Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

Checkup on my son's laptop please [Solved]

Started by AdamIsAdam , Oct 28 2015 08:06 PM

This topic is locked

#1
AdamIsAdam

Posted 28 October 2015 - 08:06 PM

Member

Member
191 posts

Hello Geeks,

My son's laptop seemed to have some malware despite my having installed MAB. I ran a scan and it cleaned up a bunch, but I wanted to post the logs here from FRST64 because Chrome seemed to have been attacked. Please let me know if we're good to go now. He had many issues of it running slowly, freezing, mouse / touchpad freezing (I found that it got switched to "disable" twice by itself somehow).

So without further delay, here are my scan logs...

TIA,

Adam

000000000000000000000000000

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:28-10-2015

Ran by adami_000 (administrator) on MAXROSENFELD (28-10-2015 21:57:39)

Running from C:\Users\adami_000\Desktop

Loaded Profiles: adami_000 (Available Profiles: adami_000)

Platform: Windows 8.1 (X64) Language: English (United States)

Internet Explorer Version 11 (Default browser: Chrome)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Intel Corporation) C:\Windows\System32\igfxCUIService.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe

(Microsoft Corporation) C:\Windows\System32\wlanext.exe

() C:\Program Files (x86)\Toshiba\PasswordUtility\GFNEXSrv.exe

(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

() C:\Program Files (x86)\Realtek\Realtek Bluetooth Filter Driver Package\BTDevMgr.exe

(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe

(Intel Corporation) C:\Windows\System32\DptfParticipantProcessorService.exe

(Intel Corporation) C:\Windows\System32\DptfPolicyCriticalService.exe

(Intel® Corporation) C:\Program Files\Intel\TXE Components\TCS\HeciServer.exe

(Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe

(Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

() C:\Program Files\CyberLink\Shared files\RichVideo64.exe

() C:\Program Files (x86)\Toshiba\TOSHIBA System Driver\TOSTABSYSSVC.exe

(RaMMicHaeL) C:\Program Files (x86)\Unchecky\bin\unchecky_svc.exe

(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe

(RaMMicHaeL) C:\Program Files (x86)\Unchecky\bin\unchecky_bg.exe

(Toshiba Corporation) C:\Program Files\TOSHIBA\Teco\TecoService.exe

(Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe

(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe

(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Teco\TecoResident.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe

(Microsoft Corporation) C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe

(Intel Corporation) C:\Windows\System32\igfxEM.exe

(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe

(Intel Corporation) C:\Windows\System32\igfxHK.exe

(Intel Corporation) C:\Windows\System32\igfxTray.exe

(Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe

() C:\Program Files (x86)\DTS, Inc\DTS Studio Sound\dts_apo_service.exe

(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe

(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe

(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\office15\onenotem.exe

(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe

(Microsoft Corporation) C:\Windows\ImmersiveControlPanel\SystemSettings.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe

(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Microsoft Corporation) C:\Windows\System32\WWAHost.exe

(Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe

(Farbar) C:\Users\adami_000\Desktop\FRST64 (1).exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [] => [X]

HKLM\...\Run: [TecoResident] => C:\Program Files\TOSHIBA\Teco\TecoResident.exe [179288 2014-04-17] (TOSHIBA Corporation)

HKLM\...\Run: [TCrdMain] => C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe [2556768 2013-10-08] (TOSHIBA Corporation)

HKLM\...\Run: [TSSSrv] => C:\Program Files (x86)\TOSHIBA\System Setting\TSSSrv.exe [296008 2013-10-21] (TOSHIBA Corporation)

HKLM\...\Run: [XboxStat] => C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe [825184 2009-09-30] (Microsoft Corporation)

HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [170256 2015-09-15] (Apple Inc.)

HKLM-x32\...\Run: [TSVU] => c:\Program Files\TOSHIBA\TOSHIBA Smart View Utility\TosSmartViewLauncher.exe [517536 2014-04-07] (TOSHIBA)

HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [335232 2015-04-10] (Oracle Corporation)

HKLM\...\Policies\Explorer: [NoFolderOptions] 0

HKLM\...\Policies\Explorer: [NoControlPanel] 0

HKU\S-1-5-21-1190642625-1873434813-491721638-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [31282304 2015-04-17] (Skype Technologies S.A.)

HKU\S-1-5-21-1190642625-1873434813-491721638-1001\Control Panel\Desktop\\SCRNSAVE.EXE ->

AppInit_DLLs: C:\PROGRA~2\SearchProtect\SearchProtect\bin\VC64Loader.dll => No File

AppInit_DLLs-x32: C:\PROGRA~2\SearchProtect\SearchProtect\bin\VC32Loader.dll => No File

Startup: C:\Users\adami_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Send to OneNote.lnk [2015-04-22]

ShortcutTarget: Send to OneNote.lnk -> C:\Program Files\Microsoft Office 15\root\office15\onenotem.exe (Microsoft Corporation)

CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

Tcpip\..\Interfaces\{2B081AA9-3B6C-428F-99B9-75FB8DDA31D7}: [DhcpNameServer] 192.168.1.1

Tcpip\..\Interfaces\{EB8F5A40-DF39-4564-97BF-9485A6FE679E}: [DhcpNameServer] 192.168.168.1

Internet Explorer:

==================

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/?pc=MSE1

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/?pc=MSE1

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://toshiba13.msn.com/?pc=TNJB

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://toshiba13.msn.com/?pc=TNJB

HKU\S-1-5-21-1190642625-1873434813-491721638-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://toshiba13.msn.com/?pc=TNJB

HKU\S-1-5-21-1190642625-1873434813-491721638-1001\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://mystart.toshiba.com

SearchScopes: HKLM -> {105EC9BF-C5FC-429A-80DA-B7D7AAFD3C20} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSE1

SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =

SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =

SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =

SearchScopes: HKU\S-1-5-21-1190642625-1873434813-491721638-1001 -> {0C181DD7-EC66-11E4-826C-D61CB079928F} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSE1

SearchScopes: HKU\S-1-5-21-1190642625-1873434813-491721638-1001 -> {105EC9BF-C5FC-429A-80DA-B7D7AAFD3C20} URL =

SearchScopes: HKU\S-1-5-21-1190642625-1873434813-491721638-1001 -> {8CDE19E6-71C2-4B46-89B7-35F6A18C571A} URL =

BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2015-09-29] (Microsoft Corporation)

BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2015-10-28] (Microsoft Corporation)

BHO-x32: Adobe PDF Reader Link Helper -> {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2012-09-23] (Adobe Systems Incorporated)

BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\ssv.dll [2015-04-29] (Oracle Corporation)

BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-04-29] (Oracle Corporation)

Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2015-05-18] (Microsoft Corporation)

StartMenuInternet: IEXPLORE.EXE - iexplore.exe

FireFox:

========

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_179.dll [2014-12-22] ()

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_179.dll [2014-12-22] ()

FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-10-30] ()

FF Plugin-x32: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-04-29] (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-04-29] (Oracle Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2015-05-18] (Microsoft Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-17] (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-17] (Google Inc.)

FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-05-08] (Adobe Systems Inc.)

Chrome:

=======

CHR dev: Chrome dev build detected! <======= ATTENTION

CHR HomePage: Default -> hxxp://google.com/

CHR Profile: C:\Users\adami_000\AppData\Local\Google\Chrome\User Data\Default

CHR Extension: (YouTube) - C:\Users\adami_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-09-29]

CHR Extension: (Google Search) - C:\Users\adami_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-05-18]

CHR Extension: (Google Docs Offline) - C:\Users\adami_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2015-09-17]

CHR Extension: (Gmail) - C:\Users\adami_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-05-18]

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77104 2015-09-02] (Apple Inc.)

R2 BTDevManager; C:\Program Files (x86)\REALTEK\Realtek Bluetooth Filter Driver Package\BTDevMgr.exe [121856 2014-07-15] () [File not signed]

R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2780856 2015-10-07] (Microsoft Corporation)

R2 DptfParticipantAcpiProcessorService; C:\Windows\system32\DptfParticipantProcessorService.exe [117704 2013-09-17] (Intel Corporation)

R2 DptfPolicyCriticalService; C:\Windows\system32\DptfPolicyCriticalService.exe [150760 2013-09-17] (Intel Corporation)

R3 dts_apo_service; C:\Program Files (x86)\DTS, Inc\DTS Studio Sound\dts_apo_service.exe [21816 2014-08-26] ()

R2 GFNEXSrv; C:\Program Files (x86)\Toshiba\PasswordUtility\GFNEXSrv.exe [163168 2013-03-27] ()

R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [318568 2014-08-21] (Intel Corporation)

R2 Intel® Capability Licensing Service Interface; C:\Program Files\Intel\TXE Components\TCS\HeciServer.exe [733696 2013-07-02] (Intel® Corporation) [File not signed]

S3 Intel® Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\TXE Components\TCS\SocketHeciServer.exe [822232 2013-07-02] (Intel® Corporation)

R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1513784 2015-10-05] (Malwarebytes)

R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1135416 2015-10-05] (Malwarebytes)

S2 mfecore; C:\Program Files\Common Files\McAfee\AMCore\mcshield.exe [1050952 2014-11-06] (McAfee, Inc.)

R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [390632 2012-04-24] ()

R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [291032 2014-08-18] (Realtek Semiconductor)

R2 TOSTABSYSSVC; C:\Program Files (x86)\TOSHIBA\TOSHIBA System Driver\TOSTABSYSSVC.exe [34680 2014-08-01] ()

R2 Unchecky; C:\Program Files (x86)\Unchecky\bin\Unchecky_svc.exe [241400 2015-10-15] (RaMMicHaeL)

R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366552 2015-07-07] (Microsoft Corporation)

R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2015-07-07] (Microsoft Corporation)

S2 McNaiAnn; "C:\Program Files\Common Files\McAfee\platform\McSvcHost\McSvHost.exe" /McCoreSvc [X]

S3 McODS; "C:\ProgramData\McAfee\Update\Installs\pkg_default\Download_Files\default\vso\vso_li_cat\%VSINSTALL_DIR64%\mcods.exe" [X]

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 AX88179; C:\Windows\system32\DRIVERS\ax88179_178a.sys [70104 2013-07-08] (ASIX Electronics Corp.)

S3 AX88772; C:\Windows\system32\DRIVERS\ax88772.sys [113864 2013-07-18] (ASIX Electronics Corp.)

S3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [226304 2014-03-18] (Microsoft Corporation)

S3 dot4; C:\Windows\system32\DRIVERS\Dot4.sys [151968 2012-10-19] (Windows ® Win 7 DDK provider)

S3 Dot4Print; C:\Windows\System32\drivers\Dot4Prt.sys [27040 2012-10-19] (Windows ® Win 7 DDK provider)

R3 DptfDevAcpiProc; C:\Windows\system32\DRIVERS\DptfDevAcpiProc.sys [198808 2013-09-17] (Intel Corporation)

R3 DptfManager; C:\Windows\system32\DRIVERS\DptfManager.sys [493240 2013-09-17] (Intel Corporation)

S0 ebdrv; C:\Windows\System32\drivers\evbda.sys [3357024 2013-08-22] (Broadcom Corporation)

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-10-05] (Malwarebytes)

R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [192216 2015-10-28] (Malwarebytes)

R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64216 2015-10-05] (Malwarebytes Corporation)

R0 MBI; C:\Windows\System32\drivers\MBI.sys [29464 2013-10-10] (Intel Corporation)

S3 mfencbdc; C:\Windows\system32\DRIVERS\mfencbdc.sys [447440 2014-09-19] (McAfee, Inc.)

S3 mfencrk; C:\Windows\system32\DRIVERS\mfencrk.sys [96600 2014-09-19] (McAfee, Inc.)

R2 PEGAGFN; C:\Program Files (x86)\Toshiba\PasswordUtility\PEGAGFN.sys [14344 2009-09-11] (PEGATRON)

R3 RtkBtFilter2; C:\Windows\system32\DRIVERS\RtkBtfilter.sys [48856 2013-09-05] (Realtek Microelectronics)

R3 RTWlanE; C:\Windows\system32\DRIVERS\rtwlane.sys [3560664 2014-09-05] (Realtek Semiconductor Corporation )

R3 SensorsServiceDriver; C:\Windows\System32\drivers\WUDFRd.sys [226304 2014-10-28] (Microsoft Corporation)

R3 Thotkey; C:\Windows\System32\drivers\Thotkey.sys [27136 2014-03-24] (Windows ® Win 7 DDK provider)

R3 TXEIx64; C:\Windows\System32\drivers\TXEIx64.sys [88592 2014-01-15] (Intel Corporation)

S0 WdBoot; C:\Windows\System32\drivers\WdBoot.sys [44560 2015-07-07] (Microsoft Corporation)

R0 WdFilter; C:\Windows\System32\drivers\WdFilter.sys [270168 2015-07-07] (Microsoft Corporation)

R2 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114520 2015-07-07] (Microsoft Corporation)

S1 BAPIDRV; system32\DRIVERS\BAPIDRV64.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-10-28 21:57 - 2015-10-28 21:58 - 00017162 _____ C:\Users\adami_000\Desktop\FRST.txt

2015-10-28 21:55 - 2015-10-28 21:57 - 00000000 ____D C:\FRST

2015-10-28 21:54 - 2015-10-28 21:54 - 02197504 _____ (Farbar) C:\Users\adami_000\Downloads\FRST64 (2).exe

2015-10-28 21:54 - 2015-10-28 21:54 - 02197504 _____ (Farbar) C:\Users\adami_000\Desktop\FRST64 (1).exe

2015-10-28 21:52 - 2015-10-28 21:52 - 02197504 _____ (Farbar) C:\Users\adami_000\Downloads\FRST64.exe

2015-10-28 21:16 - 2015-10-28 21:16 - 06341384 _____ (ParetoLogic Inc.) C:\Users\adami_000\Downloads\PCHASetup.exe

2015-10-15 16:54 - 2015-09-29 08:31 - 07457624 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe

2015-10-15 16:54 - 2015-09-29 08:31 - 01658536 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi

2015-10-15 16:54 - 2015-09-29 08:31 - 01519592 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe

2015-10-15 16:54 - 2015-09-29 08:31 - 01487008 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi

2015-10-15 16:54 - 2015-09-29 08:31 - 01355848 _____ (Microsoft Corporation) C:\Windows\system32\winresume.exe

2015-10-15 16:54 - 2015-09-24 12:42 - 00348672 _____ (Microsoft Corporation) C:\Windows\system32\bdesvc.dll

2015-10-15 16:54 - 2015-09-24 12:40 - 00737280 _____ (Microsoft Corporation) C:\Windows\system32\fveapi.dll

2015-10-15 16:54 - 2015-08-26 22:43 - 22372152 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll

2015-10-15 16:54 - 2015-08-26 22:42 - 19795904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll

2015-10-15 16:54 - 2015-08-07 17:40 - 01736520 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll

2015-10-15 16:54 - 2015-08-07 17:40 - 01499920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll

2015-10-15 16:53 - 2015-09-10 14:02 - 25851392 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2015-10-15 16:53 - 2015-09-10 13:19 - 00585728 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2015-10-15 16:53 - 2015-09-10 13:18 - 02886656 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2015-10-15 16:53 - 2015-09-10 13:18 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll

2015-10-15 16:53 - 2015-09-10 13:14 - 05990400 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2015-10-15 16:53 - 2015-09-10 13:09 - 20358144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2015-10-15 16:53 - 2015-09-10 13:06 - 00616960 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2015-10-15 16:53 - 2015-09-10 13:04 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll

2015-10-15 16:53 - 2015-09-10 12:51 - 00489984 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll

2015-10-15 16:53 - 2015-09-10 12:39 - 00504832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2015-10-15 16:53 - 2015-09-10 12:37 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2015-10-15 16:53 - 2015-09-10 12:37 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll

2015-10-15 16:53 - 2015-09-10 12:35 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2015-10-15 16:53 - 2015-09-10 12:33 - 02279936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2015-10-15 16:53 - 2015-09-10 12:28 - 01032704 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll

2015-10-15 16:53 - 2015-09-10 12:28 - 00480256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2015-10-15 16:53 - 2015-09-10 12:27 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll

2015-10-15 16:53 - 2015-09-10 12:24 - 14456832 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2015-10-15 16:53 - 2015-09-10 12:21 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll

2015-10-15 16:53 - 2015-09-10 12:19 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2015-10-15 16:53 - 2015-09-10 12:19 - 00720896 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2015-10-15 16:53 - 2015-09-10 12:19 - 00374784 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll

2015-10-15 16:53 - 2015-09-10 12:17 - 02126336 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2015-10-15 16:53 - 2015-09-10 12:17 - 00416256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll

2015-10-15 16:53 - 2015-09-10 12:07 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2015-10-15 16:53 - 2015-09-10 12:05 - 00279040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll

2015-10-15 16:53 - 2015-09-10 12:02 - 04527616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2015-10-15 16:53 - 2015-09-10 12:01 - 00880128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll

2015-10-15 16:53 - 2015-09-10 12:00 - 12853760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2015-10-15 16:53 - 2015-09-10 11:57 - 02487808 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2015-10-15 16:53 - 2015-09-10 11:57 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll

2015-10-15 16:53 - 2015-09-10 11:55 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2015-10-15 16:53 - 2015-09-10 11:55 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2015-10-15 16:53 - 2015-09-10 11:55 - 00327168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll

2015-10-15 16:53 - 2015-09-10 11:45 - 01546752 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2015-10-15 16:53 - 2015-09-10 11:34 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2015-10-15 16:53 - 2015-09-10 11:31 - 02011136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2015-10-15 16:53 - 2015-09-10 11:27 - 01311232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2015-10-15 16:53 - 2015-09-10 11:26 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2015-10-15 16:51 - 2015-09-29 08:29 - 00136904 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe

2015-10-15 16:51 - 2015-09-28 14:45 - 03705344 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll

2015-10-15 16:51 - 2015-09-28 14:26 - 00409088 _____ (Microsoft Corporation) C:\Windows\system32\WUSettingsProvider.dll

2015-10-15 16:51 - 2015-09-28 14:25 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll

2015-10-15 16:51 - 2015-09-28 14:25 - 00095744 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll

2015-10-15 16:51 - 2015-09-28 14:25 - 00035840 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe

2015-10-15 16:51 - 2015-09-28 14:22 - 00124928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll

2015-10-15 16:51 - 2015-09-28 14:22 - 00081920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll

2015-10-15 16:51 - 2015-09-28 14:22 - 00029696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe

2015-10-15 16:51 - 2015-09-28 14:15 - 02243072 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll

2015-10-15 16:51 - 2015-09-28 14:13 - 00891904 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll

2015-10-15 16:51 - 2015-09-28 14:12 - 00721920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-10-28 21:55 - 2014-12-22 08:52 - 02071940 _____ C:\Windows\WindowsUpdate.log

2015-10-28 21:41 - 2013-08-22 11:36 - 00000000 ____D C:\Windows\system32\sru

2015-10-28 21:34 - 2015-04-18 16:35 - 00003596 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1190642625-1873434813-491721638-1001

2015-10-28 21:31 - 2015-09-17 16:25 - 00000932 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2015-10-28 21:30 - 2015-05-18 14:46 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2015-10-28 21:30 - 2015-04-18 16:52 - 00000000 __RDO C:\Users\adami_000\OneDrive

2015-10-28 21:29 - 2015-09-17 16:25 - 00000928 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2015-10-28 21:28 - 2014-03-18 05:44 - 00497688 _____ C:\Windows\PFRO.log

2015-10-28 21:28 - 2013-08-22 10:46 - 00047331 _____ C:\Windows\setupact.log

2015-10-28 21:28 - 2013-08-22 10:45 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2015-10-28 21:27 - 2014-12-22 09:29 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job

2015-10-28 21:27 - 2013-08-22 09:25 - 00524288 ___SH C:\Windows\system32\config\BBI

2015-10-28 21:26 - 2013-08-22 11:20 - 00000000 ____D C:\Windows\CbsTemp

2015-10-28 21:24 - 2015-04-19 07:27 - 00000000 ____D C:\Users\adami_000\AppData\Roaming\Skype

2015-10-28 21:21 - 2013-08-22 11:36 - 00000000 __RSD C:\Windows\Media

2015-10-28 20:54 - 2015-04-21 19:33 - 00000000 ____D C:\Program Files\Microsoft Office 15

2015-10-28 20:35 - 2015-05-18 14:45 - 00001085 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2015-10-28 20:35 - 2015-05-18 14:45 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2015-10-28 20:35 - 2015-05-18 14:45 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware

2015-10-28 10:14 - 2013-08-22 11:36 - 00000000 ___RD C:\Windows\ToastData

2015-10-28 10:11 - 2015-04-18 16:24 - 00000000 ____D C:\Users\adami_000

2015-10-28 09:45 - 2013-08-22 11:36 - 00000000 ____D C:\Windows\AppReadiness

2015-10-16 00:51 - 2013-08-22 11:38 - 00810488 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2015-10-16 00:51 - 2013-08-22 11:38 - 00176632 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2015-10-15 16:28 - 2015-05-22 20:39 - 00000000 ____D C:\Program Files (x86)\Unchecky

2015-10-05 09:50 - 2015-05-18 14:45 - 00109272 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamchameleon.sys

2015-10-05 09:50 - 2015-05-18 14:45 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2015-10-05 09:50 - 2015-05-18 14:45 - 00025816 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys

2015-10-04 17:14 - 2015-04-18 16:29 - 00000000 ____D C:\Users\adami_000\AppData\Local\Packages

2015-10-01 16:52 - 2015-04-18 19:13 - 00000000 ____D C:\Users\adami_000\Desktop\other computer files

==================== Files in the root of some directories =======

2014-12-22 09:01 - 2014-12-22 09:01 - 0000000 ____H () C:\ProgramData\DP45977C.lfl

2014-12-22 09:29 - 2014-12-22 09:29 - 0000123 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.400.64.bc

==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed

C:\Windows\system32\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\system32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\system32\services.exe => File is digitally signed

C:\Windows\system32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\system32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\system32\rpcss.dll => File is digitally signed

C:\Windows\system32\dnsapi.dll => File is digitally signed

C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed

C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2015-10-28 09:54

==================== End of FRST.txt ============================

Additional scan result of Farbar Recovery Scan Tool (x64) Version:28-10-2015

Ran by adami_000 (2015-10-28 21:59:34)

Running from C:\Users\adami_000\Desktop

Windows 8.1 (X64) (2015-04-18 20:28:07)

Boot Mode: Normal

==========================================================

==================== Accounts: =============================

adami_000 (S-1-5-21-1190642625-1873434813-491721638-1001 - Administrator - Enabled) => C:\Users\adami_000

Administrator (S-1-5-21-1190642625-1873434813-491721638-500 - Administrator - Disabled)

Guest (S-1-5-21-1190642625-1873434813-491721638-501 - Limited - Disabled)

HomeGroupUser$ (S-1-5-21-1190642625-1873434813-491721638-1003 - Limited - Enabled)

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Acrobat 5.0 (HKLM-x32\...\Adobe Acrobat 5.0) (Version: 5.0 - Adobe Systems, Inc.)

Adobe Flash Player 14 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 14.0.0.179 - Adobe Systems Incorporated)

Adobe Reader XI (11.0.07) MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AB0000000001}) (Version: 11.0.07 - Adobe Systems Incorporated)

Amazon 1Button App (HKLM-x32\...\{4D875057-4353-4B8F-93E5-8C3DC7F34EA9}) (Version: 1.0.8 - Amazon)

Apple Application Support (32-bit) (HKLM-x32\...\{3540ADD5-822B-47FB-B1C2-CD7B2C8E9FEC}) (Version: 4.0.2 - Apple Inc.)

Apple Application Support (64-bit) (HKLM\...\{C9C0FE2C-602E-49D7-8C42-5B9E8FF04798}) (Version: 4.0.2 - Apple Inc.)

Apple Mobile Device Support (HKLM\...\{FD244E19-6EFE-4A2D-948A-0D45D4C168BE}) (Version: 9.0.0.26 - Apple Inc.)

Apple Software Update (HKLM-x32\...\{FFD1F7F1-1AC9-4BC4-A908-0686D635ABAF}) (Version: 2.1.4.131 - Apple Inc.)

Bonjour (HKLM\...\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}) (Version: 3.1.0.1 - Apple Inc.)

bRowseandshop (HKLM-x32\...\{B54A674B-5B6E-A4E6-4E71-FB7182E9D18F}) (Version: - "") <==== ATTENTION

Cisco EAP-FAST Module (HKLM-x32\...\{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}) (Version: 2.2.14 - Cisco Systems, Inc.)

Cisco LEAP Module (HKLM-x32\...\{AF312B06-5C5C-468E-89B3-BE6DE2645722}) (Version: 1.0.19 - Cisco Systems, Inc.)

Cisco PEAP Module (HKLM-x32\...\{0A4EF0E6-A912-4CDE-A7F3-6E56E7C13A2F}) (Version: 1.1.6 - Cisco Systems, Inc.)

CyberLink PhotoDirector 3 (HKLM-x32\...\InstallShield_{39337565-330E-4ab6-A9AE-AC81E0720B10}) (Version: 3.0.1.5501 - CyberLink Corp.)

CyberLink PowerDirector 10 (HKLM-x32\...\InstallShield_{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}) (Version: 10.0.0.4220 - CyberLink Corp.)

CyberLink PowerDirector 10 (Version: 10.0.0.4220 - CyberLink Corp.) Hidden

DTS Sound (HKLM-x32\...\{85D86047-2FD3-47D5-88E5-D0255903533F}) (Version: 1.01.9500 - DTS, Inc.)

FarmVille 2 (HKU\S-1-5-21-1190642625-1873434813-491721638-1001\...\Pokki_34e8f5c0c9e5744bf2cdb514283762dd0524776b) (Version: 1.0.4.55785 - Pokki)

globalupdate Helper (x32 Version: 1.3.25.0 - globalupdate Inc.) Hidden <==== ATTENTION

Google Chrome (HKLM-x32\...\Google Chrome) (Version: 46.0.2490.80 - Google Inc.)

Google Update Helper (x32 Version: 1.3.28.15 - Google Inc.) Hidden

IMG inspector (HKLM-x32\...\{BDA14B0B-4672-3ABF-B189-A5958FE3A42F}) (Version: - "") <==== ATTENTION

Intel® Dynamic Platform and Thermal Framework (HKLM-x32\...\FFD10ECE-F715-4a86-9BD8-F6F47DA5DA1C) (Version: 7.10.0.2208 - Intel Corporation)

Intel® Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3910 - Intel Corporation)

Intel® Sideband Fabric Device Driver (HKLM-x32\...\C5A8BC6E-723A-4C0F-96E1-C426D1A4BCA9) (Version: 1.70.305.16316 - Intel Corporation)

Intel® Trusted Execution Engine (HKLM\...\{176E2755-0A17-42C6-88E2-192AB2131278}) (Version: 1.0.0.1064 - Intel Corporation)

iTunes (HKLM\...\{88509E20-3936-4D88-A1C0-B274C7BB5151}) (Version: 12.3.0.44 - Apple Inc.)

Java 8 Update 45 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218045F0}) (Version: 8.0.450 - Oracle Corporation)

LightningDownloader (HKLM-x32\...\{0F44DC3H-6E62-4961-A14B-95323C512F9B}_is1) (Version: 1.0 - LightningDownloader)

Malwarebytes Anti-Malware version 2.2.0.1024 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.0.1024 - Malwarebytes)

Microsoft Office Home and Student 2013 - en-us (HKLM\...\HomeStudentRetail - en-us) (Version: 15.0.4763.1003 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)

Microsoft Xbox 360 Accessories 1.2 (HKLM\...\{D9C50188-12D5-4D3E-8F00-682346C2AA5F}) (Version: 1.20.146.0 - Microsoft)

Microsoft XNA Framework Redistributable 4.0 (HKLM-x32\...\{2BFC7AA0-544C-4E3A-8796-67F3BE655BE9}) (Version: 4.0.20823.0 - Microsoft Corporation)

Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4763.1003 - Microsoft Corporation) Hidden

Office 15 Click-to-Run Licensing Component (Version: 15.0.4763.1003 - Microsoft Corporation) Hidden

Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4763.1003 - Microsoft Corporation) Hidden

QuickTime (HKLM-x32\...\QuickTime) (Version: - )

Realtek Bluetooth Filter Driver Package (HKLM-x32\...\InstallShield_{0CC0980D-811D-43B8-A455-8D150EB5BC0D}) (Version: 12.32.2014.0722 - REALTEK Semiconductor Corp)

Realtek Bluetooth Filter Driver Package (x32 Version: 12.32.2014.0722 - REALTEK Semiconductor Corp) Hidden

Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.3.9600.39060 - Realtek Semiconductor Corp.)

Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7329 - Realtek Semiconductor Corp.)

REALTEK Wireless LAN Driver (HKLM-x32\...\InstallShield_{95F38874-065A-40AB-AFC1-B764B192FFE7}) (Version: 2.00.0003 - REALTEK Semiconductor Corp.)

REALTEK Wireless LAN Driver (x32 Version: 2.00.0003 - REALTEK Semiconductor Corp.) Hidden

Skype™ 7.4 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.4.102 - Skype Technologies S.A.)

Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 18.1.8.2 - Synaptics Incorporated)

TOSHIBA Application Installer (HKLM\...\{21A63CA3-75C0-4E56-B602-B7CD2EF6B621}) (Version: 9.0.2.6 - Toshiba Corporation)

TOSHIBA Audio Enhancement (HKLM\...\{1515F5E3-29EA-4CD1-A981-032D88880F09}) (Version: 2.0.18.3 - Toshiba Corporation)

TOSHIBA Display Utility (HKLM\...\{B9A67DC9-EAD3-4B87-B733-F2BA28F0D68E}) (Version: 1.2.4.0 - Toshiba Corporation)

TOSHIBA eco Utility (HKLM\...\{94D2A899-0C34-4420-880E-AE337E635AB0}) (Version: 2.5.3.6401 - Toshiba Corporation)

TOSHIBA Function Key (HKLM\...\{1844CFE2-EBA3-490A-8A5E-9BFC646342FD}) (Version: 1.1.5.6402 - Toshiba Corporation)

TOSHIBA Password Utility (HKLM-x32\...\InstallShield_{78931270-BC9E-441A-A52B-73ECD4ACFAB5}) (Version: 4.10.000 - Toshiba Corporation)

TOSHIBA Recovery Media Creator (HKLM-x32\...\{B65BBB06-1F8E-48F5-8A54-B024A9E15FDF}) (Version: 3.2.01.56006006 - Toshiba Corporation)

TOSHIBA Service Station (HKLM\...\{0DFA8761-7735-4DE8-A0EB-2286578DCFC6}) (Version: 2.6.14 - Toshiba Corporation)

TOSHIBA System Driver (HKLM-x32\...\{1E6A96A1-2BAB-43EF-8087-30437593C66C}) (Version: 1.00.0041 - Toshiba Corporation)

TOSHIBA System Settings (HKLM-x32\...\{4D57ED72-6B01-40BD-9CA9-012B8FC09CEB}) (Version: 2.0.5.32002 - Toshiba Corporation)

TOSHIBA User's Guide (HKLM-x32\...\{3384E1D9-3F18-4A98-8655-180FEF0DFC02}) (Version: 1.00.02 - TOSHIBA)

TOSHIBARegistration (HKLM-x32\...\{5AF550B4-BB67-4E7E-82F1-2C4300279050}) (Version: 1.1.6 - TOSHIBA)

Unchecky v0.4 (HKLM-x32\...\Unchecky) (Version: 0.4 - RaMMicHaeL)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== Restore Points =========================

20-09-2015 18:43:16 Windows Update

27-09-2015 16:20:30 Windows Update

28-10-2015 09:55:10 Windows Update

28-10-2015 20:38:17 Chrome Cleanup Tool

==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 09:25 - 2015-10-28 21:29 - 00003195 ____A C:\Windows\system32\Drivers\etc\hosts

⌠䍯灹物杨琠⡣⤠ㄹ㤳ⴲ〰㤠䵩捲潳潦琠䍯牰⸍ਣഊ⌠周楳⁩猠愠獡浰汥⁈体呓⁦楬攠畳敤⁢礠䵩捲潳潦琠呃倯䥐⁦潲⁗楮摯睳⸍ਣഊ⌠周楳⁦楬攠捯湴慩湳⁴桥⁭慰灩湧猠潦⁉倠慤摲敳獥猠瑯⁨潳琠湡浥献⁅慣栍ਣ⁥湴特⁳桯畬搠扥⁫数琠潮⁡渠楮摩癩摵慬⁬楮攮⁔桥⁉倠慤摲敳猠獨潵汤ഊ⌠扥⁰污捥搠楮⁴桥⁦楲獴⁣潬畭渠景汬潷敤⁢礠瑨攠捯牲敳灯湤楮朠桯獴⁮慭攮ഊ⌠周攠䥐⁡摤牥獳⁡湤⁴桥⁨潳琠湡浥⁳桯畬搠扥⁳数慲慴敤⁢礠慴⁬敡獴⁯湥ഊ⌠獰慣攮ഊ⌍ਣ⁁摤楴楯湡汬礬⁣潭浥湴猠⡳畣栠慳⁴桥獥⤠浡礠扥⁩湳敲瑥搠潮⁩湤楶楤畡氍ਣ⁬楮敳⁯爠景汬潷楮朠瑨攠浡捨楮攠湡浥⁤敮潴敤⁢礠愠✣✠獹浢潬⸍ਣഊ⌠䙯爠數慭灬攺ഊ⌍ਣ†††㄰㈮㔴⸹㐮㤷††⁲桩湯⹡捭攮捯洠††††‣⁳潵牣攠獥牶敲ഊ⌠†††㌸⸲㔮㘳⸱〠††砮慣浥⹣潭†††††††⌠砠捬楥湴⁨潳琍਍ਣ⁬潣慬桯獴⁮慭攠牥獯汵瑩潮⁩猠桡湤汥搠睩瑨楮⁄乓⁩瑳敬昮ഊ⌉ㄲ㜮〮〮ㄠ†††汯捡汨潳琍ਣऺ㨱††††††⁬潣慬桯獴ഊ

਍ਣ⁵湣桥捫祟扥杩渍ਣ⁔桥獥⁲畬敳⁷敲攠慤摥搠批⁴桥⁕湣桥捫礠灲潧牡洠楮⁯牤敲⁴漠扬潣欠慤癥牴楳楮朠獯晴睡牥⁭潤畬敳ഊ〮〮〮〠〮〮〮〠⌠晩砠景爠瑲慣敲潵瑥⁡湤⁮整獴慴⁤楳灬慹⁡湯浡汹ഊ〮〮〮〠瑲慣歩湧⹯灥湣慮摹⹣潭⹳㌮慭慺潮慷献捯洍ਰ⸰⸰⸰⁭敤楡⹯灥湣慮摹⹣潭ഊ〮〮〮〠捤渮潰敮捡湤礮捯洍ਰ⸰⸰⸰⁴牡捫楮朮潰敮捡湤礮捯洍ਰ⸰⸰⸰⁡灩⹯灥湣慮摹⹣潭ഊ〮〮〮〠慰椮牥捯浭敮摥摳眮捯洍ਰ⸰⸰⸰⁩湳瑡汬敲⹢整瑥物湳瑡汬敲⹣潭ഊ〮〮〮〠楮獴慬汥爮晩汥扵汬摯朮捯洍ਰ⸰⸰⸰⁤㍯硴渱砳戸搷椮捬潵摦牯湴⹮整ഊ〮〮〮〠楮湯⹢楳牶⹣潭ഊ〮〮〮〠湳楳⹢楳牶⹣潭ഊ〮〮〮〠捤渮晩汥㉤敳歴潰⹣潭ഊ〮〮〮〠捤渮杯慴敡獴捡捨⹵猍ਰ⸰⸰⸰⁣摮⹧畴瑡獴慴摫⹵猍ਰ⸰⸰⸰⁣摮⹩湳歩湭敤楡⹣潭ഊ〮〮〮〠捤渮楮獴愮潩扵湤汥猲⹣潭ഊ〮〮〮〠捤渮楮獴愮灬慹扲祴攮捯洍ਰ⸰⸰⸰⁣摮⹬汯来瑦慳瑣慣栮畳ഊ〮〮〮〠捤渮浯湴楥牡⹣潭ഊ〮〮〮〠捤渮浳摷湬搮捯洍ਰ⸰⸰⸰⁣摮⹭祰换慣歵瀮捯洍ਰ⸰⸰⸰⁣摮⹰灤潷湬潡搮捯洍ਰ⸰⸰⸰⁣摮⹲楣敡瑥慳瑣慣栮畳ഊ〮〮〮〠捤渮獨祡灯瑡瑯⹵猍ਰ⸰⸰⸰⁣摮⹳潬業扡⹣潭ഊ〮〮〮〠捤渮瑵瑯㑰挮捯洍ਰ⸰⸰⸰⁣摮⹡灰牯畮搮扩稍ਰ⸰⸰⸰⁣摮⹢楧獰敥摰牯⹣潭ഊ〮〮〮〠捤渮扩獰搮捯洍ਰ⸰⸰⸰⁣摮⹢楳牶⹣潭ഊ〮〮〮〠捤渮捤湤瀮捯洍ਰ⸰⸰⸰⁣摮⹤潷湬潡搮獷敥瑰慣歳⹣潭ഊ〮〮〮〠捤渮摰摯睮汯慤⹣潭ഊ〮〮〮〠捤渮癩獵慬扥攮湥琍ਣ⁵湣桥捫祟敮損

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {172637BE-1FB7-4F9A-A68C-18D2310AD12D} - System32\Tasks\RTKCPL => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [2014-08-14] (Realtek Semiconductor)

Task: {18E4AA4F-15CE-41E6-8165-8F35934CB331} - \avabvbavad -> No File <==== ATTENTION

Task: {3688301E-B7D9-42CA-9DA7-1129F533082B} - System32\Tasks\dts_apo_service_task => C:\Program Files (x86)\DTS, Inc\DTS Studio Sound\dts_apo_task.exe [2014-08-26] ()

Task: {3DF6F529-47E4-428B-989E-59DABE59180A} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-09-17] (Google Inc.)

Task: {4CA8CEA1-CA7C-4FD7-8986-E6E7ED434057} - System32\Tasks\Synaptics TouchPad Enhancements => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2014-04-12] (Synaptics Incorporated)

Task: {516614EF-A98F-4B2E-9111-025773E70CD5} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-10-07] (Microsoft Corporation)

Task: {5217491F-C40D-4096-91AA-EFA8AC22244C} - \{1C034622-AC42-44C3-806D-C4B5EA6CBDEC} -> No File <==== ATTENTION

Task: {5F2FE496-9AC2-4A3B-A98F-E94352A444CC} - System32\Tasks\PostPoneInstall => C:\Users\ADAMI_~1\AppData\Local\Temp\ce98ac2e-20c0-4a93-86f6-bdb3e61caf55.exe <==== ATTENTION

Task: {66643637-79A1-4F64-886E-B97F1D2DBEC8} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-10-07] (Microsoft Corporation)

Task: {8FD63B8E-A5DD-47C8-B749-CE9C419CC501} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-12-22] (Adobe Systems Incorporated)

Task: {B2E8BE22-B1E2-476F-894F-DF6B3C0F3AD0} - System32\Tasks\TOSHIBA\Service Station => C:\Program Files\TOSHIBA\Toshiba Service Station\ToshibaServiceStation.exe [2014-04-03] (TOSHIBA Corporation)

Task: {BB832825-029E-4663-A2DA-3E279FB41DDD} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-09-17] (Google Inc.)

Task: {CA87409D-365F-4AA5-8AF6-CD97FFE5B41A} - \Run_Bobby_Browser -> No File <==== ATTENTION

Task: {D97DB3A7-0DDF-4662-8ADD-A8F2E04104F1} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2015-08-27] (Apple Inc.)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (Whitelisted) ==============

2013-03-27 16:53 - 2013-03-27 16:53 - 00163168 _____ () C:\Program Files (x86)\Toshiba\PasswordUtility\GFNEXSrv.exe

2015-03-20 21:12 - 2015-03-20 21:12 - 00085832 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll

2015-09-15 14:25 - 2015-09-15 14:25 - 01328912 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll

2014-07-15 23:44 - 2014-07-15 23:44 - 00121856 _____ () C:\Program Files (x86)\REALTEK\Realtek Bluetooth Filter Driver Package\BTDevMgr.exe

2015-05-22 19:23 - 2015-10-07 19:28 - 00105640 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll

2015-10-28 20:53 - 2015-09-01 12:04 - 08901184 _____ () C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\1033\GrooveIntlResource.dll

2014-12-22 09:37 - 2012-04-24 06:43 - 00390632 _____ () C:\Program Files\CyberLink\Shared files\RichVideo64.exe

2014-08-01 19:54 - 2014-08-01 19:54 - 00034680 _____ () C:\Program Files (x86)\TOSHIBA\TOSHIBA System Driver\TOSTABSYSSVC.exe

2012-07-18 22:38 - 2012-07-18 22:38 - 00020904 _____ () C:\Program Files\TOSHIBA\Hotkey\SmoothView.dll

2014-08-26 21:38 - 2014-08-26 21:38 - 00021816 _____ () C:\Program Files (x86)\DTS, Inc\DTS Studio Sound\dts_apo_service.exe

2015-05-05 16:45 - 2015-05-18 21:51 - 00316576 _____ () C:\Program Files\Microsoft Office 15\root\office15\AppVIsvStream32.dll

2015-10-28 20:35 - 2015-10-20 10:08 - 01532744 _____ () C:\Program Files (x86)\Google\Chrome\Application\46.0.2490.80\libglesv2.dll

2015-10-28 20:35 - 2015-10-20 10:08 - 00081224 _____ () C:\Program Files (x86)\Google\Chrome\Application\46.0.2490.80\libegl.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => ""=""

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MCODS => ""=""

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""

==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)

==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-1190642625-1873434813-491721638-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\adami_000\Desktop\under water walking\DSCN3606.JPG

DNS Servers: 192.168.1.1

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)

Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139

FirewallRules: [{5607A2E7-6A6D-4D0D-876E-56E75D2A8E90}] => (Allow) C:\Program Files (x86)\Spotify\spotify.exe

FirewallRules: [{91C812FA-C924-430B-A6C7-44EBB348EC57}] => (Allow) C:\Program Files (x86)\Spotify\spotify.exe

FirewallRules: [{F0506D8E-F6FF-4545-842C-2EFD6A683054}] => (Allow) C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe

FirewallRules: [{70CCE42A-D545-4B3B-B282-9DB6EA6D0AE4}] => (Allow) C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe

FirewallRules: [{94119546-6676-4C44-BC2C-D4D4EC98F667}] => (Allow) C:\Program Files\CyberLink\PowerDirector10\PDR10.EXE

FirewallRules: [{F6ABF552-7D24-4525-A2CE-235076F7B1A2}] => (Allow) C:\Program Files (x86)\360\Total Security\LiveUpdate360.exe

FirewallRules: [{025CBB04-26D4-4808-8553-8DF870BE22C0}] => (Allow) C:\Program Files (x86)\360\Total Security\LiveUpdate360.exe

FirewallRules: [{332CC395-7A3F-4886-BFFA-84B0693748BF}] => (Allow) C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe

FirewallRules: [{040781B2-85D8-46EB-997E-95E4F750FAF8}] => (Allow) C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe

FirewallRules: [{42F1209B-35D7-4801-829F-7CDEA219EFE9}] => (Allow) C:\Users\adami_000\Documents\Steam\Steam.exe

FirewallRules: [{C4BDABBA-BFD7-4289-AA8B-FD7A1048BA23}] => (Allow) C:\Users\adami_000\Documents\Steam\Steam.exe

FirewallRules: [{6F04739F-AD53-4688-97E1-DD8A38675670}] => (Allow) C:\Users\adami_000\Documents\Steam\bin\steamwebhelper.exe

FirewallRules: [{D3135EC4-2F29-4F2C-9DA2-0E7B2E1267F6}] => (Allow) C:\Users\adami_000\Documents\Steam\bin\steamwebhelper.exe

FirewallRules: [{B705C168-B8FC-4ACA-ACD4-6B4B336E1FF2}] => (Allow) C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe

FirewallRules: [{F4E39EB9-9997-4DE4-A290-4FC636497491}] => (Allow) C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe

FirewallRules: [TCP Query User{F68E7DE2-8A74-42D1-BE07-9F2489FF3E6E}C:\program files (x86)\skype\phone\skype.exe] => (Block) C:\program files (x86)\skype\phone\skype.exe

FirewallRules: [UDP Query User{CDC008F8-00F0-4320-A457-97BF8E174654}C:\program files (x86)\skype\phone\skype.exe] => (Block) C:\program files (x86)\skype\phone\skype.exe

FirewallRules: [{A60C8115-31C5-49FA-8877-40D4976B4330}] => (Allow) C:\Users\adami_000\AppData\Local\BoBrowser\Application\bobrowser.exe

FirewallRules: [{A6D56A4B-B4A5-47A1-A9D9-177264A56420}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe

FirewallRules: [{E2586B72-D40F-4763-A649-D83AD8FDBD97}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe

FirewallRules: [{E1893D8D-3071-44B3-9058-EDA392CE7FFA}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe

FirewallRules: [{5F0F94C5-A70D-4FD6-9B1E-3681ECAF3EB5}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe

FirewallRules: [{75CF1AB1-15F3-402C-BBE0-9167D5D92F07}] => (Allow) C:\Program Files\iTunes\iTunes.exe

FirewallRules: [{2E4C16BE-056D-4F4E-B296-E8DD457CCAAA}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Faulty Device Manager Devices =============

==================== Event log errors: =========================

Application errors:

==================

Error: (10/28/2015 08:31:28 PM) (Source: SideBySide) (EventID: 33) (User: )

Description: Activation context generation failed for "Microsoft.VC90.MFC,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"1".

Dependent Assembly Microsoft.VC90.MFC,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8" could not be found.

Please use sxstrace.exe for detailed diagnosis.

Error: (10/28/2015 08:29:04 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledSPRetry 33569984

Error: (10/28/2015 08:29:04 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledEvent 33569984

Error: (10/28/2015 08:29:04 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: Continuously busy for more than a second

Error: (10/28/2015 08:29:03 PM) (Source: Desktop Window Manager) (EventID: 9020) (User: )

Description: The Desktop Window Manager has encountered a fatal error (0x8898008d)

Error: (10/15/2015 05:18:56 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledSPRetry 26203

Error: (10/15/2015 05:18:56 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledEvent 26203

Error: (10/15/2015 05:18:56 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: Continuously busy for more than a second

Error: (10/15/2015 04:52:28 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledSPRetry 36656

Error: (10/15/2015 04:52:28 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledEvent 36656

System errors:

=============

Error: (10/28/2015 09:31:09 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: The McAfee VirusScan Announcer service failed to start due to the following error:

%%2

Error: (10/28/2015 09:29:27 PM) (Source: DCOM) (EventID: 10016) (User: MAXROSENFELD)

Description: application-specificLocalLaunch{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}MaxRosenfeldadami_000S-1-5-21-1190642625-1873434813-491721638-1001LocalHost (Using LRPC)UnavailableUnavailable

Error: (10/28/2015 09:29:26 PM) (Source: DCOM) (EventID: 10016) (User: MAXROSENFELD)

Error: (10/28/2015 09:29:25 PM) (Source: DCOM) (EventID: 10016) (User: MAXROSENFELD)

Error: (10/28/2015 09:29:01 PM) (Source: Service Control Manager) (EventID: 7003) (User: )

Description: The McAfee Anti-Malware Core service depends on the following service: mfevtp. This service might not be installed.

Error: (10/28/2015 09:24:41 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: The McAfee VirusScan Announcer service failed to start due to the following error:

%%2

Error: (10/28/2015 09:22:32 PM) (Source: Service Control Manager) (EventID: 7003) (User: )

Description: The McAfee Anti-Malware Core service depends on the following service: mfevtp. This service might not be installed.

Error: (10/28/2015 08:48:38 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)

Description: Installation Failure: Windows failed to install the following update with error 0x80070643: Definition Update for Windows Defender - KB2267602 (Definition 1.209.822.0).

Error: (10/28/2015 10:37:03 AM) (Source: Ntfs) (EventID: 55) (User: NT AUTHORITY)

Description: A corruption was discovered in the file system structure on volume C:.

The exact nature of the corruption is unknown. The file system structures need to be scanned online.

CodeIntegrity:

===================================

Date: 2015-06-12 23:36:01.835

Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\wow64.dll because the set of per-page image hashes could not be found on the system.

Date: 2015-06-12 23:36:01.586

Date: 2015-06-12 23:36:01.346

Date: 2015-06-12 23:36:01.074

Date: 2015-06-12 23:36:00.869

Date: 2015-06-12 23:36:00.655

Date: 2015-06-12 23:36:00.388

Date: 2015-06-12 23:36:00.129

Date: 2015-06-12 23:35:59.514

Date: 2015-06-12 23:35:58.464

==================== Memory info ===========================

Processor: Intel® Celeron® CPU N2840 @ 2.16GHz

Percentage of memory in use: 45%

Total physical RAM: 3977.04 MB

Available physical RAM: 2168.38 MB

Total Virtual: 5449.04 MB

Available Virtual: 3289.33 MB

==================== Drives ================================

Drive c: (TI10702700E) (Fixed) (Total:455.46 GB) (Free:395.14 GB) NTFS

==================== MBR & Partition Table ==================

========================================================

Disk: 0 (Size: 465.8 GB) (Disk ID: 00000000)

Partition: GPT.

==================== End of Addition.txt ============================

#2
pystryker

Posted 28 October 2015 - 09:25 PM

Trusted Helper

Malware Removal
3,912 posts

Hello and welcome to Geeks To Go! My nickname is Pystryker

, and I will be helping you with your issue today.

Before we get started, I have a few things I need to go over with you

If you are receiving help for this issue at another forum, please let me know so I can close this thread.
Please download to and run all requested tools from your Desktop.
Please do not install any new software during the cleaning process other than the tools I provide for you. This can hinder the cleaning process.
At the top of your post, please click on the "Follow this topic" button and make sure that the "Received notification" box is checked and set to "Instantly" This will send an email to you as soon as I reply to your topic, allowing us to solve your problem faster.
If any of your security programs give you a warning about any tool I ask you to use, please do not worry. All the links and tools I provide to you will be safe.
Please do not run any tools other than the ones I ask you to, when I ask you to. Some of these tools can be very dangerous if used improperly. Also, if you use a tool that I have not requested you use, it can cause false positives, thereby delaying the complete cleaning of your machine.
This is a complicated process. It requires several steps, patience, and careful following of my instructions in the order they are given to diagnose your problems to get your machine back in working order.
Please stay with me until the end of all steps and procedures and I declare your system clean. Just because there is a lack of symptoms does not indicate a clean machine. I promise to do the same for you.
It is impossible for me to know what interactions may happen between your computer's software and the tools we will use to clean your machine. Therefore, I highly recommend you backup any critical personal files on your machine before we start.
If you have any questions at all, please don't hesitate to ask. There's no such thing as a stupid question when dealing with malware.
If you are unsure of an instruction I give you, or if something unexpected occurs, Do NOT proceed! Stop and ask for clarification of the instruction or tell me what occurred.
Please remember, the fixes are for your machine and your machine ONLY! Do not use these fixes on any other machine, each fix is tailor made for your system only. Using a fix on another machine can and will cause serious damage.
Once we have cleaned your machine, we'll have some cleanup and prevention steps to go through. We will also provide you with some information about how to reduce your chances of infection and get some protections in place to help defend you against this in the future
Please be patient while I am analyzing your logs. I know you are probably scared and very frustrated with this problem, but I am a volunteer and sometimes life does get in the way.

I'm currently reviewing your logs and preparing a fix. I'll be back with you shortly. :thumbsup:

#3
pystryker

Posted 29 October 2015 - 04:46 AM

Trusted Helper

Malware Removal
3,912 posts

Hello

There are some issues that need to be addressed. The one we'll deal with first is the Chrome browser has been reduced to a developmental build which will allow malware to install any extension it wishes without your permission. Let's get started.

Please disable your antivirus for the duration of my instructions. Don't forget to re-enable them after you have completed the steps.

Step 1: Re-Install Google Chrome

1. If you have bookmarks, let's save them by exporting them - Export Bookmarks
2. Then I need you to go Google Sync and sign into your account
3. Scroll down until you see the "Stop and Clear" button and click on the button. At the prompt click on "Ok"
4. Now we need to uninstall chromevia the Control Panel.
Note: When asked about user data or settings you must remove this also, so please check the box.
5. Restart the computer and reinstall chrome, You can download The latest version from here - Google Chrome
6. Import your bookmarks back into Chrome.
7. Sign back in to your Chrome browser so that your bookmarks sync with your online account.

Step 2: Program Uninstalls

Please uninstall the following programs from your machine as they are adware/malware related. If one of the programs fails to uninstall, please move on to the next one in the list.

bRowseandshop
IMG inspector

Step 3: Fix with FRST

Open notepad (Start =>All Programs => Accessories => Notepad). Please copy the entire contents of the code box below. (To do this highlight the contents of the box, right click on it and select copy.
Right-click in the open notepad and select Paste).
Save it on the desktop as fixlist.txt

NOTE: It's important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work.

Start
CreateRestorePoint:
CloseProcesses:
HKLM\...\Run: [] => [X]
AppInit_DLLs: C:\PROGRA~2\SearchProtect\SearchProtect\bin\VC64Loader.dll => No File
AppInit_DLLs-x32: C:\PROGRA~2\SearchProtect\SearchProtect\bin\VC32Loader.dll => No File
C:\PROGRA~2\SearchProtect
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
SearchScopes: HKU\S-1-5-21-1190642625-1873434813-491721638-1001 -> {8CDE19E6-71C2-4B46-89B7-35F6A18C571A} URL =
S2 McNaiAnn; "C:\Program Files\Common Files\McAfee\platform\McSvcHost\McSvHost.exe" /McCoreSvc [X]
S3 McODS; "C:\ProgramData\McAfee\Update\Installs\pkg_default\Download_Files\default\vso\vso_li_cat\%VSINSTALL_DIR64%\mcods.exe" [X]
S1 BAPIDRV; system32\DRIVERS\BAPIDRV64.sys [X]
globalupdate Helper (x32 Version: 1.3.25.0 - globalupdate Inc.) Hidden <==== ATTENTION
Task: {18E4AA4F-15CE-41E6-8165-8F35934CB331} - \avabvbavad -> No File <==== ATTENTION
Task: {5217491F-C40D-4096-91AA-EFA8AC22244C} - \{1C034622-AC42-44C3-806D-C4B5EA6CBDEC} -> No File <==== ATTENTION
Task: {5F2FE496-9AC2-4A3B-A98F-E94352A444CC} - System32\Tasks\PostPoneInstall => C:\Users\ADAMI_~1\AppData\Local\Temp\ce98ac2e-20c0-4a93-86f6-bdb3e61caf55.exe <==== ATTENTION
Task: {CA87409D-365F-4AA5-8AF6-CD97FFE5B41A} - \Run_Bobby_Browser -> No File <==== ATTENTION
CMD: bitsadmin /reset /allusers
CMD: netsh advfirewall reset
CMD: netsh advfirewall set allprofiles state on
CMD: ipconfig /flushdns
Hosts:
Emptytemp:
End

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system.

Run FRST and press the Fix button just once and wait. The tool will make a log on the desktop (Fixlog.txt) please post it in your next reply.

Step 4: Additional Program Uninstall

After running the fix with FRST and rebooting, please uninstall the following program from the computer.

globalupdate Helper

Things I need to see in your next post:

Fixlog.txt Log

#4
AdamIsAdam

Posted 29 October 2015 - 09:05 PM

Member

Topic Starter
Member
191 posts

ok. Thanks for your help. as always.

I uninstalled the programs. A few notes:

- I'm not signed in to chrome, I don't think, and I don't have it set to sync. When I followed the link, it said it wasn't syc'd. So I exported the book marks and uninstalled chrome. It seemed to work, then I downloaded and reinstalled it, but my bookmarks were there. So did i really not uninstall it?

- Regardless, I moved on to uninstall the next two programs. They both said there weren't there and it prompted me to remove the names from control panel list which I did.

- I ran the fix. See log below.

I deleted the last program but it gave me a warning asking if I really wanted to allow a program to make PC changes. I said yes.

here's the log

Fix result of Farbar Recovery Scan Tool (x64) Version:29-10-2015

Ran by adami_000 (2015-10-29 22:50:53) Run:1

Running from C:\Users\adami_000\Desktop

Loaded Profiles: adami_000 (Available Profiles: adami_000)

Boot Mode: Normal

==============================================

fixlist content:

*****************

Start

CreateRestorePoint:

CloseProcesses:

HKLM\...\Run: [] => [X]

AppInit_DLLs: C:\PROGRA~2\SearchProtect\SearchProtect\bin\VC64Loader.dll => No File

AppInit_DLLs-x32: C:\PROGRA~2\SearchProtect\SearchProtect\bin\VC32Loader.dll => No File

C:\PROGRA~2\SearchProtect

CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION

SearchScopes: HKU\S-1-5-21-1190642625-1873434813-491721638-1001 -> {8CDE19E6-71C2-4B46-89B7-35F6A18C571A} URL =

S2 McNaiAnn; "C:\Program Files\Common Files\McAfee\platform\McSvcHost\McSvHost.exe" /McCoreSvc [X]

S3 McODS; "C:\ProgramData\McAfee\Update\Installs\pkg_default\Download_Files\default\vso\vso_li_cat\%VSINSTALL_DIR64%\mcods.exe" [X]

S1 BAPIDRV; system32\DRIVERS\BAPIDRV64.sys [X]

globalupdate Helper (x32 Version: 1.3.25.0 - globalupdate Inc.) Hidden <==== ATTENTION

Task: {18E4AA4F-15CE-41E6-8165-8F35934CB331} - \avabvbavad -> No File <==== ATTENTION

Task: {5217491F-C40D-4096-91AA-EFA8AC22244C} - \{1C034622-AC42-44C3-806D-C4B5EA6CBDEC} -> No File <==== ATTENTION

Task: {5F2FE496-9AC2-4A3B-A98F-E94352A444CC} - System32\Tasks\PostPoneInstall => C:\Users\ADAMI_~1\AppData\Local\Temp\ce98ac2e-20c0-4a93-86f6-bdb3e61caf55.exe <==== ATTENTION

Task: {CA87409D-365F-4AA5-8AF6-CD97FFE5B41A} - \Run_Bobby_Browser -> No File <==== ATTENTION

CMD: bitsadmin /reset /allusers

CMD: netsh advfirewall reset

CMD: netsh advfirewall set allprofiles state on

CMD: ipconfig /flushdns

Hosts:

Emptytemp:

End

*****************

Restore point was successfully created.

Processes closed successfully.

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\ => value removed successfully

"C:\PROGRA~2\SearchProtect\SearchProtect\bin\VC64Loader.dll" => Value data removed successfully.

"C:\PROGRA~2\SearchProtect\SearchProtect\bin\VC32Loader.dll" => Value data removed successfully.

"C:\PROGRA~2\SearchProtect" => not found.

"HKLM\SOFTWARE\Policies\Google" => key removed successfully

"HKU\S-1-5-21-1190642625-1873434813-491721638-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{8CDE19E6-71C2-4B46-89B7-35F6A18C571A}" => key removed successfully

HKCR\CLSID\{8CDE19E6-71C2-4B46-89B7-35F6A18C571A} => key not found.

McNaiAnn => service removed successfully

McODS => service removed successfully

BAPIDRV => service removed successfully

HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}\\SystemComponent => value removed successfully

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{18E4AA4F-15CE-41E6-8165-8F35934CB331}" => key removed successfully

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{18E4AA4F-15CE-41E6-8165-8F35934CB331}" => key removed successfully

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\avabvbavad => key not found.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{5217491F-C40D-4096-91AA-EFA8AC22244C}" => key removed successfully

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{5217491F-C40D-4096-91AA-EFA8AC22244C}" => key removed successfully

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{1C034622-AC42-44C3-806D-C4B5EA6CBDEC}" => key removed successfully

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{5F2FE496-9AC2-4A3B-A98F-E94352A444CC}" => key removed successfully

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{5F2FE496-9AC2-4A3B-A98F-E94352A444CC}" => key removed successfully

C:\Windows\System32\Tasks\PostPoneInstall => moved successfully

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\PostPoneInstall" => key removed successfully

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{CA87409D-365F-4AA5-8AF6-CD97FFE5B41A}" => key removed successfully

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{CA87409D-365F-4AA5-8AF6-CD97FFE5B41A}" => key removed successfully

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Run_Bobby_Browser => key not found.

========= bitsadmin /reset /allusers =========

BITSADMIN version 3.0 [ 7.7.9600 ]

BITS administration utility.

BITSAdmin is deprecated and is not guaranteed to be available in future versions of Windows.

Administrative tools for the BITS service are now provided by BITS PowerShell cmdlets.

Unable to cancel {49A8C4A0-8033-4925-A8DF-F9093F635496}.

Unable to cancel {03F06348-B95E-449F-BD0E-AF1DB8BCAE16}.

Unable to cancel {42BEC5E2-8013-4D48-B652-98F418C85B18}.

Unable to cancel {E58962C9-C27F-4169-97DB-414210DB59B6}.

Unable to cancel {C295A21B-BDF5-4BE0-B906-322AEF3B8246}.

Unable to cancel {360ECA17-25F3-4DE4-BCD8-AB5A304A4A4F}.

Unable to cancel {DEE20185-517F-4568-AAAC-513E8C4B6CBD}.

Unable to cancel {B0B92CB9-D2AF-461B-A43E-ED45C509B849}.

Unable to cancel {9547CD95-2F29-4488-9830-DF4DD6FFE0CC}.

Unable to cancel {4D56EAD5-B8D4-4477-9D05-9FFFA54AC700}.

Unable to cancel {34AE836A-D9E7-467D-8942-CAAB4C3E2C7D}.

Unable to cancel {34A83F19-9592-46FC-AFD1-BD5B476E4132}.

Unable to cancel {CEE1E729-3B49-40E9-B2D6-A434C71D9373}.

Unable to cancel {8C0E3E32-03E5-4B96-B477-86A48C8ED806}.

Unable to cancel {14208D40-E3C9-4C64-A494-2EB6A2B5C451}.

Unable to cancel {5BD06D5B-6C28-4E5E-A4D0-DE8F5A75A819}.

Unable to cancel {EE70DE6A-13AF-47C0-8223-8B71C9B09BE4}.

Unable to cancel {080DEC7A-1ECB-4F77-AF9C-F96A192C0642}.

Unable to cancel {3B01BE99-4898-421C-AD40-0D9B18A99C79}.

Unable to cancel {E3C8C49D-8051-4751-BAF9-04DA93807C59}.

Unable to cancel {F6830DA8-A406-4F71-AA84-A4718E157FF7}.

Unable to cancel {7B8324C0-FADE-4AC9-9C2E-A8A32BD1D8D8}.

Unable to cancel {8F16E2D8-E6BF-45FC-AD1E-C828C1D78418}.

Unable to cancel {E7BDA6E5-81ED-498C-9365-B5EA4BFD6F7E}.

Unable to cancel {244DDDEF-B7D9-4B79-8816-DE818FBB0159}.

Unable to cancel {EF468279-44C4-4E3D-8BE9-F4A9F7DFD738}.

Unable to cancel {7123BED5-C54F-4F53-B87C-6A4630A1C498}.

Unable to cancel {1550D7F5-5554-4DED-8AF8-2E10E1FD3F58}.

Unable to cancel {7E52B1FB-0214-484F-863B-86903630772A}.

Unable to cancel {B275F4EC-2333-497B-B6FF-B3C453CD18CB}.

Unable to cancel {C417DB64-31CB-44B2-BFEB-9F2EB274E20C}.

Unable to cancel {334EBE8B-652F-4AAF-98AB-39C9FABC1DD4}.

Unable to cancel {015093B2-6FA1-4786-A053-43AA64E6370F}.

Unable to cancel {9AC661D5-4EA8-4380-8455-F2E597BF32E9}.

Unable to cancel {C0DBBF5E-C003-4580-88DD-7AA2CD1C72F3}.

Unable to cancel {227D5C92-C6E0-49F3-92D2-45CF8A524F3D}.

Unable to cancel {93E97D99-D78D-42B0-89A9-51D881FDC69F}.

Unable to cancel {C2102F3A-06AF-4616-B6FD-41F1499D7869}.

Unable to cancel {2B160009-DBD4-400E-9FB0-0F5DF90E5D3B}.

Unable to cancel {4BADA4AE-0092-4A07-A727-4A890FD9A0A1}.

Unable to cancel {45EF5B67-DA4D-4D1C-82B6-8F61376A6CE2}.

Unable to cancel {0712B00B-38CE-42DE-B03F-11D2FAF338A2}.

Unable to cancel {3D9C2A70-5ED3-42F5-BD1B-0FFDADA1813A}.

Unable to cancel {D8839FC1-1F4A-4486-A7C7-FC00CC31F03F}.

Unable to cancel {D04EFB15-6162-4389-AE9F-A197BAD9670E}.

Unable to cancel {E505289E-58ED-470D-B639-F6D8E918F4F5}.

Unable to cancel {21B54F41-BE55-4C2B-B6FF-6DF67122852E}.

0 out of 47 jobs canceled.

========= End of CMD: =========

========= netsh advfirewall reset =========

Ok.

========= End of CMD: =========

========= netsh advfirewall set allprofiles state on =========

Ok.

========= End of CMD: =========

========= ipconfig /flushdns =========

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

========= End of CMD: =========

C:\Windows\System32\Drivers\etc\hosts => moved successfully

Hosts restored successfully.

EmptyTemp: => 700.6 MB temporary data Removed.

The system needed a reboot.

==== End of Fixlog 22:52:44 ====

#5
pystryker

Posted 29 October 2015 - 09:13 PM

Trusted Helper

Malware Removal
3,912 posts

ok. Thanks for your help. as always.

You're very welcome, it's my pleasure.

- I'm not signed in to chrome, I don't think, and I don't have it set to sync. When I followed the link, it said it wasn't syc'd. So I exported the book marks and uninstalled chrome. It seemed to work, then I downloaded and reinstalled it, but my bookmarks were there. So did i really not uninstall it?

We'll run a fresh FRST scan at the end of my next instructions that will let us know if the dev build version is gone. :thumbsup:

Regardless, I moved on to uninstall the next two programs. They both said there weren't there and it prompted me to remove the names from control panel list which I did.

- I ran the fix. See log below.

I deleted the last program but it gave me a warning asking if I really wanted to allow a program to make PC changes. I said yes.

Please disable your antivirus for the duration of my instructions. Don't forget to re-enable them after you have completed the steps.

Step 1: Junkware Removal Tool

Please download Junkware Removal Tool to your desktop.

Shut down your protection software now to avoid potential conflicts.
Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
The tool will open and start scanning your system.
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next message.

Step 2: AdwCleaner

Download ADWcleaner by clicking here. Please save it to your Desktop

Double click (Vista and 7 Users)right click the adwcleaner.exe file and click Run as Adminstrator and accept the UAC prompt to run AdwCleaner
Once AdwCleaner's control panel is open and it says "Waiting for Action", click on Options at the top of the control panel.
Please Check the following options:
- Reset Proxy Settings
- Reset Winsock Settings
- Reset TCP/IP Settings
- Reset Firewall Settings
- Reset IPSec Settings
- Reset BITS Queue
- Reset Internet Explorer Policies
- Reset Chrome Policies
Close any open windows or browsers.
Pause your Anti-Virus program if it is running.
Once it starts, click on the Scan button.
Let the scan complete itself. This may take a few minutes.
Once the scan has finished, it will say "Pending, uncheck elements you don't want to remove.", don't worry about unchecking anything and then click the Cleaning button. When finished, it will ask to reboot. Please reboot.
When the machine has rebooted, a log will be produced. Please copy/paste that in your next reply. Here's how:
- Click the Logfile button and the log will open. Copy and Paste the contents of the log file into your next reply.
This report is also saved at C:\

Step 3: Fresh FRST Scan

Start Farbar's Recovery Scan Tool and press the Scan button.
FRST will scan your system and produce two logs: FRST.txt and Addition.txt. Please post them in your next reply.

Things I need to see in your next post:

Please post each of these logs as a separate reply in this thread.

Junkware Removal Tool Log

AdwCleaner Log

Fresh FRST.txt Log

Fresh Addition.txt Log

#6
AdamIsAdam

Posted 29 October 2015 - 09:15 PM

Member

Topic Starter
Member
191 posts

Ok. Tomorrow. Going to sleep now.

Thanks

#7
AdamIsAdam

Posted 30 October 2015 - 05:52 PM

Member

Topic Starter
Member
191 posts

step one done. working on 2...

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Malwarebytes

Version: 7.6.4 (09.28.2015:1)

OS: Windows 8.1 x64

Ran by adami_000 on Fri 10/30/2015 at 19:41:57.00

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

Successfully deleted: [Service] drvagent64 [Reboot required]

~~~ Tasks

~~~ Registry Values

~~~ Registry Keys

~~~ Files

~~~ Folders

Successfully deleted: [Folder] C:\Program Files (x86)\decodit

Successfully deleted: [Folder] C:\Program Files (x86)\globalupdate

Successfully deleted: [Folder] C:\Users\adami_000\Appdata\Local\globalupdate

Successfully deleted: [Folder] C:\Windows\SysWOW64\amd64

Successfully deleted: [Folder] C:\Windows\SysWOW64\x86

~~~ Chrome

[C:\Users\adami_000\Appdata\Local\Google\Chrome\User Data\Default\Preferences] - default search provider reset

[C:\Users\adami_000\Appdata\Local\Google\Chrome\User Data\Default\Preferences] - Extensions Deleted:

[C:\Users\adami_000\Appdata\Local\Google\Chrome\User Data\Default\Secure Preferences] - default search provider reset

[C:\Users\adami_000\Appdata\Local\Google\Chrome\User Data\Default\Secure Preferences] - Extensions Deleted:

[

booedmolknjekdopkepjjeckmjkdpfgl,

flpcjncodpafbgdpnkljologafpionhb

]

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on Fri 10/30/2015 at 19:46:35.28

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

#8
AdamIsAdam

Posted 30 October 2015 - 06:01 PM

Member

Topic Starter
Member
191 posts

# AdwCleaner v5.015 - Logfile created 30/10/2015 at 19:57:24

# Updated 26/10/2015 by Xplode

# Database : 2015-10-29.1 [Server]

# Operating system : Windows 8.1 (x64)

# Username : adami_000 - MAXROSENFELD

# Running from : C:\Users\adami_000\Desktop\adwcleaner_5.015.exe

# Option : Cleaning

# Support : http://toolslib.net/forum

***** [ Services ] *****

***** [ Folders ] *****

[-] Folder Deleted : C:\ProgramData\{09d94161-90de-e08f-09d9-9416190d0586}

[-] Folder Deleted : C:\ProgramData\{0df41d1a-35b1-e586-0df4-41d1a35b7468}

[-] Folder Deleted : C:\ProgramData\{c007268d-e972-ebb4-c007-7268de979a37}

***** [ Files ] *****

***** [ DLLs ] *****

***** [ Shortcuts ] *****

***** [ Scheduled tasks ] *****

***** [ Registry ] *****

[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Paths\bobrowser.exe

[-] Key Deleted : HKLM\SOFTWARE\2e633b19-2203-c8b1-0bc7-abc328bf21b3

[-] Key Deleted : HKLM\SOFTWARE\79a78153-31c2-479c-9f54-a0ff4644512b

[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Pokki_34e8f5c0c9e5744bf2cdb514283762dd0524776b

[-] Key Deleted : HKLM\SOFTWARE\Classes\AppID\{3278F5CF-48F3-4253-A6BB-004CE84AF492}

[-] Key Deleted : HKLM\SOFTWARE\Classes\AppID\{577975B8-C40E-43E6-B0DE-4C6B44088B52}

[-] Key Deleted : HKCU\Software\Classes\CLSID\{19041B6B-8F97-4669-BA21-C17572737ED2}

[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3278F5CF-48F3-4253-A6BB-004CE84AF492}

[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3B5702BA-7F4C-4D1A-B026-1E9A01D43978}

[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{577975B8-C40E-43E6-B0DE-4C6B44088B52}

[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{5E89ACE9-E16B-499A-87B4-0DBF742404C1}

[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{69F256DF-BA98-45E9-86EA-FC3CFECF9D30}

[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{6E87FC94-9866-49B9-8E93-5736D6DE3DD7}

[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{7E49F793-B3CD-4BF7-8419-B34B8BD30E61}

[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{834469E3-CA2B-4F21-A5CA-4F6F4DBCDE87}

[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{8529FAA3-5BFD-43C1-AB35-B53C4B96C6E5}

[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{ADBC39BE-3D20-4333-8D99-E91EB1B62474}

[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E06CA7F5-BA34-4FF6-8D24-B1BDC594D91F}

[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{F6421EE5-A5BE-4D31-81D5-C16B7BF48E4C}

[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{FD8E81D0-F5FE-4CB1-9AEA-1E163D2BAB78}

[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{6EDBF8C0-C94C-4A13-956F-E393BCA5BA4B}

[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{A8F7D0A5-7074-40B8-9BDC-1174BDD0A132}

[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{D14D64BC-A0E4-42E3-BB72-FB41EA43C198}

[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{DD1F043F-ABC8-4643-8B95-D2C5B22BB019}

[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E3F3E8F9-F747-4DD6-BA6B-82A6CE1E0860}

[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{ED0B64D4-BF27-4521-AD27-190F49BF5EA7}

[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{023E9EC8-B147-40EB-B0B3-DF90618FB371}

[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{0522D9A4-4D57-437D-978D-E5B3B6C9005D}

[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{07F41522-AF7D-4F26-B394-094F059FDB8A}

[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{0C40F472-7407-4467-8914-1DEA7C326972}

[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{212E6D43-6062-492A-B8CC-144669FF11ED}

[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{224FE662-1E6D-4BC0-AEBB-9E2FB4057BE9}

[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{3A807417-B46D-4D37-8C9A-19AC6DE204F9}

[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{3CC60715-D6C5-429D-830E-43FA3F86C61D}

[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{4517D94C-19BA-46FA-BE66-2A30CEAC4A85}

[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{555D7146-94A8-4C94-AE76-C39CDC7F7705}

[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{59D188FA-757A-424E-8C93-F58FFD896BD7}

[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{8120D9D6-785C-4413-9C0C-DF2028C56FAD}

[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{823AE2EB-E62C-4847-B192-C99B91B92416}

[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9B4F7CFE-987D-410E-A8E4-20182E0B3C24}

[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9B9A45F4-18FC-484A-BACA-076D78273D8E}

[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{A6D54287-7939-466A-8579-92546D946C8C}

[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{A78EDAFB-926F-4D93-AB13-8232D7378EB1}

[-] Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{532ECD0F-E6C9-4ACE-860A-3730B1F6F1DD}

[-] Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{02511508-4CCA-458D-AF69-3A8482103196}

[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{5645E0E7-FC12-43BF-A6E4-F9751942B298}

[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{C7BF8F4B-7BC7-4F42-B944-3D28A3A86D8A}

[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5E89ACE9-E16B-499A-87B4-0DBF742404C1}

[-] Key Deleted : HKU\.DEFAULT\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}

[-] Key Deleted : HKU\.DEFAULT\Software\AppDataLow\Software\Compete

[-] Key Deleted : HKCU\Software\GlobalUpdate

[-] Key Deleted : HKCU\Software\InstalledBrowserExtensions

[-] Key Deleted : HKCU\Software\WEBAPP

[-] Key Deleted : HKCU\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}

[-] Key Deleted : HKLM\SOFTWARE\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}

[-] Key Deleted : HKLM\SOFTWARE\GlobalUpdate

[-] Key Deleted : HKLM\SOFTWARE\InstalledBrowserExtensions

[-] Key Deleted : HKLM\SOFTWARE\Clara

[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{0F44DC3H-6E62-4961-A14B-95323C512F9B}_is1

[!] Key Not Deleted : [x64] HKCU\Software\GlobalUpdate

[!] Key Not Deleted : [x64] HKCU\Software\InstalledBrowserExtensions

[!] Key Not Deleted : [x64] HKCU\Software\WEBAPP

[-] Key Deleted : [x64] HKLM\SOFTWARE\InstalledBrowserExtensions

[!] Key Not Deleted : HKU\.DEFAULT\Software\AppDataLow\Software\Compete

[!] Key Not Deleted : HKU\S-1-5-18\Software\AppDataLow\Software\Compete

***** [ Web browsers ] *****

[-] [C:\Users\adami_000\AppData\Local\Google\Chrome\User Data\Default\Web Data] [Search Provider] Deleted : aol.com

[-] [C:\Users\adami_000\AppData\Local\Google\Chrome\User Data\Default\Web Data] [Search Provider] Deleted : ask.com

[-] [C:\Users\adami_000\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] [Extension] Deleted : dimfohdigjaffdaanhmbocfkpolglnjk

*************************

:: Proxy settings cleared

:: Winsock settings cleared

:: TCP/IP settings cleared

:: Firewall settings cleared

:: IPSec settings cleared

:: BITS queue cleared

:: Chrome policies deleted

########## EOF - C:\AdwCleaner\AdwCleaner[C1].txt - [6836 bytes] ##########

#9
AdamIsAdam

Posted 30 October 2015 - 06:07 PM

Member

Topic Starter
Member
191 posts

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:29-10-2015

Ran by adami_000 (administrator) on MAXROSENFELD (30-10-2015 20:05:47)

Running from C:\Users\adami_000\Desktop

Loaded Profiles: adami_000 (Available Profiles: adami_000)

Platform: Windows 8.1 (X64) Language: English (United States)

Internet Explorer Version 11 (Default browser: Chrome)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Intel Corporation) C:\Windows\System32\igfxCUIService.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe

(Microsoft Corporation) C:\Windows\System32\wlanext.exe

() C:\Program Files (x86)\Toshiba\PasswordUtility\GFNEXSrv.exe

(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

() C:\Program Files (x86)\Realtek\Realtek Bluetooth Filter Driver Package\BTDevMgr.exe

(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe

(Intel Corporation) C:\Windows\System32\DptfParticipantProcessorService.exe

(Intel Corporation) C:\Windows\System32\DptfPolicyCriticalService.exe

(Intel® Corporation) C:\Program Files\Intel\TXE Components\TCS\HeciServer.exe

(Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe

() C:\Program Files\CyberLink\Shared files\RichVideo64.exe

() C:\Program Files (x86)\Toshiba\TOSHIBA System Driver\TOSTABSYSSVC.exe

(RaMMicHaeL) C:\Program Files (x86)\Unchecky\bin\unchecky_svc.exe

(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(Toshiba Corporation) C:\Program Files\TOSHIBA\Teco\TecoService.exe

(RaMMicHaeL) C:\Program Files (x86)\Unchecky\bin\unchecky_bg.exe

(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe

(Intel Corporation) C:\Windows\System32\igfxEM.exe

(Intel Corporation) C:\Windows\System32\igfxHK.exe

(Intel Corporation) C:\Windows\System32\igfxTray.exe

(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe

(Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe

(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe

(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Teco\TecoResident.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe

(Microsoft Corporation) C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe

(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\office15\onenotem.exe

(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

() C:\Program Files (x86)\DTS, Inc\DTS Studio Sound\dts_apo_service.exe

(Microsoft Corporation) C:\Windows\System32\WWAHost.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe

(Microsoft Corporation) C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.3.9600.17709_none_fa7932f59afc2e40\TiWorker.exe