Potential Treats that wont quaratine

Despise · August 5, 2014

Hello,

I have run about 50 scans in normal windows mode and safe mode but these two keep appearing and i ask it to quarantine as it recommends and then still pops back up. Could anybody please advise me on what to do with this PUP.Optional.Trovigo.A

Thanks,

Paul

deeprybka · August 5, 2014

Hi & :welcome:

My name is Jürgen and I will be assisting you with your Malware related problems.

Before we move on, please read the following points carefully. :excl:

My native language isn't English. So please do not use slang or idioms. It could be hard for me to read. Thanks for your understanding.
Please read my instructions completely. If there is anything that you do not understand kindly ask before proceeding.
Perform everything in the correct order. Sometimes one step requires the previous one.
If you have any problems while you are follow my instructions, Stop there and tell me the exact nature of your problem.
Do not run any other scans without instruction or Add/ Remove Software unless I tell you to do so. This would change the output of our tools and could be confusing for me.
Post all Logfiles as a reply rather than as an attachment unless I specifically ask you. If you can not post all logfiles in one reply, feel free to use more posts.
If I don't hear from you within 3 days from this initial or any subsequent post, then this thread will be closed.
Stay with me. I will give you some advice about prevention after the cleanup process. Absence of symptoms does not always mean the computer is clean.

P2P/Piracy Warning:

If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall them or completely disable them from running while being assisted here.
Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.
If you have illegal/cracked software, cracks, keygens, etc. on the system, please remove or uninstall them now and read the policy on Piracy.

Step 1

Please run a FRST scan. This will help us diagnose your problem.

Please download Farbar Recovery Scan Tool and save it to your Desktop.

(If you are not sure which version (32-/64-bit) applies to your system, download and try to start both of them as just the right one will run.)

Start FRST with administator privileges.
Make sure the option Addition.txt is checked and press the Scan button.
When finished, FRST will produce two logs (FRST.txt and Addition.txt) in the same directory the tool was run from.
Please copy and paste these logs in your next reply.

Despise · August 5, 2014

Hello Buddy,

Thanks for the quick response. I hope i have done it correctly.

Paul

deeprybka · August 5, 2014

Hi,

where are the logs?

Despise · August 5, 2014

I didnt press the little attach this file icon did i

FRST.txt

deeprybka · August 5, 2014

and the Addition.txt please!

Despise · August 5, 2014

May i add, I have Bitcomet on my computer as i share videos with a editor for our clans youtube channel.

Despise · August 5, 2014

As requested

Addition.txt

deeprybka · August 5, 2014

Post up the log...

deeprybka · August 5, 2014

Step 1

Scan with Malwarebytes Antimalware

Please update the database by clicking on the "Update Now" button.
Following the update and click "Settings" and go to "Detection and Protection"
Make sure "Scan for Rootkits" is checked.
Click on Dashboard, then click on Scan Now to start the scan.
(If Malware or Potentially Unwanted Programs [PUPs] are found, you will receive a prompt so that you can decide what you want to do. I suggest "Quarantine". Click the button: Apply All Actions.)
A window with an option to view the detailed log will appear. Click on "View Detailed Log".
After viewing the results, please click on the "Copy to Clipboard" button and then OK.
Return to our forum. Paste your log into your next reply.

Step 2

Please download AdwCleaner (by Xplode) and save it to your Desktop.

Double click on AdwCleaner.exe to run the tool.
Vista/Windows 7/8 users right-click and select "Run As Administrator"
Click on the Scan button.
After the scan has finished, click on the Clean button.
Press OK when asked to close all programs and follow the onscreen prompts.
After rebooting, a log file (that is saved in C:\AdwCleaner[s#].txt) will open automatically.
Copy and paste the contents of that logfile in your next reply.

Step 3

Start FRST with administator privileges.

Press the Scan button.
When finished, FRST will produce a log (FRST.txt) in the same directory the tool was run from.
Please copy and paste the log in your next reply.

Despise · August 5, 2014

Malwarebytes Anti-Malware

www.malwarebytes.org

Scan Date: 05/08/2014

Scan Time: 20:18:33

Logfile:

Administrator: No

Version: 2.00.2.1012

Malware Database: v2014.08.05.08

Rootkit Database: v2014.08.04.01

License: Free

Malware Protection: Disabled

Malicious Website Protection: Disabled

Self-protection: Disabled

OS: Windows 7 Service Pack 1

CPU: x64

File System: NTFS

User: Paul

Scan Type: Threat Scan

Result: Completed

Objects Scanned: 291571

Time Elapsed: 3 min, 32 sec

Memory: Enabled

Startup: Enabled

Filesystem: Enabled

Archives: Enabled

Rootkits: Enabled

Heuristics: Enabled

PUP: Enabled

PUM: Enabled

Processes: 0

(No malicious items detected)

Modules: 0

(No malicious items detected)

Registry Keys: 0

(No malicious items detected)

Registry Values: 0

(No malicious items detected)

Registry Data: 0

(No malicious items detected)

Folders: 0

(No malicious items detected)

Files: 2

PUP.Optional.Trovigo.A, C:\Users\Paul\AppData\Local\Google\Chrome\User Data\Default\Preferences, Good: (), Bad: ( "homepage": ""http://www.google.com/" ],), ,[629a388a166562d4d5d8ef044db7718f]

Physical Sectors: 0

(No malicious items detected)

(end)

Despise · August 5, 2014

As requested

AdwCleanerS0.txt

FRST.txt

Despise · August 5, 2014

Still have the same two files popping up .... Grrrr ....

Malwarebytes Anti-Malware

www.malwarebytes.org

Scan Date: 05/08/2014

Scan Time: 20:48:03

Logfile:

Administrator: No

Version: 2.00.2.1012

Malware Database: v2014.08.05.08

Rootkit Database: v2014.08.04.01

License: Free

Malware Protection: Disabled

Malicious Website Protection: Disabled

Self-protection: Disabled

OS: Windows 7 Service Pack 1

CPU: x64

File System: NTFS

User: Paul

Scan Type: Threat Scan

Result: Completed

Objects Scanned: 291543

Time Elapsed: 2 min, 56 sec

Memory: Enabled

Startup: Enabled

Filesystem: Enabled

Archives: Enabled

Rootkits: Enabled

Heuristics: Enabled

PUP: Enabled

PUM: Enabled

Processes: 0

(No malicious items detected)

Modules: 0

(No malicious items detected)

Registry Keys: 0

(No malicious items detected)

Registry Values: 0

(No malicious items detected)

Registry Data: 0

(No malicious items detected)

Folders: 0

(No malicious items detected)

Files: 2

PUP.Optional.Trovigo.A, C:\Users\Paul\AppData\Local\Google\Chrome\User Data\Default\Preferences, Good: (), Bad: ( "homepage": ""http://www.google.com/" ],), ,[27d55f63710a5cda04a9f5fed52f758b]

Physical Sectors: 0

(No malicious items detected)

(end)

deeprybka · August 5, 2014

Yes, but no proplem...

Please do this:

https://support.google.com/chrome/answer/3296214?hl=en-GB

Afterwards, please run Malwarebytes again and post up the log...

Despise · August 5, 2014

Malwarebytes Anti-Malware

www.malwarebytes.org

Scan Date: 05/08/2014

Scan Time: 21:41:42

Logfile:

Administrator: No

Version: 2.00.2.1012

Malware Database: v2014.08.05.08

Rootkit Database: v2014.08.04.01

License: Free

Malware Protection: Disabled

Malicious Website Protection: Disabled

Self-protection: Disabled

OS: Windows 7 Service Pack 1

CPU: x64

File System: NTFS

User: Paul

Scan Type: Threat Scan

Result: Completed

Objects Scanned: 291934

Time Elapsed: 4 min, 6 sec

Memory: Enabled

Startup: Enabled

Filesystem: Enabled

Archives: Enabled

Rootkits: Enabled

Heuristics: Enabled

PUP: Enabled

PUM: Enabled

Processes: 0

(No malicious items detected)

Modules: 0

(No malicious items detected)

Registry Keys: 0

(No malicious items detected)

Registry Values: 0

(No malicious items detected)

Registry Data: 0

(No malicious items detected)

Folders: 0

(No malicious items detected)

Files: 2

PUP.Optional.Trovigo.A, C:\Users\Paul\AppData\Local\Google\Chrome\User Data\Default\Preferences, Good: (), Bad: ( "homepage": ""http://www.google.com/" ],), ,[6a920bb7f28952e41598bc376a9a5da3]

Physical Sectors: 0

(No malicious items detected)

(end)

deeprybka · August 5, 2014

Hi,

Start FRST with administator privileges.

Press the Scan button.
When finished, FRST will produce a log (FRST.txt) in the same directory the tool was run from.
Please copy and paste the log in your next reply.

Despise · August 5, 2014

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-08-2014

Ran by Paul (administrator) on PAUL-PC on 05-08-2014 22:11:19

Running from C:\Users\Paul\Desktop

Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: English (United States)

Internet Explorer Version 11

Boot Mode: Normal

The only official download link for FRST:

Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/

Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/

Download link from any site other than Bleeping Computer is unpermitted or outdated.

See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(BlueStack Systems, Inc.) C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe

(Corsair Components, Inc.) C:\Program Files (x86)\Corsair\Corsair Link\CorsairLINK_HardwareMonitor.exe

(BlueStack Systems, Inc.) C:\Program Files (x86)\BlueStacks\HD-UpdaterService.exe

(Creative Technology Ltd) C:\Windows\SysWOW64\CtHdaSvc.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe

(Qualcomm Atheros) C:\Program Files\Qualcomm Atheros\Network Manager\KillerService.exe

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe

(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe

(Intel Corporation) C:\Windows\System32\igfxsrvc.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(BlueStack Systems, Inc.) C:\Program Files (x86)\BlueStacks\HD-Service.exe

() C:\Program Files\Qualcomm Atheros\Network Manager\NetworkManager.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE

(Corsair Components, Inc.) C:\Program Files (x86)\Corsair\Corsair Headset Software\HeadsetControlPanel.exe

(Razer USA Ltd) C:\Program Files (x86)\Razer\Lachesis 5600\LachesisSysTray.exe

(BlueStack Systems, Inc.) C:\Program Files (x86)\BlueStacks\HD-Agent.exe

(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

(BlueStack Systems) C:\Program Files (x86)\BlueStacks\HD-Network.exe

(BlueStack Systems) C:\Program Files (x86)\BlueStacks\HD-BlockDevice.exe

(BlueStack Systems) C:\Program Files (x86)\BlueStacks\HD-SharedFolder.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe

(S2 Games) D:\Heroes of Newerth\hon.exe

(Valve Corporation) C:\Program Files (x86)\Steam\GameOverlayUI.exe

(Khrona LLC) D:\Heroes of Newerth\AwesomiumProcess.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2403104 2014-07-25] (NVIDIA Corporation)

HKLM\...\Run: [shadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart

HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [1271072 2014-03-11] (Microsoft Corporation)

HKLM-x32\...\Run: [Corsair Headset Software] => C:\Program Files (x86)\Corsair\Corsair Headset Software\HeadsetControlPanel.exe [3167544 2014-02-12] (Corsair Components, Inc.)

HKLM-x32\...\Run: [Razer Lachesis Driver] => C:\Program Files (x86)\Razer\Lachesis 5600\LachesisSysTray.exe [837008 2011-03-09] (Razer USA Ltd)

HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2014-05-08] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [blueStacks Agent] => C:\Program Files (x86)\BlueStacks\HD-Agent.exe [832272 2014-06-23] (BlueStack Systems, Inc.)

HKLM-x32\...\Run: [sunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-11] (Oracle Corporation)

Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)

HKU\S-1-5-21-893713004-3942323775-2981293478-1000\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3696912 2014-03-04] (Disc Soft Ltd)

HKU\S-1-5-21-893713004-3942323775-2981293478-1000\...\MountPoints2: {7664a87c-f2c6-11e3-bf34-74d435825ad1} - I:\Startme.exe

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Killer Network Manager.lnk

ShortcutTarget: Killer Network Manager.lnk -> C:\Windows\Installer\{7411487A-FF21-481E-AB53-BF27FF30E042}\NetworkManager.exe_130C27D738F34C89BDDF21BCFD74B56D.exe (Flexera Software LLC)

ShellIconOverlayIdentifiers: SkyDrivePro1 (ErrorConflict) -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers: SkyDrivePro2 (SyncInProgress) -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers: SkyDrivePro3 (InSync) -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers-x32: SkyDrivePro1 (ErrorConflict) -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers-x32: SkyDrivePro2 (SyncInProgress) -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers-x32: SkyDrivePro3 (InSync) -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://uk.msn.com/?ocid=iehp

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xF84929642C48CF01

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-gb

BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)

BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)

BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)

BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)

BHO-x32: Java Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)

BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)

BHO-x32: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL (Microsoft Corporation)

Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

FireFox:

========

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_145.dll ()

FF Plugin: @microsoft.com/GENUINE -> disabled No File

FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~2\Office15\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll ()

FF Plugin-x32: @java.com/DTPlugin,version=10.65.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.65.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File

FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~3\Office15\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)

FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll (Microsoft Corporation)

Chrome:

=======

CHR HomePage: hxxp://www.trovigo.com/?gd=&ctid=CT3319434&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=5&UP=SP69468449-AE9E-46A1-B671-167592C226B9&SSPV=

CHR StartupUrls: "hxxp://www.trovigo.com/?gd=&ctid=CT3319434&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=5&UP=SP69468449-AE9E-46A1-B671-167592C226B9&SSPV=", "", "hxxp://www.google.com/"

CHR Extension: (Google Docs) - C:\Users\Paul\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-03-25]

CHR Extension: (Google Drive) - C:\Users\Paul\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-03-25]

CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Paul\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-08-02]

CHR Extension: (YouTube) - C:\Users\Paul\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-03-25]

CHR Extension: (Google Search) - C:\Users\Paul\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-03-25]

CHR Extension: (AdBlock) - C:\Users\Paul\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2014-04-11]

CHR Extension: (Google Wallet) - C:\Users\Paul\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-03-25]

CHR Extension: (Click&Clean App) - C:\Users\Paul\AppData\Local\Google\Chrome\User Data\Default\Extensions\pdabfienifkbhoihedcgeogidfmibmhp [2014-03-25]

CHR Extension: (Gmail) - C:\Users\Paul\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-03-25]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [49152 2014-03-25] () [File not signed]

S3 BITCOMET_HELPER_SERVICE; C:\Program Files\BitComet\tools\BitCometService.exe [1296728 2013-11-29] (www.BitComet.com)

R2 BstHdAndroidSvc; C:\Program Files (x86)\BlueStacks\HD-Service.exe [406288 2014-06-23] (BlueStack Systems, Inc.)

R2 BstHdLogRotatorSvc; C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe [385808 2014-06-23] (BlueStack Systems, Inc.)

R2 BstHdUpdaterSvc; C:\Program Files (x86)\BlueStacks\HD-UpdaterService.exe [774928 2014-06-23] (BlueStack Systems, Inc.)

R2 CtHdaSvc; C:\Windows\sysWow64\CtHdaSvc.exe [103936 2014-04-29] (Creative Technology Ltd)

R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2014-03-11] (Microsoft Corporation)

R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [347872 2014-03-11] (Microsoft Corporation)

R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1720608 2014-07-25] (NVIDIA Corporation)

R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [18956064 2014-07-25] (NVIDIA Corporation)

R2 Qualcomm Atheros Killer Service V2; C:\Program Files\Qualcomm Atheros\Network Manager\KillerService.exe [344576 2013-12-09] (Qualcomm Atheros) [File not signed]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R1 BfLwf; C:\Windows\System32\DRIVERS\bflwfx64.sys [80080 2013-11-08] (Qualcomm Atheros, Inc.)

R2 BstHdDrv; C:\Program Files (x86)\BlueStacks\HD-Hypervisor-amd64.sys [123152 2014-06-23] (BlueStack Systems)

R3 CorsairAudioFilter; C:\Windows\System32\DRIVERS\corsveng2kamd64.sys [109912 2014-02-04] (Corsair Components, Inc.)

R3 cthda; C:\Windows\System32\drivers\cthda.sys [1050904 2014-04-29] (Creative Technology Ltd)

R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2014-05-23] (Disc Soft Ltd)

R3 Ke2200; C:\Windows\System32\DRIVERS\e22w7x64.sys [154320 2013-03-20] (Qualcomm Atheros, Inc.)

R3 MEIx64; C:\Windows\System32\DRIVERS\TeeDriverx64.sys [99800 2014-03-26] (Intel Corporation)

R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [268512 2014-01-25] (Microsoft Corporation)

R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [133928 2014-03-11] (Microsoft Corporation)

R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [20256 2014-07-25] (NVIDIA Corporation)

R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [40392 2014-03-31] (NVIDIA Corporation)

R1 Serial; C:\Windows\System32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)

S3 GPUZ; \??\C:\Windows\TEMP\GPUZ.sys [X]

R3 WinRing0_1_2_0; \??\C:\Program Files (x86)\Corsair\Corsair Link\CorsairLINK_HardwareMonitor.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)

==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-05 20:25 - 2014-08-05 22:11 - 00016566 _____ () C:\Users\Paul\Desktop\FRST.txt

2014-08-05 20:24 - 2014-08-05 20:24 - 00001446 _____ () C:\Users\Paul\Desktop\AdwCleaner[s0].txt

2014-08-05 20:23 - 2014-08-05 20:24 - 00000000 ____D () C:\AdwCleaner

2014-08-05 20:23 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll

2014-08-05 20:19 - 2014-08-05 19:28 - 02094080 _____ (Farbar) C:\Users\Paul\Desktop\FRST64.exe

2014-08-05 19:28 - 2014-08-05 22:11 - 00000000 ____D () C:\FRST

2014-08-05 19:03 - 2014-08-05 19:03 - 00001696 _____ () C:\Users\Paul\Desktop\PUP.Optional.Trovigo.A

2014-08-05 18:13 - 2014-08-05 18:13 - 00001136 _____ () C:\Users\Paul\Desktop\Watch_Dogs - Shortcut.lnk

2014-08-05 17:39 - 2014-08-05 17:39 - 00000000 ____D () C:\Users\Paul\Documents\My Games

2014-08-05 17:39 - 2014-08-05 17:39 - 00000000 ____D () C:\ProgramData\Orbit

2014-08-05 17:36 - 2014-08-05 17:36 - 00001208 _____ () C:\Users\Paul\Desktop\Uplay.lnk

2014-08-05 17:36 - 2014-08-05 17:36 - 00000000 ____D () C:\Users\Paul\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Ubisoft

2014-08-05 17:36 - 2014-08-05 17:36 - 00000000 ____D () C:\Users\Paul\AppData\Local\Ubisoft Game Launcher

2014-08-05 17:36 - 2014-08-05 17:36 - 00000000 ____D () C:\Program Files (x86)\Ubisoft

2014-08-05 12:34 - 2014-08-05 12:49 - 01195741 _____ () C:\Users\Paul\Desktop\Paul.pptx

2014-08-04 11:01 - 2014-08-04 11:01 - 00225312 _____ () C:\Users\Paul\Desktop\FAO Paul Barcz.eml

2014-08-03 10:44 - 2014-05-14 17:23 - 02477536 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll

2014-08-03 10:44 - 2014-05-14 17:23 - 00700384 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll

2014-08-03 10:44 - 2014-05-14 17:23 - 00581600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll

2014-08-03 10:44 - 2014-05-14 17:23 - 00058336 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe

2014-08-03 10:44 - 2014-05-14 17:23 - 00044512 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll

2014-08-03 10:44 - 2014-05-14 17:23 - 00038880 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll

2014-08-03 10:44 - 2014-05-14 17:23 - 00036320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll

2014-08-03 10:44 - 2014-05-14 17:21 - 02620928 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll

2014-08-03 10:44 - 2014-05-14 17:20 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll

2014-08-03 10:44 - 2014-05-14 17:17 - 00092672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll

2014-08-03 10:44 - 2014-05-14 09:23 - 00198600 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll

2014-08-03 10:44 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll

2014-08-03 10:44 - 2014-05-14 09:20 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe

2014-08-03 10:44 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe

2014-08-03 01:17 - 2014-08-05 17:35 - 00036870 _____ () C:\Windows\DirectX.log

2014-08-03 00:06 - 2014-08-05 20:24 - 00000972 _____ () C:\Windows\PFRO.log

2014-08-02 23:16 - 2014-08-02 23:17 - 00000000 ____D () C:\Windows\pss

2014-08-02 22:21 - 2014-08-05 21:41 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-08-02 22:21 - 2014-08-02 22:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-08-02 22:20 - 2014-08-02 22:21 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-08-02 22:20 - 2014-08-02 22:20 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-08-02 22:20 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2014-08-02 22:20 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2014-08-02 22:20 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2014-08-02 22:11 - 2014-07-02 18:44 - 00609240 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe

2014-08-02 22:08 - 2014-08-02 22:08 - 00000000 ____D () C:\NVIDIA

2014-08-02 22:07 - 2014-08-02 22:07 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe

2014-08-02 22:07 - 2014-08-02 22:07 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe

2014-08-02 22:07 - 2014-08-02 22:07 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe

2014-08-02 22:07 - 2014-08-02 22:07 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll

2014-08-02 22:07 - 2014-08-02 22:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java

2014-08-02 22:07 - 2014-08-02 22:07 - 00000000 ____D () C:\Program Files (x86)\Java

2014-07-30 19:58 - 2014-08-03 01:17 - 00003852 _____ () C:\Windows\windefendam.log

2014-07-30 19:58 - 2014-08-03 01:17 - 00000020 _____ () C:\Windows\capsys184523.log

2014-07-30 14:38 - 2014-07-30 14:38 - 00000000 ____D () C:\Program Files (x86)\AGEIA Technologies

2014-07-30 14:37 - 2014-07-02 21:48 - 31512520 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll

2014-07-30 14:37 - 2014-07-02 21:48 - 22994208 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll

2014-07-30 14:37 - 2014-07-02 21:48 - 18626304 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll

2014-07-30 14:37 - 2014-07-02 21:48 - 17555104 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll

2014-07-30 14:37 - 2014-07-02 21:48 - 16122344 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll

2014-07-30 14:37 - 2014-07-02 21:48 - 15294296 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll

2014-07-30 14:37 - 2014-07-02 21:48 - 13922752 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll

2014-07-30 14:37 - 2014-07-02 21:48 - 13835208 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll

2014-07-30 14:37 - 2014-07-02 21:48 - 12866008 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys

2014-07-30 14:37 - 2014-07-02 21:48 - 11283344 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll

2014-07-30 14:37 - 2014-07-02 21:48 - 11222048 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll

2014-07-30 14:37 - 2014-07-02 21:48 - 04247000 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll

2014-07-30 14:37 - 2014-07-02 21:48 - 03989960 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll

2014-07-30 14:37 - 2014-07-02 21:48 - 01890080 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6434052.dll

2014-07-30 14:37 - 2014-07-02 21:48 - 01539928 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6434052.dll

2014-07-30 14:37 - 2014-07-02 21:48 - 00944928 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll

2014-07-30 14:37 - 2014-07-02 21:48 - 00907096 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll

2014-07-30 14:37 - 2014-07-02 21:48 - 00903624 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll

2014-07-30 14:37 - 2014-07-02 21:48 - 00869152 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll

2014-07-30 14:37 - 2014-07-02 21:48 - 00846832 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll

2014-07-30 14:37 - 2014-07-02 21:48 - 00502232 _____ (NVIDIA Corporation) C:\Windows\system32\nvEncodeAPI64.dll

2014-07-30 14:37 - 2014-07-02 21:48 - 00418760 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvEncodeAPI.dll

2014-07-30 14:37 - 2014-07-02 21:48 - 00391640 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFROpenGL.dll

2014-07-30 14:37 - 2014-07-02 21:48 - 00354016 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll

2014-07-30 14:37 - 2014-07-02 21:48 - 00348120 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFROpenGL.dll

2014-07-30 14:37 - 2014-07-02 21:48 - 00305600 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll

2014-07-30 14:37 - 2014-07-02 21:48 - 00166568 _____ (NVIDIA Corporation) C:\Windows\system32\nvinitx.dll

2014-07-30 14:37 - 2014-07-02 21:48 - 00146480 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvinit.dll

2014-07-28 10:37 - 2014-08-05 20:24 - 00008432 _____ () C:\Windows\setupact.log

2014-07-28 10:37 - 2014-07-28 10:37 - 00000000 _____ () C:\Windows\setuperr.log

2014-07-27 23:35 - 2014-08-05 20:27 - 00569430 _____ () C:\Windows\WindowsUpdate.log

2014-07-09 15:47 - 2014-06-30 03:09 - 00519168 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll

2014-07-09 15:47 - 2014-06-30 03:04 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

2014-07-09 15:47 - 2014-06-05 15:45 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll

2014-07-09 15:47 - 2014-06-05 15:26 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll

2014-07-09 15:47 - 2014-06-05 15:25 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll

2014-07-09 15:46 - 2014-06-20 21:14 - 00266424 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll

2014-07-09 15:46 - 2014-06-20 20:39 - 00240824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll

2014-07-09 15:46 - 2014-06-19 02:39 - 23464448 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-07-09 15:46 - 2014-06-19 02:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-07-09 15:46 - 2014-06-19 02:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll

2014-07-09 15:46 - 2014-06-19 01:48 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2014-07-09 15:46 - 2014-06-19 01:42 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2014-07-09 15:46 - 2014-06-19 01:42 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2014-07-09 15:46 - 2014-06-19 01:41 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll

2014-07-09 15:46 - 2014-06-19 01:41 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll

2014-07-09 15:46 - 2014-06-19 01:32 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2014-07-09 15:46 - 2014-06-19 01:31 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2014-07-09 15:46 - 2014-06-19 01:26 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2014-07-09 15:46 - 2014-06-19 01:24 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2014-07-09 15:46 - 2014-06-19 01:24 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe

2014-07-09 15:46 - 2014-06-19 01:23 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2014-07-09 15:46 - 2014-06-19 01:16 - 17276416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-07-09 15:46 - 2014-06-19 01:14 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe

2014-07-09 15:46 - 2014-06-19 01:09 - 00452608 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll

2014-07-09 15:46 - 2014-06-19 00:59 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll

2014-07-09 15:46 - 2014-06-19 00:56 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-07-09 15:46 - 2014-06-19 00:53 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2014-07-09 15:46 - 2014-06-19 00:51 - 05721088 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2014-07-09 15:46 - 2014-06-19 00:50 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2014-07-09 15:46 - 2014-06-19 00:48 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2014-07-09 15:46 - 2014-06-19 00:39 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2014-07-09 15:46 - 2014-06-19 00:38 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2014-07-09 15:46 - 2014-06-19 00:37 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2014-07-09 15:46 - 2014-06-19 00:36 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll

2014-07-09 15:46 - 2014-06-19 00:35 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll

2014-07-09 15:46 - 2014-06-19 00:33 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2014-07-09 15:46 - 2014-06-19 00:32 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2014-07-09 15:46 - 2014-06-19 00:28 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2014-07-09 15:46 - 2014-06-19 00:28 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2014-07-09 15:46 - 2014-06-19 00:27 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2014-07-09 15:46 - 2014-06-19 00:27 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll

2014-07-09 15:46 - 2014-06-19 00:25 - 00442368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2014-07-09 15:46 - 2014-06-19 00:23 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2014-07-09 15:46 - 2014-06-19 00:22 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll

2014-07-09 15:46 - 2014-06-19 00:12 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll

2014-07-09 15:46 - 2014-06-19 00:06 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll

2014-07-09 15:46 - 2014-06-19 00:01 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll

2014-07-09 15:46 - 2014-06-18 23:59 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2014-07-09 15:46 - 2014-06-18 23:58 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2014-07-09 15:46 - 2014-06-18 23:58 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll

2014-07-09 15:46 - 2014-06-18 23:52 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2014-07-09 15:46 - 2014-06-18 23:51 - 13527040 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2014-07-09 15:46 - 2014-06-18 23:49 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2014-07-09 15:46 - 2014-06-18 23:46 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll

2014-07-09 15:46 - 2014-06-18 23:45 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2014-07-09 15:46 - 2014-06-18 23:35 - 11742208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2014-07-09 15:46 - 2014-06-18 23:34 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2014-07-09 15:46 - 2014-06-18 23:15 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2014-07-09 15:46 - 2014-06-18 23:13 - 01791488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2014-07-09 15:46 - 2014-06-18 23:09 - 01139200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2014-07-09 15:46 - 2014-06-18 23:07 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2014-07-09 15:46 - 2014-06-18 03:18 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\osk.exe

2014-07-09 15:46 - 2014-06-18 02:51 - 00646144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\osk.exe

2014-07-09 15:46 - 2014-06-18 02:10 - 03157504 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2014-07-09 15:46 - 2014-06-06 11:10 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll

2014-07-09 15:46 - 2014-06-06 10:44 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll

2014-07-09 15:46 - 2014-05-30 09:08 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll

2014-07-09 15:46 - 2014-05-30 09:08 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll

2014-07-09 15:46 - 2014-05-30 09:08 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll

2014-07-09 15:46 - 2014-05-30 09:08 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll

2014-07-09 15:46 - 2014-05-30 09:08 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll

2014-07-09 15:46 - 2014-05-30 09:08 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll

2014-07-09 15:46 - 2014-05-30 09:08 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll

2014-07-09 15:46 - 2014-05-30 08:52 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll

2014-07-09 15:46 - 2014-05-30 08:52 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll

2014-07-09 15:46 - 2014-05-30 08:52 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll

2014-07-09 15:46 - 2014-05-30 08:52 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll

2014-07-09 15:46 - 2014-05-30 08:52 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll

2014-07-09 15:46 - 2014-05-30 08:52 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll

2014-07-09 15:46 - 2014-05-30 08:52 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll

2014-07-09 15:46 - 2014-05-30 07:45 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-05 22:11 - 2014-08-05 20:25 - 00016566 _____ () C:\Users\Paul\Desktop\FRST.txt

2014-08-05 22:11 - 2014-08-05 19:28 - 00000000 ____D () C:\FRST

2014-08-05 22:11 - 2014-03-25 19:32 - 00000021 _____ () C:\Users\Paul\AppData\Roaming\config_data.dat

2014-08-05 21:41 - 2014-08-02 22:21 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-08-05 21:40 - 2014-03-25 14:16 - 00000894 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-08-05 21:15 - 2014-05-28 21:32 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-08-05 21:14 - 2014-03-25 14:25 - 00000000 ____D () C:\Program Files (x86)\Steam

2014-08-05 20:31 - 2009-07-14 05:45 - 00021904 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-08-05 20:31 - 2009-07-14 05:45 - 00021904 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-08-05 20:30 - 2009-07-14 06:13 - 00782470 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-08-05 20:27 - 2014-07-27 23:35 - 00569430 _____ () C:\Windows\WindowsUpdate.log

2014-08-05 20:24 - 2014-08-05 20:24 - 00001446 _____ () C:\Users\Paul\Desktop\AdwCleaner[s0].txt

2014-08-05 20:24 - 2014-08-05 20:23 - 00000000 ____D () C:\AdwCleaner

2014-08-05 20:24 - 2014-08-03 00:06 - 00000972 _____ () C:\Windows\PFRO.log

2014-08-05 20:24 - 2014-07-28 10:37 - 00008432 _____ () C:\Windows\setupact.log

2014-08-05 20:24 - 2014-04-01 14:54 - 00000258 _____ () C:\Windows\Tasks\CCleanerClean.job

2014-08-05 20:24 - 2014-03-25 14:16 - 00000890 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-08-05 20:24 - 2014-03-25 14:08 - 00000000 ____D () C:\ProgramData\NVIDIA

2014-08-05 20:24 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-08-05 19:28 - 2014-08-05 20:19 - 02094080 _____ (Farbar) C:\Users\Paul\Desktop\FRST64.exe

2014-08-05 19:03 - 2014-08-05 19:03 - 00001696 _____ () C:\Users\Paul\Desktop\PUP.Optional.Trovigo.A

2014-08-05 18:28 - 2014-03-25 14:21 - 00000000 ____D () C:\Users\Paul\AppData\Roaming\BitComet

2014-08-05 18:13 - 2014-08-05 18:13 - 00001136 _____ () C:\Users\Paul\Desktop\Watch_Dogs - Shortcut.lnk

2014-08-05 17:39 - 2014-08-05 17:39 - 00000000 ____D () C:\Users\Paul\Documents\My Games

2014-08-05 17:39 - 2014-08-05 17:39 - 00000000 ____D () C:\ProgramData\Orbit

2014-08-05 17:36 - 2014-08-05 17:36 - 00001208 _____ () C:\Users\Paul\Desktop\Uplay.lnk

2014-08-05 17:36 - 2014-08-05 17:36 - 00000000 ____D () C:\Users\Paul\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Ubisoft

2014-08-05 17:36 - 2014-08-05 17:36 - 00000000 ____D () C:\Users\Paul\AppData\Local\Ubisoft Game Launcher

2014-08-05 17:36 - 2014-08-05 17:36 - 00000000 ____D () C:\Program Files (x86)\Ubisoft

2014-08-05 17:36 - 2009-07-14 06:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games

2014-08-05 17:35 - 2014-08-03 01:17 - 00036870 _____ () C:\Windows\DirectX.log

2014-08-05 17:29 - 2014-05-23 10:06 - 00000000 ____D () C:\Users\Paul\AppData\Roaming\DAEMON Tools Lite

2014-08-05 17:07 - 2014-04-20 22:48 - 00000000 ____D () C:\Users\Paul\Desktop\Applications

2014-08-05 12:49 - 2014-08-05 12:34 - 01195741 _____ () C:\Users\Paul\Desktop\Paul.pptx

2014-08-04 19:45 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache

2014-08-04 17:01 - 2014-04-17 21:26 - 00000000 ____D () C:\Users\Paul\AppData\Roaming\TS3Client

2014-08-04 11:01 - 2014-08-04 11:01 - 00225312 _____ () C:\Users\Paul\Desktop\FAO Paul Barcz.eml

2014-08-03 01:18 - 2014-04-20 22:47 - 00000000 ____D () C:\Users\Paul\Desktop\Games

2014-08-03 01:17 - 2014-07-30 19:58 - 00003852 _____ () C:\Windows\windefendam.log

2014-08-03 01:17 - 2014-07-30 19:58 - 00000020 _____ () C:\Windows\capsys184523.log

2014-08-03 00:06 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\Cursors

2014-08-02 23:57 - 2014-03-25 14:29 - 00000000 ____D () C:\Users\Paul\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam

2014-08-02 23:17 - 2014-08-02 23:16 - 00000000 ____D () C:\Windows\pss

2014-08-02 22:21 - 2014-08-02 22:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-08-02 22:21 - 2014-08-02 22:20 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-08-02 22:20 - 2014-08-02 22:20 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-08-02 22:11 - 2014-03-25 14:09 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation

2014-08-02 22:11 - 2014-03-25 14:08 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation

2014-08-02 22:08 - 2014-08-02 22:08 - 00000000 ____D () C:\NVIDIA

2014-08-02 22:07 - 2014-08-02 22:07 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe

2014-08-02 22:07 - 2014-08-02 22:07 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe

2014-08-02 22:07 - 2014-08-02 22:07 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe

2014-08-02 22:07 - 2014-08-02 22:07 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll

2014-08-02 22:07 - 2014-08-02 22:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java

2014-08-02 22:07 - 2014-08-02 22:07 - 00000000 ____D () C:\Program Files (x86)\Java

2014-08-02 22:07 - 2014-03-27 23:37 - 00000000 ____D () C:\ProgramData\Oracle

2014-08-02 13:19 - 2009-07-14 06:08 - 00032620 _____ () C:\Windows\Tasks\SCHEDLGU.TXT

2014-08-01 21:01 - 2014-03-25 16:20 - 00000000 ____D () C:\Users\Paul\AppData\Local\DayZ

2014-07-30 14:38 - 2014-07-30 14:38 - 00000000 ____D () C:\Program Files (x86)\AGEIA Technologies

2014-07-30 14:37 - 2014-03-25 14:07 - 00000000 ____D () C:\Program Files\NVIDIA Corporation

2014-07-30 14:35 - 2014-03-25 14:11 - 00000000 ____D () C:\Users\Paul\AppData\Local\NVIDIA Corporation

2014-07-28 10:37 - 2014-07-28 10:37 - 00000000 _____ () C:\Windows\setuperr.log

2014-07-28 00:47 - 2014-03-26 20:42 - 00000000 ____D () C:\Users\Paul\AppData\Roaming\vlc

2014-07-25 15:01 - 2014-06-02 20:00 - 01715224 _____ (NVIDIA Corporation) C:\Windows\system32\nvspbridge64.dll

2014-07-25 15:01 - 2014-06-02 20:00 - 01291280 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspbridge.dll

2014-07-25 15:01 - 2014-03-25 14:09 - 01283136 _____ (NVIDIA Corporation) C:\Windows\system32\nvspcap64.dll

2014-07-25 15:01 - 2014-03-25 14:09 - 01126480 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspcap.dll

2014-07-23 14:09 - 2014-04-16 15:56 - 00000641 _____ () C:\Users\Paul\Desktop\notes.txt

2014-07-19 21:02 - 2014-06-15 15:09 - 00000000 ____D () C:\ProgramData\Microsoft Help

2014-07-18 19:50 - 2014-03-25 16:24 - 00000000 ____D () C:\Users\Paul\AppData\Local\Arma 3

2014-07-12 04:28 - 2014-06-15 15:11 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013

2014-07-10 20:49 - 2014-05-28 21:32 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2014-07-10 20:49 - 2014-05-28 21:32 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2014-07-10 20:49 - 2014-05-28 21:32 - 00003768 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater

2014-07-09 18:00 - 2009-07-14 05:45 - 00444744 _____ () C:\Windows\system32\FNTCACHE.DAT

2014-07-09 17:59 - 2014-04-30 23:14 - 00000000 ___SD () C:\Windows\system32\CompatTel

2014-07-09 17:59 - 2011-04-12 09:28 - 00000000 ____D () C:\Program Files\Windows Journal

2014-07-09 17:59 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\SysWOW64\Dism

2014-07-09 17:59 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\Dism

2014-07-09 17:18 - 2014-03-25 16:24 - 00000000 ____D () C:\Windows\system32\MRT

2014-07-09 17:17 - 2014-03-25 16:24 - 96441528 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

Some content of TEMP:

====================

C:\Users\Paul\AppData\Local\Temp\nvSCPAPI.dll

C:\Users\Paul\AppData\Local\Temp\nvStInst.exe

C:\Users\Paul\AppData\Local\Temp\Quarantine.exe

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\SysWOW64\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2014-07-28 17:22

==================== End Of Log ============================

deeprybka · August 5, 2014

Hi,

please copy&paste following text into the URL-line of your chrome browser and hit enter:

chrome://settings/startup

Delete manually these entries:

CHR HomePage: hxxp://www.trovigo.com/?gd=&ctid=CT3319434&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=5&UP=SP69468449-AE9E-46A1-B671-167592C226B9&SSPV=CHR StartupUrls: "hxxp://www.trovigo.com/?gd=&ctid=CT3319434&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=5&UP=SP69468449-AE9E-46A1-B671-167592C226B9&SSPV=", "", "hxxp://www.google.com/"

Afterwards:

Step 1

Scan with Malwarebytes Antimalware

Please update the database by clicking on the "Update Now" button.
Following the update and click "Settings" and go to "Detection and Protection"
Make sure "Scan for Rootkits" is checked.
Click on Dashboard, then click on Scan Now to start the scan.
(If Malware or Potentially Unwanted Programs [PUPs] are found, you will receive a prompt so that you can decide what you want to do. I suggest "Quarantine". Click the button: Apply All Actions.)
A window with an option to view the detailed log will appear. Click on "View Detailed Log".
After viewing the results, please click on the "Copy to Clipboard" button and then OK.
Return to our forum. Paste your log into your next reply.

Please download the ESET Online Scanner and save it to your Desktop.

Disable the realtime-protection of your antivirus and anti-malware programs because they might interfere with the scan.
Start esetsmartinstaller_enu.exe with administartor privileges.
Select the option Yes, I accept the Terms of Use and click on Start.
Make sure that the option Remove found threats is NOT checked, and the option Scan archives is checked.
Now click on Advanced Settings and select the following:
- Scan for potentially unwanted applications
- Scan for potentially unsafe applications
- Enable Anti-Stealth Technology
[*]Click on Start. The virus signature database will begin to download. This may take some time. [*]When completed the Online Scan will begin automatically.
Note: This scan might take a long time! Please be patient. [*]When completed select Uninstall application on close if you so wish, but make sure you copy the logfile first! [*]Now click on Finish [*]A log file is created at C:\Program Files\ESET\EsetOnlineScanner\log.txt.
Copy and paste the content of this log file in your next reply.

Note: Do not forget to re-enable your antivirus application after running the above scan!

Step 3

Start FRST with administator privileges.

Make sure the following option is checked:
Press the Scan button.
When finished, FRST will produce two logs (FRST.txt and Addition.txt) in the same directory the tool was run from.
Please copy and paste these logs in your next reply.

Can you please tell me which problems still persist now?

Despise · August 5, 2014

Malwarebytes Anti-Malware

www.malwarebytes.org

Scan Date: 05/08/2014

Scan Time: 22:32:06

Logfile:

Administrator: No

Version: 2.00.2.1012

Malware Database: v2014.08.05.08

Rootkit Database: v2014.08.04.01

License: Free

Malware Protection: Disabled

Malicious Website Protection: Disabled

Self-protection: Disabled

OS: Windows 7 Service Pack 1

CPU: x64

File System: NTFS

User: Paul

Scan Type: Threat Scan

Result: Completed

Objects Scanned: 291623

Time Elapsed: 3 min, 56 sec

Memory: Enabled

Startup: Enabled

Filesystem: Enabled

Archives: Enabled

Rootkits: Enabled

Heuristics: Enabled

PUP: Enabled

PUM: Enabled

Processes: 0

(No malicious items detected)

Modules: 0

(No malicious items detected)

Registry Keys: 0

(No malicious items detected)

Registry Values: 0

(No malicious items detected)

Registry Data: 0

(No malicious items detected)

Folders: 0

(No malicious items detected)

Files: 1

PUP.Optional.Trovigo.A, C:\Users\Paul\AppData\Local\Google\Chrome\User Data\Default\Preferences, Good: (), Bad: ( "homepage": "http://www.trovigo.com/?gd=&ctid=CT3319434&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=5&UP=SP69468449-AE9E-46A1-B671-167592C226B9&SSPV=",), ,[1ddf0cb685f6ec4aa4d6de15ed17ec14]

Physical Sectors: 0

(No malicious items detected)

(end)

Despise · August 5, 2014

ESETY didt find anything, was clean

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-08-2014

Ran by Paul (administrator) on PAUL-PC on 05-08-2014 23:51:07