[Ndavies19899]

Hi all, sorry if I'm going about this wrong but I'm having so much trouble on my PC that I've had to come on my phone to try and get this sorted.

The problem is that for the past week or so my computer has been slowing down more and more. Now it takes an age to do anything as remotely simple as open up a web browser. I've installed avg and done a full computer scan but that apparently didn't do anything except to slow my computer down even more. I've never had to deal with viruses etc so I honestly don't know what to do.

Any help would be greatly appreciated.
If any logs are needed (would need step by step instructions on what to do) then I could do it slowly on my PC.

Thanks in advance.
Nathan.

[Advertisements]

Hi! My name is zep516 and Welcome to Geekstogo!
I'll do the best I can to resolve your computer issue
Please make sure to carefully read any instruction that I give you. If you're not sure, or if something unexpected happens, don't continue Stop and ask! Never be afraid to ask questions!

Everything gets download to the desktop and tools are "Run as administrator."

You might want to uninstall AVG, if you already had an anti virus program running, two anti virus programs will slow things down..

Please download Farbar Recovery Scan Tool and save it to your Desktop. 32Bit for a 32 Bit machine, 64Bit for a 64Bit machine

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

• Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
• Press Scan button.
• It will produce a log called FRST.txt in the same directory the tool is run from.
• Please copy and paste log back here.
• The first time the tool is run it generates another log (Addition.txt - also located in the same directory as FRST.exe/FRST64.exe). Please also paste that along with the FRST.txt into your reply.

[zep516]

Hi! My name is zep516 and Welcome to Geekstogo!
I'll do the best I can to resolve your computer issue
Please make sure to carefully read any instruction that I give you. If you're not sure, or if something unexpected happens, don't continue Stop and ask! Never be afraid to ask questions!

Everything gets download to the desktop and tools are "Run as administrator."

You might want to uninstall AVG, if you already had an anti virus program running, two anti virus programs will slow things down..

Please download Farbar Recovery Scan Tool and save it to your Desktop. 32Bit for a 32 Bit machine, 64Bit for a 64Bit machine

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

• Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
• Press Scan button.
• It will produce a log called FRST.txt in the same directory the tool is run from.
• Please copy and paste log back here.
• The first time the tool is run it generates another log (Addition.txt - also located in the same directory as FRST.exe/FRST64.exe). Please also paste that along with the FRST.txt into your reply.

[Ndavies19899]

Hi Zep516!

 

Thanks for the speedy reply, the tool is now scanning so i will post the results as soon as they come up

 

Nathan.

 

OK, results are as follows:

 

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 20-07-2015
Ran by User (administrator) on MAINPC on 24-07-2015 18:29:39
Running from C:\Users\User\Desktop
Loaded Profiles: User & Stephanie & Leo (Available Profiles: User & Stephanie & Leo)
Platform: Microsoft Windows 7 Ultimate  Service Pack 1 (X86) OS Language: English (United States)
Internet Explorer Version 8 (Default browser not detected!)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgrsx.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgcsrvx.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgfws.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgidsagent.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgwdsvc.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgnsx.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgemcx.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MpCmdRun.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MpCmdRun.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Kies\KiesTrayAgent.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgui.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Microsoft Corporation) C:\Windows\System32\wuauclt.exe
(Microsoft Corporation) C:\Windows\System32\wuauclt.exe
(Microsoft Corporation) C:\Windows\SoftwareDistribution\Download\Install\AM_Delta.exe
(Microsoft Corporation) C:\Windows\System32\MpSigStub.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jucheck.exe
(Microsoft Corporation) C:\Windows\System32\CompatTelRunner.exe
(Microsoft Corporation) C:\Windows\temp\22741624-F655-4FA4-92C5-CAE28B726BB0\DismHost.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil32_18_0_0_209_ActiveX.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [BCSSync] => C:\Program Files\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM\...\Run: [KiesTrayAgent] => C:\Program Files\Samsung\Kies\KiesTrayAgent.exe [311616 2015-04-28] (Samsung Electronics Co., Ltd.)
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [981688 2015-04-30] (Microsoft Corporation)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [334896 2015-04-30] (Oracle Corporation)
HKLM\...\Run: [AVG_UI] => C:\Program Files\AVG\AVG2015\avgui.exe [3730344 2015-07-07] (AVG Technologies CZ, s.r.o.)
HKU\S-1-5-21-2276093219-456965671-1327668654-1004 Group Policy restriction on software: C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckgzm.exe <====== ATTENTION
HKU\S-1-5-21-2276093219-456965671-1327668654-1004 Group Policy restriction on software: C:\Program Files\Windows Media Player\Setup_wm.exe <====== ATTENTION
HKU\S-1-5-21-2276093219-456965671-1327668654-1004 Group Policy restriction on software: %HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRoot% <====== ATTENTION
HKU\S-1-5-21-2276093219-456965671-1327668654-1004 Group Policy restriction on software: C:\Program Files\Google\Chrome\Application\chrome.exe <====== ATTENTION
HKU\S-1-5-21-2276093219-456965671-1327668654-1004 Group Policy restriction on software: C:\Program Files\Windows Media Player\wmpsideshowgadget.exe <====== ATTENTION
HKU\S-1-5-21-2276093219-456965671-1327668654-1004 Group Policy restriction on software: C:\Program Files\Windows Sidebar <====== ATTENTION
HKU\S-1-5-21-2276093219-456965671-1327668654-1004 Group Policy restriction on software: C:\Program Files\Windows Media Player\wmpnetwk.exe <====== ATTENTION
HKU\S-1-5-21-2276093219-456965671-1327668654-1004 Group Policy restriction on software: C:\Program Files\Microsoft Games\Mahjong\Mahjong.exe <====== ATTENTION
HKU\S-1-5-21-2276093219-456965671-1327668654-1004 Group Policy restriction on software: C:\Program Files\Microsoft Games\More Games\MoreGames.dll <====== ATTENTION
HKU\S-1-5-21-2276093219-456965671-1327668654-1004 Group Policy restriction on software: C:\Program Files\Windows NT\Accessories\wordpad.exe <====== ATTENTION
HKU\S-1-5-21-2276093219-456965671-1327668654-1004 Group Policy restriction on software: C:\Program Files\Microsoft Games\FreeCell\freecell.exe <====== ATTENTION
HKU\S-1-5-21-2276093219-456965671-1327668654-1004 Group Policy restriction on software: C:\Program Files\Windows Media Player\wmprph.exe <====== ATTENTION
HKU\S-1-5-21-2276093219-456965671-1327668654-1004 Group Policy restriction on software: C:\Program Files\Microsoft Games\Solitaire\solitaire.exe <====== ATTENTION
HKU\S-1-5-21-2276093219-456965671-1327668654-1004 Group Policy restriction on software: C:\Program Files\Windows Media Player\wmpconfig.exe <====== ATTENTION
HKU\S-1-5-21-2276093219-456965671-1327668654-1004 Group Policy restriction on software: C:\Program Files\Windows Media Player\wmpnscfg.exe <====== ATTENTION
HKU\S-1-5-21-2276093219-456965671-1327668654-1004 Group Policy restriction on software: C:\Program Files\Microsoft Games\Hearts\hearts.exe <====== ATTENTION
HKU\S-1-5-21-2276093219-456965671-1327668654-1004 Group Policy restriction on software: C:\Program Files\Microsoft Games\Minesweeper\minesweeper.exe <====== ATTENTION
HKU\S-1-5-21-2276093219-456965671-1327668654-1004 Group Policy restriction on software: C:\Program Files\Microsoft Games\Multiplayer\Checkers\chkrzm.exe <====== ATTENTION
HKU\S-1-5-21-2276093219-456965671-1327668654-1004 Group Policy restriction on software: C:\Program Files\Microsoft Games\Chess\chess.exe <====== ATTENTION
HKU\S-1-5-21-2276093219-456965671-1327668654-1004 Group Policy restriction on software: C:\Program Files\Microsoft Games\Multiplayer\Spades\shvlzm.exe <====== ATTENTION
HKU\S-1-5-21-2276093219-456965671-1327668654-1004 Group Policy restriction on software: C:\Program Files\Windows Media Player\wmlaunch.exe <====== ATTENTION
HKU\S-1-5-21-2276093219-456965671-1327668654-1004 Group Policy restriction on software: C:\Program Files\Windows Media Player\wmpnscfg.exe <====== ATTENTION
HKU\S-1-5-21-2276093219-456965671-1327668654-1004 Group Policy restriction on software: C:\Program Files\Windows Defender <====== ATTENTION
HKU\S-1-5-21-2276093219-456965671-1327668654-1004 Group Policy restriction on software: %HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir% <====== ATTENTION
HKU\S-1-5-21-2276093219-456965671-1327668654-1004 Group Policy restriction on software: C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe <====== ATTENTION
HKU\S-1-5-21-2276093219-456965671-1327668654-1004 Group Policy restriction on software: C:\Program Files\Microsoft Games\SpiderSolitaire\spidersolitaire.exe <====== ATTENTION
HKU\S-1-5-21-2276093219-456965671-1327668654-1004 Group Policy restriction on software: C:\Program Files\Internet Explorer <====== ATTENTION
HKU\S-1-5-21-2276093219-456965671-1327668654-1004 Group Policy restriction on software: C:\Program Files\Windows Media Player\wmpshare.exe <====== ATTENTION
HKU\S-1-5-21-2276093219-456965671-1327668654-1004 Group Policy restriction on software: C:\Program Files\Windows Media Player\wmpenc.exe <====== ATTENTION
HKU\S-1-5-21-2276093219-456965671-1327668654-1003\...\RunOnce: [FlashPlayerUpdate] => C:\Windows\system32\Macromed\Flash\FlashUtil32_17_0_0_169_ActiveX.exe -update activex
Startup: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Clash of Clans.lnk [2015-05-03]
ShortcutTarget: Clash of Clans.lnk -> C:\ProgramData\{a8a5e82a-2384-b140-a8a5-5e82a238a0a8}\Clash of Clans.exe (No File)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  No File
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
GroupPolicyUsers\S-1-5-21-2276093219-456965671-1327668654-1004\User: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
CHR HKU\S-1-5-21-2276093219-456965671-1327668654-1000\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-2276093219-456965671-1327668654-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://websearch.goo...&cc=GB&unqvl=86
HKU\S-1-5-21-2276093219-456965671-1327668654-1000\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.kingdomsatwar.com/play/
HKU\S-1-5-21-2276093219-456965671-1327668654-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/en-gb/?ocid=iehp
HKU\S-1-5-21-2276093219-456965671-1327668654-1003\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://uk.msn.com/
HKU\S-1-5-21-2276093219-456965671-1327668654-1004\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://uk.msn.com/
SearchScopes: HKLM -> DefaultScope {BB82DE59-BC4C-4172-9AC4-73315F71CFFE} URL = http://websearch.goo...&cc=GB&unqvl=86
SearchScopes: HKLM -> {BB82DE59-BC4C-4172-9AC4-73315F71CFFE} URL = http://websearch.goo...&cc=GB&unqvl=86
SearchScopes: HKU\S-1-5-21-2276093219-456965671-1327668654-1000 -> DefaultScope {BB82DE59-BC4C-4172-9AC4-73315F71CFFE} URL = http://websearch.goo...&cc=GB&unqvl=86
SearchScopes: HKU\S-1-5-21-2276093219-456965671-1327668654-1000 -> {BB82DE59-BC4C-4172-9AC4-73315F71CFFE} URL = http://websearch.goo...&cc=GB&unqvl=86
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
Toolbar: HKU\S-1-5-21-2276093219-456965671-1327668654-1003 -> No Name - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} -  No File
Hosts: 54.225.95.126 alnbbbmmheedjelgjiljibhlicildiae
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{1715D1C0-65F9-496E-9F34-7F8B193499B3}: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{B2EA4081-6C00-461A-A6D0-6D548863122A}: [DhcpNameServer] 192.168.0.1

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_18_0_0_209.dll [2015-07-15] ()
FF Plugin: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-05-04] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-05-04] (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.27.5\npGoogleUpdate3.dll No File
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.27.5\npGoogleUpdate3.dll No File

Chrome:
=======
CHR dev: Chrome dev build detected! <======= ATTENTION

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 avgfws; C:\Program Files\AVG\AVG2015\avgfws.exe [1528432 2015-07-07] (AVG Technologies CZ, s.r.o.)
R2 AVGIDSAgent; C:\Program Files\AVG\AVG2015\avgidsagent.exe [3518376 2015-07-07] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files\AVG\AVG2015\avgwdsvc.exe [314304 2015-07-07] (AVG Technologies CZ, s.r.o.)
S3 IEEtwCollectorService; C:\Windows\system32\IEEtwCollector.exe [108032 2014-03-01] (Microsoft Corporation) [File not signed]
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [22216 2015-04-30] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [284504 2015-04-30] (Microsoft Corporation)
S3 ss_conn_service; C:\Program Files\Samsung\USB Drivers\25_escape\conn\ss_conn_service.exe [743688 2014-10-13] (DEVGURU Co., LTD.)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-27] (Microsoft Corporation)
S2 gupdate; "C:\Program Files\Google\Update\GoogleUpdate.exe" /svc [X]
S3 gupdatem; "C:\Program Files\Google\Update\GoogleUpdate.exe" /medsvc [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R1 Avgdiskx; C:\Windows\System32\DRIVERS\avgdiskx.sys [132576 2015-03-11] (AVG Technologies CZ, s.r.o.)
R1 Avgfwfd; C:\Windows\System32\DRIVERS\avgfwd6x.sys [57824 2015-04-14] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdriverx.sys [231856 2015-06-26] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHX; C:\Windows\System32\DRIVERS\avgidshx.sys [190944 2015-05-12] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSShim; C:\Windows\System32\DRIVERS\avgidsshimx.sys [29664 2015-05-14] (AVG Technologies CZ, s.r.o.)
R1 Avgldx86; C:\Windows\System32\DRIVERS\avgldx86.sys [207328 2015-06-16] (AVG Technologies CZ, s.r.o.)
R0 Avglogx; C:\Windows\System32\DRIVERS\avglogx.sys [290272 2015-05-07] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx86; C:\Windows\System32\DRIVERS\avgmfx86.sys [170464 2015-06-10] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx86; C:\Windows\System32\DRIVERS\avgrkx86.sys [35808 2015-03-20] (AVG Technologies CZ, s.r.o.)
R1 Avgtdix; C:\Windows\System32\DRIVERS\avgtdix.sys [213984 2015-05-12] (AVG Technologies CZ, s.r.o.)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [245096 2015-03-04] (Microsoft Corporation)
S3 netr28u; C:\Windows\System32\DRIVERS\Dnetr28u.sys [750592 2009-08-06] (Ralink Technology Corp.)
S3 ssudserd; C:\Windows\System32\DRIVERS\ssudserd.sys [184192 2014-10-13] (DEVGURU Co., LTD.(www.devguru.co.kr))
S3 MBAMSwissArmy; \??\C:\Windows\system32\drivers\MBAMSwissArmy.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-07-24 18:29 - 2015-07-24 18:31 - 00016041 _____ C:\Users\User\Desktop\FRST.txt
2015-07-24 18:29 - 2015-07-24 18:29 - 00000000 ____D C:\FRST
2015-07-24 18:28 - 2015-07-24 18:28 - 01638912 _____ (Farbar) C:\Users\User\Desktop\FRST.exe
2015-07-23 16:27 - 2015-07-23 16:28 - 00000000 ____D C:\d638f5b5a11e8d7611d48ad2a34fd0
2015-07-15 22:22 - 2015-07-15 22:22 - 208058322 _____ C:\Windows\MEMORY.DMP
2015-07-15 22:22 - 2015-07-15 22:22 - 00146536 _____ C:\Windows\Minidump\071515-39312-01.dmp
2015-07-15 22:22 - 2015-07-15 22:22 - 00000000 ____D C:\Windows\Minidump
2015-07-15 18:10 - 2015-06-15 22:47 - 00101824 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2015-07-15 18:10 - 2015-06-15 22:43 - 02364416 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2015-07-15 18:10 - 2015-06-15 22:43 - 01805824 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2015-07-15 18:10 - 2015-06-15 22:43 - 00337408 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2015-07-15 18:10 - 2015-06-15 22:43 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll
2015-07-15 18:10 - 2015-06-15 22:42 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\msiexec.exe
2015-07-15 18:10 - 2015-06-15 22:37 - 00025088 _____ (Microsoft Corporation) C:\Windows\system32\msimsg.dll
2015-07-15 18:10 - 2015-04-29 19:07 - 11411456 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2015-07-15 18:10 - 2015-04-29 19:07 - 00008192 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll
2015-07-15 18:10 - 2015-04-29 19:07 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx
2015-07-15 18:10 - 2015-04-29 19:07 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll
2015-07-15 18:10 - 2015-04-29 19:05 - 12625408 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2015-07-15 18:10 - 2015-04-27 20:05 - 00179200 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2015-07-15 18:10 - 2015-04-27 20:04 - 01174528 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2015-07-15 18:10 - 2015-04-27 20:04 - 00143872 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2015-07-15 18:10 - 2015-04-27 20:04 - 00103936 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2015-07-15 18:09 - 2015-07-01 21:46 - 00137664 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-07-15 18:09 - 2015-07-01 21:46 - 00067520 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-07-15 18:09 - 2015-07-01 21:30 - 01061376 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-07-15 18:09 - 2015-07-01 21:30 - 00655360 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2015-07-15 18:09 - 2015-07-01 21:30 - 00552960 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-07-15 18:09 - 2015-07-01 21:30 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-07-15 18:09 - 2015-07-01 21:30 - 00248832 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-07-15 18:09 - 2015-07-01 21:30 - 00221184 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-07-15 18:09 - 2015-07-01 21:30 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-07-15 18:09 - 2015-07-01 21:30 - 00100352 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-07-15 18:09 - 2015-07-01 21:30 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-07-15 18:09 - 2015-07-01 21:30 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2015-07-15 18:09 - 2015-07-01 21:30 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-07-15 18:09 - 2015-07-01 21:30 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-07-15 18:09 - 2015-07-01 21:30 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-07-15 18:09 - 2015-07-01 21:29 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-07-15 18:09 - 2015-07-01 21:29 - 00022528 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-07-15 18:09 - 2015-07-01 21:27 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-07-15 18:09 - 2015-07-01 21:26 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-07-15 18:09 - 2015-07-01 21:24 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-07-15 18:09 - 2015-07-01 20:18 - 00225792 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2015-07-15 18:09 - 2015-07-01 20:18 - 00124416 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2015-07-15 18:09 - 2015-07-01 20:18 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2015-07-15 18:09 - 2015-05-25 19:07 - 03989440 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2015-07-15 18:09 - 2015-05-25 19:07 - 03934144 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-07-15 18:09 - 2015-05-25 19:04 - 01307648 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-07-15 18:09 - 2015-05-25 19:01 - 00853504 _____ (Microsoft Corporation) C:\Windows\system32\diagtrack.dll
2015-07-15 18:09 - 2015-05-25 19:01 - 00641536 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2015-07-15 18:09 - 2015-05-25 19:01 - 00635392 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2015-07-15 18:09 - 2015-05-25 19:01 - 00400896 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-07-15 18:09 - 2015-05-25 19:01 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\sechost.dll
2015-07-15 18:09 - 2015-05-25 19:01 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-07-15 18:09 - 2015-05-25 19:01 - 00038912 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-07-15 18:09 - 2015-05-25 19:00 - 00364544 _____ (Microsoft Corporation) C:\Windows\system32\tracerpt.exe
2015-07-15 18:09 - 2015-05-25 19:00 - 00262656 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-07-15 18:09 - 2015-05-25 19:00 - 00082944 _____ (Microsoft Corporation) C:\Windows\system32\logman.exe
2015-07-15 18:09 - 2015-05-25 19:00 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-07-15 18:09 - 2015-05-25 19:00 - 00040448 _____ (Microsoft Corporation) C:\Windows\system32\typeperf.exe
2015-07-15 18:09 - 2015-05-25 19:00 - 00037888 _____ (Microsoft Corporation) C:\Windows\system32\relog.exe
2015-07-15 18:09 - 2015-05-25 19:00 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\diskperf.exe
2015-07-15 18:09 - 2015-05-25 18:55 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-07-15 18:09 - 2015-05-25 17:53 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\UtcResources.dll
2015-07-15 18:09 - 2015-04-11 04:07 - 00054656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\stream.sys
2015-07-15 18:08 - 2015-07-09 18:44 - 00015808 _____ (Microsoft Corporation) C:\Windows\system32\CompatTelRunner.exe
2015-07-15 18:08 - 2015-07-09 18:43 - 00587264 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-07-15 18:08 - 2015-07-09 18:42 - 00924160 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-07-15 18:08 - 2015-07-09 18:42 - 00628736 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-07-15 18:08 - 2015-07-09 18:42 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-07-15 18:08 - 2015-07-09 18:42 - 00202752 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-07-15 18:08 - 2015-07-09 18:42 - 00058880 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2015-07-15 18:08 - 2015-07-09 18:34 - 00932864 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-07-15 18:08 - 2015-07-04 18:48 - 01414656 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll
2015-07-15 18:08 - 2015-07-02 18:54 - 06034432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-07-15 18:08 - 2015-07-02 17:54 - 01638912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-07-15 18:08 - 2015-06-25 09:46 - 02383872 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-07-15 18:08 - 2015-06-17 18:39 - 00305664 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2015-07-15 18:08 - 2015-06-15 22:43 - 11030528 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-07-15 18:08 - 2015-06-15 22:43 - 02088448 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-07-15 18:08 - 2015-06-15 22:43 - 01267712 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-07-15 18:08 - 2015-06-15 22:43 - 00981504 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-07-15 18:08 - 2015-06-15 22:43 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-07-15 18:08 - 2015-06-15 22:43 - 00627712 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-07-15 18:08 - 2015-06-15 22:43 - 00624640 _____ (Microsoft Corporation) C:\Windows\system32\mstime.dll
2015-07-15 18:08 - 2015-06-15 22:43 - 00428544 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-07-15 18:08 - 2015-06-15 22:43 - 00389120 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-07-15 18:08 - 2015-06-15 22:43 - 00345600 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-07-15 18:08 - 2015-06-15 22:43 - 00229376 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2015-07-15 18:08 - 2015-06-15 22:43 - 00216064 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-07-15 18:08 - 2015-06-15 22:43 - 00195072 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-07-15 18:08 - 2015-06-15 22:43 - 00186368 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2015-07-15 18:08 - 2015-06-15 22:43 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-07-15 18:08 - 2015-06-15 22:43 - 00153088 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2015-07-15 18:08 - 2015-06-15 22:43 - 00132096 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2015-07-15 18:08 - 2015-06-15 22:43 - 00067584 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-07-15 18:08 - 2015-06-15 22:43 - 00064512 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2015-07-15 18:08 - 2015-06-15 22:43 - 00048128 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-07-15 18:08 - 2015-06-15 22:43 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2015-07-15 18:08 - 2015-06-15 22:43 - 00018944 _____ (Microsoft Corporation) C:\Windows\system32\corpol.dll
2015-07-15 18:08 - 2015-06-15 22:42 - 01466368 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-07-15 18:08 - 2015-06-15 22:42 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-07-15 18:08 - 2015-06-15 22:42 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2015-07-15 18:08 - 2015-06-15 22:42 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2015-07-15 18:08 - 2015-06-15 22:06 - 00386560 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-07-15 18:08 - 2015-06-11 18:57 - 00919552 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2015-07-15 18:08 - 2015-06-11 18:15 - 00134656 _____ (Microsoft Corporation) C:\Windows\system32\rdpudd.dll
2015-07-15 18:08 - 2015-06-11 18:15 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpvideominiport.sys
2015-07-15 18:08 - 2015-06-03 21:17 - 00163840 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2015-07-15 18:08 - 2015-06-02 00:47 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\cewmdm.dll
2015-07-15 18:08 - 2015-05-09 04:14 - 00169984 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2015-07-15 18:08 - 2015-05-09 04:13 - 00868352 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2015-07-15 18:08 - 2015-05-09 04:13 - 00293376 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2015-07-15 18:08 - 2015-05-09 04:12 - 00271360 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2015-07-15 18:08 - 2015-05-09 04:08 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2015-07-15 18:08 - 2015-05-09 04:08 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2015-07-15 18:08 - 2015-05-09 04:08 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2015-07-15 18:08 - 2015-05-09 04:08 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2015-07-15 18:08 - 2015-05-09 04:08 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2015-07-15 18:08 - 2015-05-09 04:08 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2015-07-15 18:08 - 2015-05-09 04:08 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2015-07-15 18:08 - 2015-05-09 04:08 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2015-07-15 18:08 - 2015-05-09 04:08 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2015-07-15 18:08 - 2015-05-09 04:08 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2015-07-15 18:08 - 2015-05-09 04:08 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2015-07-15 18:08 - 2015-05-09 04:08 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2015-07-15 18:08 - 2015-05-09 04:08 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2015-07-15 18:08 - 2015-05-09 04:08 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2015-07-15 18:08 - 2015-05-09 04:08 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-07-15 18:08 - 2015-05-09 04:08 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2015-07-15 18:08 - 2015-05-09 04:08 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2015-07-15 18:08 - 2015-05-09 04:08 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2015-07-15 18:08 - 2015-05-09 04:08 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2015-07-15 18:08 - 2015-05-09 04:08 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2015-07-15 18:08 - 2015-05-09 04:08 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2015-07-15 18:08 - 2015-05-09 04:08 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2015-07-15 18:08 - 2015-05-09 04:08 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2015-07-15 18:08 - 2015-05-09 04:08 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2015-07-15 18:08 - 2015-05-09 02:59 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2015-07-15 18:08 - 2015-05-09 02:59 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2015-07-15 18:08 - 2015-05-09 02:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2015-07-15 18:08 - 2015-05-09 02:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2015-07-15 18:07 - 2015-07-09 18:43 - 02943488 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2015-07-15 18:07 - 2015-07-09 18:43 - 02057216 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2015-07-15 18:07 - 2015-07-09 18:43 - 00566784 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2015-07-15 18:07 - 2015-07-09 18:43 - 00173056 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2015-07-15 18:07 - 2015-07-09 18:43 - 00093184 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2015-07-15 18:07 - 2015-07-09 18:43 - 00073728 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2015-07-15 18:07 - 2015-07-09 18:43 - 00035840 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2015-07-15 18:07 - 2015-07-09 18:43 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2015-07-15 18:07 - 2015-07-09 18:42 - 00135168 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2015-07-15 18:07 - 2015-07-09 18:42 - 00034816 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2015-07-15 18:07 - 2015-07-09 18:42 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\wu.upgrade.ps.dll
2015-07-15 18:02 - 2015-07-03 18:57 - 00026624 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2015-07-15 18:02 - 2015-07-03 18:56 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2015-07-15 18:02 - 2015-07-03 18:56 - 00034304 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2015-07-15 18:02 - 2015-07-03 18:56 - 00010240 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2015-07-15 18:02 - 2015-07-03 17:42 - 00299008 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2015-07-15 17:58 - 2015-04-24 18:56 - 00530432 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2015-07-15 16:24 - 2015-07-15 16:24 - 00000000 ____D C:\Users\User\AppData\Roaming\AVG2015
2015-07-15 16:24 - 2015-07-15 16:24 - 00000000 ____D C:\Program Files\Common Files\AV
2015-07-15 16:23 - 2015-07-15 16:23 - 00000935 _____ C:\Users\Public\Desktop\AVG 2015.lnk
2015-07-15 16:23 - 2015-07-15 16:23 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG
2015-07-15 16:21 - 2015-07-15 16:24 - 00000000 ____D C:\ProgramData\AVG2015
2015-07-15 16:21 - 2015-07-15 16:21 - 00000000 ___HD C:\$AVG
2015-07-15 16:18 - 2015-07-24 17:35 - 00000000 ____D C:\ProgramData\MFAData
2015-07-15 16:17 - 2015-07-15 16:17 - 05021528 _____ (AVG Technologies) C:\Users\User\Downloads\avg_free_stb_all_6086p1_177.exe
2015-06-29 11:19 - 2015-06-29 11:19 - 00000000 ____D C:\Users\User\Documents\Sony
2015-06-29 11:17 - 2015-07-09 19:14 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sony
2015-06-29 11:17 - 2015-06-29 11:17 - 00000000 ____D C:\ProgramData\Sony
2015-06-29 11:17 - 2015-06-29 11:17 - 00000000 ____D C:\Program Files\Sony
2015-06-26 17:31 - 2015-06-26 17:37 - 00000000 ____D C:\ProgramData\HitmanPro
2015-06-26 17:27 - 2015-07-15 15:47 - 00000024 _____ C:\Users\User\AppData\Roaming\appdataFr25.bin
2015-06-26 16:47 - 2015-06-26 16:47 - 00012221 _____ C:\ComboFix.txt
2015-06-26 16:30 - 2015-06-26 16:48 - 00000000 ____D C:\Qoobox
2015-06-26 09:49 - 2015-06-26 09:49 - 00231856 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgidsdriverx.sys
2015-06-24 01:29 - 2015-06-24 01:29 - 01217192 _____ (Microsoft Corporation) C:\Windows\system32\FM20.DLL

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-07-24 17:51 - 2014-06-28 18:21 - 00000000 ____D C:\Users\User\Documents\BitLord
2015-07-24 17:47 - 2009-07-14 05:34 - 00023632 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-07-24 17:47 - 2009-07-14 05:34 - 00023632 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-07-24 17:40 - 2015-01-11 16:23 - 00000000 ____D C:\Program Files\InstallShield Installation Information
2015-07-24 17:38 - 2015-01-11 16:23 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Samsung
2015-07-24 17:38 - 2014-02-19 20:35 - 00000000 ____D C:\Users\User\AppData\Roaming\Samsung
2015-07-24 17:38 - 2014-02-19 20:31 - 00000000 ____D C:\Program Files\Samsung
2015-07-24 17:37 - 2014-10-18 13:22 - 01629063 _____ C:\Windows\WindowsUpdate.log
2015-07-24 17:32 - 2014-04-15 16:48 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-07-24 17:29 - 2015-05-06 20:48 - 00108442 _____ C:\Windows\setupact.log
2015-07-24 17:29 - 2009-07-14 05:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-07-15 21:42 - 2015-06-04 15:42 - 00000352 _____ C:\Windows\Tasks\ReactorAppend.job
2015-07-15 20:10 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\rescache
2015-07-15 19:33 - 2015-05-03 19:33 - 00000340 _____ C:\Windows\Tasks\Bidaily Synchronize Task.job
2015-07-15 19:08 - 2010-11-20 22:01 - 00781782 _____ C:\Windows\system32\PerfStringBackup.INI
2015-07-15 19:03 - 2009-07-14 05:33 - 00292120 _____ C:\Windows\system32\FNTCACHE.DAT
2015-07-15 18:59 - 2014-12-10 20:04 - 00000000 ____D C:\Windows\system32\appraiser
2015-07-15 18:59 - 2014-06-28 23:45 - 00000000 ___SD C:\Windows\system32\CompatTel
2015-07-15 18:33 - 2014-02-19 16:38 - 00000000 ____D C:\Windows\system32\MRT
2015-07-15 18:22 - 2014-02-20 20:52 - 00000000 ____D C:\ProgramData\Microsoft Help
2015-07-15 17:47 - 2014-02-19 18:41 - 00000000 ____D C:\Users\User\AppData\Local\Google
2015-07-15 17:46 - 2014-10-18 12:38 - 00001413 _____ C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-07-15 17:32 - 2014-04-15 16:47 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2015-07-15 17:32 - 2014-04-15 16:47 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2015-07-15 16:39 - 2014-10-17 21:03 - 00000000 ____D C:\Users\User\AppData\Local\Avg2015
2015-07-15 16:20 - 2014-09-20 15:41 - 00000000 ____D C:\Program Files\AVG
2015-07-15 16:07 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\system32\wfp
2015-07-15 16:06 - 2015-06-04 15:44 - 00000000 ____D C:\ProgramData\5689688104766245928
2015-07-15 16:06 - 2015-05-04 21:06 - 00000000 ____D C:\Program Files\Microsoft Security Client
2015-07-15 16:06 - 2015-04-08 10:01 - 00000000 ___SD C:\Windows\system32\GWX
2015-07-15 16:06 - 2015-02-21 15:37 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2015-07-15 16:06 - 2015-02-21 15:36 - 00000000 ____D C:\Program Files\Java
2015-07-15 16:06 - 2014-10-18 12:06 - 00000000 ____D C:\Users\Stephanie
2015-07-15 16:06 - 2014-10-18 12:05 - 00000000 ____D C:\Users\Leo
2015-07-15 16:06 - 2014-09-20 13:44 - 00000000 ____D C:\Users\User\AppData\Local\com
2015-07-15 16:06 - 2014-03-08 23:37 - 00000000 ____D C:\Users\User\AppData\Roaming\vlc
2015-07-15 16:05 - 2015-05-04 21:47 - 00000000 ____D C:\Program Files\Common Files\Java
2015-07-15 16:05 - 2009-07-14 03:37 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
2015-07-15 16:04 - 2011-04-12 03:24 - 00000000 ___RD C:\Users\Public\Recorded TV
2015-07-15 16:03 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\registration
2015-07-15 16:01 - 2015-02-21 15:36 - 00000000 ____D C:\ProgramData\Oracle
2015-07-15 16:01 - 2009-07-14 03:37 - 00000000 __RHD C:\Users\Default
2015-07-15 16:01 - 2009-07-14 03:37 - 00000000 ___RD C:\Users\Public
2015-07-15 16:00 - 2014-02-20 20:51 - 00000000 __RHD C:\MSOCache
2015-07-15 15:59 - 2014-10-18 20:52 - 00000000 ___HD C:\$WINDOWS.~Q
2015-07-05 11:11 - 2014-02-19 16:26 - 00246952 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2015-07-03 08:49 - 2014-10-19 18:15 - 127070192 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-06-26 16:59 - 2014-10-15 09:12 - 00000000 ____D C:\AdwCleaner
2015-06-26 16:48 - 2014-06-27 19:43 - 00000000 ____D C:\Users\TEMP.User-PC
2015-06-26 16:48 - 2014-03-28 20:45 - 00000000 ____D C:\Users\TEMP

==================== Files in the root of some directories =======

2015-06-26 17:27 - 2015-07-15 15:47 - 0000024 _____ () C:\Users\User\AppData\Roaming\appdataFr25.bin
2014-06-28 18:24 - 2015-01-06 16:37 - 0000000 _____ () C:\Users\User\AppData\Roaming\bitlord_log.txt
2014-02-23 16:23 - 2014-02-23 16:23 - 0000067 _____ () C:\Users\User\AppData\Roaming\burnaware.ini
2015-01-06 16:37 - 2015-01-06 16:37 - 0000218 _____ () C:\Users\User\AppData\Local\recently-used.xbel
2015-05-04 20:49 - 2015-05-04 20:51 - 0000684 _____ () C:\Users\User\AppData\Local\Temp-log.txt

Some files in TEMP:
====================
C:\Users\User\AppData\Local\temp\jre-8u45-windows-au.exe
C:\Users\User\AppData\Local\temp\ntwdblib.dll

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2015-07-15 20:02

==================== End of log ============================

 

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 20-07-2015
Ran by User at 2015-07-24 18:32:05
Running from C:\Users\User\Desktop
Boot Mode: Normal
==========================================================

==================== Accounts: =============================

Administrator (S-1-5-21-2276093219-456965671-1327668654-500 - Administrator - Disabled)
Guest (S-1-5-21-2276093219-456965671-1327668654-501 - Limited - Enabled)
HomeGroupUser$ (S-1-5-21-2276093219-456965671-1327668654-1011 - Limited - Enabled)
Leo (S-1-5-21-2276093219-456965671-1327668654-1004 - Limited - Enabled) => C:\Users\Leo
Stephanie (S-1-5-21-2276093219-456965671-1327668654-1003 - Administrator - Enabled) => C:\Users\Stephanie
User (S-1-5-21-2276093219-456965671-1327668654-1000 - Administrator - Enabled) => C:\Users\User

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Microsoft Security Essentials (Enabled - Out of date) {B7ECF8CD-0188-6703-DBA4-AA65C6ACFB0A}
AV: AVG Internet Security 2015 (Enabled - Up to date) {4D41356F-32AD-7C42-C820-63775EE4F413}
AS: Microsoft Security Essentials (Enabled - Out of date) {0C8D1929-27B2-688D-E114-9117BD2BB1B7}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: AVG Internet Security 2015 (Enabled - Up to date) {F620D48B-1497-73CC-F290-58052563BEAE}
FW: AVG Internet Security 2015 (Enabled) {757AB44A-78C2-7D1A-E37F-CA42A037B368}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Flash Player 18 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 18.0.0.209 - Adobe Systems Incorporated)
Adobe Flash Player 18 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 18.0.0.209 - Adobe Systems Incorporated)
AMD Catalyst Install Manager (HKLM\...\{7FEFA920-0095-A7D7-C394-096E1A5470C5}) (Version: 8.0.916.0 - Advanced Micro Devices, Inc.)
AVG 2015 (HKLM\...\AVG) (Version: 2015.0.6086 - AVG Technologies)
AVG 2015 (Version: 15.0.4401 - AVG Technologies) Hidden
AVG 2015 (Version: 15.0.6086 - AVG Technologies) Hidden
BitLord 2.4 (HKLM\...\BitLord) (Version: 2.4.0-276 - House of Life)
CCleaner (HKLM\...\CCleaner) (Version: 4.17 - Piriform)
Google Update Helper (Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (Version: 1.3.27.5 - Google Inc.) Hidden
HydraVision (Version: 4.2.252.0 - Advanced Micro Devices, Inc.) Hidden
Intel® Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version: 8.15.10.1930 - Intel Corporation)
Java 8 Update 45 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83218045F0}) (Version: 8.0.450 - Oracle Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.8.204.0 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x86) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x86)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Word 2010 (HKLM\...\Office14.WORD) (Version: 14.0.7015.1000 - Microsoft Corporation)
MyFreeCodec (HKU\S-1-5-21-2276093219-456965671-1327668654-1000\...\MyFreeCodec) (Version:  - )
Samsung Kies (HKLM\...\InstallShield_{758C8301-2696-4855-AF45-534B1200980A}) (Version: 2.6.3.14123.5 - Samsung Electronics Co., Ltd.)
Samsung Kies (Version: 2.6.3.14123.5 - Samsung Electronics Co., Ltd.) Hidden
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.49.0 - SAMSUNG Electronics Co., Ltd.)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM\...\{90140000-001B-0000-0000-0000000FF1CE}_Office14.WORD_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version:  - Microsoft)
Visual Studio 2012 x86 Redistributables (HKLM\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
VLC media player (HKLM\...\VLC media player) (Version: 2.1.5 - VideoLAN)
WinRAR 5.01 (32-bit) (HKLM\...\WinRAR archiver) (Version: 5.01.0 - win.rar GmbH)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-2276093219-456965671-1327668654-1000_Classes\CLSID\{00b7e0ab-817a-44ad-a04b-d1148d524136}\InprocServer32 -> %SystemDrive%\Users\User\AppData\Roaming\Microsoft\MSXML2\msxml4.dll No File
CustomCLSID: HKU\S-1-5-21-2276093219-456965671-1327668654-1000_Classes\CLSID\{7c6e29bc-8b8b-4c3d-859e-af6cd158be0f}\InprocServer32 -> %SystemDrive%\Users\User\AppData\Roaming\Microsoft\MSXML2\msxml4.dll No File
CustomCLSID: HKU\S-1-5-21-2276093219-456965671-1327668654-1000_Classes\CLSID\{88d969c0-f192-11d4-a65f-0040963251e5}\InprocServer32 -> %SystemDrive%\Users\User\AppData\Roaming\Microsoft\MSXML2\msxml4.dll No File
CustomCLSID: HKU\S-1-5-21-2276093219-456965671-1327668654-1000_Classes\CLSID\{88d969c1-f192-11d4-a65f-0040963251e5}\InprocServer32 -> %SystemDrive%\Users\User\AppData\Roaming\Microsoft\MSXML2\msxml4.dll No File
CustomCLSID: HKU\S-1-5-21-2276093219-456965671-1327668654-1000_Classes\CLSID\{88d969c2-f192-11d4-a65f-0040963251e5}\InprocServer32 -> %SystemDrive%\Users\User\AppData\Roaming\Microsoft\MSXML2\msxml4.dll No File
CustomCLSID: HKU\S-1-5-21-2276093219-456965671-1327668654-1000_Classes\CLSID\{88d969c3-f192-11d4-a65f-0040963251e5}\InprocServer32 -> %SystemDrive%\Users\User\AppData\Roaming\Microsoft\MSXML2\msxml4.dll No File
CustomCLSID: HKU\S-1-5-21-2276093219-456965671-1327668654-1000_Classes\CLSID\{88d969c4-f192-11d4-a65f-0040963251e5}\InprocServer32 -> %SystemDrive%\Users\User\AppData\Roaming\Microsoft\MSXML2\msxml4.dll No File
CustomCLSID: HKU\S-1-5-21-2276093219-456965671-1327668654-1000_Classes\CLSID\{88d969c5-f192-11d4-a65f-0040963251e5}\InprocServer32 -> %SystemDrive%\Users\User\AppData\Roaming\Microsoft\MSXML2\msxml4.dll No File
CustomCLSID: HKU\S-1-5-21-2276093219-456965671-1327668654-1000_Classes\CLSID\{88d969c6-f192-11d4-a65f-0040963251e5}\InprocServer32 -> %SystemDrive%\Users\User\AppData\Roaming\Microsoft\MSXML2\msxml4.dll No File
CustomCLSID: HKU\S-1-5-21-2276093219-456965671-1327668654-1000_Classes\CLSID\{88d969c8-f192-11d4-a65f-0040963251e5}\InprocServer32 -> %SystemDrive%\Users\User\AppData\Roaming\Microsoft\MSXML2\msxml4.dll No File
CustomCLSID: HKU\S-1-5-21-2276093219-456965671-1327668654-1000_Classes\CLSID\{88d969c9-f192-11d4-a65f-0040963251e5}\InprocServer32 -> %SystemDrive%\Users\User\AppData\Roaming\Microsoft\MSXML2\msxml4.dll No File
CustomCLSID: HKU\S-1-5-21-2276093219-456965671-1327668654-1000_Classes\CLSID\{88d969ca-f192-11d4-a65f-0040963251e5}\InprocServer32 -> %SystemDrive%\Users\User\AppData\Roaming\Microsoft\MSXML2\msxml4.dll No File
CustomCLSID: HKU\S-1-5-21-2276093219-456965671-1327668654-1000_Classes\CLSID\{88d969d6-f192-11d4-a65f-0040963251e5}\InprocServer32 -> %SystemDrive%\Users\User\AppData\Roaming\Microsoft\MSXML2\msxml4.dll No File
CustomCLSID: HKU\S-1-5-21-2276093219-456965671-1327668654-1000_Classes\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\localserver32 -> C:\Users\User\AppData\Local\Temp\310\temp\6912981914866206677b.exe No File

==================== Restore Points =========================

26-06-2015 17:35:58 Checkpoint by HitmanPro
29-06-2015 11:18:08 Sony PC Companion
09-07-2015 19:14:13 Windows Update
15-07-2015 15:57:26 Restore Operation
15-07-2015 16:20:12 Installed AVG 2015
15-07-2015 16:21:14 Installed AVG 2015
15-07-2015 16:36:56 Windows Update
15-07-2015 18:11:09 Windows Update
23-07-2015 16:17:34 Windows Update
24-07-2015 17:32:26 Removed Smart Switch

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:04 - 2014-09-20 13:43 - 00000872 ____A C:\Windows\system32\Drivers\etc\hosts
54.225.95.126 alnbbbmmheedjelgjiljibhlicildiae

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {2FDE182F-477D-439F-A249-052189E63492} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2015-07-15] (Adobe Systems Incorporated)
Task: {38CA1FCC-0AC7-40C1-8DC6-355BE60B1E56} - System32\Tasks\Bidaily Synchronize Task => C:\ProgramData\{0ed61fee-fd99-b10e-0ed6-61feefd97fbb}\Clash of Clans.exe <==== ATTENTION
Task: {5764530B-C680-45A9-A822-648BE5823FBE} - System32\Tasks\{41FCF536-082B-4085-86E8-9AD80C92D2BF} => pcalua.exe -a "C:\Program Files\LeapFrog\LeapFrog Connect\uninst.exe"
Task: {ABA79391-E23F-43A3-9B4A-59CB002C5331} - System32\Tasks\ReactorAppend => c:\programdata\{843ad804-ee2d-9cfb-843a-ad804ee26013}\6912981914866206677b.exe <==== ATTENTION
Task: {B3959D97-FE17-4E3D-A29E-4936755BDC39} - System32\Tasks\{AE593129-769B-407E-AFB3-59A64A20CD6A} => pcalua.exe -a C:\Users\Stephanie\Downloads\DCP-115C\SetupDCP115C\Eng\Setup.exe -d C:\Users\Stephanie\Downloads\DCP-115C\SetupDCP115C\Eng
Task: {CCB68BE1-37F0-47CD-83B8-CA2E40462F9C} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-08-21] (Piriform Ltd)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\Bidaily Synchronize Task.job => C:\ProgramData\{0ed61fee-fd99-b10e-0ed6-61feefd97fbb}\Clash of Clans.exe <==== ATTENTION
Task: C:\Windows\Tasks\ReactorAppend.job => c:\programdata\{843ad804-ee2d-9cfb-843a-ad804ee26013}\6912981914866206677b.exe <==== ATTENTION

==================== Loaded Modules (Whitelisted) ==============

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

==================== Safe Mode (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)

==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-2276093219-456965671-1327668654-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\User\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
HKU\S-1-5-21-2276093219-456965671-1327668654-1003\Control Panel\Desktop\\Wallpaper -> C:\Users\Stephanie\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
HKU\S-1-5-21-2276093219-456965671-1327668654-1004\Control Panel\Desktop\\Wallpaper -> C:\Users\Leo\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.0.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\Services: Audiosrv => 2
MSCONFIG\Services: bthserv => 3
MSCONFIG\Services: Fax => 3
MSCONFIG\Services: LeapFrog Connect Device Service => 2

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [{D41FA292-B43F-4A35-8BF3-7FC25C1D2518}] => (Allow) C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
FirewallRules: [{00ABEC87-9BF1-4A61-804C-63B1A46FFE91}] => (Allow) C:\Program Files\FrostWire 5\FrostWire.exe
FirewallRules: [{780CDEF2-AFD2-478C-88CB-1A5F74A2597D}] => (Allow) C:\Program Files\FrostWire 5\FrostWire.exe
FirewallRules: [{DBC63D09-05FC-41DC-A26F-C2A2DA334568}] => (Allow) C:\Program Files\BitLord\BitLord.exe
FirewallRules: [{02B98492-6084-483A-9DBF-E0CFC6D9E61F}] => (Allow) C:\Program Files\BitLord\BitLord.exe
FirewallRules: [TCP Query User{E6AB77FF-2A91-4F69-BC6C-558E4FDAD3B8}C:\users\user\documents\kaw botting\application files\kaw epic battle bot\kaw epic battle bot.exe] => (Block) C:\users\user\documents\kaw botting\application files\kaw epic battle bot\kaw epic battle bot.exe
FirewallRules: [UDP Query User{2BF32D68-91C8-4DAD-9C05-D53E32EB39C1}C:\users\user\documents\kaw botting\application files\kaw epic battle bot\kaw epic battle bot.exe] => (Block) C:\users\user\documents\kaw botting\application files\kaw epic battle bot\kaw epic battle bot.exe
FirewallRules: [{07142C0E-BBE2-4AA9-B240-0C09260DE057}] => (Allow) C:\Program Files\AVG\AVG2015\avgnsx.exe
FirewallRules: [{41647469-6336-4E7D-BF4B-B38348EB6B47}] => (Allow) C:\Program Files\AVG\AVG2015\avgnsx.exe
FirewallRules: [{3C83732F-B853-4CA3-975C-9E9C43BF930C}] => (Allow) C:\Program Files\AVG\AVG2015\avgdiagex.exe
FirewallRules: [{10FF07BF-35E7-4A1E-8949-7ADF0E26C329}] => (Allow) C:\Program Files\AVG\AVG2015\avgdiagex.exe
FirewallRules: [{02E867DB-130F-437B-99E4-90A9754FB239}] => (Allow) C:\Program Files\AVG\AVG2015\avgmfapx.exe
FirewallRules: [{80802F30-C554-4FC5-9A72-461624BF2761}] => (Allow) C:\Program Files\AVG\AVG2015\avgmfapx.exe
FirewallRules: [{E819292B-A2DD-4F61-B41B-02276EACB033}] => (Allow) C:\Program Files\AVG\AVG2015\avgemcx.exe
FirewallRules: [{4A0BE214-6167-4CD4-A641-5599EC57AB1B}] => (Allow) C:\Program Files\AVG\AVG2015\avgemcx.exe

==================== Faulty Device Manager Devices =============

==================== Event log errors: =========================

Application errors:
==================
Error: (07/24/2015 05:30:40 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/23/2015 04:14:38 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/15/2015 10:24:15 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/15/2015 09:58:20 PM) (Source: Desktop Window Manager) (EventID: 9020) (User: )
Description: The Desktop Window Manager has encountered a fatal error (0x80070008)

Error: (07/15/2015 07:04:41 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/15/2015 07:04:09 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/15/2015 04:32:05 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/15/2015 04:19:11 PM) (Source: Windows Backup) (EventID: 4103) (User: )
Description: The backup did not complete because of an error writing to the backup location J:\. The error is: The backup location cannot be found or is not valid. Review your backup settings and check the backup location. (0x81000006).

Error: (07/15/2015 04:10:27 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/15/2015 03:56:53 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

System errors:
=============
Error: (07/24/2015 05:32:11 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Google Update Service (gupdate) service failed to start due to the following error:
%%2

Error: (07/23/2015 04:27:15 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the avgwd service.

Error: (07/23/2015 04:26:29 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: Installation Failure: Windows failed to install the following update with error 0x8024001e: Definition Update for Microsoft Security Essentials - KB2310138 (Definition 1.203.238.0).

Error: (07/23/2015 04:26:28 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: %NT AUTHORITY60 has encountered an error trying to update signatures.

 New Signature Version:

 Previous Signature Version: 1.201.1847.0

 Update Source: %NT AUTHORITY59

 Update Stage: 4.8.0204.00

 Source Path: 4.8.0204.01

 Signature Type: %NT AUTHORITY602

 Update Type: %NT AUTHORITY604

 User: NT AUTHORITY\SYSTEM

 Current Engine Version: %NT AUTHORITY605

 Previous Engine Version: %NT AUTHORITY606

 Error code: %NT AUTHORITY607

 Error description: %NT AUTHORITY608

Error: (07/23/2015 04:16:05 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Google Update Service (gupdate) service failed to start due to the following error:
%%2

Error: (07/15/2015 10:23:03 PM) (Source: BugCheck) (EventID: 1001) (User: )
Description: 0x00000050 (0xfe7d873c, 0x00000001, 0x9440d153, 0x00000000)C:\Windows\MEMORY.DMP071515-39312-01

Error: (07/15/2015 10:23:02 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: The previous system shutdown at 10:20:58 PM on ‎7/‎15/‎2015 was unexpected.

Error: (07/15/2015 07:13:48 PM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: The ScRegSetValueExW call failed for FailureCommand with the following error:
%%5

Error: (07/15/2015 07:13:44 PM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: The ScRegSetValueExW call failed for Start with the following error:
%%5

Error: (07/15/2015 07:06:24 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Google Update Service (gupdate) service failed to start due to the following error:
%%2

Microsoft Office:
=========================
Error: (07/24/2015 05:30:40 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/23/2015 04:14:38 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/15/2015 10:24:15 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/15/2015 09:58:20 PM) (Source: Desktop Window Manager) (EventID: 9020) (User: )
Description: 0x80070008

Error: (07/15/2015 07:04:41 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/15/2015 07:04:09 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/15/2015 04:32:05 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/15/2015 04:19:11 PM) (Source: Windows Backup) (EventID: 4103) (User: )
Description: J:\The backup location cannot be found or is not valid. Review your backup settings and check the backup location. (0x81000006)

Error: (07/15/2015 04:10:27 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/15/2015 03:56:53 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

==================== Memory info ===========================

Processor: Intel® Core™2 CPU 6300 @ 1.86GHz
Percentage of memory in use: 64%
Total physical RAM: 1919.61 MB
Available physical RAM: 683.88 MB
Total Virtual: 6910.45 MB
Available Virtual: 4790.65 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:465.66 GB) (Free:395.94 GB) NTFS
Drive d: () (Fixed) (Total:139.03 GB) (Free:121.25 GB) NTFS
Drive e: (HP_RECOVERY) (Fixed) (Total:10 GB) (Free:9.92 GB) NTFS
Drive f: (2015-04-19 1407) (CDROM) (Total:0.55 GB) (Free:0 GB) UDF

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 149.1 GB) (Disk ID: 9C879C87)
Partition 1: (Active) - (Size=139 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=10 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 6838DF0A)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=465.7 GB) - (Type=07 NTFS)

==================== End of log ============================

Edited by Ndavies19899, 24 July 2015 - 11:35 AM.

[Ndavies19899]

Did i post it wrong?

 

Nathan.

[zep516]

No it's correct.

Remove AVG if you have not done so.

I need a bit of time to look it over.

[Ndavies19899]

oh ok, I only downloaded AVG because i thought it was a trusted anti virus tool. I'll uninstall it right away.

 

Sorry for my impatience

[zep516]

I have also noticed in your log file you are using FrostWire, bitlord, P2P programs. We at Geeks to go ! Recommend removing these type of programs, they are a known cause of Malware infections. When you use file sharing programs like this you can never be sure of the file content and you are put at a much greater risk for infection. I strongly recommend you remove this program before we begin our work.


Next
Re-install Chrome

Unless you did this yourself, malware has changed your Chrome version into the Development Build. Among other things this allows malware to install any extension it wants. We need to resolve this.

1. If you have bookmarks, let's save them by exporting them - Export Bookmarks
2. Then I need you to go Google Sync and sign into your account
3. Scroll down until you see the "Stop and Clear" button and click on the button. At the prompt click on "Ok"
4. Now we need to uninstall chrome via control panel .
Note: When asked about user data or settings you must remove this also so please check the box.
5. Restart the computer and reinstall chrome, You can download The latest version from here - Google Chrome
6. Import your bookmarks back into Chrome
7. Sign back in to your Chrome browser so that your bookmarks sync with your online account.

[Ndavies19899]

Sorry my PC has decided to stop working for the minute.

I haven't used frostwire or the other one in a while, I uninstalled them a while ago. As soon as my PC starts working I'll remove bitlord.

I uninstalled chrome the other day hoping that was where the problem was but apparently that didn't work. Should I just re install it now?

Natha .

[zep516]

No. We will install it later.


Tell me about this:

2015-06-26 17:31 - 2015-06-26 17:37 - 00000000 ____D C:\ProgramData\HitmanPro
2015-06-26 16:47 - 2015-06-26 16:47 - 00012221 _____ C:\ComboFix.txt
2015-06-26 16:30 - 2015-06-26 16:48 - 00000000 ____D C:\Qoobox
2015-06-26 16:59 - 2014-10-15 09:12 - 00000000 ____D C:\AdwCleaner

Was someone helping you on 6 / 26 / 2015 ? If not who ran all those malware programs on 6 / 26 / 2015. Or Have you been trying to fix this computer since last month.

[Ndavies19899]

I've had similar problem in the past but it seemed to go away.

Yes I ran those programmed after reading some forums. Now that it keeps hapenning I decided to get the proper help that I need by posting here myself. Im obviously doing something wrong.

[zep516]

Download the enclosed Fixlist.txt , Save it in the location FRST64 is (your desktop). Run FRST64 and click on the Fix button. Wait until finished.

The tool will make a log in the location FRST64 is,(your desktop). (Fixlog.txt) Please post it to your reply.

Attached Files

•  Fixlist.txt   12.13KB   232 downloads

[Ndavies19899]

I can't see a FRST64 on my desktop.

[zep516]

Looks like this,

[Ndavies19899]

It asks if I want to replace it?

[zep516]

Did you download the fixlist to desktop ? If so;

Then right click on FRST "Run as administrator" when FRST opens, click on fix button, it will make a log on your desktop called Fixlog.txt. Post that log.