[Totakeke]

  For a while my browser has been painfully slow with it constantly crashing when in use, so I snooped around & I found that have weird processes going on (Genius.exe & a few others) with folders I don't think are meant to be there in my AppData/Roaming folder (folders like Genius, Sixth, Seventh, Snz etc.). FBDownloader messed with my browser settings too & now I can't get rid of it & the other things despite running MalwareBytes numerous times.

Not exactly tech-savvy so help would be much appreciated

[Advertisements]

Hi! My name is zep516 and Welcome to Geekstogo!
I'll do the best I can to resolve your computer issue
Please make sure to carefully read any instruction that I give you. If you're not sure, or if something unexpected happens, don't continue Stop and ask! Never be afraid to ask questions!

Everything gets download to the desktop and tools are "Run as administrator."

Please download Farbar Recovery Scan Tool and save it to your Desktop.

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

• Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
• Press Scan button.
• It will produce a log called FRST.txt in the same directory the tool is run from.
• Please copy and paste log back here.
• The first time the tool is run it generates another log (Addition.txt - also located in the same directory as FRST.exe/FRST64.exe). Please also paste that along with the FRST.txt into your reply.

[zep516]

Hi! My name is zep516 and Welcome to Geekstogo!
I'll do the best I can to resolve your computer issue
Please make sure to carefully read any instruction that I give you. If you're not sure, or if something unexpected happens, don't continue Stop and ask! Never be afraid to ask questions!

Everything gets download to the desktop and tools are "Run as administrator."

Please download Farbar Recovery Scan Tool and save it to your Desktop.

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

• Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
• Press Scan button.
• It will produce a log called FRST.txt in the same directory the tool is run from.
• Please copy and paste log back here.
• The first time the tool is run it generates another log (Addition.txt - also located in the same directory as FRST.exe/FRST64.exe). Please also paste that along with the FRST.txt into your reply.

[Totakeke]

Did the scan & got this:

 

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:06-08-2015
Ran by cex (administrator) on MEI-PC (08-08-2015 11:32:56)
Running from C:\Users\cex\Desktop
Loaded Profiles: cex (Available Profiles: cex)
Platform: Microsoft Windows 7 Starter  Service Pack 1 (X86) Language: English (United States)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Microsoft Corporation) C:\Program Files\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Dritek System Inc.) C:\Program Files\Launch Manager\dsiwmis.exe
(Dritek System Inc.) C:\Program Files\Launch Manager\LMutilps32.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
(Realsil Microelectronics Inc.) C:\Program Files\Realtek\Realtek PCIE Card Reader\RIconMan.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Updater\UpdaterService.exe
(Symantec Corporation) C:\Program Files\Symantec\Norton Online Backup\NOBuAgent.exe
(http://winaero.com/) C:\Program Files\winaero.com\Personalization Panel DWM Controller\persdwmsrv.exe
(Acer Incorporated) C:\Program Files\Acer\Acer VCM\RS_Service.exe
(Microsoft Corporation) C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe
(Microsoft Corporation) C:\Program Files\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Dritek System Inc.) C:\Program Files\Launch Manager\LManager.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Dritek System Inc.) C:\Program Files\Launch Manager\LMworker.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Acer Incorporated) C:\Program Files\Acer\Acer VCM\AcerVCM.exe
(Intel Corporation) C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(Egis Technology Inc.) C:\Program Files\EgisTec IPS\PmmUpdate.exe
(Egis Technology Inc.) C:\Program Files\EgisTec IPS\EgisUpdate.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\Virtualization Handler\CVH.EXE
() C:\Program Files\Common Files\microsoft shared\Virtualization Handler\OFFICEVIRT.EXE
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmplayer.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SuiteTray] => C:\Program Files\EgisTec MyWinLockerSuite\x86\SuiteTray.exe [341360 2011-09-20] (Egis Technology Inc.)
HKLM\...\Run: [Norton Online Backup] => C:\Program Files\Symantec\Norton Online Backup\NOBuClient.exe [966488 2010-06-02] (Symantec Corporation)
HKLM\...\Run: [LManager] => C:\Program Files\Launch Manager\LManager.exe [1103440 2011-07-01] (Dritek System Inc.)
HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [1812264 2010-11-12] (ELAN Microelectronics Corp.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [10959464 2012-01-10] (Realtek Semiconductor)
HKLM\...\Run: [Power Management] => C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [715368 2011-08-02] (Acer Incorporated)
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [981688 2015-04-30] (Microsoft Corporation)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [446392 2012-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [SwitchBoard] => C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM\...\Run: [AdobeCS6ServiceManager] => C:\Program Files\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [1073312 2012-03-09] (Adobe Systems Incorporated)
HKU\S-1-5-19\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid}
HKU\S-1-5-20\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid}
HKU\S-1-5-21-762790709-3562518967-1425496749-1000\...\Run: [AdobeBridge] => [X]
HKU\S-1-5-18\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid}
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\$McRebootA5E6DEAA56$.lnk [2013-04-27]
ShortcutTarget: $McRebootA5E6DEAA56$.lnk ->  (No File)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Acer VCM.lnk [2013-04-27]
ShortcutTarget: Acer VCM.lnk -> C:\Program Files\Acer\Acer VCM\AcerVCM.exe (Acer Incorporated)
ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\cex\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\cex\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\cex\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-11] (Dropbox, Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-762790709-3562518967-1425496749-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://acer.msn.com
HKU\S-1-5-21-762790709-3562518967-1425496749-1000\Software\Microsoft\Internet Explorer\Main,Start Page = http://acer.msn.com
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/...rc=IE-SearchBox
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/...rc=IE-SearchBox
SearchScopes: HKU\S-1-5-21-762790709-3562518967-1425496749-1000 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-762790709-3562518967-1425496749-1000 -> F0D91DBEC41642B79CA2540BCAE36CB2 URL = http://search.fbdown...q={searchTerms}
SearchScopes: HKU\S-1-5-21-762790709-3562518967-1425496749-1000 -> {95B7759C-8C7F-4BF1-B163-73684A933233} URL = http://search.fbdown...q={searchTerms}
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-29] (Microsoft Corp.)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2015-05-01] (Microsoft Corporation)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2015-05-01] (Microsoft Corporation)
Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} -  No File
Tcpip\Parameters: [DhcpNameServer] 192.168.1.254
Tcpip\..\Interfaces\{543C95CC-D2BE-4DA8-9E62-E40AD5517A04}: [DhcpNameServer] 192.168.1.254

FireFox:
========
FF ProfilePath: C:\Users\cex\AppData\Roaming\Mozilla\Firefox\Profiles\nhp6slw0.default-1390323229129
FF Homepage: hxxp://google.co.uk
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_18_0_0_209.dll [2015-07-15] ()
FF Plugin: @mcafee.com/MSC,version=10 -> c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL [No File]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MIF5BA~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll [2011-05-14] (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3538.0513 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll [2011-05-14] (Microsoft Corporation)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\cex\AppData\Roaming\Mozilla\Firefox\Profiles\nhp6slw0.default-1390323229129\searchplugins\search.xml [2015-04-22]
FF Extension: British English Dictionary (Updated) - C:\Users\cex\AppData\Roaming\Mozilla\Firefox\Profiles\nhp6slw0.default-1390323229129\Extensions\[email protected] [2015-01-07]
FF Extension: Adblock Plus - C:\Users\cex\AppData\Roaming\Mozilla\Firefox\Profiles\nhp6slw0.default-1390323229129\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-03-26]
FF Extension: Skype Click to Call - C:\Program Files\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2015-08-07]

Chrome:
=======
CHR Profile: C:\Users\cex\AppData\Local\Google\Chrome\User Data\Default

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 c2cautoupdatesvc; C:\Program Files\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1394816 2015-05-01] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1772672 2015-05-01] (Microsoft Corporation)
S3 EgisTec Ticket Service; C:\Program Files\Common Files\EgisTec\Services\EgisTicketService.exe [173424 2011-06-21] (Egis Technology Inc. )
R2 ePowerSvc; C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe [739944 2011-08-02] (Acer Incorporated)
R2 IconMan_R; C:\Program Files\Realtek\Realtek PCIE Card Reader\RIconMan.exe [1755136 2011-03-07] (Realsil Microelectronics Inc.) [File not signed]
R2 Live Updater Service; C:\Program Files\Acer\Acer Updater\UpdaterService.exe [255376 2012-02-06] (Acer Incorporated)
S2 MBAMService; C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe [1133880 2015-06-18] (Malwarebytes Corporation)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [22216 2015-04-30] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [284504 2015-04-30] (Microsoft Corporation)
R2 NOBU; C:\Program Files\Symantec\Norton Online Backup\NOBuAgent.exe [2057560 2010-06-02] (Symantec Corporation)
R2 persdwmsrv; C:\Program Files\winaero.com\Personalization Panel DWM Controller\persdwmsrv.exe [8192 2012-04-07] (http://winaero.com/) [File not signed]
R2 RS_Service; C:\Program Files\Acer\Acer VCM\RS_Service.exe [260640 2010-01-30] (Acer Incorporated)
S3 SwitchBoard; C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-27] (Microsoft Corporation)
S3 McAWFwk; c:\PROGRA~1\mcafee\msc\mcawfwk.exe [X]

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R3 ETD; C:\Windows\System32\DRIVERS\ETD.sys [116008 2010-11-12] (ELAN Microelectronics Corp.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2015-06-18] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2015-06-18] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [245096 2015-03-04] (Microsoft Corporation)
R1 mwlPSDFilter; C:\Windows\System32\DRIVERS\mwlPSDFilter.sys [21600 2011-12-16] (Egis Technology Inc.)
R1 mwlPSDNServ; C:\Windows\System32\DRIVERS\mwlPSDNServ.sys [16936 2011-12-16] (Egis Technology Inc.)
R1 mwlPSDVDisk; C:\Windows\System32\DRIVERS\mwlPSDVDisk.sys [62240 2011-12-16] (Egis Technology Inc.)
R3 RSPCIESTOR; C:\Windows\System32\DRIVERS\RtsPStor.sys [254056 2011-05-30] (Realtek Semiconductor Corp.)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-08-08 11:32 - 2015-08-08 11:34 - 00013646 _____ C:\Users\cex\Desktop\FRST.txt
2015-08-08 11:32 - 2015-08-08 11:33 - 00000000 ____D C:\FRST
2015-08-08 01:33 - 2015-08-08 01:34 - 01673728 _____ (Farbar) C:\Users\cex\Desktop\FRST.exe
2015-08-07 17:13 - 2015-08-08 10:17 - 00000000 ____D C:\Program Files\Mozilla Firefox
2015-07-28 15:35 - 2015-07-25 18:51 - 00015808 _____ (Microsoft Corporation) C:\Windows\system32\CompatTelRunner.exe
2015-07-28 15:35 - 2015-07-25 18:47 - 00628736 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-07-28 15:35 - 2015-07-25 18:47 - 00587264 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-07-28 15:35 - 2015-07-25 18:46 - 00924160 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-07-28 15:35 - 2015-07-25 18:46 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-07-28 15:35 - 2015-07-25 18:46 - 00202752 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-07-28 15:35 - 2015-07-25 18:46 - 00058880 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2015-07-28 15:35 - 2015-07-25 18:40 - 00932864 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-07-23 17:17 - 2015-07-23 17:17 - 00000000 ____D C:\Users\cex\AppData\Local\CEF
2015-07-20 22:14 - 2015-07-15 03:55 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2015-07-20 22:14 - 2015-07-15 03:55 - 00034304 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2015-07-20 22:14 - 2015-07-15 03:55 - 00026624 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2015-07-20 22:14 - 2015-07-15 03:55 - 00010240 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2015-07-20 22:14 - 2015-07-15 02:52 - 00299008 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2015-07-18 01:24 - 2015-07-18 01:24 - 00000000 _____ C:\Windows\system32\sho5D4F.tmp
2015-07-16 15:42 - 2015-06-11 18:57 - 06131200 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2015-07-16 15:42 - 2015-06-11 18:57 - 00856064 _____ (Microsoft Corporation) C:\Windows\system32\rdvidcrl.dll
2015-07-16 15:42 - 2015-06-11 18:57 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll
2015-07-16 15:42 - 2015-06-11 16:20 - 00355840 _____ (Microsoft Corporation) C:\Windows\system32\wksprt.exe
2015-07-16 15:41 - 2015-06-19 19:24 - 00047616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-07-16 15:41 - 2015-06-19 19:16 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-07-16 15:41 - 2015-06-19 19:13 - 00102912 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-07-16 15:41 - 2015-06-19 19:06 - 00667648 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-07-16 15:41 - 2015-06-19 18:57 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-07-16 15:41 - 2015-06-19 18:40 - 00685568 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-07-16 15:41 - 2015-06-09 20:35 - 02745856 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2015-07-16 15:41 - 2015-06-09 20:35 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\RdpGroupPolicyExtension.dll
2015-07-16 15:40 - 2015-06-25 18:43 - 00342736 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-07-16 15:40 - 2015-06-19 19:40 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-07-16 15:40 - 2015-06-19 19:25 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-07-16 15:40 - 2015-06-19 19:24 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-07-16 15:40 - 2015-06-19 19:23 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-07-16 15:40 - 2015-06-19 19:17 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-07-16 15:40 - 2015-06-19 19:13 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-07-16 15:40 - 2015-06-19 19:03 - 00418304 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-07-16 15:40 - 2015-06-19 18:53 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-07-16 15:40 - 2015-06-19 18:52 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-07-16 15:40 - 2015-06-19 18:51 - 00285696 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-07-16 15:40 - 2015-06-19 18:40 - 02052608 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-07-16 15:40 - 2015-06-19 18:40 - 00689152 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-07-16 15:40 - 2015-06-19 18:39 - 01155072 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-07-16 15:40 - 2015-06-19 18:15 - 01951232 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-07-16 15:40 - 2015-06-19 18:11 - 00710144 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-07-16 15:39 - 2015-06-19 19:25 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-07-16 15:39 - 2015-06-19 19:13 - 00664064 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-07-15 16:10 - 2015-06-27 02:58 - 00620032 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-07-15 16:10 - 2015-06-27 02:39 - 04520448 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-07-15 16:10 - 2015-06-17 18:39 - 00305664 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2015-07-15 16:09 - 2015-06-15 22:47 - 00101824 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2015-07-15 16:09 - 2015-06-15 22:43 - 02364416 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2015-07-15 16:09 - 2015-06-15 22:43 - 01805824 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2015-07-15 16:09 - 2015-06-15 22:43 - 00337408 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2015-07-15 16:09 - 2015-06-15 22:43 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll
2015-07-15 16:09 - 2015-06-15 22:42 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\msiexec.exe
2015-07-15 16:09 - 2015-06-15 22:37 - 00025088 _____ (Microsoft Corporation) C:\Windows\system32\msimsg.dll
2015-07-15 16:08 - 2015-07-01 21:46 - 00137664 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-07-15 16:08 - 2015-07-01 21:46 - 00067520 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-07-15 16:08 - 2015-07-01 21:30 - 01061376 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-07-15 16:08 - 2015-07-01 21:30 - 00655360 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2015-07-15 16:08 - 2015-07-01 21:30 - 00552960 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-07-15 16:08 - 2015-07-01 21:30 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-07-15 16:08 - 2015-07-01 21:30 - 00248832 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-07-15 16:08 - 2015-07-01 21:30 - 00221184 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-07-15 16:08 - 2015-07-01 21:30 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-07-15 16:08 - 2015-07-01 21:30 - 00100352 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-07-15 16:08 - 2015-07-01 21:30 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-07-15 16:08 - 2015-07-01 21:30 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2015-07-15 16:08 - 2015-07-01 21:30 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-07-15 16:08 - 2015-07-01 21:30 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-07-15 16:08 - 2015-07-01 21:30 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-07-15 16:08 - 2015-07-01 21:29 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-07-15 16:08 - 2015-07-01 21:29 - 00022528 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-07-15 16:08 - 2015-07-01 21:27 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-07-15 16:08 - 2015-07-01 21:26 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-07-15 16:08 - 2015-07-01 21:24 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-07-15 16:08 - 2015-07-01 20:18 - 00225792 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2015-07-15 16:08 - 2015-07-01 20:18 - 00124416 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2015-07-15 16:08 - 2015-07-01 20:18 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2015-07-15 16:07 - 2015-07-09 18:43 - 02943488 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2015-07-15 16:07 - 2015-07-09 18:43 - 02057216 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2015-07-15 16:07 - 2015-07-09 18:43 - 00566784 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2015-07-15 16:07 - 2015-07-09 18:43 - 00173056 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2015-07-15 16:07 - 2015-07-09 18:43 - 00093184 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2015-07-15 16:07 - 2015-07-09 18:43 - 00073728 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2015-07-15 16:07 - 2015-07-09 18:43 - 00035840 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2015-07-15 16:07 - 2015-07-09 18:43 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2015-07-15 16:07 - 2015-07-09 18:42 - 00135168 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2015-07-15 16:07 - 2015-07-09 18:42 - 00034816 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2015-07-15 16:07 - 2015-07-09 18:42 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\wu.upgrade.ps.dll
2015-07-15 16:07 - 2015-07-04 18:48 - 01414656 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll
2015-07-15 16:07 - 2015-06-25 09:46 - 02383872 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-07-15 16:07 - 2015-06-02 00:47 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\cewmdm.dll
2015-07-15 16:06 - 2015-07-02 22:21 - 19877376 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-07-15 16:06 - 2015-07-02 22:08 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-07-15 16:06 - 2015-07-02 21:50 - 02279424 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-07-15 16:06 - 2015-07-02 21:46 - 00479232 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-07-15 16:06 - 2015-07-02 21:19 - 12855296 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-07-15 16:06 - 2015-07-02 20:55 - 01310720 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-07-12 20:39 - 2015-04-27 20:05 - 00179200 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2015-07-12 20:39 - 2015-04-27 20:04 - 01174528 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2015-07-12 20:39 - 2015-04-27 20:04 - 00143872 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2015-07-12 20:39 - 2015-04-27 20:04 - 00103936 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2015-07-12 19:23 - 2015-07-12 19:23 - 00000000 ____D C:\Users\cex\AppData\Local\ext_deltagame
2015-07-10 20:09 - 2015-07-10 20:09 - 00000000 ____D C:\42f4368860e293cebe82fa

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-08-08 11:32 - 2012-12-08 14:43 - 01873540 _____ C:\Windows\WindowsUpdate.log
2015-08-08 11:29 - 2013-04-21 20:42 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-08-08 11:12 - 2009-07-14 05:34 - 00016160 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-08-08 11:12 - 2009-07-14 05:34 - 00016160 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-08-08 10:19 - 2013-01-29 20:56 - 00000342 _____ C:\Windows\Tasks\ROC_JAN2013_TB_rmv.job
2015-08-08 10:17 - 2013-01-13 21:58 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2015-08-08 10:17 - 2010-11-20 22:48 - 00199530 _____ C:\Windows\PFRO.log
2015-08-08 10:17 - 2009-07-14 05:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-08-08 10:17 - 2009-07-14 05:39 - 00089510 _____ C:\Windows\setupact.log
2015-08-08 03:16 - 2013-01-14 13:51 - 00000000 ____D C:\Users\cex\AppData\Roaming\SoftGrid Client
2015-08-07 23:47 - 2015-05-04 19:56 - 00098520 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-08-07 23:07 - 2013-02-02 21:07 - 00089302 _____ C:\Windows\wininit.ini
2015-08-07 22:22 - 2013-01-14 19:11 - 00000000 ____D C:\Users\cex\AppData\Roaming\Skype
2015-08-07 22:15 - 2013-01-16 22:32 - 00000000 ___RD C:\Program Files\Skype
2015-08-07 22:15 - 2011-12-16 10:22 - 00000000 ____D C:\ProgramData\Skype
2015-08-07 22:11 - 2015-06-18 20:52 - 00000000 ____D C:\Program Files\Steam
2015-08-07 22:11 - 2014-08-25 19:39 - 00000000 ____D C:\Users\cex\AppData\Roaming\Seventh
2015-08-07 19:08 - 2015-05-04 19:51 - 00000000 ____D C:\Program Files\Malwarebytes Anti-Malware
2015-08-07 19:07 - 2015-05-04 19:53 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-08-03 18:17 - 2014-05-07 00:17 - 00000000 ___SD C:\Windows\system32\CompatTel
2015-07-27 10:50 - 2015-06-18 20:53 - 00000000 ____D C:\Program Files\Common Files\Steam
2015-07-25 23:02 - 2015-04-08 20:03 - 00000000 ___SD C:\Windows\system32\GWX
2015-07-21 21:24 - 2009-07-14 05:33 - 03660912 _____ C:\Windows\system32\FNTCACHE.DAT
2015-07-17 20:29 - 2014-02-09 15:57 - 00048640 ____H C:\Users\cex\Documents\~WRL0001.tmp
2015-07-16 18:09 - 2014-12-13 19:27 - 00000000 ____D C:\Windows\system32\appraiser
2015-07-16 18:02 - 2013-08-15 20:51 - 00000000 ____D C:\Windows\system32\MRT
2015-07-16 02:28 - 2009-07-14 05:53 - 00032608 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2015-07-15 14:42 - 2013-04-21 20:42 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2015-07-15 14:42 - 2013-04-21 20:42 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2015-07-13 14:49 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\rescache

==================== Files in the root of some directories =======

2015-07-06 22:09 - 2015-07-06 22:09 - 0001456 _____ () C:\Users\cex\AppData\Local\Adobe Save for Web 13.0 Prefs
2015-07-08 12:22 - 2015-07-08 12:22 - 0761791 _____ () C:\Users\cex\AppData\Local\omesuperv2.exe
2015-05-31 20:23 - 2015-05-31 20:23 - 0024530 _____ () C:\Users\cex\AppData\Local\recently-used.xbel
2014-01-10 18:28 - 2015-03-18 14:23 - 0007601 _____ () C:\Users\cex\AppData\Local\Resmon.ResmonCfg
2013-04-14 22:26 - 2013-04-14 22:26 - 0029144 _____ () C:\ProgramData\1365974758.bdinstall.bin
2013-04-14 22:29 - 2013-04-14 22:29 - 0030313 _____ () C:\ProgramData\1365974935.bdinstall.bin
2013-04-14 22:30 - 2013-04-14 22:30 - 0002046 _____ () C:\ProgramData\1365975035.4812.bin
2013-04-14 22:30 - 2013-04-14 22:30 - 0026989 _____ () C:\ProgramData\1365975035.6764.bin
2013-04-14 22:30 - 2013-04-14 22:30 - 0000433 _____ () C:\ProgramData\1365975035.7712.bin
2013-04-14 22:53 - 2013-04-14 22:53 - 0029144 _____ () C:\ProgramData\1365976098.bdinstall.bin
2013-04-14 23:13 - 2013-04-14 23:13 - 0030874 _____ () C:\ProgramData\1365977541.bdinstall.bin
2013-04-14 23:42 - 2013-04-14 23:42 - 0178802 _____ () C:\ProgramData\1365978322.bdinstall.bin
2013-04-20 21:59 - 2013-04-20 21:59 - 0022732 _____ () C:\ProgramData\1366491562.bdinstall.bin
2013-04-20 22:02 - 2013-04-20 22:02 - 0044712 _____ () C:\ProgramData\1366491594.bdinstall.bin
2013-04-20 22:11 - 2013-04-20 22:11 - 0074425 _____ () C:\ProgramData\1366492167.bdinstall.bin

Some files in TEMP:
====================
C:\Users\cex\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp6vgpif.dll
C:\Users\cex\AppData\Local\Temp\firefox_gen_inst_wrp.exe
C:\Users\cex\AppData\Local\Temp\install_flashplayer11x32au_mssd_aaa_aih.exe
C:\Users\cex\AppData\Local\Temp\install_flashplayer13x32au_mssd_aaa_aih.exe
C:\Users\cex\AppData\Local\Temp\install_flashplayer13x32au_mssd_aaa_aih_1.exe
C:\Users\cex\AppData\Local\Temp\mpam-b6b0c470.exe
C:\Users\cex\AppData\Local\Temp\SkypeSetup.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-07-30 14:35

==================== End of log ============================

 

Additional scan result of Farbar Recovery Scan Tool (x86) Version:06-08-2015
Ran by cex (2015-08-08 11:35:54)
Running from C:\Users\cex\Desktop
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-762790709-3562518967-1425496749-500 - Administrator - Disabled)
cex (S-1-5-21-762790709-3562518967-1425496749-1000 - Administrator - Enabled) => C:\Users\cex
Guest (S-1-5-21-762790709-3562518967-1425496749-501 - Limited - Disabled)

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Microsoft Security Essentials (Enabled - Up to date) {B7ECF8CD-0188-6703-DBA4-AA65C6ACFB0A}
AS: Microsoft Security Essentials (Enabled - Up to date) {0C8D1929-27B2-688D-E114-9117BD2BB1B7}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

7-Data Card Recovery version 1.1 (HKLM\...\{6901730F-0385-49D1-B858-A7DBEB6ACE6F}_is1) (Version: 1.1 - SharpNight Co,Ltd)
Acer Crystal Eye Webcam (HKLM\...\InstallShield_{A0382E3C-7384-429A-9BFA-AF5888E5A193}) (Version: 1.5.2108.00 - CyberLink Corp.)
Acer Crystal Eye Webcam (Version: 1.5.2108.00 - CyberLink Corp.) Hidden
Acer ePower Management (HKLM\...\{3DB0448D-AD82-4923-B305-D001E521A964}) (Version: 6.00.3008 - Acer Incorporated)
Acer eRecovery Management (HKLM\...\{7F811A54-5A09-4579-90E1-C93498E230D9}) (Version: 5.00.3504 - Acer Incorporated)
Acer Games (HKLM\...\WildTangent acer Master Uninstall) (Version: 1.0.2.5 - WildTangent)
Acer Updater (HKLM\...\{EE171732-BEB4-4576-887D-CB62727F01CA}) (Version: 1.02.3501 - Acer Incorporated)
Acer VCM (HKLM\...\{047F790A-7A2A-4B6A-AD02-38092BA63DAC}) (Version: 4.05.3501 - Acer Incorporated)
Adobe AIR (HKLM\...\Adobe AIR) (Version: 2.7.1.19610 - Adobe Systems Incorporated)
Adobe Flash Player 18 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 18.0.0.209 - Adobe Systems Incorporated)
Adobe Photoshop CS6 (HKLM\...\{74EB3499-8B95-4B5C-96EB-7B342F3FD0C6}) (Version: 13.0 - Adobe Systems Incorporated)
Adobe Reader X (10.1.13) MUI (HKLM\...\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}) (Version: 10.1.13 - Adobe Systems Incorporated)
Akhra: The Treasures (Version: 2.2.0.98 - WildTangent) Hidden
Alice's Magical Mahjong (Version: 2.2.0.98 - WildTangent) Hidden
Any Video Converter 5.5.2 (HKLM\...\Any Video Converter_is1) (Version:  - Any-Video-Converter.com)
Bejeweled 3 (Version: 2.2.0.98 - WildTangent) Hidden
Canon MP250 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP250_series) (Version:  - )
Chuzzle Deluxe (Version: 2.2.0.95 - WildTangent) Hidden
D3DX10 (Version: 15.4.2368.0902 - Microsoft) Hidden
Diego's Ultimate Rescue (Version: 2.2.0.95 - WildTangent) Hidden
Dropbox (HKU\S-1-5-21-762790709-3562518967-1425496749-1000\...\Dropbox) (Version: 3.4.6 - Dropbox, Inc.)
Dropbox Packages (HKU\S-1-5-21-762790709-3562518967-1425496749-1000\...\Dropbox Packages) (Version:  - ) <==== ATTENTION
ETDWare PS/2-X86 8.0.6.0_WHQL (HKLM\...\Elantech) (Version: 8.0.6.0 - ELAN Microelectronic Corp.)
Fotogalerija Windows Live (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galeria de Fotografias do Windows Live (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galería fotográfica de Windows Live (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galeria fotogràfica del Windows Live (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galeria fotografii usługi Windows Live (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galerie de photos Windows Live (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galerie foto Windows Live (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
GIMP 2.8.14 (HKLM\...\GIMP-2_is1) (Version: 2.8.14 - The GIMP Team)
HetaOni English (HKU\S-1-5-21-762790709-3562518967-1425496749-1000\...\HetaOni English) (Version:  - )
Identity Card (HKLM\...\Identity Card) (Version: 1.00.3501 - Acer Incorporated)
Insaniquarium Deluxe (Version: 2.2.0.97 - WildTangent) Hidden
Intel® Control Center (HKLM\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)
Intel® Graphics Media Accelerator Driver (HKLM\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.14.8.1065 - Intel Corporation)
Intel® Rapid Storage Technology (HKLM\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 10.1.0.1008 - Intel Corporation)
Junk Mail filter update (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Launch Manager (HKLM\...\LManager) (Version: 5.1.7 - Acer Inc.)
Lyrics Plugin for Windows Media Player (HKLM\...\{43002AE2-4093-49E0-A03D-990EE184C568}) (Version: 0.4 - Lyrics Plugin)
Malwarebytes Anti-Malware version 2.1.8.1057 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.8.1057 - Malwarebytes Corporation)
Manga Studio Debut 4.0 (HKLM\...\Manga Studio Debut 4.0) (Version:  - )
Mesh Runtime (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Office 2010 (HKLM\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Click-to-Run 2010 (HKLM\...\Office14.Click2Run) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Starter 2010 - English (HKLM\...\{90140011-0066-0409-0000-0000000FF1CE}) (Version: 14.0.5131.5000 - Microsoft Corporation)
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.8.204.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40416.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 39.0.3 (x86 en-US) (HKLM\...\Mozilla Firefox 39.0.3 (x86 en-US)) (Version: 39.0.3 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
My Farm Life (Version: 2.2.0.97 - WildTangent) Hidden
My Kingdom for the Princess 3 (Version: 2.2.0.98 - WildTangent) Hidden
MyWinLocker 4 (Version: 4.0.14.27 - Egis Technology Inc.) Hidden
MyWinLocker Suite (HKLM\...\InstallShield_{17DF9714-60C9-43C9-A9C2-32BCAED44CBE}) (Version: 4.0.14.19 - Egis Technology Inc.)
MyWinLocker Suite (Version: 4.0.14.19 - Egis Technology Inc.) Hidden
Norton Online Backup (HKLM\...\{40A66DF6-22D3-44B5-A7D3-83B118A2C0DC}) (Version: 2.1.17869 - Symantec Corporation)
PDF Settings CS6 (Version: 11.0 - Adobe Systems Incorporated) Hidden
Personalization Panel (HKLM\...\Personalization Panel) (Version: 2.5 - http://winaero.com/)
Personalization Panel DWM Controller  (HKLM\...\{3925EB7E-77A2-4F6B-8B97-3C083667D4AA}) (Version: 2.5 - winaero.com)
Pixia (HKLM\...\{A0BCF90F-B4E4-435C-A48D-8FAAE10554F9}) (Version: 4.79e - Isao Maruoka)
Poczta usługi Windows Live (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Podstawowe programy Windows Live (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Pošta Windows Live (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Raccolta foto di Windows Live (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Realtek Ethernet Controller Driver (HKLM\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.49.927.2011 - Realtek)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6549 - Realtek Semiconductor Corp.)
Realtek PCIE Card Reader (HKLM\...\{C1594429-8296-4652-BF54-9DBE4932A44C}) (Version: 6.1.7601.83 - Realtek Semiconductor Corp.)
Running Sheep (Version: 2.2.0.98 - WildTangent) Hidden
SAMSUNG Mobile Modem Driver Set (HKLM\...\SAMSUNG Mobile Modem) (Version:  - )
Samsung Mobile phone USB driver Drive Software (HKLM\...\Samsung Mobile phone USB driver Drive) (Version:  - )
SAMSUNG Mobile USB Modem 1.0 Software (HKLM\...\SAMSUNG Mobile USB Modem 1.0) (Version:  - )
SAMSUNG Mobile USB Modem Software (HKLM\...\SAMSUNG Mobile USB Modem) (Version:  - )
Samsung PC Studio 3 USB Driver Installer (HKLM\...\{EBA29752-DDD2-4B62-B2E3-9841F92A3E3A}) (Version: 3.2.0.70701 - Samsung Electronics Co., Ltd.)
Shredder (Version: 2.0.8.9 - Egis Technology Inc.) Hidden
Skip-Bo - Castaway Caper (Version: 2.2.0.95 - WildTangent) Hidden
Skype Click to Call (HKLM\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.4.0.9058 - Microsoft Corporation)
Skype™ 7.7 (HKLM\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.7.103 - Skype Technologies S.A.)
Slingo Deluxe (Version: 2.2.0.95 - WildTangent) Hidden
Steam (HKLM\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
StepMania (remove only) (HKLM\...\StepMania) (Version:  - )
Team Fortress 2 (HKLM\...\Steam App 440) (Version:  - Valve)
VLC media player 2.0.5 (HKLM\...\VLC media player) (Version: 2.0.5 - VideoLAN)
Windows Live Essentials (HKLM\...\WinLiveSuite) (Version: 15.4.3538.0513 - Microsoft Corporation)
WinRAR archiver (HKLM\...\WinRAR archiver) (Version:  - )
Yume Nikki 0.10 English (HKU\S-1-5-21-762790709-3562518967-1425496749-1000\...\Yume Nikki 0.10 English) (Version:  - )
Συλλογή φωτογραφιών του Windows Live (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Основные компоненты Windows Live (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Почта Windows Live (Version: 15.4.3502.0922 - Корпорация Майкрософт) Hidden
Фотоальбом Windows Live (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Фотогалерия на Windows Live (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
גלריית התמונות של Windows Live (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
بريد Windows Live (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
معرض صور Windows Live (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-762790709-3562518967-1425496749-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\cex\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-762790709-3562518967-1425496749-1000_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\cex\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-762790709-3562518967-1425496749-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\cex\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-762790709-3562518967-1425496749-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\cex\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-762790709-3562518967-1425496749-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\cex\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-762790709-3562518967-1425496749-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\cex\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-762790709-3562518967-1425496749-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\cex\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-762790709-3562518967-1425496749-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\cex\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-762790709-3562518967-1425496749-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\cex\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-762790709-3562518967-1425496749-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\cex\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)

==================== Restore Points =========================

08-07-2015 19:12:13 Windows Update
12-07-2015 20:22:25 Windows Update
13-07-2015 01:47:34 Windows Update
16-07-2015 17:12:57 Windows Update
17-07-2015 14:45:17 Windows Update
20-07-2015 22:33:56 Windows Update
25-07-2015 23:07:21 Windows Update
30-07-2015 11:16:44 Windows Update
03-08-2015 17:20:08 Windows Update
06-08-2015 21:45:16 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:04 - 2009-06-10 22:39 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {0E652DC6-E5BF-4483-BB12-3A686D820DA4} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2015-07-15] (Adobe Systems Incorporated)
Task: {1196CAFE-8425-47C8-8B61-EF305CC24FA5} - System32\Tasks\{73E5FECE-8352-497C-AA28-3D40973E863E} => C:\Program Files\GIMP 2\bin\gimp-2.8.exe [2014-08-26] (Spencer Kimball, Peter Mattis and the GIMP Development Team)
Task: {16A160CF-96A5-43CC-948F-7CF732C42B0D} - System32\Tasks\{8D0C84C5-3C74-45CC-899A-96FDF127E575} => C:\Program Files\Common Files\mcafee\vscore\mfefire.exe
Task: {19A5B8B8-D911-47E0-B9A9-77F1F205720C} - System32\Tasks\UALU notificatin => C:\Program Files\Acer\Acer Updater\UALU.exe [2012-02-06] (Acer Incorporated)
Task: {2EE67A91-10CA-4B81-B19B-F70FF46CB6BA} - System32\Tasks\EgisUpdate => C:\Program Files\EgisTec IPS\EgisUpdate.exe [2011-03-29] (Egis Technology Inc.)
Task: {314DF6CE-5D0B-4F99-AF97-5CDC4A6DE47C} - System32\Tasks\{BDF98E18-670D-4878-9046-1AB7147F986B} => pcalua.exe -a D:\McPreInstall.exe -d D:\
Task: {338CBC38-18C8-4E14-BC6F-54F23CA7D5E1} - System32\Tasks\Genius_Interval => C:\Users\cex\AppData\Roaming\Genius\Genius.exe
Task: {41D48CB1-1B6D-47E2-802F-F013BA1E56EF} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {4C1C6774-D985-42B8-8258-A98D801E5C77} - System32\Tasks\{C1874B78-B1E7-427D-9076-E902FF612B79} => C:\Program Files\GIMP 2\bin\gimp-2.8.exe [2014-08-26] (Spencer Kimball, Peter Mattis and the GIMP Development Team)
Task: {796654BE-5A35-44A5-8D8C-51E0B99EB1BB} - System32\Tasks\{5B480406-F63C-443A-B283-C751C02F6CBA} => pcalua.exe -a C:\Users\cex\Desktop\pci_us_smartrecovery.exe -d C:\Users\cex\Desktop
Task: {7B03F380-B3F4-4AF9-B0A9-3CB9E032DFC9} - System32\Tasks\Games\UpdateCheck_S-1-5-21-762790709-3562518967-1425496749-1000
Task: {AF5ECAC0-07D9-4673-B99D-168FEC00C4E3} - System32\Tasks\PMMUpdate => C:\Program Files\EgisTec IPS\PMMUpdate.exe [2011-03-29] (Egis Technology Inc.)
Task: {BE056321-B449-4A13-B2BC-F04C83FC2D90} - System32\Tasks\ROC_JAN2013_TB_rmv => C:\Program Files\AVG Secure Search\PostInstall\ROC.exe
Task: {C84F95BF-70A3-4308-94DB-130FDAA37AEA} - System32\Tasks\{4398C708-D1D6-4BC3-BF24-C42709D2A372} => C:\Program Files\Common Files\mcafee\vscore\mfefire.exe
Task: {F5AEFE07-36BD-4606-B64F-9560836F4046} - System32\Tasks\{1E0FD6B5-2302-4AEA-8820-152778EB53A5} => pcalua.exe -a "C:\Program Files\McAfee\msc\McActInst.exe" -d "C:\Program Files\McAfee\msc"

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\ROC_JAN2013_TB_rmv.job => C:\Program Files\AVG Secure Search\PostInstall\ROC.exe

==================== Loaded Modules (Whitelisted) ==============

2013-04-30 07:37 - 2005-08-03 22:32 - 00125440 _____ () C:\Program Files\WinRAR\rarext.dll
2014-11-01 21:36 - 2014-11-01 21:36 - 00169472 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\93182e9779b8be0f688fd0784df6d7fb\IsdiInterop.ni.dll
2011-12-16 10:06 - 2010-11-06 09:50 - 00058880 _____ () C:\Program Files\Intel\Intel® Rapid Storage Technology\IsdiInterop.dll
2010-02-28 03:33 - 2010-02-28 03:33 - 00077664 _____ () C:\Program Files\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)


==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" value will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => ""=""

==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-762790709-3562518967-1425496749-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\cex\Pictures\Reference\Misc\Games\HNI_0098.JPG
DNS Servers: 192.168.1.254
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\startupreg: AVG_UI => "C:\Program Files\AVG\AVG2013\avgui.exe" /TRAYONLY
MSCONFIG\startupreg: Genius => "C:\Users\cex\AppData\Roaming\Genius\Genius.exe"  
MSCONFIG\startupreg: GfxServiceInstall => C:\Windows\system32\GfxCUIServiceInstall.vbs
MSCONFIG\startupreg: Intermediate => "C:\Users\cex\AppData\Roaming\Intermediate\Intermediate.exe"  
MSCONFIG\startupreg: mcui_exe => "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
MSCONFIG\startupreg: SCheck => "C:\Users\cex\AppData\Roaming\SCheck\SCheck.exe" check  nt
MSCONFIG\startupreg: Seventh => "C:\Users\cex\AppData\Roaming\Seventh\Seventh.exe"
MSCONFIG\startupreg: Sixth => "C:\Users\cex\AppData\Roaming\Sixth\Sixth.exe"
MSCONFIG\startupreg: Skype => "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun
MSCONFIG\startupreg: SSync => "C:\Users\cex\AppData\Roaming\SSync\SSync.exe"
MSCONFIG\startupreg: Steam => "C:\Program Files\Steam\steam.exe" -silent

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [{E5E4F130-78EE-4D9E-86CF-F1BC4D6CE59A}] => (Allow) C:\Program Files\Skype\Phone\Skype.exe
FirewallRules: [{AEDE7254-7E72-426C-BC6F-15C47CDA28F8}] => (Allow) C:\Program Files\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{B54FB873-8A18-4168-B091-6E25125B2231}] => (Allow) LPort=2869
FirewallRules: [{2B5767C8-30F1-4DA6-8EA7-56728E8233C8}] => (Allow) LPort=1900
FirewallRules: [{D6157922-2918-49D2-AF9A-C2488FD0F0F6}] => (Allow) C:\Program Files\Windows Live\Mesh\MOE.exe
FirewallRules: [{5D76B80C-1B1E-4E14-8DDA-66DF097159A4}] => (Allow) C:\Program Files\Acer\Acer VCM\VC.exe
FirewallRules: [{571C87BE-A935-4322-BC99-9C83CDBCE89A}] => (Allow) C:\Program Files\Acer\Acer VCM\RS_Service.exe
FirewallRules: [{38DD9A50-F64D-4FEB-A2BE-1B343C6D21DC}] => (Allow) C:\Users\cex\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{58B558D7-145C-413A-B5BE-FDFABDD7DFB9}] => (Allow) C:\Users\cex\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{580A7CF2-BEE7-47CC-B752-0A38E48B5FC0}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{7BE0D598-2158-42DA-85B8-46C515AA51B6}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{8121F866-477F-4D82-BDB2-FB7C112F434B}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{CA5F9F85-6BD1-4765-A6CE-E9DD039F66AE}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [TCP Query User{D293307B-B96E-4B2A-9007-4EFDABC51C60}C:\users\cex\appdata\roaming\dropbox\bin\dropbox.exe] => (Block) C:\users\cex\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [UDP Query User{8A64B7D4-7ADD-419C-AED2-0D9C74EE4443}C:\users\cex\appdata\roaming\dropbox\bin\dropbox.exe] => (Block) C:\users\cex\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [{3D30FFC8-1FBD-4E02-BB2D-49894344AAE1}] => (Allow) C:\Users\cex\AppData\Local\iLivid\iLivid.exe
FirewallRules: [{172D564E-2FD7-4C14-90C1-59CE5C1C7988}] => (Allow) C:\Users\cex\AppData\Local\iLivid\iLivid.exe
FirewallRules: [{CAAF9B7C-4262-49EB-B0E1-DCF9623910C9}] => (Allow) C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
FirewallRules: [{219901DC-FCF2-464F-BF2F-F64056455095}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{FBCD4CA9-F88C-4F66-A6C0-DD0F64EE6BC9}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{792BB738-CD57-42D0-9F7E-EE1B4673FC9B}] => (Allow) C:\Program Files\Steam\Steam.exe
FirewallRules: [{8B6A83C1-F044-44AC-9F60-359E059B6861}] => (Allow) C:\Program Files\Steam\Steam.exe
FirewallRules: [{9B172DCA-6C1E-4DD7-BD4A-C07322DF60F0}] => (Allow) C:\Program Files\Steam\bin\steamwebhelper.exe
FirewallRules: [{0EBF51D0-11A4-4B01-A597-93CE6C073F3C}] => (Allow) C:\Program Files\Steam\bin\steamwebhelper.exe
FirewallRules: [{CDD7675A-42BA-4EF7-ACEE-6B2E1FF32242}] => (Allow) C:\Program Files\Steam\steamapps\common\Team Fortress 2\hl2.exe
FirewallRules: [{9C90F824-0290-4CDD-BA71-1E44D10C2A2C}] => (Allow) C:\Program Files\Steam\steamapps\common\Team Fortress 2\hl2.exe

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (08/08/2015 10:19:26 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/07/2015 10:10:57 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/07/2015 10:04:58 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program firefox.exe version 39.0.0.5659 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

Process ID: 768

Start Time: 01d0d127be38fcf6

Termination Time: 2324

Application Path: C:\Program Files\Mozilla Firefox\firefox.exe

Report Id: c26c7596-3d47-11e5-bf69-047d7b5b2a8a

Error: (08/07/2015 04:35:01 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/06/2015 09:28:35 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/05/2015 11:57:39 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/04/2015 10:12:36 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/03/2015 06:35:48 PM) (Source: Windows Backup) (EventID: 4103) (User: )
Description: The backup did not complete because of an error writing to the backup location F:\. The error is: The backup location cannot be found or is not valid. Review your backup settings and check the backup location. (0x81000006).

Error: (08/03/2015 06:20:32 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/03/2015 05:15:22 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


System errors:
=============
Error: (08/08/2015 10:18:25 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: The following boot-start or system-start driver(s) failed to load:
cdrom

Error: (08/08/2015 12:46:32 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the Windows Error Reporting Service service to connect.

Error: (08/07/2015 10:15:08 PM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: The Windows Update service hung on starting.

Error: (08/07/2015 10:10:31 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: The following boot-start or system-start driver(s) failed to load:
cdrom

Error: (08/07/2015 09:48:18 PM) (Source: Microsoft Antimalware) (EventID: 3002) (User: )
Description: %%860 Real-Time Protection feature has encountered an error and failed.

    Feature: %%834

    Error Code: 0x80004005

    Error description: Unspecified error

    Reason: %%838

Error: (08/07/2015 09:44:48 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the Windows Error Reporting Service service to connect.

Error: (08/07/2015 09:44:18 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the Windows Error Reporting Service service to connect.

Error: (08/07/2015 09:42:06 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the Windows Error Reporting Service service to connect.

Error: (08/07/2015 09:40:38 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the Windows Error Reporting Service service to connect.

Error: (08/07/2015 09:39:11 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the Windows Error Reporting Service service to connect.


Microsoft Office:
=========================
Error: (08/08/2015 10:19:26 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/07/2015 10:10:57 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/07/2015 10:04:58 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: firefox.exe39.0.0.565976801d0d127be38fcf62324C:\Program Files\Mozilla Firefox\firefox.exec26c7596-3d47-11e5-bf69-047d7b5b2a8a

Error: (08/07/2015 04:35:01 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/06/2015 09:28:35 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/05/2015 11:57:39 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/04/2015 10:12:36 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/03/2015 06:35:48 PM) (Source: Windows Backup) (EventID: 4103) (User: )
Description: F:\The backup location cannot be found or is not valid. Review your backup settings and check the backup location. (0x81000006)

Error: (08/03/2015 06:20:32 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/03/2015 05:15:22 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


CodeIntegrity:
===================================
  Date: 2013-04-20 20:22:12.094
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files\Bitdefender\Antivirus Free Edition\avc3\avc3_sig_186\avcuf32.dll because the set of per-page image hashes could not be found on the system.

  Date: 2013-04-20 19:41:57.362
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files\Bitdefender\Antivirus Free Edition\avc3\avc3_sig_186\avcuf32.dll because the set of per-page image hashes could not be found on the system.

  Date: 2013-04-18 20:05:55.977
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files\Bitdefender\Antivirus Free Edition\avc3\avc3_sig_186\avcuf32.dll because the set of per-page image hashes could not be found on the system.

  Date: 2013-04-17 19:08:53.210
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files\Bitdefender\Antivirus Free Edition\avc3\avc3_sig_186\avcuf32.dll because the set of per-page image hashes could not be found on the system.

  Date: 2013-04-16 10:49:38.310
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files\Bitdefender\Antivirus Free Edition\avc3\avc3_sig_186\avcuf32.dll because the set of per-page image hashes could not be found on the system.


==================== Memory info ===========================

Processor: Intel® Atom™ CPU N2600 @ 1.60GHz
Percentage of memory in use: 89%
Total physical RAM: 1012.3 MB
Available physical RAM: 111.35 MB
Total Virtual: 2036.3 MB
Available Virtual: 669.48 MB

==================== Drives ================================

Drive c: (Acer) (Fixed) (Total:284.99 GB) (Free:188.91 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298.1 GB) (Disk ID: B344B632)
Partition 1: (Not Active) - (Size=13 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=285 GB) - (Type=07 NTFS)

==================== End of log ============================

[zep516]

Hello,

Please remove this program below from your programs an features uninstall list
Dropbox Packages

Next items to fix in log.
NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system
Open notepad (Start =>All Programs => Accessories => Notepad).
Copy/Paste the contents of the code box below into Notepad.
 

start
CloseProcesses:
CreateRestorePoint:
HKU\S-1-5-19\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid}
HKU\S-1-5-20\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid}
HKU\S-1-5-21-762790709-3562518967-1425496749-1000\...\Run: [AdobeBridge] => [X]
HKU\S-1-5-18\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid}
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\$McRebootA5E6DEAA56$.lnk [2013-04-27]
ShortcutTarget: $McRebootA5E6DEAA56$.lnk ->  (No File)
SearchScopes: HKU\S-1-5-21-762790709-3562518967-1425496749-1000 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-762790709-3562518967-1425496749-1000 -> F0D91DBEC41642B79CA2540BCAE36CB2 URL = http://search.fbdown...q={searchTerms}
SearchScopes: HKU\S-1-5-21-762790709-3562518967-1425496749-1000 -> {95B7759C-8C7F-4BF1-B163-73684A933233} URL = http://search.fbdown...q={searchTerms}
Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} -  No File
FF Plugin: @mcafee.com/MSC,version=10 -> c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL [No File]
S3 McAWFwk; c:\PROGRA~1\mcafee\msc\mcawfwk.exe [X]
2015-08-08 10:19 - 2013-01-29 20:56 - 00000342 _____ C:\Windows\Tasks\ROC_JAN2013_TB_rmv.job
2013-04-14 22:26 - 2013-04-14 22:26 - 0029144 _____ () C:\ProgramData\1365974758.bdinstall.bin
2013-04-14 22:29 - 2013-04-14 22:29 - 0030313 _____ () C:\ProgramData\1365974935.bdinstall.bin
2013-04-14 22:30 - 2013-04-14 22:30 - 0002046 _____ () C:\ProgramData\1365975035.4812.bin
2013-04-14 22:30 - 2013-04-14 22:30 - 0026989 _____ () C:\ProgramData\1365975035.6764.bin
2013-04-14 22:30 - 2013-04-14 22:30 - 0000433 _____ () C:\ProgramData\1365975035.7712.bin
2013-04-14 22:53 - 2013-04-14 22:53 - 0029144 _____ () C:\ProgramData\1365976098.bdinstall.bin
2013-04-14 23:13 - 2013-04-14 23:13 - 0030874 _____ () C:\ProgramData\1365977541.bdinstall.bin
2013-04-14 23:42 - 2013-04-14 23:42 - 0178802 _____ () C:\ProgramData\1365978322.bdinstall.bin
2013-04-20 21:59 - 2013-04-20 21:59 - 0022732 _____ () C:\ProgramData\1366491562.bdinstall.bin
2013-04-20 22:02 - 2013-04-20 22:02 - 0044712 _____ () C:\ProgramData\1366491594.bdinstall.bin
2013-04-20 22:11 - 2013-04-20 22:11 - 0074425 _____ () C:\ProgramData\1366492167.bdinstall.bin
Task: {BE056321-B449-4A13-B2BC-F04C83FC2D90} - System32\Tasks\ROC_JAN2013_TB_rmv => C:\Program Files\AVG Secure Search\PostInstall\ROC.exe
Task: {C84F95BF-70A3-4308-94DB-130FDAA37AEA} - System32\Tasks\{4398C708-D1D6-4BC3-BF24-C42709D2A372} => C:\Program Files\Common Files\mcafee\vscore\mfefire.exe
Task: {F5AEFE07-36BD-4606-B64F-9560836F4046} - System32\Tasks\{1E0FD6B5-2302-4AEA-8820-152778EB53A5} => pcalua.exe -a "C:\Program Files\McAfee\msc\McActInst.exe" -d "C:\Program Files\McAfee\msc"
C:\Program Files\AVG Secure Search
C:\Program Files\Common Files\mcafee
C:\Program Files\McAfee
Task: C:\Windows\Tasks\ROC_JAN2013_TB_rmv.job => C:\Program Files\AVG Secure Search\PostInstall\ROC.exe
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => ""=""
FirewallRules: [{3D30FFC8-1FBD-4E02-BB2D-49894344AAE1}] => (Allow) C:\Users\cex\AppData\Local\iLivid\iLivid.exe
FirewallRules: [{172D564E-2FD7-4C14-90C1-59CE5C1C7988}] => (Allow) C:\Users\cex\AppData\Local\iLivid\iLivid.exe
CMD: bitsadmin /reset /allusers
CMD: netsh winsock reset catalog
CMD: ipconfig /flushdns
RemoveProxy:
hosts:
Emptytemp:

Click Format and ensure Wordwrap is unchecked.
Save as Fixlist.txt to your Desktop (Must be in this location)
Run FRST/FRST64 and press the Fix button just once and wait.
If the tool needed a restart please make sure you let the system to restart normally and let the tool completes its run after restart.
The tool will make a log on the Desktop (Fixlog.txt). Please post it to your reply.

Note: If the tool warns you about the version you're using being an outdated version please download and run the updated version.

Next

Please download AdwCleaner by Xplode onto your Desktop.

• Close all open programs and internet browsers.
• Double click on AdwCleaner.exe to run the tool.
• Click the Scan button and wait for the process to complete.
• Click the logfile button and the log will open in Notepad.
• NOTE: If you get an error message, it means that nothing was found. Exit from AdwCleaner.
• Click on the Clean button follow the prompts.
• A log file will automatically open after the scan has finished and the PC has rebooted.
• Please post the content of that log file with your next answer.
• You can find the log file at C:\AdwCleaner

Next

Please download Junkware Removal Tool to your Desktop.

Please close your security software to avoid potential conflicts. See Here how to disable you security protection (Anti Virus)
Run the tool by double-clicking it. If you are using Windows Vista or 7, right-mouse click it and select Run as administrator.
The tool will open and start scanning your system.
Please be patient as this can take a while to complete, depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your Desktop and will automatically open.
Please post the contents of JRT.txt into your reply.


In your next reply post;

• Fixlog.txt
• The AdwCleaner [SO].txt Log
• The JRT.txt Log

Thanks
Joe

[Totakeke]

Fix result of Farbar Recovery Scan Tool (x86) Version:08-08-2015 01
Ran by cex (2015-08-09 15:54:08) Run:1
Running from C:\Users\cex\Desktop
Loaded Profiles: cex (Available Profiles: cex)
Boot Mode: Normal

==============================================

fixlist content:
*****************
start
CloseProcesses:
CreateRestorePoint:
HKU\S-1-5-19\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid}
HKU\S-1-5-20\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid}
HKU\S-1-5-21-762790709-3562518967-1425496749-1000\...\Run: [AdobeBridge] => [X]
HKU\S-1-5-18\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid}
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\$McRebootA5E6DEAA56$.lnk [2013-04-27]
ShortcutTarget: $McRebootA5E6DEAA56$.lnk ->  (No File)
SearchScopes: HKU\S-1-5-21-762790709-3562518967-1425496749-1000 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-762790709-3562518967-1425496749-1000 -> F0D91DBEC41642B79CA2540BCAE36CB2 URL = http://search.fbdown...q={searchTerms}
SearchScopes: HKU\S-1-5-21-762790709-3562518967-1425496749-1000 -> {95B7759C-8C7F-4BF1-B163-73684A933233} URL = http://search.fbdown...q={searchTerms}
Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} -  No File
FF Plugin: @mcafee.com/MSC,version=10 -> c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL [No File]
S3 McAWFwk; c:\PROGRA~1\mcafee\msc\mcawfwk.exe [X]
2015-08-08 10:19 - 2013-01-29 20:56 - 00000342 _____ C:\Windows\Tasks\ROC_JAN2013_TB_rmv.job
2013-04-14 22:26 - 2013-04-14 22:26 - 0029144 _____ () C:\ProgramData\1365974758.bdinstall.bin
2013-04-14 22:29 - 2013-04-14 22:29 - 0030313 _____ () C:\ProgramData\1365974935.bdinstall.bin
2013-04-14 22:30 - 2013-04-14 22:30 - 0002046 _____ () C:\ProgramData\1365975035.4812.bin
2013-04-14 22:30 - 2013-04-14 22:30 - 0026989 _____ () C:\ProgramData\1365975035.6764.bin
2013-04-14 22:30 - 2013-04-14 22:30 - 0000433 _____ () C:\ProgramData\1365975035.7712.bin
2013-04-14 22:53 - 2013-04-14 22:53 - 0029144 _____ () C:\ProgramData\1365976098.bdinstall.bin
2013-04-14 23:13 - 2013-04-14 23:13 - 0030874 _____ () C:\ProgramData\1365977541.bdinstall.bin
2013-04-14 23:42 - 2013-04-14 23:42 - 0178802 _____ () C:\ProgramData\1365978322.bdinstall.bin
2013-04-20 21:59 - 2013-04-20 21:59 - 0022732 _____ () C:\ProgramData\1366491562.bdinstall.bin
2013-04-20 22:02 - 2013-04-20 22:02 - 0044712 _____ () C:\ProgramData\1366491594.bdinstall.bin
2013-04-20 22:11 - 2013-04-20 22:11 - 0074425 _____ () C:\ProgramData\1366492167.bdinstall.bin
Task: {BE056321-B449-4A13-B2BC-F04C83FC2D90} - System32\Tasks\ROC_JAN2013_TB_rmv => C:\Program Files\AVG Secure Search\PostInstall\ROC.exe
Task: {C84F95BF-70A3-4308-94DB-130FDAA37AEA} - System32\Tasks\{4398C708-D1D6-4BC3-BF24-C42709D2A372} => C:\Program Files\Common Files\mcafee\vscore\mfefire.exe
Task: {F5AEFE07-36BD-4606-B64F-9560836F4046} - System32\Tasks\{1E0FD6B5-2302-4AEA-8820-152778EB53A5} => pcalua.exe -a "C:\Program Files\McAfee\msc\McActInst.exe" -d "C:\Program Files\McAfee\msc"
C:\Program Files\AVG Secure Search
C:\Program Files\Common Files\mcafee
C:\Program Files\McAfee
Task: C:\Windows\Tasks\ROC_JAN2013_TB_rmv.job => C:\Program Files\AVG Secure Search\PostInstall\ROC.exe
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => ""=""
FirewallRules: [{3D30FFC8-1FBD-4E02-BB2D-49894344AAE1}] => (Allow) C:\Users\cex\AppData\Local\iLivid\iLivid.exe
FirewallRules: [{172D564E-2FD7-4C14-90C1-59CE5C1C7988}] => (Allow) C:\Users\cex\AppData\Local\iLivid\iLivid.exe
CMD: bitsadmin /reset /allusers
CMD: netsh winsock reset catalog
CMD: ipconfig /flushdns
RemoveProxy:
hosts:
Emptytemp:
*****************

Processes closed successfully.
Restore point was successfully created.
HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce\\IsMyWinLockerReboot => value removed successfully.
HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce\\IsMyWinLockerReboot => value removed successfully.
HKU\S-1-5-21-762790709-3562518967-1425496749-1000\Software\Microsoft\Windows\CurrentVersion\Run\\AdobeBridge => value removed successfully.
HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\RunOnce\\IsMyWinLockerReboot => value removed successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\$McRebootA5E6DEAA56$.lnk => moved successfully.
ShortcutTarget: $McRebootA5E6DEAA56$.lnk ->  (No File) not found.
HKU\S-1-5-21-762790709-3562518967-1425496749-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value removed successfully.
"HKU\S-1-5-21-762790709-3562518967-1425496749-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\F0D91DBEC41642B79CA2540BCAE36CB2" => key removed successfully.
HKCR\CLSID\F0D91DBEC41642B79CA2540BCAE36CB2 => key not found.
"HKU\S-1-5-21-762790709-3562518967-1425496749-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}" => key removed successfully.
HKCR\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233} => key not found.
"HKCR\PROTOCOLS\Filter\application/x-mfe-ipt" => key removed successfully.
HKCR\CLSID\{3EF5086B-5478-4598-A054-786C45D75692} => key not found.
"HKLM\Software\MozillaPlugins\@mcafee.com/MSC,version=10" => key removed successfully.
McAWFwk => service removed successfully.
C:\Windows\Tasks\ROC_JAN2013_TB_rmv.job => moved successfully.
C:\ProgramData\1365974758.bdinstall.bin => moved successfully.
C:\ProgramData\1365974935.bdinstall.bin => moved successfully.
C:\ProgramData\1365975035.4812.bin => moved successfully.
C:\ProgramData\1365975035.6764.bin => moved successfully.
C:\ProgramData\1365975035.7712.bin => moved successfully.
C:\ProgramData\1365976098.bdinstall.bin => moved successfully.
C:\ProgramData\1365977541.bdinstall.bin => moved successfully.
C:\ProgramData\1365978322.bdinstall.bin => moved successfully.
C:\ProgramData\1366491562.bdinstall.bin => moved successfully.
C:\ProgramData\1366491594.bdinstall.bin => moved successfully.
C:\ProgramData\1366492167.bdinstall.bin => moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{BE056321-B449-4A13-B2BC-F04C83FC2D90}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{BE056321-B449-4A13-B2BC-F04C83FC2D90}" => key removed successfully.
C:\Windows\System32\Tasks\ROC_JAN2013_TB_rmv => moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\ROC_JAN2013_TB_rmv" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{C84F95BF-70A3-4308-94DB-130FDAA37AEA}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C84F95BF-70A3-4308-94DB-130FDAA37AEA}" => key removed successfully.
C:\Windows\System32\Tasks\{4398C708-D1D6-4BC3-BF24-C42709D2A372} => moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{4398C708-D1D6-4BC3-BF24-C42709D2A372}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{F5AEFE07-36BD-4606-B64F-9560836F4046}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F5AEFE07-36BD-4606-B64F-9560836F4046}" => key removed successfully.
C:\Windows\System32\Tasks\{1E0FD6B5-2302-4AEA-8820-152778EB53A5} => moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{1E0FD6B5-2302-4AEA-8820-152778EB53A5}" => key removed successfully.
"C:\Program Files\AVG Secure Search" => File/Folder not found.
"C:\Program Files\Common Files\mcafee" => File/Folder not found.
"C:\Program Files\McAfee" => File/Folder not found.
C:\Windows\Tasks\ROC_JAN2013_TB_rmv.job not found.
"HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\MCODS" => key removed successfully.
HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{3D30FFC8-1FBD-4E02-BB2D-49894344AAE1} => value removed successfully.
HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{172D564E-2FD7-4C14-90C1-59CE5C1C7988} => value removed successfully.

=========  bitsadmin /reset /allusers =========


BITSADMIN version 3.0 [ 7.5.7601 ]
BITS administration utility.
© Copyright 2000-2006 Microsoft Corp.

BITSAdmin is deprecated and is not guaranteed to be available in future versions of Windows.
Administrative tools for the BITS service are now provided by BITS PowerShell cmdlets.

Unable to cancel {F9D77ABD-B847-4309-BDEA-3AE99485DFCE}.
Unable to cancel {D2036452-9829-4D20-9555-E991EA0F54A6}.
{26B1B272-672E-4DE0-A3C4-E38C5A6D3BF9} canceled.
{7762E7A4-1060-42F5-99AB-56B2580CD512} canceled.
{EE3A73A4-1844-4D88-B9AE-2A9E56DD75B4} canceled.
{0CCB6E11-A01A-4CC7-B51D-06706FED944B} canceled.
{102DB264-6CEE-4E41-92D6-22FFA4DB279B} canceled.
{9723116C-D63C-40F7-B61F-A21229D300CC} canceled.
{5EB1CD88-2B06-4235-BE77-AE4BE2A12D32} canceled.
{56E2AD9D-4109-4E7F-AF89-8AC200763DA2} canceled.
8 out of 10 jobs canceled.

========= End of CMD: =========


=========  netsh winsock reset catalog =========


Sucessfully reset the Winsock Catalog.
You must restart the computer in order to complete the reset.


========= End of CMD: =========


=========  ipconfig /flushdns =========


Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

========= End of CMD: =========


========= RemoveProxy: =========

HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value removed successfully.
HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value removed successfully.
HKU\S-1-5-21-762790709-3562518967-1425496749-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value removed successfully.
HKU\S-1-5-21-762790709-3562518967-1425496749-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value removed successfully.


========= End of RemoveProxy: =========

C:\Windows\System32\Drivers\etc\hosts => moved successfully.
Hosts restored successfully.
EmptyTemp: => 1.7 GB temporary data Removed.


The system needed a reboot.

==== End of Fixlog 16:08:00 ====

 

 

 

# AdwCleaner v4.208 - Logfile created 09/08/2015 at 16:41:41
# Updated 09/07/2015 by Xplode
# Database : 2015-08-01.1 [Server]
# Operating system : Windows 7 Starter Service Pack 1 (x86)
# Username : cex - MEI-PC
# Running from : C:\Users\cex\Desktop\adwcleaner_4.208.exe
# Option : Cleaning

***** [ Services ] *****


***** [ Files / Folders ] *****

Folder Deleted : C:\Users\cex\AppData\Roaming\Common\LuaRT
Folder Deleted : C:\Users\cex\AppData\Roaming\fbDownloader
Folder Deleted : C:\Users\cex\AppData\Roaming\Intermediate
Folder Deleted : C:\Users\cex\AppData\Roaming\SCheck
Folder Deleted : C:\Users\cex\AppData\Roaming\Seventh
Folder Deleted : C:\Users\cex\AppData\Roaming\Sixth
Folder Deleted : C:\Users\cex\AppData\Roaming\Snz
Folder Deleted : C:\Users\cex\AppData\Roaming\SSync
File Deleted : C:\Users\cex\AppData\Roaming\Mozilla\Firefox\Profiles\nhp6slw0.default-1390323229129\searchplugins\search.xml
File Deleted : C:\Program Files\Mozilla Firefox\browser\searchplugins\yahoo.xml

***** [ Scheduled tasks ] *****


***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Deleted : HKCU\Software\Classes\iLivid.torrent
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{94496571-6AC5-4836-82D5-D46260C44B17}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{C8E5E280-1BFD-4C1E-AFCA-D41A7DB23733}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{13ABD093-D46F-40DF-A608-47E162EC799D}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
Key Deleted : HKCU\Software\Cr_Installer
Key Deleted : HKCU\Software\ilivid
Key Deleted : HKCU\Software\OCS
Key Deleted : HKCU\Software\Protector
Key Deleted : HKCU\Software\Softonic
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{EE171732-BEB4-4576-887D-CB62727F01CA}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{43002AE2-4093-49E0-A03D-990EE184C568}

***** [ Web browsers ] *****

-\\ Internet Explorer v11.0.9600.17909


-\\ Mozilla Firefox v39.0.3 (x86 en-US)


-\\ Google Chrome v


*************************

AdwCleaner[R0].txt - [2346 bytes] - [09/08/2015 16:26:06]
AdwCleaner[R1].txt - [2405 bytes] - [09/08/2015 16:38:35]
AdwCleaner[S0].txt - [2378 bytes] - [09/08/2015 16:41:41]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [2437  bytes] ##########
 

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 7.5.5 (08.05.2015:1)
OS: Windows 7 Starter x86
Ran by cex on 09/08/2015 at 16:47:45.02
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Tasks

Successfully deleted: [Task] C:\Windows\System32\tasks\EgisUpdate



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{11111111-1111-1111-1111-110011441179}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110011441179}



~~~ Files



~~~ Folders

Successfully deleted: [Empty Folder] C:\Users\cex\Appdata\Local\{13A71823-17B2-4F1D-A342-A1A1A269CAA4}
Successfully deleted: [Empty Folder] C:\Users\cex\Appdata\Local\{1E245F76-19D4-4C20-916F-3D0B7B194E95}
Successfully deleted: [Empty Folder] C:\Users\cex\Appdata\Local\{1E260FE0-E976-428F-9D2A-344DCAAFAAB3}
Successfully deleted: [Empty Folder] C:\Users\cex\Appdata\Local\{28EE5C2C-F818-47C3-8BB5-7ED7F70D50ED}
Successfully deleted: [Empty Folder] C:\Users\cex\Appdata\Local\{295C7395-C12E-497A-8F0D-1DBE04EB7864}
Successfully deleted: [Empty Folder] C:\Users\cex\Appdata\Local\{458F08A0-5D14-446C-8763-E51BA977508E}
Successfully deleted: [Empty Folder] C:\Users\cex\Appdata\Local\{471F50DD-1AC9-457B-9D14-0E59C636F5C4}
Successfully deleted: [Empty Folder] C:\Users\cex\Appdata\Local\{49CDDD92-652C-4BA8-AB85-1DD29B90BF47}
Successfully deleted: [Empty Folder] C:\Users\cex\Appdata\Local\{4E8E4618-2040-4614-8A86-2C291812CE13}
Successfully deleted: [Empty Folder] C:\Users\cex\Appdata\Local\{5F675996-5612-4D3B-84CE-3853465F787C}
Successfully deleted: [Empty Folder] C:\Users\cex\Appdata\Local\{60882D74-331F-4DF7-A72B-CBCA4B1D0FAE}
Successfully deleted: [Empty Folder] C:\Users\cex\Appdata\Local\{8D28BFC9-BDB0-4B46-A922-5B5B2BF02975}
Successfully deleted: [Empty Folder] C:\Users\cex\Appdata\Local\{92D91437-5A43-49D0-8670-4D326502405A}
Successfully deleted: [Empty Folder] C:\Users\cex\Appdata\Local\{93E9C8D5-29D5-4CA3-8F9D-FE51D3FD5C09}
Successfully deleted: [Empty Folder] C:\Users\cex\Appdata\Local\{A5DB7AAB-82DB-4480-AF50-34F5A9977F3F}
Successfully deleted: [Empty Folder] C:\Users\cex\Appdata\Local\{A9E4C467-DC3D-4C14-AB92-8DA23A1D4F99}
Successfully deleted: [Empty Folder] C:\Users\cex\Appdata\Local\{C802F06E-E333-4F8D-9AFA-7C93AB3D8A7B}
Successfully deleted: [Empty Folder] C:\Users\cex\Appdata\Local\{D0D8FBED-EDF1-4BC9-B415-3D2D3679576B}
Successfully deleted: [Empty Folder] C:\Users\cex\Appdata\Local\{D6F23727-27BB-4C28-AB3E-69C14E2B3766}
Successfully deleted: [Empty Folder] C:\Users\cex\Appdata\Local\{DBC76A13-17CD-462B-B7DD-7ECF2A0DBFF8}
Successfully deleted: [Empty Folder] C:\Users\cex\Appdata\Local\{DFCDE384-AFFD-4843-8360-58E034181AB0}
Successfully deleted: [Empty Folder] C:\Users\cex\Appdata\Local\{E3221CED-153F-4170-A01D-F34FD933ABA4}
Successfully deleted: [Empty Folder] C:\Users\cex\Appdata\Local\{FBC150A0-C84C-4011-9473-0D7F8292A237}
Successfully deleted: [Empty Folder] C:\Users\cex\Appdata\Local\{FCAD57F4-EAD4-4DFA-A083-0D7C964AACBA}
Successfully deleted: [Empty Folder] C:\Users\cex\Appdata\Local\{FEF0D705-D188-44D7-B107-D80BDECC548C}



~~~ FireFox

Emptied folder: C:\Users\cex\AppData\Roaming\mozilla\firefox\profiles\nhp6slw0.default-1390323229129\minidumps [51 files]



~~~ Chrome


[C:\Users\cex\Appdata\Local\Google\Chrome\User Data\Default\Preferences] - default search provider reset

[C:\Users\cex\Appdata\Local\Google\Chrome\User Data\Default\Preferences] - Extensions Deleted:

[C:\Users\cex\Appdata\Local\Google\Chrome\User Data\Default\Secure Preferences] - default search provider reset

[C:\Users\cex\Appdata\Local\Google\Chrome\User Data\Default\Secure Preferences] - Extensions Deleted:





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 09/08/2015 at 16:56:04.32
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 

[zep516]

Hello,

Malwarebytes scan please.

If you already have Malwarebytes installed skip the download part;

• Please download Malwarebytes Anti-Malware to your desktop.
• Double-click mbam-setup-version.exe and follow the prompts to install the program.
• Launch Malwarebytes Anti-Malware
• Then click Finish.
• If an update is found, you will be prompted to download and install the latest version.
• Once the program has loaded, select Scan now. Or select the Threat Scan from the Scan menu.
• When the scan is complete , make sure that that all Threats are selected, and click Remove Selected.
• Reboot your computer if prompted.

Posting the Malwarebytes log.

• After the restart once you are back at your desktop, open MBAM once more.
• Click on the History tab > Application Logs.
• Double click on the Scan Log which shows the Date and time of the scan just performed.
• Click 'Export'.
• Click 'Text file (*.txt)'
• In the Save File dialog box which appears, click on Desktop.
• In the File name: box type a name for your scan log.
• A message box named 'File Saved' should appear stating "Your file has been successfully exported".
• Click Ok
• post that saved log to your next reply.

[Totakeke]

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 09/08/2015
Scan Time: 20:50
Logfile: Scanlog.txt
Administrator: Yes

Version: 2.1.8.1057
Malware Database: v2015.08.09.05
Rootkit Database: v2015.08.06.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x86
File System: NTFS
User: cex

Scan Type: Custom Scan
Result: Completed
Objects Scanned: 297876
Time Elapsed: 15 min, 11 sec

Memory: Enabled
Startup: Enabled
Filesystem: Disabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 0
(No malicious items detected)

Physical Sectors: 0
(No malicious items detected)


(end)

[zep516]

How is the computer now ?

Next

Download Security Check by screen317 from Here or Here
Save it to your Desktop.
Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
A Notepad document should open automatically called checkup.txt; please post the contents of that document.

NOTE: If SecurityCheck aborts and you get the following message: UNSUPPORTED OPERATING SYSTEM! ABORTED! try rebooting the system and then run SecurityCheck again.

[Totakeke]

It's running an awful lot faster now thanks to your help. The occasional crash here & there while I was running the scans but other then that it's much better & lot less frustrating then it was before.

 

 

 Results of screen317's Security Check version 1.006  
 Windows 7 Service Pack 1 x86 (UAC is enabled)  
 Internet Explorer 11  
``````````````Antivirus/Firewall Check:``````````````
 Windows Firewall Enabled!  
Microsoft Security Essentials   
 Antivirus up to date!  
`````````Anti-malware/Other Utilities Check:`````````
 Adobe Flash Player     18.0.0.209  
 Adobe Reader 10.1.13 Adobe Reader out of Date!  
 Mozilla Firefox (39.0.3)
````````Process Check: objlist.exe by Laurent````````  
 Microsoft Security Essentials MSMpEng.exe
 Microsoft Security Essentials msseces.exe
 Symantec Norton Online Backup NOBuAgent.exe  
`````````````````System Health check`````````````````
 Total Fragmentation on Drive C: 5%
````````````````````End of Log``````````````````````
 

[zep516]

OK.

Your Adobe reader needs updating. You should ensure you use the latest Adobe Acrobat Reader and install any security updates that are released. You can download the latest reader and updates from here.
Note Important: Please uncheck any optional offers before downloading.

Let me know when that is done and we can remove all the stuff I had you download.

[Totakeke]

My Adobe Reader is all updated now, what's next?

[zep516]

Hello,

Run Delfix to remove all tools and log files, Then I will close topic.

Download DelFix by Xplode and save it to your desktop.

• Run the tool by right click on the icon and Run as administrator option.
• Make sure that these ones are checked:
  • Remove disinfection tools
  • Purge system restore
  • Reset system settings
• Push Run.
• The program will run for a few seconds and display a notepad report.
  Paste it for my review.

[Totakeke]

Ok, here's the log.Thank you for all your help

 

 

# DelFix v1.010 - Logfile created 10/08/2015 at 00:30:08
# Updated 26/04/2015 by Xplode
# Username : cex - MEI-PC
# Operating System : Windows 7 Starter Service Pack 1 (32 bits)

~ Removing disinfection tools ...

Deleted : C:\FRST
Deleted : C:\AdwCleaner
Deleted : C:\log.txt
Deleted : C:\Users\cex\Desktop\Addition.txt
Deleted : C:\Users\cex\Desktop\adwcleaner_4.208.exe
Deleted : C:\Users\cex\Desktop\Fixlog.txt
Deleted : C:\Users\cex\Desktop\FRST.exe
Deleted : C:\Users\cex\Desktop\FRST.txt
Deleted : C:\Users\cex\Desktop\JRT.exe
Deleted : C:\Users\cex\Desktop\JRT.txt
Deleted : C:\Users\cex\Desktop\SecurityCheck.exe
Deleted : HKLM\SOFTWARE\AdwCleaner

########## - EOF - ##########

 

[zep516]

You're welcome

You usually get infected because your security settings are too low.

Here are a number of recommendations that will help tighten them, and which will contribute to making you a less likely victim:

Safe Computing Practices please read Here


Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.

Thanks
Joe