Ext Export exe

BrettL · October 16, 2014

Looks like I have an ext export exe file infection now but am not sure how to differentiate the infection from the normal dll. Got a ransomware pop-up that MWB and Anti-exploit did not detect or block and that wasn't detected by Hitman Pro or Emsisoft. Thoughts or help please?

kevinf80 · October 16, 2014

Hello and

P2P/Piracy Warning:

If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall them or completely disable them from running while being assisted here.Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.If you have illegal/cracked software, cracks, keygens etc. on the system, please remove or uninstall them now and read the policy on Piracy.

Download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system (32 bit or 64 bit). If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

Double-click to run it. When the tool opens click Yes to disclaimer.
Press Scan button.
It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

Kevin..

BrettL · October 17, 2014

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 16-10-2014

Ran by Brett (administrator) on ELVIS on 16-10-2014 21:32:58

Running from C:\Users\Brett\Desktop

Loaded Profile: Brett (Available profiles: Brett)

Platform: Windows 8 (X64) OS Language: English (United States)

Internet Explorer Version 10

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Webroot) C:\Program Files\Webroot\WRSA.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe

(SurfRight B.V.) C:\Program Files\HitmanPro\hmpsched.exe

(Microsoft Corporation) C:\Windows\System32\wlanext.exe

(SEIKO EPSON CORPORATION) C:\Program Files (x86)\Common Files\EPSON\EBAPI\eEBSvc.exe

(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe

(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe

(Intel® Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe

(Microsoft Corporation) C:\Windows\System32\dasHost.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\Jhi_service.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae-svc.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe

(Native Instruments GmbH) C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe

(PACE Anti-Piracy, Inc.) C:\Program Files (x86)\Common Files\PACE\Services\LicenseServices\LDSvc.exe

(pdfforge GmbH) C:\Program Files (x86)\PDF Architect\HelperService.exe

(Intel® Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe

() C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe

(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe

(WIBU-SYSTEMS AG) C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(SurfRight B.V.) C:\Program Files\HitmanPro\HitmanPro.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe

(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe\LiveComm.exe

(Webroot) C:\Program Files\Webroot\WRSA.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(Microsoft Corporation) C:\Windows\System32\rundll32.exe

(Dell Inc.) C:\Program Files\Dell\QuickSet\quickset.exe

(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe

(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe

(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe

(Microsoft Corporation) C:\Users\Brett\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe

(Dell) C:\Users\Brett\AppData\Local\Apps\2.0\Y4HAQ5M8.MZY\ZCZTO1CY.ET3\dell..tion_0f612f649c4a10af_0005.0008_a4204ff54ae5d3ac\DellSystemDetect.exe

(WIBU-SYSTEMS AG) C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeterCC.exe

(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe

(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe

(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe

(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe

(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe

(Dropbox, Inc.) C:\Users\Brett\AppData\Roaming\Dropbox\bin\Dropbox.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\APSDaemon.exe

(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE

(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\office15\MSOSYNC.EXE

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\office15\MSOSYNC.EXE

(Intel Corporation) C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe

(Microsoft Corporation) C:\Windows\System32\msiexec.exe

(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe

(Intel® Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe

(Dell Products, LP.) C:\Program Files (x86)\Dell Digital Delivery\DeliveryService.exe

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [DellWPF] => [X]

HKLM\...\Run: [bTMTrayAgent] => rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshellex.dll",TrayApp

HKLM\...\Run: [PocketCloud Location] => C:\Program Files (x86)\Wyse\PocketCloud Windows Companion\WyseBrowser.exe [933776 2012-10-24] (Wyse Technology Inc.)

HKLM\...\Run: [QuickSet] => C:\Program Files\Dell\QuickSet\QuickSet.exe [5762408 2013-03-05] (Dell Inc.)

HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch

HKLM\...\Run: [iAStorIcon] => C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe [287592 2013-08-30] (Intel Corporation)

HKLM-x32\...\Run: [CLMLServer_For_P2G8] => C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [111120 2012-06-07] (CyberLink)

HKLM-x32\...\Run: [CLVirtualDrive] => C:\Program Files (x86)\CyberLink\Power2Go8\VirtualDrive.exe [491120 2012-07-04] (CyberLink Corp.)

HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [143888 2012-06-01] (CyberLink Corp.)

HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43816 2014-07-31] (Apple Inc.)

HKLM-x32\...\Run: [WRSVC] => C:\Program Files\Webroot\WRSA.exe [767664 2014-09-28] (Webroot)

HKLM-x32\...\Run: [EEventManager] => C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe [976320 2009-12-03] (SEIKO EPSON CORPORATION)

HKLM-x32\...\Run: [FUFAXSTM] => C:\Program Files (x86)\Epson Software\FAX Utility\FUFAXSTM.exe [847872 2009-12-03] (SEIKO EPSON CORPORATION)

HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-12-21] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [Malwarebytes Anti-Exploit] => C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe [440632 2014-08-29] (Malwarebytes Corporation)

HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)

HKLM-x32\...\Run: [sunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-11] (Oracle Corporation)

HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-09-01] (Apple Inc.)

Winlogon\Notify\igfxcui: C:\windows\system32\igfxdev.dll (Intel Corporation)

HKU\S-1-5-21-858208724-3078971120-2626913202-1001\...\Run: [Google Update] => C:\Users\Brett\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2013-05-10] (Google Inc.)

HKU\S-1-5-21-858208724-3078971120-2626913202-1001\...\Run: [MusicManager] => C:\Users\Brett\AppData\Local\Programs\Google\MusicManager\MusicManager.exe [7631872 2014-07-22] (Google Inc.)

HKU\S-1-5-21-858208724-3078971120-2626913202-1001\...\Run: [GoogleDriveSync] => C:\Program Files (x86)\Google\Drive\googledrivesync.exe [22415552 2014-04-25] (Google)

HKU\S-1-5-21-858208724-3078971120-2626913202-1001\...\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [59720 2013-11-20] (Apple Inc.)

HKU\S-1-5-21-858208724-3078971120-2626913202-1001\...\Run: [ApplePhotoStreams] => C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [59720 2013-11-20] (Apple Inc.)

HKU\S-1-5-21-858208724-3078971120-2626913202-1001\...\Run: [Amazon Music] => C:\Users\Brett\AppData\Local\Amazon Music\Amazon Music Helper.exe [3162944 2014-06-24] ()

HKU\S-1-5-21-858208724-3078971120-2626913202-1001\...\Run: [skyDrive] => C:\Users\Brett\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe [277672 2014-09-25] (Microsoft Corporation)

HKU\S-1-5-21-858208724-3078971120-2626913202-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [6482200 2014-09-26] (Piriform Ltd)

HKU\S-1-5-21-858208724-3078971120-2626913202-1001\...\Run: [DellSystemDetect] => C:\Users\Brett\AppData\Local\Apps\2.0\Y4HAQ5M8.MZY\ZCZTO1CY.ET3\dell..tion_0f612f649c4a10af_0005.0008_a4204ff54ae5d3ac\DellSystemDetect.exe [262720 2014-06-12] (Dell)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\CodeMeter Control Center.lnk

ShortcutTarget: CodeMeter Control Center.lnk -> C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeterCC.exe (WIBU-SYSTEMS AG)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Install LastPass IE RunOnce.lnk

ShortcutTarget: Install LastPass IE RunOnce.lnk -> C:\Program Files (x86)\Common Files\lpuninstall.exe (LastPass)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Install Webroot FF RunOnce.lnk

ShortcutTarget: Install Webroot FF RunOnce.lnk -> C:\Program Files (x86)\Common Files\wruninstall.exe (Webroot Software, Inc.)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Install Webroot IE RunOnce.lnk

ShortcutTarget: Install Webroot IE RunOnce.lnk -> C:\Program Files (x86)\Common Files\wruninstall.exe (Webroot Software, Inc.)

Startup: C:\Users\Brett\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk

ShortcutTarget: Dropbox.lnk -> C:\Users\Brett\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

Startup: C:\Users\Brett\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Send to OneNote.lnk

ShortcutTarget: Send to OneNote.lnk -> C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE (Microsoft Corporation)

ShellIconOverlayIdentifiers: [_WrSyncExcl] -> {8D7FC74C-E409-42DF-8EEE-69D45FAE2F30} => C:\windows\system32\WRusr.dll (Webroot)

ShellIconOverlayIdentifiers: [_WrSyncGreen] -> {6DA1ED92-315E-4D0B-B354-9D5F519DBA95} => C:\windows\system32\WRusr.dll (Webroot)

ShellIconOverlayIdentifiers: [_WrSyncRed] -> {1914B27A-33C8-46F8-A1C2-F993268D4564} => C:\windows\system32\WRusr.dll (Webroot)

ShellIconOverlayIdentifiers: [_WrSyncYellow] -> {C14874EA-ACE4-4A47-8A81-18C4D1C40868} => C:\windows\system32\WRusr.dll (Webroot)

BootExecute: autocheck autochk * bootdelete

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)

BHO: LastPass Vault -> {95D9ECF5-2A4D-4550-BE49-70D42F71296E} -> C:\Program Files (x86)\LastPass\LPToolbar_x64.dll (LastPass)

BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

BHO: Webroot Vault -> {c8d5d964-2be8-4c5b-8cf5-6e975aa88504} -> C:\ProgramData\WRData\pkg\LPBar64.dll (Webroot)

BHO: Webroot Filtering Extension -> {C9C42510-9B41-42c1-9DCD-7282A2D07C61} -> C:\Program Files\Webroot\WRData\PKG\Vistax64\wrflt.dll (Webroot)

BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)

BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)

BHO-x32: Java Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: LastPass Vault -> {95D9ECF5-2A4D-4550-BE49-70D42F71296E} -> C:\Program Files (x86)\LastPass\LPToolbar.dll (LastPass)

BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

BHO-x32: Webroot Vault -> {c8d5d964-2be8-4c5b-8cf5-6e975aa88504} -> C:\ProgramData\WRData\pkg\LPBar.dll (Webroot)

BHO-x32: Webroot Filtering Extension -> {C9C42510-9B41-42c1-9DCD-7282A2D07C61} -> C:\Program Files\Webroot\WRData\PKG\Vistax86\wrflt.dll (Webroot)

BHO-x32: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

Toolbar: HKLM - Webroot Toolbar - {97ab88ef-346b-4179-a0b1-7445896547a5} - C:\ProgramData\WRData\pkg\LPBar64.dll (Webroot)

Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

Toolbar: HKLM - LastPass Toolbar - {9f6b5cc3-5c7b-4b5c-97af-19dec1e380e5} - C:\Program Files (x86)\LastPass\LPToolbar_x64.dll (LastPass)

Toolbar: HKLM-x32 - Webroot Toolbar - {97ab88ef-346b-4179-a0b1-7445896547a5} - C:\ProgramData\WRData\pkg\LPBar.dll (Webroot)

Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

Toolbar: HKLM-x32 - LastPass Toolbar - {9f6b5cc3-5c7b-4b5c-97af-19dec1e380e5} - C:\Program Files (x86)\LastPass\LPToolbar.dll (LastPass)

Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:

========

FF ProfilePath: C:\Users\Brett\AppData\Roaming\Mozilla\Firefox\Profiles\fkfx4w4c.default

FF Plugin: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)

FF Plugin: @lastpass.com/NPLastPass -> C:\Program Files (x86)\LastPass\nplastpass64.dll (LastPass)

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)

FF Plugin: @tracker-software.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)

FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll No File

FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()

FF Plugin-x32: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)

FF Plugin-x32: @java.com/DTPlugin,version=10.65.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.65.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @lastpass.com/NPLastPass -> C:\Program Files (x86)\LastPass\nplastpass.dll (LastPass)

FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll (Microsoft Corporation)

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3522.0110 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tracker-software.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)

FF Plugin-x32: @videolan.org/vlc,version=2.0.0 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin HKCU: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)

FF Plugin HKCU: @talk.google.com/GoogleTalkPlugin -> C:\Users\Brett\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)

FF Plugin HKCU: @talk.google.com/O1DPlugin -> C:\Users\Brett\AppData\Roaming\Mozilla\plugins\npo1d.dll (Google)

FF Plugin HKCU: @tools.google.com/Google Update;version=3 -> C:\Users\Brett\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF Plugin HKCU: @tools.google.com/Google Update;version=9 -> C:\Users\Brett\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll (Microsoft Corporation)

FF Plugin ProgramFiles/Appdata: C:\Users\Brett\AppData\Roaming\mozilla\plugins\npgoogletalk.dll (Google)

FF Plugin ProgramFiles/Appdata: C:\Users\Brett\AppData\Roaming\mozilla\plugins\npo1d.dll (Google)

FF HKLM-x32\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt

FF Extension: PDF Architect Converter For Firefox - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt [2013-09-13]

FF HKLM-x32\...\Firefox\Extensions: [webrootsecure@webroot.com] - C:\ProgramData\WRData\PKG\FIREFOX\WebrootSecure_SocketServer

FF Extension: Webroot Filtering Extension - C:\ProgramData\WRData\PKG\FIREFOX\WebrootSecure_SocketServer [2013-11-11]

FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK

Chrome:

=======

CHR HomePage: Default ->

CHR StartupUrls: Default -> "hxxp://search.findwide.com/?guid={0E474792-D4EE-4406-8D59-3EF8E2F24A21}&serpv=22", "hxxp://mysearch.avg.com?cid={604943F2-621F-4B90-BD50-6C820DE0DCB7}&mid=778712800de847d39d39b17f9b4d5200-5fdac30f9cd384a17f614c8599ee0e68d95b43a3〈=en&ds=co011&coid=avgtbdisco&cmpid=&pr=sa&d=2014-02-05 21:24:35&v=17.3.1.204&pid=safeguard&sg=0&sap=hp", "hxxp://mysearch.avg.com?cid={604943F2-621F-4B90-BD50-6C820DE0DCB7}&mid=778712800de847d39d39b17f9b4d5200-5fdac30f9cd384a17f614c8599ee0e68d95b43a3〈=en&ds=co011&coid=avgtbdisco&cmpid=&pr=sa&d=2014-02-05 21:24:35&v=18.1.0.447&pid=safeguard&sg=0&sap=hp", "hxxp://mysearch.avg.com?cid={604943F2-621F-4B90-BD50-6C820DE0DCB7}&mid=778712800de847d39d39b17f9b4d5200-5fdac30f9cd384a17f614c8599ee0e68d95b43a3〈=en&ds=co011&coid=avgtbdisco&cmpid=&pr=sa&d=2014-02-05 21:24:35&v=18.1.5.516&pid=safeguard&sg=0&sap=hp"

CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:inputType}{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}{google:searchVersion}{google:sessionToken}{google:prefetchQuery}sugkey={google:suggestAPIKeyParameter}

CHR Profile: C:\Users\Brett\AppData\Local\Google\Chrome\User Data\Default

CHR Extension: (Beatlab) - C:\Users\Brett\AppData\Local\Google\Chrome\User Data\Default\Extensions\alnfdikmbdfgkcbdodjcbmedanjinmkk [2014-03-13]

CHR Extension: (Google Docs) - C:\Users\Brett\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-03-13]

CHR Extension: (Google Drive) - C:\Users\Brett\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-03-14]

CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Brett\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-05-21]

CHR Extension: (Audiotool) - C:\Users\Brett\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkgoccjhfjgjedhkiefaclppgbmoobnk [2014-03-13]

CHR Extension: (eBay) - C:\Users\Brett\AppData\Local\Google\Chrome\User Data\Default\Extensions\bnadbgmffcofipfljniafanjcafjlbom [2014-03-13]

CHR Extension: (HelloFax: 50 Free Fax Pages) - C:\Users\Brett\AppData\Local\Google\Chrome\User Data\Default\Extensions\bocmleclimfnadgmcdgecijlblfcmfnm [2014-03-13]

CHR Extension: (DuckDuckGo for Chrome) - C:\Users\Brett\AppData\Local\Google\Chrome\User Data\Default\Extensions\bpphkkgodbfncbcpgopijlfakfgmclao [2014-03-15]

CHR Extension: (Adblock Plus) - C:\Users\Brett\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2014-02-10]

CHR Extension: (Calculator) - C:\Users\Brett\AppData\Local\Google\Chrome\User Data\Default\Extensions\decmldkknaaemlafplkkdmmmelbdnlja [2014-03-23]

CHR Extension: (Jiggyape) - C:\Users\Brett\AppData\Local\Google\Chrome\User Data\Default\Extensions\dliinfodbpfagbocaidgdmhokfnabpnk [2014-08-21]

CHR Extension: (Gmail Offline) - C:\Users\Brett\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejidjjhkpiempkbhmpbfngldlkglhimk [2014-03-13]

CHR Extension: (Google Calendar) - C:\Users\Brett\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejjicmeblgpmajnghnpcppodonldlgfn [2014-03-13]

CHR Extension: (Pandora) - C:\Users\Brett\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbangkleohkafngihneedemihgfeikcl [2014-03-13]

CHR Extension: (Virtual Piano Black) - C:\Users\Brett\AppData\Local\Google\Chrome\User Data\Default\Extensions\fjagcpcbacoaogfljhglghpjhkmmfeeo [2014-03-13]

CHR Extension: (Mixify Turntables) - C:\Users\Brett\AppData\Local\Google\Chrome\User Data\Default\Extensions\flbjgnhcjdkihdiidhimgkcbmdbamkob [2014-03-13]

CHR Extension: (Google Play Movies) - C:\Users\Brett\AppData\Local\Google\Chrome\User Data\Default\Extensions\fppdphmgcddhjeddoeghpjefkdlccljb [2014-03-13]

CHR Extension: (HTTPS Everywhere) - C:\Users\Brett\AppData\Local\Google\Chrome\User Data\Default\Extensions\gcbommkclmclpchllfjekcdonpmejbdp [2014-03-15]

CHR Extension: (Pin It Button) - C:\Users\Brett\AppData\Local\Google\Chrome\User Data\Default\Extensions\gpdjojdkbbmdfjfahjcgigfpmkopogic [2014-10-07]

CHR Extension: (LastPass: Free Password Manager) - C:\Users\Brett\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdokiejnpimakedhajhdlcegeplioahd [2014-04-09]

CHR Extension: (NPR Infinite Player) - C:\Users\Brett\AppData\Local\Google\Chrome\User Data\Default\Extensions\hkpcelemhneoooapbbopolpjhmbfmnbf [2014-03-13]

CHR Extension: (Kindle Cloud Reader) - C:\Users\Brett\AppData\Local\Google\Chrome\User Data\Default\Extensions\icdipabjmbhpdkjaihfjoikhjjeneebd [2014-03-13]

CHR Extension: (Pixlr Editor) - C:\Users\Brett\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmaknaampgiegkcjlimdiidlhopknpk [2014-03-13]

CHR Extension: (Google Play Music) - C:\Users\Brett\AppData\Local\Google\Chrome\User Data\Default\Extensions\icppfcnhkcmnfdhfhphakoifcfokfdhg [2014-03-13]

CHR Extension: (The Weather Channel for Chrome) - C:\Users\Brett\AppData\Local\Google\Chrome\User Data\Default\Extensions\iflpcokdamgefbghpdipcibmhlkdopop [2014-03-13]

CHR Extension: (Dropbox) - C:\Users\Brett\AppData\Local\Google\Chrome\User Data\Default\Extensions\ioekoebejdcmnlefjiknokhhafglcjdl [2014-03-13]

CHR Extension: (Lose It!) - C:\Users\Brett\AppData\Local\Google\Chrome\User Data\Default\Extensions\jehemifhdilebjjpibeianiedocpgocn [2014-03-13]

CHR Extension: (Disconnect) - C:\Users\Brett\AppData\Local\Google\Chrome\User Data\Default\Extensions\jeoacafpbcihiomhlakheieifhpjdfeo [2014-03-15]

CHR Extension: (Webroot Filtering Extension) - C:\Users\Brett\AppData\Local\Google\Chrome\User Data\Default\Extensions\kjeghcllfecehndceplomkocgfbklffd [2014-10-13]

CHR Extension: (World Clock) - C:\Users\Brett\AppData\Local\Google\Chrome\User Data\Default\Extensions\klalbmkcicglbbedmdlkidhkiaelhdog [2014-03-13]

CHR Extension: (Until AM Web App) - C:\Users\Brett\AppData\Local\Google\Chrome\User Data\Default\Extensions\kodigjkcpaoeodlnmcnekemakpnmegnk [2014-03-13]

CHR Extension: (DuckDuckGo Home Page) - C:\Users\Brett\AppData\Local\Google\Chrome\User Data\Default\Extensions\ljkalbbbffedallekgkdheknngopfhif [2014-03-15]

CHR Extension: (AudioSauna) - C:\Users\Brett\AppData\Local\Google\Chrome\User Data\Default\Extensions\lkgfemnodkdnenmfkblebnkjpckkjcae [2014-03-13]

CHR Extension: (Google Maps) - C:\Users\Brett\AppData\Local\Google\Chrome\User Data\Default\Extensions\lneaknkopdijkpnocmklfnjbeapigfbh [2014-03-13]

CHR Extension: (Google Play Books) - C:\Users\Brett\AppData\Local\Google\Chrome\User Data\Default\Extensions\mmimngoggfoobjdlefbcabngfnmieonb [2014-03-13]

CHR Extension: (Google Wallet) - C:\Users\Brett\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-03]

CHR Extension: (Privacy Badger) - C:\Users\Brett\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkehgijcmpdhfbdbbnkijodmdjhbjlgp [2014-05-02]

CHR HKCU\...\Chrome\Extension: [apdfllckaahabafndbhieahigkjlhalf] - C:\Users\Brett\AppData\Local\Google\Drive\apdfllckaahabafndbhieahigkjlhalf_live.crx [2014-03-14]

CHR HKLM-x32\...\Chrome\Extension: [kjeghcllfecehndceplomkocgfbklffd] - C:\ProgramData\WRData\PKG\CHROME\CHROME_1.0.0.26.crx [2014-01-31]

CHR HKLM-x32\...\Chrome\Extension: [okfhiodnpcnnnpgbjbhfebjnbagmfhab] - C:\ProgramData\WRData\pkg\lpchrome.crx [2013-05-07]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2428088 2014-08-12] (Microsoft Corporation)

R2 DellUpdate; C:\Program Files (x86)\Dell Update\DellUpService.exe [150224 2014-09-09] (Dell Inc.)

R2 EpsonBidirectionalService; C:\Program Files (x86)\Common Files\EPSON\EBAPI\eEBSVC.exe [94208 2006-12-19] (SEIKO EPSON CORPORATION) [File not signed]

R2 HitmanProScheduler; C:\Program Files\HitmanPro\hmpsched.exe [127752 2014-09-30] (SurfRight B.V.)

R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [15720 2013-08-30] (Intel Corporation)

R2 jhi_service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [165760 2012-07-17] (Intel Corporation)

S3 KeyIso; C:\Windows\SysWOW64\keyiso.dll [43520 2012-07-25] (Microsoft Corporation)

R2 MbaeSvc; C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae-svc.exe [441144 2014-08-29] (Malwarebytes Corporation)

R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)

R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)

S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [273136 2013-08-28] ()

S3 Netlogon; C:\Windows\SysWOW64\netlogon.dll [634368 2012-07-25] (Microsoft Corporation)

R2 PDF Architect Helper Service; C:\Program Files (x86)\PDF Architect\HelperService.exe [1320496 2013-04-08] (pdfforge GmbH)

S2 PDF Architect Service; C:\Program Files (x86)\PDF Architect\ConversionService.exe [799280 2013-04-08] (pdfforge GmbH)

R2 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [254512 2012-04-24] ()

R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [201872 2012-11-23] (Realtek Semiconductor)

S3 StorSvc; C:\Windows\SysWOW64\storsvc.dll [18432 2012-07-25] (Microsoft Corporation)

S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16056 2014-03-29] (Microsoft Corporation)

R2 WRSVC; C:\Program Files\Webroot\WRSA.exe [767664 2014-09-28] (Webroot)

R2 WysePocketCloud; C:\Program Files (x86)\Wyse\PocketCloud Windows Companion\PocketCloudService.exe [188928 2012-10-24] () [File not signed]

R2 WyseRemoteAccess; C:\Program Files (x86)\Wyse\PocketCloud Windows Companion\WyseRemoteAccess.exe [1436160 2012-10-24] (Wyse Technology.) [File not signed]

R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3378416 2013-08-28] (Intel® Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R1 A2DDA; C:\EEK\BIN\a2ddax64.sys [26176 2014-09-30] (Emsisoft GmbH)

S3 a8djavs; C:\Windows\System32\Drivers\a8djavs.sys [359784 2012-12-18] (Native Instruments GmbH)

S3 a8djusb_svc; C:\Windows\System32\Drivers\a8djusb.sys [100712 2012-12-18] (Native Instruments GmbH)

S3 BthA2DP; C:\Windows\system32\drivers\BthA2DP.sys [117632 2013-05-31] (Microsoft Corporation)

S3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [202752 2012-07-25] (Microsoft Corporation)

S3 btmaux; C:\Windows\system32\DRIVERS\btmaux.sys [121728 2012-08-27] (Motorola Solutions, Inc.)

S3 btmhsf; C:\Windows\system32\DRIVERS\btmhsf.sys [857472 2012-08-29] (Motorola Solutions, Inc.)

S3 cleanhlp; C:\EEK\bin\cleanhlp64.sys [57024 2014-09-30] (Emsisoft GmbH)

R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [92536 2012-06-25] (CyberLink)

S3 DellRbtn; C:\Windows\System32\drivers\DellRbtn.sys [10752 2012-08-05] (OSR Open Systems Resources, Inc.)

R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [487216 2014-09-11] (Symantec Corporation)

R1 ESProtectionDriver; C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae64.sys [63000 2014-08-30] ()

S3 gbxavs; C:\Windows\System32\Drivers\gbxavs.sys [357968 2011-07-07] (Native Instruments GmbH)

S3 gbxusb_svc; C:\Windows\System32\Drivers\gbxusb.sys [68688 2011-07-07] (Native Instruments GmbH)

S3 hitmanpro37; C:\windows\system32\drivers\hitmanpro37.sys [32512 2014-10-16] ()

R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation)

R3 MBAMSwissArmy; C:\windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-10-16] (Malwarebytes Corporation)

R3 MBAMWebAccessControl; C:\windows\system32\drivers\mwac.sys [64216 2014-05-12] (Malwarebytes Corporation)

R3 NETwNe64; C:\Windows\system32\DRIVERS\NETwew00.sys [3345376 2013-10-08] (Intel Corporation)

R3 NIWinCDEmu; C:\Windows\System32\drivers\NIWinCDEmu.sys [112408 2014-06-23] ()

S3 rspLLL; C:\Windows\System32\DRIVERS\rspLLL64.sys [23968 2013-02-07] (Resplendence Software Projects Sp.)

S3 SmbDrv; C:\Windows\System32\drivers\Smb_driver_AMDASF.sys [41272 2012-09-20] (Synaptics Incorporated)

R3 SmbDrvI; C:\Windows\System32\drivers\Smb_driver_Intel.sys [31472 2013-11-22] (Synaptics Incorporated)

S3 taphss6; C:\Windows\system32\DRIVERS\taphss6.sys [42184 2014-03-19] (Anchorfree Inc.)

R3 usb3Hub; C:\Windows\System32\drivers\usb3Hub.sys [47072 2012-10-09] (Windows ® Win 7 DDK provider)

R0 WRkrn; C:\Windows\System32\drivers\WRkrn.sys [115744 2014-09-28] (Webroot)

R3 XHCIPort; C:\Windows\System32\drivers\XHCIPort.sys [188896 2012-10-09] (Windows ® Win 7 DDK provider)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)

==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-16 21:32 - 2014-10-16 21:32 - 00033023 _____ () C:\Users\Brett\Desktop\FRST.txt

2014-10-16 21:32 - 2014-10-16 21:32 - 00000000 ____D () C:\Users\Brett\Desktop\FRST-OlderVersion

2014-10-16 16:09 - 2014-10-16 16:09 - 00032512 _____ () C:\windows\system32\Drivers\hitmanpro37.sys

2014-10-16 16:00 - 2014-10-16 20:46 - 00106972 _____ () C:\windows\PFRO.log

2014-10-16 12:57 - 2014-09-02 21:48 - 00510464 _____ (Microsoft Corporation) C:\windows\SysWOW64\rastls.dll

2014-10-16 12:57 - 2014-09-02 21:21 - 00585728 _____ (Microsoft Corporation) C:\windows\system32\rastls.dll

2014-10-16 12:53 - 2014-09-13 00:29 - 00079360 _____ (Microsoft Corporation) C:\windows\system32\packager.dll

2014-10-16 12:53 - 2014-09-12 23:02 - 00068096 _____ (Microsoft Corporation) C:\windows\SysWOW64\packager.dll

2014-10-16 10:00 - 2014-09-20 00:18 - 00051712 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe

2014-10-16 10:00 - 2014-09-20 00:17 - 02236928 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll

2014-10-16 10:00 - 2014-09-20 00:17 - 01407488 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll

2014-10-16 10:00 - 2014-09-20 00:17 - 00915968 _____ (Microsoft Corporation) C:\windows\system32\uxtheme.dll

2014-10-16 10:00 - 2014-09-20 00:17 - 00053760 _____ (Microsoft Corporation) C:\windows\system32\UXInit.dll

2014-10-16 10:00 - 2014-09-20 00:16 - 19280896 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll

2014-10-16 10:00 - 2014-09-20 00:16 - 15399424 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll

2014-10-16 10:00 - 2014-09-20 00:16 - 03959296 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll

2014-10-16 10:00 - 2014-09-20 00:16 - 02655232 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll

2014-10-16 10:00 - 2014-09-20 00:16 - 00855552 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll

2014-10-16 10:00 - 2014-09-20 00:16 - 00603136 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll

2014-10-16 10:00 - 2014-09-20 00:16 - 00255488 _____ (Microsoft Corporation) C:\windows\system32\iedkcs32.dll

2014-10-16 10:00 - 2014-09-20 00:16 - 00197120 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll

2014-10-16 10:00 - 2014-09-20 00:16 - 00136704 _____ (Microsoft Corporation) C:\windows\system32\iesysprep.dll

2014-10-16 10:00 - 2014-09-20 00:16 - 00097280 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll

2014-10-16 10:00 - 2014-09-20 00:16 - 00067072 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll

2014-10-16 10:00 - 2014-09-20 00:16 - 00053760 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll

2014-10-16 10:00 - 2014-09-20 00:16 - 00039936 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll

2014-10-16 10:00 - 2014-09-20 00:15 - 01508864 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl

2014-10-16 10:00 - 2014-09-20 00:15 - 00451584 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll

2014-10-16 10:00 - 2014-09-20 00:15 - 00281600 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll

2014-10-16 10:00 - 2014-09-19 22:57 - 14368768 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll

2014-10-16 10:00 - 2014-09-19 22:57 - 13757952 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll

2014-10-16 10:00 - 2014-09-19 22:57 - 02861568 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll

2014-10-16 10:00 - 2014-09-19 22:57 - 02055168 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll

2014-10-16 10:00 - 2014-09-19 22:57 - 01762816 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll

2014-10-16 10:00 - 2014-09-19 22:57 - 01180672 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll

2014-10-16 10:00 - 2014-09-19 22:57 - 00690688 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll

2014-10-16 10:00 - 2014-09-19 22:57 - 00493056 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll

2014-10-16 10:00 - 2014-09-19 22:57 - 00226816 _____ (Microsoft Corporation) C:\windows\SysWOW64\iedkcs32.dll

2014-10-16 10:00 - 2014-09-19 22:57 - 00163840 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll

2014-10-16 10:00 - 2014-09-19 22:57 - 00109056 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesysprep.dll

2014-10-16 10:00 - 2014-09-19 22:57 - 00080384 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll

2014-10-16 10:00 - 2014-09-19 22:57 - 00061440 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll

2014-10-16 10:00 - 2014-09-19 22:57 - 00044032 _____ (Microsoft Corporation) C:\windows\SysWOW64\UXInit.dll

2014-10-16 10:00 - 2014-09-19 22:57 - 00039936 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll

2014-10-16 10:00 - 2014-09-19 22:57 - 00033280 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll

2014-10-16 10:00 - 2014-09-19 22:56 - 01440768 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl

2014-10-16 10:00 - 2014-09-19 22:56 - 00357888 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll

2014-10-16 10:00 - 2014-09-19 22:56 - 00226816 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll

2014-10-16 10:00 - 2014-09-19 22:38 - 02706432 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb

2014-10-16 10:00 - 2014-09-19 22:33 - 02706432 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb

2014-10-16 10:00 - 2014-09-19 20:06 - 00534528 _____ (Microsoft Corporation) C:\windows\SysWOW64\uxtheme.dll

2014-10-16 09:48 - 2014-09-27 23:18 - 04068352 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys

2014-10-14 10:32 - 2014-10-16 21:32 - 00710706 _____ () C:\windows\WindowsUpdate.log

2014-10-14 10:12 - 2014-10-16 21:30 - 00122584 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys

2014-10-14 10:12 - 2014-10-14 10:12 - 00001104 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-10-14 10:12 - 2014-10-14 10:12 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-10-14 10:12 - 2014-10-14 10:12 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-10-14 10:12 - 2014-10-14 10:12 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-10-14 10:12 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys

2014-10-14 10:12 - 2014-05-12 07:26 - 00064216 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys

2014-10-14 10:12 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys

2014-10-07 09:00 - 2014-10-16 21:33 - 00000000 ____D () C:\FRST

2014-10-07 08:59 - 2014-10-16 21:32 - 02112000 _____ (Farbar) C:\Users\Brett\Desktop\FRST64.exe

2014-10-06 20:03 - 2014-10-06 20:03 - 00001161 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk

2014-10-06 20:03 - 2014-10-06 20:03 - 00001149 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk

2014-10-06 20:03 - 2014-10-06 20:03 - 00000000 ____D () C:\ProgramData\Mozilla

2014-10-06 20:03 - 2014-10-06 20:03 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service

2014-10-06 19:51 - 2014-10-06 19:51 - 00001055 _____ () C:\Users\Brett\Desktop\MWB Scan 2 10062104.txt

2014-10-06 19:39 - 2014-10-06 19:39 - 00001055 _____ () C:\Users\Brett\Desktop\MWB Scan 10062104.txt

2014-10-05 16:40 - 2014-10-16 14:20 - 00000000 ____D () C:\Users\Brett\New folder

2014-10-05 15:03 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\windows\SysWOW64\sqlite3.dll

2014-10-05 15:01 - 2014-10-16 15:58 - 00000000 ____D () C:\AdwCleaner

2014-10-05 13:51 - 2014-10-05 13:51 - 04181856 _____ (Kaspersky Lab ZAO) C:\Users\Brett\Desktop\tdsskiller.exe

2014-10-05 12:15 - 2014-10-05 12:15 - 00001056 _____ () C:\Users\Brett\Desktop\MWB Scan 10042014.txt

2014-10-05 06:52 - 2014-10-05 06:52 - 00000000 ____D () C:\Users\Brett\Desktop\cce_2.5.242177.201_x64

2014-10-05 06:51 - 2014-10-05 06:52 - 25543261 _____ () C:\Users\Brett\Desktop\cce_2.5.242177.201_x64.zip

2014-10-05 06:50 - 2014-10-05 06:50 - 23503560 _____ () C:\Users\Brett\Downloads\cce_1.6.183539.73_x32.zip

2014-10-01 12:26 - 2014-10-01 12:28 - 122468608 _____ (Microsoft Corporation) C:\Users\Brett\Downloads\msert.exe

2014-09-30 15:19 - 2014-09-30 15:19 - 02650408 _____ (Malwarebytes ) C:\Users\Brett\Downloads\mbae-setup-1.03.1.1220 (2).exe

2014-09-30 15:03 - 2014-09-30 15:03 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Brett\Desktop\mbam-setup-2.0.2.1012 (1).exe

2014-09-30 14:52 - 2014-09-30 14:52 - 00321848 _____ (Malwarebytes Corporation) C:\Users\Brett\Desktop\mbam-clean-2.1.1.1001.exe

2014-09-30 14:42 - 2014-09-30 14:42 - 00183062 _____ () C:\windows\system32\bootdelete.lst

2014-09-30 14:42 - 2014-09-30 14:42 - 00012872 _____ (SurfRight B.V.) C:\windows\system32\bootdelete.exe

2014-09-30 14:30 - 2014-09-30 14:30 - 00001895 _____ () C:\Users\Public\Desktop\HitmanPro.lnk

2014-09-30 14:30 - 2014-09-30 14:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HitmanPro

2014-09-30 14:29 - 2014-09-30 14:30 - 00000000 ____D () C:\Program Files\HitmanPro

2014-09-30 14:24 - 2014-09-30 14:25 - 11194928 _____ (SurfRight B.V.) C:\Users\Brett\Downloads\HitmanPro_x64 (1).exe

2014-09-30 14:14 - 2014-09-30 14:14 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Brett\Downloads\mbam-setup-2.0.2.1012.exe

2014-09-30 13:47 - 2014-09-30 13:47 - 00000745 _____ () C:\Users\Brett\Desktop\Start Emsisoft Emergency Kit.lnk

2014-09-30 13:46 - 2014-10-16 15:27 - 00000000 ____D () C:\EEK

2014-09-30 13:45 - 2014-09-30 13:46 - 158649504 _____ () C:\Users\Brett\Downloads\EmsisoftEmergencyKit.exe

2014-09-25 14:58 - 2014-09-25 15:10 - 00000000 ____D () C:\Program Files (x86)\Ableton Live 9

2014-09-25 14:58 - 2014-09-25 14:58 - 00001006 _____ () C:\Users\Brett\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Ableton Live 9 Standard.lnk

2014-09-25 14:04 - 2014-09-25 15:13 - 00000000 ____D () C:\Users\Brett\Desktop\DJ Template Project Live 9

2014-09-25 13:37 - 2014-09-25 15:38 - 00000000 ____D () C:\Users\Brett\AppData\Roaming\Ableton

2014-09-25 12:51 - 2014-09-25 12:51 - 00000000 ____D () C:\Users\Brett\Downloads\DJ-Template-Pro-Live-9-1-5

2014-09-25 12:44 - 2014-09-25 14:04 - 00882350 _____ () C:\Users\Brett\Downloads\DJ-Template-Pro-Live-9-1-5.zip

2014-09-23 21:28 - 2014-09-23 21:28 - 00485664 _____ () C:\Users\Brett\Downloads\setup_en (3).exe

2014-09-23 19:02 - 2014-09-23 19:02 - 00262144 _____ () C:\windows\system32\config\userdiff

2014-09-23 18:57 - 2014-09-23 19:24 - 00000000 ____D () C:\Recovery

2014-09-23 15:41 - 2014-09-23 15:41 - 00430080 _____ () C:\Users\Brett\Downloads\maibox_export (1).exe

2014-09-23 15:30 - 2014-09-23 15:30 - 00430080 _____ () C:\Users\Brett\Downloads\maibox_export.exe

2014-09-22 20:17 - 2014-08-09 03:30 - 00148480 _____ (Microsoft Corporation) C:\windows\system32\poqexec.exe

2014-09-22 20:17 - 2014-08-09 03:29 - 00144896 _____ (Microsoft Corporation) C:\windows\system32\tssdisai.dll

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-16 21:33 - 2013-05-02 10:44 - 00000908 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-10-16 21:32 - 2014-06-12 11:20 - 00004962 _____ () C:\windows\System32\Tasks\Microsoft Office 15 Sync Maintenance for ELVIS-Brett Elvis

2014-10-16 21:32 - 2013-05-07 09:40 - 00000000 ____D () C:\ProgramData\WRData

2014-10-16 21:32 - 2013-04-16 14:51 - 00000000 ___RD () C:\Users\Brett\Dropbox

2014-10-16 21:31 - 2014-08-12 15:18 - 00000000 ___RD () C:\Users\Brett\OneDrive

2014-10-16 21:31 - 2013-05-10 14:39 - 00000000 ___RD () C:\Users\Brett\Google Drive

2014-10-16 21:31 - 2013-05-02 10:44 - 00000904 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-10-16 21:31 - 2013-04-16 14:46 - 00000000 ____D () C:\Users\Brett\AppData\Roaming\Dropbox

2014-10-16 21:31 - 2012-07-26 03:12 - 00000000 ____D () C:\windows\system32\sru

2014-10-16 21:30 - 2014-07-16 15:55 - 00000749 _____ () C:\Users\Public\Desktop\Webroot SecureAnywhere.lnk

2014-10-16 21:30 - 2012-07-26 02:22 - 00000006 ____H () C:\windows\Tasks\SA.DAT

2014-10-16 16:13 - 2012-07-26 00:26 - 00786432 ___SH () C:\windows\system32\config\BBI

2014-10-16 16:08 - 2013-05-10 15:23 - 00000920 _____ () C:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-858208724-3078971120-2626913202-1001UA.job

2014-10-16 15:26 - 2013-07-10 14:06 - 00003982 _____ () C:\windows\System32\Tasks\PCDoctorBackgroundMonitorTask

2014-10-16 15:26 - 2013-07-10 14:06 - 00003442 _____ () C:\windows\System32\Tasks\PCDEventLauncherTask

2014-10-16 14:07 - 2014-06-12 12:51 - 00000000 ____D () C:\ProgramData\Malwarebytes Anti-Exploit

2014-10-16 13:54 - 2014-09-02 17:37 - 00326360 _____ () C:\windows\system32\FNTCACHE.DAT

2014-10-16 13:08 - 2013-05-10 15:23 - 00000868 _____ () C:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-858208724-3078971120-2626913202-1001Core.job

2014-10-16 13:01 - 2012-07-26 02:59 - 00000000 ____D () C:\windows\CbsTemp

2014-10-16 08:42 - 2013-04-16 14:31 - 00000000 ____D () C:\Users\Brett\AppData\Local\Packages

2014-10-14 09:55 - 2012-07-26 02:28 - 00850046 _____ () C:\windows\system32\PerfStringBackup.INI

2014-10-13 15:18 - 2013-04-24 12:12 - 00000000 ____D () C:\Program Files (x86)\Google

2014-10-13 08:50 - 2012-07-26 03:12 - 00000000 ____D () C:\windows\system32\NDF

2014-10-13 07:43 - 2013-09-12 13:36 - 00000418 ____H () C:\windows\Tasks\Norton Security Scan for Brett.job

2014-10-13 07:38 - 2013-04-16 14:31 - 00000000 ____D () C:\Users\Brett

2014-10-12 18:40 - 2013-09-12 13:36 - 00003554 _____ () C:\windows\System32\Tasks\Norton Security Scan for Brett

2014-10-09 16:09 - 2013-06-18 13:02 - 00000000 ____D () C:\Users\Brett\AppData\Roaming\Mozilla

2014-10-06 21:30 - 2013-06-18 13:02 - 00000000 ____D () C:\Users\Brett\AppData\Local\Mozilla

2014-10-06 20:03 - 2014-09-04 20:02 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

2014-10-06 19:46 - 2013-01-29 09:03 - 00000000 ____D () C:\Program Files (x86)\Dell Backup and Recovery

2014-10-05 12:41 - 2014-08-21 15:29 - 00000824 _____ () C:\Users\Public\Desktop\CCleaner.lnk

2014-10-05 12:41 - 2013-12-27 20:52 - 00000000 ____D () C:\Program Files\CCleaner

2014-10-05 08:43 - 2013-07-16 22:25 - 00007670 _____ () C:\Users\Brett\AppData\Local\Resmon.ResmonCfg

2014-10-04 18:20 - 2014-07-16 15:51 - 00000000 ____D () C:\ProgramData\Sonos,_Inc

2014-10-02 15:46 - 2014-03-14 13:08 - 00000000 ____D () C:\Program Files (x86)\IrfanView

2014-09-30 19:44 - 2012-07-26 03:12 - 00000000 ____D () C:\windows\rescache

2014-09-29 17:49 - 2014-07-10 15:24 - 00705480 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe

2014-09-29 17:49 - 2014-07-10 15:24 - 00104904 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl

2014-09-28 10:09 - 2013-05-07 09:40 - 00154824 _____ (Webroot) C:\windows\SysWOW64\WRusr.dll

2014-09-28 10:09 - 2013-05-07 09:40 - 00115744 _____ (Webroot) C:\windows\system32\Drivers\WRkrn.sys

2014-09-28 10:09 - 2013-05-07 09:40 - 00105384 _____ (Webroot) C:\windows\system32\WRusr.dll

2014-09-25 14:52 - 2014-02-12 13:57 - 00000000 ____D () C:\ProgramData\Ableton

2014-09-25 14:26 - 2013-07-01 19:57 - 00000000 ____D () C:\Program Files (x86)\Ableton

2014-09-25 13:37 - 2013-04-16 15:50 - 00000000 ____D () C:\Program Files\Microsoft Office 15

2014-09-25 12:46 - 2014-03-06 23:28 - 00002276 _____ () C:\Users\Brett\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk

2014-09-23 21:28 - 2013-04-24 12:12 - 00000000 ____D () C:\Users\Brett\AppData\Local\Deployment

2014-09-23 15:28 - 2014-09-09 08:38 - 00045723 _____ () C:\windows\diagwrn.xml

2014-09-23 15:28 - 2014-09-09 08:38 - 00045723 _____ () C:\windows\diagerr.xml

2014-09-23 15:28 - 2012-07-26 00:26 - 00262144 ___SH () C:\windows\system32\config\ELAM

2014-09-23 15:22 - 2012-07-26 03:12 - 00000000 ____D () C:\windows\Registration

2014-09-23 13:42 - 2012-07-26 03:12 - 00000000 ____D () C:\windows\AUInstallAgent

2014-09-20 23:03 - 2013-04-16 14:51 - 00001018 _____ () C:\Users\Brett\Desktop\Dropbox.lnk

2014-09-20 23:03 - 2013-04-16 14:49 - 00000000 ____D () C:\Users\Brett\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox

Files to move or delete:

====================

C:\Users\Public\AlexaNSISPlugin.12548.dll

Some content of TEMP:

====================

C:\Users\Brett\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpkkherv.dll

C:\Users\Brett\AppData\Local\Temp\Quarantine.exe

C:\Users\Brett\AppData\Local\Temp\sqlite3.dll

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2014-10-13 03:02

==================== End Of Log ============================

Addition.txt

kevinf80 · October 17, 2014

Thanks for the logs, continue please:

Download attached fixlist.txt file (end of reply) and save it to the Desktop, or the folder you saved FRST into.

NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work.

Run FRST and press the Fix button just once and wait.

The tool will make a log on the Desktop (Fixlog.txt) or the folder it was ran from. Please post it to your reply.

Next,

Open Malwarebytes Anti-Malware, from the Dashboard please Check for Updates by clicking the Update Now... link

When the update completes select > Settings > Detection and Protection > Enable Scan for rootkit and Under Non Malware Protection set both PUP and PUM to Treat detections as malware.

Click on the SCAN button and run a Threat Scan with Malwarebytes Anti-Malware by clicking the Scan Now>> button.

When the scan is complete, if there have been detections, click Apply Actions to allow MBAM to clean what was detected.

In most cases, a restart will be required.

Wait for the prompt to restart the computer to appear, then click on Yes.

Once completed please click on the History > Application Logs and find your scan log and open it and then click on the "copy to clipboard" button and post back the results on your next reply.

Next,

Download AdwCleaner by Xplode onto your Desktop.

Double click on Adwcleaner.exe to run the tool.
Click on Scan
Once the scan is done, click on the Clean button.
You will get a prompt asking to close all programs. Click OK.
Click OK again to reboot your computer.
A text file will open after the restart. Please post the content of that logfile in your reply.
You can also find the logfile at C:\AdwCleaner[sn].txt. Where n in the scan reference number

Next,

Please download Junkware Removal Tool to your desktop.

Shut down your protection software now to avoid potential conflicts. (re-enable when done)
Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
The tool will open and start scanning your system.
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next message.

Next,

Download Microsoft's " Malicious Software Removal Tool" and save direct to the desktop

Ensure to get the correct version for your system....

32 Bit version:

https://www.microsoft.com/downloads/en/confirmation.aspx?FamilyId=AD724AE0-E72D-4F54-9AB3-75B8EB148356&displaylang=en

64 Bit version:

https://www.microsoft.com/downloads/en/confirmation.aspx?FamilyId=585D2BDE-367F-495E-94E7-6349F4EFFC74&displaylang=en'>https://www.microsoft.com/downloads/en/confirmation.aspx?FamilyId=585D2BDE-367F-495E-94E7-6349F4EFFC74&displaylang=en

Right click on the Tool, select “Run as Administrator” the tool will expand to the options Window

In the "Scan Type" window, select Full Scan

Perform a scan and Click Finish when the scan is done.

Retrieve the MSRT log as follows, and post it in your next reply:

1) Select the Windows key and R key together to open the "Run" function

2) Type or Copy/Paste the following command to the "Run Line" and Press Enter

notepad c:\windows\debug\mrt.log

Let me see those logs, also give an update on any remaining issues or concerns...

Thanks,

Kevin...

Fixlist.txt

BrettL · October 17, 2014

Hi Kevin,

first of all thanks for the assistance. The FRST log crashed midway. The log is attached. I'm doing the other scans now.

Fixlog.txt

BrettL · October 17, 2014

This is odd - the rootkits checkbox says enabled on the Malwarebytes window but says disabled on the scan.

MBAM 101714.txt

BrettL · October 17, 2014

FRST 3 101714.txt

FRST ran after disconnecting Dropbox. The one file left after the first scan and crash seems to have been deleted after I disconnected DB and reran the fix. Right now the Malicious Software Removal Tool is running - nothing found so far. I've attached the results of the FRST scan that did not crash.

kevinf80 · October 17, 2014

Did you run AdwCleaner and JRT before starting MRST?

BrettL · October 17, 2014

Oops. No. I started MRST after FRST ran without crashing. I am 3.5 hours in and it is still running. Close and go back and run adware and jrt?

kevinf80 · October 17, 2014

That`s ok, let MRST finish and then run the other two scanners....

BrettL · October 17, 2014

Hi Kevin, thanks. Six hours later the scans are finallyfinished! Attached are the Junkware, MS and AdwCleaner Log files. It looks like they were saved to the desktop and I saved the same files again but they're definitely the right ones!

AdwCleanerS2 101714.txt

JRT 171014.txt

mrt.log

kevinf80 · October 17, 2014

What is the current status of the operating system. any remaining issues or concerns...

BrettL · October 17, 2014

Seems OK. Maybe a little slow but no indication of anything on any MBAM scan or on a Hitman Pro scan now. OS seems to function without incident.

BrettL · October 17, 2014

Probably not really running slowly just a perception issue I imagine.

kevinf80 · October 18, 2014

Thanks for the update, if no remaining issues or concerns run the following to clean up....

Download "Delfix by Xplode" and save it to your desktop.

Or use the following if first link is down:

"Delfix link mirror"

Double Click to start the program. If you are using Vista or higher, please right-click and choose run as administrator

Make Sure the following items are checked:

    Activate UAC
    Remove disinfection tools
    Create registry backup
    Purge System Restore
    Reset system settings

Now click on "Run" and wait patiently until the tool has completed.

The tool will create a log when it has completed. We don't need you to post this.

Part of the routine will be to create a registry back up with ERUNT, the back up will be created here:

C:\Windows\ERUNT

When all is known to be well with your system you can delete that back up folder if you consider it as not needed...

Any remnant files/logs from tools we have used can be deleted…

Next,

Read the following link to fully understand PC security and best practices, you may find it useful....

http://www.bleepingcomputer.com/forums/t/407147/answers-to-common-security-questions-best-practices/#entry2316629

Let me know if we can close out....

Thanks,

Kevin....

AdvancedSetup · October 23, 2014

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

Ext Export exe

Recommended Posts

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Recently Browsing 0 members

Important Information