Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

Ninja Loader will not delete from my system [Solved]

Started by skandranon1971 , Jul 11 2015 06:41 PM

This topic is locked

#1
skandranon1971

Posted 11 July 2015 - 06:41 PM

Member

Member
64 posts

I have attempted to remove it with Maiwarebytes anti-malware program and it will not remove:

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:11-07-2015

Ran by Jon (administrator) on KRAKEN on 11-07-2015 17:31:17

Running from C:\Users\Jon\Desktop

Loaded Profiles: Jon (Available Profiles: Jon)

Platform: Windows 8.1 (X64) OS Language: English (United States)

Internet Explorer Version 11 (Default browser: FF)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Softex Inc.) C:\Program Files\Hewlett-Packard\SimplePass\OmniServ.exe

(AMD) C:\Windows\System32\atiesrxx.exe

(Advanced Micro Devices, Inc.) C:\Windows\SysWOW64\tbaseprovisioning.exe

(AMD) C:\Windows\System32\atieclxx.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe

(Avast Software s.r.o.) C:\Program Files\AVAST Software\Avast\AvastSvc.exe

() C:\Program Files\ATI Technologies\ATI.ACE\a4\AdaptiveSleepService.exe

(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe

(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe

(Microsoft Corporation) C:\Windows\System32\dasHost.exe

(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPWMISVC.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe

(McAfee, Inc.) C:\Windows\System32\mfevtps.exe

(Ninja Soft Inc.) C:\Program Files (x86)\Ninja Loader\NinjaMaintainer.exe

(McAfee, Inc.) C:\Program Files\mcafee\msc\McAPExe.exe

(McAfee, Inc.) C:\Program Files\Common Files\mcafee\AMCore\mcshield.exe

(McAfee, Inc.) C:\Program Files\Common Files\mcafee\systemcore\mfefire.exe

(McAfee, Inc.) C:\Program Files\Common Files\mcafee\platform\McSvcHost\McSvHost.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe

(Ninja Soft Inc.) C:\Program Files (x86)\Ninja Loader\NinjaMaintainer.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe

() C:\Program Files\Hewlett-Packard\SimplePass\opvapp.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

(CyberLink Corp.) C:\Program Files (x86)\CyberLink\YouCam\YouCamService.exe

(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe

(Hewlett-Packard) C:\Program Files\Hewlett-Packard\SimplePass\ClientCore.exe

(Hewlett-Packard) C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBroker.exe

(Hewlett-Packard) C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBrokerDsktop.exe

(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Spotify Ltd) C:\Users\Jon\AppData\Roaming\Spotify\SpotifyWebHelper.exe

(BitTorrent Inc.) C:\Users\Jon\AppData\Roaming\uTorrent\uTorrent.exe

(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(McAfee, Inc.) C:\Program Files\Common Files\mcafee\platform\McUICnt.exe

(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe

(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPMSGSVC.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Avast Software s.r.o.) C:\Program Files\AVAST Software\Avast\AvastUI.exe

(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe

(McAfee, Inc.) C:\Program Files\Common Files\mcafee\CSP\1.3.336.0\McCSPServiceHost.exe

(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe

(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20911_x64__8wekyb3d8bbwe\livecomm.exe

(The Chromium Authors) C:\Users\Jon\AppData\Local\Ninja Loader\Discover\Discover.exe

(Microsoft Corporation) C:\Windows\SysWOW64\WWAHost.exe

(Microsoft Corporation) C:\Windows\System32\backgroundTaskHost.exe

(The Chromium Authors) C:\Users\Jon\AppData\Local\Ninja Loader\Discover\Discover.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officec2rclient.exe

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7535832 2014-02-12] (Realtek Semiconductor)

HKLM\...\Run: [SimplePass] => C:\Program Files\Hewlett-Packard\SimplePass\ClientCore.exe [3962936 2014-03-28] (Hewlett-Packard)

HKLM\...\Run: [OPBHOBroker] => C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBroker.exe [415288 2014-03-28] (Hewlett-Packard)

HKLM\...\Run: [OPBHOBrokerDesktop] => C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBrokerDsktop.exe [415288 2014-03-28] (Hewlett-Packard)

HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [558496 2014-02-27] (Adobe Systems Incorporated)

HKLM\...\Run: [SpaceSoundPro] => "C:\Program Files\SpaceSoundPro\SpaceSoundPro.exe"

HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [767200 2014-04-17] (Advanced Micro Devices, Inc.)

HKLM-x32\...\Run: [mcpltui_exe] => C:\Program Files\Common Files\mcafee\platform\McUICnt.exe [643064 2014-09-17] (McAfee, Inc.)

HKLM-x32\...\Run: [HPMessageService] => C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPMSGSVC.exe [1045304 2013-10-08] (Hewlett-Packard Development Company, L.P.)

HKLM-x32\...\Run: [AdobeCS6ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [1073312 2012-03-09] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5515496 2015-06-24] (Avast Software s.r.o.)

HKLM-x32\...\Run: [SwitchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [334896 2015-04-30] (Oracle Corporation)

HKLM\...\Policies\Explorer: [NoFolderOptions] 0

HKLM\...\Policies\Explorer: [NoControlPanel] 0

HKU\S-1-5-21-3105412986-3712989239-1590487086-1002\...\Run: [GoogleChromeAutoLaunch_1476D5075BFDEEA31B57A901BC660F86] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [813896 2015-07-06] (Google Inc.)

HKU\S-1-5-21-3105412986-3712989239-1590487086-1002\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [2888384 2015-05-14] (Valve Corporation)

HKU\S-1-5-21-3105412986-3712989239-1590487086-1002\...\Run: [AdobeBridge] => [X]

HKU\S-1-5-21-3105412986-3712989239-1590487086-1002\...\Run: [Spotify Web Helper] => C:\Users\Jon\AppData\Roaming\Spotify\SpotifyWebHelper.exe [2023480 2015-06-18] (Spotify Ltd)

HKU\S-1-5-21-3105412986-3712989239-1590487086-1002\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [8202008 2015-04-08] (Piriform Ltd)

HKU\S-1-5-21-3105412986-3712989239-1590487086-1002\...\Run: [uTorrent] => C:\Users\Jon\AppData\Roaming\uTorrent\uTorrent.exe [1694560 2015-05-06] (BitTorrent Inc.)

HKU\S-1-5-21-3105412986-3712989239-1590487086-1002\...\MountPoints2: F - "F:\Setup.exe"

HKU\S-1-5-21-3105412986-3712989239-1590487086-1002\...\MountPoints2: {9e122f1b-d294-11e4-8278-1458d0c06312} - "F:\LG_PC_Programs.exe"

AppInit_DLLs: C:\ProgramData\LolliScan\LolliScan64.dll => C:\ProgramData\LolliScan\LolliScan64.dll File not found

Startup: C:\Users\Jon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Send to OneNote.lnk [2015-02-25]

ShortcutTarget: Send to OneNote.lnk -> C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE (Microsoft Corporation)

ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2015-06-24] (Avast Software s.r.o.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/HPNOT14/1

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/HPNOT14/1

HKU\S-1-5-21-3105412986-3712989239-1590487086-1002\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/HPNOT14/1

HKU\S-1-5-21-3105412986-3712989239-1590487086-1002\Software\Microsoft\Internet Explorer\Main,First Home Page = http://g.msn.com/HPNOT14/1

SearchScopes: HKLM -> {3F6221C3-393E-485B-B1EC-5F93ED8B3DF6} URL = http://www.amazon.co...s={searchTerms}

SearchScopes: HKLM-x32 -> {3F6221C3-393E-485B-B1EC-5F93ED8B3DF6} URL = http://www.amazon.co...s={searchTerms}

SearchScopes: HKU\S-1-5-21-3105412986-3712989239-1590487086-1002 -> {3F6221C3-393E-485B-B1EC-5F93ED8B3DF6} URL = http://www.amazon.co...s={searchTerms}

BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2015-05-19] (Microsoft Corporation)

BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2015-06-24] (Avast Software s.r.o.)

BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2015-05-28] (Microsoft Corporation)

BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll [2013-08-28] (Hewlett-Packard)

BHO-x32: AcroIEHlprObj Class -> {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -> C:\Program Files (x86)\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx [2001-04-16] ()

BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\ssv.dll [2015-05-11] (Oracle Corporation)

BHO-x32: ArcPluginIEBHO Class -> {84BFE29A-8139-402a-B2A4-C23AE9E1A75F} -> C:\Program Files (x86)\Arc\Plugins\ArcPluginIE.dll [2015-02-09] (Perfect World Entertainment Inc)

BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2015-06-24] (Avast Software s.r.o.)

BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-05-11] (Oracle Corporation)

BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll [2013-08-28] (Hewlett-Packard)

Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2015-02-03] (Microsoft Corporation)

Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files\mcafee\msc\McSnIePl64.dll [2015-01-13] (McAfee, Inc.)

Filter-x32: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files (x86)\McAfee\msc\McSnIePl.dll [2015-01-13] (McAfee, Inc.)

Tcpip\Parameters: [DhcpNameServer] 68.105.28.12 68.105.29.12 68.105.28.11

Tcpip\..\Interfaces\{8EE1EAB9-B157-4B13-B3DB-8BCE8196BF62}: [DhcpNameServer] 68.105.28.12 68.105.29.12 68.105.28.11

Tcpip\..\Interfaces\{DFFE8011-ABA7-4E59-9450-DD5D8BF98E1C}: [DhcpNameServer] 68.105.28.12 68.105.29.12 68.105.28.11

FireFox:

========

FF ProfilePath: C:\Users\Jon\AppData\Roaming\Mozilla\Firefox\Profiles\q5rpe8bc.default

FF SelectedSearchEngine: Trovi

FF Homepage: hxxp://www.trovi.com/?gd=&ctid=CT3334822&octid=EB_ORIGINAL_CTID&ISID=M57B03A8F-928F-4362-AE67-176B61E66F90&SearchSource=55&CUI=&UM=8&UP=SP914EEEB9-B805-4B01-A2CD-F3DE8FA6FFF5&D=071115&SSPV=SP30339TB_sp_ff

FF Plugin: @mcafee.com/MSC,version=10 -> c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL [2015-01-13] ()

FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll [2014-04-28] (Adobe Systems)

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Program Files (x86)\ArcPlugins\NPSWF32.dll No File

FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\windows\SysWOW64\Adobe\Director\np32dsw_1204144.dll [2013-09-05] (Adobe Systems, Inc.)

FF Plugin-x32: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-05-11] (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-05-11] (Oracle Corporation)

FF Plugin-x32: @mcafee.com/MSC,version=10 -> c:\PROGRA~2\mcafee\msc\NPMCSN~1.DLL [2015-01-13] ()

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2015-02-24] (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3508.0205 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2013-02-05] (Microsoft Corporation)

FF Plugin-x32: @perfectworld.com/npArcPlayNowPlugin -> C:\Program Files (x86)\Arc\Plugins\npArcPluginFF.dll [2015-02-09] (Perfect World Entertainment Inc)

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-15] (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-15] (Google Inc.)

FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll [2012-10-12] ()

FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll [2014-04-28] (Adobe Systems)

FF HKLM-x32\...\Firefox\Extensions: [[email protected]] - C:\Program Files\AVAST Software\Avast\WebRep\FF

FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2015-03-15]

FF HKLM-x32\...\Firefox\Extensions: [[email protected]] - C:\Program Files (x86)\Babylon\Babylon-Pro\Utils\[email protected]

FF HKLM-x32\...\Thunderbird\Extensions: [[email protected]] - C:\Program Files\McAfee\MSK

FF Extension: McAfee Anti-Spam Thunderbird Extension - C:\Program Files\McAfee\MSK [2014-12-18]

FF HKU\S-1-5-21-3105412986-3712989239-1590487086-1002\...\Firefox\Extensions: [[email protected]] - C:\Program Files (x86)\Ninja Loader\FireFox

FF Extension: NinjaLoader - C:\Program Files (x86)\Ninja Loader\FireFox [2015-07-10]

Chrome:

=======

CHR Profile: C:\Users\Jon\AppData\Local\Google\Chrome\User Data\Default

CHR Extension: (Google Slides) - C:\Users\Jon\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-02-11]

CHR Extension: (Angry Birds) - C:\Users\Jon\AppData\Local\Google\Chrome\User Data\Default\Extensions\aknpkdffaafgjchaibgeefbgmgeghloj [2015-02-11]

CHR Extension: (Google Drive) - C:\Users\Jon\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-02-11]

CHR Extension: (YouTube) - C:\Users\Jon\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-02-11]

CHR Extension: (eBay) - C:\Users\Jon\AppData\Local\Google\Chrome\User Data\Default\Extensions\bnadbgmffcofipfljniafanjcafjlbom [2015-02-11]

CHR Extension: (Google Search) - C:\Users\Jon\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-02-11]

CHR Extension: (Word Search) - C:\Users\Jon\AppData\Local\Google\Chrome\User Data\Default\Extensions\dnjkggjhcbohgnikmegjkodmakmimlkj [2015-02-11]

CHR Extension: (Google Sheets) - C:\Users\Jon\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-02-11]

CHR Extension: (Avast Online Security) - C:\Users\Jon\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2015-03-16]

CHR Extension: (Cargo Bridge: Armor Games Edition) - C:\Users\Jon\AppData\Local\Google\Chrome\User Data\Default\Extensions\hlpiaibleklmjieibbnmkignbggodmmj [2015-02-11]

CHR Extension: (Personal Trainer) - C:\Users\Jon\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmgohkgndpahjklgpdihieeedjeneoke [2015-02-11]

CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Jon\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-12]

CHR Extension: (Google Wallet) - C:\Users\Jon\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-02-11]

CHR Extension: (Gmail) - C:\Users\Jon\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-02-11]

CHR HKLM-x32\...\Chrome\Extension: [cmlhbjpgeogifjnmlajdaealbdlfonah] - https://clients2.goo...ice/update2/crx

CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-03-15]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AdaptiveSleepService; C:\Program Files\ATI Technologies\ATI.ACE\A4\AdaptiveSleepService.exe [140288 2014-04-17] () [File not signed]

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [344064 2014-04-17] (Advanced Micro Devices, Inc.) [File not signed]

S3 ArcService; C:\Program Files (x86)\Arc\ArcService.exe [88400 2015-02-09] (Perfect World Entertainment Inc)

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [343336 2015-06-24] (Avast Software s.r.o.)

S3 becldr3Service; C:\Program Files\BCL Technologies\easyConverter SDK 3\Common\becldr.exe [263168 2013-07-03] () [File not signed]

S3 BRSptStub; C:\ProgramData\BitRaider\BRSptStub.exe [363208 2015-02-12] (BitRaider, LLC)

S3 BthHFSrv; C:\Windows\System32\BthHFSrv.dll [324608 2014-10-28] (Microsoft Corporation)

R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2739888 2015-05-19] (Microsoft Corporation)

R2 HomeNetSvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [335064 2014-10-31] (McAfee, Inc.)

R2 HP Support Assistant Service; C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [92160 2014-01-13] (Hewlett-Packard Company) [File not signed]

R2 HPWMISVC; C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPWMISVC.exe [1039160 2013-10-08] (Hewlett-Packard Development Company, L.P.)

R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2015-06-18] (Malwarebytes Corporation)

R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1133880 2015-06-18] (Malwarebytes Corporation)

R2 McAPExe; C:\Program Files\McAfee\MSC\McAPExe.exe [562200 2015-01-13] (McAfee, Inc.)

S3 McAWFwk; c:\Program Files\Common Files\mcafee\ActWiz\McAWFwk.exe [334608 2013-07-29] (McAfee, Inc.)

R2 mccspsvc; C:\Program Files\Common Files\McAfee\CSP\1.3.336.0\McCSPServiceHost.exe [422632 2014-11-21] (McAfee, Inc.)

R2 McMPFSvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [335064 2014-10-31] (McAfee, Inc.)

R2 McNaiAnn; C:\Program Files\Common Files\mcafee\platform\McSvcHost\McSvHost.exe [335064 2014-10-31] (McAfee, Inc.)

S3 McODS; C:\Program Files\mcafee\VirusScan\mcods.exe [601864 2015-01-07] (McAfee, Inc.)

S4 McOobeSv2; C:\Program Files\Common Files\mcafee\platform\McSvcHost\McSvHost.exe [335064 2014-10-31] (McAfee, Inc.)

R2 mcpltsvc; C:\Program Files\Common Files\mcafee\platform\McSvcHost\McSvHost.exe [335064 2014-10-31] (McAfee, Inc.)

R2 McProxy; C:\Program Files\Common Files\mcafee\platform\McSvcHost\McSvHost.exe [335064 2014-10-31] (McAfee, Inc.)

R2 mfecore; C:\Program Files\Common Files\McAfee\AMCore\mcshield.exe [1050952 2014-11-06] (McAfee, Inc.)

R2 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [221832 2014-10-01] (McAfee, Inc.)

R2 mfevtp; C:\Windows\system32\mfevtps.exe [189920 2014-10-01] (McAfee, Inc.)

R2 MSK80Service; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [335064 2014-10-31] (McAfee, Inc.)

R2 NinjaLoaderService; C:\Program Files (x86)\Ninja Loader\NinjaMaintainer.exe [59496 2015-06-24] (Ninja Soft Inc.)

R2 omniserv; C:\Program Files\Hewlett-Packard\SimplePass\OmniServ.exe [88064 2014-03-28] (Softex Inc.) [File not signed]

S3 Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [1910128 2015-02-12] (Electronic Arts)

R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [290520 2014-02-12] (Realtek Semiconductor)

S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]

R2 tbaseprovisioning; C:\Windows\SysWOW64\tbaseprovisioning.exe [51712 2014-02-24] (Advanced Micro Devices, Inc.)

S3 w3logsvc; C:\Windows\system32\inetsrv\w3logsvc.dll [76800 2014-07-02] (Microsoft Corporation)

S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366520 2015-02-03] (Microsoft Corporation)

S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2015-02-03] (Microsoft Corporation)

S3 AvastVBoxSvc; "C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe" [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R3 AmdAS4; C:\Windows\System32\drivers\AmdAS4.sys [17640 2013-10-24] (Advanced Micro Devices, INC.)

S3 amdkmcsp; C:\Windows\system32\DRIVERS\amdkmcsp.sys [92360 2015-01-20] (Advanced Micro Devices, Inc. )

R0 amdkmpfd; C:\Windows\System32\drivers\amdkmpfd.sys [36608 2013-12-14] (Advanced Micro Devices, Inc.)

R0 amdpsp; C:\Windows\System32\DRIVERS\amdpsp.sys [264392 2015-01-20] (Advanced Micro Devices, Inc. )

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29168 2015-06-24] ()

R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [89944 2015-06-24] (Avast Software s.r.o.)

R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93528 2015-06-24] (Avast Software s.r.o.)

R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65736 2015-06-24] ()

R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1047320 2015-06-24] (Avast Software s.r.o.)

R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [442264 2015-06-28] (Avast Software s.r.o.)

R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [137288 2015-06-24] (Avast Software s.r.o.)

R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [272248 2015-06-24] ()

R3 athr; C:\Windows\system32\DRIVERS\athwbx.sys [3858944 2013-10-17] (Qualcomm Atheros Communications, Inc.)

R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdWB6.sys [222720 2014-03-11] (Advanced Micro Devices)

S3 BRDriver64_1_3_3_E02B25FC; C:\ProgramData\BitRaider\support\1.3.3\E02B25FC\BRDriver64.sys [78088 2015-02-12] (BitRaider)

R3 cfwids; C:\Windows\System32\drivers\cfwids.sys [72136 2014-10-01] (McAfee, Inc.)

R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [91712 2013-03-05] (CyberLink)

S3 HipShieldK; C:\Windows\System32\drivers\HipShieldK.sys [197704 2013-09-23] (McAfee, Inc.)

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-06-18] (Malwarebytes Corporation)

R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [113880 2015-07-11] (Malwarebytes Corporation)

R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64216 2015-06-18] (Malwarebytes Corporation)

R3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [181584 2014-10-01] (McAfee, Inc.)

R3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [313680 2014-10-01] (McAfee, Inc.)

S0 mfeelamk; C:\Windows\System32\drivers\mfeelamk.sys [70608 2014-10-01] (McAfee, Inc.)

R3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [526360 2014-10-01] (McAfee, Inc.)

R0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [786304 2014-10-01] (McAfee, Inc.)

R3 mfencbdc; C:\Windows\system32\DRIVERS\mfencbdc.sys [447440 2014-09-19] (McAfee, Inc.)

S3 mfencrk; C:\Windows\system32\DRIVERS\mfencrk.sys [96600 2014-09-19] (McAfee, Inc.)

R0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [348560 2014-10-01] (McAfee, Inc.)

R3 RSP2STOR; C:\Windows\system32\DRIVERS\RtsP2Stor.sys [291544 2014-01-03] (Realtek Semiconductor Corp.)

S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2015-02-03] (Microsoft Corporation)

R3 WirelessButtonDriver; C:\Windows\System32\drivers\WirelessButtonDriver64.sys [20800 2013-07-22] (Hewlett-Packard Development Company, L.P.)

R1 wsafd_1_10_0_19; C:\Windows\System32\drivers\wsafd_1_10_0_19.sys [57728 2015-06-15] (Word Surfer)

S3 andnetadb; \SystemRoot\System32\Drivers\lgandnetadb.sys [X]

S1 gfilterdrv; system32\drivers\gfilterdrv.sys [X]

S3 OATool; \??\C:\Windows\TEMP\OAToolx64.sys [X]

S2 VBoxAswDrv; \??\C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-07-11 17:31 - 2015-07-11 17:32 - 00028113 _____ C:\Users\Jon\Desktop\FRST.txt

2015-07-11 17:30 - 2015-07-11 17:31 - 00000000 ____D C:\FRST

2015-07-11 17:28 - 2015-07-11 17:29 - 02130944 _____ (Farbar) C:\Users\Jon\Desktop\FRST64.exe

2015-07-11 10:26 - 2015-07-11 10:26 - 00003200 _____ C:\Windows\System32\Tasks\avastBCLRestart_chrome.exe

2015-07-11 01:05 - 2015-07-11 17:05 - 00000000 ____D C:\Program Files (x86)\Opera

2015-07-11 01:00 - 2015-07-11 17:23 - 00000000 ____D C:\Program Files (x86)\GSafe

2015-07-11 00:56 - 2015-07-11 00:56 - 00004180 _____ C:\Windows\System32\Tasks\WordSurfer Auto Updater 1.10.0.19 Pending Update

2015-07-11 00:56 - 2015-07-11 00:56 - 00004170 _____ C:\Windows\System32\Tasks\WordSurfer Auto Updater 1.10.0.19 Core

2015-07-11 00:41 - 2015-07-11 10:01 - 00034354 _____ C:\ProgramData\I2qi58ro.dat

2015-07-11 00:38 - 2015-07-11 16:46 - 00113880 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2015-07-11 00:37 - 2015-07-11 00:37 - 00001125 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2015-07-11 00:37 - 2015-07-11 00:37 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2015-07-11 00:37 - 2015-07-11 00:37 - 00000000 ____D C:\ProgramData\Malwarebytes

2015-07-11 00:37 - 2015-07-11 00:37 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware

2015-07-11 00:37 - 2015-06-18 08:42 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2015-07-11 00:37 - 2015-06-18 08:41 - 00109272 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2015-07-11 00:37 - 2015-06-18 08:41 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2015-07-11 00:36 - 2015-07-11 00:36 - 24345872 _____ (Malwarebytes Corporation ) C:\Users\Jon\Downloads\mbam-setup-2.1.8.1057.exe

2015-07-11 00:35 - 2015-07-11 09:29 - 00000000 ____D C:\Program Files (x86)\ORBTR

2015-07-10 23:52 - 2015-07-11 10:07 - 00000000 ____D C:\ProgramData\abc

2015-07-10 23:51 - 2015-07-10 23:51 - 00000000 _____ C:\Windows\SysWOW64\Number of results

2015-07-10 23:50 - 2015-07-10 23:50 - 00001875 _____ C:\Users\Jon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\avast! antivirus.lnk

2015-07-10 22:43 - 2015-07-10 22:43 - 00000000 ____D C:\ProgramData\50661bab000019bd

2015-07-10 22:37 - 2015-07-11 09:30 - 00000005 _____ C:\END

2015-07-10 22:11 - 2015-07-10 22:11 - 00000000 ____D C:\Program Files (x86)\predm

2015-07-10 22:09 - 2015-07-10 22:09 - 00003740 _____ C:\Windows\System32\Tasks\Convertor

2015-07-10 22:09 - 2015-07-10 22:09 - 00001085 _____ C:\Users\Jon\Desktop\DocToPDFConverter.lnk

2015-07-10 22:09 - 2015-07-10 22:09 - 00000000 ____D C:\Users\Jon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\DocToPDFConverter

2015-07-10 22:09 - 2015-07-10 22:09 - 00000000 ____D C:\Users\Jon\AppData\Roaming\DocToPDFConverter

2015-07-10 22:09 - 2015-07-10 22:09 - 00000000 ____D C:\Program Files (x86)\Winsta

2015-07-10 22:09 - 2015-07-10 22:09 - 00000000 ____D C:\Program Files (x86)\Convertor

2015-07-10 22:01 - 2015-07-10 22:02 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PepperZip

2015-07-10 21:59 - 2015-07-10 23:55 - 00002110 _____ C:\Users\Jon\Desktop\Continue GamesDesktop Uninstaller.lnk

2015-07-10 21:54 - 2015-07-11 16:46 - 00000352 ____H C:\Windows\Tasks\KCTPPXQUAIUXXORP.job

2015-07-10 21:54 - 2015-07-11 16:46 - 00000340 _____ C:\Windows\Tasks\WXAOQPACW1.job

2015-07-10 21:54 - 2015-07-11 12:04 - 00000000 ____D C:\ProgramData\Service7609

2015-07-10 21:54 - 2015-07-10 21:54 - 00003356 _____ C:\Windows\System32\Tasks\KCTPPXQUAIUXXORP

2015-07-10 21:54 - 2015-07-10 21:54 - 00002854 _____ C:\Windows\System32\Tasks\WXAOQPACW1

2015-07-10 21:51 - 2015-07-10 21:53 - 00000000 ____D C:\Users\Jon\AppData\Local\Ninja Loader

2015-07-10 21:51 - 2015-07-10 21:51 - 00000000 ____D C:\Users\Jon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Ninja Loader

2015-07-10 21:51 - 2015-07-10 21:51 - 00000000 ____D C:\ProgramData\7c0535b143fc4671b6ebd202fbffe066

2015-07-10 21:50 - 2015-07-10 21:54 - 00000000 ____D C:\Program Files (x86)\Ninja Loader

2015-07-10 21:50 - 2013-08-22 06:25 - 00000824 _____ C:\Windows\system32\Drivers\etc\hp.bak

2015-07-10 20:35 - 2015-07-11 12:06 - 00000112 _____ C:\ProgramData\nI0cCK6dn.dat

2015-07-10 20:15 - 2015-07-10 20:16 - 00000000 ____D C:\Users\Jon\AppData\Roaming\Ebon

2015-07-10 20:15 - 2015-07-10 20:16 - 00000000 ____D C:\Users\Jon\AppData\Local\Ebon

2015-07-10 19:37 - 2015-07-11 16:44 - 00000696 _____ C:\Windows\setupact.log

2015-07-10 19:37 - 2015-07-10 19:37 - 00000000 _____ C:\Windows\setuperr.log

2015-07-10 19:36 - 2015-07-11 16:44 - 00091754 _____ C:\Windows\PFRO.log

2015-07-10 18:20 - 2015-07-10 19:43 - 00003458 _____ C:\Windows\System32\Tasks\Croureis

2015-07-10 18:16 - 2015-07-10 18:16 - 00000000 ____D C:\ProgramData\Ebon

2015-07-10 18:15 - 2015-07-10 21:48 - 00000000 ____D C:\Program Files (x86)\Ebon

2015-07-10 18:14 - 2015-07-11 00:16 - 00000000 ____D C:\Program Files\WebBar

2015-07-10 18:14 - 2015-07-10 23:13 - 00000000 ____D C:\ProgramData\LpIFDKNYQ

2015-07-10 18:14 - 2015-07-10 18:16 - 00000000 ____D C:\ProgramData\Ebonmedia

2015-07-10 18:13 - 2015-07-11 12:10 - 00000000 ____D C:\Program Files\015

2015-07-10 18:13 - 2015-07-11 12:04 - 00000000 ____D C:\Program Files\13

2015-07-10 18:11 - 2015-07-10 18:12 - 00910255 _____ C:\Users\Jon\Downloads\File_Downloader.jse

2015-07-09 19:04 - 2015-07-09 19:04 - 00032821 _____ C:\Users\Jon\Downloads\[kat.cr]falling.skies.s05e02.hdtv.x264.asap.ettv.torrent

2015-07-09 19:04 - 2015-07-09 19:04 - 00032821 _____ C:\Users\Jon\Downloads\[kat.cr]falling.skies.s05e02.hdtv.x264.asap.ettv (1).torrent

2015-07-09 19:03 - 2015-07-09 19:03 - 00028280 _____ C:\Users\Jon\Downloads\[kat.cr]falling.skies.s05e01.hdtv.x264.killers.ettv.torrent

2015-07-09 18:17 - 2015-07-09 18:17 - 00019684 _____ C:\Users\Jon\Downloads\Falling+Skies+Season+4+Complete.torrent

2015-07-09 18:15 - 2015-07-09 18:15 - 00022407 _____ C:\Users\Jon\Downloads\Falling+Skies%3A+Season+1%2C+2%2C+3+x264+THADOGG.torrent

2015-07-09 18:14 - 2015-07-09 18:14 - 00018621 _____ C:\Users\Jon\Downloads\[kat.cr]the.last.ship.season.1.complete.torrent

2015-07-09 00:20 - 2015-07-11 17:21 - 00853240 _____ C:\Windows\WindowsUpdate.log

2015-07-08 22:53 - 2015-07-08 22:53 - 00120196 _____ C:\Users\Jon\Downloads\[kat.cr]patrick.swayze.movie.pack.torrent.torrent

2015-07-08 22:51 - 2015-07-08 22:51 - 00102394 _____ C:\Users\Jon\Downloads\[kat.cr]one.last.dance.patrick.swayze.2003.by.anarky69.torrent

2015-07-08 22:50 - 2015-07-08 22:50 - 00024624 _____ C:\Users\Jon\Downloads\Next.of.Kin.1989.BDrip.720p.Avi-OmiTube+%5BPatrick+Swayze%5D.torrent

2015-07-08 22:47 - 2015-07-08 22:47 - 00000952 _____ C:\Users\Jon\Downloads\[kat.cr]jim.harrison.legends.of.the.fall.pdf.torrent

2015-07-08 22:43 - 2015-07-08 22:43 - 00015266 _____ C:\Users\Jon\Downloads\[kat.cr]legends.of.the.fall.1994.dvdrip.xvid.ar.torrent

2015-07-08 22:27 - 2015-07-08 22:27 - 00013989 _____ C:\Users\Jon\Downloads\[kat.cr]one.last.dance.dvd.rip.torrent

2015-07-08 22:24 - 2015-07-08 22:24 - 00023155 _____ C:\Users\Jon\Downloads\[kat.cr]one.last.dance.2003.720p.bluray.x264.ifpd.torrent

2015-07-08 19:43 - 2015-07-08 19:43 - 00008924 _____ C:\Users\Jon\Downloads\Road+House+%281989%29+720p+BrRip+x264+-+YIFY.torrent

2015-07-08 19:07 - 2015-07-08 19:07 - 00008924 _____ C:\Users\Jon\Downloads\[kat.cr]road.house.1989.720p.brrip.x264.yify.torrent

2015-07-07 16:48 - 2015-07-07 16:54 - 00000000 ____D C:\Users\Jon\AppData\Local\Mozilla

2015-07-07 16:48 - 2015-07-07 16:48 - 00001182 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk

2015-07-07 16:48 - 2015-07-07 16:48 - 00001170 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk

2015-07-07 16:48 - 2015-07-07 16:48 - 00000000 ____D C:\Users\Jon\AppData\Roaming\Mozilla

2015-07-07 16:48 - 2015-07-07 16:48 - 00000000 ____D C:\ProgramData\Mozilla

2015-07-07 16:48 - 2015-07-07 16:48 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service

2015-07-07 16:48 - 2015-07-07 16:48 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox

2015-07-07 16:39 - 2015-07-07 16:40 - 00242712 _____ C:\Users\Jon\Downloads\Firefox Setup Stub 39.0.exe

2015-07-06 23:09 - 2015-07-10 00:35 - 00047143 _____ C:\Users\Jon\Desktop\Fireworks 2015 Sign In-Sign Out.xlsx

2015-07-06 19:07 - 2015-07-06 19:07 - 00020688 _____ C:\Users\Jon\Downloads\Blackhat+%282015%29+1080p+BrRip+x264+-+YIFY.torrent

2015-07-06 18:57 - 2015-07-06 18:57 - 00114271 _____ C:\Users\Jon\Downloads\Mortdecai.2015.HDRip.XViD.AC3-ETRG.torrent

2015-07-06 18:54 - 2015-07-06 18:54 - 00017576 _____ C:\Users\Jon\Downloads\Last+Knights+%282015%29+1080p+BrRip+x264+-+YIFY.torrent

2015-07-06 12:33 - 2015-07-06 12:34 - 00000000 ____D C:\Users\Jon\Desktop\Net making

2015-07-05 21:48 - 2015-07-05 21:48 - 00046542 _____ C:\Users\Jon\Downloads\C3F22287588EFFB6DE8C6FCDFC642D22A9E92A78.torrent

2015-07-05 20:51 - 2015-07-05 20:51 - 00024448 _____ C:\Users\Jon\Downloads\[kat.cr]spartacus.war.of.the.damned.season.3.720p.bluray.x264.shaanig.torrent

2015-07-05 20:50 - 2015-07-05 20:50 - 00017957 _____ C:\Users\Jon\Downloads\[kat.cr]spartacus.season.2.gods.of.the.arena.torrent

2015-07-05 20:10 - 2015-07-05 20:11 - 70533120 _____ C:\Users\Jon\Downloads\calibre-64bit-2.31.0.msi

2015-07-05 20:03 - 2015-07-05 20:04 - 00051732 _____ C:\Users\Jon\Downloads\[kat.cr]learn.in.your.car.german.complete.95.lessons.torrent

2015-07-05 20:00 - 2015-07-05 20:00 - 00019779 _____ C:\Users\Jon\Downloads\[kat.cr]world.of.gypsies.vol1.2.3.torrent

2015-07-05 19:44 - 2015-07-05 19:44 - 00015974 _____ C:\Users\Jon\Downloads\[kat.cr]covert.affairs.season.2.torrent

2015-07-05 19:42 - 2015-07-05 19:42 - 00015335 _____ C:\Users\Jon\Downloads\[kat.cr]game.of.thrones.season.5.complete.1080p.khatake2.torrent

2015-07-05 19:36 - 2015-07-05 19:36 - 00016132 _____ C:\Users\Jon\Downloads\[kat.cr]olympus.s01e13.hdtv.x264.asap.ettv.torrent

2015-07-05 19:35 - 2015-07-05 19:35 - 00020422 _____ C:\Users\Jon\Downloads\[kat.cr]olympus.s01e12.hdtv.x264.killers.ettv.torrent

2015-07-05 19:34 - 2015-07-05 19:34 - 00019282 _____ C:\Users\Jon\Downloads\[kat.cr]olympus.s01e10.hdtv.x264.killers.ettv.torrent

2015-07-05 19:34 - 2015-07-05 19:34 - 00017694 _____ C:\Users\Jon\Downloads\[kat.cr]olympus.s01e11.hdtv.x264.killers.ettv.torrent

2015-07-05 19:33 - 2015-07-05 19:33 - 00017953 _____ C:\Users\Jon\Downloads\[kat.cr]olympus.s01e09.hdtv.x264.killers.ettv.torrent

2015-07-05 19:32 - 2015-07-05 19:32 - 00021063 _____ C:\Users\Jon\Downloads\[kat.cr]olympus.s01e08.hdtv.x264.killers.ettv.torrent

2015-07-05 19:26 - 2015-07-05 19:26 - 00012791 _____ C:\Users\Jon\Downloads\[kat.cr]the.originals.season.2.complete.480p.torrent

2015-07-05 19:22 - 2015-07-05 19:22 - 00056207 _____ C:\Users\Jon\Downloads\[kat.cr]pretty.little.liars.season.5.complete.torrent

2015-07-05 19:21 - 2015-07-05 19:21 - 00017127 _____ C:\Users\Jon\Downloads\[kat.cr]pretty.little.liars.complete.season.4.torrent

2015-07-05 19:19 - 2015-07-05 19:19 - 00048170 _____ C:\Users\Jon\Downloads\[kat.cr]star.trek.voyager.season.7.torrent

2015-07-05 19:17 - 2015-07-05 19:17 - 00048472 _____ C:\Users\Jon\Downloads\[kat.cr]star.trek.voyager.season.6.torrent

2015-07-05 17:11 - 2015-07-05 17:11 - 00001840 _____ C:\Users\Jon\Downloads\2EBD0FCFC5147B00DEC14A298DBC606345434EE8.torrent

2015-07-05 17:06 - 2015-07-05 17:06 - 00001840 _____ C:\Users\Jon\Downloads\[kat.cr]guardian.trilogy.torrent

2015-07-05 16:59 - 2015-07-05 16:59 - 00002255 _____ C:\Users\Jon\Downloads\[kat.cr]residue.series.by.laury.falter.books.1.4.epub.torrent

2015-07-05 16:55 - 2015-07-05 16:55 - 00001628 _____ C:\Users\Jon\Downloads\[kat.cr]world.after.susan.ee.epub (1).torrent

2015-07-05 16:53 - 2015-07-05 16:53 - 00001630 _____ C:\Users\Jon\Downloads\[kat.cr]world.after.susan.ee.epub.torrent

2015-07-05 16:52 - 2015-07-05 16:52 - 00001701 _____ C:\Users\Jon\Downloads\[kat.cr]angelfall.by.susan.ee.epub.mobi.torrent

2015-07-05 16:39 - 2015-07-05 16:39 - 00002643 _____ C:\Users\Jon\Downloads\[kat.cr]they.who.fell.they.who.fell.1.kevin.kneupper.epub.mobi.azw3.nm.torrent

2015-06-27 19:25 - 2015-06-27 19:25 - 00057554 _____ C:\Users\Jon\Downloads\Mad.Max.Fury.Road.2015.HDRip.XViD-ETRG.torrent

2015-06-26 23:52 - 2015-06-26 23:52 - 00020107 _____ C:\Users\Jon\Downloads\[kat.cr]step.by.step.macrame.pdf.torrent

2015-06-26 23:50 - 2015-06-26 23:50 - 00020461 _____ C:\Users\Jon\Downloads\[kat.cr]macrame.books.torrent

2015-06-26 21:21 - 2015-06-26 21:21 - 00008995 _____ C:\Users\Jon\Downloads\[kat.cr]run.all.night.2015.720p.brrip.x264.yify.torrent

2015-06-24 16:29 - 2015-06-24 16:30 - 00000000 ____D C:\Users\Jon\Documents\Fax

2015-06-24 16:28 - 2015-06-24 16:28 - 16966176 _____ C:\Users\Jon\Downloads\Coopers birthday.7z

2015-06-24 16:23 - 2015-03-03 06:17 - 00295552 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe

2015-06-24 13:37 - 2015-06-24 13:37 - 00364472 _____ (Avast Software s.r.o.) C:\Windows\system32\aswBoot.exe

2015-06-24 13:36 - 2015-06-24 13:36 - 00043112 _____ (Avast Software s.r.o.) C:\Windows\avastSS.scr

2015-06-24 01:25 - 2015-06-24 01:25 - 00016382 _____ C:\Users\Jon\Downloads\Remember+Me+%282010%29+720p+BrRip+x264-+750+MB+-+YIFY.torrent

2015-06-21 10:14 - 2015-06-21 10:14 - 00266519 _____ C:\Users\Jon\Desktop\Pandora Internet Radio - Listen to Free Music You'll Love.html

2015-06-21 10:14 - 2015-06-21 10:14 - 00000000 ____D C:\Users\Jon\Desktop\Pandora Internet Radio - Listen to Free Music You'll Love_files

2015-06-19 18:34 - 2015-06-19 18:34 - 00077056 _____ C:\Users\Jon\Downloads\parks.zip

2015-06-18 00:32 - 2015-06-18 00:32 - 00158602 _____ C:\Users\Jon\Downloads\[RI-RAw]+Fullmetal+Alchemist+Brotherhood+1-64+[END]+(x264[1920x1080+24]+aac[LC192]).torrent

2015-06-17 21:31 - 2015-06-17 21:31 - 00038493 _____ C:\Users\Jon\Downloads\Twilight+Saga+Audio+Books+FIXED.torrent

2015-06-17 21:22 - 2015-06-17 21:22 - 00101273 _____ C:\Users\Jon\Downloads\Stephenie+Meyer+%283782405%29 (1).torrent

2015-06-16 00:30 - 2015-06-16 00:30 - 00026121 _____ C:\Users\Jon\Downloads\Full+Metal+Alchemist+Brotherhood+English+Dub%281-64%29.torrent

2015-06-16 00:25 - 2015-06-16 00:25 - 00020840 _____ C:\Users\Jon\Downloads\Black+Butler+1-24+Complete+720p+%5BDual-Audio%5D+%5BEnglish+Subbed%5D+Neroextreme_NTRG.torrent

2015-06-15 15:28 - 2015-06-15 15:28 - 00057728 _____ (Word Surfer) C:\Windows\system32\Drivers\wsafd_1_10_0_19.sys

2015-06-15 00:49 - 2015-06-15 00:49 - 00097891 _____ C:\Users\Jon\Downloads\Fullmetal+Alchemist+Brotherhood+Full+Hd+Tri-Audio+English+Dubbed%2C+Português+Dublado%2CSpanish.torrent

2015-06-15 00:49 - 2015-06-15 00:49 - 00097891 _____ C:\Users\Jon\Downloads\Fullmetal+Alchemist+Brotherhood+Full+Hd+Tri-Audio+English+Dubbed%2C+Português+Dublado%2CSpanish (1).torrent

2015-06-15 00:46 - 2015-06-15 00:47 - 00185030 _____ C:\Users\Jon\Downloads\Fullmetal+Alchemist+Brotherhood+%5B720p.BRrip.x264.Dual-Audio%5D%5BxRed%5D.torrent

2015-06-13 20:18 - 2015-06-13 20:22 - 70250496 _____ C:\Users\Jon\Downloads\calibre-64bit-2.30.0.msi

2015-06-13 19:34 - 2015-06-13 19:34 - 00042597 _____ C:\Users\Jon\Downloads\Harry+Potter+Audio+Books+%283721572%29.torrent

2015-06-13 19:32 - 2015-06-13 19:32 - 00101273 _____ C:\Users\Jon\Downloads\Stephenie+Meyer+%283782405%29.torrent

2015-06-13 19:28 - 2015-06-13 19:28 - 00011602 _____ C:\Users\Jon\Downloads\[kat.cr]hendee.barb.noble.dead.1.11.mobi.torrent

2015-06-13 19:24 - 2015-06-13 19:24 - 00011878 _____ C:\Users\Jon\Downloads\Patricia+Briggs+-+Mercy+Thompson+Book+8+Night+Broken.torrent

2015-06-13 19:24 - 2015-06-13 19:24 - 00011739 _____ C:\Users\Jon\Downloads\Patricia+Briggs+-+Mercy+Thompson+Book+7+Frost+Burned+Unabridged.torrent

2015-06-13 19:22 - 2015-06-13 19:22 - 00030502 _____ C:\Users\Jon\Downloads\Patricia+Briggs+Audiobook+Collection+-+Mercy+Thompson+and+more.torrent

2015-06-13 19:16 - 2015-06-13 19:16 - 00107042 _____ C:\Users\Jon\Downloads\Kim+Harrison+-+Hollows+1-13+plus+2+other+series+and+Into+the+Woo.torrent

2015-06-13 19:14 - 2015-06-13 19:14 - 00014714 _____ C:\Users\Jon\Downloads\Cassandra+Clare+Audiobooks.torrent

2015-06-13 18:59 - 2015-06-13 18:59 - 00020613 _____ C:\Users\Jon\Downloads\[kat.cr]kingsman.the.secret.service.2014.1080p.brrip.x264.yify.torrent

2015-06-13 18:58 - 2015-06-13 18:58 - 00012883 _____ C:\Users\Jon\Downloads\[kat.cr]kingsman.the.secret.service.2015.720p.hdts.dual.audio.english.hindi.pc.exclsuive.torrent

2015-06-13 18:57 - 2015-06-13 18:57 - 00012883 _____ C:\Users\Jon\Downloads\Kingsman+The+Secret+Service+2015+720p+HDTS%5BDual+Audio%5D%5B+English-+Hindi+%5D-%5BPC%5DExclsuive.torrent

2015-06-11 11:04 - 2015-07-06 14:24 - 00792568 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2015-06-11 11:04 - 2015-07-06 14:24 - 00178168 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-07-11 17:32 - 2015-02-12 00:28 - 00000000 ____D C:\Users\Jon\AppData\Roaming\uTorrent

2015-07-11 17:27 - 2015-02-11 17:17 - 00003598 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3105412986-3712989239-1590487086-1002

2015-07-11 17:03 - 2015-02-15 11:49 - 00004958 _____ C:\Windows\System32\Tasks\Microsoft Office 15 Sync Maintenance for KRAKEN-Jon Kraken

2015-07-11 17:02 - 2013-08-22 08:36 - 00000000 ____D C:\Windows\system32\sru

2015-07-11 16:57 - 2015-02-11 17:13 - 00000000 ____D C:\Users\Jon\Documents\Youcam

2015-07-11 16:49 - 2015-02-11 17:56 - 00000000 ____D C:\Program Files (x86)\Steam

2015-07-11 16:47 - 2015-02-11 17:16 - 00000000 ___DO C:\Users\Jon\OneDrive

2015-07-11 16:46 - 2015-02-11 17:27 - 00000916 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2015-07-11 16:45 - 2015-02-11 17:10 - 00000000 ____D C:\Users\Jon

2015-07-11 16:44 - 2013-08-22 07:45 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2015-07-11 16:37 - 2014-12-18 15:41 - 00065536 _____ C:\Windows\system32\spu_storage.bin

2015-07-11 15:57 - 2013-08-22 08:36 - 00000000 ____D C:\Windows\AppReadiness

2015-07-11 15:37 - 2015-02-11 17:27 - 00000920 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2015-07-11 12:12 - 2014-12-18 15:49 - 02089422 _____ C:\Windows\SysWOW64\rootpa.e2e

2015-07-11 12:10 - 2013-08-22 06:25 - 00524288 ___SH C:\Windows\system32\config\BBI

2015-07-11 12:05 - 2015-02-12 00:28 - 00000000 ____D C:\ProgramData\APN

2015-07-11 11:13 - 2015-03-15 09:08 - 00004182 _____ C:\Windows\System32\Tasks\avast! Emergency Update

2015-07-10 19:42 - 2014-12-18 15:39 - 00000000 ____D C:\ProgramData\Package Cache

2015-07-10 19:37 - 2013-08-22 06:25 - 00262144 ___SH C:\Windows\system32\config\ELAM

2015-07-10 13:16 - 2015-02-11 17:26 - 00003910 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{BFB52E6D-0F59-4821-B8C8-BA8D2A88DD12}

2015-07-09 19:20 - 2015-04-04 18:43 - 00000000 ____D C:\utorrent

2015-07-08 23:34 - 2015-04-13 20:30 - 00000000 ____D C:\Users\Jon\Desktop\Carla

2015-07-08 22:58 - 2015-05-20 00:09 - 00000000 ____D C:\Windows\Minidump

2015-07-08 12:37 - 2013-08-22 08:20 - 00000000 ____D C:\Windows\CbsTemp

2015-07-08 00:46 - 2015-04-22 15:48 - 00000000 ____D C:\Users\Jon\Documents\Outlook Files

2015-07-07 23:10 - 2014-03-18 02:53 - 00956476 _____ C:\Windows\system32\PerfStringBackup.INI

2015-07-07 16:38 - 2015-02-11 17:27 - 00002210 _____ C:\Users\Public\Desktop\Google Chrome.lnk

2015-07-07 16:36 - 2013-08-22 08:36 - 00000000 ____D C:\Windows\system32\NDF

2015-07-06 13:22 - 2015-03-10 14:33 - 00000000 ____D C:\Users\Jon\AppData\Local\Spotify

2015-07-06 13:22 - 2015-03-10 14:32 - 00000000 ____D C:\Users\Jon\AppData\Roaming\Spotify

2015-06-28 16:40 - 2015-03-15 09:08 - 00442264 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswsp.sys

2015-06-27 09:15 - 2015-04-27 20:28 - 00023691 _____ C:\Users\Jon\Desktop\Las Vegas Recreators Inc. Business Accounts.xlsx

2015-06-24 13:37 - 2015-03-15 09:08 - 00272248 _____ C:\Windows\system32\Drivers\aswVmm.sys

2015-06-24 13:37 - 2015-03-15 09:08 - 00137288 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswStm.sys

2015-06-24 13:37 - 2015-03-15 09:08 - 00093528 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswRdr2.sys

2015-06-24 13:37 - 2015-03-15 09:08 - 00089944 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswMonFlt.sys

2015-06-24 13:37 - 2015-03-15 09:08 - 00065736 _____ C:\Windows\system32\Drivers\aswRvrt.sys

2015-06-24 13:37 - 2015-03-15 09:08 - 00029168 _____ C:\Windows\system32\Drivers\aswHwid.sys

2015-06-24 13:34 - 2015-03-15 09:08 - 01047320 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswSnx.sys

2015-06-24 11:51 - 2015-02-15 11:40 - 00000000 ____D C:\Program Files\Microsoft Office 15

2015-06-22 13:29 - 2014-12-18 11:27 - 00000000 ____D C:\Users\Jon\Desktop\Chris

2015-06-17 11:57 - 2015-02-24 19:36 - 00000000 __SHD C:\Users\Jon\AppData\Local\EmieBrowserModeList

2015-06-17 11:57 - 2015-02-11 17:26 - 00000000 __SHD C:\Users\Jon\AppData\Local\EmieUserList

2015-06-17 11:57 - 2015-02-11 17:26 - 00000000 __SHD C:\Users\Jon\AppData\Local\EmieSiteList

2015-06-16 22:39 - 2015-02-11 17:11 - 00000000 ____D C:\Users\Jon\AppData\Local\Packages

2015-06-11 11:52 - 2013-08-22 08:36 - 00000000 ____D C:\Windows\rescache

2015-06-11 11:03 - 2013-08-22 07:44 - 05105056 _____ C:\Windows\system32\FNTCACHE.DAT

2015-06-11 10:58 - 2015-02-14 03:25 - 00000000 ___SD C:\Windows\system32\CompatTel

2015-06-11 10:58 - 2015-02-14 03:25 - 00000000 ____D C:\Windows\system32\appraiser

2015-06-11 10:58 - 2013-08-22 08:36 - 00000000 ___RD C:\Windows\ToastData

2015-06-11 10:58 - 2013-08-22 08:36 - 00000000 ____D C:\Windows\PolicyDefinitions

==================== Files in the root of some directories =======

2015-03-01 23:37 - 2015-03-01 23:37 - 0000132 _____ () C:\Users\Jon\AppData\Roaming\Adobe PNG Format CS6 Prefs

2015-07-11 00:41 - 2015-07-11 10:01 - 0034354 _____ () C:\ProgramData\I2qi58ro.dat

2015-07-10 20:35 - 2015-07-11 12:06 - 0000112 _____ () C:\ProgramData\nI0cCK6dn.dat

Files to move or delete:

====================

C:\ProgramData\I2qi58ro.dat

C:\ProgramData\nI0cCK6dn.dat

Some files in TEMP:

====================

C:\Users\Jon\AppData\Local\Temp\restartinstance0.exe

C:\Users\Jon\AppData\Local\Temp\Uninstall.exe

C:\Users\Jon\AppData\Local\Temp\UninstallModule.exe

C:\Users\Jon\AppData\Local\Temp\uninstalloffer0.exe

C:\Users\Jon\AppData\Local\Temp\uninstalloffer1.exe

C:\Users\Jon\AppData\Local\Temp\uninstalloffer3.exe

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2015-07-07 15:30

==================== End of log ============================

#2
Essexboy

Posted 12 July 2015 - 05:26 AM

GeekU Moderator

Retired Staff
69,964 posts

Could you post the additions.txt as well please

CAUTION : This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:

CreateRestorePoint:
HKLM-x32\...\Run: [mcpltui_exe] => C:\Program Files\Common Files\mcafee\platform\McUICnt.exe [643064 2014-09-17] (McAfee, Inc.)
HKU\S-1-5-21-3105412986-3712989239-1590487086-1002\...\Run: [GoogleChromeAutoLaunch_1476D5075BFDEEA31B57A901BC660F86] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [813896 2015-07-06] (Google Inc.)
AppInit_DLLs: C:\ProgramData\LolliScan\LolliScan64.dll => C:\ProgramData\LolliScan\LolliScan64.dll File not found
Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files\mcafee\msc\McSnIePl64.dll [2015-01-13] (McAfee, Inc.)
Filter-x32: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files (x86)\McAfee\msc\McSnIePl.dll [2015-01-13] (McAfee, Inc.)
FF SelectedSearchEngine: Trovi
FF Homepage: hxxp://www.trovi.com/?gd=&ctid=CT3334822&octid=EB_ORIGINAL_CTID&ISID=M57B03A8F-928F-4362-AE67-176B61E66F90&SearchSource=55&CUI=&UM=8&UP=SP914EEEB9-B805-4B01-A2CD-F3DE8FA6FFF5&D=071115&SSPV=SP30339TB_sp_ff
FF Plugin: @mcafee.com/MSC,version=10 -> c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL [2015-01-13] ()
FF Plugin-x32: @mcafee.com/MSC,version=10 -> c:\PROGRA~2\mcafee\msc\NPMCSN~1.DLL [2015-01-13] ()
FF HKLM-x32\...\Firefox\Extensions: [[email protected]] - C:\Program Files (x86)\Babylon\Babylon-Pro\Utils\[email protected]
R2 HomeNetSvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [335064 2014-10-31] (McAfee, Inc.)
R2 McAPExe; C:\Program Files\McAfee\MSC\McAPExe.exe [562200 2015-01-13] (McAfee, Inc.)
S3 McAWFwk; c:\Program Files\Common Files\mcafee\ActWiz\McAWFwk.exe [334608 2013-07-29] (McAfee, Inc.)
R2 mccspsvc; C:\Program Files\Common Files\McAfee\CSP\1.3.336.0\McCSPServiceHost.exe [422632 2014-11-21] (McAfee, Inc.)
R2 McMPFSvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [335064 2014-10-31] (McAfee, Inc.)
R2 McNaiAnn; C:\Program Files\Common Files\mcafee\platform\McSvcHost\McSvHost.exe [335064 2014-10-31] (McAfee, Inc.)
S3 McODS; C:\Program Files\mcafee\VirusScan\mcods.exe [601864 2015-01-07] (McAfee, Inc.)
S4 McOobeSv2; C:\Program Files\Common Files\mcafee\platform\McSvcHost\McSvHost.exe [335064 2014-10-31] (McAfee, Inc.)
R2 mcpltsvc; C:\Program Files\Common Files\mcafee\platform\McSvcHost\McSvHost.exe [335064 2014-10-31] (McAfee, Inc.)
R2 McProxy; C:\Program Files\Common Files\mcafee\platform\McSvcHost\McSvHost.exe [335064 2014-10-31] (McAfee, Inc.)
R2 mfecore; C:\Program Files\Common Files\McAfee\AMCore\mcshield.exe [1050952 2014-11-06] (McAfee, Inc.)
R2 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [221832 2014-10-01] (McAfee, Inc.)
R2 mfevtp; C:\Windows\system32\mfevtps.exe [189920 2014-10-01] (McAfee, Inc.)
R2 MSK80Service; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [335064 2014-10-31] (McAfee, Inc.)
R2 NinjaLoaderService; C:\Program Files (x86)\Ninja Loader\NinjaMaintainer.exe [59496 2015-06-24] (Ninja Soft Inc.)
R3 cfwids; C:\Windows\System32\drivers\cfwids.sys [72136 2014-10-01] (McAfee, Inc.)
S3 HipShieldK; C:\Windows\System32\drivers\HipShieldK.sys [197704 2013-09-23] (McAfee, Inc.)
R3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [181584 2014-10-01] (McAfee, Inc.)
R3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [313680 2014-10-01] (McAfee, Inc.)
S0 mfeelamk; C:\Windows\System32\drivers\mfeelamk.sys [70608 2014-10-01] (McAfee, Inc.)
R3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [526360 2014-10-01] (McAfee, Inc.)
R0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [786304 2014-10-01] (McAfee, Inc.)
R3 mfencbdc; C:\Windows\system32\DRIVERS\mfencbdc.sys [447440 2014-09-19] (McAfee, Inc.)
S3 mfencrk; C:\Windows\system32\DRIVERS\mfencrk.sys [96600 2014-09-19] (McAfee, Inc.)
R0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [348560 2014-10-01] (McAfee, Inc.)
R1 wsafd_1_10_0_19; C:\Windows\System32\drivers\wsafd_1_10_0_19.sys [57728 2015-06-15] (Word Surfer)
2015-07-11 00:56 - 2015-07-11 00:56 - 00004180 _____ C:\Windows\System32\Tasks\WordSurfer Auto Updater 1.10.0.19 Pending Update
2015-07-11 00:56 - 2015-07-11 00:56 - 00004170 _____ C:\Windows\System32\Tasks\WordSurfer Auto Updater 1.10.0.19 Core
2015-07-11 00:41 - 2015-07-11 10:01 - 00034354 _____ C:\ProgramData\I2qi58ro.dat
2015-07-10 22:43 - 2015-07-10 22:43 - 00000000 ____D C:\ProgramData\50661bab000019bd
2015-07-10 22:37 - 2015-07-11 09:30 - 00000005 _____ C:\END
2015-07-10 22:11 - 2015-07-10 22:11 - 00000000 ____D C:\Program Files (x86)\predm
2015-07-10 22:09 - 2015-07-10 22:09 - 00003740 _____ C:\Windows\System32\Tasks\Convertor
2015-07-10 22:09 - 2015-07-10 22:09 - 00000000 ____D C:\Program Files (x86)\Winsta
2015-07-10 22:09 - 2015-07-10 22:09 - 00000000 ____D C:\Program Files (x86)\Convertor
2015-07-10 22:01 - 2015-07-10 22:02 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PepperZip
2015-07-10 21:59 - 2015-07-10 23:55 - 00002110 _____ C:\Users\Jon\Desktop\Continue GamesDesktop Uninstaller.lnk
2015-07-10 21:54 - 2015-07-11 16:46 - 00000352 ____H C:\Windows\Tasks\KCTPPXQUAIUXXORP.job
2015-07-10 21:54 - 2015-07-11 16:46 - 00000340 _____ C:\Windows\Tasks\WXAOQPACW1.job
2015-07-10 21:54 - 2015-07-11 12:04 - 00000000 ____D C:\ProgramData\Service7609
2015-07-10 21:54 - 2015-07-10 21:54 - 00003356 _____ C:\Windows\System32\Tasks\KCTPPXQUAIUXXORP
2015-07-10 21:54 - 2015-07-10 21:54 - 00002854 _____ C:\Windows\System32\Tasks\WXAOQPACW1
2015-07-10 21:51 - 2015-07-10 21:53 - 00000000 ____D C:\Users\Jon\AppData\Local\Ninja Loader
2015-07-10 21:51 - 2015-07-10 21:51 - 00000000 ____D C:\Users\Jon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Ninja Loader
2015-07-10 21:51 - 2015-07-10 21:51 - 00000000 ____D C:\ProgramData\7c0535b143fc4671b6ebd202fbffe066
2015-07-10 21:50 - 2015-07-10 21:54 - 00000000 ____D C:\Program Files (x86)\Ninja Loader
2015-07-10 20:35 - 2015-07-11 12:06 - 00000112 _____ C:\ProgramData\nI0cCK6dn.dat
2015-07-10 20:15 - 2015-07-10 20:16 - 00000000 ____D C:\Users\Jon\AppData\Roaming\Ebon
2015-07-10 20:15 - 2015-07-10 20:16 - 00000000 ____D C:\Users\Jon\AppData\Local\Ebon
2015-07-10 18:20 - 2015-07-10 19:43 - 00003458 _____ C:\Windows\System32\Tasks\Croureis
2015-07-10 18:16 - 2015-07-10 18:16 - 00000000 ____D C:\ProgramData\Ebon
2015-07-10 18:15 - 2015-07-10 21:48 - 00000000 ____D C:\Program Files (x86)\Ebon
2015-07-10 18:14 - 2015-07-11 00:16 - 00000000 ____D C:\Program Files\WebBar
2015-07-10 18:14 - 2015-07-10 23:13 - 00000000 ____D C:\ProgramData\LpIFDKNYQ
2015-07-10 18:14 - 2015-07-10 18:16 - 00000000 ____D C:\ProgramData\Ebonmedia
2015-07-10 18:13 - 2015-07-11 12:10 - 00000000 ____D C:\Program Files\015
2015-07-10 18:13 - 2015-07-11 12:04 - 00000000 ____D C:\Program Files\13
2015-07-10 18:11 - 2015-07-10 18:12 - 00910255 _____ C:\Users\Jon\Downloads\File_Downloader.jse
C:\Users\Jon\AppData\Local\Ninja Loader
C:\Program Files (x86)\Ninja Loader
C:\ProgramData\LolliScan
C:\Program Files (x86)\Babylon
CMD: netsh advfirewall reset
CMD: netsh advfirewall set allprofiles state ON
CMD: ipconfig /flushdns
CMD: netsh winsock reset catalog
CMD: netsh int ip reset c:\resetlog.txt
CMD: ipconfig /release
CMD: ipconfig /renew
CMD: netsh int ipv4 reset
CMD: netsh int ipv6 reset
RemoveProxy:
EmptyTemp:
CMD: bitsadmin /reset /allusers

Save this as fixlist.txt, in the same location as FRST.exe

Run FRST and press Fix
On completion a log will be generated please post that

#3
skandranon1971

Posted 12 July 2015 - 10:57 AM

Member

Topic Starter
Member
64 posts

Sorry, I forgot the additions.txt. Here it is:

Additional scan result of Farbar Recovery Scan Tool (x64) Version:11-07-2015

Ran by Jon at 2015-07-11 17:34:39

Running from C:\Users\Jon\Desktop

Boot Mode: Normal

==========================================================

==================== Accounts: =============================

Administrator (S-1-5-21-3105412986-3712989239-1590487086-500 - Administrator - Disabled)

Guest (S-1-5-21-3105412986-3712989239-1590487086-501 - Limited - Disabled)

HomeGroupUser$ (S-1-5-21-3105412986-3712989239-1590487086-1004 - Limited - Enabled)

Jon (S-1-5-21-3105412986-3712989239-1590487086-1002 - Administrator - Enabled) => C:\Users\Jon

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}

AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

FW: McAfee Firewall (Disabled) {E2A40FF5-9AB1-3894-DE05-F89EB212F22D}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

µTorrent (HKU\S-1-5-21-3105412986-3712989239-1590487086-1002\...\uTorrent) (Version: 3.4.3.40298 - BitTorrent Inc.)

4 Elements II (x32 Version: 2.2.0.98 - WildTangent) Hidden

7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)

Adobe Acrobat 5.0 (HKLM-x32\...\Adobe Acrobat 5.0) (Version: 5.0 - Adobe Systems, Inc.)

Adobe Illustrator CS6 (HKLM-x32\...\{4869414E-7AEA-4C8E-BE1C-8D40977FD517}) (Version: 16.0 - Adobe Systems Incorporated)

Adobe Photoshop CS6 (HKLM-x32\...\{74EB3499-8B95-4B5C-96EB-7B342F3FD0C6}) (Version: 13.0 - Adobe Systems Incorporated)

Adobe Shockwave Player 12.0 (HKLM-x32\...\Adobe Shockwave Player) (Version: 12.0.4.144 - Adobe Systems, Inc.)

Airport Mania (x32 Version: 2.2.0.95 - WildTangent) Hidden

AMD Catalyst Install Manager (HKLM\...\{7536C341-2F7D-EFE6-F521-DEBE68B025C5}) (Version: 8.0.916.0 - Advanced Micro Devices, Inc.)

Arc (HKLM-x32\...\{CED8E25B-122A-4E80-B612-7F99B93284B3}) (Version: 1.0.0.9668 - Perfect World Entertainment)

Avast Free Antivirus (HKLM-x32\...\Avast) (Version: 10.2.2218 - AVAST Software)

Azkend 2: The World Beneath (x32 Version: 2.2.0.98 - WildTangent) Hidden

BCL easyConverter SDK 3 (Word Version) 64 (HKLM\...\{350CC85B-CA59-4F85-909D-8E4CDBF532FA}) (Version: 3.0.64 - BCL Technologies)

Bejeweled 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden

BitRaider Streaming Client (HKLM-x32\...\BitRaider Streaming Client) (Version: 1.3.3.4098 - BitRaider, LLC)

Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)

Bonjour Print Services (HKLM\...\{0DA20600-6130-443B-9D4B-F30520315FA6}) (Version: 2.0.2.0 - Apple Inc.)

Borderlands 2 (HKLM-x32\...\Steam App 49520) (Version: - Gearbox Software)

Bounce Symphony (x32 Version: 2.2.0.97 - WildTangent) Hidden

Build-a-lot (x32 Version: 2.2.0.98 - WildTangent) Hidden

calibre 64bit (HKLM\...\{2342B0FF-6738-4AD5-9BD2-563C55ED9D63}) (Version: 2.28.0 - Kovid Goyal)

Call of Duty: Modern Warfare 2 - Multiplayer (HKLM-x32\...\Steam App 10190) (Version: - Infinity Ward)

Call of Duty: Modern Warfare 2 (HKLM-x32\...\Steam App 10180) (Version: - Infinity Ward)

Canon MX410 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MX410_series) (Version: - )

CCleaner (HKLM\...\CCleaner) (Version: 5.05 - Piriform)

Cradle Of Egypt Collector's Edition (x32 Version: 2.2.0.110 - WildTangent) Hidden

Cradle of Rome 2 (x32 Version: 2.2.0.98 - WildTangent) Hidden

Curse at Twilight (x32 Version: 3.0.2.32 - WildTangent) Hidden

CyberLink LabelPrint (HKLM-x32\...\InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.5.5.6902 - CyberLink Corp.)

CyberLink Media Suite 10 (HKLM-x32\...\InstallShield_{1FBF6C24-C1fD-4101-A42B-0C564F9E8E79}) (Version: 10.0.5.3303 - CyberLink Corp.)

CyberLink Power2Go 8 (HKLM-x32\...\InstallShield_{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}) (Version: 8.0.5.3416 - CyberLink Corp.)

CyberLink PowerDVD 12 (HKLM-x32\...\InstallShield_{B46BEA36-0B71-4A4E-AE41-87241643FA0A}) (Version: 12.0.3.3709 - CyberLink Corp.)

CyberLink YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 5.0.3.3907 - CyberLink Corp.)

D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden

Delicious: Emily's Childhood Memories Premium Edition (x32 Version: 3.0.2.32 - WildTangent) Hidden

DisableMSDefender (Version: 1.0.0 - Hewlett-Packard Company) Hidden

DocToPDFConverter (HKU\S-1-5-21-3105412986-3712989239-1590487086-1002\...\DocToPDFConverter) (Version: 01.00.00.00 - VolatoTech)

Dropbox (HKU\S-1-5-21-3105412986-3712989239-1590487086-1002\...\Dropbox) (Version: 3.2.9 - Dropbox, Inc.)

Energy Star (HKLM\...\{465CA2B6-98AF-4E77-BE22-A908C34BB9EC}) (Version: 1.0.9 - Hewlett-Packard Company)

Family Tree Maker 2014 (HKLM-x32\...\Family Tree Maker 2014) (Version: 22.0.207 - Ancestry.com, Inc.)

Family Tree Maker 2014 (Version: 22.0.207 - Ancestry.com, Inc.) Hidden

Farm Frenzy (x32 Version: 2.2.0.98 - WildTangent) Hidden

Fishdom 3: Collector's Edition (x32 Version: 3.0.2.38 - WildTangent) Hidden

Glyph (HKLM-x32\...\Glyph) (Version: - Trion Worlds, Inc.)

Google Chrome (HKLM-x32\...\Google Chrome) (Version: 43.0.2357.132 - Google Inc.)

Google Update Helper (x32 Version: 1.3.27.5 - Google Inc.) Hidden

Governor of Poker 2 Premium Edition (x32 Version: 2.2.0.110 - WildTangent) Hidden

Hewlett-Packard ACLM.NET v1.2.2.3 (x32 Version: 1.00.0000 - Hewlett-Packard Company) Hidden

House of 1000 Doors: Family Secrets (x32 Version: 2.2.0.98 - WildTangent) Hidden

HP Documentation (HKLM-x32\...\{F29E3AA8-CF19-4452-92B7-F1FE31CD11C5}) (Version: 1.1.0.0 - Hewlett-Packard)

HP Registration Service (HKLM\...\{D1E8F2D7-7794-4245-B286-87ED86C1893C}) (Version: 1.2.7372.4698 - Hewlett-Packard)

HP SimplePass (HKLM-x32\...\InstallShield_{314FAD12-F785-4471-BCE8-AB506642B9A1}) (Version: 8.01.11 - Hewlett-Packard)

HP Support Assistant (HKLM-x32\...\{8C696B4B-6AB1-44BC-9416-96EAC474CABE}) (Version: 7.5.2.12 - Hewlett-Packard Company)

HP System Event Utility (HKLM-x32\...\{C78E8F51-3EAD-4F0C-83F0-EF371075E0B4}) (Version: 1.0.10 - Hewlett-Packard Company)

HP Utility Center (HKLM\...\{891A1782-8B20-4403-8383-458962525926}) (Version: 2.3.4 - Hewlett-Packard Company)

HP Wireless Button Driver (HKLM-x32\...\{30B2D1D8-0A07-4B71-9553-0710C5D31E35}) (Version: 1.1.2.1 - Hewlett-Packard Company)

Inst5675 (Version: 8.01.11 - Softex Inc.) Hidden

Inst5676 (Version: 8.01.11 - Softex Inc.) Hidden

iSEEK AnswerWorks English Runtime (HKLM-x32\...\{18A8E78B-9EF2-496E-B310-BCD8E4C1DAB3}) (Version: 010.000.0101 - Vantage Linguistics)

Java 8 Update 45 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218045F0}) (Version: 8.0.450 - Oracle Corporation)

Jewel Match 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden

John Deere Drive Green (x32 Version: 2.2.0.95 - WildTangent) Hidden

King Oddball (x32 Version: 3.0.2.48 - WildTangent) Hidden

LG United Mobile Driver (HKLM-x32\...\{2A3A4BD6-6CE0-4E2A-80D2-1D0FF6ACBFBA}) (Version: 3.8.1 - LG Electronics)

Luxor Evolved (x32 Version: 2.2.0.98 - WildTangent) Hidden

Mahjongg Dimensions Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden

Malwarebytes Anti-Malware version 2.1.8.1057 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.8.1057 - Malwarebytes Corporation)

MasterCook Deluxe 9 (HKLM-x32\...\InstallShield_{99B366B0-76B6-4DBA-95A3-A730015A7D01}) (Version: 9.0.000 - ValuSoft)

MasterCook Deluxe 9 (x32 Version: 9.0.000 - ValuSoft) Hidden

McAfee LiveSafe - Internet Security (HKLM-x32\...\MSC) (Version: 13.6.1529 - McAfee, Inc.)

Microsoft Office 365 - en-us (HKLM\...\O365HomePremRetail - en-us) (Version: 15.0.4727.1003 - Microsoft Corporation)

Microsoft OneDrive (HKU\S-1-5-21-3105412986-3712989239-1590487086-1002\...\OneDriveSetup.exe) (Version: 17.3.5860.0512 - Microsoft Corporation)

Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\...\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)

Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)

Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)

Minecraft (HKLM-x32\...\{1C16BCA3-EBC1-49F6-8623-8FBFB9CCC872}) (Version: 1.0.3.0 - Mojang)

Movie Maker (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden

Mozilla Firefox 39.0 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 39.0 (x86 en-US)) (Version: 39.0 - Mozilla)

Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 39.0 - Mozilla)

Mystery P.I. - Curious Case of Counterfeit Cove (x32 Version: 2.2.0.98 - WildTangent) Hidden

Ninja Loader (HKLM-x32\...\Ninja Loader) (Version: 184.0.0.625 - CLICK YES BELOW LP)

OEM Application Profile (HKLM-x32\...\{315F1A48-D883-B234-7C79-15873574ACC1}) (Version: 1.00.0000 - Advanced Micro Devices, Inc.)

Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4727.1003 - Microsoft Corporation) Hidden

Office 15 Click-to-Run Licensing Component (Version: 15.0.4727.1003 - Microsoft Corporation) Hidden

Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4727.1003 - Microsoft Corporation) Hidden

Origin (HKLM-x32\...\Origin) (Version: 9.5.5.2850 - Electronic Arts, Inc.)

PDF Settings CS6 (x32 Version: 11.0 - Adobe Systems Incorporated) Hidden

Peggle Nights (x32 Version: 2.2.0.98 - WildTangent) Hidden

Penguins! (x32 Version: 2.2.0.98 - WildTangent) Hidden

Pinger (HKLM-x32\...\Pinger 1.4.0.1) (Version: 1.4.0.1 - Pinger Inc.)

Pinger (x32 Version: 1.4.0.1 - Pinger Inc.) Hidden

Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.98 - WildTangent) Hidden

Polar Bowler (x32 Version: 2.2.0.97 - WildTangent) Hidden

Qualcomm Atheros Driver Installation Program (HKLM-x32\...\{C3A32068-8AB1-4327-BB16-BED9C6219DC7}) (Version: 10.0 - Qualcomm Atheros)

Quicken 2015 (HKLM-x32\...\{00C2D443-43D9-4550-ABEA-318288E23E57}) (Version: 24.1.1.11 - Intuit)

QuickTime (HKLM-x32\...\QuickTime) (Version: - )

Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.3.9600.29075 - Realtek Semiconductor Corp.)

Realtek Ethernet Controller All-In-One Windows Driver (HKLM-x32\...\{F7E7F0CB-AA41-4D5A-B6F2-8E6738EB063F}) (Version: 8.24.1218.2013 - Realtek)

Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7164 - Realtek Semiconductor Corp.)

RIFT (HKLM-x32\...\Glyph RIFT) (Version: - Trion Worlds, Inc.)

Roads of Rome 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden

Setup (HKLM-x32\...\{7ADF667E-E14D-4D2C-827C-B0108F0D93BC}) (Version: - )

Spotify (HKU\S-1-5-21-3105412986-3712989239-1590487086-1002\...\Spotify) (Version: 1.0.7.157.g2a6526f9 - Spotify AB)

Star Wars The Old Republic (HKLM-x32\...\swtor_swtor) (Version: 8.0.0.10 - Bioware/EA)

Star Wars: The Old Republic (HKLM-x32\...\{3B11D799-48E0-48ED-BFD7-EA655676D8BB}) (Version: 1.00 - Electronic Arts, Inc.)

Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)

swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden

Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 18.0.4.0 - Synaptics Incorporated)

Tales of Lagoona (x32 Version: 2.2.0.110 - WildTangent) Hidden

Update Installer for WildTangent Games App (x32 Version: - WildTangent) Hidden

Vacation Quest™ - Australia (x32 Version: 3.0.2.32 - WildTangent) Hidden

WD My Cloud (HKLM\...\{3082756C-2147-411F-AE6A-9DCEF0121903}) (Version: 1.0.7.5 - Western Digital Technologies, Inc.)

WildTangent Games (HKLM-x32\...\WildTangent wildgames Master Uninstall) (Version: 1.0.4.0 - WildTangent)

WildTangent Games App (HP Games) (x32 Version: 4.0.10.15 - WildTangent) Hidden

Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3508.0205 - Microsoft Corporation)

Youda Jewel Shop (x32 Version: 3.0.2.32 - WildTangent) Hidden

Zuma's Revenge (x32 Version: 2.2.0.98 - WildTangent) Hidden

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-3105412986-3712989239-1590487086-1002_Classes\CLSID\{503E492B-C90C-4E23-842B-EB05CDA61DC9}\InprocServer32 -> No File path

CustomCLSID: HKU\S-1-5-21-3105412986-3712989239-1590487086-1002_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\Jon\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-3105412986-3712989239-1590487086-1002_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\Jon\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\amd64\FileSyncApi64.dll (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-3105412986-3712989239-1590487086-1002_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jon\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-3105412986-3712989239-1590487086-1002_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jon\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-3105412986-3712989239-1590487086-1002_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jon\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-3105412986-3712989239-1590487086-1002_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jon\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-3105412986-3712989239-1590487086-1002_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jon\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-3105412986-3712989239-1590487086-1002_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jon\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-3105412986-3712989239-1590487086-1002_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jon\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-3105412986-3712989239-1590487086-1002_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jon\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)

==================== Restore Points =========================

24-06-2015 13:32:04 avast! antivirus system restore point

01-07-2015 15:41:46 Scheduled Checkpoint

05-07-2015 20:13:18 Installed calibre 64bit

10-07-2015 19:41:08 Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005

==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 06:25 - 2013-08-22 06:25 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {09D305BE-4792-4731-9F1D-9A0D3F041DBA} - System32\Tasks\avastBCLRestart_chrome.exe => Chrome.exe

Task: {0B72ACDE-80AD-477A-9689-3A28E2A94CB7} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2015-04-08] (Piriform Ltd)

Task: {133FEFC8-7758-454F-9176-A86C20EFAE97} - System32\Tasks\KCTPPXQUAIUXXORP => C:\ProgramData\Service7609\Service7609.exe <==== ATTENTION

Task: {190B656F-621B-4239-A96F-3810630BD54B} - System32\Tasks\Microsoft Office 15 Sync Maintenance for KRAKEN-Jon Kraken => C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [2015-05-28] (Microsoft Corporation)

Task: {1B6801B9-CCF6-4D3C-9F37-48A8CADF081B} - \WinKit No Task File <==== ATTENTION

Task: {31C39732-B22F-4216-AE19-B71E650B9652} - System32\Tasks\YCMServiceAgent => C:\Program Files (x86)\CyberLink\YouCam\YouCamService.exe [2014-03-07] (CyberLink Corp.)

Task: {332E27EE-211A-43F1-91BF-9E48F64FA5FB} - System32\Tasks\Microsoft OneDrive Auto Update Task-S-1-5-21-3105412986-3712989239-1590487086-1002 => %localappdata%\Microsoft\OneDrive\OneDrive.exe

Task: {3508F23B-C080-4EBF-A992-CDAFDCD0A7E0} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2015-06-24] (Avast Software s.r.o.)

Task: {38648350-507E-42EC-8EE5-4692BDC00C9F} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2014-01-13] (Hewlett-Packard Company)

Task: {468C81C0-46A2-4022-A892-82BA74233F92} - System32\Tasks\CLVDLauncher => C:\Program Files (x86)\CyberLink\Power2Go8\CLVDLauncher.exe [2013-03-12] (CyberLink Corp.)

Task: {528EA2A7-E0F5-4537-8C77-F2C8FF53AA43} - \Winsta Update No Task File <==== ATTENTION

Task: {72BB5732-212B-4358-B374-23931E33B8F0} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2014-01-13] (Hewlett-Packard Company)

Task: {7AE42B6A-B3EE-438A-AA6A-5A17940D679E} - System32\Tasks\Croureis => C:\ProgramData\Croureis\1.0.4.1\ouhirlat.exe

Task: {7EC31002-6B00-4183-92EB-06F5F2C9D12E} - System32\Tasks\WordSurfer Auto Updater 1.10.0.19 Pending Update => C:\Program Files (x86)\WordSurfer_1.10.0.19\Update\WordSurferAutoUpdateClient.exe

Task: {A76D1F38-721F-49A2-9114-BF12E3A37DB0} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-05-19] (Microsoft Corporation)

Task: {AA0E86C3-C702-4AD9-8E7A-888B705EF9E5} - System32\Tasks\WordSurfer Auto Updater 1.10.0.19 Core => C:\Program Files (x86)\WordSurfer_1.10.0.19\Update\WordSurferAutoUpdateClient.exe

Task: {AC5EE239-4457-44B0-81FF-99ED6968A83B} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater7\HPSFUpdater.exe [2014-05-12] (Hewlett-Packard Company)

Task: {BF1CE8F9-8400-4F66-A4ED-22F7C416254E} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2015-06-16] (Hewlett-Packard)

Task: {BF7E41C7-7838-4122-935B-4D6639C3BCF3} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonx86\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe [2015-05-28] (Microsoft Corporation)

Task: {C058B08F-699F-470F-B2C6-F9665951813B} - System32\Tasks\CLMLSvc_P2G8 => C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [2013-08-05] (CyberLink)

Task: {C74EC957-0E77-4E0B-9E87-B5751DEC1602} - System32\Tasks\Convertor => C:\Program Files (x86)\Convertor\Convertor.exe [2014-11-25] ()

Task: {CB5DC25C-BDDA-4A6C-9F10-597D0ACCD274} - System32\Tasks\WXAOQPACW1 => C:\ProgramData\LolliScan\LolliScan.exe <==== ATTENTION

Task: {D049B90C-A52B-47E1-BBFB-7DA15B8FB569} - System32\Tasks\Synaptics TouchPad Enhancements => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2013-12-12] (Synaptics Incorporated)

Task: {D68CEF0E-E7A9-4517-8CD2-0BA8F67C906A} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-05-19] (Microsoft Corporation)

Task: {D9BA5766-5D5C-48B8-84C2-C42D05AE8C35} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_DeviceScan => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2015-06-16] (Hewlett-Packard)

Task: {DAE6D20F-4BDF-4F90-B28B-73279A45EDC3} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-02-11] (Google Inc.)

Task: {F3B52039-48EF-491C-AAC2-6D0FAAEC3644} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-02-11] (Google Inc.)

Task: {F722D35D-16F5-4850-ADD0-21D2FE31AEE0} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows\system32\MRT.exe [2015-06-10] (Microsoft Corporation)

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\KCTPPXQUAIUXXORP.job => C:\ProgramData\Service7609\Service7609.exe <==== ATTENTION

Task: C:\Windows\Tasks\WXAOQPACW1.job => C:\ProgramData\LolliScan\LolliScan.exe <==== ATTENTION

==================== Loaded Modules (Whitelisted) ==============

2014-03-28 13:31 - 2014-03-28 13:31 - 02110464 _____ () C:\Program Files\Hewlett-Packard\SimplePass\autheng.dll

2014-03-28 13:27 - 2014-03-28 13:27 - 00021504 _____ () C:\Program Files\Hewlett-Packard\SimplePass\cryptodll.dll

2014-03-28 13:27 - 2014-03-28 13:27 - 00035328 _____ () C:\Program Files\Hewlett-Packard\SimplePass\ssplogon.dll

2014-03-28 13:27 - 2014-03-28 13:27 - 00055296 _____ () C:\Program Files\Hewlett-Packard\SimplePass\RandomPass.dll

2014-03-28 13:48 - 2014-03-28 13:48 - 00367504 _____ () C:\Program Files\Hewlett-Packard\SimplePass\mstrpwd.dll

2014-03-28 13:48 - 2014-03-28 13:48 - 00712080 _____ () C:\Program Files\Hewlett-Packard\SimplePass\GraphicalPwd.dll

2014-04-17 16:38 - 2014-04-17 16:38 - 00140288 _____ () C:\Program Files\ATI Technologies\ATI.ACE\A4\AdaptiveSleepService.exe

2014-04-17 16:37 - 2014-04-17 16:37 - 00127488 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Container.Wlan.dll

2015-02-15 11:40 - 2014-05-20 09:19 - 00105640 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll

2015-03-13 14:32 - 2015-01-27 08:29 - 08898720 _____ () C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\1033\GrooveIntlResource.dll

2014-03-28 13:36 - 2014-03-28 13:36 - 00065024 _____ () C:\Program Files\Hewlett-Packard\SimplePass\opvapp.exe

2015-07-02 21:37 - 2015-07-02 21:37 - 00183296 _____ () C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20911_x64__8wekyb3d8bbwe\ErrorReporting.dll

2015-03-02 15:01 - 2015-03-02 15:01 - 00127488 _____ () C:\Users\Jon\AppData\Local\Packages\facebook.facebook_8xx8rvfyw5nnt\AC\Microsoft\CLR_v4.0\NativeImages\Facebook.Ba70e54e13#\8823bdb58000ba3c428e18bc54c37f8d\Facebook.BackgroundTasks.ni.dll

2015-03-02 15:00 - 2015-03-02 15:00 - 01782272 _____ () C:\Windows\assembly\NativeImages_v4.0.30319_64\Windows.App640a3541#\f1407bb1d381cf5dee299c4e5f0fdf9d\Windows.ApplicationModel.ni.dll

2015-03-02 15:01 - 2015-03-02 15:01 - 01134592 _____ () C:\Users\Jon\AppData\Local\Packages\facebook.facebook_8xx8rvfyw5nnt\AC\Microsoft\CLR_v4.0\NativeImages\Facebook-Win8-Base\a57e2bbb2149b11b1840208efc036f21\Facebook-Win8-Base.ni.dll

2015-03-02 15:01 - 2015-03-02 15:01 - 00619520 _____ () C:\Users\Jon\AppData\Local\Packages\facebook.facebook_8xx8rvfyw5nnt\AC\Microsoft\CLR_v4.0\NativeImages\Facebook-Base\b9acb2231bcf37635da949da7727727b\Facebook-Base.ni.dll

2015-06-24 13:36 - 2015-06-24 13:36 - 00104400 _____ () C:\Program Files\AVAST Software\Avast\log.dll

2015-06-24 13:35 - 2015-06-24 13:35 - 00081728 _____ () C:\Program Files\AVAST Software\Avast\JsonRpcServer.dll

2015-07-11 09:31 - 2015-07-11 09:31 - 02956288 _____ () C:\Program Files\AVAST Software\Avast\defs\15071101\algo.dll

2015-06-24 22:47 - 2015-06-24 22:47 - 00109160 _____ () C:\Program Files (x86)\Ninja Loader\Modules\Core.dll

2015-06-24 22:47 - 2015-06-24 22:47 - 00058984 _____ () C:\Program Files (x86)\Ninja Loader\Modules\BdUdr.dll

2015-06-24 22:48 - 2015-06-24 22:48 - 00041576 _____ () C:\Program Files (x86)\Ninja Loader\Modules\WInIn.dll

2015-06-24 22:47 - 2015-06-24 22:47 - 00039528 _____ () C:\Program Files (x86)\Ninja Loader\Modules\ArSp.dll

2015-06-24 22:47 - 2015-06-24 22:47 - 00118376 _____ () C:\Program Files (x86)\Ninja Loader\Modules\BrSp.dll

2015-06-24 22:47 - 2015-06-24 22:47 - 00092776 _____ () C:\Program Files (x86)\Ninja Loader\Modules\CdPrc.dll

2015-06-24 22:48 - 2015-06-24 22:48 - 00096872 _____ () C:\Program Files (x86)\Ninja Loader\Modules\WbSt.dll

2015-06-24 22:48 - 2015-06-24 22:48 - 00056424 _____ () C:\Program Files (x86)\Ninja Loader\Modules\WdCtl.dll

2014-12-18 15:59 - 2013-08-05 00:49 - 00627672 _____ () C:\Program Files (x86)\CyberLink\Power2Go8\CLMediaLibrary.dll

2013-08-05 16:48 - 2013-08-05 16:48 - 00016856 _____ () C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvcPS.dll

2015-02-15 11:40 - 2015-02-24 11:57 - 00316576 _____ () C:\Program Files\Microsoft Office 15\root\office15\AppVIsvStream32.dll

2015-07-07 16:38 - 2015-07-06 20:49 - 01281864 _____ () C:\Program Files (x86)\Google\Chrome\Application\43.0.2357.132\libglesv2.dll

2015-07-07 16:38 - 2015-07-06 20:49 - 00080712 _____ () C:\Program Files (x86)\Google\Chrome\Application\43.0.2357.132\libegl.dll

2015-03-15 09:08 - 2015-03-15 09:08 - 40540672 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll

2015-07-10 21:53 - 2015-03-26 07:13 - 01091584 _____ () C:\Users\Jon\AppData\Local\Ninja Loader\Discover\libglesv2.dll

2015-07-10 21:53 - 2015-03-26 07:13 - 00167936 _____ () C:\Users\Jon\AppData\Local\Ninja Loader\Discover\libEGL.dll

2015-07-10 21:53 - 2015-03-26 07:39 - 08569856 _____ () C:\Users\Jon\AppData\Local\Ninja Loader\Discover\pdf.dll

2015-07-10 21:53 - 2015-03-26 07:18 - 00324608 _____ () C:\Users\Jon\AppData\Local\Ninja Loader\Discover\ppGoogleNaClPluginChrome.dll

2015-07-10 21:53 - 2015-03-26 07:14 - 00880128 _____ () C:\Users\Jon\AppData\Local\Ninja Loader\Discover\ffmpegsumo.dll

2015-07-10 21:53 - 2014-09-22 21:07 - 14891848 _____ () C:\Users\Jon\AppData\Local\Ninja Loader\Discover\PepperFlash\pepflashplayer.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

AlternateDataStreams: C:\Users\Jon\OneDrive:ms-properties

==================== Safe Mode (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => ""=""

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\McMPFSvc => ""="Service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MCODS => ""=""

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefire => ""="Driver"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefirek => ""="Driver"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefirek.sys => ""="Driver"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfehidk => ""="Driver"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfehidk.sys => ""="Driver"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfevtp => ""="Driver"

==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)

==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-3105412986-3712989239-1590487086-1002\Control Panel\Desktop\\Wallpaper -> C:\Users\Jon\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper

DNS Servers: 68.105.28.12 - 68.105.29.12

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139

FirewallRules: [{F26E318E-F8E6-4304-8528-D9472D025A41}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe

FirewallRules: [{A03BDEAE-2D1C-4F97-9654-E8089BFB5FE0}] => (Allow) LPort=2869

FirewallRules: [{F349FAC7-A5F1-4A58-AD60-D778018A4144}] => (Allow) LPort=1900

FirewallRules: [{EEB67E36-F536-4275-B56B-31138E6A5707}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe

FirewallRules: [{59AE4ACA-E402-4FF3-BF30-7F813E854B40}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe

FirewallRules: [{C4C26D77-A3FE-4554-8E4F-90D66D019FA6}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe

FirewallRules: [{9D1D8E13-C220-42BB-BB15-8621D7F723E5}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe

FirewallRules: [{5CE354C7-3610-4F9D-8DF9-74CDFCF2D43B}] => (Allow) C:\Program Files\Common Files\mcafee\platform\McSvcHost\McSvHost.exe

FirewallRules: [{F39118C7-EF43-41B6-83F5-270CB0976404}] => (Allow) C:\Program Files\Common Files\mcafee\platform\McSvcHost\McSvHost.exe

FirewallRules: [{FEB3BB0C-B70E-4FA9-8C95-10625F668E31}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12.exe

FirewallRules: [{0B5D028D-8A78-4050-A1A8-C4E18266819C}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe

FirewallRules: [{2EF0770A-74B8-4752-90C6-B98CB5FD3D89}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12ML.exe

FirewallRules: [{0ECE08FA-6B5F-468F-8557-AA2F1FA6E03C}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD12\Movie\PowerDVD.exe

FirewallRules: [{E9DDEF72-15C8-4650-93B7-FD1118F66EA9}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe

FirewallRules: [{EB401012-3AC7-4124-8E14-1783FC6D9578}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe

FirewallRules: [{AD408DC7-F835-45CA-9C0E-E7B091FD4D41}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe

FirewallRules: [{F2B43702-24AF-4FCB-8C03-8EAFFE6522E3}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe

FirewallRules: [{6F1E2DD7-944C-4BBC-ADBA-2F51C2BEF7FE}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Borderlands 2\Binaries\Win32\Launcher.exe

FirewallRules: [{24F63439-10C4-4D60-81E6-6E5353D5596C}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Borderlands 2\Binaries\Win32\Launcher.exe

FirewallRules: [{AAB9CBAF-15BF-42E3-80D5-E4FFF06FA5F3}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Call of Duty Modern Warfare 2\iw4mp.exe

FirewallRules: [{7CBF2F9D-029F-41FB-95F9-2E177696909F}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Call of Duty Modern Warfare 2\iw4mp.exe

FirewallRules: [{84AA0463-A13B-440F-B981-5DD920B4916B}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Call of Duty Modern Warfare 2\iw4sp.exe

FirewallRules: [{5892AC9A-7DD9-4649-9F55-F02FD3A96828}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Call of Duty Modern Warfare 2\iw4sp.exe

FirewallRules: [{C60A5E51-F207-4A15-A0A6-94F3D0ED9B2E}] => (Allow) C:\Users\Jon\AppData\Roaming\uTorrent\uTorrent.exe

FirewallRules: [{A87467DB-177B-45EB-8913-F46FA987361E}] => (Allow) C:\Users\Jon\AppData\Roaming\uTorrent\uTorrent.exe

FirewallRules: [{33F9155B-FC75-4674-8BAB-8B488E28B5E2}] => (Allow) C:\Program Files (x86)\Electronic Arts\BioWare\Star Wars - The Old Republic\launcher.exe

FirewallRules: [{EE83B064-951F-417F-A4DB-0B3D230E9EA2}] => (Allow) C:\Program Files (x86)\Electronic Arts\BioWare\Star Wars - The Old Republic\launcher.exe

FirewallRules: [{1976A906-FBE2-42DD-B9D3-9FD16A2D86F2}] => (Allow) C:\Program Files (x86)\Electronic Arts\BioWare\Star Wars - The Old Republic\launcher.exe

FirewallRules: [{05993709-C928-47DB-8ACB-33569B1FE972}] => (Allow) C:\Program Files (x86)\Electronic Arts\BioWare\Star Wars - The Old Republic\launcher.exe

FirewallRules: [{D029409C-B468-4D08-8029-2F941FD3E029}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\outlook.exe

FirewallRules: [{80E2D27B-36A2-4761-8D39-73DD4DB045B9}] => (Allow) C:\Program Files\AVAST Software\Avast\ng\vbox\aswFe.exe

FirewallRules: [{1AE87FBC-81CC-4D6D-871E-33FDBCE214C9}] => (Allow) C:\Program Files\AVAST Software\Avast\ng\vbox\aswFe.exe

FirewallRules: [{87DEBC21-3ECC-4380-9049-165B75D8BD6D}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

FirewallRules: [{004B13B9-9DBE-4A06-A765-03E0E3524C0A}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

FirewallRules: [{8B0A8D49-318D-436C-941C-7E86936CA291}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

FirewallRules: [{217150C1-C4DD-4096-B1B6-1393E65BC179}] => (Allow) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPDeviceDetection3.exe

==================== Faulty Device Manager Devices =============

==================== Event log errors: =========================

Application errors:

==================

Error: (07/11/2015 05:34:55 PM) (Source: Application Hang) (EventID: 1002) (User: )

Description: The program backgroundTaskHost.exe version 6.3.9600.17415 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

Process ID: 28cc

Start Time: 01d0bc39d8bdbfd0

Termination Time: 4294967295

Application Path: C:\Windows\system32\backgroundTaskHost.exe

Report Id: cdb7a1d4-282d-11e5-82a0-1458d0c06312

Faulting package full name: Facebook.Facebook_1.4.0.9_x64__8xx8rvfyw5nnt

Faulting package-relative application ID: App

Error: (07/11/2015 04:51:37 PM) (Source: Application Hang) (EventID: 1002) (User: )

Process ID: 764

Start Time: 01d0bc33c7404488

Termination Time: 4294967295

Application Path: C:\Windows\system32\backgroundTaskHost.exe

Report Id: bdee34b3-2827-11e5-82a0-1458d0c06312

Faulting package full name: Facebook.Facebook_1.4.0.9_x64__8xx8rvfyw5nnt

Faulting package-relative application ID: App

Error: (07/11/2015 04:51:37 PM) (Source: Application Hang) (EventID: 1002) (User: )

Description: The program LiveComm.exe version 17.5.9600.20911 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

Process ID: 1454

Start Time: 01d0bc33c749cdfc

Termination Time: 4294967295

Application Path: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20911_x64__8wekyb3d8bbwe\LiveComm.exe

Report Id: bdea640c-2827-11e5-82a0-1458d0c06312

Faulting package full name: microsoft.windowscommunicationsapps_17.5.9600.20911_x64__8wekyb3d8bbwe

Faulting package-relative application ID: ppleae38af2e007f4358a809ac99a64a67c1

Error: (07/11/2015 03:37:21 PM) (Source: Application Hang) (EventID: 1002) (User: )

Process ID: 81c

Start Time: 01d0bc296baa7910

Termination Time: 4294967295

Application Path: C:\Windows\system32\backgroundTaskHost.exe

Report Id: 5ff69cb9-281d-11e5-829f-1458d0c06312

Faulting package full name: Facebook.Facebook_1.4.0.9_x64__8xx8rvfyw5nnt

Faulting package-relative application ID: App

Error: (07/11/2015 03:37:20 PM) (Source: Application Hang) (EventID: 1002) (User: )

Process ID: 1858

Start Time: 01d0bc296babb19b

Termination Time: 4294967295

Application Path: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20911_x64__8wekyb3d8bbwe\LiveComm.exe

Report Id: 5fcec8da-281d-11e5-829f-1458d0c06312

Faulting package full name: microsoft.windowscommunicationsapps_17.5.9600.20911_x64__8wekyb3d8bbwe

Faulting package-relative application ID: ppleae38af2e007f4358a809ac99a64a67c1

Error: (07/11/2015 12:05:42 PM) (Source: Application Hang) (EventID: 1002) (User: )

Description: The program wwahost.exe version 6.3.9600.17415 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

Process ID: b7fc

Start Time: 01d0bc0b7d2666ea

Termination Time: 4294967295

Application Path: C:\Windows\syswow64\wwahost.exe

Report Id: cae8e255-27ff-11e5-829e-1458d0c06312

Faulting package full name: Microsoft.SkypeApp_3.1.0.1016_x86__kzf8qxf38zg5c

Faulting package-relative application ID: App

Error: (07/11/2015 12:03:02 PM) (Source: Application Hang) (EventID: 1002) (User: )

Process ID: cd78

Start Time: 01d0bc0b7d0808fe

Termination Time: 4294967295

Application Path: C:\Windows\system32\backgroundTaskHost.exe

Report Id: 71850e05-27ff-11e5-829e-1458d0c06312

Faulting package full name: Facebook.Facebook_1.4.0.9_x64__8xx8rvfyw5nnt

Faulting package-relative application ID: App

Error: (07/11/2015 11:50:29 AM) (Source: Application Hang) (EventID: 1002) (User: )

Process ID: c76c

Start Time: 01d0bc0965114832

Termination Time: 4294967295

Application Path: C:\Windows\syswow64\wwahost.exe

Report Id: b1a19a1f-27fd-11e5-829e-1458d0c06312

Faulting package full name: Microsoft.SkypeApp_3.1.0.1016_x86__kzf8qxf38zg5c

Faulting package-relative application ID: App

Error: (07/11/2015 11:48:06 AM) (Source: Application Hang) (EventID: 1002) (User: )

Process ID: c760

Start Time: 01d0bc0965100fa6

Termination Time: 4294967295

Application Path: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20911_x64__8wekyb3d8bbwe\LiveComm.exe

Report Id: 5957edbb-27fd-11e5-829e-1458d0c06312

Faulting package full name: microsoft.windowscommunicationsapps_17.5.9600.20911_x64__8wekyb3d8bbwe

Faulting package-relative application ID: ppleae38af2e007f4358a809ac99a64a67c1

Error: (07/11/2015 11:48:05 AM) (Source: Application Hang) (EventID: 1002) (User: )

Process ID: c6b0

Start Time: 01d0bc096437117e

Termination Time: 4294967295

Application Path: C:\Windows\system32\backgroundTaskHost.exe

Report Id: 5965a99e-27fd-11e5-829e-1458d0c06312

Faulting package full name: Facebook.Facebook_1.4.0.9_x64__8xx8rvfyw5nnt

Faulting package-relative application ID: App

System errors:

=============

Error: (07/11/2015 04:45:03 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: The VBoxAsw Support Driver service failed to start due to the following error:

%%2

Error: (07/11/2015 04:44:53 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: The GSafe service failed to start due to the following error:

%%3

Error: (07/11/2015 03:35:17 PM) (Source: DCOM) (EventID: 10010) (User: NT AUTHORITY)

Description: {209500FC-6B45-4693-8871-6296C4843751}

Error: (07/11/2015 12:11:25 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: The VBoxAsw Support Driver service failed to start due to the following error:

%%2

Error: (07/11/2015 12:11:14 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: The GSafe service failed to start due to the following error:

%%3

Error: (07/11/2015 12:09:08 PM) (Source: Service Control Manager) (EventID: 7011) (User: )

Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the HP Support Assistant Service service.

Error: (07/11/2015 12:09:08 PM) (Source: Service Control Manager) (EventID: 7011) (User: )

Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the tbaseprovisioning service.

Error: (07/11/2015 12:09:08 PM) (Source: Service Control Manager) (EventID: 7011) (User: )

Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the ClickToRunSvc service.

Error: (07/11/2015 12:09:08 PM) (Source: Service Control Manager) (EventID: 7011) (User: )

Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the mfevtp service.

Error: (07/11/2015 12:07:46 PM) (Source: DCOM) (EventID: 10010) (User: KRAKEN)

Description: {4AA0A5C4-1B9B-4F2E-99D7-99C6AEC83474}

Microsoft Office:

=========================

Error: (07/11/2015 05:34:55 PM) (Source: Application Hang) (EventID: 1002) (User: )

Description: backgroundTaskHost.exe6.3.9600.1741528cc01d0bc39d8bdbfd04294967295C:\Windows\system32\backgroundTaskHost.execdb7a1d4-282d-11e5-82a0-1458d0c06312Facebook.Facebook_1.4.0.9_x64__8xx8rvfyw5nntApp

Error: (07/11/2015 04:51:37 PM) (Source: Application Hang) (EventID: 1002) (User: )

Description: backgroundTaskHost.exe6.3.9600.1741576401d0bc33c74044884294967295C:\Windows\system32\backgroundTaskHost.exebdee34b3-2827-11e5-82a0-1458d0c06312Facebook.Facebook_1.4.0.9_x64__8xx8rvfyw5nntApp

Error: (07/11/2015 04:51:37 PM) (Source: Application Hang) (EventID: 1002) (User: )

Description: LiveComm.exe17.5.9600.20911145401d0bc33c749cdfc4294967295C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20911_x64__8wekyb3d8bbwe\LiveComm.exebdea640c-2827-11e5-82a0-1458d0c06312microsoft.windowscommunicationsapps_17.5.9600.20911_x64__8wekyb3d8bbweppleae38af2e007f4358a809ac99a64a67c1

Error: (07/11/2015 03:37:21 PM) (Source: Application Hang) (EventID: 1002) (User: )

Description: backgroundTaskHost.exe6.3.9600.1741581c01d0bc296baa79104294967295C:\Windows\system32\backgroundTaskHost.exe5ff69cb9-281d-11e5-829f-1458d0c06312Facebook.Facebook_1.4.0.9_x64__8xx8rvfyw5nntApp

Error: (07/11/2015 03:37:20 PM) (Source: Application Hang) (EventID: 1002) (User: )

Description: LiveComm.exe17.5.9600.20911185801d0bc296babb19b4294967295C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20911_x64__8wekyb3d8bbwe\LiveComm.exe5fcec8da-281d-11e5-829f-1458d0c06312microsoft.windowscommunicationsapps_17.5.9600.20911_x64__8wekyb3d8bbweppleae38af2e007f4358a809ac99a64a67c1

Error: (07/11/2015 12:05:42 PM) (Source: Application Hang) (EventID: 1002) (User: )

Description: wwahost.exe6.3.9600.17415b7fc01d0bc0b7d2666ea4294967295C:\Windows\syswow64\wwahost.execae8e255-27ff-11e5-829e-1458d0c06312Microsoft.SkypeApp_3.1.0.1016_x86__kzf8qxf38zg5cApp

Error: (07/11/2015 12:03:02 PM) (Source: Application Hang) (EventID: 1002) (User: )

Description: backgroundTaskHost.exe6.3.9600.17415cd7801d0bc0b7d0808fe4294967295C:\Windows\system32\backgroundTaskHost.exe71850e05-27ff-11e5-829e-1458d0c06312Facebook.Facebook_1.4.0.9_x64__8xx8rvfyw5nntApp

Error: (07/11/2015 11:50:29 AM) (Source: Application Hang) (EventID: 1002) (User: )

Description: wwahost.exe6.3.9600.17415c76c01d0bc09651148324294967295C:\Windows\syswow64\wwahost.exeb1a19a1f-27fd-11e5-829e-1458d0c06312Microsoft.SkypeApp_3.1.0.1016_x86__kzf8qxf38zg5cApp

Error: (07/11/2015 11:48:06 AM) (Source: Application Hang) (EventID: 1002) (User: )

Description: LiveComm.exe17.5.9600.20911c76001d0bc0965100fa64294967295C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20911_x64__8wekyb3d8bbwe\LiveComm.exe5957edbb-27fd-11e5-829e-1458d0c06312microsoft.windowscommunicationsapps_17.5.9600.20911_x64__8wekyb3d8bbweppleae38af2e007f4358a809ac99a64a67c1

Error: (07/11/2015 11:48:05 AM) (Source: Application Hang) (EventID: 1002) (User: )

Description: backgroundTaskHost.exe6.3.9600.17415c6b001d0bc096437117e4294967295C:\Windows\system32\backgroundTaskHost.exe5965a99e-27fd-11e5-829e-1458d0c06312Facebook.Facebook_1.4.0.9_x64__8xx8rvfyw5nntApp

CodeIntegrity Errors:

===================================

Date: 2015-07-11 01:12:12.073

Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Program Files (x86)\Malwarebytes Anti-Malware\mbampt.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2015-07-10 18:17:11.235

Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Program Files\SpaceSoundPro\SpaceSoundPro.dll because the set of per-page image hashes could not be found on the system.

Date: 2015-07-10 18:17:10.954

Date: 2015-07-10 18:17:10.673

Date: 2015-07-10 18:17:10.392

Date: 2015-07-10 18:17:10.126

Date: 2015-07-10 18:17:09.860

Date: 2015-07-10 18:17:09.564

==================== Memory info ===========================

Processor: AMD A8-6410 APU with AMD Radeon R5 Graphics

Percentage of memory in use: 75%

Total physical RAM: 3528.98 MB

Available physical RAM: 848.8 MB

Total Virtual: 7112.98 MB

Available Virtual: 3214.22 MB

==================== Drives ================================

Drive c: (Windows) (Fixed) (Total:445.2 GB) (Free:123.2 GB) NTFS

Drive d: (RECOVERY) (Fixed) (Total:19.54 GB) (Free:1.88 GB) NTFS ==>[System with boot components (obtained from reading drive)]

Drive f: (MasterCook 9) (CDROM) (Total:0.56 GB) (Free:0 GB) CDFS

==================== MBR & Partition Table ==================

========================================================

Disk: 0 (Size: 465.8 GB) (Disk ID: 50891092)

Partition: GPT Partition Type.

==================== End of log ============================

And here is the fixlog:

Fix result of Farbar Recovery Scan Tool (x64) Version:11-07-2015

Ran by Jon at 2015-07-12 09:14:26 Run:1

Running from C:\Users\Jon\Desktop

Loaded Profiles: Jon (Available Profiles: Jon)

Boot Mode: Normal

==============================================

fixlist content:

*****************

CreateRestorePoint: