Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

Maybe Still Infected?


  • Please log in to reply

#1
no_body50

no_body50

    Member

  • Member
  • PipPip
  • 11 posts

Hey, i recently opened a fake picture from one of my dota chats. i already deleted the file in safe mode and scan using malwarebytes. However, i am still unsure if my laptop is still infected. As i am starting sch soon, i trying to ensure that my laptop is totally clean. My computer is also constantly auto update and chrome occasionally crashes and open again.

steam-chat-1.jpeg

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:20-07-2015
Ran by Mohamed Shahrir (administrator) on MOHAMED_SHAHRIR on 22-07-2015 19:14:34
Running from C:\Users\Mohamed Shahrir\Downloads
Loaded Profiles: Mohamed Shahrir (Available Profiles: Mohamed Shahrir & no one & Guest)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: English (United States)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Safe Mode (with Networking)
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/
 
==================== Processes (Whitelisted) =================
 
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Avast Software s.r.o.) C:\Program Files\AVAST Software\Avast\avastui.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
 
 
==================== Registry (Whitelisted) ==================
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 
HKLM\...\Run: [InstantUpdate] => C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuDaemon.exe [124520 2012-04-07] ()
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2868496 2012-02-14] (Synaptics Incorporated)
HKLM\...\Run: [Power Management] => C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [1829768 2012-02-08] (Acer Incorporated)
HKLM\...\Run: [IntelTBRunOnce] => wscript.exe //b //nologo "C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs"
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12446824 2012-01-31] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1156712 2011-11-15] (Realtek Semiconductor)
HKLM\...\Run: [Nvtmru] => C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe [1028384 2013-11-14] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2273056 2013-11-30] (NVIDIA Corporation)
HKLM\...\Run: [BtPreLoad] => "C:\Program Files (x86)\Bluetooth Suite\BtPreLoad.exe"
HKLM-x32\...\Run: [Norton Online Backup] => C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe
HKLM-x32\...\Run: [BackupManagerTray] => C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe [296984 2012-01-06] (NTI Corporation)
HKLM-x32\...\Run: [LManager] => C:\Program Files (x86)\Launch Manager\LManager.exe [1106512 2012-03-02] (Dritek System Inc.)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-01-27] (Intel Corporation)
HKLM-x32\...\Run: [Dolby Home Theater v4] => C:\Dolby PCEE4\pcee4.exe [506712 2011-06-01] (Dolby Laboratories Inc.)
HKLM-x32\...\Run: [DivXUpdate] => C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1259376 2011-07-29] ()
HKLM-x32\...\Run: [APSDaemon] => "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
HKLM-x32\...\Run: [QuickTime Task] => "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5515496 2015-07-02] (Avast Software s.r.o.)
HKLM-x32\...\Run: [PHIDriver] => C:\Windows\PhiMouPro.exe [57344 2007-06-22] (Chicony)
HKLM-x32\...\Run: [PHILED] => C:\Windows\PHILED.exe [384512 2007-05-16] (Chicony)
HKLM-x32\...\Run: [LchDrv] => C:\Windows\LchDrvKey.exe [36864 2007-03-28] ()
HKLM-x32\...\Run: [AdobeCS4ServiceManager] => "C:\Program Files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
HKLM-x32\...\Run: [BCSSync] => "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" /DelayServices
HKLM-x32\...\Run: [PWRISOVM.EXE] => C:\Program Files\PowerISO\PWRISOVM.EXE [408888 2015-06-08] (Power Software Ltd)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer: [NoControlPanel] 0
HKU\S-1-5-21-2809493940-1832043367-3520061379-1001\...\Run: [GoogleDriveSync] => "C:\Program Files (x86)\Google\Drive\googledrivesync.exe" /autostart
HKU\S-1-5-21-2809493940-1832043367-3520061379-1001\...\Run: [iLivid] => "C:\Users\Mohamed Shahrir\AppData\Local\iLivid\iLivid.exe" -autorun
HKU\S-1-5-21-2809493940-1832043367-3520061379-1001\...\Run: [DriverUpdaterPro] => C:\Program Files (x86)\oTweak\DriverUpdaterPro\DriverUpdaterPro.exe /ot /as /ss
HKU\S-1-5-21-2809493940-1832043367-3520061379-1001\...\Run: [Steam] => "C:\Program Files (x86)\Steam\steam.exe" -silent
HKU\S-1-5-21-2809493940-1832043367-3520061379-1001\...\Run: [RESTART_STICKY_NOTES] => C:\Windows\System32\StikyNot.exe [427520 2009-07-14] (Microsoft Corporation)
IFEO\bitguard.exe: [Debugger] tasklist.exe
IFEO\bprotect.exe: [Debugger] tasklist.exe
IFEO\bpsvc.exe: [Debugger] tasklist.exe
IFEO\browserdefender.exe: [Debugger] tasklist.exe
IFEO\browserprotect.exe: [Debugger] tasklist.exe
IFEO\browsersafeguard.exe: [Debugger] tasklist.exe
IFEO\dprotectsvc.exe: [Debugger] tasklist.exe
IFEO\jumpflip: [Debugger] tasklist.exe
IFEO\protectedsearch.exe: [Debugger] tasklist.exe
IFEO\searchinstaller.exe: [Debugger] tasklist.exe
IFEO\searchprotection.exe: [Debugger] tasklist.exe
IFEO\searchprotector.exe: [Debugger] tasklist.exe
IFEO\searchsettings.exe: [Debugger] tasklist.exe
IFEO\searchsettings64.exe: [Debugger] tasklist.exe
IFEO\snapdo.exe: [Debugger] tasklist.exe
IFEO\stinst32.exe: [Debugger] tasklist.exe
IFEO\stinst64.exe: [Debugger] tasklist.exe
IFEO\umbrella.exe: [Debugger] tasklist.exe
IFEO\utiljumpflip.exe: [Debugger] tasklist.exe
IFEO\volaro: [Debugger] tasklist.exe
IFEO\vonteera: [Debugger] tasklist.exe
IFEO\websteroids.exe: [Debugger] tasklist.exe
IFEO\websteroidsservice.exe: [Debugger] tasklist.exe
Startup: C:\Users\Mohamed Shahrir\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MagicDisc.lnk [2015-07-18]
ShortcutTarget: MagicDisc.lnk -> C:\Program Files (x86)\MagicDisc\MagicDisc.exe (No File)
Startup: C:\Users\no one\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Intel® Turbo Boost Technology Monitor 2.0.lnk [2012-11-19]
ShortcutTarget: Intel® Turbo Boost Technology Monitor 2.0.lnk -> C:\Program Files\Intel\TurboBoost\SignalIslandUi.exe (Intel® Corporation)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2015-07-02] (Avast Software s.r.o.)
ShellIconOverlayIdentifiers: [GDriveSharedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} =>  No File
ShellIconOverlayIdentifiers-x32: [Groove Explorer Icon Overlay 1 (GFS Unread Stub)] -> {99FD978C-D287-4F50-827F-B2C658EDA8E7} => C:\PROGRA~2\MICROS~4\Office14\GROOVEEX.DLL No File
ShellIconOverlayIdentifiers-x32: [Groove Explorer Icon Overlay 2 (GFS Stub)] -> {AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} => C:\PROGRA~2\MICROS~4\Office14\GROOVEEX.DLL No File
ShellIconOverlayIdentifiers-x32: [Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)] -> {920E6DB1-9907-4370-B3A0-BAFC03D81399} => C:\PROGRA~2\MICROS~4\Office14\GROOVEEX.DLL No File
ShellIconOverlayIdentifiers-x32: [Groove Explorer Icon Overlay 3 (GFS Folder)] -> {16F3DD56-1AF5-4347-846D-7C10C4192619} => C:\PROGRA~2\MICROS~4\Office14\GROOVEEX.DLL No File
ShellIconOverlayIdentifiers-x32: [Groove Explorer Icon Overlay 4 (GFS Unread Mark)] -> {2916C86E-86A6-43FE-8112-43ABE6BF8DCC} => C:\PROGRA~2\MICROS~4\Office14\GROOVEEX.DLL No File
GroupPolicyUsers\S-1-5-21-2809493940-1832043367-3520061379-1004\User: Group Policy Restriction detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
 
==================== Internet (Whitelisted) ====================
 
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.omniboxes...q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://www.omniboxes...q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.omniboxes...q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.omniboxes...q={searchTerms}
HKU\S-1-5-21-2809493940-1832043367-3520061379-1001\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
URLSearchHook: HKU\S-1-5-21-2809493940-1832043367-3520061379-1001 - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll No File
URLSearchHook: HKU\S-1-5-21-2809493940-1832043367-3520061379-1001 - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll No File
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/...rc=IE-SearchBox
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/...rc=IE-SearchBox
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/...rc=IE-SearchBox
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/...rc=IE-SearchBox
SearchScopes: HKU\S-1-5-21-2809493940-1832043367-3520061379-1001 -> DefaultScope {CFFA3A58-2D5E-4CA9-826F-2BCDB232D585} URL = http://search.condui...CT3220468&SSPV=
SearchScopes: HKU\S-1-5-21-2809493940-1832043367-3520061379-1001 -> {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = http://www.buenosear...414_16&tsp=5239
SearchScopes: HKU\S-1-5-21-2809493940-1832043367-3520061379-1001 -> {4B39CEAE-05BF-46EE-B05F-3302A17876FA} URL = http://sg.search.yah...p={searchTerms}
SearchScopes: HKU\S-1-5-21-2809493940-1832043367-3520061379-1001 -> {CFFA3A58-2D5E-4CA9-826F-2BCDB232D585} URL = http://search.condui...CT3220468&SSPV=
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL [2010-01-21] (Microsoft Corporation)
BHO: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll [2014-05-07] (Oracle Corporation)
BHO: CIESpeechBHO Class -> {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} -> C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll No File
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2015-07-02] (Avast Software s.r.o.)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-29] (Microsoft Corp.)
BHO: McAfee SiteAdvisor BHO -> {B164E929-A1B6-4A06-B104-2CD0E90A88FF} -> c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll No File
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2010-01-16] (Microsoft Corporation)
BHO: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll [2014-05-07] (Oracle Corporation)
BHO-x32: Babylon toolbar helper -> {2EECD738-5844-4a99-B4B6-146BF802613B} -> C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.6.9.12\bh\BabylonToolbar.dll No File
BHO-x32: DivX Plus Web Player HTML5 <video> -> {326E768D-4182-46FD-9C16-1449A49795F4} -> C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll No File
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\PROGRA~2\MICROS~4\Office14\GROOVEEX.DLL No File
BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll No File
BHO-x32: CIESpeechBHO Class -> {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} -> C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll No File
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2015-07-02] (Avast Software s.r.o.)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll No File
BHO-x32: McAfee SiteAdvisor BHO -> {B164E929-A1B6-4A06-B104-2CD0E90A88FF} -> c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll No File
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\PROGRA~2\MICROS~4\Office14\URLREDIR.DLL No File
BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll No File
Toolbar: HKLM - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll No File
Toolbar: HKLM - avast! WebRep - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} -  No File
Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} -  No File
Toolbar: HKLM-x32 - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll No File
Toolbar: HKLM-x32 - Babylon Toolbar - {98889811-442D-49dd-99D7-DC866BE87DBC} - C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.6.9.12\BabylonToolbarTlbr.dll No File
Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll No File
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.dll No File
Handler: ms-help - {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files (x86)\Common Files\Microsoft Shared\Help\hxds.dll No File
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.dll No File
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll No File
Handler: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files (x86)\Windows Live\Mail\mailcomm.dll No File
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll No File
ShellExecuteHooks-x32: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MICROS~4\Office14\GROOVEEX.DLL No File [ ]
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{181AA8B6-6680-4B70-B229-0196AF75AB1D}: [DhcpNameServer] 202.65.247.31 202.65.244.32
Tcpip\..\Interfaces\{2C6A75A3-244E-4D4F-A8AD-F343F7807266}: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{5F405688-8B73-40F0-8134-38DB73DB0E5B}: [DhcpNameServer] 192.168.42.129
Tcpip\..\Interfaces\{81C479A7-2322-448A-A7FD-291EA7CC74FD}: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{F9284998-D12F-408A-A3E9-F65004F594F8}: [DhcpNameServer] 202.65.244.31 202.65.247.32
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe http://www.omniboxes...59E6AW0AE6AW0AX
 
FireFox:
========
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_70.dll [2014-03-01] ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll [2011-06-21] (DivX, LLC.)
FF Plugin: @java.com/DTPlugin,version=10.55.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll [2014-05-07] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.55.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll [2014-05-07] (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-16] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_70.dll [2014-03-01] ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1167637.dll [2012-08-09] (Adobe Systems, Inc.)
FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll No File
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll No File
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59 -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll No File
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll No File
FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll No File
FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll No File
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.40416.0\npctrl.dll No File
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~4\Office14\NPAUTHZ.DLL No File
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL No File
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll No File
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-16] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-16] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll No File
FF Plugin HKU\S-1-5-21-2809493940-1832043367-3520061379-1001: ubisoft.com/uplaypc -> C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll No File
FF HKLM-x32\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files (x86)\McAfee\SiteAdvisor
FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF HKLM-x32\...\Firefox\Extensions: [[email protected]] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2012-05-27]
 
Chrome: 
=======
CHR dev: Chrome dev build detected! <======= ATTENTION
CHR Profile: C:\Users\Mohamed Shahrir\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Wookmark) - C:\Users\Mohamed Shahrir\AppData\Local\Google\Chrome\User Data\Default\Extensions\baaofnaeiakbkdgmheeglhmailndkkni [2015-07-19]
CHR Extension: (uTorrentControl_v2) - C:\Users\Mohamed Shahrir\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejpbbhjlbipncjklfjjaedaieimbmdda [2014-06-01]
CHR Extension: (SiteAdvisor) - C:\Users\Mohamed Shahrir\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho [2014-11-25]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Mohamed Shahrir\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-14]
CHR Extension: (Google Wallet) - C:\Users\Mohamed Shahrir\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-01]
CHR HKU\S-1-5-21-2809493940-1832043367-3520061379-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [apdfllckaahabafndbhieahigkjlhalf] - C:\Users\MOHAME~1\AppData\Local\Google\Drive\apdfllckaahabafndbhieahigkjlhalf_live.crx [Not Found]
CHR HKU\S-1-5-21-2809493940-1832043367-3520061379-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [ejpbbhjlbipncjklfjjaedaieimbmdda] - C:\Users\Mohamed Shahrir\AppData\Local\CRE\ejpbbhjlbipncjklfjjaedaieimbmdda.crx [2012-08-26]
CHR HKLM-x32\...\Chrome\Extension: [bpegkgagfojjbcpkihigfmkojdmmimdf] - No Path Or update_url value
CHR HKLM-x32\...\Chrome\Extension: [ehgldbbpchgpcfagfpfjgoomddhccfgh] - No Path Or update_url value
CHR HKLM-x32\...\Chrome\Extension: [ejpbbhjlbipncjklfjjaedaieimbmdda] - C:\Users\Mohamed Shahrir\AppData\Local\CRE\ejpbbhjlbipncjklfjjaedaieimbmdda.crx [2012-08-26]
CHR HKLM-x32\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - http://clients2.goog...ice/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-07-02]
CHR HKLM-x32\...\Chrome\Extension: [nneajnkjbffgblleaoojgaacokifdkhm] - C:\Program Files (x86)\DivX\DivX Plus Web Player\chrome\DivXHTML5\DivXHTML5.crx [Not Found]
 
==================== Services (Whitelisted) =================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
S2 7f0567dd; c:\Program Files (x86)\SeekMarkers\SeekMarkers.dll [2307584 2015-07-19] () [File not signed]
S2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [220288 2012-09-29] (Qualcomm Atheros Commnucations) [File not signed]
S2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [343336 2015-07-02] (Avast Software s.r.o.)
S3 AvastVBoxSvc; C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe [4034896 2015-07-02] (Avast Software)
S2 Intel® ME Service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\FWService\IntelMeFWService.exe [128280 2012-02-07] ()
S2 jhi_service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [161560 2012-02-07] (Intel Corporation)
S2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2804568 2010-06-02] (Symantec Corporation)
S2 NTI IScheduleSvc; C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [256536 2012-01-06] (NTI Corporation)
S2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1370912 2013-11-30] (NVIDIA Corporation)
S2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [15128352 2013-11-30] (NVIDIA Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
S2 ZAtheros Wlan Agent; C:\Program Files (x86)\Atheros\Ath_WlanAgent.exe [76960 2012-02-27] (Atheros) [File not signed]
S3 FLEXnet Licensing Service; "C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe" [X]
S2 MBAMService; "C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe" [X]
S2 McAfee SiteAdvisor Service; "C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe" /McCoreSvc [X]
S3 Microsoft SharePoint Workspace Audit Service; "C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice [X]
S3 ose; "C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE" [X]
 
==================== Drivers (Whitelisted) ====================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
S2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29168 2015-07-02] ()
S2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [89944 2015-07-02] (Avast Software s.r.o.)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93528 2015-07-02] (Avast Software s.r.o.)
S0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65736 2015-07-02] ()
S1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1047320 2015-07-02] (Avast Software s.r.o.)
S1 aswSP; C:\Windows\system32\drivers\aswSP.sys [442264 2015-07-02] (Avast Software s.r.o.)
S2 aswStm; C:\Windows\system32\drivers\aswStm.sys [137288 2015-07-02] (Avast Software s.r.o.)
S0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [272248 2015-07-02] ()
S3 BTATH_LWFLT; C:\Windows\System32\DRIVERS\btath_lwflt.sys [77464 2012-09-29] (Qualcomm Atheros)
S3 ewusbnet; C:\Windows\System32\DRIVERS\ewusbnet.sys [132608 2009-07-13] (Huawei Technologies Co., Ltd.)
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-04-14] (Malwarebytes Corporation)
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [136408 2015-06-20] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-04-14] (Malwarebytes Corporation)
S2 npf; C:\Windows\System32\drivers\npf.sys [35344 2011-02-12] (CACE Technologies, Inc.)
S3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-10-31] (NVIDIA Corporation)
R3 SmbDrv; C:\Windows\System32\DRIVERS\Smb_driver.sys [22800 2012-02-14] (Synaptics Incorporated)
S2 VBoxAswDrv; C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [273824 2015-07-02] (Avast Software)
S3 hwusbdev; system32\DRIVERS\ewusbdev.sys [X]
S3 X6va029; \??\C:\Windows\SysWOW64\Drivers\X6va029 [X]
 
==================== NetSvcs (Whitelisted) ===================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
 
==================== One Month Created files and folders ========
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2015-07-22 19:14 - 2015-07-22 19:15 - 00027679 _____ C:\Users\Mohamed Shahrir\Downloads\FRST.txt
2015-07-22 19:14 - 2015-07-22 19:14 - 00000000 ____D C:\FRST
2015-07-22 19:13 - 2015-07-22 19:13 - 02135552 _____ (Farbar) C:\Users\Mohamed Shahrir\Downloads\FRST64.exe
2015-07-22 18:49 - 2015-07-22 18:49 - 00000000 ____D C:\Users\Default\AppData\Roaming\AVAST Software
2015-07-22 18:49 - 2015-07-22 18:49 - 00000000 ____D C:\Users\Default User\AppData\Roaming\AVAST Software
2015-07-21 19:30 - 2015-07-15 11:19 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2015-07-21 19:30 - 2015-07-15 11:19 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2015-07-21 19:30 - 2015-07-15 11:19 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2015-07-21 19:30 - 2015-07-15 11:19 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2015-07-21 19:30 - 2015-07-15 10:55 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2015-07-21 19:30 - 2015-07-15 10:55 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2015-07-21 19:30 - 2015-07-15 10:55 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2015-07-21 19:30 - 2015-07-15 10:54 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2015-07-21 19:30 - 2015-07-15 09:59 - 00372224 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2015-07-21 19:30 - 2015-07-15 09:52 - 00299008 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2015-07-20 18:41 - 2015-07-22 18:48 - 00000024 _____ C:\Users\Mohamed Shahrir\AppData\Roaming\appdataFr25.bin
2015-07-19 13:03 - 2015-07-19 13:03 - 00000000 ____D C:\Program Files (x86)\Wookmark
2015-07-19 13:03 - 2015-07-19 13:03 - 00000000 ____D C:\Program Files (x86)\MOnsonRReevoenue
2015-07-19 13:03 - 2015-07-19 13:03 - 00000000 ____D C:\Program Files (x86)\MonsonReVenuE
2015-07-19 13:02 - 2015-07-19 13:03 - 00000000 ____D C:\ProgramData\7568694732754112047
2015-07-19 13:02 - 2015-07-19 13:02 - 00000000 ____D C:\Program Files (x86)\MonsOnReevenue
2015-07-19 12:44 - 2015-07-19 15:04 - 00000000 ____D C:\Users\Mohamed Shahrir\Downloads\La Parabola di Stanlio(Eng-Ita-Esp-Rus-Fra)
2015-07-19 12:43 - 2015-07-19 12:43 - 00118310 _____ C:\Users\Mohamed Shahrir\Downloads\The_Stanley_Parable[Eng-Sub_Multi5-Fiction_Interattiva]TNT_Village_[Isohunt.to].torrent
2015-07-19 12:43 - 2015-07-19 12:43 - 00000000 ____D C:\Users\Mohamed Shahrir\AppData\Roaming\Steam
2015-07-19 12:41 - 2015-07-19 12:41 - 00000000 ____D C:\Program Files (x86)\SeekMarkers
2015-07-19 12:40 - 2015-07-19 12:41 - 00000000 ____D C:\Program Files (x86)\The Magic Circle
2015-07-19 11:53 - 2015-07-19 11:53 - 00000000 ____D C:\Users\Mohamed Shahrir\Downloads\The Magic Circle v4.6.5
2015-07-19 11:52 - 2015-07-19 11:52 - 00016717 _____ C:\Users\Mohamed Shahrir\Downloads\The_Magic_Circle_v4.6.5_[Isohunt.to].torrent
2015-07-19 00:01 - 2015-07-19 08:30 - 00000000 ____D C:\Program Files (x86)\DeadCore
2015-07-18 23:54 - 2015-07-18 23:54 - 00000776 _____ C:\Users\Public\Desktop\PowerISO.lnk
2015-07-18 23:54 - 2015-07-18 23:54 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PowerISO
2015-07-18 23:54 - 2015-07-18 23:54 - 00000000 ____D C:\Program Files\PowerISO
2015-07-18 23:53 - 2015-07-18 23:54 - 04153323 _____ C:\Users\Mohamed Shahrir\Downloads\PowerISO6-x64.jse
2015-07-18 23:52 - 2015-07-18 23:52 - 00000921 _____ C:\Users\no one\Desktop\MagicDisc.lnk
2015-07-18 23:52 - 2015-07-18 23:52 - 00000921 _____ C:\Users\Guest\Desktop\MagicDisc.lnk
2015-07-18 23:52 - 2009-02-24 18:35 - 00255552 _____ (MagicISO, Inc.) C:\Windows\SysWOW64\Drivers\mcdbus.sys
2015-07-18 14:43 - 2015-07-18 14:43 - 00139362 _____ C:\Users\Mohamed Shahrir\Downloads\DeadCore-RELOADED (1).torrent
2015-07-18 14:43 - 2015-07-18 14:43 - 00018467 _____ C:\Users\Mohamed Shahrir\Downloads\DeadCore-RELOADED.torrent
2015-07-18 14:41 - 2015-07-18 14:41 - 00015632 _____ C:\Users\Mohamed Shahrir\Downloads\Contagion.Build.5688-REVOLT.torrent
2015-07-15 18:39 - 2015-07-10 01:58 - 03154944 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2015-07-15 18:39 - 2015-07-10 01:58 - 02603008 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2015-07-15 18:39 - 2015-07-10 01:58 - 00696320 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2015-07-15 18:39 - 2015-07-10 01:58 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2015-07-15 18:39 - 2015-07-10 01:58 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2015-07-15 18:39 - 2015-07-10 01:58 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2015-07-15 18:39 - 2015-07-10 01:58 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2015-07-15 18:39 - 2015-07-10 01:58 - 00037888 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2015-07-15 18:39 - 2015-07-10 01:58 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2015-07-15 18:39 - 2015-07-10 01:58 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2015-07-15 18:39 - 2015-07-10 01:58 - 00012288 _____ (Microsoft Corporation) C:\Windows\system32\wu.upgrade.ps.dll
2015-07-15 18:39 - 2015-07-10 01:43 - 00566784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2015-07-15 18:39 - 2015-07-10 01:43 - 00173056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2015-07-15 18:39 - 2015-07-10 01:43 - 00093184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2015-07-15 18:39 - 2015-07-10 01:43 - 00030208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2015-07-15 18:39 - 2015-07-10 01:42 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2015-07-15 18:39 - 2015-07-05 02:07 - 02087424 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll
2015-07-15 18:39 - 2015-07-05 01:48 - 01414656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ole32.dll
2015-07-15 18:39 - 2015-07-03 05:21 - 19877376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-07-15 18:39 - 2015-07-03 05:08 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-07-15 18:39 - 2015-07-03 04:50 - 02279424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-07-15 18:39 - 2015-07-03 04:49 - 25193984 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-07-15 18:39 - 2015-07-03 04:46 - 00479232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-07-15 18:39 - 2015-07-03 04:40 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-07-15 18:39 - 2015-07-03 04:23 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-07-15 18:39 - 2015-07-03 04:19 - 12855296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-07-15 18:39 - 2015-07-03 04:12 - 00615936 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-07-15 18:39 - 2015-07-03 03:55 - 01310720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-07-15 18:39 - 2015-07-03 03:20 - 14453248 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-07-15 18:39 - 2015-07-03 02:59 - 01545728 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-07-15 18:39 - 2015-06-27 10:47 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-07-15 18:39 - 2015-06-27 10:43 - 05923840 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-07-15 18:39 - 2015-06-27 09:58 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-07-15 18:39 - 2015-06-27 09:39 - 04520448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-07-15 18:39 - 2015-06-26 02:09 - 00389832 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-07-15 18:39 - 2015-06-26 01:43 - 00342736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-07-15 18:39 - 2015-06-25 16:57 - 03207168 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-07-15 18:39 - 2015-06-21 04:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-07-15 18:39 - 2015-06-21 03:50 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-07-15 18:39 - 2015-06-21 03:49 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-07-15 18:39 - 2015-06-21 03:49 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-07-15 18:39 - 2015-06-21 03:49 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-07-15 18:39 - 2015-06-21 03:48 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-07-15 18:39 - 2015-06-21 03:40 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-07-15 18:39 - 2015-06-21 03:39 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-07-15 18:39 - 2015-06-21 03:34 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-07-15 18:39 - 2015-06-21 03:34 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-07-15 18:39 - 2015-06-21 03:34 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-07-15 18:39 - 2015-06-21 03:25 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-07-15 18:39 - 2015-06-21 03:21 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-07-15 18:39 - 2015-06-21 03:13 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-07-15 18:39 - 2015-06-21 03:08 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-07-15 18:39 - 2015-06-21 03:07 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-07-15 18:39 - 2015-06-21 03:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-07-15 18:39 - 2015-06-21 02:48 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-07-15 18:39 - 2015-06-21 02:48 - 00720384 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-07-15 18:39 - 2015-06-21 02:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-07-15 18:39 - 2015-06-21 02:46 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-07-15 18:39 - 2015-06-21 02:26 - 02427392 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-07-15 18:39 - 2015-06-21 02:02 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-07-15 18:39 - 2015-06-20 02:25 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-07-15 18:39 - 2015-06-20 02:25 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-07-15 18:39 - 2015-06-20 02:24 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-07-15 18:39 - 2015-06-20 02:24 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-07-15 18:39 - 2015-06-20 02:23 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-07-15 18:39 - 2015-06-20 02:17 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-07-15 18:39 - 2015-06-20 02:16 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-07-15 18:39 - 2015-06-20 02:13 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-07-15 18:39 - 2015-06-20 02:13 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-07-15 18:39 - 2015-06-20 02:03 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-07-15 18:39 - 2015-06-20 01:57 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-07-15 18:39 - 2015-06-20 01:53 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-07-15 18:39 - 2015-06-20 01:52 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-07-15 18:39 - 2015-06-20 01:51 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-07-15 18:39 - 2015-06-20 01:40 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-07-15 18:39 - 2015-06-20 01:40 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-07-15 18:39 - 2015-06-20 01:39 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-07-15 18:39 - 2015-06-20 01:15 - 01951232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-07-15 18:39 - 2015-06-20 01:11 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-07-15 18:39 - 2015-06-18 01:47 - 00404992 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2015-07-15 18:39 - 2015-06-18 01:37 - 00312320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2015-07-15 18:39 - 2015-06-02 08:07 - 00254976 _____ (Microsoft Corporation) C:\Windows\system32\cewmdm.dll
2015-07-15 18:39 - 2015-06-02 07:47 - 00210432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cewmdm.dll
2015-07-15 18:38 - 2015-07-10 01:59 - 00017856 _____ (Microsoft Corporation) C:\Windows\system32\CompatTelRunner.exe
2015-07-15 18:38 - 2015-07-10 01:58 - 01085440 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-07-15 18:38 - 2015-07-10 01:58 - 00765440 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-07-15 18:38 - 2015-07-10 01:58 - 00726528 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-07-15 18:38 - 2015-07-10 01:58 - 00433664 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-07-15 18:38 - 2015-07-10 01:58 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-07-15 18:38 - 2015-07-10 01:58 - 00067584 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2015-07-15 18:38 - 2015-07-10 01:50 - 01145856 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-07-15 18:38 - 2015-07-02 04:56 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-07-15 18:38 - 2015-07-02 04:56 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-07-15 18:38 - 2015-07-02 04:49 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-07-15 18:38 - 2015-07-02 04:49 - 01216512 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2015-07-15 18:38 - 2015-07-02 04:49 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-07-15 18:38 - 2015-07-02 04:49 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-07-15 18:38 - 2015-07-02 04:49 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-07-15 18:38 - 2015-07-02 04:49 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-07-15 18:38 - 2015-07-02 04:49 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-07-15 18:38 - 2015-07-02 04:49 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-07-15 18:38 - 2015-07-02 04:49 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-07-15 18:38 - 2015-07-02 04:49 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-07-15 18:38 - 2015-07-02 04:49 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-07-15 18:38 - 2015-07-02 04:48 - 00044032 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2015-07-15 18:38 - 2015-07-02 04:48 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-07-15 18:38 - 2015-07-02 04:47 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-07-15 18:38 - 2015-07-02 04:47 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-07-15 18:38 - 2015-07-02 04:43 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-07-15 18:38 - 2015-07-02 04:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-07-15 18:38 - 2015-07-02 04:39 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-07-15 18:38 - 2015-07-02 04:30 - 00552960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-07-15 18:38 - 2015-07-02 04:30 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-07-15 18:38 - 2015-07-02 04:30 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-07-15 18:38 - 2015-07-02 04:30 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-07-15 18:38 - 2015-07-02 04:30 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-07-15 18:38 - 2015-07-02 04:30 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-07-15 18:38 - 2015-07-02 04:30 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll
2015-07-15 18:38 - 2015-07-02 04:30 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-07-15 18:38 - 2015-07-02 04:30 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-07-15 18:38 - 2015-07-02 04:29 - 00665088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2015-07-15 18:38 - 2015-07-02 04:29 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-07-15 18:38 - 2015-07-02 04:29 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-07-15 18:38 - 2015-07-02 04:27 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-07-15 18:38 - 2015-07-02 04:26 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-07-15 18:38 - 2015-07-02 04:24 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-07-15 18:38 - 2015-07-02 03:27 - 00159232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2015-07-15 18:38 - 2015-07-02 03:26 - 00290816 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2015-07-15 18:38 - 2015-07-02 03:26 - 00129024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2015-07-15 18:38 - 2015-06-16 05:50 - 00112064 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2015-07-15 18:38 - 2015-06-16 05:45 - 03242496 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2015-07-15 18:38 - 2015-06-16 05:45 - 01941504 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2015-07-15 18:38 - 2015-06-16 05:45 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2015-07-15 18:38 - 2015-06-16 05:45 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll
2015-07-15 18:38 - 2015-06-16 05:44 - 00128000 _____ (Microsoft Corporation) C:\Windows\system32\msiexec.exe
2015-07-15 18:38 - 2015-06-16 05:43 - 02364416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2015-07-15 18:38 - 2015-06-16 05:43 - 01805824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2015-07-15 18:38 - 2015-06-16 05:43 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll
2015-07-15 18:38 - 2015-06-16 05:42 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msiexec.exe
2015-07-15 18:38 - 2015-06-16 05:42 - 00025088 _____ (Microsoft Corporation) C:\Windows\system32\msimsg.dll
2015-07-15 18:38 - 2015-06-16 05:37 - 00025088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msimsg.dll
2015-07-15 18:38 - 2015-04-28 03:23 - 01480192 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2015-07-15 18:38 - 2015-04-28 03:23 - 00229376 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2015-07-15 18:38 - 2015-04-28 03:23 - 00188416 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2015-07-15 18:38 - 2015-04-28 03:23 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2015-07-15 18:38 - 2015-04-28 03:05 - 00179200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2015-07-15 18:38 - 2015-04-28 03:04 - 01174528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2015-07-15 18:38 - 2015-04-28 03:04 - 00143872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2015-07-15 18:38 - 2015-04-28 03:04 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2015-07-10 22:23 - 2015-07-10 22:35 - 113325422 _____ C:\Users\Mohamed Shahrir\Downloads\AloneXP Ver. 7.2.2a.rar
2015-07-10 22:21 - 2015-07-10 22:25 - 68427047 _____ C:\Users\Mohamed Shahrir\Downloads\Conquest 05292014.exe
2015-07-10 22:21 - 2015-07-10 22:23 - 194690591 _____ C:\Users\Mohamed Shahrir\Downloads\RPGVXAce_RTP.zip
2015-07-08 06:26 - 2015-07-08 06:26 - 00000000 ____D C:\Users\Mohamed Shahrir\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2015-07-08 06:26 - 2015-07-08 06:26 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
2015-07-08 06:25 - 2015-07-08 06:26 - 00000000 ____D C:\Program Files\WinRAR
2015-07-08 06:25 - 2015-07-08 06:25 - 01941744 _____ C:\Users\Mohamed Shahrir\Downloads\winrar-x64-521.exe
2015-07-08 06:03 - 2015-07-08 06:10 - 211480866 _____ C:\Users\Mohamed Shahrir\Downloads\Silverfall_PAL_MULTi5_PSP-OE.rar
2015-07-07 06:02 - 2015-07-07 06:02 - 00000213 _____ C:\Users\Mohamed Shahrir\Desktop\Dota 2.url
2015-07-07 05:53 - 2015-07-21 21:49 - 00000000 ____D C:\Program Files\Steam
2015-07-07 05:41 - 2015-07-07 05:53 - 00000732 _____ C:\Users\Public\Desktop\Steam.lnk
2015-07-05 07:59 - 2015-07-07 05:37 - 00000000 ___RD C:\Program Files (x86)\Skype
2015-07-05 07:59 - 2015-07-05 07:59 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2015-07-04 20:17 - 2015-07-15 06:23 - 00002147 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2015-07-04 20:17 - 2015-07-04 20:17 - 00931408 _____ (Google Inc.) C:\Users\Mohamed Shahrir\Downloads\ChromeSetup.exe
2015-07-04 19:54 - 2015-07-04 20:17 - 00000000 ____D C:\Program Files (x86)\Google
2015-07-02 20:37 - 2015-07-02 20:37 - 00000000 ____D C:\Windows\SysWOW64\vbox
2015-07-02 20:37 - 2015-07-02 20:37 - 00000000 ____D C:\Windows\system32\vbox
2015-07-02 18:34 - 2015-07-02 18:34 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVAST Software
2015-07-02 18:33 - 2015-07-02 18:33 - 00364472 _____ (Avast Software s.r.o.) C:\Windows\system32\aswBoot.exe
2015-07-02 18:33 - 2015-07-02 18:33 - 00043112 _____ (Avast Software s.r.o.) C:\Windows\avastSS.scr
2015-06-25 20:22 - 2015-06-25 20:22 - 06179362 _____ C:\Users\Mohamed Shahrir\Downloads\Evidence.7z
2015-06-23 21:27 - 2015-06-23 21:27 - 00000000 ____D C:\Users\Mohamed Shahrir\AppData\Local\Skype
 
==================== One Month Modified files and folders ========
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2015-07-22 18:48 - 2012-09-20 18:59 - 00000894 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-07-22 18:48 - 2012-05-22 16:23 - 00000828 _____ C:\Windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon.job
2015-07-22 18:48 - 2009-07-14 12:45 - 00024608 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-07-22 18:48 - 2009-07-14 12:45 - 00024608 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-07-22 18:46 - 2015-06-19 05:32 - 00014056 _____ C:\Windows\setupact.log
2015-07-22 18:46 - 2009-07-14 13:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-07-22 18:45 - 2009-07-14 12:45 - 03033552 _____ C:\Windows\system32\FNTCACHE.DAT
2015-07-21 23:21 - 2012-05-22 16:11 - 01095489 _____ C:\Windows\WindowsUpdate.log
2015-07-21 23:20 - 2012-05-28 12:20 - 00000000 ____D C:\ProgramData\Microsoft Help
2015-07-21 22:59 - 2012-08-24 16:54 - 00000912 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2809493940-1832043367-3520061379-1003UA.job
2015-07-21 22:28 - 2012-09-20 18:59 - 00000898 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-07-21 19:14 - 2012-07-12 10:53 - 00004182 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2015-07-20 01:54 - 2013-05-21 18:23 - 00000000 ____D C:\Users\Mohamed Shahrir\Desktop\unsorted
2015-07-19 15:04 - 2012-10-17 23:36 - 00000000 ___HD C:\Users\Mohamed Shahrir\AppData\Roaming\uTorrent
2015-07-19 12:59 - 2012-08-24 16:54 - 00000860 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2809493940-1832043367-3520061379-1003Core.job
2015-07-16 18:23 - 2012-09-20 18:59 - 00003894 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-07-16 18:23 - 2012-09-20 18:59 - 00003642 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-07-16 18:18 - 2012-05-22 16:23 - 00000830 _____ C:\Windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d.job
2015-07-16 17:28 - 2015-04-05 07:52 - 00000000 ___SD C:\Windows\SysWOW64\GWX
2015-07-16 17:28 - 2015-04-05 07:52 - 00000000 ___SD C:\Windows\system32\GWX
2015-07-16 17:28 - 2009-07-14 11:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2015-07-16 17:27 - 2014-12-12 07:06 - 00000000 ____D C:\Windows\system32\appraiser
2015-07-16 17:27 - 2014-05-09 08:22 - 00000000 ___SD C:\Windows\system32\CompatTel
2015-07-15 23:22 - 2013-07-22 03:06 - 00000000 ____D C:\Windows\system32\MRT
2015-07-08 06:44 - 2009-07-14 13:13 - 00786662 _____ C:\Windows\system32\PerfStringBackup.INI
2015-07-07 05:37 - 2012-09-14 04:17 - 00000000 ___HD C:\Users\Mohamed Shahrir\AppData\Roaming\Skype
2015-07-07 05:37 - 2012-04-11 02:16 - 00000000 ____D C:\ProgramData\Skype
2015-07-05 07:51 - 2010-11-21 11:47 - 00434374 _____ C:\Windows\PFRO.log
2015-07-05 07:51 - 2009-07-14 13:08 - 00032588 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2015-07-04 20:17 - 2013-12-08 23:16 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-07-04 20:09 - 2012-05-26 18:34 - 00000000 ___HD C:\Users\Mohamed Shahrir\AppData\Local\Deployment
2015-07-04 19:53 - 2015-04-09 21:13 - 00000000 __SHD C:\Users\Mohamed Shahrir\AppData\Local\EmieBrowserModeList
2015-07-04 19:53 - 2014-05-06 18:36 - 00000000 __SHD C:\Users\Mohamed Shahrir\AppData\Local\EmieUserList
2015-07-04 19:53 - 2014-05-06 18:36 - 00000000 __SHD C:\Users\Mohamed Shahrir\AppData\Local\EmieSiteList
2015-07-04 17:58 - 2015-03-24 13:58 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GOG.com
2015-07-04 17:57 - 2009-07-14 13:32 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2015-07-04 17:47 - 2012-04-11 02:26 - 00000000 ____D C:\Program Files (x86)\Adobe
2015-07-04 17:47 - 2009-07-14 13:32 - 00000000 ____D C:\Program Files (x86)\Windows Sidebar
2015-07-04 17:42 - 2012-05-22 16:29 - 00000000 ____D C:\Program Files (x86)\NVIDIA Corporation
2015-07-04 17:42 - 2012-04-11 02:27 - 00000000 ____D C:\Program Files (x86)\NTI
2015-07-04 17:42 - 2009-07-14 13:32 - 00000000 ____D C:\Program Files (x86)\MSBuild
2015-07-04 17:41 - 2012-10-01 02:20 - 00000000 ____D C:\Program Files (x86)\DivX
2015-07-04 17:41 - 2012-05-22 16:21 - 00000000 ____D C:\Program Files (x86)\Launch Manager
2015-07-04 17:41 - 2012-04-11 02:08 - 00000000 ____D C:\Program Files (x86)\Intel
2015-07-04 17:40 - 2012-04-11 02:35 - 00000000 ____D C:\Program Files (x86)\CyberLink
2015-07-04 17:39 - 2015-01-15 11:18 - 00000000 ____D C:\Program Files (x86)\Bluetooth Suite
2015-07-04 17:39 - 2012-05-22 16:41 - 00000000 ____D C:\Program Files (x86)\Atheros
2015-07-04 17:39 - 2012-04-11 02:18 - 00000000 ____D C:\Program Files (x86)\Acer
2015-07-04 15:33 - 2012-10-04 06:13 - 00000000 ___HD C:\Users\Mohamed Shahrir\AppData\Local\CrashDumps
2015-07-03 08:43 - 2012-10-20 20:30 - 130333168 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-07-02 20:29 - 2012-05-27 11:20 - 00442264 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswsp.sys
2015-07-02 18:33 - 2014-08-05 00:53 - 00029168 _____ C:\Windows\system32\Drivers\aswHwid.sys
2015-07-02 18:33 - 2014-01-14 11:45 - 00137288 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswStm.sys
2015-07-02 18:33 - 2014-01-14 11:17 - 00272248 _____ C:\Windows\system32\Drivers\aswVmm.sys
2015-07-02 18:33 - 2014-01-14 11:17 - 00065736 _____ C:\Windows\system32\Drivers\aswRvrt.sys
2015-07-02 18:33 - 2012-05-27 11:20 - 00093528 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswRdr2.sys
2015-07-02 18:33 - 2012-05-27 11:20 - 00089944 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswMonFlt.sys
2015-07-02 18:32 - 2012-05-27 11:20 - 01047320 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswSnx.sys
2015-06-29 05:38 - 2012-05-27 19:50 - 00770972 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2015-06-28 06:11 - 2012-05-27 12:36 - 00000000 ___HD C:\Users\Mohamed Shahrir\AppData\Roaming\vlc
2015-06-23 20:15 - 2014-12-24 07:41 - 00003886 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task
2015-06-23 13:30 - 2010-11-21 11:27 - 00300704 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
 
==================== Files in the root of some directories =======
 
2012-12-03 20:49 - 2012-12-03 20:49 - 0000288 ____H () C:\Users\Mohamed Shahrir\AppData\Roaming\.backup.dm
2015-07-20 18:41 - 2015-07-22 18:48 - 0000024 _____ () C:\Users\Mohamed Shahrir\AppData\Roaming\appdataFr25.bin
2013-07-18 13:35 - 2013-07-22 17:19 - 0007168 ____H () C:\Users\Mohamed Shahrir\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2015-01-05 18:09 - 2015-01-05 18:09 - 0015827 _____ () C:\Users\Mohamed Shahrir\AppData\Local\recently-used.xbel
2012-05-22 16:57 - 2012-05-22 17:01 - 0002454 _____ () C:\ProgramData\clear.fiSDK20.log
2012-05-22 17:00 - 2012-05-22 17:00 - 0000032 _____ () C:\ProgramData\PS.log
 
Some files in TEMP:
====================
C:\Users\Mohamed Shahrir\AppData\Local\Temp\game_setup.exe
C:\Users\Mohamed Shahrir\AppData\Local\Temp\tbuTo0.dll
C:\Users\no one\AppData\Local\Temp\DataCard_Setup64.exe
C:\Users\no one\AppData\Local\Temp\ResetDevice.exe
 
 
==================== Bamital & volsnap Check =================
 
(There is no automatic fix for files that do not pass verification.)
 
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
 
LastRegBack: 2015-07-08 04:37
 
==================== End of log ============================

  • 0

Advertisements


#2
RKinner

RKinner

    Malware Expert

  • Expert
  • 20,010 posts
  • MVP

You picked up something on 7/19.

 

 

 

 

Download the attached fixlist.txt to the same location as FRST
Run FRST and press Fix
A fix log will be generated please post that.

 

Download : ADWCleaner to your desktop.  Make sure you get the correct Download button.  Sometimes the ads on BleepingComputer will mimic the real Download button which should say: Download Now @BleepingComputer

NOTE: If using Internet Explorer and you get an alert that stops the program downloading, click on the warning and allow the download to complete.

Close  all programs, pause your anti-virus and run AdwCleaner (Vista or Win 7 => right click and Run As Administrator).

scan-results.jpg

Click on Scan  and follow the prompts. Let it run unhindered. When done, click on the Clean button, and follow the prompts. Allow the system to reboot. You will then be presented with the report. Copy & Paste this report on your next reply.

The report will be saved in the C:\AdwCleaner folder.



Junkware-Removal-Tool

Please download Junkware Removal Tool to your desktop.  Make sure you get the correct Download button.  Sometimes the ads on BleepingComputer will mimic the real Download button which should say: Download Now @Author's site

  • Pause your anti-virus.  Close all browsers.
  • Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
  • The tool will open and start scanning your system.
  • Please be patient as this can take a while to complete depending on your system's specifications.
  • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
  • Post the contents of JRT.txt into your next message.

 

 

Run FRST again, check the Additions box and then Scan.  You will get two logs.  Post them both.

 

Tonight have Avast do a boot time scan.  Make sure you set it up as follows:

 

How to do a boot-time scan while you sleep:
First mute the speakers so it won't wake you up when Windows loads.  Click on the Orange ball.  Click on Scan, then Scan for Viruses and wait a couple of minutes for the page to change.  Change Quickscan to Boot-time Scan.  Click on Settings.  Where it says Heuristic Sensitivity click on the last rectangle so that all of them are  orange and it says High.  Check both boxes.  Then change When a threat is found ... to:  Move to Chest.  OK.  Now click on Start.  Close the Avast window and then reboot.  The scan will start.  It will tell you where it will save the report.  Usually it's
C:\ProgramData\AVAST Software\Avast\report\aswBoot.txt but it might change so verify the location.  When Windows loads Click on the Orange Ball then Scan, Then Scan History (at the bottom of the page). Click on the last scan and then Detailed Report.  If it found anything then open the aswBoot.txt file and copy and paste it.  You may need to enable seeing hidden files in order to see the file so: Open the Control Panel menu and click Folder Options.
    After the new window appears select the View tab.
    Put a checkmark in the checkbox labeled Display the contents of system folders.
    Under the Hidden files and folders section select the radio button labeled Show hidden files and folders.
    Remove the checkmark from the checkbox labeled Hide file extensions for known file types.
    Remove the checkmark from the checkbox labeled Hide protected operating system files.
    Press the Apply button and then the OK button

If you can't find it then take a screen shot of the Detailed Report:
 


  • 0

#3
no_body50

no_body50

    Member

  • Topic Starter
  • Member
  • PipPip
  • 11 posts

hi here are the logs.

Attached Files


  • 0

#4
RKinner

RKinner

    Malware Expert

  • Expert
  • 20,010 posts
  • MVP

Run FRST again, check the Additions box and then Scan.  You will get two logs.  Post them both.

 

Let's see if anything got broken:

 

Right click on (My) Computer and select Manage (Continue) Then click on the arrow in front of Event Viewer. Next Click on the arrow in front of Windows Logs Right click on System and Clear Log, Clear. Repeat for Application.

Reboot.

Start, All Programs, Accessories then right click on Command Prompt and Run as Administrator.  Then type (with an Enter after each line).

sfc  /scannow

(This will check your critical system files. Does this finish without complaint?  IF it says it couldn't fix everything then:

Copy the next two lines:

findstr  /c:"[SR]"  \windows\logs\cbs\cbs.log  >  \windows\logs\cbs\junk.txt
notepad \windows\logs\cbs\junk.txt

Start, All Programs, Accessories, right click on Command Prompt and Run as Administrator, Continue.  Right click and Paste or Edit then Paste and the copied line should appear.
Hit Enter. Copy and paste the text from notepad or if it is too big, just attach the file.)


1. Please download the Event Viewer Tool by Vino Rosso
http://images.malwar...om/vino/VEW.exe
and save it to your Desktop:
2. Right-click VEW.exe and Run AS Administrator
3. Under 'Select log to query', select:

* System
4. Under 'Select type to list', select:
* Error
* Warning


Then use the 'Number of events' as follows:


1. Click the radio button for 'Number of events'
Type 20 in the 1 to 20 box
Then click the Run button.
Notepad will open with the output log.


Please post the Output log in your next reply then repeat but select Application.

Ron
 
  • 0

#5
no_body50

no_body50

    Member

  • Topic Starter
  • Member
  • PipPip
  • 11 posts

hi here are the logs

Attached Files


Edited by no_body50, 23 July 2015 - 12:33 PM.

  • 0

#6
RKinner

RKinner

    Malware Expert

  • Expert
  • 20,010 posts
  • MVP

We have one entry that keeps coming back.  Let's see if we can fake it out.  First let's cleanup your Java:

 

Clear the Java Cache by following the instructions on
http://www.java.com/...lugin_cache.xml

You do not have the latest Java.
First go into Control Panel, Add/Remove Software (XP) or Programs and Features (Vista/Win 7) and remove any old versions (which may call themselves: Java Runtime, Runtime Environment, Runtime, JRE, Java Virtual Machine, Virtual Machine, Java VM, JVM, VM, J2RE, J2SE)
I see:
Java 7 Update 55 (64-bit)
Java 7 Update 55
Java Launcher 3.201 (Standard edition)
Java SE Development Kit 7 Update 55
Java SE Development Kit 8 Update 5

Java has been very vulnerable to infection so unless you absolutely need it you should not reinstall it.

If you feel you must have Java:
Get the latest Java at:
http://www.java.com/en/

Save it to your PC then close all browsers and install it.  Do not let it install the yahoo toolbar or other foistware.
Once installed, go into Control Panel, Java, Security and set the slider to the Highest then OK.

(If you also want the 64 bit version then use the 64 bit version of IE to get it.)
 

 

Then we will run another fixlist.  Besides trying to trick the infection I am going to remove the corrupt archives that Avast found.

 

Download the attached fixlist.txt to the same location as FRST
Run FRST and press Fix
A fix log will be generated please post that.  Run FRST again, check the Additions box and then Scan.  You will get two logs.  Post them both.

 

What I am trying to do is replace the

 

AppdataFr25.bin

 

file with a directory of the same name.


  • 0

#7
no_body50

no_body50

    Member

  • Topic Starter
  • Member
  • PipPip
  • 11 posts

i have deleted all the java stuff and here are the logs 

Attached Files


  • 0

#8
RKinner

RKinner

    Malware Expert

  • Expert
  • 20,010 posts
  • MVP

Frst says it made the folder I asked it to so now I just need a FRST log to confirm that the folder is where it should be.  Are you seeing any problems? 

 

Let's check to see if anything is slowing it down:

 

Get Process Explorer

http://live.sysinter...com/procexp.exe
Save it to your desktop then run it (Vista or Win7 - right click and Run As Administrator).  

View, Select Column, check Verified Signer, OK
Options, Verify Image Signatures


Click twice on the CPU column header  to sort things by CPU usage with the big hitters at the top.  

Wait a full minute then:

File, Save As, Save.  Open the file Procexp.txt on your desktop and copy and paste the text to a reply.
 

 

 


  • 0

#9
no_body50

no_body50

    Member

  • Topic Starter
  • Member
  • PipPip
  • 11 posts

the text u wanted

 

Process CPU Private Bytes Working Set PID Description Company Name Verified Signer
System Idle Process 95.41 0 K 24 K 0
procexp64.exe 1.14 45,700 K 67,904 K 3632 Sysinternals Process Explorer Sysinternals - www.sysinternals.com (Verified) Microsoft Corporation
Interrupts 0.72 0 K 0 K n/a Hardware Interrupts and DPCs
chrome.exe 0.46 101,756 K 159,896 K 3732 Google Chrome Google Inc. (Verified) Google Inc
chrome.exe 0.40 66,112 K 103,764 K 1888 Google Chrome Google Inc. (Verified) Google Inc
dwm.exe 0.40 114,148 K 69,664 K 3564 Desktop Window Manager Microsoft Corporation (Verified) Microsoft Windows
System 0.34 804 K 38,172 K 4
chrome.exe 0.32 75,308 K 114,332 K 6680 Google Chrome Google Inc. (Verified) Google Inc
AvastSvc.exe 0.26 144,056 K 41,228 K 1812 avast! Service Avast Software s.r.o. (Verified) AVAST Software a.s.
csrss.exe 0.17 3,928 K 28,344 K 984 Client Server Runtime Process Microsoft Corporation (Verified) Microsoft Windows
chrome.exe 0.11 91,024 K 153,756 K 1432 Google Chrome Google Inc. (Verified) Google Inc
PhiMouPro.exe 0.10 1,772 K 5,152 K 4796 Monitor HID key code Chicony (No signature was present in the subject) Chicony
ePowerEvent.exe 0.03 3,128 K 6,080 K 4560 ePowerEvent Acer Incorporated (Verified) Acer Incorporated
ePowerTray.exe 0.03 7,948 K 14,060 K 3820 ePowerTray Acer Incorporated (Verified) Acer Incorporated
svchost.exe 0.02 5,816 K 10,868 K 856 Host Process for Windows Services Microsoft Corporation (Verified) Microsoft Windows
LMS.exe 0.01 2,736 K 5,120 K 3656 Local Manageability Service Intel Corporation (Verified) Intel Corporation
IAStorDataMgrSvc.exe 0.01 20,312 K 21,828 K 4936 IAStorDataSvc Intel Corporation (Verified) Intel Corporation
explorer.exe 0.01 51,416 K 70,996 K 3592 Windows Explorer Microsoft Corporation (Verified) Microsoft Windows
avastui.exe 0.01 19,292 K 21,424 K 4788 avast! Antivirus Avast Software s.r.o. (Verified) AVAST Software a.s.
services.exe 0.01 6,656 K 11,136 K 180 Services and Controller app Microsoft Corporation (Verified) Microsoft Windows
svchost.exe 0.01 6,928 K 11,344 K 5780 Host Process for Windows Services Microsoft Corporation (Verified) Microsoft Windows
NOBuAgent.exe < 0.01 3,348 K 6,648 K 2496 Norton Online Backup Service Symantec Corporation (Verified) Symantec Corporation
iusb3mon.exe < 0.01 2,080 K 5,724 K 4748 Intel® USB 3.0 Monitor Intel Corporation (Verified) Intel Corporation
dsiwmis.exe < 0.01 2,428 K 4,952 K 2208 Dritek WMI Service Dritek System Inc. (Verified) Dritek System Inc.
svchost.exe < 0.01 12,600 K 20,316 K 1224 Host Process for Windows Services Microsoft Corporation (Verified) Microsoft Windows
taskhost.exe < 0.01 15,300 K 15,800 K 3444 Host Process for Windows Tasks Microsoft Corporation (Verified) Microsoft Windows
SearchIndexer.exe < 0.01 42,476 K 25,120 K 5524 Microsoft Windows Search Indexer Microsoft Corporation (Verified) Microsoft Windows
NvBackend.exe < 0.01 24,256 K 31,200 K 3772 NVIDIA GeForce Experience Backend NVIDIA Corporation (Verified) NVIDIA Corporation
svchost.exe < 0.01 41,360 K 58,380 K 1260 Host Process for Windows Services Microsoft Corporation (Verified) Microsoft Windows
svchost.exe < 0.01 19,420 K 20,724 K 1452 Host Process for Windows Services Microsoft Corporation (Verified) Microsoft Windows
svchost.exe < 0.01 16,996 K 19,544 K 6112 Host Process for Windows Services Microsoft Corporation (Verified) Microsoft Windows
NvTmru.exe < 0.01 3,912 K 8,524 K 4272 NVIDIA NvTmru Application NVIDIA Corporation (Verified) NVIDIA Corporation
IScheduleSvc.exe < 0.01 5,980 K 11,376 K 2528 Backup Manager Module NTI Corporation (Verified) NTI Corporation
conhost.exe < 0.01 2,808 K 6,152 K 3452 Console Window Host Microsoft Corporation (Verified) Microsoft Windows
svchost.exe < 0.01 173,832 K 184,500 K 1176 Host Process for Windows Services Microsoft Corporation (Verified) Microsoft Windows
SynTPEnh.exe < 0.01 11,072 K 15,236 K 1368 Synaptics TouchPad Enhancements Synaptics Incorporated (Verified) Synaptics Incorporated
AvastVBoxSVC.exe < 0.01 9,692 K 17,600 K 5284 AvastVirtualBox Interface Avast Software (Verified) AVAST Software a.s.
wmpnetwk.exe < 0.01 4,948 K 3,828 K 2300 Windows Media Player Network Sharing Service Microsoft Corporation (Verified) Microsoft Windows
csrss.exe < 0.01 2,848 K 5,408 K 836 Client Server Runtime Process Microsoft Corporation (Verified) Microsoft Windows
nvvsvc.exe < 0.01 8,208 K 17,048 K 1568 NVIDIA Driver Helper Service, Version 331.82 NVIDIA Corporation (Verified) NVIDIA Corporation
spoolsv.exe < 0.01 8,948 K 15,932 K 2008 Spooler SubSystem App Microsoft Corporation (Verified) Microsoft Windows
wininit.exe < 0.01 2,132 K 5,168 K 964 Windows Start-Up Application Microsoft Corporation (Verified) Microsoft Windows
wuauclt.exe 3,384 K 8,248 K 3132 Windows Update Microsoft Corporation (Verified) Microsoft Windows
WmiPrvSE.exe 7,968 K 13,748 K 2680 WMI Provider Host Microsoft Corporation (Verified) Microsoft Windows
WmiPrvSE.exe 3,676 K 7,784 K 4448 WMI Provider Host Microsoft Corporation (Verified) Microsoft Windows
wlanext.exe 2,928 K 6,536 K 1828 Windows Wireless LAN 802.11 Extensibility Framework Microsoft Corporation (Verified) Microsoft Windows
winlogon.exe 4,288 K 8,784 K 460 Windows Logon Application Microsoft Corporation (Verified) Microsoft Windows
UpdaterService.exe 1,272 K 4,036 K 2456 Updater Service Acer Incorporated (Verified) Acer Incorporated
unsecapp.exe 3,556 K 7,952 K 4376 Sink to receive asynchronous callbacks for WMI client application Microsoft Corporation (Verified) Microsoft Windows
UNS.exe 4,136 K 10,548 K 5244 User Notification Service Intel Corporation (Verified) Intel Corporation
TrustedInstaller.exe 6,588 K 11,292 K 5632 Windows Modules Installer Microsoft Corporation (Verified) Microsoft Windows
taskeng.exe 4,000 K 8,536 K 3520 Task Scheduler Engine Microsoft Corporation (Verified) Microsoft Windows
SynTPHelper.exe 2,988 K 5,656 K 4180 Synaptics Pointing Device Helper Synaptics Incorporated (Verified) Synaptics Incorporated
svchost.exe 16,284 K 19,800 K 1612 Host Process for Windows Services Microsoft Corporation (Verified) Microsoft Windows
svchost.exe 62,172 K 34,868 K 3336 Host Process for Windows Services Microsoft Corporation (Verified) Microsoft Windows
svchost.exe 6,712 K 10,632 K 1040 Host Process for Windows Services Microsoft Corporation (Verified) Microsoft Windows
svchost.exe 26,908 K 25,340 K 1140 Host Process for Windows Services Microsoft Corporation (Verified) Microsoft Windows
svchost.exe 6,916 K 12,412 K 2172 Host Process for Windows Services Microsoft Corporation (Verified) Microsoft Windows
svchost.exe 4,924 K 8,976 K 2648 Host Process for Windows Services Microsoft Corporation (Verified) Microsoft Windows
svchost.exe 2,896 K 6,360 K 5748 Host Process for Windows Services Microsoft Corporation (Verified) Microsoft Windows
smss.exe 740 K 1,380 K 648 Windows Session Manager Microsoft Corporation (Verified) Microsoft Windows
RAVCpl64.exe 10,152 K 12,244 K 4116 Realtek HD Audio Manager Realtek Semiconductor (Verified) Realtek Semiconductor Corp
RAVBg64.exe 14,944 K 11,972 K 4204 HD Audio Background Process Realtek Semiconductor (Verified) Realtek Semiconductor Corp
PWRISOVM.EXE 3,360 K 6,932 K 5048 PowerISO Virtual Drive Manager Power Software Ltd (Verified) Power Software Limited
procexp.exe 2,532 K 7,500 K 4952 Sysinternals Process Explorer Sysinternals - www.sysinternals.com (Verified) Microsoft Corporation
PHILED.exe 1,892 K 6,680 K 4980 Chicony Multimedia Keyboard Driver Chicony (No signature was present in the subject) Chicony
pcee4.exe 41,552 K 38,252 K 4764 Dolby Profile Selector Dolby Laboratories Inc. (Verified) Dolby Laboratories
nvxdsync.exe 11,648 K 23,468 K 1552 NVIDIA User Experience Driver Component NVIDIA Corporation (Verified) NVIDIA Corporation
nvvsvc.exe 3,852 K 8,632 K 496 NVIDIA Driver Helper Service, Version 331.82 NVIDIA Corporation (Verified) NVIDIA Corporation
nvtray.exe 7,508 K 14,436 K 4108 NVIDIA Settings NVIDIA Corporation (Verified) NVIDIA Corporation
nvstreamsvc.exe 4,056 K 9,880 K 2572 NVIDIA Streamer Service NVIDIA Corporation (Verified) NVIDIA Corporation
nvstreamsvc.exe 6,752 K 12,212 K 3436 NVIDIA Streamer Service NVIDIA Corporation (Verified) NVIDIA Corporation
NvNetworkService.exe 1,868 K 5,524 K 2548 NVIDIA Network Service NVIDIA Corporation (Verified) NVIDIA Corporation
ngservice.exe 1,752 K 4,184 K 6056 avast! NG service AVAST Software (Verified) AVAST Software a.s.
ModLEDKey.exe 1,320 K 840 K 3724 AccessL Chicony (No signature was present in the subject) Chicony
MMDx64Fx.exe 6,048 K 11,336 K 4804 MMDx64Fx Application Dritek System Inc. (Verified) Dritek System Inc.
lsm.exe 3,252 K 5,004 K 172 Local Session Manager Service Microsoft Corporation (Verified) Microsoft Windows
lsass.exe 7,236 K 15,120 K 200 Local Security Authority Process Microsoft Corporation (Verified) Microsoft Windows
LMutilps32.exe 2,452 K 6,836 K 2256 Launch Manager utility process Dritek System Inc. (Verified) Dritek System Inc.
LManager.exe 11,812 K 15,004 K 4728 Launch Manager Dritek System Inc. (Verified) Dritek System Inc.
Jhi_service.exe 2,008 K 5,680 K 2424 Intel® Dynamic Application Loader Host Interface Intel Corporation (Verified) Intel Corporation
iuEmailOutlookAgent.exe 14,268 K 16,780 K 1804 iuEmailOutlookAgent (Verified) Acer Incorporated
iuBrowserIEAgent.exe 14,312 K 17,312 K 4136 iuBrowserIEAgent (Verified) Acer Incorporated
IntelMeFWService.exe 1,184 K 3,768 K 2396 (Verified) Intel Corporation
igfxsrvc.exe 4,512 K 9,052 K 3800 igfxsrvc Module Intel Corporation (Verified) Intel Corporation
igfxpers.exe 4,744 K 9,680 K 1584 persistence Module Intel Corporation (Verified) Intel Corporation
igfxext.exe 3,492 K 7,432 K 4320 igfxext Module Intel Corporation (Verified) Intel Corporation
hkcmd.exe 4,480 K 8,828 K 3804 hkcmd Module Intel Corporation (Verified) Intel Corporation
HeciServer.exe 2,524 K 6,272 K 2356 Intel® Capability Licensing Service Interface Intel® Corporation (Verified) Intel® Upgrade Service
GWX.exe 4,460 K 1,112 K 3512 GWX Microsoft Corporation (Verified) Microsoft Windows
GREGsvc.exe 1,128 K 3,568 K 2316 Global Registration Service Acer Incorporated (Verified) Acer Incorporated
ePowerSvc.exe 3,908 K 8,216 K 2248 ePowerSvc Acer Incorporated (Verified) Acer Incorporated
dllhost.exe 3,516 K 8,572 K 4592 COM Surrogate Microsoft Corporation (Verified) Microsoft Windows
dllhost.exe 1,596 K 4,828 K 6940 COM Surrogate Microsoft Corporation (Verified) Microsoft Windows
DivXUpdate.exe 8,684 K 18,328 K 4772 DivX Update (Verified) DivX
DeviceDetector.exe 2,880 K 1,916 K 508 MediaEspresso DeviceDetector CyberLink (Certificate expired) CyberLink
conhost.exe 1,476 K 3,284 K 1836 Console Window Host Microsoft Corporation (Verified) Microsoft Windows
conhost.exe 2,032 K 4,288 K 2640 Console Window Host Microsoft Corporation (Verified) Microsoft Windows
conhost.exe 2,036 K 4,284 K 3736 Console Window Host Microsoft Corporation (Verified) Microsoft Windows
chrome.exe 103,324 K 149,868 K 4656 Google Chrome Google Inc. (Verified) Google Inc
chrome.exe 20,024 K 61,308 K 4336 Google Chrome Google Inc. (Verified) Google Inc
chrome.exe 27,488 K 65,620 K 5620 Google Chrome Google Inc. (Verified) Google Inc
chrome.exe 27,960 K 65,668 K 3908 Google Chrome Google Inc. (Verified) Google Inc
chrome.exe 30,320 K 67,764 K 5804 Google Chrome Google Inc. (Verified) Google Inc
chrome.exe 31,836 K 68,824 K 4632 Google Chrome Google Inc. (Verified) Google Inc
BackupManagerTray.exe 4,928 K 13,300 K 4716 Acer Backup Manager NTI Corporation (Verified) NTI Corporation
audiodg.exe 16,772 K 18,124 K 6848 Windows Audio Device Graph Isolation Microsoft Corporation (Verified) Microsoft Windows
Ath_WlanAgent.exe 1,392 K 3,976 K 2700 Atheros Coex Service Application Atheros (Certificate expired) Atheros
armsvc.exe 1,332 K 4,124 K 2052 Adobe Acrobat Update Service Adobe Systems Incorporated (Verified) Adobe Systems
AdobeARM.exe 4,216 K 1,268 K 6800 Adobe Reader and Acrobat Manager Adobe Systems Incorporated (Verified) Adobe Systems
AdminService.exe 2,808 K 5,924 K 2124 AdminService Application Qualcomm Atheros Commnucations (Certificate expired) Qualcomm Atheros Commnucations
 

Attached Files

  • Attached File  FRST.txt   46.61KB   27 downloads

  • 0

#10
RKinner

RKinner

    Malware Expert

  • Expert
  • 20,010 posts
  • MVP

It still shows up!  Try the procedure recommended here:

 

https://forums.malwa...od/#entry973461


  • 0

Advertisements


#11
no_body50

no_body50

    Member

  • Topic Starter
  • Member
  • PipPip
  • 11 posts

not sure if i send the correct one earlier. this is the latest log after deleting and reinstalling chrome

Attached Files

  • Attached File  FRST.txt   49.28KB   34 downloads

Edited by no_body50, 25 July 2015 - 01:14 AM.

  • 0

#12
RKinner

RKinner

    Malware Expert

  • Expert
  • 20,010 posts
  • MVP

Chrome looks better but the file is still present.

 

2015-07-23 06:39 - 2015-07-25 14:46 - 0000024 _____ () C:\Users\Mohamed Shahrir\AppData\Roaming\appdataFr25.bin

 

Copy the next 4 lines
 

ren \Users\Mohamed Shahrir\AppData\Roaming\appdataFr25.bin \Users\Mohamed Shahrir\AppData\Roaming\appdataFr25.bad

mkdir \Users\Mohamed Shahrir\AppData\Roaming\appdataFr25.bin

dir \Users\Mohamed Shahrir\AppData\Roaming > \junk.txt

notepad \junk.txt

 

 

Start, All Programs, Accessories, right click on Command Prompt and Run as Administrator, Continue.  Right click and Paste or Edit then Paste and the copied line should appear.
Hit Enter if notepad does not open.  Copy and paste the text from notepad into a reply.  Close notepad.  Close the Command Window.
 

 

 


  • 0

#13
no_body50

no_body50

    Member

  • Topic Starter
  • Member
  • PipPip
  • 11 posts
here as you requested
 
 Volume in drive C is Acer
 Volume Serial Number is 90FB-6BD8
 
 Directory of C:\Users\Mohamed
 
25/07/2015  12:18 AM    <DIR>          .
25/07/2015  12:18 AM    <DIR>          ..
               0 File(s)              0 bytes
 
 Directory of C:\Users\Mohamed Shahrir\Shahrir\AppData\Roaming
 
26/07/2015  12:25 AM    <DIR>          .
26/07/2015  12:25 AM    <DIR>          ..
26/07/2015  12:25 AM    <DIR>          appdataFr25.bin
               0 File(s)              0 bytes
               3 Dir(s)  155,357,130,752 bytes free

  • 0

#14
no_body50

no_body50

    Member

  • Topic Starter
  • Member
  • PipPip
  • 11 posts

I try to find the file appdataFr25.bin u mentioned and managed to delete it in safe mode.i search using recommendation by from the internet.

%program files%\common files\system\AppdataFr25.bin.dll
%program files(x86)%\AppdataFr25.bin uninstall\
%programData%\AppdataFr25.bin.exe\
%appdata%\roaming\[AppdataFr25.bin].exe or folder
%Windows%\system32\driver\AppdataFr25.bin.sys

%users%\default\appdata\local\AppdataFr25.bin.log

this is the latest log after the delete. 

Attached Files

  • Attached File  FRST.txt   49.31KB   41 downloads

Edited by no_body50, 25 July 2015 - 10:51 AM.

  • 0

#15
RKinner

RKinner

    Malware Expert

  • Expert
  • 20,010 posts
  • MVP

OK.  It looks like you also deleted my folder of the some name but if it doesn't come back on a reboot I guess it's OK.


  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP