TWC detected botnet, please help!

hmw1008 · February 5, 2015

Today I woke up to do some homework online, I get a message page from my internet service Time Warner Cable, and they have notified me that I have a botnet! At the moment, I'm currently scanning avast and malwarebytes program to get it rid of it, but I'm not sure if its going to work, because I'm so paranoid. I've been here once before couple of years ago, and got help with a malware issue that I had. And I was satisfied with it, so I would like it if you may help me once more!

deeprybka · February 5, 2015

Hi & :welcome:

My name is Jürgen and I will be assisting you with your Malware related problems.

Before we move on, please read the following points carefully. :excl:

My native language isn't English. So please do not use slang or idioms. It could be hard for me to read. Thanks for your understanding.
Please read my instructions completely. If there is anything that you do not understand kindly ask before proceeding.
Perform everything in the correct order. Sometimes one step requires the previous one.
If you have any problems while you are follow my instructions, Stop there and tell me the exact nature of your problem.
Do not run any other scans without instruction or Add/ Remove Software unless I tell you to do so. This would change the output of our tools and could be confusing for me.
Post all Logfiles as a reply rather than as an attachment unless I specifically ask you. If you can not post all logfiles in one reply, feel free to use more posts.
If I don't hear from you within 3 days from this initial or any subsequent post, then this thread will be closed.
Stay with me. I will give you some advice about prevention after the cleanup process. Absence of symptoms does not always mean the computer is clean.

P2P/Piracy Warning:

If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall them or completely disable them from running while being assisted here.
Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.
If you have illegal/cracked software, cracks, keygens, etc. on the system, please remove or uninstall them now and read the policy on Piracy.

Step 1

Please run a FRST scan. This will help us diagnose your problem.

Please download Farbar Recovery Scan Tool and save it to your Desktop.

(If you are not sure which version (32-/64-bit) applies to your system, download and try to start both of them as just the right one will run.)

Start FRST with administator privileges.
Make sure the option Addition.txt is checked and press the Scan button.
When finished, FRST will produce two logs (FRST.txt and Addition.txt) in the same directory the tool was run from.
Please copy and paste these logs in your next reply.

hmw1008 · February 5, 2015

Hello deeprybka! Here is the FRST.txt! And posting Addition.txt on next reply/

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 05-02-2015

Ran by Home (administrator) on HOME-PC on 05-02-2015 16:14:42

Running from C:\Users\Home\Desktop

Loaded Profiles: Home (Available profiles: Home)

Platform: Microsoft Windows 7 Home Premium Service Pack 1 (X86) OS Language: English (United States)

Internet Explorer Version 11 (Default browser: FF)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe

(Microsoft Corporation) C:\Windows\System32\wlanext.exe

(Adobe Systems Incorporated) C:\Program Files\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe

(McAfee, Inc.) C:\Windows\System32\mfevtps.exe

() C:\Windows\System32\PnkBstrA.exe

(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE

(Intel Corporation) C:\Windows\System32\igfxtray.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(Renesas Electronics Corporation) C:\Program Files\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe

(Google Inc.) C:\Program Files\Google\Google Japanese Input\GoogleIMEJaBroker32.exe

(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe

(Microsoft Corporation) C:\Windows\System32\rundll32.exe

(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe

(LINE Corporation) C:\Program Files\Naver\LINE\Line.exe

(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE

(DuckLink Software) C:\Program Files\DuckLink\DuckCapture\DuckCapture.exe

(Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe

(Sony Computer Entertainment Inc.) C:\Program Files\Sony\Content Manager Assistant\CMA.exe

(Dropbox, Inc.) C:\Users\Home\AppData\Roaming\Dropbox\bin\Dropbox.exe

(Sony Computer Entertainment Inc.) C:\Program Files\Sony\Content Manager Assistant\CMAWatcher.exe

(Google Inc.) C:\Program Files\Google\Update\1.3.26.9\GoogleCrashHandler.exe

(AVAST Software) C:\Program Files\AVAST Software\Avast\setup\instup.exe

(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe

(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files\Google\Google Japanese Input\GoogleIMEJaCacheService.exe

(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe

(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [NUSB3MON] => C:\Program Files\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-11-17] (Renesas Electronics Corporation)

HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [497648 2010-07-29] (Adobe Systems Incorporated)

HKLM\...\Run: [Google Japanese Input Prelauncher] => C:\Program Files\Google\Google Japanese Input\GoogleIMEJaBroker32.exe [1435672 2013-12-18] (Google Inc.)

HKLM\...\Run: [bCSSync] => C:\Program Files\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)

HKLM\...\Run: [sunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)

HKLM\...\Run: [XeroxEndeavorBackgroundTask] => rundll32.exe xrWCbgnd.dll,LaunchBgTask 1

HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5227112 2015-01-26] (AVAST Software)

HKU\S-1-5-21-4195104481-2079486966-316092486-1000\...\Run: [DAEMON Tools Lite] => C:\Program Files\DAEMON Tools Lite\DTLite.exe [3675352 2013-10-28] (Disc Soft Ltd)

HKU\S-1-5-21-4195104481-2079486966-316092486-1000\...\Run: [Line] => C:\Program Files\Naver\LINE\Line.exe [4031336 2015-02-03] (LINE Corporation)

HKU\S-1-5-21-4195104481-2079486966-316092486-1000\...\Run: [DuckCapture] => C:\Program Files\DuckLink\DuckCapture\DuckCapture.exe [436736 2011-11-03] (DuckLink Software)

HKU\S-1-5-21-4195104481-2079486966-316092486-1000\...\Run: [skype] => C:\Program Files\Skype\Phone\Skype.exe [30877280 2014-12-11] (Skype Technologies S.A.)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Content Manager Assistant for PlayStation®.lnk

ShortcutTarget: Content Manager Assistant for PlayStation®.lnk -> C:\Program Files\Sony\Content Manager Assistant\CMA.exe (Sony Computer Entertainment Inc.)

Startup: C:\Users\Home\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk

ShortcutTarget: Dropbox.lnk -> C:\Users\Home\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShell.dll (AVAST Software)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com

SearchScopes: HKLM -> DefaultScope {31090377-0740-419E-BEFC-A56E50500D5B} URL = http://speedial.com/results.php?f=4&q={searchTerms}&a=spd_ir_14_23_ch&cd=2XzuyEtN2Y1L1Qzu0EyE0DyDtA0DtB0B0BzztB0B0A0A0B0EtN0D0Tzu0SzzzzyEtN1L2XzutBtFtBtDtFtCzytFtDtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2StAtCtDtAtC0CzzyCtGyDyB0FzytG0A0EtCtAtGtB0D0DtDtGyCyEtA0BzztC0EyE0ByCzyyC2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyB0DyBzz0BzyyD0FtG0F0B0EtCtGzzzyyE0AtGtB0B0E0BtGyB0D0Azz0B0F0A0D0CzytBtB2Q&cr=866866320&ir=

SearchScopes: HKLM -> {31090377-0740-419E-BEFC-A56E50500D5B} URL = http://speedial.com/results.php?f=4&q={searchTerms}&a=spd_ir_14_23_ch&cd=2XzuyEtN2Y1L1Qzu0EyE0DyDtA0DtB0B0BzztB0B0A0A0B0EtN0D0Tzu0SzzzzyEtN1L2XzutBtFtBtDtFtCzytFtDtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2StAtCtDtAtC0CzzyCtGyDyB0FzytG0A0EtCtAtGtB0D0DtDtGyCyEtA0BzztC0EyE0ByCzyyC2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyB0DyBzz0BzyyD0FtG0F0B0EtCtGzzzyyE0AtGtB0B0E0BtGyB0D0Azz0B0F0A0D0CzytBtB2Q&cr=866866320&ir=

SearchScopes: HKU\S-1-5-21-4195104481-2079486966-316092486-1000 -> DefaultScope {31090377-0740-419E-BEFC-A56E50500D5B} URL = http://speedial.com/results.php?f=4&q={searchTerms}&a=spd_ir_14_23_ch&cd=2XzuyEtN2Y1L1Qzu0EyE0DyDtA0DtB0B0BzztB0B0A0A0B0EtN0D0Tzu0SzzzzyEtN1L2XzutBtFtBtDtFtCzytFtDtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2StAtCtDtAtC0CzzyCtGyDyB0FzytG0A0EtCtAtGtB0D0DtDtGyCyEtA0BzztC0EyE0ByCzyyC2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyB0DyBzz0BzyyD0FtG0F0B0EtCtGzzzyyE0AtGtB0B0E0BtGyB0D0Azz0B0F0A0D0CzytBtB2Q&cr=866866320&ir=

SearchScopes: HKU\S-1-5-21-4195104481-2079486966-316092486-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =

SearchScopes: HKU\S-1-5-21-4195104481-2079486966-316092486-1000 -> {31090377-0740-419E-BEFC-A56E50500D5B} URL = http://speedial.com/results.php?f=4&q={searchTerms}&a=spd_ir_14_23_ch&cd=2XzuyEtN2Y1L1Qzu0EyE0DyDtA0DtB0B0BzztB0B0A0A0B0EtN0D0Tzu0SzzzzyEtN1L2XzutBtFtBtDtFtCzytFtDtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2StAtCtDtAtC0CzzyCtGyDyB0FzytG0A0EtCtAtGtB0D0DtDtGyCyEtA0BzztC0EyE0ByCzyyC2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyB0DyBzz0BzyyD0FtG0F0B0EtCtGzzzyyE0AtGtB0B0E0BtGyB0D0Azz0B0F0A0D0CzytBtB2Q&cr=866866320&ir=

BHO: Java Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll No File

BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)

BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll No File

BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)

BHO: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll No File

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:

========

FF ProfilePath: C:\Users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\76dr9cm9.default-1394098711741

FF DefaultSearchEngine: Google

FF NetworkProxy: "http", "1.179.143.178"

FF NetworkProxy: "http_port", 3128

FF NetworkProxy: "type", 0

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_12_0_0_44.dll ()

FF Plugin: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)

FF Plugin: @java.com/DTPlugin,version=10.45.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=10.45.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin: @microsoft.com/GENUINE -> disabled No File

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)

FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)

FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)

FF Plugin: @videolan.org/vlc,version=2.1.2 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF user.js: detected! => C:\Users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\76dr9cm9.default-1394098711741\user.js

FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\oshiete-goo.xml

FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\rakuten.xml

FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-jp-auctions.xml

FF Extension: DownloadHelper - C:\Users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\76dr9cm9.default-1394098711741\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2014-09-14]

FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF

FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-09-30]

Chrome:

=======

CHR HomePage: Default -> hxxp://feed.snapdo.com/?publisher=Somoto&dpid=SomotoCH&co=US&userid=e3b0ef4c-3de0-8572-4794-eba80106b4f5&searchtype=hp&installDate={installDate}&barcodeid={barcodeID}&um={UM}

CHR Profile: C:\Users\Home\AppData\Local\Google\Chrome\User Data\Default

CHR Extension: (Google Docs) - C:\Users\Home\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-02-01]

CHR Extension: (Google Drive) - C:\Users\Home\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-02-01]

CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Home\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-05-25]

CHR Extension: (YouTube) - C:\Users\Home\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-02-01]

CHR Extension: (4chan X) - C:\Users\Home\AppData\Local\Google\Chrome\User Data\Default\Extensions\cellaaeoekimmemgdheibaibbaoeefbl [2014-02-02]

CHR Extension: (Google Search) - C:\Users\Home\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-02-01]

CHR Extension: (AdBlock) - C:\Users\Home\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2014-06-27]

CHR Extension: (Avast Online Security) - C:\Users\Home\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2014-09-30]

CHR Extension: (Google Wallet) - C:\Users\Home\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-02-01]

CHR Extension: (Gmail) - C:\Users\Home\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-02-01]

CHR HKLM\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-01-08]

CHR HKU\S-1-5-21-4195104481-2079486966-316092486-1000\...\Chrome\Extension: [bakijjialdiiboeaknfpmflphhmljfkd] - No Path

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AdobeActiveFileMonitor9.0; C:\Program Files\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe [169408 2010-09-30] (Adobe Systems Incorporated)

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2015-01-08] (AVAST Software)

S3 cphs; C:\Windows\system32\IntelCpHeciSvc.exe [279000 2014-01-29] (Intel Corporation)

R2 GoogleIMEJaCacheService; C:\Program Files\Google\Google Japanese Input\GoogleIMEJaCacheService.exe [754712 2013-12-18] (Google Inc.)

R2 mfevtp; C:\Windows\system32\mfevtps.exe [179600 2014-09-29] (McAfee, Inc.)

S3 npggsvc; C:\Windows\system32\GameMon.des [5267776 2014-01-22] (INCA Internet Co., Ltd.)

R2 PnkBstrA; C:\Windows\system32\PnkBstrA.exe [76888 2014-05-10] ()

R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-26] (Microsoft Corporation)

S2 avgwd; "C:\Program Files\AVG\AVG2015\avgwdsvc.exe" [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [24184 2015-01-08] ()

R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [70384 2015-01-08] (AVAST Software)

R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [81768 2015-01-08] (AVAST Software)

R0 aswRvrt; C:\Windows\system32\Drivers\aswRvrt.sys [49944 2015-01-08] ()

R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [787800 2015-01-08] (AVAST Software)

R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [423784 2015-01-08] (AVAST Software)

R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [91496 2015-01-08] (AVAST Software)

R0 aswVmm; C:\Windows\system32\Drivers\aswVmm.sys [206248 2015-01-08] ()

R3 b57xdbd; C:\Windows\System32\DRIVERS\b57xdbd.sys [59944 2010-12-11] (Broadcom Corporation)

R3 b57xdmp; C:\Windows\System32\DRIVERS\b57xdmp.sys [18472 2010-12-11] (Broadcom Corporation)

R3 bScsiMSx; C:\Windows\System32\DRIVERS\bScsiMSx.sys [32296 2010-12-10] (Broadcom Corporation)

R3 bScsiSDx; C:\Windows\System32\DRIVERS\bScsiSDx.sys [55336 2010-12-11] (Broadcom Corporation)

R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [243128 2014-02-25] (Disc Soft Ltd)

R0 MBAMSwissArmy; C:\Windows\System32\drivers\MBAMSwissArmy.sys [114904 2015-02-05] (Malwarebytes Corporation)

R3 MEI; C:\Windows\System32\DRIVERS\HECI.sys [41088 2010-10-19] (Intel Corporation)

R0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [575984 2014-09-29] (McAfee, Inc.)

S3 mferkdet; C:\Windows\System32\drivers\mferkdet.sys [94520 2014-09-29] (McAfee, Inc.)

R3 Neo_VPN; C:\Windows\System32\DRIVERS\Neo_0103.sys [26880 2014-06-25] (SoftEther Corporation)

R0 sptd; C:\Windows\System32\Drivers\sptd.sys [324096 2014-02-25] (Duplex Secure Ltd.)

S3 USBAAPL; C:\Windows\System32\Drivers\usbaapl.sys [45056 2013-03-18] (Apple, Inc.) [File not signed]

U3 apxlhe8b; C:\Windows\system32\Drivers\apxlhe8b.sys [0 ] (Broadcom Corporation) <==== ATTENTION (zero size file/folder)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)

==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-05 16:14 - 2015-02-05 16:14 - 00019436 _____ () C:\Users\Home\Desktop\FRST.txt

2015-02-05 15:28 - 2015-02-05 16:14 - 00000000 ____D () C:\FRST

2015-02-05 14:39 - 2015-02-05 14:40 - 01123328 _____ (Farbar) C:\Users\Home\Desktop\FRST.exe

2015-01-26 20:27 - 2015-01-26 20:27 - 00000000 ____D () C:\Program Files\Mozilla Firefox

2015-01-23 14:16 - 2015-01-23 14:16 - 00243616 _____ () C:\Users\Home\Downloads\Firefox Setup Stub 35.0.exe

2015-01-10 10:33 - 2012-01-13 07:03 - 00000000 ____D () C:\Users\Home\Desktop\Wink - Memories

2015-01-08 10:05 - 2015-01-08 10:05 - 00002045 _____ () C:\Users\Public\Desktop\Avast Free Antivirus.lnk

2015-01-08 10:04 - 2015-01-08 10:04 - 00291352 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe

2015-01-08 10:04 - 2015-01-08 10:04 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-05 16:13 - 2014-02-21 17:48 - 00000000 ___RD () C:\Users\Home\Dropbox

2015-02-05 16:13 - 2014-02-21 17:44 - 00000000 ____D () C:\Users\Home\AppData\Roaming\Dropbox

2015-02-05 16:12 - 2014-02-02 15:40 - 00000000 ____D () C:\Users\Home\AppData\Roaming\Skype

2015-02-05 16:11 - 2014-02-01 18:41 - 00000882 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2015-02-05 16:10 - 2009-07-13 22:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2015-02-05 16:10 - 2009-07-13 22:39 - 00075122 _____ () C:\Windows\setupact.log

2015-02-05 16:09 - 2010-11-20 15:48 - 00039932 _____ () C:\Windows\PFRO.log

2015-02-05 15:36 - 2014-02-01 18:12 - 02048650 _____ () C:\Windows\WindowsUpdate.log

2015-02-05 14:50 - 2014-02-01 18:41 - 00000886 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2015-02-05 14:38 - 2014-02-08 21:52 - 00000000 ____D () C:\Users\Home\AppData\Roaming\tixati

2015-02-05 14:35 - 2014-08-11 02:33 - 00000000 ____D () C:\Program Files\OBS

2015-02-05 12:55 - 2010-11-20 15:01 - 00781298 _____ () C:\Windows\system32\PerfStringBackup.INI

2015-02-05 08:25 - 2014-06-03 19:05 - 00114904 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamswissarmy.sys

2015-02-05 08:22 - 2009-07-13 22:34 - 00022736 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2015-02-05 08:21 - 2009-07-13 22:34 - 00022736 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2015-02-04 23:27 - 2014-11-02 23:15 - 00000000 ____D () C:\Users\Home\AppData\Local\JDownloader 2.0

2015-02-04 18:58 - 2014-04-26 12:32 - 00001021 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\LINE.lnk

2015-02-04 18:58 - 2014-04-26 12:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LINE

2015-02-03 21:35 - 2014-02-05 04:25 - 00000000 ____D () C:\Users\Home\AppData\Roaming\vlc

2015-02-03 20:10 - 2014-02-01 18:42 - 00002129 _____ () C:\Users\Public\Desktop\Google Chrome.lnk

2015-01-31 21:49 - 2015-01-05 21:29 - 00000000 ____D () C:\Users\Home\Desktop\jt

2015-01-31 21:03 - 2014-08-05 14:57 - 00000000 ____D () C:\Users\Home\Desktop\Media

2015-01-31 16:14 - 2014-02-06 00:48 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service

2015-01-23 14:18 - 2014-02-06 00:48 - 00001117 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk

2015-01-23 14:18 - 2014-02-06 00:48 - 00001105 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk

2015-01-20 12:29 - 2014-02-03 05:06 - 00000000 ____D () C:\Users\Home\Documents\Note

2015-01-19 21:23 - 2014-03-14 18:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office

2015-01-19 21:23 - 2014-03-14 18:05 - 00000000 ____D () C:\ProgramData\Microsoft Help

2015-01-09 06:57 - 2014-02-02 15:40 - 00000000 ____D () C:\ProgramData\Skype

2015-01-09 06:56 - 2014-10-12 10:55 - 00000000 ___RD () C:\Program Files\Skype

2015-01-09 06:52 - 2014-07-23 02:12 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware

2015-01-08 10:05 - 2014-09-30 01:29 - 00787800 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys

2015-01-08 10:05 - 2014-09-30 01:29 - 00423784 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys

2015-01-08 10:04 - 2014-09-30 01:29 - 00206248 _____ () C:\Windows\system32\Drivers\aswVmm.sys

2015-01-08 10:04 - 2014-09-30 01:29 - 00091496 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys

2015-01-08 10:04 - 2014-09-30 01:29 - 00081768 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys

2015-01-08 10:04 - 2014-09-30 01:29 - 00070384 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys

2015-01-08 10:04 - 2014-09-30 01:29 - 00049944 _____ () C:\Windows\system32\Drivers\aswRvrt.sys

2015-01-08 10:04 - 2014-09-30 01:29 - 00024184 _____ () C:\Windows\system32\Drivers\aswHwid.sys

2015-01-06 14:25 - 2014-07-23 02:12 - 00001060 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2015-01-06 14:25 - 2014-07-23 02:12 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

==================== Files in the root of some directories =======

2014-09-22 18:06 - 2014-09-24 01:03 - 0004535 _____ () C:\Users\Home\AppData\Roaming\CamStudio.cfg

2014-05-10 00:52 - 2014-05-10 00:52 - 0138904 _____ () C:\Users\Home\AppData\Roaming\PnkBstrK.sys

2014-09-22 17:59 - 2014-09-22 17:59 - 0000096 _____ () C:\Users\Home\AppData\Roaming\version2.xml

2014-06-02 23:01 - 2014-06-02 23:01 - 0000043 _____ () C:\Users\Home\AppData\Roaming\WB.CFG

2014-08-25 14:38 - 2014-08-25 14:38 - 0005129 _____ () C:\Users\Home\AppData\Local\recently-used.xbel

Some content of TEMP:

====================

C:\Users\Home\AppData\Local\Temp\1580uninstall.exe

C:\Users\Home\AppData\Local\Temp\bdfilters.dll

C:\Users\Home\AppData\Local\Temp\BingBarSetup-Partner.exe

C:\Users\Home\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpcudqlt.dll

C:\Users\Home\AppData\Local\Temp\JDSetup130462413332658678.exe

C:\Users\Home\AppData\Local\Temp\jre-7u55-windows-i586-iftw.exe

C:\Users\Home\AppData\Local\Temp\jre-8u31-windows-au.exe

C:\Users\Home\AppData\Local\Temp\mpam-cfdb5341.exe

C:\Users\Home\AppData\Local\Temp\optprosetup.exe

C:\Users\Home\AppData\Local\Temp\ose00000.exe

C:\Users\Home\AppData\Local\Temp\proxy_vole2771621787586578924.dll

C:\Users\Home\AppData\Local\Temp\SkypeSetup.exe

C:\Users\Home\AppData\Local\Temp\welcome_jpn.dll

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\system32\winlogon.exe => File is digitally signed

C:\Windows\system32\wininit.exe => File is digitally signed

C:\Windows\system32\svchost.exe => File is digitally signed

C:\Windows\system32\services.exe => File is digitally signed

C:\Windows\system32\User32.dll => File is digitally signed

C:\Windows\system32\userinit.exe => File is digitally signed

C:\Windows\system32\rpcss.dll => File is digitally signed

C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2015-02-03 02:03

==================== End Of Log ============================

hmw1008 · February 5, 2015

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 05-02-2015

Ran by Home at 2015-02-05 16:16:08

Running from C:\Users\Home\Desktop

Boot Mode: Normal

==========================================================

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}

AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Acer System Information (HKLM\...\{72199E33-4F2A-4B7F-8E25-95DDDD50A678}) (Version: 1.0.0 - Acer)

Adobe AIR (HKLM\...\Adobe AIR) (Version: 1.5.3.9130 - Adobe Systems Inc.)

Adobe Community Help (HKLM\...\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 3.2.1.650 - Adobe Systems Incorporated)

Adobe Flash Player 12 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 12.0.0.44 - Adobe Systems Incorporated)

Adobe Photoshop Elements 9 (HKLM\...\Adobe Photoshop Elements 9) (Version: 9.0.3.0 - Adobe Systems Incorporated)

Adobe Photoshop.com Inspiration Browser (HKLM\...\PhotoshopdotcomInspirationBrowser.4C35C4D325D350FE0114230CBADCA2DDD0AC8D25.1) (Version: 3.07 - Adobe Systems Incorporated)

Adobe Premiere Elements 9 (HKLM\...\PremElem90) (Version: 9.0 - Adobe Systems Incorporated)

Adobe Premiere Elements 9 Content (HKLM\...\Adobe Premiere Elements 9 Content) (Version: 9.0 - Adobe Systems Incorporated)

Adobe Reader XI (11.0.10) (HKLM\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)

Archeblade (HKLM\...\Steam App 207230) (Version: - CodeBrush Games)

Avast Free Antivirus (HKLM\...\Avast) (Version: 10.0.2208 - AVAST Software)

Bandicam (HKLM\...\Bandicam) (Version: 2.0.1.651 - Bandisoft.com)

Bandisoft MPEG-1 Decoder (HKLM\...\BandiMPEG1) (Version: - Bandisoft.com)

Broadcom 802.11 Network Adapter (HKLM\...\Broadcom 802.11 Network Adapter) (Version: 5.100.82.135 - Broadcom Corporation)

Broadcom Card Reader Driver Installer (HKLM\...\{4710662C-8204-4334-A977-B1AC9E547819}) (Version: 14.4.9.2 - Broadcom Corporation)

Broadcom Gigabit NetLink Controller (HKLM\...\{029A4933-3F36-4E4F-AEC3-2207AB26463D}) (Version: 14.4.6.1 - Broadcom Corporation)

Cisco EAP-FAST Module (Version: 2.2.14 - Cisco Systems, Inc.) Hidden

Cisco LEAP Module (Version: 1.0.19 - Cisco Systems, Inc.) Hidden

Cisco PEAP Module (Version: 1.1.6 - Cisco Systems, Inc.) Hidden

Content Manager Assistant for PlayStation® (HKLM\...\{E6EB4571-5ADB-4557-8F95-0E0EF5D0F833}) (Version: 3.30.7824.86 - Sony Computer Entertainment Inc.)

D3DX10 (Version: 15.4.2368.0902 - Microsoft) Hidden

DAEMON Tools Lite (HKLM\...\DAEMON Tools Lite) (Version: 4.48.1.0347 - Disc Soft Ltd)

Dropbox (HKU\S-1-5-21-4195104481-2079486966-316092486-1000\...\Dropbox) (Version: 3.0.3 - Dropbox, Inc.)

DuckCapture Standard 2.7 (HKLM\...\DuckCapture_is1) (Version: 2.7 - DuckLink)

Elements 9 Organizer (Version: 9.0 - Adobe Systems Incorporated) Hidden

Elements STI Installer (Version: 1.0 - Adobe Systems Incorporated) Hidden

FLAC 1.2.1b (remove only) (HKLM\...\FLAC) (Version: 1.2.1b - Xiph.org)

foobar2000 v1.3.1 (HKLM\...\foobar2000) (Version: 1.3.1 - Peter Pawlowski)

GIMP 2.8.10 (HKLM\...\GIMP-2_is1) (Version: 2.8.10 - The GIMP Team)

Google Chrome (HKLM\...\Google Chrome) (Version: 40.0.2214.94 - Google Inc.)

Google Update Helper (Version: 1.3.25.11 - Google Inc.) Hidden

Google Update Helper (Version: 1.3.26.9 - Google Inc.) Hidden

Google 日本語入力 (HKLM\...\{56CB4ACA-C79E-439D-B55E-68EA8D57C467}) (Version: 1.13.1641.0 - Google Inc.)

Google+ Auto Backup (HKLM\...\{A50DE037-B5C0-4C8A-8049-B0C576B313D1}) (Version: 1.0.21.81 - Google)

HandBrake 0.9.9.1 (HKLM\...\HandBrake) (Version: 0.9.9.1 - )

HF pAppLoc version 1.1 (HKLM\...\{9143B17E-BBDE-4EA7-A4E3-20D384D9C8A5}_is1) (Version: 1.1 - Inquisitor)

Intel® Processor Graphics (HKLM\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.17.10.3347 - Intel Corporation)

Java 7 Update 45 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83217045FF}) (Version: 7.0.450 - Oracle)

JDownloader 0.9 (HKLM\...\5513-1208-7298-9440) (Version: 0.9 - AppWork GmbH)

JDownloader 2 (HKLM\...\jdownloader2) (Version: 2.0 - AppWork GmbH)

LINE (HKLM\...\LINE) (Version: 3.9.1.188 - LINE Corporation)

Malwarebytes Anti-Malware version 2.0.4.1028 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)

Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft Image Composite Editor (HKLM\...\{3D599ADA-65D9-4B51-898F-CE718DEC5DBB}) (Version: 1.4.4 - Microsoft Corporation)

Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)

Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61187 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.7523 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.7523 - Microsoft Corporation)

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 (HKLM\...\{B175520C-86A2-35A7-8619-86DC379688B9}) (Version: 11.0.61030 - Microsoft Corporation)

Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 (HKLM\...\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}) (Version: 11.0.61030 - Microsoft Corporation)

Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (HKLM\...\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}) (Version: 12.0.21005 - Microsoft Corporation)

Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (HKLM\...\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}) (Version: 12.0.21005 - Microsoft Corporation)

Microsoft Windows Application Compatibility Database (HKLM\...\{deb7008b-681e-4a4a-8aae-cc833e8216ce}.sdb) (Version: - )

Microsoft Word 2010 (HKLM\...\Office14.WORD) (Version: 14.0.7015.1000 - Microsoft Corporation)

MKVToolNix 6.7.0 [20140102-565] (HKLM\...\MKVToolNix) (Version: 6.7.0 - Moritz Bunkus)

Movie Maker (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden

Mozilla Firefox 35.0.1 (x86 ja) (HKLM\...\Mozilla Firefox 35.0.1 (x86 ja)) (Version: 35.0.1 - Mozilla)

Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 35.0 - Mozilla)

MPC-HC 1.7.3 (HKLM\...\{2624B969-7135-4EB1-B0F6-2D8C397B45F7}_is1) (Version: 1.7.3 - MPC-HC Team)

piaip AppLocale (HKLM\...\{394BE3D9-7F57-4638-A8D1-1D88671913B7}) (Version: 1.0.0 - MS)

Picasa 3 (HKLM\...\Picasa 3) (Version: 3.9 - Google, Inc.)

PunkBuster Services (HKLM\...\PunkBusterSvc) (Version: 0.993 - Even Balance, Inc.)

qBittorrent 3.1.8 (HKLM\...\qbittorrent) (Version: 3.1.8 - The qBittorrent project)

Renesas Electronics USB 3.0 Host Controller Driver (HKLM\...\InstallShield_{5442DAB8-7177-49E1-8B22-09A049EA5996}) (Version: 2.0.32.0 - Renesas Electronics Corporation)

Renesas Electronics USB 3.0 Host Controller Driver (Version: 2.0.32.0 - Renesas Electronics Corporation) Hidden

Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM\...\{90140000-001B-0000-0000-0000000FF1CE}_Office14.WORD_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)

Skype™ 7.0 (HKLM\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.0.102 - Skype Technologies S.A.)

SmartSound Quicktracks for Premiere Elements 9.0 (HKLM\...\InstallShield_{6748E773-5DA0-4D19-8AA5-273B4133A09B}) (Version: 3.12.3090 - SmartSound Software Inc)

SmartSound Quicktracks for Premiere Elements 9.0 (Version: 3.12.3090 - SmartSound Software Inc) Hidden

Steam (HKLM\...\Steam) (Version: - Valve Corporation)

Tixati (HKLM\...\tixati) (Version: - )

Tom Clancy's Ghost Recon Phantoms - NA (HKLM\...\Steam App 243870) (Version: - Ubisoft Singapore)

Visual Studio 2012 x86 Redistributables (HKLM\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)

VLC media player 2.1.2 (HKLM\...\VLC media player) (Version: 2.1.2 - VideoLAN)

Windows Live Essentials (HKLM\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)

WinRAR 5.01 (32-bit) (HKLM\...\WinRAR archiver) (Version: 5.01.0 - win.rar GmbH)

XMedia Recode version 3.1.8.4 (HKLM\...\{DDA3C325-47B2-4730-9672-BF3771C08799}_is1) (Version: 3.1.8.4 - XMedia Recode)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-4195104481-2079486966-316092486-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Home\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-4195104481-2079486966-316092486-1000_Classes\CLSID\{1AC77AE9-9EC6-405A-9F9B-C06AB3C10B71}\InprocServer32 -> C:\Program Files\Microsoft Research\Image Composite Editor\ShellExtension.dll No File

CustomCLSID: HKU\S-1-5-21-4195104481-2079486966-316092486-1000_Classes\CLSID\{1EF21888-3BD8-4064-BAD3-4BF694952652}\InprocServer32 -> C:\Program Files\Microsoft Research\Image Composite Editor\WLPG.dll (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-4195104481-2079486966-316092486-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Home\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-4195104481-2079486966-316092486-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Home\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-4195104481-2079486966-316092486-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Home\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-4195104481-2079486966-316092486-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Home\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-4195104481-2079486966-316092486-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Home\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-4195104481-2079486966-316092486-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Home\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-4195104481-2079486966-316092486-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Home\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-4195104481-2079486966-316092486-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Home\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)

==================== Restore Points =========================

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-13 20:04 - 2009-06-10 15:39 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {0C23445C-A760-4634-B9A0-EB280AD6891C} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-02-01] (Google Inc.)

Task: {1DDEFBDC-A5B9-4569-9BCC-FA5CCA6B3935} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc

Task: {2828B5AE-1AEC-4363-8B73-947A76D3069B} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)

Task: {308944FE-8032-47CB-B624-1730B1E13176} - System32\Tasks\Microsoft\Windows\TabletPC\InputPersonalization => C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe [2009-07-13] (Microsoft Corporation)

Task: {8210113A-F918-470A-B812-26177AA90A08} - System32\Tasks\AdobeAAMUpdater-1.0-Home-PC-Home => C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2010-07-29] (Adobe Systems Incorporated)

Task: {992951D0-0FCD-4EE9-BB1C-FC5A751B9490} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2015-01-08] (AVAST Software)

Task: {E1F7CBDA-5AF3-43AA-9E16-B9A5DC291879} - System32\Tasks\{DE5C1EA8-35F0-4744-B56A-0B2FA27465AE} => Chrome.exe http://ui.skype.com/ui/0/6.13.0.104/en/abandoninstall?source=lightinstaller&page=tsBing

Task: {F0100D7C-9C62-4D30-BBF6-5F58090D1E26} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-02-01] (Google Inc.)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) ==============

2015-02-05 07:30 - 2015-02-05 07:30 - 02913280 _____ () C:\Program Files\AVAST Software\Avast\defs\15020500\algo.dll

2014-05-10 00:51 - 2014-05-10 00:51 - 00076888 _____ () C:\Windows\system32\PnkBstrA.exe

2014-01-29 23:12 - 2014-01-29 23:12 - 00094208 _____ () C:\Windows\System32\IccLibDll.dll

2015-01-08 10:04 - 2015-01-08 10:04 - 38562088 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll

2014-11-12 23:54 - 2014-11-12 23:54 - 00113664 _____ () C:\Program Files\Naver\LINE\PlayerHelper.dll

2015-02-03 02:08 - 2015-02-03 02:08 - 03123048 _____ () C:\Program Files\Naver\LINE\ampkit_windows.dll

2014-08-21 06:48 - 2011-10-30 13:28 - 00029696 _____ () C:\Program Files\DuckLink\DuckCapture\QtSolutions_SingleApplication-head.dll

2014-08-21 06:48 - 2011-10-22 07:05 - 08343040 _____ () C:\Program Files\DuckLink\DuckCapture\QtGui4.dll

2014-08-21 06:48 - 2011-08-28 19:41 - 02305536 _____ () C:\Program Files\DuckLink\DuckCapture\QtCore4.dll

2014-08-21 06:48 - 2011-08-28 19:42 - 00862720 _____ () C:\Program Files\DuckLink\DuckCapture\QtNetwork4.dll

2014-08-21 06:48 - 2011-10-30 13:28 - 00582144 _____ () C:\Program Files\DuckLink\DuckCapture\QtSolutions_PropertyBrowser-head.dll

2014-08-21 06:48 - 2011-08-28 19:57 - 01339904 _____ () C:\Program Files\DuckLink\DuckCapture\QtScript4.dll

2014-08-21 06:48 - 2011-08-28 20:50 - 00581120 _____ () C:\Program Files\DuckLink\DuckCapture\QtScriptTools4.dll

2014-08-21 06:48 - 2011-11-03 20:20 - 00617984 _____ () C:\Program Files\DuckLink\DuckCapture\QxtGui.dll

2014-08-21 06:48 - 2011-11-03 20:21 - 00395264 _____ () C:\Program Files\DuckLink\DuckCapture\QxtCore.dll

2014-08-21 06:48 - 2011-08-28 20:51 - 00026624 _____ () C:\Program Files\DuckLink\DuckCapture\plugins\imageformats\qgif4.dll

2014-08-21 06:48 - 2011-08-28 20:51 - 00029184 _____ () C:\Program Files\DuckLink\DuckCapture\plugins\imageformats\qico4.dll

2014-08-21 06:48 - 2011-08-28 20:51 - 00200704 _____ () C:\Program Files\DuckLink\DuckCapture\plugins\imageformats\qjpeg4.dll

2014-10-21 18:22 - 2014-10-21 18:22 - 00750080 _____ () C:\Users\Home\AppData\Roaming\Dropbox\bin\libGLESv2.dll

2015-02-05 16:13 - 2015-02-05 16:13 - 00043008 _____ () c:\users\home\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpcudqlt.dll

2014-10-21 18:22 - 2014-10-21 18:22 - 00047616 _____ () C:\Users\Home\AppData\Roaming\Dropbox\bin\libEGL.dll

2014-10-21 18:22 - 2014-10-21 18:22 - 00863744 _____ () C:\Users\Home\AppData\Roaming\Dropbox\bin\plugins\platforms\qwindows.dll

2014-10-21 18:22 - 2014-10-21 18:22 - 00200704 _____ () C:\Users\Home\AppData\Roaming\Dropbox\bin\plugins\imageformats\qjpeg.dll

2015-02-03 20:10 - 2015-01-26 21:44 - 01117512 _____ () C:\Program Files\Google\Chrome\Application\40.0.2214.94\libglesv2.dll

2015-02-03 20:10 - 2015-01-26 21:44 - 00211272 _____ () C:\Program Files\Google\Chrome\Application\40.0.2214.94\libegl.dll

2015-02-03 20:10 - 2015-01-26 21:44 - 09171272 _____ () C:\Program Files\Google\Chrome\Application\40.0.2214.94\pdf.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfehidk => ""="Driver"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfehidk.sys => ""="Driver"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfevtp => ""="Driver"

==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)

==================== Other Registry Areas =====================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-4195104481-2079486966-316092486-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Home\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

==================== Accounts: =============================

Administrator (S-1-5-21-4195104481-2079486966-316092486-500 - Administrator - Disabled)

Guest (S-1-5-21-4195104481-2079486966-316092486-501 - Limited - Disabled)

Home (S-1-5-21-4195104481-2079486966-316092486-1000 - Administrator - Enabled) => C:\Users\Home

==================== Faulty Device Manager Devices =============

Name: Teredo Tunneling Pseudo-Interface

Description: Microsoft Teredo Tunneling Adapter

Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}

Manufacturer: Microsoft

Service: tunnel

Problem: : This device cannot start. (Code10)

Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.

On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.

Name: Lexmark X422

Description: Lexmark X422

Class Guid: {6bdd1fc6-810f-11d0-bec7-08002be2092f}

Manufacturer: Lexmark

Service: usbscan

Problem: : This device cannot start. (Code10)

Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.

On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.

==================== Event log errors: =========================

Application errors:

==================

Error: (02/05/2015 04:10:59 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/05/2015 02:30:54 PM) (Source: ConnectifySvc) (EventID: 0) (User: )

Description: ConnectifySvc error: 6Failed to SetServiceStatus

Error: (02/05/2015 08:14:49 AM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/05/2015 07:28:14 AM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledSPRetry 2506889

Error: (02/05/2015 07:28:14 AM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledEvent 2506889

Error: (02/05/2015 07:28:14 AM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: Continuously busy for more than a second

Error: (02/05/2015 07:28:13 AM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledSPRetry 2505875

Error: (02/05/2015 07:28:13 AM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledEvent 2505875

Error: (02/05/2015 07:28:13 AM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: Continuously busy for more than a second

Error: (02/05/2015 07:28:12 AM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledSPRetry 2504861

System errors:

=============

Error: (02/05/2015 04:10:32 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: The AVG WatchDog service failed to start due to the following error:

%%2

Error: (02/05/2015 04:10:00 PM) (Source: volsnap) (EventID: 36) (User: )

Description: The shadow copies of volume C: were aborted because the shadow copy storage could not grow due to a user imposed limit.

Error: (02/05/2015 08:14:35 AM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: The AVG WatchDog service failed to start due to the following error:

%%2

Error: (02/05/2015 08:11:21 AM) (Source: DCOM) (EventID: 10010) (User: )

Description: {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}

Error: (02/05/2015 07:29:27 AM) (Source: bScsiSDx) (EventID: 15) (User: )

Description: The device, \Device\Scsi\bScsiSDx1, is not ready for access yet.

Error: (02/05/2015 07:29:07 AM) (Source: bScsiSDx) (EventID: 15) (User: )

Description: The device, \Device\Scsi\bScsiSDx1, is not ready for access yet.

Error: (02/05/2015 07:28:47 AM) (Source: bScsiSDx) (EventID: 15) (User: )

Description: The device, \Device\Scsi\bScsiSDx1, is not ready for access yet.

Error: (02/05/2015 07:28:12 AM) (Source: Service Control Manager) (EventID: 7011) (User: )

Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the LanmanServer service.

Error: (02/05/2015 06:46:49 AM) (Source: Disk) (EventID: 11) (User: )

Description: The driver detected a controller error on \Device\Harddisk1\DR3.

Error: (02/04/2015 11:23:05 PM) (Source: DCOM) (EventID: 10000) (User: )

Description: C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}8{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}

Microsoft Office Sessions:

=========================