[Helpmeout12]

So about 3 months ago I downloaded something a little risky. About 1 month after I received an email saying that my Facebook had an attempted log in from China. I would like to note that never in my life has any account been hacked. In that 1 month I am 100% sure I did not enter in any passwords anywhere, they were all saved to my browser. However I had to enter my password for facebook and about 1 week after doing so was when the attempted log in happened. So I found a forum to help me out to see if there was any viruses on my computer. They ran me through I don't know how many different kinds of virus scans and I thought everything was fine. Fast forward to two days ago there was another attempted log in to a different website which had a different password to the one that was used to get to my facebook. So now I am siting here not sure what to do, and am here now looking for some help. At the point that I am at right now I can only assume that my computer has some sort of key logger. There is absolutely no way that the last two accounts passwords could have been in the hands of someone without so. The program that I downloaded did ask to download did ask to make changes to my driver if that helps you guys help my situation out. 

Edited by Helpmeout12, 21 April 2016 - 11:37 PM.

[Advertisements]

Hi! My name is zep516 and Welcome to Geekstogo!
I'll do the best I can to resolve your computer issue
Please make sure to carefully read any instruction that I give you. If you're not sure, or if something unexpected happens, don't continue Stop and ask! Never be afraid to ask questions!

Everything gets download to the desktop and tools are "Run as administrator."

Please download Farbar Recovery Scan Tool and save it to your Desktop.

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

• Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
• Press Scan button.
• It will produce a log called FRST.txt in the same directory the tool is run from.
• Please copy and paste log back here.
• The first time the tool is run it generates another log (Addition.txt - also located in the same directory as FRST.exe/FRST64.exe). Please also paste that along with the FRST.txt into your reply.

[zep516]

Hi! My name is zep516 and Welcome to Geekstogo!
I'll do the best I can to resolve your computer issue
Please make sure to carefully read any instruction that I give you. If you're not sure, or if something unexpected happens, don't continue Stop and ask! Never be afraid to ask questions!

Everything gets download to the desktop and tools are "Run as administrator."

Please download Farbar Recovery Scan Tool and save it to your Desktop.

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

• Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
• Press Scan button.
• It will produce a log called FRST.txt in the same directory the tool is run from.
• Please copy and paste log back here.
• The first time the tool is run it generates another log (Addition.txt - also located in the same directory as FRST.exe/FRST64.exe). Please also paste that along with the FRST.txt into your reply.

[Helpmeout12]

Sorry for the late reply, email didn't notify me but I just followed this so hopefully i get emails now

 

 

 

 

 

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:18-04-2016

Ran by Josefina (administrator) on GUADALUPE (25-04-2016 02:44:08)

Running from C:\Users\Josefina\Downloads

Loaded Profiles: Josefina (Available Profiles: Josefina)

Platform: Windows 8.1 (X64) Language: English (United States)

Internet Explorer Version 11 (Default browser: Chrome)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/

 

==================== Processes (Whitelisted) =================

 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

 

(AMD) C:\Windows\System32\atiesrxx.exe

(Advanced Micro Devices, Inc.) C:\Windows\SysWOW64\tbaseprovisioning.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\sched.exe

() C:\Program Files\ATI Technologies\ATI.ACE\a4\AdaptiveSleepService.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\avguard.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(Broadcom Corporation.) C:\Windows\System32\BtwRSupportService.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe

( ) C:\Windows\System32\dleacoms.exe

( Rsupport Corporation) C:\Program Files (x86)\RSUPPORT\MobizenService\MobizenService.exe

(OctaneVPN) C:\Program Files (x86)\OctaneVPN\resources\bin\win32\octanevpnsrvc\octanevpnsrvc.exe

() C:\Program Files (x86)\Razer\Razer Services\GSS\GameScannerService.exe

(Razer Inc.) C:\Program Files (x86)\Razer\Razer Cortex\RzKLService.exe

(A-Volute) C:\ProgramData\Razer\Synapse\Devices\Razer Surround\Driver\RzSurroundVADStreamingService.exe

(DEVGURU Co., LTD.) C:\Program Files\Samsung\USB Drivers\25_escape\conn\ss_conn_service.exe

(Toshiba Corporation) C:\Program Files\TOSHIBA\Teco\TecoService.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\avshadow.exe

(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe

(AMD) C:\Windows\System32\atieclxx.exe

() C:\Program Files (x86)\RSUPPORT\MobizenService\dat\adb.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Teco\TecoResident.exe

(Spotify Ltd) C:\Users\Josefina\AppData\Roaming\Spotify\SpotifyWebHelper.exe

(Nota Inc.) C:\Program Files (x86)\Gyazo\GyStation.exe

(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe

(Insight Software Solutions) C:\Program Files (x86)\ShortKeys2\shklite.exe

() C:\Program Files (x86)\OctaneVPN\octanevpn.exe

(TOSHIBA) C:\Program Files\TOSHIBA\TOSHIBA Smart View Utility\TDUSrv64.exe

(Razer Inc.) C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe

(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\office15\onenotem.exe

(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe

(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\avgnt.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe

() C:\ProgramData\Razer\Synapse\RzStats\RzStats.Manager.exe

(Razer, Inc.) C:\Program Files (x86)\Razer\InGameEngine\32bit\RazerIngameEngine.exe

(Razer, Inc.) C:\Users\Josefina\AppData\Local\Razer\InGameEngine\cache\RzStats.Manager\RzCefRenderProcess.exe

(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe

(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

(Eric Zhang) C:\Users\Josefina\Desktop\EZBlocker.exe

(Microsoft Corporation) C:\Windows\System32\SndVol.exe

(Spotify Ltd) C:\Users\Josefina\AppData\Roaming\Spotify\Spotify.exe

(Spotify Ltd) C:\Users\Josefina\AppData\Roaming\Spotify\SpotifyCrashService.exe

(Spotify Ltd) C:\Users\Josefina\AppData\Roaming\Spotify\Spotify.exe

(Spotify Ltd) C:\Users\Josefina\AppData\Roaming\Spotify\Spotify.exe

() C:\Program Files\AutoHotkey\AutoHotkey.exe

(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20911_x64__8wekyb3d8bbwe\livecomm.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Farbar) C:\Users\Josefina\Downloads\FRST64 (1).exe

 

 

==================== Registry (Whitelisted) ===========================

 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

 

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13667032 2014-01-20] (Realtek Semiconductor)

HKLM\...\Run: [TCrdMain] => C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe [2556768 2013-10-08] (TOSHIBA Corporation)

HKLM\...\Run: [TecoResident] => C:\Program Files\TOSHIBA\Teco\TecoResident.exe [179288 2014-01-04] (TOSHIBA Corporation)

HKLM\...\Run: [TSSSrv] => C:\Program Files (x86)\TOSHIBA\System Setting\TSSSrv.exe [296008 2013-10-21] (TOSHIBA Corporation)

HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766688 2014-03-20] (Advanced Micro Devices, Inc.)

HKLM-x32\...\Run: [TSVU] => c:\Program Files\TOSHIBA\TOSHIBA Smart View Utility\TosSmartViewLauncher.exe [516512 2013-07-23] (TOSHIBA)

HKLM-x32\...\Run: [Razer Synapse] => C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe [593216 2015-08-31] (Razer Inc.)

HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [157480 2014-10-15] (Apple Inc.)

HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1085656 2015-12-14] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [Avira SystrayStartTrigger] => C:\Program Files (x86)\Avira\Launcher\Avira.SystrayStartTrigger.exe [66328 2016-03-30] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\Antivirus\avgnt.exe [807392 2016-03-10] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [596504 2016-04-01] (Oracle Corporation)

HKU\S-1-5-21-328124280-1994820816-3203177752-1001\...\Run: [Spotify Web Helper] => C:\Users\Josefina\AppData\Roaming\Spotify\SpotifyWebHelper.exe [1525360 2016-04-16] (Spotify Ltd)

HKU\S-1-5-21-328124280-1994820816-3203177752-1001\...\Run: [puush] => C:\Program Files (x86)\puush\puush.exe

HKU\S-1-5-21-328124280-1994820816-3203177752-1001\...\Run: [Gyazo] => C:\Program Files (x86)\Gyazo\GyStation.exe [3586848 2016-02-17] (Nota Inc.)

HKU\S-1-5-21-328124280-1994820816-3203177752-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [51662464 2016-04-08] (Skype Technologies S.A.)

HKU\S-1-5-21-328124280-1994820816-3203177752-1001\...\Run: [NetUptimeMonitor] => C:\Program Files (x86)\Net Uptime Monitor\NetUptimeMonitor.exe

HKU\S-1-5-21-328124280-1994820816-3203177752-1001\...\RunOnce: [Application Restart #1] => C:\Users\Josefina\AppData\Local\Pokki\Engine\HostAppService.exe  --disable-internal-flash --noerrdialogs --no-message-box --disable-extensions --disable-web-security --disable-web-resources --disable- (the data entry has 555 more characters).

ShellIconOverlayIdentifiers: [  GoogleDriveBlacklisted] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2016-03-30] (Google)

ShellIconOverlayIdentifiers: [  GoogleDriveSynced] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2016-03-30] (Google)

ShellIconOverlayIdentifiers: [  GoogleDriveSyncing] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2016-03-30] (Google)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ShortKeys Lite.lnk [2014-08-11]

ShortcutTarget: ShortKeys Lite.lnk -> C:\Program Files (x86)\ShortKeys2\shklite.exe (Insight Software Solutions)

Startup: C:\Users\Josefina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OctaneVPN.lnk [2016-01-13]

ShortcutTarget: OctaneVPN.lnk -> C:\Program Files (x86)\OctaneVPN\octanevpn.exe ()

Startup: C:\Users\Josefina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Send to OneNote.lnk [2016-02-26]

ShortcutTarget: Send to OneNote.lnk -> C:\Program Files\Microsoft Office 15\root\office15\onenotem.exe (Microsoft Corporation)

 

==================== Internet (Whitelisted) ====================

 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

 

ProxyEnable: [S-1-5-21-328124280-1994820816-3203177752-1001] => Proxy is enabled.

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 68.105.28.12

Tcpip\..\Interfaces\{50356B71-1720-4E53-9A83-75422809EF35}: [DhcpNameServer] 192.168.1.1 68.105.28.12

Tcpip\..\Interfaces\{A3CDCC32-6451-40A0-960E-00C6CDEC270C}: [DhcpNameServer] 10.10.2.1

Tcpip\..\Interfaces\{C4CA73C3-BE41-48FE-9D4C-6AC0B598965C}: [DhcpNameServer] 192.168.1.1 68.105.28.12

 

Internet Explorer:

==================

HKU\S-1-5-21-328124280-1994820816-3203177752-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.twitch.tv/directory/following

HKU\S-1-5-21-328124280-1994820816-3203177752-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://toshiba13.msn.com/?pc=TNJB

BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2016-03-15] (Microsoft Corporation)

BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2016-04-20] (Microsoft Corporation)

BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_91\bin\ssv.dll [2016-04-24] (Oracle Corporation)

BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_91\bin\jp2ssv.dll [2016-04-24] (Oracle Corporation)

Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2015-05-07] (Microsoft Corporation)

 

FireFox:

========

FF ProfilePath: C:\Users\Josefina\AppData\Roaming\Mozilla\Firefox\Profiles\yrpp3yb8.default

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_21_0_0_182.dll [2016-03-10] ()

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_21_0_0_182.dll [2016-03-10] ()

FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-02-18] ()

FF Plugin-x32: @java.com/DTPlugin,version=11.91.2 -> C:\Program Files (x86)\Java\jre1.8.0_91\bin\dtplugin\npDeployJava1.dll [2016-04-24] (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=11.91.2 -> C:\Program Files (x86)\Java\jre1.8.0_91\bin\plugin2\npjp2.dll [2016-04-24] (Oracle Corporation)

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2015-04-23] (Microsoft Corporation)

FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll [No File]

FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-12-17] (Adobe Systems Inc.)

FF Plugin HKU\S-1-5-21-328124280-1994820816-3203177752-1001: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Josefina\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2014-10-08] (Unity Technologies ApS)

FF Extension: Avira Browser Safety - C:\Users\Josefina\AppData\Roaming\Mozilla\Firefox\Profiles\yrpp3yb8.default\Extensions\[email protected] [2016-02-25]

FF Extension: Adblock Plus - C:\Users\Josefina\AppData\Roaming\Mozilla\Firefox\Profiles\yrpp3yb8.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2015-03-14] [not signed]

 

Chrome: 

=======

CHR Profile: C:\Users\Josefina\AppData\Local\Google\Chrome\User Data\Default

CHR Extension: (Magic Actions for YouTube™) - C:\Users\Josefina\AppData\Local\Google\Chrome\User Data\Default\Extensions\abjcfabbhafbcdfjoecdgepllmpfceif [2016-03-20]

CHR Extension: (Google Drive) - C:\Users\Josefina\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-10-20]

CHR Extension: (Dwarf Galaxy NGC 4449 Theme) - C:\Users\Josefina\AppData\Local\Google\Chrome\User Data\Default\Extensions\babcfbkleafekpcmmmcdjfengfddbjpe [2015-01-09]

CHR Extension: (YouTube) - C:\Users\Josefina\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-09-24]

CHR Extension: (Bing Pong Helper) - C:\Users\Josefina\AppData\Local\Google\Chrome\User Data\Default\Extensions\cohnfldcnegepfhhfbcgecblgjdcmcka [2016-04-22]

CHR Extension: (Google Search) - C:\Users\Josefina\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-10-26]

CHR Extension: (ZenMate VPN - Best Cyber Security & Unblock) - C:\Users\Josefina\AppData\Local\Google\Chrome\User Data\Default\Extensions\fdcgdnkidjaadafnichfpabhfomcebme [2016-03-09]

CHR Extension: (Avira Browser Safety) - C:\Users\Josefina\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2016-04-12]

CHR Extension: (Google Docs Offline) - C:\Users\Josefina\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-03-16]

CHR Extension: (AdBlock) - C:\Users\Josefina\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2016-04-15]

CHR Extension: (Cenafy) - C:\Users\Josefina\AppData\Local\Google\Chrome\User Data\Default\Extensions\ndchmakhfaakbkhnkdgambadneloplnn [2015-11-03]

CHR Extension: (Gmail) - C:\Users\Josefina\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-03-27]

CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx

CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx

 

==================== Services (Whitelisted) ========================

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

R2 AdaptiveSleepService; C:\Program Files\ATI Technologies\ATI.ACE\A4\AdaptiveSleepService.exe [140288 2014-03-20] () [File not signed]

S2 AntiVirMailService; C:\Program Files (x86)\Avira\Antivirus\avmailc7.exe [955736 2016-03-10] (Avira Operations GmbH & Co. KG)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\Antivirus\sched.exe [466504 2016-03-10] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files (x86)\Avira\Antivirus\avguard.exe [466504 2016-03-10] (Avira Operations GmbH & Co. KG)

S2 AntiVirWebService; C:\Program Files (x86)\Avira\Antivirus\avwebg7.exe [1424880 2016-03-10] (Avira Operations GmbH & Co. KG)

R2 Avira.ServiceHost; C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe [272304 2016-03-30] (Avira Operations GmbH & Co. KG)

R2 BcmBtRSupport; C:\Windows\system32\BtwRSupportService.exe [2255064 2013-10-28] (Broadcom Corporation.)

S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [814464 2015-02-08] ()

S3 BRSptStub; C:\ProgramData\BitRaider\BRSptStub.exe [363208 2015-02-19] (BitRaider, LLC)

R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2829552 2016-03-08] (Microsoft Corporation)

R2 dlea_device; C:\Windows\system32\dleacoms.exe [1054888 2009-07-01] ( )

S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1135416 2015-10-05] (Malwarebytes)

R2 Mobizen plugin; C:\Program Files (x86)\RSUPPORT\MobizenService\MobizenService.exe [3353872 2015-12-28] ( Rsupport Corporation)

R2 OctaneVPNSrvc; C:\Program Files (x86)\OctaneVPN\resources\bin\win32\octanevpnsrvc\octanevpnsrvc.exe [845342 2015-07-07] (OctaneVPN) [File not signed]

S3 OpenVPNService; C:\Program Files\OpenVPN\bin\openvpnserv.exe [37504 2016-03-10] (The OpenVPN Project)

R2 Razer Game Scanner Service; C:\Program Files (x86)\Razer\Razer Services\GSS\GameScannerService.exe [187824 2016-03-21] ()

S3 rpcapd; C:\Program Files (x86)\WinPcap\rpcapd.exe [118520 2013-02-28] (Riverbed Technology, Inc.)

R2 RzKLService; C:\Program Files (x86)\Razer\Razer Cortex\RzKLService.exe [132864 2016-04-06] (Razer Inc.)

R2 RzSurroundVADStreamingService; C:\ProgramData\Razer\Synapse\Devices\Razer Surround\Driver\RzSurroundVADStreamingService.exe [4254720 2015-07-28] (A-Volute) [File not signed]

R2 ss_conn_service; C:\Program Files\Samsung\USB Drivers\25_escape\conn\ss_conn_service.exe [743688 2014-12-30] (DEVGURU Co., LTD.)

R2 tbaseprovisioning; C:\Windows\SysWOW64\tbaseprovisioning.exe [51712 2014-02-24] (Advanced Micro Devices, Inc.)

S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347880 2014-03-23] (Microsoft Corporation)

S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2014-03-23] (Microsoft Corporation)

S2 ZAMSvc; "C:\Program Files (x86)\Zemana AntiMalware\ZAM.exe" /service [X]

 

===================== Drivers (Whitelisted) ==========================

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

R3 AmdAS4; C:\Windows\System32\drivers\AmdAS4.sys [17640 2013-10-24] (Advanced Micro Devices, INC.)

S3 amdkmcsp; C:\Windows\system32\DRIVERS\amdkmcsp.sys [85704 2014-02-24] (Advanced Micro Devices, Inc. )

R0 amdkmpfd; C:\Windows\System32\drivers\amdkmpfd.sys [36608 2013-12-12] (Advanced Micro Devices, Inc.)

R0 amdpsp; C:\Windows\System32\DRIVERS\amdpsp.sys [230088 2014-02-24] (Advanced Micro Devices, Inc. )

R3 athr; C:\Windows\system32\DRIVERS\athwbx.sys [3881984 2014-01-06] (Qualcomm Atheros Communications, Inc.)

R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdWB6.sys [222720 2013-12-20] (Advanced Micro Devices)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [128664 2016-03-10] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [137952 2016-03-10] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [35488 2016-02-17] (Avira Operations GmbH & Co. KG)

R2 avnetflt; C:\Windows\system32\DRIVERS\avnetflt.sys [68936 2016-03-10] (Avira Operations GmbH & Co. KG)

S3 bcbtums; C:\Windows\system32\drivers\bcbtums.sys [170712 2013-10-28] (Broadcom Corporation.)

S3 BRDriver64_1_3_3_E02B25FC; C:\ProgramData\BitRaider\support\1.3.3\E02B25FC\BRDriver64.sys [78088 2015-02-19] (BitRaider)

S0 ebdrv; C:\Windows\System32\drivers\evbda.sys [3357024 2013-08-22] (Broadcom Corporation)

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-10-05] (Malwarebytes)

S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64216 2015-10-05] (Malwarebytes Corporation)

S3 NPF; C:\Windows\System32\drivers\npf.sys [36600 2013-02-28] (Riverbed Technology, Inc.)

R3 RSP2STOR; C:\Windows\system32\DRIVERS\RtsP2Stor.sys [293592 2014-02-11] (Realtek Semiconductor Corp.)

R3 rzendpt; C:\Windows\System32\drivers\rzendpt.sys [50392 2015-08-13] (Razer Inc)

S3 RZMAELSTROMVADService; C:\Windows\system32\drivers\RzMaelstromVAD.sys [32768 2014-06-09] (Windows ® Win 7 DDK provider)

R2 rzpmgrk; C:\Windows\system32\drivers\rzpmgrk.sys [44144 2016-03-10] (Razer, Inc.)

R2 rzpnk; C:\Windows\system32\drivers\rzpnk.sys [137840 2016-03-30] (Razer, Inc.)

R3 RZSURROUNDVADService; C:\Windows\system32\drivers\RzSurroundVAD.sys [40640 2015-07-28] (Windows ® Win 7 DDK provider)

R3 SmbDrv; C:\Windows\system32\DRIVERS\Smb_driver_AMDASF.sys [30448 2014-03-25] (Synaptics Incorporated)

S3 ss_conn_usb_driver; C:\Windows\System32\Drivers\ss_conn_usb_driver.sys [26392 2014-12-30] (DEVGURU Co., LTD.)

R3 Thotkey; C:\Windows\System32\drivers\Thotkey.sys [33168 2013-10-10] (Windows ® Win 7 DDK provider)

S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [35856 2014-03-23] (Microsoft Corporation)

S3 WdFilter; C:\Windows\system32\drivers\WdFilter.sys [257880 2014-03-23] (Microsoft Corporation)

S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [123224 2014-03-23] (Microsoft Corporation)

S1 ZAM; \??\C:\Windows\System32\drivers\zam64.sys [X]

S1 ZAM_Guard; \??\C:\Windows\System32\drivers\zamguard64.sys [X]

 

==================== NetSvcs (Whitelisted) ===================

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

 

==================== One Month Created files and folders ========

 

(If an entry is included in the fixlist, the file/folder will be moved.)

 

2016-04-25 02:44 - 2016-04-25 02:45 - 00022418 _____ C:\Users\Josefina\Downloads\FRST.txt

2016-04-25 02:43 - 2016-04-25 02:43 - 02375680 _____ (Farbar) C:\Users\Josefina\Downloads\FRST64 (1).exe

2016-04-24 18:30 - 2016-04-24 18:30 - 00738368 _____ (Oracle Corporation) C:\Users\Josefina\Downloads\chromeinstall-8u91.exe

2016-04-24 17:46 - 2016-04-24 17:58 - 00000000 ____D C:\Users\Josefina\Desktop\spotfiy

2016-04-21 21:32 - 2016-04-21 21:33 - 00000000 ____D C:\Users\Josefina\AppData\Local\PokerStars.USNJ

2016-04-21 21:32 - 2016-04-21 21:32 - 00001985 _____ C:\ProgramData\Microsoft\Windows\Start Menu\PokerStars NJ.lnk

2016-04-21 21:32 - 2016-04-21 21:32 - 00001979 _____ C:\Users\Public\Desktop\PokerStars NJ.lnk

2016-04-21 21:32 - 2016-04-21 21:32 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PokerStars.USNJ

2016-04-21 21:29 - 2016-04-21 21:33 - 00000000 ____D C:\Program Files (x86)\PokerStars.USNJ

2016-04-21 21:26 - 2016-04-21 21:28 - 82539184 _____ (PokerStars) C:\Users\Josefina\Downloads\PokerStarsInstallUSNJ.exe

2016-04-20 18:34 - 2016-04-20 18:34 - 00000935 _____ C:\Users\Public\Desktop\OpenVPN GUI.lnk

2016-04-20 18:33 - 2016-04-20 18:34 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenVPN

2016-04-20 18:33 - 2016-04-20 18:34 - 00000000 ____D C:\Program Files\TAP-Windows

2016-04-20 18:33 - 2016-04-20 18:34 - 00000000 ____D C:\Program Files\OpenVPN

2016-04-20 18:33 - 2016-04-20 18:33 - 00000000 ____D C:\Users\Josefina\Desktop\octtn

2016-04-20 18:33 - 2016-04-20 18:33 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TAP-Windows

2016-04-20 18:32 - 2016-04-20 18:32 - 01816664 _____ C:\Users\Josefina\Desktop\openvpn-install-2.3.10-I603-x86_64.exe

2016-04-20 18:31 - 2016-04-20 18:32 - 01816664 _____ C:\Users\Josefina\Downloads\openvpn-install-2.3.10-I603-x86_64.exe

2016-04-19 11:34 - 2016-04-19 21:56 - 00000000 ____D C:\Users\Josefina\AppData\Local\Jagex

2016-04-19 11:34 - 2016-04-19 21:56 - 00000000 ____D C:\ProgramData\Jagex

2016-04-19 11:34 - 2016-04-19 11:34 - 00000177 _____ C:\Users\Public\Desktop\RuneScape Launcher.url

2016-04-19 11:34 - 2016-04-19 11:34 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Jagex

2016-04-19 11:34 - 2016-04-19 11:34 - 00000000 ____D C:\Program Files\Jagex

2016-04-19 11:33 - 2015-08-22 06:42 - 00901264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ucrtbase.dll

2016-04-19 11:33 - 2015-08-22 06:42 - 00066400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-private-l1-1-0.dll

2016-04-19 11:33 - 2015-08-22 06:42 - 00022368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-math-l1-1-0.dll

2016-04-19 11:33 - 2015-08-22 06:42 - 00019808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-multibyte-l1-1-0.dll

2016-04-19 11:33 - 2015-08-22 06:42 - 00017760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-string-l1-1-0.dll

2016-04-19 11:33 - 2015-08-22 06:42 - 00017760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-stdio-l1-1-0.dll

2016-04-19 11:33 - 2015-08-22 06:42 - 00016224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-runtime-l1-1-0.dll

2016-04-19 11:33 - 2015-08-22 06:42 - 00015712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-convert-l1-1-0.dll

2016-04-19 11:33 - 2015-08-22 06:42 - 00014176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-time-l1-1-0.dll

2016-04-19 11:33 - 2015-08-22 06:42 - 00013664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-filesystem-l1-1-0.dll

2016-04-19 11:33 - 2015-08-22 06:42 - 00012640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-process-l1-1-0.dll

2016-04-19 11:33 - 2015-08-22 06:42 - 00012640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-heap-l1-1-0.dll

2016-04-19 11:33 - 2015-08-22 06:42 - 00012640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-conio-l1-1-0.dll

2016-04-19 11:33 - 2015-08-22 06:42 - 00012128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-utility-l1-1-0.dll

2016-04-19 11:33 - 2015-08-22 06:42 - 00012128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-locale-l1-1-0.dll

2016-04-19 11:33 - 2015-08-22 06:42 - 00012128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-environment-l1-1-0.dll

2016-04-19 11:33 - 2015-08-22 06:35 - 00984448 _____ (Microsoft Corporation) C:\Windows\system32\ucrtbase.dll

2016-04-19 11:33 - 2015-08-22 06:35 - 00063840 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-private-l1-1-0.dll

2016-04-19 11:33 - 2015-08-22 06:35 - 00020832 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-math-l1-1-0.dll

2016-04-19 11:33 - 2015-08-22 06:35 - 00019808 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-multibyte-l1-1-0.dll

2016-04-19 11:33 - 2015-08-22 06:35 - 00017760 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-string-l1-1-0.dll

2016-04-19 11:33 - 2015-08-22 06:35 - 00017760 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-stdio-l1-1-0.dll

2016-04-19 11:33 - 2015-08-22 06:35 - 00016224 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0.dll

2016-04-19 11:33 - 2015-08-22 06:35 - 00015712 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-convert-l1-1-0.dll

2016-04-19 11:33 - 2015-08-22 06:35 - 00014176 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-time-l1-1-0.dll

2016-04-19 11:33 - 2015-08-22 06:35 - 00013664 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-filesystem-l1-1-0.dll

2016-04-19 11:33 - 2015-08-22 06:35 - 00012640 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-process-l1-1-0.dll

2016-04-19 11:33 - 2015-08-22 06:35 - 00012640 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-heap-l1-1-0.dll

2016-04-19 11:33 - 2015-08-22 06:35 - 00012640 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-conio-l1-1-0.dll

2016-04-19 11:33 - 2015-08-22 06:35 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-utility-l1-1-0.dll

2016-04-19 11:33 - 2015-08-22 06:35 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-locale-l1-1-0.dll

2016-04-19 11:33 - 2015-08-22 06:35 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-environment-l1-1-0.dll

2016-04-19 11:30 - 2016-04-19 11:30 - 03859928 _____ (Jagex Ltd ) C:\Users\Josefina\Downloads\RuneScape-Setup.exe

2016-04-15 22:12 - 2016-04-15 22:12 - 00001268 _____ C:\Users\Public\Desktop\Razer Cortex.lnk

2016-04-15 22:11 - 2016-03-10 11:17 - 00044144 _____ (Razer, Inc.) C:\Windows\system32\Drivers\rzpmgrk.sys

2016-04-15 22:09 - 2016-04-15 22:09 - 122010296 _____ (Razer Inc. ) C:\Users\Josefina\Downloads\RazerCortexSetup_7.1.14.12241.exe

2016-04-15 13:47 - 2016-04-15 13:47 - 00000382 _____ C:\Users\Josefina\Documents\NetUptime 20160415 132959.txt

2016-04-15 00:02 - 2016-04-15 00:02 - 00000000 ____D C:\Users\Josefina\jagexcache5

2016-04-15 00:02 - 2016-04-15 00:02 - 00000000 ____D C:\Users\Josefina\jagexcache4

2016-04-15 00:02 - 2016-04-15 00:02 - 00000000 ____D C:\Users\Josefina\jagexcache3

2016-04-15 00:02 - 2016-04-15 00:02 - 00000000 ____D C:\Users\Josefina\jagexcache2

2016-04-14 14:07 - 2016-04-14 14:07 - 00000382 _____ C:\Users\Josefina\Documents\NetUptime 20160414 140649.txt

2016-04-13 14:52 - 2016-04-13 14:52 - 00000382 _____ C:\Users\Josefina\Documents\NetUptime 20160413 143254.txt

2016-04-13 01:00 - 2016-04-13 01:00 - 00000083 _____ C:\Users\Josefina\Desktop\markmywords.txt

2016-04-12 13:22 - 2016-04-12 13:22 - 00000382 _____ C:\Users\Josefina\Documents\NetUptime 20160412 132135.txt

2016-04-12 00:26 - 2016-04-12 00:26 - 00000384 _____ C:\Users\Josefina\Documents\NetUptime 20160412 002559.txt

2016-04-11 13:45 - 2016-04-11 13:47 - 00000382 _____ C:\Users\Josefina\Documents\NetUptime 20160411 134517.txt

2016-04-11 00:02 - 2016-04-11 00:02 - 00000384 _____ C:\Users\Josefina\Documents\NetUptime 20160411 000004.txt

2016-04-10 15:31 - 2016-04-10 16:00 - 00000382 _____ C:\Users\Josefina\Documents\NetUptime 20160410 153002.txt

2016-04-10 00:16 - 2016-04-10 00:17 - 46798944 _____ (Maxthon International ltd.) C:\Users\Josefina\Downloads\mx4.9.1.1000 (1).exe

2016-04-10 00:14 - 2016-04-10 00:14 - 00000008 _____ C:\Users\Josefina\Desktop\untitled(1)

2016-04-10 00:10 - 2016-04-10 00:10 - 00000008 _____ C:\Users\Josefina\Desktop\untitled

2016-04-09 23:59 - 2016-04-10 00:00 - 46798944 _____ (Maxthon International ltd.) C:\Users\Josefina\Downloads\mx4.9.1.1000.exe

2016-04-09 15:46 - 2016-04-09 16:07 - 00000380 _____ C:\Users\Josefina\Documents\NetUptime 20160409 152303.txt

2016-04-08 20:33 - 2016-04-08 21:04 - 00000538 _____ C:\Users\Josefina\Documents\NetUptime 20160408 203348.txt

2016-04-08 19:22 - 2016-04-08 19:56 - 00000380 _____ C:\Users\Josefina\Documents\NetUptime 20160408 192001.txt

2016-04-07 20:28 - 2016-04-07 21:25 - 00000568 _____ C:\Users\Josefina\Documents\NetUptime 20160407 202807.txt

2016-04-07 19:42 - 2016-04-07 20:27 - 00000538 _____ C:\Users\Josefina\Documents\NetUptime 20160407 194153.txt

2016-04-07 19:39 - 2016-04-07 19:39 - 17752712 _____ (Microsoft Corporation) C:\Users\Josefina\Downloads\NUMSetup.exe

2016-04-03 21:50 - 2016-04-21 21:18 - 00000124 _____ C:\Users\Josefina\Desktop\Dharocker(1).ahk

2016-04-03 21:41 - 2016-04-21 14:15 - 00000000 ____D C:\Users\Josefina\Desktop\ahk script

2016-03-30 12:27 - 2016-03-30 12:27 - 03081488 _____ C:\Users\Josefina\Downloads\AutoHotkey112305_Install (3).exe

2016-03-30 12:23 - 2016-03-30 12:24 - 00000000 ____D C:\Users\Josefina\Desktop\ahk

2016-03-30 12:23 - 2016-03-30 12:23 - 00575274 _____ C:\Users\Josefina\Downloads\AutoHotkey112305_x64.zip

2016-03-30 12:23 - 2016-03-30 12:23 - 00575274 _____ C:\Users\Josefina\Desktop\AutoHotkey112305_x64.zip

2016-03-30 12:20 - 2016-03-30 12:20 - 03081488 _____ C:\Users\Josefina\Downloads\AutoHotkey112305_Install (2).exe

2016-03-30 12:20 - 2016-03-30 12:20 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoHotkey

2016-03-30 12:20 - 2016-03-30 12:20 - 00000000 ____D C:\Program Files\AutoHotkey

2016-03-29 02:52 - 2016-03-29 02:52 - 03081488 _____ C:\Users\Josefina\Downloads\AutoHotkey112305_Install (1).exe

2016-03-29 02:46 - 2016-03-29 02:46 - 03081488 _____ C:\Users\Josefina\Downloads\AutoHotkey112305_Install.exe

2016-03-28 23:41 - 2016-03-28 23:41 - 00006847 _____ C:\Users\Josefina\Desktop\^09F478495FEAC78BCBDA8775F8AA9F996987B1932EEBD31A22^pimgpsh_thumbnail_win_distr.jpg

 

==================== One Month Modified files and folders ========

 

(If an entry is included in the fixlist, the file/folder will be moved.)

 

2016-04-25 02:45 - 2015-04-09 02:30 - 00000000 _____ C:\Windows\system32\RzSurroundVADAudioDeviceManager_log.txt

2016-04-25 02:44 - 2016-03-17 13:53 - 00000000 ____D C:\FRST

2016-04-25 02:43 - 2014-06-24 00:56 - 00000000 ____D C:\Users\Josefina\AppData\Roaming\Spotify

2016-04-25 02:40 - 2014-06-23 18:53 - 00000000 ____D C:\Users\Josefina\AppData\Roaming\Skype

2016-04-25 02:38 - 2014-06-23 18:15 - 00003598 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-328124280-1994820816-3203177752-1001

2016-04-25 02:04 - 2014-05-21 12:01 - 00000926 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2016-04-25 01:07 - 2014-06-23 18:29 - 00000047 _____ C:\Users\Josefina\jagex_cl_oldschool_LIVE.dat

2016-04-24 23:51 - 2014-06-24 00:57 - 00000000 ____D C:\Users\Josefina\AppData\Local\Spotify

2016-04-24 23:19 - 2016-03-12 01:34 - 00000376 _____ C:\Users\Josefina\Desktop\EZBlocker-log.txt

2016-04-24 18:38 - 2014-06-23 18:29 - 00000000 ____R C:\Users\Josefina\random.dat

2016-04-24 18:38 - 2014-06-23 18:06 - 00000000 ____D C:\Users\Josefina

2016-04-24 18:34 - 2014-09-18 02:29 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java

2016-04-24 18:34 - 2014-09-18 02:29 - 00000000 ____D C:\Program Files (x86)\Java

2016-04-24 18:32 - 2015-12-13 00:19 - 00000000 ____D C:\Users\Josefina\.oracle_jre_usage

2016-04-24 18:32 - 2014-09-18 02:29 - 00097856 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll

2016-04-24 17:46 - 2016-03-09 16:17 - 00000000 ____D C:\Users\Josefina\AppData\Local\Eric_Zhang

2016-04-24 17:12 - 2016-01-13 10:27 - 00000000 ____D C:\Users\Josefina\AppData\Roaming\OctaneVPN

2016-04-24 17:11 - 2014-09-11 22:31 - 00000000 __RDO C:\Users\Josefina\OneDrive

2016-04-24 17:11 - 2014-05-21 12:01 - 00000922 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2016-04-21 12:58 - 2016-02-25 12:24 - 00001121 _____ C:\Users\Public\Desktop\Avira Launcher.lnk

2016-04-21 12:58 - 2016-02-25 12:24 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira

2016-04-21 12:58 - 2014-05-21 11:25 - 00000000 ____D C:\ProgramData\Package Cache

2016-04-21 12:54 - 2014-05-21 11:28 - 17334188 _____ C:\Windows\SysWOW64\rootpa.e2e

2016-04-21 12:53 - 2013-08-22 07:45 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2016-04-20 20:32 - 2015-12-10 12:12 - 00000000 ___RD C:\Program Files (x86)\Skype

2016-04-20 20:32 - 2014-06-23 18:53 - 00000000 ____D C:\ProgramData\Skype

2016-04-20 18:51 - 2016-01-10 20:19 - 00000000 ____D C:\Users\Josefina\AppData\Roaming\.tribot

2016-04-20 18:38 - 2014-07-15 11:34 - 00000000 ____D C:\Program Files (x86)\Verizon

2016-04-20 18:37 - 2014-08-03 09:20 - 00000000 ____D C:\Users\Josefina\AppData\Roaming\Verizon

2016-04-20 13:56 - 2013-08-22 08:36 - 00000000 ____D C:\ProgramData\regid.1991-06.com.microsoft

2016-04-20 13:55 - 2013-08-22 06:36 - 00000000 ____D C:\Windows\Inf

2016-04-20 13:51 - 2015-04-23 10:04 - 00000000 ____D C:\Program Files\Microsoft Office 15

2016-04-20 13:38 - 2013-08-22 08:36 - 00000000 ___HD C:\Program Files\WindowsApps

2016-04-20 13:38 - 2013-08-22 08:36 - 00000000 ____D C:\Windows\AppReadiness

2016-04-19 22:49 - 2014-06-30 10:50 - 05214720 ___SH C:\Users\Josefina\Desktop\Thumbs.db

2016-04-19 11:59 - 2014-09-17 23:27 - 00000000 ____D C:\Program Files (x86)\SwiftKit

2016-04-19 11:34 - 2013-08-22 08:20 - 00000000 ____D C:\Windows\CbsTemp

2016-04-19 11:28 - 2014-06-24 20:33 - 00000047 _____ C:\Users\Josefina\jagex_cl_runescape_LIVE.dat

2016-04-17 20:05 - 2014-05-21 12:01 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive

2016-04-16 01:52 - 2016-03-18 20:24 - 00000000 ____D C:\Program Files\9-lab

2016-04-15 22:13 - 2014-09-02 20:38 - 00000000 ____D C:\Users\Josefina\AppData\Local\Razer

2016-04-15 22:12 - 2014-12-06 17:26 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Razer

2016-04-15 22:11 - 2014-09-02 20:36 - 00000000 ____D C:\ProgramData\Razer

2016-04-15 22:11 - 2014-09-02 20:36 - 00000000 ____D C:\Program Files (x86)\Razer

2016-04-14 14:25 - 2015-11-02 21:31 - 00000312 _____ C:\Users\Josefina\Desktop\AutoHotkey.ahk

2016-04-13 16:45 - 2014-07-10 10:44 - 00453280 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe

2016-04-13 00:06 - 2014-06-23 18:07 - 00000000 ____D C:\Users\Josefina\AppData\Local\Packages

2016-04-11 00:09 - 2014-07-08 15:15 - 00000000 ____D C:\Users\Josefina\AppData\Local\CrashDumps

2016-04-10 23:57 - 2016-03-18 21:36 - 00000000 ____D C:\Program Files (x86)\Zemana AntiMalware

2016-04-10 17:03 - 2015-04-08 15:09 - 00000000 ____D C:\Users\Josefina\AppData\LocalLow\Adblock Plus for IE

2016-04-10 17:00 - 2016-03-18 21:36 - 00155097 _____ C:\Windows\ZAM.krnl.trace

2016-04-10 17:00 - 2016-03-18 21:36 - 00001071 _____ C:\Windows\ZAM_Guard.krnl.trace

2016-04-07 13:09 - 2014-06-23 18:16 - 00002186 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk

2016-04-07 13:09 - 2014-06-23 18:16 - 00002174 _____ C:\Users\Public\Desktop\Google Chrome.lnk

2016-04-06 16:06 - 2016-03-19 22:53 - 00000000 ____D C:\Users\Josefina\Desktop\screenshot

2016-04-04 02:17 - 2014-04-10 22:08 - 00863592 _____ C:\Windows\system32\PerfStringBackup.INI

2016-03-30 12:20 - 2013-08-22 12:12 - 00000000 ____D C:\Windows\ShellNew

2016-03-30 11:43 - 2014-12-06 17:30 - 00137840 _____ (Razer, Inc.) C:\Windows\system32\Drivers\rzpnk.sys

 

Some files in TEMP:

====================

C:\Users\Josefina\AppData\Local\Temp\avgnt.exe

C:\Users\Josefina\AppData\Local\Temp\togl_31c151da5.dll

 

 

==================== Bamital & volsnap =================

 

(There is no automatic fix for files that do not pass verification.)

 

C:\Windows\system32\winlogon.exe => File is digitally signed

C:\Windows\system32\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\system32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\system32\services.exe => File is digitally signed

C:\Windows\system32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\system32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\system32\rpcss.dll => File is digitally signed

C:\Windows\system32\dnsapi.dll => File is digitally signed

C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed

C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

 

 

LastRegBack: 2016-04-15 13:41

 

==================== End of FRST.txt ============================

 

Additional scan result of Farbar Recovery Scan Tool (x64) Version:05-03-2016 01

Ran by Josefina (2016-03-17 13:55:38)

Running from C:\Users\Josefina\Desktop

Windows 8.1 (X64) (2014-06-24 01:07:44)

Boot Mode: Normal

==========================================================

 

 

==================== Accounts: =============================

 

Administrator (S-1-5-21-328124280-1994820816-3203177752-500 - Administrator - Disabled)

Guest (S-1-5-21-328124280-1994820816-3203177752-501 - Limited - Disabled)

HomeGroupUser$ (S-1-5-21-328124280-1994820816-3203177752-1003 - Limited - Enabled)

Josefina (S-1-5-21-328124280-1994820816-3203177752-1001 - Administrator - Enabled) => C:\Users\Josefina

 

==================== Security Center ========================

 

(If an entry is included in the fixlist, it will be removed.)

 

AV: Avira Antivirus (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}

AV: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: Avira Antivirus (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}

AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

 

==================== Installed Programs ======================

 

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

 

Adblock Plus for IE (32-bit and 64-bit) (HKLM\...\{77588F59-3C58-4675-8EEE-998E5BC33CF4}) (Version: 1.4 - Eyeo GmbH)

Adobe Flash Player 21 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 21.0.0.182 - Adobe Systems Incorporated)

Adobe Reader XI (11.0.07)  MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AB0000000001}) (Version: 11.0.07 - Adobe Systems Incorporated)

Adobe Reader XI (11.0.14) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.14 - Adobe Systems Incorporated)

AirServer Universal (x64) (HKLM\...\{6E97BF1A-1BC4-4624-8841-C5B03F234C87}) (Version: 3.1.5 - App Dynamic)

Amazon 1Button App (HKLM-x32\...\{893CB813-4179-4BFE-8D33-ABCC38816B48}) (Version: 1.0.6 - Amazon)

Amazon Kindle (HKU\S-1-5-21-328124280-1994820816-3203177752-1001\...\Amazon Kindle) (Version: 1.15.0.43061 - Amazon)

AMD Catalyst Install Manager (HKLM\...\{F80AA689-1C29-E046-3BA4-73A675AE865E}) (Version: 8.0.916.0 - Advanced Micro Devices, Inc.)

Apple Application Support (HKLM-x32\...\{83CAF0DE-8D3B-4C37-A631-2B8F16EC3031}) (Version: 3.1 - Apple Inc.)

Apple Mobile Device Support (HKLM\...\{BDD99690-3541-4619-9D2A-3CDDB3E15F9E}) (Version: 8.0.5.6 - Apple Inc.)

Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)

Atheros Driver Installation Program (HKLM-x32\...\{C3A32068-8AB1-4327-BB16-BED9C6219DC7}) (Version: 10.0 - Atheros)

AutoHotkey 1.1.22.07 (HKLM\...\AutoHotkey) (Version: 1.1.22.07 - Lexikos)

Avira Antivirus (HKLM-x32\...\Avira Antivirus) (Version: 15.0.16.282 - Avira Operations GmbH & Co. KG)

Avira Launcher (HKLM-x32\...\{3b87484e-d70b-4b4f-ad59-2ae89571e2cf}) (Version: 1.1.56.9119 - Avira Operations GmbH & Co. KG)

Avira Launcher (x32 Version: 1.1.56.9119 - Avira Operations GmbH & Co. KG) Hidden

Battle.net (HKLM-x32\...\Battle.net) (Version:  - Blizzard Entertainment)

BitRaider Streaming Client (HKLM-x32\...\BitRaider Streaming Client) (Version: 1.3.3.4098 - BitRaider, LLC)

Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)

Cain & Abel 4.9.56 (HKLM-x32\...\Cain & Abel 4.9.56) (Version:  - )

Camtasia Studio 8 (HKLM-x32\...\{765AD29A-7EF5-4456-8F6F-83467E52AB52}) (Version: 8.4.3.1792 - TechSmith Corporation)

CyberLink PowerDVD 12 (HKLM-x32\...\InstallShield_{B46BEA36-0B71-4A4E-AE41-87241643FA0A}) (Version: 12.0.3920.05 - CyberLink Corp.)

Digital Pass Launcher (HKLM-x32\...\{2359C6E9-DE4F-4FDA-9C12-AE6EFC2EE330}) (Version: 1.0.0.0 - TOSHIBA America Information Systems, Inc)

Equalify v2.5.3 (Stable) (HKLM-x32\...\{33EC4F70-9F4B-406F-BB2A-F75A285E927D}) (Version: 2.5.3.0 - Equalify)

Equalizer APO (HKLM\...\EqualizerAPO) (Version: 0.9.1 - )

Google Chrome (HKLM-x32\...\Google Chrome) (Version: 49.0.2623.87 - Google Inc.)

Google Drive (HKLM-x32\...\{895D0391-459F-4D45-B8DD-13F0DE70C66E}) (Version: 1.28.1549.1322 - Google, Inc.)

Google Update Helper (x32 Version: 1.3.29.5 - Google Inc.) Hidden

Guild Wars 2 (HKLM-x32\...\Guild Wars 2) (Version:  - NCsoft Corporation, Ltd.)

Gyazo 3.2.1 (HKLM-x32\...\{6DB8C365-E719-4BA5-9594-10DFC244D3FD}_is1) (Version:  - Nota Inc.)

Hearthstone (HKLM-x32\...\Hearthstone) (Version:  - Blizzard Entertainment)

IHA_MessageCenter (HKLM-x32\...\{91228D59-1017-4884-ABC2-B3C018F7295B}) (Version: 2.0.50 - Verizon)

iTunes (HKLM\...\{2ABBBD91-91E5-4AD7-929A-FE15D1DC0576}) (Version: 12.0.1.26 - Apple Inc.)

Java 8 Update 66 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218066F0}) (Version: 8.0.660.18 - Oracle Corporation)

League of Legends (HKLM-x32\...\League of Legends 3.0.1) (Version: 3.0.1 - Riot Games)

League of Legends (x32 Version: 3.0.1 - Riot Games) Hidden

LOLReplay (HKLM-x32\...\LOLReplay) (Version: 0.8.9.31 - www.leaguereplays.com)

McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.11.292.3 - McAfee, Inc.)

Microsoft Office 365 - en-us (HKLM\...\O365HomePremRetail - en-us) (Version: 15.0.4805.1003 - Microsoft Corporation)

Microsoft OneDrive (HKU\S-1-5-21-328124280-1994820816-3203177752-1001\...\OneDriveSetup.exe) (Version: 17.3.6302.0225 - Microsoft Corporation)

Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)

Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)

Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)

Microsoft XNA Framework Redistributable 4.0 (HKLM-x32\...\{2BFC7AA0-544C-4E3A-8796-67F3BE655BE9}) (Version: 4.0.20823.0 - Microsoft Corporation)

Minecraft (HKLM-x32\...\{1C16BCA3-EBC1-49F6-8623-8FBFB9CCC872}) (Version: 1.0.3.0 - Mojang)

Mobizen (HKLM-x32\...\{BA0D3A44-BCEE-4C8B-BCD4-F7F1E64F41E3}) (Version: 2.19.0.1 - RSUPPORT)

Mozilla Firefox 36.0.1 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 36.0.1 (x86 en-US)) (Version: 36.0.1 - Mozilla)

Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 36.0.1 - Mozilla)

Notepad++ (HKLM-x32\...\Notepad++) (Version: 6.8.3 - Notepad++ Team)

Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4805.1003 - Microsoft Corporation) Hidden

Office 15 Click-to-Run Licensing Component (Version: 15.0.4805.1003 - Microsoft Corporation) Hidden

Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4805.1003 - Microsoft Corporation) Hidden

OldSchool RuneScape Launcher 1.2.4 (HKLM-x32\...\{5D394B1B-03A1-43BC-BBA9-53BC880F86F3}) (Version: 1.2.4 - Jagex Ltd)

Open Broadcaster Software (HKLM-x32\...\Open Broadcaster Software) (Version:  - )

osu! (HKLM-x32\...\{92428af5-bffa-4c6a-8a6a-30980a440af0}) (Version: latest - ppy Pty Ltd)

Razer Surround (HKLM-x32\...\Razer Surround) (Version: 1.05.18 - Razer Inc.)

Razer Synapse (HKLM-x32\...\{0D78BEE2-F8FF-4498-AF1A-3FF81CED8AC6}) (Version: 1.18.21.27599 - Razer Inc.)

Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.3.9600.29077 - Realtek Semiconductor Corp.)

Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.24.1218.2013 - Realtek)

Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7173 - Realtek Semiconductor Corp.)

RuneScape Launcher 1.2.4 (HKLM-x32\...\{789FF9AB-5FE2-43C8-9FBE-1C3CF9E8A6E9}) (Version: 1.2.4 - Jagex Ltd)

Samsung USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.53.0 - Samsung Electronics Co., Ltd.)

ShortKeys Lite (HKLM-x32\...\ShortKeys Lite) (Version: 2.3.2.1 - Insight Software Solutions, Inc.)

Skype™ 7.18 (HKLM-x32\...\{FC965A47-4839-40CA-B618-18F486F042C6}) (Version: 7.18.112 - Skype Technologies S.A.)

Spotify (HKU\S-1-5-21-328124280-1994820816-3203177752-1001\...\Spotify) (Version: 1.0.25.127.g58007b4c - Spotify AB)

Star Wars: The Old Republic (HKLM-x32\...\{3B11D799-48E0-48ED-BFD7-EA655676D8BB}) (Version: 1.00 - Electronic Arts, Inc.)

Steam (HKLM-x32\...\Steam) (Version:  - Valve Corporation)

SwiftKit (HKU\S-1-5-21-328124280-1994820816-3203177752-1001\...\SwiftKit) (Version:  - )

Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 18.1.7.2 - Synaptics Incorporated)

Team Fortress 2 (HKLM-x32\...\Steam App 440) (Version:  - Valve)

TeamSpeak 3 Client (HKLM-x32\...\TeamSpeak 3 Client) (Version: 3.0.16 - TeamSpeak Systems GmbH)

TOSHIBA Application Installer (HKLM\...\{21A63CA3-75C0-4E56-B602-B7CD2EF6B621}) (Version: 9.0.2.6 - Toshiba Corporation)

TOSHIBA Audio Enhancement (HKLM\...\{1515F5E3-29EA-4CD1-A981-032D88880F09}) (Version: 2.0.18.0 - Toshiba Corporation)

TOSHIBA Display Utility (HKLM\...\{484A4296-6F3D-4182-8CFA-D664F7DA34AA}) (Version: 1.1.17.0 - Toshiba Corporation)

TOSHIBA eco Utility (HKLM\...\{94D2A899-0C34-4420-880E-AE337E635AB0}) (Version: 2.4.2.6403 - Toshiba Corporation)

TOSHIBA Function Key (HKLM\...\{1844CFE2-EBA3-490A-8A5E-9BFC646342FD}) (Version: 1.1.5.6402 - Toshiba Corporation)

TOSHIBA Password Utility (HKLM-x32\...\{2DB90351-FBAA-472B-9F12-6E1EBBB354DE}) (Version: v2.1.0.22 - Toshiba Corporation)

TOSHIBA Recovery Media Creator (HKLM-x32\...\{B65BBB06-1F8E-48F5-8A54-B024A9E15FDF}) (Version: 3.2.00.56006005 - Toshiba Corporation)

TOSHIBA Service Station (HKLM\...\{BFE4C813-4DD4-4B1C-97F4-76A459055C8D}) (Version: 2.6.13 - Toshiba Corporation)

TOSHIBA Start (HKLM-x32\...\{4F0F44AF-90E9-4A6E-9E82-354A3AB79F22}) (Version: 1.0.0.2 - TOSHIBA America Information Systems, Inc)

TOSHIBA System Driver (HKLM-x32\...\{1E6A96A1-2BAB-43EF-8087-30437593C66C}) (Version: 1.00.0033 - Toshiba Corporation)

TOSHIBA System Settings (HKLM-x32\...\{4D57ED72-6B01-40BD-9CA9-012B8FC09CEB}) (Version: 2.0.1.32003 - Toshiba Corporation)

TOSHIBA User's Guide (HKLM-x32\...\{3384E1D9-3F18-4A98-8655-180FEF0DFC02}) (Version: 1.00.02 - TOSHIBA)

TOSHIBARegistration (HKLM-x32\...\{5AF550B4-BB67-4E7E-82F1-2C4300279050}) (Version: 1.1.6 - TOSHIBA)

Unity Web Player (HKU\S-1-5-21-328124280-1994820816-3203177752-1001\...\UnityWebPlayer) (Version: 4.5.5f1 - Unity Technologies ApS)

Vz In-Home Agent (HKLM-x32\...\VzInHomeAgent) (Version: 9.0.63.0 - Verizon)

VzDownloadManager (HKU\S-1-5-21-328124280-1994820816-3203177752-1001\...\VzDownloadManager) (Version: 2.0.0.16 - Verizon)

WinPcap 4.1.3 (HKLM-x32\...\WinPcapInst) (Version: 4.1.0.2980 - Riverbed Technology, Inc.)

WinRAR 5.11 (32-bit) (HKLM-x32\...\WinRAR archiver) (Version: 5.11.0 - win.rar GmbH)

 

==================== Custom CLSID (Whitelisted): ==========================

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

 

==================== Scheduled Tasks (Whitelisted) =============

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

Task: {13B3C597-EF56-4D85-8559-CE5031B68E67} - System32\Tasks\Norton WSC Integration => C:\Program Files (x86)\Norton Internet Security\Engine\21.3.0.12\WSCStub.exe

Task: {14DF1E8B-A87C-4058-8477-755D228551E7} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)

Task: {14EAD3BF-AF61-4C7A-B816-9C423EDA4835} - System32\Tasks\GyazoUpdateTaskMachine => C:\Program Files (x86)\Gyazo\GyazoUpdate.exe [2016-02-17] ()

Task: {23AAAC72-D291-42D9-BBCB-F6EB3B967599} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2016-02-09] (Microsoft Corporation)

Task: {24B0CFAC-3C93-4726-A82B-5D366188BF9C} - System32\Tasks\Synaptics TouchPad Enhancements => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2014-03-25] (Synaptics Incorporated)

Task: {3573C722-AA4E-4238-9F7B-7B812181162E} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-12-14] (Adobe Systems Incorporated)

Task: {41E5FC1C-F3C7-47C4-9556-EA749923FF7B} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2016-03-10] (Adobe Systems Incorporated)

Task: {4E129DD4-4194-478D-93B3-A3AB80451A99} - System32\Tasks\TOSHIBA\Service Station => C:\Program Files\TOSHIBA\Toshiba Service Station\ToshibaServiceStation.exe [2013-09-24] (TOSHIBA Corporation)

Task: {6253AE21-5C4A-447F-BF33-F140FD85919B} - System32\Tasks\Norton Internet Security\Norton Error Analyzer => C:\Program Files (x86)\Norton Internet Security\Engine\21.3.0.12\SymErr.exe

Task: {6A9D369D-793E-4F71-A544-39D2B438A8B6} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-30] (Google Inc.)

Task: {7BE26344-0E47-43FA-8205-65BFE019DB49} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonx86\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe [2016-03-15] (Microsoft Corporation)

Task: {7E55F218-D299-40ED-A4DD-D67DB87CEF97} - System32\Tasks\Norton Internet Security\Norton Error Processor => C:\Program Files (x86)\Norton Internet Security\Engine\21.3.0.12\SymErr.exe

Task: {7EB01D07-8195-4B72-A5FE-FEA120C242E0} - System32\Tasks\Microsoft OneDrive Auto Update Task-S-1-5-21-328124280-1994820816-3203177752-1001 => C:\Users\Josefina\AppData\Local\Microsoft\OneDrive\OneDrive.exe [2016-03-12] (Microsoft Corporation)

Task: {A1470C2A-E200-4465-90C4-9CBEB2066920} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2016-02-09] (Microsoft Corporation)

Task: {B1E55388-2329-4AA7-8D1F-B775A48BF6EB} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-30] (Google Inc.)

Task: {D10EAB60-4EBE-48A6-8312-A4B510F9A376} - System32\Tasks\GyazoUpdateTaskMachineDaily => C:\Program Files (x86)\Gyazo\GyazoUpdate.exe [2016-02-17] ()

 

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

 

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

 

==================== Shortcuts =============================

 

(The entries could be listed to be restored or removed.)

 

==================== Loaded Modules (Whitelisted) ==============

 

2015-04-23 09:14 - 2009-06-19 09:01 - 00189440 _____ () C:\Windows\system32\spool\PRTPROCS\x64\dleadrpp.dll

2014-03-20 08:25 - 2014-03-20 08:25 - 00140288 _____ () C:\Program Files\ATI Technologies\ATI.ACE\A4\AdaptiveSleepService.exe

2015-04-23 10:04 - 2015-10-13 04:34 - 00105640 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll

2015-06-23 12:11 - 2015-06-23 12:11 - 00187048 _____ () C:\Program Files (x86)\Razer\Razer Services\GSS\GameScannerService.exe

2015-10-28 14:16 - 2015-09-01 09:04 - 08901184 _____ () C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\1033\GrooveIntlResource.dll

2014-11-07 11:06 - 2014-11-06 18:06 - 01016104 _____ () C:\Program Files (x86)\RSUPPORT\MobizenService\dat\adb.exe

2012-07-18 18:38 - 2012-07-18 18:38 - 00020904 _____ () C:\Program Files\TOSHIBA\Hotkey\SmoothView.dll

2016-01-13 10:27 - 2015-07-07 15:06 - 00819818 _____ () C:\Program Files (x86)\OctaneVPN\octanevpn.exe

2015-07-07 23:58 - 2015-07-07 23:58 - 00292352 _____ () C:\ProgramData\Razer\Synapse\RzStats\RzStats.Manager.exe

2015-11-09 17:42 - 2015-11-09 17:42 - 01459712 _____ () C:\Windows\assembly\NativeImages_v4.0.30319_64\Windows.UI\926020eb508f6968545d6a51fb661fad\Windows.UI.ni.dll

2015-11-09 17:42 - 2015-11-09 17:42 - 00521216 _____ () C:\Windows\assembly\NativeImages_v4.0.30319_64\Windows.Data\d07f690ce5d3a2de7c9089a6200d64db\Windows.Data.ni.dll

2013-08-22 00:19 - 2013-08-21 23:54 - 00030208 _____ () C:\Windows\system32\WinMetadata\Windows.Foundation.winmd

2014-03-20 08:25 - 2014-03-20 08:25 - 00016896 _____ () C:\Program Files\ATI Technologies\ATI.ACE\a4\AS4.NativeProxy.dll

2014-10-11 14:06 - 2014-10-11 14:06 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll

2014-10-11 14:05 - 2014-10-11 14:05 - 01044776 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll

2016-01-13 10:27 - 2014-05-03 14:56 - 00027648 _____ () C:\Program Files (x86)\OctaneVPN\resources\bin\win32\octanevpnsrvc\servicemanager.pyd

2016-01-13 10:27 - 2014-05-03 14:55 - 00110080 _____ () C:\Program Files (x86)\OctaneVPN\resources\bin\win32\octanevpnsrvc\pywintypes27.dll

2016-01-13 10:27 - 2014-05-03 14:55 - 00042496 _____ () C:\Program Files (x86)\OctaneVPN\resources\bin\win32\octanevpnsrvc\win32service.pyd

2016-01-13 10:27 - 2014-05-03 14:56 - 00100352 _____ () C:\Program Files (x86)\OctaneVPN\resources\bin\win32\octanevpnsrvc\win32api.pyd

2016-01-13 10:27 - 2014-12-10 14:25 - 00774656 _____ () C:\Program Files (x86)\OctaneVPN\resources\bin\win32\octanevpnsrvc\_hashlib.pyd

2016-01-13 10:27 - 2014-05-03 14:55 - 00036864 _____ () C:\Program Files (x86)\OctaneVPN\resources\bin\win32\octanevpnsrvc\win32process.pyd

2016-01-13 10:27 - 2014-05-03 14:55 - 00108544 _____ () C:\Program Files (x86)\OctaneVPN\resources\bin\win32\octanevpnsrvc\win32security.pyd

2016-01-13 10:27 - 2014-05-03 14:55 - 00018432 _____ () C:\Program Files (x86)\OctaneVPN\resources\bin\win32\octanevpnsrvc\win32event.pyd

2016-01-13 10:27 - 2014-05-03 14:56 - 00049664 _____ () C:\Program Files (x86)\OctaneVPN\resources\bin\win32\octanevpnsrvc\win32evtlog.pyd

2016-01-13 10:27 - 2014-12-10 14:25 - 00087552 _____ () C:\Program Files (x86)\OctaneVPN\resources\bin\win32\octanevpnsrvc\_ctypes.pyd

2016-01-13 10:27 - 2014-12-10 14:25 - 00046080 _____ () C:\Program Files (x86)\OctaneVPN\resources\bin\win32\octanevpnsrvc\_socket.pyd

2016-01-13 10:27 - 2014-12-10 14:25 - 01201152 _____ () C:\Program Files (x86)\OctaneVPN\resources\bin\win32\octanevpnsrvc\_ssl.pyd

2016-01-13 10:27 - 2014-05-03 14:55 - 00119808 _____ () C:\Program Files (x86)\OctaneVPN\resources\bin\win32\octanevpnsrvc\win32file.pyd

2016-01-13 10:27 - 2014-05-03 14:55 - 00024064 _____ () C:\Program Files (x86)\OctaneVPN\resources\bin\win32\octanevpnsrvc\win32pipe.pyd

2016-01-11 11:36 - 2016-01-11 11:36 - 00932032 ____R () C:\Program Files (x86)\Skype\Phone\ssScreenVVS2.dll

2015-03-26 20:46 - 2015-03-26 20:46 - 00422912 _____ () C:\Program Files (x86)\LOLReplay\LOLUtils.dll

2015-09-04 18:42 - 2015-09-04 18:42 - 00137728 _____ () C:\ProgramData\Razer\Synapse\CrashReporter\CrashRpt1402.dll

2016-01-13 10:27 - 2014-12-10 14:25 - 00087552 _____ () C:\Program Files (x86)\OctaneVPN\_ctypes.pyd

2016-01-13 10:27 - 2015-01-15 18:19 - 01853440 _____ () C:\Program Files (x86)\OctaneVPN\PySide.QtCore.pyd

2016-01-13 10:27 - 2015-01-15 18:19 - 00110592 _____ () C:\Program Files (x86)\OctaneVPN\pyside-python2.7.dll

2016-01-13 10:27 - 2015-01-15 18:19 - 00108544 _____ () C:\Program Files (x86)\OctaneVPN\shiboken-python2.7.dll

2016-01-13 10:27 - 2015-01-15 18:19 - 06947328 _____ () C:\Program Files (x86)\OctaneVPN\PySide.QtGui.pyd

2016-01-13 10:27 - 2014-12-10 14:25 - 00046080 _____ () C:\Program Files (x86)\OctaneVPN\_socket.pyd

2016-01-13 10:27 - 2014-12-10 14:25 - 01201152 _____ () C:\Program Files (x86)\OctaneVPN\_ssl.pyd

2016-01-13 10:27 - 2014-12-10 14:25 - 00774656 _____ () C:\Program Files (x86)\OctaneVPN\_hashlib.pyd

2016-01-13 10:27 - 2014-12-10 14:25 - 00010240 _____ () C:\Program Files (x86)\OctaneVPN\select.pyd

2016-01-13 10:27 - 2014-05-03 14:55 - 00110080 _____ () C:\Program Files (x86)\OctaneVPN\pywintypes27.dll

2016-01-13 10:27 - 2014-05-03 14:56 - 00100352 _____ () C:\Program Files (x86)\OctaneVPN\win32api.pyd

2016-01-13 10:27 - 2014-05-03 14:55 - 00119808 _____ () C:\Program Files (x86)\OctaneVPN\win32file.pyd

2016-01-13 10:27 - 2014-05-03 14:55 - 00024064 _____ () C:\Program Files (x86)\OctaneVPN\win32pipe.pyd

2016-01-13 10:27 - 2014-05-03 14:55 - 00108544 _____ () C:\Program Files (x86)\OctaneVPN\win32security.pyd

2016-01-13 10:27 - 2012-09-27 17:28 - 00029184 _____ () C:\Program Files (x86)\OctaneVPN\Crypto.Cipher._AES.pyd

2016-01-13 10:27 - 2012-09-27 17:28 - 00009728 _____ () C:\Program Files (x86)\OctaneVPN\Crypto.Random.OSRNG.winrandom.pyd

2016-01-13 10:27 - 2012-09-27 17:28 - 00010240 _____ () C:\Program Files (x86)\OctaneVPN\Crypto.Util._counter.pyd

2016-01-13 10:27 - 2015-01-15 18:19 - 00644608 _____ () C:\Program Files (x86)\OctaneVPN\PySide.QtNetwork.pyd

2016-01-13 10:27 - 2014-05-03 14:55 - 00018432 _____ () C:\Program Files (x86)\OctaneVPN\win32event.pyd

2016-01-13 10:27 - 2014-12-10 14:25 - 00686080 _____ () C:\Program Files (x86)\OctaneVPN\unicodedata.pyd

2016-02-23 19:25 - 2016-02-23 19:25 - 00325824 _____ () C:\Program Files\Microsoft Office 15\root\office15\AppVIsvStream32.dll

2015-03-15 01:57 - 2016-03-17 13:45 - 47503472 _____ () C:\Users\Josefina\AppData\Roaming\Spotify\libcef.dll

2015-03-15 01:57 - 2016-03-17 13:45 - 01584240 _____ () C:\Users\Josefina\AppData\Roaming\Spotify\libglesv2.dll

2015-03-15 01:57 - 2016-03-17 13:45 - 00082032 _____ () C:\Users\Josefina\AppData\Roaming\Spotify\libegl.dll

2014-12-06 17:35 - 2014-11-25 19:12 - 40622592 _____ () C:\Users\Josefina\AppData\Local\razer\InGameEngine\cache\RzStats.Manager\cef\libcef.dll

2014-12-06 17:36 - 2014-11-25 19:12 - 00911360 _____ () C:\Users\Josefina\AppData\Local\razer\InGameEngine\cache\RzStats.Manager\cef\libglesv2.dll

2014-12-06 17:36 - 2014-11-25 19:12 - 00134144 _____ () C:\Users\Josefina\AppData\Local\razer\InGameEngine\cache\RzStats.Manager\cef\libegl.dll

2016-03-14 20:11 - 2016-03-07 19:48 - 01676440 _____ () C:\Program Files (x86)\Google\Chrome\Application\49.0.2623.87\libglesv2.dll

2016-03-14 20:11 - 2016-03-07 19:48 - 00086168 _____ () C:\Program Files (x86)\Google\Chrome\Application\49.0.2623.87\libegl.dll

 

==================== Alternate Data Streams (Whitelisted) =========

 

(If an entry is included in the fixlist, only the ADS will be removed.)

 

AlternateDataStreams: C:\Users\Josefina\Desktop\signed.papers.jpeg:3or4kl4x13tuuug3Byamue2s4b [85]

AlternateDataStreams: C:\Users\Josefina\Desktop\signed.papers.jpeg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} [0]

 

==================== Safe Mode (Whitelisted) ===================

 

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

 

 

==================== EXE Association (Whitelisted) ===============

 

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)

 

 

==================== Internet Explorer trusted/restricted ===============

 

(If an entry is included in the fixlist, it will be removed from the registry.)

 

IE restricted site: HKU\S-1-5-21-328124280-1994820816-3203177752-1001\...\skype.com -> hxxps://apps.skype.com

 

==================== Hosts content: ===============================

 

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

 

2013-08-22 06:25 - 2016-02-18 23:07 - 00000862 ____A C:\Windows\system32\Drivers\etc\hosts

 

0.0.0.1 mssplus.mcafee.com

 

==================== Other Areas ============================

 

(Currently there is no automatic fix for this section.)

 

HKU\S-1-5-21-328124280-1994820816-3203177752-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Josefina\AppData\Roaming\Microsoft\Windows Photo Viewer\Windows Photo Viewer Wallpaper.jpg

DNS Servers: 10.10.6.1 - 68.105.28.11

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)

Windows Firewall is enabled.

 

==================== MSCONFIG/TASK MANAGER disabled items ==

 

(Currently there is no automatic fix for this section.)

 

 

==================== FirewallRules (Whitelisted) ===============

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139

FirewallRules: [{DB631FE9-D53A-4CDF-A87A-7CFA39B93909}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD12\Movie\PowerDVD Cinema\PowerDVDCinema12.exe

FirewallRules: [TCP Query User{F2917DB9-D1E0-4DEA-AE90-3B5B4F4E3F09}C:\users\josefina\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\josefina\appdata\roaming\spotify\spotify.exe

FirewallRules: [UDP Query User{DC4B0C6A-9E34-4CE8-9DA9-18D5B60732BD}C:\users\josefina\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\josefina\appdata\roaming\spotify\spotify.exe

FirewallRules: [TCP Query User{3D5A4423-C026-4F27-8E8D-7071F043F56D}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe

FirewallRules: [UDP Query User{C7039E5A-258E-4215-94F8-7268791C854E}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe

FirewallRules: [{D3BD3DB0-D717-41E2-BC6F-9994E3B1E9F0}] => (Allow) C:\Program Files (x86)\Battle.net\Battle.net.exe

FirewallRules: [{0271FA94-1B69-4522-9D72-930EE4D0ACB6}] => (Allow) C:\Program Files (x86)\Battle.net\Battle.net.exe

FirewallRules: [{9A79C10B-7A4F-4D93-9A4C-C4D7BBB9177E}] => (Allow) C:\Program Files (x86)\Hearthstone\Hearthstone.exe

FirewallRules: [{9384F0D6-6F55-4B25-A19C-C4F31092A1F7}] => (Allow) C:\Program Files (x86)\Hearthstone\Hearthstone.exe

FirewallRules: [{3AAD40A0-6250-4288-949B-893E035AB883}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3023\Agent.exe

FirewallRules: [{F27A37FD-D924-4F6F-A7EF-23AF344D94F3}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3023\Agent.exe

FirewallRules: [TCP Query User{832E9121-11DE-4C42-93D0-286595F15E25}C:\users\josefina\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\josefina\appdata\roaming\spotify\spotify.exe

FirewallRules: [UDP Query User{F73EB8AE-1AFA-4C1D-8F59-88D40BFCE08B}C:\users\josefina\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\josefina\appdata\roaming\spotify\spotify.exe

FirewallRules: [TCP Query User{96399CC5-C682-46A7-BE42-1B11D86C18B3}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe

FirewallRules: [UDP Query User{35A64C5A-D901-444B-BF5E-81091883D5B2}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe

FirewallRules: [{0DB5A003-5A2D-473F-A63E-3080500CF158}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3109\Agent.exe

FirewallRules: [{76E7B944-ACB6-4F4C-BE26-4C48F26FD315}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3109\Agent.exe

FirewallRules: [{C321B6E8-0FBC-417E-999E-391A561432C2}] => (Allow) C:\Users\Josefina\AppData\Local\Temp\7zS3044.tmp\SymNRT.exe

FirewallRules: [{66187EA6-114C-4900-8870-3F8726843F7E}] => (Allow) C:\Users\Josefina\AppData\Local\Temp\7zS3044.tmp\SymNRT.exe

FirewallRules: [{BA3D66AA-94F2-424F-8462-CCD55AD121E8}] => (Allow) LPort=50000

FirewallRules: [{78395AFE-DC7C-4FCC-869E-07EB9115CE62}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3109\Agent.exe

FirewallRules: [{13574E4B-8537-4D06-82A9-FB67CEF230D4}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3109\Agent.exe

FirewallRules: [{89C1EF30-4037-4613-B80D-2C7EB1519865}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3147\Agent.exe

FirewallRules: [{3FDFFA98-65E3-41D9-B9D4-D4A849E86D93}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3147\Agent.exe

FirewallRules: [TCP Query User{7C019123-85B9-4FAF-8AE4-C909AB9978BD}C:\program files (x86)\hearthstone\hearthstone.exe] => (Allow) C:\program files (x86)\hearthstone\hearthstone.exe

FirewallRules: [UDP Query User{7D6CA702-E339-4E96-B2DC-2645919C9017}C:\program files (x86)\hearthstone\hearthstone.exe] => (Allow) C:\program files (x86)\hearthstone\hearthstone.exe

FirewallRules: [{7E4C3B47-F2D1-4260-BD6F-B3AE57BF591E}] => (Allow) LPort=50000

FirewallRules: [{AE70EE10-EA6B-4636-9EFC-341FEEB7BAD9}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3182\Agent.exe

FirewallRules: [{1613F250-CE59-4895-AC69-88370C46C4A9}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3182\Agent.exe

FirewallRules: [TCP Query User{155E33DC-62D7-4114-9B52-9112A233F54A}C:\program files (x86)\cain\cain.exe] => (Allow) C:\program files (x86)\cain\cain.exe

FirewallRules: [UDP Query User{675FF6B5-7416-4D17-9391-E21FC7EACC1E}C:\program files (x86)\cain\cain.exe] => (Allow) C:\program files (x86)\cain\cain.exe

FirewallRules: [{00D856A1-98C2-4B84-B43E-387E0FABF773}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3235\Agent.exe

FirewallRules: [{61960BDF-16B4-40B6-AD15-87ED1E86E1AF}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3235\Agent.exe

FirewallRules: [{DEB3EDA7-24CF-4736-BA29-CF85F768DB56}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe

FirewallRules: [{18939171-7376-4232-8F25-B8D1DD97939A}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe

FirewallRules: [{DC763B3F-8BCB-4068-81D2-CCD2B56F830E}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe

FirewallRules: [{B2625160-816F-4476-BFF7-6439DDDE842F}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe

FirewallRules: [{A4A1D583-FD05-4687-928E-59DAB4092159}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Team Fortress 2\hl2.exe

FirewallRules: [{1EEE8DAC-6B50-47CC-96A7-56E595064759}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Team Fortress 2\hl2.exe

FirewallRules: [{001673F2-13AD-44A6-889D-33C2EF7AF8FE}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3323\Agent.exe

FirewallRules: [{C106D242-20D0-43FC-B844-6885944D54EB}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3323\Agent.exe

FirewallRules: [{F9177802-6F41-4A0E-8695-64B0B06FF539}] => (Allow) LPort=8317

FirewallRules: [TCP Query User{EF40A9AC-969A-46F3-9976-5BC91FFDEFFE}C:\riot games\league of legends\rads\projects\lol_patcher\releases\0.0.0.14\deploy\lolpatcher.exe] => (Allow) C:\riot games\league of legends\rads\projects\lol_patcher\releases\0.0.0.14\deploy\lolpatcher.exe

FirewallRules: [UDP Query User{40FB78D7-C238-4AEC-A372-3CF453608355}C:\riot games\league of legends\rads\projects\lol_patcher\releases\0.0.0.14\deploy\lolpatcher.exe] => (Allow) C:\riot games\league of legends\rads\projects\lol_patcher\releases\0.0.0.14\deploy\lolpatcher.exe

FirewallRules: [TCP Query User{30F229EF-2FBA-41BA-96AB-46D15D366BA3}C:\riot games\league of legends\rads\projects\lol_patcher\releases\0.0.0.14\deploy\lolpatcherux.exe] => (Allow) C:\riot games\league of legends\rads\projects\lol_patcher\releases\0.0.0.14\deploy\lolpatcherux.exe

FirewallRules: [UDP Query User{504E8A65-38A7-43CA-B28A-DB5B4D224F36}C:\riot games\league of legends\rads\projects\lol_patcher\releases\0.0.0.14\deploy\lolpatcherux.exe] => (Allow) C:\riot games\league of legends\rads\projects\lol_patcher\releases\0.0.0.14\deploy\lolpatcherux.exe

FirewallRules: [{19F38CCE-EEF2-49CC-91B3-9EE9BB8ABA77}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3526\Agent.exe

FirewallRules: [{217A4875-E897-4D05-87B0-0775AECE8D42}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3526\Agent.exe

FirewallRules: [TCP Query User{44A49255-29B6-4438-9183-2EEE22B6D7C7}C:\program files (x86)\lolreplay\lolreplay.exe] => (Allow) C:\program files (x86)\lolreplay\lolreplay.exe

FirewallRules: [UDP Query User{7CB40C52-7987-494F-B3B5-5E4608146885}C:\program files (x86)\lolreplay\lolreplay.exe] => (Allow) C:\program files (x86)\lolreplay\lolreplay.exe

FirewallRules: [TCP Query User{C1AEA2BB-A721-4FEF-BFBB-A7E2DEC2288F}C:\program files (x86)\steam\steamapps\common\dayz\dayz.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\dayz\dayz.exe

FirewallRules: [UDP Query User{28DC3DC1-C879-4A73-ACFB-A664AC3EB665}C:\program files (x86)\steam\steamapps\common\dayz\dayz.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\dayz\dayz.exe

FirewallRules: [TCP Query User{9598009A-A349-4014-A121-238FA7E80143}C:\users\josefina\appdata\local\id software\quakelive\quakelive.exe] => (Allow) C:\users\josefina\appdata\local\id software\quakelive\quakelive.exe

FirewallRules: [UDP Query User{812F7557-D2AA-4FEB-9FF7-B0100A205BFD}C:\users\josefina\appdata\local\id software\quakelive\quakelive.exe] => (Allow) C:\users\josefina\appdata\local\id software\quakelive\quakelive.exe

FirewallRules: [{4903E948-CF8F-47EF-B082-C8868F9EE385}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe

FirewallRules: [{57F4F88A-88B1-4009-910F-2C0A9AA73EEE}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe

FirewallRules: [{0CED098D-DA59-493F-ACE4-737E14AA9C3F}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe

FirewallRules: [{B898CDAF-207E-4263-9D47-D453A1A838D1}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe

FirewallRules: [{4E78E588-2BE0-4467-8176-4EB6F301E2F2}] => (Allow) C:\Program Files (x86)\iTunes\iTunes.exe

FirewallRules: [{D4BB50C2-DDCE-4C0B-8D38-89DF48516C66}] => (Allow) C:\Program Files (x86)\Electronic Arts\BioWare\Star Wars - The Old Republic\launcher.exe

FirewallRules: [{4E6EEB6C-7999-434D-BE63-68C99867D07D}] => (Allow) C:\Program Files (x86)\Electronic Arts\BioWare\Star Wars - The Old Republic\launcher.exe

FirewallRules: [{B384FF1D-A159-472A-A72C-487E719A3BC6}] => (Allow) C:\Program Files (x86)\Electronic Arts\BioWare\Star Wars - The Old Republic\launcher.exe

FirewallRules: [{72E20B10-8C81-48B5-9959-B868A7126CBD}] => (Allow) C:\Program Files (x86)\Electronic Arts\BioWare\Star Wars - The Old Republic\launcher.exe

FirewallRules: [{F81DD2BF-EB08-46D4-A2B5-D17CAE6AD330}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

FirewallRules: [{D822D03A-1630-4AED-B4CE-1E2DF16C98FB}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

FirewallRules: [{1B437634-1C06-497A-A9E8-75CA1CFBA188}] => (Allow) C:\Windows\system32\dleacoms.exe

FirewallRules: [{487C1CF0-0821-4E46-9A0F-B58507013D9D}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\outlook.exe

FirewallRules: [{B2A4CFFA-48D4-4FB2-8F85-64AAF7452307}] => (Allow) C:\Users\Josefina\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe

FirewallRules: [TCP Query User{52E4FA3C-538C-4D3C-A471-782ED82D1B48}C:\program files (x86)\mozilla firefox\firefox.exe] => (Block) C:\program files (x86)\mozilla firefox\firefox.exe

FirewallRules: [UDP Query User{576D108A-FA48-4F0C-8D91-CBC4B3DFC5BD}C:\program files (x86)\mozilla firefox\firefox.exe] => (Block) C:\program files (x86)\mozilla firefox\firefox.exe

FirewallRules: [{233DAE45-1F66-4CE5-A1FE-4638FFD9946A}] => (Allow) C:\Program Files (x86)\DolbyAxon\Axon.exe

FirewallRules: [{CE637C89-1498-43FC-A8ED-DF1C5F033445}] => (Allow) C:\Program Files (x86)\DolbyAxon\Axon.exe

FirewallRules: [TCP Query User{8116671A-3BAF-406C-8CE6-6E87D27C477F}C:\users\josefina\downloads\runtime\jre-x64\1.8.0_25\bin\javaw.exe] => (Allow) C:\users\josefina\downloads\runtime\jre-x64\1.8.0_25\bin\javaw.exe

FirewallRules: [UDP Query User{51E4029B-F73A-477A-BA74-5AC5743E804B}C:\users\josefina\downloads\runtime\jre-x64\1.8.0_25\bin\javaw.exe] => (Allow) C:\users\josefina\downloads\runtime\jre-x64\1.8.0_25\bin\javaw.exe

FirewallRules: [{F1D1F996-7767-4A32-9A22-AC5DBE2F22E8}] => (Allow) LPort=8317

FirewallRules: [TCP Query User{1E1AED25-305B-4E34-8BE1-7B0927633F80}C:\program files (x86)\mirrorop receiver\mirrorop receiver.exe] => (Allow) C:\program files (x86)\mirrorop receiver\mirrorop receiver.exe

FirewallRules: [UDP Query User{5781671B-8D3B-48AC-B3D6-4B626C4D9BF3}C:\program files (x86)\mirrorop receiver\mirrorop receiver.exe] => (Allow) C:\program files (x86)\mirrorop receiver\mirrorop receiver.exe

FirewallRules: [{ED5359CA-6240-4A0E-BF0F-991BDDBBE461}] => (Allow) C:\Program Files\App Dynamic\AirServer\AirServer.exe

FirewallRules: [{261133B7-4624-468D-8067-62C341EFE3CE}] => (Allow) C:\Program Files\App Dynamic\AirServer\AirServer.exe

FirewallRules: [TCP Query User{681DCD85-8D78-4229-9702-D3DF3EFEA603}C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe] => (Allow) C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe

FirewallRules: [UDP Query User{D040990E-BC97-4CBE-AB2C-8EC3AF5E23B6}C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe] => (Allow) C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe

FirewallRules: [{22EDAC80-B5D3-4B17-AEE5-CA55C6B281E8}] => (Allow) C:\Program Files (x86)\OctaneVPN\resources\bin\win32\openvpn.exe

FirewallRules: [{BF75F5A7-737E-4FBA-B57F-A3AA7EE23A05}] => (Allow) C:\Program Files (x86)\OctaneVPN\octanevpn.exe

FirewallRules: [{37F64EC5-91CF-4E74-9AFB-8EC38CA23D0D}] => (Allow) C:\Program Files (x86)\OctaneVPN\resources\bin\win32\openvpn.exe

FirewallRules: [{FA661404-31C9-4C67-9349-A8D9FC8797A8}] => (Allow) C:\Program Files (x86)\OctaneVPN\resources\bin\win32\openvpn.exe

FirewallRules: [{B6D1C1EB-CCED-4BD4-AE06-6D1F3E457B70}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

 

==================== Restore Points =========================

 

26-02-2016 22:50:12 Scheduled Checkpoint

28-02-2016 23:35:30 Removed League of Legends

 

==================== Faulty Device Manager Devices =============

 

 

==================== Event log errors: =========================

 

Application errors:

==================

Error: (03/17/2016 01:38:03 AM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledSPRetry 15281

 

Error: (03/17/2016 01:38:03 AM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledEvent 15281

 

Error: (03/17/2016 01:38:03 AM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: Continuously busy for more than a second

 

Error: (03/17/2016 12:44:21 AM) (Source: Office 2013 Licensing Service) (EventID: 0) (User: )

Description: Subscription licensing service failed: -1073415161

 

Error: (03/16/2016 04:50:57 AM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledSPRetry 8656687

 

Error: (03/16/2016 04:50:57 AM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledEvent 8656687

 

Error: (03/16/2016 04:50:57 AM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: Continuously busy for more than a second

 

Error: (03/16/2016 04:50:55 AM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledSPRetry 8655156

 

Error: (03/16/2016 04:50:55 AM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledEvent 8655156

 

Error: (03/16/2016 04:50:55 AM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: Continuously busy for more than a second

 

 

System errors:

=============

Error: (03/17/2016 01:38:44 PM) (Source: Service Control Manager) (EventID: 7032) (User: )

Description: The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Windows Search service, but this action failed with the following error: 

%%1056

 

Error: (03/17/2016 01:38:09 PM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: The TMachInfo service terminated unexpectedly.  It has done this 1 time(s).

 

Error: (03/17/2016 01:38:09 PM) (Source: Service Control Manager) (EventID: 7031) (User: )

Description: The Windows Media Player Network Sharing Service service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 30000 milliseconds: Restart the service.

 

Error: (03/17/2016 01:38:09 PM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: The iPod Service service terminated unexpectedly.  It has done this 1 time(s).

 

Error: (03/17/2016 01:38:09 PM) (Source: Service Control Manager) (EventID: 7031) (User: )

Description: The Windows Search service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 30000 milliseconds: Restart the service.

 

Error: (03/17/2016 01:38:09 PM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: The TOSHIBA eco Utility Service service terminated unexpectedly.  It has done this 1 time(s).

 

Error: (03/17/2016 01:38:08 PM) (Source: Service Control Manager) (EventID: 7031) (User: )

Description: The Avira Service Host service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 10000 milliseconds: Restart the service.

 

Error: (03/17/2016 01:38:08 PM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: The SAMSUNG Mobile Connectivity Service service terminated unexpectedly.  It has done this 1 time(s).

 

Error: (03/17/2016 01:38:08 PM) (Source: Service Control Manager) (EventID: 7031) (User: )

Description: The RzSurroundVADStreamingService service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 5000 milliseconds: Restart the service.

 

Error: (03/17/2016 01:38:08 PM) (Source: Service Control Manager) (EventID: 7031) (User: )

Description: The Razer Game Scanner service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 5000 milliseconds: Restart the service.

 

 

CodeIntegrity:

===================================

  Date: 2016-02-25 11:26:26.439

  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements.

 

  Date: 2016-02-25 11:26:26.300

  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements.

 

  Date: 2016-02-25 02:00:07.926

  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

 

  Date: 2016-02-24 22:24:53.471

  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

 

  Date: 2016-02-24 18:20:44.000

  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements.

 

  Date: 2016-02-24 18:20:43.863

  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements.

 

  Date: 2016-02-24 18:20:43.643

  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

 

  Date: 2016-02-24 18:20:43.507

  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

 

  Date: 2016-02-24 18:20:43.367

  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

 

  Date: 2016-02-24 18:20:42.509

  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

 

 

==================== Memory info =========================== 

 

Processor: AMD A6-6310 APU with AMD Radeon R4 Graphics 

Percentage of memory in use: 56%

Total physical RAM: 5081.23 MB

Available physical RAM: 2216.89 MB

Total Virtual: 7769.23 MB

Available Virtual: 3917.09 MB

 

==================== Drives ================================

 

Drive c: (TI10693600C) (Fixed) (Total:687.9 GB) (Free:504.34 GB) NTFS

Drive e: () (Removable) (Total:14.91 GB) (Free:0.1 GB) FAT32

 

==================== MBR & Partition Table ==================

 

========================================================

Disk: 0 (Size: 698.6 GB) (Disk ID: 00000000)

 

Partition: GPT.

 

========================================================

Disk: 1 (Size: 14.9 GB) (Disk ID: 00000000)

 

Partition: GPT.

 

==================== End of Addition.txt ============================

[zep516]

Hello,

Next

Please download AdwCleaner by Xplode onto your Desktop.

• Close all open programs and internet browsers.
• Double click on AdwCleaner.exe to run the tool.
• Click the Scan button and wait for the process to complete.
• Click the logfile button and the log will open in Notepad.
• Click on the Clean button follow the prompts.
• A log file will automatically open after the scan has finished and the PC has rebooted.
• Please post the content of that log file with your next answer.
• The report will be saved in the C:\AdwCleaner folder.
  
  Next
  
  Please download Junkware Removal Tool to your Desktop.
  Please close your security software to avoid potential conflicts. See Here how to disable you security protection (Anti Virus)
  Run the tool by double-clicking it. If you are using Windows Vista or 7, right-mouse click it and select Run as administrator.
  The tool will open and start scanning your system.
  Please be patient as this can take a while to complete, depending on your system's specifications.
  On completion, a log (JRT.txt) is saved to your Desktop and will automatically open.
  Please post the contents of JRT.txt into your reply.
  
  In your next reply post;
• The AdwCleaner [SO].txt Log
• The JRT.txt Log
  
  I'll return later today.
  
  Thanks
  Joe

[Helpmeout12]

# AdwCleaner v5.113 - Logfile created 25/04/2016 at 11:28:47

# Updated 24/04/2016 by Xplode

# Database : 2016-04-24.3 [Server]

# Operating system : Windows 8.1  (X64)

# Username : Josefina - GUADALUPE

# Running from : C:\Users\Josefina\Downloads\adwcleaner_5.113.exe

# Option : Clean

# Support : http://toolslib.net/forum

 

***** [ Services ] *****

 

 

***** [ Folders ] *****

 

[-] Folder Deleted : C:\Users\Josefina\AppData\Local\SweetLabs App Platform

 

***** [ Files ] *****

 

 

***** [ DLLs ] *****

 

 

***** [ Shortcuts ] *****

 

 

***** [ Scheduled tasks ] *****

 

 

***** [ Registry ] *****

 

[-] Key Deleted : HKCU\Software\SweetLabs App Platform

 

***** [ Web browsers ] *****

 

 

*************************

 

:: "Tracing" keys deleted

:: Winsock settings cleared

 

*************************

 

C:\AdwCleaner\AdwCleaner[C1].txt - [825 bytes] - [25/04/2016 11:28:47]

C:\AdwCleaner\AdwCleaner[S1].txt - [969 bytes] - [25/04/2016 11:15:25]

 

########## EOF - C:\AdwCleaner\AdwCleaner[C1].txt - [969 bytes] ##########

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Malwarebytes

Version: 8.0.5 (04.20.2016)

Operating System: Windows 8.1 x64 

Ran by Josefina (Administrator) on Mon 04/25/2016 at 11:56:31.70

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

 

 

 

File System: 1 

 

Successfully deleted: C:\ai_recyclebin (Folder) 

 

 

 

Registry: 0 

 

 

 

 

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on Mon 04/25/2016 at 12:01:21.62

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

[zep516]

• Please download Malwarebytes Anti-Malware to your desktop.
• Double-click mbam-setup-version.exe and follow the prompts to install the program.
• Launch Malwarebytes Anti-Malware
• Then click Finish.
• If an update is found, you will be prompted to download and install the latest version.
• Once the program has loaded, select Scan now. Or select the Threat Scan from the Scan menu.
• When the scan is complete , make sure that that all Threats are selected, and click Remove Selected.
• Reboot your computer if prompted.
  
  
  Posting the Malwarebytes log.
  
  
• After the restart once you are back at your desktop, open MBAM once more.
• Click on the History tab > Application Logs.
• Double click on the Scan Log which shows the Date and time of the scan just performed.
• Click 'Export'.
• Click 'Text file (*.txt)'
• In the Save File dialog box which appears, click on Desktop.
• In the File name: box type a name for your scan log.
• A message box named 'File Saved' should appear stating "Your file has been successfully exported".
• Click Ok
• post that saved log to your next reply.
  
  
  After you posted the Malwarebytes do this
  
  A few items to fix
  
  NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system
  Open notepad (Start =>All Programs => Accessories => Notepad).
  Copy/Paste the contents of the code box below into Notepad.
  

  start
  CloseProcesses:
  CreateRestorePoint:
  AlternateDataStreams: C:\Users\Josefina\Desktop\signed.papers.jpeg:3or4kl4x13tuuug3Byamue2s4b [85]
  AlternateDataStreams: C:\Users\Josefina\Desktop\signed.papers.jpeg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} [0]
  CMD: bitsadmin /reset /allusers
  CMD: ipconfig /flushdns
  Emptytemp:
  

• Click Format and ensure Wordwrap is unchecked.
• Save as Fixlist.txt to your Desktop (Must be in this location)
• Run FRST/FRST64 and press the Fix button just once and wait.
• If the tool needed a restart please make sure you let the system to restart normally and let the tool completes its run after restart.
• The tool will make a log on the Desktop (Fixlog.txt). Please post it to your reply.
  Note: If the tool warns you about the version you're using being an outdated version please download and run the updated version.
  
  

[Helpmeout12]

Malwarebytes Anti-Malware

www.malwarebytes.org

 

Scan Date: 4/25/2016

Scan Time: 3:19 PM

Logfile: malwarebytes log.txt

Administrator: Yes

 

Version: 2.2.0.1024

Malware Database: v2016.04.25.05

Rootkit Database: v2016.04.17.01

License: Free

Malware Protection: Disabled

Malicious Website Protection: Disabled

Self-protection: Disabled

 

OS: Windows 8.1

CPU: x64

File System: NTFS

User: Josefina

 

Scan Type: Threat Scan

Result: Completed

Objects Scanned: 382473

Time Elapsed: 43 min, 47 sec

 

Memory: Enabled

Startup: Enabled

Filesystem: Enabled

Archives: Enabled

Rootkits: Disabled

Heuristics: Enabled

PUP: Enabled

PUM: Enabled

 

Processes: 0

(No malicious items detected)

 

Modules: 0

(No malicious items detected)

 

Registry Keys: 0

(No malicious items detected)

 

Registry Values: 0

(No malicious items detected)

 

Registry Data: 0

(No malicious items detected)

 

Folders: 0

(No malicious items detected)

 

Files: 0

(No malicious items detected)

 

Physical Sectors: 0

(No malicious items detected)

 

 

(end)

[Helpmeout12]

Out of curiosity what did you see in the signed papers files? 

 

Also when I ran the first64 and clicked fixed my anti virus popped up saying that the host file was blocked. I don't know if that effected the fix.

Edited by Helpmeout12, 25 April 2016 - 05:31 PM.

[zep516]

Out of curiosity what did you see in the signed papers files?

A relatively unknown compatibility feature of NTFS, Alternate Data Streams (ADS) provides hackers with a method of hiding root kits or hacker tools on a breached system and allows them to be executed without being detected by the systems administrator.

Do you have the fixlog on the destop ?

Please post it

[Helpmeout12]

Fix result of Farbar Recovery Scan Tool (x64) Version:18-04-2016

Ran by Josefina (2016-04-25 16:26:24) Run:2

Running from C:\Users\Josefina\Downloads

Loaded Profiles: Josefina &  (Available Profiles: Josefina)

Boot Mode: Normal

==============================================

 

fixlist content:

*****************

start

CreateRestorePoint:

CloseProcesses:

C:\Program Files\McAfee Security Scan

HKLM\...\Run: [] => [X]

HKLM-x32\...\Run: [] => [X]

C:\ProgramData\28341ff220e0446c9fff27c4493d622e

HKU\S-1-5-21-328124280-1994820816-3203177752-1001\...\MountPoints2: {4ed870a2-e9d3-11e4-8397-008cfa816eed} - "F:\LaunchU3.exe" -a

HKU\S-1-5-21-328124280-1994820816-3203177752-1001\...\MountPoints2: {d8c1a4c4-21fc-11e5-83db-008cfa816eed} - "F:\VZW_Software_upgrade_assistant.exe"

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk [2016-02-18]

ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.11.292\SSScheduler.exe (McAfee, Inc.)

Tcpip\Parameters: [DhcpNameServer] 10.10.6.1

Tcpip\..\Interfaces\{50356B71-1720-4E53-9A83-75422809EF35}: [DhcpNameServer] 68.105.28.11 68.105.29.11 68.105.28.12

Tcpip\..\Interfaces\{A3CDCC32-6451-40A0-960E-00C6CDEC270C}: [DhcpNameServer] 10.10.6.1

Tcpip\..\Interfaces\{C4CA73C3-BE41-48FE-9D4C-6AC0B598965C}: [DhcpNameServer] 192.168.0.1

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://toshiba13.msn.com/?pc=TNJB

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://toshiba13.msn.com/?pc=TNJB

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://toshiba13.msn.com/?pc=TNJB

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://toshiba13.msn.com/?pc=TNJB

SearchScopes: HKU\S-1-5-21-328124280-1994820816-3203177752-1001 -> DefaultScope {66CC2DE0-B4F8-43AB-BCDA-C3F9DF0DF395} URL =

SearchScopes: HKU\S-1-5-21-328124280-1994820816-3203177752-1001 -> {66CC2DE0-B4F8-43AB-BCDA-C3F9DF0DF395} URL =

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-02-02] (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-02-02] (Google Inc.)

S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.11.292\McCHSvc.exe [293128 2016-02-05] (McAfee, Inc.)

2016-02-24 19:34 - 2016-02-24 19:34 - 00000000 ____D C:\ProgramData\28341ff220e0446c9fff27c4493d622e

2016-02-18 23:06 - 2016-03-05 19:58 - 00002035 _____ C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk

2016-02-18 23:06 - 2016-02-18 23:06 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus 

C:\ProgramData\McAfee Security Scan

C:\Program Files\McAfee Security Scan 

2014-09-29 15:29 - 2015-02-22 03:27 - 0000096 _____ () C:\Users\Josefina\AppData\Roaming\Camdata.ini

2014-09-29 15:29 - 2015-02-22 03:27 - 0000408 _____ () C:\Users\Josefina\AppData\Roaming\CamLayout.ini

2014-09-29 15:29 - 2015-02-22 03:27 - 0000408 _____ () C:\Users\Josefina\AppData\Roaming\CamShapes.ini

2014-09-29 15:29 - 2015-02-22 03:27 - 0004535 _____ () C:\Users\Josefina\AppData\Roaming\CamStudio.cfg

2014-09-29 15:29 - 2015-02-22 03:26 - 0000096 _____ () C:\Users\Josefina\AppData\Roaming\version2.xml

2015-04-24 06:42 - 2016-02-26 22:45 - 0014330 _____ () C:\ProgramData\dleaJSW.log

2015-04-23 09:13 - 2016-02-26 21:42 - 0006900 _____ () C:\ProgramData\dleascan.log

2014-05-21 11:29 - 2014-05-21 11:29 - 0000000 ____H () C:\ProgramData\DP45977C.lfl 

C:\Users\Josefina\MetricCollection.dll 

C:\Users\Josefina\AppData\Local\Temp\avgnt.exe

C:\Users\Josefina\AppData\Local\Temp\oct3D96.tmp.exe

C:\Users\Josefina\AppData\Local\Temp\oct4F86.tmp.exe

C:\Users\Josefina\AppData\Local\Temp\octEB50.tmp.exe

C:\Users\Josefina\AppData\Local\Temp\sqlite3.dll 

Task: {13B3C597-EF56-4D85-8559-CE5031B68E67} - System32\Tasks\Norton WSC Integration => C:\Program Files (x86)\Norton Internet Security\Engine\21.3.0.12\WSCStub.exe

C:\Program Files (x86)\Norton Internet Security

Task: {3573C722-AA4E-4238-9F7B-7B812181162E} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-12-14] (Adobe Systems Incorporated)

Task: {41E5FC1C-F3C7-47C4-9556-EA749923FF7B} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2016-03-10] (Adobe Systems Incorporated)

Task: {6253AE21-5C4A-447F-BF33-F140FD85919B} - System32\Tasks\Norton Internet Security\Norton Error Analyzer => C:\Program Files (x86)\Norton Internet Security\Engine\21.3.0.12\SymErr.exe

Task: {7E55F218-D299-40ED-A4DD-D67DB87CEF97} - System32\Tasks\Norton Internet Security\Norton Error Processor => C:\Program Files (x86)\Norton Internet Security\Engine\21.3.0.12\SymErr.exe

AlternateDataStreams: C:\Users\Josefina\Desktop\signed.papers.jpeg:3or4kl4x13tuuug3Byamue2s4b [85]

AlternateDataStreams: C:\Users\Josefina\Desktop\signed.papers.jpeg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} [0] 

FirewallRules: [{BA3D66AA-94F2-424F-8462-CCD55AD121E8}] => (Allow) LPort=50000

FirewallRules: [{7E4C3B47-F2D1-4260-BD6F-B3AE57BF591E}] => (Allow) LPort=50000

FirewallRules: [{F9177802-6F41-4A0E-8695-64B0B06FF539}] => (Allow) LPort=8317

C:\Windows\System32\GWX

C:\Windows\SysWOW64\GWX

CMD: netsh advfirewall reset

CMD: netsh advfirewall set allprofiles state On

RemoveProxy:

CMD: ipconfig /flushdns

hosts:

Emptytemp:

reboot:

end

 

*****************

 

Restore point was successfully created.

Processes closed successfully.

"C:\Program Files\McAfee Security Scan" => not found.

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\ => value not found.

HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\ => value not found.

"C:\ProgramData\28341ff220e0446c9fff27c4493d622e" => not found.

HKU\S-1-5-21-328124280-1994820816-3203177752-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4ed870a2-e9d3-11e4-8397-008cfa816eed} => key not found. 

HKCR\CLSID\{4ed870a2-e9d3-11e4-8397-008cfa816eed} => key not found. 

HKU\S-1-5-21-328124280-1994820816-3203177752-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d8c1a4c4-21fc-11e5-83db-008cfa816eed} => key not found. 

HKCR\CLSID\{d8c1a4c4-21fc-11e5-83db-008cfa816eed} => key not found. 

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk => not found.

C:\Program Files\McAfee Security Scan\3.11.292\SSScheduler.exe => not found.

HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\\DhcpNameServer => value removed successfully

HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{50356B71-1720-4E53-9A83-75422809EF35}\\DhcpNameServer => value removed successfully

HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{A3CDCC32-6451-40A0-960E-00C6CDEC270C}\\DhcpNameServer => value removed successfully

HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{C4CA73C3-BE41-48FE-9D4C-6AC0B598965C}\\DhcpNameServer => value removed successfully

HKLM\Software\\Microsoft\Internet Explorer\Main\\Start Page => value restored successfully

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Start Page => value restored successfully

HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Page_URL => value restored successfully

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Page_URL => value restored successfully

HKU\S-1-5-21-328124280-1994820816-3203177752-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value not found.

HKU\S-1-5-21-328124280-1994820816-3203177752-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{66CC2DE0-B4F8-43AB-BCDA-C3F9DF0DF395} => key not found. 

HKCR\CLSID\{66CC2DE0-B4F8-43AB-BCDA-C3F9DF0DF395} => key not found. 

HKLM\Software\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3 => key not found. 

C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll => not found.

HKLM\Software\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9 => key not found. 

C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll => not found.

McComponentHostService => service not found.

"C:\ProgramData\28341ff220e0446c9fff27c4493d622e" => not found.

"C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk" => not found.

"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus" => not found.

"C:\ProgramData\McAfee Security Scan" => not found.

"C:\Program Files\McAfee Security Scan" => not found.

"C:\Users\Josefina\AppData\Roaming\Camdata.ini" => not found.

"C:\Users\Josefina\AppData\Roaming\CamLayout.ini" => not found.

"C:\Users\Josefina\AppData\Roaming\CamShapes.ini" => not found.

"C:\Users\Josefina\AppData\Roaming\CamStudio.cfg" => not found.

"C:\Users\Josefina\AppData\Roaming\version2.xml" => not found.

"C:\ProgramData\dleaJSW.log" => not found.

"C:\ProgramData\dleascan.log" => not found.

"C:\ProgramData\DP45977C.lfl" => not found.

"C:\Users\Josefina\MetricCollection.dll" => not found.

C:\Users\Josefina\AppData\Local\Temp\avgnt.exe => moved successfully

"C:\Users\Josefina\AppData\Local\Temp\oct3D96.tmp.exe" => not found.

"C:\Users\Josefina\AppData\Local\Temp\oct4F86.tmp.exe" => not found.

"C:\Users\Josefina\AppData\Local\Temp\octEB50.tmp.exe" => not found.

C:\Users\Josefina\AppData\Local\Temp\sqlite3.dll => moved successfully

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{13B3C597-EF56-4D85-8559-CE5031B68E67} => key not found. 

C:\Windows\System32\Tasks\Norton WSC Integration => not found.

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Norton WSC Integration => key not found. 

"C:\Program Files (x86)\Norton Internet Security" => not found.

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3573C722-AA4E-4238-9F7B-7B812181162E} => key not found. 

C:\Windows\System32\Tasks\Adobe Acrobat Update Task => not found.

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Adobe Acrobat Update Task => key not found. 

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{41E5FC1C-F3C7-47C4-9556-EA749923FF7B} => key not found. 

C:\Windows\System32\Tasks\Adobe Flash Player Updater => not found.

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Adobe Flash Player Updater => key not found. 

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{6253AE21-5C4A-447F-BF33-F140FD85919B} => key not found. 

C:\Windows\System32\Tasks\Norton Internet Security\Norton Error Analyzer => not found.

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Norton Internet Security\Norton Error Analyzer => key not found. 

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{7E55F218-D299-40ED-A4DD-D67DB87CEF97} => key not found. 

C:\Windows\System32\Tasks\Norton Internet Security\Norton Error Processor => not found.

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Norton Internet Security\Norton Error Processor => key not found. 

"C:\Users\Josefina\Desktop\signed.papers.jpeg" => ":3or4kl4x13tuuug3Byamue2s4b" ADS not found.

"C:\Users\Josefina\Desktop\signed.papers.jpeg" => ":{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}" ADS not found.

HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{BA3D66AA-94F2-424F-8462-CCD55AD121E8} => value not found.

HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{7E4C3B47-F2D1-4260-BD6F-B3AE57BF591E} => value not found.

HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{F9177802-6F41-4A0E-8695-64B0B06FF539} => value not found.

"C:\Windows\System32\GWX" => not found.

"C:\Windows\SysWOW64\GWX" => not found.

 

=========  netsh advfirewall reset =========

 

Ok.

 

 

========= End of CMD: =========

 

 

=========  netsh advfirewall set allprofiles state On =========

 

Ok.

 

 

========= End of CMD: =========

 

 

========= RemoveProxy: =========

 

HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value removed successfully

HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value removed successfully

HKU\S-1-5-21-328124280-1994820816-3203177752-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable => value removed successfully

HKU\S-1-5-21-328124280-1994820816-3203177752-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value removed successfully

HKU\S-1-5-21-328124280-1994820816-3203177752-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value removed successfully

HKU\S-1-5-21-328124280-1994820816-3203177752-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable => value removed successfully

HKU\S-1-5-21-328124280-1994820816-3203177752-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value removed successfully

HKU\S-1-5-21-328124280-1994820816-3203177752-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value removed successfully

 

 

========= End of RemoveProxy: =========

 

 

=========  ipconfig /flushdns =========

 

 

Windows IP Configuration

 

Successfully flushed the DNS Resolver Cache.

 

========= End of CMD: =========

 

"C:\Windows\System32\Drivers\etc\hosts" => Could not move.

Could not restore Hosts.

EmptyTemp: => 860.7 MB temporary data Removed.

 

 

The system needed a reboot.

 

==== End of Fixlog 16:28:12 ====

[zep516]

That's not the fix I created, who created that fixlist ?

[Helpmeout12]

I had someone run me through something similar a few months ago on a different website. Did I do something wrong? 

[zep516]

Un-less you're trained in Malware removal you should not be creating your own fixlist. I create the fix list and you run it.

I don't see any harm done. Never veer from directions given and decide to do things on your own.

How is the computer ?

Re-run Farbar Recovery Scan Tool (FRST/FRST64) you ran at the very beginning of this topic.

• Double-click to run it. When the tool opens click Yes to disclaimer.
• Make sure you checkmark Addition.txt box.
• Press Scan button.
• Scan will create two logs, FRST.txt and Addition.txt in the same directory the tool is run. Please copy and paste them to your reply.

[Helpmeout12]

I didn't do anything on my own though. I put the fixlist note on my desktop and pressed fix on frst64. I'm not sure what happened that made it run something else.

 

The computer is running fine.

[Helpmeout12]

Should I delete the last Frst/Addition notes before I re-run it?