chrischambers Posted September 19, 2014 ID:880766 Share Posted September 19, 2014 I hope that you can help, I am geting this popup window asking me permission to allow a updateflashplayer_********.exe to run,and even time I so no, the window will flash and pop up again. I did find the file and delete it a few days ago but it has return. I have gone into safe mode, and run Malwarebtyes Pro, with the lastest database, and it finds nothing, and also I have Mircosoft Security Essentials, and again with the late's update and again that also didn't find anything, I have gone through and delete the temp folder and all the cache files, but even time I go back into normal mode, and do any youtube, or flash playing then I will get this message. I did have the lastest version of Flashplayer installed but I have removed this, thinking it was the issue, but reading online I see that it is a bigger issue. can someone please help me out. Link to post Share on other sites More sharing options...
TwinHeadedEagle Posted September 19, 2014 ID:880778 Share Posted September 19, 2014 Hello, They call me TwinHeadedEagle around here, and I'll be working with you. Before we start please read and note the following:Limit your internet access to posting here, some infections just wait to steal typed-in passwords.Please be patient. I know it is frustrating when your PC isn't working properly, but malware removal takes time.Don't run any scripts or tools on your own, unsupervised usage may cause more harm than good.Do not paste the logs in your posts, attachments make my work easier. There is a Upload Files option below which you can use to attach your reports. Always attach reports from all tools.Stay with me to the end, the absence of symptoms doesn't mean that your machine is fully operational.Note that we may live in totally different time zones, what may cause some delays between answers.Do not ask for help for your business PC. Companies are making revenue via computers, so it is good thing to pay someone to repair it.If I don't hear from you within 3 days from this initial or any subsequent post, then this thread will be closed. I can't foresee everything, so if anything unexpected happens, please stop and inform me! There are no silly questions. Never be afraid to ask if in doubt! Rules and policies We won't support any piracy. That being told, if any evidence of illegal OS, software, cracks/keygens or any other will be revealed, any further assistance will be suspended. If you are aware that there is this kind of stuff on your machine, remove it before proceeding!The same applies to any use of P2P software: uTorrent, BitTorrent, Vuze, Kazaa, Ares... We don't provide any help for P2P, except for their removal. All P2P software has to be uninstalled or at least fully disabled before proceeding! Failure to follow these guidelines will result with closing your topic and withdrawning any assistance. Please download Farbar Recovery Scan Tool and save it to your desktop. Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them.Only one of them will run on your system, that will be the right version. Double-click to run it. When the tool opens click Yes to disclaimer.Press Scan button.It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply. Link to post Share on other sites More sharing options...
chrischambers Posted September 19, 2014 Author ID:880820 Share Posted September 19, 2014 Addition Scan File Additional scan result of Farbar Recovery Scan Tool (x64) Version: 12-09-2014Ran by Chris at 2014-09-19 19:28:41Running from C:\Users\Chris\DownloadsBoot Mode: Normal============================================================================== Security Center ========================(If an entry is included in the fixlist, it will be removed.)AV: Microsoft Security Essentials (Enabled - Up to date) {4F35CFC4-45A3-FC37-EF17-759A02E39AB1}AS: Microsoft Security Essentials (Enabled - Up to date) {F4542E20-6399-F3B9-D5A7-4EE87964D00C}AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}==================== Installed Programs ======================(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)AC3Filter 2.6.0b (HKLM-x32\...\AC3Filter_is1) (Version: 2.6.0b - Alexander Vigovsky)Adobe Acrobat X Pro - English, Français, Deutsch (HKLM-x32\...\{AC76BA86-1033-F400-7760-000000000005}) (Version: 10.0.0 - Adobe Systems)Amazon Kindle (HKCU\...\Amazon Kindle) (Version: - Amazon)Citrix Access Gateway Plug-in (HKLM\...\{3F492259-C09A-41F7-B46D-E91EFAF1B4F3}) (Version: 9.3.56.5 - Citrix Systems, Inc.)Citrix Authentication Manager (x32 Version: 3.0.0.47031 - Citrix Systems, Inc.) HiddenCitrix Online Launcher (HKLM-x32\...\{B025BA0B-64A6-46DE-9D64-32965C83CCA9}) (Version: 1.0.179 - Citrix)Citrix Receiver (HDX Flash Redirection) (x32 Version: 13.3.0.55 - Citrix Systems, Inc.) HiddenCitrix Receiver (HKLM-x32\...\CitrixOnlinePluginPackWeb) (Version: 13.3.0.55 - Citrix Systems, Inc.)Citrix Receiver Inside (x32 Version: 3.3.0.17208 - Citrix Systems, Inc.) HiddenCitrix Receiver Updater (x32 Version: 3.3.0.17207 - Citrix Systems, Inc.) HiddenCitrix Receiver(Aero) (x32 Version: 13.3.0.55 - Citrix Systems, Inc.) HiddenCitrix Receiver(DV) (x32 Version: 13.3.0.55 - Citrix Systems, Inc.) HiddenCitrix Receiver(USB) (x32 Version: 13.3.0.55 - Citrix Systems, Inc.) HiddenD3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) HiddenDefinition Update for Microsoft Office 2010 (KB982726) 64-Bit Edition (HKLM\...\{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{42CBCE27-DE9B-4094-B9EB-D4C4C135FFA8}) (Version: - Microsoft)DivX Setup (HKLM-x32\...\DivX Setup) (Version: 2.6.1.8 - DivX, LLC)ffdshow v1.1.4399 [2012-03-22] (HKLM-x32\...\ffdshow_is1) (Version: 1.1.4399.0 - )Free Mouse Auto Clicker 3.4.1 (HKLM-x32\...\{7D9D583E-EC8B-4390-B3A4-017B8182C8FF}_is1) (Version: - Advanced Mouse Auto Clicker ltd.)GoToMeeting 7.0.0.1694 (HKCU\...\GoToMeeting) (Version: 7.0.0.1694 - CitrixOnline)Haali Media Splitter (HKLM-x32\...\HaaliMkx) (Version: - )Intel® Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.15.1730 - Intel Corporation)Intel® Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.18.10.3071 - Intel Corporation)Intel® Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 12.0.0.1083 - Intel Corporation)Intel® Rapid Storage Technology (Version: 12.0.0.1083 - Intel Corporation) HiddenIntel® SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 3.0.0.63463 - Intel Corporation)Intel® USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 2.0.0.100 - Intel Corporation)Intel® Trusted Connect Service Client (Version: 1.31.8.1 - Intel Corporation) HiddenJava 7 Update 67 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217067FF}) (Version: 7.0.670 - Oracle)Java Auto Updater (x32 Version: 2.1.67.1 - Oracle, Inc.) HiddenLogMeIn (HKLM-x32\...\{F8511796-1457-4A92-BEF7-71080FCF297A}) (Version: 4.1.4132 - LogMeIn, Inc.)Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) HiddenMicrosoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) HiddenMicrosoft Corporation (Version: 9.1.0.0 - Microsoft Corporation) HiddenMicrosoft Corporation (x32 Version: 9.1.0.0 - Microsoft Corporation) HiddenMicrosoft Expression Encoder 4 (HKLM-x32\...\Encoder_4.0.1651.0) (Version: 4.0.1651.0 - Microsoft Corporation)Microsoft Expression Encoder 4 (x32 Version: 4.0.1651.0 - Microsoft Corporation) HiddenMicrosoft Expression Encoder 4 Screen Capture Codec (HKLM-x32\...\{952DCCD8-4039-46C8-BC8B-5C1EB6C8E130}) (Version: 4.0.1651.0 - Microsoft Corporation)Microsoft LifeCam (HKLM\...\{5CE7E3F5-9803-4F32-AA89-2D8848A80109}) (Version: 3.60.253.0 - Microsoft Corporation)Microsoft Office Access MUI (English) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) HiddenMicrosoft Office Access Setup Metadata MUI (English) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) HiddenMicrosoft Office Excel MUI (English) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) HiddenMicrosoft Office Groove MUI (English) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) HiddenMicrosoft Office InfoPath MUI (English) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) HiddenMicrosoft Office Office 32-bit Components 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) HiddenMicrosoft Office OneNote MUI (English) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) HiddenMicrosoft Office Outlook MUI (English) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) HiddenMicrosoft Office PowerPoint MUI (English) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) HiddenMicrosoft Office Professional Plus 2010 (HKLM\...\Office14.PROPLUS) (Version: 14.0.7015.1000 - Microsoft Corporation)Microsoft Office Professional Plus 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) HiddenMicrosoft Office Proof (English) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) HiddenMicrosoft Office Proof (French) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) HiddenMicrosoft Office Proof (Spanish) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) HiddenMicrosoft Office Proofing (English) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) HiddenMicrosoft Office Publisher MUI (English) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) HiddenMicrosoft Office Shared 32-bit MUI (English) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) HiddenMicrosoft Office Shared MUI (English) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) HiddenMicrosoft Office Shared Setup Metadata MUI (English) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) HiddenMicrosoft Office Word MUI (English) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) HiddenMicrosoft Security Client (Version: 4.6.0305.0 - Microsoft Corporation) HiddenMicrosoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.6.305.0 - Microsoft Corporation)Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.51106 (HKLM-x32\...\{8e70e4e1-06d7-470b-9f74-a51bef21088e}) (Version: 11.0.51106.1 - Microsoft Corporation)Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.51106 (x32 Version: 11.0.51106 - Microsoft Corporation) HiddenMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.51106 (x32 Version: 11.0.51106 - Microsoft Corporation) HiddenMiniTool Power Data Recovery (HKLM-x32\...\MiniTool Power Data Recovery_is1) (Version: - MiniTool Solution Ltd.)Movie Maker (x32 Version: 16.4.3522.0110 - Microsoft Corporation) HiddenMozilla Firefox 31.0 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 31.0 (x86 en-US)) (Version: 31.0 - Mozilla)Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 30.0 - Mozilla)MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) HiddenMSVCRT110 (x32 Version: 16.4.1108.0727 - Microsoft) HiddenMSVCRT110_amd64 (Version: 16.4.1109.0912 - Microsoft) HiddenOnline Plug-in (x32 Version: 13.3.0.55 - Citrix Systems, Inc.) HiddenOpenSource Flash Video Splitter 1.0.0.5 (HKLM-x32\...\OpenSource Flash Video Splitter) (Version: 1.0.0.5 - )Photo Common (x32 Version: 16.4.3522.0110 - Microsoft Corporation) HiddenPhoto Gallery (x32 Version: 16.4.3522.0110 - Microsoft Corporation) HiddenPrivate Internet Access Support Files (HKLM-x32\...\{7D72DAFF-DCB2-437B-BC22-4B2ABF21462B}) (Version: 1.0.0.0 - Private Internet Access)RealDownloader (x32 Version: 1.3.3 - RealNetworks, Inc.) HiddenRealNetworks - Microsoft Visual C++ 2008 Runtime (x32 Version: 9.0 - RealNetworks, Inc) HiddenRealNetworks - Microsoft Visual C++ 2010 Runtime (x32 Version: 10.0 - RealNetworks, Inc) HiddenRealPlayer (HKLM-x32\...\RealPlayer 16.0) (Version: 16.0.3 - RealNetworks)Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.65.1025.2012 - Realtek)Realtek Ethernet Diagnostic Utility (HKLM-x32\...\{DADC7AB0-E554-4705-9F6A-83EA82ED708E}) (Version: 2.0.2.7 - Realtek)Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6849 - Realtek Semiconductor Corp.)RealUpgrade 1.1 (x32 Version: 1.1.0 - RealNetworks, Inc.) HiddenSelf-service Plug-in (x32 Version: 3.3.0.27839 - Citrix Systems, Inc.) HiddenService Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (HKLM\...\{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{A3364707-2F53-4C83-8F68-C9877A9080C7}) (Version: - Microsoft)Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (Version: - Microsoft) HiddenSkype™ 6.18 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.18.106 - Skype Technologies S.A.)System Requirements Lab for Intel (64-bit) (HKLM\...\{48F7E287-F40C-472C-A052-BB8B6EBE99D6}) (Version: 4.5.22.0 - Husdawg, LLC)TeamViewer 9 (HKLM-x32\...\TeamViewer 9) (Version: 9.0.32494 - TeamViewer)tools-freebsd (x32 Version: 9.2.3.1031769 - VMware, Inc.) Hiddentools-linux (x32 Version: 9.2.3.1031769 - VMware, Inc.) Hiddentools-netware (x32 Version: 9.2.3.1031769 - VMware, Inc.) Hiddentools-solaris (x32 Version: 9.2.3.1031769 - VMware, Inc.) Hiddentools-windows (x32 Version: 9.2.3.1031769 - VMware, Inc.) Hiddentools-winPre2k (x32 Version: 9.2.3.1031769 - VMware, Inc.) HiddenTrue Image 2013 (HKLM-x32\...\{75BC2136-B6A1-4F3B-8A69-55E39C647B1F}Visible) (Version: 16.0.6514 - Acronis)True Image 2013 (x32 Version: 16.0.6514 - Acronis) HiddenUpdate for Microsoft Access 2010 (KB2553446) 64-Bit Edition (HKLM\...\{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{FEF4C57D-0975-4D3C-ACC7-DCD038C3788F}) (Version: - Microsoft)Update for Microsoft Filter Pack 2.0 (KB2878281) 64-Bit Edition (HKLM\...\{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{84B191B5-5319-463A-A305-8C4D53B1D20A}) (Version: - Microsoft)Update for Microsoft InfoPath 2010 (KB2817369) 64-Bit Edition (HKLM\...\{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{DB0B0CDF-77EC-47B0-94E2-4738573A1E58}) (Version: - Microsoft)Update for Microsoft InfoPath 2010 (KB2817396) 64-Bit Edition (HKLM\...\{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{1AA82E2E-7DB7-4C70-910C-BBB657A6B3A5}) (Version: - Microsoft)Update for Microsoft Office 2010 (KB2589298) 64-Bit Edition (HKLM\...\{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{79C725A1-3964-421C-A528-78C1C083C7C7}) (Version: - Microsoft)Update for Microsoft Office 2010 (KB2589352) 64-Bit Edition (HKLM\...\{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{95BE5D45-A3DD-4CB1-8C35-D75DD7B4D862}) (Version: - Microsoft)Update for Microsoft Office 2010 (KB2589352) 64-Bit Edition (HKLM\...\{90140000-0043-0000-1000-0000000FF1CE}_Office14.PROPLUS_{95BE5D45-A3DD-4CB1-8C35-D75DD7B4D862}) (Version: - Microsoft)Update for Microsoft Office 2010 (KB2589375) 64-Bit Edition (HKLM\...\{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{EBD18DE5-BC84-4B57-9A30-097044871F9A}) (Version: - Microsoft)Update for Microsoft Office 2010 (KB2597087) 64-Bit Edition (HKLM\...\{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{4AD36582-256B-433D-8593-F31773A15CA4}) (Version: - Microsoft)Update for Microsoft Office 2010 (KB2597087) 64-Bit Edition (HKLM\...\{90140000-0043-0000-1000-0000000FF1CE}_Office14.PROPLUS_{4AD36582-256B-433D-8593-F31773A15CA4}) (Version: - Microsoft)Update for Microsoft Office 2010 (KB2687502) 64-Bit Edition (HKLM\...\{90140000-001F-0409-1000-0000000FF1CE}_Office14.PROPLUS_{B114A387-8A14-4C43-AE51-82F17EB81D49}) (Version: - Microsoft)Update for Microsoft Office 2010 (KB2760598) 64-Bit Edition (HKLM\...\{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{F216169C-2B40-429B-8370-B5BA06EC5423}) (Version: - Microsoft)Update for Microsoft Office 2010 (KB2760598) 64-Bit Edition (HKLM\...\{90140000-0043-0000-1000-0000000FF1CE}_Office14.PROPLUS_{F216169C-2B40-429B-8370-B5BA06EC5423}) (Version: - Microsoft)Update for Microsoft Office 2010 (KB2794737) 64-Bit Edition (HKLM\...\{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{07DC9C6C-E916-4F42-8677-716930ED0393}) (Version: - Microsoft)Update for Microsoft Office 2010 (KB2825635) 64-Bit Edition (HKLM\...\{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{6E760BBA-B83F-4C2D-918F-5F91EF6C9861}) (Version: - Microsoft)Update for Microsoft Office 2010 (KB2825640) 64-Bit Edition (HKLM\...\{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{43F59F4D-7179-497E-BE99-BC6F7D1DDCBA}) (Version: - Microsoft)Update for Microsoft Office 2010 (KB2825640) 64-Bit Edition (HKLM\...\{90140000-0044-0409-1000-0000000FF1CE}_Office14.PROPLUS_{43F59F4D-7179-497E-BE99-BC6F7D1DDCBA}) (Version: - Microsoft)Update for Microsoft Office 2010 (KB2837581) 64-Bit Edition (HKLM\...\{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{D1F3B526-7EB2-4701-92DB-0784988D78DE}) (Version: - Microsoft)Update for Microsoft Office 2010 (KB2837606) 64-Bit Edition (HKLM\...\{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{52BEF8AE-9324-40A1-9A92-E5A8FB63A475}) (Version: - Microsoft)Update for Microsoft Office 2010 (KB2878252) 64-Bit Edition (HKLM\...\{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{56551B9F-2FE1-4705-ACF0-8FA920535E18}) (Version: - Microsoft)Update for Microsoft Office 2010 (KB2878252) 64-Bit Edition (HKLM\...\{90140000-0043-0000-1000-0000000FF1CE}_Office14.PROPLUS_{56551B9F-2FE1-4705-ACF0-8FA920535E18}) (Version: - Microsoft)Update for Microsoft Office 2010 (KB2881028) 64-Bit Edition (HKLM\...\{90140000-001F-040C-1000-0000000FF1CE}_Office14.PROPLUS_{4B9B2BAF-EE1F-4B60-A4D9-17B7BEEB13A1}) (Version: - Microsoft)Update for Microsoft Office 2010 (KB2881028) 64-Bit Edition (HKLM\...\{90140000-001F-0C0A-1000-0000000FF1CE}_Office14.PROPLUS_{860EE8B1-0B9F-4A8A-91FE-649CD3C6754C}) (Version: - Microsoft)Update for Microsoft OneNote 2010 (KB2837595) 64-Bit Edition (HKLM\...\{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{3029C408-1DD1-4273-8E58-87CB1B638FC8}) (Version: - Microsoft)Update for Microsoft OneNote 2010 (KB2837595) 64-Bit Edition (HKLM\...\{90140000-0043-0000-1000-0000000FF1CE}_Office14.PROPLUS_{3029C408-1DD1-4273-8E58-87CB1B638FC8}) (Version: - Microsoft)Update for Microsoft PowerPoint 2010 (KB2837579) 64-Bit Edition (HKLM\...\{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{A20A650C-F820-4CE4-AEA5-EC140192FAFB}) (Version: - Microsoft)Update for Microsoft PowerPoint 2010 (KB2837579) 64-Bit Edition (HKLM\...\{90140000-0018-0409-1000-0000000FF1CE}_Office14.PROPLUS_{393B360E-62F8-463D-B914-1ECDC1359A46}) (Version: - Microsoft)Update for Microsoft Visio Viewer 2010 (KB2837587) 64-Bit Edition (HKLM\...\{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{C950A55F-82E3-4CC8-8FA2-E8A2A0F651F3}) (Version: - Microsoft)Update for Microsoft Word 2010 (KB2880529) 64-Bit Edition (HKLM\...\{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{89FDC8D9-FB84-4EFE-950D-AF4EECC3B64C}) (Version: - Microsoft)VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0 - DivX, Inc) HiddenVMware Workstation (HKLM-x32\...\VMware_Workstation) (Version: 9.0.2 - VMware, Inc)VMware Workstation (Version: 9.0.2 - VMware, Inc.) HiddenWindows Live Communications Platform (x32 Version: 16.4.3522.0110 - Microsoft Corporation) HiddenWindows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3522.0110 - Microsoft Corporation)Windows Live Essentials (x32 Version: 16.4.3522.0110 - Microsoft Corporation) HiddenWindows Live ID Sign-in Assistant (Version: 7.250.4311.0 - Microsoft Corporation) HiddenWindows Live Installer (x32 Version: 16.4.3522.0110 - Microsoft Corporation) HiddenWindows Live Photo Common (x32 Version: 16.4.3522.0110 - Microsoft Corporation) HiddenWindows Live PIMT Platform (x32 Version: 16.4.3522.0110 - Microsoft Corporation) HiddenWindows Live SOXE (x32 Version: 16.4.3522.0110 - Microsoft Corporation) HiddenWindows Live SOXE Definitions (x32 Version: 16.4.3522.0110 - Microsoft Corporation) HiddenWindows Live UX Platform (x32 Version: 16.4.3522.0110 - Microsoft Corporation) HiddenWindows Live UX Platform Language Pack (x32 Version: 16.4.3522.0110 - Microsoft Corporation) HiddenWinRAR 5.00 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.00.0 - win.rar GmbH)WinX DVD Ripper Platinum 7.5.6 (HKLM-x32\...\WinX DVD Ripper Platinum_is1) (Version: - Digiarty Software, Inc.)Xvid MPEG-4 Video Codec (HKLM\...\Xvid_is1) (Version: - )==================== Custom CLSID (selected items): ==========================(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)CustomCLSID: HKU\S-1-5-21-4281378426-1232025690-3597593534-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Chris\AppData\Roaming\Dropbox\bin\Dropbox.exe /autoplay No FileCustomCLSID: HKU\S-1-5-21-4281378426-1232025690-3597593534-1000_Classes\CLSID\{84B5A313-CD5D-4904-8BA2-AFDC81C1B309}\InprocServer32 -> C:\Users\Chris\AppData\Local\Citrix\GoToMeeting\1350\G2MOutlookAddin64.dll (Citrix Online, a division of Citrix Systems, Inc.)==================== Restore Points =========================09-09-2014 08:37:09 Windows Update12-09-2014 09:54:23 Windows Update12-09-2014 16:22:36 Windows Update15-09-2014 08:42:50 Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.5110615-09-2014 15:56:53 Removed Adobe Acrobat 8 Professional16-09-2014 08:57:00 Installed Adobe Acrobat X Pro - English, Français, Deutsch.17-09-2014 14:09:20 Windows Update==================== Hosts content: ==========================(If needed Hosts: directive could be included in the fixlist to reset Hosts.)2009-07-14 03:34 - 2014-09-16 09:56 - 00006622 ____A C:\Windows\system32\Drivers\etc\hosts127.0.0.1 localhost127.0.0.1 3dns-2.adobe.com #192.150.22.22127.0.0.1 3dns-3.adobe.com #192.150.14.21127.0.0.1 3dns-4.adobe.com #192.150.18.247127.0.0.1 3dns-5.adobe.com #192.150.22.46127.0.0.1 adobe-dns.adobe.com #192.150.11.30127.0.0.1 adobe-dns-2.adobe.com #192.150.11.247127.0.0.1 adobe-dns-3.adobe.com #192.150.22.30127.0.0.1 adobe.activate.com #69.175.22.26127.0.0.1 activate.adobe.com #192.150.22.40127.0.0.1 activate.wip3.adobe.com #192.150.22.40127.0.0.1 activate.wip4.adobe.com #192.150.22.40127.0.0.1 activate-sea.adobe.com #192.150.22.40127.0.0.1 activate-sjc0.adobe.com #192.150.14.69127.0.0.1 ereg.adobe.com #192.150.18.103127.0.0.1 ereg.wip3.adobe.com #192.150.18.63127.0.0.1 ereg.wip4.adobe.com #192.150.18.103127.0.0.1 practivate.adobe.com #192.150.18.54127.0.0.1 www.wip3.adobe.com #192.150.8.60127.0.0.1 www.wip4.adobe.com #192.150.18.200127.0.0.1 www.adobeereg.com #75.125.24.83127.0.0.1 adobeereg.com #207.66.2.10127.0.0.1 hl2rcv.adobe.com #192.150.14.174127.0.0.1 wwis-dubc1-vip30.adobe.com #192.150.8.30127.0.0.1 wwis-dubc1-vip31.adobe.com #192.150.8.31127.0.0.1 wwis-dubc1-vip32.adobe.com #192.150.8.32127.0.0.1 wwis-dubc1-vip33.adobe.com #192.150.8.33127.0.0.1 wwis-dubc1-vip34.adobe.com #192.150.8.34127.0.0.1 wwis-dubc1-vip35.adobe.com #192.150.8.35There are 92 more lines.==================== Scheduled Tasks (whitelisted) =============(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)Task: {0C1161F7-D51D-42DC-8D19-5F2CDBAC08F7} - \Security Center Update - 1210639621 No Task File <==== ATTENTIONTask: {27C6E6EA-B26B-4720-8107-060A0D6505C7} - System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-4281378426-1232025690-3597593534-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2013-08-14] (RealNetworks, Inc.)Task: {2EDBC96D-8A50-4EEB-8C09-3EC5C6C1C68B} - System32\Tasks\G2MUpdateTask-S-1-5-21-4281378426-1232025690-3597593534-1000 => C:\Users\Chris\AppData\Local\Citrix\GoToMeeting\1694\g2mupdate.exe [2014-09-17] (Citrix Online, a division of Citrix Systems, Inc.)Task: {48A334AA-D143-4783-A2B2-875BF138333B} - \Security Center Update - 2227540537 No Task File <==== ATTENTIONTask: {9BCE2B99-D9E4-4643-A2DA-AE76E9916CE8} - System32\Tasks\Private Internet Access Startup => C:\Program Files\pia_manager\pia_manager.exe [2014-08-24] ()Task: {BFCC7693-198E-4FBA-980B-4CADCD2CE48E} - System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-4281378426-1232025690-3597593534-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2013-08-14] (RealNetworks, Inc.)Task: C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-4281378426-1232025690-3597593534-1000.job => C:\Users\Chris\AppData\Local\Citrix\GoToMeeting\1694\g2mupdate.exe==================== Loaded Modules (whitelisted) =============2013-02-26 02:54 - 2013-02-26 02:54 - 13242960 _____ () D:\Program Files (x86)\VMware\vmware-hostd.exe2014-09-01 20:17 - 2014-09-01 20:17 - 02576896 _____ () C:\ProgramData\Microsoft\Crypto\RSA64\CryptoProvider.dll2014-09-01 20:17 - 2014-09-01 20:17 - 02162688 _____ () C:\ProgramData\Microsoft\Crypto\RSA64\rsa64.dll2013-03-27 23:39 - 2013-03-27 23:39 - 00021824 _____ () C:\Program Files (x86)\Acronis\TrueImageHome\x64\ti_managers_proxy_stub.dll2014-01-10 06:26 - 2014-01-10 06:26 - 01861968 _____ () C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe2013-02-26 03:28 - 2013-02-26 03:28 - 01260624 _____ () D:\Program Files (x86)\VMware\libxml2.dll2014-09-10 12:46 - 2014-09-10 12:46 - 00816128 _____ () C:\Users\Chris\AppData\Local\Okics\ExportModeller.DLL2014-09-19 14:30 - 2014-09-19 14:30 - 00053760 _____ () C:\Users\Chris\AppData\Local\Ejtion\BassNet.dll2014-01-10 06:28 - 2014-01-10 06:28 - 00100688 _____ () C:\Program Files (x86)\DivX\DivX Update\DivXUpdateCheck.dll2013-12-28 17:34 - 2013-09-16 13:17 - 01242584 _____ () C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\ACE.dll2013-03-27 23:09 - 2013-03-27 23:09 - 00420160 _____ () C:\Program Files (x86)\Common Files\Acronis\Home\ulxmlrpcpp.dll2013-03-27 23:36 - 2013-03-27 23:36 - 00021312 _____ () C:\Program Files (x86)\Acronis\TrueImageHome\ti_managers_proxy_stub.dll==================== Alternate Data Streams (whitelisted) =========(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)==================== Safe Mode (whitelisted) ===================(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)==================== EXE Association (whitelisted) =============(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)==================== MSCONFIG/TASK MANAGER disabled items =========(Currently there is no automatic fix for this section.)MSCONFIG\Services: AdobeARMservice => 2MSCONFIG\Services: AdobeFlashPlayerUpdateSvc => 3MSCONFIG\startupfolder: C:^Users^Chris^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^fc.lnk => C:\Windows\pss\fc.lnk.StartupMSCONFIG\startupfolder: C:^Users^Chris^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^RMActivate_isv.lnk => C:\Windows\pss\RMActivate_isv.lnk.StartupMSCONFIG\startupfolder: C:^Users^Chris^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^schtasks.lnk => C:\Windows\pss\schtasks.lnk.StartupMSCONFIG\startupreg: AcronisTibMounterMonitor => C:\Program Files (x86)\Common Files\Acronis\TibMounter\TibMounterMonitor.exeMSCONFIG\startupreg: AdobeAAMUpdater-1.0 => "C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"MSCONFIG\startupreg: AdobeCEPServiceManager => "C:\Program Files (x86)\Common Files\Adobe\CEPServiceManager4\CEPServiceManager.exe" -launchedbyloginMSCONFIG\startupreg: Aldunobivamya => C:\Users\Chris\AppData\Roaming\Omonvog\fanyg.exeMSCONFIG\startupreg: LifeCam => "C:\Program Files (x86)\Microsoft LifeCam\LifeExp.exe"==================== Faulty Device Manager Devices =============Name: VMware Virtual Ethernet Adapter for VMnet1Description: VMware Virtual Ethernet Adapter for VMnet1Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}Manufacturer: VMware, Inc.Service: VMnetAdapterProblem: : This device is disabled. (Code 22)Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.Name: VMware Virtual Ethernet Adapter for VMnet8Description: VMware Virtual Ethernet Adapter for VMnet8Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}Manufacturer: VMware, Inc.Service: VMnetAdapterProblem: : This device is disabled. (Code 22)Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.==================== Event log errors: =========================Application errors:==================Error: (09/19/2014 07:24:52 PM) (Source: Application Hang) (EventID: 1002) (User: )Description: The program Skype.exe version 6.18.60.106 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.Process ID: 1130Start Time: 01cfd435634ae8b3Termination Time: 10Application Path: C:\Program Files (x86)\Skype\Phone\Skype.exeReport Id:Error: (09/19/2014 07:12:52 PM) (Source: WinMgmt) (EventID: 10) (User: )Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003Error: (09/19/2014 07:12:16 PM) (Source: Application Error) (EventID: 1000) (User: )Description: Faulting application name: rndlresolversvc.exe, version: 0.0.0.0, time stamp: 0x520c0269Faulting module name: rndlresolversvc.exe, version: 0.0.0.0, time stamp: 0x520c0269Exception code: 0xc0000005Fault offset: 0x00003035Faulting process id: 0x958Faulting application start time: 0xrndlresolversvc.exe0Faulting application path: rndlresolversvc.exe1Faulting module path: rndlresolversvc.exe2Report Id: rndlresolversvc.exe3Error: (09/19/2014 03:59:57 PM) (Source: WinMgmt) (EventID: 10) (User: )Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003Error: (09/19/2014 03:47:10 PM) (Source: WinMgmt) (EventID: 10) (User: )Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003Error: (09/19/2014 03:29:15 PM) (Source: System Restore) (EventID: 8193) (User: )Description: Failed to create restore point (Process = C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Setup.exe Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Setup.exe" -Embedding; Description = Configured Microsoft Office Professional Plus 2010; Error = 0x8007043c).Error: (09/19/2014 03:28:06 PM) (Source: System Restore) (EventID: 8193) (User: )Description: Failed to create restore point (Process = C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Setup.exe Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Setup.exe" -Embedding; Description = Configured Microsoft Office Professional Plus 2010; Error = 0x8007043c).Error: (09/19/2014 03:26:40 PM) (Source: System Restore) (EventID: 8193) (User: )Description: Failed to create restore point (Process = C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Setup.exe Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Setup.exe" -Embedding; Description = Configured Microsoft Office Professional Plus 2010; Error = 0x8007043c).Error: (09/19/2014 03:26:35 PM) (Source: System Restore) (EventID: 8193) (User: )Description: Failed to create restore point (Process = C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Setup.exe Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Setup.exe" -Embedding; Description = Configured Microsoft Office Professional Plus 2010; Error = 0x8007043c).Error: (09/19/2014 03:14:38 PM) (Source: WinMgmt) (EventID: 10) (User: )Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003System errors:=============Error: (09/19/2014 07:14:42 PM) (Source: DCOM) (EventID: 10010) (User: )Description: {D085A4AB-CAB1-4729-9DF8-FCEEDDBD19E4}Error: (09/19/2014 07:11:16 PM) (Source: Service Control Manager) (EventID: 7000) (User: )Description: The SpyHunter 4 Service service failed to start due to the following error:%%2Error: (09/19/2014 07:10:09 PM) (Source: Service Control Manager) (EventID: 7001) (User: )Description: The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error:%%1068Error: (09/19/2014 04:50:31 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )Description: %NT AUTHORITY60 has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.185.339.0 Update Source: %NT AUTHORITY59 Update Stage: 4.6.0305.00 Source Path: 4.6.0305.01 Signature Type: %NT AUTHORITY602 Update Type: %NT AUTHORITY604 User: NT AUTHORITY\SYSTEM Current Engine Version: %NT AUTHORITY605 Previous Engine Version: %NT AUTHORITY606 Error code: %NT AUTHORITY607 Error description: %NT AUTHORITY608Error: (09/19/2014 04:50:31 PM) (Source: DCOM) (EventID: 10005) (User: )Description: 1084wuauserv{E60687F7-01A1-40AA-86AC-DB1CBF673334}Error: (09/19/2014 03:58:58 PM) (Source: Service Control Manager) (EventID: 7001) (User: )Description: The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error:%%1068Error: (09/19/2014 03:58:57 PM) (Source: Service Control Manager) (EventID: 7001) (User: )Description: The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error:%%1068Error: (09/19/2014 03:58:57 PM) (Source: DCOM) (EventID: 10005) (User: )Description: 1068netprofm{A47979D2-C419-11D9-A5B4-001185AD2B89}Error: (09/19/2014 03:58:41 PM) (Source: Service Control Manager) (EventID: 7001) (User: )Description: The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error:%%1068Error: (09/19/2014 03:58:41 PM) (Source: Service Control Manager) (EventID: 7001) (User: )Description: The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error:%%1068Microsoft Office Sessions:=========================Error: (09/19/2014 07:24:52 PM) (Source: Application Hang) (EventID: 1002) (User: )Description: Skype.exe6.18.60.106113001cfd435634ae8b310C:\Program Files (x86)\Skype\Phone\Skype.exeError: (09/19/2014 07:12:52 PM) (Source: WinMgmt) (EventID: 10) (User: )Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003Error: (09/19/2014 07:12:16 PM) (Source: Application Error) (EventID: 1000) (User: )Description: rndlresolversvc.exe0.0.0.0520c0269rndlresolversvc.exe0.0.0.0520c0269c00000050000303595801cfd4352dc5780aC:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exeC:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe7c1ba4d5-4028-11e4-84b4-94de807741f0Error: (09/19/2014 03:59:57 PM) (Source: WinMgmt) (EventID: 10) (User: )Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003Error: (09/19/2014 03:47:10 PM) (Source: WinMgmt) (EventID: 10) (User: )Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003Error: (09/19/2014 03:29:15 PM) (Source: System Restore) (EventID: 8193) (User: )Description: C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Setup.exe Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Setup.exe" -EmbeddingConfigured Microsoft Office Professional Plus 20100x8007043cError: (09/19/2014 03:28:06 PM) (Source: System Restore) (EventID: 8193) (User: )Description: C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Setup.exe Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Setup.exe" -EmbeddingConfigured Microsoft Office Professional Plus 20100x8007043cError: (09/19/2014 03:26:40 PM) (Source: System Restore) (EventID: 8193) (User: )Description: C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Setup.exe Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Setup.exe" -EmbeddingConfigured Microsoft Office Professional Plus 20100x8007043cError: (09/19/2014 03:26:35 PM) (Source: System Restore) (EventID: 8193) (User: )Description: C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Setup.exe Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Setup.exe" -EmbeddingConfigured Microsoft Office Professional Plus 20100x8007043cError: (09/19/2014 03:14:38 PM) (Source: WinMgmt) (EventID: 10) (User: )Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003==================== Memory info ===========================Processor: Intel® Core i7-4770K CPU @ 3.50GHzPercentage of memory in use: 20%Total physical RAM: 16271.56 MBAvailable physical RAM: 12912.31 MBTotal Pagefile: 32541.3 MBAvailable Pagefile: 29021.47 MBTotal Virtual: 8192 MBAvailable Virtual: 8191.8 MB==================== Drives ================================Drive c: () (Fixed) (Total:232.79 GB) (Free:160.35 GB) NTFSDrive d: (data) (Fixed) (Total:232.88 GB) (Free:226.44 GB) NTFSDrive g: (Work) (Fixed) (Total:465.76 GB) (Free:254.57 GB) NTFSDrive v: (Virtual Images) (Fixed) (Total:1863.01 GB) (Free:1362.82 GB) NTFS==================== MBR & Partition Table ==========================================================================Disk: 0 (MBR Code: Windows XP) (Size: 465.8 GB) (Disk ID: BF2966EB)Partition 1: (Not Active) - (Size=465.8 GB) - (Type=07 NTFS)========================================================Disk: 1 (MBR Code: Windows 7 or 8) (Size: 232.9 GB) (Disk ID: 8D52105C)Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)Partition 2: (Not Active) - (Size=232.8 GB) - (Type=07 NTFS)========================================================Disk: 2 (MBR Code: Windows 7 or 8) (Size: 232.9 GB) (Disk ID: 56EB883E)Partition 1: (Not Active) - (Size=232.9 GB) - (Type=07 NTFS)========================================================Disk: 3 (MBR Code: Windows 7 or 8) (Size: 1863 GB) (Disk ID: 6245369E)Partition 1: (Not Active) - (Size=1863 GB) - (Type=07 NTFS)==================== End Of Log ============================ Link to post Share on other sites More sharing options...
chrischambers Posted September 19, 2014 Author ID:880821 Share Posted September 19, 2014 FRST File Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 12-09-2014Ran by Chris (administrator) on CHRIS-PC on 19-09-2014 19:28:20Running from C:\Users\Chris\DownloadsPlatform: Windows 7 Ultimate Service Pack 1 (X64) OS Language: English (United States)Internet Explorer Version 9Boot Mode: NormalTutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/==================== Processes (Whitelisted) =================(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe(Acronis) C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe(Acronis) C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe(Acronis) C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe(Intel® Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn\x64\ramaint.exe(Microsoft Corporation) C:\Program Files\Microsoft LifeCam\MSCamS64.exe(Citrix Systems, Inc) C:\Program Files\Citrix\Secure Access Client\nsverctl.exe(TeamViewer GmbH) D:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe(VMware, Inc.) C:\Windows\SysWOW64\vmnat.exe(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn\x64\LogMeIn.exe(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE(VMware, Inc.) D:\Program Files (x86)\VMware\vmware-authd.exe() D:\Program Files (x86)\VMware\vmware-hostd.exe(Microsoft Corporation) C:\Windows\SysWOW64\wbem\WmiPrvSE.exe(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe(TeamViewer GmbH) D:\Program Files (x86)\TeamViewer\Version9\TeamViewer.exe(TeamViewer GmbH) D:\Program Files (x86)\TeamViewer\Version9\tv_w32.exe(TeamViewer GmbH) D:\Program Files (x86)\TeamViewer\Version9\tv_x64.exe(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe(Intel Corporation) C:\Windows\System32\igfxtray.exe(Intel Corporation) C:\Windows\System32\hkcmd.exe(Intel Corporation) C:\Windows\System32\igfxpers.exe(Microsoft Corporation) C:\Windows\System32\regsvr32.exe(Microsoft Corporation) C:\Windows\SysWOW64\regsvr32.exe(Acronis) C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe(VMware, Inc.) D:\Program Files (x86)\VMware\vmware-tray.exe(Citrix Systems, Inc) C:\Program Files\Citrix\Secure Access Client\nsload.exe(Intel Corporation) C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe(Microsoft Corporation) C:\Windows\SysWOW64\regsvr32.exe(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe(Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\concentr.exe() C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe(RealNetworks, Inc.) C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe(Adobe Systems Inc.) D:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe(Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\Receiver\Receiver.exe(Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe(Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe(Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\redirector.exe(Intel Corporation) C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe(Intel Corporation) C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe(Acronis) C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE(Microsoft Corporation) C:\Windows\System32\taskmgr.exe(Microsoft Corporation) C:\Windows\System32\dllhost.exe==================== Registry (Whitelisted) ==================(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)HKLM\...\Run: [Acronis Scheduler2 Service] => C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe [516928 2013-02-15] (Acronis)HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [1331288 2014-08-22] (Microsoft Corporation)HKLM\...\Run: [LogMeIn GUI] => C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe [57928 2013-12-11] (LogMeIn, Inc.)HKLM\...\Run: [iAStorIcon] => C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe [286192 2013-01-31] (Intel Corporation)HKLM\...\Run: [bCSSync] => D:\Program Files\Microsoft Office\Office14\BCSSync.exe [108144 2012-11-05] (Microsoft Corporation)HKLM-x32\...\Run: [TrueImageMonitor.exe] => C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe [6365920 2013-03-27] (Acronis)HKLM-x32\...\Run: [vmware-tray.exe] => D:\Program Files (x86)\VMware\vmware-tray.exe [104528 2013-02-26] (VMware, Inc.)HKLM-x32\...\Run: [uSB3MON] => C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291128 2013-03-06] (Intel Corporation)HKLM-x32\...\Run: [DivXMediaServer] => C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe [455512 2014-05-28] (DivX, LLC)HKLM-x32\...\Run: [CitrixReceiver] => "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Citrix\Receiver Updater.lnk"HKLM-x32\...\Run: [ConnectionCenter] => C:\Program Files (x86)\Citrix\ICA Client\concentr.exe [380088 2012-07-27] (Citrix Systems, Inc.)HKLM-x32\...\Run: [DivXUpdate] => C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1861968 2014-01-10] ()HKLM-x32\...\Run: [TkBellExe] => C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe [295512 2014-08-01] (RealNetworks, Inc.)HKLM-x32\...\Run: [sunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-25] (Oracle Corporation)HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [932288 2010-10-25] (Adobe Systems Incorporated)HKLM-x32\...\Run: [] => [X]HKLM-x32\...\Run: [Adobe Acrobat Speed Launcher] => D:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe [36760 2010-10-25] (Adobe Systems Incorporated)HKLM-x32\...\Run: [Acrobat Assistant 8.0] => D:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe [821144 2010-10-25] (Adobe Systems Inc.)Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)HKU\S-1-5-21-4281378426-1232025690-3597593534-1000\...\Run: [skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [21653096 2014-07-24] (Skype Technologies S.A.)HKU\S-1-5-21-4281378426-1232025690-3597593534-1000\...\Run: [Okics] => regsvr32.exe C:\Users\Chris\AppData\Local\Okics\ExportModeller.DLL <===== ATTENTIONHKU\S-1-5-21-4281378426-1232025690-3597593534-1000\...\Run: [Ejtion] => C:\Users\Chris\AppData\Local\Ejtion\tmpEB2A.exeHKU\S-1-5-21-4281378426-1232025690-3597593534-1000\...\Run: [Obics] => C:\Windows\SysWOW64\regsvr32.exe C:\Users\Chris\AppData\Local\Ejtion\BassNet.dllHKU\S-1-5-21-4281378426-1232025690-3597593534-1000\...\Policies\Explorer: [Run] "C:\Users\Chris\AppData\Roaming\Microsoft\Windows\IEUpdate\AdapterTroubleshooter.exe"AppInit_DLLs-x32: C:\PROGRA~2\Citrix\ICACLI~1\RSHook.dll => C:\Program Files (x86)\Citrix\ICA Client\RSHook.dll [257208 2012-07-27] (Citrix Systems, Inc.)Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Citrix Access Gateway.lnkShortcutTarget: Citrix Access Gateway.lnk -> C:\Program Files\Citrix\Secure Access Client\nsload.exe (Citrix Systems, Inc)ShellIconOverlayIdentifiers: 1CryptoProviderIcons -> {24808826-C2BF-4269-B3BA-89D1D5F431A4} => C:\ProgramData\Microsoft\Crypto\RSA64\CryptoProvider.dll ()ShellIconOverlayIdentifiers: AcronisSyncError -> {934BC6C0-FEC2-4df5-A100-961DE2C8A0ED} => C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll (Acronis)ShellIconOverlayIdentifiers: AcronisSyncInProgress -> {00F848DC-B1D4-4892-9C25-CAADC86A215D} => C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll (Acronis)ShellIconOverlayIdentifiers: AcronisSyncOk -> {71573297-552E-46fc-BE3D-3DFAF88D47B7} => C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll (Acronis)ShellIconOverlayIdentifiers-x32: DropboxExt4 -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => No File==================== Internet (Whitelisted) ====================(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://uk.msn.com/?ocid=iehpHKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-GBHKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xBDBB76AFCEC9CF01StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exeBHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> D:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)BHO-x32: RealNetworks Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader)BHO-x32: Java Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)BHO-x32: Adobe PDF Conversion Toolbar Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)BHO-x32: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)BHO-x32: SmartSelect Class -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)DPF: HKLM {3234EB1E-733E-4E6A-A8AB-EBB6287E5A7E} http://content.systemrequirementslab.com/bin/srldetect_intel64_4.5.22.0.cabDPF: HKLM {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} https://secure.logmein.com//activex/x64/ractrl.cab?lmi=1058Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)Filter: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No FileFilter: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No FileFilter: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No FileFilter: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No FileFilter: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No FileFilter: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No FileFilter: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No FileFilter: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No FileFilter: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No FileFilter: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No FileFilter: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No FileFilter: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No FileFilter: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No FileFilter: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No FileFilter: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No FileFilter: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No FileFilter-x32: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)Filter-x32: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)Filter-x32: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)Filter-x32: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)Filter-x32: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)Filter-x32: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)Filter-x32: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)Filter-x32: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)Filter-x32: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)Filter-x32: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)Filter-x32: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)Filter-x32: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)Filter-x32: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)Filter-x32: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)Filter-x32: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)Filter-x32: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txtTcpip\Parameters: [DhcpNameServer] 194.168.4.100 194.168.8.100Tcpip\..\Interfaces\{F26C013B-82E4-4325-B7CD-5B7743C70CFB}: [NameServer] 8.8.8.8,8.8.8.8FireFox:========FF ProfilePath: C:\Users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\8i9emgvf.defaultFF DefaultSearchEngine: Yahoo!FF SelectedSearchEngine: Yahoo!FF Homepage: hxxp://192.168.0.6/FF Keyword.URL: https://uk.search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&ilc=12&type=282369&p=FF Plugin: @Citrix.com/npagee64,version=9.3.56.5 -> C:\Program Files\Citrix\Secure Access Client\npagee64.dll (Citrix Systems, Inc.)FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)FF Plugin: @microsoft.com/GENUINE -> disabled No FileFF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> D:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll No FileFF Plugin-x32: @Citrix.com/npagee,version=9.3.56.5 -> C:\Program Files\Citrix\Secure Access Client\npagee.dll (Citrix Systems, Inc.)FF Plugin-x32: @Citrix.com/npican -> C:\Program Files (x86)\Citrix\ICA Client\npicaN.dll (Citrix Systems, Inc.)FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)FF Plugin-x32: @divx.com/DivX Web Player Plug-In,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX Web Player\npdivx32.dll (DivX, LLC)FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)FF Plugin-x32: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)FF Plugin-x32: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)FF Plugin-x32: @microsoft.com/GENUINE -> disabled No FileFF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~4\Office14\NPAUTHZ.DLL (Microsoft Corporation)FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation)FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3522.0110 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)FF Plugin-x32: @real.com/nppl3260;version=16.0.3.51 -> C:\Program Files (x86)\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)FF Plugin-x32: @real.com/nprndlchromebrowserrecordext;version=1.3.3 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.)FF Plugin-x32: @real.com/nprndlhtml5videoshim;version=1.3.3 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.)FF Plugin-x32: @real.com/nprndlpepperflashvideoshim;version=1.3.3 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.)FF Plugin-x32: @real.com/nprpplugin;version=16.0.3.51 -> C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprpplugin.dll (RealPlayer)FF Plugin-x32: @realnetworks.com/npdlplugin;version=1 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll (RealDownloader)FF Plugin HKCU: @citrixonline.com/appdetectorplugin -> C:\Users\Chris\AppData\Local\Citrix\Plugins\104\npappdetector.dll (Citrix Online)FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppl3260.dll (RealNetworks, Inc.)FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nprpplugin.dll (RealPlayer)FF Plugin ProgramFiles/Appdata: C:\Users\Chris\AppData\Roaming\mozilla\plugins\npagee.dll (Citrix Systems, Inc.)FF Plugin ProgramFiles/Appdata: C:\Users\Chris\AppData\Roaming\mozilla\plugins\npagee64.dll (Citrix Systems, Inc.)FF SearchPlugin: C:\Users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\8i9emgvf.default\searchplugins\yahoo_ff.xmlFF Extension: SpMMAudioIn Class - C:\Users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\8i9emgvf.default\Extensions\{CF3A662A-4EDE-CCE8-ADBD-46033A058886} [2014-09-01]FF HKLM-x32\...\Firefox\Extensions: [{DF153AFF-6948-45d7-AC98-4FC4AF8A08E2}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\ExtFF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext [2014-08-01]FF HKLM-x32\...\Firefox\Extensions: [web2pdfextension@web2pdf.adobedotcom] - D:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtnFF Extension: Adobe Acrobat - Create PDF - D:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn [2014-09-16]FF HKLM-x32\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\ExtChrome:=======CHR HKLM-x32\...\Chrome\Extension: [idhngdhcfkoamngbedgpaokgjbnpdiji] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Chrome\Ext\realdownloader.crx [2013-08-14]CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION==================== Services (Whitelisted) =================(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [15344 2013-01-31] (Intel Corporation)R2 Intel® Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [747520 2013-08-27] (Intel® Corporation) [File not signed]S3 Intel® Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [828376 2013-08-27] (Intel® Corporation)R2 jhi_service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [169432 2013-09-16] (Intel Corporation)R2 LMIGuardianSvc; C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe [376144 2014-07-20] (LogMeIn, Inc.)R2 LMIMaint; C:\Program Files (x86)\LogMeIn\x64\RaMaint.exe [226640 2014-07-20] (LogMeIn, Inc.)R2 LogMeIn; C:\Program Files (x86)\LogMeIn\x64\LogMeIn.exe [407424 2013-12-11] (LogMeIn, Inc.)R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [23784 2014-08-22] (Microsoft Corporation)R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [368624 2014-08-22] (Microsoft Corporation)R2 nsverctl; C:\Program Files\Citrix\Secure Access Client\nsverctl.exe [155800 2012-05-01] (Citrix Systems, Inc)S2 RealNetworks Downloader Resolver Service; C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [39056 2013-08-14] ()R2 Spooler; C:\Windows\System32\spoolsv.exe [559104 2012-02-11] (Microsoft Corporation) [File not signed]R2 TeamViewer9; d:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe [4799760 2014-09-12] (TeamViewer GmbH)R2 VMAuthdService; D:\Program Files (x86)\VMware\vmware-authd.exe [87120 2013-02-26] (VMware, Inc.)R2 VMwareHostd; D:\Program Files (x86)\VMware\vmware-hostd.exe [13242960 2013-02-26] ()S2 SpyHunter 4 Service; C:\PROGRA~1\ENIGMA~1\SPYHUN~1\SH4SER~1.EXE [X]==================== Drivers (Whitelisted) ====================(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)R2 cag; C:\Program Files\Common Files\Deterministic Networks\Common Files\cag.sys [100952 2011-10-18] (Citrix Systems, Inc.)R3 ctxva51; C:\Windows\System32\DRIVERS\ctxva51.sys [45720 2012-05-01] (Citrix Systems, Inc.)R1 DNE; C:\Windows\System32\DRIVERS\dnelwf64.sys [131160 2011-02-07] (Citrix Systems, Inc.)S3 EsgScanner; C:\Windows\System32\DRIVERS\EsgScanner.sys [22704 2012-06-22] ()R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28656 2013-01-31] (Intel Corporation)R2 LMIInfo; C:\Program Files (x86)\LogMeIn\x64\RaInfo.sys [16056 2013-12-11] (LogMeIn, Inc.)S4 LMIRfsClientNP; No ImagePathR3 MEIx64; C:\Windows\System32\DRIVERS\TeeDriverx64.sys [99288 2013-09-16] (Intel Corporation)R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [269008 2014-07-17] (Microsoft Corporation)R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [125584 2014-07-17] (Microsoft Corporation)R0 Pnp680r; C:\Windows\System32\DRIVERS\pnp680r.sys [125992 2007-07-24] (Silicon Image, Inc)S3 RTTEAMPT; C:\Windows\System32\DRIVERS\RtTeam620.sys [58512 2012-07-03] (Realtek Corporation)R0 tib; C:\Windows\System32\DRIVERS\tib.sys [1120032 2013-12-28] (Acronis International GmbH)R0 tib_mounter; C:\Windows\System32\DRIVERS\tib_mounter.sys [183224 2013-12-28] (Acronis)R0 vidsflt; C:\Windows\System32\DRIVERS\vidsflt.sys [117024 2013-12-28] (Acronis International GmbH)R2 VMparport; C:\Windows\system32\drivers\VMparport.sys [31824 2013-02-26] (VMware, Inc.)R0 vsock; C:\Windows\System32\drivers\vsock.sys [70296 2012-10-24] (VMware, Inc.)S1 bcdevsnl; \??\C:\Windows\system32\drivers\bcdevsnl.sys [X]S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X]S3 gdrv; \??\C:\Windows\gdrv.sys [X]S1 imxherqa; \??\C:\Windows\system32\drivers\imxherqa.sys [X]R4 mbamchameleon; \??\C:\Windows\system32\drivers\mbamchameleon.sys [X]S3 SliceDisk5; \??\C:\Program Files\A-FF Find and Mount\slicedisk-x64.sys [X]S3 VGPU; System32\drivers\rdvgkmd.sys [X]==================== NetSvcs (Whitelisted) ===================(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)==================== One Month Created Files and Folders ========(If an entry is included in the fixlist, the file\folder will be moved.)2014-09-19 19:28 - 2014-09-19 19:28 - 00026590 _____ () C:\Users\Chris\Downloads\FRST.txt2014-09-19 19:27 - 2014-09-19 19:28 - 00000000 ____D () C:\FRST2014-09-19 19:18 - 2014-09-19 19:18 - 02105856 _____ (Farbar) C:\Users\Chris\Downloads\FRST64.exe2014-09-17 18:38 - 2014-09-17 18:38 - 00000000 ____D () C:\Windows\pss2014-09-16 09:58 - 2014-09-16 11:30 - 00002465 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Acrobat Distiller X.lnk2014-09-16 09:58 - 2014-09-16 11:30 - 00002453 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Acrobat X Pro.lnk2014-09-16 09:58 - 2014-09-16 11:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe LiveCycle ES22014-09-12 17:33 - 2014-09-12 17:33 - 00000000 ____D () C:\Program Files\Common Files\DESIGNER2014-09-12 17:24 - 2014-06-27 03:08 - 02777088 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll2014-09-12 17:24 - 2014-06-27 02:45 - 02285056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msmpeg2vdec.dll2014-09-12 17:08 - 2014-06-24 04:29 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll2014-09-12 17:08 - 2014-06-24 03:59 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll2014-09-10 16:01 - 2014-09-10 16:02 - 119121656 _____ (Microsoft Corporation) C:\Users\Chris\Desktop\msert.exe2014-09-09 12:23 - 2014-09-09 12:23 - 00000000 ___RD () C:\Users\Chris\AppData\Roaming\Brother2014-09-09 12:00 - 2014-09-19 19:12 - 00003206 _____ () C:\Windows\System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-4281378426-1232025690-3597593534-10002014-09-09 09:42 - 2014-09-09 09:42 - 00000000 ____D () C:\Windows\PCHEALTH2014-09-09 09:35 - 2014-07-09 03:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDYAK.DLL2014-09-09 09:35 - 2014-07-09 03:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDTAT.DLL2014-09-09 09:35 - 2014-07-09 03:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU1.DLL2014-09-09 09:35 - 2014-07-09 03:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDBASH.DLL2014-09-09 09:35 - 2014-07-09 03:03 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU.DLL2014-09-09 09:35 - 2014-07-09 02:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDYAK.DLL2014-09-09 09:35 - 2014-07-09 02:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDTAT.DLL2014-09-09 09:35 - 2014-07-09 02:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU1.DLL2014-09-09 09:35 - 2014-07-09 02:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU.DLL2014-09-09 09:35 - 2014-07-09 02:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDBASH.DLL2014-09-09 09:35 - 2014-07-08 23:38 - 00419992 _____ () C:\Windows\system32\locale.nls2014-09-09 09:35 - 2014-07-08 23:30 - 00419992 _____ () C:\Windows\SysWOW64\locale.nls2014-09-08 10:42 - 2014-09-08 10:42 - 00000000 ____D () C:\Users\Chris\Documents\Updater52014-09-08 10:41 - 2014-09-08 10:41 - 00000000 ____D () C:\ProgramData\FLEXnet2014-09-08 10:36 - 2014-09-15 16:56 - 00001888 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe LiveCycle Designer 8.0.lnk2014-09-08 10:13 - 2014-09-19 19:12 - 00003340 _____ () C:\Windows\System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-4281378426-1232025690-3597593534-10002014-09-07 17:56 - 2014-09-07 17:56 - 00000000 _____ () C:\Users\Chris\Documents\bvxsnkyf.flv2014-09-07 17:50 - 2014-09-07 17:50 - 00000051 _____ () C:\Users\Chris\Documents\WUPDATE.LOG2014-09-07 17:45 - 2014-09-07 19:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FlvPlayer2014-09-07 10:30 - 2014-09-09 12:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office2014-09-07 10:29 - 2014-09-07 10:29 - 00000000 ____D () C:\Program Files\Microsoft Synchronization Services2014-09-07 10:29 - 2014-09-07 10:29 - 00000000 ____D () C:\Program Files\Microsoft SQL Server Compact Edition2014-09-07 10:27 - 2014-09-07 10:27 - 00000000 ____D () C:\Program Files\Microsoft Analysis Services2014-09-07 10:27 - 2014-09-07 10:27 - 00000000 ____D () C:\Program Files (x86)\Microsoft Analysis Services2014-09-06 13:57 - 2014-09-06 13:57 - 00000000 _____ () C:\autoexec.bat2014-09-06 13:56 - 2014-09-06 13:56 - 00000000 ____D () C:\Program Files\Enigma Software Group2014-09-06 13:56 - 2012-06-22 11:01 - 00022704 _____ () C:\Windows\system32\Drivers\EsgScanner.sys2014-09-06 13:55 - 2014-09-06 14:53 - 00000000 ____D () C:\Windows\ACF5FE1B377240688B872D2A6EFD0A05.TMP2014-09-06 13:52 - 2014-09-06 13:54 - 00000004 _____ () C:\ScrubRetValFile.txt2014-09-06 13:35 - 2014-09-06 13:35 - 00666894 _____ () C:\Users\Chris\Downloads\acrobat_ittools_cleaner_p2_061713.zip2014-09-06 13:02 - 2014-09-06 14:47 - 00000000 ____D () C:\Users\Chris\AppData\Roaming\Oporow2014-09-06 12:44 - 2014-08-23 03:07 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll2014-09-06 12:44 - 2014-08-23 02:45 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll2014-09-06 12:44 - 2014-08-23 01:59 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys2014-09-05 12:55 - 2014-09-05 14:18 - 00000000 ____D () C:\Users\Chris\AppData\Roaming\Weydzaw2014-09-05 12:55 - 2014-09-05 14:02 - 00000000 ____D () C:\Users\Chris\AppData\Roaming\Akliesg2014-09-04 11:16 - 2014-09-07 10:27 - 00000000 ____D () C:\Program Files (x86)\Microsoft Office2014-09-03 16:11 - 2014-09-03 16:11 - 00000000 ____D () C:\ProgramData\Malwarebytes2014-09-02 10:55 - 2014-09-02 10:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AC3Filter2014-09-02 10:55 - 2014-09-02 10:55 - 00000000 ____D () C:\Program Files (x86)\AC3Filter2014-09-02 10:28 - 2014-09-02 10:28 - 00000084 _____ () C:\Windows\wininit.ini2014-09-01 20:18 - 2014-09-19 19:26 - 00000000 ____D () C:\Users\Chris\AppData\Local\Ejtion2014-09-01 20:18 - 2014-09-10 12:46 - 00000000 ____D () C:\Users\Chris\AppData\Local\Okics2014-08-31 22:52 - 2014-09-09 09:52 - 00000060 _____ () C:\Users\Chris\Desktop\New Text Document.txt2014-08-31 11:50 - 2014-09-15 09:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Seagate2014-08-31 11:50 - 2014-08-31 11:51 - 00000000 ____D () C:\ProgramData\Package Cache2014-08-31 11:50 - 2014-08-31 11:50 - 00000000 ____D () C:\Program Files (x86)\Seagate2014-08-25 10:50 - 2014-08-26 18:47 - 00000000 ____D () C:\Users\Chris\Desktop\Quad Blueprints2014-08-22 18:25 - 2014-08-22 18:25 - 00000000 ____D () C:\Users\Chris\AppData\Roaming\Fox Dgital Copy2014-08-22 16:05 - 2014-08-22 16:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Free Mouse Auto Clicker2014-08-22 16:05 - 2014-08-22 16:05 - 00000000 ____D () C:\Program Files (x86)\Free Mouse Auto Clicker2014-08-21 06:30 - 2014-05-14 17:23 - 02477536 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll2014-08-21 06:30 - 2014-05-14 17:23 - 00700384 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll2014-08-21 06:30 - 2014-05-14 17:23 - 00581600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll2014-08-21 06:30 - 2014-05-14 17:23 - 00058336 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe2014-08-21 06:30 - 2014-05-14 17:23 - 00044512 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll2014-08-21 06:30 - 2014-05-14 17:23 - 00038880 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll2014-08-21 06:30 - 2014-05-14 17:23 - 00036320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll2014-08-21 06:30 - 2014-05-14 17:21 - 02620928 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll2014-08-21 06:30 - 2014-05-14 17:20 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll2014-08-21 06:30 - 2014-05-14 17:17 - 00092672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll2014-08-21 06:30 - 2014-05-14 09:23 - 00198600 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll2014-08-21 06:30 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll2014-08-21 06:30 - 2014-05-14 09:20 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe2014-08-21 06:30 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe==================== One Month Modified Files and Folders =======(If an entry is included in the fixlist, the file\folder will be moved.)2014-09-19 19:28 - 2014-09-19 19:28 - 00026590 _____ () C:\Users\Chris\Downloads\FRST.txt2014-09-19 19:28 - 2014-09-19 19:27 - 00000000 ____D () C:\FRST2014-09-19 19:26 - 2014-09-01 20:18 - 00000000 ____D () C:\Users\Chris\AppData\Local\Ejtion2014-09-19 19:23 - 2013-12-28 16:32 - 02072963 _____ () C:\Windows\WindowsUpdate.log2014-09-19 19:21 - 2013-12-28 18:42 - 00000000 ____D () C:\ProgramData\LogMeIn2014-09-19 19:21 - 2009-07-14 06:13 - 00787326 _____ () C:\Windows\system32\PerfStringBackup.INI2014-09-19 19:20 - 2009-07-14 05:45 - 00026384 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A02014-09-19 19:20 - 2009-07-14 05:45 - 00026384 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A02014-09-19 19:19 - 2014-03-20 14:56 - 00000562 _____ () C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-4281378426-1232025690-3597593534-1000.job2014-09-19 19:18 - 2014-09-19 19:18 - 02105856 _____ (Farbar) C:\Users\Chris\Downloads\FRST64.exe2014-09-19 19:15 - 2013-12-29 21:47 - 00000000 ____D () C:\Users\Chris\AppData\Roaming\uTorrent2014-09-19 19:12 - 2014-09-09 12:00 - 00003206 _____ () C:\Windows\System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-4281378426-1232025690-3597593534-10002014-09-19 19:12 - 2014-09-08 10:13 - 00003340 _____ () C:\Windows\System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-4281378426-1232025690-3597593534-10002014-09-19 19:11 - 2014-01-22 17:15 - 00001004 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Client.lnk2014-09-19 19:11 - 2014-01-22 17:15 - 00000988 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Control Panel.lnk2014-09-19 19:11 - 2010-11-21 04:47 - 00259560 _____ () C:\Windows\PFRO.log2014-09-19 19:11 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT2014-09-19 19:11 - 2009-07-14 05:51 - 00011587 _____ () C:\Windows\setupact.log2014-09-19 15:53 - 2014-02-09 11:40 - 00000000 ____D () C:\Users\Chris\AppData\Roaming\Skype2014-09-19 15:11 - 2013-12-28 18:23 - 00000000 ____D () C:\Users\Chris\AppData\Roaming\VMware2014-09-19 15:11 - 2013-12-28 18:23 - 00000000 ____D () C:\Users\Chris\AppData\Local\VMware2014-09-19 12:40 - 2009-07-14 06:08 - 00032608 _____ () C:\Windows\Tasks\SCHEDLGU.TXT2014-09-18 14:32 - 2011-04-12 09:28 - 00000000 ____D () C:\Windows\CSC2014-09-17 20:19 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\Web2014-09-17 18:38 - 2014-09-17 18:38 - 00000000 ____D () C:\Windows\pss2014-09-17 18:36 - 2014-03-20 14:56 - 00003588 _____ () C:\Windows\System32\Tasks\G2MUpdateTask-S-1-5-21-4281378426-1232025690-3597593534-10002014-09-17 14:21 - 2009-07-14 05:45 - 05072248 _____ () C:\Windows\system32\FNTCACHE.DAT2014-09-16 11:30 - 2014-09-16 09:58 - 00002465 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Acrobat Distiller X.lnk2014-09-16 11:30 - 2014-09-16 09:58 - 00002453 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Acrobat X Pro.lnk2014-09-16 11:30 - 2014-09-16 09:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe LiveCycle ES22014-09-16 11:30 - 2014-02-12 18:27 - 00000000 ____D () C:\ProgramData\Adobe2014-09-16 10:19 - 2013-12-28 17:59 - 00109280 _____ () C:\Users\Chris\AppData\Local\GDIPFONTCACHEV1.DAT2014-09-16 10:03 - 2014-06-06 18:31 - 00000000 ____D () C:\ProgramData\regid.1986-12.com.adobe2014-09-15 17:33 - 2014-07-16 09:12 - 00000845 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 9.lnk2014-09-15 16:57 - 2013-12-28 20:25 - 00000000 ____D () C:\Users\Chris\AppData\Local\Adobe2014-09-15 16:56 - 2014-09-08 10:36 - 00001888 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe LiveCycle Designer 8.0.lnk2014-09-15 09:58 - 2014-08-31 11:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Seagate2014-09-12 17:34 - 2013-12-29 12:02 - 00000000 ____D () C:\ProgramData\Microsoft Help2014-09-12 17:33 - 2014-09-12 17:33 - 00000000 ____D () C:\Program Files\Common Files\DESIGNER2014-09-12 17:31 - 2013-12-28 18:18 - 00771308 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI2014-09-12 17:29 - 2013-12-28 18:07 - 00002117 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk2014-09-12 17:29 - 2013-12-28 18:07 - 00001945 _____ () C:\Windows\epplauncher.mif2014-09-12 17:29 - 2013-12-28 18:07 - 00000000 ____D () C:\Program Files\Microsoft Security Client2014-09-12 17:29 - 2013-12-28 18:07 - 00000000 ____D () C:\Program Files (x86)\Microsoft Security Client2014-09-12 17:28 - 2013-12-28 18:09 - 00000000 ____D () C:\Windows\system32\MRT2014-09-12 17:26 - 2013-12-28 18:09 - 101694776 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe2014-09-11 15:17 - 2009-07-14 05:45 - 00000000 ____D () C:\Windows\Setup2014-09-10 18:56 - 2013-12-29 21:51 - 00000000 ____D () C:\Windows\AutoKMS2014-09-10 16:02 - 2014-09-10 16:01 - 119121656 _____ (Microsoft Corporation) C:\Users\Chris\Desktop\msert.exe2014-09-10 15:46 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\Help2014-09-10 12:46 - 2014-09-01 20:18 - 00000000 ____D () C:\Users\Chris\AppData\Local\Okics2014-09-09 12:39 - 2014-09-07 10:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office2014-09-09 12:23 - 2014-09-09 12:23 - 00000000 ___RD () C:\Users\Chris\AppData\Roaming\Brother2014-09-09 12:23 - 2014-01-26 11:42 - 00000426 _____ () C:\Windows\BRWMARK.INI2014-09-09 09:52 - 2014-08-31 22:52 - 00000060 _____ () C:\Users\Chris\Desktop\New Text Document.txt2014-09-09 09:42 - 2014-09-09 09:42 - 00000000 ____D () C:\Windows\PCHEALTH2014-09-09 09:29 - 2013-12-28 16:31 - 00000000 ____D () C:\Users\Chris\AppData\Local\VirtualStore2014-09-08 10:42 - 2014-09-08 10:42 - 00000000 ____D () C:\Users\Chris\Documents\Updater52014-09-08 10:41 - 2014-09-08 10:41 - 00000000 ____D () C:\ProgramData\FLEXnet2014-09-07 19:44 - 2014-09-07 17:45 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FlvPlayer2014-09-07 17:56 - 2014-09-07 17:56 - 00000000 _____ () C:\Users\Chris\Documents\bvxsnkyf.flv2014-09-07 17:50 - 2014-09-07 17:50 - 00000051 _____ () C:\Users\Chris\Documents\WUPDATE.LOG2014-09-07 11:38 - 2014-03-08 11:55 - 00000000 ____D () C:\Program Files (x86)\Xvid2014-09-07 10:29 - 2014-09-07 10:29 - 00000000 ____D () C:\Program Files\Microsoft Synchronization Services2014-09-07 10:29 - 2014-09-07 10:29 - 00000000 ____D () C:\Program Files\Microsoft SQL Server Compact Edition2014-09-07 10:29 - 2009-07-14 04:20 - 00000000 ____D () C:\Program Files\Common Files\Microsoft Shared2014-09-07 10:27 - 2014-09-07 10:27 - 00000000 ____D () C:\Program Files\Microsoft Analysis Services2014-09-07 10:27 - 2014-09-07 10:27 - 00000000 ____D () C:\Program Files (x86)\Microsoft Analysis Services2014-09-07 10:27 - 2014-09-04 11:16 - 00000000 ____D () C:\Program Files (x86)\Microsoft Office2014-09-07 10:27 - 2011-04-12 09:28 - 00000000 ____D () C:\Windows\ShellNew2014-09-06 14:53 - 2014-09-06 13:55 - 00000000 ____D () C:\Windows\ACF5FE1B377240688B872D2A6EFD0A05.TMP2014-09-06 14:47 - 2014-09-06 13:02 - 00000000 ____D () C:\Users\Chris\AppData\Roaming\Oporow2014-09-06 13:57 - 2014-09-06 13:57 - 00000000 _____ () C:\autoexec.bat2014-09-06 13:56 - 2014-09-06 13:56 - 00000000 ____D () C:\Program Files\Enigma Software Group2014-09-06 13:54 - 2014-09-06 13:52 - 00000004 _____ () C:\ScrubRetValFile.txt2014-09-06 13:37 - 2014-06-06 18:28 - 00000000 ____D () C:\Program Files\Common Files\Adobe2014-09-06 13:37 - 2013-12-28 20:16 - 00000000 ____D () C:\Users\Chris\AppData\Roaming\Adobe2014-09-06 13:35 - 2014-09-06 13:35 - 00666894 _____ () C:\Users\Chris\Downloads\acrobat_ittools_cleaner_p2_061713.zip2014-09-05 14:18 - 2014-09-05 12:55 - 00000000 ____D () C:\Users\Chris\AppData\Roaming\Weydzaw2014-09-05 14:02 - 2014-09-05 12:55 - 00000000 ____D () C:\Users\Chris\AppData\Roaming\Akliesg2014-09-03 17:05 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\tracing2014-09-03 16:11 - 2014-09-03 16:11 - 00000000 ____D () C:\ProgramData\Malwarebytes2014-09-02 10:55 - 2014-09-02 10:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AC3Filter2014-09-02 10:55 - 2014-09-02 10:55 - 00000000 ____D () C:\Program Files (x86)\AC3Filter2014-09-02 10:32 - 2014-03-08 11:47 - 00004608 _____ () C:\Users\Chris\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini2014-09-02 10:30 - 2014-02-07 20:53 - 00000000 ____D () C:\Windows\system32\appmgmt2014-09-02 10:29 - 2014-08-01 16:38 - 00000000 ____D () C:\Program Files (x86)\DSP-worx2014-09-02 10:28 - 2014-09-02 10:28 - 00000084 _____ () C:\Windows\wininit.ini2014-09-01 15:13 - 2014-01-02 19:15 - 00000600 _____ () C:\Users\Chris\AppData\Local\PUTTY.RND2014-08-31 11:51 - 2014-08-31 11:50 - 00000000 ____D () C:\ProgramData\Package Cache2014-08-31 11:50 - 2014-08-31 11:50 - 00000000 ____D () C:\Program Files (x86)\Seagate2014-08-26 18:47 - 2014-08-25 10:50 - 00000000 ____D () C:\Users\Chris\Desktop\Quad Blueprints2014-08-24 15:49 - 2013-12-29 13:00 - 00003158 _____ () C:\Windows\System32\Tasks\Private Internet Access Startup2014-08-24 15:48 - 2013-12-28 21:30 - 00000000 ____D () C:\Program Files\pia_manager2014-08-23 03:07 - 2014-09-06 12:44 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll2014-08-23 02:45 - 2014-09-06 12:44 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll2014-08-23 01:59 - 2014-09-06 12:44 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys2014-08-22 18:26 - 2014-03-13 18:58 - 00000000 ____D () C:\Users\Chris\AppData\Roaming\dvdcss2014-08-22 18:25 - 2014-08-22 18:25 - 00000000 ____D () C:\Users\Chris\AppData\Roaming\Fox Dgital Copy2014-08-22 16:05 - 2014-08-22 16:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Free Mouse Auto Clicker2014-08-22 16:05 - 2014-08-22 16:05 - 00000000 ____D () C:\Program Files (x86)\Free Mouse Auto Clicker2014-08-22 15:30 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescacheSome content of TEMP:====================C:\Users\Chris\AppData\Local\Temp\UpdateFlashPlayer_77ea467e.exe==================== Bamital & volsnap Check =================(There is no automatic fix for files that do not pass verification.)C:\Windows\System32\winlogon.exe => File is digitally signedC:\Windows\System32\wininit.exe => File is digitally signedC:\Windows\SysWOW64\wininit.exe => File is digitally signedC:\Windows\explorer.exe => File is digitally signedC:\Windows\SysWOW64\explorer.exe => File is digitally signedC:\Windows\System32\svchost.exe => File is digitally signedC:\Windows\SysWOW64\svchost.exe => File is digitally signedC:\Windows\System32\services.exe => File is digitally signedC:\Windows\System32\User32.dll => File is digitally signedC:\Windows\SysWOW64\User32.dll => File is digitally signedC:\Windows\System32\userinit.exe => File is digitally signedC:\Windows\SysWOW64\userinit.exe => File is digitally signedC:\Windows\System32\rpcss.dll => File is digitally signedC:\Windows\System32\Drivers\volsnap.sys => File is digitally signedLastRegBack: 2014-09-16 13:23==================== End Of Log ============================ Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted September 20, 2014 Root Admin ID:881026 Share Posted September 20, 2014 This topic will now be closed due to evidence of cracked or pirated software on this system. Piracy Policy Link to post Share on other sites More sharing options...
Recommended Posts