Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

Adware infection [Solved]

Started by Ornat , Jul 28 2016 12:10 PM

adware dnsunlocker

This topic is locked

#1
Ornat

Posted 28 July 2016 - 12:10 PM

Member

Member
16 posts

Hello,

It appears that my laptop has been infected with adware again... Norton has been alerting me that it has detected outbound traffic, and that the system is infected with Adware Gen 2.

There have been other signs of infection: I've noticed that I've been seeing more ads recently, even though I have Adblock plus enabled, and some ads have the tag DNS unlocker.

There has been another change today, as certain words in websites have turned into links, and when I hover over them a frame with an ad tagged with dns unlocker appears.

I've run the FRST scan, and pasted the log below.

Could you please help me solve this issue? Thank you!

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 27-07-2016

Ran by orna (administrator) on ORNA-PC (28-07-2016 20:55:25)

Running from C:\Users\orna\Desktop

Loaded Profiles: orna (Available Profiles: orna)

Platform: Windows 7 Ultimate Service Pack 1 (X64) Language: English (United States)

Internet Explorer Version 11 (Default browser: Chrome)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe

(Validity Sensors, Inc.) C:\Windows\System32\vcsFPService.exe

(AMD) C:\Windows\System32\atieclxx.exe

(Microsoft Corporation) C:\Windows\System32\wlanext.exe

(Conexant Systems, Inc.) C:\Program Files\CONEXANT\SA3\CxUtilSvc.exe

(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe

(Intel® Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\Jhi_service.exe

(Symantec Corporation) C:\Program Files (x86)\Norton Security with Backup\Engine\22.7.0.76\NSBU.exe

(Intel® Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE

(Symantec Corporation) C:\Program Files (x86)\Norton Security with Backup\Engine\22.7.0.76\NSBU.exe

(Intel® Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe

(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe

(Dell Inc.) C:\Program Files\Dell\QuickSet\quickset.exe

(Intel Corporation) C:\Windows\System32\igfxtray.exe

(Conexant Systems, Inc.) C:\Program Files\CONEXANT\SA3\SmartAudio3.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(Nero AG) C:\Program Files (x86)\Common Files\Ahead\Lib\NMBgMonitor.exe

(Nero AG) C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexingService.exe

(Nero AG) C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexStoreSvr.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe

(Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe

(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe

(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDGesture.exe

(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe

(Intel® Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe

(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe

(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe

(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe

(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe

(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Farbar) C:\Users\orna\Desktop\FRST64 (1).exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [IntelPROSet] => C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe [4802864 2012-06-25] (Intel® Corporation)

HKLM\...\Run: [IntelTBRunOnce] => wscript.exe //b //nologo "C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs"

HKLM\...\Run: [SmartAudio] => C:\Program Files\CONEXANT\SA3\SACpl.exe [1654400 2012-02-21] (Conexant Systems, Inc.)

HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [2774864 2013-01-09] (ELAN Microelectronics Corp.)

HKLM\...\Run: [QuickSet] => C:\Program Files\Dell\QuickSet\QuickSet.exe [5762408 2013-02-01] (Dell Inc.)

HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [446392 2012-04-04] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)

HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291280 2012-12-21] (Intel Corporation)

HKLM-x32\...\Run: [SwitchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [AdobeCS6ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [1073312 2012-03-09] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [Adobe Acrobat Speed Launcher] => C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe [36760 2011-09-28] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [Acrobat Assistant 8.0] => C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe [815512 2011-09-28] (Adobe Systems Inc.)

HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [343168 2012-03-05] (Advanced Micro Devices, Inc.)

HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [594992 2016-01-29] (Oracle Corporation)

Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)

HKU\S-1-5-21-1777430441-3061909375-455498286-1000\...\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] => C:\Program Files (x86)\Common Files\Ahead\Lib\NMBgMonitor.exe [153136 2007-03-12] (Nero AG)

HKU\S-1-5-21-1777430441-3061909375-455498286-1000\...\Run: [Google Update] => C:\Users\orna\AppData\Local\Google\Update\GoogleUpdate.exe [144200 2015-08-28] (Google Inc.)

HKU\S-1-5-21-1777430441-3061909375-455498286-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\Bubbles.scr [899584 2010-11-21] (Microsoft Corporation)

ShellIconOverlayIdentifiers: [ OverlayExcluded] -> {4433A54A-1AC8-432F-90FC-85F045CF383C} => C:\Program Files (x86)\Norton Security with Backup\Engine64\22.7.0.76\buShell.dll [2016-06-09] (Symantec Corporation)

ShellIconOverlayIdentifiers: [ OverlayPending] -> {F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225} => C:\Program Files (x86)\Norton Security with Backup\Engine64\22.7.0.76\buShell.dll [2016-06-09] (Symantec Corporation)

ShellIconOverlayIdentifiers: [ OverlayProtected] -> {476D0EA3-80F9-48B5-B70B-05E677C9C148} => C:\Program Files (x86)\Norton Security with Backup\Engine64\22.7.0.76\buShell.dll [2016-06-09] (Symantec Corporation)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 10.0.0.138

Tcpip\..\Interfaces\{3E9555D7-4FAD-4B1C-9CBD-101AB5350FEA}: [DhcpNameServer] 10.0.0.138

Tcpip\..\Interfaces\{89D5C277-3F85-4978-AAC1-5F710D3B89BE}: [DhcpNameServer] 10.0.0.138

Internet Explorer:

==================

HKU\S-1-5-21-1777430441-3061909375-455498286-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://www.google.co.il/?gfe_rd=cr&ei=mc0wu8p_gaek8qfjiohodq

BHO: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton Security with Backup\Engine64\22.7.0.76\coIEPlg.dll [2016-05-31] (Symantec Corporation)

BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation)

BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)

BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2016-04-27] (Google Inc.)

BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)

BHO-x32: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton Security with Backup\Engine\22.7.0.76\coIEPlg.dll [2016-05-31] (Symantec Corporation)

BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation)

BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_73\bin\ssv.dll [2016-02-20] (Oracle Corporation)

BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)

BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2016-04-27] (Google Inc.)

BHO-x32: Adobe PDF Conversion Toolbar Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2011-09-28] (Adobe Systems Incorporated)

BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)

BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_73\bin\jp2ssv.dll [2016-02-20] (Oracle Corporation)

BHO-x32: SmartSelect Class -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2011-09-28] (Adobe Systems Incorporated)

Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2016-04-27] (Google Inc.)

Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Security with Backup\Engine64\22.7.0.76\coIEPlg.dll [2016-05-31] (Symantec Corporation)

Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2011-09-28] (Adobe Systems Incorporated)

Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2016-04-27] (Google Inc.)

Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Security with Backup\Engine\22.7.0.76\coIEPlg.dll [2016-05-31] (Symantec Corporation)

Toolbar: HKU\S-1-5-21-1777430441-3061909375-455498286-1000 -> Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2016-04-27] (Google Inc.)

DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

FireFox:

========

FF Plugin: @microsoft.com/GENUINE -> disabled [No File]

FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59 -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll [2012-01-07] (Intel Corporation)

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2012-01-07] (Intel Corporation)

FF Plugin-x32: @java.com/DTPlugin,version=11.73.2 -> C:\Program Files (x86)\Java\jre1.8.0_73\bin\dtplugin\npDeployJava1.dll [2016-02-20] (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=11.73.2 -> C:\Program Files (x86)\Java\jre1.8.0_73\bin\plugin2\npjp2.dll [2016-02-20] (Oracle Corporation)

FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]

FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3508.0205 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2013-02-05] (Microsoft Corporation)

FF Plugin-x32: @millisecond.com/npInquisit,version=3.0 -> C:\Program Files (x86)\Millisecond Software\Inquisit 3.0 Mozilla Plugin\npInquisit_3060.dll [2011-10-26] (Millisecond Software)

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.30.3\npGoogleUpdate3.dll [2016-05-11] (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.30.3\npGoogleUpdate3.dll [2016-05-11] (Google Inc.)

FF Plugin-x32: @videolan.org/vlc,version=2.0.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2012-12-13] (VideoLAN)

FF Plugin-x32: Adobe Acrobat -> C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Air\nppdf32.dll [2011-09-28] (Adobe Systems Inc.)

FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2015-12-18] (Adobe Systems Inc.)

FF Plugin HKU\S-1-5-21-1777430441-3061909375-455498286-1000: @millisecond.com/npInquisit,version=3.0 -> C:\Program Files (x86)\Millisecond Software\Inquisit 3.0 Mozilla Plugin\npInquisit_3060.dll [2011-10-26] (Millisecond Software)

FF Plugin HKU\S-1-5-21-1777430441-3061909375-455498286-1000: @millisecond.com/npInquisit,version=4.0 -> C:\Users\orna\AppData\Roaming\Millisecond Software\Inquisit 4 Web Plugin\npInquisit.dll [2014-12-16] (Millisecond Software)

FF Plugin HKU\S-1-5-21-1777430441-3061909375-455498286-1000: @talk.google.com/GoogleTalkPlugin -> C:\Users\orna\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll [2015-12-08] (Google)

FF Plugin HKU\S-1-5-21-1777430441-3061909375-455498286-1000: @talk.google.com/O1DPlugin -> C:\Users\orna\AppData\Roaming\Mozilla\plugins\npo1d.dll [2015-12-08] (Google)

FF Plugin HKU\S-1-5-21-1777430441-3061909375-455498286-1000: @tools.google.com/Google Update;version=3 -> C:\Users\orna\AppData\Local\Google\Update\1.3.30.3\npGoogleUpdate3.dll [2016-05-11] (Google Inc.)

FF Plugin HKU\S-1-5-21-1777430441-3061909375-455498286-1000: @tools.google.com/Google Update;version=9 -> C:\Users\orna\AppData\Local\Google\Update\1.3.30.3\npGoogleUpdate3.dll [2016-05-11] (Google Inc.)

FF Plugin ProgramFiles/Appdata: C:\Users\orna\AppData\Roaming\mozilla\plugins\npgoogletalk.dll [2015-12-08] (Google)

FF Plugin ProgramFiles/Appdata: C:\Users\orna\AppData\Roaming\mozilla\plugins\npo1d.dll [2015-12-08] (Google)

FF HKLM\...\Firefox\Extensions: [{C1A2A613-35F1-4FCF-B27F-2840527B6556}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NSBU_22.7.0.76\coFFAddon

FF Extension: Norton Identity Safe - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NSBU_22.7.0.76\coFFAddon [2016-06-28]

FF HKLM-x32\...\Firefox\Extensions: [{C1A2A613-35F1-4FCF-B27F-2840527B6556}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NSBU_22.7.0.76\coFFAddon

Chrome:

=======

CHR HomePage: Default -> hxxp://www.haaretz.co.il/

CHR StartupUrls: Default -> "hxxp://www.google.com"

CHR Plugin: (Widevine Content Decryption Module) - C:\Users\orna\AppData\Local\Google\Chrome\User Data\WidevineCDM\1.4.6.758\_platform_specific\win_x86\widevinecdmadapter.dll => No File

CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\51.0.2704.106\PepperFlash\pepflashplayer.dll ()

CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\51.0.2704.106\pdf.dll => No File

CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)

CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)

CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll => No File

CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)

CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)

CHR Plugin: (Java Deployment Toolkit 8.0.250.18) - C:\Program Files (x86)\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll => No File

CHR Plugin: (Java™ Platform SE 8 U25) - C:\Program Files (x86)\Java\jre1.8.0_25\bin\plugin2\npjp2.dll => No File

CHR Plugin: (Inquisit Web Edition) - C:\Program Files (x86)\Millisecond Software\Inquisit 3.0 Mozilla Plugin\npInquisit_3060.dll (Millisecond Software)

CHR Plugin: (VLC Web Plugin) - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

CHR Plugin: (Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

CHR Plugin: (Google Update) - C:\Users\orna\AppData\Local\Google\Update\1.3.25.11\npGoogleUpdate3.dll => No File

CHR Plugin: (Google Talk Plugin) - C:\Users\orna\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)

CHR Plugin: (Google Talk Plugin Video Renderer) - C:\Users\orna\AppData\Roaming\Mozilla\plugins\npo1d.dll (Google)

CHR Profile: C:\Users\orna\AppData\Local\Google\Chrome\User Data\Default

CHR Extension: (Google Docs) - C:\Users\orna\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-02-05]

CHR Extension: (Google Drive) - C:\Users\orna\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-10-21]

CHR Extension: (YouTube) - C:\Users\orna\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-09-25]

CHR Extension: (Adblock Plus) - C:\Users\orna\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2016-06-29]

CHR Extension: (Google Search) - C:\Users\orna\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-10-27]

Data\Default\Extensions\dedhkkegfoejbekdhokkcfioegagdnbm [2016-07-28]

CHR Extension: (Google Docs Offline) - C:\Users\orna\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-03-16]

CHR Extension: (Pinterest Save Button) - C:\Users\orna\AppData\Local\Google\Chrome\User Data\Default\Extensions\gpdjojdkbbmdfjfahjcgigfpmkopogic [2016-07-21]

CHR Extension: (http://www.huffingtonpost.com/) - C:\Users\orna\AppData\Local\Google\Chrome\User Data\Default\Extensions\hhmpnckmgehfimbgndijbhbggdlhkchf [2016-07-28]

CHR Extension: (Windows Media Player Extension for HTML5) - C:\Users\orna\AppData\Local\Google\Chrome\User Data\Default\Extensions\hokdglbhghcebcopdbanieangmcamaak [2013-08-03] [UpdateUrl: hxxp://www.interoperabilitybridges.com/ChromeWMP/wmpChromeupdates.xml] <==== ATTENTION

CHR Extension: (http://www.ynet.co.i...340,L-8,00.html) - C:\Users\orna\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhbfbhcmdfpilbfondnkehgcddhffpdd [2016-07-28]

CHR Extension: (http://www.theguardian.com/uk) - C:\Users\orna\AppData\Local\Google\Chrome\User Data\Default\Extensions\mdhdkajgbikibncmfkonjpjpflefghfg [2016-07-28]

CHR Extension: (Chrome Web Store Payments) - C:\Users\orna\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-04-04]

CHR Extension: (Gmail) - C:\Users\orna\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-03-28]

CHR HKLM\...\Chrome\Extension: [cjabmdjcfcfdmffimndhafhblfmpjdpe] - C:\Program Files (x86)\Norton Security with Backup\Engine\22.7.0.76\Exts\Chrome.crx [2016-06-28]

CHR HKLM\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - hxxps://clients2.google.com/service/update2/crx

CHR HKLM-x32\...\Chrome\Extension: [cjabmdjcfcfdmffimndhafhblfmpjdpe] - C:\Program Files (x86)\Norton Security with Backup\Engine\22.7.0.76\Exts\Chrome.crx [2016-06-28]

CHR HKLM-x32\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - hxxps://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 CxUtilSvc; C:\Program Files\Conexant\SA3\CxUtilSvc.exe [109184 2013-05-09] (Conexant Systems, Inc.)

R2 IconMan_R; C:\Program Files (x86)\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe [2464400 2012-09-07] (Realsil Microelectronics Inc.)

R2 jhi_service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [161560 2012-01-21] (Intel Corporation)

S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [272688 2012-06-25] ()

R3 NMIndexingService; C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexingService.exe [271920 2007-03-12] (Nero AG)

R2 NSBU; C:\Program Files (x86)\Norton Security with Backup\Engine\22.7.0.76\NSBU.exe [289080 2016-06-17] (Symantec Corporation)

S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]

S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3325232 2012-06-25] (Intel® Corporation)

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R0 amdkmpfd; C:\Windows\System32\DRIVERS\amdkmpfd.sys [31872 2012-02-01] (Advanced Micro Devices, Inc.)

R1 BHDrvx64; C:\Program Files (x86)\Norton Security with Backup\NortonData\22.7.0.76\Definitions\BASHDefs\20160718.001\BHDrvx64.sys [1832176 2016-06-02] (Symantec Corporation)

R1 ccSet_NSBU; C:\Windows\system32\drivers\NSBUx64\1607000.04C\ccSetx64.sys [174328 2016-06-02] (Symantec Corporation)

S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)

R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [497392 2016-04-27] (Symantec Corporation)

R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [156912 2016-04-27] (Symantec Corporation)

R1 IDSVia64; C:\Program Files (x86)\Norton Security with Backup\NortonData\22.7.0.76\Definitions\IPSDefs\20160727.001\IDSvia64.sys [876760 2016-07-08] (Symantec Corporation)

R1 inpoutx64; C:\Windows\System32\drivers\inpoutx64.sys [15008 2012-09-04] (Highresolution Enterprises [www.highrez.co.uk])

R0 rtcrfilt64; C:\Windows\System32\DRIVERS\rtcrfilt64.sys [19600 2012-09-04] (Realtek Semiconductor Corp.)

R3 SRTSP; C:\Windows\system32\drivers\NSBUx64\1607000.04C\SRTSP64.SYS [773368 2016-07-20] (Symantec Corporation)

R1 SRTSPX; C:\Windows\system32\drivers\NSBUx64\1607000.04C\SRTSPX64.SYS [48888 2016-06-02] (Symantec Corporation)

R3 ST_ACCEL; C:\Windows\System32\DRIVERS\ST_ACCEL.sys [67184 2012-01-03] (STMicroelectronics)

R0 SymEFASI; C:\Windows\System32\drivers\NSBUx64\1607000.04C\SYMEFASI64.SYS [1627352 2016-06-02] (Symantec Corporation)

R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [101112 2016-06-28] (Symantec Corporation)

R1 SymIRON; C:\Windows\system32\drivers\NSBUx64\1607000.04C\Ironx64.SYS [291056 2016-06-02] (Symantec Corporation)

R1 SymNetS; C:\Windows\system32\drivers\NSBUx64\1607000.04C\SYMNETS.SYS [567536 2016-06-02] (Symantec Corporation)

S3 NAVENG; \??\C:\Program Files (x86)\Norton Security with Backup\NortonData\22.7.0.76\Definitions\SDSDefs\20160628.017\ENG64.SYS [X]

S3 NAVEX15; \??\C:\Program Files (x86)\Norton Security with Backup\NortonData\22.7.0.76\Definitions\SDSDefs\20160628.017\EX64.SYS [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-07-28 20:55 - 2016-07-28 20:55 - 00026167 _____ C:\Users\orna\Desktop\FRST.txt

2016-07-28 20:54 - 2016-07-28 20:55 - 00000000 ____D C:\FRST

2016-07-28 20:53 - 2016-07-28 20:53 - 02394112 _____ (Farbar) C:\Users\orna\Desktop\FRST64 (1).exe

2016-07-20 17:31 - 2016-07-20 17:31 - 00000000 ____D C:\Windows\EOONotify

2016-07-17 20:06 - 2016-07-17 20:06 - 19527360 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe

2016-07-13 11:31 - 2016-06-11 09:57 - 00394448 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll

2016-07-13 11:31 - 2016-06-11 07:48 - 00346320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll

2016-07-13 11:31 - 2016-06-11 00:38 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2016-07-13 11:31 - 2016-06-11 00:38 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll

2016-07-13 11:31 - 2016-06-11 00:20 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2016-07-13 11:31 - 2016-06-11 00:19 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec

2016-07-13 11:31 - 2016-06-11 00:19 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll

2016-07-13 11:31 - 2016-06-11 00:18 - 00572416 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2016-07-13 11:31 - 2016-06-11 00:18 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll

2016-07-13 11:31 - 2016-06-11 00:17 - 02895360 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2016-07-13 11:31 - 2016-06-11 00:10 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2016-07-13 11:31 - 2016-06-11 00:08 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2016-07-13 11:31 - 2016-06-11 00:05 - 25814016 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2016-07-13 11:31 - 2016-06-11 00:04 - 00615936 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2016-07-13 11:31 - 2016-06-11 00:03 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2016-07-13 11:31 - 2016-06-11 00:03 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe

2016-07-13 11:31 - 2016-06-11 00:02 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll

2016-07-13 11:31 - 2016-06-11 00:02 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2016-07-13 11:31 - 2016-06-10 23:53 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe

2016-07-13 11:31 - 2016-06-10 23:50 - 00489984 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll

2016-07-13 11:31 - 2016-06-10 23:49 - 06047744 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2016-07-13 11:31 - 2016-06-10 23:40 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll

2016-07-13 11:31 - 2016-06-10 23:38 - 00107520 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll

2016-07-13 11:31 - 2016-06-10 23:35 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2016-07-13 11:31 - 2016-06-10 23:34 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2016-07-13 11:31 - 2016-06-10 23:31 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2016-07-13 11:31 - 2016-06-10 23:28 - 00152064 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll

2016-07-13 11:31 - 2016-06-10 23:15 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll

2016-07-13 11:31 - 2016-06-10 23:13 - 00724992 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2016-07-13 11:31 - 2016-06-10 23:12 - 00806400 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2016-07-13 11:31 - 2016-06-10 23:11 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll

2016-07-13 11:31 - 2016-06-10 23:10 - 02131456 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2016-07-13 11:31 - 2016-06-10 22:45 - 15409664 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2016-07-13 11:31 - 2016-06-10 22:44 - 02869248 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2016-07-13 11:31 - 2016-06-10 22:30 - 01550848 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2016-07-13 11:31 - 2016-06-10 22:21 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2016-07-13 11:31 - 2016-06-10 22:09 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2016-07-13 11:31 - 2016-06-10 21:54 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2016-07-13 11:31 - 2016-06-10 21:53 - 00497664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2016-07-13 11:31 - 2016-06-10 21:53 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec

2016-07-13 11:31 - 2016-06-10 21:53 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll

2016-07-13 11:31 - 2016-06-10 21:52 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll

2016-07-13 11:31 - 2016-06-10 21:47 - 02287104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2016-07-13 11:31 - 2016-06-10 21:46 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2016-07-13 11:31 - 2016-06-10 21:45 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2016-07-13 11:31 - 2016-06-10 21:42 - 20348928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2016-07-13 11:31 - 2016-06-10 21:42 - 00476160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2016-07-13 11:31 - 2016-06-10 21:41 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll

2016-07-13 11:31 - 2016-06-10 21:41 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll

2016-07-13 11:31 - 2016-06-10 21:41 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2016-07-13 11:31 - 2016-06-10 21:32 - 00416256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll

2016-07-13 11:31 - 2016-06-10 21:27 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll

2016-07-13 11:31 - 2016-06-10 21:26 - 00091136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll

2016-07-13 11:31 - 2016-06-10 21:24 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll

2016-07-13 11:31 - 2016-06-10 21:23 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2016-07-13 11:31 - 2016-06-10 21:21 - 00279040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll

2016-07-13 11:31 - 2016-06-10 21:19 - 00130048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll

2016-07-13 11:31 - 2016-06-10 21:14 - 04608000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2016-07-13 11:31 - 2016-06-10 21:12 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll

2016-07-13 11:31 - 2016-06-10 21:10 - 00692736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2016-07-13 11:31 - 2016-06-10 21:09 - 02055680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2016-07-13 11:31 - 2016-06-10 21:09 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll

2016-07-13 11:31 - 2016-06-10 20:58 - 13806080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2016-07-13 11:31 - 2016-06-10 20:45 - 02392576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2016-07-13 11:31 - 2016-06-10 20:42 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2016-07-13 11:31 - 2016-06-10 20:41 - 01315840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2016-07-13 10:59 - 2016-06-26 03:27 - 00970240 _____ (Microsoft Corporation) C:\Windows\system32\localspl.dll

2016-07-13 10:59 - 2016-06-26 03:27 - 00756736 _____ (Microsoft Corporation) C:\Windows\system32\win32spl.dll

2016-07-13 10:59 - 2016-06-26 03:27 - 00344576 _____ (Microsoft Corporation) C:\Windows\system32\ntprint.dll

2016-07-13 10:59 - 2016-06-26 03:27 - 00166400 _____ (Microsoft Corporation) C:\Windows\system32\inetpp.dll

2016-07-13 10:59 - 2016-06-26 03:27 - 00022528 _____ (Microsoft Corporation) C:\Windows\system32\inetppui.dll

2016-07-13 10:59 - 2016-06-25 22:54 - 00497152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\win32spl.dll

2016-07-13 10:59 - 2016-06-25 22:53 - 00297472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntprint.dll

2016-07-13 10:59 - 2016-06-25 22:53 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\ntprint.exe

2016-07-13 10:59 - 2016-06-25 22:53 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\wpnpinst.exe

2016-07-13 10:59 - 2016-06-25 22:41 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntprint.exe

2016-07-13 10:58 - 2016-06-26 03:35 - 00041704 _____ (Microsoft Corporation) C:\Windows\system32\CompatTelRunner.exe

2016-07-13 10:58 - 2016-06-26 03:27 - 01208320 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

2016-07-13 10:58 - 2016-06-22 16:06 - 00268800 _____ (Microsoft Corporation) C:\Windows\system32\centel.dll

2016-07-13 10:58 - 2016-06-17 21:24 - 01490432 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll

2016-07-13 10:58 - 2016-06-17 21:24 - 00571904 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll

2016-07-13 10:58 - 2016-06-17 21:24 - 00544256 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll

2016-07-13 10:58 - 2016-06-17 21:24 - 00294912 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll

2016-07-13 10:58 - 2016-06-17 21:24 - 00219136 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll

2016-07-13 10:58 - 2016-06-17 21:24 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll

2016-07-13 10:58 - 2016-06-14 18:03 - 03217408 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2016-06-28 18:59 - 2016-06-28 18:59 - 00000000 ____D C:\Windows\System32\Tasks\Norton Security with Backup

2016-06-28 18:50 - 2016-06-28 18:50 - 00101112 _____ (Symantec Corporation) C:\Windows\system32\Drivers\SYMEVENT64x86.SYS

2016-06-28 18:50 - 2016-06-28 18:50 - 00008270 _____ C:\Windows\system32\Drivers\SYMEVENT64x86.CAT

2016-06-28 18:50 - 2016-06-28 18:50 - 00002520 _____ C:\Users\Public\Desktop\Norton Security with Backup.lnk

2016-06-28 18:49 - 2016-06-28 18:50 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton Security with Backup

2016-06-28 18:49 - 2016-06-28 18:49 - 00000000 ____D C:\Program Files (x86)\Norton Security with Backup

2016-06-28 18:48 - 2016-06-28 18:48 - 00000000 ____D C:\Program Files (x86)\NortonInstaller

2016-06-28 18:45 - 2016-06-28 18:55 - 00000000 ____D C:\Windows\System32\Tasks\Norton Remove and Reinstall

2016-06-28 18:38 - 2016-06-28 18:34 - 09406776 _____ (Symantec Corporation) C:\Users\orna\Desktop\NRnR.exe

2016-06-28 18:16 - 2016-06-28 18:50 - 00003240 _____ C:\Windows\System32\Tasks\Norton WSC Integration

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-07-28 20:50 - 2013-05-09 23:05 - 00000928 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2016-07-28 20:07 - 2013-09-01 10:07 - 00000934 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1777430441-3061909375-455498286-1000UA.job

2016-07-28 20:06 - 2013-05-09 22:58 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job

2016-07-28 16:15 - 2016-05-11 16:16 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2016-07-28 15:59 - 2009-07-14 07:45 - 00026576 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2016-07-28 15:58 - 2009-07-14 07:45 - 00026576 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2016-07-28 14:53 - 2013-05-09 23:08 - 00000000 ____D C:\Users\orna\AppData\Local\Adobe

2016-07-28 14:47 - 2009-07-14 08:13 - 00782510 _____ C:\Windows\system32\PerfStringBackup.INI

2016-07-28 14:47 - 2009-07-14 06:20 - 00000000 ____D C:\Windows\inf

2016-07-28 14:43 - 2013-05-09 22:45 - 00000000 ___HD C:\Windows\system32\WLANProfiles

2016-07-28 14:42 - 2009-07-14 08:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2016-07-28 09:07 - 2013-09-01 10:07 - 00000882 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1777430441-3061909375-455498286-1000Core.job

2016-07-27 21:04 - 2015-12-02 14:57 - 00000000 ____D C:\Windows\System32\Tasks\Remediation

2016-07-23 20:02 - 2013-05-15 10:48 - 00000000 ____D C:\Users\orna\AppData\Roaming\vlc

2016-07-21 13:08 - 2013-08-28 16:36 - 00000132 _____ C:\Users\orna\AppData\Roaming\Adobe PNG Format CS6 Prefs

2016-07-20 17:31 - 2015-04-05 20:27 - 00000000 ___SD C:\Windows\SysWOW64\GWX

2016-07-20 17:31 - 2015-04-05 20:27 - 00000000 ___SD C:\Windows\system32\GWX

2016-07-17 20:06 - 2013-05-09 22:58 - 00796352 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2016-07-17 20:06 - 2013-05-09 22:58 - 00142528 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2016-07-17 20:06 - 2013-05-09 22:58 - 00003768 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater

2016-07-17 20:06 - 2013-05-09 22:58 - 00000000 ____D C:\Windows\SysWOW64\Macromed

2016-07-17 20:06 - 2013-05-09 22:58 - 00000000 ____D C:\Windows\system32\Macromed

2016-07-14 08:29 - 2009-07-14 07:45 - 05043168 _____ C:\Windows\system32\FNTCACHE.DAT

2016-07-14 08:27 - 2014-12-11 06:53 - 00000000 ____D C:\Windows\system32\appraiser

2016-07-14 08:27 - 2010-11-21 10:16 - 00000000 ____D C:\Program Files\Windows Journal

2016-07-13 20:49 - 2013-07-20 22:15 - 00000000 ____D C:\Windows\system32\MRT

2016-07-13 20:45 - 2013-05-11 18:22 - 144749672 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2016-07-09 10:00 - 2013-05-09 23:07 - 00002195 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk

2016-07-09 10:00 - 2013-05-09 23:07 - 00002183 _____ C:\Users\Public\Desktop\Google Chrome.lnk

2016-07-03 19:06 - 2009-07-14 06:20 - 00000000 ____D C:\Windows\rescache

2016-06-28 18:50 - 2016-02-22 12:40 - 00000000 ____D C:\Program Files\Common Files\Symantec Shared

2016-06-28 18:49 - 2013-05-09 22:16 - 00000000 ____D C:\ProgramData\Norton

2016-06-28 18:36 - 2015-06-11 10:03 - 00000000 ____D C:\Program Files\Common Files\AV

2016-06-28 18:16 - 2016-02-22 12:39 - 00000000 ____D C:\Windows\system32\Drivers\NSBUx64

2016-06-28 16:06 - 2013-06-14 13:50 - 00000000 ____D C:\Users\Public\Downloads\Norton

==================== Files in the root of some directories =======

2014-01-19 19:09 - 2014-01-19 19:09 - 0000132 _____ () C:\Users\orna\AppData\Roaming\Adobe BMP Format CS6 Prefs

2013-08-28 16:36 - 2016-07-21 13:08 - 0000132 _____ () C:\Users\orna\AppData\Roaming\Adobe PNG Format CS6 Prefs

2013-05-09 22:47 - 2013-05-09 22:48 - 0005472 _____ () C:\Users\orna\AppData\Local\WiDiSetupLog.20130509.224752.txt

Some zero byte size files/folders:

==========================

C:\Windows\SysWOW64\clauth1.dll

C:\Windows\SysWOW64\clauth2.dll

C:\Windows\SysWOW64\nsprs.dll

C:\Windows\SysWOW64\serauth1.dll

C:\Windows\SysWOW64\serauth2.dll

C:\Windows\SysWOW64\ssprs.dll

==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed

C:\Windows\system32\wininit.exe => File is digitally signed

C:\Windows\SysWOW64\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\system32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\system32\services.exe => File is digitally signed

C:\Windows\system32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\system32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\system32\rpcss.dll => File is digitally signed

C:\Windows\system32\dnsapi.dll => File is digitally signed

C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed

C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2016-07-27 16:38

==================== End of FRST.txt ============================

#2
Dakeyras

Posted 28 July 2016 - 02:48 PM

Anti-Malware Mammoth

Expert
9,773 posts

Please note that all instructions given are customised for this computer only, the tools used may cause damage if used on a computer with different infections.

If you think you have similar problems, please post the appropriate logs in the Virus, Spyware, Malware Removal forum and wait for help.

Hi and welcome back to Geeks to Go.

I'm Dakeyras and I am going to try to assist you with your problem. Please take note of the below:

I will start working on your Malware issues, this may or may not, solve other issues you have with your machine.
The fixes are specific to your problem and should only be used for this issue on this machine!
The process is not instant. Please continue to review my answers until I tell you your machine is clear. Absence of symptoms does not mean that everything is clear.
If you don't know, stop and ask! Don't keep going on.
Please reply to this thread. Do not start a new topic.
Refrain from running self fixes as this will hinder the malware removal process.
It may prove beneficial if you print of the following instructions or save them to notepad as I post them.
Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.

Before we start:

Please be aware that removing Malware is a potentially hazardous undertaking. I will take care not to knowingly suggest courses of action that might damage your computer. However it is impossible for me to foresee all interactions that may happen between the software on your computer and those we'll use to clear you of infection, and I cannot guarantee the safety of your system. It is possible that we might encounter situations where the only recourse is to re-format and re-install your operating system, or to necessitate you taking your computer to a repair shop.

Because of this, I advise you to backup any personal files and folders before you start.

Next:

Could you please post the Farbar Recovery Scan Tool addition.txt log for my review. It should be located on your desktop.

We will then go from there, thank you.

#3
Ornat

Posted 28 July 2016 - 11:39 PM

Member

Topic Starter
Member
16 posts

Hi Dakeyras,

Thank you for helping

Here is the addition.txt:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 27-07-2016

Ran by orna (2016-07-28 20:55:55)

Running from C:\Users\orna\Desktop

Windows 7 Ultimate Service Pack 1 (X64) (2013-05-09 19:10:55)

Boot Mode: Normal

==========================================================

==================== Accounts: =============================

Administrator (S-1-5-21-1777430441-3061909375-455498286-500 - Administrator - Disabled)

Guest (S-1-5-21-1777430441-3061909375-455498286-501 - Limited - Disabled)

HomeGroupUser$ (S-1-5-21-1777430441-3061909375-455498286-1002 - Limited - Enabled)

orna (S-1-5-21-1777430441-3061909375-455498286-1000 - Administrator - Enabled) => C:\Users\orna

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Norton Security (Enabled - Up to date) {53C7D717-52E2-B95E-FA61-6F32ECC805DB}

AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: Norton Security (Enabled - Up to date) {E8A636F3-74D8-B6D0-C0D1-5440974F4F66}

FW: Norton Security (Enabled) {6BFC5632-188D-B806-D13E-C607121B42A0}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Acrobat Reader DC (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}) (Version: 15.010.20056 - Adobe Systems Incorporated)

Adobe Acrobat X Professional - Arabic, Hebrew, French, Greek (HKLM-x32\...\{AC76BA86-1037-0000-7760-000000000005}) (Version: 10.1.1 - Adobe Systems)

Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 3.1.0.4880 - Adobe Systems Incorporated)

Adobe Creative Suite 6 Design Standard (HKLM-x32\...\{0327A4BF-62BF-48BB-8928-B971B749E9E1}) (Version: 6 - Adobe Systems Incorporated)

Adobe Flash Player 22 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 22.0.0.210 - Adobe Systems Incorporated)

Adobe Help Manager (HKLM-x32\...\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 4.0.244 - Adobe Systems Incorporated)

AMD Catalyst Install Manager (HKLM\...\{D2EBABAC-7DA0-FAD4-7FAE-8D3C2EA779F3}) (Version: 3.0.859.0 - Advanced Micro Devices, Inc.)

Any Video Converter 5.0.7 (HKLM-x32\...\Any Video Converter_is1) (Version: - Any-Video-Converter.com)

Canon CanoScan LiDE 220 On-screen Manual (HKLM-x32\...\Canon CanoScan LiDE 220 On-screen Manual) (Version: 7.7.1 - Canon Inc.)

Canon IJ Scan Utility (HKLM-x32\...\Canon_IJ_Scan_Utility) (Version: 1.1.11.1 - Canon Inc.)

CanoScan LiDE 220 Scanner Driver (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_CNQ4811) (Version: 1.00 - Canon Inc.)

CCleaner (HKLM\...\CCleaner) (Version: 4.01 - Piriform)

Conexant HD Audio (HKLM-x32\...\{F0A37341-D692-11D4-A984-009027EC0A9C}) (Version: 1.0.30.0 - Conexant)

D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden

Dell Touchpad (HKLM\...\Elantech) (Version: 11.3.5.4 - ELAN Microelectronic Corp.)

Google Chrome (HKLM-x32\...\Google Chrome) (Version: 51.0.2704.106 - Google Inc.)

Google Talk Plugin (HKLM-x32\...\{F9B579C2-D854-300A-BE62-A09EB9D722E4}) (Version: 5.41.3.0 - Google)

Google Toolbar for Internet Explorer (HKLM-x32\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.7619.1252 - Google Inc.)

Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden

Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden

Google Update Helper (x32 Version: 1.3.30.3 - Google Inc.) Hidden

IBM SPSS Amos 21 (HKLM-x32\...\{304B71E3-1017-4717-86BC-F1D18519FEF2}) (Version: 21.0.0.0 - IBM Corp)

IBM SPSS Statistics 21 (HKLM\...\{1E26B9C2-ED08-4EEA-83C8-A786502B41E5}) (Version: 21.0.0.0 - IBM Corp)

Inquisit 3 by Millisecond Software (HKLM-x32\...\{A5060212-286B-4D6D-89E0-8EE1999C8BA9}) (Version: 3.0.6 - Millisecond Software, LLC)

Inquisit 4 (HKLM-x32\...\Inquisit 4 4.0.2) (Version: 4.0.2 - Millisecond Software)

Inquisit 4 (Version: 4.0.2 - Millisecond Software) Hidden

Inquisit 4 Web Player (HKLM\...\{E8620E4B-8567-4E07-8CDB-8432054BD5B2}) (Version: 4.0.8.0 - Millisecond Software)

Inquisit 4 Web Plugin (HKLM-x32\...\{C3F3FEB3-0E64-4649-920D-24B6C3EBBF6D}) (Version: 4.0.8.0 - Millisecond Software)

Intel® Display Audio Driver (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 6.14.00.3090 - Intel Corporation)

Intel® Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.0.1.1399 - Intel Corporation)

Intel® PROSet/Wireless for Bluetooth® + High Speed (HKLM\...\{BEE86606-EFB5-4353-9F34-29E0C59CDCFA}) (Version: 15.2.0.0284 - Intel Corporation)

Intel® Turbo Boost Technology Monitor 2.6 (HKLM\...\{6C9365EB-1F9E-4893-9196-3EC77C88D0C5}) (Version: 2.6.2.0 - Intel)

Intel® USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 1.0.7.248 - Intel Corporation)

Intel® Trusted Connect Service Client (HKLM\...\{538B98C3-773F-4F20-9C66-802D104DCBE2}) (Version: 1.23.219.2 - Intel Corporation)

Java 8 Update 73 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218073F0}) (Version: 8.0.730.2 - Oracle Corporation)

Kinovea (HKLM-x32\...\Kinovea) (Version: 0.8.15 - Kinovea)

Malwarebytes Anti-Malware version 2.2.1.1043 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.1.1043 - Malwarebytes)

Microsoft .NET Framework 4.6.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.6.01055 - Microsoft Corporation)

Microsoft Office Professional Plus 2010 (HKLM-x32\...\Office14.PROPLUSR) (Version: 14.0.7015.1000 - Microsoft Corporation)

Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)

Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)

Movie Maker (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden

MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)

MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)

Nero 7 Premium (HKLM-x32\...\{43FFE159-3199-4188-A1CD-629166AD1033}) (Version: 7.02.6445 - Nero AG)

Norton Security (HKLM-x32\...\NSBU) (Version: 22.7.0.76 - Symantec Corporation)

PDF Settings CS6 (x32 Version: 11.0 - Adobe Systems Incorporated) Hidden

PowerXpressHybrid (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden

PX Profile Update (x32 Version: 1.00.1. - AMD) Hidden

Quickset64 (HKLM\...\{87CF757E-C1F1-4D22-865C-00C6950B5258}) (Version: 10.15.017 - Dell Inc.)

Realtek Ethernet Controller All-In-One Windows Driver (HKLM-x32\...\{F7E7F0CB-AA41-4D5A-B6F2-8E6738EB063F}) (Version: 7.54.309.2012 - Realtek)

Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.2.8400.39034 - Realtek Semiconductor Corp.)

Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)

Skype™ 7.6 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.6.103 - Skype Technologies S.A.)

ST Microelectronics 3 Axis Digital Accelerometer Solution (HKLM-x32\...\{9C24F411-9CA7-4A8A-91F3-F08A4A38EB31}) (Version: 4.11.0018 - ST Microelectronics)

Validity Sensors DDK (HKLM\...\{40BEDF44-88CF-4FF6-8790-882484452003}) (Version: 4.4.231.0 - Validity Sensors, Inc.)

VLC media player 2.0.5 (HKLM-x32\...\VLC media player) (Version: 2.0.5 - VideoLAN)

Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3508.0205 - Microsoft Corporation)

WinRAR 4.20 (64-bit) (HKLM\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)

תוכנת Intel®‎ PROSet/Wireless WiFi (HKLM\...\{181BBF43-CA17-4E1A-A78D-81E67A57B8A4}) (Version: 15.02.0000.1258 - Intel Corporation)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {0A270FDA-8E86-4961-A7A8-402143549533} - System32\Tasks\{347B8B46-0F23-4560-AE3F-A94C99F1B7A5} => pcalua.exe -a D:\Downloads\Video_Intel_W74_X09_A03_Setup-HWM8D_ZPE.exe -d D:\Downloads

Task: {1C126122-E28B-4FE8-8FF7-F7F26B15FDAD} - System32\Tasks\Norton WSC Integration => C:\Program Files (x86)\Norton Security with Backup\Engine\22.7.0.76\WSCStub.exe [2016-06-17] (Symantec Corporation)

Task: {3403BA25-149B-4E27-8D94-18ABDCC46AB1} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-12-18] (Adobe Systems Incorporated)

Task: {3AD2AB73-0CA0-4735-8AAE-B17B8DB9AD2A} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-30] (Google Inc.)

Task: {3E4207EC-510C-4907-9C19-A8F96E5E3CD4} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1777430441-3061909375-455498286-1000Core => C:\Users\orna\AppData\Local\Google\Update\GoogleUpdate.exe [2015-08-28] (Google Inc.)

Task: {50FB994A-561E-4C76-9D61-C098341C758F} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-04-23] (Piriform Ltd)

Task: {55244BEE-9C7C-4485-8A74-6B1AC05BA3F9} - System32\Tasks\Games\UpdateCheck_S-1-5-21-1777430441-3061909375-455498286-1000

Task: {5E9DDE9D-FD6B-49C6-8E00-D3CD7E6AE5D1} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1777430441-3061909375-455498286-1000UA => C:\Users\orna\AppData\Local\Google\Update\GoogleUpdate.exe [2015-08-28] (Google Inc.)

Task: {62716787-922B-4F3F-B4EC-FBB2D0F0CD2F} - System32\Tasks\{1C74070F-461B-424B-9F6B-6685EE8CF233} => pcalua.exe -a D:\Documents\programs\OKB4x0W64PCL_ENUS120\setup.exe -d D:\Documents\programs\OKB4x0W64PCL_ENUS120

Task: {6766A82C-5598-466D-A6B1-7598E8881A0A} - System32\Tasks\Norton Security with Backup\Norton Error Analyzer => C:\Program Files (x86)\Norton Security with Backup\Engine\22.7.0.76\SymErr.exe [2016-05-23] (Symantec Corporation)

Task: {794FCEED-9FB8-4B28-8093-63D07EAC32F0} - System32\Tasks\Remediation\AntimalwareMigrationTask => C:\Program Files\Common Files\AV\Norton Security\Upgrade.exe [2016-06-17] (Symantec Corporation)

Task: {902D21A6-CABB-4EFB-8622-1AA4918981B9} - System32\Tasks\Microsoft\Windows\Setup\EOONotify => C:\Windows\EOONotify\EOONotify.exe [2016-07-08] (Microsoft Corporation)

Task: {9AC79200-1791-4684-8E20-3AD7EA949E9B} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2016-07-17] (Adobe Systems Incorporated)

Task: {B00C6E94-6CDB-4260-9139-A6A9FE8F7AE4} - System32\Tasks\{4B1C149F-DBED-44F3-87B9-97477F8926AD} => Chrome.exe hxxp://www.skype.com/go/downloading?source=lightinstaller&ver=6.7.0.102&LastError=12002

Task: {F113C6E1-6A25-4808-93DF-4C4B2FB6FDA5} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-30] (Google Inc.)

Task: {F2136ED2-A900-40AC-A759-861BC54D7852} - System32\Tasks\Norton Security with Backup\Norton Error Processor => C:\Program Files (x86)\Norton Security with Backup\Engine\22.7.0.76\SymErr.exe [2016-05-23] (Symantec Corporation)

Task: {FD9CA62B-32C9-4215-949B-2D054040087B} - System32\Tasks\AdobeAAMUpdater-1.0-orna-PC-orna => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2012-04-04] (Adobe Systems Incorporated)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1777430441-3061909375-455498286-1000Core.job => C:\Users\orna\AppData\Local\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1777430441-3061909375-455498286-1000UA.job => C:\Users\orna\AppData\Local\Google\Update\GoogleUpdate.exe

==================== Shortcuts =============================

(The entries could be listed to be restored or removed.)

==================== Loaded Modules (Whitelisted) ==============

2013-09-05 01:17 - 2013-09-05 01:17 - 04300456 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF

2010-10-20 15:23 - 2010-10-20 15:23 - 08801632 _____ () C:\Program Files\Microsoft Office\Office14\1033\GrooveIntlResource.dll

2013-05-09 23:21 - 2012-04-05 14:55 - 00164992 _____ () C:\Program Files\Conexant\SA3\MaxxAudioWrapper.dll

2012-03-19 19:09 - 2012-03-19 19:09 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll

2012-03-05 04:43 - 2012-03-05 04:43 - 00369152 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll

2012-04-06 10:17 - 2012-04-06 10:17 - 00016384 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll

2013-05-09 23:24 - 2012-01-21 03:23 - 01198872 _____ () C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\ACE.dll

2013-09-05 01:14 - 2013-09-05 01:14 - 04300456 _____ () C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF

2010-10-20 15:45 - 2010-10-20 15:45 - 08801120 _____ () C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveIntlResource.dll

2016-03-16 09:45 - 2014-02-10 13:44 - 04592128 _____ () C:\Users\orna\AppData\Local\Google\Chrome\User Data\SwiftShader\3.2.6.45159\libglesv2.dll

2016-03-16 09:45 - 2014-02-10 13:44 - 00112128 _____ () C:\Users\orna\AppData\Local\Google\Chrome\User Data\SwiftShader\3.2.6.45159\libegl.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)

==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 05:34 - 2009-06-11 00:00 - 00000824 ____N C:\Windows\system32\Drivers\etc\hosts

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-1777430441-3061909375-455498286-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\orna\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg

DNS Servers: 10.0.0.138

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)

Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [{C074C035-D4D0-4ABD-8C9B-8D03F5E9DE03}] => (Allow) C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe

FirewallRules: [{81ABDC45-A098-43CC-94CC-E75CDAADEF3E}] => (Allow) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer.exe

FirewallRules: [{6FE92191-4EF4-48A3-B0DE-2B799F2A35B1}] => (Allow) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer.exe

FirewallRules: [{A33AA38F-7353-4AA6-826A-3B1806E23122}] => (Allow) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe

FirewallRules: [{B2184E67-ED37-4339-9608-948AFA0AF910}] => (Allow) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe

FirewallRules: [{201AE0F8-FC94-42DB-B36E-B176BE83B357}] => (Allow) C:\Program Files\IBM\SPSS\Statistics\21\WinWrapIDE.exe

FirewallRules: [{A23C39C8-6515-44DC-9B13-59AFA5119B88}] => (Allow) C:\Program Files\IBM\SPSS\Statistics\21\stats.exe

FirewallRules: [{854B5759-2676-42C7-9FE5-6C1EFD661B87}] => (Allow) C:\Program Files\IBM\SPSS\Statistics\21\stats.com

FirewallRules: [{BB7322DF-2F70-43BE-81E5-E37AB096DC7D}] => (Allow) C:\Program Files\IBM\SPSS\Statistics\21\WinWrapIDE.exe

FirewallRules: [{21570984-9660-40DB-91CB-0D656AFAE7CC}] => (Allow) C:\Program Files\IBM\SPSS\Statistics\21\stats.com

FirewallRules: [{30E0CBB6-8EA7-4C85-99A0-B8703E18EBB4}] => (Allow) C:\Program Files\IBM\SPSS\Statistics\21\stats.exe

FirewallRules: [{A5EF9446-B269-4330-9D93-698B4595D248}] => (Allow) C:\Program Files\Lightworks\ntcardvt.exe

FirewallRules: [{967AEEA1-F3A5-43FD-A865-5656F56EC8C6}] => (Allow) C:\Program Files\Lightworks\ntcardvt.exe

FirewallRules: [{76002004-905E-4313-B291-0F83412A6053}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe

FirewallRules: [{0DED1A75-B065-4773-90BE-5E9601AC6723}] => (Allow) LPort=2869

FirewallRules: [{FE04A1EA-0D16-4DA7-8E67-7CEB2CCBF43B}] => (Allow) LPort=1900

FirewallRules: [{904FBCF2-899C-4135-B82B-BDBCEC8CC23F}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe

FirewallRules: [TCP Query User{8B56521F-4E09-4F98-8732-3EE2AA76246B}C:\program files\ibm\spss\statistics\21\jre\bin\javaw.exe] => (Allow) C:\program files\ibm\spss\statistics\21\jre\bin\javaw.exe

FirewallRules: [UDP Query User{A7003E3F-EEF4-42F8-BB5D-3506CB30C6BF}C:\program files\ibm\spss\statistics\21\jre\bin\javaw.exe] => (Allow) C:\program files\ibm\spss\statistics\21\jre\bin\javaw.exe

FirewallRules: [{C1981E89-3837-4FD1-94FC-813F701463BA}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Restore Points =========================

15-06-2016 21:10:23 Windows Update

03-07-2016 19:05:48 Scheduled Checkpoint

07-07-2016 21:15:48 Windows Update

13-07-2016 20:41:54 Windows Update

20-07-2016 17:30:42 Windows Update

==================== Faulty Device Manager Devices =============

Name: SM Bus Controller

Description: SM Bus Controller

Class Guid:

Manufacturer:

Service:

Problem: : The drivers for this device are not installed. (Code 28)

Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

==================== Event log errors: =========================

Application errors:

==================

Error: (07/28/2016 02:42:51 PM) (Source: WinMgmt) (EventID: 10) (User: )