Jump to content

malwarebytes wont run, i need help please

rossco
 Share

Recommended Posts

rossco

rossco

Posted
Posted

Hi , my laptop has been running slow so thought I would check it out using malwarebytes but it brings up an error message saying "this program is blocked by group policy"

I have run frst and here is the results

 

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:30-07-2014
Ran by Parent (administrator) on PARENT-PC on 30-07-2014 20:58:21
Running from C:\Users\Parent\Downloads
Platform: Microsoft Windows 7 Professional  Service Pack 1 (X86) OS Language: English (United States)
Internet Explorer Version 9
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Enigma Software Group USA, LLC.) C:\Program Files\Enigma Software Group\SpyHunter\SH4Service.exe
(SurfRight B.V.) C:\Program Files\HitmanPro\hmpsched.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
() C:\Program Files\3 Mobile Broadband\3Connect\BecHelperService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe
(Razer Inc.) C:\Program Files\Razer\Razer Game Booster\RzKLService.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
() C:\Windows\Installer\{31A46D32-02E0-92BD-019D-738FE175B643}\syshost.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\EasySpeedUpManager\EasySpeedUpManager.exe
(SEC) C:\Program Files\Samsung\Samsung Recovery Solution 4\WCScheduler.exe
(SAMSUNG Electronics) C:\Program Files\Samsung\Samsung Support Center\SSCKbdHk.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Positive IT Solutions) C:\Positive IT Solutions\Child Safe Solutions\CSSWebFiltering.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Adobe Systems Incorporated) C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Research In Motion Limited) C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Research In Motion Limited) C:\Program Files\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe
(BitTorrent, Inc.) C:\Program Files\uTorrent\uTorrent.exe
(Google Inc.) C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Internet Services\iCloudServices.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Microsoft Corporation) C:\Windows\System32\StikyNot.exe
(Microsoft Corporation) C:\Windows\System32\regsvr32.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Internet Services\APSDaemon.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Google Inc.) C:\Program Files\Google\Google Toolbar\GoogleToolbarUser_32.exe

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM Group Policy restriction on software: C:\Program Files\Malwarebytes' Anti-Malware <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files\Microsoft Security Client <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Malwarebytes <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Malwarebytes <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Malwarebytes <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files\Microsoft Security Client <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files\Microsoft Security Client <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files\Microsoft Security Client <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files\Microsoft Security Client <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Malwarebytes <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files\Malwarebytes' Anti-Malware <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Malwarebytes <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Malwarebytes <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Malwarebytes <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files\Malwarebytes' Anti-Malware <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files\Microsoft Security Client <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files\Microsoft Security Client <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files\Malwarebytes' Anti-Malware <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files\Malwarebytes' Anti-Malware <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files\Malwarebytes' Anti-Malware <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files\Malwarebytes' Anti-Malware <====== ATTENTION
HKLM\...D6A79037F57F\InprocServer32: [Default-fastprox] fastprox.dll ATTENTION! ====> ZeroAccess?
HKU\S-1-5-21-502250249-1756045401-4193677544-1000\...\Run: [uTorrent] => C:\Program Files\uTorrent\uTorrent.exe [396152 2011-02-05] (BitTorrent, Inc.)
HKU\S-1-5-21-502250249-1756045401-4193677544-1000\...\Run: [msnmsgr] => C:\Program Files\Windows Live\Messenger\msnmsgr.exe [4280184 2012-03-08] (Microsoft Corporation)
HKU\S-1-5-21-502250249-1756045401-4193677544-1000\...\Run: [swg] => C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2011-08-29] (Google Inc.)
HKU\S-1-5-21-502250249-1756045401-4193677544-1000\...\Run: [MobileDocuments] => C:\Program Files\Common Files\Apple\Internet Services\ubd.exe
HKU\S-1-5-21-502250249-1756045401-4193677544-1000\...\Run: [iCloudServices] => C:\Program Files\Common Files\Apple\Internet Services\iCloudServices.exe [59720 2013-09-14] (Apple Inc.)
HKU\S-1-5-21-502250249-1756045401-4193677544-1000\...\Run: [ApplePhotoStreams] => C:\Program Files\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [59720 2013-09-15] (Apple Inc.)
HKU\S-1-5-21-502250249-1756045401-4193677544-1000\...\Run: [Facebook Update] => C:\Users\Parent\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2013-01-19] (Facebook Inc.)
HKU\S-1-5-21-502250249-1756045401-4193677544-1000\...\Run: [AdobeBridge] => [X]
HKU\S-1-5-21-502250249-1756045401-4193677544-1000\...\Run: [RESTART_STICKY_NOTES] => C:\Windows\System32\StikyNot.exe [354304 2009-07-14] (Microsoft Corporation)
HKU\S-1-5-21-502250249-1756045401-4193677544-1000\...\Run: [ijnmsoft] => regsvr32.exe C:\Users\Parent\AppData\Local\Ijnmsoft\SQLMON.DLL  <===== ATTENTION
HKU\S-1-5-21-502250249-1756045401-4193677544-1000\...\MountPoints2: {53295ab4-ffff-11de-90e5-806e6f6e6963} - E:\Autorun.exe
HKU\S-1-5-21-502250249-1756045401-4193677544-1000\...\MountPoints2: {e44fa0d6-5d26-11df-8b74-00245424cc8f} - F:\AutoRun.exe
HKU\S-1-5-21-502250249-1756045401-4193677544-1000\...409d6c4515e9\InprocServer32: [Default-shell32] shell32.dll ATTENTION! ====> ZeroAccess?
Startup: C:\Users\Learner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BBC iPlayer Desktop.lnk
ShortcutTarget: BBC iPlayer Desktop.lnk -> C:\Program Files\BBC iPlayer Desktop\BBC iPlayer Desktop.exe ()
Startup: C:\Users\Parent\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EPUHelp.exe ()
ShellIconOverlayIdentifiers:  SkyDrive1 -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => C:\Users\Parent\AppData\Local\Microsoft\SkyDrive\17.0.2015.0811\SkyDriveShell.dll (Microsoft Corporation)
ShellIconOverlayIdentifiers:  SkyDrive2 -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => C:\Users\Parent\AppData\Local\Microsoft\SkyDrive\17.0.2015.0811\SkyDriveShell.dll (Microsoft Corporation)
ShellIconOverlayIdentifiers:  SkyDrive3 -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => C:\Users\Parent\AppData\Local\Microsoft\SkyDrive\17.0.2015.0811\SkyDriveShell.dll (Microsoft Corporation)
ShellIconOverlayIdentifiers: SmartFTP Drop -> {EA5A76F7-8138-4B53-B0F5-ADCC730CAFBD} => C:\Program Files\SmartFTP Client\sfShellTools.dll (SmartSoft Ltd.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/ig?hl=en/
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
SearchScopes: HKLM - DefaultScope {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SMSN
SearchScopes: HKLM - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SMSN
SearchScopes: HKCU - DefaultScope {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SMSN_en
SearchScopes: HKCU - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SMSN_en
BHO: txthlpBHO Class -> {060235DC-6D84-47BD-95D7-A4EF5099A59D} -> C:\Program Files\Texthelp Systems\Read and Write 9\texthelpbho.dll ()
BHO: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: Java Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: ba3HelperObj Class -> {A17B153F-2267-4161-A165-73DCD6C31BEF} -> C:\Program Files\Texthelp Systems\Read and Write 9\ba3bho.dll ()
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} http://office.microsoft.com/_layouts/ClientBin/ieawsdc32.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

FireFox:
========
FF Plugin: @adobe.com/ShockwavePlayer - C:\windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF Plugin: @Apple.com/iTunes,version=1.0 - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @google.com/npPicasa3,version=3.0.0 - C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin: @java.com/DTPlugin,version=10.55.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.4 - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3555.0308 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @RIM.com/WebSLLauncher,version=1.0 - C:\Program Files\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll ()
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @nsroblox.roblox.com/launcher - C:\Users\Parent\AppData\Local\Roblox\Versions\version-1112937d32504d8c\\NPRobloxProxy.dll ( ROBLOX Corporation)
FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin - C:\Users\Parent\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\Parent\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF StartMenuInternet: FIREFOX.EXE - firefox.exe

Chrome:
=======
CHR Extension: (DefinitionLoader Class) - C:\Users\Parent\AppData\Local\Google\Chrome\User Data\Default\Extensions\ajpgkpeckebdhofmmjfgcjjiiejpodla [2014-04-19]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Parent\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-05-26]
CHR Extension: (Screen capture) - C:\Users\Parent\AppData\Local\Google\Chrome\User Data\Default\Extensions\clcbnchcgjcjphmnpndoelbdhakdlfkk [2014-03-16]
CHR Extension: (Screen Capture (by Google)) - C:\Users\Parent\AppData\Local\Google\Chrome\User Data\Default\Extensions\cpngackimfmofbokmjmljamhdncknpmg [2014-03-16]
CHR Extension: (Google Wallet) - C:\Users\Parent\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-12-15]

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 BecHelperService; C:\Program Files\3 Mobile Broadband\3Connect\BecHelperService.exe [1737464 2010-01-28] ()
R3 Blackberry Device Manager; C:\Program Files\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe [577536 2013-01-18] (Research In Motion Limited) [File not signed]
S3 ExpressAccountsService; C:\Program Files\NCH Software\ExpressAccounts\expressaccounts.exe [3201576 2013-02-01] (NCH Software)
S3 ExpressInvoiceService; C:\Program Files\NCH Software\ExpressInvoice\expressinvoice.exe [2620456 2013-07-19] (NCH Software)
R2 HitmanProScheduler; C:\Program Files\HitmanPro\hmpsched.exe [106280 2013-06-05] (SurfRight B.V.)
S3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [214952 2012-03-26] (Microsoft Corporation)
R2 RzKLService; C:\Program Files\Razer\Razer Game Booster\RzKLService.exe [105448 2013-11-22] (Razer Inc.)
R2 SpyHunter 4 Service; C:\Program Files\Enigma Software Group\SpyHunter\SH4Service.exe [763840 2012-08-21] (Enigma Software Group USA, LLC.)
S3 SwitchBoard; C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]
R2 syshost32; C:\windows\Installer\{31A46D32-02E0-92BD-019D-738FE175B643}\syshost.exe [160768 2014-04-19] () [File not signed]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 CH341SER; C:\windows\System32\Drivers\CH341SER.SYS [39632 2009-06-03] (www.winchiphead.com)
S3 esgiguard; C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [13904 2011-05-06] ()
R2 mdvrmng; C:\windows\system32\drivers\mdvrmng.sys [10240 2010-01-28] () [File not signed]
R0 MpFilter; C:\windows\System32\DRIVERS\MpFilter.sys [171064 2012-03-20] (Microsoft Corporation)
S2 Par1284; C:\Program Files\FlexiSIGN-PRO 8.1v1\Program\Par1284.sys [53344 2006-10-16] (Warp Nine Engineering) [File not signed]
R1 RapportCerberus_59849; C:\ProgramData\Trusteer\Rapport\store\exts\RapportCerberus\baseline\RapportCerberus32_59849.sys [340432 2013-12-21] ()
S3 hitmanpro37; \??\C:\windows\system32\drivers\hitmanpro37.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)

==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-07-30 20:58 - 2014-07-30 20:59 - 00020622 _____ () C:\Users\Parent\Downloads\FRST.txt
2014-07-30 20:58 - 2014-07-30 20:58 - 00000000 ____D () C:\FRST
2014-07-30 20:57 - 2014-07-30 20:57 - 01084928 _____ (Farbar) C:\Users\Parent\Downloads\FRST.exe
2014-07-27 22:02 - 2014-07-27 22:02 - 00000000 ____D () C:\Users\Parent\Downloads\OneDrive-2014-07-27
2014-07-27 21:27 - 2014-07-27 21:35 - 118735112 _____ () C:\Users\Parent\Downloads\OneDrive-2014-07-27.zip
2014-07-27 19:16 - 2014-07-27 19:17 - 00000000 ____D () C:\Users\Parent\Downloads\VA - Extended 80s - The Definitive 12inch Collection [3CD Box Set] (2014) MP3
2014-07-27 19:12 - 2014-07-27 19:13 - 00000000 ____D () C:\Users\Parent\Downloads\The.House.Of.Magic.2013.BDRip.XviD.MP3-RARBG
2014-07-27 18:33 - 2014-07-27 18:33 - 00000000 ____D () C:\Users\Parent\Downloads\Skrillex - Recess [2014] [Mp3-256]-V3nom [GLT]
2014-07-26 19:38 - 2014-07-26 19:39 - 00000000 ____D () C:\Users\Parent\Downloads\The.Expendables.3.2014.DVDSCR.Xvid-DiNGO
2014-07-26 19:31 - 2014-07-26 19:31 - 00003288 ____N () C:\bootsqm.dat
2014-07-24 20:35 - 2014-07-24 20:35 - 00000000 ____D () C:\Users\Parent\AppData\Local\{C45AACE7-3EA7-4C74-A327-FB219B6B9A13}
2014-07-18 21:53 - 2014-07-18 22:18 - 00000000 ____D () C:\Users\Parent\Downloads\Ministry of Sound Tech House (2014) (320kbps) (AciDToX8)
2014-07-18 21:52 - 2014-07-18 21:52 - 00000000 ____D () C:\Users\Parent\Downloads\Ministry Of Sound The Sound Of Deep House 2 (2014)
2014-07-18 18:19 - 2014-07-18 18:27 - 00000000 ____D () C:\Users\Parent\Downloads\The.Fault.In.Our.Stars.2014.CAM.XviD.MP3-RARBG
2014-07-18 18:10 - 2014-07-18 18:10 - 00000000 ____D () C:\Users\Parent\Downloads\The Fault In Our Stars 2014 HDCAM FIRST CAM x264 Pimp4003
2014-07-18 17:28 - 2014-07-18 17:37 - 00000000 ____D () C:\Users\Parent\Downloads\The Fault In Our Stars 2014 CAM AAC x264-SSDD
2014-07-18 15:50 - 2014-07-21 11:39 - 00000000 ____D () C:\Users\Parent\AppData\Local\{E67F3A57-6FBD-4517-B45E-CB13A3122336}
2014-07-17 15:44 - 2014-07-17 15:44 - 00000000 ____D () C:\Users\Parent\AppData\Local\{E7781484-0BED-4432-BF95-A3ED1557EAE0}
2014-07-15 21:18 - 2014-07-15 21:18 - 00000000 ____D () C:\Users\Parent\Downloads\OneDrive-2014-07-15
2014-07-15 21:16 - 2014-07-15 21:16 - 08195334 _____ () C:\Users\Parent\Downloads\OneDrive-2014-07-15.zip
2014-07-14 08:18 - 2014-07-15 21:02 - 00000000 ____D () C:\Users\Parent\AppData\Local\Adobe
2014-07-13 22:18 - 2014-07-13 22:19 - 00000000 ____D () C:\Users\Parent\Downloads\OneDrive-2014-07-13 (1)
2014-07-13 21:48 - 2014-07-13 22:17 - 401674066 _____ () C:\Users\Parent\Downloads\OneDrive-2014-07-13 (1).zip
2014-07-13 19:42 - 2014-07-13 19:42 - 00000000 ____D () C:\Users\Parent\Downloads\OneDrive-2014-07-13
2014-07-13 19:37 - 2014-07-13 19:41 - 58479947 _____ () C:\Users\Parent\Downloads\OneDrive-2014-07-13.zip
2014-07-09 20:21 - 2013-08-03 15:04 - 00036762 _____ () C:\Users\Parent\Downloads\VW_CLUB_-_Czech_Republic.ai
2014-07-09 20:20 - 2014-07-09 20:20 - 00010051 _____ () C:\Users\Parent\Downloads\VW_CLUB_-_Czech_Republic-vector-logo-BACA5ED57B-seeklogo.com.zip
2014-07-09 20:19 - 2014-07-09 20:19 - 00009842 _____ () C:\Users\Parent\Downloads\vw-combi-lateral-vector-logo-A8591F7937-seeklogo.com.zip

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-07-30 20:59 - 2014-07-30 20:58 - 00020622 _____ () C:\Users\Parent\Downloads\FRST.txt
2014-07-30 20:58 - 2014-07-30 20:58 - 00000000 ____D () C:\FRST
2014-07-30 20:57 - 2014-07-30 20:57 - 01084928 _____ (Farbar) C:\Users\Parent\Downloads\FRST.exe
2014-07-30 20:55 - 2011-02-05 15:51 - 00000000 ____D () C:\Users\Parent\AppData\Roaming\uTorrent
2014-07-30 20:47 - 2012-05-08 20:55 - 00000830 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2014-07-30 20:47 - 2010-10-17 16:57 - 00000886 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-07-30 20:46 - 2009-11-13 23:09 - 02444941 _____ () C:\windows\WindowsUpdate.log
2014-07-30 19:16 - 2013-01-19 20:11 - 00000932 _____ () C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-502250249-1756045401-4193677544-1000UA.job
2014-07-30 19:16 - 2013-01-19 20:11 - 00000910 _____ () C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-502250249-1756045401-4193677544-1000Core.job
2014-07-30 17:41 - 2010-10-17 16:57 - 00000882 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-07-30 17:29 - 2009-07-14 05:39 - 00173085 _____ () C:\windows\setupact.log
2014-07-28 20:11 - 2009-07-14 05:34 - 00014752 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-07-28 20:11 - 2009-07-14 05:34 - 00014752 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-07-28 20:06 - 2011-02-09 19:03 - 00000000 ____D () C:\Users\Parent\Tracing
2014-07-28 20:02 - 2009-07-14 05:53 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2014-07-27 22:21 - 2014-03-28 22:04 - 00000000 ____D () C:\Users\Parent\Desktop\signs
2014-07-27 22:02 - 2014-07-27 22:02 - 00000000 ____D () C:\Users\Parent\Downloads\OneDrive-2014-07-27
2014-07-27 21:35 - 2014-07-27 21:27 - 118735112 _____ () C:\Users\Parent\Downloads\OneDrive-2014-07-27.zip
2014-07-27 19:55 - 2009-07-26 21:06 - 00888478 _____ () C:\windows\system32\PerfStringBackup.INI
2014-07-27 19:17 - 2014-07-27 19:16 - 00000000 ____D () C:\Users\Parent\Downloads\VA - Extended 80s - The Definitive 12inch Collection [3CD Box Set] (2014) MP3
2014-07-27 19:13 - 2014-07-27 19:12 - 00000000 ____D () C:\Users\Parent\Downloads\The.House.Of.Magic.2013.BDRip.XviD.MP3-RARBG
2014-07-27 18:33 - 2014-07-27 18:33 - 00000000 ____D () C:\Users\Parent\Downloads\Skrillex - Recess [2014] [Mp3-256]-V3nom [GLT]
2014-07-26 20:34 - 2014-01-07 21:00 - 00000693 _____ () C:\Users\Parent\AppData\Roaming\Rim.DesktopHelper.Exception.log
2014-07-26 20:34 - 2014-01-07 21:00 - 00000693 _____ () C:\Users\Parent\AppData\Roaming\Rim.Desktop.Exception.log
2014-07-26 19:39 - 2014-07-26 19:38 - 00000000 ____D () C:\Users\Parent\Downloads\The.Expendables.3.2014.DVDSCR.Xvid-DiNGO
2014-07-26 19:31 - 2014-07-26 19:31 - 00003288 ____N () C:\bootsqm.dat
2014-07-25 09:02 - 2011-11-12 19:15 - 00000000 ____D () C:\Users\Parent\Documents\emily
2014-07-24 20:35 - 2014-07-24 20:35 - 00000000 ____D () C:\Users\Parent\AppData\Local\{C45AACE7-3EA7-4C74-A327-FB219B6B9A13}
2014-07-21 11:39 - 2014-07-18 15:50 - 00000000 ____D () C:\Users\Parent\AppData\Local\{E67F3A57-6FBD-4517-B45E-CB13A3122336}
2014-07-18 22:18 - 2014-07-18 21:53 - 00000000 ____D () C:\Users\Parent\Downloads\Ministry of Sound Tech House (2014) (320kbps) (AciDToX8)
2014-07-18 21:56 - 2013-12-08 17:17 - 00002129 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-07-18 21:52 - 2014-07-18 21:52 - 00000000 ____D () C:\Users\Parent\Downloads\Ministry Of Sound The Sound Of Deep House 2 (2014)
2014-07-18 18:27 - 2014-07-18 18:19 - 00000000 ____D () C:\Users\Parent\Downloads\The.Fault.In.Our.Stars.2014.CAM.XviD.MP3-RARBG
2014-07-18 18:10 - 2014-07-18 18:10 - 00000000 ____D () C:\Users\Parent\Downloads\The Fault In Our Stars 2014 HDCAM FIRST CAM x264 Pimp4003
2014-07-18 17:37 - 2014-07-18 17:28 - 00000000 ____D () C:\Users\Parent\Downloads\The Fault In Our Stars 2014 CAM AAC x264-SSDD
2014-07-17 15:44 - 2014-07-17 15:44 - 00000000 ____D () C:\Users\Parent\AppData\Local\{E7781484-0BED-4432-BF95-A3ED1557EAE0}
2014-07-15 21:18 - 2014-07-15 21:18 - 00000000 ____D () C:\Users\Parent\Downloads\OneDrive-2014-07-15
2014-07-15 21:16 - 2014-07-15 21:16 - 08195334 _____ () C:\Users\Parent\Downloads\OneDrive-2014-07-15.zip
2014-07-15 21:02 - 2014-07-14 08:18 - 00000000 ____D () C:\Users\Parent\AppData\Local\Adobe
2014-07-13 22:19 - 2014-07-13 22:18 - 00000000 ____D () C:\Users\Parent\Downloads\OneDrive-2014-07-13 (1)
2014-07-13 22:17 - 2014-07-13 21:48 - 401674066 _____ () C:\Users\Parent\Downloads\OneDrive-2014-07-13 (1).zip
2014-07-13 19:42 - 2014-07-13 19:42 - 00000000 ____D () C:\Users\Parent\Downloads\OneDrive-2014-07-13
2014-07-13 19:41 - 2014-07-13 19:37 - 58479947 _____ () C:\Users\Parent\Downloads\OneDrive-2014-07-13.zip
2014-07-11 15:09 - 2013-06-28 17:18 - 00001169 _____ () C:\Users\Parent\Desktop\ROBLOX Studio 2013.lnk
2014-07-11 15:09 - 2012-09-22 13:47 - 00001350 _____ () C:\Users\Parent\Desktop\ROBLOX Player.lnk
2014-07-11 15:09 - 2011-05-13 07:41 - 00000000 ____D () C:\Users\Parent\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Roblox
2014-07-10 20:49 - 2014-01-19 11:25 - 00000000 ____D () C:\Users\Parent\Desktop\Ross
2014-07-09 20:20 - 2014-07-09 20:20 - 00010051 _____ () C:\Users\Parent\Downloads\VW_CLUB_-_Czech_Republic-vector-logo-BACA5ED57B-seeklogo.com.zip
2014-07-09 20:19 - 2014-07-09 20:19 - 00009842 _____ () C:\Users\Parent\Downloads\vw-combi-lateral-vector-logo-A8591F7937-seeklogo.com.zip
2014-07-08 21:01 - 2012-05-08 20:55 - 00699056 _____ (Adobe Systems Incorporated) C:\windows\system32\FlashPlayerApp.exe
2014-07-08 21:01 - 2011-08-29 17:17 - 00071344 _____ (Adobe Systems Incorporated) C:\windows\system32\FlashPlayerCPLApp.cpl
2014-07-06 16:59 - 2010-09-09 18:31 - 00000000 ____D () C:\Users\Parent\Documents\Youcam

ZeroAccess:
C:\$Recycle.Bin\S-1-5-18\$f8f3570a16c5ccb882cb75e14ab582e2

Some content of TEMP:
====================
C:\Users\Parent\AppData\Local\Temp\AutoRun.exe
C:\Users\Parent\AppData\Local\Temp\AutoRunGUI.dll
C:\Users\Parent\AppData\Local\Temp\drm_dialogs.dll
C:\Users\Parent\AppData\Local\Temp\drm_dyndata_7400006.dll
C:\Users\Parent\AppData\Local\Temp\easetup.exe
C:\Users\Parent\AppData\Local\Temp\HitmanPro.exe
C:\Users\Parent\AppData\Local\Temp\InstallFlashPlayer.exe
C:\Users\Parent\AppData\Local\Temp\jre-7u17-windows-i586-iftw.exe
C:\Users\Parent\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe
C:\Users\Parent\AppData\Local\Temp\jre-7u51-windows-i586-iftw.exe
C:\Users\Parent\AppData\Local\Temp\jre-7u55-windows-i586-iftw.exe
C:\Users\Parent\AppData\Local\Temp\Uninstall.exe
C:\Users\Parent\AppData\Local\Temp\WCNBP_279.exe
C:\Users\Parent\AppData\Local\Temp\WMSITSS.exe

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\windows\explorer.exe => File is digitally signed
C:\windows\system32\winlogon.exe => File is digitally signed
C:\windows\system32\wininit.exe => File is digitally signed
C:\windows\system32\svchost.exe => File is digitally signed
C:\windows\system32\services.exe => File is digitally signed
C:\windows\system32\User32.dll => File is digitally signed
C:\windows\system32\userinit.exe => File is digitally signed
C:\windows\system32\rpcss.dll => File is digitally signed
C:\windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2014-07-18 19:20

==================== End Of Log ============================

 

Additional scan result of Farbar Recovery Scan Tool (x86) Version:30-07-2014
Ran by Parent at 2014-07-30 21:00:33
Running from C:\Users\Parent\Downloads
Boot Mode: Normal
==========================================================

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Microsoft Security Essentials (Disabled - Up to date) {9765EA51-0D3C-7DFB-6091-10E4E1F341F6}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Microsoft Security Essentials (Disabled - Up to date) {2C040BB5-2B06-7275-5A21-2B969A740B4B}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

 Update for Microsoft Office 2007 (KB2508958) (HKLM\...\{90120000-0012-0000-0000-0000000FF1CE}_STANDARD_{0C5823AA-7B6F-44E1-8D5B-8FD1FF0E6438}) (Version:  - Microsoft)
µTorrent (HKLM\...\uTorrent) (Version: 2.2.0 - )
3Connect (HKLM\...\{A899DA1F-D626-401C-8651-F2921E3B4CB3}) (Version: 3.0.0 - 3 Mobile Broadband)
7-Zip 9.20 (HKLM\...\7-Zip) (Version:  - )
Adobe AIR (HKLM\...\Adobe AIR) (Version: 2.7.1.19610 - Adobe Systems Incorporated)
Adobe AIR (Version: 2.7.1.19610 - Adobe Systems Incorporated) Hidden
Adobe Flash Player 14 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 14.0.0.145 - Adobe Systems Incorporated)
Adobe Photoshop CS6 (HKLM\...\{74EB3499-8B95-4B5C-96EB-7B342F3FD0C6}) (Version: 13.0 - Adobe Systems Incorporated)
Adobe Reader 9.5.1 (HKLM\...\{AC76BA86-7AD7-1033-7B44-A95000000001}) (Version: 9.5.1 - Adobe Systems Incorporated)
Adobe Shockwave Player 11.5 (HKLM\...\Adobe Shockwave Player) (Version: 11.5.6.606 - Adobe Systems, Inc.)
Apple Application Support (HKLM\...\{46F044A5-CE8B-4196-984E-5BD6525E361D}) (Version: 2.3.6 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{0592EF96-69D8-4E4B-9CC9-88F58EA86F01}) (Version: 7.0.0.117 - Apple Inc.)
Apple Software Update (HKLM\...\{C6579A65-9CAE-4B31-8B6B-3306E0630A66}) (Version: 2.1.3.127 - Apple Inc.)
Atheros Client Installation Program (HKLM\...\{D1434266-0486-4469-B338-A60082CC04E1}) (Version: 1.0.1.0805 - Atheros)
Auctonic (HKLM\...\{E1CFE7F3-A062-4904-AA05-084E5C27F499}) (Version: 1.1.36 - Auctonic)
BBC iPlayer Desktop (HKLM\...\BBCiPlayerDesktop.61DB7A798358575D6A969CCD73DDBBD723A6DA9D.1) (Version: 1.5.15695.18135 - British Broadcasting Corp.)
BBC iPlayer Desktop (Version: 1.5.15695 - British Broadcasting Corp.) Hidden
BECTA Home Access Activation Tool (HKLM\...\{9B39B512-1E22-45B6-9561-83DBFEA00A33}) (Version: 1.0.0 - Texthelp Systems)
BlackBerry Desktop Software 7.1 (HKLM\...\BlackBerry_Desktop) (Version: 7.1.0.41 - Research In Motion Ltd.)
BlackBerry Desktop Software 7.1 (Version: 7.1.0.41 - Research In Motion Ltd.) Hidden
Bonjour (HKLM\...\{79155F2B-9895-49D7-8612-D92580E0DE5B}) (Version: 3.0.0.10 - Apple Inc.)
CDBurnerXP (HKLM\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.1.4003 - CDBurnerXP)
Child Safe Solutions (HKLM\...\{A78B609F-D300-48EB-B2FC-D3DA6FB6CFC3}) (Version: 1.0.0 - Positive IT Solutions)
ConstructionSkills (HKLM\...\{5499A827-E4C8-49B8-8462-4C0E5CA976A5}) (Version: 1.00.673 - IDS)
CyberLink YouCam (HKLM\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 2.0.3304 - CyberLink Corp.)
CyberLink YouCam (Version: 2.0.3304 - CyberLink Corp.) Hidden
D3DX10 (Version: 15.4.2368.0902 - Microsoft) Hidden
DHTML Editing Component (HKLM\...\{2EA870FA-585F-4187-903D-CB9FFD21E2E0}) (Version: 6.02.0001 - Microsoft Corporation)
Doctor Who: The Adventure Games (HKLM\...\{9F73FDEF-DDC1-4307-9D96-13AB3254641A}_is1) (Version:  - British Broadcasting Corp.)
Easy Display Manager (HKLM\...\{17283B95-21A8-4996-97DA-547A48DB266F}) (Version: 3.0 - Samsung Electronics Co., Ltd.)
Easy Network Manager (HKLM\...\{B660E0D0-A8CB-45A7-96FB-93E8C915A0B2}) (Version: 4.2.4 - Samsung)
Easy SpeedUp Manager (HKLM\...\{EF367AA4-070B-493C-9575-85BE59D789C9}) (Version: 3.0.0.4 - Samsung Electronics Co.,Ltd.)
EasyBatteryManager (HKLM\...\{178EE5F4-0F86-4BF0-A0D1-9790AFF409D1}) (Version: 4.0.0.2 - Samsung)
Elecard AVC HD Editor (HKLM\...\Elecard AVC HD Editor 1.0.100705) (Version: 1.0.100705 - Elecard)
Express Accounts (HKLM\...\ExpressAccounts) (Version:  - NCH Software)
Express Invoice (HKLM\...\ExpressInvoice) (Version: 3.87 - NCH Software)
Facebook Video Calling 2.0.0.447 (HKLM\...\{8DF41A9F-FE13-43E8-A003-5F9B55A011EE}) (Version: 2.0.447 - Skype Limited)
FileZilla Client 3.6.0.2 (HKLM\...\FileZilla Client) (Version: 3.6.0.2 - FileZilla Project)
FlexiSIGN-PRO 8.1v1 (HKLM\...\{7D3678E4-02FC-45D3-AE2F-7D4B52DAF8D6}) (Version: 1.00.0000 - Scanvec Amiable)
GIMP 2.6.8 (HKLM\...\WinGimp-2.0_is1) (Version:  - )
Google Chrome (HKLM\...\Google Chrome) (Version: 36.0.1985.125 - Google Inc.)
Google Earth (HKLM\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Toolbar for Internet Explorer (HKLM\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.5111.1712 - Google Inc.)
Google Toolbar for Internet Explorer (Version: 1.0.0 - Google Inc.) Hidden
Google Update Helper (Version: 1.3.24.15 - Google Inc.) Hidden
HitmanPro 3.7 (HKLM\...\HitmanPro37) (Version: 3.7.6.201 - SurfRight B.V.)
Horizon v2.7.3.0 (HKLM\...\d4cfeebc-b821-40b7-9f81-d366b1466f03_is1) (Version: 2.7.3.0 - Daring Development Inc.)
HTC Driver Installer (HKLM\...\{6D6664A9-3342-4948-9B7E-034EFE366F0F}) (Version: 3.0.0.013 - HTC Corporation)
iCloud (HKLM\...\{20C6FF70-690B-4DF7-8F5D-269DD3A7FD23}) (Version: 3.0.2.163 - Apple Inc.)
Intel® Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version: 8.15.10.2086 - Intel Corporation)
Intel® Matrix Storage Manager (HKLM\...\{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}) (Version:  - Intel Corporation)
iTunes (HKLM\...\{C197BC08-3D82-4651-8886-E68C21578A38}) (Version: 11.1.3.8 - Apple Inc.)
Java 7 Update 55 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83217051FF}) (Version: 7.0.550 - Oracle)
Java Auto Updater (Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
Junk Mail filter update (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Malwarebytes Anti-Malware version 1.65.0.1400 (HKLM\...\Malwarebytes' Anti-Malware_is1) (Version: 1.65.0.1400 - Malwarebytes Corporation)
MatchWare MindView 3.0 Home Access (HKLM\...\{F3B899DB-B138-4698-BE99-A4271BCA47A4}) (Version: 3.0.140 - MatchWare A/S)
Microsoft .NET Framework 4.5 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50709 - Microsoft Corporation)
Microsoft .NET Framework 4.5 (Version: 4.5.50709 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6012.5000 - Microsoft Corporation) Hidden
Microsoft Expression Blend 3 (HKLM\...\Blend_3.0.1927.0) (Version: 3.0.1927.0 - Microsoft Corporation)
Microsoft Expression Blend 3 (Version: 3.0.1927.0 - Microsoft Corporation) Hidden
Microsoft Expression Blend 3 SDK (HKLM\...\{0E837AF0-4C92-4077-83F0-D022073F17C0}) (Version: 1.0.1327.0 - Microsoft Corporation)
Microsoft Expression Design 3 (HKLM\...\Design_6.0.1739.0) (Version: 6.0.1739.0 - Microsoft Corporation)
Microsoft Expression Design 3 (Version: 6.0.1739.0 - Microsoft Corporation) Hidden
Microsoft Expression Encoder 3 (HKLM\...\Encoder_3.0.1332.0) (Version: 3.0.1332.0 - Microsoft Corporation)
Microsoft Expression Encoder 3 (Version: 3.0.1332.0 - Microsoft Corporation) Hidden
Microsoft Expression Studio 3 (HKLM\...\ExpressionStudio_3.0.1061.0) (Version: 3.0.1061.0 - Microsoft Corporation)
Microsoft Expression Studio 3 (Version: 3.0.1061.0 - Microsoft Corporation) Hidden
Microsoft Expression Web 3 (HKLM\...\Web_3.0.3813.0) (Version: 3.0.3813.0 - Microsoft Corporation)
Microsoft Expression Web 3 (Version: 3.0.3813.0 - Microsoft Corporation) Hidden
Microsoft Expression Web 3 SP1 (HKLM\...\{752E90AC-3F11-4EA3-88EA-96441047EC31}) (Version:  - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM\...\{90120000-0012-0000-0000-0000000FF1CE}_STANDARD_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (Version:  - Microsoft) Hidden
Microsoft Office Excel MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office File Validation Add-In (HKLM\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Live Add-in 1.4 (HKLM\...\{AE3CF174-872C-46C6-B9F6-C0593F3BC7B8}) (Version: 2.0.3008.0 - Microsoft Corporation)
Microsoft Office Outlook MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Spanish) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (English) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (Version:  - Microsoft) Hidden
Microsoft Office Shared MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared Setup Metadata MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Standard 2007 (HKLM\...\STANDARD) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Standard 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Security Client (Version: 4.0.1526.0 - Microsoft Corporation) Hidden
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.0.1526.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 4.1.10329.0 - Microsoft Corporation)
Microsoft Silverlight 3 SDK (HKLM\...\{2012098D-EEE9-4769-8DD3-B038050854D4}) (Version: 3.0.40624.0 - Microsoft Corporation)
Microsoft SkyDrive (HKCU\...\SkyDriveSetup.exe) (Version: 17.0.2015.0811 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft SQL Server 2008 (HKLM\...\Microsoft SQL Server 10 Release) (Version:  - Microsoft Corporation)
Microsoft SQL Server 2008 (Version:  - Microsoft Corporation) Hidden
Microsoft SQL Server 2008 Browser (HKLM\...\{C688457E-03FD-4941-923B-A27F4D42A7DD}) (Version: 10.1.2531.0 - Microsoft Corporation)
Microsoft SQL Server 2008 Common Files (Version: 10.0.1600.22 - Microsoft Corporation) Hidden
Microsoft SQL Server 2008 Common Files (Version: 10.1.2531.0 - Microsoft Corporation) Hidden
Microsoft SQL Server 2008 Database Engine Services (Version: 10.1.2531.0 - Microsoft Corporation) Hidden
Microsoft SQL Server 2008 Database Engine Shared (Version: 10.1.2531.0 - Microsoft Corporation) Hidden
Microsoft SQL Server 2008 Management Objects (HKLM\...\{F5E87B12-3C27-452F-8E78-21D42164FD83}) (Version: 10.0.1600.22 - Microsoft Corporation)
Microsoft SQL Server 2008 Native Client (HKLM\...\{4F44B5AE-82A6-4A8A-A3E3-E24D489728E3}) (Version: 10.1.2531.0 - Microsoft Corporation)
Microsoft SQL Server 2008 RsFx Driver (Version: 10.1.2531.0 - Microsoft Corporation) Hidden
Microsoft SQL Server 2008 Setup Support Files  (HKLM\...\{BA4DA261-CB60-4690-B202-44998DFC6986}) (Version: 10.1.2531.0 - Microsoft Corporation)
Microsoft SQL Server Compact 3.5 SP1 Design Tools English (HKLM\...\{0C19D563-5F25-4621-BF10-01F741BD283F}) (Version: 3.5.5692.0 - Microsoft Corporation)
Microsoft SQL Server Compact 3.5 SP1 English (HKLM\...\{E59113EB-0285-4BFD-A37A-B79EAC6B8F4B}) (Version: 3.5.5692.0 - Microsoft Corporation)
Microsoft SQL Server VSS Writer (HKLM\...\{B857D868-F8B0-43EE-BC2B-D9E5ED21F237}) (Version: 10.1.2531.0 - Microsoft Corporation)
Microsoft Visual Basic 2008 Express Edition with SP1 - ENU (HKLM\...\Microsoft Visual Basic 2008 Express Edition with SP1 - ENU) (Version:  - Microsoft Corporation)
Microsoft Visual Basic 2008 Express Edition with SP1 - ENU (Version: 9.0.30729 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (HKLM\...\{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM\...\{3C3D696B-0DB7-3C6D-A356-3DB8CE541918}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Windows SDK for Visual Studio 2008 SP1 Express Tools for .NET Framework - enu (HKLM\...\{5BE1E709-30E4-3D6D-A708-96CE8D5E5E8D}) (Version: 3.5.30729 - Microsoft Corporation)
Microsoft Windows SDK for Visual Studio 2008 SP1 Express Tools for Win32 (HKLM\...\{044F9133-B8D7-4d11-BF39-803FA20F5C8B}) (Version: 6.1.5295.17011 - Microsoft Corporation)
Microsoft_VC80_CRT_x86 (Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC90_CRT_x86 (Version: 1.00.0000 - Adobe) Hidden
Minecraft1.6.4 (HKLM\...\Minecraft1.6.4) (Version:  - )
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 17.0.8 - Mozilla)
Mozilla Thunderbird 17.0.8 (x86 en-GB) (HKLM\...\Mozilla Thunderbird 17.0.8 (x86 en-GB)) (Version: 17.0.8 - Mozilla)
MSVCRT (Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT Redists (Version: 1.0 - Sony Creative Software Inc.) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (HKLM\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2721691) (HKLM\...\{355B5AC0-CEEE-42C5-AD4D-7F3CFD806C36}) (Version: 4.30.2114.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB973685) (HKLM\...\{859DFA95-E4A6-48CD-B88E-A3E483E89B44}) (Version: 4.30.2107.0 - Microsoft Corporation)
Nessy Fingers - Demo Version (HKLM\...\{849343A6-A739-40A2-A85B-7C178E460DE7}) (Version: 1.0.0 - Net Educational Systems © 2007)
Notepad++ (HKLM\...\Notepad++) (Version: 6.1.1 - )
Octodad (HKLM\...\Octodad) (Version:  - )
OGA Notifier 2.0.0048.0 (Version: 2.0.0048.0 - Microsoft Corporation) Hidden
PDF Settings CS6 (Version: 11.0 - Adobe Systems Incorporated) Hidden
Picasa 3 (HKLM\...\Picasa 3) (Version: 3.6 - Google, Inc.)
Positive IT Solutions Online Support (HKLM\...\{7E117A6A-8579-4435-8290-4089C1C5BEFA}) (Version: 5.2.142 - LogMeIn, Inc.)
QuickTime (HKLM\...\{7BE15435-2D3E-4B58-867F-9C75BED0208C}) (Version: 7.71.80.42 - Apple Inc.)
Rapport (Version: 3.5.1304.66 - Trusteer) Hidden
Razer Game Booster (HKLM\...\Razer Game Booster_is1) (Version: 4.1.59.0 - Razer Inc.)
Read And Write Home Access (HKLM\...\{2775D83C-A85F-4CC2-84A1-FC5E63F682BB}) (Version: 9.0.1 - Texthelp Systems)
Realtek Ethernet Controller  Driver (HKLM\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 1.00.0008 - Realtek)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5948 - Realtek Semiconductor Corp.)
ROBLOX Player for Parent (HKCU\...\{373B1718-8CC5-4567-8EE2-9033AD08A680}) (Version:  - ROBLOX Corporation)
ROBLOX Studio 2013 for Parent (HKCU\...\{2922D6F1-2865-4EFA-97A9-94EEAB3AFA14}) (Version:  - ROBLOX Corporation)
Samsung Recovery Solution 4 (HKLM\...\{145DE957-0679-4A2A-BB5C-1D3E9808FAB2}) (Version: 4.0.0.4 - Samsung)
Samsung Support Center (HKLM\...\{4D2121FE-5CCC-4D47-B3A0-BF56045A5099}) (Version: 1.0.1 - Samsung)
SAMSUNG Video Codec 1.2.5006 (HKLM\...\{2F6DCED3-ABEC-4986-9DA4-D27C7C25C38A}) (Version: 1.2.5006 - SAMSUNG)
SamsungMovie (HKLM\...\{EFA6EF6A-9E0D-4CF0-91DD-B55D8632F65A}) (Version: 1.0.0 - Samsung)
Scratch (HKLM\...\Scratch) (Version: 1.4.0.0 - MIT Media Lab Lifelong Kindergarten Group)
Service Pack 1 for SQL Server 2008 (KB968369) (HKLM\...\KB968369) (Version: 10.1.2531.0 - Microsoft Corporation)
SignCut (remove only) (HKLM\...\SignCut) (Version:  - )
SmartFTP Client (HKLM\...\{8B0E66E5-3594-468E-93B0-7C7BC866761F}) (Version: 4.0.1241.0 - SmartSoft Ltd.)
SmartFTP Client 4.0 Setup Files (remove only) (HKLM\...\SmartFTP Client 4.0 Setup Files) (Version: 4.0 - SmartSoft Ltd)
SpyHunter (HKLM\...\{ADAFC0B4-FC15-45D9-BAB3-BC7A8829D0C4}) (Version: 4.10.5.4085 - Enigma Software Group USA, LLC)
Sql Server Customer Experience Improvement Program (Version: 10.1.2531.0 - Microsoft Corporation) Hidden
SQL Server System CLR Types (HKLM\...\{342D4AD7-EC4C-4EC8-AEA6-E70F5905A490}) (Version: 10.1.2531.0 - Microsoft Corporation)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 14.0.10.0 - Synaptics Incorporated)
The Sims 2 Family Fun Stuff (HKLM\...\{6BDD9CE6-D0A6-478A-BAD3-BA6945E89EB0}) (Version:  - )
The Sims 2 Glamour Life Stuff (HKLM\...\{9CDBC303-3EED-40b0-8E41-A7C65AA96C26}) (Version:  - )
The Sims™ 2 (HKLM\...\{2C82E097-694E-44ea-A947-2750679469CF}) (Version:  - Electronic Arts)
The Sims™ 2 H&M® Fashion Stuff (HKLM\...\{84DDE556-43EF-43ed-B2DF-37AF9E5DDD75}) (Version:  - )
The Sims™ 2 Seasons (HKLM\...\{DFEF49D9-FC95-4301-99B9-2FB91C6ABA06}) (Version:  - )
The Sims™ 2 Teen Style Stuff (HKLM\...\{5C648FDB-0138-4619-B66E-230EF53E8E2C}) (Version:  - Electronic Arts)
Trusteer Endpoint Protection (HKLM\...\Rapport_msi) (Version: 3.5.1304.66 - Trusteer)
Turbo Lister 2 (HKLM\...\{8927E07C-97F7-4A54-88FB-D976F50DD46E}) (Version: 2.00.0000 - eBay Inc.)
Unity Web Player (HKCU\...\UnityWebPlayer) (Version:  - Unity Technologies ApS)
Update for 2007 Microsoft Office System (KB967642) (HKLM\...\{90120000-0012-0000-0000-0000000FF1CE}_STANDARD_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
Update for Microsoft Office 2007 Help for Common Features (KB963673) (HKLM\...\{90120000-006E-0409-0000-0000000FF1CE}_STANDARD_{AB365889-0395-4FAD-B702-CA5985D53D42}) (Version:  - Microsoft)
Update for Microsoft Office Excel 2007 Help (KB963678) (HKLM\...\{90120000-0016-0409-0000-0000000FF1CE}_STANDARD_{199DF7B6-169C-448C-B511-1054101BE9C9}) (Version:  - Microsoft)
Update for Microsoft Office Outlook 2007 (KB2596598) 32-Bit Edition (HKLM\...\{90120000-0012-0000-0000-0000000FF1CE}_STANDARD_{8B689F89-5E1C-4DA9-B2B1-7B3843275596}) (Version:  - Microsoft)
Update for Microsoft Office Outlook 2007 (KB2596598) 32-Bit Edition (HKLM\...\{90120000-001A-0409-0000-0000000FF1CE}_STANDARD_{8F32B14E-F85E-482C-BF8C-C04E1A5ADE4F}) (Version:  - Microsoft)
Update for Microsoft Office Outlook 2007 Help (KB963677) (HKLM\...\{90120000-001A-0409-0000-0000000FF1CE}_STANDARD_{0451F231-E3E3-4943-AB9F-58EB96171784}) (Version:  - Microsoft)
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2687407) 32-Bit Edition (HKLM\...\{90120000-0012-0000-0000-0000000FF1CE}_STANDARD_{BBE715CA-02FD-4C5A-90BB-440A967DF05E}) (Version:  - Microsoft)
Update for Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM\...\{90120000-0018-0409-0000-0000000FF1CE}_STANDARD_{397B1D4F-ED7B-4ACA-A637-43B670843876}) (Version:  - Microsoft)
Update for Microsoft Office Script Editor Help (KB963671) (HKLM\...\{90120000-006E-0409-0000-0000000FF1CE}_STANDARD_{CD11C6A2-FFC6-4271-8EAB-79C3582F505C}) (Version:  - Microsoft)
Update for Microsoft Office Word 2007 Help (KB963665) (HKLM\...\{90120000-001B-0409-0000-0000000FF1CE}_STANDARD_{80E762AA-C921-4839-9D7D-DB62A72C0726}) (Version:  - Microsoft)
User Guide (HKLM\...\{BAE68339-B0F6-4D33-9554-5A3DB2DFF5DA}) (Version: 1.0 - )
Vegas Movie Studio HD  11.0 (HKLM\...\{EF5F161E-9904-11E0-AAE2-0013D3D69929}) (Version: 11.0.29 - Sony)
VLC media player 1.1.11 (HKLM\...\VLC media player) (Version: 1.1.11 - VideoLAN)
Waldo (HKLM\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-118465353}) (Version:  - Oberon Media)
WinAVI Video Converter (HKLM\...\WinAVI Video Converter) (Version: 11.0.0.3995 - ZJMedia Digital Technology Ltd.)
Windows Live Communications Platform (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM\...\WinLiveSuite) (Version: 15.4.3555.0308 - Microsoft Corporation)
Windows Live Essentials (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Family Safety (Version: 15.4.3555.0308 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4232.0 - Microsoft Corporation) Hidden
Windows Live Installer (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mail (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Messenger (Version: 15.4.3538.0513 - Microsoft Corporation) Hidden
Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Movie Maker (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Common (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Gallery (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live SOXE (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Sync (HKLM\...\{84EBDF39-4B33-49D7-A0BD-EB6E2C4E81C1}) (Version: 14.0.8089.726 - Microsoft Corporation)
Windows Live UX Platform (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Writer (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Writer Resources (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Phone app for desktop (HKLM\...\{E786AE85-8A30-4CF2-BF70-57404A5CD684}) (Version: 1.0.1720.1 - Microsoft Corporation)
WinRAR 4.00 (32-bit) (HKLM\...\WinRAR archiver) (Version: 4.00.0 - win.rar GmbH)
WPF Toolkit June 2009 (Version 3.5.40619.1) (HKLM\...\{5EE6E987-1B79-4A93-832B-27472C7D1579}) (Version: 3.5.40619.1 - Microsoft Corporation)
ZTE_1.2059.0.8 (HKLM\...\ZTE_1.2059.0.8) (Version:  - )

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-502250249-1756045401-4193677544-1000_Classes\CLSID\{1FD1FE74-9E3C-4C1C-AEEB-AAB592AD770F}\localserver32 -> C:\Users\Parent\AppData\Local\Facebook\Update\FacebookUpdate.exe (Facebook Inc.)
CustomCLSID: HKU\S-1-5-21-502250249-1756045401-4193677544-1000_Classes\CLSID\{444785F1-DE89-4295-863A-D46C3A781394}\InprocServer32 -> C:\Users\Parent\AppData\LocalLow\Unity\WebPlayer\loader\UnityWebPluginAX.ocx (Unity Technologies ApS)
CustomCLSID: HKU\S-1-5-21-502250249-1756045401-4193677544-1000_Classes\CLSID\{5E71E4F3-E8C7-4906-9626-973E418762B6}\InprocServer32 -> C:\Users\Parent\AppData\Local\Facebook\Update\1.2.205.0\goopdate.dll (Facebook Inc.)
CustomCLSID: HKU\S-1-5-21-502250249-1756045401-4193677544-1000_Classes\CLSID\{76D50904-6780-4c8b-8986-1A7EE0B1716D}\InprocServer32 -> C:\Users\Parent\AppData\Local\Roblox\Versions\version-1112937d32504d8c\RobloxProxy.dll (ROBLOX Corporation)
CustomCLSID: HKU\S-1-5-21-502250249-1756045401-4193677544-1000_Classes\CLSID\{7B37E4E2-C62F-4914-9620-8FB5062718CC}\localserver32 -> C:\Users\Parent\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-502250249-1756045401-4193677544-1000_Classes\CLSID\{82E5DF24-51E8-47CD-864A-F4BD5005AA73}\InprocServer32 -> C:\Users\Parent\AppData\Local\Microsoft\Internet Explorer\Downloaded Program Files\iCloud.ocx (Apple Inc.)
CustomCLSID: HKU\S-1-5-21-502250249-1756045401-4193677544-1000_Classes\CLSID\{8B9F5BF4-0407-4BB2-9FED-4C0372DABD00}\localserver32 -> C:\Users\Parent\AppData\Local\Facebook\Video\Skype\FacebookVideoCallingProxy.exe (Skype Limited)
CustomCLSID: HKU\S-1-5-21-502250249-1756045401-4193677544-1000_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32 -> C:\Users\Parent\AppData\Local\Microsoft\SkyDrive\17.0.2015.0811\SkyDriveShell.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-502250249-1756045401-4193677544-1000_Classes\CLSID\{AB807329-7324-431B-8B36-DBD581F56E0B}\localserver32 -> C:\Users\Parent\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-502250249-1756045401-4193677544-1000_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32 -> C:\Users\Parent\AppData\Local\Microsoft\SkyDrive\17.0.2015.0811\SkyDriveShell.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-502250249-1756045401-4193677544-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0051-ABCDEFFEDCBA}\InprocServer32 -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
CustomCLSID: HKU\S-1-5-21-502250249-1756045401-4193677544-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0051-ABCDEFFEDCBB}\InprocServer32 -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
CustomCLSID: HKU\S-1-5-21-502250249-1756045401-4193677544-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0051-ABCDEFFEDCBC}\InprocServer32 -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
CustomCLSID: HKU\S-1-5-21-502250249-1756045401-4193677544-1000_Classes\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32 -> C:\Users\Parent\AppData\Local\Microsoft\SkyDrive\17.0.2015.0811\SkyDriveShell.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-502250249-1756045401-4193677544-1000_Classes\CLSID\{CBE9C57E-FFA9-4123-8354-AD360D6DD3CC}\InprocServer32 -> C:\Users\Parent\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
CustomCLSID: HKU\S-1-5-21-502250249-1756045401-4193677544-1000_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 -> C:\Users\Parent\AppData\Local\Microsoft\SkyDrive\17.0.2015.0811\SkyDriveShell.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-502250249-1756045401-4193677544-1000_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\Parent\AppData\Local\Microsoft\SkyDrive\17.0.2015.0811\FileSyncApi.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-502250249-1756045401-4193677544-1000_Classes\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32 -> C:\windows\system32\shell32.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-502250249-1756045401-4193677544-1000_Classes\CLSID\{FE0D8F60-5A07-40a1-85EC-4FFB7E0F2306}\localserver32 -> C:\Users\Parent\AppData\Local\Roblox\Versions\version-21cdb2fff9fb4df2\RobloxApp.exe (ROBLOX Corporation)

==================== Restore Points  =========================

22-07-2014 17:12:39 Scheduled Checkpoint

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:04 - 2009-06-10 22:39 - 00000824 ____N C:\windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {0C037336-922F-415D-9FC5-EEA128F30D58} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-502250249-1756045401-4193677544-1000UA => C:\Users\Parent\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-01-19] (Facebook Inc.)
Task: {1129C3B5-E612-4A8F-B5F4-3471C2B0BE55} - System32\Tasks\EasySpeedUpManager => C:\Program Files\SAMSUNG\EasySpeedUpManager\EasySpeedUpManager.exe [2009-08-23] (Samsung Electronics Co., Ltd.)
Task: {2889E4F8-1011-4879-91CC-7784E240F58A} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2010-10-17] (Google Inc.)
Task: {4A9C4A98-D921-4B35-AAE4-31BBBE10ABE3} - System32\Tasks\SpyHunter4Startup => C:\Program Files\Enigma Software Group\SpyHunter\Spyhunter4.exe [2012-08-21] (Enigma Software Group USA, LLC.)
Task: {6E364C8B-5AA6-441E-ABAC-C8872C6B7108} - System32\Tasks\EasyBatteryManager => C:\Program Files\Samsung\EasyBatteryManager\EasyBatteryMgr4.exe [2009-08-01] (SAMSUNG Electronics co., LTD.)
Task: {6F37B217-4E46-489E-BEDE-B0E98C6EBE83} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {9553652B-537C-4722-9021-1DF14765791C} - System32\Tasks\Adobe Flash Player Updater => C:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-07-08] (Adobe Systems Incorporated)
Task: {9BC4757A-4FD7-4E5D-A2A3-89BEF7957083} - System32\Tasks\Launch HTC Sync Loader => C:\Program Files\HTC\HTC Sync 3.0\htcUPCTLoader.exe
Task: {9F9213EC-D680-4EC6-80A9-7DDDBD6BEECD} - System32\Tasks\advSRS4 => C:\Program Files\Samsung\Samsung Recovery Solution 4\WCScheduler.exe [2009-10-07] (SEC)
Task: {C0043620-FE59-40AE-97B9-09CA0E2BFFEE} - System32\Tasks\SamsungSupportCenter => C:\Program Files\Samsung\Samsung Support Center\SSCKbdHk.exe [2009-09-07] (SAMSUNG Electronics)
Task: {CC0FC958-7160-4B95-893F-5817CD340782} - System32\Tasks\SUPBackground => C:\Program Files\Samsung\Samsung Update Plus\SUPBackground.exe
Task: {DBC143F8-F93B-4934-843F-032FEEDD4020} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2010-10-17] (Google Inc.)
Task: {DE3E0974-D3C8-44FC-81D7-9FC510634D7C} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-502250249-1756045401-4193677544-1000Core => C:\Users\Parent\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-01-19] (Facebook Inc.)
Task: {EA20BE70-5970-4369-A178-C2B66A793321} - System32\Tasks\EasyDisplayMgr => C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe [2009-09-08] (Samsung Electronics Co., Ltd.)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-502250249-1756045401-4193677544-1000Core.job => C:\Users\Parent\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-502250249-1756045401-4193677544-1000UA.job => C:\Users\Parent\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2011-06-24 22:56 - 2011-06-24 22:56 - 00087328 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2011-06-24 22:56 - 2011-06-24 22:56 - 01241888 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2010-05-11 19:07 - 2010-01-28 13:47 - 01737464 _____ () C:\Program Files\3 Mobile Broadband\3Connect\BecHelperService.exe
2014-04-19 09:54 - 2014-04-19 09:53 - 00160768 _____ () C:\windows\Installer\{31A46D32-02E0-92BD-019D-738FE175B643}\syshost.exe
2014-04-19 08:40 - 2014-04-19 08:40 - 00797184 _____ () C:\Users\Parent\AppData\Local\Ijnmsoft\SQLMON.DLL
2012-11-29 22:59 - 2012-11-29 22:59 - 00093696 _____ () C:\Program Files\FileZilla FTP Client\fzshellext.dll
2009-11-13 06:19 - 2006-08-12 04:48 - 00049152 _____ () C:\Program Files\Samsung\Easy Display Manager\HookDllPS2.dll
2009-07-13 22:03 - 2009-07-14 02:15 - 00364544 _____ () C:\Windows\system32\msjetoledb40.dll
2013-09-14 02:51 - 2013-09-14 02:51 - 00087952 _____ () C:\Program Files\Common Files\Apple\Internet Services\zlib1.dll
2013-09-14 02:50 - 2013-09-14 02:50 - 01242952 _____ () C:\Program Files\Common Files\Apple\Internet Services\libxml2.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\ProgramData\Temp:D82A9FCF

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcmscsvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MCODS => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MpfService => ""="Service"

==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)

==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

==================== Faulty Device Manager Devices =============

==================== Event log errors: =========================

Application errors:
==================
Error: (07/30/2014 08:51:23 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program iexplore.exe version 9.0.8112.16450 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

Process ID: 35ac

Start Time: 01cfac2000ddc68d

Termination Time: 638

Application Path: C:\Program Files\Internet Explorer\iexplore.exe

Report Id: d419bba3-1822-11e4-8ab9-0626b6c8292f

Error: (07/30/2014 08:45:49 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 1259927

Error: (07/30/2014 08:45:49 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 1259927

Error: (07/30/2014 08:45:49 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (07/30/2014 08:25:17 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 28377

Error: (07/30/2014 08:25:17 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 28377

Error: (07/30/2014 08:25:17 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (07/30/2014 08:25:16 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 27098

Error: (07/30/2014 08:25:16 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 27098

Error: (07/30/2014 08:25:16 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

System errors:
=============
Error: (07/29/2014 08:00:36 AM) (Source: DCOM) (EventID: 10010) (User: )
Description: {078AEF33-C48A-49F7-AFF3-A0EE810BFE7C}

Error: (07/28/2014 08:02:32 PM) (Source: Service Control Manager) (EventID: 7003) (User: )
Description: The IPsec Policy Agent service depends the following service: BFE. This service might not be installed.

Error: (07/28/2014 08:02:32 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Par1284 service failed to start due to the following error:
%%20

Error: (07/28/2014 08:02:29 PM) (Source: Service Control Manager) (EventID: 7003) (User: )
Description: The IKE and AuthIP IPsec Keying Modules service depends the following service: BFE. This service might not be installed.

Error: (07/28/2014 08:02:28 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: The Computer Browser service terminated with the following error:
%%1060

Error: (07/28/2014 08:02:25 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: The previous system shutdown at 20:00:47 on ‎28/‎07/‎2014 was unexpected.

Error: (07/28/2014 07:44:15 PM) (Source: DCOM) (EventID: 10000) (User: )
Description: C:\windows\system32\wbem\wmiprvse.exe -Embedding5{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}

Error: (07/26/2014 07:32:08 PM) (Source: Service Control Manager) (EventID: 7003) (User: )
Description: The IPsec Policy Agent service depends the following service: BFE. This service might not be installed.

Error: (07/26/2014 07:32:08 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Par1284 service failed to start due to the following error:
%%20

Error: (07/26/2014 07:32:08 PM) (Source: Service Control Manager) (EventID: 7003) (User: )
Description: The IKE and AuthIP IPsec Keying Modules service depends the following service: BFE. This service might not be installed.

Microsoft Office Sessions:
=========================

==================== Memory info ===========================

Percentage of memory in use: 40%
Total physical RAM: 2008.61 MB
Available physical RAM: 1200.29 MB
Total Pagefile: 4017.22 MB
Available Pagefile: 1639.7 MB
Total Virtual: 2047.88 MB
Available Virtual: 1884.75 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:133.96 GB) (Free:6.78 GB) NTFS
Drive e: (Sims2_EP5_1) (CDROM) (Total:0.71 GB) (Free:0 GB) UDF

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 149 GB) (Disk ID: 5EB34F41)
Partition 1: (Not Active) - (Size=15 GB) - (Type=27)
Partition 2: (Active) - (Size=95 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=134 GB) - (Type=07 NTFS)

==================== End Of Log ============================

 

 

 

Hopefully someone can help me , thanks

Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted

Welcome to the forum. (Do what you can)

General P2P/Piracy Warning:

 

1. If you're using Peer 2 Peer software such uTorrent, BitTorrent or similar you must either fully uninstall it or completely disable it from running while being assisted here.

2. If you have illegal/cracked software (MS Office, Adobe Products), cracks, keygens, custom (Adobe) host file, etc. on the system, please remove or uninstall them now and read the policy on Piracy.

Failure to remove such software will result in your topic being closed and no further assistance being provided.

Please run a Quick Scan with Malwarebytes

For Malwarebytes ver: 1.75

Open up Malwarebytes > Settings Tab > Scanner Settings > Under action for PUP > Select: Show in Results List and Check for removal.

Please Update and run a Quick Scan with Malwarebytes Anti-Malware, post the report.

Make sure that everything is checked, and click Remove Selected.

For Malwarebytes 2.0, please run a Threat Scan

Click on Settings > Detection and Protection > Non-Malware Protection > PUP (Potentially Unwanted Program) detections > Make sure it's set to Treat detections as malware

Same for PUM (Potentially Unwanted Modifications)

Quarantine all that's found

Then.......

Please download and run RogueKiller 32 bit to your desktop.

RogueKiller<---use this one for 64 bit systems

Which system am I using?

Quit all running programs.

For Windows XP, double-click to start.

For Vista or Windows 7-8, do a right-click on the program, select Run as Administrator to start, & when prompted Allow to run.

Wait for the Prescan to finish

Click Scan to scan the system.

When the scan completes > Don't Fix anything! > Click on the Report Button and post the Report back here.

Don't run any other options, they're not all bad!!!!!!!

RogueKiller logs will also be located here:

%programdata%/RogueKiller/Logs <-------W7

C:\Documents and Settings\All Users\Application Data\RogueKiller\Logs <-------XP

(please don't put logs in code or quotes and use the default font)

MrC

Note:

Please read all of my instructions completely including these.

Make sure system restore is turned on and running. Create a new restore point

Make sure you're subscribed to this topic: Click on the Follow This Topic Button (at the top right of this page), make sure that the Receive notification box is checked and that it is set to Instantly

Removing malware can be unpredictable...unlikely but things can go very wrong! Backup any files that cannot be replaced. You can copy them to a CD/DVD, external drive or a pen drive

<+>Please don't run any other scans, download, install or uninstall any programs while I'm working with you.

<+>The removal of malware isn't instantaneous, please be patient.

<+>When we are done, I'll give to instructions on how to cleanup all the tools and logs

<+>Please stick with me until I give you the "all clear" and Please don't waste my time by leaving before that.

------->Your topic will be closed if you haven't replied within 3 days!<--------

If I don't respond within 24 hours, please send me a PM

Link to post
Share on other sites
rossco

rossco

Posted
  • Author
Posted

Thanks for your help, here is the report

 

RogueKiller V9.2.4.0 [Jul 11 2014] by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Website : http://www.adlice.com/softwares/roguekiller/
Blog : http://www.adlice.com

Operating System : Windows 7 (6.1.7601 Service Pack 1) 32 bits version
Started in : Normal mode
User : Parent [Admin rights]
Mode : Scan -- Date : 07/31/2014  22:35:51

¤¤¤ Bad processes : 1 ¤¤¤
[suspicious.Path] explorer.exe -- C:\Users\Parent\AppData\Local\Ijnmsoft\SQLMON.DLL[-] -> UNLOADED

¤¤¤ Registry Entries : 10 ¤¤¤
[suspicious.Path] HKEY_USERS\S-1-5-21-502250249-1756045401-4193677544-1000\Software\Microsoft\Windows\CurrentVersion\Run | Ijnmsoft : regsvr32.exe C:\Users\Parent\AppData\Local\Ijnmsoft\SQLMON.DLL  -> FOUND
[PUM.Dns] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{648DAEC7-293D-4C5A-9C9B-D129E8B1AB10} | DhcpNameServer : 172.20.10.1  -> FOUND
[PUM.Dns] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{FF0EB4DB-AF8C-484B-A843-8ADA9FE73C5A} | DhcpNameServer : 172.30.139.17 172.31.139.17  -> FOUND
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{648DAEC7-293D-4C5A-9C9B-D129E8B1AB10} | DhcpNameServer : 172.20.10.1  -> FOUND
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{FF0EB4DB-AF8C-484B-A843-8ADA9FE73C5A} | DhcpNameServer : 172.30.139.17 172.31.139.17  -> FOUND
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Tcpip\Parameters\Interfaces\{648DAEC7-293D-4C5A-9C9B-D129E8B1AB10} | DhcpNameServer : 172.20.10.1  -> FOUND
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Tcpip\Parameters\Interfaces\{FF0EB4DB-AF8C-484B-A843-8ADA9FE73C5A} | DhcpNameServer : 172.30.139.17 172.31.139.17  -> FOUND
[PUM.StartMenu] HKEY_USERS\S-1-5-21-502250249-1756045401-4193677544-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowMyGames : 0  -> FOUND
[PUM.DesktopIcons] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1  -> FOUND
[PUM.DesktopIcons] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1  -> FOUND

¤¤¤ Scheduled tasks : 0 ¤¤¤

¤¤¤ Files : 4 ¤¤¤
[suspicious.Startup][File] EPUHelp.exe -- C:\Users\Parent\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EPUHelp.exe -> FOUND
[ZeroAccess][File] @ -- C:\$Recycle.Bin\S-1-5-18\$f8f3570a16c5ccb882cb75e14ab582e2\@ -> FOUND
[ZeroAccess][Folder] L -- C:\$Recycle.Bin\S-1-5-18\$f8f3570a16c5ccb882cb75e14ab582e2\L -> FOUND
[ZeroAccess][Folder] U -- C:\$Recycle.Bin\S-1-5-18\$f8f3570a16c5ccb882cb75e14ab582e2\U -> FOUND

¤¤¤ HOSTS File : 0 ¤¤¤

¤¤¤ Antirootkit : 17 (Driver: LOADED) ¤¤¤
[sSDT:Addr(Hook.SSDT)] NtWriteVirtualMemory[399] : C:\ProgramData\Trusteer\Rapport\store\exts\RapportCerberus\baseline\RapportCerberus32_59849.sys @ 0x91948480
[EAT:Addr] (iexplore.exe) samcli.dll - begin_fnhook_chelper_hooking : c:\program files\trusteer\rapport\bin\rooksdol.dll @ 0x7423a710
[EAT:Addr] (iexplore.exe) samcli.dll - end_fnhook_chelper_hooking : c:\program files\trusteer\rapport\bin\rooksdol.dll @ 0x7423a730
[EAT:Addr] (iexplore.exe) samcli.dll - on_construct_sink : c:\program files\trusteer\rapport\bin\rooksdol.dll @ 0x7423c8b0
[EAT:Addr] (iexplore.exe) samcli.dll - on_resolve_sink : c:\program files\trusteer\rapport\bin\rooksdol.dll @ 0x7423c890
[EAT:Addr] (iexplore.exe) samcli.dll - rooks_ext_get_rooks_extension : c:\program files\trusteer\rapport\bin\rooksdol.dll @ 0x742360c0
[EAT:Addr] (iexplore.exe) samcli.dll - rooksdol_fnhook_chelper_hook : c:\program files\trusteer\rapport\bin\rooksdol.dll @ 0x7423b230
[EAT:Addr] (iexplore.exe) samcli.dll - rooksdol_fnhook_chelper_phook : c:\program files\trusteer\rapport\bin\rooksdol.dll @ 0x7423b250
[EAT:Addr] (iexplore.exe) samcli.dll - rooksdol_fnhook_chelper_unhook : c:\program files\trusteer\rapport\bin\rooksdol.dll @ 0x7423b280
[EAT:Addr] (iexplore.exe) samcli.dll - begin_fnhook_chelper_hooking : c:\program files\trusteer\rapport\bin\rooksdol.dll @ 0x7423a710
[EAT:Addr] (iexplore.exe) samcli.dll - end_fnhook_chelper_hooking : c:\program files\trusteer\rapport\bin\rooksdol.dll @ 0x7423a730
[EAT:Addr] (iexplore.exe) samcli.dll - on_construct_sink : c:\program files\trusteer\rapport\bin\rooksdol.dll @ 0x7423c8b0
[EAT:Addr] (iexplore.exe) samcli.dll - on_resolve_sink : c:\program files\trusteer\rapport\bin\rooksdol.dll @ 0x7423c890
[EAT:Addr] (iexplore.exe) samcli.dll - rooks_ext_get_rooks_extension : c:\program files\trusteer\rapport\bin\rooksdol.dll @ 0x742360c0
[EAT:Addr] (iexplore.exe) samcli.dll - rooksdol_fnhook_chelper_hook : c:\program files\trusteer\rapport\bin\rooksdol.dll @ 0x7423b230
[EAT:Addr] (iexplore.exe) samcli.dll - rooksdol_fnhook_chelper_phook : c:\program files\trusteer\rapport\bin\rooksdol.dll @ 0x7423b250
[EAT:Addr] (iexplore.exe) samcli.dll - rooksdol_fnhook_chelper_unhook : c:\program files\trusteer\rapport\bin\rooksdol.dll @ 0x7423b280

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ MBR Check : ¤¤¤
+++++ PhysicalDrive0: SAMSUNG HM160HI +++++
--- User ---
[MBR] 98113a4f6d6f93a3ccf6471d0c47cf44
[bSP] b669e0312c6a4428711d1a1bcd9b1da1 : Kiwi MBR Code
Partition table:
0 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 2048 | Size: 15352 MB
1 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 31442944 | Size: 95 MB
2 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 31637504 | Size: 137179 MB
User = LL1 ... OK
User = LL2 ... OK

Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted

You're infected with Rootkit.ZeroAccess, a BackDoor Trojan.

BACKDOOR WARNING

------------------------------

One or more of the identified infections is known to use a backdoor.

This allows hackers to remotely control your computer, steal critical system information and download and execute files.

I would advice you to disconnect this PC from the Internet immediately. If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation.

Though the infection has been identified and because of it's backdoor functionality, your PC is very likely compromised and there is no way to be sure your computer can ever again be trusted. Many experts in the security community believe that once infected with this type of trojan, the best course of action would be a reformat and reinstall of the OS. Please read these for more information:

How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?
http://www.dslreports.com/faq/10451

When Should I Format, How Should I Reinstall
http://www.dslreports.com/faq/10063

I will try my best to clean this machine but I can't guarantee that it will be 100% secure afterwards 

------------------------------------------
Make sure you have created a restore point and.....
bwebb7v.jpgDownload Delfix from Here and save it to your desktop.

  • Place a check mark in front of .......
  • Create registry backup <---only!
  • Uncheck the rest!
  • Click the Run button.

    Close the tool out when it's done....we'll use it later.

    ----------------------------

    Run RogueKiller again and click Scan
    When the scan completes > click on the Files tab
    Put a check next to all of these and uncheck the rest: (if found)

    [ZeroAccess][File] @ -- C:\$Recycle.Bin\S-1-5-18\$f8f3570a16c5ccb882cb75e14ab582e2\@ -> FOUND
    [ZeroAccess][Folder] L -- C:\$Recycle.Bin\S-1-5-18\$f8f3570a16c5ccb882cb75e14ab582e2\L -> FOUND
    [ZeroAccess][Folder] U -- C:\$Recycle.Bin\S-1-5-18\$f8f3570a16c5ccb882cb75e14ab582e2\U -> FOUND

    Now click Delete on the right hand column under Options

    ---------------------------------------------------

    Download the attached fixlist.txt to the same folder as FRST.exe/FRST64.exe.
    Run FRST.exe/FRST64.exe and click Fix only once and wait
    The tool will create a log (Fixlog.txt) in the folder, please post it to your reply.

    --------------------------------------------------------

    Please download and run ComboFix.

    The most important things to remember when running it is to disable all your malware programs and run Combofix from your desktop.

    Please visit this webpage for download links, and instructions for running ComboFix

    http://www.bleepingcomputer.com/combofix/how-to-use-combofix

    http://www.bleepingcomputer.com/download/combofix/dl/12/ <---ComboFix direct download

    Please make sure you click download buttons that look similar to this, not "sponsored ad links":

    bleep-crop.jpg

    Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

    Information on disabling your malware programs can be found Here.

    Make sure you run ComboFix from your desktop.

    Give it at least 30-45 minutes to finish if needed.

    Please include the C:\ComboFix.txt in your next reply for further review.

    ---------->NOTE<----------

    If you get the message Illegal operation attempted on registry key that has been marked for deletion after you run ComboFix....please reboot the computer, this should resolve the problem. You may have to do this several times if needed.

    MrC
     
Link to post
Share on other sites
rossco

rossco

Posted
  • Author
Posted

Hi, I have done all of the above here are the reports, thanks

 

 

ComboFix 14-08-02.02 - Parent 01/08/2014  21:30:47.1.2 - x86
Microsoft Windows 7 Professional   6.1.7601.1.1252.44.1033.18.2009.1333 [GMT 1:00]
Running from: c:\users\Parent\Downloads\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {9765EA51-0D3C-7DFB-6091-10E4E1F341F6}
SP: Microsoft Security Essentials *Disabled/Updated* {2C040BB5-2B06-7275-5A21-2B969A740B4B}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\Microsoft\Windows\DRM\tmp5D4B.tmp
c:\users\Parent\AppData\Local\Microsoft\Windows\Temporary Internet Files\cqbw_.exe
c:\users\Parent\AppData\Local\Microsoft\Windows\Temporary Internet Files\gAy4p.exe
c:\users\Parent\AppData\Roaming\Adobe\acupx217.dll
c:\users\Parent\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EPUHelp.exe
.
.
(((((((((((((((((((((((((((((((((((((((   Drivers/Services   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_syshost32
.
.
(((((((((((((((((((((((((   Files Created from 2014-07-01 to 2014-08-01  )))))))))))))))))))))))))))))))
.
.
2014-08-01 21:03 . 2014-08-01 21:03 -------- d-----w- c:\users\Learner\AppData\Local\temp
2014-08-01 21:03 . 2014-08-01 21:03 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-08-01 19:16 . 2014-08-01 19:16 -------- d-----w- c:\windows\ERUNT
2014-07-31 21:04 . 2014-08-01 19:47 -------- d-----w- c:\users\Parent\AppData\Local\CrashDumps
2014-07-31 21:00 . 2014-08-01 19:22 29160 ----a-w- c:\windows\system32\drivers\TrueSight.sys
2014-07-31 21:00 . 2014-07-31 21:00 -------- d-----w- c:\programdata\RogueKiller
2014-07-30 19:58 . 2014-08-01 20:17 -------- d-----w- C:\FRST
2014-07-14 07:18 . 2014-07-15 20:02 -------- d-----w- c:\users\Parent\AppData\Local\Adobe
.
.
.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-07-08 20:01 . 2012-05-08 19:55 699056 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2014-07-08 20:01 . 2011-08-29 16:17 71344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
.
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive1]
@="{F241C880-6982-4CE5-8CF7-7085BA96DA5A}"
[HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]
2013-08-14 07:07 222832 ----a-w- c:\users\Parent\AppData\Local\Microsoft\SkyDrive\17.0.2015.0811\SkyDriveShell.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive2]
@="{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}"
[HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]
2013-08-14 07:07 222832 ----a-w- c:\users\Parent\AppData\Local\Microsoft\SkyDrive\17.0.2015.0811\SkyDriveShell.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive3]
@="{BBACC218-34EA-4666-9D7A-C78F2274A524}"
[HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]
2013-08-14 07:07 222832 ----a-w- c:\users\Parent\AppData\Local\Microsoft\SkyDrive\17.0.2015.0811\SkyDriveShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2011-02-05 396152]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2011-08-29 39408]
"iCloudServices"="c:\program files\Common Files\Apple\Internet Services\iCloudServices.exe" [2013-09-14 59720]
"ApplePhotoStreams"="c:\program files\Common Files\Apple\Internet Services\ApplePhotoStreams.exe" [2013-09-15 59720]
"RESTART_STICKY_NOTES"="c:\windows\System32\StikyNot.exe" [2009-07-14 354304]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-09-30 7744032]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-10-10 1578280]
"UCam_Menu"="c:\program files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2009-05-19 222504]
"CSSolutionsClient"="c:\positive it solutions\Child Safe Solutions\CSSolutionsClient.exe" [2010-05-10 308200]
"CSSWebFiltering"="c:\positive it solutions\Child Safe Solutions\CSSWebFiltering.exe" [2010-05-10 62440]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-08-25 136216]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-08-25 171032]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-08-25 170520]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-09-13 59720]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-10-24 421888]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-03-27 37296]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-02 843712]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-03-26 931200]
"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2012-04-04 446392]
"SwitchBoard"="c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"AdobeCS6ServiceManager"="c:\program files\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" [2012-03-09 1073312]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2013-11-02 152392]
"RIMBBLaunchAgent.exe"="c:\program files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe" [2013-01-17 267792]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37.sys]
@=""
.
R3 CH341SER;CH341SER;c:\windows\system32\Drivers\CH341SER.SYS [2009-06-02 39632]
R3 esgiguard;esgiguard;c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys [2011-05-06 13904]
R3 ExpressAccountsService;Express Accounts;c:\program files\NCH Software\ExpressAccounts\expressaccounts.exe [2013-02-01 3201576]
R3 ExpressInvoiceService;Express Invoice;c:\program files\NCH Software\ExpressInvoice\expressinvoice.exe [2013-07-19 2620456]
R3 hitmanpro37;HitmanPro 3.7 Support Driver;c:\windows\system32\drivers\hitmanpro37.sys [x]
R3 massfilter;ZTE Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys [2010-01-19 9216]
R3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\DRIVERS\netaapl.sys [2013-07-25 18944]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2012-03-20 74112]
R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe [2012-03-26 214952]
R3 SwitchBoard;SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-05-22 1343400]
R4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\Microsoft SQL Server\100\Shared\SQLADHLP.EXE [2008-07-10 47128]
R4 RsFx0103;RsFx0103 Driver;c:\windows\system32\DRIVERS\RsFx0103.sys [2009-03-30 239336]
R4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);c:\program files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [2009-03-30 366936]
S0 RapportKELL;RapportKELL;c:\windows\System32\Drivers\RapportKELL.sys [2014-03-30 107256]
S1 RapportCerberus_59849;RapportCerberus_59849;c:\programdata\Trusteer\Rapport\store\exts\RapportCerberus\baseline\RapportCerberus32_59849.sys [2013-12-21 340432]
S1 RapportEI;RapportEI;c:\program files\Trusteer\Rapport\bin\RapportEI.sys [2014-03-30 156024]
S1 RapportPG;RapportPG;c:\program files\Trusteer\Rapport\bin\RapportPG.sys [2014-03-30 228888]
S1 SABI;SAMSUNG Kernel Driver For Windows 7;c:\windows\system32\Drivers\SABI.sys [2009-05-28 10752]
S2 BecHelperService;BecHelperService;c:\program files\3 Mobile Broadband\3Connect\BecHelperService.exe [2010-01-28 1737464]
S2 HitmanProScheduler;HitmanPro Scheduler;c:\program files\HitmanPro\hmpsched.exe [2013-06-05 106280]
S2 RapportMgmtService;Rapport Management Service;c:\program files\Trusteer\Rapport\bin\RapportMgmtService.exe [2014-03-30 1444120]
S2 RzKLService;RzKLService;c:\program files\Razer\Razer Game Booster\RzKLService.exe [2013-11-22 105448]
S3 Blackberry Device Manager;Blackberry Device Manager;c:\program files\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe [2013-01-18 577536]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2009-07-31 187392]
.
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2014-07-18 20:49 1104200 ----a-w- c:\program files\Google\Chrome\Application\36.0.1985.125\Installer\chrmstp.exe
.
Contents of the 'Scheduled Tasks' folder
.
2014-08-01 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-08 20:02]
.
2014-08-01 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-502250249-1756045401-4193677544-1000Core.job
- c:\users\Parent\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-01-19 19:11]
.
2014-08-01 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-502250249-1756045401-4193677544-1000UA.job
- c:\users\Parent\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-01-19 19:11]
.
2014-08-01 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-10-17 15:57]
.
2014-08-01 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-10-17 15:57]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/ig?hl=en/
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MIF5BA~1\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.0.1
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
HKCU-Run-MobileDocuments - c:\program files\Common Files\Apple\Internet Services\ubd.exe
HKCU-Run-AdobeBridge - (no file)
SafeBoot-mcmscsvc
SafeBoot-MCODS
SafeBoot-MsMpSvc
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Other Running Processes ------------------------
.
c:\progra~1\ENIGMA~1\SPYHUN~1\SH4SER~1.EXE
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\windows\system32\taskhost.exe
c:\program files\Samsung\Samsung Recovery Solution 4\WCScheduler.exe
c:\program files\Samsung\Samsung Support Center\SSCKbdHk.exe
c:\windows\system32\conhost.exe
c:\program files\Synaptics\SynTP\SynTPHelper.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\Common Files\Apple\Internet Services\APSDaemon.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\servicing\TrustedInstaller.exe
c:\program files\Common Files\Java\Java Update\jucheck.exe
c:\windows\system32\sppsvc.exe
c:\windows\system32\RunDll32.exe
c:\windows\system32\taskhost.exe
.
**************************************************************************
.
Completion time: 2014-08-01  22:22:40 - machine was rebooted
ComboFix-quarantined-files.txt  2014-08-01 21:22
.
Pre-Run: 10,398,117,888 bytes free
Post-Run: 12,909,981,696 bytes free
.
- - End Of File - - 863AF1DBD43399ECC856D02905882C35
2E5DEBB2116B3417023E0D6562D7ED07
 

 

 

 

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version:30-07-2014
Ran by Parent at 2014-08-01 21:17:16 Run:1
Running from C:\Users\Parent\Downloads
Boot Mode: Normal

==============================================

Content of fixlist:
*****************
C:\Windows\Installer\{31A46D32-02E0-92BD-019D-738FE175B643}\syshost.exe
HKLM Group Policy restriction on software: C:\Program Files\Malwarebytes' Anti-Malware <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files\Microsoft Security Client <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Malwarebytes <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Malwarebytes <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Malwarebytes <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files\Microsoft Security Client <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files\Microsoft Security Client <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files\Microsoft Security Client <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files\Microsoft Security Client <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Malwarebytes <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files\Malwarebytes' Anti-Malware <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Malwarebytes <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Malwarebytes <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Malwarebytes <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files\Malwarebytes' Anti-Malware <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files\Microsoft Security Client <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files\Microsoft Security Client <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files\Malwarebytes' Anti-Malware <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files\Malwarebytes' Anti-Malware <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files\Malwarebytes' Anti-Malware <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files\Malwarebytes' Anti-Malware <====== ATTENTION
HKLM\...D6A79037F57F\InprocServer32: [Default-fastprox] fastprox.dll ATTENTION! ====> ZeroAccess?
HKU\S-1-5-21-502250249-1756045401-4193677544-1000\...\Run: [ijnmsoft] => regsvr32.exe C:\Users\Parent\AppData\Local\Ijnmsoft\SQLMON.DLL  <===== ATTENTION
HKU\S-1-5-21-502250249-1756045401-4193677544-1000\...409d6c4515e9\InprocServer32: [Default-shell32] shell32.dll ATTENTION! ====> ZeroAccess?
C:\$Recycle.Bin\S-1-5-18\$f8f3570a16c5ccb882cb75e14ab582e2
C:\Users\Parent\AppData\Local\Temp\AutoRun.exe
C:\Users\Parent\AppData\Local\Temp\AutoRunGUI.dll
C:\Users\Parent\AppData\Local\Temp\drm_dialogs.dll
C:\Users\Parent\AppData\Local\Temp\drm_dyndata_7400006.dll
C:\Users\Parent\AppData\Local\Temp\easetup.exe
C:\Users\Parent\AppData\Local\Temp\HitmanPro.exe
C:\Users\Parent\AppData\Local\Temp\InstallFlashPlayer.exe
C:\Users\Parent\AppData\Local\Temp\jre-7u17-windows-i586-iftw.exe
C:\Users\Parent\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe
C:\Users\Parent\AppData\Local\Temp\jre-7u51-windows-i586-iftw.exe
C:\Users\Parent\AppData\Local\Temp\jre-7u55-windows-i586-iftw.exe
C:\Users\Parent\AppData\Local\Temp\Uninstall.exe
C:\Users\Parent\AppData\Local\Temp\WCNBP_279.exe
C:\Users\Parent\AppData\Local\Temp\WMSITSS.exe
AlternateDataStreams: C:\ProgramData\Temp:D82A9FCF

 

*****************

C:\Windows\Installer\{31A46D32-02E0-92BD-019D-738FE175B643}\syshost.exe => Moved successfully.
HKLM => Unable to delete Group Policy Restriction on software
HKLM => Unable to delete Group Policy Restriction on software
HKLM => Unable to delete Group Policy Restriction on software
HKLM => Unable to delete Group Policy Restriction on software
HKLM => Unable to delete Group Policy Restriction on software
HKLM => Unable to delete Group Policy Restriction on software
HKLM => Unable to delete Group Policy Restriction on software
HKLM => Unable to delete Group Policy Restriction on software
HKLM => Unable to delete Group Policy Restriction on software
HKLM => Unable to delete Group Policy Restriction on software
HKLM => Unable to delete Group Policy Restriction on software
HKLM => Unable to delete Group Policy Restriction on software
HKLM => Unable to delete Group Policy Restriction on software
HKLM => Unable to delete Group Policy Restriction on software
HKLM => Unable to delete Group Policy Restriction on software
HKLM => Unable to delete Group Policy Restriction on software
HKLM => Unable to delete Group Policy Restriction on software
HKLM => Unable to delete Group Policy Restriction on software
HKLM => Unable to delete Group Policy Restriction on software
HKLM => Unable to delete Group Policy Restriction on software
HKLM => Unable to delete Group Policy Restriction on software
HKLM => Unable to delete Group Policy Restriction on software
HKLM => Unable to delete Group Policy Restriction on software
HKLM => Unable to delete Group Policy Restriction on software
HKLM => Unable to delete Group Policy Restriction on software
HKLM => Unable to delete Group Policy Restriction on software
HKLM => Unable to delete Group Policy Restriction on software
HKLM => Unable to delete Group Policy Restriction on software
HKLM => Unable to delete Group Policy Restriction on software
HKLM => Unable to delete Group Policy Restriction on software
HKLM => Unable to delete Group Policy Restriction on software
HKLM => Unable to delete Group Policy Restriction on software
HKLM => Unable to delete Group Policy Restriction on software
HKLM => Unable to delete Group Policy Restriction on software
HKLM => Unable to delete Group Policy Restriction on software
HKLM\Software\Classes\CLSID\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InprocServer32\\Default => Value was restored successfully.
HKU\S-1-5-21-502250249-1756045401-4193677544-1000\Software\Microsoft\Windows\CurrentVersion\Run\\Ijnmsoft => Value not found.
"HKU\S-1-5-21-502250249-1756045401-4193677544-1000\Software\Classes\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}" => Key deleted successfully.
C:\$Recycle.Bin\S-1-5-18\$f8f3570a16c5ccb882cb75e14ab582e2 => Moved successfully.
C:\Users\Parent\AppData\Local\Temp\AutoRun.exe => Moved successfully.
C:\Users\Parent\AppData\Local\Temp\AutoRunGUI.dll => Moved successfully.
C:\Users\Parent\AppData\Local\Temp\drm_dialogs.dll => Moved successfully.
C:\Users\Parent\AppData\Local\Temp\drm_dyndata_7400006.dll => Moved successfully.
C:\Users\Parent\AppData\Local\Temp\easetup.exe => Moved successfully.
C:\Users\Parent\AppData\Local\Temp\HitmanPro.exe => Moved successfully.
C:\Users\Parent\AppData\Local\Temp\InstallFlashPlayer.exe => Moved successfully.
C:\Users\Parent\AppData\Local\Temp\jre-7u17-windows-i586-iftw.exe => Moved successfully.
C:\Users\Parent\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe => Moved successfully.
C:\Users\Parent\AppData\Local\Temp\jre-7u51-windows-i586-iftw.exe => Moved successfully.
C:\Users\Parent\AppData\Local\Temp\jre-7u55-windows-i586-iftw.exe => Moved successfully.
C:\Users\Parent\AppData\Local\Temp\Uninstall.exe => Moved successfully.
C:\Users\Parent\AppData\Local\Temp\WCNBP_279.exe => Moved successfully.
C:\Users\Parent\AppData\Local\Temp\WMSITSS.exe => Moved successfully.
C:\ProgramData\Temp => ":D82A9FCF" ADS removed successfully.

==== End of Fixlog ====

Link to post
Share on other sites
rossco

rossco

Posted
  • Author
Posted

thanks

 

Additional scan result of Farbar Recovery Scan Tool (x86) Version:30-07-2014
Ran by Parent at 2014-08-03 17:05:13
Running from C:\Users\Parent\Downloads
Boot Mode: Normal
==========================================================

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Microsoft Security Essentials (Disabled - Up to date) {9765EA51-0D3C-7DFB-6091-10E4E1F341F6}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Microsoft Security Essentials (Disabled - Up to date) {2C040BB5-2B06-7275-5A21-2B969A740B4B}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

 Update for Microsoft Office 2007 (KB2508958) (HKLM\...\{90120000-0012-0000-0000-0000000FF1CE}_STANDARD_{0C5823AA-7B6F-44E1-8D5B-8FD1FF0E6438}) (Version:  - Microsoft)
µTorrent (HKLM\...\uTorrent) (Version: 2.2.0 - )
3Connect (HKLM\...\{A899DA1F-D626-401C-8651-F2921E3B4CB3}) (Version: 3.0.0 - 3 Mobile Broadband)
7-Zip 9.20 (HKLM\...\7-Zip) (Version:  - )
Adobe AIR (HKLM\...\Adobe AIR) (Version: 2.7.1.19610 - Adobe Systems Incorporated)
Adobe AIR (Version: 2.7.1.19610 - Adobe Systems Incorporated) Hidden
Adobe Flash Player 14 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 14.0.0.145 - Adobe Systems Incorporated)
Adobe Photoshop CS6 (HKLM\...\{74EB3499-8B95-4B5C-96EB-7B342F3FD0C6}) (Version: 13.0 - Adobe Systems Incorporated)
Adobe Reader 9.5.1 (HKLM\...\{AC76BA86-7AD7-1033-7B44-A95000000001}) (Version: 9.5.1 - Adobe Systems Incorporated)
Adobe Shockwave Player 11.5 (HKLM\...\Adobe Shockwave Player) (Version: 11.5.6.606 - Adobe Systems, Inc.)
Apple Application Support (HKLM\...\{46F044A5-CE8B-4196-984E-5BD6525E361D}) (Version: 2.3.6 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{0592EF96-69D8-4E4B-9CC9-88F58EA86F01}) (Version: 7.0.0.117 - Apple Inc.)
Apple Software Update (HKLM\...\{C6579A65-9CAE-4B31-8B6B-3306E0630A66}) (Version: 2.1.3.127 - Apple Inc.)
Atheros Client Installation Program (HKLM\...\{D1434266-0486-4469-B338-A60082CC04E1}) (Version: 1.0.1.0805 - Atheros)
Auctonic (HKLM\...\{E1CFE7F3-A062-4904-AA05-084E5C27F499}) (Version: 1.1.36 - Auctonic)
BBC iPlayer Desktop (HKLM\...\BBCiPlayerDesktop.61DB7A798358575D6A969CCD73DDBBD723A6DA9D.1) (Version: 1.5.15695.18135 - British Broadcasting Corp.)
BBC iPlayer Desktop (Version: 1.5.15695 - British Broadcasting Corp.) Hidden
BECTA Home Access Activation Tool (HKLM\...\{9B39B512-1E22-45B6-9561-83DBFEA00A33}) (Version: 1.0.0 - Texthelp Systems)
BlackBerry Desktop Software 7.1 (HKLM\...\BlackBerry_Desktop) (Version: 7.1.0.41 - Research In Motion Ltd.)
BlackBerry Desktop Software 7.1 (Version: 7.1.0.41 - Research In Motion Ltd.) Hidden
Bonjour (HKLM\...\{79155F2B-9895-49D7-8612-D92580E0DE5B}) (Version: 3.0.0.10 - Apple Inc.)
CDBurnerXP (HKLM\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.1.4003 - CDBurnerXP)
Child Safe Solutions (HKLM\...\{A78B609F-D300-48EB-B2FC-D3DA6FB6CFC3}) (Version: 1.0.0 - Positive IT Solutions)
ConstructionSkills (HKLM\...\{5499A827-E4C8-49B8-8462-4C0E5CA976A5}) (Version: 1.00.673 - IDS)
CyberLink YouCam (HKLM\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 2.0.3304 - CyberLink Corp.)
CyberLink YouCam (Version: 2.0.3304 - CyberLink Corp.) Hidden
D3DX10 (Version: 15.4.2368.0902 - Microsoft) Hidden
DHTML Editing Component (HKLM\...\{2EA870FA-585F-4187-903D-CB9FFD21E2E0}) (Version: 6.02.0001 - Microsoft Corporation)
Doctor Who: The Adventure Games (HKLM\...\{9F73FDEF-DDC1-4307-9D96-13AB3254641A}_is1) (Version:  - British Broadcasting Corp.)
Easy Display Manager (HKLM\...\{17283B95-21A8-4996-97DA-547A48DB266F}) (Version: 3.0 - Samsung Electronics Co., Ltd.)
Easy Network Manager (HKLM\...\{B660E0D0-A8CB-45A7-96FB-93E8C915A0B2}) (Version: 4.2.4 - Samsung)
Easy SpeedUp Manager (HKLM\...\{EF367AA4-070B-493C-9575-85BE59D789C9}) (Version: 3.0.0.4 - Samsung Electronics Co.,Ltd.)
EasyBatteryManager (HKLM\...\{178EE5F4-0F86-4BF0-A0D1-9790AFF409D1}) (Version: 4.0.0.2 - Samsung)
Elecard AVC HD Editor (HKLM\...\Elecard AVC HD Editor 1.0.100705) (Version: 1.0.100705 - Elecard)
Express Accounts (HKLM\...\ExpressAccounts) (Version:  - NCH Software)
Express Invoice (HKLM\...\ExpressInvoice) (Version: 3.87 - NCH Software)
Facebook Video Calling 2.0.0.447 (HKLM\...\{8DF41A9F-FE13-43E8-A003-5F9B55A011EE}) (Version: 2.0.447 - Skype Limited)
FileZilla Client 3.6.0.2 (HKLM\...\FileZilla Client) (Version: 3.6.0.2 - FileZilla Project)
FlexiSIGN-PRO 8.1v1 (HKLM\...\{7D3678E4-02FC-45D3-AE2F-7D4B52DAF8D6}) (Version: 1.00.0000 - Scanvec Amiable)
GIMP 2.6.8 (HKLM\...\WinGimp-2.0_is1) (Version:  - )
Google Chrome (HKLM\...\Google Chrome) (Version: 36.0.1985.125 - Google Inc.)
Google Earth (HKLM\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Toolbar for Internet Explorer (HKLM\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.5111.1712 - Google Inc.)
Google Toolbar for Internet Explorer (Version: 1.0.0 - Google Inc.) Hidden
Google Update Helper (Version: 1.3.24.15 - Google Inc.) Hidden
HitmanPro 3.7 (HKLM\...\HitmanPro37) (Version: 3.7.6.201 - SurfRight B.V.)
Horizon v2.7.3.0 (HKLM\...\d4cfeebc-b821-40b7-9f81-d366b1466f03_is1) (Version: 2.7.3.0 - Daring Development Inc.)
HTC Driver Installer (HKLM\...\{6D6664A9-3342-4948-9B7E-034EFE366F0F}) (Version: 3.0.0.013 - HTC Corporation)
iCloud (HKLM\...\{20C6FF70-690B-4DF7-8F5D-269DD3A7FD23}) (Version: 3.0.2.163 - Apple Inc.)
Intel® Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version: 8.15.10.2086 - Intel Corporation)
Intel® Matrix Storage Manager (HKLM\...\{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}) (Version:  - Intel Corporation)
iTunes (HKLM\...\{C197BC08-3D82-4651-8886-E68C21578A38}) (Version: 11.1.3.8 - Apple Inc.)
Java 7 Update 55 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83217051FF}) (Version: 7.0.550 - Oracle)
Java Auto Updater (Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
Junk Mail filter update (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Malwarebytes Anti-Malware version 1.65.0.1400 (HKLM\...\Malwarebytes' Anti-Malware_is1) (Version: 1.65.0.1400 - Malwarebytes Corporation)
MatchWare MindView 3.0 Home Access (HKLM\...\{F3B899DB-B138-4698-BE99-A4271BCA47A4}) (Version: 3.0.140 - MatchWare A/S)
Microsoft .NET Framework 4.5 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50709 - Microsoft Corporation)
Microsoft .NET Framework 4.5 (Version: 4.5.50709 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6012.5000 - Microsoft Corporation) Hidden
Microsoft Expression Blend 3 (HKLM\...\Blend_3.0.1927.0) (Version: 3.0.1927.0 - Microsoft Corporation)
Microsoft Expression Blend 3 (Version: 3.0.1927.0 - Microsoft Corporation) Hidden
Microsoft Expression Blend 3 SDK (HKLM\...\{0E837AF0-4C92-4077-83F0-D022073F17C0}) (Version: 1.0.1327.0 - Microsoft Corporation)
Microsoft Expression Design 3 (HKLM\...\Design_6.0.1739.0) (Version: 6.0.1739.0 - Microsoft Corporation)
Microsoft Expression Design 3 (Version: 6.0.1739.0 - Microsoft Corporation) Hidden
Microsoft Expression Encoder 3 (HKLM\...\Encoder_3.0.1332.0) (Version: 3.0.1332.0 - Microsoft Corporation)
Microsoft Expression Encoder 3 (Version: 3.0.1332.0 - Microsoft Corporation) Hidden
Microsoft Expression Studio 3 (HKLM\...\ExpressionStudio_3.0.1061.0) (Version: 3.0.1061.0 - Microsoft Corporation)
Microsoft Expression Studio 3 (Version: 3.0.1061.0 - Microsoft Corporation) Hidden
Microsoft Expression Web 3 (HKLM\...\Web_3.0.3813.0) (Version: 3.0.3813.0 - Microsoft Corporation)
Microsoft Expression Web 3 (Version: 3.0.3813.0 - Microsoft Corporation) Hidden
Microsoft Expression Web 3 SP1 (HKLM\...\{752E90AC-3F11-4EA3-88EA-96441047EC31}) (Version:  - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM\...\{90120000-0012-0000-0000-0000000FF1CE}_STANDARD_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (Version:  - Microsoft) Hidden
Microsoft Office Excel MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office File Validation Add-In (HKLM\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Live Add-in 1.4 (HKLM\...\{AE3CF174-872C-46C6-B9F6-C0593F3BC7B8}) (Version: 2.0.3008.0 - Microsoft Corporation)
Microsoft Office Outlook MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Spanish) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (English) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (Version:  - Microsoft) Hidden
Microsoft Office Shared MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared Setup Metadata MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Standard 2007 (HKLM\...\STANDARD) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Standard 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Security Client (Version: 4.0.1526.0 - Microsoft Corporation) Hidden
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.0.1526.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 4.1.10329.0 - Microsoft Corporation)
Microsoft Silverlight 3 SDK (HKLM\...\{2012098D-EEE9-4769-8DD3-B038050854D4}) (Version: 3.0.40624.0 - Microsoft Corporation)
Microsoft SkyDrive (HKCU\...\SkyDriveSetup.exe) (Version: 17.0.2015.0811 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft SQL Server 2008 (HKLM\...\Microsoft SQL Server 10 Release) (Version:  - Microsoft Corporation)
Microsoft SQL Server 2008 (Version:  - Microsoft Corporation) Hidden
Microsoft SQL Server 2008 Browser (HKLM\...\{C688457E-03FD-4941-923B-A27F4D42A7DD}) (Version: 10.1.2531.0 - Microsoft Corporation)
Microsoft SQL Server 2008 Common Files (Version: 10.0.1600.22 - Microsoft Corporation) Hidden
Microsoft SQL Server 2008 Common Files (Version: 10.1.2531.0 - Microsoft Corporation) Hidden
Microsoft SQL Server 2008 Database Engine Services (Version: 10.1.2531.0 - Microsoft Corporation) Hidden
Microsoft SQL Server 2008 Database Engine Shared (Version: 10.1.2531.0 - Microsoft Corporation) Hidden
Microsoft SQL Server 2008 Management Objects (HKLM\...\{F5E87B12-3C27-452F-8E78-21D42164FD83}) (Version: 10.0.1600.22 - Microsoft Corporation)
Microsoft SQL Server 2008 Native Client (HKLM\...\{4F44B5AE-82A6-4A8A-A3E3-E24D489728E3}) (Version: 10.1.2531.0 - Microsoft Corporation)
Microsoft SQL Server 2008 RsFx Driver (Version: 10.1.2531.0 - Microsoft Corporation) Hidden
Microsoft SQL Server 2008 Setup Support Files  (HKLM\...\{BA4DA261-CB60-4690-B202-44998DFC6986}) (Version: 10.1.2531.0 - Microsoft Corporation)
Microsoft SQL Server Compact 3.5 SP1 Design Tools English (HKLM\...\{0C19D563-5F25-4621-BF10-01F741BD283F}) (Version: 3.5.5692.0 - Microsoft Corporation)
Microsoft SQL Server Compact 3.5 SP1 English (HKLM\...\{E59113EB-0285-4BFD-A37A-B79EAC6B8F4B}) (Version: 3.5.5692.0 - Microsoft Corporation)
Microsoft SQL Server VSS Writer (HKLM\...\{B857D868-F8B0-43EE-BC2B-D9E5ED21F237}) (Version: 10.1.2531.0 - Microsoft Corporation)
Microsoft Visual Basic 2008 Express Edition with SP1 - ENU (HKLM\...\Microsoft Visual Basic 2008 Express Edition with SP1 - ENU) (Version:  - Microsoft Corporation)
Microsoft Visual Basic 2008 Express Edition with SP1 - ENU (Version: 9.0.30729 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (HKLM\...\{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM\...\{3C3D696B-0DB7-3C6D-A356-3DB8CE541918}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Windows SDK for Visual Studio 2008 SP1 Express Tools for .NET Framework - enu (HKLM\...\{5BE1E709-30E4-3D6D-A708-96CE8D5E5E8D}) (Version: 3.5.30729 - Microsoft Corporation)
Microsoft Windows SDK for Visual Studio 2008 SP1 Express Tools for Win32 (HKLM\...\{044F9133-B8D7-4d11-BF39-803FA20F5C8B}) (Version: 6.1.5295.17011 - Microsoft Corporation)
Microsoft_VC80_CRT_x86 (Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC90_CRT_x86 (Version: 1.00.0000 - Adobe) Hidden
Minecraft1.6.4 (HKLM\...\Minecraft1.6.4) (Version:  - )
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 17.0.8 - Mozilla)
Mozilla Thunderbird 17.0.8 (x86 en-GB) (HKLM\...\Mozilla Thunderbird 17.0.8 (x86 en-GB)) (Version: 17.0.8 - Mozilla)
MSVCRT (Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT Redists (Version: 1.0 - Sony Creative Software Inc.) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (HKLM\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2721691) (HKLM\...\{355B5AC0-CEEE-42C5-AD4D-7F3CFD806C36}) (Version: 4.30.2114.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB973685) (HKLM\...\{859DFA95-E4A6-48CD-B88E-A3E483E89B44}) (Version: 4.30.2107.0 - Microsoft Corporation)
Nessy Fingers - Demo Version (HKLM\...\{849343A6-A739-40A2-A85B-7C178E460DE7}) (Version: 1.0.0 - Net Educational Systems © 2007)
Notepad++ (HKLM\...\Notepad++) (Version: 6.1.1 - )
Octodad (HKLM\...\Octodad) (Version:  - )
OGA Notifier 2.0.0048.0 (Version: 2.0.0048.0 - Microsoft Corporation) Hidden
PDF Settings CS6 (Version: 11.0 - Adobe Systems Incorporated) Hidden
Picasa 3 (HKLM\...\Picasa 3) (Version: 3.6 - Google, Inc.)
Positive IT Solutions Online Support (HKLM\...\{7E117A6A-8579-4435-8290-4089C1C5BEFA}) (Version: 5.2.142 - LogMeIn, Inc.)
QuickTime (HKLM\...\{7BE15435-2D3E-4B58-867F-9C75BED0208C}) (Version: 7.71.80.42 - Apple Inc.)
Rapport (Version: 3.5.1304.66 - Trusteer) Hidden
Razer Game Booster (HKLM\...\Razer Game Booster_is1) (Version: 4.1.59.0 - Razer Inc.)
Read And Write Home Access (HKLM\...\{2775D83C-A85F-4CC2-84A1-FC5E63F682BB}) (Version: 9.0.1 - Texthelp Systems)
Realtek Ethernet Controller  Driver (HKLM\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 1.00.0008 - Realtek)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5948 - Realtek Semiconductor Corp.)
ROBLOX Player for Parent (HKCU\...\{373B1718-8CC5-4567-8EE2-9033AD08A680}) (Version:  - ROBLOX Corporation)
ROBLOX Studio 2013 for Parent (HKCU\...\{2922D6F1-2865-4EFA-97A9-94EEAB3AFA14}) (Version:  - ROBLOX Corporation)
Samsung Recovery Solution 4 (HKLM\...\{145DE957-0679-4A2A-BB5C-1D3E9808FAB2}) (Version: 4.0.0.4 - Samsung)
Samsung Support Center (HKLM\...\{4D2121FE-5CCC-4D47-B3A0-BF56045A5099}) (Version: 1.0.1 - Samsung)
SAMSUNG Video Codec 1.2.5006 (HKLM\...\{2F6DCED3-ABEC-4986-9DA4-D27C7C25C38A}) (Version: 1.2.5006 - SAMSUNG)
SamsungMovie (HKLM\...\{EFA6EF6A-9E0D-4CF0-91DD-B55D8632F65A}) (Version: 1.0.0 - Samsung)
Scratch (HKLM\...\Scratch) (Version: 1.4.0.0 - MIT Media Lab Lifelong Kindergarten Group)
Service Pack 1 for SQL Server 2008 (KB968369) (HKLM\...\KB968369) (Version: 10.1.2531.0 - Microsoft Corporation)
SignCut (remove only) (HKLM\...\SignCut) (Version:  - )
SmartFTP Client (HKLM\...\{8B0E66E5-3594-468E-93B0-7C7BC866761F}) (Version: 4.0.1241.0 - SmartSoft Ltd.)
SmartFTP Client 4.0 Setup Files (remove only) (HKLM\...\SmartFTP Client 4.0 Setup Files) (Version: 4.0 - SmartSoft Ltd)
SpyHunter (HKLM\...\{ADAFC0B4-FC15-45D9-BAB3-BC7A8829D0C4}) (Version: 4.10.5.4085 - Enigma Software Group USA, LLC)
Sql Server Customer Experience Improvement Program (Version: 10.1.2531.0 - Microsoft Corporation) Hidden
SQL Server System CLR Types (HKLM\...\{342D4AD7-EC4C-4EC8-AEA6-E70F5905A490}) (Version: 10.1.2531.0 - Microsoft Corporation)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 14.0.10.0 - Synaptics Incorporated)
The Sims 2 Family Fun Stuff (HKLM\...\{6BDD9CE6-D0A6-478A-BAD3-BA6945E89EB0}) (Version:  - )
The Sims 2 Glamour Life Stuff (HKLM\...\{9CDBC303-3EED-40b0-8E41-A7C65AA96C26}) (Version:  - )
The Sims™ 2 (HKLM\...\{2C82E097-694E-44ea-A947-2750679469CF}) (Version:  - Electronic Arts)
The Sims™ 2 H&M® Fashion Stuff (HKLM\...\{84DDE556-43EF-43ed-B2DF-37AF9E5DDD75}) (Version:  - )
The Sims™ 2 Seasons (HKLM\...\{DFEF49D9-FC95-4301-99B9-2FB91C6ABA06}) (Version:  - )
The Sims™ 2 Teen Style Stuff (HKLM\...\{5C648FDB-0138-4619-B66E-230EF53E8E2C}) (Version:  - Electronic Arts)
Trusteer Endpoint Protection (HKLM\...\Rapport_msi) (Version: 3.5.1304.66 - Trusteer)
Turbo Lister 2 (HKLM\...\{8927E07C-97F7-4A54-88FB-D976F50DD46E}) (Version: 2.00.0000 - eBay Inc.)
Unity Web Player (HKCU\...\UnityWebPlayer) (Version:  - Unity Technologies ApS)
Update for 2007 Microsoft Office System (KB967642) (HKLM\...\{90120000-0012-0000-0000-0000000FF1CE}_STANDARD_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
Update for Microsoft Office 2007 Help for Common Features (KB963673) (HKLM\...\{90120000-006E-0409-0000-0000000FF1CE}_STANDARD_{AB365889-0395-4FAD-B702-CA5985D53D42}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (HKLM\...\{90120000-0012-0000-0000-0000000FF1CE}_STANDARD_{E9A82945-BA29-4EE8-8F2A-2F49545E9CF2}) (Version:  - Microsoft)
Update for Microsoft Office Excel 2007 Help (KB963678) (HKLM\...\{90120000-0016-0409-0000-0000000FF1CE}_STANDARD_{199DF7B6-169C-448C-B511-1054101BE9C9}) (Version:  - Microsoft)
Update for Microsoft Office Outlook 2007 (KB2596598) 32-Bit Edition (HKLM\...\{90120000-0012-0000-0000-0000000FF1CE}_STANDARD_{8B689F89-5E1C-4DA9-B2B1-7B3843275596}) (Version:  - Microsoft)
Update for Microsoft Office Outlook 2007 (KB2596598) 32-Bit Edition (HKLM\...\{90120000-001A-0409-0000-0000000FF1CE}_STANDARD_{8F32B14E-F85E-482C-BF8C-C04E1A5ADE4F}) (Version:  - Microsoft)
Update for Microsoft Office Outlook 2007 Help (KB963677) (HKLM\...\{90120000-001A-0409-0000-0000000FF1CE}_STANDARD_{0451F231-E3E3-4943-AB9F-58EB96171784}) (Version:  - Microsoft)
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2687407) 32-Bit Edition (HKLM\...\{90120000-0012-0000-0000-0000000FF1CE}_STANDARD_{BBE715CA-02FD-4C5A-90BB-440A967DF05E}) (Version:  - Microsoft)
Update for Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM\...\{90120000-0018-0409-0000-0000000FF1CE}_STANDARD_{397B1D4F-ED7B-4ACA-A637-43B670843876}) (Version:  - Microsoft)
Update for Microsoft Office Script Editor Help (KB963671) (HKLM\...\{90120000-006E-0409-0000-0000000FF1CE}_STANDARD_{CD11C6A2-FFC6-4271-8EAB-79C3582F505C}) (Version:  - Microsoft)
Update for Microsoft Office Word 2007 Help (KB963665) (HKLM\...\{90120000-001B-0409-0000-0000000FF1CE}_STANDARD_{80E762AA-C921-4839-9D7D-DB62A72C0726}) (Version:  - Microsoft)
User Guide (HKLM\...\{BAE68339-B0F6-4D33-9554-5A3DB2DFF5DA}) (Version: 1.0 - )
Vegas Movie Studio HD  11.0 (HKLM\...\{EF5F161E-9904-11E0-AAE2-0013D3D69929}) (Version: 11.0.29 - Sony)
VLC media player 1.1.11 (HKLM\...\VLC media player) (Version: 1.1.11 - VideoLAN)
Waldo (HKLM\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-118465353}) (Version:  - Oberon Media)
WinAVI Video Converter (HKLM\...\WinAVI Video Converter) (Version: 11.0.0.3995 - ZJMedia Digital Technology Ltd.)
Windows Live Communications Platform (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM\...\WinLiveSuite) (Version: 15.4.3555.0308 - Microsoft Corporation)
Windows Live Essentials (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Family Safety (Version: 15.4.3555.0308 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4232.0 - Microsoft Corporation) Hidden
Windows Live Installer (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mail (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Messenger (Version: 15.4.3538.0513 - Microsoft Corporation) Hidden
Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Movie Maker (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Common (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Gallery (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live SOXE (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Sync (HKLM\...\{84EBDF39-4B33-49D7-A0BD-EB6E2C4E81C1}) (Version: 14.0.8089.726 - Microsoft Corporation)
Windows Live UX Platform (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Writer (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Writer Resources (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Phone app for desktop (HKLM\...\{E786AE85-8A30-4CF2-BF70-57404A5CD684}) (Version: 1.0.1720.1 - Microsoft Corporation)
WinRAR 4.00 (32-bit) (HKLM\...\WinRAR archiver) (Version: 4.00.0 - win.rar GmbH)
WPF Toolkit June 2009 (Version 3.5.40619.1) (HKLM\...\{5EE6E987-1B79-4A93-832B-27472C7D1579}) (Version: 3.5.40619.1 - Microsoft Corporation)
ZTE_1.2059.0.8 (HKLM\...\ZTE_1.2059.0.8) (Version:  - )

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-502250249-1756045401-4193677544-1000_Classes\CLSID\{1FD1FE74-9E3C-4C1C-AEEB-AAB592AD770F}\localserver32 -> C:\Users\Parent\AppData\Local\Facebook\Update\FacebookUpdate.exe (Facebook Inc.)
CustomCLSID: HKU\S-1-5-21-502250249-1756045401-4193677544-1000_Classes\CLSID\{444785F1-DE89-4295-863A-D46C3A781394}\InprocServer32 -> C:\Users\Parent\AppData\LocalLow\Unity\WebPlayer\loader\UnityWebPluginAX.ocx (Unity Technologies ApS)
CustomCLSID: HKU\S-1-5-21-502250249-1756045401-4193677544-1000_Classes\CLSID\{5E71E4F3-E8C7-4906-9626-973E418762B6}\InprocServer32 -> C:\Users\Parent\AppData\Local\Facebook\Update\1.2.205.0\goopdate.dll (Facebook Inc.)
CustomCLSID: HKU\S-1-5-21-502250249-1756045401-4193677544-1000_Classes\CLSID\{76D50904-6780-4c8b-8986-1A7EE0B1716D}\InprocServer32 -> C:\Users\Parent\AppData\Local\Roblox\Versions\version-1112937d32504d8c\RobloxProxy.dll (ROBLOX Corporation)
CustomCLSID: HKU\S-1-5-21-502250249-1756045401-4193677544-1000_Classes\CLSID\{7B37E4E2-C62F-4914-9620-8FB5062718CC}\localserver32 -> C:\Users\Parent\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-502250249-1756045401-4193677544-1000_Classes\CLSID\{82E5DF24-51E8-47CD-864A-F4BD5005AA73}\InprocServer32 -> C:\Users\Parent\AppData\Local\Microsoft\Internet Explorer\Downloaded Program Files\iCloud.ocx (Apple Inc.)
CustomCLSID: HKU\S-1-5-21-502250249-1756045401-4193677544-1000_Classes\CLSID\{8B9F5BF4-0407-4BB2-9FED-4C0372DABD00}\localserver32 -> C:\Users\Parent\AppData\Local\Facebook\Video\Skype\FacebookVideoCallingProxy.exe (Skype Limited)
CustomCLSID: HKU\S-1-5-21-502250249-1756045401-4193677544-1000_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32 -> C:\Users\Parent\AppData\Local\Microsoft\SkyDrive\17.0.2015.0811\SkyDriveShell.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-502250249-1756045401-4193677544-1000_Classes\CLSID\{AB807329-7324-431B-8B36-DBD581F56E0B}\localserver32 -> C:\Users\Parent\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-502250249-1756045401-4193677544-1000_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32 -> C:\Users\Parent\AppData\Local\Microsoft\SkyDrive\17.0.2015.0811\SkyDriveShell.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-502250249-1756045401-4193677544-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0051-ABCDEFFEDCBA}\InprocServer32 -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
CustomCLSID: HKU\S-1-5-21-502250249-1756045401-4193677544-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0051-ABCDEFFEDCBB}\InprocServer32 -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
CustomCLSID: HKU\S-1-5-21-502250249-1756045401-4193677544-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0051-ABCDEFFEDCBC}\InprocServer32 -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
CustomCLSID: HKU\S-1-5-21-502250249-1756045401-4193677544-1000_Classes\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32 -> C:\Users\Parent\AppData\Local\Microsoft\SkyDrive\17.0.2015.0811\SkyDriveShell.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-502250249-1756045401-4193677544-1000_Classes\CLSID\{CBE9C57E-FFA9-4123-8354-AD360D6DD3CC}\InprocServer32 -> C:\Users\Parent\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
CustomCLSID: HKU\S-1-5-21-502250249-1756045401-4193677544-1000_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 -> C:\Users\Parent\AppData\Local\Microsoft\SkyDrive\17.0.2015.0811\SkyDriveShell.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-502250249-1756045401-4193677544-1000_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\Parent\AppData\Local\Microsoft\SkyDrive\17.0.2015.0811\FileSyncApi.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-502250249-1756045401-4193677544-1000_Classes\CLSID\{FE0D8F60-5A07-40a1-85EC-4FFB7E0F2306}\localserver32 -> C:\Users\Parent\AppData\Local\Roblox\Versions\version-21cdb2fff9fb4df2\RobloxApp.exe (ROBLOX Corporation)

==================== Restore Points  =========================

03-08-2014 07:56:17 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:04 - 2014-08-01 22:07 - 00000027 ____N C:\windows\system32\Drivers\etc\hosts
127.0.0.1       localhost

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {0C037336-922F-415D-9FC5-EEA128F30D58} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-502250249-1756045401-4193677544-1000UA => C:\Users\Parent\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-01-19] (Facebook Inc.)
Task: {1129C3B5-E612-4A8F-B5F4-3471C2B0BE55} - System32\Tasks\EasySpeedUpManager => C:\Program Files\SAMSUNG\EasySpeedUpManager\EasySpeedUpManager.exe [2009-08-23] (Samsung Electronics Co., Ltd.)
Task: {2889E4F8-1011-4879-91CC-7784E240F58A} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2010-10-17] (Google Inc.)
Task: {4A9C4A98-D921-4B35-AAE4-31BBBE10ABE3} - System32\Tasks\SpyHunter4Startup => C:\Program Files\Enigma Software Group\SpyHunter\Spyhunter4.exe [2012-08-21] (Enigma Software Group USA, LLC.)
Task: {6E364C8B-5AA6-441E-ABAC-C8872C6B7108} - System32\Tasks\EasyBatteryManager => C:\Program Files\Samsung\EasyBatteryManager\EasyBatteryMgr4.exe [2009-08-01] (SAMSUNG Electronics co., LTD.)
Task: {6F37B217-4E46-489E-BEDE-B0E98C6EBE83} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {9553652B-537C-4722-9021-1DF14765791C} - System32\Tasks\Adobe Flash Player Updater => C:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-07-08] (Adobe Systems Incorporated)
Task: {9BC4757A-4FD7-4E5D-A2A3-89BEF7957083} - System32\Tasks\Launch HTC Sync Loader => C:\Program Files\HTC\HTC Sync 3.0\htcUPCTLoader.exe
Task: {9F9213EC-D680-4EC6-80A9-7DDDBD6BEECD} - System32\Tasks\advSRS4 => C:\Program Files\Samsung\Samsung Recovery Solution 4\WCScheduler.exe [2009-10-07] (SEC)
Task: {C0043620-FE59-40AE-97B9-09CA0E2BFFEE} - System32\Tasks\SamsungSupportCenter => C:\Program Files\Samsung\Samsung Support Center\SSCKbdHk.exe [2009-09-07] (SAMSUNG Electronics)
Task: {CC0FC958-7160-4B95-893F-5817CD340782} - System32\Tasks\SUPBackground => C:\Program Files\Samsung\Samsung Update Plus\SUPBackground.exe
Task: {DBC143F8-F93B-4934-843F-032FEEDD4020} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2010-10-17] (Google Inc.)
Task: {DE3E0974-D3C8-44FC-81D7-9FC510634D7C} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-502250249-1756045401-4193677544-1000Core => C:\Users\Parent\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-01-19] (Facebook Inc.)
Task: {EA20BE70-5970-4369-A178-C2B66A793321} - System32\Tasks\EasyDisplayMgr => C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe [2009-09-08] (Samsung Electronics Co., Ltd.)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-502250249-1756045401-4193677544-1000Core.job => C:\Users\Parent\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-502250249-1756045401-4193677544-1000UA.job => C:\Users\Parent\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2011-06-24 22:56 - 2011-06-24 22:56 - 00087328 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2011-06-24 22:56 - 2011-06-24 22:56 - 01241888 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2010-05-11 19:07 - 2010-01-28 13:47 - 01737464 _____ () C:\Program Files\3 Mobile Broadband\3Connect\BecHelperService.exe
2009-07-13 22:03 - 2009-07-14 02:15 - 00364544 _____ () C:\Windows\system32\msjetoledb40.dll
2013-09-14 02:51 - 2013-09-14 02:51 - 00087952 _____ () C:\Program Files\Common Files\Apple\Internet Services\zlib1.dll
2013-09-14 02:50 - 2013-09-14 02:50 - 01242952 _____ () C:\Program Files\Common Files\Apple\Internet Services\libxml2.dll
2012-03-26 20:47 - 2012-03-26 20:47 - 00016832 _____ () C:\Program Files\Adobe\Reader 9.0\Reader\viewerps.dll
2009-02-27 12:52 - 2009-02-27 12:52 - 00258048 _____ () C:\Program Files\Adobe\Reader 9.0\Reader\sqlite.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MpfService => ""="Service"

==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)

==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

==================== Faulty Device Manager Devices =============

==================== Event log errors: =========================

Application errors:
==================
Error: (08/03/2014 05:00:14 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 15249176

Error: (08/03/2014 05:00:14 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 15249176

Error: (08/03/2014 05:00:14 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (08/03/2014 00:46:09 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 3682

Error: (08/03/2014 00:46:09 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 3682

Error: (08/03/2014 00:46:09 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (08/03/2014 00:46:07 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 2434

Error: (08/03/2014 00:46:07 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 2434

Error: (08/03/2014 00:46:07 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (08/03/2014 00:46:06 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 1373

System errors:
=============
Error: (08/03/2014 05:00:41 PM) (Source: DCOM) (EventID: 10005) (User: )
Description: 109gupdate/comsvc{4EB61BAC-A3B6-4760-9581-655041EF4D69}

Error: (08/03/2014 05:00:40 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Google Update Service (gupdate) service failed to start due to the following error:
%%109

Error: (08/01/2014 10:06:36 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Par1284 service failed to start due to the following error:
%%20

Error: (08/01/2014 10:06:29 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: The previous system shutdown at 22:04:27 on ‎01/‎08/‎2014 was unexpected.

Error: (08/01/2014 10:04:41 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: The PEVSystemStart service is marked as an interactive service.  However, the system is configured to not allow interactive services.  This service may not function properly.

Error: (08/01/2014 10:04:30 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: The PEVSystemStart service is marked as an interactive service.  However, the system is configured to not allow interactive services.  This service may not function properly.

Error: (08/01/2014 09:50:17 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: The PEVSystemStart service is marked as an interactive service.  However, the system is configured to not allow interactive services.  This service may not function properly.

Error: (08/01/2014 09:30:32 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: The PEVSystemStart service is marked as an interactive service.  However, the system is configured to not allow interactive services.  This service may not function properly.

Error: (08/01/2014 09:24:42 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The SpyHunter 4 Service service terminated unexpectedly.  It has done this 1 time(s).

Error: (08/01/2014 09:41:34 AM) (Source: volsnap) (EventID: 36) (User: )
Description: The shadow copies of volume C: were aborted because the shadow copy storage could not grow due to a user imposed limit.

Microsoft Office Sessions:
=========================

==================== Memory info ===========================

Percentage of memory in use: 69%
Total physical RAM: 2008.61 MB
Available physical RAM: 614.36 MB
Total Pagefile: 4017.22 MB
Available Pagefile: 1984.02 MB
Total Virtual: 2047.88 MB
Available Virtual: 1915.87 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:133.96 GB) (Free:10.31 GB) NTFS
Drive e: (Sims2_EP5_1) (CDROM) (Total:0.71 GB) (Free:0 GB) UDF

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 149 GB) (Disk ID: 5EB34F41)
Partition 1: (Not Active) - (Size=15 GB) - (Type=27)
Partition 2: (Active) - (Size=95 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=134 GB) - (Type=07 NTFS)

==================== End Of Log ============================

 

 

 

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:30-07-2014
Ran by Parent (administrator) on PARENT-PC on 03-08-2014 17:02:58
Running from C:\Users\Parent\Downloads
Platform: Microsoft Windows 7 Professional  Service Pack 1 (X86) OS Language: English (United States)
Internet Explorer Version 9
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Enigma Software Group USA, LLC.) C:\Program Files\Enigma Software Group\SpyHunter\SH4Service.exe
(SurfRight B.V.) C:\Program Files\HitmanPro\hmpsched.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
() C:\Program Files\3 Mobile Broadband\3Connect\BecHelperService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe
(Razer Inc.) C:\Program Files\Razer\Razer Game Booster\RzKLService.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(SEC) C:\Program Files\Samsung\Samsung Recovery Solution 4\WCScheduler.exe
(SAMSUNG Electronics) C:\Program Files\Samsung\Samsung Support Center\SSCKbdHk.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Positive IT Solutions) C:\Positive IT Solutions\Child Safe Solutions\CSSWebFiltering.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Research In Motion Limited) C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Google Inc.) C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Internet Services\iCloudServices.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
(Microsoft Corporation) C:\Windows\System32\StikyNot.exe
(Research In Motion Limited) C:\Program Files\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Internet Services\APSDaemon.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jucheck.exe
(Microsoft Corporation) C:\Windows\System32\wuauclt.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Google Inc.) C:\Program Files\Google\Google Toolbar\GoogleToolbarUser_32.exe
(Adobe Systems Incorporated) C:\Program Files\Adobe\Reader 9.0\Reader\AcroRd32Info.exe

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM Group Policy restriction on software: C:\Program Files\Malwarebytes' Anti-Malware <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files\Microsoft Security Client <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Malwarebytes <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Malwarebytes <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Malwarebytes <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files\Microsoft Security Client <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files\Microsoft Security Client <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files\Microsoft Security Client <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files\Microsoft Security Client <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Malwarebytes <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files\Malwarebytes' Anti-Malware <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Malwarebytes <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Malwarebytes <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Malwarebytes <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files\Malwarebytes' Anti-Malware <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files\Microsoft Security Client <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files\Microsoft Security Client <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files\Malwarebytes' Anti-Malware <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files\Malwarebytes' Anti-Malware <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files\Malwarebytes' Anti-Malware <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files\Malwarebytes' Anti-Malware <====== ATTENTION
HKU\S-1-5-21-502250249-1756045401-4193677544-1000\...\Run: [uTorrent] => C:\Program Files\uTorrent\uTorrent.exe [396152 2011-02-05] (BitTorrent, Inc.)
HKU\S-1-5-21-502250249-1756045401-4193677544-1000\...\Run: [swg] => C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2011-08-29] (Google Inc.)
HKU\S-1-5-21-502250249-1756045401-4193677544-1000\...\Run: [iCloudServices] => C:\Program Files\Common Files\Apple\Internet Services\iCloudServices.exe [59720 2013-09-14] (Apple Inc.)
HKU\S-1-5-21-502250249-1756045401-4193677544-1000\...\Run: [ApplePhotoStreams] => C:\Program Files\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [59720 2013-09-15] (Apple Inc.)
HKU\S-1-5-21-502250249-1756045401-4193677544-1000\...\Run: [RESTART_STICKY_NOTES] => C:\Windows\System32\StikyNot.exe [354304 2009-07-14] (Microsoft Corporation)
Startup: C:\Users\Learner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BBC iPlayer Desktop.lnk
ShortcutTarget: BBC iPlayer Desktop.lnk -> C:\Program Files\BBC iPlayer Desktop\BBC iPlayer Desktop.exe ()
ShellIconOverlayIdentifiers:  SkyDrive1 -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => C:\Users\Parent\AppData\Local\Microsoft\SkyDrive\17.0.2015.0811\SkyDriveShell.dll (Microsoft Corporation)
ShellIconOverlayIdentifiers:  SkyDrive2 -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => C:\Users\Parent\AppData\Local\Microsoft\SkyDrive\17.0.2015.0811\SkyDriveShell.dll (Microsoft Corporation)
ShellIconOverlayIdentifiers:  SkyDrive3 -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => C:\Users\Parent\AppData\Local\Microsoft\SkyDrive\17.0.2015.0811\SkyDriveShell.dll (Microsoft Corporation)
ShellIconOverlayIdentifiers: SmartFTP Drop -> {EA5A76F7-8138-4B53-B0F5-ADCC730CAFBD} => C:\Program Files\SmartFTP Client\sfShellTools.dll (SmartSoft Ltd.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/ig?hl=en/
SearchScopes: HKLM - DefaultScope {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SMSN
SearchScopes: HKLM - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SMSN
SearchScopes: HKCU - DefaultScope {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SMSN_en
SearchScopes: HKCU - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SMSN_en
BHO: txthlpBHO Class -> {060235DC-6D84-47BD-95D7-A4EF5099A59D} -> C:\Program Files\Texthelp Systems\Read and Write 9\texthelpbho.dll ()
BHO: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: Java Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: ba3HelperObj Class -> {A17B153F-2267-4161-A165-73DCD6C31BEF} -> C:\Program Files\Texthelp Systems\Read and Write 9\ba3bho.dll ()
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} http://office.microsoft.com/_layouts/ClientBin/ieawsdc32.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

FireFox:
========
FF Plugin: @adobe.com/ShockwavePlayer - C:\windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF Plugin: @Apple.com/iTunes,version=1.0 - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @google.com/npPicasa3,version=3.0.0 - C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin: @java.com/DTPlugin,version=10.55.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.4 - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3555.0308 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @RIM.com/WebSLLauncher,version=1.0 - C:\Program Files\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll ()
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @nsroblox.roblox.com/launcher - C:\Users\Parent\AppData\Local\Roblox\Versions\version-1112937d32504d8c\\NPRobloxProxy.dll ( ROBLOX Corporation)
FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin - C:\Users\Parent\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\Parent\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF StartMenuInternet: FIREFOX.EXE - firefox.exe

Chrome:
=======
CHR Extension: (DefinitionLoader Class) - C:\Users\Parent\AppData\Local\Google\Chrome\User Data\Default\Extensions\ajpgkpeckebdhofmmjfgcjjiiejpodla [2014-04-19]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Parent\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-05-26]
CHR Extension: (Screen capture) - C:\Users\Parent\AppData\Local\Google\Chrome\User Data\Default\Extensions\clcbnchcgjcjphmnpndoelbdhakdlfkk [2014-03-16]
CHR Extension: (Screen Capture (by Google)) - C:\Users\Parent\AppData\Local\Google\Chrome\User Data\Default\Extensions\cpngackimfmofbokmjmljamhdncknpmg [2014-03-16]
CHR Extension: (Google Wallet) - C:\Users\Parent\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-12-15]

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 BecHelperService; C:\Program Files\3 Mobile Broadband\3Connect\BecHelperService.exe [1737464 2010-01-28] ()
R3 Blackberry Device Manager; C:\Program Files\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe [577536 2013-01-18] (Research In Motion Limited) [File not signed]
S3 ExpressAccountsService; C:\Program Files\NCH Software\ExpressAccounts\expressaccounts.exe [3201576 2013-02-01] (NCH Software)
S3 ExpressInvoiceService; C:\Program Files\NCH Software\ExpressInvoice\expressinvoice.exe [2620456 2013-07-19] (NCH Software)
R2 HitmanProScheduler; C:\Program Files\HitmanPro\hmpsched.exe [106280 2013-06-05] (SurfRight B.V.)
S3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [214952 2012-03-26] (Microsoft Corporation)
R2 RzKLService; C:\Program Files\Razer\Razer Game Booster\RzKLService.exe [105448 2013-11-22] (Razer Inc.)
R2 SpyHunter 4 Service; C:\Program Files\Enigma Software Group\SpyHunter\SH4Service.exe [763840 2012-08-21] (Enigma Software Group USA, LLC.)
S3 SwitchBoard; C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 CH341SER; C:\windows\System32\Drivers\CH341SER.SYS [39632 2009-06-03] (www.winchiphead.com)
R3 esgiguard; C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [13904 2011-05-06] ()
R2 mdvrmng; C:\windows\system32\drivers\mdvrmng.sys [10240 2010-01-28] () [File not signed]
R0 MpFilter; C:\windows\System32\DRIVERS\MpFilter.sys [171064 2012-03-20] (Microsoft Corporation)
S2 Par1284; C:\Program Files\FlexiSIGN-PRO 8.1v1\Program\Par1284.sys [53344 2006-10-16] (Warp Nine Engineering) [File not signed]
R1 RapportCerberus_59849; C:\ProgramData\Trusteer\Rapport\store\exts\RapportCerberus\baseline\RapportCerberus32_59849.sys [340432 2013-12-21] ()
S3 catchme; \??\C:\Users\Parent\AppData\Local\Temp\catchme.sys [X]
S3 hitmanpro37; \??\C:\windows\system32\drivers\hitmanpro37.sys [X]
U3 mbr; \??\C:\Users\Parent\AppData\Local\Temp\mbr.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)

==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-01 22:22 - 2014-08-01 22:22 - 00013095 _____ () C:\ComboFix.txt
2014-08-01 22:13 - 2014-05-14 17:23 - 01973728 _____ (Microsoft Corporation) C:\windows\system32\wuaueng.dll
2014-08-01 22:13 - 2014-05-14 17:23 - 00054240 _____ (Microsoft Corporation) C:\windows\system32\wuauclt.exe
2014-08-01 22:13 - 2014-05-14 17:23 - 00045536 _____ (Microsoft Corporation) C:\windows\system32\wups2.dll
2014-08-01 22:13 - 2014-05-14 17:17 - 02425856 _____ (Microsoft Corporation) C:\windows\system32\wucltux.dll
2014-08-01 22:11 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\windows\system32\wuwebv.dll
2014-08-01 22:11 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\windows\system32\wuapp.exe
2014-08-01 21:26 - 2011-06-26 07:45 - 00256000 _____ () C:\windows\PEV.exe
2014-08-01 21:26 - 2010-11-07 18:20 - 00208896 _____ () C:\windows\MBR.exe
2014-08-01 21:26 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\windows\NIRCMD.exe
2014-08-01 21:26 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\windows\SWREG.exe
2014-08-01 21:26 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\windows\SWSC.exe
2014-08-01 21:26 - 2000-08-31 01:00 - 00098816 _____ () C:\windows\sed.exe
2014-08-01 21:26 - 2000-08-31 01:00 - 00080412 _____ () C:\windows\grep.exe
2014-08-01 21:26 - 2000-08-31 01:00 - 00068096 _____ () C:\windows\zip.exe
2014-08-01 21:25 - 2014-08-01 22:22 - 00000000 ____D () C:\Qoobox
2014-08-01 21:24 - 2014-08-01 22:18 - 00000000 ____D () C:\windows\erdnt
2014-08-01 21:23 - 2014-08-01 21:23 - 05566616 ____R (Swearware) C:\Users\Parent\Downloads\ComboFix.exe
2014-08-01 20:20 - 2014-08-01 20:21 - 05566482 _____ (Swearware) C:\Users\Parent\Desktop\ComboFix.exe
2014-08-01 20:16 - 2014-08-01 20:16 - 00000262 _____ () C:\DelFix.txt
2014-08-01 20:16 - 2014-08-01 20:16 - 00000000 ____D () C:\windows\ERUNT
2014-08-01 20:13 - 2014-08-01 20:13 - 00709564 _____ () C:\Users\Parent\Desktop\delfix_10.8.exe
2014-07-31 22:04 - 2014-08-03 11:13 - 00000000 ____D () C:\Users\Parent\AppData\Local\CrashDumps
2014-07-31 22:00 - 2014-08-01 20:22 - 00029160 _____ () C:\windows\system32\Drivers\TrueSight.sys
2014-07-31 22:00 - 2014-07-31 22:00 - 04806744 _____ () C:\Users\Parent\Downloads\RogueKiller.exe
2014-07-31 22:00 - 2014-07-31 22:00 - 00000000 ____D () C:\ProgramData\RogueKiller
2014-07-31 21:11 - 2014-07-31 21:11 - 00000000 ____D () C:\Users\Parent\Downloads\Everything Is AWESOME!!! (feat. The Lonely Island)
2014-07-31 21:09 - 2014-07-31 21:13 - 00000000 ____D () C:\Users\Parent\Downloads\Frozen [2013]  Soundtrack (Deluxe Edition) (Christophe Beck) YG
2014-07-30 21:00 - 2014-07-30 21:01 - 00039051 _____ () C:\Users\Parent\Downloads\Addition.txt
2014-07-30 20:58 - 2014-08-03 17:04 - 00018955 _____ () C:\Users\Parent\Downloads\FRST.txt
2014-07-30 20:58 - 2014-08-03 17:03 - 00000000 ____D () C:\FRST
2014-07-30 20:57 - 2014-07-30 20:57 - 01084928 _____ (Farbar) C:\Users\Parent\Downloads\FRST.exe
2014-07-27 22:02 - 2014-07-27 22:02 - 00000000 ____D () C:\Users\Parent\Downloads\OneDrive-2014-07-27
2014-07-27 21:27 - 2014-07-27 21:35 - 118735112 _____ () C:\Users\Parent\Downloads\OneDrive-2014-07-27.zip
2014-07-27 19:16 - 2014-07-27 19:17 - 00000000 ____D () C:\Users\Parent\Downloads\VA - Extended 80s - The Definitive 12inch Collection [3CD Box Set] (2014) MP3
2014-07-27 19:12 - 2014-07-27 19:13 - 00000000 ____D () C:\Users\Parent\Downloads\The.House.Of.Magic.2013.BDRip.XviD.MP3-RARBG
2014-07-27 18:33 - 2014-07-27 18:33 - 00000000 ____D () C:\Users\Parent\Downloads\Skrillex - Recess [2014] [Mp3-256]-V3nom [GLT]
2014-07-26 19:38 - 2014-07-26 19:39 - 00000000 ____D () C:\Users\Parent\Downloads\The.Expendables.3.2014.DVDSCR.Xvid-DiNGO
2014-07-26 19:31 - 2014-07-26 19:31 - 00003288 ____N () C:\bootsqm.dat
2014-07-24 20:35 - 2014-07-24 20:35 - 00000000 ____D () C:\Users\Parent\AppData\Local\{C45AACE7-3EA7-4C74-A327-FB219B6B9A13}
2014-07-18 21:53 - 2014-07-18 22:18 - 00000000 ____D () C:\Users\Parent\Downloads\Ministry of Sound Tech House (2014) (320kbps) (AciDToX8)
2014-07-18 21:52 - 2014-07-18 21:52 - 00000000 ____D () C:\Users\Parent\Downloads\Ministry Of Sound The Sound Of Deep House 2 (2014)
2014-07-18 18:19 - 2014-07-18 18:27 - 00000000 ____D () C:\Users\Parent\Downloads\The.Fault.In.Our.Stars.2014.CAM.XviD.MP3-RARBG
2014-07-18 18:10 - 2014-07-18 18:10 - 00000000 ____D () C:\Users\Parent\Downloads\The Fault In Our Stars 2014 HDCAM FIRST CAM x264 Pimp4003
2014-07-18 17:28 - 2014-07-18 17:37 - 00000000 ____D () C:\Users\Parent\Downloads\The Fault In Our Stars 2014 CAM AAC x264-SSDD
2014-07-18 15:50 - 2014-07-21 11:39 - 00000000 ____D () C:\Users\Parent\AppData\Local\{E67F3A57-6FBD-4517-B45E-CB13A3122336}
2014-07-17 15:44 - 2014-07-17 15:44 - 00000000 ____D () C:\Users\Parent\AppData\Local\{E7781484-0BED-4432-BF95-A3ED1557EAE0}
2014-07-15 21:18 - 2014-07-15 21:18 - 00000000 ____D () C:\Users\Parent\Downloads\OneDrive-2014-07-15
2014-07-15 21:16 - 2014-07-15 21:16 - 08195334 _____ () C:\Users\Parent\Downloads\OneDrive-2014-07-15.zip
2014-07-14 08:18 - 2014-07-15 21:02 - 00000000 ____D () C:\Users\Parent\AppData\Local\Adobe
2014-07-13 22:18 - 2014-07-13 22:19 - 00000000 ____D () C:\Users\Parent\Downloads\OneDrive-2014-07-13 (1)
2014-07-13 21:48 - 2014-07-13 22:17 - 401674066 _____ () C:\Users\Parent\Downloads\OneDrive-2014-07-13 (1).zip
2014-07-13 19:42 - 2014-07-13 19:42 - 00000000 ____D () C:\Users\Parent\Downloads\OneDrive-2014-07-13
2014-07-13 19:37 - 2014-07-13 19:41 - 58479947 _____ () C:\Users\Parent\Downloads\OneDrive-2014-07-13.zip
2014-07-09 20:21 - 2013-08-03 15:04 - 00036762 _____ () C:\Users\Parent\Downloads\VW_CLUB_-_Czech_Republic.ai
2014-07-09 20:20 - 2014-07-09 20:20 - 00010051 _____ () C:\Users\Parent\Downloads\VW_CLUB_-_Czech_Republic-vector-logo-BACA5ED57B-seeklogo.com.zip
2014-07-09 20:19 - 2014-07-09 20:19 - 00009842 _____ () C:\Users\Parent\Downloads\vw-combi-lateral-vector-logo-A8591F7937-seeklogo.com.zip

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-03 17:04 - 2014-07-30 20:58 - 00018955 _____ () C:\Users\Parent\Downloads\FRST.txt
2014-08-03 17:03 - 2014-07-30 20:58 - 00000000 ____D () C:\FRST
2014-08-03 17:01 - 2010-10-17 16:57 - 00000886 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-08-03 17:00 - 2013-01-19 20:11 - 00000932 _____ () C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-502250249-1756045401-4193677544-1000UA.job
2014-08-03 17:00 - 2012-05-08 20:55 - 00000830 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2014-08-03 11:47 - 2009-07-14 03:37 - 00000000 ____D () C:\windows\Microsoft.NET
2014-08-03 11:46 - 2009-07-14 05:39 - 00174215 _____ () C:\windows\setupact.log
2014-08-03 11:13 - 2014-07-31 22:04 - 00000000 ____D () C:\Users\Parent\AppData\Local\CrashDumps
2014-08-03 09:26 - 2009-11-13 23:09 - 01536068 _____ () C:\windows\WindowsUpdate.log
2014-08-03 09:04 - 2010-05-11 21:32 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-08-03 09:03 - 2013-01-19 20:11 - 00000910 _____ () C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-502250249-1756045401-4193677544-1000Core.job
2014-08-03 09:01 - 2009-07-26 21:06 - 00872788 _____ () C:\windows\system32\PerfStringBackup.INI
2014-08-03 08:59 - 2010-10-17 16:57 - 00000882 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-08-01 22:22 - 2014-08-01 22:22 - 00013095 _____ () C:\ComboFix.txt
2014-08-01 22:22 - 2014-08-01 21:25 - 00000000 ____D () C:\Qoobox
2014-08-01 22:22 - 2009-07-14 05:34 - 00014752 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-08-01 22:22 - 2009-07-14 05:34 - 00014752 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-08-01 22:22 - 2009-07-14 03:37 - 00000000 __RHD () C:\Users\Default
2014-08-01 22:22 - 2009-07-14 03:37 - 00000000 ___RD () C:\Users\Public
2014-08-01 22:18 - 2014-08-01 21:24 - 00000000 ____D () C:\windows\erdnt
2014-08-01 22:08 - 2011-02-05 15:51 - 00000000 ____D () C:\Users\Parent\AppData\Roaming\uTorrent
2014-08-01 22:08 - 2009-07-14 03:04 - 00000215 _____ () C:\windows\system.ini
2014-08-01 22:06 - 2009-11-13 06:52 - 00684998 _____ () C:\windows\PFRO.log
2014-08-01 22:06 - 2009-07-14 05:53 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2014-08-01 22:05 - 2009-07-14 03:03 - 63700992 _____ () C:\windows\system32\config\SOFTWARE.bak
2014-08-01 22:05 - 2009-07-14 03:03 - 19136512 _____ () C:\windows\system32\config\SYSTEM.bak
2014-08-01 22:05 - 2009-07-14 03:03 - 00262144 _____ () C:\windows\system32\config\SECURITY.bak
2014-08-01 22:05 - 2009-07-14 03:03 - 00262144 _____ () C:\windows\system32\config\SAM.bak
2014-08-01 22:05 - 2009-07-14 03:03 - 00262144 _____ () C:\windows\system32\config\DEFAULT.bak
2014-08-01 22:01 - 2010-05-11 19:07 - 00000000 ____D () C:\Users\Parent\AppData\Roaming\Adobe
2014-08-01 21:23 - 2014-08-01 21:23 - 05566616 ____R (Swearware) C:\Users\Parent\Downloads\ComboFix.exe
2014-08-01 20:22 - 2014-07-31 22:00 - 00029160 _____ () C:\windows\system32\Drivers\TrueSight.sys
2014-08-01 20:21 - 2014-08-01 20:20 - 05566482 _____ (Swearware) C:\Users\Parent\Desktop\ComboFix.exe
2014-08-01 20:16 - 2014-08-01 20:16 - 00000262 _____ () C:\DelFix.txt
2014-08-01 20:16 - 2014-08-01 20:16 - 00000000 ____D () C:\windows\ERUNT
2014-08-01 20:13 - 2014-08-01 20:13 - 00709564 _____ () C:\Users\Parent\Desktop\delfix_10.8.exe
2014-08-01 09:55 - 2010-09-09 18:31 - 00000000 ____D () C:\Users\Parent\Documents\Youcam
2014-07-31 22:00 - 2014-07-31 22:00 - 04806744 _____ () C:\Users\Parent\Downloads\RogueKiller.exe
2014-07-31 22:00 - 2014-07-31 22:00 - 00000000 ____D () C:\ProgramData\RogueKiller
2014-07-31 21:13 - 2014-07-31 21:09 - 00000000 ____D () C:\Users\Parent\Downloads\Frozen [2013]  Soundtrack (Deluxe Edition) (Christophe Beck) YG
2014-07-31 21:11 - 2014-07-31 21:11 - 00000000 ____D () C:\Users\Parent\Downloads\Everything Is AWESOME!!! (feat. The Lonely Island)
2014-07-30 21:01 - 2014-07-30 21:00 - 00039051 _____ () C:\Users\Parent\Downloads\Addition.txt
2014-07-30 20:57 - 2014-07-30 20:57 - 01084928 _____ (Farbar) C:\Users\Parent\Downloads\FRST.exe
2014-07-28 20:06 - 2011-02-09 19:03 - 00000000 ____D () C:\Users\Parent\Tracing
2014-07-27 22:21 - 2014-03-28 22:04 - 00000000 ____D () C:\Users\Parent\Desktop\signs
2014-07-27 22:02 - 2014-07-27 22:02 - 00000000 ____D () C:\Users\Parent\Downloads\OneDrive-2014-07-27
2014-07-27 21:35 - 2014-07-27 21:27 - 118735112 _____ () C:\Users\Parent\Downloads\OneDrive-2014-07-27.zip
2014-07-27 19:17 - 2014-07-27 19:16 - 00000000 ____D () C:\Users\Parent\Downloads\VA - Extended 80s - The Definitive 12inch Collection [3CD Box Set] (2014) MP3
2014-07-27 19:13 - 2014-07-27 19:12 - 00000000 ____D () C:\Users\Parent\Downloads\The.House.Of.Magic.2013.BDRip.XviD.MP3-RARBG
2014-07-27 18:33 - 2014-07-27 18:33 - 00000000 ____D () C:\Users\Parent\Downloads\Skrillex - Recess [2014] [Mp3-256]-V3nom [GLT]
2014-07-26 20:34 - 2014-01-07 21:00 - 00000693 _____ () C:\Users\Parent\AppData\Roaming\Rim.DesktopHelper.Exception.log
2014-07-26 20:34 - 2014-01-07 21:00 - 00000693 _____ () C:\Users\Parent\AppData\Roaming\Rim.Desktop.Exception.log
2014-07-26 19:39 - 2014-07-26 19:38 - 00000000 ____D () C:\Users\Parent\Downloads\The.Expendables.3.2014.DVDSCR.Xvid-DiNGO
2014-07-26 19:31 - 2014-07-26 19:31 - 00003288 ____N () C:\bootsqm.dat
2014-07-25 09:02 - 2011-11-12 19:15 - 00000000 ____D () C:\Users\Parent\Documents\emily
2014-07-24 20:35 - 2014-07-24 20:35 - 00000000 ____D () C:\Users\Parent\AppData\Local\{C45AACE7-3EA7-4C74-A327-FB219B6B9A13}
2014-07-21 11:39 - 2014-07-18 15:50 - 00000000 ____D () C:\Users\Parent\AppData\Local\{E67F3A57-6FBD-4517-B45E-CB13A3122336}
2014-07-18 22:18 - 2014-07-18 21:53 - 00000000 ____D () C:\Users\Parent\Downloads\Ministry of Sound Tech House (2014) (320kbps) (AciDToX8)
2014-07-18 21:56 - 2013-12-08 17:17 - 00002129 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-07-18 21:52 - 2014-07-18 21:52 - 00000000 ____D () C:\Users\Parent\Downloads\Ministry Of Sound The Sound Of Deep House 2 (2014)
2014-07-18 18:27 - 2014-07-18 18:19 - 00000000 ____D () C:\Users\Parent\Downloads\The.Fault.In.Our.Stars.2014.CAM.XviD.MP3-RARBG
2014-07-18 18:10 - 2014-07-18 18:10 - 00000000 ____D () C:\Users\Parent\Downloads\The Fault In Our Stars 2014 HDCAM FIRST CAM x264 Pimp4003
2014-07-18 17:37 - 2014-07-18 17:28 - 00000000 ____D () C:\Users\Parent\Downloads\The Fault In Our Stars 2014 CAM AAC x264-SSDD
2014-07-17 15:44 - 2014-07-17 15:44 - 00000000 ____D () C:\Users\Parent\AppData\Local\{E7781484-0BED-4432-BF95-A3ED1557EAE0}
2014-07-15 21:18 - 2014-07-15 21:18 - 00000000 ____D () C:\Users\Parent\Downloads\OneDrive-2014-07-15
2014-07-15 21:16 - 2014-07-15 21:16 - 08195334 _____ () C:\Users\Parent\Downloads\OneDrive-2014-07-15.zip
2014-07-15 21:02 - 2014-07-14 08:18 - 00000000 ____D () C:\Users\Parent\AppData\Local\Adobe
2014-07-13 22:19 - 2014-07-13 22:18 - 00000000 ____D () C:\Users\Parent\Downloads\OneDrive-2014-07-13 (1)
2014-07-13 22:17 - 2014-07-13 21:48 - 401674066 _____ () C:\Users\Parent\Downloads\OneDrive-2014-07-13 (1).zip
2014-07-13 19:42 - 2014-07-13 19:42 - 00000000 ____D () C:\Users\Parent\Downloads\OneDrive-2014-07-13
2014-07-13 19:41 - 2014-07-13 19:37 - 58479947 _____ () C:\Users\Parent\Downloads\OneDrive-2014-07-13.zip
2014-07-11 15:09 - 2013-06-28 17:18 - 00001169 _____ () C:\Users\Parent\Desktop\ROBLOX Studio 2013.lnk
2014-07-11 15:09 - 2012-09-22 13:47 - 00001350 _____ () C:\Users\Parent\Desktop\ROBLOX Player.lnk
2014-07-11 15:09 - 2011-05-13 07:41 - 00000000 ____D () C:\Users\Parent\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Roblox
2014-07-10 20:49 - 2014-01-19 11:25 - 00000000 ____D () C:\Users\Parent\Desktop\Ross
2014-07-09 20:20 - 2014-07-09 20:20 - 00010051 _____ () C:\Users\Parent\Downloads\VW_CLUB_-_Czech_Republic-vector-logo-BACA5ED57B-seeklogo.com.zip
2014-07-09 20:19 - 2014-07-09 20:19 - 00009842 _____ () C:\Users\Parent\Downloads\vw-combi-lateral-vector-logo-A8591F7937-seeklogo.com.zip
2014-07-08 21:01 - 2012-05-08 20:55 - 00699056 _____ (Adobe Systems Incorporated) C:\windows\system32\FlashPlayerApp.exe
2014-07-08 21:01 - 2011-08-29 17:17 - 00071344 _____ (Adobe Systems Incorporated) C:\windows\system32\FlashPlayerCPLApp.cpl

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\windows\explorer.exe => File is digitally signed
C:\windows\system32\winlogon.exe => File is digitally signed
C:\windows\system32\wininit.exe => File is digitally signed
C:\windows\system32\svchost.exe => File is digitally signed
C:\windows\system32\services.exe => File is digitally signed
C:\windows\system32\User32.dll => File is digitally signed
C:\windows\system32\userinit.exe => File is digitally signed
C:\windows\system32\rpcss.dll => File is digitally signed
C:\windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2014-07-18 19:20

==================== End Of Log ============================

Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted

Have you installed any type of program that puts these Group Policies on all of these:
 

HKLM Group Policy restriction on software: C:\Program Files\Malwarebytes' Anti-Malware <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files\Microsoft Security Client <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Malwarebytes <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Malwarebytes <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Malwarebytes <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files\Microsoft Security Client <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files\Microsoft Security Client <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files\Microsoft Security Client <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files\Microsoft Security Client <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files\Malwarebytes' Anti-Malware <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Malwarebytes <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Malwarebytes <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Malwarebytes <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files\Malwarebytes' Anti-Malware <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files\Microsoft Security Client <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files\Microsoft Security Client <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files\Malwarebytes' Anti-Malware <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files\Malwarebytes' Anti-Malware <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files\Malwarebytes' Anti-Malware <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files\Malwarebytes' Anti-Malware <====== ATTENTION

 

MrC

Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted

Lets try it again.....

Download the attached fixlist.txt to the same folder as FRST.exe/FRST64.exe.

Run FRST.exe/FRST64.exe and click Fix only once and wait

The tool will create a log (Fixlog.txt) in the folder, please post it to your reply.

MrC

Link to post
Share on other sites
rossco

rossco

Posted
  • Author
Posted
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version:30-07-2014

Ran by Parent at 2014-08-03 22:24:35 Run:2

Running from C:\Users\Parent\Downloads

Boot Mode: Normal

 

==============================================

 

Content of fixlist:

*****************

HKLM Group Policy restriction on software: C:\Program Files\Malwarebytes' Anti-Malware <====== ATTENTION

HKLM Group Policy restriction on software: C:\Program Files\Microsoft Security Client <====== ATTENTION

HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Malwarebytes <====== ATTENTION

HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware <====== ATTENTION

HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Malwarebytes <====== ATTENTION

HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION

HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Malwarebytes <====== ATTENTION

HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION

HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION

HKLM Group Policy restriction on software: C:\Program Files\Microsoft Security Client <====== ATTENTION

HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION

HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware <====== ATTENTION

HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION

HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION

HKLM Group Policy restriction on software: C:\Program Files\Microsoft Security Client <====== ATTENTION

HKLM Group Policy restriction on software: C:\Program Files\Microsoft Security Client <====== ATTENTION

HKLM Group Policy restriction on software: C:\Program Files\Microsoft Security Client <====== ATTENTION

HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware <====== ATTENTION

HKLM Group Policy restriction on software: C:\Program Files\Malwarebytes' Anti-Malware <====== ATTENTION

HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Malwarebytes <====== ATTENTION

HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Malwarebytes <====== ATTENTION

HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Malwarebytes <====== ATTENTION

HKLM Group Policy restriction on software: C:\Program Files\Malwarebytes' Anti-Malware <====== ATTENTION

HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware <====== ATTENTION

HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware <====== ATTENTION

HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware <====== ATTENTION

HKLM Group Policy restriction on software: C:\Program Files\Microsoft Security Client <====== ATTENTION

HKLM Group Policy restriction on software: C:\Program Files\Microsoft Security Client <====== ATTENTION

HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION

HKLM Group Policy restriction on software: C:\Program Files\Malwarebytes' Anti-Malware <====== ATTENTION

HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware <====== ATTENTION

HKLM Group Policy restriction on software: C:\Program Files\Malwarebytes' Anti-Malware <====== ATTENTION

HKLM Group Policy restriction on software: C:\Program Files\Malwarebytes' Anti-Malware <====== ATTENTION

HKLM Group Policy restriction on software: C:\Program Files\Malwarebytes' Anti-Malware <====== ATTENTION

 

*****************

 

HKLM => Unable to delete Group Policy Restriction on software

HKLM => Unable to delete Group Policy Restriction on software

HKLM => Unable to delete Group Policy Restriction on software

HKLM => Unable to delete Group Policy Restriction on software

HKLM => Unable to delete Group Policy Restriction on software

HKLM => Unable to delete Group Policy Restriction on software

HKLM => Unable to delete Group Policy Restriction on software

HKLM => Unable to delete Group Policy Restriction on software

HKLM => Unable to delete Group Policy Restriction on software

HKLM => Unable to delete Group Policy Restriction on software

HKLM => Unable to delete Group Policy Restriction on software

HKLM => Unable to delete Group Policy Restriction on software

HKLM => Unable to delete Group Policy Restriction on software

HKLM => Unable to delete Group Policy Restriction on software

HKLM => Unable to delete Group Policy Restriction on software

HKLM => Unable to delete Group Policy Restriction on software

HKLM => Unable to delete Group Policy Restriction on software

HKLM => Unable to delete Group Policy Restriction on software

HKLM => Unable to delete Group Policy Restriction on software

HKLM => Unable to delete Group Policy Restriction on software

HKLM => Unable to delete Group Policy Restriction on software

HKLM => Unable to delete Group Policy Restriction on software

HKLM => Unable to delete Group Policy Restriction on software

HKLM => Unable to delete Group Policy Restriction on software

HKLM => Unable to delete Group Policy Restriction on software

HKLM => Unable to delete Group Policy Restriction on software

HKLM => Unable to delete Group Policy Restriction on software

HKLM => Unable to delete Group Policy Restriction on software

HKLM => Unable to delete Group Policy Restriction on software

HKLM => Unable to delete Group Policy Restriction on software

HKLM => Unable to delete Group Policy Restriction on software

HKLM => Unable to delete Group Policy Restriction on software

HKLM => Unable to delete Group Policy Restriction on software

HKLM => Unable to delete Group Policy Restriction on software

 

==== End of Fixlog ====
Link to post
Share on other sites
rossco

rossco

Posted
  • Author
Posted

I have re downloaded roguekiller and scanned, here is the report, thanks

 

RogueKiller V9.2.4.0 [Jul 11 2014] by Adlice Software
 
Operating System : Windows 7 (6.1.7601 Service Pack 1) 32 bits version
Started in : Normal mode
User : Parent [Admin rights]
Mode : Scan -- Date : 08/03/2014  23:09:35
 
¤¤¤ Bad processes : 0 ¤¤¤
 
¤¤¤ Registry Entries : 15 ¤¤¤
[suspicious.Path] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\catchme -> FOUND
[suspicious.Path] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\mbr -> FOUND
[suspicious.Path] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\catchme -> FOUND
[suspicious.Path] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\mbr -> FOUND
[suspicious.Path] HKEY_LOCAL_MACHINE\System\ControlSet002\Services\catchme -> FOUND
[PUM.Dns] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{648DAEC7-293D-4C5A-9C9B-D129E8B1AB10} | DhcpNameServer : 172.20.10.1  -> FOUND
[PUM.Dns] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{FF0EB4DB-AF8C-484B-A843-8ADA9FE73C5A} | DhcpNameServer : 172.30.139.17 172.31.139.17  -> FOUND
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{648DAEC7-293D-4C5A-9C9B-D129E8B1AB10} | DhcpNameServer : 172.20.10.1  -> FOUND
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{FF0EB4DB-AF8C-484B-A843-8ADA9FE73C5A} | DhcpNameServer : 172.30.139.17 172.31.139.17  -> FOUND
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Tcpip\Parameters\Interfaces\{648DAEC7-293D-4C5A-9C9B-D129E8B1AB10} | DhcpNameServer : 172.20.10.1  -> FOUND
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Tcpip\Parameters\Interfaces\{FF0EB4DB-AF8C-484B-A843-8ADA9FE73C5A} | DhcpNameServer : 172.30.139.17 172.31.139.17  -> FOUND
[PUM.Policies] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System | DisableRegistryTools : 0  -> FOUND
[PUM.StartMenu] HKEY_USERS\S-1-5-21-502250249-1756045401-4193677544-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowMyGames : 0  -> FOUND
[PUM.DesktopIcons] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1  -> FOUND
[PUM.DesktopIcons] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1  -> FOUND
 
¤¤¤ Scheduled tasks : 0 ¤¤¤
 
¤¤¤ Files : 0 ¤¤¤
 
¤¤¤ HOSTS File : 1 ¤¤¤
[C:\windows\System32\drivers\etc\hosts] 127.0.0.1       localhost
 
¤¤¤ Antirootkit : 2 (Driver: LOADED) ¤¤¤
[sSDT:Addr(Hook.SSDT)] NtWriteVirtualMemory[399] : C:\ProgramData\Trusteer\Rapport\store\exts\RapportCerberus\baseline\RapportCerberus32_59849.sys @ 0x90560480
[Filter(Root.Keylogger)] \Driver\kbdclass @ \Device\KeyboardClass0 : \Driver\SynTP @ \Device\0000007e (\SystemRoot\system32\DRIVERS\Rt86win7.sys)
 
¤¤¤ Web browsers : 0 ¤¤¤
 
¤¤¤ MBR Check : ¤¤¤
+++++ PhysicalDrive0: SAMSUNG HM160HI +++++
--- User ---
[MBR] 98113a4f6d6f93a3ccf6471d0c47cf44
[bSP] b669e0312c6a4428711d1a1bcd9b1da1 : Kiwi MBR Code
Partition table:
0 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 2048 | Size: 15352 MB
1 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 31442944 | Size: 95 MB
2 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 31637504 | Size: 137179 MB
User = LL1 ... OK
User = LL2 ... OK
 
 
============================================
RKreport_DEL_08012014_211325.log - RKreport_SCN_07312014_223551.log - RKreport_SCN_08012014_211106.log
Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted

OK, let try and fix them in recovery mode: (you'll need a usb flash drive)

  • On a clean machine, please download Farbar Recovery Scan Tool and save it to a flash drive.

    Note: You need to run the version compatible with your system.

    Plug the flashdrive into the infected PC.

  • If you are using Windows 8 consult How to use the Windows 8 System Recovery Environment Command Prompt to enter System Recovery Command prompt.

    If you are using Vista or Windows 7 enter System Recovery Options.

    To enter System Recovery Options from the Advanced Boot Options:

    • Restart the computer.
    • As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
    • Use the arrow keys to select the Repair your computer menu item.
    • Select US as the keyboard language settings, and then click Next.
    • Select the operating system you want to repair, and then click Next.
    • Select your user account an click Next.
    Note: In case you can not enter System Recovery Options by using F8 method, you can use Windows installation disc, or make a repair disc. Any Windows installation disc or a repair disc made on another computer can be used.

    To make a repair disk on Windows 7 consult: http://www.sevenforums.com/tutorials/2083-system-repair-disc-create.html

    To enter System Recovery Options by using Windows installation disc:

    • Insert the installation disc.
    • Restart your computer.
    • If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
    • Click Repair your computer.
    • Select US as the keyboard language settings, and then click Next.
    • Select the operating system you want to repair, and then click Next.
    • Select your user account and click Next.
  • On the System Recovery Options menu you will get the following options:

    Startup Repair

    System Restore

    Windows Complete PC Restore

    Windows Memory Diagnostic Tool

    Command Prompt

    Select Command Prompt

  • Once in the Command Prompt:
    • In the command window type in notepad and press Enter.
    • The notepad opens. Under File menu select Open.
    • Select "Computer" and find your flash drive letter and close the notepad.
    • In the command window type e:\frst (for x64 bit version type e:\frst64) and press Enter

      Note: Replace letter e with the drive letter of your flash drive.

    • The tool will start to run.
    • When the tool opens click Yes to disclaimer.
    • Press Scan button.
    • It will make a log (FRST.txt) on the flash drive. Please copy and paste it to your reply.
  • MrC
Link to post
Share on other sites
  • Root Admin
AdvancedSetup

AdvancedSetup

Posted
  • Root Admin
Posted

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.