New virus that won't go away

kgh5219 · October 29, 2015

A very complicated virus that started off a chain of downloads. It's called gzsir.exe? I've searched it up on the Internet and it seems that no one else had encountered this virus. It seems to be Chinese. There is also an adware called Chinad? Makes annoying Chinese ads come up. The virus also installed a bunch of extensions and changed start up pages and suchlike. It also disguises it's processes with other names like chrome.exe and other stuff, but in the beginning it was gzsir.exe.

Please help, ran malwarebyte a few times and chinad keeps coming up even though I had supposedly quarantined it

I also basically deleted a bunch of suspicious looking files but I was an idiot and let the virus run for a long time because I was downloading music (which was how I got the virus in the first place :/ )

kevinf80 · October 30, 2015

Hello and welcome to Malwarebytes.org

P2P/Piracy Warning:

If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall them or completely disable them from running while being assisted here. Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.If you have illegal/cracked software, cracks, keygens etc. on the system, please remove or uninstall them now and read the policy on Piracy.

Next,

Change the download folder setting in the default Browser so all tools we may use are saved to the Desktop:

Google Chrome - Click the "Customize and control Google Chrome" button in the upper right-corner of the browser.

Choose Settings. at the bottom of the screen click the
"Show advanced settings..." link. Scroll down to find the Downloads section and click the Change... button. Select your desktop and click OK.

Mozilla Firefox - Click the "Open Menu" button in the upper right-corner of the browser.

Choose Options. In the downloads section, click the Browse button, click on the Desktop folder and the click the "Select Folder" button. Click OK to get out of the Options menu.

Internet Explorer - Click the Tools menu in the upper right-corner of the browser.

Select View downloads. Select the Options link in the lower left of the window. Click Browse and select the Desktop and then choose the Select Folder button. Click OK to get out of the download options screen and then click Close to get out of the View Downloads screen.
NOTE: IE8 Does not support changing download locations in this manner. You will need to download the tool(s) to the default folder, usually Downloads, then copy them to the desktop.

Next,

Follow the instructions in the following link to show hidden files:

http://www.bleepingcomputer.com/tutorials/how-to-see-hidden-files-in-windows/

Next,

Please open Malwarebytes Anti-Malware.

On the Settings tab > Detection and Protection sub tab, Detection Options, tick the box "Scan for rootkits".
Under Non-Malware Protection sub tab Change PUP and PUM entries to Treat detections as Malware
Click on the Scan tab, then click on Scan Now >> . If an update is available, click the Update Now button.
A Threat Scan will begin.
With some infections, you may or may not see this message box.

'Could not load DDA driver'
Click 'Yes' to this message, to allow the driver to load after a restart.
Allow the computer to restart. Continue with the rest of these instructions.
When the scan is complete, click Apply Actions.
Wait for the prompt to restart the computer to appear, then click on Yes.
After the restart once you are back at your desktop, open MBAM once more.

To get the log from Malwarebytes do the following:

Click on the History tab > Application Logs.
Double click on the scan log which shows the Date and time of the scan just performed.
Click Export > From export you have three options:

Copy to Clipboard - if seleted right click to your reply and select "Paste" log will be pasted to your reply
Text file (*.txt) - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply
XML file (*.xml) - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply
Recommend you use "Copy to Clipboard, then Right click to your reply > select "Paste" that will copy the log to your reply…

If Malwarebytes is not installed follow these instructions first:

Download Malwarebytes Anti-Malware to your desktop.

Double-click mbam-setup and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to the following:
Launch Malwarebytes Anti-Malware
A 14 day trial of the Premium features is pre-selected. You may deselect this if you wish, and it will not diminish the scanning and removal capabilities of the program.
Click Finish. Follow the instructions above....

Next,

Download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system (32 bit or 64 bit). If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

If your security alerts to FRST either accept the alert or disable your security and allow FRST to run...

Double-click to run it. When the tool opens click Yes to disclaimer.
Press Scan button.
It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

Next,

Please download RogueKiller and save it to your desktop from the following link: http://www.bleepingcomputer.com/download/roguekiller/

Quit all running programs.
For Windows XP, double-click to start.
For Vista,Windows 7/8/8.1/10, Right-click on the program and select Run as Administrator to start and when prompted allow it to run.
Read and accept the EULA (End User Licene Agreement)
Click Scan to scan the system.
When the scan completes select "Report",in the next window select "Export txt" the log will open as a text file post that log... Also save to your Desktop for reference. log will open.
Close the program > Don't Fix anything!

Let me see those logs in your reply....

Thank you,

Kevin...

kgh5219 · November 5, 2015

Malwarebytes Anti-Malware

www.malwarebytes.org

Scan Date: 05/11/2015

Scan Time: 12:26

Logfile:

Administrator: Yes

Version: 2.2.0.1024

Malware Database: v2015.11.05.03

Rootkit Database: v2015.11.04.02

License: Trial

Malware Protection: Enabled

Malicious Website Protection: Enabled

Self-protection: Disabled

OS: Windows 7 Service Pack 1

CPU: x64

File System: NTFS

User: Master

Scan Type: Threat Scan

Result: Completed

Objects Scanned: 478763

Time Elapsed: 52 min, 42 sec

Memory: Enabled

Startup: Enabled

Filesystem: Enabled

Archives: Enabled

Rootkits: Enabled

Heuristics: Enabled

PUP: Enabled

PUM: Enabled

Processes: 0

(No malicious items detected)

Modules: 0

(No malicious items detected)

Registry Keys: 0

(No malicious items detected)

Registry Values: 9

Adware.ChinAd, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SHELL EXTENSIONS\APPROVED\{646BAAE7-7538-4866-8EEE-974C0AA910AB}, Quarantined, [90d7b1c9c6c549ed0204fd3304fe3dc3],

Adware.ChinAd, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\SHELL EXTENSIONS\APPROVED\{646BAAE7-7538-4866-8EEE-974C0AA910AB}, Quarantined, [84e30773a1eaf54136d0260ac83a0cf4],

PUP.Optional.BrowserAir, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\SHAREDACCESS\PARAMETERS\FIREWALLPOLICY\FIREWALLRULES|{3CA2FCF0-1208-4E6E-B239-01BC581E228B}, v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|LPort=5353|App=C:\Users\Master\AppData\Local\BrowserAir\Application\BrowserAir.exe|Name=BrowserAir (mDNS-In)|Desc=Inbound rule for BrowserAir to allow mDNS traffic.|EmbedCtxt=BrowserAir|, Quarantined, [3d2a3347abe03303493784493ac9a957]

PUP.Optional.ChinAd, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\SHAREDACCESS\PARAMETERS\FIREWALLPOLICY\FIREWALLRULES|{CAB992EE-1D7F-43F5-A4ED-F2AB60FDD4D6}, v2.10|Action=Allow|Active=TRUE|Dir=In|App=C:\IQIYI Video\GeePlayer\GeePlayer.exe|Name=爱奇艺万能播放器|Desc=C:\IQIYI Video\GeePlayer\GeePlayer.exe|, Quarantined, [ec7b39416229e6502e58dbf26e9501ff]

PUP.Optional.IQIYI, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\SHAREDACCESS\PARAMETERS\FIREWALLPOLICY\FIREWALLRULES|{7B870D9A-B8EE-41C8-B6F9-EABB59B2EACF}, v2.10|Action=Allow|Active=TRUE|Dir=In|App=C:\Users\Master\AppData\Roaming\IQIYI Video\LStyle\QyUpdate.exe|Name=爱奇艺升级模块|Desc=C:\Users\Master\AppData\Roaming\IQIYI Video\LStyle\QyUpdate.exe|, Quarantined, [462184f6d1ba93a337557c51db2835cb]

PUP.Optional.IQIYI, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\SHAREDACCESS\PARAMETERS\FIREWALLPOLICY\FIREWALLRULES|{B0741C7B-5264-4284-8DB4-A17E0B266123}, v2.10|Action=Allow|Active=TRUE|Dir=In|App=C:\IQIYI Video\LStyle\QyClient.exe|Name=爱奇艺PPS影音|Desc=C:\IQIYI Video\LStyle\QyClient.exe|, Quarantined, [0f58780286058bab266621ac29da9967]

PUP.Optional.IQIYI, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\SHAREDACCESS\PARAMETERS\FIREWALLPOLICY\FIREWALLRULES|{EAF5C527-8EF3-40F2-A170-546CCF5171AB}, v2.10|Action=Allow|Active=TRUE|Dir=In|App=C:\IQIYI Video\LStyle\QyWebPlayer.exe|Name=爱奇艺PPS影音|Desc=C:\IQIYI Video\LStyle\QyWebPlayer.exe|, Quarantined, [14536e0cd4b7a393ff8d468756ade719]

PUP.Optional.IQIYI, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\SHAREDACCESS\PARAMETERS\FIREWALLPOLICY\FIREWALLRULES|{165F2037-7A20-440A-B646-D8F72FEA368B}, v2.10|Action=Allow|Active=TRUE|Dir=In|App=C:\IQIYI Video\Common\QyKernel.exe|Name=爱奇艺HCDN网络数据传输组件|Desc=C:\IQIYI Video\Common\QyKernel.exe|, Quarantined, [1a4d54266d1e171f9eeea825bc478e72]

PUP.Optional.IQIYI, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\SHAREDACCESS\PARAMETERS\FIREWALLPOLICY\FIREWALLRULES|{E831D923-2D77-43CE-AB0F-989E8BE4E7F2}, v2.10|Action=Allow|Active=TRUE|Dir=In|App=C:\IQIYI Video\LStyle\QyPlayer.exe|Name=爱奇艺视频播放器|Desc=C:\IQIYI Video\LStyle\QyPlayer.exe|, Quarantined, [b6b1344693f8af87325ab21b12f1837d]

Registry Data: 0

(No malicious items detected)

Folders: 0

(No malicious items detected)

Files: 2

PUP.Optional.ChinAd, C:\Users\Master\AppData\Local\temp\setup3.exe, Quarantined, [b8afa0daf596a69044d190b72dd3f20e],

PUP.Optional.ChinAd, C:\Users\Master\AppData\Local\temp\IQIYIsetup_spl004@kb037.exe, Quarantined, [75f2c2b85e2d40f6e77f1eaf0df69f61],

Physical Sectors: 0

(No malicious items detected)

(end)

kgh5219 · November 5, 2015

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:04-11-2015

Ran by Master (administrator) on LUKE (05-11-2015 13:37:24)

Running from C:\Users\Master\Desktop

Loaded Profiles: Master (Available Profiles: Master & Ruke)

Platform: Windows 7 Home Premium Service Pack 1 (X64) Language: English (United States)

Internet Explorer Version 11 (Default browser: Chrome)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Windows\System32\wlanext.exe

(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

() C:\Windows\SysWOW64\DM.exe

(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe

(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe

(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GREGsvc.exe

(HP) C:\Program Files (x86)\HP\HPLaserJetService\HPLaserJetService.exe

(HP) C:\Windows\System32\HPSIsvc.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe

(Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe

(Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe

(Egis Technology Inc.) C:\Program Files (x86)\EgisTec MyWinLocker\x86\MWLService.exe

(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe

() C:\Program Files (x86)\Real\UpdateService\RealPlayerUpdateSvc.exe

(Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe

(RealNetworks, Inc.) C:\Program Files (x86)\Real\RealPlayer\RPDS\Bin\rpdsvc.exe

(Microsoft Corporation) C:\Windows\System32\rundll32.exe

(Egis Technology Inc.) C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe

(Spotify Ltd) C:\Users\Master\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe

(RealNetworks, Inc.) C:\Program Files (x86)\Real\RealPlayer\RPDS\Bin\rpsystray.exe

(Hewlett-Packard Company) C:\Program Files (x86)\HP\HP UT LEDM\bin\hppusg.exe

(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe

(Egis Technology Inc.) C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe

(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

(RealNetworks, Inc.) C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe

(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe

(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMworker.exe

(Intel Corporation) C:\Windows\System32\igfxext.exe

(Intel Corporation) C:\Windows\System32\igfxsrvc.exe

(Egis Technology Inc.) C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe

(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe

(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [mwlDaemon] => C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe [349552 2010-05-27] (Egis Technology Inc.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [10920552 2010-06-22] (Realtek Semiconductor)

HKLM\...\Run: [synTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1890088 2009-12-10] (Synaptics Incorporated)

HKLM\...\Run: [Acer ePower Management] => C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [861216 2010-06-11] (Acer Incorporated)

HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [170256 2015-10-16] (Apple Inc.)

HKLM-x32\...\Run: [Microsoft Default Manager] => C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe [439568 2010-05-10] (Microsoft Corporation)

HKLM-x32\...\Run: [HPUsageTrackingLEDM] => C:\Program Files (x86)\HP\HP UT LEDM\bin\hppusg.exe [30264 2009-08-04] (Hewlett-Packard Company)

HKLM-x32\...\Run: [suiteTray] => C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe [337264 2010-05-27] (Egis Technology Inc.)

HKLM-x32\...\Run: [LManager] => C:\Program Files (x86)\Launch Manager\LManager.exe [975952 2010-08-10] (Dritek System Inc.)

HKLM-x32\...\Run: [iAStorIcon] => C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe [284696 2010-04-13] (Intel Corporation)

HKLM-x32\...\Run: [EgisUpdate] => C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe [201584 2010-03-11] (Egis Technology Inc.)

HKLM-x32\...\Run: [EgisTecPMMUpdate] => C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe [407920 2010-03-11] (Egis Technology Inc.)

HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [41056 2013-05-08] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [sunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [335232 2015-03-07] (Oracle Corporation)

HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2015-08-06] (Apple Inc.)

HKLM-x32\...\Run: [TkBellExe] => C:\Program Files (x86)\Real\RealPlayer\update\realsched.exe [286784 2015-09-04] (RealNetworks, Inc.)

HKLM-x32\...\Run: [RealDownloader] => C:\Program Files (x86)\RealNetworks\RealDownloader\downloader2.exe [614464 2015-07-27] ()

HKLM-x32\...\Run: [ldkxa] => C:\Users\Master\AppData\Roaming\afght\onhbdi\gzsir.exe [261440 2015-10-28] ()

Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)

HKU\S-1-5-21-2562538608-3379174730-3565747309-1005\...\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe

HKU\S-1-5-21-2562538608-3379174730-3565747309-1005\...\Run: [spotify Web Helper] => C:\Users\Master\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1514040 2014-10-21] (Spotify Ltd)

HKU\S-1-5-21-2562538608-3379174730-3565747309-1005\...\Run: [iCloudDrive] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe

HKU\S-1-5-21-2562538608-3379174730-3565747309-1005\...\Run: [iCloudPhotos] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudPhotos.exe

AppInit_DLLs-x32: c:\progra~2\sk-enh~1\psupport.dll => No File

ShellIconOverlayIdentifiers: [4SyncOverlay1] -> {2012DE06-50C0-48BD-ACDE-88F95D4CAD1F} => No File

ShellIconOverlayIdentifiers: [4SyncOverlay2] -> {C72C6188-BEF2-46E5-A89A-52F0ED75219E} => No File

ShellIconOverlayIdentifiers: [4SyncOverlay3] -> {C92F6BC2-AF61-4C0E-80E0-939B8282DDB7} => No File

ShellIconOverlayIdentifiers: [4SyncOverlay4] -> {CB1EFEF8-D5E0-49D1-B768-41B48B1D7803} => No File

ShellIconOverlayIdentifiers: [egisPSDP] -> {30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} => C:\Program Files (x86)\EgisTec MyWinLocker\x64\psdprotect.dll [2010-05-27] (Egis Technology Inc.)

ShellIconOverlayIdentifiers: [Fatlfn] -> {646BAAE7-7538-4866-8EEE-974C0AA910AB} => No File

ShellIconOverlayIdentifiers-x32: [egisPSDP] -> {30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} => C:\Program Files (x86)\EgisTec MyWinLocker\x86\psdprotect.dll [2010-05-27] (Egis Technology Inc.)

ShellIconOverlayIdentifiers-x32: [Fatlfn] -> {646BAAE7-7538-4866-8EEE-974C0AA910AB} => No File

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\RealTimes.lnk [2015-10-28]

ShortcutTarget: RealTimes.lnk -> C:\Program Files (x86)\Real\RealPlayer\RPDS\Bin\rpsystray.exe (RealNetworks, Inc.)

CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

ProxyServer: [s-1-5-21-2562538608-3379174730-3565747309-1005] => http=127.0.0.1:4444;https=127.0.0.1:4445;ftp=127.0.0.1:4444

Winsock: Catalog9 01 C:\Windows\SysWOW64\mintcastnetworks.dll [295736 2014-06-11] (AdwareRoi)

Winsock: Catalog9 02 C:\Windows\SysWOW64\mintcastnetworks.dll [295736 2014-06-11] (AdwareRoi)

Winsock: Catalog9 03 C:\Windows\SysWOW64\mintcastnetworks.dll [295736 2014-06-11] (AdwareRoi)

Winsock: Catalog9 04 C:\Windows\SysWOW64\mintcastnetworks.dll [295736 2014-06-11] (AdwareRoi)

Winsock: Catalog9 15 C:\Windows\SysWOW64\mintcastnetworks.dll [295736 2014-06-11] (AdwareRoi)

Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

Tcpip\..\Interfaces\{3DE1FAC4-B916-448F-A747-E5A362D2FC66}: [DhcpNameServer] 192.168.0.1

Tcpip\..\Interfaces\{C5EDA27D-50E6-4F19-A31E-549A739F6C6B}: [NameServer] 8.8.8.8,8.8.4.4

Tcpip\..\Interfaces\{C5EDA27D-50E6-4F19-A31E-549A739F6C6B}: [DhcpNameServer] 192.168.0.1

Internet Explorer:

==================

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=56626&homepage=www.google.com

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=56626&homepage=www.google.com

HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page =

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com

HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=56626&homepage=hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome

SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=AARTDF&pc=MAAR&src=IE-SearchBox

SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=AARTDF&pc=MAAR&src=IE-SearchBox

SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=AARTDF&pc=MAAR&src=IE-SearchBox

SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=AARTDF&pc=MAAR&src=IE-SearchBox

SearchScopes: HKLM-x32 -> {443789B7-F39C-4b5c-9287-DA72D38F4FE6} URL = hxxp://search.aol.com/aolcom/search?query={searchTerms}&invocationType=tb50aoldesktopie7

SearchScopes: HKU\.DEFAULT -> {4C4C7AAB-5854-4241-A414-E2F1EF119C4A} URL = hxxp://www.dnsbasic.com/?prt=DNSBASIC111&sp=&keywords={searchTerms}

SearchScopes: HKU\S-1-5-21-2562538608-3379174730-3565747309-1005 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =

SearchScopes: HKU\S-1-5-21-2562538608-3379174730-3565747309-1005 -> {4C4C7AAB-5854-4241-A414-E2F1EF119C4A} URL = hxxp://www.dnsbasic.com/?prt=dnsbsc50r1&sp=&keywords={searchTerms}

SearchScopes: HKU\S-1-5-21-2562538608-3379174730-3565747309-1005 -> {F445C8D2-5860-4978-A564-0D8F36A879E4} URL = hxxp://www.search.ask.com/web?p2=%5EADN%5EOSJ000%5EYY%5EGB&gct=&itbv=12.0.1.100&o=APN10616&tpid=ORJ-V7&apn_uid=241C9536-6D17-4B8D-ABB1-7395AE106732&apn_ptnrs=ADN&apn_dtid=%5EOSJ000%5EYY%5EGB&apn_dbr=ie_10.0.9200.16635&doi=2013-07-15&trgb=IE&q={searchTerms}&psv=

BHO: RealNetworks Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\Program Files (x86)\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin64.dll [2015-07-27] (RealDownloader)

BHO: No Name -> {4F524A2D-5637-006A-76A7-7A786E7484D7} -> No File

BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21] (Microsoft Corp.)

BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2013-05-08] (Adobe Systems Incorporated)

BHO-x32: RealNetworks Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\Program Files (x86)\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll [2015-07-27] (RealDownloader)

BHO-x32: Search Helper -> {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} -> C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll [2010-07-27] (Microsoft Corporation)

BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)

BHO-x32: Java Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\ssv.dll [2015-03-22] (Oracle Corporation)

BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21] (Microsoft Corp.)

BHO-x32: Windows Live Messenger Companion Helper -> {9FDDE16B-836F-4806-AB1F-1455CBEFF289} -> C:\Program Files (x86)\Windows Live\Companion\companioncore.dll [2010-11-10] (Microsoft Corporation)

BHO-x32: Skype Browser Helper -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2011-10-10] (Skype Technologies S.A.)

BHO-x32: Daum 클리너 -> {BDDB5A00-D1EB-49D5-B197-72A06DF78AA1} -> C:\Program Files\Daum\Cleaner\DaumStart.1.5.0.114.dll [2012-08-01] (Daum Communications Corp.)

BHO-x32: Bing Bar BHO -> {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -> C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll => No File

BHO-x32: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\jp2ssv.dll [2015-03-22] (Oracle Corporation)

Toolbar: HKLM-x32 - @C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll,-100 - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll No File

Toolbar: HKU\S-1-5-21-2562538608-3379174730-3565747309-1005 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File

DPF: HKLM-x32 {477D5B9A-6479-44F8-9718-9340119B0308} hxxp://www.hanabank.com/resource/download/veraport/down/veraport20.cab

DPF: HKLM-x32 {6A060448-60F9-11D5-A6CD-0002B31F7455}

DPF: HKLM-x32 {6CE20149-ABE3-462E-A1B4-5B549971AA38} C:\Users\Dad\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8SKV67EK\TouchEnKey_Installer.exe

DPF: HKLM-x32 {8C96AC47-F768-47F5-95C2-24018E6674C5} hxxp://www.jjangfile.net/scripts/common/mmsv/ChocoStream.cab

DPF: HKLM-x32 {B9B38E70-EEF6-4E3A-AE84-DDE59A053B7C} hxxp://mail.daum.net/hanmail-ax/DaumActiveX/2_0_1_4/DaumActiveX.cab?ver=2,0,1,4

Handler-x32: s-http - {D37E6C5F-1C0F-47C0-A3B6-403EEC555402} - C:\Program Files (x86)\Initech\SHTTP\InitechSHTTPInterface.11018.dll [2015-02-23] (© INITECH)

Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2011-10-10] (Skype Technologies S.A.)

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2013-02-26] (Skype Technologies)

StartMenuInternet: IEXPLORE.EXE - iexplore.exe

FireFox:

========

FF ProfilePath: C:\Users\Master\AppData\Roaming\Mozilla\Firefox\Profiles\wkwtgo1d.default

FF SelectedSearchEngine: v9

FF Homepage: hxxps://www.malwarebytes.org/restorebrowser/.com/?site=shyosffdefault&prd=set&s=FASzamobl06092,a494acb5-76a5-49e5-81a7-c146c5d77224

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_18_0_0_232.dll [2015-08-31] ()

FF Plugin: @microsoft.com/GENUINE -> disabled [No File]

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_18_0_0_232.dll [2015-08-31] ()

FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw.dll [No File]

FF Plugin-x32: @ahnlab.com/asp/npaosmgr.1 -> C:\Program Files (x86)\AhnLab\ASP\Components\aosmgr\npaosmgr.dll [No File]

FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2015-10-08] ()

FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2013-10-07] (Google)

FF Plugin-x32: @java.com/DTPlugin,version=11.40.2 -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\dtplugin\npDeployJava1.dll [2015-03-22] (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=11.40.2 -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\plugin2\npjp2.dll [2015-03-22] (Oracle Corporation)

FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)

FF Plugin-x32: @Microsoft.com/NpWinExt,version=5.0 -> C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll [No File]

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2010-11-10] (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2010-11-10] (Microsoft Corporation)

FF Plugin-x32: @nexon.com/NxGame -> C:\ProgramData\Nexon\NGM\npNxGame.dll [No File]

FF Plugin-x32: @nexon.net/NxGame -> C:\ProgramData\NexonUS\NGM\npNxGameUS.dll [No File]

FF Plugin-x32: @ngm.nexoneu.com/NxGame -> C:\ProgramData\NexonEU\NGM\npNxGameeu.dll [2011-11-16] (Nexon)

FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll [No File]

FF Plugin-x32: @real.com/nppl3260;version=18.0.2.59 -> c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll [2015-09-04] (RealNetworks, Inc.)

FF Plugin-x32: @real.com/nprpplugin;version=18.0.2.59 -> c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll [2015-09-04] (RealTimes)

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-17] (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-17] (Google Inc.)

FF Plugin-x32: @videolan.org/vlc,version=2.1.2 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2014-07-22] (VideoLAN)

FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2014-07-22] (VideoLAN)

FF Plugin-x32: @wizvera.com/npVeraport20 -> C:\Program Files (x86)\Wizvera\Veraport20\npveraport20.dll [No File]

FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll [2013-05-08] (Adobe Systems Inc.)

FF Plugin HKU\S-1-5-21-2562538608-3379174730-3565747309-1005: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Master\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2014-12-05] (Unity Technologies ApS)

FF user.js: detected! => C:\Users\Master\AppData\Roaming\Mozilla\Firefox\Profiles\wkwtgo1d.default\user.js [2015-02-23]

FF HKLM-x32\...\Firefox\Extensions: [msntoolbar@msn.com] - C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\Firefox => not found

FF HKLM-x32\...\Firefox\Extensions: [{27182e60-b5f3-411c-b545-b44205977502}] - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\firefoxextension\SearchHelperExtension

FF Extension: Search Helper Extension - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\firefoxextension\SearchHelperExtension [2010-12-04] [not signed]

FF HKLM-x32\...\Firefox\Extensions: [{3252b9ae-c69a-4eaf-9502-dc9c1f6c009e}] - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DMExtension

FF Extension: Default Manager - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DMExtension [2010-12-04] [not signed]

FF HKLM-x32\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext => not found

FF HKLM-x32\...\Firefox\Extensions: [quickprint@hp.com] - C:\Program Files (x86)\Hewlett-Packard\SmartPrint\QPExtension

FF Extension: SmartPrintButton - C:\Program Files (x86)\Hewlett-Packard\SmartPrint\QPExtension [2011-01-26] [not signed]

Chrome:

=======

CHR HomePage: Default -> hxxp://www-searching.com/?pid=s&s=FASzamobl06092,a494acb5-76a5-49e5-81a7-c146c5d77224&vp=ch&prd=set

CHR StartupUrls: Default -> "hxxp://google.com/"

CHR Plugin: (Widevine Content Decryption Module) - C:\Users\Master\AppData\Local\Google\Chrome\User Data\WidevineCDM\1.4.6.758\_platform_specific\win_x86\widevinecdmadapter.dll => No File

CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\46.0.2490.80\PepperFlash\pepflashplayer.dll ()

CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\46.0.2490.80\pdf.dll => No File

CHR Plugin: (QuickTime Plug-in 7.7.6) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.7.6) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.7.6) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.7.6) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.7.6) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll (Apple Inc.)

CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

CHR Plugin: (Google Earth Plugin) - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)

CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll => No File

CHR Plugin: (Bing Bar) - C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll => No File

CHR Plugin: (VLC Web Plugin) - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

CHR Plugin: (Windows Live Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

CHR Plugin: (iTunes Application Detector) - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()

CHR Plugin: (Nexon Game Controller) - C:\ProgramData\NexonEU\NGM\npNxGameeu.dll (Nexon)

CHR Plugin: (RealNetworks RealDownloader Chrome Background Extension Plug-In (32-bit) ) - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll => No File

CHR Plugin: (RealNetworks RealDownloader HTML5VideoShim Plug-In (32-bit) ) - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll => No File

CHR Plugin: (RealNetworks RealDownloader PepperFlashVideoShim Plug-In (32-bit) ) - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll => No File

CHR Plugin: (RealDownloader Plugin) - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll => No File

CHR Plugin: (Unity Player) - C:\Users\Master\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)

CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll => No File

CHR Plugin: (Shockwave for Director) - C:\Windows\system32\Adobe\Director\np32dsw.dll => No File

CHR Plugin: (RealPlayer G2 LiveConnect-Enabled Plug-In (32-bit) ) - c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)

CHR Plugin: (RealPlayer Download Plugin) - c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll (RealTimes)

CHR Profile: C:\Users\Master\AppData\Local\Google\Chrome\User Data\Default

CHR Extension: (Google Drive) - C:\Users\Master\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-10-23]

CHR Extension: (YouTube) - C:\Users\Master\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-09-26]

CHR Extension: (Adblock Plus) - C:\Users\Master\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2015-09-22]

CHR Extension: (Google Search) - C:\Users\Master\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-10-28]

CHR Extension: (Google Docs Offline) - C:\Users\Master\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2015-09-04]

CHR Extension: (Chrome Web Store Payments) - C:\Users\Master\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-07-28]

CHR Extension: (Gmail) - C:\Users\Master\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-03-28]

CHR HKU\S-1-5-21-2562538608-3379174730-3565747309-1005\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [nklfajnmfbchcceflgddnkignfheooic] - C:\Users\Master\AppData\Local\B5T\6.0.5.2\Extensions\B5TShoppingAssistantNativeMsg.crx <not found>

StartMenuInternet: Google Chrome.I7TI3I7QGXMC6GV4VF542MKHD4 - C:\Users\luk\AppData\Local\Google\Chrome\Application\chrome.exe

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77104 2015-10-07] (Apple Inc.)

S4 DaumCleanerService; C:\Program Files\Daum\Cleaner\DaumCleanerService.exe [199088 2012-08-01] (Daum Communications Corp.)

R2 DM; C:\Windows\SysWOW64\DM.exe [2535424 2011-06-07] () [File not signed]

R2 HP LaserJet Service; C:\Program Files (x86)\HP\HPLaserJetService\HPLaserJetService.exe [136704 2009-06-24] (HP) [File not signed]

R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1513784 2015-10-05] (Malwarebytes)

R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1135416 2015-10-05] (Malwarebytes)

R2 MWLService; C:\Program Files (x86)\EgisTec MyWinLocker\x86\MWLService.exe [305520 2010-05-27] (Egis Technology Inc.)

S3 npggsvc; C:\Windows\SysWOW64\GameMon.des [3963248 2011-01-12] (INCA Internet Co., Ltd.) [File not signed]

S4 RealPlayer Cloud Service; c:\program files (x86)\real\realplayer\RPDS\Bin\rpdsvc.exe [1115736 2015-09-04] (RealNetworks, Inc.)

R2 RealPlayerUpdateSvc; C:\Program Files (x86)\Real\UpdateService\RealPlayerUpdateSvc.exe [32880 2015-07-27] ()

R2 RealTimes Desktop Service; c:\program files (x86)\real\realplayer\RPDS\Bin\rpdsvc.exe [1115736 2015-09-04] (RealNetworks, Inc.)

R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

S3 xsherlock; C:\Windows\SysWOW64\xsherlock.xem [666720 2012-10-20] (Wellbia.com Co., Ltd.) [File not signed]

S2 BstHdAndroidSvc; "C:\Program Files (x86)\BlueStacks\HD-Service.exe" BstHdAndroidSvc Android [X]

S2 BstHdLogRotatorSvc; C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe [X]

S2 BstHdUpdaterSvc; C:\Program Files (x86)\BlueStacks\HD-UpdaterService.exe [X]

S4 Razer Game Scanner Service; C:\Program Files (x86)\Razer\Razer Services\GSS\GameScannerService.exe [X]

S4 RzMaelstromVADStreamingService; "C:\ProgramData\Razer\Synapse\Devices\Razer Surround\Driver\RzMaelstromVADStreamingService.exe" [X]

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

U5 ALG; C:\Windows\System32\alg.exe [79360 2009-07-14] (Microsoft Corporation)

R1 AMonTDLH; C:\Windows\system32\Drivers\AMonTDLH.sys [118072 2012-09-14] (AhnLab, Inc.)

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)

S3 CdmDrvNt; C:\Windows\system32\Drivers\CdmDrvNt.sys [25656 2009-07-21] (AhnLab, Inc.)

R2 clunet; C:\Windows\system32\drivers\clunet.sys [49224 2010-10-18] (Windows ® Win 7 DDK provider)

S3 ebdrv; C:\Windows\system32\DRIVERS\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)

S3 JRSUKD25; C:\Windows\system32\JRSUKD25.SYS [20384 2014-02-28] (RaonSecure Co., Ltd.)

S3 kcrtx64; C:\Windows\system32\kcrtx64.sys [141848 2014-02-28] (Kings Information & Network)

S3 KovaPlusFltr; C:\Windows\System32\drivers\KovaPlusFltr.sys [15104 2010-01-25] (ROCCAT Development, Inc.) [File not signed]

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-10-05] (Malwarebytes)

R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [192216 2015-11-05] (Malwarebytes)

R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-10-05] (Malwarebytes Corporation)

S3 MfFWEnt; C:\Program Files\AhnLab\ASP\MyFirewall 4.0\MfFWEnt.sys [127224 2014-10-15] (AhnLab, Inc.)

S3 MfIPSEnt; C:\Program Files\AhnLab\ASP\MyFirewall 4.0\MfIPSEnt.sys [156408 2014-10-15] (AhnLab, Inc.)

S3 Mkd2Bthf; C:\Windows\System32\drivers\Mkd2Bthf.sys [98040 2012-03-07] (AhnLab, Inc.)

S3 Mkd2Nadr; C:\Windows\System32\drivers\Mkd2Nadr.sys [107768 2012-03-07] (AhnLab, Inc.)

S3 Mkd3kfNt; C:\Windows\System32\drivers\Mkd3kfNt.sys [183544 2012-03-07] (AhnLab, Inc.)

S3 NPPTNT2; C:\Windows\SysWOW64\npptNT2.sys [4682 2005-01-02] (INCA Internet Co., Ltd.) [File not signed]

R3 RZMAELSTROMVADService; C:\Windows\System32\drivers\RzMaelstromVAD.sys [32768 2014-05-23] (Windows ® Win 7 DDK provider)

R2 rzpmgrk; C:\Windows\system32\drivers\rzpmgrk.sys [37184 2014-10-31] (Razer, Inc.)

R2 rzpnk; C:\Windows\system32\drivers\rzpnk.sys [129600 2014-10-23] (Razer, Inc.)

S3 scsk5; C:\Windows\SysWow64\drivers\scsk5.sys [50608 2015-05-15] ()

S3 scskusbf; C:\Windows\SysWow64\drivers\scskusbf.sys [21432 2015-02-23] (SoftCamp)

S3 scskusbs; C:\Windows\SysWow64\drivers\scskusbs.sys [42352 2015-02-23] (SoftCamp)

S3 AhnFlt2K; \??\C:\Windows\system32\drivers\AhnFlt2K.sys [X]

S3 AhnRec2K; \??\C:\Windows\system32\drivers\AhnRec2K.sys [X]

S2 BstHdDrv; \??\C:\Program Files (x86)\BlueStacks\HD-Hypervisor-amd64.sys [X]

S3 dump_wmimmc; \??\c:\sg interactive\grand chase\GameGuard\dump_wmimmc.sys [X]

S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]

S3 JRSKD24; \??\C:\Windows\system32\JRSKD24.SYS [X]

S0 TfFsMon; system32\drivers\TfFsMon.sys [X]

S3 TfNetMon; \??\C:\Windows\system32\drivers\TfNetMon.sys [X]

S0 TfSysMon; system32\drivers\TfSysMon.sys [X]

S3 vtany; \??\C:\Windows\vtany.sys [X]

S3 wanatw; system32\DRIVERS\wanatw64.sys [X]

S3 xspirit; \??\C:\Windows\xspirit.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-11-05 13:37 - 2015-11-05 13:38 - 00033223 _____ C:\Users\Master\Desktop\FRST.txt

2015-11-05 13:37 - 2015-11-05 13:37 - 00000000 ____D C:\FRST

2015-11-05 13:36 - 2015-11-05 13:36 - 02198016 _____ (Farbar) C:\Users\Master\Desktop\FRST64.exe

2015-11-05 12:15 - 2015-11-05 12:15 - 00000000 ____D C:\MGADiagToolOutput

2015-11-05 12:13 - 2015-11-05 12:13 - 02031992 _____ (Microsoft Corporation) C:\Users\Master\Downloads\MGADiag.exe

2015-11-05 12:13 - 2015-11-05 12:13 - 00000000 ____D C:\ProgramData\Office Genuine Advantage

2015-11-05 12:10 - 2015-11-05 13:33 - 00006424 _____ C:\Windows\system32\PerfStringBackup.TMP

2015-11-05 12:10 - 2015-11-05 12:10 - 00002709 _____ C:\Users\Master\Downloads\legitcheck.hta

2015-11-05 12:08 - 2015-11-05 12:08 - 00000552 _____ C:\Windows\system32\spsys.log

2015-11-05 12:07 - 2015-11-05 13:25 - 00010800 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2015-11-05 12:07 - 2015-11-05 13:25 - 00010800 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2015-11-05 12:03 - 2015-11-05 12:04 - 00470072 _____ C:\Windows\system32\FNTCACHE.DAT

2015-10-29 19:32 - 2015-10-29 19:32 - 00000000 __SHD C:\found.001

2015-10-29 19:24 - 2015-10-29 19:24 - 00007604 _____ C:\Users\Ruke\AppData\Local\Resmon.ResmonCfg

2015-10-29 19:22 - 2015-10-29 19:22 - 00001421 _____ C:\Users\Ruke\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk

2015-10-29 19:22 - 2015-10-29 19:22 - 00000000 ____D C:\Users\Ruke\AppData\Roaming\Real

2015-10-29 19:22 - 2015-10-29 19:22 - 00000000 ____D C:\Users\Ruke\AppData\Roaming\Macromedia

2015-10-29 19:22 - 2015-10-29 19:22 - 00000000 ____D C:\Users\Ruke\AppData\Roaming\Intel Corporation

2015-10-29 19:22 - 2015-10-29 19:22 - 00000000 ____D C:\Users\Ruke\AppData\Roaming\Apple Computer

2015-10-29 19:22 - 2015-10-29 19:22 - 00000000 ____D C:\Users\Ruke\AppData\Roaming\Adobe

2015-10-29 19:22 - 2015-10-29 19:22 - 00000000 ____D C:\Users\Ruke\AppData\Local\Google

2015-10-29 19:22 - 2015-10-29 19:22 - 00000000 ____D C:\Users\Ruke\AppData\Local\EgisTec IPS

2015-10-29 19:22 - 2015-10-29 19:22 - 00000000 ____D C:\Users\Ruke\AppData\Local\CrashRpt

2015-10-29 19:21 - 2015-10-29 19:21 - 00000020 ___SH C:\Users\Ruke\ntuser.ini

2015-10-29 19:21 - 2015-10-29 19:21 - 00000000 ____D C:\Users\Ruke

2015-10-29 19:21 - 2011-02-20 21:01 - 00000000 ____D C:\Users\Ruke\AppData\Local\Microsoft Help

2015-10-29 19:21 - 2009-07-14 04:54 - 00000000 ___RD C:\Users\Ruke\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories

2015-10-29 19:21 - 2009-07-14 04:49 - 00000000 ___RD C:\Users\Ruke\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance

2015-10-29 18:26 - 2015-10-29 18:26 - 00000000 ____D C:\Windows\Minidump

2015-10-28 15:40 - 2015-10-28 15:40 - 00000080 _____ C:\Users\Master\AppData\Roaming\Microsoft\Windows\Start Menu\μTorrent.lnk

2015-10-28 13:40 - 2015-10-28 15:40 - 00001064 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2015-10-28 13:33 - 2015-10-28 15:41 - 00001397 _____ C:\Users\Master\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk

2015-10-28 13:14 - 2015-10-28 13:15 - 00000000 ____D C:\Users\Master\AppData\LocalLow\B5T

2015-10-28 13:14 - 2015-10-28 13:14 - 00000000 ____D C:\Users\Master\AppData\Roaming\afght

2015-10-28 13:11 - 2015-10-28 13:15 - 00000000 ____D C:\Users\Master\AppData\Local\DeskBar

2015-10-28 11:54 - 2015-10-28 11:54 - 00000000 ____D C:\Users\Master\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\iCloud

2015-10-28 11:54 - 2015-10-28 11:54 - 00000000 ____D C:\Users\Master\AppData\Local\Apple Inc

2015-10-28 11:54 - 2015-10-28 11:54 - 00000000 ____D C:\Users\Master\AppData\Local\7AC9325A-5313-488A-9DB0-D0B71223D70B.aplzod

2015-10-28 11:38 - 2015-10-28 15:40 - 00001751 _____ C:\Users\Public\Desktop\iTunes.lnk

2015-10-28 11:38 - 2015-10-28 11:38 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes

2015-10-28 11:37 - 2015-10-28 11:38 - 00000000 ____D C:\Program Files\iTunes

2015-10-28 11:37 - 2015-10-28 11:37 - 00000000 ____D C:\Program Files\iPod

2015-10-28 11:37 - 2015-10-28 11:37 - 00000000 ____D C:\Program Files (x86)\iTunes

2015-10-28 11:32 - 2015-10-28 11:32 - 00000000 ____D C:\Program Files\Bonjour

2015-10-28 11:32 - 2015-10-28 11:32 - 00000000 ____D C:\Program Files (x86)\Bonjour

2015-10-28 11:29 - 2015-10-28 11:29 - 00000000 ____D C:\Program Files (x86)\Apple Software Update

2015-10-27 10:58 - 2015-10-27 10:58 - 00186880 _____ (TODO: <Company name>) C:\Windows\system32\rsrcs.dll

2015-10-23 21:40 - 2015-10-23 21:40 - 00000000 ____D C:\Users\Master\AppData\LocalLow\Oracle

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-11-05 13:31 - 2010-12-04 04:05 - 01197266 _____ C:\Windows\WindowsUpdate.log

2015-11-05 13:29 - 2015-03-12 17:23 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2015-11-05 13:26 - 2014-11-15 17:35 - 00701022 _____ C:\Windows\PFRO.log

2015-11-05 13:26 - 2014-09-30 17:06 - 00006968 _____ C:\Windows\setupact.log

2015-11-05 13:26 - 2011-03-11 19:47 - 00000000 ____D C:\Windows\Sun

2015-11-05 12:36 - 2012-08-21 20:40 - 00007602 _____ C:\Users\Master\AppData\Local\Resmon.ResmonCfg

2015-11-05 12:19 - 2013-11-26 21:32 - 00000000 ____D C:\Users\Master\AppData\Roaming\uTorrent

2015-11-05 12:02 - 2009-07-14 03:20 - 00000000 ____D C:\Windows\Vss

2015-10-29 22:31 - 2012-08-18 10:20 - 00000000 ____D C:\Users\Master

2015-10-29 19:22 - 2013-12-17 21:56 - 00118216 _____ C:\Windows\SysWOW64\GDIPFONTCACHEV1.DAT

2015-10-29 19:22 - 2009-07-14 04:57 - 00001547 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk

2015-10-29 19:15 - 2009-07-14 04:45 - 00000000 ____D C:\Windows\Setup

2015-10-28 16:02 - 2012-08-18 10:21 - 00000000 ____D C:\Users\Master\AppData\Roaming\Apple Computer

2015-10-28 16:02 - 2011-02-22 21:02 - 00000000 ____D C:\Program Files\Common Files\Apple

2015-10-28 15:45 - 2009-07-14 05:32 - 00000000 ____D C:\Windows\addins

2015-10-28 15:41 - 2014-09-11 20:39 - 00001816 _____ C:\Users\Master\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spotify.lnk

2015-10-28 15:41 - 2014-04-26 09:28 - 00001115 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk

2015-10-28 15:41 - 2012-08-18 10:20 - 00001397 _____ C:\Users\Master\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet-Explorer.lnk

2015-10-28 15:41 - 2011-12-01 19:36 - 00002491 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Safari.lnk

2015-10-28 15:41 - 2011-02-24 14:00 - 00001297 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Movie Maker.lnk

2015-10-28 15:41 - 2011-02-24 13:59 - 00002478 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Messenger.lnk

2015-10-28 15:41 - 2011-02-24 13:59 - 00001450 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Mail.lnk

2015-10-28 15:41 - 2011-02-24 13:59 - 00001366 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Photo Gallery.lnk

2015-10-28 15:41 - 2011-02-22 21:03 - 00002507 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk

2015-10-28 15:41 - 2010-12-04 04:26 - 00001352 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Default Manager.lnk

2015-10-28 15:41 - 2010-08-30 09:26 - 00002429 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader 9.lnk

2015-10-28 15:41 - 2010-08-30 08:52 - 00001333 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk

2015-10-28 15:41 - 2010-08-30 08:51 - 00001314 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk

2015-10-28 15:41 - 2009-07-14 04:57 - 00001340 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Anytime Upgrade.lnk

2015-10-28 15:41 - 2009-07-14 04:57 - 00001292 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sidebar.lnk

2015-10-28 15:41 - 2009-07-14 04:57 - 00001234 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XPS Viewer.lnk

2015-10-28 15:41 - 2009-07-14 04:54 - 00001198 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Fax and Scan.lnk

2015-10-28 15:40 - 2015-09-04 10:13 - 00000948 _____ C:\Users\Public\Desktop\RealTimes (RealPlayer).lnk

2015-10-28 15:40 - 2015-08-31 19:43 - 00001803 _____ C:\Users\Public\Desktop\QuickTime Player.lnk

2015-10-28 15:40 - 2014-08-27 00:37 - 00002141 _____ C:\Users\Public\Desktop\Google Chrome.lnk

2015-10-28 15:40 - 2014-04-26 09:28 - 00001109 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk

2015-10-28 15:40 - 2013-12-21 18:08 - 00001028 _____ C:\Users\Public\Desktop\VLC media player.lnk

2015-10-28 15:40 - 2013-12-15 10:12 - 00002170 _____ C:\Users\Public\Desktop\Google Earth.lnk

2015-10-28 15:40 - 2012-09-06 06:04 - 00002509 _____ C:\Users\Public\Desktop\Skype.lnk

2015-10-28 15:40 - 2011-12-01 19:36 - 00002485 _____ C:\Users\Public\Desktop\Safari.lnk

2015-10-28 15:40 - 2011-03-15 19:13 - 00001972 _____ C:\Users\Public\Desktop\Adobe Reader 9.lnk

2015-10-28 15:40 - 2009-07-14 05:01 - 00001218 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Default Programs.lnk

2015-10-28 15:40 - 2009-07-14 04:49 - 00001246 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Windows Update.lnk

2015-10-28 13:40 - 2015-03-12 17:22 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2015-10-28 13:40 - 2014-08-21 20:20 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware

2015-10-28 13:34 - 2014-11-16 18:50 - 00000000 ____D C:\Users\Master\AppData\Local\Unity

2015-10-28 13:15 - 2012-08-18 10:21 - 00118608 _____ C:\Users\Master\AppData\Local\GDIPFONTCACHEV1.DAT

2015-10-28 13:14 - 2014-11-16 18:50 - 00000000 ____D C:\Users\Master\AppData\LocalLow\Unity

2015-10-15 10:05 - 2013-12-12 19:54 - 00000000 ____D C:\Users\Master\AppData\Local\CrashDumps

==================== Files in the root of some directories =======

2014-05-12 18:52 - 2014-03-16 01:22 - 0003541 _____ () C:\Program Files (x86)\NA_Network_Diagnostic_Test_v6.bat

2014-05-12 18:53 - 2014-05-12 18:57 - 0015204 _____ () C:\Program Files (x86)\riot-lol-results-pc-v6.txt

2013-05-11 18:00 - 2013-05-10 05:06 - 0011855 _____ () C:\Users\Master\AppData\Roaming\photo.jpeg

2013-12-11 21:25 - 2014-06-02 20:57 - 0034816 _____ () C:\Users\Master\AppData\Roaming\RZR_0060a48d4361bf547311ce97226c.db

2014-08-26 23:19 - 2014-08-26 23:19 - 0000047 _____ () C:\Users\Master\AppData\Roaming\WB.CFG

2013-01-26 14:46 - 2013-01-30 21:23 - 0000004 _____ () C:\Users\Master\AppData\Local\aqgghxya.log

2015-08-14 10:47 - 2015-08-14 10:47 - 0004608 _____ () C:\Users\Master\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

2013-01-26 14:46 - 2013-01-26 14:46 - 0000000 _____ () C:\Users\Master\AppData\Local\kxolkgoj.log

2013-01-26 14:54 - 2013-01-30 21:22 - 0000000 _____ () C:\Users\Master\AppData\Local\mmxikddc.log

2013-01-26 14:46 - 2013-01-26 14:46 - 0000000 _____ () C:\Users\Master\AppData\Local\qdavljxb.log

2012-08-21 20:40 - 2015-11-05 12:36 - 0007602 _____ () C:\Users\Master\AppData\Local\Resmon.ResmonCfg

2013-04-16 17:03 - 2013-04-16 17:03 - 0000000 _____ () C:\ProgramData\243c3831_c

2012-08-14 11:01 - 2012-08-14 11:01 - 0000064 _____ () C:\ProgramData\cytkwumn.log

Some files in TEMP:

====================

C:\Users\Master\AppData\Local\temp\jre-8u51-windows-au.exe

C:\Users\Master\AppData\Local\temp\jre-8u65-windows-au.exe

C:\Users\Master\AppData\Local\temp\lowproc.exe

C:\Users\Master\AppData\Local\temp\qdAstsetup13.exe

C:\Users\Master\AppData\Local\temp\stubhelper.dll

C:\Users\Master\AppData\Local\temp\tu17p84.exe

==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed

C:\Windows\system32\wininit.exe => File is digitally signed

C:\Windows\SysWOW64\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\system32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\system32\services.exe => File is digitally signed

C:\Windows\system32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\system32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\system32\rpcss.dll => File is digitally signed

C:\Windows\system32\dnsapi.dll => File is digitally signed

C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed

C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2015-02-03 18:16

==================== End of FRST.txt ============================

kgh5219 · November 5, 2015

Additional scan result of Farbar Recovery Scan Tool (x64) Version:04-11-2015

Ran by Master (2015-11-05 13:38:35)

Running from C:\Users\Master\Desktop

Windows 7 Home Premium Service Pack 1 (X64) (2011-02-19 20:57:01)

Boot Mode: Normal

==========================================================

==================== Accounts: =============================

Administrator (S-1-5-21-2562538608-3379174730-3565747309-500 - Administrator - Disabled)

Guest (S-1-5-21-2562538608-3379174730-3565747309-501 - Limited - Disabled)

HomeGroupUser$ (S-1-5-21-2562538608-3379174730-3565747309-1002 - Limited - Enabled)

Master (S-1-5-21-2562538608-3379174730-3565747309-1005 - Administrator - Enabled) => C:\Users\Master

Ruke (S-1-5-21-2562538608-3379174730-3565747309-1006 - Administrator - Enabled) => C:\Users\Ruke

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Acer Backup Manager (HKLM-x32\...\InstallShield_{72B776E5-4530-4C4B-9453-751DF87D9D93}) (Version: 2.0.0.68 - NewTech Infosystems)

Acer Crystal Eye webcam (HKLM-x32\...\{51F026FA-5146-4232-A8BA-1364740BD053}) (Version: 1.0.4.5 - Liteon)

Acer ePower Management (HKLM-x32\...\{3DB0448D-AD82-4923-B305-D001E521A964}) (Version: 5.00.3005 - Acer Incorporated)

Acer eRecovery Management (HKLM-x32\...\{7F811A54-5A09-4579-90E1-C93498E230D9}) (Version: 4.05.3013 - Acer Incorporated)

Acer GameZone Console (HKLM-x32\...\{58F4D244-314F-4D26-B5EF-C28AB32E22CB}_is1) (Version: 6.1.0.9 - Oberon Media, Inc.)

Acer Registration (HKLM-x32\...\Acer Registration) (Version: 1.03.3003 - Acer Incorporated)

Acer ScreenSaver (HKLM-x32\...\Acer Screensaver) (Version: 1.1.0707.2010 - Acer Incorporated)

Acer Updater (HKLM-x32\...\{EE171732-BEB4-4576-887D-CB62727F01CA}) (Version: 1.02.3001 - Acer Incorporated)

Acrobat.com (HKLM-x32\...\{287ECFA4-719A-2143-A09B-D6A12DE54E40}) (Version: 1.6.65 - Adobe Systems Incorporated)

Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 1.5.0.7220 - Adobe Systems Inc.)

Adobe Flash Player 17 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 17.0.0.188 - Adobe Systems Incorporated)

Adobe Flash Player 18 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 18.0.0.232 - Adobe Systems Incorporated)

Adobe Reader 9.5.5 MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-A91000000001}) (Version: 9.5.5 - Adobe Systems Incorporated)

Adobe Shockwave Player 11.6 (HKLM-x32\...\Adobe Shockwave Player) (Version: 11.6.3.633 - Adobe Systems, Inc.)

AhnLab Online Security (HKLM-x32\...\AhnLab Online Security) (Version: - AhnLab, Inc)

Airport Mania First Flight (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11505173}) (Version: - Oberon Media)

Amazonia (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11273477}) (Version: - Oberon Media)

Apple Application Support (32-bit) (HKLM-x32\...\{649A1FD9-5892-46AD-8DF0-C4A43FF61CB7}) (Version: 4.1 - Apple Inc.)

Apple Application Support (64-bit) (HKLM\...\{0DE0A178-AC7B-4650-806C-CF226DE03766}) (Version: 4.1 - Apple Inc.)

Apple Mobile Device Support (HKLM\...\{3540181E-340A-4E7A-B409-31663472B2F7}) (Version: 9.1.0.6 - Apple Inc.)

Apple Software Update (HKLM-x32\...\{FFD1F7F1-1AC9-4BC4-A908-0686D635ABAF}) (Version: 2.1.4.131 - Apple Inc.)

Backup Manager Basic (x32 Version: 2.0.0.68 - NewTech Infosystems) Hidden

Bing Bar Platform (x32 Version: 6.0.2282.0 - Microsoft Corporation) Hidden

BlueStacks Notification Center (HKLM-x32\...\{4FCF716C-CEB4-499D-AFB8-A5375105EC2A}) (Version: 0.9.17.9138 - BlueStack Systems, Inc.)

Bonjour (HKLM\...\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}) (Version: 3.1.0.1 - Apple Inc.)

Broadcom Gigabit NetLink Controller (HKLM\...\{A84DB02B-9C2B-4272-9D2D-A80E00A56513}) (Version: 14.0.2.3 - Broadcom Corporation)

Cake Mania (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111199750}) (Version: - Oberon Media)

CyberLink PowerDVD 9 (HKLM-x32\...\InstallShield_{A8516AC9-AAF1-47F9-9766-03E2D4CDBCF8}) (Version: 9.0.3216.50 - CyberLink Corp.)

D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden

Daum 클리너 (HKLM\...\DaumCleaner) (Version: 1.5 - Daum Communications Corp.)

Dream Day First Home (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113832110}) (Version: - Oberon Media)

eBay Worldwide (HKLM-x32\...\{E0B19DF7-B1C7-4937-82C4-0E4B1E346965}) (Version: 2.1.0901 - OEM)

eSobi v2 (HKLM-x32\...\InstallShield_{15D967B5-A4BE-42AE-9E84-64CD062B25AA}) (Version: 2.0.4.000274 - esobi Inc.)

eSobi v2 (x32 Version: 2.0.4.000274 - esobi Inc.) Hidden

Farm Frenzy 2 (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11531173}) (Version: - Oberon Media)

Feedback Tool (HKLM-x32\...\{13A5E785-5197-4EAD-8EE3-D660271E49BC}) (Version: 1.2.0 - Microsoft Corporation)

Galapago (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111307457}) (Version: - Oberon Media)

Google Chrome (HKLM-x32\...\Google Chrome) (Version: 46.0.2490.80 - Google Inc.)

Google Earth (HKLM-x32\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)

Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden

Google Update Helper (x32 Version: 1.3.28.15 - Google Inc.) Hidden

Heroes of Hellas (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113786380}) (Version: - Oberon Media)

HP LaserJet Professional P1100-P1560-P1600 Series (HKLM\...\HP LaserJet Professional P1100-P1560-P1600 Series) (Version: - )

hppLaserJetService (x32 Version: 001.001.0.0 - Hewlett-Packard) Hidden

hppP1100P1560P1600SeriesLaserJetService (x32 Version: 001.001.0.0 - Hewlett-Packard) Hidden

hppusgP1100P1560P1600Series (x32 Version: 1.0.0.1 - Hewlett-Packard) Hidden

HPSSupply (HKLM-x32\...\{7902E313-FF0F-4493-ACB1-A8147B78DCD0}) (Version: 2.1.1.0000 - Hewlett Packard Development Company L.P.)

Identity Card (HKLM-x32\...\Identity Card) (Version: 1.00.3003 - Acer Incorporated)

INISafe SFilter 7.2 (SFilter v1.0) (HKLM-x32\...\UnINISafeWeb7) (Version: - )

Intel® Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)

Intel® Graphics Media Accelerator Driver (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2182 - Intel Corporation)

Intel® Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 6.0.0.1179 - Intel Corporation)

Intel® Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 9.6.2.1001 - Intel Corporation)

iTunes (HKLM\...\{E690A491-702F-4DEC-9977-C015D1DBB57C}) (Version: 12.3.1.23 - Apple Inc.)

Java 8 Update 40 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218040F0}) (Version: 8.0.400 - Oracle Corporation)

Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Launch Manager (HKLM-x32\...\LManager) (Version: 4.0.14 - Acer Inc.)

League of Legends (HKLM-x32\...\League of Legends 3.0.1) (Version: 3.0.1 - Riot Games)

League of Legends (x32 Version: 3.0.1 - Riot Games) Hidden

Malwarebytes Anti-Malware version 2.2.0.1024 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.0.1024 - Malwarebytes)

MarketResearch (x32 Version: 130.0.374.000 - Hewlett-Packard) Hidden

Merriam Websters Spell Jam (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-112662477}) (Version: - Oberon Media)

Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden

Messenger Companion (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)

Microsoft Office Enterprise 2007 (HKLM-x32\...\ENTERPRISE) (Version: 12.0.6612.1000 - Microsoft Corporation)

Microsoft Office Excel 2007 Help 업데이트 (KB963678) (HKLM-x32\...\{90120000-0016-0412-0000-0000000FF1CE}_ENTERPRISE_{DEA3DED2-5CB8-4FD3-BE1B-7C0412D4117F}) (Version: - Microsoft)

Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)

Microsoft Office Outlook Connector (HKLM-x32\...\{95140000-007A-0409-0000-0000000FF1CE}) (Version: 14.0.5118.5000 - Microsoft Corporation)

Microsoft Office Powerpoint 2007 Help 업데이트 (KB963669) (HKLM-x32\...\{90120000-0018-0412-0000-0000000FF1CE}_ENTERPRISE_{98189FA0-E081-4DBD-84DE-8FB66BF4AC6C}) (Version: - Microsoft)

Microsoft Office Word 2007 Help 업데이트 (KB963665) (HKLM-x32\...\{90120000-001B-0412-0000-0000000FF1CE}_ENTERPRISE_{15B9412E-6769-4CEA-8A83-39FEDB1F3499}) (Version: - Microsoft)

Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)

Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)

Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)

Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (HKLM-x32\...\{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM-x32\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319 (HKLM-x32\...\{196BB40D-1578-3D01-B289-BEFC77A11A1E}) (Version: 10.0.30319 - Microsoft Corporation)

MLS AD Integration (HKLM-x32\...\{4F517950-16E9-49A5-B3B1-91E100604B29}) (Version: 1.0.0 - Micro Librarian Systems)

MobileMe Control Panel (HKLM\...\{6DD01FF3-63CE-436B-96DB-61363EAA4EB8}) (Version: 3.1.8.0 - Apple Inc.)

Mozilla Firefox 18.0.1 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 18.0.1 (x86 en-US)) (Version: 18.0.1 - Mozilla)

Mozilla Firefox 35.0.1 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 35.0.1 (x86 en-US)) (Version: 35.0.1 - Mozilla)

Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 34.0.5 - Mozilla)

Mplayer 0.6.9 (HKLM-x32\...\Mplayer) (Version: 0.6.9 - )

MyWinLocker (x32 Version: 3.1.212.0 - Egis Technology Inc.) Hidden

MyWinLocker Suite (HKLM-x32\...\InstallShield_{738BF5C3-AF7B-4BB0-B7EF-E505EFC756BE}) (Version: 3.1.212.0 - Egis Technology Inc.)

MyWinLocker Suite (x32 Version: 3.1.212.0 - Egis Technology Inc.) Hidden

Nexon Game Manager (HKLM-x32\...\{289AC7E0-0AEE-4a7b-913C-709D9803D23E}) (Version: - )

NWZ-B170 WALKMAN Guide (HKLM-x32\...\{B91B14D5-B817-4C79-BEF6-0A7A23FE6C61}) (Version: 2.1.0.33220 - Sony Corporation)

Poker Pop (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111355427}) (Version: - Oberon Media)

QuickTime 7 (HKLM-x32\...\{80CEEB1E-0A6C-45B9-A312-37A1D25FDEBC}) (Version: 7.78.80.95 - Apple Inc.)

RealDownloader (x32 Version: 18.0.2.56 - RealNetworks, Inc.) Hidden

RealDownloader (x32 Version: 18.0.2.60 - RealNetworks) Hidden

RealNetworks - Microsoft Visual C++ 2008 Runtime (x32 Version: 9.0 - RealNetworks, Inc) Hidden

RealNetworks - Microsoft Visual C++ 2010 Runtime (Version: 10.0 - RealNetworks, Inc) Hidden

RealNetworks - Microsoft Visual C++ 2010 Runtime (x32 Version: 10.0 - RealNetworks, Inc) Hidden

Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6141 - Realtek Semiconductor Corp.)

Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.7600.30122 - Realtek Semiconductor Corp.)

RealTimes (RealPlayer) (HKLM-x32\...\RealPlayer 18.0) (Version: 18.0.2 - RealNetworks)

RealUpgrade 1.1 (x32 Version: 1.1.0 - RealNetworks, Inc.) Hidden

Safari (HKLM-x32\...\{C779648B-410E-4BBA-B75B-5815BCEFE71D}) (Version: 5.34.57.2 - Apple Inc.)

Search Assistant WebSearch 1.74 (HKLM-x32\...\SP_4e24eecb) (Version: - ) <==== ATTENTION

Shredder (Version: 2.0.8.3 - Egis Technology Inc.) Hidden

Shredder (x32 Version: 2.0.8.3 - Egis Technology Inc.) Hidden

SK-Helper 1.74 (HKLM-x32\...\SP_617c7ac4) (Version: - Verified Publisher)

Skype Click to Call (HKLM-x32\...\{B6CF2967-C81E-40C0-9815-C05774FEF120}) (Version: 5.6.8442 - Skype Technologies S.A.)

Skype™ 6.11 (HKLM-x32\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.)

SoftCamp Secure KeyStroke 4.0 (HKLM-x32\...\SoftcampSCSK) (Version: - )

Spin & Win (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110300453}) (Version: - Oberon Media)

Spotify (HKU\S-1-5-21-2562538608-3379174730-3565747309-1005\...\Spotify) (Version: 0.9.14.13.gba5645ad - Spotify AB)

Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)

swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden

Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 14.0.19.0 - Synaptics Incorporated)

Unity Web Player (HKU\S-1-5-21-2562538608-3379174730-3565747309-1005\...\UnityWebPlayer) (Version: 4.6.1f1 - Unity Technologies ApS)

Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)

UpdateService (x32 Version: 1.0.0 - RealNetworks, Inc.) Hidden

VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0 - DivX, Inc) Hidden

Veraport20(Security module management) - 2,5,1,6 (HKLM-x32\...\{2D992E01-604B-472C-A883-1DDA105A24D5}_is1) (Version: 2,5,1,6 - Wizvera)

Video Downloader (x32 Version: 1.0.0 - RealNetworks) Hidden

VLC media player (HKLM-x32\...\VLC media player) (Version: 2.1.5 - VideoLAN)

Welcome Center (HKLM-x32\...\Acer Welcome Center) (Version: 1.02.3004 - Acer Incorporated)

Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3502.0922 - Microsoft Corporation)

Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation)

Windows Live Sync (HKLM-x32\...\{B10914FD-8812-47A4-85A1-50FCDE7F1F33}) (Version: 14.0.8117.416 - Microsoft Corporation)

WinRAR 5.01 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.01.0 - win.rar GmbH)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== Restore Points =========================

==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 02:34 - 2013-01-31 18:48 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts

127.0.0.1 localhost

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {04026F6F-526F-4096-A160-5CEB98E55FD1} - System32\Tasks\{591457EB-5077-43BA-B069-AF13F542FB09} => pcalua.exe -a C:\Users\luk\Downloads\jre-6u24-windows-i586-iftw(3).exe -d "C:\Program Files (x86)\Mozilla Firefox 4.0 Beta 11"

Task: {09172A5F-209C-4779-A8B9-EAE7B1D18F4B} - System32\Tasks\Sk-Enhancer-S-5902107913 => c:\programdata\quickset\sk-enhancer\Sk-Enhancer.exe <==== ATTENTION

Task: {0A06C8E9-F35C-4414-9365-62C6D6E45629} - System32\Tasks\{81EC26CB-FC62-4850-B73F-9EC046D5EDBB} => pcalua.exe -a "C:\Remote Programs\Leeloo's Talent Agency\GPlrLanc.exe" -c -LOpCode 2 /RemoveContent cid=721750;name=Leeloo's Talent Agency;dir=C:\Remote Programs\Leeloo's Talent Agency\;prvid=143;cmdid=1;prvdir=Default

Task: {117987D2-0CDD-424B-8F35-E501D4C15F83} - System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-2562538608-3379174730-3565747309-1005 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2015-07-27] (RealNetworks, Inc.)

Task: {1BF6F709-663B-4985-967D-18DF3E1A68AF} - System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-2562538608-3379174730-3565747309-1005 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2015-07-27] (RealNetworks, Inc.)

Task: {2013D8E8-C751-4A3E-A865-0577C252F603} - System32\Tasks\{FB587424-E5B5-4F20-A9CE-07D6EBBD00E0} => pcalua.exe -a "C:\Remote Programs\Leeloo's Talent Agency\GPlrLanc.exe" -c -LOpCode 2 /RemoveContent cid=721750;name=Leeloo's Talent Agency;dir=C:\Remote Programs\Leeloo's Talent Agency\;prvid=143;cmdid=1;prvdir=Default

Task: {222A3CCF-44BC-4B3A-AD32-218514666674} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-31] (Google Inc.)

Task: {3F631565-51F6-419F-8352-E826F02614A8} - System32\Tasks\{34DA9454-7B6A-43C0-85AD-BE1306D9F696} => pcalua.exe -a "C:\Users\luk\Downloads\New folder\MSSetupv83.exe" -d "C:\Users\luk\Downloads\New folder"

Task: {40FDAE7E-05DC-48EA-B9BE-EFEDAEB7B1B5} - System32\Tasks\{2A82FD18-9598-4C49-9C06-14BD8DDA6834} => pcalua.exe -a "C:\Users\Master\Local Settings\Application Data\Bundled software uninstaller\biclient.exe" -c /initurl hxxp://bi.bisrv.com/:affid:/:sid:/:uid:? /affid uninstall /id uninstall /name "Bundled software uninstaller"

Task: {426F6309-9A90-4293-9CF5-AF85B53C0171} - System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-2562538608-3379174730-3565747309-1005 => C:\Program Files (x86)\RealNetworks\RealDownloader\realupgrade.exe [2015-07-27] (RealNetworks, Inc.)

Task: {4CF65650-702F-4DEF-BFFE-FE6F6B6A7485} - System32\Tasks\Trojan Killer => C:\Program Files\GridinSoft Trojan Killer\trojankiller.exe

Task: {6E0DDEAC-0C7C-4FA8-A3DF-A4D67560D64F} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2015-08-27] (Apple Inc.)

Task: {88D5203D-3311-45EB-8A8B-04BAC7D3DA1C} - System32\Tasks\LaunchSignup => C:\Program Files (x86)\MyPC Backup\Signup Wizard.exe <==== ATTENTION

Task: {92559B97-FA4F-49DE-A58A-5E287C7FF5D1} - System32\Tasks\RealDownloaderDownloaderScheduledTaskS-1-5-21-2562538608-3379174730-3565747309-1005 => C:\Program Files (x86)\RealNetworks\RealDownloader\recordingmanager.exe [2015-07-27] (RealNetworks, Inc.)

Task: {93083D06-A07A-4884-9DF9-6867455C9669} - System32\Tasks\SidebarExecute => C:\Program Files (x86)\Windows Sidebar\sidebar.exe [2010-11-20] (Microsoft Corporation)

Task: {99F3F955-35DE-4A16-AB5E-A1BD0EF3A80A} - System32\Tasks\RunAsStdUser Task => C:\Users\Master\AppData\Local\gameflakeSA\bin\1.0.11.0\GameFlakeSA.exe <==== ATTENTION

Task: {B57C9741-35DC-4282-91B9-F3AFC4C1D3D6} - \Test TimeTrigger -> No File <==== ATTENTION

Task: {BB48DAD0-51EF-49DB-8F72-38A3DAC3A931} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-08-31] (Adobe Systems Incorporated)

Task: {BC47FA25-9DBB-49D8-A2DB-DCF5C3580CB2} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-31] (Google Inc.)

Task: {C630D205-6042-4008-87C5-A17EC56B55F5} - System32\Tasks\{4F2BA3FA-C0A0-49B9-A270-D21866EE47A5} => pcalua.exe -a "C:\Nexon\Europe MapleStory\Setup.exe" -d "C:\Nexon\Europe MapleStory"

Task: {C7D21CA1-A678-4A5C-96C3-1E0E7A07061E} - System32\Tasks\AutoKMSCustom => C:\Windows\AutoKMS\AutoKMS.exe

Task: {DF013C53-02CE-4492-9B67-3680F10C16A9} - System32\Tasks\{41154EC5-E06D-4263-9390-ADF52902598E} => pcalua.exe -a C:\Users\luk\Downloads\jre-6u24-windows-i586-iftw(3).exe -d "C:\Program Files (x86)\Mozilla Firefox 4.0 Beta 11"

Task: {E3D86EE5-3B45-4A8C-92B8-1099DF26175D} - System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-2562538608-3379174730-3565747309-1005 => C:\Program Files (x86)\RealNetworks\RealDownloader\realupgrade.exe [2015-07-27] (RealNetworks, Inc.)

Task: {EAD81C2C-00E4-4F71-AD56-1285B0033072} - \PC SpeedUp Service Deactivator -> No File <==== ATTENTION

Task: {FCC49B66-B670-488E-A906-ACD04858F400} - System32\Tasks\{43683F31-E93C-4C68-8FBA-2777FF3B7A2D} => pcalua.exe -a "C:\Program Files (x86)\Acer GameZone\Farm Frenzy 2\Uninstall.exe" -c "C:\Program Files (x86)\Acer GameZone\Farm Frenzy 2\install.log"

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\Windows\Tasks\AutoKMSCustom.job => C:\Windows\AutoKMS\AutoKMS.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore1d0b409cef98cef.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore1d0c01bea26f8b4.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore1d0e4075456c35.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore1d0f1663bc0b05c.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\RealDownloader Update Check.job => C:\Program Files (x86)\RealNetworks\RealDownloader\downloader2.exe

Task: C:\Windows\Tasks\RealDownloaderDownloaderScheduledTaskS-1-5-21-2562538608-3379174730-3565747309-1005.job => C:\Program Files (x86)\RealNetworks\RealDownloader\recordingmanager.exe

Task: C:\Windows\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-2562538608-3379174730-3565747309-1005.job => C:\Program Files (x86)\RealNetworks\RealDownloader\realupgrade.exe

Task: C:\Windows\Tasks\Sk-Enhancer-S-5902107913.job => c:\programdata\quickset\sk-enhancer\Sk-Enhancer.exeH/schedule /profile c:\programdata\quickset\sk-enhancer\5902107913.ini <==== ATTENTION

==================== Loaded Modules (Whitelisted) ==============

2014-06-02 19:25 - 2012-08-31 14:03 - 00288768 _____ () C:\Windows\System32\HP1100LM.DLL

2014-06-02 19:25 - 2012-08-31 14:02 - 00074240 _____ () C:\Windows\system32\spool\PRTPROCS\x64\HP1100PP.DLL

2015-03-20 17:12 - 2015-03-20 17:12 - 00085832 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll

2015-10-13 05:45 - 2015-10-13 05:45 - 01328912 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll

2011-06-07 07:08 - 2011-06-07 07:08 - 02535424 _____ () C:\Windows\SysWOW64\DM.exe

2015-07-27 20:28 - 2015-07-27 20:28 - 00032880 _____ () C:\Program Files (x86)\Real\UpdateService\RealPlayerUpdateSvc.exe

2010-09-01 07:18 - 2010-09-01 07:18 - 00033792 _____ () C:\Windows\SysWOW64\clunet.dll

2010-06-28 22:20 - 2010-06-28 22:20 - 00465576 _____ () C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\sqlite3.dll

2010-06-28 22:12 - 2010-06-28 22:12 - 01081600 _____ () C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\ACE.dll

2015-07-27 20:28 - 2015-07-27 20:28 - 00037512 _____ () C:\Program Files (x86)\Real\UpdateService\DL2UpdatePlugin.dll

2015-07-27 20:28 - 2015-07-27 20:28 - 00039560 _____ () C:\Program Files (x86)\Real\UpdateService\RealDownloaderUpdatePlugin.dll

2015-07-27 20:28 - 2015-07-27 20:28 - 00037528 _____ () C:\Program Files (x86)\Real\UpdateService\VideoDLUpdatePlugin.dll

2015-09-04 10:13 - 2015-09-04 10:13 - 00089152 _____ () c:\program files (x86)\real\realplayer\CrashRpt\CrashRpt1402.dll

2009-08-04 16:23 - 2009-08-04 16:23 - 00063032 _____ () C:\Program Files (x86)\HP\HP UT LEDM\bin\HPTools.dll

2009-08-04 16:23 - 2009-08-04 16:23 - 00075320 _____ () C:\Program Files (x86)\HP\HP UT LEDM\bin\HPToolkit.dll

2010-08-30 09:45 - 2009-05-20 06:02 - 00072200 _____ () C:\Program Files (x86)\Launch Manager\CdDirIo.dll

2014-10-23 20:43 - 2014-10-23 20:43 - 00170496 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\89753abff3827095ec7f3d3fb79f744a\IsdiInterop.ni.dll

2010-08-30 09:03 - 2010-04-13 16:52 - 00058880 _____ () C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IsdiInterop.dll

2015-10-28 05:07 - 2015-10-20 14:08 - 01532744 _____ () C:\Program Files (x86)\Google\Chrome\Application\46.0.2490.80\libglesv2.dll

2015-10-28 05:07 - 2015-10-20 14:08 - 00081224 _____ () C:\Program Files (x86)\Google\Chrome\Application\46.0.2490.80\libegl.dll

2015-02-15 00:40 - 2015-02-15 00:40 - 00381440 _____ () C:\Windows\mod_frst.exe

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

AlternateDataStreams: C:\ProgramData\Temp:373E1720

AlternateDataStreams: C:\ProgramData\Temp:4D066AD2

AlternateDataStreams: C:\ProgramData\Temp:DFC5A2B2

AlternateDataStreams: C:\ProgramData\Temp:E1F04E8D

AlternateDataStreams: C:\ProgramData\Temp:E36F5B57

==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart => ""="Service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys => ""="Driver"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mintcastnetworks => ""="service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\PEVSystemStart => ""="Service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\procexp90.Sys => ""="Driver"

==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)

==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-2562538608-3379174730-3565747309-1005\Control Panel\Desktop\\Wallpaper ->

DNS Servers: 8.8.8.8 - 8.8.4.4

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 0)

Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\Services: Bonjour Service => 2

MSCONFIG\Services: DaumCleanerService => 3

MSCONFIG\Services: EFS => 3

MSCONFIG\Services: eventlog => 2

MSCONFIG\Services: Fax => 3

MSCONFIG\Services: gupdate => 2

MSCONFIG\Services: gupdatem => 3

MSCONFIG\Services: gusvc => 3

MSCONFIG\Services: PCSUService => 2

MSCONFIG\Services: Razer Game Scanner Service => 2

MSCONFIG\Services: RealNetworks Downloader Resolver Service => 2

MSCONFIG\Services: RealPlayer Cloud Service => 2

MSCONFIG\Services: RzMaelstromVADStreamingService => 2

MSCONFIG\Services: RzOvlMon => 2

MSCONFIG\Services: SCPolicySvc => 3

MSCONFIG\Services: SDRSVC => 3

MSCONFIG\Services: SeaPort => 2

MSCONFIG\Services: SkypeUpdate => 2

MSCONFIG\Services: Steam Client Service => 3

MSCONFIG\Services: SysMain => 2

MSCONFIG\Services: Updater Service => 2

MSCONFIG\Services: Wecsvc => 3

MSCONFIG\Services: wlidsvc => 2

MSCONFIG\Services: WMPNetworkSvc => 2

MSCONFIG\Services: WPCSvc => 3

MSCONFIG\Services: wuauserv => 2

MSCONFIG\Services: YahooAUService => 2

MSCONFIG\startupreg: AppleSyncNotifier => C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe

MSCONFIG\startupreg: APSDaemon => "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"

MSCONFIG\startupreg: BackupManagerTray => "C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe" -h -k

MSCONFIG\startupreg: DivXUpdate => "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW

MSCONFIG\startupreg: iCloudServices => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe

MSCONFIG\startupreg: iTunesHelper => "C:\Program Files (x86)\iTunes\iTunesHelper.exe"

MSCONFIG\startupreg: Korean IME Migration => C:\PROGRA~1\COMMON~1\MICROS~1\IME12\IMEKR\IMKRMIG.EXE

MSCONFIG\startupreg: Norton Online Backup => C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe

MSCONFIG\startupreg: QuickTime Task => "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime

MSCONFIG\startupreg: Razer Synapse => "C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe"

MSCONFIG\startupreg: Spotify Web Helper => "C:\Users\Master\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe"

MSCONFIG\startupreg: swg => "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

MSCONFIG\startupreg: TkBellExe => "C:\Program Files (x86)\Real\RealPlayer\update\realsched.exe" -osboot

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [{6CDDC26C-3BD0-4BC3-967C-1438DD8B77B7}] => (Allow) C:\Users\Master\AppData\Roaming\Spotify\spotify.exe

FirewallRules: [{6DF5C7AC-1BFB-4CDB-960C-5106C8B4FDB4}] => (Allow) C:\Users\Master\AppData\Roaming\Spotify\spotify.exe

FirewallRules: [TCP Query User{185A6A5E-38FC-4AD5-95C7-6A8B5E3E5FFA}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe

FirewallRules: [uDP Query User{36D473F5-5B43-4922-8651-559D5A0C1FDE}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe

FirewallRules: [{FE5E4F67-745F-4536-BCA9-E142F4436D8F}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe

FirewallRules: [{6DFAB8CA-6A61-4428-A283-A151756F7D29}] => (Allow) C:\Users\Master\AppData\Roaming\uTorrent\uTorrent.exe

FirewallRules: [{53E0B21D-CEC5-4064-80AB-9D36E57868AA}] => (Allow) C:\Users\Master\AppData\Roaming\uTorrent\uTorrent.exe

FirewallRules: [{14108F18-1108-4814-AB3C-6439FD3E8753}] => (Allow) C:\LJP1100_P1560_P1600_Full_Solution\ProductInst64.exe

FirewallRules: [{E4A53963-EA44-42D4-95B7-2E7FD14C45B9}] => (Allow) C:\LJP1100_P1560_P1600_Full_Solution\ProductInst64.exe

FirewallRules: [{588C52AA-34EA-4DA2-A3D9-A7BC0BA3D950}] => (Allow) LPort=9100

FirewallRules: [{C51128F3-23C1-455C-B134-5B3640B38E94}] => (Allow) LPort=427

FirewallRules: [{496815FA-1809-4B4E-BD22-E232CA9340C5}] => (Allow) LPort=161

FirewallRules: [{19D58FB3-99CF-4C24-A4E9-99311B4DFA07}] => (Allow) c:\program files (x86)\real\realplayer\RPDS\Bin\rpdsvc.exe

FirewallRules: [TCP Query User{1126BF81-3B4F-4A67-9DF4-7E178378BBC0}C:\users\master\desktop\0\league of legends\rads\projects\lol_patcher\releases\0.0.0.14\deploy\lolpatcher.exe] => (Allow) C:\users\master\desktop\0\league of legends\rads\projects\lol_patcher\releases\0.0.0.14\deploy\lolpatcher.exe

FirewallRules: [uDP Query User{CE5BCA81-96DC-458D-B4C2-13BCAA979042}C:\users\master\desktop\0\league of legends\rads\projects\lol_patcher\releases\0.0.0.14\deploy\lolpatcher.exe] => (Allow) C:\users\master\desktop\0\league of legends\rads\projects\lol_patcher\releases\0.0.0.14\deploy\lolpatcher.exe

FirewallRules: [TCP Query User{8B27FB08-C4B2-4E03-9564-B9989E7B95E7}C:\users\master\desktop\0\league of legends\rads\projects\lol_patcher\releases\0.0.0.14\deploy\lolpatcherux.exe] => (Allow) C:\users\master\desktop\0\league of legends\rads\projects\lol_patcher\releases\0.0.0.14\deploy\lolpatcherux.exe

FirewallRules: [uDP Query User{61BC8FF8-D3D8-4AB1-9C61-7AC4B5F1504D}C:\users\master\desktop\0\league of legends\rads\projects\lol_patcher\releases\0.0.0.14\deploy\lolpatcherux.exe] => (Allow) C:\users\master\desktop\0\league of legends\rads\projects\lol_patcher\releases\0.0.0.14\deploy\lolpatcherux.exe

FirewallRules: [{5C66CE2D-CE06-4601-913B-9B61C0A4984E}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

FirewallRules: [{3A0E4610-C87D-43A6-AA7E-07666FC665B6}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

FirewallRules: [TCP Query User{B8446F95-6B62-4440-9BA5-B7B03CC4C5ED}C:\program files (x86)\java\jre1.8.0_40\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_40\bin\javaw.exe

FirewallRules: [uDP Query User{F17F00C0-7D8D-4250-B1BE-CCD4B6F52F03}C:\program files (x86)\java\jre1.8.0_40\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_40\bin\javaw.exe

FirewallRules: [{053168E4-AAD5-4387-9BE2-FFA8574066C4}] => (Allow) c:\program files (x86)\real\realplayer\RPDS\Bin\rpdsvc.exe

FirewallRules: [{8C0A2E64-DA6C-4A3F-A4A8-10D58D036AC0}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

FirewallRules: [{38F89912-3940-4291-9ECF-BEA0D6F1CA72}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe

FirewallRules: [{AC2AAB7C-5BF6-405D-8EC2-432DE0F36ADC}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe

FirewallRules: [{E8D0901A-F879-4CA4-A951-80A807382B90}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe

FirewallRules: [{CA83269A-0098-4451-86C4-A293834B1731}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe

FirewallRules: [{240EB17C-6EA4-476F-9806-F241EE40314E}] => (Allow) C:\Program Files\iTunes\iTunes.exe

==================== Faulty Device Manager Devices =============

Name: BlueStacks Hypervisor

Description: BlueStacks Hypervisor

Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}

Manufacturer:

Service: BstHdDrv

Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)

Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.

Devices stay in this state if they have been prepared for removal.

After you remove the device, this error disappears.Remove the device, and this error should be resolved.

==================== Event log errors: =========================

Application errors:

==================

Error: (11/05/2015 01:33:43 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3006) (User: NT AUTHORITY)

Description: Unable to read the performance counter strings defined for the 009 language ID. The first DWORD in the Data section contains the Win32 error code.

Error: (11/05/2015 01:33:43 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3006) (User: NT AUTHORITY)

Description: Unable to read the performance counter strings defined for the 009 language ID. The first DWORD in the Data section contains the Win32 error code.

Error: (11/05/2015 12:10:36 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3006) (User: NT AUTHORITY)

Description: Unable to read the performance counter strings defined for the 009 language ID. The first DWORD in the Data section contains the Win32 error code.

Error: (11/05/2015 12:10:36 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3006) (User: NT AUTHORITY)

Description: Unable to read the performance counter strings defined for the 009 language ID. The first DWORD in the Data section contains the Win32 error code.

Error: (02/07/2015 07:41:46 AM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application name: rads_user_kernel.exe, version: 0.0.0.0, time stamp: 0x4e65c1ac

Faulting module name: rads_user_kernel.exe, version: 0.0.0.0, time stamp: 0x4e65c1ac

Exception code: 0xc0000005

Fault offset: 0x000b8554

Faulting process id: 0x2a70

Faulting application start time: 0xrads_user_kernel.exe0

Faulting application path: rads_user_kernel.exe1

Faulting module path: rads_user_kernel.exe2

Report Id: rads_user_kernel.exe3

Error: (02/06/2015 06:53:24 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application name: rads_user_kernel.exe, version: 0.0.0.0, time stamp: 0x4e65c1ac

Faulting module name: rads_user_kernel.exe, version: 0.0.0.0, time stamp: 0x4e65c1ac

Exception code: 0xc0000005

Fault offset: 0x000b8554

Faulting process id: 0x2c10

Faulting application start time: 0xrads_user_kernel.exe0

Faulting application path: rads_user_kernel.exe1

Faulting module path: rads_user_kernel.exe2

Report Id: rads_user_kernel.exe3

Error: (02/05/2015 09:54:51 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application name: rads_user_kernel.exe, version: 0.0.0.0, time stamp: 0x4e65c1ac

Faulting module name: rads_user_kernel.exe, version: 0.0.0.0, time stamp: 0x4e65c1ac

Exception code: 0xc0000005

Fault offset: 0x000b8554

Faulting process id: 0x105c

Faulting application start time: 0xrads_user_kernel.exe0

Faulting application path: rads_user_kernel.exe1

Faulting module path: rads_user_kernel.exe2

Report Id: rads_user_kernel.exe3

Error: (01/31/2015 10:58:49 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application name: rads_user_kernel.exe, version: 0.0.0.0, time stamp: 0x4e65c1ac

Faulting module name: rads_user_kernel.exe, version: 0.0.0.0, time stamp: 0x4e65c1ac

Exception code: 0xc0000005

Fault offset: 0x000b8554

Faulting process id: 0x1f74

Faulting application start time: 0xrads_user_kernel.exe0

Faulting application path: rads_user_kernel.exe1

Faulting module path: rads_user_kernel.exe2

Report Id: rads_user_kernel.exe3

Error: (01/23/2015 12:52:40 AM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application name: rads_user_kernel.exe, version: 0.0.0.0, time stamp: 0x4e65c1ac

Faulting module name: rads_user_kernel.exe, version: 0.0.0.0, time stamp: 0x4e65c1ac

Exception code: 0xc0000005

Fault offset: 0x000b8554

Faulting process id: 0x18e4

Faulting application start time: 0xrads_user_kernel.exe0

Faulting application path: rads_user_kernel.exe1

Faulting module path: rads_user_kernel.exe2

Report Id: rads_user_kernel.exe3

Error: (01/21/2015 06:03:28 PM) (Source: Application Error) (EventID: 1005) (User: )

Description: Windows cannot access the file for one of the following reasons:

there is a problem with the network connection, the disk that the file is stored on, or the storage

drivers installed on this computer; or the disk is missing.

Windows closed the program PMM Update Application because of this error.

Program: PMM Update Application

File:

The error value is listed in the Additional Data section.

User Action

1. Open the file again.

This situation might be a temporary problem that corrects itself when the program runs again.

2.

If the file still cannot be accessed and

- It is on the network,

your network administrator should verify that there is not a problem with the network and that the server can be contacted.

- It is on a removable disk, for example, a floppy disk or CD-ROM, verify that the disk is fully inserted into the computer.

3. Check and repair the file system by running CHKDSK. To run CHKDSK, click Start, click Run, type CMD, and then click OK. At the command prompt, type CHKDSK /F, and then press ENTER.

4. If the problem persists, restore the file from a backup copy.

5. Determine whether other files on the same disk can be opened. If not, the disk might be damaged. If it is a hard disk, contact your administrator or computer hardware vendor for

further assistance.

Additional Data

Error value: 00000000

Disk type: 0

System errors:

=============

Error: (10/30/2015 01:25:12 AM) (Source: Service Control Manager) (EventID: 7001) (User: )

Description: The Computer Browser service depends on the Server service which failed to start because of the following error:

%%1068

Error: (10/30/2015 01:25:12 AM) (Source: Service Control Manager) (EventID: 7001) (User: )

Description: The Computer Browser service depends on the Server service which failed to start because of the following error:

%%1068

Error: (10/30/2015 01:25:12 AM) (Source: Service Control Manager) (EventID: 7001) (User: )

Description: The Computer Browser service depends on the Server service which failed to start because of the following error:

%%1068

Error: (10/30/2015 01:23:22 AM) (Source: Service Control Manager) (EventID: 7001) (User: )

Description: The Computer Browser service depends on the Server service which failed to start because of the following error:

%%1068

Error: (10/30/2015 01:23:22 AM) (Source: Service Control Manager) (EventID: 7001) (User: )

Description: The Computer Browser service depends on the Server service which failed to start because of the following error:

%%1068

Error: (10/30/2015 01:23:22 AM) (Source: Service Control Manager) (EventID: 7001) (User: )

Description: The Computer Browser service depends on the Server service which failed to start because of the following error:

%%1068

Error: (10/30/2015 01:20:12 AM) (Source: Service Control Manager) (EventID: 7001) (User: )

Description: The Computer Browser service depends on the Server service which failed to start because of the following error:

%%1068

Error: (10/30/2015 01:20:12 AM) (Source: Service Control Manager) (EventID: 7001) (User: )

Description: The Computer Browser service depends on the Server service which failed to start because of the following error:

%%1068

Error: (10/30/2015 01:20:12 AM) (Source: Service Control Manager) (EventID: 7001) (User: )

Description: The Computer Browser service depends on the Server service which failed to start because of the following error:

%%1068

Error: (10/30/2015 01:18:14 AM) (Source: Service Control Manager) (EventID: 7001) (User: )

Description: The Computer Browser service depends on the Server service which failed to start because of the following error:

%%1068

CodeIntegrity:

===================================

Date: 2013-03-22 17:19:39.463

Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\usbaapl64.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2013-03-22 17:19:38.963

Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\usbaapl64.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2013-01-31 18:44:53.793

Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2013-01-31 18:44:53.606

Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2013-01-30 19:22:56.105

Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Users\Master\AppData\Local\Temp\ugabgegf.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2013-01-30 19:22:55.949

Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Users\Master\AppData\Local\Temp\ugabgegf.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2013-01-29 21:45:18.679

Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Users\Master\AppData\Local\Temp\ugabgegf.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2013-01-29 21:45:18.492

Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Users\Master\AppData\Local\Temp\ugabgegf.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2013-01-28 19:53:18.465

Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Users\Master\AppData\Local\Temp\ugabgegf.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2013-01-28 19:53:18.278

Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Users\Master\AppData\Local\Temp\ugabgegf.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

==================== Memory info ===========================

Processor: Intel® Core i3 CPU M 380 @ 2.53GHz

Percentage of memory in use: 61%

Total physical RAM: 2806.71 MB

Available physical RAM: 1074 MB

Total Virtual: 7412.9 MB

Available Virtual: 5266.92 MB

==================== Drives ================================

Drive c: (Acer) (Fixed) (Total:284.99 GB) (Free:165.41 GB) NTFS

==================== MBR & Partition Table ==================

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298.1 GB) (Disk ID: A022D740)

Partition 1: (Not Active) - (Size=13 GB) - (Type=27)

Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=285 GB) - (Type=07 NTFS)

==================== End of Addition.txt ============================

kevinf80 · November 5, 2015

Thanks for those logs, unfortunately there is evidence of installed and active illegal software. That is a direct breach of forum protocol, I cannot offer any further help, if you do not agree with that action you willhave to contact a forum moderator..

Thank you,

Kevin.

kgh5219 · November 5, 2015

Um, I'm not actually sure what illegal software I have... could you please tell me?

AdvancedSetup · November 5, 2015

Task: {C7D21CA1-A678-4A5C-96C3-1E0E7A07061E} - System32\Tasks\AutoKMSCustom => C:\Windows\AutoKMS\AutoKMS.exe

Task: C:\Windows\Tasks\AutoKMSCustom.job => C:\Windows\AutoKMS\AutoKMS.exe

AdvancedSetup · November 5, 2015

This topic will now be closed due to evidence of cracked or pirated software on this system.

Piracy Policy

kgh5219 · November 5, 2015

Caught a virus that downloaded a bunch of other nasty stuff. Also changed my windows key or something so my computer tells me that I dont have genuine windows

the virus hides as other processes, eg. chrome.exe. i know this because there are like 10 chrome processes when i just open it.

AdvancedSetup · November 6, 2015

I'm sorry but AutoKMS is not due to an infection. One has to read where and how to download and then how to install it. It's done on purpose.

The best thing to do is backup your data and format the drive and install Windows 10 or contact Microsoft who can work with you to change your Windows to a legitimate licensed version.

https://forums.malwarebytes.org/index.php?/topic/174566-new-virus-that-wont-go-away/

AdvancedSetup · November 12, 2015

Topic reopened per request

kgh5219 · November 12, 2015

So, should I redo all the steps again? The adware is still coming up on scans

kevinf80 · November 12, 2015

Which scans show the adware? can you post logs?

kgh5219 · November 13, 2015

Malwarebytes Anti-Malware

www.malwarebytes.org

Scan Date: 13/11/2015

Scan Time: 13:22

Logfile:

Administrator: Yes

Version: 2.2.0.1024

Malware Database: v2015.11.13.04

Rootkit Database: v2015.11.13.01

License: Free

Malware Protection: Disabled

Malicious Website Protection: Disabled

Self-protection: Disabled

OS: Windows 7 Service Pack 1

CPU: x64

File System: NTFS

User: Master

Scan Type: Threat Scan

Result: Completed

Objects Scanned: 433489

Time Elapsed: 48 min, 0 sec

Memory: Enabled

Startup: Enabled

Filesystem: Enabled

Archives: Enabled

Rootkits: Enabled

Heuristics: Enabled

PUP: Enabled

PUM: Enabled

Processes: 0

(No malicious items detected)

Modules: 0

(No malicious items detected)

Registry Keys: 0

(No malicious items detected)

Registry Values: 4

Adware.ChinAd, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SHELL EXTENSIONS\APPROVED\{646BAAE7-7538-4866-8EEE-974C0AA910AB}, Quarantined, [682038453358cb6b08e896a248babb45],

Adware.ChinAd, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\SHELL EXTENSIONS\APPROVED\{646BAAE7-7538-4866-8EEE-974C0AA910AB}, Quarantined, [91f7e39aabe07eb8ba36b0886b97ca36],

PUP.Optional.ChinAd, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_BROWSER_EMULATION|QyClient.exe, 9000, Quarantined, [7f09a1dcd2b9270fb611f9de28db43bd]

PUP.Optional.ChinAd, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_BROWSER_EMULATION|QyBrowser.exe, 9000, Quarantined, [c4c4443905868aac2b9b667140c30cf4]

Registry Data: 0

(No malicious items detected)

Folders: 0

(No malicious items detected)

Files: 0

(No malicious items detected)

Physical Sectors: 0

(No malicious items detected)

(end)

kevinf80 · November 13, 2015

Run FRST one more time, ensure all boxes are checkmarked under "Whitelist" but only Addition.txt and Shortcut.txt under "Optional scan" Select scan, when done post the new logs....

Next,

Please download RogueKiller and save it to your desktop from the following link: http://www.bleepingcomputer.com/download/roguekiller/

Quit all running programs.
For Windows XP, double-click to start.
For Vista,Windows 7/8/8.1/10, Right-click on the program and select Run as Administrator to start and when prompted allow it to run.
Read and accept the EULA (End User Licene Agreement)
Click Scan to scan the system.
When the scan completes select "Report",in the next window select "Export txt" the log will open as a text file post that log... Also save to your Desktop for reference. log will open.
Close the program > Don't Fix anything!

Thank you,

Kevin...

kgh5219 · November 14, 2015

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:07-11-2015

Ran by Master (administrator) on LUKE (14-11-2015 20:02:16)

Running from C:\Users\Master\Desktop

Loaded Profiles: Master (Available Profiles: Master)