Infected and in trouble

unluckychick · December 29, 2013

Hi!

Today when I turned my computer on, I detected that when I turned Chrome on, all of my add-ons and settings had been deleted and suddenly I had a bunch of new add-ons which I had not added myself.

I immediately deleted the add-ons ran a check on Malwarebytes which came up empty.

I decided to ask you guys for help since I had heard great things about the forum.

I started by trying to do the first step and run DDS, but when I downloaded the program and tried to run it, I got the following message: DDS is not meant to run in 'Compability Mode'. The program shall now exit.

After this it shuts down.

So, now I'm completely lost as to what to do.

I'm running a Samsung laptop with Windows 8.1.

Help?

kevinf80 · December 29, 2013

Hello and

P2P/Piracy Warning:

If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall them or completely disable them from running while being assisted here.
Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.
If you have illegal/cracked software, cracks, keygens etc. on the system, please remove or uninstall them now and read the policy on Piracy.

Download AdwCleaner by Xplode from here: http://www.bleepingcomputer.com/download/adwcleaner/ and save to your Desktop.

Double click on AdwCleaner.exe to run the tool.
Vista/Windows 7/8 users right-click and select Run As Administrator
Click on the Scan button.
AdwCleaner will begin...be patient as the scan may take some time to complete.
When it's done you'll see: Pending: Uncheck any elements you don't want removed.
Now click on the Report button...a logfile (AdwCleaner[R0].txt) will open in Notepad for review.
Look over the log especially under Files/Folders for any program you want to save.
If there's a program you want to save, just uncheck it from AdwCleaner.
If you're not sure, post the log for review.
If you're ready to clean it all up.....click the Clean button.
After rebooting, a logfile report (AdwCleaner[s0].txt) will open automatically.
Copy and paste the contents of that logfile in your next reply.
A copy of that logfile will also be saved in the C:\AdwCleaner folder.
Items that are deleted are moved to the Quarantine Folder: C:\AdwCleaner\Quarantine
To restore an item that has been deleted (if necessary):
Go to Tools > Quarantine Manager > check what you want restored > now click on Restore.

Next,

Download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system (32 bit or 64 bit). If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

Double-click to run it. When the tool opens click Yes to disclaimer.
Press Scan button.
It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

Post those logs..

Kevin

unluckychick · December 29, 2013

Hello kevinf80 and thank you so much for helping!

# AdwCleaner v3.016 - Report created 30/12/2013 at 00:40:58

# Updated 23/12/2013 by Xplode

# Operating System : Windows 8.1 (64 bits)

# Username : Mari - SAMSUNG

# Running from : C:\Users\Mari\Desktop\AdwCleaner.exe

# Option : Clean

***** [ Services ] *****

Service Deleted : Application Updater

***** [ Files / Folders ] *****

Folder Deleted : C:\ProgramData\boost_interprocess

Folder Deleted : C:\Program Files (x86)\Application Updater

Folder Deleted : C:\Program Files (x86)\IObit Apps Toolbar

Folder Deleted : C:\Program Files (x86)\Common Files\Spigot

Folder Deleted : C:\Users\Mari\AppData\LocalLow\Search Settings

***** [ Shortcuts ] *****

***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\hbcennhacfaagdopikcegfcobcadeocj

Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\icdlfehblmklkikfigmjhbmmpmkmpooj

Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\mhkaekfpcppmmioggniknbnbdbcigpkk

Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\pfndaklgolladniicklehhancnlgocpp

Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [searchSettings]

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{0A18A436-2A7A-49F3-A488-30538A2F6323}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{007EFBDF-8A5D-4930-97CC-A4B437CBA777}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{03EB0E9C-7A91-4381-A220-9B52B641CDB1}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{03EB0E9C-7A91-4381-A220-9B52B641CDB1}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{03EB0E9C-7A91-4381-A220-9B52B641CDB1}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{03EB0E9C-7A91-4381-A220-9B52B641CDB1}

Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{03EB0E9C-7A91-4381-A220-9B52B641CDB1}]

Value Deleted : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{03EB0E9C-7A91-4381-A220-9B52B641CDB1}]

Key Deleted : HKCU\Software\Search Settings

Key Deleted : HKCU\Software\AppDataLow\Software\Search Settings

Key Deleted : HKLM\Software\Application Updater

Key Deleted : HKLM\Software\Search Settings

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.16384

-\\ Mozilla Firefox v24.0 (fi)

[ File : C:\Users\Mari\AppData\Roaming\Mozilla\Firefox\Profiles\i4q717sh.default\prefs.js ]

-\\ Google Chrome v31.0.1650.63

[ File : C:\Users\Mari\AppData\Local\Google\Chrome\User Data\Default\preferences ]

*************************

AdwCleaner[R0].txt - [2619 octets] - [11/09/2013 22:01:03]

AdwCleaner[R1].txt - [2719 octets] - [30/12/2013 00:37:43]

AdwCleaner[s0].txt - [2647 octets] - [30/12/2013 00:40:58]

########## EOF - C:\AdwCleaner\AdwCleaner[s0].txt - [2707 octets] ##########

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 29-12-2013 01

Ran by Mari (administrator) on SAMSUNG on 30-12-2013 00:49:53

Running from C:\Users\Mari\Desktop

Windows 8.1 (X64) OS Language: 040B

Internet Explorer Version 11

Boot Mode: Normal

==================== Processes (Whitelisted) =================

(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(Windows ® Win 7 DDK provider) C:\Program Files (x86)\Bluetooth Suite\AdminService.exe

() C:\Program Files (x86)\Elisa\Mobiililaajakaista-ohjelma\BecHelperService.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

() C:\Program Files (x86)\Elisa\Mobiililaajakaista-ohjelma\LoggerServer.exe

(Samsung Electronics CO., LTD.) C:\Program Files (x86)\Samsung\Settings\CmdServer\EasyLauncher.exe

(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDService.exe

(Intel® Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe

(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe

(Atheros) C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe

(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.22.3\GoogleCrashHandler.exe

(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.22.3\GoogleCrashHandler64.exe

() C:\Program Files (x86)\Samsung\Settings\CmdServer\EasySettingsCmdServer.exe

(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe

(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDTouch.exe

(Samsung Electronics CO., LTD.) C:\Program Files (x86)\Samsung\Settings\sSettings.exe

(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe

(Intel Corporation) C:\Windows\System32\igfxext.exe

(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe

(Qualcomm®Atheros®) C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe

() C:\Program Files (x86)\Bluetooth Suite\ActivateDesktop.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe

(Intel Corporation) C:\Windows\System32\igfxtray.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Integrated Clock Controller Service\ICCProxy.exe

(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe

(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe

(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe

(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe

(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe

(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe

(Birdstep) C:\Program Files (x86)\Elisa\Mobiililaajakaista-ohjelma\Wilog.exe

(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\office15\MSOSYNC.EXE

(Samsung Electronics CO., LTD.) C:\Program Files\Samsung\S Agent\CommonAgent.exe

(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Intel Corporation) C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\FWService\IntelMeFWService.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\Jhi_service.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe

(Symantec Corporation) C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe

(Samsung Electronics CO., LTD.) C:\ProgramData\Samsung\SW Update Service\SWMAgent.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Samsung Electronics CO., LTD.) C:\Program Files\Samsung\Support Center\GuaranaAgent.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [ETDCtrl] - C:\Program Files\Elantech\ETDCtrl.exe [2894152 2013-09-06] (ELAN Microelectronics Corp.)

HKLM\...\Run: [RtHDVBg] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1353432 2013-09-26] (Realtek Semiconductor)

HKLM\...\Run: [HotKeysCmds] - C:\WINDOWS\system32\hkcmd.exe [ ] ()

HKLM\...\Run: [bitcasa] - C:\Program Files\Bitcasa\Bitcasa.exe [4365824 2012-12-27] (Bitcasa, Inc)

HKLM\...\Run: [AdobeAAMUpdater-1.0] - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe [500208 2010-03-06] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [RemoteControl10] - C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [97392 2012-08-15] (CyberLink Corp.)

HKLM-x32\...\Run: [CLMLServer_For_P2G8] - C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [111120 2012-06-08] (CyberLink)

HKLM-x32\...\Run: [CLVirtualDrive] - C:\Program Files (x86)\CyberLink\Power2Go8\VirtualDrive.exe [491120 2012-07-12] (CyberLink Corp.)

HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\reader_sl.exe [40312 2013-09-03] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [intel AppUp(SM) center] - C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe [155488 2012-07-13] (Intel Corporation)

HKLM-x32\...\Run: [Norton Online Backup] - C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe [2994880 2012-08-15] (Symantec Corporation)

HKLM-x32\...\Run: [KiesTrayAgent] - C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [310640 2013-03-07] (Samsung Electronics Co., Ltd.)

HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)

HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [switchBoard] - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [AdobeCS5ServiceManager] - C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe [406992 2010-02-22] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [] - [x]

HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)

HKLM-x32\...\Run: [AvastUI.exe] - C:\Program Files\AVAST Software\Avast\AvastUI.exe [3764024 2013-12-29] (AVAST Software)

HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-11-02] (Apple Inc.)

HKLM-x32\...\Run: [20131121] - C:\Program Files\AVAST Software\Avast\Setup\emupdate\abf5d97d-16c9-47bd-a9aa-d8a0ffd822f2.exe [180184 2013-11-23] (AVAST Software)

Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)

HKLM\...\Policies\Explorer\Run: [btvStack] - C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [132736 2013-09-25] ( (Qualcomm®Atheros®))

MountPoints2: {d0928262-4207-11e3-bebb-001e101ff69a} - "D:\AutoRun.exe"

MountPoints2: {dfbf43e5-37f3-11e3-8250-f8a4f7d96fd1} - "D:\Autorun.exe"

SSODL: EldosMountNotificator - {5FF49FE8-B332-4CB9-B102-FB6951629E55} - C:\windows\system32\CbFsMntNtf3.dll (EldoS Corporation)

SSODL-x32: EldosMountNotificator - {5FF49FE8-B332-4CB9-B102-FB6951629E55} - C:\windows\SysWow64\CbFsMntNtf3.dll (EldoS Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://samsung13.msn.com/

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://samsung13.msn.com

SearchScopes: HKLM - DefaultScope {5387967B-EEB6-4153-9D59-0F3C7606A394} URL = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MASMJS

SearchScopes: HKLM - {5387967B-EEB6-4153-9D59-0F3C7606A394} URL = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MASMJS

SearchScopes: HKLM-x32 - {5387967B-EEB6-4153-9D59-0F3C7606A394} URL = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MASMJS

SearchScopes: HKCU - {5387967B-EEB6-4153-9D59-0F3C7606A394} URL =

SearchScopes: HKCU - {6F6FA199-9824-4C68-9F27-C1E311749F98} URL = http://fi.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=800236&p={searchTerms}

BHO: avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)

BHO: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)

BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)

BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)

BHO: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)

BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)

BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office 15\root\office15\URLREDIR.DLL (Microsoft Corporation)

Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)

Toolbar: HKLM - avast! Online Security - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)

Toolbar: HKLM-x32 - avast! Online Security - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)

Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\office15\MSOSB.DLL (Microsoft Corporation)

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)

Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt

Tcpip\..\Interfaces\{BB849D9B-7821-4069-9513-6AD572D67D84}: [NameServer]195.197.54.100 195.74.0.47

FireFox:

========

FF ProfilePath: C:\Users\Mari\AppData\Roaming\Mozilla\Firefox\Profiles\i4q717sh.default

FF Homepage: about:home

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 - C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3503.0728 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @videolan.org/vlc,version=2.0.8 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin-x32: @videolan.org/vlc,version=2.1.0 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin-x32: @videolan.org/vlc,version=2.1.1 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin-x32: @videolan.org/vlc,version=2.1.2 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\bookplus-fi.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-fi.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-fi.xml

FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF

FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF

Chrome:

=======

CHR Extension: (Google Docs) - C:\Users\Mari\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_1

CHR Extension: (Google Drive) - C:\Users\Mari\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_1

CHR Extension: (YouTube) - C:\Users\Mari\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_1

CHR Extension: (Adblock Plus) - C:\Users\Mari\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb\1.7.2_0

CHR Extension: (Google Search) - C:\Users\Mari\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_1

CHR Extension: (XKit) - C:\Users\Mari\AppData\Local\Google\Chrome\User Data\Default\Extensions\fpfgeeomkfdefkckijiabdbogjkdaecd\7.3.6_0

CHR Extension: (avast! Online Security) - C:\Users\Mari\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki\9.0.2011.70_0

CHR Extension: (Reddit Enhancement Suite) - C:\Users\Mari\AppData\Local\Google\Chrome\User Data\Default\Extensions\kbmfpngjjgdllneeigpgjifpgocmfgmb\4.3.1.2_0

CHR Extension: (Google Wallet) - C:\Users\Mari\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_1

CHR Extension: (Gmail) - C:\Users\Mari\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_2

CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx

==================== Services (Whitelisted) =================

R2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [312448 2013-09-25] (Windows ® Win 7 DDK provider)

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2013-12-29] (AVAST Software)

R2 BecHelperService; C:\Program Files (x86)\Elisa\Mobiililaajakaista-ohjelma\BecHelperService.exe [1286144 2013-05-27] ()

R2 Easy Launcher; C:\Program Files (x86)\Samsung\Settings\CmdServer\EasyLauncher.exe [1594416 2013-02-01] (Samsung Electronics CO., LTD.)

R2 ETDService; C:\Program Files\Elantech\ETDService.exe [100104 2013-09-06] (ELAN Microelectronics Corp.)

R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [15720 2013-08-07] (Intel Corporation)

S3 Intel® Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [828376 2013-08-27] (Intel® Corporation)

R2 Intel® ME Service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\FWService\IntelMeFWService.exe [131544 2013-09-16] (Intel Corporation)

R2 jhi_service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [169432 2013-09-16] (Intel Corporation)

R2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [3943104 2012-08-15] (Symantec Corporation)

R2 OfficeSvc; C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe [1907896 2013-11-02] (Microsoft Corporation)

R2 SWUpdateService; C:\ProgramData\Samsung\SW Update Service\SWMAgent.exe [3018800 2013-10-21] (Samsung Electronics CO., LTD.)

S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [346872 2013-08-22] (Microsoft Corporation)

S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23840 2013-08-22] (Microsoft Corporation)

R2 ZAtheros Bt and Wlan Coex Agent; C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [323584 2013-09-25] (Atheros)

==================== Drivers (Whitelisted) ====================

S0 ADP80XX; C:\Windows\System32\drivers\ADP80XX.SYS [782176 2013-08-22] (PMC-Sierra)

R2 aswMonFlt; C:\windows\system32\drivers\aswMonFlt.sys [78648 2013-12-29] (AVAST Software)

R1 aswRdr; C:\windows\system32\drivers\aswRdr2.sys [92544 2013-10-16] (AVAST Software)

R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2013-10-16] ()

R1 aswSnx; C:\windows\system32\drivers\aswSnx.sys [1034464 2013-12-29] (AVAST Software)

R1 aswSP; C:\windows\system32\drivers\aswSP.sys [422216 2013-12-29] (AVAST Software)

R3 aswStm; C:\WINDOWS\system32\drivers\aswStm.sys [79672 2013-12-29] (AVAST Software)

R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [207904 2013-12-29] ()

R3 athr; C:\Windows\system32\DRIVERS\athwbx.sys [3859968 2013-08-15] (Qualcomm Atheros Communications, Inc.)

S3 bcmfn2; C:\Windows\System32\drivers\bcmfn2.sys [17624 2013-08-13] (Windows ® Win 7 DDK provider)

R3 BTATH_HID; C:\Windows\system32\DRIVERS\btath_hid.sys [223432 2013-09-25] (Qualcomm Atheros)

R3 BTATH_LWFLT; C:\Windows\system32\DRIVERS\btath_lwflt.sys [77464 2013-09-25] (Qualcomm Atheros)

R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [224768 2013-08-22] (Microsoft Corporation)

R1 cbfs3; C:\windows\system32\drivers\cbfs3.sys [352456 2012-08-06] (EldoS Corporation)

R1 ccSet_NARA; C:\Windows\system32\drivers\NARAx64\0401000.00E\ccSetx64.sys [168608 2012-05-26] (Symantec Corporation)

R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [92536 2012-06-25] (CyberLink)

S3 hitmanpro37; C:\windows\system32\drivers\hitmanpro37.sys [32512 2013-10-16] ()

S3 iaLPSSi_GPIO; C:\Windows\System32\drivers\iaLPSSi_GPIO.sys [24568 2013-07-30] (Intel Corporation)

S3 iaLPSSi_I2C; C:\Windows\System32\drivers\iaLPSSi_I2C.sys [99320 2013-07-25] (Intel Corporation)

S0 iaStorAV; C:\Windows\System32\drivers\iaStorAV.sys [651248 2013-08-10] (Intel Corporation)

R0 intelpep; C:\Windows\System32\drivers\intelpep.sys [39768 2013-11-11] (Microsoft Corporation)

S0 LSI_SAS3; C:\Windows\System32\drivers\lsi_sas3.sys [81760 2013-08-22] (LSI Corporation)

R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [99288 2013-09-16] (Intel Corporation)

R3 NdisVirtualBus; C:\Windows\System32\drivers\NdisVirtualBus.sys [16384 2013-08-22] (Microsoft Corporation)

S3 netvsc; C:\Windows\system32\DRIVERS\netvsc63.sys [87040 2013-08-22] (Microsoft Corporation)

R3 RadioHIDMini; C:\Windows\System32\drivers\RadioHIDMini.sys [23408 2012-07-27] (Windows ® Win 7 DDK provider)

S3 ReFS; C:\Windows\System32\Drivers\ReFS.sys [924512 2013-08-22] (Microsoft Corporation)

S3 SerCx2; C:\Windows\System32\drivers\SerCx2.sys [146776 2013-10-26] (Microsoft Corporation)

S0 stornvme; C:\Windows\System32\drivers\stornvme.sys [57176 2013-10-05] (Microsoft Corporation)

S3 UEFI; C:\Windows\System32\drivers\UEFI.sys [26976 2013-08-22] (Microsoft Corporation)

S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [124256 2013-08-22] (Microsoft Corporation)

S3 ewusbnet; \SystemRoot\system32\DRIVERS\ewusbnet.sys [x]

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2013-12-30 00:49 - 2013-12-30 00:50 - 00020093 _____ C:\Users\Mari\Desktop\FRST.txt

2013-12-30 00:49 - 2013-12-30 00:49 - 00000000 ____D C:\FRST

2013-12-30 00:47 - 2013-12-30 00:48 - 01931302 _____ (Farbar) C:\Users\Mari\Desktop\FRST64.exe

2013-12-30 00:43 - 2013-12-30 00:43 - 00000000 ___RD C:\Users\Mari\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BT Devices

2013-12-30 00:43 - 2013-12-30 00:43 - 00000000 ____D C:\ProgramData\boost_interprocess

2013-12-30 00:35 - 2013-12-30 00:37 - 01233962 _____ C:\Users\Mari\Desktop\AdwCleaner.exe

2013-12-29 20:38 - 2013-12-29 20:39 - 00079672 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswstm.sys

2013-12-28 23:45 - 2013-12-28 23:45 - 00000000 ____H C:\WINDOWS\system32\Drivers\Msft_Kernel_netaapl64_01009.Wdf

2013-12-14 01:48 - 2013-11-26 13:54 - 23183360 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll

2013-12-14 01:48 - 2013-11-26 12:11 - 17112576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll

2013-12-14 01:48 - 2013-11-26 11:41 - 02764288 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll

2013-12-14 01:48 - 2013-11-26 10:38 - 02166784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll

2013-12-14 01:48 - 2013-11-26 10:35 - 05769216 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll

2013-12-14 01:48 - 2013-11-26 10:16 - 04243968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll

2013-12-14 01:48 - 2013-11-26 10:02 - 01995264 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl

2013-12-14 01:48 - 2013-11-26 09:48 - 12996608 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll

2013-12-14 01:48 - 2013-11-26 09:32 - 01928192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl

2013-12-14 01:48 - 2013-11-26 09:26 - 11221504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll

2013-12-14 01:48 - 2013-11-26 09:07 - 02334208 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll

2013-12-14 01:48 - 2013-11-26 08:40 - 01395200 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll

2013-12-14 01:48 - 2013-11-26 08:34 - 00817664 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll

2013-12-14 01:48 - 2013-11-26 08:33 - 01820160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll

2013-12-14 01:48 - 2013-11-26 08:27 - 01157632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll

2013-12-14 01:48 - 2013-11-12 01:41 - 00189952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll

2013-12-14 01:48 - 2013-11-12 01:40 - 00249856 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.TestingFramework.dll

2013-12-14 01:48 - 2013-11-12 01:27 - 00701440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSShared.dll

2013-12-14 01:48 - 2013-11-12 01:24 - 00840704 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSShared.dll

2013-12-14 01:48 - 2013-11-11 04:48 - 00039768 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\intelpep.sys

2013-12-14 01:48 - 2013-11-09 13:55 - 00325464 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBXHCI.SYS

2013-12-14 01:48 - 2013-11-09 08:37 - 01756160 _____ (Microsoft Corporation) C:\WINDOWS\system32\WMPDMC.exe

2013-12-14 01:48 - 2013-11-09 07:56 - 01391104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WMPDMC.exe

2013-12-14 01:48 - 2013-11-08 12:26 - 00358896 _____ (Microsoft Corporation) C:\WINDOWS\system32\dcomp.dll

2013-12-14 01:48 - 2013-11-08 06:43 - 00254464 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentClient.dll

2013-12-14 01:48 - 2013-11-08 06:28 - 13177344 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll

2013-12-14 01:48 - 2013-11-08 06:26 - 11674624 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll

2013-12-14 01:48 - 2013-11-08 06:16 - 00225792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dcomp.dll

2013-12-14 01:48 - 2013-11-08 06:15 - 00198656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppXDeploymentClient.dll

2013-12-14 01:48 - 2013-11-08 06:07 - 00115712 _____ (Microsoft Corporation) C:\WINDOWS\system32\winbici.dll

2013-12-14 01:48 - 2013-11-08 05:41 - 01302528 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll

2013-12-14 01:48 - 2013-11-08 05:14 - 00922624 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.dll

2013-12-14 01:48 - 2013-11-05 16:19 - 00566784 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpncore.dll

2013-12-14 01:48 - 2013-11-05 16:03 - 00637952 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncHost.exe

2013-12-14 01:48 - 2013-11-05 15:57 - 00479744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncHost.exe

2013-12-14 01:48 - 2013-11-05 15:33 - 00584192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncCore.dll

2013-12-14 01:48 - 2013-11-05 15:32 - 00744448 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncCore.dll

2013-12-14 01:48 - 2013-11-04 19:13 - 01530200 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys

2013-12-14 01:48 - 2013-11-04 19:13 - 00382808 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms1.sys

2013-12-14 01:48 - 2013-11-04 15:07 - 01843712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Display.dll

2013-12-14 01:48 - 2013-11-04 13:50 - 02143744 _____ (Microsoft Corporation) C:\WINDOWS\system32\dwmcore.dll

2013-12-14 01:48 - 2013-11-04 12:32 - 02570240 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers.dll

2013-12-14 01:48 - 2013-11-04 04:28 - 01816576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Display.dll

2013-12-14 01:48 - 2013-11-04 03:30 - 01765376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dwmcore.dll

2013-12-14 01:48 - 2013-11-01 13:39 - 00086872 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\pdc.sys

2013-12-14 01:48 - 2013-11-01 08:08 - 00747008 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlidcli.dll

2013-12-14 01:48 - 2013-11-01 07:57 - 00544768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wlidcli.dll

2013-12-14 01:48 - 2013-10-31 02:58 - 00372568 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\spaceport.sys

2013-12-14 01:48 - 2013-10-31 02:42 - 07399256 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe

2013-12-14 01:48 - 2013-10-31 02:33 - 01642016 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi

2013-12-14 01:48 - 2013-10-31 02:33 - 01506680 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe

2013-12-14 01:48 - 2013-10-31 02:33 - 01476184 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi

2013-12-14 01:48 - 2013-10-31 02:33 - 01345536 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe

2013-12-14 01:48 - 2013-10-26 03:54 - 00146776 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\SerCx2.sys

2013-12-14 01:48 - 2013-10-24 11:31 - 00030208 _____ (Microsoft Corporation) C:\WINDOWS\system32\CredentialMigrationHandler.dll

2013-12-14 01:48 - 2013-10-24 11:12 - 00027136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CredentialMigrationHandler.dll

2013-12-14 01:48 - 2013-10-17 13:21 - 02896896 _____ (Microsoft Corporation) C:\WINDOWS\system32\msftedit.dll

2013-12-14 01:48 - 2013-10-17 12:36 - 02266624 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msftedit.dll

2013-12-14 01:48 - 2013-10-05 16:21 - 02140888 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d11.dll

2013-12-14 01:48 - 2013-10-05 16:21 - 00516496 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxgi.dll

2013-12-14 01:48 - 2013-10-05 14:05 - 01765384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d11.dll

2013-12-14 01:48 - 2013-10-05 14:05 - 00406400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxgi.dll

2013-12-14 01:47 - 2013-11-26 10:57 - 00218624 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe

2013-12-14 01:47 - 2013-11-26 08:34 - 00703488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll

2013-12-14 01:47 - 2013-11-23 06:34 - 00393216 _____ (Microsoft Corporation) C:\WINDOWS\system32\WMPhoto.dll

2013-12-14 01:47 - 2013-11-23 06:13 - 00348160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WMPhoto.dll

2013-12-14 01:47 - 2013-11-23 05:32 - 04105728 _____ (Microsoft Corporation) C:\WINDOWS\system32\SyncEngine.dll

2013-12-14 01:47 - 2013-11-23 05:10 - 00568832 _____ (Microsoft Corporation) C:\WINDOWS\system32\SkyDrive.exe

2013-12-14 01:47 - 2013-11-09 08:34 - 00615936 _____ (Microsoft Corporation) C:\WINDOWS\system32\MDMAgent.exe

2013-12-14 01:47 - 2013-11-09 08:34 - 00287744 _____ (Microsoft Corporation) C:\WINDOWS\system32\mdmregistration.dll

2013-12-14 01:47 - 2013-11-09 07:52 - 00240128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mdmregistration.dll

2013-12-14 01:47 - 2013-10-19 10:53 - 00075360 _____ (Microsoft Corporation) C:\WINDOWS\system32\imagehlp.dll

2013-12-14 01:47 - 2013-10-19 09:14 - 00070680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\imagehlp.dll

2013-12-14 01:47 - 2013-10-15 10:54 - 00197120 _____ (Microsoft Corporation) C:\WINDOWS\system32\scrrun.dll

2013-12-14 01:47 - 2013-10-15 10:03 - 00156672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\scrrun.dll

2013-12-14 01:42 - 2013-11-08 09:21 - 04191744 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys

2013-12-07 17:20 - 2013-12-07 17:31 - 00000000 ___SD C:\Users\Mari\Documents\Omat tietolähteet

2013-12-07 16:55 - 2013-12-30 00:44 - 00005040 _____ C:\WINDOWS\System32\Tasks\Microsoft Office 15 Sync Maintenance for SAMSUNG-Mari Samsung

2013-12-01 22:13 - 2013-12-01 22:13 - 00000132 _____ C:\Users\Mari\AppData\Roaming\Adobe PNG Format CS5 Prefs

==================== One Month Modified Files and Folders =======

2013-12-30 00:50 - 2013-12-30 00:49 - 00020093 _____ C:\Users\Mari\Desktop\FRST.txt

2013-12-30 00:49 - 2013-12-30 00:49 - 00000000 ____D C:\FRST

2013-12-30 00:48 - 2013-12-30 00:47 - 01931302 _____ (Farbar) C:\Users\Mari\Desktop\FRST64.exe

2013-12-30 00:47 - 2013-08-28 12:28 - 00003598 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1389066822-2107305290-2761972221-1001

2013-12-30 00:45 - 2013-10-18 15:26 - 01417669 _____ C:\WINDOWS\WindowsUpdate.log

2013-12-30 00:45 - 2013-03-11 11:48 - 00000000 ____D C:\ProgramData\WinClon

2013-12-30 00:44 - 2013-12-07 16:55 - 00005040 _____ C:\WINDOWS\System32\Tasks\Microsoft Office 15 Sync Maintenance for SAMSUNG-Mari Samsung

2013-12-30 00:44 - 2013-10-18 15:34 - 00000000 __RDO C:\Users\Mari\SkyDrive

2013-12-30 00:44 - 2013-08-28 18:46 - 00002197 _____ C:\Users\Public\Desktop\Google Chrome.lnk

2013-12-30 00:43 - 2013-12-30 00:43 - 00000000 ___RD C:\Users\Mari\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BT Devices

2013-12-30 00:43 - 2013-12-30 00:43 - 00000000 ____D C:\ProgramData\boost_interprocess

2013-12-30 00:43 - 2013-08-28 18:44 - 00001016 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job

2013-12-30 00:42 - 2013-08-22 16:45 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT

2013-12-30 00:41 - 2013-09-11 22:00 - 00000000 ____D C:\AdwCleaner

2013-12-30 00:41 - 2013-08-22 15:25 - 00262144 ___SH C:\WINDOWS\system32\config\BBI

2013-12-30 00:37 - 2013-12-30 00:35 - 01233962 _____ C:\Users\Mari\Desktop\AdwCleaner.exe

2013-12-30 00:00 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\system32\sru

2013-12-29 23:59 - 2013-08-28 18:44 - 00001020 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job

2013-12-29 21:44 - 2013-10-19 10:38 - 00003938 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{5FE57C4E-6A43-4F29-97D6-564B70C043AD}

2013-12-29 21:30 - 2013-09-06 16:41 - 00000000 ____D C:\Users\Mari\AppData\Roaming\uTorrent

2013-12-29 20:40 - 2013-09-29 20:07 - 00004122 _____ C:\WINDOWS\PFRO.log

2013-12-29 20:39 - 2013-12-29 20:38 - 00079672 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswstm.sys

2013-12-29 20:39 - 2013-10-16 21:02 - 00001982 _____ C:\Users\Public\Desktop\avast! Free Antivirus.lnk

2013-12-29 20:38 - 2013-10-16 21:02 - 01034464 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswSnx.sys

2013-12-29 20:38 - 2013-10-16 21:02 - 00422216 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswsp.sys

2013-12-29 20:38 - 2013-10-16 21:02 - 00334136 _____ (AVAST Software) C:\WINDOWS\system32\aswBoot.exe

2013-12-29 20:38 - 2013-10-16 21:02 - 00207904 _____ C:\WINDOWS\system32\Drivers\aswVmm.sys

2013-12-29 20:38 - 2013-10-16 21:02 - 00078648 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswMonFlt.sys

2013-12-29 20:38 - 2013-10-16 21:02 - 00043152 _____ (AVAST Software) C:\WINDOWS\avastSS.scr

2013-12-29 20:38 - 2013-08-29 23:51 - 00003924 _____ C:\WINDOWS\System32\Tasks\avast! Emergency Update

2013-12-28 23:50 - 2013-09-05 17:54 - 00000000 ____D C:\Users\Mari\AppData\Local\Last.fm

2013-12-28 23:45 - 2013-12-28 23:45 - 00000000 ____H C:\WINDOWS\system32\Drivers\Msft_Kernel_netaapl64_01009.Wdf

2013-12-28 23:45 - 2013-08-22 16:46 - 00291612 _____ C:\WINDOWS\setupact.log

2013-12-27 00:05 - 2013-08-30 00:31 - 00000000 ____D C:\Users\Mari\AppData\Roaming\vlc

2013-12-22 02:14 - 2013-08-29 22:42 - 00000000 ____D C:\Users\Mari\Documents\Ficit

2013-12-21 16:05 - 2013-11-28 15:09 - 00001456 _____ C:\Users\Mari\AppData\Local\Adobe Save for Web 12.0 Prefs

2013-12-18 18:03 - 2013-09-10 20:00 - 00000000 ____D C:\Users\Mari\Documents\Koulu

2013-12-18 00:52 - 2013-08-28 12:20 - 00000000 ____D C:\Users\Mari\AppData\Local\Packages

2013-12-18 00:32 - 2013-09-30 06:17 - 01371388 _____ C:\WINDOWS\system32\PerfStringBackup.INI

2013-12-18 00:32 - 2013-09-30 05:59 - 00436568 _____ C:\WINDOWS\system32\perfh00B.dat

2013-12-18 00:32 - 2013-09-30 05:59 - 00082128 _____ C:\WINDOWS\system32\perfc00B.dat

2013-12-16 14:34 - 2013-08-28 19:11 - 00000000 ____D C:\Program Files\Microsoft Office 15

2013-12-14 20:22 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\rescache

2013-12-14 13:08 - 2013-08-22 16:44 - 06959920 _____ C:\WINDOWS\system32\FNTCACHE.DAT

2013-12-14 02:28 - 2013-08-22 17:36 - 00000000 ___RD C:\WINDOWS\ToastData

2013-12-14 02:28 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\WinStore

2013-12-14 02:28 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\MediaViewer

2013-12-14 02:28 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\FileManager

2013-12-14 02:28 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\Camera

2013-12-14 01:52 - 2013-08-28 13:38 - 00000000 ____D C:\WINDOWS\system32\MRT

2013-12-14 01:50 - 2013-08-28 13:38 - 90708896 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe

2013-12-07 17:31 - 2013-12-07 17:20 - 00000000 ___SD C:\Users\Mari\Documents\Omat tietolähteet

2013-12-06 12:54 - 2013-08-28 18:44 - 00003992 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA

2013-12-06 12:54 - 2013-08-28 18:44 - 00003756 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore

2013-12-04 02:05 - 2013-08-22 17:38 - 00693240 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe

2013-12-04 02:05 - 2013-08-22 17:38 - 00105464 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl

2013-12-03 17:43 - 2013-09-30 17:14 - 00000000 ____D C:\Users\Mari\AppData\Roaming\Skype

2013-12-01 22:13 - 2013-12-01 22:13 - 00000132 _____ C:\Users\Mari\AppData\Roaming\Adobe PNG Format CS5 Prefs

2013-11-30 22:34 - 2012-07-26 10:12 - 00000000 ____D C:\WINDOWS\LiveKernelReports

Files to move or delete:

====================

C:\ProgramData\MakeMarkerFile.exe

C:\Users\EasySurvey\EasySurvey.exe

Some content of TEMP:

====================

C:\Users\Mari\AppData\Local\Temp\Quarantine.exe

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

LastRegBack: 2013-12-29 13:11

==================== End Of Log ============================

Sorry, for some reason I didn't get the Addition.txt or closed it or something.

I bought this laptop used so could that somehow be the reason?

Lol sorry I'm completely computer illiterate.

unluckychick · December 29, 2013

Oh this is nice, I just contacted the friend I bought the laptop from. He only used it a few months until he got a new laptop as a present.

Apparently he had a virus on the laptop that he had someone to remove.

Apparently the virus he had changed the homepage to a different page, he's saying he thinks it was yahoo, and he also had random toolbars appear. Could this virus be linked to the one I have now?

kevinf80 · December 29, 2013

Addition.txt will be saved the same place FRST was saved to and ran from, your Desktop. Even if the log isclosed it will still be on the desktop, if it was deleted check in the Recycle bin. I need to see that log

unluckychick · December 29, 2013

dditional scan result of Farbar Recovery Scan Tool (x64) Version: 29-12-2013 01

Ran by Mari at 2013-12-30 00:51:06

Running from C:\Users\Mari\Desktop

Boot Mode: Normal

==========================================================

==================== Security Center ========================

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}

AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

==================== Installed Programs ======================

HUAWEI 4.25.10.00 (x32 Version: - )

Adobe AIR (x32 Version: 3.9.0.1380 - Adobe Systems Incorporated)

Adobe Community Help (x32 Version: 3.0.0 - Adobe Systems Incorporated)

Adobe Community Help (x32 Version: 3.0.0.400 - Adobe Systems Incorporated)

Adobe Media Player (x32 Version: 1.8 - Adobe Systems Incorporated)

Adobe Photoshop CS5 (x32 Version: 12.0 - Adobe Systems Incorporated)

Adobe Reader X (10.1.8) MUI (x32 Version: 10.1.8 - Adobe Systems Incorporated)

AllSharePlayLink (x32 Version: 1.0.0 - Samsung Electronics Co., Ltd.)

Apple Mobile Device Support (Version: 7.0.0.117 - Apple Inc.)

Apple Software Update (x32 Version: 2.1.3.127 - Apple Inc.)

Applen ohjelmatuki (x32 Version: 2.3.6 - Apple Inc.)

avast! Free Antivirus (x32 Version: 9.0.2011 - Avast Software)

Bitcasa version 0.9.20.4135 (Version: 0.9.20.4135 - Bitcasa Inc.)

Bonjour (Version: 3.0.0.10 - Apple Inc.)

CCleaner (Version: 4.06 - Piriform)

CyberLink Power2Go 8 (x32 Version: 8.0.0.1912 - CyberLink Corp.)

CyberLink PowerDVD 10 (x32 Version: 10.0.4421.02 - CyberLink Corp.)

D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft)

Easy File Share (x32 Version: 1.3.6 - Samsung Electronics CO.,LTD.)

E-POP (x32 Version: 1.0.1 - Samsung Electronics CO., LTD.)

ETDWare X64 11.7.17.3_WHQL (Version: 11.7.17.3 - ELAN Microelectronic Corp.)

Fotogalleri (x32 Version: 16.4.3503.0728 - Microsoft Corporation)

Fotogalleriet (x32 Version: 16.4.3503.0728 - Microsoft Corporation)

Google Chrome (x32 Version: 31.0.1650.63 - Google Inc.)

Google Update Helper (x32 Version: 1.3.22.3 - Google Inc.)

Help Desk (Version: 1.0.96 - Samsung Electronics CO., LTD.)

HomeSync Lite (x32 Version: 1.1.0.32 - Samsung Electronics CO., LTD.)

Huawei modem (x32 Version: - )

Intel AppUp(SM) center (x32 Version: 3.6.1.33070.11 - Intel)

Intel® Manageability Engine Firmware Recovery Agent (x32 Version: 1.1.0.36960 - Intel Corporation)

Intel® Management Engine Components (x32 Version: 9.5.15.1730 - Intel Corporation)

Intel® Processor Graphics (x32 Version: 9.17.10.2932 - Intel Corporation)

Intel® Rapid Storage Technology (Version: 12.8.0.1016 - Intel Corporation)

Intel® SDK for OpenCL - CPU Only Runtime Package (x32 Version: 2.0.0.37149 - Intel Corporation)

Intel® Trusted Connect Service Client (Version: 1.31.8.1 - Intel Corporation)

IObit Apps Toolbar v7.6 (x32 Version: 7.6 - Spigot, Inc.) <==== ATTENTION

iTunes (Version: 11.1.3.8 - Apple Inc.)

Last.fm Scrobbler 2.1.36 (x32 Version: - Last.fm)

Malwarebytes Anti-Malware versio 1.75.0.1300 (x32 Version: 1.75.0.1300 - Malwarebytes Corporation)

Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation)

Microsoft Office 365 Home Premium - fi-fi (Version: 15.0.4551.1011 - Microsoft Corporation)

Microsoft Silverlight (Version: 5.1.20913.0 - Microsoft Corporation)

Microsoft SkyDrive (HKCU Version: 17.0.2003.1112 - Microsoft Corporation)

Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219 - Microsoft Corporation)

Microsoft_VC80_ATL_x86 (x32 Version: 8.0.50727.4053 - Adobe)

Microsoft_VC80_ATL_x86_x64 (Version: 8.0.50727.4053 - Adobe)

Microsoft_VC80_CRT_x86 (x32 Version: 8.0.50727.4053 - Adobe)

Microsoft_VC80_CRT_x86_x64 (Version: 8.0.50727.4053 - Adobe)

Microsoft_VC80_MFC_x86 (x32 Version: 8.0.50727.4053 - Adobe)

Microsoft_VC80_MFC_x86_x64 (Version: 8.0.50727.4053 - Adobe)

Microsoft_VC80_MFCLOC_x86 (x32 Version: 8.0.50727.4053 - Adobe)

Microsoft_VC80_MFCLOC_x86_x64 (Version: 80.50727.4053 - Adobe)

Microsoft_VC90_ATL_x86 (x32 Version: 1.00.0000 - Adobe)

Microsoft_VC90_ATL_x86_x64 (Version: 1.00.0000 - Adobe)

Microsoft_VC90_CRT_x86 (x32 Version: 1.00.0000 - Adobe)

Microsoft_VC90_CRT_x86_x64 (Version: 1.00.0000 - Adobe)

Microsoft_VC90_MFC_x86 (x32 Version: 1.00.0000 - Adobe)

Microsoft_VC90_MFC_x86_x64 (Version: 1.00.0000 - Adobe)

Mobiililaajakaista-ohjelma (x32 Version: 4.0 - Elisa)

Movie Maker (x32 Version: 16.4.3503.0728 - Microsoft Corporation)

Mozilla Firefox 24.0 (x86 fi) (x32 Version: 24.0 - Mozilla)

Mozilla Maintenance Service (x32 Version: 24.0 - Mozilla)

MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft)

MSVCRT110 (x32 Version: 16.4.1108.0727 - Microsoft)

MSVCRT110_amd64 (Version: 16.4.1108.0727 - Microsoft)

Norton Online Backup (x32 Version: 2.2.3.51 - Symantec Corporation)

Norton Online Backup ARA (x32 Version: 4.1.0.14 - Symantec Corporation)

Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4551.1011 - Microsoft Corporation)

Office 15 Click-to-Run Licensing Component (Version: 15.0.4551.1011 - Microsoft Corporation)

Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4551.1011 - Microsoft Corporation)

PDF Settings CS5 (x32 Version: 10.0 - Adobe Systems Incorporated)

Phone Screen Sharing (x32 Version: 2.0.0.18 - RSUPPORT)

Photo Common (x32 Version: 16.4.3503.0728 - Microsoft Corporation)

Photo Gallery (x32 Version: 16.4.3503.0728 - Microsoft Corporation)

Qualcomm Atheros Bluetooth Suite (64) (Version: 8.0.1.306 - Qualcomm Atheros Communications)

Qualcomm Atheros Client Installation Program (x32 Version: 10.0 - Qualcomm Atheros)

QuickTime (x32 Version: 7.74.80.86 - Apple Inc.)

Realtek Ethernet Controller Driver (x32 Version: 8.19.726.2013 - Realtek)

Realtek High Definition Audio Driver (x32 Version: 6.0.1.7055 - Realtek Semiconductor Corp.)

Recovery (x32 Version: 6.0.10.0 - Samsung Electronics CO., LTD.)

S Agent (Version: 1.1.45 - Samsung Electronics CO., LTD.)

Samsung Kies (x32 Version: 2.5.2.13021_11 - Samsung Electronics Co., Ltd.)

SAMSUNG USB Driver for Mobile Phones (Version: 1.5.25.0 - SAMSUNG Electronics Co., Ltd.)

Settings (x32 Version: 2.0.1 - Samsung Electronics CO., LTD.)

SideSync (x32 Version: 2.0.0 - Samsung Electronics CO., LTD.)

Skype™ 6.10 (x32 Version: 6.10.104 - Skype Technologies S.A.)

Support Center (Version: 2.1.1201 - Samsung Electronics CO., LTD.)

Support Center FAQ (x32 Version: 1.0.11 - Samsung Electronics CO., LTD.)

SW Update (x32 Version: 2.1.21 - Samsung Electronics CO., LTD.)

User Guide (x32 Version: 1.0.00 - Samsung Electronics CO., LTD.)

Valokuvavalikoima (x32 Version: 16.4.3503.0728 - Microsoft Corporation)

Windows Live Communications Platform (x32 Version: 16.4.3503.0728 - Microsoft Corporation)

Windows Live Essentials (x32 Version: 16.4.3503.0728 - Microsoft Corporation)

Windows Live Installer (x32 Version: 16.4.3503.0728 - Microsoft Corporation)

Windows Live Photo Common (x32 Version: 16.4.3503.0728 - Microsoft Corporation)

Windows Live PIMT Platform (x32 Version: 16.4.3503.0728 - Microsoft Corporation)

Windows Live SOXE (x32 Version: 16.4.3503.0728 - Microsoft Corporation)

Windows Live SOXE Definitions (x32 Version: 16.4.3503.0728 - Microsoft Corporation)

Windows Live UX Platform (x32 Version: 16.4.3503.0728 - Microsoft Corporation)

Windows Live UX Platform Language Pack (x32 Version: 16.4.3503.0728 - Microsoft Corporation)

Windows Liven peruspaketti (x32 Version: 16.4.3503.0728 - Microsoft Corporation)

VLC media player 2.1.2 (x32 Version: 2.1.2 - VideoLAN)

==================== Restore Points =========================

13-12-2013 16:40:49 Ajoitettu tarkistuspiste

21-12-2013 17:30:51 Ajoitettu tarkistuspiste

29-12-2013 11:34:09 Ajoitettu tarkistuspiste

==================== Hosts content: ==========================

2012-07-26 07:26 - 2013-09-06 23:20 - 00004207 ____A C:\WINDOWS\system32\Drivers\etc\hosts

127.0.0.1 activate.adobe.com

127.0.0.1 activate-sjc0.adobe.com

127.0.0.1 adobeereg.com

127.0.0.1 practivate.adobe.com

127.0.0.1 ereg.adobe.com

127.0.0.1 www.adobeereg.com

127.0.0.1 activate.wip3.adobe.com

127.0.0.1 wip3.adobe.com

127.0.0.1 3dns-3.adobe.com

127.0.0.1 3dns-2.adobe.com

127.0.0.1 adobe-dns.adobe.com

127.0.0.1 adobe-dns-2.adobe.com

127.0.0.1 adobe-dns-3.adobe.com

127.0.0.1 ereg.wip3.adobe.com

127.0.0.1 activate-sea.adobe.com

127.0.0.1 wwis-dubc1-vip60.adobe.com

127.0.0.1 activate-sjc0.adobe.com

127.0.0.1 wwis-dubc1-vip60.adobe.com

127.0.0.1 activate.adobe.com

127.0.0.1 activate-sjc0.adobe.com

127.0.0.1 adobeereg.com

127.0.0.1 practivate.adobe.com

127.0.0.1 ereg.adobe.com

127.0.0.1 www.adobeereg.com

127.0.0.1 activate.wip3.adobe.com

127.0.0.1 wip3.adobe.com

127.0.0.1 3dns-3.adobe.com

127.0.0.1 3dns-2.adobe.com

127.0.0.1 adobe-dns.adobe.com

There are 60 more lines.

==================== Scheduled Tasks (whitelisted) =============

Task: {05293577-D647-4185-B859-C94839A0B2E3} - System32\Tasks\Microsoft\Windows\SettingSync\NetworkStateChangeTask

Task: {0ADE7482-4863-4830-AD1D-D51F0B0B0257} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)

Task: {0B545118-B563-42FC-8D07-B78F602FCF34} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => Rundll32.exe WSClient.dll,RefreshBannedAppsList

Task: {149AAD4D-C6A9-4E79-ADA6-844FC3A7718E} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-09-19] (Piriform Ltd)

Task: {15E033FF-F6B4-4311-A723-50C1F37A1BB1} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe [2013-11-02] (Microsoft Corporation)

Task: {2085BF56-520D-4951-B7C0-DF34AF90CC6A} - System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask => Rundll32.exe sysmain.dll,PfSvWsSwapAssessmentTask

Task: {2C9C0C6C-2A74-46F2-858A-4389D253EAD0} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCachePrepopulate

Task: {352E6CA0-7314-4DF4-89C4-682368D80D57} - System32\Tasks\Microsoft\Windows\Workplace Join\Automatic-Workplace-Join => C:\Windows\System32\AutoWorkplace.exe [2013-08-22] (Microsoft Corporation)

Task: {3B6D8A73-F20B-4C93-B8FB-56A154F172D2} - System32\Tasks\Microsoft\Windows\Time Zone\SynchronizeTimeZone => C:\Windows\System32\tzsync.exe [2013-08-22] (Microsoft Corporation)

Task: {3EE2A1C1-2180-438E-8F0F-E2379A00D962} - System32\Tasks\AdobeAAMUpdater-1.0-MicrosoftAccount-noobsession@hotmail.com => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe [2010-03-06] (Adobe Systems Incorporated)

Task: {424C684A-7B7D-49FB-8CF0-75FE30375EEE} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows\System32\MRT.exe [2013-12-14] (Microsoft Corporation)

Task: {4336FCAC-D91D-4BF2-8F8C-D33F69CD6956} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-08-28] (Google Inc.)

Task: {49754026-21E1-41FC-94FD-727AFE414FE7} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCacheRebalance

Task: {4F547001-6589-4124-B6BF-087110679B72} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe [2013-12-16] (Microsoft Corporation)

Task: {6AA91E8C-DDBD-4979-8464-4062F7681A19} - System32\Tasks\Microsoft\Windows\Plug and Play\Plug and Play Cleanup

Task: {6DFCB649-0769-4F83-BB10-F60F235F6D3D} - System32\Tasks\Microsoft\Windows\SkyDrive\Idle Sync Maintenance Task

Task: {732A29FE-857D-4741-B0D3-F3650C277D3D} - System32\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d => C:\Program Files (x86)\Intel\Intel® ME FW Recovery Agent\bin\Bootstrap.exe [2013-03-07] (Intel Corporation)

Task: {73B1B253-CE67-4501-AE1A-377DD1D68B65} - System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask => Rundll32.exe Startupscan.dll,SusRunTask

Task: {77F1D869-6E65-4079-A2A0-E2023408EF97} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => Rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState

Task: {7C593329-4849-4F62-8C77-F8E48CF732E1} - System32\Tasks\SamsungHomeSyncPC => C:\Program Files (x86)\Samsung\HomeSync Lite\RefreshToken.exe [2013-11-06] ()

Task: {872D0E53-FD2E-41E3-B431-698AF82882CE} - System32\Tasks\Microsoft\Windows\SkyDrive\Routine Maintenance Task

Task: {8CC813C9-712A-41EF-9512-B233444FC669} - System32\Tasks\Microsoft\Windows\AppxDeploymentClient\Pre-staged app cleanup => Rundll32.exe %windir%\system32\AppxDeploymentClient.dll,AppxPreStageCleanupRunTask

Task: {9DBD80A7-846F-4CA2-BB55-DB33716E41EB} - System32\Tasks\SAgent => C:\Program Files\Samsung\S Agent\CommonAgent.exe [2013-10-16] (Samsung Electronics CO., LTD.)

Task: {9EE987E6-95FB-48C9-9E7A-4C7E8AAC009E} - System32\Tasks\Settings => C:\Program Files (x86)\Samsung\Settings\sSettings.exe [2013-02-01] (Samsung Electronics CO., LTD.)

Task: {9FF4C139-5234-410C-B7FA-23EE2FD2AB53} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Maintenance Work

Task: {ADF85AD0-0BDC-4B38-A70E-B027BD3777E7} - System32\Tasks\advRecovery => C:\Program Files\Samsung\Recovery\WCScheduler.exe [2013-08-23] (SEC)

Task: {CFD7C21A-808B-487B-A6EC-8A10E44E8360} - System32\Tasks\Microsoft\Windows\SettingSync\BackupTask

Task: {D6EA8EB1-0399-41C8-BC2B-340F6EEC5543} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-08-28] (Google Inc.)

Task: {D88FEC9E-A82A-46F9-87E2-B6B97B301C1A} - System32\Tasks\Microsoft\Windows\WS\License Validation => Rundll32.exe WSClient.dll,WSpTLR licensing

Task: {DA46820F-FF8A-4B5E-A6B2-B12185DCFFFB} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Logon Synchronization

Task: {E218F8F5-0A60-460C-BCFB-2A3D2BA5126A} - System32\Tasks\Microsoft Office 15 Sync Maintenance for SAMSUNG-Mari Samsung => C:\Program Files\Microsoft Office 15\root\office15\MSOSYNC.EXE [2013-12-16] (Microsoft Corporation)

Task: {E6D378FA-E068-4BCB-80DE-56D43A249507} - System32\Tasks\Microsoft\Windows\RecoveryEnvironment\VerifyWinRE

Task: {EB052B2F-779B-4EBE-B630-E40AFF891847} - System32\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon => C:\Program Files (x86)\Intel\Intel® ME FW Recovery Agent\bin\Bootstrap.exe [2013-03-07] (Intel Corporation)

Task: {ECCCB047-480A-4885-B25F-870FA9777F2D} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2013-12-29] (AVAST Software)

Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2013-09-25 03:04 - 2013-09-25 03:04 - 00011264 _____ () C:\Program Files (x86)\Bluetooth Suite\Modules\ActivateDesktopDebugger\ActivateDesktopDebugger.dll

2013-09-25 03:01 - 2013-09-25 03:01 - 00086016 _____ () C:\Program Files (x86)\Bluetooth Suite\Modules\Map\MAP.dll

2012-12-14 01:42 - 2012-12-14 01:42 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll

2013-10-16 19:15 - 2013-10-16 19:15 - 00088624 _____ () C:\Program Files\Samsung\S Agent\ToastX64.dll

2013-12-29 16:25 - 2013-12-29 14:54 - 02153984 _____ () C:\Program Files\AVAST Software\Avast\defs\13122900\algo.dll

2013-04-21 20:44 - 2013-04-21 20:44 - 00087952 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll

2013-04-21 20:44 - 2013-04-21 20:44 - 01242952 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll

2013-02-01 03:52 - 2013-02-01 03:52 - 00029232 _____ () C:\Program Files (x86)\Samsung\Settings\CmdServer\EasySettingsCmdWrapper.dll

2013-02-01 03:52 - 2013-02-01 03:52 - 01106480 _____ () C:\Program Files (x86)\Samsung\Settings\CmdServer\EasySettingsCmd.dll

2013-02-01 03:52 - 2013-02-01 03:52 - 00111152 _____ () C:\Program Files (x86)\Samsung\Settings\CmdServer\EasySettingsBase.dll

2013-02-01 03:52 - 2013-02-01 03:52 - 00056440 _____ () C:\Program Files (x86)\Samsung\Settings\CmdServer\HookDllPS2.dll

2013-02-01 03:52 - 2013-02-01 03:52 - 00211064 _____ () C:\Program Files (x86)\Samsung\Settings\CmdServer\WinCRT.dll

2013-02-01 03:52 - 2013-02-01 03:52 - 00027184 _____ () C:\Program Files (x86)\Samsung\Settings\EasySettingsAPI.dll

2013-02-01 03:52 - 2013-02-01 03:52 - 00111152 _____ () C:\Program Files (x86)\Samsung\Settings\EasySettingsBase.dll

2013-02-01 03:52 - 2013-02-01 03:52 - 00060976 _____ () C:\Program Files (x86)\Samsung\Settings\EasyMovieEnhancer.dll

2013-02-01 03:52 - 2013-02-01 03:52 - 00103472 _____ () C:\Program Files (x86)\Samsung\Settings\EasySettingsCmdClient.dll

2013-03-11 11:42 - 2012-06-08 05:34 - 00627216 _____ () C:\Program Files (x86)\CyberLink\Power2Go8\CLMediaLibrary.dll

2012-06-08 04:34 - 2012-06-08 04:34 - 00016400 _____ () C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvcPS.dll

2013-10-16 11:40 - 2013-10-16 11:40 - 19336120 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll

2013-05-27 09:23 - 2013-05-27 09:23 - 02337792 _____ () C:\Program Files (x86)\Elisa\Mobiililaajakaista-ohjelma\QtCore4.dll

2013-05-27 09:23 - 2013-05-27 09:23 - 08442368 _____ () C:\Program Files (x86)\Elisa\Mobiililaajakaista-ohjelma\QtGui4.dll

2013-05-27 09:23 - 2013-05-27 09:23 - 11158528 _____ () C:\Program Files (x86)\Elisa\Mobiililaajakaista-ohjelma\QtWebKit4.dll

2013-05-27 09:23 - 2013-05-27 09:23 - 00270336 _____ () C:\Program Files (x86)\Elisa\Mobiililaajakaista-ohjelma\phonon4.dll

2013-05-27 09:23 - 2013-05-27 09:23 - 00804352 _____ () C:\Program Files (x86)\Elisa\Mobiililaajakaista-ohjelma\QtNetwork4.dll

2013-05-27 09:23 - 2013-05-27 09:23 - 00025600 _____ () C:\Program Files (x86)\Elisa\Mobiililaajakaista-ohjelma\imageformats\qgif4.dll

2013-05-27 09:23 - 2013-05-27 09:23 - 00027648 _____ () C:\Program Files (x86)\Elisa\Mobiililaajakaista-ohjelma\imageformats\qico4.dll

2013-05-27 09:23 - 2013-05-27 09:23 - 00119808 _____ () C:\Program Files (x86)\Elisa\Mobiililaajakaista-ohjelma\imageformats\qjpeg4.dll

2013-05-27 09:23 - 2013-05-27 09:23 - 00220672 _____ () C:\Program Files (x86)\Elisa\Mobiililaajakaista-ohjelma\imageformats\qmng4.dll

2013-05-27 08:46 - 2013-05-27 08:46 - 00195072 _____ () C:\Program Files (x86)\Elisa\Mobiililaajakaista-ohjelma\LoginHandler.dll

2013-05-27 09:23 - 2013-05-27 09:23 - 01114112 _____ () C:\Program Files (x86)\Elisa\Mobiililaajakaista-ohjelma\NDISAPI.dll

2013-05-27 09:29 - 2013-05-27 09:29 - 00110592 _____ () C:\Program Files (x86)\Elisa\Mobiililaajakaista-ohjelma\MbnPinManager.dll

2013-10-10 13:32 - 2013-11-17 13:35 - 00316584 _____ () C:\Program Files\Microsoft Office 15\Root\Office15\AppVIsvStream32.dll

2013-12-16 14:27 - 2013-12-16 14:27 - 00359592 _____ () C:\Program Files\Microsoft Office 15\Root\Office15\c2r32.dll

2013-12-05 23:01 - 2013-12-04 04:47 - 00702416 _____ () C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\libglesv2.dll

2013-12-05 23:01 - 2013-12-04 04:47 - 00099792 _____ () C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\libegl.dll

2013-12-05 23:01 - 2013-12-04 04:48 - 04055504 _____ () C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\pdf.dll

2013-12-05 23:01 - 2013-12-04 04:48 - 00399312 _____ () C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\ppGoogleNaClPluginChrome.dll

2013-12-05 23:01 - 2013-12-04 04:47 - 01619408 _____ () C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\ffmpegsumo.dll

2013-11-21 14:18 - 2013-09-16 12:20 - 01242584 _____ () C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\ACE.dll

2011-06-16 14:54 - 2011-06-16 14:54 - 00009504 _____ () C:\Program Files (x86)\Apple Software Update\SoftwareUpdateFiles.Resources\fi.lproj\SoftwareUpdateFilesLocalized.dll

2011-06-16 14:54 - 2011-06-16 14:54 - 00029984 _____ () C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.Resources\fi.lproj\SoftwareUpdateLocalized.dll

==================== Alternate Data Streams (whitelisted) =========

AlternateDataStreams: C:\Users\Mari\SkyDrive:ms-properties

==================== Safe Mode (whitelisted) ===================

==================== Faulty Device Manager Devices =============

==================== Event log errors: =========================

Application errors:

==================

Error: (12/30/2013 00:41:03 AM) (Source: Microsoft-Windows-Immersive-Shell) (User: SAMSUNG)

Description: Sovelluksen microsoft.windowscommunicationsapps_8wekyb3d8bbwe!Microsoft.WindowsLive.Mail aktivointi epäonnistui, virhe: -2147023170. Lisätietoja on Microsoft-Windows-TWinUI/Toiminnassa-lokissa.

Error: (12/29/2013 11:16:28 PM) (Source: Customer Experience Improvement Program) (User: )

Description: 80070005

Error: (12/29/2013 09:47:54 PM) (Source: Customer Experience Improvement Program) (User: )

Description: 80070005

Error: (12/29/2013 02:18:09 PM) (Source: Customer Experience Improvement Program) (User: )

Description: 80070005

Error: (12/29/2013 00:50:40 PM) (Source: Customer Experience Improvement Program) (User: )

Description: 80070005

Error: (12/28/2013 11:06:35 PM) (Source: Customer Experience Improvement Program) (User: )

Description: 80070005

Error: (12/27/2013 00:48:36 PM) (Source: Customer Experience Improvement Program) (User: )

Description: 80070005

Error: (12/27/2013 00:12:56 AM) (Source: Application Error) (User: )

Description: Viallisen sovelluksen nimi: EasyLauncher.exe, versio: 2.0.0.10, aikaleima: 0x510b1e29

Viallisen moduulin nimi: unknown, versio: 0.0.0.0, aikaleima: 0x00000000

Poikkeuskoodi: 0xc0000005

Virhepoikkeama: 0x00000000

Viallisen prosessin tunnus: 0x828

Viallisen sovelluksen käynnistysaika: 0xEasyLauncher.exe0

Viallisen sovelluksen polku: EasyLauncher.exe1

Viallisen moduulin polku: EasyLauncher.exe2

Raportin tunnus: EasyLauncher.exe3

Viallisen paketin koko nimi: EasyLauncher.exe4

Viallisen paketin suhteellinen sovellustunnus: EasyLauncher.exe5

Error: (12/27/2013 00:12:13 AM) (Source: Application Error) (User: )

Description: Viallisen sovelluksen nimi: iTunes.exe, versio: 11.1.3.8, aikaleima: 0x5274a87d

Viallisen moduulin nimi: itw_scrobbler.dll_unloaded, versio: 6.0.5.4, aikaleima: 0x511d100e

Poikkeuskoodi: 0xc00001a5

Virhepoikkeama: 0x000b3a9c

Viallisen prosessin tunnus: 0x1090

Viallisen sovelluksen käynnistysaika: 0xiTunes.exe0

Viallisen sovelluksen polku: iTunes.exe1

Viallisen moduulin polku: iTunes.exe2

Raportin tunnus: iTunes.exe3

Viallisen paketin koko nimi: iTunes.exe4

Viallisen paketin suhteellinen sovellustunnus: iTunes.exe5

Error: (12/26/2013 03:05:20 PM) (Source: Customer Experience Improvement Program) (User: )

Description: 80070005

System errors:

=============

Error: (12/30/2013 00:51:20 AM) (Source: DCOM) (User: NT-hallinta)

Description: tietokoneen oletusarvoPaikallinenAktivointi{C2F03A33-21F5-47FA-B4BB-156362A2F239}{316CDED5-E4AE-4B15-9113-7055D84DCC97}NT-hallintaPaikallinen palveluS-1-5-19LocalHost (LRPC käytössä)Ei käytettävissäEi käytettävissä

Error: (12/29/2013 10:45:26 PM) (Source: DCOM) (User: NT-hallinta)

Description: tietokoneen oletusarvoPaikallinenAktivointi{C2F03A33-21F5-47FA-B4BB-156362A2F239}{316CDED5-E4AE-4B15-9113-7055D84DCC97}NT-hallintaPaikallinen palveluS-1-5-19LocalHost (LRPC käytössä)Ei käytettävissäEi käytettävissä

Error: (12/29/2013 09:28:38 PM) (Source: DCOM) (User: NT-hallinta)

Description: tietokoneen oletusarvoPaikallinenAktivointi{C2F03A33-21F5-47FA-B4BB-156362A2F239}{316CDED5-E4AE-4B15-9113-7055D84DCC97}NT-hallintaPaikallinen palveluS-1-5-19LocalHost (LRPC käytössä)Ei käytettävissäEi käytettävissä

Error: (12/29/2013 09:24:53 PM) (Source: DCOM) (User: SAMSUNG)