Jump to content

Am I infected?


Recommended Posts

Hey!

Lately I've experience quite frequently blue screens, and programs just closing them self. I then yesterday noticed that malwarebytes did not run, and that the process was killed every time I tried to start the program. I found out that I had a rootkit using avast! Free Antivirus, but I don't know if I got rid of everything.

 

Almost, if not every time, I run a virus scan, I will get a blue screen before the scan finish. The most common blue screen error I get is "MEMORY_MANAGEMENT".

 

can anyone help me out? 
Thanks in advance,
Jon-F

Link to post
Share on other sites

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 27-04-2014

Ran by JF (administrator) on JF-PC on 29-04-2014 15:34:14

Running from C:\Users\JF\Desktop\New folder (2)

Windows 7 Ultimate Service Pack 1 (X64) OS Language: Norwegian Bokmal

Internet Explorer Version 11

Boot Mode: Normal

 

The only official download link for FRST:

Download link for 32-Bit version:

Download link for 64-Bit Version:

Download link from any site other than Bleeping Computer is unpermitted or outdated.


 

==================== Processes (Whitelisted) =================

 

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe

(AMD) C:\Windows\system32\atiesrxx.exe

(Creative Technology Ltd) C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe

(AMD) C:\Windows\system32\atieclxx.exe

(AVAST Software) d:\Program Files\AVAST Software\Avast\AvastSvc.exe

() C:\Program Files (x86)\ASUS\AXSP\1.00.18\atkexComSvc.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AI Suite II\AsRoutineController.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AI Suite II\DIGI+ Power Control\PowerControlHelp.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AAHM\1.00.20\aaHMSvc.exe

(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.23.9\GoogleCrashHandler.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.13\AsSysCtrlService.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AsusFanControlService\1.00.25\AsusFanControlService.exe

(cFos Software GmbH) C:\Program Files\ASUS\ROG GameFirst\spd.exe

(Intel® Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe

(Intel Corporation) C:\Windows\system32\IProsetMonitor.exe

(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.23.9\GoogleCrashHandler64.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe

(Skype Technologies) C:\Program Files (x86)\Skype\Updater\Updater.exe

(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

(LogMeIn Inc.) D:\hamachi-2.exe

(LogMeIn, Inc.) D:\LMIGuardianSvc.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AI Suite II\USB 3.0 Boost\U3BoostSvr64.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AI Suite II\TurboV EVO\TurboVHelp.exe

(LogMeIn Inc.) D:\hamachi-2-ui.exe

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Integrated Clock Controller Service\ICCProxy.exe

(LogMeIn, Inc.) D:\LMIGuardianSvc.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AI Suite II\EPU\EPUHelp.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe

(cFos Software GmbH) C:\Program Files\ASUS\ROG GameFirst\cfosspeed.exe

(Valve Corporation) D:\Steam\Steam.exe

(Spotify Ltd) C:\Users\JF\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe

(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe

(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AI Suite II\AI Suite II.exe

(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AI Suite II\Sensor\AlertHelper\AlertHelper.exe

(Spotify Ltd) C:\Users\JF\AppData\Roaming\Spotify\spotify.exe

(Dropbox, Inc.) C:\Users\JF\AppData\Roaming\Dropbox\bin\Dropbox.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe

(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(cyberlink) C:\Program Files (x86)\CyberLink\Shared files\brs.exe

(Creative Technology Ltd) C:\Program Files (x86)\Creative\Sound Blaster X-Fi MB 2\Sound Blaster Panel\VolPanlu.exe

(ASUSTek Computer Inc.) C:\Program Files (x86)\InstallShield Installation Information\{E6931688-DA2B-4E16-8539-3D323D69C677}\AiChargerPlus.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(AVAST Software) D:\Program Files\AVAST Software\Avast\AvastUI.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

() C:\Users\JF\AppData\Roaming\Spotify\Data\SpotifyHelper.exe

() C:\Users\JF\AppData\Roaming\Spotify\Data\SpotifyHelper.exe

() C:\Users\JF\AppData\Roaming\Spotify\Data\SpotifyHelper.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

() C:\Users\JF\AppData\Roaming\Spotify\Data\SpotifyHelper.exe

(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe

 

 

==================== Registry (Whitelisted) ==================

 

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6463592 2012-02-10] (Realtek Semiconductor)

HKLM\...\Run: [THXCfg64] => C:\Windows\system32\THXCfg64.dll [17920 2009-10-15] (Creative Technology Ltd.)

HKLM\...\Run: [RunDLLEntry] => C:\Windows\system32\AmbRunE.dll [17920 2009-02-26] (Creative Technology Ltd.)

HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [1271072 2014-03-11] (Microsoft Corporation)

HKLM\...\Run: [ROG GameFirst] => C:\Program Files\ASUS\ROG GameFirst\cFosSpeed.exe [1305272 2010-11-22] (cFos Software GmbH)

HKLM-x32\...\Run: [THX Audio Control Panel] => C:\Program Files (x86)\Creative\Sound Blaster X-Fi MB 2\THXAudioCP\THXAudio.exe [1349632 2010-06-11] (Creative Technology Ltd)

HKLM-x32\...\Run: [updReg] => C:\Windows\UpdReg.EXE [90112 2000-05-11] (Creative Technology Ltd.)

HKLM-x32\...\Run: [uSB3MON] => C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-01-04] (Intel Corporation)

HKLM-x32\...\Run: [iAStorIcon] => C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe [284440 2012-02-01] (Intel Corporation)

HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [87336 2010-02-03] (CyberLink Corp.)

HKLM-x32\...\Run: [bDRegion] => C:\Program Files (x86)\Cyberlink\Shared files\brs.exe [75048 2011-03-01] (cyberlink)

HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)

HKLM-x32\...\Run: [VolPanel] => C:\Program Files (x86)\Creative\Sound Blaster X-Fi MB 2\Sound Blaster Panel\VolPanlu.exe [241789 2010-02-18] (Creative Technology Ltd)

HKLM-x32\...\Run: [ASUS AiChargerPlus Execute] => C:\Program Files (x86)\InstallShield Installation Information\{E6931688-DA2B-4E16-8539-3D323D69C677}\AiChargerPlus.exe [465536 2011-10-31] (ASUSTek Computer Inc.)

HKLM-x32\...\Run: [startCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766208 2013-08-30] (Advanced Micro Devices, Inc.)

HKLM-x32\...\Run: [AvastUI.exe] => d:\Program Files\AVAST Software\Avast\AvastUI.exe [3873704 2014-04-19] (AVAST Software)

HKLM-x32\...\Run: [LogMeIn Hamachi Ui] => D:\hamachi-2-ui.exe [3814736 2014-04-15] (LogMeIn Inc.)

HKLM-x32\...\Run: [sunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)

HKU\.DEFAULT\...\RunOnce: [Application Restart #1] - C:\Program Files (x86)\ASUS\GPU Tweak\Monitor.exe  /RestartByRestartManager:3AB1406E-AAEC-4a90-BF0E-B3F88CD054B0

HKU\S-1-5-21-2228356659-1681754584-2698884876-1000\...\Run: [steam] => D:\Steam\steam.exe [1825984 2014-04-24] (Valve Corporation)

HKU\S-1-5-21-2228356659-1681754584-2698884876-1000\...\Run: [spotify Web Helper] => C:\Users\JF\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1171000 2014-04-10] (Spotify Ltd)

HKU\S-1-5-21-2228356659-1681754584-2698884876-1000\...\Run: [AdobeBridge] => [X]

HKU\S-1-5-21-2228356659-1681754584-2698884876-1000\...\Run: [HydraVisionDesktopManager] => C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe [389120 2013-08-30] (AMD)

HKU\S-1-5-21-2228356659-1681754584-2698884876-1000\...\Run: [skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [20922016 2014-02-10] (Skype Technologies S.A.)

HKU\S-1-5-21-2228356659-1681754584-2698884876-1000\...\Run: [spotify] => C:\Users\JF\AppData\Roaming\Spotify\spotify.exe [6087224 2014-04-10] (Spotify Ltd)

HKU\S-1-5-21-2228356659-1681754584-2698884876-1000\...\MountPoints2: {639bb87e-2f43-11e2-936a-10bf4886abff} - F:\Startme.exe

HKU\S-1-5-21-2228356659-1681754584-2698884876-1000\...\MountPoints2: {879868cb-f3ff-11e1-a7a4-806e6f6e6963} - D:\.\Bin\ASSETUP.exe

Startup: C:\Users\JF\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk

ShortcutTarget: Dropbox.lnk -> C:\Users\JF\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

 

==================== Internet (Whitelisted) ====================

 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://no.msn.com/?ocid=iehp

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xC9EAEBFB1388CD01

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = no

URLSearchHook: HKCU - (No Name) - {472734EA-242A-422b-ADF8-83D1E48CC825} - No File

BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)

BHO-x32: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: Påloggingshjelp for Microsoft-konto - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

BHO-x32: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

DPF: HKLM-x32 {6C269571-C6D7-4818-BCA4-32A035E8C884} http://ccfiles.creative.com/Web/softwareupdate/su/ocx/15102/CTSUEng.cab

DPF: HKLM-x32 {D4B68B83-8710-488B-A692-D74B50BA558E} http://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab

DPF: HKLM-x32 {E705A591-DA3C-4228-B0D5-A356DBA42FBF} http://ccfiles.creative.com/Web/softwareupdate/su2/ocx/20015/CTSUEng.cab

DPF: HKLM-x32 {F6ACF75C-C32C-447B-9BEF-46B766368D29} http://ccfiles.creative.com/Web/softwareupdate/ocx/110926/CTPID.cab

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

 

FireFox:

========

FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_182.dll ()

FF Plugin: @microsoft.com/GENUINE - disabled No File

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)

FF Plugin: adobe.com/AdobeAAMDetect_x86_64 - C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll (Adobe Systems)

FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_182.dll ()

FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59 - C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)

FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @microsoft.com/GENUINE - disabled No File

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File

FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @videolan.org/vlc,version=2.0.2 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin-x32: @videolan.org/vlc,version=2.1.2 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin-x32: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll (Adobe Systems)

FF Plugin HKCU: @nsroblox.roblox.com/launcher - C:\Program Files (x86)\Roblox\Versions\version-df24752ec7384d96\\NPRobloxProxy.dll ( ROBLOX Corporation)

FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\JF\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)

 

Chrome: 

=======

CHR HomePage: www.google.com

CHR RestoreOnStartup: "sync"

CHR StartupUrls: "www.google.com"

CHR DefaultSearchURL: http://www.google.no/#hl=no&sclient=psy-ab&q={searchTerms}

CHR DefaultNewTabURL: 

CHR Plugin: (Widevine Content Decryption Module) - C:\Users\JF\AppData\Local\Google\Chrome\User Data\WidevineCDM\1.4.2.464\_platform_specific\win_x86\widevinecdmadapter.dll ()

CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.131\PepperFlash\pepflashplayer.dll ()

CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer

CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.131\ppGoogleNaClPluginChrome.dll ()

CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.131\pdf.dll ()

CHR Plugin: (AdobeAAMDetect) - C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll (Adobe Systems)

CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

CHR Plugin: (Google Earth Plugin) - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)

CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)

CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)

CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)

CHR Plugin: (Java Deployment Toolkit 7.0.550.14) - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

CHR Plugin: (Java Platform SE 7 U55) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

CHR Plugin: (Silverlight Plug-In) - C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)

CHR Plugin: (Roblox Launcher Plugin) - C:\Program Files (x86)\Roblox\Versions\version-df24752ec7384d96\\NPRobloxProxy.dll ( ROBLOX Corporation)

CHR Plugin: (VLC Web Plugin) - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

CHR Plugin: (Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

CHR Plugin: (Unity Player) - C:\Users\JF\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)

CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_182.dll ()

CHR Extension: (Google Docs) - C:\Users\JF\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-05-04]

CHR Extension: (Google Drive) - C:\Users\JF\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-05-04]

CHR Extension: (Hover Free) - C:\Users\JF\AppData\Local\Google\Chrome\User Data\Default\Extensions\bbilojbgaikphnpbllmjjfpgapbhmkic [2014-01-11]

CHR Extension: (YouTube) - C:\Users\JF\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-05-04]

CHR Extension: (Google Search) - C:\Users\JF\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-05-04]

CHR Extension: (HTTPS Everywhere) - C:\Users\JF\AppData\Local\Google\Chrome\User Data\Default\Extensions\gcbommkclmclpchllfjekcdonpmejbdp [2014-04-03]

CHR Extension: (AdBlock) - C:\Users\JF\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2013-05-11]

CHR Extension: (Disconnect) - C:\Users\JF\AppData\Local\Google\Chrome\User Data\Default\Extensions\jeoacafpbcihiomhlakheieifhpjdfeo [2014-03-30]

CHR Extension: (Ghostery) - C:\Users\JF\AppData\Local\Google\Chrome\User Data\Default\Extensions\mlomiejdfkolichcflejclcbmpeaniij [2014-03-30]

CHR Extension: (Google Wallet) - C:\Users\JF\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-23]

CHR Extension: (Gmail) - C:\Users\JF\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-05-04]

CHR HKCU\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

 

==================== Services (Whitelisted) =================

 

R2 asComSvc; C:\Program Files (x86)\ASUS\AXSP\1.00.18\atkexComSvc.exe [918448 2011-10-29] ()

R2 asHmComSvc; C:\Program Files (x86)\ASUS\AAHM\1.00.20\aaHMSvc.exe [951936 2012-02-02] (ASUSTeK Computer Inc.)

R2 AsSysCtrlService; C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.13\AsSysCtrlService.exe [149120 2012-02-17] (ASUSTeK Computer Inc.)

R2 AsusFanControlService; C:\Program Files (x86)\ASUS\AsusFanControlService\1.00.25\AsusFanControlService.exe [1493120 2012-02-22] (ASUSTeK Computer Inc.)

R2 avast! Antivirus; d:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-04-19] (AVAST Software)

R2 cFosSpeedS; C:\Program Files\ASUS\ROG GameFirst\spd.exe [487096 2010-11-22] (cFos Software GmbH)

R2 Hamachi2Svc; D:\hamachi-2.exe [2227536 2014-04-15] (LogMeIn Inc.)

R2 jhi_service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [161560 2012-02-07] (Intel Corporation)

R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2014-03-11] (Microsoft Corporation)

R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [347872 2014-03-11] (Microsoft Corporation)

 

==================== Drivers (Whitelisted) ====================

 

R3 AiCharger; C:\Windows\SysWow64\drivers\AiCharger.sys [14592 2010-10-20] (ASUSTek Computer Inc.)

S3 arcvad_ds2dhw; C:\Windows\System32\drivers\ArcVad.sys [27136 2008-10-28] (ArcSoft, Inc.)

R0 asahci64; C:\Windows\System32\DRIVERS\asahci64.sys [49760 2012-01-06] (Asmedia Technology)

R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [15232 2013-02-27] ()

R1 AsUpIO; C:\Windows\SysWow64\drivers\AsUpIO.sys [14464 2010-08-03] ()

R3 ASUSFILTER; C:\Windows\SysWow64\drivers\ASUSFILTER.sys [46152 2011-09-20] (MCCI Corporation)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-04-19] ()

R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-04-19] (AVAST Software)

R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-04-19] (AVAST Software)

R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-04-19] ()

R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1039096 2014-04-19] (AVAST Software)

R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [423240 2014-04-19] (AVAST Software)

R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [85328 2014-04-19] (AVAST Software)

R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [208416 2014-04-19] ()

R3 cFosSpeed; C:\Windows\System32\DRIVERS\cfosspeed.sys [1437368 2010-11-22] (cFos Software GmbH)

U5 FontCache3.0.0.0; C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe [42856 2010-11-04] (Microsoft Corporation)

S3 FsUsbExDisk; C:\Windows\SysWOW64\FsUsbExDisk.SYS [37344 2013-03-20] ()

S3 LGPBTDD; C:\Windows\System32\Drivers\LGPBTDD.sys [30728 2009-07-01] (Logitech Inc.)

S3 LGSHidFilt; C:\Windows\System32\DRIVERS\LGSHidFilt.Sys [66360 2012-10-03] (Logitech Inc.)

S3 LGSUsbFilt; C:\Windows\System32\DRIVERS\LGSUsbFilt.Sys [43832 2012-10-03] (Logitech Inc.)

R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [268512 2014-01-25] (Microsoft Corporation)

R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [133928 2014-03-11] (Microsoft Corporation)

S3 YMIDUSBW; C:\Windows\System32\drivers\ymidusbx64.sys [51016 2011-11-01] (Yamaha Corporation)

R2 {1BA31E5A-C098-42d8-8F88-3C9F78A2FDDC}; C:\Program Files (x86)\CyberLink\PowerDVD10\NavFilter\000.fcl [146928 2011-03-01] (CyberLink Corp.)

S0 74926767; system32\drivers\10651725.sys [X]

S3 atillk64; \??\C:\HD_6950_to_HD_6970_mod\winflash\atillk64.sys [X]

S3 cpuz136; \??\C:\Windows\TEMP\cpuz136\cpuz136_x64.sys [X]

S3 GPUZ; \??\C:\Windows\TEMP\GPUZ.sys [X]

S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]

S3 tsusbhub; system32\drivers\tsusbhub.sys [X]

S3 VGPU; System32\drivers\rdvgkmd.sys [X]

 

==================== NetSvcs (Whitelisted) ===================

 

 

==================== One Month Created Files and Folders ========

 

2014-04-29 15:32 - 2014-04-29 15:32 - 00277536 _____ () C:\Windows\Minidump\042914-11856-01.dmp

2014-04-29 15:30 - 2014-04-29 15:30 - 00000262 ____H () C:\Windows\Tasks\User_Feed_Synchronization-{3B65AA3E-3538-4E66-BAF5-DFE0C0489BDC}.job

2014-04-28 22:52 - 2014-04-29 15:34 - 00000000 ____D () C:\Users\JF\Desktop\New folder (2)

2014-04-28 22:20 - 2014-04-28 22:21 - 00056170 _____ () C:\Users\JF\Downloads\FRST.txt

2014-04-28 22:20 - 2014-04-28 22:21 - 00049353 _____ () C:\Users\JF\Downloads\Addition.txt

2014-04-28 22:18 - 2014-04-29 15:34 - 00000000 ____D () C:\FRST

2014-04-28 19:31 - 2014-04-28 19:31 - 00001106 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-04-28 19:31 - 2014-04-28 19:31 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-04-28 19:31 - 2014-04-28 19:31 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-04-28 19:31 - 2014-04-03 09:51 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2014-04-28 19:31 - 2014-04-03 09:51 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2014-04-28 19:31 - 2014-04-03 09:50 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2014-04-28 19:30 - 2014-04-28 19:30 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\JF\Downloads\mbam-setup-2.0.1.1004 (3).exe

2014-04-28 18:59 - 2014-04-28 18:59 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\JF\Downloads\mbam-setup-2.0.1.1004 (2).exe

2014-04-28 18:38 - 2014-04-28 18:38 - 00277536 _____ () C:\Windows\Minidump\042814-15662-01.dmp

2014-04-28 18:32 - 2014-04-28 18:32 - 00277536 _____ () C:\Windows\Minidump\042814-15272-01.dmp

2014-04-28 17:22 - 2014-04-28 17:22 - 00000000 ____D () C:\TDSSKiller_Quarantine

2014-04-28 17:19 - 2014-04-28 17:19 - 04164448 _____ (Kaspersky Lab ZAO) C:\Users\JF\Downloads\tdsskiller (1).exe

2014-04-28 17:18 - 2014-04-28 17:18 - 00277536 _____ () C:\Windows\Minidump\042814-13072-01.dmp

2014-04-28 17:07 - 2014-04-28 17:07 - 04164448 _____ (Kaspersky Lab ZAO) C:\Users\JF\Downloads\tdsskiller.exe

2014-04-28 16:46 - 2014-04-28 16:46 - 00277536 _____ () C:\Windows\Minidump\042814-10920-01.dmp

2014-04-28 16:43 - 2014-04-28 16:43 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\JF\Downloads\mbam-setup-2.0.1.1004 (1).exe

2014-04-28 16:37 - 2014-04-28 16:37 - 00000806 _____ () C:\Users\JF\Downloads\FixExe.reg

2014-04-28 16:30 - 2014-04-28 16:30 - 01933048 _____ (Bleeping Computer, LLC) C:\Users\JF\Downloads\rkill.exe

2014-04-28 16:25 - 2014-04-28 16:25 - 00000000 ____D () C:\SUPERDelete

2014-04-28 16:20 - 2014-04-28 16:26 - 00000000 ____D () C:\AdwCleaner

2014-04-28 16:20 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll

2014-04-28 16:19 - 2014-04-28 16:19 - 01329501 _____ () C:\Users\JF\Downloads\AdwCleaner.exe

2014-04-28 15:39 - 2014-04-28 15:40 - 18835768 _____ (SUPERAntiSpyware) C:\Users\JF\Downloads\SUPERAntiSpyware.exe

2014-04-28 15:32 - 2014-04-28 15:32 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\JF\Downloads\mbam-setup-2.0.1.1004.exe

2014-04-28 14:58 - 2014-04-28 15:22 - 00000000 ____D () C:\Sandbox

2014-04-28 14:57 - 2014-04-28 15:22 - 00000000 ____D () C:\Users\JF\Desktop\YouTube til mp3-konvertering_files

2014-04-28 14:57 - 2014-04-28 14:57 - 00012761 _____ () C:\Users\JF\Desktop\YouTube til mp3-konvertering.htm

2014-04-28 14:45 - 2014-04-28 15:22 - 00000000 ____D () C:\Users\JF\AppData\Roaming\Device Doctor Pro

2014-04-28 14:45 - 2014-04-28 15:22 - 00000000 ____D () C:\Program Files (x86)\Device Doctor Pro

2014-04-28 14:43 - 2014-04-28 14:43 - 00000000 ____D () C:\Program Files (x86)\NuGet

2014-04-28 14:39 - 2014-04-28 14:39 - 00000000 ____D () C:\Users\JF\Documents\Visual Studio 2013

2014-04-28 14:38 - 2014-04-28 14:38 - 00277536 _____ () C:\Windows\Minidump\042814-16036-01.dmp

2014-04-28 14:36 - 2014-04-28 15:22 - 00000000 ____D () C:\Program Files (x86)\Microsoft SDKs

2014-04-28 14:36 - 2014-04-28 14:37 - 00000000 ____D () C:\Program Files (x86)\Windows Kits

2014-04-28 14:36 - 2014-04-28 14:36 - 00000000 ____D () C:\Program Files (x86)\Microsoft Help Viewer

2014-04-28 14:35 - 2014-04-28 15:22 - 00000000 ____D () C:\Program Files\Microsoft SQL Server

2014-04-28 14:35 - 2014-04-28 15:22 - 00000000 ____D () C:\Program Files (x86)\Microsoft SQL Server

2014-04-28 14:35 - 2014-04-28 14:35 - 00000000 ____D () C:\Windows\SysWOW64\1033

2014-04-28 14:35 - 2014-04-28 14:35 - 00000000 ____D () C:\Windows\system32\1033

2014-04-28 14:35 - 2014-04-28 14:35 - 00000000 ____D () C:\Program Files\Microsoft SQL Server Compact Edition

2014-04-28 14:26 - 2014-04-28 14:26 - 00000000 __SHD () C:\Users\JF\AppData\Local\EmieUserList

2014-04-28 14:26 - 2014-04-28 14:26 - 00000000 __SHD () C:\Users\JF\AppData\Local\EmieSiteList

2014-04-28 14:25 - 2014-04-28 14:25 - 00991928 _____ (Microsoft Corporation) C:\Users\JF\Downloads\wdksetup (1).exe

2014-04-28 14:23 - 2014-04-28 14:23 - 00000000 ___SD () C:\Windows\system32\CompatTel

2014-04-28 14:22 - 2014-04-28 14:22 - 01036872 _____ (Microsoft Corporation) C:\Users\JF\Downloads\wdexpress_full.exe

2014-04-28 14:22 - 2014-04-28 14:22 - 00991928 _____ (Microsoft Corporation) C:\Users\JF\Downloads\wdksetup.exe

2014-04-28 14:20 - 2014-04-14 04:24 - 00465408 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll

2014-04-28 14:20 - 2014-04-14 04:19 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

2014-04-28 14:04 - 2014-04-28 14:05 - 00277536 _____ () C:\Windows\Minidump\042814-15600-01.dmp

2014-04-27 11:56 - 2014-04-27 11:56 - 00277536 _____ () C:\Windows\Minidump\042714-14274-01.dmp

2014-04-27 02:25 - 2014-03-06 12:21 - 23549440 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-04-27 02:25 - 2014-03-06 11:32 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-04-27 02:25 - 2014-03-06 11:31 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll

2014-04-27 02:25 - 2014-03-06 11:19 - 17387008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-04-27 02:25 - 2014-03-06 10:59 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2014-04-27 02:25 - 2014-03-06 10:57 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2014-04-27 02:25 - 2014-03-06 10:57 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll

2014-04-27 02:25 - 2014-03-06 10:53 - 02767360 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2014-04-27 02:25 - 2014-03-06 10:40 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2014-04-27 02:25 - 2014-03-06 10:39 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2014-04-27 02:25 - 2014-03-06 10:32 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-04-27 02:25 - 2014-03-06 10:32 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2014-04-27 02:25 - 2014-03-06 10:29 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2014-04-27 02:25 - 2014-03-06 10:29 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe

2014-04-27 02:25 - 2014-03-06 10:28 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2014-04-27 02:25 - 2014-03-06 10:15 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe

2014-04-27 02:25 - 2014-03-06 10:11 - 05784064 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2014-04-27 02:25 - 2014-03-06 10:09 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll

2014-04-27 02:25 - 2014-03-06 10:03 - 00586240 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2014-04-27 02:25 - 2014-03-06 10:02 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2014-04-27 02:25 - 2014-03-06 10:02 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2014-04-27 02:25 - 2014-03-06 10:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll

2014-04-27 02:25 - 2014-03-06 09:56 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll

2014-04-27 02:25 - 2014-03-06 09:48 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2014-04-27 02:25 - 2014-03-06 09:47 - 02178048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2014-04-27 02:25 - 2014-03-06 09:46 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2014-04-27 02:25 - 2014-03-06 09:46 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2014-04-27 02:25 - 2014-03-06 09:45 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2014-04-27 02:25 - 2014-03-06 09:42 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2014-04-27 02:25 - 2014-03-06 09:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2014-04-27 02:25 - 2014-03-06 09:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2014-04-27 02:25 - 2014-03-06 09:36 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll

2014-04-27 02:25 - 2014-03-06 09:22 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll

2014-04-27 02:25 - 2014-03-06 09:21 - 00628736 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2014-04-27 02:25 - 2014-03-06 09:13 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll

2014-04-27 02:25 - 2014-03-06 09:11 - 02043904 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2014-04-27 02:25 - 2014-03-06 09:07 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll

2014-04-27 02:25 - 2014-03-06 09:01 - 00244224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll

2014-04-27 02:25 - 2014-03-06 08:53 - 13551104 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2014-04-27 02:25 - 2014-03-06 08:46 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2014-04-27 02:25 - 2014-03-06 08:40 - 01967104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2014-04-27 02:25 - 2014-03-06 08:36 - 11745792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2014-04-27 02:25 - 2014-03-06 08:22 - 02260480 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2014-04-27 02:25 - 2014-03-06 07:58 - 01400832 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2014-04-27 02:25 - 2014-03-06 07:50 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2014-04-27 02:25 - 2014-03-06 07:43 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2014-04-27 02:25 - 2014-03-06 07:41 - 01789440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2014-04-27 02:25 - 2014-03-06 07:36 - 01143808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2014-04-27 00:45 - 2014-04-27 00:45 - 00277536 _____ () C:\Windows\Minidump\042714-12152-01.dmp

2014-04-25 23:44 - 2014-04-28 22:30 - 00000000 ____D () C:\Users\JF\AppData\Local\CrashDumps

2014-04-24 15:45 - 2014-04-24 15:45 - 00277536 _____ () C:\Windows\Minidump\042414-13447-01.dmp

2014-04-24 15:45 - 2014-04-24 15:45 - 00006696 ____N () C:\bootsqm.dat

2014-04-24 15:35 - 2014-04-24 15:35 - 00277536 _____ () C:\Windows\Minidump\042414-12776-01.dmp

2014-04-20 15:14 - 2014-04-20 15:14 - 00046098 _____ () C:\Users\JF\Downloads\155840.user.js

2014-04-19 11:14 - 2014-04-19 11:14 - 04787368 _____ (Piriform Ltd) C:\Users\JF\Downloads\ccsetup412.exe

2014-04-19 01:26 - 2014-04-19 01:26 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr

2014-04-19 01:26 - 2014-04-19 01:26 - 00029208 _____ () C:\Windows\system32\Drivers\aswHwid.sys

2014-04-19 01:23 - 2014-04-19 01:23 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe

2014-04-19 01:23 - 2014-04-19 01:23 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe

2014-04-19 01:23 - 2014-04-19 01:23 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe

2014-04-19 01:23 - 2014-04-19 01:23 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll

2014-04-19 01:23 - 2014-04-19 01:23 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java

2014-04-19 01:23 - 2014-04-19 01:23 - 00000000 ____D () C:\Program Files (x86)\Java

2014-04-19 01:22 - 2014-04-19 01:22 - 00921512 _____ (Oracle Corporation) C:\Users\JF\Downloads\chromeinstall-7u55 (1).exe

2014-04-19 01:21 - 2014-04-19 01:22 - 00004001 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_55-b14.log

2014-04-19 01:20 - 2014-04-19 01:21 - 00921512 _____ (Oracle Corporation) C:\Users\JF\Downloads\chromeinstall-7u55.exe

2014-04-19 01:09 - 2014-04-19 01:09 - 00000267 _____ () C:\Users\JF\Downloads\ATT00101.htm

2014-04-19 00:43 - 2014-04-19 00:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi

2014-04-09 11:47 - 2014-03-04 11:44 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll

2014-04-09 11:47 - 2014-03-04 11:44 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll

2014-04-09 11:47 - 2014-03-04 11:44 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll

2014-04-09 11:47 - 2014-03-04 11:44 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll

2014-04-09 11:47 - 2014-03-04 11:44 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll

2014-04-09 11:47 - 2014-03-04 11:17 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll

2014-04-09 11:47 - 2014-03-04 11:16 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll

2014-04-09 11:47 - 2014-03-04 11:16 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe

2014-04-09 11:47 - 2014-03-04 11:16 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll

2014-04-09 11:47 - 2014-03-04 10:09 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe

2014-04-09 11:47 - 2014-03-04 10:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe

2014-04-09 11:47 - 2014-02-04 04:35 - 00274880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys

2014-04-09 11:47 - 2014-02-04 04:35 - 00190912 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys

2014-04-09 11:47 - 2014-02-04 04:35 - 00027584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Diskdump.sys

2014-04-09 11:47 - 2014-02-04 04:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\iologmsg.dll

2014-04-09 11:47 - 2014-02-04 04:00 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iologmsg.dll

2014-04-09 11:47 - 2014-01-24 04:37 - 01684928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys

2014-04-07 17:43 - 2014-04-07 17:43 - 00057374 _____ () C:\Users\JF\Downloads\174037.user.js

 

==================== One Month Modified Files and Folders =======

 

2014-04-29 15:34 - 2014-04-28 22:52 - 00000000 ____D () C:\Users\JF\Desktop\New folder (2)

2014-04-29 15:34 - 2014-04-28 22:18 - 00000000 ____D () C:\FRST

2014-04-29 15:32 - 2014-04-29 15:32 - 00277536 _____ () C:\Windows\Minidump\042914-11856-01.dmp

2014-04-29 15:32 - 2014-02-01 13:50 - 1335524509 _____ () C:\Windows\MEMORY.DMP

2014-04-29 15:32 - 2014-01-26 02:00 - 00003606 _____ () C:\Windows\setupact.log

2014-04-29 15:32 - 2012-10-22 14:50 - 00000000 ____D () C:\Users\JF\AppData\Local\LogMeIn Hamachi

2014-04-29 15:32 - 2012-10-03 17:24 - 00000000 ____D () C:\Windows\Minidump

2014-04-29 15:32 - 2012-09-06 18:26 - 00000000 ____D () C:\Users\JF\AppData\Roaming\Dropbox

2014-04-29 15:32 - 2012-09-01 21:29 - 00000000 ____D () C:\Users\JF\AppData\Roaming\Skype

2014-04-29 15:32 - 2012-09-01 18:21 - 00000000 ____D () C:\Users\JF\AppData\Local\Spotify

2014-04-29 15:32 - 2012-09-01 18:19 - 00000000 ____D () C:\Users\JF\AppData\Roaming\Spotify

2014-04-29 15:32 - 2012-09-01 08:59 - 00000980 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-04-29 15:32 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-04-29 15:31 - 2012-09-01 08:40 - 01589664 _____ () C:\Windows\WindowsUpdate.log

2014-04-29 15:30 - 2014-04-29 15:30 - 00000262 ____H () C:\Windows\Tasks\User_Feed_Synchronization-{3B65AA3E-3538-4E66-BAF5-DFE0C0489BDC}.job

2014-04-29 15:29 - 2009-07-14 07:08 - 00032542 _____ () C:\Windows\Tasks\SCHEDLGU.TXT

2014-04-29 15:28 - 2012-09-01 08:59 - 00000984 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-04-28 22:51 - 2012-09-15 10:30 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-04-28 22:30 - 2014-04-25 23:44 - 00000000 ____D () C:\Users\JF\AppData\Local\CrashDumps

2014-04-28 22:21 - 2014-04-28 22:20 - 00056170 _____ () C:\Users\JF\Downloads\FRST.txt

2014-04-28 22:21 - 2014-04-28 22:20 - 00049353 _____ () C:\Users\JF\Downloads\Addition.txt

2014-04-28 20:42 - 2012-09-01 09:33 - 00003904 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{3B65AA3E-3538-4E66-BAF5-DFE0C0489BDC}

2014-04-28 19:35 - 2009-07-14 06:45 - 00014736 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-04-28 19:35 - 2009-07-14 06:45 - 00014736 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-04-28 19:31 - 2014-04-28 19:31 - 00001106 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-04-28 19:31 - 2014-04-28 19:31 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-04-28 19:31 - 2014-04-28 19:31 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-04-28 19:30 - 2014-04-28 19:30 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\JF\Downloads\mbam-setup-2.0.1.1004 (3).exe

2014-04-28 19:04 - 2009-07-14 11:16 - 00495372 _____ () C:\Windows\system32\perfh014.dat

2014-04-28 19:04 - 2009-07-14 11:16 - 00098248 _____ () C:\Windows\system32\perfc014.dat

2014-04-28 19:04 - 2009-07-14 07:13 - 01369758 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-04-28 18:59 - 2014-04-28 18:59 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\JF\Downloads\mbam-setup-2.0.1.1004 (2).exe

2014-04-28 18:58 - 2012-09-11 17:53 - 00000000 _____ () C:\Windows\system32\Drivers\lvuvc.hs

2014-04-28 18:57 - 2009-07-14 07:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games

2014-04-28 18:56 - 2012-09-01 09:16 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ASUS

2014-04-28 18:56 - 2012-09-01 09:16 - 00000000 ____D () C:\Program Files (x86)\ASUS

2014-04-28 18:56 - 2012-09-01 09:01 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information

2014-04-28 18:56 - 2012-09-01 04:42 - 00000000 ____D () C:\Windows\System32\Tasks\ASUS

2014-04-28 18:55 - 2012-12-09 23:16 - 00000000 ____D () C:\Users\JF\AppData\Local\Black_Tree_Gaming

2014-04-28 18:51 - 2013-09-24 16:35 - 00000000 ____D () C:\ProgramData\Package Cache

2014-04-28 18:51 - 2009-07-14 07:32 - 00000000 ____D () C:\Program Files (x86)\MSBuild

2014-04-28 18:38 - 2014-04-28 18:38 - 00277536 _____ () C:\Windows\Minidump\042814-15662-01.dmp

2014-04-28 18:32 - 2014-04-28 18:32 - 00277536 _____ () C:\Windows\Minidump\042814-15272-01.dmp

2014-04-28 18:32 - 2013-11-12 23:44 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update

2014-04-28 18:18 - 2009-07-14 06:57 - 00001547 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk

2014-04-28 17:22 - 2014-04-28 17:22 - 00000000 ____D () C:\TDSSKiller_Quarantine

2014-04-28 17:19 - 2014-04-28 17:19 - 04164448 _____ (Kaspersky Lab ZAO) C:\Users\JF\Downloads\tdsskiller (1).exe

2014-04-28 17:18 - 2014-04-28 17:18 - 00277536 _____ () C:\Windows\Minidump\042814-13072-01.dmp

2014-04-28 17:07 - 2014-04-28 17:07 - 04164448 _____ (Kaspersky Lab ZAO) C:\Users\JF\Downloads\tdsskiller.exe

2014-04-28 16:46 - 2014-04-28 16:46 - 00277536 _____ () C:\Windows\Minidump\042814-10920-01.dmp

2014-04-28 16:43 - 2014-04-28 16:43 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\JF\Downloads\mbam-setup-2.0.1.1004 (1).exe

2014-04-28 16:37 - 2014-04-28 16:37 - 00000806 _____ () C:\Users\JF\Downloads\FixExe.reg

2014-04-28 16:30 - 2014-04-28 16:30 - 01933048 _____ (Bleeping Computer, LLC) C:\Users\JF\Downloads\rkill.exe

2014-04-28 16:27 - 2014-02-01 13:50 - 00015296 _____ () C:\Windows\PFRO.log

2014-04-28 16:26 - 2014-04-28 16:20 - 00000000 ____D () C:\AdwCleaner

2014-04-28 16:25 - 2014-04-28 16:25 - 00000000 ____D () C:\SUPERDelete

2014-04-28 16:19 - 2014-04-28 16:19 - 01329501 _____ () C:\Users\JF\Downloads\AdwCleaner.exe

2014-04-28 15:40 - 2014-04-28 15:39 - 18835768 _____ (SUPERAntiSpyware) C:\Users\JF\Downloads\SUPERAntiSpyware.exe

2014-04-28 15:32 - 2014-04-28 15:32 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\JF\Downloads\mbam-setup-2.0.1.1004.exe

2014-04-28 15:27 - 2012-09-01 08:40 - 00000000 ____D () C:\Users\JF

2014-04-28 15:22 - 2014-04-28 14:58 - 00000000 ____D () C:\Sandbox

2014-04-28 15:22 - 2014-04-28 14:57 - 00000000 ____D () C:\Users\JF\Desktop\YouTube til mp3-konvertering_files

2014-04-28 15:22 - 2014-04-28 14:45 - 00000000 ____D () C:\Users\JF\AppData\Roaming\Device Doctor Pro

2014-04-28 15:22 - 2014-04-28 14:45 - 00000000 ____D () C:\Program Files (x86)\Device Doctor Pro

2014-04-28 15:22 - 2014-04-28 14:36 - 00000000 ____D () C:\Program Files (x86)\Microsoft SDKs

2014-04-28 15:22 - 2014-04-28 14:35 - 00000000 ____D () C:\Program Files\Microsoft SQL Server

2014-04-28 15:22 - 2014-04-28 14:35 - 00000000 ____D () C:\Program Files (x86)\Microsoft SQL Server

2014-04-28 15:22 - 2012-09-15 10:00 - 00000000 ____D () C:\Users\JF\AppData\Roaming\vlc

2014-04-28 15:22 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\registration

2014-04-28 14:57 - 2014-04-28 14:57 - 00012761 _____ () C:\Users\JF\Desktop\YouTube til mp3-konvertering.htm

2014-04-28 14:43 - 2014-04-28 14:43 - 00000000 ____D () C:\Program Files (x86)\NuGet

2014-04-28 14:39 - 2014-04-28 14:39 - 00000000 ____D () C:\Users\JF\Documents\Visual Studio 2013

2014-04-28 14:38 - 2014-04-28 14:38 - 00277536 _____ () C:\Windows\Minidump\042814-16036-01.dmp

2014-04-28 14:37 - 2014-04-28 14:36 - 00000000 ____D () C:\Program Files (x86)\Windows Kits

2014-04-28 14:36 - 2014-04-28 14:36 - 00000000 ____D () C:\Program Files (x86)\Microsoft Help Viewer

2014-04-28 14:35 - 2014-04-28 14:35 - 00000000 ____D () C:\Windows\SysWOW64\1033

2014-04-28 14:35 - 2014-04-28 14:35 - 00000000 ____D () C:\Windows\system32\1033

2014-04-28 14:35 - 2014-04-28 14:35 - 00000000 ____D () C:\Program Files\Microsoft SQL Server Compact Edition

2014-04-28 14:35 - 2012-12-24 00:06 - 00000000 ____D () C:\Program Files (x86)\Microsoft SQL Server Compact Edition

2014-04-28 14:32 - 2013-09-10 22:20 - 00000000 ____D () C:\Windows\pss

2014-04-28 14:26 - 2014-04-28 14:26 - 00000000 __SHD () C:\Users\JF\AppData\Local\EmieUserList

2014-04-28 14:26 - 2014-04-28 14:26 - 00000000 __SHD () C:\Users\JF\AppData\Local\EmieSiteList

2014-04-28 14:25 - 2014-04-28 14:25 - 00991928 _____ (Microsoft Corporation) C:\Users\JF\Downloads\wdksetup (1).exe

2014-04-28 14:24 - 2012-09-01 04:54 - 00052469 _____ () C:\ProgramData\Gpu.log

2014-04-28 14:23 - 2014-04-28 14:23 - 00000000 ___SD () C:\Windows\system32\CompatTel

2014-04-28 14:22 - 2014-04-28 14:22 - 01036872 _____ (Microsoft Corporation) C:\Users\JF\Downloads\wdexpress_full.exe

2014-04-28 14:22 - 2014-04-28 14:22 - 00991928 _____ (Microsoft Corporation) C:\Users\JF\Downloads\wdksetup.exe

2014-04-28 14:15 - 2012-09-02 14:36 - 00000000 ____D () C:\Users\JF\AppData\Local\Adobe

2014-04-28 14:05 - 2014-04-28 14:04 - 00277536 _____ () C:\Windows\Minidump\042814-15600-01.dmp

2014-04-27 20:52 - 2014-03-15 21:46 - 00000000 ____D () C:\Users\JF\AppData\Roaming\TS3Client

2014-04-27 11:56 - 2014-04-27 11:56 - 00277536 _____ () C:\Windows\Minidump\042714-14274-01.dmp

2014-04-27 11:54 - 2014-03-24 18:53 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-04-27 11:54 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions

2014-04-27 00:45 - 2014-04-27 00:45 - 00277536 _____ () C:\Windows\Minidump\042714-12152-01.dmp

2014-04-25 23:38 - 2012-09-01 19:02 - 00000024 _____ () C:\Users\JF\random.dat

2014-04-24 20:21 - 2012-09-01 19:02 - 00000041 _____ () C:\Users\JF\jagex_cl_runescape_LIVE.dat

2014-04-24 15:45 - 2014-04-24 15:45 - 00277536 _____ () C:\Windows\Minidump\042414-13447-01.dmp

2014-04-24 15:45 - 2014-04-24 15:45 - 00006696 ____N () C:\bootsqm.dat

2014-04-24 15:35 - 2014-04-24 15:35 - 00277536 _____ () C:\Windows\Minidump\042414-12776-01.dmp

2014-04-21 22:53 - 2013-10-14 15:30 - 00000000 ____D () C:\Users\JF\AppData\Local\Battle.net

2014-04-20 15:14 - 2014-04-20 15:14 - 00046098 _____ () C:\Users\JF\Downloads\155840.user.js

2014-04-19 22:35 - 2013-10-14 15:47 - 00000000 ____D () C:\Program Files (x86)\Hearthstone

2014-04-19 22:16 - 2012-09-01 09:18 - 00000866 _____ () C:\Users\Public\Desktop\CCleaner.lnk

2014-04-19 21:47 - 2012-09-01 04:51 - 04598224 _____ () C:\Windows\PE_Rom.dll

2014-04-19 21:39 - 2012-09-01 08:59 - 00000000 ____D () C:\Program Files (x86)\Google

2014-04-19 11:21 - 2012-09-15 10:30 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2014-04-19 11:21 - 2012-09-15 10:30 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2014-04-19 11:21 - 2012-09-15 10:30 - 00003768 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater

2014-04-19 11:15 - 2012-11-10 18:03 - 00000000 ____D () C:\Users\JF\AppData\Roaming\uTorrent

2014-04-19 11:14 - 2014-04-19 11:14 - 04787368 _____ (Piriform Ltd) C:\Users\JF\Downloads\ccsetup412.exe

2014-04-19 11:14 - 2012-09-01 09:18 - 00000000 ____D () C:\Program Files\CCleaner

2014-04-19 01:26 - 2014-04-19 01:26 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr

2014-04-19 01:26 - 2014-04-19 01:26 - 00029208 _____ () C:\Windows\system32\Drivers\aswHwid.sys

2014-04-19 01:26 - 2014-01-05 17:57 - 00085328 _____ (AVAST Software) C:\Windows\system32\Drivers\aswstm.sys

2014-04-19 01:26 - 2013-10-23 19:35 - 01039096 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys

2014-04-19 01:26 - 2013-10-23 19:35 - 00423240 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys

2014-04-19 01:26 - 2013-10-23 19:35 - 00334648 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe

2014-04-19 01:26 - 2013-10-23 19:35 - 00208416 _____ () C:\Windows\system32\Drivers\aswVmm.sys

2014-04-19 01:26 - 2013-10-23 19:35 - 00093568 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys

2014-04-19 01:26 - 2013-10-23 19:35 - 00079184 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys

2014-04-19 01:26 - 2013-10-23 19:35 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys

2014-04-19 01:26 - 2013-10-23 19:35 - 00001036 _____ () C:\Users\Public\Desktop\avast! Free Antivirus.lnk

2014-04-19 01:24 - 2013-10-17 22:30 - 00000000 ____D () C:\ProgramData\Oracle

2014-04-19 01:23 - 2014-04-19 01:23 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe

2014-04-19 01:23 - 2014-04-19 01:23 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe

2014-04-19 01:23 - 2014-04-19 01:23 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe

2014-04-19 01:23 - 2014-04-19 01:23 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll

2014-04-19 01:23 - 2014-04-19 01:23 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java

2014-04-19 01:23 - 2014-04-19 01:23 - 00000000 ____D () C:\Program Files (x86)\Java

2014-04-19 01:22 - 2014-04-19 01:22 - 00921512 _____ (Oracle Corporation) C:\Users\JF\Downloads\chromeinstall-7u55 (1).exe

2014-04-19 01:22 - 2014-04-19 01:21 - 00004001 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_55-b14.log

2014-04-19 01:21 - 2014-04-19 01:20 - 00921512 _____ (Oracle Corporation) C:\Users\JF\Downloads\chromeinstall-7u55.exe

2014-04-19 01:09 - 2014-04-19 01:09 - 00000267 _____ () C:\Users\JF\Downloads\ATT00101.htm

2014-04-19 00:43 - 2014-04-19 00:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi

2014-04-19 00:43 - 2013-10-06 15:14 - 00000447 _____ () C:\Users\Public\Desktop\LogMeIn Hamachi.lnk

2014-04-14 04:24 - 2014-04-28 14:20 - 00465408 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll

2014-04-14 04:19 - 2014-04-28 14:20 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

2014-04-11 14:42 - 2012-09-01 09:38 - 00000000 ____D () C:\ProgramData\Adobe

2014-04-11 14:42 - 2012-09-01 04:49 - 00000000 ____D () C:\Users\JF\AppData\Roaming\Adobe

2014-04-09 23:32 - 2012-09-01 09:26 - 00000000 ____D () C:\ProgramData\Microsoft Help

2014-04-09 23:31 - 2013-08-15 00:06 - 00000000 ____D () C:\Windows\system32\MRT

2014-04-09 23:30 - 2012-09-01 09:35 - 90655440 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2014-04-07 17:43 - 2014-04-07 17:43 - 00057374 _____ () C:\Users\JF\Downloads\174037.user.js

2014-04-06 12:50 - 2012-11-25 15:45 - 00000000 ____D () C:\Program Files (x86)\Opera

2014-04-03 23:33 - 2012-09-01 09:37 - 00001945 _____ () C:\Windows\epplauncher.mif

2014-04-03 23:33 - 2012-09-01 08:51 - 00002117 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk

2014-04-03 23:32 - 2012-09-01 08:51 - 00000000 ____D () C:\Program Files\Microsoft Security Client

2014-04-03 23:32 - 2012-09-01 08:51 - 00000000 ____D () C:\Program Files (x86)\Microsoft Security Client

2014-04-03 22:28 - 2012-09-01 19:49 - 00000042 _____ () C:\Users\JF\jagex_cl_runescape_LIVE1.dat

2014-04-03 09:51 - 2014-04-28 19:31 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2014-04-03 09:51 - 2014-04-28 19:31 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2014-04-03 09:50 - 2014-04-28 19:31 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

 

Files to move or delete:

====================

C:\Users\JF\AppData\Roaming\Camdata.ini

C:\Users\JF\AppData\Roaming\CamLayout.ini

C:\Users\JF\AppData\Roaming\CamShapes.ini

C:\Users\JF\jagex_cl_oldschool_LIVE.dat

C:\Users\JF\jagex_cl_runescape_LIVE.dat

C:\Users\JF\jagex_cl_runescape_LIVE1.dat

C:\Users\JF\jagex_cl_runescape_LIVE2.dat

C:\Users\JF\jagex_cl_runescape_LIVE_BETA.dat

C:\Users\JF\jagex_cl_runescape_LIVE_BETA1.dat

C:\Users\JF\random.dat

 

 

Some content of TEMP:

====================

C:\Users\JF\AppData\Local\Temp\Creative Cloud Helper.exe

C:\Users\JF\AppData\Local\Temp\CreativeCloudSet-Up.exe

C:\Users\JF\AppData\Local\Temp\qc_a402013b_7656_4f6f_b57f_5a8ef69f5fc4_32.exe

C:\Users\JF\AppData\Local\Temp\Quarantine.exe

C:\Users\JF\AppData\Local\Temp\SkypeSetup.exe

 

 

==================== Bamital & volsnap Check =================

 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe

[2012-09-01 09:34] - [2012-09-01 04:48] - 2871808 ____A (Microsoft Corporation) 65DE61A95D4F5CD4E7ED63EC6344CBF0

 

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\rpcss.dll => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

 

 

LastRegBack: 2013-05-04 11:35

 

==================== End Of Log ============================

Link to post
Share on other sites

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 27-04-2014

Ran by JF at 2014-04-29 15:34:39

Running from C:\Users\JF\Desktop\New folder (2)

Boot Mode: Normal

==========================================================

 

 

==================== Security Center ========================

 

AV: Microsoft Security Essentials (Enabled - Up to date) {641105E6-77ED-3F35-A304-765193BCB75F}

AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}

AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

AS: Microsoft Security Essentials (Enabled - Up to date) {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}

 

==================== Installed Programs ======================

 

Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 4.0.0.1390 - Adobe Systems Incorporated)

Adobe AIR (x32 Version: 4.0.0.1390 - Adobe Systems Incorporated) Hidden

Adobe Creative Cloud (HKLM-x32\...\Adobe Creative Cloud) (Version: 2.4.1.351 - Adobe Systems Incorporated)

Adobe Flash Player 13 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 13.0.0.182 - Adobe Systems Incorporated)

Adobe Flash Player 13 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 13.0.0.182 - Adobe Systems Incorporated)

Adobe Photoshop CC (HKLM-x32\...\{2D99B50E-431D-4AA8-85C1-172A6F8BCF09}) (Version: 14.0 - Adobe Systems Incorporated)

Adobe Reader X (10.1.9) - Norsk (HKLM-x32\...\{AC76BA86-7AD7-1044-7B44-AA1000000001}) (Version: 10.1.9 - Adobe Systems Incorporated)

AI Suite II (HKLM-x32\...\{34D3688E-A737-44C5-9E2A-FF73618728E1}) (Version: 1.02.29 - ASUSTeK Computer Inc.)

AMD Accelerated Video Transcoding (Version: 13.15.100.30830 - Advanced Micro Devices, Inc.) Hidden

AMD APP SDK Runtime (Version: 10.0.1016.4 - Advanced Micro Devices Inc.) Hidden

AMD Catalyst Control Center (x32 Version: 2013.0830.1944.33589 - Firmanavn) Hidden

AMD Catalyst Install Manager (HKLM\...\{13351E83-6DCD-4E97-2A8C-5D496259A47F}) (Version: 8.0.915.0 - Advanced Micro Devices, Inc.)

AMD Drag and Drop Transcoding (Version: 2.00.0000 - Advanced Micro Devices, Inc.) Hidden

AMD Media Foundation Decoders (Version: 1.0.80830.1925 - Advanced Micro Devices, Inc.) Hidden

Amnesia: The Dark Descent (HKLM-x32\...\Steam App 57300) (Version:  - )

ASIO4ALL (HKLM-x32\...\ASIO4ALL) (Version: 2.10 - Michael Tippach)

Asmedia ASM104x USB 3.0 Host Controller Driver (HKLM-x32\...\{E4FB0B39-C991-4EE7-95DD-1A1A7857D33D}) (Version: 1.14.3.0 - Asmedia Technology)

Asmedia ASM106x SATA Host Controller Driver (HKLM-x32\...\{61942EF5-2CD8-47D4-869C-2E9A8BB085F1}) (Version: 1.3.4.000 - Asmedia Technology)

ASUS UEFI (HKLM-x32\...\InstallShield_{926C75FA-31A5-45B9-A26D-33EF1097D569}) (Version: 1.1.1.0 - ASUSTek COMPUTER INC.)

ASUS UEFI (x32 Version: 1.1.1.0 - ASUSTek COMPUTER INC.) Hidden

ASUS Utility (x32 Version: 1.00.0000 - ASUSTek) Hidden

ASUS VGA Driver (x32 Version: 3.0.0.1 - ASUSTek) Hidden

ASUS_ROG_THEME (HKLM-x32\...\ASUS_ROG_THEME) (Version: 1.00.14 - ASUSTeK Computer Inc.)

Auto Clicker v1.3 (HKLM-x32\...\{C0A7E4F3-82CC-416B-82C6-BA06AACFD635}_is1) (Version: 1.3 - MurGee.com)

Avadon: The Black Fortress (HKLM-x32\...\Steam App 112100) (Version:  - )

avast! Free Antivirus (HKLM-x32\...\Avast) (Version: 9.0.2018 - Avast Software)

Bastion (HKLM-x32\...\Steam App 107100) (Version:  - Supergiant Games)

Battle.net (HKLM-x32\...\Battle.net) (Version:  - Blizzard Entertainment)

BIT.TRIP RUNNER (HKLM-x32\...\Steam App 63710) (Version:  - Gaijin Games)

Borderlands (HKLM-x32\...\Steam App 8980) (Version:  - Gearbox Software)

BOSS (HKLM-x32\...\BOSS) (Version: 2.1.1 - BOSS Development Team)

Braid (HKLM-x32\...\Steam App 26800) (Version:  - Number None, Inc.)

Call of Duty: Modern Warfare 2 - Multiplayer (HKLM-x32\...\Steam App 10190) (Version:  - Infinity Ward)

Camersoft Webcam Recorder 3.1.08 (HKLM-x32\...\Camersoft Webcam Recorder_is1) (Version:  - Camersoft Studio)

Catalyst Control Center - Branding (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden

Catalyst Control Center Graphics Previews Common (x32 Version: 2013.0830.1944.33589 - Advanced Micro Devices, Inc.) Hidden

Catalyst Control Center InstallProxy (x32 Version: 2013.0830.1944.33589 - Advanced Micro Devices, Inc.) Hidden

Catalyst Control Center Localization All (x32 Version: 2013.0830.1944.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Chinese Standard (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Chinese Traditional (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Czech (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Danish (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Dutch (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help English (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Finnish (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help French (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help German (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Greek (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Hungarian (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Italian (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Japanese (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Korean (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Norwegian (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Polish (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Portuguese (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Russian (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Spanish (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Swedish (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Thai (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

CCC Help Turkish (x32 Version: 2013.0830.1943.33589 - Advanced Micro Devices, Inc.) Hidden

ccc-utility64 (Version: 2013.0830.1944.33589 - Advanced Micro Devices, Inc.) Hidden

CCleaner (HKLM\...\CCleaner) (Version: 4.12 - Piriform)

Closure (HKLM-x32\...\Steam App 72000) (Version:  - )

Cockatrice (HKLM-x32\...\Cockatrice) (Version:  - )

Cogs (HKLM-x32\...\Steam App 26500) (Version:  - Lazy 8 Studios)

Counter-Strike (HKLM-x32\...\Steam App 10) (Version:  - Valve)

Counter-Strike: Condition Zero (HKLM-x32\...\Steam App 80) (Version:  - Valve)

Counter-Strike: Global Offensive (HKLM-x32\...\Steam App 730) (Version:  - Valve)

Counter-Strike: Source (HKLM-x32\...\Steam App 240) (Version:  - Valve)

CPUID ROG CPU-Z 1.59.2 (HKLM\...\CPUID ROG CPU-Z_is1) (Version: 1.59.2 - CPUID, Inc.)

Creative Karaoke Player (HKLM-x32\...\CREATIVE KARAOKE PLAYER) (Version: 2.11 - Creative Technology Limited)

CyberLink PowerDVD 10 (HKLM-x32\...\InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}) (Version: 10.0.2701.51 - CyberLink Corp.)

CyberLink PowerDVD 10 (x32 Version: 10.0.2701.51 - CyberLink Corp.) Hidden

D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden

Dead Island (HKLM-x32\...\Steam App 91310) (Version:  - Techland)

Deponia (HKLM-x32\...\Steam App 214340) (Version:  - Daedalic Entertainment)

Dishonored (HKLM-x32\...\Steam App 205100) (Version: 1.0 - Bethesda Softworks)

Dota 2 (HKLM-x32\...\Steam App 570) (Version:  - Valve)

Dropbox (HKCU\...\Dropbox) (Version: 2.4.11 - Dropbox, Inc.)

Dungeon Defenders (HKLM-x32\...\Steam App 65800) (Version:  - )

Dustforce (HKLM-x32\...\Steam App 65300) (Version:  - )

Dwarfs!? (HKLM-x32\...\Steam App 35480) (Version:  - Power of 2)

Dynamite Jack (HKLM-x32\...\Steam App 202730) (Version:  - Hassey Enterprises, Inc.)

FEZ (HKLM-x32\...\Steam App 224760) (Version:  - Polytron Corporation)

FileZilla Client 3.7.3 (HKCU\...\FileZilla Client) (Version: 3.7.3 - Tim Kosse)

Fotogalleri (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden

Free to Play (HKLM-x32\...\Steam App 245550) (Version:  - Valve)

Game Dev Tycoon (HKLM-x32\...\Steam App 239820) (Version:  - Greenheart Games)

Google Chrome (HKLM-x32\...\Google Chrome) (Version: 34.0.1847.131 - Google Inc.)

Google Earth Plug-in (HKLM-x32\...\{4AB54F11-2F8C-11E3-B09F-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)

Google Toolbar for Internet Explorer (HKLM-x32\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.5111.1712 - Google Inc.)

Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden

Google Update Helper (x32 Version: 1.3.23.9 - Google Inc.) Hidden

Hearthstone (HKLM-x32\...\Hearthstone) (Version:  - Blizzard Entertainment)

Hi-Rez Studios Authenticate and Update Service (HKLM-x32\...\{3C87E0FF-BC0A-4F5E-951B-68DC3F8DF1FC}) (Version: 3.0.0.0 - Hi-Rez Studios)

HydraVision (x32 Version: 4.2.252.0 - Advanced Micro Devices, Inc.) Hidden

IL Download Manager (HKLM-x32\...\IL Download Manager) (Version:  - Image-Line)

Indie Game: The Movie (HKLM-x32\...\Steam App 207080) (Version:  - BlinkWorks Media)

Intel® Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)

Intel® Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.0.2.1410 - Intel Corporation)

Intel® Network Connections 16.6.126.0 (HKLM\...\PROSetDX) (Version: 16.6.126.0 - Intel)

Intel® Network Connections 16.6.126.0 (Version: 16.6.126.0 - Intel) Hidden

Intel® Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.1.0.1006 - Intel Corporation)

Intel® USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 1.0.1.209 - Intel Corporation)

Intel® Trusted Connect Service Client (HKLM\...\{09536BA1-E498-4CC3-B834-D884A67D7E34}) (Version: 1.23.605.1 - Intel Corporation)

Intel® Watchdog Timer Driver (Intel® WDT) (HKLM-x32\...\{3FD0C489-0F02-481a-A3E1-9754CD396761}) (Version:  - Intel Corporation)

Java 7 Update 55 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217055FF}) (Version: 7.0.550 - Oracle)

Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden

League of Legends (HKLM-x32\...\{92606477-9366-4D3B-8AE3-6BE4B29727AB}) (Version: 1.3 - Riot Games)

Logitech Gaming Software (Version: 8.40.83 - Logitech Inc.) Hidden

LogMeIn Hamachi (HKLM-x32\...\LogMeIn Hamachi) (Version: 2.2.0.188 - LogMeIn, Inc.)

LogMeIn Hamachi (x32 Version: 2.2.0.188 - LogMeIn, Inc.) Hidden

Magic 2014  (HKLM-x32\...\Steam App 213850) (Version:  - Stainless Games)

Malwarebytes Anti-Malware version 2.0.1.1004 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.1.1004 - Malwarebytes Corporation)

Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft .NET Framework 4.5.1 (NOR) (Version: 4.5.50938 - Microsoft Corporation) Hidden

Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden

Microsoft .NET Framework 4.5.1, norsk språkpakke (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1044) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft Antimalware Service NB-NO Language Pack (Version: 3.0.8107.0 - Microsoft Corporation) Hidden

Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden

Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)

Microsoft Office 2007 Service Pack 3 (SP3) (x32 Version:  - Microsoft) Hidden

Microsoft Office Access MUI (Norwegian (Bokmål)) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Enterprise 2007 (HKLM-x32\...\ENTERPRISE) (Version: 12.0.6612.1000 - Microsoft Corporation)

Microsoft Office Enterprise 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Excel 2007 Help Oppdatering (KB963678) (HKLM-x32\...\{90120000-0016-0414-0000-0000000FF1CE}_ENTERPRISE_{786F200B-1F70-4B66-BBB3-29CFF7C425D7}) (Version:  - Microsoft)

Microsoft Office Excel MUI (Norwegian (Bokmål)) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)

Microsoft Office Groove MUI (Norwegian (Bokmål)) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office InfoPath MUI (Norwegian (Bokmål)) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office OneNote MUI (Norwegian (Bokmål)) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Outlook MUI (Norwegian (Bokmål)) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Powerpoint 2007 Help Oppdatering (KB963669) (HKLM-x32\...\{90120000-0018-0414-0000-0000000FF1CE}_ENTERPRISE_{5511F835-0C39-4158-A689-34997E3F28AD}) (Version:  - Microsoft)

Microsoft Office PowerPoint MUI (Norwegian (Bokmål)) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Proof (Norwegian (Bokmål)) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Proof (Norwegian (Nynorsk)) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Proofing (Norwegian (Bokmål)) 2007 (x32 Version: 12.0.4518.1022 - Microsoft Corporation) Hidden

Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32 Version:  - Microsoft) Hidden

Microsoft Office Publisher MUI (Norwegian (Bokmål)) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Shared 64-bit MUI (Norwegian (Bokmål)) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Shared MUI (Norwegian (Bokmål)) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Word 2007 Help Oppdatering (KB963665) (HKLM-x32\...\{90120000-001B-0414-0000-0000000FF1CE}_ENTERPRISE_{ED32C952-462A-4787-8AC1-CE455D7A816F}) (Version:  - Microsoft)

Microsoft Office Word MUI (Norwegian (Bokmål)) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Security Client (Version: 4.5.0216.0 - Microsoft Corporation) Hidden

Microsoft Security Client NB-NO Language Pack (Version: 2.0.0657.0 - Microsoft Corporation) Hidden

Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.5.216.0 - Microsoft Corporation)

Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)

Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)

Microsoft SQL Server 2012 Command Line Utilities  (HKLM\...\{58FED865-4F13-408D-A5BF-996019C4B936}) (Version: 11.1.3000.0 - Microsoft Corporation)

Microsoft SQL Server 2012 Native Client  (HKLM\...\{D411E9C9-CE62-4DBF-9D92-4CB22B750ED5}) (Version: 11.1.3000.0 - Microsoft Corporation)

Microsoft SQL Server 2012 Transact-SQL ScriptDom  (HKLM\...\{54C5041B-0E91-4E92-8417-AAA12493C790}) (Version: 11.1.3000.0 - Microsoft Corporation)

Microsoft SQL Server 2012 T-SQL Language Service  (HKLM-x32\...\{04DD7AF4-A6D3-4E30-9BB9-3B3670719234}) (Version: 11.1.3000.0 - Microsoft Corporation)

Microsoft SQL Server Compact 4.0 SP1 x64 ENU (HKLM\...\{78909610-D229-459C-A936-25D92283D3FD}) (Version: 4.0.8876.1 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\...\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)

Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.50727 (Version: 11.0.50727 - Microsoft Corporation) Hidden

Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.50727 (Version: 11.0.50727 - Microsoft Corporation) Hidden

Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.50727 (x32 Version: 11.0.50727 - Microsoft Corporation) Hidden

Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.50727 (x32 Version: 11.0.50727 - Microsoft Corporation) Hidden

Microsoft WSE 3.0 Runtime (HKLM-x32\...\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}) (Version: 3.0.5305.0 - Microsoft Corp.)

Microsoft XNA Framework Redistributable 3.1 (HKLM-x32\...\{19BFDA5D-1FE2-4F25-97F9-1A79DD04EE20}) (Version: 3.1.10527.0 - Microsoft Corporation)

Microsoft_VC80_CRT_x86 (x32 Version: 8.0.50727.4053 - Adobe) Hidden

Microsoft_VC90_CRT_x86 (x32 Version: 1.00.0000 - Adobe) Hidden

Movie Maker (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden

MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden

MSVCRT Redists (Version: 1.0 - Sony Creative Software Inc.) Hidden

MSVCRT110 (x32 Version: 16.4.1108.0727 - Microsoft) Hidden

MSVCRT110_amd64 (Version: 16.4.1109.0912 - Microsoft) Hidden

MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)

MyFreeCodec (HKCU\...\MyFreeCodec) (Version:  - )

Nero Backup Drivers (HKLM\...\{D600D357-5CB9-4DE9-8FD4-14E208BD1970}) (Version: 1.0.10000.1.0 - Nero AG)

Notepad++ (HKLM-x32\...\Notepad++) (Version: 6.3 - )

Oil Rush (HKLM-x32\...\Steam App 200390) (Version:  - Unigine Corp.)

OpenAL (HKLM-x32\...\OpenAL) (Version:  - )

Opera 12.16 (HKLM-x32\...\Opera 12.16.1860) (Version: 12.16.1860 - Opera Software ASA)

Opera Stable 20.0.1387.91 (HKLM-x32\...\Opera 20.0.1387.91) (Version: 20.0.1387.91 - Opera Software ASA)

Orcs Must Die! 2 (HKLM-x32\...\Steam App 201790) (Version:  - Robot Entertainment)

Origin (HKLM-x32\...\Origin) (Version: 9.2.1.4399 - Electronic Arts, Inc.)

PCSX2 - Playstation 2 Emulator (HKLM-x32\...\pcsx2-r5350) (Version:  - )

PDF Settings CC (x32 Version: 12.0 - Adobe Systems Incorporated) Hidden

Photo Common (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden

Photo Gallery (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden

RAGE (HKLM-x32\...\Steam App 9200) (Version:  - id Software)

Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6570 - Realtek Semiconductor Corp.)

ROBLOX Player (HKLM-x32\...\{373B1718-8CC5-4567-8EE2-9033AD08A680}) (Version:  - ROBLOX Corporation)

ROG GameFirst v4.53 (HKLM\...\ROG GameFirst) (Version: 4.53 - cFos Software GmbH, Bonn)

rust. (HKLM-x32\...\Steam App 252490) (Version:  - )

Saints Row IV (HKLM-x32\...\Steam App 206420) (Version:  - Deep Silver Volition)

Samsung Kies (HKLM-x32\...\InstallShield_{758C8301-2696-4855-AF45-534B1200980A}) (Version: 2.5.0.12094_28 - Samsung Electronics Co., Ltd.)

Samsung Kies (x32 Version: 2.5.0.12094_28 - Samsung Electronics Co., Ltd.) Hidden

Samsung Story Album Viewer (HKLM-x32\...\InstallShield_{698BBAD8-B116-495D-B879-0F07A533E57F}) (Version: 1.0.0.13052_1 - Samsung Electronics Co., Ltd.)

Samsung Story Album Viewer (x32 Version: 1.0.0.13052_1 - Samsung Electronics Co., Ltd.) Hidden

SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.22.0 - SAMSUNG Electronics Co., Ltd.)

SimCity 4 (HKLM-x32\...\{01339AE5-04D4-43F8-008E-13AD788DC4F7}) (Version:  - )

SimCity™ (HKLM-x32\...\{F70FDE4B-8F86-4eb6-8C8E-636EC89F6419}) (Version: 1.0.0.0 - Electronic Arts)

Skype™ 6.14 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.14.104 - Skype Technologies S.A.)

Smite (HKLM-x32\...\{3C87E0FF-BC0A-4F5E-951B-68DC3F8DF017}) (Version: 0.1.1557.1 - Hi-Rez Studios)

Sound Blaster X-Fi MB 2 (HKLM-x32\...\{89F922D6-E3E0-4303-AF8E-CE18412E3A18}) (Version: 1.0 - Creative Technology Limited)

Spotify (HKCU\...\Spotify) (Version: 0.9.8.296.g91f68827 - Spotify AB)

Starbound (HKLM-x32\...\Steam App 211820) (Version:  - )

StarCraft II (HKLM-x32\...\StarCraft II) (Version:  - Blizzard Entertainment)

Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)

Surgeon Simulator 2013 (HKLM-x32\...\Steam App 233720) (Version:  - Bossa Studios)

Synthesia (HKLM-x32\...\Synthesia) (Version: 8.5 - Synthesia LLC)

System Requirements Lab CYRI (HKLM-x32\...\{F3FCB08B-E752-444D-86A0-0634A4F3B23D}) (Version: 6.0.8.0 - Husdawg, LLC)

Team Fortress 2 (HKLM-x32\...\Steam App 440) (Version:  - Valve)

TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.14 - TeamSpeak Systems GmbH)

TeamViewer 8 (HKLM-x32\...\TeamViewer 8) (Version: 8.0.20202 - TeamViewer)

The Binding of Isaac (HKLM-x32\...\Steam App 113200) (Version:  - )

The Elder Scrolls V: Skyrim (HKLM-x32\...\Steam App 72850) (Version:  - Bethesda Game Studios)

The Sims™ 3 (HKLM-x32\...\{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}) (Version: 1.0.631 - Electronic Arts)

Under the Ocean (HKLM-x32\...\Steam App 227720) (Version:  - )

Unigine Valley Benchmark version 1.0 (HKLM-x32\...\Unigine Valley Benchmark_is1) (Version: 1.0 - Unigine Corp.)

Unity Web Player (HKCU\...\UnityWebPlayer) (Version:  - Unity Technologies ApS)

Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)

Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version:  - Microsoft)

Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6FAA03BD-2B51-4029-9AD9-64A3B8E3C84C}) (Version:  - Microsoft)

Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{90120000-002A-0000-1000-0000000FF1CE}_ENTERPRISE_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version:  - Microsoft)

Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version:  - Microsoft)

Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{E9A82945-BA29-4EE8-8F2A-2F49545E9CF2}) (Version:  - Microsoft)

Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (HKLM-x32\...\{90120000-001A-0414-0000-0000000FF1CE}_ENTERPRISE_{4E5A0B6D-173C-4DFF-BB4C-55841AD16161}) (Version:  - Microsoft)

Update for Microsoft Office Outlook 2007 (KB2863811) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{53DEC068-4690-4F6B-9946-7D21EF02236B}) (Version:  - Microsoft)

Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2878297) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{9B1DEEA3-B4ED-49F0-9EF7-4A820EEEA7F1}) (Version:  - Microsoft)

VLC media player 2.1.2 (HKLM-x32\...\VLC media player) (Version: 2.1.2 - VideoLAN)

Warcraft III (HKLM-x32\...\Warcraft III) (Version:  - Blizzard Entertainment)

Windows Live Communications Platform (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden

Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3505.0912 - Microsoft Corporation)

Windows Live Essentials (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden

Windows Live ID Sign-in Assistant (Version: 7.250.4311.0 - Microsoft Corporation) Hidden

Windows Live Installer (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden

Windows Live Photo Common (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden

Windows Live PIMT Platform (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden

Windows Live SOXE (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden

Windows Live SOXE Definitions (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden

Windows Live UX Platform (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden

Windows Live UX Platform Language Pack (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden

Windows Software Development Kit for Windows Store Apps DirectX x86 Remote (x32 Version: 8.100.25984 - Microsoft Corporation) Hidden

WinRAR 5.01 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.01.0 - win.rar GmbH)

World of Warcraft (HKLM-x32\...\World of Warcraft) (Version:  - Blizzard Entertainment)

Xiph.Org Open Codecs 0.85.17777 (HKLM-x32\...\Open Codecs) (Version: 0.85.17777 - Xiph.Org)

Yamaha USB-MIDI Driver (HKLM-x32\...\InstallShield_{18369253-E53F-4A47-818E-082DFB950872}) (Version: 3.1.2.3 - Yamaha Corporation)

Yamaha USB-MIDI Driver (Version: 3.1.2.3 - Yamaha Corporation) Hidden

 

==================== Restore Points  =========================

 

28-04-2014 16:49:16 Microsoft Visual Studio Express 2013 for Windows Desktop - ENU

28-04-2014 16:53:17 Configured GPUTweakStreaming

28-04-2014 16:53:45 Removed Apple Mobile Device Support

28-04-2014 16:54:03 Removed Apple-programsupport

28-04-2014 16:55:25 Removed Bonjour

28-04-2014 16:55:55 Configured ASUS GPU Tweak

28-04-2014 16:56:27 Removed ASUS ROG Connect

28-04-2014 16:56:46 Removed ASUS ROG Connect Plus

 

==================== Hosts content: ==========================

 

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

 

==================== Scheduled Tasks (whitelisted) =============

 

Task: {0351274A-7DA0-4C34-BF46-39EDD42CA9A0} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-04-19] (Adobe Systems Incorporated)

Task: {06583EE8-FCA7-4200-A24F-18BE04191558} - System32\Tasks\ASUS\ASUS AI Suite II Execute => C:\Program Files (x86)\ASUS\AI Suite II\AsRoutineController.exe [2010-11-26] (ASUSTeK Computer Inc.)

Task: {06D9DE59-2667-429E-80A4-CC2E5AFE0D30} - System32\Tasks\ASUS\ASUS DigiPowerControl Help => C:\Program Files (x86)\ASUS\AI Suite II\DIGI+ Power Control\PowerControlHelp.exe [2012-02-29] (ASUSTeK Computer Inc.)

Task: {41227F3C-4074-4B6C-9678-C0E4237A7F31} - System32\Tasks\AdobeAAMUpdater-1.0-JF-PC-JF => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2013-12-10] (Adobe Systems Incorporated)

Task: {48351FB6-70FA-443F-86AF-EE5F81C3336E} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-03-18] (Piriform Ltd)

Task: {486D715E-6AA2-44CF-BC48-B6990CBB53C6} - \Microsoft\Windows\Shell\WindowsParentalControlsMigration No Task File <==== ATTENTION

Task: {5B42DD9C-5A26-4F27-BB95-34603F0997E5} - \Microsoft\Windows\Shell\WindowsParentalControls No Task File <==== ATTENTION

Task: {5D5547AD-68F6-4CF9-A661-73863CA84F0B} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-09-01] (Google Inc.)

Task: {6AD59CB5-931E-4A70-A2A9-1250DF55D2D5} - System32\Tasks\{C901FD8D-2023-4EB2-AC1C-BBFE2C1B947B} => Iexplore.exe http://www.skype.com/go/downloading?source=lightinstaller&ver=5.10.0.116.259&LastError=12007

Task: {71432CCD-4ED8-4B03-9BB6-48BD5F1D6E28} - \Microsoft\Windows\MUI\Mcbuilder No Task File <==== ATTENTION

Task: {CA4B8FF2-A4D2-4D88-A52E-3A5BDAF7F56E} - \Microsoft\Windows\Registry\RegIdleBackup No Task File <==== ATTENTION

Task: {CB3D64BF-C0C9-45FF-BFB0-FF1A8F680186} - \Microsoft\Windows\RemoteAssistance\RemoteAssistanceTask No Task File <==== ATTENTION

Task: {CEE64558-E1A7-4D9D-80A7-2001912BE5B5} - \Microsoft\Windows\MemoryDiagnostic\CorruptionDetector No Task File <==== ATTENTION

Task: {D6B83C1E-74EE-4096-B08E-8038F91A0528} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-09-01] (Google Inc.)

Task: {DB972230-E1EB-4A46-B4BD-2118D234FEC3} - System32\Tasks\ASUS\USB 3.0 Boost Service => C:\Program Files (x86)\ASUS\AI Suite II\USB 3.0 Boost\U3BoostSvr.exe [2011-09-09] ()

Task: {EB02381F-D652-4B1C-894A-712498C62C51} - \Microsoft\Windows\MUI\LPRemove No Task File <==== ATTENTION

Task: {FA2BC0A6-8D4B-458A-85C8-2B8C72487513} - \Microsoft\Windows\MemoryDiagnostic\DecompressionFailureDetector No Task File <==== ATTENTION

Task: {FAF4C216-7CC9-430A-8928-D4D38D84D671} - System32\Tasks\avast! Emergency Update => d:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2014-04-19] (AVAST Software)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\User_Feed_Synchronization-{3B65AA3E-3538-4E66-BAF5-DFE0C0489BDC}.job => C:\Windows\system32\msfeedssync.exe

 

==================== Loaded Modules (whitelisted) =============

 

2014-02-11 04:21 - 2014-02-11 04:21 - 00644464 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync_x64.dll

2010-01-02 16:42 - 2010-01-02 16:42 - 00098304 _____ () D:\Program Files (x86)\FileZilla FTP Client\fzshellext_64.dll

2011-10-29 03:59 - 2011-10-29 03:59 - 00918448 ____R () C:\Program Files (x86)\ASUS\AXSP\1.00.18\atkexComSvc.exe

2013-09-23 16:10 - 2014-04-10 16:37 - 00602680 _____ () C:\Users\JF\AppData\Roaming\Spotify\Data\SpotifyHelper.exe

2014-04-28 22:20 - 2014-04-28 22:20 - 02252800 _____ () d:\Program Files\AVAST Software\Avast\defs\14042801\algo.dll

2012-09-01 04:41 - 2014-04-29 15:32 - 00039936 _____ () C:\Program Files (x86)\ASUS\AXSP\1.00.18\PEbiosinterface32.dll

2012-09-01 04:41 - 2010-06-29 04:58 - 00104448 ____R () C:\Program Files (x86)\ASUS\AXSP\1.00.18\ATKEX.dll

2012-09-01 04:44 - 2011-12-28 19:13 - 00043520 ____N () C:\Program Files (x86)\ASUS\AI Suite II\TurboV EVO\HookKey32.dll

2012-09-01 04:44 - 2011-09-07 23:23 - 00253952 _____ () C:\Program Files (x86)\ASUS\AI Suite II\TurboV EVO\pngio.dll

2014-01-10 23:29 - 2014-04-22 00:55 - 00340480 _____ () D:\Steam\libavresample-1.dll

2014-04-08 20:14 - 2014-04-22 00:55 - 00471552 _____ () D:\Steam\libavutil-53.dll

2013-03-12 18:10 - 2014-04-01 00:09 - 00754688 _____ () D:\Steam\SDL2.dll

2012-09-01 14:50 - 2014-04-24 00:01 - 01092288 _____ () D:\Steam\bin\chromehtml.DLL

2012-09-01 14:50 - 2014-03-03 21:15 - 20626624 _____ () D:\Steam\bin\libcef.dll

2012-09-01 14:50 - 2013-06-15 01:49 - 01100800 _____ () D:\Steam\bin\avcodec-53.dll

2012-09-01 14:50 - 2013-06-15 01:49 - 00124416 _____ () D:\Steam\bin\avutil-51.dll

2012-09-01 14:50 - 2013-06-15 01:49 - 00192000 _____ () D:\Steam\bin\avformat-53.dll

2012-09-01 04:42 - 2011-07-12 19:14 - 00147456 _____ () C:\Program Files (x86)\ASUS\AI Suite II\AssistFunc.dll

2012-09-01 04:42 - 2010-10-05 08:22 - 00253952 _____ () C:\Program Files (x86)\ASUS\AI Suite II\pngio.dll

2012-09-01 04:42 - 2011-09-26 19:36 - 00869376 _____ () C:\Program Files (x86)\ASUS\AI Suite II\AI Charger+\AIChargerPlus.dll

2012-09-01 04:42 - 2011-09-20 18:11 - 00985600 _____ () C:\Program Files (x86)\ASUS\AI Suite II\BarGadget\BarGadget.dll

2012-09-01 04:43 - 2012-03-01 14:20 - 01296384 _____ () C:\Program Files (x86)\ASUS\AI Suite II\MyLogo\MyLogo.dll

2012-09-01 04:43 - 2012-02-10 11:29 - 01047040 _____ () C:\Program Files (x86)\ASUS\AI Suite II\Probe_II\ProbeII.dll

2012-09-01 04:42 - 2012-02-13 09:53 - 00883712 _____ () C:\Program Files (x86)\ASUS\AI Suite II\Sensor\Sensor.dll

2012-09-01 04:42 - 2011-09-26 18:37 - 01616384 _____ () C:\Program Files (x86)\ASUS\AI Suite II\Sensor Graph\SensorGraph.dll

2012-09-01 04:42 - 2011-09-19 20:18 - 01243136 _____ () C:\Program Files (x86)\ASUS\AI Suite II\Settings\Settings.dll

2012-09-01 04:42 - 2011-07-21 09:06 - 00846848 _____ () C:\Program Files (x86)\ASUS\AI Suite II\Splitter\Splitter.dll

2012-09-01 04:42 - 2011-10-14 20:03 - 00885248 _____ () C:\Program Files (x86)\ASUS\AI Suite II\TabGadget\TabGadget.dll

2012-09-01 04:42 - 2010-08-23 04:17 - 00662016 ____R () C:\Program Files (x86)\ASUS\AAHM\1.00.20\aaHMLib.dll

2012-09-01 04:42 - 2010-10-05 08:22 - 00208896 _____ () C:\Program Files (x86)\ASUS\AI Suite II\ImageHelper.dll

2012-09-01 04:42 - 2009-08-12 20:15 - 00253952 _____ () C:\Program Files (x86)\ASUS\AI Suite II\Sensor\AlertHelper\pngio.dll

2012-09-01 18:21 - 2014-04-10 16:37 - 36966968 _____ () C:\Users\JF\AppData\Roaming\Spotify\Data\libcef.dll

2013-10-19 01:55 - 2013-10-19 01:55 - 25100288 _____ () C:\Users\JF\AppData\Roaming\Dropbox\bin\libcef.dll

2014-04-26 18:33 - 2014-04-24 02:33 - 00065352 _____ () C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.131\chrome_elf.dll

2013-08-07 21:25 - 2013-08-07 21:25 - 00093696 _____ () D:\Program Files (x86)\FileZilla FTP Client\fzshellext.dll

2012-09-01 09:04 - 2009-12-29 16:50 - 00073728 _____ () C:\Windows\SysWOW64\CmdRtr.DLL

2012-09-01 09:04 - 2010-06-08 13:22 - 00181760 _____ () C:\Windows\SysWOW64\APOMngr.DLL

2014-04-26 18:33 - 2014-04-24 02:33 - 00674632 _____ () C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.131\libglesv2.dll

2014-04-26 18:33 - 2014-04-24 02:33 - 00093000 _____ () C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.131\libegl.dll

2013-10-23 19:35 - 2013-10-23 19:35 - 19336120 _____ () D:\Program Files\AVAST Software\Avast\libcef.dll

2014-04-26 18:33 - 2014-04-24 02:33 - 04081480 _____ () C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.131\pdf.dll

2014-04-26 18:33 - 2014-04-24 02:33 - 00390472 _____ () C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.131\ppGoogleNaClPluginChrome.dll

2014-04-26 18:33 - 2014-04-24 02:33 - 01647432 _____ () C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.131\ffmpegsumo.dll

2013-09-23 16:10 - 2014-04-10 16:37 - 00886840 _____ () C:\Users\JF\AppData\Roaming\Spotify\Data\libglesv2.dll

2013-09-23 16:10 - 2014-04-10 16:37 - 00108600 _____ () C:\Users\JF\AppData\Roaming\Spotify\Data\libegl.dll

2014-02-19 18:39 - 2014-02-19 18:39 - 00172032 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\00a0b4a9df6e4abf30ae2af3624a77ce\IsdiInterop.ni.dll

2012-09-01 09:06 - 2012-02-01 16:25 - 00059904 _____ () C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IsdiInterop.dll

2012-09-01 09:02 - 2012-02-07 17:39 - 01198872 _____ () C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\ACE.dll

2014-04-26 18:33 - 2014-04-24 02:33 - 13692232 _____ () C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.131\PepperFlash\pepflashplayer.dll

 

==================== Alternate Data Streams (whitelisted) =========

 

AlternateDataStreams: C:\ProgramData\Temp:DED17083

AlternateDataStreams: C:\ProgramData\Temp:DFC5A2B2

 

==================== Safe Mode (whitelisted) ===================

 

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\74926767.sys => ""="Driver"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\74926767.sys => ""="Driver"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Hamachi2Svc => ""="Service"

 

==================== Disabled items from MSCONFIG ==============

 

MSCONFIG\startupfolder: C:^Users^JF^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper og Launcher.lnk => C:\Windows\pss\OneNote 2007 Screen Clipper og Launcher.lnk.Startup

MSCONFIG\startupreg: Adobe Creative Cloud => "C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe" --showwindow=false --onOSstartup=true

MSCONFIG\startupreg: AdobeAAMUpdater-1.0 => "C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"

MSCONFIG\startupreg: APSDaemon => "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"

MSCONFIG\startupreg: GPU TweakIt Server Execute => "C:\Program Files (x86)\ASUS\ASUS ROG Connect Plus\GPU TweakIt Server\GPUTweakit.exe"

MSCONFIG\startupreg: KiesAirMessage => D:\Kies\KiesAirMessage.exe -startup

MSCONFIG\startupreg: KiesPreload => D:\Kies\Kies.exe /preload

MSCONFIG\startupreg: KiesTrayAgent => D:\Kies\KiesTrayAgent.exe

MSCONFIG\startupreg: MurGee.com Auto Clicker => C:\ProgramData\Auto Clicker\AutoClicker.exe :silent

MSCONFIG\startupreg: swg => "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

 

==================== Faulty Device Manager Devices =============

 

Name: Logitech Mic (QuickCam E3500)

Description: Logitech Mic (QuickCam E3500)

Class Guid: {4d36e96c-e325-11ce-bfc1-08002be10318}

Manufacturer: Logitech

Service: usbaudio

Problem: : This device is disabled. (Code 22)

Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

 

 

==================== Event log errors: =========================

 

Application errors:

==================

Error: (04/29/2014 03:32:48 PM) (Source: Chrome) (User: NT-MYNDIGHET)

Description: Chrome has encountered a fatal error.

ver=34.0.1847.131;lang=;id=;is_machine=1;oop=1;upload=1;minidump=C:\Program Files (x86)\Google\CrashReports\b5d51d37-2bf6-4a97-bc8b-0a88e1ed380c.dmp

 

Error: (04/29/2014 03:29:31 PM) (Source: Application Error) (User: )

Description: Faulting application name: svchost.exe_wuauserv, version: 6.1.7600.16385, time stamp: 0x4a5bc3c1

Faulting module name: ntdll.dll, version: 6.1.7601.18247, time stamp: 0x521eaf24

Exception code: 0xc0000374

Fault offset: 0x00000000000c4102

Faulting process id: 0x480

Faulting application start time: 0xsvchost.exe_wuauserv0

Faulting application path: svchost.exe_wuauserv1

Faulting module path: svchost.exe_wuauserv2

Report Id: svchost.exe_wuauserv3

 

Error: (04/28/2014 10:30:53 PM) (Source: Application Error) (User: )

Description: Faulting application name: wermgr.exe, version: 6.1.7600.16385, time stamp: 0x4a5bc5f9

Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000

Exception code: 0xc0000005

Fault offset: 0x00000000e69b3420

Faulting process id: 0x1f60

Faulting application start time: 0xwermgr.exe0

Faulting application path: wermgr.exe1

Faulting module path: wermgr.exe2

Report Id: wermgr.exe3

 

Error: (04/28/2014 10:30:53 PM) (Source: Application Error) (User: )

Description: Faulting application name: WSqmCons.exe, version: 6.1.7601.17514, time stamp: 0x4ce79ab2

Faulting module name: KERNELBASE.dll, version: 6.1.7601.18229, time stamp: 0x51fb1677

Exception code: 0xc0000005

Fault offset: 0x00000000000012c3

Faulting process id: 0x1f90

Faulting application start time: 0xWSqmCons.exe0

Faulting application path: WSqmCons.exe1

Faulting module path: WSqmCons.exe2

Report Id: WSqmCons.exe3

 

Error: (04/28/2014 10:23:09 PM) (Source: Chrome) (User: NT-MYNDIGHET)

Description: Chrome has encountered a fatal error.

ver=34.0.1847.131;lang=;id=;is_machine=1;oop=1;upload=1;minidump=C:\Program Files (x86)\Google\CrashReports\63b46e3c-8623-4ca1-a0cc-667e080ad787.dmp

 

Error: (04/28/2014 10:14:12 PM) (Source: Chrome) (User: NT-MYNDIGHET)

Description: Chrome has encountered a fatal error.

ver=34.0.1847.131;lang=;id=;is_machine=1;oop=1;upload=1;minidump=C:\Program Files (x86)\Google\CrashReports\dce92aa3-dbce-4af1-9705-68c385daac19.dmp

 

Error: (04/28/2014 07:31:20 PM) (Source: Application Error) (User: )

Description: Faulting application name: mbam.exe, version: 1.0.0.500, time stamp: 0x533d8de2

Faulting module name: MSVCR100.dll, version: 10.0.40219.325, time stamp: 0x4df2be1e

Exception code: 0x40000015

Fault offset: 0x0008d6fd

Faulting process id: 0x166c

Faulting application start time: 0xmbam.exe0

Faulting application path: mbam.exe1

Faulting module path: mbam.exe2

Report Id: mbam.exe3

 

Error: (04/28/2014 07:28:58 PM) (Source: Application Error) (User: )

Description: Faulting application name: mbam.exe, version: 1.0.0.500, time stamp: 0x533d8de2

Faulting module name: MSVCR100.dll, version: 10.0.40219.325, time stamp: 0x4df2be1e

Exception code: 0x40000015

Fault offset: 0x0008d6fd

Faulting process id: 0xc8c

Faulting application start time: 0xmbam.exe0

Faulting application path: mbam.exe1

Faulting module path: mbam.exe2

Report Id: mbam.exe3

 

Error: (04/28/2014 07:09:41 PM) (Source: Application Error) (User: )

Description: Faulting application name: mbam.exe, version: 1.0.0.500, time stamp: 0x533d8de2

Faulting module name: MSVCR100.dll, version: 10.0.40219.325, time stamp: 0x4df2be1e

Exception code: 0x40000015

Fault offset: 0x0008d6fd

Faulting process id: 0xfb4

Faulting application start time: 0xmbam.exe0

Faulting application path: mbam.exe1

Faulting module path: mbam.exe2

Report Id: mbam.exe3

 

Error: (04/28/2014 07:09:27 PM) (Source: Application Error) (User: )

Description: Faulting application name: mbam.exe, version: 1.0.0.500, time stamp: 0x533d8de2

Faulting module name: MSVCR100.dll, version: 10.0.40219.325, time stamp: 0x4df2be1e

Exception code: 0x40000015

Fault offset: 0x0008d6fd

Faulting process id: 0x1b44

Faulting application start time: 0xmbam.exe0

Faulting application path: mbam.exe1

Faulting module path: mbam.exe2

Report Id: mbam.exe3

 

 

System errors:

=============

Error: (04/29/2014 03:32:17 PM) (Source: Service Control Manager) (User: )

Description: The following boot-start or system-start driver(s) failed to load: 

74926767

 

Error: (04/29/2014 03:32:09 PM) (Source: BugCheck) (User: )

Description: 0x0000001a (0x0000000000041790, 0xfffffa80025be610, 0x000000000000ffff, 0x0000000000000000)C:\Windows\MEMORY.DMP042914-11856-01

 

Error: (04/29/2014 03:32:08 PM) (Source: EventLog) (User: )

Description: The previous system shutdown at 15:31:06 on ‎29.‎04.‎2014 was unexpected.

 

Error: (04/29/2014 03:30:33 PM) (Source: Service Control Manager) (User: )

Description: The Service Control Manager tried to take a corrective action (Start tjenesten på nytt) after the unexpected termination of the Server service, but this action failed with the following error: 

%%1056

 

Error: (04/29/2014 03:29:33 PM) (Source: Service Control Manager) (User: )

Description: The Windows Update service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 60000 milliseconds: Start tjenesten på nytt.

 

Error: (04/29/2014 03:29:33 PM) (Source: Service Control Manager) (User: )

Description: The Windows Management Instrumentation service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 120000 milliseconds: Start tjenesten på nytt.

 

Error: (04/29/2014 03:29:33 PM) (Source: Service Control Manager) (User: )

Description: The Themes service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 60000 milliseconds: Start tjenesten på nytt.

 

Error: (04/29/2014 03:29:33 PM) (Source: Service Control Manager) (User: )

Description: The Shell Hardware Detection service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 60000 milliseconds: Start tjenesten på nytt.

 

Error: (04/29/2014 03:29:33 PM) (Source: Service Control Manager) (User: )

Description: The System Event Notification Service service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 120000 milliseconds: Start tjenesten på nytt.

 

Error: (04/29/2014 03:29:33 PM) (Source: Service Control Manager) (User: )

Description: The Task Scheduler service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 60000 milliseconds: Start tjenesten på nytt.

 

 

Microsoft Office Sessions:

=========================

 

CodeIntegrity Errors:

===================================

  Date: 2013-05-21 20:55:49.020

  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\mrxsmb10.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

 

  Date: 2013-05-08 15:56:50.910

  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\mrxsmb20.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

 

  Date: 2013-04-14 20:19:30.680

  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\SysWOW64\FsUsbExDisk.Sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

 

  Date: 2013-04-14 20:19:30.637

  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\SysWOW64\FsUsbExDisk.Sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

 

  Date: 2013-04-14 20:19:28.583

  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\SysWOW64\FsUsbExDisk.Sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

 

  Date: 2013-04-14 20:19:28.542

  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\SysWOW64\FsUsbExDisk.Sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

 

  Date: 2013-04-14 20:19:26.486

  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\SysWOW64\FsUsbExDisk.Sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

 

  Date: 2013-04-14 20:19:26.445

  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\SysWOW64\FsUsbExDisk.Sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

 

  Date: 2013-04-14 20:19:24.395

  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\SysWOW64\FsUsbExDisk.Sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

 

  Date: 2013-04-14 20:19:24.354

  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\SysWOW64\FsUsbExDisk.Sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

 

 

==================== Memory info =========================== 

 

Percentage of memory in use: 38%

Total physical RAM: 7637.36 MB

Available physical RAM: 4734.88 MB

Total Pagefile: 15272.91 MB

Available Pagefile: 11749.55 MB

Total Virtual: 8192 MB

Available Virtual: 8191.84 MB

 

==================== Drives ================================

 

Drive c: () (Fixed) (Total:111.69 GB) (Free:36.81 GB) NTFS

Drive d: (Nytt volum) (Fixed) (Total:1863.01 GB) (Free:1554.26 GB) NTFS

 

==================== MBR & Partition Table ==================

 

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 112 GB) (Disk ID: 14843875)

Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=112 GB) - (Type=07 NTFS)

 

========================================================

Disk: 1 (MBR Code: Windows 7 or 8) (Size: 1863 GB) (Disk ID: EF392CB0)

Partition 1: (Not Active) - (Size=-198626508800) - (Type=07 NTFS)

 

==================== End Of Log ============================

Link to post
Share on other sites

  • Root Admin

Hello and :welcome:

Please read the following and post back the logs when ready.

General P2P/Piracy Warning:

If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall them or completely disable them from running while being assisted here.

Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.

If you have illegal/cracked software, cracks, keygens etc. on the system, please remove or uninstall them now and read the policy on Piracy.

Before we proceed further, please read all of the following instructions carefully.

If there is anything that you do not understand kindly ask before proceeding.

If needed please print out these instructions.

  • Please do not post logs using CODE, QUOTE, or FONT tags. Just paste them as direct text.
  • If the log is too large then you can use attachments by clicking on the More Reply Options button.
  • Please enable your system to show hidden files: How to see hidden files in Windows
  • Make sure you're subscribed to this topic:
    • Click on the Follow This Topic Button (at the top right of this page), make sure that the Receive notification box is checked and that it is set to Instantly
  • Removing malware can be unpredictable...It is unlikely but things can go very wrong! Please make sure you Backup all files that cannot be replaced if something were to happen. You can copy them to a CD/DVD, external drive or a pen drive
  • Please don't run any other scans, download, install or uninstall any programs unless requested by me while I'm working with you.
  • The removal of malware is not instantaneous, please be patient. Often we are also on a different Time Zone.
  • Perform everything in the correct order. Sometimes one step requires the previous one.
  • If you have any problems while following my instructions, Stop there and tell me the exact nature of the issue.
  • You can check here if you're not sure if your computer is 32-bit or 64-bit
  • Please disable your antivirus while running any requested scanners so that they do not interfere with the scanners.
  • When we are done, I'll give you instructions on how to cleanup all the tools and logs
  • Please stick with me until I give you the "all clear" and Please don't waste my time by leaving before that.
  • Your topic will be closed if you haven't replied within 3 days
  • (If I have not responded within 24 hours, please send me a Private Message as a reminder)
STEP 0

RKill is a program that was developed at BleepingComputer.com that attempts to terminate known malware processes

so that your normal security software can then run and clean your computer of infections.

When RKill runs it will kill malware processes and then removes incorrect executable associations and fixes policies

that stop us from using certain tools. When finished it will display a log file that shows the processes that were

terminated while the program was running.

As RKill only terminates a program's running process, and does not delete any files, after running it you should not reboot

your computer as any malware processes that are configured to start automatically will just be started again.

Instead, after running RKill you should immediately scan your computer using the requested scans I've included.

Please download Rkill by Grinler from one of the links below and save it to your desktop.

Link 1

Link 2

  • On Windows XP double-click on the Rkill desktop icon to run the tool.
  • On Windows Vista/Windows 7 or 8, right-click on the Rkill desktop icon and select Run As Administrator
  • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
  • If not, delete the file, then download and use the one provided in Link 2.
  • If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
  • If the tool does not run from any of the links provided, please let me know.
  • Do not reboot the computer, you will need to run the application again.
STEP 01

Backup the Registry:

Modifying the Registry can create unforeseen problems, so it always wise to create a backup before doing so.

  • Please download ERUNT from one of the following links: Link1 | Link2 | Link3
  • ERUNT (Emergency Recovery Utility NT) is a free program that allows you to keep a complete backup of your registry and restore it when needed.
  • Double click on erunt-setup.exe to Install ERUNT by following the prompts.
  • NOTE: Do not choose to allow ERUNT to add an Entry to the Startup folder. Click NO.
  • Start ERUNT either by double clicking on the desktop icon or choosing to start the program at the end of the setup process.
  • Choose a location for the backup.
    • Note: the default location is C:\Windows\ERDNT which is acceptable.
  • Make sure that at least the first two check boxes are selected.
  • Click on OK
  • Then click on YES to create the folder.
  • Note: if it is necessary to restore the registry, open the backup folder and start ERDNT.exe
STEP 02

Please open Malwarebytes Anti-Malware and from the Dashboard please Check for Updates by clicking the Update Now... link

Open up Malwarebytes > Settings > Detection and Protection > Under Non Malware Protection set both PUP and PUM to Treat detections as malware.

Click on the SCAN button and run a Threat Scan with Malwarebytes Anti-Malware by clicking the Scan Now>> button.

Once completed please click on the History > Application Logs and find your scan log and open it and then click on the "copy to clipboard" button and post back the results on your next reply.

STEP 03

Please download RogueKiller and save it to your desktop.

You can check here if you're not sure if your computer is 32-bit or 64-bit

  • RogueKiller 32-bit | RogueKiller 64-bit
  • Quit all running programs.
  • For Windows XP, double-click to start.
  • For Vista,Windows 7/8, Right-click on the program and select Run as Administrator to start and when prompted allow it to run.
  • Read and accept the EULA (End User Licene Agreement)
  • Click Scan to scan the system.
  • When the scan completes Close the program > Don't Fix anything!
  • Don't run any other options, they're not all bad!!
  • Post back the report which should be located on your desktop.
Thanks
Link to post
Share on other sites

Thank you for your reply. I tried to follow your instruction, but whenever I try to open Malwarebytes, the process gets killed before the program opens.. I've tried earlier to use the chameleon without it being able to open it either, what do I do instead?

Link to post
Share on other sites

Good morning Ron,
I've run the scan and this is the report, it found a few bad things I think.
 

RogueKiller V8.8.15 _x64_ [Mar 27 2014] by Adlice Software
 
Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User : JF [Admin rights]
Mode : Scan -- Date : 05/02/2014 09:02:29
| ARK || FAK || MBR |
 
¤¤¤ Bad processes : 0 ¤¤¤
 
¤¤¤ Registry Entries : 9 ¤¤¤
[sERVICE][ROGUE ST] HKLM\[...]\CCSet\[...]\Services : 74926767 (C:\Windows\system32\drivers\10651725.sys [x]) -> FOUND
[sERVICE][ROGUE ST] HKLM\[...]\CS002\[...]\Services : 74926767 (C:\Windows\system32\drivers\10651725.sys [x]) -> FOUND
[sERVICE][ROGUE ST] HKLM\[...]\CS003\[...]\Services : 74926767 (C:\Windows\system32\drivers\10651725.sys [x]) -> FOUND
[HJ POL][PUM] HKLM\[...]\System : ConsentPromptBehaviorAdmin (0) -> FOUND
[HJ POL][PUM] HKLM\[...]\System : EnableLUA (0) -> FOUND
[HJ POL][PUM] HKLM\[...]\Wow6432Node\[...]\System : ConsentPromptBehaviorAdmin (0) -> FOUND
[HJ POL][PUM] HKLM\[...]\Wow6432Node\[...]\System : EnableLUA (0) -> FOUND
[HJ DESK][PUM] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
[HJ DESK][PUM] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
 
¤¤¤ Scheduled tasks : 0 ¤¤¤
 
¤¤¤ Startup Entries : 0 ¤¤¤
 
¤¤¤ Web browsers : 0 ¤¤¤
 
¤¤¤ Browser Addons : 0 ¤¤¤
 
¤¤¤ Particular Files / Folders: ¤¤¤
 
¤¤¤ Driver : [NOT LOADED 0x0] ¤¤¤
[Address] EAT @explorer.exe (DllCanUnloadNow) : mbamext.dll -> HOOKED (C:\Windows\System32\AltTab.dll @ 0xFAE720D8)
[Address] EAT @explorer.exe (DllGetClassObject) : mbamext.dll -> HOOKED (C:\Windows\System32\AltTab.dll @ 0xFAE720EC)
 
¤¤¤ External Hives: ¤¤¤
 
¤¤¤ Infection :  ¤¤¤
 
¤¤¤ HOSTS File: ¤¤¤
--> %SystemRoot%\System32\drivers\etc\hosts
 
 
 
 
¤¤¤ MBR Check: ¤¤¤
 
+++++ PhysicalDrive0: (\\.\PHYSICALDRIVE0 @ IDE) Corsair Force 3 SSD +++++
--- User ---
[MBR] d4e4ec1c85ebe27642d17c7a72ddacbf
[bSP] 9f01662e717a2792cad9edec24a1e30f : Windows 7/8 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 100 MB
1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 206848 | Size: 114371 MB
User = LL1 ... OK!
User = LL2 ... OK!
 
+++++ PhysicalDrive1: (\\.\PHYSICALDRIVE1 @ IDE) WDC WD20EARX-00PASB0 +++++
--- User ---
[MBR] 37459a4c9c6dfd4d5ba3d7a17e4d7b8a
[bSP] b55a0d45e097f4fbc0056d1de92450fc : Windows 7/8 MBR Code
Partition table:
0 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 1907727 MB
User = LL1 ... OK!
User = LL2 ... OK!
 
Finished : << RKreport[0]_S_05022014_090229.txt >>
Link to post
Share on other sites

  • Root Admin

Good morning.  Well RK found stuff but often has false positive so we'll let other tools help us to confirm and remove if needed.

 

Please go ahead and run through the following steps and post back the logs when ready.

STEP 03
Please download Malwarebytes Anti-Rootkit from here

  • Unzip the contents to a folder in a convenient location.
  • Open the folder where the contents were unzipped and run mbar.exe
  • Follow the instructions in the wizard to update and allow the program to scan your computer for threats.
  • Click on the Cleanup button to remove any threats and reboot if prompted to do so.
  • Wait while the system shuts down and the cleanup process is performed.
  • Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.
  • When done, please post the two logs produced they will be in the MBAR folder... mbar-log.txt and system-log.txt

STEP 04
Please download Junkware Removal Tool to your desktop.
  • Shutdown your antivirus to avoid any conflicts.
  • Right click over JRT.exe and select Run as administrator on Windows Vista or Windows 7, double-click on XP.
  • The tool will open and start scanning your system.
  • Please be patient as this can take a while to complete.
  • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
  • Post the contents of JRT.txt into your next reply message
  • When completed make sure to re-enable your antivirus



STEP 05
Lets clean out any adware now: (this will require a reboot so save all your work)

Please download AdwCleaner by Xplode and save to your Desktop.

  • Double click on AdwCleaner.exe to run the tool.
    Vista/Windows 7/8 users right-click and select Run As Administrator
  • Click on the Scan button.
  • AdwCleaner will begin...be patient as the scan may take some time to complete.
  • When it's done you'll see: Pending: Please uncheck elements you don't want removed.
  • Now click on the Report button...a logfile (AdwCleaner[R0].txt) will open in Notepad for review.
  • Look over the log especially under Files/Folders for any program you want to save.
  • If there's a program you may want to save, just uncheck it from AdwCleaner.
  • If you're not sure, post the log for review. (all items found are adware/spyware/foistware)
  • If you're ready to clean it all up.....click the Clean button.
  • After rebooting, a logfile report (AdwCleaner[s0].txt) will open automatically.
  • Copy and paste the contents of that logfile in your next reply.
  • A copy of that logfile will also be saved in the C:\AdwCleaner folder.
  • Items that are deleted are moved to the Quarantine Folder: C:\AdwCleaner\Quarantine
  • To restore an item that has been deleted:
  • Go to Tools > Quarantine Manager > check what you want restored > now click on Restore.



STEP 06
Please open Malwarebytes Anti-Malware and from the Dashboard please Check for Updates by clicking the Update Now... link
Open up Malwarebytes > Settings > Detection and Protection > Under Non Malware Protection set both PUP and PUM to Treat detections as malware.
Click on the SCAN button and run a Threat Scan with Malwarebytes Anti-Malware by clicking the Scan Now>> button.
Once completed please click on the History > Application Logs and find your scan log and open it and then click on the "copy to clipboard" button and post back the results on your next reply.


STEP 07
button_eos.gif

Please go here to run the online antivirus scannner from ESET.

  • Turn off the real time scanner of any existing antivirus program while performing the online scan
  • Tick the box next to YES, I accept the Terms of Use.
  • Click Start
  • When asked, allow the activex control to install
  • Click Start
  • Make sure that the option Remove found threats is unticked
  • Click on Advanced Settings and ensure these options are ticked:
    • Scan for potentially unwanted applications
    • Scan for potentially unsafe applications
    • Enable Anti-Stealth Technology

    [*]Click Scan [*]Wait for the scan to finish [*]If any threats were found, click the 'List of found threats' , then click Export to text file.... [*]Save it to your desktop, then please copy and paste that log as a reply to this topic.



STEP 08
Please download the Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatibale with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit

  • Double-click to run it. When the tool opens click Yes to disclaimer.
  • Press the Scan button.
  • It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
  • The first time the tool is run, it also makes another log (Addition.txt). Please attach it to your reply as well.


 

Link to post
Share on other sites

Hello,
 

I followed the steps to step 07 so far, and I just want to give you a short summary before I finish.

My first scans went without troubles, I don't believe it found very much either. I had to skip step 06 since the MBAM.exe process is still killed every time I try to launch the program. When I did the ESET scan, it crashed midway I think and found one threat. I print screened the crash error but when I tried to save it as a picture in paint I got a BSOD. Gonna try to make a new scan and then do a Farbar scan after that, here are the results so far.

 

-Jon

Link to post
Share on other sites

Malwarebytes Anti-Rootkit BETA 1.07.0.1009
www.malwarebytes.org
 
Database version: v2014.05.02.08
 
Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.17041
JF :: JF-PC [administrator]
 
02/05/2014 16:57:12
mbar-log-2014-05-02 (16-57-12).txt
 
Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled: 
Objects scanned: 299779
Time elapsed: 5 minute(s), 42 second(s)
 
Memory Processes Detected: 0
(No malicious items detected)
 
Memory Modules Detected: 0
(No malicious items detected)
 
Registry Keys Detected: 0
(No malicious items detected)
 
Registry Values Detected: 0
(No malicious items detected)
 
Registry Data Items Detected: 0
(No malicious items detected)
 
Folders Detected: 0
(No malicious items detected)
 
Files Detected: 0
(No malicious items detected)
 
Physical Sectors Detected: 0
(No malicious items detected)
 
(end)
 
 
 
---------------------------------------
Malwarebytes Anti-Rootkit BETA 1.07.0.1009
 
© Malwarebytes Corporation 2011-2012
 
OS version: 6.1.7601 Windows 7 Service Pack 1 x64
 
Account is Administrative
 
Internet Explorer version: 11.0.9600.17041
 
File system is: NTFS
Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED
CPU speed: 3.417000 GHz
Memory total: 8008355840, free: 5950455808
 
Downloaded database version: v2014.05.02.08
Downloaded database version: v2014.03.27.01
Initializing...
======================
------------ Kernel report ------------
     05/02/2014 16:57:08
------------ Loaded modules -----------
\SystemRoot\system32\ntoskrnl.exe
\SystemRoot\system32\hal.dll
\SystemRoot\system32\kdcom.dll
\SystemRoot\system32\mcupdate_GenuineIntel.dll
\SystemRoot\system32\PSHED.dll
\SystemRoot\system32\CLFS.SYS
\SystemRoot\system32\CI.dll
\SystemRoot\system32\drivers\Wdf01000.sys
\SystemRoot\system32\drivers\WDFLDR.SYS
\SystemRoot\system32\drivers\ACPI.sys
\SystemRoot\system32\drivers\WMILIB.SYS
\SystemRoot\system32\drivers\msisadrv.sys
\SystemRoot\system32\drivers\pci.sys
\SystemRoot\system32\drivers\vdrvroot.sys
\SystemRoot\System32\drivers\partmgr.sys
\SystemRoot\system32\drivers\volmgr.sys
\SystemRoot\System32\drivers\volmgrx.sys
\SystemRoot\System32\drivers\mountmgr.sys
\SystemRoot\system32\drivers\vmbus.sys
\SystemRoot\system32\drivers\winhv.sys
\SystemRoot\system32\DRIVERS\iaStor.sys
\SystemRoot\system32\drivers\atapi.sys
\SystemRoot\system32\drivers\ataport.SYS
\SystemRoot\system32\drivers\msahci.sys
\SystemRoot\system32\drivers\PCIIDEX.SYS
\SystemRoot\system32\DRIVERS\asahci64.sys
\SystemRoot\system32\drivers\amdxata.sys
\SystemRoot\system32\drivers\fltmgr.sys
\SystemRoot\system32\drivers\fileinfo.sys
\SystemRoot\system32\DRIVERS\MpFilter.sys
\SystemRoot\System32\Drivers\Ntfs.sys
\SystemRoot\System32\Drivers\msrpc.sys
\SystemRoot\System32\Drivers\ksecdd.sys
\SystemRoot\System32\Drivers\cng.sys
\SystemRoot\System32\drivers\pcw.sys
\SystemRoot\System32\Drivers\Fs_Rec.sys
\SystemRoot\system32\drivers\ndis.sys
\SystemRoot\system32\drivers\NETIO.SYS
\SystemRoot\System32\Drivers\ksecpkg.sys
\SystemRoot\System32\drivers\tcpip.sys
\SystemRoot\System32\drivers\fwpkclnt.sys
\SystemRoot\system32\drivers\vmstorfl.sys
\SystemRoot\system32\drivers\volsnap.sys
\SystemRoot\System32\Drivers\spldr.sys
\SystemRoot\System32\drivers\rdyboost.sys
\SystemRoot\system32\DRIVERS\NBVol.sys
\SystemRoot\system32\DRIVERS\NBVolUp.sys
\SystemRoot\System32\Drivers\mup.sys
\SystemRoot\system32\DRIVERS\iusb3hcs.sys
\SystemRoot\System32\drivers\hwpolicy.sys
\SystemRoot\System32\DRIVERS\fvevol.sys
\SystemRoot\system32\DRIVERS\disk.sys
\SystemRoot\system32\DRIVERS\CLASSPNP.SYS
\SystemRoot\System32\Drivers\aswVmm.sys
\SystemRoot\System32\Drivers\aswRvrt.sys
\SystemRoot\system32\DRIVERS\cdrom.sys
\SystemRoot\system32\drivers\aswSnx.sys
\SystemRoot\system32\drivers\aswSP.sys
\SystemRoot\System32\Drivers\Null.SYS
\SystemRoot\System32\Drivers\Beep.SYS
\SystemRoot\System32\drivers\vga.sys
\SystemRoot\System32\drivers\VIDEOPRT.SYS
\SystemRoot\System32\drivers\watchdog.sys
\SystemRoot\System32\DRIVERS\RDPCDD.sys
\SystemRoot\system32\drivers\rdpencdd.sys
\SystemRoot\system32\drivers\rdprefmp.sys
\SystemRoot\System32\Drivers\Msfs.SYS
\SystemRoot\System32\Drivers\Npfs.SYS
\SystemRoot\system32\DRIVERS\tdx.sys
\SystemRoot\system32\DRIVERS\TDI.SYS
\SystemRoot\system32\drivers\afd.sys
\SystemRoot\system32\drivers\aswRdr2.sys
\SystemRoot\System32\DRIVERS\netbt.sys
\SystemRoot\system32\DRIVERS\wfplwf.sys
\SystemRoot\system32\DRIVERS\pacer.sys
\SystemRoot\system32\DRIVERS\netbios.sys
\SystemRoot\system32\DRIVERS\wanarp.sys
\SystemRoot\system32\drivers\termdd.sys
\SystemRoot\system32\DRIVERS\rdbss.sys
\SystemRoot\system32\drivers\nsiproxy.sys
\SystemRoot\system32\drivers\mssmbios.sys
\SystemRoot\System32\drivers\discache.sys
\SystemRoot\system32\drivers\csc.sys
\SystemRoot\System32\Drivers\dfsc.sys
\SystemRoot\system32\DRIVERS\blbdrive.sys
\SystemRoot\SysWow64\drivers\AsUpIO.sys
\SystemRoot\SysWow64\drivers\AsIO.sys
\SystemRoot\system32\DRIVERS\tunnel.sys
\SystemRoot\system32\DRIVERS\atikmpag.sys
\SystemRoot\system32\DRIVERS\atikmdag.sys
\SystemRoot\System32\drivers\dxgkrnl.sys
\SystemRoot\System32\drivers\dxgmms1.sys
\SystemRoot\system32\DRIVERS\HDAudBus.sys
\SystemRoot\SysWow64\drivers\AiCharger.sys
\SystemRoot\system32\DRIVERS\iusb3xhc.sys
\SystemRoot\system32\DRIVERS\USBD.SYS
\SystemRoot\system32\DRIVERS\HECIx64.sys
\SystemRoot\system32\DRIVERS\e1c62x64.sys
\SystemRoot\system32\drivers\usbehci.sys
\SystemRoot\system32\drivers\USBPORT.SYS
\SystemRoot\system32\DRIVERS\asmtxhci.sys
\SystemRoot\system32\DRIVERS\ICCWDT.sys
\SystemRoot\system32\drivers\wmiacpi.sys
\SystemRoot\system32\DRIVERS\intelppm.sys
\SystemRoot\system32\DRIVERS\cfosspeed.sys
\SystemRoot\system32\drivers\CompositeBus.sys
\SystemRoot\system32\DRIVERS\AgileVpn.sys
\SystemRoot\system32\DRIVERS\rasl2tp.sys
\SystemRoot\system32\DRIVERS\ndistapi.sys
\SystemRoot\system32\DRIVERS\ndiswan.sys
\SystemRoot\system32\DRIVERS\raspppoe.sys
\SystemRoot\system32\DRIVERS\raspptp.sys
\SystemRoot\system32\DRIVERS\rassstp.sys
\SystemRoot\system32\DRIVERS\hamachi.sys
\SystemRoot\system32\DRIVERS\rdpbus.sys
\SystemRoot\system32\DRIVERS\kbdclass.sys
\SystemRoot\system32\DRIVERS\mouclass.sys
\SystemRoot\system32\drivers\swenum.sys
\SystemRoot\system32\drivers\ks.sys
\SystemRoot\system32\DRIVERS\umbus.sys
\SystemRoot\system32\DRIVERS\usbhub.sys
\SystemRoot\System32\Drivers\NDProxy.SYS
\SystemRoot\system32\drivers\AtihdW76.sys
\SystemRoot\system32\drivers\portcls.sys
\SystemRoot\system32\drivers\drmk.sys
\SystemRoot\system32\drivers\ksthunk.sys
\SystemRoot\system32\DRIVERS\iusb3hub.sys
\SystemRoot\SysWow64\drivers\ASUSFILTER.sys
\SystemRoot\system32\drivers\RTKVHD64.sys
\SystemRoot\System32\Drivers\crashdmp.sys
\SystemRoot\System32\win32k.sys
\SystemRoot\System32\drivers\Dxapi.sys
\SystemRoot\System32\Drivers\dump_iaStor.sys
\SystemRoot\System32\Drivers\dump_dumpfve.sys
\SystemRoot\system32\DRIVERS\asmthub3.sys
\SystemRoot\system32\DRIVERS\usbccgp.sys
\SystemRoot\system32\DRIVERS\hidusb.sys
\SystemRoot\system32\DRIVERS\HIDCLASS.SYS
\SystemRoot\system32\DRIVERS\HIDPARSE.SYS
\SystemRoot\system32\DRIVERS\kbdhid.sys
\SystemRoot\system32\DRIVERS\mouhid.sys
\SystemRoot\system32\DRIVERS\monitor.sys
\SystemRoot\System32\TSDDD.dll
\SystemRoot\System32\cdd.dll
\SystemRoot\System32\ATMFD.DLL
\SystemRoot\system32\drivers\luafv.sys
\SystemRoot\system32\drivers\aswMonFlt.sys
\SystemRoot\system32\drivers\LVUSBS64.sys
\SystemRoot\system32\DRIVERS\lvuvc64.sys
\SystemRoot\system32\drivers\aswStm.sys
\SystemRoot\system32\DRIVERS\lltdio.sys
\SystemRoot\system32\DRIVERS\rspndr.sys
\SystemRoot\system32\drivers\HTTP.sys
\SystemRoot\system32\DRIVERS\bowser.sys
\SystemRoot\System32\drivers\mpsdrv.sys
\SystemRoot\system32\DRIVERS\mrxsmb.sys
\SystemRoot\system32\DRIVERS\mrxsmb10.sys
\SystemRoot\system32\DRIVERS\mrxsmb20.sys
\SystemRoot\system32\drivers\aswHwid.sys
\??\C:\Windows\system32\drivers\cpuz135_x64.sys
\SystemRoot\system32\DRIVERS\NisDrvWFP.sys
\SystemRoot\system32\drivers\peauth.sys
\SystemRoot\System32\Drivers\secdrv.SYS
\SystemRoot\System32\DRIVERS\srvnet.sys
\SystemRoot\System32\drivers\tcpipreg.sys
\??\C:\Program Files (x86)\CyberLink\PowerDVD10\NavFilter\000.fcl
\SystemRoot\System32\DRIVERS\srv2.sys
\SystemRoot\System32\DRIVERS\srv.sys
\SystemRoot\system32\DRIVERS\cdfs.sys
\SystemRoot\system32\DRIVERS\udfs.sys
\??\C:\Windows\system32\drivers\mbamchameleon.sys
\??\C:\Windows\system32\drivers\MBAMSwissArmy.sys
\Windows\System32\ntdll.dll
\Windows\System32\smss.exe
\Windows\System32\apisetschema.dll
\Windows\System32\autochk.exe
\Windows\System32\urlmon.dll
\Windows\System32\difxapi.dll
\Windows\System32\setupapi.dll
\Windows\System32\kernel32.dll
\Windows\System32\clbcatq.dll
\Windows\System32\msvcrt.dll
\Windows\System32\rpcrt4.dll
\Windows\System32\imagehlp.dll
\Windows\System32\ole32.dll
\Windows\System32\psapi.dll
\Windows\System32\comdlg32.dll
\Windows\System32\iertutil.dll
\Windows\System32\Wldap32.dll
\Windows\System32\nsi.dll
\Windows\System32\user32.dll
\Windows\System32\imm32.dll
\Windows\System32\msctf.dll
\Windows\System32\wininet.dll
\Windows\System32\sechost.dll
\Windows\System32\ws2_32.dll
\Windows\System32\oleaut32.dll
\Windows\System32\shlwapi.dll
\Windows\System32\shell32.dll
\Windows\System32\gdi32.dll
\Windows\System32\normaliz.dll
\Windows\System32\lpk.dll
\Windows\System32\advapi32.dll
\Windows\System32\usp10.dll
\Windows\System32\api-ms-win-downlevel-advapi32-l1-1-0.dll
\Windows\System32\devobj.dll
\Windows\System32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
\Windows\System32\crypt32.dll
\Windows\System32\comctl32.dll
\Windows\System32\KernelBase.dll
\Windows\System32\wintrust.dll
\Windows\System32\api-ms-win-downlevel-normaliz-l1-1-0.dll
\Windows\System32\cfgmgr32.dll
\Windows\System32\api-ms-win-downlevel-user32-l1-1-0.dll
\Windows\System32\api-ms-win-downlevel-ole32-l1-1-0.dll
\Windows\System32\api-ms-win-downlevel-version-l1-1-0.dll
\Windows\System32\msasn1.dll
\Windows\SysWOW64\normaliz.dll
----------- End -----------
Done!
<<<1>>>
Upper Device Name: \Device\Harddisk1\DR1
Upper Device Object: 0xfffffa80069ee790
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\Ide\IAAStorageDevice-2\
Lower Device Object: 0xfffffa80069f3050
Lower Device Driver Name: \Driver\iaStor\
<<<1>>>
Upper Device Name: \Device\Harddisk0\DR0
Upper Device Object: 0xfffffa800614c790
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\Ide\IAAStorageDevice-1\
Lower Device Object: 0xfffffa80069f1050
Lower Device Driver Name: \Driver\iaStor\
<<<2>>>
Physical Sector Size: 512
Drive: 0, DevicePointer: 0xfffffa800614c790, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xfffffa800690aa90, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xfffffa800614c790, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
DevicePointer: 0xfffffa80068d7950, DeviceName: Unknown, DriverName: \Driver\ACPI\
DevicePointer: 0xfffffa80069f1050, DeviceName: \Device\Ide\IAAStorageDevice-1\, DriverName: \Driver\iaStor\
------------ End ----------
Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
Upper DeviceData: 0x0, 0x0, 0x0
Lower DeviceData: 0x0, 0x0, 0x0
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
<<<2>>>
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Scanning drivers directory: C:\WINDOWS\SYSTEM32\drivers...
<<<2>>>
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Done!
Drive 0
Scanning MBR on drive 0...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: 14843875
 
Partition information:
 
    Partition 0 type is Primary (0x7)
    Partition is ACTIVE.
    Partition starts at LBA: 2048  Numsec = 204800
    Partition file system is NTFS
    Partition is bootable
 
    Partition 1 type is Primary (0x7)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 206848  Numsec = 234231808
 
    Partition 2 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0  Numsec = 0
 
    Partition 3 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0  Numsec = 0
 
Disk Size: 120034123776 bytes
Sector size: 512 bytes
 
Scanning physical sectors of unpartitioned space on drive 0 (1-2047-234421648-234441648)...
Done!
Physical Sector Size: 512
Drive: 1, DevicePointer: 0xfffffa80069ee790, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xfffffa800690bb90, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xfffffa80069ee790, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\
DevicePointer: 0xfffffa80068d8950, DeviceName: Unknown, DriverName: \Driver\ACPI\
DevicePointer: 0xfffffa80069f3050, DeviceName: \Device\Ide\IAAStorageDevice-2\, DriverName: \Driver\iaStor\
------------ End ----------
Alternate DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\
Upper DeviceData: 0x0, 0x0, 0x0
Lower DeviceData: 0x0, 0x0, 0x0
Drive 1
Scanning MBR on drive 1...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: EF392CB0
 
Partition information:
 
    Partition 0 type is Primary (0x7)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 2048  Numsec = 3907024896
 
    Partition 1 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0  Numsec = 0
 
    Partition 2 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0  Numsec = 0
 
    Partition 3 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0  Numsec = 0
 
Disk Size: 2000398934016 bytes
Sector size: 512 bytes
 
Done!
Scan finished
=======================================
 
 
Removal queue found; removal started
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-0-i.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\VBR-0-0-2048-i.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-0-r.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-1-i.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-1-r.mbam...
Removal finished
 
 
 
 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 7 Ultimate x64
Ran by JF on 02/05/2014 at 17:07:51.78
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 
 
 
~~~ Services
 
 
 
~~~ Registry Values
 
 
 
~~~ Registry Keys
 
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Myfree Codec
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-2228356659-1681754584-2698884876-1000\Software\sweetim
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Myfree Codec
 
 
 
~~~ Files
 
 
 
~~~ Folders
 
Successfully deleted: [Folder] "C:\ProgramData\boost_interprocess"
Failed to delete: [Folder] "C:\ProgramData\browserprotect"
Successfully deleted: [Folder] "C:\Program Files (x86)\myfree codec"
 
 
 
~~~ Chrome
 
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Policies\Google [blacklisted Policy]
 
 
 
~~~ Event Viewer Logs were cleared
 
 
 
 
 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 02/05/2014 at 17:12:05.39
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 
 
 
# AdwCleaner v3.205 - Report created 02/05/2014 at 17:20:57
# Updated 28/04/2014 by Xplode
# Operating System : Windows 7 Ultimate Service Pack 1 (64 bits)
# Username : JF - JF-PC
# Running from : C:\Users\JF\Desktop\AdwCleaner (1).exe
# Option : Clean
 
***** [ Services ] *****
 
 
***** [ Files / Folders ] *****
 
 
***** [ Shortcuts ] *****
 
 
***** [ Registry ] *****
 
 
***** [ Browsers ] *****
 
-\\ Internet Explorer v11.0.9600.17041
 
 
-\\ Mozilla Firefox v
 
-\\ Google Chrome v34.0.1847.131
 
[ File : C:\Users\JF\AppData\Local\Google\Chrome\User Data\Default\preferences ]
 
 
*************************
 
AdwCleaner[R1].txt - [774 octets] - [02/05/2014 17:16:53]
AdwCleaner[s1].txt - [696 octets] - [02/05/2014 17:20:57]
 
########## EOF - C:\AdwCleaner\AdwCleaner[s1].txt - [755 octets] ##########
 
 

 

MBAM - no logs

Link to post
Share on other sites


Tried a several times more, here is the result:

 

First time, eset finds " A variant of Win32/BitCoinMiner.BJ" after a few secs, when I come back my computer has restarted after a BSOD.

Second time, finds the same thing after a few secs, then BSOD about halfway with the message "PFN_List_Corrupt"

Third time, finds the threat again, BSOD halfway with the message "IRQL_Not_Less_Or_Equal"

 

Here is the farbar results:


 

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-05-2014

Ran by JF (administrator) on JF-PC on 02-05-2014 18:53:15

Running from C:\Users\JF\Desktop

Windows 7 Ultimate Service Pack 1 (X64) OS Language: Norwegian Bokmal

Internet Explorer Version 11

Boot Mode: Normal

 

The only official download link for FRST:



Download link from any site other than Bleeping Computer is unpermitted or outdated.


 

==================== Processes (Whitelisted) =================

 

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe

(AMD) C:\Windows\System32\atiesrxx.exe

(Creative Technology Ltd) C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe

(AMD) C:\Windows\System32\atieclxx.exe

(AVAST Software) D:\Program Files\AVAST Software\Avast\AvastSvc.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe

(cFos Software GmbH) C:\Program Files\ASUS\ROG GameFirst\cfosspeed.exe

() C:\Program Files (x86)\ASUS\AXSP\1.00.18\atkexComSvc.exe

(Valve Corporation) D:\Steam\Steam.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AI Suite II\AsRoutineController.exe

(Spotify Ltd) C:\Users\JF\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe

(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe

(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AI Suite II\DIGI+ Power Control\PowerControlHelp.exe

(Dropbox, Inc.) C:\Users\JF\AppData\Roaming\Dropbox\bin\Dropbox.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AAHM\1.00.20\aaHMSvc.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.13\AsSysCtrlService.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AsusFanControlService\1.00.25\AsusFanControlService.exe

(cFos Software GmbH) C:\Program Files\ASUS\ROG GameFirst\spd.exe

(Intel® Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe

(Intel Corporation) C:\Windows\System32\IPROSetMonitor.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\Jhi_service.exe

(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe

(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.23.9\GoogleCrashHandler.exe

(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe

(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe

(cyberlink) C:\Program Files (x86)\CyberLink\Shared files\brs.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE

(LogMeIn Inc.) D:\hamachi-2.exe

(Creative Technology Ltd) C:\Program Files (x86)\Creative\Sound Blaster X-Fi MB 2\Sound Blaster Panel\VolPanlu.exe

(ASUSTek Computer Inc.) C:\Program Files (x86)\InstallShield Installation Information\{E6931688-DA2B-4E16-8539-3D323D69C677}\AiChargerPlus.exe

(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

(AVAST Software) D:\Program Files\AVAST Software\Avast\AvastUI.exe

(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.23.9\GoogleCrashHandler64.exe

(LogMeIn Inc.) D:\hamachi-2-ui.exe

(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

(LogMeIn, Inc.) D:\LMIGuardianSvc.exe

(LogMeIn, Inc.) D:\LMIGuardianSvc.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AI Suite II\USB 3.0 Boost\U3BoostSvr64.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AI Suite II\TurboV EVO\TurboVHelp.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Integrated Clock Controller Service\ICCProxy.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AI Suite II\EPU\EPUHelp.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AI Suite II\AI Suite II.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AI Suite II\Sensor\AlertHelper\AlertHelper.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe

(Microsoft Corporation) C:\Windows\System32\wbem\WMIADAP.exe

 

 

==================== Registry (Whitelisted) ==================

 

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6463592 2012-02-10] (Realtek Semiconductor)

HKLM\...\Run: [THXCfg64] => C:\Windows\system32\THXCfg64.dll [17920 2009-10-15] (Creative Technology Ltd.)

HKLM\...\Run: [RunDLLEntry] => C:\Windows\system32\AmbRunE.dll [17920 2009-02-26] (Creative Technology Ltd.)

HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [1271072 2014-03-11] (Microsoft Corporation)

HKLM\...\Run: [ROG GameFirst] => C:\Program Files\ASUS\ROG GameFirst\cFosSpeed.exe [1305272 2010-11-22] (cFos Software GmbH)

HKLM-x32\...\Run: [THX Audio Control Panel] => C:\Program Files (x86)\Creative\Sound Blaster X-Fi MB 2\THXAudioCP\THXAudio.exe [1349632 2010-06-11] (Creative Technology Ltd)

HKLM-x32\...\Run: [updReg] => C:\Windows\UpdReg.EXE [90112 2000-05-11] (Creative Technology Ltd.)

HKLM-x32\...\Run: [uSB3MON] => C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-01-04] (Intel Corporation)

HKLM-x32\...\Run: [iAStorIcon] => C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe [284440 2012-02-01] (Intel Corporation)

HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [87336 2010-02-03] (CyberLink Corp.)

HKLM-x32\...\Run: [bDRegion] => C:\Program Files (x86)\Cyberlink\Shared files\brs.exe [75048 2011-03-01] (cyberlink)

HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)

HKLM-x32\...\Run: [VolPanel] => C:\Program Files (x86)\Creative\Sound Blaster X-Fi MB 2\Sound Blaster Panel\VolPanlu.exe [241789 2010-02-18] (Creative Technology Ltd)

HKLM-x32\...\Run: [ASUS AiChargerPlus Execute] => C:\Program Files (x86)\InstallShield Installation Information\{E6931688-DA2B-4E16-8539-3D323D69C677}\AiChargerPlus.exe [465536 2011-10-31] (ASUSTek Computer Inc.)

HKLM-x32\...\Run: [startCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766208 2013-08-30] (Advanced Micro Devices, Inc.)

HKLM-x32\...\Run: [AvastUI.exe] => d:\Program Files\AVAST Software\Avast\AvastUI.exe [3873704 2014-04-19] (AVAST Software)

HKLM-x32\...\Run: [LogMeIn Hamachi Ui] => D:\hamachi-2-ui.exe [3814736 2014-04-15] (LogMeIn Inc.)

HKLM-x32\...\Run: [sunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)

HKU\.DEFAULT\...\RunOnce: [Application Restart #1] - C:\Program Files (x86)\ASUS\GPU Tweak\Monitor.exe  /RestartByRestartManager:3AB1406E-AAEC-4a90-BF0E-B3F88CD054B0

HKU\S-1-5-21-2228356659-1681754584-2698884876-1000\...\Run: [steam] => D:\Steam\steam.exe [1775808 2014-05-02] (Valve Corporation)

HKU\S-1-5-21-2228356659-1681754584-2698884876-1000\...\Run: [spotify Web Helper] => C:\Users\JF\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1171000 2014-04-10] (Spotify Ltd)

HKU\S-1-5-21-2228356659-1681754584-2698884876-1000\...\Run: [AdobeBridge] => [X]

HKU\S-1-5-21-2228356659-1681754584-2698884876-1000\...\Run: [HydraVisionDesktopManager] => C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe [389120 2013-08-30] (AMD)

HKU\S-1-5-21-2228356659-1681754584-2698884876-1000\...\Run: [skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [20922016 2014-02-10] (Skype Technologies S.A.)

HKU\S-1-5-21-2228356659-1681754584-2698884876-1000\...\Run: [spotify] => C:\Users\JF\AppData\Roaming\Spotify\spotify.exe [6087224 2014-04-10] (Spotify Ltd)

HKU\S-1-5-21-2228356659-1681754584-2698884876-1000\...\MountPoints2: {639bb87e-2f43-11e2-936a-10bf4886abff} - F:\Startme.exe

HKU\S-1-5-21-2228356659-1681754584-2698884876-1000\...\MountPoints2: {879868cb-f3ff-11e1-a7a4-806e6f6e6963} - D:\.\Bin\ASSETUP.exe

Startup: C:\Users\JF\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk

ShortcutTarget: Dropbox.lnk -> C:\Users\JF\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

 

==================== Internet (Whitelisted) ====================

 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://no.msn.com/?ocid=iehp

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xC9EAEBFB1388CD01

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = no

URLSearchHook: HKCU - (No Name) - {472734EA-242A-422b-ADF8-83D1E48CC825} - No File

BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)

BHO-x32: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: Påloggingshjelp for Microsoft-konto - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

BHO-x32: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

DPF: HKLM-x32 {6C269571-C6D7-4818-BCA4-32A035E8C884} http://ccfiles.creative.com/Web/softwareupdate/su/ocx/15102/CTSUEng.cab

DPF: HKLM-x32 {D4B68B83-8710-488B-A692-D74B50BA558E} http://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab

DPF: HKLM-x32 {E705A591-DA3C-4228-B0D5-A356DBA42FBF} http://ccfiles.creative.com/Web/softwareupdate/su2/ocx/20015/CTSUEng.cab

DPF: HKLM-x32 {F6ACF75C-C32C-447B-9BEF-46B766368D29} http://ccfiles.creative.com/Web/softwareupdate/ocx/110926/CTPID.cab

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)

 

FireFox:

========

FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_206.dll ()

FF Plugin: @microsoft.com/GENUINE - disabled No File

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)

FF Plugin: adobe.com/AdobeAAMDetect_x86_64 - C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll (Adobe Systems)

FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_206.dll ()

FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59 - C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)

FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @microsoft.com/GENUINE - disabled No File

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File

FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @videolan.org/vlc,version=2.0.2 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin-x32: @videolan.org/vlc,version=2.1.2 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin-x32: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll (Adobe Systems)

FF Plugin HKCU: @nsroblox.roblox.com/launcher - C:\Program Files (x86)\Roblox\Versions\version-df24752ec7384d96\\NPRobloxProxy.dll ( ROBLOX Corporation)

FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\JF\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)

 

Chrome: 

=======

CHR HomePage: www.google.com

CHR RestoreOnStartup: "sync"

CHR StartupUrls: "www.google.com"

CHR DefaultSearchURL: http://www.google.no/#hl=no&sclient=psy-ab&q={searchTerms}

CHR DefaultNewTabURL: 

CHR Plugin: (Widevine Content Decryption Module) - C:\Users\JF\AppData\Local\Google\Chrome\User Data\WidevineCDM\1.4.2.464\_platform_specific\win_x86\widevinecdmadapter.dll ()

CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.131\PepperFlash\pepflashplayer.dll ()

CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer

CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.131\ppGoogleNaClPluginChrome.dll ()

CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.131\pdf.dll ()

CHR Plugin: (AdobeAAMDetect) - C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll (Adobe Systems)

CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

CHR Plugin: (Google Earth Plugin) - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)

CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)

CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)

CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)

CHR Plugin: (Java Deployment Toolkit 7.0.550.14) - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

CHR Plugin: (Java Platform SE 7 U55) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

CHR Plugin: (Silverlight Plug-In) - C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)

CHR Plugin: (Roblox Launcher Plugin) - C:\Program Files (x86)\Roblox\Versions\version-df24752ec7384d96\\NPRobloxProxy.dll ( ROBLOX Corporation)

CHR Plugin: (VLC Web Plugin) - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

CHR Plugin: (Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

CHR Plugin: (Unity Player) - C:\Users\JF\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)

CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_182.dll No File

CHR Extension: (Google Docs) - C:\Users\JF\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-05-04]

CHR Extension: (Google Drive) - C:\Users\JF\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-05-04]

CHR Extension: (Hover Free) - C:\Users\JF\AppData\Local\Google\Chrome\User Data\Default\Extensions\bbilojbgaikphnpbllmjjfpgapbhmkic [2014-01-11]

CHR Extension: (YouTube) - C:\Users\JF\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-05-04]

CHR Extension: (Google Search) - C:\Users\JF\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-05-04]

CHR Extension: (HTTPS Everywhere) - C:\Users\JF\AppData\Local\Google\Chrome\User Data\Default\Extensions\gcbommkclmclpchllfjekcdonpmejbdp [2014-04-03]

CHR Extension: (AdBlock) - C:\Users\JF\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2013-05-11]

CHR Extension: (Disconnect) - C:\Users\JF\AppData\Local\Google\Chrome\User Data\Default\Extensions\jeoacafpbcihiomhlakheieifhpjdfeo [2014-03-30]

CHR Extension: (Ghostery) - C:\Users\JF\AppData\Local\Google\Chrome\User Data\Default\Extensions\mlomiejdfkolichcflejclcbmpeaniij [2014-03-30]

CHR Extension: (Google Wallet) - C:\Users\JF\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-23]

CHR Extension: (Gmail) - C:\Users\JF\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-05-04]

 

==================== Services (Whitelisted) =================

 

R2 asComSvc; C:\Program Files (x86)\ASUS\AXSP\1.00.18\atkexComSvc.exe [918448 2011-10-29] ()

R2 asHmComSvc; C:\Program Files (x86)\ASUS\AAHM\1.00.20\aaHMSvc.exe [951936 2012-02-02] (ASUSTeK Computer Inc.)

R2 AsSysCtrlService; C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.13\AsSysCtrlService.exe [149120 2012-02-17] (ASUSTeK Computer Inc.)

R2 AsusFanControlService; C:\Program Files (x86)\ASUS\AsusFanControlService\1.00.25\AsusFanControlService.exe [1493120 2012-02-22] (ASUSTeK Computer Inc.)

R2 avast! Antivirus; d:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-04-19] (AVAST Software)

R2 cFosSpeedS; C:\Program Files\ASUS\ROG GameFirst\spd.exe [487096 2010-11-22] (cFos Software GmbH)

R2 Hamachi2Svc; D:\hamachi-2.exe [2227536 2014-04-15] (LogMeIn Inc.)

R2 jhi_service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [161560 2012-02-07] (Intel Corporation)

R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2014-03-11] (Microsoft Corporation)

S3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [347872 2014-03-11] (Microsoft Corporation)

 

==================== Drivers (Whitelisted) ====================

 

R3 AiCharger; C:\Windows\SysWow64\drivers\AiCharger.sys [14592 2010-10-20] (ASUSTek Computer Inc.)

S3 arcvad_ds2dhw; C:\Windows\System32\drivers\ArcVad.sys [27136 2008-10-28] (ArcSoft, Inc.)

R0 asahci64; C:\Windows\System32\DRIVERS\asahci64.sys [49760 2012-01-06] (Asmedia Technology)

R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [15232 2013-02-27] ()

R1 AsUpIO; C:\Windows\SysWow64\drivers\AsUpIO.sys [14464 2010-08-03] ()

R3 ASUSFILTER; C:\Windows\SysWow64\drivers\ASUSFILTER.sys [46152 2011-09-20] (MCCI Corporation)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-04-19] ()

R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-04-19] (AVAST Software)

R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-04-19] (AVAST Software)

R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-04-19] ()

R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1039096 2014-04-19] (AVAST Software)

R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [423240 2014-04-19] (AVAST Software)

R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [85328 2014-04-19] (AVAST Software)

R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [208416 2014-04-19] ()

R3 cFosSpeed; C:\Windows\System32\DRIVERS\cfosspeed.sys [1437368 2010-11-22] (cFos Software GmbH)

U5 FontCache3.0.0.0; C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe [42856 2010-11-04] (Microsoft Corporation)

S3 FsUsbExDisk; C:\Windows\SysWOW64\FsUsbExDisk.SYS [37344 2013-03-20] ()

S3 LGPBTDD; C:\Windows\System32\Drivers\LGPBTDD.sys [30728 2009-07-01] (Logitech Inc.)

S3 LGSHidFilt; C:\Windows\System32\DRIVERS\LGSHidFilt.Sys [66360 2012-10-03] (Logitech Inc.)

S3 LGSUsbFilt; C:\Windows\System32\DRIVERS\LGSUsbFilt.Sys [43832 2012-10-03] (Logitech Inc.)

R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [268512 2014-01-25] (Microsoft Corporation)

S3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [133928 2014-03-11] (Microsoft Corporation)

S3 YMIDUSBW; C:\Windows\System32\drivers\ymidusbx64.sys [51016 2011-11-01] (Yamaha Corporation)

R2 {1BA31E5A-C098-42d8-8F88-3C9F78A2FDDC}; C:\Program Files (x86)\CyberLink\PowerDVD10\NavFilter\000.fcl [146928 2011-03-01] (CyberLink Corp.)

S0 74926767; system32\drivers\10651725.sys [X]

S3 atillk64; \??\C:\HD_6950_to_HD_6970_mod\winflash\atillk64.sys [X]

S3 cpuz136; \??\C:\Windows\TEMP\cpuz136\cpuz136_x64.sys [X]

S3 GPUZ; \??\C:\Windows\TEMP\GPUZ.sys [X]

S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]

S3 tsusbhub; system32\drivers\tsusbhub.sys [X]

S3 VGPU; System32\drivers\rdvgkmd.sys [X]

 

==================== NetSvcs (Whitelisted) ===================

 

 

==================== One Month Created Files and Folders ========

 

2014-05-02 18:53 - 2014-05-02 18:53 - 00023600 _____ () C:\Users\JF\Desktop\FRST.txt

2014-05-02 18:48 - 2014-05-02 18:48 - 00277536 _____ () C:\Windows\Minidump\050214-14398-01.dmp

2014-05-02 18:36 - 2014-05-02 18:36 - 00277536 _____ () C:\Windows\Minidump\050214-15600-01.dmp

2014-05-02 18:35 - 2014-05-02 18:35 - 02062336 _____ (Farbar) C:\Users\JF\Desktop\FRST64.exe

2014-05-02 18:13 - 2014-05-02 18:13 - 00277536 _____ () C:\Windows\Minidump\050214-12620-01.dmp

2014-05-02 18:12 - 2014-05-02 18:12 - 00277536 _____ () C:\Windows\Minidump\050214-11918-01.dmp

2014-05-02 18:08 - 2014-05-02 18:08 - 00277536 _____ () C:\Windows\Minidump\050214-13166-01.dmp

2014-05-02 18:07 - 2014-05-02 18:07 - 00003288 ____N () C:\bootsqm.dat

2014-05-02 17:34 - 2014-05-02 17:34 - 00277480 _____ () C:\Windows\Minidump\050214-11622-01.dmp

2014-05-02 17:29 - 2014-05-02 17:29 - 00000000 ____D () C:\Program Files (x86)\ESET

2014-05-02 17:28 - 2014-05-02 17:28 - 02347384 _____ (ESET) C:\Users\JF\Desktop\esetsmartinstaller_enu.exe

2014-05-02 17:26 - 2014-05-02 17:26 - 01310621 _____ () C:\Users\JF\Downloads\AdwCleaner (2).exe

2014-05-02 17:16 - 2014-05-02 17:21 - 00000000 ____D () C:\AdwCleaner

2014-05-02 17:16 - 2014-05-02 17:16 - 01310621 _____ () C:\Users\JF\Downloads\AdwCleaner (1).exe

2014-05-02 17:16 - 2014-05-02 17:16 - 01310621 _____ () C:\Users\JF\Desktop\AdwCleaner (1).exe

2014-05-02 17:12 - 2014-05-02 17:12 - 00001287 _____ () C:\Users\JF\Desktop\JRT.txt

2014-05-02 17:07 - 2014-05-02 17:07 - 00000000 ____D () C:\Windows\ERUNT

2014-05-02 16:59 - 2014-05-02 16:59 - 01016261 _____ (Thisisu) C:\Users\JF\Downloads\JRT.exe

2014-05-02 16:59 - 2014-05-02 16:59 - 01016261 _____ (Thisisu) C:\Users\JF\Desktop\JRT.exe

2014-05-02 16:57 - 2014-05-02 17:03 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)

2014-05-02 16:56 - 2014-05-02 17:03 - 00000000 ____D () C:\Users\JF\Desktop\mbar

2014-05-02 16:56 - 2014-05-02 16:56 - 12589848 _____ (Malwarebytes Corp.) C:\Users\JF\Downloads\mbar-1.07.0.1009.exe

2014-05-02 09:02 - 2014-05-02 09:02 - 00002780 _____ () C:\Users\JF\Desktop\RKreport[0]_S_05022014_090229.txt

2014-05-02 09:00 - 2014-05-02 09:03 - 00000000 ____D () C:\Users\JF\Desktop\RK_Quarantine

2014-05-02 09:00 - 2014-05-02 08:58 - 04527616 _____ () C:\Users\JF\Desktop\RogueKillerX64.exe

2014-05-02 08:58 - 2014-05-02 08:58 - 04527616 _____ () C:\Users\JF\Downloads\RogueKillerX64.exe

2014-05-01 23:46 - 2014-05-01 23:46 - 00000000 ____D () C:\Windows\ERDNT

2014-05-01 23:45 - 2014-05-01 23:46 - 00000000 ____D () C:\Program Files (x86)\ERUNT

2014-05-01 23:45 - 2014-05-01 23:45 - 00791393 _____ (Lars Hederer ) C:\Users\JF\Downloads\erunt-setup.exe

2014-05-01 23:45 - 2014-05-01 23:45 - 00000928 _____ () C:\Users\JF\Desktop\NTREGOPT.lnk

2014-05-01 23:45 - 2014-05-01 23:45 - 00000909 _____ () C:\Users\JF\Desktop\ERUNT.lnk

2014-05-01 23:45 - 2014-05-01 23:45 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ERUNT

2014-05-01 23:44 - 2014-05-01 23:45 - 00007448 _____ () C:\Users\JF\Desktop\Rkill.txt

2014-05-01 23:42 - 2014-05-02 16:56 - 00000000 ____D () C:\Users\JF\Desktop\fix

2014-05-01 23:42 - 2014-05-01 23:42 - 01933048 _____ (Bleeping Computer, LLC) C:\Users\JF\Downloads\rkill (1).exe

2014-05-01 23:42 - 2014-05-01 23:42 - 01933048 _____ (Bleeping Computer, LLC) C:\Users\JF\Desktop\rkill (1).exe

2014-05-01 22:06 - 2014-05-01 22:06 - 00001102 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 9.lnk

2014-05-01 22:02 - 2014-05-01 22:02 - 04615552 _____ (TeamViewer) C:\Users\JF\Downloads\TeamViewerQS_no (1).exe

2014-05-01 21:57 - 2014-05-01 21:57 - 03145782 _____ () C:\Users\JF\Downloads\ScreenShot023.bmp

2014-05-01 21:50 - 2014-05-01 21:50 - 00005536 _____ () C:\Users\JF\Downloads\xpnetdiag.xml

2014-05-01 14:02 - 2014-05-01 14:02 - 00002850 _____ () C:\Users\JF\Downloads\AdwCleanerS0.txt

2014-05-01 12:48 - 2014-05-01 12:48 - 00277536 _____ () C:\Windows\Minidump\050114-11668-01.dmp

2014-05-01 11:52 - 2014-05-01 11:52 - 00277536 _____ () C:\Windows\Minidump\050114-12667-01.dmp

2014-04-29 21:43 - 2014-04-29 21:43 - 00054481 _____ () C:\Users\JF\Downloads\Addition (1).txt

2014-04-29 20:45 - 2014-04-29 20:45 - 00001086 _____ () C:\Users\JF\Downloads\Most recent threat scan results.txt

2014-04-29 19:05 - 2014-04-29 19:06 - 04615552 _____ (TeamViewer) C:\Users\JF\Downloads\TeamViewerQS_no.exe

2014-04-29 16:05 - 2014-04-29 16:05 - 00018359 _____ () C:\Windows\DirectX.log

2014-04-29 15:32 - 2014-04-29 15:32 - 00277536 _____ () C:\Windows\Minidump\042914-11856-01.dmp

2014-04-28 22:52 - 2014-04-29 15:34 - 00000000 ____D () C:\Users\JF\Desktop\New folder (2)

2014-04-28 22:20 - 2014-04-28 22:21 - 00056170 _____ () C:\Users\JF\Downloads\FRST.txt

2014-04-28 22:20 - 2014-04-28 22:21 - 00049353 _____ () C:\Users\JF\Downloads\Addition.txt

2014-04-28 22:18 - 2014-05-02 18:53 - 00000000 ____D () C:\FRST

2014-04-28 19:31 - 2014-05-02 16:56 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2014-04-28 19:31 - 2014-04-28 19:31 - 00001106 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-04-28 19:31 - 2014-04-28 19:31 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-04-28 19:31 - 2014-04-28 19:31 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-04-28 19:31 - 2014-04-03 09:51 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2014-04-28 19:31 - 2014-04-03 09:50 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2014-04-28 19:30 - 2014-04-28 19:30 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\JF\Downloads\mbam-setup-2.0.1.1004 (3).exe

2014-04-28 18:59 - 2014-04-28 18:59 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\JF\Downloads\mbam-setup-2.0.1.1004 (2).exe

2014-04-28 18:38 - 2014-04-28 18:38 - 00277536 _____ () C:\Windows\Minidump\042814-15662-01.dmp

2014-04-28 18:32 - 2014-04-28 18:32 - 00277536 _____ () C:\Windows\Minidump\042814-15272-01.dmp

2014-04-28 17:19 - 2014-04-28 17:19 - 04164448 _____ (Kaspersky Lab ZAO) C:\Users\JF\Downloads\tdsskiller (1).exe

2014-04-28 17:18 - 2014-04-28 17:18 - 00277536 _____ () C:\Windows\Minidump\042814-13072-01.dmp

2014-04-28 17:07 - 2014-04-28 17:07 - 04164448 _____ (Kaspersky Lab ZAO) C:\Users\JF\Downloads\tdsskiller.exe

2014-04-28 16:46 - 2014-04-28 16:46 - 00277536 _____ () C:\Windows\Minidump\042814-10920-01.dmp

2014-04-28 16:43 - 2014-04-28 16:43 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\JF\Downloads\mbam-setup-2.0.1.1004 (1).exe

2014-04-28 16:37 - 2014-04-28 16:37 - 00000806 _____ () C:\Users\JF\Downloads\FixExe.reg

2014-04-28 16:30 - 2014-04-28 16:30 - 01933048 _____ (Bleeping Computer, LLC) C:\Users\JF\Downloads\rkill.exe

2014-04-28 16:20 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll

2014-04-28 16:19 - 2014-04-28 16:19 - 01329501 _____ () C:\Users\JF\Downloads\AdwCleaner.exe

2014-04-28 15:39 - 2014-04-28 15:40 - 18835768 _____ (SUPERAntiSpyware) C:\Users\JF\Downloads\SUPERAntiSpyware.exe

2014-04-28 15:32 - 2014-04-28 15:32 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\JF\Downloads\mbam-setup-2.0.1.1004.exe

2014-04-28 14:45 - 2014-04-28 15:22 - 00000000 ____D () C:\Users\JF\AppData\Roaming\Device Doctor Pro

2014-04-28 14:45 - 2014-04-28 15:22 - 00000000 ____D () C:\Program Files (x86)\Device Doctor Pro

2014-04-28 14:43 - 2014-04-28 14:43 - 00000000 ____D () C:\Program Files (x86)\NuGet

2014-04-28 14:39 - 2014-04-28 14:39 - 00000000 ____D () C:\Users\JF\Documents\Visual Studio 2013

2014-04-28 14:38 - 2014-04-28 14:38 - 00277536 _____ () C:\Windows\Minidump\042814-16036-01.dmp

2014-04-28 14:36 - 2014-04-28 15:22 - 00000000 ____D () C:\Program Files (x86)\Microsoft SDKs

2014-04-28 14:36 - 2014-04-28 14:37 - 00000000 ____D () C:\Program Files (x86)\Windows Kits

2014-04-28 14:36 - 2014-04-28 14:36 - 00000000 ____D () C:\Program Files (x86)\Microsoft Help Viewer

2014-04-28 14:35 - 2014-04-28 15:22 - 00000000 ____D () C:\Program Files\Microsoft SQL Server

2014-04-28 14:35 - 2014-04-28 15:22 - 00000000 ____D () C:\Program Files (x86)\Microsoft SQL Server

2014-04-28 14:35 - 2014-04-28 14:35 - 00000000 ____D () C:\Windows\SysWOW64\1033

2014-04-28 14:35 - 2014-04-28 14:35 - 00000000 ____D () C:\Windows\system32\1033

2014-04-28 14:35 - 2014-04-28 14:35 - 00000000 ____D () C:\Program Files\Microsoft SQL Server Compact Edition

2014-04-28 14:26 - 2014-04-28 14:26 - 00000000 __SHD () C:\Users\JF\AppData\Local\EmieUserList

2014-04-28 14:26 - 2014-04-28 14:26 - 00000000 __SHD () C:\Users\JF\AppData\Local\EmieSiteList

2014-04-28 14:25 - 2014-04-28 14:25 - 00991928 _____ (Microsoft Corporation) C:\Users\JF\Downloads\wdksetup (1).exe

2014-04-28 14:23 - 2014-04-28 14:23 - 00000000 ___SD () C:\Windows\system32\CompatTel

2014-04-28 14:22 - 2014-04-28 14:22 - 01036872 _____ (Microsoft Corporation) C:\Users\JF\Downloads\wdexpress_full.exe

2014-04-28 14:22 - 2014-04-28 14:22 - 00991928 _____ (Microsoft Corporation) C:\Users\JF\Downloads\wdksetup.exe

2014-04-28 14:20 - 2014-04-14 04:24 - 00465408 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll

2014-04-28 14:20 - 2014-04-14 04:19 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

2014-04-28 14:04 - 2014-04-28 14:05 - 00277536 _____ () C:\Windows\Minidump\042814-15600-01.dmp

2014-04-27 11:56 - 2014-04-27 11:56 - 00277536 _____ () C:\Windows\Minidump\042714-14274-01.dmp

2014-04-27 02:25 - 2014-03-06 12:21 - 23549440 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-04-27 02:25 - 2014-03-06 11:32 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-04-27 02:25 - 2014-03-06 11:31 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll

2014-04-27 02:25 - 2014-03-06 11:19 - 17387008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-04-27 02:25 - 2014-03-06 10:59 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2014-04-27 02:25 - 2014-03-06 10:57 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2014-04-27 02:25 - 2014-03-06 10:57 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll

2014-04-27 02:25 - 2014-03-06 10:53 - 02767360 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2014-04-27 02:25 - 2014-03-06 10:40 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2014-04-27 02:25 - 2014-03-06 10:39 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2014-04-27 02:25 - 2014-03-06 10:32 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-04-27 02:25 - 2014-03-06 10:32 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2014-04-27 02:25 - 2014-03-06 10:29 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2014-04-27 02:25 - 2014-03-06 10:29 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe

2014-04-27 02:25 - 2014-03-06 10:28 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2014-04-27 02:25 - 2014-03-06 10:15 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe

2014-04-27 02:25 - 2014-03-06 10:11 - 05784064 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2014-04-27 02:25 - 2014-03-06 10:09 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll

2014-04-27 02:25 - 2014-03-06 10:03 - 00586240 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2014-04-27 02:25 - 2014-03-06 10:02 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2014-04-27 02:25 - 2014-03-06 10:02 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2014-04-27 02:25 - 2014-03-06 10:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll

2014-04-27 02:25 - 2014-03-06 09:56 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll

2014-04-27 02:25 - 2014-03-06 09:48 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2014-04-27 02:25 - 2014-03-06 09:47 - 02178048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2014-04-27 02:25 - 2014-03-06 09:46 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2014-04-27 02:25 - 2014-03-06 09:46 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2014-04-27 02:25 - 2014-03-06 09:45 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2014-04-27 02:25 - 2014-03-06 09:42 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2014-04-27 02:25 - 2014-03-06 09:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2014-04-27 02:25 - 2014-03-06 09:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2014-04-27 02:25 - 2014-03-06 09:36 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll

2014-04-27 02:25 - 2014-03-06 09:22 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll

2014-04-27 02:25 - 2014-03-06 09:21 - 00628736 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2014-04-27 02:25 - 2014-03-06 09:13 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll

2014-04-27 02:25 - 2014-03-06 09:11 - 02043904 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2014-04-27 02:25 - 2014-03-06 09:07 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll

2014-04-27 02:25 - 2014-03-06 09:01 - 00244224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll

2014-04-27 02:25 - 2014-03-06 08:53 - 13551104 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2014-04-27 02:25 - 2014-03-06 08:46 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2014-04-27 02:25 - 2014-03-06 08:40 - 01967104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2014-04-27 02:25 - 2014-03-06 08:36 - 11745792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2014-04-27 02:25 - 2014-03-06 08:22 - 02260480 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2014-04-27 02:25 - 2014-03-06 07:58 - 01400832 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2014-04-27 02:25 - 2014-03-06 07:50 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2014-04-27 02:25 - 2014-03-06 07:43 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2014-04-27 02:25 - 2014-03-06 07:41 - 01789440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2014-04-27 02:25 - 2014-03-06 07:36 - 01143808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2014-04-27 00:45 - 2014-04-27 00:45 - 00277536 _____ () C:\Windows\Minidump\042714-12152-01.dmp

2014-04-25 23:44 - 2014-05-02 18:44 - 00000000 ____D () C:\Users\JF\AppData\Local\CrashDumps

2014-04-24 15:45 - 2014-04-24 15:45 - 00277536 _____ () C:\Windows\Minidump\042414-13447-01.dmp

2014-04-24 15:35 - 2014-04-24 15:35 - 00277536 _____ () C:\Windows\Minidump\042414-12776-01.dmp

2014-04-20 15:14 - 2014-04-20 15:14 - 00046098 _____ () C:\Users\JF\Downloads\155840.user.js

2014-04-19 11:14 - 2014-04-19 11:14 - 04787368 _____ (Piriform Ltd) C:\Users\JF\Downloads\ccsetup412.exe

2014-04-19 01:26 - 2014-04-19 01:26 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr

2014-04-19 01:26 - 2014-04-19 01:26 - 00029208 _____ () C:\Windows\system32\Drivers\aswHwid.sys

2014-04-19 01:23 - 2014-04-19 01:23 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe

2014-04-19 01:23 - 2014-04-19 01:23 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe

2014-04-19 01:23 - 2014-04-19 01:23 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe

2014-04-19 01:23 - 2014-04-19 01:23 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll

2014-04-19 01:23 - 2014-04-19 01:23 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java

2014-04-19 01:23 - 2014-04-19 01:23 - 00000000 ____D () C:\Program Files (x86)\Java

2014-04-19 01:22 - 2014-04-19 01:22 - 00921512 _____ (Oracle Corporation) C:\Users\JF\Downloads\chromeinstall-7u55 (1).exe

2014-04-19 01:21 - 2014-04-19 01:22 - 00004001 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_55-b14.log

2014-04-19 01:20 - 2014-04-19 01:21 - 00921512 _____ (Oracle Corporation) C:\Users\JF\Downloads\chromeinstall-7u55.exe

2014-04-19 01:09 - 2014-04-19 01:09 - 00000267 _____ () C:\Users\JF\Downloads\ATT00101.htm

2014-04-19 00:43 - 2014-04-19 00:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi

2014-04-09 11:47 - 2014-03-04 11:44 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll

2014-04-09 11:47 - 2014-03-04 11:44 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll

2014-04-09 11:47 - 2014-03-04 11:44 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll

2014-04-09 11:47 - 2014-03-04 11:44 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll

2014-04-09 11:47 - 2014-03-04 11:44 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll

2014-04-09 11:47 - 2014-03-04 11:17 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll

2014-04-09 11:47 - 2014-03-04 11:16 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll

2014-04-09 11:47 - 2014-03-04 11:16 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe

2014-04-09 11:47 - 2014-03-04 11:16 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll

2014-04-09 11:47 - 2014-03-04 10:09 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe

2014-04-09 11:47 - 2014-03-04 10:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe

2014-04-09 11:47 - 2014-02-04 04:35 - 00274880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys

2014-04-09 11:47 - 2014-02-04 04:35 - 00190912 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys

2014-04-09 11:47 - 2014-02-04 04:35 - 00027584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Diskdump.sys

2014-04-09 11:47 - 2014-02-04 04:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\iologmsg.dll

2014-04-09 11:47 - 2014-02-04 04:00 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iologmsg.dll

2014-04-09 11:47 - 2014-01-24 04:37 - 01684928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys

2014-04-07 17:43 - 2014-04-07 17:43 - 00057374 _____ () C:\Users\JF\Downloads\174037.user.js

 

==================== One Month Modified Files and Folders =======

 

2014-05-02 18:53 - 2014-05-02 18:53 - 00023600 _____ () C:\Users\JF\Desktop\FRST.txt

2014-05-02 18:53 - 2014-04-28 22:18 - 00000000 ____D () C:\FRST

2014-05-02 18:51 - 2012-09-15 10:30 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-05-02 18:51 - 2012-09-01 08:40 - 01925599 _____ () C:\Windows\WindowsUpdate.log

2014-05-02 18:48 - 2014-05-02 18:48 - 00277536 _____ () C:\Windows\Minidump\050214-14398-01.dmp

2014-05-02 18:48 - 2014-02-01 13:50 - 1153109149 _____ () C:\Windows\MEMORY.DMP

2014-05-02 18:48 - 2014-01-26 02:00 - 00004166 _____ () C:\Windows\setupact.log

2014-05-02 18:48 - 2012-10-22 14:50 - 00000000 ____D () C:\Users\JF\AppData\Local\LogMeIn Hamachi

2014-05-02 18:48 - 2012-10-03 17:24 - 00000000 ____D () C:\Windows\Minidump

2014-05-02 18:48 - 2012-09-06 18:26 - 00000000 ____D () C:\Users\JF\AppData\Roaming\Dropbox

2014-05-02 18:48 - 2012-09-01 21:29 - 00000000 ____D () C:\Users\JF\AppData\Roaming\Skype

2014-05-02 18:48 - 2012-09-01 18:19 - 00000000 ____D () C:\Users\JF\AppData\Roaming\Spotify

2014-05-02 18:48 - 2012-09-01 08:59 - 00000980 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-05-02 18:48 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-05-02 18:44 - 2014-04-25 23:44 - 00000000 ____D () C:\Users\JF\AppData\Local\CrashDumps

2014-05-02 18:43 - 2009-07-14 06:45 - 00014736 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-05-02 18:43 - 2009-07-14 06:45 - 00014736 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-05-02 18:42 - 2009-07-14 11:16 - 00495372 _____ () C:\Windows\system32\perfh014.dat

2014-05-02 18:42 - 2009-07-14 11:16 - 00098248 _____ () C:\Windows\system32\perfc014.dat

2014-05-02 18:42 - 2009-07-14 07:13 - 01369758 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-05-02 18:39 - 2012-09-01 09:33 - 00003904 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{3B65AA3E-3538-4E66-BAF5-DFE0C0489BDC}

2014-05-02 18:36 - 2014-05-02 18:36 - 00277536 _____ () C:\Windows\Minidump\050214-15600-01.dmp

2014-05-02 18:35 - 2014-05-02 18:35 - 02062336 _____ (Farbar) C:\Users\JF\Desktop\FRST64.exe

2014-05-02 18:28 - 2012-09-01 08:59 - 00000984 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-05-02 18:14 - 2012-09-01 18:21 - 00000000 ____D () C:\Users\JF\AppData\Local\Spotify

2014-05-02 18:13 - 2014-05-02 18:13 - 00277536 _____ () C:\Windows\Minidump\050214-12620-01.dmp

2014-05-02 18:12 - 2014-05-02 18:12 - 00277536 _____ () C:\Windows\Minidump\050214-11918-01.dmp

2014-05-02 18:08 - 2014-05-02 18:08 - 00277536 _____ () C:\Windows\Minidump\050214-13166-01.dmp

2014-05-02 18:07 - 2014-05-02 18:07 - 00003288 ____N () C:\bootsqm.dat

2014-05-02 17:34 - 2014-05-02 17:34 - 00277480 _____ () C:\Windows\Minidump\050214-11622-01.dmp

2014-05-02 17:29 - 2014-05-02 17:29 - 00000000 ____D () C:\Program Files (x86)\ESET

2014-05-02 17:28 - 2014-05-02 17:28 - 02347384 _____ (ESET) C:\Users\JF\Desktop\esetsmartinstaller_enu.exe

2014-05-02 17:26 - 2014-05-02 17:26 - 01310621 _____ () C:\Users\JF\Downloads\AdwCleaner (2).exe

2014-05-02 17:25 - 2014-02-01 13:50 - 00015602 _____ () C:\Windows\PFRO.log

2014-05-02 17:25 - 2009-07-14 06:45 - 05112624 _____ () C:\Windows\system32\FNTCACHE.DAT

2014-05-02 17:21 - 2014-05-02 17:16 - 00000000 ____D () C:\AdwCleaner

2014-05-02 17:16 - 2014-05-02 17:16 - 01310621 _____ () C:\Users\JF\Downloads\AdwCleaner (1).exe

2014-05-02 17:16 - 2014-05-02 17:16 - 01310621 _____ () C:\Users\JF\Desktop\AdwCleaner (1).exe

2014-05-02 17:12 - 2014-05-02 17:12 - 00001287 _____ () C:\Users\JF\Desktop\JRT.txt

2014-05-02 17:07 - 2014-05-02 17:07 - 00000000 ____D () C:\Windows\ERUNT

2014-05-02 17:03 - 2014-05-02 16:57 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)

2014-05-02 17:03 - 2014-05-02 16:56 - 00000000 ____D () C:\Users\JF\Desktop\mbar

2014-05-02 16:59 - 2014-05-02 16:59 - 01016261 _____ (Thisisu) C:\Users\JF\Downloads\JRT.exe

2014-05-02 16:59 - 2014-05-02 16:59 - 01016261 _____ (Thisisu) C:\Users\JF\Desktop\JRT.exe

2014-05-02 16:57 - 2014-03-24 18:53 - 00119000 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-05-02 16:56 - 2014-05-02 16:56 - 12589848 _____ (Malwarebytes Corp.) C:\Users\JF\Downloads\mbar-1.07.0.1009.exe

2014-05-02 16:56 - 2014-05-01 23:42 - 00000000 ____D () C:\Users\JF\Desktop\fix

2014-05-02 16:56 - 2014-04-28 19:31 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2014-05-02 09:03 - 2014-05-02 09:00 - 00000000 ____D () C:\Users\JF\Desktop\RK_Quarantine

2014-05-02 09:02 - 2014-05-02 09:02 - 00002780 _____ () C:\Users\JF\Desktop\RKreport[0]_S_05022014_090229.txt

2014-05-02 08:58 - 2014-05-02 09:00 - 04527616 _____ () C:\Users\JF\Desktop\RogueKillerX64.exe

2014-05-02 08:58 - 2014-05-02 08:58 - 04527616 _____ () C:\Users\JF\Downloads\RogueKillerX64.exe

2014-05-02 08:57 - 2013-11-12 23:44 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update

2014-05-02 08:57 - 2012-09-02 14:36 - 00000000 ____D () C:\Users\JF\AppData\Local\Adobe

2014-05-01 23:46 - 2014-05-01 23:46 - 00000000 ____D () C:\Windows\ERDNT

2014-05-01 23:46 - 2014-05-01 23:45 - 00000000 ____D () C:\Program Files (x86)\ERUNT

2014-05-01 23:45 - 2014-05-01 23:45 - 00791393 _____ (Lars Hederer ) C:\Users\JF\Downloads\erunt-setup.exe

2014-05-01 23:45 - 2014-05-01 23:45 - 00000928 _____ () C:\Users\JF\Desktop\NTREGOPT.lnk

2014-05-01 23:45 - 2014-05-01 23:45 - 00000909 _____ () C:\Users\JF\Desktop\ERUNT.lnk

2014-05-01 23:45 - 2014-05-01 23:45 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ERUNT

2014-05-01 23:45 - 2014-05-01 23:44 - 00007448 _____ () C:\Users\JF\Desktop\Rkill.txt

2014-05-01 23:42 - 2014-05-01 23:42 - 01933048 _____ (Bleeping Computer, LLC) C:\Users\JF\Downloads\rkill (1).exe

2014-05-01 23:42 - 2014-05-01 23:42 - 01933048 _____ (Bleeping Computer, LLC) C:\Users\JF\Desktop\rkill (1).exe

2014-05-01 23:34 - 2013-03-25 20:13 - 00000000 ____D () C:\Users\JF\Desktop\random

2014-05-01 22:41 - 2012-09-01 08:53 - 00110488 _____ () C:\Users\JF\AppData\Local\GDIPFONTCACHEV1.DAT

2014-05-01 22:06 - 2014-05-01 22:06 - 00001102 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 9.lnk

2014-05-01 22:05 - 2013-03-09 23:17 - 00000000 ____D () C:\Program Files (x86)\TeamViewer

2014-05-01 22:02 - 2014-05-01 22:02 - 04615552 _____ (TeamViewer) C:\Users\JF\Downloads\TeamViewerQS_no (1).exe

2014-05-01 21:57 - 2014-05-01 21:57 - 03145782 _____ () C:\Users\JF\Downloads\ScreenShot023.bmp

2014-05-01 21:50 - 2014-05-01 21:50 - 00005536 _____ () C:\Users\JF\Downloads\xpnetdiag.xml

2014-05-01 14:02 - 2014-05-01 14:02 - 00002850 _____ () C:\Users\JF\Downloads\AdwCleanerS0.txt

2014-05-01 12:48 - 2014-05-01 12:48 - 00277536 _____ () C:\Windows\Minidump\050114-11668-01.dmp

2014-05-01 11:52 - 2014-05-01 11:52 - 00277536 _____ () C:\Windows\Minidump\050114-12667-01.dmp

2014-04-29 21:43 - 2014-04-29 21:43 - 00054481 _____ () C:\Users\JF\Downloads\Addition (1).txt

2014-04-29 20:45 - 2014-04-29 20:45 - 00001086 _____ () C:\Users\JF\Downloads\Most recent threat scan results.txt

2014-04-29 19:21 - 2014-03-15 21:46 - 00000000 ____D () C:\Users\JF\AppData\Roaming\TS3Client

2014-04-29 19:06 - 2014-04-29 19:05 - 04615552 _____ (TeamViewer) C:\Users\JF\Downloads\TeamViewerQS_no.exe

2014-04-29 17:51 - 2012-09-15 10:30 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2014-04-29 17:51 - 2012-09-15 10:30 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2014-04-29 17:51 - 2012-09-15 10:30 - 00003768 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater

2014-04-29 16:05 - 2014-04-29 16:05 - 00018359 _____ () C:\Windows\DirectX.log

2014-04-29 15:34 - 2014-04-28 22:52 - 00000000 ____D () C:\Users\JF\Desktop\New folder (2)

2014-04-29 15:32 - 2014-04-29 15:32 - 00277536 _____ () C:\Windows\Minidump\042914-11856-01.dmp

2014-04-29 15:29 - 2009-07-14 07:08 - 00032542 _____ () C:\Windows\Tasks\SCHEDLGU.TXT

2014-04-28 22:21 - 2014-04-28 22:20 - 00056170 _____ () C:\Users\JF\Downloads\FRST.txt

2014-04-28 22:21 - 2014-04-28 22:20 - 00049353 _____ () C:\Users\JF\Downloads\Addition.txt

2014-04-28 19:31 - 2014-04-28 19:31 - 00001106 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-04-28 19:31 - 2014-04-28 19:31 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-04-28 19:31 - 2014-04-28 19:31 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-04-28 19:30 - 2014-04-28 19:30 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\JF\Downloads\mbam-setup-2.0.1.1004 (3).exe

2014-04-28 18:59 - 2014-04-28 18:59 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\JF\Downloads\mbam-setup-2.0.1.1004 (2).exe

2014-04-28 18:58 - 2012-09-11 17:53 - 00000000 _____ () C:\Windows\system32\Drivers\lvuvc.hs

2014-04-28 18:57 - 2009-07-14 07:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games

2014-04-28 18:56 - 2012-09-01 09:16 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ASUS

2014-04-28 18:56 - 2012-09-01 09:16 - 00000000 ____D () C:\Program Files (x86)\ASUS

2014-04-28 18:56 - 2012-09-01 09:01 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information

2014-04-28 18:56 - 2012-09-01 04:42 - 00000000 ____D () C:\Windows\System32\Tasks\ASUS

2014-04-28 18:55 - 2012-12-09 23:16 - 00000000 ____D () C:\Users\JF\AppData\Local\Black_Tree_Gaming

2014-04-28 18:51 - 2013-09-24 16:35 - 00000000 ____D () C:\ProgramData\Package Cache

2014-04-28 18:51 - 2009-07-14 07:32 - 00000000 ____D () C:\Program Files (x86)\MSBuild

2014-04-28 18:38 - 2014-04-28 18:38 - 00277536 _____ () C:\Windows\Minidump\042814-15662-01.dmp

2014-04-28 18:32 - 2014-04-28 18:32 - 00277536 _____ () C:\Windows\Minidump\042814-15272-01.dmp

2014-04-28 18:18 - 2009-07-14 06:57 - 00001547 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk

2014-04-28 17:19 - 2014-04-28 17:19 - 04164448 _____ (Kaspersky Lab ZAO) C:\Users\JF\Downloads\tdsskiller (1).exe

2014-04-28 17:18 - 2014-04-28 17:18 - 00277536 _____ () C:\Windows\Minidump\042814-13072-01.dmp

2014-04-28 17:07 - 2014-04-28 17:07 - 04164448 _____ (Kaspersky Lab ZAO) C:\Users\JF\Downloads\tdsskiller.exe

2014-04-28 16:46 - 2014-04-28 16:46 - 00277536 _____ () C:\Windows\Minidump\042814-10920-01.dmp

2014-04-28 16:43 - 2014-04-28 16:43 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\JF\Downloads\mbam-setup-2.0.1.1004 (1).exe

2014-04-28 16:37 - 2014-04-28 16:37 - 00000806 _____ () C:\Users\JF\Downloads\FixExe.reg

2014-04-28 16:30 - 2014-04-28 16:30 - 01933048 _____ (Bleeping Computer, LLC) C:\Users\JF\Downloads\rkill.exe

2014-04-28 16:19 - 2014-04-28 16:19 - 01329501 _____ () C:\Users\JF\Downloads\AdwCleaner.exe

2014-04-28 15:40 - 2014-04-28 15:39 - 18835768 _____ (SUPERAntiSpyware) C:\Users\JF\Downloads\SUPERAntiSpyware.exe

2014-04-28 15:32 - 2014-04-28 15:32 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\JF\Downloads\mbam-setup-2.0.1.1004.exe

2014-04-28 15:27 - 2012-09-01 08:40 - 00000000 ____D () C:\Users\JF

2014-04-28 15:22 - 2014-04-28 14:45 - 00000000 ____D () C:\Users\JF\AppData\Roaming\Device Doctor Pro

2014-04-28 15:22 - 2014-04-28 14:45 - 00000000 ____D () C:\Program Files (x86)\Device Doctor Pro

2014-04-28 15:22 - 2014-04-28 14:36 - 00000000 ____D () C:\Program Files (x86)\Microsoft SDKs

2014-04-28 15:22 - 2014-04-28 14:35 - 00000000 ____D () C:\Program Files\Microsoft SQL Server

2014-04-28 15:22 - 2014-04-28 14:35 - 00000000 ____D () C:\Program Files (x86)\Microsoft SQL Server

2014-04-28 15:22 - 2012-09-15 10:00 - 00000000 ____D () C:\Users\JF\AppData\Roaming\vlc

2014-04-28 15:22 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\registration

2014-04-28 14:43 - 2014-04-28 14:43 - 00000000 ____D () C:\Program Files (x86)\NuGet

2014-04-28 14:39 - 2014-04-28 14:39 - 00000000 ____D () C:\Users\JF\Documents\Visual Studio 2013

2014-04-28 14:38 - 2014-04-28 14:38 - 00277536 _____ () C:\Windows\Minidump\042814-16036-01.dmp

2014-04-28 14:37 - 2014-04-28 14:36 - 00000000 ____D () C:\Program Files (x86)\Windows Kits

2014-04-28 14:36 - 2014-04-28 14:36 - 00000000 ____D () C:\Program Files (x86)\Microsoft Help Viewer

2014-04-28 14:35 - 2014-04-28 14:35 - 00000000 ____D () C:\Windows\SysWOW64\1033

2014-04-28 14:35 - 2014-04-28 14:35 - 00000000 ____D () C:\Windows\system32\1033

2014-04-28 14:35 - 2014-04-28 14:35 - 00000000 ____D () C:\Program Files\Microsoft SQL Server Compact Edition

2014-04-28 14:35 - 2012-12-24 00:06 - 00000000 ____D () C:\Program Files (x86)\Microsoft SQL Server Compact Edition

2014-04-28 14:32 - 2013-09-10 22:20 - 00000000 ____D () C:\Windows\pss

2014-04-28 14:26 - 2014-04-28 14:26 - 00000000 __SHD () C:\Users\JF\AppData\Local\EmieUserList

2014-04-28 14:26 - 2014-04-28 14:26 - 00000000 __SHD () C:\Users\JF\AppData\Local\EmieSiteList

2014-04-28 14:25 - 2014-04-28 14:25 - 00991928 _____ (Microsoft Corporation) C:\Users\JF\Downloads\wdksetup (1).exe

2014-04-28 14:24 - 2012-09-01 04:54 - 00052469 _____ () C:\ProgramData\Gpu.log

2014-04-28 14:23 - 2014-04-28 14:23 - 00000000 ___SD () C:\Windows\system32\CompatTel

2014-04-28 14:22 - 2014-04-28 14:22 - 01036872 _____ (Microsoft Corporation) C:\Users\JF\Downloads\wdexpress_full.exe

2014-04-28 14:22 - 2014-04-28 14:22 - 00991928 _____ (Microsoft Corporation) C:\Users\JF\Downloads\wdksetup.exe

2014-04-28 14:05 - 2014-04-28 14:04 - 00277536 _____ () C:\Windows\Minidump\042814-15600-01.dmp

2014-04-27 11:56 - 2014-04-27 11:56 - 00277536 _____ () C:\Windows\Minidump\042714-14274-01.dmp

2014-04-27 11:54 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions

2014-04-27 00:45 - 2014-04-27 00:45 - 00277536 _____ () C:\Windows\Minidump\042714-12152-01.dmp

2014-04-25 23:38 - 2012-09-01 19:02 - 00000024 _____ () C:\Users\JF\random.dat

2014-04-24 20:21 - 2012-09-01 19:02 - 00000041 _____ () C:\Users\JF\jagex_cl_runescape_LIVE.dat

2014-04-24 15:45 - 2014-04-24 15:45 - 00277536 _____ () C:\Windows\Minidump\042414-13447-01.dmp

2014-04-24 15:35 - 2014-04-24 15:35 - 00277536 _____ () C:\Windows\Minidump\042414-12776-01.dmp

2014-04-21 22:53 - 2013-10-14 15:30 - 00000000 ____D () C:\Users\JF\AppData\Local\Battle.net

2014-04-20 15:14 - 2014-04-20 15:14 - 00046098 _____ () C:\Users\JF\Downloads\155840.user.js

2014-04-19 22:35 - 2013-10-14 15:47 - 00000000 ____D () C:\Program Files (x86)\Hearthstone

2014-04-19 22:16 - 2012-09-01 09:18 - 00000866 _____ () C:\Users\Public\Desktop\CCleaner.lnk

2014-04-19 21:47 - 2012-09-01 04:51 - 04598224 _____ () C:\Windows\PE_Rom.dll

2014-04-19 21:39 - 2012-09-01 08:59 - 00000000 ____D () C:\Program Files (x86)\Google

2014-04-19 11:15 - 2012-11-10 18:03 - 00000000 ____D () C:\Users\JF\AppData\Roaming\uTorrent

2014-04-19 11:14 - 2014-04-19 11:14 - 04787368 _____ (Piriform Ltd) C:\Users\JF\Downloads\ccsetup412.exe

2014-04-19 11:14 - 2012-09-01 09:18 - 00000000 ____D () C:\Program Files\CCleaner

2014-04-19 01:26 - 2014-04-19 01:26 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr

2014-04-19 01:26 - 2014-04-19 01:26 - 00029208 _____ () C:\Windows\system32\Drivers\aswHwid.sys

2014-04-19 01:26 - 2014-01-05 17:57 - 00085328 _____ (AVAST Software) C:\Windows\system32\Drivers\aswstm.sys

2014-04-19 01:26 - 2013-10-23 19:35 - 01039096 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys

2014-04-19 01:26 - 2013-10-23 19:35 - 00423240 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys

2014-04-19 01:26 - 2013-10-23 19:35 - 00334648 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe

2014-04-19 01:26 - 2013-10-23 19:35 - 00208416 _____ () C:\Windows\system32\Drivers\aswVmm.sys

2014-04-19 01:26 - 2013-10-23 19:35 - 00093568 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys

2014-04-19 01:26 - 2013-10-23 19:35 - 00079184 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys

2014-04-19 01:26 - 2013-10-23 19:35 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys

2014-04-19 01:26 - 2013-10-23 19:35 - 00001036 _____ () C:\Users\Public\Desktop\avast! Free Antivirus.lnk

2014-04-19 01:24 - 2013-10-17 22:30 - 00000000 ____D () C:\ProgramData\Oracle

2014-04-19 01:23 - 2014-04-19 01:23 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe

2014-04-19 01:23 - 2014-04-19 01:23 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe

2014-04-19 01:23 - 2014-04-19 01:23 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe

2014-04-19 01:23 - 2014-04-19 01:23 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll

2014-04-19 01:23 - 2014-04-19 01:23 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java

2014-04-19 01:23 - 2014-04-19 01:23 - 00000000 ____D () C:\Program Files (x86)\Java

2014-04-19 01:22 - 2014-04-19 01:22 - 00921512 _____ (Oracle Corporation) C:\Users\JF\Downloads\chromeinstall-7u55 (1).exe

2014-04-19 01:22 - 2014-04-19 01:21 - 00004001 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_55-b14.log

2014-04-19 01:21 - 2014-04-19 01:20 - 00921512 _____ (Oracle Corporation) C:\Users\JF\Downloads\chromeinstall-7u55.exe

2014-04-19 01:09 - 2014-04-19 01:09 - 00000267 _____ () C:\Users\JF\Downloads\ATT00101.htm

2014-04-19 00:43 - 2014-04-19 00:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi

2014-04-19 00:43 - 2013-10-06 15:14 - 00000447 _____ () C:\Users\Public\Desktop\LogMeIn Hamachi.lnk

2014-04-14 04:24 - 2014-04-28 14:20 - 00465408 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll

2014-04-14 04:19 - 2014-04-28 14:20 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

2014-04-11 14:42 - 2012-09-01 09:38 - 00000000 ____D () C:\ProgramData\Adobe

2014-04-11 14:42 - 2012-09-01 04:49 - 00000000 ____D () C:\Users\JF\AppData\Roaming\Adobe

2014-04-09 23:32 - 2012-09-01 09:26 - 00000000 ____D () C:\ProgramData\Microsoft Help

2014-04-09 23:31 - 2013-08-15 00:06 - 00000000 ____D () C:\Windows\system32\MRT

2014-04-09 23:30 - 2012-09-01 09:35 - 90655440 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2014-04-07 17:43 - 2014-04-07 17:43 - 00057374 _____ () C:\Users\JF\Downloads\174037.user.js

2014-04-06 12:50 - 2012-11-25 15:45 - 00000000 ____D () C:\Program Files (x86)\Opera

2014-04-03 23:33 - 2012-09-01 09:37 - 00001945 _____ () C:\Windows\epplauncher.mif

2014-04-03 23:33 - 2012-09-01 08:51 - 00002117 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk

2014-04-03 23:32 - 2012-09-01 08:51 - 00000000 ____D () C:\Program Files\Microsoft Security Client

2014-04-03 23:32 - 2012-09-01 08:51 - 00000000 ____D () C:\Program Files (x86)\Microsoft Security Client

2014-04-03 22:28 - 2012-09-01 19:49 - 00000042 _____ () C:\Users\JF\jagex_cl_runescape_LIVE1.dat

2014-04-03 09:51 - 2014-04-28 19:31 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2014-04-03 09:50 - 2014-04-28 19:31 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

 

Files to move or delete:

====================

C:\Users\JF\AppData\Roaming\Camdata.ini

C:\Users\JF\AppData\Roaming\CamLayout.ini

C:\Users\JF\AppData\Roaming\CamShapes.ini

C:\Users\JF\jagex_cl_oldschool_LIVE.dat

C:\Users\JF\jagex_cl_runescape_LIVE.dat

C:\Users\JF\jagex_cl_runescape_LIVE1.dat

C:\Users\JF\jagex_cl_runescape_LIVE2.dat

C:\Users\JF\jagex_cl_runescape_LIVE_BETA.dat

C:\Users\JF\jagex_cl_runescape_LIVE_BETA1.dat

C:\Users\JF\random.dat

 

 

Some content of TEMP:

====================

C:\Users\JF\AppData\Local\Temp\Creative Cloud Helper.exe

C:\Users\JF\AppData\Local\Temp\CreativeCloudSet-Up.exe

C:\Users\JF\AppData\Local\Temp\ntdll_dump.dll

C:\Users\JF\AppData\Local\Temp\qc_a402013b_7656_4f6f_b57f_5a8ef69f5fc4_32.exe

C:\Users\JF\AppData\Local\Temp\Quarantine.exe

C:\Users\JF\AppData\Local\Temp\SkypeSetup.exe

 

 

==================== Bamital & volsnap Check =================

 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe

[2012-09-01 09:34] - [2012-09-01 04:48] - 2871808 ____A (Microsoft Corporation) 65DE61A95D4F5CD4E7ED63EC6344CBF0

 

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\rpcss.dll => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

 

 

LastRegBack: 2013-05-04 11:35

 

==================== End Of Log ============================

Addition.txt

Link to post
Share on other sites

  • Root Admin

Please go into Control Panel, Add/Remove and uninstall ALL versions of Java and then run the following.
 
Please download JavaRa-1.16 and save it to your computer.

  • Double click to open the zip file and then select all and choose Copy.
  • Create a new folder on your Desktop named RemoveJava and paste the files into this new folder.
  • Quit all browsers and other running applications.
  • Right-click on JavaRa.exe in RemoveJava folder and choose Run as administrator to start the program.
  • From the drop-down menu, choose English and click on Select.
  • JavaRa will open; click on Remove Older Versions to remove the older versions of Java installed on your computer.
  • Click Yes when prompted. When JavaRa is done, a notice will appear that a logfile has been produced. Click OK.
  • A logfile will pop up. Please save it to a convenient location and post it in your next reply.

 

 

Next, Please visit this webpage and read the ComboFix User's Guide:

  • Once you've read the article and are ready to use the program you can download it directly from the link below.
  • Important! - Please make sure you save combofix to your desktop and do not run it from your browser
  • Direct download link for: ComboFix.exe
  • Please make sure you disable your security applications before running ComboFix.
  • Once Combofix has completed it will produce and open a log file.  Please be patient as it can take some time to load.
  • Please attach that log file to your next reply.
  • If needed the file can be located here:  C:\combofix.txt
  • NOTE: If you receive the message "illegal operation has been attempted on a registry key that has been marked for deletion", just reboot the computer.


 

Link to post
Share on other sites

Good morning Ron,
I uninstalled Java without problems and run the ComboFix scan. CF found some infections, but what is weird is that the program never mentioned anything about the Recovery Console. Something else worth mentioning is that right after CF opened the log file, I got a blue screen, and then my computer did a disk control.

Here are the scan results:

 

JavaRa 1.16 Removal Log.
 
Report follows after line.
 
------------------------------------
 
The JavaRa removal process was started on Sat May 03 08:58:24 2014
 
Found and removed: SOFTWARE\Classes\CLSID\{08B0E5C0-4FCB-11CF-AAA5-00401C608501}
 
Found and removed: SOFTWARE\Classes\CLSID\{5852F5ED-8BF4-11D4-A245-0080C6F74284}
 
Found and removed: SOFTWARE\Classes\CLSID\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}
 
Found and removed: SOFTWARE\Classes\CLSID\{DBC80044-A445-435b-BC74-9C25C1C588A9}
 
Found and removed: SOFTWARE\Classes\Interface\{5852F5EC-8BF4-11D4-A245-0080C6F74284}
 
Found and removed: SOFTWARE\Classes\MIME\Database\Content Type\application/java-deployment-toolkit
 
Found and removed: SOFTWARE\Classes\TypeLib\{5852F5E0-8BF4-11D4-A245-0080C6F74284}
 
Found and removed: SOFTWARE\Classes\JavaWebStart.isInstalled
 
Found and removed: SOFTWARE\Classes\JavaWebStart.isInstalled.1.7.0.0
 
Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
 
Found and removed: SOFTWARE\JavaSoft
 
Found and removed: SOFTWARE\JreMetrics
 
Found and removed: SOFTWARE\MozillaPlugins
 
------------------------------------
 
Finished reporting.
 
 
 

ComboFix.txt

Link to post
Share on other sites

  • Root Admin

The file you attached was not the Combofix.txt file.  It is a binary file.

 

Please restart the computer and then run the following. 

 

Please open Malwarebytes Anti-Malware and from the Dashboard please Check for Updates by clicking the Update Now... link
Open up Malwarebytes > Settings > Detection and Protection > Under Non Malware Protection set both PUP and PUM to Treat detections as malware.
Click on the SCAN button and run a Threat Scan with Malwarebytes Anti-Malware by clicking the Scan Now>> button.
Once completed please click on the History > Application Logs and find your scan log and open it and then click on the "copy to clipboard" button and post back the results on your next reply.
 

Link to post
Share on other sites

Hey again Ron,

 

As I said in my last response, I am unable to open malwarebytes, this is what happens. 
 

I try to run MalwareBytes.exe, in window task manager, I look on processes and see MBAM.exe *32 appear, but after a few sec it disapears..

I've also tried to open all #13 of the Chameleons from chameleon.chm without any results.

 

What should I do next?

 

Link to post
Share on other sites

Malwarebytes Anti-Malware
www.malwarebytes.org
 
Scan Date: 04/05/2014
Scan Time: 23:20:08
Logfile: 
Administrator: Yes
 
Version: 2.00.1.1004
Malware Database: v2014.05.04.09
Rootkit Database: v2014.03.27.01
License: Trial
Malware Protection: Enabled
Malicious Website Protection: Enabled
Chameleon: Disabled
 
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: JF
 
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 297260
Time Elapsed: 4 min, 33 sec
 
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Shuriken: Enabled
PUP: Enabled
PUM: Enabled
 
Processes: 0
(No malicious items detected)
 
Modules: 0
(No malicious items detected)
 
Registry Keys: 0
(No malicious items detected)
 
Registry Values: 0
(No malicious items detected)
 
Registry Data: 0
(No malicious items detected)
 
Folders: 0
(No malicious items detected)
 
Files: 0
(No malicious items detected)
 
Physical Sectors: 0
(No malicious items detected)
 
 
(end)

 
Link to post
Share on other sites

  • Root Admin

My fault. Sorry about that - I was hoping you'd see and install the beta.  Please follow the directions below but this time install the latest beta and enable the Anti-Rootkit scan and post back the new log when ready.

Thank You

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.