jamesost Posted June 8, 2015 ID:968043 Share Posted June 8, 2015 I have two family laptops (this is laptop #2, I made a separate post for #1 already) that I want to install MB and the MB Anti-Exploit tool on, but first I need to fix whatever is screwing them up. They use to run well, but they got so slow, experience so many browser crashes, and get tons of popups that people just didn't want to use them any longer. I thought maybe if one of you guys could assist on cleaning them up then if I installed all the MB tools on it they would be functional once again. Appreciate the help and below are the first log files. FRST log Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:08-06-2015Ran by owner (administrator) on OWNER-PC on 08-06-2015 15:42:10Running from C:\Users\owner\DesktopLoaded Profiles: owner (Available Profiles: owner)Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: English (United States)Internet Explorer Version 11 (Default browser: IE)Boot Mode: NormalTutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/==================== Processes (Whitelisted) =================(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe(SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCore64.exe(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe() C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe(RealNetworks, Inc.) C:\Program Files (x86)\Real\RealPlayer\RPDS\Bin\rpdsvc.exe() C:\Program Files (x86)\Real\UpdateService\RealPlayerUpdateSvc.exe(TOSHIBA Corporation) C:\Windows\System32\TODDSrv.exe(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE(Yahoo! Inc.) C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe(Intel Corporation) C:\Windows\System32\igfxtray.exe(Intel Corporation) C:\Windows\System32\hkcmd.exe(Intel Corporation) C:\Windows\System32\igfxpers.exe(Intel Corporation) C:\Windows\System32\igfxsrvc.exe(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe(TOSHIBA Corporation) C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe(TOSHIBA Corporation) C:\Program Files\TOSHIBA\BulletinBoard\TosNcCore.exe(TOSHIBA Corporation) C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe(SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe(RealNetworks, Inc.) C:\Program Files (x86)\Real\RealPlayer\RPDS\Bin64\rpsystray.exe(TOSHIBA Corporation) C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe(Intel Corporation) C:\Windows\System32\igfxext.exe() C:\Program Files (x86)\RealNetworks\RealDownloader\downloader2.exe(Yahoo! Inc.) C:\Program Files (x86)\Yahoo!\Messenger\Ymsgr_tray.exe(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe(Microsoft Corporation) C:\Windows\System32\dllhost.exe(TOSHIBA Corporation) C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe(Microsoft Corporation) C:\Windows\System32\GWX\GWXConfigManager.exe(RealNetworks, Inc.) C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe(Microsoft Corporation) C:\Windows\System32\dinotify.exe(Microsoft Corporation) C:\Windows\System32\wbem\WMIADAP.exe() C:\Program Files (x86)\RealNetworks\RealDownloader\downloader2.exe==================== Registry (Whitelisted) ==================(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)HKLM\...\Run: [] => [X]HKLM\...\Run: [smartAudio] => C:\Program Files\CONEXANT\SAII\SAIICpl.exe [316032 2010-12-14] (Conexant systems, Inc.)HKLM\...\Run: [synTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2052392 2010-03-10] (Synaptics Incorporated)HKLM\...\Run: [TPwrMain] => C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE [566696 2011-03-02] (TOSHIBA Corporation)HKLM\...\Run: [TCrdMain] => C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe [973176 2010-12-15] (TOSHIBA Corporation)HKLM\...\Run: [TosVolRegulator] => C:\Program Files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe [24376 2009-11-11] (TOSHIBA Corporation)HKLM\...\Run: [TosSENotify] => C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe [710040 2010-12-08] (TOSHIBA Corporation)HKLM\...\Run: [TosNC] => C:\Program Files\Toshiba\BulletinBoard\TosNcCore.exe [595816 2010-04-23] (TOSHIBA Corporation)HKLM\...\Run: [TosReelTimeMonitor] => C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe [38304 2010-12-14] (TOSHIBA Corporation)HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1337000 2015-04-30] (Microsoft Corporation)HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [169768 2015-02-13] (Apple Inc.)HKLM-x32\...\Run: [ToshibaServiceStation] => C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe [1295736 2011-02-11] (TOSHIBA Corporation)HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [60712 2015-02-13] (Apple Inc.)HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-10-02] (Apple Inc.)HKLM-x32\...\Run: [TkBellExe] => C:\Program Files (x86)\Real\RealPlayer\update\realsched.exe [296520 2015-02-28] (RealNetworks, Inc.)HKLM-x32\...\Run: [RealDownloader] => C:\Program Files (x86)\RealNetworks\RealDownloader\downloader2.exe [560192 2014-10-29] ()Winlogon\Notify\igfxcui: C:\windows\system32\igfxdev.dll (Intel Corporation)HKU\S-1-5-21-4066985096-3163565410-4042152647-1000\...\Run: [Messenger (Yahoo!)] => C:\Program Files (x86)\Yahoo!\Messenger\YahooMessenger.exe [6276408 2011-06-16] (Yahoo! Inc.)HKU\S-1-5-21-4066985096-3163565410-4042152647-1000\...\Run: [DW6] => [X]HKU\S-1-5-21-4066985096-3163565410-4042152647-1000\...\Run: [Google Update] => C:\Users\owner\AppData\Local\Google\Update\GoogleUpdate.exe [107912 2014-10-17] (Google Inc.)HKU\S-1-5-21-4066985096-3163565410-4042152647-1000\...\Run: [MobileDocuments] => C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exeHKU\S-1-5-21-4066985096-3163565410-4042152647-1000\...\Run: [DW7] => "C:\Program Files (x86)\The Weather Channel\The Weather Channel App\TWCApp.exe"HKU\S-1-5-21-4066985096-3163565410-4042152647-1000\...\Run: [sUPERAntiSpyware] => C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [2988784 2010-11-22] (SUPERAntiSpyware.com)HKU\S-1-5-21-4066985096-3163565410-4042152647-1000\...\Policies\Explorer: [NoDesktopCleanupWizard] 1HKU\S-1-5-21-4066985096-3163565410-4042152647-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\windows\system32\Bubbles.scr [899584 2010-11-20] (Microsoft Corporation)Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk [2015-04-16]ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.)Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\RealPlayer Cloud Service UI.lnk [2015-02-28]ShortcutTarget: RealPlayer Cloud Service UI.lnk -> C:\Program Files (x86)\Real\RealPlayer\RPDS\Bin64\rpsystray.exe (RealNetworks, Inc.)Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Best Buy pc app.lnk [2011-07-06]ShortcutTarget: Best Buy pc app.lnk -> C:\ProgramData\Best Buy pc app\ClickOnceSetup.exe (Microsoft)Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Best Buy pc app.lnk [2011-07-06]ShortcutTarget: Best Buy pc app.lnk -> C:\ProgramData\Best Buy pc app\ClickOnceSetup.exe (Microsoft)==================== Internet (Whitelisted) ====================(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)HKU\S-1-5-21-4066985096-3163565410-4042152647-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://start.toshiba.com/g/HKU\S-1-5-21-4066985096-3163565410-4042152647-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/SearchScopes: HKLM -> DefaultScope value is missingSearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =SearchScopes: HKLM -> {{67A2568C-7A0A-4EED-AECC-B5405DE63B64}} URL = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSNJSearchScopes: HKLM-x32 -> DefaultScope value is missingSearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =SearchScopes: HKLM-x32 -> {{67A2568C-7A0A-4EED-AECC-B5405DE63B64}} URL = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSNJSearchScopes: HKU\.DEFAULT -> {{67A2568C-7A0A-4EED-AECC-B5405DE63B64}} URL =SearchScopes: HKU\S-1-5-21-4066985096-3163565410-4042152647-1000 -> {11A6411B-24AE-419A-86F6-2E489EAF9A3C} URL = http://websearch.ask.com/redirect?client=ie&tb=ORJ&o=&src=kw&q={searchTerms}&locale=&apn_ptnrs=&apn_dtid=OSJ000&apn_uid=8CC3C70F-EE38-4A24-B3D1-7EA5B4BFA511&apn_sauid=0F4A6884-FDDD-4C28-8D10-FFB992C7994D&SearchScopes: HKU\S-1-5-21-4066985096-3163565410-4042152647-1000 -> {1A943B02-2C44-43b4-8B00-A6A15C81B13C} URL = http://www.diigo.com/search/g?cx=partner-pub-7625644023173335%3Agqffh9-8lvc&cof=FORID%3A9&ie=UTF-8&q={searchTerms}&sa=Search#932SearchScopes: HKU\S-1-5-21-4066985096-3163565410-4042152647-1000 -> {BDF8D41F-0D54-404A-98C7-2DF1D65FAB15} URL = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSNJSearchScopes: HKU\S-1-5-21-4066985096-3163565410-4042152647-1000 -> {{67A2568C-7A0A-4EED-AECC-B5405DE63B64}} URL = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSNJ_enUS445BHO: RealNetworks Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\Program Files (x86)\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin64.dll [2014-10-27] (RealDownloader)BHO: No Name -> {4F564F32-5637-006A-76A7-7A786E7484D7} -> No FileBHO: No Name -> {6E89E1D3-C66F-41C4-A648-CD91544E99C3} -> No FileBHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21] (Microsoft Corp.)BHO-x32: MSS+ Identifier -> {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} -> C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll [2014-04-09] (McAfee, Inc.)BHO-x32: RealNetworks Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\Program Files (x86)\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll [2014-10-27] (RealDownloader)BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)BHO-x32: Java Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2013-12-18] (Oracle Corporation)BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21] (Microsoft Corp.)BHO-x32: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2013-12-18] (Oracle Corporation)BHO-x32: TOSHIBA Media Controller Plug-in -> {F3C88694-EFFA-4d78-B409-54B7B2535B14} -> C:\Program Files (x86)\TOSHIBA\TOSHIBA Media Controller Plug-in\TOSHIBAMediaControllerIE.dll [2010-12-05] (<TOSHIBA>)Toolbar: HKU\S-1-5-21-4066985096-3163565410-4042152647-1000 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No FileToolbar: HKU\S-1-5-21-4066985096-3163565410-4042152647-1000 -> No Name - {4F564F32-5637-006A-76A7-7A786E7484D7} - No FileDPF: HKLM-x32 {02BCC737-B171-4746-94C9-0D8A0B2C0089} http://office.microsoft.com/sites/production/ieawsdc32.cabDPF: HKLM-x32 {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cabDPF: HKLM-x32 {233C1507-6A77-46A4-9443-F871F945D258} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cabTcpip\Parameters: [DhcpNameServer] 192.168.1.254FireFox:========FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF64_17_0_0_169.dll [2015-04-15] ()FF Plugin: @bestbuy.com/npBestBuyPcAppDetector,version=1.0 -> C:\ProgramData\Best Buy pc app\npBestBuyPcAppDetector.dll [2011-02-25] (Best Buy)FF Plugin: @microsoft.com/GENUINE -> disabled No FileFF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-16] ( Microsoft Corporation)FF Plugin-x32: @adobe.com/FlashPlayer -> C:\windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_169.dll [2015-04-15] ()FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\windows\SysWOW64\Adobe\Director\np32dsw_1212152.dll [2014-05-30] (Adobe Systems, Inc.)FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-10-30] ()FF Plugin-x32: @bestbuy.com/npBestBuyPcAppDetector,version=1.0 -> C:\ProgramData\Best Buy pc app\npBestBuyPcAppDetector.dll [2011-02-25] (Best Buy)FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll [2013-12-18] (Oracle Corporation)FF Plugin-x32: @java.com/JavaPlugin -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll [2013-12-18] (Oracle Corporation)FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll [2013-12-18] (Oracle Corporation)FF Plugin-x32: @messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6 -> C:\Program Files (x86)\Yahoo!\Shared\npYState.dll [2011-06-16] (Yahoo! Inc.)FF Plugin-x32: @microsoft.com/GENUINE -> disabled No FileFF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation)FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2010-11-10] (Microsoft Corporation)FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2010-11-10] (Microsoft Corporation)FF Plugin-x32: @real.com/nppl3260;version=17.0.15.10 -> c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll [2015-02-28] (RealNetworks, Inc.)FF Plugin-x32: @real.com/nprjplug;version=15.0.0.198 -> c:\program files (x86)\real\realplayer\Netscape6\nprjplug.dll [2011-11-26] (RealNetworks, Inc.)FF Plugin-x32: @real.com/nprndlhtml5videoshim;version=17.0.15 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll [2014-10-27] (RealNetworks, Inc.)FF Plugin-x32: @real.com/nprpchromebrowserrecordext;version=15.0.0.198 -> C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll [2011-11-26] (RealNetworks, Inc.)FF Plugin-x32: @real.com/nprphtml5videoshim;version=15.0.0.198 -> C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll [2011-11-26] (RealNetworks, Inc.)FF Plugin-x32: @real.com/nprpjplug;version=15.0.0.198 -> c:\program files (x86)\real\realplayer\Netscape6\nprpjplug.dll [2011-11-26] (RealNetworks, Inc.)FF Plugin-x32: @real.com/nprpplugin;version=17.0.15.10 -> c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll [2015-02-28] (RealPlayer Cloud)FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-23] (Google Inc.)FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-23] (Google Inc.)FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll [2014-09-04] (Adobe Systems Inc.)FF Plugin HKU\S-1-5-21-4066985096-3163565410-4042152647-1000: @citrixonline.com/appdetectorplugin -> C:\Users\owner\AppData\Local\Citrix\Plugins\104\npappdetector.dll [2015-02-06] (Citrix Online)FF Plugin HKU\S-1-5-21-4066985096-3163565410-4042152647-1000: @tools.google.com/Google Update;version=3 -> C:\Users\owner\AppData\Local\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-23] (Google Inc.)FF Plugin HKU\S-1-5-21-4066985096-3163565410-4042152647-1000: @tools.google.com/Google Update;version=9 -> C:\Users\owner\AppData\Local\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-23] (Google Inc.)FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\Yahooober1158042.xml [2013-06-12]FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\Yahooober14843651.xml [2013-06-12]FF HKLM-x32\...\Firefox\Extensions: [virtualKeyboard@kaspersky.ru] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2011\FFExt\virtualKeyboard@kaspersky.ruFF HKLM-x32\...\Firefox\Extensions: [linkfilter@kaspersky.ru] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2011\FFExt\linkfilter@kaspersky.ruFF HKLM-x32\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\ExtFF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext [2015-02-28]FF HKLM-x32\...\Firefox\Extensions: [{338950EA-82DB-44C1-930D-0C28E023C9F0}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\ExtFF HKU\.DEFAULT\...\Firefox\Extensions: [{b64982b1-d112-42b5-b1e4-d3867c4533f8}] - C:\ProgramData\Browser Manager\2.2.643.41\{16cdff19-861d-48e3-a751-d99a27784753}\FirefoxExtensionChrome:=======CHR Profile: C:\Users\owner\AppData\Local\Google\Chrome\User Data\DefaultCHR Extension: (Bookmark Manager) - C:\Users\owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\gmlllbghnfkpflemihljekbapjopfjik [2015-04-15]CHR Extension: (Chrome Hotword Shared Module) - C:\Users\owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-14]CHR Extension: (Google Wallet) - C:\Users\owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-10-10]CHR HKLM-x32\...\Chrome\Extension: [bopakagnckmlgajfccecajhnimjiiedh] - http://clients2.google.com/service/update2/crxStartMenuInternet: Google Chrome - C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe==================== Services (Whitelisted) =================(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [128752 2010-06-29] (SUPERAntiSpyware.com) [File not signed]R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77128 2015-01-20] (Apple Inc.)S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe [69632 2005-11-14] (Macrovision Corporation) [File not signed]R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [289256 2014-04-09] (McAfee, Inc.)R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23816 2015-04-30] (Microsoft Corporation)R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [366544 2015-04-30] (Microsoft Corporation)R2 RealNetworks Downloader Resolver Service; C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [39568 2014-10-26] ()R2 RealPlayer Cloud Service; c:\program files (x86)\real\realplayer\RPDS\Bin\rpdsvc.exe [1141848 2015-02-28] (RealNetworks, Inc.)R2 RealPlayerUpdateSvc; C:\Program Files (x86)\Real\UpdateService\RealPlayerUpdateSvc.exe [31856 2014-10-30] ()S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)==================== Drivers (Whitelisted) ====================(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [486192 2014-06-16] (Symantec Corporation)R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [280376 2015-03-04] (Microsoft Corporation)R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [124568 2015-03-04] (Microsoft Corporation)R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14920 2010-02-17] (SUPERAdBlocker.com and SUPERAntiSpyware.com)R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12360 2010-02-17] (SUPERAdBlocker.com and SUPERAntiSpyware.com)S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [54784 2012-12-13] (Apple, Inc.) [File not signed]==================== NetSvcs (Whitelisted) ===================(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)==================== One Month Created files and folders ========(If an entry is included in the fixlist, the file/folder will be moved.)2015-06-08 15:42 - 2015-06-08 15:44 - 00023274 _____ C:\Users\owner\Desktop\FRST.txt2015-06-08 15:40 - 2015-06-08 15:43 - 00000000 ____D C:\FRST2015-06-08 15:40 - 2015-06-08 15:38 - 02108928 _____ (Farbar) C:\Users\owner\Desktop\FRST64.exe2015-05-23 21:38 - 2015-05-23 21:38 - 00003642 _____ C:\windows\System32\Tasks\GoogleUpdateTaskMachineCore2015-05-23 21:35 - 2015-05-23 21:35 - 00000000 ____D C:\windows\Temp605FC034-DAED-DA28-25E4-6DADA3791C19-Signatures2015-05-23 21:12 - 2015-05-01 08:17 - 00124112 _____ (Microsoft Corporation) C:\windows\system32\PresentationCFFRasterizerNative_v0300.dll2015-05-23 21:12 - 2015-05-01 08:16 - 00102608 _____ (Microsoft Corporation) C:\windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll2015-05-13 22:55 - 2015-05-04 20:29 - 00342016 _____ (Microsoft Corporation) C:\windows\system32\schannel.dll2015-05-13 22:55 - 2015-05-04 20:12 - 00248832 _____ (Microsoft Corporation) C:\windows\SysWOW64\schannel.dll2015-05-13 22:55 - 2015-04-21 21:28 - 00389840 _____ (Microsoft Corporation) C:\windows\system32\iedkcs32.dll2015-05-13 22:55 - 2015-04-21 20:48 - 00342736 _____ (Microsoft Corporation) C:\windows\SysWOW64\iedkcs32.dll2015-05-13 22:55 - 2015-04-21 12:08 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb2015-05-13 22:55 - 2015-04-21 12:07 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll2015-05-13 22:55 - 2015-04-21 11:51 - 00066560 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll2015-05-13 22:55 - 2015-04-21 11:50 - 00584192 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll2015-05-13 22:55 - 2015-04-21 11:50 - 00048640 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll2015-05-13 22:55 - 2015-04-21 11:49 - 02885120 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll2015-05-13 22:55 - 2015-04-21 11:41 - 00054784 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll2015-05-13 22:55 - 2015-04-21 11:40 - 00034304 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll2015-05-13 22:55 - 2015-04-21 11:35 - 00144384 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe2015-05-13 22:55 - 2015-04-21 11:35 - 00114688 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe2015-05-13 22:55 - 2015-04-21 11:26 - 00968704 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe2015-05-13 22:55 - 2015-04-21 11:25 - 02724864 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb2015-05-13 22:55 - 2015-04-21 11:24 - 19691008 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll2015-05-13 22:55 - 2015-04-21 11:14 - 00077824 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll2015-05-13 22:55 - 2015-04-21 11:11 - 00504320 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll2015-05-13 22:55 - 2015-04-21 11:11 - 00062464 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll2015-05-13 22:55 - 2015-04-21 11:10 - 00047616 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieetwproxystub.dll2015-05-13 22:55 - 2015-04-21 11:09 - 00341504 _____ (Microsoft Corporation) C:\windows\SysWOW64\html.iec2015-05-13 22:55 - 2015-04-21 11:08 - 00064000 _____ (Microsoft Corporation) C:\windows\SysWOW64\MshtmlDac.dll2015-05-13 22:55 - 2015-04-21 11:05 - 00316928 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll2015-05-13 22:55 - 2015-04-21 11:04 - 02278400 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll2015-05-13 22:55 - 2015-04-21 11:03 - 00047104 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll2015-05-13 22:55 - 2015-04-21 11:02 - 00030720 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll2015-05-13 22:55 - 2015-04-21 11:00 - 00478208 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll2015-05-13 22:55 - 2015-04-21 10:58 - 00664576 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll2015-05-13 22:55 - 2015-04-21 10:58 - 00115712 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieUnatt.exe2015-05-13 22:55 - 2015-04-21 10:57 - 00620032 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9diag.dll2015-05-13 22:55 - 2015-04-21 10:49 - 00801280 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll2015-05-13 22:55 - 2015-04-21 10:49 - 00720384 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe2015-05-13 22:55 - 2015-04-21 10:48 - 00418304 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll2015-05-13 22:55 - 2015-04-21 10:46 - 02125824 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl2015-05-13 22:55 - 2015-04-21 10:43 - 00060416 _____ (Microsoft Corporation) C:\windows\SysWOW64\JavaScriptCollectionAgent.dll2015-05-13 22:55 - 2015-04-21 10:39 - 00168960 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll2015-05-13 22:55 - 2015-04-21 10:38 - 00076288 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll2015-05-13 22:55 - 2015-04-21 10:36 - 00285696 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll2015-05-13 22:55 - 2015-04-21 10:31 - 04305920 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll2015-05-13 22:55 - 2015-04-21 10:26 - 00688640 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll2015-05-13 22:55 - 2015-04-21 10:25 - 02052608 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl2015-05-13 22:55 - 2015-04-21 10:24 - 01155072 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmlmedia.dll2015-05-13 22:55 - 2015-04-21 10:17 - 12828672 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll2015-05-13 22:55 - 2015-04-21 10:15 - 01547264 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll2015-05-13 22:55 - 2015-04-21 10:03 - 00800768 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll2015-05-13 22:55 - 2015-04-21 10:02 - 01882112 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll2015-05-13 22:55 - 2015-04-21 09:58 - 01310208 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll2015-05-13 22:55 - 2015-04-21 09:56 - 00710144 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dll2015-05-13 22:55 - 2015-04-17 22:10 - 00460800 _____ (Microsoft Corporation) C:\windows\system32\certcli.dll2015-05-13 22:55 - 2015-04-17 21:56 - 00342016 _____ (Microsoft Corporation) C:\windows\SysWOW64\certcli.dll2015-05-13 22:54 - 2015-04-27 14:28 - 05569984 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe2015-05-13 22:54 - 2015-04-27 14:28 - 00155584 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecpkg.sys2015-05-13 22:54 - 2015-04-27 14:28 - 00095680 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecdd.sys2015-05-13 22:54 - 2015-04-27 14:26 - 01728960 _____ (Microsoft Corporation) C:\windows\system32\ntdll.dll2015-05-13 22:54 - 2015-04-27 14:23 - 01461760 _____ (Microsoft Corporation) C:\windows\system32\lsasrv.dll2015-05-13 22:54 - 2015-04-27 14:23 - 01254400 _____ (Microsoft Corporation) C:\windows\system32\diagtrack.dll2015-05-13 22:54 - 2015-04-27 14:23 - 01162752 _____ (Microsoft Corporation) C:\windows\system32\kernel32.dll2015-05-13 22:54 - 2015-04-27 14:23 - 00879104 _____ (Microsoft Corporation) C:\windows\system32\tdh.dll2015-05-13 22:54 - 2015-04-27 14:23 - 00879104 _____ (Microsoft Corporation) C:\windows\system32\advapi32.dll2015-05-13 22:54 - 2015-04-27 14:23 - 00728064 _____ (Microsoft Corporation) C:\windows\system32\kerberos.dll2015-05-13 22:54 - 2015-04-27 14:23 - 00503808 _____ (Microsoft Corporation) C:\windows\system32\srcore.dll2015-05-13 22:54 - 2015-04-27 14:23 - 00424448 _____ (Microsoft Corporation) C:\windows\system32\KernelBase.dll2015-05-13 22:54 - 2015-04-27 14:23 - 00362496 _____ (Microsoft Corporation) C:\windows\system32\wow64win.dll2015-05-13 22:54 - 2015-04-27 14:23 - 00314880 _____ (Microsoft Corporation) C:\windows\system32\msv1_0.dll2015-05-13 22:54 - 2015-04-27 14:23 - 00309760 _____ (Microsoft Corporation) C:\windows\system32\ncrypt.dll2015-05-13 22:54 - 2015-04-27 14:23 - 00243712 _____ (Microsoft Corporation) C:\windows\system32\wow64.dll2015-05-13 22:54 - 2015-04-27 14:23 - 00215040 _____ (Microsoft Corporation) C:\windows\system32\winsrv.dll2015-05-13 22:54 - 2015-04-27 14:23 - 00210944 _____ (Microsoft Corporation) C:\windows\system32\wdigest.dll2015-05-13 22:54 - 2015-04-27 14:23 - 00136192 _____ (Microsoft Corporation) C:\windows\system32\sspicli.dll2015-05-13 22:54 - 2015-04-27 14:23 - 00113664 _____ (Microsoft Corporation) C:\windows\system32\sechost.dll2015-05-13 22:54 - 2015-04-27 14:23 - 00086528 _____ (Microsoft Corporation) C:\windows\system32\TSpkg.dll2015-05-13 22:54 - 2015-04-27 14:23 - 00050176 _____ (Microsoft Corporation) C:\windows\system32\srclient.dll2015-05-13 22:54 - 2015-04-27 14:23 - 00043520 _____ (Microsoft Corporation) C:\windows\system32\csrsrv.dll2015-05-13 22:54 - 2015-04-27 14:23 - 00029184 _____ (Microsoft Corporation) C:\windows\system32\sspisrv.dll2015-05-13 22:54 - 2015-04-27 14:23 - 00028160 _____ (Microsoft Corporation) C:\windows\system32\secur32.dll2015-05-13 22:54 - 2015-04-27 14:23 - 00022016 _____ (Microsoft Corporation) C:\windows\system32\credssp.dll2015-05-13 22:54 - 2015-04-27 14:23 - 00016384 _____ (Microsoft Corporation) C:\windows\system32\ntvdm64.dll2015-05-13 22:54 - 2015-04-27 14:23 - 00013312 _____ (Microsoft Corporation) C:\windows\system32\wow64cpu.dll2015-05-13 22:54 - 2015-04-27 14:22 - 00404992 _____ (Microsoft Corporation) C:\windows\system32\tracerpt.exe2015-05-13 22:54 - 2015-04-27 14:22 - 00338432 _____ (Microsoft Corporation) C:\windows\system32\conhost.exe2015-05-13 22:54 - 2015-04-27 14:22 - 00296960 _____ (Microsoft Corporation) C:\windows\system32\rstrui.exe2015-05-13 22:54 - 2015-04-27 14:22 - 00112640 _____ (Microsoft Corporation) C:\windows\system32\smss.exe2015-05-13 22:54 - 2015-04-27 14:22 - 00104448 _____ (Microsoft Corporation) C:\windows\system32\logman.exe2015-05-13 22:54 - 2015-04-27 14:22 - 00047104 _____ (Microsoft Corporation) C:\windows\system32\typeperf.exe2015-05-13 22:54 - 2015-04-27 14:22 - 00043008 _____ (Microsoft Corporation) C:\windows\system32\relog.exe2015-05-13 22:54 - 2015-04-27 14:22 - 00031232 _____ (Microsoft Corporation) C:\windows\system32\lsass.exe2015-05-13 22:54 - 2015-04-27 14:22 - 00019456 _____ (Microsoft Corporation) C:\windows\system32\diskperf.exe2015-05-13 22:54 - 2015-04-27 14:21 - 00064000 _____ (Microsoft Corporation) C:\windows\system32\auditpol.exe2015-05-13 22:54 - 2015-04-27 14:18 - 00146432 _____ (Microsoft Corporation) C:\windows\system32\msaudite.dll2015-05-13 22:54 - 2015-04-27 14:18 - 00060416 _____ (Microsoft Corporation) C:\windows\system32\msobjs.dll2015-05-13 22:54 - 2015-04-27 14:16 - 00686080 _____ (Microsoft Corporation) C:\windows\system32\adtschema.dll2015-05-13 22:54 - 2015-04-27 14:16 - 00006656 _____ (Microsoft Corporation) C:\windows\system32\apisetschema.dll2015-05-13 22:54 - 2015-04-27 14:16 - 00006144 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-security-base-l1-1-0.dll2015-05-13 22:54 - 2015-04-27 14:16 - 00005120 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-file-l1-1-0.dll2015-05-13 22:54 - 2015-04-27 14:16 - 00004608 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll2015-05-13 22:54 - 2015-04-27 14:16 - 00004608 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-processthreads-l1-1-0.dll2015-05-13 22:54 - 2015-04-27 14:16 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll2015-05-13 22:54 - 2015-04-27 14:16 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-synch-l1-1-0.dll2015-05-13 22:54 - 2015-04-27 14:16 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-localregistry-l1-1-0.dll2015-05-13 22:54 - 2015-04-27 14:16 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-localization-l1-1-0.dll2015-05-13 22:54 - 2015-04-27 14:16 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll2015-05-13 22:54 - 2015-04-27 14:16 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll2015-05-13 22:54 - 2015-04-27 14:16 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll2015-05-13 22:54 - 2015-04-27 14:16 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-misc-l1-1-0.dll2015-05-13 22:54 - 2015-04-27 14:16 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-memory-l1-1-0.dll2015-05-13 22:54 - 2015-04-27 14:16 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll2015-05-13 22:54 - 2015-04-27 14:16 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-heap-l1-1-0.dll2015-05-13 22:54 - 2015-04-27 14:16 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll2015-05-13 22:54 - 2015-04-27 14:16 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-util-l1-1-0.dll2015-05-13 22:54 - 2015-04-27 14:16 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-string-l1-1-0.dll2015-05-13 22:54 - 2015-04-27 14:16 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-profile-l1-1-0.dll2015-05-13 22:54 - 2015-04-27 14:16 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-io-l1-1-0.dll2015-05-13 22:54 - 2015-04-27 14:16 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-interlocked-l1-1-0.dll2015-05-13 22:54 - 2015-04-27 14:16 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-handle-l1-1-0.dll2015-05-13 22:54 - 2015-04-27 14:16 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-fibers-l1-1-0.dll2015-05-13 22:54 - 2015-04-27 14:16 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll2015-05-13 22:54 - 2015-04-27 14:16 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-delayload-l1-1-0.dll2015-05-13 22:54 - 2015-04-27 14:16 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-debug-l1-1-0.dll2015-05-13 22:54 - 2015-04-27 14:16 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-datetime-l1-1-0.dll2015-05-13 22:54 - 2015-04-27 14:16 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-console-l1-1-0.dll2015-05-13 22:54 - 2015-04-27 14:11 - 03989440 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntkrnlpa.exe2015-05-13 22:54 - 2015-04-27 14:11 - 03934144 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntoskrnl.exe2015-05-13 22:54 - 2015-04-27 14:08 - 01310744 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntdll.dll2015-05-13 22:54 - 2015-04-27 14:05 - 00635392 _____ (Microsoft Corporation) C:\windows\SysWOW64\tdh.dll2015-05-13 22:54 - 2015-04-27 14:05 - 00259584 _____ (Microsoft Corporation) C:\windows\SysWOW64\msv1_0.dll2015-05-13 22:54 - 2015-04-27 14:05 - 00221184 _____ (Microsoft Corporation) C:\windows\SysWOW64\ncrypt.dll2015-05-13 22:54 - 2015-04-27 14:05 - 00172032 _____ (Microsoft Corporation) C:\windows\SysWOW64\wdigest.dll2015-05-13 22:54 - 2015-04-27 14:05 - 00092160 _____ (Microsoft Corporation) C:\windows\SysWOW64\sechost.dll2015-05-13 22:54 - 2015-04-27 14:05 - 00065536 _____ (Microsoft Corporation) C:\windows\SysWOW64\TSpkg.dll2015-05-13 22:54 - 2015-04-27 14:05 - 00043008 _____ (Microsoft Corporation) C:\windows\SysWOW64\srclient.dll2015-05-13 22:54 - 2015-04-27 14:05 - 00022016 _____ (Microsoft Corporation) C:\windows\SysWOW64\secur32.dll2015-05-13 22:54 - 2015-04-27 14:05 - 00014336 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntvdm64.dll2015-05-13 22:54 - 2015-04-27 14:04 - 00641536 _____ (Microsoft Corporation) C:\windows\SysWOW64\advapi32.dll2015-05-13 22:54 - 2015-04-27 14:04 - 00550912 _____ (Microsoft Corporation) C:\windows\SysWOW64\kerberos.dll2015-05-13 22:54 - 2015-04-27 14:04 - 00364544 _____ (Microsoft Corporation) C:\windows\SysWOW64\tracerpt.exe2015-05-13 22:54 - 2015-04-27 14:04 - 00082944 _____ (Microsoft Corporation) C:\windows\SysWOW64\logman.exe2015-05-13 22:54 - 2015-04-27 14:04 - 00040448 _____ (Microsoft Corporation) C:\windows\SysWOW64\typeperf.exe2015-05-13 22:54 - 2015-04-27 14:04 - 00037888 _____ (Microsoft Corporation) C:\windows\SysWOW64\relog.exe2015-05-13 22:54 - 2015-04-27 14:04 - 00025600 _____ (Microsoft Corporation) C:\windows\SysWOW64\setup16.exe2015-05-13 22:54 - 2015-04-27 14:04 - 00017408 _____ (Microsoft Corporation) C:\windows\SysWOW64\credssp.dll2015-05-13 22:54 - 2015-04-27 14:03 - 01114112 _____ (Microsoft Corporation) C:\windows\SysWOW64\kernel32.dll2015-05-13 22:54 - 2015-04-27 14:03 - 00274944 _____ (Microsoft Corporation) C:\windows\SysWOW64\KernelBase.dll2015-05-13 22:54 - 2015-04-27 14:03 - 00096768 _____ (Microsoft Corporation) C:\windows\SysWOW64\sspicli.dll2015-05-13 22:54 - 2015-04-27 14:03 - 00050176 _____ (Microsoft Corporation) C:\windows\SysWOW64\auditpol.exe2015-05-13 22:54 - 2015-04-27 14:03 - 00017408 _____ (Microsoft Corporation) C:\windows\SysWOW64\diskperf.exe2015-05-13 22:54 - 2015-04-27 14:03 - 00005120 _____ (Microsoft Corporation) C:\windows\SysWOW64\wow32.dll2015-05-13 22:54 - 2015-04-27 14:01 - 00146432 _____ (Microsoft Corporation) C:\windows\SysWOW64\msaudite.dll2015-05-13 22:54 - 2015-04-27 14:01 - 00060416 _____ (Microsoft Corporation) C:\windows\SysWOW64\msobjs.dll2015-05-13 22:54 - 2015-04-27 13:59 - 00686080 _____ (Microsoft Corporation) C:\windows\SysWOW64\adtschema.dll2015-05-13 22:54 - 2015-04-27 13:59 - 00006656 _____ (Microsoft Corporation) C:\windows\SysWOW64\apisetschema.dll2015-05-13 22:54 - 2015-04-27 13:59 - 00005120 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll2015-05-13 22:54 - 2015-04-27 13:59 - 00004608 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll2015-05-13 22:54 - 2015-04-27 13:59 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll2015-05-13 22:54 - 2015-04-27 13:59 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll2015-05-13 22:54 - 2015-04-27 13:59 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll2015-05-13 22:54 - 2015-04-27 13:59 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll2015-05-13 22:54 - 2015-04-27 13:59 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll2015-05-13 22:54 - 2015-04-27 13:59 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll2015-05-13 22:54 - 2015-04-27 13:59 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll2015-05-13 22:54 - 2015-04-27 13:59 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll2015-05-13 22:54 - 2015-04-27 13:59 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll2015-05-13 22:54 - 2015-04-27 13:59 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll2015-05-13 22:54 - 2015-04-27 13:59 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll2015-05-13 22:54 - 2015-04-27 13:59 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll2015-05-13 22:54 - 2015-04-27 13:59 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll2015-05-13 22:54 - 2015-04-27 13:59 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll2015-05-13 22:54 - 2015-04-27 13:59 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll2015-05-13 22:54 - 2015-04-27 13:59 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll2015-05-13 22:54 - 2015-04-27 13:59 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll2015-05-13 22:54 - 2015-04-27 13:59 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll2015-05-13 22:54 - 2015-04-27 13:59 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll2015-05-13 22:54 - 2015-04-27 13:59 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll2015-05-13 22:54 - 2015-04-27 13:59 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll2015-05-13 22:54 - 2015-04-27 13:59 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll2015-05-13 22:54 - 2015-04-27 13:06 - 00036864 _____ (Microsoft Corporation) C:\windows\system32\UtcResources.dll2015-05-13 22:54 - 2015-04-27 12:57 - 00007680 _____ (Microsoft Corporation) C:\windows\SysWOW64\instnm.exe2015-05-13 22:54 - 2015-04-27 12:57 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\user.exe2015-05-13 22:54 - 2015-04-27 12:55 - 00006144 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll2015-05-13 22:54 - 2015-04-27 12:55 - 00004608 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll2015-05-13 22:54 - 2015-04-27 12:55 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll2015-05-13 22:54 - 2015-04-27 12:55 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll2015-05-13 22:54 - 2015-04-21 12:14 - 24971776 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll2015-05-13 22:54 - 2015-04-21 11:50 - 00417792 _____ (Microsoft Corporation) C:\windows\system32\html.iec2015-05-13 22:54 - 2015-04-21 11:48 - 00088064 _____ (Microsoft Corporation) C:\windows\system32\MshtmlDac.dll2015-05-13 22:54 - 2015-04-21 11:37 - 00633856 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll2015-05-13 22:54 - 2015-04-21 11:35 - 00816640 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll2015-05-13 22:54 - 2015-04-21 11:34 - 00814080 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll2015-05-13 22:54 - 2015-04-21 11:31 - 06025728 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll2015-05-13 22:54 - 2015-04-21 11:22 - 00490496 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll2015-05-13 22:54 - 2015-04-21 11:09 - 00199680 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll2015-05-13 22:54 - 2015-04-21 11:08 - 00092160 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll2015-05-13 22:54 - 2015-04-21 10:47 - 01359360 _____ (Microsoft Corporation) C:\windows\system32\mshtmlmedia.dll2015-05-13 22:54 - 2015-04-21 10:40 - 14401536 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll2015-05-13 22:54 - 2015-04-21 10:27 - 02352128 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll2015-05-13 22:54 - 2015-04-12 22:28 - 00328704 _____ (Microsoft Corporation) C:\windows\system32\services.exe2015-05-13 22:52 - 2015-04-19 22:17 - 01647104 _____ (Microsoft Corporation) C:\windows\system32\DWrite.dll2015-05-13 22:52 - 2015-04-19 22:17 - 01179136 _____ (Microsoft Corporation) C:\windows\system32\FntCache.dll2015-05-13 22:52 - 2015-04-19 21:56 - 01250816 _____ (Microsoft Corporation) C:\windows\SysWOW64\DWrite.dll2015-05-13 22:52 - 2015-04-19 21:11 - 03204608 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys2015-05-13 22:52 - 2015-04-07 22:29 - 00275456 _____ (Microsoft Corporation) C:\windows\system32\InkEd.dll2015-05-13 22:52 - 2015-04-07 22:29 - 00024576 _____ (Microsoft Corporation) C:\windows\system32\jnwmon.dll2015-05-13 22:52 - 2015-04-07 22:14 - 00216064 _____ (Microsoft Corporation) C:\windows\SysWOW64\InkEd.dll2015-05-13 22:52 - 2015-03-03 23:41 - 00342016 _____ (Microsoft Corporation) C:\windows\system32\apphelp.dll2015-05-13 22:52 - 2015-03-03 23:41 - 00072192 _____ (Microsoft Corporation) C:\windows\system32\aelupsvc.dll2015-05-13 22:52 - 2015-03-03 23:41 - 00023552 _____ (Microsoft Corporation) C:\windows\system32\sdbinst.exe2015-05-13 22:52 - 2015-03-03 23:41 - 00006656 _____ (Microsoft Corporation) C:\windows\system32\shimeng.dll2015-05-13 22:52 - 2015-03-03 23:11 - 00005120 _____ (Microsoft Corporation) C:\windows\SysWOW64\shimeng.dll2015-05-13 22:52 - 2015-03-03 23:10 - 00295936 _____ (Microsoft Corporation) C:\windows\SysWOW64\apphelp.dll2015-05-13 22:52 - 2015-03-03 23:10 - 00020992 _____ (Microsoft Corporation) C:\windows\SysWOW64\sdbinst.exe2015-05-13 22:52 - 2015-02-18 02:06 - 00123904 _____ (Microsoft Corporation) C:\windows\SysWOW64\poqexec.exe2015-05-13 22:52 - 2015-02-18 02:04 - 00142336 _____ (Microsoft Corporation) C:\windows\system32\poqexec.exe2015-05-13 22:52 - 2015-01-28 22:19 - 02543104 _____ (Microsoft Corporation) C:\windows\system32\wpdshext.dll2015-05-13 22:52 - 2015-01-28 22:02 - 02311168 _____ (Microsoft Corporation) C:\windows\SysWOW64\wpdshext.dll==================== One Month Modified files and folders ========(If an entry is included in the fixlist, the file/folder will be moved.)2015-06-08 15:44 - 2012-02-13 00:15 - 00000908 _____ C:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4066985096-3163565410-4042152647-1000UA.job2015-06-08 15:44 - 2009-07-14 00:13 - 00813554 _____ C:\windows\system32\PerfStringBackup.INI2015-06-08 15:43 - 2011-07-06 11:12 - 00000898 _____ C:\windows\Tasks\GoogleUpdateTaskMachineUA.job2015-06-08 15:40 - 2011-07-06 10:43 - 01288149 _____ C:\windows\WindowsUpdate.log2015-06-08 15:39 - 2009-07-13 23:51 - 00081871 _____ C:\windows\setupact.log2015-06-08 15:39 - 2009-07-13 23:45 - 00024608 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A02015-06-08 15:39 - 2009-07-13 23:45 - 00024608 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A02015-06-08 15:32 - 2013-09-10 18:30 - 00000830 _____ C:\windows\Tasks\Adobe Flash Player Updater.job2015-06-08 15:32 - 2012-02-13 00:15 - 00000856 _____ C:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4066985096-3163565410-4042152647-1000Core.job2015-06-08 15:32 - 2011-07-06 11:12 - 00000894 _____ C:\windows\Tasks\GoogleUpdateTaskMachineCore.job2015-06-03 15:41 - 2009-07-14 00:08 - 00000006 ____H C:\windows\Tasks\SA.DAT2015-06-02 22:45 - 2015-04-11 21:28 - 00000000 ___SD C:\windows\SysWOW64\GWX2015-06-02 22:45 - 2015-04-11 21:28 - 00000000 ___SD C:\windows\system32\GWX2015-06-01 23:38 - 2013-03-16 16:43 - 00000000 ____D C:\Program Files\Microsoft Silverlight2015-06-01 23:38 - 2013-03-16 16:43 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight2015-06-01 23:38 - 2009-07-13 23:45 - 00418128 _____ C:\windows\system32\FNTCACHE.DAT2015-05-24 00:48 - 2010-11-21 02:17 - 00000000 ____D C:\Program Files\Windows Journal2015-05-24 00:48 - 2009-07-13 22:20 - 00000000 ____D C:\windows\system32\AdvancedInstallers2015-05-24 00:47 - 2013-07-22 23:15 - 00001945 _____ C:\windows\epplauncher.mif2015-05-24 00:47 - 2013-07-22 23:14 - 00002128 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk2015-05-24 00:46 - 2013-07-22 23:14 - 00000000 ____D C:\Program Files\Microsoft Security Client2015-05-24 00:46 - 2013-07-22 23:14 - 00000000 ____D C:\Program Files (x86)\Microsoft Security Client2015-05-24 00:46 - 2013-07-20 01:04 - 00000000 ____D C:\windows\system32\MRT2015-05-24 00:40 - 2011-08-20 13:03 - 140425016 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe2015-05-23 21:39 - 2012-02-13 00:15 - 00003882 _____ C:\windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-4066985096-3163565410-4042152647-1000UA2015-05-23 21:39 - 2012-02-13 00:15 - 00003486 _____ C:\windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-4066985096-3163565410-4042152647-1000Core2015-05-23 21:38 - 2011-07-06 11:12 - 00003894 _____ C:\windows\System32\Tasks\GoogleUpdateTaskMachineUA2015-05-23 21:34 - 2011-08-21 21:58 - 00000000 ____D C:\ProgramData\Microsoft Help2015-05-23 21:11 - 2013-03-16 16:45 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight==================== Files in the root of some directories =======2014-04-28 23:55 - 2014-04-28 23:57 - 0030720 ___SH () C:\Users\owner\AppData\Roaming\Thumbs.db2014-04-28 14:50 - 2014-04-28 14:50 - 0022544 _____ () C:\Users\owner\AppData\Roaming\UserTile.png2012-08-09 09:24 - 2012-08-09 09:25 - 0006144 ____H () C:\Users\owner\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini2012-05-06 13:00 - 2012-05-06 13:00 - 0000093 ____H () C:\Users\owner\AppData\Local\fusioncache.datSome files in TEMP:====================C:\Users\owner\AppData\Local\Temp\5AEC.exeC:\Users\owner\AppData\Local\Temp\7EF0.exeC:\Users\owner\AppData\Local\Temp\ApnStub.exeC:\Users\owner\AppData\Local\Temp\contentDATs.exeC:\Users\owner\AppData\Local\Temp\E07E.exeC:\Users\owner\AppData\Local\Temp\firefoxjre_exe.exeC:\Users\owner\AppData\Local\Temp\install_reader10_en_chrd_aih.exeC:\Users\owner\AppData\Local\Temp\jre-6u29-windows-i586-iftw-rv.exeC:\Users\owner\AppData\Local\Temp\jre-7u17-windows-i586-iftw.exeC:\Users\owner\AppData\Local\Temp\jsp9s6t0.dllC:\Users\owner\AppData\Local\Temp\lowproc.exeC:\Users\owner\AppData\Local\Temp\ose00000.exeC:\Users\owner\AppData\Local\Temp\SAS50.EXEC:\Users\owner\AppData\Local\Temp\SecurityScan_Release.exeC:\Users\owner\AppData\Local\Temp\SkypeSetup.exeC:\Users\owner\AppData\Local\Temp\SSUPDATE64.EXEC:\Users\owner\AppData\Local\Temp\stubhelper.dllC:\Users\owner\AppData\Local\Temp\The_Weather_Channel_Application.exe==================== Bamital & volsnap Check =================(There is no automatic fix for files that do not pass verification.)C:\Windows\System32\winlogon.exe => File is digitally signedC:\Windows\System32\wininit.exe => File is digitally signedC:\Windows\SysWOW64\wininit.exe => File is digitally signedC:\Windows\explorer.exe => File is digitally signedC:\Windows\SysWOW64\explorer.exe => File is digitally signedC:\Windows\System32\svchost.exe => File is digitally signedC:\Windows\SysWOW64\svchost.exe => File is digitally signedC:\Windows\System32\services.exe => File is digitally signedC:\Windows\System32\User32.dll => File is digitally signedC:\Windows\SysWOW64\User32.dll => File is digitally signedC:\Windows\System32\userinit.exe => File is digitally signedC:\Windows\SysWOW64\userinit.exe => File is digitally signedC:\Windows\System32\rpcss.dll => File is digitally signedC:\Windows\System32\Drivers\volsnap.sys => File is digitally signedLastRegBack: 2015-06-03 18:43==================== End of log ============================ Addition log Additional scan result of Farbar Recovery Scan Tool (x64) Version:08-06-2015Ran by owner at 2015-06-08 15:46:09Running from C:\Users\owner\DesktopBoot Mode: Normal============================================================================== Accounts: =============================Administrator (S-1-5-21-4066985096-3163565410-4042152647-500 - Administrator - Disabled)ASPNET (S-1-5-21-4066985096-3163565410-4042152647-1004 - Limited - Enabled)Guest (S-1-5-21-4066985096-3163565410-4042152647-501 - Limited - Disabled)HomeGroupUser$ (S-1-5-21-4066985096-3163565410-4042152647-1002 - Limited - Enabled)owner (S-1-5-21-4066985096-3163565410-4042152647-1000 - Administrator - Enabled) => C:\Users\owner==================== Security Center ========================(If an entry is included in the fixlist, it will be removed.)AV: Microsoft Security Essentials (Enabled - Up to date) {B7ECF8CD-0188-6703-DBA4-AA65C6ACFB0A}AS: Microsoft Security Essentials (Enabled - Up to date) {0C8D1929-27B2-688D-E114-9117BD2BB1B7}AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}==================== Installed Programs ======================(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 2.5.1.17730 - Adobe Systems Inc.)Adobe Digital Editions 3.0 (HKLM-x32\...\Adobe Digital Editions 3.0) (Version: 3.0.1 - Adobe Systems Incorporated)Adobe Flash Player 17 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 17.0.0.169 - Adobe Systems Incorporated)Adobe Flash Player 17 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 17.0.0.169 - Adobe Systems Incorporated)Adobe Reader X (10.1.1) MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}) (Version: 10.1.1 - Adobe Systems Incorporated)Adobe Reader X (10.1.12) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AA1000000001}) (Version: 10.1.12 - Adobe Systems Incorporated)Adobe Shockwave Player 12.1 (HKLM-x32\...\Adobe Shockwave Player) (Version: 12.1.2.152 - Adobe Systems, Inc.)Apple Application Support (32-bit) (HKLM-x32\...\{447CDCE5-F555-429B-BFA6-642C3C6D684F}) (Version: 3.1.2 - Apple Inc.)Apple Application Support (64-bit) (HKLM\...\{0DF7096B-715A-4233-8633-C7A16ED6D616}) (Version: 3.1.2 - Apple Inc.)Apple Mobile Device Support (HKLM\...\{C4123106-B685-48E6-B9BD-E4F911841EB4}) (Version: 8.1.1.3 - Apple Inc.)Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)Atheros Communications Inc.® AR81Family Gigabit/Fast Ethernet Driver (HKLM-x32\...\{3108C217-BE83-42E4-AE9E-A56A2A92E549}) (Version: 1.0.1.42 - Atheros Communications Inc.)Best Buy pc app (Version: 3.2.0.0 - Best Buy) HiddenBest Buy pc app (x32 Version: 3.2.0.0 - Best Buy) HiddenBonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)Conexant HD Audio (HKLM\...\CNXT_AUDIO_HDA) (Version: 8.54.1.0 - Conexant)D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) HiddenFileViewPro (HKLM\...\FileViewPro_is1) (Version: 4.0 - Solvusoft Corporation)Google Chrome (HKU\S-1-5-21-4066985096-3163565410-4042152647-1000\...\Google Chrome) (Version: 43.0.2357.81 - Google Inc.)Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) HiddenGoogle Update Helper (x32 Version: 1.3.27.5 - Google Inc.) HiddeniCloud (HKLM\...\{309768A4-A2BB-4930-A5A2-8169678C9B4C}) (Version: 4.0.6.28 - Apple Inc.)Intel® Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 7.0.0.1144 - Intel Corporation)Intel® Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2353 - Intel Corporation)Intel® Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 10.1.0.1008 - Intel Corporation)iTunes (HKLM\...\{D227565A-0033-40AD-89BA-653A205CDC11}) (Version: 12.1.1.4 - Apple Inc.)Java 7 Update 51 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217025FF}) (Version: 7.0.510 - Oracle)Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) HiddenLabel@Once 1.0 (HKLM-x32\...\{0D795777-9D60-4692-8386-F2B3F2B5E5BF}) (Version: 1.0 - Corel)Malwarebytes Anti-Malware version 1.75.0.1300 (HKLM-x32\...\Malwarebytes' Anti-Malware_is1) (Version: 1.75.0.1300 - Malwarebytes Corporation)McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.8.150.1 - McAfee, Inc.)Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) HiddenMicrosoft .NET Framework 1.1 (HKLM-x32\...\Microsoft .NET Framework 1.1 (1033)) (Version: - )Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{91120000-002E-0000-0000-0000000FF1CE}_ULTIMATER_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)Microsoft Office Ultimate 2007 (HKLM-x32\...\ULTIMATER) (Version: 12.0.6612.1000 - Microsoft Corporation)Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.8.204.0 - Microsoft Corporation)Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40416.0 - Microsoft Corporation)Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)Microsoft Visual C++ 2005 Redistributable - KB2467175 (HKLM-x32\...\{a0fe116e-9a8a-466f-aee0-625cb7c207e3}) (Version: 8.0.51011 - Microsoft Corporation)Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{3C3D696B-0DB7-3C6D-A356-3DB8CE541918}) (Version: 9.0.30729 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319 (HKLM-x32\...\{196BB40D-1578-3D01-B289-BEFC77A11A1E}) (Version: 10.0.30319 - Microsoft Corporation)MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)Norton Security Scan (HKLM-x32\...\NSS) (Version: 4.1.0.28 - Symantec Corporation)PlayReady PC Runtime amd64 (HKLM\...\{BCA9334F-B6C9-4F65-9A73-AC5A329A4D04}) (Version: 1.3.0 - Microsoft Corporation)PlayReady PC Runtime x86 (HKLM-x32\...\{CCA5EAAD-92F4-4B7A-B5EE-14294C66AB61}) (Version: 1.3.0 - Microsoft Corporation)QuickTime 7 (HKLM-x32\...\{3D2CBC2C-65D4-4463-87AB-BB2C859C1F3E}) (Version: 7.76.80.95 - Apple Inc.)RealDownloader (x32 Version: 17.0.15.4 - RealNetworks, Inc.) HiddenRealDownloader (x32 Version: 17.0.15.7 - RealNetworks) HiddenRealNetworks - Microsoft Visual C++ 2008 Runtime (x32 Version: 9.0 - RealNetworks, Inc) HiddenRealNetworks - Microsoft Visual C++ 2010 Runtime (Version: 10.0 - RealNetworks, Inc) HiddenRealNetworks - Microsoft Visual C++ 2010 Runtime (x32 Version: 10.0 - RealNetworks, Inc) HiddenRealPlayer (HKLM-x32\...\RealPlayer 15.0) (Version: - RealNetworks)RealPlayer Cloud (HKLM-x32\...\RealPlayer 17.0) (Version: 17.0.15 - RealNetworks)Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.7600.30124 - Realtek Semiconductor Corp.)Realtek WLAN Driver (HKLM-x32\...\{9D3D8C60-A55F-4fed-B2B9-173001290E16}) (Version: 2.00.0016 - REALTEK Semiconductor Corp.)RealUpgrade 1.1 (x32 Version: 1.1.0 - RealNetworks, Inc.) HiddenSUPERAntiSpyware (HKLM\...\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}) (Version: 4.46.1000 - SUPERAntiSpyware.com)swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) HiddenSynaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.0.8.1 - Synaptics Incorporated)TOSHIBA Application Installer (HKLM-x32\...\{970472D0-F5F9-4158-A6E3-1AE49EFEF2D3}) (Version: 9.0.1.1 - TOSHIBA)TOSHIBA Assist (HKLM-x32\...\{C2A276E3-154E-44DC-AAF1-FFDD7FD30E35}) (Version: 4.02.02 - TOSHIBA CORPORATION)TOSHIBA Bulletin Board (HKLM-x32\...\InstallShield_{C14518AF-1A0F-4D39-8011-69BAA01CD380}) (Version: 1.6.08.64 - TOSHIBA Corporation)TOSHIBA Disc Creator (HKLM\...\{5DA0E02F-970B-424B-BF41-513A5018E4C0}) (Version: 2.1.0.6 for x64 - TOSHIBA Corporation)TOSHIBA Face Recognition (HKLM-x32\...\InstallShield_{F67FA545-D8E5-4209-86B1-AEE045D1003F}) (Version: 3.1.8.64 - TOSHIBA Corporation)TOSHIBA Hardware Setup (HKLM-x32\...\{97965331-BC5D-4D9F-B6DF-5C0A123E4AE0}) (Version: 2.1.0.1 - TOSHIBA Corporation)TOSHIBA HDD/SSD Alert (HKLM-x32\...\InstallShield_{D4322448-B6AF-4316-B859-D8A0E84DCB38}) (Version: 3.1.64.7 - TOSHIBA Corporation)TOSHIBA Media Controller (HKLM-x32\...\{C7A4F26F-F9B0-41B2-8659-99181108CDE3}) (Version: 1.0.86.2 - TOSHIBA CORPORATION)TOSHIBA Media Controller Plug-in (HKLM-x32\...\{F26FDF57-483E-42C8-A9C9-EEE1EDB256E0}) (Version: 1.0.6.1 - TOSHIBA CORPORATION)TOSHIBA Quality Application (HKLM-x32\...\{E69992ED-A7F6-406C-9280-1C156417BC49}) (Version: 1.0.3 - TOSHIBA)TOSHIBA Recovery Media Creator (HKLM-x32\...\{B65BBB06-1F8E-48F5-8A54-B024A9E15FDF}) (Version: 2.1.3.5109 - TOSHIBA CORPORATION)TOSHIBA ReelTime (HKLM-x32\...\InstallShield_{24811C12-F4A9-4D0F-8494-A7B8FE46123C}) (Version: 1.7.17.64 - TOSHIBA Corporation)TOSHIBA Resolution+ Plug-in for Windows Media Player (HKLM-x32\...\{6CB76C9D-80C2-4CB3-A4CD-D96B239E3F94}) (Version: 1.1.0 - TOSHIBA Corporation)TOSHIBA Service Station (HKLM-x32\...\{AC6569FA-6919-442A-8552-073BE69E247A}) (Version: 2.2.9 - TOSHIBA)TOSHIBA Supervisor Password (HKLM-x32\...\{0AF17224-CF88-40B8-BB1A-D179369847B4}) (Version: 2.1.0.1 - TOSHIBA Corporation)TOSHIBA Value Added Package (HKLM-x32\...\InstallShield_{066CFFF8-12BF-4390-A673-75F95EFF188E}) (Version: 1.5.4.64 - TOSHIBA Corporation)TOSHIBA Web Camera Application (HKLM-x32\...\InstallShield_{6F3C8901-EBD3-470D-87F8-AC210F6E5E02}) (Version: 2.0.0.19 - TOSHIBA Corporation)TOSHIBA Wireless LAN Indicator (HKLM-x32\...\{CDADE9BC-612C-42B8-B929-5C6A823E7FF9}) (Version: 1.0.3 - TOSHIBA CORPORATION)ToshibaRegistration (HKLM-x32\...\{5AF550B4-BB67-4E7E-82F1-2C4300279050}) (Version: 1.0.4 - Toshiba)Uninstall Helper (HKLM-x32\...\Uninstall Helper 2.0.1.0) (Version: 2.0.1.0 - InstallX, LLC) <==== ATTENTIONUninstall Helper (x32 Version: 2.0.1.0 - InstallX, LLC) Hidden <==== ATTENTIONUpdate for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{91120000-002E-0000-0000-0000000FF1CE}_ULTIMATER_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)UpdateService (x32 Version: 1.0.0 - RealNetworks, Inc.) HiddenVideo Downloader (x32 Version: 1.0.0 - RealNetworks) HiddenWindows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3508.1109 - Microsoft Corporation)Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation)WinZip 17.5 (HKLM\...\{CD95F661-A5C4-44F5-A6AA-ECDD91C240DB}) (Version: 17.5.10480 - WinZip Computing, S.L. )Yahoo! Messenger (HKLM-x32\...\Yahoo! Messenger) (Version: - Yahoo! Inc.)Yahoo! Software Update (HKLM-x32\...\Yahoo! Software Update) (Version: - )==================== Custom CLSID (Whitelisted): ==========================(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)CustomCLSID: HKU\S-1-5-21-4066985096-3163565410-4042152647-1000_Classes\CLSID\{0F22A205-CFB0-4679-8499-A6F44A80A208}\InprocServer32 -> C:\Users\owner\AppData\Local\Google\Update\1.3.25.5\psuser_64.dll No FileCustomCLSID: HKU\S-1-5-21-4066985096-3163565410-4042152647-1000_Classes\CLSID\{1423F872-3F7F-4E57-B621-8B1A9D49B448}\InprocServer32 -> C:\Users\owner\AppData\Local\Google\Update\1.3.27.5\psuser_64.dll (Google Inc.)CustomCLSID: HKU\S-1-5-21-4066985096-3163565410-4042152647-1000_Classes\CLSID\{355EC88A-02E2-4547-9DEE-F87426484BD1}\InprocServer32 -> C:\Users\owner\AppData\Local\Google\Update\1.3.23.9\psuser_64.dll No FileCustomCLSID: HKU\S-1-5-21-4066985096-3163565410-4042152647-1000_Classes\CLSID\{3560575F-7C2D-48AE-AB45-DAD430A95EBE}\InprocServer32 -> C:\Program Files\WinZip\adxloader64.dll ()CustomCLSID: HKU\S-1-5-21-4066985096-3163565410-4042152647-1000_Classes\CLSID\{90B3DFBF-AF6A-4EA0-8899-F332194690F8}\InprocServer32 -> C:\Users\owner\AppData\Local\Google\Update\1.3.24.15\psuser_64.dll No FileCustomCLSID: HKU\S-1-5-21-4066985096-3163565410-4042152647-1000_Classes\CLSID\{C3BC25C0-FCD3-4F01-AFDD-41373F017C9A}\InprocServer32 -> C:\Users\owner\AppData\Local\Google\Update\1.3.26.9\psuser_64.dll No FileCustomCLSID: HKU\S-1-5-21-4066985096-3163565410-4042152647-1000_Classes\CLSID\{D0336C0B-7919-4C04-8CCE-2EBAE2ECE8C9}\InprocServer32 -> C:\Users\owner\AppData\Local\Google\Update\1.3.25.11\psuser_64.dll No FileCustomCLSID: HKU\S-1-5-21-4066985096-3163565410-4042152647-1000_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\owner\AppData\Local\Google\Update\1.3.27.5\psuser_64.dll (Google Inc.)CustomCLSID: HKU\S-1-5-21-4066985096-3163565410-4042152647-1000_Classes\CLSID\{FE498BAB-CB4C-4F88-AC3F-3641AAAF5E9E}\InprocServer32 -> C:\Users\owner\AppData\Local\Google\Update\1.3.24.7\psuser_64.dll No File==================== Restore Points =========================15-04-2015 18:24:25 Windows Update15-04-2015 23:24:05 Removed Citrix Online Launcher15-04-2015 23:32:11 Removed Inmagic DB/TextWorks15-04-2015 23:37:09 Removed Safari15-04-2015 23:39:33 Removed Skype™ 6.1115-04-2015 23:58:47 Removed Facebook Messenger 2.1.4814.015-04-2015 23:59:29 Removed Java 6 Update 3130-04-2015 21:21:48 Windows Update01-05-2015 00:03:50 Windows Update05-05-2015 20:03:13 Windows Update13-05-2015 22:18:14 Windows Update23-05-2015 21:04:40 Windows Update24-05-2015 00:39:37 Windows Update02-06-2015 19:36:52 Windows Update02-06-2015 22:45:04 Windows Update==================== Hosts content: ===============================(If needed Hosts: directive could be included in the fixlist to reset Hosts.)2009-07-13 21:34 - 2009-06-10 16:00 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts==================== Scheduled Tasks (Whitelisted) =============(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)Task: {0537E315-19E5-437E-B893-36703C6DE625} - System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-4066985096-3163565410-4042152647-1000 => C:\Program Files (x86)\RealNetworks\RealDownloader\realupgrade.exe [2014-10-27] (RealNetworks, Inc.)Task: {0C054A74-0A9F-4FBF-929C-557AF5C9FCA1} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-4066985096-3163565410-4042152647-1000Core => C:\Users\owner\AppData\Local\Google\Update\GoogleUpdate.exe [2014-10-17] (Google Inc.)Task: {14B7CD49-0A18-4620-93DA-75324C5CEE74} - \AdobeFlashPlayerUpdate No Task File <==== ATTENTIONTask: {29929080-52B3-44B0-9D78-279727CDDB74} - System32\Tasks\Norton Security Scan for owner => C:\Program Files (x86)\Norton Security Scan\Engine\4.1.0.28\Nss.exe [2014-01-27] (Symantec Corporation)Task: {31189136-4CA7-47C8-991E-F00FFF2EA4CC} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-4066985096-3163565410-4042152647-1000UA => C:\Users\owner\AppData\Local\Google\Update\GoogleUpdate.exe [2014-10-17] (Google Inc.)Task: {6D5C6DF0-02F1-422A-B348-DB5A035065FC} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-05-07] (Microsoft Corporation)Task: {75CB4273-03B0-4755-B445-EACC0DA1F371} - System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-4066985096-3163565410-4042152647-1000 => C:\Program Files (x86)\RealNetworks\RealDownloader\realupgrade.exe [2014-10-27] (RealNetworks, Inc.)Task: {75CF58F5-6410-428E-A306-A56928166732} - System32\Tasks\Microsoft\Windows\Windows Activation Technologies\ValidationTask => C:\Windows\system32\Wat\WatAdminSvc.exe [2011-08-20] (Microsoft Corporation)Task: {78E4ECBB-DCDF-42A7-AFF5-AB7711F74E6D} - System32\Tasks\SidebarExecute => C:\Program Files\Windows Sidebar\sidebar.exe [2010-11-20] (Microsoft Corporation)Task: {7A2A7C60-A66C-4F96-9F94-30FC479740A6} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)Task: {7EE54CDD-C331-473D-9359-03E9D8A409BC} - System32\Tasks\{C2A04334-4884-491A-8FC0-21B42FB55358} => pcalua.exe -a C:\Users\owner\AppData\Local\Temp\firefoxjre_exe.exe -d "C:\Program Files (x86)\Mozilla Firefox"Task: {8E46563C-ACFA-4502-8611-240BA94BAE0C} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-04-15] (Adobe Systems Incorporated)Task: {939DDC0A-0AA7-46E5-9624-CFF9BD18CB90} - System32\Tasks\RealUpgradeScheduledTaskS-1-5-21-4066985096-3163565410-4042152647-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2014-10-30] (RealNetworks, Inc.)Task: {9C39A8D9-35D3-478F-82D4-31A545165ABD} - System32\Tasks\RealUpgradeLogonTaskS-1-5-21-4066985096-3163565410-4042152647-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2014-10-30] (RealNetworks, Inc.)Task: {B975CE6C-0F66-44E9-8CB5-22D2E1893036} - System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-4066985096-3163565410-4042152647-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2014-10-30] (RealNetworks, Inc.)Task: {BB460EA7-552D-4D88-A591-BB1A59F71FF8} - System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-4066985096-3163565410-4042152647-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2014-10-30] (RealNetworks, Inc.)Task: {D292D502-C328-4158-9DEA-749D55543AA3} - \AdobeFlashPlayerUpdate 2 No Task File <==== ATTENTIONTask: {E4951160-47E0-4C53-9FB6-51AF2835457F} - System32\Tasks\Microsoft\Windows\Setup\gwx\launchtrayprocess => C:\Windows\system32\GWX\GWX.exe [2015-05-07] (Microsoft Corporation)Task: {E910488F-3DC1-4C6E-A1F7-DB9AA1627870} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-11-16] (Google Inc.)Task: {F1C0D46F-1385-4B0F-8742-1E9553B94FE4} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-11-16] (Google Inc.)Task: {F3359801-1052-4311-89C5-F6082D8F4730} - System32\Tasks\RealDownloader Update Check => C:\Program Files (x86)\RealNetworks\RealDownloader\downloader2.exe [2014-10-29] ()Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exeTask: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exeTask: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exeTask: C:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4066985096-3163565410-4042152647-1000Core.job => C:\Users\owner\AppData\Local\Google\Update\GoogleUpdate.exeTask: C:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4066985096-3163565410-4042152647-1000UA.job => C:\Users\owner\AppData\Local\Google\Update\GoogleUpdate.exeTask: C:\windows\Tasks\Norton Security Scan for owner.job => C:\PROGRA~2\NORTON~2\Engine\410~1.28\Nss.exe==================== Loaded Modules (Whitelisted) ==============2015-01-20 23:35 - 2015-01-20 23:35 - 00085832 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll2015-01-20 23:35 - 2015-01-20 23:35 - 01346344 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll2014-10-26 23:59 - 2014-10-26 23:59 - 00039568 _____ () C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe2014-10-30 06:41 - 2014-10-30 06:41 - 00031856 _____ () C:\Program Files (x86)\Real\UpdateService\RealPlayerUpdateSvc.exe2011-04-04 21:18 - 2011-04-04 21:18 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll2010-11-18 19:18 - 2010-11-18 19:18 - 11190784 _____ () C:\Program Files\TOSHIBA\FlashCards\BlackPng.dll2014-10-29 20:06 - 2014-10-29 20:06 - 00560192 _____ () C:\Program Files (x86)\RealNetworks\RealDownloader\downloader2.exe2010-12-08 17:42 - 2010-12-08 17:42 - 00079264 _____ () C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosIPCWraper.dll2015-02-28 17:20 - 2015-02-28 17:20 - 00865880 _____ () c:\program files (x86)\real\realplayer\RPDS\Plugins\cldplin.dll2014-10-30 06:41 - 2014-10-30 06:41 - 00035976 _____ () C:\Program Files (x86)\Real\UpdateService\DL2UpdatePlugin.dll2014-10-30 06:41 - 2014-10-30 06:41 - 00039560 _____ () C:\Program Files (x86)\Real\UpdateService\RealDownloaderUpdatePlugin.dll2014-10-30 06:41 - 2014-10-30 06:41 - 00032888 _____ () C:\Program Files (x86)\Real\UpdateService\RPDSUpdatePlugin.dll2014-10-29 20:01 - 2014-10-29 20:01 - 01382048 _____ () C:\Program Files (x86)\RealNetworks\RealDownloader\cpprest100_1_2.dll2014-10-29 20:07 - 2014-10-29 20:07 - 00065600 _____ () C:\Program Files (x86)\RealNetworks\RealDownloader\dtvhooks.dll2011-08-23 17:54 - 2011-06-16 07:55 - 00925696 _____ () C:\Program Files (x86)\Yahoo!\Messenger\yui.dll==================== Alternate Data Streams (Whitelisted) =========(If an entry is included in the fixlist, only the ADS will be removed.)==================== Safe Mode (Whitelisted) ===================(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)==================== EXE Association (Whitelisted) ===============(If an entry is included in the fixlist, the registry item will be restored to default or removed.)==================== Internet Explorer trusted/restricted ===============(If an entry is included in the fixlist, it will be removed from the registry.)==================== Other Areas ============================(Currently there is no automatic fix for this section.)HKU\S-1-5-21-4066985096-3163565410-4042152647-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\owner\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpgDNS Servers: 192.168.1.254==================== MSCONFIG/TASK MANAGER disabled items ==(Currently there is no automatic fix for this section.)==================== FirewallRules (Whitelisted) ===============(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)FirewallRules: [{76FD7710-A70F-498E-A202-C10712C62C18}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exeFirewallRules: [{CD0EF3BE-86F3-4452-BCA5-0AC2147D8808}] => (Allow) LPort=2869FirewallRules: [{6D1C6BE3-E8BF-460F-92A0-A06E488A8223}] => (Allow) LPort=1900FirewallRules: [{479945B7-9FFC-4A7B-9F3F-A06488AD70A1}] => (Allow) C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exeFirewallRules: [{E5FCA8BD-6544-434B-9D29-A271568852C8}] => (Allow) C:\Program Files (x86)\Windows Live\Mesh\MOE.exeFirewallRules: [{8402DE9A-2365-45BB-AE5B-7D87561D0083}] => (Allow) C:\Program Files (x86)\Yahoo!\Messenger\YahooMessenger.exeFirewallRules: [{9821F3B0-DFCD-486E-87BB-1AF4ADD33B99}] => (Allow) C:\Program Files (x86)\Yahoo!\Messenger\YahooMessenger.exeFirewallRules: [TCP Query User{3F06FC9F-019C-41BD-8B0E-FFD4280FB7D2}C:\program files (x86)\real\realplayer\realplay.exe] => (Allow) C:\program files (x86)\real\realplayer\realplay.exeFirewallRules: [uDP Query User{D51F90DB-A23F-46B7-885B-7AEAEB9FD896}C:\program files (x86)\real\realplayer\realplay.exe] => (Allow) C:\program files (x86)\real\realplayer\realplay.exeFirewallRules: [{5925D03E-6951-4F5E-9416-AC77A630F836}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exeFirewallRules: [{5F214380-2830-4B65-8961-D18C3C930DC7}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exeFirewallRules: [{7408050A-5203-422C-B62B-BFC4DC04885C}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exeFirewallRules: [{4081B74B-AEBC-4339-8118-CBC0E580287E}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exeFirewallRules: [TCP Query User{86A2D9C2-D651-4604-B639-D12BBEA6AE79}C:\program files (x86)\java\jre7\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre7\bin\javaw.exeFirewallRules: [uDP Query User{C4C7F789-83BD-4788-A4CD-176995A371AD}C:\program files (x86)\java\jre7\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre7\bin\javaw.exeFirewallRules: [{7BAE9317-267A-40DE-94DD-B17EE50B24FC}] => (Allow) c:\program files (x86)\real\realplayer\RPDS\Bin\rpdsvc.exeFirewallRules: [{F3914444-8CF6-4661-B7F6-747FCB9C5531}] => (Allow) C:\Program Files\iTunes\iTunes.exeFirewallRules: [{0D119882-900E-403D-9022-4BFDE5205ED6}] => (Allow) C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe==================== Faulty Device Manager Devices ================================= Event log errors: =========================Application errors:==================Error: (06/03/2015 07:33:21 PM) (Source: Bonjour Service) (EventID: 100) (User: )Description: Task Scheduling Error: m->NextScheduledSPRetry 16021Error: (06/03/2015 07:33:21 PM) (Source: Bonjour Service) (EventID: 100) (User: )Description: Task Scheduling Error: m->NextScheduledEvent 16021Error: (06/03/2015 07:33:21 PM) (Source: Bonjour Service) (EventID: 100) (User: )Description: Task Scheduling Error: Continuously busy for more than a secondError: (06/03/2015 07:33:20 PM) (Source: Bonjour Service) (EventID: 100) (User: )Description: Task Scheduling Error: m->NextScheduledSPRetry 15007Error: (06/03/2015 07:33:20 PM) (Source: Bonjour Service) (EventID: 100) (User: )Description: Task Scheduling Error: m->NextScheduledEvent 15007Error: (06/03/2015 07:33:20 PM) (Source: Bonjour Service) (EventID: 100) (User: )Description: Task Scheduling Error: Continuously busy for more than a secondError: (06/03/2015 07:33:19 PM) (Source: Bonjour Service) (EventID: 100) (User: )Description: Task Scheduling Error: m->NextScheduledSPRetry 14009Error: (06/03/2015 07:33:19 PM) (Source: Bonjour Service) (EventID: 100) (User: )Description: Task Scheduling Error: m->NextScheduledEvent 14009Error: (06/03/2015 07:33:19 PM) (Source: Bonjour Service) (EventID: 100) (User: )Description: Task Scheduling Error: Continuously busy for more than a secondError: (06/03/2015 07:33:18 PM) (Source: Bonjour Service) (EventID: 100) (User: )Description: Task Scheduling Error: m->NextScheduledSPRetry 13010System errors:=============Error: (06/08/2015 03:39:51 PM) (Source: Disk) (EventID: 11) (User: )Description: The driver detected a controller error on \Device\Harddisk1\DR2.Error: (06/08/2015 03:39:45 PM) (Source: Disk) (EventID: 11) (User: )Description: The driver detected a controller error on \Device\Harddisk1\DR2.Error: (06/08/2015 03:39:43 PM) (Source: Disk) (EventID: 11) (User: )Description: The driver detected a controller error on \Device\Harddisk1\DR2.Error: (06/08/2015 03:39:42 PM) (Source: Disk) (EventID: 11) (User: )Description: The driver detected a controller error on \Device\Harddisk1\DR2.Error: (06/08/2015 03:39:42 PM) (Source: Disk) (EventID: 11) (User: )Description: The driver detected a controller error on \Device\Harddisk1\DR2.Error: (06/08/2015 03:39:41 PM) (Source: Disk) (EventID: 11) (User: )Description: The driver detected a controller error on \Device\Harddisk1\DR2.Error: (06/03/2015 05:25:24 PM) (Source: DCOM) (EventID: 10010) (User: )Description: {995C996E-D918-4A8C-A302-45719A6F4EA7}Error: (06/03/2015 05:25:21 PM) (Source: Service Control Manager) (EventID: 7011) (User: )Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the ShellHWDetection service.Error: (06/02/2015 07:33:01 PM) (Source: Service Control Manager) (EventID: 7011) (User: )Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the eventlog service.Error: (06/02/2015 07:32:01 PM) (Source: Service Control Manager) (EventID: 7011) (User: )Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the eventlog service.Microsoft Office:=========================Error: (11/01/2011 08:42:49 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )Description: ID: 13, Application Name: Microsoft Office OneNote, Application Version: 12.0.6500.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 18 seconds with 0 seconds of active time. This session ended with a crash.==================== Memory info ===========================Processor: Intel® Core i3-2310M CPU @ 2.10GHzPercentage of memory in use: 85%Total physical RAM: 3019.86 MBAvailable physical RAM: 425.92 MBTotal Pagefile: 6037.93 MBAvailable Pagefile: 2530.36 MBTotal Virtual: 8192 MBAvailable Virtual: 8191.84 MB==================== Drives ================================Drive c: (TI106136W0E) (Fixed) (Total:285.15 GB) (Free:219.47 GB) NTFS ==>[system with boot components (obtained from reading drive)]Drive e: (GSP1RMCPRXF) (Removable) (Total:14.55 GB) (Free:14.44 GB) NTFS==================== MBR & Partition Table ==========================================================================Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 298.1 GB) (Disk ID: 95469684)Partition 1: (Active) - (Size=1.5 GB) - (Type=27)Partition 2: (Not Active) - (Size=285.1 GB) - (Type=07 NTFS)Partition 3: (Not Active) - (Size=11.5 GB) - (Type=17)========================================================Disk: 1 (Size: 14.6 GB) (Disk ID: 00000000)Partition: GPT Partition Type.==================== End of log ============================ Link to post Share on other sites More sharing options...
TwinHeadedEagle Posted June 8, 2015 ID:968044 Share Posted June 8, 2015 Hello, It would be nice to first finish with your previous topic: https://forums.malwarebytes.org/index.php?/topic/169143-laptop-infected/ Link to post Share on other sites More sharing options...
jamesost Posted June 8, 2015 Author ID:968046 Share Posted June 8, 2015 No problem. I thought since there were two laptops I would just make two separate posts to keep things organized, but we can just leave this post on the boards and bump it once the other one is done. Appreciate the help....I'm about to post the fresh logs on the other thread. Thanks. Link to post Share on other sites More sharing options...
TwinHeadedEagle Posted June 8, 2015 ID:968055 Share Posted June 8, 2015 Can you attach report like you did with first topic? Thanks Link to post Share on other sites More sharing options...
jamesost Posted June 9, 2015 Author ID:968091 Share Posted June 9, 2015 Reports attached. Thank you. Addition.txtFRST.txt Link to post Share on other sites More sharing options...
TwinHeadedEagle Posted June 9, 2015 ID:968127 Share Posted June 9, 2015 Fine. We'll continue when we finish with previous one. Link to post Share on other sites More sharing options...
jamesost Posted June 11, 2015 Author ID:968501 Share Posted June 11, 2015 Now that we are done with laptop #1, do I need to repost new logs for this? It's been off the entire time, but thought I'd check. Link to post Share on other sites More sharing options...
TwinHeadedEagle Posted June 11, 2015 ID:968504 Share Posted June 11, 2015 Uninstall some programs We need to uninstall some unwanted/unneeded programs.Press the + R on your keyboard at the same time. Type appwiz.cpl and click OK.Search there for each entry mentioned below, right-click the entry and click Uninstall one at a timeThe list of programs to uninstall:Uninstall HelperAfter completing uninstalls, please manually reboot your machine! Note: If you get the message like: An error occurred while trying to uninstall, just press Yes. Fix with Farbar Recovery Scan Tool This fix was created for this user for use on that particular machine. Running it on another one may cause damage and render the system unstable. Download attached fixlist.txt file and save it to the Desktop: Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!Right-click on icon and select Run as Administrator to start the tool.(XP users click run after receipt of Windows Security Warning - Open File).Press the Fix button just once and wait.If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.When finished FRST will generate a log on the Desktop, called Fixlog.txt.Please upload it to your reply.fixlist.txt Link to post Share on other sites More sharing options...
jamesost Posted June 11, 2015 Author ID:968558 Share Posted June 11, 2015 Hmmmm....well I ran the fix and had both files in the same place just as we did with the other laptop, but with this one the FRST program finished and closed at some point and now it's just showing my desktop background....no icons, no start menu, nothing. Just a background and the mouse cursor. Been like this for some time. Link to post Share on other sites More sharing options...
TwinHeadedEagle Posted June 11, 2015 ID:968568 Share Posted June 11, 2015 Just restart your PC. Two times if needed. Link to post Share on other sites More sharing options...
jamesost Posted June 11, 2015 Author ID:968578 Share Posted June 11, 2015 fixlog attachedFixlog.txt Link to post Share on other sites More sharing options...
TwinHeadedEagle Posted June 11, 2015 ID:968580 Share Posted June 11, 2015 Hm. Didn't work well. Can you try again? In safe mode? Link to post Share on other sites More sharing options...
jamesost Posted June 11, 2015 Author ID:968587 Share Posted June 11, 2015 Booted into Safe Mode and ran fixlist again. This time it restarted normally and I didn't have to force it. Attached new log.Fixlog.txt Link to post Share on other sites More sharing options...
TwinHeadedEagle Posted June 11, 2015 ID:968590 Share Posted June 11, 2015 Very good. How is PC behaving now? Link to post Share on other sites More sharing options...
jamesost Posted June 11, 2015 Author ID:968597 Share Posted June 11, 2015 The start up and web browsing is faster for sure. No popups yet. Link to post Share on other sites More sharing options...
TwinHeadedEagle Posted June 11, 2015 ID:968604 Share Posted June 11, 2015 Good. Keep me updated. Link to post Share on other sites More sharing options...
jamesost Posted June 12, 2015 Author ID:968666 Share Posted June 12, 2015 So I guess this one wasn't too bad....usually when I do this they have me run through Combofix, Dr Cure it, Adware this, spyware that, etc etc lol. With this laptop and the other one, this is the first time no one asked me to run Combofix hahaha So far still running fine. Link to post Share on other sites More sharing options...
TwinHeadedEagle Posted June 12, 2015 ID:968729 Share Posted June 12, 2015 ComboFix isn't updated couple of years I think, so it is not used as much as before. Can we mark this as solved? Link to post Share on other sites More sharing options...
jamesost Posted June 12, 2015 Author ID:968765 Share Posted June 12, 2015 Yes. I think we're good to go. I have to do a few clean up things still, but I shouldn't need any more help in that matter. Thanks for the help on the two computers. I'll be sending in a donation later today for your help. Link to post Share on other sites More sharing options...
TwinHeadedEagle Posted June 12, 2015 ID:968778 Share Posted June 12, 2015 Thank you Glad I could help. We will delete all used tools and I'll give you some tips to harden your security and learn how to protect yourself Recommended reading: MUST READ - security tips:Computer Security - a short guide to staying safer online.Simple and easy ways to keep your computer safe and secure on the InternetHow Malware Spreads - How did I get infectedMUST READ - general maintenance:What to do if your Computer is running slowly?The Importance of Software Updating: In order to stay protected it is very important that you regularly update all of your software. Cybercriminals depend on the apathy of users around software updates to keep their malicious endeavor running. Operating systems, such as Windows, and applications, such as Adobe Reader or JAVA, are used by tens of millions of computers and devices around the world, making them a huge target for cybercriminals. Downloading updates and installing them can sometimes be tedious, but the advantages you get from the updates are certainly worth it.How to configure and use Automatic Updates in WindowsHow to update JavaHow to update Adobe ReaderRecommended additional software: CCleaner - to clean unneeded temporary files.Malwarebytes' Anti-Malware - to scan your system from time to time in search for malware.Malwarebytes' Anti-Exploit - to prevent plenty of mostly exploited vulnerabilities.McShield - to prevent infections spread by removable media.Unchecky - to prevent from installing additional foistware, implemented in legitimate installations.Adblock - to surf the web without annoying ads! Post-cleanup procedures: Download DelFix by Xplode and save it to your desktop.Run the tool by right click on the icon and Run as administrator option.Make sure that these ones are checked:Remove disinfection toolsPurge system restoreReset system settingsPush Run.The program will run for a few seconds and display a notepad report. You do not need to attach it.The tool will also record healthy state of registry and make a backup using ERUNT program in %windir%\ERUNT\DelFixTool deletes old system restore points and create a fresh system restore point after cleaning. My help is free for everybody.If you're happy with the help provided and/or wish to show your appreciation for the assistance you received, then you can consider a donation: Thank you! Stay safe,TwinHeadedEagle Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted June 25, 2015 Root Admin ID:971665 Share Posted June 25, 2015 Glad we could help. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread. Thanks! Link to post Share on other sites More sharing options...
Recommended Posts