
 
==================== Installed Programs ======================
 
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 
Adobe Acrobat Reader DC (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}) (Version: 15.023.20053 - Adobe Systems Incorporated)
Arduino (HKLM-x32\...\Arduino) (Version: 1.6.12 - Arduino LLC)
Atheros Client Installation Program (HKLM-x32\...\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 8.0 - Atheros)
Avast Premier (HKLM-x32\...\Avast) (Version: 12.3.2280 - AVAST Software)
Bitdefender Agent (HKLM\...\Bitdefender Agent) (Version: 20.0.26.1436 - Bitdefender)
Bitdefender Device Management (HKLM\...\Bitdefender Device Management) (Version: 21.0.21.976 - Bitdefender)
BitTorrent (HKU\S-1-5-21-2014530170-318503234-4003923440-1000\...\BitTorrent) (Version: 7.9.9.42974 - BitTorrent Inc.)
CCleaner (HKLM\...\CCleaner) (Version: 5.01 - Piriform)
CodeBlocks (HKU\S-1-5-21-2014530170-318503234-4003923440-1000\...\CodeBlocks) (Version: 15.xx - The Code::Blocks Team)
CPUID CPU-Z 1.78 (HKLM\...\CPUID CPU-Z_is1) (Version:  - )
CPUID HWMonitor Pro 1.20 (HKLM\...\CPUID HWMonitorPro_is1) (Version:  - )
Dev C Add-ons (HKLM-x32\...\{3D7C744C-7EDE-4765-BDBF-A9FD2A8FACFE}) (Version: 1.0.0 - Private)
Dev-C++ 5 beta 9 release (4.9.9.2) (HKLM-x32\...\Dev-C++) (Version:  - )
dr.fone toolkit for Android (Version 8.0.1) (HKLM-x32\...\{7B08A1E1-3644-4237-B39D-762B5F5564D0}_is1) (Version: 8.0.1.32 - Wondershare Software Co.,Ltd.)
Emsisoft Anti-Malware (HKLM\...\{5502032C-88C1-4303-99FE-B5CBD7684CEA}_is1) (Version: 12.0 - Emsisoft Ltd.)
ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version:  - )
FluidSIM 4.0f Pneumatics Demo Version (HKLM-x32\...\FluidSIM 4.0f Pneumatics Demo Version) (Version:  - )
Fraps (HKLM-x32\...\Fraps) (Version:  - )
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 55.0.2883.87 - Google Inc.)
Google Update Helper (x32 Version: 1.3.32.7 - Google Inc.) Hidden
GTA San Andreas (HKLM-x32\...\{D417C96A-FCC7-4590-A1BB-FAF73F5BC98E}) (Version: 1.00.00001 - Rockstar Games)
Intel® Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.20.1337 - Intel Corporation)
Intel® Smart Connect Technology 3.0 x64 (HKLM\...\{DE788AD4-F7CE-4995-ADF8-56174A7B613C}) (Version: 3.0.41.1571 - Intel)
Intel® USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 1.0.5.235 - Intel Corporation)
LOGO!Soft Comfort V8.0 (Demo) (HKLM\...\LOGO!Soft Comfort V8.0 (Demo)) (Version: 8.0.0.0 - Siemens AG)
Malwarebytes version 3.0.5.1299 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 3.0.5.1299 - Malwarebytes)
Microsoft .NET Framework 4.6.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.6.01055 - Microsoft Corporation)
Microsoft Office Professional Plus 2013 (HKLM\...\Office15.PROPLUS) (Version: 15.0.4569.1506 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{527BBE2F-1FED-3D8B-91CB-4DB0F838E69E}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.51106 (HKLM-x32\...\{8e70e4e1-06d7-470b-9f74-a51bef21088e}) (Version: 11.0.51106.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
NVIDIA Graphics Driver 320.18 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 320.18 - NVIDIA Corporation)
OTPService (HKLM-x32\...\{B05F7750-8800-4520-9732-9C841246C8E2}_is1) (Version: 1.0.004 - MSI)
Outils de vérification linguistique 2013 de Microsoft Office - Français (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
Popcorn Time (HKLM-x32\...\Popcorn Time_is1) (Version: Beta 5.2.1 - Popcorn Time) <==== ATTENTION
PowerISO (HKLM-x32\...\PowerISO) (Version: 6.0 - Power Software Ltd)
Qualcomm Atheros Bluetooth Suite (64) (HKLM\...\{A84A4FB1-D703-48DB-89E0-68B6499D2801}) (Version: 8.0.0.208 - Qualcomm Atheros Communications)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.53.216.2012 - Realtek)
Renesas Electronics USB 3.0 Host Controller Driver (HKLM-x32\...\InstallShield_{17528CE4-C333-48FB-A9E4-D841E795CDCE}) (Version: 3.0.12.0 - Renesas Electronics Corporation)
Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 3.0.12.0 - Renesas Electronics Corporation) Hidden
SafeZone Stable 1.51.2220.62 (x32 Version: 1.51.2220.62 - Avast Software) Hidden
SeaTools for Windows 1.4.0.4 (HKLM-x32\...\SeaTools for Windows) (Version: 1.4.0.4 - Seagate Technology)
Service Pack 1 for Microsoft Office 2013 (KB2850036) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{D82063A8-7C8C-4C3B-A9BB-95138CA55D26}) (Version:  - Microsoft)
Service Pack 1 for Microsoft Office 2013 (KB2850036) 64-Bit Edition (Version:  - Microsoft) Hidden
Speccy (HKLM\...\Speccy) (Version: 1.30 - Piriform)
SpeedFan (remove only) (HKLM-x32\...\SpeedFan) (Version:  - )
Super-Charger (HKLM-x32\...\{7CDF10DD-A9B5-4DA3-AB95-E193248D4369}_is1) (Version: 1.2.014 - MSI)
The Witcher 2 - Assassins of Kings Enhanced Edition (HKLM-x32\...\The Witcher 2 - Assassins of Kings Enhanced Edition_is1) (Version:  - GOG.com)
Update for Skype for Business 2015 (KB3039776) 64-Bit Edition (HKLM\...\{90150000-012B-0409-1000-0000000FF1CE}_Office15.PROPLUS_{0FA8AE0C-69AE-4F60-A1AB-F79C6BA5A999}) (Version:  - Microsoft)
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.2.4 - VideoLAN)
Vodafone Mobile Broadband (HKLM-x32\...\{6C29152D-3FF9-43B2-84E4-9B35FC0BF5C2}) (Version: 10.3.408.46426 - Vodafone)
Winki (HKLM-x32\...\{81CF5153-38CF-41e2-AC3C-3D477C987D96}_is1) (Version: 3.2.126 - MSI)
WinRAR 5.20 beta 1 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.20.1 - win.rar GmbH)
Wise Force Deleter 1.41 (HKLM-x32\...\Wise Force Deleter_is1) (Version: 1.41 - WiseCleaner.com, Inc.)
 
==================== Custom CLSID (Whitelisted): ==========================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
 
==================== Scheduled Tasks (Whitelisted) =============
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
Task: {073DF810-619F-4329-B4E4-B952AE356D2D} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-11-19] (Google Inc.)
Task: {0E7C3DEB-D40F-4096-981E-D925740819CA} - System32\Tasks\{4532F012-5FB9-4F67-977F-84DEB5AD0007} => pcalua.exe -a D:\Utility\Google\Toolbar.exe -d D:\Utility\Google -c /r:MSIM /q  /T
Task: {23EC32C6-34FB-4521-ACF8-B8CDD77CBC94} - System32\Tasks\{29098EF2-4114-4933-852D-1A72059FA2B7} => pcalua.exe -a "C:\Program Files (x86)\Electronic Arts\Need for Speed Carbon\EAUninstall.exe"
Task: {2B519396-91E3-49A3-9DEC-7C15BB5E3EF8} - System32\Tasks\WiseCleaner\WFDSkipUAC => C:\Program Files (x86)\Wise\Wise Force Deleter\WiseDeleter.exe [2016-09-07] (WiseCleaner.com)
Task: {4A633FD9-CBBE-4CFA-9EAC-E5091B2EED94} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exe [2014-01-23] (Microsoft Corporation)
Task: {5803AD1D-76F9-4BE2-A69C-CA5665E7F190} - System32\Tasks\SafeZone scheduled Autoupdate 1483392868 => C:\Program Files\AVAST Software\SZBrowser\launcher.exe [2016-09-06] (Avast Software)
Task: {608F2486-D9CE-4948-966F-2409CE337B42} - System32\Tasks\{CA6B6052-778D-4542-8AA4-D40D6A447D43} => pcalua.exe -a D:\ChipSet\Intel\Patsburg\infinst_autol.exe -d D:\ChipSet\Intel\Patsburg -c -s
Task: {6F298316-1F91-4F8C-A7A8-BC16806DEF3C} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-11-19] (Google Inc.)
Task: {91D36348-F227-4942-8295-00472445400F} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2016-12-19] (Adobe Systems Incorporated)
Task: {965D43BD-D5D7-494C-8C8F-6187690B7D44} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2017-01-02] (AVAST Software)
Task: {9BE0CDC6-2C88-4626-AB33-06862E52455D} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-23] (Microsoft Corporation)
Task: {D022B3F2-8833-47BC-8DE9-4B7CB524EB20} - System32\Tasks\Bitdefender Agent WatchDog_65D6944A0EF74FDAB96E31112AD39864 => C:\Program Files\Bitdefender Agent\WatchDog.exe [2016-10-21] (Bitdefender)
Task: {D04FDA25-850E-482A-BC52-A0AD46F2B117} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-23] (Microsoft Corporation)
Task: {D561C941-4877-498B-A54D-473F64D9B2A1} - System32\Tasks\Serkersyphakdom Reports => C:\Program Files (x86)\Clemot\thecerther.exe [2017-01-02] (Glarysoft Ltd)
Task: {DE4C79CF-AC12-4579-9277-C2DFEB005F09} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-12-12] (Piriform Ltd)
Task: {F204C4DF-351D-4175-8E9A-747BA2526C0E} - System32\Tasks\{845222CE-9F79-4811-8915-A8127719CB76} => pcalua.exe -a D:\winki\Setup.exe -d D:\winki -c /VERYSILENT
Task: {F88BB171-0752-4EA2-B1B7-3827F5E52069} - System32\Tasks\AVAST Software\Avast settings backup => C:\Program Files\Common Files\AV\avast! Antivirus\backup.exe [2016-08-18] (AVAST Software)
 
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
 
 
==================== Shortcuts =============================
 
(The entries could be listed to be restored or removed.)
 
==================== Loaded Modules (Whitelisted) ==============
 
2014-08-30 09:13 - 2013-05-12 22:34 - 00087328 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2016-01-12 18:58 - 2016-01-12 18:58 - 08901184 _____ () C:\Program Files\Microsoft Office\Office15\1033\GrooveIntlResource.dll
2012-08-16 20:36 - 2012-08-16 20:36 - 00149032 _____ () C:\Program Files\Intel\Intel® Smart Connect Technology Agent\iSCTAgent.exe
2012-08-16 20:36 - 2012-08-16 20:36 - 00058920 _____ () C:\Program Files\Intel\Intel® Smart Connect Technology Agent\NetworkHeuristic.dll
2014-08-29 21:38 - 2012-04-12 19:59 - 00252432 _____ () C:\Program Files (x86)\MSI\OTPService\OTPService.exe
2017-01-02 23:26 - 2017-01-02 23:26 - 00169064 _____ () C:\Program Files\AVAST Software\Avast\JsonRpcServer.dll
2017-01-12 20:13 - 2017-01-12 20:13 - 03138632 _____ () C:\Program Files\AVAST Software\Avast\defs\17011201\algo.dll
2017-01-02 23:26 - 2017-01-02 23:26 - 00482928 _____ () C:\Program Files\AVAST Software\Avast\ffl2.dll
2017-01-02 23:26 - 2017-01-02 23:26 - 48936448 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2016-01-12 18:58 - 2016-01-12 18:58 - 08901184 _____ () C:\Program Files (x86)\Microsoft Office\Office15\1033\GrooveIntlResource.dll
2016-12-15 12:07 - 2016-12-08 09:29 - 01829208 _____ () C:\Program Files (x86)\Google\Chrome\Application\55.0.2883.87\libglesv2.dll
2016-12-15 12:07 - 2016-12-08 09:29 - 00085848 _____ () C:\Program Files (x86)\Google\Chrome\Application\55.0.2883.87\libegl.dll
2014-08-29 21:39 - 2012-10-22 07:22 - 01199648 ____R () C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\ACE.dll
2017-01-11 21:57 - 2017-01-11 21:57 - 17835096 _____ () C:\Users\Mikey\AppData\Local\Google\Chrome\User Data\PepperFlash\24.0.0.194\pepflashplayer.dll
 
==================== Alternate Data Streams (Whitelisted) =========
 
(If an entry is included in the fixlist, only the ADS will be removed.)
 
 
==================== Safe Mode (Whitelisted) ===================
 
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"
 
==================== Association (Whitelisted) ===============
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
 
 
==================== Internet Explorer trusted/restricted ===============
 
(If an entry is included in the fixlist, it will be removed from the registry.)
 
 
==================== Hosts content: ===============================
 
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 
2009-07-14 04:34 - 2017-01-12 20:45 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
 
127.0.0.1       localhost
 
==================== Other Areas ============================
 
(Currently there is no automatic fix for this section.)
 
HKU\S-1-5-21-2014530170-318503234-4003923440-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Mikey\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.0.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 0) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.
 
==================== MSCONFIG/TASK MANAGER disabled items ==
 
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^BackupRemind.lnk => C:\Windows\pss\BackupRemind.lnk.CommonStartup
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^iSCTsysTray.lnk => C:\Windows\pss\iSCTsysTray.lnk.CommonStartup
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: BtTray => "C:\Program Files (x86)\Bluetooth Suite\BtTray.exe"
MSCONFIG\startupreg: BtvStack => "C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe"
MSCONFIG\startupreg: CCleaner Monitoring => "C:\Program Files\CCleaner\CCleaner64.exe" /MONITOR
MSCONFIG\startupreg: InstallerLauncher => "C:\Program Files\Common Files\Bitdefender\SetupInformation\{09FE2C2E-BB0D-4848-A706-AA244FA25FEA}\setuplauncher.exe" /run:"C:\Program Files\Common Files\Bitdefender\SetupInformation\{09FE2C2E-BB0D-4848-A706-AA244FA25FEA}\Installer.exe"
MSCONFIG\startupreg: Lync => "C:\Program Files\Microsoft Office\Office15\lync.exe" /fromrunkey
MSCONFIG\startupreg: MobileBroadband => C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\MobileBroadband.exe /silent
MSCONFIG\startupreg: Super-Charger => C:\Program Files (x86)\MSI\Super-Charger\Super-Charger.exe
MSCONFIG\startupreg: VmbNotifier => C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\VmbNotifier.exe
MSCONFIG\startupreg: Wondershare Helper Compact.exe => "C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelperSetup.exe"
 
==================== FirewallRules (Whitelisted) ===============
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
FirewallRules: [{A2075D1B-3F98-454C-AECA-D129779309C3}] => C:\Users\Mikey\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{4503425E-3240-4299-B6D9-442F8ED673AF}] => C:\Users\Mikey\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{4A153582-8570-4622-8DD5-2626D13036E8}] => C:\Program Files\AVAST Software\Avast\ng\vbox\aswFe.exe
FirewallRules: [{6324FCA6-8105-4B3C-900A-5D1AED85E210}] => C:\Program Files\AVAST Software\Avast\ng\vbox\aswFe.exe
FirewallRules: [{9627DA12-F5F7-4CFD-AE24-DD3D8DE9F920}] => C:\Program Files\Microsoft Office\Office15\lync.exe
FirewallRules: [{C6B04F3E-551F-4A16-BE70-F3EF91EEFD7B}] => C:\Program Files\Microsoft Office\Office15\lync.exe
FirewallRules: [{0715E22C-CFCE-49C9-9A46-4F042849B94D}] => C:\Program Files\Microsoft Office\Office15\UcMapi.exe
FirewallRules: [{F33D70D8-1F15-406F-9E83-94921991A4D4}] => C:\Program Files\Microsoft Office\Office15\UcMapi.exe
FirewallRules: [TCP Query User{3D3E4313-C744-4BCA-9D7E-87116061B0EA}C:\program files (x86)\rockstar games\gta san andreas\samp\samp-server.exe] => C:\program files (x86)\rockstar games\gta san andreas\samp\samp-server.exe
FirewallRules: [UDP Query User{61B1ADEC-5072-4D6B-B25B-6A4140EE0A96}C:\program files (x86)\rockstar games\gta san andreas\samp\samp-server.exe] => C:\program files (x86)\rockstar games\gta san andreas\samp\samp-server.exe
FirewallRules: [{F047A9C0-CA46-4D44-A291-8DA361A61D57}] => C:\Program Files\Microsoft Office\Office15\lync.exe
FirewallRules: [{751F40BC-5E29-4395-BB60-89015F047BB9}] => C:\Program Files\Microsoft Office\Office15\lync.exe
FirewallRules: [{D3C808FE-F2B3-4F9D-967A-502725B36188}] => C:\Program Files\Microsoft Office\Office15\UcMapi.exe
FirewallRules: [{5BD4BE59-FA5A-4D87-AEFD-45B06C1FF3A8}] => C:\Program Files\Microsoft Office\Office15\UcMapi.exe
FirewallRules: [TCP Query User{D14108DC-6110-4B3D-9F3A-16E690D612A5}E:\games\call of duty\call of duty - world at war\codwaw.exe] => E:\games\call of duty\call of duty - world at war\codwaw.exe
FirewallRules: [UDP Query User{2A91CBF6-82DD-4DD5-B070-C89E6F1A1ADD}E:\games\call of duty\call of duty - world at war\codwaw.exe] => E:\games\call of duty\call of duty - world at war\codwaw.exe
FirewallRules: [TCP Query User{3350C10B-B512-497A-A98D-96F9AAC93F34}E:\games\call of duty\call of duty - world at war\codwawmp.exe] => E:\games\call of duty\call of duty - world at war\codwawmp.exe
FirewallRules: [UDP Query User{7A519980-8BE5-44E3-9A67-7F647121C07B}E:\games\call of duty\call of duty - world at war\codwawmp.exe] => E:\games\call of duty\call of duty - world at war\codwawmp.exe
FirewallRules: [{1E823292-F5A4-4E23-894A-D09CE2516478}] => C:\Program Files (x86)\Popcorn Time\PopcornTimeDesktop.exe
FirewallRules: [{CD0A9CD5-5F75-4CE5-8D88-777A265D0163}] => C:\Program Files (x86)\Popcorn Time\PopcornTimeDesktop.exe
FirewallRules: [{96A5A53A-F201-4286-8324-D3CE4024DDC6}] => C:\Program Files (x86)\Popcorn Time\Updater.exe
FirewallRules: [{E665BBAE-0BAA-422E-8B8C-64C3DE6C40F0}] => C:\Program Files (x86)\Popcorn Time\Updater.exe
FirewallRules: [TCP Query User{D4D5DCB7-82FF-4D69-8359-2AA691A64C6A}C:\program files (x86)\popcorn time\chromecast\node.exe] => C:\program files (x86)\popcorn time\chromecast\node.exe
FirewallRules: [UDP Query User{D44F24C0-414F-4B02-BED3-401CF1D01776}C:\program files (x86)\popcorn time\chromecast\node.exe] => C:\program files (x86)\popcorn time\chromecast\node.exe
FirewallRules: [TCP Query User{820C1FF3-DB8B-47E0-B387-0A6353132FE5}E:\games\3dmgame-mortal.kombat.komplete.edition.pc.cracked-3dm\mortalkombat_kompleteedition\disccontentpc\mkke.exe] => E:\games\3dmgame-mortal.kombat.komplete.edition.pc.cracked-3dm\mortalkombat_kompleteedition\disccontentpc\mkke.exe
FirewallRules: [UDP Query User{F0654DED-7A16-4F8F-A580-04FAD02C0DF4}E:\games\3dmgame-mortal.kombat.komplete.edition.pc.cracked-3dm\mortalkombat_kompleteedition\disccontentpc\mkke.exe] => E:\games\3dmgame-mortal.kombat.komplete.edition.pc.cracked-3dm\mortalkombat_kompleteedition\disccontentpc\mkke.exe
FirewallRules: [{DC20F4B3-5927-4FC1-9C27-B44AE1174BF0}] => C:\Program Files (x86)\Labcenter Electronics\Proteus 8 Professional\BIN\PDS.EXE
FirewallRules: [{4DF079E9-8891-4152-96B4-E822BE35A16C}] => C:\Program Files (x86)\Labcenter Electronics\Proteus 8 Professional\BIN\PDS.EXE
FirewallRules: [TCP Query User{10BA59CF-B8B7-424D-8184-BE5914B16674}C:\program files (x86)\payday 2\payday2_win32_release.exe] => C:\program files (x86)\payday 2\payday2_win32_release.exe
FirewallRules: [UDP Query User{437255E4-BE9F-4E33-8F2E-6FFF6B757547}C:\program files (x86)\payday 2\payday2_win32_release.exe] => C:\program files (x86)\payday 2\payday2_win32_release.exe
FirewallRules: [TCP Query User{0A2DC715-773D-4943-8905-24F623B95958}C:\program files (x86)\payday 2\payday2_win32_release.exe] => C:\program files (x86)\payday 2\payday2_win32_release.exe
FirewallRules: [UDP Query User{7CBDB3F9-2CF1-427B-A1E5-2A9AA85FC8AC}C:\program files (x86)\payday 2\payday2_win32_release.exe] => C:\program files (x86)\payday 2\payday2_win32_release.exe
FirewallRules: [TCP Query User{99D51C70-36F2-432E-BEBC-62C230CFE0AC}C:\program files (x86)\popcorn time\chromecast\node.exe] => C:\program files (x86)\popcorn time\chromecast\node.exe
FirewallRules: [UDP Query User{83FE2793-7137-47BC-929E-FA4DEE2112D6}C:\program files (x86)\popcorn time\chromecast\node.exe] => C:\program files (x86)\popcorn time\chromecast\node.exe
FirewallRules: [{13F09CA9-77A1-4675-A3F5-D162D45F5FF4}] => C:\Program Files\AVAST Software\Avast\ng\vbox\aswFe.exe
FirewallRules: [{5BE96FBC-B8F9-4119-8821-4217E1610D18}] => C:\Program Files\AVAST Software\Avast\ng\vbox\aswFe.exe
FirewallRules: [TCP Query User{ADF7B83B-408E-4132-B5EC-AA73926B2FA9}C:\program files (x86)\activision\call of duty black ops ii\t6sp.exe] => C:\program files (x86)\activision\call of duty black ops ii\t6sp.exe
FirewallRules: [UDP Query User{3A2F1940-B27F-4676-8813-3F961F4B1E6F}C:\program files (x86)\activision\call of duty black ops ii\t6sp.exe] => C:\program files (x86)\activision\call of duty black ops ii\t6sp.exe
FirewallRules: [TCP Query User{2266F3FB-6B64-4DB3-AD81-BE222E014B6B}C:\program files (x86)\rockstar games\gta san andreas\samp\samp-server.exe] => C:\program files (x86)\rockstar games\gta san andreas\samp\samp-server.exe
FirewallRules: [UDP Query User{37D756ED-7162-4160-B3B6-5263B37F10BE}C:\program files (x86)\rockstar games\gta san andreas\samp\samp-server.exe] => C:\program files (x86)\rockstar games\gta san andreas\samp\samp-server.exe
FirewallRules: [TCP Query User{6BAD8CE9-E290-406E-AC3A-82C322ECC5C4}C:\program files (x86)\gog.com\the witcher 2 enhanced edition\bin\witcher2.exe] => C:\program files (x86)\gog.com\the witcher 2 enhanced edition\bin\witcher2.exe
FirewallRules: [UDP Query User{1B8760DF-FC44-45DB-90EB-E19FE8BA62BE}C:\program files (x86)\gog.com\the witcher 2 enhanced edition\bin\witcher2.exe] => C:\program files (x86)\gog.com\the witcher 2 enhanced edition\bin\witcher2.exe
FirewallRules: [TCP Query User{AA88AEA4-15A8-44FD-BF4D-D35FED1272B6}C:\program files (x86)\gog.com\the witcher 2 enhanced edition\bin\witcher2.exe] => C:\program files (x86)\gog.com\the witcher 2 enhanced edition\bin\witcher2.exe
FirewallRules: [UDP Query User{BEE38BF7-1A9D-41CE-AAFD-DD2CE99ACB3F}C:\program files (x86)\gog.com\the witcher 2 enhanced edition\bin\witcher2.exe] => C:\program files (x86)\gog.com\the witcher 2 enhanced edition\bin\witcher2.exe
FirewallRules: [{11EAD162-CEDA-469A-865A-31BF89C21FCE}] => C:\Program Files (x86)\Labcenter Electronics\Proteus 8 Demonstration\BIN\PDS.EXE
FirewallRules: [{E8DB50D5-E27C-460B-B87A-C02192C40FF2}] => C:\Program Files (x86)\Labcenter Electronics\Proteus 8 Demonstration\BIN\PDS.EXE
FirewallRules: [{30D26B81-059A-43CD-9736-A27E72018A3F}] => C:\Program Files (x86)\Labcenter Electronics\Proteus 8 Professional\BIN\\PDS.EXE
FirewallRules: [{6580462F-A35D-4B17-81C6-9069BB97977D}] => C:\Program Files (x86)\Labcenter Electronics\Proteus 8 Professional\BIN\\PDS.EXE
FirewallRules: [TCP Query User{64927ECF-4F1E-443C-96D0-552559263BB6}C:\program files (x86)\arduino\java\bin\javaw.exe] => C:\program files (x86)\arduino\java\bin\javaw.exe
FirewallRules: [UDP Query User{3C41A3E2-451E-4597-A1DB-469746D1DEDA}C:\program files (x86)\arduino\java\bin\javaw.exe] => C:\program files (x86)\arduino\java\bin\javaw.exe
FirewallRules: [{A23A2BC8-BC4D-43FB-AB71-B0B8D52CDF29}] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
 
==================== Restore Points =========================
 
12-01-2017 20:19:45 JRT Pre-Junkware Removal
12-01-2017 20:53:25 JRT Pre-Junkware Removal
 
==================== Faulty Device Manager Devices =============
 
Name: avast! SecureLine TAP Adapter v3
Description: avast! SecureLine TAP Adapter v3
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: TAP-Windows Provider V9
Service: aswTap
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
 
Name: Qualcomm Atheros AR3011 Bluetooth 3.0
Description: Qualcomm Atheros AR3011 Bluetooth 3.0
Class Guid: {e0cbf06c-cd8b-4647-bb8a-263b43f0f974}
Manufacturer: Qualcomm Atheros Communications
Service: BTHUSB
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
 
 
==================== Event log errors: =========================
 
Application errors:
==================
Error: (01/13/2017 08:31:08 AM) (Source: Office 2013 Licensing Service) (EventID: 0) (User: )
Description: Event-ID 0
 
Error: (01/12/2017 07:11:10 PM) (Source: WinSnare) (EventID: 104) (User: )
Description: 
 
Error: (01/12/2017 06:22:14 PM) (Source: WinSnare) (EventID: 104) (User: )
Description: 
 
Error: (01/12/2017 05:04:50 PM) (Source: WinSnare) (EventID: 104) (User: )
Description: 
 
Error: (01/12/2017 11:40:15 AM) (Source: Office Software Protection Platform Service) (EventID: 16385) (User: )
Description: Failed to schedule Software Protection service for re-start at 2017-01-12T10:00:15Z. Error Code: 0x80070057.
 
Error: (01/12/2017 11:23:25 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT AUTHORITY)
Description: Unloading the performance counter strings for service WmiApRpl (WmiApRpl) failed. The first DWORD in the Data section contains the error code.
 
Error: (01/12/2017 11:23:25 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT AUTHORITY)
Description: The performance strings in the Performance registry value is corrupted when process Performance extension counter provider. The BaseIndex value from the Performance registry is the first DWORD in the Data section, LastCounter value is the second DWORD in the Data section, and LastHelp value is the third DWORD in the Data section.
 
Error: (01/12/2017 10:05:36 AM) (Source: Office Software Protection Platform Service) (EventID: 16385) (User: )
Description: Failed to schedule Software Protection service for re-start at 2017-01-12T09:59:36Z. Error Code: 0x80070057.
 
Error: (01/12/2017 09:55:36 AM) (Source: Office 2013 Licensing Service) (EventID: 0) (User: )
Description: Event-ID 0
 
Error: (01/12/2017 09:45:33 AM) (Source: WinSnare) (EventID: 104) (User: )
Description: 
 
 
System errors:
=============
Error: (01/13/2017 08:24:02 AM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The Peer Networking Grouping service depends on the Peer Name Resolution Protocol service which failed to start because of the following error: 
%%-2140993535
 
Error: (01/13/2017 08:24:02 AM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: The Peer Name Resolution Protocol service terminated with the following error: 
%%-2140993535
 
Error: (01/13/2017 08:24:02 AM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The Peer Networking Grouping service depends on the Peer Name Resolution Protocol service which failed to start because of the following error: 
%%-2140993535
 
Error: (01/13/2017 08:24:02 AM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: The Peer Name Resolution Protocol service terminated with the following error: 
%%-2140993535
 
Error: (01/13/2017 08:24:02 AM) (Source: PNRPSvc) (EventID: 102) (User: )
Description: The Peer Name Resolution Protocol cloud did not start because the creation of the default identity failed with error code: 0x80630801.
 
Error: (01/13/2017 08:24:02 AM) (Source: PNRPSvc) (EventID: 102) (User: )
Description: The Peer Name Resolution Protocol cloud did not start because the creation of the default identity failed with error code: 0x80630801.
 
Error: (01/13/2017 08:23:54 AM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The Peer Networking Grouping service depends on the Peer Name Resolution Protocol service which failed to start because of the following error: 
%%-2140993535
 
Error: (01/13/2017 08:23:54 AM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: The Peer Name Resolution Protocol service terminated with the following error: 
%%-2140993535
 
Error: (01/13/2017 08:23:53 AM) (Source: PNRPSvc) (EventID: 102) (User: )
Description: The Peer Name Resolution Protocol cloud did not start because the creation of the default identity failed with error code: 0x80630801.
 
Error: (01/13/2017 08:23:12 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: The following boot-start or system-start driver(s) failed to load: 
cdrom
 
 
CodeIntegrity:
===================================
  Date: 2017-01-12 20:41:27.276
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume1\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 
  Date: 2017-01-12 20:41:27.236
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume1\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 
  Date: 2017-01-12 20:41:27.206
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume1\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 
  Date: 2017-01-12 20:41:27.166
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume1\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 
  Date: 2015-02-14 07:33:09.592
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume1\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 
  Date: 2015-02-14 07:33:09.560
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume1\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 
  Date: 2015-02-14 07:33:09.514
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume1\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 
  Date: 2015-02-14 07:33:09.482
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume1\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 
  Date: 2015-02-13 23:03:17.233
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume1\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 
  Date: 2015-02-13 23:03:17.202
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume1\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 
 
==================== Memory info =========================== 
 
Processor: Intel® Core™ i5-3570K CPU @ 3.40GHz
Percentage of memory in use: 37%
Total physical RAM: 8137.78 MB
Available physical RAM: 5123.79 MB
Total Virtual: 16273.74 MB
Available Virtual: 12483.4 MB
 
==================== Drives ================================
 
Drive c: () (Fixed) (Total:111.79 GB) (Free:21.38 GB) NTFS ==>[drive with boot components (obtained from BCD)]
 
==================== MBR & Partition Table ==================
 
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 111.8 GB) (Disk ID: B1F63164)
Partition 1: (Active) - (Size=111.8 GB) - (Type=07 NTFS)
 
==================== End of Addition.txt ============================

 



BC AdBot (Login to Remove)

 


#2 nasdaq

nasdaq

  • Malware Response Team
  • 39,531 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:08:04 PM

Posted 14 January 2017 - 11:14 AM

Hello, Welcome to BleepingComputer.
I'm nasdaq and will be helping you.

If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed.
===

Press the windows key Windows_Logo_key.gif+ r on your keyboard at the same time. This will open the RUN BOX.
Type Notepad and and click the OK key.

Please copy the entire contents of the code box below to a new file.


Start

CreateRestorePoint:
EmptyTemp:
CloseProcesses:

HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\S-1-5-21-2014530170-318503234-4003923440-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
Handler: tmbp - {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\Module\20002\7.5.1137\7.5.1137\TmBpIe32.dll No File
Handler: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\Module\20004\2.5.1331\6.8.1094\TmIEPlg32.dll No File
FF HKLM\...\Firefox\Extensions: [tmbepff-7.5@trendmicro.com] - C:\Program Files\Trend Micro\AMSP\Module\20002\7.5.1137\7.5.1137\firefoxextension => not found
FF HKLM-x32\...\Firefox\Extensions: [tmbepff-7.5@trendmicro.com] - C:\Program Files\Trend Micro\AMSP\Module\20002\7.5.1137\7.5.1137\firefoxextension => not found
FF HKLM-x32\...\Firefox\Extensions: [{22C7F6C6-8D67-4534-92B5-529A0EC09405}] - C:\Program Files\Trend Micro\AMSP\module\20004\FxExt\firefoxextension => not found
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
CHR Profile: C:\Users\Mikey\AppData\Local\Google\Chrome\User Data\ChromeDefaultData [2017-01-12] <==== ATTENTION
CHR Extension: (Avira Browser Safety) - C:\Users\Mikey\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2017-01-02]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Mikey\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-04-04]
CHR Extension: (Chrome Media Router) - C:\Users\Mikey\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2016-12-15]
CHR Extension: (Avast SafePrice) - C:\Users\Mikey\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\eofcbnmajmjmplflapaojjnihcjkigck [2017-01-03]
CHR Extension: (Avast Online Security) - C:\Users\Mikey\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\gomekmidlodglbbmalcneegieacbdmki [2017-01-03]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Mikey\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-01-02]
CHR Extension: (Chrome Media Router) - C:\Users\Mikey\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-01-02]
CHR HKLM-x32\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - hxxps://clients2.google.com/service/update2/crx
S2 Clocrydreveward; C:\Program Files (x86)\Ghjakgherither\Njtmanager.dll [X]
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 MBfilt; system32\drivers\MBfilt64.sys [X]
S3 MSICDSetup; \??\D:\CDriver64.sys [X]
S3 NTIOLib_1_0_C; \??\D:\NTIOLib_X64.sys [X]
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]


Reboot:

End
Save the file as fixlist.txt in the same folder where the Farbar tool is running from.
The location is listed in the 3rd line of the Farbar log you have submitted.

Run FRST and click Fix only once and wait.

The tool will create a log (Fixlog.txt) please post it to your reply.

==

Reset Chrome...
Open Google Chrome, click on menu icon google-chrome-setting-icon.png which is located right side top of the google chrome.
 
Click "Settings" then "Show advanced settings" at the bottom of the screen.
 
Click "Reset browser settings" button.
 
Restart Chrome.
==

Please let me know what problem persists with this computer.

#3 SociallyAwkward

SociallyAwkward
  • Topic Starter

  • Members
  • 72 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:South Africa
  • Local time:02:04 AM

Posted 15 January 2017 - 10:51 AM

Fix result of Farbar Recovery Scan Tool (x64) Version: 12-01-2017
Ran by Mikey (15-01-2017 17:34:08) Run:1
Running from C:\Users\Mikey\Downloads
Loaded Profiles: Mikey (Available Profiles: Mikey)
Boot Mode: Normal
==============================================
 
fixlist content:
*****************
Start
 
CreateRestorePoint:
EmptyTemp:
CloseProcesses:
 
HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\S-1-5-21-2014530170-318503234-4003923440-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
Handler: tmbp - {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\Module\20002\7.5.1137\7.5.1137\TmBpIe32.dll No File
Handler: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\Module\20004\2.5.1331\6.8.1094\TmIEPlg32.dll No File
FF HKLM\...\Firefox\Extensions: [tmbepff-7.5@trendmicro.com] - C:\Program Files\Trend Micro\AMSP\Module\20002\7.5.1137\7.5.1137\firefoxextension => not found
FF HKLM-x32\...\Firefox\Extensions: [tmbepff-7.5@trendmicro.com] - C:\Program Files\Trend Micro\AMSP\Module\20002\7.5.1137\7.5.1137\firefoxextension => not found
FF HKLM-x32\...\Firefox\Extensions: [{22C7F6C6-8D67-4534-92B5-529A0EC09405}] - C:\Program Files\Trend Micro\AMSP\module\20004\FxExt\firefoxextension => not found
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
CHR Profile: C:\Users\Mikey\AppData\Local\Google\Chrome\User Data\ChromeDefaultData [2017-01-12] <==== ATTENTION
CHR Extension: (Avira Browser Safety) - C:\Users\Mikey\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2017-01-02]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Mikey\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-04-04]
CHR Extension: (Chrome Media Router) - C:\Users\Mikey\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2016-12-15]
CHR Extension: (Avast SafePrice) - C:\Users\Mikey\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\eofcbnmajmjmplflapaojjnihcjkigck [2017-01-03]
CHR Extension: (Avast Online Security) - C:\Users\Mikey\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\gomekmidlodglbbmalcneegieacbdmki [2017-01-03]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Mikey\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-01-02]
CHR Extension: (Chrome Media Router) - C:\Users\Mikey\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-01-02]
CHR HKLM-x32\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - hxxps://clients2.google.com/service/update2/crx
S2 Clocrydreveward; C:\Program Files (x86)\Ghjakgherither\Njtmanager.dll [X]
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 MBfilt; system32\drivers\MBfilt64.sys [X]
S3 MSICDSetup; \??\D:\CDriver64.sys [X]
S3 NTIOLib_1_0_C; \??\D:\NTIOLib_X64.sys [X]
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
 
 
Reboot:
 
End
*****************
 
Restore point was successfully created.
Processes closed successfully.
HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\\EnableShellExecuteHooks => value removed successfully
HKLM\SOFTWARE\Policies\Google => key removed successfully
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer => key removed successfully
HKU\S-1-5-21-2014530170-318503234-4003923440-1000\SOFTWARE\Policies\Microsoft\Internet Explorer => key removed successfully
HKCR\PROTOCOLS\Handler\tmbp => key not found. 
HKCR\CLSID\{1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} => key not found. 
HKCR\PROTOCOLS\Handler\tmpx => key not found. 
HKCR\CLSID\{0E526CB5-7446-41D1-A403-19BFE95E8C23} => key not found. 
HKLM\Software\Mozilla\Firefox\Extensions\\tmbepff-7.5@trendmicro.com => value removed successfully
HKLM\Software\Wow6432Node\Mozilla\Firefox\Extensions\\tmbepff-7.5@trendmicro.com => value removed successfully
HKLM\Software\Wow6432Node\Mozilla\Firefox\Extensions\\{22C7F6C6-8D67-4534-92B5-529A0EC09405} => value removed successfully
HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE => key removed successfully
HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE => key removed successfully
C:\Users\Mikey\AppData\Local\Google\Chrome\User Data\ChromeDefaultData => moved successfully
C:\Users\Mikey\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk => moved successfully
C:\Users\Mikey\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda => moved successfully
C:\Users\Mikey\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm => moved successfully
C:\Users\Mikey\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\eofcbnmajmjmplflapaojjnihcjkigck => moved successfully
C:\Users\Mikey\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\gomekmidlodglbbmalcneegieacbdmki => moved successfully
C:\Users\Mikey\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\nmmhkkegccagdldgiimedpiccmgmieda => moved successfully
C:\Users\Mikey\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm => moved successfully
HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\eofcbnmajmjmplflapaojjnihcjkigck => key removed successfully
HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\gomekmidlodglbbmalcneegieacbdmki => key removed successfully
HKLM\System\CurrentControlSet\Services\Clocrydreveward => key removed successfully
Clocrydreveward => service removed successfully
HKLM\System\CurrentControlSet\Services\catchme => key removed successfully
catchme => service removed successfully
HKLM\System\CurrentControlSet\Services\MBfilt => key removed successfully
MBfilt => service removed successfully
HKLM\System\CurrentControlSet\Services\MSICDSetup => key removed successfully
MSICDSetup => service removed successfully
HKLM\System\CurrentControlSet\Services\NTIOLib_1_0_C => key removed successfully
NTIOLib_1_0_C => service removed successfully
HKLM\System\CurrentControlSet\Services\Synth3dVsc => key removed successfully
Synth3dVsc => service removed successfully
HKLM\System\CurrentControlSet\Services\tsusbhub => key removed successfully
tsusbhub => service removed successfully
HKLM\System\CurrentControlSet\Services\VGPU => key removed successfully
VGPU => service removed successfully
 
=========== EmptyTemp: ==========
 
BITS transfer queue => 8388608 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 8090773 B
Java, Flash, Steam htmlcache => 0 B
Windows/system/drivers => 2122 B
Edge => 0 B
Chrome => 47648803 B
Firefox => 0 B
Opera => 0 B
 
Temp, IE cache, history, cookies, recent:
Users => 0 B
Default => 0 B
Public => 0 B
ProgramData => 0 B
systemprofile => 128 B
systemprofile32 => 278068 B
LocalService => 6268 B
NetworkService => 0 B
Mikey => 5387734 B
 
RecycleBin => 0 B
EmptyTemp: => 66.6 MB temporary data Removed.
 
================================
 
 
The system needed a reboot.
 
==== End of Fixlog 17:35:53 ====
 
Hello Nasdaq, thank you for assisting me.
 
My PC does seem to be running smoother now on start-up, quicker now and not as sluggish. Not as quick as I'd like ( still a little slow for a few seconds, and takes a while to log into windows after i enter my password), but i maybe I'm expecting too much?


#4 nasdaq

nasdaq

  • Malware Response Team
  • 39,531 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:08:04 PM

Posted 15 January 2017 - 02:19 PM

If all is well.

To learn more about how to protect yourself while on the internet read this little guide best security practices keep safe.
http://www.bleepingcomputer.com/forums/t/407147/answers-to-common-security-questions-best-practices/


I will leave this topic open for 6 days.

#5 SociallyAwkward

SociallyAwkward
  • Topic Starter

  • Members
  • 72 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:South Africa
  • Local time:02:04 AM

Posted 16 January 2017 - 08:51 AM

So everything seems more or less okay now. I have noticed, however, that my cpu core temps are going up to 65 + degrees even till 70 sometimes @ IDLE. This is all indicated by SpeedFan/CoreTemp/HW monitor. My bios indicates temperatures of 40-45 degrees though. Should i be concerned?


Edited by SociallyAwkward, 16 January 2017 - 08:53 AM.


#6 nasdaq

nasdaq

  • Malware Response Team
  • 39,531 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:08:04 PM

Posted 16 January 2017 - 09:07 AM


I suggest you check with the Hardware helpers in this forum. It's not my forte.

https://www.bleepingcomputer.com/forums/f/7/internal-hardware/
===

#7 SociallyAwkward

SociallyAwkward
  • Topic Starter

  • Members
  • 72 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:South Africa
  • Local time:02:04 AM

Posted 17 January 2017 - 09:14 AM

So Malwarebytes trial finished. I got the full version and did a scan. 5414 threats found :|. downloaded Adwclaener and Junkware remover. they also found some (about 10). Where am i getting these infections from? I don't use any malicious websites..was Malwarebytes wrong? This bleeping pc is really starting to give me a headache. One problem after another


Edited by SociallyAwkward, 17 January 2017 - 09:15 AM.


#8 SociallyAwkward

SociallyAwkward
  • Topic Starter

  • Members
  • 72 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:South Africa
  • Local time:02:04 AM

Posted 17 January 2017 - 10:44 AM

Avast finds no more threats...think I'm okay now.



#9 nasdaq

nasdaq

  • Malware Response Team
  • 39,531 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:08:04 PM

Posted 17 January 2017 - 01:42 PM

If all is well.

To learn more about how to protect yourself while on the internet read this little guide best security practices keep safe.
http://www.bleepingcomputer.com/forums/t/407147/answers-to-common-security-questions-best-practices/

===




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users