unitryderz93 Posted January 6, 2015 ID:927094 Share Posted January 6, 2015 Additional scan result of Farbar Recovery Scan Tool (x64) Version: 06-01-2015Ran by Dans Puter at 2015-01-07 08:56:58Running from C:\Users\Dans Puter\DownloadsBoot Mode: Normal========================================================== ==================== Security Center ======================== (If an entry is included in the fixlist, it will be removed.) AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736} ==================== Installed Programs ====================== (Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.) ACP Application (Version: 2.15.10.0003 - Advanced Micro Devices, Inc.) HiddenAdobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.235 - Adobe Systems Incorporated)Age of Empires II: HD Edition (HKLM-x32\...\Steam App 221380) (Version: - Hidden Path Entertainment, Ensemble Studios)Age of Empires® III: Complete Collection (HKLM-x32\...\Steam App 105450) (Version: - Ensemble Studios)AMD Catalyst Install Manager (HKLM\...\{F2A7CE36-57BF-5C86-952D-90DBF3746D82}) (Version: 8.0.916.0 - Advanced Micro Devices, Inc.)avast! Free Antivirus (HKLM-x32\...\Avast) (Version: 9.0.2018 - Avast Software)Bandizip (HKLM\...\Bandizip) (Version: 5.0 - Bandisoft.com)Battle.net (HKLM-x32\...\Battle.net) (Version: - Blizzard Entertainment)Battlefield 4™ (HKLM-x32\...\{ABADE36E-EC37-413B-8179-B432AD3FACE7}) (Version: 1.4.2.23831 - Electronic Arts)Battlelog Web Plugins (HKLM-x32\...\Battlelog Web Plugins) (Version: 2.3.0 - EA Digital Illusions CE AB)BioShock Infinite (HKLM-x32\...\Steam App 8870) (Version: - Irrational Games)Bulletstorm (HKLM-x32\...\Steam App 99810) (Version: - People Can Fly)Cheat Engine 6.3 (HKLM-x32\...\Cheat Engine 6.3_is1) (Version: - Cheat Engine)Counter-Strike: Global Offensive (HKLM-x32\...\Steam App 730) (Version: - Valve)Curse Client (HKU\S-1-5-21-24755090-1781970286-2270670643-1001\...\101a9f93b8f0bb6f) (Version: 5.1.1.820 - Curse)D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) HiddenDiablo III (HKLM-x32\...\Diablo III) (Version: - Blizzard Entertainment)Diablo III Public Test (HKLM-x32\...\Diablo III Public Test) (Version: - Blizzard Entertainment)Dishonored (HKLM-x32\...\Steam App 205100) (Version: 1.0 - Bethesda Softworks)ESN Sonar (HKLM-x32\...\ESN Sonar-0.70.4) (Version: 0.70.4 - ESN Social Software AB)Euro Truck Simulator 2 (HKLM-x32\...\Steam App 227300) (Version: - SCS Software)Far Cry 3 (HKLM-x32\...\{E3B9C5A9-BD7A-4B56-B754-FAEA7DD6FA88}) (Version: 1.05 - Ubisoft)Far Cry 4 (HKLM-x32\...\Uplay Install 420) (Version: - Ubisoft)FINAL FANTASY VIII (HKLM-x32\...\Steam App 39150) (Version: - SQUARE ENIX)Goat Simulator (HKLM-x32\...\Steam App 265930) (Version: - Coffee Stain Studios)Google Chrome (HKLM-x32\...\Google Chrome) (Version: 39.0.2171.95 - Google Inc.)Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) HiddenHeroes of the Storm (HKLM-x32\...\Heroes of the Storm) (Version: - Blizzard Entertainment)Honorbuddy (HKU\S-1-5-21-24755090-1781970286-2270670643-1001\...\{0114de04-992c-404e-aeed-b29e86e2dca5}) (Version: 2.5.11034.745 - Bossland GmbH)Honorbuddy (x32 Version: 2.5.11034.745 - Bossland GmbH) HiddenIntel® Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3412 - Intel Corporation)Java 7 Update 60 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F06417060FF}) (Version: 7.0.600 - Oracle)Java 7 Update 65 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217055FF}) (Version: 7.0.650 - Oracle)Kingdoms of Amalur: Reckoning™ (HKLM-x32\...\Steam App 102500) (Version: - Big Huge Games)Logitech Gaming Software 5.10 (HKLM\...\{1444D2EE-C7AD-44A8-844F-2634B49353D1}) (Version: 5.10.127 - Logitech)Lords Of The Fallen (HKLM-x32\...\Steam App 265300) (Version: - CI Games)Malwarebytes Anti-Malware version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)ManiaPlanet (HKLM-x32\...\ManiaPlanet_is1) (Version: - Nadeo)Microsoft Games for Windows - LIVE Redistributable (HKLM-x32\...\{42AA4CA8-DCD8-4308-BCAB-0B6D75856A9D}) (Version: 3.5.95.0 - Microsoft Corporation)Microsoft Games for Windows Marketplace (HKLM-x32\...\{67F42018-F647-4D3C-BE62-F8CB4FE2FCD5}) (Version: 3.5.67.0 - Microsoft Corporation)Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (HKLM-x32\...\{a1909659-0a08-4554-8af1-2175904903a1}) (Version: 11.0.60610.1 - Microsoft Corporation)Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\...\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (HKLM-x32\...\{95716cce-fc71-413f-8ad5-56c2892d4b3a}) (Version: 11.0.60610.1 - Microsoft Corporation)Microsoft XNA Framework Redistributable 4.0 Refresh (HKLM-x32\...\{D69C8EDE-BBC5-436B-8E0E-C5A6D311CF4F}) (Version: 4.0.30901.0 - Microsoft Corporation)Mount Your Friends (HKLM-x32\...\Steam App 296470) (Version: - Stegersaurus Software Inc.)Movie Maker (x32 Version: 16.4.3528.0331 - Microsoft Corporation) HiddenMozilla Firefox 33.1 (x86 en-GB) (HKLM-x32\...\Mozilla Firefox 33.1 (x86 en-GB)) (Version: 33.1 - Mozilla)Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 30.0 - Mozilla)MyFreeCodec (HKU\S-1-5-21-24755090-1781970286-2270670643-1001\...\MyFreeCodec) (Version: - )Next Car Game Sneak Peek 2.0 (HKLM-x32\...\Steam App 272860) (Version: - Bugbear)Next Car Game: Wreckfest (HKLM-x32\...\Steam App 228380) (Version: - Bugbear)NVIDIA PhysX (HKLM-x32\...\{46ED2B64-85C7-4E1F-920C-A555B21F2E4C}) (Version: 9.11.1111 - NVIDIA Corporation)OpenAL (HKLM-x32\...\OpenAL) (Version: - )Origin (HKLM-x32\...\Origin) (Version: 9.4.7.2799 - Electronic Arts, Inc.)Outlast (HKLM-x32\...\Steam App 238320) (Version: - Red Barrels)Plantronics® GameCom 780/788 Software for Dolby® Headphone (HKLM-x32\...\{EB3C9064-9140-4279-9E51-965119402151}) (Version: 3.20.0001 - Plantronics)Plants vs. Zombies™ (HKLM-x32\...\{5E6536C2-E79A-49CF-83EA-817AD81F9FC8}) (Version: 1.2.0.1093 - Electronic Arts, Inc.)Pulseway (HKLM\...\{DC2A928E-1C99-466A-B0C0-22C1146E58B1}) (Version: 4.6.1 - MMSOFT Design)PunkBuster Services (HKLM-x32\...\PunkBusterSvc) (Version: 0.993 - Even Balance, Inc.)Raptr (HKLM-x32\...\Raptr) (Version: - )Razer Synapse 2.0 (HKLM-x32\...\{0D78BEE2-F8FF-4498-AF1A-3FF81CED8AC6}) (Version: 1.18.15.20888 - Razer Inc.)Rocksmith (HKLM-x32\...\Steam App 205190) (Version: - Ubisoft - San Francisco)Rocksmith 2014 (HKLM-x32\...\Steam App 221680) (Version: - Ubisoft - San Francisco)Saints Row IV (HKLM-x32\...\Steam App 206420) (Version: - Deep Silver Volition)Saints Row: The Third (HKLM-x32\...\Steam App 55230) (Version: - Volition)Samsung Kies (HKLM-x32\...\InstallShield_{758C8301-2696-4855-AF45-534B1200980A}) (Version: 2.6.2.14014_6 - Samsung Electronics Co., Ltd.)Samsung Kies (x32 Version: 2.6.2.14014_6 - Samsung Electronics Co., Ltd.) HiddenSAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.45.0 - SAMSUNG Electronics Co., Ltd.)Skype™ 6.21 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 6.21.104 - Skype Technologies S.A.)South Park™: The Stick of Truth™ (HKLM-x32\...\Steam App 213670) (Version: - Obsidian Entertainment)State of Decay (HKLM-x32\...\Steam App 241540) (Version: - Undead Labs)Steam (HKLM-x32\...\Steam) (Version: - Valve Corporation)Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 16.2.12.23 - Synaptics Incorporated)Team Fortress 2 (HKLM-x32\...\Steam App 440) (Version: - Valve)TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.16 - TeamSpeak Systems GmbH)The Elder Scrolls V: Skyrim (HKLM-x32\...\Steam App 72850) (Version: - Bethesda Game Studios)The Forest (HKLM-x32\...\Steam App 242760) (Version: - Endnight Games Ltd)Trials Fusion (HKLM-x32\...\Uplay Install 297) (Version: - Ubisoft)Uplay (HKLM-x32\...\Uplay) (Version: 4.5 - Ubisoft)Ventrilo Client for Windows x64 (HKLM\...\{EEB3F6BB-318D-4CE5-989F-8191FCBFB578}) (Version: 3.0.8.0 - Flagship Industries, Inc.)VLC media player (HKLM-x32\...\VLC media player) (Version: 2.1.5 - VideoLAN)Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)World of Warcraft (HKLM-x32\...\World of Warcraft) (Version: - Blizzard Entertainment)XSplit Broadcaster (HKLM-x32\...\{3A1F3A32-7E9D-4AD2-A2E2-DFC98BAA9DC7}) (Version: 1.3.1403.1202 - SplitMediaLabs) ==================== Custom CLSID (selected items): ========================== (If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.) CustomCLSID: HKU\S-1-5-21-24755090-1781970286-2270670643-1001_Classes\CLSID\{5B69A6B4-393B-459C-8EBB-214237A9E7AC}\InprocServer32 -> C:\Program Files\Bandizip\bdzshl64.dll (Bandisoft.com)CustomCLSID: HKU\S-1-5-21-24755090-1781970286-2270670643-1001_Classes\CLSID\{6ac2cd5f-a939-497d-a416-8cfb5eb1a070}\InprocServer32 -> C:\Windows\system32\dfshim.dll (Microsoft Corporation) ==================== Restore Points ========================= 18-12-2014 15:03:02 Windows Update31-12-2014 17:42:57 Scheduled Checkpoint01-01-2015 20:06:50 Installed DirectX03-01-2015 14:38:20 Installed DirectX 9.0 ==================== Hosts content: ========================== (If needed Hosts: directive could be included in the fixlist to reset Hosts.) 2013-08-23 00:25 - 2013-08-23 00:25 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts ==================== Scheduled Tasks (whitelisted) ============= (If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.) Task: {123956E8-CCFB-4BC2-99E5-94EB82FC48D6} - System32\Tasks\Synaptics TouchPad Enhancements => \Program Files\Synaptics\SynTP\SynTPEnh.exe [2012-10-04] (Synaptics Incorporated)Task: {339F955A-5A04-466D-AE87-4F477E691A3D} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-05-14] (Google Inc.)Task: {33EE418C-9B6E-4B49-8434-22E911199AB0} - System32\Tasks\{4DCAA094-96F2-41D5-8C2B-CD0FA60ED117} => Chrome.exe http://ui.skype.com/ui/0/6.16.0.105/en/abandoninstall?source=lightinstaller&page=tsInstallTask: {4FEA720A-6818-4D91-B439-30F6910C2BE5} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2014-05-14] (AVAST Software)Task: {560A8F97-D1C8-48DA-AC68-93B7B4BB9D05} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-05-14] (Google Inc.)Task: {9CE427ED-48F2-4306-BC8F-65A92937B166} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows\system32\MRT.exe [2014-12-10] (Microsoft Corporation)Task: {B26E0207-DA34-4096-BCC6-9CE4EDB9F10B} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-01-04] (Adobe Systems Incorporated)Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exeTask: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exeTask: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe ==================== Loaded Modules (whitelisted) ============= 2014-10-28 19:10 - 2013-08-05 20:12 - 00266240 _____ () C:\Program Files\Pulseway\OpenHardwareMonitorLib.dll2014-07-19 00:54 - 2014-07-19 00:54 - 00076152 _____ () C:\Windows\system32\PnkBstrA.exe2014-05-15 14:56 - 2014-01-21 17:41 - 00817440 ____N () C:\Program Files\Plantronics\GameCom 780 & 788\GameCom780.exe2015-01-05 21:59 - 2015-01-05 21:59 - 02909696 _____ () C:\Program Files\AVAST Software\Avast\defs\15010500\algo.dll2015-01-06 10:21 - 2015-01-06 10:21 - 02909696 _____ () C:\Program Files\AVAST Software\Avast\defs\15010501\algo.dll2014-05-15 14:56 - 2014-01-21 17:41 - 00149792 ____N () C:\Program Files\Plantronics\GameCom 780 & 788\VmixPLGC.dll2014-05-14 15:14 - 2014-05-14 15:14 - 19336120 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll2012-08-29 12:32 - 2012-08-29 12:32 - 00014336 _____ () C:\ProgramData\Razer\SwitchBlade\Apps\Razer\65BFE244-2354-4E41-ADC9-CCF6BE3B5F75\RzFPS\FPSClient.dll2013-10-22 19:24 - 2013-10-22 19:24 - 24978944 _____ () C:\ProgramData\Razer\SwitchBlade\Resources\CEF1\libcef.dll2013-10-22 19:24 - 2013-10-22 19:24 - 00736256 _____ () C:\ProgramData\Razer\SwitchBlade\Resources\CEF1\libglesv2.dll2013-10-22 19:24 - 2013-10-22 19:24 - 00130048 _____ () C:\ProgramData\Razer\SwitchBlade\Resources\CEF1\libegl.dll2010-11-23 09:56 - 2010-11-23 09:56 - 00087040 _____ () C:\Program Files (x86)\Raptr\_ctypes.pyd2010-11-23 09:56 - 2010-11-23 09:56 - 00043008 _____ () C:\Program Files (x86)\Raptr\_socket.pyd2010-11-23 09:56 - 2010-11-23 09:56 - 00805376 _____ () C:\Program Files (x86)\Raptr\_ssl.pyd2014-05-14 10:26 - 2014-05-14 10:26 - 05812736 _____ () C:\Program Files (x86)\Raptr\PyQt4.QtGui.pyd2014-05-14 10:26 - 2014-05-14 10:26 - 00067584 _____ () C:\Program Files (x86)\Raptr\sip.pyd2014-05-14 10:26 - 2014-05-14 10:26 - 01662464 _____ () C:\Program Files (x86)\Raptr\PyQt4.QtCore.pyd2014-05-14 10:26 - 2014-05-14 10:26 - 00494592 _____ () C:\Program Files (x86)\Raptr\PyQt4.QtNetwork.pyd2010-11-23 09:57 - 2010-11-23 09:57 - 00096256 _____ () C:\Program Files (x86)\Raptr\win32api.pyd2010-11-23 09:56 - 2010-11-23 09:56 - 00110592 _____ () C:\Program Files (x86)\Raptr\pywintypes26.dll2010-11-23 09:56 - 2010-11-23 09:56 - 00010240 _____ () C:\Program Files (x86)\Raptr\select.pyd2010-11-23 09:56 - 2010-11-23 09:56 - 00356864 _____ () C:\Program Files (x86)\Raptr\_hashlib.pyd2010-11-23 09:57 - 2010-11-23 09:57 - 00036352 _____ () C:\Program Files (x86)\Raptr\win32process.pyd2010-11-23 09:57 - 2010-11-23 09:57 - 00111104 _____ () C:\Program Files (x86)\Raptr\win32file.pyd2010-11-23 09:56 - 2010-11-23 09:56 - 00044544 _____ () C:\Program Files (x86)\Raptr\_sqlite3.pyd2011-02-16 05:17 - 2011-02-16 05:17 - 00417501 _____ () C:\Program Files (x86)\Raptr\sqlite3.dll2010-11-23 09:57 - 2010-11-23 09:57 - 00167936 _____ () C:\Program Files (x86)\Raptr\win32gui.pyd2014-05-14 10:26 - 2014-05-14 10:26 - 00313856 _____ () C:\Program Files (x86)\Raptr\PyQt4.QtWebKit.pyd2010-11-23 09:56 - 2010-11-23 09:56 - 00127488 _____ () C:\Program Files (x86)\Raptr\pyexpat.pyd2010-11-23 09:56 - 2010-11-23 09:56 - 00009216 _____ () C:\Program Files (x86)\Raptr\winsound.pyd2010-11-23 09:56 - 2010-11-23 09:56 - 00354304 _____ () C:\Program Files (x86)\Raptr\pythoncom26.dll2010-11-23 09:57 - 2010-11-23 09:57 - 00016384 _____ () C:\Program Files (x86)\Raptr\win32trace.pyd2014-08-14 11:37 - 2014-08-14 11:37 - 00113171 _____ () C:\Program Files (x86)\Raptr\libvlc.dll2014-08-14 11:37 - 2014-08-14 11:37 - 02396691 _____ () C:\Program Files (x86)\Raptr\libvlccore.dll2010-11-23 09:56 - 2010-11-23 09:56 - 00583680 _____ () C:\Program Files (x86)\Raptr\unicodedata.pyd2011-11-21 13:20 - 2011-11-21 13:20 - 01949696 _____ () C:\Program Files (x86)\Raptr\libtorrent.pyd2010-11-23 09:57 - 2010-11-23 09:57 - 00263168 _____ () C:\Program Files (x86)\Raptr\win32com.shell.shell.pyd2010-11-23 09:56 - 2010-11-23 09:56 - 00324608 _____ () C:\Program Files (x86)\Raptr\PIL._imaging.pyd2013-11-21 11:05 - 2013-11-21 11:05 - 00256000 _____ () C:\Program Files (x86)\Raptr\amd_ags.dll2012-02-07 07:28 - 2012-02-07 07:28 - 00010752 _____ () C:\Program Files (x86)\Raptr\Crypto.Random.OSRNG.winrandom.pyd2012-02-07 07:28 - 2012-02-07 07:28 - 00011264 _____ () C:\Program Files (x86)\Raptr\Crypto.Util._counter.pyd2012-02-07 07:28 - 2012-02-07 07:28 - 00031744 _____ () C:\Program Files (x86)\Raptr\Crypto.Cipher.AES.pyd2014-11-19 17:53 - 2014-11-12 05:48 - 01171456 _____ () D:\Steam\libavcodec-56.dll2014-11-19 17:53 - 2014-11-12 05:48 - 00332800 _____ () D:\Steam\libavresample-2.dll2014-11-19 17:53 - 2014-11-12 05:48 - 00442368 _____ () D:\Steam\libavutil-54.dll2014-11-19 17:53 - 2014-11-12 05:47 - 00774656 _____ () D:\Steam\SDL2.dll2014-11-22 00:40 - 2014-11-19 07:23 - 02227904 _____ () D:\Steam\video.dll2014-11-19 17:53 - 2014-11-12 05:48 - 00403968 _____ () D:\Steam\libavformat-56.dll2014-11-19 17:53 - 2014-11-12 05:48 - 00485888 _____ () D:\Steam\libswscale-3.dll2014-11-22 00:40 - 2014-11-19 07:23 - 00690880 _____ () D:\Steam\bin\chromehtml.DLL2010-11-23 09:57 - 2010-11-23 09:57 - 00141312 _____ () C:\Program Files (x86)\Raptr\gobject._gobject.pyd2014-06-18 11:56 - 2014-06-18 11:56 - 02717595 _____ () C:\Program Files (x86)\Raptr\heliotrope._purple.pyd2011-02-16 05:17 - 2011-02-16 05:17 - 01213633 _____ () C:\Program Files (x86)\Raptr\libxml2-2.dll2010-11-23 10:06 - 2010-11-23 10:06 - 00055808 _____ () C:\Program Files (x86)\Raptr\zlib1.dll2013-05-10 10:52 - 2013-05-10 10:52 - 00495680 _____ () C:\Program Files (x86)\Raptr\plugins\libaim.dll2013-05-10 10:52 - 2013-05-10 10:52 - 01183699 _____ () C:\Program Files (x86)\Raptr\liboscar.dll2013-05-10 10:52 - 2013-05-10 10:52 - 00483306 _____ () C:\Program Files (x86)\Raptr\plugins\libicq.dll2013-05-04 05:57 - 2013-05-04 05:57 - 00655356 _____ () C:\Program Files (x86)\Raptr\plugins\libirc.dll2013-05-04 05:56 - 2013-05-04 05:56 - 01306387 _____ () C:\Program Files (x86)\Raptr\plugins\libmsn.dll2013-05-04 05:56 - 2013-05-04 05:56 - 00565461 _____ () C:\Program Files (x86)\Raptr\plugins\libxmpp.dll2013-05-04 05:57 - 2013-05-04 05:57 - 01640221 _____ () C:\Program Files (x86)\Raptr\libjabber.dll2013-05-04 05:56 - 2013-05-04 05:56 - 00506276 _____ () C:\Program Files (x86)\Raptr\plugins\libyahoo.dll2013-05-04 05:57 - 2013-05-04 05:57 - 01053730 _____ () C:\Program Files (x86)\Raptr\libymsg.dll2013-05-04 05:57 - 2013-05-04 05:57 - 00497782 _____ () C:\Program Files (x86)\Raptr\plugins\libyahoojp.dll2013-05-04 05:57 - 2013-05-04 05:57 - 00603326 _____ () C:\Program Files (x86)\Raptr\plugins\ssl-nss.dll2013-05-04 05:57 - 2013-05-04 05:57 - 00474199 _____ () C:\Program Files (x86)\Raptr\plugins\ssl.dll2014-12-11 13:26 - 2014-12-11 13:26 - 26065408 _____ () D:\Battle.net\Battle.net.5383\libcef.dll2014-12-11 13:26 - 2014-12-11 13:26 - 00739840 _____ () D:\Battle.net\Battle.net.5383\libGLESv2.dll2014-12-11 13:26 - 2014-12-11 13:26 - 00907776 _____ () D:\Battle.net\Battle.net.5383\platforms\qwindows.dll2014-12-11 13:26 - 2014-12-11 13:26 - 00130048 _____ () D:\Battle.net\Battle.net.5383\libEGL.dll2014-12-11 13:26 - 2014-12-11 13:26 - 00020992 _____ () D:\Battle.net\Battle.net.5383\imageformats\qgif.dll2014-12-11 13:26 - 2014-12-11 13:26 - 00021504 _____ () D:\Battle.net\Battle.net.5383\imageformats\qico.dll2014-12-11 13:26 - 2014-12-11 13:26 - 00205312 _____ () D:\Battle.net\Battle.net.5383\imageformats\qjpeg.dll2014-12-11 13:26 - 2014-12-11 13:26 - 00225792 _____ () D:\Battle.net\Battle.net.5383\imageformats\qmng.dll2014-12-11 13:26 - 2014-12-11 13:26 - 00015872 _____ () D:\Battle.net\Battle.net.5383\imageformats\qsvg.dll2014-12-11 13:26 - 2014-12-11 13:26 - 00312832 _____ () D:\Battle.net\Battle.net.5383\imageformats\qtiff.dll2014-12-11 13:26 - 2014-12-11 13:26 - 00010240 _____ () D:\Battle.net\Battle.net.5383\qml\QtQuick.2\qtquick2plugin.dll2014-12-11 13:26 - 2014-12-11 13:26 - 00054272 _____ () D:\Battle.net\Battle.net.5383\qml\QtQuick\Layouts\qquicklayoutsplugin.dll2014-12-11 13:26 - 2014-12-11 13:26 - 00010240 _____ () D:\Battle.net\Battle.net.5383\qml\QtQml\Models.2\modelsplugin.dll2014-11-19 17:53 - 2014-11-12 05:48 - 34589888 _____ () D:\Steam\bin\libcef.dll2014-11-19 17:53 - 2014-11-12 05:48 - 00837824 _____ () D:\Steam\bin\ffmpegsumo.dll2014-01-03 22:03 - 2014-01-03 22:03 - 07816192 _____ () C:\Program Files (x86)\SplitMediaLabs\XSplit\avcodec-54.dll2014-01-03 22:03 - 2014-01-03 22:03 - 01425920 _____ () C:\Program Files (x86)\SplitMediaLabs\XSplit\avformat-54.dll2014-01-03 22:03 - 2014-01-03 22:03 - 00188416 _____ () C:\Program Files (x86)\SplitMediaLabs\XSplit\avutil-52.dll2014-01-03 22:03 - 2014-01-03 22:03 - 00336896 _____ () C:\Program Files (x86)\SplitMediaLabs\XSplit\swscale-2.dll2014-01-03 22:03 - 2014-01-03 22:03 - 00096256 _____ () C:\Program Files (x86)\SplitMediaLabs\XSplit\swresample-0.dll2014-12-12 23:41 - 2014-12-06 12:50 - 01077064 _____ () C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.95\libglesv2.dll2014-12-12 23:41 - 2014-12-06 12:50 - 00211272 _____ () C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.95\libegl.dll2014-12-12 23:41 - 2014-12-06 12:50 - 09009480 _____ () C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.95\pdf.dll2014-12-12 23:41 - 2014-12-06 12:50 - 01677128 _____ () C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.95\ffmpegsumo.dll ==================== Alternate Data Streams (whitelisted) ========= (If an entry is included in the fixlist, only the Alternate Data Streams will be removed.) AlternateDataStreams: C:\Users\Dans Puter\SkyDrive:ms-properties ==================== Safe Mode (whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.) ==================== EXE Association (whitelisted) ============= (If an entry is included in the fixlist, the default will be restored. None default entries will be removed.) ==================== MSCONFIG/TASK MANAGER disabled items ========= (Currently there is no automatic fix for this section.) HKU\S-1-5-21-24755090-1781970286-2270670643-1001\...\StartupApproved\StartupFolder: => "CurseClientStartup.ccip"HKU\S-1-5-21-24755090-1781970286-2270670643-1001\...\StartupApproved\Run: => "Skype" ========================= Accounts: ========================== Administrator (S-1-5-21-24755090-1781970286-2270670643-500 - Administrator - Disabled)Dans Puter (S-1-5-21-24755090-1781970286-2270670643-1001 - Administrator - Enabled) => C:\Users\Dans PuterGuest (S-1-5-21-24755090-1781970286-2270670643-501 - Limited - Disabled)HomeGroupUser$ (S-1-5-21-24755090-1781970286-2270670643-1003 - Limited - Enabled) ==================== Faulty Device Manager Devices ============= Name: PCI Simple Communications ControllerDescription: PCI Simple Communications ControllerClass Guid: Manufacturer: Service: Problem: : The drivers for this device are not installed. (Code 28)Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard. Name: SM Bus ControllerDescription: SM Bus ControllerClass Guid: Manufacturer: Service: Problem: : The drivers for this device are not installed. (Code 28)Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard. ==================== Event log errors: ========================= Application errors:==================Error: (01/07/2015 08:12:32 AM) (Source: amdacpusrsvc) (EventID: 0) (User: )Description: amdacpusrsvc[EVENT]: SERVICE_CONTROL_POWEREVENT: RESUME: FAILED. Error: (01/07/2015 08:12:32 AM) (Source: amdacpusrsvc) (EventID: 0) (User: )Description: amdacpusrsvcacpusrsvc: GraphicsMemory API Wrapper: Dummy Packet Submission FAILED Error: (01/06/2015 11:31:17 AM) (Source: Microsoft-Windows-Defrag) (EventID: 257) (User: )Description: The volume Recovery was not optimised because an error was encountered: The parameter is incorrect. (0x80070057) Error: (01/05/2015 05:54:29 PM) (Source: Application Error) (EventID: 1005) (User: )Description: Windows cannot access the file for one of the following reasons:there is a problem with the network connection, the disk that the file is stored on, or the storagedrivers installed on this computer; or the disk is missing.Windows closed the program Age of Empires 3 because of this error. Program: Age of Empires 3File: The error value is listed in the Additional Data section.User Action1. Open the file again.This situation might be a temporary problem that corrects itself when the program runs again.2.If the file still cannot be accessed and- It is on the network,your network administrator should verify that there is not a problem with the network and that the server can be contacted.- It is on a removable disk, for example, a floppy disk or CD-ROM, verify that the disk is fully inserted into the computer.3. Check and repair the file system by running CHKDSK. To run CHKDSK, click Start, click Run, type CMD, and then click OK. At the command prompt, type CHKDSK /F, and then press ENTER.4. If the problem persists, restore the file from a backup copy.5. Determine whether other files on the same disk can be opened. If not, the disk might be damaged. If it is a hard disk, contact your administrator or computer hardware vendor forfurther assistance. Additional DataError value: 00000000Disk type: 0 Error: (01/05/2015 05:54:29 PM) (Source: Application Error) (EventID: 1000) (User: )Description: Faulting application name: age3.exe, version: 4.107.803.3366, time stamp: 0x49ef2fdaFaulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000Exception code: 0xc000001dFault offset: 0x03a45a83Faulting process ID: 0x13d8Faulting application start time: 0xage3.exe0Faulting application path: age3.exe1Faulting module path: age3.exe2Report ID: age3.exe3Faulting package full name: age3.exe4Faulting package-relative application ID: age3.exe5 Error: (01/05/2015 05:49:49 PM) (Source: Application Error) (EventID: 1000) (User: )Description: Faulting application name: age3.exe, version: 4.107.803.3366, time stamp: 0x49ef2fdaFaulting module name: RockallDLL.dll, version: 6.3.9600.17278, time stamp: 0x53eeb4a3Exception code: 0xc0000135Fault offset: 0x00098f05Faulting process ID: 0x714Faulting application start time: 0xage3.exe0Faulting application path: age3.exe1Faulting module path: age3.exe2Report ID: age3.exe3Faulting package full name: age3.exe4Faulting package-relative application ID: age3.exe5 Error: (01/05/2015 03:53:42 PM) (Source: amdacpusrsvc) (EventID: 0) (User: )Description: amdacpusrsvc[EVENT]: SERVICE_CONTROL_POWEREVENT: RESUME: FAILED. Error: (01/05/2015 03:53:42 PM) (Source: amdacpusrsvc) (EventID: 0) (User: )Description: amdacpusrsvcacpusrsvc: GraphicsMemory API Wrapper: Dummy Packet Submission FAILED Error: (01/05/2015 08:10:34 AM) (Source: amdacpusrsvc) (EventID: 0) (User: )Description: amdacpusrsvc[EVENT]: SERVICE_CONTROL_POWEREVENT: RESUME: FAILED. Error: (01/05/2015 08:10:34 AM) (Source: amdacpusrsvc) (EventID: 0) (User: )Description: amdacpusrsvcacpusrsvc: GraphicsMemory API Wrapper: Dummy Packet Submission FAILED System errors:=============Error: (01/06/2015 07:19:29 PM) (Source: DCOM) (EventID: 10010) (User: DANSRIG)Description: {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} Error: (01/06/2015 11:25:53 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)Description: application-specificLocalActivation{D63B10C5-BB46-4990-A94F-E40B9D520160}{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}NT AUTHORITYSYSTEMS-1-5-18LocalHost (Using LRPC)UnavailableUnavailable Error: (01/06/2015 00:23:12 AM) (Source: EventLog) (EventID: 6008) (User: )Description: The previous system shutdown at 00:22:10 on 06/01/2015 was unexpected. Error: (01/06/2015 00:23:07 AM) (Source: Microsoft-Windows-Kernel-Boot) (EventID: 29) (User: NT AUTHORITY)Description: 32212256841148048 Error: (01/05/2015 05:42:11 PM) (Source: BugCheck) (EventID: 1001) (User: )Description: 0x0000000a (0x0000000000000010, 0x0000000000000002, 0x0000000000000001, 0xfffff8034567fc70)C:\Windows\MEMORY.DMP010515-4531-01 Error: (01/05/2015 05:42:10 PM) (Source: EventLog) (EventID: 6008) (User: )Description: The previous system shutdown at 17:09:06 on 05/01/2015 was unexpected. Error: (01/04/2015 07:49:42 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)Description: application-specificLocalActivation{D63B10C5-BB46-4990-A94F-E40B9D520160}{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}NT AUTHORITYSYSTEMS-1-5-18LocalHost (Using LRPC)UnavailableUnavailable Error: (01/04/2015 04:02:47 PM) (Source: EventLog) (EventID: 6008) (User: )Description: The previous system shutdown at 01:40:21 on 04/01/2015 was unexpected. Error: (01/04/2015 04:02:41 PM) (Source: Microsoft-Windows-Kernel-Boot) (EventID: 29) (User: NT AUTHORITY)Description: 32212256841147920 Error: (01/04/2015 01:31:43 AM) (Source: DCOM) (EventID: 10010) (User: DANSRIG)Description: {ED1D0FDF-4414-470A-A56D-CFB68623FC58} Microsoft Office Sessions:=========================Error: (01/07/2015 08:12:32 AM) (Source: amdacpusrsvc) (EventID: 0) (User: )Description: amdacpusrsvc[EVENT]: SERVICE_CONTROL_POWEREVENT: RESUME: FAILED. Error: (01/07/2015 08:12:32 AM) (Source: amdacpusrsvc) (EventID: 0) (User: )Description: amdacpusrsvcacpusrsvc: GraphicsMemory API Wrapper: Dummy Packet Submission FAILED Error: (01/06/2015 11:31:17 AM) (Source: Microsoft-Windows-Defrag) (EventID: 257) (User: )Description: RecoveryThe parameter is incorrect. (0x80070057) Error: (01/05/2015 05:54:29 PM) (Source: Application Error) (EventID: 1005) (User: )Description: Age of Empires 3000000000 Error: (01/05/2015 05:54:29 PM) (Source: Application Error) (EventID: 1000) (User: )Description: age3.exe4.107.803.336649ef2fdaunknown0.0.0.000000000c000001d03a45a8313d801d028b435ee3051D:\Steam\steamapps\common\Age Of Empires 3\bin\age3.exeunknownb12de678-94a7-11e4-82ac-74d43584b108 Error: (01/05/2015 05:49:49 PM) (Source: Application Error) (EventID: 1000) (User: )Description: age3.exe4.107.803.336649ef2fdaRockallDLL.dll6.3.9600.1727853eeb4a3c000013500098f0571401d028b3cb8b289aC:\Users\Dans Puter\Downloads\age3.exeRockallDLL.dll0a790e45-94a7-11e4-82ac-74d43584b108 Error: (01/05/2015 03:53:42 PM) (Source: amdacpusrsvc) (EventID: 0) (User: )Description: amdacpusrsvc[EVENT]: SERVICE_CONTROL_POWEREVENT: RESUME: FAILED. Error: (01/05/2015 03:53:42 PM) (Source: amdacpusrsvc) (EventID: 0) (User: )Description: amdacpusrsvcacpusrsvc: GraphicsMemory API Wrapper: Dummy Packet Submission FAILED Error: (01/05/2015 08:10:34 AM) (Source: amdacpusrsvc) (EventID: 0) (User: )Description: amdacpusrsvc[EVENT]: SERVICE_CONTROL_POWEREVENT: RESUME: FAILED. Error: (01/05/2015 08:10:34 AM) (Source: amdacpusrsvc) (EventID: 0) (User: )Description: amdacpusrsvcacpusrsvc: GraphicsMemory API Wrapper: Dummy Packet Submission FAILED ==================== Memory info =========================== Processor: Intel® Core i5-4670K CPU @ 3.40GHzPercentage of memory in use: 37%Total physical RAM: 8145.15 MBAvailable physical RAM: 5062.48 MBTotal Pagefile: 16337.15 MBAvailable Pagefile: 12568.51 MBTotal Virtual: 131072 MBAvailable Virtual: 131071.79 MB ==================== Drives ================================ Drive c: () (Fixed) (Total:111.27 GB) (Free:54.11 GB) NTFSDrive d: (Games) (Fixed) (Total:931.39 GB) (Free:604.29 GB) NTFS ==================== MBR & Partition Table ================== ========================================================Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: 00000000) Partition: GPT Partition Type. ========================================================Disk: 1 (MBR Code: Windows 7 or 8) (Size: 111.8 GB) (Disk ID: 00000000) Partition: GPT Partition Type. ==================== End Of Log ============================ ---------------------------------------------------------------------------------------------------------------------------------------------------------------Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 06-01-2015Ran by Dans Puter (administrator) on DANSRIG on 07-01-2015 08:56:38Running from C:\Users\Dans Puter\DownloadsLoaded Profile: Dans Puter (Available profiles: Dans Puter)Platform: Windows 8.1 (X64) OS Language: English (United Kingdom)Internet Explorer Version 11 (Default browser: Chrome)Boot Mode: NormalTutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (AMD) C:\Windows\System32\atiesrxx.exe(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe(Advanced Micro Devices) C:\Program Files\AMD\{920DEC42-4CA5-4d1d-9487-67BE645CDDFC}\amdacpusrsvc.exe(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe(Microsoft Corporation) C:\Windows\System32\dasHost.exe(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe(MMSOFT Design Ltd.) C:\Program Files\Pulseway\PCMonitorSrv.exe() C:\Windows\System32\PnkBstrA.exe(Microsoft Corporation) C:\Windows\System32\dllhost.exe(AMD) C:\Windows\System32\atieclxx.exe(MMSOFT Design Ltd.) C:\Program Files\Pulseway\pcmontask.exe(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe(Microsoft Corporation) C:\Windows\System32\dllhost.exe(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe() C:\Program Files\Plantronics\GameCom 780 & 788\GameCom780.exe(Logitech Inc.) C:\Program Files\Logitech\Gaming Software\LWEMon.exe(Samsung) C:\Program Files (x86)\Samsung\Kies\Kies.exe(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe(Razer USA Ltd) C:\ProgramData\Razer\SwitchBlade\Apps\Razer\65BFE244-2354-4E41-ADC9-CCF6BE3B5F75\RzFPS\RzFPS.exe(Razer Inc.) C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe(Razer USA Ltd) C:\Program Files (x86)\Razer\SwitchBlade\RzSBHelper.exe(Razer Inc.) C:\ProgramData\Razer\SwitchBlade\DeathStalker\Razer\1068AAE3-6299-4086-A7F6-0600F5F1D1E5\RzHome.exe(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe(Razer USA Ltd) C:\Program Files (x86)\Razer\SwitchBlade\RzAppManager.exe(Advanced Micro Devices Inc.) C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\MOM.exe(ATI Technologies Inc.) C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\CCC.exe(Raptr, Inc) C:\Program Files (x86)\Raptr\raptr.exe(Valve Corporation) D:\Steam\Steam.exe(Blizzard Entertainment) C:\ProgramData\Battle.net\Agent\Agent.3634\Agent.exe(Raptr, Inc) C:\Program Files (x86)\Raptr\raptr_im.exe(Blizzard Entertainment) D:\Battle.net\Battle.net.5383\Battle.net.exe(Raptr Inc.) C:\Program Files (x86)\Raptr\raptr_ep64.exe(Valve Corporation) D:\Steam\bin\steamwebhelper.exe(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe(Valve Corporation) D:\Steam\bin\steamwebhelper.exe(Razer USA Ltd) C:\ProgramData\Razer\SwitchBlade\Apps\Razer\65BFE244-2354-4E41-ADC9-CCF6BE3B5F75\RzScreenshotGallery.exe(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [GamecomSound] => C:\Program Files\Plantronics\GameCom 780 & 788\GameCom780.exe [817440 2014-01-21] ()HKLM\...\Run: [start WingMan Profiler] => C:\Program Files\Logitech\Gaming Software\LWEMon.exe [190536 2010-06-14] (Logitech Inc.)HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [3890208 2014-08-09] (AVAST Software)HKLM-x32\...\Run: [] => [X]HKLM-x32\...\Run: [Razer Synapse] => C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe [585560 2014-06-23] (Razer Inc.)HKLM-x32\...\Run: [RzSBHelper] => C:\Program Files (x86)\Razer\SwitchBlade\RzSBHelper.exe [78336 2014-06-03] (Razer USA Ltd)HKLM-x32\...\Run: [sunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-11] (Oracle Corporation)HKLM-x32\...\Run: [KiesTrayAgent] => C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [311616 2014-02-07] (Samsung Electronics Co., Ltd.)HKLM-x32\...\Run: [Raptr] => C:\Program Files (x86)\Raptr\raptrstub.exe [55568 2014-12-09] (Raptr, Inc)HKLM-x32\...\Run: [startCCC] => C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\amd64\CLIStart.exe [767176 2014-11-20] (Advanced Micro Devices, Inc.)Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)HKU\S-1-5-21-24755090-1781970286-2270670643-1001\...\Run: [KiesPreload] => C:\Program Files (x86)\Samsung\Kies\Kies.exe [1564992 2014-02-07] (Samsung)HKU\S-1-5-21-24755090-1781970286-2270670643-1001\...\Run: [KiesAirMessage] => C:\Program Files (x86)\Samsung\Kies\KiesAirMessage.exe -startupHKU\S-1-5-21-24755090-1781970286-2270670643-1001\...\Run: [skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [22065760 2014-10-01] (Skype Technologies S.A.)Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\RazerFPSStartup.lnkShortcutTarget: RazerFPSStartup.lnk -> C:\ProgramData\Razer\SwitchBlade\Apps\Razer\65BFE244-2354-4E41-ADC9-CCF6BE3B5F75\RzFPS\RzFPS.exe (Razer USA Ltd)Startup: C:\Users\Dans Puter\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CurseClientStartup.ccip ()ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software)BootExecute: autocheck autochk * aswBoot.exe /A:"* " /L:"1033" /heur:80 /RA:ask /pup /archives /IA:0 /KBD:3 /wow /dir:"C:\Program Files\AVAST Software\Avast" ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKU\S-1-5-21-24755090-1781970286-2270670643-1001\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.us.com/?guid={8A8C7975-F2F8-468E-A59A-65CC9F758212}HKU\S-1-5-21-24755090-1781970286-2270670643-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://t.uk.msn.com/BHO: Java Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)BHO: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)BHO-x32: Java Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)BHO-x32: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)Tcpip\Parameters: [DhcpNameServer] 192.168.1.254 FireFox:========FF ProfilePath: C:\Users\Dans Puter\AppData\Roaming\Mozilla\Firefox\Profiles\duanb83e.defaultFF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_235.dll ()FF Plugin: @java.com/DTPlugin,version=10.60.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)FF Plugin: @java.com/JavaPlugin,version=10.60.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_235.dll ()FF Plugin-x32: @esn.me/esnsonar,version=0.70.4 -> C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)FF Plugin-x32: @esn/esnlaunch,version=2.3.0 -> C:\Program Files (x86)\Battlelog Web Plugins\2.3.0\npesnlaunch.dll (ESN Social Software AB)FF Plugin-x32: @esn/npbattlelog,version=2.4.0 -> C:\Program Files (x86)\Battlelog Web Plugins\2.4.0\npbattlelog.dll (EA Digital Illusions CE AB)FF Plugin-x32: @java.com/DTPlugin,version=10.65.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)FF Plugin-x32: @java.com/JavaPlugin,version=10.65.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)FF Plugin HKU\S-1-5-21-24755090-1781970286-2270670643-1001: ubisoft.com/uplaypc -> C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll No FileFF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FFFF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-05-14] Chrome: =======CHR StartupUrls: Default -> "hxxp://www.google.com/", "https://www.youtube.com/","hxxp://hotmail.com/" CHR Profile: C:\Users\Dans Puter\AppData\Local\Google\Chrome\User Data\DefaultCHR Extension: (Google Drive) - C:\Users\Dans Puter\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-05-14]CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Dans Puter\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2015-01-02]CHR Extension: (YouTube) - C:\Users\Dans Puter\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-05-14]CHR Extension: (Google Search) - C:\Users\Dans Puter\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-05-14]CHR Extension: (Hola Better Internet Engine) - C:\Users\Dans Puter\AppData\Local\Google\Chrome\User Data\Default\Extensions\epbfmioobedknooiakdehepogalbgkng [2014-05-17]CHR Extension: (AdBlock) - C:\Users\Dans Puter\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2014-05-14]CHR Extension: (Google Wallet) - C:\Users\Dans Puter\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-05-14]CHR Extension: (Gmail) - C:\Users\Dans Puter\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-05-14]CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-05-14] ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 amdacpusrsvc; C:\Program Files\AMD\{920DEC42-4CA5-4d1d-9487-67BE645CDDFC}\amdacpusrsvc.exe [116224 2014-11-20] (Advanced Micro Devices) [File not signed]R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-05-14] (AVAST Software)R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)S3 Origin Client Service; D:\Origin\OriginClientService.exe [1903472 2015-01-05] (Electronic Arts)R2 PC Monitor; C:\Program Files\Pulseway\PCMonitorSrv.exe [836568 2014-12-29] (MMSOFT Design Ltd.)R2 PnkBstrA; C:\Windows\system32\PnkBstrA.exe [76152 2014-07-19] ()R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2014-07-19] ()S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-22] (Microsoft Corporation)S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-22] (Microsoft Corporation) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 amdacpksd; C:\Windows\system32\drivers\amdacpksd.sys [294600 2014-11-21] (Advanced Micro Devices)S0 amdkmafd; C:\Windows\System32\drivers\amdkmafd.sys [21160 2012-09-23] (Advanced Micro Devices, Inc.)R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-05-14] ()R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-05-14] (AVAST Software)R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-05-14] (AVAST Software)R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-05-14] ()R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1039096 2014-05-16] (AVAST Software)R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [423240 2014-05-16] (AVAST Software)R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [85328 2014-05-16] (AVAST Software)R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [208416 2014-05-14] ()R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdWB6.sys [222720 2014-03-12] (Advanced Micro Devices)R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation)R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-01-07] (Malwarebytes Corporation)R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64216 2014-11-21] (Malwarebytes Corporation)R3 PlantronicsGC; C:\Windows\system32\drivers\PLTGC.sys [1327104 2013-10-08] (C-Media Electronics Inc)R3 rzendpt; C:\Windows\System32\drivers\rzendpt.sys [39080 2014-05-19] (Razer Inc)R3 rzhnet; C:\Windows\System32\Drivers\rzhnet.sys [21160 2014-05-19] (Razer Inc)R3 rzjstk; C:\Windows\System32\drivers\rzjstk.sys [27816 2014-05-19] (Razer Inc)S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-22] (Microsoft Corporation)R3 xusb22; C:\Windows\System32\drivers\xusb22.sys [87040 2014-03-18] (Microsoft Corporation)S3 WinRing0_1_2_0; \??\C:\Program Files\Pulseway\PCMonitorSrv.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2015-01-07 08:56 - 2015-01-07 08:56 - 02123776 _____ (Farbar) C:\Users\Dans Puter\Downloads\FRST64.exe2015-01-07 08:56 - 2015-01-07 08:56 - 00015410 _____ () C:\Users\Dans Puter\Downloads\FRST.txt2015-01-07 08:56 - 2015-01-07 08:56 - 00000000 ____D () C:\FRST2015-01-06 18:33 - 2015-01-07 08:16 - 65751896 _____ () C:\Users\Dans Puter\Desktop\SmiteInstaller.exe2015-01-06 16:01 - 2015-01-06 16:03 - 00000027 _____ () C:\Users\Dans Puter\Desktop\wow athent.txt2015-01-06 00:14 - 2015-01-06 00:15 - 00000039 _____ () C:\Users\Dans Puter\Documents\new wow account.txt2015-01-05 17:42 - 2015-01-05 17:42 - 00281256 _____ () C:\Windows\Minidump\010515-4531-01.dmp2015-01-05 10:51 - 2014-05-30 03:22 - 00001438 ____H () C:\Users\Dans Puter\Documents\records.txt2015-01-05 08:31 - 2015-01-05 08:31 - 00000905 _____ () C:\Users\Dans Puter\Desktop\JoyToKey - Shortcut.lnk2015-01-04 16:06 - 2015-01-04 16:06 - 00000000 ____D () C:\ProgramData\McAfee2015-01-04 01:45 - 2015-01-05 14:55 - 00000000 ___RD () C:\Users\Dans Puter\Desktop\JoyToKey_en2015-01-04 01:44 - 2015-01-04 01:44 - 00816854 _____ () C:\Users\Dans Puter\Documents\JoyToKey_en.zip2015-01-03 14:38 - 2015-01-03 14:38 - 00000000 ____D () C:\ProgramData\Age of Empires 32015-01-02 16:42 - 2015-01-02 16:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Games for Windows Marketplace2015-01-01 20:18 - 2015-01-02 16:42 - 00000000 ____D () C:\Program Files (x86)\Microsoft Games for Windows - LIVE2015-01-01 20:18 - 2015-01-01 20:18 - 00000000 ____D () C:\Windows\SysWOW64\xlive2015-01-01 20:18 - 2015-01-01 20:18 - 00000000 ____D () C:\Windows\8A809006C25A4A3A9DAB94659BCDB107.TMP2015-01-01 20:15 - 2015-01-01 20:23 - 00000000 ____D () C:\Users\Dans Puter\Documents\Lords of the Fallen2014-12-19 22:35 - 2015-01-04 01:54 - 00000000 ____D () C:\Users\Dans Puter\Documents\Euro Truck Simulator 22014-12-17 13:03 - 2014-10-31 09:37 - 00129536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\poqexec.exe2014-12-17 13:03 - 2014-10-31 09:34 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\poqexec.exe2014-12-10 22:06 - 2014-12-10 22:06 - 00000000 ____D () C:\ProgramData\ATI2014-12-10 22:01 - 2014-12-10 22:01 - 00000000 ____D () C:\Windows\system32\appraiser2014-12-10 21:54 - 2014-12-10 21:54 - 00053564 _____ () C:\Windows\SysWOW64\CCCInstall_201412102154470192.log2014-12-10 21:54 - 2014-12-10 21:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Catalyst Control Center2014-12-10 21:54 - 2014-12-10 21:54 - 00000000 ____D () C:\Program Files (x86)\AMD AVT2014-12-10 21:54 - 2014-12-10 21:54 - 00000000 ____D () C:\Program Files (x86)\AMD2014-12-10 21:43 - 2014-12-10 21:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Gaming Evolved2014-12-10 21:31 - 2015-01-01 19:02 - 00107008 ___SH () C:\Users\Dans Puter\Downloads\Thumbs.db2014-12-10 14:10 - 2014-11-10 13:29 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\DeviceSetupStatusProvider.dll2014-12-10 14:10 - 2014-11-10 12:51 - 00028672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DeviceSetupStatusProvider.dll2014-12-10 14:10 - 2014-10-31 10:39 - 01970432 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll2014-12-10 14:10 - 2014-10-31 10:38 - 01612992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll2014-12-10 14:01 - 2014-11-22 14:13 - 25059840 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll2014-12-10 14:01 - 2014-11-22 13:50 - 00580096 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll2014-12-10 14:01 - 2014-11-22 13:49 - 02885120 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll2014-12-10 14:01 - 2014-11-22 13:49 - 00417280 _____ (Microsoft Corporation) C:\Windows\system32\html.iec2014-12-10 14:01 - 2014-11-22 13:48 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll2014-12-10 14:01 - 2014-11-22 13:35 - 00812544 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll2014-12-10 14:01 - 2014-11-22 13:34 - 06039552 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll2014-12-10 14:01 - 2014-11-22 13:22 - 19749376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll2014-12-10 14:01 - 2014-11-22 13:08 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll2014-12-10 14:01 - 2014-11-22 13:07 - 00501248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll2014-12-10 14:01 - 2014-11-22 13:06 - 00340992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec2014-12-10 14:01 - 2014-11-22 13:06 - 00145408 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll2014-12-10 14:01 - 2014-11-22 13:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll2014-12-10 14:01 - 2014-11-22 13:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll2014-12-10 14:01 - 2014-11-22 13:01 - 02277888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll2014-12-10 14:01 - 2014-11-22 12:59 - 01032704 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll2014-12-10 14:01 - 2014-11-22 12:55 - 00661504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll2014-12-10 14:01 - 2014-11-22 12:52 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll2014-12-10 14:01 - 2014-11-22 12:49 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll2014-12-10 14:01 - 2014-11-22 12:49 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe2014-12-10 14:01 - 2014-11-22 12:49 - 00373760 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll2014-12-10 14:01 - 2014-11-22 12:46 - 02125312 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl2014-12-10 14:01 - 2014-11-22 12:43 - 14412800 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll2014-12-10 14:01 - 2014-11-22 12:35 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll2014-12-10 14:01 - 2014-11-22 12:34 - 00128000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll2014-12-10 14:01 - 2014-11-22 12:33 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll2014-12-10 14:01 - 2014-11-22 12:29 - 04299264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll2014-12-10 14:01 - 2014-11-22 12:29 - 00880128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll2014-12-10 14:01 - 2014-11-22 12:28 - 02358272 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll2014-12-10 14:01 - 2014-11-22 12:25 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll2014-12-10 14:01 - 2014-11-22 12:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll2014-12-10 14:01 - 2014-11-22 12:23 - 00326656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll2014-12-10 14:01 - 2014-11-22 12:22 - 02052096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl2014-12-10 14:01 - 2014-11-22 12:15 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll2014-12-10 14:01 - 2014-11-22 12:13 - 12836864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll2014-12-10 14:01 - 2014-11-22 12:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll2014-12-10 14:01 - 2014-11-22 12:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll2014-12-10 14:01 - 2014-11-22 11:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll2014-12-10 14:01 - 2014-11-22 11:54 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll2014-12-10 14:01 - 2014-11-07 15:16 - 01762840 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll2014-12-10 14:01 - 2014-11-07 14:26 - 01489072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll2014-12-10 14:00 - 2014-12-04 10:37 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll2014-12-10 14:00 - 2014-12-04 10:09 - 00830464 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll2014-12-10 14:00 - 2014-12-03 10:09 - 01083392 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll2014-12-10 14:00 - 2014-12-03 10:09 - 00740864 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll2014-12-10 14:00 - 2014-12-03 10:09 - 00412672 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll2014-12-10 14:00 - 2014-12-03 10:09 - 00396288 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll2014-12-10 14:00 - 2014-12-03 10:09 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll2014-12-10 14:00 - 2014-11-01 10:57 - 01091072 _____ (Microsoft Corporation) C:\Windows\system32\MrmCoreR.dll2014-12-10 14:00 - 2014-11-01 10:47 - 00790528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MrmCoreR.dll2014-12-10 14:00 - 2014-10-13 13:43 - 00238912 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\sdbus.sys2014-12-10 14:00 - 2014-10-13 13:43 - 00153920 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\dumpsd.sys2014-12-10 14:00 - 2014-10-13 13:43 - 00086336 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\pdc.sys2014-12-10 14:00 - 2014-10-13 13:43 - 00039744 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\intelpep.sys ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2015-01-07 08:54 - 2014-05-14 01:41 - 00000000 ____D () C:\Users\Dans Puter\AppData\Local\Battle.net2015-01-07 08:50 - 2014-06-21 19:32 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job2015-01-07 08:41 - 2014-05-14 15:14 - 00000922 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job2015-01-07 08:33 - 2014-05-14 03:34 - 01086551 _____ () C:\Windows\WindowsUpdate.log2015-01-07 08:31 - 2014-05-14 15:03 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys2015-01-07 08:16 - 2014-05-14 04:34 - 00003942 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{7D795362-A87D-484F-817B-AA97C1B9D14A}2015-01-07 08:14 - 2014-05-14 04:48 - 00000000 ____D () C:\Users\Dans Puter\AppData\Roaming\Raptr2015-01-07 08:13 - 2014-05-15 03:17 - 00000000 __RDO () C:\Users\Dans Puter\SkyDrive2015-01-07 08:13 - 2014-05-14 15:14 - 00000918 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job2015-01-07 08:12 - 2013-08-23 02:36 - 00000000 ____D () C:\Windows\system32\sru2015-01-06 19:19 - 2014-05-14 03:34 - 00000000 ____D () C:\Users\Dans Puter2015-01-06 13:54 - 2014-11-02 13:50 - 00029696 ___SH () C:\Users\Dans Puter\Documents\Thumbs.db2015-01-06 10:25 - 2014-05-14 03:38 - 00863592 _____ () C:\Windows\system32\PerfStringBackup.INI2015-01-06 00:23 - 2013-08-23 01:45 - 00000006 ____H () C:\Windows\Tasks\SA.DAT2015-01-05 17:42 - 2014-06-25 22:45 - 590420449 _____ () C:\Windows\MEMORY.DMP2015-01-05 17:42 - 2014-06-25 22:45 - 00000000 ____D () C:\Windows\Minidump2015-01-05 11:03 - 2014-05-14 01:06 - 00000000 ____D () C:\ProgramData\Origin2015-01-05 10:50 - 2013-08-23 01:46 - 00127739 _____ () C:\Windows\setupact.log2015-01-05 10:37 - 2014-05-14 01:08 - 00000000 ____D () C:\Users\Dans Puter\AppData\Roaming\Origin2015-01-04 16:37 - 2014-05-14 04:30 - 00003596 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-24755090-1781970286-2270670643-10012015-01-04 16:16 - 2013-08-23 02:36 - 00000000 ____D () C:\Windows\LiveKernelReports2015-01-04 16:06 - 2014-10-26 11:38 - 00000000 ____D () C:\Users\Dans Puter\AppData\Local\Adobe2015-01-04 16:06 - 2014-06-21 19:32 - 00003718 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater2015-01-04 01:19 - 2014-10-29 20:29 - 00000000 ____D () C:\Users\Dans Puter\AppData\Local\Deployment2015-01-03 14:38 - 2014-05-15 00:57 - 00000000 ____D () C:\Users\Dans Puter\Documents\My Games2015-01-03 14:38 - 2014-05-14 01:31 - 00197837 _____ () C:\Windows\DirectX.log2015-01-03 13:21 - 2014-05-14 04:27 - 00065536 _____ () C:\Windows\system32\spu_storage.bin2015-01-03 13:21 - 2013-08-23 00:25 - 00262144 ___SH () C:\Windows\system32\config\BBI2015-01-02 16:28 - 2013-08-23 02:36 - 00000000 ____D () C:\Windows\AppReadiness2014-12-31 18:05 - 2014-11-02 12:03 - 00000000 ____D () C:\Program Files\Pulseway2014-12-22 12:37 - 2014-05-14 00:49 - 00000000 ____D () C:\Users\Dans Puter\AppData\Roaming\.minecraft2014-12-18 15:03 - 2013-08-23 02:20 - 00000000 ____D () C:\Windows\CbsTemp2014-12-15 16:06 - 2014-10-26 00:41 - 00245248 ___SH () C:\Users\Dans Puter\Desktop\Thumbs.db2014-12-14 19:28 - 2013-08-23 02:36 - 00000000 ____D () C:\Windows\system32\NDF2014-12-12 09:52 - 2013-08-23 02:36 - 00000000 ____D () C:\Windows\rescache2014-12-10 22:01 - 2014-07-11 01:52 - 00000000 ___SD () C:\Windows\system32\CompatTel2014-12-10 22:01 - 2013-08-23 02:36 - 00000000 ____D () C:\Windows\SysWOW64\en-GB2014-12-10 22:01 - 2013-08-23 02:36 - 00000000 ____D () C:\Windows\system32\en-GB2014-12-10 22:01 - 2013-08-23 02:36 - 00000000 ____D () C:\Windows\PolicyDefinitions2014-12-10 22:01 - 2013-08-23 02:36 - 00000000 ____D () C:\Windows\AppCompat2014-12-10 21:54 - 2014-05-27 23:08 - 00000000 ____D () C:\ProgramData\AMD2014-12-10 21:54 - 2014-05-14 04:27 - 00000000 ____D () C:\Program Files\AMD2014-12-10 21:53 - 2014-05-14 04:27 - 00000000 ____D () C:\Program Files\Common Files\ATI Technologies2014-12-10 21:53 - 2014-05-14 04:27 - 00000000 ____D () C:\AMD2014-12-10 21:43 - 2014-05-14 04:48 - 00000000 ____D () C:\Program Files (x86)\Raptr2014-12-10 20:18 - 2014-05-25 19:09 - 00000000 ____D () C:\Users\Dans Puter\AppData\Roaming\Skype2014-12-10 15:15 - 2014-05-14 04:56 - 00000000 ____D () C:\Windows\system32\MRT2014-12-10 15:15 - 2013-08-23 02:36 - 00000000 ____D () C:\Windows\system32\sr-Latn-RS2014-12-10 15:15 - 2013-08-23 02:36 - 00000000 ____D () C:\Windows\system32\sr-Latn-CS2014-12-10 15:14 - 2014-05-14 04:56 - 112710672 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe Some content of TEMP:====================C:\Users\Dans Puter\AppData\Local\Temp\jre-7u65-windows-i586-iftw.exeC:\Users\Dans Puter\AppData\Local\Temp\raptr_stub.exeC:\Users\Dans Puter\AppData\Local\Temp\RzSbBroadcaster.exeC:\Users\Dans Puter\AppData\Local\Temp\sonarinst.exeC:\Users\Dans Puter\AppData\Local\Temp\tmpEA17.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signedC:\Windows\System32\wininit.exe => File is digitally signedC:\Windows\explorer.exe => File is digitally signedC:\Windows\SysWOW64\explorer.exe => File is digitally signedC:\Windows\System32\svchost.exe => File is digitally signedC:\Windows\SysWOW64\svchost.exe => File is digitally signedC:\Windows\System32\services.exe => File is digitally signedC:\Windows\System32\User32.dll => File is digitally signedC:\Windows\SysWOW64\User32.dll => File is digitally signedC:\Windows\System32\userinit.exe => File is digitally signedC:\Windows\SysWOW64\userinit.exe => File is digitally signedC:\Windows\System32\rpcss.dll => File is digitally signedC:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-12-31 17:40 ==================== End Of Log ============================ help? Link to post Share on other sites More sharing options...
Blackbird Posted January 10, 2015 ID:928228 Share Posted January 10, 2015 Hi!Welcome to Malwarebytes' Support Forums! I am Blackbird and I will help you removing any malware that might be present on your computer.An important WARNING to all individuals reading this topic:All advice in this topic was given specifically for this user and this computer!! Performing instructions given by me in this topic on other computers may harm your computer's infrastructure and can cause serious damage to them!!Please don't perform the steps given by me or other Helpers in this topic when you are not the original Topic Starter, but start your own topic with a question for help. You will get help from a trained and qualified Helper to clean up your computer from any present malware when you do so.General rules:From now on, don't use this computer anymore to access your bank account or any other serious business where you have to login for, untill I've told you your computer is clean from malware. Be patient waiting for my answer. I'm doing the best I can to answer to logs as soon as possible, but I'm handling multiple topics at the same time. Please feel free to remind me of your topic by sending a link to it by private message, when I didn't get back to you after 24 hours. Don't change anything on your computer in the period I'm helping you, except when I tell you to do so. So don't add/remove any software (programs, drivers, etc.) and don't change any hardware. If you really need to change something that can't wait, please inform me directly, by posting it in this topic or - if private - send me a private message containing an explanation of the changes made by you. This gives me the possibility to give you good advice.Rules about advices from me:The Helpers active on this board first got a full training in removing malware and providing support to people who got infected. Also they were trained to resolve any problems caused by malware infections. Please use the programs I provide to you only when under supervision of a trained Helper. This, because using these programs without supervision can cause damage to your computer. It's possible that your virus scanner, anti-spyware program or any other malware protection program or policy tries to block one or more of the programs provided by us. If that is the case, please always allow those programs to run and/or allow the provided changes to be made. If needed to run our tools properly, temporarily disable your anti-malware programs. Always Save tools provided by me to your Desktop, unless I give you other instructions. Don't ever run tools directly from the internet, because this can stop them from working properly. Also never save tools to any other locations than your Desktop. If you have any problems while following my instructions, stop there and tell me the exact nature of the issue. Perform everything in the correct order. Sometimes one step requires the previous one. You can check here if you're not sure if your computer is 32-bit or 64-bit.Rules about posting results:Always copy/paste the logfiles in your replies completely. If a logfile doesn't fit into one post, please add the logfile as an attachment instead. If this still won't work, please inform me. Never change something in the logfiles!! Include them in your posts as they were provided by the tools. This way I'll get a clear view on your system's situation. If you change the logfiles, it will take more time to clean up your computer. Don't post logs using CODE, QUOTE or FONT tags. Just post them as direct text.Things I want you to do before performing the steps below:Please enable your system to show hidden files: How to see hidden files in Windows. Make sure you're subscribed to this topic. Click on the Follow This Topic button at the top right of this page, make sure that the Receive Notification box is checked and that it is set to Instantly. Even though we do the best we can to help you, removing malware includes risks. Therefor I advise you to back-up all of your important files to a CD/DVD, external drive or flash drive. For instructions/help, take a look here.-------------------------------------------------------------------------------------------------------------------------------------------------------Thanks in advance for keeping above rules in mind. Maybe they look like unnecessary rules, but practice teaches us they are needed to help.Now, let's continue with the steps you need to do:-------------------------------------------------------------------------------------------------------------------------------------------------------1. We need to temporarily disable any cd-emulators active on your computer, as they can impede the interpretation of logfiles provided by our tools.Download Defogger and save it to your Desktop. Right-click Defogger.exe and select Run as Administrator. When the program has opened, click the Disable button. When Defogger asks for a confirmation, click Yes. Wait untill you get the "Finished" message. Click OK. When Defogger asks you to restart the system, please allow the program to do so immediately.When an error occured while using Defogger, look for a file called "defogger_disable.txt", which should be located at your Desktop. Post the contents of this file into your next reply. You can enable the cd-emulator software again by running Defogger again and clicking the "Re-enable" button. Only do this when I told you your computer is clean again.2. Download AdwCleaner and save it to your Desktop.Close all open windows. Right-click AdwCleaner.exe and select Run as Administrator. When the program has started, click the Scan button and wait untill the scan has finished. Make sure everything (on all tabs) is selected, and click the Delete button. It's possible that AdwCleaner asks you to restart the system. It's important that you agree with this. After restart a logfile will appear. Please post the contents of that logfile in your next reply.3. Download Malwarebytes' Anti-Malware and save it to your Desktop.If you already got Malwarebytes' Anti-Malware installed on your computer, please go to step 3-A.Install the program, eventually using these instructions.3-A. Start Malwarebytes' Anti-Malware.On the Dashboard tab, click the Update Now button, to update the definitions to the latest version. Then click the Scan tab. Select Custom Scan and click the Start Scan button. In the window that appears, check the box next to Scan for Rootkits. Also, select all drives, except for CD/DVD-drives. After you have done this, click Start Scan. Follow the instructions given by Malwarebytes' Anti-Malware. If any items were found during the scan process, Malwarebytes' Anti-Malware will ask you what you want to do with those items. Please quarantine all items. It's possible the program asks you for permission to restart the computer. If so, please allow MBAM to do so immediately. Save the logfile in txt-format and copy/paste it in your next reply. Note: If you can't find the logfile, look at the "History" tab. Select the most recent logfile (you can see the creation date in the log's title).4. Please read and perform the steps described on this page: I'm infected - What do I do now?.Post the logfile from Farbar Recovery Scan Tool into your next reply.5. Download GMER Rootkit Scanner and save it to your Desktop.NOTE: Windows 8 users can skip this step. GMER Rootkit Scanner isn't compatible with Windows 8. Don't run it.Right-click the GMER executable file (which's name will contain 8 digits/characters) and select Run as Administrator. If GMER warns you about possible rootkit activity and asks you to scan for rootkits, DON'T allow GMER to do so. Under "Files", put a checkmark next to Quick Scan. Remove the checkmark next to Show all. Now, click the Scan button. Note: This scan often provides False Positives in the scan results. Never fix anything found by Gmer, unless I instructed you to do so! If the scan's finished, click Save and save the log to your Desktop. Post GMER's logfile into your next reply.6. Please provide me a detailed description of any computer problems you're facing, together with the logfiles mentioned in step 1 - 6.Good luck! Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted January 13, 2015 Root Admin ID:929055 Share Posted January 13, 2015 Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread. Thanks! Link to post Share on other sites More sharing options...
Recommended Posts