Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

Laptop is a mess. Little Brother was gaming [Solved]

Started by Triskelion , Jul 21 2014 10:49 AM

This topic is locked

#16
Triskelion

Posted 28 July 2014 - 10:29 AM

Member

Topic Starter
Member
663 posts

Hello Adam, hope you had a great weekend.

1.Torch - Uninstalled successfully

2. Fixlog:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 26-07-2014

Ran by Lauren at 2014-07-28 10:04:28 Run:1

Running from C:\Users\Lauren\Desktop

Boot Mode: Normal

==============================================

Content of fixlist:

*****************

start

(Speedbit Ltd.) C:\Program Files\Common Files\SpeedBit\SBUpdate\sbu.exe

SearchScopes: HKLM - {7F4EFF06-7032-458e-AE16-1C1D8255C28A} URL = http://go.speedbit.c...q={searchTerms}

SearchScopes: HKCU - DefaultScope {7F4EFF06-7032-458e-AE16-1C1D8255C28A} URL = http://go.speedbit.c...q={searchTerms}

SearchScopes: HKCU - {7F4EFF06-7032-458e-AE16-1C1D8255C28A} URL = http://go.speedbit.c...q={searchTerms}

FF Keyword.URL: hxxp://go.speedbit.com/search.aspx?s=Unknown&q=

FF DefaultSearchEngine: Speedbit

R2 SBUpd; C:\Program Files\Common Files\SpeedBit\SBUpdate\sbu.exe [2541688 2014-03-04] (Speedbit Ltd.)

Task: C:\Windows\Tasks\SBW_UpdateTask_Time_323835363539383132302d2337785a326c5b3234342d41.job => C:\ProgramData\SpeedBit\sbhe.js" sbu.exe

C:\Windows\Tasks\SBW_UpdateTask_Time_323835363539383132302d2337785a326c5b3234342d41.job

2014-03-04 02:36 - 2014-03-04 02:36 - 01011320 _____ () C:\Program Files\Common Files\SpeedBit\SBUpdate\sbci32.dll

R3 SBUpdd; C:\Program Files\Common Files\SpeedBit\SBUpdate\sbw.sys [41368 2014-03-04] ()

2014-06-27 07:51 - 2014-03-16 17:50 - 00000472 _____ () C:\Windows\Tasks\SBW_UpdateTask_Time_323835363539383132302d2337785a326c5b3234342d41.job

C:\Program Files\Common Files\SpeedBit

C:\ProgramData\SpeedBit

(TorchMedia Inc.) C:\Users\Lauren\AppData\Local\Torch\Update\TorchCrashHandler.exe

R2 TorchCrashHandler; C:\Users\Lauren\AppData\Local\Torch\Update\TorchCrashHandler.exe [1216520 2014-07-09] (TorchMedia Inc.)

2014-07-08 00:39 - 2014-07-22 09:16 - 00000000 ____D () C:\ProgramData\TorchCrashHandler

2014-07-08 00:37 - 2014-07-08 00:37 - 01661136 _____ (Torch Media, Inc) C:\Users\Lauren\Downloads\TorchSetupk-r20-n-bc.exe

2014-07-17 09:08 - 2014-05-07 15:19 - 00001257 _____ () C:\Users\Lauren\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Torch.lnk

2014-07-17 09:08 - 2014-05-07 15:17 - 00000000 ____D () C:\Users\Lauren\AppData\Local\Torch

HKU\.DEFAULT\...\Run: [Exetender] => "C:\Program Files (x86)\Free Ride Games\GPlayer.exe" /runonstartup

HKU\S-1-5-19\...\Run: [Exetender] => "C:\Program Files (x86)\Free Ride Games\GPlayer.exe" /runonstartup

HKU\S-1-5-20\...\Run: [Exetender] => "C:\Program Files (x86)\Free Ride Games\GPlayer.exe" /runonstartup

FF Plugin-x32: @exent.com/npExentCtl,version=7.0.0.0 - C:\Program Files (x86)\Free Ride Games\npExentCtl.dll No File

FF Plugin-x32: www.exent.com/GameTreatWidget - C:\Program Files (x86)\Free Ride Games\NPGameTreatPlugin.dll No File

S2 X5XSEx_Pr143; \??\C:\Program Files (x86)\Free Ride Games\X5XSEx_Pr143.Sys [X]

C:\Program Files (x86)\Free Ride Games

HKU\.DEFAULT\...\RunOnce: [SpUninstallDeleteDir] => rmdir /s /q "\SearchProtect"

SearchScopes: HKCU - {19E2B84A-76AB-4A61-83E6-7CD18211855F} URL = http://search.condui...rchTerms}&SSPV=

SearchScopes: HKCU - {267BB848-E6E8-46A7-A0B6-8E0123B74611} URL = http://search.condui...PV=SSPV_AB_IE_1

SearchScopes: HKCU - {3F66891D-B10C-45FD-9D4A-226A6165CEFB} URL = http://search.condui...4215271082&UM=2

Toolbar: HKCU - No Name - {37483B40-C254-4A72-BDA4-22EE90182C1E} - No File

SearchScopes: HKCU - {3C3DCC02-C1F9-44CC-8A57-3EB6F6FA3376} URL = http://www.mysearchr...q={searchTerms}

FF HKCU\...\Firefox\Extensions: [{193fe82a-c958-450c-8097-de926f5db967}] - C:\Program Files (x86)\LyricSing\130.xpi

CHR HKLM-x32\...\Chrome\Extension: [npffmjkglbnioaoncpfmdbmehnbcldfh] - C:\Program Files (x86)\LyricSing\130.crx [2014-04-11]

C:\Program Files (x86)\LyricSing

Task: {E7ABD842-895A-458B-A44F-8EE6CDC5B76F} - System32\Tasks\Updater21804.exe => C:\Users\Lauren\AppData\Local\Updater21804\Updater21804.exe <==== ATTENTION

C:\Users\Lauren\AppData\Local\Updater21804

CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

MSCONFIG\startupreg: Browser Infrastructure Helper => C:\Users\Lauren\AppData\Local\Smartbar\Application\SnapDo.exe startup

C:\Users\Lauren\AppData\Local\Smartbar

MSCONFIG\startupreg: ConduitFloatingPlugin_dnmlhhbehhdmajijfenoldcajelckpmn => "C:\Windows\SysWOW64\Rundll32.exe" "C:\Program Files (x86)\Conduit\CT3291327\plugins\TBVerifier.dll",RunConduitFloatingPlugin dnmlhhbehhdmajijfenoldcajelckpmn

C:\Program Files (x86)\Conduit

MSCONFIG\startupreg: vProt => "C:\Program Files (x86)\AVG SafeGuard toolbar\vprot.exe"

C:\Program Files (x86)\AVG SafeGuard toolbar

MSCONFIG\startupreg: SearchProtect => C:\Users\Lauren\AppData\Roaming\SearchProtect\bin\cltmng.exe

C:\Users\Lauren\AppData\Roaming\SearchProtect

MSCONFIG\startupreg: SearchProtectAll => C:\Program Files (x86)\SearchProtect\bin\cltmng.exe

MSCONFIG\startupreg: AdobeUpdate => wscript "C:\Users\Lauren\AppData\Roaming\Adobe32\invis.vbs" "C:\Users\Lauren\AppData\Roaming\Adobe32\bat.exe"

:\Users\Lauren\AppData\Roaming\Adobe32

BootExecute: autocheck autochk * bootdeletesdnclean64.exe

MSCONFIG\startupreg: SDTray => "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe"

MSCONFIG\startupreg: Spybot-S&D Cleaning => "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDCleaner.exe" /autoclean

C:\Program Files (x86)\Spybot - Search & Destroy 2

Toolbar: HKCU - No Name - {00000000-0000-0000-0000-000000000000} - No File

S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X]

C:\Program Files\Enigma Software Group

SearchScopes: HKLM-x32 - DefaultScope value is missing.

Task: {0F79FDFB-C25B-4800-A74D-5C3FC3CFAEA9} - \DealPlyUpdate No Task File <==== ATTENTION

Task: {9E21C1EF-2A6E-4F59-B0F4-F161FCBDAA15} - \DealPly No Task File <==== ATTENTION

Task: {CFB8C104-6C3D-4A16-A42C-535C2B33BC7F} - \Desk 365 RunAsStdUser No Task File <==== ATTENTION

Task: {D32B59BD-1E3A-44EF-980D-4E1F87136440} - \LaunchApp No Task File <==== ATTENTION

Task: {EE1C3C45-5CCD-42D0-84F7-4C870EC55BE5} - \DTReg No Task File <==== ATTENTION

c:\users\lauren\downloads\bigfish-games---westward-+-crack.rar

AlternateDataStreams: C:\ProgramData\Temp:014BC3B4

AlternateDataStreams: C:\ProgramData\Temp:04ADB7A6

AlternateDataStreams: C:\ProgramData\Temp:059167AF

AlternateDataStreams: C:\ProgramData\Temp:05F547A9

AlternateDataStreams: C:\ProgramData\Temp:063969F8

AlternateDataStreams: C:\ProgramData\Temp:073139EC

AlternateDataStreams: C:\ProgramData\Temp:08DB8D99

AlternateDataStreams: C:\ProgramData\Temp:0C65EA0E

AlternateDataStreams: C:\ProgramData\Temp:0DFE2AE1

AlternateDataStreams: C:\ProgramData\Temp:0E5CFA74

AlternateDataStreams: C:\ProgramData\Temp:0E61938B

AlternateDataStreams: C:\ProgramData\Temp:1095ECE1

AlternateDataStreams: C:\ProgramData\Temp:10D45FC3

AlternateDataStreams: C:\ProgramData\Temp:12A012A1

AlternateDataStreams: C:\ProgramData\Temp:12EA4DC9

AlternateDataStreams: C:\ProgramData\Temp:14FA5E46

AlternateDataStreams: C:\ProgramData\Temp:16F2A6FF

AlternateDataStreams: C:\ProgramData\Temp:18897B1D

AlternateDataStreams: C:\ProgramData\Temp:1A4BF204

AlternateDataStreams: C:\ProgramData\Temp:1ADC4BD5

AlternateDataStreams: C:\ProgramData\Temp:1B3549F2

AlternateDataStreams: C:\ProgramData\Temp:1B9E79B3

AlternateDataStreams: C:\ProgramData\Temp:217A2A36

AlternateDataStreams: C:\ProgramData\Temp:2216A431

AlternateDataStreams: C:\ProgramData\Temp:27C3CD07

AlternateDataStreams: C:\ProgramData\Temp:29C0641D

AlternateDataStreams: C:\ProgramData\Temp:2CB9631F

AlternateDataStreams: C:\ProgramData\Temp:2CED8825

AlternateDataStreams: C:\ProgramData\Temp:2EB79F01

AlternateDataStreams: C:\ProgramData\Temp:302ECBD6

AlternateDataStreams: C:\ProgramData\Temp:30E0D641

AlternateDataStreams: C:\ProgramData\Temp:330E66BD

AlternateDataStreams: C:\ProgramData\Temp:33384BC0

AlternateDataStreams: C:\ProgramData\Temp:35629AE6

AlternateDataStreams: C:\ProgramData\Temp:36608448

AlternateDataStreams: C:\ProgramData\Temp:36A39835

AlternateDataStreams: C:\ProgramData\Temp:373E1720

AlternateDataStreams: C:\ProgramData\Temp:37994DBE

AlternateDataStreams: C:\ProgramData\Temp:38D2EA83

AlternateDataStreams: C:\ProgramData\Temp:38E2864F

AlternateDataStreams: C:\ProgramData\Temp:395F6776

AlternateDataStreams: C:\ProgramData\Temp:3B07E6F4

AlternateDataStreams: C:\ProgramData\Temp:3C0887BF

AlternateDataStreams: C:\ProgramData\Temp:4149A170

AlternateDataStreams: C:\ProgramData\Temp:436BE28C

AlternateDataStreams: C:\ProgramData\Temp:43E95997

AlternateDataStreams: C:\ProgramData\Temp:471AD3D0

AlternateDataStreams: C:\ProgramData\Temp:49EB0FDC

AlternateDataStreams: C:\ProgramData\Temp:4A966CC2

AlternateDataStreams: C:\ProgramData\Temp:4B244549

AlternateDataStreams: C:\ProgramData\Temp:4B6A9FDA

AlternateDataStreams: C:\ProgramData\Temp:4B70A9FA

AlternateDataStreams: C:\ProgramData\Temp:4C3504B5

AlternateDataStreams: C:\ProgramData\Temp:4EF94CF3

AlternateDataStreams: C:\ProgramData\Temp:4F96D8E6

AlternateDataStreams: C:\ProgramData\Temp:517B507A

AlternateDataStreams: C:\ProgramData\Temp:517DBC32

AlternateDataStreams: C:\ProgramData\Temp:52B3B2D1

AlternateDataStreams: C:\ProgramData\Temp:52E1DB1D

AlternateDataStreams: C:\ProgramData\Temp:54531C7D

AlternateDataStreams: C:\ProgramData\Temp:56C66609

AlternateDataStreams: C:\ProgramData\Temp:56F368C9

AlternateDataStreams: C:\ProgramData\Temp:57173DB4

AlternateDataStreams: C:\ProgramData\Temp:57619D72

AlternateDataStreams: C:\ProgramData\Temp:59846E5E

AlternateDataStreams: C:\ProgramData\Temp:5A8F8A0C

AlternateDataStreams: C:\ProgramData\Temp:5AE33054

AlternateDataStreams: C:\ProgramData\Temp:5C0940F1

AlternateDataStreams: C:\ProgramData\Temp:5C4A588B

AlternateDataStreams: C:\ProgramData\Temp:5DB4FD98

AlternateDataStreams: C:\ProgramData\Temp:5F1019FF

AlternateDataStreams: C:\ProgramData\Temp:60E0AB2A

AlternateDataStreams: C:\ProgramData\Temp:6301CE40

AlternateDataStreams: C:\ProgramData\Temp:639BB5E9

AlternateDataStreams: C:\ProgramData\Temp:640DDEFF

AlternateDataStreams: C:\ProgramData\Temp:68FC22BD

AlternateDataStreams: C:\ProgramData\Temp:69FE2EE4

AlternateDataStreams: C:\ProgramData\Temp:6CEC50B4

AlternateDataStreams: C:\ProgramData\Temp:6D5A15BF

AlternateDataStreams: C:\ProgramData\Temp:6E3C585B

AlternateDataStreams: C:\ProgramData\Temp:701B92FB

AlternateDataStreams: C:\ProgramData\Temp:708BB0FA

AlternateDataStreams: C:\ProgramData\Temp:73B78E79

AlternateDataStreams: C:\ProgramData\Temp:76466F4C

AlternateDataStreams: C:\ProgramData\Temp:7920E530

AlternateDataStreams: C:\ProgramData\Temp:7BB584AA

AlternateDataStreams: C:\ProgramData\Temp:7D288858

AlternateDataStreams: C:\ProgramData\Temp:7E4E56EA

AlternateDataStreams: C:\ProgramData\Temp:7ECD9621

AlternateDataStreams: C:\ProgramData\Temp:82756AB7

AlternateDataStreams: C:\ProgramData\Temp:84FA02E7

AlternateDataStreams: C:\ProgramData\Temp:884C7316

AlternateDataStreams: C:\ProgramData\Temp:8967C154

AlternateDataStreams: C:\ProgramData\Temp:896FF808

AlternateDataStreams: C:\ProgramData\Temp:8AA99C0C

AlternateDataStreams: C:\ProgramData\Temp:8AC20936

AlternateDataStreams: C:\ProgramData\Temp:8B3C3098

AlternateDataStreams: C:\ProgramData\Temp:8B69E3C3

AlternateDataStreams: C:\ProgramData\Temp:8C81B36D

AlternateDataStreams: C:\ProgramData\Temp:8DD36B71

AlternateDataStreams: C:\ProgramData\Temp:902C848D

AlternateDataStreams: C:\ProgramData\Temp:908A1B53

AlternateDataStreams: C:\ProgramData\Temp:933D54A9

AlternateDataStreams: C:\ProgramData\Temp:9547F1DB

AlternateDataStreams: C:\ProgramData\Temp:957E9765

AlternateDataStreams: C:\ProgramData\Temp:961B4D58

AlternateDataStreams: C:\ProgramData\Temp:96646EC1

AlternateDataStreams: C:\ProgramData\Temp:966CEAE7

AlternateDataStreams: C:\ProgramData\Temp:97B3B270

AlternateDataStreams: C:\ProgramData\Temp:9D5BB34A

AlternateDataStreams: C:\ProgramData\Temp:9E0656EC

AlternateDataStreams: C:\ProgramData\Temp:A0C7D68A

AlternateDataStreams: C:\ProgramData\Temp:A1023D41

AlternateDataStreams: C:\ProgramData\Temp:A17CCD03

AlternateDataStreams: C:\ProgramData\Temp:A1D3FEF0

AlternateDataStreams: C:\ProgramData\Temp:A2907225

AlternateDataStreams: C:\ProgramData\Temp:A2B3764A

AlternateDataStreams: C:\ProgramData\Temp:A3840F5B

AlternateDataStreams: C:\ProgramData\Temp:A3E39C6A

AlternateDataStreams: C:\ProgramData\Temp:A41FEAA2

AlternateDataStreams: C:\ProgramData\Temp:A5264343

AlternateDataStreams: C:\ProgramData\Temp:A69FAA24

AlternateDataStreams: C:\ProgramData\Temp:A7BB14DF

AlternateDataStreams: C:\ProgramData\Temp:A97FF73C

AlternateDataStreams: C:\ProgramData\Temp:A9ABA3FF

AlternateDataStreams: C:\ProgramData\Temp:AE289451

AlternateDataStreams: C:\ProgramData\Temp:B093E177

AlternateDataStreams: C:\ProgramData\Temp:B12D1A7D

AlternateDataStreams: C:\ProgramData\Temp:B285A50E

AlternateDataStreams: C:\ProgramData\Temp:B2D32F1D

AlternateDataStreams: C:\ProgramData\Temp:B3942462

AlternateDataStreams: C:\ProgramData\Temp:B3D50E25

AlternateDataStreams: C:\ProgramData\Temp:B722BCE5

AlternateDataStreams: C:\ProgramData\Temp:B761039D

AlternateDataStreams: C:\ProgramData\Temp:BA24E689

AlternateDataStreams: C:\ProgramData\Temp:BAC2F271

AlternateDataStreams: C:\ProgramData\Temp:BCDC6E07

AlternateDataStreams: C:\ProgramData\Temp:C0A2E219

AlternateDataStreams: C:\ProgramData\Temp:C69BA1D0

AlternateDataStreams: C:\ProgramData\Temp:C82210DD

AlternateDataStreams: C:\ProgramData\Temp:C86B29EB

AlternateDataStreams: C:\ProgramData\Temp:CB959782

AlternateDataStreams: C:\ProgramData\Temp:CC386FD2

AlternateDataStreams: C:\ProgramData\Temp:CC7382F6

AlternateDataStreams: C:\ProgramData\Temp:CC7738DB

AlternateDataStreams: C:\ProgramData\Temp:CE6885F1

AlternateDataStreams: C:\ProgramData\Temp:D0AB0B4A

AlternateDataStreams: C:\ProgramData\Temp:D254266B

AlternateDataStreams: C:\ProgramData\Temp:D8134D8F

AlternateDataStreams: C:\ProgramData\Temp:D987CB43

AlternateDataStreams: C:\ProgramData\Temp:D9987109

AlternateDataStreams: C:\ProgramData\Temp:DA18D4E3

AlternateDataStreams: C:\ProgramData\Temp:DCA79AB3

AlternateDataStreams: C:\ProgramData\Temp:DCB27118

AlternateDataStreams: C:\ProgramData\Temp:DDEB08FD

AlternateDataStreams: C:\ProgramData\Temp:DF30C7A6

AlternateDataStreams: C:\ProgramData\Temp:E0848D16

AlternateDataStreams: C:\ProgramData\Temp:E0AE69BE

AlternateDataStreams: C:\ProgramData\Temp:E153075C

AlternateDataStreams: C:\ProgramData\Temp:E6537A16

AlternateDataStreams: C:\ProgramData\Temp:E9900C74

AlternateDataStreams: C:\ProgramData\Temp:EA701346

AlternateDataStreams: C:\ProgramData\Temp:EA7D76BE

AlternateDataStreams: C:\ProgramData\Temp:EB333CFC

AlternateDataStreams: C:\ProgramData\Temp:EB5BDBB0

AlternateDataStreams: C:\ProgramData\Temp:EC0279DC

AlternateDataStreams: C:\ProgramData\Temp:ED9B661E

AlternateDataStreams: C:\ProgramData\Temp:EDE28CFC

AlternateDataStreams: C:\ProgramData\Temp:EE7AAC75

AlternateDataStreams: C:\ProgramData\Temp:EFECABA9

AlternateDataStreams: C:\ProgramData\Temp:F2327E82

AlternateDataStreams: C:\ProgramData\Temp:F422F8F1

AlternateDataStreams: C:\ProgramData\Temp:F5FC5DCE

AlternateDataStreams: C:\ProgramData\Temp:F67947AF

AlternateDataStreams: C:\ProgramData\Temp:F67AAFC5

end

*****************

C:\Program Files\Common Files\SpeedBit\SBUpdate\sbu.exe => No running process found

"HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{7F4EFF06-7032-458e-AE16-1C1D8255C28A}" => Key deleted successfully.

"HKCR\CLSID\{7F4EFF06-7032-458e-AE16-1C1D8255C28A}" => Key not found.

HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.

"HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{7F4EFF06-7032-458e-AE16-1C1D8255C28A}" => Key deleted successfully.

"HKCR\CLSID\{7F4EFF06-7032-458e-AE16-1C1D8255C28A}" => Key not found.

Firefox Keyword.URL deleted successfully.

Firefox DefaultSearchEngine deleted successfully.

SBUpd => Service deleted successfully.

C:\Windows\Tasks\SBW_UpdateTask_Time_323835363539383132302d2337785a326c5b3234342d41.job => Moved successfully.

"C:\Windows\Tasks\SBW_UpdateTask_Time_323835363539383132302d2337785a326c5b3234342d41.job" => File/Directory not found.

C:\Program Files\Common Files\SpeedBit\SBUpdate\sbci32.dll => Moved successfully.

SBUpdd => Service stopped successfully.

SBUpdd => Service deleted successfully.

"C:\Windows\Tasks\SBW_UpdateTask_Time_323835363539383132302d2337785a326c5b3234342d41.job" => File/Directory not found.

C:\Program Files\Common Files\SpeedBit => Moved successfully.

C:\ProgramData\SpeedBit => Moved successfully.

C:\Users\Lauren\AppData\Local\Torch\Update\TorchCrashHandler.exe => No running process found

TorchCrashHandler => Service not found.

"C:\ProgramData\TorchCrashHandler" => File/Directory not found.

C:\Users\Lauren\Downloads\TorchSetupk-r20-n-bc.exe => Moved successfully.

"C:\Users\Lauren\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Torch.lnk" => File/Directory not found.

C:\Users\Lauren\AppData\Local\Torch => Moved successfully.

HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run\\Exetender => value deleted successfully.

HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Run\\Exetender => value deleted successfully.

HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Run\\Exetender => value deleted successfully.

"HKLM\Software\Wow6432Node\MozillaPlugins\@exent.com/npExentCtl,version=7.0.0.0" => Key deleted successfully.

C:\Program Files (x86)\Free Ride Games\npExentCtl.dll not found.

"HKLM\Software\Wow6432Node\MozillaPlugins\www.exent.com/GameTreatWidget" => Key deleted successfully.

C:\Program Files (x86)\Free Ride Games\NPGameTreatPlugin.dll not found.

X5XSEx_Pr143 => Service deleted successfully.

"C:\Program Files (x86)\Free Ride Games" => File/Directory not found.

HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce\\HKU\.DEFAULT\...\RunOnce: [SpUninstallDeleteDir] => rmdir /s /q "\SearchProtect" => Value not found.

"HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{19E2B84A-76AB-4A61-83E6-7CD18211855F}" => Key deleted successfully.

"HKCR\CLSID\{19E2B84A-76AB-4A61-83E6-7CD18211855F}" => Key not found.

"HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{267BB848-E6E8-46A7-A0B6-8E0123B74611}" => Key deleted successfully.

"HKCR\CLSID\{267BB848-E6E8-46A7-A0B6-8E0123B74611}" => Key not found.

"HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{3F66891D-B10C-45FD-9D4A-226A6165CEFB}" => Key deleted successfully.

"HKCR\CLSID\{3F66891D-B10C-45FD-9D4A-226A6165CEFB}" => Key not found.

HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{37483B40-C254-4A72-BDA4-22EE90182C1E} => value deleted successfully.

"HKCR\CLSID\{37483B40-C254-4A72-BDA4-22EE90182C1E}" => Key not found.

"HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{3C3DCC02-C1F9-44CC-8A57-3EB6F6FA3376}" => Key deleted successfully.

"HKCR\CLSID\{3C3DCC02-C1F9-44CC-8A57-3EB6F6FA3376}" => Key not found.

HKCU\Software\Mozilla\Firefox\Extensions\\{193fe82a-c958-450c-8097-de926f5db967} => value deleted successfully.

"HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\npffmjkglbnioaoncpfmdbmehnbcldfh" => Key deleted successfully.

"C:\Program Files (x86)\LyricSing\130.crx" => File/Directory not found.

"C:\Program Files (x86)\LyricSing" => File/Directory not found.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{E7ABD842-895A-458B-A44F-8EE6CDC5B76F}" => Key deleted successfully.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{E7ABD842-895A-458B-A44F-8EE6CDC5B76F}" => Key deleted successfully.

C:\Windows\System32\Tasks\Updater21804.exe => Moved successfully.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Updater21804.exe" => Key deleted successfully.

"C:\Users\Lauren\AppData\Local\Updater21804" => File/Directory not found.

"HKLM\SOFTWARE\Policies\Google" => Key deleted successfully.

MSCONFIG\startupreg: Browser Infrastructure Helper => C:\Users\Lauren\AppData\Local\Smartbar\Application\SnapDo.exe startup => Error: No automatic fix found for this entry.

"C:\Users\Lauren\AppData\Local\Smartbar" => File/Directory not found.

"C:\Program Files (x86)\Conduit" => File/Directory not found.

MSCONFIG\startupreg: vProt => "C:\Program Files (x86)\AVG SafeGuard toolbar\vprot.exe" => Error: No automatic fix found for this entry.

"C:\Program Files (x86)\AVG SafeGuard toolbar" => File/Directory not found.

MSCONFIG\startupreg: SearchProtect => C:\Users\Lauren\AppData\Roaming\SearchProtect\bin\cltmng.exe => Error: No automatic fix found for this entry.

"C:\Users\Lauren\AppData\Roaming\SearchProtect" => File/Directory not found.

MSCONFIG\startupreg: SearchProtectAll => C:\Program Files (x86)\SearchProtect\bin\cltmng.exe => Error: No automatic fix found for this entry.

MSCONFIG\startupreg: AdobeUpdate => wscript "C:\Users\Lauren\AppData\Roaming\Adobe32\invis.vbs" "C:\Users\Lauren\AppData\Roaming\Adobe32\bat.exe" => Error: No automatic fix found for this entry.

:\Users\Lauren\AppData\Roaming\Adobe32 => Error: No automatic fix found for this entry.

HKLM\System\CurrentControlSet\Control\Session Manager\\BootExecute => Value was restored successfully.

MSCONFIG\startupreg: SDTray => "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe" => Error: No automatic fix found for this entry.

MSCONFIG\startupreg: Spybot-S&D Cleaning => "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDCleaner.exe" /autoclean => Error: No automatic fix found for this entry.

C:\Program Files (x86)\Spybot - Search & Destroy 2 => Moved successfully.

HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{00000000-0000-0000-0000-000000000000} => value deleted successfully.

"HKCR\CLSID\{00000000-0000-0000-0000-000000000000}" => Key not found.

esgiguard => Service deleted successfully.

C:\Program Files\Enigma Software Group => Moved successfully.

HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{0F79FDFB-C25B-4800-A74D-5C3FC3CFAEA9}" => Key deleted successfully.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{0F79FDFB-C25B-4800-A74D-5C3FC3CFAEA9}" => Key deleted successfully.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\DealPlyUpdate" => Key deleted successfully.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{9E21C1EF-2A6E-4F59-B0F4-F161FCBDAA15}" => Key deleted successfully.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{9E21C1EF-2A6E-4F59-B0F4-F161FCBDAA15}" => Key deleted successfully.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\DealPly" => Key deleted successfully.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{CFB8C104-6C3D-4A16-A42C-535C2B33BC7F}" => Key deleted successfully.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{CFB8C104-6C3D-4A16-A42C-535C2B33BC7F}" => Key deleted successfully.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Desk 365 RunAsStdUser" => Key deleted successfully.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{D32B59BD-1E3A-44EF-980D-4E1F87136440}" => Key deleted successfully.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{D32B59BD-1E3A-44EF-980D-4E1F87136440}" => Key deleted successfully.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\LaunchApp" => Key deleted successfully.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{EE1C3C45-5CCD-42D0-84F7-4C870EC55BE5}" => Key deleted successfully.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{EE1C3C45-5CCD-42D0-84F7-4C870EC55BE5}" => Key deleted successfully.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\DTReg" => Key deleted successfully.

c:\users\lauren\downloads\bigfish-games---westward-+-crack.rar => Moved successfully.

C:\ProgramData\Temp => ":014BC3B4" ADS removed successfully.

C:\ProgramData\Temp => ":04ADB7A6" ADS removed successfully.

C:\ProgramData\Temp => ":059167AF" ADS removed successfully.

C:\ProgramData\Temp => ":05F547A9" ADS removed successfully.

C:\ProgramData\Temp => ":063969F8" ADS removed successfully.

C:\ProgramData\Temp => ":073139EC" ADS removed successfully.

C:\ProgramData\Temp => ":08DB8D99" ADS removed successfully.

C:\ProgramData\Temp => ":0C65EA0E" ADS removed successfully.

C:\ProgramData\Temp => ":0DFE2AE1" ADS removed successfully.

C:\ProgramData\Temp => ":0E5CFA74" ADS removed successfully.

C:\ProgramData\Temp => ":0E61938B" ADS removed successfully.

C:\ProgramData\Temp => ":1095ECE1" ADS removed successfully.

C:\ProgramData\Temp => ":10D45FC3" ADS removed successfully.

C:\ProgramData\Temp => ":12A012A1" ADS removed successfully.

C:\ProgramData\Temp => ":12EA4DC9" ADS removed successfully.

C:\ProgramData\Temp => ":14FA5E46" ADS removed successfully.

C:\ProgramData\Temp => ":16F2A6FF" ADS removed successfully.

C:\ProgramData\Temp => ":18897B1D" ADS removed successfully.

C:\ProgramData\Temp => ":1A4BF204" ADS removed successfully.

C:\ProgramData\Temp => ":1ADC4BD5" ADS removed successfully.

C:\ProgramData\Temp => ":1B3549F2" ADS removed successfully.

C:\ProgramData\Temp => ":1B9E79B3" ADS removed successfully.

C:\ProgramData\Temp => ":217A2A36" ADS removed successfully.

C:\ProgramData\Temp => ":2216A431" ADS removed successfully.

C:\ProgramData\Temp => ":27C3CD07" ADS removed successfully.

C:\ProgramData\Temp => ":29C0641D" ADS removed successfully.

C:\ProgramData\Temp => ":2CB9631F" ADS removed successfully.

C:\ProgramData\Temp => ":2CED8825" ADS removed successfully.

C:\ProgramData\Temp => ":2EB79F01" ADS removed successfully.

C:\ProgramData\Temp => ":302ECBD6" ADS removed successfully.

C:\ProgramData\Temp => ":30E0D641" ADS removed successfully.

C:\ProgramData\Temp => ":330E66BD" ADS removed successfully.

C:\ProgramData\Temp => ":33384BC0" ADS removed successfully.

C:\ProgramData\Temp => ":35629AE6" ADS removed successfully.

C:\ProgramData\Temp => ":36608448" ADS removed successfully.

C:\ProgramData\Temp => ":36A39835" ADS removed successfully.

C:\ProgramData\Temp => ":373E1720" ADS removed successfully.

C:\ProgramData\Temp => ":37994DBE" ADS removed successfully.

C:\ProgramData\Temp => ":38D2EA83" ADS removed successfully.

C:\ProgramData\Temp => ":38E2864F" ADS removed successfully.

C:\ProgramData\Temp => ":395F6776" ADS removed successfully.

C:\ProgramData\Temp => ":3B07E6F4" ADS removed successfully.

C:\ProgramData\Temp => ":3C0887BF" ADS removed successfully.

C:\ProgramData\Temp => ":4149A170" ADS removed successfully.

C:\ProgramData\Temp => ":436BE28C" ADS removed successfully.

C:\ProgramData\Temp => ":43E95997" ADS removed successfully.

C:\ProgramData\Temp => ":471AD3D0" ADS removed successfully.

C:\ProgramData\Temp => ":49EB0FDC" ADS removed successfully.

C:\ProgramData\Temp => ":4A966CC2" ADS removed successfully.

C:\ProgramData\Temp => ":4B244549" ADS removed successfully.

C:\ProgramData\Temp => ":4B6A9FDA" ADS removed successfully.

C:\ProgramData\Temp => ":4B70A9FA" ADS removed successfully.

C:\ProgramData\Temp => ":4C3504B5" ADS removed successfully.

C:\ProgramData\Temp => ":4EF94CF3" ADS removed successfully.

C:\ProgramData\Temp => ":4F96D8E6" ADS removed successfully.

C:\ProgramData\Temp => ":517B507A" ADS removed successfully.

C:\ProgramData\Temp => ":517DBC32" ADS removed successfully.

C:\ProgramData\Temp => ":52B3B2D1" ADS removed successfully.

C:\ProgramData\Temp => ":52E1DB1D" ADS removed successfully.

C:\ProgramData\Temp => ":54531C7D" ADS removed successfully.

C:\ProgramData\Temp => ":56C66609" ADS removed successfully.

C:\ProgramData\Temp => ":56F368C9" ADS removed successfully.

C:\ProgramData\Temp => ":57173DB4" ADS removed successfully.

C:\ProgramData\Temp => ":57619D72" ADS removed successfully.

C:\ProgramData\Temp => ":59846E5E" ADS removed successfully.

C:\ProgramData\Temp => ":5A8F8A0C" ADS removed successfully.

C:\ProgramData\Temp => ":5AE33054" ADS removed successfully.

C:\ProgramData\Temp => ":5C0940F1" ADS removed successfully.

C:\ProgramData\Temp => ":5C4A588B" ADS removed successfully.

C:\ProgramData\Temp => ":5DB4FD98" ADS removed successfully.

C:\ProgramData\Temp => ":5F1019FF" ADS removed successfully.

C:\ProgramData\Temp => ":60E0AB2A" ADS removed successfully.

C:\ProgramData\Temp => ":6301CE40" ADS removed successfully.

C:\ProgramData\Temp => ":639BB5E9" ADS removed successfully.

C:\ProgramData\Temp => ":640DDEFF" ADS removed successfully.

C:\ProgramData\Temp => ":68FC22BD" ADS removed successfully.

C:\ProgramData\Temp => ":69FE2EE4" ADS removed successfully.

C:\ProgramData\Temp => ":6CEC50B4" ADS removed successfully.

C:\ProgramData\Temp => ":6D5A15BF" ADS removed successfully.

C:\ProgramData\Temp => ":6E3C585B" ADS removed successfully.

C:\ProgramData\Temp => ":701B92FB" ADS removed successfully.

C:\ProgramData\Temp => ":708BB0FA" ADS removed successfully.

C:\ProgramData\Temp => ":73B78E79" ADS removed successfully.

C:\ProgramData\Temp => ":76466F4C" ADS removed successfully.

C:\ProgramData\Temp => ":7920E530" ADS removed successfully.

C:\ProgramData\Temp => ":7BB584AA" ADS removed successfully.

C:\ProgramData\Temp => ":7D288858" ADS removed successfully.

C:\ProgramData\Temp => ":7E4E56EA" ADS removed successfully.

C:\ProgramData\Temp => ":7ECD9621" ADS removed successfully.

C:\ProgramData\Temp => ":82756AB7" ADS removed successfully.

C:\ProgramData\Temp => ":84FA02E7" ADS removed successfully.

C:\ProgramData\Temp => ":884C7316" ADS removed successfully.

C:\ProgramData\Temp => ":8967C154" ADS removed successfully.

C:\ProgramData\Temp => ":896FF808" ADS removed successfully.

C:\ProgramData\Temp => ":8AA99C0C" ADS removed successfully.

C:\ProgramData\Temp => ":8AC20936" ADS removed successfully.

C:\ProgramData\Temp => ":8B3C3098" ADS removed successfully.

C:\ProgramData\Temp => ":8B69E3C3" ADS removed successfully.

C:\ProgramData\Temp => ":8C81B36D" ADS removed successfully.

C:\ProgramData\Temp => ":8DD36B71" ADS removed successfully.

C:\ProgramData\Temp => ":902C848D" ADS removed successfully.

C:\ProgramData\Temp => ":908A1B53" ADS removed successfully.

C:\ProgramData\Temp => ":933D54A9" ADS removed successfully.

C:\ProgramData\Temp => ":9547F1DB" ADS removed successfully.

C:\ProgramData\Temp => ":957E9765" ADS removed successfully.

C:\ProgramData\Temp => ":961B4D58" ADS removed successfully.

C:\ProgramData\Temp => ":96646EC1" ADS removed successfully.

C:\ProgramData\Temp => ":966CEAE7" ADS removed successfully.

C:\ProgramData\Temp => ":97B3B270" ADS removed successfully.

C:\ProgramData\Temp => ":9D5BB34A" ADS removed successfully.

C:\ProgramData\Temp => ":9E0656EC" ADS removed successfully.

C:\ProgramData\Temp => ":A0C7D68A" ADS removed successfully.

C:\ProgramData\Temp => ":A1023D41" ADS removed successfully.

C:\ProgramData\Temp => ":A17CCD03" ADS removed successfully.

C:\ProgramData\Temp => ":A1D3FEF0" ADS removed successfully.

C:\ProgramData\Temp => ":A2907225" ADS removed successfully.

C:\ProgramData\Temp => ":A2B3764A" ADS removed successfully.

C:\ProgramData\Temp => ":A3840F5B" ADS removed successfully.

C:\ProgramData\Temp => ":A3E39C6A" ADS removed successfully.

C:\ProgramData\Temp => ":A41FEAA2" ADS removed successfully.

C:\ProgramData\Temp => ":A5264343" ADS removed successfully.

C:\ProgramData\Temp => ":A69FAA24" ADS removed successfully.

C:\ProgramData\Temp => ":A7BB14DF" ADS removed successfully.

C:\ProgramData\Temp => ":A97FF73C" ADS removed successfully.

C:\ProgramData\Temp => ":A9ABA3FF" ADS removed successfully.

C:\ProgramData\Temp => ":AE289451" ADS removed successfully.

C:\ProgramData\Temp => ":B093E177" ADS removed successfully.

C:\ProgramData\Temp => ":B12D1A7D" ADS removed successfully.

C:\ProgramData\Temp => ":B285A50E" ADS removed successfully.

C:\ProgramData\Temp => ":B2D32F1D" ADS removed successfully.

C:\ProgramData\Temp => ":B3942462" ADS removed successfully.

C:\ProgramData\Temp => ":B3D50E25" ADS removed successfully.

C:\ProgramData\Temp => ":B722BCE5" ADS removed successfully.

C:\ProgramData\Temp => ":B761039D" ADS removed successfully.

C:\ProgramData\Temp => ":BA24E689" ADS removed successfully.

C:\ProgramData\Temp => ":BAC2F271" ADS removed successfully.

C:\ProgramData\Temp => ":BCDC6E07" ADS removed successfully.

C:\ProgramData\Temp => ":C0A2E219" ADS removed successfully.

C:\ProgramData\Temp => ":C69BA1D0" ADS removed successfully.

C:\ProgramData\Temp => ":C82210DD" ADS removed successfully.

C:\ProgramData\Temp => ":C86B29EB" ADS removed successfully.

C:\ProgramData\Temp => ":CB959782" ADS removed successfully.

C:\ProgramData\Temp => ":CC386FD2" ADS removed successfully.

C:\ProgramData\Temp => ":CC7382F6" ADS removed successfully.

C:\ProgramData\Temp => ":CC7738DB" ADS removed successfully.

C:\ProgramData\Temp => ":CE6885F1" ADS removed successfully.

C:\ProgramData\Temp => ":D0AB0B4A" ADS removed successfully.

C:\ProgramData\Temp => ":D254266B" ADS removed successfully.

C:\ProgramData\Temp => ":D8134D8F" ADS removed successfully.

C:\ProgramData\Temp => ":D987CB43" ADS removed successfully.

C:\ProgramData\Temp => ":D9987109" ADS removed successfully.

C:\ProgramData\Temp => ":DA18D4E3" ADS removed successfully.

C:\ProgramData\Temp => ":DCA79AB3" ADS removed successfully.

C:\ProgramData\Temp => ":DCB27118" ADS removed successfully.

C:\ProgramData\Temp => ":DDEB08FD" ADS removed successfully.

C:\ProgramData\Temp => ":DF30C7A6" ADS removed successfully.

C:\ProgramData\Temp => ":E0848D16" ADS removed successfully.

C:\ProgramData\Temp => ":E0AE69BE" ADS removed successfully.

C:\ProgramData\Temp => ":E153075C" ADS removed successfully.

C:\ProgramData\Temp => ":E6537A16" ADS removed successfully.

C:\ProgramData\Temp => ":E9900C74" ADS removed successfully.

C:\ProgramData\Temp => ":EA701346" ADS removed successfully.

C:\ProgramData\Temp => ":EA7D76BE" ADS removed successfully.

C:\ProgramData\Temp => ":EB333CFC" ADS removed successfully.

C:\ProgramData\Temp => ":EB5BDBB0" ADS removed successfully.

C:\ProgramData\Temp => ":EC0279DC" ADS removed successfully.

C:\ProgramData\Temp => ":ED9B661E" ADS removed successfully.

C:\ProgramData\Temp => ":EDE28CFC" ADS removed successfully.

C:\ProgramData\Temp => ":EE7AAC75" ADS removed successfully.

C:\ProgramData\Temp => ":EFECABA9" ADS removed successfully.

C:\ProgramData\Temp => ":F2327E82" ADS removed successfully.

C:\ProgramData\Temp => ":F422F8F1" ADS removed successfully.

C:\ProgramData\Temp => ":F5FC5DCE" ADS removed successfully.

C:\ProgramData\Temp => ":F67947AF" ADS removed successfully.

C:\ProgramData\Temp => ":F67AAFC5" ADS removed successfully.

==== End of Fixlog ====

3. Chrome: - Resetted

4. VirusTotal URL's:

C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe: https://www.virustot...sis/1406564811/

C:\Windows\SysWOW64\schdiphlp.exe - File not found
C:\Users\Lauren\AppData\Roaming\10522Hagsclub launcher.exe: File not Found

#17
LiquidTension

Posted 28 July 2014 - 03:00 PM

Expert

Expert
1,151 posts

Hi Triskelion,

hope you had a great weekend.

Thank you; albeit not so great. Moving house is always stressful.

Please do the following:

STEP 1
Windows Explorer

Press the Windows Key + r on your keyboard at the same time. Type Explorer and click OK.
In the Search bar, type schdiphlp.exe and allow the search to fully complete.
If found, please right-click the file and click Copy. Navigate back to your Desktop, right-click your Desktop and click Paste.
Do the same for the 10522Hagsclub launcher.exe file.
If you've been able to copy/paste the files to your Desktop, please repeat the VirusTotal step, only this time selecting the files copied to your Desktop.

STEP 2
AdwCleaner

Please download AdwCleaner and save the file to your desktop.
Right-Click AdwCleaner.exe and select Run as administrator to run the programme.
Follow the prompts.
Click Scan.
Upon completion, click Report. A log (AdwCleaner[R0].txt) will open. Briefly check the log for anything you know to be legitimate.
Ensure anything you know to be legitimate does not have a checkmark, and click Clean.
Follow the prompts and allow your computer to reboot.
After rebooting, a log (AdwCleaner[S0].txt) will open. Copy the contents of the log and paste in your next reply.

-- File and registry key backups are made for anything removed using this tool. Should a legitimate entry be removed (otherwise known as a 'false-positive'), simple steps can be taken to restore the entry. Please do not overly concern yourself with the contents of AdwCleaner[R0].txt.

STEP 3
Junkware Removal Tool (JRT)

Please download Junkware Removal Tool and save the file to your desktop.
Note: If you unchecked any items in AdwCleaner, please backup the associated folders/files to a USB drive.
Temporarily disable your anti-virus software. For instructions, please refer to the following link.
Right-Click JRT.exe and select Run as administrator to run the programme.
Follow the prompts and allow the scan to run uninterrupted.
Upon completion, a log (JRT.txt) will open on your desktop.
Re-enable your anti-virus software.
Copy the contents of JRT.txt and paste in your next reply.

STEP 4
Farbar Recovery Scan Tool (FRST) Scan

Right-Click FRST64.exe and select Run as administrator to run the programme.
Click Yes to the disclaimer.
Ensure the Addition.txt box is checked.
Click the Scan button and let the programme run.
Upon completion, click OK, then OK on the Addition.txt pop up screen.
Two logs (FRST.txt & Addition.txt) will now be open on your desktop. Copy the contents of both logs and paste in your next reply.

======================================================

STEP 5
Logs
In your next reply please include the following logs. Please be sure to copy and paste the requested logs, as well as provide information on any questions I may have asked.

Could you find the files using Windows Explorer?
(VirusTotal results)
AdwCleaner[S0].txt
JRT.txt
FRST.txt
Addition.txt

#18
Triskelion

Posted 28 July 2014 - 06:13 PM

Member

Topic Starter
Member
663 posts

Hey Adam;

So I still could not find those two files, even using Explorer. the only record of them in the search was in an Addition.txt file that was left over.

AdwCleaner:

# AdwCleaner v3.301 - Report created 28/07/2014 at 17:47:22

# Updated 28/07/2014 by Xplode

# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)

# Username : Lauren - LAUREN-HP

# Running from : C:\Users\Lauren\Desktop\AdwCleaner.exe

# Option : Clean

***** [ Services ] *****

***** [ Files / Folders ] *****

Folder Deleted : C:\ProgramData\NCH Software

Folder Deleted : C:\ProgramData\Trymedia

Folder Deleted : C:\Program Files (x86)\NCH Software

Folder Deleted : C:\Users\Lauren\AppData\Local\Temp\OCS

File Deleted : C:\Windows\SysWOW64\RegistryHelperLM.ocx

File Deleted : C:\Users\Lauren\AppData\Local\Temp\Uninstall.exe

***** [ Scheduled Tasks ] *****

***** [ Shortcuts ] *****

***** [ Registry ] *****

Key Deleted : HKCU\Software\Google\Chrome\Extensions\klibnahbojhkanfgaglnlalfkgpcppfi

Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\klibnahbojhkanfgaglnlalfkgpcppfi

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\biclient_RASAPI32

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\biclient_RASMANCS

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\mconduitinstaller_RASAPI32

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\mconduitinstaller_RASMANCS

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\WajamInternetEnhancer_RASAPI32

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\WajamInternetEnhancer_RASMANCS

Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}

Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{2318C2B1-4965-11D4-9B18-009027A5CD4F}]

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}

Key Deleted : HKCU\Software\OCS

Key Deleted : HKCU\Software\Softonic

Key Deleted : HKCU\Software\torch

Key Deleted : HKLM\Software\SweetIM

Key Deleted : HKLM\Software\torch

Key Deleted : HKLM\Software\Trymedia Systems

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.16428

-\\ Mozilla Firefox v30.0 (en-US)

[ File : C:\Users\Lauren\AppData\Roaming\Mozilla\Firefox\Profiles\no6ndkj8.default\prefs.js ]

[ File : C:\Users\Lauren\AppData\Roaming\Mozilla\Firefox\Profiles\[opt]rs0\prefs.js ]

-\\ Google Chrome v36.0.1985.125

[ File : C:\Users\Lauren\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Deleted [Search Provider] : hxxp://www.ask.com/web?q={searchTerms}

Deleted [Search Provider] : hxxp://go.speedbit.com/search.aspx?s=Unknown&q={searchTerms}

*************************

AdwCleaner[R0].txt - [28404 octets] - [21/03/2014 18:28:44]

AdwCleaner[R1].txt - [18969 octets] - [21/03/2014 18:33:18]

AdwCleaner[R2].txt - [4967 octets] - [02/04/2014 17:26:44]

AdwCleaner[R3].txt - [3388 octets] - [06/04/2014 20:13:02]

AdwCleaner[R4].txt - [1912 octets] - [07/04/2014 19:17:07]

AdwCleaner[R5].txt - [1913 octets] - [07/04/2014 19:17:38]

AdwCleaner[R6].txt - [2961 octets] - [14/04/2014 18:27:15]

AdwCleaner[R7].txt - [6085 octets] - [02/05/2014 10:49:47]

AdwCleaner[R8].txt - [3555 octets] - [28/07/2014 17:02:37]

AdwCleaner[R9].txt - [3615 octets] - [28/07/2014 17:43:15]

AdwCleaner[S0].txt - [3303 octets] - [21/03/2014 18:29:51]

AdwCleaner[S1].txt - [17008 octets] - [21/03/2014 18:33:46]

AdwCleaner[S2].txt - [4493 octets] - [02/04/2014 17:33:55]

AdwCleaner[S3].txt - [3302 octets] - [06/04/2014 20:14:06]

AdwCleaner[S4].txt - [2765 octets] - [14/04/2014 18:28:06]

AdwCleaner[S5].txt - [5706 octets] - [02/05/2014 10:51:49]

AdwCleaner[S6].txt - [3505 octets] - [28/07/2014 17:47:22]

########## EOF - C:\AdwCleaner\AdwCleaner[S6].txt - [3565 octets] ##########

JRT:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 6.1.4 (04.06.2014:1)

OS: Windows 7 Home Premium x64

Ran by Lauren on 28/07/2014 at 17:56:38.20

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Registry Values

~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\AppDataLow\software\lyricsing

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1BB8B3AE-757D-443F-B3A4-0629E709B0D9}

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-1437321509-492886448-564446639-1000\Software\sweetim

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110211181104}

~~~ Files

Successfully deleted: [File] C:\Windows\syswow64\sho2542.tmp

Successfully deleted: [File] C:\Windows\syswow64\sho3028.tmp

Successfully deleted: [File] C:\Windows\syswow64\sho88A7.tmp

Successfully deleted: [File] C:\Windows\syswow64\shoB92A.tmp

Successfully deleted: [File] C:\Windows\syswow64\shoBD0E.tmp

Successfully deleted: [File] C:\Windows\syswow64\shoEFD1.tmp

~~~ Folders

Successfully deleted: [Folder] "C:\ProgramData\big fish"

Successfully deleted: [Folder] "C:\ProgramData\big fish games"

Successfully deleted: [Folder] "C:\Users\Lauren\appdata\locallow\visualbee_v.1"

Successfully deleted: [Folder] "C:\bigfishcache"

Successfully deleted: [Empty Folder] C:\Users\Lauren\appdata\local\{02EAEC45-E96F-464D-A0EE-33B4BEB1B4B1}

Successfully deleted: [Empty Folder] C:\Users\Lauren\appdata\local\{06BD0390-E3F7-4D4F-9333-2AFF9A0047EC}

Successfully deleted: [Empty Folder] C:\Users\Lauren\appdata\local\{0878F1F2-3C9E-4D65-8683-7210647B4831}

Successfully deleted: [Empty Folder] C:\Users\Lauren\appdata\local\{346056EA-D733-45B7-8C45-527D53CB8A5F}

Successfully deleted: [Empty Folder] C:\Users\Lauren\appdata\local\{4E23064B-B310-4DEE-BBF6-687C9A805504}

Successfully deleted: [Empty Folder] C:\Users\Lauren\appdata\local\{565300DA-E3AB-412F-8889-511EBE5A64B1}

Successfully deleted: [Empty Folder] C:\Users\Lauren\appdata\local\{8D6B6982-0B17-43AA-8602-9744123E179D}

Successfully deleted: [Empty Folder] C:\Users\Lauren\appdata\local\{91158E57-D1A7-482C-88C6-DB5082F7FC45}

Successfully deleted: [Empty Folder] C:\Users\Lauren\appdata\local\{91E99FC8-F60C-48EC-BF92-FFDF34304ED4}

Successfully deleted: [Empty Folder] C:\Users\Lauren\appdata\local\{ABA9C7AE-5346-46C3-811D-56DC680EF401}

Successfully deleted: [Empty Folder] C:\Users\Lauren\appdata\local\{B398720D-473A-443E-9F5B-1EAEFE8DAE7B}

Successfully deleted: [Empty Folder] C:\Users\Lauren\appdata\local\{D18A9CFC-159E-4D4A-BC47-5485D0CA12D8}

Successfully deleted: [Empty Folder] C:\Users\Lauren\appdata\local\{F0F9AF42-CEF7-42AC-9700-8D809B8B7DA3}

~~~ Event Viewer Logs were cleared

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on 28/07/2014 at 18:04:36.93

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

FRST:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 26-07-2014

Ran by Lauren (administrator) on LAUREN-HP on 28-07-2014 18:05:57

Running from C:\Users\Lauren\Desktop

Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: English (United States)

Internet Explorer Version 11

Boot Mode: Normal

The only official download link for FRST:

Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/

Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/

Download link from any site other than Bleeping Computer is unpermitted or outdated.

See tutorial for FRST: http://www.geekstogo...very-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(HP) C:\Program Files (x86)\HP SimplePass 2011\TrueSuiteService.exe

(Hewlett-Packard Company) C:\Windows\System32\hpservice.exe

(Microsoft Corporation) C:\Windows\System32\wlanext.exe

(Andrea Electronics Corporation) C:\Program Files\IDT\WDM\AESTSr64.exe

(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe

(Intel® Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe

(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe

(HP) C:\Program Files (x86)\HP SimplePass 2011\TouchControl.exe

(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe

(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe

(HP) C:\Program Files (x86)\HP SimplePass 2011\BioMonitor.exe

(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe

(Hi-Rez Studios) C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe

(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe

(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe

(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe

(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe

() C:\Windows\SysWOW64\PnkBstrA.exe

(Intel® Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe

(Razer Inc.) C:\Program Files (x86)\Razer\Razer Game Booster\RzKLService.exe

(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE

(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE

(Microsoft Corporation) C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgui.exe

(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe

(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [XboxStat] => C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe [825184 2009-09-30] (Microsoft Corporation)

HKLM\...\Run: [IntelPAN] => C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe [1935120 2011-05-02] (Intel® Corporation)

HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [1128448 2011-05-27] (IDT, Inc.)

HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch

HKLM-x32\...\Run: [AVG_UI] => C:\Program Files (x86)\AVG\AVG2014\avgui.exe [5179408 2014-06-17] (AVG Technologies CZ, s.r.o.)

HKLM-x32\...\Run: [amd_dc_opt] => C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe [77824 2008-07-22] (AMD)

HKLM\...\RunOnce: [NCPluginUpdater] => C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\NCPluginUpdater.exe [21720 2014-04-08] (Hewlett-Packard)

Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)

HKLM\...\Policies\Explorer: [NoControlPanel] 0

HKU\.DEFAULT\...\RunOnce: [SpUninstallDeleteDir] => rmdir /s /q "\SearchProtect"

HKU\S-1-5-19\...\RunOnce: [mctadmin] => C:\Windows\System32\mctadmin.exe [97280 2009-07-13] (Microsoft Corporation)

HKU\S-1-5-20\...\RunOnce: [mctadmin] => C:\Windows\System32\mctadmin.exe [97280 2009-07-13] (Microsoft Corporation)

HKU\S-1-5-21-1437321509-492886448-564446639-1000\...\Policies\system: [EnableLUA] 0

ShellIconOverlayIdentifiers: SkyDrivePro1 (ErrorConflict) -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers: SkyDrivePro2 (SyncInProgress) -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers: SkyDrivePro3 (InSync) -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers: GDriveBlacklistedOverlay -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll (Google)

ShellIconOverlayIdentifiers: GDriveSharedEditOverlay -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll (Google)

ShellIconOverlayIdentifiers: GDriveSharedViewOverlay -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll (Google)

ShellIconOverlayIdentifiers: GDriveSyncedOverlay -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll (Google)

ShellIconOverlayIdentifiers: GDriveSyncingOverlay -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll (Google)

ShellIconOverlayIdentifiers-x32: SkyDrivePro1 (ErrorConflict) -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers-x32: SkyDrivePro2 (SyncInProgress) -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers-x32: SkyDrivePro3 (InSync) -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/HPCON/4

SearchScopes: HKLM - {67BEB0E5-6B31-4D2E-A769-000C5FA712E0} URL = http://www.amazon.ca...s={searchTerms}

SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =

SearchScopes: HKCU - {803427AC-4E9B-4306-ABCD-EB550F28BAD9} URL = http://ca.search.yah...p={SearchTerms}

BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)

BHO: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO: TrueSuite Website Log On -> {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} -> C:\Program Files (x86)\HP SimplePass 2011\x64\IEBHO.dll (HP)

BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO: Skype add-on for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)

BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)

BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)

BHO: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll (Hewlett-Packard)

BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\Office15\OCHelper.dll (Microsoft Corporation)

BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: TrueSuite Website Log On -> {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} -> C:\Program Files (x86)\HP SimplePass 2011\IEBHO.dll (HP)

BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO-x32: Skype Browser Helper -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)

BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\Office15\URLREDIR.DLL (Microsoft Corporation)

BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation)

BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)

Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File

DPF: HKLM-x32 {33704B0F-9EB7-434B-B752-EA6CFFB87423} http://192.168.1.81/JpegInst.cab

DPF: HKLM-x32 {6A060448-60F9-11D5-A6CD-0002B31F7455}

Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)

Handler-x32: intu-tt2012 - {02F985EF-502B-4597-993F-6BF9E004C138} - C:\Program Files (x86)\TurboTax 2012\ic2012pp.dll (Intuit Canada, a general partnership/une société en nom collectif.)

Handler-x32: intu-tt2013 - {9FF5EC07-1645-43BF-828F-C73CFA7BC1AF} - C:\Program Files (x86)\TurboTax 2013\ic2013pp.dll (Intuit Canada, a general partnership/une société en nom collectif.)

Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation)

Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.254 75.153.176.9

Tcpip\..\Interfaces\{2B725F0B-F1CB-4FDD-B78A-022C5481E817}: [NameServer]8.8.8.8,8.8.4.4

FireFox:

========

FF ProfilePath: C:\Users\Lauren\AppData\Roaming\Mozilla\Firefox\Profiles\no6ndkj8.default

FF SelectedSearchEngine: user_pref("browser.search.selectedEngine", "");

FF Homepage: user_pref("browser.startup.homepage", "");

FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_145.dll ()

FF Plugin: @java.com/DTPlugin,version=10.55.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin: @microsoft.com/GENUINE - disabled No File

FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll ()

FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw.dll No File

FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()

FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @microsoft.com/GENUINE - disabled No File

FF Plugin-x32: @microsoft.com/Lync,version=15.0 - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin HKCU: @nsroblox.roblox.com/launcher - C:\Users\Lauren\AppData\Local\Roblox\Versions\version-459b702c887942d4\\NPRobloxProxy.dll ( ROBLOX Corporation)

FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\Lauren\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)

FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll ()

FF Extension: TrueSuite Website Logon - C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected] [2014-07-21]

FF HKLM-x32\...\Firefox\Extensions: [[email protected]] - C:\Program Files (x86)\Hewlett-Packard\SmartPrint\QPExtension

FF Extension: SmartPrintButton - C:\Program Files (x86)\Hewlett-Packard\SmartPrint\QPExtension [2012-05-21]

FF HKLM-x32\...\Thunderbird\Extensions: [[email protected]] - C:\Program Files\McAfee\MSK

Chrome:

=======

CHR HomePage: hxxp://www.google.com

CHR StartupUrls: "hxxp://google.ca/"

CHR DefaultSearchKeyword:

CHR DefaultSearchProvider:

CHR DefaultSearchURL:

CHR Plugin: (Widevine Content Decryption Module) - C:\Users\Lauren\AppData\Local\Google\Chrome\User Data\WidevineCDM\1.4.4.600\_platform_specific\win_x86\widevinecdmadapter.dll ()

CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\36.0.1985.125\PepperFlash\pepflashplayer.dll ()

CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer

CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\36.0.1985.125\ppGoogleNaClPluginChrome.dll ()

CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\36.0.1985.125\pdf.dll ()

CHR Plugin: (EA Battlefield Heroes Updater) - C:\Users\Lauren\AppData\Local\Google\Chrome\User Data\Default\Extensions\cehdakiococlfmjcbebbkjkfjhbieknh\5.0.203.0_0\npBFHUpdater.dll (EA Digital Illusions CE AB)

CHR Plugin: (QuickTime Plug-in 7.7.5) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.7.5) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.7.5) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.7.5) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.7.5) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll (Apple Inc.)

CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

CHR Plugin: (ESN Launch Mozilla Plugin) - C:\Program Files (x86)\Battlelog Web Plugins\2.3.0\npesnlaunch.dll No File

CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

CHR Plugin: (Java Deployment Toolkit 7.0.510.13) - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

CHR Plugin: (Java™ Platform SE 7 U51) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

CHR Plugin: (WildTangent Games App V2 Presence Detector) - C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\7\NP_wtapp.dll No File

CHR Plugin: (Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

CHR Plugin: (iTunes Application Detector) - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()

CHR Plugin: (Microsoft Office 2013) - C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)

CHR Plugin: (Microsoft Office 2013) - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll (Microsoft Corporation)

CHR Plugin: (Unity Player) - C:\Users\Lauren\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)

CHR Plugin: (Roblox Launcher Plugin) - C:\Users\Lauren\AppData\Local\Roblox\Versions\version-459b702c887942d4\\NPRobloxProxy.dll ( ROBLOX Corporation)

CHR Plugin: (VLC Web Plugin) - C:\Users\Lauren\AppData\Local\Torch\Plugins\Video\VLC\npvlc.dll No File

CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll ()

CHR Plugin: (Shockwave for Director) - C:\Windows\system32\Adobe\Director\np32dsw.dll No File

CHR Extension: (From Dust) - C:\Users\Lauren\AppData\Local\Google\Chrome\User Data\Default\Extensions\anelkojiepicmcldgnmkplocifmegpfj [2014-02-05]

CHR Extension: (Google Drive) - C:\Users\Lauren\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-01-07]

CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Lauren\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-05-22]

CHR Extension: (YouTube) - C:\Users\Lauren\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-01-07]

CHR Extension: (Battlefield Heroes) - C:\Users\Lauren\AppData\Local\Google\Chrome\User Data\Default\Extensions\cehdakiococlfmjcbebbkjkfjhbieknh [2014-04-19]

CHR Extension: (Kingdom Rush) - C:\Users\Lauren\AppData\Local\Google\Chrome\User Data\Default\Extensions\ckmfhhjalnddapegkbbohfaodgbnocim [2014-03-21]

CHR Extension: (Search) - C:\Users\Lauren\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-01-07]

CHR Extension: (AdBlock) - C:\Users\Lauren\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2014-04-26]

CHR Extension: (Skyrama) - C:\Users\Lauren\AppData\Local\Google\Chrome\User Data\Default\Extensions\jlehaidnnmjjkhgbbiombcdifogolhap [2014-03-21]

CHR Extension: (Ashish Mishra) - C:\Users\Lauren\AppData\Local\Google\Chrome\User Data\Default\Extensions\lnkdbjbjpnpjeciipoaflmpcddinpjjp [2014-04-26]

CHR Extension: (Google Wallet) - C:\Users\Lauren\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-01-07]

CHR Extension: (VEGA Conflict) - C:\Users\Lauren\AppData\Local\Google\Chrome\User Data\Default\Extensions\ojnhjmhhejnacfimcjhjbcphfnndhfec [2014-02-05]

CHR Extension: (Gmail) - C:\Users\Lauren\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-01-07]

CHR HKCU\...\Chrome\Extension: [cgiaikfpllchefojlnehlmpekeogihnm] - C:\Users\Lauren\AppData\Local\CRE\cgiaikfpllchefojlnehlmpekeogihnm.crx [2014-01-07]

CHR HKCU\...\Chrome\Extension: [cpoooaodibfldhiobnmnjliddplmekeb] - C:\Users\Lauren\AppData\Local\CRE\cpoooaodibfldhiobnmnjliddplmekeb.crx [2013-09-08]

CHR HKCU\...\Chrome\Extension: [dnmlhhbehhdmajijfenoldcajelckpmn] - C:\Users\Lauren\AppData\Local\CRE\dnmlhhbehhdmajijfenoldcajelckpmn.crx [2013-09-08]

CHR HKCU\...\Chrome\Extension: [edfllcfghbogdahicgpcmnmkgpcmdjeo] - C:\Users\Lauren\AppData\Local\CRE\edfllcfghbogdahicgpcmnmkgpcmdjeo.crx [2013-09-08]

CHR HKLM-x32\...\Chrome\Extension: [cgiaikfpllchefojlnehlmpekeogihnm] - C:\Users\Lauren\AppData\Local\CRE\cgiaikfpllchefojlnehlmpekeogihnm.crx [2013-09-08]

CHR HKLM-x32\...\Chrome\Extension: [cpoooaodibfldhiobnmnjliddplmekeb] - C:\Users\Lauren\AppData\Local\CRE\cpoooaodibfldhiobnmnjliddplmekeb.crx [2013-09-08]

CHR HKLM-x32\...\Chrome\Extension: [dnmlhhbehhdmajijfenoldcajelckpmn] - C:\Users\Lauren\AppData\Local\CRE\dnmlhhbehhdmajijfenoldcajelckpmn.crx [2013-09-08]

CHR HKLM-x32\...\Chrome\Extension: [edfllcfghbogdahicgpcmnmkgpcmdjeo] - C:\Users\Lauren\AppData\Local\CRE\edfllcfghbogdahicgpcmnmkgpcmdjeo.crx [2013-09-08]

CHR HKLM-x32\...\Chrome\Extension: [hdhihajbmafmgilcciomnamcjfkdhikl] - C:\Program Files (x86)\HP SimplePass 2011\tschrome.crx [2011-04-14]

CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2014-04-11]

CHR HKLM-x32\...\Chrome\Extension: [palpbfjgianahgbbeodmcohjdmaelbeo] - C:\Program Files\Common Files\SpeedBit\SBUpdate\SpeedbitNewTab.crx [2014-04-11]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe [3241488 2014-06-27] (AVG Technologies CZ, s.r.o.)

R2 avgwd; C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe [289328 2014-06-17] (AVG Technologies CZ, s.r.o.)

S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [49152 2013-08-24] () [File not signed]

R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390720 2014-04-11] (Microsoft Corporation)

R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1764992 2014-04-11] (Microsoft Corporation)

R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2356408 2014-06-19] (Microsoft Corporation)

R2 HiPatchService; C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe [9216 2014-02-28] (Hi-Rez Studios) [File not signed]

R2 HP Support Assistant Service; C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [92160 2013-11-04] (Hewlett-Packard Company) [File not signed]

R2 IconMan_R; C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [2375168 2011-03-07] (Realsil Microelectronics Inc.) [File not signed]

S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [340240 2011-05-02] ()

R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2014-06-28] ()

R2 RzKLService; C:\Program Files (x86)\Razer\Razer Game Booster\RzKLService.exe [105448 2014-02-25] (Razer Inc.)

S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]

S2 Hamachi2Svc; "C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe" -s [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S0 amdkmafd; C:\Windows\System32\DRIVERS\amdkmafd.sys [21600 2013-03-14] (Advanced Micro Devices, Inc.)

R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [153368 2014-06-17] (AVG Technologies CZ, s.r.o.)

R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [242968 2014-06-17] (AVG Technologies CZ, s.r.o.)

R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [190744 2014-06-17] (AVG Technologies CZ, s.r.o.)

R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [235800 2014-06-17] (AVG Technologies CZ, s.r.o.)

R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [328984 2014-06-17] (AVG Technologies CZ, s.r.o.)

R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [123672 2014-06-17] (AVG Technologies CZ, s.r.o.)

R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [31512 2014-06-17] (AVG Technologies CZ, s.r.o.)

R1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [269080 2014-06-17] (AVG Technologies CZ, s.r.o.)

R1 avgtp; C:\Windows\system32\drivers\avgtpx64.sys [49952 2014-03-20] (AVG Technologies)

R3 L1C; C:\Windows\System32\DRIVERS\L1C62x64.sys [129224 2013-08-22] (Qualcomm Atheros Co., Ltd.)

R3 MEIx64; C:\Windows\System32\DRIVERS\TeeDriverx64.sys [125952 2014-05-14] (Intel Corporation)

S3 RimVSerPort; C:\Windows\System32\DRIVERS\RimSerial_AMD64.sys [31744 2009-01-09] (Research in Motion Ltd)

S3 RZMAELSTROMVADService; C:\Windows\System32\drivers\RzMaelstromVAD.sys [40696 2013-11-21] (Windows ® Win 7 DDK provider)

R2 rzpnk; C:\Windows\system32\drivers\rzpnk.sys [129856 2014-04-25] (Razer, Inc.)

S3 SWDUMon; C:\Windows\System32\DRIVERS\SWDUMon.sys [16152 2014-06-21] ()

S3 clwvd; system32\DRIVERS\clwvd.sys [X]

S3 CV2K1; system32\DRIVERS\cv2k1.sys [X]

S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]

S3 lmimirr; system32\DRIVERS\lmimirr.sys [X]

S3 RimUsb; System32\Drivers\RimUsb_AMD64.sys [X]

S3 VBoxNetFlt; system32\DRIVERS\VBoxNetFlt.sys [X]

S3 WinRing0_1_2_0; \??\C:\Program Files (x86)\Razer\Razer Game Booster\Driver\WinRing0x64.sys [X]

S3 X6va012; \??\C:\Windows\SysWOW64\Drivers\X6va012 [X]

S3 xhunter1; \??\C:\Windows\xhunter1.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)

==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-07-28 18:05 - 2014-07-28 18:06 - 00028215 _____ () C:\Users\Lauren\Desktop\FRST.txt

2014-07-28 18:05 - 2014-07-28 18:05 - 01016261 _____ (Thisisu) C:\Users\Lauren\Desktop\JRT (1).exe

2014-07-28 18:04 - 2014-07-28 18:04 - 00003230 _____ () C:\Users\Lauren\Desktop\JRT.txt

2014-07-28 17:56 - 2014-07-28 17:56 - 00000000 ____D () C:\Windows\ERUNT

2014-07-28 17:52 - 2014-07-28 17:52 - 01016261 _____ (Thisisu) C:\Users\Lauren\Desktop\JRT.exe

2014-07-28 17:45 - 2014-07-28 17:45 - 00003615 _____ () C:\Users\Lauren\Desktop\AdwCleaner[R9].txt

2014-07-28 17:01 - 2014-07-28 17:01 - 01365551 _____ () C:\Users\Lauren\Desktop\AdwCleaner.exe

2014-07-28 10:09 - 2014-07-28 10:09 - 00015439 _____ () C:\Users\Lauren\Desktop\bookmarks_7_28_14.html

2014-07-24 09:43 - 2014-07-24 09:43 - 00468480 _____ () C:\Users\Lauren\Desktop\CKScanner.exe

2014-07-22 11:42 - 2014-07-22 11:42 - 05185536 _____ (AVAST Software) C:\Users\Lauren\Desktop\aswMBR.exe

2014-07-22 11:38 - 2014-07-28 18:06 - 00000000 ____D () C:\FRST

2014-07-22 11:36 - 2014-07-28 10:04 - 02093568 _____ (Farbar) C:\Users\Lauren\Desktop\FRST64.exe

2014-07-22 11:35 - 2014-07-22 11:35 - 02090496 _____ (Farbar) C:\Users\Lauren\Downloads\FRST64.exe

2014-07-21 10:34 - 2014-07-21 10:34 - 00602112 _____ (OldTimer Tools) C:\Users\Lauren\Downloads\OTL.exe

2014-07-21 10:34 - 2014-07-21 10:34 - 00602112 _____ (OldTimer Tools) C:\Users\Lauren\Desktop\OTL.exe

2014-07-21 09:55 - 2014-07-21 09:55 - 00001226 _____ () C:\Users\Lauren\Desktop\Revo Uninstaller.lnk

2014-07-21 09:55 - 2014-07-21 09:55 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group

2014-07-21 09:54 - 2014-07-21 09:54 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Lauren\Downloads\revosetup.exe

2014-07-20 23:42 - 2014-07-20 23:43 - 00567080 _____ () C:\Users\Lauren\Downloads\setup(1).exe

2014-07-20 23:42 - 2014-07-20 23:42 - 00567080 _____ () C:\Users\Lauren\Downloads\setup.exe

2014-07-20 23:41 - 2014-07-20 23:41 - 00001121 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk

2014-07-20 23:41 - 2014-07-20 23:41 - 00001109 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk

2014-07-20 23:41 - 2014-07-20 23:41 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service

2014-07-20 23:40 - 2014-07-20 23:40 - 00284224 _____ (Mozilla) C:\Users\Lauren\Downloads\Firefox Setup Stub 30.0.exe

2014-07-20 16:24 - 2014-07-28 17:49 - 00000336 _____ () C:\Windows\Tasks\HPCeeScheduleForLauren.job

2014-07-20 16:24 - 2014-07-28 17:02 - 00003192 _____ () C:\Windows\System32\Tasks\HPCeeScheduleForLauren

2014-07-18 21:50 - 2014-07-18 21:50 - 00000000 ____D () C:\Users\Lauren\Documents\TurboTax

2014-07-18 21:33 - 2014-07-18 22:58 - 00000000 ____D () C:\Users\Lauren\Desktop\SAVED ITEMS!!!

2014-07-12 21:20 - 2014-07-12 21:20 - 00254976 _____ () C:\Users\Lauren\Downloads\jonnewsletter.wiz

2014-07-12 20:18 - 2014-07-12 20:18 - 00025600 _____ () C:\Users\Lauren\Downloads\scriptforretirementinterview.wiz

2014-07-08 22:52 - 2014-07-08 22:52 - 00339968 _____ () C:\Users\Lauren\Downloads\image (12).jpeg

2014-07-08 22:52 - 2014-07-08 22:52 - 00331776 _____ () C:\Users\Lauren\Downloads\image (14).jpeg

2014-07-08 22:52 - 2014-07-08 22:52 - 00286720 _____ () C:\Users\Lauren\Downloads\image (13).jpeg

2014-07-08 22:27 - 2014-07-08 22:27 - 00307200 _____ () C:\Users\Lauren\Downloads\image (11).jpeg

2014-07-08 22:26 - 2014-07-08 22:26 - 00352256 _____ () C:\Users\Lauren\Downloads\image (7).jpeg

2014-07-08 22:26 - 2014-07-08 22:26 - 00339968 _____ () C:\Users\Lauren\Downloads\image (10).jpeg

2014-07-08 22:26 - 2014-07-08 22:26 - 00319488 _____ () C:\Users\Lauren\Downloads\image (9).jpeg

2014-07-08 22:26 - 2014-07-08 22:26 - 00282624 _____ () C:\Users\Lauren\Downloads\image (8).jpeg

2014-07-08 22:25 - 2014-07-08 22:25 - 00319488 _____ () C:\Users\Lauren\Downloads\image (5).jpeg

2014-07-08 22:25 - 2014-07-08 22:25 - 00294912 _____ () C:\Users\Lauren\Downloads\image (6).jpeg

2014-07-08 22:25 - 2014-07-08 22:25 - 00249856 _____ () C:\Users\Lauren\Downloads\image (4).jpeg

2014-07-08 22:24 - 2014-07-08 22:24 - 00352256 _____ () C:\Users\Lauren\Downloads\image (3).jpeg

2014-07-08 22:24 - 2014-07-08 22:24 - 00339968 _____ () C:\Users\Lauren\Downloads\image (1).jpeg

2014-07-08 22:24 - 2014-07-08 22:24 - 00278528 _____ () C:\Users\Lauren\Downloads\image (2).jpeg

2014-07-08 22:22 - 2014-07-08 22:22 - 00237568 _____ () C:\Users\Lauren\Downloads\image.jpeg

2014-07-08 22:19 - 2014-07-28 17:48 - 00008592 _____ () C:\Windows\PFRO.log

2014-07-08 00:40 - 2014-07-08 00:40 - 01853264 _____ (BitTorrent Inc.) C:\Users\Lauren\Downloads\uTorrent.exe

2014-07-08 00:28 - 2014-07-08 00:28 - 01391485 _____ () C:\Users\Lauren\Downloads\ultralow_settings_mod1.1.zip

2014-07-03 18:17 - 2014-07-20 16:18 - 00002271 _____ () C:\Windows\comsetup.log

2014-06-29 11:21 - 2014-06-29 11:21 - 09052192 _____ (Cheat Engine ) C:\Users\Lauren\Downloads\CheatEngine64.exe

2014-06-29 07:28 - 2014-06-29 07:30 - 00000000 ____D () C:\Program Files (x86)\SpeedFan

2014-06-29 07:28 - 2014-06-29 07:28 - 00000045 _____ () C:\Windows\SysWOW64\initdebug.nfo

2014-06-29 07:25 - 2014-06-29 07:25 - 02143832 _____ () C:\Users\Lauren\Downloads\instsf449.exe

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-07-28 18:06 - 2014-07-28 18:05 - 00028215 _____ () C:\Users\Lauren\Desktop\FRST.txt

2014-07-28 18:06 - 2014-07-22 11:38 - 00000000 ____D () C:\FRST

2014-07-28 18:05 - 2014-07-28 18:05 - 01016261 _____ (Thisisu) C:\Users\Lauren\Desktop\JRT (1).exe

2014-07-28 18:04 - 2014-07-28 18:04 - 00003230 _____ () C:\Users\Lauren\Desktop\JRT.txt

2014-07-28 18:01 - 2012-05-21 14:17 - 00000258 _____ () C:\Windows\Tasks\HP Photo Creations Messager.job

2014-07-28 17:56 - 2014-07-28 17:56 - 00000000 ____D () C:\Windows\ERUNT

2014-07-28 17:54 - 2009-07-13 22:45 - 00032064 _____ () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-07-28 17:54 - 2009-07-13 22:45 - 00032064 _____ () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-07-28 17:52 - 2014-07-28 17:52 - 01016261 _____ (Thisisu) C:\Users\Lauren\Desktop\JRT.exe

2014-07-28 17:52 - 2011-11-29 21:21 - 01367394 _____ () C:\Windows\WindowsUpdate.log

2014-07-28 17:49 - 2014-07-20 16:24 - 00000336 _____ () C:\Windows\Tasks\HPCeeScheduleForLauren.job

2014-07-28 17:49 - 2012-11-10 16:45 - 00000894 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-07-28 17:49 - 2009-07-13 23:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-07-28 17:48 - 2014-07-08 22:19 - 00008592 _____ () C:\Windows\PFRO.log

2014-07-28 17:48 - 2014-06-26 16:20 - 00005308 _____ () C:\Windows\setupact.log

2014-07-28 17:47 - 2014-03-21 18:28 - 00000000 ____D () C:\AdwCleaner

2014-07-28 17:45 - 2014-07-28 17:45 - 00003615 _____ () C:\Users\Lauren\Desktop\AdwCleaner[R9].txt

2014-07-28 17:33 - 2012-04-18 09:27 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-07-28 17:11 - 2012-11-10 16:45 - 00000898 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-07-28 17:02 - 2014-07-20 16:24 - 00003192 _____ () C:\Windows\System32\Tasks\HPCeeScheduleForLauren

2014-07-28 17:02 - 2012-01-30 19:42 - 00000052 _____ () C:\Windows\SysWOW64\DOErrors.log

2014-07-28 17:01 - 2014-07-28 17:01 - 01365551 _____ () C:\Users\Lauren\Desktop\AdwCleaner.exe

2014-07-28 17:01 - 2012-02-06 17:11 - 00000000 _____ () C:\Windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt

2014-07-28 17:00 - 2014-06-19 15:33 - 00000000 ____D () C:\Users\Lauren\AppData\Local\Adobe

2014-07-28 16:53 - 2012-01-27 02:52 - 00003934 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{1E80AD34-A1C2-4DC2-88B6-9D9458878640}

2014-07-28 10:09 - 2014-07-28 10:09 - 00015439 _____ () C:\Users\Lauren\Desktop\bookmarks_7_28_14.html

2014-07-28 10:04 - 2014-07-22 11:36 - 02093568 _____ (Farbar) C:\Users\Lauren\Desktop\FRST64.exe

2014-07-28 09:51 - 2013-12-27 22:35 - 00000000 ____D () C:\ProgramData\MFAData

2014-07-26 22:45 - 2013-06-12 16:10 - 00000000 ____D () C:\Users\Lauren\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\War Thunder

2014-07-26 22:42 - 2013-06-04 16:23 - 00000000 ____D () C:\Program Files (x86)\Steam

2014-07-26 21:12 - 2009-07-13 23:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games

2014-07-26 21:01 - 2014-03-25 07:44 - 00000000 ____D () C:\Program Files (x86)\Ubisoft

2014-07-26 20:50 - 2012-01-27 02:49 - 00000000 ____D () C:\Users\Lauren

2014-07-24 09:43 - 2014-07-24 09:43 - 00468480 _____ () C:\Users\Lauren\Desktop\CKScanner.exe

2014-07-22 11:42 - 2014-07-22 11:42 - 05185536 _____ (AVAST Software) C:\Users\Lauren\Desktop\aswMBR.exe

2014-07-22 11:35 - 2014-07-22 11:35 - 02090496 _____ (Farbar) C:\Users\Lauren\Downloads\FRST64.exe

2014-07-22 09:20 - 2009-07-13 21:20 - 00000000 ____D () C:\Windows\system32\NDF

2014-07-22 09:06 - 2009-07-13 23:13 - 00783400 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-07-21 10:34 - 2014-07-21 10:34 - 00602112 _____ (OldTimer Tools) C:\Users\Lauren\Downloads\OTL.exe

2014-07-21 10:34 - 2014-07-21 10:34 - 00602112 _____ (OldTimer Tools) C:\Users\Lauren\Desktop\OTL.exe

2014-07-21 10:09 - 2011-10-12 17:38 - 00000000 ____D () C:\Program Files (x86)\HP Games

2014-07-21 10:08 - 2011-10-12 17:38 - 00000000 ____D () C:\Program Files (x86)\WildTangent Games

2014-07-21 10:05 - 2012-06-08 17:20 - 00000000 ____D () C:\Users\Lauren\AppData\Roaming\WildTangent

2014-07-21 10:05 - 2011-10-12 17:38 - 00000000 ____D () C:\ProgramData\WildTangent

2014-07-21 09:55 - 2014-07-21 09:55 - 00001226 _____ () C:\Users\Lauren\Desktop\Revo Uninstaller.lnk

2014-07-21 09:55 - 2014-07-21 09:55 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group

2014-07-21 09:54 - 2014-07-21 09:54 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Lauren\Downloads\revosetup.exe

2014-07-20 23:43 - 2014-07-20 23:42 - 00567080 _____ () C:\Users\Lauren\Downloads\setup(1).exe

2014-07-20 23:42 - 2014-07-20 23:42 - 00567080 _____ () C:\Users\Lauren\Downloads\setup.exe

2014-07-20 23:42 - 2012-08-15 13:55 - 00000000 ____D () C:\Users\Lauren\AppData\Roaming\Mozilla

2014-07-20 23:41 - 2014-07-20 23:41 - 00001121 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk

2014-07-20 23:41 - 2014-07-20 23:41 - 00001109 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk

2014-07-20 23:41 - 2014-07-20 23:41 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service

2014-07-20 23:41 - 2012-12-24 01:50 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

2014-07-20 23:41 - 2012-02-03 22:09 - 00000000 ____D () C:\Users\Lauren\AppData\Local\CrashDumps

2014-07-20 23:40 - 2014-07-20 23:40 - 00284224 _____ (Mozilla) C:\Users\Lauren\Downloads\Firefox Setup Stub 30.0.exe

2014-07-20 23:28 - 2012-01-27 21:35 - 00000000 ____D () C:\Users\Lauren\AppData\Roaming\Skype

2014-07-20 18:31 - 2014-05-11 21:53 - 00002232 ____H () C:\Users\Lauren\Documents\Default.rdp

2014-07-20 16:18 - 2014-07-03 18:17 - 00002271 _____ () C:\Windows\comsetup.log

2014-07-20 16:18 - 2009-07-13 21:20 - 00000000 ____D () C:\Windows\registration

2014-07-18 22:58 - 2014-07-18 21:33 - 00000000 ____D () C:\Users\Lauren\Desktop\SAVED ITEMS!!!

2014-07-18 22:26 - 2013-07-20 07:04 - 00000000 ____D () C:\Users\Lauren\Desktop\Eric's Stuff

2014-07-18 22:04 - 2013-01-19 15:28 - 00000000 ____D () C:\Users\Lauren\Documents\Outlook Files

2014-07-18 22:03 - 2013-02-14 22:59 - 00000000 ____D () C:\Users\Lauren\AppData\Local\E7769A38-323B-4206-A300-C653DD6C913E.aplzod

2014-07-18 21:50 - 2014-07-18 21:50 - 00000000 ____D () C:\Users\Lauren\Documents\TurboTax

2014-07-18 21:41 - 2012-01-27 21:07 - 00000000 ____D () C:\Users\Lauren\Documents\Youcam

2014-07-18 21:34 - 2013-08-03 16:26 - 00000000 ____D () C:\Users\Lauren\Documents\Arma 3

2014-07-12 21:20 - 2014-07-12 21:20 - 00254976 _____ () C:\Users\Lauren\Downloads\jonnewsletter.wiz

2014-07-12 20:18 - 2014-07-12 20:18 - 00025600 _____ () C:\Users\Lauren\Downloads\scriptforretirementinterview.wiz

2014-07-12 13:46 - 2013-02-21 20:28 - 00000132 _____ () C:\Users\Lauren\AppData\Roaming\Adobe PNG Format CS6 Prefs

2014-07-11 16:57 - 2014-06-25 18:06 - 00000000 ___DC () C:\Users\Lauren\AppData\Local\MigWiz

2014-07-10 19:04 - 2013-01-19 14:31 - 00000000 ____D () C:\Program Files\Microsoft Office 15

2014-07-09 21:58 - 2012-04-18 09:27 - 00003768 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater

2014-07-09 21:33 - 2012-04-18 09:27 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2014-07-09 21:33 - 2011-10-12 17:36 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl