[taipei_tony]

Hi, I'm running Windows 7 Home Preminium.

 

A few weeks ago, a program was unknowningly installed on my system, Spigot Search Protect. Not sure how it was done, but it was either through Utorrent or by installing a really really old game, "StarSiege Tribes". I uninstalled the program and I think it's gone but I just want to make sure.

 

Also my browser, Firefox, seems to be really sluggish these days. I'm using Avast Free as my antivirus and I've been getting numerous "Threat has been detected" warnings while browsing. I just want to make sure none of these viruses got through.

 

Here's my OTL log:

OTL logfile created on: 1/8/2015 9:14:44 PM - Run 3
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Tony\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.11.9600.17501)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
 
3.91 Gb Total Physical Memory | 2.49 Gb Available Physical Memory | 63.74% Memory free
7.81 Gb Paging File | 5.74 Gb Available in Paging File | 73.50% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 97.66 Gb Total Space | 7.63 Gb Free Space | 7.81% Space Free | Partition Type: NTFS
Drive D: | 185.69 Gb Total Space | 68.47 Gb Free Space | 36.88% Space Free | Partition Type: NTFS
 
Computer Name: TONY-PC | User Name: Tony | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2015/01/08 21:13:13 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Tony\Desktop\OTL.exe
PRC - [2014/12/14 01:58:27 | 005,227,112 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\avastui.exe
PRC - [2014/12/03 14:31:16 | 000,081,088 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2014/11/26 16:12:46 | 000,050,344 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe
PRC - [2014/07/14 18:21:46 | 001,390,176 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
PRC - [2014/07/14 18:21:06 | 001,767,520 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
PRC - [2013/10/16 07:06:12 | 001,016,712 | ---- | M] (Flux Software LLC) -- C:\Users\Tony\AppData\Local\FluxSoftware\Flux\flux.exe
PRC - [2013/06/26 19:21:50 | 000,207,528 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
PRC - [2013/06/26 19:21:46 | 000,523,944 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
PRC - [2011/09/07 01:29:20 | 004,259,648 | ---- | M] (SoftThinks - Dell) -- C:\Program Files (x86)\Dell DataSafe Local Backup\Toaster.exe
PRC - [2011/08/18 23:05:54 | 002,751,808 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\STService.exe
PRC - [2011/08/18 23:05:46 | 001,692,480 | ---- | M] (SoftThinks SAS) -- C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe
PRC - [2011/06/23 23:34:08 | 000,028,288 | ---- | M] (Conexant Systems, Inc.) -- C:\Program Files\CONEXANT\SA3\CxUtilSvc.exe
PRC - [2011/03/31 03:42:34 | 001,001,808 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
PRC - [2011/03/31 03:42:32 | 001,321,296 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe
PRC - [2011/03/31 03:42:30 | 000,923,984 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
PRC - [2011/03/31 03:42:28 | 000,985,424 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Bluetooth\btplayerctrl.exe
PRC - [2011/02/23 20:13:50 | 002,656,280 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe
PRC - [2011/02/23 20:13:46 | 000,326,168 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
PRC - [2011/02/18 21:20:54 | 000,013,336 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe
PRC - [2011/02/18 21:20:50 | 000,283,160 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe
PRC - [2011/01/28 13:15:33 | 000,066,048 | ---- | M] (PostgreSQL Global Development Group) -- C:\Program Files (x86)\PostgreSQL\8.4\bin\pg_ctl.exe
PRC - [2011/01/28 13:13:43 | 004,538,368 | ---- | M] (PostgreSQL Global Development Group) -- C:\Program Files (x86)\PostgreSQL\8.4\bin\postgres.exe
PRC - [2010/12/17 23:25:22 | 000,686,704 | ---- | M] () -- C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2014/11/26 16:12:49 | 038,562,088 | ---- | M] () -- C:\Program Files\AVAST Software\Avast\libcef.dll
MOD - [2014/11/13 06:03:43 | 000,475,648 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\d32ff1bd62fbeb4e889935e8013485f7\IAStorUtil.ni.dll
MOD - [2014/11/13 02:06:06 | 000,774,144 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\8b80d5e968295b1fe3841beeb5912539\System.Runtime.Remoting.ni.dll
MOD - [2014/10/23 04:28:58 | 002,297,344 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Core\1d77c59255cfaa1ed686712980ebb54b\System.Core.ni.dll
MOD - [2014/10/20 00:25:05 | 000,368,128 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\7b22741531a2850c807656d0298a96bd\PresentationFramework.Aero.ni.dll
MOD - [2014/10/20 00:24:34 | 014,340,096 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\74396b3f78bcd3aa5a9cada88dd23355\PresentationFramework.ni.dll
MOD - [2014/10/20 00:24:18 | 012,435,968 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\a277e731e81b74527afefddaacf83cec\System.Windows.Forms.ni.dll
MOD - [2014/10/20 00:24:11 | 001,593,344 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\23c160abc74c5cdb993df0272a1d3c82\System.Drawing.ni.dll
MOD - [2014/10/20 00:24:06 | 005,467,648 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Xml\8ee56845939217383c5d514a3c554c4e\System.Xml.ni.dll
MOD - [2014/10/20 00:24:02 | 000,978,432 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\240c3bc2a636cc5bc7007ac84b9ff61c\System.Configuration.ni.dll
MOD - [2014/10/20 00:24:01 | 012,236,800 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\06a6a4fc43a4172d0595d990bc3f0ddb\PresentationCore.ni.dll
MOD - [2014/10/20 00:23:49 | 003,348,480 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\6a1916f12d012851749172ccdf2e6d93\WindowsBase.ni.dll
MOD - [2014/10/20 00:23:43 | 007,991,808 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System\2d51befb114fedd7db3f5ab02fb3c860\System.ni.dll
MOD - [2014/09/14 20:07:43 | 000,014,336 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\IAStorCommon\9afbc0732818d697f59563155e6a7d88\IAStorCommon.ni.dll
MOD - [2014/09/14 17:18:52 | 011,497,984 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\mscorlib\38bf604432e1a30c954b2ee40d6a2d1c\mscorlib.ni.dll
MOD - [2011/08/18 23:05:54 | 002,751,808 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\STService.exe
MOD - [2010/12/17 23:25:22 | 000,686,704 | ---- | M] () -- C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe
 
 
========== Services (SafeList) ==========
 
SRV:64bit: - [2014/11/26 16:12:46 | 000,050,344 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe -- (avast! Antivirus)
SRV:64bit: - [2014/11/26 16:12:37 | 004,012,248 | ---- | M] (Avast Software) [On_Demand | Stopped] -- C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe -- (AvastVBoxSvc)
SRV:64bit: - [2014/11/22 10:35:29 | 000,114,688 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\windows\SysNative\IEEtwCollector.exe -- (IEEtwCollectorService)
SRV:64bit: - [2013/05/27 13:50:47 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV:64bit: - [2011/06/23 23:34:08 | 000,028,288 | ---- | M] (Conexant Systems, Inc.) [Auto | Running] -- C:\Program Files\CONEXANT\SA3\CxUtilSvc.exe -- (CxUtilSvc)
SRV:64bit: - [2011/05/12 05:06:38 | 000,200,320 | ---- | M] (Conexant Systems Inc.) [Auto | Running] -- C:\Windows\SysNative\CxAudMsg64.exe -- (CxAudMsg)
SRV:64bit: - [2011/05/03 03:27:50 | 001,517,328 | ---- | M] (Intel® Corporation) [Auto | Stopped] -- C:\Program Files\Intel\WiFi\bin\EvtEng.exe -- (EvtEng)
SRV:64bit: - [2011/05/03 03:13:54 | 000,340,240 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe -- (MyWiFiDHCPDNS)
SRV:64bit: - [2011/05/03 03:10:26 | 000,844,560 | ---- | M] (Intel® Corporation) [Auto | Running] -- C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe -- (RegSrvc)
SRV:64bit: - [2011/04/21 22:34:16 | 001,136,640 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe -- (AMPPALR3)
SRV:64bit: - [2011/04/21 21:42:50 | 000,134,928 | ---- | M] (Intel® Corporation) [Auto | Running] -- C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe -- (BTHSSecurityMgr)
SRV:64bit: - [2010/09/23 07:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)
SRV - [2014/12/20 01:58:29 | 000,267,440 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2014/12/03 14:31:16 | 000,081,088 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2014/07/14 18:21:46 | 001,390,176 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe -- (c2cautoupdatesvc)
SRV - [2014/07/14 18:21:06 | 001,767,520 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe -- (c2cpnrsvc)
SRV - [2013/09/11 21:21:54 | 000,105,144 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2013/06/26 19:21:50 | 000,207,528 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe -- (sftvsa)
SRV - [2013/06/26 19:21:46 | 000,523,944 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe -- (sftlist)
SRV - [2012/05/01 02:30:00 | 000,489,256 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2011/08/18 23:05:46 | 001,692,480 | ---- | M] (SoftThinks SAS) [Auto | Running] -- C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe -- (SftService)
SRV - [2011/03/31 03:42:34 | 001,001,808 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe -- (Bluetooth OBEX Service)
SRV - [2011/03/31 03:42:32 | 001,321,296 | ---- | M] (Intel Corporation) [On_Demand | Running] -- C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe -- (Bluetooth Media Service)
SRV - [2011/03/31 03:42:30 | 000,923,984 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe -- (Bluetooth Device Monitor)
SRV - [2011/02/23 20:13:50 | 002,656,280 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe -- (UNS)
SRV - [2011/02/23 20:13:46 | 000,326,168 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe -- (LMS)
SRV - [2011/02/18 21:20:54 | 000,013,336 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc)
SRV - [2011/01/28 13:15:33 | 000,066,048 | ---- | M] (PostgreSQL Global Development Group) [Auto | Running] -- C:\Program Files (x86)\PostgreSQL\8.4\bin\pg_ctl.exe -- (postgresql-8.4)
SRV - [2010/08/26 09:28:54 | 002,823,000 | ---- | M] (Dell, Inc.) [Auto | Running] -- C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuAgent.exe -- (NOBU)
SRV - [2010/05/05 01:07:22 | 000,503,080 | ---- | M] (Nero AG) [Disabled | Stopped] -- C:\Program Files (x86)\Nero\Update\NASvc.exe -- (NAUpdate)
SRV - [2009/06/11 05:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2014/11/26 16:13:10 | 001,050,432 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\Windows\SysNative\drivers\aswsnx.sys -- (aswSnx)
DRV:64bit: - [2014/11/26 16:12:55 | 000,267,632 | ---- | M] () [Kernel | Boot | Running] -- C:\windows\SysNative\drivers\aswVmm.sys -- (aswVmm)
DRV:64bit: - [2014/11/26 16:12:55 | 000,116,728 | ---- | M] (AVAST Software) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\aswstm.sys -- (aswStm)
DRV:64bit: - [2014/11/26 16:12:54 | 000,436,624 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\Windows\SysNative\drivers\aswsp.sys -- (aswSP)
DRV:64bit: - [2014/11/26 16:12:54 | 000,093,568 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswRdr2.sys -- (aswRdr)
DRV:64bit: - [2014/11/26 16:12:54 | 000,083,280 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\aswMonFlt.sys -- (aswMonFlt)
DRV:64bit: - [2014/11/26 16:12:54 | 000,065,776 | ---- | M] () [Kernel | Boot | Running] -- C:\windows\SysNative\drivers\aswRvrt.sys -- (aswRvrt)
DRV:64bit: - [2014/11/26 16:12:54 | 000,029,208 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\aswHwid.sys -- (aswHwid)
DRV:64bit: - [2014/11/26 16:12:37 | 000,271,752 | ---- | M] (Avast Software) [Kernel | Auto | Running] -- C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys -- (VBoxAswDrv)
DRV:64bit: - [2013/10/02 10:22:20 | 000,056,832 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2013/09/18 04:33:40 | 000,042,184 | ---- | M] (Anchorfree Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\taphss6.sys -- (taphss6)
DRV:64bit: - [2013/06/26 19:21:50 | 000,023,208 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftvollh.sys -- (Sftvol)
DRV:64bit: - [2013/06/26 19:21:48 | 000,028,840 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftredirlh.sys -- (Sftredir)
DRV:64bit: - [2013/06/26 19:21:46 | 000,273,576 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftplaylh.sys -- (Sftplay)
DRV:64bit: - [2013/06/26 19:21:44 | 000,767,144 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftfslh.sys -- (Sftfs)
DRV:64bit: - [2013/04/30 16:51:09 | 000,040,616 | ---- | M] (The OpenVPN Project) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\tap0901.sys -- (tap0901)
DRV:64bit: - [2013/02/12 12:12:06 | 000,019,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usb8023x.sys -- (usb_rndisx)
DRV:64bit: - [2012/12/06 12:11:40 | 011,518,976 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Netwsw00.sys -- (NETwNs64)
DRV:64bit: - [2012/08/23 22:10:20 | 000,019,456 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
DRV:64bit: - [2012/08/23 22:08:26 | 000,030,208 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD)
DRV:64bit: - [2012/03/01 14:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2011/12/09 19:45:00 | 000,060,416 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\iBtFltCoex.sys -- (iBtFltCoex)
DRV:64bit: - [2011/11/15 01:13:00 | 000,327,168 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btmhsf.sys -- (btmhsf)
DRV:64bit: - [2011/07/21 06:21:50 | 000,406,336 | ---- | M] (Texas Instruments Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\tixhci.sys -- (tixhci)
DRV:64bit: - [2011/07/21 06:21:50 | 000,136,000 | ---- | M] (Texas Instruments Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\tihub3.sys -- (tihub3)
DRV:64bit: - [2011/06/11 03:16:08 | 012,230,912 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)
DRV:64bit: - [2011/06/10 11:04:38 | 001,591,936 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CHDRT64.sys -- (CnxtHdAudService)
DRV:64bit: - [2011/06/10 06:34:52 | 000,539,240 | ---- | M] (Realtek                                            ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2011/04/30 10:03:12 | 001,439,280 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP)
DRV:64bit: - [2011/04/21 22:09:26 | 000,294,912 | ---- | M] (Windows ® Win 7 DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\AmpPal.sys -- (AMPPALP)
DRV:64bit: - [2011/04/21 22:09:26 | 000,294,912 | ---- | M] (Windows ® Win 7 DDK provider) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AmpPal.sys -- (AMPPAL)
DRV:64bit: - [2011/03/24 19:47:02 | 000,034,200 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\intelaud.sys -- (intaud_WaveExtensible)
DRV:64bit: - [2011/03/24 19:47:02 | 000,025,496 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\iwdbus.sys -- (iwdbus)
DRV:64bit: - [2011/03/11 14:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011/03/11 14:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2011/03/09 03:44:08 | 000,051,712 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btmaux.sys -- (btmaux)
DRV:64bit: - [2011/02/18 21:11:54 | 000,439,320 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:64bit: - [2011/01/21 00:20:46 | 000,176,096 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CtClsFlt.sys -- (CtClsFlt)
DRV:64bit: - [2011/01/16 00:21:04 | 000,036,352 | ---- | M] (Elaborate Bytes AG) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\VClone.sys -- (VClone)
DRV:64bit: - [2010/12/17 06:58:14 | 000,040,816 | ---- | M] (Elaborate Bytes AG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\ElbyCDIO.sys -- (ElbyCDIO)
DRV:64bit: - [2010/12/13 22:34:14 | 000,027,760 | ---- | M] (ST Microelectronics) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Accelern.sys -- (Acceler)
DRV:64bit: - [2010/12/09 12:29:58 | 000,032,344 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\MCfilt64.sys -- (MCfilt)
DRV:64bit: - [2010/12/02 08:12:06 | 000,250,984 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RtsUStor.sys -- (RSUSBSTOR)
DRV:64bit: - [2010/11/21 11:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010/10/21 00:34:26 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (MEIx64)
DRV:64bit: - [2010/10/15 17:28:16 | 000,317,440 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\IntcDAud.sys -- (IntcDAud)
DRV:64bit: - [2010/08/21 00:05:12 | 000,021,616 | ---- | M] (ST Microelectronics) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\stdcfltn.sys -- (stdcfltn)
DRV:64bit: - [2009/07/14 09:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009/07/14 09:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009/07/14 09:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009/06/11 04:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009/06/11 04:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009/06/11 04:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009/06/11 04:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2006/11/02 01:51:00 | 000,151,656 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WimFltr.sys -- (WimFltr)
DRV - [2009/07/14 09:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...ms}&FORM=IE8SRC
IE:64bit: - HKLM\..\SearchScopes\{2F1E335A-858A-4BE9-8F6B-D0AF1D018B53}: "URL" = http://www.bing.com/...rc=IE-SearchBox
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...ms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{2F1E335A-858A-4BE9-8F6B-D0AF1D018B53}: "URL" = http://www.bing.com/...rc=IE-SearchBox
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://search.us.com...ED81E}&serpv=17
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = https://tw.search.ya...r=spigot-yhp-ie
IE - HKCU\..\SearchScopes,DefaultScope = {E8A5D506-E19A-4E15-B702-C408EB56A033}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...Box&FORM=IE11SR
IE - HKCU\..\SearchScopes\{E8A5D506-E19A-4E15-B702-C408EB56A033}: "URL" = https://tw.search.ya...p={searchTerms}
IE - HKCU\..\SearchScopes\{F025182F-F258-48C6-945A-2B529C0699E4}: "URL" = http://search.yahoo....petb&type=10583
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.hiddenOneOffs: "Yahoo,Bing,Amazon.com,DuckDuckGo,eBay,Twitter,Wikipedia (en),Yahoo!"
FF - prefs.js..browser.search.highlightCount: 0
FF - prefs.js..browser.search.isUS: false
FF - prefs.js..browser.search.selectedEngine: "Yahoo!"
FF - prefs.js..browser.startup.homepage: "www.yahoo.com | www.google.com"
FF - prefs.js..extensions.enabledAddons: chineseperakun%40gmail.com:9.0.0
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:34.0.5
FF - prefs.js..keyword.URL: "https://tw.search.ya...type=523482&p="
FF - user.js - File not found
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\system32\Macromed\Flash\NPSWF64_16_0_0_235.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_235.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.71.2: C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre7\bin\new_plugin\npjp2.dll File not found
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.71.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll File not found
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin: C:\Users\Tony\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files\AVAST Software\Avast\WebRep\FF [2014/11/26 16:12:56 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 34.0.5\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 34.0.5\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
 
[2011/10/05 01:57:53 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Tony\AppData\Roaming\Mozilla\Extensions
[2015/01/08 18:07:04 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Tony\AppData\Roaming\Mozilla\Firefox\Profiles\gt83rqoy.default-1383689389646\extensions
[2013/12/31 04:21:22 | 000,000,000 | ---D | M] (Perapera Chinese) -- C:\Users\Tony\AppData\Roaming\Mozilla\Firefox\Profiles\gt83rqoy.default-1383689389646\extensions\[email protected]
[2014/12/27 16:21:16 | 000,008,150 | ---- | M] () -- C:\Users\Tony\AppData\Roaming\Mozilla\Firefox\Profiles\gt83rqoy.default-1383689389646\searchplugins\yahoo_ff.xml
[2014/12/10 00:11:15 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\browser\extensions
[2014/12/10 00:11:29 | 000,000,000 | ---D | M] (Default) -- C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
 
O1 HOSTS File: ([2009/06/11 05:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (avast! Online Security) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
O2:64bit: - BHO: (Skype Click to Call for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\SkypeIEPlugin.dll (Microsoft Corporation)
O2:64bit: - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll File not found
O2 - BHO: (avast! Online Security) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll File not found
O2 - BHO: (Skype Click to Call for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll File not found
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll File not found
O3:64bit: - HKLM\..\Toolbar: (no name) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No CLSID value found.
O3:64bit: - HKLM\..\Toolbar: (no name) - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - No CLSID value found.
O4:64bit: - HKLM..\Run: [BTMTrayAgent] C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll (Intel Corporation)
O4:64bit: - HKLM..\Run: [FreeFallProtection] C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe ()
O4:64bit: - HKLM..\Run: [Google Pinyin 3 Autoupdater] C:\Program Files\Google\Google Pinyin 3\GooglePinyinDaemon.exe (Google Inc.)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IntelPAN] C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe (Intel® Corporation)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe (Dell Inc.)
O4:64bit: - HKLM..\Run: [SmartAudio] C:\Program Files\CONEXANT\SA3\SACpl.exe (Conexant Systems, Inc.)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" File not found
O4 - HKLM..\Run: [AvastUI.exe] C:\Program Files\AVAST Software\Avast\AvastUI.exe (AVAST Software)
O4 - HKLM..\Run: [Dell Webcam Central] C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
O4 - HKCU..\Run: [F.lux] C:\Users\Tony\AppData\Local\FluxSoftware\Flux\flux.exe (Flux Software LLC)
O4 - HKCU..\RunOnce: [Adobe Speed Launcher] 1420711044 File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: SoftwareSASGeneration = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableLockWorkstation = 0
O9:64bit: - Extra Button: Skype Click to Call settings - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\SkypeIEPlugin.dll (Microsoft Corporation)
O9 - Extra Button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files (x86)\PokerStars\PokerStarsUpdate.exe File not found
O9 - Extra Button: Skype Click to Call settings - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll File not found
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset...lineScanner.cab (OnlineScanner Control)
O16 - DPF: {88B8A9C7-10A1-4535-8EEB-0D875349E5B8} https://etrade.emega...w/CA/axekey.cab (SendOrder Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 10.71.2)
O16 - DPF: {C1F8FC10-E5DB-4112-9DBF-6C3FF728D4E3} http://support.dell....lSystemLite.CAB (DellSystemLite.Scanner)
O16 - DPF: {CAFEEFAC-0017-0000-0071-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.7.0_71)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.7.0_71)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{0714651A-25F9-4DC3-AACC-7C8EE204E81D}: DhcpNameServer = 192.168.42.129
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1F54C2B4-EF9C-48AD-9DCA-F25EF5107F83}: DhcpNameServer = 192.168.1.1
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\skypec2c {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\SkypeIEPlugin.dll (Microsoft Corporation)
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skypec2c {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll File not found
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\windows\SysWow64\userinit.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\windows\SysNative\igfxdev.dll (Intel Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{3803d1af-f40d-11e1-aa08-ac7289af52e8}\Shell - "" = AutoRun
O33 - MountPoints2\{3803d1af-f40d-11e1-aa08-ac7289af52e8}\Shell\AutoRun\command - "" = E:\autorun.exe
O33 - MountPoints2\{3803d1af-f40d-11e1-aa08-ac7289af52e8}\Shell\directx\command - "" = E:\DirectX9\dxsetup.exe
O33 - MountPoints2\{3803d1af-f40d-11e1-aa08-ac7289af52e8}\Shell\setup\command - "" = E:\setup.exe
O33 - MountPoints2\{974717a2-46ab-11e1-a3d0-ac7289af52e8}\Shell - "" = AutoRun
O33 - MountPoints2\{974717a2-46ab-11e1-a3d0-ac7289af52e8}\Shell\AutoRun\command - "" = E:\TL-Bootstrap.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2015/01/08 21:13:12 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Tony\Desktop\OTL.exe
[2015/01/01 19:54:29 | 000,000,000 | ---D | C] -- C:\Users\Tony\Desktop\Stocks
[2014/12/26 14:21:05 | 000,000,000 | ---D | C] -- C:\windows\solcache
[2014/12/26 14:20:51 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Sierra On-Line
[2014/12/12 06:58:34 | 000,000,000 | ---D | C] -- C:\windows\rescache
[2014/12/11 08:47:10 | 000,000,000 | ---D | C] -- C:\windows\SysNative\appraiser
[2014/12/10 00:11:14 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox
[10 C:\windows\SysWow64\*.tmp files -> C:\windows\SysWow64\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2015/01/08 21:13:13 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Tony\Desktop\OTL.exe
[2015/01/08 21:07:30 | 000,028,576 | -H-- | M] () -- C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2015/01/08 21:07:30 | 000,028,576 | -H-- | M] () -- C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2015/01/08 20:56:03 | 000,000,924 | ---- | M] () -- C:\windows\tasks\FacebookUpdateTaskUserS-1-5-21-3482530603-2352231087-752530051-1000UA.job
[2015/01/08 20:54:00 | 000,000,830 | ---- | M] () -- C:\windows\tasks\Adobe Flash Player Updater.job
[2015/01/08 20:42:43 | 000,081,564 | ---- | M] () -- C:\Users\Tony\Desktop\3.jpg
[2015/01/08 20:42:31 | 000,101,787 | ---- | M] () -- C:\Users\Tony\Desktop\2.jpg
[2015/01/08 20:42:18 | 000,099,237 | ---- | M] () -- C:\Users\Tony\Desktop\1.jpg
[2015/01/08 17:56:19 | 000,067,584 | --S- | M] () -- C:\windows\bootstat.dat
[2015/01/08 17:56:11 | 3147,399,168 | -HS- | M] () -- C:\hiberfil.sys
[2015/01/07 03:49:38 | 000,001,538 | ---- | M] () -- C:\Users\Tony\Desktop\Logs - Shortcut.lnk
[2015/01/06 23:07:19 | 000,000,902 | ---- | M] () -- C:\windows\tasks\FacebookUpdateTaskUserS-1-5-21-3482530603-2352231087-752530051-1000Core.job
[2015/01/06 15:28:25 | 000,211,175 | ---- | M] () -- C:\Users\Tony\Desktop\mon2.jpg
[2015/01/05 09:35:39 | 000,213,271 | ---- | M] () -- C:\Users\Tony\Desktop\sun lose.jpg
[2015/01/04 07:51:42 | 000,248,264 | ---- | M] () -- C:\Users\Tony\Desktop\first.jpg
[2014/12/30 11:15:18 | 000,000,017 | ---- | M] () -- C:\windows\SysWow64\shortcut_ex.dat
[2014/12/27 14:15:12 | 000,000,151 | ---- | M] () -- C:\windows\Sierra.ini
[10 C:\windows\SysWow64\*.tmp files -> C:\windows\SysWow64\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2015/01/08 20:42:42 | 000,081,564 | ---- | C] () -- C:\Users\Tony\Desktop\3.jpg
[2015/01/08 20:42:30 | 000,101,787 | ---- | C] () -- C:\Users\Tony\Desktop\2.jpg
[2015/01/08 20:42:17 | 000,099,237 | ---- | C] () -- C:\Users\Tony\Desktop\1.jpg
[2015/01/07 03:49:38 | 000,001,538 | ---- | C] () -- C:\Users\Tony\Desktop\Logs - Shortcut.lnk
[2015/01/06 15:28:25 | 000,211,175 | ---- | C] () -- C:\Users\Tony\Desktop\mon2.jpg
[2015/01/05 09:35:38 | 000,213,271 | ---- | C] () -- C:\Users\Tony\Desktop\sun lose.jpg
[2015/01/04 07:51:42 | 000,248,264 | ---- | C] () -- C:\Users\Tony\Desktop\first.jpg
[2014/12/30 11:15:18 | 000,000,017 | ---- | C] () -- C:\windows\SysWow64\shortcut_ex.dat
[2014/12/26 14:20:39 | 000,000,151 | ---- | C] () -- C:\windows\Sierra.ini
[2013/11/06 04:17:15 | 000,000,600 | ---- | C] () -- C:\Users\Tony\PUTTY.RND
[2011/10/15 23:33:11 | 000,007,646 | ---- | C] () -- C:\Users\Tony\AppData\Local\Resmon.ResmonCfg
 
========== ZeroAccess Check ==========
 
[2009/07/14 12:55:00 | 000,000,227 | RHS- | M] () -- C:\windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2014/06/25 10:05:42 | 014,175,744 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2014/06/25 09:41:30 | 012,874,240 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2012/08/21 21:11:31 | 000,857,088 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2012/08/21 21:37:44 | 000,636,928 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2012/08/21 21:08:38 | 000,453,120 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
 
========== LOP Check ==========
 
[2013/11/06 06:40:38 | 000,000,000 | ---D | M] -- C:\Users\Tony\AppData\Roaming\amazon
[2014/01/23 01:52:35 | 000,000,000 | ---D | M] -- C:\Users\Tony\AppData\Roaming\AVAST Software
[2014/04/07 16:53:13 | 000,000,000 | ---D | M] -- C:\Users\Tony\AppData\Roaming\Dropbox
[2014/04/06 22:48:17 | 000,000,000 | ---D | M] -- C:\Users\Tony\AppData\Roaming\DropboxMaster
[2011/10/04 21:59:38 | 000,000,000 | ---D | M] -- C:\Users\Tony\AppData\Roaming\Fingertapps
[2012/09/22 16:05:50 | 000,000,000 | ---D | M] -- C:\Users\Tony\AppData\Roaming\GameRanger
[2015/01/04 07:36:31 | 000,000,000 | ---D | M] -- C:\Users\Tony\AppData\Roaming\HEM Data
[2014/12/06 23:56:16 | 000,000,000 | ---D | M] -- C:\Users\Tony\AppData\Roaming\HoldemManager
[2011/10/04 21:59:23 | 000,000,000 | ---D | M] -- C:\Users\Tony\AppData\Roaming\Leadertech
[2011/10/15 18:24:39 | 000,000,000 | ---D | M] -- C:\Users\Tony\AppData\Roaming\OpenOffice.org
[2014/11/14 06:00:34 | 000,000,000 | ---D | M] -- C:\Users\Tony\AppData\Roaming\Oracle
[2011/10/20 09:02:44 | 000,000,000 | ---D | M] -- C:\Users\Tony\AppData\Roaming\PCDr
[2012/12/21 22:27:56 | 000,000,000 | ---D | M] -- C:\Users\Tony\AppData\Roaming\postgresql
[2012/12/01 18:34:34 | 000,000,000 | ---D | M] -- C:\Users\Tony\AppData\Roaming\Roaming
[2014/11/18 05:28:55 | 000,000,000 | ---D | M] -- C:\Users\Tony\AppData\Roaming\SoftGrid Client
[2011/10/05 02:22:05 | 000,000,000 | ---D | M] -- C:\Users\Tony\AppData\Roaming\TP
[2012/06/01 01:35:34 | 000,000,000 | ---D | M] -- C:\Users\Tony\AppData\Roaming\UBNet
[2015/01/06 15:43:05 | 000,000,000 | ---D | M] -- C:\Users\Tony\AppData\Roaming\uTorrent
[2012/11/24 19:29:04 | 000,000,000 | ---D | M] -- C:\Users\Tony\AppData\Roaming\Windows Live Writer
 
========== Purity Check ==========
 
 

< End of report >
 

Edited by taipei_tony, 08 January 2015 - 07:36 AM.

[Advertisements]

 

Download : ADWCleaner to your desktop.  Make sure you get the correct Download button.  Sometimes the ads on BleepingComputer will mimic the real Download button which should say: Download Now @BleepingComputer

 

NOTE: If using Internet Explorer and you get an alert that stops the program downloading, click on the warning and allow the download to complete.

 

Close  all programs, pause your anti-virus and run AdwCleaner (Vista or Win 7 => right click and Run As Administrator).

 

 

Click on Scan  and follow the prompts. Let it run unhindered. When done, click on the Clean button, and follow the prompts. Allow the system to reboot. You will then be presented with the report. Copy & Paste this report on your next reply.

 

The report will be saved in the C:\AdwCleaner folder.

 

 

 

Junkware-Removal-Tool

 

Please download Junkware Removal Tool to your desktop.  Make sure you get the correct Download button.  Sometimes the ads on BleepingComputer will mimic the real Download button which should say: Download Now @Author's site

• Pause your anti-virus.  Close all browsers.

Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".

The tool will open and start scanning your system.

Please be patient as this can take a while to complete depending on your system's specifications.

On completion, a log (JRT.txt) is saved to your desktop and will automatically open.

Post the contents of JRT.txt into your next message.

 

 

 

Please download Farbar Recovery Scan Tool and save it to your Desktop. 

 

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version. 

 

•  

Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer. 

Press Scan button. 

It will produce a log called FRST.txt in the same directory the tool is run from.  

Please copy and paste log back here. 

The first time the tool is run it generates another log (Addition.txt - also located in the same directory as FRST.exe/FRST64.exe). Please also paste that along with the FRST.txt into your reply. 

[RKinner]

 

Download : ADWCleaner to your desktop.  Make sure you get the correct Download button.  Sometimes the ads on BleepingComputer will mimic the real Download button which should say: Download Now @BleepingComputer

 

NOTE: If using Internet Explorer and you get an alert that stops the program downloading, click on the warning and allow the download to complete.

 

Close  all programs, pause your anti-virus and run AdwCleaner (Vista or Win 7 => right click and Run As Administrator).

 

 

Click on Scan  and follow the prompts. Let it run unhindered. When done, click on the Clean button, and follow the prompts. Allow the system to reboot. You will then be presented with the report. Copy & Paste this report on your next reply.

 

The report will be saved in the C:\AdwCleaner folder.

 

 

 

Junkware-Removal-Tool

 

Please download Junkware Removal Tool to your desktop.  Make sure you get the correct Download button.  Sometimes the ads on BleepingComputer will mimic the real Download button which should say: Download Now @Author's site

• Pause your anti-virus.  Close all browsers.

Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".

The tool will open and start scanning your system.

Please be patient as this can take a while to complete depending on your system's specifications.

On completion, a log (JRT.txt) is saved to your desktop and will automatically open.

Post the contents of JRT.txt into your next message.

 

 

 

Please download Farbar Recovery Scan Tool and save it to your Desktop. 

 

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version. 

 

•  

Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer. 

Press Scan button. 

It will produce a log called FRST.txt in the same directory the tool is run from.  

Please copy and paste log back here. 

The first time the tool is run it generates another log (Addition.txt - also located in the same directory as FRST.exe/FRST64.exe). Please also paste that along with the FRST.txt into your reply. 

[taipei_tony]

Hi, thanks for the response.

 

I ran Adwcleaner and deleted all the files it found except for one. There was a file in the Windows System folder named "reboot64.exe", that seemed important so I left it. Here's the log:

 

# AdwCleaner v4.107 - Report created 09/01/2015 at 16:39:24
# Updated 07/01/2015 by Xplode
# Database : 2015-01-03.1 [Live]
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
# Username : Tony - TONY-PC
# Running from : C:\Users\Tony\Desktop\AdwCleaner.exe
# Option : Clean

***** [ Services ] *****


***** [ Files / Folders ] *****

Folder Deleted : C:\windows\SysWOW64\hotspot shield
Folder Deleted : C:\windows\SysWOW64\config\systemprofile\AppData\Roaming\hotspot shield
[x] Not Deleted : C:\windows\System32\roboot64.exe
File Deleted : C:\Users\Tony\AppData\Roaming\Mozilla\Firefox\Profiles\gt83rqoy.default-1383689389646\invalidprefs.js

***** [ Scheduled Tasks ] *****


***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{459DD0F7-0D55-D3DC-67BC-E6BE37E9D762}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : HKCU\Software\anchorfree

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.17496

Setting Restored : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page]

-\\ Mozilla Firefox v34.0.5 (x86 en-US)


*************************

AdwCleaner[R0].txt - [2070 octets] - [06/11/2013 06:12:44]
AdwCleaner[R1].txt - [2041 octets] - [06/11/2013 06:18:13]
AdwCleaner[R2].txt - [1966 octets] - [09/01/2015 16:27:42]
AdwCleaner[S0].txt - [2090 octets] - [06/11/2013 06:23:43]
AdwCleaner[S1].txt - [1801 octets] - [09/01/2015 16:39:24]

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [1861 octets] ##########
 

 

Here's the JRT log:

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.4.1 (12.28.2014:1)
OS: Windows 7 Home Premium x64
Ran by Tony on Fri 01/09/2015 at 16:48:03.84
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values

Successfully repaired: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\\Default_Page_URL



~~~ Registry Keys



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\ProgramData\pcdr"
Successfully deleted: [Folder] "C:\Users\Tony\AppData\Roaming\pcdr"
Successfully deleted: [Empty Folder] C:\Users\Tony\appdata\local\{00E89FC5-717A-4A74-98F9-4DD378AD6DEB}
Successfully deleted: [Empty Folder] C:\Users\Tony\appdata\local\{04DAFA05-4A1C-4EBE-8A03-8AEC137FB2B9}
Successfully deleted: [Empty Folder] C:\Users\Tony\appdata\local\{0BB2F482-512E-4E05-A300-585A6CD55E3D}
Successfully deleted: [Empty Folder] C:\Users\Tony\appdata\local\{1B620D6C-80DD-4E76-A421-3E9542282F91}
Successfully deleted: [Empty Folder] C:\Users\Tony\appdata\local\{1ED242C0-0D44-4C29-B774-F43AAE72A329}
Successfully deleted: [Empty Folder] C:\Users\Tony\appdata\local\{21B49184-E2CC-443B-AE22-E0C80DD6706E}
Successfully deleted: [Empty Folder] C:\Users\Tony\appdata\local\{22A8B3FD-F1C9-4FEC-BD34-906A5DD5FAF5}
Successfully deleted: [Empty Folder] C:\Users\Tony\appdata\local\{2F2B22CD-432B-4F2B-B20D-DCB8D23A8C24}
Successfully deleted: [Empty Folder] C:\Users\Tony\appdata\local\{2F64122A-3344-4449-8659-BE71C6072D8E}
Successfully deleted: [Empty Folder] C:\Users\Tony\appdata\local\{33A2E5BF-4644-47B7-B532-F61948BD74D0}
Successfully deleted: [Empty Folder] C:\Users\Tony\appdata\local\{346B9633-A117-4B3A-AD6D-F1A6D5BD89B0}
Successfully deleted: [Empty Folder] C:\Users\Tony\appdata\local\{34CD0EE3-ABCB-4924-99F7-C1426DF599DF}
Successfully deleted: [Empty Folder] C:\Users\Tony\appdata\local\{356FEEDC-1FB3-40AA-8291-D69474F1159D}
Successfully deleted: [Empty Folder] C:\Users\Tony\appdata\local\{374C3924-7503-4FD4-9414-52AA9CFCB563}
Successfully deleted: [Empty Folder] C:\Users\Tony\appdata\local\{380192E0-5E7D-4FB8-8313-A784A25C1745}
Successfully deleted: [Empty Folder] C:\Users\Tony\appdata\local\{38E801E2-2AF6-4DA0-8A5E-998005809D0D}
Successfully deleted: [Empty Folder] C:\Users\Tony\appdata\local\{39AFF37B-3C0F-47EE-82C2-D91548E1245E}
Successfully deleted: [Empty Folder] C:\Users\Tony\appdata\local\{39FF741C-E55A-4F1B-BF68-C3E36132ED31}
Successfully deleted: [Empty Folder] C:\Users\Tony\appdata\local\{3A562976-DD39-472B-9EF7-B8D01BBC308B}
Successfully deleted: [Empty Folder] C:\Users\Tony\appdata\local\{3FEE00E9-0F0C-40B0-BCD0-C35AEBDC2A0E}
Successfully deleted: [Empty Folder] C:\Users\Tony\appdata\local\{453F8750-FF7E-45D6-B4E2-4801AF310255}
Successfully deleted: [Empty Folder] C:\Users\Tony\appdata\local\{473C0F64-8AD4-438C-B2DA-4AE107CF723F}
Successfully deleted: [Empty Folder] C:\Users\Tony\appdata\local\{4A28D676-A588-47CD-9B22-1C76E3A5711A}
Successfully deleted: [Empty Folder] C:\Users\Tony\appdata\local\{50DB1759-C437-4F85-95A8-84E5366754CA}
Successfully deleted: [Empty Folder] C:\Users\Tony\appdata\local\{54044A5A-AB0C-446F-8E6F-283CACEBE581}
Successfully deleted: [Empty Folder] C:\Users\Tony\appdata\local\{5D8FA0B4-11A8-4202-A94E-E62B92C8E595}
Successfully deleted: [Empty Folder] C:\Users\Tony\appdata\local\{5E8F092C-710F-4D42-AD80-46F16AAAAF4C}
Successfully deleted: [Empty Folder] C:\Users\Tony\appdata\local\{605CD37F-F89C-4CB8-B3F4-12E8896B3DFE}
Successfully deleted: [Empty Folder] C:\Users\Tony\appdata\local\{611FC08A-06AA-487D-B518-192D0C345EC8}
Successfully deleted: [Empty Folder] C:\Users\Tony\appdata\local\{62AFAF8D-AAD8-4C9B-8BDC-DFB7B6C46A56}
Successfully deleted: [Empty Folder] C:\Users\Tony\appdata\local\{6673225B-C570-46EC-BEF7-8A38494EAA03}
Successfully deleted: [Empty Folder] C:\Users\Tony\appdata\local\{66D634A2-58E0-4BEB-8C96-15B9A97619B4}
Successfully deleted: [Empty Folder] C:\Users\Tony\appdata\local\{6E39C2B4-225D-415A-BF69-2DDD33B455F9}
Successfully deleted: [Empty Folder] C:\Users\Tony\appdata\local\{6F1ADA24-0864-4DAA-957B-09E32F5B46BE}
Successfully deleted: [Empty Folder] C:\Users\Tony\appdata\local\{75C64383-D90D-4316-AFC6-B1C896252224}
Successfully deleted: [Empty Folder] C:\Users\Tony\appdata\local\{80314806-E7B6-4921-A6A7-BB5A544B0F74}
Successfully deleted: [Empty Folder] C:\Users\Tony\appdata\local\{85844D0B-2472-428C-BF2F-6912AAD38ABA}
Successfully deleted: [Empty Folder] C:\Users\Tony\appdata\local\{877EC2D0-394A-4535-84A2-684A992B1B7C}
Successfully deleted: [Empty Folder] C:\Users\Tony\appdata\local\{8B0A5666-F58F-469D-86BC-C41871275607}
Successfully deleted: [Empty Folder] C:\Users\Tony\appdata\local\{8CAA2501-6081-41F1-9DDA-1CE99B2EEC32}
Successfully deleted: [Empty Folder] C:\Users\Tony\appdata\local\{98BDC005-3748-44F3-8C96-B1F81F3453DD}
Successfully deleted: [Empty Folder] C:\Users\Tony\appdata\local\{9B5E8323-6B31-43AB-8A78-DE4FD495F43D}
Successfully deleted: [Empty Folder] C:\Users\Tony\appdata\local\{9EBAE6BD-35BD-4088-8096-5DEAED32E142}
Successfully deleted: [Empty Folder] C:\Users\Tony\appdata\local\{A6948810-0A5F-4722-96F3-5C0C1D4275B3}
Successfully deleted: [Empty Folder] C:\Users\Tony\appdata\local\{A7069B81-4BD1-421A-AEF7-C5AAC4AE05BC}
Successfully deleted: [Empty Folder] C:\Users\Tony\appdata\local\{A7AE5307-3EA9-44A4-BCF0-D777BE045D7C}
Successfully deleted: [Empty Folder] C:\Users\Tony\appdata\local\{AA997E92-7C22-4852-82EA-419D51C6A899}
Successfully deleted: [Empty Folder] C:\Users\Tony\appdata\local\{B0AB805B-F6DD-4688-B8E4-D0D2DF5291A3}
Successfully deleted: [Empty Folder] C:\Users\Tony\appdata\local\{B22912EB-8344-48BB-8615-902E7F222298}
Successfully deleted: [Empty Folder] C:\Users\Tony\appdata\local\{BB0A2C23-28BC-4506-8270-125662CE8FE3}
Successfully deleted: [Empty Folder] C:\Users\Tony\appdata\local\{C128121F-FDAF-4CEA-996F-31577CEF7C9B}
Successfully deleted: [Empty Folder] C:\Users\Tony\appdata\local\{C1C0D98C-C44D-4004-82C1-2245D4AACBB4}
Successfully deleted: [Empty Folder] C:\Users\Tony\appdata\local\{C2D1CE9B-E412-4E13-9580-73B85195A488}
Successfully deleted: [Empty Folder] C:\Users\Tony\appdata\local\{C4CE3B8F-CDA8-43BA-BC90-B5ACA06598C7}
Successfully deleted: [Empty Folder] C:\Users\Tony\appdata\local\{C53E3BC8-7719-4D40-AA9B-5E4A376EC92C}
Successfully deleted: [Empty Folder] C:\Users\Tony\appdata\local\{CB957BCB-936D-480B-A6E2-716DD05B5ED6}
Successfully deleted: [Empty Folder] C:\Users\Tony\appdata\local\{CF9E2587-FE72-472E-8E16-4D44C562686F}
Successfully deleted: [Empty Folder] C:\Users\Tony\appdata\local\{D5E8583C-B2F9-48FF-B6B5-544C7CA8A4CF}
Successfully deleted: [Empty Folder] C:\Users\Tony\appdata\local\{E56B2277-35CA-4289-A170-5D2C9995ABEB}
Successfully deleted: [Empty Folder] C:\Users\Tony\appdata\local\{EC8CAFF7-5291-456A-96B4-80766B30C900}
Successfully deleted: [Empty Folder] C:\Users\Tony\appdata\local\{F0C1A710-5669-42F3-914E-B026DD49F387}
Successfully deleted: [Empty Folder] C:\Users\Tony\appdata\local\{F1DF9913-D2A9-4D94-A877-94D5104182DC}
Successfully deleted: [Empty Folder] C:\Users\Tony\appdata\local\{F453492C-2490-49D9-94DE-C931B89CF8F1}
Successfully deleted: [Empty Folder] C:\Users\Tony\appdata\local\{F909B012-0258-40AF-A4CA-6C0D97A88359}



~~~ FireFox

Emptied folder: C:\Users\Tony\AppData\Roaming\mozilla\firefox\profiles\gt83rqoy.default-1383689389646\minidumps [99 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Fri 01/09/2015 at 16:52:34.96
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 

 

And here are the two Farbar logs:

 

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 07-01-2015
Ran by Tony (administrator) on TONY-PC on 09-01-2015 16:54:55
Running from C:\Users\Tony\Desktop
Loaded Profiles: Tony & postgres (Available profiles: Tony & postgres)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: English (United States)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel® Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
() C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Dell Inc.) C:\Program Files\Dell\QuickSet\quickset.exe
(Intel® Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Google Inc.) C:\Program Files\Google\Google Pinyin 3\GooglePinyinDaemon.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Flux Software LLC) C:\Users\Tony\AppData\Local\FluxSoftware\Flux\flux.exe
(Conexant Systems Inc.) C:\Windows\System32\CxAudMsg64.exe
(Conexant Systems, Inc.) C:\Program Files\CONEXANT\SA3\CxUtilSvc.exe
() C:\Program Files\Google\Google Pinyin 3\GooglePinyinService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe
(Conexant Systems, Inc.) C:\Program Files\CONEXANT\SA3\SmartAudio3.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Dell, Inc.) C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuAgent.exe
(PostgreSQL Global Development Group) C:\Program Files (x86)\PostgreSQL\8.4\bin\pg_ctl.exe
(PostgreSQL Global Development Group) C:\Program Files (x86)\PostgreSQL\8.4\bin\postgres.exe
(SoftThinks SAS) C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe
(PostgreSQL Global Development Group) C:\Program Files (x86)\PostgreSQL\8.4\bin\postgres.exe
(PostgreSQL Global Development Group) C:\Program Files (x86)\PostgreSQL\8.4\bin\postgres.exe
(PostgreSQL Global Development Group) C:\Program Files (x86)\PostgreSQL\8.4\bin\postgres.exe
(PostgreSQL Global Development Group) C:\Program Files (x86)\PostgreSQL\8.4\bin\postgres.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
(SoftThinks - Dell) C:\Program Files (x86)\Dell DataSafe Local Backup\Toaster.exe
() C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\STService.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\btplayerctrl.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2780968 2011-04-30] (Synaptics Incorporated)
HKLM\...\Run: [FreeFallProtection] => C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe [686704 2010-12-17] ()
HKLM\...\Run: [QuickSet] => C:\Program Files\Dell\QuickSet\QuickSet.exe [3668336 2011-03-25] (Dell Inc.)
HKLM\...\Run: [IntelPAN] => C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe [1935120 2011-05-03] (Intel® Corporation)
HKLM\...\Run: [BTMTrayAgent] => rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll",TrayApp
HKLM\...\Run: [Google Pinyin 3 Autoupdater] => C:\Program Files\Google\Google Pinyin 3\GooglePinyinDaemon.exe [1854008 2011-10-25] (Google Inc.)
HKLM\...\Run: [SmartAudio] => C:\Program Files\CONEXANT\SA3\SACpl.exe [1573504 2011-06-23] (Conexant Systems, Inc.)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe [283160 2011-02-18] (Intel Corporation)
HKLM-x32\...\Run: [Dell Webcam Central] => C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe [503942 2011-04-13] (Creative Technology Ltd)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe"
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1021128 2014-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5227112 2014-12-14] (AVAST Software)
Winlogon\Notify\igfxcui: C:\windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-3482530603-2352231087-752530051-1000\...\Run: [F.lux] => C:\Users\Tony\AppData\Local\FluxSoftware\Flux\flux.exe [1016712 2013-10-16] (Flux Software LLC)
HKU\S-1-5-21-3482530603-2352231087-752530051-1000\...\Policies\system: [DisableLockWorkstation] 0
HKU\S-1-5-21-3482530603-2352231087-752530051-1000\...\MountPoints2: {3803d1af-f40d-11e1-aa08-ac7289af52e8} - E:\autorun.exe
HKU\S-1-5-21-3482530603-2352231087-752530051-1000\...\MountPoints2: {974717a2-46ab-11e1-a3d0-ac7289af52e8} - E:\TL-Bootstrap.exe
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software)
ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Tony\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Tony\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Tony\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Tony\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Tony\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Tony\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Tony\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Tony\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll (Dropbox, Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

SearchScopes: HKLM -> {2F1E335A-858A-4BE9-8F6B-D0AF1D018B53} URL = http://www.bing.com/...rc=IE-SearchBox
SearchScopes: HKLM-x32 -> {2F1E335A-858A-4BE9-8F6B-D0AF1D018B53} URL = http://www.bing.com/...rc=IE-SearchBox
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-3482530603-2352231087-752530051-1000 -> {E8A5D506-E19A-4E15-B702-C408EB56A033} URL = https://tw.search.ya...p={searchTerms}
SearchScopes: HKU\S-1-5-21-3482530603-2352231087-752530051-1000 -> {F025182F-F258-48C6-945A-2B529C0699E4} URL = http://search.yahoo....petb&type=10583
SearchScopes: HKU\S-1-5-21-3482530603-2352231087-752530051-1002 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre6\bin\jp2ssv.dll No File
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll No File
BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll No File
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} -  No File
Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} -  No File
DPF: HKLM-x32 {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset...lineScanner.cab
DPF: HKLM-x32 {88B8A9C7-10A1-4535-8EEB-0D875349E5B8} https://etrade.emega...w/CA/axekey.cab
DPF: HKLM-x32 {C1F8FC10-E5DB-4112-9DBF-6C3FF728D4E3} http://support.dell....lSystemLite.CAB
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\Tony\AppData\Roaming\Mozilla\Firefox\Profiles\gt83rqoy.default-1383689389646
FF SelectedSearchEngine: Yahoo!
FF Homepage: www.yahoo.com | www.google.com
FF Keyword.URL: https://tw.search.ya...&type=523482&p=
FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF64_16_0_0_235.dll ()
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_235.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin -> C:\Program Files (x86)\Java\jre7\bin\new_plugin\npjp2.dll No File
FF Plugin-x32: @java.com/JavaPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll No File
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-3482530603-2352231087-752530051-1000: @Skype Limited.com/Facebook Video Calling Plugin -> C:\Users\Tony\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF SearchPlugin: C:\Users\Tony\AppData\Roaming\Mozilla\Firefox\Profiles\gt83rqoy.default-1383689389646\searchplugins\yahoo_ff.xml
FF Extension: Perapera Chinese - C:\Users\Tony\AppData\Roaming\Mozilla\Firefox\Profiles\gt83rqoy.default-1383689389646\Extensions\[email protected] [2013-12-31]
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2014-12-10]
FF HKLM-x32\...\Firefox\Extensions: [[email protected]] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2011-10-08]

Chrome:
=======
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-11-26]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-11-26] (AVAST Software)
S3 AvastVBoxSvc; C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe [4012248 2014-11-26] (Avast Software)
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)
R2 CxUtilSvc; C:\Program Files\Conexant\SA3\CxUtilSvc.exe [28288 2011-06-23] (Conexant Systems, Inc.)
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed]
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [340240 2011-05-03] ()
R2 postgresql-8.4; C:/Program Files (x86)/PostgreSQL/8.4/bin/pg_ctl.exe runservice -N "postgresql-8.4" -D "C:/Program Files (x86)/PostgreSQL/8.4/data" -w [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-11-26] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [83280 2014-11-26] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-11-26] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-11-26] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1050432 2014-11-26] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [436624 2014-11-26] (AVAST Software)
S2 aswStm; C:\Windows\system32\drivers\aswStm.sys [116728 2014-11-26] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [267632 2014-11-26] ()
R3 MCfilt; C:\Windows\System32\drivers\MCfilt64.sys [32344 2010-12-09] (Creative Technology Ltd.)
S3 taphss6; C:\Windows\System32\DRIVERS\taphss6.sys [42184 2013-09-18] (Anchorfree Inc.)
R2 VBoxAswDrv; C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [271752 2014-11-26] (Avast Software)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-09 16:54 - 2015-01-09 16:55 - 00016842 _____ () C:\Users\Tony\Desktop\FRST.txt
2015-01-09 16:54 - 2015-01-09 16:54 - 00000000 ____D () C:\FRST
2015-01-09 16:52 - 2015-01-09 16:52 - 00007743 _____ () C:\Users\Tony\Desktop\JRT.txt
2015-01-09 16:48 - 2015-01-09 16:48 - 00000000 ____D () C:\windows\ERUNT
2015-01-09 16:46 - 2015-01-09 16:46 - 02124288 _____ (Farbar) C:\Users\Tony\Desktop\FRST64.exe
2015-01-09 16:44 - 2015-01-09 16:44 - 01707939 _____ (Thisisu) C:\Users\Tony\Desktop\JRT.exe
2015-01-09 16:43 - 2015-01-09 16:43 - 00001949 _____ () C:\Users\Tony\Desktop\AdwCleaner[S1].txt
2015-01-09 16:24 - 2015-01-09 16:24 - 02191360 _____ () C:\Users\Tony\Desktop\AdwCleaner.exe
2015-01-08 21:22 - 2015-01-08 21:22 - 00091362 _____ () C:\Users\Tony\Desktop\OTL.Txt
2015-01-08 21:13 - 2015-01-08 21:13 - 00602112 _____ (OldTimer Tools) C:\Users\Tony\Desktop\OTL.exe
2015-01-08 18:27 - 2015-01-08 19:39 - 217932271 _____ () C:\Users\Tony\Downloads\1466hj.wmv
2015-01-07 03:49 - 2015-01-07 03:49 - 00001538 _____ () C:\Users\Tony\Desktop\Logs - Shortcut.lnk
2015-01-06 04:27 - 2015-01-06 04:35 - 273127579 ____R () C:\Users\Tony\Downloads\sgs_veronica_rodriguez_480p_1000.mp4
2015-01-05 10:05 - 2015-01-05 10:05 - 00001393 _____ () C:\Users\Tony\Desktop\sun review.txt
2015-01-04 12:35 - 2015-01-04 12:35 - 00001211 _____ () C:\Users\Tony\Desktop\review2.txt
2015-01-04 11:48 - 2015-01-04 11:48 - 00001087 _____ () C:\Users\Tony\Desktop\trips post.txt
2015-01-04 01:56 - 2015-01-04 01:57 - 00000197 _____ () C:\windows\system32\2015-01-03-17-56-52.089-AvastVBoxSVC.exe-4212.log
2015-01-02 12:21 - 2015-01-02 12:22 - 00000197 _____ () C:\windows\system32\2015-01-02-04-21-50.068-AvastVBoxSVC.exe-5920.log
2015-01-01 19:54 - 2015-01-01 19:55 - 00000000 ____D () C:\Users\Tony\Desktop\Stocks
2015-01-01 12:15 - 2015-01-01 12:15 - 00000197 _____ () C:\windows\system32\2015-01-01-04-15-48.063-AvastVBoxSVC.exe-5288.log
2014-12-30 19:02 - 2014-12-30 19:03 - 00000197 _____ () C:\windows\system32\2014-12-30-11-02-46.049-AvastVBoxSVC.exe-5364.log
2014-12-30 11:15 - 2014-12-30 11:15 - 00000017 _____ () C:\windows\SysWOW64\shortcut_ex.dat
2014-12-29 15:29 - 2014-12-29 16:39 - 254246916 _____ () C:\Users\Tony\Downloads\2007_LLT.wmv
2014-12-29 15:04 - 2014-12-29 16:15 - 717731553 ____R () C:\Users\Tony\Downloads\dtl_daisymarie-wmvFullHigh-1.wmv
2014-12-29 14:00 - 2014-12-29 14:34 - 296732146 _____ () C:\Users\Tony\Downloads\sashagrey-gbg_5-sc6.avi
2014-12-29 10:14 - 2014-12-29 10:15 - 00000197 _____ () C:\windows\system32\2014-12-29-02-14-31.023-AvastVBoxSVC.exe-4132.log
2014-12-28 19:22 - 2014-12-28 19:22 - 00000197 _____ () C:\windows\system32\2014-12-28-11-22-20.055-AvastVBoxSVC.exe-4220.log
2014-12-27 14:15 - 2014-12-27 14:15 - 00000000 ____D () C:\Users\Tony\Downloads\Tribes1.40.655_SP1_OC3
2014-12-27 14:10 - 2014-12-27 14:14 - 114484131 _____ () C:\Users\Tony\Downloads\trorbs.zip
2014-12-26 14:21 - 2014-12-26 14:21 - 00000000 ____D () C:\windows\solcache
2014-12-26 14:20 - 2014-12-27 14:15 - 00000151 _____ () C:\windows\Sierra.ini
2014-12-26 14:20 - 2014-12-26 14:20 - 00000000 ____D () C:\Program Files (x86)\Sierra On-Line
2014-12-26 14:20 - 1998-10-29 16:45 - 00306688 _____ (InstallShield Software Corporation) C:\windows\IsUninst.exe
2014-12-26 14:09 - 2014-12-26 14:09 - 00000479 _____ () C:\Users\Tony\Downloads\ptavvski.zip
2014-12-26 06:24 - 2014-12-26 06:25 - 00000197 _____ () C:\windows\system32\2014-12-25-22-24-40.003-AvastVBoxSVC.exe-5156.log
2014-12-26 06:15 - 2014-12-26 06:15 - 00000197 _____ () C:\windows\system32\2014-12-25-22-15-52.067-AvastVBoxSVC.exe-5000.log
2014-12-24 05:30 - 2014-12-24 05:30 - 00000247 _____ () C:\windows\system32\2014-12-23-21-30-45.013-aswFe.exe-6972.log
2014-12-24 05:23 - 2014-12-24 05:30 - 00000247 _____ () C:\windows\system32\2014-12-23-21-23-40.044-aswFe.exe-1384.log
2014-12-24 05:23 - 2014-12-24 05:23 - 00000197 _____ () C:\windows\system32\2014-12-23-21-23-29.058-AvastVBoxSVC.exe-3764.log
2014-12-24 05:16 - 2014-12-24 05:17 - 00000197 _____ () C:\windows\system32\2014-12-23-21-16-52.093-AvastVBoxSVC.exe-4072.log
2014-12-20 02:01 - 2014-12-13 13:09 - 00144384 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe
2014-12-20 02:01 - 2014-12-13 11:33 - 00115712 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieUnatt.exe
2014-12-14 01:54 - 2014-12-14 01:54 - 00000197 _____ () C:\windows\system32\2014-12-13-17-54-16.089-AvastVBoxSVC.exe-5360.log
2014-12-12 06:58 - 2014-12-16 02:29 - 00000000 ____D () C:\windows\rescache
2014-12-11 22:48 - 2014-12-11 22:48 - 00000197 _____ () C:\windows\system32\2014-12-11-14-48-17.002-AvastVBoxSVC.exe-3792.log
2014-12-11 08:47 - 2014-12-11 08:47 - 00000000 ____D () C:\windows\system32\appraiser
2014-12-11 08:31 - 2014-10-18 10:05 - 04121600 _____ (Microsoft Corporation) C:\windows\system32\mf.dll
2014-12-11 08:31 - 2014-10-18 09:33 - 03209728 _____ (Microsoft Corporation) C:\windows\SysWOW64\mf.dll
2014-12-11 08:31 - 2014-07-07 10:06 - 00206848 _____ (Microsoft Corporation) C:\windows\system32\mfps.dll
2014-12-11 08:31 - 2014-07-07 10:06 - 00055808 _____ (Microsoft Corporation) C:\windows\system32\rrinstaller.exe
2014-12-11 08:31 - 2014-07-07 10:06 - 00024576 _____ (Microsoft Corporation) C:\windows\system32\mfpmp.exe
2014-12-11 08:31 - 2014-07-07 10:02 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\mferror.dll
2014-12-11 08:31 - 2014-07-07 09:40 - 00103424 _____ (Microsoft Corporation) C:\windows\SysWOW64\mfps.dll
2014-12-11 08:31 - 2014-07-07 09:39 - 00050176 _____ (Microsoft Corporation) C:\windows\SysWOW64\rrinstaller.exe
2014-12-11 08:31 - 2014-07-07 09:39 - 00023040 _____ (Microsoft Corporation) C:\windows\SysWOW64\mfpmp.exe
2014-12-11 08:31 - 2014-07-07 09:37 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\mferror.dll
2014-12-11 08:30 - 2014-11-27 09:43 - 00389296 _____ (Microsoft Corporation) C:\windows\system32\iedkcs32.dll
2014-12-11 08:30 - 2014-11-27 09:10 - 00342200 _____ (Microsoft Corporation) C:\windows\SysWOW64\iedkcs32.dll
2014-12-11 08:30 - 2014-11-22 11:13 - 25059840 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2014-12-11 08:30 - 2014-11-22 11:06 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2014-12-11 08:30 - 2014-11-22 11:06 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll
2014-12-11 08:30 - 2014-11-22 10:50 - 00580096 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll
2014-12-11 08:30 - 2014-11-22 10:50 - 00066560 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2014-12-11 08:30 - 2014-11-22 10:49 - 02885120 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2014-12-11 08:30 - 2014-11-22 10:49 - 00048640 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll
2014-12-11 08:30 - 2014-11-22 10:48 - 00088064 _____ (Microsoft Corporation) C:\windows\system32\MshtmlDac.dll
2014-12-11 08:30 - 2014-11-22 10:41 - 00054784 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2014-12-11 08:30 - 2014-11-22 10:40 - 00034304 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2014-12-11 08:30 - 2014-11-22 10:37 - 00633856 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2014-12-11 08:30 - 2014-11-22 10:35 - 00114688 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe
2014-12-11 08:30 - 2014-11-22 10:34 - 06039552 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2014-12-11 08:30 - 2014-11-22 10:34 - 00814080 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll
2014-12-11 08:30 - 2014-11-22 10:26 - 00968704 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe
2014-12-11 08:30 - 2014-11-22 10:22 - 19749376 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2014-12-11 08:30 - 2014-11-22 10:22 - 00490496 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll
2014-12-11 08:30 - 2014-11-22 10:20 - 02724864 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2014-12-11 08:30 - 2014-11-22 10:14 - 00077824 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll
2014-12-11 08:30 - 2014-11-22 10:09 - 00199680 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll
2014-12-11 08:30 - 2014-11-22 10:08 - 00092160 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2014-12-11 08:30 - 2014-11-22 10:07 - 00501248 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll
2014-12-11 08:30 - 2014-11-22 10:07 - 00062464 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
2014-12-11 08:30 - 2014-11-22 10:06 - 00047616 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieetwproxystub.dll
2014-12-11 08:30 - 2014-11-22 10:05 - 00316928 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll
2014-12-11 08:30 - 2014-11-22 10:05 - 00064000 _____ (Microsoft Corporation) C:\windows\SysWOW64\MshtmlDac.dll
2014-12-11 08:30 - 2014-11-22 10:01 - 02277888 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2014-12-11 08:30 - 2014-11-22 09:59 - 00047104 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2014-12-11 08:30 - 2014-11-22 09:58 - 00030720 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
2014-12-11 08:30 - 2014-11-22 09:56 - 00478208 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll
2014-12-11 08:30 - 2014-11-22 09:54 - 00620032 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9diag.dll
2014-12-11 08:30 - 2014-11-22 09:49 - 00800768 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2014-12-11 08:30 - 2014-11-22 09:49 - 00718848 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2014-12-11 08:30 - 2014-11-22 09:47 - 01359360 _____ (Microsoft Corporation) C:\windows\system32\mshtmlmedia.dll
2014-12-11 08:30 - 2014-11-22 09:46 - 02125312 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
2014-12-11 08:30 - 2014-11-22 09:45 - 00418304 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll
2014-12-11 08:30 - 2014-11-22 09:43 - 14412800 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2014-12-11 08:30 - 2014-11-22 09:40 - 00060416 _____ (Microsoft Corporation) C:\windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-12-11 08:30 - 2014-11-22 09:36 - 00168960 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll
2014-12-11 08:30 - 2014-11-22 09:35 - 00076288 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll
2014-12-11 08:30 - 2014-11-22 09:33 - 00285696 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll
2014-12-11 08:30 - 2014-11-22 09:29 - 04299264 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2014-12-11 08:30 - 2014-11-22 09:28 - 02358272 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2014-12-11 08:30 - 2014-11-22 09:23 - 00688640 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2014-12-11 08:30 - 2014-11-22 09:22 - 02052096 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl
2014-12-11 08:30 - 2014-11-22 09:21 - 01155072 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmlmedia.dll
2014-12-11 08:30 - 2014-11-22 09:15 - 01548288 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2014-12-11 08:30 - 2014-11-22 09:13 - 12836864 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2014-12-11 08:30 - 2014-11-22 09:03 - 00800768 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll
2014-12-11 08:30 - 2014-11-22 09:00 - 01888256 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2014-12-11 08:30 - 2014-11-22 08:56 - 01307136 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2014-12-11 08:30 - 2014-11-22 08:54 - 00710144 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dll
2014-12-11 08:29 - 2014-12-04 10:50 - 00830976 _____ (Microsoft Corporation) C:\windows\system32\appraiser.dll
2014-12-11 08:29 - 2014-12-04 10:50 - 00741376 _____ (Microsoft Corporation) C:\windows\system32\invagent.dll
2014-12-11 08:29 - 2014-12-04 10:50 - 00413184 _____ (Microsoft Corporation) C:\windows\system32\generaltel.dll
2014-12-11 08:29 - 2014-12-04 10:50 - 00396800 _____ (Microsoft Corporation) C:\windows\system32\devinv.dll
2014-12-11 08:29 - 2014-12-04 10:50 - 00227328 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll
2014-12-11 08:29 - 2014-12-04 10:50 - 00192000 _____ (Microsoft Corporation) C:\windows\system32\aepic.dll
2014-12-11 08:29 - 2014-12-04 10:44 - 01083392 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll
2014-12-11 08:29 - 2014-12-02 07:28 - 01232040 _____ (Microsoft Corporation) C:\windows\system32\aitstatic.exe
2014-12-11 08:29 - 2014-11-11 11:09 - 01424384 _____ (Microsoft Corporation) C:\windows\system32\WindowsCodecs.dll
2014-12-11 08:29 - 2014-11-11 10:44 - 01230336 _____ (Microsoft Corporation) C:\windows\SysWOW64\WindowsCodecs.dll
2014-12-11 08:29 - 2014-11-11 09:46 - 00119296 _____ (Microsoft Corporation) C:\windows\system32\Drivers\tdx.sys
2014-12-11 08:28 - 2014-11-08 11:16 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\tzres.dll
2014-12-11 08:28 - 2014-11-08 10:45 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\tzres.dll
2014-12-11 08:27 - 2014-10-30 10:03 - 00165888 _____ (Microsoft Corporation) C:\windows\system32\charmap.exe
2014-12-11 08:27 - 2014-10-30 09:45 - 00155136 _____ (Microsoft Corporation) C:\windows\SysWOW64\charmap.exe
2014-12-10 22:15 - 2014-12-10 22:15 - 00000197 _____ () C:\windows\system32\2014-12-10-14-15-14.014-AvastVBoxSVC.exe-5268.log
2014-12-10 00:11 - 2014-12-10 00:11 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-09 16:54 - 2013-06-17 16:18 - 00000830 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2015-01-09 16:51 - 2009-07-14 12:45 - 00028576 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-01-09 16:51 - 2009-07-14 12:45 - 00028576 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-01-09 16:45 - 2011-09-27 11:24 - 01226092 _____ () C:\windows\WindowsUpdate.log
2015-01-09 16:41 - 2011-10-04 21:56 - 00000000 ____D () C:\Users\Default\AppData\Local\SoftThinks
2015-01-09 16:41 - 2011-10-04 21:56 - 00000000 ____D () C:\Users\Default User\AppData\Local\SoftThinks
2015-01-09 16:41 - 2011-09-27 12:19 - 00000000 ____D () C:\Program Files (x86)\Dell DataSafe Local Backup
2015-01-09 16:40 - 2010-11-21 11:47 - 00382336 _____ () C:\windows\PFRO.log
2015-01-09 16:40 - 2009-07-14 13:08 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2015-01-09 16:40 - 2009-07-14 12:51 - 00164208 _____ () C:\windows\setupact.log
2015-01-09 16:39 - 2013-11-06 06:12 - 00000000 ____D () C:\AdwCleaner
2015-01-09 16:14 - 2012-07-10 08:03 - 00004182 _____ () C:\windows\System32\Tasks\avast! Emergency Update
2015-01-09 16:13 - 2011-10-09 20:14 - 00000000 ____D () C:\Users\postgres
2015-01-09 05:56 - 2013-12-23 17:51 - 00000924 _____ () C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3482530603-2352231087-752530051-1000UA.job
2015-01-09 05:44 - 2012-11-06 22:30 - 00000000 ____D () C:\Program Files (x86)\Full Tilt Poker
2015-01-09 05:16 - 2011-10-09 20:15 - 00000000 ____D () C:\Users\Tony\AppData\Roaming\HEM Data
2015-01-09 04:26 - 2011-10-08 19:14 - 00000000 ____D () C:\Users\Tony\AppData\Local\PokerStars
2015-01-08 20:58 - 2011-10-08 23:52 - 00000000 ____D () C:\Users\Tony\AppData\Roaming\Skype
2015-01-08 18:01 - 2011-10-13 04:26 - 00003918 _____ () C:\windows\System32\Tasks\User_Feed_Synchronization-{8E6A4211-3F19-4F2D-AC5F-BD7D11C1D32B}
2015-01-07 03:37 - 2012-11-22 01:15 - 00000000 ____D () C:\Users\Tony\Desktop\Poker
2015-01-06 23:07 - 2013-12-23 17:51 - 00000902 _____ () C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3482530603-2352231087-752530051-1000Core.job
2015-01-06 15:43 - 2011-10-12 22:12 - 00000000 ____D () C:\Users\Tony\AppData\Roaming\uTorrent
2015-01-06 04:36 - 2010-11-21 11:27 - 00298120 ____N (Microsoft Corporation) C:\windows\system32\MpSigStub.exe
2015-01-04 02:34 - 2011-10-09 20:15 - 00000000 ____D () C:\HMArchive
2015-01-04 02:25 - 2012-12-03 22:28 - 00000000 ____D () C:\Users\Tony\Desktop\FT Hands
2015-01-01 19:49 - 2012-12-03 23:23 - 00000000 ____D () C:\Users\Tony\AppData\Local\cache
2014-12-26 14:21 - 2012-09-02 04:05 - 00000000 ____D () C:\Users\Tony\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
2014-12-20 09:18 - 2013-06-27 20:42 - 00001065 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\LINE.lnk
2014-12-20 09:18 - 2013-06-27 20:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LINE
2014-12-20 01:59 - 2014-08-18 03:52 - 00000000 ____D () C:\Users\Tony\AppData\Local\Adobe
2014-12-20 01:58 - 2013-06-17 16:18 - 00003768 _____ () C:\windows\System32\Tasks\Adobe Flash Player Updater
2014-12-20 01:58 - 2012-03-31 15:40 - 00701616 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2014-12-20 01:58 - 2011-10-12 04:38 - 00071344 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-12-11 22:58 - 2013-01-11 04:47 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-12-11 08:47 - 2014-05-07 08:04 - 00000000 ___SD () C:\windows\system32\CompatTel
2014-12-11 08:47 - 2009-07-14 11:20 - 00000000 ____D () C:\windows\PolicyDefinitions
2014-12-11 08:47 - 2009-07-14 11:20 - 00000000 ____D () C:\windows\AppCompat
2014-12-11 08:36 - 2013-07-17 02:07 - 00000000 ____D () C:\windows\system32\MRT
2014-12-11 08:32 - 2011-10-05 03:31 - 112710672 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe

Files to move or delete:
====================
C:\Users\Public\AlexaNSISPlugin.10440.dll


Some content of TEMP:
====================
C:\Users\Tony\AppData\Local\Temp\Quarantine.exe
C:\Users\Tony\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Tony\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-01-04 21:16

==================== End Of Log ============================

 

 

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 07-01-2015
Ran by Tony at 2015-01-09 16:55:53
Running from C:\Users\Tony\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: avast! Antivirus (Disabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Disabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

µTorrent (HKU\S-1-5-21-3482530603-2352231087-752530051-1000\...\uTorrent) (Version: 3.4.2.34309 - BitTorrent Inc.)
AccelerometerP11 (HKLM-x32\...\{87434D51-51DB-4109-B68F-A829ECDCF380}) (Version: 2.00.11.22 - STMicroelectronics)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 3.6.0.6090 - Adobe Systems Incorporated)
Adobe Flash Player 15 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 15.0.0.246 - Adobe Systems Incorporated)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.235 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
Advanced Audio FX Engine (HKLM-x32\...\Advanced Audio FX Engine) (Version: 1.12.05 - Creative Technology Ltd)
Age of Empires III - The Asian Dynasties (HKLM-x32\...\InstallShield_{C43C1415-3DFC-4089-9A32-0BECF28A6046}) (Version: 1.00.0000 - Microsoft Game Studios)
Age of Empires III - The Asian Dynasties (x32 Version: 1.00.0000 - Microsoft Game Studios) Hidden
Age of Empires III - The WarChiefs (HKLM-x32\...\InstallShield_{1C08A24C-B168-407E-A826-68FAF5F20710}) (Version: 1.00.0000 - Microsoft Game Studios)
Age of Empires III - The WarChiefs (x32 Version: 1.00.0000 - Microsoft Game Studios) Hidden
Age of Empires III (HKLM-x32\...\InstallShield_{7B9CC60A-9B81-46A3-A953-76B6BF9EEC97}) (Version: 1.00.0000 - Microsoft Game Studios)
Age of Empires III (x32 Version: 1.00.0000 - Microsoft Game Studios) Hidden
Age of Empires Online (HKLM-x32\...\Steam App 105430) (Version:  - Microsoft)
Avast Free Antivirus (HKLM-x32\...\avast) (Version: 10.0.2208 - AVAST Software)
Bodog Poker (HKLM-x32\...\{D7CA2DF8-95CE-4C80-9296-98E21219A1E4}}_is1) (Version:   - )
Conexant SmartAudio HD (HKLM\...\CNXT_AUDIO_HDA) (Version: 8.54.16.0 - Conexant)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Dell DataSafe Local Backup - Support Software (HKLM-x32\...\{A9668246-FB70-4103-A1E3-66C9BC2EFB49}) (Version: 9.4.60 - Dell Inc.)
Dell DataSafe Local Backup (HKLM-x32\...\{0ED7EE95-6A97-47AA-AD73-152C08A15B04}) (Version: 9.4.60 - Dell Inc.)
Dell DataSafe Online (HKLM-x32\...\{7EC66A95-AC2D-4127-940B-0445A526AB2F}) (Version: 2.1.19634 - Dell)
Dell Edoc Viewer (HKLM\...\{8EBA8727-ADC2-477B-9D9A-1A1836BE4E05}) (Version: 1.0.0 - Dell Inc)
Dell Getting Started Guide (HKLM-x32\...\{7DB9F1E5-9ACB-410D-A7DC-7A3D023CE045}) (Version: 1.00.0000 - Dell Inc.)
Dell MusicStage (HKLM-x32\...\{91AF2672-F5BC-42CF-8037-A9D2F92BBCC0}) (Version: 1.5.201.0 - Fingertapps)
Dell PhotoStage (HKLM-x32\...\{E4335E82-17B3-460F-9E70-39D9BC269DB3}) (Version: 1.5.0.65 - ArcSoft)
Dell Stage (HKLM-x32\...\{E2EBA7C0-8072-447F-856D-FFEE8D15B23B}) (Version: 1.5.201.0 - Fingertapps)
Dell Stage Remote (HKLM-x32\...\{AF4D3C63-009B-4A17-B02E-D395065DD3F0}) (Version: 2.0.0.43 - ArcSoft)
Dell Touchpad (HKLM\...\SynTPDeinstKey) (Version: 15.3.5.0 - Synaptics Incorporated)
Dell VideoStage  (HKLM-x32\...\InstallShield_{DCE0E79A-B9AC-41AC-98C1-7EF0538BCA7F}) (Version: 1.2.0.1712 - CyberLink Corp.)
Dell VideoStage  (x32 Version: 1.2.0.1712 - CyberLink Corp.) Hidden
Dell Webcam Central (HKLM-x32\...\Dell Webcam Central) (Version: 2.00.44 - Creative Technology Ltd)
Dropbox (HKU\S-1-5-21-3482530603-2352231087-752530051-1000\...\Dropbox) (Version: 2.6.27 - Dropbox, Inc.)
ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version:  - )
f.lux (HKU\S-1-5-21-3482530603-2352231087-752530051-1000\...\Flux) (Version:  - )
Facebook Video Calling 3.1.0.521 (HKLM-x32\...\{2091F234-EB58-4B80-8C96-8EB78C808CF7}) (Version: 3.1.521 - Skype Limited)
Full Tilt Poker (HKLM-x32\...\{D4C9692E-4EFA-4DA0-8B7F-9439466D9E31}) (Version: 4.46.3.WIN.FullTilt.COM - )
GameRanger (HKU\S-1-5-21-3482530603-2352231087-752530051-1000\...\GameRanger) (Version:  - GameRanger Technologies)
Goalwin Poker (HKLM-x32\...\Goalwin Poker_is1) (Version:  - goalwin)
High-Definition Video Playback (x32 Version: 7.3.10000.0.0 - Nero AG) Hidden
Holdem Manager (HKLM-x32\...\HoldemManager) (Version:  - )
Holdem Manager 2 (HKLM-x32\...\HoldemManager2) (Version:  - )
Intel PROSet Wireless (x32 Version:  - ) Hidden
Intel® Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)
Intel® Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 7.0.0.1144 - Intel Corporation)
Intel® Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2418 - Intel Corporation)
Intel® PROSet/Wireless for Bluetooth® 3.0 + High Speed (HKLM\...\{A0E106D2-4815-4B7A-BAA7-7E21B530CFB4}) (Version: 1.1.0.0157 - Intel Corporation)
Intel® PROSet/Wireless Software for Bluetooth® Technology (HKLM\...\{006B5C65-3938-4246-B182-994A7E415EDE}) (Version: 1.1.0.0537 - Intel Corporation)
Intel® PROSet/Wireless WiFi Software (HKLM\...\{3C41721F-AF0F-4086-AA1C-4C7F29076228}) (Version: 14.01.1000 - Intel Corporation)
Intel® Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 10.1.5.1001 - Intel Corporation)
Intel® WiDi (HKLM-x32\...\{25680C01-6753-4FE9-A891-7857F26457C1}) (Version: 2.1.35.0 - Intel Corporation)
Intel® Wireless Display (HKLM\...\{28EF7372-9087-4AC3-9B9F-D9751FCDF830}) (Version:  - )
Java 7 Update 71 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217071FF}) (Version: 7.0.710 - Oracle)
JavaFX 2.1.1 (HKLM-x32\...\{1111706F-666A-4037-7777-211328764D10}) (Version: 2.1.1 - Oracle Corporation)
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
LINE (HKLM-x32\...\LINE) (Version: 3.9.0.172 - LINE Corporation)
Malwarebytes Anti-Malware version 1.75.0.1300 (HKLM-x32\...\Malwarebytes' Anti-Malware_is1) (Version: 1.75.0.1300 - Malwarebytes Corporation)
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Games for Windows - LIVE Redistributable (HKLM-x32\...\{832D9DE0-8AFC-4689-9819-4DBBDEBD3E4F}) (Version: 3.5.92.0 - Microsoft Corporation)
Microsoft Games for Windows Marketplace (HKLM-x32\...\{4CB0307C-565E-4441-86BE-0DF2E4FB828C}) (Version: 3.5.50.0 - Microsoft Corporation)
Microsoft Office 2010 (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Click-to-Run 2010 (HKLM-x32\...\Office14.Click2Run) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Starter 2010 - English (HKLM-x32\...\{90140011-0066-0409-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft PowerPoint Viewer (HKLM-x32\...\{95140000-00AF-0409-0000-0000000FF1CE}) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable - KB2467175 (HKLM-x32\...\{a0fe116e-9a8a-466f-aee0-625cb7c207e3}) (Version: 8.0.51011 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{820B6609-4C97-3A2B-B644-573B06A0F0CC}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.30319 (HKLM-x32\...\{196BB40D-1578-3D01-B289-BEFC77A11A1E}) (Version: 10.0.30319 - Microsoft Corporation)
Mozilla Firefox 34.0.5 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 34.0.5 (x86 en-US)) (Version: 34.0.5 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 12.0 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Nero Update (HKLM-x32\...\{65BB0407-4CC8-4DC7-952E-3EEFDF05602A}) (Version: 1.0.0018 - Nero AG)
OpenOffice.org 3.3 (HKLM-x32\...\{3E171899-0175-47CC-84C4-562ACDD4C021}) (Version: 3.3.9567 - OpenOffice.org)
PokerStars (HKLM-x32\...\PokerStars) (Version:  - PokerStars)
PokerStrategy.com Equilab (HKLM-x32\...\{86D09F48-CDAB-4B4C-8806-F6C16F17935A}) (Version: 1.2.8.0 - PokerStrategy.com)
PostgreSQL 8.4 (HKLM-x32\...\PostgreSQL 8.4) (Version: 8.4 - PostgreSQL Global Development Group)
Quickset64 (HKLM\...\{87CF757E-C1F1-4D22-865C-00C6950B5258}) (Version: 10.09.25 - Dell Inc.)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.43.321.2011 - Realtek)
Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.7600.30127 - Realtek Semiconductor Corp.)
Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.3.16540.9015 - Microsoft Corporation)
Skype™ 6.20 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 6.20.104 - Skype Technologies S.A.)
Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)
SyncUP (HKLM-x32\...\{40F06490-8C14-43AA-99D3-EEEFDBAC3CFC}) (Version: 1.8.21200.33.104 - Nero AG)
SyncUP (HKLM-x32\...\{D92C9CCE-E5F0-4125-977A-0590F3225B74}) (Version: 10.2.13500 - Nero AG)
Team Fortress 2 (HKLM-x32\...\Steam App 440) (Version:  - Valve)
TI USB 3.0 Host Controller Driver (HKLM-x32\...\InstallShield_{B1EB7FFF-6E44-43D8-869D-B78E44CD3E0F}) (Version: 1.12.14.0 - Texas Instruments Inc.)
TI USB3 Host Driver (x32 Version: 1.12.14.0 - Texas Instruments Inc.) Hidden
UBNet (HKU\S-1-5-21-3482530603-2352231087-752530051-1000\...\UBNet) (Version:  - )
VirtualCloneDrive (HKLM-x32\...\VirtualCloneDrive) (Version:  - Elaborate Bytes)
VLC media player 1.1.11 (HKLM-x32\...\VLC media player) (Version: 1.1.11 - VideoLAN)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3538.0513 - Microsoft Corporation)
Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation)
WinRAR 4.01 (64-bit) (HKLM\...\WinRAR archiver) (Version: 4.01.0 - win.rar GmbH)
Zinio Reader 4 (HKLM-x32\...\ZinioReader4) (Version: 4.2.4164 - Zinio LLC)
Zinio Reader 4 (x32 Version: 4.2.4164 - Zinio LLC) Hidden
谷歌拼音输入法 3.0 (HKLM\...\GooglePinyin3) (Version:  - Google Inc.)
適用遠端連線的 Windows Live Mesh ActiveX 控制項 (HKLM-x32\...\{622DE1BE-9EDE-49D3-B349-29D64760342A}) (Version: 15.4.5722.2 - Microsoft Corporation)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-3482530603-2352231087-752530051-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Tony\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3482530603-2352231087-752530051-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Tony\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3482530603-2352231087-752530051-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Tony\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3482530603-2352231087-752530051-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Tony\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3482530603-2352231087-752530051-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Tony\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)

==================== Restore Points  =========================

24-12-2014 03:17:47 Windows Update
27-12-2014 13:50:22 Windows Update
31-12-2014 12:44:38 Windows Update
08-01-2015 20:58:46 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 10:34 - 2009-06-11 05:00 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {5394BB77-A35F-4465-8A8C-F711EA6C0DB0} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-3482530603-2352231087-752530051-1000Core => C:\Users\Tony\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-12-23] (Facebook Inc.)
Task: {91ECF624-36C8-485C-8DAF-2D6956F8DAF8} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-3482530603-2352231087-752530051-1000UA => C:\Users\Tony\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-12-23] (Facebook Inc.)
Task: {9D897891-E5B6-4F25-9A42-93EA5F62579A} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {BEBE4AAC-2C0C-4E90-AD89-D615A1EFA72B} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-12-20] (Adobe Systems Incorporated)
Task: {D0CECD90-26B3-4B6D-AD24-07502AD5EE9F} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2014-11-26] (AVAST Software)
Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3482530603-2352231087-752530051-1000Core.job => C:\Users\Tony\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3482530603-2352231087-752530051-1000UA.job => C:\Users\Tony\AppData\Local\Facebook\Update\FacebookUpdate.exe

==================== Loaded Modules (whitelisted) =============

2011-05-03 02:41 - 2011-05-03 02:41 - 01501696 _____ () C:\Program Files\Common Files\Intel\WirelessCommon\Libeay32.dll
2011-09-27 13:53 - 2011-06-11 02:36 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2011-09-27 11:42 - 2010-12-17 23:25 - 00686704 _____ () C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe
2011-05-03 02:41 - 2011-05-03 02:41 - 01501696 _____ () C:\Program Files\Common Files\Intel\WirelessCommon\LIBEAY32.dll
2011-10-25 19:10 - 2011-10-25 19:10 - 01208376 _____ () C:\Program Files\Google\Google Pinyin 3\GooglePinyinService.exe
2011-09-27 12:19 - 2011-08-18 23:05 - 02751808 _____ () C:\Program Files (x86)\Dell DataSafe Local Backup\COMPONENTS\SCHEDULER\STSERVICE.EXE
2011-10-08 22:56 - 2011-05-28 22:05 - 00164864 _____ () C:\Program Files\WinRAR\rarext.dll
2015-01-09 16:15 - 2015-01-09 16:15 - 02909696 _____ () C:\Program Files\AVAST Software\Avast\defs\15010900\algo.dll
2014-11-26 16:12 - 2014-11-26 16:12 - 38562088 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2011-10-09 20:13 - 2011-01-28 13:15 - 00172032 _____ () C:\Program Files (x86)\PostgreSQL\8.4\bin\LIBPQ.dll
2011-10-09 20:13 - 2009-02-13 03:01 - 00976384 _____ () C:\Program Files (x86)\PostgreSQL\8.4\bin\libxml2.dll
2011-10-09 20:13 - 2005-07-20 18:48 - 00059904 _____ () C:\Program Files (x86)\PostgreSQL\8.4\bin\zlib1.dll
2014-10-23 04:27 - 2014-10-23 04:27 - 00169472 _____ () C:\windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\139f38c8b8d826dbacb56c272a366bd7\IsdiInterop.ni.dll
2011-09-27 11:32 - 2011-02-18 21:16 - 00058880 _____ () C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IsdiInterop.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

MSCONFIG\Services: NAUpdate => 2
MSCONFIG\startupreg: AccuWeatherWidget => "C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe" "C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\start.umj" --startup
MSCONFIG\startupreg: Dell DataSafe Online => C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuClient.exe
MSCONFIG\startupreg: DellStage => "C:\Program Files (x86)\Dell Stage\Dell Stage\stage_primary.exe" "C:\Program Files (x86)\Dell Stage\Dell Stage\start.umj" --startup
MSCONFIG\startupreg: Facebook Update => "C:\Users\Tony\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver
MSCONFIG\startupreg: NeroLauncher => C:\Program Files (x86)\Nero\SyncUP\NeroLauncher.exe 900
MSCONFIG\startupreg: Stage Remote => C:\Program Files (x86)\Dell\Stage Remote\StageRemote.exe -Quiet
MSCONFIG\startupreg: VirtualCloneDrive => "C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s

========================= Accounts: ==========================

Administrator (S-1-5-21-3482530603-2352231087-752530051-500 - Administrator - Disabled)
Guest (S-1-5-21-3482530603-2352231087-752530051-501 - Limited - Disabled)
postgres (S-1-5-21-3482530603-2352231087-752530051-1002 - Limited - Enabled) => C:\Users\postgres
Tony (S-1-5-21-3482530603-2352231087-752530051-1000 - Administrator - Enabled) => C:\Users\Tony

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================

System errors:
=============

Microsoft Office Sessions:
=========================

==================== Memory info ===========================

Processor: Intel® Core™ i3-2330M CPU @ 2.20GHz
Percentage of memory in use: 40%
Total physical RAM: 4002.13 MB
Available physical RAM: 2393 MB
Total Pagefile: 8002.44 MB
Available Pagefile: 6073.94 MB
Total Virtual: 8192 MB
Available Virtual: 8191.81 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:97.66 GB) (Free:6.87 GB) NTFS
Drive d: (DATA) (Fixed) (Total:185.69 GB) (Free:68.47 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298.1 GB) (Disk ID: B2158B78)
Partition 1: (Not Active) - (Size=100 MB) - (Type=DE)
Partition 2: (Active) - (Size=14.6 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=97.7 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=185.7 GB) - (Type=OF Extended)

==================== End Of Log ============================

[RKinner]

Submit C:\windows\System32\roboot64.exe to virustotal.com and see what they say about it.

 

Easiest way to submit a file is to copy the path:

 

C:\windows\System32\roboot64.exe

 

Then

Go to virustotal.com with your browser.  Click on Choose File then when the file chooser window opens, move down to the File Name: box and then Ctrl + v and the path should appear.  Hit Open and it should return to the main page with spoolsv.exe chosen.  Click on Scan it.  If it knows the file already it will tell you it's already been analyzed and offer you a choice of Reanalyze and View Last Analysis.  In that case click on View Last Analysis.  If it doesn't know the file it will take a minute to query 50+ different anti-virus companies.  In either case, If the Detection ratio: is not 0 / 58? (last number varies) then copy the Analysis page and paste it into the forum.  You can just hit Ctrl + a then Ctrl + c to copy the page then go to a reply and Ctrl + v.

 

 

 

Download the attached fixlist.txt to the same location as FRST

Run FRST and press Fix

A fix log will be generated please post that.  Run FRST again, check the Additions box and then Scan.  You will get two logs.  Post them both.

 

 

Right click on (My) Computer and select Manage (Continue) Then click on the arrow in front of Event Viewer. Next Click on the arrow in front of Windows Logs Right click on System and Clear Log, Clear. Repeat for Application.

 

Reboot. 

 

Start, All Programs, Accessories then right click on Command Prompt and Run as Administrator.  Then type (with an Enter after each line).

sfc  /scannow

 

(This will check your critical system files. Does this finish without complaint?  IF it says it couldn't fix everything then:

 

Copy the next two lines:

 

findstr  /c:"[SR]"  \windows\logs\cbs\cbs.log  >  \windows\logs\cbs\junk.txt 

notepad \windows\logs\cbs\junk.txt 

 

Start, All Programs, Accessories, right click on Command Prompt and Run as Administrator, Continue.  Right click and Paste or Edit then Paste and the copied line should appear.

Hit Enter. Copy and paste the text from notepad or if it is too big, just attach the file.)

 

 

1. Please download the Event Viewer Tool by Vino Rosso

http://images.malwar...om/vino/VEW.exe

and save it to your Desktop:

2. Right-click VEW.exe and Run AS Administrator

3. Under 'Select log to query', select:

 

* System

4. Under 'Select type to list', select:

* Error

* Warning

 

 

Then use the 'Number of events' as follows:

 

 

1. Click the radio button for 'Number of events'

Type 20 in the 1 to 20 box

Then click the Run button.

Notepad will open with the output log.

 

 

Please post the Output log in your next reply then repeat but select Application.

 

Get Process Explorer

 

http://live.sysinter...com/procexp.exe

Save it to your desktop then run it (Vista or Win7 - right click and Run As Administrator).  

 

View, Select Column, check Verified Signer, OK

Options, Verify Image Signatures

 

 

Click twice on the CPU column header  to sort things by CPU usage with the big hitters at the top.  

 

Wait a full minute then:

 

File, Save As, Save.  Open the file Procexp.txt on your desktop and copy and paste the text to a reply.

 

 

To speed up firefox:

 

Then download and run Speedy Fox.

http://www.crystalidea.com/speedyfox .  Close Chrome/Firefox. Hit Optimize.   You can run it any time that Chrome/Firefox seems slow.

 

 

Ron

 

[taipei_tony]

Hi, I have to do this step-by-step due to the copy/pasting of the Virustotal scan. Here's the analysis of 'roboot64.exe'. I will perform the other steps right now.

 

Edit: It looks like the copy/paste doesn't work too well. I think a copy/paste from notepad works better, here it is:

VirusTotal
SHA256:     6ffac5649025cc58a8064344612f30506816a106d1a24dc157a92d1ac25e8adc
File name:     roboot64.exe.vir
Detection ratio:     3 / 56
Analysis date:     2015-01-07 20:20:49 UTC ( 1 day, 19 hours ago )
0
0

    Analysis
    File detail
    Relationships
    Additional information
    Comments 0
    Votes

Antivirus     Result     Update
ESET-NOD32     a variant of Win64/Systweak.A     20150107
Sophos     Registry Cleaner     20150107
Symantec     RegCleanPro     20150107
ALYac         20150107
AVG         20150107
AVware         20150107
Ad-Aware         20150107
AegisLab         20150107
Agnitum         20150107
AhnLab-V3         20150107
Antiy-AVL         20150107
Avast         20150107
Avira         20150107
Baidu-International         20150107
BitDefender         20150107
Bkav         20150107
ByteHero         20150107
CAT-QuickHeal         20150107
CMC         20150107
ClamAV         20150107
Comodo         20150107
Cyren         20150107
DrWeb         20150107
Emsisoft         20150107
F-Prot         20150107
F-Secure         20150107
Fortinet         20150105
GData         20150107
Ikarus         20150107
Jiangmin         20150107
K7AntiVirus         20150107
K7GW         20150107
Kaspersky         20150107
Kingsoft         20150107
Malwarebytes         20150107
McAfee         20150107
McAfee-GW-Edition         20150107
MicroWorld-eScan         20150107
Microsoft         20150107
NANO-Antivirus         20150107
Norman         20150107
Panda         20150107
Qihoo-360         20150107
Rising         20150106
SUPERAntiSpyware         20150107
Tencent         20150107
TheHacker         20150106
TotalDefense         20150106
TrendMicro         20150107
TrendMicro-HouseCall         20150107
VBA32         20150106
VIPRE         20150107
ViRobot         20150107
Zillya         20150106
Zoner         20150107
nProtect         20150107
----------------------------------------------------------------------------------------------------------------

SHA256: 6ffac5649025cc58a8064344612f30506816a106d1a24dc157a92d1ac25e8adc File name: roboot64.exe.vir Detection ratio: 3 / 56 Analysis date: 2015-01-07 20:20:49 UTC ( 1 day, 19 hours ago )

 

Antivirus Result Update ESET-NOD32 a variant of Win64/Systweak.A 20150107 Sophos Registry Cleaner 20150107 Symantec RegCleanPro 20150107 ALYac   20150107 AVG   20150107 AVware   20150107 Ad-Aware   20150107 AegisLab   20150107 Agnitum   20150107 AhnLab-V3   20150107 Antiy-AVL   20150107 Avast   20150107 Avira   20150107 Baidu-International   20150107 BitDefender   20150107 Bkav   20150107 ByteHero   20150107 CAT-QuickHeal   20150107 CMC   20150107 ClamAV   20150107 Comodo   20150107 Cyren   20150107 DrWeb   20150107 Emsisoft   20150107 F-Prot   20150107 F-Secure   20150107 Fortinet   20150105 GData   20150107 Ikarus   20150107 Jiangmin   20150107 K7AntiVirus   20150107 K7GW   20150107 Kaspersky   20150107 Kingsoft   20150107 Malwarebytes   20150107 McAfee   20150107 McAfee-GW-Edition   20150107 MicroWorld-eScan   20150107 Microsoft   20150107 NANO-Antivirus   20150107 Norman   20150107 Panda   20150107 Qihoo-360   20150107 Rising   20150106 SUPERAntiSpyware   20150107 Tencent   20150107 TheHacker   20150106 TotalDefense   20150106 TrendMicro   20150107 TrendMicro-HouseCall   20150107 VBA32   20150106 VIPRE   20150107 ViRobot   20150107 Zillya   20150106 Zoner   20150107 nProtect   20150107

Edited by taipei_tony, 09 January 2015 - 10:13 AM.

[taipei_tony]

Here are the FRST logs:

 

Fixlog:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 07-01-2015
Ran by Tony at 2015-01-10 00:16:55 Run:1
Running from C:\Users\Tony\Desktop
Loaded Profiles: Tony & postgres (Available profiles: Tony & postgres)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
HKU\S-1-5-21-3482530603-2352231087-752530051-1000\...\Policies\system: [DisableLockWorkstation] 0
HKU\S-1-5-21-3482530603-2352231087-752530051-1000\...\MountPoints2: {3803d1af-f40d-11e1-aa08-ac7289af52e8} - E:\autorun.exe
HKU\S-1-5-21-3482530603-2352231087-752530051-1000\...\MountPoints2: {974717a2-46ab-11e1-a3d0-ac7289af52e8} - E:\TL-Bootstrap.exe
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-3482530603-2352231087-752530051-1000 -> {E8A5D506-E19A-4E15-B702-C408EB56A033} URL = https://tw.search.ya...p={searchTerms}
SearchScopes: HKU\S-1-5-21-3482530603-2352231087-752530051-1000 -> {F025182F-F258-48C6-945A-2B529C0699E4} URL = http://search.yahoo....petb&type=10583
SearchScopes: HKU\S-1-5-21-3482530603-2352231087-752530051-1002 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre6\bin\jp2ssv.dll No File
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll No File
BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll No File
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} -  No File
Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} -  No File
FF Keyword.URL: https://tw.search.ya...&type=523482&p=
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll No File
FF SearchPlugin: C:\Users\Tony\AppData\Roaming\Mozilla\Firefox\Profiles\gt83rqoy.default-1383689389646\searchplugins\yahoo_ff.xml
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2014-12-10]
S3 taphss6; C:\Windows\System32\DRIVERS\taphss6.sys [42184 2013-09-18] (Anchorfree Inc.)
C:\Users\Public\AlexaNSISPlugin.10440.dll
Task: {5394BB77-A35F-4465-8A8C-F711EA6C0DB0} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-3482530603-2352231087-752530051-1000Core => C:\Users\Tony\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-12-23] (Facebook Inc.)
Task: {91ECF624-36C8-485C-8DAF-2D6956F8DAF8} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-3482530603-2352231087-752530051-1000UA => C:\Users\Tony\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-12-23] (Facebook Inc.)
Task: C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3482530603-2352231087-752530051-1000Core.job => C:\Users\Tony\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3482530603-2352231087-752530051-1000UA.job => C:\Users\Tony\AppData\Local\Facebook\Update\FacebookUpdate.exe

*****************

HKU\S-1-5-21-3482530603-2352231087-752530051-1000\Software\Microsoft\Windows\CurrentVersion\Policies\system\\DisableLockWorkstation => value deleted successfully.
"HKU\S-1-5-21-3482530603-2352231087-752530051-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3803d1af-f40d-11e1-aa08-ac7289af52e8}" => Key deleted successfully.
HKCR\CLSID\{3803d1af-f40d-11e1-aa08-ac7289af52e8} => Key not found.
"HKU\S-1-5-21-3482530603-2352231087-752530051-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{974717a2-46ab-11e1-a3d0-ac7289af52e8}" => Key deleted successfully.
HKCR\CLSID\{974717a2-46ab-11e1-a3d0-ac7289af52e8} => Key not found.
HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
"HKU\S-1-5-21-3482530603-2352231087-752530051-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{E8A5D506-E19A-4E15-B702-C408EB56A033}" => Key deleted successfully.
HKCR\CLSID\{E8A5D506-E19A-4E15-B702-C408EB56A033} => Key not found.
"HKU\S-1-5-21-3482530603-2352231087-752530051-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{F025182F-F258-48C6-945A-2B529C0699E4}" => Key deleted successfully.
HKCR\CLSID\{F025182F-F258-48C6-945A-2B529C0699E4} => Key not found.
HKU\S-1-5-21-3482530603-2352231087-752530051-1002\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}" => Key deleted successfully.
"HKCR\CLSID\{DBC80044-A445-435b-BC74-9C25C1C588A9}" => Key deleted successfully.
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}" => Key deleted successfully.
"HKCR\Wow6432Node\CLSID\{9030D464-4C02-4ABF-8ECC-5164760863C6}" => Key deleted successfully.
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}" => Key deleted successfully.
"HKCR\Wow6432Node\CLSID\{DBC80044-A445-435b-BC74-9C25C1C588A9}" => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\\{318A227B-5E9F-45bd-8999-7F8F10CA4CF5} => value deleted successfully.
"HKCR\CLSID\{318A227B-5E9F-45bd-8999-7F8F10CA4CF5}" => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\\{CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} => value deleted successfully.
HKCR\CLSID\{CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} => Key not found.
Firefox Keyword.URL deleted successfully.
"HKLM\Software\Wow6432Node\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0" => Key deleted successfully.
C:\Users\Tony\AppData\Roaming\Mozilla\Firefox\Profiles\gt83rqoy.default-1383689389646\searchplugins\yahoo_ff.xml => Moved successfully.
C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi => Moved successfully.
taphss6 => Service deleted successfully.
C:\Users\Public\AlexaNSISPlugin.10440.dll => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{5394BB77-A35F-4465-8A8C-F711EA6C0DB0}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{5394BB77-A35F-4465-8A8C-F711EA6C0DB0}" => Key deleted successfully.
C:\Windows\System32\Tasks\FacebookUpdateTaskUserS-1-5-21-3482530603-2352231087-752530051-1000Core => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\FacebookUpdateTaskUserS-1-5-21-3482530603-2352231087-752530051-1000Core" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{91ECF624-36C8-485C-8DAF-2D6956F8DAF8}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{91ECF624-36C8-485C-8DAF-2D6956F8DAF8}" => Key deleted successfully.
C:\Windows\System32\Tasks\FacebookUpdateTaskUserS-1-5-21-3482530603-2352231087-752530051-1000UA => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\FacebookUpdateTaskUserS-1-5-21-3482530603-2352231087-752530051-1000UA" => Key deleted successfully.
C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3482530603-2352231087-752530051-1000Core.job => Moved successfully.
C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3482530603-2352231087-752530051-1000UA.job => Moved successfully.

==== End of Fixlog 00:16:55 ====

 

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 07-01-2015
Ran by Tony (administrator) on TONY-PC on 10-01-2015 00:17:50
Running from C:\Users\Tony\Desktop
Loaded Profiles: Tony & postgres (Available profiles: Tony & postgres)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: English (United States)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel® Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
() C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Intel® Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Google Inc.) C:\Program Files\Google\Google Pinyin 3\GooglePinyinDaemon.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Flux Software LLC) C:\Users\Tony\AppData\Local\FluxSoftware\Flux\flux.exe
(Conexant Systems Inc.) C:\Windows\System32\CxAudMsg64.exe
(Conexant Systems, Inc.) C:\Program Files\CONEXANT\SA3\CxUtilSvc.exe
() C:\Program Files\Google\Google Pinyin 3\GooglePinyinService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe
(Conexant Systems, Inc.) C:\Program Files\CONEXANT\SA3\SmartAudio3.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Dell, Inc.) C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuAgent.exe
(PostgreSQL Global Development Group) C:\Program Files (x86)\PostgreSQL\8.4\bin\pg_ctl.exe
(PostgreSQL Global Development Group) C:\Program Files (x86)\PostgreSQL\8.4\bin\postgres.exe
(SoftThinks SAS) C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe
(PostgreSQL Global Development Group) C:\Program Files (x86)\PostgreSQL\8.4\bin\postgres.exe
(PostgreSQL Global Development Group) C:\Program Files (x86)\PostgreSQL\8.4\bin\postgres.exe
(PostgreSQL Global Development Group) C:\Program Files (x86)\PostgreSQL\8.4\bin\postgres.exe
(PostgreSQL Global Development Group) C:\Program Files (x86)\PostgreSQL\8.4\bin\postgres.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
(SoftThinks - Dell) C:\Program Files (x86)\Dell DataSafe Local Backup\Toaster.exe
() C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\STService.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2780968 2011-04-30] (Synaptics Incorporated)
HKLM\...\Run: [FreeFallProtection] => C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe [686704 2010-12-17] ()
HKLM\...\Run: [QuickSet] => C:\Program Files\Dell\QuickSet\QuickSet.exe [3668336 2011-03-25] (Dell Inc.)
HKLM\...\Run: [IntelPAN] => C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe [1935120 2011-05-03] (Intel® Corporation)
HKLM\...\Run: [BTMTrayAgent] => rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll",TrayApp
HKLM\...\Run: [Google Pinyin 3 Autoupdater] => C:\Program Files\Google\Google Pinyin 3\GooglePinyinDaemon.exe [1854008 2011-10-25] (Google Inc.)
HKLM\...\Run: [SmartAudio] => C:\Program Files\CONEXANT\SA3\SACpl.exe [1573504 2011-06-23] (Conexant Systems, Inc.)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe [283160 2011-02-18] (Intel Corporation)
HKLM-x32\...\Run: [Dell Webcam Central] => C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe [503942 2011-04-13] (Creative Technology Ltd)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe"
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1021128 2014-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5227112 2014-12-14] (AVAST Software)
Winlogon\Notify\igfxcui: C:\windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-3482530603-2352231087-752530051-1000\...\Run: [F.lux] => C:\Users\Tony\AppData\Local\FluxSoftware\Flux\flux.exe [1016712 2013-10-16] (Flux Software LLC)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software)
ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Tony\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Tony\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Tony\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Tony\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Tony\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Tony\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Tony\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Tony\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll (Dropbox, Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

SearchScopes: HKLM -> {2F1E335A-858A-4BE9-8F6B-D0AF1D018B53} URL = http://www.bing.com/...rc=IE-SearchBox
SearchScopes: HKLM-x32 -> {2F1E335A-858A-4BE9-8F6B-D0AF1D018B53} URL = http://www.bing.com/...rc=IE-SearchBox
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
DPF: HKLM-x32 {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset...lineScanner.cab
DPF: HKLM-x32 {88B8A9C7-10A1-4535-8EEB-0D875349E5B8} https://etrade.emega...w/CA/axekey.cab
DPF: HKLM-x32 {C1F8FC10-E5DB-4112-9DBF-6C3FF728D4E3} http://support.dell....lSystemLite.CAB
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\Tony\AppData\Roaming\Mozilla\Firefox\Profiles\gt83rqoy.default-1383689389646
FF SelectedSearchEngine: Yahoo!
FF Homepage: www.yahoo.com | www.google.com
FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF64_16_0_0_235.dll ()
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_235.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin -> C:\Program Files (x86)\Java\jre7\bin\new_plugin\npjp2.dll No File
FF Plugin-x32: @java.com/JavaPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-3482530603-2352231087-752530051-1000: @Skype Limited.com/Facebook Video Calling Plugin -> C:\Users\Tony\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF Extension: Perapera Chinese - C:\Users\Tony\AppData\Roaming\Mozilla\Firefox\Profiles\gt83rqoy.default-1383689389646\Extensions\[email protected] [2013-12-31]
FF HKLM-x32\...\Firefox\Extensions: [[email protected]] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2011-10-08]

Chrome:
=======
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-11-26]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-11-26] (AVAST Software)
S3 AvastVBoxSvc; C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe [4012248 2014-11-26] (Avast Software)
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)
R2 CxUtilSvc; C:\Program Files\Conexant\SA3\CxUtilSvc.exe [28288 2011-06-23] (Conexant Systems, Inc.)
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed]
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [340240 2011-05-03] ()
R2 postgresql-8.4; C:/Program Files (x86)/PostgreSQL/8.4/bin/pg_ctl.exe runservice -N "postgresql-8.4" -D "C:/Program Files (x86)/PostgreSQL/8.4/data" -w [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-11-26] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [83280 2014-11-26] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-11-26] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-11-26] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1050432 2014-11-26] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [436624 2014-11-26] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [116728 2014-11-26] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [267632 2014-11-26] ()
R3 MCfilt; C:\Windows\System32\drivers\MCfilt64.sys [32344 2010-12-09] (Creative Technology Ltd.)
R2 VBoxAswDrv; C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [271752 2014-11-26] (Avast Software)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-10 00:15 - 2015-01-10 00:15 - 00000230 _____ () C:\Users\Tony\Desktop\virus to do.txt
2015-01-10 00:11 - 2015-01-10 00:11 - 00001807 _____ () C:\Users\Tony\Desktop\virus total.txt
2015-01-10 00:06 - 2013-09-17 11:25 - 00020312 _____ (Systweak Inc., (www.systweak.com)) C:\Users\Tony\Desktop\roboot64.exe
2015-01-09 16:55 - 2015-01-09 16:56 - 00021399 _____ () C:\Users\Tony\Desktop\Addition.txt
2015-01-09 16:54 - 2015-01-10 00:18 - 00014336 _____ () C:\Users\Tony\Desktop\FRST.txt
2015-01-09 16:54 - 2015-01-10 00:17 - 00000000 ____D () C:\FRST
2015-01-09 16:52 - 2015-01-09 16:52 - 00007743 _____ () C:\Users\Tony\Desktop\JRT.txt
2015-01-09 16:48 - 2015-01-09 16:48 - 00000000 ____D () C:\windows\ERUNT
2015-01-09 16:46 - 2015-01-09 16:46 - 02124288 _____ (Farbar) C:\Users\Tony\Desktop\FRST64.exe
2015-01-09 16:44 - 2015-01-09 16:44 - 01707939 _____ (Thisisu) C:\Users\Tony\Desktop\JRT.exe
2015-01-09 16:43 - 2015-01-09 16:43 - 00001949 _____ () C:\Users\Tony\Desktop\AdwCleaner[S1].txt
2015-01-09 16:24 - 2015-01-09 16:24 - 02191360 _____ () C:\Users\Tony\Desktop\AdwCleaner.exe
2015-01-08 21:22 - 2015-01-08 21:22 - 00091362 _____ () C:\Users\Tony\Desktop\OTL.Txt
2015-01-08 21:13 - 2015-01-08 21:13 - 00602112 _____ (OldTimer Tools) C:\Users\Tony\Desktop\OTL.exe
2015-01-08 18:27 - 2015-01-08 19:39 - 217932271 _____ () C:\Users\Tony\Downloads\1466hj.wmv
2015-01-07 03:49 - 2015-01-07 03:49 - 00001538 _____ () C:\Users\Tony\Desktop\Logs - Shortcut.lnk
2015-01-06 04:27 - 2015-01-06 04:35 - 273127579 ____R () C:\Users\Tony\Downloads\sgs_veronica_rodriguez_480p_1000.mp4
2015-01-05 10:05 - 2015-01-05 10:05 - 00001393 _____ () C:\Users\Tony\Desktop\sun review.txt
2015-01-04 12:35 - 2015-01-04 12:35 - 00001211 _____ () C:\Users\Tony\Desktop\review2.txt
2015-01-04 11:48 - 2015-01-04 11:48 - 00001087 _____ () C:\Users\Tony\Desktop\trips post.txt
2015-01-04 01:56 - 2015-01-04 01:57 - 00000197 _____ () C:\windows\system32\2015-01-03-17-56-52.089-AvastVBoxSVC.exe-4212.log
2015-01-02 12:21 - 2015-01-02 12:22 - 00000197 _____ () C:\windows\system32\2015-01-02-04-21-50.068-AvastVBoxSVC.exe-5920.log
2015-01-01 19:54 - 2015-01-01 19:55 - 00000000 ____D () C:\Users\Tony\Desktop\Stocks
2015-01-01 12:15 - 2015-01-01 12:15 - 00000197 _____ () C:\windows\system32\2015-01-01-04-15-48.063-AvastVBoxSVC.exe-5288.log
2014-12-30 19:02 - 2014-12-30 19:03 - 00000197 _____ () C:\windows\system32\2014-12-30-11-02-46.049-AvastVBoxSVC.exe-5364.log
2014-12-30 11:15 - 2014-12-30 11:15 - 00000017 _____ () C:\windows\SysWOW64\shortcut_ex.dat
2014-12-29 15:29 - 2014-12-29 16:39 - 254246916 _____ () C:\Users\Tony\Downloads\2007_LLT.wmv
2014-12-29 15:04 - 2014-12-29 16:15 - 717731553 ____R () C:\Users\Tony\Downloads\dtl_daisymarie-wmvFullHigh-1.wmv
2014-12-29 14:00 - 2014-12-29 14:34 - 296732146 _____ () C:\Users\Tony\Downloads\sashagrey-gbg_5-sc6.avi
2014-12-29 10:14 - 2014-12-29 10:15 - 00000197 _____ () C:\windows\system32\2014-12-29-02-14-31.023-AvastVBoxSVC.exe-4132.log
2014-12-28 19:22 - 2014-12-28 19:22 - 00000197 _____ () C:\windows\system32\2014-12-28-11-22-20.055-AvastVBoxSVC.exe-4220.log
2014-12-27 14:15 - 2014-12-27 14:15 - 00000000 ____D () C:\Users\Tony\Downloads\Tribes1.40.655_SP1_OC3
2014-12-27 14:10 - 2014-12-27 14:14 - 114484131 _____ () C:\Users\Tony\Downloads\trorbs.zip
2014-12-26 14:21 - 2014-12-26 14:21 - 00000000 ____D () C:\windows\solcache
2014-12-26 14:20 - 2014-12-27 14:15 - 00000151 _____ () C:\windows\Sierra.ini
2014-12-26 14:20 - 2014-12-26 14:20 - 00000000 ____D () C:\Program Files (x86)\Sierra On-Line
2014-12-26 14:20 - 1998-10-29 16:45 - 00306688 _____ (InstallShield Software Corporation) C:\windows\IsUninst.exe
2014-12-26 14:09 - 2014-12-26 14:09 - 00000479 _____ () C:\Users\Tony\Downloads\ptavvski.zip
2014-12-26 06:24 - 2014-12-26 06:25 - 00000197 _____ () C:\windows\system32\2014-12-25-22-24-40.003-AvastVBoxSVC.exe-5156.log
2014-12-26 06:15 - 2014-12-26 06:15 - 00000197 _____ () C:\windows\system32\2014-12-25-22-15-52.067-AvastVBoxSVC.exe-5000.log
2014-12-24 05:30 - 2014-12-24 05:30 - 00000247 _____ () C:\windows\system32\2014-12-23-21-30-45.013-aswFe.exe-6972.log
2014-12-24 05:23 - 2014-12-24 05:30 - 00000247 _____ () C:\windows\system32\2014-12-23-21-23-40.044-aswFe.exe-1384.log
2014-12-24 05:23 - 2014-12-24 05:23 - 00000197 _____ () C:\windows\system32\2014-12-23-21-23-29.058-AvastVBoxSVC.exe-3764.log
2014-12-24 05:16 - 2014-12-24 05:17 - 00000197 _____ () C:\windows\system32\2014-12-23-21-16-52.093-AvastVBoxSVC.exe-4072.log
2014-12-20 02:01 - 2014-12-13 13:09 - 00144384 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe
2014-12-20 02:01 - 2014-12-13 11:33 - 00115712 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieUnatt.exe
2014-12-14 01:54 - 2014-12-14 01:54 - 00000197 _____ () C:\windows\system32\2014-12-13-17-54-16.089-AvastVBoxSVC.exe-5360.log
2014-12-12 06:58 - 2014-12-16 02:29 - 00000000 ____D () C:\windows\rescache
2014-12-11 22:48 - 2014-12-11 22:48 - 00000197 _____ () C:\windows\system32\2014-12-11-14-48-17.002-AvastVBoxSVC.exe-3792.log
2014-12-11 08:47 - 2014-12-11 08:47 - 00000000 ____D () C:\windows\system32\appraiser
2014-12-11 08:31 - 2014-10-18 10:05 - 04121600 _____ (Microsoft Corporation) C:\windows\system32\mf.dll
2014-12-11 08:31 - 2014-10-18 09:33 - 03209728 _____ (Microsoft Corporation) C:\windows\SysWOW64\mf.dll
2014-12-11 08:31 - 2014-07-07 10:06 - 00206848 _____ (Microsoft Corporation) C:\windows\system32\mfps.dll
2014-12-11 08:31 - 2014-07-07 10:06 - 00055808 _____ (Microsoft Corporation) C:\windows\system32\rrinstaller.exe
2014-12-11 08:31 - 2014-07-07 10:06 - 00024576 _____ (Microsoft Corporation) C:\windows\system32\mfpmp.exe
2014-12-11 08:31 - 2014-07-07 10:02 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\mferror.dll
2014-12-11 08:31 - 2014-07-07 09:40 - 00103424 _____ (Microsoft Corporation) C:\windows\SysWOW64\mfps.dll
2014-12-11 08:31 - 2014-07-07 09:39 - 00050176 _____ (Microsoft Corporation) C:\windows\SysWOW64\rrinstaller.exe
2014-12-11 08:31 - 2014-07-07 09:39 - 00023040 _____ (Microsoft Corporation) C:\windows\SysWOW64\mfpmp.exe
2014-12-11 08:31 - 2014-07-07 09:37 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\mferror.dll
2014-12-11 08:30 - 2014-11-27 09:43 - 00389296 _____ (Microsoft Corporation) C:\windows\system32\iedkcs32.dll
2014-12-11 08:30 - 2014-11-27 09:10 - 00342200 _____ (Microsoft Corporation) C:\windows\SysWOW64\iedkcs32.dll
2014-12-11 08:30 - 2014-11-22 11:13 - 25059840 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2014-12-11 08:30 - 2014-11-22 11:06 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2014-12-11 08:30 - 2014-11-22 11:06 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll
2014-12-11 08:30 - 2014-11-22 10:50 - 00580096 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll
2014-12-11 08:30 - 2014-11-22 10:50 - 00066560 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2014-12-11 08:30 - 2014-11-22 10:49 - 02885120 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2014-12-11 08:30 - 2014-11-22 10:49 - 00048640 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll
2014-12-11 08:30 - 2014-11-22 10:48 - 00088064 _____ (Microsoft Corporation) C:\windows\system32\MshtmlDac.dll
2014-12-11 08:30 - 2014-11-22 10:41 - 00054784 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2014-12-11 08:30 - 2014-11-22 10:40 - 00034304 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2014-12-11 08:30 - 2014-11-22 10:37 - 00633856 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2014-12-11 08:30 - 2014-11-22 10:35 - 00114688 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe
2014-12-11 08:30 - 2014-11-22 10:34 - 06039552 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2014-12-11 08:30 - 2014-11-22 10:34 - 00814080 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll
2014-12-11 08:30 - 2014-11-22 10:26 - 00968704 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe
2014-12-11 08:30 - 2014-11-22 10:22 - 19749376 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2014-12-11 08:30 - 2014-11-22 10:22 - 00490496 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll
2014-12-11 08:30 - 2014-11-22 10:20 - 02724864 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2014-12-11 08:30 - 2014-11-22 10:14 - 00077824 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll
2014-12-11 08:30 - 2014-11-22 10:09 - 00199680 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll
2014-12-11 08:30 - 2014-11-22 10:08 - 00092160 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2014-12-11 08:30 - 2014-11-22 10:07 - 00501248 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll
2014-12-11 08:30 - 2014-11-22 10:07 - 00062464 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
2014-12-11 08:30 - 2014-11-22 10:06 - 00047616 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieetwproxystub.dll
2014-12-11 08:30 - 2014-11-22 10:05 - 00316928 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll
2014-12-11 08:30 - 2014-11-22 10:05 - 00064000 _____ (Microsoft Corporation) C:\windows\SysWOW64\MshtmlDac.dll
2014-12-11 08:30 - 2014-11-22 10:01 - 02277888 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2014-12-11 08:30 - 2014-11-22 09:59 - 00047104 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2014-12-11 08:30 - 2014-11-22 09:58 - 00030720 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
2014-12-11 08:30 - 2014-11-22 09:56 - 00478208 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll
2014-12-11 08:30 - 2014-11-22 09:54 - 00620032 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9diag.dll
2014-12-11 08:30 - 2014-11-22 09:49 - 00800768 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2014-12-11 08:30 - 2014-11-22 09:49 - 00718848 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2014-12-11 08:30 - 2014-11-22 09:47 - 01359360 _____ (Microsoft Corporation) C:\windows\system32\mshtmlmedia.dll
2014-12-11 08:30 - 2014-11-22 09:46 - 02125312 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
2014-12-11 08:30 - 2014-11-22 09:45 - 00418304 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll
2014-12-11 08:30 - 2014-11-22 09:43 - 14412800 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2014-12-11 08:30 - 2014-11-22 09:40 - 00060416 _____ (Microsoft Corporation) C:\windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-12-11 08:30 - 2014-11-22 09:36 - 00168960 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll
2014-12-11 08:30 - 2014-11-22 09:35 - 00076288 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll
2014-12-11 08:30 - 2014-11-22 09:33 - 00285696 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll
2014-12-11 08:30 - 2014-11-22 09:29 - 04299264 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2014-12-11 08:30 - 2014-11-22 09:28 - 02358272 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2014-12-11 08:30 - 2014-11-22 09:23 - 00688640 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2014-12-11 08:30 - 2014-11-22 09:22 - 02052096 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl
2014-12-11 08:30 - 2014-11-22 09:21 - 01155072 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmlmedia.dll
2014-12-11 08:30 - 2014-11-22 09:15 - 01548288 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2014-12-11 08:30 - 2014-11-22 09:13 - 12836864 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2014-12-11 08:30 - 2014-11-22 09:03 - 00800768 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll
2014-12-11 08:30 - 2014-11-22 09:00 - 01888256 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2014-12-11 08:30 - 2014-11-22 08:56 - 01307136 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2014-12-11 08:30 - 2014-11-22 08:54 - 00710144 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dll
2014-12-11 08:29 - 2014-12-04 10:50 - 00830976 _____ (Microsoft Corporation) C:\windows\system32\appraiser.dll
2014-12-11 08:29 - 2014-12-04 10:50 - 00741376 _____ (Microsoft Corporation) C:\windows\system32\invagent.dll
2014-12-11 08:29 - 2014-12-04 10:50 - 00413184 _____ (Microsoft Corporation) C:\windows\system32\generaltel.dll
2014-12-11 08:29 - 2014-12-04 10:50 - 00396800 _____ (Microsoft Corporation) C:\windows\system32\devinv.dll
2014-12-11 08:29 - 2014-12-04 10:50 - 00227328 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll
2014-12-11 08:29 - 2014-12-04 10:50 - 00192000 _____ (Microsoft Corporation) C:\windows\system32\aepic.dll
2014-12-11 08:29 - 2014-12-04 10:44 - 01083392 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll
2014-12-11 08:29 - 2014-12-02 07:28 - 01232040 _____ (Microsoft Corporation) C:\windows\system32\aitstatic.exe
2014-12-11 08:29 - 2014-11-11 11:09 - 01424384 _____ (Microsoft Corporation) C:\windows\system32\WindowsCodecs.dll
2014-12-11 08:29 - 2014-11-11 10:44 - 01230336 _____ (Microsoft Corporation) C:\windows\SysWOW64\WindowsCodecs.dll
2014-12-11 08:29 - 2014-11-11 09:46 - 00119296 _____ (Microsoft Corporation) C:\windows\system32\Drivers\tdx.sys
2014-12-11 08:28 - 2014-11-08 11:16 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\tzres.dll
2014-12-11 08:28 - 2014-11-08 10:45 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\tzres.dll
2014-12-11 08:27 - 2014-10-30 10:03 - 00165888 _____ (Microsoft Corporation) C:\windows\system32\charmap.exe
2014-12-11 08:27 - 2014-10-30 09:45 - 00155136 _____ (Microsoft Corporation) C:\windows\SysWOW64\charmap.exe

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-09 23:54 - 2013-06-17 16:18 - 00000830 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2015-01-09 23:47 - 2011-10-13 04:26 - 00003918 _____ () C:\windows\System32\Tasks\User_Feed_Synchronization-{8E6A4211-3F19-4F2D-AC5F-BD7D11C1D32B}
2015-01-09 23:47 - 2011-09-27 11:24 - 01226370 _____ () C:\windows\WindowsUpdate.log
2015-01-09 17:19 - 2013-10-24 06:01 - 00001352 _____ () C:\Users\Tony\Desktop\PLO notes.txt
2015-01-09 16:51 - 2009-07-14 12:45 - 00028576 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-01-09 16:51 - 2009-07-14 12:45 - 00028576 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-01-09 16:41 - 2011-10-04 21:56 - 00000000 ____D () C:\Users\Default\AppData\Local\SoftThinks
2015-01-09 16:41 - 2011-10-04 21:56 - 00000000 ____D () C:\Users\Default User\AppData\Local\SoftThinks
2015-01-09 16:41 - 2011-09-27 12:19 - 00000000 ____D () C:\Program Files (x86)\Dell DataSafe Local Backup
2015-01-09 16:40 - 2010-11-21 11:47 - 00382336 _____ () C:\windows\PFRO.log
2015-01-09 16:40 - 2009-07-14 13:08 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2015-01-09 16:40 - 2009-07-14 12:51 - 00164208 _____ () C:\windows\setupact.log
2015-01-09 16:39 - 2013-11-06 06:12 - 00000000 ____D () C:\AdwCleaner
2015-01-09 16:14 - 2012-07-10 08:03 - 00004182 _____ () C:\windows\System32\Tasks\avast! Emergency Update
2015-01-09 16:13 - 2011-10-09 20:14 - 00000000 ____D () C:\Users\postgres
2015-01-09 05:44 - 2012-11-06 22:30 - 00000000 ____D () C:\Program Files (x86)\Full Tilt Poker
2015-01-09 05:16 - 2011-10-09 20:15 - 00000000 ____D () C:\Users\Tony\AppData\Roaming\HEM Data
2015-01-09 04:26 - 2011-10-08 19:14 - 00000000 ____D () C:\Users\Tony\AppData\Local\PokerStars
2015-01-08 20:58 - 2011-10-08 23:52 - 00000000 ____D () C:\Users\Tony\AppData\Roaming\Skype
2015-01-07 03:37 - 2012-11-22 01:15 - 00000000 ____D () C:\Users\Tony\Desktop\Poker
2015-01-06 15:43 - 2011-10-12 22:12 - 00000000 ____D () C:\Users\Tony\AppData\Roaming\uTorrent
2015-01-06 04:36 - 2010-11-21 11:27 - 00298120 ____N (Microsoft Corporation) C:\windows\system32\MpSigStub.exe
2015-01-04 02:34 - 2011-10-09 20:15 - 00000000 ____D () C:\HMArchive
2015-01-04 02:25 - 2012-12-03 22:28 - 00000000 ____D () C:\Users\Tony\Desktop\FT Hands
2015-01-01 19:49 - 2012-12-03 23:23 - 00000000 ____D () C:\Users\Tony\AppData\Local\cache
2014-12-26 14:21 - 2012-09-02 04:05 - 00000000 ____D () C:\Users\Tony\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
2014-12-20 09:18 - 2013-06-27 20:42 - 00001065 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\LINE.lnk
2014-12-20 09:18 - 2013-06-27 20:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LINE
2014-12-20 01:59 - 2014-08-18 03:52 - 00000000 ____D () C:\Users\Tony\AppData\Local\Adobe
2014-12-20 01:58 - 2013-06-17 16:18 - 00003768 _____ () C:\windows\System32\Tasks\Adobe Flash Player Updater
2014-12-20 01:58 - 2012-03-31 15:40 - 00701616 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2014-12-20 01:58 - 2011-10-12 04:38 - 00071344 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-12-11 22:58 - 2013-01-11 04:47 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-12-11 08:47 - 2014-05-07 08:04 - 00000000 ___SD () C:\windows\system32\CompatTel
2014-12-11 08:47 - 2009-07-14 11:20 - 00000000 ____D () C:\windows\PolicyDefinitions
2014-12-11 08:47 - 2009-07-14 11:20 - 00000000 ____D () C:\windows\AppCompat
2014-12-11 08:36 - 2013-07-17 02:07 - 00000000 ____D () C:\windows\system32\MRT
2014-12-11 08:32 - 2011-10-05 03:31 - 112710672 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe

Some content of TEMP:
====================
C:\Users\Tony\AppData\Local\Temp\Quarantine.exe
C:\Users\Tony\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Tony\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-01-04 21:16

==================== End Of Log ============================

 

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 07-01-2015
Ran by Tony at 2015-01-10 00:18:30
Running from C:\Users\Tony\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: avast! Antivirus (Disabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Disabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

µTorrent (HKU\S-1-5-21-3482530603-2352231087-752530051-1000\...\uTorrent) (Version: 3.4.2.34309 - BitTorrent Inc.)
AccelerometerP11 (HKLM-x32\...\{87434D51-51DB-4109-B68F-A829ECDCF380}) (Version: 2.00.11.22 - STMicroelectronics)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 3.6.0.6090 - Adobe Systems Incorporated)
Adobe Flash Player 15 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 15.0.0.246 - Adobe Systems Incorporated)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.235 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
Advanced Audio FX Engine (HKLM-x32\...\Advanced Audio FX Engine) (Version: 1.12.05 - Creative Technology Ltd)
Age of Empires III - The Asian Dynasties (HKLM-x32\...\InstallShield_{C43C1415-3DFC-4089-9A32-0BECF28A6046}) (Version: 1.00.0000 - Microsoft Game Studios)
Age of Empires III - The Asian Dynasties (x32 Version: 1.00.0000 - Microsoft Game Studios) Hidden
Age of Empires III - The WarChiefs (HKLM-x32\...\InstallShield_{1C08A24C-B168-407E-A826-68FAF5F20710}) (Version: 1.00.0000 - Microsoft Game Studios)
Age of Empires III - The WarChiefs (x32 Version: 1.00.0000 - Microsoft Game Studios) Hidden
Age of Empires III (HKLM-x32\...\InstallShield_{7B9CC60A-9B81-46A3-A953-76B6BF9EEC97}) (Version: 1.00.0000 - Microsoft Game Studios)
Age of Empires III (x32 Version: 1.00.0000 - Microsoft Game Studios) Hidden
Age of Empires Online (HKLM-x32\...\Steam App 105430) (Version:  - Microsoft)
Avast Free Antivirus (HKLM-x32\...\avast) (Version: 10.0.2208 - AVAST Software)
Bodog Poker (HKLM-x32\...\{D7CA2DF8-95CE-4C80-9296-98E21219A1E4}}_is1) (Version:   - )
Conexant SmartAudio HD (HKLM\...\CNXT_AUDIO_HDA) (Version: 8.54.16.0 - Conexant)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Dell DataSafe Local Backup - Support Software (HKLM-x32\...\{A9668246-FB70-4103-A1E3-66C9BC2EFB49}) (Version: 9.4.60 - Dell Inc.)
Dell DataSafe Local Backup (HKLM-x32\...\{0ED7EE95-6A97-47AA-AD73-152C08A15B04}) (Version: 9.4.60 - Dell Inc.)
Dell DataSafe Online (HKLM-x32\...\{7EC66A95-AC2D-4127-940B-0445A526AB2F}) (Version: 2.1.19634 - Dell)
Dell Edoc Viewer (HKLM\...\{8EBA8727-ADC2-477B-9D9A-1A1836BE4E05}) (Version: 1.0.0 - Dell Inc)
Dell Getting Started Guide (HKLM-x32\...\{7DB9F1E5-9ACB-410D-A7DC-7A3D023CE045}) (Version: 1.00.0000 - Dell Inc.)
Dell MusicStage (HKLM-x32\...\{91AF2672-F5BC-42CF-8037-A9D2F92BBCC0}) (Version: 1.5.201.0 - Fingertapps)
Dell PhotoStage (HKLM-x32\...\{E4335E82-17B3-460F-9E70-39D9BC269DB3}) (Version: 1.5.0.65 - ArcSoft)
Dell Stage (HKLM-x32\...\{E2EBA7C0-8072-447F-856D-FFEE8D15B23B}) (Version: 1.5.201.0 - Fingertapps)
Dell Stage Remote (HKLM-x32\...\{AF4D3C63-009B-4A17-B02E-D395065DD3F0}) (Version: 2.0.0.43 - ArcSoft)
Dell Touchpad (HKLM\...\SynTPDeinstKey) (Version: 15.3.5.0 - Synaptics Incorporated)
Dell VideoStage  (HKLM-x32\...\InstallShield_{DCE0E79A-B9AC-41AC-98C1-7EF0538BCA7F}) (Version: 1.2.0.1712 - CyberLink Corp.)
Dell VideoStage  (x32 Version: 1.2.0.1712 - CyberLink Corp.) Hidden
Dell Webcam Central (HKLM-x32\...\Dell Webcam Central) (Version: 2.00.44 - Creative Technology Ltd)
Dropbox (HKU\S-1-5-21-3482530603-2352231087-752530051-1000\...\Dropbox) (Version: 2.6.27 - Dropbox, Inc.)
ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version:  - )
f.lux (HKU\S-1-5-21-3482530603-2352231087-752530051-1000\...\Flux) (Version:  - )
Facebook Video Calling 3.1.0.521 (HKLM-x32\...\{2091F234-EB58-4B80-8C96-8EB78C808CF7}) (Version: 3.1.521 - Skype Limited)
Full Tilt Poker (HKLM-x32\...\{D4C9692E-4EFA-4DA0-8B7F-9439466D9E31}) (Version: 4.46.3.WIN.FullTilt.COM - )
GameRanger (HKU\S-1-5-21-3482530603-2352231087-752530051-1000\...\GameRanger) (Version:  - GameRanger Technologies)
Goalwin Poker (HKLM-x32\...\Goalwin Poker_is1) (Version:  - goalwin)
High-Definition Video Playback (x32 Version: 7.3.10000.0.0 - Nero AG) Hidden
Holdem Manager (HKLM-x32\...\HoldemManager) (Version:  - )
Holdem Manager 2 (HKLM-x32\...\HoldemManager2) (Version:  - )
Intel PROSet Wireless (x32 Version:  - ) Hidden
Intel® Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)
Intel® Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 7.0.0.1144 - Intel Corporation)
Intel® Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2418 - Intel Corporation)
Intel® PROSet/Wireless for Bluetooth® 3.0 + High Speed (HKLM\...\{A0E106D2-4815-4B7A-BAA7-7E21B530CFB4}) (Version: 1.1.0.0157 - Intel Corporation)
Intel® PROSet/Wireless Software for Bluetooth® Technology (HKLM\...\{006B5C65-3938-4246-B182-994A7E415EDE}) (Version: 1.1.0.0537 - Intel Corporation)
Intel® PROSet/Wireless WiFi Software (HKLM\...\{3C41721F-AF0F-4086-AA1C-4C7F29076228}) (Version: 14.01.1000 - Intel Corporation)
Intel® Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 10.1.5.1001 - Intel Corporation)
Intel® WiDi (HKLM-x32\...\{25680C01-6753-4FE9-A891-7857F26457C1}) (Version: 2.1.35.0 - Intel Corporation)
Intel® Wireless Display (HKLM\...\{28EF7372-9087-4AC3-9B9F-D9751FCDF830}) (Version:  - )
Java 7 Update 71 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217071FF}) (Version: 7.0.710 - Oracle)
JavaFX 2.1.1 (HKLM-x32\...\{1111706F-666A-4037-7777-211328764D10}) (Version: 2.1.1 - Oracle Corporation)
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
LINE (HKLM-x32\...\LINE) (Version: 3.9.0.172 - LINE Corporation)
Malwarebytes Anti-Malware version 1.75.0.1300 (HKLM-x32\...\Malwarebytes' Anti-Malware_is1) (Version: 1.75.0.1300 - Malwarebytes Corporation)
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Games for Windows - LIVE Redistributable (HKLM-x32\...\{832D9DE0-8AFC-4689-9819-4DBBDEBD3E4F}) (Version: 3.5.92.0 - Microsoft Corporation)
Microsoft Games for Windows Marketplace (HKLM-x32\...\{4CB0307C-565E-4441-86BE-0DF2E4FB828C}) (Version: 3.5.50.0 - Microsoft Corporation)
Microsoft Office 2010 (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Click-to-Run 2010 (HKLM-x32\...\Office14.Click2Run) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Starter 2010 - English (HKLM-x32\...\{90140011-0066-0409-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft PowerPoint Viewer (HKLM-x32\...\{95140000-00AF-0409-0000-0000000FF1CE}) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable - KB2467175 (HKLM-x32\...\{a0fe116e-9a8a-466f-aee0-625cb7c207e3}) (Version: 8.0.51011 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{820B6609-4C97-3A2B-B644-573B06A0F0CC}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.30319 (HKLM-x32\...\{196BB40D-1578-3D01-B289-BEFC77A11A1E}) (Version: 10.0.30319 - Microsoft Corporation)
Mozilla Firefox 34.0.5 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 34.0.5 (x86 en-US)) (Version: 34.0.5 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 12.0 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Nero Update (HKLM-x32\...\{65BB0407-4CC8-4DC7-952E-3EEFDF05602A}) (Version: 1.0.0018 - Nero AG)
OpenOffice.org 3.3 (HKLM-x32\...\{3E171899-0175-47CC-84C4-562ACDD4C021}) (Version: 3.3.9567 - OpenOffice.org)
PokerStars (HKLM-x32\...\PokerStars) (Version:  - PokerStars)
PokerStrategy.com Equilab (HKLM-x32\...\{86D09F48-CDAB-4B4C-8806-F6C16F17935A}) (Version: 1.2.8.0 - PokerStrategy.com)
PostgreSQL 8.4 (HKLM-x32\...\PostgreSQL 8.4) (Version: 8.4 - PostgreSQL Global Development Group)
Quickset64 (HKLM\...\{87CF757E-C1F1-4D22-865C-00C6950B5258}) (Version: 10.09.25 - Dell Inc.)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.43.321.2011 - Realtek)
Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.7600.30127 - Realtek Semiconductor Corp.)
Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.3.16540.9015 - Microsoft Corporation)
Skype™ 6.20 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 6.20.104 - Skype Technologies S.A.)
Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)
SyncUP (HKLM-x32\...\{40F06490-8C14-43AA-99D3-EEEFDBAC3CFC}) (Version: 1.8.21200.33.104 - Nero AG)
SyncUP (HKLM-x32\...\{D92C9CCE-E5F0-4125-977A-0590F3225B74}) (Version: 10.2.13500 - Nero AG)
Team Fortress 2 (HKLM-x32\...\Steam App 440) (Version:  - Valve)
TI USB 3.0 Host Controller Driver (HKLM-x32\...\InstallShield_{B1EB7FFF-6E44-43D8-869D-B78E44CD3E0F}) (Version: 1.12.14.0 - Texas Instruments Inc.)
TI USB3 Host Driver (x32 Version: 1.12.14.0 - Texas Instruments Inc.) Hidden
UBNet (HKU\S-1-5-21-3482530603-2352231087-752530051-1000\...\UBNet) (Version:  - )
VirtualCloneDrive (HKLM-x32\...\VirtualCloneDrive) (Version:  - Elaborate Bytes)
VLC media player 1.1.11 (HKLM-x32\...\VLC media player) (Version: 1.1.11 - VideoLAN)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3538.0513 - Microsoft Corporation)
Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation)
WinRAR 4.01 (64-bit) (HKLM\...\WinRAR archiver) (Version: 4.01.0 - win.rar GmbH)
Zinio Reader 4 (HKLM-x32\...\ZinioReader4) (Version: 4.2.4164 - Zinio LLC)
Zinio Reader 4 (x32 Version: 4.2.4164 - Zinio LLC) Hidden
谷歌拼音输入法 3.0 (HKLM\...\GooglePinyin3) (Version:  - Google Inc.)
適用遠端連線的 Windows Live Mesh ActiveX 控制項 (HKLM-x32\...\{622DE1BE-9EDE-49D3-B349-29D64760342A}) (Version: 15.4.5722.2 - Microsoft Corporation)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-3482530603-2352231087-752530051-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Tony\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3482530603-2352231087-752530051-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Tony\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3482530603-2352231087-752530051-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Tony\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3482530603-2352231087-752530051-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Tony\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3482530603-2352231087-752530051-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Tony\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)

==================== Restore Points  =========================

24-12-2014 03:17:47 Windows Update
27-12-2014 13:50:22 Windows Update
31-12-2014 12:44:38 Windows Update
08-01-2015 20:58:46 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 10:34 - 2009-06-11 05:00 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {9D897891-E5B6-4F25-9A42-93EA5F62579A} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {BEBE4AAC-2C0C-4E90-AD89-D615A1EFA72B} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-12-20] (Adobe Systems Incorporated)
Task: {D0CECD90-26B3-4B6D-AD24-07502AD5EE9F} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2014-11-26] (AVAST Software)
Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Loaded Modules (whitelisted) =============

2011-05-03 02:41 - 2011-05-03 02:41 - 01501696 _____ () C:\Program Files\Common Files\Intel\WirelessCommon\Libeay32.dll
2011-09-27 13:53 - 2011-06-11 02:36 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2011-09-27 13:53 - 2011-04-30 10:01 - 00057640 _____ () C:\Program Files\Synaptics\SynTP\SynTPEnhPS.dll
2011-09-27 11:42 - 2010-12-17 23:25 - 00686704 _____ () C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe
2011-05-03 02:41 - 2011-05-03 02:41 - 01501696 _____ () C:\Program Files\Common Files\Intel\WirelessCommon\LIBEAY32.dll
2011-10-25 19:10 - 2011-10-25 19:10 - 01208376 _____ () C:\Program Files\Google\Google Pinyin 3\GooglePinyinService.exe
2011-09-27 12:19 - 2011-08-18 23:05 - 02751808 _____ () C:\Program Files (x86)\Dell DataSafe Local Backup\COMPONENTS\SCHEDULER\STSERVICE.EXE
2011-10-08 22:56 - 2011-05-28 22:05 - 00164864 _____ () C:\Program Files\WinRAR\rarext.dll
2015-01-09 16:15 - 2015-01-09 16:15 - 02909696 _____ () C:\Program Files\AVAST Software\Avast\defs\15010900\algo.dll
2014-11-26 16:12 - 2014-11-26 16:12 - 38562088 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2011-10-09 20:13 - 2011-01-28 13:15 - 00172032 _____ () C:\Program Files (x86)\PostgreSQL\8.4\bin\LIBPQ.dll
2011-10-09 20:13 - 2009-02-13 03:01 - 00976384 _____ () C:\Program Files (x86)\PostgreSQL\8.4\bin\libxml2.dll
2011-10-09 20:13 - 2005-07-20 18:48 - 00059904 _____ () C:\Program Files (x86)\PostgreSQL\8.4\bin\zlib1.dll
2014-10-23 04:27 - 2014-10-23 04:27 - 00169472 _____ () C:\windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\139f38c8b8d826dbacb56c272a366bd7\IsdiInterop.ni.dll
2011-09-27 11:32 - 2011-02-18 21:16 - 00058880 _____ () C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IsdiInterop.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

MSCONFIG\Services: NAUpdate => 2
MSCONFIG\startupreg: AccuWeatherWidget => "C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe" "C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\start.umj" --startup
MSCONFIG\startupreg: Dell DataSafe Online => C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuClient.exe
MSCONFIG\startupreg: DellStage => "C:\Program Files (x86)\Dell Stage\Dell Stage\stage_primary.exe" "C:\Program Files (x86)\Dell Stage\Dell Stage\start.umj" --startup
MSCONFIG\startupreg: Facebook Update => "C:\Users\Tony\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver
MSCONFIG\startupreg: NeroLauncher => C:\Program Files (x86)\Nero\SyncUP\NeroLauncher.exe 900
MSCONFIG\startupreg: Stage Remote => C:\Program Files (x86)\Dell\Stage Remote\StageRemote.exe -Quiet
MSCONFIG\startupreg: VirtualCloneDrive => "C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s

========================= Accounts: ==========================

Administrator (S-1-5-21-3482530603-2352231087-752530051-500 - Administrator - Disabled)
Guest (S-1-5-21-3482530603-2352231087-752530051-501 - Limited - Disabled)
postgres (S-1-5-21-3482530603-2352231087-752530051-1002 - Limited - Enabled) => C:\Users\postgres
Tony (S-1-5-21-3482530603-2352231087-752530051-1000 - Administrator - Enabled) => C:\Users\Tony

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================

System errors:
=============

Microsoft Office Sessions:
=========================

==================== Memory info ===========================

Processor: Intel® Core™ i3-2330M CPU @ 2.20GHz
Percentage of memory in use: 44%
Total physical RAM: 4002.13 MB
Available physical RAM: 2240.5 MB
Total Pagefile: 8002.44 MB
Available Pagefile: 5963.27 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:97.66 GB) (Free:6.87 GB) NTFS
Drive d: (DATA) (Fixed) (Total:185.69 GB) (Free:68.47 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298.1 GB) (Disk ID: B2158B78)
Partition 1: (Not Active) - (Size=100 MB) - (Type=DE)
Partition 2: (Active) - (Size=14.6 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=97.7 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=185.7 GB) - (Type=OF Extended)

==================== End Of Log ============================

[taipei_tony]

I just did the "sfc /scannow" and it finised and said "Windows Resource Protection did not find any integrity violations."

[taipei_tony]

And finally here are the two Event Viewer logs:

 

Vino's Event Viewer v01c run on Windows 2008 in English
Report run at 10/01/2015 12:48:49 AM

Note: All dates below are in the format dd/mm/yyyy

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'System' Log - Critical Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'System' Log - Error Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'System' Log - Warning Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Log: 'System' Date/Time: 09/01/2015 4:25:38 PM
Type: Warning Category: 0
Event: 11 Source: Microsoft-Windows-Wininit
Custom dynamic link libraries are being loaded for every application. The system administrator should review the list of libraries to ensure they are related to trusted applications.

Log: 'System' Date/Time: 09/01/2015 4:25:21 PM
Type: Warning Category: 0
Event: 1 Source: RTL8167
Realtek PCIe GBE Family Controller is disconnected from network.

Log: 'System' Date/Time: 09/01/2015 4:24:50 PM
Type: Warning Category: 0
Event: 4001 Source: Microsoft-Windows-WLAN-AutoConfig
WLAN AutoConfig service has successfully stopped.

Log: 'System' Date/Time: 09/01/2015 4:24:50 PM
Type: Warning Category: 0
Event: 10002 Source: Microsoft-Windows-WLAN-AutoConfig
WLAN Extensibility Module has stopped.  Module Path: C:\windows\System32\IWMSSvc.dll
 

 

Vino's Event Viewer v01c run on Windows 2008 in English
Report run at 10/01/2015 12:49:37 AM

Note: All dates below are in the format dd/mm/yyyy

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'Application' Log - Critical Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'Application' Log - Error Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Log: 'Application' Date/Time: 09/01/2015 4:26:42 PM
Type: Error Category: 0
Event: 10 Source: Microsoft-Windows-WMI
Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Log: 'Application' Date/Time: 09/01/2015 4:26:26 PM
Type: Error Category: 0
Event: 0 Source: PostgreSQL
2015-01-10 00:26:26 CSTFATAL:  the database system is starting up


Log: 'Application' Date/Time: 09/01/2015 4:26:25 PM
Type: Error Category: 0
Event: 0 Source: PostgreSQL
2015-01-10 00:26:25 CSTFATAL:  the database system is starting up


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'Application' Log - Warning Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Log: 'Application' Date/Time: 09/01/2015 4:36:54 PM
Type: Warning Category: 1
Event: 100 Source: CVHSVC
Information only. CurrentSoftGridPrereq: Click2Run installation (version = 14.0.4763.1000) is found on the machine; skipping installation...

Log: 'Application' Date/Time: 09/01/2015 4:36:53 PM
Type: Warning Category: 1
Event: 100 Source: CVHSVC
Information only. C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE is trusted.

Log: 'Application' Date/Time: 09/01/2015 4:26:44 PM
Type: Warning Category: 6
Event: 3057 Source: Application Virtualization Client
{tid=1184}
The Application Virtualization Client Core initialized correctly.  Installed Product:  Version: 4.6.2.22610 Install Path: C:\Program Files (x86)\Microsoft Application Virtualization Client Global Data Directory: C:\ProgramData\Microsoft\Application Virtualization Client\ Machine Name: TONY-PC Operating System: Windows 7 64-bit Service Pack 1.0 Build 7601 OSD Command:

Log: 'Application' Date/Time: 09/01/2015 4:26:41 PM
Type: Warning Category: 3
Event: 3191 Source: Application Virtualization Client
{tid=1184}
-------------------------------------------------------- Initialized client log (C:\ProgramData\Microsoft\Application Virtualization Client\sftlog.txt)

 

 

And here's the Process Explorer log:

Process    CPU    Private Bytes    Working Set    PID    Description    Company Name    Verified Signer
System Idle Process    94.07    0 K    24 K    0            
procexp64.exe    3.10    29,112 K    51,040 K    5000    Sysinternals Process Explorer    Sysinternals - www.sysinternals.com    (Verified) Sysinternals
dwm.exe    0.83    134,544 K    93,632 K    1768    Desktop Window Manager    Microsoft Corporation    (Verified) Microsoft Windows
System    0.62    196 K    3,340 K    4            
csrss.exe    0.55    11,460 K    42,032 K    688    Client Server Runtime Process    Microsoft Corporation    (No signature was present in the subject) Microsoft Corporation
Interrupts    0.42    0 K    0 K    n/a    Hardware Interrupts and DPCs        
explorer.exe    0.10    38,732 K    59,924 K    1776    Windows Explorer    Microsoft Corporation    (Verified) Microsoft Windows
FF_Protection.exe    0.04    2,184 K    7,176 K    2064    FF_Protection MFC Application        (Verified) STMicroelectronics
LMS.exe    0.04    2,260 K    4,732 K    3836    Local Manageability Service    Intel Corporation    (Verified) Intel Corporation
Toaster.exe    0.03    63,432 K    45,896 K    4084    Dell DataSafe Local Backup    SoftThinks - Dell    (Verified) Dell Inc
svchost.exe    0.03    4,864 K    9,804 K    916    Host Process for Windows Services    Microsoft Corporation    (Verified) Microsoft Windows
flux.exe    0.02    43,312 K    29,700 K    2488    f.lux    Flux Software LLC    (Verified) Michael Herf
AvastSvc.exe    0.02    74,540 K    40,964 K    1920    avast! Service    AVAST Software    (Verified) AVAST Software a.s.
avastui.exe    0.02    14,372 K    17,252 K    2956    avast! Antivirus    AVAST Software    (Verified) AVAST Software a.s.
IAStorDataMgrSvc.exe    0.02    18,720 K    16,408 K    4840    IAStorDataSvc    Intel Corporation    (Verified) Intel Corporation
NOBuAgent.exe    0.02    2,592 K    5,800 K    2988    Dell DataSafe Online Service    Dell, Inc.    (Verified) Symantec Corporation
svchost.exe    0.01    14,972 K    15,956 K    1468    Host Process for Windows Services    Microsoft Corporation    (Verified) Microsoft Windows
svchost.exe    0.01    9,556 K    17,128 K    468    Host Process for Windows Services    Microsoft Corporation    (Verified) Microsoft Windows
WLIDSVC.EXE    < 0.01    7,220 K    14,396 K    4048    Microsoft® Windows Live ID Service    Microsoft Corp.    (Verified) Microsoft Corporation
SmartAudio3.exe    < 0.01    104,900 K    54,248 K    2920    SmartAudio3 [32-Bit]    Conexant Systems, Inc.    (Verified) Conexant Systems
taskhost.exe    < 0.01    11,404 K    16,192 K    1696    Host Process for Windows Tasks    Microsoft Corporation    (Verified) Microsoft Windows
svchost.exe    < 0.01    28,420 K    43,784 K    420    Host Process for Windows Services    Microsoft Corporation    (Verified) Microsoft Windows
postgres.exe    < 0.01    4,508 K    8,008 K    3612    PostgreSQL Server    PostgreSQL Global Development Group    (No signature was present in the subject) PostgreSQL Global Development Group
SynTPEnh.exe    < 0.01    9,304 K    14,984 K    1864    Synaptics TouchPad Enhancements    Synaptics Incorporated    (Verified) Microsoft Windows Hardware Compatibility Publisher
postgres.exe    < 0.01    4,508 K    7,784 K    3620    PostgreSQL Server    PostgreSQL Global Development Group    (No signature was present in the subject) PostgreSQL Global Development Group
conhost.exe    < 0.01    1,376 K    3,408 K    3352    Console Window Host    Microsoft Corporation    (Verified) Microsoft Windows
svchost.exe    < 0.01    41,644 K    20,196 K    2244    Host Process for Windows Services    Microsoft Corporation    (Verified) Microsoft Windows
SearchIndexer.exe    < 0.01    23,320 K    14,188 K    4748    Microsoft Windows Search Indexer    Microsoft Corporation    (Verified) Microsoft Windows
svchost.exe    < 0.01    14,736 K    15,784 K    1196    Host Process for Windows Services    Microsoft Corporation    (Verified) Microsoft Windows
csrss.exe    < 0.01    2,764 K    5,668 K    584    Client Server Runtime Process    Microsoft Corporation    (Verified) Microsoft Windows
IAStorIcon.exe    < 0.01    25,048 K    22,576 K    2904    IAStorIcon    Intel Corporation    (Verified) Intel Corporation
svchost.exe    < 0.01    150,864 K    157,684 K    604    Host Process for Windows Services    Microsoft Corporation    (Verified) Microsoft Windows
wmpnetwk.exe    < 0.01    4,160 K    3,836 K    2076    Windows Media Player Network Sharing Service    Microsoft Corporation    (Verified) Microsoft Windows
BTHSAmpPalService.exe    < 0.01    2,084 K    4,928 K    1868    Intel® Centrino® Bluetooth 3.0 + High Speed Virtual Adapter    Intel Corporation    (Verified) Intel Corporation - Mobile Wireless Group
mediasrv.exe    < 0.01    4,124 K    7,816 K    4932    Bluetooth Media Service    Intel Corporation    (Verified) Intel Corporation - Mobile Wireless Group
postgres.exe    < 0.01    4,548 K    8,000 K    3628    PostgreSQL Server    PostgreSQL Global Development Group    (No signature was present in the subject) PostgreSQL Global Development Group
WmiPrvSE.exe        7,668 K    13,044 K    4412    WMI Provider Host    Microsoft Corporation    (Verified) Microsoft Windows
WmiPrvSE.exe        5,344 K    11,260 K    4428    WMI Provider Host    Microsoft Corporation    (Verified) Microsoft Windows
WLIDSVCM.EXE        1,520 K    3,520 K    3572    Microsoft® Windows Live ID Service Monitor    Microsoft Corp.    (Verified) Microsoft Corporation
wlanext.exe        9,656 K    19,404 K    1328    Windows Wireless LAN 802.11 Extensibility Framework    Microsoft Corporation    (Verified) Microsoft Windows
winlogon.exe        3,296 K    7,672 K    784    Windows Logon Application    Microsoft Corporation    (Verified) Microsoft Windows
wininit.exe        1,668 K    4,580 K    696    Windows Start-Up Application    Microsoft Corporation    (Verified) Microsoft Windows
unsecapp.exe        2,240 K    6,020 K    4308    Sink to receive asynchronous callbacks for WMI client application    Microsoft Corporation    (Verified) Microsoft Windows
unsecapp.exe        1,844 K    5,120 K    4276    Sink to receive asynchronous callbacks for WMI client application    Microsoft Corporation    (Verified) Microsoft Windows
UNS.exe        3,192 K    7,344 K    1716    User Notification Service    Intel Corporation    (Verified) Intel Corporation
SynTPHelper.exe        1,572 K    3,608 K    2280    Synaptics Pointing Device Helper    Synaptics Incorporated    (Verified) Microsoft Windows Hardware Compatibility Publisher
svchost.exe        5,200 K    9,004 K    1008    Host Process for Windows Services    Microsoft Corporation    (Verified) Microsoft Windows
svchost.exe        18,656 K    22,368 K    404    Host Process for Windows Services    Microsoft Corporation    (Verified) Microsoft Windows
svchost.exe        5,236 K    9,204 K    3484    Host Process for Windows Services    Microsoft Corporation    (Verified) Microsoft Windows
svchost.exe        2,004 K    5,616 K    3992    Host Process for Windows Services    Microsoft Corporation    (Verified) Microsoft Windows
svchost.exe        2,536 K    5,936 K    1444    Host Process for Windows Services    Microsoft Corporation    (Verified) Microsoft Windows
svchost.exe        2,540 K    5,664 K    1096    Host Process for Windows Services    Microsoft Corporation    (Verified) Microsoft Windows
svchost.exe        1,836 K    4,828 K    2256    Host Process for Windows Services    Microsoft Corporation    (Verified) Microsoft Windows
STService.exe        3,316 K    10,680 K    3200    ST Service Scheduling        (Verified) Dell Inc
spoolsv.exe        7,240 K    12,240 K    1420    Spooler SubSystem App    Microsoft Corporation    (Verified) Microsoft Windows
smss.exe        544 K    1,188 K    392    Windows Session Manager    Microsoft Corporation    (Verified) Microsoft Windows
SkypeC2CPNRSvc.exe        1,912 K    5,004 K    2572    Phone Number Recognition (PNR) module    Microsoft Corporation    (Verified) Skype Software Sarl
SkypeC2CAutoUpdateSvc.exe        1,388 K    4,784 K    2364    Updates Skype Click to Call    Microsoft Corporation    (Verified) Skype Software Sarl
sftvsa.exe        1,492 K    4,812 K    3936    Microsoft Application Virtualization Virtual Service Agent    Microsoft Corporation    (Verified) Microsoft Corporation
SftService.exe        4,428 K    8,272 K    3860    SoftThinks Agent Service    SoftThinks SAS    (Verified) Dell Inc
sftlist.exe        6,516 K    14,480 K    4100    Microsoft Application Virtualization Client Service    Microsoft Corporation    (Verified) Microsoft Corporation
services.exe        6,748 K    10,308 K    752    Services and Controller app    Microsoft Corporation    (Verified) Microsoft Windows
rundll32.exe        3,172 K    9,788 K    2136    Windows host process (Rundll32)    Microsoft Corporation    (Verified) Microsoft Windows
RegSrvc.exe        2,264 K    5,900 K    3272    Intel® PROSet/Wireless Registry Service    Intel® Corporation    (Verified) Intel Corporation - Mobile Wireless Group
quickset.exe        7,948 K    10,048 K    2096    QuickSet    Dell Inc.    (Verified) Dell Inc
procexp.exe        2,444 K    7,408 K    1684    Sysinternals Process Explorer    Sysinternals - www.sysinternals.com    (Verified) Microsoft Corporation
postgres.exe        4,488 K    7,452 K    3636    PostgreSQL Server    PostgreSQL Global Development Group    (No signature was present in the subject) PostgreSQL Global Development Group
postgres.exe        5,112 K    10,408 K    3344    PostgreSQL Server    PostgreSQL Global Development Group    (No signature was present in the subject) PostgreSQL Global Development Group
pg_ctl.exe        3,012 K    7,052 K    3208    pg_ctl - starts/stops/restarts the PostgreSQL server    PostgreSQL Global Development Group    (No signature was present in the subject) PostgreSQL Global Development Group
obexsrv.exe        2,856 K    6,852 K    3468    Bluetooth OBEX Service    Intel Corporation    (Verified) Intel Corporation - Mobile Wireless Group
notepad.exe        1,928 K    6,688 K    5600    Notepad    Microsoft Corporation    (Verified) Microsoft Windows
lsm.exe        2,784 K    4,468 K    820    Local Session Manager Service    Microsoft Corporation    (Verified) Microsoft Windows
lsass.exe        5,032 K    12,660 K    812    Local Security Authority Process    Microsoft Corporation    (Verified) Microsoft Windows
igfxpers.exe        3,560 K    9,784 K    1592    persistence Module    Intel Corporation    (Verified) Microsoft Windows Hardware Compatibility Publisher
iFrmewrk.exe        10,220 K    21,200 K    2120    Intel® PROSet/Wireless Framework    Intel® Corporation    (Verified) Intel Corporation - Mobile Wireless Group
hkcmd.exe        2,732 K    6,760 K    1968    hkcmd Module    Intel Corporation    (Verified) Microsoft Windows Hardware Compatibility Publisher
GooglePinyinService.exe        1,584 K    3,536 K    2888            (Verified) Google Inc
GooglePinyinDaemon.exe        4,928 K    368 K    2400    Google Pinyin IME    Google Inc.    (Verified) Google Inc
EvtEng.exe        8,484 K    15,972 K    2660    Intel® PROSet/Wireless Event Log Service    Intel® Corporation    (Verified) Intel Corporation - Mobile Wireless Group
devmonsrv.exe        2,736 K    6,708 K    1628    Bluetooth Device Monitor    Intel Corporation    (Verified) Intel Corporation - Mobile Wireless Group
CxUtilSvc.exe        11,484 K    9,824 K    2792    CxUtilSvc    Conexant Systems, Inc.    (Verified) Conexant Systems
CxAudMsg64.exe        6,128 K    5,284 K    2684    Conexant Audio Message Service    Conexant Systems Inc.    (Verified) Conexant Systems
CVHSVC.EXE        6,908 K    14,224 K    4700    Microsoft Office Client Virtualization Service     Microsoft Corporation    (Verified) Microsoft Corporation
conhost.exe        1,080 K    2,860 K    1336    Console Window Host    Microsoft Corporation    (Verified) Microsoft Windows
btplayerctrl.exe        2,336 K    5,776 K    4368    Bluetooth Media Player Controller    Intel Corporation    (Verified) Intel Corporation - Mobile Wireless Group
BTHSSecurityMgr.exe        4,204 K    8,972 K    2288    Intel® BlueTooth® HS Security Manager Service    Intel® Corporation    (Verified) Intel Corporation - Mobile Wireless Group
audiodg.exe        21,444 K    22,040 K    5408    Windows Audio Device Graph Isolation     Microsoft Corporation    (Verified) Microsoft Windows
armsvc.exe        1,204 K    3,920 K    1616    Adobe Acrobat Update Service    Adobe Systems Incorporated    (Verified) Adobe Systems


 

[RKinner]

I think you can safely remove  C:\windows\System32\roboot64.exe.

 

How is it running now?  Are you still being hijacked?

[taipei_tony]

Everything seems to be fine. And I just deleted roboot64.exe.

 

So my previous logs are all clean?

[RKinner]

Looking pretty good.

 

Clear the Java Cache by following the instructions on

http://www.java.com/...lugin_cache.xml

 

You do not have the latest Java.

First go into Control Panel, Add/Remove Software (XP) or Programs and Features (Vista/Win 7) and remove any old versions (which may call themselves: Java Runtime, Runtime Environment, Runtime, JRE, Java Virtual Machine, Virtual Machine, Java VM, JVM, VM, J2RE, J2SE)

I see:

Java 7 Update 71 

JavaFX 2.1.1 

 

Java has been very vulnerable to infection so unless you absolutely need it you should not reinstall it.

 

If you feel you must have Java:

Get the latest Java at:

http://www.java.com/en/

 

Save it to your PC then close all browsers and install it.  Do not let it install the Ask toolbar or other foistware.  (Just uncheck the offer before you hit next)

Once installed, go into Control Panel, Java, Security and set the slider to the Highest then OK.

 

(If you also want the 64 bit version then use the 64 bit version of IE to get it.)

 

 

I think we can clean up now:

 

Copy the following:

 

 
:Commands
[CLEARALLRESTOREPOINTS]
[Reboot]
 

Right click on OTL and Run As Administrator.   In the Custom Scans/Fixes box at the bottom, paste in the copied text (Ctrl + v) and then hit Run Fix.

 

That will get the last of the malware off the system.

 

 

 

You can uninstall or delete any tools we had you download and their logs. 

 

 

 

OTL has a cleanup tab but DO NOT USE IT!.  There are reports that it leaves the PC unbootable.  Instead just delete  OTL.exe and the folder c:\_OTL.

 

To hide hidden files again:

 

Vista or Win7

 

# Open the Control Panel menu and click Folder Options.

# After the new window appears select the View tab.

# Remove the check in the  checkbox labeled Display the contents of system folders.

# Under the Hidden files and folders section select the radio button labeled Do not Show hidden files and folders.

# Check the checkbox labeled Hide protected operating system files.

# Press the Apply button and then the OK button and exit My Computer. 

 

Also make sure you have the latest versions of any adobe.com products you use like Shockwave, Flash or Acrobat.  

 

Whether you use adobe reader, acrobat or fox-it to read pdf files you need to disable Javascript in the program.  There is an exploit out there now that can use it to get on your PC.  For Adobe Reader:  Start, All Programs, Adobe Reader, Edit, Preferences, Click on Javascript in the left column and uncheck Enable Acrobat Javascript.  OK Close program.  It's the same for Foxit reader except you uncheck Enable Javascript Actions. 

 

Unless you have the latest version of Avast which has its own update checker:  To help keep your programs up-to-date you should download and run the UpdateChecker: 

http://www.filehippo.../updatechecker/

(You don't need to download Betas and if there is a program you don't use you can just uninstall it rather than update it.  Exception is MSN messenger which appears to be part of Windows.)

If you get a blocked program notice after installing updatechecker then change it to not run at start then manually run it once a week.

 Seems to work best if Firefox is the default browser.  Windows always hides its icon so you need to unhide it.  Click on the up arrow to the left of the clock.  Then click on Customize.  Maximize the window so you can see all of the options.  Scroll Down and find the File Hippo UpdateChecker and change its Behaviors to Show Icon and Notifications.  OK.  When you reboot you should see the icon.  It will take it a minute to finish checking then it will put up a bubble if you need to update something. Click on the bubble and it should open in your browser.  (Seems to work best if it uses Firefox.  If you do not use Firefox as your default browser then right click on the icon and click on Settings. Then on Results.  Change the Open Results in Default Browser to Custom Browser and then select the line that has Firefox.exe in it.  While there, also check Hide Beta Versions.  OK. )  You will see a list of programs that have updates with green down arrows next to them.  You do not need to download any Beta Versions.  There is an option Settings to Hide Beta Versions.  I do not advise updating Windows Messenger unless you really use it so I right click on the Icon and Customize Results then find Microsoft Messenger and change Show All Releases to Hide All Releases.  OK. 

 

You can also try Secunia PSI http://secunia.com/v...l/download_psi/  Same kind of info but requires Java.  You don't need both.

If you use Chrome/Firefox/IE then get the AdBlock Plus Add-on.  Go to adblockplus.org with each browser and get the add-on.

 

If Chrome/Firefox is slow loading make sure it only has the current Java add-on.  Then download and run Speedy Fox.

http://www.crystalidea.com/speedyfox .  Close Chrome/Firefox. Hit Optimize.   You can run it any time that Chrome/Firefox seems slow.

 

Be warned:  If you use Limewire, utorrent or any of the other P2P programs you will almost certain be coming back to the Malware Removal forum.  If you must use P2P then submit any files you get to http://virustotal.com before you open them.

 

Due to a recent rise in the number of Crytolocker infections I am now recommending you install:

 

CryptoPrevent

 

http://www.foolishIT.../cryptoprevent/

 

The free version does not update on its own so you should check for updated versions once in a while.

 

 

 

If you have a router, log on to it today and change the default password!  If using a Wireless router you really should be using encryption on the link.  Use the strongest (newest) encryption method that your router and PC wireless adapter support especially if you own a business.  See http://www.king5.com...-120637284.html and http://www.seattlepi...ted-1344185.php for why encryption is important.  If you don't know how, visit the router maker's website.  They all have detailed step by step instructions or a wizard you can download.

 

Special note on Java.  Old Java versions should be removed after first clearing the Java Cache by following the instructions in:

http://www.java.com/...lugin_cache.xml

Then remove the old versions by going to Control Panel, Programs and Features and Uninstall all Java programs which are not Java Version 7 update 25 or better.  These may call themselves: Java Runtime, Runtime Environment, Runtime, JRE, Java Virtual Machine, Virtual Machine, Java VM, JVM, VM, J2RE, J2SE.  Get the latest version from Java.com.  They will usually attempt to foist some garbage like the Ask toolbar, Yahoo toolbar or McAfee Security Scan on you as part of the download.  Just uncheck the garbage before the download (or install) starts.  If you use a 64-bit browser and want the 64-bit version of Java you need to use it to visit java.com.

Due to multiple security problems with Java we are now recommending that it not be installed unless you absolutely know you need it.  IF that is the case then go to Control Panel, Java, Security and slide it up to the highest level.  OK.

 

Make sure Windows Updates is turned and that it works.  Go to Control panel, Windows Updates and see if it works.  

 

 

My help is free but if you wish to show your appreciation, please donate to Kwiaht instead of me. It's a local environmental organization that I volunteer with: http://www.kwiaht.org/donate.htm

(The name means something like "clean place" in one of the local native-American dialects)

[taipei_tony]

Hi thanks for all the help. I have removed Java and will not reinstall it. I deleted OTL and all the other programs that were downloaded. I fixed the Adobe leak. I also downloaded Speedy Fox and CryptoPrevent.

 

And you're so right about Utorrent lol. I'll try to avoid using it but it's just so hard lol.

 

Thanks again for all the help, much appreciated!