This topic is locked
when i try to downlaod something it downloads in chrome then i close chrome so install it then it disappears i have no idea whats going on
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:10-01-2015 01
Ran by Acer (administrator) on ACER-PC (13-01-2016 19:29:08)
Running from C:\Users\Acer\Downloads
Loaded Profiles: Acer (Available Profiles: Acer)
Platform: Microsoft Windows 7 Starter Service Pack 1 (X86) Language: العربية (السعودية)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Cisco Consumer Products LLC) C:\Program Files\Linksys AE6000\WPS_Mon.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
() C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe
(RealNetworks, Inc.) C:\Program Files\Real\RealPlayer\RPDS\Bin\rpdsvc.exe
() C:\Program Files\Real\UpdateService\RealPlayerUpdateSvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe
(Microsoft Corporation) C:\Program Files\Microsoft Application Virtualization Client\sftlist.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(RealNetworks, Inc.) C:\Program Files\Real\RealPlayer\Update\realsched.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
() C:\Program Files\RealNetworks\RealDownloader\downloader2.exe
(Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Valve Corporation) C:\Program Files\Steam\Steam.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(RealNetworks, Inc.) C:\Program Files\Real\RealPlayer\RPDS\Bin\rpsystray.exe
(Valve Corporation) C:\Program Files\Steam\bin\steamwebhelper.exe
(Adobe Systems Incorporated) C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Google Inc.) C:\Users\Acer\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Acer\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Acer\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Acer\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Acer\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Acer\AppData\Local\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWXUX.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWXUXWorker.exe
(Microsoft Corporation) C:\Windows\System32\wuauclt.exe
==================== Registry (Whitelisted) ===========================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [12000984 2013-07-04] (Realtek Semiconductor)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [157480 2015-02-13] (Apple Inc.)
HKLM\...\Run: [TkBellExe] => C:\Program Files\Real\RealPlayer\update\realsched.exe [296520 2015-05-15] (RealNetworks, Inc.)
HKLM\...\Run: [RealDownloader] => C:\Program Files\RealNetworks\RealDownloader\downloader2.exe [560192 2014-10-29] ()
HKU\S-1-5-21-119598711-2110433348-3638664424-1000\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [53288576 2015-06-30] (Skype Technologies S.A.)
HKU\S-1-5-21-119598711-2110433348-3638664424-1000\...\Run: [Google Update] => C:\Users\Acer\AppData\Local\Google\Update\GoogleUpdate.exe [107848 2015-05-15] (Google Inc.)
HKU\S-1-5-21-119598711-2110433348-3638664424-1000\...\Run: [Steam] => C:\Program Files\Steam\steam.exe [2899136 2015-08-12] (Valve Corporation)
HKU\S-1-5-21-119598711-2110433348-3638664424-1000\...\MountPoints2: {113cb14b-fb16-11e4-ae96-806e6f6e6963} - D:\Setup.exe
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\RealPlayer Cloud Service UI.lnk [2015-05-15]
ShortcutTarget: RealPlayer Cloud Service UI.lnk -> C:\Program Files\Real\RealPlayer\RPDS\Bin\rpsystray.exe (RealNetworks, Inc.)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704 2011-08-30] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.100.1
Tcpip\..\Interfaces\{480AF3C1-99A3-4514-9449-0E75A003E0CA}: [DhcpNameServer] 192.168.100.1
Tcpip\..\Interfaces\{97BB15F6-C32F-48C5-B5A6-6CC3106B88DE}: [DhcpNameServer] 192.168.100.1
Internet Explorer:
==================
BHO: RealNetworks Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\Program Files\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll [2014-10-26] (RealDownloader)
Toolbar: HKU\S-1-5-21-119598711-2110433348-3638664424-1000 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
FireFox:
========
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_11_9_900_110.dll [2015-05-15] ()
FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll [2014-10-30] ()
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~3\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin: @real.com/nppl3260;version=17.0.15.10 -> C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll [2015-05-15] (RealNetworks, Inc.)
FF Plugin: @real.com/nprndlhtml5videoshim;version=17.0.15 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll [2014-10-26] (RealNetworks, Inc.)
FF Plugin: @real.com/nprpplugin;version=17.0.15.10 -> C:\Program Files\Real\RealPlayer\Netscape6\nprpplugin.dll [2015-05-15] (RealPlayer Cloud)
FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-07-22] (VideoLAN)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-05-01] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-119598711-2110433348-3638664424-1000: @tools.google.com/Google Update;version=3 -> C:\Users\Acer\AppData\Local\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-02] (Google Inc.)
FF Plugin HKU\S-1-5-21-119598711-2110433348-3638664424-1000: @tools.google.com/Google Update;version=9 -> C:\Users\Acer\AppData\Local\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-02] (Google Inc.)
FF HKLM\...\Firefox\Extensions: [{338950EA-82DB-44C1-930D-0C28E023C9F0}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext
FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext [2015-05-15] [not signed]
FF HKLM\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext
Chrome:
=======
CHR Profile: C:\Users\Acer\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (محرّر مستندات Google) - C:\Users\Acer\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-05-15]
CHR Extension: (Google Drive) - C:\Users\Acer\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-10-22]
CHR Extension: (Youtube) - C:\Users\Acer\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-09-24]
CHR Extension: (بحث Google) - C:\Users\Acer\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-10-28]
CHR Extension: (مستندات Google في وضع عدم الاتصال) - C:\Users\Acer\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2015-11-19]
CHR Extension: (AgarioMods Evergreen Script) - C:\Users\Acer\AppData\Local\Google\Chrome\User Data\Default\Extensions\nhjgdbihpkphlammdaeicdemggagfbdo [2015-09-18]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Acer\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-07-25]
CHR Extension: (Gmail) - C:\Users\Acer\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-05-15]
StartMenuInternet: Google Chrome.QSTSPJKQN662YWIUACZ22YQOZY - C:\Users\Acer\AppData\Local\Google\Chrome\Application\chrome.exe
==================== Services (Whitelisted) ========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
S3 cphs; C:\Windows\system32\IntelCpHeciSvc.exe [279024 2013-05-28] (Intel Corporation)
R2 RealNetworks Downloader Resolver Service; C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe [39568 2014-10-26] ()
R2 RealPlayer Cloud Service; C:\Program Files\Real\RealPlayer\RPDS\Bin\rpdsvc.exe [1141848 2015-05-15] (RealNetworks, Inc.)
R2 RealPlayerUpdateSvc; C:\Program Files\Real\UpdateService\RealPlayerUpdateSvc.exe [31856 2014-10-30] ()
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-27] (Microsoft Corporation)
===================== Drivers (Whitelisted) ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R3 AE6000; C:\Windows\System32\DRIVERS\AE6000w7.sys [1583136 2013-01-25] (Ralink Technology Corp.)
R3 e1cexpress; C:\Windows\System32\DRIVERS\e1c6232.sys [368392 2013-02-20] (Intel Corporation)
R0 iaStorA; C:\Windows\System32\DRIVERS\iaStorA.sys [531816 2013-06-27] (Intel Corporation)
R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [25960 2013-06-27] (Intel Corporation)
R0 iusb3hcs; C:\Windows\System32\DRIVERS\iusb3hcs.sys [16880 2013-02-22] (Intel Corporation)
R3 MEI; C:\Windows\System32\DRIVERS\HECI.sys [56432 2013-01-23] (Intel Corporation)
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2016-01-13 19:29 - 2016-01-13 19:29 - 00010622 _____ C:\Users\Acer\Downloads\FRST.txt
2016-01-13 19:28 - 2016-01-13 19:29 - 00000000 ____D C:\FRST
2016-01-13 19:28 - 2016-01-13 19:28 - 01721856 _____ (Farbar) C:\Users\Acer\Downloads\FRST.exe
2016-01-13 19:17 - 2016-01-13 19:17 - 01138808 _____ (TQ Digital Entertainment) C:\Users\Acer\Downloads\Arabic_Conquer_v1690_P2P.exe
2016-01-13 19:17 - 2016-01-13 19:17 - 01138808 _____ (TQ Digital Entertainment) C:\Users\Acer\Downloads\Arabic_Conquer_v1690_P2P (1).exe
2016-01-13 19:14 - 2016-01-13 19:15 - 00000000 ____D C:\gfgfg
2016-01-13 19:10 - 2016-01-13 19:10 - 00000000 ____D C:\Program Files\zf
2016-01-13 19:00 - 2016-01-13 19:18 - 00000000 ____D C:\Users\Acer\Downloads\_cfg
2016-01-03 17:16 - 2016-01-03 17:16 - 50699928 _____ (Hi-Rez Studios) C:\Users\Acer\Downloads\InstallSmite (3).exe
2016-01-03 15:01 - 2016-01-03 15:01 - 00000000 ____D C:\Users\Acer\Desktop\【ṖѴ】✌ AMAL✌
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2016-01-13 19:29 - 2009-07-14 02:37 - 00000000 ____D C:\Windows
2016-01-13 19:23 - 2009-07-14 04:34 - 00017328 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2016-01-13 19:23 - 2009-07-14 04:34 - 00017328 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2016-01-13 19:17 - 2015-05-15 16:13 - 00000000 ____D C:\Users\Acer\AppData\Roaming\Skype
2016-01-13 19:11 - 2015-05-18 07:29 - 00000000 ____D C:\Users\Acer\AppData\Local\CrashDumps
2016-01-13 19:01 - 2015-09-16 11:12 - 00000000 ____D C:\Users\Acer\Desktop\League of Legends
2016-01-13 18:40 - 2015-05-15 20:01 - 00000904 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-119598711-2110433348-3638664424-1000UA.job
2016-01-13 18:40 - 2015-05-15 15:44 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2016-01-13 12:55 - 2015-07-24 20:24 - 00000000 ____D C:\Program Files\Steam
2016-01-13 12:55 - 2009-07-14 04:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-01-12 13:07 - 2015-05-15 20:01 - 00000852 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-119598711-2110433348-3638664424-1000Core.job
2016-01-10 17:44 - 2011-04-12 01:34 - 00682258 _____ C:\Windows\system32\perfh00C.dat
2016-01-10 17:44 - 2011-04-12 01:34 - 00478718 _____ C:\Windows\system32\perfh001.dat
2016-01-10 17:44 - 2011-04-12 01:34 - 00129672 _____ C:\Windows\system32\perfc00C.dat
2016-01-10 17:44 - 2011-04-12 01:34 - 00094286 _____ C:\Windows\system32\perfc001.dat
2016-01-10 17:44 - 2010-11-20 21:01 - 02156158 _____ C:\Windows\system32\PerfStringBackup.INI
2016-01-10 17:44 - 2009-07-14 02:37 - 00000000 ____D C:\Windows\inf
2015-12-25 12:42 - 2015-05-17 16:07 - 00000000 ____D C:\Users\Acer\AppData\Local\ElevatedDiagnostics
2015-12-25 12:42 - 2009-07-14 02:37 - 00000000 ____D C:\Windows\system32\NDF
2015-12-25 11:57 - 2015-07-08 05:07 - 00000000 ____D C:\Users\Acer\AppData\Local\Popcorn-Time
2015-12-25 09:53 - 2015-08-26 12:40 - 00000000 ____D C:\Users\Acer\Desktop\not needed
2015-12-21 06:48 - 2015-05-15 14:51 - 00000000 ____D C:\Users\Acer
2015-12-18 23:08 - 2015-05-20 06:09 - 00000000 ___SD C:\Windows\system32\GWX
2015-12-18 06:29 - 2015-06-04 04:01 - 00000000 ____D C:\Users\Acer\AppData\Roaming\SoftGrid Client
2015-12-14 12:06 - 2009-07-14 02:37 - 00000000 ____D C:\Windows\rescache
==================== Files in the root of some directories =======
2015-10-20 17:40 - 2015-10-20 17:40 - 0003584 _____ () C:\Users\Acer\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2015-09-12 16:20 - 2015-10-19 15:44 - 0000073 _____ () C:\Users\Acer\AppData\Local\package.nw.new
Some files in TEMP:
====================
C:\Users\Acer\AppData\Local\Temp\ExPromo.exe
C:\Users\Acer\AppData\Local\Temp\GUR246E.exe
C:\Users\Acer\AppData\Local\Temp\NSISPromotionEx.dll
C:\Users\Acer\AppData\Local\Temp\update.exe
C:\Users\Acer\AppData\Local\Temp\{21ACE488-66D9-4E55-B08B-14453674C049}-44.0.2403.130_44.0.2403.125_chrome_updater.exe
==================== Bamital & volsnap =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2016-01-11 10:25
==================== End of FRST.txt ============================
Sign In
Create Account
