Chrome Persistent window pops up with FBI warning intermittently

raynga · October 26, 2015

Background:

I am running windows 8.1 Pro, with a Intel i7-4790K @ 4.0 GHz, 16gb Ram, Trend Micro Maximum Security and malware bytes Home Premium. I have 1 samsung SSD 840 Pro as a boot drive a HGST HDN724040ALE640 split into 2 partitions and a St4000Dm000-1F2168 as a video server drive.

Typically I'm running my AV, Malware bytes, Plex Media Server, Teamviewer 10 [ in background in case i need to login] & Next PVR in a Chrome window, . I'm on a Comcast 105mb Cable connection.

Problem:

When using Chrome v 46.0.2490.80 m running add block plus, i get an aggressive new tab that opens from time to time that has a FBI warning and wants $ I can use control alt delete and kill the process but when i do all windows close.

also it seems from time to time that my computer is running way slower than it was

I have scanned in the past with a number of programs trying to find the problem such as CC Cleaner, AdwCkeanerm Farbar Recovery, Junkware Removal tool, house-call 64bit, Revo uninstaller free, without luck.

I ran windows System file check in administrator mode with the /scannow command and the response is Windows Resource Protection did not find any integrity violations.

As per the instructions here is the FRST.txt Notes:

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:25-10-2015 02

Ran by Ray (administrator) on RAYS-DESKTOP (26-10-2015 08:40:56)

Running from D:\Trblshooting\Farbar Scan Recovery Tool

Loaded Profiles: Ray (Available Profiles: Ray)

Platform: Windows 8.1 Pro (X64) Language: English (United States)

Internet Explorer Version 11 (Default browser: Chrome)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(Trend Micro Inc.) C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe

() C:\Program Files\pia_manager\pia_manager.exe

(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe

() C:\Program Files (x86)\ASUS\ASUS ROG Connect Plus\RC TweakIt Server\AsBCLK.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AI Suite III\AISuite3.exe

() C:\Program Files (x86)\ASUS\AI Suite III\DIP4\DIPAwayMode\DipAwayMode.exe

(Corsair Components, Inc.) C:\Program Files (x86)\Corsair\Corsair Link\CorsairLINK_HardwareMonitor.exe

(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe

() C:\Program Files (x86)\ASUS\AXSP\1.01.02\atkexComSvc.exe

(Trend Micro Inc.) C:\Program Files\Trend Micro\UniClient\UiFrmwrk\uiWatchDog.exe

(Trend Micro Inc.) C:\Program Files\Trend Micro\AMSP\coreFrameworkHost.exe

(Trend Micro Inc.) C:\Program Files\Trend Micro\UniClient\UiFrmwrk\uiSeAgnt.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AAHM\1.00.22\aaHMSvc.exe

() C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.11\AsSysCtrlService.exe

() C:\Program Files (x86)\ASUS\WebStorage\2.0.1.213\AsusWSWinService.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AsusFanControlService\1.04.01\AsusFanControlService.exe

(cFos Software GmbH) C:\Program Files\ASUS\ROG GameFirst II\spd.exe

(Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe

(Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe

(Menten Holdings Ltd) C:\Program Files (x86)\NPVR\NRecord.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe

(Trend Micro Inc.) C:\Program Files\Trend Micro\Titanium\plugin\Pt\PtSvcHost.exe

(Trend Micro Inc.) C:\Program Files\Trend Micro\Titanium\plugin\Pt\PtWatchDog.exe

(Trend Micro Inc.) C:\Program Files\Trend Micro\TMIDS\PwmSvc.exe

(Razer Inc.) C:\Program Files (x86)\Razer\RzWizard\RzWizardService.exe

() C:\Python27\nssm.exe

(DEVGURU Co., LTD.) C:\Program Files\SAMSUNG\USB Drivers\25_escape\conn\ss_conn_service.exe

(Silicondust USA Inc) C:\Program Files\Silicondust\HDHomeRun\hdhomerun_service.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AI Suite III\USB 3.0 Boost\U3BoostSvr64.exe

(IvoSoft) C:\Program Files\Classic Shell\ClassicStartMenu.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe

(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe

(cFos Software GmbH) C:\Program Files\ASUS\ROG GameFirst II\cfosspeed.exe

(Trend Micro Inc.) C:\Program Files\Trend Micro\Titanium\plugin\Pt\PtSessionAgent.exe

(Menten Holdings Ltd) C:\Program Files (x86)\NPVR\NTray.exe

(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Ai Charger\AiChargerAP.exe

() C:\Program Files (x86)\SABnzbd\SABnzbd.exe

(Logitech Inc.) C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe

() C:\Program Files (x86)\Logitech\LWS\Webcam Software\CameraHelperShell.exe

(http://www.ruby-lang.org/) C:\Users\Ray\AppData\Local\Temp\ocr5AE1.tmp\bin\rubyw.exe

() C:\Program Files\pia_manager\pia_manager.exe

(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Integrated Clock Controller Service\ICCProxy.exe

(http://www.ruby-lang.org/) C:\Users\Ray\AppData\Local\Temp\ocrC6CA.tmp\bin\rubyw.exe

() C:\Program Files (x86)\ASUS\AI Suite III\DIP4\DIPAwayMode\EPUShortCut.exe

() C:\Program Files\pia_manager\pia_tray\pia_tray.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe

(Intel® Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe

(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe

(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe

(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer.exe

(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\tv_w32.exe

(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\tv_x64.exe

(Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe

(Menten Holdings Ltd) C:\Program Files (x86)\NPVR\NextPVR.exe

(Trend Micro Inc.) C:\Program Files\Trend Micro\TMIDS\InstallWorkspace.exe

(Microsoft Corporation) C:\Windows\System32\WWAHost.exe

(Plex, Inc.) C:\Program Files (x86)\Plex\Plex Media Server\Plex Media Server.exe

(Python Software Foundation) C:\Program Files (x86)\Plex\Plex Media Server\PlexScriptHost.exe

() C:\Python27\python.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe

(Trend Micro Inc.) C:\Program Files\Trend Micro\TMIDS\PwmNativeMessaging\PwmNativeMessaging.exe

(Trend Micro Inc.) C:\Program Files\Trend Micro\AMSP\module\20013\ChromeExt\chromeextension\TmopChromeMsgHost32.exe

(Trend Micro Inc.) C:\Program Files\Trend Micro\AMSP\module\20002\9.1.1030\9.1.1030\chrome_extension2\host\chrome_native_msg_host.exe

(Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe

(Trend Micro Inc.) C:\Program Files\Trend Micro\Titanium\UIFramework\Toolbar\chromeextension\NativeMessageHost\ToolbarNativeMsgHost.exe

(Python Software Foundation) C:\Program Files (x86)\Plex\Plex Media Server\PlexScriptHost.exe

(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.Reader_6.4.9926.17994_x64__8wekyb3d8bbwe\glcnd.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Trend Micro Inc.) C:\Program Files\Trend Micro SafeSync\HrfsClient.exe

(Trend Micro Inc.) C:\Program Files\Trend Micro SafeSync\hrfscore.exe

(Python Software Foundation) C:\Program Files (x86)\Plex\Plex Media Server\PlexScriptHost.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7569624 2014-07-25] (Realtek Semiconductor)

HKLM\...\Run: [ROG GameFirst II] => C:\Program Files\ASUS\ROG GameFirst II\cFosSpeed.exe [2806672 2014-07-25] (cFos Software GmbH)

HKLM\...\Run: [Classic Start Menu] => C:\Program Files\Classic Shell\ClassicStartMenu.exe [161984 2014-04-20] (IvoSoft)

HKLM\...\Run: [Platinum] => C:\Program Files\Trend Micro\Titanium\plugin\Pt\PtSessionAgent.exe [1266688 2015-05-04] (Trend Micro Inc.)

HKLM\...\Run: [PwmConsole.exe] => C:\Program Files\Trend Micro\TMIDS\PwmConsole.exe [2047216 2015-06-29] (Trend Micro Inc.)

HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2634872 2015-08-26] (NVIDIA Corporation)

HKLM\...\Run: [shadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart

HKLM\...\Run: [Trend Micro Client Framework] => C:\Program Files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe [246304 2014-07-20] (Trend Micro Inc.)

HKLM-x32\...\Run: [ASUS Ai Charger] => C:\Program Files (x86)\ASUS\ASUS Ai Charger\AiChargerAP.exe [547984 2012-08-13] (ASUSTek Computer Inc.)

HKLM-x32\...\Run: [WebStorage] => C:\Program Files (x86)\ASUS\WebStorage\2.0.1.213\ASUSWSLoader.exe [56640 2013-06-26] ()

HKLM-x32\...\Run: [LWS] => C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe [204136 2012-09-13] (Logitech Inc.)

HKLM-x32\...\Run: [RzWizard] => C:\Program Files (x86)\Razer\RzWizard\RzWizard.exe [254976 2015-07-23] (Razer Inc.)

HKLM\...\RunOnce: [PostRebootServiceRegistration] => C:\Program Files\Trend Micro SafeSync\hrfscore.exe [8108296 2015-05-27] (Trend Micro Inc.)

Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)

HKU\S-1-5-21-1762967866-3398325791-1478008531-1001\...\Run: [Messenger (Yahoo!)] => C:\Program Files (x86)\Yahoo!\Messenger\YahooMessenger.exe [6595928 2012-05-25] (Yahoo! Inc.)

HKU\S-1-5-21-1762967866-3398325791-1478008531-1001\...\Run: [uTorrent] => C:\Users\Ray\AppData\Roaming\uTorrent\uTorrent.exe [1696096 2015-09-01] (BitTorrent Inc.)

HKU\S-1-5-21-1762967866-3398325791-1478008531-1001\...\Run: [GoogleChromeAutoLaunch_30A297CA4BE4E9C14106EC01A52D35A1] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [811848 2015-10-20] (Google Inc.)

HKU\S-1-5-21-1762967866-3398325791-1478008531-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [8461224 2015-09-16] (Piriform Ltd)

HKU\S-1-5-21-1762967866-3398325791-1478008531-1001\...\Run: [Plex Media Server] => C:\Program Files (x86)\Plex\Plex Media Server\Plex Media Server.exe [6294664 2015-09-24] (Plex, Inc.)

ShellIconOverlayIdentifiers: [ 00HumyoPaired] -> {A203F945-39E9-4286-AFA2-F3ADFCD5FAAA} => C:\Program Files\Trend Micro SafeSync\HrfsShellExtension.dll [2015-05-27] (Trend Micro Inc.)

ShellIconOverlayIdentifiers: [ 00HumyoPriority] -> {6F1BB626-1107-4b82-B322-54C5E64461B8} => C:\Program Files\Trend Micro SafeSync\HrfsShellExtension.dll [2015-05-27] (Trend Micro Inc.)

ShellIconOverlayIdentifiers: [ 00HumyoProblem] -> {7479C9AF-DA81-4944-92E5-23E49390BB2B} => C:\Program Files\Trend Micro SafeSync\HrfsShellExtension.dll [2015-05-27] (Trend Micro Inc.)

ShellIconOverlayIdentifiers: [ 00HumyoSynced] -> {7479C9AF-DA81-4944-92E5-23E49390BB2A} => C:\Program Files\Trend Micro SafeSync\HrfsShellExtension.dll [2015-05-27] (Trend Micro Inc.)

ShellIconOverlayIdentifiers: [ 00HumyoSyncing] -> {7479C9AF-DA81-4944-92E5-23E49390BB29} => C:\Program Files\Trend Micro SafeSync\HrfsShellExtension.dll [2015-05-27] (Trend Micro Inc.)

ShellIconOverlayIdentifiers: [ 00HumyoUnavailable] -> {66669544-5639-4922-99C8-CE7A86651364} => C:\Program Files\Trend Micro SafeSync\HrfsShellExtension.dll [2015-05-27] (Trend Micro Inc.)

ShellIconOverlayIdentifiers: [!AsusWSShellExt_B] -> {6D4133E5-0742-4ADC-8A8C-9303440F7191} => C:\Program Files (x86)\Common Files\AWS\2.0.1.213\ASUSWSShellExt64.dll [2013-06-25] (ASUS Cloud Corporation.)

ShellIconOverlayIdentifiers: [!AsusWSShellExt_O] -> {64174815-8D98-4CE6-8646-4C039977D809} => C:\Program Files (x86)\Common Files\AWS\2.0.1.213\ASUSWSShellExt64.dll [2013-06-25] (ASUS Cloud Corporation.)

ShellIconOverlayIdentifiers: [!AsusWSShellExt_U] -> {1C5AB7B1-0B38-4EC4-9093-7FD277E2AF4E} => C:\Program Files (x86)\Common Files\AWS\2.0.1.213\ASUSWSShellExt64.dll [2013-06-25] (ASUS Cloud Corporation.)

ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => No File

ShellIconOverlayIdentifiers: [shareOverlay] -> {594D4122-1F87-41E2-96C7-825FB4796516} => C:\Program Files\Classic Shell\ClassicExplorer64.dll [2014-04-20] (IvoSoft)

ShellIconOverlayIdentifiers-x32: [ 00HumyoPaired] -> {A203F945-39E9-4286-AFA2-F3ADFCD5FAAA} => C:\Program Files\Trend Micro SafeSync\HrfsShellExtension32.dll [2015-05-27] (Trend Micro Inc.)

ShellIconOverlayIdentifiers-x32: [ 00HumyoPriority] -> {6F1BB626-1107-4b82-B322-54C5E64461B8} => C:\Program Files\Trend Micro SafeSync\HrfsShellExtension32.dll [2015-05-27] (Trend Micro Inc.)

ShellIconOverlayIdentifiers-x32: [ 00HumyoProblem] -> {7479C9AF-DA81-4944-92E5-23E49390BB2B} => C:\Program Files\Trend Micro SafeSync\HrfsShellExtension32.dll [2015-05-27] (Trend Micro Inc.)

ShellIconOverlayIdentifiers-x32: [ 00HumyoSynced] -> {7479C9AF-DA81-4944-92E5-23E49390BB2A} => C:\Program Files\Trend Micro SafeSync\HrfsShellExtension32.dll [2015-05-27] (Trend Micro Inc.)

ShellIconOverlayIdentifiers-x32: [ 00HumyoSyncing] -> {7479C9AF-DA81-4944-92E5-23E49390BB29} => C:\Program Files\Trend Micro SafeSync\HrfsShellExtension32.dll [2015-05-27] (Trend Micro Inc.)

ShellIconOverlayIdentifiers-x32: [ 00HumyoUnavailable] -> {66669544-5639-4922-99C8-CE7A86651364} => C:\Program Files\Trend Micro SafeSync\HrfsShellExtension32.dll [2015-05-27] (Trend Micro Inc.)

ShellIconOverlayIdentifiers-x32: [shareOverlay] -> {594D4122-1F87-41E2-96C7-825FB4796516} => C:\Program Files\Classic Shell\ClassicExplorer32.dll [2014-04-20] (IvoSoft)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\NextPVR Tray.lnk [2015-09-27]

ShortcutTarget: NextPVR Tray.lnk -> C:\Program Files (x86)\NPVR\NTray.exe (Menten Holdings Ltd)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Trend Micro SafeSync.lnk [2015-10-26]

ShortcutTarget: Trend Micro SafeSync.lnk -> C:\Program Files\Trend Micro SafeSync\HrfsClient.exe (Trend Micro Inc.)

Startup: C:\Users\Ray\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Logitech . Product Registration.lnk [2015-10-06]

ShortcutTarget: Logitech . Product Registration.lnk -> C:\Program Files (x86)\Logitech\Ereg\eReg.exe (Leader Technologies/Logitech)

Startup: C:\Users\Ray\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Plex Media Server.lnk [2015-05-27]

ShortcutTarget: Plex Media Server.lnk -> C:\Program Files (x86)\Plex\Plex Media Server\Plex Media Server.exe (Plex, Inc.)

Startup: C:\Users\Ray\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SABnzbd.lnk [2015-04-05]

ShortcutTarget: SABnzbd.lnk -> C:\Program Files (x86)\SABnzbd\SABnzbd.exe ()

GroupPolicy: Restriction - Chrome <======= ATTENTION

CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\..\Interfaces\{3D90502C-7E0B-4CAE-BFAE-E6F17A682A0B}: [NameServer] 8.8.8.8,8.8.4.4

Tcpip\..\Interfaces\{43BDE109-4F06-490D-B57C-9E6A273CF42B}: [DhcpNameServer] 209.222.18.222 209.222.18.218

Internet Explorer:

==================

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank

HKU\S-1-5-21-1762967866-3398325791-1478008531-1001\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

HKU\S-1-5-21-1762967866-3398325791-1478008531-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://t.msn.com/

SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =

SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =

SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =

BHO: Trend Micro Password Manager BHO -> {3F019D1C-7EAA-4F25-A765-FBA635BD0AFF} -> C:\Program Files\Trend Micro\TMIDS\PwmIEBHO64.dll [2015-06-29] (Trend Micro Inc.)

BHO: Trend Micro Security Toolbar Helper -> {43C6D902-A1C5-45c9-91F6-FD9E90337E18} -> C:\Program Files\Trend Micro\Titanium\plugin\ToolbarIE64\ToolbarIE.dll [2014-07-20] (Trend Micro Inc.)

BHO: ExplorerBHO Class -> {449D0D6E-2412-4E61-B68F-1CB625CD9E52} -> C:\Program Files\Classic Shell\ClassicExplorer64.dll [2014-04-20] (IvoSoft)

BHO: TmIEPlugInBHO Class -> {959A5673-7971-48e6-AF54-58F745AC4ABC} -> C:\Program Files\Trend Micro\AMSP\module\20013\3.5.1239\2.0.1039\TmopIEPlg.dll [2014-06-30] (Trend Micro Inc.)

BHO: TmBpIeBHO -> {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} -> C:\Program Files\Trend Micro\AMSP\module\20002\9.1.1030\9.1.1030\TmBpIe64.dll [2015-07-03] (Trend Micro Inc.)

BHO: ClassicIEBHO Class -> {EA801577-E6AD-4BD5-8F71-4BE0154331A4} -> C:\Program Files\Classic Shell\ClassicIEDLL_64.dll [2014-04-20] (IvoSoft)

BHO-x32: Trend Micro Password Manager BHO -> {3F019D1C-7EAA-4F25-A765-FBA635BD0AFF} -> C:\Program Files\Trend Micro\TMIDS\PwmIEBHO32.dll [2015-06-29] (Trend Micro Inc.)

BHO-x32: Trend Micro Security Toolbar Helper -> {43C6D902-A1C5-45c9-91F6-FD9E90337E18} -> C:\Program Files\Trend Micro\Titanium\UIFramework\ToolbarIE.dll [2014-07-20] (Trend Micro Inc.)

BHO-x32: ExplorerBHO Class -> {449D0D6E-2412-4E61-B68F-1CB625CD9E52} -> C:\Program Files\Classic Shell\ClassicExplorer32.dll [2014-04-20] (IvoSoft)

BHO-x32: Java Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\ssv.dll [2015-04-10] (Oracle Corporation)

BHO-x32: TmIEPlugInBHO Class -> {959A5673-7971-48e6-AF54-58F745AC4ABC} -> C:\Program Files\Trend Micro\AMSP\module\20013\3.5.1239\2.0.1039\TmopIEPlg32.dll [2014-06-30] (Trend Micro Inc.)

BHO-x32: TmBpIeBHO -> {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} -> C:\Program Files\Trend Micro\AMSP\module\20002\9.1.1030\9.1.1030\TmBpIe32.dll [2015-07-03] (Trend Micro Inc.)

BHO-x32: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\jp2ssv.dll [2015-04-10] (Oracle Corporation)

BHO-x32: ClassicIEBHO Class -> {EA801577-E6AD-4BD5-8F71-4BE0154331A4} -> C:\Program Files\Classic Shell\ClassicIEDLL_32.dll [2014-04-20] (IvoSoft)

Toolbar: HKLM - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer64.dll [2014-04-20] (IvoSoft)

Toolbar: HKLM - Trend Micro Password Manager ToolBar - {9B4B91FC-EC4D-4018-9575-96FA5A3C03C5} - C:\Program Files\Trend Micro\TMIDS\PwmIEBHO64.dll [2015-06-29] (Trend Micro Inc.)

Toolbar: HKLM - Trend Micro Security Toolbar - {CCAC5586-44D7-4c43-B64A-F042461A97D2} - C:\Program Files\Trend Micro\Titanium\plugin\ToolbarIE64\ToolbarIE.dll [2014-07-20] (Trend Micro Inc.)

Toolbar: HKLM-x32 - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer32.dll [2014-04-20] (IvoSoft)

Toolbar: HKLM-x32 - Trend Micro Password Manager ToolBar - {9B4B91FC-EC4D-4018-9575-96FA5A3C03C5} - C:\Program Files\Trend Micro\TMIDS\PwmIEBHO32.dll [2015-06-29] (Trend Micro Inc.)

Toolbar: HKLM-x32 - Trend Micro Security Toolbar - {CCAC5586-44D7-4c43-B64A-F042461A97D2} - C:\Program Files\Trend Micro\Titanium\UIFramework\ToolbarIE.dll [2014-07-20] (Trend Micro Inc.)

DPF: HKLM-x32 {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

Handler: tmbp - {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\module\20002\9.1.1030\9.1.1030\TmBpIe64.dll [2015-07-03] (Trend Micro Inc.)

Handler-x32: tmbp - {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\module\20002\9.1.1030\9.1.1030\TmBpIe32.dll [2015-07-03] (Trend Micro Inc.)

Handler: tmop - {69FD7CE3-4604-4fe6-967C-49B9735CEE70} - C:\Program Files\Trend Micro\AMSP\module\20013\3.5.1239\2.0.1039\TmopIEPlg.dll [2014-06-30] (Trend Micro Inc.)

Handler-x32: tmop - {69FD7CE3-4604-4fe6-967C-49B9735CEE70} - C:\Program Files\Trend Micro\AMSP\module\20013\3.5.1239\2.0.1039\TmopIEPlg32.dll [2014-06-30] (Trend Micro Inc.)

Handler: tmtb - {04EAF3FB-4BAC-4B5A-A37D-A1CF210A5A42} - C:\Program Files\Trend Micro\Titanium\plugin\ToolbarIE64\ToolbarIE.dll [2014-07-20] (Trend Micro Inc.)

Handler-x32: tmtb - {04EAF3FB-4BAC-4B5A-A37D-A1CF210A5A42} - C:\Program Files\Trend Micro\Titanium\UIFramework\ToolbarIE.dll [2014-07-20] (Trend Micro Inc.)

Handler: tmtbim - {0B37915C-8B98-4B9E-80D4-464D2C830D10} - C:\Program Files\Trend Micro\Titanium\plugin\ToolbarIE64\ProToolbarIMRatingActiveX.dll [2014-07-20] (Trend Micro Inc.)

Handler-x32: tmtbim - {0B37915C-8B98-4B9E-80D4-464D2C830D10} - C:\Program Files\Trend Micro\Titanium\UIFramework\ProToolbarIMRatingActiveX.dll [2014-07-20] (Trend Micro Inc.)

FireFox:

========

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_19_0_0_185.dll [2015-09-23] ()

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_19_0_0_185.dll [2015-09-23] ()

FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1219160.dll [2015-07-23] (Adobe Systems, Inc.)

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-09-16] (Intel Corporation)

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-09-16] (Intel Corporation)

FF Plugin-x32: @java.com/DTPlugin,version=11.40.2 -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\dtplugin\npDeployJava1.dll [2015-04-10] (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=11.40.2 -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\plugin2\npjp2.dll [2015-04-10] (Oracle Corporation)

FF Plugin-x32: @messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6 -> C:\Program Files (x86)\Yahoo!\Shared\npYState.dll [2012-05-25] (Yahoo! Inc.)

FF Plugin-x32: @Nero.com/KM -> C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL [2014-08-29] (Nero AG)

FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2015-08-07] (NVIDIA Corporation)

FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2015-08-07] (NVIDIA Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-17] (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-17] (Google Inc.)

FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2014-07-22] (VideoLAN)

FF HKLM\...\Firefox\Extensions: [tmbepff@trendmicro.com] - C:\Program Files\Trend Micro\AMSP\module\20002\9.1.1030\9.1.1030\firefoxextension

FF Extension: Trend Micro BEP Firefox Extension - C:\Program Files\Trend Micro\AMSP\module\20002\9.1.1030\9.1.1030\firefoxextension [2015-08-31] [not signed]

FF HKLM-x32\...\Firefox\Extensions: [tmbepff@trendmicro.com] - C:\Program Files\Trend Micro\AMSP\module\20002\9.1.1030\9.1.1030\firefoxextension

FF HKLM-x32\...\Firefox\Extensions: [{BBB77B49-9FF4-4d5c-8FE2-92B1D6CD696C}] - C:\Program Files\Trend Micro\AMSP\module\20013\FxExt\firefoxextension

FF Extension: Trend Micro Osprey Firefox Extension - C:\Program Files\Trend Micro\AMSP\module\20013\FxExt\firefoxextension [2015-08-31] [not signed]

FF HKLM-x32\...\Firefox\Extensions: [{22181a4d-af90-4ca3-a569-faed9118d6bc}] - C:\Program Files\Trend Micro\Titanium\UIFramework\Toolbar\firefoxextension

FF Extension: Trend Micro Toolbar - C:\Program Files\Trend Micro\Titanium\UIFramework\Toolbar\firefoxextension [2015-02-08] [not signed]

FF HKLM-x32\...\Firefox\Extensions: [{8197dd50-b252-4b08-a1be-1277f22357bb}] - C:\Program Files\Trend Micro\TMIDS\PwmFirefoxExt

FF Extension: Trend Micro Password Manager Firefox Extension - C:\Program Files\Trend Micro\TMIDS\PwmFirefoxExt [2015-08-13] [not signed]

Chrome:

=======

CHR HomePage: Default -> hxxp://www.msn.com/?pc=UP21&ocid=UP21DHP&dt=052213

CHR StartupUrls: Default -> "hxxp://google.com/"

CHR Profile: C:\Users\Ray\AppData\Local\Google\Chrome\User Data\Default

CHR Extension: (Google Cast) - C:\Users\Ray\AppData\Local\Google\Chrome\User Data\Default\Extensions\boadgeojelhgndaghljhdicfkmllpafd [2015-10-13]

CHR Extension: (Adblock Plus) - C:\Users\Ray\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2015-09-23]

CHR Extension: (MightyText - SMS from PC & Text from Computer) - C:\Users\Ray\AppData\Local\Google\Chrome\User Data\Default\Extensions\dkfhfaphfkopdgpbfkebjfcblcafcmpi [2015-05-14]

CHR Extension: (MagicScroll eBook Reader) - C:\Users\Ray\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghgnmgfdoiplfmhgghbmlphanpfmjble [2015-06-08]

CHR Extension: (Java for Browsing) - C:\Users\Ray\AppData\Local\Google\Chrome\User Data\Default\Extensions\ibbogmiigionndgfnmajmchoejcapfeo [2015-05-03]

CHR Extension: (Google Hangouts) - C:\Users\Ray\AppData\Local\Google\Chrome\User Data\Default\Extensions\knipolnnllmklapflnccelgolnpehhpl [2015-10-23]

CHR Extension: (ShareThis) - C:\Users\Ray\AppData\Local\Google\Chrome\User Data\Default\Extensions\lplpcpijdokpnbjcklakgabohjgneidi [2015-07-30]

CHR Extension: (Google Hangouts) - C:\Users\Ray\AppData\Local\Google\Chrome\User Data\Default\Extensions\nckgahadagoaajjgafhacjanaoiihapd [2015-10-14]

CHR Extension: (Chrome Web Store Payments) - C:\Users\Ray\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-07-24]

CHR Extension: (Trend Micro Toolbar) - C:\Users\Ray\AppData\Local\Google\Chrome\User Data\Default\Extensions\ohhcpmplhhiiaoiddkfboafbhiknefdf [2015-07-28]

CHR Extension: (Trend Micro Password Manager) - C:\Users\Ray\AppData\Local\Google\Chrome\User Data\Default\Extensions\olmajmomenlhgihenlbjcfbopoghpckg [2015-07-07]

CHR HKLM\...\Chrome\Extension: [olmajmomenlhgihenlbjcfbopoghpckg] - hxxps://clients2.google.com/service/update2/crx

CHR HKLM-x32\...\Chrome\Extension: [idkknaphebegndgimgdpfnconcickdfn] - <no Path/update_url>

CHR HKLM-x32\...\Chrome\Extension: [ohhcpmplhhiiaoiddkfboafbhiknefdf] - hxxps://clients2.google.com/service/update2/crx

CHR HKLM-x32\...\Chrome\Extension: [olmajmomenlhgihenlbjcfbopoghpckg] - hxxps://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 asComSvc; C:\Program Files (x86)\ASUS\AXSP\1.01.02\atkexComSvc.exe [936728 2014-07-25] ()

R2 asHmComSvc; C:\Program Files (x86)\ASUS\AAHM\1.00.22\aaHMSvc.exe [954648 2014-07-25] (ASUSTeK Computer Inc.)

R2 AsSysCtrlService; C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.11\AsSysCtrlService.exe [586880 2014-07-25] ()

R2 Asus WebStorage Windows Service; C:\Program Files (x86)\ASUS\WebStorage\2.0.1.213\AsusWSWinService.exe [71680 2013-06-26] () [File not signed]

R2 AsusFanControlService; C:\Program Files (x86)\ASUS\AsusFanControlService\1.04.01\AsusFanControlService.exe [1656464 2014-07-25] (ASUSTeK Computer Inc.) [File not signed]

R2 cFosSpeedS; C:\Program Files\ASUS\ROG GameFirst II\spd.exe [1009552 2014-07-25] (cFos Software GmbH)

R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1155192 2015-08-26] (NVIDIA Corporation)

S4 HDHomeRun RECORD; C:\Program Files\Silicondust\HDHomeRun\hdhomerun_record.exe [155784 2015-08-26] ()

R2 HDHomeRun Service; C:\Program Files\Silicondust\HDHomeRun\hdhomerun_service.exe [28296 2015-08-26] (Silicondust USA Inc)

R2 Intel® Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [747520 2013-08-27] (Intel® Corporation) [File not signed]

S3 Intel® Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [828376 2013-08-27] (Intel® Corporation)

R2 jhi_service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [169432 2013-09-16] (Intel Corporation)

R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1513784 2015-10-05] (Malwarebytes)

R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1135416 2015-10-05] (Malwarebytes)

R2 NPVR Recording Service; C:\Program Files (x86)\NPVR\NRecord.exe [61440 2015-09-05] (Menten Holdings Ltd) [File not signed]

R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1872504 2015-08-26] (NVIDIA Corporation)

R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe [5544568 2015-08-26] (NVIDIA Corporation)

R3 OnlineStorageService; C:\Program Files\Trend Micro SafeSync\hrfscore.exe [8108296 2015-05-27] (Trend Micro Inc.)

R2 Platinum Host Service; C:\Program Files\Trend Micro\Titanium\plugin\Pt\PtSvcHost.exe [1187328 2015-05-04] (Trend Micro Inc.)

R2 PwmSvc; C:\Program Files\Trend Micro\TMIDS\PwmSvc.exe [333856 2015-06-29] (Trend Micro Inc.)

R2 RzWizardService; C:\Program Files (x86)\Razer\RzWizard\RzWizardService.exe [368128 2015-07-23] (Razer Inc.) [File not signed]

R2 SickRage; C:\Python27\nssm.exe [331264 2014-08-31] () [File not signed]

R2 ss_conn_service; C:\Program Files\SAMSUNG\USB Drivers\25_escape\conn\ss_conn_service.exe [743688 2014-10-13] (DEVGURU Co., LTD.)

R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [5702416 2015-09-11] (TeamViewer GmbH)

S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366552 2015-07-07] (Microsoft Corporation)

S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2015-07-07] (Microsoft Corporation)

R2 Amsp; "C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe" coreFrameworkHost.exe -m=rb -dt=60000 -ad -bt=0 [X]

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R3 AiCharger; C:\Windows\SysWow64\drivers\AiCharger.sys [14848 2012-03-22] (ASUSTek Computer Inc.)

R2 ASInsHelp; C:\Windows\SysWow64\drivers\AsInsHelp64.sys [11832 2013-09-30] ()

R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [15232 2014-07-25] ()

R2 AsRamDisk; C:\Windows\system32\DRIVERS\asramdisk.sys [111928 2013-12-13] (Asus)

R0 asstor64; C:\Windows\System32\drivers\asstor64.sys [84816 2014-07-27] (Asmedia Technology)

R1 AsUpIO; C:\Windows\SysWow64\drivers\AsUpIO.sys [14464 2014-07-25] ()

R3 ASUSFILTER; C:\Windows\SysWow64\drivers\ASUSFILTER.sys [46152 2014-07-25] (MCCI Corporation)

S3 AWEAlloc; C:\Windows\system32\DRIVERS\awealloc.sys [21304 2013-10-06] (Olof Lagerkvist)

R3 e1dexpress; C:\Windows\system32\DRIVERS\e1d64x64.sys [469264 2014-07-25] (Intel Corporation)

S0 ebdrv; C:\Windows\System32\drivers\evbda.sys [3357024 2013-08-22] (Broadcom Corporation)

S3 kbfilter; C:\Windows\system32\DRIVERS\kbfilter.sys [67408 2015-01-29] (Trend Micro Inc.)

R1 mbamchameleon; C:\Windows\system32\drivers\mbamchameleon.sys [109272 2015-10-05] (Malwarebytes)

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-10-05] (Malwarebytes)

R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [192216 2015-10-26] (Malwarebytes)

R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64216 2015-10-05] (Malwarebytes Corporation)

S3 MbswMailbox; C:\Program Files (x86)\ASUS\AI Suite III\690b33e1-0462-4e84-9bea-c7552b45432a.sys [17208 2014-07-28] ()

R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [99288 2013-09-16] (Intel Corporation)

R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19576 2015-08-26] (NVIDIA Corporation)

R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [50472 2015-08-11] (NVIDIA Corporation)

R1 tmactmon; C:\Windows\system32\DRIVERS\tmactmon.sys [122440 2015-07-20] (Trend Micro Inc.)

R0 tmcomm; C:\Windows\System32\DRIVERS\tmcomm.sys [318152 2015-10-19] (Trend Micro Inc.)

R0 TMEBC; C:\Windows\System32\DRIVERS\TMEBC64.sys [50976 2014-07-09] (Trend Micro Inc.)

R3 tmeevw; C:\Windows\system32\DRIVERS\tmeevw.sys [106296 2014-07-09] (Trend Micro Inc.)

S0 tmel; C:\Windows\System32\DRIVERS\tmel.sys [37904 2014-07-09] (Trend Micro Inc.)

R1 tmevtmgr; C:\Windows\system32\DRIVERS\tmevtmgr.sys [93624 2015-07-20] (Trend Micro Inc.)

R3 tmnciesc; C:\Windows\system32\DRIVERS\tmnciesc.sys [407864 2014-07-09] (Trend Micro Inc.)

R2 tmusa; C:\Windows\system32\DRIVERS\tmusa.sys [106296 2014-06-30] (Trend Micro Inc.)

S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [44560 2015-07-07] (Microsoft Corporation)

S3 WdFilter; C:\Windows\system32\drivers\WdFilter.sys [270168 2015-07-07] (Microsoft Corporation)

S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114520 2015-07-07] (Microsoft Corporation)

S3 ssudeadb; \SystemRoot\System32\Drivers\ssudeadb.sys [X]

U2 TMAgent; no ImagePath

R3 WinRing0_1_2_0; \??\C:\Program Files (x86)\Corsair\Corsair Link\CorsairLINK_HardwareMonitor.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-10-26 08:28 - 2015-10-26 08:29 - 00001842 _____ C:\Users\Public\Desktop\SafeSync Folder.lnk

2015-10-26 08:28 - 2015-10-26 08:28 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Trend Micro SafeSync

2015-10-26 08:28 - 2015-10-26 08:28 - 00000000 ____D C:\Program Files\Trend Micro SafeSync

2015-10-26 08:27 - 2015-10-26 08:27 - 00000036 _____ C:\ProgramData\InstallerWebUI.ini

2015-10-26 08:27 - 2015-10-26 08:27 - 00000000 ____D C:\ProgramData\temp_safesync_install

2015-10-20 21:03 - 2015-10-20 21:03 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Plex Media Server

2015-10-20 21:03 - 2015-10-20 21:03 - 00000000 ____D C:\Program Files (x86)\Plex

2015-10-19 18:22 - 2015-10-19 18:22 - 00002794 _____ C:\Windows\System32\Tasks\CCleanerSkipUAC

2015-10-19 18:21 - 2015-10-25 17:04 - 00001276 _____ C:\Windows\setupact.log

2015-10-19 18:21 - 2015-10-19 18:21 - 00000000 _____ C:\Windows\setuperr.log

2015-10-19 17:25 - 2015-10-19 17:25 - 00000794 _____ C:\Users\Public\Desktop\CCleaner.lnk

2015-10-19 17:25 - 2015-10-19 17:25 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner

2015-10-19 17:25 - 2015-10-19 17:25 - 00000000 ____D C:\Program Files\CCleaner

2015-10-15 08:55 - 2015-10-15 08:55 - 00001217 _____ C:\Users\Ray\Desktop\JRT.txt

2015-10-14 23:44 - 2015-09-18 23:18 - 00035384 _____ (Microsoft Corporation) C:\Windows\system32\CompatTelRunner.exe

2015-10-14 23:44 - 2015-09-18 09:42 - 01290752 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll

2015-10-14 23:44 - 2015-09-18 09:42 - 01163776 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

2015-10-14 23:44 - 2015-09-18 09:42 - 00766464 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll

2015-10-14 23:44 - 2015-09-18 09:42 - 00699904 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll

2015-10-14 23:44 - 2015-09-18 09:42 - 00503296 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll

2015-10-14 23:44 - 2015-09-18 09:42 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll

2015-10-14 05:42 - 2015-09-29 08:31 - 07457624 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe

2015-10-14 05:42 - 2015-09-29 08:31 - 01519592 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe

2015-10-14 05:42 - 2015-09-29 08:31 - 01355848 _____ (Microsoft Corporation) C:\Windows\system32\winresume.exe

2015-10-14 05:42 - 2015-08-26 22:43 - 22372152 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll

2015-10-14 05:42 - 2015-08-26 22:42 - 19795904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll

2015-10-14 05:42 - 2015-08-07 17:40 - 01134752 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll

2015-10-14 05:42 - 2015-08-07 17:40 - 00686960 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll

2015-10-14 05:42 - 2015-08-07 17:40 - 00507176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll

2015-10-14 05:42 - 2015-08-07 10:13 - 00862720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll

2015-10-14 05:42 - 2015-08-06 13:05 - 00669184 _____ (Microsoft Corporation) C:\Windows\system32\hhctrl.ocx

2015-10-14 05:42 - 2015-08-06 12:47 - 04710400 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll

2015-10-14 05:42 - 2015-08-06 12:37 - 00536576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\hhctrl.ocx

2015-10-14 05:42 - 2015-08-06 12:18 - 04068352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll

2015-10-14 05:41 - 2015-09-29 08:31 - 01658536 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi

2015-10-14 05:41 - 2015-09-29 08:31 - 01487008 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi

2015-10-14 05:41 - 2015-09-29 08:29 - 00136904 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe

2015-10-14 05:41 - 2015-09-28 14:45 - 03705344 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll

2015-10-14 05:41 - 2015-09-28 14:26 - 00409088 _____ (Microsoft Corporation) C:\Windows\system32\WUSettingsProvider.dll

2015-10-14 05:41 - 2015-09-28 14:25 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll

2015-10-14 05:41 - 2015-09-28 14:25 - 00095744 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll

2015-10-14 05:41 - 2015-09-28 14:25 - 00035840 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe

2015-10-14 05:41 - 2015-09-28 14:22 - 00124928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll

2015-10-14 05:41 - 2015-09-28 14:22 - 00081920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll

2015-10-14 05:41 - 2015-09-28 14:22 - 00029696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe

2015-10-14 05:41 - 2015-09-28 14:15 - 02243072 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll

2015-10-14 05:41 - 2015-09-28 14:13 - 00891904 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll

2015-10-14 05:41 - 2015-09-28 14:12 - 00721920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll

2015-10-14 05:41 - 2015-09-24 13:51 - 00130560 _____ (Microsoft Corporation) C:\Windows\system32\BdeHdCfg.exe

2015-10-14 05:41 - 2015-09-24 13:38 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\BdeHdCfgLib.dll

2015-10-14 05:41 - 2015-09-24 13:30 - 00322048 _____ (Microsoft Corporation) C:\Windows\system32\fvecpl.dll

2015-10-14 05:41 - 2015-09-24 12:42 - 00348672 _____ (Microsoft Corporation) C:\Windows\system32\bdesvc.dll

2015-10-14 05:41 - 2015-09-24 12:40 - 00737280 _____ (Microsoft Corporation) C:\Windows\system32\fveapi.dll

2015-10-14 05:41 - 2015-09-10 14:02 - 25851392 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2015-10-14 05:41 - 2015-09-10 13:19 - 00585728 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2015-10-14 05:41 - 2015-09-10 13:18 - 02886656 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2015-10-14 05:41 - 2015-09-10 13:18 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll

2015-10-14 05:41 - 2015-09-10 13:14 - 05990400 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2015-10-14 05:41 - 2015-09-10 13:09 - 20358144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2015-10-14 05:41 - 2015-09-10 13:06 - 00616960 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2015-10-14 05:41 - 2015-09-10 13:04 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll

2015-10-14 05:41 - 2015-09-10 12:51 - 00489984 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll

2015-10-14 05:41 - 2015-09-10 12:39 - 00504832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2015-10-14 05:41 - 2015-09-10 12:37 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2015-10-14 05:41 - 2015-09-10 12:37 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll

2015-10-14 05:41 - 2015-09-10 12:35 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2015-10-14 05:41 - 2015-09-10 12:33 - 02279936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2015-10-14 05:41 - 2015-09-10 12:28 - 01032704 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll

2015-10-14 05:41 - 2015-09-10 12:28 - 00480256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2015-10-14 05:41 - 2015-09-10 12:27 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll

2015-10-14 05:41 - 2015-09-10 12:24 - 14456832 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2015-10-14 05:41 - 2015-09-10 12:21 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll

2015-10-14 05:41 - 2015-09-10 12:19 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2015-10-14 05:41 - 2015-09-10 12:19 - 00720896 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2015-10-14 05:41 - 2015-09-10 12:19 - 00374784 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll

2015-10-14 05:41 - 2015-09-10 12:17 - 02126336 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2015-10-14 05:41 - 2015-09-10 12:17 - 00416256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll

2015-10-14 05:41 - 2015-09-10 12:07 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2015-10-14 05:41 - 2015-09-10 12:05 - 00279040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll

2015-10-14 05:41 - 2015-09-10 12:02 - 04527616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2015-10-14 05:41 - 2015-09-10 12:01 - 00880128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll

2015-10-14 05:41 - 2015-09-10 12:00 - 12853760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2015-10-14 05:41 - 2015-09-10 11:57 - 02487808 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2015-10-14 05:41 - 2015-09-10 11:57 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll

2015-10-14 05:41 - 2015-09-10 11:55 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2015-10-14 05:41 - 2015-09-10 11:55 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2015-10-14 05:41 - 2015-09-10 11:55 - 00327168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll

2015-10-14 05:41 - 2015-09-10 11:45 - 01546752 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2015-10-14 05:41 - 2015-09-10 11:34 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2015-10-14 05:41 - 2015-09-10 11:31 - 02011136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2015-10-14 05:41 - 2015-09-10 11:27 - 01311232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2015-10-14 05:41 - 2015-09-10 11:26 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2015-10-14 05:41 - 2015-08-22 09:42 - 00901264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ucrtbase.dll

2015-10-14 05:41 - 2015-08-22 09:42 - 00066400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-private-l1-1-0.dll

2015-10-14 05:41 - 2015-08-22 09:42 - 00022368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-math-l1-1-0.dll

2015-10-14 05:41 - 2015-08-22 09:42 - 00019808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-multibyte-l1-1-0.dll

2015-10-14 05:41 - 2015-08-22 09:42 - 00017760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-string-l1-1-0.dll

2015-10-14 05:41 - 2015-08-22 09:42 - 00017760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-stdio-l1-1-0.dll

2015-10-14 05:41 - 2015-08-22 09:42 - 00016224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-runtime-l1-1-0.dll

2015-10-14 05:41 - 2015-08-22 09:42 - 00015712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-convert-l1-1-0.dll

2015-10-14 05:41 - 2015-08-22 09:42 - 00014176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-time-l1-1-0.dll

2015-10-14 05:41 - 2015-08-22 09:42 - 00013664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-filesystem-l1-1-0.dll

2015-10-14 05:41 - 2015-08-22 09:42 - 00012640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-process-l1-1-0.dll

2015-10-14 05:41 - 2015-08-22 09:42 - 00012640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-heap-l1-1-0.dll

2015-10-14 05:41 - 2015-08-22 09:42 - 00012640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-conio-l1-1-0.dll

2015-10-14 05:41 - 2015-08-22 09:42 - 00012128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-utility-l1-1-0.dll

2015-10-14 05:41 - 2015-08-22 09:42 - 00012128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-locale-l1-1-0.dll

2015-10-14 05:41 - 2015-08-22 09:42 - 00012128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-environment-l1-1-0.dll

2015-10-14 05:41 - 2015-08-22 09:35 - 00984448 _____ (Microsoft Corporation) C:\Windows\system32\ucrtbase.dll

2015-10-14 05:41 - 2015-08-22 09:35 - 00063840 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-private-l1-1-0.dll

2015-10-14 05:41 - 2015-08-22 09:35 - 00020832 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-math-l1-1-0.dll

2015-10-14 05:41 - 2015-08-22 09:35 - 00019808 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-multibyte-l1-1-0.dll

2015-10-14 05:41 - 2015-08-22 09:35 - 00017760 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-string-l1-1-0.dll

2015-10-14 05:41 - 2015-08-22 09:35 - 00017760 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-stdio-l1-1-0.dll

2015-10-14 05:41 - 2015-08-22 09:35 - 00016224 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0.dll

2015-10-14 05:41 - 2015-08-22 09:35 - 00015712 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-convert-l1-1-0.dll

2015-10-14 05:41 - 2015-08-22 09:35 - 00014176 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-time-l1-1-0.dll

2015-10-14 05:41 - 2015-08-22 09:35 - 00013664 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-filesystem-l1-1-0.dll

2015-10-14 05:41 - 2015-08-22 09:35 - 00012640 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-process-l1-1-0.dll

2015-10-14 05:41 - 2015-08-22 09:35 - 00012640 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-heap-l1-1-0.dll

2015-10-14 05:41 - 2015-08-22 09:35 - 00012640 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-conio-l1-1-0.dll

2015-10-14 05:41 - 2015-08-22 09:35 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-utility-l1-1-0.dll

2015-10-14 05:41 - 2015-08-22 09:35 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-locale-l1-1-0.dll

2015-10-14 05:41 - 2015-08-22 09:35 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-environment-l1-1-0.dll

2015-10-14 05:41 - 2015-08-07 17:40 - 01736520 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll

2015-10-14 05:41 - 2015-08-07 17:40 - 01499920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll

2015-10-14 05:41 - 2015-07-16 14:58 - 00074752 _____ (Microsoft Corporation) C:\Windows\system32\NcdAutoSetup.dll

2015-10-06 10:26 - 2015-10-26 08:40 - 00000000 ____D C:\FRST

2015-10-06 10:05 - 2015-10-06 10:05 - 00000000 ____D C:\Program Files (x86)\VS Revo Group

2015-10-05 19:37 - 2015-10-05 19:37 - 00000000 ____D C:\Users\Ray\AppData\Roaming\AsRamdisk

2015-10-05 19:21 - 2015-10-05 19:21 - 00007479 _____ C:\Users\Ray\fake av removal.txt

2015-10-02 13:06 - 2015-10-02 13:06 - 00500268 _____ C:\Users\Ray\AppData\Local\census.cache

2015-10-02 13:06 - 2015-10-02 13:06 - 00197402 _____ C:\Users\Ray\AppData\Local\ars.cache

2015-09-27 23:34 - 2015-10-26 08:29 - 00000000 ____D C:\Users\Public\NPVR

2015-09-27 23:34 - 2015-10-06 10:00 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NPVR

2015-09-27 23:34 - 2015-09-27 23:34 - 00001071 _____ C:\Users\Ray\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Start NPVR Service.lnk

2015-09-27 23:34 - 2015-09-27 23:34 - 00000000 ____D C:\Program Files (x86)\NPVR

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-10-26 08:41 - 2014-07-28 20:04 - 00000021 _____ C:\Users\Ray\AppData\Roaming\config_data.dat

2015-10-26 08:37 - 2014-07-28 01:39 - 00000000 ____D C:\Users\Ray\AppData\Roaming\ClassicShell

2015-10-26 08:34 - 2015-04-24 18:00 - 00003598 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1762967866-3398325791-1478008531-1001

2015-10-26 08:29 - 2014-07-29 02:48 - 00000000 ____D C:\ProgramData\boost_interprocess

2015-10-26 08:29 - 2014-07-28 01:33 - 00000000 ____D C:\Users\Ray\AppData\Local\Trend Micro

2015-10-26 08:28 - 2015-05-17 18:24 - 00000000 ____D C:\SickRage

2015-10-26 08:27 - 2014-07-28 01:32 - 00000000 ____D C:\ProgramData\Trend Micro

2015-10-26 08:00 - 2013-08-22 11:36 - 00000000 ____D C:\Windows\system32\sru

2015-10-26 07:14 - 2015-04-24 17:55 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2015-10-25 22:45 - 2014-07-27 19:55 - 00000000 _____ C:\Windows\Path.idx

2015-10-25 22:15 - 2014-07-28 03:04 - 00000688 _____ C:\Windows\MB.idx

2015-10-25 19:24 - 2015-02-08 03:10 - 00000010 _____ C:\Users\Ray\AppData\Local\sponge.last.runtime.cache

2015-10-25 18:30 - 2014-07-27 18:28 - 01857432 _____ C:\Windows\WindowsUpdate.log

2015-10-25 18:10 - 2014-07-28 01:25 - 00000928 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2015-10-25 16:36 - 2014-07-30 18:18 - 00101719 _____ C:\Windows\system32\lvcoinst.log

2015-10-23 02:30 - 2014-07-28 01:25 - 00002203 _____ C:\Users\Public\Desktop\Google Chrome.lnk

2015-10-22 07:39 - 2013-08-22 11:36 - 00000000 ____D C:\Windows\AppReadiness

2015-10-21 08:04 - 2014-03-18 06:04 - 00863592 _____ C:\Windows\system32\PerfStringBackup.INI

2015-10-20 21:03 - 2014-07-29 02:48 - 00000000 ____D C:\ProgramData\Package Cache

2015-10-19 18:33 - 2013-08-22 11:20 - 00000000 ____D C:\Windows\CbsTemp

2015-10-19 18:24 - 2013-08-22 09:25 - 00262144 ___SH C:\Windows\system32\config\ELAM

2015-10-19 18:22 - 2014-07-27 19:44 - 01048576 _____ C:\Windows\PE_Rom.dll

2015-10-19 18:21 - 2015-08-22 18:06 - 00000000 ____D C:\ProgramData\NVIDIA

2015-10-19 18:21 - 2014-07-27 23:14 - 00000000 ____D C:\Windows\pss

2015-10-19 18:21 - 2013-08-22 10:45 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2015-10-19 18:14 - 2015-04-25 11:00 - 00000000 ____D C:\AdwCleaner

2015-10-19 17:27 - 2014-11-27 18:29 - 00000000 ____D C:\Program Files (x86)\Steam

2015-10-19 17:27 - 2014-08-04 13:10 - 00000000 ____D C:\Users\Ray\AppData\Roaming\TeamViewer

2015-10-19 17:27 - 2014-07-31 00:53 - 00000000 ____D C:\Users\Ray\AppData\Roaming\uTorrent

2015-10-19 17:27 - 2014-07-27 19:23 - 00000000 ____D C:\Windows\Panther

2015-10-19 17:23 - 2015-02-08 02:07 - 00318152 _____ (Trend Micro Inc.) C:\Windows\system32\Drivers\tmcomm.sys

2015-10-19 17:22 - 2014-07-28 01:32 - 00000036 _____ C:\Users\Ray\AppData\Local\housecall.guid.cache

2015-10-18 19:03 - 2014-07-27 18:28 - 00000000 ____D C:\Users\Ray

2015-10-17 20:55 - 2015-09-10 23:14 - 00000231 _____ C:\Users\Ray\.swfinfo

2015-10-17 05:52 - 2013-08-22 11:36 - 00000000 ____D C:\Windows\rescache

2015-10-16 18:16 - 2014-11-14 15:54 - 00000000 ____D C:\Users\Ray\AppData\Roaming\vlc

2015-10-16 00:51 - 2013-08-22 11:38 - 00810488 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2015-10-16 00:51 - 2013-08-22 11:38 - 00176632 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2015-10-15 15:46 - 2015-04-24 17:55 - 00001118 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2015-10-15 15:46 - 2015-04-24 17:55 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2015-10-15 15:46 - 2015-04-24 17:55 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware

2015-10-15 09:00 - 2013-08-22 09:25 - 00262144 ___SH C:\Windows\system32\config\BBI

2015-10-15 08:17 - 2015-04-16 17:05 - 00000000 ____D C:\Windows\system32\appraiser

2015-10-15 08:17 - 2015-03-28 16:08 - 00000000 ___SD C:\Windows\system32\CompatTel

2015-10-15 08:17 - 2013-08-22 11:36 - 00000000 ___RD C:\Windows\ToastData

2015-10-14 07:22 - 2014-07-28 04:06 - 00000000 ____D C:\Windows\system32\MRT

2015-10-14 07:20 - 2014-07-28 04:06 - 143481208 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2015-10-07 01:25 - 2014-07-28 03:11 - 00000000 ____D C:\Program Files (x86)\TeamViewer

2015-10-06 10:44 - 2015-04-04 03:31 - 00000000 ___SD C:\Windows\system32\GWX

2015-10-06 10:28 - 2015-04-04 03:31 - 00000000 ___SD C:\Windows\SysWOW64\GWX

2015-10-05 22:43 - 2015-09-10 22:25 - 00000000 ____D C:\Users\Ray\AppData\Roaming\Kodi

2015-10-05 09:50 - 2015-04-24 17:55 - 00109272 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamchameleon.sys

2015-10-05 09:50 - 2015-04-24 17:55 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2015-10-05 09:50 - 2015-04-24 17:55 - 00025816 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys

2015-09-30 23:17 - 2013-08-22 11:36 - 00000000 ____D C:\Windows\system32\NDF

2015-09-27 23:25 - 2015-09-23 21:54 - 00000000 ____D C:\Users\Ray\AppData\Local\hdhomerun_view

==================== Files in the root of some directories =======

2014-07-28 20:04 - 2015-10-26 08:41 - 0000021 _____ () C:\Users\Ray\AppData\Roaming\config_data.dat

2014-08-24 10:40 - 2015-01-12 01:40 - 0000191 _____ () C:\Users\Ray\AppData\Roaming\WB.CFG

2015-10-02 13:06 - 2015-10-02 13:06 - 0197402 _____ () C:\Users\Ray\AppData\Local\ars.cache

2015-10-02 13:06 - 2015-10-02 13:06 - 0500268 _____ () C:\Users\Ray\AppData\Local\census.cache

2014-12-01 19:40 - 2014-12-17 01:40 - 0000001 _____ () C:\Users\Ray\AppData\Local\DSI.DAT

2014-07-28 01:32 - 2015-10-19 17:22 - 0000036 _____ () C:\Users\Ray\AppData\Local\housecall.guid.cache

2014-08-03 03:23 - 2015-06-26 14:00 - 0007614 _____ () C:\Users\Ray\AppData\Local\resmon.resmoncfg

2015-02-08 03:10 - 2015-10-25 19:24 - 0000010 _____ () C:\Users\Ray\AppData\Local\sponge.last.runtime.cache

2014-07-27 19:33 - 2014-07-27 19:33 - 0000000 ____H () C:\ProgramData\DP45977C.lfl

2015-10-26 08:27 - 2015-10-26 08:27 - 0000036 _____ () C:\ProgramData\InstallerWebUI.ini

==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed

C:\Windows\system32\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\system32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\system32\services.exe => File is digitally signed

C:\Windows\system32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\system32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\system32\rpcss.dll => File is digitally signed

C:\Windows\system32\dnsapi.dll => File is digitally signed

C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed

C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

As per the instructions here is the Addition.txt Notes:

Additional scan result of Farbar Recovery Scan Tool (x64) Version:25-10-2015 02

Ran by Ray (2015-10-26 08:41:13)

Running from D:\Trblshooting\Farbar Scan Recovery Tool

Windows 8.1 Pro (X64) (2014-07-27 22:28:08)

Boot Mode: Normal

==========================================================

==================== Accounts: =============================

Administrator (S-1-5-21-1762967866-3398325791-1478008531-500 - Administrator - Disabled)

Guest (S-1-5-21-1762967866-3398325791-1478008531-501 - Limited - Enabled)

HomeGroupUser$ (S-1-5-21-1762967866-3398325791-1478008531-1003 - Limited - Enabled)

Ray (S-1-5-21-1762967866-3398325791-1478008531-1001 - Administrator - Enabled) => C:\Users\Ray

rays-dv6 (S-1-5-21-1762967866-3398325791-1478008531-1004 - Limited - Enabled)

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Trend Micro Maximum Security (Enabled - Up to date) {8242D66F-41BD-4049-C2E6-E578E73B62A0}

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: Trend Micro Maximum Security (Enabled - Up to date) {3923378B-6787-4FC7-F856-DE0A9CBC281D}

AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

µTorrent (HKU\S-1-5-21-1762967866-3398325791-1478008531-1001\...\uTorrent) (Version: 3.4.4.40911 - BitTorrent Inc.)

7-Zip 15.05 beta x64 (HKLM\...\7-Zip) (Version: - )

Adobe Flash Player 19 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 19.0.0.185 - Adobe Systems Incorporated)

Adobe Shockwave Player 12.1 (HKLM-x32\...\Adobe Shockwave Player) (Version: 12.1.9.160 - Adobe Systems, Inc.)

AI Suite 3 (HKLM-x32\...\{D46DA5F0-25AD-4B77-98DA-6DD6AF39FBD9}) (Version: 1.00.56 - ASUSTeK Computer Inc.)

ASUS Ai Charger (HKLM-x32\...\{7FB64E72-9B0E-4460-A821-040C341E414A}) (Version: 1.03.00 - ASUSTeK Computer Inc.)

ASUS Boot Setting (HKLM-x32\...\{7AAE9187-C24F-4073-A951-36C370E7A3A5}) (Version: 1.00.18 - ASUSTeK Computer Inc.)

ASUS PC Diagnostics (HKLM-x32\...\{D709005F-D8DC-42A8-8435-5AE880ECAF82}) (Version: 1.3.4 - ASUSTeK Computer Inc.)

ASUS ROG Connect Plus (HKLM-x32\...\{ECF51D37-52ED-4871-BF8B-FEA34B8B4120}) (Version: 1.00.26 - ASUSTeK Computer Inc.)

CameraHelperMsi (x32 Version: 13.51.815.0 - Logitech) Hidden

CCleaner (HKLM\...\CCleaner) (Version: 5.10 - Piriform)

Classic Shell (HKLM\...\{840C85B7-D3D6-4143-9AF9-DAE80FD54CFC}) (Version: 4.1.0 - IvoSoft)

Corsair Link (HKLM-x32\...\{658EFB3F-8606-4576-8FEC-B0CED48F1E68}) (Version: 2.4.5110 - Corsair)

Corsair Link USB Dongle (Driver Removal) (HKLM-x32\...\CMIUSB&1B1C&1C00) (Version: - Corsair Memory, Inc.)

CouchPotato (HKLM-x32\...\CouchPotato_is1) (Version: 2 - Your Mom)

CPUID ROG CPU-Z 1.65 (HKLM\...\CPUID ROG CPU-Z_is1) (Version: 1.65 - CPUID, Inc.)

erLT (x32 Version: 1.20.138.34 - Logitech, Inc.) Hidden

Git version 1.9.5-preview20150319 (HKLM-x32\...\Git_is1) (Version: 1.9.5-preview20150319 - The Git Development Community)

Google Chrome (HKLM-x32\...\Google Chrome) (Version: 46.0.2490.80 - Google Inc.)

Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden

Google Update Helper (x32 Version: 1.3.28.15 - Google Inc.) Hidden

Half-Life (HKLM-x32\...\Steam App 70) (Version: - Valve)

Half-Life 2 (HKLM-x32\...\Steam App 220) (Version: - Valve)

Half-Life 2: Deathmatch (HKLM-x32\...\Steam App 320) (Version: - Valve)

Half-Life 2: Episode One (HKLM-x32\...\Steam App 380) (Version: - Valve)

Half-Life 2: Episode Two (HKLM-x32\...\Steam App 420) (Version: - Valve)

Half-Life 2: Lost Coast (HKLM-x32\...\Steam App 340) (Version: - Valve)

Half-Life Deathmatch: Source (HKLM-x32\...\Steam App 360) (Version: - Valve)

Half-Life: Blue Shift (HKLM-x32\...\Steam App 130) (Version: - Gearbox Software)

Half-Life: Opposing Force (HKLM-x32\...\Steam App 50) (Version: - Gearbox Software)

Half-Life: Source (HKLM-x32\...\Steam App 280) (Version: - Valve)

HDHomeRun (HKLM\...\{1447F2EE-B042-40AB-8BEB-478FEB1F9A3A}) (Version: 1.0.19686.0 - Silicondust)

ImgBurn (HKLM-x32\...\ImgBurn) (Version: 2.5.8.0 - LIGHTNING UK!)

Intel® Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.15.1730 - Intel Corporation)

Intel® Network Connections Drivers (HKLM\...\PROSet) (Version: 18.5 - Intel)

Intel® Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3412 - Intel Corporation)

Java 8 Update 40 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218040F0}) (Version: 8.0.400 - Oracle Corporation)

join.me (HKU\S-1-5-21-1762967866-3398325791-1478008531-1001\...\JoinMe) (Version: 2.4.0.1104 - LogMeIn, Inc.)

Kodi (HKU\S-1-5-21-1762967866-3398325791-1478008531-1001\...\Kodi) (Version: - XBMC-Foundation)

Logitech Webcam Software (HKLM-x32\...\{D40EB009-0499-459c-A8AF-C9C110766215}) (Version: 2.80 - Logitech Inc.)

Malwarebytes Anti-Malware version 2.2.0.1024 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.0.1024 - Malwarebytes)

MemTweakIt (HKLM-x32\...\{E51AAC3A-D66D-4912-B883-DAFBA249D10F}) (Version: 2.02.01 - ASUSTeK Computer Inc.)

Microsoft Mouse and Keyboard Center (HKLM\...\Microsoft Mouse and Keyboard Center) (Version: 2.5.166.0 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)

Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)

MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)

Nero 2014 (HKLM-x32\...\{4EC535F1-AE46-4734-8188-DA549B7B73D2}) (Version: 15.0.10200 - Nero AG)

Nero 2015 (HKLM-x32\...\{763EF8DC-4CC0-47CA-BE1C-BDE731462250}) (Version: 16.0.02900 - Nero AG)

Nero 2015 Content Pack (HKLM-x32\...\{55192BC6-EDBA-4F48-A2C4-3D164E41AF55}) (Version: 16.0.00300 - Nero AG)

Nero Info (HKLM-x32\...\{B791E0AB-87A9-41A4-8D98-D13C2E37D928}) (Version: 16.0.1003 - Nero AG)

NextPVR (HKLM-x32\...\NextPVR) (Version: - )

NVIDIA 3D Vision Controller Driver 352.65 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 352.65 - NVIDIA Corporation)

NVIDIA 3D Vision Driver 355.60 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 355.60 - NVIDIA Corporation)

NVIDIA GeForce Experience 2.5.14.5 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.5.14.5 - NVIDIA Corporation)

NVIDIA Graphics Driver 355.60 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 355.60 - NVIDIA Corporation)

NVIDIA HD Audio Driver 1.3.34.3 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.34.3 - NVIDIA Corporation)

NVIDIA PhysX System Software 9.15.0428 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.15.0428 - NVIDIA Corporation)

Plex Media Server (HKLM-x32\...\{5a054eae-1147-460c-990a-0859dc73c194}) (Version: 0.9.1213 - Plex, Inc.)

Plex Media Server (x32 Version: 0.9.1213 - Plex, Inc.) Hidden

Prerequisite installer (x32 Version: 15.0.0005 - Nero AG) Hidden

Prerequisite installer (x32 Version: 16.0.0000 - Nero AG) Hidden

Private Internet Access Support Files (HKLM-x32\...\{7D72DAFF-DCB2-437B-BC22-4B2ABF21462B}) (Version: 1.0.0.0 - Private Internet Access)

Python 2.7.9 (64-bit) (HKLM\...\{79F081BF-7454-43DB-BD8F-9EE596813233}) (Version: 2.7.9150 - Python Software Foundation)

Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7218 - Realtek Semiconductor Corp.)

Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)

ROG GameFirst II v9.05 (HKLM\...\ROG GameFirst II) (Version: 9.05 - cFos Software GmbH, Bonn)

ROG RAMDisk (HKLM-x32\...\{DE8C1883-4F14-40DF-8C8C-376157ADF5A3}) (Version: 2.02.05 - ASUSTeK Computer Inc.)

SABnzbd 0.7.20 (HKLM-x32\...\SABnzbd) (Version: 0.7.20 - The SABnzbd Team)

SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.49.0 - SAMSUNG Electronics Co., Ltd.)

SHIELD Streaming (Version: 4.1.3000 - NVIDIA Corporation) Hidden

SHIELD Wireless Controller Driver (Version: 2.5.14.5 - NVIDIA Corporation) Hidden

Skype™ 7.5 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.5.102 - Skype Technologies S.A.)

Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)

swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden

Team Fortress Classic (HKLM-x32\...\Steam App 20) (Version: - Valve)

TeamViewer 10 (HKLM-x32\...\TeamViewer) (Version: 10.0.47484 - TeamViewer)

Trend Micro DirectPass (Version: 1.9.0.1094 - Trend Micro Inc.) Hidden

Trend Micro Maximum Security (HKLM\...\{ABBD4BA8-6703-40D2-AB1E-5BB1F7DB49A4}) (Version: 8.0 - Trend Micro Inc.)

Trend Micro Password Manager (HKLM\...\{3075404F-5657-4f31-A064-FEF98661BDD4}) (Version: 1.9.1189 - Trend Micro Inc.)

Trend Micro SafeSync (HKLM\...\HFRS_is1) (Version: 5.1.0.1590 - Trend Micro)

Trend Micro Titanium (Version: 8.0 - Trend Micro Inc.) Hidden

VCRT for DirectPass x64 (Version: 1.0.0.1000 - Trend Micro, Inc.) Hidden

VCRT for DirectPass x86 (x32 Version: 1.0.0.1000 - Trend Micro, Inc.) Hidden

VLC media player (HKLM-x32\...\VLC media player) (Version: 2.1.5 - VideoLAN)

WebStorage (HKLM-x32\...\WebStorage) (Version: 2.0.1.213 - ASUS Cloud Corporation)

WinDirStat 1.1.2 (HKU\S-1-5-21-1762967866-3398325791-1478008531-1001\...\WinDirStat) (Version: - )

WinRAR 5.20 beta 1 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.20.1 - win.rar GmbH)

Yahoo! Messenger (HKLM-x32\...\Yahoo! Messenger) (Version: - Yahoo! Inc.)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== Restore Points =========================

06-10-2015 10:30:19 JRT Pre-Junkware Removal

14-10-2015 05:34:28 Scheduled Checkpoint

15-10-2015 08:54:03 JRT Pre-Junkware Removal

18-10-2015 19:01:05 Restore Operation

20-10-2015 21:02:20 Plex Media Server

26-10-2015 08:39:58 before farar scan recovery tool

==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 09:25 - 2013-08-22 09:25 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {15A001CD-4218-44B8-A244-4F26D4AFDA08} - System32\Tasks\Private Internet Access Startup => C:\Program Files\pia_manager\pia_manager.exe [2015-05-26] ()

Task: {293B8180-950A-4A8E-A4B5-33CFF6DF7529} - System32\Tasks\Trend Micro Inspect of Platinum => C:\Program Files\Trend Micro\Titanium\plugin\Pt\win32\Inspect\Inspect.exe [2015-05-04] (Trend Micro Inc.)

Task: {42268EC3-7D36-4634-9F85-D0626ECE144E} - System32\Tasks\ASUS\RC TweakIt Server Execute => C:\Program Files (x86)\ASUS\ASUS ROG Connect Plus\RC TweakIt Server\AsBCLK.exe [2014-03-08] ()

Task: {732079E2-F299-4BB7-A6C2-A3D2AA6FEDB3} - System32\Tasks\Microsoft_MKC_Logon_Task_ipoint.exe => C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2015-07-08] (Microsoft Corporation)

Task: {75714EC3-B8AF-4BEC-B09A-075E693949BE} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2015-09-16] (Piriform Ltd)

Task: {76F24A53-CD07-4332-BAB0-D4849C954F70} - System32\Tasks\ASUS\RamDisk => C:\Program Files (x86)\ASUS\ROG RAMDisk\loadImage.exe [2013-12-23] ()

Task: {7DADC0F0-9AB7-46E4-BA2D-17112220F1F2} - System32\Tasks\ASUS\ASUS AISuiteIII => C:\Program Files (x86)\ASUS\AI Suite III\AISuite3.exe [2013-08-07] (ASUSTeK Computer Inc.)

Task: {863BA24A-7C03-4F45-AD15-00D3B9E2A5BC} - System32\Tasks\ASUS\USB 3.0 Boost Service => C:\Program Files (x86)\ASUS\AI Suite III\USB 3.0 Boost\U3BoostSvr.exe [2013-07-24] (ASUSTeK Computer Inc.)

Task: {889BEC1D-A5F5-4B50-9A93-68BF80EE2880} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-26] (Google Inc.)

Task: {8EA4EC40-3E78-4D3E-AE5F-AD6D335237E9} - System32\Tasks\ASUS\Ez Update => C:\Program Files (x86)\ASUS\AI Suite III\EZ Update\EzUpdt.exe [2013-07-24] ()

Task: {94B90711-D2FA-4D91-AE83-C5D49C4116B2} - System32\Tasks\ASUS\ASUS DIPAwayMode => C:\Program Files (x86)\ASUS\AI Suite III\DIP4\DIPAwayMode\DipAwayMode.exe [2013-08-08] ()

Task: {9A7A7999-47C7-435C-822F-A4D66AF90F50} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows\system32\MRT.exe [2015-10-14] (Microsoft Corporation)

Task: {A508591E-3F04-4B73-AC6F-FBB67EF5FEAE} - System32\Tasks\Start CorsairLINK Hardware Monitor => C:\Program Files (x86)\Corsair\Corsair Link\CorsairLINK_HardwareMonitor.exe [2013-08-06] (Corsair Components, Inc.)

Task: {AEF5E91E-DA2C-4F05-B0C0-15DFEC063C6F} - System32\Tasks\Microsoft_Hardware_Launch_ipoint_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2015-07-08] (Microsoft Corporation)

Task: {B306CB35-B067-4BF3-A1EE-087FA7577D15} - System32\Tasks\Microsoft_Hardware_Launch_mousekeyboardcenter_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\mousekeyboardcenter.exe [2015-07-08] (Microsoft)

Task: {C1D89586-433F-401C-B438-CFC71F8A923F} - System32\Tasks\Microsoft_Hardware_Launch_itype_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2015-07-08] (Microsoft Corporation)

Task: {C34DAF1F-2C24-40A0-9F0A-CDCB9B03012D} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-26] (Google Inc.)

Task: {D0EEE9DD-20BD-4E55-A40A-EEE6AE1B2C32} - System32\Tasks\Microsoft_MKC_Logon_Task_itype.exe => C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2015-07-08] (Microsoft Corporation)

Task: {E094D72B-3CBC-4FE0-8AD2-68AB52FB4664} - System32\Tasks\Nero\Nero Info => C:\Program Files (x86)\Common Files\Nero\Nero Info\NeroInfo.exe [2014-07-21] (Nero AG)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Thank you for your Assistance in advance!

kevinf80 · October 26, 2015

Hello and welcome,

P2P/Piracy Warning:

If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall them or completely disable them from running while being assisted here.Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.If you have illegal/cracked software, cracks, keygens etc. on the system, please remove or uninstall them now and read the policy on Piracy.

Next,

Please open Malwarebytes Anti-Malware.

On the Settings tab > Detection and Protection sub tab, Detection Options, tick the box "Scan for rootkits".
Under Non-Malware Protection sub tab Change PUP and PUM entries to Treat detections as Malware
Click on the Scan tab, then click on Scan Now >> . If an update is available, click the Update Now button.
A Threat Scan will begin.
With some infections, you may or may not see this message box.

'Could not load DDA driver'
Click 'Yes' to this message, to allow the driver to load after a restart.
Allow the computer to restart. Continue with the rest of these instructions.
When the scan is complete, click Apply Actions.
Wait for the prompt to restart the computer to appear, then click on Yes.
After the restart once you are back at your desktop, open MBAM once more.

To get the log from Malwarebytes do the following:

Click on the History tab > Application Logs.
Double click on the scan log which shows the Date and time of the scan just performed.
Click Export > From export you have three options:

Copy to Clipboard - if seleted right click to your reply and select "Paste" log will be pasted to your reply
Text file (*.txt) - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply
XML file (*.xml) - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply
Please use "Copy to Clipboard, then Right click to your reply > select "Paste" that will copy the log to your reply…

Next,

Download AdwCleaner by Xplode onto your Desktop.

Double click on Adwcleaner.exe to run the tool.
Click on the Scan in the Actions box
Please wait fot the scan to finish..
When "Waiting for action.Please uncheck elements you want to keep" shows in top line..
Click on the Cleaning box.
Next click OK on the "Closing Programs" pop up box.
Click OK on the Information box & again OK to allow the necessary reboot
After restart the AdwCleaner(C*)-Notepad log will appear, please copy/paste it in your next reply. Where * is the number relative to list of scans completed...

Next,

Please download Junkware Removal Tool to your desktop.

Shut down your protection software now to avoid potential conflicts. (re-enable when done)
Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
The tool will open and start scanning your system.
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next message.

Next,

Download Microsoft's " Malicious Software Removal Tool" and save direct to the desktop

Ensure to get the correct version for your system....

32 Bit version:
https://www.microsoft.com/downloads/en/confirmation.aspx?FamilyId=AD724AE0-E72D-4F54-9AB3-75B8EB148356&displaylang=en

64 Bit version:
https://www.microsoft.com/downloads/en/confirmation.aspx?FamilyId=585D2BDE-367F-495E-94E7-6349F4EFFC74&displaylang=en

Right click on the Tool, select “Run as Administrator” the tool will expand to the options Window
In the "Scan Type" window, select Quick Scan
Perform a scan and Click Finish when the scan is done.

Retrieve the MSRT log as follows, and post it in your next reply:

1) Select the Windows key and R key together to open the "Run" function
2) Type or Copy/Paste the following command to the "Run Line" and Press Enter:

notepad c:\windows\debug\mrt.log

Post those logs, also let me know if any remaining issues or concerns....

Thank you,

Kevin...

kevinf80 · October 30, 2015

Do you still need help?

raynga · November 3, 2015

I just saw your reply i didnt' get a email showing you replied I'm checking now thank you

kevinf80 · November 3, 2015

Select "follow this topic" tab at the top right og this thread...

kevinf80 · November 7, 2015

Do you still need help?

AdvancedSetup · November 13, 2015

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

AdvancedSetup · December 17, 2015

Topic reopened per request

kevinf80 · December 17, 2015

Run to the instructions as per reply #2, post the produced logs, also give an update on any remaining issues or concerns...

raynga · December 25, 2015

I just got back in town and I will do by the end of the weekend, thank you and Merry Christmas

kevinf80 · December 25, 2015

Thanks for the update, a merry christmas to you... catch up later...

raynga · December 25, 2015

I attached the logs from the scan's also I realized i had done a deep scan in microsoft so i canceled it and changed it to a quick scan.

Thanks for your help. let me know what you think,

ps I ran the same scan's on my wife's computer is it OK to post that here or should I open a separate post?

Thanks again

Malwarebytes protection logs.zip

JRT.txt

AdwCleanerC6.txt

mrt.log

kevinf80 · December 25, 2015

What is the current status of your system, are there any remaining issues or concerns? i note that MSRT flags the following entry with no action taken...

E:\g\Users\G Michael Smith\AppData\Local\Google\Chrome\User Data\Default\Extensions\nfnbanddeegfjaahcnigefcmafdbpjhn\1.3\unKTfjKjyE2z.js

What is E:\ drive used for...

regarding your wifes system, yes a fresh topic should be opened...

Thank you,

Kevin

raynga · December 26, 2015

E is a storage drive mostly I didn't notice the issue on teh drive till i stopped the scan to do the scan you listed. so I need to run the full in depth scan from microsoft as there was an issue there.

I was gone so I haven't really used it much yet although i noticed that a number of items were removed. does it appear that there is other issues? can you tell from what I posted?

Thanks

kevinf80 · December 26, 2015

Yes please run the Full scan with MSRT, if that scan does not delete the item flagged in quick scan please let me know, also post the new log. Even when logs do not idicate any more issues/problems, your response to how your system is performing is very valuable to us, clean logs do not always mean the system is OK....

So.... let me see the new log, also give me an update on any remaining issues or concerns....

Thank you,

Kevin....

AdvancedSetup · January 3, 2016

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

Chrome Persistent window pops up with FBI warning intermittently

Recommended Posts

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Recently Browsing 0 members

Important Information