Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

adultube.info virus

Started by VinodAntony10 , Apr 14 2015 04:06 AM

google chrome malware

This topic is locked

#1
VinodAntony10

Posted 14 April 2015 - 04:06 AM

Member

Member
19 posts

Hello

Google Chrome keeps getting redirected to a website called "http://adultube.info/community".Even while trying to type this message, I got redirected about 5 times. It is very irksome and keeps coming.

I've tried system restore but that didn't help.

Please help.

Attached Thumbnails

#2
zep516

Posted 14 April 2015 - 10:15 AM

Trusted Helper

Malware Removal
8,090 posts

Hi! My name is zep516 and Welcome to Geekstogo!
I'll do the best I can to resolve your computer issue
Please make sure to carefully read any instruction that I give you. If you're not sure, or if something unexpected happens, don't continue Stop and ask! Never be afraid to ask questions!

Please download Farbar Recovery Scan Tool and save it to your Desktop.

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
Press Scan button.
It will produce a log called FRST.txt in the same directory the tool is run from.
Please copy and paste log back here.
The first time the tool is run it generates another log (Addition.txt - also located in the same directory as FRST.exe/FRST64.exe). Please also paste that along with the FRST.txt into your reply.

#3
zep516

Posted 15 April 2015 - 06:35 AM

Trusted Helper

Malware Removal
8,090 posts

Hello,

Try posting the log reports now.

Thanks

Joe

#4
VinodAntony10

Posted 15 April 2015 - 06:59 AM

Member

Topic Starter
Member
19 posts

Here are the logs

FRST.txt

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 15-04-2015 01

Ran by Administrator (administrator) on ANTONY-3054D97E on 15-04-2015 17:34:06

Running from C:\Documents and Settings\Administrator\My Documents\Downloads\Programs

Loaded Profiles: Administrator (Available profiles: Administrator)

Platform: Microsoft Windows XP Professional Service Pack 3 (X86) OS Language: English (United States)

Internet Explorer Version 8 (Default browser: Opera)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(IObit) C:\Program Files\IObit\Advanced SystemCare 8\ASCService.exe

(IObit) C:\Program Files\IObit\Advanced SystemCare 8\Monitor.exe

(Intel Corporation) C:\WINDOWS\system32\igfxtray.exe

(Intel Corporation) C:\WINDOWS\system32\hkcmd.exe

(Intel Corporation) C:\WINDOWS\system32\igfxpers.exe

(Intel Corporation) C:\WINDOWS\system32\igfxsrvc.exe

(Realtek Semiconductor Corp.) C:\WINDOWS\RTHDCPL.EXE

(Zbshareware Lab) C:\Program Files\USB Disk Security\USBGuard.exe

(APN) C:\Program Files\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe

(LG Electronics) C:\Documents and Settings\Administrator\Bluebirds\BlueBirds.exe

(Tonec Inc.) D:\idm\Internet Download Manager\IDMan.exe

(APN LLC.) C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe

() C:\Program Files\Garena Plus\ggdllhost.exe

(Microsoft Corporation) C:\WINDOWS\system32\wbem\unsecapp.exe

(Microsoft Corporation) C:\WINDOWS\system32\wscntfy.exe

(Tonec Inc.) D:\idm\Internet Download Manager\IEMonitor.exe

(IObit) C:\Program Files\IObit\IObit Uninstaller\UninstallMonitor.exe

() C:\Program Files\IObit\Advanced SystemCare 8\RealTimeProtector.exe

(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbam.exe

(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe

(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe

() C:\Program Files\Garena Plus\GarenaMessenger.exe

(BitTorrent Inc.) C:\Documents and Settings\Administrator\Application Data\BitTorrent\BitTorrent.exe

(Opera Software) C:\Program Files\Opera\28.0.1750.51\opera.exe

() C:\Program Files\Opera\28.0.1750.51\opera_crashreporter.exe

(Opera Software) C:\Program Files\Opera\28.0.1750.51\opera.exe

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDCPL] => C:\WINDOWS\RTHDCPL.EXE [17567744 2009-03-27] (Realtek Semiconductor Corp.)

HKLM\...\Run: [USB Security] => C:\Program Files\USB Disk Security\USBGuard.exe [623520 2011-01-31] (Zbshareware Lab)

HKLM\...\Run: [ApnTBMon] => C:\Program Files\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe [2005896 2015-03-26] (APN)

HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [446392 2012-04-04] (Adobe Systems Incorporated)

HKLM\...\Run: [SwitchBoard] => C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)

HKLM\...\Run: [AdobeCS6ServiceManager] => C:\Program Files\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [1073312 2012-03-09] (Adobe Systems Incorporated)

HKU\S-1-5-21-299502267-1935655697-1417001333-500\...\Run: [bluebirds] => C:\Documents and Settings\Administrator\Bluebirds\BlueBirds.exe [270336 2009-04-29] (LG Electronics)

HKU\S-1-5-21-299502267-1935655697-1417001333-500\...\Run: [GarenaPlus] => C:\Program Files\Garena Plus\GarenaMessenger.exe [9981528 2015-01-20] ()

HKU\S-1-5-21-299502267-1935655697-1417001333-500\...\Run: [IDMan] => D:\idm\Internet Download Manager\IDMan.exe [3604048 2013-06-20] (Tonec Inc.)

HKU\S-1-5-21-299502267-1935655697-1417001333-500\...\Run: [AlcoholAutomount] => C:\Program Files\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe [75624 2012-01-05] (Alcohol Soft Development Team)

HKU\S-1-5-21-299502267-1935655697-1417001333-500\...\Run: [Advanced SystemCare 8] => C:\Program Files\IObit\Advanced SystemCare 8\ASCTray.exe [2429728 2015-04-08] (IObit)

HKU\S-1-5-21-299502267-1935655697-1417001333-500\...\MountPoints2: {561a9b10-dc1e-11e2-9771-806d6172696f} - G:\BlueBirds.exe

HKU\S-1-5-21-299502267-1935655697-1417001333-500\...\MountPoints2: {855889d6-6cac-11e3-9712-002618bd9288} - H:\.\StartModem.exe

HKU\S-1-5-21-299502267-1935655697-1417001333-500\...\MountPoints2: {e2419e63-e178-11e2-95ee-002618bd9288} - I:\setup.exe

HKU\S-1-5-21-299502267-1935655697-1417001333-500\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\WINDOWS\SNOWYDSK.SCR

ShellIconOverlayIdentifiers: [IDM Shell Extension] -> {CDC95B92-E27C-4745-A8C5-64A52A78855D} => D:\idm\Internet Download Manager\IDMShellExt.dll (Tonec Inc.)

GroupPolicy: Group Policy on Chrome detected <======= ATTENTION

CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank

HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

HKU\S-1-5-21-299502267-1935655697-1417001333-500\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.com

HKU\S-1-5-21-299502267-1935655697-1417001333-500\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft...=ie&ar=iesearch

BHO: IDM integration (IDMIEHlprObj Class) -> {0055C089-8582-441B-A0BF-17B458C2A3A8} -> D:\idm\Internet Download Manager\IDMIECC.dll [2013-06-20] (Internet Download Manager, Tonec Inc.)

BHO: ExplorerWnd Helper -> {10921475-03CE-4E04-90CE-E2E7EF20C814} -> C:\Program Files\IObit\IObit Uninstaller\UninstallExplorer32.dll [2015-04-14] (IObit)

BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2006-10-27] (Microsoft Corporation)

BHO: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll [2013-12-22] (Oracle Corporation)

BHO: Advanced SystemCare Surfing Protection -> {BA0C978D-D909-49B6-AFE2-8BDE245DC7E6} -> C:\Program Files\IObit\Surfing Protection\BrowerProtect\ASCPlugin_Protection.dll [2015-04-01] (IObit)

BHO: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll [2013-12-22] (Oracle Corporation)

Toolbar: HKLM - ExplorerWnd Helper - {10921475-03CE-4E04-90CE-E2E7EF20C814} - C:\Program Files\IObit\IObit Uninstaller\UninstallExplorer32.dll [2015-04-14] (IObit)

Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll [2006-10-27] (Microsoft Corporation)

Tcpip\Parameters: [DhcpNameServer] 5.104.175.150 8.8.8.8

FireFox:

========

FF ProfilePath: C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\a1zf5h3p.default

FF SelectedSearchEngine: Google

FF Homepage: hxxp://www.google.com/

FF DefaultSearchEngine: Google

FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_7_700_224.dll [2013-06-27] ()

FF Plugin: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files\Google\Picasa3\npPicasa3.dll [2014-01-07] (Google, Inc.)

FF Plugin: @java.com/DTPlugin,version=10.45.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll [2013-12-22] (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=10.45.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll [2013-12-22] (Oracle Corporation)

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)

FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2007-11-07] (Microsoft Corporation)

FF Plugin: @t.garena.com/garenatalk -> C:\Program Files\Garena Plus\bbtalk\plugins\npPlugin\npGarenaTalkPlugin.dll [2015-01-16] ( Garena)

FF Plugin: @videolan.org/vlc,version=1.1.0-rc -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2010-05-21] (the VideoLAN Team)

FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2013-09-26] (Adobe Systems Inc.)

FF user.js: detected! => C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\a1zf5h3p.default\user.js [2015-04-14]

FF Extension: Weather Now - C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\a1zf5h3p.default\Extensions\[email protected] [2013-06-27]

FF Extension: Advanced SystemCare Surfing Protection - C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\a1zf5h3p.default\Extensions\[email protected] [2015-04-14]

FF Extension: Firebug - C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\a1zf5h3p.default\Extensions\[email protected] [2013-07-06]

FF HKU\S-1-5-21-299502267-1935655697-1417001333-500\...\Firefox\Extensions: [[email protected]] - C:\Documents and Settings\Administrator\Application Data\IDM\idmmzcc5

FF Extension: IDM CC - C:\Documents and Settings\Administrator\Application Data\IDM\idmmzcc5 [2014-04-15]

FF HKU\S-1-5-21-299502267-1935655697-1417001333-500\...\SeaMonkey\Extensions: [[email protected]] - C:\Documents and Settings\Administrator\Application Data\IDM\idmmzcc5

FF Extension: No Name - C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [Not Found]

Chrome:

=======

CHR HKLM\...\Chrome\Extension: [aaaaipkbmjkakicapiinmamgjlkaeehh] - https://clients2.goo...ice/update2/crx

CHR HKLM\...\Chrome\Extension: [dchmpbaclbiioedakpcldenooikekokm] - No Path Or update_url value

CHR HKLM\...\Chrome\Extension: [dgadkdfaoaaboghcnjmbcppkalapgkmb] - No Path Or update_url value

CHR HKLM\...\Chrome\Extension: [jmolcgpienlcieaajfkkdamlngancncm] - D:\idm\Internet Download Manager\IDMGCExt.crx [2013-06-20]

CHR HKLM\...\Chrome\Extension: [kllhllgiijehpamgcmeciagegjecoaod] - No Path Or update_url value

CHR HKU\S-1-5-21-299502267-1935655697-1417001333-500\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [apdfllckaahabafndbhieahigkjlhalf] - No Path Or update_url value

CHR HKU\S-1-5-21-299502267-1935655697-1417001333-500\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [dchmpbaclbiioedakpcldenooikekokm] - No Path Or update_url value

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AdvancedSystemCareService8; C:\Program Files\IObit\Advanced SystemCare 8\ASCService.exe [814880 2015-04-03] (IObit)

S4 Apache2.2; C:\Program Files\Apache Software Foundation\Apache2.2\bin\httpd.exe [20549 2012-01-28] (Apache Software Foundation) [File not signed]

R2 APNMCP; C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe [180632 2015-03-26] (APN LLC.)

S4 AxAutoMntSrv; C:\Program Files\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe [75624 2012-01-05] (Alcohol Soft Development Team)

S4 idsvc; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [864256 2007-10-11] (Microsoft Corporation) [File not signed]

S4 JavaQuickStarterService; C:\Program Files\Java\jre7\bin\jqs.exe [182696 2013-12-22] (Oracle Corporation)

S2 LiveUpdateSvc; C:\Program Files\IObit\LiveUpdate\LiveUpdate.exe [2585376 2015-03-26] (IObit)

R2 MBAMScheduler; C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2015-03-17] (Malwarebytes Corporation)

R2 MBAMService; C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe [1080120 2015-03-17] (Malwarebytes Corporation)

S4 NetTcpPortSharing; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [122880 2007-10-11] (Microsoft Corporation) [File not signed]

S4 ss_conn_service; C:\Program Files\SAMSUNG\USB Drivers\25_escape\conn\ss_conn_service.exe [743688 2014-10-13] (DEVGURU Co., LTD.)

S4 StarWindServiceAE; C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe [370688 2009-12-24] (StarWind Software) [File not signed]

S3 SwitchBoard; C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 Ambfilt; C:\WINDOWS\System32\drivers\Ambfilt.sys [1684736 2008-08-05] (Creative)

R1 IDMTDI; C:\WINDOWS\System32\DRIVERS\idmtdi.sys [115912 2013-05-25] (Tonec Inc.)

R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [23256 2015-03-17] (Malwarebytes Corporation)

R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [119512 2015-04-15] (Malwarebytes Corporation)

S3 Monfilt; C:\WINDOWS\System32\drivers\Monfilt.sys [1389056 2006-01-04] (Creative Technology Ltd.)

S3 mtkmbim; C:\WINDOWS\System32\DRIVERS\mtkmbimx.sys [176896 2012-12-13] (MediaTek Inc.)

R3 MTsensor; C:\WINDOWS\System32\DRIVERS\ASACPI.sys [5810 2004-08-14] ()

R0 sptd; C:\WINDOWS\System32\Drivers\sptd.sys [320120 2014-08-04] (Duplex Secure Ltd.)

S3 wdf_usb; C:\WINDOWS\System32\DRIVERS\usb2ser.sys [68480 2013-02-21] (MediaTek Inc.)

R3 cpuz137; \??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\cpuz137\cpuz137_x32.sys [X]

S3 GGSAFERDriver; No ImagePath

S4 IntelIde; No ImagePath

U1 WS2IFSL; No ImagePath

U3 acqdwj3n; No ImagePath

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)

==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-15 17:34 - 2015-04-15 17:34 - 00000000 ____D () C:\FRST

2015-04-14 20:43 - 2015-04-15 10:41 - 00000414 _____ () C:\WINDOWS\Tasks\Opera scheduled Autoupdate 1429024374.job

2015-04-14 20:43 - 2015-04-14 20:43 - 00000675 _____ () C:\Documents and Settings\All Users\Start Menu\Programs\Opera.lnk

2015-04-14 20:43 - 2015-04-14 20:43 - 00000675 _____ () C:\Documents and Settings\All Users\Desktop\Opera.lnk

2015-04-14 20:33 - 2015-04-14 20:43 - 00000000 ____D () C:\Program Files\Opera

2015-04-14 19:57 - 2015-04-15 13:23 - 00119512 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys

2015-04-14 19:56 - 2015-04-14 19:56 - 00000777 _____ () C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk

2015-04-14 19:56 - 2015-04-14 19:56 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware

2015-04-14 19:56 - 2015-04-14 19:56 - 00000000 ____D () C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes Anti-Malware

2015-04-14 19:56 - 2015-04-14 19:56 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\Malwarebytes

2015-04-14 19:56 - 2015-03-17 06:15 - 00120024 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys

2015-04-14 19:56 - 2015-03-17 06:15 - 00023256 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys

2015-04-14 19:44 - 2015-04-14 19:44 - 00000104 _____ () C:\Documents and Settings\Administrator\Desktop\Internet.lnk

2015-04-14 19:30 - 2015-04-15 10:41 - 00000236 _____ () C:\WINDOWS\wiadebug.log

2015-04-14 19:30 - 2015-04-15 10:41 - 00000049 _____ () C:\WINDOWS\wiaservc.log

2015-04-14 19:30 - 2015-04-14 19:30 - 00000000 _____ () C:\WINDOWS\Sti_Trace.log

2015-04-14 17:24 - 2015-04-14 19:23 - 28872704 _____ () C:\WINDOWS\system32\config\software.iobit

2015-04-14 17:24 - 2015-04-14 19:23 - 00286720 _____ () C:\WINDOWS\system32\config\default.iobit

2015-04-14 17:24 - 2015-04-14 19:23 - 00053248 _____ () C:\WINDOWS\system32\config\SECURITY.iobit

2015-04-14 17:24 - 2015-04-14 19:23 - 00028672 _____ () C:\WINDOWS\system32\config\SAM.iobit

2015-04-14 16:37 - 2015-04-15 10:41 - 00000296 _____ () C:\WINDOWS\Tasks\ASC8_PerformanceMonitor.job

2015-04-14 16:37 - 2015-04-14 16:38 - 00000000 ____D () C:\Documents and Settings\Administrator\Application Data\ProductData

2015-04-14 16:36 - 2015-04-14 18:32 - 00000000 ____D () C:\Documents and Settings\Administrator\Application Data\IObit

2015-04-14 16:36 - 2015-04-14 18:30 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\ProductData

2015-04-14 16:36 - 2015-04-14 18:06 - 00001822 _____ () C:\Documents and Settings\All Users\Desktop\Advanced SystemCare 8.lnk

2015-04-14 16:36 - 2015-04-14 16:36 - 00000000 ____D () C:\WINDOWS\Tasks\ImCleanDisabled

2015-04-14 16:36 - 2015-04-14 16:36 - 00000000 ____D () C:\Program Files\Common Files\IObit

2015-04-14 16:36 - 2015-04-14 16:36 - 00000000 ____D () C:\Documents and Settings\All Users\Start Menu\Programs\Advanced SystemCare 8

2015-04-14 16:36 - 2015-04-14 16:36 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\{BAF091CA-86C4-4627-ADA1-897E2621C1B0}

2015-04-14 16:36 - 2015-04-14 16:36 - 00000000 ____D () C:\Documents and Settings\Administrator\Application Data\Apple Computer

2015-04-14 16:35 - 2015-04-14 19:29 - 00000000 ____D () C:\Program Files\IObit

2015-04-14 15:50 - 2015-04-14 15:50 - 00000000 ____D () C:\TDSSKiller_Quarantine

2015-04-14 14:48 - 2015-04-14 20:24 - 00000000 ____D () C:\Program Files\RichMediaViewV1

2015-04-14 14:48 - 2015-04-14 20:24 - 00000000 ____D () C:\Documents and Settings\Administrator\Application Data\FoxTab

2015-04-14 14:48 - 2015-04-14 14:48 - 00000000 ____D () C:\Program Files\Conduit

2015-04-14 14:48 - 2015-04-14 14:48 - 00000000 ____D () C:\Program Files\AskPartnerNetwork

2015-04-14 14:48 - 2015-04-14 14:48 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\Babylon

2015-04-14 14:48 - 2015-04-14 14:48 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\AskPartnerNetwork

2015-04-14 14:48 - 2015-04-14 14:48 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\APN

2015-04-14 14:48 - 2015-04-14 14:48 - 00000000 ____D () C:\Documents and Settings\Administrator\Local Settings\Application Data\VNT

2015-04-14 14:48 - 2015-04-14 14:48 - 00000000 ____D () C:\Documents and Settings\Administrator\Local Settings\Application Data\Conduit

2015-04-14 14:48 - 2015-04-14 14:48 - 00000000 ____D () C:\Documents and Settings\Administrator\Local Settings\Application Data\AskPartnerNetwork

2015-04-14 14:48 - 2015-04-14 14:48 - 00000000 ____D () C:\Documents and Settings\Administrator\Application Data\Babylon

2015-04-14 14:34 - 2015-04-14 14:34 - 00081920 _____ () C:\WINDOWS\Minidump\Mini041415-01.dmp

2015-04-14 14:19 - 2015-04-14 14:50 - 00000000 ____D () C:\Program Files\SystemConserve

2015-04-14 14:18 - 2015-04-14 14:48 - 00000000 ____D () C:\Program Files\Play

2015-04-14 14:17 - 2015-04-14 14:48 - 00000000 ____D () C:\Program Files\bestadblocker

2015-04-14 14:15 - 2015-04-14 14:15 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\cncaklookhiljnimkipmolldampgfcmf

2015-04-14 13:50 - 2015-04-14 14:01 - 00000000 ____D () C:\AdwCleaner

2015-04-14 13:40 - 2015-04-14 13:43 - 00000000 ____D () C:\sh4ldr(2)

2015-04-14 11:52 - 2015-04-14 11:52 - 00000000 ____D () C:\Program Files\Enigma Software Group

2015-04-06 15:56 - 2015-04-06 15:56 - 00000000 ____D () C:\Documents and Settings\Administrator\Desktop\Tor Browser

2015-03-22 15:14 - 2015-03-22 15:14 - 00081920 _____ () C:\WINDOWS\Minidump\Mini032215-01.dmp

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-15 17:34 - 2013-06-23 16:22 - 00000000 ____D () C:\Documents and Settings\Administrator\Local Settings\Temp

2015-04-15 17:32 - 2013-06-30 00:00 - 00000000 ____D () C:\Documents and Settings\Administrator\Application Data\BitTorrent

2015-04-15 17:30 - 2014-01-30 10:30 - 00000416 _____ () C:\WINDOWS\Tasks\At2.job

2015-04-15 17:30 - 2013-11-03 22:30 - 00000416 _____ () C:\WINDOWS\Tasks\At1.job

2015-04-15 14:54 - 2013-06-27 11:32 - 00000000 ____D () C:\Program Files\The KMPlayer

2015-04-15 14:25 - 2013-06-27 16:25 - 00000000 ____D () C:\Documents and Settings\Administrator\Local Settings\Application Data\Adobe

2015-04-15 14:09 - 2014-04-15 18:59 - 00000000 ____D () C:\Documents and Settings\Administrator\Application Data\IDM

2015-04-15 13:25 - 2013-06-24 08:53 - 00000000 ____D () C:\Documents and Settings\Administrator\Application Data\GarenaPlus

2015-04-15 13:25 - 2013-06-23 16:45 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\GarenaMessenger

2015-04-15 11:56 - 2013-06-23 16:45 - 00000000 ____D () C:\Program Files\Garena Plus

2015-04-15 10:42 - 2013-06-23 16:18 - 01532801 _____ () C:\WINDOWS\WindowsUpdate.log

2015-04-15 10:41 - 2013-06-23 16:22 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT

2015-04-15 10:40 - 2013-06-23 21:33 - 00000000 ____D () C:\WINDOWS\system

2015-04-14 21:41 - 2013-06-23 16:22 - 00012618 _____ () C:\WINDOWS\SchedLgU.Txt

2015-04-14 21:41 - 2013-06-23 16:22 - 00000178 ___SH () C:\Documents and Settings\Administrator\ntuser.ini

2015-04-14 21:11 - 2014-03-22 08:50 - 00000000 ____D () C:\Documents and Settings\Administrator\Desktop\vam

2015-04-14 20:43 - 2013-11-10 14:05 - 00000000 ____D () C:\Documents and Settings\Administrator\Local Settings\Application Data\Opera Software

2015-04-14 20:26 - 2013-07-21 18:32 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB2723135-v2$

2015-04-14 20:24 - 2014-01-30 10:30 - 00000000 ____D () C:\Documents and Settings\NetworkService\Application Data\FoxTab

2015-04-14 20:24 - 2013-09-01 08:57 - 00000000 ____D () C:\Documents and Settings\Administrator\Local Settings\Application Data\CRE

2015-04-14 19:36 - 2013-06-23 16:43 - 00000000 ____D () C:\Program Files\Google

2015-04-14 19:36 - 2013-06-23 16:43 - 00000000 ____D () C:\Documents and Settings\Administrator\Local Settings\Application Data\Google

2015-04-14 19:35 - 2013-06-23 16:36 - 00000000 ____D () C:\Documents and Settings\Administrator\Application Data\DMCache

2015-04-14 19:23 - 2013-06-23 16:22 - 00000000 __SHD () C:\Documents and Settings\NetworkService

2015-04-14 19:23 - 2013-06-23 16:22 - 00000000 __SHD () C:\Documents and Settings\LocalService

2015-04-14 18:30 - 2014-09-06 17:41 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\IObit

2015-04-14 18:13 - 2013-06-23 16:22 - 00000178 ___SH () C:\Documents and Settings\LocalService\ntuser.ini

2015-04-14 17:44 - 2013-07-02 21:34 - 00000000 ____D () C:\Documents and Settings\All Users\Start Menu\Programs\McAfee Security Scan Plus

2015-04-14 16:36 - 2013-06-23 16:22 - 00000000 ____D () C:\Documents and Settings\Administrator

2015-04-14 16:14 - 2013-06-23 21:38 - 00000211 ___SH () C:\boot.ini

2015-04-14 16:14 - 2004-08-04 17:30 - 00000791 _____ () C:\WINDOWS\win.ini

2015-04-14 16:14 - 2004-08-04 17:30 - 00000227 _____ () C:\WINDOWS\system.ini

2015-04-14 15:30 - 2013-12-19 13:30 - 00000103 _____ () C:\Documents and Settings\NetworkService\Application Data\WB.CFG

2015-04-14 14:51 - 2004-08-04 17:30 - 00002206 _____ () C:\WINDOWS\system32\wpa.dbl

2015-04-14 14:49 - 2013-06-23 16:15 - 00000000 ____D () C:\WINDOWS\Registration

2015-04-14 14:46 - 2013-06-23 16:45 - 00000000 ____D () C:\Documents and Settings\Administrator\Application Data\vlc

2015-04-14 13:00 - 2013-06-23 16:22 - 00001593 _____ () C:\Documents and Settings\Administrator\Start Menu\Programs\Remote Assistance.lnk

2015-04-14 13:00 - 2013-06-23 16:19 - 00001593 _____ () C:\Documents and Settings\Default User\Start Menu\Programs\Remote Assistance.lnk

2015-04-14 13:00 - 2013-06-23 16:19 - 00001507 _____ () C:\Documents and Settings\All Users\Start Menu\Windows Update.lnk

2015-04-03 20:34 - 2013-06-23 16:24 - 00075776 _____ () C:\Documents and Settings\Administrator\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

2015-04-01 20:30 - 2013-12-23 00:30 - 00000256 _____ () C:\Documents and Settings\Administrator\Application Data\WB.CFG

2015-03-22 15:14 - 2014-05-30 14:16 - 00000000 ____D () C:\WINDOWS\Minidump

2015-03-21 12:44 - 2013-11-27 22:29 - 00000038 _____ () C:\WINDOWS\AviSplitter.INI

2015-03-20 19:21 - 2014-05-30 15:06 - 00000000 ____D () C:\Documents and Settings\Administrator\Application Data\FlowStone

2015-03-19 18:12 - 2014-09-07 18:24 - 00000499 _____ () C:\Documents and Settings\Administrator\Desktop\vargheses phone.txt

==================== Files in the root of some directories =======

2013-09-19 14:35 - 2013-09-19 14:37 - 0000364 _____ () C:\Documents and Settings\Administrator\Application Data\burnaware.ini

2013-06-24 09:25 - 2015-01-24 12:40 - 0045194 _____ () C:\Documents and Settings\Administrator\Application Data\room_v3.dat

2013-12-23 00:30 - 2015-04-01 20:30 - 0000256 _____ () C:\Documents and Settings\Administrator\Application Data\WB.CFG

2013-06-23 16:24 - 2015-04-03 20:34 - 0075776 _____ () C:\Documents and Settings\Administrator\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

2014-04-05 22:37 - 2014-04-05 22:37 - 0000090 _____ () C:\Documents and Settings\Administrator\Local Settings\Application Data\FASTWiz.log

Files to move or delete:

====================

C:\Windows\Tasks\At1.job

C:\Windows\Tasks\At2.job

Some content of TEMP:

====================

C:\Documents and Settings\Administrator\Local Settings\Temp\ASCSetup_1323593.exe

C:\Documents and Settings\Administrator\Local Settings\Temp\avgnt.exe

C:\Documents and Settings\Administrator\Local Settings\Temp\Quarantine.exe

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\explorer.exe => File is digitally signed

C:\WINDOWS\system32\winlogon.exe => File is digitally signed

C:\WINDOWS\system32\svchost.exe => File is digitally signed

C:\WINDOWS\system32\services.exe => File is digitally signed

C:\WINDOWS\system32\User32.dll => File is digitally signed

C:\WINDOWS\system32\userinit.exe => File is digitally signed

C:\WINDOWS\system32\rpcss.dll => File is digitally signed

C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed

==================== End Of Log ============================Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 15-04-2015 01