[rajinikanths]

In regular windows mode or in Safe Mode (with...)?

Thanks

[Advertisements]

regular

[RKinner]

regular

[rajinikanths]

Here are my actions:

I uninstalled, restarted and reinstalled. Same problem. Crash screenshot is attached.

I cleared eventvwr and ran VWV. Both System and Application are attached.

I ran the SpeedFan and the report was trying to open in Chrome (even though i changed the default to IE). I can see, for first time, it stayed 2 seconds up. It was trying to open SpeedFan links and again crashed. 

Uninstalled Chrome.

Reran Speedfan. Got the result in IE.

Link below:

http://www.hddstatus...cation=A7537DCC

 

Thanks again.

Attached Thumbnails

• 

Attached Files

•  VEW_ranWithSystemONLY_11122015.txt   453bytes   579 downloads
•  VEW_ranWithApplicationONLY_11122015.txt   468bytes   590 downloads

[RKinner]

Did you remove the default folder first before uninstalling and reinstalling Chrome?

 

Did you reboot after clearing the event logs?

[rajinikanths]

I removed default folder first then uninstalled then rebooted then installed.

I didnt restart after clearing the events. - I'M SORRY I just noticed reboot. Shall i now do it? 

[RKinner]

Yes please.  then run VEW again.

[rajinikanths]

Please find attached

Attached Files

•  VEW_ranWithSystemONLY_11122015_2.txt   2.02KB   599 downloads
•  VEW_ranWithApplicationONLY_11122015_2.txt   3.72KB   603 downloads

[rajinikanths]

Update: I just recall that, we ran FRST twice. When you asked to run for the second time, I booted the PC and it showed me a message (near clock as balloons...) that AVG is turned OFF and Windows Defender is expecting an Anti-Virus. Until then system did not even open AVG. After seeing those message, I thought first FRST helped. Then I went ahead and ran the 2nd FRST and we were working on the results from there. It occurred for me to tell you now so it may be of any help.

[RKinner]

Try to run the AVG removal program again and then when it fails, run VEW for Applications and post the log.  Sometimes it will tell you what went wrong.

 

Run FRST again with the Addition box checked, post both logs and we will try and remove AVG manually.

[rajinikanths]

I tried to run avg removal exe with 'RUN AS ADMIN' but did not react.

Ran VEW with Run as Admin, for applications. Log is attached please.

Ran FRST with Run as Admin and Addition selected. Both logs are attached.

 

Thanks again.

 

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:07-11-2015

Ran by Rajinikanth (administrator) on SARVESH-DSK (12-11-2015 13:42:11)

Running from C:\Users\Rajinikanth\Desktop

Loaded Profiles: Rajinikanth (Available Profiles: Rajinikanth & Deploy)

Platform: Windows 7 Professional Service Pack 1 (X64) Language: English (United States)

Internet Explorer Version 9 (Default browser: IE)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/

 

==================== Processes (Whitelisted) =================

 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

 

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe

(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSMonitorServicePDVD12.exe

(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe

(Nero AG) C:\Program Files (x86)\Common Files\Ahead\Lib\NMBgMonitor.exe

(Ralink Technology, Corp.) C:\Program Files (x86)\TP-LINK\COMMON\RaRegistry.exe

(BitTorrent Inc.) C:\Users\Rajinikanth\AppData\Roaming\uTorrent\uTorrent.exe

(Ralink Technology, Corp.) C:\Program Files (x86)\TP-LINK\COMMON\RaRegistry64.exe

(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe

(TP-LINK Technology, Corp.) C:\Program Files (x86)\TP-LINK\COMMON\TWCU.exe

() C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\AllShare\AllShareAgent.exe

(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMR\PowerDVD12DMREngine.exe

(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12Agent.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

(Nero AG) C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexingService.exe

(Nero AG) C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexStoreSvr.exe

(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe

(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTStackServer.exe

(BitTorrent Inc.) C:\Users\Rajinikanth\AppData\Roaming\uTorrent\updates\3.4.5_41202\utorrentie.exe

(BitTorrent Inc.) C:\Users\Rajinikanth\AppData\Roaming\uTorrent\updates\3.4.5_41202\utorrentie.exe

(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMP\CLHNServer\CLHNServiceForPowerDVD12.exe

(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe

 

 

==================== Registry (Whitelisted) ===========================

 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

 

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13374568 2011-12-13] (Realtek Semiconductor)

HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2754704 2015-06-24] (NVIDIA Corporation)

HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart

HKLM\...\Run: [igfxEM_64] => "C:\PROGRA~3\igfxEM_64.exe"

HKLM-x32\...\Run: [AVG_UI] => C:\Program Files (x86)\AVG\AVG2014\avgui.exe [5180432 2014-04-06] (AVG Technologies CZ, s.r.o.)

HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)

HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)

HKLM-x32\...\Run: [AllShareAgent] => C:\Program Files (x86)\Samsung\AllShare\AllShareAgent.exe [285072 2012-03-01] (Samsung Electronics Co., Ltd.)

HKLM-x32\...\Run: [PowerDVD12DMREngine] => C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMR\PowerDVD12DMREngine.exe [505872 2012-07-25] (CyberLink)

HKLM-x32\...\Run: [PowerDVD12Agent] => C:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12Agent.exe [374560 2012-07-25] (CyberLink Corp.)

HKU\S-1-5-21-1873260180-584723267-4080468776-1000\...\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] => C:\Program Files (x86)\Common Files\Ahead\Lib\NMBgMonitor.exe [152872 2007-06-27] (Nero AG)

HKU\S-1-5-21-1873260180-584723267-4080468776-1000\...\Run: [uTorrent] => C:\Users\Rajinikanth\AppData\Roaming\uTorrent\uTorrent.exe [1822048 2015-10-13] (BitTorrent Inc.)

HKU\S-1-5-21-1873260180-584723267-4080468776-1000\...\Run: [DAEMON Tools Lite Automount] => "C:\Program Files\DAEMON Tools Lite\DTAgent.exe" -autorun

Lsa: [Notification Packages] scecli C:\Program Files\WIDCOMM\Bluetooth Software\BtwProximityCP.dll

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk [2014-12-28]

ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\TP-LINK Wireless Client Utility.lnk [2012-07-05]

ShortcutTarget: TP-LINK Wireless Client Utility.lnk -> C:\Program Files (x86)\TP-LINK\COMMON\TWCU.exe (TP-LINK Technology, Corp.)

 

==================== Internet (Whitelisted) ====================

 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

 

Tcpip\Parameters: [DhcpNameServer] 192.168.1.254

Tcpip\..\Interfaces\{0B29B12F-5142-4420-935D-3E17F0E6FDDB}: [DhcpNameServer] 192.168.1.254

Tcpip\..\Interfaces\{492BB5EE-2F43-4084-A03B-2BF7904C8544}: [DhcpNameServer] 192.168.1.254

Tcpip\..\Interfaces\{69C927DF-D948-467A-8720-6ED730F92778}: [DhcpNameServer] 192.168.1.254

 

Internet Explorer:

==================

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION

HKU\S-1-5-21-1873260180-584723267-4080468776-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION

HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome

HKU\S-1-5-21-1873260180-584723267-4080468776-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKU\S-1-5-21-1873260180-584723267-4080468776-1000\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

SearchScopes: HKU\S-1-5-21-1873260180-584723267-4080468776-1000 -> {78CC8F23-5F76-4711-9F10-B19F78179064} URL = hxxps://search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=282369&p={searchTerms}

BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-12-18] (Adobe Systems Incorporated)

BHO-x32: RealNetworks Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll => No File

DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

 

FireFox:

========

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll [2012-03-29] ( Microsoft Corporation)

FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2015-08-25] (NVIDIA Corporation)

FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2015-08-25] (NVIDIA Corporation)

FF Plugin-x32: @real.com/nprndlchromebrowserrecordext;version=1.2.0 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll [No File]

FF Plugin-x32: @real.com/nprndlhtml5videoshim;version=1.2.0 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll [No File]

FF Plugin-x32: @realnetworks.com/npdlplugin;version=1 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll [No File]

FF Plugin-x32: @videolan.org/vlc,version=2.0.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2012-07-19] (VideoLAN)

FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll [2013-02-15] (Adobe Systems Inc.)

FF HKLM-x32\...\Firefox\Extensions: [{B1FC07E1-E05B-4567-8891-E63FBE545BA8}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext => not found

 

Chrome: 

=======

CHR Profile: C:\Users\Rajinikanth\AppData\Local\Google\Chrome\User Data\Default

CHR Extension: (Docs) - C:\Users\Rajinikanth\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-11-12]

CHR Extension: (Google Drive) - C:\Users\Rajinikanth\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-11-12]

CHR Extension: (Gmail) - C:\Users\Rajinikanth\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-11-12]

CHR HKLM-x32\...\Chrome\Extension: [idhngdhcfkoamngbedgpaokgjbnpdiji] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Chrome\Ext\realdownloader.crx <not found>

 

==================== Services (Whitelisted) ========================

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

S2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe [3645456 2014-04-18] (AVG Technologies CZ, s.r.o.)

S2 avgwd; C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe [291912 2014-03-27] (AVG Technologies CZ, s.r.o.)

R2 CLHNServiceForPowerDVD12; C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMP\CLHNServer\CLHNServiceForPowerDVD12.exe [90640 2012-07-25] (CyberLink Corp.)

R2 CyberLink PowerDVD 12 Media Server Monitor Service; C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSMonitorServicePDVD12.exe [78352 2012-07-25] (CyberLink)

R2 CyberLink PowerDVD 12 Media Server Service; C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe [295440 2012-07-25] (CyberLink)

R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1152656 2015-06-24] (NVIDIA Corporation)

R3 NMIndexingService; C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexingService.exe [279848 2007-06-27] (Nero AG)

R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1868432 2015-06-24] (NVIDIA Corporation)

R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [23007376 2015-06-24] (NVIDIA Corporation)

R2 RalinkRegistryWriter; C:\Program Files (x86)\TP-LINK\COMMON\RaRegistry.exe [374112 2011-03-14] (Ralink Technology, Corp.)

R2 RalinkRegistryWriter64; C:\Program Files (x86)\TP-LINK\COMMON\RaRegistry64.exe [451936 2011-03-14] (Ralink Technology, Corp.)

R2 RealNetworks Downloader Resolver Service; C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [38608 2012-08-09] ()

S3 TpMediaServer; C:\Program Files (x86)\TP-LINK\COMMON\RaMediaServer.exe [619872 2011-03-14] ()

S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-26] (Microsoft Corporation)

S3 Disc Soft Lite Bus Service; "C:\Program Files\DAEMON Tools Lite\DiscSoftBusService.exe" [X]

 

===================== Drivers (Whitelisted) ==========================

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [153368 2014-03-27] (AVG Technologies CZ, s.r.o.)

R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [237336 2014-04-18] (AVG Technologies CZ, s.r.o.)

R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [192792 2014-03-27] (AVG Technologies CZ, s.r.o.)

R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [236824 2014-03-27] (AVG Technologies CZ, s.r.o.)

R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [324376 2014-03-27] (AVG Technologies CZ, s.r.o.)

R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [130840 2014-03-31] (AVG Technologies CZ, s.r.o.)

R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [32536 2014-03-27] (AVG Technologies CZ, s.r.o.)

R1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [274200 2014-03-31] (AVG Technologies CZ, s.r.o.)

R3 bcbtums; C:\Windows\System32\drivers\bcbtums.sys [172760 2014-12-28] (Broadcom Corporation.)

R1 BIOS; C:\Windows\system32\drivers\BIOS64.sys [14136 2009-06-17] (BIOSTAR Group)

R1 BIOS; C:\Windows\SysWOW64\drivers\BIOS64.sys [14136 2009-06-17] (BIOSTAR Group)

R3 dtlitescsibus; C:\Windows\System32\DRIVERS\dtlitescsibus.sys [30264 2015-06-20] (Disc Soft Ltd)

S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)

S3 MPMFL; C:\Windows\System32\DRIVERS\MPMFL.sys [23272 2012-12-17] (Windows ® Server 2003 DDK provider)

R2 ntk_PowerDVD12; C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMP\CLHNServer\ntk_PowerDVD12_64.sys [83704 2012-06-20] (Cyberlink Corp.)

R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19600 2015-06-24] (NVIDIA Corporation)

R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [46768 2015-05-18] (NVIDIA Corporation)

S3 xb1usb; C:\Windows\System32\DRIVERS\xb1usb.sys [34016 2014-05-27] (Microsoft Corporation)

S3 ZG760_64; C:\Windows\System32\DRIVERS\WlanGZ64.SYS [493696 2006-08-17] (ZyDAS Technology Corporation)

S3 ZG760_64; C:\Windows\SysWOW64\DRIVERS\WlanGZ64.SYS [493696 2006-08-17] (ZyDAS Technology Corporation)

R2 {73526619-C24F-470B-9BED-53D455FBB5C6}; C:\Program Files (x86)\CyberLink\PowerDVD12\Common\NavFilter\000.fcl [147704 2012-08-10] (CyberLink Corp.)

S3 catchme; \??\C:\george2093g\catchme.sys [X]

 

==================== NetSvcs (Whitelisted) ===================

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

 

==================== One Month Created files and folders ========

 

(If an entry is included in the fixlist, the file/folder will be moved.)

 

2015-11-12 13:42 - 2015-11-12 13:42 - 00015123 _____ C:\Users\Rajinikanth\Desktop\FRST.txt

2015-11-12 13:41 - 2015-11-08 17:38 - 02198528 _____ (Farbar) C:\Users\Rajinikanth\Desktop\FRST64.exe

2015-11-12 13:40 - 2015-11-12 13:40 - 00003809 _____ C:\Users\Rajinikanth\Desktop\VEW_ranWithApplicationONLY_11122015_3_avgrem.txt

2015-11-12 13:09 - 2015-11-12 13:09 - 00003809 _____ C:\Users\Rajinikanth\Desktop\VEW_ranWithApplicationONLY_11122015_2.txt

2015-11-12 13:07 - 2015-11-12 13:08 - 00002069 _____ C:\Users\Rajinikanth\Desktop\VEW_ranWithSystemONLY_11122015_2.txt

2015-11-12 11:05 - 2015-11-12 11:05 - 00000091 _____ C:\Users\Rajinikanth\Desktop\speedfan report.txt

2015-11-12 10:57 - 2015-11-12 10:57 - 00000468 _____ C:\Users\Rajinikanth\Desktop\VEW_ranWithApplicationONLY_11122015.txt

2015-11-12 10:55 - 2015-11-12 10:56 - 00000453 _____ C:\Users\Rajinikanth\Desktop\VEW_ranWithSystemONLY_11122015.txt

2015-11-12 00:19 - 2015-11-12 00:19 - 00000000 ____D C:\Windows\CheckSur

2015-11-11 23:59 - 2015-11-11 23:42 - 564744309 _____ C:\Users\Rajinikanth\Desktop\Windows6.1-KB947821-v34-x64.msu

2015-11-11 20:59 - 2015-11-12 11:02 - 00000000 ____D C:\Program Files (x86)\SpeedFan

2015-11-11 20:59 - 2015-11-11 20:59 - 00001046 _____ C:\Users\Rajinikanth\Desktop\SpeedFan.lnk

2015-11-11 20:59 - 2015-11-11 20:59 - 00000045 _____ C:\Windows\SysWOW64\initdebug.nfo

2015-11-11 20:59 - 2015-11-11 20:59 - 00000000 ____D C:\Users\Rajinikanth\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpeedFan

2015-11-11 20:58 - 2015-11-11 20:31 - 02218504 _____ C:\Users\Rajinikanth\Desktop\instspeedfan451.exe

2015-11-11 20:28 - 2015-11-11 20:28 - 00007757 _____ C:\Users\Rajinikanth\Desktop\VEW_ranWithApplicationONLY.txt

2015-11-11 20:27 - 2015-11-11 20:27 - 00005558 _____ C:\Users\Rajinikanth\Desktop\VEW_ranWithSystemONLY.txt

2015-11-11 20:25 - 2015-11-12 13:39 - 00003809 _____ C:\VEW.txt

2015-11-11 20:24 - 2015-11-11 20:24 - 00061440 _____ ( ) C:\Users\Rajinikanth\Desktop\VEW.exe

2015-11-11 08:15 - 2015-11-11 08:15 - 00270920 _____ C:\Windows\Minidump\111115-17596-01.dmp

2015-11-11 01:02 - 2015-11-11 01:02 - 00018973 _____ C:\ComboFix.txt

2015-11-11 00:42 - 2015-11-11 00:42 - 00000000 ____D C:\ProgramData\RealNetworks

2015-11-11 00:41 - 2015-11-12 13:01 - 00000000 ____D C:\ProgramData\NVIDIA

2015-11-11 00:30 - 2015-11-11 08:15 - 374735438 _____ C:\Windows\MEMORY.DMP

2015-11-11 00:30 - 2015-11-11 00:30 - 00313944 _____ C:\Windows\Minidump\111115-18657-01.dmp

2015-11-10 23:01 - 2015-11-11 01:02 - 00000000 ____D C:\Qoobox

2015-11-10 23:01 - 2015-11-10 23:15 - 00000000 ____D C:\george

2015-11-10 23:01 - 2011-06-26 00:45 - 00256000 _____ C:\Windows\PEV.exe

2015-11-10 23:01 - 2010-11-07 11:20 - 00208896 _____ C:\Windows\MBR.exe

2015-11-10 23:01 - 2009-04-19 22:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe

2015-11-10 23:01 - 2000-08-30 18:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe

2015-11-10 23:01 - 2000-08-30 18:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe

2015-11-10 23:01 - 2000-08-30 18:00 - 00098816 _____ C:\Windows\sed.exe

2015-11-10 23:01 - 2000-08-30 18:00 - 00080412 _____ C:\Windows\grep.exe

2015-11-10 23:01 - 2000-08-30 18:00 - 00068096 _____ C:\Windows\zip.exe

2015-11-10 23:00 - 2015-11-10 23:30 - 00000000 ____D C:\Windows\erdnt

2015-11-10 22:58 - 2015-11-10 22:30 - 05638248 ____R (Swearware) C:\Users\Rajinikanth\Desktop\george.exe

2015-11-10 22:07 - 2015-11-10 21:35 - 01090912 _____ (AVG Technologies CZ, s.r.o.) C:\Users\Rajinikanth\Desktop\avg_remover_stf_x86_2011_1184.exe

2015-11-10 21:42 - 2015-11-10 21:34 - 05200384 _____ (AVAST Software) C:\Users\Rajinikanth\Desktop\aswmbr.exe

2015-11-10 21:32 - 2015-11-10 22:39 - 00003380 _____ C:\Windows\System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-1873260180-584723267-4080468776-1000

2015-11-09 19:03 - 2015-11-10 18:10 - 00000000 ____D C:\Windows\system32\MpEngineStore

2015-11-09 07:49 - 2015-11-10 22:39 - 00003258 _____ C:\Windows\System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-1873260180-584723267-4080468776-1000

2015-11-08 23:24 - 2015-11-08 23:24 - 00000036 _____ C:\Users\Rajinikanth\AppData\Local\housecall.guid.cache

2015-11-08 23:14 - 2015-11-08 23:14 - 00000000 ____D C:\Users\Rajinikanth\AppData\Roaming\QuickScan

2015-11-08 17:51 - 2015-11-12 13:42 - 00000000 ____D C:\FRST

2015-11-08 17:36 - 2015-11-08 17:44 - 00000000 ____D C:\Users\Rajinikanth\AppData\Roaming\tor

2015-11-08 16:42 - 2015-11-08 16:42 - 00007626 _____ C:\Users\Rajinikanth\AppData\Local\Resmon.ResmonCfg

2015-11-08 14:37 - 2015-11-09 11:08 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service

2015-11-08 14:37 - 2015-11-09 11:08 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox

2015-11-08 14:37 - 2015-11-08 15:24 - 00000000 ____D C:\Users\Rajinikanth\AppData\Local\Mozilla

2015-11-08 14:37 - 2015-11-08 14:37 - 00000000 ____D C:\Users\Rajinikanth\AppData\Roaming\Mozilla

2015-11-08 02:23 - 2015-11-12 13:03 - 00000000 ____D C:\Users\Rajinikanth\AppData\LocalLow\uTorrent

2015-10-23 20:26 - 2015-11-12 10:23 - 03474516 _____ C:\Windows\system32\CFG2228303646

2015-10-23 20:14 - 2015-10-23 20:14 - 00329496 _____ C:\Windows\Minidump\102315-55536-01.dmp

2015-10-23 20:11 - 2015-10-23 20:12 - 00000000 ___HD C:\ProgramData\{9A88E103-A20A-4EA5-8636-C73B709A5BF8}

2015-10-13 20:32 - 2015-10-13 20:32 - 00020679 _____ C:\Users\Rajinikanth\Downloads\32415815A0B4621400688F0BF2966D7FD3435D93.torrent

2015-10-13 20:31 - 2015-10-13 20:31 - 00019703 _____ C:\Users\Rajinikanth\Downloads\D6525C8CB07CBC6CE001A97541DAD408D4F1FFF0.torrent

2015-10-13 20:30 - 2015-10-13 20:30 - 00019715 _____ C:\Users\Rajinikanth\Downloads\81BA198ED92739B4BCEE99C90FF5EFA0B71069D4.torrent

2015-10-13 20:28 - 2015-10-13 20:28 - 00017607 _____ C:\Users\Rajinikanth\Downloads\D5A14DD9675E85750E60051FC86F0AB402E9443F.torrent

2015-10-13 20:24 - 2015-10-13 20:24 - 00013303 _____ C:\Users\Rajinikanth\Downloads\www.TamilRockers.com - Unnale Unnale 2006 Tamil 720p DVDRip x264 1.2GB ESubs.torrent

2015-10-13 20:23 - 2015-10-13 20:23 - 00012075 _____ C:\Users\Rajinikanth\Downloads\www.TamilRockers.com - VSOP (2015)1080p v2 HD - AVC - MP4 - 5.1 - 4.4GB - Tamil.mp4.torrent

2015-10-13 20:21 - 2015-10-13 20:21 - 00016196 _____ C:\Users\Rajinikanth\Downloads\www.TamilRockers.com - Baahubali (2015)1080p DVDRip - Tamil AAC 5.1 (Original) - 3GB ESubs.torrent

 

==================== One Month Modified files and folders ========

 

(If an entry is included in the fixlist, the file/folder will be moved.)

 

2015-11-12 13:42 - 2012-09-08 20:28 - 00000000 ____D C:\Users\Rajinikanth\AppData\Roaming\uTorrent

2015-11-12 13:11 - 2009-07-13 22:45 - 00026000 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2015-11-12 13:11 - 2009-07-13 22:45 - 00026000 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2015-11-12 13:10 - 2012-02-01 01:41 - 01428138 _____ C:\Windows\WindowsUpdate.log

2015-11-12 13:02 - 2009-07-13 22:51 - 00113848 _____ C:\Windows\setupact.log

2015-11-12 13:01 - 2009-07-13 23:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2015-11-12 11:04 - 2015-07-18 22:43 - 00000000 ____D C:\Program Files (x86)\Google

2015-11-12 11:04 - 2015-06-20 00:12 - 00000000 ____D C:\Users\Rajinikanth\AppData\Local\CrashDumps

2015-11-12 10:50 - 2009-07-13 23:13 - 00778834 _____ C:\Windows\system32\PerfStringBackup.INI

2015-11-12 10:30 - 2012-02-10 22:09 - 00000000 ____D C:\Users\Rajinikanth\AppData\Local\Google

2015-11-12 01:33 - 2012-02-10 22:09 - 00000000 ____D C:\Users\Rajinikanth\Desktop\Default

2015-11-11 08:15 - 2012-02-16 00:10 - 00000000 ____D C:\Windows\Minidump

2015-11-11 01:41 - 2010-11-20 21:47 - 00030802 _____ C:\Windows\PFRO.log

2015-11-11 01:00 - 2009-07-13 20:34 - 00000215 _____ C:\Windows\system.ini

2015-11-11 00:34 - 2012-08-24 15:37 - 00000000 ____D C:\Users\Rajinikanth\AppData\Roaming\vlc

2015-11-09 11:08 - 2014-07-23 17:08 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrok

2015-11-09 11:08 - 2014-07-23 17:07 - 00000000 ____D C:\Program Files (x86)\Acrok

2015-11-09 11:08 - 2012-08-01 12:42 - 00000000 ____D C:\Users\Deploy

2015-11-09 11:08 - 2009-07-13 21:20 - 00000000 ____D C:\Windows\system32\NDF

2015-11-09 11:08 - 2009-07-13 21:20 - 00000000 ____D C:\Windows\registration

2015-11-09 11:08 - 2009-07-13 21:20 - 00000000 ____D C:\Windows\AppCompat

2015-11-09 07:44 - 2012-02-01 01:40 - 00000000 ____D C:\Users\Rajinikanth

2015-11-08 19:23 - 2009-07-13 23:32 - 00000000 ____D C:\Windows\system32\FxsTmp

2015-11-08 14:32 - 2012-02-10 22:09 - 00000000 ____D C:\Users\Rajinikanth\AppData\Local\Deployment

2015-10-23 20:10 - 2012-02-10 23:53 - 00000000 ____D C:\ProgramData\MFAData

2015-10-21 14:37 - 2015-06-23 08:54 - 00003886 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task

 

==================== Files in the root of some directories =======

 

2012-08-01 23:29 - 2012-09-29 14:45 - 0015872 _____ () C:\Users\Rajinikanth\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

2015-11-08 23:24 - 2015-11-08 23:24 - 0000036 _____ () C:\Users\Rajinikanth\AppData\Local\housecall.guid.cache

2015-11-08 16:42 - 2015-11-08 16:42 - 0007626 _____ () C:\Users\Rajinikanth\AppData\Local\Resmon.ResmonCfg

 

==================== Bamital & volsnap =================

 

(There is no automatic fix for files that do not pass verification.)

 

C:\Windows\system32\winlogon.exe => File is digitally signed

C:\Windows\system32\wininit.exe => File is digitally signed

C:\Windows\SysWOW64\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\system32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\system32\services.exe => File is digitally signed

C:\Windows\system32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\system32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\system32\rpcss.dll => File is digitally signed

C:\Windows\system32\dnsapi.dll => File is digitally signed

C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed

C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

 

 

LastRegBack: 2015-11-11 15:05

 

==================== End of FRST.txt ============================

 

Additional scan result of Farbar Recovery Scan Tool (x64) Version:07-11-2015

Ran by Rajinikanth (2015-11-12 13:42:50)

Running from C:\Users\Rajinikanth\Desktop

Windows 7 Professional Service Pack 1 (X64) (2012-02-01 07:40:01)

Boot Mode: Normal

==========================================================

 

 

==================== Accounts: =============================

 

Administrator (S-1-5-21-1873260180-584723267-4080468776-500 - Administrator - Disabled)

Deploy (S-1-5-21-1873260180-584723267-4080468776-1003 - Administrator - Enabled) => C:\Users\Deploy

Guest (S-1-5-21-1873260180-584723267-4080468776-501 - Limited - Disabled)

HomeGroupUser$ (S-1-5-21-1873260180-584723267-4080468776-1002 - Limited - Enabled)

Rajinikanth (S-1-5-21-1873260180-584723267-4080468776-1000 - Administrator - Enabled) => C:\Users\Rajinikanth

 

==================== Security Center ========================

 

(If an entry is included in the fixlist, it will be removed.)

 

AV: AVG AntiVirus Free Edition 2014 (Disabled - Out of date) {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}

AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: AVG AntiVirus Free Edition 2014 (Disabled - Out of date) {B5F5C120-2089-702E-0001-553BB0D5A664}

 

==================== Installed Programs ======================

 

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

 

µTorrent (HKU\S-1-5-21-1873260180-584723267-4080468776-1000\...\uTorrent) (Version: 3.4.5.41202 - BitTorrent Inc.)

Acrok Video Converter Ultimate Ver 2.6.18.444 (HKLM-x32\...\{A3888E12-10A5-41E1-A22D-199F01964175}_is1) (Version:  - )

Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 3.1.0.4880 - Adobe Systems Incorporated)

Adobe Flash Player 11 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 11.3.300.257 - Adobe Systems Incorporated)

Adobe Reader X (10.1.6) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AA1000000001}) (Version: 10.1.6 - Adobe Systems Incorporated)

Apple Application Support (HKLM-x32\...\{5D09C772-ECB3-442B-9CC6-B4341C78FDC2}) (Version: 2.3.4 - Apple Inc.)

Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)

AVG 2014 (HKLM\...\AVG) (Version: 2014.0.4570 - AVG Technologies)

AVG 2014 (Version: 14.0.3964 - AVG Technologies) Hidden

AVG 2014 (Version: 14.0.4570 - AVG Technologies) Hidden

Bino (HKLM-x32\...\Bino) (Version: 1.4.4 - The Bino developers)

Cisco EAP-FAST Module (HKLM-x32\...\{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}) (Version: 2.2.14 - Cisco Systems, Inc.)

Cisco LEAP Module (HKLM-x32\...\{51C7AD07-C3F6-4635-8E8A-231306D810FE}) (Version: 1.0.19 - Cisco Systems, Inc.)

Cisco PEAP Module (HKLM-x32\...\{ED5776D5-59B4-46B7-AF81-5F2D94D7C640}) (Version: 1.1.6 - Cisco Systems, Inc.)

Core Temp 1.0 RC6 (HKLM\...\{086D343F-8E78-4AFC-81AC-D6D414AFD8AC}_is1) (Version: 1.0 - Alcpu)

CyberLink PowerDVD 12 (HKLM-x32\...\InstallShield_{B46BEA36-0B71-4A4E-AE41-87241643FA0A}) (Version: 12.0.1905.56 - CyberLink Corp.)

DAEMON Tools Lite (HKLM\...\DAEMON Tools Lite) (Version: 10.1.0.0074 - Disc Soft Ltd)

DirectVobSub (remove only) (HKLM-x32\...\DirectVobSub) (Version:  - )

Dolphin (HKLM-x32\...\Dolphin) (Version: 4.0.2 - Dolphin Development Team)

DVD Decrypter (Remove Only) (HKLM-x32\...\DVD Decrypter) (Version:  - )

DVD Shrink 3.2 (HKLM-x32\...\DVD Shrink_is1) (Version:  - DVD Shrink)

ffdshow v1.2.4475 [2012-07-12] (HKLM-x32\...\ffdshow_is1) (Version: 1.2.4475.0 - )

ffdshow x64 v1.2.4422 [2012-04-09] (HKLM\...\ffdshow64_is1) (Version: 1.2.4422.0 - )

Haali Media Splitter (HKLM-x32\...\HaaliMkx) (Version:  - )

Java 7 Update 65 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217065FF}) (Version: 7.0.650 - Oracle)

Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)

Microsoft .NET Framework 4 Extended (HKLM\...\Microsoft .NET Framework 4 Extended) (Version: 4.0.30319 - Microsoft Corporation)

Microsoft Silverlight (HKLM-x32\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 4.1.10329.0 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (HKLM-x32\...\{a1909659-0a08-4554-8af1-2175904903a1}) (Version: 11.0.60610.1 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (HKLM-x32\...\{95716cce-fc71-413f-8ad5-56c2892d4b3a}) (Version: 11.0.60610.1 - Microsoft Corporation)

Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005 (HKLM-x32\...\{7f51bdb9-ee21-49ee-94d6-90afc321780e}) (Version: 12.0.21005.1 - Microsoft Corporation)

Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)

Microsoft Xbox One Controller for Windows (HKLM\...\{DC2CB48C-FD96-48EB-A36A-7D995BB587EB}) (Version: 1.0.2 - Microsoft Corporation)

MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)

MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)

NEF Codec (HKLM-x32\...\{D6506521-0959-4FA3-875F-E2E28830B0D2}) (Version: 1.00.0000 - Nikon)

Nero 7 Premium (HKLM-x32\...\{CF097717-F174-4144-954A-FBC4BF301033}) (Version: 7.02.9753 - Nero AG)

Netflix in Windows Media Center (HKLM-x32\...\{0CA72D12-F6C6-4D43-A2A0-41F5AA17E2B6}) (Version: 3.3.101.0 - Microsoft Corporation)

NVIDIA 3D Vision Controller Driver 352.65 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 352.65 - NVIDIA Corporation)

NVIDIA 3D Vision Driver 355.82 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 355.82 - NVIDIA Corporation)

NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version: 1.4 - NVIDIA Corporation)

NVIDIA GeForce Experience 2.4.5.57 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.4.5.57 - NVIDIA Corporation)

NVIDIA Graphics Driver 355.82 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 355.82 - NVIDIA Corporation)

NVIDIA HD Audio Driver 1.3.34.3 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.34.3 - NVIDIA Corporation)

NVIDIA PhysX System Software 9.15.0428 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.15.0428 - NVIDIA Corporation)

QuickTime (HKLM-x32\...\{B67BAFBA-4C9F-48FA-9496-933E3B255044}) (Version: 7.74.80.86 - Apple Inc.)

RealDownloader (HKLM-x32\...\{A88E1685-1986-4A86-8E88-5FE1E727D026}) (Version: 1.2.0 - RealNetworks, Inc.)

Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6526 - Realtek Semiconductor Corp.)

Samsung AllShare (HKLM-x32\...\InstallShield_{DF47ACA3-7C78-4C08-8007-AC682563C9F1}) (Version: 2.1.0.12031_10 - Samsung Electronics Co., Ltd.)

Samsung AllShare (x32 Version: 2.1.0.12031_10 - Samsung Electronics Co., Ltd.) Hidden

SHIELD Streaming (Version: 4.1.2000 - NVIDIA Corporation) Hidden

SHIELD Wireless Controller Driver (Version: 2.4.5.57 - NVIDIA Corporation) Hidden

SpeedFan (remove only) (HKLM-x32\...\SpeedFan) (Version:  - )

Stereoscopic Player (HKLM-x32\...\{0B67DFA8-E3F5-4E1A-893E-526F9F4EFBAE}) (Version: 2.1.4 - 3dtv.at)

The Amazing Spider-Man 2 (HKLM-x32\...\VGhlQW1hemluZ1NwaWRlck1hbjI=_is1) (Version: 1 - )

TP-LINK Wireless Client Utility (HKLM-x32\...\{44D9C861-7B40-41E4-8A25-C9EBB9A7A59B}) (Version: 1.0.0.0 - TP-LINK)

Visual Studio 2008 x64 Redistributables (HKLM-x32\...\{FCDBEA60-79F0-4FAE-BBA8-55A26C609A49}) (Version: 10.0.0.2 - AVG Technologies)

Visual Studio 2010 x64 Redistributables (HKLM\...\{21B133D6-5979-47F0-BE1C-F6A6B304693F}) (Version: 13.0.0.1 - AVG Technologies)

Visual Studio 2012 x64 Redistributables (HKLM\...\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)

Visual Studio 2012 x86 Redistributables (HKLM-x32\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)

VLC media player 2.0.3 (HKLM-x32\...\VLC media player) (Version: 2.0.3 - VideoLAN)

WIDCOMM Bluetooth Software (HKLM\...\{A1439D4F-FD46-47F2-A1D3-FEE097C29A09}) (Version: 6.5.1.5800 - Broadcom Corporation)

Winamp (HKLM-x32\...\Winamp) (Version: 5.623  - Nullsoft, Inc)

Winamp Detector Plug-in (HKU\S-1-5-21-1873260180-584723267-4080468776-1000\...\Winamp Detect) (Version: 1.0.0.1 - Nullsoft, Inc)

WinRAR archiver (HKLM-x32\...\WinRAR archiver) (Version:  - )

Zoom Player (remove only) (HKLM-x32\...\ZoomPlayer) (Version:  - )

 

==================== Custom CLSID (Whitelisted): ==========================

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

 

==================== Restore Points =========================

 

24-10-2015 12:03:52 Scheduled Checkpoint

04-11-2015 01:00:00 Scheduled Checkpoint

11-11-2015 00:52:36 ComboFix created restore point

12-11-2015 00:19:22 Windows Update

 

==================== Hosts content: ===============================

 

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

 

2009-07-13 20:34 - 2015-11-10 23:29 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts

 

127.0.0.1       localhost

 

==================== Scheduled Tasks (Whitelisted) =============

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

Task: {131FA374-1CEC-40CA-A49E-89C0612A702A} - System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-1873260180-584723267-4080468776-1000 => C:\Program Files (x86)\RealNetworks\RealDownloader\realupgrade.exe [2012-08-09] (RealNetworks, Inc.)

Task: {344B00A9-28A4-4024-8984-B9EE747B1532} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-09-14] (Adobe Systems Incorporated)

Task: {4A84841C-490E-4949-BABE-B28D79525EFB} - System32\Tasks\RealDownloaderDownloaderScheduledTaskS-1-5-21-1873260180-584723267-4080468776-1000 => C:\Program Files (x86)\RealNetworks\RealDownloader\recordingmanager.exe [2012-08-09] (RealNetworks, Inc.)

Task: {7FA7D4CF-972A-4C49-8858-675A253F9D1B} - System32\Tasks\{A82A3F27-1291-4365-92C0-6F9A51DD842C} => pcalua.exe -a C:\Users\Rajinikanth\Downloads\NVIDIA_3DTV_Play_Activation_Utility.exe -d C:\Users\Rajinikanth\Downloads

Task: {F34F305F-7A71-4235-BD3B-996F13715D26} - System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-1873260180-584723267-4080468776-1000 => C:\Program Files (x86)\RealNetworks\RealDownloader\realupgrade.exe [2012-08-09] (RealNetworks, Inc.)

 

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

 

 

==================== Loaded Modules (Whitelisted) ==============

 

2014-07-24 23:29 - 2015-08-25 08:24 - 00116344 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll

2012-08-01 11:21 - 2006-12-11 01:14 - 00043008 _____ () C:\Program Files (x86)\WinRAR\rarext64.dll

2012-08-09 13:02 - 2012-08-09 13:02 - 00038608 _____ () C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe

2015-06-20 11:16 - 2015-06-24 05:37 - 00011920 _____ () C:\Program Files (x86)\NVIDIA Corporation\Update Core\detoured.dll

2012-07-05 21:58 - 2011-03-14 14:20 - 01033568 _____ () C:\Program Files (x86)\TP-LINK\COMMON\RaWLAPI.dll

2014-07-22 19:15 - 2011-08-23 20:39 - 00081920 _____ () C:\Program Files (x86)\CyberLink\PowerDVD12\Common\koan\_ctypes.pyd

2014-07-22 19:15 - 2011-08-23 20:39 - 00053248 _____ () C:\Program Files (x86)\CyberLink\PowerDVD12\Common\Koan\_socket.pyd

2014-07-22 19:15 - 2011-08-23 20:39 - 00655360 _____ () C:\Program Files (x86)\CyberLink\PowerDVD12\Common\Koan\_ssl.pyd

 

==================== Alternate Data Streams (Whitelisted) =========

 

(If an entry is included in the fixlist, only the ADS will be removed.)

 

AlternateDataStreams: C:\ProgramData\Temp:966F7784

 

==================== Safe Mode (Whitelisted) ===================

 

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

 

 

==================== EXE Association (Whitelisted) ===============

 

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)

 

 

==================== Internet Explorer trusted/restricted ===============

 

(If an entry is included in the fixlist, it will be removed from the registry.)

 

 

==================== Other Areas ============================

 

(Currently there is no automatic fix for this section.)

 

HKU\S-1-5-21-1873260180-584723267-4080468776-1000\Control Panel\Desktop\\Wallpaper -> 

DNS Servers: 192.168.1.254

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 0) (ConsentPromptBehaviorUser: 3) (EnableLUA: 0)

Windows Firewall is enabled.

 

==================== MSCONFIG/TASK MANAGER disabled items ==

 

(Currently there is no automatic fix for this section.)

 

MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

 

==================== FirewallRules (Whitelisted) ===============

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppsvc.exe

FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppsvc.exe

FirewallRules: [{05C92B3C-6F91-4727-B5E2-C5F47E9B739C}] => (Allow) C:\Program Files (x86)\AVG\AVG2012\avgmfapx.exe

FirewallRules: [{ED23FCD3-E64A-4A69-AA3D-E962709C632E}] => (Allow) C:\Program Files (x86)\AVG\AVG2012\avgmfapx.exe

FirewallRules: [{80E60713-E79F-4F81-BC9C-13547DE992A8}] => (Allow) C:\Program Files (x86)\AVG\AVG2013\avgmfapx.exe

FirewallRules: [{EBB45424-63FB-4586-8592-9B7CF2F2BEBB}] => (Allow) C:\Program Files (x86)\AVG\AVG2013\avgmfapx.exe

FirewallRules: [{62053721-4955-45F4-9FE0-E4575E9CCE78}] => (Allow) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\WebKit2WebProcess.exe

FirewallRules: [{0B568D35-36B1-4902-9B7F-A6BD7898EEDD}] => (Allow) C:\Users\Rajinikanth\AppData\Roaming\uTorrent\uTorrent.exe

FirewallRules: [{C760431E-D820-4526-B947-51B87764AF5B}] => (Allow) C:\Users\Rajinikanth\AppData\Roaming\uTorrent\uTorrent.exe

FirewallRules: [{71DEE1C1-9639-4DF5-A4D0-7CDA5F9DF73C}] => (Allow) C:\Program Files (x86)\AVG\AVG2014\avgmfapx.exe

FirewallRules: [{AF6DC200-E505-4BCF-B3D2-441483F5F5CE}] => (Allow) C:\Program Files (x86)\AVG\AVG2014\avgmfapx.exe

FirewallRules: [{311A8881-50A8-44EA-B75F-0BE337A29627}] => (Allow) C:\Program Files (x86)\AVG\AVG2014\avgnsa.exe

FirewallRules: [{15ABB10F-CCE5-480E-9F47-6EC50EAAF20E}] => (Allow) C:\Program Files (x86)\AVG\AVG2014\avgnsa.exe

FirewallRules: [{4786EF49-B082-4C87-ADF0-B0ACDF82CF59}] => (Allow) C:\Program Files (x86)\AVG\AVG2014\avgdiagex.exe

FirewallRules: [{BEB298F1-A394-4F45-9D4A-2A39BBCD0934}] => (Allow) C:\Program Files (x86)\AVG\AVG2014\avgdiagex.exe

FirewallRules: [{16A87A35-8ACD-48EB-B0C4-AD16CCF7C948}] => (Allow) C:\Program Files (x86)\AVG\AVG2014\avgemca.exe

FirewallRules: [{C0E80E3F-2D85-4D18-9285-1F125525648D}] => (Allow) C:\Program Files (x86)\AVG\AVG2014\avgemca.exe

FirewallRules: [{20630E71-8753-40CC-89D5-A2721CC764F7}] => (Allow) C:\Users\Rajinikanth\AppData\Roaming\uTorrent\uTorrent.exe

FirewallRules: [{FBACE9EB-5290-49D3-8838-EA66650AACA0}] => (Allow) C:\Users\Rajinikanth\AppData\Roaming\uTorrent\uTorrent.exe

FirewallRules: [{54D88887-1EB0-4877-B761-32B96AC350CF}] => (Allow) C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\AllShareDMS.exe

FirewallRules: [{4B677A69-39D5-4304-BAD1-9B58FB3CD739}] => (Allow) C:\Program Files (x86)\Samsung\AllShare\AllShare.exe

FirewallRules: [{80A54FE8-1F2F-49F1-BA8C-7196DB16311F}] => (Allow) C:\Program Files (x86)\Samsung\AllShare\AllShareAgent.exe

FirewallRules: [{1826B5AA-7DFF-42D1-A6F7-E3EBF9BBBB53}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12.exe

FirewallRules: [{640A2EEA-3BEF-4BF9-B5A1-3EFCC5E9CBFF}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMR\PowerDVD12DMREngine.exe

FirewallRules: [{7FA78D15-6C98-44EE-8416-E065D9105E4F}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe

FirewallRules: [{D8652F5F-CD63-4E67-BF4A-34BA5BDA02C3}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12Agent.exe

FirewallRules: [{FA29F28A-33C4-44A9-BE12-DEA7EAB0EC6B}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12ML.exe

FirewallRules: [{4171175C-AEFA-45C0-BCB7-5754DF7D3906}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD12\Movie\PowerDVD Cinema\PowerDVDCinema12.exe

FirewallRules: [{87114E3A-C8D5-40D8-94E4-7DE81512C1DD}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe

FirewallRules: [{37147F27-F833-4AE0-839F-90AF4562D83C}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe

FirewallRules: [{8B8E3BBA-A024-4FCB-9848-143C9941A720}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe

FirewallRules: [{A13146BC-562D-40D0-A2A8-B849C2EC526B}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe

FirewallRules: [{4FA1E622-66CF-4CF3-B19C-6D938D9C0E5C}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe

FirewallRules: [{BDCA63BB-3849-4F5B-B78D-008D6137E6F6}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe

FirewallRules: [TCP Query User{23BC1AFB-D708-48D8-A666-A7BB8AB8F9A8}C:\program files (x86)\flashget network\flashget 3\flashget3.exe] => (Allow) C:\program files (x86)\flashget network\flashget 3\flashget3.exe

FirewallRules: [UDP Query User{C1BBD96B-73C9-4E01-B249-9058E21A3A91}C:\program files (x86)\flashget network\flashget 3\flashget3.exe] => (Allow) C:\program files (x86)\flashget network\flashget 3\flashget3.exe

FirewallRules: [{4B950EF5-E7BC-4F71-BFDE-B6F6760C04DB}] => (Allow) C:\Program Files (x86)\Raptr\raptr.exe

FirewallRules: [{0BE6416B-9B0E-4859-80E6-4D983D72AC21}] => (Allow) C:\Program Files (x86)\Raptr\raptr.exe

FirewallRules: [{8DC997FB-4D7B-4C41-A647-F8ED32E9B95D}] => (Allow) C:\Program Files (x86)\Raptr\raptr_im.exe

FirewallRules: [{4624FBE1-8D93-447A-96AA-CE78DCF4D951}] => (Allow) C:\Program Files (x86)\Raptr\raptr_im.exe

FirewallRules: [{88CC2727-3FB4-4B59-8721-7EB53F20541C}] => (Allow) C:\Program Files (x86)\Raptr\raptr.exe

FirewallRules: [{9B5304FD-494A-4796-89C6-26DF13CA5704}] => (Allow) C:\Program Files (x86)\Raptr\raptr.exe

FirewallRules: [{DE377501-3E2F-49B4-A2B7-F0CC3DF5AE27}] => (Allow) C:\Program Files (x86)\Raptr\raptr_im.exe

FirewallRules: [{51A37D7E-2A40-49F7-872E-5775809B0257}] => (Allow) C:\Program Files (x86)\Raptr\raptr_im.exe

StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\FlashGet Network\FlashGet 3\FlashGet3.exe] => Enabled:Flashget3

 

==================== Faulty Device Manager Devices =============

 

 

==================== Event log errors: =========================

 

Application errors:

==================

Error: (11/12/2015 01:05:01 PM) (Source: SamsungAllShareV2.0) (EventID: 0) (User: )

Description: Service cannot be started. System.NullReferenceException: Object reference not set to an instance of an object.

   at AllShareDmsUtil.Configuration.ConfigurationManager.GetSharingFolderList()

   at AllShareDmsUtil.Manager.AllShareDmsManager.LoadSharingFolderList()

   at AllShareDmsUtil.Manager.AllShareDmsManager.InitContentsDirectoryManager()

   at AllShareDmsUtil.Manager.AllShareDmsManager.Initialize()

   at AllShareDmsUtil.Manager.AllShareDmsManager..ctor()

   at AllShareDmsUtil.Manager.AllShareDmsManager.get_Instance()

   at AllShareDMS.AllShareDMS.DoStart()

   at AllShareDMS.AllShareDMS.OnStart(String[] args)

   at System.ServiceProcess.ServiceBase.ServiceQueuedMainCallback(Object state)

 

Error: (11/12/2015 01:02:35 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

 

 

System errors:

=============

Error: (11/12/2015 01:01:29 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: The AVG WatchDog service failed to start due to the following error: 

%%1053

 

Error: (11/12/2015 01:01:29 PM) (Source: Service Control Manager) (EventID: 7009) (User: )

Description: A timeout was reached (30000 milliseconds) while waiting for the AVG WatchDog service to connect.

 

Error: (11/12/2015 01:01:29 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: The AVGIDSAgent service failed to start due to the following error: 

%%1053

 

Error: (11/12/2015 01:01:29 PM) (Source: Service Control Manager) (EventID: 7009) (User: )

Description: A timeout was reached (30000 milliseconds) while waiting for the AVGIDSAgent service to connect.

 

Error: (11/12/2015 12:59:02 PM) (Source: Service Control Manager) (EventID: 7043) (User: )

Description: The Windows Update service did not shut down properly after receiving a preshutdown control.

 

 

CodeIntegrity:

===================================

  Date: 2015-11-10 23:28:46.634

  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\george2093g\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

 

  Date: 2015-11-10 23:28:46.619

  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\george2093g\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

 

  Date: 2015-11-08 17:52:01.200

  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\l3codeca.acm because the set of per-page image hashes could not be found on the system.

 

  Date: 2015-11-08 16:55:44.832

  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\l3codeca.acm because the set of per-page image hashes could not be found on the system.

 

  Date: 2015-11-08 16:34:59.643

  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\l3codeca.acm because the set of per-page image hashes could not be found on the system.

 

  Date: 2015-11-08 16:24:01.402

  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\l3codeca.acm because the set of per-page image hashes could not be found on the system.

 

  Date: 2015-11-08 16:13:11.572

  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\l3codeca.acm because the set of per-page image hashes could not be found on the system.

 

  Date: 2015-11-08 16:04:35.170

  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\l3codeca.acm because the set of per-page image hashes could not be found on the system.

 

  Date: 2015-11-08 15:18:54.758

  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\l3codeca.acm because the set of per-page image hashes could not be found on the system.

 

  Date: 2015-11-08 13:09:04.533

  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\l3codeca.acm because the set of per-page image hashes could not be found on the system.

 

 

==================== Memory info =========================== 

 

Processor: AMD Athlon™ II X3 455 Processor

Percentage of memory in use: 48%

Total physical RAM: 8191.37 MB

Available physical RAM: 4257.76 MB

Total Virtual: 16382.73 MB

Available Virtual: 12861.56 MB

 

==================== Drives ================================

 

Drive c: () (Fixed) (Total:984.01 GB) (Free:63.42 GB) NTFS

Drive d: () (Fixed) (Total:878.91 GB) (Free:269.33 GB) NTFS

Drive g: (USB20FD) (Removable) (Total:14.92 GB) (Free:13.49 GB) FAT32

 

==================== MBR & Partition Table ==================

 

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 1863 GB) (Disk ID: B65E26BF)

Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=984 GB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=878.9 GB) - (Type=07 NTFS)

 

========================================================

Disk: 1 (Size: 14.9 GB) (Disk ID: 04030201)

Partition 1: (Not Active) - (Size=14.9 GB) - (Type=0C)

 

==================== End of Addition.txt ============================

Attached Files

•  VEW_ranWithApplicationONLY_11122015_3_avgrem.txt   3.72KB   571 downloads
•  FRST_11122015.txt   25.23KB   580 downloads
•  Addition_11122015.txt   25.56KB   607 downloads

[RKinner]

Sorry for the delay.  Had to take a nap.

 

 

Download the attached fixlist.txt to the same location as FRST

Run FRST and press Fix

A fix log will be generated please post that.  Run FRST again, check the Additions box and then Scan.  You will get two logs.  Post them both.

 

 

[rajinikanths]

No Problem, we all need a break.

 

Now I've done your steps partially and explained.

 

I've downloaded your fixlist and ran it in FRST64 (with Run as admin). I got the attached dialog after running asking me to reboot.

I left the dialog open. Please advise next step. This is the first time this message has come in my FRST run history.

Attached Thumbnails

• 

[RKinner]

Normal.  Click on OK and let it reboot.  The fixlog will be where it always is if it doesn't pop up/

[rajinikanths]

sure. then i'll rerun FRST64 (run as admin) with Addition option and share logs.

[rajinikanths]

Please find the Fix log for the fix run.

Please find the FRST and Addition log for the 2nd run.

Attached Files

•  Fixlog_11122015_Run1.txt   11.3KB   584 downloads
•  FRST_11122015_Run2.txt   20.71KB   584 downloads
•  Addition_11122015_Run2.txt   26.89KB   611 downloads