Jump to content

PUP.Mindspark detection

unjulienne
 Share

Recommended Posts

unjulienne

unjulienne

Posted
Posted

Hello! 

 

I scanned Malwarebytes Free and came with 4 detection from the threat scan, all of them PUP.Mindspark.

I kept them in the quarantine section in Malwarebytes.

I followed some of the steps here in the forum such as the adwcleaner (i ran the scan and cleaned some of them), then I ran the FRST next and came up with these reports:

 

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 08-06-2015
Ran by windows 7 (administrator) on WINDOWS7-PC on 09-06-2015 11:56:46
Running from C:\Users\windows 7\Downloads
Loaded Profiles: windows 7 (Available Profiles: windows 7 & rishibility & ingrid)
Platform: Microsoft Windows 7 Ultimate  Service Pack 1 (X86) OS Language: English (United States)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
 
==================== Processes (Whitelisted) =================
 
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 
(IDT, Inc.) C:\Drivers\Audio\Sigmatel(IDT)\IDT\Lenovo_K46\stacsv.exe
(Avast Software s.r.o.) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Avast Software s.r.o.) C:\Program Files\AVAST Software\Avast\avastui.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
 
 
==================== Registry (Whitelisted) ==================
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 
HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5515496 2015-05-11] (Avast Software s.r.o.)
HKLM\...\Run: [GrooveMonitor] => C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [157480 2015-04-07] (Apple Inc.)
HKLM\...\Run: [QuickTime Task] => C:\Program Files\QuickTime\QTTask.exe [421888 2014-10-02] (Apple Inc.)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShell.dll [2015-05-03] (Avast Software s.r.o.)
 
==================== Internet (Whitelisted) ====================
 
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 
HKU\S-1-5-21-3246227928-2897000876-3919210742-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-3246227928-2897000876-3919210742-1000\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.com.ph/?gfe_rd=cr&ei=jr1qVYnsEOmL8Qec24CYCA&gws_rd=ssl
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-09-23] (Adobe Systems Incorporated)
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2015-05-03] (Avast Software s.r.o.)
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll [2009-02-26] (Microsoft Corporation)
Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704 2011-08-30] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
 
FireFox:
========
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_12_0_0_31.dll [2015-03-10] ()
FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll [2014-10-30] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-17] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-17] (Google Inc.)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2012-09-23] (Adobe Systems Inc.)
FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2015-03-10]
 
Chrome: 
=======
CHR Profile: C:\Users\windows 7\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\windows 7\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-03-10]
CHR Extension: (Google Drive) - C:\Users\windows 7\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-05-07]
CHR Extension: (Bookmark Manager) - C:\Users\windows 7\AppData\Local\Google\Chrome\User Data\Default\Extensions\gmlllbghnfkpflemihljekbapjopfjik [2015-04-26]
CHR Extension: (Google Wallet) - C:\Users\windows 7\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-04-26]
CHR HKLM\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-05-03]
 
========================== Services (Whitelisted) =================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [343336 2015-05-03] (Avast Software s.r.o.)
R2 STacSV; c:\drivers\audio\sigmatel(idt)\idt\lenovo_k46\STacSV.exe [229475 2010-03-09] (IDT, Inc.)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-27] (Microsoft Corporation)
 
==================== Drivers (Whitelisted) ====================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
S3 AndnetBus; C:\Windows\System32\DRIVERS\lgandnetbus.sys [15744 2014-10-09] (LG Electronics Inc.)
S3 AndNetDiag; C:\Windows\System32\DRIVERS\lgandnetdiag.sys [23680 2014-10-09] (LG Electronics Inc.)
S3 ANDNetModem; C:\Windows\System32\DRIVERS\lgandnetmodem.sys [28416 2014-10-09] (LG Electronics Inc.)
R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [24144 2015-05-03] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [74976 2015-05-03] (Avast Software s.r.o.)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [81728 2015-05-03] (Avast Software s.r.o.)
R0 aswRvrt; C:\Windows\system32\Drivers\aswRvrt.sys [49904 2015-05-03] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [787760 2015-05-03] (Avast Software s.r.o.)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [427992 2015-05-03] (Avast Software s.r.o.)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [106912 2015-05-03] (Avast Software s.r.o.)
R0 aswVmm; C:\Windows\system32\Drivers\aswVmm.sys [209048 2015-05-03] ()
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
 
==================== NetSvcs (Whitelisted) ===================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
 
==================== One Month Created files and folders ========
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2015-06-09 11:56 - 2015-06-09 11:57 - 00008070 _____ C:\Users\windows 7\Downloads\FRST.txt
2015-06-09 11:56 - 2015-06-09 11:56 - 00000000 ____D C:\FRST
2015-06-09 11:55 - 2015-06-09 11:55 - 01147904 _____ (Farbar) C:\Users\windows 7\Downloads\FRST.exe
2015-06-09 11:39 - 2015-06-09 11:48 - 00000000 ____D C:\AdwCleaner
2015-06-09 11:37 - 2015-06-09 11:38 - 02231296 _____ C:\Users\windows 7\Downloads\AdwCleaner.exe
2015-06-09 01:10 - 2015-06-09 01:11 - 04197016 _____ (Kaspersky Lab ZAO) C:\Users\windows 7\Downloads\tdsskiller.exe
2015-06-08 11:30 - 2015-06-09 11:22 - 00000000 ____D C:\Users\windows 7\AppData\Roaming\Apple Computer
2015-06-08 11:27 - 2015-06-08 11:29 - 00000000 ___SD C:\Windows\system32\GWX
2015-06-07 23:45 - 2015-01-09 07:44 - 00419936 _____ C:\Windows\system32\locale.nls
2015-06-07 23:44 - 2014-06-27 09:45 - 02285056 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll
2015-06-07 20:42 - 2015-06-07 20:42 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iCloud
2015-06-07 20:34 - 2015-06-07 20:34 - 00001815 _____ C:\Users\Public\Desktop\QuickTime Player.lnk
2015-06-07 20:34 - 2015-06-07 20:34 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
2015-06-07 20:34 - 2015-06-07 20:34 - 00000000 ____D C:\Program Files\QuickTime
2015-06-07 20:08 - 2015-06-07 21:38 - 00000000 ____D C:\Users\rishibility\AppData\Roaming\Apple Computer
2015-06-07 20:08 - 2015-06-07 20:08 - 00001753 _____ C:\Users\Public\Desktop\iTunes.lnk
2015-06-07 20:08 - 2015-06-07 20:08 - 00000000 ____D C:\Users\rishibility\AppData\Local\Apple Computer
2015-06-07 20:08 - 2015-06-07 20:08 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2015-06-07 20:07 - 2012-10-03 16:14 - 00026840 _____ (GEAR Software Inc.) C:\Windows\system32\Drivers\GEARAspiWDM.sys
2015-06-07 20:06 - 2015-06-07 20:07 - 00000000 ____D C:\ProgramData\B0FFCDD9-5261-4e59-B29A-17A4FABDEBAB
2015-06-07 20:06 - 2015-06-07 20:07 - 00000000 ____D C:\Program Files\iTunes
2015-06-07 20:06 - 2015-06-07 20:06 - 00002519 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk
2015-06-07 20:06 - 2015-06-07 20:06 - 00000000 ____D C:\Users\rishibility\AppData\Local\Apple
2015-06-07 20:06 - 2015-06-07 20:06 - 00000000 ____D C:\ProgramData\Apple Computer
2015-06-07 20:06 - 2015-06-07 20:06 - 00000000 ____D C:\Program Files\iPod
2015-06-07 20:06 - 2015-06-07 20:06 - 00000000 ____D C:\Program Files\Bonjour
2015-06-07 20:06 - 2015-06-07 20:06 - 00000000 ____D C:\Program Files\Apple Software Update
2015-06-07 20:05 - 2015-06-07 20:42 - 00000000 ____D C:\Program Files\Common Files\Apple
2015-06-07 20:05 - 2015-06-07 20:06 - 00000000 ____D C:\ProgramData\Apple
2015-06-07 18:31 - 2015-06-07 20:04 - 108728624 _____ (Apple Inc.) C:\Users\rishibility\Downloads\iTunesSetup.exe
2015-06-07 17:57 - 2015-06-07 17:57 - 00000000 ____D C:\LGMobileUpgrade
2015-06-07 17:54 - 2015-06-07 19:21 - 00000000 ____D C:\Users\rishibility\AppData\Local\Microsoft Games
2015-06-07 17:54 - 2015-06-07 17:54 - 00109280 _____ C:\Users\rishibility\AppData\Local\GDIPFONTCACHEV1.DAT
2015-06-07 17:45 - 2015-06-07 17:45 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_WinUsb_01009.Wdf
2015-06-07 17:45 - 2015-06-07 17:45 - 00000000 ____D C:\Users\rishibility\.android
2015-06-07 17:44 - 2015-06-07 17:44 - 00000000 ____D C:\Users\rishibility\Documents\LG PC Suite
2015-06-07 17:41 - 2015-01-09 10:48 - 00635904 _____ (Microsoft Corporation) C:\Windows\system32\perftrack.dll
2015-06-07 17:41 - 2015-01-09 10:48 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\wdi.dll
2015-06-07 17:41 - 2015-01-09 10:48 - 00027136 _____ (Microsoft Corporation) C:\Windows\system32\powertracker.dll
2015-06-07 17:40 - 2014-08-01 19:35 - 00793600 _____ (Microsoft Corporation) C:\Windows\system32\TSWorkspace.dll
2015-06-07 17:40 - 2012-02-11 13:37 - 00317440 _____ (Microsoft Corporation) C:\Windows\system32\spoolsv.exe
2015-06-07 17:40 - 2011-02-25 13:30 - 02616320 _____ (Microsoft Corporation) C:\Windows\explorer.exe
2015-06-07 17:39 - 2015-03-04 12:11 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\shimeng.dll
2015-06-07 17:39 - 2015-03-04 12:10 - 00295936 _____ (Microsoft Corporation) C:\Windows\system32\apphelp.dll
2015-06-07 17:39 - 2015-03-04 12:10 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\aelupsvc.dll
2015-06-07 17:39 - 2015-03-04 12:10 - 00020992 _____ (Microsoft Corporation) C:\Windows\system32\sdbinst.exe
2015-06-07 17:39 - 2014-07-09 09:29 - 00006144 _____ (Microsoft Corporation) C:\Windows\system32\KBDYAK.DLL
2015-06-07 17:39 - 2014-07-09 09:29 - 00006144 _____ (Microsoft Corporation) C:\Windows\system32\KBDTAT.DLL
2015-06-07 17:39 - 2014-07-09 09:29 - 00006144 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU1.DLL
2015-06-07 17:39 - 2014-07-09 09:29 - 00006144 _____ (Microsoft Corporation) C:\Windows\system32\KBDBASH.DLL
2015-06-07 17:39 - 2014-07-09 09:29 - 00005632 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU.DLL
2015-06-07 17:39 - 2013-08-05 09:56 - 00133056 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ataport.sys
2015-06-07 17:38 - 2015-06-07 17:38 - 00000000 ____D C:\Users\rishibility\AppData\Roaming\LG Electronics
2015-06-07 17:38 - 2015-01-29 11:02 - 02311168 _____ (Microsoft Corporation) C:\Windows\system32\wpdshext.dll
2015-06-07 17:38 - 2014-11-11 09:32 - 00074752 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdx.sys
2015-06-07 17:38 - 2014-10-14 09:50 - 02363904 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2015-06-07 17:38 - 2013-10-30 10:19 - 00301568 _____ (Microsoft Corporation) C:\Windows\system32\msieftp.dll
2015-06-07 17:38 - 2013-10-04 09:58 - 00152576 _____ (Microsoft Corporation) C:\Windows\system32\SmartcardCredentialProvider.dll
2015-06-07 17:38 - 2013-10-04 09:56 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\credui.dll
2015-06-07 17:38 - 2011-03-11 13:39 - 00143744 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvstor.sys
2015-06-07 17:38 - 2011-03-11 13:39 - 00117120 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvraid.sys
2015-06-07 17:38 - 2011-03-11 13:38 - 00332160 _____ (Intel Corporation) C:\Windows\system32\Drivers\iaStorV.sys
2015-06-07 17:38 - 2011-03-11 13:38 - 00080256 _____ (Advanced Micro Devices) C:\Windows\system32\Drivers\amdsata.sys
2015-06-07 17:38 - 2011-03-11 13:38 - 00022400 _____ (Advanced Micro Devices) C:\Windows\system32\Drivers\amdxata.sys
2015-06-07 17:38 - 2011-03-11 13:33 - 01699328 _____ (Microsoft Corporation) C:\Windows\system32\esent.dll
2015-06-07 17:38 - 2011-03-11 13:31 - 00074240 _____ (Microsoft Corporation) C:\Windows\system32\fsutil.exe
2015-06-07 17:38 - 2011-03-11 12:01 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBSTOR.SYS
2015-06-07 17:37 - 2015-06-07 17:37 - 00001168 _____ C:\Users\Public\Desktop\LG PC Suite.lnk
2015-06-07 17:37 - 2014-01-28 10:07 - 00185344 _____ (Microsoft Corporation) C:\Windows\system32\wwansvc.dll
2015-06-07 17:37 - 2013-08-28 08:57 - 00434688 _____ (Microsoft Corporation) C:\Windows\system32\scavengeui.dll
2015-06-07 17:37 - 2013-03-19 11:33 - 00040960 _____ (Microsoft Corporation) C:\Windows\system32\wwanprotdim.dll
2015-06-07 17:36 - 2015-06-07 17:36 - 00000000 ____D C:\Users\rishibility\AppData\Local\LG Electronics
2015-06-07 17:36 - 2015-06-07 17:36 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LG PC Suite
2015-06-07 17:36 - 2014-02-04 10:07 - 00234432 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys
2015-06-07 17:36 - 2014-02-04 10:07 - 00149440 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys
2015-06-07 17:36 - 2014-02-04 10:07 - 00027072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Diskdump.sys
2015-06-07 17:36 - 2014-02-04 10:00 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\iologmsg.dll
2015-06-07 17:35 - 2015-06-07 17:35 - 00000000 ____D C:\Program Files\LG Electronics
2015-06-07 17:34 - 2014-11-08 10:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2015-06-07 17:32 - 2014-06-24 10:59 - 01987584 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2015-06-07 17:32 - 2014-01-24 10:18 - 01212352 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2015-06-07 17:15 - 2014-11-26 11:32 - 00571904 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2015-06-07 17:10 - 2013-07-04 19:57 - 00205824 _____ (Microsoft Corporation) C:\Windows\system32\WebClnt.dll
2015-06-07 17:10 - 2013-07-04 19:51 - 00081920 _____ (Microsoft Corporation) C:\Windows\system32\davclnt.dll
2015-06-07 17:08 - 2014-10-30 09:45 - 00155136 _____ (Microsoft Corporation) C:\Windows\system32\charmap.exe
2015-06-07 16:53 - 2015-06-07 17:32 - 235940832 _____ (LG Electronics) C:\Users\rishibility\Downloads\LGPCSuite_Setup.exe
2015-06-05 12:04 - 2015-06-06 20:53 - 00000000 ____D C:\Program Files\TeamViewer
2015-06-05 12:04 - 2015-06-05 12:04 - 00000000 ____D C:\Users\windows 7\AppData\Roaming\TeamViewer
2015-06-05 00:12 - 2015-06-05 00:12 - 00000000 ____D C:\Windows\CheckSur
2015-06-04 23:49 - 2015-06-05 00:06 - 239126136 _____ C:\Users\windows 7\Downloads\Windows6.1-KB947821-v34-x86.msu
2015-06-04 14:31 - 2015-06-04 14:31 - 00003536 ____N C:\bootsqm.dat
2015-06-04 13:56 - 2015-06-04 23:46 - 00000000 ____D C:\MGADiagToolOutput
2015-06-04 13:55 - 2015-06-04 13:55 - 00000000 ____D C:\ProgramData\Office Genuine Advantage
2015-05-31 15:51 - 2015-05-31 15:51 - 00000000 __SHD C:\Users\windows 7\AppData\Local\EmieUserList
2015-05-31 15:51 - 2015-05-31 15:51 - 00000000 __SHD C:\Users\windows 7\AppData\Local\EmieSiteList
2015-05-31 15:51 - 2015-05-31 15:51 - 00000000 __SHD C:\Users\windows 7\AppData\Local\EmieBrowserModeList
2015-05-31 13:35 - 2015-05-31 22:10 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\0E732AA2.sys
2015-05-28 00:55 - 2015-05-28 00:55 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
2015-05-13 12:28 - 2015-05-01 21:16 - 00102608 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-05-13 12:02 - 2015-04-22 09:48 - 00342736 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-05-13 12:02 - 2015-04-22 00:25 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-05-13 12:02 - 2015-04-22 00:25 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-05-13 12:02 - 2015-04-22 00:24 - 19691008 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-05-13 12:02 - 2015-04-22 00:11 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-05-13 12:02 - 2015-04-22 00:11 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-05-13 12:02 - 2015-04-22 00:10 - 00047616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-05-13 12:02 - 2015-04-22 00:09 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-05-13 12:02 - 2015-04-22 00:08 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-05-13 12:02 - 2015-04-22 00:04 - 02278400 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-05-13 12:02 - 2015-04-22 00:03 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-05-13 12:02 - 2015-04-22 00:02 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-05-13 12:02 - 2015-04-22 00:00 - 00478208 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-05-13 12:02 - 2015-04-21 23:58 - 00664576 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-05-13 12:02 - 2015-04-21 23:58 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-05-13 12:02 - 2015-04-21 23:58 - 00102912 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-05-13 12:02 - 2015-04-21 23:57 - 00620032 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-05-13 12:02 - 2015-04-21 23:51 - 00667648 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-05-13 12:02 - 2015-04-21 23:48 - 00418304 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-05-13 12:02 - 2015-04-21 23:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-05-13 12:02 - 2015-04-21 23:39 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-05-13 12:02 - 2015-04-21 23:38 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-05-13 12:02 - 2015-04-21 23:36 - 00285696 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-05-13 12:02 - 2015-04-21 23:31 - 04305920 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-05-13 12:02 - 2015-04-21 23:26 - 00688640 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-05-13 12:02 - 2015-04-21 23:26 - 00685568 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-05-13 12:02 - 2015-04-21 23:25 - 02052608 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-05-13 12:02 - 2015-04-21 23:24 - 01155072 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-05-13 12:02 - 2015-04-21 23:17 - 12828672 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-05-13 12:02 - 2015-04-21 23:02 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-05-13 12:02 - 2015-04-21 22:58 - 01310208 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-05-13 12:02 - 2015-04-21 22:56 - 00710144 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-05-13 11:44 - 2015-05-05 09:12 - 00248832 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-05-13 11:44 - 2015-04-18 10:56 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2015-05-13 11:44 - 2015-04-04 11:10 - 00137656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-05-13 11:44 - 2015-04-04 11:10 - 00067512 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-05-13 11:44 - 2015-04-04 11:05 - 01061376 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-05-13 11:44 - 2015-04-04 11:05 - 00550912 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-05-13 11:44 - 2015-04-04 11:05 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-05-13 11:44 - 2015-04-04 11:05 - 00221184 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-05-13 11:44 - 2015-04-04 11:05 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-05-13 11:44 - 2015-04-04 11:05 - 00100352 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-05-13 11:44 - 2015-04-04 11:05 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-05-13 11:44 - 2015-04-04 11:05 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-05-13 11:44 - 2015-04-04 11:05 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-05-13 11:44 - 2015-04-04 11:05 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-05-13 11:44 - 2015-04-04 11:04 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-05-13 11:44 - 2015-04-04 11:04 - 00022528 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-05-13 11:44 - 2015-04-04 11:01 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-05-13 11:44 - 2015-04-04 11:01 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-05-13 11:44 - 2015-04-04 10:59 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-05-13 11:38 - 2015-04-20 10:56 - 01250816 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2015-05-13 11:38 - 2015-04-20 10:56 - 00909312 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2015-05-13 11:38 - 2015-04-20 10:03 - 02382336 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-05-13 11:38 - 2015-04-08 11:14 - 00216064 _____ (Microsoft Corporation) C:\Windows\system32\InkEd.dll
2015-05-13 11:38 - 2015-04-08 11:14 - 00019968 _____ (Microsoft Corporation) C:\Windows\system32\jnwmon.dll
2015-05-13 11:37 - 2015-04-13 11:19 - 00259072 _____ (Microsoft Corporation) C:\Windows\system32\services.exe
2015-05-13 11:37 - 2015-02-18 15:06 - 00123904 _____ (Microsoft Corporation) C:\Windows\system32\poqexec.exe
 
==================== One Month Modified files and folders ========
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2015-06-09 11:53 - 2015-03-10 16:05 - 01279251 _____ C:\Windows\WindowsUpdate.log
2015-06-09 11:50 - 2009-07-14 12:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-06-09 11:50 - 2009-07-14 12:39 - 00043468 _____ C:\Windows\setupact.log
2015-06-09 11:48 - 2009-07-14 12:34 - 00025664 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-06-09 11:48 - 2009-07-14 12:34 - 00025664 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-06-09 11:45 - 2015-05-03 18:08 - 00000000 ____D C:\Users\windows 7\AppData\Roaming\Skype
2015-06-09 11:36 - 2015-03-10 16:14 - 00000886 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-06-08 23:50 - 2015-05-03 18:52 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-06-08 15:01 - 2009-07-14 12:33 - 00405992 _____ C:\Windows\system32\FNTCACHE.DAT
2015-06-08 14:47 - 2009-07-14 10:37 - 00000000 ____D C:\Windows\system32\NDF
2015-06-08 11:27 - 2015-05-03 18:29 - 00000000 ____D C:\Windows\system32\Drivers\ko-KR
2015-06-08 11:27 - 2009-07-14 10:37 - 00000000 ____D C:\Windows\tracing
2015-06-08 11:27 - 2009-07-14 10:37 - 00000000 ____D C:\Windows\system32\ko-KR
2015-06-08 11:27 - 2009-07-14 10:37 - 00000000 ____D C:\Windows\system32\AdvancedInstallers
2015-06-07 17:45 - 2015-04-28 16:57 - 00000000 ____D C:\Users\rishibility
2015-06-07 17:33 - 2009-07-14 10:37 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
2015-06-07 13:00 - 2010-11-21 05:48 - 00009684 _____ C:\Windows\PFRO.log
2015-06-06 20:54 - 2015-03-10 16:16 - 00109280 _____ C:\Users\windows 7\AppData\Local\GDIPFONTCACHEV1.DAT
2015-06-05 23:38 - 2015-05-03 18:29 - 00427048 _____ C:\Windows\system32\perfh012.dat
2015-06-05 23:38 - 2015-05-03 18:29 - 00118778 _____ C:\Windows\system32\perfc012.dat
2015-06-05 23:38 - 2010-11-21 05:01 - 01315944 _____ C:\Windows\system32\PerfStringBackup.INI
2015-05-29 04:03 - 2009-07-14 10:37 - 00000000 ____D C:\Windows\rescache
2015-05-26 12:35 - 2015-03-10 16:15 - 00002129 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2015-05-17 02:24 - 2015-03-10 16:14 - 00000882 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-05-15 23:33 - 2010-11-21 08:46 - 00000000 ____D C:\Program Files\Windows Journal
2015-05-14 03:21 - 2009-07-14 10:37 - 00000000 ____D C:\Windows\Microsoft.NET
2015-05-13 12:32 - 2015-05-03 16:00 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2015-05-13 12:27 - 2015-03-10 16:19 - 00000000 ____D C:\ProgramData\Microsoft Help
2015-05-13 12:26 - 2015-04-27 00:41 - 00000000 ____D C:\Windows\system32\MRT
2015-05-13 12:16 - 2015-04-27 00:41 - 137310008 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-05-13 12:10 - 2015-05-03 16:01 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
 
Some files in TEMP:
====================
C:\Users\rishibility\AppData\Local\Temp\vcredist9_x86.exe
C:\Users\windows 7\AppData\Local\Temp\Quarantine.exe
C:\Users\windows 7\AppData\Local\Temp\sqlite3.dll
 
 
==================== Bamital & volsnap Check =================
 
(There is no automatic fix for files that do not pass verification.)
 
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
 
 
LastRegBack: 2015-05-29 03:45
 

 

==================== End of log ============================
 
 
And then the additional txt:

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 08-06-2015
Ran by windows 7 at 2015-06-09 11:57:22
Running from C:\Users\windows 7\Downloads
Boot Mode: Normal
==========================================================
 
 
==================== Accounts: =============================
 
Administrator (S-1-5-21-3246227928-2897000876-3919210742-500 - Administrator - Disabled)
Guest (S-1-5-21-3246227928-2897000876-3919210742-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-3246227928-2897000876-3919210742-1002 - Limited - Enabled)
ingrid (S-1-5-21-3246227928-2897000876-3919210742-1004 - Administrator - Enabled) => C:\Users\ingrid
rishibility (S-1-5-21-3246227928-2897000876-3919210742-1003 - Administrator - Enabled) => C:\Users\rishibility
windows 7 (S-1-5-21-3246227928-2897000876-3919210742-1000 - Administrator - Enabled) => C:\Users\windows 7
 
==================== Security Center ========================
 
(If an entry is included in the fixlist, it will be removed.)
 
AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
 
==================== Installed Programs ======================
 
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 
Adobe Flash Player 12 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 12.0.0.31 - Adobe Systems Incorporated)
Adobe Flash Player 12 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 12.0.0.31 - Adobe Systems Incorporated)
Adobe Reader XI  MUI (HKLM\...\{AC76BA86-7AD7-FFFF-7B44-AB0000000001}) (Version: 11.0.00 - Adobe Systems Incorporated)
Apple Application Support (32-bit) (HKLM\...\{AFA1153A-F547-409B-B837-3A0D6C5A3FEC}) (Version: 3.1.3 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{E1DB0812-2D60-43DB-AE09-6C7027D93B28}) (Version: 8.1.1.3 - Apple Inc.)
Apple Software Update (HKLM\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Avast Free Antivirus (HKLM\...\Avast) (Version: 10.2.2218 - AVAST Software)
Bonjour (HKLM\...\{79155F2B-9895-49D7-8612-D92580E0DE5B}) (Version: 3.0.0.10 - Apple Inc.)
Google Chrome (HKLM\...\Google Chrome) (Version: 43.0.2357.81 - Google Inc.)
Google Update Helper (Version: 1.3.24.7 - Google Inc.) Hidden
Google Update Helper (Version: 1.3.27.5 - Google Inc.) Hidden
iCloud (HKLM\...\{9A07AB4F-6B53-43E9-B7FC-7892E8C26BE3}) (Version: 4.1.1.53 - Apple Inc.)
iTunes (HKLM\...\{CE1F04C7-79BC-4219-BE6A-BA490224D4B5}) (Version: 12.1.2.27 - Apple Inc.)
K-Lite Mega Codec Pack 9.9.5 (HKLM\...\KLiteCodecPack_is1) (Version: 9.9.5 - )
LG PC Suite (HKLM\...\LG PC Suite) (Version: 5.3.24.20150327 - LG Electronics)
LG United Mobile Drivers (HKLM\...\{2D5218EB-6992-46E3-8ECE-76C79AB955CE}) (Version: 3.13.2.0 - LG Electronics)
Malwarebytes Anti-Malware version 2.1.6.1022 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.6.1022 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office Enterprise 2007 (HKLM\...\ENTERPRISE) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office File Validation Add-In (HKLM\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40416.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Works 6-9 Converter (HKLM\...\{95140000-0137-0409-0000-0000000FF1CE}) (Version: 14.0.6120.5002 - Microsoft Corporation)
QuickTime 7 (HKLM\...\{3D2CBC2C-65D4-4463-87AB-BB2C859C1F3E}) (Version: 7.76.80.95 - Apple Inc.)
Skype™ 7.4 (HKLM\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.4.102 - Skype Technologies S.A.)
Update for 2007 Microsoft Office System (KB967642) (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
WinRAR 5.01 (32-bit) (HKLM\...\WinRAR archiver) (Version: 5.01.0 - win.rar GmbH)
 
==================== Custom CLSID (Whitelisted): ==========================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
 
==================== Restore Points =========================
 
07-06-2015 16:51:39 Installed LG United Mobile Drivers.
07-06-2015 19:00:51 Windows Backup
08-06-2015 11:40:38 Windows Update
 
==================== Hosts content: ==========================
 
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 
2009-07-14 10:04 - 2009-06-11 05:39 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
 
==================== Scheduled Tasks (Whitelisted) =============
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
Task: {0442B0DC-CA6A-442F-89CD-E6A2808C9CC1} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2015-03-10] (Google Inc.)
Task: {0D213FCF-0ADC-4C31-BBB1-137432973021} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {174909B5-4554-4C7A-B12E-63AF8D4F7E1E} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2015-03-10] (Google Inc.)
Task: {492AC1F3-9269-410B-B7B7-E09C4043C413} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\OutOfIdle => C:\Windows\system32\GWX\GWX.exe [2015-05-08] (Microsoft Corporation)
Task: {5D0CD894-DBA6-4A62-B7B2-D33BFCED0997} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-05-08] (Microsoft Corporation)
Task: {88E7D511-D9B7-46B7-96A6-6B7D6642F261} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2015-05-03] (Avast Software s.r.o.)
Task: {8D9968DE-F551-46D6-A88F-38BD6EA9587E} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\Logon => C:\Windows\system32\GWX\GWX.exe [2015-05-08] (Microsoft Corporation)
Task: {A314D0A5-D152-4026-A1A7-EF2B271227F9} - System32\Tasks\Microsoft\Windows\Setup\gwx\launchtrayprocess => C:\Windows\system32\GWX\GWX.exe [2015-05-08] (Microsoft Corporation)
Task: {DBDA7C85-99E6-4C27-9917-FBD4F28CEED3} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B => schtasks
 
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
 
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
 
==================== Loaded Modules (Whitelisted) ==============
 
2015-05-03 16:28 - 2015-05-03 16:28 - 00104400 _____ () C:\Program Files\AVAST Software\Avast\log.dll
2015-05-03 16:28 - 2015-05-03 16:28 - 00081728 _____ () C:\Program Files\AVAST Software\Avast\JsonRpcServer.dll
2015-06-09 11:25 - 2015-06-09 11:25 - 02952192 _____ () C:\Program Files\AVAST Software\Avast\defs\15060801\algo.dll
2015-05-03 16:28 - 2015-05-03 16:28 - 40540672 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2015-03-20 18:12 - 2015-03-20 18:12 - 00073544 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2015-03-20 18:12 - 2015-03-20 18:12 - 01044776 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2015-05-26 12:35 - 2015-05-23 04:22 - 01281864 _____ () C:\Program Files\Google\Chrome\Application\43.0.2357.81\libglesv2.dll
2015-05-26 12:35 - 2015-05-23 04:22 - 00080712 _____ () C:\Program Files\Google\Chrome\Application\43.0.2357.81\libegl.dll
 
==================== Alternate Data Streams (Whitelisted) =========
 
(If an entry is included in the fixlist, only the ADS will be removed.)
 
 
==================== Safe Mode (Whitelisted) ===================
 
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 
 
==================== EXE Association (Whitelisted) ===============
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
 
 
==================== Internet Explorer trusted/restricted ===============
 
(If an entry is included in the fixlist, it will be removed from the registry.)
 
 
==================== Other Areas ============================
 
(Currently there is no automatic fix for this section.)
 
HKU\S-1-5-21-3246227928-2897000876-3919210742-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\windows 7\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.1.1
 
==================== MSCONFIG/TASK MANAGER disabled items ==
 
(Currently there is no automatic fix for this section.)
 
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: GrooveMonitor => "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
MSCONFIG\startupreg: HotKeysCmds => C:\Windows\system32\hkcmd.exe
MSCONFIG\startupreg: IgfxTray => C:\Windows\system32\igfxtray.exe
MSCONFIG\startupreg: Persistence => C:\Windows\system32\igfxpers.exe
MSCONFIG\startupreg: SysTrayApp => %ProgramFiles%\IDT\WDM\sttray.exe
 
==================== FirewallRules (Whitelisted) ===============
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
FirewallRules: [{96483D3A-3E01-45E7-A6C5-2B758E9B8195}] => (Allow) C:\Program Files\Skype\Phone\Skype.exe
FirewallRules: [{F7DB76FA-D508-4B81-A1DA-3080B29ACB0F}] => (Allow) C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
FirewallRules: [{4E8E2E99-E5A5-4B56-9AB9-1CEE802E78FE}] => (Allow) C:\Program Files\Google\Chrome\Application\chrome.exe
FirewallRules: [{6670A648-9F59-46BD-83D0-054459F3F7F6}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{8C981AC3-5D31-4366-875A-967E95E1FFF7}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{49DED3ED-E3CB-4388-B9EB-18612DB9DCCB}] => (Allow) C:\Program Files\iTunes\iTunes.exe
 
==================== Faulty Device Manager Devices =============
 
 
==================== Event log errors: =========================
 
Application errors:
==================
Error: (06/09/2015 11:50:56 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
Error: (06/09/2015 11:49:09 AM) (Source: Windows Search Service) (EventID: 3084) (User: )
Description: Failed to load protocol handler Csc. Error description: Illegal operation attempted on a registry key that has been marked for deletion.  (HRESULT : 0x800703fa).
 
Error: (06/09/2015 11:23:32 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
Error: (06/08/2015 11:46:26 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program Skype.exe version 7.4.0.102 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.
 
Process ID: be8
 
Start Time: 01d0a201c927388c
 
Termination Time: 11
 
Application Path: C:\Program Files\Skype\Phone\Skype.exe
 
Report Id: 6fbb7a9c-0df5-11e5-ab05-1078d2fe3a66
 
Error: (06/08/2015 11:42:25 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
Error: (06/08/2015 03:02:34 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
Error: (06/08/2015 11:29:36 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
Error: (06/08/2015 11:26:32 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
Error: (06/07/2015 11:46:43 PM) (Source: MsiInstaller) (EventID: 11935) (User: NT AUTHORITY)
Description: Product: Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 -- Error 1935.An error occurred during the installation of assembly 'Microsoft.VC90.ATL,version="9.0.30729.6161",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86",type="win32"'. Please refer to Help and Support for more information. HRESULT: 0x80070BC9. assembly interface: IAssemblyCacheItem, function: Commit, component: {03329364-ED3E-3EF1-ACB0-C1E9F5282929}
 
Error: (06/07/2015 04:45:53 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
 
System errors:
=============
Error: (06/09/2015 11:49:33 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Print Spooler service failed to start due to the following error: 
%%1069
 
Error: (06/09/2015 11:49:33 AM) (Source: Service Control Manager) (EventID: 7038) (User: )
Description: The Spooler service was unable to log on as NT AUTHORITY\SYSTEM with the currently configured password due to the following error: 
%%50
 
To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC).
 
Error: (06/09/2015 11:49:33 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Apple Mobile Device service failed to start due to the following error: 
%%109
 
Error: (06/09/2015 11:48:52 AM) (Source: Service Control Manager) (EventID: 7032) (User: )
Description: The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Windows Search service, but this action failed with the following error: 
%%1056
 
Error: (06/09/2015 11:48:22 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Windows Search service terminated unexpectedly.  It has done this 2 time(s).  The following corrective action will be taken in 30000 milliseconds: Restart the service.
 
Error: (06/09/2015 11:48:20 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Software Protection service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 120000 milliseconds: Restart the service.
 
Error: (06/09/2015 11:48:20 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Windows Modules Installer service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 120000 milliseconds: Restart the service.
 
Error: (06/09/2015 11:48:18 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Windows Search service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 30000 milliseconds: Restart the service.
 
Error: (06/09/2015 11:48:18 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Windows Media Player Network Sharing Service service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 30000 milliseconds: Restart the service.
 
Error: (06/09/2015 11:48:17 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The iPod Service service terminated unexpectedly.  It has done this 1 time(s).
 
 
Microsoft Office:
=========================
 
==================== Memory info =========================== 
 
Processor: Intel® Core2 Quad CPU Q6600 @ 2.40GHz
Percentage of memory in use: 50%
Total physical RAM: 1981.24 MB
Available physical RAM: 985.05 MB
Total Pagefile: 3962.48 MB
Available Pagefile: 2831.61 MB
Total Virtual: 2047.88 MB
Available Virtual: 1892.99 MB
 
==================== Drives ================================
 
Drive c: () (Fixed) (Total:50.68 GB) (Free:21.56 GB) NTFS
Drive d: () (Fixed) (Total:98.27 GB) (Free:46.89 GB) NTFS
 
==================== MBR & Partition Table ==================
 
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 149.1 GB) (Disk ID: FF6AFF6A)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=50.7 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=98.3 GB) - (Type=07 NTFS)
 
==================== End of log ============================
 
 
I don't know what to do next after this since I dn't know how to read the logs and find what's wrong. I have also Avast Antivirus Free, but it didn't detect anything. Thank you in advance for those who will reply.

 

Link to post
Share on other sites
_argus

_argus

Posted
Posted

Helllo,

My name is Argus and and I will be helping you with your computer problems.

Before we begin, please note the following:

  • I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
  • The logs can take some time to research, so please be patient with me.
  • Stay with the topic until I tell you that your system is clean. Missing symptoms does not mean that everything is okay.
  • Instructions that I give are for your system only!
  • Please do not run any tools until requested ! The reason for this is so I know what is going on with the machine at any time. Some programs can interfere with others and hamper the recovery process.
  • Please perform all steps in the order received. If you can't understand something don't hesitate to ask.
  • Again I would like to remind you to make no further changes to your computer unless I direct you to do so. I will not be able to help you if you do not follow my instructions.





warning.gif Rules and policies

We won't support any piracy.
That being told, if any evidence of illegal OS, software, cracks/keygens or any other will be revealed, any further assistance will be suspended. If you are aware that there is this kind of stuff on your machine, remove it before proceeding!
The same applies to any use of P2P software: uTorrent, BitTorrent, Vuze, Kazaa, Ares... We don't provide any help for P2P, except for their removal. All P2P software has to be uninstalled or at least fully disabled before proceeding!

Failure to follow these guidelines will result with closing your topic and withdrawning any assistance.

 

 

 

 

 

51a612a8b27e2-Zoek.png Scan with ZOEK

Please download ZOEK by Smeenk and save it to your desktop (preferred version is the *.exe one)
Temporary disable your AntiVirus and AntiSpyware protection - instructions here.
 

  • Right-click on 51a612a8b27e2-Zoek.png icon and select RunAsAdmin.jpg Run as Administrator to start the tool.
  • Wait patiently until the main console will appear, it may take a minute or two.
  • In the main box please paste in the following script:
    createsrpoint;autoclean;emptyalltemp;bitsadmin /reset /allusers;bipconfig /flushdns;b
  • Make sure that Scan All Users option is checked.
  • Push Run Script and wait patiently. The scan may take a couple of minutes.
  • When the scan completes, a zoek-results logfile should open in notepad.
  • If a reboot is needed, it will be opened after it. You may also find it at your main drive (usually C:\ drive)


Post its content into your next reply.

 

 

 

 

 

 

 

 

 

FRST.gif Scan with Farbar Recovery Scan Tool

Please re-run Farbar Recovery Scan Tool to give me a fresh look at your system.

  • Right-click on FRST.gif icon and select RunAsAdmin.jpg Run as Administrator to start the tool.
    (XP users click run after receipt of Windows Security Warning - Open File).
  • Make sure that Addition option is checked.
  • Press Scan button and wait.
  • The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.


Please include their content into your next reply.

Link to post
Share on other sites
unjulienne

unjulienne

Posted
  • Author
Posted

Thank you for the replies. I've tried ZOEK before, but I had a bad experience with it so I am hesitant with that application. I hope you understand my trouble with this. 

 

Anyway, thank you. I will try the Farbar Recovery Scan Tool for the second time around and see if it catches again something.

 

Again, thank you for the replies. I'm very grateful for the help. I'll reply again if I find something in my system.

Link to post
Share on other sites
  • Root Admin
AdvancedSetup

AdvancedSetup

Posted
  • Root Admin
Posted

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.