yontoo 1.10.02 removal & and other possible malwares

shug70 · June 20, 2014

HI. My browser (chrome & windows 7) recently began showing highlighted words on web pages that wouild produce pop-up type of ads when moused over. I did some research and found this yontoo 1.10.02 in my programs list. I get an error when trying to uninstall this program.

Ran a scan and fix with Malware Bytes free and Super anti-spyware free removed all threats detected. Re-booted my PC them started up Chrome and immediately had a proxy server error. I went into the browser setting and unchecked using a proxy server. Now the web browsing seems to be back to normal but I still have yontoo 1.10.02 in my installed programs in control panel->remove programs list but I cannot find yontoo 1.10.02 anywhere on my pc to manually delete the files!

please help & thank you!

kevinf80 · June 20, 2014

Hello and

P2P/Piracy Warning:

If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall them or completely disable them from running while being assisted here.
Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.
If you have illegal/cracked software, cracks, keygens etc. on the system, please remove or uninstall them now and read the policy on Piracy.

Next,

Download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system (32 bit or 64 bit). If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

Double-click to run it. When the tool opens click Yes to disclaimer.
Press Scan button.
It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

Kevin...

shug70 · June 20, 2014

Thank you Kevin!

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 21-06-2014

Ran by Tina (administrator) on TINA-PC on 20-06-2014 18:04:51

Running from C:\Users\Tina\Downloads\malware removal\farbar recovery

Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: English (United States)

Internet Explorer Version 11

Boot Mode: Normal

The only official download link for FRST:

Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/

Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/

Download link from any site other than Bleeping Computer is unpermitted or outdated.

See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgrsa.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgcsrva.exe

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCore64.exe

(Acronis) C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe

(Acronis) C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe

(Acronis) C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe

(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(SUPERAntiSpyware) C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe

(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe

(Acronis) C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe

(Acronis) C:\Program Files (x86)\Acronis\TrueImageHome\TimounterMonitor.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgui.exe

(NCSOFT Corporation) C:\Program Files (x86)\NCWest\NCLauncher\NCUpdateHelper.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe

(Acronis) C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgnsa.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgemca.exe

(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Extreme Tuning Utility\XtuService.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Integrated Clock Controller Service\ICCProxy.exe

(TeamSpeak Systems GmbH) C:\Program Files (x86)\TeamSpeak 3 Client\ts3client_win32.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1271072 2014-03-11] (Microsoft Corporation)

HKLM\...\Run: [Acronis Scheduler2 Service] => C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe [403112 2012-04-27] (Acronis)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13192848 2012-08-20] (Realtek Semiconductor)

HKLM\...\Run: [Nvtmru] => C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe [1028896 2013-08-27] (NVIDIA Corporation)

HKLM-x32\...\Run: [uSB3MON] => C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-01-04] (Intel Corporation)

HKLM-x32\...\Run: [NUSB3MON] => C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [115048 2011-09-16] (Renesas Electronics Corporation)

HKLM-x32\...\Run: [TrueImageMonitor.exe] => C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe [5955000 2012-04-27] (Acronis)

HKLM-x32\...\Run: [AcronisTimounterMonitor] => C:\Program Files (x86)\Acronis\TrueImageHome\TimounterMonitor.exe [1171304 2012-04-27] (Acronis)

HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-01-20] (Apple Inc.)

HKLM-x32\...\Run: [AVG_UI] => C:\Program Files (x86)\AVG\AVG2014\avgui.exe [5181456 2014-05-13] (AVG Technologies CZ, s.r.o.)

HKLM-x32\...\Run: [NCUpdateHelper] => C:\Program Files (x86)\NCWest\NCLauncher\NCUpdateHelper.exe [528360 2013-06-27] (NCSOFT Corporation)

HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)

HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-01-20] (Apple Inc.)

HKU\S-1-5-21-1490675113-1556375148-775488712-1000\...\Run: [PlayNC Launcher] => [X]

HKU\S-1-5-21-1490675113-1556375148-775488712-1000\...\Run: [Pando Media Booster] => C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe [3093624 2013-04-19] ()

HKU\S-1-5-21-1490675113-1556375148-775488712-1000\...\Run: [ROC_ROC_APR2013_AV] => C:\Users\Tina\AppData\Roaming\AVG April 2013 Campaign\AVG-Secure-Search-Update.exe /PROMPT --mid 7b8518251b1547d0a58ad16b0b9be047-defeac4d0fd1c2e51cd12c28b046300bbf2baa08 --CMPID ROC_APR2013_AV --CMPIDEXTRA 2013

HKU\S-1-5-21-1490675113-1556375148-775488712-1000\...\Run: [steam] => C:\Program Files (x86)\Steam\Steam.exe [1824000 2014-02-11] (Valve Corporation)

HKU\S-1-5-21-1490675113-1556375148-775488712-1000\...\Run: [AVG-Secure-Search-Update_0913a] => C:\Users\Tina\AppData\Roaming\AVG 0913a Campaign\AVG-Secure-Search-Update-0913a.exe /PROMPT --mid 7b8518251b1547d0a58ad16b0b9be047-defeac4d0fd1c2e51cd12c28b046300bbf2baa08 --CMPID 0913a

HKU\S-1-5-21-1490675113-1556375148-775488712-1000\...\Run: [skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [21444224 2014-05-08] (Skype Technologies S.A.)

HKU\S-1-5-21-1490675113-1556375148-775488712-1000\...\Run: [AVG-Secure-Search-Update_0214c] => C:\Users\Tina\AppData\Roaming\AVG 0214c Campaign\AVG-Secure-Search-Update-0214c.exe /PROMPT /mid=7b8518251b1547d0a58ad16b0b9be047-defeac4d0fd1c2e51cd12c28b046300bbf2baa08 /CMPID=0214c

HKU\S-1-5-21-1490675113-1556375148-775488712-1000\...\Run: [sUPERAntiSpyware] => C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [6564120 2014-06-04] (SUPERAntiSpyware)

ShellIconOverlayIdentifiers: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => No File

ShellIconOverlayIdentifiers: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => No File

ShellIconOverlayIdentifiers: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => No File

ShellIconOverlayIdentifiers: DropboxExt4 -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => No File

==================== Internet (Whitelisted) ====================

ProxyServer: http=127.0.0.1:13987;https=127.0.0.1:13987

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/?ocid=iehp

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x733B9691D612CE01

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-US

SearchScopes: HKCU - 13A690672BF342AC918EB35947DA53A4 URL = http://isearch.avg.com/search?cid={2FF6FF7E-4BA5-49C3-924D-2355A1EF671B}&mid=7b8518251b1547d0a58ad16b0b9be047-defeac4d0fd1c2e51cd12c28b046300bbf2baa08〈=en&ds=AVG&pr=fr&d=&v=&sap=dsp&q={searchTerms}

SearchScopes: HKCU - {F58C2885-23F0-4BC7-9EA9-A386D367F4A6} URL = http://www.mysearchresults.com/search?&c=2643&t=03&q={searchTerms}

BHO: HQPro-1.9 - {11111111-1111-1111-1111-110511311172} - C:\Program Files (x86)\HQPro-1.9\HQPro-1.9-bho64.dll No File

BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

BHO: Skype add-on for Internet Explorer - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)

BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

BHO-x32: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)

Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)

Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.254

FireFox:

========

FF Plugin: @microsoft.com/GENUINE - disabled No File

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()

FF Plugin-x32: @microsoft.com/GENUINE - disabled No File

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)

FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)

FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

FF Plugin-x32: @staging.google.com/globalUpdate Update;version=10 - C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\npGoogleUpdate4.dll (globalUpdate)

FF Plugin-x32: @staging.google.com/globalUpdate Update;version=4 - C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\npGoogleUpdate4.dll (globalUpdate)

FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

FF Extension: Swiki - C:\Program Files (x86)\Mozilla Firefox\extensions\swiki@swiki.com.xpi [2012-10-28]

FF HKCU\...\Firefox\Extensions: [{735C497D-D20D-45CB-51DE-4E6626FEAD4D}] - C:\Program Files (x86)\-ViewPassword-soft\174.xpi

FF Extension: Swiki - C:\Program Files (x86)\-ViewPassword-soft\174.xpi [2014-06-19]

Chrome:

=======

CHR HomePage: hxxp://www.msn.com/?pc=UP97&ocid=UP97DHP&dt=072013

CHR StartupUrls: "hxxp://www.msn.com/?pc=UP97&ocid=UP97DHP&dt=072013", "hxxp://www.google.com/", "hxxp://us.yhs4.search.yahoo.com/web/partner?&hspart=w3i&hsimp=yhs-syctransfer&type=W3i_SP, 203, 0_0, StartPage, 20121044, 17093, 0, 11, 0"

CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\22.0.1229.95\PepperFlash\pepflashplayer.dll No File

CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer

CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\ppGoogleNaClPluginChrome.dll ()

CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\pdf.dll ()

CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll No File

CHR Plugin: (NVIDIA 3D Vision) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)

CHR Plugin: (NVIDIA 3D VISION) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)

CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll No File

CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Tina\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-05-23]

CHR Extension: (YouTube) - C:\Users\Tina\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-10-27]

CHR Extension: (Google Search) - C:\Users\Tina\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-10-27]

CHR Extension: (Skype Click to Call) - C:\Users\Tina\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2014-02-13]

CHR Extension: (Google Wallet) - C:\Users\Tina\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-24]

CHR Extension: (Gmail) - C:\Users\Tina\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-10-27]

CHR HKLM-x32\...\Chrome\Extension: [gikoeigmfnoggdlhnobkbbbkohiahbko] - C:\Program Files (x86)\Swiki\chrome.crx [2012-10-28]

CHR HKLM-x32\...\Chrome\Extension: [kdidombaedgpfiiedeimiebkmbilgmlc] - C:\Program Files (x86)\DefaultTab\DefaultTab.crx [2012-10-28]

CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2014-04-11]

==================== Services (Whitelisted) =================

R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [144152 2013-10-10] (SUPERAntiSpyware.com)

R2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe [3644432 2014-05-13] (AVG Technologies CZ, s.r.o.)

R2 avgwd; C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe [292424 2014-05-13] (AVG Technologies CZ, s.r.o.)

S3 BRSptSvc; C:\ProgramData\BitRaider\BRSptSvc.exe [477960 2014-01-17] (BitRaider, LLC)

R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390720 2014-04-11] (Microsoft Corporation)

R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1764992 2014-04-11] (Microsoft Corporation)

S2 globalUpdate; C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe [68608 2014-06-19] (globalUpdate) [File not signed]

S3 globalUpdatem; C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe [68608 2014-06-19] (globalUpdate) [File not signed]

R3 ICCS; C:\Program Files (x86)\Intel\Intel® Integrated Clock Controller Service\ICCProxy.exe [160256 2012-02-01] (Intel Corporation) [File not signed]

R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2014-03-11] (Microsoft Corporation)

R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [347872 2014-03-11] (Microsoft Corporation)

R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [14997280 2013-08-27] (NVIDIA Corporation)

S2 ViewPassword; C:\Program Files (x86)\-ViewPassword-soft\ViewPasswordHh174.exe [179712 2014-06-19] () [File not signed]

R2 XTU3SERVICE; C:\Program Files (x86)\Intel\Extreme Tuning Utility\XtuService.exe [14848 2012-02-24] (Intel Corporation)

==================== Drivers (Whitelisted) ====================

R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [152344 2014-05-13] (AVG Technologies CZ, s.r.o.)

R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [236312 2014-05-13] (AVG Technologies CZ, s.r.o.)

R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [191768 2014-05-13] (AVG Technologies CZ, s.r.o.)

R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [235800 2014-05-13] (AVG Technologies CZ, s.r.o.)

R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [323352 2014-05-13] (AVG Technologies CZ, s.r.o.)

R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [130328 2014-05-13] (AVG Technologies CZ, s.r.o.)

R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [31512 2014-05-13] (AVG Technologies CZ, s.r.o.)

R1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [273176 2014-05-13] (AVG Technologies CZ, s.r.o.)

S3 BRDriver64; C:\programdata\bitraider\BRDriver64.sys [75048 2014-01-27] (BitRaider)

R3 CorsairCAHS1; C:\Windows\System32\drivers\CAHS164.sys [1308160 2011-06-16] (C-Media Electronics Inc)

R2 iocbios2; C:\Program Files (x86)\Intel\Extreme Tuning Utility\Drivers\IocDriver\64bit\iocbios2.sys [22776 2011-12-22] (Intel Corporation)

R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [268512 2014-01-25] (Microsoft Corporation)

R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [133928 2014-03-11] (Microsoft Corporation)

R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-08-20] (NVIDIA Corporation)

S3 rt2870; C:\Windows\System32\DRIVERS\rt2870.sys [1212768 2010-07-29] (Ralink Technology, Corp.)

R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)

R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com)

S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2014-06-20 18:03 - 2014-06-20 18:04 - 00000000 ____D () C:\Users\Tina\Downloads\malware removal

2014-06-20 18:02 - 2014-06-20 18:04 - 00000000 ____D () C:\FRST

2014-06-19 21:47 - 2014-06-19 21:47 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Tina\Downloads\revosetup.exe

2014-06-19 21:47 - 2014-06-19 21:47 - 00001264 _____ () C:\Users\Tina\Desktop\Revo Uninstaller.lnk

2014-06-19 21:47 - 2014-06-19 21:47 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group

2014-06-19 20:47 - 2014-06-20 12:47 - 00000508 _____ () C:\Windows\Tasks\SUPERAntiSpyware Scheduled Task 851f81d1-f685-4fd3-bb64-3e3d650f2658.job

2014-06-19 20:47 - 2014-06-20 02:00 - 00000508 _____ () C:\Windows\Tasks\SUPERAntiSpyware Scheduled Task 90976bf7-efd1-40c7-b2a3-932747e04ea8.job

2014-06-19 20:47 - 2014-06-19 20:47 - 00003582 _____ () C:\Windows\System32\Tasks\SUPERAntiSpyware Scheduled Task 90976bf7-efd1-40c7-b2a3-932747e04ea8

2014-06-19 20:47 - 2014-06-19 20:47 - 00003508 _____ () C:\Windows\System32\Tasks\SUPERAntiSpyware Scheduled Task 851f81d1-f685-4fd3-bb64-3e3d650f2658

2014-06-19 20:47 - 2014-06-19 20:47 - 00000000 ____D () C:\Users\Tina\AppData\Roaming\SUPERAntiSpyware.com

2014-06-19 20:46 - 2014-06-19 20:47 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware

2014-06-19 20:46 - 2014-06-19 20:47 - 00000000 ____D () C:\Program Files\SUPERAntiSpyware

2014-06-19 20:46 - 2014-06-19 20:46 - 00001808 _____ () C:\Users\Public\Desktop\SUPERAntiSpyware Professional.lnk

2014-06-19 20:46 - 2014-06-19 20:46 - 00000000 ____D () C:\ProgramData\SUPERAntiSpyware.com

2014-06-19 20:44 - 2014-06-19 20:46 - 19746696 _____ (SUPERAntiSpyware) C:\Users\Tina\Downloads\SUPERAntiSpyware.exe

2014-06-19 18:20 - 2014-06-19 18:20 - 00000000 __SHD () C:\Users\Tina\AppData\Local\EmieUserList

2014-06-19 18:20 - 2014-06-19 18:20 - 00000000 __SHD () C:\Users\Tina\AppData\Local\EmieSiteList

2014-06-19 12:21 - 2014-06-20 12:26 - 00000906 _____ () C:\Windows\Tasks\globalUpdateUpdateTaskMachineUA.job

2014-06-19 12:21 - 2014-06-20 12:26 - 00000902 _____ () C:\Windows\Tasks\globalUpdateUpdateTaskMachineCore.job

2014-06-19 12:21 - 2014-06-19 13:27 - 00000000 ____D () C:\Users\Tina\AppData\Roaming\VOPackage

2014-06-19 12:21 - 2014-06-19 12:21 - 01376768 _____ () C:\Users\Tina\Desktop\7z920-x64.msi

2014-06-19 12:21 - 2014-06-19 12:21 - 00003904 _____ () C:\Windows\System32\Tasks\globalUpdateUpdateTaskMachineUA

2014-06-19 12:21 - 2014-06-19 12:21 - 00003650 _____ () C:\Windows\System32\Tasks\globalUpdateUpdateTaskMachineCore

2014-06-19 12:21 - 2014-06-19 12:21 - 00000000 ____D () C:\Users\Tina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VOPackage

2014-06-19 12:21 - 2014-06-19 12:21 - 00000000 ____D () C:\Users\Tina\AppData\Local\globalUpdate

2014-06-19 12:21 - 2014-06-19 12:21 - 00000000 ____D () C:\Program Files (x86)\globalUpdate

2014-06-19 12:20 - 2014-06-19 13:27 - 00000000 ____D () C:\Program Files (x86)\-ViewPassword-soft

2014-06-19 12:19 - 2014-06-19 12:19 - 00513256 _____ (firseria s.l.) C:\Users\Tina\Downloads\Setup.exe

2014-06-18 20:01 - 2014-06-18 20:01 - 00047709 _____ () C:\Users\Tina\Downloads\dump2014-6-18 20_1_26.dmp

2014-06-18 09:59 - 2014-06-18 11:37 - 2474812150 _____ () C:\Users\Tina\Downloads\BackGoldInstallSetup_0.0.1.008.rar

2014-06-18 09:54 - 2014-06-18 09:54 - 03295872 _____ (<Snail Game>) C:\Users\Tina\Downloads\BlackGoldDownLoader_usa (2).exe

2014-06-18 09:17 - 2014-06-18 09:17 - 00139264 _____ (sun.the9.com) C:\Users\Tina\Downloads\9yin_MD5Check.exe

2014-06-17 17:48 - 2014-06-17 17:48 - 03295872 _____ (<Snail Game>) C:\Users\Tina\Downloads\BlackGoldDownLoader_usa.exe

2014-06-17 15:37 - 2014-06-17 15:38 - 00010386 _____ () C:\Users\Tina\Documents\Uninstall STAR WARS The Old Republic.log

2014-06-10 13:08 - 2014-06-08 04:13 - 00506368 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll

2014-06-10 13:08 - 2014-06-08 04:08 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

2014-06-10 13:08 - 2014-05-30 05:21 - 23414784 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-06-10 13:08 - 2014-05-30 05:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-06-10 13:08 - 2014-05-30 05:02 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll

2014-06-10 13:08 - 2014-05-30 04:45 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2014-06-10 13:08 - 2014-05-30 04:39 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2014-06-10 13:08 - 2014-05-30 04:39 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2014-06-10 13:08 - 2014-05-30 04:38 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll

2014-06-10 13:08 - 2014-05-30 04:28 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2014-06-10 13:08 - 2014-05-30 04:27 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2014-06-10 13:08 - 2014-05-30 04:24 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2014-06-10 13:08 - 2014-05-30 04:21 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2014-06-10 13:08 - 2014-05-30 04:21 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe

2014-06-10 13:08 - 2014-05-30 04:20 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2014-06-10 13:08 - 2014-05-30 04:18 - 17271296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-06-10 13:08 - 2014-05-30 04:11 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe

2014-06-10 13:08 - 2014-05-30 04:08 - 05782528 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2014-06-10 13:08 - 2014-05-30 04:06 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll

2014-06-10 13:08 - 2014-05-30 04:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-06-10 13:08 - 2014-05-30 03:55 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll

2014-06-10 13:08 - 2014-05-30 03:49 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2014-06-10 13:08 - 2014-05-30 03:46 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2014-06-10 13:08 - 2014-05-30 03:44 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2014-06-10 13:08 - 2014-05-30 03:44 - 00295424 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2014-06-10 13:08 - 2014-05-30 03:43 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2014-06-10 13:08 - 2014-05-30 03:42 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll

2014-06-10 13:08 - 2014-05-30 03:38 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2014-06-10 13:08 - 2014-05-30 03:35 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2014-06-10 13:08 - 2014-05-30 03:34 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2014-06-10 13:08 - 2014-05-30 03:33 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2014-06-10 13:08 - 2014-05-30 03:30 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2014-06-10 13:08 - 2014-05-30 03:29 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2014-06-10 13:08 - 2014-05-30 03:28 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2014-06-10 13:08 - 2014-05-30 03:27 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll

2014-06-10 13:08 - 2014-05-30 03:24 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll

2014-06-10 13:08 - 2014-05-30 03:23 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2014-06-10 13:08 - 2014-05-30 03:16 - 00368128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll

2014-06-10 13:08 - 2014-05-30 03:10 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll

2014-06-10 13:08 - 2014-05-30 03:06 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll

2014-06-10 13:08 - 2014-05-30 03:04 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2014-06-10 13:08 - 2014-05-30 03:02 - 00242688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll

2014-06-10 13:08 - 2014-05-30 02:56 - 04244992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2014-06-10 13:08 - 2014-05-30 02:56 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2014-06-10 13:08 - 2014-05-30 02:54 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2014-06-10 13:08 - 2014-05-30 02:50 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll

2014-06-10 13:08 - 2014-05-30 02:49 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2014-06-10 13:08 - 2014-05-30 02:43 - 13522944 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2014-06-10 13:08 - 2014-05-30 02:40 - 11725312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2014-06-10 13:08 - 2014-05-30 02:30 - 01398272 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2014-06-10 13:08 - 2014-05-30 02:21 - 01790976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2014-06-10 13:08 - 2014-05-30 02:15 - 01143296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2014-06-10 13:08 - 2014-05-30 02:13 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2014-06-10 13:08 - 2014-05-30 02:13 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2014-06-10 13:08 - 2014-04-24 21:34 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll

2014-06-10 13:08 - 2014-04-24 21:06 - 00626688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\usp10.dll

2014-06-10 13:08 - 2014-04-04 21:47 - 01903552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys

2014-06-10 13:08 - 2014-04-04 21:47 - 00288192 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS

2014-06-10 13:08 - 2014-03-26 09:44 - 02002432 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll

2014-06-10 13:08 - 2014-03-26 09:44 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll

2014-06-10 13:08 - 2014-03-26 09:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll

2014-06-10 13:08 - 2014-03-26 09:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll

2014-06-10 13:08 - 2014-03-26 09:27 - 01389056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll

2014-06-10 13:08 - 2014-03-26 09:27 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll

2014-06-10 13:08 - 2014-03-26 09:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6r.dll

2014-06-10 13:08 - 2014-03-26 09:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll

==================== One Month Modified Files and Folders =======

2014-06-20 18:04 - 2014-06-20 18:03 - 00000000 ____D () C:\Users\Tina\Downloads\malware removal

2014-06-20 18:04 - 2014-06-20 18:02 - 00000000 ____D () C:\FRST

2014-06-20 17:48 - 2012-10-27 16:12 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-06-20 17:26 - 2012-11-02 12:03 - 00000000 ____D () C:\ProgramData\MFAData

2014-06-20 17:16 - 2012-10-27 16:12 - 00000894 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-06-20 16:48 - 2012-10-18 06:02 - 01785632 _____ () C:\Windows\WindowsUpdate.log

2014-06-20 16:22 - 2012-10-24 17:43 - 00000000 ____D () C:\Users\Tina\AppData\Roaming\TS3Client

2014-06-20 12:47 - 2014-06-19 20:47 - 00000508 _____ () C:\Windows\Tasks\SUPERAntiSpyware Scheduled Task 851f81d1-f685-4fd3-bb64-3e3d650f2658.job

2014-06-20 12:26 - 2014-06-19 12:21 - 00000906 _____ () C:\Windows\Tasks\globalUpdateUpdateTaskMachineUA.job

2014-06-20 12:26 - 2014-06-19 12:21 - 00000902 _____ () C:\Windows\Tasks\globalUpdateUpdateTaskMachineCore.job

2014-06-20 12:21 - 2013-10-25 13:48 - 00000000 ____D () C:\Users\Tina\AppData\Local\Battle.net

2014-06-20 12:20 - 2013-10-25 13:49 - 00000000 ____D () C:\Program Files (x86)\Hearthstone

2014-06-20 12:20 - 2013-09-06 15:59 - 00000000 ____D () C:\Program Files (x86)\Diablo III

2014-06-20 12:19 - 2013-10-25 13:48 - 00000000 ____D () C:\Program Files (x86)\Battle.net

2014-06-20 12:18 - 2012-10-18 06:02 - 00000000 ____D () C:\Users\Tina

2014-06-20 09:16 - 2012-10-27 16:12 - 00000890 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-06-20 02:00 - 2014-06-19 20:47 - 00000508 _____ () C:\Windows\Tasks\SUPERAntiSpyware Scheduled Task 90976bf7-efd1-40c7-b2a3-932747e04ea8.job

2014-06-19 21:59 - 2013-04-19 09:45 - 00000000 ____D () C:\Users\Tina\AppData\Local\PMB Files

2014-06-19 21:53 - 2012-10-28 22:31 - 00000000 ____D () C:\Users\Tina\AppData\Roaming\Skype

2014-06-19 21:47 - 2014-06-19 21:47 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Tina\Downloads\revosetup.exe

2014-06-19 21:47 - 2014-06-19 21:47 - 00001264 _____ () C:\Users\Tina\Desktop\Revo Uninstaller.lnk

2014-06-19 21:47 - 2014-06-19 21:47 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group

2014-06-19 21:44 - 2013-09-05 16:58 - 00000000 ____D () C:\Program Files (x86)\Steam

2014-06-19 21:36 - 2009-07-13 23:45 - 00022064 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-06-19 21:36 - 2009-07-13 23:45 - 00022064 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-06-19 21:28 - 2009-07-13 23:51 - 00059781 _____ () C:\Windows\setupact.log

2014-06-19 21:27 - 2012-10-17 17:07 - 00000000 ____D () C:\ProgramData\NVIDIA

2014-06-19 21:27 - 2009-07-14 00:08 - 00032584 _____ () C:\Windows\Tasks\SCHEDLGU.TXT

2014-06-19 21:27 - 2009-07-14 00:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-06-19 20:47 - 2014-06-19 20:47 - 00003582 _____ () C:\Windows\System32\Tasks\SUPERAntiSpyware Scheduled Task 90976bf7-efd1-40c7-b2a3-932747e04ea8

2014-06-19 20:47 - 2014-06-19 20:47 - 00003508 _____ () C:\Windows\System32\Tasks\SUPERAntiSpyware Scheduled Task 851f81d1-f685-4fd3-bb64-3e3d650f2658

2014-06-19 20:47 - 2014-06-19 20:47 - 00000000 ____D () C:\Users\Tina\AppData\Roaming\SUPERAntiSpyware.com

2014-06-19 20:47 - 2014-06-19 20:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware

2014-06-19 20:47 - 2014-06-19 20:46 - 00000000 ____D () C:\Program Files\SUPERAntiSpyware

2014-06-19 20:46 - 2014-06-19 20:46 - 00001808 _____ () C:\Users\Public\Desktop\SUPERAntiSpyware Professional.lnk

2014-06-19 20:46 - 2014-06-19 20:46 - 00000000 ____D () C:\ProgramData\SUPERAntiSpyware.com

2014-06-19 20:46 - 2014-06-19 20:44 - 19746696 _____ (SUPERAntiSpyware) C:\Users\Tina\Downloads\SUPERAntiSpyware.exe

2014-06-19 18:20 - 2014-06-19 18:20 - 00000000 __SHD () C:\Users\Tina\AppData\Local\EmieUserList

2014-06-19 18:20 - 2014-06-19 18:20 - 00000000 __SHD () C:\Users\Tina\AppData\Local\EmieSiteList

2014-06-19 13:29 - 2010-11-20 22:47 - 00308390 _____ () C:\Windows\PFRO.log

2014-06-19 13:27 - 2014-06-19 12:21 - 00000000 ____D () C:\Users\Tina\AppData\Roaming\VOPackage

2014-06-19 13:27 - 2014-06-19 12:20 - 00000000 ____D () C:\Program Files (x86)\-ViewPassword-soft

2014-06-19 12:21 - 2014-06-19 12:21 - 01376768 _____ () C:\Users\Tina\Desktop\7z920-x64.msi

2014-06-19 12:21 - 2014-06-19 12:21 - 00003904 _____ () C:\Windows\System32\Tasks\globalUpdateUpdateTaskMachineUA

2014-06-19 12:21 - 2014-06-19 12:21 - 00003650 _____ () C:\Windows\System32\Tasks\globalUpdateUpdateTaskMachineCore

2014-06-19 12:21 - 2014-06-19 12:21 - 00000000 ____D () C:\Users\Tina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VOPackage

2014-06-19 12:21 - 2014-06-19 12:21 - 00000000 ____D () C:\Users\Tina\AppData\Local\globalUpdate

2014-06-19 12:21 - 2014-06-19 12:21 - 00000000 ____D () C:\Program Files (x86)\globalUpdate

2014-06-19 12:19 - 2014-06-19 12:19 - 00513256 _____ (firseria s.l.) C:\Users\Tina\Downloads\Setup.exe

2014-06-18 21:40 - 2013-10-07 17:46 - 00000000 ____D () C:\Users\Tina\AppData\Local\CrashDumps

2014-06-18 20:01 - 2014-06-18 20:01 - 00047709 _____ () C:\Users\Tina\Downloads\dump2014-6-18 20_1_26.dmp

2014-06-18 11:37 - 2014-06-18 09:59 - 2474812150 _____ () C:\Users\Tina\Downloads\BackGoldInstallSetup_0.0.1.008.rar

2014-06-18 09:54 - 2014-06-18 09:54 - 03295872 _____ (<Snail Game>) C:\Users\Tina\Downloads\BlackGoldDownLoader_usa (2).exe

2014-06-18 09:43 - 2014-03-31 09:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG

2014-06-18 09:43 - 2013-09-27 11:56 - 00000965 _____ () C:\Users\Public\Desktop\AVG 2014.lnk

2014-06-18 09:17 - 2014-06-18 09:17 - 00139264 _____ (sun.the9.com) C:\Users\Tina\Downloads\9yin_MD5Check.exe

2014-06-17 17:48 - 2014-06-17 17:48 - 03295872 _____ (<Snail Game>) C:\Users\Tina\Downloads\BlackGoldDownLoader_usa.exe

2014-06-17 15:42 - 2013-04-10 00:08 - 00000000 ____D () C:\Program Files (x86)\Snail Games USA

2014-06-17 15:38 - 2014-06-17 15:37 - 00010386 _____ () C:\Users\Tina\Documents\Uninstall STAR WARS The Old Republic.log

2014-06-17 15:38 - 2009-07-14 00:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games

2014-06-17 15:37 - 2013-06-06 10:03 - 00000000 ____D () C:\ProgramData\BitRaider

2014-06-17 09:11 - 2012-10-27 16:12 - 00003890 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA

2014-06-17 09:11 - 2012-10-27 16:12 - 00003638 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore

2014-06-14 11:15 - 2014-01-16 18:35 - 00000000 ____D () C:\Users\Tina\AppData\Roaming\Advanced Combat Tracker

2014-06-11 18:13 - 2012-10-27 16:13 - 00002183 _____ () C:\Users\Public\Desktop\Google Chrome.lnk

2014-06-11 03:59 - 2009-07-13 22:20 - 00000000 ____D () C:\Windows\rescache

2014-06-11 03:26 - 2013-02-18 20:42 - 00000000 ___RD () C:\Program Files (x86)\Skype

2014-06-11 03:26 - 2012-10-28 22:30 - 00000000 ____D () C:\ProgramData\Skype

2014-06-11 03:03 - 2013-08-15 03:02 - 00000000 ____D () C:\Windows\system32\MRT

2014-06-11 03:02 - 2012-05-10 13:16 - 95414520 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2014-06-11 03:00 - 2014-05-06 03:00 - 00000000 ___SD () C:\Windows\system32\CompatTel

2014-06-08 04:13 - 2014-06-10 13:08 - 00506368 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll

2014-06-08 04:08 - 2014-06-10 13:08 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

2014-06-08 00:06 - 2012-10-19 09:39 - 00000000 ____D () C:\Program Files (x86)\RIFT Game

2014-06-06 19:58 - 2013-01-27 09:54 - 00000000 ____D () C:\Users\Tina\AppData\Roaming\Mumble

2014-05-30 05:21 - 2014-06-10 13:08 - 23414784 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-05-30 05:02 - 2014-06-10 13:08 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-05-30 05:02 - 2014-06-10 13:08 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll

2014-05-30 04:45 - 2014-06-10 13:08 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2014-05-30 04:39 - 2014-06-10 13:08 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2014-05-30 04:39 - 2014-06-10 13:08 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2014-05-30 04:38 - 2014-06-10 13:08 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll

2014-05-30 04:28 - 2014-06-10 13:08 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2014-05-30 04:27 - 2014-06-10 13:08 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2014-05-30 04:24 - 2014-06-10 13:08 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2014-05-30 04:21 - 2014-06-10 13:08 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2014-05-30 04:21 - 2014-06-10 13:08 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe

2014-05-30 04:20 - 2014-06-10 13:08 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2014-05-30 04:18 - 2014-06-10 13:08 - 17271296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-05-30 04:11 - 2014-06-10 13:08 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe

2014-05-30 04:08 - 2014-06-10 13:08 - 05782528 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2014-05-30 04:06 - 2014-06-10 13:08 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll

2014-05-30 04:02 - 2014-06-10 13:08 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-05-30 03:55 - 2014-06-10 13:08 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll

2014-05-30 03:49 - 2014-06-10 13:08 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2014-05-30 03:46 - 2014-06-10 13:08 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2014-05-30 03:44 - 2014-06-10 13:08 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2014-05-30 03:44 - 2014-06-10 13:08 - 00295424 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2014-05-30 03:43 - 2014-06-10 13:08 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2014-05-30 03:42 - 2014-06-10 13:08 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll

2014-05-30 03:38 - 2014-06-10 13:08 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2014-05-30 03:35 - 2014-06-10 13:08 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2014-05-30 03:34 - 2014-06-10 13:08 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2014-05-30 03:33 - 2014-06-10 13:08 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2014-05-30 03:30 - 2014-06-10 13:08 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2014-05-30 03:29 - 2014-06-10 13:08 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2014-05-30 03:28 - 2014-06-10 13:08 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2014-05-30 03:27 - 2014-06-10 13:08 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll

2014-05-30 03:24 - 2014-06-10 13:08 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll

2014-05-30 03:23 - 2014-06-10 13:08 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2014-05-30 03:16 - 2014-06-10 13:08 - 00368128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll

2014-05-30 03:10 - 2014-06-10 13:08 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll

2014-05-30 03:06 - 2014-06-10 13:08 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll

2014-05-30 03:04 - 2014-06-10 13:08 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2014-05-30 03:02 - 2014-06-10 13:08 - 00242688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll

2014-05-30 02:56 - 2014-06-10 13:08 - 04244992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2014-05-30 02:56 - 2014-06-10 13:08 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2014-05-30 02:54 - 2014-06-10 13:08 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2014-05-30 02:50 - 2014-06-10 13:08 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll

2014-05-30 02:49 - 2014-06-10 13:08 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2014-05-30 02:43 - 2014-06-10 13:08 - 13522944 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2014-05-30 02:40 - 2014-06-10 13:08 - 11725312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2014-05-30 02:30 - 2014-06-10 13:08 - 01398272 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2014-05-30 02:21 - 2014-06-10 13:08 - 01790976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2014-05-30 02:15 - 2014-06-10 13:08 - 01143296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2014-05-30 02:13 - 2014-06-10 13:08 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2014-05-30 02:13 - 2014-06-10 13:08 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

Some content of TEMP:

====================

C:\Users\Tina\AppData\Local\Temp\avguidx.dll

C:\Users\Tina\AppData\Local\Temp\Gw2.exe

C:\Users\Tina\AppData\Local\Temp\ICReinstall_PMB_updater.exe

C:\Users\Tina\AppData\Local\Temp\MachineIdCreator.exe

C:\Users\Tina\AppData\Local\Temp\nvSCPAPI.dll

C:\Users\Tina\AppData\Local\Temp\nvSCPAPI64.dll

C:\Users\Tina\AppData\Local\Temp\nvStInst.exe

C:\Users\Tina\AppData\Local\Temp\oi_{64F9BFCE-2CD7-4638-BF3F-D9EFBD22235D}.exe

C:\Users\Tina\AppData\Local\Temp\riftuninstall.exe

C:\Users\Tina\AppData\Local\Temp\SkypeSetup.exe

C:\Users\Tina\AppData\Local\Temp\swt-win32-3740.dll

C:\Users\Tina\AppData\Local\Temp\tmp7938.exe

C:\Users\Tina\AppData\Local\Temp\tmp83A6.exe

C:\Users\Tina\AppData\Local\Temp\tmp9A8E.exe

C:\Users\Tina\AppData\Local\Temp\tmpC5A6.exe

C:\Users\Tina\AppData\Local\Temp\YontooSetup-S.exe

C:\Users\Tina\AppData\Local\Temp\_isBE7C.exe

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\SysWOW64\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2014-06-18 00:58

==================== End Of Log ============================

shug70 · June 20, 2014

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 21-06-2014

Ran by Tina at 2014-06-20 18:05:28

Running from C:\Users\Tina\Downloads\malware removal\farbar recovery

Boot Mode: Normal

==========================================================

==================== Security Center ========================

AV: AVG AntiVirus Free Edition 2014 (Enabled - Up to date) {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}

AV: Microsoft Security Essentials (Enabled - Up to date) {641105E6-77ED-3F35-A304-765193BCB75F}

AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: AVG AntiVirus Free Edition 2014 (Enabled - Up to date) {B5F5C120-2089-702E-0001-553BB0D5A664}

AS: Microsoft Security Essentials (Enabled - Up to date) {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}

==================== Installed Programs ======================

Acronis True Image Home 2012 (HKLM-x32\...\{BE0CD30D-69A6-4B3A-857D-218C2C32E912}Visible) (Version: 15.0.7119 - Acronis)

Acronis True Image Home 2012 (x32 Version: 15.0.7119 - Acronis) Hidden

ACTv3 Clipboard Sharer (remove only) (HKLM-x32\...\ACTv3 Clipboard Sharer) (Version: - )

Adobe Flash Player 13 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 13.0.0.214 - Adobe Systems Incorporated)

Advanced Combat Tracker (remove only) (HKLM-x32\...\Advanced Combat Tracker) (Version: - )

Age of Wushu (HKLM-x32\...\{A0AFB64E-79E1-45BF-BA6C-18C21E007D8E}) (Version: 0.0.1.034 - Snail Games USA)

Aion (HKLM-x32\...\NCW-AION) (Version: 1.0.0.2 - NC Interactive, LLC)

Apple Application Support (HKLM-x32\...\{A922C4B7-50E0-4787-A94C-59DBF3C65DBE}) (Version: 3.0 - Apple Inc.)

Apple Mobile Device Support (HKLM\...\{FE86CB0C-FCB3-4358-B4B0-B0A41E33B3DD}) (Version: 7.1.0.32 - Apple Inc.)

Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)

ArcheAge (HKLM-x32\...\Glyph ArcheAge) (Version: - Trion Worlds, Inc.)

Audacity 2.0.2 (HKLM-x32\...\Audacity_is1) (Version: 2.0.2 - Audacity Team)

AVG 2014 (HKLM\...\AVG) (Version: 2014.0.4592 - AVG Technologies)

AVG 2014 (Version: 14.0.3972 - AVG Technologies) Hidden

AVG 2014 (Version: 14.0.4592 - AVG Technologies) Hidden

Battle.net (HKLM-x32\...\Battle.net) (Version: - Blizzard Entertainment)

BitRaider Web Client (HKLM-x32\...\BitRaider Web Client) (Version: 1.1.6.3 - BitRaider, LLC)

Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)

Curse Client (HKCU\...\101a9f93b8f0bb6f) (Version: 5.1.1.792 - Curse)

Diablo III (HKLM-x32\...\Diablo III) (Version: - Blizzard Entertainment)

EQ2MAP Updater 1.2.10 (HKLM-x32\...\EQ2MAP Updater) (Version: 1.2.10 - Johan Nilsson)

EverQuest II (HKCU\...\SOE-EverQuest II) (Version: - Sony Online Entertainment)

EverQuest Next Landmark (HKCU\...\SOE-EverQuest Next Landmark) (Version: 1.0.3.183 - Sony Online Entertainment)

FINAL FANTASY XIV - A Realm Reborn (HKLM-x32\...\{2B41E132-07DF-4925-A3D3-F2D1765CCDFE}) (Version: 1.0.0000 - SQUARE ENIX CO., LTD.)

Firefall (HKLM-x32\...\{CFEF8DB5-B45E-4b05-90BE-D02AA6F45354}) (Version: - Red 5 Studios)

FMOD Studio (HKLM-x32\...\FMOD Studio) (Version: - )

GeForce Experience NvStream Client Components (Version: 0.1.87 - NVIDIA Corporation) Hidden

GIMP 2.8.6 (HKLM\...\GIMP-2_is1) (Version: 2.8.6 - The GIMP Team)

Glyph (HKLM-x32\...\Glyph) (Version: - Trion Worlds, Inc.)

Google Chrome (HKLM-x32\...\Google Chrome) (Version: 35.0.1916.153 - Google Inc.)

Google Toolbar for Internet Explorer (HKLM-x32\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.5111.1712 - Google Inc.)

Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden

Google Update Helper (x32 Version: 1.3.25.0 - Google Inc.) Hidden

Guild Wars 2 (HKLM-x32\...\Guild Wars 2) (Version: - NCsoft Corporation, Ltd.)

Hearthstone (HKLM-x32\...\Hearthstone) (Version: - Blizzard Entertainment)

iCloud (HKLM\...\{81E20D41-C277-4526-934D-F2380AF91B78}) (Version: 3.1.0.40 - Apple Inc.)

Installer (HKLM-x32\...\VOPackage) (Version: 1.0.0.0 - ) <==== ATTENTION

Intel Extreme Tuning Utility (HKLM-x32\...\{7C1CA9A1-4A23-4CC5-AC7E-D81D9E0C9493}) (Version: 3.1.105.0 - Intel Corporation)

Intel® USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 1.0.1.209 - Intel Corporation)

Intel® Watchdog Timer Driver (Intel® WDT) (HKLM-x32\...\{3FD0C489-0F02-481a-A3E1-9754CD396761}) (Version: - Intel Corporation)

Intel® Watchdog Timer Driver (Intel® WDT) (HKLM-x32\...\3FD0C489-0F02-481a-A3E1-9754CD396761) (Version: - Intel Corporation)

iTunes (HKLM\...\{0D924CB2-2EA4-4044-BAF7-770202D6BD0D}) (Version: 11.1.4.62 - Apple Inc.)

Kingdoms of Amalur: Reckoning Demo (HKLM-x32\...\Steam App 203970) (Version: - Big Huge Games)

Legends of Norrath (HKCU\...\SOE-LegendsOfNorrath) (Version: - Sony Online Entertainment)

Magic 2014 (HKLM-x32\...\Steam App 213850) (Version: - Stainless Games)

Malwarebytes Anti-Malware version 1.75.0.1300 (HKLM-x32\...\Malwarebytes' Anti-Malware_is1) (Version: 1.75.0.1300 - Malwarebytes Corporation)

Microsoft .NET Framework 1.1 (HKLM-x32\...\Microsoft .NET Framework 1.1 (1033)) (Version: - )

Microsoft .NET Framework 1.1 (x32 Version: 1.1.4322 - Microsoft) Hidden

Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden

Microsoft Security Client (Version: 4.5.0216.0 - Microsoft Corporation) Hidden

Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.5.216.0 - Microsoft Corporation)

Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Mumble 1.2.5 (HKLM-x32\...\{C7BC557D-8C8B-4F5F-83AB-D20C58CF4575}) (Version: 1.2.5 - Thorvald Natvig)

NCSOFT Game Launcher (HKLM-x32\...\NCLauncher_NCWest) (Version: - NCSOFT)

NCsoft Launcher (HKLM-x32\...\{5F8E2CBB-949D-4175-AC98-5ADE7F6C9697}) (Version: 1.5.19002 - NCsoft)

Neverwinter (HKLM-x32\...\Neverwinter) (Version: - Cryptic Studios)

NVIDIA 3D Vision Controller Driver 331.58 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 331.58 - NVIDIA Corporation)

NVIDIA 3D Vision Driver 331.58 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 331.58 - NVIDIA Corporation)

NVIDIA Control Panel 331.58 (Version: 331.58 - NVIDIA Corporation) Hidden

NVIDIA GeForce Experience 1.6.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 1.6.1 - NVIDIA Corporation)

NVIDIA Graphics Driver 331.58 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 331.58 - NVIDIA Corporation)

NVIDIA HD Audio Driver 1.3.26.4 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.26.4 - NVIDIA Corporation)

NVIDIA Install Application (Version: 2.1002.133.902 - NVIDIA Corporation) Hidden

NVIDIA PhysX (x32 Version: 9.13.0725 - NVIDIA Corporation) Hidden

NVIDIA PhysX System Software 9.13.0725 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.0725 - NVIDIA Corporation)

NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.13.3158 - NVIDIA Corporation) Hidden

NVIDIA Update 8.3.14 (Version: 8.3.14 - NVIDIA Corporation) Hidden

NVIDIA Update Components (Version: 8.3.14 - NVIDIA Corporation) Hidden

NVIDIA Virtual Audio 1.2.5 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_VirtualAudio.Driver) (Version: 1.2.5 - NVIDIA Corporation)

OpenOffice.org 3.4.1 (HKLM-x32\...\{9F1F2AEA-C72A-4DD6-991E-C5506A5625E4}) (Version: 3.41.9593 - Apache Software Foundation)

Pando Media Booster (HKLM-x32\...\{980A182F-E0A2-4A40-94C1-AE0C1235902E}) (Version: 2.6.0.8 - Pando Networks Inc.)

QuickTime (HKLM-x32\...\{B67BAFBA-4C9F-48FA-9496-933E3B255044}) (Version: 7.74.80.86 - Apple Inc.)

Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6710 - Realtek Semiconductor Corp.)

Renesas Electronics USB 3.0 Host Controller Driver (HKLM-x32\...\InstallShield_{5442DAB8-7177-49E1-8B22-09A049EA5996}) (Version: 2.1.28.1 - Renesas Electronics Corporation)

Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 2.1.28.1 - Renesas Electronics Corporation) Hidden

Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)

RIFT (Beta) (HKCU\...\RIFT-Beta) (Version: - Trion Worlds, Inc.)

RIFT (HKLM-x32\...\InstallShield_{D7A0A22A-C132-4B6F-8D68-67B95117DE93}) (Version: 1.0.0 - Trion Worlds, Inc.)

RIFT (x32 Version: 1.0.0 - Trion Worlds, Inc.) Hidden

SHIELD Streaming (Version: 1.05.28 - NVIDIA Corporation) Hidden

Skype Click to Call (HKLM-x32\...\{BB285C9F-C821-4770-8970-56C4AB52C87E}) (Version: 7.2.15747.10003 - Microsoft Corporation)

Skype™ 6.16 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.16.105 - Skype Technologies S.A.)

Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)

SUPERAntiSpyware (HKLM\...\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}) (Version: 5.7.1026 - SUPERAntiSpyware.com)

Swiki version 1.0 (HKLM-x32\...\Swiki_is1) (Version: 1.0 - Swiki)

TeamSpeak 3 Client (HKLM-x32\...\TeamSpeak 3 Client) (Version: 3.0.11 - TeamSpeak Systems GmbH)

TERA (HKLM-x32\...\{0FCDA0F8-F3E5-402E-B9B6-13CB2B01182B}) (Version: 1.41 - En Masse Entertainment)

The Elder Scrolls Online (HKLM-x32\...\The Elder Scrolls Online) (Version: 1.0.0.0 - Zenimax Online Studios)

The Elder Scrolls Online Beta (HKLM-x32\...\The Elder Scrolls Online Beta_is1) (Version: 0.3.4 - )

The Lord of the Rings Online™ v03.03.05.8039 (HKLM-x32\...\12bbe590-c890-11d9-9669-0800200c9a66_is1) (Version: 03.03.05.8039 - Turbine, Inc.)

Ventrilo Client (HKLM-x32\...\{789289CA-F73A-4A16-A331-54D498CE069F}) (Version: 3.0.8 - Flagship Industries, Inc.)

ViewPassword (HKLM-x32\...\49DBFAF9-23C4-A643-5CE3-5ACA5F8CA8B0) (Version: - ViewPassword-software) <==== ATTENTION

Visual Studio 2010 x64 Redistributables (HKLM\...\{21B133D6-5979-47F0-BE1C-F6A6B304693F}) (Version: 13.0.0.1 - AVG Technologies)

Visual Studio 2012 x64 Redistributables (HKLM\...\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)

Visual Studio 2012 x86 Redistributables (HKLM-x32\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)

WildStar (HKLM-x32\...\WildStar) (Version: - NCSOFT)

Xiph.Org Open Codecs 0.85.17777 (HKLM-x32\...\Open Codecs) (Version: 0.85.17777 - Xiph.Org)

Yontoo 1.10.02 (HKLM\...\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}) (Version: 1.10.02 - Yontoo LLC) <==== ATTENTION

You Need A Budget 4 (YNAB) (HKLM-x32\...\Steam App 227320) (Version: - YouNeedABudget.com)

==================== Restore Points =========================

18-06-2014 05:00:01 Scheduled Checkpoint

18-06-2014 21:01:32 Windows Update

==================== Hosts content: ==========================

2009-07-13 21:34 - 2009-06-10 16:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {19115C79-9C3E-4517-8F83-D5B4C93B1E94} - System32\Tasks\SUPERAntiSpyware Scheduled Task 851f81d1-f685-4fd3-bb64-3e3d650f2658 => C:\Program Files\SUPERAntiSpyware\SASTask.exe [2013-11-07] (SUPERAdBlocker.com)

Task: {4057C060-299E-495F-8132-1DE9C49B7127} - System32\Tasks\Swiki_Checker => C:\Windows\SChecker\SC_w3i.exe [2012-10-18] ( )

Task: {6BF0166F-5E56-4C10-9C93-3B6BAC82E2B2} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)

Task: {7C903B0C-380F-41FC-BEC1-A1CA2B722B32} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-05-14] (Adobe Systems Incorporated)

Task: {8F08634B-AA83-44C3-A4BA-6FF16ECF025D} - System32\Tasks\SUPERAntiSpyware Scheduled Task 90976bf7-efd1-40c7-b2a3-932747e04ea8 => C:\Program Files\SUPERAntiSpyware\SASTask.exe [2013-11-07] (SUPERAdBlocker.com)

Task: {9B6DFD67-788C-4831-A95B-C75D6E65B9CF} - System32\Tasks\globalUpdateUpdateTaskMachineCore => C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe [2014-06-19] (globalUpdate) <==== ATTENTION

Task: {9D1F2370-12A9-4E3C-8E44-75FEFA23C739} - System32\Tasks\globalUpdateUpdateTaskMachineUA => C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe [2014-06-19] (globalUpdate) <==== ATTENTION

Task: {D4D47DD1-DAEF-44D6-B521-E2BC89F56938} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-10-27] (Google Inc.)

Task: {F4C9161B-D945-4FD7-93E8-FCDBA378FD8E} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-10-27] (Google Inc.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\Windows\Tasks\globalUpdateUpdateTaskMachineCore.job => C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe <==== ATTENTION

Task: C:\Windows\Tasks\globalUpdateUpdateTaskMachineUA.job => C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe <==== ATTENTION

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\SUPERAntiSpyware Scheduled Task 851f81d1-f685-4fd3-bb64-3e3d650f2658.job => C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

Task: C:\Windows\Tasks\SUPERAntiSpyware Scheduled Task 90976bf7-efd1-40c7-b2a3-932747e04ea8.job => C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

==================== Loaded Modules (whitelisted) =============

2012-10-17 17:06 - 2013-10-15 16:47 - 00102176 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll

2014-01-20 14:17 - 2014-01-20 14:17 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll

2014-01-20 14:16 - 2014-01-20 14:16 - 01044808 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll

2012-04-27 20:33 - 2012-04-27 20:33 - 00435552 _____ () C:\Program Files (x86)\Acronis\TrueImageHome\Common\ulxmlrpcpp.dll

2012-10-23 03:24 - 2013-08-01 20:46 - 00230376 _____ () C:\Program Files (x86)\TeamSpeak 3 Client\soundbackends\directsound_win32.dll

2012-10-23 03:24 - 2013-08-01 20:46 - 00237032 _____ () C:\Program Files (x86)\TeamSpeak 3 Client\soundbackends\windowsaudiosession_win32.dll

2012-10-23 03:24 - 2013-08-01 20:46 - 00159208 _____ () C:\Program Files (x86)\TeamSpeak 3 Client\plugins\appscanner_plugin.dll

2012-10-23 03:24 - 2013-08-01 20:46 - 00431080 _____ () C:\Program Files (x86)\TeamSpeak 3 Client\plugins\clientquery_plugin.dll

2014-06-11 18:13 - 2014-06-05 08:58 - 00716616 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\libglesv2.dll

2014-06-11 18:13 - 2014-06-05 08:58 - 00126280 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\libegl.dll

2014-06-11 18:13 - 2014-06-05 08:58 - 04217672 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\pdf.dll

2014-06-11 18:13 - 2014-06-05 08:58 - 00414536 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\ppGoogleNaClPluginChrome.dll

2014-06-11 18:13 - 2014-06-05 08:58 - 01732424 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\ffmpegsumo.dll

2012-04-27 21:09 - 2012-04-27 21:09 - 00018784 _____ () C:\Program Files (x86)\Acronis\TrueImageHome\ti_managers_proxy_stub.dll

==================== Alternate Data Streams (whitelisted) =========

==================== Safe Mode (whitelisted) ===================

==================== EXE Association (whitelisted) =============

==================== MSCONFIG/TASK MANAGER disabled items =========

==================== Faulty Device Manager Devices =============

==================== Event log errors: =========================

Application errors:

==================

Error: (06/20/2014 05:53:12 AM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )

Description: 80004005

Error: (06/19/2014 09:29:05 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application name: ViewPasswordHh174.exe, version: 1.174.0.0, time stamp: 0x53a17e28

Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000

Exception code: 0xc0000005

Fault offset: 0x00000000

Faulting process id: 0xee4

Faulting application start time: 0xViewPasswordHh174.exe0

Faulting application path: ViewPasswordHh174.exe1

Faulting module path: ViewPasswordHh174.exe2

Report Id: ViewPasswordHh174.exe3

Error: (06/19/2014 09:28:48 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (06/19/2014 01:31:25 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (06/18/2014 09:40:29 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application name: EverQuest2.exe, version: 1.0.0.1, time stamp: 0x539f79b4

Faulting module name: EverQuest2.exe, version: 1.0.0.1, time stamp: 0x539f79b4

Exception code: 0xc0000005

Fault offset: 0x0075ed95

Faulting process id: 0x1620

Faulting application start time: 0xEverQuest2.exe0

Faulting application path: EverQuest2.exe1

Faulting module path: EverQuest2.exe2

Report Id: EverQuest2.exe3

Error: (06/17/2014 08:14:21 PM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )

Description: 80004005

Error: (06/17/2014 03:52:24 PM) (Source: Steam Client Service) (EventID: 1) (User: )

Description: Error: Failed to poke open firewall

Error: (06/17/2014 03:50:51 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (06/14/2014 00:48:56 AM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application name: EverQuest2.exe, version: 1.0.0.1, time stamp: 0x539108dd

Faulting module name: EverQuest2.exe, version: 1.0.0.1, time stamp: 0x539108dd

Exception code: 0xc0000005

Fault offset: 0x009b12a7

Faulting process id: 0xab8

Faulting application start time: 0xEverQuest2.exe0

Faulting application path: EverQuest2.exe1

Faulting module path: EverQuest2.exe2

Report Id: EverQuest2.exe3

Error: (06/13/2014 09:32:15 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application name: EverQuest2.exe, version: 1.0.0.1, time stamp: 0x539108dd

Faulting module name: EverQuest2.exe, version: 1.0.0.1, time stamp: 0x539108dd

Exception code: 0xc0000005

Fault offset: 0x0098a348

Faulting process id: 0x37c

Faulting application start time: 0xEverQuest2.exe0

Faulting application path: EverQuest2.exe1

Faulting module path: EverQuest2.exe2

Report Id: EverQuest2.exe3

System errors:

=============

Error: (06/19/2014 09:29:43 PM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: The ViewPassword service terminated unexpectedly. It has done this 1 time(s).

Error: (06/19/2014 01:27:55 PM) (Source: DCOM) (EventID: 10010) (User: )

Description: {F9717507-6651-4EDB-BFF7-AE615179BCCF}

Error: (06/17/2014 07:11:58 PM) (Source: volsnap) (EventID: 36) (User: )

Description: The shadow copies of volume C: were aborted because the shadow copy storage could not grow due to a user imposed limit.

Error: (06/07/2014 06:27:45 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)

Description: Installation Failure: Windows failed to install the following update with error 0x80070643: Definition Update for Microsoft Security Essentials - KB2310138 (Definition 1.175.1586.0).

Error: (06/07/2014 06:27:39 AM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )

Description: %NT AUTHORITY60 has encountered an error trying to update signatures.

New Signature Version:

Previous Signature Version: 1.175.1503.0

Update Source: %NT AUTHORITY59

Update Stage: 4.5.0216.00

Source Path: 4.5.0216.01

Signature Type: %NT AUTHORITY602

Update Type: %NT AUTHORITY604

User: NT AUTHORITY\SYSTEM

Current Engine Version: %NT AUTHORITY605

Previous Engine Version: %NT AUTHORITY606

Error code: %NT AUTHORITY607

Error description: %NT AUTHORITY608

Error: (05/29/2014 06:15:37 AM) (Source: DCOM) (EventID: 10010) (User: )

Description: {CC957078-B838-47C4-A7CF-626E7A82FC58}

Error: (05/29/2014 06:12:42 AM) (Source: EventLog) (EventID: 6008) (User: )

Description: The previous system shutdown at 6:10:47 AM on ‎5/‎29/‎2014 was unexpected.

Error: (05/12/2014 04:42:46 PM) (Source: EventLog) (EventID: 6008) (User: )

Description: The previous system shutdown at 1:29:06 PM on ‎5/‎12/‎2014 was unexpected.

Error: (05/04/2014 00:05:46 PM) (Source: WMPNetworkSvc) (EventID: 14332) (User: )

Description: WMPNetworkSvc0x80004005

Error: (05/04/2014 00:02:21 PM) (Source: EventLog) (EventID: 6008) (User: )

Description: The previous system shutdown at 12:00:21 PM on ‎5/‎4/‎2014 was unexpected.

Microsoft Office Sessions:

=========================

Error: (06/20/2014 05:53:12 AM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )

Description: 80004005

Error: (06/19/2014 09:29:05 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: ViewPasswordHh174.exe1.174.0.053a17e28unknown0.0.0.000000000c000000500000000ee401cf8c2f5079a35fC:\Program Files (x86)\-ViewPassword-soft\ViewPasswordHh174.exeunknowna5fd919b-f822-11e3-86e1-00224d7f09b4

Error: (06/19/2014 09:28:48 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (06/19/2014 01:31:25 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (06/18/2014 09:40:29 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: EverQuest2.exe1.0.0.1539f79b4EverQuest2.exe1.0.0.1539f79b4c00000050075ed95162001cf8b580d83cbc5C:\Users\Public\Sony Online Entertainment\Installed Games\EverQuest II\EverQuest2.exeC:\Users\Public\Sony Online Entertainment\Installed Games\EverQuest II\EverQuest2.exe131dd8a1-f75b-11e3-b241-00224d7f09b4

Error: (06/17/2014 08:14:21 PM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )

Description: 80004005

Error: (06/17/2014 03:52:24 PM) (Source: Steam Client Service) (EventID: 1) (User: )

Description: Failed to poke open firewall

Error: (06/17/2014 03:50:51 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (06/14/2014 00:48:56 AM) (Source: Application Error) (EventID: 1000) (User: )

Description: EverQuest2.exe1.0.0.1539108ddEverQuest2.exe1.0.0.1539108ddc0000005009b12a7ab801cf8778fd959450C:\Users\Public\Sony Online Entertainment\Installed Games\EverQuest II\EverQuest2.exeC:\Users\Public\Sony Online Entertainment\Installed Games\EverQuest II\EverQuest2.exe92be6b48-f387-11e3-86f2-00224d7f09b4

Error: (06/13/2014 09:32:15 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: EverQuest2.exe1.0.0.1539108ddEverQuest2.exe1.0.0.1539108ddc00000050098a34837c01cf87784df98c1dC:\Users\Public\Sony Online Entertainment\Installed Games\EverQuest II\EverQuest2.exeC:\Users\Public\Sony Online Entertainment\Installed Games\EverQuest II\EverQuest2.exe187c9ca2-f36c-11e3-86f2-00224d7f09b4

==================== Memory info ===========================

Percentage of memory in use: 58%

Total physical RAM: 4065.42 MB

Available physical RAM: 1668.68 MB

Total Pagefile: 8129.02 MB

Available Pagefile: 5605.97 MB

Total Virtual: 8192 MB

Available Virtual: 8191.85 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:931.51 GB) (Free:485.15 GB) NTFS ==>[Drive with boot components (obtained from BCD)]

==================== MBR & Partition Table ==================

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: 304D8D09)

Partition 1: (Active) - (Size=932 GB) - (Type=07 NTFS)

==================== End Of Log ============================

kevinf80 · June 20, 2014

Download attached fixlist.txt file and save it to the Desktop, or the folder you saved FRST into.

NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work.

Run FRST and press the Fix button just once and wait.

The tool will make a log on the Desktop (Fixlog.txt) or the folder it was ran from. Please post it

to your reply.

Next,

Download AdwCleaner by Xplode onto your Desktop.

Double click on Adwcleaner.exe to run the tool.
Click on Scan
Once the scan is done, click on the Clean button.
You will get a prompt asking to close all programs. Click OK.
Click OK again to reboot your computer.
A text file will open after the restart. Please post the content of that logfile in your reply.
You can also find the logfile at C:\AdwCleaner[sn].txt. Where n in the scan reference number

Next,

Please download Junkware Removal Tool to your desktop.

Shut down your protection software now to avoid potential conflicts.
Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
The tool will open and start scanning your system.
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next message.

Next,

Run Malwarebytes, Open: Settings Tab > Scanner Settings > Under action for PUP > Select: Show in Results List and Check for removal.

Please Update and run a Quick scan

Make sure that everything is checked, and click Remove Selected on any found items.

Post the produced log,,,

Let me see those logs, also give an update on any remaining issues or concerns...

Kevin

fixlist.txt

shug70 · June 21, 2014

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 21-06-2014

Ran by Tina at 2014-06-20 18:38:15 Run:1

Running from C:\Users\Tina\Downloads\malware removal\farbar recovery

Boot Mode: Normal

==============================================

Content of fixlist:

*****************

Start

ProxyServer: http=127.0.0.1:13987;https=127.0.0.1:13987

SearchScopes: HKCU - {F58C2885-23F0-4BC7-9EA9-A386D367F4A6} URL = http://www.mysearchr...q={searchTerms}

BHO: HQPro-1.9 - {11111111-1111-1111-1111-110511311172} - C:\Program Files (x86)\HQPro-1.9\HQPro-1.9-bho64.dll No File

C:\Users\Tina\AppData\Local\Temp\avguidx.dll

C:\Users\Tina\AppData\Local\Temp\Gw2.exe

C:\Users\Tina\AppData\Local\Temp\ICReinstall_PMB_updater.exe

C:\Users\Tina\AppData\Local\Temp\MachineIdCreator.exe

C:\Users\Tina\AppData\Local\Temp\nvSCPAPI.dll

C:\Users\Tina\AppData\Local\Temp\nvSCPAPI64.dll

C:\Users\Tina\AppData\Local\Temp\nvStInst.exe

C:\Users\Tina\AppData\Local\Temp\oi_{64F9BFCE-2CD7-4638-BF3F-D9EFBD22235D}.exe

C:\Users\Tina\AppData\Local\Temp\riftuninstall.exe

C:\Users\Tina\AppData\Local\Temp\SkypeSetup.exe

C:\Users\Tina\AppData\Local\Temp\swt-win32-3740.dll

C:\Users\Tina\AppData\Local\Temp\tmp7938.exe

C:\Users\Tina\AppData\Local\Temp\tmp83A6.exe

C:\Users\Tina\AppData\Local\Temp\tmp9A8E.exe

C:\Users\Tina\AppData\Local\Temp\tmpC5A6.exe

C:\Users\Tina\AppData\Local\Temp\YontooSetup-S.exe

C:\Users\Tina\AppData\Local\Temp\_isBE7C.exe

Yontoo 1.10.02 (HKLM\...\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}) (Version: 1.10.02 - Yontoo LLC) <==== ATTENTION

Task: C:\Windows\Tasks\globalUpdateUpdateTaskMachineCore.job => C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe <==== ATTENTION

Task: C:\Windows\Tasks\globalUpdateUpdateTaskMachineUA.job => C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe <==== ATTENTION

End

*****************

HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer => value deleted successfully.

'HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{F58C2885-23F0-4BC7-9EA9-A386D367F4A6}' => Key deleted successfully.

'HKCR\CLSID\{F58C2885-23F0-4BC7-9EA9-A386D367F4A6}'=> Key not found.

'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11111111-1111-1111-1111-110511311172}' => Key deleted successfully.

'HKCR\CLSID\{11111111-1111-1111-1111-110511311172}' => Key deleted successfully.

C:\Users\Tina\AppData\Local\Temp\avguidx.dll => Moved successfully.

C:\Users\Tina\AppData\Local\Temp\Gw2.exe => Moved successfully.

C:\Users\Tina\AppData\Local\Temp\ICReinstall_PMB_updater.exe => Moved successfully.

C:\Users\Tina\AppData\Local\Temp\MachineIdCreator.exe => Moved successfully.

C:\Users\Tina\AppData\Local\Temp\nvSCPAPI.dll => Moved successfully.

C:\Users\Tina\AppData\Local\Temp\nvSCPAPI64.dll => Moved successfully.

C:\Users\Tina\AppData\Local\Temp\nvStInst.exe => Moved successfully.

C:\Users\Tina\AppData\Local\Temp\oi_{64F9BFCE-2CD7-4638-BF3F-D9EFBD22235D}.exe => Moved successfully.

C:\Users\Tina\AppData\Local\Temp\riftuninstall.exe => Moved successfully.

C:\Users\Tina\AppData\Local\Temp\SkypeSetup.exe => Moved successfully.

C:\Users\Tina\AppData\Local\Temp\swt-win32-3740.dll => Moved successfully.

C:\Users\Tina\AppData\Local\Temp\tmp7938.exe => Moved successfully.

C:\Users\Tina\AppData\Local\Temp\tmp83A6.exe => Moved successfully.

C:\Users\Tina\AppData\Local\Temp\tmp9A8E.exe => Moved successfully.

C:\Users\Tina\AppData\Local\Temp\tmpC5A6.exe => Moved successfully.

C:\Users\Tina\AppData\Local\Temp\YontooSetup-S.exe => Moved successfully.

C:\Users\Tina\AppData\Local\Temp\_isBE7C.exe => Moved successfully.

C:\Windows\Tasks\globalUpdateUpdateTaskMachineCore.job => Moved successfully.

C:\Windows\Tasks\globalUpdateUpdateTaskMachineUA.job => Moved successfully.

==== End of Fixlog ====

# AdwCleaner v3.212 - Report created 20/06/2014 at 18:40:19

# Updated 05/06/2014 by Xplode

# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)

# Username : Tina - TINA-PC

# Running from : C:\Users\Tina\Downloads\malware removal\adwcleaner\AdwCleaner.exe

# Option : Clean

***** [ Services ] *****

[#] Service Deleted : globalUpdate

[#] Service Deleted : globalUpdatem

[#] Service Deleted : ViewPassword

***** [ Files / Folders ] *****

Folder Deleted : C:\ProgramData\Tarma Installer

Folder Deleted : C:\Program Files (x86)\globalUpdate

Folder Deleted : C:\Users\Tina\AppData\Local\globalUpdate

Folder Deleted : C:\Users\Tina\AppData\Roaming\DefaultTab

Folder Deleted : C:\Users\Tina\AppData\Roaming\VOPackage

Folder Deleted : C:\Users\Tina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VOPackage

File Deleted : C:\Users\Tina\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.superfish.com_0.localstorage

File Deleted : C:\Users\Tina\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.superfish.com_0.localstorage-journal

File Deleted : C:\Windows\System32\Tasks\globalUpdateUpdateTaskMachineCore

File Deleted : C:\Windows\System32\Tasks\globalUpdateUpdateTaskMachineUA

***** [ Shortcuts ] *****

***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\kdidombaedgpfiiedeimiebkmbilgmlc

Key Deleted : HKLM\SOFTWARE\Classes\AppID\PropertySync.EXE

Key Deleted : HKLM\SOFTWARE\Classes\AppID\YontooIEClient.DLL

Key Deleted : HKLM\SOFTWARE\Classes\protector_dll.protectorbho

Key Deleted : HKLM\SOFTWARE\Classes\protector_dll.protectorbho.1

Key Deleted : HKLM\SOFTWARE\Classes\YontooIEClient.Api

Key Deleted : HKLM\SOFTWARE\Classes\YontooIEClient.Api.1

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\avg-secure-search-installer_RASAPI32

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\avg-secure-search-installer_RASMANCS

Key Deleted : HKLM\SOFTWARE\MozillaPlugins\@staging.google.com/globalUpdate Update;version=10

Key Deleted : HKLM\SOFTWARE\MozillaPlugins\@staging.google.com/globalUpdate Update;version=4

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{18B9B16E-716F-43DF-A6AD-512C7D2EB983}

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{CFDAFE39-20CE-451D-BD45-A37452F39CF0}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{99066096-8989-4612-841F-621A01D54AD7}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{FE9271F2-6EFD-44B0-A826-84C829536E93}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{6DDA37BA-0553-499A-AE0D-BEBA67204548}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220522312272}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{43969E3F-3E7C-4911-A8F1-79C6CA6AC731}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C815E3DA-0823-49B0-9270-D1771D58B317}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{EE95078D-518C-4FD2-8093-FD1D4E33D3CA}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660566316672}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}

Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{6DDA37BA-0553-499A-AE0D-BEBA67204548}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220522312272}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{045F91B3-695F-423A-98C7-8DE3C47AA020}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{1348BD1B-C32A-41A7-9BD4-5377AA1AB925}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{1F8EDE97-36D5-422A-B8F0-9406E2D87C60}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{395AFE6E-8308-48DB-89BE-ED5F4AA3D3EC}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{43969E3F-3E7C-4911-A8F1-79C6CA6AC731}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{43B390F0-6BA2-45CA-ABF2-5DB0CEE9B49D}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{93CF54F5-CFAA-4440-B588-8ED0DFAD5C21}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{94CADA2E-1D3F-419F-8A3D-06C58EDF53C8}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{9E52EB8B-8DD9-4605-AD36-D352BCD482F2}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{A1440EC3-F0FA-407A-B811-DE6668C06D29}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{B9A84AD0-5777-46FD-8B8F-1EBD06750FBC}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{C1995F88-1C7F-40D7-B0FA-6F107F6308B8}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{C815E3DA-0823-49B0-9270-D1771D58B317}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{D3BC53E7-0437-4C97-90EE-2CD6FF47FB14}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{E4A994B0-5550-4680-A4C6-B9470B888069}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{EE95078D-518C-4FD2-8093-FD1D4E33D3CA}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{F9EB11AB-9384-4736-9B33-993940F88895}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660566316672}

Key Deleted : HKCU\Software\AVG SafeGuard toolbar

Key Deleted : HKCU\Software\DefaultTab

Key Deleted : HKCU\Software\installedbrowserextensions

Key Deleted : HKCU\Software\AppDataLow\Software\ViewPassword

Key Deleted : HKLM\Software\AVG Secure Search

Key Deleted : HKLM\Software\AVG Security Toolbar

Key Deleted : HKLM\Software\DefaultTab

Key Deleted : HKLM\Software\installedbrowserextensions

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VOPackage

Key Deleted : [x64] HKLM\SOFTWARE\installedbrowserextensions

Key Deleted : [x64] HKLM\SOFTWARE\Tarma Installer

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.17126

-\\ Google Chrome v35.0.1916.153

[ File : C:\Users\Tina\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Deleted [search Provider] : hxxp://isearch.avg.com/search?cid={2FF6FF7E-4BA5-49C3-924D-2355A1EF671B}&mid=7b8518251b1547d0a58ad16b0b9be047-defeac4d0fd1c2e51cd12c28b046300bbf2baa08〈=en&ds=AVG&pr=fr&d=&v=&sap=dsp&q={searchTerms}

Deleted [search Provider] : hxxp://search.aol.com/aol/search?query={searchTerms}

Deleted [search Provider] : hxxp://www.ask.com/web?q={searchTerms}

Deleted [Extension] : bcjagnifjocnddgeknajocbkkhlgibem

Deleted [Extension] : deghekbbihbapplmbffglehkdhkeibbm

Deleted [Extension] : niapdbllcanepiiimjjndipklodoedlc

*************************

AdwCleaner[R0].txt - [7163 octets] - [20/06/2014 18:39:41]

AdwCleaner[s0].txt - [7267 octets] - [20/06/2014 18:40:19]

########## EOF - C:\AdwCleaner\AdwCleaner[s0].txt - [7327 octets] ##########

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 6.1.4 (04.06.2014:1)

OS: Windows 7 Home Premium x64

Ran by Tina on Fri 06/20/2014 at 18:49:38.49

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Registry Values

~~~ Registry Keys

~~~ Files

~~~ Folders

Successfully deleted: [Folder] "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\swiki"

~~~ Event Viewer Logs were cleared

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on Fri 06/20/2014 at 18:54:43.92

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Malwarebytes Anti-Malware 1.75.0.1300

www.malwarebytes.org

Database version: v2014.06.20.14

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 11.0.9600.17126

Tina :: TINA-PC [administrator]

6/20/2014 7:00:28 PM

mbam-log-2014-06-20 (19-00-28).txt

Scan type: Quick scan

Scan options disabled: P2P

Objects scanned: 304748

Time elapsed: 8 minute(s), 13 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 1

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\49DBFAF9-23C4-A643-5CE3-5ACA5F8CA8B0 (PUP.Optional.ViewPassword.A) -> Quarantined and deleted successfully.

Registry Values Detected: 1

HKCU\SOFTWARE\Mozilla\Firefox\Extensions|{735C497D-D20D-45CB-51DE-4E6626FEAD4D} (PUP.Optional.ViewPassword.A) -> Data: C:\Program Files (x86)\-ViewPassword-soft\174.xpi -> Quarantined and deleted successfully.

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 1

C:\Program Files (x86)\-ViewPassword-soft (PUP.Optional.ViewPassword.A) -> Quarantined and deleted successfully.

Files Detected: 15

C:\Users\Tina\Downloads\Setup.exe (PUP.Optional.Solimba) -> Quarantined and deleted successfully.

C:\Users\Tina\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_static.betterdeals00.betterdeals.co_0.localstorage (PUP.Optional.BetterDeals.A) -> Quarantined and deleted successfully.

C:\Users\Tina\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_static.betterdeals00.betterdeals.co_0.localstorage-journal (PUP.Optional.BetterDeals.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\-ViewPassword-soft\174.dat (PUP.Optional.ViewPassword.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\-ViewPassword-soft\174.xpi (PUP.Optional.ViewPassword.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\-ViewPassword-soft\a.db (PUP.Optional.ViewPassword.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\-ViewPassword-soft\b.db (PUP.Optional.ViewPassword.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\-ViewPassword-soft\Sqlite3.dll (PUP.Optional.ViewPassword.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\-ViewPassword-soft\Uninstall.exe (PUP.Optional.ViewPassword.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\-ViewPassword-soft\ViewPasswordFIXQNw.exe (PUP.Optional.ViewPassword.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\-ViewPassword-soft\ViewPasswordHh174.bin (PUP.Optional.ViewPassword.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\-ViewPassword-soft\ViewPasswordHh174.dll (PUP.Optional.ViewPassword.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\-ViewPassword-soft\ViewPasswordHh174.exe (PUP.Optional.ViewPassword.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\-ViewPassword-soft\ViewPasswordHh174.ini (PUP.Optional.ViewPassword.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\-ViewPassword-soft\ViewPasswordt83.exe (PUP.Optional.ViewPassword.A) -> Quarantined and deleted successfully.

(end)

kevinf80 · June 21, 2014

What is the current status of your system, are there any remaining issues or concerns?

Next,

Please download SystemLook from the following link below and save it to your Desktop. Use the correct version 32bit or 64bit.

http://jpshortstuff.247fixes.com/SystemLook_x64.exe <<- 64 bit….

http://images.malwareremoval.com/jpshortstuff/SystemLook.exe <<- 32 bit

Double-click SystemLook.exe to run it.
Copy the content of the following codebox into the main textfield:

:regfindyontoo*yontoo*

Click the Look button to start the scan.
When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

Next,

We need to run an online AV scan to ensure there are no remnants of any infection left on your system that may have been missed. This scan is very thorough and well worth running, it can take several hours please be patient and let it complete:

Run Eset Online Scanner

**Note** You will need to use Internet explorer for this scan - Vista and Windows 7/8 right click on IE shortcut and run as admin

Go to Eset web page http://www.eset.com/us/online-scanner/ to run an online scan from ESET.

Turn off the real time scanner of any existing antivirus program while performing the online scan
click on the Run ESET Online Scanner button
Tick the box next to YES, I accept the Terms of Use.
Click Start
When asked, allow the add/on to be installed
Click Start
Make sure that the option "Remove found threats" is UNticked
Click on Advanced Settings, ensure the options
Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.
Click Scan
wait for the virus definitions to be downloaded
Wait for the scan to finish

When the scan is complete

If no threats were found
put a checkmark in "Uninstall application on close"
close program
report to me that nothing was found

If threats were found

click on "list of threats found"
click on "export to text file" and save it as ESET SCAN and save to the desktop
Click on back
put a checkmark in "Uninstall application on close"
click on finish

close program

Copy and paste the report in next reply.

Post those two logs and give an update on any remaining issues or concerns....

Kevin...

shug70 · June 21, 2014

The yontoo program is no longer in my add/remove programs list and internet browsing seems to be back to normal.

C:\AdwCleaner\Quarantine\C\Users\Tina\AppData\Roaming\VOPackage\Uninstall.exe.vir Win32/VOPackage.J potentially unwanted application

C:\FRST\Quarantine\C\Users\Tina\AppData\Local\Temp\ICReinstall_PMB_updater.exe.xBAD Win32/InstallCore.GI potentially unwanted application

C:\FRST\Quarantine\C\Users\Tina\AppData\Local\Temp\YontooSetup-S.exe.xBAD multiple threats

C:\Users\Tina\AppData\Local\Google\Chrome\User Data\Default\Cache\f_003918 JS/Toolbar.Crossrider.B potentially unwanted application

C:\Users\Tina\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3BD7D1HN\266[1].js JS/Toolbar.Crossrider.B potentially unwanted application

C:\Users\Tina\AppData\Local\PMB Files\Upgrade41270\PMB_updater.exe Win32/InstallCore.GI potentially unwanted application

C:\Users\Tina\AppData\Local\Temp\n1192\VOPackage.exe Win32/VOPackage.J potentially unwanted application

C:\Windows\Temp\dts75CB\deftabupdate.exe a variant of Win32/Toolbar.DefaultTab.B potentially unwanted application

SystemLook 30.07.11 by jpshortstuff

Log created at 11:58 on 21/06/2014 by Tina

Administrator - Elevation successful

========== regfind ==========

Searching for "yontoo"

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\YontooSetup-S-0770_RASAPI32]

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\YontooSetup-S-0770_RASMANCS]

Searching for "*yontoo*"

No data found.

-= EOF =-

kevinf80 · June 21, 2014

Download OTM from either of the following links and save to your Desktop: (If your security alerts to OTM, either accept the alert or turn off security to allow OTM to run)

http://oldtimer.geekstogo.com/OTM.exe.
http://www.itxassociates.com/OT-Tools/OTM.com
http://www.itxassociates.com/OT-Tools/OTM.exe

Double click OTM.exe to start the tool. Vista or Windows 7 users accepy UAC alert. Be aware all processes will be stopped during run, also Desktop will disappear, this will be put back on completion.... If your security alerts to OTM either, accept the alert or turn off security until OTM completes...

Copy the text from the code box belowbelow to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy). Ensure to start with and include the colon before Reg :Reg

:Reg[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\YontooSetup-S-0770_RASAPI32][-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\YontooSetup-S-0770_RASMANCS]:FilesC:\Users\Tina\AppData\Local\Google\Chrome\User Data\Default\Cache\f_003918C:\Users\Tina\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3BD7D1HN\266[1].jsC:\Users\Tina\AppData\Local\PMB Files\Upgrade41270\PMB_updater.exeC:\Users\Tina\AppData\Local\Temp\n1192\VOPackage.exeC:\Windows\Temp\dts75CB\deftabupdate.exe:Commands[EmptyTemp]

Return to OTMoveIt3, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.
Click the red button.
Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
Close OTM

Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

If the machine reboots, the Results log can be found here:

c:\_OTMoveIt\MovedFiles\mmddyyyy_hhmmss.log

Where mmddyyyy_hhmmss is the date of the tool run.

Let me see that log, also give an update on any remaining issues or concerns...

Kevin

shug70 · June 21, 2014

All processes killed

========== REGISTRY ==========

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\YontooSetup-S-0770_RASAPI32\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\YontooSetup-S-0770_RASMANCS\ deleted successfully.

========== FILES ==========

C:\Users\Tina\AppData\Local\Google\Chrome\User Data\Default\Cache\f_003918 moved successfully.

C:\Users\Tina\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3BD7D1HN\266[1].js moved successfully.

C:\Users\Tina\AppData\Local\PMB Files\Upgrade41270\PMB_updater.exe moved successfully.

C:\Users\Tina\AppData\Local\Temp\n1192\VOPackage.exe moved successfully.

C:\Windows\Temp\dts75CB\deftabupdate.exe moved successfully.

========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

User: hedev

->Temp folder emptied: 43164427 bytes

User: Public

User: Tina

->Temp folder emptied: 589557568 bytes

->Temporary Internet Files folder emptied: 481934504 bytes

->Google Chrome cache emptied: 376134139 bytes

->Flash cache emptied: 20691 bytes

User: UpdatusUser

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32 (64bit) .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 677194065 bytes

%systemroot%\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 42860 bytes

%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 112499 bytes

RecycleBin emptied: 314214236 bytes

Total Files Cleaned = 2,367.00 mb

OTM by OldTimer - Version 3.1.21.0 log created on 06212014_181954

Files moved on Reboot...

C:\Users\Tina\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

C:\Users\Tina\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat moved successfully.

File move failed. C:\Windows\temp\Low\SkypeClickToCall\Logs\AutoUpdateSvc.log scheduled to be moved on reboot.

Registry entries deleted on Reboot...

kevinf80 · June 22, 2014

I assume there are no remaining issues or concerns... We continue:

There are two active security programs on your system with AV components, that is counterproductive. One should be removed asap, your choice...

MSE removal tool - http://www.bleepingcomputer.com/download/microsoft-security-essentials-removal-tool/

AVG removal tool - http://www.avg.com/us-en/utilities

Next,

Download "Delfix by Xplode" and save it to your desktop.

"Delfix link mirror"

Double Click to start the program. If you are using Vista or higher, please right-click and choose run as administrator

Make Sure the following items are checked:

    Activate UAC
    Remove disinfection tools
    Create registry backup
    Purge System Restore
    Reset system settings

Now click on "Run" and wait patiently until the tool has completed.

The tool will create a log when it has completed. We don't need you to post this.

Part of the routine will be to create a registry back up with ERUNT, the back up will be created here:

C:\Windows\ERUNT

When all is known to be well with your system you can delete that back up folder if you consider it as not needed...

Next,

Read the following link to fully understand PC security and best practices, you may find it useful....

http://www.bleepingcomputer.com/forums/t/407147/answers-to-common-security-questions-best-practices/#entry2316629

Let me know if we can close out...

Kevin.

shug70 · June 22, 2014

Thank you again Kevin for your expertise and time! I believe I am running clean with no further issue Sir

kevinf80 · June 22, 2014

Excellent, thank you for the update. It was a pleasure to work with you.

Take care and surf safe,

Kevin.....

AdvancedSetup · July 1, 2014

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

yontoo 1.10.02 removal & and other possible malwares

Recommended Posts

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Recently Browsing 0 members

Important Information