Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

Findingdiscount removal [Closed]

Started by levin.aj , Dec 15 2014 02:05 PM

  • This topic is locked This topic is locked

#1
levin.aj
Posted 15 December 2014 - 02:05 PM

levin.aj

    New Member

  • Member
  • Pip
  • 2 posts
Hello:
 
I have a problem with my browser constantly redirecting;  there is a program in Windows discount folder that cannot be accessed or removed with control panel.  Any help would be appreciated.

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 14-12-2014 01
Ran by alan (administrator) on SSD on 15-12-2014 07:31:43
Running from C:\Users\alan\Downloads
Loaded Profile: alan (Available profiles: alan)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: English (United States)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.25.11\GoogleCrashHandler.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe
(Spotify Ltd) C:\Users\alan\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.25.11\GoogleCrashHandler64.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
() C:\Program Files (x86)\WajaInternetEnhance\WajaInternetEnhance Internet Enhancer\InternetEnhancerService.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
() C:\Program Files (x86)\WajaInternetEnhance\WajaInternetEnhance Internet Enhancer\InternetEnhancer.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
() C:\Program Files (x86)\Windows NT\Accessories\RuntimeManager\runtimemanager.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe
(Company) C:\Program Files (x86)\Popcorn Time\Updater.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Spotify Ltd) C:\Users\alan\AppData\Roaming\Spotify\spotify.exe
(Samsung) C:\Program Files (x86)\Samsung\Kies\Kies.exe
(Samsung) C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
() C:\Users\alan\AppData\Local\Amazon Music\Amazon Music Helper.exe
(PFU LIMITED) C:\Program Files (x86)\PFU\ScanSnap\Driver\PfuSsMon.exe
(Evernote Corp., 305 Walnut Street, Redwood City, CA 94063) C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe
(Apple Inc.) C:\Program Files (x86)\AirPort\APAgent.exe
(PFU LIMITED) C:\Windows\SSDriver\fi5110\SsWiaChecker.exe
(Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\acrotray.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
(Acronis) C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe
(Acronis) C:\Program Files (x86)\Acronis\TrueImageHome\TimounterMonitor.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\BrYNSvc.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
() C:\Users\alan\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
() C:\Users\alan\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
() C:\Users\alan\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
() C:\Users\alan\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
() C:\Users\alan\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Elements 10 Organizer\PhotoshopElementsFileAgent.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intuit Inc.) C:\Program Files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Microsoft Corporation) C:\Windows\System32\wiawow64.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
() C:\Program Files (x86)\Windows Discount\FindingDiscount\findingdiscount.exe
() C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\AdAwareTray.exe
() C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.WinService.exe
(Lavasoft Limited) C:\Program Files (x86)\Lavasoft\Web Companion\TcpService\2.2.9.5\LavasoftTcpService.exe
(Lavasoft) C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
() C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\AdAwareService.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_15_0_0_246.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_15_0_0_246.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [1331288 2014-08-22] (Microsoft Corporation)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [444904 2012-09-20] (Adobe Systems Incorporated)
HKLM\...\Run: [Acronis Scheduler2 Service] => C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe [375576 2013-04-10] (Acronis)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11905128 2011-06-28] (Realtek Semiconductor)
HKLM\...\Run: [] => [X]
HKLM\...\Run: [AdAwareTray] => C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\AdAwareTray.exe [8925504 2014-10-15] ()
HKLM-x32\...\Run: [JMB36X IDE Setup] => C:\Windows\RaidTool\xInsIDE.exe [36864 2010-05-19] ()
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe [284440 2011-04-30] (Intel Corporation)
HKLM-x32\...\Run: [AirPort Base Station Agent] => C:\Program Files (x86)\AirPort\APAgent.exe [771360 2009-11-11] (Apple Inc.)
HKLM-x32\...\Run: [ScanSnap WIA Service Checker] => C:\Windows\SSDriver\fi5110\SsWiaChecker.exe [86016 2009-09-30] (PFU LIMITED)
HKLM-x32\...\Run: [Adobe Acrobat Speed Launcher] => C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe [44128 2013-05-08] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Acrobat Assistant 8.0] => C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe [642664 2013-05-08] (Adobe Systems Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-12-20] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [60712 2014-10-11] (Apple Inc.)
HKLM-x32\...\Run: [QuickFinder Scheduler] => C:\Program Files (x86)\WordPerfect Office 11\Programs\QFSCHD110.EXE [77887 2003-07-09] (Novell, Inc., c/o Corel Corporation Limited)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642808 2012-12-19] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [KiesTrayAgent] => C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [310640 2013-03-28] (Samsung Electronics Co., Ltd.)
HKLM-x32\...\Run: [TrueImageMonitor.exe] => C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe [5955088 2012-06-28] (Acronis)
HKLM-x32\...\Run: [AcronisTimounterMonitor] => C:\Program Files (x86)\Acronis\TrueImageHome\TimounterMonitor.exe [1171336 2012-06-28] (Acronis)
HKLM-x32\...\Run: [BrStsMon00] => C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe [2621440 2010-06-10] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [157480 2014-10-15] (Apple Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [271744 2014-09-26] (Oracle Corporation)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-10-02] (Apple Inc.)
HKU\S-1-5-21-3898122870-386111202-1819820821-1000\...\Run: [Spotify Web Helper] => C:\Users\alan\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1676344 2014-12-10] (Spotify Ltd)
HKU\S-1-5-21-3898122870-386111202-1819820821-1000\...\Run: [Spotify] => C:\Users\alan\AppData\Roaming\Spotify\Spotify.exe [6737976 2014-12-10] (Spotify Ltd)
HKU\S-1-5-21-3898122870-386111202-1819820821-1000\...\Run: [KiesPreload] => C:\Program Files (x86)\Samsung\Kies\Kies.exe [1511792 2013-03-28] (Samsung)
HKU\S-1-5-21-3898122870-386111202-1819820821-1000\...\Run: [KiesAirMessage] => C:\Program Files (x86)\Samsung\Kies\KiesAirMessage.exe -startup
HKU\S-1-5-21-3898122870-386111202-1819820821-1000\...\Run: [] => C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [1106288 2013-03-28] (Samsung)
HKU\S-1-5-21-3898122870-386111202-1819820821-1000\...\Run: [GoogleChromeAutoLaunch_1AB6B3CFEE2013BCE94DDD8E7D3815B6] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [856904 2014-12-05] (Google Inc.)
HKU\S-1-5-21-3898122870-386111202-1819820821-1000\...\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [43816 2014-10-17] (Apple Inc.)
HKU\S-1-5-21-3898122870-386111202-1819820821-1000\...\Run: [uTorrent] => C:\Users\alan\AppData\Roaming\uTorrent\uTorrent.exe [1378640 2014-12-11] (BitTorrent Inc.)
HKU\S-1-5-21-3898122870-386111202-1819820821-1000\...\Run: [Amazon Music] => C:\Users\alan\AppData\Local\Amazon Music\Amazon Music Helper.exe [3356480 2014-07-22] ()
HKU\S-1-5-21-3898122870-386111202-1819820821-1000\...\Run: [Web Companion] => C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe [1467200 2014-11-27] (Lavasoft)
HKU\S-1-5-21-3898122870-386111202-1819820821-1000\...\MountPoints2: {b99dc4c0-585c-11e2-8581-806e6f6e6963} - E:\Bin\assetup.exe
Startup: C:\Users\alan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EvernoteClipper.lnk
ShortcutTarget: EvernoteClipper.lnk -> C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Conversion to PDF with ScanSnap Organizer.lnk
ShortcutTarget: Conversion to PDF with ScanSnap Organizer.lnk -> C:\Program Files (x86)\PFU\ScanSnap\Organizer\PfuSsOrgOcrChk.exe (PFU LIMITED)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ScanSnap Manager.lnk
ShortcutTarget: ScanSnap Manager.lnk -> C:\Program Files (x86)\PFU\ScanSnap\Driver\PfuSsMon.exe (PFU LIMITED)
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:47574
ProxyEnable: [S-1-5-21-3898122870-386111202-1819820821-1000] => Internet Explorer proxy is enabled.
ProxyServer: [S-1-5-21-3898122870-386111202-1819820821-1000] => http=127.0.0.1:53035;https=127.0.0.1:53035
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKU\S-1-5-21-3898122870-386111202-1819820821-1000\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bing.com/...nlogo=CT3330947
HKU\S-1-5-21-3898122870-386111202-1819820821-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/?ocid=iehp
HKU\S-1-5-21-3898122870-386111202-1819820821-1000\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie
HKU\S-1-5-21-3898122870-386111202-1819820821-1000\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://astromenda.co...r=612014251&ir=
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://astromenda.co...r=612014251&ir=
SearchScopes: HKLM -> {2E00D31D-D171-423D-836D-1A4D7EA7F1A9} URL = http://start.mysearc...r=417167192&ir=
SearchScopes: HKU\S-1-5-21-3898122870-386111202-1819820821-1000 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/...q={searchTerms}
SearchScopes: HKU\S-1-5-21-3898122870-386111202-1819820821-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/...q={searchTerms}
SearchScopes: HKU\S-1-5-21-3898122870-386111202-1819820821-1000 -> {0ED8EE86-37BE-4E45-96A7-C0CC7C12C870} URL = http://websearch.ask...17-156EBCD5BF14
SearchScopes: HKU\S-1-5-21-3898122870-386111202-1819820821-1000 -> {2E00D31D-D171-423D-836D-1A4D7EA7F1A9} URL = http://start.mysearc...r=417167192&ir=
SearchScopes: HKU\S-1-5-21-3898122870-386111202-1819820821-1000 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = http://www.google.com/search?q={sear
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Evernote extension -> {92EF2EAD-A7CE-4424-B0DB-499CF856608E} -> C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)
BHO-x32: Adobe PDF Conversion Toolbar Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: SmartSelect Class -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKU\S-1-5-21-3898122870-386111202-1819820821-1000 -> No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File
Handler: gopher - {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\system32\urlmon.dll (Microsoft Corporation)
Handler-x32: gopher - {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\syswow64\urlmon.dll (Microsoft Corporation)
Winsock: Catalog9 01 C:\Windows\SysWOW64\LavasoftTcpService.dll [312424] (Lavasoft Limited)
Winsock: Catalog9 02 C:\Windows\SysWOW64\LavasoftTcpService.dll [312424] (Lavasoft Limited)
Winsock: Catalog9 03 C:\Windows\SysWOW64\LavasoftTcpService.dll [312424] (Lavasoft Limited)
Winsock: Catalog9 04 C:\Windows\SysWOW64\LavasoftTcpService.dll [312424] (Lavasoft Limited)
Winsock: Catalog9 16 C:\Windows\SysWOW64\LavasoftTcpService.dll [312424] (Lavasoft Limited)
Winsock: Catalog9-x64 01 C:\Windows\system32\LavasoftTcpService64.dll [358736] (Lavasoft Limited)
Winsock: Catalog9-x64 02 C:\Windows\system32\LavasoftTcpService64.dll [358736] (Lavasoft Limited)
Winsock: Catalog9-x64 03 C:\Windows\system32\LavasoftTcpService64.dll [358736] (Lavasoft Limited)
Winsock: Catalog9-x64 04 C:\Windows\system32\LavasoftTcpService64.dll [358736] (Lavasoft Limited)
Winsock: Catalog9-x64 16 C:\Windows\system32\LavasoftTcpService64.dll [358736] (Lavasoft Limited)
Tcpip\Parameters: [DhcpNameServer] 10.0.1.1

FireFox:
========
FF ProfilePath: C:\Users\alan\AppData\Roaming\Mozilla\Firefox\Profiles\kcw302hw.default
FF DefaultSearchEngine: Google
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_246.dll ()
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_246.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Acrobat -> C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll (Adobe Systems)
FF Plugin HKU\S-1-5-21-3898122870-386111202-1819820821-1000: @citrixonline.com/appdetectorplugin -> C:\Users\alan\AppData\Local\Citrix\Plugins\104\npappdetector.dll (Citrix Online)
FF Plugin HKU\S-1-5-21-3898122870-386111202-1819820821-1000: amazon.com/AmazonMP3DownloaderPlugin -> C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin101772.dll (Amazon.com, Inc.)
FF SearchPlugin: C:\Users\alan\AppData\Roaming\Mozilla\Firefox\Profiles\kcw302hw.default\searchplugins\askcom.xml
FF SearchPlugin: C:\Users\alan\AppData\Roaming\Mozilla\Firefox\Profiles\kcw302hw.default\searchplugins\search.xml
FF SearchPlugin: C:\Users\alan\AppData\Roaming\Mozilla\Firefox\Profiles\kcw302hw.default\searchplugins\yahoo-msd.xml
FF Extension: MediaPlayer - C:\Users\alan\AppData\Roaming\Mozilla\Firefox\Profiles\kcw302hw.default\Extensions\[email protected] [2014-12-13]
FF Extension: Search Manager 2 - C:\Users\alan\AppData\Roaming\Mozilla\Firefox\Profiles\kcw302hw.default\Extensions\{3f0ba114-7ec4-4ac6-ad6d-3b259c333458}.xpi [2014-11-24]
FF Extension: Newtab for Moziila Firefox ™ - C:\Users\alan\AppData\Roaming\Mozilla\Firefox\Profiles\kcw302hw.default\Extensions\{4c782321-3297-49ab-adf4-71c10e656059}.xpi [2014-11-30]
FF Extension: Sеarch - C:\Users\alan\AppData\Roaming\Mozilla\Firefox\Profiles\kcw302hw.default\Extensions\{e415d353-ec1b-43ec-886d-ba2be7b2388d}.xpi [2014-08-15]

Chrome:
=======
CHR HomePage: Default -> hxxp://www.google.com/
CHR StartupUrls: Default -> "hxxp://www.google.com", "hxxp://start.mysearchdial.com/?f=1&a=irmsd0101aw&cd=2XzuyEtN2Y1L1QzutCyE0D0A0Ezy0D0CtCyDyD0AtC0EyCtBtN0D0Tzu0SyByDtBtN1L2XzutBtFtBtFtCyDtFtCyDzytBtN1L1CzutDzytDtCtG1T&cr=417167192&ir=", "hxxp://astromenda.com/?f=7&a=ast_dnldstr_14_45_ch&cd=2XzuyEtN2Y1L1QzutCyE0D0A0Ezy0D0CtCyDyD0AtC0EyCtBtN0D0Tzu0StCtDyEtBtN1L2XzutAtFyCtFtCtFtDtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyE0E0AyEtC0F0CyCtG0B0Fzy0DtGyDzytD0AtG0CyEyC0BtGtCtDtAzzyBtCtByEtAzytAtB2QtN1M1F1B2Z1V1N2Y1L1Qzu2StA0DzyyD0D0D0FtBtGtDyEtDyEtGyEyDyCtAtGzyyBtD0AtGyE0BzyzzzzzzyCzyzzyDyCzy2Q&cr=612014251&ir="
CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:inputType}{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}{google:searchVersion}{google:sessionToken}{google:prefetchQuery}sugkey={google:suggestAPIKeyParameter}
CHR Profile: C:\Users\alan\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Drive) - C:\Users\alan\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-01-08]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\alan\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-05-27]
CHR Extension: (YouTube) - C:\Users\alan\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-01-08]
CHR Extension: (Google Search) - C:\Users\alan\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-01-08]
CHR Extension: (Google Wallet) - C:\Users\alan\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-25]
CHR Extension: (Gmail) - C:\Users\alan\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-01-08]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

Locked "FindingDiscount" service was unlocked successfully. <===== ATTENTION

R2 AdobeActiveFileMonitor10.0; C:\Program Files (x86)\Adobe\Elements 10 Organizer\PhotoshopElementsFileAgent.exe [169624 2011-09-01] (Adobe Systems Incorporated)
R3 BrYNSvc; C:\Program Files (x86)\Browny02\BrYNSvc.exe [245760 2010-01-25] (Brother Industries, Ltd.) [File not signed]
R2 FindingDiscount; C:\Program Files (x86)\Windows Discount\FindingDiscount\FindingDiscount.exe [337920 2014-12-11] () [File not signed]
S3 FLEXnet Licensing Service; C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [651720 2013-01-07] (Macrovision Europe Ltd.) [File not signed]
R2 Internet Enhancer Service; C:\Program Files (x86)\WajaInternetEnhance\WajaInternetEnhance Internet Enhancer\InternetEnhancerService.exe [312320 2014-12-12] () [File not signed]
R2 LavasoftAdAwareService11; C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\AdAwareService.exe [707888 2014-10-15] ()
R2 LavasoftTcpService; C:\Program Files (x86)\Lavasoft\Web Companion\TcpService\2.2.9.5\LavasoftTcpService.exe [1351512 2014-11-27] (Lavasoft Limited)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)
S3 McComponentHostService; C:\Program Files (x86)\McAfee Security Scan\3.0.285\McCHSvc.exe [234776 2012-09-05] (McAfee, Inc.)
S3 Media Center 18 Service; C:\Program Files (x86)\J River\Media Center 18\JRService.exe [488704 2013-01-03] (JRiver, Inc.)
S3 Media Center 19 Service; C:\Program Files (x86)\J River\Media Center 19\JRService.exe [397896 2014-06-25] (JRiver, Inc.)
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [23784 2014-08-22] (Microsoft Corporation)
R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [368624 2014-08-22] (Microsoft Corporation)
R2 RuntimeManager; C:\Program Files (x86)\Windows NT\Accessories\RuntimeManager\runtimemanager.exe [186880 2014-12-11] () [File not signed]
R2 SearchProtectionService; C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.WinService.exe [15208 2014-11-27] ()
R2 Update service; C:\Program Files (x86)\Popcorn Time\Updater.exe [179200 2014-10-05] (Company) [File not signed]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 HC-USB; C:\Windows\System32\drivers\gs911usb.sys [76648 2013-04-03] (FTDI Ltd.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2014-12-15] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-11-21] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [269008 2014-07-17] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [125584 2014-07-17] (Microsoft Corporation)
S3 SMIGrabber3C; C:\Windows\System32\Drivers\SmiUsbGrabber3C.sys [821888 2011-01-26] (Windows ® Win 7 DDK provider)
S3 Trufos; C:\Windows\System32\DRIVERS\Trufos.sys [389240 2014-07-10] (BitDefender S.R.L.)
S3 cpuz137; \??\C:\Users\alan\AppData\Local\Temp\cpuz137\cpuz137_x64.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-12-15 07:31 - 2014-12-15 07:31 - 02119168 _____ (Farbar) C:\Users\alan\Downloads\FRST64.exe
2014-12-15 07:31 - 2014-12-15 07:31 - 00029010 _____ () C:\Users\alan\Downloads\FRST.txt
2014-12-15 07:31 - 2014-12-15 07:31 - 00000000 ____D () C:\FRST
2014-12-15 07:21 - 2014-12-15 07:21 - 00000000 ____D () C:\Users\alan\AppData\Roaming\LavasoftStatistics
2014-12-15 07:21 - 2014-12-15 07:21 - 00000000 ____D () C:\Users\alan\AppData\Local\Lavasoft
2014-12-15 07:20 - 2014-12-15 07:21 - 00002305 _____ () C:\Users\Public\Desktop\Ad-Aware Antivirus.lnk
2014-12-15 07:20 - 2014-12-15 07:21 - 00000000 ____D () C:\Users\alan\AppData\Roaming\Lavasoft
2014-12-15 07:20 - 2014-12-15 07:20 - 00004616 _____ () C:\Windows\SysWOW64\LavasoftTcpService.ini
2014-12-15 07:20 - 2014-12-15 07:20 - 00002448 _____ () C:\Windows\SysWOW64\LavasoftTcpServiceOff.ini
2014-12-15 07:20 - 2014-12-15 07:20 - 00002448 _____ () C:\Windows\system32\LavasoftTcpServiceOff.ini
2014-12-15 07:20 - 2014-12-15 07:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lavasoft
2014-12-15 07:20 - 2014-12-15 07:20 - 00000000 ____D () C:\Program Files (x86)\Lavasoft
2014-12-15 07:20 - 2014-11-27 10:44 - 00358736 _____ (Lavasoft Limited) C:\Windows\system32\LavasoftTcpService64.dll
2014-12-15 07:20 - 2014-11-27 10:44 - 00312424 _____ (Lavasoft Limited) C:\Windows\SysWOW64\LavasoftTcpService.dll
2014-12-15 07:19 - 2014-12-15 07:19 - 00000000 ____D () C:\Program Files\Lavasoft
2014-12-15 07:19 - 2014-12-15 07:19 - 00000000 ____D () C:\Program Files\Common Files\Lavasoft
2014-12-15 07:18 - 2014-12-15 07:20 - 00000000 ____D () C:\ProgramData\Lavasoft
2014-12-15 07:18 - 2014-12-15 07:18 - 01753736 _____ () C:\Users\alan\Downloads\Adaware_Installer.exe
2014-12-14 12:19 - 2014-12-15 07:26 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-12-14 12:19 - 2014-12-14 12:19 - 00001102 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-12-14 12:19 - 2014-12-14 12:19 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-12-14 12:19 - 2014-12-14 12:19 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-12-14 12:19 - 2014-12-14 12:19 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-12-14 12:19 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-12-14 12:19 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-12-14 12:19 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-12-14 12:18 - 2014-12-14 12:19 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\alan\Downloads\mbam-setup-2.0.4.1028.exe
2014-12-14 12:01 - 2014-12-14 12:01 - 07457936 _____ () C:\Users\alan\Downloads\SmiUsbGrabber3C.zip
2014-12-14 11:48 - 2014-12-14 22:48 - 00000000 ____D () C:\Users\alan\AppData\Roaming\Open Download Manager
2014-12-14 11:48 - 2014-12-14 13:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PC Tech Hotline
2014-12-14 11:48 - 2014-12-14 11:48 - 00001067 _____ () C:\Users\Public\Desktop\PC Tech Hotline.lnk
2014-12-14 11:48 - 2014-12-14 11:48 - 00000000 ____D () C:\Users\alan\AppData\Roaming\PC Tech Hotline
2014-12-14 11:48 - 2014-12-14 11:48 - 00000000 ____D () C:\ProgramData\Windows Discount
2014-12-14 11:48 - 2014-12-14 11:48 - 00000000 ____D () C:\Program Files (x86)\Windows Discount
2014-12-14 11:47 - 2014-12-14 22:48 - 00000000 ____D () C:\Program Files (x86)\OpenDownloaderManager
2014-12-14 11:47 - 2014-12-14 11:47 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WajaInternetEnhance
2014-12-14 11:47 - 2014-12-14 11:47 - 00000000 ____D () C:\Program Files (x86)\WajaInternetEnhance
2014-12-14 11:44 - 2014-12-14 11:44 - 00453128 _____ (Installer Technology Co) C:\Users\alan\Downloads\Setup_ODM.exe
2014-12-14 08:04 - 2014-12-14 22:48 - 00000000 ____D () C:\Program Files (x86)\NCH Software
2014-12-14 08:04 - 2014-12-14 10:33 - 00000000 ____D () C:\Windows\System32\Tasks\NCH Software
2014-12-14 08:04 - 2014-12-14 08:04 - 04130384 _____ (NCH Software) C:\Users\alan\Downloads\gvsetup.exe
2014-12-14 08:04 - 2014-12-14 08:04 - 00000000 ____D () C:\Users\alan\AppData\Roaming\NCH Software
2014-12-14 08:04 - 2014-12-14 08:04 - 00000000 ____D () C:\ProgramData\NCH Software
2014-12-14 07:26 - 2011-01-26 11:31 - 00821888 _____ (Windows ® Win 7 DDK provider) C:\Windows\system32\Drivers\SmiUsbGrabber3C.sys
2014-12-14 07:16 - 2014-12-14 12:49 - 00000000 ____D () C:\Users\alan\Documents\VHS to DVD
2014-12-14 07:15 - 2014-12-14 07:15 - 00016974 _____ () C:\INSTALL.LOG
2014-12-14 07:15 - 2014-12-14 07:15 - 00000000 ____D () C:\Users\Administrator
2014-12-14 07:15 - 2002-07-26 17:02 - 00153088 _____ () C:\UNWISE.EXE
2014-12-14 07:14 - 2014-12-14 22:47 - 00000000 ____D () C:\Program Files (x86)\honestech VHS to DVD 2.0 SE
2014-12-14 07:09 - 2014-12-14 07:09 - 103847936 _____ () C:\Users\alan\Downloads\ezcap168.iso
2014-12-13 15:14 - 2007-06-28 08:45 - 00632704 _____ (Syntek) C:\Users\alan\Desktop\StkCMini.sys
2014-12-13 15:14 - 2006-12-20 06:08 - 06921856 _____ (Syntek America Inc.) C:\Users\alan\Desktop\StkCPipe.sys
2014-12-13 15:03 - 2014-12-13 15:03 - 00000000 ____D () C:\Users\alan\AppData\Local\VHS to DVD
2014-12-13 14:58 - 2014-12-13 14:58 - 00000000 ____D () C:\Program Files (x86)\honestech
2014-12-13 14:56 - 2014-12-13 14:57 - 63902456 _____ (Acresso Software Inc. ) C:\Users\alan\Downloads\honestechVHStoDVD7Trial.exe
2014-12-13 13:55 - 2014-12-13 13:57 - 908304384 _____ () C:\Users\alan\Desktop\training vid
2014-12-13 13:52 - 2005-12-26 06:11 - 00172032 _____ (Syntek Corporation) C:\Users\alan\Desktop\VideoView.exe
2014-12-13 13:45 - 2010-05-04 22:33 - 00811520 _____ (Windows ® Win 7 DDK provider) C:\Users\alan\Desktop\SmiUsbGrabber3C.sys
2014-12-13 13:45 - 2010-05-04 22:33 - 00007806 _____ () C:\Users\alan\Desktop\smiusbgrabber3c.cat
2014-12-13 13:44 - 2010-05-04 22:33 - 00811520 _____ (Windows ® Win 7 DDK provider) C:\Users\alan\SmiUsbGrabber3C.sys
2014-12-13 13:44 - 2010-05-04 22:33 - 00007806 _____ () C:\Users\alan\smiusbgrabber3c.cat
2014-12-13 13:33 - 2014-12-13 13:33 - 07309570 _____ () C:\Users\alan\Downloads\SM_USB007 Driver by TheFatCheetah.zip
2014-12-13 11:29 - 2014-12-13 11:29 - 04452578 _____ () C:\Users\alan\Downloads\Easycap Drivers for Windows 7.zip
2014-12-13 11:02 - 2014-12-13 11:03 - 29497247 _____ () C:\Users\alan\Downloads\USB2.0_VIDBOX_FW_xp_vista_Win7_Win8_120801.zip
2014-12-13 10:53 - 2014-12-13 10:59 - 379663942 _____ () C:\Users\alan\Downloads\1045.rar
2014-12-13 07:45 - 2014-12-13 07:45 - 12458536 _____ () C:\Users\alan\Downloads\USB-AVCPTSetup_For_Win7.zip
2014-12-11 19:17 - 2014-12-11 19:17 - 00020796 _____ () C:\Users\alan\Downloads\SelectMedication.php
2014-12-10 03:20 - 2014-12-10 03:20 - 00000000 ____D () C:\Windows\system32\appraiser
2014-12-10 03:01 - 2014-10-17 19:05 - 04121600 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll
2014-12-10 03:01 - 2014-10-17 18:33 - 03209728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll
2014-12-10 02:09 - 2014-12-03 19:50 - 00830976 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2014-12-10 02:09 - 2014-12-03 19:50 - 00741376 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2014-12-10 02:09 - 2014-12-03 19:50 - 00413184 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2014-12-10 02:09 - 2014-12-03 19:50 - 00396800 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2014-12-10 02:09 - 2014-12-03 19:50 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-12-10 02:09 - 2014-12-03 19:50 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2014-12-10 02:09 - 2014-12-03 19:44 - 01083392 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-12-10 02:09 - 2014-12-01 16:28 - 01232040 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe
2014-12-10 02:08 - 2014-11-26 18:43 - 00389296 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-12-10 02:08 - 2014-11-26 18:10 - 00342200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-12-10 02:08 - 2014-11-21 20:13 - 25059840 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-12-10 02:08 - 2014-11-21 20:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-12-10 02:08 - 2014-11-21 20:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-12-10 02:08 - 2014-11-21 19:50 - 00580096 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-12-10 02:08 - 2014-11-21 19:50 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-12-10 02:08 - 2014-11-21 19:49 - 02885120 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-12-10 02:08 - 2014-11-21 19:49 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-12-10 02:08 - 2014-11-21 19:48 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-12-10 02:08 - 2014-11-21 19:41 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-12-10 02:08 - 2014-11-21 19:40 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-12-10 02:08 - 2014-11-21 19:37 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-12-10 02:08 - 2014-11-21 19:35 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-12-10 02:08 - 2014-11-21 19:35 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-12-10 02:08 - 2014-11-21 19:34 - 06039552 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-12-10 02:08 - 2014-11-21 19:34 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-12-10 02:08 - 2014-11-21 19:26 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-12-10 02:08 - 2014-11-21 19:22 - 19749376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-12-10 02:08 - 2014-11-21 19:22 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-12-10 02:08 - 2014-11-21 19:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-12-10 02:08 - 2014-11-21 19:14 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-12-10 02:08 - 2014-11-21 19:09 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-12-10 02:08 - 2014-11-21 19:08 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-12-10 02:08 - 2014-11-21 19:07 - 00501248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-12-10 02:08 - 2014-11-21 19:07 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-12-10 02:08 - 2014-11-21 19:06 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-12-10 02:08 - 2014-11-21 19:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-12-10 02:08 - 2014-11-21 19:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-12-10 02:08 - 2014-11-21 19:01 - 02277888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-12-10 02:08 - 2014-11-21 18:59 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-12-10 02:08 - 2014-11-21 18:58 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-12-10 02:08 - 2014-11-21 18:56 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-12-10 02:08 - 2014-11-21 18:55 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-12-10 02:08 - 2014-11-21 18:54 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-12-10 02:08 - 2014-11-21 18:49 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-12-10 02:08 - 2014-11-21 18:49 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-12-10 02:08 - 2014-11-21 18:47 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-12-10 02:08 - 2014-11-21 18:46 - 02125312 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-12-10 02:08 - 2014-11-21 18:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-12-10 02:08 - 2014-11-21 18:43 - 14412800 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-12-10 02:08 - 2014-11-21 18:40 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-12-10 02:08 - 2014-11-21 18:36 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-12-10 02:08 - 2014-11-21 18:35 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-12-10 02:08 - 2014-11-21 18:33 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-12-10 02:08 - 2014-11-21 18:29 - 04299264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-12-10 02:08 - 2014-11-21 18:28 - 02358272 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-12-10 02:08 - 2014-11-21 18:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-12-10 02:08 - 2014-11-21 18:22 - 02052096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-12-10 02:08 - 2014-11-21 18:21 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-12-10 02:08 - 2014-11-21 18:15 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-12-10 02:08 - 2014-11-21 18:13 - 12836864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-12-10 02:08 - 2014-11-21 18:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-12-10 02:08 - 2014-11-21 18:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-12-10 02:08 - 2014-11-21 17:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-12-10 02:08 - 2014-11-21 17:54 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-12-10 02:08 - 2014-11-10 20:09 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2014-12-10 02:08 - 2014-11-10 19:44 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2014-12-10 02:08 - 2014-11-10 18:46 - 00119296 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdx.sys
2014-12-10 02:08 - 2014-11-07 20:16 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-12-10 02:08 - 2014-11-07 19:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2014-12-10 02:08 - 2014-10-29 19:03 - 00165888 _____ (Microsoft Corporation) C:\Windows\system32\charmap.exe
2014-12-10 02:08 - 2014-10-29 18:45 - 00155136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\charmap.exe
2014-12-10 02:08 - 2014-10-02 19:12 - 02020352 _____ (Microsoft Corporation) C:\Windows\system32\WsmSvc.dll
2014-12-10 02:08 - 2014-10-02 19:12 - 00346624 _____ (Microsoft Corporation) C:\Windows\system32\WSManMigrationPlugin.dll
2014-12-10 02:08 - 2014-10-02 19:12 - 00310272 _____ (Microsoft Corporation) C:\Windows\system32\WsmWmiPl.dll
2014-12-10 02:08 - 2014-10-02 19:12 - 00181248 _____ (Microsoft Corporation) C:\Windows\system32\WsmAuto.dll
2014-12-10 02:08 - 2014-10-02 19:11 - 00266240 _____ (Microsoft Corporation) C:\Windows\system32\WSManHTTPConfig.exe
2014-12-10 02:08 - 2014-10-02 18:45 - 01177088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmSvc.dll
2014-12-10 02:08 - 2014-10-02 18:45 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSManMigrationPlugin.dll
2014-12-10 02:08 - 2014-10-02 18:45 - 00214016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmWmiPl.dll
2014-12-10 02:08 - 2014-10-02 18:45 - 00145920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmAuto.dll
2014-12-10 02:08 - 2014-10-02 18:44 - 00198656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSManHTTPConfig.exe
2014-12-09 05:57 - 2014-12-09 05:58 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-12-04 19:49 - 2014-12-04 19:49 - 00697988 _____ () C:\Users\alan\Documents\bev.pptx
2014-12-03 13:25 - 2014-12-03 13:25 - 07283404 _____ () C:\Users\alan\Desktop\IMG_1287.MOV.mov
2014-12-01 19:39 - 2014-12-01 19:39 - 00022528 _____ () C:\Users\alan\AppData\Local\dsisetup1665067772.exe
2014-12-01 19:39 - 2014-12-01 19:39 - 00000002 _____ () C:\Users\alan\AppData\Local\DSI.DAT
2014-11-30 11:01 - 2014-11-30 11:01 - 00243277 _____ () C:\Users\alan\Desktop\waahhflac.flac
2014-11-30 10:59 - 2014-11-30 10:59 - 00243277 _____ () C:\Users\alan\Desktop\waahflac.flac
2014-11-30 10:46 - 2014-11-30 10:47 - 00000000 ____D () C:\Users\alan\AppData\Roaming\freemkvtomp4converter
2014-11-30 10:46 - 2014-11-30 10:46 - 00001394 _____ () C:\Users\Public\Desktop\Free MP4 To MP3 Converter.lnk
2014-11-30 10:46 - 2014-11-30 10:46 - 00000000 ____D () C:\Users\alan\AppData\Local\SkinSoft
2014-11-30 10:46 - 2014-11-30 10:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Free MP4 To MP3 Converter
2014-11-30 10:46 - 2014-11-30 10:46 - 00000000 ____D () C:\Program Files (x86)\Convert Audio Free
2014-11-30 10:45 - 2014-11-30 10:45 - 10170275 _____ (Convert Audio Free) C:\Users\alan\Downloads\mp4tomp3_setup.exe
2014-11-30 10:45 - 2014-11-30 10:45 - 00000000 ____D () C:\Users\alan\AppData\Roaming\Convert Audio Free
2014-11-30 10:38 - 2014-11-30 10:38 - 10529250 _____ () C:\Users\alan\Desktop\20141129_091412.mp4
2014-11-25 06:49 - 2014-11-25 06:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Evernote
2014-11-18 14:56 - 2014-11-18 14:56 - 01202848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FM20.DLL
2014-11-18 14:52 - 2014-11-10 20:08 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-11-18 14:52 - 2014-11-10 20:08 - 00241152 _____ (Microsoft Corporation) C:\Windows\system32\pku2u.dll
2014-11-18 14:52 - 2014-11-10 19:44 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-11-18 14:52 - 2014-11-10 19:44 - 00186880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pku2u.dll
2014-11-17 07:09 - 2014-12-04 07:04 - 21726146 _____ () C:\Users\alan\Desktop\NEW-2014-11-16.QDF

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-12-15 07:25 - 2014-02-04 18:03 - 00000556 _____ () C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-3898122870-386111202-1819820821-1000.job
2014-12-15 07:11 - 2013-01-08 19:13 - 00000898 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-12-15 06:57 - 2013-01-06 16:14 - 01612193 _____ () C:\Windows\WindowsUpdate.log
2014-12-15 06:54 - 2013-01-14 19:36 - 00000000 ____D () C:\Users\alan\AppData\Roaming\Spotify
2014-12-15 06:49 - 2014-11-07 17:44 - 00000288 _____ () C:\Windows\Tasks\UpdaterEX.job
2014-12-15 06:49 - 2013-01-08 19:19 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-12-15 03:00 - 2014-09-01 12:58 - 00000000 ____D () C:\Users\alan\AppData\Local\Adobe
2014-12-14 22:49 - 2013-04-03 20:56 - 00023874 _____ () C:\Windows\DPINST.LOG
2014-12-14 22:49 - 2013-01-06 16:27 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-12-14 22:43 - 2013-01-08 19:13 - 00000894 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-12-14 17:07 - 2009-07-13 22:13 - 00782510 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-12-14 13:11 - 2009-07-13 21:45 - 00022592 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-12-14 13:11 - 2009-07-13 21:45 - 00022592 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-12-14 13:06 - 2013-01-09 00:07 - 00000000 ____D () C:\Users\alan\AppData\Roaming\uTorrent
2014-12-14 13:03 - 2013-07-11 03:25 - 00529770 _____ () C:\Windows\PFRO.log
2014-12-14 13:03 - 2013-03-18 19:27 - 00025453 _____ () C:\Windows\setupact.log
2014-12-14 13:03 - 2009-07-13 22:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-12-14 12:59 - 2009-07-13 22:32 - 00000000 ____D () C:\Windows\Offline Web Pages
2014-12-14 12:58 - 2014-11-07 17:44 - 00000000 ____D () C:\Users\alan\AppData\Roaming\UpdaterEX
2014-12-14 07:49 - 2013-01-14 19:37 - 00000000 ____D () C:\Users\alan\AppData\Local\Spotify
2014-12-14 00:44 - 2014-01-21 12:47 - 00000151 _____ () C:\Users\alan\AppData\Roaming\WB.CFG
2014-12-13 08:03 - 2009-07-13 22:08 - 00032602 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-12-11 19:09 - 2013-11-26 07:46 - 00671600 _____ () C:\Users\alan\Desktop\JULY42~1_20110127OFXLOG.DAT
2014-12-10 14:32 - 2013-01-06 19:04 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-12-10 08:12 - 2013-01-06 19:17 - 21739722 _____ () C:\Users\alan\Desktop\new.QDF
2014-12-10 07:46 - 2013-01-06 19:15 - 35471360 _____ () C:\Users\alan\Desktop\JULY42~1_20110127.QDF
2014-12-10 03:20 - 2014-05-07 03:00 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-12-10 03:20 - 2009-07-13 20:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-12-10 03:20 - 2009-07-13 20:20 - 00000000 ____D () C:\Windows\AppCompat
2014-12-10 03:04 - 2013-08-14 03:01 - 00000000 ____D () C:\Windows\system32\MRT
2014-12-10 03:04 - 2013-02-05 20:08 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-12-10 03:01 - 2013-01-06 21:36 - 112710672 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-12-09 14:34 - 2013-01-08 19:19 - 00003768 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-12-09 14:34 - 2013-01-07 08:08 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-12-09 14:34 - 2013-01-07 08:08 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-12-09 07:52 - 2013-04-22 07:43 - 00000000 ____D () C:\Users\alan\Desktop\BACKUP
2014-12-04 07:52 - 2014-02-04 18:03 - 00003570 _____ () C:\Windows\System32\Tasks\G2MUpdateTask-S-1-5-21-3898122870-386111202-1819820821-1000
2014-12-03 21:31 - 2009-07-13 22:32 - 00000000 ____D () C:\Windows\system32\FxsTmp
2014-12-03 13:19 - 2013-01-07 20:09 - 00000000 ___SD () C:\Users\alan\Documents\ScanSnap
2014-11-30 11:07 - 2013-04-06 22:25 - 00000000 ____D () C:\Users\alan\AppData\Roaming\vlc
2014-11-30 10:49 - 2013-04-06 22:25 - 00001066 _____ () C:\Users\Public\Desktop\VLC media player.lnk

Files to move or delete:
====================
C:\Users\alan\mfc71.dll
C:\Users\alan\mfc71u.dll
C:\Users\alan\msvcp71.dll
C:\Users\alan\msvcr71.dll


Some content of TEMP:
====================
C:\Users\alan\AppData\Local\Temp\3d701429-b9b1-42cb-b15e-bec0f3a61c69.exe
C:\Users\alan\AppData\Local\Temp\jre-7u71-windows-i586-iftw.exe
C:\Users\alan\AppData\Local\Temp\SpOrder.dll
C:\Users\alan\AppData\Local\Temp\utt761.tmp.exe
C:\Users\alan\AppData\Local\Temp\vlc-2.1.5-win32.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2013-01-06 17:24

==================== End Of Log ============================

Attached Files


  • 0

Advertisements

#2
Essexboy
Posted 15 December 2014 - 02:43 PM

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
Hi there, let see what we can do to remove this

First could you uninstall the following programmes :

Duplicate Cleaner Free 3.2.4
Extended Update
YTD Video Downloader 4.8.1

It does not really matter if they do not uninstall properly

CAUTION : This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:
 

CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:47574
ProxyEnable: [S-1-5-21-3898122870-386111202-1819820821-1000] => Internet Explorer proxy is enabled.
ProxyServer: [S-1-5-21-3898122870-386111202-1819820821-1000] => http=127.0.0.1:53035;https=127.0.0.1:53035
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://astromenda.co...r=612014251&ir=
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://astromenda.co...r=612014251&ir=
SearchScopes: HKLM -> {2E00D31D-D171-423D-836D-1A4D7EA7F1A9} URL = http://start.mysearc...r=417167192&ir=
SearchScopes: HKU\S-1-5-21-3898122870-386111202-1819820821-1000 -> {0ED8EE86-37BE-4E45-96A7-C0CC7C12C870} URL = http://websearch.ask...17-156EBCD5BF14
SearchScopes: HKU\S-1-5-21-3898122870-386111202-1819820821-1000 -> {2E00D31D-D171-423D-836D-1A4D7EA7F1A9} URL = http://start.mysearc...r=417167192&ir=
Toolbar: HKU\S-1-5-21-3898122870-386111202-1819820821-1000 -> No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File
FF SearchPlugin: C:\Users\alan\AppData\Roaming\Mozilla\Firefox\Profiles\kcw302hw.default\searchplugins\askcom.xml
FF SearchPlugin: C:\Users\alan\AppData\Roaming\Mozilla\Firefox\Profiles\kcw302hw.default\searchplugins\search.xml
FF SearchPlugin: C:\Users\alan\AppData\Roaming\Mozilla\Firefox\Profiles\kcw302hw.default\searchplugins\yahoo-msd.xml
FF Extension: MediaPlayer - C:\Users\alan\AppData\Roaming\Mozilla\Firefox\Profiles\kcw302hw.default\Extensions\[email protected] [2014-12-13]
FF Extension: Search Manager 2 - C:\Users\alan\AppData\Roaming\Mozilla\Firefox\Profiles\kcw302hw.default\Extensions\{3f0ba114-7ec4-4ac6-ad6d-3b259c333458}.xpi [2014-11-24]
R2 FindingDiscount; C:\Program Files (x86)\Windows Discount\FindingDiscount\FindingDiscount.exe [337920 2014-12-11] () [File not signed]
R2 Internet Enhancer Service; C:\Program Files (x86)\WajaInternetEnhance\WajaInternetEnhance Internet Enhancer\InternetEnhancerService.exe [312320 2014-12-12] () [File not signed]
R2 RuntimeManager; C:\Program Files (x86)\Windows NT\Accessories\RuntimeManager\runtimemanager.exe [186880 2014-12-11] () [File not signed]
2014-12-14 11:48 - 2014-12-14 11:48 - 00001067 _____ () C:\Users\Public\Desktop\PC Tech Hotline.lnk
2014-12-14 11:48 - 2014-12-14 11:48 - 00000000 ____D () C:\Users\alan\AppData\Roaming\PC Tech Hotline
2014-12-14 11:48 - 2014-12-14 11:48 - 00000000 ____D () C:\ProgramData\Windows Discount
2014-12-14 11:48 - 2014-12-14 11:48 - 00000000 ____D () C:\Program Files (x86)\Windows Discount
2014-12-14 11:47 - 2014-12-14 22:48 - 00000000 ____D () C:\Program Files (x86)\OpenDownloaderManager
2014-12-14 11:47 - 2014-12-14 11:47 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WajaInternetEnhance
2014-12-14 11:47 - 2014-12-14 11:47 - 00000000 ____D () C:\Program Files (x86)\WajaInternetEnhance
2014-12-14 11:44 - 2014-12-14 11:44 - 00453128 _____ (Installer Technology Co) C:\Users\alan\Downloads\Setup_ODM.exe
2014-12-14 08:04 - 2014-12-14 08:04 - 04130384 _____ (NCH Software) C:\Users\alan\Downloads\gvsetup.exe
2014-12-14 08:04 - 2014-12-14 08:04 - 00000000 ____D () C:\Users\alan\AppData\Roaming\NCH Software
2014-12-14 08:04 - 2014-12-14 08:04 - 00000000 ____D () C:\ProgramData\NCH Software
2014-12-15 06:49 - 2014-11-07 17:44 - 00000288 _____ () C:\Windows\Tasks\UpdaterEX.job
2014-12-14 12:58 - 2014-11-07 17:44 - 00000000 ____D () C:\Users\alan\AppData\Roaming\UpdaterEX
Task: {5CED01F0-6C53-45BD-AD0C-F394AB07F1CB} - System32\Tasks\{69C81BDB-913A-41DD-B093-27956D9213BA} => E:\RepROM.exe
Task: {5FA99C7A-7BFD-4E2A-8522-B9585D6FC915} - System32\Tasks\UpdaterEX => C:\Users\alan\AppData\Roaming\UPDATE~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: {F69B8C09-79E9-4808-B3E6-F1100A8E0BF6} - System32\Tasks\{9BAB0B04-493F-4244-BB0C-F4517D8AECCE} => E:\RepROM.exe
Task: {F7FDBC3A-B7DE-46C4-B12B-03096136A8BF} - System32\Tasks\{FC5A5113-6833-45FC-A8B2-4F47A916BD60} => E:\RepROM.exe
Task: C:\Windows\Tasks\UpdaterEX.job => C:\Users\alan\AppData\Roaming\UPDATE~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
C:\Users\alan\mfc71.dll
C:\Users\alan\mfc71u.dll
C:\Users\alan\msvcp71.dll
C:\Users\alan\msvcr71.dll
C:\Program Files (x86)\Windows NT
C:\Program Files (x86)\WajaInternetEnhance
C:\Program Files (x86)\Windows Discount
EmptyTemp:
CMD: bitsadmin /reset /allusers


Save this as fixlist.txt, in the same location as FRST.exe
FRSTfix.JPG
Run FRST and press Fix
On completion a log will be generated please post that

THEN

Please download AdwCleaner by Xplode onto your desktop.
  • Close all open programs and internet browsers.
  • Double click on AdwCleaner.exe to run the tool.
  • Click on Scan.
  • After the scan is complete click on "Clean"
  • Confirm each time with Ok.
  • Your computer will be rebooted automatically. A text file will open after the restart.
  • Please post the content of that logfile with your next answer.
  • You can find the logfile at C:\AdwCleaner[S1].txt as well.

  • 0

#3
levin.aj
Posted 15 December 2014 - 07:23 PM

levin.aj

    New Member

  • Topic Starter
  • Member
  • Pip
  • 2 posts

Many thanks.  The two files are attached.  Seems that progress has been made...

Attached Files


  • 0

#4
Essexboy
Posted 16 December 2014 - 08:47 AM

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
Nice, lets now check for orphans. On completion could you let me know what problems remain

Nice, lets now check for orphans. On completion could you let me know what problems remain

Please download Malwarebytes' Anti-Malware from [Here.

Double Click mbam-setup-2.0..exe to install the application. (The revision number may vary.)
  • Select the language and click OK
  • Accept the agreement
  • Launch Malwarebytes' Anti-Malware, then click on finish
  • If an update is found, it will download and install the latest version
  • Once the program has loaded, select Scan Now
  • The scan may take some time to finish,so please be patient
  • When the scan is complete, click on Quarantine All
  • When disinfection is completed, a dialog will open and you may be prompted to Restart.(See Extra Note)
  • Upon restart, launch Malwarebytes Antimalware and select History
  • Double click on the last scan done, then on Copy to Clipboard.
  • To submit your reply, click on Add Reply, then right click on the window and select Paste
  • Submit your reply
    Extra Note:

    If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immedietly.

  • 0

#5
Essexboy
Posted 20 December 2014 - 06:22 AM

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.
  • 0
Back to Virus, Spyware, Malware Removal · Next Unread Topic →




Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. Geeks to Go Community
  2. → Security
  3. → Virus, Spyware, Malware Removal

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP