Jump to content

etexe

Members
  • Posts

    8
  • Joined

  • Last visited

Reputation

0 Neutral
  1. sorry... couldn't find the attach button... The situation has not resolved itself. I am able to access the internet now... but any update I attempt to install for ANY antivirus/antimalware program will not work due to the same corrupt directory message... There are viruses in my FRST scan logs, aren't there?
  2. Malwarebytes Anti-Malware www.malwarebytes.org Scan Date: 1/10/2016 Scan Time: 9:42 PM Logfile: Administrator: Yes Version: 2.2.0.1024 Malware Database: v2015.09.22.05 Rootkit Database: v2015.09.18.01 License: Free Malware Protection: Disabled Malicious Website Protection: Disabled Self-protection: Disabled OS: Windows 8.1 CPU: x64 File System: NTFS User: Zack Scan Type: Threat Scan Result: Completed Objects Scanned: 494559 Time Elapsed: 11 min, 41 sec Memory: Enabled Startup: Enabled Filesystem: Enabled Archives: Enabled Rootkits: Disabled Heuristics: Enabled PUP: Enabled PUM: Enabled Processes: 0 (No malicious items detected) Modules: 0 (No malicious items detected) Registry Keys: 6 PUP.Optional.WebWatcher, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{FCE1662E-06F1-413D-80CB-33D456D1CFCB}, Quarantined, [678648ea375441f557f327c7c53dfc04], PUP.Optional.WebWatcher, HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{FCE1662E-06F1-413D-80CB-33D456D1CFCB}, Quarantined, [678648ea375441f557f327c7c53dfc04], PUP.Optional.AmiUpdater, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\amiupdaterExd, Quarantined, [e9043002fc8f83b326cd9fe732d2b947], PUP.Optional.AmiUpdater, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\amiupdaterExi, Quarantined, [bf2e0230eba01f17f6fdb1d5c2424ab6], PUP.Optional.Udapoker, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\UdvdPork, Quarantined, [b439c36f98f36fc77de307bd29db6799], PUP.Optional.WindowsManagementService, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\WINDOWSMANAGEMENTSERVICE, Quarantined, [54993ff3abe0ac8a9644f2d6bc48dd23], Registry Values: 1 PUP.Optional.WindowsManagementService, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\WINDOWSMANAGEMENTSERVICE|ImagePath, "C:\Users\Zack\AppData\Local\Temp\20151017\ct.exe" /svc, Quarantined, [54993ff3abe0ac8a9644f2d6bc48dd23] Registry Data: 0 (No malicious items detected) Folders: 3 Rogue.Multiple, C:\ProgramData\1445042128, Quarantined, [a34a161c4942cd692b45ba34b64c9b65], PUP.Optional.Nosibay, C:\Users\Zack\AppData\Roaming\Nosibay, Quarantined, [4da0df53e5a660d60b98be637b8858a8], PUP.Optional.Nosibay, C:\Users\Zack\AppData\Roaming\Nosibay\Bubble Dock, Quarantined, [4da0df53e5a660d60b98be637b8858a8], Files: 9 PUP.Optional.Nosibay, C:\Users\Zack\AppData\Roaming\Nosibay\Bubble Dock\LBubble Dock.exe, Quarantined, [c5282909a5e69b9bb8b24467a3626997], PUP.Optional.BubbleDock, C:\Users\Zack\AppData\Local\Temp\LBubble Dock.txt, Quarantined, [777645ed6328ed495268cac2eb19d828], Rogue.Multiple, C:\ProgramData\1445042128\s9.zip, Quarantined, [a34a161c4942cd692b45ba34b64c9b65], PUP.Optional.Nosibay, C:\Users\Zack\AppData\Roaming\Nosibay\Bubble Dock\CommonSrv.dll, Quarantined, [4da0df53e5a660d60b98be637b8858a8], PUP.Optional.Nosibay, C:\Users\Zack\AppData\Roaming\Nosibay\Bubble Dock\gdiplus.dll, Quarantined, [4da0df53e5a660d60b98be637b8858a8], PUP.Optional.Nosibay, C:\Users\Zack\AppData\Roaming\Nosibay\Bubble Dock\MFC71.dll, Quarantined, [4da0df53e5a660d60b98be637b8858a8], PUP.Optional.Nosibay, C:\Users\Zack\AppData\Roaming\Nosibay\Bubble Dock\msvcp71.dll, Quarantined, [4da0df53e5a660d60b98be637b8858a8], PUP.Optional.Nosibay, C:\Users\Zack\AppData\Roaming\Nosibay\Bubble Dock\msvcr71.dll, Quarantined, [4da0df53e5a660d60b98be637b8858a8], PUP.Optional.Nosibay, C:\Users\Zack\AppData\Roaming\Nosibay\Bubble Dock\WindowsHook.dll, Quarantined, [4da0df53e5a660d60b98be637b8858a8], Physical Sectors: 0 (No malicious items detected) (end)
  3. I will run another scan with malwarebytes and see what I can come up with.... it seems as though the infection (s) are not completely cured or are regenerating after using MBAM and Norton...
  4. Here are the logs from FRST: Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:10-01-2015 01 Ran by Zack (administrator) on BOSSPLAYA (11-01-2016 18:26:41)Running from F:\Loaded Profiles: Zack (Available Profiles: UpdatusUser & Zack)Platform: Windows 8.1 (X64) Language: English (United States)Internet Explorer Version 11 (Default browser: Chrome)Boot Mode: Safe Mode (with Networking)Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (Microsoft Corporation) C:\Windows\System32\dllhost.exe(Microsoft Corporation) C:\Windows\System32\dllhost.exe ==================== Registry (Whitelisted) =========================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [sysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [1664000 2012-08-14] (IDT, Inc.)HKLM\...\Run: [synTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2874168 2012-09-14] (Synaptics Incorporated)HKLM-x32\...\Run: [CLVirtualDrive] => C:\Program Files (x86)\CyberLink\Power2Go8\VirtualDrive.exe [491632 2012-09-10] (CyberLink Corp.)HKLM-x32\...\Run: [] => [X]HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [93296 2012-07-13] (CyberLink Corp.)HKLM-x32\...\Run: [HP Quick Launch] => C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [581024 2012-09-07] (Hewlett-Packard Development Company, L.P.)HKLM-x32\...\Run: [HP CoolSense] => C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe [1342008 2012-09-14] (Hewlett-Packard Development Company, L.P.)HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-05-26] (Apple Inc.)HKLM-x32\...\Run: [M-Audio Panel Launcher] => C:\Program Files (x86)\M-Audio\M-Track\MAPanel.exe [1190096 2013-04-24] (M-Audio)HKLM-x32\...\Run: [sDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.)Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]HKU\S-1-5-21-1957512214-3067395479-2839608453-1002\...\Run: [steam] => C:\Program Files (x86)\Steam\Steam.exe [2892992 2015-06-04] (Valve Corporation)HKU\S-1-5-21-1957512214-3067395479-2839608453-1002\...\Run: [bitTorrent] => C:\Users\Zack\AppData\Roaming\BitTorrent\BitTorrent.exe [1873952 2015-12-06] (BitTorrent Inc.)HKU\S-1-5-21-1957512214-3067395479-2839608453-1002\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [6501656 2014-10-29] (Piriform Ltd)HKU\S-1-5-21-1957512214-3067395479-2839608453-1002\...\Run: [Copy] => C:\Users\Zack\AppData\Roaming\Copy\CopyAgent.exe [15410832 2015-04-07] (Barracuda Networks, Inc.)HKU\S-1-5-21-1957512214-3067395479-2839608453-1002\...\Run: [spybotPostWindows10UpgradeReInstall] => C:\Program Files\Common Files\AV\Spybot - Search and Destroy\Test.exe [1011200 2015-07-28] (Safer-Networking Ltd.)HKU\S-1-5-21-1957512214-3067395479-2839608453-1002\...\Run: [bubble Dock] => "C:\Users\Zack\AppData\Roaming\Nosibay\Bubble Dock\LBubble Dock.exe" /winstartupHKU\S-1-5-21-1957512214-3067395479-2839608453-1002\...\MountPoints2: {a0d6b8b7-73a4-11e5-802f-a0b3cc52253a} - "G:\WD SmartWare.exe" autoplay=trueHKU\S-1-5-18\...\Run: [Copy] => C:\Users\Zack\AppData\Roaming\Copy\CopyAgent.exe [15410832 2015-04-07] (Barracuda Networks, Inc.)ShellIconOverlayIdentifiers: [ OverlayExcluded] -> {4433A54A-1AC8-432F-90FC-85F045CF383C} => C:\Program Files (x86)\Norton Internet Security\Engine64\22.5.5.15\buShell.dll [2015-11-05] (Symantec Corporation)ShellIconOverlayIdentifiers: [ OverlayPending] -> {F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225} => C:\Program Files (x86)\Norton Internet Security\Engine64\22.5.5.15\buShell.dll [2015-11-05] (Symantec Corporation)ShellIconOverlayIdentifiers: [ OverlayProtected] -> {476D0EA3-80F9-48B5-B70B-05E677C9C148} => C:\Program Files (x86)\Norton Internet Security\Engine64\22.5.5.15\buShell.dll [2015-11-05] (Symantec Corporation)ShellIconOverlayIdentifiers: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => No FileShellIconOverlayIdentifiers: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => No FileShellIconOverlayIdentifiers: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => No FileShellIconOverlayIdentifiers: [ SkyDrivePro1 (ErrorConflict)] -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2015-01-14] ()ShellIconOverlayIdentifiers: [ SkyDrivePro2 (SyncInProgress)] -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2015-01-14] ()ShellIconOverlayIdentifiers: [ SkyDrivePro3 (InSync)] -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2015-01-14] ()ShellIconOverlayIdentifiers: [1aCopyShExtError] -> {83BEA36E-7680-4598-A4DF-994426F6E78D} => C:\Users\Zack\AppData\Roaming\Copy\overlay\CopyShExt.dll [2015-03-06] (Barracuda Networks, Inc.)ShellIconOverlayIdentifiers: [2aCopyShExtSynced] -> {845B7388-6F85-4F32-9FD5-F02DC7882B89} => C:\Users\Zack\AppData\Roaming\Copy\overlay\CopyShExt.dll [2015-03-06] (Barracuda Networks, Inc.)ShellIconOverlayIdentifiers: [3aCopyShExtSyncing] -> {F6378A7A-F753-449B-AE1B-997A96132E61} => C:\Users\Zack\AppData\Roaming\Copy\overlay\CopyShExt.dll [2015-03-06] (Barracuda Networks, Inc.)ShellIconOverlayIdentifiers: [4aCopyShExtSyncingProg1] -> {3A511828-777D-46F8-82F4-5B530C1B3D9E} => C:\Users\Zack\AppData\Roaming\Copy\overlay\CopyShExt.dll [2015-03-06] (Barracuda Networks, Inc.)ShellIconOverlayIdentifiers: [5aCopyShExtSyncingProg2] -> {C8C88204-5B14-40EC-BA72-8AEBC762047E} => C:\Users\Zack\AppData\Roaming\Copy\overlay\CopyShExt.dll [2015-03-06] (Barracuda Networks, Inc.)ShellIconOverlayIdentifiers: [6aCopyShExtSyncingProg3] -> {ACFF45C3-3EEB-4351-86C2-6696BA264239} => C:\Users\Zack\AppData\Roaming\Copy\overlay\CopyShExt.dll [2015-03-06] (Barracuda Networks, Inc.)ShellIconOverlayIdentifiers: [7aCopyShExtSyncingProg4] -> {29AF997F-488B-46F0-AE78-7146F1B89CC3} => C:\Users\Zack\AppData\Roaming\Copy\overlay\CopyShExt.dll [2015-03-06] (Barracuda Networks, Inc.)ShellIconOverlayIdentifiers: [8aCopyShExtSyncingProg5] -> {03F9AD29-1C78-4B66-8890-B177B5430C53} => C:\Users\Zack\AppData\Roaming\Copy\overlay\CopyShExt.dll [2015-03-06] (Barracuda Networks, Inc.)ShellIconOverlayIdentifiers-x32: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => No FileShellIconOverlayIdentifiers-x32: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => No FileShellIconOverlayIdentifiers-x32: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => No FileBootExecute: autocheck autochk * sdnclean64.exe ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) Tcpip\Parameters: [DhcpNameServer] 75.75.76.76 75.75.75.75Tcpip\..\Interfaces\{F255D4F5-805E-4D33-8CD1-6C50082B7CB1}: [DhcpNameServer] 75.75.76.76 75.75.75.75Tcpip\..\Interfaces\{F811CCDA-5468-4282-A4DA-759DAB7CAA3B}: [DhcpNameServer] 75.75.76.76 75.75.75.75 Internet Explorer:==================HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.msn.com/HPNOT13/1HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.msn.com/HPNOT13/1HKU\S-1-5-21-1957512214-3067395479-2839608453-1002\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://www.youtube.com/SearchScopes: HKLM -> {C7F82C5A-78D0-467E-AE51-BBC60F64B27F} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us2-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}SearchScopes: HKLM -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/711-154371-11896-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}SearchScopes: HKLM-x32 -> {C7F82C5A-78D0-467E-AE51-BBC60F64B27F} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us2-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}SearchScopes: HKLM-x32 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/711-154371-11896-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-21-1957512214-3067395479-2839608453-1002 -> {6CBE31E5-EE1E-433E-BCB5-D8F8E904CA72} URL = hxxp://search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=586383&p={searchTerms}SearchScopes: HKU\S-1-5-21-1957512214-3067395479-2839608453-1002 -> {C7F82C5A-78D0-467E-AE51-BBC60F64B27F} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us2-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}SearchScopes: HKU\S-1-5-21-1957512214-3067395479-2839608453-1002 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/711-154371-11896-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2014-12-02] (Microsoft Corporation)BHO: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton Internet Security\Engine64\22.5.5.15\coIEPlg.dll [2015-11-05] (Symantec Corporation)BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2015-01-14] ()BHO-x32: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton Internet Security\Engine\22.5.5.15\coIEPlg.dll [2015-11-05] (Symantec Corporation)BHO-x32: Norton Vulnerability Protection -> {6D53EC84-6AAE-4787-AEEE-F4628F01010C} -> C:\Program Files (x86)\Norton Internet Security\Engine\21.7.0.11\IPS\IPSBHO.DLL => No FileBHO-x32: Java Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2014-07-25] (Oracle Corporation)BHO-x32: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2014-07-25] (Oracle Corporation)BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll [2012-07-09] (Hewlett-Packard)Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine64\22.5.5.15\coIEPlg.dll [2015-11-05] (Symantec Corporation)Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\22.5.5.15\coIEPlg.dll [2015-11-05] (Symantec Corporation)Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2014-10-24] (Microsoft Corporation) FireFox:========FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\windows\SysWOW64\Adobe\Director\np32dsw_1166636.dll [2012-08-08] (Adobe Systems, Inc.)FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-02-21] ()FF Plugin-x32: @authentec.com/ffwloplugin -> C:\Program Files (x86)\HP SimplePass\npffwloplugin.dll [2012-08-10] ( HP)FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll [2012-06-06] (Intel Corporation)FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2012-06-06] (Intel Corporation)FF Plugin-x32: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll [2014-07-25] (Oracle Corporation)FF Plugin-x32: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll [2014-07-25] (Oracle Corporation)FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2014-10-24] (Microsoft Corporation)FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-01] (Google Inc.)FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-01] (Google Inc.)FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll [2012-05-11] ()FF HKLM\...\Firefox\Extensions: [{C1A2A613-35F1-4FCF-B27F-2840527B6556}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_22.5.0.124\coFFAddonFF Extension: Norton Identity Safe - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_22.5.0.124\coFFAddon [2015-12-15]FF HKLM-x32\...\Firefox\Extensions: [{C1A2A613-35F1-4FCF-B27F-2840527B6556}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_22.5.0.124\coFFAddon Chrome: =======CHR Profile: C:\Users\Zack\AppData\Local\Google\Chrome\User Data\DefaultCHR Extension: (Google Slides) - C:\Users\Zack\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2016-01-07]CHR Extension: (Google Docs) - C:\Users\Zack\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2016-01-07]CHR Extension: (Google Drive) - C:\Users\Zack\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-01-07]CHR Extension: (YouTube) - C:\Users\Zack\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-01-07]CHR Extension: (Google Search) - C:\Users\Zack\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2016-01-07]CHR Extension: (Website Logon) - C:\Users\Zack\AppData\Local\Google\Chrome\User Data\Default\Extensions\fegekclkdhbnfdcmomlpegkkndgnmfmo [2016-01-07]CHR Extension: (Google Sheets) - C:\Users\Zack\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2016-01-07]CHR Extension: (Google Docs Offline) - C:\Users\Zack\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-01-07]CHR Extension: (Chrome Web Store Payments) - C:\Users\Zack\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-01-07]CHR Extension: (Gmail) - C:\Users\Zack\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-01-07]CHR HKLM\...\Chrome\Extension: [cjabmdjcfcfdmffimndhafhblfmpjdpe] - C:\Program Files (x86)\Norton Internet Security\Engine\22.5.5.15\Exts\Chrome.crx [2015-11-30]CHR HKLM\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - hxxps://clients2.google.com/service/update2/crxCHR HKLM-x32\...\Chrome\Extension: [cjabmdjcfcfdmffimndhafhblfmpjdpe] - C:\Program Files (x86)\Norton Internet Security\Engine\22.5.5.15\Exts\Chrome.crx [2015-11-30]CHR HKLM-x32\...\Chrome\Extension: [fegekclkdhbnfdcmomlpegkkndgnmfmo] - C:\Program Files (x86)\HP SimplePass\tschrome.crx [2012-07-12]CHR HKLM-x32\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - hxxps://clients2.google.com/service/update2/crx ==================== Services (Whitelisted) ======================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) ATTENTION: => Could not perform signature verification. Cryptographic Service is not running. S2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2802360 2015-11-24] (Microsoft Corporation)S2 FPLService; C:\Program Files (x86)\HP SimplePass\TrueSuiteService.exe [1641320 2012-08-10] (HP)S2 HPConnectedRemote; C:\Program Files (x86)\Hewlett-Packard\HP Connected Remote\HPConnectedRemoteService.exe [35744 2012-10-12] (Hewlett-Packard)S2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [314696 2014-05-20] (Intel Corporation)S2 Intel® ME Service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\FWService\IntelMeFWService.exe [128896 2012-07-17] (Intel Corporation)S2 jhi_service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [165760 2012-07-17] (Intel Corporation)S2 MBAMService; D:\Malwarebytes Anti-Malware\mbamservice.exe [1135416 2015-10-05] (Malwarebytes)S2 MTrackAudioDevMon; C:\Program Files (x86)\M-Audio\M-Track\AudioDevMon.exe [546816 2013-04-24] (M-Audio)S2 NIS; C:\Program Files (x86)\Norton Internet Security\Engine\22.5.5.15\NIS.exe [282016 2015-11-20] (Symantec Corporation)S2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)S3 TrueService; C:\Program Files\Common Files\AuthenTec\TrueService.exe [401256 2012-07-16] (AuthenTec, Inc.)S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366552 2015-07-07] (Microsoft Corporation)S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2015-07-07] (Microsoft Corporation)S2 winoptfilterservice; C:\Program Files (x86)\winoptfilter\WinOptSrv.exe [141440 2015-10-08] (Digital Light Co.)S2 winoptfilterservice2; C:\Program Files (x86)\winoptfilter\WinOptSrv_.exe [141440 2015-10-08] (Digital Light Co.) ===================== Drivers (Whitelisted) ========================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) S1 BHDrvx64; C:\Program Files (x86)\Norton Internet Security\NortonData\22.5.0.124\Definitions\BASHDefs\20160104.001\BHDrvx64.sys [1665608 2016-01-04] (Symantec Corporation)S1 ccSet_NIS; C:\Windows\system32\drivers\NISx64\1605050.00F\ccSetx64.sys [173808 2015-07-10] (Symantec Corporation)S1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [92536 2012-06-25] (CyberLink)R0 ebdrv; C:\Windows\System32\drivers\evbda.sys [3357024 2013-08-22] (Broadcom Corporation)S1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [498512 2015-11-17] (Symantec Corporation)S3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [157520 2015-11-17] (Symantec Corporation)S3 ffusb2audio; C:\Windows\system32\DRIVERS\ffusb2audio.sys [127280 2013-09-25] (Focusrite Audio Engineering Limited.)S3 gfiark; C:\Windows\System32\drivers\gfiark.sys [41032 2013-05-23] (ThreatTrack Security)S3 gfiutil; C:\Windows\System32\drivers\gfiutil.sys [31264 2013-09-04] (ThreatTrack Security)S1 IDSVia64; C:\Program Files (x86)\Norton Internet Security\NortonData\22.5.0.124\Definitions\IPSDefs\20160106.001\IDSvia64.sys [767224 2016-01-05] (Symantec Corporation)S3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2015-10-05] (Malwarebytes)R0 MBAMSwissArmy; C:\Windows\System32\drivers\MBAMSwissArmy.sys [192216 2016-01-10] (Malwarebytes)S3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2015-10-05] (Malwarebytes Corporation)S3 mm2avs; C:\Windows\System32\Drivers\mm2avs.sys [358520 2012-06-06] (Native Instruments GmbH)S3 mm2usb_svc; C:\Windows\System32\Drivers\mm2usb.sys [45688 2012-06-06] (Native Instruments GmbH)S3 MTRACK; C:\Windows\system32\DRIVERS\MAudioMTrack.sys [471040 2013-04-24] (M-Audio)S3 NAVENG; C:\Program Files (x86)\Norton Internet Security\NortonData\22.5.0.124\Definitions\VirusDefs\20160107.004\ENG64.SYS [138488 2015-10-27] (Symantec Corporation)S3 NAVEX15; C:\Program Files (x86)\Norton Internet Security\NortonData\22.5.0.124\Definitions\VirusDefs\20160107.004\EX64.SYS [2148080 2015-10-27] (Symantec Corporation)S3 pbfilter; C:\Program Files\PeerBlock\pbfilter.sys [22600 2014-01-14] ()S3 RSP2STOR; C:\Windows\system32\DRIVERS\RtsP2Stor.sys [273040 2012-08-08] (Realtek Semiconductor Corp.)S3 SmbDrv; C:\Windows\System32\drivers\Smb_driver_AMDASF.sys [41272 2012-09-14] (Synaptics Incorporated)R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [43832 2012-09-14] (Synaptics Incorporated)S1 SRTSP; C:\Windows\System32\Drivers\NISx64\1605050.00F\SRTSP64.SYS [928496 2015-11-11] (Symantec Corporation)S1 SRTSPX; C:\Windows\system32\drivers\NISx64\1605050.00F\SRTSPX64.SYS [50936 2015-07-10] (Symantec Corporation)R0 SymEFASI; C:\Windows\System32\drivers\NISx64\1605050.00F\SYMEFASI64.SYS [1621232 2015-11-11] (Symantec Corporation)S0 SymELAM; C:\Windows\System32\drivers\NISx64\1605050.00F\SymELAM.sys [24192 2015-07-10] (Symantec Corporation)S3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [111344 2015-07-21] (Symantec Corporation)S1 SymIRON; C:\Windows\system32\drivers\NISx64\1605050.00F\Ironx64.SYS [297720 2015-07-10] (Symantec Corporation)S1 SymNetS; C:\Windows\System32\Drivers\NISx64\1605050.00F\SYMNETS.SYS [577768 2015-11-11] (Symantec Corporation)S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [44560 2015-07-07] (Microsoft Corporation)S3 WdFilter; C:\Windows\system32\drivers\WdFilter.sys [270168 2015-07-07] (Microsoft Corporation)S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114520 2015-07-07] (Microsoft Corporation)R3 WirelessButtonDriver; C:\Windows\System32\drivers\WirelessButtonDriver64.sys [20800 2012-08-31] (Hewlett-Packard Development Company, L.P.)S1 SASDIFSV; \??\C:\Users\Zack\AppData\Local\Temp\SAS_SelfExtract\SASDIFSV64.SYS [X]S1 SASKUTIL; \??\C:\Users\Zack\AppData\Local\Temp\SAS_SelfExtract\SASKUTIL64.SYS [X]S1 SMR501; \SystemRoot\System32\drivers\SMR501.SYS [X] ==================== NetSvcs (Whitelisted) =================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) ==================== One Month Created files and folders ======== (If an entry is included in the fixlist, the file/folder will be moved.) 2016-01-11 18:26 - 2016-01-11 18:26 - 00000000 ____D C:\FRST2016-01-10 23:28 - 2016-01-10 23:28 - 00000882 _____ C:\Pictures - Shortcut.lnk2016-01-10 22:23 - 2016-01-10 22:23 - 00004040 _____ C:\ProgramData\SMRResults501.dat2016-01-10 22:16 - 2016-01-11 18:26 - 01953418 _____ C:\WINDOWS\ntbtlog.txt2016-01-10 21:42 - 2016-01-10 23:17 - 00192216 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys2016-01-10 21:42 - 2016-01-10 21:42 - 00000645 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk2016-01-10 21:42 - 2016-01-10 21:42 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware2016-01-10 18:47 - 2016-01-10 18:47 - 00000274 ____H C:\WINDOWS\Tasks\User_Feed_Synchronization-{5C3BE7DA-81AD-4C57-B4AB-3B09DAA7A9BF}.job2016-01-10 15:43 - 2016-01-10 21:41 - 00000000 ____D C:\Program Files\Malwarebytes Anti-Malware2016-01-10 15:43 - 2015-10-05 09:50 - 00109272 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbamchameleon.sys2016-01-10 15:43 - 2015-10-05 09:50 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys2016-01-10 15:43 - 2015-10-05 09:50 - 00025816 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbam.sys2016-01-10 15:17 - 2016-01-10 15:17 - 00000000 ____D C:\ProgramData\Malwarebytes2016-01-09 16:48 - 2016-01-09 16:48 - 00000020 ___SH C:\Users\Zack\ntuser.ini2016-01-08 21:43 - 2016-01-08 21:44 - 00000000 ____D C:\Users\Zack\Downloads\Rob Papen Plugin Collection 22.04.2014 VST32 VST64 Win - R2R [oddsox]2016-01-08 18:54 - 2016-01-08 18:54 - 00013103 _____ C:\Users\Zack\Downloads\[kat.cr]rob.papen.plugins.latest.win.12.2015.r2r.oddsox.torrent2016-01-08 18:35 - 2016-01-08 18:35 - 00720373 _____ C:\WINDOWS\unins000.exe2016-01-08 18:13 - 2016-01-08 18:13 - 00000000 ____D C:\Users\Zack\AppData\Local\Apple2016-01-07 23:11 - 2016-01-07 23:11 - 00001509 _____ C:\Users\Zack\Desktop\Ableton Live 9 Suite - Shortcut.lnk2016-01-07 23:09 - 2016-01-10 18:47 - 00000000 ____D C:\Users\Zack\AppData\Local\CrashDumps2016-01-07 23:05 - 2016-01-07 23:05 - 00000905 _____ C:\Users\Zack\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Ableton Live 9.5 Suite.lnk2016-01-07 23:05 - 2016-01-07 23:05 - 00000000 ____D C:\ProgramData\Ableton2016-01-07 22:43 - 2016-01-07 23:03 - 00000000 ____D C:\Users\Zack\Downloads\Ableton live Suite v9.5 WiN x86 x64-d33p57a7u52016-01-07 22:43 - 2016-01-07 22:43 - 00019023 _____ C:\Users\Zack\Downloads\[kat.cr]ableton.live.suite.v9.5.win.x86.x64.d33p57a7u5 (3).torrent2016-01-07 22:42 - 2016-01-07 22:42 - 00019023 _____ C:\Users\Zack\Downloads\[kat.cr]ableton.live.suite.v9.5.win.x86.x64.d33p57a7u5 (2).torrent2016-01-07 22:32 - 2016-01-07 22:32 - 00000901 _____ C:\Users\Zack\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Ableton Live 9 Suite.lnk2016-01-07 21:27 - 2016-01-07 21:27 - 00002279 _____ C:\Users\Zack\Desktop\Google Chrome.lnk2016-01-07 20:58 - 2016-01-07 22:36 - 00000000 ____D C:\Users\Zack\Desktop\ableton_live_suite_9.5_642016-01-07 20:40 - 2016-01-10 21:53 - 00000000 ____D C:\Users\Zack\AppData\LocalLow\BitTorrent2016-01-06 23:11 - 2016-01-06 23:26 - 1981452851 _____ C:\Users\Zack\Documents\LoopmastersMixtape_r32903_v9.0.alp2016-01-02 14:48 - 2016-01-02 20:48 - 00000000 ____D C:\Users\Zack\VST PRESETS2015-12-16 18:10 - 2015-12-16 20:00 - 00000000 ____D C:\Users\Zack\Documents\Writing Samples DMM ==================== One Month Modified files and folders ======== (If an entry is included in the fixlist, the file/folder will be moved.) 2016-01-11 18:26 - 2013-08-22 08:36 - 00000000 ____D C:\Windows2016-01-11 17:42 - 2015-03-06 10:48 - 00000000 ____D C:\Users\Zack\AppData\Roaming\Copy2016-01-11 17:39 - 2013-08-22 09:45 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT2016-01-11 17:35 - 2015-04-10 12:42 - 00000922 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job2016-01-11 17:35 - 2014-10-21 23:09 - 00000000 __RDO C:\Users\Zack\OneDrive2016-01-11 17:34 - 2013-08-15 17:25 - 00000000 ____D C:\Users\Zack\AppData\LocalLow\AuthenTec2016-01-11 17:33 - 2014-10-21 21:09 - 00000000 ____D C:\Users\Zack2016-01-10 23:34 - 2013-08-22 10:36 - 00000000 ____D C:\WINDOWS\vpnplugins2016-01-10 23:15 - 2015-10-15 16:20 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 22016-01-10 22:43 - 2015-10-15 16:20 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy2016-01-10 22:31 - 2013-08-22 08:36 - 00000000 ____D C:\WINDOWS\Inf2016-01-10 22:30 - 2013-08-15 17:35 - 00003598 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1957512214-3067395479-2839608453-10022016-01-10 22:28 - 2015-04-23 15:31 - 00000000 ____D C:\Users\Zack\AppData\Local\NPE2016-01-10 22:27 - 2013-08-15 23:01 - 00000000 ____D C:\Program Files (x86)\Steam2016-01-10 21:53 - 2013-08-26 03:15 - 00000000 ____D C:\Users\Zack\AppData\Roaming\BitTorrent2016-01-10 21:39 - 2015-10-17 00:01 - 00000000 ____D C:\Users\Zack\AppData\Roaming\Ableton2016-01-10 17:49 - 2013-08-22 08:25 - 00262144 ___SH C:\WINDOWS\system32\config\ELAM2016-01-10 13:03 - 2014-09-24 02:15 - 00339546 _____ C:\WINDOWS\system32\PerfStringBackup.INI2016-01-10 12:58 - 2015-02-18 13:07 - 00000000 ____D C:\WINDOWS\pss2016-01-10 10:29 - 2013-08-22 10:36 - 00000000 ___HD C:\Program Files\WindowsApps2016-01-10 10:29 - 2013-08-22 10:36 - 00000000 ____D C:\WINDOWS\AppReadiness2016-01-10 10:20 - 2014-11-13 22:56 - 00000000 __SHD C:\Users\Zack\AppData\LocalLow\EmieUserList2016-01-10 10:20 - 2014-11-13 22:56 - 00000000 __SHD C:\Users\Zack\AppData\LocalLow\EmieSiteList2016-01-09 18:12 - 2015-04-10 12:42 - 00000926 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job2016-01-08 18:55 - 2014-12-28 03:14 - 00000000 ____D C:\Program Files\PeerBlock2016-01-08 18:35 - 2014-07-14 20:09 - 00014507 _____ C:\WINDOWS\unins000.dat2016-01-08 18:35 - 2013-08-26 04:53 - 00000000 ____D C:\Program Files (x86)\VstPlugins2016-01-08 18:28 - 2013-08-15 17:27 - 00003926 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{5C3BE7DA-81AD-4C57-B4AB-3B09DAA7A9BF}2016-01-08 07:39 - 2014-01-31 20:38 - 00000000 ____D C:\Users\Zack\Documents\SOUNDZZZZ2016-01-07 23:09 - 2015-12-07 19:18 - 00000000 ____D C:\WINDOWS\System32\Tasks\Remediation2016-01-07 23:07 - 2015-01-06 20:50 - 00000000 ____D C:\ProgramData\Package Cache2016-01-07 18:01 - 2015-10-17 00:01 - 00000000 ____D C:\Users\Zack\Documents\Ableton2016-01-06 22:54 - 2013-12-26 18:20 - 00000000 ____D C:\Program Files\Native Instruments2016-01-06 22:07 - 2015-03-06 10:49 - 00000000 ___RD C:\Users\Zack\Copy2016-01-05 19:26 - 2013-08-22 08:25 - 00262144 ___SH C:\WINDOWS\system32\config\BBI2015-12-31 16:52 - 2012-07-26 02:59 - 00000000 ____D C:\WINDOWS\CbsTemp2015-12-27 23:02 - 2015-03-02 15:09 - 00000000 ____D C:\WINDOWS\Minidump2015-12-26 03:48 - 2014-09-24 04:55 - 00826872 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe2015-12-26 03:48 - 2014-09-24 04:55 - 00176632 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl2015-12-19 17:31 - 2015-04-20 14:39 - 00000000 ___SD C:\WINDOWS\SysWOW64\GWX2015-12-19 17:31 - 2015-04-20 14:39 - 00000000 ___SD C:\WINDOWS\system32\GWX2015-12-16 20:14 - 2013-08-15 17:24 - 00000000 ____D C:\Users\Zack\AppData\Local\Packages2015-12-16 20:13 - 2014-01-29 18:09 - 00000000 ____D C:\Users\Zack\Documents\POEMS AND SUCH2015-12-15 17:38 - 2013-08-26 01:50 - 00000000 ____D C:\Program Files\Microsoft Office 152015-12-13 18:04 - 2013-08-22 09:44 - 00381968 _____ C:\WINDOWS\system32\FNTCACHE.DAT ==================== Files in the root of some directories ======= 2013-08-15 17:26 - 2013-08-15 17:26 - 0000141 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.351.64.bc2016-01-10 22:23 - 2016-01-10 22:23 - 0004040 _____ () C:\ProgramData\SMRResults501.dat Files to move or delete:====================C:\ProgramData\SMRResults501.dat ==================== Bamital & volsnap ================= (There is no automatic fix for files that do not pass verification.) C:\WINDOWS\system32\winlogon.exe[2015-12-08 16:53] - [2015-10-05 13:25] - 0572928 ____A (Microsoft Corporation) 3F8645885823692D93765817759BE21C C:\WINDOWS\system32\wininit.exe[2015-12-08 16:53] - [2015-10-05 13:28] - 0146432 ____A (Microsoft Corporation) EC302D06155F8E3C383750993FCB6B27 C:\WINDOWS\explorer.exe[2015-03-10 18:07] - [2015-01-27 18:47] - 2501368 ____A (Microsoft Corporation) C10A66189DC8C090E7C84873EDCEBC88 C:\WINDOWS\SysWOW64\explorer.exe[2015-03-10 18:07] - [2015-01-27 18:41] - 2207488 ____A (Microsoft Corporation) 91E24273FCA076EA9E65DAFA98901225 C:\WINDOWS\system32\svchost.exe[2015-03-19 14:08] - [2014-10-28 23:11] - 0038792 ____A (Microsoft Corporation) E3A2AD05E24105B35E986CF9CB38EC47 C:\WINDOWS\SysWOW64\svchost.exe[2015-03-19 14:08] - [2014-10-28 22:17] - 0033088 ____A (Microsoft Corporation) D0ABC231C0B3E88C6B612B28ABBF734D C:\WINDOWS\system32\services.exe[2015-05-14 00:15] - [2015-04-08 17:55] - 0410128 ____A (Microsoft Corporation) E0C7813A97CA7947FF5C18A8F3B61A45 C:\WINDOWS\system32\User32.dll[2015-12-08 16:53] - [2015-11-08 19:41] - 1540728 ____A (Microsoft Corporation) 33094E2182C451BCFCFD60F734B1C4EF C:\WINDOWS\SysWOW64\User32.dll[2015-12-08 16:53] - [2015-11-08 15:48] - 1376256 ____A (Microsoft Corporation) 72DF14DA8F1CC15F7BE4176DE0404D9E C:\WINDOWS\system32\userinit.exe[2015-03-19 14:08] - [2014-10-28 20:28] - 0026112 ____A (Microsoft Corporation) 5C131534A3EA4A461A793FB507A8004F C:\WINDOWS\SysWOW64\userinit.exe[2015-03-19 14:08] - [2014-10-28 20:05] - 0022528 ____A (Microsoft Corporation) D10643FC0095434C819316CA6CD748C0 C:\WINDOWS\system32\rpcss.dll[2015-03-19 14:10] - [2014-10-28 20:19] - 0817664 ____A (Microsoft Corporation) A6F17C299A03BAFEFB9257C462A19E00 C:\WINDOWS\system32\dnsapi.dll[2015-03-19 14:10] - [2014-10-28 20:30] - 0657920 ____A (Microsoft Corporation) A5675939CF0F99B20B5A3CFCC3C1B46A C:\WINDOWS\SysWOW64\dnsapi.dll[2015-03-19 14:10] - [2014-10-28 20:06] - 0498688 ____A (Microsoft Corporation) BD9C7A068C46053F8747CEA73B5930AB C:\WINDOWS\system32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2015-01-25 22:53 ==================== End of FRST.txt ============================​Additional scan result of Farbar Recovery Scan Tool (x64) Version:10-01-2015 01 Ran by Zack (2016-01-11 18:27:32)Running from F:\Windows 8.1 (X64) (2014-10-22 04:05:09)Boot Mode: Safe Mode (with Networking)========================================================== ==================== Accounts: ============================= Administrator (S-1-5-21-1957512214-3067395479-2839608453-500 - Administrator - Disabled)Guest (S-1-5-21-1957512214-3067395479-2839608453-501 - Limited - Disabled)HomeGroupUser$ (S-1-5-21-1957512214-3067395479-2839608453-1004 - Limited - Enabled)UpdatusUser (S-1-5-21-1957512214-3067395479-2839608453-1001 - Limited - Enabled) => C:\Users\UpdatusUserZack (S-1-5-21-1957512214-3067395479-2839608453-1002 - Administrator - Enabled) => C:\Users\Zack ==================== Security Center ======================== (If an entry is included in the fixlist, it will be removed.) AV: Norton Internet Security (Enabled - Out of date) {53C7D717-52E2-B95E-FA61-6F32ECC805DB}AV: Windows Defender (Enabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}AS: Windows Defender (Enabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}AS: Spybot - Search and Destroy (Enabled - Out of date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}AS: Norton Internet Security (Enabled - Out of date) {E8A636F3-74D8-B6D0-C0D1-5440974F4F66}FW: Norton Internet Security (Enabled) {6BFC5632-188D-B806-D13E-C607121B42A0} ==================== Installed Programs ====================== (Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.) 4 Elements II (x32 Version: 2.2.0.98 - WildTangent) Hidden7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)Ableton Live 9 Intro (HKLM\...\{703D1131-DCA5-4B27-B7A4-40B734D5D7D4}) (Version: 9.0.0.0 - Ableton)Ableton Live 9 Suite (HKLM\...\{7597F2DC-003A-476E-9281-774AB112B7BE}) (Version: 9.0.0.0 - Ableton)Adobe Shockwave Player 11.6 (HKLM-x32\...\Adobe Shockwave Player) (Version: 11.6.6.636 - Adobe Systems, Inc.)Apple Application Support (HKLM-x32\...\{D9DAD0FF-495A-472B-9F10-BAE430A26682}) (Version: 3.0.3 - Apple Inc.)Apple Mobile Device Support (HKLM\...\{787136D2-F0F8-4625-AA3F-72D7795AC842}) (Version: 7.1.1.3 - Apple Inc.)Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)ASIO4ALL (HKLM-x32\...\ASIO4ALL) (Version: 2.10 - Michael Tippach)AuthenTec TrueAPI 64-bit (Version: 1.6.0.86 - AuthenTec, Inc.) HiddenBejeweled 3 (x32 Version: 2.2.0.98 - WildTangent) HiddenBitTorrent (HKU\S-1-5-21-1957512214-3067395479-2839608453-1002\...\BitTorrent) (Version: 7.9.5.41373 - BitTorrent Inc.)Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)Build-a-lot 4 - Power Source (x32 Version: 2.2.0.98 - WildTangent) HiddenCamel Audio Alchemy64 (HKLM-x32\...\Camel Audio Alchemy64) (Version: 1.25.0 - Camel Audio)CCleaner (HKLM\...\CCleaner) (Version: 4.19 - Piriform)Copy (HKLM\...\{6C680D3E-8940-4FEA-BA3A-E57825C691AF}) (Version: 1.48.456.0 - Barracuda Networks, Inc.)Counter-Strike: Source (HKLM-x32\...\Steam App 240) (Version: - Valve)Cradle Of Egypt Collector's Edition (x32 Version: 2.2.0.98 - WildTangent) HiddenCradle of Rome 2 (x32 Version: 2.2.0.98 - WildTangent) HiddenCyberLink LabelPrint (HKLM-x32\...\InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.5.2.5712 - CyberLink Corp.)CyberLink Media Suite 10 (HKLM-x32\...\InstallShield_{1FBF6C24-C1fD-4101-A42B-0C564F9E8E79}) (Version: 10.0.2.2114 - CyberLink Corp.)CyberLink PhotoDirector (HKLM-x32\...\InstallShield_{4862344A-A39C-4897-ACD4-A1BED5163C5A}) (Version: 2.0.2.3317 - CyberLink Corp.)CyberLink Power2Go 8 (HKLM-x32\...\InstallShield_{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}) (Version: 8.0.2.2110 - CyberLink Corp.)CyberLink PowerDirector 10 (HKLM-x32\...\InstallShield_{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}) (Version: 10.0.2.2126 - CyberLink Corp.)CyberLink PowerDVD (HKLM-x32\...\InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}) (Version: 10.0.7.4528 - CyberLink Corp.)CyberLink YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 3.5.5.5811 - CyberLink Corp.)D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) HiddenEnergy Star (HKLM-x32\...\{FC0ADA4D-8FA5-4452-8AFF-F0A0BAC97EF7}) (Version: 1.0.9 - Hewlett-Packard Company)Farm Frenzy (x32 Version: 2.2.0.98 - WildTangent) HiddenFATE: The Cursed King (x32 Version: 2.2.0.97 - WildTangent) HiddenFinal Drive Fury (x32 Version: 2.2.0.95 - WildTangent) HiddenFocusrite USB 2.0 Audio Driver 2.5.1 (HKLM\...\Focusrite USB 2.0 Audio Driver_is1) (Version: 2.5.1 - Focusrite Audio Engineering Limited.)Fracture version 1.0 (HKLM-x32\...\{0BF82F4F-37CC-4A00-A20E-B24AA8D90160}_is1) (Version: 1.0 - Glitchmachines)Gardenscapes: Mansion Makeover (x32 Version: 3.0.2.32 - WildTangent) HiddenGoogle Chrome (HKLM-x32\...\Google Chrome) (Version: 47.0.2526.106 - Google Inc.)Google Update Helper (x32 Version: 1.3.29.1 - Google Inc.) HiddenGovernor of Poker 2 Premium Edition (x32 Version: 2.2.0.95 - WildTangent) HiddenHewlett-Packard ACLM.NET v1.2.1.1 (x32 Version: 1.00.0000 - Hewlett-Packard Company) HiddenHouse of 1000 Doors: Family Secrets (x32 Version: 2.2.0.98 - WildTangent) HiddenHoyle Card Games (x32 Version: 2.2.0.95 - WildTangent) HiddenHP 3D DriveGuard (HKLM\...\{6821D775-9303-46DD-977A-2D97CA18B054}) (Version: 4.2.8.1 - Hewlett-Packard Company)HP Connected Music (Meridian - installer) (HKLM-x32\...\StartHPConnectedMusic) (Version: v1.0 - Meridian Audio Ltd)HP Connected Remote (HKLM-x32\...\{F243A34B-AB7F-4065-B770-B85B767C247C}) (Version: 1.0.1218 - Hewlett-Packard)HP CoolSense (HKLM-x32\...\{8704FEEF-A6A8-4E7E-B124-BD6122C66E2C}) (Version: 2.10.42 - Hewlett-Packard Company)HP Documentation (HKLM-x32\...\{53D3E126-699A-4D92-AA66-6560D573553E}) (Version: 1.2.0.0 - Hewlett-Packard)HP Games (HKLM-x32\...\WildTangent hp Master Uninstall) (Version: 1.0.3.0 - WildTangent)HP MyRoom (HKLM-x32\...\{9C35EDE5-4B0F-45E7-A438-314BA889948E}) (Version: 9.0.0.0 - Hewlett-Packard Company)HP Quick Launch (HKLM-x32\...\{E5823036-6F09-4D0A-B05C-E2BAA129288A}) (Version: 3.0.6 - Hewlett-Packard Company)HP Registration Service (HKLM\...\{C2E428EB-116E-41C0-9E84-B22DE9CCA42F}) (Version: 1.1.6232.4245 - Hewlett-Packard)HP SimplePass (HKLM-x32\...\{34C821CA-6B55-44A0-8A9B-2EF471D6019E}) (Version: 6.0.100.244 - Hewlett-Packard)HP Support Assistant (HKLM-x32\...\{EE202411-2C26-49E8-9784-1BC1DBF7DE96}) (Version: 7.0.39.15 - Hewlett-Packard Company)HP Utility Center (HKLM-x32\...\{0C57987A-A03A-4B95-A309-D23F78F406CA}) (Version: 1.0.8 - Hewlett-Packard)HP Wireless Button Driver (HKLM-x32\...\{941DE69D-6CEE-4171-8F1F-3D7E352AA498}) (Version: 1.0.6.1 - Hewlett-Packard Company)IDT Audio (HKLM-x32\...\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6423.0 - IDT)Intel® Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1252 - Intel Corporation)Intel® Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3621 - Intel Corporation)Intel® Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.5.9.1002 - Intel Corporation)Intel® SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 2.0.0.37149 - Intel Corporation)iTunes (HKLM\...\{5A68A656-979F-4168-8795-E2E368AA4DC2}) (Version: 11.2.2.3 - Apple Inc.)Java 7 Update 67 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217025FF}) (Version: 7.0.670 - Oracle)JBridge (HKLM-x32\...\JBridge) (Version: - JBridge)Jewel Match 3 (x32 Version: 2.2.0.98 - WildTangent) HiddenJohn Deere Drive Green (x32 Version: 2.2.0.95 - WildTangent) HiddenLeft 4 Dead 2 (HKLM-x32\...\Steam App 550) (Version: - Valve)Luxor Evolved (x32 Version: 2.2.0.98 - WildTangent) HiddenMahjongg Dimensions Deluxe: Tiles in Time (x32 Version: 2.2.0.98 - WildTangent) HiddenMalwarebytes Anti-Malware version 2.2.0.1024 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.0.1024 - Malwarebytes)M-Audio M-Track Driver 1.0.6 (x64) (HKLM\...\{7E76C229-D68D-480E-BB99-DAF73BE3C67B}) (Version: 1.0.6 - M-Audio)Max 6.1.10 (x64) (HKLM\...\{C8F67FDD-EE0B-4F60-9FAD-1B49C4E2EB63}) (Version: 136.1.10 - Cycling '74)Microsoft Office Home and Student 2013 - en-us (HKLM\...\HomeStudentRetail - en-us) (Version: 15.0.4779.1002 - Microsoft Corporation)Microsoft OneDrive (HKU\S-1-5-21-1957512214-3067395479-2839608453-1002\...\OneDriveSetup.exe) (Version: 17.3.6281.1202 - Microsoft Corporation)Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.51106 (HKLM-x32\...\{6e8f74e0-43bd-4dce-8477-6ff6828acc07}) (Version: 11.0.51106.1 - Microsoft Corporation)Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.51106 (HKLM-x32\...\{8e70e4e1-06d7-470b-9f74-a51bef21088e}) (Version: 11.0.51106.1 - Microsoft Corporation)Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005 (HKLM-x32\...\{7f51bdb9-ee21-49ee-94d6-90afc321780e}) (Version: 12.0.21005.1 - Microsoft Corporation)Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)Mortimer Beckett and the Crimson Thief Premium Edition (x32 Version: 2.2.0.98 - WildTangent) HiddenMovie Maker (x32 Version: 16.4.3528.0331 - Microsoft Corporation) HiddenMystery P.I. - Curious Case of Counterfeit Cove (x32 Version: 2.2.0.98 - WildTangent) HiddenNative Instruments Abbey Road 60s Drummer (HKLM-x32\...\Native Instruments Abbey Road 60s Drummer) (Version: - Native Instruments)Native Instruments Absynth 5 (HKLM-x32\...\Native Instruments Absynth 5) (Version: - Native Instruments)Native Instruments Battery 4 (HKLM-x32\...\Native Instruments Battery 4) (Version: 4.0.0.1981 - Native Instruments)Native Instruments Battery 4 Factory Library (HKLM-x32\...\Native Instruments Battery 4 Factory Library) (Version: 1.0.0.002 - Native Instruments)Native Instruments Berlin Concert Grand (HKLM-x32\...\Native Instruments Berlin Concert Grand) (Version: - Native Instruments)Native Instruments Controller Editor (HKLM-x32\...\Native Instruments Controller Editor) (Version: 1.6.1.1657 - Native Instruments)Native Instruments FM8 (HKLM-x32\...\Native Instruments FM8) (Version: - Native Instruments)Native Instruments Guitar Rig 5 (HKLM-x32\...\Native Instruments Guitar Rig 5) (Version: - Native Instruments)Native Instruments Guitar Rig Mobile I/O (HKLM-x32\...\Native Instruments Guitar Rig Mobile I/O) (Version: - Native Instruments)Native Instruments Guitar Rig Pro Library for Maschine (HKLM-x32\...\Native Instruments Guitar Rig Pro Library for Maschine) (Version: - Native Instruments)Native Instruments Guitar Rig Session I/O (HKLM-x32\...\Native Instruments Guitar Rig Session I/O) (Version: - Native Instruments)Native Instruments Komplete 9 (HKLM-x32\...\Native Instruments Komplete 9) (Version: - Native Instruments)Native Instruments Komplete Selection (HKLM-x32\...\Native Instruments Komplete Selection) (Version: - Native Instruments)Native Instruments Kontakt 5 (HKLM-x32\...\Native Instruments Kontakt 5) (Version: 5.3.1.37 - Native Instruments)Native Instruments Kontakt Factory Library (HKLM-x32\...\Native Instruments Kontakt Factory Library) (Version: - Native Instruments)Native Instruments Maschine 2 (HKLM-x32\...\Native Instruments Maschine 2) (Version: 2.0.6.1083 - Native Instruments)Native Instruments Maschine 2 Factory Library (HKLM-x32\...\Native Instruments Maschine 2 Factory Library) (Version: 1.0.0.12 - Native Instruments)Native Instruments Maschine Controller Driver (HKLM-x32\...\Native Instruments Maschine Controller Driver) (Version: - Native Instruments)Native Instruments Maschine Controller MK2 Driver (HKLM-x32\...\Native Instruments Maschine Controller MK2 Driver) (Version: - Native Instruments)Native Instruments Maschine Mikro Driver (HKLM-x32\...\Native Instruments Maschine Mikro Driver) (Version: - Native Instruments)Native Instruments Maschine Mikro MK2 Driver (HKLM-x32\...\Native Instruments Maschine Mikro MK2 Driver) (Version: - Native Instruments)Native Instruments Maschine Studio Driver (HKLM-x32\...\Native Instruments Maschine Studio Driver) (Version: - Native Instruments)Native Instruments Massive (HKLM-x32\...\Native Instruments Massive) (Version: 1.4.0.292 - Native Instruments)Native Instruments Monark (HKLM-x32\...\Native Instruments Monark) (Version: - Native Instruments)Native Instruments New York Concert Grand (HKLM-x32\...\Native Instruments New York Concert Grand) (Version: - Native Instruments)Native Instruments Rammfire (HKLM-x32\...\Native Instruments Rammfire) (Version: - Native Instruments)Native Instruments Rammfire for Maschine (HKLM-x32\...\Native Instruments Rammfire for Maschine) (Version: - Native Instruments)Native Instruments Reaktor 5 (HKLM-x32\...\Native Instruments Reaktor 5) (Version: 5.9.2.1074 - Native Instruments)Native Instruments Reaktor Prism (HKLM-x32\...\Native Instruments Reaktor Prism) (Version: 1.4.0.10 - Native Instruments)Native Instruments Reaktor Spark R2 (HKLM-x32\...\Native Instruments Reaktor Spark R2) (Version: - Native Instruments)Native Instruments Reflektor (HKLM-x32\...\Native Instruments Reflektor) (Version: - Native Instruments)Native Instruments Reflektor for Maschine (HKLM-x32\...\Native Instruments Reflektor for Maschine) (Version: - Native Instruments)Native Instruments Retro Machines Mk2 (HKLM-x32\...\Native Instruments Retro Machines Mk2) (Version: - Native Instruments)Native Instruments Rig Kontrol 3 (HKLM-x32\...\Native Instruments Rig Kontrol 3) (Version: - Native Instruments)Native Instruments Scarbee Mark I (HKLM-x32\...\Native Instruments Scarbee Mark I) (Version: 1.3.0.7 - Native Instruments)Native Instruments Scarbee MM-Bass (HKLM-x32\...\Native Instruments Scarbee MM-Bass) (Version: - Native Instruments)Native Instruments Scarbee Vintage Keys (HKLM-x32\...\Native Instruments Scarbee Vintage Keys) (Version: - Native Instruments)Native Instruments Service Center (HKLM-x32\...\Native Instruments Service Center) (Version: 2.5.2.1549 - Native Instruments)Native Instruments Session Strings (HKLM-x32\...\Native Instruments Session Strings) (Version: - Native Instruments)Native Instruments Solid Bus Comp FX (HKLM-x32\...\Native Instruments Solid Bus Comp FX) (Version: 1.0.0.276 - Native Instruments)Native Instruments Solid Dynamics FX (HKLM-x32\...\Native Instruments Solid Dynamics FX) (Version: 1.0.0.276 - Native Instruments)Native Instruments Solid EQ FX (HKLM-x32\...\Native Instruments Solid EQ FX) (Version: 1.0.0.276 - Native Instruments)Native Instruments Studio Drummer (HKLM-x32\...\Native Instruments Studio Drummer) (Version: - Native Instruments)Native Instruments The Finger R2 (HKLM-x32\...\Native Instruments The Finger R2) (Version: - Native Instruments)Native Instruments The Giant (HKLM-x32\...\Native Instruments The Giant) (Version: - Native Instruments)Native Instruments Traktors 12 (HKLM-x32\...\Native Instruments Traktors 12) (Version: - Native Instruments)Native Instruments Traktors 12 for Maschine (HKLM-x32\...\Native Instruments Traktors 12 for Maschine) (Version: - Native Instruments)Native Instruments Transient Master FX (HKLM-x32\...\Native Instruments Transient Master FX) (Version: - Native Instruments)Native Instruments Upright Piano (HKLM-x32\...\Native Instruments Upright Piano) (Version: - Native Instruments)Native Instruments Vienna Concert Grand (HKLM-x32\...\Native Instruments Vienna Concert Grand) (Version: - Native Instruments)Native Instruments Vintage Organs (HKLM-x32\...\Native Instruments Vintage Organs) (Version: - Native Instruments)Native Instruments West Africa (HKLM-x32\...\Native Instruments West Africa) (Version: - Native Instruments)Network Secured DNS (HKLM-x32\...\DnsIo) (Version: 1.52.0.0 - Network Secured DNS)Norton Internet Security (HKLM-x32\...\NIS) (Version: 22.5.5.15 - Symantec Corporation)Novation Launch Control XL Editor version 1.0 (HKLM-x32\...\{CAAF2F99-674E-457a-854A-94051D5F5B18}_is1) (Version: 1.0 - Focusrite Audio Engineering Ltd.)NVIDIA Graphics Driver 331.65 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 331.65 - NVIDIA Corporation)NVIDIA Update 1.10.8 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 1.10.8 - NVIDIA Corporation)Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4693.1002 - Microsoft Corporation) HiddenOffice 15 Click-to-Run Licensing Component (Version: 15.0.4693.1002 - Microsoft Corporation) HiddenOffice 15 Click-to-Run Localization Component (x32 Version: 15.0.4693.1002 - Microsoft Corporation) HiddenPeerBlock 1.2 (r693) (HKLM\...\{015C5B35-B678-451C-9AEE-821E8D69621C}_is1) (Version: 1.2.0.693 - PeerBlock, LLC)Peggle Nights (x32 Version: 2.2.0.98 - WildTangent) HiddenPenguins! (x32 Version: 2.2.0.98 - WildTangent) HiddenPolar Bowler (x32 Version: 2.2.0.97 - WildTangent) HiddenPolar Golfer (x32 Version: 2.2.0.98 - WildTangent) HiddenRalink RT5390R 802.11bgn Wi-Fi Adapter (HKLM-x32\...\{8FC4F1DD-F7FD-4766-804D-3C8FF1D309AF}) (Version: 5.0.5.0 - Ralink)Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.2.612.2012 - Realtek)Realtek PCIE Card Reader (HKLM-x32\...\{C1594429-8296-4652-BF54-9DBE4932A44C}) (Version: 6.2.8400.29034 - Realtek Semiconductor Corp.)Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)Roads of Rome 3 (x32 Version: 2.2.0.98 - WildTangent) HiddenRoyal Envoy 2 Collector's Edition (x32 Version: 3.0.2.32 - WildTangent) HiddenScarlett Plug-in Suite 1.7 (HKLM-x32\...\{D7F912D4-C237-4079-966A-5044A5025CBF}}_is1) (Version: 1.7 - Focusrite)Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.4.40 - Safer-Networking Ltd.)Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) HiddenSynaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 16.2.15.0 - Synaptics Incorporated)Tales of Lagoona (x32 Version: 2.2.0.110 - WildTangent) HiddenTeam Fortress 2 (HKLM-x32\...\Steam App 440) (Version: - Valve)Update Installer for WildTangent Games App (x32 Version: - WildTangent) HiddenValidity WBF DDK (HKLM\...\{1F91C200-8F0F-4009-A75E-DB6CE151BD4E}) (Version: 4.4.234.0 - Validity Sensors, Inc.)WildTangent Games (HKLM-x32\...\WildTangent wildgames Master Uninstall) (Version: 1.0.3.0 - WildTangent)WildTangent Games App (x32 Version: 4.0.9.7 - WildTangent) HiddenWindow Optimizer (HKU\S-1-5-21-1957512214-3067395479-2839608453-1002\...\Window Optimizer) (Version: 1.27 - Digital Light Co.)Windows Driver Package - Focusrite USB 2.0 Audio Driver (09/25/2013 2.5.128.1) (HKLM\...\CF1FC201D237269A9CD51A3A6B14ADBF67175C32) (Version: 09/25/2013 2.5.128.1 - Focusrite)Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)Youda Jewel Shop (x32 Version: 3.0.2.32 - WildTangent) HiddenZuma's Revenge (x32 Version: 2.2.0.98 - WildTangent) Hidden ==================== Custom CLSID (Whitelisted): ========================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) CustomCLSID: HKU\S-1-5-21-1957512214-3067395479-2839608453-1002_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\WINDOWS\system32\igfxEM.exe (Intel Corporation) ==================== Scheduled Tasks (Whitelisted) ============= (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) Task: {02027014-6DA5-43E5-A0C1-0C825A9416F0} - System32\Tasks\{28C5B692-F3F3-46E3-9DE5-0C71F9A07952} => pcalua.exe -a C:\Users\Zack\AppData\Roaming\SSN\uninstall.exeTask: {0D8A6DBC-72AB-4A32-938D-DFCB6ADAD0BF} - System32\Tasks\Norton Internet Security\Norton Error Analyzer => C:\Program Files (x86)\Norton Internet Security\Engine\22.5.5.15\SymErr.exe [2015-11-05] (Symantec Corporation)Task: {19CE6A74-71D1-448F-8CEE-765DF60D6EF0} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater7\HPSFUpdater.exe [2012-09-05] (Hewlett-Packard Company)Task: {1A5C64FF-B11F-439C-AF0B-D0E4131789FF} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-04-10] (Google Inc.)Task: {2F2806BD-82EC-41A8-9642-E77BEAB77C5F} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-10-13] (Microsoft Corporation)Task: {3BF80125-DC19-4D2C-A18F-C05CCF5B6F82} - System32\Tasks\CLMLSvc_P2G8 => C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [2012-06-07] (CyberLink)Task: {4D5EA519-0B46-4C97-BE92-234FAE565B29} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe [2014-06-24] (Safer-Networking Ltd.)Task: {60D8FD05-B24A-47A3-B256-5423C887EC94} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-10-29] (Piriform Ltd)Task: {61B63C27-A5EE-4FD6-9AA5-591901C06F47} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)Task: {6FBFC01B-5F89-450D-B6A3-E9C4349E64A1} - System32\Tasks\{215602C0-0825-46B9-AABD-32562D4E49E2} => pcalua.exe -a "C:\Program Files (x86)\jogotempo\uninst.exe"Task: {8770F09D-95EB-40C2-9AFD-965E9645DEDB} - System32\Tasks\Synaptics TouchPad Enhancements => Program Files\Synaptics\SynTP\SynTPEnh.exeTask: {8966AFC4-9868-4C7B-8E79-54553E270F68} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe [2014-06-27] (Safer-Networking Ltd.)Task: {8CB92F5B-37E5-40FE-8296-7977C10B3017} - System32\Tasks\MirageAgent => C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe [2012-10-12] (CyberLink)Task: {93347EE8-C1BE-4B8E-99E0-9FC7CFEACE30} - System32\Tasks\Norton Internet Security\Norton Error Processor => C:\Program Files (x86)\Norton Internet Security\Engine\22.5.5.15\SymErr.exe [2015-11-05] (Symantec Corporation)Task: {9D950182-6CA6-44B8-BC9B-539AED12241A} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2012-09-27] (Hewlett-Packard Company)Task: {AB9E7401-B1BC-44FB-93E3-59011876A335} - System32\Tasks\Microsoft OneDrive Auto Update Task-S-1-5-21-1957512214-3067395479-2839608453-1002 => C:\Users\Zack\AppData\Local\Microsoft\OneDrive\OneDrive.exe [2015-12-11] (Microsoft Corporation)Task: {AF322C87-2D69-44F0-A16A-EAB217531E22} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-04-10] (Google Inc.)Task: {BA48FCCD-F364-42BF-B684-E7B4DCC4D3D1} - System32\Tasks\Microsoft\Windows\UPnP\UPnPHostConfig => config upnphost start= autoTask: {F162DBE3-BBD5-4276-A1C4-D17F4E5170FA} - System32\Tasks\Remediation\AntimalwareMigrationTask => C:\Program Files\Common Files\AV\Norton Internet Security\Upgrade.exe [2015-11-23] (Symantec Corporation)Task: {F39E1382-908F-463B-977A-FE520C556C14} - System32\Tasks\K9-PCP => C:\Program Files (x86)\K9-PCFixer\k9schedule.exeTask: {F4EF0E12-325B-4C3F-A6A2-022C1B0FDE1A} - System32\Tasks\Norton WSC Integration => C:\Program Files (x86)\Norton Internet Security\Engine\22.5.5.15\WSCStub.exe [2015-11-23] (Symantec Corporation)Task: {F545CE86-9657-49A4-A65C-F6CD8344B0D6} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2012-09-27] (Hewlett-Packard Company)Task: {F8DB6AD2-7F64-431F-91DC-E46D8C4C39CA} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2015-12-10] (Microsoft Corporation)Task: {FE0164F0-24F0-4344-ACD3-B747FA48A6C9} - \RegClean Pro -> No File <==== ATTENTIONTask: {FFD24C81-3212-4EE7-854D-0E8EDFF903A2} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-10-13] (Microsoft Corporation) (If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.) Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exeTask: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exeTask: C:\WINDOWS\Tasks\Synaptics TouchPad Enhancements.job => C:\Program Files\Synaptics\SynTP\SynTPEnh.exeTask: C:\WINDOWS\Tasks\User_Feed_Synchronization-{5C3BE7DA-81AD-4C57-B4AB-3B09DAA7A9BF}.job => C:\WINDOWS\system32\msfeedssync.exe ==================== Shortcuts ============================= (The entries could be listed to be restored or removed.) ==================== Loaded Modules (Whitelisted) ============== ==================== Alternate Data Streams (Whitelisted) ========= (If an entry is included in the fixlist, only the ADS will be removed.) ==================== Safe Mode (Whitelisted) =================== (If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.) HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMSwissArmy => ""="Driver"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MSIServer => ""="Service"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMSwissArmy => ""="Driver"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MSIServer => ""="Service"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SMR501 => ""="Service"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Option => "OptionValue"="2" ==================== EXE Association (Whitelisted) =============== (If an entry is included in the fixlist, the registry item will be restored to default or removed.) ==================== Internet Explorer trusted/restricted =============== (If an entry is included in the fixlist, it will be removed from the registry.) ==================== Hosts content: =============================== (If needed Hosts: directive could be included in the fixlist to reset Hosts.) 2013-08-22 08:25 - 2013-08-22 08:25 - 00000824 ____N C:\WINDOWS\system32\Drivers\etc\hosts ==================== Other Areas ============================ (Currently there is no automatic fix for this section.) HKU\S-1-5-21-1957512214-3067395479-2839608453-1002\Control Panel\Desktop\\Wallpaper -> C:\Users\Zack\AppData\Roaming\Microsoft\Windows Photo Viewer\Windows Photo Viewer Wallpaper.jpgDNS Servers: Media is not connected to internet.HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)Windows Firewall is enabled. ==================== MSCONFIG/TASK MANAGER disabled items == (Currently there is no automatic fix for this section.) HKU\S-1-5-21-1957512214-3067395479-2839608453-1002\...\StartupApproved\Run: => "BitTorrent" ==================== FirewallRules (Whitelisted) =============== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139FirewallRules: [{56DC4E7B-F25F-4F5E-BE8B-B3A71C708244}] => (Allow) C:\Program Files (x86)\iTunes\iTunes.exeFirewallRules: [uDP Query User{DE365860-C1C3-4860-A903-1F04000BAF75}C:\program files (x86)\steam\steam.exe] => (Allow) C:\program files (x86)\steam\steam.exeFirewallRules: [TCP Query User{CA3F5FDF-06B1-446D-83FC-0C6F5C9BD786}C:\program files (x86)\steam\steam.exe] => (Allow) C:\program files (x86)\steam\steam.exeFirewallRules: [{CA639CAD-8562-4FF5-9A39-058AE7AE057A}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Team Fortress 2\hl2.exeFirewallRules: [{2AE0CDA7-E14B-4BB5-9A25-629074D35E4B}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Team Fortress 2\hl2.exeFirewallRules: [{C036F94B-B68E-4483-8659-83DC04DDFDF9}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Left 4 Dead 2\left4dead2.exeFirewallRules: [{A2276020-1DF5-45DC-B328-90EDD53ED849}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Left 4 Dead 2\left4dead2.exeFirewallRules: [{7AF8F440-E6DF-4567-9E8B-3A170C238097}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Team Fortress 2\hl2.exeFirewallRules: [{3962D227-0AC8-4A30-BB20-5B8416AC4C82}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Team Fortress 2\hl2.exeFirewallRules: [{D7279A2B-9367-41BF-A24A-309260B5EFA2}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Counter-Strike Source\hl2.exeFirewallRules: [{4EE60DC0-3A6C-48CF-ABA4-ECA8A8BA3F52}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Counter-Strike Source\hl2.exeFirewallRules: [{91AA5670-733D-4133-84F0-36438D0D0213}] => (Allow) C:\Users\Zack\AppData\Roaming\BitTorrent\BitTorrent.exeFirewallRules: [{06E40A9B-AF4D-4ABD-94E5-A98234AC2CB2}] => (Allow) C:\Users\Zack\AppData\Roaming\BitTorrent\BitTorrent.exeFirewallRules: [{C24F59E3-1003-45AF-B75E-32A98AE40B91}] => (Allow) C:\Program Files (x86)\Steam\Steam.exeFirewallRules: [{260EA907-2B92-4CA6-A9BB-192156C07A73}] => (Allow) C:\Program Files (x86)\Steam\Steam.exeFirewallRules: [{D2203DA3-5D06-4081-A41A-22FCF9D794B4}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDirector10\PDR10.EXEFirewallRules: [{C3D3B01D-73E9-4643-9492-50264DF24616}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD10\PowerDVD10.EXEFirewallRules: [{0C05005A-39D0-451C-86D5-74C64FC1BFF4}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exeFirewallRules: [{CCCE09EC-1841-4223-8384-9CDB41FE2412}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exeFirewallRules: [{B834139A-D9ED-43EB-8108-1999E291A7F6}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exeFirewallRules: [{54079D45-924E-4BDF-A322-9D5013AEBA59}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exeFirewallRules: [{D5113F7A-BACB-4BB1-987F-3A33CE7B6AD4}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exeFirewallRules: [{02D31468-DF2C-49AF-A4A5-B036E16E80EF}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exeFirewallRules: [{313267C1-8BA5-40AE-9504-7A19BF9D4B22}] => (Allow) C:\Program Files (x86)\HPConnectedMusic\HPConnectedMusic.exeFirewallRules: [{AEC7259B-6E41-4B31-BC82-7401B043CE36}] => (Allow) C:\Program Files (x86)\HPConnectedMusic\HPConnectedMusic.exeFirewallRules: [{CACCB147-4CA8-4B00-B260-530F1D05B6EA}] => (Allow) C:\Users\Zack\AppData\Roaming\Copy\CopyAgent.exeFirewallRules: [TCP Query User{73E44585-B71E-4232-BD5E-360587D9F0A2}C:\users\zack\appdata\roaming\copy\copyagent.exe] => (Block) C:\users\zack\appdata\roaming\copy\copyagent.exeFirewallRules: [uDP Query User{F3F69AC4-7B42-4D24-9564-AE3B26CE76E1}C:\users\zack\appdata\roaming\copy\copyagent.exe] => (Block) C:\users\zack\appdata\roaming\copy\copyagent.exeFirewallRules: [{3B475B41-908C-46B8-B4A8-B0358A364F98}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exeFirewallRules: [{1A5A0921-34F3-4EAE-9701-0B57BE3AEEC0}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exeFirewallRules: [{9508DD06-B328-4AC8-A6A7-9DCE0366AB91}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exeFirewallRules: [{E04058D9-BEF8-44D5-8F78-E8E6879F673F}] => (Allow) LPort=2869FirewallRules: [{38B0B790-20D2-4C7B-B406-E1DC32B01B36}] => (Allow) LPort=1900FirewallRules: [{A6CE4005-153F-4667-ADBB-D0583B7FB2FA}] => (Allow) C:\WINDOWS\system32\rundll32.exeFirewallRules: [{43616F05-BC30-43D9-A337-4DE6BEAA4497}] => (Allow) C:\Users\Zack\AppData\Roaming\SSN\ssn.exeFirewallRules: [{AFABBCBC-BF6B-4AFB-95CD-5365A753E4A3}] => (Allow) C:\Users\Zack\AppData\Roaming\SSN\updssn.exeFirewallRules: [{4370C624-5141-4D00-870A-205727ECD920}] => (Allow) 㩃停潲牧浡䘠汩獥⠠㡸⤶睜湩灯晴汩整屲楷潮瑰楦瑬牥攮數FirewallRules: [{4BFEAF16-99F7-4331-BDF0-6EA5F246B7E6}] => (Allow) 㩃停潲牧浡䘠汩獥⠠㡸⤶睜湩灯晴汩整屲敲瑳楷潮瑰楦瑬牥攮數FirewallRules: [{9636989E-E72E-4F2A-AF03-7F2066E17FAD}] => (Allow) 㩃停潲牧浡䘠汩獥⠠㡸⤶睜湩灯晴汩整屲楷潮瑰楦瑬牥⹟硥eFirewallRules: [{C10BA3AA-2D4F-458D-B2FE-746E5DAA10D7}] => (Allow) 㩃停潲牧浡䘠汩獥⠠㡸⤶睜湩灯晴汩整屲敲瑳楷潮瑰楦瑬牥⹟硥eFirewallRules: [{D54D2523-AD65-442B-8525-53AF11726BF5}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exeFirewallRules: [{B4375C8C-2CE1-45E5-8B4E-C9F82779D2F5}] => (Allow) LPort=53000FirewallRules: [{77F86AE5-60BC-49B8-B906-1DD8A30FF657}] => (Allow) LPort=52000StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe] => Enabled:Spybot - Search & Destroy tray accessStandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe] => Enabled:Spybot-S&D 2 Scanner ServiceStandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe] => Enabled:Spybot-S&D 2 UpdaterStandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe] => Enabled:Spybot-S&D 2 Background update serviceStandardProfile\AuthorizedApplications: [C:\Windows\SysWOW64\rundll32.exe] => *:Enabled:rundll32 ==================== Restore Points ========================= 07-01-2016 18:03:48 Removed Ableton Live 9 Suite ==================== Faulty Device Manager Devices ============= Name: ISO MounterDescription: ISO MounterClass Guid: {4d36e97b-e325-11ce-bfc1-08002be10318}Manufacturer: Native Instruments GmbHService: NIWinCDEmuProblem: : Windows cannot start this hardware device because its configuration information (in the registry) is incomplete or damaged. (Code 19)Resolution: A registry problem was detected. This can occur when more than one service is defined for a device, if there is a failure opening the service subkey, or if the driver name cannot be obtained from the service subkey. Try these options:On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.Click "Uninstall", and then click "Scan for hardware changes" to load a usable driver. ==================== Event log errors: ========================= Application errors:==================Error: (01/11/2016 05:38:04 PM) (Source: Customer Experience Improvement Program) (EventID: 1006) (User: )Description: 80070570 Error: (01/11/2016 05:37:33 PM) (Source: ESENT) (EventID: 536) (User: )Description: taskhost (5612) An attempt to create temporary database C:\ProgramData\Microsoft\RAC\StateData\tmp.edb failed with error -1121. Error: (01/11/2016 05:37:03 PM) (Source: Application Error) (EventID: 1000) (User: )Description: Faulting application name: IAStorDataMgrSvc.exe, version: 11.5.9.1002, time stamp: 0x5065e128Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000Exception code: 0xc0000005Fault offset: 0x0467538dFaulting process id: 0x32cFaulting application start time: 0xIAStorDataMgrSvc.exe0Faulting application path: IAStorDataMgrSvc.exe1Faulting module path: IAStorDataMgrSvc.exe2Report Id: IAStorDataMgrSvc.exe3Faulting package full name: IAStorDataMgrSvc.exe4Faulting package-relative application ID: IAStorDataMgrSvc.exe5 Error: (01/11/2016 05:37:02 PM) (Source: .NET Runtime) (EventID: 1026) (User: )Description: Application: IAStorDataMgrSvc.exeFramework Version: v4.0.30319Description: The process was terminated due to an unhandled exception.Exception Info: System.NullReferenceExceptionStack: at IAStorUtil.SystemDataModelListener.ProcessSystemDataModelChanges() at IAStorUtil.SystemDataModelListener.LoadSavedSystemState() at IAStorDataMgr.EventRelay.<Start>b__0(System.Object) at System.Threading.QueueUserWorkItemCallback.WaitCallback_Context(System.Object) at System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean) at System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean) at System.Threading.QueueUserWorkItemCallback.System.Threading.IThreadPoolWorkItem.ExecuteWorkItem() at System.Threading.ThreadPoolWorkQueue.Dispatch() at System.Threading._ThreadPoolWaitCallback.PerformWaitCallback() Error: (01/11/2016 05:35:42 PM) (Source: Windows Search Service) (EventID: 3030) (User: )Description: The gatherer service cannot be initialized. Details:The Temp folder is on a drive that is full or is inaccessible. Free up space on the drive or verify that you have write permission on the Temp folder. (HRESULT : 0x80070660) (0x80070660) Error: (01/10/2016 11:39:00 PM) (Source: Application Error) (EventID: 1000) (User: )Description: Faulting application name: IAStorDataMgrSvc.exe, version: 11.5.9.1002, time stamp: 0x5065e128Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000Exception code: 0xc0000005Fault offset: 0x0428538dFaulting process id: 0xeb8Faulting application start time: 0xIAStorDataMgrSvc.exe0Faulting application path: IAStorDataMgrSvc.exe1Faulting module path: IAStorDataMgrSvc.exe2Report Id: IAStorDataMgrSvc.exe3Faulting package full name: IAStorDataMgrSvc.exe4Faulting package-relative application ID: IAStorDataMgrSvc.exe5 Error: (01/10/2016 11:38:59 PM) (Source: .NET Runtime) (EventID: 1026) (User: )Description: Application: IAStorDataMgrSvc.exeFramework Version: v4.0.30319Description: The process was terminated due to an unhandled exception.Exception Info: System.NullReferenceExceptionStack: at IAStorUtil.SystemDataModelListener.ProcessSystemDataModelChanges() at IAStorUtil.SystemDataModelListener.LoadSavedSystemState() at IAStorDataMgr.EventRelay.<Start>b__0(System.Object) at System.Threading.QueueUserWorkItemCallback.WaitCallback_Context(System.Object) at System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean) at System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean) at System.Threading.QueueUserWorkItemCallback.System.Threading.IThreadPoolWorkItem.ExecuteWorkItem() at System.Threading.ThreadPoolWorkQueue.Dispatch() at System.Threading._ThreadPoolWaitCallback.PerformWaitCallback() Error: (01/10/2016 11:38:50 PM) (Source: Software Protection Platform Service) (EventID: 16385) (User: )Description: Failed to schedule Software Protection service for re-start at 2115-12-18T04:38:50Z. Error Code: 0x80070570. Error: (01/10/2016 11:38:20 PM) (Source: Software Protection Platform Service) (EventID: 16385) (User: )Description: Failed to schedule Software Protection service for re-start at 2115-12-18T04:38:20Z. Error Code: 0x80070570. Error: (01/10/2016 11:37:42 PM) (Source: Windows Search Service) (EventID: 3030) (User: )Description: The gatherer service cannot be initialized. Details:The Temp folder is on a drive that is full or is inaccessible. Free up space on the drive or verify that you have write permission on the Temp folder. (HRESULT : 0x80070660) (0x80070660) System errors:=============Error: (01/11/2016 06:27:33 PM) (Source: DCOM) (EventID: 10005) (User: BOSSPLAYA)Description: 1084WSearchUnavailable{B52D54BB-4818-4EB9-AA80-F9EACD371DF8} Error: (01/11/2016 06:27:33 PM) (Source: DCOM) (EventID: 10005) (User: BOSSPLAYA)Description: 1084WSearchUnavailable{B52D54BB-4818-4EB9-AA80-F9EACD371DF8} Error: (01/11/2016 06:27:33 PM) (Source: DCOM) (EventID: 10005) (User: BOSSPLAYA)Description: 1084ShellHWDetectionUnavailable{DD522ACC-F821-461A-A407-50B198B896DC} Error: (01/11/2016 06:26:42 PM) (Source: DCOM) (EventID: 10005) (User: BOSSPLAYA)Description: 1084WSearchUnavailable{B52D54BB-4818-4EB9-AA80-F9EACD371DF8} Error: (01/11/2016 06:26:42 PM) (Source: DCOM) (EventID: 10005) (User: BOSSPLAYA)Description: 1084WSearchUnavailable{B52D54BB-4818-4EB9-AA80-F9EACD371DF8} Error: (01/11/2016 06:26:38 PM) (Source: DCOM) (EventID: 10005) (User: BOSSPLAYA)Description: 1084ShellHWDetectionUnavailable{DD522ACC-F821-461A-A407-50B198B896DC} Error: (01/11/2016 06:26:31 PM) (Source: DCOM) (EventID: 10005) (User: BOSSPLAYA)Description: 1084WSearchUnavailable{B52D54BB-4818-4EB9-AA80-F9EACD371DF8} Error: (01/11/2016 06:26:31 PM) (Source: DCOM) (EventID: 10005) (User: BOSSPLAYA)Description: 1084WSearchUnavailable{B52D54BB-4818-4EB9-AA80-F9EACD371DF8} Error: (01/11/2016 06:26:31 PM) (Source: DCOM) (EventID: 10005) (User: BOSSPLAYA)Description: 1084WSearchUnavailable{B52D54BB-4818-4EB9-AA80-F9EACD371DF8} Error: (01/11/2016 06:26:31 PM) (Source: DCOM) (EventID: 10005) (User: BOSSPLAYA)Description: 1084WSearchUnavailable{B52D54BB-4818-4EB9-AA80-F9EACD371DF8} ==================== Memory info =========================== Processor: Intel® Core i7-3630QM CPU @ 2.40GHzPercentage of memory in use: 6%Total physical RAM: 12177.27 MBAvailable physical RAM: 11327.78 MBTotal Virtual: 24465.27 MBAvailable Virtual: 23698.73 MB ==================== Drives ================================ Drive c: () (Fixed) (Total:665.49 GB) (Free:395.88 GB) NTFS ==>[system with boot components (obtained from drive)]Drive d: (RECOVERY) (Fixed) (Total:31.93 GB) (Free:3.55 GB) NTFS ==>[system with boot components (obtained from drive)]Drive f: (YEAH HOE) (Removable) (Total:7.22 GB) (Free:7.11 GB) FAT32 ==================== MBR & Partition Table ================== ========================================================Disk: 0 (Size: 698.6 GB) (Disk ID: A50E1C7D) Partition: GPT. ========================================================Disk: 1 (Size: 7.2 GB) (Disk ID: 00000000) Partition: GPT. ==================== End of Addition.txt ============================
  5. I haven't tried that recently. I was finally able to run Malwarebytes, which removed 6 threats the first time, and even more the second time. I then ran my Norton Antivirus and removed two more threats. However, I am still getting an error message when trying to access (open, copy, delete, run programs) from the C drive. Could a virus (or multiple) be responsible for this corrupt message? I'm hoping the drive isn't actually corrupt, although I don't know why it would be, if that were the case. I will post my FRST re​​ports after work today.
  6. It appears as though the entire C: drive is corrupted... I can run programs when moving them to the D drive... I can only assume this is the work of whatever viruses are on my computer, as the problems began as small glitches and crashes and escalated to this point.. I can't run anything that needs to access the C: drive though.
  7. Hey all, I could really use some help with installation of Malwarebytes. I have been attempting to install the program in safe mode from a flash drive, but every time I do, I get an error message saying "Setup was unable to create the directory C:/users/appdate/local/temp/is-FS1CO.tmp: followed by "Error 1392: The file or directory is corrupted and unreadable"... I have utilized the MBAM clean tool for a clean uninstall, but this hasn't gotten me anywhere.. I have gotten further than this error message once, only to get about halfway through the install and receive a similar error message. I have tried alternatives such as "Windows all in one" and various other scanning instruments, but am unable to run any of them on my PC due to error messages of similar nature. The virus also seems to be creating the same error messages when I try to run just about any other program on my PC, as well as viewing pictures.. Google Chrome won't even open. I have Spybot Search and Destroy, but upon completion of a scan, it restarts and freezes in the same spot before I can resolve any threats. I was able to run my Norton antivirus once (won't open usually), and saw it detect something called info stealer.snifula.b, but it didn't flag it. I also saw one called win32.fraudload.edt, so it is obvious my computer is infected. I am running windows 8.1 on an HP. I've been battling this issue for a few days thus far, and could really use some help. PLEASE AND THANK YOU
  8. Hey all, I could really use some help with installation of Malwarebytes. I have been attempting to install the program in safe mode from a flash drive, but every time I do, I get an error message saying "Setup was unable to create the directory C:/users/appdate/local/temp/is-FS1CO.tmp: followed by "Error 1392: The file or directory is corrupted and unreadable"... I have utilized the MBAM clean tool for a clean uninstall, but this hasn't gotten me anywhere.. I have gotten further than this error message once, only to get about halfway through the install and receive a similar error message. I have tried alternatives such as "Windows all in one" and various other scanning instruments, but am unable to run any of them on my PC due to error messages of similar nature. The virus also seems to be creating the same error messages when I try to run just about any other program on my PC, as well as viewing pictures.. Google Chrome won't even open. I have Spybot Search and Destroy, but upon completion of a scan, it restarts and freezes in the same spot before I can resolve any threats. I was able to run my Norton antivirus once (won't open usually), and saw it detect something called info stealer.snifula.b, but it didn't flag it. I also saw one called win32.fraudload.edt, so it is obvious my computer is infected. I am running windows 8.1 on an HP. I've been battling this issue for a few days thus far, and could really use some help. PLEASE AND THANK YOU
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.