Autorun.inf virus cannot be deleted with Malwarebytes

Matthew22 · September 1, 2013

Hello i recently got infected with a virus that makes all the folders in my external hard disk into shortcuts. I have tried many ways to get rid of it including CMD prompt and several shortcut virus removers but the virus comes back after a few seconds. My infected external hard disks have 3 extra files in them called "Recycle.Bin", "System Volume Information" and "recycler" theres also an autorun.inf file that cannot be deleted. After searching the internet for several days I came across a similar topic on this forum and it recomended the use of ComboFix. I tried it and I was told to put the log in the forum for further assistance.

ComboFix 13-08-31.01 - Neoh 01/09/2013 13:49:29.1.4 - x64

Microsoft Windows 8 Single Language 6.2.9200.0.1252.60.1033.18.3982.2284 [GMT 8:00]

Running from: c:\users\Neoh\Desktop\fix.exe.exe

AV: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

SP: IObit Malware Fighter *Disabled/Updated* {A751AC20-3B48-5237-898A-78C4436BB78D}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\programdata\SetStretch.exe

c:\programdata\SetStretch.VBS

c:\windows\msvcr71.dll

.

((((((((((((((((((((((((( Files Created from 2013-08-01 to 2013-09-01 )))))))))))))))))))))))))))))))

.

2013-08-31 16:32 . 2013-08-31 16:32 -------- d-----w- c:\programdata\Malwarebytes

2013-08-31 16:32 . 2013-08-31 16:40 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware

2013-08-31 16:32 . 2013-04-04 06:50 25928 ----a-w- c:\windows\system32\drivers\mbam.sys

2013-08-31 15:24 . 2013-08-31 15:24 -------- d-----w- c:\programdata\IObit

2013-08-31 15:23 . 2013-08-31 15:23 -------- d-----w- c:\program files (x86)\IObit

2013-08-31 09:42 . 2013-08-31 09:42 -------- d-----w- c:\program files\CSL 3.5G Connect

2013-08-30 17:07 . 2013-08-30 17:07 -------- d-----w- C:\3bfda

2013-08-28 12:12 . 2013-08-31 09:29 -------- d-----w- c:\program files\Recuva

2013-08-28 01:58 . 2013-08-28 01:58 -------- d-----w- c:\programdata\NCH Software

2013-08-28 01:57 . 2013-08-28 01:58 -------- d-----w- c:\program files (x86)\NCH Software

2013-08-28 01:11 . 2013-08-31 15:55 -------- d-----w- c:\users\Public\AccountPictures

2013-08-27 18:11 . 2013-08-27 18:11 240304 ----a-w- c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10214.bin

2013-08-27 13:56 . 2013-08-27 13:56 -------- d-----w- c:\program files\Microsoft Office

2013-08-27 13:56 . 2013-08-27 13:56 -------- d-----w- c:\program files (x86)\Microsoft Analysis Services

2013-08-27 13:55 . 2013-08-27 14:03 -------- d-----w- c:\programdata\Microsoft Help

2013-08-27 13:55 . 2013-08-27 13:55 -------- d-----r- C:\MSOCache

2013-08-27 13:32 . 2013-04-03 17:27 5102040 ----a-w- c:\windows\SysWow64\GameMon.des

2013-08-27 13:32 . 2012-01-01 07:33 4774 ----a-w- c:\windows\SysWow64\npptNT2.sys

2013-08-27 13:32 . 2003-07-20 00:17 5174 ----a-w- c:\windows\SysWow64\nppt9x.vxd

2013-08-27 13:32 . 2013-08-27 13:32 -------- d-----w- c:\program files\Common Files\INCA Shared

2013-08-27 13:31 . 2013-08-27 13:31 -------- d-----w- c:\program files (x86)\Combined Community Codec Pack

2013-08-27 13:19 . 2009-05-22 08:02 119552 ----a-w- c:\windows\system32\drivers\bmusbser.sys

2013-08-27 13:19 . 2009-05-22 08:02 103424 ----a-w- c:\windows\SysWow64\MyDIT_GenClassCoInst.dll

2013-08-27 13:19 . 2013-08-31 09:31 -------- d-----w- c:\program files (x86)\CSL 3.5G Connect

2013-08-27 12:33 . 2013-08-27 12:33 -------- d-----w- c:\users\Public\CyberLink

2013-08-27 12:33 . 2013-08-27 12:33 -------- d-----w- c:\programdata\CyberLink

2013-08-27 12:27 . 2013-08-27 12:27 -------- d-----w- c:\program files (x86)\PANDORA.TV

2013-08-27 12:27 . 2013-08-27 12:27 -------- d-----w- c:\program files (x86)\The KMPlayer

2013-08-27 10:26 . 2013-08-27 10:27 -------- d-----w- c:\programdata\Yahoo!

2013-08-27 10:25 . 2013-08-27 10:26 -------- d-----w- c:\program files (x86)\Yahoo!

2013-08-27 10:25 . 2013-08-27 10:25 -------- d-----w- c:\program files (x86)\Common Files\Adobe

2013-08-27 10:23 . 2013-08-27 10:23 -------- d-----w- c:\program files (x86)\Mozilla Maintenance Service

2013-08-27 10:21 . 2013-08-27 16:25 -------- d-----w- c:\program files (x86)\Google

2013-08-27 10:20 . 2013-08-27 10:20 -------- d-----w- c:\program files\7-Zip

2013-08-27 10:16 . 2013-08-27 10:16 50784 ----a-w- c:\programdata\Microsoft\windowsfiltering\Sqm\Manifest\Sqm3.bin

2013-08-27 10:16 . 2013-08-27 10:16 17536 ----a-w- c:\programdata\Microsoft\windowssampling\Sqm\Manifest\Sqm3.bin

2013-08-27 10:13 . 2013-08-29 11:57 -------- d-----w- c:\users\Neoh

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2013-08-27 10:13 . 2012-07-26 08:13 22240 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll

2013-07-18 05:47 . 2013-07-18 05:47 499712 ----a-w- c:\windows\SysWow64\msvcp71.dll

2013-07-18 05:47 . 2013-07-18 05:47 348160 ----a-w- c:\windows\SysWow64\msvcr71.dll

2013-07-18 05:47 . 2013-07-18 05:47 29480 ----a-w- c:\windows\SysWow64\msxml3a.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"2c4e2"="c:\users\Neoh\AppData\Roaming\3a583\2c4e2.js" [X]

"Messenger (Yahoo!)"="c:\program files (x86)\Yahoo!\Messenger\YahooMessenger.exe" [2009-11-10 5244216]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"ASUSPRP"="c:\program files (x86)\ASUS\APRP\APRP.EXE" [2013-04-24 3187360]

"ASUSWebStorage"="c:\program files (x86)\ASUS\WebStorage Sync Agent\1.1.18.159\AsusWSPanel.exe" [2012-12-19 3576784]

"RemoteControl10"="c:\program files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe" [2012-03-29 91432]

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]

"IObit Malware Fighter"="c:\program files (x86)\IObit\IObit Malware Fighter\IMF.exe" [2013-08-16 1549120]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"EnableUIADesktopToggle"= 0 (0x0)

"EnableCursorSuppression"= 1 (0x1)

"ConsentPromptBehaviorUser"= 3 (0x3)

"DisableCAD"= 1 (0x1)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]

"LoadAppInit_DLLs"=1 (0x1)

"AppInit_DLLs"=c:\windows\SysWOW64\nvinit.dll

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\IMFservice]

@="Service"

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

@=""

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc]

@=""

.

R3 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [x]

R3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des;c:\windows\SYSNATIVE\GameMon.des [x]

R3 UrlFilter;UrlFilter;c:\program files (x86)\IObit\IObit Malware Fighter\drivers\win7_amd64\UrlFilter.sys;c:\program files (x86)\IObit\IObit Malware Fighter\drivers\win7_amd64\UrlFilter.sys [x]

R3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\System32\drivers\wdcsam64.sys;c:\windows\SYSNATIVE\drivers\wdcsam64.sys [x]

R4 FileMonitor;FileMonitor;c:\program files (x86)\IObit\IObit Malware Fighter\Drivers\win7_amd64\FileMonitor.sys;c:\program files (x86)\IObit\IObit Malware Fighter\Drivers\win7_amd64\FileMonitor.sys [x]

S0 iaStorA;iaStorA;c:\windows\System32\drivers\iaStorA.sys;c:\windows\SYSNATIVE\drivers\iaStorA.sys [x]

S0 nvpciflt;nvpciflt;c:\windows\system32\DRIVERS\nvpciflt.sys;c:\windows\SYSNATIVE\DRIVERS\nvpciflt.sys [x]

S1 ATKWMIACPIIO;ATKWMIACPI Driver;c:\program files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys;c:\program files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys [x]

S2 ASMMAP64;ASMMAP64;c:\program files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys;c:\program files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys [x]

S2 ASUS InstantOn;ASUS InstantOn Service;c:\program files (x86)\ASUS\ASUS InstantOn\InsOnSrv.exe;c:\program files (x86)\ASUS\ASUS InstantOn\InsOnSrv.exe [x]

S2 Asus WebStorage Windows Service;Asus WebStorage Windows Service;c:\program files (x86)\ASUS\WebStorage Sync Agent\1.1.18.159\AsusWSWinService.exe;c:\program files (x86)\ASUS\WebStorage Sync Agent\1.1.18.159\AsusWSWinService.exe [x]

S2 AtherosSvc;AtherosSvc;c:\program files (x86)\Bluetooth Suite\adminservice.exe;c:\program files (x86)\Bluetooth Suite\adminservice.exe [x]

S2 IconMan_R;IconMan_R;c:\program files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe;c:\program files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [x]

S2 IMFservice;IMF Service;c:\program files (x86)\IObit\IObit Malware Fighter\IMFsrv.exe;c:\program files (x86)\IObit\IObit Malware Fighter\IMFsrv.exe [x]

S2 Intel® Capability Licensing Service Interface;Intel® Capability Licensing Service Interface;c:\program files\Intel\iCLS Client\HeciServer.exe;c:\program files\Intel\iCLS Client\HeciServer.exe [x]

S2 Intel® ME Service;Intel® ME Service;c:\program files (x86)\Intel\Intel® Management Engine Components\FWService\IntelMeFWService.exe;c:\program files (x86)\Intel\Intel® Management Engine Components\FWService\IntelMeFWService.exe [x]

S2 jhi_service;Intel® Dynamic Application Loader Host Interface Service;c:\program files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe;c:\program files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [x]

S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [x]

S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [x]

S2 PanService;PandoraService;c:\program files (x86)\PANDORA.TV\PanService\PandoraService.exe;c:\program files (x86)\PANDORA.TV\PanService\PandoraService.exe [x]

S2 UNS;Intel® Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [x]

S2 ZAtheros Bt and Wlan Coex Agent;ZAtheros Bt and Wlan Coex Agent;c:\program files (x86)\Bluetooth Suite\Ath_CoexAgent.exe;c:\program files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [x]

S3 AiCharger;ASUS Charger Driver;c:\windows\system32\DRIVERS\AiCharger.sys;c:\windows\SYSNATIVE\DRIVERS\AiCharger.sys [x]

S3 AthBTPort;Qualcomm Atheros Virtual Bluetooth Class;c:\windows\system32\DRIVERS\btath_flt.sys;c:\windows\SYSNATIVE\DRIVERS\btath_flt.sys [x]

S3 ATP;ASUS Input Device;c:\windows\System32\drivers\AsusTP.sys;c:\windows\SYSNATIVE\drivers\AsusTP.sys [x]

S3 bmusbser;Network Connect USB Device for Legacy Serial Communication;c:\windows\system32\DRIVERS\bmusbser.sys;c:\windows\SYSNATIVE\DRIVERS\bmusbser.sys [x]

S3 BTATH_BUS;Qualcomm Atheros Bluetooth Bus;c:\windows\System32\drivers\btath_bus.sys;c:\windows\SYSNATIVE\drivers\btath_bus.sys [x]

S3 BTATH_HCRP;Bluetooth HCRP Server driver;c:\windows\System32\drivers\btath_hcrp.sys;c:\windows\SYSNATIVE\drivers\btath_hcrp.sys [x]

S3 BTATH_LWFLT;Bluetooth LWFLT Device;c:\windows\system32\DRIVERS\btath_lwflt.sys;c:\windows\SYSNATIVE\DRIVERS\btath_lwflt.sys [x]

S3 BtFilter;BtFilter;c:\windows\system32\DRIVERS\btfilter.sys;c:\windows\SYSNATIVE\DRIVERS\btfilter.sys [x]

S3 BthLEEnum;Bluetooth Low Energy Driver;c:\windows\system32\DRIVERS\BthLEEnum.sys;c:\windows\SYSNATIVE\DRIVERS\BthLEEnum.sys [x]

S3 HIDSwitch;ASUS Wireless Radio Control;c:\windows\System32\drivers\AsHIDSwitch64.sys;c:\windows\SYSNATIVE\drivers\AsHIDSwitch64.sys [x]

S3 ICCS;Intel® Integrated Clock Controller Service - Intel® ICCS;c:\program files (x86)\Intel\Intel® Integrated Clock Controller Service\ICCProxy.exe;c:\program files (x86)\Intel\Intel® Integrated Clock Controller Service\ICCProxy.exe [x]

S3 IntcDAud;Intel® Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]

S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]

S3 RegFilter;RegFilter;c:\program files (x86)\IObit\IObit Malware Fighter\drivers\win7_amd64\regfilter.sys;c:\program files (x86)\IObit\IObit Malware Fighter\drivers\win7_amd64\regfilter.sys [x]

S3 RSBASTOR;Realtek PCIE CardReader Driver - BA;c:\windows\system32\DRIVERS\RtsBaStor.sys;c:\windows\SYSNATIVE\DRIVERS\RtsBaStor.sys [x]

S3 RTL8168;Realtek 8168 NT Driver;c:\windows\system32\DRIVERS\Rt630x64.sys;c:\windows\SYSNATIVE\DRIVERS\Rt630x64.sys [x]

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]

2013-08-30 10:38 1177552 ----a-w- c:\program files (x86)\Google\Chrome\Application\29.0.1547.62\Installer\chrmstp.exe

.

Contents of the 'Scheduled Tasks' folder

.

2013-09-01 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-08-27 10:32]

.

2013-09-01 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-08-27 10:21]

.

2013-09-01 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-08-27 10:21]

.

--------- X64 Entries -----------

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\!AsusWSShellExt_B]

@="{6D4133E5-0742-4ADC-8A8C-9303440F7190}"

[HKEY_CLASSES_ROOT\CLSID\{6D4133E5-0742-4ADC-8A8C-9303440F7190}]

2012-09-27 07:15 1472512 ----a-w- c:\program files (x86)\ASUS\WebStorage Sync Agent\1.1.18.159\AsusWSShellExt64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\!AsusWSShellExt_O]

@="{64174815-8D98-4CE6-8646-4C039977D808}"

[HKEY_CLASSES_ROOT\CLSID\{64174815-8D98-4CE6-8646-4C039977D808}]

2012-09-27 07:15 1472512 ----a-w- c:\program files (x86)\ASUS\WebStorage Sync Agent\1.1.18.159\AsusWSShellExt64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\!AsusWSShellExt_U]

@="{1C5AB7B1-0B38-4EC4-9093-7FD277E2AF4D}"

[HKEY_CLASSES_ROOT\CLSID\{1C5AB7B1-0B38-4EC4-9093-7FD277E2AF4D}]

2012-09-27 07:15 1472512 ----a-w- c:\program files (x86)\ASUS\WebStorage Sync Agent\1.1.18.159\AsusWSShellExt64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveBlacklistedOverlay]

@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}"

[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}]

2013-06-27 08:11 778704 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedEditOverlay]

@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"

[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}]

2013-06-27 08:11 778704 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedViewOverlay]

@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}"

[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}]

2013-06-27 08:11 778704 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncedOverlay]

@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}"

[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}]

2013-06-27 08:11 778704 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncingOverlay]

@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}"

[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}]

2013-06-27 08:11 778704 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2013-02-21 171992]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2013-02-21 399832]

"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2013-04-24 13535304]

"RtHDVBg"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2013-04-24 1307720]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

"AppInit_DLLs"=c:\windows\System32\nvinitx.dll

.

------- Supplementary Scan -------

.

uLocal Page = c:\windows\system32\blank.htm

mLocal Page = c:\windows\SysWOW64\blank.htm

IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000

IE: Se&nd to OneNote - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105

TCP: Interfaces\{CAC55C7A-405F-466D-88B0-6F509E667897}: NameServer = 203.82.64.129 203.82.64.145

FF - ProfilePath - c:\users\Neoh\AppData\Roaming\Mozilla\Firefox\Profiles\qkkklbw0.default\

.

- - - - ORPHANS REMOVED - - - -

.

Toolbar-Locked - (no file)

ShellIconOverlayIdentifiers-{F241C880-6982-4CE5-8CF7-7085BA96DA5A} - (no file)

ShellIconOverlayIdentifiers-{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} - (no file)

ShellIconOverlayIdentifiers-{BBACC218-34EA-4666-9D7A-C78F2274A524} - (no file)

Toolbar-Locked - (no file)

ShellIconOverlayIdentifiers-{F241C880-6982-4CE5-8CF7-7085BA96DA5A} - (no file)

ShellIconOverlayIdentifiers-{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} - (no file)

ShellIconOverlayIdentifiers-{BBACC218-34EA-4666-9D7A-C78F2274A524} - (no file)

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\npggsvc]

"ImagePath"="c:\windows\system32\GameMon.des -service"

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]

@Denied: (A) (Everyone)

"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]

@Denied: (A) (Everyone)

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]

"Key"="ActionsPane3"

"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e96d-e325-11ce-bfc1-08002be10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

@SACL=(02 0000)

.

Completion time: 2013-09-01 13:54:33

ComboFix-quarantined-files.txt 2013-09-01 05:54

.

Pre-Run: 177,808,629,760 bytes free

Post-Run: 178,035,535,872 bytes free

.

- - End Of File - - 86F7EDCA065BFBA6677F0719A4A74683

5FB38429D5D77768867C76DCBDB35194

AdvancedSetup · September 2, 2013

I notice that you're running IObit Malware Fighter

The company behind this product was found to be stealing our database.
Personally I would not trust installing any software from a company that resorts to stealing someone's technology to sell their product.
Please see the following links and make up your own mind if you want to keep this on your system. If needed I can help you remove it.

Please visit this webpage and read the ComboFix User's Guide:

Once you've read the article and are ready to use the program you can download it directly from the link below.
Important! - Please make sure you save combofix to your desktop and do not run it from your browser
Direct download link for: ComboFix.exe
Please make sure you disable your security applications before running ComboFix.
Once Combofix has completed it will produce and open a log file. Please be patient as it can take some time to load.
Please attach that log file to your next reply.
If needed the file can be located here: C:\combofix.txt
NOTE: If you receive the message "illegal operation has been attempted on a registry key that has been marked for deletion", just reboot the computer.

Matthew22 · September 2, 2013

I read that ComboFix is not supported by Windows 8? Also IObit was recomended by a friend, I am planning to uninstall it after I downloaded avast when I am free.

AdvancedSetup · September 2, 2013

Please download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

Double-click to run it. When the tool opens click Yes to disclaimer.
Press Scan button.
It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

Matthew22 · September 2, 2013

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-09-2013 04

Ran by Neoh (administrator) on USER on 02-09-2013 16:47:10

Running from C:\Users\Neoh\Desktop

Windows 8 Single Language (X64) OS Language: English(US)

Internet Explorer Version 10

Boot Mode: Normal

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe

(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe

(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe

(IObit) C:\Program Files (x86)\IObit\IObit Malware Fighter\IMFsrv.exe

(ASUS) C:\Program Files (x86)\ASUS\ASUS InstantOn\InsOnSrv.exe

() C:\Program Files (x86)\ASUS\WebStorage Sync Agent\1.1.18.159\AsusWSWinService.exe

(Qualcomm Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\adminservice.exe

(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe

(Microsoft Corporation) C:\Windows\system32\dashost.exe

(Intel® Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe

(Pandora.TV) C:\Program Files (x86)\PANDORA.TV\PanService\PandoraService.exe

(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe

(Atheros) C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe

(PandoraTV) C:\Program Files (x86)\PANDORA.TV\PanService\PanProcess.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Integrated Clock Controller Service\ICCProxy.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\FWService\IntelMeFWService.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe

(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\Splendid\ColorUService.exe

(ASUS) C:\Program Files\ASUS\P4G\BatteryLife.exe

(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\USBChargerPlus\USBChargerPlus.exe

(ASUS) C:\Program Files (x86)\ASUS\Splendid\ACMON.exe

(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe

(ASUS) C:\Program Files (x86)\ASUS\ASUS InstantOn\InsOnWMI.exe

(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe

(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe

(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe

(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4406.1205_x64__8wekyb3d8bbwe\LiveComm.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPLoader.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\QuickGesture\x64\QuickGesture64.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\QuickGesture\x86\QuickGesture.exe

(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPHelper.exe

(Intel Corporation) C:\Windows\system32\igfxpers.exe

(Intel Corporation) C:\Windows\System32\igfxtray.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe

(Microsoft Corporation) C:\Windows\System32\WScript.exe

(Yahoo! Inc.) C:\Program Files (x86)\Yahoo!\Messenger\ymsgr_tray.exe

(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Live Update\LiveUpdate.exe

(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPCenter.exe

() C:\Program Files\CSL 3.5G Connect\WirelessModem.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Farbar) C:\Users\Neoh\Desktop\Far.exe.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13535304 2013-04-24] (Realtek Semiconductor)

HKLM\...\Run: [RtHDVBg] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1307720 2013-04-24] (Realtek Semiconductor)

HKLM\...\Policies\Explorer: [NoDrives] 0

HKCU\...\Run: [Messenger (Yahoo!)] - C:\Program Files (x86)\Yahoo!\Messenger\YahooMessenger.exe [5244216 2009-11-11] (Yahoo! Inc.)

HKCU\...\Run: [2c4e2] - C:\Users\Neoh\AppData\Roaming\3a583\2c4e2.js [47534 2013-09-02] ()

HKCU\...\Policies\Explorer: [NoDrives] 0

HKLM-x32\...\Run: [ASUSPRP] - C:\Program Files (x86)\ASUS\APRP\APRP.EXE [3187360 2013-04-24] (ASUSTek Computer Inc.)

HKLM-x32\...\Run: [ASUSWebStorage] - C:\Program Files (x86)\ASUS\WebStorage Sync Agent\1.1.18.159\AsusWSPanel.exe [3576784 2012-12-19] (ASUS Cloud Corporation)

HKLM-x32\...\Run: [RemoteControl10] - C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [91432 2012-03-29] (CyberLink Corp.)

HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-05] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [iObit Malware Fighter] - C:\Program Files (x86)\IObit\IObit Malware Fighter\IMF.exe [1549120 2013-08-16] (IObit)

AppInit_DLLs: C:\Windows\System32\nvinitx.dll [245872 2013-03-07] (NVIDIA Corporation)

AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll [201576 2013-03-07] (NVIDIA Corporation)

Startup: C:\Users\Neoh\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7f0c7.js ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://asus13.msn.com

StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe

SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=ASU2JS

SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=ASU2JS

SearchScopes: HKLM-x32 - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=ASU2JS

SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=ASU2JS

SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =

SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =

BHO: CIESpeechBHO Class - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Qualcomm Atheros Commnucations)

BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)

BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)

Tcpip\..\Interfaces\{CAC55C7A-405F-466D-88B0-6F509E667897}: [NameServer]203.82.64.145 203.82.64.129

FireFox:

========

FF ProfilePath: C:\Users\Neoh\AppData\Roaming\Mozilla\Firefox\Profiles\qkkklbw0.default

FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()

FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 - C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)

FF Plugin-x32: @messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6 - C:\Program Files (x86)\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)

FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 - C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()

FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] C:\Program Files\McAfee\MSK

Chrome:

=======

CHR RestoreOnStartup: "https://www.google.com/"

CHR DefaultSearchURL: (Google) - {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}{google:omniboxStartMarginParameter}ie={inputEncoding}

CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&q={searchTerms}&{google:cursorPosition}{google:zeroPrefixUrl}sugkey={google:suggestAPIKeyParameter}

CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.62\PepperFlash\pepflashplayer.dll ()

CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer

CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.62\ppGoogleNaClPluginChrome.dll ()

CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.62\pdf.dll ()

CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)

CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)

CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)

CHR Plugin: (Intel\u00AE Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)

CHR Plugin: (Intel\u00AE Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)

CHR Plugin: (WildTangent Games App V2 Presence Detector) - C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()

CHR Plugin: (Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()

CHR Plugin: (McAfee SecurityCenter) - c:\PROGRA~2\mcafee\msc\NPMCSN~1.DLL No File

CHR Extension: (Google Docs) - C:\Users\Neoh\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0

CHR Extension: (Google Drive) - C:\Users\Neoh\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0

CHR Extension: (YouTube) - C:\Users\Neoh\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0

CHR Extension: (Google Search) - C:\Users\Neoh\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0

CHR Extension: (Chrome In-App Payments service) - C:\Users\Neoh\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.10_0

CHR Extension: (Gmail) - C:\Users\Neoh\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0

==================== Services (Whitelisted) =================

R2 ASUS InstantOn; C:\Program Files (x86)\ASUS\ASUS InstantOn\InsOnSrv.exe [277120 2012-04-14] (ASUS)

R2 Asus WebStorage Windows Service; C:\Program Files (x86)\ASUS\WebStorage Sync Agent\1.1.18.159\AsusWSWinService.exe [72192 2012-12-19] ()

R2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [226944 2012-12-29] (Qualcomm Atheros Commnucations)

R2 IMFservice; C:\Program Files (x86)\IObit\IObit Malware Fighter\IMFsrv.exe [335168 2013-04-25] (IObit)

R2 Intel® ME Service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\FWService\IntelMeFWService.exe [129856 2012-07-06] (Intel Corporation)

R2 jhi_service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [166720 2012-07-06] (Intel Corporation)

S3 npggsvc; C:\Windows\SysWow64\GameMon.des [5102040 2013-04-04] (INCA Internet Co., Ltd.)

R2 PanService; C:\Program Files (x86)\PANDORA.TV\PanService\PandoraService.exe [625304 2012-09-28] (Pandora.TV)

R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [14920 2013-04-24] (Microsoft Corporation)

R2 ZAtheros Bt and Wlan Coex Agent; C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [323584 2012-12-29] (Atheros)

==================== Drivers (Whitelisted) ====================

R3 ATP; C:\Windows\System32\drivers\AsusTP.sys [65784 2013-02-07] (ASUS Corporation)

R3 bmusbser; C:\Windows\system32\DRIVERS\bmusbser.sys [119552 2009-05-22] (BM)

R3 BTATH_LWFLT; C:\Windows\system32\DRIVERS\btath_lwflt.sys [77464 2012-12-29] (Qualcomm Atheros)

R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [202752 2012-07-26] (Microsoft Corporation)

S4 FileMonitor; C:\Program Files (x86)\IObit\IObit Malware Fighter\Drivers\win7_amd64\FileMonitor.sys [23048 2013-03-23] (IObit)

R3 kbfiltr; C:\Windows\System32\drivers\kbfiltr.sys [14992 2012-08-02] ( )

R3 RegFilter; C:\Program Files (x86)\IObit\IObit Malware Fighter\drivers\win7_amd64\regfilter.sys [34336 2013-03-26] (IObit.com)

S3 UrlFilter; C:\Program Files (x86)\IObit\IObit Malware Fighter\drivers\win7_amd64\UrlFilter.sys [23016 2013-03-26] (IObit.com)

U5 AppMgmt; C:\Windows\system32\svchost.exe [29696 2013-04-24] (Microsoft Corporation)

S3 catchme; \??\C:\fix.exe\catchme.sys [x]

U0 msahci;

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2013-09-02 16:45 - 2013-09-02 16:45 - 01085803 _____ (Farbar) C:\Users\Neoh\Desktop\FRST.exe

2013-09-02 16:43 - 2013-09-02 16:43 - 01951950 _____ (Farbar) C:\Users\Neoh\Desktop\Far.exe.exe

2013-09-02 16:41 - 2013-09-02 16:41 - 00018534 _____ C:\Users\Neoh\Desktop\combofix.txt

2013-09-02 16:40 - 2013-09-02 16:40 - 00018534 _____ C:\ComboFix.txt

2013-09-02 12:06 - 2013-05-02 23:29 - 00278800 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe

2013-09-01 21:13 - 2013-09-01 21:13 - 01038464 _____ (Bleeping Computer, LLC) C:\Users\Neoh\Downloads\rkill64-7800.exe

2013-09-01 21:13 - 2013-09-01 21:13 - 01038464 _____ (Bleeping Computer, LLC) C:\Users\Neoh\Downloads\rkill64.exe

2013-09-01 21:12 - 2013-09-01 21:12 - 01898112 _____ (Bleeping Computer, LLC) C:\Users\Neoh\Downloads\run.com.exe

2013-09-01 13:48 - 2013-09-02 16:40 - 00000000 ____D C:\Qoobox

2013-09-01 13:48 - 2013-09-01 13:53 - 00000000 ____D C:\Windows\erdnt

2013-09-01 13:48 - 2011-06-26 14:45 - 00256000 _____ C:\Windows\PEV.exe

2013-09-01 13:48 - 2010-11-08 01:20 - 00208896 _____ C:\Windows\MBR.exe

2013-09-01 13:48 - 2009-04-20 12:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe

2013-09-01 13:48 - 2000-08-31 08:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe

2013-09-01 13:48 - 2000-08-31 08:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe

2013-09-01 13:48 - 2000-08-31 08:00 - 00212480 _____ (SteelWerX) C:\Windows\SWXCACLS.exe

2013-09-01 13:48 - 2000-08-31 08:00 - 00098816 _____ C:\Windows\sed.exe

2013-09-01 13:48 - 2000-08-31 08:00 - 00080412 _____ C:\Windows\grep.exe

2013-09-01 13:48 - 2000-08-31 08:00 - 00068096 _____ C:\Windows\zip.exe

2013-09-01 13:30 - 2013-09-02 16:34 - 05116805 ____R (Swearware) C:\Users\Neoh\Desktop\fix.exe.exe

2013-09-01 00:52 - 2013-09-01 09:40 - 00000029 _____ C:\Users\Neoh\AppData\Roaming\mbam.context.scan

2013-09-01 00:33 - 2013-09-01 00:33 - 00000000 ____D C:\Users\Neoh\AppData\Roaming\Malwarebytes

2013-09-01 00:32 - 2013-09-02 01:00 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2013-09-01 00:32 - 2013-09-01 00:32 - 00000000 ____D C:\ProgramData\Malwarebytes

2013-08-31 23:24 - 2013-08-31 23:24 - 00001175 _____ C:\Users\Public\Desktop\IObit Malware Fighter.lnk

2013-08-31 23:24 - 2013-08-31 23:24 - 00000000 ____D C:\Users\Neoh\AppData\Roaming\IObit

2013-08-31 23:24 - 2013-08-31 23:24 - 00000000 ____D C:\ProgramData\IObit

2013-08-31 23:23 - 2013-08-31 23:23 - 00000000 ____D C:\Program Files (x86)\IObit

2013-08-31 17:57 - 2013-08-31 17:59 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Neoh\Downloads\mbam-setup-1.75.0.1300 (1).exe

2013-08-31 17:42 - 2013-09-01 01:41 - 00000615 _____ C:\Users\Public\Desktop\CSL 3.5G Connect.lnk

2013-08-31 17:42 - 2013-08-31 17:42 - 00000000 ____D C:\Program Files\CSL 3.5G Connect

2013-08-31 17:23 - 2013-08-31 17:24 - 00806717 _____ C:\Users\Neoh\Downloads\Shortcut Virus Remover v3.1.exe

2013-08-31 17:21 - 2013-08-31 17:22 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Neoh\Downloads\winlogon.exe.exe

2013-08-31 16:10 - 2013-09-01 01:47 - 00340354 _____ C:\Users\Neoh\AppData\Roaming\ICARE_ACTIVITY.LOG

2013-08-31 16:09 - 2013-09-01 09:20 - 04613956 _____ C:\Users\Neoh\AppData\Roaming\ICARE.LOG

2013-08-31 16:08 - 2013-08-31 16:08 - 00017028 _____ C:\Users\Neoh\Downloads\AutoRunExterminator-1.8.zip

2013-08-31 15:46 - 2013-08-31 23:49 - 00000000 ____D C:\Users\Neoh\Desktop\New folder

2013-08-31 02:12 - 2013-08-31 02:12 - 00000000 ____D C:\Users\Neoh\AppData\Roaming\Media Player Classic

2013-08-31 01:07 - 2013-08-31 01:07 - 00000000 __SHD C:\Users\Neoh\AppData\Roaming\3a583

2013-08-31 01:07 - 2013-08-31 01:07 - 00000000 __SHD C:\3bfda

2013-08-30 23:11 - 2013-08-30 23:11 - 00000000 ____D C:\Users\Neoh\AppData\Roaming\NVIDIA

2013-08-28 20:12 - 2013-08-31 17:29 - 00000000 ____D C:\Program Files\Recuva

2013-08-28 20:12 - 2013-08-31 15:50 - 00001660 _____ C:\Users\Public\Desktop\Recuva.lnk

2013-08-28 09:58 - 2013-08-28 10:46 - 00000000 ____D C:\Windows\System32\Tasks\NCH Software

2013-08-28 09:58 - 2013-08-28 09:58 - 00000000 ____D C:\ProgramData\NCH Software

2013-08-28 09:57 - 2013-08-28 09:58 - 00000000 ____D C:\Program Files (x86)\NCH Software

2013-08-28 09:57 - 2013-08-28 09:57 - 03292760 _____ (NCH Software) C:\Users\Neoh\Downloads\vpsetup.exe

2013-08-28 09:57 - 2013-08-28 09:57 - 00001136 _____ C:\Users\Public\Desktop\VideoPad Video Editor.lnk

2013-08-28 09:57 - 2013-08-28 09:57 - 00000000 ____D C:\Users\Neoh\AppData\Roaming\NCH Software

2013-08-28 02:03 - 2013-08-28 02:03 - 00000310 _____ C:\Windows\AutoKMS.log

2013-08-28 00:27 - 2013-08-31 23:54 - 00000000 ____D C:\Users\Neoh\Google Drive

2013-08-28 00:27 - 2013-08-28 00:27 - 00001658 _____ C:\Users\Neoh\Desktop\Google Drive.lnk

2013-08-28 00:25 - 2013-08-28 00:25 - 00002046 _____ C:\Users\Public\Desktop\Google Slides.lnk

2013-08-28 00:25 - 2013-08-28 00:25 - 00002042 _____ C:\Users\Public\Desktop\Google Sheets.lnk

2013-08-28 00:25 - 2013-08-28 00:25 - 00002030 _____ C:\Users\Public\Desktop\Google Docs.lnk

2013-08-28 00:18 - 2013-08-28 00:18 - 00784832 _____ (Google Inc.) C:\Users\Neoh\Downloads\googledrivesync.exe

2013-08-27 22:27 - 2013-09-01 19:59 - 00003598 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-458189604-2422199037-1606706877-1002

2013-08-27 22:27 - 2013-08-27 22:27 - 00000184 _____ C:\Windows\AutoKMS.ini

2013-08-27 21:56 - 2013-08-27 21:56 - 00000000 ____D C:\Windows\System32\Tasks\OfficeSoftwareProtectionPlatform

2013-08-27 21:56 - 2013-08-27 21:56 - 00000000 ____D C:\Users\Neoh\AppData\Local\Microsoft Help

2013-08-27 21:56 - 2013-08-27 21:56 - 00000000 ____D C:\Program Files\Microsoft Office

2013-08-27 21:56 - 2013-08-27 21:56 - 00000000 ____D C:\Program Files (x86)\Microsoft Analysis Services

2013-08-27 21:55 - 2013-08-27 22:03 - 00000000 ____D C:\ProgramData\Microsoft Help

2013-08-27 21:55 - 2013-08-27 22:00 - 00000000 ____D C:\Program Files (x86)\Microsoft Office

2013-08-27 21:55 - 2013-08-27 21:55 - 00000000 ___RD C:\MSOCache

2013-08-27 21:35 - 2013-08-31 01:20 - 00000000 ____D C:\Users\Neoh\AppData\Local\CrashDumps

2013-08-27 21:32 - 2013-08-27 21:32 - 00000000 ____D C:\Program Files\Common Files\INCA Shared

2013-08-27 21:32 - 2013-04-04 01:27 - 05102040 _____ (INCA Internet Co., Ltd.) C:\Windows\SysWOW64\GameMon.des

2013-08-27 21:32 - 2012-01-01 15:33 - 00004774 _____ (INCA Internet Co., Ltd.) C:\Windows\SysWOW64\npptNT2.sys

2013-08-27 21:32 - 2003-07-20 08:17 - 00005174 _____ C:\Windows\SysWOW64\nppt9x.vxd

2013-08-27 21:31 - 2013-08-27 21:31 - 00000000 ____D C:\Program Files (x86)\Combined Community Codec Pack

2013-08-27 21:27 - 2013-08-27 21:28 - 09283128 _____ (CCCP Project ) C:\Users\Neoh\Downloads\Combined-Community-Codec-Pack-2013-08-01.exe

2013-08-27 21:22 - 2013-08-27 21:22 - 00001062 _____ C:\Users\Neoh\Desktop\GUpdate_SINGAPORE - Shortcut.lnk

2013-08-27 21:20 - 2013-08-27 21:20 - 00000000 ____D C:\Users\Neoh\AppData\Local\Adobe

2013-08-27 21:19 - 2013-08-31 17:31 - 00000000 ____D C:\Program Files (x86)\CSL 3.5G Connect

2013-08-27 21:19 - 2009-05-22 16:02 - 00119552 _____ (BM) C:\Windows\system32\Drivers\bmusbser.sys

2013-08-27 21:19 - 2009-05-22 16:02 - 00103424 _____ (Thesycon GmbH) C:\Windows\SysWOW64\MyDIT_GenClassCoInst.dll

2013-08-27 20:33 - 2013-08-27 20:33 - 00000000 ____D C:\Users\Public\CyberLink

2013-08-27 20:33 - 2013-08-27 20:33 - 00000000 ____D C:\Users\Neoh\Documents\CyberLink

2013-08-27 20:33 - 2013-08-27 20:33 - 00000000 ____D C:\Users\Neoh\AppData\Roaming\CyberLink

2013-08-27 20:33 - 2013-08-27 20:33 - 00000000 ____D C:\Users\Neoh\AppData\Local\Cyberlink

2013-08-27 20:33 - 2013-08-27 20:33 - 00000000 ____D C:\ProgramData\CyberLink

2013-08-27 20:27 - 2013-08-27 20:27 - 00001037 _____ C:\Users\Neoh\Desktop\KMPlayer.lnk

2013-08-27 20:27 - 2013-08-27 20:27 - 00000000 ____D C:\Users\Neoh\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\The KMPlayer

2013-08-27 20:27 - 2013-08-27 20:27 - 00000000 ____D C:\Program Files (x86)\The KMPlayer

2013-08-27 20:27 - 2013-08-27 20:27 - 00000000 ____D C:\Program Files (x86)\PANDORA.TV

2013-08-27 18:27 - 2013-08-27 18:27 - 00001161 _____ C:\Users\Public\Desktop\Yahoo! Messenger.lnk

2013-08-27 18:26 - 2013-08-27 18:27 - 00000000 ____D C:\ProgramData\Yahoo!

2013-08-27 18:25 - 2013-08-30 22:16 - 00000000 ____D C:\ProgramData\Adobe

2013-08-27 18:25 - 2013-08-27 18:26 - 00000000 ____D C:\Program Files (x86)\Yahoo!

2013-08-27 18:25 - 2013-08-27 18:25 - 00000000 ____D C:\Program Files (x86)\Adobe

2013-08-27 18:24 - 2013-09-02 16:28 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job

2013-08-27 18:24 - 2013-08-27 18:32 - 00003718 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater

2013-08-27 18:23 - 2013-08-27 18:23 - 00001149 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk

2013-08-27 18:23 - 2013-08-27 18:23 - 00000000 ____D C:\Users\Neoh\AppData\Roaming\Mozilla

2013-08-27 18:23 - 2013-08-27 18:23 - 00000000 ____D C:\Users\Neoh\AppData\Local\Mozilla

2013-08-27 18:23 - 2013-08-27 18:23 - 00000000 ____D C:\ProgramData\Mozilla

2013-08-27 18:23 - 2013-08-27 18:23 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service

2013-08-27 18:23 - 2013-08-27 18:23 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox

2013-08-27 18:22 - 2013-08-30 18:41 - 00002185 _____ C:\Users\Public\Desktop\Google Chrome.lnk

2013-08-27 18:21 - 2013-09-02 16:37 - 00000904 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2013-08-27 18:21 - 2013-09-02 11:20 - 00000900 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2013-08-27 18:21 - 2013-08-28 00:25 - 00000000 ____D C:\Users\Neoh\AppData\Local\Google

2013-08-27 18:21 - 2013-08-28 00:25 - 00000000 ____D C:\Program Files (x86)\Google

2013-08-27 18:21 - 2013-08-27 18:32 - 00003876 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA

2013-08-27 18:21 - 2013-08-27 18:32 - 00003640 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore

2013-08-27 18:20 - 2013-08-27 18:20 - 00000000 ____D C:\Program Files\7-Zip

2013-08-27 18:19 - 2013-08-27 18:19 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdFs_01_11_00.Wdf

2013-08-27 18:17 - 2013-08-27 18:17 - 00000000 ____D C:\Users\Neoh\AppData\Roaming\Macromedia

2013-08-27 18:16 - 2013-09-02 16:00 - 00000000 ____D C:\Users\Neoh\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

2013-08-27 18:16 - 2013-09-01 01:47 - 00000000 ____D C:\Users\Neoh\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools

2013-08-27 18:16 - 2013-08-28 11:26 - 00000000 ____D C:\Users\Neoh\Documents\Bluetooth Folder

2013-08-27 18:16 - 2013-08-27 18:16 - 00000000 ____D C:\Windows\System32\Tasks\WPD

2013-08-27 18:16 - 2013-08-27 18:16 - 00000000 ____D C:\Users\Neoh\AppData\Roaming\Atheros

2013-08-27 18:16 - 2013-08-27 18:16 - 00000000 ____D C:\Users\Neoh\AppData\Roaming\ASUS WebStorage

2013-08-27 18:16 - 2013-08-27 18:16 - 00000000 ____D C:\Users\Neoh\AppData\Local\BMExplorer

2013-08-27 18:15 - 2013-08-27 21:20 - 00000000 ____D C:\Users\Neoh\AppData\Roaming\Adobe

2013-08-27 18:15 - 2013-08-27 18:15 - 00001432 _____ C:\Users\Neoh\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk

2013-08-27 18:14 - 2013-09-02 11:20 - 00000074 _____ C:\Users\Neoh\AppData\Roaming\sp_data.sys

2013-08-27 18:14 - 2013-08-27 18:14 - 00000192 _____ C:\Windows\FixPatch.log

2013-08-27 18:13 - 2013-09-01 01:48 - 00000000 ____D C:\Users\Neoh\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories

2013-08-27 18:13 - 2013-09-01 01:48 - 00000000 ____D C:\Users\Neoh\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility

2013-08-27 18:13 - 2013-09-01 01:47 - 00000000 ____D C:\Users\Neoh\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools

2013-08-27 18:13 - 2013-09-01 01:47 - 00000000 ____D C:\Users\Neoh\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance

2013-08-27 18:13 - 2013-08-29 19:57 - 00000000 ____D C:\Users\Neoh

2013-08-27 18:13 - 2013-08-27 20:07 - 00000000 ____D C:\Users\Neoh\AppData\Local\VirtualStore

2013-08-27 18:13 - 2013-08-27 18:15 - 00000000 ____D C:\Users\Neoh\AppData\Local\Packages

2013-08-27 18:13 - 2013-08-27 18:14 - 00000000 ____D C:\Users\Neoh\AppData\Local\ASUS

2013-08-27 18:13 - 2013-08-27 18:13 - 00000020 ___SH C:\Users\Neoh\ntuser.ini

2013-08-27 18:13 - 2013-04-24 12:10 - 00002102 _____ C:\Users\Neoh\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SkyDrive.lnk

==================== One Month Modified Files and Folders =======

2013-09-02 16:46 - 2013-09-02 16:46 - 00000000 ____D C:\FRST

2013-09-02 16:46 - 2013-07-18 13:28 - 02037451 _____ C:\Windows\WindowsUpdate.log

2013-09-02 16:45 - 2013-09-02 16:45 - 01085803 _____ (Farbar) C:\Users\Neoh\Desktop\FRST.exe

2013-09-02 16:43 - 2013-09-02 16:43 - 01951950 _____ (Farbar) C:\Users\Neoh\Desktop\Far.exe.exe

2013-09-02 16:41 - 2013-09-02 16:41 - 00018534 _____ C:\Users\Neoh\Desktop\combofix.txt

2013-09-02 16:40 - 2013-09-02 16:40 - 00018534 _____ C:\ComboFix.txt

2013-09-02 16:40 - 2013-09-01 13:48 - 00000000 ____D C:\Qoobox

2013-09-02 16:39 - 2012-07-26 13:26 - 00000215 _____ C:\Windows\system.ini

2013-09-02 16:37 - 2013-08-27 18:21 - 00000904 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2013-09-02 16:34 - 2013-09-01 13:30 - 05116805 ____R (Swearware) C:\Users\Neoh\Desktop\fix.exe.exe

2013-09-02 16:28 - 2013-08-27 18:24 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job

2013-09-02 16:00 - 2013-08-27 18:16 - 00000000 ____D C:\Users\Neoh\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

2013-09-02 16:00 - 2012-07-26 16:12 - 00000000 ____D C:\Windows\system32\sru

2013-09-02 11:20 - 2013-08-27 18:21 - 00000900 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2013-09-02 11:20 - 2013-08-27 18:14 - 00000074 _____ C:\Users\Neoh\AppData\Roaming\sp_data.sys

2013-09-02 01:00 - 2013-09-01 00:32 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2013-09-02 00:50 - 2012-07-26 15:22 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2013-09-02 00:41 - 2012-08-02 11:32 - 00021508 _____ C:\Windows\PFRO.log

2013-09-02 00:41 - 2012-07-26 13:26 - 00262144 ___SH C:\Windows\system32\config\BBI

2013-09-01 21:13 - 2013-09-01 21:13 - 01038464 _____ (Bleeping Computer, LLC) C:\Users\Neoh\Downloads\rkill64-7800.exe

2013-09-01 21:13 - 2013-09-01 21:13 - 01038464 _____ (Bleeping Computer, LLC) C:\Users\Neoh\Downloads\rkill64.exe

2013-09-01 21:12 - 2013-09-01 21:12 - 01898112 _____ (Bleeping Computer, LLC) C:\Users\Neoh\Downloads\run.com.exe

2013-09-01 20:23 - 2012-07-26 15:28 - 00848230 _____ C:\Windows\system32\PerfStringBackup.INI

2013-09-01 20:10 - 2012-07-26 15:21 - 00038411 _____ C:\Windows\setupact.log

2013-09-01 19:59 - 2013-08-27 22:27 - 00003598 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-458189604-2422199037-1606706877-1002

2013-09-01 13:54 - 2012-07-26 13:37 - 00000000 __RHD C:\Users\Default

2013-09-01 13:53 - 2013-09-01 13:48 - 00000000 ____D C:\Windows\erdnt

2013-09-01 09:40 - 2013-09-01 00:52 - 00000029 _____ C:\Users\Neoh\AppData\Roaming\mbam.context.scan

2013-09-01 09:20 - 2013-08-31 16:09 - 04613956 _____ C:\Users\Neoh\AppData\Roaming\ICARE.LOG

2013-09-01 01:48 - 2013-08-27 18:13 - 00000000 ____D C:\Users\Neoh\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories

2013-09-01 01:48 - 2013-08-27 18:13 - 00000000 ____D C:\Users\Neoh\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility

2013-09-01 01:47 - 2013-08-31 16:10 - 00340354 _____ C:\Users\Neoh\AppData\Roaming\ICARE_ACTIVITY.LOG

2013-09-01 01:47 - 2013-08-27 18:16 - 00000000 ____D C:\Users\Neoh\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools

2013-09-01 01:47 - 2013-08-27 18:13 - 00000000 ____D C:\Users\Neoh\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools

2013-09-01 01:47 - 2013-08-27 18:13 - 00000000 ____D C:\Users\Neoh\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance

2013-09-01 01:41 - 2013-08-31 17:42 - 00000615 _____ C:\Users\Public\Desktop\CSL 3.5G Connect.lnk

2013-09-01 00:33 - 2013-09-01 00:33 - 00000000 ____D C:\Users\Neoh\AppData\Roaming\Malwarebytes

2013-09-01 00:32 - 2013-09-01 00:32 - 00000000 ____D C:\ProgramData\Malwarebytes

2013-08-31 23:54 - 2013-08-28 00:27 - 00000000 ____D C:\Users\Neoh\Google Drive

2013-08-31 23:52 - 2012-07-26 16:12 - 00000000 ____D C:\Users\Public\Libraries

2013-08-31 23:49 - 2013-08-31 15:46 - 00000000 ____D C:\Users\Neoh\Desktop\New folder

2013-08-31 23:31 - 2013-04-24 12:11 - 00000000 ____D C:\ProgramData\McAfee

2013-08-31 23:28 - 2012-07-26 16:12 - 00000000 ___HD C:\Windows\ELAMBKUP

2013-08-31 23:24 - 2013-08-31 23:24 - 00001175 _____ C:\Users\Public\Desktop\IObit Malware Fighter.lnk

2013-08-31 23:24 - 2013-08-31 23:24 - 00000000 ____D C:\Users\Neoh\AppData\Roaming\IObit

2013-08-31 23:24 - 2013-08-31 23:24 - 00000000 ____D C:\ProgramData\IObit

2013-08-31 23:23 - 2013-08-31 23:23 - 00000000 ____D C:\Program Files (x86)\IObit

2013-08-31 22:19 - 2013-04-24 12:09 - 07275552 _____ C:\Windows\AsDebug.log

2013-08-31 17:59 - 2013-08-31 17:57 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Neoh\Downloads\mbam-setup-1.75.0.1300 (1).exe

2013-08-31 17:42 - 2013-08-31 17:42 - 00000000 ____D C:\Program Files\CSL 3.5G Connect

2013-08-31 17:31 - 2013-08-27 21:19 - 00000000 ____D C:\Program Files (x86)\CSL 3.5G Connect

2013-08-31 17:29 - 2013-08-28 20:12 - 00000000 ____D C:\Program Files\Recuva

2013-08-31 17:24 - 2013-08-31 17:23 - 00806717 _____ C:\Users\Neoh\Downloads\Shortcut Virus Remover v3.1.exe

2013-08-31 17:22 - 2013-08-31 17:21 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Neoh\Downloads\winlogon.exe.exe

2013-08-31 16:08 - 2013-08-31 16:08 - 00017028 _____ C:\Users\Neoh\Downloads\AutoRunExterminator-1.8.zip

2013-08-31 15:50 - 2013-08-28 20:12 - 00001660 _____ C:\Users\Public\Desktop\Recuva.lnk

2013-08-31 02:12 - 2013-08-31 02:12 - 00000000 ____D C:\Users\Neoh\AppData\Roaming\Media Player Classic

2013-08-31 01:20 - 2013-08-27 21:35 - 00000000 ____D C:\Users\Neoh\AppData\Local\CrashDumps

2013-08-31 01:07 - 2013-08-31 01:07 - 00000000 __SHD C:\Users\Neoh\AppData\Roaming\3a583

2013-08-31 01:07 - 2013-08-31 01:07 - 00000000 __SHD C:\3bfda

2013-08-30 23:11 - 2013-08-30 23:11 - 00000000 ____D C:\Users\Neoh\AppData\Roaming\NVIDIA

2013-08-30 22:16 - 2013-08-27 18:25 - 00000000 ____D C:\ProgramData\Adobe

2013-08-30 18:41 - 2013-08-27 18:22 - 00002185 _____ C:\Users\Public\Desktop\Google Chrome.lnk

2013-08-30 01:24 - 2012-07-26 16:12 - 00000000 ____D C:\Windows\AUInstallAgent

2013-08-29 19:57 - 2013-08-27 18:13 - 00000000 ____D C:\Users\Neoh

2013-08-28 11:26 - 2013-08-27 18:16 - 00000000 ____D C:\Users\Neoh\Documents\Bluetooth Folder

2013-08-28 10:46 - 2013-08-28 09:58 - 00000000 ____D C:\Windows\System32\Tasks\NCH Software

2013-08-28 09:58 - 2013-08-28 09:58 - 00000000 ____D C:\ProgramData\NCH Software

2013-08-28 09:58 - 2013-08-28 09:57 - 00000000 ____D C:\Program Files (x86)\NCH Software

2013-08-28 09:57 - 2013-08-28 09:57 - 03292760 _____ (NCH Software) C:\Users\Neoh\Downloads\vpsetup.exe

2013-08-28 09:57 - 2013-08-28 09:57 - 00001136 _____ C:\Users\Public\Desktop\VideoPad Video Editor.lnk

2013-08-28 09:57 - 2013-08-28 09:57 - 00000000 ____D C:\Users\Neoh\AppData\Roaming\NCH Software

2013-08-28 02:13 - 2012-07-26 16:12 - 00000000 ____D C:\Windows\rescache

2013-08-28 02:03 - 2013-08-28 02:03 - 00000310 _____ C:\Windows\AutoKMS.log

2013-08-28 00:27 - 2013-08-28 00:27 - 00001658 _____ C:\Users\Neoh\Desktop\Google Drive.lnk

2013-08-28 00:25 - 2013-08-28 00:25 - 00002046 _____ C:\Users\Public\Desktop\Google Slides.lnk

2013-08-28 00:25 - 2013-08-28 00:25 - 00002042 _____ C:\Users\Public\Desktop\Google Sheets.lnk

2013-08-28 00:25 - 2013-08-28 00:25 - 00002030 _____ C:\Users\Public\Desktop\Google Docs.lnk

2013-08-28 00:25 - 2013-08-27 18:21 - 00000000 ____D C:\Users\Neoh\AppData\Local\Google

2013-08-28 00:25 - 2013-08-27 18:21 - 00000000 ____D C:\Program Files (x86)\Google

2013-08-28 00:18 - 2013-08-28 00:18 - 00784832 _____ (Google Inc.) C:\Users\Neoh\Downloads\googledrivesync.exe

2013-08-27 22:27 - 2013-08-27 22:27 - 00000184 _____ C:\Windows\AutoKMS.ini

2013-08-27 22:17 - 2013-04-24 12:01 - 00420904 _____ C:\Windows\system32\FNTCACHE.DAT

2013-08-27 22:15 - 2012-07-26 16:12 - 00000000 ____D C:\Windows\WinStore

2013-08-27 22:15 - 2012-07-26 16:12 - 00000000 ____D C:\Windows\SysWOW64\th-TH

2013-08-27 22:15 - 2012-07-26 16:12 - 00000000 ____D C:\Windows\SysWOW64\migwiz

2013-08-27 22:15 - 2012-07-26 16:12 - 00000000 ____D C:\Program Files\Windows Photo Viewer

2013-08-27 22:15 - 2012-07-26 16:12 - 00000000 ____D C:\Program Files\Windows Defender

2013-08-27 22:15 - 2012-07-26 16:12 - 00000000 ____D C:\Program Files\Common Files\System

2013-08-27 22:15 - 2012-07-26 16:12 - 00000000 ____D C:\Program Files (x86)\Windows Photo Viewer

2013-08-27 22:15 - 2012-07-26 16:12 - 00000000 ____D C:\Program Files (x86)\Windows Defender

2013-08-27 22:15 - 2012-07-26 15:52 - 00000000 ____D C:\Program Files\Windows Journal

2013-08-27 22:15 - 2012-07-26 15:51 - 00000000 ____D C:\Windows\SysWOW64\WCN

2013-08-27 22:15 - 2012-07-26 15:51 - 00000000 ____D C:\Windows\SysWOW64\slmgr

2013-08-27 22:15 - 2012-07-26 13:38 - 00000000 ____D C:\Windows\SysWOW64\oobe

2013-08-27 22:15 - 2012-07-26 13:37 - 00000000 ____D C:\Windows\servicing

2013-08-27 22:14 - 2012-07-26 16:12 - 00000000 ___RD C:\Windows\ImmersiveControlPanel

2013-08-27 22:14 - 2012-07-26 16:12 - 00000000 ____D C:\Windows\system32\th-TH

2013-08-27 22:14 - 2012-07-26 16:12 - 00000000 ____D C:\Windows\system32\migwiz

2013-08-27 22:14 - 2012-07-26 16:12 - 00000000 ____D C:\Windows\PolicyDefinitions

2013-08-27 22:14 - 2012-07-26 15:51 - 00000000 ____D C:\Windows\system32\WCN

2013-08-27 22:14 - 2012-07-26 15:51 - 00000000 ____D C:\Windows\system32\slmgr

2013-08-27 22:14 - 2012-07-26 13:38 - 00000000 ____D C:\Windows\system32\Sysprep

2013-08-27 22:14 - 2012-07-26 13:38 - 00000000 ____D C:\Windows\system32\oobe

2013-08-27 22:13 - 2012-07-26 16:12 - 00000000 ____D C:\Windows\system32\SystemResetPlatform

2013-08-27 22:10 - 2012-07-26 16:12 - 00000000 ____D C:\Windows\SysWOW64\MUI

2013-08-27 22:10 - 2012-07-26 16:12 - 00000000 ____D C:\Windows\SysWOW64\Com

2013-08-27 22:10 - 2012-07-26 15:51 - 00000000 ____D C:\Windows\SysWOW64\winrm

2013-08-27 22:10 - 2012-07-26 15:51 - 00000000 ____D C:\Windows\SysWOW64\Printing_Admin_Scripts

2013-08-27 22:10 - 2012-07-26 13:38 - 00000000 ____D C:\Windows\SysWOW64\Dism

2013-08-27 22:09 - 2012-07-26 16:12 - 00000000 ____D C:\Windows\IME

2013-08-27 22:08 - 2012-07-26 16:12 - 00000000 ____D C:\Windows\system32\MUI

2013-08-27 22:08 - 2012-07-26 15:51 - 00000000 ____D C:\Windows\system32\winrm

2013-08-27 22:08 - 2012-07-26 15:51 - 00000000 ____D C:\Windows\system32\Printing_Admin_Scripts

2013-08-27 22:08 - 2012-07-26 13:38 - 00000000 ____D C:\Windows\system32\Dism

2013-08-27 22:07 - 2012-07-26 16:12 - 00000000 ____D C:\Windows\system32\Com

2013-08-27 22:03 - 2013-08-27 21:55 - 00000000 ____D C:\ProgramData\Microsoft Help

2013-08-27 22:00 - 2013-08-27 21:55 - 00000000 ____D C:\Program Files (x86)\Microsoft Office

2013-08-27 22:00 - 2012-07-26 15:52 - 00000000 ____D C:\Windows\ShellNew

2013-08-27 21:56 - 2013-08-27 21:56 - 00000000 ____D C:\Windows\System32\Tasks\OfficeSoftwareProtectionPlatform

2013-08-27 21:56 - 2013-08-27 21:56 - 00000000 ____D C:\Users\Neoh\AppData\Local\Microsoft Help

2013-08-27 21:56 - 2013-08-27 21:56 - 00000000 ____D C:\Program Files\Microsoft Office

2013-08-27 21:56 - 2013-08-27 21:56 - 00000000 ____D C:\Program Files (x86)\Microsoft Analysis Services

2013-08-27 21:56 - 2012-07-26 16:12 - 00000000 ____D C:\Program Files\Common Files\microsoft shared

2013-08-27 21:55 - 2013-08-27 21:55 - 00000000 ___RD C:\MSOCache

2013-08-27 21:32 - 2013-08-27 21:32 - 00000000 ____D C:\Program Files\Common Files\INCA Shared

2013-08-27 21:31 - 2013-08-27 21:31 - 00000000 ____D C:\Program Files (x86)\Combined Community Codec Pack

2013-08-27 21:28 - 2013-08-27 21:27 - 09283128 _____ (CCCP Project ) C:\Users\Neoh\Downloads\Combined-Community-Codec-Pack-2013-08-01.exe

2013-08-27 21:22 - 2013-08-27 21:22 - 00001062 _____ C:\Users\Neoh\Desktop\GUpdate_SINGAPORE - Shortcut.lnk

2013-08-27 21:20 - 2013-08-27 21:20 - 00000000 ____D C:\Users\Neoh\AppData\Local\Adobe

2013-08-27 21:20 - 2013-08-27 18:15 - 00000000 ____D C:\Users\Neoh\AppData\Roaming\Adobe