Name not available?!?

Noelz · May 23, 2014

Hi,

A couple days ago, I downloaded DosBox along with a game in a zip file, and ever since then, the sound on my pc would just lag. Until I checked the volume mixer, and it says 'no name available'. When I unmuted the sound, I could hear things like adverts being played, but no windows are open on the pc. I've tried to use Malwarebytes to remove it, but it says that there are no threats. But the problem still remains on the computer!

Any sort of help will be appreciated,

Thanks

B-boy/StyLe/ · May 23, 2014

Hello! Welcome to Malwarebytes Forums!
My name is Georgi and and I will be helping you with your computer problems.

Before we begin, please note the following:

I will working be on your Malware issues, this may or may not, solve other issues you have with your machine.
The logs can take some time to research, so please be patient with me.
Stay with the topic until I tell you that your system is clean. Missing symptoms does not mean that everything is okay.
Instructions that I give are for your system only!
Please do not run any tools until requested ! The reason for this is so I know what is going on with the machine at any time. Some programs can interfere with others and hamper the recovery process.
Please perform all steps in the order received. If you can't understand something don't hesitate to ask.
Again I would like to remind you to make no further changes to your computer unless I direct you to do so. I will not help you if you do not follow my instructions.

Please download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

Double-click to run it. When the tool opens click Yes to disclaimer.
Press Scan button.
It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

Also please re-run FRST again and type the following in the edit box after Search: rpcss.dll
Click the Search button
It will make a log (Search.txt)- please post the log into your reply to me.

Regards,

Georgi

Noelz · May 24, 2014

Thanks Georgi

First Log:

==================== Processes (Whitelisted) =================

(Microsoft Corp.) C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktopUpdater.exe
(Alcatel-Lucent) C:\Program Files (x86)\BT Broadband Desktop Help\btbb\MA\8.4.0.53.bt.0.7\ma\bin\MAHostService.exe
(Ellora Assets Corp.) C:\Program Files (x86)\Freemake\CaptureLib\CaptureLibService.exe
(Joyent, Inc) C:\Program Files (x86)\BT Broadband Desktop Help\btbb\MA\8.4.0.53.bt.0.7\ma\bin\node.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe
(McAfee, Inc.) C:\Windows\System32\mfevtps.exe
(Alcatel-Lucent) C:\Program Files (x86)\Common Files\Motive\pcCMService.exe
(Alcatel-Lucent) C:\Program Files\Common Files\Motive\pcCMService.exe
(PC Tools) C:\Program Files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe
(AVG Secure Search) C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.1.0\ToolbarUpdater.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Yahoo! Inc.) C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe
() C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.1.0\loggingserver.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(McAfee, Inc.) C:\Program Files\McAfee\MSC\McAPExe.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\AMCore\mcshield.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe
() C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe
(Alcatel-Lucent) C:\Program Files\BT Broadband Desktop Help\btbb\BTHelpNotifier.exe
(WinZip Computing International, LLC) C:\Program Files\File Association Helper\FAHWindow.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe
(Alcatel-Lucent) C:\Program Files (x86)\BT Broadband Desktop Help\btbb\BTHelpBrowser.exe
(Alcatel-Lucent) C:\Program Files (x86)\Common Files\Motive\pcContextHookShim.exe
(Microsoft Corporation) C:\Windows\System32\StikyNot.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\hp\Digital Imaging\bin\hpqtra08.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.141\SSScheduler.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(PC Tools) C:\Program Files (x86)\Common Files\PC Tools\sMonitor\SSDMonitor.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE
(Research In Motion Limited) C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Odometer\hpsysdrv.exe
(Research In Motion Limited) C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe
(Hewlett-Packard) C:\Program Files (x86)\hp\HP Software Update\hpwuschd2.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\Platform\McUICnt.exe
(CyberLink) C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe
() C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\hp\Digital Imaging\bin\hpqste08.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\hp\Digital Imaging\bin\hpqbam08.exe
(Hewlett-Packard) C:\Program Files (x86)\hp\Digital Imaging\bin\hpqgpc01.exe
(Alcatel-Lucent) C:\Program Files\Common Files\Motive\pcControlHost.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
() C:\Users\CRESCENTIA\AppData\Local\IdleCrawler\IdleCrawler.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee\SiteAdvisor\saUI.exe
(Google Inc.) C:\Users\Noel\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Noel\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Noel\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Noel\AppData\Local\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee\SiteAdvisor\McChHost.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil64_13_0_0_214_ActiveX.exe
(McAfee, Inc.) C:\Program Files\McAfee\MSM\McSmtFwk.exe
(Alcatel-Lucent) C:\Program Files (x86)\BT Broadband Desktop Help\btbb\BTHelpBrowser.exe
(Alcatel-Lucent) C:\Program Files (x86)\BT Broadband Desktop Help\btbb\BTHelpBrowser.exe
(Alcatel-Lucent) C:\Program Files (x86)\BT Broadband Desktop Help\btbb\BTHelpBrowser.exe
(Alcatel-Lucent) C:\Program Files (x86)\BT Broadband Desktop Help\btbb\BTHelpBrowser.exe
(Alcatel-Lucent) C:\Program Files (x86)\BT Broadband Desktop Help\btbb\BTHelpBrowser.exe
(Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe
(Google Inc.) C:\Users\CRESCENTIA\AppData\Local\IdleCrawler\Chrome-bin\chrome.exe
(Google Inc.) C:\Users\CRESCENTIA\AppData\Local\IdleCrawler\Chrome-bin\chrome.exe
(Google Inc.) C:\Users\CRESCENTIA\AppData\Local\IdleCrawler\Chrome-bin\chrome.exe
(Google Inc.) C:\Users\CRESCENTIA\AppData\Local\IdleCrawler\Chrome-bin\chrome.exe
(Google Inc.) C:\Users\CRESCENTIA\AppData\Local\IdleCrawler\Chrome-bin\chrome.exe
(Google Inc.) C:\Users\CRESCENTIA\AppData\Local\IdleCrawler\Chrome-bin\chrome.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [smartMenu] => C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe [610360 2009-09-14] ()
HKLM\...\Run: [PC-Doctor for Windows localizer] => C:\Program Files\PC-Doctor for Windows\localizer.exe [95728 2009-09-17] (PC-Doctor, Inc.)
HKLM\...\Run: [FAHConsole] => C:\Program Files\File Association Helper\FAHConsole.exe [216248 2013-09-26] (WinZip Computing International, LLC)
HKLM\...\Run: [btbb_McciTrayApp] => C:\Program Files\BT Broadband Desktop Help\btbb\BTHelpNotifier.exe [2860856 2013-11-11] (Alcatel-Lucent)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [NPSStartup] => [X]
HKLM-x32\...\Run: [sunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [sSDMonitor] => C:\Program Files (x86)\Common Files\PC Tools\sMonitor\SSDMonitor.exe [104408 2010-08-05] (PC Tools)
HKLM-x32\...\Run: [RIMBBLaunchAgent.exe] => C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe [267792 2013-01-17] (Research In Motion Limited)
HKLM-x32\...\Run: [NortonOnlineBackupReminder] => C:\Program Files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe [600936 2009-06-29] (Symantec Corporation)
HKLM-x32\...\Run: [mcui_exe] => C:\Program Files\McAfee.com\Agent\mcagent.exe [537992 2014-04-25] (McAfee, Inc.)
HKLM-x32\...\Run: [mcpltui_exe] => C:\Program Files\McAfee.com\Agent\mcagent.exe [537992 2014-04-25] (McAfee, Inc.)
HKLM-x32\...\Run: [hpsysdrv] => c:\program files (x86)\hewlett-packard\HP odometer\hpsysdrv.exe [62768 2008-11-20] (Hewlett-Packard)
HKLM-x32\...\Run: [HP Software Update] => c:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [54576 2008-12-08] (Hewlett-Packard)
HKLM-x32\...\Run: [HP Remote Solution] => C:\Program Files (x86)\Hewlett-Packard\HP Remote Solution\HP_Remote_Solution.exe [656896 2009-08-25] (Hewlett-Packard)
HKLM-x32\...\Run: [Easybits Recovery] => C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe [60464 2009-09-02] (EasyBits Software AS)
HKLM-x32\...\Run: [DivXUpdate] => C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1263952 2013-02-13] ()
HKLM-x32\...\Run: [DivXMediaServer] => C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe [450560 2013-05-20] (DivX, LLC)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [bingDesktop] => C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktop.exe [2353880 2013-11-01] (Microsoft Corp.)
Winlogon\Notify\GoToAssist: C:\Program Files (x86)\Citrix\GoToAssist\896\G2AWinLogon_x64.dll (Citrix Online, a division of Citrix Systems, Inc.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer: [NoControlPanel] 0
HKLM\...\Policies\Explorer: [NoFolderOptions] 0
HKU\S-1-5-21-1843119849-658739943-1546731566-1000\...\Run: [swg] => C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2010-03-06] (Google Inc.)
HKU\S-1-5-21-1843119849-658739943-1546731566-1000\...\Run: [HPADVISOR] => C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe [1685048 2009-09-29] (Hewlett-Packard)
HKU\S-1-5-21-1843119849-658739943-1546731566-1000\...\RunOnce: [Del5236953] - cmd.exe /Q /D /c del "C:\Users\CRESCE~1\AppData\Local\Temp\0.del"
HKU\S-1-5-21-1843119849-658739943-1546731566-1001\...\Run: [HPADVISOR] => C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe [1685048 2009-09-29] (Hewlett-Packard)
HKU\S-1-5-21-1843119849-658739943-1546731566-1001\...\Run: [Google Update] => C:\Users\Noel\AppData\Local\Google\Update\GoogleUpdate.exe [136176 2012-03-21] (Google Inc.)
HKU\S-1-5-21-1843119849-658739943-1546731566-1001\...\Run: [Facebook Update] => C:\Users\Noel\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2012-07-20] (Facebook Inc.)
HKU\S-1-5-21-1843119849-658739943-1546731566-1001\...\Run: [swg] => C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2010-03-06] (Google Inc.)
HKU\S-1-5-21-1843119849-658739943-1546731566-1001\...\Run: [RESTART_STICKY_NOTES] => C:\Windows\System32\StikyNot.exe [427520 2009-07-14] (Microsoft Corporation)
HKU\S-1-5-21-1843119849-658739943-1546731566-1001\...\Policies\system: [DisableLockWorkstation] 0
HKU\S-1-5-21-1843119849-658739943-1546731566-1001\...\Policies\system: [DisableChangePassword] 0
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\AutorunsDisabled ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files (x86)\hp\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.141\SSScheduler.exe (McAfee, Inc.)
Startup: C:\Users\Noel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk
ShortcutTarget: OneNote 2007 Screen Clipper and Launcher.lnk -> C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://login.yahoo.com/config/login_verify2?.intl=uk&.partner=bt-1&.done=http%3a//bt.yahoo.com/%3fa//bt.yahoo.com/%3f
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
URLSearchHook: HKLM-x32 - (No Name) - {b760d5a4-8d24-4cb6-942e-d6bb540ad88c} - No File
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM - {31090377-0740-419E-BEFC-A56E50500D5B} URL =
SearchScopes: HKLM-x32 - DefaultScope {f05c97d3-449c-4e72-a8eb-af9e39e3978d} URL =
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - DefaultScope {C2B0C49B-6E6D-4D39-AAC1-8820FE3918D2} URL = http://uk.search.yahoo.com/search?fr=mcafee&type=A011GB691&p={SearchTerms}
SearchScopes: HKCU - {0988E493-3507-4521-B1DD-B3873A22AB12} URL =
SearchScopes: HKCU - {C2B0C49B-6E6D-4D39-AAC1-8820FE3918D2} URL = http://uk.search.yahoo.com/search?fr=mcafee&type=A011GB691&p={SearchTerms}
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - C:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
BHO-x32: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO-x32: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.8.141\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO-x32: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
BHO-x32: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - C:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
BHO-x32: Bing Bar BHO - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll (Microsoft Corporation)
BHO-x32: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Freemake.YoutubeButton - {e9e8eb35-ff77-455d-b677-91e5e4fc06c2} - C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation)
BHO-x32: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll (Yahoo! Inc)
BHO-x32: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKLM - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - C:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - No Name - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - No File
Toolbar: HKLM-x32 - No Name - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File
Toolbar: HKLM-x32 - No Name - {b760d5a4-8d24-4cb6-942e-d6bb540ad88c} - No File
Toolbar: HKLM-x32 - No Name - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No File
Toolbar: HKLM-x32 - @C:\Program Files (x86)\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll,-100 - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll (Microsoft Corporation)
Toolbar: HKLM-x32 - No Name - {95B7759C-8C7F-4BF1-B163-73684A933233} - No File
Toolbar: HKLM-x32 - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - C:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
Toolbar: HKCU - No Name - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - No File
Toolbar: HKCU - No Name - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File
Toolbar: HKCU - No Name - {B760D5A4-8D24-4CB6-942E-D6BB540AD88C} - No File
Toolbar: HKCU - No Name - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No File
DPF: HKLM-x32 {233C1507-6A77-46A4-9443-F871F945D258} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - C:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - C:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
Handler-x32: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - C:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
Handler-x32: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - C:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - C:\Program Files\McAfee\MSC\McSnIePl64.dll (McAfee, Inc.)
Filter-x32: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - C:\Program Files (x86)\McAfee\MSC\McSnIePl.dll (McAfee, Inc.)
ShellExecuteHooks-x32: EasyBits ShellExecute Hook - {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWOW64\ezUPBHook.dll [52272 2009-12-05] (EasyBits Software Corp.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.254 192.168.1.254

FireFox:
========
FF ProfilePath: C:\Users\Noel\AppData\Roaming\Mozilla\Firefox\Profiles\ui9vo4h8.default
FF DefaultSearchEngine: Secure Search
FF SearchEngineOrder.1: Secure Search
FF SelectedSearchEngine: Secure Search
FF Keyword.URL: hxxp://uk.search.yahoo.com/search?fr=mcafee&type=A111GB691&p=
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @mcafee.com/MSC,version=10 - c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL ()
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1202122.dll (Adobe Systems, Inc.)
FF Plugin-x32: @avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin - C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\18.1.0\\npsitesafety.dll No File
FF Plugin-x32: @divx.com/DivX Plus Web Player Plug-In,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @mcafee.com/McAfeeMssPlugin - C:\Program Files\McAfee Security Scan\3.8.141\npMcAfeeMss.dll (McAfee, Inc.)
FF Plugin-x32: @mcafee.com/MSC,version=10 - c:\PROGRA~2\mcafee\msc\NPMCSN~1.DLL ()
FF Plugin-x32: @mcafee.com/MVT - C:\Program Files (x86)\McAfee\Supportability\MVT\NPMVTPlugin.dll (McAfee, Inc.)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @Motive.com/NpMotive,version=1.0 - C:\Program Files (x86)\Common Files\Motive\npMotive.dll (Alcatel-Lucent)
FF Plugin-x32: @Motive.com/npMotiveRequest,version=1.0 - C:\Program Files (x86)\Common Files\Motive\npMotiveRequest.dll (Alcatel-Lucent)
FF Plugin-x32: @RIM.com/WebSLLauncher,version=1.0 - C:\Program Files (x86)\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll ()
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin - C:\Users\Noel\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Noel\AppData\Local\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Noel\AppData\Local\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\Noel\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\avg-secure-search.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\sweettunes_search.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\avg-secure-search.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\McSiteAdvisor.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\sweettunes_search.xml
FF Extension: Motive Extension - C:\Program Files (x86)\Mozilla Firefox\extensions\mcciwbch@motive.com.xpi [2012-09-24]
FF HKLM-x32\...\Firefox\Extensions: [{7BA52691-1876-45ce-9EE6-54BCB3B04BBC}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\coFFPlgn\
FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010-03-16]
FF HKLM-x32\...\Firefox\Extensions: [avg@toolbar] - C:\ProgramData\AVG Secure Search\FireFoxExt\18.1.0.443
FF Extension: AVG Security Toolbar - C:\ProgramData\AVG Secure Search\FireFoxExt\18.1.0.443 [2014-04-30]
FF HKLM-x32\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files (x86)\McAfee\SiteAdvisor
FF Extension: McAfee SiteAdvisor - C:\Program Files (x86)\McAfee\SiteAdvisor [2012-08-22]
FF HKLM-x32\...\Firefox\Extensions: [fmdownloader@gmail.com] - C:\Program Files (x86)\Freemake\Freemake Video Downloader\BrowserPlugin\Firefox\fmdownloader@gmail.com\
FF Extension: Freemake Video Downloader Plugin - C:\Program Files (x86)\Freemake\Freemake Video Downloader\BrowserPlugin\Firefox\fmdownloader@gmail.com\ []
FF HKLM-x32\...\Firefox\Extensions: [ytfmdownloader@gmail.com] - C:\Program Files (x86)\Freemake\Freemake Video Downloader\BrowserPlugin\Firefox\ytfmdownloader@gmail.com\
FF Extension: Freemake Youtube Download Button - C:\Program Files (x86)\Freemake\Freemake Video Downloader\BrowserPlugin\Firefox\ytfmdownloader@gmail.com\ []
FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF Extension: DivX Plus Web Player HTML5 <video> - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2013-07-16]

Chrome:
=======
CHR DefaultSearchKeyword: mcafee
CHR DefaultSearchProvider: McAfee
CHR DefaultSearchURL: http://uk.search.yahoo.com/search?fr=mcafee&type=A211GB691&p={searchTerms}
CHR DefaultNewTabURL:
CHR Extension: (Google Docs) - C:\Users\Noel\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-02-08]
CHR Extension: (Google Drive) - C:\Users\Noel\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-02-08]
CHR Extension: (YouTube) - C:\Users\Noel\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-03-21]
CHR Extension: (McAfee Security Scan+) - C:\Users\Noel\AppData\Local\Google\Chrome\User Data\Default\Extensions\bopakagnckmlgajfccecajhnimjiiedh [2014-02-22]
CHR Extension: (Freemake Video Downloader) - C:\Users\Noel\AppData\Local\Google\Chrome\User Data\Default\Extensions\bpegkgagfojjbcpkihigfmkojdmmimdf [2013-02-15]
CHR Extension: (Google Search) - C:\Users\Noel\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-03-21]
CHR Extension: (BT DesktopHelp extension) - C:\Users\Noel\AppData\Local\Google\Chrome\User Data\Default\Extensions\edmgmpmklgfbohogafcfobonnkogchec [2012-09-24]
CHR Extension: (Freemake Youtube Download Button) - C:\Users\Noel\AppData\Local\Google\Chrome\User Data\Default\Extensions\ehgldbbpchgpcfagfpfjgoomddhccfgh [2013-02-15]
CHR Extension: (SiteAdvisor) - C:\Users\Noel\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho [2012-03-21]
CHR Extension: (Google Wallet) - C:\Users\Noel\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-22]
CHR Extension: (DivX Plus Web Player HTML5 <video>) - C:\Users\Noel\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm [2013-07-18]
CHR Extension: (Gmail) - C:\Users\Noel\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-03-21]
CHR HKLM-x32\...\Chrome\Extension: [bpegkgagfojjbcpkihigfmkojdmmimdf] - C:\Program Files (x86)\Freemake\Freemake Video Downloader\BrowserPlugin\Chrome\Freemake.Plugin.Chrome.crx [2013-02-13]
CHR HKLM-x32\...\Chrome\Extension: [edmgmpmklgfbohogafcfobonnkogchec] - C:\Program Files (x86)\Common Files\Motive\extensions\MotiveRequest.crx [2012-12-14]
CHR HKLM-x32\...\Chrome\Extension: [ehgldbbpchgpcfagfpfjgoomddhccfgh] - C:\Program Files (x86)\Freemake\Freemake Video Downloader\BrowserPlugin\Chrome\ChromeYoutubePlugin.crx [2013-02-13]
CHR HKLM-x32\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - C:\Program Files (x86)\McAfee\SiteAdvisor\McChPlg.crx [2014-05-21]
CHR HKLM-x32\...\Chrome\Extension: [ndibdjnfmopecpmkdieinmbadjfpblof] - C:\ProgramData\AVG Secure Search\ChromeExt\17.3.0.49\avg.crx [2014-05-21]
CHR HKLM-x32\...\Chrome\Extension: [nneajnkjbffgblleaoojgaacokifdkhm] - C:\Program Files (x86)\DivX\DivX Plus Web Player\chrome\DivXHTML5\DivXHTML5.crx [2013-05-06]

==================== Services (Whitelisted) =================

R2 BingDesktopUpdate; C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktopUpdater.exe [173272 2013-11-01] (Microsoft Corp.)
R3 Blackberry Device Manager; C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe [577536 2013-01-18] (Research In Motion Limited)
R2 BT Help Wizard; C:\Program Files (x86)\BT Broadband Desktop Help\btbb\MA\8.4.0.53.bt.0.7\ma\bin\MAHostService.exe [321024 2014-03-13] (Alcatel-Lucent)
R2 FreemakeVideoCapture; C:\Program Files (x86)\Freemake\CaptureLib\CaptureLibService.exe [9216 2013-02-07] (Ellora Assets Corp.)
S4 getPlusHelper; C:\Program Files (x86)\NOS\bin\getPlus_Helper.dll [67360 2010-02-19] (NOS Microsystems Ltd.)
R2 HomeNetSvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-04-03] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [857912 2014-04-03] (Malwarebytes Corporation)
R2 McAfee SiteAdvisor Service; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
R2 McAPExe; C:\Program Files\McAfee\MSC\McAPExe.exe [178528 2014-04-25] (McAfee, Inc.)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.141\McCHSvc.exe [289256 2014-01-16] (McAfee, Inc.)
R2 McMPFSvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
R2 McNaiAnn; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
S3 McODS; C:\Program Files\McAfee\VirusScan\mcods.exe [602944 2013-08-02] (McAfee, Inc.)
R2 mcpltsvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
R2 McProxy; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
R2 mfecore; C:\Program Files\Common Files\McAfee\AMCore\mcshield.exe [1025712 2014-01-21] (McAfee, Inc.)
R2 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [219752 2014-03-17] (McAfee, Inc.)
R2 mfevtp; C:\Windows\system32\mfevtps.exe [185792 2014-03-17] (McAfee, Inc.)
R2 pcCMService64; C:\Program Files\Common Files\Motive\pcCMService.exe [467256 2013-11-11] (Alcatel-Lucent)
R2 PCToolsSSDMonitorSvc; C:\Program Files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe [583640 2010-08-05] (PC Tools)
R2 vToolbarUpdater18.1.0; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.1.0\ToolbarUpdater.exe [1801240 2014-04-30] (AVG Secure Search)

==================== Drivers (Whitelisted) ====================

R1 avgtp; C:\Windows\system32\drivers\avgtpx64.sys [50464 2014-04-30] (AVG Technologies)
R3 cfwids; C:\Windows\System32\drivers\cfwids.sys [70592 2014-03-17] (McAfee, Inc.)
S3 GetSusp; C:\Windows\GetSusp.sys [16680 2014-05-22] (McAfee, Inc.)
R3 HipShieldK; C:\Windows\System32\drivers\HipShieldK.sys [197704 2013-09-23] (McAfee, Inc.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [119512 2014-05-23] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63192 2014-04-03] (Malwarebytes Corporation)
R3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [180272 2014-03-17] (McAfee, Inc.)
R3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [311600 2014-03-17] (McAfee, Inc.)
R3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [522360 2014-03-17] (McAfee, Inc.)
R0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [783864 2014-03-17] (McAfee, Inc.)
R3 mfencbdc; C:\Windows\System32\DRIVERS\mfencbdc.sys [422712 2014-01-21] (McAfee, Inc.)
S3 mfencrk; C:\Windows\System32\DRIVERS\mfencrk.sys [96592 2014-01-21] (McAfee, Inc.)
R0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [345456 2014-03-17] (McAfee, Inc.)
S3 MREMP50; C:\Program Files (x86)\Common Files\Motive\MREMP50.sys [21248 2010-02-02] (Printing Communications Assoc., Inc. (PCAUSA))
S3 MREMP50a64; C:\Program Files\Common Files\Motive\MREMP50a64.sys [43008 2010-02-02] (Printing Communications Assoc., Inc. (PCAUSA))
S3 MRESP50; C:\Program Files (x86)\Common Files\Motive\MRESP50.sys [20096 2010-02-02] (Printing Communications Assoc., Inc. (PCAUSA))
S3 MRESP50a64; C:\Program Files\Common Files\Motive\MRESP50a64.sys [40960 2010-02-02] (Printing Communications Assoc., Inc. (PCAUSA))
R2 npf; C:\Windows\System32\drivers\npf.sys [35344 2011-02-11] (CACE Technologies, Inc.)
S3 RimUsb; C:\Windows\System32\Drivers\RimUsb_AMD64.sys [78336 2013-01-03] (Research In Motion Limited)
R3 RimVSerPort; C:\Windows\System32\DRIVERS\RimSerial_AMD64.sys [44544 2012-12-10] (Research in Motion Ltd)
S3 s125bus; C:\Windows\System32\DRIVERS\s125bus.sys [108296 2007-04-24] (MCCI Corporation)
S3 PCDSRVC{F36B3A4C-F95654BD-06000000}_0; \??\c:\program files\pc-doctor for windows\pcdsrvc_x64.pkms [X]

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2014-05-24 10:38 - 2014-05-24 10:38 - 00000000 ____D () C:\FRST
2014-05-24 01:07 - 2014-05-24 01:07 - 00509944 _____ () C:\Windows\Minidump\052414-19952-01.dmp
2014-05-23 23:36 - 2014-05-23 23:36 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-05-22 21:27 - 2014-05-22 21:27 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\48230029.sys
2014-05-22 21:03 - 2014-05-22 21:03 - 00000000 ____D () C:\Users\Noel\AppData\Roaming\Malwarebytes
2014-05-22 21:03 - 2014-05-22 21:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
2014-05-22 21:03 - 2014-05-22 21:03 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-05-22 20:59 - 2014-05-22 21:02 - 00000000 ____D () C:\Users\Noel\Documents\mbam-chameleon-1.62.1.1000
2014-05-22 16:12 - 2014-05-22 16:12 - 00002159 _____ () C:\Users\CRESCENTIA\Downloads\5A08.tmp
2014-05-22 14:48 - 2014-05-22 14:48 - 00016680 _____ (McAfee, Inc.) C:\Windows\GetSusp.sys
2014-05-22 14:30 - 2014-05-23 08:03 - 00000000 ____D () C:\Users\Noel\AppData\Local\LogMeIn Rescue Applet
2014-05-21 11:11 - 2014-01-09 03:22 - 05694464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2014-05-21 11:11 - 2014-01-03 23:44 - 06574592 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2014-05-20 23:50 - 2013-10-02 03:22 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\TsUsbFlt.sys
2014-05-20 23:50 - 2013-10-02 03:11 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyControl.exe
2014-05-20 23:50 - 2013-10-02 03:08 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyExtension.dll
2014-05-20 23:50 - 2013-10-02 02:48 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\MsRdpWebAccess.dll
2014-05-20 23:50 - 2013-10-02 02:48 - 00018944 _____ (Microsoft Corporation) C:\Windows\system32\wksprtPS.dll
2014-05-20 23:50 - 2013-10-02 02:29 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll
2014-05-20 23:50 - 2013-10-02 02:10 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbGDCoInstaller.dll
2014-05-20 23:50 - 2013-10-02 01:15 - 01057280 _____ (Microsoft Corporation) C:\Windows\system32\rdvidcrl.dll
2014-05-20 23:50 - 2013-10-02 01:14 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MsRdpWebAccess.dll
2014-05-20 23:50 - 2013-10-02 01:14 - 00017920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wksprtPS.dll
2014-05-20 23:50 - 2013-10-02 01:08 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2014-05-20 23:50 - 2013-10-02 01:01 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\wksprt.exe
2014-05-20 23:50 - 2013-10-02 00:58 - 00053248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll
2014-05-20 23:50 - 2013-10-02 00:31 - 01147392 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe
2014-05-20 23:50 - 2013-10-02 00:08 - 00855552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdvidcrl.dll
2014-05-20 23:50 - 2013-10-01 23:34 - 01068544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstsc.exe
2014-05-20 23:48 - 2012-08-23 15:13 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\rdpudd.dll
2014-05-20 23:48 - 2012-08-23 15:10 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpvideominiport.sys
2014-05-20 23:48 - 2012-08-23 14:24 - 00015360 _____ (Microsoft Corporation) C:\Windows\system32\RdpGroupPolicyExtension.dll
2014-05-20 23:48 - 2012-08-23 12:12 - 00192000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdpendp_winip.dll
2014-05-20 23:48 - 2012-08-23 11:51 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\rdpendp_winip.dll
2014-05-20 23:48 - 2012-08-23 10:51 - 03174912 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2014-05-20 23:46 - 2014-05-20 23:46 - 00000000 ____D () C:\Program Files (x86)\Intel
2014-05-20 23:46 - 2014-05-20 23:46 - 00000000 ____D () C:\Intel
2014-05-20 23:33 - 2013-09-25 03:23 - 01030144 _____ (Microsoft Corporation) C:\Windows\system32\TSWorkspace.dll
2014-05-20 23:33 - 2013-09-25 02:57 - 00792576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSWorkspace.dll
2014-05-20 23:33 - 2012-05-04 12:00 - 00366592 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2014-05-20 23:33 - 2012-05-04 10:59 - 00514560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll
2014-05-20 16:36 - 2014-05-22 21:03 - 00000958 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-05-20 16:36 - 2014-05-22 21:03 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-05-20 16:36 - 2014-05-20 16:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-05-20 16:36 - 2014-05-20 16:36 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-05-20 16:36 - 2014-04-03 09:51 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-05-20 16:36 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-05-20 15:37 - 2014-05-20 15:38 - 00000000 ____D () C:\Quarantine
2014-05-20 15:32 - 2014-05-20 15:34 - 00000000 ____D () C:\Windows\pss
2014-05-18 13:19 - 2014-05-18 13:19 - 00000000 ____D () C:\Users\Noel\AppData\Local\DOSBox
2014-05-18 13:12 - 2014-05-18 13:16 - 00000000 ____D () C:\Users\Noel\AppData\Local\WinZip
2014-05-18 12:42 - 2014-05-18 12:34 - 00620843 _____ () C:\Users\CRESCENTIA\Desktop\prince4d (1).zip
2014-05-18 12:40 - 2014-05-18 12:42 - 00000000 ____D () C:\Users\CRESCENTIA\AppData\Local\IdleCrawler
2014-05-18 12:40 - 2014-05-18 12:40 - 00004594 _____ () C:\Windows\System32\Tasks\IdleCrawler Runner
2014-05-18 12:29 - 2014-05-24 10:29 - 00000308 _____ () C:\Windows\Tasks\Speedial.job
2014-05-18 12:29 - 2014-05-18 12:29 - 00003268 _____ () C:\Windows\System32\Tasks\Speedial
2014-05-18 12:27 - 2014-05-18 12:29 - 00000000 ____D () C:\Users\CRESCENTIA\AppData\Local\WinZip
2014-05-18 12:27 - 2014-05-18 12:27 - 00002285 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\WinZip.lnk
2014-05-18 12:27 - 2014-05-18 12:27 - 00002279 _____ () C:\Users\Public\Desktop\WinZip.lnk
2014-05-18 12:27 - 2014-05-18 12:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip
2014-05-18 12:26 - 2014-05-18 12:27 - 00000000 ____D () C:\Program Files\WinZip
2014-05-18 12:15 - 2014-05-18 12:15 - 00620843 _____ () C:\Users\CRESCENTIA\Desktop\prince4d.zip
2014-05-14 13:25 - 2014-05-06 05:40 - 23544320 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-14 13:25 - 2014-05-06 05:17 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-14 13:25 - 2014-05-06 04:25 - 17382912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-14 13:25 - 2014-05-06 04:07 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-05-14 13:25 - 2014-05-06 04:00 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-14 13:25 - 2014-05-06 03:10 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-05-14 10:46 - 2014-05-09 07:14 - 00477184 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-05-14 10:46 - 2014-05-09 07:11 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-05-14 10:46 - 2014-03-25 03:43 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-05-14 10:46 - 2014-03-25 03:09 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-05-14 10:45 - 2014-04-12 03:22 - 00155072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2014-05-14 10:45 - 2014-04-12 03:22 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2014-05-14 10:45 - 2014-04-12 03:19 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-05-14 10:45 - 2014-04-12 03:19 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2014-05-14 10:45 - 2014-04-12 03:19 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2014-05-14 10:45 - 2014-04-12 03:19 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2014-05-14 10:45 - 2014-04-12 03:19 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2014-05-14 10:45 - 2014-04-12 03:12 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-05-14 10:45 - 2014-04-12 03:10 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-05-14 10:45 - 2014-03-04 10:47 - 05550016 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2014-05-14 10:45 - 2014-03-04 10:44 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-05-14 10:45 - 2014-03-04 10:44 - 00722944 _____ (Microsoft Corporation) C:\Windows\system32\objsel.dll
2014-05-14 10:45 - 2014-03-04 10:44 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2014-05-14 10:45 - 2014-03-04 10:44 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-05-14 10:45 - 2014-03-04 10:44 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-05-14 10:45 - 2014-03-04 10:44 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-05-14 10:45 - 2014-03-04 10:44 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-05-14 10:45 - 2014-03-04 10:44 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\wincredprovider.dll
2014-05-14 10:45 - 2014-03-04 10:43 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2014-05-14 10:45 - 2014-03-04 10:43 - 00057344 _____ (Microsoft Corporation) C:\Windows\system32\cngprovider.dll
2014-05-14 10:45 - 2014-03-04 10:43 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\adprovider.dll
2014-05-14 10:45 - 2014-03-04 10:43 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\capiprovider.dll
2014-05-14 10:45 - 2014-03-04 10:43 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\dpapiprovider.dll
2014-05-14 10:45 - 2014-03-04 10:43 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\dimsroam.dll
2014-05-14 10:45 - 2014-03-04 10:43 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-05-14 10:45 - 2014-03-04 10:20 - 03969984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2014-05-14 10:45 - 2014-03-04 10:20 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2014-05-14 10:45 - 2014-03-04 10:17 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-05-14 10:45 - 2014-03-04 10:17 - 00538112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\objsel.dll
2014-05-14 10:45 - 2014-03-04 10:17 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2014-05-14 10:45 - 2014-03-04 10:17 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-05-14 10:45 - 2014-03-04 10:17 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2014-05-14 10:45 - 2014-03-04 10:17 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-05-14 10:45 - 2014-03-04 10:17 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cngprovider.dll
2014-05-14 10:45 - 2014-03-04 10:17 - 00049664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adprovider.dll
2014-05-14 10:45 - 2014-03-04 10:17 - 00048128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\capiprovider.dll
2014-05-14 10:45 - 2014-03-04 10:17 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpapiprovider.dll
2014-05-14 10:45 - 2014-03-04 10:17 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dimsroam.dll
2014-05-14 10:45 - 2014-03-04 10:17 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wincredprovider.dll
2014-05-14 10:45 - 2014-03-04 10:17 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-05-14 10:45 - 2014-03-04 10:16 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2014-05-13 23:53 - 2014-05-13 23:53 - 17938608 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2014-05-07 23:54 - 2014-05-07 23:54 - 00000000 ____D () C:\Users\Noel\Downloads\Bundle_classic_Vicetone_remixes
2014-05-07 23:48 - 2014-05-07 23:51 - 59859684 _____ () C:\Users\Noel\Downloads\Bundle_classic_Vicetone_remixes.zip
2014-05-07 23:47 - 2014-05-07 23:51 - 59859684 _____ () C:\Users\Noel\Downloads\Bundle_classic_Vicetone_remixes (1).zip
2014-05-07 16:37 - 2014-05-07 16:37 - 00000000 ____D () C:\Windows\en-gb
2014-05-07 16:36 - 2014-05-07 16:36 - 00001307 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Movie Maker.lnk
2014-05-07 16:36 - 2014-05-07 16:36 - 00000000 ____D () C:\Windows\en
2014-05-06 09:13 - 2014-05-14 14:39 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-04-30 20:18 - 2014-04-30 20:19 - 00000000 ____D () C:\ProgramData\AVG Secure Search
2014-04-24 18:52 - 2014-04-24 18:51 - 00558663 _____ () C:\Users\Noel\Documents\Council Tax 2.jpeg
2014-04-24 18:51 - 2014-04-24 18:50 - 00367338 _____ () C:\Users\Noel\Documents\Council Tax.jpeg

==================== One Month Modified Files and Folders =======

2014-05-24 10:38 - 2014-05-24 10:38 - 00000000 ____D () C:\FRST
2014-05-24 10:30 - 2012-03-21 21:41 - 00000904 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1843119849-658739943-1546731566-1001UA.job
2014-05-24 10:29 - 2014-05-18 12:29 - 00000308 _____ () C:\Windows\Tasks\Speedial.job
2014-05-24 10:27 - 2010-01-04 05:04 - 02066913 _____ () C:\Windows\WindowsUpdate.log
2014-05-24 10:25 - 2009-07-14 05:45 - 00015792 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-05-24 10:25 - 2009-07-14 05:45 - 00015792 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-05-24 10:23 - 2010-03-06 21:54 - 00000898 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-05-24 10:22 - 2013-11-23 01:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee
2014-05-24 10:19 - 2009-07-14 05:51 - 00174298 _____ () C:\Windows\setupact.log
2014-05-24 10:16 - 2010-03-06 21:54 - 00000894 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-05-24 10:15 - 2013-06-06 13:04 - 00000350 _____ () C:\Windows\Tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv.job
2014-05-24 10:15 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-05-24 01:07 - 2014-05-24 01:07 - 00509944 _____ () C:\Windows\Minidump\052414-19952-01.dmp
2014-05-24 01:07 - 2012-02-11 21:47 - 402837295 _____ () C:\Windows\MEMORY.DMP
2014-05-24 01:07 - 2012-02-11 21:47 - 00000000 ____D () C:\Windows\Minidump
2014-05-24 01:05 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\LiveKernelReports
2014-05-24 00:52 - 2012-04-04 23:08 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-05-24 00:50 - 2013-11-21 00:19 - 00002368 _____ () C:\Users\Noel\Desktop\Google Chrome.lnk
2014-05-23 23:45 - 2012-07-20 23:40 - 00000924 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1843119849-658739943-1546731566-1001UA.job
2014-05-23 23:45 - 2012-07-20 23:40 - 00000902 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1843119849-658739943-1546731566-1001Core.job
2014-05-23 23:36 - 2014-05-23 23:36 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-05-23 08:25 - 2012-03-21 21:41 - 00000852 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1843119849-658739943-1546731566-1001Core.job
2014-05-23 08:03 - 2014-05-22 14:30 - 00000000 ____D () C:\Users\Noel\AppData\Local\LogMeIn Rescue Applet
2014-05-23 08:02 - 2010-03-01 17:57 - 01209146 _____ () C:\Windows\PFRO.log
2014-05-22 21:27 - 2014-05-22 21:27 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\48230029.sys
2014-05-22 21:03 - 2014-05-22 21:03 - 00000000 ____D () C:\Users\Noel\AppData\Roaming\Malwarebytes
2014-05-22 21:03 - 2014-05-22 21:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
2014-05-22 21:03 - 2014-05-22 21:03 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-05-22 21:03 - 2014-05-20 16:36 - 00000958 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-05-22 21:03 - 2014-05-20 16:36 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-05-22 21:02 - 2014-05-22 20:59 - 00000000 ____D () C:\Users\Noel\Documents\mbam-chameleon-1.62.1.1000
2014-05-22 17:38 - 2010-03-15 20:26 - 00000000 ____D () C:\Users\Noel\AppData\Local\CrashDumps
2014-05-22 16:12 - 2014-05-22 16:12 - 00002159 _____ () C:\Users\CRESCENTIA\Downloads\5A08.tmp
2014-05-22 14:48 - 2014-05-22 14:48 - 00016680 _____ (McAfee, Inc.) C:\Windows\GetSusp.sys
2014-05-22 14:45 - 2012-10-16 23:21 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-05-22 08:08 - 2010-03-07 18:14 - 00000000 ____D () C:\Users\CRESCENTIA\AppData\Local\CrashDumps
2014-05-21 10:47 - 2009-07-14 04:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
2014-05-21 10:46 - 2012-08-22 00:45 - 00000000 ____D () C:\Program Files (x86)\McAfee
2014-05-21 00:25 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-05-20 23:50 - 2009-12-05 08:04 - 00000000 ____D () C:\Windows\SysWOW64\RTCOM
2014-05-20 23:48 - 2009-07-14 06:13 - 00782510 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-05-20 23:46 - 2014-05-20 23:46 - 00000000 ____D () C:\Program Files (x86)\Intel
2014-05-20 23:46 - 2014-05-20 23:46 - 00000000 ____D () C:\Intel
2014-05-20 23:44 - 2013-03-15 23:16 - 00000000 ____D () C:\Users\CRESCENTIA\AppData\Roaming\McAFee TechCheck
2014-05-20 16:36 - 2014-05-20 16:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-05-20 16:36 - 2014-05-20 16:36 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-05-20 16:09 - 2010-03-02 19:15 - 00000000 ____D () C:\Users\Noel\Tracing
2014-05-20 15:38 - 2014-05-20 15:37 - 00000000 ____D () C:\Quarantine
2014-05-20 15:34 - 2014-05-20 15:32 - 00000000 ____D () C:\Windows\pss
2014-05-20 15:34 - 2009-07-14 04:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
2014-05-18 13:19 - 2014-05-18 13:19 - 00000000 ____D () C:\Users\Noel\AppData\Local\DOSBox
2014-05-18 13:16 - 2014-05-18 13:12 - 00000000 ____D () C:\Users\Noel\AppData\Local\WinZip
2014-05-18 12:42 - 2014-05-18 12:40 - 00000000 ____D () C:\Users\CRESCENTIA\AppData\Local\IdleCrawler
2014-05-18 12:40 - 2014-05-18 12:40 - 00004594 _____ () C:\Windows\System32\Tasks\IdleCrawler Runner
2014-05-18 12:39 - 2010-04-16 21:28 - 00000000 ____D () C:\Users\CRESCENTIA\AppData\Local\Downloaded Installations
2014-05-18 12:34 - 2014-05-18 12:42 - 00620843 _____ () C:\Users\CRESCENTIA\Desktop\prince4d (1).zip
2014-05-18 12:29 - 2014-05-18 12:29 - 00003268 _____ () C:\Windows\System32\Tasks\Speedial
2014-05-18 12:29 - 2014-05-18 12:27 - 00000000 ____D () C:\Users\CRESCENTIA\AppData\Local\WinZip
2014-05-18 12:28 - 2010-07-04 17:18 - 00000000 ____D () C:\ProgramData\WinZip
2014-05-18 12:27 - 2014-05-18 12:27 - 00002285 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\WinZip.lnk
2014-05-18 12:27 - 2014-05-18 12:27 - 00002279 _____ () C:\Users\Public\Desktop\WinZip.lnk
2014-05-18 12:27 - 2014-05-18 12:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip
2014-05-18 12:27 - 2014-05-18 12:26 - 00000000 ____D () C:\Program Files\WinZip
2014-05-18 12:15 - 2014-05-18 12:15 - 00620843 _____ () C:\Users\CRESCENTIA\Desktop\prince4d.zip
2014-05-17 20:48 - 2010-02-28 23:09 - 00000000 ___RD () C:\Users\CRESCENTIA\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-05-17 20:48 - 2010-02-28 23:09 - 00000000 ___RD () C:\Users\CRESCENTIA\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-05-14 14:43 - 2010-03-02 19:11 - 00000000 ___RD () C:\Users\Noel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-05-14 14:43 - 2010-03-02 19:11 - 00000000 ___RD () C:\Users\Noel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-05-14 14:39 - 2014-05-06 09:13 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-05-14 13:24 - 2010-02-28 23:21 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-05-14 13:23 - 2013-07-18 03:01 - 00000000 ____D () C:\Windows\system32\MRT
2014-05-14 13:18 - 2010-03-25 17:50 - 93223848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-05-13 23:54 - 2012-04-04 23:08 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-05-13 23:54 - 2012-04-04 23:08 - 00003768 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-05-13 23:54 - 2011-05-15 21:22 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-05-13 23:53 - 2014-05-13 23:53 - 17938608 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2014-05-10 13:17 - 2010-03-06 21:54 - 00003894 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-05-10 13:17 - 2010-03-06 21:54 - 00003642 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-05-09 07:14 - 2014-05-14 10:46 - 00477184 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-05-09 07:11 - 2014-05-14 10:46 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-05-07 23:54 - 2014-05-07 23:54 - 00000000 ____D () C:\Users\Noel\Downloads\Bundle_classic_Vicetone_remixes
2014-05-07 23:51 - 2014-05-07 23:48 - 59859684 _____ () C:\Users\Noel\Downloads\Bundle_classic_Vicetone_remixes.zip
2014-05-07 23:51 - 2014-05-07 23:47 - 59859684 _____ () C:\Users\Noel\Downloads\Bundle_classic_Vicetone_remixes (1).zip
2014-05-07 16:37 - 2014-05-07 16:37 - 00000000 ____D () C:\Windows\en-gb
2014-05-07 16:36 - 2014-05-07 16:36 - 00001307 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Movie Maker.lnk
2014-05-07 16:36 - 2014-05-07 16:36 - 00000000 ____D () C:\Windows\en
2014-05-07 16:36 - 2013-02-13 22:31 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live
2014-05-07 16:35 - 2013-02-13 22:35 - 00001376 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Photo Gallery.lnk
2014-05-07 16:34 - 2010-10-20 21:25 - 00002488 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Messenger.lnk
2014-05-07 16:34 - 2010-10-20 21:25 - 00001460 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Mail.lnk
2014-05-07 16:33 - 2009-12-05 08:45 - 00000000 ____D () C:\Program Files (x86)\Windows Live
2014-05-07 16:32 - 2013-02-13 22:31 - 00000000 ____D () C:\Program Files\Windows Live
2014-05-07 16:28 - 2009-12-05 08:51 - 00033005 _____ () C:\Windows\DirectX.log
2014-05-07 08:39 - 2009-07-14 06:08 - 00032620 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-05-06 08:20 - 2012-03-21 21:41 - 00003872 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1843119849-658739943-1546731566-1001UA
2014-05-06 08:20 - 2012-03-21 21:41 - 00003476 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1843119849-658739943-1546731566-1001Core
2014-05-06 05:40 - 2014-05-14 13:25 - 23544320 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-06 05:17 - 2014-05-14 13:25 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-06 04:25 - 2014-05-14 13:25 - 17382912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-06 04:07 - 2014-05-14 13:25 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-05-06 04:00 - 2014-05-14 13:25 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-06 03:10 - 2014-05-14 13:25 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-05-05 22:39 - 2010-07-01 20:04 - 00004608 _____ () C:\Users\Noel\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-04-30 20:19 - 2014-04-30 20:18 - 00000000 ____D () C:\ProgramData\AVG Secure Search
2014-04-30 20:16 - 2012-08-19 21:58 - 00000000 ____D () C:\Program Files (x86)\AVG Secure Search
2014-04-30 20:13 - 2012-08-19 21:58 - 00050464 _____ (AVG Technologies) C:\Windows\system32\Drivers\avgtpx64.sys
2014-04-24 18:51 - 2014-04-24 18:52 - 00558663 _____ () C:\Users\Noel\Documents\Council Tax 2.jpeg
2014-04-24 18:50 - 2014-04-24 18:51 - 00367338 _____ () C:\Users\Noel\Documents\Council Tax.jpeg

Some content of TEMP:
====================
C:\Users\CRESCENTIA\AppData\Local\Temp\contentDATs.exe
C:\Users\CRESCENTIA\AppData\Local\Temp\FreemakeVideoDownloader_3.5.0.3.exe
C:\Users\CRESCENTIA\AppData\Local\Temp\install_flashplayer12x32axau_gtbd_chrd_dn_aaa_aih.exe
C:\Users\CRESCENTIA\AppData\Local\Temp\KDLdr2_new.exe
C:\Users\CRESCENTIA\AppData\Local\Temp\lowproc.exe
C:\Users\CRESCENTIA\AppData\Local\Temp\ms.exe
C:\Users\CRESCENTIA\AppData\Local\Temp\nsf6C9E.exe
C:\Users\CRESCENTIA\AppData\Local\Temp\nsf8EFC.exe
C:\Users\CRESCENTIA\AppData\Local\Temp\nsfB1BB.exe
C:\Users\CRESCENTIA\AppData\Local\Temp\nsk6482.exe
C:\Users\CRESCENTIA\AppData\Local\Temp\nsl79F5.exe
C:\Users\CRESCENTIA\AppData\Local\Temp\nspF2A1.exe
C:\Users\CRESCENTIA\AppData\Local\Temp\nspFD4C.exe
C:\Users\CRESCENTIA\AppData\Local\Temp\nsv8599.exe
C:\Users\CRESCENTIA\AppData\Local\Temp\nsvB999.exe
C:\Users\CRESCENTIA\AppData\Local\Temp\Okiitan_bs.exe
C:\Users\CRESCENTIA\AppData\Local\Temp\pcDesktopAlertNotifierX.dll
C:\Users\CRESCENTIA\AppData\Local\Temp\qms.exe
C:\Users\CRESCENTIA\AppData\Local\Temp\setup_265.exe
C:\Users\CRESCENTIA\AppData\Local\Temp\stubhelper.dll
C:\Users\CRESCENTIA\AppData\Local\Temp\vcredist_x64.exe

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

LastRegBack: 2014-05-12 14:37

==================== End Of Log ============================

(Search.txt):

================== Search Files: "rpcss.dll" =============

C:\Windows\winsxs\amd64_microsoft-windows-com-base-qfe-rpcss_31bf3856ad364e35_6.1.7601.17514_none_c7f0e16b547f887d\rpcss.dll
[2011-06-21 21:51] - [2010-11-20 14:27] - 0512000 ____A (Microsoft Corporation) 5C627D1B1138676C0A7AB2C2C190D123

C:\Windows\winsxs\amd64_microsoft-windows-com-base-qfe-rpcss_31bf3856ad364e35_6.1.7600.16385_none_c5bfcda3579104e3\rpcss.dll
[2009-07-14 01:00] - [2009-07-14 02:41] - 0509440 ____A (Microsoft Corporation) 7266972E86890E2B30C0C322E906B027

C:\Windows\System32\rpcss.dll
[2011-06-21 21:51] - [2010-11-20 14:27] - 0512000 ____A (Microsoft Corporation) 5C627D1B1138676C0A7AB2C2C190D123

====== End Of Search ======

Addition.txt

B-boy/StyLe/ · May 24, 2014

Hello,

That's weird. I don't see any sign of trojan Zekos currently on your computer. You may have the latest version which resides in the LocalLow folder.

STEP 1

Please download RogueKiller.exe and save to the desktop.
Close all windows and browsers
Right-click the program and select 'Run as Administrator'
Press the scan button.
A report opens on the desktop named - RKreport.txt
Please copy and past the results at pastebin.com and post the link to the log in your next reply.

STEP 2

Please download the latest version of TDSSKiller from here and save it to your Desktop.

Doubleclick on TDSSKiller.exe to run the application, then click on Change parameters.
Put a checkmark beside loaded modules.
A reboot will be needed to apply the changes. Do it.
TDSSKiller will launch automatically after the reboot. Also your computer may seem very slow and unusable. This is normal. Give it enough time to load your background programs.
Then click on Change parameters in TDSSKiller.
Check all boxes then click OK.
Click the Start Scan button.
The scan should take no longer than 2 minutes.
If a suspicious object is detected, the default action will be Skip, click on Continue.
If malicious objects are found, they will show in the Scan results - Select action for found objects and offer three options.
Ensure Cure (default) is selected, then click Continue > Reboot now to finish the cleaning process.

Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.
A report will be created in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and past the results at pastebin.com and post the link to the log in your next reply.

STEP 3

Please download Malwarebytes Anti-Malware to your desktop.

Double-click mbam-setup-2.0.2.1012.exe and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to the following:
- Launch Malwarebytes Anti-Malware
- A 14 day trial of the Premium features is pre-selected. You may deselect this if you wish, and it will not diminish the scanning and removal capabilities of the program.
Click Finish.
On the Settings tab > Detection and Protection subtab, Detection Options, tick the box 'Scan for rootkits'.
Click on the Scan tab, then click on Scan Now >> . If an update is available, click the Update Now button.
A Threat Scan will begin.
With some infections, you may see this message box.
- 'Could not load DDA driver'
Click 'Yes' to this message, to allow the driver to load after a restart.
Allow the computer to restart. Continue with the rest of these instructions.
When the scan is complete, click Apply Actions.
Wait for the prompt to restart the computer to appear, then click on Yes.
After the restart once you are back at your desktop, open MBAM once more.
Click on the History tab > Application Logs.
Double click on the scan log which shows the Date and time of the scan just performed.
Click 'Copy to Clipboard'
Paste the contents of the clipboard into your reply.

STEP 4

1.Please download HitmanPro.

For 32-bit Operating System - .
This is the mirror -
For 64-bit Operating System -
This is the mirror -

2.Launch the program by double clicking on the icon. (Windows Vista/7 users right click on the HitmanPro icon and select run as administrator).

Note: If the program won't run please then open the program while holding down the left CTRL key until the program is loaded.

3.Click on the next button. You must agree with the terms of EULA. (if asked)

4.Check the box beside "No, I only want to perform a one-time scan to check this computer".

5.Click on the next button.

6.The program will start to scan the computer. The scan will typically take no more than 2-3 minutes.

7.When the scan is done click on drop-down menu of the found entries (if any) and choose - Apply to all => Ignore <= IMPORTANT!!!

8.Click on the next button.

9.Click on the "Save Log" button.

10.Save that file to your desktop and post the content of that file in your next reply.

Note: if there isn't a dropdown menu when the scan is done then please don't delete anything and close HitmanPro

Navigate to C:\ProgramData\HitmanPro\Logs open the report and copy and paste it to your next reply.

Regards,

Georgi

Noelz · May 25, 2014

Roguekiller Log: http://pastebin.com/tWdwMmhL

Malwarebytes Log:

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 25/05/2014
Scan Time: 12:21:55
Logfile:
Administrator: Yes

Version: 2.00.2.1012
Malware Database: v2014.05.25.02
Rootkit Database: v2014.05.21.01
License: Trial
Malware Protection: Enabled
Malicious Website Protection: Enabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: Noel

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 332250
Time Elapsed: 38 min, 9 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Warn
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 0
(No malicious items detected)

Physical Sectors: 0
(No malicious items detected)

(end)

Sorry, I had to attach the TDS Log as pastebin.com wouldn't allow me to paste the log (exceeded 500KB)

TDS Log.txt

HitmanPro Log:

Computer name . . . . : CRESCENTIA-PC
Windows . . . . . . . : 6.1.1.7601.X64/2
User name . . . . . . : CRESCENTIA-PC\Noel
UAC . . . . . . . . . : Enabled
License . . . . . . . : Free

Scan date . . . . . . : 2014-05-25 13:07:44
Scan mode . . . . . . : Normal
Scan duration . . . . : 19m 15s
Disk access mode . . : Direct disk access (SRB)
Cloud . . . . . . . . : Internet
Reboot . . . . . . . : No

Threats . . . . . . . : 2
Traces . . . . . . . : 169

Objects scanned . . . : 2,283,976
Files scanned . . . . : 139,117
Remnants scanned . . : 987,097 files / 1,157,762 keys

Malware _____________________________________________________________________

C:\Users\CRESCENTIA\AppData\Local\IdleCrawler\IdleCrawler.exe
Size . . . . . . . : 541,696 bytes
Age . . . . . . . : 7.0 days (2014-05-18 12:40:15)
Entropy . . . . . : 6.1
SHA-256 . . . . . : 787122DCC664D806F99F84AA73CA96A79221B56B07FC811836D23CD06F788859
Parent Name . . . : C:\Windows\system32\taskeng.exe
Running processes : 2416
> Bitdefender . . . : Gen:Variant.Kazy.381269
Fuzzy . . . . . . : 117.0
Network Ports
0.0.0.0:38950
Forensic Cluster
-17.9s C:\Users\Noel\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UVMCZAR0\USX9CYQI.htm
-6.4s C:\Users\Noel\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I8C33HRX\xtiUOQU1F3C.htm
-6.3s C:\Users\Noel\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I8C33HRX\xti4GVPHLJ9.htm
-3.3s C:\Users\Noel\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I8C33HRX\xti0TEAXGJM.htm
0.0s C:\Users\CRESCENTIA\AppData\Local\IdleCrawler\
0.0s C:\Users\CRESCENTIA\AppData\Local\IdleCrawler\IdleCrawler.exe
0.1s C:\Users\CRESCENTIA\AppData\Local\IdleCrawler\IdleProfile.exe
0.2s C:\Users\CRESCENTIA\AppData\Local\IdleCrawler\Modules\
0.2s C:\Users\CRESCENTIA\AppData\Local\IdleCrawler\Modules\InSes.dll
0.4s C:\Users\CRESCENTIA\AppData\Local\IdleCrawler\Modules\WbSes.dll
0.4s C:\Users\CRESCENTIA\AppData\Local\IdleCrawler\Modules\7z.dll
2.3s C:\Windows\System32\Tasks\IdleCrawler Runner
3.6s C:\Windows\System32\Tasks\Microsoft\Windows\Maintenance\IdleCrawler Update
10.0s C:\Users\CRESCENTIA\AppData\Local\IdleCrawler\uninstall.exe

C:\Users\CRESCENTIA\AppData\Local\Temp\setup_265.exe
Size . . . . . . . : 1,873,941 bytes
Age . . . . . . . : 7.0 days (2014-05-18 12:39:45)
Entropy . . . . . : 7.6
SHA-256 . . . . . : AF5190D52CC8E70DBD5DFE0D4ABFF9004B521FE79AD5E64A29750AE342828A57
Product . . . . . : IdleCrawler
Publisher . . . . : Internet Deep Research Foundation
Description . . . : Setup Application
Version . . . . . : 41.0.0.93
Copyright . . . . : © Internet Deep Research Foundation
> Bitdefender . . . : Gen:Variant.Kazy.381269
Fuzzy . . . . . . : 109.0
Forensic Cluster
-6.9s C:\Users\CRESCENTIA\AppData\Local\Temp\jdaaAVBC_265
-6.4s C:\Users\CRESCENTIA\AppData\Local\Temp\nsz934C.tmp\Number of results
-2.4s C:\Users\CRESCENTIA\AppData\Local\Temp\dummy.htm
0.0s C:\Users\CRESCENTIA\AppData\Local\Temp\setup_265.exe

Potential Unwanted Programs _________________________________________________

C:\Users\CRESCENTIA\AppData\Local\Conduit\ (Conduit)
C:\Users\CRESCENTIA\AppData\Local\Conduit\CT2949154\ (Conduit)
C:\Users\CRESCENTIA\AppData\Local\Conduit\CT2949154\Messenger_PlusAutoUpdateHelper.exe (Conduit)
Size . . . . . . . : 38,496 bytes
Age . . . . . . . : 1151.7 days (2011-03-30 19:29:08)
Entropy . . . . . : 6.4
SHA-256 . . . . . : 47F14A359B58F52B632347EC80D48B493A576E42350CC7CDD9029E95072691F4
RSA Key Size . . . : 1024
Authenticode . . . : Valid
Fuzzy . . . . . . : -1.0

search.conduit.com
C:\Users\CRESCENTIA\AppData\Local\Google\Chrome\User Data\Default\Web Data

C:\Users\CRESCENTIA\AppData\Local\OpenCandy\ (Conduit)
C:\Users\CRESCENTIA\AppData\LocalLow\Conduit\ (Conduit)
C:\Users\CRESCENTIA\AppData\LocalLow\Conduit\Community Alerts\Dialogs\ (Conduit)
C:\Users\CRESCENTIA\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\ (Conduit)
C:\Users\CRESCENTIA\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\AppNotification.js (Conduit)
C:\Users\CRESCENTIA\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\ (Conduit)
C:\Users\CRESCENTIA\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\close.png (Conduit)
C:\Users\CRESCENTIA\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\like.png (Conduit)
C:\Users\CRESCENTIA\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\Next.png (Conduit)
C:\Users\CRESCENTIA\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\Next_hover.png (Conduit)
C:\Users\CRESCENTIA\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\powered-by.png (Conduit)
C:\Users\CRESCENTIA\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\Prev.png (Conduit)
C:\Users\CRESCENTIA\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\Prev_hover.png (Conduit)
C:\Users\CRESCENTIA\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\settings.png (Conduit)
C:\Users\CRESCENTIA\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\Thumbs.db (Conduit)
C:\Users\CRESCENTIA\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\initialNotification.html (Conduit)
C:\Users\CRESCENTIA\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\main.html (Conduit)
C:\Users\CRESCENTIA\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\NotificationDialogStyle.css (Conduit)
C:\Users\CRESCENTIA\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\NotificationDialogStyleIE9.css (Conduit)
C:\Users\CRESCENTIA\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\sampleNotification.html (Conduit)
C:\Users\CRESCENTIA\AppData\LocalLow\Conduit\Community Alerts\Dialogs\DialogsAPI.js (Conduit)
C:\Users\CRESCENTIA\AppData\LocalLow\Conduit\Community Alerts\Dialogs\PIE.htc (Conduit)
C:\Users\CRESCENTIA\AppData\LocalLow\Conduit\Community Alerts\Dialogs\settings.js (Conduit)
C:\Users\CRESCENTIA\AppData\LocalLow\Conduit\Community Alerts\Dialogs\version.txt (Conduit)
C:\Users\CRESCENTIA\AppData\LocalLow\Conduit\Community Alerts\Feeds\ (Conduit)
C:\Users\CRESCENTIA\AppData\LocalLow\Conduit\Community Alerts\Feeds\http___alerts_conduit-services_com_root_1341008_1336676_UK.xml (Conduit)
C:\Users\CRESCENTIA\AppData\LocalLow\Conduit\Community Alerts\Feeds\http___alerts_conduit-services_com_root_909619_905414_UK.xml (Conduit)
C:\Users\CRESCENTIA\AppData\LocalLow\Conduit\Community Alerts\LanguagePacks\ (Conduit)
C:\Users\CRESCENTIA\AppData\LocalLow\Conduit\Community Alerts\LanguagePacks\en.xml (Conduit)
C:\Users\CRESCENTIA\AppData\LocalLow\SweetIM\ (Sweetpacks)
C:\Users\CRESCENTIA\AppData\LocalLow\SweetIM\Toolbars\Internet Explorer\cache\ (Sweetpacks)
C:\Users\CRESCENTIA\AppData\LocalLow\SweetIM\Toolbars\Internet Explorer\cache\052fa331a4bfc3dfa2a3603ffa88e8f2.prad39.js (Sweetpacks)
C:\Users\CRESCENTIA\AppData\LocalLow\SweetIM\Toolbars\Internet Explorer\cache\53b597b55d8412d563b720d3585c1af8.facebook.png (Sweetpacks)
C:\Users\CRESCENTIA\AppData\LocalLow\SweetIM\Toolbars\Internet Explorer\cache\73c3abd900e81eb93d1e52c26ec42ff9.toolbar39.xml (Sweetpacks)
C:\Users\CRESCENTIA\AppData\LocalLow\SweetIM\Toolbars\Internet Explorer\cache\ae4884ec095a2b4ca0c079f93439dd7f.ieinfb.js (Sweetpacks)
HKLM\SOFTWARE\Classes\Installer\UpgradeCodes\A97CEC23332751B47BA4B95BAA50C9D0\ (Sweetpacks)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\A97CEC23332751B47BA4B95BAA50C9D0\ (Sweetpacks)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\02F47BF73B948514FAACADD8CBBDF37D\ (Sweetpacks)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\080D9F5E1E95FEE4794CE438E635239E\ (Sweetpacks)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1E264E0A5959A1C46BA9175A878B12EA\ (Sweetpacks)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2E6768B6932D112438F047C54D180635\ (Sweetpacks)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\351716A953E21214898904032EAE2E81\ (Sweetpacks)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\397C771A7BCAC904697C3EC629ED33ED\ (Sweetpacks)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\69D6A6B2ED56AF24EA6335EAD6E91CA4\ (Sweetpacks)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7FFA128C2B0FF414D805FC5627883401\ (Sweetpacks)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\97C3D0F82E712E241A2F969F45E3351C\ (Sweetpacks)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\98CC8BF5A4A6E6C4ABF7051DDAB8B058\ (Sweetpacks)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A189D17A469616C4688D23E192996267\ (Sweetpacks)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BF4F885EDEE45644EB1E0C99E0162399\ (Sweetpacks)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D15DAF33C220F91468A1D7D57C31ACD7\ (Sweetpacks)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D3BA76A44C779424889063D5098ED2D6\ (Sweetpacks)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D6D0EB9FDBD90C04D92A7E729058F10D\ (Sweetpacks)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E4748F9A4181FCE46A23C13B517B9420\ (Sweetpacks)
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4}\ (AskBar)
HKU\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4}\ (AskBar)
HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4}\ (AskBar)
HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4}\ (AskBar)
HKU\S-1-5-21-1843119849-658739943-1546731566-1000\Software\AppDataLow\Software\Conduit\ (Conduit)
HKU\S-1-5-21-1843119849-658739943-1546731566-1000\Software\Conduit\ (Conduit)
HKU\S-1-5-21-1843119849-658739943-1546731566-1000\Software\Microsoft\Internet Explorer\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4}\ (AskBar)
HKU\S-1-5-21-1843119849-658739943-1546731566-1000\Software\Microsoft\Internet Explorer\SearchScopes\{f05c97d3-449c-4e72-a8eb-af9e39e3978d}\ (Conduit)
HKU\S-1-5-21-1843119849-658739943-1546731566-1000\Software\Softonic\ (Softonic)

Cookies _____________________________________________________________________

C:\Users\CRESCENTIA\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads.trafficjunky.net
C:\Users\CRESCENTIA\AppData\Local\Google\Chrome\User Data\Default\Cookies:doubleclick.net
C:\Users\CRESCENTIA\AppData\Local\Google\Chrome\User Data\Default\Cookies:engine.phn.doublepimp.com
C:\Users\CRESCENTIA\AppData\Local\Google\Chrome\User Data\Default\Cookies:pornhub.com
C:\Users\CRESCENTIA\AppData\Local\Google\Chrome\User Data\Default\Cookies:tour.pornhubpremium.com
C:\Users\CRESCENTIA\AppData\Local\Google\Chrome\User Data\Default\Cookies:www.pornhub.com
C:\Users\CRESCENTIA\AppData\Roaming\Mozilla\Firefox\Profiles\3d648e8e.default\cookies.sqlite:statse.webtrendslive.com
C:\Users\Noel\AppData\Local\Google\Chrome\User Data\Default\Cookies:ad.360yield.com
C:\Users\Noel\AppData\Local\Google\Chrome\User Data\Default\Cookies:ad.propellerads.com
C:\Users\Noel\AppData\Local\Google\Chrome\User Data\Default\Cookies:ad.reklamport.com
C:\Users\Noel\AppData\Local\Google\Chrome\User Data\Default\Cookies:ad.yieldmanager.com
C:\Users\Noel\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads.adk2.com
C:\Users\Noel\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads.adplxmd.com
C:\Users\Noel\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads.audience2media.com
C:\Users\Noel\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads.betweendigital.com
C:\Users\Noel\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads.cpallmedia.com
C:\Users\Noel\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads.crakmedia.com
C:\Users\Noel\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads.creative-serving.com
C:\Users\Noel\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads.dothads.com
C:\Users\Noel\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads.genericlink.com
C:\Users\Noel\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads.glispa.com
C:\Users\Noel\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads.gltrkk.com
C:\Users\Noel\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads.ibtracking.com
C:\Users\Noel\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads.pubmatic.com
C:\Users\Noel\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads.trafficjunky.net
C:\Users\Noel\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads.undertone.com
C:\Users\Noel\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads.web3-ads.com
C:\Users\Noel\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads.yahoo.com
C:\Users\Noel\AppData\Local\Google\Chrome\User Data\Default\Cookies:adserving.unibet.com
C:\Users\Noel\AppData\Local\Google\Chrome\User Data\Default\Cookies:adtech.de
C:\Users\Noel\AppData\Local\Google\Chrome\User Data\Default\Cookies:adtechus.com
C:\Users\Noel\AppData\Local\Google\Chrome\User Data\Default\Cookies:advertising.com
C:\Users\Noel\AppData\Local\Google\Chrome\User Data\Default\Cookies:apmebf.com
C:\Users\Noel\AppData\Local\Google\Chrome\User Data\Default\Cookies:at.atwola.com
C:\Users\Noel\AppData\Local\Google\Chrome\User Data\Default\Cookies:atdmt.com
C:\Users\Noel\AppData\Local\Google\Chrome\User Data\Default\Cookies:bs.serving-sys.com
C:\Users\Noel\AppData\Local\Google\Chrome\User Data\Default\Cookies:burstnet.com
C:\Users\Noel\AppData\Local\Google\Chrome\User Data\Default\Cookies:casalemedia.com
C:\Users\Noel\AppData\Local\Google\Chrome\User Data\Default\Cookies:collective-media.net
C:\Users\Noel\AppData\Local\Google\Chrome\User Data\Default\Cookies:doubleclick.net
C:\Users\Noel\AppData\Local\Google\Chrome\User Data\Default\Cookies:engine.phn.doublepimp.com
C:\Users\Noel\AppData\Local\Google\Chrome\User Data\Default\Cookies:hearstdigital.122.2o7.net
C:\Users\Noel\AppData\Local\Google\Chrome\User Data\Default\Cookies:in.getclicky.com
C:\Users\Noel\AppData\Local\Google\Chrome\User Data\Default\Cookies:invitemedia.com
C:\Users\Noel\AppData\Local\Google\Chrome\User Data\Default\Cookies:livejasmin.com
C:\Users\Noel\AppData\Local\Google\Chrome\User Data\Default\Cookies:media6degrees.com
C:\Users\Noel\AppData\Local\Google\Chrome\User Data\Default\Cookies:mediaplex.com
C:\Users\Noel\AppData\Local\Google\Chrome\User Data\Default\Cookies:openx.sexsearch.com
C:\Users\Noel\AppData\Local\Google\Chrome\User Data\Default\Cookies:partypoker.com
C:\Users\Noel\AppData\Local\Google\Chrome\User Data\Default\Cookies:pornhub.com
C:\Users\Noel\AppData\Local\Google\Chrome\User Data\Default\Cookies:pornhubpremium.com
C:\Users\Noel\AppData\Local\Google\Chrome\User Data\Default\Cookies:realmedia.com
C:\Users\Noel\AppData\Local\Google\Chrome\User Data\Default\Cookies:revsci.net
C:\Users\Noel\AppData\Local\Google\Chrome\User Data\Default\Cookies:ru4.com
C:\Users\Noel\AppData\Local\Google\Chrome\User Data\Default\Cookies:serving-sys.com
C:\Users\Noel\AppData\Local\Google\Chrome\User Data\Default\Cookies:sexinchat.net
C:\Users\Noel\AppData\Local\Google\Chrome\User Data\Default\Cookies:smartadserver.com
C:\Users\Noel\AppData\Local\Google\Chrome\User Data\Default\Cookies:specificclick.net
C:\Users\Noel\AppData\Local\Google\Chrome\User Data\Default\Cookies:statcounter.com
C:\Users\Noel\AppData\Local\Google\Chrome\User Data\Default\Cookies:stats.renault.co.uk
C:\Users\Noel\AppData\Local\Google\Chrome\User Data\Default\Cookies:statse.webtrendslive.com
C:\Users\Noel\AppData\Local\Google\Chrome\User Data\Default\Cookies:tacoda.at.atwola.com
C:\Users\Noel\AppData\Local\Google\Chrome\User Data\Default\Cookies:track.adform.net
C:\Users\Noel\AppData\Local\Google\Chrome\User Data\Default\Cookies:tribalfusion.com
C:\Users\Noel\AppData\Local\Google\Chrome\User Data\Default\Cookies:www.pornhub.com
C:\Users\Noel\AppData\Local\Google\Chrome\User Data\Default\Cookies:www.sexual-dalliance.com
C:\Users\Noel\AppData\Local\Google\Chrome\User Data\Default\Cookies:xiti.com
C:\Users\Noel\AppData\Local\Google\Chrome\User Data\Default\Cookies:zedo.com
C:\Users\Noel\AppData\Roaming\Microsoft\Windows\Cookies\372ICE84.txt
C:\Users\Noel\AppData\Roaming\Mozilla\Firefox\Profiles\ui9vo4h8.default\cookies.sqlite:247realmedia.com
C:\Users\Noel\AppData\Roaming\Mozilla\Firefox\Profiles\ui9vo4h8.default\cookies.sqlite:ad.360yield.com
C:\Users\Noel\AppData\Roaming\Mozilla\Firefox\Profiles\ui9vo4h8.default\cookies.sqlite:ad.yieldmanager.com
C:\Users\Noel\AppData\Roaming\Mozilla\Firefox\Profiles\ui9vo4h8.default\cookies.sqlite:adbrite.com
C:\Users\Noel\AppData\Roaming\Mozilla\Firefox\Profiles\ui9vo4h8.default\cookies.sqlite:ads.footymad.net
C:\Users\Noel\AppData\Roaming\Mozilla\Firefox\Profiles\ui9vo4h8.default\cookies.sqlite:ads.trafficjunky.net
C:\Users\Noel\AppData\Roaming\Mozilla\Firefox\Profiles\ui9vo4h8.default\cookies.sqlite:adserver.adtechus.com
C:\Users\Noel\AppData\Roaming\Mozilla\Firefox\Profiles\ui9vo4h8.default\cookies.sqlite:adtech.de
C:\Users\Noel\AppData\Roaming\Mozilla\Firefox\Profiles\ui9vo4h8.default\cookies.sqlite:advertising.com
C:\Users\Noel\AppData\Roaming\Mozilla\Firefox\Profiles\ui9vo4h8.default\cookies.sqlite:adviva.net
C:\Users\Noel\AppData\Roaming\Mozilla\Firefox\Profiles\ui9vo4h8.default\cookies.sqlite:apmebf.com
C:\Users\Noel\AppData\Roaming\Mozilla\Firefox\Profiles\ui9vo4h8.default\cookies.sqlite:at.atwola.com
C:\Users\Noel\AppData\Roaming\Mozilla\Firefox\Profiles\ui9vo4h8.default\cookies.sqlite:atdmt.com
C:\Users\Noel\AppData\Roaming\Mozilla\Firefox\Profiles\ui9vo4h8.default\cookies.sqlite:casalemedia.com
C:\Users\Noel\AppData\Roaming\Mozilla\Firefox\Profiles\ui9vo4h8.default\cookies.sqlite:collective-media.net
C:\Users\Noel\AppData\Roaming\Mozilla\Firefox\Profiles\ui9vo4h8.default\cookies.sqlite:doubleclick.net
C:\Users\Noel\AppData\Roaming\Mozilla\Firefox\Profiles\ui9vo4h8.default\cookies.sqlite:engine.phn.doublepimp.com
C:\Users\Noel\AppData\Roaming\Mozilla\Firefox\Profiles\ui9vo4h8.default\cookies.sqlite:exoclick.com
C:\Users\Noel\AppData\Roaming\Mozilla\Firefox\Profiles\ui9vo4h8.default\cookies.sqlite:fastclick.net
C:\Users\Noel\AppData\Roaming\Mozilla\Firefox\Profiles\ui9vo4h8.default\cookies.sqlite:invitemedia.com
C:\Users\Noel\AppData\Roaming\Mozilla\Firefox\Profiles\ui9vo4h8.default\cookies.sqlite:media6degrees.com
C:\Users\Noel\AppData\Roaming\Mozilla\Firefox\Profiles\ui9vo4h8.default\cookies.sqlite:pornhub.com
C:\Users\Noel\AppData\Roaming\Mozilla\Firefox\Profiles\ui9vo4h8.default\cookies.sqlite:revsci.net
C:\Users\Noel\AppData\Roaming\Mozilla\Firefox\Profiles\ui9vo4h8.default\cookies.sqlite:ru4.com
C:\Users\Noel\AppData\Roaming\Mozilla\Firefox\Profiles\ui9vo4h8.default\cookies.sqlite:serving-sys.com
C:\Users\Noel\AppData\Roaming\Mozilla\Firefox\Profiles\ui9vo4h8.default\cookies.sqlite:specificclick.net
C:\Users\Noel\AppData\Roaming\Mozilla\Firefox\Profiles\ui9vo4h8.default\cookies.sqlite:statcounter.com
C:\Users\Noel\AppData\Roaming\Mozilla\Firefox\Profiles\ui9vo4h8.default\cookies.sqlite:stats.ilivid.com
C:\Users\Noel\AppData\Roaming\Mozilla\Firefox\Profiles\ui9vo4h8.default\cookies.sqlite:tribalfusion.com
C:\Users\Noel\AppData\Roaming\Mozilla\Firefox\Profiles\ui9vo4h8.default\cookies.sqlite:zedo.com

B-boy/StyLe/ · May 25, 2014

Hello,

I don't see any malware related entries except for a few potentially unwanted applications:

STEP 1

Click on Start > type in appwiz.cpl in the search box and press Enter
Find and uninstall the following programs from the list

AVG Security Toolbar

IdleCrawler

Registry Mechanic 10.0 (check the warning below)...

Yahoo! Software Update

Yahoo! Toolbar

Registry Editor / Cleaner Warning !!

The following is referring to Registry Mechanic 10.0.
Please be aware that bleepingcomputer staff do not recommend the usage of registry cleaners / tools due to the following facts:

Registry tools can cause irreparable damage to your Operating System
Registry tools can, as a result of the above, render your pc to be inoperable.

This is done, assuming that the major audience here at this board might be inexperienced users and thus a suggested safeguard from our side.
If you feel you have the need for a registry cleaner, then you are just as welcome to keep it. This is what we refer to an "optional fix" and is up to the user, so just take this as a recommendation from my side.

For more information about why you should avoid using a such programs please take a look here => Registry Cleaners and System Tweaking Tools

STEP 2

Next please download the following file => fixlist.txt and save it to the Desktop.
NOTE. It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work.

Run FRST and press the Fix button just once and wait.
The tool will make a log on the Desktop (Fixlog.txt). Please post it to your reply.

STEP 3

Please download AdwCleaner by Xplode and save to your Desktop.

Double click on AdwCleaner.exe to run the tool.
Vista/Windows 7/8 users right-click and select Run As Administrator.
Click on the Scan button.
AdwCleaner will begin to scan your computer like it did before.
After the scan has finished click on the Clean button.
Press OK when asked to close all programs and follow the onscreen prompts.
Press OK again to allow AdwCleaner to restart the computer and complete the removal process.
After rebooting, a logfile report (AdwCleaner[s0].txt) will open automatically.
Copy and paste the contents of that logfile in your next reply.
A copy of that logfile will also be saved in the C:\AdwCleaner folder.

STEP 4

Please download Junkware Removal Tool to your desktop.

Shut down your protection software now to avoid potential conflicts.
Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
The tool will open and start scanning your system.
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next message.

Let me know if you still experience the volume mixer issue in your next reply after the steps above.

Regards,

Georgi

Noelz · May 26, 2014

Yahoo Toolbar wouldn't install, even when I downloaded IObit Uninstaller

Fixlog:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 25-05-2014 02
Ran by Noel at 2014-05-26 21:12:50 Run:1
Running from C:\Users\Noel\Desktop
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
start
HKLM-x32\...\Run: [] => [X]
HKU\S-1-5-21-1843119849-658739943-1546731566-1000\...\RunOnce: [Del5236953] - cmd.exe /Q /D /c del "C:\Users\CRESCE~1\AppData\Local\Temp\0.del"
Toolbar: HKLM-x32 - No Name - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - No File
Toolbar: HKLM-x32 - No Name - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File
Toolbar: HKLM-x32 - No Name - {b760d5a4-8d24-4cb6-942e-d6bb540ad88c} - No File
Toolbar: HKLM-x32 - No Name - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No File
Toolbar: HKLM-x32 - No Name - {95B7759C-8C7F-4BF1-B163-73684A933233} - No File
Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
Toolbar: HKCU - No Name - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - No File
Toolbar: HKCU - No Name - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File
Toolbar: HKCU - No Name - {B760D5A4-8D24-4CB6-942E-D6BB540AD88C} - No File
Toolbar: HKCU - No Name - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No File
FF DefaultSearchEngine: Secure Search
FF SearchEngineOrder.1: Secure Search
FF SelectedSearchEngine: Secure Search
FF Plugin-x32: @avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin - C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\18.1.0\\npsitesafety.dll No File
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\avg-secure-search.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\sweettunes_search.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\avg-secure-search.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\sweettunes_search.xml
FF HKLM-x32\...\Firefox\Extensions: [avg@toolbar] - C:\ProgramData\AVG Secure Search\FireFoxExt\18.1.0.443
FF Extension: AVG Security Toolbar - C:\ProgramData\AVG Secure Search\FireFoxExt\18.1.0.443 [2014-04-30]
CHR HKLM-x32\...\Chrome\Extension: [ndibdjnfmopecpmkdieinmbadjfpblof] - C:\ProgramData\AVG Secure Search\ChromeExt\17.3.0.49\avg.crx [2014-05-21]
R2 PCToolsSSDMonitorSvc; C:\Program Files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe [583640 2010-08-05] (PC Tools)
R2 vToolbarUpdater18.1.0; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.1.0\ToolbarUpdater.exe [1801240 2014-04-30] (AVG Secure Search)
R1 avgtp; C:\Windows\system32\drivers\avgtpx64.sys [50464 2014-04-30] (AVG Technologies)
C:\Windows\system32\drivers\avgtpx64.sys
2014-05-22 16:12 - 2014-05-22 16:12 - 00002159 _____ () C:\Users\CRESCENTIA\Downloads\5A08.tmp
C:\ProgramData\AVG Secure Search
C:\Program Files (x86)\AVG Secure Search
C:\Windows\System32\Tasks\Speedial
C:\Users\CRESCENTIA\AppData\Local\IdleCrawler
C:\Users\CRESCE~1\AppData\Roaming\Speedial
C:\Windows\System32\Tasks\IdleCrawler Runner
C:\Windows\System32\Tasks\Microsoft\Windows\Maintenance\IdleCrawler Update
C:\Users\CRESCENTIA\AppData\Local\Conduit
C:\Users\CRESCENTIA\AppData\Local\OpenCandy
C:\Users\CRESCENTIA\AppData\LocalLow\Conduit
C:\Users\CRESCENTIA\AppData\LocalLow\SweetIM
C:\Program Files (x86)\Common Files\AVG Secure Search
Reg: reg delete "HKLM\SOFTWARE\Classes\Installer\UpgradeCodes\A97CEC23332751B47BA4B95BAA50C9D0" /f
Reg: reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\A97CEC23332751B47BA4B95BAA50C9D0" /f
Reg: reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\02F47BF73B948514FAACADD8CBBDF37D" /f
Reg: reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\080D9F5E1E95FEE4794CE438E635239E" /f
Reg: reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1E264E0A5959A1C46BA9175A878B12EA" /f
Reg: reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2E6768B6932D112438F047C54D180635" /f
Reg: reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\351716A953E21214898904032EAE2E81" /f
Reg: reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\397C771A7BCAC904697C3EC629ED33ED" /f
Reg: reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\69D6A6B2ED56AF24EA6335EAD6E91CA4" /f
Reg: reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7FFA128C2B0FF414D805FC5627883401" /f
Reg: reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\97C3D0F82E712E241A2F969F45E3351C" /f
Reg: reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\98CC8BF5A4A6E6C4ABF7051DDAB8B058" /f
Reg: reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A189D17A469616C4688D23E192996267" /f
Reg: reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BF4F885EDEE45644EB1E0C99E0162399" /f
Reg: reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D15DAF33C220F91468A1D7D57C31ACD7" /f
Reg: reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D3BA76A44C779424889063D5098ED2D6" /f
Reg: reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D6D0EB9FDBD90C04D92A7E729058F10D" /f
Reg: reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E4748F9A4181FCE46A23C13B517B9420" /f
Reg: reg delete "HKU\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4}" /f
Reg: reg delete "HKU\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4}" /f
Reg: reg delete "HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4}" /f
Reg: reg delete "HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4}" /f
Reg: reg delete "HKU\S-1-5-21-1843119849-658739943-1546731566-1000\Software\AppDataLow\Software\Conduit" /f
Reg: reg delete "HKU\S-1-5-21-1843119849-658739943-1546731566-1000\Software\Conduit" /f
Reg: reg delete "HKU\S-1-5-21-1843119849-658739943-1546731566-1000\Software\Microsoft\Internet Explorer\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4}" /f
Reg: reg delete "HKU\S-1-5-21-1843119849-658739943-1546731566-1000\Software\Microsoft\Internet Explorer\SearchScopes\{f05c97d3-449c-4e72-a8eb-af9e39e3978d}" /f
Reg: reg delete "HKU\S-1-5-21-1843119849-658739943-1546731566-1000\Software\Softonic" /f
Task: {046AA288-97AA-496E-9E97-23D95B7542EC} - System32\Tasks\RMSchedule => C:\Program Files (x86)\Registry Mechanic\RegMech.exe
Task: {2F569F19-8C2E-4C54-8D36-8B16B3332E44} - System32\Tasks\Microsoft\Windows\Maintenance\IdleCrawler Update => %LOCALAPPDATA%\IdleCrawler\IdleCrawler.exe
Task: {76A84B1F-A3C3-41FE-A598-9857585E82EF} - System32\Tasks\RMSmartUpdate => C:\Program Files (x86)\Registry Mechanic\update.exe
Task: {D4A41EE1-7232-4515-8492-D7FA7C83659F} - System32\Tasks\Speedial => C:\Users\CRESCE~1\AppData\Roaming\Speedial\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: {E5F8FF7C-4F1F-49A4-90B3-4A110BD04CC3} - System32\Tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv => C:\Windows\TEMP\{4D0F2166-5ACC-49C4-8A77-ACFAEE67A9CF}.exe
Task: {FD2D4378-90DB-4986-94BB-E63FF5D07D92} - System32\Tasks\IdleCrawler Runner => %LOCALAPPDATA%\IdleCrawler\IdleCrawler.exe
Task: C:\Windows\Tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv.job => C:\Windows\TEMP\{4D0F2166-5ACC-49C4-8A77-ACFAEE67A9CF}.exe
Task: C:\Windows\Tasks\Speedial.job => C:\Users\CRESCE~1\AppData\Roaming\Speedial\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
AlternateDataStreams: C:\ProgramData\Temp:D1B5B4F1
Folder: C:\Quarantine
C:\Users\Noel\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5
C:\Users\CRESCENTIA\AppData\Local\Temp
end
*****************

HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\ => Value deleted successfully.
HKU\S-1-5-21-1843119849-658739943-1546731566-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\\Del5236953 => Value not found.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\\{4B3803EA-5230-4DC3-A7FC-33638F3D3542} => Value deleted successfully.
HKCR\Wow6432Node\CLSID\{4B3803EA-5230-4DC3-A7FC-33638F3D3542} => Key not found.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\\{CCC7A320-B3CA-4199-B1A6-9F516DD69829} => Value deleted successfully.
HKCR\Wow6432Node\CLSID\{CCC7A320-B3CA-4199-B1A6-9F516DD69829} => Key not found.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\\{b760d5a4-8d24-4cb6-942e-d6bb540ad88c} => Value deleted successfully.
HKCR\Wow6432Node\CLSID\{b760d5a4-8d24-4cb6-942e-d6bb540ad88c} => Key not found.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\\{EF99BD32-C1FB-11D2-892F-0090271D4F88} => Value deleted successfully.
HKCR\Wow6432Node\CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88} => Key not found.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\\{95B7759C-8C7F-4BF1-B163-73684A933233} => Value deleted successfully.
HKCR\Wow6432Node\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233} => Key not found.
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} => Value deleted successfully.
HKCR\CLSID\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} => Key not found.
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{21FA44EF-376D-4D53-9B0F-8A89D3229068} => Value deleted successfully.
HKCR\CLSID\{21FA44EF-376D-4D53-9B0F-8A89D3229068} => Key not found.
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{4B3803EA-5230-4DC3-A7FC-33638F3D3542} => Value deleted successfully.
HKCR\CLSID\{4B3803EA-5230-4DC3-A7FC-33638F3D3542} => Key not found.
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{CCC7A320-B3CA-4199-B1A6-9F516DD69829} => Value deleted successfully.
HKCR\CLSID\{CCC7A320-B3CA-4199-B1A6-9F516DD69829} => Key not found.
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{B760D5A4-8D24-4CB6-942E-D6BB540AD88C} => Value deleted successfully.
HKCR\CLSID\{B760D5A4-8D24-4CB6-942E-D6BB540AD88C} => Key not found.
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} => Value deleted successfully.
HKCR\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} => Key not found.
Firefox DefaultSearchEngine deleted successfully.
Firefox SearchEngineOrder.1 deleted successfully.
Firefox SelectedSearchEngine deleted successfully.
HKLM\Software\Wow6432Node\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin => Key deleted successfully.
C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\18.1.0\\npsitesafety.dll not found.
C:\Program Files (x86)\mozilla firefox\searchplugins\avg-secure-search.xml => Moved successfully.
C:\Program Files (x86)\mozilla firefox\searchplugins\sweettunes_search.xml => Moved successfully.
C:\Program Files (x86)\mozilla firefox\browser\searchplugins\avg-secure-search.xml => Moved successfully.
C:\Program Files (x86)\mozilla firefox\browser\searchplugins\sweettunes_search.xml => Moved successfully.
HKLM\Software\Wow6432Node\Mozilla\Firefox\Extensions\\avg@toolbar => Value deleted successfully.
C:\ProgramData\AVG Secure Search\FireFoxExt\18.1.0.443 => Moved successfully.
HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof => Key deleted successfully.
"C:\ProgramData\AVG Secure Search\ChromeExt\17.3.0.49\avg.crx" => File/Directory not found.
PCToolsSSDMonitorSvc => Service stopped successfully.
PCToolsSSDMonitorSvc => Service deleted successfully.
vToolbarUpdater18.1.0 => Service stopped successfully.
vToolbarUpdater18.1.0 => Service deleted successfully.
avgtp => Service stopped successfully.
avgtp => Service deleted successfully.
C:\Windows\system32\drivers\avgtpx64.sys => Moved successfully.
C:\Users\CRESCENTIA\Downloads\5A08.tmp => Moved successfully.
C:\ProgramData\AVG Secure Search => Moved successfully.
"C:\Program Files (x86)\AVG Secure Search" => File/Directory not found.
C:\Windows\System32\Tasks\Speedial => Moved successfully.
C:\Users\CRESCENTIA\AppData\Local\IdleCrawler => Moved successfully.
"C:\Users\CRESCE~1\AppData\Roaming\Speedial" => File/Directory not found.
"C:\Windows\System32\Tasks\IdleCrawler Runner" => File/Directory not found.
C:\Windows\System32\Tasks\Microsoft\Windows\Maintenance\IdleCrawler Update => Moved successfully.
C:\Users\CRESCENTIA\AppData\Local\Conduit => Moved successfully.
C:\Users\CRESCENTIA\AppData\Local\OpenCandy => Moved successfully.
C:\Users\CRESCENTIA\AppData\LocalLow\Conduit => Moved successfully.
C:\Users\CRESCENTIA\AppData\LocalLow\SweetIM => Moved successfully.
C:\Program Files (x86)\Common Files\AVG Secure Search => Moved successfully.

========= reg delete "HKLM\SOFTWARE\Classes\Installer\UpgradeCodes\A97CEC23332751B47BA4B95BAA50C9D0" /f =========

The operation completed successfully.

========= End of Reg: =========

========= reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\A97CEC23332751B47BA4B95BAA50C9D0" /f =========

The operation completed successfully.

========= End of Reg: =========

========= reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\02F47BF73B948514FAACADD8CBBDF37D" /f =========

The operation completed successfully.

========= End of Reg: =========

========= reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\080D9F5E1E95FEE4794CE438E635239E" /f =========

The operation completed successfully.

========= End of Reg: =========

========= reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1E264E0A5959A1C46BA9175A878B12EA" /f =========

The operation completed successfully.

========= End of Reg: =========

========= reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2E6768B6932D112438F047C54D180635" /f =========

The operation completed successfully.

========= End of Reg: =========

========= reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\351716A953E21214898904032EAE2E81" /f =========

The operation completed successfully.

========= End of Reg: =========

========= reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\397C771A7BCAC904697C3EC629ED33ED" /f =========

The operation completed successfully.

========= End of Reg: =========

========= reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\69D6A6B2ED56AF24EA6335EAD6E91CA4" /f =========

The operation completed successfully.

========= End of Reg: =========

========= reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7FFA128C2B0FF414D805FC5627883401" /f =========

The operation completed successfully.

========= End of Reg: =========

========= reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\97C3D0F82E712E241A2F969F45E3351C" /f =========

The operation completed successfully.

========= End of Reg: =========

========= reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\98CC8BF5A4A6E6C4ABF7051DDAB8B058" /f =========

The operation completed successfully.

========= End of Reg: =========

========= reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A189D17A469616C4688D23E192996267" /f =========

The operation completed successfully.

========= End of Reg: =========

========= reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BF4F885EDEE45644EB1E0C99E0162399" /f =========

The operation completed successfully.

========= End of Reg: =========

========= reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D15DAF33C220F91468A1D7D57C31ACD7" /f =========

The operation completed successfully.

========= End of Reg: =========

========= reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D3BA76A44C779424889063D5098ED2D6" /f =========

The operation completed successfully.

========= End of Reg: =========

========= reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D6D0EB9FDBD90C04D92A7E729058F10D" /f =========

The operation completed successfully.

========= End of Reg: =========

========= reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E4748F9A4181FCE46A23C13B517B9420" /f =========

The operation completed successfully.

========= End of Reg: =========

========= reg delete "HKU\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4}" /f =========

The operation completed successfully.

========= End of Reg: =========

========= reg delete "HKU\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4}" /f =========

ERROR: The system was unable to find the specified registry key or value.

========= End of Reg: =========

========= reg delete "HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4}" /f =========

The operation completed successfully.

========= End of Reg: =========

========= reg delete "HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4}" /f =========

The operation completed successfully.

========= End of Reg: =========

========= reg delete "HKU\S-1-5-21-1843119849-658739943-1546731566-1000\Software\AppDataLow\Software\Conduit" /f =========

ERROR: The system was unable to find the specified registry key or value.

========= End of Reg: =========

========= reg delete "HKU\S-1-5-21-1843119849-658739943-1546731566-1000\Software\Conduit" /f =========

ERROR: The system was unable to find the specified registry key or value.

========= End of Reg: =========

========= reg delete "HKU\S-1-5-21-1843119849-658739943-1546731566-1000\Software\Microsoft\Internet Explorer\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4}" /f =========

ERROR: The system was unable to find the specified registry key or value.

========= End of Reg: =========

========= reg delete "HKU\S-1-5-21-1843119849-658739943-1546731566-1000\Software\Microsoft\Internet Explorer\SearchScopes\{f05c97d3-449c-4e72-a8eb-af9e39e3978d}" /f =========

ERROR: The system was unable to find the specified registry key or value.

========= End of Reg: =========

========= reg delete "HKU\S-1-5-21-1843119849-658739943-1546731566-1000\Software\Softonic" /f =========

ERROR: The system was unable to find the specified registry key or value.

========= End of Reg: =========

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{046AA288-97AA-496E-9E97-23D95B7542EC} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{046AA288-97AA-496E-9E97-23D95B7542EC} => Key deleted successfully.
C:\Windows\System32\Tasks\RMSchedule => Moved successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\RMSchedule => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{2F569F19-8C2E-4C54-8D36-8B16B3332E44} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{2F569F19-8C2E-4C54-8D36-8B16B3332E44} => Key deleted successfully.
C:\Windows\System32\Tasks\Microsoft\Windows\Maintenance\IdleCrawler Update not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Maintenance\IdleCrawler Update => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{76A84B1F-A3C3-41FE-A598-9857585E82EF} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{76A84B1F-A3C3-41FE-A598-9857585E82EF} => Key deleted successfully.
C:\Windows\System32\Tasks\RMSmartUpdate => Moved successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\RMSmartUpdate => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{D4A41EE1-7232-4515-8492-D7FA7C83659F} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{D4A41EE1-7232-4515-8492-D7FA7C83659F} => Key deleted successfully.
C:\Windows\System32\Tasks\Speedial not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Speedial => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{E5F8FF7C-4F1F-49A4-90B3-4A110BD04CC3} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{E5F8FF7C-4F1F-49A4-90B3-4A110BD04CC3} => Key deleted successfully.
C:\Windows\System32\Tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv => Moved successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\AVG-Secure-Search-Update_JUNE2013_TB_rmv => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{FD2D4378-90DB-4986-94BB-E63FF5D07D92} => Key not found.
C:\Windows\System32\Tasks\IdleCrawler Runner not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\IdleCrawler Runner => Key not found.
C:\Windows\Tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv.job => Moved successfully.
C:\Windows\Tasks\Speedial.job => Moved successfully.
C:\ProgramData\Temp => ":D1B5B4F1" ADS removed successfully.

========================= Folder: C:\Quarantine ========================

2014-05-20 15:38 - 2014-05-20 15:38 - 0000000 ____D () C:\Quarantine\Stinger
2014-05-20 15:38 - 2014-05-20 15:38 - 0012288 _____ () C:\Quarantine\Stinger\Quarantine.db

====== End of Folder: ======

C:\Users\Noel\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 => Moved successfully.
C:\Users\CRESCENTIA\AppData\Local\Temp => Moved successfully.

==== End of Fixlog ====

AdwCleanerS0.txt

AdwCleanerS1.txt

JRT Log:

Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 7 Home Premium x64
Ran by Noel on 26/05/2014 at 22:08:09.75
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Registry Values

~~~ Registry Keys

~~~ Files

~~~ Folders

~~~ Event Viewer Logs were cleared

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 26/05/2014 at 22:23:04.57
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Furthermore, the 'Name not available' is no longer in my volume mixer.

B-boy/StyLe/ · May 27, 2014

Nice work!

Before I let you go let's check for old software:

Download Security Check by screen317 from here.

Save it to your Desktop.
Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
A Notepad document should open automatically called checkup.txt; please post the contents of that document.

Regards,

Georgi

Noelz · May 27, 2014

Results of screen317's Security Check version 0.99.83
Windows 7 Service Pack 1 x64 (UAC is enabled)
Internet Explorer 11
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Enabled!
McAfee Anti-Virus and Anti-Spyware
WMI entry may not exist for antivirus; attempting automatic update.
`````````Anti-malware/Other Utilities Check:`````````
Java 6 Update 18
Java 7 Update 45
Java version out of Date!
Adobe Flash Player 13.0.0.214
Adobe Reader XI
Mozilla Firefox 11.0 Firefox out of Date!
Google Chrome 34.0.1847.137
Google Chrome 35.0.1916.114
````````Process Check: objlist.exe by Laurent````````
Malwarebytes Anti-Malware mbamservice.exe
Malwarebytes Anti-Malware mbam.exe
Malwarebytes Anti-Malware mbamscheduler.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: 16% Defragment your hard drive soon! (Do NOT defrag if SSD!)
````````````````````End of Log``````````````````````

B-boy/StyLe/ · May 28, 2014

Hello,

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version of Java components and upgrade the application.

Download the latest version of Java SE 8.
Click the Java SE 8u5 "Download JRE" button to the right.
Select your Platform, Register and check the box that says: "I agree to the Java SE Runtime Environment 7 License Agreement.".
Click on Continue.
Click on the link to download Windows Offline Installation (jre-8u5-windows-i586.exe) and save it to your desktop. Do NOT use the Sun Download Manager..
Close any programs you may have running - especially your web browser.
Go to Start > Control Panel > Programs, click on Uninstall a program and remove all older versions of Java:
Java™ 6 Update 18
Java 7 Update 45
Check any item with Java Runtime Environment (JRE or J2SE) in the name.
Click the Remove or Change/Remove button.
Repeat as many times as necessary to remove each Java version.
Reboot your computer once all Java components are removed.
Then from your desktop double-click on the download to install the newest version. (Vista/Windows 7 users, right click on the jre-8u5-windows-i586.exe and select "Run as an Administrator.")

Your Mozilla Firefox is out of date!
Download and install the latest version Mozilla Firefox 29.0.1 Final for Windows
Do a backup of your existing profile using Mozbackup or FEBE before you proceed with the update.

Run Windows Defragmenter to improve the computer performance (only if your HDD is not SSD)!!

Ways to improve your computer's performance

It is possible for other programs on your computer to have security vulnerability that can allow malware to infect you.
Therefore, it is also a good idea to check for the latest versions of commonly installed applications that are regularly patched to fix vulnerabilities.
You can check these by visiting Secunia Software Inspector or you can use the following application for this purpose PatchMyPC

Visit Microsoft's Windows Update Site Frequently

It is important that you visit Windows Update regularly.
This will ensure your computer has always the latest security updates available installed on your computer.
If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.

When done please post a new log from SecurityCheck.

I'll give you my final recommendations in the next post.

Regards,

Georgi

B-boy/StyLe/ · June 1, 2014

Hello,

Do you still need assistance?

Regards,

Georgi

Noelz · June 1, 2014

Sorry about that Georgi,

Heres the SecurtyCheck Log:

Results of screen317's Security Check version 0.99.83
Windows 7 Service Pack 1 x64 (UAC is enabled)
Internet Explorer 11
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Enabled!
McAfee Anti-Virus and Anti-Spyware
WMI entry may not exist for antivirus; attempting automatic update.
`````````Anti-malware/Other Utilities Check:`````````
Secunia PSI (3.0.0.9016)
Java 8 Update 5
Java version out of Date!
Adobe Flash Player 13.0.0.214
Adobe Reader XI
Google Chrome 34.0.1847.137
Google Chrome 35.0.1916.114
````````Process Check: objlist.exe by Laurent````````
Malwarebytes Anti-Malware mbamservice.exe
Malwarebytes Anti-Malware mbam.exe
Malwarebytes Anti-Malware mbamscheduler.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: 14% Defragment your hard drive soon! (Do NOT defrag if SSD!)
````````````````````End of Log``````````````````````

B-boy/StyLe/ · June 3, 2014

Hello,

Nice work...however you still need to defrag your system drive (only if you don't use SSD).

I guess I can post my final recommendations to you now:

Nicely done ! This is the end of our journey if you don't have any more questions.
Thank you for following my instructions perfectly.
I have some final words for you.
All Clean !
Your machine appears to be clean, please take the time to read below on how to secure the machine and take the necessary steps to keep it Clean.

STEP 1 CLEANUP

To remove all of the tools we used and the files and folders they created, please do the following:

Download the following file => fixlist.txt and save it to the Desktop.
NOTE. It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work.

Run FRST/FRST64 and press the Fix button just once and wait.
It's no needed to post the log this time.

Next please download Delfix.exe by Xplode and save it to your desktop.
Please start it and check the box next to "Remove disinfection tools" and click on the run button.
The tool will delete itself once it finishes.

Note: If any tool, file, log file or folder (belonging to the program we have used) hasn't been deleted, please delete it manually.

STEP 2 SECURITY ADVICES

Change all your passwords !

Since your computer was infected for peace of mind, I would however advise you that all your passwords be changed immediately including those for bank accounts, credit cards and home loans, PIN codes etc)!! (just in case).
If you're storing password in the browser to access websites than they are non encrypted well (only if you use Firefox with master password protection activated provide better security). So I strongly recommend to change as much password as possible. Many of the modern malware samples have backdoor abilities and can steal confidential information from the compromised computer. Also you should check for any suspicious transactions if such occur. If you find out that you have been victim to fraud contact your bank or the appropriate institution for assistance.
Use different passwords for all your accounts. Also don't use easy passwords such as your favorite teams, bands or pets because this will allow people to guess your password.
You can use PC Tools Password Generator to create random passwords and then install an application like KeePass Password Safe to store them for easy access.If you do Online Banikng please read this article: Online Banking Protection Against Identity Theft

Keep your antivirus software turned on and up-to-date

Make sure your antivirus software is turned on and up-to-date.
New viruses come out every minute, so it is essential that you have the latest signatures for your antivirus program to provide you with the best possible protection from malicious software.
Note:
You should only have one antivirus installed at a time. Having more than one antivirus program installed at once is likely to cause conflicts and may well decrease your overall protection as well as impairing the performance of your PC.
You should scan your computer with an AntiSpyware program like Malwarebytes' Anti-Malware on a regular basis just as you would an antivirus software.
Be sure to check for and download any definition updates prior to performing a scan.
Also keep in mind that MBAM is not a replacement for antivirus software, it is meant to complement the protection provided by a full antivirus product and is designed to detect the threats that are missed by most antivirus software.

Install HIPS based software if needed (or use Limited Account with UAC enabled)

I usually recommend to users to install HIPS based software but this type software is only effective in the right hands since it require from the users to take the right decisions.

HIPS based software controls what an application is allowed to do and not allowed to do.
It monitors what each application tries to do, how it use the internet and give you the ability to block any suspicious activity occurring on your computer.
In my opinion the best way to prevent an unknown malware from gaining access is to use some HIPS programs (like COMODO Firewall, PrivateFirewall, Online Armor etc.) to control the access rights of legitimate applications, although this would only be advisable for experienced users. (so if you don't feel comfortable using such software then you can skip this advice)

However, you should be aware though that (if you install Comodo Firewall and not the whole package Comodo Internet Security) this is not an replacement for a standard antivirus application. It's a great tool to add another layer of protection to your existent antivirus application. Also note that if you have an antivirus installed then you should install Comodo Firewall (and not Comodo Internet Security to avoid conflicts).

It takes some time and knowledge to configure it for individual purposes but once done, you should not have a problems with it.
There are so many reviews on YouTube and blogs about all these programs.
Keep in mind to choose carefully in order to avoid conflicts or instability caused by incompatible security programs.
Also having more than one "real-time" program can be a drain on your PC's efficiency so please refrain doing so.
More information about HIPS can be found here: What is Host Intrusion Prevention System (HIPS) and how does it work?

If you like Comodo you should choose for yourself which version of Comodo you will use 5 or 7. Personally I stick to version 5 at least for now.

If these kind of programs are difficult for you to use then you can use a standard user account with UAC enabled. If you need administrative privileges to perform some tasks, then you can use Run As or log on as the administrator account for that specific task.

Be prepared for CryptoLocker:

CryptoLocker Ransomware Information Guide and FAQ
Cryptolocker Ransomware: What You Need To Know
New CryptoLocker Ransomware Variant Spread Through Yahoo Messenger
CryptoDefense and How_Decrypt Ransomware Information Guide and FAQ
CryptoWall - A new ransomware from the creators of CryptoDefense

Since the prevention is better than cure you can use gpedit built-in Windows or CryptoPrevent (described in the first link) to secure the PC against this locker.
Another way is to use Comodo Firewall and to add all local disks to Protected Files and Folders
You may want to check HitmanPro.Alert.CryptoGuard and add install it to be safe when surfing the net.

Practice Safe Internet

One of the main reasons people get infected in the first place is that they are not practicing Safe Internet. You practice Safe Internet when you educate yourself on how to properly use the Internet through the use of security tools and good practice. Knowing how you can get infected and what types of files and sites to avoid will be the most crucial step in keeping your computer malware free. The reality is that the majority of people who are infected with malware are ones who click on things they shouldn't be clicking on. Whether these things are files or sites it doesn't really matter. If something is out to get you, and you click on it, it most likely will. Below are a list of simple precautions to take to keep your computer clean and running securely:

If you receive an attachment from someone you do not know, DO NOT OPEN IT! Simple as that. Opening attachments from people you do not know is a very common method for viruses or worms to infect your computer.
.exe, .com, .bat, .pif, .scr, .cmd or .vbs do not open the attachment unless you know for a fact that it is clean. For the casual computer user, you will almost never receive a valid attachment of this type.
If you receive an attachment from someone you know, and it looks suspicious, then it probably is. The email could be from someone you know infected with a malware that is trying to infect everyone in their address book.
If you are browsing the Internet and a popup appears saying that you are infected, ignore it!. These are, as far as I am concerned, scams that are being used to scare you into purchasing a piece of software. For an example of these types of popups, or Foistware, you should read this article:
Foistware, And how to avoid it. There are also programs that disguise themselves as Anti-Spyware or security products but are instead scams. For a list of these types of programs we recommend you visit this link: About Malwares, Rogues, Scarewares, SmitfraudFix
Another tactic to fool you on the web is when a site displays a popup that looks like a normal Windows message or alert. When you click on them, though, they instead bring you to another site that is trying to push a product on you. We suggest that you close these windows by clicking on the X instead of the OK button. Alternatively, you can check to see if it's a real alert by right-clicking on the window. If there is a menu that comes up saying Add to Favorites... you know it's a fake.
Do not go to adult sites. I know this may bother some of you, but the fact is that a large amount of malware is pushed through these types of sites. I am not saying all adult sites do this, but a lot do.
When using an Instant Messaging program be cautious about clicking on links people send to you. It is not uncommon for infections to send a message to everyone in the infected person's contact list that contains a link to an infection. Instead when you receive a message that contains a link, message back to the person asking if it is legit before you click on it.
Stay away from Warez and Crack sites! In addition to the obvious copyright issues, the downloads from these sites are typically overrun with infections. Avoid using cracks and unknown programs from sources you don't trust. There are MANY alternative open-source applications. Malware writers just love cracks and keygens, and will often attach malicious code into them. By using cracks and/or keygens, you are asking for problems. So my advice is - stay away from them!
Be careful of what you download off of web sites and Peer-2-Peer networks. Some sites disguise malware as legitimate software to trick you into installing them and Peer-2-Peer networks are crawling with it. If you want to download a piece of software a from a site, and are not sure if they are legitimate, you can use McAfee Siteadvisor to look up info on the site. Note: skip this advice if your antivirus have a Web Guard.
DO NOT INSTALL any software without first reading the End User License Agreement, otherwise known as the EULA. A tactic that some developers use is to offer their software for free, but have spyware and other programs you do not want bundled with it. This is where they make their money. By reading the agreement there is a good chance you can spot this and not install the software.

Tweak your browsers

MOZILLA FIREFOX

To prevent further infections be sure to install the following add-ons NoScript and AdBlock Plus

Adblock Plus hides all those annoying (and potentially dangerous) advertisements on websites that try and tempt you to buy or download something. AdBlock not only speeds up your browsing and makes it easier on your eyes, but also makes it safer.

Adblock Plus can be found here.

Do not add to many filters subscriptions because it will slow down your browser startup time.

NoScript is only for advanced users as it blocks all the interactive parts of a webpage, such as login options. Obviously you wouldn’t want to block your ability to log on to your internet banking or your webmail, but thankfully you can tell NoScript to allow certain websites and block others. This is very useful to ensure that the website you’re visiting is not trying to tempt you to interact with another, more dangerous website.

NoScript can be found here

You can find the optimal settings here
A tutorial on how to use it can be found here

Google Chrome

If you like Google Chrome there are many similar extensions for this browser as well. Since I am not a Google Chrome user I can't tell you which of them are good and how they work. You should find out by yourself.

However Google Chrome can block a lot of unknown malware because of his sandbox.Beware of the fact that Google Chrome doesn't provide master password protection for your saved in the browser passwords. Check this out: Google Chrome security flaw offers unrestricted password access

For Internet Explorer 9/10 read the articles below:

Security and privacy features in Internet Explorer 9
Enhanced Protected Mode
Use Tracking Protection in Internet Explorer
Security in Internet Explorer 10

Immunize your browsers with SpywareBlaster 5 and Spybot Search and Destroy 1.6

Also MBAM acquired the following software Malwarebytes Anti-Exploit and it should work with the most popular browsers. Beware the product is in beta stage.
Changelog can be seen here and known issues here.

EMET and VoodooShield are another great tools which should lock the computer against exploits but they are too confusing to use for home users. However you can take a look at them if you want.

I would not install them all because they could render your pc unusable and will slow it down like a turtle.
Having more than one "real-time" program installed at once is likely to cause conflicts and may well decrease your overall protection as well as impairing the performance of your PC.

Make the extensions for known file types visible:

Be wary of files with a double extension such as jpg.exe. As a default setting, Windows often hides common file extensions, meaning that a program like image.jpg.exe will appear to you as simply image.jpg. Double extensions exploit this by hiding the second, dangerous extension and reassuring you with the first one.Check this out - Show or hide file name extensions.

Disable Autorun and Windows Scripting Host:

It's a good idea to disable the Autorun functionality using the following tool to prevent spreading of the infections from USB flash drives.

If you don't use any script files then you can go ahead and disable Windows Scripting Host using the tool provided by Symantec - NoScript.exe. Simple download and run it and click on the Disable button and reboot the computer. If you need to run any js. or vbs scripts at a later stage you should run NoScript again and select Enable, then reboot the computer.

Create an image of your system (you can use the built-in Windows software as well if you prefer)

Now when your pc is malware free it is a good idea to do a backup of all important files just in case something happens it.
Macrium Reflect is very good choice that enables you to create an image of your system drive which can be restored in case of problems.
The download link is here.
The tutorial on how to create an system image can be found here.
The tutorial on how to restore an system image can be found here.
Be sure to read the tutorial first.

Follow this list and your potential for being infected again will reduce dramatically.

Safe Surfing !

Cheers,
Georgi

Noelz · June 4, 2014

Thank you so much, my computer is working even better than before. I'll try to apply the instructions that you have given me.

AdvancedSetup · June 5, 2014

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

Name not available?!?

Recommended Posts

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Recently Browsing 0 members

Important Information