Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

Keep getting popups with Shopper Master and Lucky Shopper

Started by sdrspudman , Mar 06 2015 05:03 PM

This topic is locked

#1
sdrspudman

Posted 06 March 2015 - 05:03 PM

Member

Member
53 posts

I have tried Malwarebytes. It will not allow me to run Microsoft's Malicious malware removal tool. Any help is greatly appreciated below is the OTL.TXT file:

OTL logfile created on: 3/6/2015 4:59:50 PM - Run 2

OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\lawill\Downloads

64bit- An unknown product (Version = 6.2.9200) - Type = NTWorkstation

Internet Explorer (Version = 9.11.9600.17498)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.89 Gb Total Physical Memory | 0.26 Gb Available Physical Memory | 13.93% Memory free

3.20 Gb Paging File | 0.97 Gb Available in Paging File | 30.39% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 257.15 Gb Total Space | 227.30 Gb Free Space | 88.39% Space Free | Partition Type: NTFS

Drive D: | 25.00 Gb Total Space | 24.90 Gb Free Space | 99.61% Space Free | Partition Type: NTFS

Computer Name: THEBIFF | User Name: lawill | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2015/03/06 16:57:54 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\lawill\Downloads\OTL (2).exe

PRC - [2015/03/06 09:39:38 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\lawill\Downloads\OTL.exe

PRC - [2014/12/08 12:55:41 | 001,851,192 | ---- | M] (Maxthon) -- C:\Program Files (x86)\Maxthon\Modules\Service\Update\MaxthonUpdateSvc.exe

PRC - [2014/11/25 01:39:27 | 000,856,904 | ---- | M] (Google Inc.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

PRC - [2014/10/16 17:13:12 | 001,360,672 | ---- | M] (Lenovo) -- C:\Program Files\Lenovo\Lenovo Solution Center\LSCNotify.exe

PRC - [2013/12/12 20:57:54 | 000,069,640 | ---- | M] (Nalpeiron Ltd.) -- C:\Windows\SysWOW64\NLSSRV32.EXE

PRC - [2013/03/08 17:18:34 | 000,095,192 | ---- | M] (CyberLink Corp.) -- C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe

PRC - [2011/09/01 02:23:44 | 000,447,104 | ---- | M] (Conexant Systems, Inc.) -- C:\Windows\SysWOW64\SASrv.exe

========== Modules (No Company Name) ==========

MOD - [2014/11/25 01:39:25 | 014,910,280 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.71\PepperFlash\pepflashplayer.dll

MOD - [2014/11/25 01:39:24 | 009,009,480 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.71\pdf.dll

MOD - [2014/11/25 01:39:20 | 001,077,064 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.71\libglesv2.dll

MOD - [2014/11/25 01:39:18 | 000,211,272 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.71\libegl.dll

MOD - [2014/11/25 01:39:17 | 001,677,128 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.71\ffmpegsumo.dll

========== Services (SafeList) ==========

SRV:64bit: - [2015/01/13 16:11:30 | 000,562,200 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\mcafee\MSC\McAPExe.exe -- (McAPExe)

SRV:64bit: - [2015/01/07 19:37:22 | 000,601,864 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files\mcafee\VirusScan\mcods.exe -- (McODS)

SRV:64bit: - [2014/12/05 20:35:00 | 000,229,888 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\AudioEndpointBuilder.dll -- (AudioEndpointBuilder)

SRV:64bit: - [2014/11/21 10:17:58 | 000,422,632 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\McAfee\CSP\1.3.336.0\McCSPServiceHost.exe -- (mccspsvc)

SRV:64bit: - [2014/11/06 06:34:38 | 001,050,952 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\McAfee\AMCore\mcshield.exe -- (mfecore)

SRV:64bit: - [2014/10/31 20:10:34 | 000,335,064 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe -- (MSK80Service)

SRV:64bit: - [2014/10/31 20:10:34 | 000,335,064 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe -- (McProxy)

SRV:64bit: - [2014/10/31 20:10:34 | 000,335,064 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe -- (mcpltsvc)

SRV:64bit: - [2014/10/31 20:10:34 | 000,335,064 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe -- (McNaiAnn)

SRV:64bit: - [2014/10/31 20:10:34 | 000,335,064 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe -- (McMPFSvc)

SRV:64bit: - [2014/10/31 20:10:34 | 000,335,064 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe -- (HomeNetSvc)

SRV:64bit: - [2014/10/30 23:51:25 | 000,114,688 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\windows\SysNative\IEEtwCollector.exe -- (IEEtwCollectorService)

SRV:64bit: - [2014/10/16 17:13:48 | 000,272,776 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files\Lenovo\Lenovo Solution Center\App\LSCWinService.exe -- (LSCWinService)

SRV:64bit: - [2014/10/01 12:18:08 | 000,189,920 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Windows\SysNative\mfevtps.exe -- (mfevtp)

SRV:64bit: - [2014/10/01 12:15:18 | 000,221,832 | ---- | M] () [Auto | Running] -- C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe -- (mfefire)

SRV:64bit: - [2014/09/21 22:05:56 | 000,368,632 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\NisSrv.exe -- (WdNisSvc)

SRV:64bit: - [2014/09/21 22:05:56 | 000,023,792 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MsMpEng.exe -- (WinDefend)

SRV:64bit: - [2014/08/15 22:29:38 | 002,899,968 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\spool\drivers\x64\3\PrintConfig.dll -- (PrintNotify)

SRV:64bit: - [2014/08/15 19:58:35 | 000,287,744 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\SystemEventsBrokerServer.dll -- (SystemEventsBroker)

SRV:64bit: - [2014/08/15 19:45:51 | 000,267,776 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\bisrv.dll -- (BrokerInfrastructure)

SRV:64bit: - [2014/07/24 02:28:58 | 001,600,000 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\workfolderssvc.dll -- (workfolderssvc)

SRV:64bit: - [2014/06/11 15:17:10 | 000,288,240 | ---- | M] (Lenovo) [Auto | Running] -- C:\Program Files\Lenovo PhoneCompanion\PhoneCompanionPusher.exe -- (PhoneCompanionPusher)

SRV:64bit: - [2014/06/11 15:17:09 | 000,305,136 | ---- | M] (Lenovo) [On_Demand | Stopped] -- C:\Program Files\Lenovo PhoneCompanion\PhoneCompanionVap.exe -- (PhoneCompanionVap)

SRV:64bit: - [2014/03/18 04:54:59 | 000,710,656 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\lsm.dll -- (LSM)

SRV:64bit: - [2014/03/18 04:54:59 | 000,530,944 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\AppReadiness.dll -- (AppReadiness)

SRV:64bit: - [2014/03/18 04:54:55 | 000,366,080 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\wcmsvc.dll -- (Wcmsvc)

SRV:64bit: - [2014/03/18 04:54:53 | 003,394,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\WSService.dll -- (WSService)

SRV:64bit: - [2014/03/18 04:54:53 | 001,576,960 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\wlidsvc.dll -- (wlidsvc)

SRV:64bit: - [2014/03/18 04:54:50 | 000,399,872 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\das.dll -- (DeviceAssociationService)

SRV:64bit: - [2014/03/14 01:26:25 | 000,491,520 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\GeofenceMonitorService.dll -- (lfsvc)

SRV:64bit: - [2014/03/11 20:16:02 | 000,282,096 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Windows\SysNative\igfxCUIService.exe -- (igfxCUIService1.0.0.0)

SRV:64bit: - [2014/03/08 00:41:25 | 001,306,624 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\AppXDeploymentServer.dll -- (AppXSvc)

SRV:64bit: - [2014/03/06 02:02:13 | 000,834,560 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\netlogon.dll -- (Netlogon)

SRV:64bit: - [2013/12/12 20:57:44 | 000,230,920 | ---- | M] (Nitro PDF Software) [Auto | Running] -- C:\Program Files\Common Files\Nitro\Pro\9.0\NitroPDFDriverService9x64.exe -- (NitroDriverReadSpool9)

SRV:64bit: - [2013/08/22 06:32:02 | 000,024,576 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\wephostsvc.dll -- (WEPHOSTSVC)

SRV:64bit: - [2013/08/22 06:31:43 | 000,040,448 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\efssvc.dll -- (EFS)

SRV:64bit: - [2013/08/22 06:22:45 | 000,066,048 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\wiarpc.dll -- (WiaRpc)

SRV:64bit: - [2013/08/22 06:21:15 | 000,013,312 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\svsvc.dll -- (svsvc)

SRV:64bit: - [2013/08/22 06:16:57 | 000,118,272 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\fhsvc.dll -- (fhsvc)

SRV:64bit: - [2013/08/22 06:03:41 | 000,052,736 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\windows\SysNative\rundll32.exe -- (051cdb72)

SRV:64bit: - [2013/08/22 05:25:28 | 000,164,352 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\NcaSvc.dll -- (NcaSvc)

SRV:64bit: - [2013/08/22 05:19:28 | 000,517,120 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\icsvc.dll -- (vmicvss)

SRV:64bit: - [2013/08/22 05:19:28 | 000,517,120 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\icsvc.dll -- (vmictimesync)

SRV:64bit: - [2013/08/22 05:19:28 | 000,517,120 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\icsvc.dll -- (vmicshutdown)

SRV:64bit: - [2013/08/22 05:19:28 | 000,517,120 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\icsvc.dll -- (vmicrdv)

SRV:64bit: - [2013/08/22 05:19:28 | 000,517,120 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\icsvc.dll -- (vmickvpexchange)

SRV:64bit: - [2013/08/22 05:19:28 | 000,517,120 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\icsvc.dll -- (vmicheartbeat)

SRV:64bit: - [2013/08/22 05:19:28 | 000,517,120 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\icsvc.dll -- (vmicguestinterface)

SRV:64bit: - [2013/08/22 05:02:47 | 000,013,312 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\smphost.dll -- (smphost)

SRV:64bit: - [2013/08/22 04:57:25 | 000,130,560 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\ScDeviceEnum.dll -- (ScDeviceEnum)

SRV:64bit: - [2013/08/22 04:54:59 | 000,059,392 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\keyiso.dll -- (KeyIso)

SRV:64bit: - [2013/08/22 04:50:59 | 000,245,760 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\TimeBrokerServer.dll -- (TimeBroker)

SRV:64bit: - [2013/08/22 04:50:00 | 000,525,312 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\netprofmsvc.dll -- (netprofm)

SRV:64bit: - [2013/08/22 04:45:59 | 000,151,040 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\ncbservice.dll -- (NcbService)

SRV:64bit: - [2013/08/22 04:40:49 | 000,248,832 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\vaultsvc.dll -- (VaultSvc)

SRV:64bit: - [2013/08/22 04:31:03 | 000,201,728 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\DeviceSetupManager.dll -- (DsmSvc)

SRV:64bit: - [2013/08/22 04:15:54 | 000,073,728 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\NcdAutoSetup.dll -- (NcdAutoSetup)

SRV:64bit: - [2013/07/25 01:39:26 | 000,206,552 | ---- | M] (Conexant Systems Inc.) [Auto | Running] -- C:\Windows\SysNative\CxAudMsg64.exe -- (CxAudMsg)

SRV:64bit: - [2013/07/01 22:08:48 | 000,822,232 | ---- | M] (Intel® Corporation) [On_Demand | Stopped] -- C:\Program Files\Intel\TXE Components\TCS\SocketHeciServer.exe -- (Intel®

SRV:64bit: - [2013/07/01 22:08:32 | 000,733,696 | ---- | M] (Intel® Corporation) [Auto | Running] -- C:\Program Files\Intel\TXE Components\TCS\HeciServer.exe -- (Intel®

SRV:64bit: - [2012/04/24 21:43:50 | 000,390,632 | ---- | M] () [Auto | Running] -- C:\Program Files\CyberLink\Shared files\RichVideo64.exe -- (RichVideo64)

SRV - [2015/02/19 16:39:38 | 000,155,368 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files (x86)\McAfee\SiteAdvisor\mcsacore.exe -- (McAfee SiteAdvisor Service)

SRV - [2014/12/08 12:55:41 | 001,851,192 | ---- | M] (Maxthon) [Auto | Running] -- C:\Program Files (x86)\Maxthon\Modules\Service\Update\MaxthonUpdateSvc.exe -- (MaxthonUpdateSvc)

SRV - [2014/08/15 22:29:38 | 002,899,968 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\windows\system32\spool\drivers\x64\3\PrintConfig.dll -- (PrintNotify)

SRV - [2014/08/08 14:26:16 | 000,851,136 | ---- | M] (McAfee, Inc.) [Auto | Stopped] -- C:\Windows\Temp\0155641425676696mcinst.exe -- (0155641425676696mcinstcleanup)

SRV - [2014/06/11 15:17:48 | 000,067,856 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Lenovo\Lenovo VeriFace Pro\VfConnectorService.exe -- (VeriFaceSrv)

SRV - [2014/03/14 01:10:16 | 000,357,376 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysWOW64\GeofenceMonitorService.dll -- (lfsvc)

SRV - [2014/03/11 20:16:06 | 000,279,024 | ---- | M] (Intel Corporation) [On_Demand | Stopped] -- C:\Windows\SysWOW64\IntelCpHeciSvc.exe -- (cphs)

SRV - [2014/01/22 16:04:00 | 000,084,992 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Realtek\Realtek Bluetooth\BTDevMgr.exe -- (BTDevManager)

SRV - [2013/12/12 20:57:54 | 000,069,640 | ---- | M] (Nalpeiron Ltd.) [Auto | Running] -- C:\Windows\SysWOW64\NLSSRV32.EXE -- (nlsX86cc)

SRV - [2013/08/21 22:55:35 | 000,018,944 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysWOW64\StorSvc.dll -- (StorSvc)

SRV - [2013/08/21 21:53:34 | 000,011,776 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysWOW64\smphost.dll -- (smphost)

SRV - [2012/04/24 16:37:56 | 000,169,752 | ---- | M] (Intel Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Intel\Intel® Integrated Clock Controller Service\ICCProxy.exe -- (ICCS)

SRV - [2011/09/01 02:23:44 | 000,447,104 | ---- | M] (Conexant Systems, Inc.) [Auto | Running] -- C:\Windows\SysWOW64\SASrv.exe -- (SAService)

========== Driver Services (SafeList) ==========

DRV:64bit: - [2014/10/12 21:43:17 | 000,238,912 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\sdbus.sys -- (sdbus)

DRV:64bit: - [2014/10/12 21:43:17 | 000,086,336 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\pdc.sys -- (pdc)

DRV:64bit: - [2014/10/12 21:43:17 | 000,039,744 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\intelpep.sys -- (intelpep)

DRV:64bit: - [2014/10/09 20:58:57 | 000,027,456 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)

DRV:64bit: - [2014/10/01 12:20:58 | 000,072,136 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\cfwids.sys -- (cfwids)

DRV:64bit: - [2014/10/01 12:18:18 | 000,348,560 | ---- | M] (McAfee, Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\mfewfpk.sys -- (mfewfpk)

DRV:64bit: - [2014/10/01 12:16:28 | 000,786,304 | ---- | M] (McAfee, Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\mfehidk.sys -- (mfehidk)

DRV:64bit: - [2014/10/01 12:15:28 | 000,526,360 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\mfefirek.sys -- (mfefirek)

DRV:64bit: - [2014/10/01 12:14:48 | 000,313,680 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\mfeavfk.sys -- (mfeavfk)

DRV:64bit: - [2014/10/01 12:14:26 | 000,181,584 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\mfeapfk.sys -- (mfeapfk)

DRV:64bit: - [2014/10/01 11:16:10 | 000,070,608 | ---- | M] (McAfee, Inc.) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\mfeelamk.sys -- (mfeelamk)

DRV:64bit: - [2014/09/21 22:06:16 | 000,258,368 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WdFilter.sys -- (WdFilter)

DRV:64bit: - [2014/09/21 22:06:16 | 000,114,496 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WdNisDrv.sys -- (WdNisDrv)

DRV:64bit: - [2014/09/21 21:49:43 | 000,035,320 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WdBoot.sys -- (WdBoot)

DRV:64bit: - [2014/09/19 02:44:18 | 000,096,600 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\mfencrk.sys -- (mfencrk)

DRV:64bit: - [2014/09/19 02:43:24 | 000,447,440 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\mfencbdc.sys -- (mfencbdc)

DRV:64bit: - [2014/08/14 19:36:55 | 000,146,752 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\msgpioclx.sys -- (GPIOClx0101)

DRV:64bit: - [2014/07/24 10:28:38 | 000,468,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\USBHUB3.SYS -- (USBHUB3)

DRV:64bit: - [2014/07/24 10:28:38 | 000,412,992 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\spaceport.sys -- (spaceport)

DRV:64bit: - [2014/07/24 06:42:22 | 000,126,464 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\NdisImPlatform.sys -- (NdisImPlatform)

DRV:64bit: - [2014/06/11 15:20:26 | 000,035,576 | ---- | M] (Lenovo Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AcpiVpc.sys -- (ACPIVPC)

DRV:64bit: - [2014/05/01 08:31:39 | 000,055,328 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\wpcfltr.sys -- (wpcfltr)

DRV:64bit: - [2014/03/19 22:41:20 | 000,376,152 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\clfs.sys -- (CLFS)

DRV:64bit: - [2014/03/18 04:54:54 | 000,924,504 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\windows\SysNative\drivers\refs.sys -- (ReFS)

DRV:64bit: - [2014/03/18 04:54:51 | 000,146,776 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\SerCx2.sys -- (SerCx2)

DRV:64bit: - [2014/03/18 04:54:39 | 000,226,304 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\BthLEEnum.sys -- (BthLEEnum)

DRV:64bit: - [2014/03/18 04:54:39 | 000,175,960 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VerifierExt.sys -- (VerifierExt)

DRV:64bit: - [2014/03/18 04:54:39 | 000,079,192 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\sdstor.sys -- (sdstor)

DRV:64bit: - [2014/03/18 04:54:38 | 000,325,464 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\USBXHCI.SYS -- (USBXHCI)

DRV:64bit: - [2014/03/18 04:54:38 | 000,189,784 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\UCX01000.SYS -- (UCX01000)

DRV:64bit: - [2014/03/18 04:54:38 | 000,057,176 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\stornvme.sys -- (stornvme)

DRV:64bit: - [2014/03/18 04:54:38 | 000,033,280 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\BasicRender.sys -- (BasicRender)

DRV:64bit: - [2014/03/18 04:37:54 | 000,037,216 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\terminpt.sys -- (terminpt)

DRV:64bit: - [2014/03/13 07:35:24 | 000,157,016 | ---- | M] (Microsoft Corporation) [File_System | Boot | Running] -- C:\windows\SysNative\drivers\wof.sys -- (Wof)

DRV:64bit: - [2014/03/08 15:40:16 | 000,136,024 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\wfplwfs.sys -- (WFPLWFS)

DRV:64bit: - [2014/03/07 11:26:44 | 000,450,520 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\IntcDAud.sys -- (IntcDAud)

DRV:64bit: - [2014/03/07 11:18:24 | 003,729,920 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)

DRV:64bit: - [2014/03/01 15:32:31 | 000,038,296 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\intelaud.sys -- (intaud_WaveExtensible)

DRV:64bit: - [2014/03/01 15:32:31 | 000,027,032 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\iwdbus.sys -- (iwdbus)

DRV:64bit: - [2014/01/27 03:23:56 | 001,474,240 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CHDRT64.sys -- (CnxtHdAudService)

DRV:64bit: - [2014/01/13 21:02:08 | 000,558,296 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\RtkBtfilter.sys -- (RtkBtFilter)

DRV:64bit: - [2013/12/26 03:31:00 | 002,982,104 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\rtwlane.sys -- (RTWlanE)

DRV:64bit: - [2013/12/23 20:14:50 | 000,532,720 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP)

DRV:64bit: - [2013/12/23 20:14:44 | 000,034,544 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Smb_driver_Intel.sys -- (SmbDrvI)

DRV:64bit: - [2013/10/09 19:44:38 | 000,029,464 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\MBI.sys -- (MBI)

DRV:64bit: - [2013/09/24 04:23:30 | 000,329,944 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\RtsUVStor.sys -- (RSUSBVSTOR)

DRV:64bit: - [2013/09/23 13:49:22 | 000,197,704 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HipShieldK.sys -- (HipShieldK)

DRV:64bit: - [2013/08/22 08:25:40 | 000,043,008 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\condrv.sys -- (condrv)

DRV:64bit: - [2013/08/22 08:25:40 | 000,030,048 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)

DRV:64bit: - [2013/08/22 07:50:19 | 000,057,696 | ---- | M] (Microsoft Corporation) [Kernel | System | Stopped] -- C:\Windows\SysNative\drivers\dam.sys -- (dam)

DRV:64bit: - [2013/08/22 07:49:54 | 000,079,712 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\acpiex.sys -- (acpiex)

DRV:64bit: - [2013/08/22 07:49:33 | 000,159,584 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\tpm.sys -- (TPM)

DRV:64bit: - [2013/08/22 07:43:49 | 000,063,840 | ---- | M] (Marvell Semiconductor, Inc.) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\mvumis.sys -- (mvumis)

DRV:64bit: - [2013/08/22 07:43:48 | 000,041,824 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\msgpiowin32.sys -- (msgpiowin32)

DRV:64bit: - [2013/08/22 07:43:45 | 003,357,024 | ---- | M] (Broadcom Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)

DRV:64bit: - [2013/08/22 07:43:45 | 000,093,536 | ---- | M] (LSI Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)

DRV:64bit: - [2013/08/22 07:43:45 | 000,082,784 | ---- | M] (LSI Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\lsi_sss.sys -- (LSI_SSS)

DRV:64bit: - [2013/08/22 07:43:45 | 000,064,352 | ---- | M] (Hewlett-Packard Company) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)

DRV:64bit: - [2013/08/22 07:43:44 | 000,081,760 | ---- | M] (LSI Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas3.sys -- (LSI_SAS3)

DRV:64bit: - [2013/08/22 07:43:41 | 000,782,176 | ---- | M] (PMC-Sierra) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\adp80xx.sys -- (ADP80XX)

DRV:64bit: - [2013/08/22 07:43:41 | 000,531,296 | ---- | M] (Broadcom Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)

DRV:64bit: - [2013/08/22 07:43:41 | 000,259,424 | ---- | M] (AMD Technologies Inc.) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)

DRV:64bit: - [2013/08/22 07:43:41 | 000,108,896 | ---- | M] (LSI) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\3ware.sys -- (3ware)

DRV:64bit: - [2013/08/22 07:43:41 | 000,079,200 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)

DRV:64bit: - [2013/08/22 07:43:40 | 000,114,016 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\EhStorTcgDrv.sys -- (EhStorTcgDrv)

DRV:64bit: - [2013/08/22 07:43:40 | 000,082,784 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\EhStorClass.sys -- (EhStorClass)

DRV:64bit: - [2013/08/22 07:43:40 | 000,025,952 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)

DRV:64bit: - [2013/08/22 07:43:34 | 000,305,504 | ---- | M] (VIA Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\VSTXRAID.SYS -- (VSTXRAID)

DRV:64bit: - [2013/08/22 07:43:33 | 000,074,080 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\uaspstor.sys -- (UASPStor)

DRV:64bit: - [2013/08/22 07:43:32 | 000,031,072 | ---- | M] (Promise Technology, Inc.) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)

DRV:64bit: - [2013/08/22 07:43:31 | 000,107,872 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\storahci.sys -- (storahci)

DRV:64bit: - [2013/08/22 07:43:31 | 000,072,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\SpbCx.sys -- (SpbCx)

DRV:64bit: - [2013/08/22 07:43:31 | 000,069,472 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\SerCx.sys -- (SerCx)

DRV:64bit: - [2013/08/22 07:39:15 | 000,026,976 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\uefi.sys -- (UEFI)

DRV:64bit: - [2013/08/22 07:37:27 | 000,069,472 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\vpci.sys -- (vpci)

DRV:64bit: - [2013/08/22 07:36:12 | 000,026,976 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WpdUpFltr.sys -- (WpdUpFltr)

DRV:64bit: - [2013/08/22 06:39:54 | 000,076,800 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\ahcache.sys -- (ahcache)

DRV:64bit: - [2013/08/22 06:39:31 | 000,050,688 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\BasicDisplay.sys -- (BasicDisplay)

DRV:64bit: - [2013/08/22 06:39:20 | 000,022,016 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HyperVideo.sys -- (HyperVideo)

DRV:64bit: - [2013/08/22 06:39:06 | 000,009,728 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\mshidumdf.sys -- (mshidumdf)

DRV:64bit: - [2013/08/22 06:38:58 | 000,010,752 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\acpitime.sys -- (acpitime)

DRV:64bit: - [2013/08/22 06:38:48 | 000,010,240 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\acpipagr.sys -- (acpipagr)

DRV:64bit: - [2013/08/22 06:38:39 | 000,036,992 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\BthAvrcpTg.sys -- (BthAvrcpTg)

DRV:64bit: - [2013/08/22 06:38:26 | 000,019,456 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\kdnic.sys -- (kdnic)

DRV:64bit: - [2013/08/22 06:38:23 | 000,011,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\vmgencounter.sys -- (gencounter)

DRV:64bit: - [2013/08/22 06:38:22 | 000,023,040 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\npsvctrig.sys -- (npsvctrig)

DRV:64bit: - [2013/08/22 06:38:16 | 000,030,720 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\BthhfHid.sys -- (bthhfhid)

DRV:64bit: - [2013/08/22 06:37:49 | 000,013,824 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hyperkbd.sys -- (hyperkbd)

DRV:64bit: - [2013/08/22 06:37:46 | 000,029,696 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD)

DRV:64bit: - [2013/08/22 06:37:42 | 000,057,856 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bthhfenum.sys -- (BthHFEnum)

DRV:64bit: - [2013/08/22 06:37:28 | 000,056,320 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)

DRV:64bit: - [2013/08/22 06:37:28 | 000,041,472 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hidi2c.sys -- (hidi2c)

DRV:64bit: - [2013/08/22 06:37:14 | 000,029,696 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\dmvsc.sys -- (dmvsc)

DRV:64bit: - [2013/08/22 06:36:43 | 000,087,040 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\netvsc63.sys -- (netvsc)

DRV:64bit: - [2013/08/22 06:36:25 | 000,016,384 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NdisVirtualBus.sys -- (NdisVirtualBus)

DRV:64bit: - [2013/08/22 06:36:07 | 000,066,560 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\mslldp.sys -- (MsLldp)

DRV:64bit: - [2013/08/22 06:35:42 | 000,103,424 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\Ndu.sys -- (Ndu)

DRV:64bit: - [2013/08/22 03:46:33 | 000,027,136 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\fxppm.sys -- (FxPPM)

DRV:64bit: - [2013/08/15 01:28:42 | 000,830,680 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt630x64.sys -- (RTL8168)

DRV:64bit: - [2013/08/12 18:25:46 | 000,017,624 | ---- | M] (Windows ® Win 7 DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bcmfn2.sys -- (bcmfn2)

DRV:64bit: - [2013/08/09 19:39:30 | 000,651,248 | ---- | M] (Intel Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\iaStorAV.sys -- (iaStorAV)

DRV:64bit: - [2013/07/30 13:47:35 | 000,024,568 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\iaLPSSi_GPIO.sys -- (iaLPSSi_GPIO)

DRV:64bit: - [2013/07/25 14:05:39 | 000,099,320 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\iaLPSSi_I2C.sys -- (iaLPSSi_I2C)

DRV:64bit: - [2013/07/01 22:10:20 | 000,087,568 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\TXEIx64.sys -- (TXEIx64)

DRV:64bit: - [2013/06/18 09:45:43 | 004,649,440 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\NETwew02.sys -- (NETwNe64)

DRV:64bit: - [2013/06/18 09:45:26 | 000,460,288 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\e1i63x64.sys -- (e1iexpress)

DRV:64bit: - [2012/06/13 19:10:32 | 000,102,376 | ---- | M] ("CyberLink) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\wsvd.sys -- (wsvd)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {A2E5F672-55A5-45E6-87EE-E699CA5DE3E9}

IE:64bit: - HKLM\..\SearchScopes\{A2E5F672-55A5-45E6-87EE-E699CA5DE3E9}: "URL" = http://www.bing.com/...=IE11TR&pc=LCJB

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank

IE - HKLM\..\SearchScopes,DefaultScope = {A2E5F672-55A5-45E6-87EE-E699CA5DE3E9}

IE - HKLM\..\SearchScopes\{A2E5F672-55A5-45E6-87EE-E699CA5DE3E9}: "URL" = http://www.bing.com/...=IE11TR&pc=LCJB

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://lenovo13.msn.com/?pc=LCJB

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = http://home.lenovo.com [binary data]

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://home.lenovo.com [binary data]

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank

IE - HKCU\..\SearchScopes,DefaultScope = {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}

IE - HKCU\..\SearchScopes\{A2E5F672-55A5-45E6-87EE-E699CA5DE3E9}: "URL" = http://www.bing.com/...q={searchTerms}

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF:64bit: - HKLM\Software\MozillaPlugins\@mcafee.com/MSC,version=10: c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL ()

FF - HKLM\Software\MozillaPlugins\@mcafee.com/MSC,version=10: c:\PROGRA~2\mcafee\msc\NPMCSN~1.DLL ()

FF - HKLM\Software\MozillaPlugins\@mcafee.com/MVT: C:\Program Files (x86)\McAfee\Supportability\MVT\NPMVTPlugin.dll (McAfee, Inc.)

FF - HKLM\Software\MozillaPlugins\@nitropdf.com/NitroPDF: C:\Program Files (x86)\Nitro\Pro 9\npnitromozilla.dll (Nitro PDF)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{4ED1F68A-5463-4931-9384-8FFF5ED91D92}: C:\Program Files (x86)\McAfee\SiteAdvisor [2015/03/06 13:29:27 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\[email protected]: C:\Program Files\McAfee\MSK [2015/03/06 16:20:33 | 000,000,000 | ---D | M]

========== Chrome ==========

CHR - default_search_provider: ()

CHR - default_search_provider: search_url =

CHR - default_search_provider: suggest_url =

CHR - homepage:

CHR - plugin: Error reading preferences file

CHR - Extension: Google Docs = C:\Users\lawill\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\

CHR - Extension: Google Drive = C:\Users\lawill\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\

CHR - Extension: Google Voice Search Hotword (Beta) = C:\Users\lawill\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn\0.1.1.5023_0\

CHR - Extension: YouTube = C:\Users\lawill\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_0\

CHR - Extension: The Fancy Pants Adventure World 1 = C:\Users\lawill\AppData\Local\Google\Chrome\User Data\Default\Extensions\ckcgalhncgkicdlhojcalmjcjhndldpl\201\

CHR - Extension: Google Search = C:\Users\lawill\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\

CHR - Extension: Clipboard Sync = C:\Users\lawill\AppData\Local\Google\Chrome\User Data\Default\Extensions\dapdfappilfdiljfpjcbkmkblldaemjg\118\

CHR - Extension: SiteAdvisor = C:\Users\lawill\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho\3.65.135.1_0\

CHR - Extension: Quick Block = C:\Users\lawill\AppData\Local\Google\Chrome\User Data\Default\Extensions\jlkpnekpomdbobkdokohimfcbgcpldfp\118\

CHR - Extension: Google Wallet = C:\Users\lawill\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\

CHR - Extension: Gmail = C:\Users\lawill\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\8_0\

O1 HOSTS File: ([2013/08/22 08:25:41 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts

O2:64bit: - BHO: (SHopperMAsteer) - {030a4c79-a86b-4eab-88fe-caae27d43e19} - C:\ProgramData\SHopperMAsteer\Nm9DTshH8Ou3bl.x64.dll ()

O2:64bit: - BHO: (BetterPricceChec) - {48be1d7a-41fa-4dbb-8ed5-2979bdd48d73} - C:\Program Files (x86)\BetterPricceChec\b0pouHodCm2YHa.x64.dll ()

O2:64bit: - BHO: (no name) - {497f7640-e809-4b95-8e3a-711f4c27df63} - No CLSID value found.

O2:64bit: - BHO: (no name) - {856d397c-8da1-4b35-a989-01c6ccf1c50b} - No CLSID value found.

O2:64bit: - BHO: (LucckyShaoaPpeer) - {bc2bccc0-b4a0-43ca-9852-13098376e93d} - C:\Program Files (x86)\LucckyShaoaPpeer\UkJyLGa5KM9dGW.x64.dll ()

O2 - BHO: (SHopperMAsteer) - {030a4c79-a86b-4eab-88fe-caae27d43e19} - C:\ProgramData\SHopperMAsteer\Nm9DTshH8Ou3bl.dll ()

O2 - BHO: (BetterPricceChec) - {48be1d7a-41fa-4dbb-8ed5-2979bdd48d73} - C:\Program Files (x86)\BetterPricceChec\b0pouHodCm2YHa.dll ()

O2 - BHO: (no name) - {497f7640-e809-4b95-8e3a-711f4c27df63} - No CLSID value found.

O2 - BHO: (no name) - {856d397c-8da1-4b35-a989-01c6ccf1c50b} - No CLSID value found.

O2 - BHO: (LucckyShaoaPpeer) - {bc2bccc0-b4a0-43ca-9852-13098376e93d} - C:\Program Files (x86)\LucckyShaoaPpeer\UkJyLGa5KM9dGW.dll ()

O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.

O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.

O4:64bit: - HKLM..\Run: [BtServer] C:\Program Files (x86)\REALTEK\Realtek Bluetooth\BTServer.exe (Realtek Semiconductor Corporation)

O4:64bit: - HKLM..\Run: [cAudioFilterAgent] C:\Program Files\CONEXANT\cAudioFilterAgent\CAudioFilterAgent64.exe (Conexant Systems, Inc.)

O4:64bit: - HKLM..\Run: [Energy Manager] C:\Program Files (x86)\Lenovo\Energy Manager\Energy Manager.exe (Lenovo(beijing) Limited)

O4:64bit: - HKLM..\Run: [ForteConfig] C:\Program Files\CONEXANT\ForteConfig\fmapp.exe ()

O4:64bit: - HKLM..\Run: [Lenovo Utility] C:\Program Files (x86)\Lenovo\Energy Manager\utility.exe (Lenovo(beijing) Limited)

O4:64bit: - HKLM..\Run: [PhoneCompanion] C:\Program Files\Lenovo PhoneCompanion\Phone Companion.exe (Lenovo)

O4:64bit: - HKLM..\Run: [SmartAudio] C:\Program Files\CONEXANT\SAII\SACpl.exe (Conexant Systems, Inc.)

O4 - HKLM..\Run: [mcpltui_exe] C:\Program Files\Common Files\McAfee\Platform\McUICnt.exe (McAfee, Inc.)

O4 - HKLM..\Run: [UpdateP2GShortCut] C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)

O4 - HKCU..\Run: [CCleaner Monitoring] C:\PROGRAM FILES\CCLEANER\CCLEANER64.EXE (Piriform Ltd)

O4 - HKCU..\Run: [Pokki] "%LOCALAPPDATA%\Pokki\Engine\HostAppServiceUpdater.exe" /LOGON File not found

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoControlPanel = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableCursorSuppression = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O1364bit: - gopher Prefix: missing

O13 - gopher Prefix: missing

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1 216.170.153.146

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{34014777-B6CC-4ECC-968E-1CB00A0855DE}: DhcpNameServer = 192.168.0.1 216.170.153.146

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D30A63DB-F224-44A3-96A3-F671B76C9F4A}: DhcpNameServer = 192.168.0.1 216.170.153.146

O18:64bit: - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)

O18:64bit: - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)

O18 - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)

O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)

O18:64bit: - Protocol\Filter\application/x-mfe-ipt {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files\mcafee\MSC\McSnIePl64.dll (McAfee, Inc.)

O18 - Protocol\Filter\application/x-mfe-ipt {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files (x86)\McAfee\MSC\McSnIePl.dll (McAfee, Inc.)

O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\SysWow64\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\windows\SysWow64\userinit.exe (Microsoft Corporation)

O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O32 - HKLM CDRom: AutoRun - 1

O34 - HKLM BootExecute: (autocheck autochk *)

O35:64bit: - HKLM\..comfile [open] -- "%1" %*

O35:64bit: - HKLM\..exefile [open] -- "%1" %*

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*

O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2015/03/06 16:20:16 | 000,197,704 | ---- | C] (McAfee, Inc.) -- C:\windows\SysNative\drivers\HipShieldK.sys

[2015/03/06 09:33:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\LucckyShaoaPpeer

[2015/03/06 09:33:28 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\BetterPricceChec

[2015/03/06 09:33:04 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Quick Block

[2015/03/05 05:57:23 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\KingaCoupon

[2015/03/04 17:07:00 | 000,000,000 | ---D | C] -- C:\Users\lawill\AppData\Roaming\Maxthon3

========== Files - Modified Within 30 Days ==========

[2015/03/06 16:44:03 | 000,000,914 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineUA.job

[2015/03/06 16:05:51 | 000,067,584 | --S- | M] () -- C:\windows\bootstat.dat

[2015/03/06 13:44:00 | 000,000,910 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineCore.job

[2015/03/06 13:43:41 | 000,129,752 | ---- | M] (Malwarebytes Corporation) -- C:\windows\SysNative\drivers\MBAMSwissArmy.sys

[2015/03/06 13:29:35 | 268,435,456 | -HS- | M] () -- C:\swapfile.sys

[2015/03/06 13:29:33 | 1620,013,056 | -HS- | M] () -- C:\hiberfil.sys

[2015/03/04 17:23:11 | 000,000,158 | ---- | M] () -- C:\windows\Reimage.ini

[2015/03/04 17:04:33 | 000,002,560 | ---- | M] () -- C:\windows\SysNative\VfService.trf

[2015/03/04 16:25:53 | 000,000,020 | ---- | M] () -- C:\Users\lawill\AppData\Roaming\appdataFr3.bin

========== Files Created - No Company Name ==========

[2015/03/04 17:18:11 | 000,000,158 | ---- | C] () -- C:\windows\Reimage.ini

[2015/02/04 17:13:25 | 000,000,020 | ---- | C] () -- C:\Users\lawill\AppData\Roaming\appdataFr3.bin

[2014/06/11 14:38:33 | 000,451,072 | ---- | C] () -- C:\windows\SysWow64\ISSRemoveSP.exe

[2014/06/11 14:38:33 | 000,048,856 | ---- | C] () -- C:\windows\runSW.exe

[2014/06/11 14:30:36 | 000,000,000 | -H-- | C] () -- C:\ProgramData\DP45977C.lfl

[2014/03/18 04:55:05 | 000,002,255 | ---- | C] () -- C:\windows\SysWow64\WimBootCompress.ini

[2014/03/18 04:54:40 | 000,103,936 | ---- | C] () -- C:\windows\SysWow64\OEMLicense.dll

[2014/03/12 03:37:58 | 000,068,608 | ---- | C] () -- C:\windows\SysWow64\igfxexps32.dll

[2014/03/12 03:37:51 | 000,342,944 | ---- | C] () -- C:\windows\SysWow64\igdmd32.dll

[2014/03/12 03:37:47 | 000,183,296 | ---- | C] () -- C:\windows\SysWow64\igdde32.dll

[2014/03/12 03:37:46 | 000,142,848 | ---- | C] () -- C:\windows\SysWow64\igdail32.dll

[2013/08/22 10:36:43 | 000,215,943 | ---- | C] () -- C:\windows\SysWow64\dssec.dat

[2013/08/22 10:36:42 | 000,000,741 | ---- | C] () -- C:\windows\SysWow64\NOISE.DAT

[2013/08/22 09:46:23 | 000,067,584 | --S- | C] () -- C:\windows\bootstat.dat

[2013/08/22 02:01:23 | 000,043,131 | ---- | C] () -- C:\windows\mib.bin

[2013/08/21 22:32:36 | 000,046,080 | ---- | C] () -- C:\windows\SysWow64\BWContextHandler.dll

[2013/08/21 18:55:20 | 000,364,544 | ---- | C] () -- C:\windows\SysWow64\msjetoledb40.dll

[2013/08/21 18:52:39 | 000,673,088 | ---- | C] () -- C:\windows\SysWow64\mlang.dat

[2013/07/01 21:44:46 | 000,001,536 | ---- | C] () -- C:\windows\SysWow64\IusEventLog.dll

========== ZeroAccess Check ==========

[2014/12/08 13:05:39 | 000,000,227 | RHS- | M] () -- C:\windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

"" = C:\Windows\SysNative\shell32.dll -- [2014/08/30 19:15:33 | 021,197,152 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

"" = %SystemRoot%\system32\shell32.dll -- [2014/08/30 17:59:13 | 018,723,112 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64

"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2013/08/22 04:49:49 | 000,921,088 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]

"" = %systemroot%\system32\wbem\fastprox.dll -- [2013/08/21 21:45:10 | 000,691,712 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64

"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2013/08/22 04:45:17 | 000,483,840 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

========== LOP Check ==========

[2014/12/25 10:22:08 | 000,000,000 | ---D | M] -- C:\Users\lawill\AppData\Roaming\LSC

[2015/03/04 17:07:05 | 000,000,000 | ---D | M] -- C:\Users\lawill\AppData\Roaming\Maxthon3

[2014/12/08 13:06:05 | 000,000,000 | ---D | M] -- C:\Users\lawill\AppData\Roaming\Nitro PDF

========== Purity Check ==========

< End of report >

#2
zep516

Posted 06 March 2015 - 05:27 PM

Trusted Helper

Malware Removal
8,093 posts

Hi! My name is zep516 and Welcome to Geekstogo!
I'll do the best I can to resolve your computer issue
Please make sure to carefully read any instruction that I give you. If you're not sure, or if something unexpected happens, don't continue Stop and ask! Never be afraid to ask questions!

We will not be using OTL, please follow instruction below. Make sure you download FRST to the desktop.

Download the version of this tool for your operating system.
Farbar Recovery Scan Tool (64 bit)
and save it to a folder on your computer's Desktop.
Double-click to run it. When the tool opens click Yes to disclaimer.
Press Scan button.
It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
The first time the tool is run, it makes also another log (Addition.txt). Please also paste it to your reply.

#3
sdrspudman

Posted 07 March 2015 - 04:13 PM

Member

Topic Starter
Member
53 posts

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 07-03-2015 01

Ran by lawill (administrator) on THEBIFF on 07-03-2015 16:57:41

Running from C:\Users\lawill\Downloads

Loaded Profiles: lawill (Available profiles: lawill)

Platform: Windows 8.1 Connected (X64) OS Language: English (United States)

Internet Explorer Version 11 (Default browser: Chrome)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Intel Corporation) C:\Windows\System32\igfxCUIService.exe

(Microsoft Corporation) C:\Windows\System32\wlanext.exe

(Microsoft Corporation) C:\Windows\System32\rundll32.exe

(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe

() C:\Program Files (x86)\Realtek\Realtek Bluetooth\BTDevMgr.exe

(Conexant Systems Inc.) C:\Windows\System32\CxAudMsg64.exe

(Intel® Corporation) C:\Program Files\Intel\TXE Components\TCS\HeciServer.exe

(Maxthon) C:\Program Files (x86)\Maxthon\Modules\Service\Update\MaxthonUpdateSvc.exe

(McAfee, Inc.) C:\Windows\System32\mfevtps.exe

(Nitro PDF Software) C:\Program Files\Common Files\Nitro\Pro\9.0\NitroPDFDriverService9x64.exe

(Nalpeiron Ltd.) C:\Windows\SysWOW64\NLSSRV32.EXE

(Lenovo) C:\Program Files\Lenovo PhoneCompanion\PhoneCompanionPusher.exe

() C:\Program Files\CyberLink\Shared files\RichVideo64.exe

(Conexant Systems, Inc.) C:\Windows\SysWOW64\SASrv.exe

() C:\Program Files (x86)\Lenovo\Lenovo VeriFace Pro\VfConnectorService.exe

(McAfee, Inc.) C:\Program Files\mcafee\MSC\McA6A07.tmp

(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe

(Microsoft Corporation) C:\Windows\System32\rundll32.exe

(McAfee, Inc.) C:\Program Files\Common Files\McAfee\CSP\1.3.336.0\McCSPServiceHost.exe

(McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe

(McAfee, Inc.) C:\Program Files\Common Files\McAfee\AMCore\mcshield.exe

(McAfee, Inc.) C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe

(McAfee, Inc.) C:\Program Files (x86)\McAfee\SiteAdvisor\mcsacore.exe

(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe

(Microsoft Corporation) C:\Windows\System32\rundll32.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(McAfee, Inc.) C:\Program Files\Common Files\McAfee\Platform\McUICnt.exe

(Intel Corporation) C:\Windows\System32\igfxHK.exe

(Intel Corporation) C:\Windows\System32\igfxTray.exe

(Realtek Semiconductor Corporation) C:\Program Files (x86)\Realtek\Realtek Bluetooth\BTServer.exe

(Intel Corporation) C:\Windows\System32\igfxEM.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

(Conexant Systems, Inc.) C:\Program Files\CONEXANT\cAudioFilterAgent\CAudioFilterAgent64.exe

() C:\Program Files\CONEXANT\ForteConfig\fmapp.exe

(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Manager\Energy Manager.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(CyberLink Corp.) C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Lenovo) C:\Program Files\Lenovo\Lenovo Solution Center\LSCNotify.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(McAfee, Inc.) C:\Program Files\mcafee\VirusScan\McVsMap.exe

(McAfee, Inc.) C:\Program Files\mcafee\VirusScan\McVsShld.exe

(Microsoft Corporation) C:\Windows\System32\wermgr.exe

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [cAudioFilterAgent] => C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [907480 2013-09-04] (Conexant Systems, Inc.)

HKLM\...\Run: [ForteConfig] => C:\Program Files\Conexant\ForteConfig\fmapp.exe [49056 2010-10-25] ()

HKLM\...\Run: [SmartAudio] => C:\Program Files\CONEXANT\SAII\SACpl.exe [1647616 2012-06-12] (Conexant Systems, Inc.)

HKLM\...\Run: [BtServer] => C:\Program Files (x86)\REALTEK\Realtek Bluetooth\BTServer.exe [216064 2014-01-06] (Realtek Semiconductor Corporation)

HKLM\...\Run: [PhoneCompanion] => C:\Program Files\Lenovo PhoneCompanion\Phone Companion.exe [836592 2014-06-11] (Lenovo)

HKLM\...\Run: [Energy Manager] => C:\Program Files (x86)\Lenovo\Energy Manager\Energy Manager.exe [16094704 2014-06-11] (Lenovo(beijing) Limited)

HKLM\...\Run: [Lenovo Utility] => C:\Program Files (x86)\Lenovo\Energy Manager\Utility.exe [10842096 2014-06-11] (Lenovo(beijing) Limited)

HKLM-x32\...\Run: [UpdateP2GShortCut] => C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe [214312 2011-12-06] (CyberLink Corp.)

HKLM-x32\...\Run: [mcpltui_exe] => C:\Program Files\Common Files\McAfee\Platform\McUICnt.exe [643064 2014-09-17] (McAfee, Inc.)

HKLM\...\Policies\Explorer: [NoControlPanel] 0

HKLM\...\Policies\Explorer: [NoFolderOptions] 0

HKU\S-1-5-21-2025283895-1953685814-2999071867-1001\...\Run: [Pokki] => "%LOCALAPPDATA%\Pokki\Engine\HostAppServiceUpdater.exe" /LOGON

HKU\S-1-5-21-2025283895-1953685814-2999071867-1001\...\Run: [CCleaner Monitoring] => C:\PROGRAM FILES\CCLEANER\CCleaner64.exe [7063832 2014-11-21] (Piriform Ltd)

CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank

HKU\S-1-5-21-2025283895-1953685814-2999071867-1001\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

HKU\S-1-5-21-2025283895-1953685814-2999071867-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://lenovo13.msn.com/?pc=LCJB

HKU\S-1-5-21-2025283895-1953685814-2999071867-1001\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://home.lenovo.com

HKU\S-1-5-21-2025283895-1953685814-2999071867-1001\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = http://home.lenovo.com

SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =

SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =

SearchScopes: HKU\S-1-5-21-2025283895-1953685814-2999071867-1001 -> DefaultScope {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL =

SearchScopes: HKU\S-1-5-21-2025283895-1953685814-2999071867-1001 -> {A2E5F672-55A5-45E6-87EE-E699CA5DE3E9} URL = http://www.bing.com/...q={searchTerms}

BHO: SHopperMAsteer -> {030a4c79-a86b-4eab-88fe-caae27d43e19} -> C:\ProgramData\SHopperMAsteer\Nm9DTshH8Ou3bl.x64.dll [2015-01-13] ()

BHO: BetterPricceChec -> {48be1d7a-41fa-4dbb-8ed5-2979bdd48d73} -> C:\Program Files (x86)\BetterPricceChec\b0pouHodCm2YHa.x64.dll [2015-03-06] ()

BHO: No Name -> {497f7640-e809-4b95-8e3a-711f4c27df63} -> No File

BHO: No Name -> {856d397c-8da1-4b35-a989-01c6ccf1c50b} -> No File

BHO: LucckyShaoaPpeer -> {bc2bccc0-b4a0-43ca-9852-13098376e93d} -> C:\Program Files (x86)\LucckyShaoaPpeer\UkJyLGa5KM9dGW.x64.dll [2015-03-06] ()

BHO-x32: SHopperMAsteer -> {030a4c79-a86b-4eab-88fe-caae27d43e19} -> C:\ProgramData\SHopperMAsteer\Nm9DTshH8Ou3bl.dll [2015-01-13] ()

BHO-x32: BetterPricceChec -> {48be1d7a-41fa-4dbb-8ed5-2979bdd48d73} -> C:\Program Files (x86)\BetterPricceChec\b0pouHodCm2YHa.dll [2015-03-06] ()

BHO-x32: No Name -> {497f7640-e809-4b95-8e3a-711f4c27df63} -> No File

BHO-x32: No Name -> {856d397c-8da1-4b35-a989-01c6ccf1c50b} -> No File

BHO-x32: LucckyShaoaPpeer -> {bc2bccc0-b4a0-43ca-9852-13098376e93d} -> C:\Program Files (x86)\LucckyShaoaPpeer\UkJyLGa5KM9dGW.dll [2015-03-06] ()

Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll [2015-01-28] (McAfee, Inc.)

Handler-x32: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll [2015-01-28] (McAfee, Inc.)

Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll [2015-01-28] (McAfee, Inc.)

Handler-x32: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll [2015-01-28] (McAfee, Inc.)

Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files\mcafee\MSC\McSnIePl64.dll [2015-01-13] (McAfee, Inc.)

Filter-x32: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files (x86)\McAfee\MSC\McSnIePl.dll [2015-01-13] (McAfee, Inc.)

Tcpip\Parameters: [DhcpNameServer] 192.168.0.1 216.170.153.146

FireFox:

========

FF Plugin: @mcafee.com/MSC,version=10 -> c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL [2015-01-13] ()

FF Plugin-x32: @mcafee.com/MSC,version=10 -> c:\PROGRA~2\mcafee\msc\NPMCSN~1.DLL [2015-01-13] ()

FF Plugin-x32: @mcafee.com/MVT -> C:\Program Files (x86)\McAfee\Supportability\MVT\NPMVTPlugin.dll [2014-12-08] (McAfee, Inc.)

FF Plugin-x32: @nitropdf.com/NitroPDF -> C:\Program Files (x86)\Nitro\Pro 9\npnitromozilla.dll [2013-12-12] (Nitro PDF)

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll [2014-12-08] (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll [2014-12-08] (Google Inc.)

FF HKLM-x32\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files (x86)\McAfee\SiteAdvisor

FF Extension: McAfee SiteAdvisor - C:\Program Files (x86)\McAfee\SiteAdvisor [2015-01-11]

FF HKLM-x32\...\Thunderbird\Extensions: [[email protected]] - C:\Program Files\McAfee\MSK

FF Extension: McAfee Anti-Spam Thunderbird Extension - C:\Program Files\McAfee\MSK [2015-01-11]

Chrome:

=======

CHR dev: Chrome dev build detected! <======= ATTENTION

CHR Profile: C:\Users\lawill\AppData\Local\Google\Chrome\User Data\Default

CHR Extension: (Google Docs) - C:\Users\lawill\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-12-08]

CHR Extension: (Google Drive) - C:\Users\lawill\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-12-08]

CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\lawill\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-12-08]

CHR Extension: (YouTube) - C:\Users\lawill\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-12-08]

CHR Extension: (The Fancy Pants Adventure World 1) - C:\Users\lawill\AppData\Local\Google\Chrome\User Data\Default\Extensions\ckcgalhncgkicdlhojcalmjcjhndldpl [2015-02-03]

CHR Extension: (Google Search) - C:\Users\lawill\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-12-08]

CHR Extension: (Clipboard Sync) - C:\Users\lawill\AppData\Local\Google\Chrome\User Data\Default\Extensions\dapdfappilfdiljfpjcbkmkblldaemjg [2015-01-26]

CHR Extension: (SiteAdvisor) - C:\Users\lawill\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho [2015-03-04]

CHR Extension: (Quick Block) - C:\Users\lawill\AppData\Local\Google\Chrome\User Data\Default\Extensions\jlkpnekpomdbobkdokohimfcbgcpldfp [2015-03-05]

CHR Extension: (Google Wallet) - C:\Users\lawill\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-12-08]

CHR Extension: (Gmail) - C:\Users\lawill\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-12-08]

CHR HKLM\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - C:\Program Files (x86)\McAfee\SiteAdvisor\McChPlg.crx [2015-03-06]

CHR HKLM-x32\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - C:\Program Files (x86)\McAfee\SiteAdvisor\McChPlg.crx [2015-03-06]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S2 0155641425676696mcinstcleanup; C:\windows\TEMP\015564~1.EXE [851136 2014-08-08] (McAfee, Inc.)

R2 051cdb72; c:\Program Files (x86)\Optimizer Pro 3.11\OptProMon.dll [3908176 2014-12-08] () [File not signed]

R2 BTDevManager; C:\Program Files (x86)\REALTEK\Realtek Bluetooth\BTDevMgr.exe [84992 2014-01-22] () [File not signed]

R2 HomeNetSvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [335064 2014-10-31] (McAfee, Inc.)

R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [282096 2014-03-11] (Intel Corporation)

R2 Intel® Capability Licensing Service Interface; C:\Program Files\Intel\TXE Components\TCS\HeciServer.exe [733696 2013-07-01] (Intel® Corporation) [File not signed]

S3 Intel® Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\TXE Components\TCS\SocketHeciServer.exe [822232 2013-07-01] (Intel® Corporation)

S3 LSCWinService; C:\Program Files\Lenovo\Lenovo Solution Center\App\LSCWinService.exe [272776 2014-10-16] ()

R2 MaxthonUpdateSvc; C:\Program Files (x86)\Maxthon\Modules\Service\Update\MaxthonUpdateSvc.exe [1851192 2014-12-08] (Maxthon)

R2 McAfee SiteAdvisor Service; C:\Program Files (x86)\McAfee\SiteAdvisor\McSACore.exe [155368 2015-02-19] (McAfee, Inc.)

R2 McAPExe; C:\Program Files\McAfee\MSC\McAPExe.exe [562200 2015-01-13] (McAfee, Inc.)

R2 mccspsvc; C:\Program Files\Common Files\McAfee\CSP\1.3.336.0\McCSPServiceHost.exe [422632 2014-11-21] (McAfee, Inc.)

R2 McMPFSvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [335064 2014-10-31] (McAfee, Inc.)

R2 McNaiAnn; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [335064 2014-10-31] (McAfee, Inc.)

S3 McODS; C:\Program Files\mcafee\VirusScan\mcods.exe [601864 2015-01-07] (McAfee, Inc.)

R2 mcpltsvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [335064 2014-10-31] (McAfee, Inc.)

R2 McProxy; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [335064 2014-10-31] (McAfee, Inc.)

R2 mfecore; C:\Program Files\Common Files\McAfee\AMCore\mcshield.exe [1050952 2014-11-06] (McAfee, Inc.)

R2 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [221832 2014-10-01] (McAfee, Inc.)

R2 mfevtp; C:\windows\system32\mfevtps.exe [189920 2014-10-01] (McAfee, Inc.)

R2 MSK80Service; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [335064 2014-10-31] (McAfee, Inc.)

R2 NitroDriverReadSpool9; C:\Program Files\Common Files\Nitro\Pro\9.0\NitroPDFDriverService9x64.exe [230920 2013-12-12] (Nitro PDF Software)

R2 PhoneCompanionPusher; C:\Program Files\Lenovo PhoneCompanion\PhoneCompanionPusher.exe [288240 2014-06-11] (Lenovo)

S3 PhoneCompanionVap; C:\Program Files\Lenovo PhoneCompanion\PhoneCompanionVap.exe [305136 2014-06-11] (Lenovo)

R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [390632 2012-04-24] ()

R2 VeriFaceSrv; C:\Program Files (x86)\Lenovo\Lenovo VeriFace Pro\VfConnectorService.exe [67856 2014-06-11] ()

S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-21] (Microsoft Corporation)

S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-21] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [226304 2014-03-18] (Microsoft Corporation)

R3 cfwids; C:\Windows\System32\drivers\cfwids.sys [72136 2014-10-01] (McAfee, Inc.)

S3 HipShieldK; C:\Windows\System32\drivers\HipShieldK.sys [197704 2013-09-23] (McAfee, Inc.)

R0 MBI; C:\Windows\System32\drivers\MBI.sys [29464 2013-10-09] (Intel Corporation)

R3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [181584 2014-10-01] (McAfee, Inc.)

R3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [313680 2014-10-01] (McAfee, Inc.)

S0 mfeelamk; C:\Windows\System32\drivers\mfeelamk.sys [70608 2014-10-01] (McAfee, Inc.)

R3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [526360 2014-10-01] (McAfee, Inc.)

R0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [786304 2014-10-01] (McAfee, Inc.)

R3 mfencbdc; C:\Windows\system32\DRIVERS\mfencbdc.sys [447440 2014-09-19] (McAfee, Inc.)

U3 mfencbdc01; No ImagePath

S3 mfencrk; C:\Windows\system32\DRIVERS\mfencrk.sys [96600 2014-09-19] (McAfee, Inc.)

R0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [348560 2014-10-01] (McAfee, Inc.)

S3 NETwNe64; C:\Windows\system32\DRIVERS\NETwew02.sys [4649440 2013-06-18] (Intel Corporation)

R3 RtkBtFilter; C:\Windows\system32\DRIVERS\RtkBtfilter.sys [558296 2014-01-13] (Realtek Semiconductor Corporation)

R3 RTWlanE; C:\Windows\system32\DRIVERS\rtwlane.sys [2982104 2013-12-26] (Realtek Semiconductor Corporation )

R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [34544 2013-12-23] (Synaptics Incorporated)

R3 TXEIx64; C:\Windows\System32\drivers\TXEIx64.sys [87568 2013-07-01] (Intel Corporation)

S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-21] (Microsoft Corporation)

S3 wsvd; C:\Windows\system32\DRIVERS\wsvd.sys [102376 2012-06-13] ("CyberLink)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)

==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-07 16:57 - 2015-03-07 16:57 - 00018417 _____ () C:\Users\lawill\Downloads\FRST.txt

2015-03-07 16:56 - 2015-03-07 16:58 - 00000000 ____D () C:\FRST

2015-03-07 16:55 - 2015-03-07 16:55 - 02094592 _____ (Farbar) C:\Users\lawill\Downloads\FRST64.exe

2015-03-07 16:54 - 2015-03-07 16:54 - 00000149 _____ () C:\windows\setupact.log

2015-03-07 16:54 - 2015-03-07 16:54 - 00000000 _____ () C:\windows\setuperr.log

2015-03-06 17:55 - 2015-03-06 17:55 - 00102474 _____ () C:\Users\lawill\Downloads\OTL.Txt 3-6-15.txt

2015-03-06 16:57 - 2015-03-06 16:57 - 00602112 _____ (OldTimer Tools) C:\Users\lawill\Downloads\OTL (2).exe

2015-03-06 16:20 - 2013-09-23 13:49 - 00197704 _____ (McAfee, Inc.) C:\windows\system32\Drivers\HipShieldK.sys

2015-03-06 13:56 - 2015-03-07 16:57 - 00398650 _____ () C:\windows\WindowsUpdate.log

2015-03-06 12:19 - 2015-03-06 12:19 - 00057348 _____ () C:\Users\lawill\Downloads\Extras.Txt

2015-03-06 11:30 - 2015-03-06 17:54 - 00102474 _____ () C:\Users\lawill\Downloads\OTL.Txt

2015-03-06 09:39 - 2015-03-06 09:39 - 00602112 _____ (OldTimer Tools) C:\Users\lawill\Downloads\OTL.exe

2015-03-06 09:33 - 2015-03-06 09:34 - 00000000 ____D () C:\Program Files (x86)\LucckyShaoaPpeer

2015-03-06 09:33 - 2015-03-06 09:33 - 00000000 ____D () C:\Program Files (x86)\Quick Block

2015-03-06 09:33 - 2015-03-06 09:33 - 00000000 ____D () C:\Program Files (x86)\BetterPricceChec

2015-03-05 05:57 - 2015-03-06 09:30 - 00000000 ____D () C:\Program Files (x86)\KingaCoupon

2015-03-04 18:04 - 2015-03-04 18:04 - 00003098 _____ () C:\windows\System32\Tasks\{EE3271BE-FF68-4268-B9B8-FCAB070DE8B8}

2015-03-04 17:18 - 2015-03-04 17:23 - 00000158 _____ () C:\windows\Reimage.ini

2015-03-04 17:07 - 2015-03-04 17:07 - 00000000 ____D () C:\Users\lawill\AppData\Roaming\Maxthon3

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-07 17:00 - 2013-08-22 10:36 - 00000000 ____D () C:\windows\system32\sru

2015-03-07 16:59 - 2014-12-08 13:01 - 00003598 _____ () C:\windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2025283895-1953685814-2999071867-1001

2015-03-07 16:54 - 2013-08-22 10:36 - 00000000 ____D () C:\windows\AppReadiness

2015-03-07 16:44 - 2014-12-08 13:39 - 00000914 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job

2015-03-07 16:43 - 2014-12-08 13:39 - 00000910 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job

2015-03-07 16:43 - 2014-12-08 12:55 - 00545661 _____ () C:\Users\lawill\AppData\Local\BTServer.log

2015-03-06 18:05 - 2014-12-08 12:55 - 00000000 ____D () C:\Users\lawill\AppData\Local\Pokki

2015-03-06 18:05 - 2014-12-08 12:54 - 00000000 ____D () C:\Users\lawill

2015-03-06 18:05 - 2014-06-11 14:30 - 01638374 _____ () C:\Users\Public\CAFADEBUG.log

2015-03-06 17:59 - 2015-02-04 17:13 - 00000020 _____ () C:\Users\lawill\AppData\Roaming\appdataFr3.bin

2015-03-06 16:46 - 2013-08-22 10:20 - 00000000 ____D () C:\windows\CbsTemp

2015-03-06 16:20 - 2015-01-11 21:12 - 00000000 ____D () C:\Program Files\Common Files\McAfee

2015-03-06 16:19 - 2013-08-22 10:36 - 00000000 ___HD () C:\windows\ELAMBKUP

2015-03-06 16:18 - 2014-06-11 15:04 - 00000000 ____D () C:\ProgramData\McAfee

2015-03-06 16:18 - 2014-06-11 15:04 - 00000000 ____D () C:\Program Files (x86)\McAfee

2015-03-06 13:43 - 2014-12-09 12:31 - 00129752 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys

2015-03-06 13:29 - 2013-08-22 10:36 - 00000000 ____D () C:\windows\Vss

2015-03-06 13:29 - 2013-08-22 09:45 - 00000006 ____H () C:\windows\Tasks\SA.DAT

2015-03-06 09:33 - 2015-02-03 11:37 - 00000000 ____D () C:\ProgramData\1781179848093534370

2015-03-06 09:29 - 2015-01-05 09:03 - 00000000 ____D () C:\ProgramData\saevinsahoP

2015-03-06 09:26 - 2015-01-05 09:04 - 00000000 ____D () C:\ProgramData\leesS2payy

2015-03-04 18:01 - 2015-02-03 11:38 - 00000000 ____D () C:\Program Files (x86)\RoyaleCouPoN

2015-03-04 18:01 - 2015-02-03 11:37 - 00000000 ____D () C:\Program Files (x86)\The Fancy Pants Adventure World 1

2015-03-04 18:01 - 2015-02-03 11:37 - 00000000 ____D () C:\Program Files (x86)\QueenCooupon

2015-03-04 17:34 - 2014-12-28 12:05 - 00000000 ____D () C:\ProgramData\18b805a27eb308a2

2015-03-04 17:04 - 2014-06-11 15:17 - 00002560 _____ () C:\windows\system32\VfService.trf

2015-03-04 17:03 - 2013-08-22 08:25 - 00262144 ___SH () C:\windows\system32\config\BBI

2015-03-04 16:33 - 2013-08-22 08:25 - 00262144 ___SH () C:\windows\system32\config\ELAM

==================== Files in the root of some directories =======

2015-02-04 17:13 - 2015-03-06 17:59 - 0000020 _____ () C:\Users\lawill\AppData\Roaming\appdataFr3.bin

2014-12-08 12:55 - 2015-03-07 16:43 - 0545661 _____ () C:\Users\lawill\AppData\Local\BTServer.log

2014-06-11 14:30 - 2014-06-11 14:30 - 0000000 ____H () C:\ProgramData\DP45977C.lfl

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2015-01-27 07:33

==================== End Of Log ============================Additional scan result of Farbar Recovery Scan Tool (x64) Version: 07-03-2015 01

Ran by lawill at 2015-03-07 17:03:20

Running from C:\Users\lawill\Downloads

Boot Mode: Normal

==========================================================

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: McAfee Anti-Virus and Anti-Spyware (Enabled - Up to date) {ADA629C7-7F48-5689-624A-3B76997E0892}

AV: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AV: McAfee Anti-Virus and Anti-Spyware (Enabled - Up to date) {DA9F8ED0-D0DE-39CC-F55A-51AB4CC1B556}

AS: McAfee Anti-Virus and Anti-Spyware (Enabled - Up to date) {16C7C823-5972-5907-58FA-0004E2F9422F}

AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: McAfee Anti-Virus and Anti-Spyware (Enabled - Up to date) {61FE6F34-F6E4-3642-CFEA-6AD93746FFEB}

FW: McAfee Firewall (Enabled) {E2A40FF5-9AB1-3894-DE05-F89EB212F22D}

FW: McAfee Firewall (Enabled) {959DA8E2-3527-57D1-4915-924367AD4FE9}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 3.4.0.2710 - Adobe Systems Incorporated)

CCleaner (HKLM\...\CCleaner) (Version: 5.00 - Piriform)

Cisco EAP-FAST Module (HKLM-x32\...\{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}) (Version: 2.2.14 - Cisco Systems, Inc.)

Cisco LEAP Module (HKLM-x32\...\{AF312B06-5C5C-468E-89B3-BE6DE2645722}) (Version: 1.0.19 - Cisco Systems, Inc.)

Cisco PEAP Module (HKLM-x32\...\{0A4EF0E6-A912-4CDE-A7F3-6E56E7C13A2F}) (Version: 1.1.6 - Cisco Systems, Inc.)

Conexant HD Audio (HKLM\...\CNXT_AUDIO_HDA) (Version: 8.65.28.50 - Conexant)

CyberLink PhotoDirector 3 (HKLM-x32\...\InstallShield_{39337565-330E-4ab6-A9AE-AC81E0720B10}) (Version: 3.0.1.4107 - CyberLink Corp.)

CyberLink PowerDirector 10 (HKLM-x32\...\InstallShield_{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}) (Version: 10.0.0.2810 - CyberLink Corp.)

Dolby Digital Plus Advanced Audio (HKLM\...\{B0BFC63F-EA07-419E-960B-3FB2ED5DD0B2}) (Version: 7.5.1.1 - Dolby Laboratories Inc)

Energy Manager (HKLM-x32\...\InstallShield_{AC768037-7079-4658-AC24-2897650E0ABE}) (Version: 1.5.0.17 - Lenovo)

Energy Manager (x32 Version: 1.5.0.17 - Lenovo) Hidden

Google Chrome (HKLM-x32\...\Google Chrome) (Version: 39.0.2171.71 - Google Inc.)

Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden

Host App Service (HKU\S-1-5-21-2025283895-1953685814-2999071867-1001\...\Pokki) (Version: 0.269.5.367 - Pokki)

Intel® Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3496 - Intel Corporation)

Intel® Sideband Fabric Device Driver (HKLM-x32\...\C5A8BC6E-723A-4C0F-96E1-C426D1A4BCA9) (Version: 1.0.0.1002 - Intel Corporation)

Intel® Trusted Execution Engine (HKLM\...\{176E2755-0A17-42C6-88E2-192AB2131278}) (Version: 1.0.0.1050 - Intel Corporation)

Lenovo OneKey Recovery (HKLM-x32\...\InstallShield_{46F4D124-20E5-4D12-BE52-EC177A7A4B42}) (Version: 8.1.0.2326 - CyberLink Corp.)

Lenovo OneKey Recovery (Version: 8.1.0.2326 - CyberLink Corp.) Hidden

Lenovo PhoneCompanion (HKLM-x32\...\InstallShield_{0F82EA83-B0C5-4AB9-9695-DFE92C5FD57B}) (Version: 1.2.0.0 - Lenovo)

Lenovo PhoneCompanion (x32 Version: 1.2.0.0 - Lenovo) Hidden

Lenovo Photos (HKLM-x32\...\Lenovo Photos) (Version: 4.8.5 - CEWE COLOR AG u Co. OHG)

Lenovo PowerDVD10 (HKLM-x32\...\InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}) (Version: 10.0.5630.52 - CyberLink Corp.)

Lenovo PowerDVD10 (x32 Version: 10.0.5630.52 - CyberLink Corp.) Hidden

Lenovo Reach (HKLM-x32\...\{3245D8C8-7FE0-4FD4-B04B-2720A333D592}) (Version: 1.1.3.5 - Stoneware, Inc.)

Lenovo Solution Center (HKLM\...\{4C2B6F96-3AED-4E3F-8DCE-917863D1E6B1}) (Version: 2.7.003.00 - Lenovo Group Limited)

Lenovo VeriFace Pro (HKLM\...\Lenovo VeriFace) (Version: 5.0.14.1061 - Lenovo)

Lenovo Web Start (HKU\S-1-5-21-2025283895-1953685814-2999071867-1001\...\Pokki_04bb6df446330549a2cb8d67fbd1a745025b7bd1) (Version: 1.0.2.53457 - Pokki)

LuckyyCouupon (HKLM-x32\...\{BA5D43C9-D633-D0EC-CFEA-2ABA974B333D}) (Version: - "") <==== ATTENTION

Malwarebytes Anti-Malware version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)

Maxthon Cloud Browser (HKLM-x32\...\Maxthon3) (Version: 4.1.3.5000 - Maxthon International Limited)

McAfee Internet Security Suite (HKLM-x32\...\MSC) (Version: 13.6.1529 - McAfee, Inc.)

McAfee SiteAdvisor (HKLM-x32\...\{35ED3F83-4BDC-4c44-8EC6-6A8301C7413A}) (Version: 3.7.194 - McAfee, Inc.)

McAfee Virtual Technician (HKLM-x32\...\McAfee Virtual Technician) (Version: 7.6.0.202 - McAfee, Inc.)

Microsoft Office (HKLM-x32\...\{90150000-0138-0409-0000-0000000FF1CE}) (Version: 15.0.4569.1506 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.51106 (HKLM-x32\...\{6e8f74e0-43bd-4dce-8477-6ff6828acc07}) (Version: 11.0.51106.1 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (HKLM-x32\...\{95716cce-fc71-413f-8ad5-56c2892d4b3a}) (Version: 11.0.60610.1 - Microsoft Corporation)

Nitro Pro 9 (HKLM\...\{70B831B7-A8EE-4C5F-8F34-F383D24B3A04}) (Version: 9.0.5.9 - Nitro)

Optimizer Pro v3.2 (HKLM-x32\...\Optimizer Pro_is1) (Version: 3.2.0.3 - PC Utilities Software Limited) <==== ATTENTION

Power2Go (HKLM-x32\...\{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 5.6.0.10525 - CyberLink Corp.)

REALTEK Bluetooth Driver (HKLM-x32\...\{9D3D8C60-A5EF-4123-B2B9-172095903AB}) (Version: 3.805.806.012214 - REALTEK Semiconductor Corp.)

Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.2.9600.39053 - Realtek Semiconductor Corp.)

Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.20.815.2013 - Realtek)

REALTEK Wireless LAN Driver (HKLM-x32\...\{9DAABC60-A5EF-41FF-B2B9-17329590CD5}) (Version: 1.00.0238 - REALTEK Semiconductor Corp.)

Start Menu (HKU\S-1-5-21-2025283895-1953685814-2999071867-1001\...\Pokki_Start_Menu) (Version: 0.269.5.367 - Pokki)

Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 17.0.14.74 - Synaptics Incorporated)

User Manuals (HKLM-x32\...\InstallShield_{F07C2CF8-4C53-4EC3-8162-A6221E36EB88}) (Version: 3.0.0.3 - Lenovo)

User Manuals (x32 Version: 3.0.0.3 - Lenovo) Hidden

Windows Driver Package - Lenovo (ACPIVPC) System (09/24/2013 19.29.2.34) (HKLM\...\EE9B1F2037C580F36D92FA431CC02BFF04C31F15) (Version: 09/24/2013 19.29.2.34 - Lenovo)

Windows Driver Package - Lenovo (WUDFRd) LenovoVhid (07/25/2013 10.30.0.288) (HKLM\...\6BCA401E9CBEED970D75F55FA5320F60D11984E9) (Version: 07/25/2013 10.30.0.288 - Lenovo)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-2025283895-1953685814-2999071867-1001_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\windows\system32\igfxEM.exe (Intel Corporation)

==================== Restore Points =========================

16-01-2015 09:13:28 Windows Update

02-02-2015 17:28:52 Removed Nitro Pro 9

03-02-2015 10:35:16 Restore Operation

04-03-2015 16:23:47 Windows Update

06-03-2015 13:37:47 Removed PowerDirector.

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 08:25 - 2013-08-22 08:25 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {127A8B67-570F-46E3-AB30-1E697A7C23DE} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-12-08] (Google Inc.)

Task: {2F981AC6-A603-4595-B7A3-1B98F4F17C7C} - System32\Tasks\PDVDServ Task => C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.EXE [2013-03-08] (CyberLink Corp.)

Task: {3CDFB379-E4C0-4E0F-BAFA-46C0B5FA1227} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program => C:\Program Files\Lenovo\Customer Feedback Program\Lenovo.TVT.CustomerFeedback.Agent.exe [2014-10-16] (Lenovo)

Task: {5EE0751E-AA3C-4712-809B-3FE643316F9B} - System32\Tasks\Maxthon Update => C:\Program Files (x86)\Maxthon\Bin\mxup.exe [2013-10-14] (Maxthon International ltd.)

Task: {6375C7CE-03A2-47B9-B097-7C522F379641} - System32\Tasks\Lenovo\Lenovo Solution Center Launcher => C:\Program Files\lenovo\lenovo solution center\App\LSCService.exe [2014-10-16] (Lenovo)

Task: {65D425EF-EF8E-4E3C-B47B-A004FA365008} - System32\Tasks\Lenovo\LSC\Lenovo Solution Center Notifications => C:\Program Files\Lenovo\Lenovo Solution Center\LSCNotify.exe [2014-10-16] (Lenovo)

Task: {814DDB08-1658-489A-B994-9AF3716B3C88} - System32\Tasks\{EE3271BE-FF68-4268-B9B8-FCAB070DE8B8} => pcalua.exe -a "C:\Program Files\Reimage\Reimage Repair\uninst.exe"

Task: {889776D6-5E25-4381-938E-D16B8770881E} - System32\Tasks\Lenovo\LSC\LSCTaskService => C:\Program Files\Lenovo\Lenovo Solution Center\App\LSCTaskService.exe [2014-10-16] ()

Task: {9D75B641-BE13-4EFA-90F2-7276A2AA30D9} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-12-08] (Google Inc.)

Task: {A05659C9-EEA2-4A1D-A593-8B352EFEC3DF} - System32\Tasks\Synaptics TouchPad Enhancements => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2013-12-23] (Synaptics Incorporated)

Task: {E2EB359A-5F5F-48F5-833A-DF67F36FA01E} - System32\Tasks\CCleanerSkipUAC => C:\PROGRAM FILES\CCLEANER\CCLEANER.EXE [2014-11-21] (Piriform Ltd)

Task: {ED6DB43E-E3E4-456E-8C4E-DBF95F904D30} - System32\Tasks\Lenovo\LSC\LSCHardwareScan => C:\Program Files\Lenovo\Lenovo Solution Center\LSC.exe [2014-10-16] ()

Task: {F109A2DE-FCD1-481B-9084-A64CA1479174} - System32\Tasks\OFFICE2013ACT => C:\ProgramData\Office2013\OFFICEICON.vbs [2013-06-03] ()

Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) ==============

2014-06-11 14:34 - 2014-01-22 16:04 - 00084992 _____ () C:\Program Files (x86)\REALTEK\Realtek Bluetooth\BTDevMgr.exe

2014-06-11 15:10 - 2012-04-24 21:43 - 00390632 _____ () C:\Program Files\CyberLink\Shared files\RichVideo64.exe

2014-06-11 15:17 - 2014-06-11 15:17 - 00067856 _____ () C:\Program Files (x86)\Lenovo\Lenovo VeriFace Pro\VfConnectorService.exe

2014-06-11 15:17 - 2014-06-11 15:17 - 00672016 _____ () C:\Program Files (x86)\Lenovo\Lenovo VeriFace Pro\VfDataStorageInterface.dll

2014-06-11 14:30 - 2010-10-25 23:40 - 00049056 _____ () C:\Program Files\CONEXANT\ForteConfig\fmapp.exe

2014-03-12 03:37 - 2014-03-07 11:21 - 00080312 _____ () C:\windows\system32\igfxexps.dll

2014-12-08 13:33 - 2014-12-08 13:33 - 03908176 _____ () c:\Program Files (x86)\Optimizer Pro 3.11\OptProMon.dll

2014-12-08 13:41 - 2014-11-25 01:39 - 01077064 _____ () C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.71\libglesv2.dll

2014-12-08 13:41 - 2014-11-25 01:39 - 00211272 _____ () C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.71\libegl.dll

2014-12-08 13:41 - 2014-11-25 01:39 - 09009480 _____ () C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.71\pdf.dll

2014-12-08 13:41 - 2014-11-25 01:39 - 01677128 _____ () C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.71\ffmpegsumo.dll

2014-12-08 13:41 - 2014-11-25 01:39 - 14910280 _____ () C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.71\PepperFlash\pepflashplayer.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => ""=""

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\McMPFSvc => ""="Service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MCODS => ""=""

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefire => ""="Driver"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefirek => ""="Driver"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefirek.sys => ""="Driver"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfehidk => ""="Driver"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfehidk.sys => ""="Driver"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfevtp => ""="Driver"

==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-2025283895-1953685814-2999071867-1001\Control Panel\Desktop\\Wallpaper -> C:\windows\Web\Wallpaper\Lenovo\LenovoWallPaper.jpg

DNS Servers: 192.168.0.1 - 216.170.153.146

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

HKLM\...\StartupApproved\Run: => "PhoneCompanion"

HKLM\...\StartupApproved\Run: => "Lenovo Utility"

HKU\S-1-5-21-2025283895-1953685814-2999071867-1001\...\StartupApproved\Run: => "Pokki"

==================== Accounts: =============================

Administrator (S-1-5-21-2025283895-1953685814-2999071867-500 - Administrator - Disabled)

Guest (S-1-5-21-2025283895-1953685814-2999071867-501 - Limited - Disabled)

lawill (S-1-5-21-2025283895-1953685814-2999071867-1001 - Administrator - Enabled) => C:\Users\lawill

==================== Faulty Device Manager Devices =============

==================== Event log errors: =========================

Application errors:

==================

Error: (03/06/2015 01:38:25 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )

Description: Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.

Details:

AddLegacyDriverFiles: Unable to back up image of binary Spyware Terminator Driver Filter.

System Error:

The system cannot find the file specified.

Error: (03/06/2015 01:32:00 PM) (Source: SideBySide) (EventID: 78) (User: )

Description: Activation context generation failed for "C:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest1".Error in manifest or policy file "C:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest2" on line C:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest3.

A component version required by the application conflicts with another component version already active.

Conflicting components are:.

Component 1: C:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.

Component 2: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.

Error: (03/06/2015 09:14:04 AM) (Source: SideBySide) (EventID: 78) (User: )

A component version required by the application conflicts with another component version already active.

Conflicting components are:.

Component 1: C:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.

Component 2: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.

Error: (03/04/2015 04:32:10 PM) (Source: SideBySide) (EventID: 78) (User: )

A component version required by the application conflicts with another component version already active.

Conflicting components are:.

Component 1: C:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.

Component 2: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.

Error: (02/04/2015 08:33:44 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: TheBiff)

Description: Activation of app Microsoft.BingWeather_8wekyb3d8bbwe!App failed with error: -2144927142 See the Microsoft-Windows-TWinUI/Operational log for additional information.

Error: (02/04/2015 06:23:32 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: TheBiff)

Description: Activation of app Microsoft.BingNews_8wekyb3d8bbwe!AppexNews failed with error: -2147009284 See the Microsoft-Windows-TWinUI/Operational log for additional information.

Error: (02/03/2015 10:26:03 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: TheBiff)

Description: Activation of app Microsoft.BingNews_8wekyb3d8bbwe!AppexNews failed with error: -2147009284 See the Microsoft-Windows-TWinUI/Operational log for additional information.

Error: (02/03/2015 01:27:02 PM) (Source: Desktop Window Manager) (EventID: 9020) (User: )

Description: The Desktop Window Manager has encountered a fatal error (0x8898008d)

Error: (02/03/2015 11:28:32 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: TheBiff)

Description: Activation of app Microsoft.BingNews_8wekyb3d8bbwe!AppexNews failed with error: -2147009284 See the Microsoft-Windows-TWinUI/Operational log for additional information.

Error: (02/03/2015 11:13:32 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: TheBiff)

Description: Activation of app Microsoft.BingNews_8wekyb3d8bbwe!AppexNews failed with error: -2147009284 See the Microsoft-Windows-TWinUI/Operational log for additional information.

System errors:

=============

Error: (03/06/2015 04:21:50 PM) (Source: Service Control Manager) (EventID: 7023) (User: )

Description: The Interactive Services Detection service terminated with the following error:

%%1

Error: (03/06/2015 04:19:59 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: The McAfee Proxy Service service failed to start due to the following error:

%%1053

Error: (03/06/2015 04:19:59 PM) (Source: Service Control Manager) (EventID: 7009) (User: )

Description: A timeout was reached (30000 milliseconds) while waiting for the McAfee Proxy Service service to connect.

Error: (03/06/2015 04:19:59 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: The McAfee Personal Firewall Service service failed to start due to the following error:

%%1053

Error: (03/06/2015 04:19:59 PM) (Source: Service Control Manager) (EventID: 7009) (User: )

Description: A timeout was reached (30000 milliseconds) while waiting for the McAfee Personal Firewall Service service to connect.

Error: (03/06/2015 04:19:27 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: The McAfee Proxy Service service failed to start due to the following error:

%%1053

Error: (03/06/2015 04:19:27 PM) (Source: Service Control Manager) (EventID: 7009) (User: )

Description: A timeout was reached (30000 milliseconds) while waiting for the McAfee Proxy Service service to connect.

Error: (03/06/2015 04:19:26 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: The McAfee Personal Firewall Service service failed to start due to the following error:

%%1053

Error: (03/06/2015 04:19:26 PM) (Source: Service Control Manager) (EventID: 7009) (User: )

Description: A timeout was reached (30000 milliseconds) while waiting for the McAfee Personal Firewall Service service to connect.

Error: (03/06/2015 04:18:26 PM) (Source: DCOM) (EventID: 10005) (User: NT AUTHORITY)

Description: 1053mcpltsvcUnavailable{20966775-18A4-4299-B8E3-772C336B52A7}

Microsoft Office Sessions:

=========================

Error: (03/06/2015 01:38:25 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )

Description:

Details:

AddLegacyDriverFiles: Unable to back up image of binary Spyware Terminator Driver Filter.

System Error:

The system cannot find the file specified.

Error: (03/06/2015 01:32:00 PM) (Source: SideBySide) (EventID: 78) (User: )

Description: C:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\Users\lawill\AppData\Local\Pokki\Engine\HostAppService.exe

Error: (03/06/2015 09:14:04 AM) (Source: SideBySide) (EventID: 78) (User: )

Error: (03/04/2015 04:32:10 PM) (Source: SideBySide) (EventID: 78) (User: )

Error: (02/04/2015 08:33:44 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: TheBiff)

Description: Microsoft.BingWeather_8wekyb3d8bbwe!App-2144927142

Error: (02/04/2015 06:23:32 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: TheBiff)

Description: Microsoft.BingNews_8wekyb3d8bbwe!AppexNews-2147009284

Error: (02/03/2015 10:26:03 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: TheBiff)

Description: Microsoft.BingNews_8wekyb3d8bbwe!AppexNews-2147009284

Error: (02/03/2015 01:27:02 PM) (Source: Desktop Window Manager) (EventID: 9020) (User: )

Description: 0x8898008d

Error: (02/03/2015 11:28:32 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: TheBiff)

Description: Microsoft.BingNews_8wekyb3d8bbwe!AppexNews-2147009284

Error: (02/03/2015 11:13:32 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: TheBiff)

Description: Microsoft.BingNews_8wekyb3d8bbwe!AppexNews-2147009284

==================== Memory info ===========================

Processor: Intel® Celeron® CPU N2830 @ 2.16GHz

Percentage of memory in use: 90%

Total physical RAM: 1931.21 MB

Available physical RAM: 187.63 MB

Total Pagefile: 3275.21 MB

Available Pagefile: 829.33 MB

Total Virtual: 131072 MB

Available Virtual: 131071.81 MB

==================== Drives ================================

Drive c: (Windows8_OS) (Fixed) (Total:257.15 GB) (Free:227.09 GB) NTFS ==>[System with boot components (obtained from reading drive)]

Drive d: (LENOVO) (Fixed) (Total:25 GB) (Free:24.9 GB) NTFS

==================== MBR & Partition Table ==================

========================================================

Disk: 0 (Size: 298.1 GB) (Disk ID: 9A32C9E9)

Partition: GPT Partition Type.

==================== End Of Log ============================

#4
zep516

Posted 07 March 2015 - 07:01 PM

Trusted Helper

Malware Removal
8,093 posts

Hello,

Farber Recovery Scanner needs to be running fron the desktop. You have it in the downloads folder. Please move to desktop
To do that:

Navagate to your downloads folder-->C:\Users\lawill\Downloads
In the downloads folder find FRST
Right click on it,Choose cut
Go back to the desktop.
On an empty space right click, choose paste.
Farber will now have been successfully moved to desktop. No additional scan is necessary.

Thanks,
Let me review the logs you posted.

Joe

#5
sdrspudman

Posted 08 March 2015 - 03:50 AM

Member

Topic Starter
Member
53 posts

Done...Thanks...not too familiar with anything beyond windowsXP yet LOL

Edited by sdrspudman, 08 March 2015 - 03:50 AM.

#6
zep516

Posted 08 March 2015 - 04:06 PM

Trusted Helper

Malware Removal
8,093 posts

Next

A few items to fix

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Open notepad (Start =>All Programs => Accessories => Notepad).
Copy/Paste the contents of the code box below into Notepad.

start
CloseProcesses:
CreateRestorePoint:
HKLM\...\Policies\Explorer: [NoControlPanel] 0
HKLM\...\Policies\Explorer: [NoFolderOptions] 0
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-2025283895-1953685814-2999071867-1001\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-2025283895-1953685814-2999071867-1001 -> DefaultScope {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = 
BHO: SHopperMAsteer -> {030a4c79-a86b-4eab-88fe-caae27d43e19} -> C:\ProgramData\SHopperMAsteer\Nm9DTshH8Ou3bl.x64.dll [2015-01-13] ()
BHO: BetterPricceChec -> {48be1d7a-41fa-4dbb-8ed5-2979bdd48d73} -> C:\Program Files (x86)\BetterPricceChec\b0pouHodCm2YHa.x64.dll [2015-03-06] ()
BHO: No Name -> {497f7640-e809-4b95-8e3a-711f4c27df63} ->  No File
BHO: No Name -> {856d397c-8da1-4b35-a989-01c6ccf1c50b} ->  No File
BHO: LucckyShaoaPpeer -> {bc2bccc0-b4a0-43ca-9852-13098376e93d} -> C:\Program Files (x86)\LucckyShaoaPpeer\UkJyLGa5KM9dGW.x64.dll [2015-03-06] ()
BHO-x32: SHopperMAsteer -> {030a4c79-a86b-4eab-88fe-caae27d43e19} -> C:\ProgramData\SHopperMAsteer\Nm9DTshH8Ou3bl.dll [2015-01-13] ()
BHO-x32: BetterPricceChec -> {48be1d7a-41fa-4dbb-8ed5-2979bdd48d73} -> C:\Program Files (x86)\BetterPricceChec\b0pouHodCm2YHa.dll [2015-03-06] ()
BHO-x32: No Name -> {497f7640-e809-4b95-8e3a-711f4c27df63} ->  No File
BHO-x32: No Name -> {856d397c-8da1-4b35-a989-01c6ccf1c50b} ->  No File
BHO-x32: LucckyShaoaPpeer -> {bc2bccc0-b4a0-43ca-9852-13098376e93d} -> C:\Program Files (x86)\LucckyShaoaPpeer\UkJyLGa5KM9dGW.dll [2015-03-06] ()
2015-03-06 09:33 - 2015-03-06 09:34 - 00000000 ____D () C:\Program Files (x86)\LucckyShaoaPpeer
2015-03-06 09:33 - 2015-03-06 09:33 - 00000000 ____D () C:\Program Files (x86)\Quick Block
2015-03-06 09:33 - 2015-03-06 09:33 - 00000000 ____D () C:\Program Files (x86)\BetterPricceChec
2015-03-05 05:57 - 2015-03-06 09:30 - 00000000 ____D () C:\Program Files (x86)\KingaCoupon
2015-03-06 17:59 - 2015-02-04 17:13 - 00000020 _____ () C:\Users\lawill\AppData\Roaming\appdataFr3.bin
2015-03-06 09:29 - 2015-01-05 09:03 - 00000000 ____D () C:\ProgramData\saevinsahoP
2015-03-06 09:26 - 2015-01-05 09:04 - 00000000 ____D () C:\ProgramData\leesS2payy
2015-03-04 18:01 - 2015-02-03 11:38 - 00000000 ____D () C:\Program Files (x86)\RoyaleCouPoN
2015-03-04 18:01 - 2015-02-03 11:37 - 00000000 ____D () C:\Program Files (x86)\QueenCooupon
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\McMPFSvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MCODS => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefire => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefirek => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefirek.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfehidk => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfehidk.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfevtp => ""="Driver"
CMD: ipconfig /flushdns
hosts:
Emptytemp:
end

Click Format and ensure Wordwrap is unchecked.
Save as Fixlist.txt to your Desktop (Must be in this location)
Run FRST/FRST64 and press the Fix button just once and wait.
If the tool needed a restart please make sure you let the system to restart normally and let the tool completes its run after restart.
The tool will make a log on the Desktop (Fixlog.txt). Please post it to your reply.

Note: If the tool warns you about the version you're using being an outdated version please download and run the updated version.

Next

Please download AdwCleaner by Xplode onto your Desktop.

Close all open programs and internet browsers.
Double click on AdwCleaner.exe to run the tool.
Click the Scan button and wait for the process to complete.
Click the Report button and the report will open in Notepad.
NOTE: If you get an error message, it means that nothing was found. Exit from AdwCleaner.
Click on the Clean button follow the prompts.
A log file will automatically open after the scan has finished and the PC has rebooted.
Please post the content of that log file with your next answer.
You can find the log file at C:\AdwCleaner
Next

Please download Junkware Removal Tool to your Desktop.

Please close your security software to avoid potential conflicts. See Here how to disable you security protection (Anti Virus)
Run the tool by double-clicking it. If you are using Windows Vista or 7, right-mouse click it and select Run as administrator.
The tool will open and start scanning your system.
Please be patient as this can take a while to complete, depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your Desktop and will automatically open.
Please post the contents of JRT.txt into your reply.

In your next reply post;
- Fixlog.txt That log will be located on your desktop when the fix completes.
- The AdwCleaner [SO].txt Log
- The JRT.txt Log
Thanks
Joe

#7
sdrspudman

Posted 08 March 2015 - 09:08 PM

Member

Topic Starter
Member
53 posts

# AdwCleaner v4.109 - Report created 02/02/2015 at 20:45:28

# Updated 24/01/2015 by Xplode

# Database : 2015-02-02.1 [Live]

# Operating System : Windows 8.1 Connected (64 bits)

# Username : lawill - THEBIFF

# Running from : C:\Users\lawill\Downloads\adwcleaner_4.109.exe

# Option : Clean

***** [ Services ] *****

Service Deleted : 051cdb72

***** [ Files / Folders ] *****

Folder Deleted : C:\ProgramData\leesS2payy

Folder Deleted : C:\ProgramData\saevinsahoP

Folder Deleted : C:\ProgramData\shhoipandropu

Folder Deleted : C:\ProgramData\SHopperMAsteer

Folder Deleted : C:\ProgramData\1781179848093534370

Folder Deleted : C:\ProgramData\18b805a27eb308a2

Folder Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Optimizer Pro v3.2

Folder Deleted : C:\Program Files (x86)\Optimizer Pro 3.11

Folder Deleted : C:\Program Files (x86)\ClickFourSaele

Folder Deleted : C:\Program Files (x86)\PrrIIncEECoupon

Folder Deleted : C:\ProgramData\neoeapogjflfbgkbamcimndnpigmnnem

File Deleted : C:\Users\lawill\Desktop\Optimizer Pro.lnk

***** [ Scheduled Tasks ] *****

***** [ Shortcuts ] *****

***** [ Registry ] *****

Key Deleted : HKCU\Software\Classes\pokki

Value Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [Pokki]

Key Deleted : HKLM\SOFTWARE\Classes\.

Key Deleted : HKLM\SOFTWARE\Classes\..9

Key Deleted : HKLM\SOFTWARE\Classes\Paace40af_6315_4894_a3c3_08fff9f68bbd_.Paace40af_6315_4894_a3c3_08fff9f68bbd_

Key Deleted : HKLM\SOFTWARE\Classes\Paace40af_6315_4894_a3c3_08fff9f68bbd_.Paace40af_6315_4894_a3c3_08fff9f68bbd_.9

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{497f7640-e809-4b95-8e3a-711f4c27df63}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{856d397c-8da1-4b35-a989-01c6ccf1c50b}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{aace40af-6315-4894-a3c3-08fff9f68bbd}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{230332DF-D235-47EE-BC42-60860EF144CD}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{AEF2BB85-DF75-41E2-8366-FB89A5F869F9}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{E0D6077D-7186-48B2-A6C6-2F7C533E8CFF}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{497f7640-e809-4b95-8e3a-711f4c27df63}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{856d397c-8da1-4b35-a989-01c6ccf1c50b}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{aace40af-6315-4894-a3c3-08fff9f68bbd}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{497f7640-e809-4b95-8e3a-711f4c27df63}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{856d397c-8da1-4b35-a989-01c6ccf1c50b}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{aace40af-6315-4894-a3c3-08fff9f68bbd}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{497f7640-e809-4b95-8e3a-711f4c27df63}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{856d397c-8da1-4b35-a989-01c6ccf1c50b}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{aace40af-6315-4894-a3c3-08fff9f68bbd}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{497f7640-e809-4b95-8e3a-711f4c27df63}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{856d397c-8da1-4b35-a989-01c6ccf1c50b}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{aace40af-6315-4894-a3c3-08fff9f68bbd}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{497f7640-e809-4b95-8e3a-711f4c27df63}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{856d397c-8da1-4b35-a989-01c6ccf1c50b}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{aace40af-6315-4894-a3c3-08fff9f68bbd}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{497f7640-e809-4b95-8e3a-711f4c27df63}

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{856d397c-8da1-4b35-a989-01c6ccf1c50b}

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{aace40af-6315-4894-a3c3-08fff9f68bbd}

Key Deleted : HKCU\Software\Optimizer Pro

Key Deleted : HKCU\Software\Pokki

Key Deleted : HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}

Key Deleted : HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}

Key Deleted : HKLM\SOFTWARE\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}

Key Deleted : HKLM\SOFTWARE\{6791A2F3-FC80-475C-A002-C014AF797E9C}

Key Deleted : HKLM\SOFTWARE\SPPDCOM

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Pokki

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Optimizer Pro_is1

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.17416

-\\ Google Chrome v39.0.2171.71

[C:\Users\lawill\AppData\Local\Google\Chrome\User Data\Default\preferences] - Deleted [Extension] : booedmolknjekdopkepjjeckmjkdpfgl

[C:\Users\lawill\AppData\Local\Google\Chrome\User Data\Default\preferences] - Deleted [Extension] : flpcjncodpafbgdpnkljologafpionhb

*************************

AdwCleaner[R0].txt - [5783 octets] - [02/02/2015 20:26:05]

AdwCleaner[S0].txt - [5548 octets] - [02/02/2015 20:45:28]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [5608 octets] ##########

# AdwCleaner v4.111 - Logfile created 08/03/2015 at 22:33:10

# Updated 18/02/2015 by Xplode

# Database : 2015-03-05.1 [Server]

# Operating system : Windows 8.1 Connected (x64)

# Username : lawill - THEBIFF

# Running from : C:\Users\lawill\Downloads\adwcleaner_4.111.exe

# Option : Cleaning

***** [ Services ] *****

Service Deleted : 051cdb72

***** [ Files / Folders ] *****

Folder Deleted : C:\ProgramData\leesS2payy

Folder Deleted : C:\ProgramData\saevinsahoP

Folder Deleted : C:\ProgramData\shhoipandropu

Folder Deleted : C:\ProgramData\SHopperMAsteer

Folder Deleted : C:\ProgramData\1781179848093534370

Folder Deleted : C:\ProgramData\18b805a27eb308a2

Folder Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Optimizer Pro v3.2

Folder Deleted : C:\Program Files (x86)\Optimizer Pro 3.11

Folder Deleted : C:\Program Files (x86)\BetterPricceChec

Folder Deleted : C:\Program Files (x86)\KingaCoupon

Folder Deleted : C:\Program Files (x86)\LucckyShaoaPpeer

Folder Deleted : C:\Program Files (x86)\LuckyyCouupon

Folder Deleted : C:\Program Files (x86)\QueenCooupon

Folder Deleted : C:\Program Files (x86)\RoyaleCouPoN

File Deleted : C:\windows\Reimage.ini

File Deleted : C:\Users\lawill\Desktop\Optimizer Pro.lnk

***** [ Scheduled tasks ] *****

***** [ Shortcuts ] *****

***** [ Registry ] *****

Key Deleted : HKCU\Software\Classes\pokki

Value Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [Pokki]

Key Deleted : HKLM\SOFTWARE\Classes\P030a4c79_a86b_4eab_88fe_caae27d43e19_.P030a4c79_a86b_4eab_88fe_caae27d43e19_

Key Deleted : HKLM\SOFTWARE\Classes\P030a4c79_a86b_4eab_88fe_caae27d43e19_.P030a4c79_a86b_4eab_88fe_caae27d43e19_.9

Key Deleted : HKLM\SOFTWARE\Classes\P48be1d7a_41fa_4dbb_8ed5_2979bdd48d73_.P48be1d7a_41fa_4dbb_8ed5_2979bdd48d73_

Key Deleted : HKLM\SOFTWARE\Classes\P48be1d7a_41fa_4dbb_8ed5_2979bdd48d73_.P48be1d7a_41fa_4dbb_8ed5_2979bdd48d73_.9

Key Deleted : HKLM\SOFTWARE\Classes\Pbc2bccc0_b4a0_43ca_9852_13098376e93d_.Pbc2bccc0_b4a0_43ca_9852_13098376e93d_

Key Deleted : HKLM\SOFTWARE\Classes\Pbc2bccc0_b4a0_43ca_9852_13098376e93d_.Pbc2bccc0_b4a0_43ca_9852_13098376e93d_.9

Key Deleted : HKLM\SOFTWARE\Classes\Pf59e1a6f_30be_4522_8a57_78f02d8a190e_.Pf59e1a6f_30be_4522_8a57_78f02d8a190e_

Key Deleted : HKLM\SOFTWARE\Classes\Pf59e1a6f_30be_4522_8a57_78f02d8a190e_.Pf59e1a6f_30be_4522_8a57_78f02d8a190e_.9

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{030a4c79-a86b-4eab-88fe-caae27d43e19}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{48be1d7a-41fa-4dbb-8ed5-2979bdd48d73}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{bc2bccc0-b4a0-43ca-9852-13098376e93d}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{f59e1a6f-30be-4522-8a57-78f02d8a190e}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{079E2F0F-FCA0-4163-BC82-5355B879E86E}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{41F978F3-431A-4464-A789-5C0692D562FB}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{AEF2BB85-DF75-41E2-8366-FB89A5F869F9}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{E0D6077D-7186-48B2-A6C6-2F7C533E8CFF}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{f59e1a6f-30be-4522-8a57-78f02d8a190e}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{030a4c79-a86b-4eab-88fe-caae27d43e19}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{48be1d7a-41fa-4dbb-8ed5-2979bdd48d73}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{bc2bccc0-b4a0-43ca-9852-13098376e93d}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{f59e1a6f-30be-4522-8a57-78f02d8a190e}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{030a4c79-a86b-4eab-88fe-caae27d43e19}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{48be1d7a-41fa-4dbb-8ed5-2979bdd48d73}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{bc2bccc0-b4a0-43ca-9852-13098376e93d}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{f59e1a6f-30be-4522-8a57-78f02d8a190e}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{f59e1a6f-30be-4522-8a57-78f02d8a190e}

Key Deleted : HKCU\Software\Optimizer Pro

Key Deleted : HKCU\Software\Pokki

Key Deleted : HKCU\Software\Reimage

Key Deleted : HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}

Key Deleted : HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}

Key Deleted : HKLM\SOFTWARE\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}

Key Deleted : HKLM\SOFTWARE\{6791A2F3-FC80-475C-A002-C014AF797E9C}

Key Deleted : HKLM\SOFTWARE\SPPDCOM

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Pokki

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Optimizer Pro_is1

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{BA5D43C9-D633-D0EC-CFEA-2ABA974B333D}

Key Deleted : [x64] HKLM\SOFTWARE\Reimage

***** [ Web browsers ] *****

-\\ Internet Explorer v11.0.9600.17416

-\\ Google Chrome v39.0.2171.71

[C:\Users\lawill\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [Search Provider] : hxxp://search.aol.com/aol/search?q={searchTerms}

[C:\Users\lawill\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [Search Provider] : hxxp://www.ask.com/web?q={searchTerms}

[C:\Users\lawill\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [Search Provider] : hxxp://taplika.com/results.php?f=4&q={searchTerms}&a=tlk_dwndlm_15_06_other&cd=2XzuyEtN2Y1L1QzutBzz0DtByEyEzy0FtCyB0F0DtAtCzyzztN0D0Tzu0StCtCtBzztN1L2XzutAtFyBtFtBtFtDtN1L1CzutCyEtBzytDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2SyCtCyB0FtBtCyDyEtGyDyC0A0FtG0ByC0B0EtG0Azy0DzztGtCtD0BzyzzyCtD0BtCtBtAtA2QtN1M1F1B2Z1V1N2Y1L1Qzu2StBtDtBzy0AyD0DtBtGtA0EyDyCtGyEzy0AtDtG0AzztDtCtGtBzytCtAtA0DtCtB0DzzyEtC2Q&cr=961314617&ir=

*************************

AdwCleaner[R0].txt - [12888 bytes] - [02/02/2015 21:26:05]

AdwCleaner[R1].txt - [1755 bytes] - [02/02/2015 21:55:17]

AdwCleaner[S0].txt - [12522 bytes] - [02/02/2015 21:45:28]

AdwCleaner[S1].txt - [1666 bytes] - [02/02/2015 21:59:04]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [12641 bytes] ##########

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 6.4.3 (03.01.2015:1)

OS: Windows 8.1 Connected x64

Ran by lawill on Sun 03/08/2015 at 22:57:50.21

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Registry Values

~~~ Registry Keys

~~~ Files

~~~ Folders

~~~ Event Viewer Logs were cleared

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on Sun 03/08/2015 at 23:03:46.17

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Joe, i don't see the fixlog.txt anywhere on my desktop.

I really appreciate the help....this one was a nasty one.

#8
zep516

Posted 09 March 2015 - 06:10 AM

Trusted Helper

Malware Removal
8,093 posts

Fixlog is always saved to the same location FRST is running from. That's why I wanted you to move it to the desktop so just in case it did not get moved to the desktop, check here for fixlog.txt--->C:\Users\lawill\Downloads

Joe

#9
sdrspudman

Posted 09 March 2015 - 02:49 PM

Member

Topic Starter
Member
53 posts

I put it on the desktop but dont see it. The original addition and frst log is there with a 3-7 date but nothing dated 3-8 I must be doing something wrong. It is definitely on the desk top.

#10
sdrspudman

Posted 09 March 2015 - 02:52 PM

Member

Topic Starter
Member
53 posts

Just in case it overwrote the 3-7 one I'll paste that.