[lordcheezus]

I thought I was able to get rid of the malware at one point, however, today, a random cmdprompt popped up a couple times then caused Chrome to restart and ads by salesale were on my pages. Even with Adblock. I went to Chrome extensions and removed the extension. I've ran both Malwarebytes and Windows Defender. Originally Malwarebytes came up with a few hits with pup.optional.booster.a among others. I've since quarantined those. The original occurrence was done out of my own stupidity when googling system performance ratings after Windows removed them from Windows 8 and 8.1. I downloaded what was supposed to be an application to be similar and became the system became filled with adware. I went on a mission to remove everything from the control panel and through chrome and IE. Apparently, I have missed something.  

 

 

OTL logfile created on: 2/17/2015 9:43:49 PM - Run 1

OTL by OldTimer - Version 3.2.69.0     Folder = D:\Downloads

64bit- Professional  (Version = 6.2.9200) - Type = NTWorkstation

Internet Explorer (Version = 9.11.9600.17631)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

 

15.95 Gb Total Physical Memory | 12.75 Gb Available Physical Memory | 79.93% Memory free

18.33 Gb Paging File | 14.74 Gb Available in Paging File | 80.45% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 111.45 Gb Total Space | 65.43 Gb Free Space | 58.71% Space Free | Partition Type: NTFS

Drive D: | 931.51 Gb Total Space | 839.44 Gb Free Space | 90.12% Space Free | Partition Type: NTFS

 

Computer Name: CHEEZUS | User Name: Anthony | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 

========== Processes (SafeList) ==========

 

PRC - File not found -- 

PRC - [2015/02/17 21:43:44 | 000,602,112 | ---- | M] (OldTimer Tools) -- D:\Downloads\OTL.exe

PRC - [2015/02/05 11:57:45 | 000,410,952 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

PRC - [2015/01/25 00:08:45 | 000,843,592 | ---- | M] (Google Inc.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

PRC - [2015/01/16 00:42:47 | 002,585,928 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe

PRC - [2015/01/16 00:42:37 | 001,706,312 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe

PRC - [2014/12/11 01:33:52 | 006,737,976 | ---- | M] (Spotify Ltd) -- C:\Users\Anthony\AppData\Roaming\Spotify\spotify.exe

PRC - [2014/12/11 01:33:48 | 001,676,344 | ---- | M] (Spotify Ltd) -- C:\Users\Anthony\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe

PRC - [2014/12/11 01:33:48 | 000,374,840 | ---- | M] () -- C:\Users\Anthony\AppData\Roaming\Spotify\Data\SpotifyHelper.exe

PRC - [2014/06/18 17:18:10 | 005,860,656 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel® Smart Connect Technology Agent\iSCTsysTray8.exe

 

 

========== Modules (No Company Name) ==========

 

MOD - [2015/02/03 12:22:16 | 014,964,912 | ---- | M] () -- C:\Users\Anthony\AppData\Local\Google\Chrome\User Data\PepperFlash\16.0.0.305\pepflashplayer.dll

MOD - [2015/01/25 00:08:41 | 009,170,760 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.93\pdf.dll

MOD - [2015/01/25 00:08:37 | 001,117,512 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.93\libglesv2.dll

MOD - [2015/01/25 00:08:35 | 000,211,272 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.93\libegl.dll

MOD - [2014/12/11 01:33:48 | 036,966,968 | ---- | M] () -- C:\Users\Anthony\AppData\Roaming\Spotify\Data\libcef.dll

MOD - [2014/12/11 01:33:48 | 000,886,840 | ---- | M] () -- C:\Users\Anthony\AppData\Roaming\Spotify\Data\libglesv2.dll

MOD - [2014/12/11 01:33:48 | 000,867,896 | ---- | M] () -- C:\Users\Anthony\AppData\Roaming\Spotify\Data\ffmpegsumo.dll

MOD - [2014/12/11 01:33:48 | 000,374,840 | ---- | M] () -- C:\Users\Anthony\AppData\Roaming\Spotify\Data\SpotifyHelper.exe

MOD - [2014/12/11 01:33:48 | 000,108,600 | ---- | M] () -- C:\Users\Anthony\AppData\Roaming\Spotify\Data\libegl.dll

MOD - [2014/09/23 05:43:09 | 008,897,696 | ---- | M] () -- C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX86\Microsoft Office\Office15\1033\grooveintlresource.dll

 

 

========== Services (SafeList) ==========

 

SRV:64bit: - [2015/01/16 00:42:37 | 001,148,744 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe -- (GfExperienceService)

SRV:64bit: - [2015/01/16 00:42:33 | 021,833,544 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe -- (NvStreamSvc)

SRV:64bit: - [2014/12/05 19:35:00 | 000,229,888 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\AudioEndpointBuilder.dll -- (AudioEndpointBuilder)

SRV:64bit: - [2014/11/12 00:06:52 | 002,449,592 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe -- (ClickToRunSvc)

SRV:64bit: - [2014/10/30 22:51:25 | 000,114,688 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\IEEtwCollector.exe -- (IEEtwCollectorService)

SRV:64bit: - [2014/09/21 21:05:56 | 000,368,632 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Program Files\Windows Defender\NisSrv.exe -- (WdNisSvc)

SRV:64bit: - [2014/09/21 21:05:56 | 000,023,792 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MsMpEng.exe -- (WinDefend)

SRV:64bit: - [2014/08/15 21:29:38 | 002,899,968 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\spool\drivers\x64\3\PrintConfig.dll -- (PrintNotify)

SRV:64bit: - [2014/08/15 18:58:35 | 000,287,744 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\SystemEventsBrokerServer.dll -- (SystemEventsBroker)

SRV:64bit: - [2014/08/15 18:45:51 | 000,267,776 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\bisrv.dll -- (BrokerInfrastructure)

SRV:64bit: - [2014/07/24 01:28:58 | 001,600,000 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\workfolderssvc.dll -- (workfolderssvc)

SRV:64bit: - [2014/06/18 17:18:36 | 000,209,712 | ---- | M] () [Auto | Running] -- C:\Program Files\Intel\Intel® Smart Connect Technology Agent\iSCTAgent.exe -- (ISCTAgent)

SRV:64bit: - [2014/03/14 00:26:25 | 000,491,520 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\GeofenceMonitorService.dll -- (lfsvc)

SRV:64bit: - [2014/03/07 23:41:25 | 001,306,624 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\AppXDeploymentServer.dll -- (AppXSvc)

SRV:64bit: - [2014/03/06 01:02:13 | 000,834,560 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\netlogon.dll -- (Netlogon)

SRV:64bit: - [2014/02/22 09:53:10 | 003,394,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\WSService.dll -- (WSService)

SRV:64bit: - [2014/02/22 03:57:16 | 000,710,656 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\lsm.dll -- (LSM)

SRV:64bit: - [2014/02/22 03:26:58 | 000,366,080 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\wcmsvc.dll -- (Wcmsvc)

SRV:64bit: - [2014/02/22 03:25:39 | 000,399,872 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\das.dll -- (DeviceAssociationService)

SRV:64bit: - [2014/02/22 03:23:58 | 001,576,960 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\wlidsvc.dll -- (wlidsvc)

SRV:64bit: - [2013/12/10 01:35:18 | 000,530,944 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\AppReadiness.dll -- (AppReadiness)

SRV:64bit: - [2013/08/22 13:12:17 | 000,183,296 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)

SRV:64bit: - [2013/08/22 13:12:17 | 000,090,464 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\SysNative\KeyboardFilterSvc.dll -- (MsKeyboardFilter)

SRV:64bit: - [2013/08/22 05:32:02 | 000,024,576 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\wephostsvc.dll -- (WEPHOSTSVC)

SRV:64bit: - [2013/08/22 05:31:43 | 000,040,448 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\efssvc.dll -- (EFS)

SRV:64bit: - [2013/08/22 05:22:45 | 000,066,048 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\wiarpc.dll -- (WiaRpc)

SRV:64bit: - [2013/08/22 05:21:15 | 000,013,312 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\svsvc.dll -- (svsvc)

SRV:64bit: - [2013/08/22 05:16:57 | 000,118,272 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\fhsvc.dll -- (fhsvc)

SRV:64bit: - [2013/08/22 05:03:41 | 000,052,736 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\rundll32.exe -- (f291fddf)

SRV:64bit: - [2013/08/22 05:03:41 | 000,052,736 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\rundll32.exe -- (db79edbd)

SRV:64bit: - [2013/08/22 04:25:28 | 000,164,352 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\NcaSvc.dll -- (NcaSvc)

SRV:64bit: - [2013/08/22 04:19:28 | 000,517,120 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\icsvc.dll -- (vmicvss)

SRV:64bit: - [2013/08/22 04:19:28 | 000,517,120 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\icsvc.dll -- (vmictimesync)

SRV:64bit: - [2013/08/22 04:19:28 | 000,517,120 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\icsvc.dll -- (vmicshutdown)

SRV:64bit: - [2013/08/22 04:19:28 | 000,517,120 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\icsvc.dll -- (vmicrdv)

SRV:64bit: - [2013/08/22 04:19:28 | 000,517,120 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\icsvc.dll -- (vmickvpexchange)

SRV:64bit: - [2013/08/22 04:19:28 | 000,517,120 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\icsvc.dll -- (vmicheartbeat)

SRV:64bit: - [2013/08/22 04:19:28 | 000,517,120 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\icsvc.dll -- (vmicguestinterface)

SRV:64bit: - [2013/08/22 04:02:47 | 000,013,312 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\smphost.dll -- (smphost)

SRV:64bit: - [2013/08/22 03:57:25 | 000,130,560 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\ScDeviceEnum.dll -- (ScDeviceEnum)

SRV:64bit: - [2013/08/22 03:54:59 | 000,059,392 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\keyiso.dll -- (KeyIso)

SRV:64bit: - [2013/08/22 03:50:59 | 000,245,760 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\TimeBrokerServer.dll -- (TimeBroker)

SRV:64bit: - [2013/08/22 03:50:00 | 000,525,312 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\netprofmsvc.dll -- (netprofm)

SRV:64bit: - [2013/08/22 03:45:59 | 000,151,040 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\ncbservice.dll -- (NcbService)

SRV:64bit: - [2013/08/22 03:40:49 | 000,248,832 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\vaultsvc.dll -- (VaultSvc)

SRV:64bit: - [2013/08/22 03:31:03 | 000,201,728 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\DeviceSetupManager.dll -- (DsmSvc)

SRV:64bit: - [2013/08/22 03:15:54 | 000,073,728 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\NcdAutoSetup.dll -- (NcdAutoSetup)

SRV - [2015/02/06 22:42:26 | 001,910,128 | ---- | M] (Electronic Arts) [On_Demand | Stopped] -- C:\Program Files (x86)\Origin\OriginClientService.exe -- (Origin Client Service)

SRV - [2015/02/05 11:57:45 | 000,410,952 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)

SRV - [2015/01/23 16:33:44 | 000,834,752 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)

SRV - [2015/01/16 00:42:37 | 001,706,312 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe -- (NvNetworkService)

SRV - [2014/08/15 21:29:38 | 002,899,968 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\system32\spool\drivers\x64\3\PrintConfig.dll -- (PrintNotify)

SRV - [2014/03/14 00:10:16 | 000,357,376 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysWOW64\GeofenceMonitorService.dll -- (lfsvc)

SRV - [2013/08/21 21:55:35 | 000,018,944 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysWOW64\StorSvc.dll -- (StorSvc)

SRV - [2013/08/21 20:53:34 | 000,011,776 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysWOW64\smphost.dll -- (smphost)

 

 

========== Driver Services (SafeList) ==========

 

DRV:64bit: - [2015/02/13 22:04:34 | 002,377,216 | ---- | M] (Ralink Technology Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AE6000w864.sys -- (AE6000)

DRV:64bit: - [2015/01/16 00:42:32 | 000,019,784 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys -- (NvStreamKms)

DRV:64bit: - [2014/12/11 18:51:20 | 000,075,776 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\ahcache.sys -- (ahcache)

DRV:64bit: - [2014/11/22 04:46:30 | 000,038,032 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvvad64v.sys -- (nvvad_WaveExtensible)

DRV:64bit: - [2014/10/12 20:43:17 | 000,238,912 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\sdbus.sys -- (sdbus)

DRV:64bit: - [2014/10/12 20:43:17 | 000,086,336 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\pdc.sys -- (pdc)

DRV:64bit: - [2014/10/12 20:43:17 | 000,039,744 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\intelpep.sys -- (intelpep)

DRV:64bit: - [2014/10/09 19:58:57 | 000,027,456 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)

DRV:64bit: - [2014/10/09 11:02:39 | 000,195,728 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA)

DRV:64bit: - [2014/09/30 17:47:28 | 000,129,312 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\TeeDriverx64.sys -- (MEIx64)

DRV:64bit: - [2014/09/21 21:06:16 | 000,258,368 | ---- | M] (Microsoft Corporation) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\WdFilter.sys -- (WdFilter)

DRV:64bit: - [2014/09/21 21:06:16 | 000,114,496 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\WdNisDrv.sys -- (WdNisDrv)

DRV:64bit: - [2014/09/21 20:49:43 | 000,035,320 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\WdBoot.sys -- (WdBoot)

DRV:64bit: - [2014/08/14 18:36:55 | 000,146,752 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\msgpioclx.sys -- (GPIOClx0101)

DRV:64bit: - [2014/07/24 09:28:38 | 000,468,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\USBHUB3.SYS -- (USBHUB3)

DRV:64bit: - [2014/07/24 09:28:38 | 000,412,992 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\spaceport.sys -- (spaceport)

DRV:64bit: - [2014/07/24 05:42:22 | 000,126,464 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\NdisImPlatform.sys -- (NdisImPlatform)

DRV:64bit: - [2014/05/28 17:32:06 | 000,034,016 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\xb1usb.sys -- (xb1usb)

DRV:64bit: - [2014/05/27 11:21:08 | 000,022,728 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\imsevent.sys -- (imsevent)

DRV:64bit: - [2014/05/27 11:21:06 | 000,025,800 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\INETMON.sys -- (INETMON)

DRV:64bit: - [2014/05/27 11:21:04 | 000,022,216 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ikbevent.sys -- (ikbevent)

DRV:64bit: - [2014/05/27 10:21:08 | 000,044,744 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ISCTD.sys -- (ISCT)

DRV:64bit: - [2014/05/01 07:31:39 | 000,055,328 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\wpcfltr.sys -- (wpcfltr)

DRV:64bit: - [2014/03/19 21:41:20 | 000,376,152 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\clfs.sys -- (CLFS)

DRV:64bit: - [2014/03/13 06:35:24 | 000,157,016 | ---- | M] (Microsoft Corporation) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\wof.sys -- (Wof)

DRV:64bit: - [2014/03/08 14:40:16 | 000,136,024 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\wfplwfs.sys -- (WFPLWFS)

DRV:64bit: - [2014/02/22 09:49:51 | 000,325,464 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\USBXHCI.SYS -- (USBXHCI)

DRV:64bit: - [2014/02/22 09:49:49 | 000,189,784 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\UCX01000.SYS -- (UCX01000)

DRV:64bit: - [2014/02/22 09:49:49 | 000,079,192 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\sdstor.sys -- (sdstor)

DRV:64bit: - [2014/02/22 09:44:13 | 000,924,504 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\refs.sys -- (ReFS)

DRV:64bit: - [2014/02/22 06:14:02 | 000,033,280 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\BasicRender.sys -- (BasicRender)

DRV:64bit: - [2013/10/25 19:54:32 | 000,146,776 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\SerCx2.sys -- (SerCx2)

DRV:64bit: - [2013/10/05 09:25:54 | 000,057,176 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\stornvme.sys -- (stornvme)

DRV:64bit: - [2013/09/14 08:06:57 | 000,175,960 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VerifierExt.sys -- (VerifierExt)

DRV:64bit: - [2013/08/22 13:12:19 | 000,022,272 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\kbldfltr.sys -- (kbldfltr)

DRV:64bit: - [2013/08/22 13:12:08 | 000,220,672 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Vid.sys -- (Vid)

DRV:64bit: - [2013/08/22 13:12:08 | 000,129,536 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\vmbusr.sys -- (vmbusr)

DRV:64bit: - [2013/08/22 13:12:08 | 000,068,608 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\storvsp.sys -- (storvsp)

DRV:64bit: - [2013/08/22 13:12:08 | 000,065,536 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\vpcivsp.sys -- (vpcivsp)

DRV:64bit: - [2013/08/22 13:12:08 | 000,037,216 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\terminpt.sys -- (terminpt)

DRV:64bit: - [2013/08/22 07:25:40 | 000,043,008 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\condrv.sys -- (condrv)

DRV:64bit: - [2013/08/22 07:25:40 | 000,030,048 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)

DRV:64bit: - [2013/08/22 06:50:19 | 000,057,696 | ---- | M] (Microsoft Corporation) [Kernel | System | Stopped] -- C:\Windows\SysNative\drivers\dam.sys -- (dam)

DRV:64bit: - [2013/08/22 06:49:54 | 000,079,712 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\acpiex.sys -- (acpiex)

DRV:64bit: - [2013/08/22 06:49:33 | 000,159,584 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\tpm.sys -- (TPM)

DRV:64bit: - [2013/08/22 06:43:49 | 000,063,840 | ---- | M] (Marvell Semiconductor, Inc.) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\mvumis.sys -- (mvumis)

DRV:64bit: - [2013/08/22 06:43:48 | 000,041,824 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\msgpiowin32.sys -- (msgpiowin32)

DRV:64bit: - [2013/08/22 06:43:45 | 003,357,024 | ---- | M] (Broadcom Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)

DRV:64bit: - [2013/08/22 06:43:45 | 000,093,536 | ---- | M] (LSI Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)

DRV:64bit: - [2013/08/22 06:43:45 | 000,082,784 | ---- | M] (LSI Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\lsi_sss.sys -- (LSI_SSS)

DRV:64bit: - [2013/08/22 06:43:45 | 000,064,352 | ---- | M] (Hewlett-Packard Company) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)

DRV:64bit: - [2013/08/22 06:43:44 | 000,081,760 | ---- | M] (LSI Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas3.sys -- (LSI_SAS3)

DRV:64bit: - [2013/08/22 06:43:41 | 000,782,176 | ---- | M] (PMC-Sierra) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\adp80xx.sys -- (ADP80XX)

DRV:64bit: - [2013/08/22 06:43:41 | 000,531,296 | ---- | M] (Broadcom Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)

DRV:64bit: - [2013/08/22 06:43:41 | 000,259,424 | ---- | M] (AMD Technologies Inc.) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)

DRV:64bit: - [2013/08/22 06:43:41 | 000,108,896 | ---- | M] (LSI) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\3ware.sys -- (3ware)

DRV:64bit: - [2013/08/22 06:43:41 | 000,079,200 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)

DRV:64bit: - [2013/08/22 06:43:40 | 000,114,016 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\EhStorTcgDrv.sys -- (EhStorTcgDrv)

DRV:64bit: - [2013/08/22 06:43:40 | 000,082,784 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\EhStorClass.sys -- (EhStorClass)

DRV:64bit: - [2013/08/22 06:43:40 | 000,025,952 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)

DRV:64bit: - [2013/08/22 06:43:34 | 000,305,504 | ---- | M] (VIA Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\VSTXRAID.SYS -- (VSTXRAID)

DRV:64bit: - [2013/08/22 06:43:33 | 000,074,080 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\uaspstor.sys -- (UASPStor)

DRV:64bit: - [2013/08/22 06:43:32 | 000,031,072 | ---- | M] (Promise Technology, Inc.) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)

DRV:64bit: - [2013/08/22 06:43:31 | 000,107,872 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\storahci.sys -- (storahci)

DRV:64bit: - [2013/08/22 06:43:31 | 000,072,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\SpbCx.sys -- (SpbCx)

DRV:64bit: - [2013/08/22 06:43:31 | 000,069,472 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\SerCx.sys -- (SerCx)

DRV:64bit: - [2013/08/22 06:39:15 | 000,026,976 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\uefi.sys -- (UEFI)

DRV:64bit: - [2013/08/22 06:37:27 | 000,069,472 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\vpci.sys -- (vpci)

DRV:64bit: - [2013/08/22 06:36:12 | 000,026,976 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WpdUpFltr.sys -- (WpdUpFltr)

DRV:64bit: - [2013/08/22 05:39:58 | 000,020,992 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WSDPrint.sys -- (WSDPrintDevice)

DRV:64bit: - [2013/08/22 05:39:31 | 000,050,688 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\BasicDisplay.sys -- (BasicDisplay)

DRV:64bit: - [2013/08/22 05:39:20 | 000,022,016 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HyperVideo.sys -- (HyperVideo)

DRV:64bit: - [2013/08/22 05:39:06 | 000,009,728 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\mshidumdf.sys -- (mshidumdf)

DRV:64bit: - [2013/08/22 05:38:58 | 000,010,752 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\acpitime.sys -- (acpitime)

DRV:64bit: - [2013/08/22 05:38:48 | 000,010,240 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\acpipagr.sys -- (acpipagr)

DRV:64bit: - [2013/08/22 05:38:39 | 000,036,992 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\BthAvrcpTg.sys -- (BthAvrcpTg)

DRV:64bit: - [2013/08/22 05:38:26 | 000,019,456 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\kdnic.sys -- (kdnic)

DRV:64bit: - [2013/08/22 05:38:23 | 000,011,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\vmgencounter.sys -- (gencounter)

DRV:64bit: - [2013/08/22 05:38:22 | 000,023,040 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\npsvctrig.sys -- (npsvctrig)

DRV:64bit: - [2013/08/22 05:38:16 | 000,030,720 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\BthhfHid.sys -- (bthhfhid)

DRV:64bit: - [2013/08/22 05:37:49 | 000,013,824 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hyperkbd.sys -- (hyperkbd)

DRV:64bit: - [2013/08/22 05:37:46 | 000,029,696 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD)

DRV:64bit: - [2013/08/22 05:37:42 | 000,057,856 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bthhfenum.sys -- (BthHFEnum)

DRV:64bit: - [2013/08/22 05:37:28 | 000,056,320 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)

DRV:64bit: - [2013/08/22 05:37:28 | 000,041,472 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hidi2c.sys -- (hidi2c)

DRV:64bit: - [2013/08/22 05:37:14 | 000,029,696 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\dmvsc.sys -- (dmvsc)

DRV:64bit: - [2013/08/22 05:36:43 | 000,087,040 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\netvsc63.sys -- (netvsc)

DRV:64bit: - [2013/08/22 05:36:25 | 000,016,384 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NdisVirtualBus.sys -- (NdisVirtualBus)

DRV:64bit: - [2013/08/22 05:36:07 | 000,066,560 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\mslldp.sys -- (MsLldp)

DRV:64bit: - [2013/08/22 05:35:42 | 000,103,424 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\Ndu.sys -- (Ndu)

DRV:64bit: - [2013/08/22 02:46:33 | 000,027,136 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\fxppm.sys -- (FxPPM)

DRV:64bit: - [2013/08/12 17:25:46 | 000,017,624 | ---- | M] (Windows ® Win 7 DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bcmfn2.sys -- (bcmfn2)

DRV:64bit: - [2013/08/09 18:39:30 | 000,651,248 | ---- | M] (Intel Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\iaStorAV.sys -- (iaStorAV)

DRV:64bit: - [2013/07/30 12:47:35 | 000,024,568 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\iaLPSSi_GPIO.sys -- (iaLPSSi_GPIO)

DRV:64bit: - [2013/07/25 13:05:39 | 000,099,320 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\iaLPSSi_I2C.sys -- (iaLPSSi_I2C)

DRV:64bit: - [2013/06/18 12:30:32 | 002,408,208 | ---- | M] (Ralink Technology Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\netr28ux.sys -- (netr28ux)

DRV:64bit: - [2013/06/18 08:46:17 | 000,591,360 | ---- | M] (Realtek                                            ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt630x64.sys -- (RTL8168)

DRV:64bit: - [2013/04/09 09:42:06 | 000,006,144 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\t_mouse.sys -- (t_mouse.sys)

DRV:64bit: - [2011/11/25 00:25:52 | 000,015,360 | ---- | M] (June Fabrics Technology Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\pneteth.sys -- (pneteth)

DRV - [2012/12/29 14:59:38 | 000,028,664 | ---- | M] (Almico Software) [Kernel | Auto | Running] -- C:\Windows\SysWOW64\speedfan.sys -- (speedfan)

 

 

========== Standard Registry (SafeList) ==========

 

 

========== Internet Explorer ==========

 

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...ms}&FORM=IE8SRC

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKLM\..\SearchScopes,DefaultScope = {006ee092-9658-4fd6-bd8e-a21a348e59f5}

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...ms}&FORM=IE8SRC

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = www.google.com

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = www.google.com

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = www.google.com

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/?ocid=iehp

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-US

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 45 40 9C 8E 5C E3 CF 01  [binary data]

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = www.google.com

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = www.google.com

IE - HKCU\..\SearchScopes,DefaultScope = {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

 

========== FireFox ==========

 

FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)

FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: D:\Picasa3\npPicasa3.dll (Google, Inc.)

FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=11.31.2: C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=11.31.2: C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll (Oracle Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/Lync,version=15.0: C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Microsoft Office\Office15\NPSPWRAP.DLL (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)

FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.1.5: D:\VLC\npvlc.dll (VideoLAN)

 

 

 

========== Chrome  ==========

 

CHR - default_search_provider:  ()

CHR - default_search_provider: search_url = 

CHR - default_search_provider: suggest_url = 

CHR - plugin: Error reading preferences file

CHR - Extension: No name found = C:\Users\Anthony\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\

CHR - Extension: No name found = C:\Users\Anthony\AppData\Local\Google\Chrome\User Data\Default\Extensions\ajjgiajaoafimgkdlcofflenackmpjhd\1.3.1_0\

CHR - Extension: No name found = C:\Users\Anthony\AppData\Local\Google\Chrome\User Data\Default\Extensions\algjnflpgoopkdijmkalfcifomdhmcbe\1.1.2_0\

CHR - Extension: No name found = C:\Users\Anthony\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\

CHR - Extension: No name found = C:\Users\Anthony\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\

CHR - Extension: No name found = C:\Users\Anthony\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn\0.1.1.5023_0\

CHR - Extension: No name found = C:\Users\Anthony\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_0\

CHR - Extension: No name found = C:\Users\Anthony\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\

CHR - Extension: No name found = C:\Users\Anthony\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\

CHR - Extension: No name found = C:\Users\Anthony\AppData\Local\Google\Chrome\User Data\Default\Extensions\geedigenhgnhbebebbjlidlalocdggjl\1.0_0\

CHR - Extension: No name found = C:\Users\Anthony\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.18_0\

CHR - Extension: No name found = C:\Users\Anthony\AppData\Local\Google\Chrome\User Data\Default\Extensions\gkojfkhlekighikafcpjkiklfbnlmeio\1.6.595_1\

CHR - Extension: No name found = C:\Users\Anthony\AppData\Local\Google\Chrome\User Data\Default\Extensions\haebnnbpedcbhciplfhjjkbafijpncjl\1.1.4_0\

CHR - Extension: No name found = C:\Users\Anthony\AppData\Local\Google\Chrome\User Data\Default\Extensions\kbmfpngjjgdllneeigpgjifpgocmfgmb\4.5.4_0\

CHR - Extension: No name found = C:\Users\Anthony\AppData\Local\Google\Chrome\User Data\Default\Extensions\mjpnnnikhngjjoapjdcdfepkenphaobi\1.1.1_0\

CHR - Extension: No name found = C:\Users\Anthony\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\

CHR - Extension: No name found = C:\Users\Anthony\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\

 

O1 HOSTS File: ([2013/08/22 07:25:41 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts

O2:64bit: - BHO: (Lync Browser Helper) - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\office15\ochelper.dll (Microsoft Corporation)

O2:64bit: - BHO: (Microsoft SkyDrive Pro Browser Helper) - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office 15\root\office15\grooveex.dll (Microsoft Corporation)

O2 - BHO: (Lync Browser Helper) - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX86\Microsoft Office\Office15\ochelper.dll (Microsoft Corporation)

O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll (Oracle Corporation)

O2 - BHO: (Microsoft SkyDrive Pro Browser Helper) - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX86\Microsoft Office\Office15\grooveex.dll (Microsoft Corporation)

O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll (Oracle Corporation)

O4:64bit: - HKLM..\Run: [ISCT Tray] C:\Program Files\Intel\Intel® Smart Connect Technology Agent\iSCTsysTray8.exe (Intel Corporation)

O4:64bit: - HKLM..\Run: [MouseDriver] C:\Windows\SysNative\TiltWheelMouse.exe (Pixart Imaging Inc)

O4:64bit: - HKLM..\Run: [NvBackend] C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe (NVIDIA Corporation)

O4:64bit: - HKLM..\Run: [ShadowPlay] C:\Windows\SysNative\nvspcap64.dll (NVIDIA Corporation)

O4 - HKCU..\Run: [GoogleChromeAutoLaunch_2AA0595218EF30A2508F1E549DA19CC6] C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.)

O4 - HKCU..\Run: [Spotify] C:\Users\Anthony\AppData\Roaming\Spotify\spotify.exe (Spotify Ltd)

O4 - HKCU..\Run: [Spotify Web Helper] C:\Users\Anthony\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe (Spotify Ltd)

O4 - Startup: C:\Users\Anthony\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PdaNet Desktop.lnk = C:\Program Files (x86)\PdaNet for Android\PdaNetPC.exe ()

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableCursorSuppression = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\SearchScopes present

O8:64bit: - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200 File not found

O8:64bit: - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office 15\Root\Office15\EXCEL.EXE (Microsoft Corporation)

O8:64bit: - Extra context menu item: Se&nd to OneNote - C:\Program Files\Microsoft Office 15\Root\Office15\ONBttnIE.dll (Microsoft Corporation)

O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\SysWow64\GPhotos.scr (Google Inc.)

O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office 15\Root\Office15\EXCEL.EXE (Microsoft Corporation)

O8 - Extra context menu item: Se&nd to OneNote - C:\Program Files\Microsoft Office 15\Root\Office15\ONBttnIE.dll (Microsoft Corporation)

O9:64bit: - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office 15\root\office15\onbttnie.dll (Microsoft Corporation)

O9:64bit: - Extra 'Tools' menuitem : Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office 15\root\office15\onbttnie.dll (Microsoft Corporation)

O9:64bit: - Extra Button: Lync Click to Call - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\office15\ochelper.dll (Microsoft Corporation)

O9:64bit: - Extra 'Tools' menuitem : Lync Click to Call - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\office15\ochelper.dll (Microsoft Corporation)

O9:64bit: - Extra Button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office 15\root\office15\onbttnielinkednotes.dll (Microsoft Corporation)

O9:64bit: - Extra 'Tools' menuitem : OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office 15\root\office15\onbttnielinkednotes.dll (Microsoft Corporation)

O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX86\Microsoft Office\Office15\onbttnie.dll (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX86\Microsoft Office\Office15\onbttnie.dll (Microsoft Corporation)

O9 - Extra Button: Lync Click to Call - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX86\Microsoft Office\Office15\ochelper.dll (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : Lync Click to Call - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX86\Microsoft Office\Office15\ochelper.dll (Microsoft Corporation)

O9 - Extra Button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX86\Microsoft Office\Office15\onbttnielinkednotes.dll (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX86\Microsoft Office\Office15\onbttnielinkednotes.dll (Microsoft Corporation)

O1364bit: - gopher Prefix: missing

O13 - gopher Prefix: missing

O15 - HKCU\..Trusted Domains: sharepoint.com ([kctcs] https in Trusted sites)

O15 - HKCU\..Trusted Domains: sharepoint.com ([kctcs-my] https in Trusted sites)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{0E3C38C5-8347-4CEE-BEC6-F28B7E2FA110}: DhcpNameServer = 192.168.1.1

O18:64bit: - Protocol\Handler\osf {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\office15\MSOSB.DLL (Microsoft Corporation)

O18 - Protocol\Handler\osf {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX86\Microsoft Office\Office15\MSOSB.DLL (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)

O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O32 - HKLM CDRom: AutoRun - 1

O34 - HKLM BootExecute: (autocheck autochk *)

O35:64bit: - HKLM\..comfile [open] -- "%1" %*

O35:64bit: - HKLM\..exefile [open] -- "%1" %*

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*

O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

 

========== Files/Folders - Created Within 30 Days ==========

 

[2015/02/17 21:22:54 | 000,000,000 | ---D | C] -- C:\ProgramData\OnlineLowDeals

[2015/02/17 21:22:37 | 000,000,000 | ---D | C] -- C:\ProgramData\cheap-o

[2015/02/17 21:02:37 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\TurboStrength

[2015/02/17 21:02:22 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\LighterSystem

[2015/02/13 23:33:34 | 000,621,384 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvStreaming.exe

[2015/02/13 23:32:47 | 032,106,640 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvoglv64.dll

[2015/02/13 23:32:47 | 025,460,880 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvcompiler.dll

[2015/02/13 23:32:47 | 024,768,144 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvoglv32.dll

[2015/02/13 23:32:47 | 020,466,496 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvcompiler.dll

[2015/02/13 23:32:47 | 017,253,848 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvd3dumx.dll

[2015/02/13 23:32:47 | 013,294,528 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvopencl.dll

[2015/02/13 23:32:47 | 013,208,200 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvcuda.dll

[2015/02/13 23:32:47 | 010,773,704 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvopencl.dll

[2015/02/13 23:32:47 | 010,713,256 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvcuda.dll

[2015/02/13 23:32:47 | 003,610,768 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvcuvid.dll

[2015/02/13 23:32:47 | 003,247,248 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvcuvid.dll

[2015/02/13 23:32:47 | 001,895,240 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvdispco6434752.dll

[2015/02/13 23:32:47 | 001,557,648 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvdispgenco6434752.dll

[2015/02/13 23:32:47 | 000,995,248 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvumdshimx.dll

[2015/02/13 23:32:47 | 000,969,872 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\NvIFR64.dll

[2015/02/13 23:32:47 | 000,943,760 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\NvFBC64.dll

[2015/02/13 23:32:47 | 000,929,936 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\NvIFR.dll

[2015/02/13 23:32:47 | 000,908,104 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\NvFBC.dll

[2015/02/13 23:32:47 | 000,877,816 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvumdshim.dll

[2015/02/13 23:32:47 | 000,496,272 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvEncodeAPI64.dll

[2015/02/13 23:32:47 | 000,399,504 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvEncodeAPI.dll

[2015/02/13 23:32:47 | 000,390,472 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\NvIFROpenGL.dll

[2015/02/13 23:32:47 | 000,353,224 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvoglshim64.dll

[2015/02/13 23:32:47 | 000,345,744 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\NvIFROpenGL.dll

[2015/02/13 23:32:47 | 000,305,136 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvoglshim32.dll

[2015/02/13 23:32:47 | 000,177,624 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvinitx.dll

[2015/02/13 23:32:47 | 000,164,752 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvinit.dll

[2015/02/11 18:21:44 | 006,041,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll

[2015/02/10 20:09:29 | 007,472,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntoskrnl.exe

[2015/02/10 20:09:29 | 001,733,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntdll.dll

[2015/02/10 20:09:29 | 000,285,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64.dll

[2015/02/10 20:09:28 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\setup16.exe

[2015/02/10 20:09:28 | 000,016,896 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntvdm64.dll

[2015/02/10 20:09:28 | 000,014,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntvdm64.dll

[2015/02/10 20:09:28 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64cpu.dll

[2015/02/10 20:09:28 | 000,008,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\instnm.exe

[2015/02/10 20:09:28 | 000,005,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wow32.dll

[2015/02/10 20:09:28 | 000,004,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\user.exe

[2015/02/10 18:55:18 | 001,441,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\lsasrv.dll

[2015/02/10 18:55:18 | 000,736,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\adtschema.dll

[2015/02/10 18:55:18 | 000,736,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\adtschema.dll

[2015/02/10 18:55:18 | 000,445,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\certcli.dll

[2015/02/10 18:55:18 | 000,324,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\certcli.dll

[2015/02/10 18:55:18 | 000,154,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msaudite.dll

[2015/02/10 18:55:18 | 000,154,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msaudite.dll

[2015/02/10 18:55:17 | 001,762,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WindowsCodecs.dll

[2015/02/10 18:55:17 | 000,538,624 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\scesrv.dll

[2015/02/10 18:55:17 | 000,393,728 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\scesrv.dll

[2015/02/10 18:40:08 | 000,788,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\oleaut32.dll

[2015/02/10 18:34:45 | 002,865,152 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\actxprxy.dll

[2015/02/10 18:34:45 | 002,125,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl

[2015/02/10 18:34:45 | 002,052,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl

[2015/02/10 18:34:45 | 000,816,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll

[2015/02/10 18:34:45 | 000,801,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll

[2015/02/10 18:34:45 | 000,800,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieapfltr.dll

[2015/02/10 18:34:45 | 000,718,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ie4uinit.exe

[2015/02/10 18:34:45 | 000,710,144 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieapfltr.dll

[2015/02/10 18:34:45 | 000,664,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll

[2015/02/10 18:34:45 | 000,584,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\vbscript.dll

[2015/02/10 18:34:45 | 000,490,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dxtmsft.dll

[2015/02/10 18:34:45 | 000,128,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iepeers.dll

[2015/02/10 18:34:45 | 000,092,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll

[2015/02/10 18:34:45 | 000,088,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\MshtmlDac.dll

[2015/02/10 18:34:45 | 000,064,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MshtmlDac.dll

[2015/02/10 18:30:04 | 001,487,976 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\sppobjs.dll

[2015/02/10 18:29:58 | 001,098,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\aeinv.dll

[2015/02/10 18:29:58 | 000,894,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\appraiser.dll

[2015/02/10 18:29:58 | 000,761,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\invagent.dll

[2015/02/10 18:29:58 | 000,609,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\generaltel.dll

[2015/02/10 18:29:58 | 000,414,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\devinv.dll

[2015/02/10 18:29:58 | 000,227,328 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\aepdu.dll

[2015/01/29 16:21:21 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java

[2015/01/28 23:08:36 | 000,129,752 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\MBAMSwissArmy.sys

[2015/01/28 23:08:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

[2015/01/28 23:08:28 | 000,093,400 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbamchameleon.sys

[2015/01/28 23:08:28 | 000,064,216 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mwac.sys

[2015/01/28 23:08:28 | 000,025,816 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys

[2015/01/28 23:08:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2015/01/28 22:54:12 | 000,000,000 | ---D | C] -- C:\ProgramData\62e80b73000079b4

[2015/01/28 22:52:41 | 000,000,000 | ---D | C] -- C:\ProgramData\79f6df4a00001f62

[2015/01/28 22:50:42 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\predm

[2015/01/28 22:48:10 | 000,000,000 | ---D | C] -- C:\Users\Anthony\AppData\Local\globalUpdate

[2015/01/28 22:48:10 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\globalUpdate

[2015/01/28 22:44:37 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\appmgmt

[2015/01/24 17:48:10 | 001,540,240 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvhdagenco6420103.dll

[2015/01/24 17:48:09 | 001,895,240 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvdispco6434725.dll

[2015/01/24 17:48:09 | 001,556,808 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvdispgenco6434725.dll

[2015/01/21 22:21:25 | 002,902,784 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvapi.dll

[2015/01/21 22:21:25 | 001,895,056 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvdispco6434709.dll

[2015/01/21 22:21:25 | 001,556,624 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvdispgenco6434709.dll

[2015/01/21 22:21:25 | 001,540,240 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvhdagenco64.dll

[2015/01/21 22:21:25 | 000,195,728 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\drivers\nvhda64v.sys

[2015/01/21 22:21:25 | 000,030,536 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvhdap64.dll

[2015/01/19 15:54:36 | 000,000,000 | ---D | C] -- C:\Users\Anthony\Desktop\Niki's [bleep]

[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

 

========== Files - Modified Within 30 Days ==========

 

[2015/02/17 21:36:29 | 000,000,020 | ---- | M] () -- C:\Users\Anthony\AppData\Roaming\appdataFr3.bin

[2015/02/17 21:07:26 | 000,129,752 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\MBAMSwissArmy.sys

[2015/02/17 20:00:00 | 000,001,710 | ---- | M] () -- C:\Windows\tasks\KTMJRRLI.job

[2015/02/17 18:18:25 | 000,863,592 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI

[2015/02/17 18:18:25 | 000,730,408 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat

[2015/02/17 18:18:25 | 000,135,520 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat

[2015/02/17 18:14:24 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2015/02/17 18:09:16 | 016,777,216 | -HS- | M] () -- C:\swapfile.sys

[2015/02/17 18:09:12 | 818,204,669 | -HS- | M] () -- C:\hiberfil.sys

[2015/02/13 23:33:56 | 000,002,149 | ---- | M] () -- C:\Users\Public\Desktop\3D Vision Photo Viewer.lnk

[2015/02/13 22:04:34 | 002,377,216 | ---- | M] (Ralink Technology Corp.) -- C:\Windows\SysNative\drivers\AE6000w864.sys

[2015/02/13 22:04:34 | 000,334,000 | ---- | M] (Ralink Technology, Inc.) -- C:\Windows\SysNative\RaCoInstx.dll

[2015/02/13 22:04:34 | 000,014,172 | ---- | M] () -- C:\Windows\SysNative\RaCoInst.dat

[2015/02/11 18:09:41 | 000,481,880 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT

[2015/02/05 21:36:05 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_Kernel_TeeDriverx64_01011.Wdf

[2015/02/05 15:01:44 | 032,106,640 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvoglv64.dll

[2015/02/05 15:01:44 | 025,460,880 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvcompiler.dll

[2015/02/05 15:01:44 | 024,768,144 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvoglv32.dll

[2015/02/05 15:01:44 | 020,466,496 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvcompiler.dll

[2015/02/05 15:01:44 | 018,575,880 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvwgf2umx.dll

[2015/02/05 15:01:44 | 017,253,848 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvd3dumx.dll

[2015/02/05 15:01:44 | 016,017,040 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvwgf2um.dll

[2015/02/05 15:01:44 | 014,119,744 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvd3dum.dll

[2015/02/05 15:01:44 | 013,294,528 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvopencl.dll

[2015/02/05 15:01:44 | 013,208,200 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvcuda.dll

[2015/02/05 15:01:44 | 010,773,704 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvopencl.dll

[2015/02/05 15:01:44 | 010,713,256 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvcuda.dll

[2015/02/05 15:01:44 | 003,610,768 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvcuvid.dll

[2015/02/05 15:01:44 | 003,299,512 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvapi64.dll

[2015/02/05 15:01:44 | 003,247,248 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvcuvid.dll

[2015/02/05 15:01:44 | 002,902,784 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvapi.dll

[2015/02/05 15:01:44 | 001,895,240 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvdispco6434752.dll

[2015/02/05 15:01:44 | 001,557,648 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvdispgenco6434752.dll

[2015/02/05 15:01:44 | 000,995,248 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvumdshimx.dll

[2015/02/05 15:01:44 | 000,969,872 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\NvIFR64.dll

[2015/02/05 15:01:44 | 000,943,760 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\NvFBC64.dll

[2015/02/05 15:01:44 | 000,929,936 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysWow64\NvIFR.dll

[2015/02/05 15:01:44 | 000,908,104 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysWow64\NvFBC.dll

[2015/02/05 15:01:44 | 000,877,816 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvumdshim.dll

[2015/02/05 15:01:44 | 000,833,680 | ---- | M] () -- C:\Windows\SysNative\nvmcumd.dll

[2015/02/05 15:01:44 | 000,496,272 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvEncodeAPI64.dll

[2015/02/05 15:01:44 | 000,399,504 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvEncodeAPI.dll

[2015/02/05 15:01:44 | 000,390,472 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\NvIFROpenGL.dll

[2015/02/05 15:01:44 | 000,353,224 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvoglshim64.dll

[2015/02/05 15:01:44 | 000,345,744 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysWow64\NvIFROpenGL.dll

[2015/02/05 15:01:44 | 000,305,136 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvoglshim32.dll

[2015/02/05 15:01:44 | 000,177,624 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvinitx.dll

[2015/02/05 15:01:44 | 000,164,752 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvinit.dll

[2015/02/05 15:01:44 | 000,074,056 | ---- | M] (Khronos Group) -- C:\Windows\SysNative\OpenCL.dll

[2015/02/05 15:01:44 | 000,060,560 | ---- | M] (Khronos Group) -- C:\Windows\SysWow64\OpenCL.dll

[2015/02/05 15:01:44 | 000,027,441 | ---- | M] () -- C:\Windows\SysNative\nvinfo.pb

[2015/02/05 13:07:04 | 006,861,128 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvcpl.dll

[2015/02/05 13:07:03 | 003,517,584 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvsvc64.dll

[2015/02/05 13:07:00 | 002,558,792 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvsvcr.dll

[2015/02/05 13:07:00 | 000,062,792 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvshext.dll

[2015/02/05 13:06:59 | 000,385,168 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvmctray.dll

[2015/02/05 11:57:47 | 000,621,384 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvStreaming.exe

[2015/02/05 06:50:11 | 004,236,870 | ---- | M] () -- C:\Windows\SysNative\nvcoproc.bin

[2015/02/03 17:38:41 | 000,227,328 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\aepdu.dll

[2015/02/03 17:08:38 | 000,761,856 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\invagent.dll

[2015/02/03 17:08:37 | 000,414,208 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\devinv.dll

[2015/02/03 13:31:19 | 000,714,720 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe

[2015/02/03 13:31:19 | 000,106,976 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl

[2015/02/02 17:11:29 | 000,609,280 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\generaltel.dll

[2015/02/02 17:11:24 | 001,098,752 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\aeinv.dll

[2015/02/02 17:11:24 | 000,894,464 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\appraiser.dll

[2015/01/29 16:21:12 | 000,098,216 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\WindowsAccessBridge-32.dll

[2015/01/29 16:21:11 | 000,272,296 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\javaws.exe

[2015/01/29 16:21:11 | 000,176,552 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\javaw.exe

[2015/01/29 16:21:11 | 000,176,552 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\java.exe

[2015/01/28 22:44:43 | 000,001,751 | ---- | M] () -- C:\ProgramData\tempimage.bmp

[2015/01/28 18:16:33 | 000,002,203 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk

[2015/01/25 10:12:14 | 000,001,248 | ---- | M] () -- C:\Users\Anthony\AppData\Roaming\KTMJRRLI

[2015/01/22 22:41:36 | 006,041,600 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll

[2015/01/19 12:42:59 | 001,487,976 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\sppobjs.dll

[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

 

========== Files Created - No Company Name ==========

 

[2015/02/17 21:22:37 | 000,000,020 | ---- | C] () -- C:\Users\Anthony\AppData\Roaming\appdataFr3.bin

[2015/02/13 23:33:56 | 000,002,149 | ---- | C] () -- C:\Users\Public\Desktop\3D Vision Photo Viewer.lnk

[2015/02/13 23:32:47 | 000,833,680 | ---- | C] () -- C:\Windows\SysNative\nvmcumd.dll

[2015/02/10 18:40:04 | 000,391,526 | ---- | C] () -- C:\Windows\SysNative\ApnDatabase.xml

[2015/02/05 21:36:05 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_Kernel_TeeDriverx64_01011.Wdf

[2015/01/28 22:48:11 | 000,001,710 | ---- | C] () -- C:\Windows\tasks\KTMJRRLI.job

[2015/01/28 22:44:43 | 000,001,751 | ---- | C] () -- C:\ProgramData\tempimage.bmp

[2015/01/25 10:12:14 | 000,001,248 | ---- | C] () -- C:\Users\Anthony\AppData\Roaming\KTMJRRLI

[2014/10/12 22:45:26 | 000,002,255 | ---- | C] () -- C:\Windows\SysWow64\WimBootCompress.ini

[2014/10/09 18:33:12 | 000,103,936 | ---- | C] () -- C:\Windows\SysWow64\OEMLicense.dll

[2013/08/22 09:36:25 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat

[2013/08/22 09:36:24 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT

[2013/08/22 08:45:38 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat

[2013/08/22 01:01:23 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin

[2013/08/21 21:32:36 | 000,046,080 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll

[2013/08/21 17:55:20 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll

[2013/08/21 17:52:39 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat

 

========== ZeroAccess Check ==========

 

[2014/12/27 01:03:07 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

 

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

 

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

"" = C:\Windows\SysNative\shell32.dll -- [2014/08/30 18:15:33 | 021,197,152 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Apartment

 

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

"" = %SystemRoot%\system32\shell32.dll -- [2014/08/30 16:59:13 | 018,723,112 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Apartment

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64

"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2013/08/22 03:49:49 | 000,921,088 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Free

 

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]

"" = %systemroot%\system32\wbem\fastprox.dll -- [2013/08/21 20:45:10 | 000,691,712 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Free

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64

"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2013/08/22 03:45:17 | 000,483,840 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Both

 

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

 

========== Alternate Data Streams ==========

 

@Alternate Data Stream - 237 bytes -> C:\Users\Anthony\SkyDrive:ms-properties

 

< End of report >

 

[Advertisements]

Hi. My name is Brian, and I would be happy to look into your issue.
 

- General Instructions -

• Please read all instructions and fixes thoroughly. Read the ENTIRE post BEFORE performing any steps so you understand all that needs to be done.
• I would advise printing any instructions for easy reference as some of the fixes may require you to boot in Safe mode. Access to these instructions may not be available in Safe Mode.
• Any fixes provided by myself are for this log file only and should not be used on any other systems.
• Do not run any other removal software or perform updates other than the ones I provide, as it will complicate the cleaning process.
• It's very likely that part of our cleanup will include emptying your recycle bin. If you use your recycle bin as an archive and do not wish this to be emptied, please let me know.
• You have 4 days to reply to each post or the topic will be closed. You will be able to request that the topic be re-opened by sending me a PM (Personal Message) or PM a moderator.
• Please feel free to ask any questions, especially if you are having problems with my instructions.

- Save ALL Tools to your Desktop-

 

All tools that I have you download should be placed on the desktop unless otherwise stated. If you are familiar with how to save files to the desktop then you can skip this step.
 
Since you are continuing with this step then I assume you are unfamiliar with saving files to your desktop. As a result it's easiest if you configure your browser(s) to download any tools to the desktop by default. Please use the appropriate instructions below depending on the browser you are using.
Google Chrome - Click the "Customize and control Google Chrome" button in the upper right-corner of the browser. Choose Settings. at the bottom of the screen click the
"Show advanced settings..." link. Scroll down to find the Downloads section and click the Change... button. Select your desktop and click OK.
Mozilla Firefox - Click the "Open Menu" button in the upper right-corner of the browser. Choose Options. In the downloads section, click the Browse button, click on the Desktop folder
and the click the "Select Folder" button. Click OK to get out of the Options menu.
Internet Explorer - Click the Tools menu in the upper right-corner of the browser. Select View downloads. Select the Options link in the lower left of the window. Click Browse and
select the Desktop and then choose the Select Folder button. Click OK to get out of the download options screen and then click Close to get out of the View Downloads screen.
NOTE: IE8 Does not support changing download locations in this manner. You will need to download the tool(s) to the default folder, usually Downloads, then copy them to the desktop.
 

- Finally Before We Start-

 
Removing malware is a complicated multiple step process, Please stay with me until I have declared your system clean. I strongly recommend you backup your personal files and folders. Although rare, attempting to remove malware can render your machine unbootable or cause data loss. Having backups of your data is your responsibility. Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.

 

 

 

I believe I see your issue. Since you are using Windows 8 I'd like to use a different tool.

 

Step#1 - FRST Scan
 
1. Please download Farbar Recovery Scan Tool and save it to your Desktop.
    Note: You need to run the 64-bit Version so please ensure you download that one.
2. Right click to run as administrator. When the tool opens click Yes to disclaimer.
3. Please ensure you place a check mark in the Addition.txt check box at the bottom of the form before running (if not already).
4. Press Scan button.
5. It will produce a log called FRST.txt in the same directory the tool is run from (which should now be the desktop)
6. Please copy and paste log back here.
7. Another log (Addition.txt - also located in the same directory as FRST64.exe) will be generated Please also paste that along with the FRST.txt into your reply.

 

Step#2 - AdWCleaner
1. Please download AdwCleaner by Xplode onto your desktop.
2. Close all open programs and internet browsers.
3. Right-click on AdwCleaner.exe and select Run as administrator to run the tool.
4. Click on Scan.
5. After the scan is complete click on "Clean"
6. Confirm each time with Ok.
7. Your computer will be rebooted automatically. A text file will open after the restart.
8. Please post the content of that logfile with your next answer.
9. If need be, you can also find the logfile at C:\AdwCleaner\AdwCleaner[S0].txt as well.

 

 

 

Items for your next post

1. FRST & Addition logs

2. Adwcleaner logs

 

 

[BrianDrab]

Hi. My name is Brian, and I would be happy to look into your issue.
 

- General Instructions -

• Please read all instructions and fixes thoroughly. Read the ENTIRE post BEFORE performing any steps so you understand all that needs to be done.
• I would advise printing any instructions for easy reference as some of the fixes may require you to boot in Safe mode. Access to these instructions may not be available in Safe Mode.
• Any fixes provided by myself are for this log file only and should not be used on any other systems.
• Do not run any other removal software or perform updates other than the ones I provide, as it will complicate the cleaning process.
• It's very likely that part of our cleanup will include emptying your recycle bin. If you use your recycle bin as an archive and do not wish this to be emptied, please let me know.
• You have 4 days to reply to each post or the topic will be closed. You will be able to request that the topic be re-opened by sending me a PM (Personal Message) or PM a moderator.
• Please feel free to ask any questions, especially if you are having problems with my instructions.

- Save ALL Tools to your Desktop-

 

All tools that I have you download should be placed on the desktop unless otherwise stated. If you are familiar with how to save files to the desktop then you can skip this step.
 
Since you are continuing with this step then I assume you are unfamiliar with saving files to your desktop. As a result it's easiest if you configure your browser(s) to download any tools to the desktop by default. Please use the appropriate instructions below depending on the browser you are using.
Google Chrome - Click the "Customize and control Google Chrome" button in the upper right-corner of the browser. Choose Settings. at the bottom of the screen click the
"Show advanced settings..." link. Scroll down to find the Downloads section and click the Change... button. Select your desktop and click OK.
Mozilla Firefox - Click the "Open Menu" button in the upper right-corner of the browser. Choose Options. In the downloads section, click the Browse button, click on the Desktop folder
and the click the "Select Folder" button. Click OK to get out of the Options menu.
Internet Explorer - Click the Tools menu in the upper right-corner of the browser. Select View downloads. Select the Options link in the lower left of the window. Click Browse and
select the Desktop and then choose the Select Folder button. Click OK to get out of the download options screen and then click Close to get out of the View Downloads screen.
NOTE: IE8 Does not support changing download locations in this manner. You will need to download the tool(s) to the default folder, usually Downloads, then copy them to the desktop.
 

- Finally Before We Start-

 
Removing malware is a complicated multiple step process, Please stay with me until I have declared your system clean. I strongly recommend you backup your personal files and folders. Although rare, attempting to remove malware can render your machine unbootable or cause data loss. Having backups of your data is your responsibility. Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.

 

 

 

I believe I see your issue. Since you are using Windows 8 I'd like to use a different tool.

 

Step#1 - FRST Scan
 
1. Please download Farbar Recovery Scan Tool and save it to your Desktop.
    Note: You need to run the 64-bit Version so please ensure you download that one.
2. Right click to run as administrator. When the tool opens click Yes to disclaimer.
3. Please ensure you place a check mark in the Addition.txt check box at the bottom of the form before running (if not already).
4. Press Scan button.
5. It will produce a log called FRST.txt in the same directory the tool is run from (which should now be the desktop)
6. Please copy and paste log back here.
7. Another log (Addition.txt - also located in the same directory as FRST64.exe) will be generated Please also paste that along with the FRST.txt into your reply.

 

Step#2 - AdWCleaner
1. Please download AdwCleaner by Xplode onto your desktop.
2. Close all open programs and internet browsers.
3. Right-click on AdwCleaner.exe and select Run as administrator to run the tool.
4. Click on Scan.
5. After the scan is complete click on "Clean"
6. Confirm each time with Ok.
7. Your computer will be rebooted automatically. A text file will open after the restart.
8. Please post the content of that logfile with your next answer.
9. If need be, you can also find the logfile at C:\AdwCleaner\AdwCleaner[S0].txt as well.

 

 

 

Items for your next post

1. FRST & Addition logs

2. Adwcleaner logs

 

 

[lordcheezus]

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 18-02-2015 01

Ran by Anthony (administrator) on CHEEZUS on 20-02-2015 20:30:42

Running from C:\Users\Anthony\Desktop

Loaded Profiles: Anthony (Available profiles: Anthony)

Platform: Windows 8.1 Pro N (X64) OS Language: English (United States)

Internet Explorer Version 11 (Default browser: Chrome)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/

 

==================== Processes (Whitelisted) =================

 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

 

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe

(Microsoft Corporation) C:\Windows\System32\dasHost.exe

() C:\Program Files\Intel\Intel® Smart Connect Technology Agent\iSCTAgent.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

(Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

(Microsoft Corporation) C:\Windows\System32\rundll32.exe

(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe

(Microsoft Corporation) C:\Windows\System32\rundll32.exe

(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe

(Pixart Imaging Inc) C:\Windows\System32\TiltWheelMouse.exe

(Intel Corporation) C:\Program Files\Intel\Intel® Smart Connect Technology Agent\iSCTsysTray8.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Spotify Ltd) C:\Users\Anthony\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe

(Spotify Ltd) C:\Users\Anthony\AppData\Roaming\Spotify\spotify.exe

() C:\Users\Anthony\AppData\Roaming\Spotify\Data\SpotifyHelper.exe

() C:\Users\Anthony\AppData\Roaming\Spotify\Data\SpotifyHelper.exe

() C:\Users\Anthony\AppData\Roaming\Spotify\Data\SpotifyHelper.exe

() C:\Users\Anthony\AppData\Roaming\Spotify\Data\SpotifyHelper.exe

(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

() C:\Users\Anthony\AppData\Roaming\Spotify\Data\SpotifyHelper.exe

() C:\Users\Anthony\AppData\Roaming\Spotify\Data\SpotifyHelper.exe

(Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

(Farbar) C:\Users\Anthony\Desktop\FRST64 (1).exe

 

 

==================== Registry (Whitelisted) ==================

 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

 

HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2585928 2015-01-16] (NVIDIA Corporation)

HKLM\...\Run: [MouseDriver] => C:\Windows\system32\TiltWheelMouse.exe [241152 2013-04-09] (Pixart Imaging Inc)

HKLM\...\Run: [ISCT Tray] => C:\Program Files\Intel\Intel® Smart Connect Technology Agent\iSCTsysTray8.exe [5860656 2014-06-18] (Intel Corporation)

HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart

HKU\S-1-5-21-1912583399-466474933-4168976199-1001\...\Run: [GoogleChromeAutoLaunch_2AA0595218EF30A2508F1E549DA19CC6] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [843592 2015-01-25] (Google Inc.)

HKU\S-1-5-21-1912583399-466474933-4168976199-1001\...\Run: [Spotify Web Helper] => C:\Users\Anthony\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1676344 2014-12-11] (Spotify Ltd)

HKU\S-1-5-21-1912583399-466474933-4168976199-1001\...\Run: [Spotify] => C:\Users\Anthony\AppData\Roaming\Spotify\spotify.exe [6737976 2014-12-11] (Spotify Ltd)

Startup: C:\Users\Anthony\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PdaNet Desktop.lnk

ShortcutTarget: PdaNet Desktop.lnk -> C:\Program Files (x86)\PdaNet for Android\PdaNetPC.exe ()

ShellIconOverlayIdentifiers: [ SkyDrivePro1 (ErrorConflict)] -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers: [ SkyDrivePro2 (SyncInProgress)] -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers: [ SkyDrivePro3 (InSync)] -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation)

CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

 

==================== Internet (Whitelisted) ====================

 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

 

HKU\S-1-5-21-1912583399-466474933-4168976199-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION

HKU\S-1-5-21-1912583399-466474933-4168976199-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/?ocid=iehp

SearchScopes: HKLM-x32 -> DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = 

SearchScopes: HKU\S-1-5-21-1912583399-466474933-4168976199-1001 -> DefaultScope {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = 

BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\Office15\OCHelper.dll (Microsoft Corporation)

BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation)

BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)

BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll (Oracle Corporation)

BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)

BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll (Oracle Corporation)

Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation)

Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Microsoft Office\Office15\MSOSB.DLL (Microsoft Corporation)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

 

FireFox:

========

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)

FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> D:\Picasa3\npPicasa3.dll (Google, Inc.)

FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll (Microsoft Corporation)

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Microsoft Office\Office15\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)

FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> D:\VLC\npvlc.dll (VideoLAN)

 

Chrome: 

=======

CHR HomePage: Default -> hxxp://www.reddit.com/

CHR StartupUrls: Default -> "hxxp://www.reddit.com/"

CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:inputType}{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}{google:searchVersion}{google:sessionToken}{google:prefetchQuery}sugkey={google:suggestAPIKeyParameter}

CHR Profile: C:\Users\Anthony\AppData\Local\Google\Chrome\User Data\Default

CHR Extension: (Google Slides) - C:\Users\Anthony\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2014-10-08]

CHR Extension: (Rage Faces for Reddit ™) - C:\Users\Anthony\AppData\Local\Google\Chrome\User Data\Default\Extensions\ajjgiajaoafimgkdlcofflenackmpjhd [2014-10-08]

CHR Extension: (reddit companion) - C:\Users\Anthony\AppData\Local\Google\Chrome\User Data\Default\Extensions\algjnflpgoopkdijmkalfcifomdhmcbe [2014-10-08]

CHR Extension: (Google Docs) - C:\Users\Anthony\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-10-08]

CHR Extension: (Google Drive) - C:\Users\Anthony\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-10-08]

CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Anthony\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-10-08]

CHR Extension: (YouTube) - C:\Users\Anthony\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-10-08]

CHR Extension: (Google Search) - C:\Users\Anthony\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-10-08]

CHR Extension: (Google Sheets) - C:\Users\Anthony\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2014-10-08]

CHR Extension: (Reddit votes) - C:\Users\Anthony\AppData\Local\Google\Chrome\User Data\Default\Extensions\geedigenhgnhbebebbjlidlalocdggjl [2014-10-08]

CHR Extension: (AdBlock) - C:\Users\Anthony\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2014-10-08]

CHR Extension: (Hola Better Internet) - C:\Users\Anthony\AppData\Local\Google\Chrome\User Data\Default\Extensions\gkojfkhlekighikafcpjkiklfbnlmeio [2014-10-22]

CHR Extension: (TinEye Reverse Image Search) - C:\Users\Anthony\AppData\Local\Google\Chrome\User Data\Default\Extensions\haebnnbpedcbhciplfhjjkbafijpncjl [2014-10-08]

CHR Extension: (Reddit Enhancement Suite) - C:\Users\Anthony\AppData\Local\Google\Chrome\User Data\Default\Extensions\kbmfpngjjgdllneeigpgjifpgocmfgmb [2014-10-08]

CHR Extension: (Reddit NSFW Filter) - C:\Users\Anthony\AppData\Local\Google\Chrome\User Data\Default\Extensions\mjpnnnikhngjjoapjdcdfepkenphaobi [2014-10-08]

CHR Extension: (Google Wallet) - C:\Users\Anthony\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-10-08]

CHR Extension: (Gmail) - C:\Users\Anthony\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-10-08]

 

==================== Services (Whitelisted) =================

 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

 

R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2449592 2014-11-12] (Microsoft Corporation)

R2 db79edbd; c:\Program Files (x86)\LighterSystem\LighterSystem.dll [1582592 2015-02-17] () [File not signed]

R2 f291fddf; c:\Program Files (x86)\TurboStrength\TurboStrength.dll [1626112 2015-02-17] () [File not signed]

R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1148744 2015-01-16] (NVIDIA Corporation)

R2 ISCTAgent; C:\Program Files\Intel\Intel® Smart Connect Technology Agent\iSCTAgent.exe [209712 2014-06-18] ()

R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1706312 2015-01-16] (NVIDIA Corporation)

R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [21833544 2015-01-16] (NVIDIA Corporation)

S3 Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [1910128 2015-02-06] (Electronic Arts)

R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-21] (Microsoft Corporation)

R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-21] (Microsoft Corporation)

 

==================== Drivers (Whitelisted) ====================

 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

 

R3 AE6000; C:\Windows\system32\DRIVERS\AE6000w864.sys [2377216 2015-02-13] (Ralink Technology Corp.)

R3 ikbevent; C:\Windows\system32\DRIVERS\ikbevent.sys [22216 2014-05-27] ()

R3 imsevent; C:\Windows\system32\DRIVERS\imsevent.sys [22728 2014-05-27] ()

R3 INETMON; C:\Windows\System32\Drivers\INETMON.sys [25800 2014-05-27] ()

R3 ISCT; C:\Windows\System32\drivers\ISCTD.sys [44744 2014-05-27] ()

R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [129312 2014-09-30] (Intel Corporation)

R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19784 2015-01-16] (NVIDIA Corporation)

R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [38032 2014-11-22] (NVIDIA Corporation)

R3 t_mouse.sys; C:\Windows\system32\DRIVERS\t_mouse.sys [6144 2013-04-09] ()

R3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-21] (Microsoft Corporation)

S3 xb1usb; C:\Windows\System32\drivers\xb1usb.sys [34016 2014-05-28] (Microsoft Corporation)

S3 andnetadb; \SystemRoot\System32\Drivers\lgandnetadb.sys [X]

S3 AndNetDiag; \SystemRoot\system32\DRIVERS\lgandnetdiag64.sys [X]

S3 ANDNetModem; \SystemRoot\system32\DRIVERS\lgandnetmodem64.sys [X]

S3 LgBttPort; \SystemRoot\system32\DRIVERS\lgbtpt64.sys [X]

S3 lgbusenum; \SystemRoot\System32\drivers\lgbtbs64.sys [X]

S3 LGVMODEM; \SystemRoot\system32\DRIVERS\lgvmdm64.sys [X]

S3 usbbus; \SystemRoot\System32\drivers\lgx64bus.sys [X]

S3 UsbDiag; \SystemRoot\system32\DRIVERS\lgx64diag.sys [X]

S3 USBModem; \SystemRoot\system32\DRIVERS\lgx64modem.sys [X]

 

==================== NetSvcs (Whitelisted) ===================

 

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)

 

 

==================== One Month Created Files and Folders ========

 

(If an entry is included in the fixlist, the file\folder will be moved.)

 

2015-02-20 20:30 - 2015-02-20 20:31 - 00016956 _____ () C:\Users\Anthony\Desktop\FRST.txt

2015-02-20 20:30 - 2015-02-20 20:30 - 02086912 _____ (Farbar) C:\Users\Anthony\Desktop\FRST64 (1).exe

2015-02-17 22:18 - 2015-02-20 20:30 - 00000000 ____D () C:\FRST

2015-02-17 21:22 - 2015-02-17 21:36 - 00000020 _____ () C:\Users\Anthony\AppData\Roaming\appdataFr3.bin

2015-02-17 21:22 - 2015-02-17 21:22 - 00000000 ____D () C:\ProgramData\OnlineLowDeals

2015-02-17 21:22 - 2015-02-17 21:22 - 00000000 ____D () C:\ProgramData\cheap-o

2015-02-17 21:02 - 2015-02-17 21:02 - 00000000 ____D () C:\Program Files (x86)\TurboStrength

2015-02-17 21:02 - 2015-02-17 21:02 - 00000000 ____D () C:\Program Files (x86)\LighterSystem

2015-02-13 23:33 - 2015-02-13 23:33 - 00002149 _____ () C:\Users\Public\Desktop\3D Vision Photo Viewer.lnk

2015-02-13 23:33 - 2015-02-13 23:33 - 00000000 ____D () C:\Windows\LastGood.Tmp

2015-02-13 23:33 - 2015-02-05 11:57 - 00621384 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe

2015-02-13 23:32 - 2015-02-05 15:01 - 32106640 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll

2015-02-13 23:32 - 2015-02-05 15:01 - 25460880 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll

2015-02-13 23:32 - 2015-02-05 15:01 - 24768144 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll

2015-02-13 23:32 - 2015-02-05 15:01 - 20466496 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll

2015-02-13 23:32 - 2015-02-05 15:01 - 17253848 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll

2015-02-13 23:32 - 2015-02-05 15:01 - 13294528 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll

2015-02-13 23:32 - 2015-02-05 15:01 - 13208200 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll

2015-02-13 23:32 - 2015-02-05 15:01 - 10773704 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll

2015-02-13 23:32 - 2015-02-05 15:01 - 10713256 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll

2015-02-13 23:32 - 2015-02-05 15:01 - 10284872 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys

2015-02-13 23:32 - 2015-02-05 15:01 - 03610768 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll

2015-02-13 23:32 - 2015-02-05 15:01 - 03247248 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll

2015-02-13 23:32 - 2015-02-05 15:01 - 01895240 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6434752.dll

2015-02-13 23:32 - 2015-02-05 15:01 - 01557648 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6434752.dll

2015-02-13 23:32 - 2015-02-05 15:01 - 00995248 _____ (NVIDIA Corporation) C:\Windows\system32\nvumdshimx.dll

2015-02-13 23:32 - 2015-02-05 15:01 - 00969872 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll

2015-02-13 23:32 - 2015-02-05 15:01 - 00943760 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll

2015-02-13 23:32 - 2015-02-05 15:01 - 00929936 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll

2015-02-13 23:32 - 2015-02-05 15:01 - 00908104 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll

2015-02-13 23:32 - 2015-02-05 15:01 - 00877816 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll

2015-02-13 23:32 - 2015-02-05 15:01 - 00833680 _____ () C:\Windows\system32\nvmcumd.dll

2015-02-13 23:32 - 2015-02-05 15:01 - 00496272 _____ (NVIDIA Corporation) C:\Windows\system32\nvEncodeAPI64.dll

2015-02-13 23:32 - 2015-02-05 15:01 - 00399504 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvEncodeAPI.dll

2015-02-13 23:32 - 2015-02-05 15:01 - 00390472 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFROpenGL.dll

2015-02-13 23:32 - 2015-02-05 15:01 - 00353224 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll

2015-02-13 23:32 - 2015-02-05 15:01 - 00345744 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFROpenGL.dll

2015-02-13 23:32 - 2015-02-05 15:01 - 00305136 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll

2015-02-13 23:32 - 2015-02-05 15:01 - 00177624 _____ (NVIDIA Corporation) C:\Windows\system32\nvinitx.dll

2015-02-13 23:32 - 2015-02-05 15:01 - 00164752 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvinit.dll

2015-02-11 18:21 - 2015-01-22 22:41 - 06041600 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2015-02-11 18:21 - 2015-01-22 21:17 - 04300800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2015-02-10 20:09 - 2015-01-10 03:10 - 07472960 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe

2015-02-10 20:09 - 2015-01-10 03:10 - 01733440 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll

2015-02-10 20:09 - 2015-01-10 02:28 - 01498360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll

2015-02-10 20:09 - 2014-10-28 20:02 - 00285184 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll

2015-02-10 20:09 - 2014-10-28 20:02 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll

2015-02-10 20:09 - 2014-10-28 19:57 - 00016896 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll

2015-02-10 20:09 - 2014-10-28 19:15 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll

2015-02-10 20:09 - 2014-10-28 19:15 - 00005632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll

2015-02-10 20:09 - 2014-10-28 19:14 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe

2015-02-10 20:09 - 2014-10-28 19:13 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe

2015-02-10 20:09 - 2014-10-28 19:13 - 00008704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe

2015-02-10 18:55 - 2015-01-15 16:43 - 00563504 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys

2015-02-10 18:55 - 2015-01-15 16:43 - 00177984 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys

2015-02-10 18:55 - 2015-01-13 22:22 - 00445440 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll

2015-02-10 18:55 - 2015-01-13 21:53 - 00324096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll

2015-02-10 18:55 - 2015-01-13 16:11 - 01762840 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll

2015-02-10 18:55 - 2015-01-13 16:04 - 01489072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll

2015-02-10 18:55 - 2014-12-08 21:45 - 00393728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scesrv.dll

2015-02-10 18:55 - 2014-12-08 19:56 - 00538624 _____ (Microsoft Corporation) C:\Windows\system32\scesrv.dll

2015-02-10 18:55 - 2014-10-28 20:51 - 00154112 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll

2015-02-10 18:55 - 2014-10-28 20:50 - 00736768 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll

2015-02-10 18:55 - 2014-10-28 20:06 - 00736768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll

2015-02-10 18:55 - 2014-10-28 20:06 - 00154112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll

2015-02-10 18:55 - 2014-10-28 19:31 - 01441792 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll

2015-02-10 18:45 - 2015-01-10 02:22 - 04175872 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2015-02-10 18:40 - 2014-12-19 02:57 - 00788680 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll

2015-02-10 18:40 - 2014-12-19 02:25 - 00602776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll

2015-02-10 18:40 - 2014-12-08 17:12 - 00391526 _____ () C:\Windows\system32\ApnDatabase.xml

2015-02-10 18:34 - 2015-01-11 21:09 - 25056256 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2015-02-10 18:34 - 2015-01-11 20:48 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2015-02-10 18:34 - 2015-01-11 20:48 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2015-02-10 18:34 - 2015-01-11 20:47 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll

2015-02-10 18:34 - 2015-01-11 20:34 - 00816128 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll

2015-02-10 18:34 - 2015-01-11 20:25 - 19740160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2015-02-10 18:34 - 2015-01-11 20:21 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll

2015-02-10 18:34 - 2015-01-11 20:08 - 00503296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2015-02-10 18:34 - 2015-01-11 20:07 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2015-02-10 18:34 - 2015-01-11 20:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll

2015-02-10 18:34 - 2015-01-11 20:02 - 02277888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2015-02-10 18:34 - 2015-01-11 19:58 - 01032704 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll

2015-02-10 18:34 - 2015-01-11 19:55 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll

2015-02-10 18:34 - 2015-01-11 19:51 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll

2015-02-10 18:34 - 2015-01-11 19:48 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2015-02-10 18:34 - 2015-01-11 19:48 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2015-02-10 18:34 - 2015-01-11 19:48 - 00374272 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll

2015-02-10 18:34 - 2015-01-11 19:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2015-02-10 18:34 - 2015-01-11 19:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll

2015-02-10 18:34 - 2015-01-11 19:43 - 14401024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2015-02-10 18:34 - 2015-01-11 19:34 - 00128000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll

2015-02-10 18:34 - 2015-01-11 19:30 - 00880128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll

2015-02-10 18:34 - 2015-01-11 19:27 - 02865152 _____ (Microsoft Corporation) C:\Windows\system32\actxprxy.dll

2015-02-10 18:34 - 2015-01-11 19:27 - 02358272 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2015-02-10 18:34 - 2015-01-11 19:25 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll

2015-02-10 18:34 - 2015-01-11 19:23 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2015-02-10 18:34 - 2015-01-11 19:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2015-02-10 18:34 - 2015-01-11 19:23 - 00327168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll

2015-02-10 18:34 - 2015-01-11 19:14 - 12829184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2015-02-10 18:34 - 2015-01-11 19:14 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2015-02-10 18:34 - 2015-01-11 19:02 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2015-02-10 18:34 - 2015-01-11 19:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2015-02-10 18:34 - 2015-01-11 18:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2015-02-10 18:34 - 2015-01-11 18:55 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2015-02-10 18:34 - 2015-01-10 01:00 - 00430080 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll

2015-02-10 18:34 - 2015-01-10 00:38 - 00359424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll

2015-02-10 18:30 - 2015-01-19 12:42 - 01487976 _____ (Microsoft Corporation) C:\Windows\system32\sppobjs.dll

2015-02-10 18:29 - 2015-02-03 17:38 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll

2015-02-10 18:29 - 2015-02-03 17:08 - 00761856 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll

2015-02-10 18:29 - 2015-02-03 17:08 - 00414208 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll

2015-02-10 18:29 - 2015-02-02 17:11 - 01098752 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

2015-02-10 18:29 - 2015-02-02 17:11 - 00894464 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll

2015-02-10 18:29 - 2015-02-02 17:11 - 00609280 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll

2015-02-05 21:36 - 2015-02-05 21:36 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_TeeDriverx64_01011.Wdf

2015-01-28 23:08 - 2015-02-17 21:07 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2015-01-28 23:08 - 2015-01-28 23:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2015-01-28 23:08 - 2015-01-28 23:08 - 00000000 ____D () C:\ProgramData\Malwarebytes

2015-01-28 23:08 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2015-01-28 23:08 - 2014-11-21 06:14 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2015-01-28 23:08 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2015-01-28 22:54 - 2015-02-17 21:02 - 00000000 ____D () C:\ProgramData\62e80b73000079b4

2015-01-28 22:52 - 2015-02-17 21:02 - 00000000 ____D () C:\ProgramData\79f6df4a00001f62

2015-01-28 22:50 - 2015-01-28 22:50 - 00000000 ____D () C:\Program Files (x86)\predm

2015-01-28 22:48 - 2015-02-20 20:17 - 00001710 _____ () C:\Windows\Tasks\KTMJRRLI.job

2015-01-28 22:48 - 2015-01-28 23:16 - 00000000 ____D () C:\Program Files (x86)\globalUpdate

2015-01-28 22:48 - 2015-01-28 22:48 - 00004720 _____ () C:\Windows\System32\Tasks\KTMJRRLI

2015-01-28 22:48 - 2015-01-28 22:48 - 00000000 ____D () C:\Users\Anthony\AppData\Local\globalUpdate

2015-01-28 22:44 - 2015-01-28 23:05 - 00000000 ____D () C:\Windows\system32\appmgmt

2015-01-28 22:44 - 2015-01-28 22:44 - 00001751 _____ () C:\ProgramData\tempimage.bmp

2015-01-25 10:12 - 2015-01-25 10:12 - 00001248 _____ () C:\Users\Anthony\AppData\Roaming\KTMJRRLI

2015-01-24 17:48 - 2015-01-12 22:15 - 01540240 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdagenco6420103.dll

2015-01-24 17:48 - 2015-01-10 02:07 - 01895240 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6434725.dll

2015-01-24 17:48 - 2015-01-10 02:07 - 01556808 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6434725.dll

2015-01-21 22:21 - 2015-02-05 15:01 - 02902784 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvapi.dll

2015-01-21 22:21 - 2014-12-13 04:08 - 01895056 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6434709.dll

2015-01-21 22:21 - 2014-12-13 04:08 - 01556624 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6434709.dll

2015-01-21 22:21 - 2014-10-09 11:02 - 00195728 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvhda64v.sys

2015-01-21 22:21 - 2014-10-09 11:02 - 00030536 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdap64.dll

2015-01-21 22:21 - 2014-10-09 01:17 - 01540240 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdagenco64.dll

 

==================== One Month Modified Files and Folders =======

 

(If an entry is included in the fixlist, the file\folder will be moved.)

 

2015-02-20 20:27 - 2014-10-08 13:56 - 01233268 _____ () C:\Windows\WindowsUpdate.log

2015-02-20 20:25 - 2014-10-09 13:52 - 00000000 ____D () C:\Users\Anthony\AppData\Roaming\Spotify

2015-02-20 20:24 - 2014-10-08 13:59 - 00863592 _____ () C:\Windows\system32\PerfStringBackup.INI

2015-02-20 20:21 - 2013-08-22 08:45 - 00034670 _____ () C:\Windows\setupact.log

2015-02-20 20:19 - 2014-10-08 19:01 - 00003930 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{48D22CF4-221F-43DB-AE16-D7853ED7FA36}

2015-02-20 20:18 - 2014-10-09 14:01 - 00000000 ____D () C:\Users\Anthony\AppData\Local\Spotify

2015-02-20 20:18 - 2014-10-09 13:09 - 00000000 __RDO () C:\Users\Anthony\SkyDrive

2015-02-18 00:00 - 2013-08-22 09:36 - 00000000 ____D () C:\Windows\system32\sru

2015-02-17 18:35 - 2014-10-08 14:01 - 00003598 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1912583399-466474933-4168976199-1001

2015-02-17 18:09 - 2014-10-08 19:13 - 00000000 ____D () C:\ProgramData\NVIDIA

2015-02-17 18:09 - 2013-08-22 08:45 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2015-02-17 18:09 - 2013-08-22 07:25 - 00262144 ___SH () C:\Windows\system32\config\BBI

2015-02-17 17:51 - 2014-10-08 13:53 - 00038786 _____ () C:\Windows\PFRO.log

2015-02-17 17:51 - 2013-08-22 09:36 - 00000000 ____D () C:\Windows\AppReadiness

2015-02-15 23:54 - 2014-10-08 19:34 - 00000000 ____D () C:\Users\Anthony\AppData\Local\Battle.net

2015-02-15 19:58 - 2013-08-22 09:36 - 00000000 ____D () C:\Windows\rescache

2015-02-13 23:33 - 2014-10-22 21:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation

2015-02-13 22:04 - 2013-01-25 14:13 - 02377216 _____ (Ralink Technology Corp.) C:\Windows\system32\Drivers\AE6000w864.sys

2015-02-13 22:04 - 2013-01-25 14:13 - 00334000 _____ (Ralink Technology, Inc.) C:\Windows\system32\RaCoInstx.dll

2015-02-13 22:04 - 2013-01-25 14:13 - 00014172 _____ () C:\Windows\system32\RaCoInst.dat

2015-02-12 19:15 - 2013-08-22 09:20 - 00000000 ____D () C:\Windows\CbsTemp

2015-02-11 18:09 - 2013-08-22 08:44 - 00481880 _____ () C:\Windows\system32\FNTCACHE.DAT

2015-02-10 19:02 - 2014-10-09 18:34 - 00000000 ____D () C:\Windows\system32\MRT

2015-02-10 19:00 - 2014-12-11 02:23 - 00000000 ____D () C:\Windows\system32\appraiser

2015-02-10 19:00 - 2014-10-16 22:07 - 00000000 ___SD () C:\Windows\system32\CompatTel

2015-02-10 19:00 - 2014-10-09 18:34 - 116773704 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2015-02-08 20:24 - 2014-10-08 13:56 - 00000000 ____D () C:\Users\Anthony\AppData\Local\Packages

2015-02-07 00:24 - 2014-10-08 19:27 - 00000000 ____D () C:\ProgramData\Origin

2015-02-06 22:43 - 2014-10-08 19:42 - 00000000 ____D () C:\Users\Anthony\AppData\Roaming\Origin

2015-02-06 22:42 - 2014-10-08 19:27 - 00000000 ____D () C:\Program Files (x86)\Origin

2015-02-05 15:01 - 2014-10-22 21:25 - 14119744 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvd3dum.dll

2015-02-05 15:01 - 2014-10-08 19:12 - 00074056 _____ (Khronos Group) C:\Windows\system32\OpenCL.dll

2015-02-05 15:01 - 2014-10-08 19:12 - 00060560 _____ (Khronos Group) C:\Windows\SysWOW64\OpenCL.dll

2015-02-05 15:01 - 2014-08-19 23:15 - 18575880 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll

2015-02-05 15:01 - 2014-08-19 23:15 - 16017040 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll

2015-02-05 15:01 - 2014-08-19 23:14 - 03299512 _____ (NVIDIA Corporation) C:\Windows\system32\nvapi64.dll

2015-02-05 15:01 - 2014-08-19 23:14 - 00027441 _____ () C:\Windows\system32\nvinfo.pb

2015-02-05 13:07 - 2014-10-08 19:12 - 06861128 _____ (NVIDIA Corporation) C:\Windows\system32\nvcpl.dll

2015-02-05 13:07 - 2014-10-08 19:12 - 03517584 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvc64.dll

2015-02-05 13:07 - 2014-10-08 19:12 - 02558792 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvcr.dll

2015-02-05 13:07 - 2014-10-08 19:12 - 00935056 _____ (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe

2015-02-05 13:07 - 2014-10-08 19:12 - 00062792 _____ (NVIDIA Corporation) C:\Windows\system32\nvshext.dll

2015-02-05 13:06 - 2014-10-08 19:12 - 00385168 _____ (NVIDIA Corporation) C:\Windows\system32\nvmctray.dll

2015-02-05 06:50 - 2014-10-08 19:12 - 04236870 _____ () C:\Windows\system32\nvcoproc.bin

2015-02-03 13:31 - 2013-08-22 09:38 - 00714720 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2015-02-03 13:31 - 2013-08-22 09:38 - 00106976 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2015-01-29 16:21 - 2014-10-18 18:28 - 00000000 ____D () C:\Program Files (x86)\Java

2015-01-29 16:21 - 2014-10-09 15:05 - 00272296 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe

2015-01-29 16:21 - 2014-10-09 15:05 - 00176552 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe

2015-01-29 16:21 - 2014-10-09 15:05 - 00176552 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe

2015-01-29 16:21 - 2014-10-09 15:05 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll

2015-01-29 16:21 - 2014-10-09 15:05 - 00000000 ____D () C:\ProgramData\Oracle

2015-01-28 23:16 - 2013-08-22 09:36 - 00000000 ____D () C:\Windows\WinStore

2015-01-28 23:07 - 2014-12-11 02:05 - 00000000 ____D () C:\Users\Anthony\AppData\Local\LG Electronics

2015-01-28 23:07 - 2014-12-11 00:29 - 00000000 ____D () C:\LG

2015-01-28 23:06 - 2014-12-11 00:31 - 00000000 ____D () C:\Program Files (x86)\LG Electronics

2015-01-28 18:16 - 2014-10-08 19:03 - 00002203 _____ () C:\Users\Public\Desktop\Google Chrome.lnk

2015-01-25 16:06 - 2015-01-19 15:54 - 00000000 ____D () C:\Users\Anthony\Desktop\Niki's [bleep]

2015-01-21 23:53 - 2014-10-16 21:29 - 00000000 ____D () C:\Users\Anthony\AppData\Roaming\vlc

 

==================== Files in the root of some directories =======

 

2015-02-17 21:22 - 2015-02-17 21:36 - 0000020 _____ () C:\Users\Anthony\AppData\Roaming\appdataFr3.bin

2015-01-25 10:12 - 2015-01-25 10:12 - 0001248 _____ () C:\Users\Anthony\AppData\Roaming\KTMJRRLI

2015-01-28 22:44 - 2015-01-28 22:44 - 0001751 _____ () C:\ProgramData\tempimage.bmp

 

Some content of TEMP:

====================

C:\Users\Anthony\AppData\Local\Temp\crdli.dll

C:\Users\Anthony\AppData\Local\Temp\jre-7u71-windows-i586-iftw.exe

C:\Users\Anthony\AppData\Local\Temp\jre-8u31-windows-au.exe

C:\Users\Anthony\AppData\Local\Temp\nvSCPAPI.dll

C:\Users\Anthony\AppData\Local\Temp\nvSCPAPI64.dll

C:\Users\Anthony\AppData\Local\Temp\nvSCPAPISvr.exe

C:\Users\Anthony\AppData\Local\Temp\nvStInst.exe

C:\Users\Anthony\AppData\Local\Temp\optprosetup.exe

C:\Users\Anthony\AppData\Local\Temp\sfamcc00001.dll

C:\Users\Anthony\AppData\Local\Temp\sfextra.dll

C:\Users\Anthony\AppData\Local\Temp\SoftonicAssistant_v0-1-6.exe

C:\Users\Anthony\AppData\Local\Temp\wmfdist.exe

 

 

==================== Bamital & volsnap Check =================

 

(There is no automatic fix for files that do not pass verification.)

 

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed

 

 

LastRegBack: 2015-02-17 18:35

 

==================== End Of Log ============================

 

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 18-02-2015 01

Ran by Anthony at 2015-02-20 20:31:08

Running from C:\Users\Anthony\Desktop

Boot Mode: Normal

==========================================================

 

 

==================== Security Center ========================

 

(If an entry is included in the fixlist, it will be removed.)

 

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

 

==================== Installed Programs ======================

 

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

 

7-Zip 9.20 (HKLM-x32\...\7-Zip) (Version:  - )

7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)

Battle.net (HKLM-x32\...\Battle.net) (Version:  - Blizzard Entertainment)

BitTorrent (HKU\S-1-5-21-1912583399-466474933-4168976199-1001\...\BitTorrent) (Version: 7.9.2.35704 - BitTorrent Inc.)

Borderlands: The Pre-Sequel (HKLM-x32\...\Steam App 261640) (Version:  - 2K Australia)

Brawlhalla (HKLM-x32\...\Steam App 291550) (Version:  - Blue Mammoth Games)

Diablo III (HKLM-x32\...\Diablo III) (Version:  - Blizzard Entertainment)

Fallout: New Vegas (HKLM-x32\...\Steam App 22380) (Version:  - Obsidian Entertainment)

Google Chrome (HKLM-x32\...\Google Chrome) (Version: 40.0.2214.93 - Google Inc.)

Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden

Intel® Smart Connect Technology (HKLM\...\{08B90A20-95D3-4725-84B9-AF6553E06C4F}) (Version: 5.0.10.2850 - Intel Corporation)

Itibiti RTC (x32 Version: 0.0.1 - Itibiti Inc) Hidden

Java 8 Update 31 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218031F0}) (Version: 8.0.310 - Oracle Corporation)

Malwarebytes Anti-Malware version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)

Microsoft ASP.NET MVC 4 Runtime (HKLM-x32\...\{3FE312D5-B862-40CE-8E4E-A6D8ABF62736}) (Version: 4.0.40804.0 - Microsoft Corporation)

Microsoft Office 365 ProPlus - en-us (HKLM\...\O365ProPlusRetail - en-us) (Version: 15.0.4675.1003 - Microsoft Corporation)

Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)

MSXML 4.0 SP2 Parser and SDK (HKLM-x32\...\{716E0306-8318-4364-8B8F-0CC4E9376BAC}) (Version: 4.20.9818.0 - Microsoft Corporation)

Nexus Mod Manager (HKLM\...\6af12c54-643b-4752-87d0-8335503010de_is1) (Version: 0.52.3 - Black Tree Gaming)

NVIDIA 3D Vision Controller Driver 347.09 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 347.09 - NVIDIA Corporation)

NVIDIA 3D Vision Driver 347.52 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 347.52 - NVIDIA Corporation)

NVIDIA GeForce Experience 2.2.2 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.2.2 - NVIDIA Corporation)

NVIDIA Graphics Driver 347.52 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 347.52 - NVIDIA Corporation)

NVIDIA HD Audio Driver 1.3.33.0 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.33.0 - NVIDIA Corporation)

NVIDIA Miracast Virtual Audio 347.52 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Miracast.VirtualAudio) (Version: 347.52 - NVIDIA Corporation)

NVIDIA PhysX System Software 9.14.0702 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.14.0702 - NVIDIA Corporation)

Office 15 Click-to-Run Extensibility Component (Version: 15.0.4675.1003 - Microsoft Corporation) Hidden

Office 15 Click-to-Run Licensing Component (Version: 15.0.4675.1003 - Microsoft Corporation) Hidden

Office 15 Click-to-Run Localization Component (Version: 15.0.4675.1003 - Microsoft Corporation) Hidden

Origin (HKLM-x32\...\Origin) (Version: 9.4.22.2815 - Electronic Arts, Inc.)

PdaNet+ for Android 4.15 (HKLM-x32\...\PdaNet_is1) (Version:  - June Fabrics Technology Inc)

Picasa 3 (HKLM-x32\...\Picasa 3) (Version: 3.9 - Google, Inc.)

Prison Architect (HKLM-x32\...\Steam App 233450) (Version:  - Introversion Software)

SHIELD Streaming (Version: 4.0.1000 - NVIDIA Corporation) Hidden

SHIELD Wireless Controller Driver (Version: 17.12.8 - NVIDIA Corporation) Hidden

SpeedFan (remove only) (HKLM-x32\...\SpeedFan) (Version:  - )

Spotify (HKU\S-1-5-21-1912583399-466474933-4168976199-1001\...\Spotify) (Version: 0.9.15.27.g87efe634 - Spotify AB)

Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)

System Requirements Lab Detection (HKLM-x32\...\{D10323D5-353F-4172-8CB2-D2ABF29411E9}) (Version: 2.2.1.0 - Husdawg, LLC)

The Binding of Isaac (HKLM-x32\...\Steam App 113200) (Version:  - Edmund McMillen and Florian Himsl)

The Evil Within (HKLM-x32\...\Steam App 268050) (Version:  - Tango Gameworks)

VLC media player (HKLM-x32\...\VLC media player) (Version: 2.1.5 - VideoLAN)

 

==================== Custom CLSID (selected items): ==========================

 

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

 

 

==================== Restore Points  =========================

 

28-01-2015 17:27:52 Windows Update

05-02-2015 21:35:57 Windows Update

10-02-2015 19:00:23 Windows Update

17-02-2015 20:12:50 Scheduled Checkpoint

 

==================== Hosts content: ==========================

 

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

 

2013-08-22 07:25 - 2013-08-22 07:25 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

 

==================== Scheduled Tasks (whitelisted) =============

 

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

 

Task: {11A6D19D-0F40-454A-907C-A6E8E729B987} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows\system32\MRT.exe [2015-02-10] (Microsoft Corporation)

Task: {9103C8FD-1072-4068-A719-9B6F4BFF2522} - System32\Tasks\KTMJRRLI => C:\Users\Anthony\AppData\Roaming\KTMJRRLI.exe <==== ATTENTION

Task: {B17FD7C7-A673-4933-8722-512F8357F5BD} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office 15\root\Office15\msoia.exe [2014-10-07] (Microsoft Corporation)

Task: {CEE481D6-73A8-47E0-A78C-7F3358FE41EB} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office 15\root\Office15\msoia.exe [2014-10-07] (Microsoft Corporation)

Task: {D1CD848D-42EF-42FA-B646-A39DF8B3AADF} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonx64\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe [2014-11-12] (Microsoft Corporation)

Task: {F40952A6-6449-45BF-931F-D8232A182893} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2014-11-04] (Microsoft Corporation)

Task: C:\Windows\Tasks\KTMJRRLI.job => C:\Users\Anthony\AppData\Roaming\KTMJRRLI.exe <==== ATTENTION

 

==================== Loaded Modules (whitelisted) ==============

 

2014-10-17 18:36 - 2014-05-20 08:19 - 00105640 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll

2014-06-18 17:18 - 2014-06-18 17:18 - 00209712 _____ () C:\Program Files\Intel\Intel® Smart Connect Technology Agent\iSCTAgent.exe

2014-06-18 17:18 - 2014-06-18 17:18 - 00057648 _____ () C:\Program Files\Intel\Intel® Smart Connect Technology Agent\NetworkHeuristic.dll

2014-06-18 17:18 - 2014-06-18 17:18 - 00057648 _____ () C:\Program Files\Intel\Intel® Smart Connect Technology Agent\ISCTEncryptionCheck.dll

2014-06-18 17:18 - 2014-06-18 17:18 - 00037168 _____ () C:\Program Files\Intel\Intel® Smart Connect Technology Agent\ISCTNetMon.dll

2014-11-16 15:51 - 2014-09-23 07:36 - 08897696 _____ () C:\Program Files\Microsoft Office 15\root\Office15\1033\GrooveIntlResource.dll

2014-10-08 19:12 - 2015-02-05 13:07 - 00117576 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll

2014-10-09 14:01 - 2014-12-11 01:33 - 00374840 _____ () C:\Users\Anthony\AppData\Roaming\Spotify\Data\SpotifyHelper.exe

2015-02-17 21:02 - 2015-02-17 21:02 - 01582592 _____ () c:\Program Files (x86)\LighterSystem\LighterSystem.dll

2015-02-17 21:02 - 2015-02-17 21:02 - 01626112 _____ () c:\Program Files (x86)\TurboStrength\TurboStrength.dll

2014-11-16 15:51 - 2014-09-23 05:43 - 08897696 _____ () C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Microsoft Office\Office15\1033\GrooveIntlResource.dll

2015-01-28 18:16 - 2015-01-25 00:08 - 01117512 _____ () C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.93\libglesv2.dll

2015-01-28 18:16 - 2015-01-25 00:08 - 00211272 _____ () C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.93\libegl.dll

2015-01-28 18:16 - 2015-01-25 00:08 - 09170760 _____ () C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.93\pdf.dll

2014-10-09 14:01 - 2014-12-11 01:33 - 36966968 _____ () C:\Users\Anthony\AppData\Roaming\Spotify\Data\libcef.dll

2014-10-09 14:01 - 2014-12-11 01:33 - 00867896 _____ () C:\Users\Anthony\AppData\Roaming\Spotify\Data\ffmpegsumo.dll

2014-10-09 14:01 - 2014-12-11 01:33 - 00886840 _____ () C:\Users\Anthony\AppData\Roaming\Spotify\Data\libglesv2.dll

2014-10-09 14:01 - 2014-12-11 01:33 - 00108600 _____ () C:\Users\Anthony\AppData\Roaming\Spotify\Data\libegl.dll

 

==================== Alternate Data Streams (whitelisted) =========

 

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

 

AlternateDataStreams: C:\Users\Anthony\SkyDrive:ms-properties

 

==================== Safe Mode (whitelisted) ===================

 

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

 

 

==================== EXE Association (whitelisted) ===============

 

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)

 

 

==================== Other Areas ============================

 

(Currently there is no automatic fix for this section.)

 

HKU\S-1-5-21-1912583399-466474933-4168976199-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Anthony\AppData\Roaming\Microsoft\Windows Photo Viewer\Windows Photo Viewer Wallpaper.jpg

DNS Servers: 192.168.1.1

 

==================== MSCONFIG/TASK MANAGER disabled items ==

 

(Currently there is no automatic fix for this section.)

 

HKU\S-1-5-21-1912583399-466474933-4168976199-1001\...\StartupApproved\StartupFolder: => "PdaNet Desktop.lnk"

HKU\S-1-5-21-1912583399-466474933-4168976199-1001\...\StartupApproved\Run: => "Browser Infrastructure Helper"

 

==================== Accounts: =============================

 

Administrator (S-1-5-21-1912583399-466474933-4168976199-500 - Administrator - Disabled)

Anthony (S-1-5-21-1912583399-466474933-4168976199-1001 - Administrator - Enabled) => C:\Users\Anthony

Guest (S-1-5-21-1912583399-466474933-4168976199-501 - Limited - Disabled)

HomeGroupUser$ (S-1-5-21-1912583399-466474933-4168976199-1003 - Limited - Enabled)

 

==================== Faulty Device Manager Devices =============

 

Name: SM Bus Controller

Description: SM Bus Controller

Class Guid: 

Manufacturer: 

Service: 

Problem: : The drivers for this device are not installed. (Code 28)

Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

 

 

==================== Event log errors: =========================

 

Application errors:

==================

Error: (02/20/2015 08:19:02 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: CHEEZUS)

Description: Activation of app Microsoft.BingWeather_8wekyb3d8bbwe!App failed with error: -2144927148 See the Microsoft-Windows-TWinUI/Operational log for additional information.

 

Error: (02/17/2015 11:42:26 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: CHEEZUS)

Description: Activation of app Microsoft.BingWeather_8wekyb3d8bbwe!App failed with error: -2144927148 See the Microsoft-Windows-TWinUI/Operational log for additional information.

 

Error: (02/17/2015 09:42:26 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: CHEEZUS)

Description: Activation of app Microsoft.BingWeather_8wekyb3d8bbwe!App failed with error: -2144927148 See the Microsoft-Windows-TWinUI/Operational log for additional information.

 

Error: (02/17/2015 07:42:26 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: CHEEZUS)

Description: Activation of app Microsoft.BingWeather_8wekyb3d8bbwe!App failed with error: -2144927148 See the Microsoft-Windows-TWinUI/Operational log for additional information.

 

Error: (02/17/2015 07:33:07 PM) (Source: Microsoft-Windows-Defrag) (EventID: 257) (User: )

Description: The volume System Reserved was not optimized because an error was encountered: The parameter is incorrect. (0x80070057)

 

Error: (02/17/2015 06:35:22 PM) (Source: Microsoft-Windows-Defrag) (EventID: 257) (User: )

Description: The volume System Reserved was not optimized because an error was encountered: The parameter is incorrect. (0x80070057)

 

Error: (02/17/2015 05:52:49 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: CHEEZUS)

Description: Activation of app Microsoft.BingWeather_8wekyb3d8bbwe!App failed with error: -2144927148 See the Microsoft-Windows-TWinUI/Operational log for additional information.

 

Error: (02/15/2015 11:43:39 PM) (Source: SideBySide) (EventID: 78) (User: )

Description: Activation context generation failed for "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1".Error in manifest or policy file "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" on line C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.

A component version required by the application conflicts with another component version already active.

Conflicting components are:.

Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.

Component 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.

 

Error: (02/15/2015 11:39:53 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: CHEEZUS)

Description: Activation of app Microsoft.BingWeather_8wekyb3d8bbwe!App failed with error: -2144927148 See the Microsoft-Windows-TWinUI/Operational log for additional information.

 

Error: (02/15/2015 10:30:20 PM) (Source: Microsoft-Windows-Defrag) (EventID: 257) (User: )

Description: The volume System Reserved was not optimized because an error was encountered: The parameter is incorrect. (0x80070057)

 

 

System errors:

=============

Error: (02/17/2015 05:51:46 PM) (Source: EventLog) (EventID: 6008) (User: )

Description: The previous system shutdown at 11:54:51 PM on ‎2/‎15/‎2015 was unexpected.

 

Error: (02/17/2015 05:51:38 PM) (Source: Microsoft-Windows-Kernel-Boot) (EventID: 29) (User: NT AUTHORITY)

Description: 32212265134654060922767456

 

Error: (01/29/2015 11:08:26 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: The Steam Client Service service failed to start due to the following error: 

%%1053

 

Error: (01/29/2015 11:08:26 PM) (Source: Service Control Manager) (EventID: 7009) (User: )

Description: A timeout was reached (30000 milliseconds) while waiting for the Steam Client Service service to connect.

 

Error: (01/28/2015 11:16:09 PM) (Source: DCOM) (EventID: 10010) (User: CHEEZUS)

Description: {9BA05972-F6A8-11CF-A442-00A0C90A8F39}

 

Error: (01/28/2015 11:01:50 PM) (Source: DCOM) (EventID: 10010) (User: CHEEZUS)

Description: App.AppXn2yw9nedj8p3sqs8gycmwj7bwjbftkqa.mca

 

Error: (01/28/2015 11:01:49 PM) (Source: DCOM) (EventID: 10010) (User: CHEEZUS)

Description: Microsoft.WindowsLive.Mail.AppXj3e9v0xw9sf8t58nqr15tqqb2yq4zsfg.mca

 

Error: (01/28/2015 11:01:49 PM) (Source: DCOM) (EventID: 10010) (User: CHEEZUS)

Description: Microsoft.WindowsLive.Mail.AppXj3e9v0xw9sf8t58nqr15tqqb2yq4zsfg.mca

 

Error: (01/28/2015 11:01:49 PM) (Source: DCOM) (EventID: 10010) (User: CHEEZUS)

Description: Microsoft.WindowsLive.Mail.AppXj3e9v0xw9sf8t58nqr15tqqb2yq4zsfg.mca

 

Error: (01/28/2015 11:01:49 PM) (Source: DCOM) (EventID: 10010) (User: CHEEZUS)

Description: Microsoft.WindowsLive.Mail.AppXj3e9v0xw9sf8t58nqr15tqqb2yq4zsfg.mca

 

 

Microsoft Office Sessions:

=========================

Error: (02/20/2015 08:19:02 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: CHEEZUS)

Description: Microsoft.BingWeather_8wekyb3d8bbwe!App-2144927148

 

Error: (02/17/2015 11:42:26 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: CHEEZUS)

Description: Microsoft.BingWeather_8wekyb3d8bbwe!App-2144927148

 

Error: (02/17/2015 09:42:26 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: CHEEZUS)

Description: Microsoft.BingWeather_8wekyb3d8bbwe!App-2144927148

 

Error: (02/17/2015 07:42:26 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: CHEEZUS)

Description: Microsoft.BingWeather_8wekyb3d8bbwe!App-2144927148

 

Error: (02/17/2015 07:33:07 PM) (Source: Microsoft-Windows-Defrag) (EventID: 257) (User: )

Description: System ReservedThe parameter is incorrect. (0x80070057)

 

Error: (02/17/2015 06:35:22 PM) (Source: Microsoft-Windows-Defrag) (EventID: 257) (User: )

Description: System ReservedThe parameter is incorrect. (0x80070057)

 

Error: (02/17/2015 05:52:49 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: CHEEZUS)

Description: Microsoft.BingWeather_8wekyb3d8bbwe!App-2144927148

 

Error: (02/15/2015 11:43:39 PM) (Source: SideBySide) (EventID: 78) (User: )

Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestD:\$RECYCLE.BIN\S-1-5-21-1912583399-466474933-4168976199-1001\$RYADANV.exe

 

Error: (02/15/2015 11:39:53 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: CHEEZUS)

Description: Microsoft.BingWeather_8wekyb3d8bbwe!App-2144927148

 

Error: (02/15/2015 10:30:20 PM) (Source: Microsoft-Windows-Defrag) (EventID: 257) (User: )

Description: System ReservedThe parameter is incorrect. (0x80070057)

 

 

CodeIntegrity Errors:

===================================

  Date: 2015-02-17 19:37:30.713

  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

 

  Date: 2015-02-17 19:37:30.625

  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

 

  Date: 2015-02-17 19:37:30.440

  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

 

  Date: 2015-02-17 19:37:30.354

  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

 

  Date: 2015-02-17 19:36:24.036

  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

 

  Date: 2015-02-17 19:36:23.945

  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

 

  Date: 2015-02-17 18:39:21.026

  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

 

  Date: 2015-02-17 18:39:20.942

  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

 

  Date: 2015-02-17 18:39:20.746

  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

 

  Date: 2015-02-17 18:39:20.659

  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

 

 

==================== Memory info =========================== 

 

Processor: Intel® Core™ i5-4590 CPU @ 3.30GHz

Percentage of memory in use: 17%

Total physical RAM: 16335.38 MB

Available physical RAM: 13449.29 MB

Total Pagefile: 18767.38 MB

Available Pagefile: 15339.68 MB

Total Virtual: 131072 MB

Available Virtual: 131071.84 MB

 

==================== Drives ================================

 

Drive c: () (Fixed) (Total:111.45 GB) (Free:65.02 GB) NTFS

Drive d: (Teletraan 1) (Fixed) (Total:931.51 GB) (Free:839.43 GB) NTFS

 

==================== MBR & Partition Table ==================

 

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 111.8 GB) (Disk ID: 4E45CCD4)

Partition 1: (Active) - (Size=350 MB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=111.4 GB) - (Type=07 NTFS)

 

========================================================

Disk: 1 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: 117211BF)

Partition 1: (Not Active) - (Size=931.5 GB) - (Type=07 NTFS)

 

==================== End Of Log ============================

[lordcheezus]

# AdwCleaner v4.111 - Logfile created 20/02/2015 at 20:33:50

# Updated 18/02/2015 by Xplode

# Database : 2015-02-18.3 [Server]

# Operating system : Windows 8.1 Pro N  (x64)

# Username : Anthony - CHEEZUS

# Running from : C:\Users\Anthony\Desktop\AdwCleaner.exe

# Option : Cleaning

 

***** [ Services ] *****

 

 

***** [ Files / Folders ] *****

 

Folder Deleted : C:\ProgramData\OnlineLowDeals

Folder Deleted : C:\ProgramData\62e80b73000079b4

Folder Deleted : C:\ProgramData\79f6df4a00001f62

Folder Deleted : C:\Program Files (x86)\globalUpdate

Folder Deleted : C:\Program Files (x86)\predm

Folder Deleted : C:\Users\Anthony\AppData\Local\globalUpdate

Folder Deleted : C:\Users\Anthony\AppData\Local\Google\Chrome\User Data\Default\Extensions\algjnflpgoopkdijmkalfcifomdhmcbe

 

***** [ Scheduled tasks ] *****

 

 

***** [ Shortcuts ] *****

 

 

***** [ Registry ] *****

 

Key Deleted : HKLM\SOFTWARE\Classes\globalUpdate.OneClickProcessLauncherMachine

Key Deleted : HKLM\SOFTWARE\Classes\globalUpdate.OneClickProcessLauncherMachine.1.0

Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoCreateAsync

Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoCreateAsync.1.0

Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoreClass

Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoreClass.1

Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoreMachineClass

Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoreMachineClass.1

Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CredentialDialogMachine

Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CredentialDialogMachine.1.0

Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassMachine

Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassMachine.1.0

Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassMachineFallback

Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassMachineFallback.1.0

Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassSvc

Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassSvc.1.0

Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.ProcessLauncher

Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.ProcessLauncher.1.0

Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3COMClassService

Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3COMClassService.1.0

Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebMachine

Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebMachine.1.0

Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebMachineFallback

Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebMachineFallback.1.0

Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebSvc

Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebSvc.1.0

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{3278F5CF-48F3-4253-A6BB-004CE84AF492}

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{577975B8-C40E-43E6-B0DE-4C6B44088B52}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{02A96331-0CA6-40E2-A87D-C224601985EB}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3278F5CF-48F3-4253-A6BB-004CE84AF492}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3B5702BA-7F4C-4D1A-B026-1E9A01D43978}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{577975B8-C40E-43E6-B0DE-4C6B44088B52}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{5E89ACE9-E16B-499A-87B4-0DBF742404C1}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{69F256DF-BA98-45E9-86EA-FC3CFECF9D30}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{6E87FC94-9866-49B9-8E93-5736D6DE3DD7}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{7E49F793-B3CD-4BF7-8419-B34B8BD30E61}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{834469E3-CA2B-4F21-A5CA-4F6F4DBCDE87}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{8529FAA3-5BFD-43C1-AB35-B53C4B96C6E5}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{ADBC39BE-3D20-4333-8D99-E91EB1B62474}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E06CA7F5-BA34-4FF6-8D24-B1BDC594D91F}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{F6421EE5-A5BE-4D31-81D5-C16B7BF48E4C}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{FD8E81D0-F5FE-4CB1-9AEA-1E163D2BAB78}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE07101B-46D4-4A98-AF68-0333EA26E113}

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5E89ACE9-E16B-499A-87B4-0DBF742404C1}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}

Key Deleted : HKCU\Software\GlobalUpdate

Key Deleted : HKCU\Software\Tutorials

Key Deleted : HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}

Key Deleted : HKCU\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}

Key Deleted : HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}

Key Deleted : HKLM\SOFTWARE\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}

Key Deleted : HKLM\SOFTWARE\{6791A2F3-FC80-475C-A002-C014AF797E9C}

Key Deleted : HKLM\SOFTWARE\GlobalUpdate

Key Deleted : HKLM\SOFTWARE\NpApp

Key Deleted : HKLM\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}

Key Deleted : HKLM\SOFTWARE\{12A61307-94CD-4F8E-94BC-918E511FAA81}

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\649A52D257CA5DB4EAAE8BA9EB23E467

 

***** [ Web browsers ] *****

 

-\\ Internet Explorer v11.0.9600.17416

 

 

-\\ Google Chrome v40.0.2214.93

 

 

*************************

 

AdwCleaner[R0].txt - [5749 bytes] - [20/02/2015 20:32:13]

AdwCleaner[S0].txt - [5711 bytes] - [20/02/2015 20:33:50]

 

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [5770  bytes] ##########

[BrianDrab]

Great thanks. Let me know how your machine is running after this.
 
Step#1 - Warnings
The Dangers of P2P Programs
IMPORTANT: I noticed that you have a P2P (Peer to Peer) file sharing program on your computer. I cannot stress highly enough the danger in using these types of programs. P2P programs are one of the major avenues of infection these days. The files downloaded with these programs are more than likely infected with trojans, malware, rootkits, etc.
You run the risk of getting an infection that can compromise your sensitive data, such as financial records, personal information, etc. That is just the infection aspect of using P2P programs. You also run the risk of possible arrest, fines, or in severe cases, jail time for illegal downloading of copyrighted material.
Here are some information sources about the dangers of P2P programs:
 
FBI - Peer to Peer Scams
USA Today Artticle on P2P Programs
File Sharing Infects 500,000 Computers
 
I very much recommend you uninstall this program from your machine. If not, you will likely be back needing help with your machine again. The risks of infections from content downloaded with P2P programs far outweigh any benefit of using them.
 
It is, of course, your choice as to whether or not you remove the program from your machine. It is my duty though, to point out how dangerous it is to use these programs. However, I must request that you do not use it while we are cleaning your machine.
Please uninstall the following Peer-to-Peer program(s): BitTorrent

 

 

 Step#2 - FRST Fix
NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system
1. Download attached file and save it to the Desktop.  fixlist.txt   1.75KB   228 downloads
Note. It's important that both files, FRST64 and fixlist.txt are in the same location or the fix will not work (in this case...the desktop).
2. Run FRST64 by Right-Clicking on the file and choosing Run as administrator.
3. Press the Fix button just once and wait. If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
4. When finished FRST64 will generate a log on the Desktop (Fixlog.txt). Please post the contents of it in your reply.

 

Step#3 - Rootkit Scan
1. Download aswMBR to your desktop.
2. Right-click on aswMBR.exe and select Run as administrator to run it.
3. If you get a question about Virtualization Technology, answer Yes.
4. If you see this question: Would you like to download latest Avast! virus definitions?" say "Yes".
5. Click the "Scan" button to start scan.
6. On completion of the scan click "Save log", save it to your desktop and post in your next reply.
NOTE. aswMBR will create MBR.dat file on your desktop. This is a copy of your MBR. Do NOT delete it.

 

 

 

Items for your next post

1. FRST Fix Log

2. Rootkit Scan log

[lordcheezus]

I ran FRST, computer restarted, then opened Chrome to come back to the site before running Rootkit and my standard homepage opened, along with separate page for adblock saying was downloading and as soon as it was done, more of the forced ads by the malware showed up, so, I removed the extension in chrome and ran Rootkit. Here are both logs.

 

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 18-02-2015 01

Ran by Anthony at 2015-02-20 23:13:16 Run:1

Running from C:\Users\Anthony\Desktop

Loaded Profiles: Anthony (Available profiles: Anthony)

Boot Mode: Normal

==============================================

 

Content of fixlist:

*****************

CreateRestorePoint:

CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

HKU\S-1-5-21-1912583399-466474933-4168976199-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION

R2 db79edbd; c:\Program Files (x86)\LighterSystem\LighterSystem.dll [1582592 2015-02-17] () [File not signed]

c:\Program Files (x86)\LighterSystem

R2 f291fddf; c:\Program Files (x86)\TurboStrength\TurboStrength.dll [1626112 2015-02-17] () [File not signed]

c:\Program Files (x86)\TurboStrength

2015-02-17 21:22 - 2015-02-17 21:22 - 00000000 ____D () C:\ProgramData\OnlineLowDeals

2015-02-17 21:22 - 2015-02-17 21:22 - 00000000 ____D () C:\ProgramData\cheap-o

2015-01-28 22:54 - 2015-02-17 21:02 - 00000000 ____D () C:\ProgramData\62e80b73000079b4

2015-01-28 22:52 - 2015-02-17 21:02 - 00000000 ____D () C:\ProgramData\79f6df4a00001f62

2015-01-28 22:50 - 2015-01-28 22:50 - 00000000 ____D () C:\Program Files (x86)\predm

2015-01-28 22:48 - 2015-02-20 20:17 - 00001710 _____ () C:\Windows\Tasks\KTMJRRLI.job

2015-01-28 22:48 - 2015-01-28 23:16 - 00000000 ____D () C:\Program Files (x86)\globalUpdate

2015-01-28 22:48 - 2015-01-28 22:48 - 00004720 _____ () C:\Windows\System32\Tasks\KTMJRRLI

2015-01-28 22:48 - 2015-01-28 22:48 - 00000000 ____D () C:\Users\Anthony\AppData\Local\globalUpdate

2015-01-25 10:12 - 2015-01-25 10:12 - 00001248 _____ () C:\Users\Anthony\AppData\Roaming\KTMJRRLI

2015-02-17 21:22 - 2015-02-17 21:36 - 0000020 _____ () C:\Users\Anthony\AppData\Roaming\appdataFr3.bin

Task: {9103C8FD-1072-4068-A719-9B6F4BFF2522} - System32\Tasks\KTMJRRLI => C:\Users\Anthony\AppData\Roaming\KTMJRRLI.exe <==== ATTENTION

Task: C:\Windows\Tasks\KTMJRRLI.job => C:\Users\Anthony\AppData\Roaming\KTMJRRLI.exe <==== ATTENTION

EmptyTemp:

 

 

*****************

 

Restore point was successfully created.

"HKLM\SOFTWARE\Policies\Google" => Key deleted successfully.

"HKU\S-1-5-21-1912583399-466474933-4168976199-1001\SOFTWARE\Policies\Microsoft\Internet Explorer" => Key deleted successfully.

db79edbd => Service deleted successfully.

c:\Program Files (x86)\LighterSystem => Moved successfully.

f291fddf => Service deleted successfully.

c:\Program Files (x86)\TurboStrength => Moved successfully.

"C:\ProgramData\OnlineLowDeals" => File/Directory not found.

C:\ProgramData\cheap-o => Moved successfully.

"C:\ProgramData\62e80b73000079b4" => File/Directory not found.

"C:\ProgramData\79f6df4a00001f62" => File/Directory not found.

"C:\Program Files (x86)\predm" => File/Directory not found.

C:\Windows\Tasks\KTMJRRLI.job => Moved successfully.

"C:\Program Files (x86)\globalUpdate" => File/Directory not found.

C:\Windows\System32\Tasks\KTMJRRLI => Moved successfully.

"C:\Users\Anthony\AppData\Local\globalUpdate" => File/Directory not found.

C:\Users\Anthony\AppData\Roaming\KTMJRRLI => Moved successfully.

C:\Users\Anthony\AppData\Roaming\appdataFr3.bin => Moved successfully.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{9103C8FD-1072-4068-A719-9B6F4BFF2522}" => Key deleted successfully.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{9103C8FD-1072-4068-A719-9B6F4BFF2522}" => Key deleted successfully.

C:\Windows\System32\Tasks\KTMJRRLI not found.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\KTMJRRLI" => Key deleted successfully.

C:\Windows\Tasks\KTMJRRLI.job not found.

EmptyTemp: => Removed 1.4 GB temporary data.

 

 

The system needed a reboot. 

 

==== End of Fixlog 23:13:33 ====

aswMBR version 1.0.1.2252 Copyright© 2014 AVAST Software

Run date: 2015-02-20 23:17:47

-----------------------------

23:17:47.083    OS Version: Windows x64 6.2.9200 

23:17:47.083    Number of processors: 4 586 0x3C03

23:17:47.084    ComputerName: CHEEZUS  UserName: Anthony

23:17:47.242    Initialize success

23:17:47.245    VM: initialized successfully

23:17:47.247    VM: Intel CPU supported 

23:17:48.771    VM: supported disk I/O storport.sys

23:25:19.902    AVAST engine defs: 15022001

23:25:25.571    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\00000029

23:25:25.573    Disk 0 Vendor: KINGSTON_SV300S37A120G 527ABBF0 Size: 114473MB BusType: 11

23:25:25.574    Disk 1  \Device\Harddisk1\DR1 -> \Device\0000002a

23:25:25.575    Disk 1 Vendor: ST1000DM003-1ER162 CC43 Size: 953869MB BusType: 11

23:25:25.585    VM: Disk 0 MBR read successfully

23:25:25.586    Disk 0 MBR scan

23:25:25.590    Disk 0 Windows 7 default MBR code

23:25:25.592    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS          350 MB offset 2048

23:25:25.605    Disk 0 Partition 2 00     07    HPFS/NTFS NTFS       114121 MB offset 718848

23:25:25.634    Disk 0 scanning C:\Windows\system32\drivers

23:25:29.841    Service scanning

23:25:40.795    Modules scanning

23:25:40.805    Disk 0 trace - called modules:

23:25:40.822    ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys storport.sys hal.dll storahci.sys 

23:25:40.831    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xffffe000bd8a1060]

23:25:40.836    3 CLASSPNP.SYS[fffff8019614b27b] -> nt!IofCallDriver -> [0xffffe000bced68f0]

23:25:40.841    5 ACPI.sys[fffff801957667aa] -> nt!IofCallDriver -> [0xffffe000bced8d60]

23:25:40.846    7 ACPI.sys[fffff801957667aa] -> nt!IofCallDriver -> \Device\00000029[0xffffe000bced6060]

23:25:40.979    AVAST engine scan C:\Windows

23:25:41.373    AVAST engine scan C:\Windows\system32

23:27:04.844    AVAST engine scan C:\Windows\system32\drivers

23:27:10.134    AVAST engine scan C:\Users\Anthony

23:27:48.069    AVAST engine scan C:\ProgramData

23:27:59.728    Disk 0 statistics 3412719/0/9 @ 60.77 MB/s

23:27:59.732    Scan finished successfully

23:28:36.107    Disk 0 MBR fix error

23:28:39.401    Disk 0 MBR fix error

23:28:44.496    Disk 0 MBR has been saved successfully to "C:\Users\Anthony\Desktop\MBR.dat"

23:28:44.512    The log file has been saved successfully to "C:\Users\Anthony\Desktop\aswMBR.txt"

 

 

[BrianDrab]

Thanks for the info. I know you have already run Malwarebytes but I would like you to run it again using a slightly different option set. Please follow the instructions below. Thank you.

 

Step#1 - Retrieve Current Malwarebytes log 
I'd like to see the results of the last scan that you did. So please post the log following the instructions below.

1. Open up the Malwarebytes program again. You can simply double click on the shortcut on your desktop that says "Malwarebytes Anti-Malware". Don't double-click on the mbam-setup file as the program is already installed.
2. Click the History button as shown in the picture below.
3. Click Application Logs as shown in the picture below.
4. Put a check mark next to Scan Log as shown in the picture below.
5. Click the view button as shown in the picture below.

 

Step#2 - Malwarebytes Scan

• Open up Malwarebytes again so we can do a scan using a slightly different default options set.
• If an update is found you will be prompted to download and install. Go ahead.
• Click the Settings button and then the Detection and Protection tab. Then check the box to Scan for rootkits. as shown below.
• 
   
• Click the Scan button at the top of the form and then click Scan Now.
  
• If anything is detected, there will be an Apply Actions button. Please click this.
• Once the scan completes click the View detailed log link.
  
• Then click the Copy to clipboard button and paste into your next post.
  

 

 

Step#3 - JRT
1. Download Junkware Removal Tool to your desktop.
2. Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
3, The tool will open and start scanning your system.
4. Please be patient as this can take a while to complete depending on your system's specifications.
5. On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
6. Close the text file and reboot your machine.
7. After your machine is rebooted, please re-enable your antivirus.
8. Post the contents of JRT.txt into your next message.

 

 

Step#4 - Fresh Set of Logs
1. Right click on FRST64.exe and select Run as administrator. When the tool opens click Yes to disclaimer.
2. Please ensure you place a check mark in the Addition.txt check box at the bottom of the form before running.
3. Press Scan button.
4. It will produce a log called FRST.txt in the same directory the tool is run from (which should now be the desktop)
5. Please copy and paste log back here.
6. Because you selected the Addition.txt check box this log will be created as well. Please copy and paste this log as well.
 
 

 

 

Items for your next post

1. Existing Malwarebytes log

2. New Malwarebytes log

3. Junkware log

4. FRST and Addition logs

 

 

 

[lordcheezus]

Last Malwarebytes log: Malwarebytes Anti-Malware

www.malwarebytes.org

 

Scan Date: 2/17/2015

Scan Time: 9:12:42 PM

Logfile: 

Administrator: Yes

 

Version: 2.00.4.1028

Malware Database: v2015.02.18.01

Rootkit Database: v2015.02.03.01

License: Free

Malware Protection: Disabled

Malicious Website Protection: Disabled

Self-protection: Disabled

 

OS: Windows 8.1

CPU: x64

File System: NTFS

User: Anthony

 

Scan Type: Threat Scan

Result: Completed

Objects Scanned: 327664

Time Elapsed: 3 min, 23 sec

 

Memory: Enabled

Startup: Enabled

Filesystem: Enabled

Archives: Enabled

Rootkits: Disabled

Heuristics: Enabled

PUP: Enabled

PUM: Enabled

 

Processes: 0

(No malicious items detected)

 

Modules: 0

(No malicious items detected)

 

Registry Keys: 0

(No malicious items detected)

 

Registry Values: 0

(No malicious items detected)

 

Registry Data: 0

(No malicious items detected)

 

Folders: 0

(No malicious items detected)

 

Files: 0

(No malicious items detected)

 

Physical Sectors: 0

(No malicious items detected)

 

 

(end)

 

New Malwarebytes Log: 

Malwarebytes Anti-Malware

www.malwarebytes.org

 

Scan Date: 2/21/2015

Scan Time: 9:15:12 PM

Logfile: 

Administrator: Yes

 

Version: 2.00.4.1028

Malware Database: v2015.02.22.02

Rootkit Database: v2015.02.20.01

License: Free

Malware Protection: Disabled

Malicious Website Protection: Disabled

Self-protection: Disabled

 

OS: Windows 8.1

CPU: x64

File System: NTFS

User: Anthony

 

Scan Type: Threat Scan

Result: Completed

Objects Scanned: 327482

Time Elapsed: 3 min, 35 sec

 

Memory: Enabled

Startup: Enabled

Filesystem: Enabled

Archives: Enabled

Rootkits: Enabled

Heuristics: Enabled

PUP: Enabled

PUM: Enabled

 

Processes: 0

(No malicious items detected)

 

Modules: 0

(No malicious items detected)

 

Registry Keys: 0

(No malicious items detected)

 

Registry Values: 0

(No malicious items detected)

 

Registry Data: 0

(No malicious items detected)

 

Folders: 0

(No malicious items detected)

 

Files: 0

(No malicious items detected)

 

Physical Sectors: 0

(No malicious items detected)

 

 

(end)

 

Junkware Log:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 6.4.2 (02.02.2015:1)

OS: Windows 8.1 Pro N x64

Ran by Anthony on Sat 02/21/2015 at 21:20:47.00

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

 

 

 

~~~ Services

 

 

 

~~~ Registry Values

 

 

 

~~~ Registry Keys

 

 

 

~~~ Files

 

 

 

~~~ Folders

 

 

 

~~~ Chrome

 

Successfully deleted: [Folder] C:\Users\Anthony\appdata\local\Google\Chrome\User Data\Default\Extensions\gkojfkhlekighikafcpjkiklfbnlmeio

 

 

 

~~~ Event Viewer Logs were cleared

 

 

 

 

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on Sat 02/21/2015 at 21:21:51.75

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

FRST Log: Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 18-02-2015 01

Ran by Anthony (administrator) on CHEEZUS on 21-02-2015 21:24:30

Running from C:\Users\Anthony\Desktop

Loaded Profiles: Anthony (Available profiles: Anthony)

Platform: Windows 8.1 Pro N (X64) OS Language: English (United States)

Internet Explorer Version 11 (Default browser: Chrome)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/

 

==================== Processes (Whitelisted) =================

 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

 

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe

(Microsoft Corporation) C:\Windows\System32\dasHost.exe

() C:\Program Files\Intel\Intel® Smart Connect Technology Agent\iSCTAgent.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

(Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe

(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe

(Pixart Imaging Inc) C:\Windows\System32\TiltWheelMouse.exe

(Intel Corporation) C:\Program Files\Intel\Intel® Smart Connect Technology Agent\iSCTsysTray8.exe

(Spotify Ltd) C:\Users\Anthony\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe

(Spotify Ltd) C:\Users\Anthony\AppData\Roaming\Spotify\spotify.exe

() C:\Users\Anthony\AppData\Roaming\Spotify\Data\SpotifyHelper.exe

() C:\Users\Anthony\AppData\Roaming\Spotify\Data\SpotifyHelper.exe

() C:\Users\Anthony\AppData\Roaming\Spotify\Data\SpotifyHelper.exe

() C:\Users\Anthony\AppData\Roaming\Spotify\Data\SpotifyHelper.exe

() C:\Users\Anthony\AppData\Roaming\Spotify\Data\SpotifyHelper.exe

(Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe

(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Malwarebytes Corporation) D:\Malwarebytes Anti-Malware\mbam.exe

(Farbar) C:\Users\Anthony\Desktop\FRST64 (1).exe

 

 

==================== Registry (Whitelisted) ==================

 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

 

HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2585928 2015-01-16] (NVIDIA Corporation)

HKLM\...\Run: [MouseDriver] => C:\Windows\system32\TiltWheelMouse.exe [241152 2013-04-09] (Pixart Imaging Inc)

HKLM\...\Run: [ISCT Tray] => C:\Program Files\Intel\Intel® Smart Connect Technology Agent\iSCTsysTray8.exe [5860656 2014-06-18] (Intel Corporation)

HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart

HKU\S-1-5-21-1912583399-466474933-4168976199-1001\...\Run: [GoogleChromeAutoLaunch_2AA0595218EF30A2508F1E549DA19CC6] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [843592 2015-01-25] (Google Inc.)

HKU\S-1-5-21-1912583399-466474933-4168976199-1001\...\Run: [Spotify Web Helper] => C:\Users\Anthony\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1676344 2014-12-11] (Spotify Ltd)

HKU\S-1-5-21-1912583399-466474933-4168976199-1001\...\Run: [Spotify] => C:\Users\Anthony\AppData\Roaming\Spotify\spotify.exe [6737976 2014-12-11] (Spotify Ltd)

Startup: C:\Users\Anthony\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PdaNet Desktop.lnk

ShortcutTarget: PdaNet Desktop.lnk -> C:\Program Files (x86)\PdaNet for Android\PdaNetPC.exe ()

ShellIconOverlayIdentifiers: [ SkyDrivePro1 (ErrorConflict)] -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers: [ SkyDrivePro2 (SyncInProgress)] -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers: [ SkyDrivePro3 (InSync)] -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation)

 

==================== Internet (Whitelisted) ====================

 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

 

HKU\S-1-5-21-1912583399-466474933-4168976199-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/?ocid=iehp

SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\Office15\OCHelper.dll (Microsoft Corporation)

BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation)

BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)

BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll (Oracle Corporation)

BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)

BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll (Oracle Corporation)

Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation)

Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Microsoft Office\Office15\MSOSB.DLL (Microsoft Corporation)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

 

FireFox:

========

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)

FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> D:\Picasa3\npPicasa3.dll (Google, Inc.)

FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll (Microsoft Corporation)

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Microsoft Office\Office15\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)

FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> D:\VLC\npvlc.dll (VideoLAN)

 

Chrome: 

=======

CHR HomePage: Default -> hxxp://www.reddit.com/

CHR StartupUrls: Default -> "hxxp://www.reddit.com/"

CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:inputType}{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}{google:searchVersion}{google:sessionToken}{google:prefetchQuery}sugkey={google:suggestAPIKeyParameter}

CHR Profile: C:\Users\Anthony\AppData\Local\Google\Chrome\User Data\Default

CHR Extension: (Google Slides) - C:\Users\Anthony\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2014-10-08]

CHR Extension: (Rage Faces for Reddit ™) - C:\Users\Anthony\AppData\Local\Google\Chrome\User Data\Default\Extensions\ajjgiajaoafimgkdlcofflenackmpjhd [2014-10-08]

CHR Extension: (No Name) - C:\Users\Anthony\AppData\Local\Google\Chrome\User Data\Default\Extensions\algjnflpgoopkdijmkalfcifomdhmcbe [2015-02-20]

CHR Extension: (Google Docs) - C:\Users\Anthony\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-10-08]

CHR Extension: (Google Drive) - C:\Users\Anthony\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-10-08]

CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Anthony\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-10-08]

CHR Extension: (YouTube) - C:\Users\Anthony\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-10-08]

CHR Extension: (Google Search) - C:\Users\Anthony\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-10-08]

CHR Extension: (Google Sheets) - C:\Users\Anthony\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2014-10-08]

CHR Extension: (Reddit votes) - C:\Users\Anthony\AppData\Local\Google\Chrome\User Data\Default\Extensions\geedigenhgnhbebebbjlidlalocdggjl [2014-10-08]

CHR Extension: (AdBlock) - C:\Users\Anthony\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2014-10-08]

CHR Extension: (No Name) - C:\Users\Anthony\AppData\Local\Google\Chrome\User Data\Default\Extensions\gkojfkhlekighikafcpjkiklfbnlmeio [2015-02-21]

CHR Extension: (TinEye Reverse Image Search) - C:\Users\Anthony\AppData\Local\Google\Chrome\User Data\Default\Extensions\haebnnbpedcbhciplfhjjkbafijpncjl [2014-10-08]

CHR Extension: (Reddit Enhancement Suite) - C:\Users\Anthony\AppData\Local\Google\Chrome\User Data\Default\Extensions\kbmfpngjjgdllneeigpgjifpgocmfgmb [2014-10-08]

CHR Extension: (Reddit NSFW Filter) - C:\Users\Anthony\AppData\Local\Google\Chrome\User Data\Default\Extensions\mjpnnnikhngjjoapjdcdfepkenphaobi [2014-10-08]

CHR Extension: (Google Wallet) - C:\Users\Anthony\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-10-08]

CHR Extension: (Gmail) - C:\Users\Anthony\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-10-08]

 

==================== Services (Whitelisted) =================

 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

 

R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2449592 2014-11-12] (Microsoft Corporation)

R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1148744 2015-01-16] (NVIDIA Corporation)

R2 ISCTAgent; C:\Program Files\Intel\Intel® Smart Connect Technology Agent\iSCTAgent.exe [209712 2014-06-18] ()

R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1706312 2015-01-16] (NVIDIA Corporation)

R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [21833544 2015-01-16] (NVIDIA Corporation)

S3 Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [1910128 2015-02-06] (Electronic Arts)

R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-21] (Microsoft Corporation)

R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-21] (Microsoft Corporation)

 

==================== Drivers (Whitelisted) ====================

 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

 

R3 AE6000; C:\Windows\system32\DRIVERS\AE6000w864.sys [2377216 2015-02-13] (Ralink Technology Corp.)

R3 ikbevent; C:\Windows\system32\DRIVERS\ikbevent.sys [22216 2014-05-27] ()

R3 imsevent; C:\Windows\system32\DRIVERS\imsevent.sys [22728 2014-05-27] ()

R3 INETMON; C:\Windows\System32\Drivers\INETMON.sys [25800 2014-05-27] ()

R3 ISCT; C:\Windows\System32\drivers\ISCTD.sys [44744 2014-05-27] ()

R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-02-21] (Malwarebytes Corporation)

R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [129312 2014-09-30] (Intel Corporation)

R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19784 2015-01-16] (NVIDIA Corporation)

R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [38032 2014-11-22] (NVIDIA Corporation)

R3 t_mouse.sys; C:\Windows\system32\DRIVERS\t_mouse.sys [6144 2013-04-09] ()

R3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-21] (Microsoft Corporation)

S3 xb1usb; C:\Windows\System32\drivers\xb1usb.sys [34016 2014-05-28] (Microsoft Corporation)

S3 andnetadb; \SystemRoot\System32\Drivers\lgandnetadb.sys [X]

S3 AndNetDiag; \SystemRoot\system32\DRIVERS\lgandnetdiag64.sys [X]

S3 ANDNetModem; \SystemRoot\system32\DRIVERS\lgandnetmodem64.sys [X]

S3 LgBttPort; \SystemRoot\system32\DRIVERS\lgbtpt64.sys [X]

S3 lgbusenum; \SystemRoot\System32\drivers\lgbtbs64.sys [X]

S3 LGVMODEM; \SystemRoot\system32\DRIVERS\lgvmdm64.sys [X]

S3 usbbus; \SystemRoot\System32\drivers\lgx64bus.sys [X]

S3 UsbDiag; \SystemRoot\system32\DRIVERS\lgx64diag.sys [X]

S3 USBModem; \SystemRoot\system32\DRIVERS\lgx64modem.sys [X]

U3 aswMBR; \??\C:\Users\Anthony\AppData\Local\Temp\aswMBR.sys [X]

U3 aswVmm; \??\C:\Users\Anthony\AppData\Local\Temp\aswVmm.sys [X]

 

==================== NetSvcs (Whitelisted) ===================

 

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)

 

 

==================== One Month Created Files and Folders ========

 

(If an entry is included in the fixlist, the file\folder will be moved.)

 

2015-02-21 21:21 - 2015-02-21 21:21 - 00000789 _____ () C:\Users\Anthony\Desktop\JRT.txt

2015-02-21 21:19 - 2015-02-21 21:19 - 01388274 _____ (Thisisu) C:\Users\Anthony\Desktop\JRT.exe

2015-02-20 23:28 - 2015-02-20 23:28 - 00002425 _____ () C:\Users\Anthony\Desktop\aswMBR.txt

2015-02-20 23:15 - 2015-02-20 23:28 - 00000512 _____ () C:\Users\Anthony\Desktop\MBR.dat

2015-02-20 23:14 - 2015-02-20 23:16 - 00000020 _____ () C:\Users\Anthony\AppData\Roaming\appdataFr3.bin

2015-02-20 23:13 - 2015-02-20 23:13 - 05198336 _____ (AVAST Software) C:\Users\Anthony\Desktop\aswMBR.exe

2015-02-20 20:32 - 2015-02-20 20:33 - 00000000 ____D () C:\AdwCleaner

2015-02-20 20:31 - 2015-02-20 20:31 - 02126848 _____ () C:\Users\Anthony\Desktop\AdwCleaner.exe

2015-02-20 20:31 - 2015-02-20 20:31 - 00024873 _____ () C:\Users\Anthony\Desktop\Addition.txt

2015-02-20 20:30 - 2015-02-21 21:24 - 00016478 _____ () C:\Users\Anthony\Desktop\FRST.txt

2015-02-20 20:30 - 2015-02-20 20:30 - 02086912 _____ (Farbar) C:\Users\Anthony\Desktop\FRST64 (1).exe

2015-02-17 22:18 - 2015-02-21 21:24 - 00000000 ____D () C:\FRST

2015-02-13 23:33 - 2015-02-13 23:33 - 00002149 _____ () C:\Users\Public\Desktop\3D Vision Photo Viewer.lnk

2015-02-13 23:33 - 2015-02-13 23:33 - 00000000 ____D () C:\Windows\LastGood.Tmp

2015-02-13 23:33 - 2015-02-05 11:57 - 00621384 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe

2015-02-13 23:32 - 2015-02-05 15:01 - 32106640 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll

2015-02-13 23:32 - 2015-02-05 15:01 - 25460880 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll

2015-02-13 23:32 - 2015-02-05 15:01 - 24768144 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll

2015-02-13 23:32 - 2015-02-05 15:01 - 20466496 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll

2015-02-13 23:32 - 2015-02-05 15:01 - 17253848 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll

2015-02-13 23:32 - 2015-02-05 15:01 - 13294528 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll

2015-02-13 23:32 - 2015-02-05 15:01 - 13208200 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll

2015-02-13 23:32 - 2015-02-05 15:01 - 10773704 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll

2015-02-13 23:32 - 2015-02-05 15:01 - 10713256 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll

2015-02-13 23:32 - 2015-02-05 15:01 - 10284872 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys

2015-02-13 23:32 - 2015-02-05 15:01 - 03610768 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll

2015-02-13 23:32 - 2015-02-05 15:01 - 03247248 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll

2015-02-13 23:32 - 2015-02-05 15:01 - 01895240 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6434752.dll

2015-02-13 23:32 - 2015-02-05 15:01 - 01557648 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6434752.dll

2015-02-13 23:32 - 2015-02-05 15:01 - 00995248 _____ (NVIDIA Corporation) C:\Windows\system32\nvumdshimx.dll

2015-02-13 23:32 - 2015-02-05 15:01 - 00969872 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll

2015-02-13 23:32 - 2015-02-05 15:01 - 00943760 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll

2015-02-13 23:32 - 2015-02-05 15:01 - 00929936 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll

2015-02-13 23:32 - 2015-02-05 15:01 - 00908104 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll

2015-02-13 23:32 - 2015-02-05 15:01 - 00877816 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll

2015-02-13 23:32 - 2015-02-05 15:01 - 00833680 _____ () C:\Windows\system32\nvmcumd.dll

2015-02-13 23:32 - 2015-02-05 15:01 - 00496272 _____ (NVIDIA Corporation) C:\Windows\system32\nvEncodeAPI64.dll

2015-02-13 23:32 - 2015-02-05 15:01 - 00399504 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvEncodeAPI.dll

2015-02-13 23:32 - 2015-02-05 15:01 - 00390472 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFROpenGL.dll

2015-02-13 23:32 - 2015-02-05 15:01 - 00353224 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll

2015-02-13 23:32 - 2015-02-05 15:01 - 00345744 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFROpenGL.dll

2015-02-13 23:32 - 2015-02-05 15:01 - 00305136 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll

2015-02-13 23:32 - 2015-02-05 15:01 - 00177624 _____ (NVIDIA Corporation) C:\Windows\system32\nvinitx.dll

2015-02-13 23:32 - 2015-02-05 15:01 - 00164752 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvinit.dll

2015-02-11 18:21 - 2015-01-22 22:41 - 06041600 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2015-02-11 18:21 - 2015-01-22 21:17 - 04300800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2015-02-10 20:09 - 2015-01-10 03:10 - 07472960 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe

2015-02-10 20:09 - 2015-01-10 03:10 - 01733440 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll

2015-02-10 20:09 - 2015-01-10 02:28 - 01498360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll

2015-02-10 20:09 - 2014-10-28 20:02 - 00285184 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll

2015-02-10 20:09 - 2014-10-28 20:02 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll

2015-02-10 20:09 - 2014-10-28 19:57 - 00016896 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll

2015-02-10 20:09 - 2014-10-28 19:15 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll

2015-02-10 20:09 - 2014-10-28 19:15 - 00005632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll

2015-02-10 20:09 - 2014-10-28 19:14 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe

2015-02-10 20:09 - 2014-10-28 19:13 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe

2015-02-10 20:09 - 2014-10-28 19:13 - 00008704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe

2015-02-10 18:55 - 2015-01-15 16:43 - 00563504 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys

2015-02-10 18:55 - 2015-01-15 16:43 - 00177984 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys

2015-02-10 18:55 - 2015-01-13 22:22 - 00445440 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll

2015-02-10 18:55 - 2015-01-13 21:53 - 00324096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll

2015-02-10 18:55 - 2015-01-13 16:11 - 01762840 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll

2015-02-10 18:55 - 2015-01-13 16:04 - 01489072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll

2015-02-10 18:55 - 2014-12-08 21:45 - 00393728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scesrv.dll

2015-02-10 18:55 - 2014-12-08 19:56 - 00538624 _____ (Microsoft Corporation) C:\Windows\system32\scesrv.dll

2015-02-10 18:55 - 2014-10-28 20:51 - 00154112 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll

2015-02-10 18:55 - 2014-10-28 20:50 - 00736768 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll

2015-02-10 18:55 - 2014-10-28 20:06 - 00736768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll

2015-02-10 18:55 - 2014-10-28 20:06 - 00154112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll

2015-02-10 18:55 - 2014-10-28 19:31 - 01441792 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll

2015-02-10 18:45 - 2015-01-10 02:22 - 04175872 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2015-02-10 18:40 - 2014-12-19 02:57 - 00788680 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll

2015-02-10 18:40 - 2014-12-19 02:25 - 00602776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll

2015-02-10 18:40 - 2014-12-08 17:12 - 00391526 _____ () C:\Windows\system32\ApnDatabase.xml

2015-02-10 18:34 - 2015-01-11 21:09 - 25056256 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2015-02-10 18:34 - 2015-01-11 20:48 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2015-02-10 18:34 - 2015-01-11 20:48 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2015-02-10 18:34 - 2015-01-11 20:47 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll

2015-02-10 18:34 - 2015-01-11 20:34 - 00816128 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll

2015-02-10 18:34 - 2015-01-11 20:25 - 19740160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2015-02-10 18:34 - 2015-01-11 20:21 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll

2015-02-10 18:34 - 2015-01-11 20:08 - 00503296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2015-02-10 18:34 - 2015-01-11 20:07 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2015-02-10 18:34 - 2015-01-11 20:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll

2015-02-10 18:34 - 2015-01-11 20:02 - 02277888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2015-02-10 18:34 - 2015-01-11 19:58 - 01032704 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll

2015-02-10 18:34 - 2015-01-11 19:55 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll

2015-02-10 18:34 - 2015-01-11 19:51 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll

2015-02-10 18:34 - 2015-01-11 19:48 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2015-02-10 18:34 - 2015-01-11 19:48 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2015-02-10 18:34 - 2015-01-11 19:48 - 00374272 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll

2015-02-10 18:34 - 2015-01-11 19:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2015-02-10 18:34 - 2015-01-11 19:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll

2015-02-10 18:34 - 2015-01-11 19:43 - 14401024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2015-02-10 18:34 - 2015-01-11 19:34 - 00128000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll

2015-02-10 18:34 - 2015-01-11 19:30 - 00880128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll

2015-02-10 18:34 - 2015-01-11 19:27 - 02865152 _____ (Microsoft Corporation) C:\Windows\system32\actxprxy.dll

2015-02-10 18:34 - 2015-01-11 19:27 - 02358272 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2015-02-10 18:34 - 2015-01-11 19:25 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll

2015-02-10 18:34 - 2015-01-11 19:23 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2015-02-10 18:34 - 2015-01-11 19:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2015-02-10 18:34 - 2015-01-11 19:23 - 00327168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll

2015-02-10 18:34 - 2015-01-11 19:14 - 12829184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2015-02-10 18:34 - 2015-01-11 19:14 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2015-02-10 18:34 - 2015-01-11 19:02 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2015-02-10 18:34 - 2015-01-11 19:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2015-02-10 18:34 - 2015-01-11 18:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2015-02-10 18:34 - 2015-01-11 18:55 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2015-02-10 18:34 - 2015-01-10 01:00 - 00430080 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll

2015-02-10 18:34 - 2015-01-10 00:38 - 00359424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll

2015-02-10 18:30 - 2015-01-19 12:42 - 01487976 _____ (Microsoft Corporation) C:\Windows\system32\sppobjs.dll

2015-02-10 18:29 - 2015-02-03 17:38 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll

2015-02-10 18:29 - 2015-02-03 17:08 - 00761856 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll

2015-02-10 18:29 - 2015-02-03 17:08 - 00414208 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll

2015-02-10 18:29 - 2015-02-02 17:11 - 01098752 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

2015-02-10 18:29 - 2015-02-02 17:11 - 00894464 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll

2015-02-10 18:29 - 2015-02-02 17:11 - 00609280 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll

2015-02-05 21:36 - 2015-02-05 21:36 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_TeeDriverx64_01011.Wdf

2015-01-28 23:08 - 2015-02-21 21:22 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2015-01-28 23:08 - 2015-01-28 23:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2015-01-28 23:08 - 2015-01-28 23:08 - 00000000 ____D () C:\ProgramData\Malwarebytes

2015-01-28 23:08 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2015-01-28 23:08 - 2014-11-21 06:14 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2015-01-28 23:08 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2015-01-28 22:44 - 2015-01-28 23:05 - 00000000 ____D () C:\Windows\system32\appmgmt

2015-01-28 22:44 - 2015-01-28 22:44 - 00001751 _____ () C:\ProgramData\tempimage.bmp

2015-01-24 17:48 - 2015-01-12 22:15 - 01540240 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdagenco6420103.dll

2015-01-24 17:48 - 2015-01-10 02:07 - 01895240 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6434725.dll

2015-01-24 17:48 - 2015-01-10 02:07 - 01556808 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6434725.dll

 

==================== One Month Modified Files and Folders =======

 

(If an entry is included in the fixlist, the file\folder will be moved.)

 

2015-02-21 21:21 - 2014-10-09 13:52 - 00000000 ____D () C:\Users\Anthony\AppData\Roaming\Spotify

2015-02-21 21:20 - 2014-10-08 13:56 - 01483506 _____ () C:\Windows\WindowsUpdate.log

2015-02-21 21:13 - 2014-10-08 19:01 - 00003930 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{48D22CF4-221F-43DB-AE16-D7853ED7FA36}

2015-02-21 21:11 - 2014-10-09 13:09 - 00000000 __RDO () C:\Users\Anthony\SkyDrive

2015-02-21 21:10 - 2013-08-22 09:36 - 00000000 ____D () C:\Windows\system32\sru

2015-02-20 23:19 - 2014-10-08 13:59 - 00863592 _____ () C:\Windows\system32\PerfStringBackup.INI

2015-02-20 23:13 - 2014-10-08 19:13 - 00000000 ____D () C:\ProgramData\NVIDIA

2015-02-20 23:13 - 2014-10-08 13:53 - 00039458 _____ () C:\Windows\PFRO.log

2015-02-20 23:13 - 2013-08-22 09:36 - 00000000 ____D () C:\Windows\AppReadiness

2015-02-20 23:13 - 2013-08-22 08:45 - 00035648 _____ () C:\Windows\setupact.log

2015-02-20 23:13 - 2013-08-22 08:45 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2015-02-20 23:13 - 2013-08-22 07:25 - 00262144 ___SH () C:\Windows\system32\config\BBI

2015-02-20 20:18 - 2014-10-09 14:01 - 00000000 ____D () C:\Users\Anthony\AppData\Local\Spotify

2015-02-17 18:35 - 2014-10-08 14:01 - 00003598 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1912583399-466474933-4168976199-1001

2015-02-15 23:54 - 2014-10-08 19:34 - 00000000 ____D () C:\Users\Anthony\AppData\Local\Battle.net

2015-02-15 19:58 - 2013-08-22 09:36 - 00000000 ____D () C:\Windows\rescache

2015-02-13 23:33 - 2014-10-22 21:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation

2015-02-13 22:04 - 2013-01-25 14:13 - 02377216 _____ (Ralink Technology Corp.) C:\Windows\system32\Drivers\AE6000w864.sys

2015-02-13 22:04 - 2013-01-25 14:13 - 00334000 _____ (Ralink Technology, Inc.) C:\Windows\system32\RaCoInstx.dll

2015-02-13 22:04 - 2013-01-25 14:13 - 00014172 _____ () C:\Windows\system32\RaCoInst.dat

2015-02-12 19:15 - 2013-08-22 09:20 - 00000000 ____D () C:\Windows\CbsTemp

2015-02-11 18:09 - 2013-08-22 08:44 - 00481880 _____ () C:\Windows\system32\FNTCACHE.DAT

2015-02-10 19:02 - 2014-10-09 18:34 - 00000000 ____D () C:\Windows\system32\MRT

2015-02-10 19:00 - 2014-12-11 02:23 - 00000000 ____D () C:\Windows\system32\appraiser

2015-02-10 19:00 - 2014-10-16 22:07 - 00000000 ___SD () C:\Windows\system32\CompatTel

2015-02-10 19:00 - 2014-10-09 18:34 - 116773704 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2015-02-08 20:24 - 2014-10-08 13:56 - 00000000 ____D () C:\Users\Anthony\AppData\Local\Packages

2015-02-07 00:24 - 2014-10-08 19:27 - 00000000 ____D () C:\ProgramData\Origin

2015-02-06 22:43 - 2014-10-08 19:42 - 00000000 ____D () C:\Users\Anthony\AppData\Roaming\Origin

2015-02-06 22:42 - 2014-10-08 19:27 - 00000000 ____D () C:\Program Files (x86)\Origin

2015-02-05 15:01 - 2015-01-21 22:21 - 02902784 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvapi.dll

2015-02-05 15:01 - 2014-10-22 21:25 - 14119744 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvd3dum.dll

2015-02-05 15:01 - 2014-10-08 19:12 - 00074056 _____ (Khronos Group) C:\Windows\system32\OpenCL.dll

2015-02-05 15:01 - 2014-10-08 19:12 - 00060560 _____ (Khronos Group) C:\Windows\SysWOW64\OpenCL.dll

2015-02-05 15:01 - 2014-08-19 23:15 - 18575880 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll

2015-02-05 15:01 - 2014-08-19 23:15 - 16017040 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll

2015-02-05 15:01 - 2014-08-19 23:14 - 03299512 _____ (NVIDIA Corporation) C:\Windows\system32\nvapi64.dll

2015-02-05 15:01 - 2014-08-19 23:14 - 00027441 _____ () C:\Windows\system32\nvinfo.pb

2015-02-05 13:07 - 2014-10-08 19:12 - 06861128 _____ (NVIDIA Corporation) C:\Windows\system32\nvcpl.dll

2015-02-05 13:07 - 2014-10-08 19:12 - 03517584 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvc64.dll

2015-02-05 13:07 - 2014-10-08 19:12 - 02558792 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvcr.dll

2015-02-05 13:07 - 2014-10-08 19:12 - 00935056 _____ (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe

2015-02-05 13:07 - 2014-10-08 19:12 - 00062792 _____ (NVIDIA Corporation) C:\Windows\system32\nvshext.dll

2015-02-05 13:06 - 2014-10-08 19:12 - 00385168 _____ (NVIDIA Corporation) C:\Windows\system32\nvmctray.dll

2015-02-05 06:50 - 2014-10-08 19:12 - 04236870 _____ () C:\Windows\system32\nvcoproc.bin

2015-02-03 13:31 - 2013-08-22 09:38 - 00714720 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2015-02-03 13:31 - 2013-08-22 09:38 - 00106976 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2015-01-29 16:21 - 2014-10-18 18:28 - 00000000 ____D () C:\Program Files (x86)\Java

2015-01-29 16:21 - 2014-10-09 15:05 - 00272296 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe

2015-01-29 16:21 - 2014-10-09 15:05 - 00176552 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe

2015-01-29 16:21 - 2014-10-09 15:05 - 00176552 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe

2015-01-29 16:21 - 2014-10-09 15:05 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll

2015-01-29 16:21 - 2014-10-09 15:05 - 00000000 ____D () C:\ProgramData\Oracle

2015-01-28 23:16 - 2013-08-22 09:36 - 00000000 ____D () C:\Windows\WinStore

2015-01-28 23:07 - 2014-12-11 02:05 - 00000000 ____D () C:\Users\Anthony\AppData\Local\LG Electronics

2015-01-28 23:07 - 2014-12-11 00:29 - 00000000 ____D () C:\LG

2015-01-28 23:06 - 2014-12-11 00:31 - 00000000 ____D () C:\Program Files (x86)\LG Electronics

2015-01-28 18:16 - 2014-10-08 19:03 - 00002203 _____ () C:\Users\Public\Desktop\Google Chrome.lnk

2015-01-25 16:06 - 2015-01-19 15:54 - 00000000 ____D () C:\Users\Anthony\Desktop\Niki's [bleep]

 

==================== Files in the root of some directories =======

 

2015-02-20 23:14 - 2015-02-20 23:16 - 0000020 _____ () C:\Users\Anthony\AppData\Roaming\appdataFr3.bin

2015-01-28 22:44 - 2015-01-28 22:44 - 0001751 _____ () C:\ProgramData\tempimage.bmp

 

==================== Bamital & volsnap Check =================

 

(There is no automatic fix for files that do not pass verification.)

 

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed

 

 

LastRegBack: 2015-02-17 18:35

 

==================== End Of Log ============================

 

Addition log:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 18-02-2015 01

Ran by Anthony at 2015-02-21 21:24:43

Running from C:\Users\Anthony\Desktop

Boot Mode: Normal

==========================================================

 

 

==================== Security Center ========================

 

(If an entry is included in the fixlist, it will be removed.)

 

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

 

==================== Installed Programs ======================

 

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

 

7-Zip 9.20 (HKLM-x32\...\7-Zip) (Version:  - )

7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)

Battle.net (HKLM-x32\...\Battle.net) (Version:  - Blizzard Entertainment)

BitTorrent (HKU\S-1-5-21-1912583399-466474933-4168976199-1001\...\BitTorrent) (Version: 7.9.2.35704 - BitTorrent Inc.)

Borderlands: The Pre-Sequel (HKLM-x32\...\Steam App 261640) (Version:  - 2K Australia)

Brawlhalla (HKLM-x32\...\Steam App 291550) (Version:  - Blue Mammoth Games)

Diablo III (HKLM-x32\...\Diablo III) (Version:  - Blizzard Entertainment)

Fallout: New Vegas (HKLM-x32\...\Steam App 22380) (Version:  - Obsidian Entertainment)

Google Chrome (HKLM-x32\...\Google Chrome) (Version: 40.0.2214.93 - Google Inc.)

Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden

Intel® Smart Connect Technology (HKLM\...\{08B90A20-95D3-4725-84B9-AF6553E06C4F}) (Version: 5.0.10.2850 - Intel Corporation)

Itibiti RTC (x32 Version: 0.0.1 - Itibiti Inc) Hidden

Java 8 Update 31 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218031F0}) (Version: 8.0.310 - Oracle Corporation)

Malwarebytes Anti-Malware version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)

Microsoft ASP.NET MVC 4 Runtime (HKLM-x32\...\{3FE312D5-B862-40CE-8E4E-A6D8ABF62736}) (Version: 4.0.40804.0 - Microsoft Corporation)

Microsoft Office 365 ProPlus - en-us (HKLM\...\O365ProPlusRetail - en-us) (Version: 15.0.4675.1003 - Microsoft Corporation)

Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)

MSXML 4.0 SP2 Parser and SDK (HKLM-x32\...\{716E0306-8318-4364-8B8F-0CC4E9376BAC}) (Version: 4.20.9818.0 - Microsoft Corporation)

Nexus Mod Manager (HKLM\...\6af12c54-643b-4752-87d0-8335503010de_is1) (Version: 0.52.3 - Black Tree Gaming)

NVIDIA 3D Vision Controller Driver 347.09 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 347.09 - NVIDIA Corporation)

NVIDIA 3D Vision Driver 347.52 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 347.52 - NVIDIA Corporation)

NVIDIA GeForce Experience 2.2.2 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.2.2 - NVIDIA Corporation)

NVIDIA Graphics Driver 347.52 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 347.52 - NVIDIA Corporation)

NVIDIA HD Audio Driver 1.3.33.0 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.33.0 - NVIDIA Corporation)

NVIDIA Miracast Virtual Audio 347.52 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Miracast.VirtualAudio) (Version: 347.52 - NVIDIA Corporation)

NVIDIA PhysX System Software 9.14.0702 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.14.0702 - NVIDIA Corporation)

Office 15 Click-to-Run Extensibility Component (Version: 15.0.4675.1003 - Microsoft Corporation) Hidden

Office 15 Click-to-Run Licensing Component (Version: 15.0.4675.1003 - Microsoft Corporation) Hidden

Office 15 Click-to-Run Localization Component (Version: 15.0.4675.1003 - Microsoft Corporation) Hidden

Origin (HKLM-x32\...\Origin) (Version: 9.4.22.2815 - Electronic Arts, Inc.)

PdaNet+ for Android 4.15 (HKLM-x32\...\PdaNet_is1) (Version:  - June Fabrics Technology Inc)

Picasa 3 (HKLM-x32\...\Picasa 3) (Version: 3.9 - Google, Inc.)

Prison Architect (HKLM-x32\...\Steam App 233450) (Version:  - Introversion Software)

SHIELD Streaming (Version: 4.0.1000 - NVIDIA Corporation) Hidden

SHIELD Wireless Controller Driver (Version: 17.12.8 - NVIDIA Corporation) Hidden

SpeedFan (remove only) (HKLM-x32\...\SpeedFan) (Version:  - )

Spotify (HKU\S-1-5-21-1912583399-466474933-4168976199-1001\...\Spotify) (Version: 0.9.15.27.g87efe634 - Spotify AB)

Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)

System Requirements Lab Detection (HKLM-x32\...\{D10323D5-353F-4172-8CB2-D2ABF29411E9}) (Version: 2.2.1.0 - Husdawg, LLC)

The Binding of Isaac (HKLM-x32\...\Steam App 113200) (Version:  - Edmund McMillen and Florian Himsl)

The Evil Within (HKLM-x32\...\Steam App 268050) (Version:  - Tango Gameworks)

VLC media player (HKLM-x32\...\VLC media player) (Version: 2.1.5 - VideoLAN)

 

==================== Custom CLSID (selected items): ==========================

 

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

 

 

==================== Restore Points  =========================

 

28-01-2015 17:27:52 Windows Update

05-02-2015 21:35:57 Windows Update

10-02-2015 19:00:23 Windows Update

17-02-2015 20:12:50 Scheduled Checkpoint

20-02-2015 23:13:16 Restore Point Created by FRST

 

==================== Hosts content: ==========================

 

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

 

2013-08-22 07:25 - 2013-08-22 07:25 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

 

==================== Scheduled Tasks (whitelisted) =============

 

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

 

Task: {A0068F93-5F92-40C1-8326-951882B3AE61} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows\system32\MRT.exe [2015-02-10] (Microsoft Corporation)

Task: {B17FD7C7-A673-4933-8722-512F8357F5BD} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office 15\root\Office15\msoia.exe [2014-10-07] (Microsoft Corporation)

Task: {CEE481D6-73A8-47E0-A78C-7F3358FE41EB} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office 15\root\Office15\msoia.exe [2014-10-07] (Microsoft Corporation)

Task: {D1CD848D-42EF-42FA-B646-A39DF8B3AADF} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonx64\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe [2014-11-12] (Microsoft Corporation)

Task: {F40952A6-6449-45BF-931F-D8232A182893} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2014-11-04] (Microsoft Corporation)

 

==================== Loaded Modules (whitelisted) ==============

 

2014-10-17 18:36 - 2014-05-20 08:19 - 00105640 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll

2014-06-18 17:18 - 2014-06-18 17:18 - 00209712 _____ () C:\Program Files\Intel\Intel® Smart Connect Technology Agent\iSCTAgent.exe

2014-06-18 17:18 - 2014-06-18 17:18 - 00057648 _____ () C:\Program Files\Intel\Intel® Smart Connect Technology Agent\NetworkHeuristic.dll

2014-06-18 17:18 - 2014-06-18 17:18 - 00057648 _____ () C:\Program Files\Intel\Intel® Smart Connect Technology Agent\ISCTEncryptionCheck.dll

2014-06-18 17:18 - 2014-06-18 17:18 - 00037168 _____ () C:\Program Files\Intel\Intel® Smart Connect Technology Agent\ISCTNetMon.dll

2014-10-08 19:12 - 2015-02-05 13:07 - 00117576 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll

2014-10-09 14:01 - 2014-12-11 01:33 - 00374840 _____ () C:\Users\Anthony\AppData\Roaming\Spotify\Data\SpotifyHelper.exe

2014-11-16 15:51 - 2014-09-23 07:36 - 08897696 _____ () C:\Program Files\Microsoft Office 15\root\Office15\1033\GrooveIntlResource.dll

2014-10-09 14:01 - 2014-12-11 01:33 - 36966968 _____ () C:\Users\Anthony\AppData\Roaming\Spotify\Data\libcef.dll

2014-10-09 14:01 - 2014-12-11 01:33 - 00867896 _____ () C:\Users\Anthony\AppData\Roaming\Spotify\Data\ffmpegsumo.dll

2014-10-09 14:01 - 2014-12-11 01:33 - 00886840 _____ () C:\Users\Anthony\AppData\Roaming\Spotify\Data\libglesv2.dll

2014-10-09 14:01 - 2014-12-11 01:33 - 00108600 _____ () C:\Users\Anthony\AppData\Roaming\Spotify\Data\libegl.dll

2014-11-16 15:51 - 2014-09-23 05:43 - 08897696 _____ () C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Microsoft Office\Office15\1033\GrooveIntlResource.dll

2015-01-28 18:16 - 2015-01-25 00:08 - 01117512 _____ () C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.93\libglesv2.dll

2015-01-28 18:16 - 2015-01-25 00:08 - 00211272 _____ () C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.93\libegl.dll

2015-01-28 18:16 - 2015-01-25 00:08 - 09170760 _____ () C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.93\pdf.dll

 

==================== Alternate Data Streams (whitelisted) =========

 

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

 

AlternateDataStreams: C:\Users\Anthony\SkyDrive:ms-properties

 

==================== Safe Mode (whitelisted) ===================

 

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

 

 

==================== EXE Association (whitelisted) ===============

 

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)

 

 

==================== Other Areas ============================

 

(Currently there is no automatic fix for this section.)

 

HKU\S-1-5-21-1912583399-466474933-4168976199-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Anthony\AppData\Roaming\Microsoft\Windows Photo Viewer\Windows Photo Viewer Wallpaper.jpg

DNS Servers: 192.168.1.1

 

==================== MSCONFIG/TASK MANAGER disabled items ==

 

(Currently there is no automatic fix for this section.)

 

HKU\S-1-5-21-1912583399-466474933-4168976199-1001\...\StartupApproved\StartupFolder: => "PdaNet Desktop.lnk"

HKU\S-1-5-21-1912583399-466474933-4168976199-1001\...\StartupApproved\Run: => "Browser Infrastructure Helper"

 

==================== Accounts: =============================

 

Administrator (S-1-5-21-1912583399-466474933-4168976199-500 - Administrator - Disabled)

Anthony (S-1-5-21-1912583399-466474933-4168976199-1001 - Administrator - Enabled) => C:\Users\Anthony

Guest (S-1-5-21-1912583399-466474933-4168976199-501 - Limited - Disabled)

HomeGroupUser$ (S-1-5-21-1912583399-466474933-4168976199-1003 - Limited - Enabled)

 

==================== Faulty Device Manager Devices =============

 

Name: SM Bus Controller

Description: SM Bus Controller

Class Guid: 

Manufacturer: 

Service: 

Problem: : The drivers for this device are not installed. (Code 28)

Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

 

 

==================== Event log errors: =========================

 

Application errors:

==================

 

System errors:

=============

Error: (02/21/2015 09:24:22 PM) (Source: DCOM) (EventID: 10010) (User: CHEEZUS)

Description: {9AA46009-3CE0-458A-A354-715610A075E6}

 

Error: (02/21/2015 09:23:52 PM) (Source: DCOM) (EventID: 10010) (User: CHEEZUS)

Description: {9AA46009-3CE0-458A-A354-715610A075E6}

 

Error: (02/21/2015 09:23:22 PM) (Source: DCOM) (EventID: 10010) (User: CHEEZUS)

Description: {9AA46009-3CE0-458A-A354-715610A075E6}

 

 

Microsoft Office Sessions:

=========================

 

CodeIntegrity Errors:

===================================

  Date: 2015-02-17 19:37:30.713

  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

 

  Date: 2015-02-17 19:37:30.625

  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

 

  Date: 2015-02-17 19:37:30.440

  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

 

  Date: 2015-02-17 19:37:30.354

  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

 

  Date: 2015-02-17 19:36:24.036

  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

 

  Date: 2015-02-17 19:36:23.945

  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

 

  Date: 2015-02-17 18:39:21.026

  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

 

  Date: 2015-02-17 18:39:20.942

  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

 

  Date: 2015-02-17 18:39:20.746

  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

 

  Date: 2015-02-17 18:39:20.659

  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

 

 

==================== Memory info =========================== 

 

Processor: Intel® Core™ i5-4590 CPU @ 3.30GHz

Percentage of memory in use: 13%

Total physical RAM: 16335.38 MB

Available physical RAM: 14159.26 MB

Total Pagefile: 18767.38 MB

Available Pagefile: 16244.59 MB

Total Virtual: 131072 MB

Available Virtual: 131071.83 MB

 

==================== Drives ================================

 

Drive c: () (Fixed) (Total:111.45 GB) (Free:66.05 GB) NTFS

Drive d: (Teletraan 1) (Fixed) (Total:931.51 GB) (Free:839.42 GB) NTFS

 

==================== MBR & Partition Table ==================

 

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 111.8 GB) (Disk ID: 4E45CCD4)

Partition 1: (Active) - (Size=350 MB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=111.4 GB) - (Type=07 NTFS)

 

========================================================

Disk: 1 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: 117211BF)

Partition 1: (Not Active) - (Size=931.5 GB) - (Type=07 NTFS)

 

==================== End Of Log ============================

[BrianDrab]

Thank you. Please do the following and let me know how your machine is.

 

Step#1 - FRST Fix
NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system
1. Download attached file and save it to the Desktop.  fixlist.txt   327bytes   169 downloads
Note. It's important that both files, FRST64 and fixlist.txt are in the same location or the fix will not work (in this case...the desktop).
2. Run FRST64 by Right-Clicking on the file and choosing Run as administrator.
3. Press the Fix button just once and wait. If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
4. When finished FRST64 will generate a log on the Desktop (Fixlog.txt). Please post the contents of it in your reply.

 

Step#2 - ESET Online Scanner and Post Results
Before running this scan, please temporarily disable your antivirus software to avoid conflicts. You can re-enable once it's done. Instructions for doing this on many AVs are here. This scan can take hours to run but is necessary to ensure we don't miss anything. Plan accordingly.

 

• Please go here and click on
• Note: This site is optimized for Internet Explorer. Please use it for this scan. If you wish to use Firefox or Chrome you will be asked to download the ESET Smart Installer first (esetsmartinstaller_enu.exe). Go ahead and download and run this file.
• Please accept the ESET Online Scanner EULA and click Start.
• If prompted, allow the Add-On/Active X to install. If you have problems with this step please see this link.
• Make sure Enable detection of potentially unwanted applications is selected.
• Click the Advanced Settings link.
• Make sure Remove found threats is NOT checked.
• Make sure Scan archives IS checked.
• Make sure Scan for potentially unsafe applications IS checked.
• Make sure Enable Anti-Stealth technology IS checked
• 
   
• Click on Start
• The virus signature database will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
• When completed the Online Scan will begin automatically.
• Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
• When completed, if anything was detected please click the List of found threats link.
• 
   
• Then click the Copy to Clipboard link and paste this information into your next reply.
• 

   

   

• Then you may click the Back button.
• Check Uninstall Application on Close before clicking finish.

 
Items for your next post

1. FRST Fix
2. Contents of the ESET log file

 

[lordcheezus]

FRST Log: Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 18-02-2015 01

Ran by Anthony at 2015-02-21 22:33:30 Run:3

Running from C:\Users\Anthony\Desktop

Loaded Profiles: Anthony (Available profiles: Anthony)

Boot Mode: Normal

==============================================

 

Content of fixlist:

*****************

CreateRestorePoint:

CHR Extension: (No Name) - C:\Users\Anthony\AppData\Local\Google\Chrome\User Data\Default\Extensions\algjnflpgoopkdijmkalfcifomdhmcbe [2015-02-20]

CHR Extension: (No Name) - C:\Users\Anthony\AppData\Local\Google\Chrome\User Data\Default\Extensions\gkojfkhlekighikafcpjkiklfbnlmeio [2015-02-21]

EmptyTemp:

*****************

 

Restore point was successfully created.

C:\Users\Anthony\AppData\Local\Google\Chrome\User Data\Default\Extensions\algjnflpgoopkdijmkalfcifomdhmcbe => Moved successfully.

C:\Users\Anthony\AppData\Local\Google\Chrome\User Data\Default\Extensions\gkojfkhlekighikafcpjkiklfbnlmeio => Moved successfully.

EmptyTemp: => Removed 21 MB temporary data.

 

 

The system needed a reboot. 

 

==== End of Fixlog 22:33:43 ====

 

Well, the scanner went straight from updating to scanning without giving me the option to not remove the threats found. Anyway, here is the log:

C:\FRST\Quarantine\c\Program Files (x86)\LighterSystem\LighterSystem.dll a variant of Win32/SProtector.O potentially unwanted application deleted - quarantined

C:\FRST\Quarantine\c\Program Files (x86)\TurboStrength\TurboStrength.dll a variant of Win32/SProtector.O potentially unwanted application deleted - quarantined

[BrianDrab]

Is your issue resolved now? Please do the following.

 

Step#1 - Security Check
1. Download Security Check from here or here or here.
2. Save it to your Desktop.
3. Right-click SecurityCheck.exe and select Run as administrator. Follow the onscreen instructions inside of the black box.
4. A Notepad document should open automatically called checkup.txt; please post the contents of that document.
Note: Don't be alarmed if the process runs for 10 to 15 minutes before completing. If it runs for over 30 minutes, just close the program and try running it again.

NOTE: If SecurityCheck aborts and you get the following message: UNSUPPORTED OPERATING SYSTEM! ABORTED! try rebooting the system and then run SecurityCheck again.

[lordcheezus]

It doesn't seem like it's completely gone, I went to open a tab and another extension appeared on Chrome. Here is the log from Security Check:

 

 Results of screen317's Security Check version 0.99.96  

   x64 (UAC is enabled)  

 Internet Explorer 11  

``````````````Antivirus/Firewall Check:`````````````` 

 Windows Firewall Enabled!  

Windows Defender   

 WMI entry may not exist for antivirus; attempting automatic update. 

`````````Anti-malware/Other Utilities Check:````````` 

 Java 8 Update 31  

 Java version 32-bit out of Date! 

  Java 64-bit 8 Update 31  

 Google Chrome (40.0.2214.91) 

 Google Chrome (40.0.2214.93) 

 Google Chrome (GoogleUpdate.dll..) 

````````Process Check: objlist.exe by Laurent````````  

 Windows Defender MSMpEng.exe 

`````````````````System Health check````````````````` 

 Total Fragmentation on Drive C:  % 

````````````````````End of Log`````````````````````` 

[BrianDrab]

What was the extension that appeared this time?

[lordcheezus]

To be honest, I deleted the extension before I even looked at the name. It's become second nature to just delete it. Sorry.

[BrianDrab]

Let's take a deeper look.
 
Run RogueKiller

• Click here to go to the RogueKiller download page.
• Scroll down on the page and click on the Download button for the 64-bit version.

• Quit all programs and close all browsers.
• Double click the RogueKiller icon to run the program.
  NOTE: If this is the first time you have used the program you will need to accept the User Agreement and the browser will open with some information related to the program.
• Wait until Prescan has finished ...This may take a few minutes, especially if it is the first time you have used the program.
• Click on Scan
• Wait for the end of the scan.
• Please post the results of the scan
• NOTE: If RogueKiller has been blocked, do not hesitate to try a few times more. If it really won't run, rename it to winlogon.exe (or winlogon.com) and try again