[heyage13]

Hello,

 

I believe my computer has been infected with spyware. I was under the impression that I was downloading a  loose file from a Mediafire type site, however it was a downloader tool and after that my web browser shows strange links and random words being underlines which lead to other sites. Also, when wanting to go to sites, I get " 404 Bad Request" warnings.

 

Here is my OTL Log:

 

OTL logfile created on: 11/21/2014 12:00:30 AM - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Office PC\Desktop
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.11.9600.17420)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
 
4.00 Gb Total Physical Memory | 2.32 Gb Available Physical Memory | 58.09% Memory free
8.00 Gb Paging File | 5.73 Gb Available in Paging File | 71.60% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 931.41 Gb Total Space | 587.46 Gb Free Space | 63.07% Space Free | Partition Type: NTFS
Drive F: | 1863.01 Gb Total Space | 452.98 Gb Free Space | 24.31% Space Free | Partition Type: NTFS
 
Computer Name: OFFICEPC-PC | User Name: Office PC | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2014/11/20 23:57:21 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Office PC\Desktop\OTL.exe
PRC - [2014/10/21 23:05:02 | 000,854,344 | ---- | M] (Google Inc.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
PRC - [2014/04/30 13:28:45 | 002,199,840 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2014/10/21 23:05:00 | 014,902,600 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\38.0.2125.111\PepperFlash\pepflashplayer.dll
MOD - [2014/10/21 23:04:57 | 008,910,664 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\38.0.2125.111\pdf.dll
MOD - [2014/10/21 23:04:51 | 001,042,760 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\38.0.2125.111\libglesv2.dll
MOD - [2014/10/21 23:04:49 | 000,211,272 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\38.0.2125.111\libegl.dll
MOD - [2014/10/21 23:04:48 | 001,681,224 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\38.0.2125.111\ffmpegsumo.dll
MOD - [2014/04/23 15:05:12 | 000,073,544 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2014/04/23 15:04:54 | 001,044,808 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
 
 
========== Services (SafeList) ==========
 
SRV:64bit: - [2014/11/05 22:30:08 | 000,114,688 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\IEEtwCollector.exe -- (IEEtwCollectorService)
SRV:64bit: - [2014/08/22 14:14:34 | 000,368,624 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Program Files\Microsoft Security Client\NisSrv.exe -- (NisSrv)
SRV:64bit: - [2014/08/22 14:14:34 | 000,023,784 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc)
SRV:64bit: - [2014/04/30 13:28:23 | 021,007,192 | ---- | M] (NVIDIA Corporation) [Disabled | Stopped] -- C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe -- (NvStreamSvc)
SRV:64bit: - [2013/05/27 00:50:47 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV:64bit: - [2009/07/13 20:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)
SRV - [2014/05/19 18:10:40 | 000,413,128 | ---- | M] (NVIDIA Corporation) [Disabled | Stopped] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)
SRV - [2014/05/08 08:48:38 | 000,065,432 | ---- | M] (Adobe Systems Incorporated) [Disabled | Stopped] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2014/04/30 13:28:32 | 001,617,696 | ---- | M] (NVIDIA Corporation) [Disabled | Stopped] -- C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe -- (NvNetworkService)
SRV - [2014/03/20 17:49:18 | 000,067,224 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2013/09/11 20:21:54 | 000,105,144 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2014/07/17 17:05:06 | 000,125,584 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\NisDrvWFP.sys -- (NisDrv)
DRV:64bit: - [2014/05/19 21:44:03 | 000,197,408 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA)
DRV:64bit: - [2014/04/30 13:28:22 | 000,018,776 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys -- (NvStreamKms)
DRV:64bit: - [2014/03/31 11:42:44 | 000,040,392 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvvad64v.sys -- (nvvad_WaveExtensible)
DRV:64bit: - [2014/03/19 14:27:44 | 000,076,496 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\dc3d.sys -- (dc3d)
DRV:64bit: - [2013/10/01 21:22:20 | 000,056,832 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2013/09/24 06:10:34 | 000,097,768 | ---- | M] (Citrix Systems, Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\ctxusbm.sys -- (ctxusbm)
DRV:64bit: - [2013/08/06 14:13:30 | 000,023,040 | ---- | M] (Apple Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\netaapl64.sys -- (Netaapl)
DRV:64bit: - [2013/03/18 15:51:08 | 000,054,784 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)
DRV:64bit: - [2012/08/23 09:10:20 | 000,019,456 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
DRV:64bit: - [2012/08/23 09:08:26 | 000,030,208 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD)
DRV:64bit: - [2012/08/21 12:01:20 | 000,033,240 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV:64bit: - [2012/03/01 01:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2012/02/09 01:06:36 | 000,125,376 | ---- | M] (Power Software Ltd) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\scdemu.sys -- (SCDEmu)
DRV:64bit: - [2011/07/13 12:59:54 | 000,072,240 | ---- | M] (Nero AG) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\NBVol.sys -- (NBVol)
DRV:64bit: - [2011/07/13 12:59:54 | 000,015,920 | ---- | M] (Nero AG) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\NBVolUp.sys -- (NBVolUp)
DRV:64bit: - [2011/03/11 01:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011/03/11 01:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010/11/20 22:23:48 | 000,071,168 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\dmvsc.sys -- (dmvsc)
DRV:64bit: - [2010/11/20 22:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2009/10/13 01:15:52 | 000,061,440 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\l160x64.sys -- (AtcL001)
DRV:64bit: - [2009/10/05 15:34:00 | 001,542,656 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr)
DRV:64bit: - [2009/07/13 20:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009/07/13 20:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009/07/13 20:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009/06/10 15:35:58 | 000,047,872 | ---- | M] (VIA Technologies, Inc.              ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\fet6x64.sys -- (FETNDIS)
DRV:64bit: - [2009/06/10 15:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009/06/10 15:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009/06/10 15:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009/06/10 15:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009/05/14 08:26:24 | 000,015,416 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ASACPI.sys -- (MTsensor)
DRV:64bit: - [2009/05/09 00:14:20 | 000,015,752 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nuidfltr.sys -- (NuidFltr)
DRV:64bit: - [2009/04/08 13:28:46 | 000,068,992 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\xusb21.sys -- (xusb21)
DRV - [2009/07/13 20:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...ms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...ms}&FORM=IE8SRC
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...Box&FORM=IESR02
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <-loopback>
 
 
========== FireFox ==========
 
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.60.2: C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.60.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MICROS~1\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@Citrix.com/npican: C:\Program Files (x86)\Citrix\ICA Client\npicaN.dll (Citrix Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.71.2: C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.71.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@microsoft.com/Lync,version=15.0: C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Office PC\AppData\Local\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Office PC\AppData\Local\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
 
 
[2014/01/21 19:07:48 | 000,034,072 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll
 
========== Chrome  ==========
 
CHR - default_search_provider:  (Enabled)
CHR - default_search_provider: search_url =
CHR - default_search_provider: suggest_url =
CHR - homepage: http://google.com/
CHR - plugin: Error reading preferences file
CHR - Extension: Google Docs = C:\Users\Office PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\
CHR - Extension: Google Drive = C:\Users\Office PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\
CHR - Extension: Google Voice Search Hotword (Beta) = C:\Users\Office PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn\0.1.1.5023_0\
CHR - Extension: YouTube = C:\Users\Office PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\
CHR - Extension: Adblock for Youtubeâ„¢ = C:\Users\Office PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\cmedhionkhpnakcndndgjdbohmhepckk\2.20_0\
CHR - Extension: Google Search = C:\Users\Office PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\
CHR - Extension: Personal Trainer = C:\Users\Office PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmgohkgndpahjklgpdihieeedjeneoke\2.0_0\
CHR - Extension: Metal Slug Brutal 3 = C:\Users\Office PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\maphilmnngnhkfigpjjoddpjpfbmpmcc\1_0\
CHR - Extension: Floor plans and interior design = C:\Users\Office PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\mcafejemebbngbglfoinpoaannbihjna\1.5.0.0_0\
CHR - Extension: Google Wallet = C:\Users\Office PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\
CHR - Extension: Pop Art Studio Online = C:\Users\Office PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\oompiimecpnflklhlnmdpddcjdmiibkf\1.0.0.0_0\
CHR - Extension: Psykopaint = C:\Users\Office PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgjchkcfmigkkhedgjedmffdepgmpfil\0.0.0.10_0\
CHR - Extension: Psykopaint = C:\Users\Office PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgjchkcfmigkkhedgjedmffdepgmpfil\0.0.0.10_0\.bak
CHR - Extension: Weather Underground = C:\Users\Office PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjejbgheonogbpfkkjigbmahaljipoej\1.6_0\
CHR - Extension: World Clocks 2 = C:\Users\Office PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjgoijhajhaahklokegbfnohialajpej\7.0_0\
CHR - Extension: Gmail = C:\Users\Office PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\
 
O1 HOSTS File: ([2009/06/10 16:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2:64bit: - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O4:64bit: - HKLM..\Run: [MSC] C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [NvBackend] C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe (NVIDIA Corporation)
O4:64bit: - HKLM..\Run: [ShadowPlay] C:\Windows\SysNative\nvspcap64.dll (NVIDIA Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {4B54A9DE-EF1C-4EBE-A328-7C28EA3B433A} http://quickscan.bit...m/qsax/qsax.cab (Bitdefender QuickScan Control)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 64.71.255.204 64.71.255.198
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{31DE69D8-51FB-41F5-9F0D-3863C77E27A6}: DhcpNameServer = 172.20.10.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{EB3B84BD-802A-4C54-A0E0-BB726E77BB76}: DhcpNameServer = 64.71.255.204 64.71.255.198
O18 - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Filter\application/x-ica - No CLSID value found
O18:64bit: - Protocol\Filter\application/x-ica; charset=euc-jp - No CLSID value found
O18:64bit: - Protocol\Filter\application/x-ica; charset=ISO-8859-1 - No CLSID value found
O18:64bit: - Protocol\Filter\application/x-ica; charset=MS936 - No CLSID value found
O18:64bit: - Protocol\Filter\application/x-ica; charset=MS949 - No CLSID value found
O18:64bit: - Protocol\Filter\application/x-ica; charset=MS950 - No CLSID value found
O18:64bit: - Protocol\Filter\application/x-ica; charset=UTF8 - No CLSID value found
O18:64bit: - Protocol\Filter\application/x-ica; charset=UTF-8 - No CLSID value found
O18:64bit: - Protocol\Filter\application/x-ica;charset=euc-jp - No CLSID value found
O18:64bit: - Protocol\Filter\application/x-ica;charset=ISO-8859-1 - No CLSID value found
O18:64bit: - Protocol\Filter\application/x-ica;charset=MS936 - No CLSID value found
O18:64bit: - Protocol\Filter\application/x-ica;charset=MS949 - No CLSID value found
O18:64bit: - Protocol\Filter\application/x-ica;charset=MS950 - No CLSID value found
O18:64bit: - Protocol\Filter\application/x-ica;charset=UTF8 - No CLSID value found
O18:64bit: - Protocol\Filter\application/x-ica;charset=UTF-8 - No CLSID value found
O18:64bit: - Protocol\Filter\ica - No CLSID value found
O18 - Protocol\Filter\application/x-ica {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\application/x-ica; charset=euc-jp {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\application/x-ica; charset=ISO-8859-1 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\application/x-ica; charset=MS936 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\application/x-ica; charset=MS949 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\application/x-ica; charset=MS950 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\application/x-ica; charset=UTF8 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\application/x-ica; charset=UTF-8 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\application/x-ica;charset=euc-jp {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\application/x-ica;charset=ISO-8859-1 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\application/x-ica;charset=MS936 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\application/x-ica;charset=MS949 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\application/x-ica;charset=MS950 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\application/x-ica;charset=UTF8 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\application/x-ica;charset=UTF-8 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\ica {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 16:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2014/11/20 23:57:20 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Office PC\Desktop\OTL.exe
[2014/11/20 23:51:36 | 000,000,000 | -HSD | C] -- C:\Users\Office PC\AppData\Local\EmieBrowserModeList
[2014/11/20 22:01:09 | 000,000,000 | ---D | C] -- C:\Users\Office PC\AppData\Roaming\Steam
[2014/11/20 00:09:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Sonic Academy
[2014/11/20 00:06:20 | 000,000,000 | ---D | C] -- C:\ProgramData\3872871776
[2014/11/20 00:00:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Trusted Publisher
[2014/11/19 23:59:01 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\GoSave
[2014/11/19 23:58:53 | 000,000,000 | ---D | C] -- C:\ProgramData\3017449621078163633
[2014/11/19 23:57:44 | 000,000,000 | ---D | C] -- C:\ProgramData\ogklohgadnedlfgdljmpdkfpbmkbgjpd
[2014/11/19 23:57:10 | 000,000,000 | ---D | C] -- C:\Users\Office PC\Desktop\Nicky Romero kiskstart Plugin
[2014/11/10 21:05:21 | 000,000,000 | ---D | C] -- C:\Users\Office PC\AppData\Local\Native Instruments
[2014/11/10 21:02:06 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Native Instruments
[2014/11/10 21:02:05 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Native Instruments
[2014/11/10 21:01:51 | 000,000,000 | ---D | C] -- C:\Program Files\Native Instruments
[2014/11/10 20:32:48 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Digidesign
[2014/11/05 21:55:26 | 001,332,224 | ---- | C] (AD © 2009) -- C:\Windows\SysWow64\SYNSOEMU.DLL
[2014/10/28 20:27:09 | 000,000,000 | ---D | C] -- C:\Users\Office PC\Desktop\Samples
[2014/10/24 22:24:34 | 000,000,000 | ---D | C] -- C:\Users\Office PC\AppData\Local\Serato
[2014/10/24 22:24:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
[2014/10/24 22:23:46 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\QuickTime
[2014/10/23 18:33:16 | 000,000,000 | ---D | C] -- C:\Users\Office PC\Documents\VirtualDJ
[2010/12/22 11:26:24 | 487,666,616 | ---- | C] (Adobe Systems Incorporated) -- C:\Users\Office PC\AppData\Roaming\AcrobatPro_10_Web_WWEFD.exe
 
========== Files - Modified Within 30 Days ==========
 
[2014/11/20 23:57:21 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Office PC\Desktop\OTL.exe
[2014/11/20 23:35:00 | 000,000,898 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2014/11/20 23:10:03 | 000,000,924 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2488212447-1855921873-862638463-1000UA.job
[2014/11/20 22:54:47 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2014/11/20 19:54:31 | 000,031,312 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2014/11/20 19:54:31 | 000,031,312 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2014/11/20 19:52:37 | 000,781,298 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2014/11/20 19:52:37 | 000,661,656 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2014/11/20 19:52:37 | 000,121,524 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2014/11/20 19:51:45 | 000,000,894 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2014/11/20 19:46:58 | 3220,529,152 | -HS- | M] () -- C:\hiberfil.sys
[2014/11/20 00:10:01 | 000,000,872 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2488212447-1855921873-862638463-1000Core.job
[2014/11/19 22:35:31 | 000,002,455 | ---- | M] () -- C:\Users\Office PC\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome Canary.lnk
[2014/11/19 17:52:58 | 000,002,503 | ---- | M] () -- C:\Users\Public\Desktop\Serato DJ .lnk
[2014/11/14 19:02:51 | 000,433,120 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2014/11/10 20:23:36 | 000,101,260 | ---- | M] () -- C:\Users\Office PC\Desktop\1st Song.flp
[2014/10/30 19:22:00 | 007,538,525 | ---- | M] () -- C:\Users\Office PC\Desktop\Latch vs Hex (Clean).mp3
 
========== Files Created - No Company Name ==========
 
[2014/11/19 17:52:58 | 000,002,503 | ---- | C] () -- C:\Users\Public\Desktop\Serato DJ .lnk
[2014/11/05 00:10:39 | 000,101,260 | ---- | C] () -- C:\Users\Office PC\Desktop\1st Song.flp
[2014/10/27 18:17:35 | 007,538,525 | ---- | C] () -- C:\Users\Office PC\Desktop\Latch vs Hex (Clean).mp3
[2014/10/20 20:44:39 | 000,000,000 | ---- | C] () -- C:\Users\Office PC\.swfinfo
[2014/09/30 18:55:33 | 000,024,576 | ---- | C] () -- C:\Windows\SysWow64\AsIO.dll
[2014/09/30 18:55:33 | 000,013,368 | ---- | C] () -- C:\Windows\SysWow64\drivers\AsIO.sys
[2014/06/09 21:39:34 | 000,007,602 | ---- | C] () -- C:\Users\Office PC\AppData\Local\Resmon.ResmonCfg
[2014/05/23 11:39:03 | 000,773,536 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2014/05/18 15:18:04 | 000,045,400 | ---- | C] () -- C:\Windows\SysWow64\DiscHandler.exe
[2014/05/13 10:02:30 | 003,916,288 | ---- | C] () -- C:\Windows\SysWow64\ffmpeg.dll
[2014/05/13 10:01:48 | 000,112,640 | ---- | C] () -- C:\Windows\SysWow64\ff_vfw.dll
[2014/05/13 10:01:12 | 000,271,360 | ---- | C] () -- C:\Windows\SysWow64\TomsMoComp_ff.dll
[2014/05/13 10:00:58 | 000,157,184 | ---- | C] () -- C:\Windows\SysWow64\ff_unrar.dll
[2014/05/13 10:00:58 | 000,099,840 | ---- | C] () -- C:\Windows\SysWow64\ff_wmv9.dll
[2014/05/13 10:00:56 | 001,525,760 | ---- | C] () -- C:\Windows\SysWow64\ff_samplerate.dll
[2014/05/13 10:00:56 | 000,211,968 | ---- | C] () -- C:\Windows\SysWow64\ff_libdts.dll
[2014/05/13 10:00:56 | 000,147,456 | ---- | C] () -- C:\Windows\SysWow64\ff_libmad.dll
[2014/05/13 10:00:54 | 000,114,688 | ---- | C] () -- C:\Windows\SysWow64\ff_liba52.dll
[2014/05/13 10:00:52 | 000,136,704 | ---- | C] () -- C:\Windows\SysWow64\libmpeg2_ff.dll
[2014/04/08 15:50:26 | 000,235,520 | ---- | C] () -- C:\Windows\SysWow64\xvidvfw.dll
[2014/04/08 15:50:16 | 000,632,320 | ---- | C] () -- C:\Windows\SysWow64\xvidcore.dll
[2014/04/08 10:29:48 | 000,238,736 | ---- | C] () -- C:\Windows\SysWow64\libbluray.dll
[2013/12/16 21:19:30 | 000,216,064 | ---- | C] ( ) -- C:\Windows\SysWow64\Lagarith.dll
[2013/12/16 21:15:32 | 000,237,568 | ---- | C] () -- C:\Windows\SysWow64\OptimFROG.dll
[2013/12/16 21:15:32 | 000,000,236 | ---- | C] () -- C:\Windows\SysWow64\Formats.ini
[2013/12/16 21:15:30 | 000,047,104 | ---- | C] () -- C:\Windows\SysWow64\bass_tak.dll
[2013/12/16 20:28:18 | 000,109,568 | ---- | C] () -- C:\Windows\SysWow64\avi.dll
[2013/12/16 20:28:18 | 000,097,792 | ---- | C] () -- C:\Windows\SysWow64\avs.dll
[2013/12/16 20:28:18 | 000,093,184 | ---- | C] () -- C:\Windows\SysWow64\avss.dll
[2013/12/16 20:27:52 | 000,113,152 | ---- | C] () -- C:\Windows\SysWow64\dsmux.exe
[2013/12/16 20:27:50 | 000,249,856 | ---- | C] () -- C:\Windows\SysWow64\dxr.dll
[2013/12/16 20:27:40 | 000,358,400 | ---- | C] () -- C:\Windows\SysWow64\gdsmux.exe
[2013/12/16 20:27:16 | 000,137,728 | ---- | C] () -- C:\Windows\SysWow64\mkv2vfr.exe
[2013/12/16 20:27:16 | 000,024,576 | ---- | C] () -- C:\Windows\SysWow64\mkunicode.dll
[2013/12/16 20:27:14 | 000,150,528 | ---- | C] () -- C:\Windows\SysWow64\mkx.dll
[2013/12/16 20:27:14 | 000,080,384 | ---- | C] () -- C:\Windows\SysWow64\mkzlib.dll
[2013/12/16 20:27:10 | 000,142,336 | ---- | C] () -- C:\Windows\SysWow64\mp4.dll
[2013/12/16 20:26:52 | 000,123,392 | ---- | C] () -- C:\Windows\SysWow64\ogm.dll
[2013/12/16 20:26:40 | 000,154,624 | ---- | C] () -- C:\Windows\SysWow64\ts.dll
 
========== ZeroAccess Check ==========
 
[2009/07/13 23:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2014/06/24 21:05:42 | 014,175,744 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2014/06/24 20:41:30 | 012,874,240 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009/07/13 20:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010/11/20 22:24:25 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009/07/13 20:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
 
========== LOP Check ==========
 
[2014/11/21 00:05:53 | 000,000,000 | ---D | M] -- C:\Users\Office PC\AppData\Roaming\Azureus
[2014/11/19 23:32:10 | 000,000,000 | ---D | M] -- C:\Users\Office PC\AppData\Roaming\FlowStone
[2014/07/08 10:18:02 | 000,000,000 | ---D | M] -- C:\Users\Office PC\AppData\Roaming\ICAClient
[2014/10/14 22:51:52 | 000,000,000 | ---D | M] -- C:\Users\Office PC\AppData\Roaming\Image-Line
[2014/09/10 09:52:04 | 000,000,000 | ---D | M] -- C:\Users\Office PC\AppData\Roaming\MultiWall
[2014/05/24 11:21:46 | 000,000,000 | ---D | M] -- C:\Users\Office PC\AppData\Roaming\Oracle
[2014/05/23 20:26:31 | 000,000,000 | ---D | M] -- C:\Users\Office PC\AppData\Roaming\PowerISO
[2014/11/20 22:01:09 | 000,000,000 | ---D | M] -- C:\Users\Office PC\AppData\Roaming\Steam
[2014/11/20 21:15:38 | 000,000,000 | ---D | M] -- C:\Users\Office PC\AppData\Roaming\XBMC
 
========== Purity Check ==========
 
 

< End of report >

[Advertisements]

Hello just following up and would like to add that all sites where flash is needed to play video, it is redirected to the following site: www.papiba.com

 

Also noticed in google chrome that a little tab is situated on the top right hand side of my browser showing a link to my gmail account....haven't logged in from there as it's most likely spyware.

 

Please help and thank you.

[heyage13]

Hello just following up and would like to add that all sites where flash is needed to play video, it is redirected to the following site: www.papiba.com

 

Also noticed in google chrome that a little tab is situated on the top right hand side of my browser showing a link to my gmail account....haven't logged in from there as it's most likely spyware.

 

Please help and thank you.

[heyage13]

Hello was wondering if someone could please help me..as the days go by more and more malicious activity seems to be occurring. 

 

Can someone else please aid me...it's been 3 days since I first posted. 

 

Thank you.

[23red]

Hi heyage13     

 

Apologies for the delay.  I'm 23red, and it'll be my pleasure to assist you with your problem.  I am currently reviewing your log.  In the meantime, I'd be grateful if you would note the following:

•  Please make sure to carefully read every post completely before doing anything.
 
•  If you're not sure, or if something unexpected happens do not continue! Stop and ask!  It is not a problem.
 
•  Please do not run any other scans or other software on your computer unless asked as it may make this repair more difficult.
 
•  Please stick with me until all malware is gone from your system.  Malware removal is not an instant process, just because you no longer see any symptoms it does not necessarily mean your system is completely clear.

 

•  Please copy/paste to Notepad and save my instructions as a text file on your desktop, or print them out, as you may not be able to access this thread at times.

 

• Back up your data. I will not knowingly suggest your any course that might damage your system but sometimes Malware infections are so severe that only option we have is to re-format and re-install the operating system.

 

•   I do my best to respond as quick as I can.  I, like everyone else here am also a volunteer and sometimes life keeps me busy 

 

•  Thank you for your understanding and I appreciate your patience.

 

Please allow some time to go through the logs you posted.  I'll post back as soon as possible.

[heyage13]

Thanks very much. I do as you've mentioned. Looking forward to hearing back from you after you've reviewed my logs. 

 

Thanks

[23red]

Hello heyage13 

 

Let's start here:

 

Step 1
OTL Fix

 

Please right click on on your Desktop, choose Run as Administrator, accept UAC prompts.

 

Under
 in the textbox at the bottom, please paste in the following text:

 

 

 

:Commands
[CREATERESTOREPOINT]

:OTL

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <-loopback>
[2014/11/20 00:00:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Trusted Publisher
[2014/11/19 23:59:01 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\GoSave
[2014/11/19 23:58:53 | 000,000,000 | ---D | C] -- C:\ProgramData\3017449621078163633
[2014/11/19 23:57:44 | 000,000,000 | ---D | C] -- C:\ProgramData\ogklohgadnedlfgdljmpdkfpbmkbgjpd

 

:Files
netsh advfirewall reset /c
netsh advfirewall set allprofiles state on /c
ipconfig /flushdns /c

:Commands
[EmptyTemp]

 

 

 

 

 

•  Push the   button.
•  OTL may ask to reboot the machine. Please do so if asked. 
•  A massage box will pop-up.
•  Click the OK button and a report will open.
•  If the machine reboots, the log will be located at C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log, (where mmddyyyy_hhmmss is the date of the tool run).
•  Copy and Paste that report in your next reply, please

 

Next, I'd like to scan with another tool that looks in other places and is more updated than OTL:

 

 

Step 2
FRST

 

Please download Farbar Recovery Scan Tool and save it to your Desktop.

 

Note: You need to run the version compatible with your system.  Your system is 64bit, choose that version.

• Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
• Press Scan button.
• It will produce a log called FRST.txt in the same directory the tool is run from.
• Please copy and paste log back here.
• The first time the tool is run it generates another log (Addition.txt - also located in the same directory as FRST.exe/FRST64.exe). Please also paste that along with the FRST.txt into your reply.

 

 

Step 3
Post!

 

When you return please post:

 

1.  OTL fix log
2.  FRST.txt
3.  Addition.txt

 

Thank you

[heyage13]

All processes killed

========== COMMANDS ==========

Restore point Set: OTL Restore Point

========== OTL ==========

HKCU\Software\MICROSOFT\Windows\CurrentVersion\Internet Settings\\ProxyOverride| /E : value set successfully!

C:\ProgramData\Trusted Publisher folder moved successfully.

C:\Program Files (x86)\GoSave folder moved successfully.

C:\ProgramData\3017449621078163633 folder moved successfully.

C:\ProgramData\ogklohgadnedlfgdljmpdkfpbmkbgjpd folder moved successfully.

========== FILES ==========

< netsh advfirewall reset /c >

Ok.

C:\Users\Office PC\Desktop\cmd.bat deleted successfully.

C:\Users\Office PC\Desktop\cmd.txt deleted successfully.

< netsh advfirewall set allprofiles state on /c >

Ok.

C:\Users\Office PC\Desktop\cmd.bat deleted successfully.

C:\Users\Office PC\Desktop\cmd.txt deleted successfully.

< ipconfig /flushdns /c >

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

C:\Users\Office PC\Desktop\cmd.bat deleted successfully.

C:\Users\Office PC\Desktop\cmd.txt deleted successfully.

========== COMMANDS ==========

 

[EMPTYTEMP]

 

User: All Users

 

User: Default

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

 

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

 

User: Office PC

->Temp folder emptied: 103965540 bytes

->Temporary Internet Files folder emptied: 45961979 bytes

->Java cache emptied: 657604 bytes

->Google Chrome cache emptied: 92884592 bytes

 

User: Public

 

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32 (64bit) .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 79796720 bytes

%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 33298 bytes

RecycleBin emptied: 9123672 bytes

 

Total Files Cleaned = 317.00 mb

 

 

OTL by OldTimer - Version 3.2.69.0 log created on 11252014_194551

 

Files\Folders moved on Reboot...

File move failed. C:\Users\Office PC\AppData\Local\Temp\NVIDIA Corporation\NV_Cache\6d1026b4fa6d4c49d77d65f8805a9c0_fce8395c8fd8a860_6229ccd76215aea1_0_0.bin scheduled to be moved on reboot.

File move failed. C:\Users\Office PC\AppData\Local\Temp\NVIDIA Corporation\NV_Cache\6d1026b4fa6d4c49d77d65f8805a9c0_fce8395c8fd8a860_6229ccd76215aea1_0_0.toc scheduled to be moved on reboot.

C:\Users\Office PC\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

C:\Users\Office PC\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat moved successfully.

 

PendingFileRenameOperations files...

 

Registry entries deleted on Reboot...

 

 

_________________________________________________________________________________________________________________________________________________________

 

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 23-11-2014 01

Ran by Office PC (administrator) on OFFICEPC-PC on 25-11-2014 19:51:13

Running from C:\Users\Office PC\Downloads

Loaded Profile: Office PC (Available profiles: Office PC)

Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: English (United States)

Internet Explorer Version 11

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/

 

==================== Processes (Whitelisted) =================

 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

 

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe

(SurfRight B.V.) C:\Program Files\HitmanPro\hmpsched.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(SurfRight B.V.) C:\Program Files\HitmanPro\HitmanPro.exe

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe

(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe

(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

 

 

==================== Registry (Whitelisted) ==================

 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

 

HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart

HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2199840 2014-04-30] (NVIDIA Corporation)

HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [1331288 2014-08-22] (Microsoft Corporation)

HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-08-01] (Apple Inc.)

HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [271744 2014-09-26] (Oracle Corporation)

HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)

HKU\S-1-5-21-2488212447-1855921873-862638463-1000\...\Run: [Google Update] => C:\Users\Office PC\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2014-06-03] (Google Inc.)

CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

 

==================== Internet (Whitelisted) ====================

 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

 

SearchScopes: HKLM-x32 -> DefaultScope value is missing.

BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)

BHO: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)

BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)

BHO: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)

BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)

BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)

BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

DPF: HKLM-x32 {4B54A9DE-EF1C-4EBE-A328-7C28EA3B433A} http://quickscan.bit...m/qsax/qsax.cab

Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL (Microsoft Corporation)

Filter-x32: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Tcpip\Parameters: [DhcpNameServer] 64.71.255.204 64.71.255.198

 

FireFox:

========

FF Plugin: @java.com/DTPlugin,version=10.60.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=10.60.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin: @microsoft.com/GENUINE -> disabled No File

FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office15\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()

FF Plugin-x32: @Citrix.com/npican -> C:\Program Files (x86)\Citrix\ICA Client\npicaN.dll (Citrix Systems, Inc.)

FF Plugin-x32: @java.com/DTPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File

FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)

FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin HKU\S-1-5-21-2488212447-1855921873-862638463-1000: @tools.google.com/Google Update;version=3 -> C:\Users\Office PC\AppData\Local\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)

FF Plugin HKU\S-1-5-21-2488212447-1855921873-862638463-1000: @tools.google.com/Google Update;version=9 -> C:\Users\Office PC\AppData\Local\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll (Microsoft Corporation)

 

Chrome: 

=======

CHR dev: Chrome dev build detected! <======= ATTENTION

CHR Profile: C:\Users\Office PC\AppData\Local\Google\Chrome\User Data\Default

CHR Extension: (Google Docs) - C:\Users\Office PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-05-23]

CHR Extension: (Google Drive) - C:\Users\Office PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-05-23]

CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Office PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-05-23]

CHR Extension: (YouTube) - C:\Users\Office PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-05-23]

CHR Extension: (Adblock for Youtube™) - C:\Users\Office PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\cmedhionkhpnakcndndgjdbohmhepckk [2014-05-23]

CHR Extension: (Google Search) - C:\Users\Office PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-05-23]

CHR Extension: (Personal Trainer) - C:\Users\Office PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmgohkgndpahjklgpdihieeedjeneoke [2014-05-23]

CHR Extension: (Metal Slug Brutal 3) - C:\Users\Office PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\maphilmnngnhkfigpjjoddpjpfbmpmcc [2014-05-23]

CHR Extension: (Floor plans and interior design) - C:\Users\Office PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\mcafejemebbngbglfoinpoaannbihjna [2014-05-23]

CHR Extension: (Google Wallet) - C:\Users\Office PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-05-23]

CHR Extension: (Pop Art Studio Online) - C:\Users\Office PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\oompiimecpnflklhlnmdpddcjdmiibkf [2014-05-23]

CHR Extension: (Psykopaint) - C:\Users\Office PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgjchkcfmigkkhedgjedmffdepgmpfil [2014-05-23]

CHR Extension: (Weather Underground) - C:\Users\Office PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjejbgheonogbpfkkjigbmahaljipoej [2014-05-23]

CHR Extension: (World Clocks 2) - C:\Users\Office PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjgoijhajhaahklokegbfnohialajpej [2014-05-23]

CHR Extension: (Gmail) - C:\Users\Office PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-05-23]

 

==================== Services (Whitelisted) =================

 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

 

R2 HitmanProScheduler; C:\Program Files\HitmanPro\hmpsched.exe [127752 2014-11-22] (SurfRight B.V.)

R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [23784 2014-08-22] (Microsoft Corporation)

R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [368624 2014-08-22] (Microsoft Corporation)

S4 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1617696 2014-04-30] (NVIDIA Corporation)

S4 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [21007192 2014-04-30] (NVIDIA Corporation)

 

==================== Drivers (Whitelisted) ====================

 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

 

R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13368 2009-04-06] ()

R3 AtcL001; C:\Windows\System32\DRIVERS\l160x64.sys [61440 2009-10-13] (Atheros Communications, Inc.)

R3 FETNDIS; C:\Windows\System32\DRIVERS\fet6x64.sys [47872 2009-06-10] (VIA Technologies, Inc.              )

R3 hitmanpro37; C:\Windows\system32\drivers\hitmanpro37.sys [43664 2014-11-25] ()

R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [269008 2014-07-17] (Microsoft Corporation)

R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-05-14] ()

R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [125584 2014-07-17] (Microsoft Corporation)

S3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [18776 2014-04-30] (NVIDIA Corporation)

R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [40392 2014-03-31] (NVIDIA Corporation)

S3 MBAMSwissArmy; \??\C:\Windows\system32\drivers\MBAMSwissArmy.sys [X]

 

==================== NetSvcs (Whitelisted) ===================

 

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)

 

 

==================== One Month Created Files and Folders ========

 

(If an entry is included in the fixlist, the file\folder will be moved.)

 

2014-11-25 19:51 - 2014-11-25 19:52 - 00015049 _____ () C:\Users\Office PC\Downloads\FRST.txt

2014-11-25 19:50 - 2014-11-25 19:51 - 00000000 ____D () C:\FRST

2014-11-25 19:50 - 2014-11-25 19:50 - 02118144 _____ (Farbar) C:\Users\Office PC\Downloads\FRST64.exe

2014-11-25 19:45 - 2014-11-25 19:45 - 00000000 ____D () C:\_OTL

2014-11-25 18:40 - 2014-11-25 18:40 - 00783352 _____ (Elex do Brasil Participações Ltda) C:\Users\Office PC\Downloads\yet_another_cleaner_avae (1).exe

2014-11-24 22:15 - 2014-11-24 22:15 - 01058272 _____ () C:\Users\Office PC\Downloads\Setup (1).exe

2014-11-23 20:01 - 2014-11-23 20:01 - 01040360 _____ () C:\Users\Office PC\Downloads\flashplayer (3).exe

2014-11-23 12:08 - 2014-11-23 12:08 - 01040368 _____ () C:\Users\Office PC\Downloads\flashplayer (2).exe

2014-11-23 12:06 - 2014-11-23 12:06 - 00773824 _____ (Elex do Brasil Participações Ltda) C:\Users\Office PC\Downloads\yet_another_cleaner_avae.exe

2014-11-22 02:20 - 2014-11-22 02:20 - 00001893 _____ () C:\Users\Public\Desktop\HitmanPro.lnk

2014-11-22 02:20 - 2014-11-22 02:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HitmanPro

2014-11-22 02:20 - 2014-11-22 02:20 - 00000000 ____D () C:\Program Files\HitmanPro

2014-11-22 02:19 - 2014-11-22 02:19 - 11222744 _____ (SurfRight B.V.) C:\Users\Office PC\Downloads\HitmanPro_x64.exe

2014-11-22 02:17 - 2014-11-22 02:17 - 19828376 _____ (Malwarebytes Corporation ) C:\Users\Office PC\Downloads\mbam-setup-2.0.3.1025.exe

2014-11-22 02:16 - 2014-11-22 02:16 - 02140160 _____ () C:\Users\Office PC\Downloads\adwcleaner_4.101 (1).exe

2014-11-22 02:12 - 2014-11-22 02:12 - 01707532 _____ (Thisisu) C:\Users\Office PC\Downloads\JRT.exe

2014-11-22 02:09 - 2014-11-22 02:09 - 02140160 _____ () C:\Users\Office PC\Downloads\adwcleaner_4.101.exe

2014-11-22 00:55 - 2014-11-22 00:55 - 01040368 _____ () C:\Users\Office PC\Downloads\flashplayer (1).exe

2014-11-22 00:55 - 2014-11-22 00:55 - 01040360 _____ () C:\Users\Office PC\Downloads\flashplayer.exe

2014-11-20 23:57 - 2014-11-20 23:57 - 00602112 _____ (OldTimer Tools) C:\Users\Office PC\Desktop\OTL.exe

2014-11-20 23:51 - 2014-11-20 23:51 - 00000000 __SHD () C:\Users\Office PC\AppData\Local\EmieBrowserModeList

2014-11-20 23:46 - 2014-11-20 23:46 - 00930768 _____ () C:\Users\Office PC\Downloads\Setup.exe

2014-11-20 22:05 - 2014-11-20 22:05 - 00000452 _____ () C:\Users\Office PC\Downloads\Call.of.Duty.Advanced.Warfare.Proper.Crack-RELOADED.torrent

2014-11-20 22:01 - 2014-11-20 22:01 - 00000000 ____D () C:\Users\Office PC\AppData\Roaming\Steam

2014-11-20 00:09 - 2014-11-20 00:09 - 00000000 ____D () C:\ProgramData\Sonic Academy

2014-11-20 00:06 - 2014-11-20 00:06 - 00000000 ____D () C:\ProgramData\3872871776

2014-11-19 23:57 - 2014-11-20 00:07 - 00000000 ____D () C:\Users\Office PC\Desktop\Nicky Romero kiskstart Plugin

2014-11-19 23:34 - 2014-11-19 23:35 - 01929175 _____ () C:\Users\Office PC\Downloads\FL Studio Remakes (FLP).rar

2014-11-19 17:52 - 2014-11-19 17:52 - 00002503 _____ () C:\Users\Public\Desktop\Serato DJ .lnk

2014-11-19 17:42 - 2014-11-19 17:44 - 165019946 _____ () C:\Users\Office PC\Downloads\Serato Dj1.6.1 FULL By #DJALFAMED.rar

2014-11-19 17:20 - 2014-11-19 17:20 - 00560653 _____ () C:\Users\Office PC\Downloads\Far.Cry.4.Proper-RELOADED.torrent

2014-11-19 17:15 - 2014-11-10 22:08 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll

2014-11-19 17:15 - 2014-11-10 22:08 - 00241152 _____ (Microsoft Corporation) C:\Windows\system32\pku2u.dll

2014-11-19 17:15 - 2014-11-10 21:44 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll

2014-11-19 17:15 - 2014-11-10 21:44 - 00186880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pku2u.dll

2014-11-17 23:35 - 2014-11-17 23:35 - 00049541 _____ () C:\Users\Office PC\Downloads\Assassins.Creed.Unity.Gold.Edition-3DM.torrent

2014-11-15 12:52 - 2014-11-15 12:52 - 158762693 _____ () C:\Users\Office PC\Downloads\Serato DJ 1.7.1.zip

2014-11-11 18:05 - 2014-11-07 14:49 - 00388272 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll

2014-11-11 18:05 - 2014-11-07 14:23 - 00341168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll

2014-11-11 18:05 - 2014-11-05 23:04 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-11-11 18:05 - 2014-11-05 23:03 - 25110016 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-11-11 18:05 - 2014-11-05 23:03 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll

2014-11-11 18:05 - 2014-11-05 22:47 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2014-11-11 18:05 - 2014-11-05 22:46 - 00580096 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2014-11-11 18:05 - 2014-11-05 22:46 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll

2014-11-11 18:05 - 2014-11-05 22:44 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll

2014-11-11 18:05 - 2014-11-05 22:43 - 02884096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2014-11-11 18:05 - 2014-11-05 22:36 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2014-11-11 18:05 - 2014-11-05 22:35 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2014-11-11 18:05 - 2014-11-05 22:31 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2014-11-11 18:05 - 2014-11-05 22:30 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2014-11-11 18:05 - 2014-11-05 22:30 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe

2014-11-11 18:05 - 2014-11-05 22:29 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2014-11-11 18:05 - 2014-11-05 22:28 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-11-11 18:05 - 2014-11-05 22:23 - 06040064 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2014-11-11 18:05 - 2014-11-05 22:20 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe

2014-11-11 18:05 - 2014-11-05 22:16 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll

2014-11-11 18:05 - 2014-11-05 22:13 - 00501248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2014-11-11 18:05 - 2014-11-05 22:13 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2014-11-11 18:05 - 2014-11-05 22:12 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll

2014-11-11 18:05 - 2014-11-05 22:10 - 19781632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-11-11 18:05 - 2014-11-05 22:10 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll

2014-11-11 18:05 - 2014-11-05 22:07 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll

2014-11-11 18:05 - 2014-11-05 22:05 - 02277376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2014-11-11 18:05 - 2014-11-05 22:04 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2014-11-11 18:05 - 2014-11-05 22:03 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2014-11-11 18:05 - 2014-11-05 22:02 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2014-11-11 18:05 - 2014-11-05 22:00 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2014-11-11 18:05 - 2014-11-05 22:00 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2014-11-11 18:05 - 2014-11-05 21:59 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2014-11-11 18:05 - 2014-11-05 21:58 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll

2014-11-11 18:05 - 2014-11-05 21:57 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2014-11-11 18:05 - 2014-11-05 21:48 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll

2014-11-11 18:05 - 2014-11-05 21:42 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll

2014-11-11 18:05 - 2014-11-05 21:41 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2014-11-11 18:05 - 2014-11-05 21:41 - 00716800 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2014-11-11 18:05 - 2014-11-05 21:39 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll

2014-11-11 18:05 - 2014-11-05 21:38 - 02124288 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2014-11-11 18:05 - 2014-11-05 21:37 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll

2014-11-11 18:05 - 2014-11-05 21:36 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2014-11-11 18:05 - 2014-11-05 21:34 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll

2014-11-11 18:05 - 2014-11-05 21:30 - 14390272 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2014-11-11 18:05 - 2014-11-05 21:22 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2014-11-11 18:05 - 2014-11-05 21:21 - 04298240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2014-11-11 18:05 - 2014-11-05 21:21 - 02051072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2014-11-11 18:05 - 2014-11-05 21:20 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll

2014-11-11 18:05 - 2014-11-05 21:17 - 02365440 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2014-11-11 18:05 - 2014-11-05 21:04 - 01550336 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2014-11-11 18:05 - 2014-11-05 21:03 - 12819456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2014-11-11 18:05 - 2014-11-05 20:53 - 00799232 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2014-11-11 18:05 - 2014-11-05 20:52 - 01892864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2014-11-11 18:05 - 2014-11-05 20:48 - 01310208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2014-11-11 18:05 - 2014-11-05 20:47 - 00708096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2014-11-11 18:05 - 2014-11-05 12:56 - 00304640 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll

2014-11-11 18:05 - 2014-11-05 12:56 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll

2014-11-11 18:05 - 2014-11-05 12:52 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

2014-11-11 18:05 - 2014-10-24 20:57 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll

2014-11-11 18:05 - 2014-10-24 20:32 - 00067584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\packager.dll

2014-11-11 18:05 - 2014-10-13 21:16 - 00155064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys

2014-11-11 18:05 - 2014-10-13 21:13 - 00683520 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll

2014-11-11 18:05 - 2014-10-13 21:12 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll

2014-11-11 18:05 - 2014-10-13 21:09 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll

2014-11-11 18:05 - 2014-10-13 21:07 - 00681984 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll

2014-11-11 18:05 - 2014-10-13 20:50 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll

2014-11-11 18:05 - 2014-10-13 20:49 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll

2014-11-11 18:05 - 2014-10-13 20:47 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll

2014-11-11 18:05 - 2014-10-13 20:46 - 00681984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll

2014-11-11 18:05 - 2014-10-02 21:12 - 00500224 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll

2014-11-11 18:05 - 2014-10-02 21:11 - 00680960 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll

2014-11-11 18:05 - 2014-10-02 21:11 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll

2014-11-11 18:05 - 2014-10-02 21:11 - 00296448 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll

2014-11-11 18:05 - 2014-10-02 21:11 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll

2014-11-11 18:05 - 2014-10-02 20:44 - 00442880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AUDIOKSE.dll

2014-11-11 18:05 - 2014-10-02 20:44 - 00374784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioEng.dll

2014-11-11 18:05 - 2014-10-02 20:44 - 00195584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioSes.dll

2014-11-11 18:05 - 2014-09-19 04:42 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll

2014-11-11 18:05 - 2014-09-19 04:42 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll

2014-11-11 18:05 - 2014-09-19 04:42 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll

2014-11-11 18:05 - 2014-09-19 04:42 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll

2014-11-11 18:05 - 2014-09-19 04:42 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll

2014-11-11 18:05 - 2014-09-19 04:42 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll

2014-11-11 18:05 - 2014-09-19 04:23 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll

2014-11-11 18:05 - 2014-09-19 04:23 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll

2014-11-11 18:05 - 2014-09-19 04:23 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll

2014-11-11 18:05 - 2014-09-19 04:23 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll

2014-11-11 18:05 - 2014-09-19 04:23 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll

2014-11-11 18:05 - 2014-09-19 04:23 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll

2014-11-11 18:05 - 2014-08-21 01:43 - 01882624 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll

2014-11-11 18:05 - 2014-08-21 01:40 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll

2014-11-11 18:05 - 2014-08-21 01:26 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll

2014-11-11 18:05 - 2014-08-21 01:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll

2014-11-11 18:05 - 2014-08-11 21:02 - 00878080 _____ (Microsoft Corporation) C:\Windows\system32\IMJP10K.DLL

2014-11-11 18:05 - 2014-08-11 20:36 - 00701440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IMJP10K.DLL

2014-11-11 18:04 - 2014-10-17 21:05 - 00861696 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll

2014-11-11 18:04 - 2014-10-17 20:33 - 00571904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll

2014-11-11 18:04 - 2014-10-13 21:13 - 03241984 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll

2014-11-11 18:04 - 2014-10-13 20:50 - 02363904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll

2014-11-11 18:04 - 2014-10-09 19:57 - 03198976 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2014-11-10 21:05 - 2014-11-10 21:05 - 00000000 ____D () C:\Users\Office PC\AppData\Local\Native Instruments

2014-11-10 21:02 - 2014-11-10 21:02 - 00000000 ____D () C:\Program Files\Common Files\Native Instruments

2014-11-10 21:01 - 2014-11-19 17:37 - 00000000 ____D () C:\Program Files\Native Instruments

2014-11-09 12:08 - 2014-11-09 12:08 - 00161575 _____ () C:\Users\Office PC\Downloads\Nyomi Banxxx.torrent

2014-11-07 18:56 - 2014-11-07 18:56 - 00874864 _____ () C:\Users\Office PC\Downloads\Call.of.Duty.Advanced.Warfare.MULTi6-PROPHET.torrent

2014-11-07 18:56 - 2014-11-07 18:56 - 00208596 _____ () C:\Users\Office PC\Downloads\Call.of.Duty.Advanced.Warfare-CODEX.torrent

2014-11-05 21:55 - 2009-10-24 21:15 - 01332224 _____ (AD © 2009) C:\Windows\SysWOW64\SYNSOEMU.DLL

2014-11-05 00:10 - 2014-11-10 20:23 - 00101260 _____ () C:\Users\Office PC\Desktop\1st Song.flp

2014-10-28 20:27 - 2014-11-22 11:49 - 00000000 ____D () C:\Users\Office PC\Desktop\Samples

 

==================== One Month Modified Files and Folders =======

 

(If an entry is included in the fixlist, the file\folder will be moved.)

 

2014-11-25 19:51 - 2014-05-23 12:49 - 02055386 _____ () C:\Windows\WindowsUpdate.log

2014-11-25 19:47 - 2014-05-23 17:12 - 00000894 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-11-25 19:47 - 2010-11-20 22:47 - 00019884 _____ () C:\Windows\PFRO.log

2014-11-25 19:47 - 2009-07-14 00:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-11-25 19:47 - 2009-07-13 23:51 - 00009855 _____ () C:\Windows\setupact.log

2014-11-25 19:43 - 2014-09-10 11:42 - 00000000 ____D () C:\Users\Office PC\Desktop\2014.11.20

2014-11-25 19:35 - 2014-05-23 17:12 - 00000898 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-11-25 19:10 - 2014-06-03 18:46 - 00000924 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2488212447-1855921873-862638463-1000UA.job

2014-11-25 01:59 - 2014-06-03 18:46 - 00000872 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2488212447-1855921873-862638463-1000Core.job

2014-11-24 22:19 - 2014-05-23 17:18 - 00000000 ____D () C:\Users\Office PC\AppData\Roaming\Azureus

2014-11-24 19:32 - 2009-07-13 23:45 - 00031312 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-11-24 19:32 - 2009-07-13 23:45 - 00031312 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-11-24 19:29 - 2009-07-14 00:13 - 00781298 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-11-24 19:22 - 2009-07-13 22:20 - 00000000 ____D () C:\Windows\system32\NDF

2014-11-22 02:10 - 2013-08-25 18:44 - 00000000 ____D () C:\AdwCleaner

2014-11-20 21:15 - 2014-05-26 21:19 - 00000000 ____D () C:\Users\Office PC\AppData\Roaming\XBMC

2014-11-19 23:32 - 2014-10-14 22:43 - 00000000 ____D () C:\Users\Office PC\AppData\Roaming\FlowStone

2014-11-19 17:52 - 2014-10-21 19:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Serato

2014-11-19 17:52 - 2014-10-21 19:34 - 00000000 ____D () C:\Program Files (x86)\Serato

2014-11-19 17:52 - 2014-07-08 15:05 - 00000000 ____D () C:\ProgramData\Package Cache

2014-11-15 12:48 - 2014-05-28 18:59 - 00000000 ____D () C:\Users\Office PC\AppData\Local\Apple Computer

2014-11-15 03:02 - 2014-05-23 20:46 - 00000000 ____D () C:\ProgramData\Microsoft Help

2014-11-15 03:01 - 2014-05-23 20:52 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013

2014-11-15 00:05 - 2014-06-03 18:46 - 00003902 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2488212447-1855921873-862638463-1000UA

2014-11-15 00:05 - 2014-06-03 18:46 - 00003506 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2488212447-1855921873-862638463-1000Core

2014-11-14 22:40 - 2009-07-13 22:20 - 00000000 ____D () C:\Windows\rescache

2014-11-14 19:30 - 2014-05-23 17:12 - 00003894 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA

2014-11-14 19:30 - 2014-05-23 17:12 - 00003642 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore

2014-11-14 19:02 - 2009-07-13 23:45 - 00433120 _____ () C:\Windows\system32\FNTCACHE.DAT

2014-11-14 19:01 - 2014-05-23 15:22 - 00000000 ___SD () C:\Windows\system32\CompatTel

2014-11-12 01:08 - 2009-07-13 21:34 - 00000478 _____ () C:\Windows\win.ini

2014-11-12 01:07 - 2014-05-23 10:57 - 00000000 ____D () C:\Windows\system32\MRT

2014-11-12 01:04 - 2014-05-23 10:57 - 103374192 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2014-11-10 20:55 - 2014-10-21 18:01 - 00000000 ____D () C:\Program Files (x86)\VstPlugins

2014-11-05 20:47 - 2009-07-14 00:08 - 00032574 _____ () C:\Windows\Tasks\SCHEDLGU.TXT

2014-10-30 18:54 - 2013-08-19 18:46 - 00000000 ____D () C:\temp

2014-10-30 06:25 - 2010-11-20 22:27 - 00275080 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe

2014-10-29 14:38 - 2014-05-23 17:19 - 00111520 _____ () C:\Users\Office PC\AppData\Local\GDIPFONTCACHEV1.DAT

2014-10-28 21:35 - 2014-10-23 18:33 - 00000000 ____D () C:\Users\Office PC\Documents\VirtualDJ

2014-10-28 21:28 - 2014-09-10 10:33 - 00000000 ____D () C:\Users\Office PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VirtualDJ

2014-10-28 21:28 - 2014-07-28 15:32 - 00000000 ____D () C:\Program Files (x86)\VirtualDJ

 

==================== Bamital & volsnap Check =================

 

(There is no automatic fix for files that do not pass verification.)

 

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\SysWOW64\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed

 

 

LastRegBack: 2014-11-25 02:02

 

==================== End Of Log ============================

 

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 23-11-2014 01

Ran by Office PC at 2014-11-25 19:52:48

Running from C:\Users\Office PC\Downloads

Boot Mode: Normal

==========================================================

 

 

==================== Security Center ========================

 

(If an entry is included in the fixlist, it will be removed.)

 

AV: Microsoft Security Essentials (Enabled - Up to date) {4F35CFC4-45A3-FC37-EF17-759A02E39AB1}

AS: Microsoft Security Essentials (Enabled - Up to date) {F4542E20-6399-F3B9-D5A7-4EE87964D00C}

AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

 

==================== Installed Programs ======================

 

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

 

Adobe Reader XI (11.0.08) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.08 - Adobe Systems Incorporated)

Apple Application Support (HKLM-x32\...\{78002155-F025-4070-85B3-7C0453561701}) (Version: 3.0.6 - Apple Inc.)

Apple Mobile Device Support (HKLM\...\{6AF2AC2A-3532-43FD-9F4D-BDC9C0D724C7}) (Version: 7.1.2.6 - Apple Inc.)

Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)

ASIO4ALL (HKLM-x32\...\ASIO4ALL) (Version: 2.11 Beta2 - Michael Tippach)

Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)

Citrix Receiver (HKLM-x32\...\CitrixOnlinePluginPackWeb) (Version: 14.1.0.0 - Citrix Systems, Inc.)

DJ Intro version 1.2.3 (HKLM-x32\...\{36625871-9D4B-4046-A837-677974F51CAC}_is1) (Version: 1.2.3 - Serato Audio Research)

FL Studio 11 (HKLM-x32\...\FL Studio 11) (Version:  - Image-Line)

FlowStone FL 3.0 (HKLM-x32\...\FlowStone) (Version:  - )

Full Tilt Poker (HKLM-x32\...\{D4C9692E-4EFA-4DA0-8B7F-9439466D9E31}) (Version: 5.10.15.WIN.FullTilt.COM - )

Google Chrome (HKLM-x32\...\Google Chrome) (Version: 38.0.2125.111 - Google Inc.)

Google Chrome Canary (HKU\S-1-5-21-2488212447-1855921873-862638463-1000\...\Google Chrome SxS) (Version: 41.0.2224.2 - Google Inc.)

Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden

HitmanPro 3.7 (HKLM\...\HitmanPro37) (Version: 3.7.9.232 - SurfRight B.V.)

IL Shared Libraries (HKLM-x32\...\IL Shared Libraries) (Version:  - Image-Line)

iTunes (HKLM\...\{77DE5105-D05E-448C-96CB-7FA381903753}) (Version: 11.3.1.2 - Apple Inc.)

Java 7 Update 60 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F06417060FF}) (Version: 7.0.600 - Oracle)

Java 7 Update 71 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217071FF}) (Version: 7.0.710 - Oracle)

Loopmaster Samples version 1.0 (HKLM-x32\...\{EF29801F-C87A-481B-B4D1-6D1FBDEA954B}_is1) (Version: 1.0 - Serato LP INC)

Media Player Codec Pack 4.3.1 (HKLM-x32\...\Media Player - Codec Pack) (Version: 4.3.1 - Media Player Codec Pack)

Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft Office Professional Plus 2013 (HKLM\...\Office15.PROPLUS) (Version: 15.0.4569.1506 - Microsoft Corporation)

Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.6.305.0 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{2af972c7-13b0-4978-92a8-fee26a4fb4e9}) (Version: 12.0.21005.1 - Корпорация Майкрософт)

MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)

MultiWall version 1.0.26 (HKLM-x32\...\{54384F46-6346-4BDC-A137-4D4037D362D3}_is1) (Version: 1.0.26 - MultiWall)

Nero 11 Mini Repack (HKLM\...\NMMS11) (Version:  - )

Nero Backup Drivers (HKLM\...\{D600D357-5CB9-4DE9-8FD4-14E208BD1970}) (Version: 1.0.10000.1.0 - Nero AG)

NVIDIA 3D Vision Controller Driver 337.88 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 337.88 - NVIDIA Corporation)

NVIDIA 3D Vision Driver 337.88 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 337.88 - NVIDIA Corporation)

NVIDIA GeForce Experience 2.0.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.0.1 - NVIDIA Corporation)

NVIDIA Graphics Driver 337.88 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 337.88 - NVIDIA Corporation)

NVIDIA HD Audio Driver 1.3.30.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.30.1 - NVIDIA Corporation)

NVIDIA PhysX System Software 9.13.1220 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.1220 - NVIDIA Corporation)

Online Plug-in (x32 Version: 14.1.0.0 - Citrix Systems, Inc.) Hidden

Outils de vérification linguistique 2013 de Microsoft Office - Français (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden

Pioneer DDJ_SB Driver (HKLM-x32\...\Pioneer DDJ_SB ASIO) (Version: 1.000.000.002 - Pioneer Corporation.)

PowerISO (HKLM-x32\...\PowerISO) (Version: 5.0 - Power Software Ltd)

QuickTime 7 (HKLM-x32\...\{111EE7DF-FC45-40C7-98A7-753AC46B12FB}) (Version: 7.75.80.95 - Apple Inc.)

Self-service Plug-in (x32 Version: 4.1.0.41738 - Citrix Systems, Inc.) Hidden

Serato DJ  (HKLM-x32\...\{9e649cc6-2e9a-4d16-a834-ec9b64c5a459}) (Version: 1.6.1.5835 - )

Serato DJ  (x32 Version: 1.6.1.5835 - Serato) Hidden

SHIELD Streaming (Version: 2.1.108 - NVIDIA Corporation) Hidden

System Requirements Lab CYRI (HKLM-x32\...\{F3FCB08B-E752-444D-86A0-0634A4F3B23D}) (Version: 6.0.8.0 - Husdawg, LLC)

UnderCoverXP 1.23 (HKLM-x32\...\UnderCoverXP_is1) (Version:  - Wicked & Wild Inc.)

Uplay (HKLM-x32\...\Uplay) (Version: 4.5 - Ubisoft)

VirtualDJ 8 (HKLM-x32\...\{9ADBBA93-4625-4898-BB0D-BCE7EA9F8B4A}) (Version: 8.0.0 - Atomix Productions)

Vuze (HKLM\...\8461-7759-5462-8226) (Version: 5.4.0.0 - Azureus Software, Inc.)

WinRAR 5.10 beta 4 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.10.4 - win.rar GmbH)

XBMC (HKU\S-1-5-21-2488212447-1855921873-862638463-1000\...\XBMC) (Version:  - Team XBMC)

 

==================== Custom CLSID (selected items): ==========================

 

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

 

CustomCLSID: HKU\S-1-5-21-2488212447-1855921873-862638463-1000_Classes\CLSID\{0F22A205-CFB0-4679-8499-A6F44A80A208}\InprocServer32 -> C:\Users\Office PC\AppData\Local\Google\Update\1.3.25.5\psuser_64.dll No File

CustomCLSID: HKU\S-1-5-21-2488212447-1855921873-862638463-1000_Classes\CLSID\{1BEAC3E3-B852-44F4-B468-8906C062422E}\localserver32 -> C:\Users\Office PC\AppData\Local\Google\Chrome SxS\Application\41.0.2224.2\delegate_execute.exe (Google Inc.)

CustomCLSID: HKU\S-1-5-21-2488212447-1855921873-862638463-1000_Classes\CLSID\{90B3DFBF-AF6A-4EA0-8899-F332194690F8}\InprocServer32 -> C:\Users\Office PC\AppData\Local\Google\Update\1.3.24.15\psuser_64.dll No File

CustomCLSID: HKU\S-1-5-21-2488212447-1855921873-862638463-1000_Classes\CLSID\{D0336C0B-7919-4C04-8CCE-2EBAE2ECE8C9}\InprocServer32 -> C:\Users\Office PC\AppData\Local\Google\Update\1.3.25.11\psuser_64.dll (Google Inc.)

CustomCLSID: HKU\S-1-5-21-2488212447-1855921873-862638463-1000_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\Office PC\AppData\Local\Google\Update\1.3.25.11\psuser_64.dll (Google Inc.)

CustomCLSID: HKU\S-1-5-21-2488212447-1855921873-862638463-1000_Classes\CLSID\{FE498BAB-CB4C-4F88-AC3F-3641AAAF5E9E}\InprocServer32 -> C:\Users\Office PC\AppData\Local\Google\Update\1.3.24.7\psuser_64.dll No File

 

==================== Restore Points  =========================

 

22-11-2014 22:02:19 Scheduled Checkpoint

23-11-2014 17:08:15 Windows Update

26-11-2014 00:46:02 OTL Restore Point - 11/25/2014 7:46:01 PM

 

==================== Hosts content: ==========================

 

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

 

2009-07-13 21:34 - 2009-06-10 16:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

 

==================== Scheduled Tasks (whitelisted) =============

 

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

 

Task: {1C8B5135-3362-451B-8010-8A62F5C8030D} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-23] (Microsoft Corporation)

Task: {2D401E09-D133-4209-A64F-7EBC2BD5049B} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exe [2014-01-23] (Microsoft Corporation)

Task: {3FB5ED31-DB98-4A8C-BDCB-CBB3C3DE34DB} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc

Task: {4B2EDA24-013E-4C0D-ACDA-ED02EFBDB41C} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2488212447-1855921873-862638463-1000Core => C:\Users\Office PC\AppData\Local\Google\Update\GoogleUpdate.exe [2014-06-03] (Google Inc.)

Task: {6584E792-8A0C-4840-A6E7-AF9779FC80C5} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-23] (Microsoft Corporation)

Task: {81660A6E-E8E5-43E6-A033-7A2908AB4CC2} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2488212447-1855921873-862638463-1000UA => C:\Users\Office PC\AppData\Local\Google\Update\GoogleUpdate.exe [2014-06-03] (Google Inc.)

Task: {BDC262C9-849C-45E7-84FD-14207D4B72EE} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-05-23] (Google Inc.)

Task: {DE933F40-BFB9-4F55-AECE-8ECF1E423AAE} - \AutoKMS No Task File <==== ATTENTION

Task: {E5F6674C-1C6A-4FC6-A6E6-E40F63FE77A9} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-05-23] (Google Inc.)

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2488212447-1855921873-862638463-1000Core.job => C:\Users\Office PC\AppData\Local\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2488212447-1855921873-862638463-1000UA.job => C:\Users\Office PC\AppData\Local\Google\Update\GoogleUpdate.exe

 

==================== Loaded Modules (whitelisted) =============

 

2014-10-14 23:27 - 2014-10-14 23:27 - 08897696 _____ () C:\Program Files\Microsoft Office\Office15\1033\GrooveIntlResource.dll

2014-04-23 15:05 - 2014-04-23 15:05 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll

2014-04-23 15:04 - 2014-04-23 15:04 - 01044808 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll

2014-10-14 23:28 - 2014-10-14 23:28 - 08897696 _____ () C:\Program Files (x86)\Microsoft Office\Office15\1033\GrooveIntlResource.dll

2014-10-29 15:31 - 2014-10-21 23:04 - 01042760 _____ () C:\Program Files (x86)\Google\Chrome\Application\38.0.2125.111\libglesv2.dll

2014-10-29 15:31 - 2014-10-21 23:04 - 00211272 _____ () C:\Program Files (x86)\Google\Chrome\Application\38.0.2125.111\libegl.dll

2014-10-29 15:31 - 2014-10-21 23:04 - 08910664 _____ () C:\Program Files (x86)\Google\Chrome\Application\38.0.2125.111\pdf.dll

2014-10-29 15:31 - 2014-10-21 23:04 - 01681224 _____ () C:\Program Files (x86)\Google\Chrome\Application\38.0.2125.111\ffmpegsumo.dll

 

==================== Alternate Data Streams (whitelisted) =========

 

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

 

 

==================== Safe Mode (whitelisted) ===================

 

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

 

 

==================== EXE Association (whitelisted) =============

 

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)

 

 

==================== MSCONFIG/TASK MANAGER disabled items =========

 

(Currently there is no automatic fix for this section.)

 

MSCONFIG\Services: AdobeARMservice => 2

MSCONFIG\Services: Apple Mobile Device => 2

MSCONFIG\Services: Bonjour Service => 2

MSCONFIG\Services: gupdate => 2

MSCONFIG\Services: gupdatem => 3

MSCONFIG\Services: iPod Service => 3

MSCONFIG\Services: NvNetworkService => 2

MSCONFIG\Services: NvStreamSvc => 2

MSCONFIG\Services: nvsvc => 2

MSCONFIG\Services: Stereo Service => 2

MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^CodecPackUpdateChecker.lnk => C:\Windows\pss\CodecPackUpdateChecker.lnk.CommonStartup

MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

MSCONFIG\startupreg: CitrixReceiver => "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Citrix\Receiver Updater.lnk"

MSCONFIG\startupreg: ConnectionCenter => "C:\Program Files (x86)\Citrix\ICA Client\concentr.exe" /startup

MSCONFIG\startupreg: Google Update => "C:\Users\Office PC\AppData\Local\Google\Update\GoogleUpdate.exe" /c

MSCONFIG\startupreg: iTunesHelper => "C:\Program Files (x86)\iTunes\iTunesHelper.exe"

MSCONFIG\startupreg: NBAgent => "C:\Program Files (x86)\Nero\Nero 11\Nero BackItUp\NBAgent.exe" /WinStart

MSCONFIG\startupreg: PWRISOVM.EXE => C:\Program Files (x86)\PowerISO\PWRISOVM.EXE -startup

MSCONFIG\startupreg: Redirector => "C:\Program Files (x86)\Citrix\ICA Client\redirector.exe" /startup

 

========================= Accounts: ==========================

 

Administrator (S-1-5-21-2488212447-1855921873-862638463-500 - Administrator - Disabled)

Guest (S-1-5-21-2488212447-1855921873-862638463-501 - Limited - Disabled)

HomeGroupUser$ (S-1-5-21-2488212447-1855921873-862638463-1002 - Limited - Enabled)

Office PC (S-1-5-21-2488212447-1855921873-862638463-1000 - Administrator - Enabled) => C:\Users\Office PC

 

==================== Faulty Device Manager Devices =============

 

Name: Standard PS/2 Keyboard

Description: Standard PS/2 Keyboard

Class Guid: {4d36e96b-e325-11ce-bfc1-08002be10318}

Manufacturer: (Standard keyboards)

Service: i8042prt

Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)

Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.

Devices stay in this state if they have been prepared for removal.

After you remove the device, this error disappears.Remove the device, and this error should be resolved.

 

 

==================== Event log errors: =========================

 

Application errors:

==================

Error: (11/25/2014 07:49:25 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

 

Error: (11/25/2014 07:46:04 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )

Description: Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.

 

 

Details:

AddLegacyDriverFiles: Unable to back up image of binary SASKUTIL.

 

System Error:

The system cannot find the file specified.

.

 

Error: (11/24/2014 07:25:04 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

 

Error: (11/23/2014 07:57:29 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

 

Error: (11/23/2014 11:56:39 AM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

 

Error: (11/22/2014 11:43:10 AM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

 

 

System errors:

=============

Error: (11/25/2014 07:45:51 PM) (Source: Service Control Manager) (EventID: 7031) (User: )

Description: The Apple Mobile Device service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 60000 milliseconds: Restart the service.

 

Error: (11/24/2014 10:05:09 PM) (Source: Disk) (EventID: 11) (User: )

Description: The driver detected a controller error on \Device\Harddisk2\DR2.

 

Error: (11/24/2014 01:59:50 AM) (Source: Disk) (EventID: 11) (User: )

Description: The driver detected a controller error on \...\DR2.

 

Error: (11/23/2014 00:08:35 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )

Description: %NT AUTHORITY60 has encountered an error trying to update signatures.

 

New Signature Version: 

 

Previous Signature Version: 1.189.480.0

 

Update Source: %NT AUTHORITY59

 

Update Stage: 4.6.0305.00

 

Source Path: 4.6.0305.01

 

Signature Type: %NT AUTHORITY602

 

Update Type: %NT AUTHORITY604

 

User: NT AUTHORITY\SYSTEM

 

Current Engine Version: %NT AUTHORITY605

 

Previous Engine Version: %NT AUTHORITY606

 

Error code: %NT AUTHORITY607

 

Error description: %NT AUTHORITY608

 

Error: (11/22/2014 02:33:40 PM) (Source: volsnap) (EventID: 36) (User: )

Description: The shadow copies of volume C: were aborted because the shadow copy storage could not grow due to a user imposed limit.

 

Error: (11/22/2014 01:29:00 PM) (Source: Disk) (EventID: 11) (User: )

Description: The driver detected a controller error on \Device\Harddisk2\DR2.

 

 

Microsoft Office Sessions:

=========================

Error: (11/25/2014 07:49:25 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

 

Error: (11/25/2014 07:46:04 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )

Description: 

Details:

AddLegacyDriverFiles: Unable to back up image of binary SASKUTIL.

 

System Error:

The system cannot find the file specified.

 

Error: (11/24/2014 07:25:04 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

 

Error: (11/23/2014 07:57:29 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

 

Error: (11/23/2014 11:56:39 AM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

 

Error: (11/22/2014 11:43:10 AM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

 

 

CodeIntegrity Errors:

===================================

  Date: 2014-05-24 12:29:18.648

  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Users\OFFICE~1\AppData\Local\Temp\EverestDriver.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

 

  Date: 2014-05-24 12:29:18.614

  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Users\OFFICE~1\AppData\Local\Temp\EverestDriver.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

 

  Date: 2014-05-24 12:29:18.224

  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files (x86)\Lavalys\EVEREST Home Edition\kerneld.amd64 because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

 

  Date: 2014-05-24 12:29:18.189

  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files (x86)\Lavalys\EVEREST Home Edition\kerneld.amd64 because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

 

 

==================== Memory info =========================== 

 

Processor: Intel® Core™2 Duo CPU E6750 @ 2.66GHz

Percentage of memory in use: 50%

Total physical RAM: 4095.12 MB

Available physical RAM: 2025.61 MB

Total Pagefile: 8188.41 MB

Available Pagefile: 6068.25 MB

Total Virtual: 8192 MB

Available Virtual: 8191.83 MB

 

==================== Drives ================================

 

Drive c: () (Fixed) (Total:931.41 GB) (Free:646.09 GB) NTFS

Drive f: (Iomega HDD) (Fixed) (Total:1863.01 GB) (Free:452.96 GB) NTFS

 

==================== MBR & Partition Table ==================

 

========================================================

Disk: 0 (Size: 149.1 GB) (Disk ID: 36EC2C3C)

 

Partition: GPT Partition Type.

 

========================================================

Disk: 1 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: 915F062F)

Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=931.4 GB) - (Type=07 NTFS)

 

========================================================

Disk: 2 (MBR Code: Windows XP) (Size: 1863 GB) (Disk ID: E0EC8070)

Partition 1: (Not Active) - (Size=1863 GB) - (Type=07 NTFS)

 

==================== End Of Log ============================

[23red]

Hi heyage13 

 

One additional scan please

 

 Download CKScanner by askey127

 

Save it to your Desktop.

 

Right click on and choose Run as administrator to start the program.

 

Give permission if necessary, and click Search For Files.

 

After a very short time, when the cursor hourglass disappears, click Save List To File.

 

A message box will verify the file saved. Please run the program once only.

 

Double-click the CKFiles.txt icon on your desktop and copy/paste the contents in your next reply.

When you return, please post:

 

CKFiles.txt log

 

Thank you

[heyage13]

CKScanner 2.4 - Additional Security Risks - These are not necessarily bad

c:\program files (x86)\image-line\fl studio 11\data\patches\plugin presets\generators\drumpad\sound fx\crack.fst

c:\program files (x86)\image-line\fl studio 11\plugins\fruity\effects\hardcore\presets\i cracked my tube!.hdprg

c:\program files (x86)\image-line\fl studio 11\plugins\fruity\generators\drumaxx\drum patches\sound fx\crack.dmpatch

c:\program files (x86)\image-line\fl studio 11\plugins\fruity\generators\drumpad\drum patches\sound fx\crack.dmpatch

c:\program files (x86)\winrar password cracker\7z.dll

c:\program files (x86)\winrar password cracker\7z64.dll

c:\program files (x86)\winrar password cracker\dict.lst

c:\program files (x86)\winrar password cracker\eula.rtf

c:\program files (x86)\winrar password cracker\help.chm

c:\program files (x86)\winrar password cracker\microsoft.windowsapicodepack.dll

c:\program files (x86)\winrar password cracker\microsoft.windowsapicodepack.shell.dll

c:\program files (x86)\winrar password cracker\rarpassrecovery.exe

c:\program files (x86)\winrar password cracker\rarpassrecovery.exe.config

c:\program files (x86)\winrar password cracker\rarpassrecoverystarter.exe

c:\program files (x86)\winrar password cracker\rarpassrecoverystarter.exe.ini

c:\program files (x86)\winrar password cracker\sevenzipsharp.dll

c:\program files (x86)\winrar password cracker\system.core.dll

c:\program files (x86)\winrar password cracker\system.threading.dll

c:\program files (x86)\winrar password cracker\uninstall.lnk

c:\program files (x86)\winrar password cracker\webtooker.appframework.dll

c:\program files (x86)\winrar password cracker\webtooker.appupdate.dll

c:\program files (x86)\winrar password cracker\webtooker.drawing.dll

c:\program files (x86)\winrar password cracker\webtooker.framework.dll

c:\program files (x86)\winrar password cracker\webtooker.wepassrecover.domain.dll

c:\program files (x86)\winrar password cracker\webtooker.wepassrecover.domain.dll.config

c:\program files (x86)\winrar password cracker\webtooker.wepassrecover.presentation.dll

c:\program files (x86)\winrar password cracker\webtooker.werarpassrecover.core.dll

c:\program files (x86)\winrar password cracker\webtooker.win32.dll

c:\program files (x86)\winrar password cracker\webtooker.windows.animations.dll

c:\program files (x86)\winrar password cracker\webtooker.windows.dll

c:\program files (x86)\winrar password cracker\webtooker.windows.forms.dll

c:\program files (x86)\winrar password cracker\webtooker.windows.forms.ribbons.dll

c:\program files (x86)\winrar password cracker\webtooker.windows.forms.ribbons.xmlserializers.dll

c:\program files (x86)\winrar password cracker\webtooker.windows.forms.widgets.dll

c:\program files (x86)\winrar password cracker\bg\webtooker.appupdate.resources.dll

c:\program files (x86)\winrar password cracker\de\webtooker.appupdate.resources.dll

c:\program files (x86)\winrar password cracker\es-mx\webtooker.appupdate.resources.dll

c:\program files (x86)\winrar password cracker\fr\webtooker.appupdate.resources.dll

c:\program files (x86)\winrar password cracker\it\webtooker.appupdate.resources.dll

c:\program files (x86)\winrar password cracker\lt\webtooker.appupdate.resources.dll

c:\program files (x86)\winrar password cracker\nl\webtooker.appupdate.resources.dll

c:\program files (x86)\winrar password cracker\pt-br\webtooker.appupdate.resources.dll

c:\program files (x86)\winrar password cracker\ru\webtooker.appupdate.resources.dll

c:\program files (x86)\winrar password cracker\zh-chs\webtooker.windows.resources.dll

c:\program files (x86)\winrar password cracker\zh-cn\webtooker.appupdate.resources.dll

c:\program files (x86)\winrar password cracker\zh-hans\webtooker.windows.forms.ribbons.resources.dll

c:\program files (x86)\winrar password cracker\zh-tw\webtooker.appupdate.resources.dll

c:\users\office pc\desktop\plugins\nicky romero kiskstart plugin\nickyromero kickstart plugin\keygen\instructions.txt

c:\users\office pc\desktop\watch dogs\crack\bin\gamelauncher_x64.exe

c:\users\office pc\desktop\watch dogs\crack\bin\uplaypatch.ini

c:\users\office pc\desktop\watch dogs\crack\bin\uplaypatch_x64.dll

c:\users\office pc\documents\image-line\data\drumaxx\drum patches\sound fx\crack.dmpatch

c:\users\office pc\documents\image-line\data\drumaxx\sound fx\crack.dmpatch

c:\users\office pc\documents\vuze downloads\assassins.creed.unity.gold.edition-3dm\crack\acu.exe

c:\users\office pc\documents\vuze downloads\assassins.creed.unity.gold.edition-3dm\crack\uplay_r1_loader64.dll

c:\users\office pc\documents\vuze downloads\fl studio 10 & ni massive & 3,500 presets\fl studio 10\flstudio_10.0_crack.exe

c:\users\office pc\documents\vuze downloads\nexus 2.2 full cracked\nexus 2.2 iso\air-nexus2.iso

c:\users\office pc\documents\vuze downloads\watch.dogs-tptb\watch.dogs.update1-tptb\tptb-wdu1\crack\3dm\bin\1.save

c:\users\office pc\documents\vuze downloads\watch.dogs-tptb\watch.dogs.update1-tptb\tptb-wdu1\crack\3dm\bin\2.save

c:\users\office pc\documents\vuze downloads\watch.dogs-tptb\watch.dogs.update1-tptb\tptb-wdu1\crack\3dm\bin\3dm.ini

c:\users\office pc\documents\vuze downloads\watch.dogs-tptb\watch.dogs.update1-tptb\tptb-wdu1\crack\3dm\bin\gfsdk_txaa.win64.dll

c:\users\office pc\documents\vuze downloads\watch.dogs-tptb\watch.dogs.update1-tptb\tptb-wdu1\crack\3dm\bin\uplay_r164.dll

c:\users\office pc\documents\vuze downloads\watch.dogs-tptb\watch.dogs.update1-tptb\tptb-wdu1\crack\3dm\bin\watch_dogs.exe

c:\users\office pc\documents\vuze downloads\watch.dogs-tptb\watch.dogs.update1-tptb\tptb-wdu1\crack\steam006\bin\1.save

c:\users\office pc\documents\vuze downloads\watch.dogs-tptb\watch.dogs.update1-tptb\tptb-wdu1\crack\steam006\bin\2.save

c:\users\office pc\documents\vuze downloads\watch.dogs-tptb\watch.dogs.update1-tptb\tptb-wdu1\crack\steam006\bin\ubiapi.dll

c:\users\office pc\documents\vuze downloads\watch.dogs-tptb\watch.dogs.update1-tptb\tptb-wdu1\crack\steam006\bin\watch_dogs.exe

c:\users\office pc\downloads\call.of.duty.advanced.warfare.proper.crack-reloaded.torrent

c:\users\office pc\downloads\enemy.front.crack.only.proper-codex.torrent

scanner sequence 3.ZZ.11.NDAPRZ

 ----- EOF ----- 

[heyage13]

Is there any other steps involved or does the PC look clear of the malware?

[23red]

Hi heyage13

 

Not clear, yet.  This is going to take a little more work   Appologies for the delay.

 

Before I proceed, I noticed that you have one (or more) P2P programs installed on your system. It's my duty to warn you that using these programs can lead you to being infected by many malwares of all types. These days, spreading malwares via torrents that look "legitimate": music, videos, keygens, cracks, etc. is one of the most efficient and commonly used method by a malware spreaders to infect computers. This infection can lead to many consequences such as your personal information being compromised, your passwords being stolen, your bank accounts being accessed and used without your authorization, etc.  It also appears that you have pirated material on your computer.

 Here at Geeks to Go we DO NOT support pirated material.

 

An installed P2P, chrome canary, and dev channel ~ the combination of all that instability on top of downloading torrents and cracks the infections you get or in this case have now obtained are pretty much a part of that package. 

Both of the aforementioned Chrome programs themselves break frequently and cause immense problems.  The dev channel is updated daily (or more) with who-knows-what's-in-them-updates that go largely unchecked and of course P2P cracks and torrents come with their own baggage of a questionable nature.

 

In order for any kind of fix to work and hold two things need to be done:

 

1.  The cracks and torrents really should go.  They are technically illegal. 
2.  The Chrome programs should be uninstalled.

  If you wish our help to continue, you need to remove the pirated software.  If you would like to unintall them, or if you would like help removing them, then we can help.
Please let me know what you decide.

 

Thank you

 

[heyage13]

ok what needs to be uninstalled? I've uninstalled the chrome canary...what web browser do you suggest I use?

[23red]

Hi heyage13

 

 

what needs to be uninstalled?

 

 

Uninstalls

 

Go to Start Menu ~> Control Panel ~> Programs ~> Uninstall a program (or Control Panel ~> Programs and Features if using icon view) and remove the following:

 

Java 7 Update 60 (old Java versions kept leave vulnerabilites)
All Chrome

 

Please also remove:

 

C:\Users\Office PC\Downloads\Call.of.Duty.Advanced.Warfare.Proper.Crack-RELOADED.torrent
C:\Users\Office PC\Downloads\Far.Cry.4.Proper-RELOADED.torrent
C:\Users\Office PC\Downloads\Assassins.Creed.Unity.Gold.Edition-3DM.torrent
C:\Users\Office PC\Downloads\Nyomi Banxxx.torrent
Items listed in post #9.

 

 

 

Optional removals:

 

1.  HitmanPro 3.7
I would recommend that you uninstall it. I have seen many posts where HitMan and HitMan Pro have left a system unbootable after using it. Just food for thought.
2.  Vuse

 

I've uninstalled the chrome canary...what web browser do you suggest I use?

 

 

I'm all Internet Explorer, myself   If you prefer Chrome:

Install Chrome from http://www.google.com/chrome/.

 

Please advise if there are any issues with that  

 

Afterwards, please run a fresh FRST log for me:

 

• Right click to run as administrator. When the tool opens click Yes to disclaimer.
• Press Scan button.
• It will produce a log called FRST.txt in the same directory the tool is run from.
• Please copy and paste log back here.

 

When you return please post:

1.  FRST log
2.  How did the uninstalls/removals go?
3.  How is the computer running now?

4.  Do you want Citrix on the computer?

 

Thank you

[heyage13]

Everything went fine and my PC seems to be running much better, I appreciate all your help and advice. I do need the Citrix on my PC as I occasionally need to remotely connect to my work computer and that's what it is used for. 

 

Here is the log:

 

be runningScan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-12-2014

Ran by Office PC (administrator) on OFFICEPC-PC on 01-12-2014 12:24:54

Running from C:\Users\Office PC\Downloads

Loaded Profile: Office PC (Available profiles: Office PC)

Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: English (United States)

Internet Explorer Version 11

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/

 

==================== Processes (Whitelisted) =================

 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

 

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe

(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Microsoft Corporation) C:\Windows\System32\msiexec.exe

 

 

==================== Registry (Whitelisted) ==================

 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

 

HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart

HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2199840 2014-04-30] (NVIDIA Corporation)

HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [1331288 2014-08-22] (Microsoft Corporation)

HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-08-01] (Apple Inc.)

HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)

CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

 

==================== Internet (Whitelisted) ====================

 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

 

SearchScopes: HKLM-x32 -> DefaultScope value is missing.

BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)

BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)

BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)

BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)

BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)

BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)

BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

DPF: HKLM-x32 {4B54A9DE-EF1C-4EBE-A328-7C28EA3B433A} http://quickscan.bit...m/qsax/qsax.cab

Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL (Microsoft Corporation)

Filter-x32: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Tcpip\Parameters: [DhcpNameServer] 64.71.255.204 64.71.255.198

 

FireFox:

========

FF Plugin: @microsoft.com/GENUINE -> disabled No File

FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office15\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()

FF Plugin-x32: @Citrix.com/npican -> C:\Program Files (x86)\Citrix\ICA Client\npicaN.dll (Citrix Systems, Inc.)

FF Plugin-x32: @java.com/DTPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File

FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)

FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll (Microsoft Corporation)

 

Chrome: 

=======

CHR HomePage: Default -> hxxp://google.com/

CHR StartupUrls: Default -> "hxxp://google.com/"

CHR Profile: C:\Users\Office PC\AppData\Local\Google\Chrome\User Data\Default

CHR Extension: (Google Docs) - C:\Users\Office PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-05-23]

CHR Extension: (Google Drive) - C:\Users\Office PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-05-23]

CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Office PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-05-23]

CHR Extension: (YouTube) - C:\Users\Office PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-05-23]

CHR Extension: (Adblock for Youtube™) - C:\Users\Office PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\cmedhionkhpnakcndndgjdbohmhepckk [2014-05-23]

CHR Extension: (Google Search) - C:\Users\Office PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-05-23]

CHR Extension: (Personal Trainer) - C:\Users\Office PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmgohkgndpahjklgpdihieeedjeneoke [2014-05-23]

CHR Extension: (Metal Slug Brutal 3) - C:\Users\Office PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\maphilmnngnhkfigpjjoddpjpfbmpmcc [2014-05-23]

CHR Extension: (Floor plans and interior design) - C:\Users\Office PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\mcafejemebbngbglfoinpoaannbihjna [2014-05-23]

CHR Extension: (Google Wallet) - C:\Users\Office PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-05-23]

CHR Extension: (Pop Art Studio Online) - C:\Users\Office PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\oompiimecpnflklhlnmdpddcjdmiibkf [2014-05-23]

CHR Extension: (Psykopaint) - C:\Users\Office PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgjchkcfmigkkhedgjedmffdepgmpfil [2014-05-23]

CHR Extension: (Weather Underground) - C:\Users\Office PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjejbgheonogbpfkkjigbmahaljipoej [2014-05-23]

CHR Extension: (World Clocks 2) - C:\Users\Office PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjgoijhajhaahklokegbfnohialajpej [2014-05-23]

CHR Extension: (Gmail) - C:\Users\Office PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-05-23]

 

==================== Services (Whitelisted) =================

 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

 

R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [23784 2014-08-22] (Microsoft Corporation)

R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [368624 2014-08-22] (Microsoft Corporation)

S4 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1617696 2014-04-30] (NVIDIA Corporation)

S4 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [21007192 2014-04-30] (NVIDIA Corporation)

 

==================== Drivers (Whitelisted) ====================

 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

 

R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13368 2009-04-06] ()

R3 AtcL001; C:\Windows\System32\DRIVERS\l160x64.sys [61440 2009-10-13] (Atheros Communications, Inc.)

R3 FETNDIS; C:\Windows\System32\DRIVERS\fet6x64.sys [47872 2009-06-10] (VIA Technologies, Inc.              )

R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [269008 2014-07-17] (Microsoft Corporation)

R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-05-14] ()

R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [125584 2014-07-17] (Microsoft Corporation)

S3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [18776 2014-04-30] (NVIDIA Corporation)

R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [40392 2014-03-31] (NVIDIA Corporation)

S3 MBAMSwissArmy; \??\C:\Windows\system32\drivers\MBAMSwissArmy.sys [X]

 

==================== NetSvcs (Whitelisted) ===================

 

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)

 

 

==================== One Month Created Files and Folders ========

 

(If an entry is included in the fixlist, the file\folder will be moved.)

 

2014-12-01 12:24 - 2014-12-01 12:24 - 00000000 ____D () C:\Users\Office PC\Downloads\FRST-OlderVersion

2014-11-28 18:44 - 2014-11-28 18:44 - 00223463 _____ () C:\Users\Office PC\Downloads\Watch.Dogs.Incl.Hotfix.No.Uplay.Repack-BM (1).torrent

2014-11-28 18:42 - 2014-11-28 18:42 - 00223463 _____ () C:\Users\Office PC\Downloads\Watch.Dogs.Incl.Hotfix.No.Uplay.Repack-BM.torrent

2014-11-26 21:01 - 2014-11-26 21:01 - 00045425 _____ () C:\Users\Office PC\Downloads\Windows 7 Sp1 Ultimate 16in1 [x86 x64] OEM ESD Oct 2014 en-US (1).torrent

2014-11-26 18:53 - 2014-11-26 18:53 - 00045425 _____ () C:\Users\Office PC\Downloads\Windows 7 Sp1 Ultimate 16in1 [x86 x64] OEM ESD Oct 2014 en-US.torrent

2014-11-26 18:50 - 2014-11-26 18:51 - 00032600 _____ () C:\Users\Office PC\Downloads\Microsoft Windows 7 Ultimate x64 wSP1 COMPLETE Installation Package.torrent

2014-11-26 17:49 - 2014-12-01 12:17 - 00000900 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-11-26 17:49 - 2014-11-28 18:54 - 00000904 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-11-26 17:49 - 2014-11-26 17:49 - 00003900 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA

2014-11-26 17:49 - 2014-11-26 17:49 - 00003648 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore

2014-11-26 17:49 - 2014-11-26 17:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome

2014-11-26 17:48 - 2014-11-26 17:48 - 00000000 ____D () C:\Users\Office PC\AppData\Local\Deployment

2014-11-26 17:48 - 2014-11-26 17:48 - 00000000 ____D () C:\Users\Office PC\AppData\Local\Apps\2.0

2014-11-26 17:05 - 2014-11-26 17:05 - 00006238 _____ () C:\Users\Office PC\Downloads\ckfiles.txt

2014-11-26 17:00 - 2014-11-26 17:00 - 00468480 _____ () C:\Users\Office PC\Downloads\CKScanner.exe

2014-11-25 20:42 - 2014-11-25 20:42 - 00000000 ____D () C:\Users\Office PC\Desktop\Plugins

2014-11-25 19:52 - 2014-11-25 19:53 - 00023637 _____ () C:\Users\Office PC\Downloads\Addition.txt

2014-11-25 19:51 - 2014-12-01 12:24 - 00013286 _____ () C:\Users\Office PC\Downloads\FRST.txt

2014-11-25 19:50 - 2014-12-01 12:24 - 02117120 _____ (Farbar) C:\Users\Office PC\Downloads\FRST64.exe

2014-11-25 19:50 - 2014-12-01 12:24 - 00000000 ____D () C:\FRST

2014-11-25 19:45 - 2014-11-25 19:45 - 00000000 ____D () C:\_OTL

2014-11-25 18:40 - 2014-11-25 18:40 - 00783352 _____ (Elex do Brasil Participações Ltda) C:\Users\Office PC\Downloads\yet_another_cleaner_avae (1).exe

2014-11-24 22:15 - 2014-11-24 22:15 - 01058272 _____ () C:\Users\Office PC\Downloads\Setup (1).exe

2014-11-23 20:01 - 2014-11-23 20:01 - 01040360 _____ () C:\Users\Office PC\Downloads\flashplayer (3).exe

2014-11-23 12:08 - 2014-11-23 12:08 - 01040368 _____ () C:\Users\Office PC\Downloads\flashplayer (2).exe

2014-11-23 12:06 - 2014-11-23 12:06 - 00773824 _____ (Elex do Brasil Participações Ltda) C:\Users\Office PC\Downloads\yet_another_cleaner_avae.exe

2014-11-22 02:17 - 2014-11-22 02:17 - 19828376 _____ (Malwarebytes Corporation ) C:\Users\Office PC\Downloads\mbam-setup-2.0.3.1025.exe

2014-11-22 02:16 - 2014-11-22 02:16 - 02140160 _____ () C:\Users\Office PC\Downloads\adwcleaner_4.101 (1).exe

2014-11-22 02:12 - 2014-11-22 02:12 - 01707532 _____ (Thisisu) C:\Users\Office PC\Downloads\JRT.exe

2014-11-22 02:09 - 2014-11-22 02:09 - 02140160 _____ () C:\Users\Office PC\Downloads\adwcleaner_4.101.exe

2014-11-22 00:55 - 2014-11-22 00:55 - 01040368 _____ () C:\Users\Office PC\Downloads\flashplayer (1).exe

2014-11-22 00:55 - 2014-11-22 00:55 - 01040360 _____ () C:\Users\Office PC\Downloads\flashplayer.exe

2014-11-20 23:51 - 2014-11-20 23:51 - 00000000 __SHD () C:\Users\Office PC\AppData\Local\EmieBrowserModeList

2014-11-20 23:46 - 2014-11-20 23:46 - 00930768 _____ () C:\Users\Office PC\Downloads\Setup.exe

2014-11-20 22:05 - 2014-11-20 22:05 - 00000452 _____ () C:\Users\Office PC\Downloads\Call.of.Duty.Advanced.Warfare.Proper.Crack-RELOADED.torrent

2014-11-20 22:01 - 2014-11-20 22:01 - 00000000 ____D () C:\Users\Office PC\AppData\Roaming\Steam

2014-11-20 00:09 - 2014-11-20 00:09 - 00000000 ____D () C:\ProgramData\Sonic Academy

2014-11-20 00:06 - 2014-11-20 00:06 - 00000000 ____D () C:\ProgramData\3872871776

2014-11-19 23:34 - 2014-11-19 23:35 - 01929175 _____ () C:\Users\Office PC\Downloads\FL Studio Remakes (FLP).rar

2014-11-19 17:52 - 2014-11-19 17:52 - 00002503 _____ () C:\Users\Public\Desktop\Serato DJ .lnk

2014-11-19 17:42 - 2014-11-19 17:44 - 165019946 _____ () C:\Users\Office PC\Downloads\Serato Dj1.6.1 FULL By #DJALFAMED.rar

2014-11-19 17:20 - 2014-11-19 17:20 - 00560653 _____ () C:\Users\Office PC\Downloads\Far.Cry.4.Proper-RELOADED.torrent

2014-11-19 17:15 - 2014-11-10 22:08 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll

2014-11-19 17:15 - 2014-11-10 22:08 - 00241152 _____ (Microsoft Corporation) C:\Windows\system32\pku2u.dll

2014-11-19 17:15 - 2014-11-10 21:44 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll

2014-11-19 17:15 - 2014-11-10 21:44 - 00186880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pku2u.dll

2014-11-17 23:35 - 2014-11-17 23:35 - 00049541 _____ () C:\Users\Office PC\Downloads\Assassins.Creed.Unity.Gold.Edition-3DM.torrent

2014-11-15 12:52 - 2014-11-15 12:52 - 158762693 _____ () C:\Users\Office PC\Downloads\Serato DJ 1.7.1.zip

2014-11-11 18:05 - 2014-11-07 14:49 - 00388272 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll

2014-11-11 18:05 - 2014-11-07 14:23 - 00341168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll

2014-11-11 18:05 - 2014-11-05 23:04 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-11-11 18:05 - 2014-11-05 23:03 - 25110016 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-11-11 18:05 - 2014-11-05 23:03 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll

2014-11-11 18:05 - 2014-11-05 22:47 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2014-11-11 18:05 - 2014-11-05 22:46 - 00580096 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2014-11-11 18:05 - 2014-11-05 22:46 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll

2014-11-11 18:05 - 2014-11-05 22:44 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll

2014-11-11 18:05 - 2014-11-05 22:43 - 02884096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2014-11-11 18:05 - 2014-11-05 22:36 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2014-11-11 18:05 - 2014-11-05 22:35 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2014-11-11 18:05 - 2014-11-05 22:31 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2014-11-11 18:05 - 2014-11-05 22:30 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2014-11-11 18:05 - 2014-11-05 22:30 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe

2014-11-11 18:05 - 2014-11-05 22:29 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2014-11-11 18:05 - 2014-11-05 22:28 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-11-11 18:05 - 2014-11-05 22:23 - 06040064 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2014-11-11 18:05 - 2014-11-05 22:20 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe

2014-11-11 18:05 - 2014-11-05 22:16 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll

2014-11-11 18:05 - 2014-11-05 22:13 - 00501248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2014-11-11 18:05 - 2014-11-05 22:13 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2014-11-11 18:05 - 2014-11-05 22:12 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll

2014-11-11 18:05 - 2014-11-05 22:10 - 19781632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-11-11 18:05 - 2014-11-05 22:10 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll

2014-11-11 18:05 - 2014-11-05 22:07 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll

2014-11-11 18:05 - 2014-11-05 22:05 - 02277376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2014-11-11 18:05 - 2014-11-05 22:04 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2014-11-11 18:05 - 2014-11-05 22:03 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2014-11-11 18:05 - 2014-11-05 22:02 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2014-11-11 18:05 - 2014-11-05 22:00 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2014-11-11 18:05 - 2014-11-05 22:00 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2014-11-11 18:05 - 2014-11-05 21:59 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2014-11-11 18:05 - 2014-11-05 21:58 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll

2014-11-11 18:05 - 2014-11-05 21:57 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2014-11-11 18:05 - 2014-11-05 21:48 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll

2014-11-11 18:05 - 2014-11-05 21:42 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll

2014-11-11 18:05 - 2014-11-05 21:41 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2014-11-11 18:05 - 2014-11-05 21:41 - 00716800 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2014-11-11 18:05 - 2014-11-05 21:39 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll

2014-11-11 18:05 - 2014-11-05 21:38 - 02124288 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2014-11-11 18:05 - 2014-11-05 21:37 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll

2014-11-11 18:05 - 2014-11-05 21:36 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2014-11-11 18:05 - 2014-11-05 21:34 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll

2014-11-11 18:05 - 2014-11-05 21:30 - 14390272 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2014-11-11 18:05 - 2014-11-05 21:22 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2014-11-11 18:05 - 2014-11-05 21:21 - 04298240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2014-11-11 18:05 - 2014-11-05 21:21 - 02051072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2014-11-11 18:05 - 2014-11-05 21:20 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll

2014-11-11 18:05 - 2014-11-05 21:17 - 02365440 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2014-11-11 18:05 - 2014-11-05 21:04 - 01550336 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2014-11-11 18:05 - 2014-11-05 21:03 - 12819456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2014-11-11 18:05 - 2014-11-05 20:53 - 00799232 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2014-11-11 18:05 - 2014-11-05 20:52 - 01892864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2014-11-11 18:05 - 2014-11-05 20:48 - 01310208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2014-11-11 18:05 - 2014-11-05 20:47 - 00708096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2014-11-11 18:05 - 2014-11-05 12:56 - 00304640 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll

2014-11-11 18:05 - 2014-11-05 12:56 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll

2014-11-11 18:05 - 2014-11-05 12:52 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

2014-11-11 18:05 - 2014-10-24 20:57 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll

2014-11-11 18:05 - 2014-10-24 20:32 - 00067584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\packager.dll

2014-11-11 18:05 - 2014-10-13 21:16 - 00155064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys

2014-11-11 18:05 - 2014-10-13 21:13 - 00683520 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll

2014-11-11 18:05 - 2014-10-13 21:12 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll

2014-11-11 18:05 - 2014-10-13 21:09 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll

2014-11-11 18:05 - 2014-10-13 21:07 - 00681984 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll

2014-11-11 18:05 - 2014-10-13 20:50 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll

2014-11-11 18:05 - 2014-10-13 20:49 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll

2014-11-11 18:05 - 2014-10-13 20:47 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll

2014-11-11 18:05 - 2014-10-13 20:46 - 00681984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll

2014-11-11 18:05 - 2014-10-02 21:12 - 00500224 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll

2014-11-11 18:05 - 2014-10-02 21:11 - 00680960 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll

2014-11-11 18:05 - 2014-10-02 21:11 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll

2014-11-11 18:05 - 2014-10-02 21:11 - 00296448 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll

2014-11-11 18:05 - 2014-10-02 21:11 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll

2014-11-11 18:05 - 2014-10-02 20:44 - 00442880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AUDIOKSE.dll

2014-11-11 18:05 - 2014-10-02 20:44 - 00374784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioEng.dll

2014-11-11 18:05 - 2014-10-02 20:44 - 00195584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioSes.dll

2014-11-11 18:05 - 2014-09-19 04:42 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll

2014-11-11 18:05 - 2014-09-19 04:42 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll

2014-11-11 18:05 - 2014-09-19 04:42 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll

2014-11-11 18:05 - 2014-09-19 04:42 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll

2014-11-11 18:05 - 2014-09-19 04:42 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll

2014-11-11 18:05 - 2014-09-19 04:42 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll

2014-11-11 18:05 - 2014-09-19 04:23 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll

2014-11-11 18:05 - 2014-09-19 04:23 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll

2014-11-11 18:05 - 2014-09-19 04:23 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll

2014-11-11 18:05 - 2014-09-19 04:23 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll

2014-11-11 18:05 - 2014-09-19 04:23 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll

2014-11-11 18:05 - 2014-09-19 04:23 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll

2014-11-11 18:05 - 2014-08-21 01:43 - 01882624 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll

2014-11-11 18:05 - 2014-08-21 01:40 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll

2014-11-11 18:05 - 2014-08-21 01:26 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll

2014-11-11 18:05 - 2014-08-21 01:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll

2014-11-11 18:05 - 2014-08-11 21:02 - 00878080 _____ (Microsoft Corporation) C:\Windows\system32\IMJP10K.DLL

2014-11-11 18:05 - 2014-08-11 20:36 - 00701440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IMJP10K.DLL

2014-11-11 18:04 - 2014-10-17 21:05 - 00861696 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll

2014-11-11 18:04 - 2014-10-17 20:33 - 00571904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll

2014-11-11 18:04 - 2014-10-13 21:13 - 03241984 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll

2014-11-11 18:04 - 2014-10-13 20:50 - 02363904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll

2014-11-11 18:04 - 2014-10-09 19:57 - 03198976 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2014-11-10 21:05 - 2014-11-10 21:05 - 00000000 ____D () C:\Users\Office PC\AppData\Local\Native Instruments

2014-11-10 21:02 - 2014-11-10 21:02 - 00000000 ____D () C:\Program Files\Common Files\Native Instruments

2014-11-10 21:01 - 2014-11-19 17:37 - 00000000 ____D () C:\Program Files\Native Instruments

2014-11-07 18:56 - 2014-11-07 18:56 - 00874864 _____ () C:\Users\Office PC\Downloads\Call.of.Duty.Advanced.Warfare.MULTi6-PROPHET.torrent

2014-11-07 18:56 - 2014-11-07 18:56 - 00208596 _____ () C:\Users\Office PC\Downloads\Call.of.Duty.Advanced.Warfare-CODEX.torrent

2014-11-05 21:55 - 2009-10-24 21:15 - 01332224 _____ (AD © 2009) C:\Windows\SysWOW64\SYNSOEMU.DLL

2014-11-05 00:10 - 2014-11-10 20:23 - 00101260 _____ () C:\Users\Office PC\Desktop\1st Song.flp

 

==================== One Month Modified Files and Folders =======

 

(If an entry is included in the fixlist, the file\folder will be moved.)

 

2014-12-01 12:22 - 2014-07-29 19:49 - 00000000 ____D () C:\Windows\system32\appmgmt

2014-12-01 12:21 - 2009-07-13 23:45 - 00031312 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-12-01 12:21 - 2009-07-13 23:45 - 00031312 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-12-01 12:20 - 2009-07-14 00:13 - 00781298 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-12-01 12:17 - 2009-07-13 23:51 - 00001618 _____ () C:\Windows\setupact.log

2014-12-01 12:16 - 2014-05-23 12:49 - 01173836 _____ () C:\Windows\WindowsUpdate.log

2014-12-01 12:16 - 2009-07-14 00:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-11-28 19:37 - 2014-05-23 17:18 - 00000000 ____D () C:\Users\Office PC\AppData\Roaming\Azureus

2014-11-28 18:27 - 2014-09-10 11:42 - 00000000 ____D () C:\Users\Office PC\Desktop\2014.11.20

2014-11-27 18:36 - 2014-08-10 19:47 - 00001908 _____ () C:\Windows\diagwrn.xml

2014-11-27 18:36 - 2014-08-10 19:47 - 00001908 _____ () C:\Windows\diagerr.xml

2014-11-27 18:36 - 2009-07-13 23:51 - 00000000 _____ () C:\Windows\setuperr.log

2014-11-27 16:42 - 2010-11-20 22:47 - 00020208 _____ () C:\Windows\PFRO.log

2014-11-26 19:14 - 2014-10-28 20:27 - 00000000 ____D () C:\Users\Office PC\Desktop\Samples

2014-11-26 17:49 - 2014-05-23 17:12 - 00000000 ____D () C:\Program Files (x86)\Google

2014-11-26 17:48 - 2014-05-23 17:12 - 00000000 ____D () C:\Users\Office PC\AppData\Local\Google

2014-11-26 17:44 - 2014-10-21 19:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Serato

2014-11-26 17:44 - 2014-10-21 19:34 - 00000000 ____D () C:\Program Files (x86)\Serato

2014-11-24 19:22 - 2009-07-13 22:20 - 00000000 ____D () C:\Windows\system32\NDF

2014-11-22 02:10 - 2013-08-25 18:44 - 00000000 ____D () C:\AdwCleaner

2014-11-20 21:15 - 2014-05-26 21:19 - 00000000 ____D () C:\Users\Office PC\AppData\Roaming\XBMC

2014-11-19 23:32 - 2014-10-14 22:43 - 00000000 ____D () C:\Users\Office PC\AppData\Roaming\FlowStone

2014-11-19 17:52 - 2014-07-08 15:05 - 00000000 ____D () C:\ProgramData\Package Cache

2014-11-15 12:48 - 2014-05-28 18:59 - 00000000 ____D () C:\Users\Office PC\AppData\Local\Apple Computer

2014-11-15 03:02 - 2014-05-23 20:46 - 00000000 ____D () C:\ProgramData\Microsoft Help

2014-11-15 03:01 - 2014-05-23 20:52 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013

2014-11-14 22:40 - 2009-07-13 22:20 - 00000000 ____D () C:\Windows\rescache

2014-11-14 19:02 - 2009-07-13 23:45 - 00433120 _____ () C:\Windows\system32\FNTCACHE.DAT

2014-11-14 19:01 - 2014-05-23 15:22 - 00000000 ___SD () C:\Windows\system32\CompatTel

2014-11-12 01:08 - 2009-07-13 21:34 - 00000478 _____ () C:\Windows\win.ini

2014-11-12 01:07 - 2014-05-23 10:57 - 00000000 ____D () C:\Windows\system32\MRT

2014-11-12 01:04 - 2014-05-23 10:57 - 103374192 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2014-11-10 20:55 - 2014-10-21 18:01 - 00000000 ____D () C:\Program Files (x86)\VstPlugins

2014-11-05 20:47 - 2009-07-14 00:08 - 00032574 _____ () C:\Windows\Tasks\SCHEDLGU.TXT

 

Some content of TEMP:

====================

C:\Users\Office PC\AppData\Local\Temp\HitmanPro.exe

C:\Users\Office PC\AppData\Local\Temp\i4jdel0.exe

 

 

==================== Bamital & volsnap Check =================

 

(There is no automatic fix for files that do not pass verification.)

 

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\SysWOW64\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed

 

 

LastRegBack: 2014-11-25 02:02

 

==================== End Of Log ============================

[23red]

Hi heyage13
 
Let's proceed ~
First you need to put the FRST program on your Desktop.  Please copy it from C:\Users\Office PC\Downloads and paste it onto your Desktop before proceeding.  This fix and the tool need to be in the same place.

 
Step 1
FRST Fix
 
Download attached fixlist.txt file and save it to the Desktop. ~>  fixlist.txt   1.15KB   250 downloads
 
NOTE. It's important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work.
 
NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system
 
Run FRST/FRST64 and press the Fix button just once and wait.

If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.

When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.
 

Step 2
Malwarebytes
 
You have Malwarebytes installed, please right click to run as Administrator, let it check for updates.

• If an update is found, it will download and install the latest updates automatically:
  
  
• Now select the Settings tab, and check the box next to Scan for rootkits:
  
  
• Go back to the Dashboard tab, and click the Scan Now button:
  
  
• The scan may take some time to finish,so please be patient.
  
  
• When the scan is complete, it will show you the results.  (This one is clean):
  
  
• Make sure that everything is checked, and click Quarantine All (or similar).
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.  (See Extra Note below)  If the log doesn't open, select View detailed log in the Scan tab:
  
  
• The log is automatically saved by MBAM and can be viewed by going to the History tab and clicking on Application Logs:
  
  
• Choose the latest Scan Log, and click on the View button:
  
  
• In the bottom of the Scanning History Log window that opens, you can click on Export > Save to Text file (*.txt).  Save the report to your Desktop.
  
  
• Copy & Paste the entire contents of the report log in your next reply.

Let's check for Security issues:
 
Step 3
SecurityCheck by Screen317:
 
Please also download Security Check by screen317.
 
•Save it to your Desktop.
•Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
•A Notepad document should open automatically called checkup.txt; please also post the contents of that document.
 
NOTE: If SecurityCheck aborts and you get the following message: UNSUPPORTED OPERATING SYSTEM! ABORTED!  Try rebooting the system and then run SecurityCheck again.
 

Step 4
Post!
 
When you return, please post:
 
1.  FRST fix log
2.  Malwarebytes log
3.  Checkup.txt
 
Thank you