Chrome false plug ins

PeaceRiver · January 24, 2015

I am still getting bogus requests to upgrade microsoft silverlight, winzip and adobe flash player as Chrome plug ins

Naathim · January 24, 2015

Hello and welcome!

I'm Radek and I'll try to help you with your issue.

Before we start please note the following:

Analysis and research take some time, also sometimes real life gets in the way, please be patient.
Limit your internet access to posting here, some infections just wait to steal typed-in passwords.
Don't run any scripts or tools on your own, unsupervised usage may cause more harm than good.
Paste the logs in your posts, attachments make my work harder and more complicated.
Stay with me to the end, the absence of symtoms doesn't mean that your machine is fully operational.
Note that we may live in totally different time zones, what may cause some delays between answers.

I can't foresee everything, so if anything unexpected happens, please stop and inform me!

There are no silly questions. Never be afraid to ask if in doubt!

Rules and policies

We won't support any piracy.

That being told, if any evidence of illegal OS, software, cracks/keygens or any other will be revealed, any further assistance will be suspended. If you are aware that there is this kind of stuff on your machine, remove it before proceeding!

The same applies to any use of P2P software: uTorrent, BitTorrent, Vuze, Kazaa, Ares... We don't provide any help for P2P, except for their removal. All P2P software has to be uninstalled or at least fully disabled before proceeding!

Failure to follow these guidelines will result with closing your topic and withdrawning any assistance.

51a46ae42d560-malwarebytes_anti_malware. Scan with Malwarebytes' Anti-Malware

Please download and install Malwarebytes Anti-Malware, or re-run it if you already have it installed.

First of all select update.
Once updated, click the Settings tab, in the left panel choose Detctions & protection and tick Scan for rootkits.
Click the Scan tab, choose Threat Scan is checked and click Scan Now.
If threats are detected, click the Apply Actions button. You will now be prompted to reboot. Click Yes.
Upon completion of the scan (or after the reboot), click the History tab.
Click Application Logs and double-click the Scan Log.
At the bottom click Export and choose Text file.

Save the file to your desktop and include its content in your next reply.

PeaceRiver · January 26, 2015

Hi Radek. I am including my latest scan Jan 26, 2015

Malwarebytes Anti-Malware

www.malwarebytes.org

Scan Date: 26/01/2015

Scan Time: 10:54:46 AM

Logfile: Log26012015.txt

Administrator: Yes

Version: 2.00.4.1028

Malware Database: v2015.01.26.06

Rootkit Database: v2015.01.14.01

License: Premium

Malware Protection: Enabled

Malicious Website Protection: Enabled

Self-protection: Disabled

OS: Windows 7 Service Pack 1

CPU: x86

File System: NTFS

User: Linda

Scan Type: Threat Scan

Result: Completed

Objects Scanned: 294783

Time Elapsed: 9 min, 56 sec

Memory: Enabled

Startup: Enabled

Filesystem: Enabled

Archives: Enabled

Rootkits: Enabled

Heuristics: Enabled

PUP: Enabled

PUM: Enabled

Processes: 0

(No malicious items detected)

Modules: 0

(No malicious items detected)

Registry Keys: 0

(No malicious items detected)

Registry Values: 0

(No malicious items detected)

Registry Data: 0

(No malicious items detected)

Folders: 0

(No malicious items detected)

Files: 0

(No malicious items detected)

Physical Sectors: 0

(No malicious items detected)

(end)

Naathim · January 26, 2015

OK, then let's take a look an your system's internals.

Scan with Farbar Recovery Scan Tool

Please download Farbar Recovery Scan Tool and save it to your Desktop.

There will be two versions to download: 32-bit and 64-bit. Please download the one that is designed for your system. If you don't know which one should it be, download both of them and try each other out. Only one will run - this is the right one. Please leave it and delete the other.

Right-click on icon and select Run as Administrator to start the tool.
> XP users click run after receipt of Windows Security Warning - Open File.
> 8 users will be prompted about Windows SmartScreen protection - click More information and Run.
When the tool opens click Yes to disclaimer.
Make sure that Addition option is checked.
Press Scan button and wait.
The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.

Please include their content in your next reply.

PeaceRiver · January 26, 2015

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 24-01-2015 01

Ran by Linda (administrator) on LYNX on 26-01-2015 14:52:00

Running from C:\Users\Linda\Downloads

Loaded Profiles: Linda (Available profiles: Linda)

Platform: Microsoft Windows 7 Home Premium Service Pack 1 (X86) OS Language: English (United States)

Internet Explorer Version 11 (Default browser: Chrome)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe

(Foxit Software Inc.) C:\Program Files\Foxit Software\Foxit Reader\Foxit Cloud\FCUpdateService.exe

(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe

(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe

(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbam.exe

(MicroStudio) C:\Program Files\Windows Network Accelerater\v3\winvxm.exe

(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe

(Logitech Inc.) C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe

(Intel Corporation) C:\Windows\System32\igfxsrvc.exe

(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE

() C:\Program Files\Logitech\LWS\Webcam Software\CameraHelperShell.exe

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [974432 2014-08-22] (Microsoft Corporation)

HKLM\...\Run: [LWS] => C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe [204136 2012-09-13] (Logitech Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-2539202307-1761660001-8006430-1000\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.telus.com/en/ab/account/login.jsp?&INTCMP=SSMyaccount

HKU\S-1-5-21-2539202307-1761660001-8006430-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/en-ca/?ocid=iehp

BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.254 75.153.176.9

FireFox:

========

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_16_0_0_296.dll ()

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)

FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)

FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)

Chrome:

=======

CHR StartupUrls: Profile 1 -> "hxxp://www.google.com/"

CHR DefaultSuggestURL: Profile 1 -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:inputType}{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}{google:searchVersion}{google:sessionToken}{google:prefetchQuery}sugkey={google:suggestAPIKeyParameter}

CHR Profile: C:\Users\Linda\AppData\Local\Google\Chrome\User Data\Profile 1

CHR Extension: (Google Slides) - C:\Users\Linda\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2014-11-29]

CHR Extension: (Google Docs) - C:\Users\Linda\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\aohghmighlieiainnegkcijnfilokake [2014-11-29]

CHR Extension: (Google Drive) - C:\Users\Linda\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-11-29]

CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Linda\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-11-29]

CHR Extension: (YouTube) - C:\Users\Linda\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-11-29]

CHR Extension: (Google Search) - C:\Users\Linda\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-11-29]

CHR Extension: (Google Sheets) - C:\Users\Linda\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2014-11-29]

CHR Extension: (Hangouts) - C:\Users\Linda\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\nckgahadagoaajjgafhacjanaoiihapd [2014-11-29]

CHR Extension: (Google Wallet) - C:\Users\Linda\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-11-29]

CHR Extension: (Gmail) - C:\Users\Linda\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-11-29]

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 FoxitCloudUpdateService; C:\Program Files\Foxit Software\Foxit Reader\Foxit Cloud\FCUpdateService.exe [243880 2015-01-23] (Foxit Software Inc.)

R2 MBAMScheduler; C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)

R2 MBAMService; C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)

R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [22192 2014-08-22] (Microsoft Corporation)

R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [288120 2014-08-22] (Microsoft Corporation)

R2 RapportMgmtService; C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe [1919256 2014-12-22] (IBM Corp.)

S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-26] (Microsoft Corporation)

R2 WindowsVNT_R3; C:\Program Files\Windows Network Accelerater\v3\winvxm.exe [2973600 2014-10-20] (MicroStudio) [File not signed]

S4 YouTubeDownload_P2; C:\Program Files\YouTube Downloader Services\P2\youtubeserv.exe [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 CompFilter; C:\Windows\System32\DRIVERS\lvbusflt.sys [19688 2012-09-21] (Logitech Inc.)

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2014-11-21] (Malwarebytes Corporation)

R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [114904 2015-01-26] (Malwarebytes Corporation)

R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2014-11-21] (Malwarebytes Corporation)

R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [231800 2014-07-17] (Microsoft Corporation)

R1 MpKslfc3a24d7; c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{967838F9-4D72-484C-AA3E-1AC9FAF0C5AD}\MpKslfc3a24d7.sys [39464 2015-01-26] (Microsoft Corporation)

R1 netfilter; C:\Windows\System32\drivers\netfilter.sys [36048 2014-11-19] (NetFilterSDK.com)

R1 RapportCerberus_80120; C:\ProgramData\Trusteer\Rapport\store\exts\RapportCerberus\baseline\RapportCerberus32_80120.sys [472792 2015-01-12] (IBM Corp.)

R1 RapportEI; C:\Program Files\Trusteer\Rapport\bin\RapportEI.sys [251640 2014-12-22] (IBM Corp.)

R0 RapportKELL; C:\Windows\System32\Drivers\RapportKELL.sys [208856 2014-12-22] (IBM Corp.)

R1 RapportPG; C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys [332696 2014-12-22] (IBM Corp.)

S3 SrvHsfPCI; C:\Windows\System32\DRIVERS\VSTBS23.SYS [266752 2009-07-13] (Conexant Systems, Inc.)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)

==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-26 14:52 - 2015-01-26 14:52 - 00009098 _____ () C:\Users\Linda\Downloads\FRST.txt

2015-01-26 14:51 - 2015-01-26 14:52 - 00000000 ____D () C:\FRST

2015-01-26 14:51 - 2015-01-26 14:51 - 01120768 _____ (Farbar) C:\Users\Linda\Downloads\FRST.exe

2015-01-24 16:09 - 2015-01-24 16:25 - 00053248 _____ () C:\Users\Linda\Documents\HowardLinda.14t.backup

2015-01-24 16:07 - 2015-01-25 08:38 - 00058368 _____ () C:\Users\Linda\Documents\HowardLinda.14t

2015-01-24 15:52 - 2015-01-24 15:52 - 00000000 ____D () C:\Users\Linda\AppData\Roaming\BHOK IT Consulting

2015-01-24 15:51 - 2015-01-24 15:51 - 00000000 ____D () C:\Users\Linda\AppData\Roaming\BHOK

2015-01-24 15:50 - 2015-01-24 15:50 - 00000000 ____D () C:\Users\Linda\AppData\Local\IsolatedStorage

2015-01-24 15:49 - 2015-01-24 15:49 - 00002083 _____ () C:\Users\Public\Desktop\StudioTax 2014.lnk

2015-01-24 15:49 - 2015-01-24 15:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StudioTax 2014

2015-01-24 15:49 - 2015-01-24 15:49 - 00000000 ____D () C:\Program Files\BHOK IT Consulting

2015-01-24 15:46 - 2015-01-24 15:47 - 31023968 _____ (BHOK IT Consulting) C:\Users\Linda\Downloads\StudioTax2014Install.exe

2015-01-15 06:10 - 2014-12-18 19:43 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll

2015-01-15 06:10 - 2014-12-11 10:47 - 00074240 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe

2015-01-14 06:22 - 2014-12-11 22:11 - 03971512 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe

2015-01-14 06:22 - 2014-12-11 22:11 - 03916728 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe

2015-01-14 06:21 - 2014-12-18 18:34 - 00116224 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys

2015-01-14 06:21 - 2014-12-05 20:50 - 00242688 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll

2015-01-12 10:39 - 2015-01-12 10:39 - 00000938 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Sierra Utilities.lnk

2015-01-12 10:39 - 2015-01-12 10:39 - 00000000 ____D () C:\SIERRA

2015-01-12 10:39 - 2015-01-12 10:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sierra

2015-01-12 10:39 - 2015-01-12 10:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\After Dark Games

2015-01-12 10:39 - 2015-01-12 10:39 - 00000000 ____D () C:\Program Files\Sierra On-Line

2015-01-12 10:39 - 1998-09-23 16:17 - 00558592 _____ (Sierra On-Line) C:\Windows\system32\SierraNW.dll

2015-01-12 10:39 - 1998-09-23 16:17 - 00227840 _____ (Sierra On-Line) C:\Windows\system32\SNWValid.dll

2015-01-12 10:39 - 1998-09-23 16:17 - 00011104 _____ () C:\Windows\system32\SNWVALID.HLP

2015-01-12 10:38 - 2015-01-12 10:39 - 00000402 _____ () C:\Windows\SIERRA.INI

2015-01-11 10:44 - 2015-01-11 10:44 - 07884764 _____ () C:\Users\Linda\Downloads\AuroraBorealis.themepack

2015-01-03 08:30 - 2015-01-03 08:30 - 00001125 _____ () C:\Users\Linda\Desktop\Pinball.lnk

2015-01-03 08:20 - 2015-01-03 08:20 - 00017082 _____ () C:\Windows\DeIsL1.isu

2015-01-03 08:20 - 2015-01-03 08:20 - 00001554 _____ () C:\Windows\yahtzee.ini

2015-01-03 08:20 - 2015-01-03 08:20 - 00000000 ____D () C:\Program Files\Hasbro

2015-01-03 08:20 - 1996-03-04 15:27 - 00331776 _____ (Criterion Software Ltd.) C:\Windows\system32\rwx20.dll

2015-01-03 08:20 - 1995-11-17 00:05 - 00339968 _____ (Criterion Software Ltd.) C:\Windows\system32\rwdx8d20.dll

2015-01-03 08:20 - 1995-11-16 23:52 - 00423424 _____ (Criterion Software Ltd.) C:\Windows\system32\rwdx6d20.dll

2015-01-03 08:19 - 1996-01-09 03:38 - 00283648 _____ (Stirling Technologies, Inc.) C:\Windows\uninst.exe

2015-01-01 19:17 - 2015-01-01 19:17 - 00000173 _____ () C:\Windows\KPCMS.INI

2015-01-01 19:17 - 2015-01-01 19:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe

2015-01-01 19:17 - 1999-06-18 21:13 - 00210944 _____ () C:\Windows\system32\MSVCRT10.DLL

2015-01-01 19:17 - 1999-06-18 21:13 - 00133120 _____ (Eastman Kodak Company) C:\Windows\sprof32.dll

2015-01-01 19:17 - 1999-05-26 09:46 - 00212480 _____ (Eastman Kodak) C:\Windows\system32\pcdlib32.dll

2015-01-01 19:17 - 1999-05-26 09:46 - 00196608 _____ (Eastman Kodak Company) C:\Windows\kpcp32.dll

2015-01-01 19:17 - 1999-05-26 09:46 - 00058368 _____ (Eastman Kodak Company) C:\Windows\pfpick.dll

2015-01-01 19:17 - 1999-05-26 09:46 - 00040129 _____ () C:\Windows\iccsigs.dat

2015-01-01 19:17 - 1999-05-26 09:46 - 00037376 _____ (Eastman Kodak Company) C:\Windows\kpsys32.dll

2015-01-01 19:17 - 1999-05-26 09:46 - 00020992 _____ (Eastman Kodak Company) C:\Windows\icccodes.dll

2015-01-01 19:16 - 2015-01-01 19:16 - 00000000 ____D () C:\Program Files\Common Files\Adobe

2015-01-01 19:16 - 2015-01-01 19:16 - 00000000 ____D () C:\Program Files\Adobe

2015-01-01 19:16 - 2015-01-01 19:16 - 00000000 ____D () C:\KPCMS

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-26 14:49 - 2014-11-21 13:44 - 00000884 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2015-01-26 14:33 - 2014-12-07 08:22 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2015-01-26 13:49 - 2014-11-21 13:44 - 00000880 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2015-01-26 13:34 - 2014-11-21 09:16 - 01213326 _____ () C:\Windows\WindowsUpdate.log

2015-01-26 13:10 - 2014-11-28 08:51 - 00114904 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2015-01-26 12:27 - 2009-07-13 21:34 - 00027920 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2015-01-26 12:27 - 2009-07-13 21:34 - 00027920 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2015-01-26 12:20 - 2009-07-13 21:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2015-01-26 12:20 - 2009-07-13 21:39 - 00045290 _____ () C:\Windows\setupact.log

2015-01-26 11:06 - 2014-11-21 13:52 - 00000000 ____D () C:\Users\Linda\Documents\Computer and Camera

2015-01-25 12:52 - 2014-11-21 13:48 - 00002129 _____ () C:\Users\Public\Desktop\Google Chrome.lnk

2015-01-25 12:33 - 2014-12-02 06:54 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe

2015-01-25 12:33 - 2014-12-02 06:54 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl

2015-01-24 09:26 - 2014-11-21 14:40 - 00000000 ____D () C:\Users\Linda\Documents\WatchTower

2015-01-24 08:48 - 2014-11-21 14:40 - 00000000 ____D () C:\Users\Linda\Documents\Letters

2015-01-24 06:58 - 2010-11-20 14:01 - 00781298 _____ () C:\Windows\system32\PerfStringBackup.INI

2015-01-24 06:55 - 2014-11-21 14:39 - 00000000 ____D () C:\Users\Linda\Documents\Business

2015-01-22 08:35 - 2009-07-13 21:53 - 00032558 _____ () C:\Windows\Tasks\SCHEDLGU.TXT

2015-01-21 07:10 - 2014-11-21 14:24 - 00000000 ____D () C:\Users\Linda\AppData\Roaming\Foxit Software

2015-01-16 16:36 - 2014-11-21 14:40 - 00000000 ____D () C:\Users\Linda\Documents\Howard

2015-01-14 06:33 - 2014-11-21 10:37 - 00000000 ____D () C:\Windows\system32\MRT

2015-01-14 06:26 - 2014-11-21 10:37 - 110348472 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2015-01-12 18:26 - 2014-11-23 07:52 - 00000000 ____D () C:\Users\Linda\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games

2015-01-12 10:40 - 2014-11-21 08:28 - 00000000 ____D () C:\Users\Linda

2015-01-12 09:13 - 2014-11-21 13:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Trusteer Endpoint Protection

2015-01-07 17:11 - 2014-11-21 18:12 - 00000000 ___RD () C:\Users\Linda\Dropbox

2015-01-07 17:11 - 2014-11-21 18:06 - 00000000 ____D () C:\Users\Linda\AppData\Roaming\Dropbox

2015-01-04 11:17 - 2014-11-21 16:07 - 00000000 ____D () C:\Users\Linda\AppData\Local\Microsoft Games

2015-01-03 08:30 - 2009-07-13 21:52 - 00000000 ____D () C:\Program Files\Microsoft Games

2015-01-03 08:21 - 2014-11-21 08:28 - 00000000 ____D () C:\Users\Linda\AppData\Local\VirtualStore

2015-01-03 08:20 - 2014-11-23 07:51 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hasbro Interactive

2015-01-02 11:03 - 2014-11-22 10:57 - 00000000 ____D () C:\Users\Linda\AppData\Roaming\Skype

2014-12-31 04:13 - 2014-11-21 10:18 - 00249488 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe

2014-12-29 06:30 - 2014-11-21 14:40 - 00000000 ____D () C:\Users\Linda\Documents\Health

==================== Files in the root of some directories =======

2014-11-21 08:54 - 2014-11-21 08:54 - 0613057 _____ (CMI Limited) C:\Users\Linda\AppData\Local\nso3AE0.tmp

Some content of TEMP:

====================

C:\Users\Linda\AppData\Local\Temp\ose00000.exe

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\system32\winlogon.exe => File is digitally signed

C:\Windows\system32\wininit.exe => File is digitally signed

C:\Windows\system32\svchost.exe => File is digitally signed

C:\Windows\system32\services.exe => File is digitally signed

C:\Windows\system32\User32.dll => File is digitally signed

C:\Windows\system32\userinit.exe => File is digitally signed

C:\Windows\system32\rpcss.dll => File is digitally signed

C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2015-01-25 08:56

==================== End Of Log ============================

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 24-01-2015 01

Ran by Linda at 2015-01-26 14:52:50

Running from C:\Users\Linda\Downloads

Boot Mode: Normal

==========================================================

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Microsoft Security Essentials (Enabled - Up to date) {4F35CFC4-45A3-FC37-EF17-759A02E39AB1}

AS: Microsoft Security Essentials (Enabled - Up to date) {F4542E20-6399-F3B9-D5A7-4EE87964D00C}

AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Flash Player 16 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 16.0.0.296 - Adobe Systems Incorporated)

Adobe Photoshop 5.5 (HKLM\...\Adobe Photoshop 5.5) (Version: 5.5 - Adobe Systems, Inc.)

After Dark Games (HKLM\...\After Dark Games) (Version: - )

CameraHelperMsi (Version: 13.51.815.0 - Logitech) Hidden

D3DX10 (Version: 15.4.2368.0902 - Microsoft) Hidden

Dropbox (HKU\S-1-5-21-2539202307-1761660001-8006430-1000\...\Dropbox) (Version: 3.0.3 - Dropbox, Inc.)

erLT (Version: 1.20.138.34 - Logitech, Inc.) Hidden

Foxit Cloud (HKLM\...\{41914D8B-9D6E-4764-A1F9-BC43FB6782C1}_is1) (Version: 2.7.39.123 - Foxit Software Inc.)

Foxit Reader (HKLM\...\Foxit Reader_is1) (Version: 7.0.3.916 - Foxit Software Inc.)

Google Chrome (HKLM\...\Google Chrome) (Version: 40.0.2214.91 - Google Inc.)

Google Update Helper (Version: 1.3.25.11 - Google Inc.) Hidden

Intel® Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version: 8.15.10.1930 - Intel Corporation)

Intel® TV Wizard (HKLM\...\TVWiz) (Version: - Intel Corporation)

Junk Mail filter update (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden

Logitech Webcam Software (HKLM\...\{D40EB009-0499-459c-A8AF-C9C110766215}) (Version: 2.51 - Logitech Inc.)

Malwarebytes Anti-Malware version 2.0.4.1028 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)

Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft Office 2007 Service Pack 3 (SP3) (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)

Microsoft Office File Validation Add-In (HKLM\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)

Microsoft Office Home and Student 2007 (HKLM\...\HOMESTUDENTR) (Version: 12.0.6612.1000 - Microsoft Corporation)

Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.6.305.0 - Microsoft Corporation)

Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)

Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Movie Maker (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden

Movie Rotator version 2.0.1 (HKLM\...\{1D2DBEF4-FF54-4E64-971E-8EE1E9585BB6}_is1) (Version: 2.0.1 - Chris Pearce)

PCI SoftV92 Modem (HKLM\...\CNXT_MODEM_PCI_HSF) (Version: 7.80.5.0 - Conexant Systems)

Rapport (Version: 3.5.1404.61 - Trusteer) Hidden

Scrabble v2.0 (HKLM\...\Scrabble v2.0) (Version: - )

Sierra Utilities (HKLM\...\Sierra Utilities) (Version: - )

Skype™ 6.22 (HKLM\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 6.22.107 - Skype Technologies S.A.)

StudioTax 2014 (HKLM\...\{28201C6B-7274-43F7-B6FE-6F0EC24096F3}) (Version: 10.0.0.0 - BHOK IT Consulting)

Trusteer Endpoint Protection (HKLM\...\Rapport_msi) (Version: 3.5.1404.61 - Trusteer)

Update for 2007 Microsoft Office System (KB967642) (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)

Watchtower Library 2013 - English (HKLM\...\{004E8ED2-315C-4473-A934-032D5D7B3A02}) (Version: 15.0 - Watchtower Bible and Tract Society of Pennsylvania, Inc.)

Winamp (HKLM\...\Winamp) (Version: 5.65 - Nullsoft, Inc)

Winamp Detector Plug-in (HKU\S-1-5-21-2539202307-1761660001-8006430-1000\...\Winamp Detect) (Version: 1.0.0.1 - Nullsoft, Inc)

Windows Live Essentials (HKLM\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)

Yahtzee (HKLM\...\Yahtzeev1) (Version: - )

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-2539202307-1761660001-8006430-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Linda\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-2539202307-1761660001-8006430-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Linda\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-2539202307-1761660001-8006430-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Linda\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-2539202307-1761660001-8006430-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Linda\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-2539202307-1761660001-8006430-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Linda\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-2539202307-1761660001-8006430-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Linda\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-2539202307-1761660001-8006430-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Linda\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-2539202307-1761660001-8006430-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Linda\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-2539202307-1761660001-8006430-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Linda\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)

==================== Restore Points =========================

08-01-2015 18:14:29 Windows Update

09-01-2015 08:34:59 Windows Backup

12-01-2015 08:12:59 Windows Update

12-01-2015 09:12:23 Installed Rapport

14-01-2015 06:24:58 Windows Update

15-01-2015 07:23:31 Windows Update

16-01-2015 08:43:14 Windows Backup

18-01-2015 08:19:05 Windows Update

22-01-2015 07:36:22 Windows Update

23-01-2015 09:33:16 Windows Backup

24-01-2015 15:48:43 Installed StudioTax 2014

25-01-2015 07:44:52 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-13 19:04 - 2009-06-10 14:39 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {412853CF-851A-4575-9294-D1DE9FDA0705} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-11-21] (Google Inc.)

Task: {999DB801-1469-44E2-984B-DB959E60EBE8} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-11-21] (Google Inc.)

Task: {BB19C3C8-FE14-4C5D-862E-0FD9115C0BBB} - System32\Tasks\LaunchSignup => C:\Program Files\MyPC Backup\Signup Wizard.exe <==== ATTENTION

Task: {DD422B60-3BAA-4B52-8399-9BB04289A945} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2015-01-25] (Adobe Systems Incorporated)

Task: {F0877E0C-746E-4808-B134-BE0010850263} - System32\Tasks\Knight System Protector Startup => C:\Program Files\Knight System Protector\KnightSystemProtector.exe

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2014-11-21 13:29 - 2013-04-15 11:49 - 00176128 _____ () C:\Windows\System32\HP1006LM.DLL

2014-11-21 13:30 - 2013-04-15 11:49 - 00059904 _____ () C:\Windows\system32\spool\PRTPROCS\W32X86\HP1006PP.dll

2012-09-13 00:38 - 2012-09-13 00:38 - 02144104 _____ () C:\Program Files\Logitech\LWS\Webcam Software\QtCore4.dll

2012-09-13 00:38 - 2012-09-13 00:38 - 07955304 _____ () C:\Program Files\Logitech\LWS\Webcam Software\QtGui4.dll

2012-09-13 00:38 - 2012-09-13 00:38 - 00341352 _____ () C:\Program Files\Logitech\LWS\Webcam Software\QtXml4.dll

2012-09-13 00:38 - 2012-09-13 00:38 - 00028008 _____ () C:\Program Files\Logitech\LWS\Webcam Software\imageformats\QGif4.dll

2012-09-13 00:38 - 2012-09-13 00:38 - 00127336 _____ () C:\Program Files\Logitech\LWS\Webcam Software\imageformats\QJpeg4.dll

2012-09-13 00:38 - 2012-09-13 00:38 - 00264040 _____ () C:\Program Files\Logitech\LWS\Webcam Software\CameraHelperShell.exe

2012-09-13 00:39 - 2012-09-13 00:39 - 00336232 _____ () C:\Program Files\Common Files\logishrd\LWSPlugins\LWS\Applets\CameraHelper\DevManagerCore.dll

2015-01-25 12:51 - 2015-01-20 20:50 - 01117512 _____ () C:\Program Files\Google\Chrome\Application\40.0.2214.91\libglesv2.dll

2015-01-25 12:51 - 2015-01-20 20:50 - 00211272 _____ () C:\Program Files\Google\Chrome\Application\40.0.2214.91\libegl.dll

2015-01-25 12:51 - 2015-01-20 20:50 - 09171272 _____ () C:\Program Files\Google\Chrome\Application\40.0.2214.91\pdf.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)

==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

MSCONFIG\Services: YouTubeDownload_P2 => 2

MSCONFIG\startupreg: ConvertAd => C:\Users\Linda\AppData\Local\ConvertAd\ConvertAd.exe

========================= Accounts: ==========================

Administrator (S-1-5-21-2539202307-1761660001-8006430-500 - Administrator - Disabled)

Guest (S-1-5-21-2539202307-1761660001-8006430-501 - Limited - Disabled)

HomeGroupUser$ (S-1-5-21-2539202307-1761660001-8006430-1002 - Limited - Enabled)

Linda (S-1-5-21-2539202307-1761660001-8006430-1000 - Administrator - Enabled) => C:\Users\Linda

==================== Faulty Device Manager Devices =============

Name: Teredo Tunneling Pseudo-Interface

Description: Microsoft Teredo Tunneling Adapter

Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}

Manufacturer: Microsoft

Service: tunnel

Problem: : This device cannot start. (Code10)

Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.

On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.

==================== Event log errors: =========================

Application errors:

==================

Error: (01/26/2015 00:22:00 PM) (Source: WinMgmt) (EventID: 10) (User: )