[no_body50]

Hey, i recently opened a fake picture from one of my dota chats. i already deleted the file in safe mode and scan using malwarebytes. However, i am still unsure if my laptop is still infected. As i am starting sch soon, i trying to ensure that my laptop is totally clean. My computer is also constantly auto update and chrome occasionally crashes and open again.

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:20-07-2015

Ran by Mohamed Shahrir (administrator) on MOHAMED_SHAHRIR on 22-07-2015 19:14:34

Running from C:\Users\Mohamed Shahrir\Downloads

Loaded Profiles: Mohamed Shahrir (Available Profiles: Mohamed Shahrir & no one & Guest)

Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: English (United States)

Internet Explorer Version 11 (Default browser: Chrome)

Boot Mode: Safe Mode (with Networking)

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/

 

==================== Processes (Whitelisted) =================

 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

 

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

(Avast Software s.r.o.) C:\Program Files\AVAST Software\Avast\avastui.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

 

 

==================== Registry (Whitelisted) ==================

 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

 

HKLM\...\Run: [InstantUpdate] => C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuDaemon.exe [124520 2012-04-07] ()

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2868496 2012-02-14] (Synaptics Incorporated)

HKLM\...\Run: [Power Management] => C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [1829768 2012-02-08] (Acer Incorporated)

HKLM\...\Run: [IntelTBRunOnce] => wscript.exe //b //nologo "C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs"

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12446824 2012-01-31] (Realtek Semiconductor)

HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1156712 2011-11-15] (Realtek Semiconductor)

HKLM\...\Run: [Nvtmru] => C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe [1028384 2013-11-14] (NVIDIA Corporation)

HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart

HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2273056 2013-11-30] (NVIDIA Corporation)

HKLM\...\Run: [BtPreLoad] => "C:\Program Files (x86)\Bluetooth Suite\BtPreLoad.exe"

HKLM-x32\...\Run: [Norton Online Backup] => C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe

HKLM-x32\...\Run: [BackupManagerTray] => C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe [296984 2012-01-06] (NTI Corporation)

HKLM-x32\...\Run: [LManager] => C:\Program Files (x86)\Launch Manager\LManager.exe [1106512 2012-03-02] (Dritek System Inc.)

HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-01-27] (Intel Corporation)

HKLM-x32\...\Run: [Dolby Home Theater v4] => C:\Dolby PCEE4\pcee4.exe [506712 2011-06-01] (Dolby Laboratories Inc.)

HKLM-x32\...\Run: [DivXUpdate] => C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1259376 2011-07-29] ()

HKLM-x32\...\Run: [APSDaemon] => "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"

HKLM-x32\...\Run: [QuickTime Task] => "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime

HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5515496 2015-07-02] (Avast Software s.r.o.)

HKLM-x32\...\Run: [PHIDriver] => C:\Windows\PhiMouPro.exe [57344 2007-06-22] (Chicony)

HKLM-x32\...\Run: [PHILED] => C:\Windows\PHILED.exe [384512 2007-05-16] (Chicony)

HKLM-x32\...\Run: [LchDrv] => C:\Windows\LchDrvKey.exe [36864 2007-03-28] ()

HKLM-x32\...\Run: [AdobeCS4ServiceManager] => "C:\Program Files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin

HKLM-x32\...\Run: [BCSSync] => "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" /DelayServices

HKLM-x32\...\Run: [PWRISOVM.EXE] => C:\Program Files\PowerISO\PWRISOVM.EXE [408888 2015-06-08] (Power Software Ltd)

Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)

HKLM\...\Policies\Explorer: [NoControlPanel] 0

HKU\S-1-5-21-2809493940-1832043367-3520061379-1001\...\Run: [GoogleDriveSync] => "C:\Program Files (x86)\Google\Drive\googledrivesync.exe" /autostart

HKU\S-1-5-21-2809493940-1832043367-3520061379-1001\...\Run: [iLivid] => "C:\Users\Mohamed Shahrir\AppData\Local\iLivid\iLivid.exe" -autorun

HKU\S-1-5-21-2809493940-1832043367-3520061379-1001\...\Run: [DriverUpdaterPro] => C:\Program Files (x86)\oTweak\DriverUpdaterPro\DriverUpdaterPro.exe /ot /as /ss

HKU\S-1-5-21-2809493940-1832043367-3520061379-1001\...\Run: [Steam] => "C:\Program Files (x86)\Steam\steam.exe" -silent

HKU\S-1-5-21-2809493940-1832043367-3520061379-1001\...\Run: [RESTART_STICKY_NOTES] => C:\Windows\System32\StikyNot.exe [427520 2009-07-14] (Microsoft Corporation)

IFEO\bitguard.exe: [Debugger] tasklist.exe

IFEO\bprotect.exe: [Debugger] tasklist.exe

IFEO\bpsvc.exe: [Debugger] tasklist.exe

IFEO\browserdefender.exe: [Debugger] tasklist.exe

IFEO\browserprotect.exe: [Debugger] tasklist.exe

IFEO\browsersafeguard.exe: [Debugger] tasklist.exe

IFEO\dprotectsvc.exe: [Debugger] tasklist.exe

IFEO\jumpflip: [Debugger] tasklist.exe

IFEO\protectedsearch.exe: [Debugger] tasklist.exe

IFEO\searchinstaller.exe: [Debugger] tasklist.exe

IFEO\searchprotection.exe: [Debugger] tasklist.exe

IFEO\searchprotector.exe: [Debugger] tasklist.exe

IFEO\searchsettings.exe: [Debugger] tasklist.exe

IFEO\searchsettings64.exe: [Debugger] tasklist.exe

IFEO\snapdo.exe: [Debugger] tasklist.exe

IFEO\stinst32.exe: [Debugger] tasklist.exe

IFEO\stinst64.exe: [Debugger] tasklist.exe

IFEO\umbrella.exe: [Debugger] tasklist.exe

IFEO\utiljumpflip.exe: [Debugger] tasklist.exe

IFEO\volaro: [Debugger] tasklist.exe

IFEO\vonteera: [Debugger] tasklist.exe

IFEO\websteroids.exe: [Debugger] tasklist.exe

IFEO\websteroidsservice.exe: [Debugger] tasklist.exe

Startup: C:\Users\Mohamed Shahrir\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MagicDisc.lnk [2015-07-18]

ShortcutTarget: MagicDisc.lnk -> C:\Program Files (x86)\MagicDisc\MagicDisc.exe (No File)

Startup: C:\Users\no one\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Intel® Turbo Boost Technology Monitor 2.0.lnk [2012-11-19]

ShortcutTarget: Intel® Turbo Boost Technology Monitor 2.0.lnk -> C:\Program Files\Intel\TurboBoost\SignalIslandUi.exe (Intel® Corporation)

ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2015-07-02] (Avast Software s.r.o.)

ShellIconOverlayIdentifiers: [GDriveSharedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} =>  No File

ShellIconOverlayIdentifiers-x32: [Groove Explorer Icon Overlay 1 (GFS Unread Stub)] -> {99FD978C-D287-4F50-827F-B2C658EDA8E7} => C:\PROGRA~2\MICROS~4\Office14\GROOVEEX.DLL No File

ShellIconOverlayIdentifiers-x32: [Groove Explorer Icon Overlay 2 (GFS Stub)] -> {AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} => C:\PROGRA~2\MICROS~4\Office14\GROOVEEX.DLL No File

ShellIconOverlayIdentifiers-x32: [Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)] -> {920E6DB1-9907-4370-B3A0-BAFC03D81399} => C:\PROGRA~2\MICROS~4\Office14\GROOVEEX.DLL No File

ShellIconOverlayIdentifiers-x32: [Groove Explorer Icon Overlay 3 (GFS Folder)] -> {16F3DD56-1AF5-4347-846D-7C10C4192619} => C:\PROGRA~2\MICROS~4\Office14\GROOVEEX.DLL No File

ShellIconOverlayIdentifiers-x32: [Groove Explorer Icon Overlay 4 (GFS Unread Mark)] -> {2916C86E-86A6-43FE-8112-43ABE6BF8DCC} => C:\PROGRA~2\MICROS~4\Office14\GROOVEEX.DLL No File

GroupPolicyUsers\S-1-5-21-2809493940-1832043367-3520061379-1004\User: Group Policy Restriction detected <======= ATTENTION

CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

 

==================== Internet (Whitelisted) ====================

 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

 

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank

HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.omniboxes...q={searchTerms}

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://www.omniboxes...q={searchTerms}

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.omniboxes...q={searchTerms}

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.omniboxes...q={searchTerms}

HKU\S-1-5-21-2809493940-1832043367-3520061379-1001\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

URLSearchHook: HKU\S-1-5-21-2809493940-1832043367-3520061379-1001 - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll No File

URLSearchHook: HKU\S-1-5-21-2809493940-1832043367-3520061379-1001 - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll No File

SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/...rc=IE-SearchBox

SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/...rc=IE-SearchBox

SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/...rc=IE-SearchBox

SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/...rc=IE-SearchBox

SearchScopes: HKU\S-1-5-21-2809493940-1832043367-3520061379-1001 -> DefaultScope {CFFA3A58-2D5E-4CA9-826F-2BCDB232D585} URL = http://search.condui...CT3220468&SSPV=

SearchScopes: HKU\S-1-5-21-2809493940-1832043367-3520061379-1001 -> {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = http://www.buenosear...414_16&tsp=5239

SearchScopes: HKU\S-1-5-21-2809493940-1832043367-3520061379-1001 -> {4B39CEAE-05BF-46EE-B05F-3302A17876FA} URL = http://sg.search.yah...p={searchTerms}

SearchScopes: HKU\S-1-5-21-2809493940-1832043367-3520061379-1001 -> {CFFA3A58-2D5E-4CA9-826F-2BCDB232D585} URL = http://search.condui...CT3220468&SSPV=

BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL [2010-01-21] (Microsoft Corporation)

BHO: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll [2014-05-07] (Oracle Corporation)

BHO: CIESpeechBHO Class -> {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} -> C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll No File

BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2015-07-02] (Avast Software s.r.o.)

BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-29] (Microsoft Corp.)

BHO: McAfee SiteAdvisor BHO -> {B164E929-A1B6-4A06-B104-2CD0E90A88FF} -> c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll No File

BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2010-01-16] (Microsoft Corporation)

BHO: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll [2014-05-07] (Oracle Corporation)

BHO-x32: Babylon toolbar helper -> {2EECD738-5844-4a99-B4B6-146BF802613B} -> C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.6.9.12\bh\BabylonToolbar.dll No File

BHO-x32: DivX Plus Web Player HTML5 <video> -> {326E768D-4182-46FD-9C16-1449A49795F4} -> C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll No File

BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\PROGRA~2\MICROS~4\Office14\GROOVEEX.DLL No File

BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll No File

BHO-x32: CIESpeechBHO Class -> {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} -> C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll No File

BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2015-07-02] (Avast Software s.r.o.)

BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll No File

BHO-x32: McAfee SiteAdvisor BHO -> {B164E929-A1B6-4A06-B104-2CD0E90A88FF} -> c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll No File

BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\PROGRA~2\MICROS~4\Office14\URLREDIR.DLL No File

BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll No File

Toolbar: HKLM - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll No File

Toolbar: HKLM - avast! WebRep - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} -  No File

Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} -  No File

Toolbar: HKLM-x32 - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll No File

Toolbar: HKLM-x32 - Babylon Toolbar - {98889811-442D-49dd-99D7-DC866BE87DBC} - C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.6.9.12\BabylonToolbarTlbr.dll No File

Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll No File

Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.dll No File

Handler: ms-help - {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files (x86)\Common Files\Microsoft Shared\Help\hxds.dll No File

Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.dll No File

Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll No File

Handler: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files (x86)\Windows Live\Mail\mailcomm.dll No File

Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll No File

ShellExecuteHooks-x32: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MICROS~4\Office14\GROOVEEX.DLL No File [ ]

Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

Tcpip\..\Interfaces\{181AA8B6-6680-4B70-B229-0196AF75AB1D}: [DhcpNameServer] 202.65.247.31 202.65.244.32

Tcpip\..\Interfaces\{2C6A75A3-244E-4D4F-A8AD-F343F7807266}: [DhcpNameServer] 192.168.1.1

Tcpip\..\Interfaces\{5F405688-8B73-40F0-8134-38DB73DB0E5B}: [DhcpNameServer] 192.168.42.129

Tcpip\..\Interfaces\{81C479A7-2322-448A-A7FD-291EA7CC74FD}: [DhcpNameServer] 192.168.0.1

Tcpip\..\Interfaces\{F9284998-D12F-408A-A3E9-F65004F594F8}: [DhcpNameServer] 202.65.244.31 202.65.247.32

StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe http://www.omniboxes...59E6AW0AE6AW0AX

 

FireFox:

========

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_70.dll [2014-03-01] ()

FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll [2011-06-21] (DivX, LLC.)

FF Plugin: @java.com/DTPlugin,version=10.55.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll [2014-05-07] (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=10.55.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll [2014-05-07] (Oracle Corporation)

FF Plugin: @microsoft.com/GENUINE -> disabled No File

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-16] ( Microsoft Corporation)

FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_70.dll [2014-03-01] ()

FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1167637.dll [2012-08-09] (Adobe Systems, Inc.)

FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll No File

FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll No File

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59 -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll No File

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll No File

FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll No File

FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll No File

FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.40416.0\npctrl.dll No File

FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~4\Office14\NPAUTHZ.DLL No File

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL No File

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll No File

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll No File

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-16] (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-16] (Google Inc.)

FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll No File

FF Plugin HKU\S-1-5-21-2809493940-1832043367-3520061379-1001: ubisoft.com/uplaypc -> C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll No File

FF HKLM-x32\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files (x86)\McAfee\SiteAdvisor

FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5

FF HKLM-x32\...\Firefox\Extensions: [[email protected]] - C:\Program Files\AVAST Software\Avast\WebRep\FF

FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2012-05-27]

 

Chrome: 

=======

CHR dev: Chrome dev build detected! <======= ATTENTION

CHR Profile: C:\Users\Mohamed Shahrir\AppData\Local\Google\Chrome\User Data\Default

CHR Extension: (Wookmark) - C:\Users\Mohamed Shahrir\AppData\Local\Google\Chrome\User Data\Default\Extensions\baaofnaeiakbkdgmheeglhmailndkkni [2015-07-19]

CHR Extension: (uTorrentControl_v2) - C:\Users\Mohamed Shahrir\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejpbbhjlbipncjklfjjaedaieimbmdda [2014-06-01]

CHR Extension: (SiteAdvisor) - C:\Users\Mohamed Shahrir\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho [2014-11-25]

CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Mohamed Shahrir\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-14]

CHR Extension: (Google Wallet) - C:\Users\Mohamed Shahrir\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-01]

CHR HKU\S-1-5-21-2809493940-1832043367-3520061379-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [apdfllckaahabafndbhieahigkjlhalf] - C:\Users\MOHAME~1\AppData\Local\Google\Drive\apdfllckaahabafndbhieahigkjlhalf_live.crx [Not Found]

CHR HKU\S-1-5-21-2809493940-1832043367-3520061379-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [ejpbbhjlbipncjklfjjaedaieimbmdda] - C:\Users\Mohamed Shahrir\AppData\Local\CRE\ejpbbhjlbipncjklfjjaedaieimbmdda.crx [2012-08-26]

CHR HKLM-x32\...\Chrome\Extension: [bpegkgagfojjbcpkihigfmkojdmmimdf] - No Path Or update_url value

CHR HKLM-x32\...\Chrome\Extension: [ehgldbbpchgpcfagfpfjgoomddhccfgh] - No Path Or update_url value

CHR HKLM-x32\...\Chrome\Extension: [ejpbbhjlbipncjklfjjaedaieimbmdda] - C:\Users\Mohamed Shahrir\AppData\Local\CRE\ejpbbhjlbipncjklfjjaedaieimbmdda.crx [2012-08-26]

CHR HKLM-x32\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - http://clients2.goog...ice/update2/crx

CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-07-02]

CHR HKLM-x32\...\Chrome\Extension: [nneajnkjbffgblleaoojgaacokifdkhm] - C:\Program Files (x86)\DivX\DivX Plus Web Player\chrome\DivXHTML5\DivXHTML5.crx [Not Found]

 

==================== Services (Whitelisted) =================

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

S2 7f0567dd; c:\Program Files (x86)\SeekMarkers\SeekMarkers.dll [2307584 2015-07-19] () [File not signed]

S2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [220288 2012-09-29] (Qualcomm Atheros Commnucations) [File not signed]

S2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [343336 2015-07-02] (Avast Software s.r.o.)

S3 AvastVBoxSvc; C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe [4034896 2015-07-02] (Avast Software)

S2 Intel® ME Service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\FWService\IntelMeFWService.exe [128280 2012-02-07] ()

S2 jhi_service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [161560 2012-02-07] (Intel Corporation)

S2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2804568 2010-06-02] (Symantec Corporation)

S2 NTI IScheduleSvc; C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [256536 2012-01-06] (NTI Corporation)

S2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1370912 2013-11-30] (NVIDIA Corporation)

S2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [15128352 2013-11-30] (NVIDIA Corporation)

R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

S2 ZAtheros Wlan Agent; C:\Program Files (x86)\Atheros\Ath_WlanAgent.exe [76960 2012-02-27] (Atheros) [File not signed]

S3 FLEXnet Licensing Service; "C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe" [X]

S2 MBAMService; "C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe" [X]

S2 McAfee SiteAdvisor Service; "C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe" /McCoreSvc [X]

S3 Microsoft SharePoint Workspace Audit Service; "C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice [X]

S3 ose; "C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE" [X]

 

==================== Drivers (Whitelisted) ====================

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

S2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29168 2015-07-02] ()

S2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [89944 2015-07-02] (Avast Software s.r.o.)

R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93528 2015-07-02] (Avast Software s.r.o.)

S0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65736 2015-07-02] ()

S1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1047320 2015-07-02] (Avast Software s.r.o.)

S1 aswSP; C:\Windows\system32\drivers\aswSP.sys [442264 2015-07-02] (Avast Software s.r.o.)

S2 aswStm; C:\Windows\system32\drivers\aswStm.sys [137288 2015-07-02] (Avast Software s.r.o.)

S0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [272248 2015-07-02] ()

S3 BTATH_LWFLT; C:\Windows\System32\DRIVERS\btath_lwflt.sys [77464 2012-09-29] (Qualcomm Atheros)

S3 ewusbnet; C:\Windows\System32\DRIVERS\ewusbnet.sys [132608 2009-07-13] (Huawei Technologies Co., Ltd.)

S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-04-14] (Malwarebytes Corporation)

S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [136408 2015-06-20] (Malwarebytes Corporation)

S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-04-14] (Malwarebytes Corporation)

S2 npf; C:\Windows\System32\drivers\npf.sys [35344 2011-02-12] (CACE Technologies, Inc.)

S3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-10-31] (NVIDIA Corporation)

R3 SmbDrv; C:\Windows\System32\DRIVERS\Smb_driver.sys [22800 2012-02-14] (Synaptics Incorporated)

S2 VBoxAswDrv; C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [273824 2015-07-02] (Avast Software)

S3 hwusbdev; system32\DRIVERS\ewusbdev.sys [X]

S3 X6va029; \??\C:\Windows\SysWOW64\Drivers\X6va029 [X]

 

==================== NetSvcs (Whitelisted) ===================

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

 

==================== One Month Created files and folders ========

 

(If an entry is included in the fixlist, the file/folder will be moved.)

 

2015-07-22 19:14 - 2015-07-22 19:15 - 00027679 _____ C:\Users\Mohamed Shahrir\Downloads\FRST.txt

2015-07-22 19:14 - 2015-07-22 19:14 - 00000000 ____D C:\FRST

2015-07-22 19:13 - 2015-07-22 19:13 - 02135552 _____ (Farbar) C:\Users\Mohamed Shahrir\Downloads\FRST64.exe

2015-07-22 18:49 - 2015-07-22 18:49 - 00000000 ____D C:\Users\Default\AppData\Roaming\AVAST Software

2015-07-22 18:49 - 2015-07-22 18:49 - 00000000 ____D C:\Users\Default User\AppData\Roaming\AVAST Software

2015-07-21 19:30 - 2015-07-15 11:19 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll

2015-07-21 19:30 - 2015-07-15 11:19 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll

2015-07-21 19:30 - 2015-07-15 11:19 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll

2015-07-21 19:30 - 2015-07-15 11:19 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll

2015-07-21 19:30 - 2015-07-15 10:55 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll

2015-07-21 19:30 - 2015-07-15 10:55 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll

2015-07-21 19:30 - 2015-07-15 10:55 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll

2015-07-21 19:30 - 2015-07-15 10:54 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll

2015-07-21 19:30 - 2015-07-15 09:59 - 00372224 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll

2015-07-21 19:30 - 2015-07-15 09:52 - 00299008 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll

2015-07-20 18:41 - 2015-07-22 18:48 - 00000024 _____ C:\Users\Mohamed Shahrir\AppData\Roaming\appdataFr25.bin

2015-07-19 13:03 - 2015-07-19 13:03 - 00000000 ____D C:\Program Files (x86)\Wookmark

2015-07-19 13:03 - 2015-07-19 13:03 - 00000000 ____D C:\Program Files (x86)\MOnsonRReevoenue

2015-07-19 13:03 - 2015-07-19 13:03 - 00000000 ____D C:\Program Files (x86)\MonsonReVenuE

2015-07-19 13:02 - 2015-07-19 13:03 - 00000000 ____D C:\ProgramData\7568694732754112047

2015-07-19 13:02 - 2015-07-19 13:02 - 00000000 ____D C:\Program Files (x86)\MonsOnReevenue

2015-07-19 12:44 - 2015-07-19 15:04 - 00000000 ____D C:\Users\Mohamed Shahrir\Downloads\La Parabola di Stanlio(Eng-Ita-Esp-Rus-Fra)

2015-07-19 12:43 - 2015-07-19 12:43 - 00118310 _____ C:\Users\Mohamed Shahrir\Downloads\The_Stanley_Parable[Eng-Sub_Multi5-Fiction_Interattiva]TNT_Village_[Isohunt.to].torrent

2015-07-19 12:43 - 2015-07-19 12:43 - 00000000 ____D C:\Users\Mohamed Shahrir\AppData\Roaming\Steam

2015-07-19 12:41 - 2015-07-19 12:41 - 00000000 ____D C:\Program Files (x86)\SeekMarkers

2015-07-19 12:40 - 2015-07-19 12:41 - 00000000 ____D C:\Program Files (x86)\The Magic Circle

2015-07-19 11:53 - 2015-07-19 11:53 - 00000000 ____D C:\Users\Mohamed Shahrir\Downloads\The Magic Circle v4.6.5

2015-07-19 11:52 - 2015-07-19 11:52 - 00016717 _____ C:\Users\Mohamed Shahrir\Downloads\The_Magic_Circle_v4.6.5_[Isohunt.to].torrent

2015-07-19 00:01 - 2015-07-19 08:30 - 00000000 ____D C:\Program Files (x86)\DeadCore

2015-07-18 23:54 - 2015-07-18 23:54 - 00000776 _____ C:\Users\Public\Desktop\PowerISO.lnk

2015-07-18 23:54 - 2015-07-18 23:54 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PowerISO

2015-07-18 23:54 - 2015-07-18 23:54 - 00000000 ____D C:\Program Files\PowerISO

2015-07-18 23:53 - 2015-07-18 23:54 - 04153323 _____ C:\Users\Mohamed Shahrir\Downloads\PowerISO6-x64.jse

2015-07-18 23:52 - 2015-07-18 23:52 - 00000921 _____ C:\Users\no one\Desktop\MagicDisc.lnk

2015-07-18 23:52 - 2015-07-18 23:52 - 00000921 _____ C:\Users\Guest\Desktop\MagicDisc.lnk

2015-07-18 23:52 - 2009-02-24 18:35 - 00255552 _____ (MagicISO, Inc.) C:\Windows\SysWOW64\Drivers\mcdbus.sys

2015-07-18 14:43 - 2015-07-18 14:43 - 00139362 _____ C:\Users\Mohamed Shahrir\Downloads\DeadCore-RELOADED (1).torrent

2015-07-18 14:43 - 2015-07-18 14:43 - 00018467 _____ C:\Users\Mohamed Shahrir\Downloads\DeadCore-RELOADED.torrent

2015-07-18 14:41 - 2015-07-18 14:41 - 00015632 _____ C:\Users\Mohamed Shahrir\Downloads\Contagion.Build.5688-REVOLT.torrent

2015-07-15 18:39 - 2015-07-10 01:58 - 03154944 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll

2015-07-15 18:39 - 2015-07-10 01:58 - 02603008 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll

2015-07-15 18:39 - 2015-07-10 01:58 - 00696320 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll

2015-07-15 18:39 - 2015-07-10 01:58 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll

2015-07-15 18:39 - 2015-07-10 01:58 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe

2015-07-15 18:39 - 2015-07-10 01:58 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll

2015-07-15 18:39 - 2015-07-10 01:58 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll

2015-07-15 18:39 - 2015-07-10 01:58 - 00037888 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll

2015-07-15 18:39 - 2015-07-10 01:58 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe

2015-07-15 18:39 - 2015-07-10 01:58 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll

2015-07-15 18:39 - 2015-07-10 01:58 - 00012288 _____ (Microsoft Corporation) C:\Windows\system32\wu.upgrade.ps.dll

2015-07-15 18:39 - 2015-07-10 01:43 - 00566784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll

2015-07-15 18:39 - 2015-07-10 01:43 - 00173056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll

2015-07-15 18:39 - 2015-07-10 01:43 - 00093184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll

2015-07-15 18:39 - 2015-07-10 01:43 - 00030208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll

2015-07-15 18:39 - 2015-07-10 01:42 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe

2015-07-15 18:39 - 2015-07-05 02:07 - 02087424 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll

2015-07-15 18:39 - 2015-07-05 01:48 - 01414656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ole32.dll

2015-07-15 18:39 - 2015-07-03 05:21 - 19877376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2015-07-15 18:39 - 2015-07-03 05:08 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2015-07-15 18:39 - 2015-07-03 04:50 - 02279424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2015-07-15 18:39 - 2015-07-03 04:49 - 25193984 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2015-07-15 18:39 - 2015-07-03 04:46 - 00479232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2015-07-15 18:39 - 2015-07-03 04:40 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2015-07-15 18:39 - 2015-07-03 04:23 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2015-07-15 18:39 - 2015-07-03 04:19 - 12855296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2015-07-15 18:39 - 2015-07-03 04:12 - 00615936 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2015-07-15 18:39 - 2015-07-03 03:55 - 01310720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2015-07-15 18:39 - 2015-07-03 03:20 - 14453248 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2015-07-15 18:39 - 2015-07-03 02:59 - 01545728 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2015-07-15 18:39 - 2015-06-27 10:47 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2015-07-15 18:39 - 2015-06-27 10:43 - 05923840 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2015-07-15 18:39 - 2015-06-27 09:58 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll

2015-07-15 18:39 - 2015-06-27 09:39 - 04520448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2015-07-15 18:39 - 2015-06-26 02:09 - 00389832 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll

2015-07-15 18:39 - 2015-06-26 01:43 - 00342736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll

2015-07-15 18:39 - 2015-06-25 16:57 - 03207168 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2015-07-15 18:39 - 2015-06-21 04:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll

2015-07-15 18:39 - 2015-06-21 03:50 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2015-07-15 18:39 - 2015-06-21 03:49 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2015-07-15 18:39 - 2015-06-21 03:49 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec

2015-07-15 18:39 - 2015-06-21 03:49 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll

2015-07-15 18:39 - 2015-06-21 03:48 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll

2015-07-15 18:39 - 2015-06-21 03:40 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2015-07-15 18:39 - 2015-06-21 03:39 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2015-07-15 18:39 - 2015-06-21 03:34 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll

2015-07-15 18:39 - 2015-06-21 03:34 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2015-07-15 18:39 - 2015-06-21 03:34 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe

2015-07-15 18:39 - 2015-06-21 03:25 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe

2015-07-15 18:39 - 2015-06-21 03:21 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll

2015-07-15 18:39 - 2015-06-21 03:13 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll

2015-07-15 18:39 - 2015-06-21 03:08 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2015-07-15 18:39 - 2015-06-21 03:07 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2015-07-15 18:39 - 2015-06-21 03:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2015-07-15 18:39 - 2015-06-21 02:48 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2015-07-15 18:39 - 2015-06-21 02:48 - 00720384 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2015-07-15 18:39 - 2015-06-21 02:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2015-07-15 18:39 - 2015-06-21 02:46 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll

2015-07-15 18:39 - 2015-06-21 02:26 - 02427392 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2015-07-15 18:39 - 2015-06-21 02:02 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2015-07-15 18:39 - 2015-06-20 02:25 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2015-07-15 18:39 - 2015-06-20 02:25 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2015-07-15 18:39 - 2015-06-20 02:24 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec

2015-07-15 18:39 - 2015-06-20 02:24 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll

2015-07-15 18:39 - 2015-06-20 02:23 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll

2015-07-15 18:39 - 2015-06-20 02:17 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2015-07-15 18:39 - 2015-06-20 02:16 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2015-07-15 18:39 - 2015-06-20 02:13 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll

2015-07-15 18:39 - 2015-06-20 02:13 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2015-07-15 18:39 - 2015-06-20 02:03 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll

2015-07-15 18:39 - 2015-06-20 01:57 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll

2015-07-15 18:39 - 2015-06-20 01:53 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll

2015-07-15 18:39 - 2015-06-20 01:52 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2015-07-15 18:39 - 2015-06-20 01:51 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll

2015-07-15 18:39 - 2015-06-20 01:40 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2015-07-15 18:39 - 2015-06-20 01:40 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2015-07-15 18:39 - 2015-06-20 01:39 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll

2015-07-15 18:39 - 2015-06-20 01:15 - 01951232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2015-07-15 18:39 - 2015-06-20 01:11 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2015-07-15 18:39 - 2015-06-18 01:47 - 00404992 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll

2015-07-15 18:39 - 2015-06-18 01:37 - 00312320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll

2015-07-15 18:39 - 2015-06-02 08:07 - 00254976 _____ (Microsoft Corporation) C:\Windows\system32\cewmdm.dll

2015-07-15 18:39 - 2015-06-02 07:47 - 00210432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cewmdm.dll

2015-07-15 18:38 - 2015-07-10 01:59 - 00017856 _____ (Microsoft Corporation) C:\Windows\system32\CompatTelRunner.exe

2015-07-15 18:38 - 2015-07-10 01:58 - 01085440 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll

2015-07-15 18:38 - 2015-07-10 01:58 - 00765440 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll

2015-07-15 18:38 - 2015-07-10 01:58 - 00726528 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll

2015-07-15 18:38 - 2015-07-10 01:58 - 00433664 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll

2015-07-15 18:38 - 2015-07-10 01:58 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll

2015-07-15 18:38 - 2015-07-10 01:58 - 00067584 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll

2015-07-15 18:38 - 2015-07-10 01:50 - 01145856 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

2015-07-15 18:38 - 2015-07-02 04:56 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys

2015-07-15 18:38 - 2015-07-02 04:56 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys

2015-07-15 18:38 - 2015-07-02 04:49 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll

2015-07-15 18:38 - 2015-07-02 04:49 - 01216512 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll

2015-07-15 18:38 - 2015-07-02 04:49 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll

2015-07-15 18:38 - 2015-07-02 04:49 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll

2015-07-15 18:38 - 2015-07-02 04:49 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll

2015-07-15 18:38 - 2015-07-02 04:49 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll

2015-07-15 18:38 - 2015-07-02 04:49 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll

2015-07-15 18:38 - 2015-07-02 04:49 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll

2015-07-15 18:38 - 2015-07-02 04:49 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll

2015-07-15 18:38 - 2015-07-02 04:49 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll

2015-07-15 18:38 - 2015-07-02 04:49 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll

2015-07-15 18:38 - 2015-07-02 04:48 - 00044032 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll

2015-07-15 18:38 - 2015-07-02 04:48 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll

2015-07-15 18:38 - 2015-07-02 04:47 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe

2015-07-15 18:38 - 2015-07-02 04:47 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe

2015-07-15 18:38 - 2015-07-02 04:43 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll

2015-07-15 18:38 - 2015-07-02 04:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll

2015-07-15 18:38 - 2015-07-02 04:39 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll

2015-07-15 18:38 - 2015-07-02 04:30 - 00552960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll

2015-07-15 18:38 - 2015-07-02 04:30 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll

2015-07-15 18:38 - 2015-07-02 04:30 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll

2015-07-15 18:38 - 2015-07-02 04:30 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll

2015-07-15 18:38 - 2015-07-02 04:30 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll

2015-07-15 18:38 - 2015-07-02 04:30 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll

2015-07-15 18:38 - 2015-07-02 04:30 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll

2015-07-15 18:38 - 2015-07-02 04:30 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll

2015-07-15 18:38 - 2015-07-02 04:30 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll

2015-07-15 18:38 - 2015-07-02 04:29 - 00665088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll

2015-07-15 18:38 - 2015-07-02 04:29 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll

2015-07-15 18:38 - 2015-07-02 04:29 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe

2015-07-15 18:38 - 2015-07-02 04:27 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll

2015-07-15 18:38 - 2015-07-02 04:26 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll

2015-07-15 18:38 - 2015-07-02 04:24 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll

2015-07-15 18:38 - 2015-07-02 03:27 - 00159232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys

2015-07-15 18:38 - 2015-07-02 03:26 - 00290816 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys

2015-07-15 18:38 - 2015-07-02 03:26 - 00129024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys

2015-07-15 18:38 - 2015-06-16 05:50 - 00112064 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe

2015-07-15 18:38 - 2015-06-16 05:45 - 03242496 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll

2015-07-15 18:38 - 2015-06-16 05:45 - 01941504 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll

2015-07-15 18:38 - 2015-06-16 05:45 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll

2015-07-15 18:38 - 2015-06-16 05:45 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll

2015-07-15 18:38 - 2015-06-16 05:44 - 00128000 _____ (Microsoft Corporation) C:\Windows\system32\msiexec.exe

2015-07-15 18:38 - 2015-06-16 05:43 - 02364416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll

2015-07-15 18:38 - 2015-06-16 05:43 - 01805824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll

2015-07-15 18:38 - 2015-06-16 05:43 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll

2015-07-15 18:38 - 2015-06-16 05:42 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msiexec.exe

2015-07-15 18:38 - 2015-06-16 05:42 - 00025088 _____ (Microsoft Corporation) C:\Windows\system32\msimsg.dll

2015-07-15 18:38 - 2015-06-16 05:37 - 00025088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msimsg.dll

2015-07-15 18:38 - 2015-04-28 03:23 - 01480192 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll

2015-07-15 18:38 - 2015-04-28 03:23 - 00229376 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll

2015-07-15 18:38 - 2015-04-28 03:23 - 00188416 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll

2015-07-15 18:38 - 2015-04-28 03:23 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll

2015-07-15 18:38 - 2015-04-28 03:05 - 00179200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll

2015-07-15 18:38 - 2015-04-28 03:04 - 01174528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll

2015-07-15 18:38 - 2015-04-28 03:04 - 00143872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll

2015-07-15 18:38 - 2015-04-28 03:04 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll

2015-07-10 22:23 - 2015-07-10 22:35 - 113325422 _____ C:\Users\Mohamed Shahrir\Downloads\AloneXP Ver. 7.2.2a.rar

2015-07-10 22:21 - 2015-07-10 22:25 - 68427047 _____ C:\Users\Mohamed Shahrir\Downloads\Conquest 05292014.exe

2015-07-10 22:21 - 2015-07-10 22:23 - 194690591 _____ C:\Users\Mohamed Shahrir\Downloads\RPGVXAce_RTP.zip

2015-07-08 06:26 - 2015-07-08 06:26 - 00000000 ____D C:\Users\Mohamed Shahrir\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR

2015-07-08 06:26 - 2015-07-08 06:26 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR

2015-07-08 06:25 - 2015-07-08 06:26 - 00000000 ____D C:\Program Files\WinRAR

2015-07-08 06:25 - 2015-07-08 06:25 - 01941744 _____ C:\Users\Mohamed Shahrir\Downloads\winrar-x64-521.exe

2015-07-08 06:03 - 2015-07-08 06:10 - 211480866 _____ C:\Users\Mohamed Shahrir\Downloads\Silverfall_PAL_MULTi5_PSP-OE.rar

2015-07-07 06:02 - 2015-07-07 06:02 - 00000213 _____ C:\Users\Mohamed Shahrir\Desktop\Dota 2.url

2015-07-07 05:53 - 2015-07-21 21:49 - 00000000 ____D C:\Program Files\Steam

2015-07-07 05:41 - 2015-07-07 05:53 - 00000732 _____ C:\Users\Public\Desktop\Steam.lnk

2015-07-05 07:59 - 2015-07-07 05:37 - 00000000 ___RD C:\Program Files (x86)\Skype

2015-07-05 07:59 - 2015-07-05 07:59 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype

2015-07-04 20:17 - 2015-07-15 06:23 - 00002147 _____ C:\Users\Public\Desktop\Google Chrome.lnk

2015-07-04 20:17 - 2015-07-04 20:17 - 00931408 _____ (Google Inc.) C:\Users\Mohamed Shahrir\Downloads\ChromeSetup.exe

2015-07-04 19:54 - 2015-07-04 20:17 - 00000000 ____D C:\Program Files (x86)\Google

2015-07-02 20:37 - 2015-07-02 20:37 - 00000000 ____D C:\Windows\SysWOW64\vbox

2015-07-02 20:37 - 2015-07-02 20:37 - 00000000 ____D C:\Windows\system32\vbox

2015-07-02 18:34 - 2015-07-02 18:34 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVAST Software

2015-07-02 18:33 - 2015-07-02 18:33 - 00364472 _____ (Avast Software s.r.o.) C:\Windows\system32\aswBoot.exe

2015-07-02 18:33 - 2015-07-02 18:33 - 00043112 _____ (Avast Software s.r.o.) C:\Windows\avastSS.scr

2015-06-25 20:22 - 2015-06-25 20:22 - 06179362 _____ C:\Users\Mohamed Shahrir\Downloads\Evidence.7z

2015-06-23 21:27 - 2015-06-23 21:27 - 00000000 ____D C:\Users\Mohamed Shahrir\AppData\Local\Skype

 

==================== One Month Modified files and folders ========

 

(If an entry is included in the fixlist, the file/folder will be moved.)

 

2015-07-22 18:48 - 2012-09-20 18:59 - 00000894 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2015-07-22 18:48 - 2012-05-22 16:23 - 00000828 _____ C:\Windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon.job

2015-07-22 18:48 - 2009-07-14 12:45 - 00024608 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2015-07-22 18:48 - 2009-07-14 12:45 - 00024608 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2015-07-22 18:46 - 2015-06-19 05:32 - 00014056 _____ C:\Windows\setupact.log

2015-07-22 18:46 - 2009-07-14 13:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2015-07-22 18:45 - 2009-07-14 12:45 - 03033552 _____ C:\Windows\system32\FNTCACHE.DAT

2015-07-21 23:21 - 2012-05-22 16:11 - 01095489 _____ C:\Windows\WindowsUpdate.log

2015-07-21 23:20 - 2012-05-28 12:20 - 00000000 ____D C:\ProgramData\Microsoft Help

2015-07-21 22:59 - 2012-08-24 16:54 - 00000912 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2809493940-1832043367-3520061379-1003UA.job

2015-07-21 22:28 - 2012-09-20 18:59 - 00000898 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2015-07-21 19:14 - 2012-07-12 10:53 - 00004182 _____ C:\Windows\System32\Tasks\avast! Emergency Update

2015-07-20 01:54 - 2013-05-21 18:23 - 00000000 ____D C:\Users\Mohamed Shahrir\Desktop\unsorted

2015-07-19 15:04 - 2012-10-17 23:36 - 00000000 ___HD C:\Users\Mohamed Shahrir\AppData\Roaming\uTorrent

2015-07-19 12:59 - 2012-08-24 16:54 - 00000860 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2809493940-1832043367-3520061379-1003Core.job

2015-07-16 18:23 - 2012-09-20 18:59 - 00003894 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA

2015-07-16 18:23 - 2012-09-20 18:59 - 00003642 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore

2015-07-16 18:18 - 2012-05-22 16:23 - 00000830 _____ C:\Windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d.job

2015-07-16 17:28 - 2015-04-05 07:52 - 00000000 ___SD C:\Windows\SysWOW64\GWX

2015-07-16 17:28 - 2015-04-05 07:52 - 00000000 ___SD C:\Windows\system32\GWX

2015-07-16 17:28 - 2009-07-14 11:20 - 00000000 ____D C:\Windows\PolicyDefinitions

2015-07-16 17:27 - 2014-12-12 07:06 - 00000000 ____D C:\Windows\system32\appraiser

2015-07-16 17:27 - 2014-05-09 08:22 - 00000000 ___SD C:\Windows\system32\CompatTel

2015-07-15 23:22 - 2013-07-22 03:06 - 00000000 ____D C:\Windows\system32\MRT

2015-07-08 06:44 - 2009-07-14 13:13 - 00786662 _____ C:\Windows\system32\PerfStringBackup.INI

2015-07-07 05:37 - 2012-09-14 04:17 - 00000000 ___HD C:\Users\Mohamed Shahrir\AppData\Roaming\Skype

2015-07-07 05:37 - 2012-04-11 02:16 - 00000000 ____D C:\ProgramData\Skype

2015-07-05 07:51 - 2010-11-21 11:47 - 00434374 _____ C:\Windows\PFRO.log

2015-07-05 07:51 - 2009-07-14 13:08 - 00032588 _____ C:\Windows\Tasks\SCHEDLGU.TXT

2015-07-04 20:17 - 2013-12-08 23:16 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome

2015-07-04 20:09 - 2012-05-26 18:34 - 00000000 ___HD C:\Users\Mohamed Shahrir\AppData\Local\Deployment

2015-07-04 19:53 - 2015-04-09 21:13 - 00000000 __SHD C:\Users\Mohamed Shahrir\AppData\Local\EmieBrowserModeList

2015-07-04 19:53 - 2014-05-06 18:36 - 00000000 __SHD C:\Users\Mohamed Shahrir\AppData\Local\EmieUserList

2015-07-04 19:53 - 2014-05-06 18:36 - 00000000 __SHD C:\Users\Mohamed Shahrir\AppData\Local\EmieSiteList

2015-07-04 17:58 - 2015-03-24 13:58 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GOG.com

2015-07-04 17:57 - 2009-07-14 13:32 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games

2015-07-04 17:47 - 2012-04-11 02:26 - 00000000 ____D C:\Program Files (x86)\Adobe

2015-07-04 17:47 - 2009-07-14 13:32 - 00000000 ____D C:\Program Files (x86)\Windows Sidebar

2015-07-04 17:42 - 2012-05-22 16:29 - 00000000 ____D C:\Program Files (x86)\NVIDIA Corporation

2015-07-04 17:42 - 2012-04-11 02:27 - 00000000 ____D C:\Program Files (x86)\NTI

2015-07-04 17:42 - 2009-07-14 13:32 - 00000000 ____D C:\Program Files (x86)\MSBuild

2015-07-04 17:41 - 2012-10-01 02:20 - 00000000 ____D C:\Program Files (x86)\DivX

2015-07-04 17:41 - 2012-05-22 16:21 - 00000000 ____D C:\Program Files (x86)\Launch Manager

2015-07-04 17:41 - 2012-04-11 02:08 - 00000000 ____D C:\Program Files (x86)\Intel

2015-07-04 17:40 - 2012-04-11 02:35 - 00000000 ____D C:\Program Files (x86)\CyberLink

2015-07-04 17:39 - 2015-01-15 11:18 - 00000000 ____D C:\Program Files (x86)\Bluetooth Suite

2015-07-04 17:39 - 2012-05-22 16:41 - 00000000 ____D C:\Program Files (x86)\Atheros

2015-07-04 17:39 - 2012-04-11 02:18 - 00000000 ____D C:\Program Files (x86)\Acer

2015-07-04 15:33 - 2012-10-04 06:13 - 00000000 ___HD C:\Users\Mohamed Shahrir\AppData\Local\CrashDumps

2015-07-03 08:43 - 2012-10-20 20:30 - 130333168 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2015-07-02 20:29 - 2012-05-27 11:20 - 00442264 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswsp.sys

2015-07-02 18:33 - 2014-08-05 00:53 - 00029168 _____ C:\Windows\system32\Drivers\aswHwid.sys

2015-07-02 18:33 - 2014-01-14 11:45 - 00137288 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswStm.sys

2015-07-02 18:33 - 2014-01-14 11:17 - 00272248 _____ C:\Windows\system32\Drivers\aswVmm.sys

2015-07-02 18:33 - 2014-01-14 11:17 - 00065736 _____ C:\Windows\system32\Drivers\aswRvrt.sys

2015-07-02 18:33 - 2012-05-27 11:20 - 00093528 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswRdr2.sys

2015-07-02 18:33 - 2012-05-27 11:20 - 00089944 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswMonFlt.sys

2015-07-02 18:32 - 2012-05-27 11:20 - 01047320 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswSnx.sys

2015-06-29 05:38 - 2012-05-27 19:50 - 00770972 _____ C:\Windows\SysWOW64\PerfStringBackup.INI

2015-06-28 06:11 - 2012-05-27 12:36 - 00000000 ___HD C:\Users\Mohamed Shahrir\AppData\Roaming\vlc

2015-06-23 20:15 - 2014-12-24 07:41 - 00003886 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task

2015-06-23 13:30 - 2010-11-21 11:27 - 00300704 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe

 

==================== Files in the root of some directories =======

 

2012-12-03 20:49 - 2012-12-03 20:49 - 0000288 ____H () C:\Users\Mohamed Shahrir\AppData\Roaming\.backup.dm

2015-07-20 18:41 - 2015-07-22 18:48 - 0000024 _____ () C:\Users\Mohamed Shahrir\AppData\Roaming\appdataFr25.bin

2013-07-18 13:35 - 2013-07-22 17:19 - 0007168 ____H () C:\Users\Mohamed Shahrir\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

2015-01-05 18:09 - 2015-01-05 18:09 - 0015827 _____ () C:\Users\Mohamed Shahrir\AppData\Local\recently-used.xbel

2012-05-22 16:57 - 2012-05-22 17:01 - 0002454 _____ () C:\ProgramData\clear.fiSDK20.log

2012-05-22 17:00 - 2012-05-22 17:00 - 0000032 _____ () C:\ProgramData\PS.log

 

Some files in TEMP:

====================

C:\Users\Mohamed Shahrir\AppData\Local\Temp\game_setup.exe

C:\Users\Mohamed Shahrir\AppData\Local\Temp\tbuTo0.dll

C:\Users\no one\AppData\Local\Temp\DataCard_Setup64.exe

C:\Users\no one\AppData\Local\Temp\ResetDevice.exe

 

 

==================== Bamital & volsnap Check =================

 

(There is no automatic fix for files that do not pass verification.)

 

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\SysWOW64\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed

 

 

LastRegBack: 2015-07-08 04:37

 

==================== End of log ============================

[Advertisements]

You picked up something on 7/19.

 

 

 

 

Download the attached fixlist.txt to the same location as FRST
Run FRST and press Fix
A fix log will be generated please post that.

 

Download : ADWCleaner to your desktop.  Make sure you get the correct Download button.  Sometimes the ads on BleepingComputer will mimic the real Download button which should say: Download Now @BleepingComputer

NOTE: If using Internet Explorer and you get an alert that stops the program downloading, click on the warning and allow the download to complete.

Close  all programs, pause your anti-virus and run AdwCleaner (Vista or Win 7 => right click and Run As Administrator).



Click on Scan  and follow the prompts. Let it run unhindered. When done, click on the Clean button, and follow the prompts. Allow the system to reboot. You will then be presented with the report. Copy & Paste this report on your next reply.

The report will be saved in the C:\AdwCleaner folder.



Junkware-Removal-Tool

Please download Junkware Removal Tool to your desktop.  Make sure you get the correct Download button.  Sometimes the ads on BleepingComputer will mimic the real Download button which should say: Download Now @Author's site

• Pause your anti-virus.  Close all browsers.
• Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
• The tool will open and start scanning your system.
• Please be patient as this can take a while to complete depending on your system's specifications.
• On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
• Post the contents of JRT.txt into your next message.

 

 

Run FRST again, check the Additions box and then Scan.  You will get two logs.  Post them both.

 

Tonight have Avast do a boot time scan.  Make sure you set it up as follows:

 

How to do a boot-time scan while you sleep:
First mute the speakers so it won't wake you up when Windows loads.  Click on the Orange ball.  Click on Scan, then Scan for Viruses and wait a couple of minutes for the page to change.  Change Quickscan to Boot-time Scan.  Click on Settings.  Where it says Heuristic Sensitivity click on the last rectangle so that all of them are  orange and it says High.  Check both boxes.  Then change When a threat is found ... to:  Move to Chest.  OK.  Now click on Start.  Close the Avast window and then reboot.  The scan will start.  It will tell you where it will save the report.  Usually it's
C:\ProgramData\AVAST Software\Avast\report\aswBoot.txt but it might change so verify the location.  When Windows loads Click on the Orange Ball then Scan, Then Scan History (at the bottom of the page). Click on the last scan and then Detailed Report.  If it found anything then open the aswBoot.txt file and copy and paste it.  You may need to enable seeing hidden files in order to see the file so: Open the Control Panel menu and click Folder Options.
    After the new window appears select the View tab.
    Put a checkmark in the checkbox labeled Display the contents of system folders.
    Under the Hidden files and folders section select the radio button labeled Show hidden files and folders.
    Remove the checkmark from the checkbox labeled Hide file extensions for known file types.
    Remove the checkmark from the checkbox labeled Hide protected operating system files.
    Press the Apply button and then the OK button

If you can't find it then take a screen shot of the Detailed Report:
 

[RKinner]

You picked up something on 7/19.

 

 

 

 

Download the attached fixlist.txt to the same location as FRST
Run FRST and press Fix
A fix log will be generated please post that.

 

Download : ADWCleaner to your desktop.  Make sure you get the correct Download button.  Sometimes the ads on BleepingComputer will mimic the real Download button which should say: Download Now @BleepingComputer

NOTE: If using Internet Explorer and you get an alert that stops the program downloading, click on the warning and allow the download to complete.

Close  all programs, pause your anti-virus and run AdwCleaner (Vista or Win 7 => right click and Run As Administrator).



Click on Scan  and follow the prompts. Let it run unhindered. When done, click on the Clean button, and follow the prompts. Allow the system to reboot. You will then be presented with the report. Copy & Paste this report on your next reply.

The report will be saved in the C:\AdwCleaner folder.



Junkware-Removal-Tool

Please download Junkware Removal Tool to your desktop.  Make sure you get the correct Download button.  Sometimes the ads on BleepingComputer will mimic the real Download button which should say: Download Now @Author's site

• Pause your anti-virus.  Close all browsers.
• Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
• The tool will open and start scanning your system.
• Please be patient as this can take a while to complete depending on your system's specifications.
• On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
• Post the contents of JRT.txt into your next message.

 

 

Run FRST again, check the Additions box and then Scan.  You will get two logs.  Post them both.

 

Tonight have Avast do a boot time scan.  Make sure you set it up as follows:

 

How to do a boot-time scan while you sleep:
First mute the speakers so it won't wake you up when Windows loads.  Click on the Orange ball.  Click on Scan, then Scan for Viruses and wait a couple of minutes for the page to change.  Change Quickscan to Boot-time Scan.  Click on Settings.  Where it says Heuristic Sensitivity click on the last rectangle so that all of them are  orange and it says High.  Check both boxes.  Then change When a threat is found ... to:  Move to Chest.  OK.  Now click on Start.  Close the Avast window and then reboot.  The scan will start.  It will tell you where it will save the report.  Usually it's
C:\ProgramData\AVAST Software\Avast\report\aswBoot.txt but it might change so verify the location.  When Windows loads Click on the Orange Ball then Scan, Then Scan History (at the bottom of the page). Click on the last scan and then Detailed Report.  If it found anything then open the aswBoot.txt file and copy and paste it.  You may need to enable seeing hidden files in order to see the file so: Open the Control Panel menu and click Folder Options.
    After the new window appears select the View tab.
    Put a checkmark in the checkbox labeled Display the contents of system folders.
    Under the Hidden files and folders section select the radio button labeled Show hidden files and folders.
    Remove the checkmark from the checkbox labeled Hide file extensions for known file types.
    Remove the checkmark from the checkbox labeled Hide protected operating system files.
    Press the Apply button and then the OK button

If you can't find it then take a screen shot of the Detailed Report:
 

[no_body50]

hi here are the logs.

Attached Files

•  AdwCleanerR0.txt   21.21KB   141 downloads
•  AdwCleanerR1.txt   1.2KB   135 downloads
•  AdwCleanerR2.txt   1.01KB   132 downloads
•  AdwCleanerR3.txt   1.08KB   120 downloads
•  AdwCleanerS0.txt   18.85KB   158 downloads
•  AdwCleanerS1.txt   1.27KB   133 downloads
•  AdwCleanerS2.txt   1.14KB   116 downloads
•  aswBoot.txt   15.18KB   263 downloads
•  Fixlog.txt   22.79KB   148 downloads
•  JRT.txt   1.22KB   118 downloads

[RKinner]

Run FRST again, check the Additions box and then Scan.  You will get two logs.  Post them both.

 

Let's see if anything got broken:

 

Right click on (My) Computer and select Manage (Continue) Then click on the arrow in front of Event Viewer. Next Click on the arrow in front of Windows Logs Right click on System and Clear Log, Clear. Repeat for Application.

Reboot.

Start, All Programs, Accessories then right click on Command Prompt and Run as Administrator.  Then type (with an Enter after each line).

sfc  /scannow

(This will check your critical system files. Does this finish without complaint?  IF it says it couldn't fix everything then:

Copy the next two lines:

findstr  /c:"[SR]"  \windows\logs\cbs\cbs.log  >  \windows\logs\cbs\junk.txt
notepad \windows\logs\cbs\junk.txt

Start, All Programs, Accessories, right click on Command Prompt and Run as Administrator, Continue.  Right click and Paste or Edit then Paste and the copied line should appear.
Hit Enter. Copy and paste the text from notepad or if it is too big, just attach the file.)


1. Please download the Event Viewer Tool by Vino Rosso
http://images.malwar...om/vino/VEW.exe
and save it to your Desktop:
2. Right-click VEW.exe and Run AS Administrator
3. Under 'Select log to query', select:

* System
4. Under 'Select type to list', select:
* Error
* Warning


Then use the 'Number of events' as follows:


1. Click the radio button for 'Number of events'
Type 20 in the 1 to 20 box
Then click the Run button.
Notepad will open with the output log.


Please post the Output log in your next reply then repeat but select Application.

Ron
 

[no_body50]

hi here are the logs

Attached Files

•  Addition.txt   52.08KB   154 downloads
•  FRST.txt   47.01KB   118 downloads
•  junk.txt   47.75KB   117 downloads
•  VEW.txt   758bytes   117 downloads
•  VEW2.txt   6.88KB   133 downloads

Edited by no_body50, 23 July 2015 - 12:33 PM.

[RKinner]

We have one entry that keeps coming back.  Let's see if we can fake it out.  First let's cleanup your Java:

 

Clear the Java Cache by following the instructions on
http://www.java.com/...lugin_cache.xml

You do not have the latest Java.
First go into Control Panel, Add/Remove Software (XP) or Programs and Features (Vista/Win 7) and remove any old versions (which may call themselves: Java Runtime, Runtime Environment, Runtime, JRE, Java Virtual Machine, Virtual Machine, Java VM, JVM, VM, J2RE, J2SE)
I see:
Java 7 Update 55 (64-bit)
Java 7 Update 55
Java Launcher 3.201 (Standard edition)
Java SE Development Kit 7 Update 55
Java SE Development Kit 8 Update 5

Java has been very vulnerable to infection so unless you absolutely need it you should not reinstall it.

If you feel you must have Java:
Get the latest Java at:
http://www.java.com/en/

Save it to your PC then close all browsers and install it.  Do not let it install the yahoo toolbar or other foistware.
Once installed, go into Control Panel, Java, Security and set the slider to the Highest then OK.

(If you also want the 64 bit version then use the 64 bit version of IE to get it.)
 

 

Then we will run another fixlist.  Besides trying to trick the infection I am going to remove the corrupt archives that Avast found.

 

Download the attached fixlist.txt to the same location as FRST
Run FRST and press Fix
A fix log will be generated please post that.  Run FRST again, check the Additions box and then Scan.  You will get two logs.  Post them both.

 

What I am trying to do is replace the

 

AppdataFr25.bin

 

file with a directory of the same name.

[no_body50]

i have deleted all the java stuff and here are the logs 

Attached Files

•  Addition.txt   47.7KB   269 downloads
•  Fixlog.txt   3.51KB   234 downloads

[RKinner]

Frst says it made the folder I asked it to so now I just need a FRST log to confirm that the folder is where it should be.  Are you seeing any problems? 

 

Let's check to see if anything is slowing it down:

 

Get Process Explorer

http://live.sysinter...com/procexp.exe
Save it to your desktop then run it (Vista or Win7 - right click and Run As Administrator).  

View, Select Column, check Verified Signer, OK
Options, Verify Image Signatures


Click twice on the CPU column header  to sort things by CPU usage with the big hitters at the top.  

Wait a full minute then:

File, Save As, Save.  Open the file Procexp.txt on your desktop and copy and paste the text to a reply.
 

 

 

[no_body50]

the text u wanted

 

Process CPU Private Bytes Working Set PID Description Company Name Verified Signer

System Idle Process 95.41 0 K 24 K 0

procexp64.exe 1.14 45,700 K 67,904 K 3632 Sysinternals Process Explorer Sysinternals - www.sysinternals.com (Verified) Microsoft Corporation

Interrupts 0.72 0 K 0 K n/a Hardware Interrupts and DPCs

chrome.exe 0.46 101,756 K 159,896 K 3732 Google Chrome Google Inc. (Verified) Google Inc

chrome.exe 0.40 66,112 K 103,764 K 1888 Google Chrome Google Inc. (Verified) Google Inc

dwm.exe 0.40 114,148 K 69,664 K 3564 Desktop Window Manager Microsoft Corporation (Verified) Microsoft Windows

System 0.34 804 K 38,172 K 4

chrome.exe 0.32 75,308 K 114,332 K 6680 Google Chrome Google Inc. (Verified) Google Inc

AvastSvc.exe 0.26 144,056 K 41,228 K 1812 avast! Service Avast Software s.r.o. (Verified) AVAST Software a.s.

csrss.exe 0.17 3,928 K 28,344 K 984 Client Server Runtime Process Microsoft Corporation (Verified) Microsoft Windows

chrome.exe 0.11 91,024 K 153,756 K 1432 Google Chrome Google Inc. (Verified) Google Inc

PhiMouPro.exe 0.10 1,772 K 5,152 K 4796 Monitor HID key code Chicony (No signature was present in the subject) Chicony

ePowerEvent.exe 0.03 3,128 K 6,080 K 4560 ePowerEvent Acer Incorporated (Verified) Acer Incorporated

ePowerTray.exe 0.03 7,948 K 14,060 K 3820 ePowerTray Acer Incorporated (Verified) Acer Incorporated

svchost.exe 0.02 5,816 K 10,868 K 856 Host Process for Windows Services Microsoft Corporation (Verified) Microsoft Windows

LMS.exe 0.01 2,736 K 5,120 K 3656 Local Manageability Service Intel Corporation (Verified) Intel Corporation

IAStorDataMgrSvc.exe 0.01 20,312 K 21,828 K 4936 IAStorDataSvc Intel Corporation (Verified) Intel Corporation

explorer.exe 0.01 51,416 K 70,996 K 3592 Windows Explorer Microsoft Corporation (Verified) Microsoft Windows

avastui.exe 0.01 19,292 K 21,424 K 4788 avast! Antivirus Avast Software s.r.o. (Verified) AVAST Software a.s.

services.exe 0.01 6,656 K 11,136 K 180 Services and Controller app Microsoft Corporation (Verified) Microsoft Windows

svchost.exe 0.01 6,928 K 11,344 K 5780 Host Process for Windows Services Microsoft Corporation (Verified) Microsoft Windows

NOBuAgent.exe < 0.01 3,348 K 6,648 K 2496 Norton Online Backup Service Symantec Corporation (Verified) Symantec Corporation

iusb3mon.exe < 0.01 2,080 K 5,724 K 4748 Intel® USB 3.0 Monitor Intel Corporation (Verified) Intel Corporation

dsiwmis.exe < 0.01 2,428 K 4,952 K 2208 Dritek WMI Service Dritek System Inc. (Verified) Dritek System Inc.

svchost.exe < 0.01 12,600 K 20,316 K 1224 Host Process for Windows Services Microsoft Corporation (Verified) Microsoft Windows

taskhost.exe < 0.01 15,300 K 15,800 K 3444 Host Process for Windows Tasks Microsoft Corporation (Verified) Microsoft Windows

SearchIndexer.exe < 0.01 42,476 K 25,120 K 5524 Microsoft Windows Search Indexer Microsoft Corporation (Verified) Microsoft Windows

NvBackend.exe < 0.01 24,256 K 31,200 K 3772 NVIDIA GeForce Experience Backend NVIDIA Corporation (Verified) NVIDIA Corporation

svchost.exe < 0.01 41,360 K 58,380 K 1260 Host Process for Windows Services Microsoft Corporation (Verified) Microsoft Windows

svchost.exe < 0.01 19,420 K 20,724 K 1452 Host Process for Windows Services Microsoft Corporation (Verified) Microsoft Windows

svchost.exe < 0.01 16,996 K 19,544 K 6112 Host Process for Windows Services Microsoft Corporation (Verified) Microsoft Windows

NvTmru.exe < 0.01 3,912 K 8,524 K 4272 NVIDIA NvTmru Application NVIDIA Corporation (Verified) NVIDIA Corporation

IScheduleSvc.exe < 0.01 5,980 K 11,376 K 2528 Backup Manager Module NTI Corporation (Verified) NTI Corporation

conhost.exe < 0.01 2,808 K 6,152 K 3452 Console Window Host Microsoft Corporation (Verified) Microsoft Windows

svchost.exe < 0.01 173,832 K 184,500 K 1176 Host Process for Windows Services Microsoft Corporation (Verified) Microsoft Windows

SynTPEnh.exe < 0.01 11,072 K 15,236 K 1368 Synaptics TouchPad Enhancements Synaptics Incorporated (Verified) Synaptics Incorporated

AvastVBoxSVC.exe < 0.01 9,692 K 17,600 K 5284 AvastVirtualBox Interface Avast Software (Verified) AVAST Software a.s.

wmpnetwk.exe < 0.01 4,948 K 3,828 K 2300 Windows Media Player Network Sharing Service Microsoft Corporation (Verified) Microsoft Windows

csrss.exe < 0.01 2,848 K 5,408 K 836 Client Server Runtime Process Microsoft Corporation (Verified) Microsoft Windows

nvvsvc.exe < 0.01 8,208 K 17,048 K 1568 NVIDIA Driver Helper Service, Version 331.82 NVIDIA Corporation (Verified) NVIDIA Corporation

spoolsv.exe < 0.01 8,948 K 15,932 K 2008 Spooler SubSystem App Microsoft Corporation (Verified) Microsoft Windows

wininit.exe < 0.01 2,132 K 5,168 K 964 Windows Start-Up Application Microsoft Corporation (Verified) Microsoft Windows

wuauclt.exe 3,384 K 8,248 K 3132 Windows Update Microsoft Corporation (Verified) Microsoft Windows

WmiPrvSE.exe 7,968 K 13,748 K 2680 WMI Provider Host Microsoft Corporation (Verified) Microsoft Windows

WmiPrvSE.exe 3,676 K 7,784 K 4448 WMI Provider Host Microsoft Corporation (Verified) Microsoft Windows

wlanext.exe 2,928 K 6,536 K 1828 Windows Wireless LAN 802.11 Extensibility Framework Microsoft Corporation (Verified) Microsoft Windows

winlogon.exe 4,288 K 8,784 K 460 Windows Logon Application Microsoft Corporation (Verified) Microsoft Windows

UpdaterService.exe 1,272 K 4,036 K 2456 Updater Service Acer Incorporated (Verified) Acer Incorporated

unsecapp.exe 3,556 K 7,952 K 4376 Sink to receive asynchronous callbacks for WMI client application Microsoft Corporation (Verified) Microsoft Windows

UNS.exe 4,136 K 10,548 K 5244 User Notification Service Intel Corporation (Verified) Intel Corporation

TrustedInstaller.exe 6,588 K 11,292 K 5632 Windows Modules Installer Microsoft Corporation (Verified) Microsoft Windows

taskeng.exe 4,000 K 8,536 K 3520 Task Scheduler Engine Microsoft Corporation (Verified) Microsoft Windows

SynTPHelper.exe 2,988 K 5,656 K 4180 Synaptics Pointing Device Helper Synaptics Incorporated (Verified) Synaptics Incorporated

svchost.exe 16,284 K 19,800 K 1612 Host Process for Windows Services Microsoft Corporation (Verified) Microsoft Windows

svchost.exe 62,172 K 34,868 K 3336 Host Process for Windows Services Microsoft Corporation (Verified) Microsoft Windows

svchost.exe 6,712 K 10,632 K 1040 Host Process for Windows Services Microsoft Corporation (Verified) Microsoft Windows

svchost.exe 26,908 K 25,340 K 1140 Host Process for Windows Services Microsoft Corporation (Verified) Microsoft Windows

svchost.exe 6,916 K 12,412 K 2172 Host Process for Windows Services Microsoft Corporation (Verified) Microsoft Windows

svchost.exe 4,924 K 8,976 K 2648 Host Process for Windows Services Microsoft Corporation (Verified) Microsoft Windows

svchost.exe 2,896 K 6,360 K 5748 Host Process for Windows Services Microsoft Corporation (Verified) Microsoft Windows

smss.exe 740 K 1,380 K 648 Windows Session Manager Microsoft Corporation (Verified) Microsoft Windows

RAVCpl64.exe 10,152 K 12,244 K 4116 Realtek HD Audio Manager Realtek Semiconductor (Verified) Realtek Semiconductor Corp

RAVBg64.exe 14,944 K 11,972 K 4204 HD Audio Background Process Realtek Semiconductor (Verified) Realtek Semiconductor Corp

PWRISOVM.EXE 3,360 K 6,932 K 5048 PowerISO Virtual Drive Manager Power Software Ltd (Verified) Power Software Limited

procexp.exe 2,532 K 7,500 K 4952 Sysinternals Process Explorer Sysinternals - www.sysinternals.com (Verified) Microsoft Corporation

PHILED.exe 1,892 K 6,680 K 4980 Chicony Multimedia Keyboard Driver Chicony (No signature was present in the subject) Chicony

pcee4.exe 41,552 K 38,252 K 4764 Dolby Profile Selector Dolby Laboratories Inc. (Verified) Dolby Laboratories

nvxdsync.exe 11,648 K 23,468 K 1552 NVIDIA User Experience Driver Component NVIDIA Corporation (Verified) NVIDIA Corporation

nvvsvc.exe 3,852 K 8,632 K 496 NVIDIA Driver Helper Service, Version 331.82 NVIDIA Corporation (Verified) NVIDIA Corporation

nvtray.exe 7,508 K 14,436 K 4108 NVIDIA Settings NVIDIA Corporation (Verified) NVIDIA Corporation

nvstreamsvc.exe 4,056 K 9,880 K 2572 NVIDIA Streamer Service NVIDIA Corporation (Verified) NVIDIA Corporation

nvstreamsvc.exe 6,752 K 12,212 K 3436 NVIDIA Streamer Service NVIDIA Corporation (Verified) NVIDIA Corporation

NvNetworkService.exe 1,868 K 5,524 K 2548 NVIDIA Network Service NVIDIA Corporation (Verified) NVIDIA Corporation

ngservice.exe 1,752 K 4,184 K 6056 avast! NG service AVAST Software (Verified) AVAST Software a.s.

ModLEDKey.exe 1,320 K 840 K 3724 AccessL Chicony (No signature was present in the subject) Chicony

MMDx64Fx.exe 6,048 K 11,336 K 4804 MMDx64Fx Application Dritek System Inc. (Verified) Dritek System Inc.

lsm.exe 3,252 K 5,004 K 172 Local Session Manager Service Microsoft Corporation (Verified) Microsoft Windows

lsass.exe 7,236 K 15,120 K 200 Local Security Authority Process Microsoft Corporation (Verified) Microsoft Windows

LMutilps32.exe 2,452 K 6,836 K 2256 Launch Manager utility process Dritek System Inc. (Verified) Dritek System Inc.

LManager.exe 11,812 K 15,004 K 4728 Launch Manager Dritek System Inc. (Verified) Dritek System Inc.

Jhi_service.exe 2,008 K 5,680 K 2424 Intel® Dynamic Application Loader Host Interface Intel Corporation (Verified) Intel Corporation

iuEmailOutlookAgent.exe 14,268 K 16,780 K 1804 iuEmailOutlookAgent (Verified) Acer Incorporated

iuBrowserIEAgent.exe 14,312 K 17,312 K 4136 iuBrowserIEAgent (Verified) Acer Incorporated

IntelMeFWService.exe 1,184 K 3,768 K 2396 (Verified) Intel Corporation

igfxsrvc.exe 4,512 K 9,052 K 3800 igfxsrvc Module Intel Corporation (Verified) Intel Corporation

igfxpers.exe 4,744 K 9,680 K 1584 persistence Module Intel Corporation (Verified) Intel Corporation

igfxext.exe 3,492 K 7,432 K 4320 igfxext Module Intel Corporation (Verified) Intel Corporation

hkcmd.exe 4,480 K 8,828 K 3804 hkcmd Module Intel Corporation (Verified) Intel Corporation

HeciServer.exe 2,524 K 6,272 K 2356 Intel® Capability Licensing Service Interface Intel® Corporation (Verified) Intel® Upgrade Service

GWX.exe 4,460 K 1,112 K 3512 GWX Microsoft Corporation (Verified) Microsoft Windows

GREGsvc.exe 1,128 K 3,568 K 2316 Global Registration Service Acer Incorporated (Verified) Acer Incorporated

ePowerSvc.exe 3,908 K 8,216 K 2248 ePowerSvc Acer Incorporated (Verified) Acer Incorporated

dllhost.exe 3,516 K 8,572 K 4592 COM Surrogate Microsoft Corporation (Verified) Microsoft Windows

dllhost.exe 1,596 K 4,828 K 6940 COM Surrogate Microsoft Corporation (Verified) Microsoft Windows

DivXUpdate.exe 8,684 K 18,328 K 4772 DivX Update (Verified) DivX

DeviceDetector.exe 2,880 K 1,916 K 508 MediaEspresso DeviceDetector CyberLink (Certificate expired) CyberLink

conhost.exe 1,476 K 3,284 K 1836 Console Window Host Microsoft Corporation (Verified) Microsoft Windows

conhost.exe 2,032 K 4,288 K 2640 Console Window Host Microsoft Corporation (Verified) Microsoft Windows

conhost.exe 2,036 K 4,284 K 3736 Console Window Host Microsoft Corporation (Verified) Microsoft Windows

chrome.exe 103,324 K 149,868 K 4656 Google Chrome Google Inc. (Verified) Google Inc

chrome.exe 20,024 K 61,308 K 4336 Google Chrome Google Inc. (Verified) Google Inc

chrome.exe 27,488 K 65,620 K 5620 Google Chrome Google Inc. (Verified) Google Inc

chrome.exe 27,960 K 65,668 K 3908 Google Chrome Google Inc. (Verified) Google Inc

chrome.exe 30,320 K 67,764 K 5804 Google Chrome Google Inc. (Verified) Google Inc

chrome.exe 31,836 K 68,824 K 4632 Google Chrome Google Inc. (Verified) Google Inc

BackupManagerTray.exe 4,928 K 13,300 K 4716 Acer Backup Manager NTI Corporation (Verified) NTI Corporation

audiodg.exe 16,772 K 18,124 K 6848 Windows Audio Device Graph Isolation Microsoft Corporation (Verified) Microsoft Windows

Ath_WlanAgent.exe 1,392 K 3,976 K 2700 Atheros Coex Service Application Atheros (Certificate expired) Atheros

armsvc.exe 1,332 K 4,124 K 2052 Adobe Acrobat Update Service Adobe Systems Incorporated (Verified) Adobe Systems

AdobeARM.exe 4,216 K 1,268 K 6800 Adobe Reader and Acrobat Manager Adobe Systems Incorporated (Verified) Adobe Systems

AdminService.exe 2,808 K 5,924 K 2124 AdminService Application Qualcomm Atheros Commnucations (Certificate expired) Qualcomm Atheros Commnucations

 

Attached Files

•  FRST.txt   46.61KB   120 downloads

[RKinner]

It still shows up!  Try the procedure recommended here:

 

https://forums.malwa...od/#entry973461

[no_body50]

not sure if i send the correct one earlier. this is the latest log after deleting and reinstalling chrome

Attached Files

•  FRST.txt   49.28KB   122 downloads

Edited by no_body50, 25 July 2015 - 01:14 AM.

[RKinner]

Chrome looks better but the file is still present.

 

2015-07-23 06:39 - 2015-07-25 14:46 - 0000024 _____ () C:\Users\Mohamed Shahrir\AppData\Roaming\appdataFr25.bin

 

Copy the next 4 lines
 

ren \Users\Mohamed Shahrir\AppData\Roaming\appdataFr25.bin \Users\Mohamed Shahrir\AppData\Roaming\appdataFr25.bad

mkdir \Users\Mohamed Shahrir\AppData\Roaming\appdataFr25.bin

dir \Users\Mohamed Shahrir\AppData\Roaming > \junk.txt

notepad \junk.txt

 

 

Start, All Programs, Accessories, right click on Command Prompt and Run as Administrator, Continue.  Right click and Paste or Edit then Paste and the copied line should appear.
Hit Enter if notepad does not open.  Copy and paste the text from notepad into a reply.  Close notepad.  Close the Command Window.
 

 

 

[no_body50]

here as you requested

 

 Volume in drive C is Acer

 Volume Serial Number is 90FB-6BD8

 

 Directory of C:\Users\Mohamed

 

25/07/2015  12:18 AM    <DIR>          .

25/07/2015  12:18 AM    <DIR>          ..

               0 File(s)              0 bytes

 

 Directory of C:\Users\Mohamed Shahrir\Shahrir\AppData\Roaming

 

26/07/2015  12:25 AM    <DIR>          .

26/07/2015  12:25 AM    <DIR>          ..

26/07/2015  12:25 AM    <DIR>          appdataFr25.bin

               0 File(s)              0 bytes

               3 Dir(s)  155,357,130,752 bytes free

[no_body50]

I try to find the file appdataFr25.bin u mentioned and managed to delete it in safe mode.i search using recommendation by from the internet.

%program files%\common files\system\AppdataFr25.bin.dll
%program files(x86)%\AppdataFr25.bin uninstall\
%programData%\AppdataFr25.bin.exe\
%appdata%\roaming\[AppdataFr25.bin].exe or folder
%Windows%\system32\driver\AppdataFr25.bin.sys

%users%\default\appdata\local\AppdataFr25.bin.log

this is the latest log after the delete. 

Attached Files

•  FRST.txt   49.31KB   145 downloads

Edited by no_body50, 25 July 2015 - 10:51 AM.

[RKinner]

OK.  It looks like you also deleted my folder of the some name but if it doesn't come back on a reboot I guess it's OK.