malignant Posted May 14, 2015 ID:962614 Share Posted May 14, 2015 Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 14-05-2015 02Ran by David (administrator) on DAVIDASUSULTRA on 14-05-2015 16:42:01Running from C:\Users\David\DesktopLoaded Profiles: David (Available profiles: David)Platform: Windows 8.1 (X64) OS Language: English (United States)Internet Explorer Version 11 (Default browser: IE)Boot Mode: NormalTutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (Check Point Software Technologies Ltd.) C:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exe(Avast Software s.r.o.) C:\Program Files\AVAST Software\Avast\AvastSvc.exe(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe(Microsoft Corporation) C:\Windows\System32\dasHost.exe(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe(ASUS) C:\Program Files (x86)\ASUS\ASUS InstantOn\InsOnSrv.exe(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe(Intel® Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\FWService\IntelMeFWService.exe(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\Jhi_service.exe(Garmin Ltd or its subsidiaries) C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe(ASUS) C:\Program Files (x86)\ASUS\ASUS InstantOn\InsOnWMI.exe(Microsoft Corporation) C:\Windows\System32\InputMethod\JPN\JpnIME.exe(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office15\ONENOTEM.EXE(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe(Avast Software s.r.o.) C:\Program Files\AVAST Software\Avast\avastui.exe(Check Point Software Technologies Ltd.) C:\Program Files (x86)\CheckPoint\ZoneAlarm\zatray.exe(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe(CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe(Microsoft Corporation) C:\Windows\System32\dllhost.exe(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\42.0.2311.135\nacl64.exe(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\42.0.2311.135\nacl64.exe(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office15\POWERPNT.EXE(Microsoft Corporation) C:\Windows\System32\SppExtComObj.Exe(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.26.9\GoogleCrashHandler.exe(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.26.9\GoogleCrashHandler64.exe(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5515496 2015-05-11] (Avast Software s.r.o.)HKLM-x32\...\Run: [ZoneAlarm] => C:\Program Files (x86)\CheckPoint\ZoneAlarm\zatray.exe [137352 2014-05-30] (Check Point Software Technologies Ltd.)HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1022152 2014-12-19] (Adobe Systems Incorporated)Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)HKU\S-1-5-21-1747770994-1414608345-870757575-1001\...\Run: [GoogleChromeAutoLaunch_9A83AADA066CCEA6F8C613E0AB5C7E19] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [812872 2015-04-27] (Google Inc.)HKU\S-1-5-21-1747770994-1414608345-870757575-1001\...\MountPoints2: {c6c8ecbb-aa6b-11e3-be7d-74d02b6fcae9} - "D:\VZW_Software_upgrade_assistant.exe" Startup: C:\Users\David\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Send to OneNote.lnk [2014-06-26]ShortcutTarget: Send to OneNote.lnk -> C:\Program Files (x86)\Microsoft Office\Office15\ONENOTEM.EXE (Microsoft Corporation)ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2015-04-22] (Avast Software s.r.o.)ShellIconOverlayIdentifiers: [AsusWSShellExt_B] -> {6D4133E5-0742-4ADC-8A8C-9303440F7190} => C:\Program Files (x86)\ASUS\WebStorage Sync Agent\1.1.10.123\ASUSWSShellExt64.dll [2012-03-13] (ASUS Cloud Corporation.)ShellIconOverlayIdentifiers: [AsusWSShellExt_O] -> {64174815-8D98-4CE6-8646-4C039977D808} => C:\Program Files (x86)\ASUS\WebStorage Sync Agent\1.1.10.123\ASUSWSShellExt64.dll [2012-03-13] (ASUS Cloud Corporation.)ShellIconOverlayIdentifiers: [AsusWSShellExt_U] -> {1C5AB7B1-0B38-4EC4-9093-7FD277E2AF4D} => C:\Program Files (x86)\ASUS\WebStorage Sync Agent\1.1.10.123\ASUSWSShellExt64.dll [2012-03-13] (ASUS Cloud Corporation.) ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTIONHKU\S-1-5-21-1747770994-1414608345-870757575-1001\Software\Microsoft\Internet Explorer\Main,Start Page = http://asus13.msn.comHKU\S-1-5-21-1747770994-1414608345-870757575-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://asus13.msn.comSearchScopes: HKU\S-1-5-21-1747770994-1414608345-870757575-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-21-1747770994-1414608345-870757575-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2015-03-10] (Microsoft Corporation)BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2015-03-26] (Avast Software s.r.o.)BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2015-03-10] (Microsoft Corporation)BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll [2015-03-31] (Microsoft Corporation)BHO-x32: Java Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\ssv.dll [2015-04-22] (Oracle Corporation)BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2015-03-26] (Avast Software s.r.o.)BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL [2015-03-18] (Microsoft Corporation)BHO-x32: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-04-22] (Oracle Corporation)Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 FireFox:========FF ProfilePath: C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\fr4529fs.defaultFF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-10-30] ()FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll [2012-06-06] (Intel Corporation)FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2012-06-06] (Intel Corporation)FF Plugin-x32: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-04-22] (Oracle Corporation)FF Plugin-x32: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-04-22] (Oracle Corporation)FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2015-03-31] (Microsoft Corporation)FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2014-03-11] (Microsoft Corporation)FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-09-12] (Microsoft Corporation)FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-06] (Google Inc.)FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-06] (Google Inc.)FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-05-01] (Adobe Systems Inc.)FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll [2015-03-31] (Microsoft Corporation)FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2015-05-01] (Adobe Systems Inc.)FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FFFF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-06-25] Chrome: =======CHR HomePage: Default -> hxxp://search.yahoo.com?type=198484&fr=spigot-yhp-chCHR Profile: C:\Users\David\AppData\Local\Google\Chrome\User Data\DefaultCHR Extension: (Google Docs) - C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-02-17]CHR Extension: (Google Drive) - C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-02-17]CHR Extension: (YouTube) - C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-02-17]CHR Extension: (HelloFax: 50 Free Fax Pages) - C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Extensions\bocmleclimfnadgmcdgecijlblfcmfnm [2014-03-24]CHR Extension: (Google Search) - C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-02-17]CHR Extension: (Google Calendar) - C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejjicmeblgpmajnghnpcppodonldlgfn [2015-05-04]CHR Extension: (Box) - C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejnkaeblpdcamcioiiabclakabcbjmbl [2015-05-04]CHR Extension: (Pandora) - C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbangkleohkafngihneedemihgfeikcl [2015-05-04]CHR Extension: (AdBlock) - C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2015-02-07]CHR Extension: (Bookmark Manager) - C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Extensions\gmlllbghnfkpflemihljekbapjopfjik [2015-04-21]CHR Extension: (Avast Online Security) - C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2014-06-25]CHR Extension: (Google Keep - notes and lists) - C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Extensions\hmjkmjkepdijhoojdojkdfohbdgmmhki [2015-05-04]CHR Extension: (Chrome Hotword Shared Module) - C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-12]CHR Extension: (Pocket) - C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Extensions\mjcnijlhddpbdemagnpefmlkjdagkogk [2015-05-04]CHR Extension: (Google Wallet) - C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-02-17]CHR Extension: (Gmail) - C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-02-17]CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-03-18] ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R3 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77128 2015-01-19] (Apple Inc.)R3 ASUS InstantOn; C:\Program Files (x86)\ASUS\ASUS InstantOn\InsOnSrv.exe [277120 2012-04-13] (ASUS)R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [343336 2015-04-22] (Avast Software s.r.o.)S3 BthHFSrv; C:\Windows\System32\BthHFSrv.dll [324608 2014-10-28] (Microsoft Corporation)R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2719928 2015-04-22] (Microsoft Corporation)R3 Garmin Core Update Service; C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe [451416 2014-12-31] (Garmin Ltd or its subsidiaries)R3 Intel® ME Service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\FWService\IntelMeFWService.exe [129856 2012-06-27] (Intel Corporation)R3 jhi_service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [166720 2012-06-25] (Intel Corporation)R2 vsmon; C:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exe [3592120 2014-05-30] (Check Point Software Technologies Ltd.)S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366520 2015-02-03] (Microsoft Corporation)S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2015-02-03] (Microsoft Corporation)S3 ZAPrivacyService; C:\Program Files (x86)\CheckPoint\ZoneAlarm\ZAPrivacyService.exe [90936 2014-05-29] (Check Point Software Technologies, Ltd.)U4 AvastVBoxSvc; "C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe" [X] ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29168 2015-04-22] ()R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [89944 2015-04-22] (Avast Software s.r.o.)R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93528 2015-04-22] (Avast Software s.r.o.)R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65736 2015-04-22] ()R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1047320 2015-04-22] (Avast Software s.r.o.)R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [442264 2015-04-22] (Avast Software s.r.o.)R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [137288 2015-04-22] (Avast Software s.r.o.)R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [272248 2015-04-22] ()R3 ATP; C:\Windows\System32\drivers\AsusTP.sys [62848 2012-11-20] (ASUS Corporation)S3 dot4; C:\Windows\system32\DRIVERS\Dot4.sys [151968 2012-10-19] (Windows ® Win 7 DDK provider)S3 Dot4Print; C:\Windows\System32\drivers\Dot4Prt.sys [27040 2012-10-19] (Windows ® Win 7 DDK provider)R3 kbfiltr; C:\Windows\System32\drivers\kbfiltr.sys [14992 2012-08-01] ( )R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [129752 2015-05-14] (Malwarebytes Corporation)R1 Vsdatant; C:\Windows\System32\drivers\vsdatant.sys [450968 2014-05-30] (Check Point Software Technologies Ltd.)S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2015-02-03] (Microsoft Corporation)U4 VBoxAswDrv; \??\C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2015-05-14 16:42 - 2015-05-14 16:42 - 00018030 _____ () C:\Users\David\Desktop\FRST.txt2015-05-14 16:41 - 2015-05-14 16:42 - 00000000 ____D () C:\FRST2015-05-14 16:40 - 2015-05-14 16:40 - 02106368 _____ (Farbar) C:\Users\David\Desktop\FRST64.exe2015-05-04 13:27 - 2015-05-04 13:27 - 00002321 _____ () C:\Users\David\Desktop\Chrome App Launcher.lnk2015-05-04 13:27 - 2015-05-04 13:27 - 00000000 ____D () C:\Users\David\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome2015-05-03 15:37 - 2015-04-22 15:33 - 00272296 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\javaws.exe2015-05-03 15:37 - 2015-04-22 15:33 - 00191400 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\javaw.exe2015-05-03 15:37 - 2015-04-22 15:33 - 00190888 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\java.exe2015-05-03 15:36 - 2015-04-22 15:33 - 00098216 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\WindowsAccessBridge-32.dll2015-04-22 20:37 - 2015-04-22 20:37 - 00001096 _____ () C:\Users\David\Desktop\mcat2015-content - Shortcut.lnk2015-04-22 15:10 - 2015-04-22 15:10 - 00364472 _____ (Avast Software s.r.o.) C:\WINDOWS\system32\aswBoot.exe2015-04-22 15:10 - 2015-04-22 15:10 - 00043112 _____ (Avast Software s.r.o.) C:\WINDOWS\avastSS.scr2015-04-16 10:00 - 2015-04-16 10:00 - 00000000 ____D () C:\Users\Default\AppData\Roaming\Apple Computer2015-04-16 10:00 - 2015-04-16 10:00 - 00000000 ____D () C:\Users\Default\AppData\Local\Power2Go2015-04-16 10:00 - 2015-04-16 10:00 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\Apple Computer2015-04-16 10:00 - 2015-04-16 10:00 - 00000000 ____D () C:\Users\Default User\AppData\Local\Power2Go2015-04-16 08:00 - 2015-04-16 08:00 - 00045056 _____ () C:\WINDOWS\SysWOW64\acovcnt.exe2015-04-14 12:06 - 2015-04-14 12:06 - 00000000 ____D () C:\WINDOWS\system32\appraiser2015-04-14 11:19 - 2015-03-23 14:59 - 07476032 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe2015-04-14 11:19 - 2015-03-23 14:59 - 01733952 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll2015-04-14 11:19 - 2015-03-23 14:59 - 00360480 _____ (Microsoft Corporation) C:\WINDOWS\system32\sechost.dll2015-04-14 11:19 - 2015-03-23 14:58 - 01498872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll2015-04-14 11:19 - 2015-03-23 14:45 - 00257216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sechost.dll2015-04-14 11:19 - 2015-03-19 21:12 - 00246272 _____ (Microsoft Corporation) C:\WINDOWS\system32\microsoft-windows-system-events.dll2015-04-14 11:19 - 2015-03-19 21:10 - 00285184 _____ (Microsoft Corporation) C:\WINDOWS\system32\wow64.dll2015-04-14 11:19 - 2015-03-19 21:10 - 00013312 _____ (Microsoft Corporation) C:\WINDOWS\system32\wow64cpu.dll2015-04-14 11:19 - 2015-03-19 20:17 - 00411648 _____ (Microsoft Corporation) C:\WINDOWS\system32\tracerpt.exe2015-04-14 11:19 - 2015-03-19 19:41 - 00369152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tracerpt.exe2015-04-14 11:19 - 2015-03-19 19:40 - 00950784 _____ (Microsoft Corporation) C:\WINDOWS\system32\tdh.dll2015-04-14 11:19 - 2015-03-19 19:16 - 00749568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tdh.dll2015-04-14 11:19 - 2015-03-14 01:20 - 01385256 _____ (Microsoft Corporation) C:\WINDOWS\system32\msctf.dll2015-04-14 11:19 - 2015-03-14 01:13 - 01124352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msctf.dll2015-04-14 11:19 - 2015-03-12 19:58 - 00259072 _____ (Microsoft Corporation) C:\WINDOWS\system32\pku2u.dll2015-04-14 11:19 - 2015-03-12 19:37 - 00208896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\pku2u.dll2015-04-14 11:19 - 2015-02-20 16:49 - 00780800 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsm.dll2015-04-14 11:18 - 2015-03-22 15:45 - 00227328 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepdu.dll2015-04-14 11:18 - 2015-03-22 15:09 - 01111552 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll2015-04-14 11:18 - 2015-03-22 15:09 - 00957440 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll2015-04-14 11:18 - 2015-03-22 15:09 - 00769024 _____ (Microsoft Corporation) C:\WINDOWS\system32\invagent.dll2015-04-14 11:18 - 2015-03-22 15:09 - 00726528 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll2015-04-14 11:18 - 2015-03-22 15:09 - 00419328 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll2015-04-14 11:18 - 2015-03-22 15:09 - 00030720 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll2015-04-14 11:18 - 2015-03-14 01:54 - 00133256 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe2015-04-14 11:18 - 2015-03-13 18:56 - 00066048 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups.dll2015-04-14 11:18 - 2015-03-13 18:56 - 00052224 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups2.dll2015-04-14 11:18 - 2015-03-13 18:51 - 00015360 _____ (Microsoft Corporation) C:\WINDOWS\system32\wu.upgrade.ps.dll2015-04-14 11:18 - 2015-03-13 18:37 - 00267264 _____ (Microsoft Corporation) C:\WINDOWS\system32\WinSetupUI.dll2015-04-14 11:18 - 2015-03-13 18:14 - 00027136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wups.dll2015-04-14 11:18 - 2015-03-13 17:22 - 03678720 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll2015-04-14 11:18 - 2015-03-13 17:12 - 00140288 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuwebv.dll2015-04-14 11:18 - 2015-03-13 17:12 - 00035840 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapp.exe2015-04-14 11:18 - 2015-03-13 17:09 - 00200192 _____ (Microsoft Corporation) C:\WINDOWS\system32\storewuauth.dll2015-04-14 11:18 - 2015-03-13 17:08 - 00408064 _____ (Microsoft Corporation) C:\WINDOWS\system32\WUSettingsProvider.dll2015-04-14 11:18 - 2015-03-13 17:08 - 00095744 _____ (Microsoft Corporation) C:\WINDOWS\system32\wudriver.dll2015-04-14 11:18 - 2015-03-13 17:06 - 02373632 _____ (Microsoft Corporation) C:\WINDOWS\system32\wucltux.dll2015-04-14 11:18 - 2015-03-13 17:06 - 00891392 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll2015-04-14 11:18 - 2015-03-13 17:02 - 00124928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuwebv.dll2015-04-14 11:18 - 2015-03-13 17:02 - 00029696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapp.exe2015-04-14 11:18 - 2015-03-13 16:59 - 00721920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll2015-04-14 11:18 - 2015-03-13 16:59 - 00081920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wudriver.dll2015-04-14 11:18 - 2015-03-12 21:32 - 24980480 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll2015-04-14 11:18 - 2015-03-12 21:08 - 00584192 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll2015-04-14 11:18 - 2015-03-12 21:07 - 02886144 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll2015-04-14 11:18 - 2015-03-12 20:53 - 00816128 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll2015-04-14 11:18 - 2015-03-12 20:50 - 06025216 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll2015-04-14 11:18 - 2015-03-12 20:42 - 19695616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll2015-04-14 11:18 - 2015-03-12 20:28 - 00503296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll2015-04-14 11:18 - 2015-03-12 20:26 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll2015-04-14 11:18 - 2015-03-12 20:22 - 02278400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll2015-04-14 11:18 - 2015-03-12 20:17 - 01032704 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll2015-04-14 11:18 - 2015-03-12 20:16 - 00664064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll2015-04-14 11:18 - 2015-03-12 20:08 - 00720384 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe2015-04-14 11:18 - 2015-03-12 20:07 - 00801280 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll2015-04-14 11:18 - 2015-03-12 20:00 - 14397440 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll2015-04-14 11:18 - 2015-03-12 19:50 - 00880128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll2015-04-14 11:18 - 2015-03-12 19:49 - 04305408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll2015-04-14 11:18 - 2015-03-12 19:45 - 02358784 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll2015-04-14 11:18 - 2015-03-12 19:44 - 00689152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll2015-04-14 11:18 - 2015-03-12 19:34 - 12825600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll2015-04-14 11:18 - 2015-03-12 19:33 - 01548288 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll2015-04-14 11:18 - 2015-03-12 19:22 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll2015-04-14 11:18 - 2015-03-12 19:20 - 01888256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll2015-04-14 11:18 - 2015-03-12 19:16 - 01311232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll2015-04-14 11:18 - 2015-03-12 19:14 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll2015-04-14 11:18 - 2015-03-04 03:25 - 00377152 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\clfs.sys2015-04-14 11:18 - 2015-03-03 20:04 - 00075264 _____ (Microsoft Corporation) C:\WINDOWS\system32\clfsw32.dll2015-04-14 11:18 - 2015-03-03 19:19 - 00058880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\clfsw32.dll2015-04-14 11:18 - 2015-02-24 01:32 - 00991552 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\http.sys2015-04-14 11:18 - 2014-12-02 16:09 - 00192000 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepic.dll ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2015-05-14 16:07 - 2014-02-17 17:31 - 00000936 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job2015-05-14 16:02 - 2013-08-22 08:36 - 00000000 ____D () C:\WINDOWS\system32\sru2015-05-14 15:49 - 2014-03-25 02:49 - 01377846 _____ () C:\WINDOWS\WindowsUpdate.log2015-05-14 15:44 - 2014-06-25 22:17 - 00129752 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys2015-05-14 15:29 - 2015-03-31 08:48 - 00000000 ____D () C:\Users\David\Desktop\Biochem22015-05-14 15:22 - 2012-07-26 00:59 - 00000000 ____D () C:\WINDOWS\CbsTemp2015-05-14 14:14 - 2014-04-03 22:54 - 00003950 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{1E0882DB-89F2-4FA9-8F72-09CFCFB90381}2015-05-14 14:14 - 2014-02-17 16:23 - 00003596 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1747770994-1414608345-870757575-10012015-05-14 14:09 - 2013-08-22 08:36 - 00000000 ____D () C:\WINDOWS\AppReadiness2015-05-14 13:52 - 2014-03-25 07:07 - 00000000 ___DO () C:\Users\David\SkyDrive2015-05-14 08:56 - 2014-02-17 16:15 - 00000000 ____D () C:\Users\David\AppData\Local\Packages2015-05-14 08:48 - 2015-01-26 22:38 - 00000344 _____ () C:\WINDOWS\lgfwup.ini2015-05-14 08:48 - 2015-01-26 22:38 - 00000000 ____D () C:\Program Files (x86)\lg_fwupdate2015-05-14 08:11 - 2014-06-12 20:45 - 00002457 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk2015-05-14 08:07 - 2014-06-25 22:07 - 00004182 _____ () C:\WINDOWS\System32\Tasks\avast! Emergency Update2015-05-14 08:07 - 2014-02-17 16:20 - 00000507 _____ () C:\Users\David\AppData\Roaming\sp_data.sys2015-05-14 08:04 - 2013-11-14 00:20 - 00126188 _____ () C:\WINDOWS\PFRO.log2015-05-14 08:04 - 2013-08-22 07:46 - 00323422 _____ () C:\WINDOWS\setupact.log2015-05-14 08:04 - 2013-08-22 07:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT2015-05-13 19:19 - 2013-08-22 06:25 - 00524288 ___SH () C:\WINDOWS\system32\config\BBI2015-05-13 19:17 - 2014-04-09 11:14 - 00000000 ____D () C:\ProgramData\Microsoft Help2015-05-12 14:43 - 2015-04-12 14:14 - 00004998 _____ () C:\WINDOWS\System32\Tasks\Microsoft Office 15 Sync Maintenance for DAVIDASUSULTRA-David DavidAsusUltra2015-05-07 08:03 - 2014-09-12 22:40 - 00032768 ___SH () C:\Users\David\Desktop\Thumbs.db2015-05-05 17:36 - 2013-04-21 03:51 - 00003367 _____ () C:\WINDOWS\system32\ServiceFilter.ini2015-05-05 10:44 - 2014-02-21 19:06 - 00000000 ____D () C:\Program Files\Microsoft Office 152015-05-05 08:02 - 2015-03-31 08:48 - 00000000 ____D () C:\Users\David\Desktop\Calc22015-05-04 11:52 - 2014-10-05 19:48 - 00000000 ____D () C:\Users\David\Desktop\David2015-05-04 11:52 - 2014-09-11 17:34 - 00000000 ____D () C:\Users\David\Desktop\MCAT2015-05-03 15:43 - 2014-10-05 20:04 - 00000000 ____D () C:\Users\David\Documents\Outlook Files2015-05-03 15:37 - 2015-01-25 17:33 - 00000000 ____D () C:\Program Files (x86)\Java2015-04-22 15:35 - 2014-04-09 10:56 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 20132015-04-22 15:10 - 2014-06-25 22:07 - 01047320 _____ (Avast Software s.r.o.) C:\WINDOWS\system32\Drivers\aswSnx.sys2015-04-22 15:10 - 2014-06-25 22:07 - 00442264 _____ (Avast Software s.r.o.) C:\WINDOWS\system32\Drivers\aswSP.sys2015-04-22 15:10 - 2014-06-25 22:07 - 00272248 _____ () C:\WINDOWS\system32\Drivers\aswVmm.sys2015-04-22 15:10 - 2014-06-25 22:07 - 00137288 _____ (Avast Software s.r.o.) C:\WINDOWS\system32\Drivers\aswStm.sys2015-04-22 15:10 - 2014-06-25 22:07 - 00093528 _____ (Avast Software s.r.o.) C:\WINDOWS\system32\Drivers\aswRdr2.sys2015-04-22 15:10 - 2014-06-25 22:07 - 00089944 _____ (Avast Software s.r.o.) C:\WINDOWS\system32\Drivers\aswMonFlt.sys2015-04-22 15:10 - 2014-06-25 22:07 - 00065736 _____ () C:\WINDOWS\system32\Drivers\aswRvrt.sys2015-04-22 15:10 - 2014-06-25 22:07 - 00029168 _____ () C:\WINDOWS\system32\Drivers\aswHwid.sys2015-04-19 13:23 - 2013-08-22 08:36 - 00000000 ____D () C:\WINDOWS\AppCompat2015-04-17 17:40 - 2014-03-12 21:49 - 01227264 ___SH () C:\Users\David\Downloads\Thumbs.db2015-04-17 14:55 - 2013-08-22 08:36 - 00000000 ____D () C:\WINDOWS\rescache2015-04-17 14:27 - 2012-07-25 22:26 - 00000199 _____ () C:\WINDOWS\win.ini2015-04-16 18:47 - 2014-02-17 17:31 - 00000932 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job2015-04-16 18:46 - 2014-12-29 14:58 - 00003886 _____ () C:\WINDOWS\System32\Tasks\Adobe Acrobat Update Task2015-04-16 09:59 - 2014-02-17 17:31 - 00003674 _____ () C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore2015-04-16 09:59 - 2013-04-21 03:42 - 00003056 _____ () C:\WINDOWS\System32\Tasks\ASUS P4G2015-04-16 09:59 - 2013-04-21 03:36 - 00003542 _____ () C:\WINDOWS\System32\Tasks\ASUS Touchpad Launcher (x64)2015-04-16 09:49 - 2013-04-21 03:43 - 00003114 _____ () C:\WINDOWS\System32\Tasks\ASUS Live Update2015-04-14 12:06 - 2015-03-11 23:02 - 00000000 ___SD () C:\WINDOWS\system32\CompatTel2015-04-14 12:05 - 2014-02-22 00:03 - 00000000 ____D () C:\WINDOWS\system32\MRT2015-04-14 11:53 - 2014-02-22 00:03 - 128913832 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe ==================== Files in the root of some directories ======= 2014-02-17 16:20 - 2015-05-14 08:07 - 0000507 _____ () C:\Users\David\AppData\Roaming\sp_data.sys2012-11-23 09:32 - 2012-09-07 04:40 - 0000256 _____ () C:\ProgramData\SetStretch.cmd2012-11-23 09:32 - 2009-07-22 03:04 - 0024576 _____ () C:\ProgramData\SetStretch.exe2012-11-23 09:32 - 2012-09-07 04:37 - 0000103 _____ () C:\ProgramData\SetStretch.VBS Files to move or delete:====================C:\ProgramData\SetStretch.exeC:\ProgramData\SetStretch.VBS Some content of TEMP:====================C:\Users\David\AppData\Local\Temp\jre-7u65-windows-i586-iftw.exeC:\Users\David\AppData\Local\Temp\jre-8u40-windows-au.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signedC:\Windows\System32\wininit.exe => File is digitally signedC:\Windows\explorer.exe => File is digitally signedC:\Windows\SysWOW64\explorer.exe => File is digitally signedC:\Windows\System32\svchost.exe => File is digitally signedC:\Windows\SysWOW64\svchost.exe => File is digitally signedC:\Windows\System32\services.exe => File is digitally signedC:\Windows\System32\User32.dll => File is digitally signedC:\Windows\SysWOW64\User32.dll => File is digitally signedC:\Windows\System32\userinit.exe => File is digitally signedC:\Windows\SysWOW64\userinit.exe => File is digitally signedC:\Windows\System32\rpcss.dll => File is digitally signedC:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2015-05-13 19:12 ==================== End Of Log ============================ Additional scan result of Farbar Recovery Scan Tool (x64) Version: 14-05-2015 02Ran by David at 2015-05-14 16:43:42Running from C:\Users\David\DesktopBoot Mode: Normal========================================================== ==================== Accounts: ============================= Administrator (S-1-5-21-1747770994-1414608345-870757575-500 - Administrator - Disabled)David (S-1-5-21-1747770994-1414608345-870757575-1001 - Administrator - Enabled) => C:\Users\DavidGuest (S-1-5-21-1747770994-1414608345-870757575-501 - Limited - Disabled)HomeGroupUser$ (S-1-5-21-1747770994-1414608345-870757575-1005 - Limited - Enabled) ==================== Security Center ======================== (If an entry is included in the fixlist, it will be removed.) AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}FW: ZoneAlarm Free Firewall Firewall (Enabled) {1B8D532F-88B1-B2AD-ED22-AED92687A1D2} ==================== Installed Programs ====================== (Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.) Adobe Reader XI (11.0.11) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.11 - Adobe Systems Incorporated)ANT Drivers Installer x64 (Version: 2.3.4 - Garmin Ltd or its subsidiaries) HiddenApple Application Support (32-bit) (HKLM-x32\...\{AFA1153A-F547-409B-B837-3A0D6C5A3FEC}) (Version: 3.1.3 - Apple Inc.)Apple Application Support (64-bit) (HKLM\...\{D7B824DE-DA32-4772-9E5E-39C5158136A7}) (Version: 3.1.3 - Apple Inc.)Apple Mobile Device Support (HKLM\...\{C4123106-B685-48E6-B9BD-E4F911841EB4}) (Version: 8.1.1.3 - Apple Inc.)Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)ASUS Instant Connect (HKLM-x32\...\{89ECB85A-D933-4CEA-9116-5CBC9C2ED95B}) (Version: 1.2.8 - ASUS)ASUS InstantOn (HKLM-x32\...\{749F674B-2674-47E8-879C-5626A06B2A91}) (Version: 3.0.4 - ASUS)ASUS LifeFrame3 (HKLM-x32\...\{1DBD1F12-ED93-49C0-A7CC-56CBDE488158}) (Version: 3.1.9 - ASUS)ASUS Live Update (HKLM-x32\...\{FA540E67-095C-4A1B-97BA-4D547DEC9AF4}) (Version: 3.1.9 - ASUS)ASUS Power4Gear Hybrid (HKLM\...\{9B6239BF-4E85-4590-8D72-51E30DB1A9AA}) (Version: 2.0.4 - ASUS)ASUS Smart Gesture (HKLM-x32\...\{4D3286A6-F6AB-498A-82A4-E4F040529F3D}) (Version: 1.0.36 - ASUS)ASUS Splendid Video Enhancement Technology (HKLM-x32\...\{0969AF05-4FF6-4C00-9406-43599238DE0D}) (Version: 1.03.0004 - ASUS)ASUS Tutor (HKLM-x32\...\{58172D66-2F69-4215-9AEC-ED8196023736}) (Version: 1.0.8 - ASUS)ASUS WebStorage Sync Agent (HKLM-x32\...\ASUS WebStorage) (Version: 1.1.10.123 - ASUS Cloud Corporation)ATK Package (HKLM-x32\...\{AB5C933E-5C7D-4D30-B314-9C83A49B94BE}) (Version: 1.0.0025 - ASUS)Avast Free Antivirus (HKLM-x32\...\Avast) (Version: 10.2.2218 - AVAST Software)Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)CyberLink Media Suite 10 (HKLM-x32\...\InstallShield_{8F14AA37-5193-4A14-BD5B-BDF9B361AEF7}) (Version: 10.0 - CyberLink Corp.)D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) HiddenElevated Installer (x32 Version: 3.2.27.0 - Garmin Ltd or its subsidiaries) HiddenGalería de fotos (x32 Version: 16.4.3505.0912 - Microsoft Corporation) HiddenGalerie de photos (x32 Version: 16.4.3505.0912 - Microsoft Corporation) HiddenGarmin Express (HKLM-x32\...\{855d8086-4275-4bd3-a7a8-b44da3a56d7a}) (Version: 3.2.27.0 - Garmin Ltd or its subsidiaries)Garmin Express (x32 Version: 3.2.27.0 - Garmin Ltd or its subsidiaries) HiddenGarmin Express Tray (x32 Version: 3.2.27.0 - Garmin Ltd or its subsidiaries) HiddenGoogle Chrome (HKLM-x32\...\Google Chrome) (Version: 42.0.2311.152 - Google Inc.)Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) HiddenGoogle Update Helper (x32 Version: 1.3.26.9 - Google Inc.) HiddenIntel® Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1252 - Intel Corporation)Intel® Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3308 - Intel Corporation)Intel® SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 2.0.0.37149 - Intel Corporation)InterActual Player (HKLM-x32\...\InterActual Player) (Version: - )iTunes (HKLM\...\{93F2A022-6C37-48B8-B241-FFABD9F60C30}) (Version: 12.1.2.27 - Apple Inc.)Java 7 Update 80 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217080FF}) (Version: 7.0.800 - Oracle)Java 8 Update 40 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218040F0}) (Version: 8.0.400 - Oracle Corporation)Java 8 Update 45 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218045F0}) (Version: 8.0.450 - Oracle Corporation)LG ODD Auto Firmware Update (HKLM-x32\...\{6179550A-3E7C-499E-BCC9-9E8113E0A285}) (Version: 10.01.0712.01 - )Malwarebytes Anti-Malware version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)Microsoft Office 365 - en-us (HKLM\...\O365HomePremRetail - en-us) (Version: 15.0.4711.1003 - Microsoft Corporation)Microsoft Office Professional Plus 2013 (HKLM-x32\...\Office15.PROPLUS) (Version: 15.0.4569.1506 - Microsoft Corporation)Microsoft OneDrive (HKU\S-1-5-21-1747770994-1414608345-870757575-1001\...\OneDriveSetup.exe) (Version: 17.0.4029.0217 - Microsoft Corporation)Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)Movie Maker (x32 Version: 16.4.3505.0912 - Microsoft Corporation) HiddenMozilla Firefox 34.0.5 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 34.0.5 (x86 en-US)) (Version: 34.0.5 - Mozilla)Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 34.0.5 - Mozilla)MyBitCast 2.0 (HKLM-x32\...\MyBitCast) (Version: 2.0 - ASUS)Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4711.1003 - Microsoft Corporation) HiddenOffice 15 Click-to-Run Licensing Component (Version: 15.0.4711.1003 - Microsoft Corporation) HiddenOffice 15 Click-to-Run Localization Component (x32 Version: 15.0.4711.1003 - Microsoft Corporation) HiddenOutils de vérification linguistique 2013 de Microsoft Office - Français (x32 Version: 15.0.4569.1506 - Microsoft Corporation) HiddenQualcomm Atheros Client Installation Program (HKLM-x32\...\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 10.0 - Qualcomm Atheros)Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.3.730.2012 - Realtek)Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6754 - Realtek Semiconductor Corp.)Realtek PCIE Card Reader (HKLM-x32\...\{C1594429-8296-4652-BF54-9DBE4932A44C}) (Version: 6.2.9200.27030 - Realtek Semiconductor Corp.)SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.24.999 - SAMSUNG Electronics Co., Ltd.)Service Pack 1 for Microsoft Office 2013 (KB2850036) 32-Bit Edition (HKLM-x32\...\{90150000-0011-0000-0000-0000000FF1CE}_Office15.PROPLUS_{7F6C4883-A18C-459A-82C1-A2F9403F2DA6}) (Version: - Microsoft)Shared C Run-time for x64 (HKLM\...\{EF79C448-6946-4D71-8134-03407888C054}) (Version: 10.0.0 - McAfee)Update for Japanese Microsoft IME Postal Code Dictionary (HKLM\...\{1B2C85A0-2B9E-4291-8B37-468D57503E98}) (Version: 16.0.1171.1 - Microsoft Corporation)Update for Japanese Microsoft IME Postal Code Dictionary (HKLM-x32\...\{15015752-9990-4516-A2B1-93823281FB8E}) (Version: 15.0.1759 - Microsoft Corporation)Update for Japanese Microsoft IME Standard Dictionary (HKLM\...\{5A1CD0BB-7E65-45DC-9A9A-682CE8B62AA4}) (Version: 16.0.1065.1 - Microsoft Corporation)Update for Japanese Microsoft IME Standard Dictionary (HKLM-x32\...\{7DB71278-9AD7-4480-AB08-8649C5010B17}) (Version: 15.0.1215 - Microsoft Corporation)Update for Japanese Microsoft IME Standard Extended Dictionary (HKLM-x32\...\{78CE66A9-85AF-4BD8-8FB7-35B5F3846C00}) (Version: 15.0.1215 - Microsoft Corporation)Update for Japanese Microsoft IME Trending Words Dictionary (HKLM\...\{B939BFEB-824F-4456-A4EE-2B86ED04033D}) (Version: 16.0.1016.1 - Microsoft Corporation)Update for Skype for Business 2015 (KB2889853) 32-Bit Edition (HKLM-x32\...\{90150000-012B-0409-0000-0000000FF1CE}_Office15.PROPLUS_{BF1B3F01-93F3-4B83-93DB-132EB1AED259}) (Version: - Microsoft)Verizon Wireless Software Upgrade Assistant - Samsung(ar) (HKLM-x32\...\{BB743020-0F2D-4E9B-922B-12014902B20F}) (Version: 2.14.0201 - Samsung Electronics Co., Ltd.)Verizon Wireless Software Utility Application for Android - Samsung (HKLM-x32\...\{041E914E-7B73-4E8B-967F-B7FFC527FF80}) (Version: 2.14.0106 - Samsung Electronics Co., Ltd.)Windows Driver Package - ASUS (ATP) Mouse (11/09/2012 1.0.0.153) (HKLM\...\5AB9160B769DD2E134ADCB8010377DECA2479378) (Version: 11/09/2012 1.0.0.153 - ASUS)Windows Driver Package - Dynastream Innovations, Inc. ANT LibUSB Drivers (04/11/2012 1.2.40.201) (HKLM\...\F9D2A789F9CFF8CEC36B544F53877C80F1F73C46) (Version: 04/11/2012 1.2.40.201 - Dynastream Innovations, Inc.)Windows Driver Package - Silicon Labs Software (DSI_SiUSBXp_3_1) USB (02/06/2007 3.1) (HKLM\...\D1506E0025B5A3F9EB8270FE81C1EEDD9388B8A2) (Version: 02/06/2007 3.1 - Silicon Labs Software)Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3505.0912 - Microsoft Corporation)WinFlash (HKLM-x32\...\{8F21291E-0444-4B1D-B9F9-4370A73E346D}) (Version: 2.41.1 - ASUS)YouCam (x32 Version: 3.1.5324 - CyberLink Corp.) HiddenZoneAlarm Firewall (x32 Version: 13.2.015.000 - Check Point Software Technologies Ltd.) HiddenZoneAlarm Free Firewall (HKLM-x32\...\ZoneAlarm Free Firewall) (Version: 13.2.015.000 - Check Point)ZoneAlarm Security (x32 Version: 13.2.015.000 - Check Point Software Technologies Ltd.) Hidden ==================== Custom CLSID (selected items): ========================== (If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.) CustomCLSID: HKU\S-1-5-21-1747770994-1414608345-870757575-1001_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32 -> C:\Users\David\AppData\Local\Microsoft\SkyDrive\17.0.4029.0217\amd64\SkyDriveShell64.dll (Microsoft Corporation)CustomCLSID: HKU\S-1-5-21-1747770994-1414608345-870757575-1001_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32 -> C:\Users\David\AppData\Local\Microsoft\SkyDrive\17.0.4029.0217\amd64\SkyDriveShell64.dll (Microsoft Corporation)CustomCLSID: HKU\S-1-5-21-1747770994-1414608345-870757575-1001_Classes\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32 -> C:\Users\David\AppData\Local\Microsoft\SkyDrive\17.0.4029.0217\amd64\SkyDriveShell64.dll (Microsoft Corporation)CustomCLSID: HKU\S-1-5-21-1747770994-1414608345-870757575-1001_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 -> C:\Users\David\AppData\Local\Microsoft\SkyDrive\17.0.4029.0217\amd64\SkyDriveShell64.dll (Microsoft Corporation)CustomCLSID: HKU\S-1-5-21-1747770994-1414608345-870757575-1001_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\David\AppData\Local\Microsoft\SkyDrive\17.0.4029.0217\amd64\FileSyncApi64.dll (Microsoft Corporation) ==================== Restore Points ========================= 22-04-2015 15:08:58 avast! antivirus system restore point29-04-2015 17:06:43 Scheduled Checkpoint12-05-2015 14:29:21 Scheduled Checkpoint ==================== Hosts content: ========================== (If needed Hosts: directive could be included in the fixlist to reset Hosts.) 2013-08-22 06:25 - 2013-08-22 06:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts ==================== Scheduled Tasks (Whitelisted) ============= (If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.) Task: {021D4D12-6101-4239-A1C9-D8ECA12D921A} - System32\Tasks\ASUS InstantOn Config => C:\Program Files (x86)\ASUS\ASUS InstantOn\InsOnCfg.exe [2012-09-24] (ASUS)Task: {1D294690-9F25-4ED1-8C29-DA361BC61B3A} - System32\Tasks\{B77FBB48-0E89-434C-8F1F-EBDFDD3347DD} => pcalua.exe -a "c:\program files\interactual\interactual player\iplayer.exe" -d D:\ -c -startup=autorunTask: {1D3A6E4B-D3C1-44AB-B921-9AAC79A35ADE} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxcontent => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-23] (Microsoft Corporation)Task: {24134B99-B6D4-42BC-A188-9297F31BA4BF} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-02-17] (Google Inc.)Task: {31E9BE53-E676-4F81-823D-96F0DFDA1CA6} - System32\Tasks\Microsoft Office 15 Sync Maintenance for DAVIDASUSULTRA-David DavidAsusUltra => C:\Program Files\Microsoft Office 15\root\Office15\MsoSync.exe [2015-03-10] (Microsoft Corporation)Task: {338BF46A-6867-4C08-8DB8-7B2DC6D5DE4E} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)Task: {38D69CA5-A11D-4004-B621-1DA5BAD77290} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)Task: {3ABFDD35-35CB-42C2-B98A-587EEA0BCDD5} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-23] (Microsoft Corporation)Task: {3C9AB71C-6546-4024-9E6C-F3A0019B6BAD} - System32\Tasks\ASUS P4G => C:\Program Files\ASUS\P4G\BatteryLife.exe [2012-08-24] (ASUS)Task: {437E278D-F28F-4488-A597-06F88703784F} - System32\Tasks\Microsoft\Windows\Setup\gwx\launchtrayprocess => C:\Windows\system32\GWX\GWX.exe [2015-03-23] (Microsoft Corporation)Task: {463FFB46-983C-4FA9-82BB-0FD660C8AFB3} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2015-04-14] (Microsoft Corporation)Task: {5D959CFA-E692-48A4-AF4A-1E758B8A0485} - System32\Tasks\Microsoft\Windows\Setup\gwx\runappraiser => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-23] (Microsoft Corporation)Task: {6064E6FD-9863-4B93-9ACA-6B0C696C22D8} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2015-04-22] (Avast Software s.r.o.)Task: {6199DE59-4FBA-4F20-9C3A-A625B99323D9} - System32\Tasks\GenericSettingsHandler\Windows-Credentials\RetrySyncTask_for_S-1-5-21-1747770994-1414608345-870757575-1001Task: {76A8DAAD-00FF-4E05-810E-B0C0313C11C3} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-22] (Microsoft Corporation)Task: {7FEBFCC3-85EC-4B43-89B1-C7D833F2F241} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-04-22] (Microsoft Corporation)Task: {8AF536A8-DB73-4FDB-AB76-EB0F84E40240} - System32\Tasks\MirageAgent => C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe [2012-06-14] (CyberLink)Task: {979A56A5-DE2D-4593-ACC2-1BA31B13A84A} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-22] (Microsoft Corporation)Task: {9CD0D86B-D659-436F-8A0A-7EF95D0D49B0} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exeTask: {AD8F3F0C-0837-4DA2-8F7F-453282F83DFF} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-04-22] (Microsoft Corporation)Task: {B2F5C936-36A1-4786-BDA3-3924777FA2A1} - System32\Tasks\ASUS Live Update => C:\Program Files (x86)\ASUS\ASUS Live Update\LiveUpdate.exe [2012-08-22] (ASUSTeK Computer Inc.)Task: {C6A70C7D-EE98-4A08-ADF4-27BCE150EF48} - System32\Tasks\ASUS Touchpad Launcher (x64) => C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPLauncher.exe [2012-11-20] (AsusTek)Task: {CCA169F0-F3C8-4F0D-98B3-F0D8EFD7262B} - System32\Tasks\GarminUpdaterTask => C:\Program Files (x86)\Garmin\Express Self Updater\ExpressSelfUpdater.exe [2014-12-31] ()Task: {F47235B6-13D4-4087-88CF-F0C8F06B6EB5} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-02-17] (Google Inc.)Task: {F705D006-F278-4937-A1BA-C4E6050FC346} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonx86\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe [2015-04-22] (Microsoft Corporation)Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exeTask: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe ==================== Loaded Modules (Whitelisted) ============== 2014-03-11 22:19 - 2014-05-20 09:19 - 00105640 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll2015-03-20 18:12 - 2015-03-20 18:12 - 00085832 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll2015-03-20 18:12 - 2015-03-20 18:12 - 01346344 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll2015-03-16 11:08 - 2015-01-27 08:29 - 08898720 _____ () C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\1033\GrooveIntlResource.dll2015-04-22 15:10 - 2015-04-22 15:10 - 00104400 _____ () C:\Program Files\AVAST Software\Avast\log.dll2015-04-22 15:10 - 2015-04-22 15:10 - 00081728 _____ () C:\Program Files\AVAST Software\Avast\JsonRpcServer.dll2015-05-13 19:05 - 2015-05-13 19:05 - 02927616 _____ () C:\Program Files\AVAST Software\Avast\defs\15051302\algo.dll2015-05-14 14:18 - 2015-05-14 14:18 - 02928128 _____ () C:\Program Files\AVAST Software\Avast\defs\15051401\algo.dll2015-03-18 14:08 - 2015-03-18 14:08 - 08898720 _____ () C:\Program Files (x86)\Microsoft Office\Office15\1033\GrooveIntlResource.dll2015-03-18 15:34 - 2015-03-18 15:34 - 40540672 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll2015-05-01 12:09 - 2015-04-27 19:07 - 01252680 _____ () C:\Program Files (x86)\Google\Chrome\Application\42.0.2311.135\libglesv2.dll2015-05-01 12:09 - 2015-04-27 19:07 - 00080712 _____ () C:\Program Files (x86)\Google\Chrome\Application\42.0.2311.135\libegl.dll2015-03-18 14:08 - 2015-03-18 14:08 - 01286312 _____ () C:\Program Files (x86)\Microsoft Office\Office15\PPRESOURCES.DLL ==================== Alternate Data Streams (Whitelisted) ========= (If an entry is included in the fixlist, only the Alternate Data Streams will be removed.) AlternateDataStreams: C:\Users\David\SkyDrive:ms-properties ==================== Safe Mode (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.) HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\vsmon => ""="Service" ==================== EXE Association (Whitelisted) =============== (If an entry is included in the fixlist, the default will be restored. None default entries will be removed.) ==================== Internet Explorer trusted/restricted =============== (If an entry is included in the fixlist, the associated entry will be removed from the registry.) ==================== Other Areas ============================ (Currently there is no automatic fix for this section.) HKU\S-1-5-21-1747770994-1414608345-870757575-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\David\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaperDNS Servers: 192.168.1.1 ==================== MSCONFIG/TASK MANAGER disabled items == (Currently there is no automatic fix for this section.) MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^SafeConnect.lnk => C:\WINDOWS\pss\SafeConnect.lnk.CommonStartupMSCONFIG\startupfolder: C:^Users^David^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Verizon Wireless Software Utility Application for Android – Samsung.lnk => C:\WINDOWS\pss\Verizon Wireless Software Utility Application for Android – Samsung.lnk.StartupMSCONFIG\startupreg: ACMON => C:\Program Files (x86)\ASUS\Splendid\ACMON.exeMSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"MSCONFIG\startupreg: Adobe Reader Speed Launcher => "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe"MSCONFIG\startupreg: ASUSPRP => "C:\Program Files (x86)\ASUS\APRP\APRP.EXE"MSCONFIG\startupreg: ASUSWebStorage => C:\Program Files (x86)\ASUS\WebStorage Sync Agent\1.1.10.123\AsusWSPanel.exe /SMSCONFIG\startupreg: AvastUI.exe => "C:\Program Files\AVAST Software\Avast\AvastUI.exe" /noguiMSCONFIG\startupreg: CLMLServer => "C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe"MSCONFIG\startupreg: DisableS3S4 => c:\windows\temp\DisableS3S464\sethigh.cmdMSCONFIG\startupreg: GarminExpressTrayApp => "C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe"MSCONFIG\startupreg: GoogleChromeAutoLaunch_9A83AADA066CCEA6F8C613E0AB5C7E19 => "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --no-startup-windowMSCONFIG\startupreg: HotKeysCmds => "C:\WINDOWS\system32\hkcmd.exe"MSCONFIG\startupreg: IgfxTray => "C:\WINDOWS\system32\igfxtray.exe"MSCONFIG\startupreg: iTunesHelper => "C:\Program Files\iTunes\iTunesHelper.exe"MSCONFIG\startupreg: LGODDFU => C:\Program Files (x86)\lg_fwupdate\lgfw.exe blrunMSCONFIG\startupreg: mcpltui_exe => "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkeyMSCONFIG\startupreg: mcui_exe => "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkeyMSCONFIG\startupreg: Persistence => "C:\WINDOWS\system32\igfxpers.exe"MSCONFIG\startupreg: RTHDVCPL => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -sMSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"MSCONFIG\startupreg: YouCam Mirage => "C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe"MSCONFIG\startupreg: YouCam Tray => "C:\Program Files (x86)\CyberLink\YouCam\YouCam.exe" /sMSCONFIG\startupreg: ZoneAlarm => "C:\Program Files (x86)\CheckPoint\ZoneAlarm\zatray.exe" ==================== FirewallRules (Whitelisted) =============== (If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.) FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139FirewallRules: [{E0BA1545-8191-4D31-BE14-C792174CD690}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\outlook.exeFirewallRules: [{B2760B90-C571-4867-9626-9CB6310BC511}] => (Allow) C:\Program Files\Common Files\mcafee\Platform\McSvcHost\McSvHost.exeFirewallRules: [{DEF7192E-6F61-478A-86D9-5943171B8066}] => (Allow) C:\Program Files\Common Files\mcafee\Platform\McSvcHost\McSvHost.exeFirewallRules: [{C58A8B59-48FA-4DA0-9FE6-91C9C912AD75}] => (Allow) LPort=1900FirewallRules: [{9F25673E-3DA9-4AF5-B8D3-22A598095E76}] => (Allow) LPort=2869FirewallRules: [{A8F6257E-29D4-4768-ADFC-01507E837D0C}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exeFirewallRules: [{87FB56BE-BF2F-4DD3-995C-68EE963A3E4E}] => (Allow) C:\Program Files (x86)\Microsoft Office\Office15\lync.exeFirewallRules: [{6731A76D-3472-4C78-8603-6C6AB83B8ECB}] => (Allow) C:\Program Files (x86)\Microsoft Office\Office15\lync.exeFirewallRules: [{1AD4E277-92AA-4CB1-A87B-9AB8509C3D2C}] => (Allow) C:\Program Files (x86)\Microsoft Office\Office15\UcMapi.exeFirewallRules: [{E8C673A4-9928-4081-AAB5-1D3B4E648594}] => (Allow) C:\Program Files (x86)\Microsoft Office\Office15\UcMapi.exeFirewallRules: [{A55DC664-8F0D-4E73-BF82-32A99C8D9040}] => (Allow) C:\Program Files (x86)\Microsoft Office\Office15\lync.exeFirewallRules: [{0C0807E8-43CD-4140-8BED-99412DF36D51}] => (Allow) C:\Program Files (x86)\Microsoft Office\Office15\lync.exeFirewallRules: [{7A0D435D-914B-4B7C-A3CE-95BF3E406CE5}] => (Allow) C:\Program Files (x86)\Microsoft Office\Office15\UcMapi.exeFirewallRules: [{FC92A0D4-CBBE-4F4F-874C-6B22CDCC0949}] => (Allow) C:\Program Files (x86)\Microsoft Office\Office15\UcMapi.exeFirewallRules: [{72F3A6B5-A8FE-4B3C-8BD2-9A05D1E17B20}] => (Allow) C:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exeFirewallRules: [{9D2BA8BD-9D98-4DC6-A478-6498348232FB}] => (Allow) C:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exeFirewallRules: [{6BEC5839-2199-480F-80D4-49F2FF0454DF}] => (Allow) C:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exeFirewallRules: [{1397E887-CB0C-497C-B037-D4D6BEA36777}] => (Allow) C:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exeFirewallRules: [{84394046-C210-429F-8B6F-2CE04C860A20}] => (Allow) C:\Program Files\AVAST Software\Avast\ng\vbox\aswFe.exeFirewallRules: [{CD6B538F-A6FD-40AF-ADF4-DFAAF5B6474D}] => (Allow) C:\Program Files\AVAST Software\Avast\ng\vbox\aswFe.exeFirewallRules: [{6E301D07-5189-4522-8191-F391998957D3}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exeFirewallRules: [{590D216A-9232-4AB9-8482-DF907BA2251B}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exeFirewallRules: [{F16A4BD4-9694-47DE-8F8B-ED4629F20E2C}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exeFirewallRules: [{35BC6C25-0FBB-41A0-98D9-F935ED080419}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exeFirewallRules: [{63832345-2BA7-4CE8-BC2D-53B9DFBA5E23}] => (Allow) C:\Program Files\iTunes\iTunes.exeFirewallRules: [{20E6889E-6A04-4F39-BD25-08E058D33782}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe ==================== Faulty Device Manager Devices ============= ==================== Event log errors: ========================= Application errors:==================Error: (05/14/2015 04:03:59 PM) (Source: Office 2013 Licensing Service) (EventID: 0) (User: )Description: Subscription licensing service failed: -1073418225 Error: (05/14/2015 02:45:30 PM) (Source: Application Hang) (EventID: 1002) (User: )Description: The program wwahost.exe version 6.3.9600.17415 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel. Process ID: 7b4 Start Time: 01d08e8e957890a6 Termination Time: 4294967295 Application Path: C:\WINDOWS\syswow64\wwahost.exe Report Id: 893e2567-fa82-11e4-bebb-74d02b6fcae9 Faulting package full name: Microsoft.SkypeApp_3.1.0.1007_x86__kzf8qxf38zg5c Faulting package-relative application ID: App Error: (05/14/2015 02:30:37 PM) (Source: Application Hang) (EventID: 1002) (User: )Description: The program wwahost.exe version 6.3.9600.17415 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel. Process ID: 4cc Start Time: 01d08e8c7d0fb53b Termination Time: 4294967295 Application Path: C:\WINDOWS\syswow64\wwahost.exe Report Id: 717c48f8-fa80-11e4-bebb-74d02b6fcae9 Faulting package full name: Microsoft.SkypeApp_3.1.0.1007_x86__kzf8qxf38zg5c Faulting package-relative application ID: App Error: (05/14/2015 08:10:35 AM) (Source: Application Hang) (EventID: 1002) (User: )Description: The program wwahost.exe version 6.3.9600.17415 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel. Process ID: f0c Start Time: 01d08e57639a6fac Termination Time: 4294967295 Application Path: C:\WINDOWS\syswow64\wwahost.exe Report Id: 585e0fb2-fa4b-11e4-bebb-74d02b6fcae9 Faulting package full name: Microsoft.SkypeApp_3.1.0.1007_x86__kzf8qxf38zg5c Faulting package-relative application ID: App Error: (05/14/2015 08:10:07 AM) (Source: MsiInstaller) (EventID: 1024) (User: DAVIDASUSULTRA)Description: Product: Adobe Reader XI (11.0.10) - Update '{AC76BA86-7AD7-0000-2550-7A8C40011011}' could not be installed. Error code 1625. Windows Installer can create logs to help troubleshoot issues with installing software packages. Use the following link for instructions on turning on logging support: http://go.microsoft.com/fwlink/?LinkId=23127 Error: (05/14/2015 08:08:20 AM) (Source: Application Error) (EventID: 1000) (User: )Description: Faulting application name: FBAgent.exe, version: 2.0.0.0, time stamp: 0x507bd9e8Faulting module name: ntdll.dll, version: 6.3.9600.17736, time stamp: 0x550f4336Exception code: 0xc0000374Fault offset: 0x00000000000f0f20Faulting process id: 0x570Faulting application start time: 0xFBAgent.exe0Faulting application path: FBAgent.exe1Faulting module path: FBAgent.exe2Report Id: FBAgent.exe3Faulting package full name: FBAgent.exe4Faulting package-relative application ID: FBAgent.exe5 Error: (05/13/2015 07:13:23 PM) (Source: SideBySide) (EventID: 35) (User: )Description: Activation context generation failed for "UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0"1".Error in manifest or policy file "UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0"2" on line UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0"3.Component identity found in manifest does not match the identity of the component requested.Reference is UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0".Definition is UccApi,processorArchitecture="x86",type="win32",version="15.0.0.0".Please use sxstrace.exe for detailed diagnosis. Error: (05/13/2015 06:51:36 PM) (Source: SideBySide) (EventID: 35) (User: )Description: Activation context generation failed for "UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0"1".Error in manifest or policy file "UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0"2" on line UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0"3.Component identity found in manifest does not match the identity of the component requested.Reference is UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0".Definition is UccApi,processorArchitecture="x86",type="win32",version="15.0.0.0".Please use sxstrace.exe for detailed diagnosis. Error: (05/13/2015 00:38:32 PM) (Source: SideBySide) (EventID: 35) (User: )Description: Activation context generation failed for "UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0"1".Error in manifest or policy file "UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0"2" on line UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0"3.Component identity found in manifest does not match the identity of the component requested.Reference is UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0".Definition is UccApi,processorArchitecture="x86",type="win32",version="15.0.0.0".Please use sxstrace.exe for detailed diagnosis. Error: (05/12/2015 04:49:23 PM) (Source: SideBySide) (EventID: 35) (User: )Description: Activation context generation failed for "UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0"1".Error in manifest or policy file "UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0"2" on line UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0"3.Component identity found in manifest does not match the identity of the component requested.Reference is UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0".Definition is UccApi,processorArchitecture="x86",type="win32",version="15.0.0.0".Please use sxstrace.exe for detailed diagnosis. System errors:=============Error: (05/14/2015 08:08:32 AM) (Source: Service Control Manager) (EventID: 7034) (User: )Description: The AFBAgent service terminated unexpectedly. It has done this 1 time(s). Error: (05/14/2015 08:07:59 AM) (Source: Service Control Manager) (EventID: 7000) (User: )Description: The Garmin Core Update Service service failed to start due to the following error: %%1053 Error: (05/14/2015 08:07:59 AM) (Source: Service Control Manager) (EventID: 7009) (User: )Description: A timeout was reached (30000 milliseconds) while waiting for the Garmin Core Update Service service to connect. Error: (05/14/2015 08:07:23 AM) (Source: Service Control Manager) (EventID: 7006) (User: )Description: The ScRegSetValueExW call failed for DelayedAutostart with the following error: %%5 Error: (05/14/2015 08:07:23 AM) (Source: Service Control Manager) (EventID: 7006) (User: )Description: The ScRegSetValueExW call failed for Start with the following error: %%5 Error: (05/14/2015 08:07:07 AM) (Source: Service Control Manager) (EventID: 7000) (User: )Description: The Google Update Service (gupdate) service failed to start due to the following error: %%1053 Error: (05/14/2015 08:07:07 AM) (Source: Service Control Manager) (EventID: 7009) (User: )Description: A timeout was reached (30000 milliseconds) while waiting for the Google Update Service (gupdate) service to connect. Error: (05/13/2015 07:19:15 PM) (Source: Service Control Manager) (EventID: 7011) (User: )Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the ClickToRunSvc service. Error: (05/13/2015 07:19:15 PM) (Source: Service Control Manager) (EventID: 7011) (User: )Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Garmin Core Update Service service. Error: (05/13/2015 05:09:39 PM) (Source: Microsoft-Windows-Kernel-Power) (EventID: 137) (User: )Description: 4 Microsoft Office Sessions:=========================Error: (05/14/2015 04:03:59 PM) (Source: Office 2013 Licensing Service) (EventID: 0) (User: )Description: Subscription licensing service failed: -1073418225 Error: (05/14/2015 02:45:30 PM) (Source: Application Hang) (EventID: 1002) (User: )Description: wwahost.exe6.3.9600.174157b401d08e8e957890a64294967295C:\WINDOWS\syswow64\wwahost.exe893e2567-fa82-11e4-bebb-74d02b6fcae9Microsoft.SkypeApp_3.1.0.1007_x86__kzf8qxf38zg5cApp Error: (05/14/2015 02:30:37 PM) (Source: Application Hang) (EventID: 1002) (User: )Description: wwahost.exe6.3.9600.174154cc01d08e8c7d0fb53b4294967295C:\WINDOWS\syswow64\wwahost.exe717c48f8-fa80-11e4-bebb-74d02b6fcae9Microsoft.SkypeApp_3.1.0.1007_x86__kzf8qxf38zg5cApp Error: (05/14/2015 08:10:35 AM) (Source: Application Hang) (EventID: 1002) (User: )Description: wwahost.exe6.3.9600.17415f0c01d08e57639a6fac4294967295C:\WINDOWS\syswow64\wwahost.exe585e0fb2-fa4b-11e4-bebb-74d02b6fcae9Microsoft.SkypeApp_3.1.0.1007_x86__kzf8qxf38zg5cApp Error: (05/14/2015 08:10:07 AM) (Source: MsiInstaller) (EventID: 1024) (User: DAVIDASUSULTRA)Description: Adobe Reader XI (11.0.10){AC76BA86-7AD7-0000-2550-7A8C40011011}1625(NULL)(NULL)(NULL) Error: (05/14/2015 08:08:20 AM) (Source: Application Error) (EventID: 1000) (User: )Description: FBAgent.exe2.0.0.0507bd9e8ntdll.dll6.3.9600.17736550f4336c000037400000000000f0f2057001d08e5746bad093C:\Windows\system32\FBAgent.exeC:\WINDOWS\SYSTEM32\ntdll.dll0e5daa1d-fa4b-11e4-bebb-74d02b6fcae9 Error: (05/13/2015 07:13:23 PM) (Source: SideBySide) (EventID: 35) (User: )Description: UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0"UccApi,processorArchitecture="x86",type="win32",version="15.0.0.0"c:\program files (x86)\microsoft office\Office15\lync.exe.Manifestc:\program files (x86)\microsoft office\Office15\UccApi.DLL1 Error: (05/13/2015 06:51:36 PM) (Source: SideBySide) (EventID: 35) (User: )Description: UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0"UccApi,processorArchitecture="x86",type="win32",version="15.0.0.0"c:\program files (x86)\microsoft office\Office15\lync.exe.Manifestc:\program files (x86)\microsoft office\Office15\UccApi.DLL1 Error: (05/13/2015 00:38:32 PM) (Source: SideBySide) (EventID: 35) (User: )Description: UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0"UccApi,processorArchitecture="x86",type="win32",version="15.0.0.0"c:\program files (x86)\microsoft office\Office15\lync.exe.Manifestc:\program files (x86)\microsoft office\Office15\UccApi.DLL1 Error: (05/12/2015 04:49:23 PM) (Source: SideBySide) (EventID: 35) (User: )Description: UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0"UccApi,processorArchitecture="x86",type="win32",version="15.0.0.0"c:\program files (x86)\microsoft office\Office15\lync.exe.Manifestc:\program files (x86)\microsoft office\Office15\UccApi.DLL1 CodeIntegrity Errors:=================================== Date: 2014-06-22 23:45:22.480 Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2014-06-22 23:45:22.357 Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2014-06-22 23:45:21.859 Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2014-06-22 23:45:20.792 Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2014-06-22 23:45:19.957 Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2014-06-22 23:45:19.722 Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2014-06-22 23:45:19.599 Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2014-06-22 23:45:19.484 Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2014-06-22 23:45:19.383 Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2014-06-22 23:45:19.252 Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements. ==================== Memory info =========================== Processor: Intel® Celeron® CPU 1000M @ 1.80GHzPercentage of memory in use: 55%Total physical RAM: 3981.68 MBAvailable physical RAM: 1775.68 MBTotal Pagefile: 4685.68 MBAvailable Pagefile: 2290.08 MBTotal Virtual: 131072 MBAvailable Virtual: 131071.8 MB ==================== Drives ================================ Drive c: (OS) (Fixed) (Total:276.34 GB) (Free:201.33 GB) NTFS ==>[system with boot components (obtained from reading drive)] ==================== MBR & Partition Table ================== ========================================================Disk: 0 (Size: 298.1 GB) (Disk ID: F7791DB4) Partition: GPT Partition Type. ==================== End Of Log ============================ Link to post Share on other sites More sharing options...
_argus Posted May 15, 2015 ID:962665 Share Posted May 15, 2015 Helllo,My name is Argus and and I will be helping you with your computer problems.Before we begin, please note the following:I will be working on your Malware issues, this may or may not, solve other issues you have with your machine. The logs can take some time to research, so please be patient with me. Stay with the topic until I tell you that your system is clean. Missing symptoms does not mean that everything is okay. Instructions that I give are for your system only! Please do not run any tools until requested ! The reason for this is so I know what is going on with the machine at any time. Some programs can interfere with others and hamper the recovery process. Please perform all steps in the order received. If you can't understand something don't hesitate to ask. Again I would like to remind you to make no further changes to your computer unless I direct you to do so. I will not be able to help you if you do not follow my instructions. Rules and policiesWe won't support any piracy. That being told, if any evidence of illegal OS, software, cracks/keygens or any other will be revealed, any further assistance will be suspended. If you are aware that there is this kind of stuff on your machine, remove it before proceeding!The same applies to any use of P2P software: uTorrent, BitTorrent, Vuze, Kazaa, Ares... We don't provide any help for P2P, except for their removal. All P2P software has to be uninstalled or at least fully disabled before proceeding!Failure to follow these guidelines will result with closing your topic and withdrawning any assistance. Scan with ZOEKPlease download ZOEK by Smeenk and save it to your desktop (preferred version is the *.exe one)Temporary disable your AntiVirus and AntiSpyware protection - instructions here.Right-click on icon and select Run as Administrator to start the tool. Wait patiently until the main console will appear, it may take a minute or two. In the main box please paste in the following script:createsrpoint;autoclean;emptyalltemp;ipconfig /flushdns;bMake sure that Scan All Users option is checked. Push Run Script and wait patiently. The scan may take a couple of minutes. When the scan completes, a zoek-results logfile should open in notepad. If a reboot is needed, it will be opened after it. You may also find it at your main drive (usually C:\ drive)Post its content into your next reply. Link to post Share on other sites More sharing options...
malignant Posted May 15, 2015 Author ID:962680 Share Posted May 15, 2015 Hi Argus, I downloaded ZOEK (.exe version) to my desktop, but when I right-clicked on it and selected "Run as administrator" my cursor merely turning into a "loading icon" (the blue ring-shaped cursor that continually rotates). After waiting at least 6 minutes while only seeing this cursor, I left-clicked a couple of times with the mouse icon on the empty desktop, the screen appeared near-white for several seconds, and then my mouse icon went back to normal. It seems my computer may be running somewhat slower after attempting to run ZOEK. Am I incorrectly trying to run ZOEK?I turned off my avast! Antivirus shields. I have ZoneAlarm firewall running still. Link to post Share on other sites More sharing options...
_argus Posted May 15, 2015 ID:962686 Share Posted May 15, 2015 Download zoek again, rar version. Unpack and run again. Link to post Share on other sites More sharing options...
malignant Posted May 15, 2015 Author ID:962700 Share Posted May 15, 2015 Zoek.exe v5.0.0.0 Updated 04-May-2015Tool run by David on Thu 05/14/2015 at 23:55:08.52.Microsoft Windows 8.1 6.3.9600 x64Running in: Normal Mode Internet Access DetectedLaunched: C:\Users\David\Desktop\zoek.exe [scan all users] [script inserted] ==== System Restore Info ====================== 5/15/2015 12:02:21 AM Zoek.exe System Restore Point Created Successfully. ==== Empty Folders Check ====================== C:\PROGRA~2\SafeConnect deleted successfullyC:\Users\Default\AppData\Roaming\Apple Computer deleted successfully Link to post Share on other sites More sharing options...
malignant Posted May 15, 2015 Author ID:962701 Share Posted May 15, 2015 I was able to get the ZOEK .exe version to work, by the way. Link to post Share on other sites More sharing options...
_argus Posted May 15, 2015 ID:962702 Share Posted May 15, 2015 Is not complete reports Link to post Share on other sites More sharing options...
malignant Posted May 15, 2015 Author ID:962704 Share Posted May 15, 2015 Zoek.exe v5.0.0.0 Updated 04-May-2015Tool run by David on Thu 05/14/2015 at 23:55:08.52.Microsoft Windows 8.1 6.3.9600 x64Running in: Normal Mode Internet Access DetectedLaunched: C:\Users\David\Desktop\zoek.exe [scan all users] [script inserted] ===== Runcheck 0:01:20.63 ===== --- Create Environment Variables 0:01:23.39 --- Create System Restore Point 0:01:39.00 --- Checking Input 0:02:24.78 --- AU AppData Check 0:02:50.18 --- Remove From Windows Installer 0:02:58.02 --- Empty Folders Check 0:06:08.06 --- Registry HKLM Software Check 0:06:08.07 --- Quick Launch Shortcut Check 0:06:41.37 --- IE Startpage Check 0:06:48.84 --- Program Files DB Check 0:07:29.95 --- C:\Users\David\AppData\Roaming DB Check 0:09:12.55 --- C:\Users\Default\AppData\Roaming DB Check 0:09:12.55 --- C:\Users\Default User\AppData\Roaming DB Check 0:09:12.55 --- C:\WINDOWS\SysNative\config\systemprofile\AppData\Roaming DB Check 0:09:12.55 --- C:\WINDOWS\sysWoW64\config\systemprofile\AppData\Roaming DB Check 0:09:12.55 --- C:\WINDOWS\serviceprofiles\networkservice\AppData\Roaming DB Check 0:09:12.55 --- C:\WINDOWS\serviceprofiles\Localservice\AppData\Roaming DB Check 0:09:12.55 --- C:\Users\David DB Check 0:14:19.93 --- C:\PROGRA~3 DB Check 0:15:09.13 --- C:\Users\David\AppData\Local DB Check 0:15:20.92 --- C:\Users\Default\AppData\Local DB Check 0:15:20.92 Link to post Share on other sites More sharing options...
_argus Posted May 15, 2015 ID:962705 Share Posted May 15, 2015 Fix with Farbar Recovery Scan Tool This fix was created for this user for use on that particular machine. Running it on another one may cause damage and render the system unstable. Download attached fixlist.txt file and save it to the Desktop:Both files, FRST and fixlist.txt have to be in the same location or the fix will not work! Right-click on icon and select Run as Administrator to start the tool.(XP users click run after receipt of Windows Security Warning - Open File).Press the Fix button just once and wait.If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.When finished FRST will generate a log on the Desktop, called Fixlog.txt.Please attach it to your reply. fixlist.txt Link to post Share on other sites More sharing options...
malignant Posted May 15, 2015 Author ID:962709 Share Posted May 15, 2015 Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 14-05-2015 02Ran by David at 2015-05-15 00:24:27 Run:1Running from C:\Users\David\DesktopLoaded Profiles: David (Available profiles: David)Boot Mode: Normal============================================== Content of fixlist:*****************closeprocesses:emptytemp:CHR HomePage: Default -> hxxp://search.yahoo.com?type=198484&fr=spigot-yhp-chU4 VBoxAswDrv; \??\C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [X]HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTIONHKU\S-1-5-21-1747770994-1414608345-870757575-1001\...\MountPoints2: {c6c8ecbb-aa6b-11e3-be7d-74d02b6fcae9} - "D:\VZW_Software_upgrade_assistant.exe" CMD: ipconfig /flushdnsCMD: bitsadmin /reset /allusers***************** Processes closed successfully.Chrome HomePage deleted successfully.VBoxAswDrv => Error deleting Service"HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer" => Key deleted successfully."HKU\S-1-5-21-1747770994-1414608345-870757575-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c6c8ecbb-aa6b-11e3-be7d-74d02b6fcae9}" => Key deleted successfully.HKCR\CLSID\{c6c8ecbb-aa6b-11e3-be7d-74d02b6fcae9} => Key not found. ========= ipconfig /flushdns ========= Windows IP Configuration Successfully flushed the DNS Resolver Cache. ========= End of CMD: ========= ========= bitsadmin /reset /allusers ========= BITSADMIN version 3.0 [ 7.7.9600 ]BITS administration utility.© Copyright 2000-2006 Microsoft Corp. BITSAdmin is deprecated and is not guaranteed to be available in future versions of Windows.Administrative tools for the BITS service are now provided by BITS PowerShell cmdlets. Unable to cancel {4DCD94B7-EA0D-4AF9-8C5F-2B2452550417}.Unable to cancel {CE7C11B3-7B9D-4150-A662-B841D1E9A51E}.Unable to cancel {64166357-D4D3-4B01-8F4E-95D9CDB97C26}.Unable to cancel {894AAE26-3FEB-43A9-A0B7-2AF59CEB43D0}.Unable to cancel {C4FD5986-0B98-4037-B7E8-FF8D29C3D248}.{E8E3A828-6196-4A46-A36B-F64F09D12777} canceled.1 out of 6 jobs canceled. ========= End of CMD: ========= EmptyTemp: => Removed 1.7 GB temporary data. The system needed a reboot. ==== End of Fixlog 00:25:37 ==== Link to post Share on other sites More sharing options...
_argus Posted May 15, 2015 ID:962710 Share Posted May 15, 2015 Is everything ok now? Link to post Share on other sites More sharing options...
malignant Posted May 15, 2015 Author ID:962789 Share Posted May 15, 2015 I just scanned my computer using Malwarebytes Anti-Malware free version and the PUP.Optional.Spigot.A still seems to be in my computer. Link to post Share on other sites More sharing options...
_argus Posted May 15, 2015 ID:962790 Share Posted May 15, 2015 Scan with ZOEKPlease download ZOEK by Smeenk and save it to your desktop (preferred version is the *.exe one)Temporary disable your AntiVirus and AntiSpyware protection - instructions here.Right-click on icon and select Run as Administrator to start the tool.Wait patiently until the main console will appear, it may take a minute or two.In the main box please paste in the following script: createsrpoint;autoclean;emptyalltemp;ipconfig /flushdns;bMake sure that Scan All Users option is checked.Push Run Script and wait patiently. The scan may take a couple of minutes.When the scan completes, a zoek-results logfile should open in notepad.If a reboot is needed, it will be opened after it. You may also find it at your main drive (usually C:\ drive)Post its content into your next reply. Link to post Share on other sites More sharing options...
_argus Posted May 15, 2015 ID:962792 Share Posted May 15, 2015 The first time you're not well-copied report is not complete. Link to post Share on other sites More sharing options...
malignant Posted May 15, 2015 Author ID:962828 Share Posted May 15, 2015 Zoek.exe v5.0.0.0 Updated 04-May-2015Tool run by David on Fri 05/15/2015 at 11:21:43.86.Microsoft Windows 8.1 6.3.9600 x64Running in: Normal Mode Internet Access DetectedLaunched: C:\Users\David\Desktop\zoek.exe [scan all users] [script inserted] ==== Older Logs ====================== C:\zoek-results2015-05-15-070608.log 557 bytes ==== System Restore Info ====================== 5/15/2015 11:23:34 AM Zoek.exe System Restore Point Created Successfully. ==== Deleting CLSID Registry Keys ====================== ==== Deleting CLSID Registry Values ====================== ==== Deleting Services ====================== ==== Batch Command(s) Run By Tool====================== ==== Deleting Files \ Folders ====================== C:\PROGRA~3\SetStretch.VBS deletedC:\PROGRA~3\Package Cache deletedC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Search.lnk deleted ==== Firefox Extensions Registry ====================== [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Mozilla\Firefox\Extensions]"wrc@avast.com"="C:\Program Files\AVAST Software\Avast\WebRep\FF" [04/22/2015 03:10 PM] ==== Firefox Extensions ====================== AppDir: C:\Program Files (x86)\Mozilla Firefox- Default - %AppDir%\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} ==== Firefox Plugins ====================== Profilepath: C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\fr4529fs.default18CF51689186AEB9D1D149AEB0E92D03 - C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL - Microsoft Office 2013 ==== Chromium Look ====================== Google Chrome Version: 42.0.2311.152 HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensionsgomekmidlodglbbmalcneegieacbdmki - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx[03/18/2015 03:34 PM] Pandora - David\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbangkleohkafngihneedemihgfeikclAdBlock - David\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidomBookmark Manager - David\AppData\Local\Google\Chrome\User Data\Default\Extensions\gmlllbghnfkpflemihljekbapjopfjikAvast Online Security - David\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmkiChrome Hotword Shared Module - David\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg ==== Chromium Startpages ====================== C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Preferences"homepage": "http://search.yahoo.com?type=198484&fr=spigot-yhp-ch", ==== Set IE to Default ====================== Old Values:[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]"Start Page"="http://asus13.msn.com"[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" New Values:[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]"Start Page"="http://asus13.msn.com"[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]"DefaultScope"="{012E1000-F331-11DB-8314-0800200C9A66}" ==== All HKCU SearchScopes ====================== HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes{012E1000-F331-11DB-8314-0800200C9A66} Google Url="http://www.google.com/search?q={searchTerms}"{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC" ==== Deleting Registry Keys ====================== HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher deleted successfullyHKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds deleted successfullyHKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray deleted successfullyHKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mcpltui_exe deleted successfullyHKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mcui_exe deleted successfullyHKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence deleted successfully ==== Empty IE Cache ====================== C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfullyC:\Users\David\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfullyC:\WINDOWS\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfullyC:\Users\David\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfullyC:\WINDOWS\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully ==== Empty FireFox Cache ====================== No FireFox Cache found ==== Empty Chrome Cache ====================== C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully ==== Empty All Flash Cache ====================== Flash Cache Emptied Successfully ==== Empty All Java Cache ====================== Java Cache cleared successfully ==== C:\zoek_backup content ====================== C:\zoek_backup (files=16 folders=14 46083677 bytes) ==== Empty Temp Folders ====================== C:\Users\David\AppData\Local\Temp will be emptied at rebootC:\Users\Default\AppData\Local\Temp emptied successfullyC:\Users\Default User\AppData\Local\Temp emptied successfullyC:\WINDOWS\serviceprofiles\networkservice\AppData\Local\Temp emptied successfullyC:\WINDOWS\serviceprofiles\Localservice\AppData\Local\Temp emptied successfullyC:\WINDOWS\Temp will be emptied at reboot ==== After Reboot ====================== ==== Empty Temp Folders ====================== C:\WINDOWS\Temp successfully emptiedC:\Users\David\AppData\Local\Temp successfully emptied ==== Empty Recycle Bin ====================== C:\$RECYCLE.BIN successfully emptied ==== EOF on Fri 05/15/2015 at 13:09:02.96 ====================== Link to post Share on other sites More sharing options...
_argus Posted May 15, 2015 ID:962831 Share Posted May 15, 2015 Re-run zoek and run this script:createsrpoint;autoclean;C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Preferences;femptyalltemp;ipconfig /flushdns;bPost its content into your next reply. Link to post Share on other sites More sharing options...
malignant Posted May 15, 2015 Author ID:962838 Share Posted May 15, 2015 Zoek.exe v5.0.0.0 Updated 04-May-2015Tool run by David on Fri 05/15/2015 at 13:28:13.65.Microsoft Windows 8.1 6.3.9600 x64Running in: Normal Mode Internet Access DetectedLaunched: C:\Users\David\Desktop\zoek.exe [scan all users] [script inserted] ==== Older Logs ====================== C:\zoek-results2015-05-15-070608.log 557 bytesC:\zoek-results2015-05-15-200902.log 6082 bytes ==== System Restore Info ====================== 5/15/2015 1:30:00 PM Zoek.exe System Restore Point Created Successfully. ==== Deleting CLSID Registry Keys ====================== ==== Deleting CLSID Registry Values ====================== ==== Deleting Services ====================== ==== Batch Command(s) Run By Tool====================== ==== Deleting Files \ Folders ====================== "C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Preferences" deleted ==== Firefox Extensions Registry ====================== [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Mozilla\Firefox\Extensions]"wrc@avast.com"="C:\Program Files\AVAST Software\Avast\WebRep\FF" [04/22/2015 03:10 PM] ==== Firefox Extensions ====================== AppDir: C:\Program Files (x86)\Mozilla Firefox- Default - %AppDir%\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} ==== Firefox Plugins ====================== Profilepath: C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\fr4529fs.default18CF51689186AEB9D1D149AEB0E92D03 - C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL - Microsoft Office 2013 ==== Chromium Look ====================== Google Chrome Version: 42.0.2311.152 HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensionsgomekmidlodglbbmalcneegieacbdmki - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx[03/18/2015 03:34 PM] Pandora - David\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbangkleohkafngihneedemihgfeikclAdBlock - David\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidomBookmark Manager - David\AppData\Local\Google\Chrome\User Data\Default\Extensions\gmlllbghnfkpflemihljekbapjopfjikAvast Online Security - David\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmkiChrome Hotword Shared Module - David\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg ==== Set IE to Default ====================== Old Values:[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]"Start Page"="http://asus13.msn.com" New Values:[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]"Start Page"="http://asus13.msn.com" ==== All HKCU SearchScopes ====================== HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes"DefaultScope"="{012E1000-F331-11DB-8314-0800200C9A66}"{012E1000-F331-11DB-8314-0800200C9A66} Google Url="http://www.google.com/search?q={searchTerms}"{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC" ==== Empty IE Cache ====================== C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfullyC:\Users\David\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfullyC:\WINDOWS\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfullyC:\WINDOWS\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfullyC:\Users\David\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfullyC:\WINDOWS\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully ==== Empty FireFox Cache ====================== No FireFox Cache found ==== Empty Chrome Cache ====================== C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully ==== Empty All Flash Cache ====================== Flash Cache Emptied Successfully ==== Empty All Java Cache ====================== Java Cache cleared successfully ==== C:\zoek_backup content ====================== C:\zoek_backup (files=17 folders=14 46248271 bytes) ==== Empty Temp Folders ====================== C:\Users\David\AppData\Local\Temp will be emptied at rebootC:\Users\Default\AppData\Local\Temp emptied successfullyC:\Users\Default User\AppData\Local\Temp emptied successfullyC:\WINDOWS\serviceprofiles\networkservice\AppData\Local\Temp emptied successfullyC:\WINDOWS\serviceprofiles\Localservice\AppData\Local\Temp emptied successfullyC:\WINDOWS\Temp will be emptied at reboot ==== After Reboot ====================== ==== Empty Temp Folders ====================== C:\WINDOWS\Temp successfully emptiedC:\Users\David\AppData\Local\Temp successfully emptied ==== Empty Recycle Bin ====================== C:\$RECYCLE.BIN successfully emptied ==== EOF on Fri 05/15/2015 at 14:07:09.42 ====================== Link to post Share on other sites More sharing options...
_argus Posted May 15, 2015 ID:962839 Share Posted May 15, 2015 Very good, is everything ok now? Link to post Share on other sites More sharing options...
malignant Posted May 15, 2015 Author ID:962844 Share Posted May 15, 2015 I scanned my computer with Malwarebytes Anti-Malware free version again, and it looks like the PUP.Optional.Spigot.A is still showed up on the scan. Link to post Share on other sites More sharing options...
_argus Posted May 16, 2015 ID:962877 Share Posted May 16, 2015 Please re-run Malwarebytes' Anti-Malware.Click the History tab. Click Application Logs and double-click the newest Protection Log. At the bottom click Export and choose Text file.Save the file to your desktop and include its content in your next reply. Fix with AdwCleanerPlease download AdwCleaner by Xplode and save the file to your desktop.Right-click on icon and select Run as Administrator to start the tool. Follow the prompts and click Scan. When finished, please click Clean. Upon completion, click Report. A log (AdwCleaner[s*].txt) will open.Please include the contents of that file in your reply. Link to post Share on other sites More sharing options...
malignant Posted May 16, 2015 Author ID:962879 Share Posted May 16, 2015 # AdwCleaner v4.204 - Logfile created 15/05/2015 at 21:19:21# Updated 12/05/2015 by Xplode# Database : 2015-05-12.2 [server]# Operating system : Windows 8.1 (x64)# Username : David - DAVIDASUSULTRA# Running from : C:\Users\David\Desktop\adwcleaner_4.204.exe# Option : Cleaning ***** [ Services ] ***** ***** [ Files / Folders ] ***** ***** [ Scheduled tasks ] ***** ***** [ Shortcuts ] ***** ***** [ Registry ] ***** Data Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyOverride] - *.local ***** [ Web browsers ] ***** -\\ Internet Explorer v11.0.9600.17416 -\\ Mozilla Firefox v34.0.5 (x86 en-US) -\\ Google Chrome v42.0.2311.152 [C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] - Deleted [Homepage] : hxxp://search.yahoo.com?type=198484&fr=spigot-yhp-ch ************************* AdwCleaner[R0].txt - [1040 bytes] - [15/05/2015 21:12:51]AdwCleaner[R1].txt - [1100 bytes] - [15/05/2015 21:17:53]AdwCleaner[s0].txt - [1030 bytes] - [15/05/2015 21:19:21] ########## EOF - C:\AdwCleaner\AdwCleaner[s0].txt - [1089 bytes] ########## # AdwCleaner v4.204 - Logfile created 15/05/2015 at 21:19:21# Updated 12/05/2015 by Xplode# Database : 2015-05-12.2 [server]# Operating system : Windows 8.1 (x64)# Username : David - DAVIDASUSULTRA# Running from : C:\Users\David\Desktop\adwcleaner_4.204.exe# Option : Cleaning ***** [ Services ] ***** ***** [ Files / Folders ] ***** ***** [ Scheduled tasks ] ***** ***** [ Shortcuts ] ***** ***** [ Registry ] ***** Data Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyOverride] - *.local ***** [ Web browsers ] ***** -\\ Internet Explorer v11.0.9600.17416 -\\ Mozilla Firefox v34.0.5 (x86 en-US) -\\ Google Chrome v42.0.2311.152 [C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] - Deleted [Homepage] : hxxp://search.yahoo.com?type=198484&fr=spigot-yhp-ch ************************* AdwCleaner[R0].txt - [1040 bytes] - [15/05/2015 21:12:51]AdwCleaner[R1].txt - [1100 bytes] - [15/05/2015 21:17:53]AdwCleaner[s0].txt - [1030 bytes] - [15/05/2015 21:19:21] ########## EOF - C:\AdwCleaner\AdwCleaner[s0].txt - [1089 bytes] ########## Link to post Share on other sites More sharing options...
malignant Posted May 16, 2015 Author ID:962880 Share Posted May 16, 2015 Malwarebytes Anti-Malwarewww.malwarebytes.org Update, 5/15/2015 12:42:46 AM, SYSTEM, DAVIDASUSULTRA, Manual, program, 2.0.4.1028, 2.1.6.1022, Update, 5/15/2015 12:44:17 AM, SYSTEM, DAVIDASUSULTRA, Manual, Remediation Database, 2015.3.9.1, 2015.5.13.1, Update, 5/15/2015 12:44:17 AM, SYSTEM, DAVIDASUSULTRA, Manual, Rootkit Database, 2015.2.25.1, 2015.5.14.1, Update, 5/15/2015 12:44:23 AM, SYSTEM, DAVIDASUSULTRA, Manual, Malware Database, 2015.3.9.5, 2015.5.15.1, Scan, 5/15/2015 9:56:08 AM, SYSTEM, DAVIDASUSULTRA, Manual, Start:5/15/2015 12:44:33 AM, Duration:32 min 58 sec, Threat Scan, Completed, 0 Malware Detections, 1 Non-Malware Detection, Error, 5/15/2015 1:05:12 PM, SYSTEM, DAVIDASUSULTRA, Protection, IsLicensed, 13, Protection, 5/15/2015 1:05:12 PM, SYSTEM, DAVIDASUSULTRA, Protection, Malware Protection, Stopping, Protection, 5/15/2015 1:05:12 PM, SYSTEM, DAVIDASUSULTRA, Protection, Malware Protection, Stopped, Error, 5/15/2015 2:09:18 PM, SYSTEM, DAVIDASUSULTRA, Protection, IsLicensed, 13, Protection, 5/15/2015 2:09:18 PM, SYSTEM, DAVIDASUSULTRA, Protection, Malware Protection, Stopping, Protection, 5/15/2015 2:09:18 PM, SYSTEM, DAVIDASUSULTRA, Protection, Malware Protection, Stopped, Update, 5/15/2015 2:17:40 PM, SYSTEM, DAVIDASUSULTRA, Manual, Malware Database, 2015.5.15.1, 2015.5.15.5, Scan, 5/15/2015 2:57:42 PM, SYSTEM, DAVIDASUSULTRA, Manual, Start:5/15/2015 2:17:40 PM, Duration:35 min 16 sec, Threat Scan, Completed, 0 Malware Detections, 1 Non-Malware Detection, (end) Link to post Share on other sites More sharing options...
_argus Posted May 16, 2015 ID:962885 Share Posted May 16, 2015 Completed, 0 Malware Detections, 1 Non-Malware Detection, System is clean. Link to post Share on other sites More sharing options...
_argus Posted May 16, 2015 ID:962889 Share Posted May 16, 2015 How's your computer behaving now? Link to post Share on other sites More sharing options...
malignant Posted May 16, 2015 Author ID:962895 Share Posted May 16, 2015 It's behaving normal as far as I can tell. Each MBAM scan I've done before my prior post has shown 0 Malware Detections, 1 Non-Malware Detection, with the PUP.Optional.Spigot.A being the 1 Non-Malware Detection. Does the fact that MBAM considers the PUP.Optional.Spigot.A "Non-Malware" mean that I do not need to worry too much about it? Link to post Share on other sites More sharing options...
Recommended Posts