Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

Gotta have a virus, cant open any anti virus programs, chrome stops, c

Started by rct8787 , Nov 06 2015 05:17 PM

Please log in to reply

#16
RKinner

Posted 11 November 2015 - 09:11 PM

Malware Expert

Expert
24,624 posts

CF log looks OK. The only thing I don't like is this user: \Mcx1-TYRANT.TyRaNt

Are you sure this is legit?

I'm wondering if the suspicious driver we saw earlier was related to Daemon Tools. I've seen it do weird things. Can you uninstall Daemon Tools then run a FRST scan again?

Try the free iso burner from:

http://www.freeisoburner.com/

Let's check your hard drive and temps:

Get the free version of Speccy:

http://www.filehippo...download_speccy (Look in the upper right for the Download

Latest Version button - Do NOT press the large Start Download button on the upper left!) Download, Save and Install it.

Close all browsers and open progrms before running Speccy. Run Speccy. When it finishes (the little icon in the bottom left will stop moving), File, Save as Text File, (to your desktop) note the name it gives. OK. Open the file in notepad and delete the line that gives the serial number of your Operating System. (It will be near the top about 10 lines down.) Save the file and close notepad Attach the file to your next post as it is usually too large for the forum (Click on More Reply Options then Choose file, select the file, Open, Attach this File) Uninstall Speccy.

#17
rct8787

Posted 14 November 2015 - 02:37 PM

Member

Topic Starter
Member
14 posts

Sorry for the delay, I believe \Mcx1-TYRANT.TyRaNt is legit but Im not positive, at this point I would be fine with getting rid of it if you think that may be the problem, I dont see it listed as one of the users though when I go into users in the control panel, I was able to burn the iso to a CD and ran AVG it found some stuff that I cleaned out but still doesnt appear to solve the problem as chrome still stops working and I still cant run any anti virus programs. I uninstalled Daemon and ran FRST and ran speccy, see below. Thanks

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:05-11-2015
Ran by Ryan (administrator) on TYRANT (14-11-2015 15:30:45)
Running from C:\Users\Ryan\Desktop
Loaded Profiles: Ryan (Available Profiles: Ryan & Mcx1-TYRANT)
Platform: Windows 7 Home Premium (X64) Language: English (United States)
Internet Explorer Version 9 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(American Megatrends Inc.) C:\Program Files\AMI\DuOS\AndServMgr.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(BlueStack Systems, Inc.) C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe
(BlueStack Systems, Inc.) C:\Program Files (x86)\BlueStacks\HD-UpdaterService.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(Scarlet.Crush Productions) C:\Users\Ryan\Desktop\SCP DS3 Driver Package\ScpServer\bin\ScpService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Ralink Technology, Corp.) C:\Program Files (x86)\Ralink\Common\RaRegistry.exe
(Ralink Technology, Corp.) C:\Program Files (x86)\Ralink\Common\RaRegistry64.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
(Roxio) C:\Program Files (x86)\Roxio\RoxioNow Player\RNowSvc.exe
(Splashtop Inc.) C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
(Splashtop Inc.) C:\Program Files (x86)\Splashtop\Splashtop Software Updater\SSUService.exe
(GlavSoft LLC.) C:\Program Files (x86)\TightVNC\tvnserver.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(AMD) C:\Windows\System32\atieclxx.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe
(Microsoft Corporation) C:\Program Files\Microsoft IntelliType Pro\itype.exe
(Microsoft Corporation) C:\Program Files\Microsoft IntelliPoint\ipoint.exe
(Microsoft Corporation) C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Google Inc.) C:\Users\Ryan\AppData\Local\Programs\Google\MusicManager\MusicManager.exe
(Plex, Inc.) C:\Program Files (x86)\Plex\Plex Media Server\Plex Media Server.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(Ralink Technology, Inc.) C:\Program Files (x86)\Ralink\Common\RaWiFi.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe
(Python Software Foundation) C:\Program Files (x86)\Plex\Plex Media Server\PlexScriptHost.exe
(Plex, Inc.) C:\Program Files (x86)\Plex\Plex Media Server\PlexDlnaServer.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
() C:\Program Files (x86)\Wyse\PocketCloud Windows Companion\PocketCloudService.exe
(Wyse Technology.) C:\Program Files (x86)\Wyse\PocketCloud Windows Companion\WyseRemoteAccess.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [itype] => c:\Program Files\Microsoft IntelliType Pro\itype.exe [1873256 2011-08-10] (Microsoft Corporation)
HKLM\...\Run: [IntelliPoint] => c:\Program Files\Microsoft IntelliPoint\ipoint.exe [2417032 2011-08-01] (Microsoft Corporation)
HKLM\...\Run: [XboxStat] => C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe [825184 2009-09-30] (Microsoft Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2655520 2015-10-11] (NVIDIA Corporation)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13876952 2015-05-16] (Realtek Semiconductor)
HKLM\...\Run: [TabTip_64] => "C:\PROGRA~3\TabTip_64.exe"
HKLM-x32\...\Run: [amd_dc_opt] => C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe [77824 2008-07-22] (AMD)
HKU\S-1-5-21-1725188070-1093038038-2835830549-1000\...\Run: [MusicManager] => C:\Users\Ryan\AppData\Local\Programs\Google\MusicManager\MusicManager.exe [7646208 2015-08-13] (Google Inc.)
HKU\S-1-5-21-1725188070-1093038038-2835830549-1000\...\Run: [Plex Media Server] => C:\Program Files (x86)\Plex\Plex Media Server\Plex Media Server.exe [6274184 2015-08-23] (Plex, Inc.)
HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [301568 2015-11-14] (Microsoft Corporation)
Lsa: [Notification Packages] scecli C:\Program Files\WIDCOMM\Bluetooth Software\BtwProximityCP.dll
ShellIconOverlayIdentifiers: [ GoogleDriveBlacklisted] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2015-10-12] (Google)
ShellIconOverlayIdentifiers: [ GoogleDriveSynced] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2015-10-12] (Google)
ShellIconOverlayIdentifiers: [ GoogleDriveSyncing] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2015-10-12] (Google)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk [2015-01-19]
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Ralink Wireless Utility.lnk [2013-01-09]
ShortcutTarget: Ralink Wireless Utility.lnk -> C:\Program Files (x86)\Ralink\Common\RaWiFi.exe (Ralink Technology, Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{BBF9F091-EADE-4E1C-AB76-D5897FD5207B}: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{C4349D22-40F8-480F-AD78-E820B327C557}: [DhcpNameServer] 209.18.47.61 209.18.47.62

Internet Explorer:
==================
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\S-1-5-21-1725188070-1093038038-2835830549-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.msn.com/HPDSK/1
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.msn.com/HPDSK/1
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Local Page =
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-1725188070-1093038038-2835830549-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.yahoo.com/
HKU\S-1-5-21-1725188070-1093038038-2835830549-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM -> {ec29edf6-ad3c-4e1c-a087-d6cb81400c43} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPDTDF&pc=HPDTDF&src=IE-SearchBox
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> {ec29edf6-ad3c-4e1c-a087-d6cb81400c43} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPDTDF&pc=HPDTDF&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-1725188070-1093038038-2835830549-1000 -> DefaultScope {5ED88E19-FCB1-4428-9612-3E22A725041E} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3306058&CUI=UN26255233522486923&UM=2
SearchScopes: HKU\S-1-5-21-1725188070-1093038038-2835830549-1000 -> {5ED88E19-FCB1-4428-9612-3E22A725041E} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3306058&CUI=UN26255233522486923&UM=2
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office15\OCHelper.dll [2015-10-20] (Microsoft Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21] (Microsoft Corp.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL [2014-01-23] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL [2015-10-13] (Microsoft Corporation)
BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll [2013-08-28] (Hewlett-Packard)
BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll [2015-10-20] (Microsoft Corporation)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21] (Microsoft Corp.)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL [2014-01-22] (Microsoft Corporation)
BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL [2015-10-13] (Microsoft Corporation)
BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll [2013-08-28] (Hewlett-Packard)
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL [2014-03-12] (Microsoft Corporation)

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_19_0_0_245.dll [2015-11-11] ()
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MIF5BA~1\Office15\NPSPWRAP.DLL [2014-01-23] (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_19_0_0_245.dll [2015-11-11] ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1218158.dll [2015-04-27] (Adobe Systems, Inc.)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2015-03-31] (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~3\Office15\NPSPWRAP.DLL [2014-01-22] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2010-09-23] (Microsoft Corporation)
FF Plugin-x32: @nexon.net/NxGame -> C:\ProgramData\NexonUS\NGM\npNxGameUS.dll [2012-05-14] (Nexon)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2015-10-02] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2015-10-02] (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-15] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-15] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-09-26] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-1725188070-1093038038-2835830549-1000: @hulu.com/Hulu Desktop -> C:\Windows\..\Users\Default\AppData\Local\HuluDesktop\instances\0.9.13.1\npHDPlg.dll [2010-04-09] (Hulu LLC)
FF Plugin HKU\S-1-5-21-1725188070-1093038038-2835830549-1000: @tools.google.com/Google Update;version=3 -> C:\Users\Ryan\AppData\Local\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-14] (Google Inc.)
FF Plugin HKU\S-1-5-21-1725188070-1093038038-2835830549-1000: @tools.google.com/Google Update;version=9 -> C:\Users\Ryan\AppData\Local\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-14] (Google Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll [2015-03-31] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2013-05-11] (Adobe Systems Inc.)

Chrome:
=======
CHR HomePage: Default -> hxxp://www.yahoo.com/
CHR Profile: C:\Users\Ryan\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\Ryan\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-02-03]
CHR Extension: (Google Drive) - C:\Users\Ryan\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-10-22]
CHR Extension: (Advanced SystemCare Surfing Protection) - C:\Users\Ryan\AppData\Local\Google\Chrome\User Data\Default\Extensions\bbmegnmpleoagolcnjnejdacakedpcgd [2015-11-14]
CHR Extension: (YouTube) - C:\Users\Ryan\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-09-28]
CHR Extension: (Google Search) - C:\Users\Ryan\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-11-01]
CHR Extension: (Dark Vibe) - C:\Users\Ryan\AppData\Local\Google\Chrome\User Data\Default\Extensions\dkckeanhmkjaechlhllmapjaaglgpcbj [2013-10-15]
CHR Extension: (Google Play Music) - C:\Users\Ryan\AppData\Local\Google\Chrome\User Data\Default\Extensions\fahmaaghhglfmonjliepjlchgpgfmobi [2015-11-04]
CHR Extension: (Google Docs Offline) - C:\Users\Ryan\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2015-09-02]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Ryan\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-07-27]
CHR Extension: (Gmail) - C:\Users\Ryan\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-03-28]

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [361984 2012-12-19] (Advanced Micro Devices, Inc.) [File not signed]
R2 AndServMgr; C:\Program Files\AMI\DuOS\AndServMgr.exe [82384 2015-08-06] (American Megatrends Inc.)
S3 BRSptSvc; C:\ProgramData\BitRaider\BRSptSvc.exe [915736 2013-06-11] (BitRaider, LLC)
S3 BstHdAndroidSvc; C:\Program Files (x86)\BlueStacks\HD-Service.exe [433784 2015-06-16] (BlueStack Systems, Inc.)
R2 BstHdLogRotatorSvc; C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe [413304 2015-06-16] (BlueStack Systems, Inc.)
R2 BstHdUpdaterSvc; C:\Program Files (x86)\BlueStacks\HD-UpdaterService.exe [831096 2015-07-21] (BlueStack Systems, Inc.)
R2 Ds3Service; C:\Users\Ryan\Desktop\SCP DS3 Driver Package\ScpServer\bin\ScpService.exe [381952 2014-06-29] (Scarlet.Crush Productions) [File not signed]
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1156384 2015-10-11] (NVIDIA Corporation)
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-03] (Macrovision Corporation) [File not signed]
R2 LightScribeService; c:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe [73728 2010-05-19] (Hewlett-Packard Company) [File not signed]
S2 LiveUpdateSvc; C:\Program Files (x86)\IObit\LiveUpdate\LiveUpdate.exe [2909472 2015-07-30] (IObit)
S2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23816 2015-04-30] (Microsoft Corporation)
S3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [366544 2015-04-30] (Microsoft Corporation)
S3 npggsvc; C:\Windows\SysWOW64\GameMon.des [4302576 2012-08-15] (INCA Internet Co., Ltd.) [File not signed]
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1873696 2015-10-11] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe [5568288 2015-10-11] (NVIDIA Corporation)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2013-05-17] ()
R2 RalinkRegistryWriter; C:\Program Files (x86)\Ralink\Common\RaRegistry.exe [372736 2012-01-12] (Ralink Technology, Corp.) [File not signed]
R2 RalinkRegistryWriter64; C:\Program Files (x86)\Ralink\Common\RaRegistry64.exe [447488 2012-01-12] (Ralink Technology, Corp.) [File not signed]
S2 RaMediaServer; C:\Program Files (x86)\Ralink\Common\RaMediaServer.exe [625728 2011-08-18] ()
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [295128 2015-05-16] (Realtek Semiconductor)
S3 ServiceLayer; C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe [575488 2008-09-08] (Nokia.) [File not signed]
R2 tvnserver; C:\Program Files (x86)\TightVNC\tvnserver.exe [828944 2011-08-03] (GlavSoft LLC.)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2009-07-13] (Microsoft Corporation)
R2 WysePocketCloud; C:\Program Files (x86)\Wyse\PocketCloud Windows Companion\PocketCloudService.exe [191488 2012-11-05] () [File not signed]
R2 WyseRemoteAccess; C:\Program Files (x86)\Wyse\PocketCloud Windows Companion\WyseRemoteAccess.exe [1436160 2012-11-05] (Wyse Technology.) [File not signed]

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-13] (Microsoft Corporation)
S3 bcbtums; C:\Windows\System32\drivers\bcbtums.sys [172760 2015-01-19] (Broadcom Corporation.)
R2 BstHdDrv; C:\Program Files (x86)\BlueStacks\HD-Hypervisor-amd64.sys [145528 2015-06-16] (BlueStack Systems)
R0 BtHidBus; C:\Windows\System32\Drivers\BtHidBus.sys [25056 2011-12-21] (IVT Corporation.)
S3 CpqDfw; C:\Windows\System32\drivers\CpqDfw.sys [27456 2012-05-29] (Windows ® Codename Longhorn DDK provider)
S3 cqcpu; C:\Windows\System32\drivers\cqcpu.sys [24376 2010-03-01] ()
R1 DuoVMDrv; C:\Windows\System32\DRIVERS\DuoVMDrv.sys [239536 2015-07-31] (American Megatrends Inc.)
S3 ebdrv; C:\Windows\system32\DRIVERS\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
R1 HWiNFO32; C:\Windows\SysWOW64\drivers\HWiNFO64A.SYS [26528 2015-01-30] (REALiX™)
S3 IvtAudioBusSrv; C:\Windows\System32\Drivers\IvtBtBus.sys [27256 2012-12-24] (IVT Corporation.)
S3 IvtPanBusSrv; C:\Windows\System32\Drivers\btnetBus.sys [31480 2012-12-24] (IVT Corporation.)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [280376 2015-03-04] (Microsoft Corporation)
S3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [124568 2015-03-04] (Microsoft Corporation)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [20768 2015-10-11] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [50472 2015-08-10] (NVIDIA Corporation)
S3 PcaSp60; C:\Windows\SysWOW64\DRIVERS\PcaSp60.sys [38912 2010-09-07] (Printing Communications Assoc., Inc. (PCAUSA))
S3 RtkBtFilter; C:\Windows\System32\DRIVERS\RtkBtfilter.sys [555736 2014-04-27] (Realtek Semiconductor Corporation)
R3 ScpVBus; C:\Windows\System32\DRIVERS\ScpVBus.sys [39168 2014-04-27] (Scarlet.Crush Productions)
S3 SIVDRIVER; C:\Windows\system32\Drivers\SIVX64.sys [57312 2008-06-14] (Ray Hinchliffe)
R0 SmartDefragDriver; C:\Windows\System32\Drivers\SmartDefragDriver.sys [21184 2014-06-04] (IObit)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [564824 2013-02-14] (Duplex Secure Ltd.)
S3 toshidpt; C:\Windows\System32\drivers\Toshidpt.sys [9608 2009-06-19] (TOSHIBA Corporation.)
S3 uvhid; C:\Windows\System32\DRIVERS\uvhid.sys [20992 2013-04-11] (Windows ® Win 7 DDK provider)
S3 WinRing0_1_2_0; C:\Program Files (x86)\IObit\Game Booster 3\Driver\WinRing0x64.sys [14544 2010-11-01] (OpenLibSys.org)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-11-14 15:28 - 2015-11-14 15:28 - 00920662 _____ C:\Users\Ryan\Desktop\Speccy.txt
2015-11-14 15:27 - 2015-11-14 15:27 - 00000798 _____ C:\Users\Public\Desktop\Speccy.lnk
2015-11-14 15:27 - 2015-11-14 15:27 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Speccy
2015-11-14 15:27 - 2015-11-14 15:27 - 00000000 ____D C:\Program Files\Speccy
2015-11-14 15:24 - 2015-11-14 15:26 - 05127432 _____ (Piriform Ltd) C:\Users\Ryan\Desktop\spsetup128.exe
2015-11-14 03:01 - 2015-11-14 03:01 - 00000000 ____D C:\Windows\system32\SPReview
2015-11-12 17:23 - 2015-11-12 17:23 - 00001013 _____ C:\Users\Public\Desktop\PowerISO.lnk
2015-11-12 17:23 - 2015-11-12 17:23 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PowerISO
2015-11-12 17:23 - 2015-11-12 17:23 - 00000000 ____D C:\Program Files (x86)\PowerISO
2015-11-12 17:23 - 2015-10-08 02:00 - 00127760 _____ (Power Software Ltd) C:\Windows\system32\Drivers\scdemu.sys
2015-11-12 17:22 - 2015-11-12 17:22 - 02621480 _____ (Power Software Ltd) C:\Users\Ryan\Downloads\PowerISO6-cnet.exe
2015-11-12 17:14 - 2015-11-12 17:14 - 00612520 _____ C:\Users\Ryan\Downloads\isoburner_setup-65690114.exe
2015-11-12 17:14 - 2015-11-12 17:14 - 00564752 _____ (Media Freeware ) C:\Users\Ryan\Downloads\isoburner_setup.exe
2015-11-12 17:14 - 2015-11-12 17:14 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Free ISO Burner
2015-11-12 17:14 - 2015-11-12 17:14 - 00000000 ____D C:\Program Files (x86)\FreeISOBurner
2015-11-11 15:26 - 2015-11-11 15:26 - 04404952 _____ (Kaspersky Lab ZAO) C:\Users\Ryan\Desktop\tdsskiller (1).exe
2015-11-11 15:22 - 2015-11-11 15:22 - 00034663 _____ C:\ComboFix.txt
2015-11-11 13:44 - 2015-11-11 13:44 - 00338160 _____ C:\Windows\Minidump\111115-55785-01.dmp
2015-11-11 13:41 - 2015-11-11 15:22 - 00000000 ____D C:\Qoobox
2015-11-11 13:41 - 2015-11-11 15:20 - 00000000 ____D C:\Windows\erdnt
2015-11-11 13:41 - 2011-06-26 01:45 - 00256000 _____ C:\Windows\PEV.exe
2015-11-11 13:41 - 2010-11-07 12:20 - 00208896 _____ C:\Windows\MBR.exe
2015-11-11 13:41 - 2009-04-19 23:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2015-11-11 13:41 - 2000-08-30 19:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2015-11-11 13:41 - 2000-08-30 19:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2015-11-11 13:41 - 2000-08-30 19:00 - 00098816 _____ C:\Windows\sed.exe
2015-11-11 13:41 - 2000-08-30 19:00 - 00080412 _____ C:\Windows\grep.exe
2015-11-11 13:41 - 2000-08-30 19:00 - 00068096 _____ C:\Windows\zip.exe
2015-11-11 13:40 - 2015-11-11 13:40 - 05638248 ____R (Swearware) C:\Users\Ryan\Desktop\ComboFix.exe
2015-11-11 13:35 - 2015-11-11 13:35 - 05200384 _____ (AVAST Software) C:\Users\Ryan\Desktop\aswmbr.exe
2015-11-11 13:34 - 2015-11-11 13:34 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Active@ ISO Burner
2015-11-11 13:34 - 2015-11-11 13:34 - 00000000 ____D C:\Program Files (x86)\LSoft Technologies
2015-11-11 05:47 - 2015-11-11 06:47 - 05286088 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2015-11-11 03:07 - 2015-11-11 03:07 - 00341352 _____ C:\Windows\Minidump\111115-58859-01.dmp
2015-11-10 21:44 - 2015-11-10 21:44 - 02941736 _____ (LSoft Technologies Inc ) C:\Users\Ryan\Downloads\IsoBurner-Setup.exe
2015-11-10 19:40 - 2015-11-10 19:41 - 181379072 _____ C:\Users\Ryan\Downloads\avg_arl_cdi_all_120_150814a10442.iso
2015-11-10 18:51 - 2015-11-10 18:51 - 00141568 _____ C:\Users\Ryan\Downloads\shexview_setup.exe
2015-11-10 18:51 - 2015-11-10 18:51 - 00000000 ____D C:\Users\Ryan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\NirSoft ShellExView
2015-11-10 18:51 - 2015-11-10 18:51 - 00000000 ____D C:\Program Files (x86)\NirSoft
2015-11-09 22:59 - 2015-11-09 23:00 - 00224968 _____ (ESET) C:\Users\Ryan\Desktop\ESETPoweliksCleaner.exe
2015-11-09 22:57 - 2015-11-10 19:12 - 00010182 _____ C:\Users\Ryan\Desktop\System Idle Process.txt
2015-11-09 22:55 - 2015-11-09 22:55 - 02508432 _____ (Sysinternals - www.sysinternals.com) C:\Users\Ryan\Desktop\procexp.exe
2015-11-09 22:51 - 2015-11-09 23:13 - 00000000 _____ C:\junk.txt
2015-11-08 16:31 - 2015-11-08 16:31 - 00001363 _____ C:\Users\Ryan\Downloads\fixlist.txt
2015-11-08 16:27 - 2015-11-08 16:37 - 00000467 _____ C:\VEW.txt
2015-11-08 16:27 - 2015-11-08 16:27 - 00006063 _____ C:\Users\Ryan\Desktop\VEW.txt
2015-11-08 16:25 - 2015-11-08 16:25 - 00061440 _____ ( ) C:\Users\Ryan\Desktop\VEW.exe
2015-11-07 17:24 - 2015-11-11 13:44 - 1259367026 _____ C:\Windows\MEMORY.DMP
2015-11-07 17:24 - 2015-11-07 17:24 - 00268928 _____ C:\Windows\Minidump\110715-47517-01.dmp
2015-11-07 17:13 - 2015-11-12 09:56 - 03474516 _____ C:\Windows\system32\CFG2364854530
2015-11-06 20:45 - 2015-11-14 03:33 - 00001624 _____ C:\Windows\setupact.log
2015-11-06 20:45 - 2015-11-06 20:45 - 00000000 _____ C:\Windows\setuperr.log
2015-11-06 20:38 - 2015-11-11 15:13 - 00023922 _____ C:\Windows\PFRO.log
2015-11-06 20:37 - 2015-11-06 20:37 - 00000000 _____ C:\asc_rdflag
2015-11-06 20:34 - 2015-11-06 20:34 - 00321848 _____ (Malwarebytes Corporation) C:\Users\Ryan\Downloads\mbam-clean-2.1.1.1001.exe
2015-11-06 20:32 - 2015-11-06 20:32 - 04404952 _____ (Kaspersky Lab ZAO) C:\Users\Ryan\Downloads\tdsskiller.exe
2015-11-06 20:30 - 2015-11-06 20:35 - 00001238 _____ C:\Users\Ryan\Desktop\FixExec.txt
2015-11-06 20:30 - 2015-11-06 20:30 - 00457632 _____ (Bleeping Computer, LLC) C:\Users\Ryan\Downloads\FixExec.exe
2015-11-06 20:26 - 2015-11-06 20:26 - 01801288 _____ (Malwarebytes) C:\Users\Ryan\Desktop\JRT.exe
2015-11-06 20:20 - 2015-11-06 20:20 - 00000070 _____ C:\Windows\RAVTC.TMP
2015-11-06 20:13 - 2015-11-06 20:13 - 16563352 _____ (Malwarebytes Corp.) C:\Users\Ryan\Downloads\mbar-1.09.3.1001.exe
2015-11-06 19:59 - 2015-11-06 19:59 - 29619504 _____ (IObit ) C:\Users\Ryan\Downloads\IObit-Malware-Fighter-Setup.exe
2015-11-06 19:20 - 2015-11-06 19:21 - 22908888 _____ (Malwarebytes ) C:\Users\Ryan\Downloads\mbam-setup-2.2.0.1024.exe
2015-11-06 19:11 - 2015-11-07 17:36 - 00000000 ____D C:\AdwCleaner
2015-11-06 19:10 - 2015-11-06 19:10 - 01713664 _____ C:\Users\Ryan\Desktop\AdwCleaner.exe
2015-11-06 19:01 - 2015-11-08 16:40 - 00088276 _____ C:\Users\Ryan\Desktop\Addition.txt
2015-11-06 18:59 - 2015-11-14 15:30 - 00023120 _____ C:\Users\Ryan\Desktop\FRST.txt
2015-11-06 18:59 - 2015-11-14 15:30 - 00000000 ____D C:\FRST
2015-11-06 18:54 - 2015-11-06 18:54 - 02198528 _____ (Farbar) C:\Users\Ryan\Desktop\FRST64.exe
2015-11-06 18:53 - 2015-11-09 23:01 - 00000347 _____ C:\Users\Ryan\Desktop\New Text Document.txt
2015-11-06 17:33 - 2015-11-06 17:33 - 00076814 _____ C:\Users\Ryan\Desktop\runscanner.log
2015-11-06 17:27 - 2015-11-06 17:27 - 00000000 ____D C:\Users\Ryan\AppData\Roaming\Runscanner.net
2015-11-06 17:26 - 2015-11-06 17:27 - 00000000 ____D C:\runscanner
2015-11-06 17:18 - 2015-11-06 17:18 - 05200384 _____ (AVAST Software) C:\Users\Ryan\Downloads\aswmbr
2015-11-05 21:02 - 2015-11-06 20:20 - 00000000 ____D C:\Program Files (x86)\Panda Security
2015-11-05 21:01 - 2015-11-06 20:20 - 00000000 ____D C:\ProgramData\Panda Security
2015-11-05 21:01 - 2015-11-05 21:01 - 02113152 _____ C:\Users\Ryan\Downloads\PANDAFREEAV.exe
2015-11-05 18:01 - 2015-11-12 02:35 - 00002185 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2015-11-04 21:49 - 2015-11-04 21:49 - 02924672 _____ (AVG Technologies) C:\Users\Ryan\Downloads\AVG_Protection_Free_698.exe
2015-11-04 21:36 - 2015-11-04 21:36 - 05481336 _____ (Avast Software s.r.o.) C:\Users\Ryan\Downloads\avast_free_antivirus_setup_online_cnet.exe
2015-10-31 14:05 - 2015-10-31 14:05 - 00012169 _____ C:\Users\Ryan\Downloads\[kat.cr]family.feud.decades.wbfs.sfae41.ntsc.wiigm.torrent
2015-10-31 14:05 - 2015-10-31 14:05 - 00000000 ____D C:\Users\Ryan\Downloads\SFAE41 Family Feud Decades
2015-10-25 19:14 - 2015-10-02 21:18 - 00102520 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe
2015-10-25 19:12 - 2015-10-03 00:06 - 42914096 _____ C:\Windows\system32\nvcompiler.dll
2015-10-25 19:12 - 2015-10-03 00:06 - 37882488 _____ C:\Windows\SysWOW64\nvcompiler.dll
2015-10-25 19:12 - 2015-10-03 00:06 - 22306936 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll
2015-10-25 19:12 - 2015-10-03 00:06 - 18359928 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll
2015-10-25 19:12 - 2015-10-03 00:06 - 16541040 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll
2015-10-25 19:12 - 2015-10-03 00:06 - 15002304 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll
2015-10-25 19:12 - 2015-10-03 00:06 - 14832968 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll
2015-10-25 19:12 - 2015-10-03 00:06 - 13518496 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll
2015-10-25 19:12 - 2015-10-03 00:06 - 12032200 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll
2015-10-25 19:12 - 2015-10-03 00:06 - 11114616 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys
2015-10-25 19:12 - 2015-10-03 00:06 - 02869880 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll
2015-10-25 19:12 - 2015-10-03 00:06 - 02489976 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll
2015-10-25 19:12 - 2015-10-03 00:06 - 01905456 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6435850.dll
2015-10-25 19:12 - 2015-10-03 00:06 - 01564976 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6435850.dll
2015-10-25 19:12 - 2015-10-03 00:06 - 00877176 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll
2015-10-25 19:12 - 2015-10-03 00:06 - 00861816 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll
2015-10-25 19:12 - 2015-10-03 00:06 - 00689456 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll
2015-10-25 19:12 - 2015-10-03 00:06 - 00673912 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll
2015-10-25 19:12 - 2015-10-03 00:06 - 00512720 _____ (NVIDIA Corporation) C:\Windows\system32\nvEncodeAPI64.dll
2015-10-25 19:12 - 2015-10-03 00:06 - 00467912 _____ (NVIDIA Corporation) C:\Windows\system32\nvumdshimx.dll
2015-10-25 19:12 - 2015-10-03 00:06 - 00422240 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvEncodeAPI.dll
2015-10-25 19:12 - 2015-10-03 00:06 - 00414000 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFROpenGL.dll
2015-10-25 19:12 - 2015-10-03 00:06 - 00388024 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll
2015-10-25 19:12 - 2015-10-03 00:06 - 00369272 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFROpenGL.dll
2015-10-25 19:12 - 2015-10-03 00:06 - 00177416 _____ (NVIDIA Corporation) C:\Windows\system32\nvinitx.dll
2015-10-25 19:12 - 2015-10-03 00:06 - 00155976 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvinit.dll
2015-10-25 19:12 - 2015-10-03 00:06 - 00151368 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll
2015-10-25 19:12 - 2015-10-03 00:06 - 00128696 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll
2015-10-25 10:16 - 2015-10-25 10:16 - 00001054 _____ C:\Users\Public\Desktop\The Witcher® 3 - Wild Hunt.lnk
2015-10-25 10:16 - 2015-10-25 10:16 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GOG.com
2015-10-25 09:56 - 2015-10-25 09:56 - 00000000 ____D C:\Users\Ryan\Documents\The Witcher 3
2015-10-25 09:14 - 2015-10-25 09:15 - 318801672 _____ ( ) C:\Users\Ryan\Downloads\witcher3_patch_1.01.exe
2015-10-23 16:21 - 2015-10-23 17:04 - 00000000 ____D C:\Users\Ryan\Downloads\The.Witcher.3.Wild.Hunt.Patch.v1.10-GOG
2015-10-23 16:21 - 2015-10-23 16:36 - 00000000 ____D C:\Users\Ryan\Downloads\The.Witcher.3.Wild.Hunt.Hearts.of.Stone-GOG
2015-10-23 13:25 - 2015-10-23 14:20 - 00000000 ____D C:\Users\Ryan\Downloads\The Witcher 3 Wild Hunt
2015-10-22 18:06 - 2015-10-22 20:11 - 00000000 ____D C:\Program Files (x86)\BlueStacks
2015-10-22 18:06 - 2015-10-22 18:06 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BlueStacks
2015-10-22 18:06 - 2015-10-22 18:06 - 00000000 ____D C:\ProgramData\BlueStacks
2015-10-22 18:05 - 2015-10-22 18:05 - 00000000 ____D C:\Users\Ryan\AppData\Local\Bluestacks
2015-10-22 18:02 - 2015-10-22 18:04 - 265913504 _____ C:\Users\Ryan\Downloads\BlueStacksAppPlayer_0.9.30.4239_by_AJacobs_Rooted_BSEasy.exe
2015-10-22 17:48 - 2015-10-22 17:48 - 00001127 _____ C:\Users\Public\Desktop\Star Wars Battlefront II.lnk
2015-10-22 17:48 - 2015-10-22 17:48 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LucasArts
2015-10-22 16:18 - 2015-10-22 16:18 - 00000000 ____D C:\Users\Ryan\Downloads\Star Wars Battlefront II

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-11-14 15:29 - 2011-12-23 13:21 - 00000000 ____D C:\Users\Ryan\AppData\Local\CrashDumps
2015-11-14 14:47 - 2012-04-29 15:11 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-11-14 05:46 - 2011-01-26 11:19 - 02075579 _____ C:\Windows\WindowsUpdate.log
2015-11-14 03:42 - 2009-07-13 23:45 - 00015568 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-11-14 03:42 - 2009-07-13 23:45 - 00015568 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-11-14 03:33 - 2013-08-05 18:43 - 00000000 ____D C:\ProgramData\NVIDIA
2015-11-14 03:33 - 2009-07-14 00:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-11-12 17:00 - 2014-04-22 13:12 - 00000000 ____D C:\Users\Ryan\Desktop\Hyper Spin
2015-11-12 17:00 - 2013-02-14 20:36 - 00000000 ____D C:\Users\Ryan\AppData\Local\Updater21804
2015-11-12 03:50 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\AppCompat
2015-11-12 03:01 - 2013-04-14 11:48 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013
2015-11-12 03:01 - 2012-01-16 10:48 - 00000000 ____D C:\ProgramData\Microsoft Help
2015-11-11 15:22 - 2009-07-13 22:20 - 00000000 __RHD C:\Users\Default
2015-11-11 15:15 - 2009-07-13 21:34 - 00000215 _____ C:\Windows\system.ini
2015-11-11 14:06 - 2011-09-28 07:55 - 00000052 _____ C:\Windows\SysWOW64\DOErrors.log
2015-11-11 13:44 - 2013-01-21 13:51 - 00000000 ____D C:\Windows\Minidump
2015-11-11 06:47 - 2012-04-29 15:11 - 00780488 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-11-11 06:47 - 2012-04-29 15:11 - 00003768 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-11-11 06:47 - 2011-09-27 07:58 - 00142536 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-11-11 03:44 - 2013-07-13 02:00 - 00000000 ____D C:\Windows\system32\MRT
2015-11-11 03:38 - 2011-09-29 17:51 - 145617392 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-11-11 03:06 - 2014-12-11 04:02 - 00000000 ____D C:\Windows\system32\appraiser
2015-11-11 03:06 - 2014-07-10 02:06 - 00000000 ___SD C:\Windows\system32\CompatTel
2015-11-11 03:02 - 2009-07-13 21:34 - 00000478 _____ C:\Windows\win.ini
2015-11-10 19:34 - 2015-08-20 17:27 - 00000000 ____D C:\Users\Ryan\AppData\Roaming\Kodi
2015-11-07 17:21 - 2015-05-17 08:17 - 00000000 ____D C:\Program Files\Microsoft Security Client
2015-11-07 17:10 - 2013-10-15 17:42 - 00000898 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-11-07 17:10 - 2013-10-15 17:42 - 00000894 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-11-07 17:10 - 2013-02-02 11:59 - 00000904 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1725188070-1093038038-2835830549-1000UA.job
2015-11-07 16:56 - 2012-01-06 19:41 - 00000000 ____D C:\Users\Ryan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Image-Line
2015-11-07 16:56 - 2012-01-06 19:39 - 00000000 ____D C:\Program Files (x86)\Image-Line
2015-11-07 03:35 - 2014-03-19 20:45 - 00000000 ____D C:\ProgramData\ProductData
2015-11-07 03:29 - 2013-02-02 11:59 - 00000852 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1725188070-1093038038-2835830549-1000Core.job
2015-11-06 20:51 - 2011-09-26 13:32 - 00123136 _____ C:\Users\Ryan\AppData\Local\GDIPFONTCACHEV1.DAT
2015-11-06 20:39 - 2009-07-13 23:45 - 00475984 _____ C:\Windows\system32\FNTCACHE.DAT
2015-11-06 20:37 - 2014-04-07 02:28 - 99581952 _____ C:\Windows\system32\config\SOFTWARE.iodefrag.bak
2015-11-06 20:37 - 2014-04-07 02:28 - 00401408 _____ C:\Windows\system32\config\DEFAULT.iodefrag.bak
2015-11-06 20:37 - 2014-04-07 02:28 - 00061440 _____ C:\Windows\system32\config\SAM.iodefrag.bak
2015-11-06 20:37 - 2014-04-07 02:28 - 00028672 _____ C:\Windows\system32\config\SECURITY.iodefrag.bak
2015-11-06 20:37 - 2011-09-26 13:28 - 00000000 ____D C:\Users\Ryan
2015-11-06 19:12 - 2009-07-14 00:13 - 00784956 _____ C:\Windows\system32\PerfStringBackup.INI
2015-11-05 22:39 - 2015-05-16 15:06 - 00000000 ____D C:\Users\Mcx1-TYRANT.TyRaNt
2015-11-05 22:38 - 2014-06-10 12:16 - 00000000 ____D C:\Users\Ryan\AppData\Roaming\ProductData
2015-11-05 22:38 - 2013-10-18 18:19 - 00000000 ____D C:\Users\Ryan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-11-05 22:38 - 2013-10-15 17:43 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-11-05 22:38 - 2013-10-15 17:42 - 00000000 ____D C:\Program Files (x86)\Google
2015-11-05 22:38 - 2012-01-16 10:50 - 00000000 ____D C:\Windows\System32\Tasks\OfficeSoftwareProtectionPlatform
2015-11-05 22:38 - 2011-01-26 11:43 - 00000000 ____D C:\ProgramData\RoxioNow
2015-11-05 22:38 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\registration
2015-11-05 21:14 - 2011-01-27 00:27 - 00000000 ____D C:\ProgramData\Recovery
2015-11-01 02:40 - 2011-09-29 19:39 - 00000000 ____D C:\Users\Ryan\AppData\Roaming\uTorrent
2015-10-29 02:31 - 2014-07-02 13:25 - 00000328 _____ C:\Windows\Tasks\HPCeeScheduleForRyan.job
2015-10-25 19:14 - 2013-08-05 18:44 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
2015-10-25 19:14 - 2013-08-05 18:41 - 00000000 ____D C:\ProgramData\NVIDIA Corporation
2015-10-25 19:14 - 2012-02-23 21:37 - 00000000 ____D C:\Temp
2015-10-25 14:27 - 2015-09-10 17:38 - 00003116 ____H C:\Users\Ryan\.swfinfo
2015-10-25 10:18 - 2009-07-14 00:32 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2015-10-25 09:46 - 2014-07-19 14:03 - 00000000 ____D C:\Users\Ryan\AppData\Local\Glyph
2015-10-24 08:05 - 2014-07-19 14:03 - 00000000 ____D C:\Program Files (x86)\Glyph
2015-10-23 02:41 - 2013-04-08 21:40 - 00000000 ____D C:\ProgramData\BlueStacksSetup
2015-10-22 18:06 - 2009-07-13 22:20 - 00000000 __RHD C:\Users\Public\Libraries
2015-10-22 17:08 - 2015-09-04 22:31 - 00000000 ____D C:\Users\Ryan\.VirtualBox
2015-10-22 17:02 - 2009-07-14 00:08 - 00032624 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2015-10-19 07:01 - 2014-05-31 19:59 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive
2015-10-15 18:37 - 2015-10-07 20:04 - 00000000 ____D C:\ProgramData\Oracle

==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2015-11-10 01:02

==================== End of FRST.txt ============================

Attached Files

Speccy.txt 899.04KB 468 downloads

Edited by rct8787, 14 November 2015 - 02:38 PM.

#18
RKinner

Posted 14 November 2015 - 05:58 PM

Malware Expert

Expert
24,624 posts

I found something this time:

HKLM\...\Run: [TabTip_64] => "C:\PROGRA~3\TabTip_64.exe"

TabTip_64.exe is a random name even tho it looks sort of legit.

Download the attached fixlist.txt to the same location as FRST

Run FRST and press Fix

A fix log will be generated please post that. Run FRST again, check the Additions box and then Scan. You will get two logs. Post them both.

Your hard drive C:\ looks pretty bad. I'd say it is time to clone it before you lose it.

Attribute name Seek Error Rate

Real value 0

Current 87

Worst 60

Threshold 30

Raw Value 001D9C59B1

Status Good

Attribute name Command Timeout

Real value 4,295,032,833

Current 100

Worst 99

Threshold 0

Raw Value 0000010001

Status Good

1. Double-click My Computer, and then right-click the hard disk that you want to check. C:

2. Click Properties, and then click Tools.

3. Under Error-checking, click Check Now. A dialog box that shows the Check disk options is displayed,

4. Check both boxes and then click Start.

You will receive the following message:

The disk check could not be performed because the disk check utility needs exclusive access to some Windows files on the disk. These files can be accessed by restarting Windows. Do you want to schedule the disk check to occur the next time you restart the computer?

Click Yes to schedule the disk check, but don't restart yet.

Right click on (My) Computer and select Manage (Continue) Then the Event Viewer. Next select Windows Logs. Right click on System and Clear Log, Clear. Repeat for Application. Reboot. The disk check will run and will probably take an hour or more to finish.

Start, All Programs, Accessories then right click on Command Prompt and Run as Administrator. Then type (with an Enter after each line).

sfc /scannow

(SPACE after sfc. This will check your critical system files. Does this finish without complaint? IF it says it couldn't fix everything then:

Copy the next two lines:

findstr /c:"[SR]" \windows\logs\cbs\cbs.log > \windows\logs\cbs\junk.txt

notepad \windows\logs\cbs\junk.txt

Start, All Programs, Accessories, right click on Command Prompt and Run as Administrator, Continue. Right click and Paste or Edit then Paste and the copied line should appear.

Hit Enter if notepad does not open. Copy and paste the text from notepad into a reply. Close nOtepad. Close the Command Window.

1~~. Please download the Event Viewer Tool by Vino Rosso~~

~~http://images.malwar...om/vino/VEW.exe~~

~~and save it to your Desktop:~~

2. Right-click VEW.exe and Run AS Administrator

3. Under 'Select log to query', select:

* System

4. Under 'Select type to list', select:

* Error

* Warning

Then use the 'Number of events' as follows:

1. Click the radio button for 'Number of events'

Type 20 in the 1 to 20 box

Then click the Run button.

Notepad will open with the output log.

Please post the Output log in your next reply then repeat but select Application. (Second time you run vew it will overwrite the first log so copy it to a reply or rename it first.)

Any change?

#19
rct8787

Posted 15 November 2015 - 08:31 PM

Member

Topic Starter
Member
14 posts

ok heres all the logs.

Fix result of Farbar Recovery Scan Tool (x64) Version:05-11-2015
Ran by Ryan (2015-11-15 14:39:28) Run:5
Running from C:\Users\Ryan\Desktop
Loaded Profiles: Ryan (Available Profiles: Ryan & Mcx1-TYRANT)
Boot Mode: Normal
==============================================

fixlist content:
*****************
HKLM\...\Run: [TabTip_64] => "C:\PROGRA~3\TabTip_64.exe"
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\S-1-5-21-1725188070-1093038038-2835830549-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Local Page =
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-1725188070-1093038038-2835830549-1000 -> DefaultScope {5ED88E19-FCB1-4428-9612-3E22A725041E} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3306058&CUI=UN26255233522486923&UM=2
SearchScopes: HKU\S-1-5-21-1725188070-1093038038-2835830549-1000 -> {5ED88E19-FCB1-4428-9612-3E22A725041E} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3306058&CUI=UN26255233522486923&UM=2
S3 WinRing0_1_2_0; C:\Program Files (x86)\IObit\Game Booster 3\Driver\WinRing0x64.sys [14544 2010-11-01] (OpenLibSys.org)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
2015-11-05 22:39 - 2015-05-16 15:06 - 00000000 ____D C:\Users\Mcx1-TYRANT.TyRaNt
2015-11-05 22:38 - 2014-06-10 12:16 - 00000000 ____D C:\Users\Ryan\AppData\Roaming\ProductData
2015-11-05 22:38 - 2013-10-18 18:19 - 00000000 ____D C:\Users\Ryan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-11-05 22:38 - 2013-10-15 17:43 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
*****************

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\TabTip_64 => value not found.
"HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer" => key removed successfully
"HKU\S-1-5-21-1725188070-1093038038-2835830549-1000\SOFTWARE\Policies\Microsoft\Internet Explorer" => key removed successfully
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Local Page => value restored successfully
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value restored successfully
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value restored successfully
HKU\S-1-5-21-1725188070-1093038038-2835830549-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value removed successfully
"HKU\S-1-5-21-1725188070-1093038038-2835830549-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{5ED88E19-FCB1-4428-9612-3E22A725041E}" => key removed successfully
HKCR\CLSID\{5ED88E19-FCB1-4428-9612-3E22A725041E} => key not found.
WinRing0_1_2_0 => service removed successfully
catchme => service removed successfully
C:\Users\Mcx1-TYRANT.TyRaNt => moved successfully
C:\Users\Ryan\AppData\Roaming\ProductData => moved successfully
C:\Users\Ryan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome => moved successfully
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome => moved successfully

==== End of Fixlog 14:39:28 ====

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:05-11-2015
Ran by Ryan (administrator) on TYRANT (15-11-2015 14:40:11)
Running from C:\Users\Ryan\Desktop
Loaded Profiles: Ryan (Available Profiles: Ryan & Mcx1-TYRANT)
Platform: Windows 7 Home Premium (X64) Language: English (United States)
Internet Explorer Version 9 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(American Megatrends Inc.) C:\Program Files\AMI\DuOS\AndServMgr.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(BlueStack Systems, Inc.) C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe
(BlueStack Systems, Inc.) C:\Program Files (x86)\BlueStacks\HD-UpdaterService.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(Scarlet.Crush Productions) C:\Users\Ryan\Desktop\SCP DS3 Driver Package\ScpServer\bin\ScpService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Ralink Technology, Corp.) C:\Program Files (x86)\Ralink\Common\RaRegistry.exe
(Ralink Technology, Corp.) C:\Program Files (x86)\Ralink\Common\RaRegistry64.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
(Roxio) C:\Program Files (x86)\Roxio\RoxioNow Player\RNowSvc.exe
(Splashtop Inc.) C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
(Splashtop Inc.) C:\Program Files (x86)\Splashtop\Splashtop Software Updater\SSUService.exe
(GlavSoft LLC.) C:\Program Files (x86)\TightVNC\tvnserver.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(AMD) C:\Windows\System32\atieclxx.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe
(Microsoft Corporation) C:\Program Files\Microsoft IntelliType Pro\itype.exe
(Microsoft Corporation) C:\Program Files\Microsoft IntelliPoint\ipoint.exe
(Microsoft Corporation) C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Google Inc.) C:\Users\Ryan\AppData\Local\Programs\Google\MusicManager\MusicManager.exe
(Plex, Inc.) C:\Program Files (x86)\Plex\Plex Media Server\Plex Media Server.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(Ralink Technology, Inc.) C:\Program Files (x86)\Ralink\Common\RaWiFi.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Python Software Foundation) C:\Program Files (x86)\Plex\Plex Media Server\PlexScriptHost.exe
(Plex, Inc.) C:\Program Files (x86)\Plex\Plex Media Server\PlexDlnaServer.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
() C:\Program Files (x86)\Wyse\PocketCloud Windows Companion\PocketCloudService.exe
(Wyse Technology.) C:\Program Files (x86)\Wyse\PocketCloud Windows Companion\WyseRemoteAccess.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [itype] => c:\Program Files\Microsoft IntelliType Pro\itype.exe [1873256 2011-08-10] (Microsoft Corporation)
HKLM\...\Run: [IntelliPoint] => c:\Program Files\Microsoft IntelliPoint\ipoint.exe [2417032 2011-08-01] (Microsoft Corporation)
HKLM\...\Run: [XboxStat] => C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe [825184 2009-09-30] (Microsoft Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2655520 2015-10-11] (NVIDIA Corporation)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13876952 2015-05-16] (Realtek Semiconductor)
HKLM-x32\...\Run: [amd_dc_opt] => C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe [77824 2008-07-22] (AMD)
HKU\S-1-5-21-1725188070-1093038038-2835830549-1000\...\Run: [MusicManager] => C:\Users\Ryan\AppData\Local\Programs\Google\MusicManager\MusicManager.exe [7646208 2015-08-13] (Google Inc.)
HKU\S-1-5-21-1725188070-1093038038-2835830549-1000\...\Run: [Plex Media Server] => C:\Program Files (x86)\Plex\Plex Media Server\Plex Media Server.exe [6274184 2015-08-23] (Plex, Inc.)
HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [301568 2015-11-15] (Microsoft Corporation)
Lsa: [Notification Packages] scecli C:\Program Files\WIDCOMM\Bluetooth Software\BtwProximityCP.dll
ShellIconOverlayIdentifiers: [ GoogleDriveBlacklisted] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2015-10-12] (Google)
ShellIconOverlayIdentifiers: [ GoogleDriveSynced] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2015-10-12] (Google)
ShellIconOverlayIdentifiers: [ GoogleDriveSyncing] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2015-10-12] (Google)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk [2015-01-19]
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Ralink Wireless Utility.lnk [2013-01-09]
ShortcutTarget: Ralink Wireless Utility.lnk -> C:\Program Files (x86)\Ralink\Common\RaWiFi.exe (Ralink Technology, Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\..\Interfaces\{BBF9F091-EADE-4E1C-AB76-D5897FD5207B}: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{C4349D22-40F8-480F-AD78-E820B327C557}: [DhcpNameServer] 209.18.47.61 209.18.47.62

Internet Explorer:
==================
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.msn.com/HPDSK/1
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.msn.com/HPDSK/1
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-1725188070-1093038038-2835830549-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.yahoo.com/
HKU\S-1-5-21-1725188070-1093038038-2835830549-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM -> {ec29edf6-ad3c-4e1c-a087-d6cb81400c43} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPDTDF&pc=HPDTDF&src=IE-SearchBox
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> {ec29edf6-ad3c-4e1c-a087-d6cb81400c43} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPDTDF&pc=HPDTDF&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-1725188070-1093038038-2835830549-1000 -> DefaultScope {ec29edf6-ad3c-4e1c-a087-d6cb81400c43} URL =
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office15\OCHelper.dll [2015-10-20] (Microsoft Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21] (Microsoft Corp.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL [2014-01-23] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL [2015-10-13] (Microsoft Corporation)
BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll [2013-08-28] (Hewlett-Packard)
BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll [2015-10-20] (Microsoft Corporation)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21] (Microsoft Corp.)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL [2014-01-22] (Microsoft Corporation)
BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL [2015-10-13] (Microsoft Corporation)
BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll [2013-08-28] (Hewlett-Packard)
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL [2014-03-12] (Microsoft Corporation)