Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

Invalid external drive H:/ and f:/ keep popping up in explorer

Started by Evelyn Smith , Jul 01 2016 01:29 AM

external drive pop up explorer.exe

Please log in to reply

#1
Evelyn Smith

Posted 01 July 2016 - 01:29 AM

New Member

Member
4 posts

Hi,

After I used 2 different cameras that I plugged into my USB drive, I keep having explorer.exe popping up their drive names saying "F:/ or H:/ The directory name is invalid." I can't even close the windows because hundreds are popping up over and over and I can't even do anything unless I end explorer.exe task. This isn't my computer but my husband likes to dabble in music sample websites so it could have come from there. I have no idea. I also noticed that anytime I use a process that can enable the "always on top" feature. ex. Task manager, the screen starts flashing. I really think it's either a hack or a virus. If it's a virus, it's definitely responding to everything I do.

Here is my FRST.txt file:

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 29-06-2016

Ran by ALLAH is UP (administrator) on ALLAHISUP-PC (30-06-2016 23:52:55)

Running from C:\Users\ALLAH is UP\Downloads

Loaded Profiles: ALLAH is UP (Available Profiles: ALLAH is UP & DefaultAppPool)

Platform: Windows 10 Home Version 1511 (X64) Language: English (United States)

Internet Explorer Version 11 (Default browser: Chrome)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Av\avgrsa.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Av\avgcsrva.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Framework\Common\avgsvca.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Av\avgidsagenta.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Av\avgwdsvca.exe

() C:\Program Files (x86)\NETGEAR\WNA1100\WifiSvc.exe

(Microsoft Corporation) C:\Windows\System32\mqsvc.exe

(Native Instruments GmbH) C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe

(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Av\avgnsa.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Av\avgemca.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

() C:\Program Files (x86)\NETGEAR\WNA1100\WNA1100.exe

() C:\Program Files (x86)\eMachines\Hotkey Utility\HotkeyUtility.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Framework\Common\avguix.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Av\avgui.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Microsoft Corporation) C:\Windows\System32\rundll32.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Microsoft Corporation) C:\Windows\System32\rundll32.exe

(Microsoft Corporation) C:\Windows\System32\sdiagnhost.exe

(Microsoft Corporation) C:\Windows\System32\rundll32.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [8312352 2009-11-02] (Realtek Semiconductor)

HKLM\...\Run: [IgfxTray] => C:\Windows\system32\igfxtray.exe

HKLM\...\Run: [HotKeysCmds] => C:\Windows\system32\hkcmd.exe

HKLM\...\Run: [Persistence] => C:\Windows\system32\igfxpers.exe

HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [35696 2009-02-27] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [Hotkey Utility] => C:\Program Files (x86)\eMachines\Hotkey Utility\HotkeyUtility.exe [611872 2010-08-04] ()

HKLM-x32\...\Run: [jswtrayutil] => "C:\Program Files (x86)\NETGEAR\WNA1100\jswtrayutil.exe"

HKLM-x32\...\Run: [AvgUi] => C:\Program Files (x86)\AVG\Framework\Common\avguirnx.exe [186640 2016-06-21] (AVG Technologies CZ, s.r.o.)

HKLM-x32\...\Run: [AVG_UI] => C:\Program Files (x86)\AVG\Av\avgui.exe [6570256 2016-06-09] (AVG Technologies CZ, s.r.o.)

HKLM-x32\...\Run: [PWRISOVM.EXE] => C:\Program Files\PowerISO\PWRISOVM.EXE [408888 2015-10-08] (Power Software Ltd)

HKLM-x32\...\Run: [Dropbox] => C:\Program Files (x86)\Dropbox\Client\Dropbox.exe [23972712 2016-05-31] (Dropbox, Inc.)

HKU\S-1-5-21-436150743-3596999183-3093125189-1000\...\RunOnce: [Uninstall C:\Users\ALLAH is UP\AppData\Local\Microsoft\OneDrive\17.3.6281.1202\amd64] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\ALLAH is UP\AppData\Local\Microsoft\OneDrive\17.3.6281.1202\amd64"

ShellIconOverlayIdentifiers: [ DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.34.dll [2016-05-31] (Dropbox, Inc.)

ShellIconOverlayIdentifiers: [ DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.34.dll [2016-05-31] (Dropbox, Inc.)

ShellIconOverlayIdentifiers: [ DropboxExt3] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.34.dll [2016-05-31] (Dropbox, Inc.)

ShellIconOverlayIdentifiers: [ DropboxExt4] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.34.dll [2016-05-31] (Dropbox, Inc.)

ShellIconOverlayIdentifiers: [ DropboxExt5] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.34.dll [2016-05-31] (Dropbox, Inc.)

ShellIconOverlayIdentifiers: [ DropboxExt6] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.34.dll [2016-05-31] (Dropbox, Inc.)

ShellIconOverlayIdentifiers: [ DropboxExt7] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.34.dll [2016-05-31] (Dropbox, Inc.)

ShellIconOverlayIdentifiers: [ DropboxExt8] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.34.dll [2016-05-31] (Dropbox, Inc.)

ShellIconOverlayIdentifiers-x32: [ DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.34.dll [2016-05-31] (Dropbox, Inc.)

ShellIconOverlayIdentifiers-x32: [ DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.34.dll [2016-05-31] (Dropbox, Inc.)

ShellIconOverlayIdentifiers-x32: [ DropboxExt3] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.34.dll [2016-05-31] (Dropbox, Inc.)

ShellIconOverlayIdentifiers-x32: [ DropboxExt4] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.34.dll [2016-05-31] (Dropbox, Inc.)

ShellIconOverlayIdentifiers-x32: [ DropboxExt5] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.34.dll [2016-05-31] (Dropbox, Inc.)

ShellIconOverlayIdentifiers-x32: [ DropboxExt6] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.34.dll [2016-05-31] (Dropbox, Inc.)

ShellIconOverlayIdentifiers-x32: [ DropboxExt7] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.34.dll [2016-05-31] (Dropbox, Inc.)

ShellIconOverlayIdentifiers-x32: [ DropboxExt8] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.34.dll [2016-05-31] (Dropbox, Inc.)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\NETGEAR WNA1100 Genie.lnk [2015-11-07]

ShortcutTarget: NETGEAR WNA1100 Genie.lnk -> C:\Program Files (x86)\NETGEAR\WNA1100\WNA1100.exe ()

Startup: C:\Users\ALLAH is UP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Launch ShareMouse.lnk [2015-12-31]

ShortcutTarget: Launch ShareMouse.lnk -> (No File)

Startup: C:\Users\ALLAH is UP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PalTalk.lnk [2015-12-05]

ShortcutTarget: PalTalk.lnk -> C:\Program Files (x86)\Paltalk Messenger\paltalk.exe (AVM Software Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 209.18.47.62 209.18.47.61

Tcpip\..\Interfaces\{198b4aa9-9dc7-4069-a127-c7186133f369}: [DhcpNameServer] 209.18.47.62 209.18.47.61

Tcpip\..\Interfaces\{bf9f04bb-c5eb-494c-9375-71bc1da463d8}: [DhcpNameServer] 209.18.47.62 209.18.47.61

Internet Explorer:

==================

HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page =

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL =

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL =

HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Local Page =

HKU\S-1-5-21-436150743-3596999183-3093125189-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://emachines.msn.com

SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://us.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wncy_pwrisofs_15_47&param1=1&param2=f%3D4%26b%3DIE%26cc%3Dus%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1QzutAtDyEyCzy0AtC0F0FyCtBtCyDtAyB0AtN0D0Tzu0StCyEtCyCtN1L2XzutAtFtCyDtFtAtFtBtN1L1Czu1BtBtN1L1G1B1V1N2Y1L1Qzu2SyC0AtC0ByEtByDyCtGtAtBzzyBtGtByDzztAtGyEtCtB0AtGzy0C0D0FtByD0BzzzytDyCtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0BtCzztA0F0EyC0FtGyEyBtDzytGyEtAtAtAtGzzzy0BzztGtD0CyEtCyBtA0F0CtCtB0A0D2QtN0A0LzuyE%26cr%3D1644942901%26a%3Dwncy_pwrisofs_15_47%26os%3DWindows%2B7%2BHome%2BPremium&p={searchTerms}

SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://us.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wncy_pwrisofs_15_47&param1=1&param2=f%3D4%26b%3DIE%26cc%3Dus%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1QzutAtDyEyCzy0AtC0F0FyCtBtCyDtAyB0AtN0D0Tzu0StCyEtCyCtN1L2XzutAtFtCyDtFtAtFtBtN1L1Czu1BtBtN1L1G1B1V1N2Y1L1Qzu2SyC0AtC0ByEtByDyCtGtAtBzzyBtGtByDzztAtGyEtCtB0AtGzy0C0D0FtByD0BzzzytDyCtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0BtCzztA0F0EyC0FtGyEyBtDzytGyEtAtAtAtGzzzy0BzztGtD0CyEtCyBtA0F0CtCtB0A0D2QtN0A0LzuyE%26cr%3D1644942901%26a%3Dwncy_pwrisofs_15_47%26os%3DWindows%2B7%2BHome%2BPremium&p={searchTerms}

SearchScopes: HKLM -> {2f23ab71-4ac6-41f2-a955-ea576e553146} URL = hxxp://www.bing.com/search?q={searchTerms}&form=AEMTDF&pc=MAEM&src=IE-SearchBox

SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=AEMTDF&pc=MAEM&src=IE-SearchBox

SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=AEMTDF&pc=MAEM&src=IE-SearchBox

SearchScopes: HKU\S-1-5-21-436150743-3596999183-3093125189-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://us.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wncy_pwrisofs_15_47&param1=1&param2=f%3D4%26b%3DIE%26cc%3Dus%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1QzutAtDyEyCzy0AtC0F0FyCtBtCyDtAyB0AtN0D0Tzu0StCyEtCyCtN1L2XzutAtFtCyDtFtAtFtBtN1L1Czu1BtBtN1L1G1B1V1N2Y1L1Qzu2SyC0AtC0ByEtByDyCtGtAtBzzyBtGtByDzztAtGyEtCtB0AtGzy0C0D0FtByD0BzzzytDyCtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0BtCzztA0F0EyC0FtGyEyBtDzytGyEtAtAtAtGzzzy0BzztGtD0CyEtCyBtA0F0CtCtB0A0D2QtN0A0LzuyE%26cr%3D1644942901%26a%3Dwncy_pwrisofs_15_47%26os%3DWindows%2B7%2BHome%2BPremium&p={searchTerms}

BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27] (Adobe Systems Incorporated)

FireFox:

========

FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_20_0_0_267.dll [2015-12-31] ()

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-12] ( Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_20_0_0_267.dll [2015-12-31] ()

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-12] ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2010-09-23] (Microsoft Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.30.3\npGoogleUpdate3.dll [2016-05-12] (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.30.3\npGoogleUpdate3.dll [2016-05-12] (Google Inc.)

Chrome:

=======

CHR Profile: C:\Users\ALLAH is UP\AppData\Local\Google\Chrome\User Data\Default

CHR Extension: (Google Slides) - C:\Users\ALLAH is UP\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-11-17]

CHR Extension: (Google Docs) - C:\Users\ALLAH is UP\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-11-17]

CHR Extension: (Google Drive) - C:\Users\ALLAH is UP\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-11-17]

CHR Extension: (YouTube) - C:\Users\ALLAH is UP\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-11-17]

CHR Extension: (Adblock Plus) - C:\Users\ALLAH is UP\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2016-06-28]

CHR Extension: (Google Search) - C:\Users\ALLAH is UP\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-11-17]

CHR Extension: (Google Sheets) - C:\Users\ALLAH is UP\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-11-17]

CHR Extension: (Google Docs Offline) - C:\Users\ALLAH is UP\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-03-31]

CHR Extension: (Hotspot Shield Free VPN Proxy – Unblock Sites) - C:\Users\ALLAH is UP\AppData\Local\Google\Chrome\User Data\Default\Extensions\heajfgnegopeedndeahkdjedjkjcmnpb [2016-06-07]

CHR Extension: (Online For Disconnect) - C:\Users\ALLAH is UP\AppData\Local\Google\Chrome\User Data\Default\Extensions\jkbbibfnbfeolainmnliccbfipijonao [2015-11-17]

CHR Extension: (Hotspot Shield Free VPN Proxy – Unblock Sites) - C:\Users\ALLAH is UP\AppData\Local\Google\Chrome\User Data\Default\Extensions\nlbejmccbhkncgokjcmghpfloaajcffj [2016-06-29]

CHR Extension: (Chrome Web Store Payments) - C:\Users\ALLAH is UP\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-04-09]

CHR Extension: (Gmail) - C:\Users\ALLAH is UP\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-11-17]

CHR Extension: (Ad.Block Plus) - C:\Users\ALLAH is UP\AppData\Local\Google\Chrome\User Data\Default\Extensions\ppokofpeodofmocjcgjamemiiddhjpbe [2015-11-17]

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 AvgAMPS; C:\Program Files (x86)\AVG\Av\avgamps.exe [636312 2016-06-09] (AVG Technologies CZ, s.r.o.)

R2 AVGIDSAgent; C:\Program Files (x86)\AVG\Av\avgidsagenta.exe [5165824 2016-06-09] (AVG Technologies CZ, s.r.o.)

R2 avgsvc; C:\Program Files (x86)\AVG\Framework\Common\avgsvca.exe [1080080 2016-06-21] (AVG Technologies CZ, s.r.o.)

R2 avgwd; C:\Program Files (x86)\AVG\Av\avgwdsvca.exe [705528 2016-06-09] (AVG Technologies CZ, s.r.o.)

S4 dbupdate; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [136048 2015-11-17] (Dropbox, Inc.)

S4 dbupdatem; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [136048 2015-11-17] (Dropbox, Inc.)

S3 NetcamStudioSvc64; C:\Program Files\Netcam Studio - 64-bit\NetcamStudio.Service.exe [4051264 2016-01-06] (Moonware Studios)

R2 NIHardwareService; C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe [5352960 2011-04-07] (Native Instruments GmbH) [File not signed]

S4 Updater Service; C:\Program Files\eMachines\eMachines Updater\UpdaterService.exe [243232 2010-01-28] (Acer Group)

S4 vncserver; C:\Program Files\RealVNC\VNC Server\vncserver.exe [5653736 2015-12-07] (RealVNC Ltd)

S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [364464 2015-10-30] (Microsoft Corporation)

S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [24864 2015-10-30] (Microsoft Corporation)

R2 WSWNA1100; C:\Program Files (x86)\NETGEAR\WNA1100\WifiSvc.exe [297440 2011-07-28] ()

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S0 Avgboota; C:\Windows\System32\DRIVERS\avgboota.sys [21632 2016-01-07] (AVG Technologies CZ, s.r.o.)

R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [162592 2016-02-16] (AVG Technologies CZ, s.r.o.)

R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [307456 2016-05-18] (AVG Technologies CZ, s.r.o.)

R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [272304 2016-01-26] (AVG Technologies CZ, s.r.o.)

R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [260352 2016-05-02] (AVG Technologies CZ, s.r.o.)

R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [360736 2016-02-16] (AVG Technologies CZ, s.r.o.)

R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [247040 2016-05-05] (AVG Technologies CZ, s.r.o.)

R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [51968 2016-05-02] (AVG Technologies CZ, s.r.o.)

R0 Avguniva; C:\Windows\System32\DRIVERS\avguniva.sys [71936 2016-05-05] (AVG Technologies CZ, s.r.o.)

R1 Avgwfpa; C:\Windows\system32\DRIVERS\avgwfpa.sys [315840 2015-12-16] (AVG Technologies CZ, s.r.o.)

S3 DGUSBAP; C:\Windows\system32\DRIVERS\dgmbx2.sys [194864 2011-02-13] (Avid Technology, Inc.)

R3 ManyCam; C:\Windows\system32\DRIVERS\mcvidrv.sys [49304 2014-12-28] (Visicom Media Inc.)

S3 MBX2DFU; C:\Windows\SYSTEM32\DRIVERS\dgmbx2fu.sys [32944 2011-02-13] (Avid Technology, Inc.)

R3 mcaudrv_simple; C:\Windows\system32\drivers\mcaudrv_x64.sys [35992 2014-12-28] (Visicom Media Inc.)

R3 rt640x64; C:\Windows\System32\drivers\rt640x64.sys [589824 2015-10-30] (Realtek )

S2 SecDrv; C:\WINDOWS\SysWOW64\drivers\SECDRV.SYS [12400 2016-01-28] (Macrovision Europe Ltd) [File not signed]

R3 VBAudioVMAUXVAIOMME; C:\Windows\system32\DRIVERS\vbaudio_vmauxvaio64_win7.sys [41192 2015-11-21] (Windows ® Win 7 DDK provider)

R3 VBAudioVMVAIOMME; C:\Windows\system32\DRIVERS\vbaudio_vmvaio64_win7.sys [41192 2015-11-21] (Windows ® Win 7 DDK provider)

S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [44568 2015-10-30] (Microsoft Corporation)

S3 WdFilter; C:\Windows\system32\drivers\WdFilter.sys [293216 2015-10-30] (Microsoft Corporation)

S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [118112 2015-10-30] (Microsoft Corporation)

U3 idsvc; no ImagePath

U3 swmidi; no ImagePath

U3 wpcsvc; no ImagePath

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-06-30 00:00 - 2016-06-30 00:01 - 00045425 _____ C:\Users\ALLAH is UP\Downloads\Addition.txt

2016-06-29 23:58 - 2016-06-30 23:52 - 00019882 _____ C:\Users\ALLAH is UP\Downloads\FRST.txt

2016-06-29 23:58 - 2016-06-30 23:52 - 00000000 ____D C:\FRST

2016-06-29 23:57 - 2016-06-29 23:57 - 02390016 _____ (Farbar) C:\Users\ALLAH is UP\Downloads\FRST64.exe

2016-06-29 23:10 - 2016-06-30 23:14 - 00000214 _____ C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job

2016-06-19 16:40 - 2016-06-19 16:40 - 00373965 _____ C:\Users\ALLAH is UP\Downloads\012714.pdf

2016-06-09 04:45 - 2016-06-09 04:45 - 00000382 _____ C:\WINDOWS\Tasks\AVG-SSU_0616avz.job

2016-06-09 04:45 - 2016-06-09 04:45 - 00000000 ____D C:\ProgramData\Avg_Update_0616avz

2016-06-07 03:17 - 2016-06-07 03:18 - 00281404 _____ C:\WINDOWS\Minidump\060716-52046-01.dmp

2016-06-07 03:17 - 2016-06-07 03:17 - 00000000 ____D C:\WINDOWS\Minidump

2016-06-07 03:14 - 2016-06-29 21:18 - 00171579 _____ C:\WINDOWS\system32\DICoInst64.bak

2016-06-07 03:13 - 2010-10-09 13:53 - 00170584 _____ (EGOSYS, Inc.) C:\WINDOWS\system32\DICoInst64.dll

2016-06-07 03:12 - 2016-06-07 03:12 - 00000000 ____D C:\Program Files (x86)\TASCAM

2016-06-07 03:12 - 2011-01-08 06:44 - 00103512 _____ C:\WINDOWS\SysWOW64\US800Asio32.dll

2016-06-07 03:11 - 2016-06-07 03:11 - 02722289 _____ C:\Users\ALLAH is UP\Downloads\us800_win_v1_0_8_20110107.zip

2016-06-06 22:18 - 2016-06-06 22:18 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dropbox

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-06-30 23:14 - 2015-10-30 00:24 - 00000000 ____D C:\WINDOWS\AppReadiness

2016-06-30 18:44 - 2015-11-07 16:42 - 00000000 ____D C:\ProgramData\MFAData

2016-06-30 16:50 - 2015-12-26 15:57 - 01009692 _____ C:\WINDOWS\system32\PerfStringBackup.INI

2016-06-30 16:50 - 2015-10-30 00:21 - 00000000 ____D C:\WINDOWS\INF

2016-06-30 16:49 - 2016-01-15 15:17 - 02407736 _____ C:\WINDOWS\ntbtlog.txt

2016-06-29 21:35 - 2015-10-30 00:24 - 00000000 ___HD C:\Program Files\WindowsApps

2016-06-29 21:19 - 2015-12-26 16:14 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT

2016-06-29 21:03 - 2015-12-26 15:58 - 00000000 ____D C:\Users\ALLAH is UP

2016-06-29 21:03 - 2015-10-29 23:28 - 00262144 ___SH C:\WINDOWS\system32\config\BBI

2016-06-29 13:53 - 2016-02-20 21:26 - 00000882 _____ C:\Users\Public\Desktop\AVG.lnk

2016-06-29 13:53 - 2015-11-07 16:42 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG Zen

2016-06-28 03:35 - 2015-10-29 23:28 - 00032768 ___SH C:\WINDOWS\system32\config\ELAM

2016-06-25 21:45 - 2015-11-17 18:08 - 00002281 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk

2016-06-25 21:42 - 2015-11-17 16:42 - 00000288 _____ C:\WINDOWS\Tasks\UpdateTask.job

2016-06-25 21:41 - 2015-11-17 17:10 - 00000914 _____ C:\WINDOWS\Tasks\DropboxUpdateTaskMachineCore.job

2016-06-25 21:41 - 2015-11-07 15:51 - 00000928 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job

2016-06-25 21:40 - 2015-12-05 10:44 - 00000830 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job

2016-06-23 04:36 - 2016-01-05 18:35 - 00000000 ____D C:\Users\ALLAH is UP\AppData\Local\RealVNC

2016-06-21 22:15 - 2015-11-17 17:10 - 00000918 _____ C:\WINDOWS\Tasks\DropboxUpdateTaskMachineUA.job

2016-06-21 22:05 - 2015-11-07 15:51 - 00000932 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job

2016-06-14 22:37 - 2015-11-07 16:44 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG

2016-06-14 21:47 - 2015-12-26 16:54 - 00002431 _____ C:\Users\ALLAH is UP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk

2016-06-14 21:47 - 2015-12-26 16:54 - 00000000 ___RD C:\Users\ALLAH is UP\OneDrive

2016-06-14 21:29 - 2016-03-29 13:21 - 00000000 ____D C:\Users\ALLAH is UP\AppData\Local\Windows Live

2016-06-07 03:37 - 2015-11-17 18:20 - 00000000 ____D C:\Users\ALLAH is UP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

2016-06-07 03:17 - 2015-12-26 15:51 - 00194224 _____ C:\WINDOWS\system32\FNTCACHE.DAT

2016-06-07 03:17 - 2015-11-20 12:17 - 327445488 _____ C:\WINDOWS\MEMORY.DMP

2016-06-06 22:18 - 2015-11-17 17:10 - 00000000 ____D C:\Program Files (x86)\Dropbox

==================== Files in the root of some directories =======

2015-11-21 03:20 - 2015-12-26 17:21 - 0031460 _____ () C:\Users\ALLAH is UP\AppData\Roaming\VoiceMeeterDefault.xml

Some files in TEMP:

====================

C:\Users\ALLAH is UP\AppData\Local\Temp\avguirn_081040707190.exe

C:\Users\ALLAH is UP\AppData\Local\Temp\avguirn_081193459123.exe

C:\Users\ALLAH is UP\AppData\Local\Temp\avguirn_081216923614.exe

C:\Users\ALLAH is UP\AppData\Local\Temp\avguirn_081449743922.exe

C:\Users\ALLAH is UP\AppData\Local\Temp\avguirn_081800841901.exe

C:\Users\ALLAH is UP\AppData\Local\Temp\avguirn_08872103858.exe

C:\Users\ALLAH is UP\AppData\Local\Temp\exeE981.tmp.exe

C:\Users\ALLAH is UP\AppData\Local\Temp\GLF23A9.tmp.exe

C:\Users\ALLAH is UP\AppData\Local\Temp\GLF9DA.tmp.exe

C:\Users\ALLAH is UP\AppData\Local\Temp\GLFCBFC.tmp.exe

C:\Users\ALLAH is UP\AppData\Local\Temp\GLFE1F3.tmp.exe

C:\Users\ALLAH is UP\AppData\Local\Temp\GLFE326.tmp.exe

==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\system32\winlogon.exe => File is digitally signed

C:\WINDOWS\system32\wininit.exe => File is digitally signed

C:\WINDOWS\explorer.exe => File is digitally signed

C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed

C:\WINDOWS\system32\svchost.exe => File is digitally signed

C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed

C:\WINDOWS\system32\services.exe => File is digitally signed

C:\WINDOWS\system32\User32.dll => File is digitally signed

C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed

C:\WINDOWS\system32\userinit.exe => File is digitally signed

C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed

C:\WINDOWS\system32\rpcss.dll => File is digitally signed

C:\WINDOWS\system32\dnsapi.dll => File is digitally signed

C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed

C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2016-06-13 22:17

==================== End of FRST.txt ============================

Now here is my addition.txt file:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 29-06-2016

Ran by ALLAH is UP (2016-06-30 00:00:46)

Running from C:\Users\ALLAH is UP\Downloads

Windows 10 Home Version 1511 (X64) (2015-12-26 23:26:51)

Boot Mode: Normal

==========================================================

==================== Accounts: =============================

Administrator (S-1-5-21-436150743-3596999183-3093125189-500 - Administrator - Disabled)

ALLAH is UP (S-1-5-21-436150743-3596999183-3093125189-1000 - Administrator - Enabled) => C:\Users\ALLAH is UP

DefaultAccount (S-1-5-21-436150743-3596999183-3093125189-503 - Limited - Disabled)

Guest (S-1-5-21-436150743-3596999183-3093125189-501 - Limited - Disabled)

HomeGroupUser$ (S-1-5-21-436150743-3596999183-3093125189-1002 - Limited - Enabled)

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AV: AVG AntiVirus Free Edition (Enabled - Up to date) {4D41356F-32AD-7C42-C820-63775EE4F413}

AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: AVG AntiVirus Free Edition (Enabled - Up to date) {F620D48B-1497-73CC-F290-58052563BEAE}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Ableton Live 9 Suite (HKLM\...\{F6238EAB-3AD7-4B0E-B0AD-E533A93A5C32}) (Version: 9.0.0.0 - Ableton)

Acrobat.com (HKLM-x32\...\{287ECFA4-719A-2143-A09B-D6A12DE54E40}) (Version: 1.6.65 - Adobe Systems Incorporated)

Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 2.0.2.12610 - Adobe Systems Inc.)

Adobe Flash Player 20 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 20.0.0.267 - Adobe Systems Incorporated)

Adobe Reader 9.1 MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-A91000000001}) (Version: 9.1.0 - Adobe Systems Incorporated)

Advertising Center (x32 Version: 0.0.0.2 - Nero AG) Hidden

Antares Tube v1.0 (HKLM-x32\...\Antares Tube v1.0) (Version: - )

Arturia CS-80V v1.2 (HKLM-x32\...\Arturia CS-80V v1.2) (Version: - )

Arturia Minimoog V v1.0 (HKLM-x32\...\Arturia Minimoog V v1.0) (Version: - )

ASIO4ALL (HKLM-x32\...\ASIO4ALL) (Version: 2.12 - Michael Tippach)

AVG (HKLM\...\AvgZen) (Version: 1.72.2.24716 - AVG Technologies)

AVG (Version: 16.81.7640 - AVG Technologies) Hidden

AVG 2016 (Version: 16.0.4613 - AVG Technologies) Hidden

AVG Protection (HKLM\...\AVG) (Version: 2016.81.7640 - AVG Technologies)

AVG Zen (Version: 1.72.1 - AVG Technologies) Hidden

Avid Mbox 2 USB Drivers (x64) (HKLM\...\{F9242D4E-09E7-45C7-A53A-83375D0FAD42}) (Version: 9.0.2 - Avid Technology, Inc.)

BassGrinder version 1.0.4 (HKLM\...\BassGrinder_is1) (Version: 1.0.4 - )

Cakewalk Rapture 1.2 (HKLM\...\Cakewalk Rapture_is1) (Version: 1.2 - Cakewalk Music Software)

CANTOR 2 (HKLM-x32\...\{0EF0223B-1EE2-4D79-8668-9E1FE7E23C50}) (Version: 2.0.0 - VirSyn Software Synthesizer)

Classic Drum Machines Volume 1.0 (HKLM-x32\...\Classic Drum Machines Expansion Pack_is1) (Version: - Arturia)

Command & Conquer Generals (HKLM-x32\...\InstallShield_{06F80017-8F98-4C94-B868-52358569FC32}) (Version: 0.50.0000 - Electronic Arts)

Command & Conquer Generals (x32 Version: 0.50.0000 - Electronic Arts) Hidden

Command and ConquerTM Generals Zero Hour (HKLM-x32\...\InstallShield_{F3E9C243-122E-4D6B-ACC1-E1FEC02F6CA1}) (Version: 1.00.0000 - Electronic Arts)

Command and ConquerTM Generals Zero Hour (x32 Version: 1.00.0000 - Electronic Arts) Hidden

CUBE 2 (HKLM-x32\...\CUBE 2) (Version: 2.2 - VirSyn Software Synthesizer)

D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden

Dropbox (HKLM-x32\...\Dropbox) (Version: 4.4.29 - Dropbox, Inc.)

Dropbox Update Helper (x32 Version: 1.3.27.37 - Dropbox, Inc.) Hidden

DUNE 1.35 (HKLM-x32\...\DUNE_is1) (Version: - Synapse Audio Software)

DVM_IPCam2Setup version 1.0 (HKLM-x32\...\{679D432E-006C-4371-B190-884997A55280}_is1) (Version: 1.0 - ipcam)

eMachines Recovery Management (HKLM-x32\...\{7F811A54-5A09-4579-90E1-C93498E230D9}) (Version: 4.05.3013 - Acer Incorporated)

eMachines Registration (HKLM-x32\...\eMachines Registration) (Version: 1.03.3003 - Acer Incorporated)

eMachines ScreenSaver (HKLM-x32\...\eMachines Screensaver) (Version: 1.1.0825.2010 - Acer Incorporated)

eMachines Updater (HKLM-x32\...\{EE171732-BEB4-4576-887D-CB62727F01CA}) (Version: 1.02.3001 - Acer Incorporated)

Fiddler (HKLM-x32\...\Fiddler2) (Version: 2.6.2.0 - Telerik)

FL Studio 11 (HKLM-x32\...\FL Studio 11) (Version: - Image-Line)

FL Studio 12 (HKLM-x32\...\FL Studio 12) (Version: - Image-Line)

FL Studio ASIO (HKLM-x32\...\FL Studio ASIO) (Version: - Image-Line)

FlowStone FL 3.0 (HKLM-x32\...\FlowStone) (Version: - )

FMW 1 (Version: 1.102.4 - AVG Technologies) Hidden

FXpansion Bloom (HKU\S-1-5-21-436150743-3596999183-3093125189-1000\...\FXpansion Bloom) (Version: 1.0.0.5 - FXpansion Audio UK Ltd)

FXpansion Etch (HKU\S-1-5-21-436150743-3596999183-3093125189-1000\...\FXpansion Etch) (Version: 1.0.0.6 - FXpansion Audio UK Ltd)

FXpansion Maul (HKU\S-1-5-21-436150743-3596999183-3093125189-1000\...\FXpansion Maul) (Version: 1.0.1.2 - FXpansion Audio UK Ltd)

FXpansion Tremor (HKU\S-1-5-21-436150743-3596999183-3093125189-1000\...\FXpansion Tremor) (Version: 1.0.0.6 - FXpansion Audio UK Ltd)

Gladiator full (HKLM-x32\...\Tone2 Gladiator full_is1) (Version: - Tone2)

Google Chrome (HKLM-x32\...\Google Chrome) (Version: 51.0.2704.103 - Google Inc.)

Google Update Helper (x32 Version: 1.3.30.3 - Google Inc.) Hidden

Hotkey Utility (HKLM-x32\...\Hotkey Utility) (Version: 2.05.3009 - Acer Incorporated)

Identity Card (HKLM-x32\...\Identity Card) (Version: 1.00.3003 - Acer Incorporated)

IL Download Manager (HKLM-x32\...\IL Download Manager) (Version: - Image-Line)

IL Harmor (HKLM-x32\...\IL Harmor) (Version: - Image-Line)

IL Minihost Modular (HKLM-x32\...\IL Minihost Modular) (Version: - Image-Line)

IL Shared Libraries (HKLM-x32\...\IL Shared Libraries) (Version: - Image-Line)

IL Slicex (HKLM-x32\...\IL Slicex) (Version: - Image-Line)

IL Vocodex (HKLM-x32\...\IL Vocodex) (Version: - Image-Line)

ImagXpress (x32 Version: 7.0.74.0 - Nero AG) Hidden

Intel® C++ Redistributables on Intel® 64 (HKLM-x32\...\{5D9EB565-39CB-4C8E-BF3B-CB8880A61404}) (Version: 12.1.258 - Intel Corporation)

Intel® Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.0.1006 - Intel Corporation)

Intel® Graphics Media Accelerator Driver (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.1968 - Intel Corporation)

Interlok driver setup x64 (HKLM\...\{25613C10-27D2-410B-942B-D922D5C3A7BE}) (Version: 5.9.0 - PACE Anti-Piracy, Inc.)

IPCMonitor_en version 1.0.1.7 (HKLM-x32\...\{8EC13308-5065-43FA-A5E8-E225F18DAB89}_is1) (Version: 1.0.1.7 - IPCMonitor, Inc.)

iSpy (64 bit) (HKLM\...\{37E90B7A-5567-4369-8281-3753B490B04C}) (Version: 6.5.0.0 - DeveloperInABox)

iSpy package installer (64 bit) (HKLM-x32\...\{193e83ec-4ab5-44dc-9d86-fe858f8521ff}) (Version: 6.5.0.0 - DeveloperInABox)

Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Kinisis 1.0 (HKLM-x32\...\{AF68E62A-159C-4B08-97D1-101303A4857A}_is1) (Version: - Progress Audio)

Lennar Digital Sylenth VSTi v1.2.1 (HKLM-x32\...\Lennar Digital Sylenth VSTi v1.2.1) (Version: - )

LUXONIX Ravity(S) v1.4 (HKLM-x32\...\LUXONIX Ravity(S) v1.4) (Version: - )

ManyCam 5.1.0 (HKLM-x32\...\ManyCam) (Version: 5.1.0 - Visicom Media Inc.)

M-Audio Drum and Bass Rig 1.0.0 (HKLM-x32\...\M-Audio Drum and Bass Rig_is1) (Version: - M-Audio. A part of Avid.)

M-Audio Key Rig 1.0.0 (HKLM-x32\...\M-Audio Key Rig_is1) (Version: - M-Audio. A part of Avid.)

Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden

Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.41212.0 - Microsoft Corporation)

Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)

MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)

Native Instruments Absynth 4 (HKLM-x32\...\Native Instruments Absynth 4) (Version: - )

Native Instruments Controller Editor (HKLM-x32\...\Native Instruments Controller Editor) (Version: - Native Instruments)

Native Instruments FM8 v1.0.1.002 VSTi DXi RTAS (HKLM-x32\...\Native Instruments FM8 v1.0.1.002 VSTi DXi RTAS) (Version: - )

Native Instruments Guitar Rig 5 (HKLM-x32\...\Native Instruments Guitar Rig 5) (Version: - Native Instruments)

Native Instruments Pro-53 (HKLM-x32\...\Native Instruments Pro-53) (Version: - )

Native Instruments Service Center (HKLM-x32\...\Native Instruments Service Center) (Version: - Native Instruments)

Nero 9 Essentials (HKLM-x32\...\{cab2e8d7-08e4-42d2-a676-ddf729a26522}) (Version: - Nero AG)

Netcam Studio - 64-bit (HKLM\...\Netcam Studio - 64-bit 1.2.8.0) (Version: 1.2.8.0 - Moonware)

Netcam Studio - 64-bit (Version: 1.2.8.0 - Moonware) Hidden

NETGEAR WNA1100 N150 Wireless USB Adapter (HKLM-x32\...\{A2AE9709-283B-4B48-AA34-729C070A62FB}) (Version: 1.0.0.133 - NETGEAR)

Nuklear VST2 1.1.2 (HKLM-x32\...\Nuklear VST2) (Version: 1.1.2 - Hamburg Audio)

Paltalk Messenger 11.7 (HKLM-x32\...\Paltalk Messenger) (Version: 11.7.630.17743 - AVM Software Inc.)

PowerISO (HKLM-x32\...\PowerISO) (Version: 6.4 - Power Software Ltd)

Proteus VX (HKLM-x32\...\Proteus VX) (Version: - )

Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5972 - Realtek Semiconductor Corp.)

reFX Nexus VSTi RTAS v2.2.0 (HKLM-x32\...\reFX Nexus_is1) (Version: - )

Renoise 2.8.0 (HKLM-x32\...\Renoise_is1) (Version: 2.8.0 - Renoise)

Renoise 2.8.0 (x64) (HKLM\...\Renoise (x64)_is1) (Version: 2.8.0 - Renoise)

Rob Papen Punch 64 Bits 1.0.3 (HKLM-x32\...\Rob Papen Punch_is1) (Version: - Rob Papen)

Sonic Charge Synplant VST (HKLM-x32\...\Sonic Charge Synplant VST) (Version: 1.0 - NuEdge Development)

Sound-Record Waspy LE VSTi 1.3 (HKLM-x32\...\{F70701D1-C08C-4FFD-9324-870DD65BB829}_is1) (Version: - Sound-record LP)

Sugar Bytes Turnado 1.0.1 (HKLM\...\Turnado_is1) (Version: 1.0.1 - Sugar Bytes)

SynthMaster 2.6 VST/VSTi/RTAS/AAX Software Synthesizer version 2.6.21 (HKLM-x32\...\{724D6BD0-88D0-4354-A124-6EE4D36E9EF2}_is1) (Version: 2.6.21 - KV331 Audio)

TrancerOne Vers. 1.0 (HKLM-x32\...\TrancerOne_is1) (Version: - sonic at work)

US800 Audio Driver (HKLM-x32\...\US800 Audio Driver Setup) (Version: - )

VB:VST-Chorus Pack (HKLM-x32\...\VB:VST-Chorus Pack) (Version: - )

VirSyn BARK VST RTAS v1.1.0 (HKLM-x32\...\VirSyn BARK VST RTAS_is1) (Version: - )

VirSyn FDELAY VST RTAS v1.0.1 (HKLM-x32\...\VirSyn FDELAY VST RTAS_is1) (Version: - )

VirSyn KLON VST RTAS v1.0.2 (HKLM-x32\...\VirSyn KLON VST RTAS_is1) (Version: - )

VirSyn MATRIX VST RTAS v1.2.1 (HKLM-x32\...\VirSyn MATRIX VST RTAS_is1) (Version: - )

VirSyn PRISM VST RTAS v1.1.0 (HKLM-x32\...\VirSyn PRISM VST RTAS_is1) (Version: - )

Virsyn REFLECT VST RTAS v2.0 (HKLM-x32\...\Virsyn REFLECT VST RTAS_is1) (Version: - )

VirSyn TDESIGN VST RTAS v1.0.1 (HKLM-x32\...\VirSyn TDESIGN VST RTAS_is1) (Version: - )

Virsyn Tera VSTi RTAS v3.2.1 (HKLM-x32\...\Virsyn Tera VSTi RTAS_is1) (Version: - )

Visual Studio 2012 x64 Redistributables (HKLM\...\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)

Visual Studio 2012 x86 Redistributables (HKLM-x32\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)

VNC Server 5.3.0 (HKLM\...\{9FC6D0C1-137D-4A03-9345-ACB9403BFF69}) (Version: 5.3.0.15303 - RealVNC Ltd)

Voicemeeter, The Virtual Mixing Console (HKLM-x32\...\VB:Voicemeeter {17359A74-1236-5467}) (Version: - VB-Audio Software)

Waves Mercury Bundle (HKLM-x32\...\Waves Mercury Bundle) (Version: 5.0 - Team AiR)

Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3502.0922 - Microsoft Corporation)

Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation)

WinRAR 5.30 beta 6 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.30.6 - win.rar GmbH)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-436150743-3596999183-3093125189-1000_Classes\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\localserver32 -> C:\Users\ALLAH is UP\AppData\Local\Microsoft\OneDrive\17.3.6390.0509\FileCoAuth.exe (Microsoft Corporation)

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {00BAB6D9-A0A6-465A-BD4C-7B1EC4BF379A} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW2 => C:\Windows\ehome\ehPrivJob.exe

Task: {032DD79D-00A2-47E0-AB99-A38964AB69D1} - System32\Tasks\Microsoft\Windows\Media Center\ehDRMInit => C:\Windows\ehome\ehPrivJob.exe

Task: {13EF6CAE-E265-4AC9-ACAD-26EFBC5E2F2D} - System32\Tasks\Microsoft\Windows\Media Center\MediaCenterRecoveryTask => C:\Windows\ehome\mcupdate.exe

Task: {1627A9A6-4C16-4B12-B16C-2A1973FD59B8} - System32\Tasks\Microsoft\Windows\Media Center\UpdateRecordPath => C:\Windows\ehome\ehPrivJob.exe

Task: {182E8B15-4510-41F8-A276-9D9599B1211B} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate => C:\Windows\ehome\mcupdate.exe

Task: {36DF9638-DB98-4A32-9ED4-A9AE508657F3} - System32\Tasks\Microsoft\Windows\Media Center\OCURActivate => C:\Windows\ehome\ehPrivJob.exe

Task: {37BC2206-1C22-4606-9C9A-284A30310CC0} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscovery => C:\Windows\ehome\ehPrivJob.exe

Task: {3E20E961-4179-43D5-B714-C2C48CE28561} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW1 => C:\Windows\ehome\ehPrivJob.exe

Task: {40452E42-A835-4799-963D-DB6424B6DC50} - System32\Tasks\Microsoft\Windows\Media Center\PeriodicScanRetry => C:\Windows\ehome\MCUpdate.exe

Task: {41F978BC-C37E-4A7B-8C40-C3FA4BD17399} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> No File <==== ATTENTION

Task: {53237B23-D28D-4B8C-924E-CA0B311760B8} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> No File <==== ATTENTION

Task: {5E2187CA-9592-489F-84E1-CD350D24A7DC} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> No File <==== ATTENTION

Task: {5EE36781-6DCC-4124-BCE1-90A6B6AFDA73} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> No File <==== ATTENTION

Task: {60083070-0A6F-4686-87EB-9C4B6683E825} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> No File <==== ATTENTION

Task: {65118348-E7BF-4E88-9EEE-345FFF211258} - System32\Tasks\Microsoft\Windows\Media Center\DispatchRecoveryTasks => C:\Windows\ehome\ehPrivJob.exe

Task: {668C29BA-D8A6-4C0C-BB82-8A846B27EC91} - System32\Tasks\Microsoft\Windows\Media Center\PvrRecoveryTask => C:\Windows\ehome\mcupdate.exe

Task: {68A88857-F640-429A-9C37-5FAE8FE97CF7} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION

Task: {705F8C4B-EC21-4583-97B9-E6E8B1F18C93} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> No File <==== ATTENTION

Task: {72088B4C-BBAF-4864-AA18-D79547098113} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate_scheduled => C:\Windows\ehome\mcupdate.exe

Task: {7F42C90B-C60E-4D14-928F-61A371AA7F03} - System32\Tasks\Microsoft\Windows\Media Center\ReindexSearchRoot => C:\Windows\ehome\ehPrivJob.exe

Task: {8029F1C5-42F0-4517-94D0-4295D82A01A5} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-11-07] (Google Inc.)

Task: {83D52F0A-96DD-491F-8E11-EA82944FD331} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> No File <==== ATTENTION

Task: {8D23957D-4101-48AC-9EEC-39C8A8EF6BFA} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-11-07] (Google Inc.)

Task: {8F0B319B-A8D6-43A2-8B22-7DD90B0D1832} - System32\Tasks\UpdateTask => C:\Users\ALLAHI~1\AppData\Local\{E7AED~1\UNINST~1.EXE

Task: {96270EF1-40A2-4CEC-8893-95FC6FFFBCD9} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTION

Task: {9C28E0CF-CE14-40AA-98FC-696A79020483} - System32\Tasks\Microsoft\Windows\Media Center\RecordingRestart => C:\Windows\ehome\ehrec.exe

Task: {A11794F4-2AB1-4AC7-B3AA-85C43188C2BA} - System32\Tasks\{0CEB6DD2-248A-417C-91F9-86341DB79200} => pcalua.exe -a "C:\Program Files (x86)\EA Games\Command & Conquer Generals Zero Hour\generals.exe"

Task: {A1685AA1-1B80-404B-A64D-EF9D58C0FF93} - System32\Tasks\Microsoft\Windows\Media Center\ActivateWindowsSearch => C:\Windows\ehome\ehPrivJob.exe

Task: {B1770283-B4AE-4522-9313-306CA929BD71} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> No File <==== ATTENTION

Task: {B8B04FD5-FDC7-45C6-81D6-426906A5B546} - System32\Tasks\Microsoft\Windows\Media Center\InstallPlayReady => C:\Windows\ehome\ehPrivJob.exe

Task: {BC13C75D-5921-4A93-B057-FC90CD12FC5E} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2016-05-16] (Microsoft Corporation)

Task: {BCC56878-F97A-45D0-A7D0-8850F5540190} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-12-31] (Adobe Systems Incorporated)

Task: {BCCD5116-D114-477C-B8A3-FF45DEB36CBD} - System32\Tasks\DropboxUpdateTaskMachineUA => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [2015-11-17] (Dropbox, Inc.)

Task: {C141AF1E-C25A-4DA4-BC58-1D3700300340} - System32\Tasks\Microsoft\Windows\Media Center\ObjectStoreRecoveryTask => C:\Windows\ehome\mcupdate.exe

Task: {C56695FB-0A89-4161-8CFC-01DF8E0A8302} - System32\Tasks\Microsoft\Windows\Media Center\RegisterSearch => C:\Windows\ehome\ehPrivJob.exe

Task: {C7B182A5-5AA5-4217-A5DE-D5989A8131EF} - System32\Tasks\Microsoft\Windows\Media Center\PvrScheduleTask => C:\Windows\ehome\mcupdate.exe

Task: {CC5B583C-4F75-49F6-A761-8E7AFAF613A6} - System32\Tasks\Microsoft\Windows\Media Center\SqlLiteRecoveryTask => C:\Windows\ehome\mcupdate.exe

Task: {DAF71117-E345-4907-87F6-FBC506D7D401} - System32\Tasks\DropboxUpdateTaskMachineCore => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [2015-11-17] (Dropbox, Inc.)

Task: {EEC6334F-6E8C-47FC-A59E-E7ABF61F34EE} - System32\Tasks\Microsoft\Windows\Media Center\ConfigureInternetTimeService => C:\Windows\ehome\ehPrivJob.exe

Task: {F9D27511-78F7-4B62-8AC7-FE4239A60466} - System32\Tasks\Microsoft\Windows\Media Center\OCURDiscovery => C:\Windows\ehome\ehPrivJob.exe

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\WINDOWS\Tasks\AVG-SSU_0616avz.job => C:\ProgramData\Avg_Update_0616avz\AVG-Secure-Search-Update_0616avz.exe

Task: C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job => C:\WINDOWS\explorer.exe

Task: C:\WINDOWS\Tasks\DropboxUpdateTaskMachineCore.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe

Task: C:\WINDOWS\Tasks\DropboxUpdateTaskMachineUA.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe

Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\WINDOWS\Tasks\UpdateTask.job => C:\Users\ALLAHI~1\AppData\Local\{E7AED~1\UNINST~1.EXE

==================== Shortcuts =============================

(The entries could be listed to be restored or removed.)

Shortcut: C:\Users\ALLAH is UP\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Upgrade to Paltalk Extreme.lnk -> hxxp://www.paltalk.com/en/buy.shtml (No File)

==================== Loaded Modules (Whitelisted) ==============

2015-10-30 00:18 - 2015-10-30 00:18 - 00185856 _____ () C:\WINDOWS\SYSTEM32\ism32k.dll

2015-11-07 15:42 - 2011-07-28 18:06 - 00297440 _____ () C:\Program Files (x86)\NETGEAR\WNA1100\WifiSvc.exe

2016-04-29 17:39 - 2016-03-29 03:20 - 02656952 _____ () C:\WINDOWS\system32\CoreUIComponents.dll

2015-11-07 15:42 - 2011-07-28 18:06 - 08247264 _____ () C:\Program Files (x86)\NETGEAR\WNA1100\WNA1100.exe

2010-08-04 05:40 - 2010-08-04 05:40 - 00611872 _____ () C:\Program Files (x86)\eMachines\Hotkey Utility\HotkeyUtility.exe

2015-12-26 15:46 - 2015-12-26 15:46 - 00093696 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\Windows.UI.Shell.SharedUtilities.dll

2016-05-12 19:16 - 2016-04-22 21:25 - 00472064 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\QuickActions.dll

2016-06-14 21:47 - 2016-06-14 21:47 - 00959168 _____ () C:\Users\ALLAH is UP\AppData\Local\Microsoft\OneDrive\17.3.6390.0509\amd64\ClientTelemetry.dll

2015-11-07 15:42 - 2011-07-27 12:53 - 00360448 _____ () C:\Program Files (x86)\NETGEAR\WNA1100\WifiLib.dll

2015-11-07 15:42 - 2009-08-28 17:50 - 00282624 _____ () C:\Program Files (x86)\NETGEAR\WNA1100\WifiSvcLib.dll

2010-08-04 02:47 - 2010-08-04 02:47 - 00144896 _____ () C:\Program Files (x86)\eMachines\Hotkey Utility\HotkeyHook.dll

2015-11-07 16:41 - 2016-04-09 18:12 - 40500224 _____ () C:\Program Files (x86)\AVG\UiDll\2171\libcef.dll

2016-06-25 21:45 - 2016-06-15 02:15 - 01745560 _____ () C:\Program Files (x86)\Google\Chrome\Application\51.0.2704.103\libglesv2.dll

2016-06-25 21:45 - 2016-06-15 02:15 - 00091288 _____ () C:\Program Files (x86)\Google\Chrome\Application\51.0.2704.103\libegl.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)

==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-13 19:34 - 2009-06-10 14:00 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-436150743-3596999183-3093125189-1000\Control Panel\Desktop\\Wallpaper -> c:\windows\web\wallpaper\theme1\img13.jpg

DNS Servers: 209.18.47.62 - 209.18.47.61

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)

Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\Services: AdobeFlashPlayerUpdateSvc => 3

MSCONFIG\Services: dbupdate => 2

MSCONFIG\Services: dbupdatem => 3

MSCONFIG\Services: gupdate => 2

MSCONFIG\Services: gupdatem => 3

MSCONFIG\Services: jswpsapi => 3

MSCONFIG\Services: Nero BackItUp Scheduler 4.0 => 3

MSCONFIG\Services: Updater Service => 2

MSCONFIG\Services: vncserver => 3

HKLM\...\StartupApproved\Run: => "Persistence"

HKLM\...\StartupApproved\Run: => "IgfxTray"

HKLM\...\StartupApproved\Run32: => "Adobe Reader Speed Launcher"

HKLM\...\StartupApproved\Run32: => "Dropbox"

HKLM\...\StartupApproved\Run32: => "jswtrayutil"

HKLM\...\StartupApproved\Run32: => "PWRISOVM.EXE"

HKU\S-1-5-21-436150743-3596999183-3093125189-1000\...\StartupApproved\StartupFolder: => "PalTalk.lnk"

HKU\S-1-5-21-436150743-3596999183-3093125189-1000\...\StartupApproved\Run: => "OneDrive"

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139

FirewallRules: [MSMQ-In-TCP] => (Allow) %systemroot%\system32\mqsvc.exe

FirewallRules: [MSMQ-Out-TCP] => (Allow) %systemroot%\system32\mqsvc.exe

FirewallRules: [MSMQ-In-UDP] => (Allow) %systemroot%\system32\mqsvc.exe

FirewallRules: [MSMQ-Out-UDP] => (Allow) %systemroot%\system32\mqsvc.exe

FirewallRules: [WCF-NetTcpActivator-In-TCP-64bit] => (Allow) LPort=808

FirewallRules: [UDP Query User{A619B1A5-A60C-4665-AE70-876ED719E989}C:\program files (x86)\paltalk messenger\paltalk.exe] => (Allow) C:\program files (x86)\paltalk messenger\paltalk.exe

FirewallRules: [TCP Query User{52EF8013-FA6E-4726-9AA6-7C7D86723481}C:\program files (x86)\paltalk messenger\paltalk.exe] => (Allow) C:\program files (x86)\paltalk messenger\paltalk.exe

FirewallRules: [UDP Query User{B6FF4486-8D56-4460-8C48-15E1E57BC8DD}C:\program files (x86)\image-line\minihost\minihostmodular.exe] => (Allow) C:\program files (x86)\image-line\minihost\minihostmodular.exe

FirewallRules: [TCP Query User{721A12D3-2953-4CA3-8B25-CE3F93242221}C:\program files (x86)\image-line\minihost\minihostmodular.exe] => (Allow) C:\program files (x86)\image-line\minihost\minihostmodular.exe

FirewallRules: [UDP Query User{0D3B9296-4EFF-44EA-A425-122B50F498CD}C:\program files (x86)\vb\voicemeeter\voicemeeter.exe] => (Allow) C:\program files (x86)\vb\voicemeeter\voicemeeter.exe

FirewallRules: [TCP Query User{5113E71B-0CC9-400B-8223-1459F81C5945}C:\program files (x86)\vb\voicemeeter\voicemeeter.exe] => (Allow) C:\program files (x86)\vb\voicemeeter\voicemeeter.exe

FirewallRules: [UDP Query User{197DF1DE-9F04-4F42-98CC-74230AA4A7EE}C:\program files (x86)\image-line\minihost\minihostmodular_x64.exe] => (Allow) C:\program files (x86)\image-line\minihost\minihostmodular_x64.exe

FirewallRules: [TCP Query User{2B2E1E0B-4AAA-465F-B329-E2AEC486E8C1}C:\program files (x86)\image-line\minihost\minihostmodular_x64.exe] => (Allow) C:\program files (x86)\image-line\minihost\minihostmodular_x64.exe

FirewallRules: [UDP Query User{542C93DF-3ECD-4576-90AA-932A87280F3B}C:\program files (x86)\image-line\fl studio 12\system\tools\bridge\32bit\ilbridge.exe] => (Allow) C:\program files (x86)\image-line\fl studio 12\system\tools\bridge\32bit\ilbridge.exe

FirewallRules: [TCP Query User{A0CED2DA-FD83-4969-9514-3F613649F3B9}C:\program files (x86)\image-line\fl studio 12\system\tools\bridge\32bit\ilbridge.exe] => (Allow) C:\program files (x86)\image-line\fl studio 12\system\tools\bridge\32bit\ilbridge.exe

FirewallRules: [{AA75ED7A-9EA1-4663-AB88-617C8BD91061}] => (Allow) C:\Users\ALLAH is UP\AppData\Local\Chromium\Application\chrome.exe

FirewallRules: [UDP Query User{D45F929C-AE82-49F9-8D96-D01379D9C778}C:\program files (x86)\ea games\command & conquer generals zero hour\game.dat] => (Allow) C:\program files (x86)\ea games\command & conquer generals zero hour\game.dat

FirewallRules: [TCP Query User{66E23A53-2F2A-4879-9D70-EE59D953A10D}C:\program files (x86)\ea games\command & conquer generals zero hour\game.dat] => (Allow) C:\program files (x86)\ea games\command & conquer generals zero hour\game.dat

FirewallRules: [{D6BC31A1-2F40-47A4-BDF2-399AB349AD74}] => (Allow) C:\Program Files (x86)\AVG\Av\avgmfapx.exe

FirewallRules: [{9B4FA300-A6A8-451B-99A4-31FE24DC6A3F}] => (Allow) C:\Program Files (x86)\AVG\Av\avgmfapx.exe

FirewallRules: [{E21626DD-B54B-41D2-AD72-62020D36F75F}] => (Allow) C:\Program Files (x86)\Windows Live\Mesh\MOE.exe

FirewallRules: [{888096E0-4E13-4EB8-8911-1AB9001B6707}] => (Allow) C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe

FirewallRules: [{E335A964-D45C-4881-988A-0B2230E9B392}] => (Allow) LPort=1900

FirewallRules: [{F6FD8472-D00E-498B-A807-A1C427D88395}] => (Allow) LPort=2869

FirewallRules: [{BF74D15D-4FFE-42CE-8324-8325A9C5A2BE}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe

FirewallRules: [{A6389C21-A9F4-4F3F-A73F-E9132448BFE8}] => (Allow) C:\Program Files\RealVNC\VNC Server\vncserver.exe

FirewallRules: [{25251CBC-53F2-424E-9241-761DD34B76EA}] => (Allow) C:\Program Files\RealVNC\VNC Server\vncserver.exe

FirewallRules: [TCP Query User{B0BBE7D0-8018-47F5-9240-DBA0762B25ED}C:\program files\ispy\ispy.exe] => (Allow) C:\program files\ispy\ispy.exe

FirewallRules: [UDP Query User{C5061046-C0DA-4C37-89F2-53531A1C4954}C:\program files\ispy\ispy.exe] => (Allow) C:\program files\ispy\ispy.exe

FirewallRules: [{2271153B-757F-46F0-85EF-9FC00A3C9F6F}] => (Allow) C:\Program Files\Netcam Studio - 64-bit\NetcamStudio.Service.exe

FirewallRules: [{674048E0-F7B9-4F1A-9300-D71F7C3932D9}] => (Allow) LPort=8100

FirewallRules: [{1DD68E7D-CB0A-4BC3-A7C0-8241E559305C}] => (Allow) LPort=8124

FirewallRules: [{A9407BB6-5771-4288-8743-B3A57CF48E22}] => (Allow) C:\Program Files\Netcam Studio - 64-bit\NetcamStudioX.exe

FirewallRules: [TCP Query User{438BA469-68A5-4154-934E-B63CCE11C652}C:\program files\ispy\ispy.exe] => (Block) C:\program files\ispy\ispy.exe

FirewallRules: [UDP Query User{E441CEB6-B97B-4920-BA0F-A7C2933E6A9E}C:\program files\ispy\ispy.exe] => (Block) C:\program files\ispy\ispy.exe

FirewallRules: [TCP Query User{61719147-7A2F-436D-8119-17B18076186B}D:\bsearch_en.exe] => (Allow) D:\bsearch_en.exe

FirewallRules: [UDP Query User{6457032E-3C2A-4779-B3E9-19E70527A82A}D:\bsearch_en.exe] => (Allow) D:\bsearch_en.exe

FirewallRules: [{45566F61-67EC-4589-93CD-F1F9569E98B1}] => (Allow) C:\Program Files (x86)\IPCMonitor_en\IPCMonitor.exe

FirewallRules: [{48478AE8-D1E2-4EE6-9992-A75BB2DC82EF}] => (Allow) C:\Program Files (x86)\IPCMonitor_en\IPCMonitor.exe

FirewallRules: [{EECB82CB-D691-4DEC-BAD5-EA0C953A0895}] => (Allow) C:\Program Files (x86)\IPCMonitor_en\IPCMonitor.exe

FirewallRules: [{5D7ADA48-73A1-451E-99A7-C12F0192AB02}] => (Allow) C:\Program Files (x86)\IPCMonitor_en\IPCMonitor.exe

FirewallRules: [TCP Query User{FAF4B238-7BCA-4DC4-A168-659DF53ABEB8}C:\program files (x86)\ipcmonitor_en\nvrplay.exe] => (Allow) C:\program files (x86)\ipcmonitor_en\nvrplay.exe

FirewallRules: [UDP Query User{6965B0C2-D1B8-42B6-8379-531073AF302C}C:\program files (x86)\ipcmonitor_en\nvrplay.exe] => (Allow) C:\program files (x86)\ipcmonitor_en\nvrplay.exe

FirewallRules: [TCP Query User{6B3FA95E-68F5-4AC7-A7B4-0080C2C9FBD9}C:\users\allah is up\desktop\bsearch_en.exe] => (Allow) C:\users\allah is up\desktop\bsearch_en.exe

FirewallRules: [UDP Query User{10F2E3A4-DEE0-43F2-A80F-639DFBC7456F}C:\users\allah is up\desktop\bsearch_en.exe] => (Allow) C:\users\allah is up\desktop\bsearch_en.exe

FirewallRules: [TCP Query User{9C84A8F9-6CEA-41A9-A2AD-C414E6A36CF9}C:\users\allah is up\desktop\bsearch_en.exe] => (Block) C:\users\allah is up\desktop\bsearch_en.exe

FirewallRules: [UDP Query User{7AD9DE2C-CA54-4397-9B26-3BE7B37DE3AC}C:\users\allah is up\desktop\bsearch_en.exe] => (Block) C:\users\allah is up\desktop\bsearch_en.exe

FirewallRules: [TCP Query User{43B75871-5126-4785-B5CD-C575F1D4C33C}D:\bsearch_en.exe] => (Block) D:\bsearch_en.exe

FirewallRules: [UDP Query User{F0847478-DE83-45E3-B82B-204A9BF46243}D:\bsearch_en.exe] => (Block) D:\bsearch_en.exe

FirewallRules: [{87193180-D153-4E1E-B5CE-98564DFD6FB5}] => (Allow) C:\Program Files (x86)\Fiddler2\Fiddler.exe

FirewallRules: [TCP Query User{A610EE6D-6AE8-4BB0-BBF0-8402B788BC69}C:\program files (x86)\paltalk messenger\paltalk.exe] => (Block) C:\program files (x86)\paltalk messenger\paltalk.exe

FirewallRules: [UDP Query User{2A914FE8-783F-49A2-9A2E-8EC32305EDAC}C:\program files (x86)\paltalk messenger\paltalk.exe] => (Block) C:\program files (x86)\paltalk messenger\paltalk.exe

FirewallRules: [{5A7C9E70-D5FA-4F59-B5C7-685DC457C541}] => (Allow) C:\Program Files (x86)\AVG\Av\avgnsa.exe

FirewallRules: [{DBD383A5-1B1E-403A-83DA-DCEE1FCBE54C}] => (Allow) C:\Program Files (x86)\AVG\Av\avgnsa.exe

FirewallRules: [{FEECB766-3202-4A3A-900B-98530EF28104}] => (Allow) C:\Program Files (x86)\AVG\Av\avgdiagex.exe

FirewallRules: [{E89A2BFB-D765-462C-A7FB-20C25D53B522}] => (Allow) C:\Program Files (x86)\AVG\Av\avgdiagex.exe

FirewallRules: [{F9694ED3-3CA8-4F9F-9598-586F10C0051B}] => (Allow) C:\Program Files (x86)\AVG\Av\avgemca.exe

FirewallRules: [{A178A614-EE57-447B-ADBE-FAEB62506CC9}] => (Allow) C:\Program Files (x86)\AVG\Av\avgemca.exe

FirewallRules: [{70D2E06D-91BA-4494-A8BE-4CE51AB740FD}] => (Allow) C:\Program Files (x86)\Dropbox\Client\Dropbox.exe

FirewallRules: [TCP Query User{93A2AF5E-FDB8-4E71-A727-48A028D94E39}C:\program files\realvnc\vnc server\vncserver.exe] => (Allow) C:\program files\realvnc\vnc server\vncserver.exe

FirewallRules: [UDP Query User{8FD247FF-8012-4E99-A51E-07869E5538B8}C:\program files\realvnc\vnc server\vncserver.exe] => (Allow) C:\program files\realvnc\vnc server\vncserver.exe

FirewallRules: [{2E8205F7-A4C6-44B0-9825-2BA1568367FF}] => (Allow) C:\Program Files (x86)\AVG\Av\avgnsa.exe

FirewallRules: [{19966D90-3A99-48ED-81EA-6EFA5F9ED2B1}] => (Allow) C:\Program Files (x86)\AVG\Av\avgnsa.exe

FirewallRules: [{DBBE1BE6-58B5-4F50-AC76-F8FE9F280DAE}] => (Allow) C:\Program Files (x86)\AVG\Av\avgdiagex.exe

FirewallRules: [{9CBF694F-7046-48AF-8C88-9E8F29BED51A}] => (Allow) C:\Program Files (x86)\AVG\Av\avgdiagex.exe

FirewallRules: [{87EFE3FC-4445-4751-B655-625FABBAFBE3}] => (Allow) C:\Program Files (x86)\AVG\Av\avgemca.exe

FirewallRules: [{6C810C98-E397-49F7-99CB-41F0344BFB28}] => (Allow) C:\Program Files (x86)\AVG\Av\avgemca.exe

FirewallRules: [{16B2C784-CD4A-4DCE-91E4-A295857EDA50}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Restore Points =========================

24-05-2016 12:42:18 Scheduled Checkpoint

06-06-2016 21:48:35 Scheduled Checkpoint

13-06-2016 23:43:50 Scheduled Checkpoint

==================== Faulty Device Manager Devices =============

Name: Microsoft PS/2 Mouse

Description: Microsoft PS/2 Mouse

Class Guid: {4d36e96f-e325-11ce-bfc1-08002be10318}

Manufacturer: Microsoft

Service: i8042prt

Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)

Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.

Devices stay in this state if they have been prepared for removal.

After you remove the device, this error disappears.Remove the device, and this error should be resolved.

==================== Event log errors: =========================

Application errors:

==================

Error: (06/29/2016 11:57:59 PM) (Source: Software Protection Platform Service) (EventID: 16385) (User: )

Description: Failed to schedule Software Protection service for re-start at 2116-06-06T06:57:58Z. Error Code: 0x80040154.

Error: (06/29/2016 11:16:01 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: ALLAHisUP-PC)

Description: Activation of app Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy!App failed with error: -2144927151 See the Microsoft-Windows-TWinUI/Operational log for additional information.

Error: (06/29/2016 11:14:35 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application name: svchost.exe_wuauserv, version: 10.0.10586.0, time stamp: 0x5632d7ba

Faulting module name: ntdll.dll, version: 10.0.10586.306, time stamp: 0x571af2eb

Exception code: 0xc0000409

Fault offset: 0x000000000002144b

Faulting process id: 0x8d8

Faulting application start time: 0xsvchost.exe_wuauserv0

Faulting application path: svchost.exe_wuauserv1

Faulting module path: svchost.exe_wuauserv2

Report Id: svchost.exe_wuauserv3

Faulting package full name: svchost.exe_wuauserv4

Faulting package-relative application ID: svchost.exe_wuauserv5

Error: (06/29/2016 11:14:29 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application name: mmc.exe, version: 10.0.10586.0, time stamp: 0x5632d42c

Faulting module name: ntdll.dll, version: 10.0.10586.306, time stamp: 0x571af2eb

Exception code: 0xc0000374

Fault offset: 0x00000000000ee6fc

Faulting process id: 0x37a0

Faulting application start time: 0xmmc.exe0

Faulting application path: mmc.exe1

Faulting module path: mmc.exe2

Report Id: mmc.exe3

Faulting package full name: mmc.exe4

Faulting package-relative application ID: mmc.exe5

Error: (06/29/2016 11:14:10 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: ALLAHisUP-PC)

Description: Activation of app Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI failed with error: -2144927151 See the Microsoft-Windows-TWinUI/Operational log for additional information.

Error: (06/29/2016 11:10:16 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: ALLAHisUP-PC)

Description: Activation of app Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI failed with error: -2144927151 See the Microsoft-Windows-TWinUI/Operational log for additional information.

Error: (06/29/2016 11:10:14 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: ALLAHisUP-PC)

Description: Activation of app Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI failed with error: -2144927151 See the Microsoft-Windows-TWinUI/Operational log for additional information.

Error: (06/29/2016 11:10:12 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: ALLAHisUP-PC)

Description: Activation of app Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI failed with error: -2144927151 See the Microsoft-Windows-TWinUI/Operational log for additional information.

Error: (06/29/2016 11:10:10 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: ALLAHisUP-PC)

Description: Activation of app Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI failed with error: -2144927151 See the Microsoft-Windows-TWinUI/Operational log for additional information.

Error: (06/29/2016 11:10:08 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: ALLAHisUP-PC)

Description: Activation of app Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI failed with error: -2144927151 See the Microsoft-Windows-TWinUI/Operational log for additional information.

System errors:

=============

Error: (06/29/2016 11:14:36 PM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: The Windows Update service terminated unexpectedly. It has done this 4 time(s).

Error: (06/29/2016 11:14:36 PM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: The Windows Management Instrumentation service terminated unexpectedly. It has done this 4 time(s).

Error: (06/29/2016 11:14:36 PM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: The User Manager service terminated unexpectedly. It has done this 2 time(s).

Error: (06/29/2016 11:14:36 PM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: The Shell Hardware Detection service terminated unexpectedly. It has done this 4 time(s).

Error: (06/29/2016 11:14:36 PM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: The System Event Notification Service service terminated unexpectedly. It has done this 3 time(s).

Error: (06/29/2016 11:14:36 PM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: The User Profile Service service terminated unexpectedly. It has done this 3 time(s).

Error: (06/29/2016 11:14:36 PM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: The Server service terminated unexpectedly. It has done this 4 time(s).

Error: (06/29/2016 11:14:36 PM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: The IP Helper service terminated unexpectedly. It has done this 3 time(s).

Error: (06/29/2016 11:14:36 PM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: The Device Setup Manager service terminated unexpectedly. It has done this 1 time(s).

Error: (06/29/2016 11:14:36 PM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: The Computer Browser service terminated unexpectedly. It has done this 1 time(s).

CodeIntegrity:

===================================

Date: 2016-05-21 16:42:19.599

Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.

Date: 2016-05-16 18:19:28.135

Date: 2016-05-06 20:19:53.525

Date: 2016-05-03 16:23:17.050

Date: 2016-03-31 01:43:15.023

Date: 2016-03-16 20:47:29.785

Date: 2016-03-09 21:50:01.292

Date: 2016-03-02 12:06:42.334

Date: 2016-02-17 14:07:39.208

Date: 2016-02-12 11:56:48.831

==================== Memory info ===========================

Processor: Pentium® Dual-Core CPU E5800 @ 3.20GHz

Percentage of memory in use: 82%

Total physical RAM: 2013.24 MB

Available physical RAM: 350.75 MB

Total Virtual: 4061.24 MB

Available Virtual: 2115.8 MB

==================== Drives ================================

Drive c: (eMachines) (Fixed) (Total:283.49 GB) (Free:187.71 GB) NTFS

==================== MBR & Partition Table ==================

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298.1 GB) (Disk ID: 76CA7A7E)

Partition 1: (Not Active) - (Size=14.5 GB) - (Type=27)

Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=283.5 GB) - (Type=07 NTFS)

==================== End of Addition.txt ============================

#2
RKinner

Posted 01 July 2016 - 09:14 AM

Malware Expert

Expert
24,624 posts

I don't really see any malware. Expect that something like manycam or netcamstudio both of which run as services and are thus always running detected the cameras and are stupidly looking for them. Try starting up the user interface for the programs and see if they are detecting the no-longer-there cameras. Usually you can right click on the camera and Delete.

If that's not it you do have one task that I don't like:

Task: {8F0B319B-A8D6-43A2-8B22-7DD90B0D1832} - System32\Tasks\UpdateTask => C:\Users\ALLAHI~1\AppData\Local\{E7AED~1\UNINST~1.EXE

Can't see what it does. Plus you have a lot of these running:

(Microsoft Corporation) C:\Windows\System32\rundll32.exe

Also can't see what they are doing so come back if manycam &/or netcamstudio aren't the culprits.

#3
Evelyn Smith

Posted 02 July 2016 - 11:50 PM

New Member

Topic Starter
Member
4 posts

I deleted the {EZAED~1) folder completely. I tried running manycam and didn't see the cameras and I can't seem to start netcam studio so I don't know what else to do. I think I'll run it again and post it. I think I do have a virus because my mouse moves around the screen all the time without me doing anything. Please take a look at the new files and if possible give a more automated solution so I can make sure I'm taking care of the problems in the cleanest and best of ways.

NEW FRST.txt

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 02-07-2016

Ran by ALLAH is UP (administrator) on ALLAHISUP-PC (02-07-2016 22:43:17)