Help me Remove Pup.optional.helpbar.a

Napoleose · July 24, 2014

I have recently had a problem with the Yahoo Community Smartbar by Linkury. I (stupidly) downloaded a mod for Napoleon total war from a website I should not have trusted and it appeared. I have managed to get rid of the smartbar itself by deleting all files, resetting browsers etc. There is one problem however. Malwarebytes keeps detecting one file within chrome preferences - "Pup.optional.helpbar.a" which I assume is the source of all my problems.

I have resorted to making this thread after using countless methods to rid myself of the troublesome file, including hitman pro, malwarebytes, Ccleaner, Junkware remover, Adware remover, and have even tried (and failed) to perform a system restore.

Help me please, this is worrying me very much. I want this file destroyed.

deeprybka · July 24, 2014

Hi & :welcome:

My name is Jürgen and I will be assisting you with your Malware related problems.

Before we move on, please read the following points carefully. :excl:

My native language isn't English. So please do not use slang or idioms. It could be hard for me to read. Thanks for your understanding.
Please read my instructions completely. If there is anything that you do not understand kindly ask before proceeding.
Perform everything in the correct order. Sometimes one step requires the previous one.
If you have any problems while you are follow my instructions, Stop there and tell me the exact nature of your problem.
Do not run any other scans without instruction or Add/ Remove Software unless I tell you to do so. This would change the output of our tools and could be confusing for me.
Post all Logfiles as a reply rather than as an attachment unless I specifically ask you. If you can not post all logfiles in one reply, feel free to use more posts.
If I don't hear from you within 3 days from this initial or any subsequent post, then this thread will be closed.
Stay with me. I will give you some advice about prevention after the cleanup process. Absence of symptoms does not always mean the computer is clean.

Step 1

Please run a FRST scan. This will help us diagnose your problem.

Please download Farbar Recovery Scan Tool and save it to your Desktop.

(If you are not sure which version (32-/64-bit) applies to your system, download and try to start both of them as just the right one will run.)

Start FRST with administator privileges.
Make sure the option Addition.txt is checked and press the Scan button.
When finished, FRST will produce two logs (FRST.txt and Addition.txt) in the same directory the tool was run from.
Please copy and paste these logs in your next reply.

Napoleose · July 26, 2014

Thank you for the quick reply - currently scanning

Napoleose · July 26, 2014

Ok, so here's the FRST.

-

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 26-07-2014

Ran by Asus (administrator) on ASUSCM6330 on 26-07-2014 11:22:52

Running from C:\Users\Asus\Downloads

Platform: Windows 8.1 (X64) OS Language: English (United States)

Internet Explorer Version 11

Boot Mode: Normal

The only official download link for FRST:

Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/

Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/

Download link from any site other than Bleeping Computer is unpermitted or outdated.

See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

(ArcSoft Inc.) C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

() C:\Program Files (x86)\ASUS\AXSP\1.00.19\atkexComSvc.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AAHM\1.00.20\aaHMSvc.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.13\AsSysCtrlService.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(Intel® Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe

(Microsoft Corporation) C:\Windows\System32\dasHost.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\Jhi_service.exe

(McAfee, Inc.) C:\Windows\System32\mfevtps.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

() C:\Windows\SysWOW64\PnkBstrA.exe

(ArcSoft, Inc.) C:\Program Files (x86)\ArcSoft\HP Webcam Software Suite\Magic-i Visual Effects 2\uCamMonitor.exe

(McAfee, Inc.) C:\Program Files\McAfee\MSC\McAPExe.exe

(McAfee, Inc.) C:\Program Files\Common Files\McAfee\AMCore\mcshield.exe

(McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

(MAGIX AG) C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe

(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe

(Microsoft Corporation.) C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\SeaPort.EXE

(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe

(McAfee, Inc.) C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe

(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe

(Microsoft Corporation) C:\Windows\System32\rundll32.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Easy Update\ALU.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AI Suite II\AsRoutineController.exe

(McAfee, Inc.) C:\Program Files\Common Files\McAfee\Platform\McUICnt.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AI Suite II\EPU\EPUHelp.exe

(IvoSoft) C:\Program Files\Classic Shell\ClassicStartMenu.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe

(Spotify Ltd) C:\Users\Asus\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe

(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet Pro 8600\Bin\ScanToPCActivationApp.exe

() C:\Program Files (x86)\HP Button Manager\BM.exe

(Microsoft Corporation) C:\Windows\System32\rundll32.exe

(ASUSTek Computer Inc.) C:\Program Files (x86)\InstallShield Installation Information\{E6931688-DA2B-4E16-8539-3D323D69C677}\AiChargerPlus.exe

(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe

(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet Pro 8600\Bin\HPNetworkCommunicatorCom.exe

(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe

(ArcSoft Inc.) C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe

(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

(ArcSoft Inc.) C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\APSDaemon.exe

(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet Pro 8600\Bin\HPNetworkCommunicator.exe

(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe

(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe

(Microsoft Corporation) C:\Program Files (x86)\Internet Explorer\ielowutil.exe

(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe

(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe

(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google) C:\Users\Asus\AppData\Local\Google\Google Talk Plugin\googletalkplugin.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Farbar) C:\Users\Asus\Downloads\FRST64 (1).exe

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6968904 2013-01-29] (Realtek Semiconductor)

HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1276488 2013-01-18] (Realtek Semiconductor)

HKLM\...\Run: [Nvtmru] => "C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe"

HKLM\...\Run: [shadowPlay] => C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\nvspcap64.dll,ShadowPlayOnSystemStart

HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2199840 2014-04-30] (NVIDIA Corporation)

HKLM-x32\...\Run: [ASUS AiChargerPlus Execute] => C:\Program Files (x86)\InstallShield Installation Information\{E6931688-DA2B-4E16-8539-3D323D69C677}\AiChargerPlus.exe [550272 2012-08-20] (ASUSTek Computer Inc.)

HKLM-x32\...\Run: [ASUSWebStorage] => C:\Program Files (x86)\ASUS\WebStorage Sync Agent\1.1.10.123\AsusWSPanel.exe [3423104 2012-08-31] (ASUS Cloud Corporation)

HKLM-x32\...\Run: [ASUSPRP] => C:\Program Files (x86)\ASUS\APRP\APRP.EXE [3187360 2013-02-01] (ASUSTek Computer Inc.)

HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [91432 2012-03-29] (CyberLink Corp.)

HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-12-21] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-02-12] (Apple Inc.)

HKLM-x32\...\Run: [bCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)

HKLM-x32\...\Run: [mcpltui_exe] => C:\Program Files\McAfee.com\Agent\mcagent.exe [537992 2014-04-25] (McAfee, Inc.)

HKLM-x32\...\Run: [ArcSoft Connection Service] => C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe [207424 2010-10-27] (ArcSoft Inc.)

HKLM-x32\...\Run: [sunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)

HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)

HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [49208 2011-10-28] (Hewlett-Packard)

HKLM-x32\...\Run: [] => [X]

HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-05-26] (Apple Inc.)

Winlogon\Notify\GoToAssist: C:\Program Files (x86)\Citrix\GoToAssist\896\G2AWinLogon_x64.dll (Citrix Online, a division of Citrix Systems, Inc.)

HKLM\...\Policies\Explorer: [NoControlPanel] 0

HKU\S-1-5-21-2219433388-3516391376-827625826-1001\...\Run: [spotify Web Helper] => C:\Users\Asus\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1178168 2014-07-19] (Spotify Ltd)

HKU\S-1-5-21-2219433388-3516391376-827625826-1001\...\Run: [Google Update] => C:\Users\Asus\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2013-11-23] (Google Inc.)

HKU\S-1-5-21-2219433388-3516391376-827625826-1001\...\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [59720 2013-11-20] (Apple Inc.)

HKU\S-1-5-21-2219433388-3516391376-827625826-1001\...\Run: [ApplePhotoStreams] => C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [59720 2013-11-20] (Apple Inc.)

HKU\S-1-5-21-2219433388-3516391376-827625826-1001\...\Run: [HP Officejet Pro 8600 (NET)] => C:\Program Files\HP\HP Officejet Pro 8600\Bin\ScanToPCActivationApp.exe [2573416 2012-10-17] (Hewlett-Packard Co.)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Button Manager.lnk

ShortcutTarget: HP Button Manager.lnk -> C:\Program Files (x86)\HP Button Manager\BM.exe ()

Startup: C:\Users\Asus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Monitor Ink Alerts - HP Officejet Pro 8600 (Network).lnk

ShortcutTarget: Monitor Ink Alerts - HP Officejet Pro 8600 (Network).lnk -> C:\Program Files\HP\HP Officejet Pro 8600\Bin\HPStatusBL.dll (Hewlett-Packard Co.)

ShellIconOverlayIdentifiers: SkyDrive1 -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => C:\Users\Asus\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll (Microsoft Corporation)

ShellIconOverlayIdentifiers: SkyDrive2 -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => C:\Users\Asus\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll (Microsoft Corporation)

ShellIconOverlayIdentifiers: SkyDrive3 -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => C:\Users\Asus\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll (Microsoft Corporation)

ShellIconOverlayIdentifiers: AsusWSShellExt_B -> {6D4133E5-0742-4ADC-8A8C-9303440F7190} => C:\Program Files (x86)\ASUS\WebStorage Sync Agent\1.1.10.123\ASUSWSShellExt64.dll (ASUS Cloud Corporation.)

ShellIconOverlayIdentifiers: AsusWSShellExt_O -> {64174815-8D98-4CE6-8646-4C039977D808} => C:\Program Files (x86)\ASUS\WebStorage Sync Agent\1.1.10.123\ASUSWSShellExt64.dll (ASUS Cloud Corporation.)

ShellIconOverlayIdentifiers: AsusWSShellExt_U -> {1C5AB7B1-0B38-4EC4-9093-7FD277E2AF4D} => C:\Program Files (x86)\ASUS\WebStorage Sync Agent\1.1.10.123\ASUSWSShellExt64.dll (ASUS Cloud Corporation.)

ShellIconOverlayIdentifiers: ShareOverlay -> {594D4122-1F87-41E2-96C7-825FB4796516} => C:\Program Files\Classic Shell\ClassicExplorer64.dll (IvoSoft)

ShellIconOverlayIdentifiers: StorageProviderError -> {0CA2640D-5B9C-4c59-A5FB-2DA61A7437CF} => C:\Windows\System32\shell32.dll (Microsoft Corporation)

ShellIconOverlayIdentifiers: StorageProviderSyncing -> {0A30F902-8398-4ee8-86F7-4CFB589F04D1} => C:\Windows\System32\shell32.dll (Microsoft Corporation)

ShellIconOverlayIdentifiers-x32: SkyDrive1 -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => C:\Users\Asus\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\SkyDriveShell.dll (Microsoft Corporation)

ShellIconOverlayIdentifiers-x32: SkyDrive2 -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => C:\Users\Asus\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\SkyDriveShell.dll (Microsoft Corporation)

ShellIconOverlayIdentifiers-x32: SkyDrive3 -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => C:\Users\Asus\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\SkyDriveShell.dll (Microsoft Corporation)

ShellIconOverlayIdentifiers-x32: ShareOverlay -> {594D4122-1F87-41E2-96C7-825FB4796516} => C:\Program Files\Classic Shell\ClassicExplorer32.dll (IvoSoft)

ShellIconOverlayIdentifiers-x32: StorageProviderError -> {0CA2640D-5B9C-4c59-A5FB-2DA61A7437CF} => C:\Windows\SysWOW64\shell32.dll (Microsoft Corporation)

ShellIconOverlayIdentifiers-x32: StorageProviderSyncing -> {0A30F902-8398-4ee8-86F7-4CFB589F04D1} => C:\Windows\SysWOW64\shell32.dll (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://asus13.msn.com

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/?pc=UP94&ocid=UP94DHP

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://uk.msn.com/?ocid=iehp

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-gb

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xE103614DF7FDCB01

SearchScopes: HKLM-x32 - DefaultScope value is missing.

SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =

BHO: ExplorerBHO Class -> {449D0D6E-2412-4E61-B68F-1CB625CD9E52} -> C:\Program Files\Classic Shell\ClassicExplorer64.dll (IvoSoft)

BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)

BHO: Java Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO: McAfee SiteAdvisor BHO -> {B164E929-A1B6-4A06-B104-2CD0E90A88FF} -> c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)

BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)

BHO: Bing Bar Helper -> {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -> C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\amd64\BingExt.dll (Microsoft Corporation.)

BHO: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

BHO: ClassicIEBHO Class -> {EA801577-E6AD-4BD5-8F71-4BE0154331A4} -> C:\Program Files\Classic Shell\ClassicIEDLL_64.dll (IvoSoft)

BHO-x32: ExplorerBHO Class -> {449D0D6E-2412-4E61-B68F-1CB625CD9E52} -> C:\Program Files\Classic Shell\ClassicExplorer32.dll (IvoSoft)

BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)

BHO-x32: Java Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: McAfee SiteAdvisor BHO -> {B164E929-A1B6-4A06-B104-2CD0E90A88FF} -> c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)

BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)

BHO-x32: Bing Bar Helper -> {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -> C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\BingExt.dll (Microsoft Corporation.)

BHO-x32: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

BHO-x32: ClassicIEBHO Class -> {EA801577-E6AD-4BD5-8F71-4BE0154331A4} -> C:\Program Files\Classic Shell\ClassicIEDLL_32.dll (IvoSoft)

Toolbar: HKLM - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)

Toolbar: HKLM - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer64.dll (IvoSoft)

Toolbar: HKLM - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\amd64\BingExt.dll (Microsoft Corporation.)

Toolbar: HKLM-x32 - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)

Toolbar: HKLM-x32 - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer32.dll (IvoSoft)

Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\BingExt.dll (Microsoft Corporation.)

Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)

Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)

Handler-x32: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)

Handler-x32: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)

Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files\McAfee\MSC\McSnIePl64.dll (McAfee, Inc.)

Filter-x32: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files (x86)\McAfee\MSC\McSnIePl.dll (McAfee, Inc.)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.254

FireFox:

========

FF Plugin: @java.com/DTPlugin,version=10.40.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=10.40.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin: @mcafee.com/MSC,version=10 - c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL ()

FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()

FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 - C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)

FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @mcafee.com/MSC,version=10 - c:\PROGRA~2\mcafee\msc\NPMCSN~1.DLL ()

FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3508.0205 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)

FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @TrendMicro.com/FFExtension - C:\Program Files\Trend Micro\Titanium\UIFramework\Toolbar\firefoxextension\components\npToolbarChrome.dll No File

FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin HKCU: @talk.google.com/GoogleTalkPlugin - C:\Users\Asus\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)

FF Plugin HKCU: @talk.google.com/O1DPlugin - C:\Users\Asus\AppData\Roaming\Mozilla\plugins\npo1d.dll (Google)

FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Asus\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Asus\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll ()

FF Plugin ProgramFiles/Appdata: C:\Users\Asus\AppData\Roaming\mozilla\plugins\npgoogletalk.dll (Google)

FF Plugin ProgramFiles/Appdata: C:\Users\Asus\AppData\Roaming\mozilla\plugins\npo1d.dll (Google)

FF HKLM-x32\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files (x86)\McAfee\SiteAdvisor

FF Extension: McAfee SiteAdvisor - C:\Program Files (x86)\McAfee\SiteAdvisor [2013-09-14]

Chrome:

=======

CHR HomePage: hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StMBGUhCtXlT7G1muS_BRDXuH_N6dnG4YA4YYZwVC8dZ1beD-mJflaiNDSel7fXyQcqlcTR1x8966iKDs24kRcN3dopBbjzHdb73TII9qPejTbXvoFs2_szMMnpw1XEmSwl5uzSNHkaJQZkmGPMa3KWYD-UrMRNz3y_HPuU3BuYLyOCHd-KyzWUPwE_KBADCPtdmrybw,,

CHR Extension: (Google Docs) - C:\Users\Asus\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-07-24]

CHR Extension: (Google Drive) - C:\Users\Asus\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-07-24]

CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Asus\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-07-24]

CHR Extension: (YouTube) - C:\Users\Asus\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-07-24]

CHR Extension: (Google Search) - C:\Users\Asus\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-07-24]

CHR Extension: (SiteAdvisor) - C:\Users\Asus\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho [2014-07-24]

CHR Extension: (Google Wallet) - C:\Users\Asus\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-07-24]

CHR Extension: (Gmail) - C:\Users\Asus\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-07-24]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)

R2 asComSvc; C:\Program Files (x86)\ASUS\AXSP\1.00.19\atkexComSvc.exe [920736 2012-06-01] ()

R2 asHmComSvc; C:\Program Files (x86)\ASUS\AAHM\1.00.20\aaHMSvc.exe [951936 2012-06-01] (ASUSTeK Computer Inc.)

R2 AsSysCtrlService; C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.13\AsSysCtrlService.exe [149120 2012-02-17] (ASUSTeK Computer Inc.)

R2 Fabs; C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe [1840128 2011-05-24] (MAGIX AG) [File not signed]

S3 FirebirdServerMAGIXInstance; C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe [2702848 2011-04-26] (MAGIX®) [File not signed]

R2 HomeNetSvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)

R2 jhi_service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [166720 2012-06-25] (Intel Corporation)

S4 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)

S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)

R2 McAfee SiteAdvisor Service; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)

R2 McAPExe; C:\Program Files\McAfee\MSC\McAPExe.exe [178528 2014-04-25] (McAfee, Inc.)

R2 McMPFSvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)

R2 McNaiAnn; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)

S3 McODS; C:\Program Files\McAfee\VirusScan\mcods.exe [603424 2014-06-12] (McAfee, Inc.)

R2 mcpltsvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)

R2 McProxy; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)

R2 mfecore; C:\Program Files\Common Files\McAfee\AMCore\mcshield.exe [1041192 2014-06-18] (McAfee, Inc.)

R2 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [219752 2014-06-20] (McAfee, Inc.)

R2 mfevtp; C:\Windows\system32\mfevtps.exe [189912 2014-06-20] (McAfee, Inc.)

R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1618888 2014-04-30] (NVIDIA Corporation)

R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [21009352 2014-04-30] (NVIDIA Corporation)

R2 PnkBstrA; C:\WINDOWS\SysWOW64\PnkBstrA.exe [75136 2014-02-21] ()

R2 uCamMonitor; C:\Program Files (x86)\ArcSoft\HP Webcam Software Suite\Magic-i Visual Effects 2\uCamMonitor.exe [145984 2012-01-18] (ArcSoft, Inc.)

S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [348392 2013-10-31] (Microsoft Corporation)

S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2013-10-31] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 AiChargerPlus; C:\Windows\SysWow64\drivers\AiChargerPlus.sys [14848 2012-04-19] (ASUSTek Computer Inc.)

R3 ArcSoftKsUFilter; C:\Windows\system32\DRIVERS\ArcSoftKsUFilter.sys [19968 2008-04-03] (ArcSoft, Inc.)

R0 asahci64; C:\Windows\System32\drivers\asahci64.sys [49760 2012-01-06] (Asmedia Technology)

R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [15232 2012-08-22] ()

R1 AsUpIO; C:\Windows\SysWow64\drivers\AsUpIO.sys [14464 2010-08-03] ()

R3 cfwids; C:\Windows\System32\drivers\cfwids.sys [72128 2014-06-20] (McAfee, Inc.)

S3 dot4; C:\Windows\system32\DRIVERS\Dot4.sys [151968 2012-10-19] (Windows ® Win 7 DDK provider)

S3 Dot4Print; C:\Windows\System32\drivers\Dot4Prt.sys [27040 2012-10-19] (Windows ® Win 7 DDK provider)

S3 HipShieldK; C:\Windows\System32\drivers\HipShieldK.sys [197704 2013-09-23] (McAfee, Inc.)

S3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation)

S3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2014-05-12] (Malwarebytes Corporation)

R3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [181704 2014-06-20] (McAfee, Inc.)

R3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [313544 2014-06-20] (McAfee, Inc.)

S0 mfeelamk; C:\Windows\System32\drivers\mfeelamk.sys [70600 2014-06-20] (McAfee, Inc.)

R3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [523792 2014-06-20] (McAfee, Inc.)

R0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [786296 2014-06-20] (McAfee, Inc.)

R3 mfencbdc; C:\Windows\system32\DRIVERS\mfencbdc.sys [444720 2014-06-18] (McAfee, Inc.)

S3 mfencrk; C:\Windows\system32\DRIVERS\mfencrk.sys [96592 2014-06-18] (McAfee, Inc.)

R0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [348552 2014-06-20] (McAfee, Inc.)

R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19744 2014-04-30] (NVIDIA Corporation)

R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [40392 2014-03-31] (NVIDIA Corporation)

R1 RsProxy; C:\Windows\system32\drivers\RsProxy.sys [15976 2013-11-24] ()

S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [54784 2012-12-13] (Apple, Inc.) [File not signed]

S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [124760 2013-10-31] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)

==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-07-26 11:22 - 2014-07-26 11:23 - 00029806 _____ () C:\Users\Asus\Downloads\FRST.txt

2014-07-26 11:22 - 2014-07-26 11:22 - 00000000 ____D () C:\FRST

2014-07-26 11:21 - 2014-07-26 11:22 - 02093568 _____ (Farbar) C:\Users\Asus\Downloads\FRST64 (1).exe

2014-07-26 11:21 - 2014-07-26 11:21 - 02093568 _____ (Farbar) C:\Users\Asus\Downloads\FRST64.exe

2014-07-26 10:20 - 2014-07-26 10:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee

2014-07-24 20:37 - 2014-07-24 20:54 - 00000000 ____D () C:\Users\Asus\Desktop\mbar

2014-07-24 20:37 - 2014-07-24 20:54 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)

2014-07-24 20:36 - 2014-07-24 20:36 - 14349744 _____ (Malwarebytes Corp.) C:\Users\Asus\Downloads\mbar-1.07.0.1012.exe

2014-07-24 19:27 - 2014-07-24 19:28 - 01354223 _____ () C:\Users\Asus\Downloads\AdwCleaner.exe

2014-07-24 18:11 - 2014-07-26 10:38 - 00058422 _____ () C:\WINDOWS\WindowsUpdate.log

2014-07-24 17:44 - 2014-07-24 17:44 - 04813544 _____ (Piriform Ltd) C:\Users\Asus\Downloads\ccsetup416.exe

2014-07-24 17:44 - 2014-07-24 17:44 - 00002770 _____ () C:\WINDOWS\System32\Tasks\CCleanerSkipUAC

2014-07-24 17:44 - 2014-07-24 17:44 - 00000841 _____ () C:\Users\Public\Desktop\CCleaner.lnk

2014-07-24 17:44 - 2014-07-24 17:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner

2014-07-24 17:44 - 2014-07-24 17:44 - 00000000 ____D () C:\Program Files\CCleaner

2014-07-24 17:19 - 2014-07-24 17:20 - 01354223 _____ () C:\Users\Asus\Downloads\adwcleaner_3.216 (1).exe

2014-07-24 14:02 - 2014-07-24 14:02 - 00000000 ____D () C:\MATS

2014-07-24 13:59 - 2014-07-24 13:59 - 00347816 _____ (Microsoft Corporation) C:\Users\Asus\Downloads\MicrosoftFixit.ProgramInstallUninstall.RNP.1329637559147331.1.1.Run.exe

2014-07-23 15:57 - 2014-07-23 16:18 - 00000000 ____D () C:\ProgramData\HitmanPro

2014-07-23 15:54 - 2014-07-23 15:54 - 11188736 _____ (SurfRight B.V.) C:\Users\Asus\Downloads\hitmanpro_x64.exe

2014-07-23 15:47 - 2014-07-23 15:47 - 00000000 ____D () C:\WINDOWS\ERUNT

2014-07-23 15:41 - 2014-07-24 19:28 - 00000000 ____D () C:\AdwCleaner

2014-07-23 15:41 - 2014-07-23 15:41 - 01016261 _____ (Thisisu) C:\Users\Asus\Downloads\JRT.exe

2014-07-23 15:41 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\WINDOWS\SysWOW64\sqlite3.dll

2014-07-23 15:40 - 2014-07-23 15:40 - 01354223 _____ () C:\Users\Asus\Downloads\adwcleaner_3.216.exe

2014-07-23 08:54 - 2014-07-24 21:10 - 00122584 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys

2014-07-23 08:53 - 2014-07-24 20:37 - 00092888 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys

2014-07-23 08:53 - 2014-07-23 08:53 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Asus\Downloads\mbam-setup-2.0.2.1012.exe

2014-07-23 08:53 - 2014-07-23 08:53 - 00001121 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-07-23 08:53 - 2014-07-23 08:53 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-07-23 08:53 - 2014-07-23 08:53 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-07-23 08:53 - 2014-07-23 08:53 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-07-23 08:53 - 2014-05-12 07:26 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys

2014-07-23 08:53 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys

2014-07-22 20:21 - 2014-07-22 20:21 - 12906784 _____ (IObit) C:\Users\Asus\Downloads\iobituninstaller.exe

2014-07-20 18:03 - 2014-07-20 18:04 - 00000000 ____D () C:\Users\Asus\Documents\Mods

2014-07-20 13:48 - 2014-07-21 16:25 - 00000000 ____D () C:\Users\Asus\Documents\Napoleon StartPos Backup

2014-07-20 13:12 - 2014-07-20 13:12 - 00000000 ____D () C:\Users\Asus\AppData\Roaming\EditSF

2014-07-20 11:48 - 2014-07-20 13:11 - 00000000 ____D () C:\Users\Asus\AppData\Local\EsfEditor

2014-07-19 18:54 - 2014-07-19 18:54 - 29611712 _____ (Microsoft Corporation) C:\Users\Asus\Downloads\Windows-KB890830-x64-V5.14.exe

2014-07-19 18:44 - 2014-07-19 18:44 - 00000000 ____D () C:\Program Files\Enigma Software Group

2014-07-19 18:44 - 2014-07-19 18:44 - 00000000 _____ () C:\autoexec.bat

2014-07-19 18:43 - 2014-07-19 18:46 - 00000000 ____D () C:\WINDOWS\ACF5FE1B377240688B872D2A6EFD0A05.TMP

2014-07-19 18:39 - 2014-07-19 18:39 - 00000000 ____D () C:\Users\Asus\Documents\My Cheat Tables

2014-07-19 18:38 - 2014-07-19 18:38 - 09052192 _____ (Cheat Engine ) C:\Users\Asus\Downloads\CheatEngine64.exe

2014-07-05 18:58 - 2014-07-26 10:38 - 00000000 __RDO () C:\Users\Asus\SkyDrive

2014-07-04 15:41 - 2014-07-04 16:02 - 00000000 ____D () C:\Users\Asus\Documents\Kathryn Pearson

2014-06-27 16:26 - 2014-06-27 16:26 - 00027938 _____ () C:\Users\Asus\Downloads\A681.tmp

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-07-26 11:23 - 2014-07-26 11:22 - 00029806 _____ () C:\Users\Asus\Downloads\FRST.txt

2014-07-26 11:22 - 2014-07-26 11:22 - 00000000 ____D () C:\FRST

2014-07-26 11:22 - 2014-07-26 11:21 - 02093568 _____ (Farbar) C:\Users\Asus\Downloads\FRST64 (1).exe

2014-07-26 11:21 - 2014-07-26 11:21 - 02093568 _____ (Farbar) C:\Users\Asus\Downloads\FRST64.exe

2014-07-26 11:02 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\sru

2014-07-26 10:43 - 2013-11-23 20:12 - 00000926 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-2219433388-3516391376-827625826-1001UA.job

2014-07-26 10:38 - 2014-07-24 18:11 - 00058422 _____ () C:\WINDOWS\WindowsUpdate.log

2014-07-26 10:38 - 2014-07-05 18:58 - 00000000 __RDO () C:\Users\Asus\SkyDrive

2014-07-26 10:37 - 2013-09-13 17:01 - 00003598 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2219433388-3516391376-827625826-1001

2014-07-26 10:26 - 2013-09-13 17:46 - 00000928 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job

2014-07-26 10:20 - 2014-07-26 10:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee

2014-07-26 10:20 - 2014-05-23 20:11 - 00003930 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{F1E0584D-E116-442F-B2BB-4379CEC3630E}

2014-07-26 10:20 - 2013-09-13 17:46 - 00002210 _____ () C:\Users\Public\Desktop\Google Chrome.lnk

2014-07-26 10:20 - 2013-09-13 17:46 - 00000924 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job

2014-07-26 10:18 - 2013-09-27 11:31 - 00000492 _____ () C:\WINDOWS\Tasks\SDMsgUpdate (TE).job

2014-07-26 10:18 - 2013-09-27 11:31 - 00000492 _____ () C:\WINDOWS\Tasks\SDMsgUpdate (SD).job

2014-07-25 20:15 - 2014-01-08 17:26 - 00000000 ____D () C:\Users\Asus\AppData\Roaming\ClassicShell

2014-07-25 19:23 - 2013-09-15 09:39 - 00000000 ____D () C:\Program Files (x86)\Steam

2014-07-25 17:34 - 2013-09-28 15:15 - 00000000 ____D () C:\Users\Asus\AppData\Roaming\.minecraft

2014-07-25 16:43 - 2013-11-23 20:12 - 00000874 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-2219433388-3516391376-827625826-1001Core.job

2014-07-25 09:28 - 2013-09-28 15:19 - 00000671 _____ () C:\Users\Asus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Minecraft.lnk

2014-07-24 21:10 - 2014-07-23 08:54 - 00122584 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys

2014-07-24 21:00 - 2014-01-08 19:48 - 00000000 ____D () C:\Users\Asus\AppData\Local\Razer

2014-07-24 21:00 - 2014-01-08 19:47 - 00000000 ____D () C:\ProgramData\Razer

2014-07-24 21:00 - 2014-01-08 19:47 - 00000000 ____D () C:\Program Files (x86)\Razer

2014-07-24 20:54 - 2014-07-24 20:37 - 00000000 ____D () C:\Users\Asus\Desktop\mbar

2014-07-24 20:54 - 2014-07-24 20:37 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)

2014-07-24 20:37 - 2014-07-23 08:53 - 00092888 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys

2014-07-24 20:36 - 2014-07-24 20:36 - 14349744 _____ (Malwarebytes Corp.) C:\Users\Asus\Downloads\mbar-1.07.0.1012.exe

2014-07-24 19:28 - 2014-07-24 19:27 - 01354223 _____ () C:\Users\Asus\Downloads\AdwCleaner.exe

2014-07-24 19:28 - 2014-07-23 15:41 - 00000000 ____D () C:\AdwCleaner

2014-07-24 18:52 - 2014-01-06 21:00 - 00000000 ____D () C:\ProgramData\NVIDIA

2014-07-24 18:52 - 2013-08-22 15:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT

2014-07-24 18:16 - 2013-08-22 14:25 - 00786432 ___SH () C:\WINDOWS\system32\config\BBI

2014-07-24 17:51 - 2014-02-19 21:43 - 00000000 ____D () C:\WINDOWS\Minidump

2014-07-24 17:51 - 2014-01-07 04:57 - 00000000 ___DC () C:\WINDOWS\Panther

2014-07-24 17:44 - 2014-07-24 17:44 - 04813544 _____ (Piriform Ltd) C:\Users\Asus\Downloads\ccsetup416.exe

2014-07-24 17:44 - 2014-07-24 17:44 - 00002770 _____ () C:\WINDOWS\System32\Tasks\CCleanerSkipUAC

2014-07-24 17:44 - 2014-07-24 17:44 - 00000841 _____ () C:\Users\Public\Desktop\CCleaner.lnk

2014-07-24 17:44 - 2014-07-24 17:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner

2014-07-24 17:44 - 2014-07-24 17:44 - 00000000 ____D () C:\Program Files\CCleaner

2014-07-24 17:31 - 2013-09-13 17:46 - 00000000 ____D () C:\Users\Asus\AppData\Local\Google

2014-07-24 17:27 - 2013-11-14 08:28 - 00863592 _____ () C:\WINDOWS\system32\PerfStringBackup.INI

2014-07-24 17:20 - 2014-07-24 17:19 - 01354223 _____ () C:\Users\Asus\Downloads\adwcleaner_3.216 (1).exe

2014-07-24 14:02 - 2014-07-24 14:02 - 00000000 ____D () C:\MATS

2014-07-24 13:59 - 2014-07-24 13:59 - 00347816 _____ (Microsoft Corporation) C:\Users\Asus\Downloads\MicrosoftFixit.ProgramInstallUninstall.RNP.1329637559147331.1.1.Run.exe

2014-07-23 17:36 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\AppReadiness

2014-07-23 17:18 - 2014-01-02 17:25 - 00000000 ____D () C:\Users\Asus\AppData\Local\DayZ

2014-07-23 16:18 - 2014-07-23 15:57 - 00000000 ____D () C:\ProgramData\HitmanPro

2014-07-23 15:54 - 2014-07-23 15:54 - 11188736 _____ (SurfRight B.V.) C:\Users\Asus\Downloads\hitmanpro_x64.exe

2014-07-23 15:47 - 2014-07-23 15:47 - 00000000 ____D () C:\WINDOWS\ERUNT

2014-07-23 15:41 - 2014-07-23 15:41 - 01016261 _____ (Thisisu) C:\Users\Asus\Downloads\JRT.exe

2014-07-23 15:40 - 2014-07-23 15:40 - 01354223 _____ () C:\Users\Asus\Downloads\adwcleaner_3.216.exe

2014-07-23 09:38 - 2013-09-14 23:39 - 00000000 ____D () C:\Program Files (x86)\McAfee

2014-07-23 09:19 - 2013-09-14 23:27 - 00000000 ____D () C:\Program Files\Common Files\McAfee

2014-07-23 09:18 - 2012-07-26 09:12 - 00000000 ___HD () C:\WINDOWS\ELAMBKUP

2014-07-23 08:53 - 2014-07-23 08:53 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Asus\Downloads\mbam-setup-2.0.2.1012.exe

2014-07-23 08:53 - 2014-07-23 08:53 - 00001121 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-07-23 08:53 - 2014-07-23 08:53 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-07-23 08:53 - 2014-07-23 08:53 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-07-23 08:53 - 2014-07-23 08:53 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-07-22 20:21 - 2014-07-22 20:21 - 12906784 _____ (IObit) C:\Users\Asus\Downloads\iobituninstaller.exe

2014-07-21 21:51 - 2013-09-15 09:39 - 00000000 ____D () C:\Users\Asus\AppData\Roaming\Spotify

2014-07-21 21:36 - 2013-09-15 09:40 - 00000000 ____D () C:\Users\Asus\AppData\Local\Spotify

2014-07-21 16:25 - 2014-07-20 13:48 - 00000000 ____D () C:\Users\Asus\Documents\Napoleon StartPos Backup

2014-07-21 11:16 - 2013-08-22 14:25 - 00262144 ___SH () C:\WINDOWS\system32\config\ELAM

2014-07-20 18:04 - 2014-07-20 18:03 - 00000000 ____D () C:\Users\Asus\Documents\Mods

2014-07-20 13:12 - 2014-07-20 13:12 - 00000000 ____D () C:\Users\Asus\AppData\Roaming\EditSF

2014-07-20 13:11 - 2014-07-20 11:48 - 00000000 ____D () C:\Users\Asus\AppData\Local\EsfEditor

2014-07-19 18:54 - 2014-07-19 18:54 - 29611712 _____ (Microsoft Corporation) C:\Users\Asus\Downloads\Windows-KB890830-x64-V5.14.exe

2014-07-19 18:46 - 2014-07-19 18:43 - 00000000 ____D () C:\WINDOWS\ACF5FE1B377240688B872D2A6EFD0A05.TMP

2014-07-19 18:44 - 2014-07-19 18:44 - 00000000 ____D () C:\Program Files\Enigma Software Group

2014-07-19 18:44 - 2014-07-19 18:44 - 00000000 _____ () C:\autoexec.bat

2014-07-19 18:39 - 2014-07-19 18:39 - 00000000 ____D () C:\Users\Asus\Documents\My Cheat Tables

2014-07-19 18:38 - 2014-07-19 18:38 - 09052192 _____ (Cheat Engine ) C:\Users\Asus\Downloads\CheatEngine64.exe

2014-07-19 10:52 - 2011-07-07 23:08 - 00000000 ____D () C:\Users\Asus\Documents\Meadow Cottage

2014-07-17 20:00 - 2013-10-12 13:54 - 00000000 ____D () C:\Users\Asus\Documents\Sean A-level

2014-07-17 19:03 - 2012-08-24 18:06 - 00000000 ____D () C:\Users\Asus\Documents\Mount&Blade Warband Savegames

2014-07-14 23:29 - 2013-09-13 18:17 - 00000000 ____D () C:\Users\Asus\Documents\Outlook Files

2014-07-08 18:46 - 2011-03-08 19:14 - 00000000 ____D () C:\Users\Asus\Documents\Kathryn

2014-07-05 18:58 - 2014-01-06 21:43 - 00000000 __RDO () C:\Users\Asus\SkyDrive (2).old

2014-07-05 18:58 - 2014-01-06 21:05 - 00000000 ____D () C:\Users\Asus

2014-07-04 16:02 - 2014-07-04 15:41 - 00000000 ____D () C:\Users\Asus\Documents\Kathryn Pearson

2014-06-28 20:48 - 2013-12-21 18:55 - 00000000 ____D () C:\ProgramData\Origin

2014-06-27 21:10 - 2013-12-21 18:56 - 00000000 ____D () C:\Users\Asus\AppData\Local\Origin

2014-06-27 21:10 - 2013-12-21 18:55 - 00000000 ____D () C:\Users\Asus\AppData\Roaming\Origin

2014-06-27 21:04 - 2013-12-21 18:55 - 00000000 ____D () C:\Program Files (x86)\Origin

2014-06-27 16:26 - 2014-06-27 16:26 - 00027938 _____ () C:\Users\Asus\Downloads\A681.tmp

2014-06-26 17:40 - 2013-09-15 14:38 - 96441528 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2014-07-24 19:04

==================== End Of Log ============================

Napoleose · July 26, 2014

How do I attach the addition? It's too long to post.

deeprybka · July 26, 2014

Hi,

Napoleose · July 26, 2014

Sorry :L Here it is

Addition.txt

deeprybka · July 26, 2014

Step 1

Please run AdwCleaner (by Xplode).

Double click on AdwCleaner.exe to run the tool.
Vista/Windows 7/8 users right-click and select "Run As Administrator"
Click on the Scan button.
After the scan has finished, click on the Clean button.
Press OK when asked to close all programs and follow the onscreen prompts.
After rebooting, a log file (that is saved in C:\AdwCleaner[s#].txt) will open automatically.
Copy and paste the contents of that logfile in your next reply.

Step 2

Download zoek.exe to your desktop

If Internet Explorer, any other browser, or a security program issues a warning indicating the file is unsafe, please ignore, since it is a false warning.

Using Zoek.exe

On the Desktop, double-click Zoek.exe to start the tool.
Windows Vista, 7 and 8 users right-click the file and select: Run as Administrator.
Give the program a few seconds to appear.
Copy and paste the following script in the code box:
Note: This script is written for usage on this system only, do not use it on any other computer even if the problems are similar.
```
FFdefaults;CHRdefaults;iedefaults;emptyclsid;autoclean;
```
Click the "Run script" button and wait patiently.
When finished the logfile will be opened in notepad.
If a reboot is needed the logfile will be opened after reboot.
The zoek-results.log can also be found on your systemdrive.
Please post the logfile for further review in your next comment.

Step 3

Scan with Malwarebytes Antimalware

Please update the database by clicking on the "Update Now" button.
Following the update and click "Settings" and go to "Detection and Protection"
Make sure "Scan for Rootkits" is checked.
Click on Dashboard, then click on Scan Now to start the scan.
(If Malware or Potentially Unwanted Programs [PUPs] are found, you will receive a prompt so that you can decide what you want to do. I suggest "Quarantine". Click the button: Apply All Actions.)
A window with an option to view the detailed log will appear. Click on "View Detailed Log".
After viewing the results, please click on the "Copy to Clipboard" button and then OK.
Return to our forum. Paste your log into your next reply.

Step 4

Start FRST with administator privileges.

Press the Scan button.
When finished, FRST will produce a log (FRST.txt) in the same directory the tool was run from.
Please copy and paste the log in your next reply.

Napoleose · July 26, 2014

I have used this tool before - and have removed the helperbar thing numerous times - and it has come back. Will these other programmes remove it?

-

# AdwCleaner v3.216 - Report created 26/07/2014 at 19:15:39

# Updated 17/07/2014 by Xplode

# Operating System : Windows 8.1 (64 bits)

# Username : Asus - ASUSCM6330

# Running from : C:\Users\Asus\Downloads\AdwCleaner.exe

# Option : Clean

***** [ Services ] *****

***** [ Files / Folders ] *****

***** [ Shortcuts ] *****

***** [ Registry ] *****

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.16518

-\\ Google Chrome v36.0.1985.125

[ File : C:\Users\Asus\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Deleted [Homepage] : hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StMBGUhCtXlT7G1muS_BRDXuH_N6dnG4YA4YYZwVC8dZ1beD-mJflaiNDSel7fXyQcqlcTR1x8966iKDs24kRcN3dopBbjzHdb73TII9qPejTbXvoFs2_szMMnpw1XEmSwl5uzSNHkaJQZkmGPMa3KWYD-UrMRNz3y_HPuU3BuYLyOCHd-KyzWUPwE_KBADCPtdmrybw,,

*************************

AdwCleaner[R0].txt - [3297 octets] - [23/07/2014 15:41:03]

AdwCleaner[R1].txt - [1138 octets] - [24/07/2014 17:21:23]

AdwCleaner[R2].txt - [1248 octets] - [24/07/2014 19:28:20]

AdwCleaner[R3].txt - [342 octets] - [26/07/2014 19:12:24]

AdwCleaner[R4].txt - [1368 octets] - [26/07/2014 19:13:19]

AdwCleaner[s0].txt - [3420 octets] - [23/07/2014 15:43:19]

AdwCleaner[s1].txt - [1202 octets] - [24/07/2014 17:22:59]

AdwCleaner[s2].txt - [1291 octets] - [26/07/2014 19:15:39]

########## EOF - C:\AdwCleaner\AdwCleaner[s2].txt - [1351 octets] ##########

deeprybka · July 26, 2014

I have used this tool before

I know...

Napoleose · July 26, 2014

It wont let me open the Voek thing, it says a trojan called artemis has been detected?

Napoleose · July 26, 2014

Macafee is being a pain

Napoleose · July 26, 2014

It's running now.

Napoleose · July 26, 2014

Here you go.

-

Zoek.exe v5.0.0.0 Updated 14-07-2014

Tool run by Asus on 26/07/2014 at 19:24:44.49.

Microsoft Windows 8.1 6.3.9600 x64

Running in: Normal Mode No Internet Access Detected

Launched: C:\Users\Asus\Downloads\zoek.exe [scan all users] [script inserted]

==== System Restore Info ======================

26/07/2014 19:27:32 Zoek.exe System Restore Point Created Succesfully.

==== Deleting CLSID Registry Keys ======================

HKEY_USERS\S-1-5-21-2219433388-3516391376-827625826-1001\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{8E5E2654-AD2D-48BF-AC2D-D17F00898D06} deleted successfully

HKEY_USERS\S-1-5-21-2219433388-3516391376-827625826-1001\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{8E5E2654-AD2D-48BF-AC2D-D17F00898D06} deleted successfully

HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{8E5E2654-AD2D-48BF-AC2D-D17F00898D06} deleted successfully

HKEY_CLASSES_ROOT\CLSID\{318A227B-5E9F-45BD-8999-7F8F10CA4CF5} deleted successfully

==== Deleting CLSID Registry Values ======================

==== Deleting Services ======================

==== Deleting Files \ Folders ======================

C:\PROGRA~3\Malwarebytes' Anti-Malware (portable) deleted

C:\Autorun.inf deleted

deeprybka · July 26, 2014

Is this the complete log?

Napoleose · July 26, 2014

Yes - should I be worried like?

Napoleose · July 26, 2014

Could you tell me where the log is located so I can check please?

deeprybka · July 26, 2014

The zoek-results.log can also be found on your systemdrive.

C:\

Napoleose · July 26, 2014

Zoek.exe v5.0.0.0 Updated 14-07-2014

Tool run by Asus on 26/07/2014 at 19:24:44.49.

Microsoft Windows 8.1 6.3.9600 x64

Running in: Normal Mode No Internet Access Detected

Launched: C:\Users\Asus\Downloads\zoek.exe [scan all users] [script inserted]

==== System Restore Info ======================

26/07/2014 19:27:32 Zoek.exe System Restore Point Created Succesfully.

==== Deleting CLSID Registry Keys ======================

HKEY_USERS\S-1-5-21-2219433388-3516391376-827625826-1001\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{8E5E2654-AD2D-48BF-AC2D-D17F00898D06} deleted successfully

HKEY_USERS\S-1-5-21-2219433388-3516391376-827625826-1001\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{8E5E2654-AD2D-48BF-AC2D-D17F00898D06} deleted successfully

HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{8E5E2654-AD2D-48BF-AC2D-D17F00898D06} deleted successfully

HKEY_CLASSES_ROOT\CLSID\{318A227B-5E9F-45BD-8999-7F8F10CA4CF5} deleted successfully

==== Deleting CLSID Registry Values ======================

==== Deleting Services ======================

==== Deleting Files \ Folders ======================

C:\PROGRA~3\Malwarebytes' Anti-Malware (portable) deleted

C:\Autorun.inf deleted

C:\found.000 deleted

C:\PROGRA~3\InstallMate deleted

C:\PROGRA~3\Package Cache deleted

C:\Users\Asus\Searches deleted

C:\WINDOWS\wininit.ini deleted

"C:\Windows\Installer\304a8a.msi" deleted

==== Firefox Extensions Registry ======================

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Mozilla\Firefox\Extensions]

"{4ED1F68A-5463-4931-9384-8FFF5ED91D92}"="C:\Program Files (x86)\McAfee\SiteAdvisor" [21/07/2014 13:26]

==== Chrome Look ======================

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions

bmiabdepfhhiieiipmeecdmeljggmfee - No path found[]

fheoggkfdfchfphceeifdbepaooicaho - No path found[]

Google Voice Search Hotword (Beta) - Asus\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn

SiteAdvisor - Asus\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho

==== Chrome Fix ======================

C:\Users\Asus\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho deleted successfully

==== Set IE to Default ======================

Old Values:

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]

"Use Search Asst"="yes"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchUrl]

"Default"="www.google.com"

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\SearchUrl]

"Default"="www.google.com"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl]

"Default"="www.google.com"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]

No DefaultScope Set For HKCU

New Values:

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]

"Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157"

"Use Search Asst"="no"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchUrl]

"(Default)"="http://search.msn.com/results.asp?q=%s"

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\SearchUrl]

"(Default)"="http://search.msn.com/results.asp?q=%s"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl]

"(Default)"="http://search.msn.com/results.asp?q=%s"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]

"DefaultScope"="{6A1806CD-94D4-4689-BA73-E35EA1EA9990}"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes

{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC"

{6A1806CD-94D4-4689-BA73-E35EA1EA9990} Google Url="http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}"

==== Reset Google Chrome ======================

C:\Users\Asus\AppData\Local\Google\Chrome\User Data\Default\Preferences was reset successfully

C:\Users\Asus\AppData\Local\Google\Chrome\User Data\Default\Web Data was reset successfully

==== Deleting Registry Keys ======================

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\F60730A4A66673047777F5728467D401 deleted successfully

HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{CEF5F303-5354-6A46-97BF-9C5889D8C48A} deleted successfully

HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Google\Chrome\Extensions\bmiabdepfhhiieiipmeecdmeljggmfee deleted successfully

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions\bmiabdepfhhiieiipmeecdmeljggmfee deleted successfully

HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Google\Chrome\Extensions\fheoggkfdfchfphceeifdbepaooicaho deleted successfully

HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10} deleted successfully

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\F60730A4A66673047777F5728467D401 deleted successfully

==== Empty IE Cache ======================

C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

C:\Users\Asus\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully

C:\Users\Asus\AppData\Local\Microsoft\Windows\INetCache\Low\Content.IE5 emptied successfully

C:\Users\Asus\Desktop\kps harddrive\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

C:\Users\Asus\Desktop\kps harddrive\Users\Kathryn\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

C:\Users\Asus\Desktop\kps harddrive\Users\Kathryn\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully

C:\Users\Asus\Desktop\kps harddrive\Users\Kathryn\AppData\Local\Temp\Low\Temporary Internet Files\Content.IE5 emptied successfully

C:\Users\Asus\Desktop\kps harddrive\Users\Kathryn\AppData\Local\Temp\Temporary Internet Files\Content.IE5 emptied successfully

C:\Users\Asus\Desktop\kps harddrive\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

C:\Users\Asus\Desktop\kps harddrive\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\Temporary Internet Files\Content.IE5 emptied successfully

C:\Users\Asus\Desktop\kps harddrive\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

C:\Users\Asus\Desktop\kps harddrive\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully

C:\WINDOWS\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully

C:\WINDOWS\sysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully

==== Empty FireFox Cache ======================

No FireFox Profiles found

==== Empty Chrome Cache ======================

C:\Users\Asus\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully

==== Empty All Flash Cache ======================

Flash Cache Emptied Successfully

==== Empty All Java Cache ======================

Java Cache cleared successfully

==== C:\zoek_backup content ======================

C:\zoek_backup (files=55 folders=23 18084303 bytes)

==== Empty Temp Folders ======================

C:\Users\Asus\AppData\Local\Temp will be emptied at reboot

C:\Users\Default\AppData\Local\Temp emptied successfully

C:\Users\Default User\AppData\Local\Temp emptied successfully

C:\WINDOWS\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully

C:\WINDOWS\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully

C:\WINDOWS\Temp will be emptied at reboot

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\WINDOWS\Temp successfully emptied

C:\Users\Asus\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\$RECYCLE.BIN successfully emptied

==== EOF on 26/07/2014 at 19:35:36.95 ======================

Napoleose · July 26, 2014

Malwarebytes complete! There's apparently nothing! I wish I could shake you by the hand sir!

-

Malwarebytes Anti-Malware

www.malwarebytes.org

Scan Date: 26/07/2014

Scan Time: 19:38:13

Logfile:

Administrator: Yes

Version: 2.00.2.1012

Malware Database: v2014.07.26.08

Rootkit Database: v2014.07.17.01

License: Trial

Malware Protection: Enabled

Malicious Website Protection: Enabled

Self-protection: Disabled

OS: Windows 8.1

CPU: x64

File System: NTFS

User: Asus

Scan Type: Threat Scan

Result: Completed

Objects Scanned: 311771

Time Elapsed: 17 min, 53 sec

Memory: Enabled

Startup: Enabled

Filesystem: Enabled

Archives: Enabled

Rootkits: Disabled

Heuristics: Enabled

PUP: Enabled

PUM: Enabled

Processes: 0

(No malicious items detected)

Modules: 0

(No malicious items detected)

Registry Keys: 0

(No malicious items detected)

Registry Values: 0

(No malicious items detected)

Registry Data: 0

(No malicious items detected)

Folders: 0

(No malicious items detected)

Files: 0

(No malicious items detected)

Physical Sectors: 0

(No malicious items detected)

(end)

Napoleose · July 26, 2014

For good measure, the FRST results

-

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 26-07-2014

Ran by Asus (administrator) on ASUSCM6330 on 26-07-2014 20:00:41