Jump to content

Build Theme!
  •  
  • Unreplied Topics
  • Downloads
  • Infected?

WE'RE SURE THAT YOU'LL LOVE US!

Hey there! :wub: Looks like you're enjoying the discussion, but you're not signed up for an account. When you create an account, we remember exactly what you've read, so you always come right back where you left off. You also get notifications, here and via email, whenever new posts are made. You can like posts to share the love. :D Join 93084 other members! Anybody can ask, anybody can answer. Consistently helpful members may be invited to become staff. Here's how it works. Virus cleanup? Start here -> Malware Removal Forum.

Try What the Tech -- It's free!


Photo

Badly infected with b1 virus [Solved]

Started by tonilo , Nov 14 2014 09:12 PM
redirected when going to inte

  • This topic is locked This topic is locked
33 replies to this topic

#1 tonilo

tonilo

    Authentic Member

  • Authentic Member
  • PipPip
  • 53 posts

Posted 14 November 2014 - 09:12 PM

Hey guys.  It's now been 4 years since I needed your help and this is only the 3rd time since I started with Tom Coyote in 2005!  My son kept telling me I had a virus as I was continuously getting popups to clean a virus when I went online.  Finally, when I went to my Yahoo home page it was blank.  I was able to get to the Yahoo home page from Google but it also went blank as soon as I clicked on anything.  I downloaded the free Malwarebytes and it detected a few and quarantined them.  Still problems on the internet so I downloaded the free AVG 2015.  It found 4 problems and quarantined them.  Turned off computer for a few days and tonight ran AVG which found none  and Malwarebytes which only found 2 potential savr threats and tried to go to Yahoo and all sorts of popups about having a virus and reinstalling or updating Java were coming up.  I've noticed b1.zbcsrs and b1.zetruv which is the one telling me to update Java.  It's almost impossible to x out of them.  In going to your site I tried to download Spybot but couldn't even do it after 3 attempts.  Here are the logs I was able to get.

 

aswMBR version 1.0.1.2252 Copyright© 2014 AVAST Software
Run date: 2014-11-14 20:20:39
-----------------------------
20:20:39.625    OS Version: Windows 6.1.7601 Service Pack 1
20:20:39.625    Number of processors: 2 586 0x170A
20:20:39.625    ComputerName: TONY-PC  UserName: Toni
20:20:42.574    Initialize success
20:20:42.730    VM: initialized successfully
20:20:42.730    VM: Intel CPU BiosDisabled
20:23:45.842    AVAST engine defs: 14111400
20:24:31.597    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-4
20:24:31.597    Disk 0 Vendor: ST3320418AS HP35 Size: 305245MB BusType: 11
20:24:31.706    Disk 0 MBR read successfully
20:24:31.706    Disk 0 MBR scan
20:24:31.753    Disk 0 Windows 7 default MBR code
20:24:31.769    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS          100 MB offset 2048
20:24:31.800    Disk 0 default boot code
20:24:31.847    Disk 0 Partition 2 00     07    HPFS/NTFS NTFS       305143 MB offset 206848
20:24:31.893    Disk 0 scanning sectors +625139712
20:24:31.987    Disk 0 scanning C:\Windows\system32\drivers
20:24:51.144    Service scanning
20:25:09.911    Service MpKsl54c774ab c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{05C05934-1366-4738-87CA-230F306DB7FE}\MpKsl54c774ab.sys **LOCKED** 32
20:25:30.237    Modules scanning
20:25:30.237    Disk 0 trace - called modules:
20:25:30.269    ntkrnlpa.exe CLASSPNP.SYS disk.sys ataport.SYS halmacpi.dll PCIIDEX.SYS msahci.sys
20:25:30.269    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x86b17ac8]
20:25:30.269    3 CLASSPNP.SYS[8ca0459e] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP2T0L0-4[0x8666b030]
20:25:37.569    AVAST engine scan C:\Windows
20:25:40.393    AVAST engine scan C:\Windows\system32
20:30:43.239    AVAST engine scan C:\Windows\system32\drivers
20:31:07.185    AVAST engine scan C:\Users\Toni.Ron-PC
20:41:45.480    Disk 0 MBR has been saved successfully to "C:\Users\Toni.Ron-PC\Desktop\MBR.dat"
20:41:45.496    The log file has been saved successfully to "C:\Users\Toni.Ron-PC\Desktop\aswMBR.txt"

 

 

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 13-11-2014 01
Ran by Toni (administrator) on TONY-PC on 14-11-2014 20:48:20
Running from C:\Users\Toni.Ron-PC\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6PI3CJKG
Loaded Profiles: Toni & UpdatusUser (Available profiles: Toni & UpdatusUser)
Platform: Microsoft Windows 7 Professional  Service Pack 1 (X86) OS Language: English (United States)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgrsx.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgcsrvx.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Adobe Systems Incorporated) C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
() C:\Program Files\DivX\DivX Update\DivXUpdate.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgui.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Google Inc.) C:\Users\Toni.Ron-PC\AppData\Local\Google\Update\GoogleUpdate.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Internet Services\iCloudServices.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgidsagent.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgwdsvc.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Yahoo! Inc.) C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgnsx.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgemcx.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
(Microsoft Corporation) C:\Windows\System32\wuauclt.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgcfgex.exe

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [974432 2014-08-22] (Microsoft Corporation)
HKLM\...\Run: [APSDaemon] => C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [43816 2014-07-31] (Apple Inc.)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKLM\...\Run: [BCSSync] => C:\Program Files\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM\...\Run: [DivXMediaServer] => C:\Program Files\DivX\DivX Media Server\DivXMediaServer.exe [455512 2014-05-27] (DivX, LLC)
HKLM\...\Run: [DivXUpdate] => C:\Program Files\DivX\DivX Update\DivXUpdate.exe [1861968 2014-01-09] ()
HKLM\...\Run: [QuickTime Task] => C:\Program Files\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [152392 2014-09-01] (Apple Inc.)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [507776 2014-10-07] (Oracle Corporation)
HKLM\...\Run: [AVG_UI] => C:\Program Files\AVG\AVG2015\avgui.exe [3653136 2014-11-09] (AVG Technologies CZ, s.r.o.)
HKU\S-1-5-21-4106215785-1409883783-339786315-1001\...\Run: [Google Update] => C:\Users\Toni.Ron-PC\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2012-04-06] (Google Inc.)
HKU\S-1-5-21-4106215785-1409883783-339786315-1001\...\Run: [iCloudServices] => C:\Program Files\Common Files\Apple\Internet Services\iCloudServices.exe [43816 2014-08-07] (Apple Inc.)
HKU\S-1-5-21-4106215785-1409883783-339786315-1001\...\Run: [ApplePhotoStreams] => C:\Program Files\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [43816 2014-08-14] (Apple Inc.)
HKU\S-1-5-21-4106215785-1409883783-339786315-1001\...\MountPoints2: E - E:\LaunchU3.exe -a
HKU\S-1-5-21-4106215785-1409883783-339786315-1001\...\MountPoints2: {834e473f-0175-11e4-88e1-d48564132670} - E:\LaunchU3.exe -a
HKU\S-1-5-21-4106215785-1409883783-339786315-1001\...\MountPoints2: {c07cff79-55d7-11e4-8930-d48564132670} - E:\windows\AutoRun.exe {430A8AE3-8898-4DAB-8C5B-5E8ADA7D571E} 3.0.0.02 VID_19D2&PID_0358 {9B00E99F-83A4-40d4-B987-7EB04F722BB7}
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xFA0613278D03CD01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.msn.com/?ocid=OIE9HP
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
SearchScopes: HKLM - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = http://dts.search-re...&q={searchTerms}
SearchScopes: HKCU - {77D1CA7D-336C-437E-8F96-680E2428975F} URL = https://search.yahoo...&p={searchTerms}
SearchScopes: HKCU - {92B5EDEB-7FCF-47D9-A390-71E96B84E724} URL = http://search.yahoo....rms}&fr=chr-att
SearchScopes: HKCU - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = http://dts.search-re...&q={searchTerms}
BHO: No Name -> {02478D38-C3F9-4efb-9B51-7695ECA05670} ->  No File
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_25\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Windows Live Messenger Companion Helper -> {9FDDE16B-836F-4806-AB1F-1455CBEFF289} -> C:\Program Files\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: No Name -> {D40C654D-7C51-4EB3-95B2-1E23905C2A2D} ->  No File
BHO: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_25\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} https://fpdownload.m...ash/swflash.cab
Winsock: Catalog5 09 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.254

FireFox:
========
FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @canon.com/MycameraPlugin -> C:\Program Files\Canon\ZoomBrowser EX\Program\NPCIG.dll (CANON INC.)
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files\Java\jre1.8.0_25\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3555.0308 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

Chrome:
=======
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\Toni.Ron-PC\AppData\Local\Google\Chrome\Application\36.0.1985.125\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Users\Toni.Ron-PC\AppData\Local\Google\Chrome\Application\36.0.1985.125\pdf.dll ()
CHR Plugin: (Shockwave Flash) - C:\Users\Toni.Ron-PC\AppData\Local\Google\Chrome\Application\36.0.1985.125\gcswf32.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (NPCIG.dll) - C:\Program Files\Canon\ZoomBrowser EX\Program\NPCIG.dll (CANON INC.)
CHR Plugin: (Picasa) - C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
CHR Plugin: (Java™ Platform SE 7 U4) - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll No File
CHR Plugin: (Java Deployment Toolkit 7.0.40.255) - C:\Windows\system32\npDeployJava1.dll No File
CHR Plugin: (Windows Live™ Photo Gallery) - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (Google Update) - C:\Users\Toni.Ron-PC\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files\Microsoft Silverlight\4.0.50401.0\npctrl.dll No File
CHR Profile: C:\Users\Toni.Ron-PC\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Toni.Ron-PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-05-25]
CHR Extension: (YouTube) - C:\Users\Toni.Ron-PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-04-06]
CHR Extension: (Google Search) - C:\Users\Toni.Ron-PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-04-06]
CHR Extension: (Facebook Image Zoom and Downloader) - C:\Users\Toni.Ron-PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\edefbbbcggajdncnoingicdckbhngpcj [2014-09-21]
CHR Extension: (fbmemes) - C:\Users\Toni.Ron-PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\hmfcioabbebeebdcfkkbjaajjjffmngn [2014-10-17]
CHR Extension: (rikaikun) - C:\Users\Toni.Ron-PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\jipdnfibhldikgcjhfnomkfpcebammhp [2014-09-02]
CHR Extension: (Anydo Extension) - C:\Users\Toni.Ron-PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\kdadialhpiikehpdeejjeiikopddkjem [2014-10-07]
CHR Extension: (Google Wallet) - C:\Users\Toni.Ron-PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-02]
CHR Extension: (PotatoSmile) - C:\Users\Toni.Ron-PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\oalbpfagfhfkcmklpdanadjpbfdedndn [2014-08-07]
CHR Extension: (Gmail) - C:\Users\Toni.Ron-PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-04-06]

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AVGIDSAgent; C:\Program Files\AVG\AVG2015\avgidsagent.exe [3488784 2014-11-09] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files\AVG\AVG2015\avgwdsvc.exe [298080 2014-11-09] (AVG Technologies CZ, s.r.o.)
S3 FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [654848 2014-08-01] (Macrovision Europe Ltd.) [File not signed]
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [22192 2014-08-22] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [288120 2014-08-22] (Microsoft Corporation)
R2 nvUpdatusService; C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2214504 2011-05-21] (NVIDIA Corporation)
S2 671c50b0; "C:\Windows\system32\rundll32.exe" "c:\progra~2\browse~1\BrowserSystemEnahncerSvc.dll",service

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R1 Avgdiskx; C:\Windows\System32\DRIVERS\avgdiskx.sys [121624 2014-06-18] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdriverx.sys [213784 2014-10-29] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHX; C:\Windows\System32\DRIVERS\avgidshx.sys [147736 2014-06-18] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSShim; C:\Windows\System32\DRIVERS\avgidsshimx.sys [21272 2014-06-18] (AVG Technologies CZ, s.r.o.)
R1 Avgldx86; C:\Windows\System32\DRIVERS\avgldx86.sys [192792 2014-08-28] (AVG Technologies CZ, s.r.o.)
R0 Avglogx; C:\Windows\System32\DRIVERS\avglogx.sys [230680 2014-07-18] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx86; C:\Windows\System32\DRIVERS\avgmfx86.sys [98584 2014-10-05] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx86; C:\Windows\System32\DRIVERS\avgrkx86.sys [27416 2014-06-18] (AVG Technologies CZ, s.r.o.)
R1 Avgtdix; C:\Windows\System32\DRIVERS\avgtdix.sys [200984 2014-10-10] (AVG Technologies CZ, s.r.o.)
R3 e1kexpress; C:\Windows\System32\DRIVERS\e1k6032.sys [164864 2009-07-13] (Intel Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [231800 2014-07-17] (Microsoft Corporation)
R1 MpKsl54c774ab; c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{05C05934-1366-4738-87CA-230F306DB7FE}\MpKsl54c774ab.sys [39464 2014-11-14] (Microsoft Corporation)
R3 netr28u; C:\Windows\System32\DRIVERS\netr28u.sys [657408 2009-07-13] (Ralink Technology Corp.)
U3 aswMBR; \??\C:\Users\TONI~1.RON\AppData\Local\Temp\aswMBR.sys [X]
U3 aswVmm; \??\C:\Users\TONI~1.RON\AppData\Local\Temp\aswVmm.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)

==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-11-14 20:47 - 2014-11-14 20:48 - 00000000 ____D () C:\FRST
2014-11-14 20:41 - 2014-11-14 20:41 - 00002092 _____ () C:\Users\Toni.Ron-PC\Desktop\aswMBR.txt
2014-11-14 20:41 - 2014-11-14 20:41 - 00000512 _____ () C:\Users\Toni.Ron-PC\Desktop\MBR.dat
2014-11-14 20:18 - 2014-11-14 20:20 - 05198336 _____ (AVAST Software) C:\Users\Toni.Ron-PC\Downloads\aswMBR.exe
2014-11-14 19:42 - 2014-11-14 19:42 - 00399224 _____ (Premium Installer ) C:\Users\Toni.Ron-PC\Downloads\setup (1).exe
2014-11-14 19:36 - 2014-11-14 19:36 - 00399224 _____ (Premium Installer ) C:\Users\Toni.Ron-PC\Downloads\setup.exe
2014-11-14 17:25 - 2014-11-14 17:25 - 00000000 ____D () C:\Users\Default\AppData\Roaming\TuneUp Software
2014-11-14 17:25 - 2014-11-14 17:25 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\TuneUp Software
2014-11-09 21:08 - 2014-11-09 21:08 - 00000000 ____D () C:\Users\Toni.Ron-PC\AppData\Roaming\AVG2015
2014-11-09 21:07 - 2014-11-14 17:25 - 00000935 _____ () C:\Users\Public\Desktop\AVG 2015.lnk
2014-11-09 21:07 - 2014-11-14 17:25 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG
2014-11-09 21:06 - 2014-11-09 21:07 - 00000000 ____D () C:\ProgramData\AVG2015
2014-11-09 21:00 - 2014-11-09 21:19 - 00000000 ____D () C:\Users\Toni.Ron-PC\AppData\Local\Avg2015
2014-11-06 19:49 - 2014-11-14 18:18 - 00114904 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-11-06 19:48 - 2014-11-06 19:48 - 00001060 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-11-06 19:48 - 2014-11-06 19:48 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-11-06 19:48 - 2014-11-06 19:48 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware
2014-11-06 19:48 - 2014-10-01 11:11 - 00075480 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-11-06 19:48 - 2014-10-01 11:11 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-11-06 19:48 - 2014-10-01 11:11 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-11-06 19:37 - 2014-11-06 19:41 - 19828376 _____ (Malwarebytes Corporation ) C:\Users\Toni.Ron-PC\Downloads\mbam-setup-2.0.3.1025 (1).exe
2014-11-06 19:34 - 2014-11-06 19:35 - 19828376 _____ (Malwarebytes Corporation ) C:\Users\Toni.Ron-PC\Downloads\mbam-setup-2.0.3.1025.exe
2014-10-29 21:34 - 2014-10-29 21:34 - 00213784 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgidsdriverx.sys
2014-10-27 20:08 - 2014-10-27 20:09 - 00000000 ____D () C:\Users\Toni.Ron-PC\AppData\Local\{52C980EF-72E7-485E-BDB5-2B4588EDE283}
2014-10-20 06:51 - 2014-10-20 06:51 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-10-20 06:36 - 2014-10-20 06:36 - 00000000 ____D () C:\Program Files\webSaver
2014-10-20 06:35 - 2014-10-20 06:35 - 00000000 ____D () C:\Program Files\sAVer box
2014-10-20 06:35 - 2014-10-20 06:35 - 00000000 ____D () C:\Program Files\saiviingetoyoU
2014-10-20 06:31 - 2014-10-20 06:31 - 00000000 ____D () C:\Program Files\Common Files\Java
2014-10-20 06:27 - 2014-10-20 06:31 - 00000000 ____D () C:\ProgramData\Oracle
2014-10-17 02:30 - 2014-11-14 17:30 - 00001176 _____ () C:\Windows\setupact.log
2014-10-17 02:30 - 2014-10-17 02:30 - 00000000 _____ () C:\Windows\setuperr.log
2014-10-17 01:58 - 2014-10-20 07:16 - 00000000 ____D () C:\ProgramData\saiviingetoyoU
2014-10-16 17:45 - 2014-10-09 19:44 - 00396288 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-10-16 17:45 - 2014-10-09 19:44 - 00230912 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2014-10-16 17:45 - 2014-10-09 19:39 - 00302592 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-10-16 17:44 - 2014-10-06 20:04 - 00331448 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-10-16 17:44 - 2014-09-28 18:41 - 02379264 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-10-16 17:44 - 2014-09-25 16:46 - 00365056 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-10-16 17:44 - 2014-09-25 16:46 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-10-16 17:44 - 2014-09-25 16:46 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-10-16 17:44 - 2014-09-25 16:43 - 11807232 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-10-16 17:44 - 2014-09-25 16:32 - 02017280 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-10-16 17:44 - 2014-09-18 19:44 - 17484800 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-10-16 17:44 - 2014-09-18 19:25 - 04201472 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-10-16 17:44 - 2014-09-18 19:14 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-10-16 17:44 - 2014-09-18 19:14 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-10-16 17:44 - 2014-09-18 19:02 - 00454656 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-10-16 17:44 - 2014-09-18 19:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-10-16 17:44 - 2014-09-18 19:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-10-16 17:44 - 2014-09-18 18:59 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-10-16 17:44 - 2014-09-18 18:55 - 02187264 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-10-16 17:44 - 2014-09-18 18:54 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-10-16 17:44 - 2014-09-18 18:53 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-10-16 17:44 - 2014-09-18 18:51 - 00440320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-10-16 17:44 - 2014-09-18 18:50 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-10-16 17:44 - 2014-09-18 18:50 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-10-16 17:44 - 2014-09-18 18:49 - 00597504 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-10-16 17:44 - 2014-09-18 18:44 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-10-16 17:44 - 2014-09-18 18:36 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-10-16 17:44 - 2014-09-18 18:32 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-10-16 17:44 - 2014-09-18 18:20 - 00677888 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-10-16 17:44 - 2014-09-18 18:20 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-10-16 17:44 - 2014-09-18 18:18 - 01068032 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-10-16 17:44 - 2014-09-18 17:59 - 01810944 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-10-16 17:44 - 2014-09-18 17:53 - 01190400 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-10-16 17:44 - 2014-09-18 17:52 - 00678400 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-10-16 17:44 - 2014-09-03 23:04 - 00372736 _____ (Microsoft Corporation) C:\Windows\system32\rastls.dll
2014-10-16 17:44 - 2014-07-16 19:40 - 00157696 _____ (Microsoft Corporation) C:\Windows\system32\winsta.dll
2014-10-16 17:44 - 2014-07-16 19:39 - 03221504 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2014-10-16 17:44 - 2014-07-16 19:39 - 01051136 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe
2014-10-16 17:44 - 2014-07-16 19:39 - 00523264 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll
2014-10-16 17:44 - 2014-07-16 19:39 - 00304128 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2014-10-16 17:44 - 2014-07-16 19:39 - 00131584 _____ (Microsoft Corporation) C:\Windows\system32\aaclient.dll
2014-10-16 17:44 - 2014-07-16 19:39 - 00130048 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorekmts.dll
2014-10-16 17:44 - 2014-07-16 19:39 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-10-16 17:44 - 2014-07-16 19:39 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-10-16 17:44 - 2014-07-16 19:03 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpwd.sys
2014-10-16 17:44 - 2014-07-16 19:02 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2014-10-16 17:44 - 2014-07-08 19:29 - 00006144 _____ (Microsoft Corporation) C:\Windows\system32\KBDYAK.DLL
2014-10-16 17:44 - 2014-07-08 19:29 - 00006144 _____ (Microsoft Corporation) C:\Windows\system32\KBDTAT.DLL
2014-10-16 17:44 - 2014-07-08 19:29 - 00006144 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU1.DLL
2014-10-16 17:44 - 2014-07-08 19:29 - 00006144 _____ (Microsoft Corporation) C:\Windows\system32\KBDBASH.DLL
2014-10-16 17:44 - 2014-07-08 19:29 - 00005632 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU.DLL
2014-10-16 17:44 - 2014-07-08 16:30 - 00419992 _____ () C:\Windows\system32\locale.nls
2014-10-16 17:44 - 2014-06-18 16:23 - 01131664 _____ (Microsoft Corporation) C:\Windows\system32\dfshim.dll
2014-10-16 17:44 - 2014-06-18 16:23 - 00156824 _____ (Microsoft Corporation) C:\Windows\system32\mscorier.dll
2014-10-16 17:44 - 2014-06-18 16:23 - 00081560 _____ (Microsoft Corporation) C:\Windows\system32\mscories.dll
2014-10-16 17:43 - 2014-09-17 19:32 - 02363904 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-10-16 17:43 - 2014-09-12 19:40 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-11-14 20:11 - 2013-02-18 17:26 - 00000882 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-11-14 20:08 - 2012-04-06 14:46 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-11-14 20:05 - 2012-04-06 14:48 - 00000918 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4106215785-1409883783-339786315-1001UA.job
2014-11-14 20:01 - 2013-12-15 19:55 - 00000000 ____D () C:\ProgramData\MFAData
2014-11-14 18:46 - 2012-01-04 15:14 - 01655070 _____ () C:\Windows\WindowsUpdate.log
2014-11-14 18:08 - 2012-04-06 14:46 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-11-14 18:08 - 2012-04-06 14:46 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-11-14 17:38 - 2009-07-13 22:34 - 00031728 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-11-14 17:38 - 2009-07-13 22:34 - 00031728 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-11-14 17:37 - 2010-11-20 15:01 - 00782510 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-11-14 17:30 - 2013-02-18 17:25 - 00000878 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-11-14 17:30 - 2009-07-13 22:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-11-09 21:51 - 2014-07-17 20:01 - 00000000 ____D () C:\Users\Toni.Ron-PC\Downloads\WinRAR420
2014-11-09 21:38 - 2014-07-16 22:04 - 00000000 ____D () C:\Program Files\Optimizer Pro
2014-11-09 21:05 - 2013-12-15 19:57 - 00000000 ____D () C:\Program Files\AVG
2014-11-09 21:05 - 2012-04-06 14:48 - 00000866 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4106215785-1409883783-339786315-1001Core.job
2014-11-09 20:59 - 2009-07-13 20:37 - 00000000 ____D () C:\Windows\system32\NDF
2014-11-09 20:33 - 2010-11-20 15:48 - 00081732 _____ () C:\Windows\PFRO.log
2014-10-30 05:24 - 2012-03-16 10:01 - 00229000 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-10-20 07:44 - 2014-06-18 10:55 - 00000000 ____D () C:\Users\Toni.Ron-PC\AppData\Roaming\uTorrent
2014-10-20 07:16 - 2014-10-07 07:59 - 00000000 ____D () C:\ProgramData\sAVer box
2014-10-20 07:16 - 2014-08-07 20:02 - 00000000 ____D () C:\ProgramData\webSaver
2014-10-20 06:36 - 2014-08-07 20:02 - 00000000 ____D () C:\ProgramData\935d36f68bd5f941
2014-10-20 06:36 - 2014-07-27 11:49 - 00000000 ____D () C:\Program Files\VideoLAN
2014-10-20 06:36 - 2014-07-20 16:03 - 00000000 ____D () C:\Program Files\WinRAR
2014-10-20 06:29 - 2013-12-07 12:07 - 00000000 ____D () C:\Program Files\Java
2014-10-20 06:27 - 2013-12-07 12:07 - 00272296 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-10-20 06:27 - 2013-12-07 12:07 - 00176552 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-10-20 06:27 - 2013-12-07 12:07 - 00176552 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-10-20 06:27 - 2013-12-07 12:07 - 00096680 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2014-10-17 03:07 - 2009-07-13 20:37 - 00000000 ____D () C:\Windows\rescache
2014-10-17 02:41 - 2009-07-13 20:37 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-10-17 02:30 - 2009-07-13 22:33 - 01749864 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-10-17 02:28 - 2014-05-07 02:00 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-10-17 02:12 - 2012-04-06 14:18 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-10-17 02:10 - 2013-08-13 20:06 - 00000000 ____D () C:\Windows\system32\MRT
2014-10-17 02:03 - 2012-03-16 10:11 - 100290944 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-10-16 20:03 - 2012-05-16 20:15 - 00000000 ____D () C:\Windows\Minidump

Files to move or delete:
====================
C:\Users\Toni.Ron-PC\CTX.DAT

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2014-11-06 21:25

==================== End Of Log ============================

 

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 13-11-2014 01
Ran by Toni at 2014-11-14 20:49:12
Running from C:\Users\Toni.Ron-PC\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6PI3CJKG
Boot Mode: Normal
==========================================================

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Microsoft Security Essentials (Enabled - Up to date) {4F35CFC4-45A3-FC37-EF17-759A02E39AB1}
AV: AVG AntiVirus 2015 (Enabled - Up to date) {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}
AS: Microsoft Security Essentials (Enabled - Up to date) {F4542E20-6399-F3B9-D5A7-4EE87964D00C}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: AVG AntiVirus 2015 (Enabled - Up to date) {B5F5C120-2089-702E-0001-553BB0D5A664}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Flash Player 15 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 15.0.0.223 - Adobe Systems Incorporated)
Adobe Photoshop CS3 (HKLM\...\Adobe_2ac78060bc5856b0c1cf873bb919b58) (Version: 10.0 - Adobe Systems Incorporated)
Adobe Reader X (10.1.12) (HKLM\...\{AC76BA86-7AD7-1033-7B44-AA1000000001}) (Version: 10.1.12 - Adobe Systems Incorporated)
Apple Application Support (HKLM\...\{78002155-F025-4070-85B3-7C0453561701}) (Version: 3.0.6 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{C0CC75CD-F5B7-46AD-B016-17C0F5171718}) (Version: 8.0.0.23 - Apple Inc.)
Apple Software Update (HKLM\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
AVG 2015 (HKLM\...\AVG) (Version: 2015.0.5577 - AVG Technologies)
AVG 2015 (Version: 15.0.4213 - AVG Technologies) Hidden
AVG 2015 (Version: 15.0.5577 - AVG Technologies) Hidden
Bonjour (HKLM\...\{79155F2B-9895-49D7-8612-D92580E0DE5B}) (Version: 3.0.0.10 - Apple Inc.)
CANON iMAGE GATEWAY Task for ZoomBrowser EX (HKLM\...\CANON iMAGE GATEWAY Task) (Version: 1.7.0.4 - Canon Inc.)
Canon Internet Library for ZoomBrowser EX (HKLM\...\Canon Internet Library for ZoomBrowser EX) (Version: 1.6.3.9 - Canon Inc.)
Canon MovieEdit Task for ZoomBrowser EX (HKLM\...\MovieEditTask) (Version: 3.0.0.20 - Canon Inc.)
Canon Utilities CameraWindow (HKLM\...\CameraWindowLauncher) (Version: 7.2.0.2 - Canon Inc.)
Canon Utilities CameraWindow DC (HKLM\...\CameraWindowDC) (Version: 7.4.0.9 - Canon Inc.)
Canon Utilities CameraWindow DC_DV 6 for ZoomBrowser EX (HKLM\...\CameraWindowDVC6) (Version: 6.5.0.3 - Canon Inc.)
Canon Utilities MyCamera (HKLM\...\MyCamera) (Version: 7.2.0.4 - Canon Inc.)
Canon Utilities MyCamera DC (HKLM\...\MyCameraDC) (Version: 7.2.0.5 - Canon Inc.)
Canon Utilities RemoteCapture Task for ZoomBrowser EX (HKLM\...\RemoteCaptureTask) (Version: 1.8.0.1 - Canon Inc.)
Canon Utilities ZoomBrowser EX (HKLM\...\ZoomBrowser EX) (Version: 6.3.0.7 - Canon Inc.)
Canon ZoomBrowser EX Memory Card Utility (HKLM\...\ZoomBrowser EX Memory Card Utility) (Version: 1.2.0.9 - Canon Inc.)
D3DX10 (Version: 15.4.2368.0902 - Microsoft) Hidden
DivX Setup (HKLM\...\DivX Setup) (Version: 2.6.3.52 - DivX, LLC)
EPSON Printer Software (HKLM\...\EPSON Printer and Utilities) (Version:  - SEIKO EPSON Corporation)
EPSON Scan (HKLM\...\EPSON Scanner) (Version:  - )
Google Toolbar for Internet Explorer (HKLM\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.5111.1712 - Google Inc.)
Google Toolbar for Internet Explorer (Version: 1.0.0 - Google Inc.) Hidden
Google Update Helper (Version: 1.3.24.15 - Google Inc.) Hidden
Google+ Auto Backup (HKLM\...\{A50DE037-B5C0-4C8A-8049-B0C576B313D1}) (Version: 1.0.21.81 - Google)
iCloud (HKLM\...\{8D9592B4-7E22-4D1F-B2CB-B5F0F2F619CB}) (Version: 4.0.3.56 - Apple Inc.)
iTunes (HKLM\...\{F32DC846-4457-40A8-BECA-BCC0E960BC53}) (Version: 11.4.0.18 - Apple Inc.)
Java 8 Update 25 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83218025F0}) (Version: 8.0.250 - Oracle Corporation)
Junk Mail filter update (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Malwarebytes Anti-Malware version 2.0.3.1025 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.3.1025 - Malwarebytes Corporation)
Mesh Runtime (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Messenger Companion (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office Outlook Connector (HKLM\...\{95140000-007A-0409-0000-0000000FF1CE}) (Version: 14.0.5118.5000 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (HKLM\...\Office14.PROPLUSR) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Outlook Social Connector Provider for Windows Live Messenger 32-bit (HKLM\...\{95140000-007D-0409-0000-0000000FF1CE}) (Version: 14.0.5120.5000 - Microsoft Corporation)
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.6.305.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
MSVCRT (Version: 15.4.2862.0708 - Microsoft) Hidden
NVIDIA Graphics Driver 275.33 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 275.33 - NVIDIA Corporation)
NVIDIA Update 1.3.5 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 1.3.5 - NVIDIA Corporation)
OpooSoft JPEG To PDF Converter v6.6 (HKLM\...\JPEG To PDF Converter_is1) (Version:  - OpooSoft.com Inc)
PDF Settings (Version: 1.0 - Adobe Systems Incorporated) Hidden
Picasa 3 (HKLM\...\Picasa 3) (Version: 3.9 - Google, Inc.)
Pin It (HKLM\...\Pin It_is1) (Version: 0.0.3 - Pinterest)
QuickTime 7 (HKLM\...\{111EE7DF-FC45-40C7-98A7-753AC46B12FB}) (Version: 7.75.80.95 - Apple Inc.)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version:  - Microsoft)
VC80CRTRedist - 8.0.50727.6195 (Version: 1.2.0 - DivX, Inc) Hidden
Visual Studio 2012 x86 Redistributables (HKLM\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
Windows Live Essentials (HKLM\...\WinLiveSuite) (Version: 15.4.3555.0308 - Microsoft Corporation)
Windows Live Mesh ActiveX Control for Remote Connections (HKLM\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Phone app for desktop (HKLM\...\{5F71448B-88EB-4357-9A98-8658D4C49C48}) (Version: 1.1.2726.0 - Microsoft Corporation)
Yahoo! Software Update (HKLM\...\Yahoo! Software Update) (Version:  - )

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-4106215785-1409883783-339786315-1001_Classes\CLSID\{022105BD-948A-40C9-AB42-A3300DDF097F}\localserver32 -> C:\Users\Toni.Ron-PC\AppData\Local\Google\Update\GoogleUpdate.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-4106215785-1409883783-339786315-1001_Classes\CLSID\{035FBE31-3755-450A-A775-5E6BBD43D344}\InprocServer32 -> C:\Users\Toni.Ron-PC\AppData\Local\Google\Update\1.3.21.135\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-4106215785-1409883783-339786315-1001_Classes\CLSID\{22181302-A8A6-4F84-A541-E5CBFC70CC43}\localserver32 -> C:\Users\Toni.Ron-PC\AppData\Local\Google\Update\1.3.24.15\GoogleUpdateOnDemand.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-4106215785-1409883783-339786315-1001_Classes\CLSID\{2F0E2680-9FF5-43C0-B76E-114A56E93598}\localserver32 -> C:\Users\Toni.Ron-PC\AppData\Local\Google\Update\1.3.24.15\GoogleUpdateOnDemand.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-4106215785-1409883783-339786315-1001_Classes\CLSID\{355EC88A-02E2-4547-9DEE-F87426484BD1}\InprocServer32 -> C:\Users\Toni.Ron-PC\AppData\Local\Google\Update\1.3.23.9\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-4106215785-1409883783-339786315-1001_Classes\CLSID\{51F9E8EF-59D7-475B-A106-C7EA6F30C119}\localserver32 -> C:\Users\Toni.Ron-PC\AppData\Local\Google\Update\1.3.24.15\GoogleUpdateOnDemand.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-4106215785-1409883783-339786315-1001_Classes\CLSID\{5C65F4B0-3651-4514-B207-D10CB699B14B}\localserver32 -> C:\Users\Toni.Ron-PC\AppData\Local\Google\Chrome\Application\36.0.1985.125\delegate_execute.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-4106215785-1409883783-339786315-1001_Classes\CLSID\{62A0D750-DED9-448C-B693-406B34BB0892}\InprocServer32 -> C:\Users\Toni.Ron-PC\AppData\Local\Google\Update\1.3.21.145\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-4106215785-1409883783-339786315-1001_Classes\CLSID\{634059C0-D264-4B2C-AE80-F73E48D33E5B}\InprocServer32 -> C:\Users\Toni.Ron-PC\AppData\Local\Google\Update\1.3.21.123\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-4106215785-1409883783-339786315-1001_Classes\CLSID\{6D7374DE-63AA-473C-8C02-60D9CDCD84C5}\InprocServer32 -> C:\Users\Toni.Ron-PC\AppData\Local\Google\Update\1.3.21.153\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-4106215785-1409883783-339786315-1001_Classes\CLSID\{90B3DFBF-AF6A-4EA0-8899-F332194690F8}\InprocServer32 -> C:\Users\Toni.Ron-PC\AppData\Local\Google\Update\1.3.24.15\psuser.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-4106215785-1409883783-339786315-1001_Classes\CLSID\{A45426FB-E444-42B2-AA56-419F8FBEEC61}\InprocServer32 -> C:\Users\Toni.Ron-PC\AppData\Local\Google\Update\1.3.22.3\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-4106215785-1409883783-339786315-1001_Classes\CLSID\{A54D478D-4F70-4F72-9A74-17C9986E35AB}\InprocServer32 -> C:\Users\Toni.Ron-PC\AppData\Local\Google\Update\1.3.21.165\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-4106215785-1409883783-339786315-1001_Classes\CLSID\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}\InprocServer32 -> C:\Users\Toni.Ron-PC\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-4106215785-1409883783-339786315-1001_Classes\CLSID\{C442AC41-9200-4770-8CC0-7CDB4F245C55}\InprocServer32 -> C:\Users\Toni.Ron-PC\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-4106215785-1409883783-339786315-1001_Classes\CLSID\{C5A2122B-A05B-4FD8-AE49-91990AE10998}\InprocServer32 -> C:\Users\Toni.Ron-PC\AppData\Local\Google\Update\1.3.21.115\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-4106215785-1409883783-339786315-1001_Classes\CLSID\{E67BE843-BBBE-4484-95FB-05271AE86750}\localserver32 -> C:\Users\Toni.Ron-PC\AppData\Local\Google\Update\1.3.24.15\GoogleUpdateOnDemand.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-4106215785-1409883783-339786315-1001_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\Toni.Ron-PC\AppData\Local\Google\Update\1.3.24.15\psuser.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-4106215785-1409883783-339786315-1001_Classes\CLSID\{EB06378B-ABB6-4B3C-9B40-D488DD8A6E93}\InprocServer32 -> C:\Users\Toni.Ron-PC\AppData\Local\Google\Update\1.3.22.5\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-4106215785-1409883783-339786315-1001_Classes\CLSID\{FB994D36-B312-46CE-A40B-CF63980641F9}\InprocServer32 -> C:\Users\Toni.Ron-PC\AppData\Local\Google\Update\1.3.21.111\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-4106215785-1409883783-339786315-1001_Classes\CLSID\{FE498BAB-CB4C-4F88-AC3F-3641AAAF5E9E}\InprocServer32 -> C:\Users\Toni.Ron-PC\AppData\Local\Google\Update\1.3.24.7\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-4106215785-1409883783-339786315-1002_Classes\CLSID\{022105BD-948A-40C9-AB42-A3300DDF097F}\localserver32 -> C:\Users\Toni.Ron-PC\AppData\Local\Google\Update\GoogleUpdate.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-4106215785-1409883783-339786315-1002_Classes\CLSID\{22181302-A8A6-4F84-A541-E5CBFC70CC43}\localserver32 -> "C:\Users\Toni.Ron-PC\AppData\Local\Google\Update\1.3.21.111\GoogleUpdateOnDemand.exe" No File
CustomCLSID: HKU\S-1-5-21-4106215785-1409883783-339786315-1002_Classes\CLSID\{2F0E2680-9FF5-43C0-B76E-114A56E93598}\localserver32 -> "C:\Users\Toni.Ron-PC\AppData\Local\Google\Update\1.3.21.111\GoogleUpdateOnDemand.exe" No File
CustomCLSID: HKU\S-1-5-21-4106215785-1409883783-339786315-1002_Classes\CLSID\{51F9E8EF-59D7-475B-A106-C7EA6F30C119}\localserver32 -> "C:\Users\Toni.Ron-PC\AppData\Local\Google\Update\1.3.21.111\GoogleUpdateOnDemand.exe" No File
CustomCLSID: HKU\S-1-5-21-4106215785-1409883783-339786315-1002_Classes\CLSID\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}\InprocServer32 -> C:\Users\UpdatusUser\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
CustomCLSID: HKU\S-1-5-21-4106215785-1409883783-339786315-1002_Classes\CLSID\{C442AC41-9200-4770-8CC0-7CDB4F245C55}\InprocServer32 -> C:\Users\UpdatusUser\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
CustomCLSID: HKU\S-1-5-21-4106215785-1409883783-339786315-1002_Classes\CLSID\{E67BE843-BBBE-4484-95FB-05271AE86750}\localserver32 -> "C:\Users\Toni.Ron-PC\AppData\Local\Google\Update\1.3.21.111\GoogleUpdateOnDemand.exe" No File
CustomCLSID: HKU\S-1-5-21-4106215785-1409883783-339786315-1002_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\UpdatusUser\AppData\Local\Google\Update\1.3.21.111\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-4106215785-1409883783-339786315-1002_Classes\CLSID\{FB994D36-B312-46CE-A40B-CF63980641F9}\InprocServer32 -> C:\Users\UpdatusUser\AppData\Local\Google\Update\1.3.21.111\psuser.dll No File

==================== Restore Points  =========================

20-10-2014 08:41:48 Windows Update
23-10-2014 23:30:37 Windows Update
27-10-2014 02:49:54 Windows Update
31-10-2014 22:34:51 Windows Update
05-11-2014 03:41:12 Windows Update
08-11-2014 04:49:42 Windows Update
10-11-2014 03:05:38 Installed AVG 2015
10-11-2014 03:06:04 Installed AVG 2015
14-11-2014 23:49:30 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-13 20:04 - 2009-06-10 15:39 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {2C743EC3-BC3F-467E-A6D2-38FC88E4770B} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2013-02-18] (Google Inc.)
Task: {32D98768-F73E-4699-AF5B-5F1B7C14AC6E} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {44DB7EF3-C3CC-4A7B-A7A5-7A31E08FB341} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-4106215785-1409883783-339786315-1001UA => C:\Users\Toni.Ron-PC\AppData\Local\Google\Update\GoogleUpdate.exe [2012-04-06] (Google Inc.)
Task: {69E07F76-8F46-4432-BB36-940F31A49E71} - System32\Tasks\Optimizer Pro Schedule => C:\Program Files\Optimizer Pro\OptProLauncher.exe <==== ATTENTION
Task: {9B9981CF-544A-4E46-BBEA-0536F25B9412} - System32\Tasks\PinItAutoUpdate => C:\Program Files\Pinterest\Pin It\AutoUpdater.exe [2013-10-17] ()
Task: {B5BF6911-7D0D-4412-B2A0-B79E2A1AC64D} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-11-14] (Adobe Systems Incorporated)
Task: {C8A0E098-68EC-43C6-B346-8CC1D32E170E} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2013-02-18] (Google Inc.)
Task: {CAB99260-6056-4ED4-B4BA-D828B1D63115} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-4106215785-1409883783-339786315-1001Core => C:\Users\Toni.Ron-PC\AppData\Local\Google\Update\GoogleUpdate.exe [2012-04-06] (Google Inc.)
Task: {DDCF89D7-A039-4F4E-BCAD-0D45E3E5EAA5} - System32\Tasks\Microsoft\Windows\PLA\System\{A7B800E8-39B8-4A1F-B66F-31FFB3D3F381}_System Diagnostics => Rundll32.exe C:\Windows\system32\pla.dll,PlaHost "system\System Diagnostics" "$(Arg0)"
Task: {F0BFB3B5-3425-4C77-8088-54C09896A7E3} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4106215785-1409883783-339786315-1001Core.job => C:\Users\Toni.Ron-PC\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4106215785-1409883783-339786315-1001UA.job => C:\Users\Toni.Ron-PC\AppData\Local\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2013-09-05 00:14 - 2013-09-05 00:14 - 04300456 _____ () C:\Program Files\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
2010-10-20 14:45 - 2010-10-20 14:45 - 08801120 _____ () C:\Program Files\Microsoft Office\Office14\1033\GrooveIntlResource.dll
2014-01-09 23:26 - 2014-01-09 23:26 - 01861968 _____ () C:\Program Files\DivX\DivX Update\DivXUpdate.exe
2014-01-09 23:28 - 2014-01-09 23:28 - 00100688 _____ () C:\Program Files\DivX\DivX Update\DivXUpdateCheck.dll
2014-07-31 11:16 - 2014-07-31 11:16 - 00073544 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2014-07-31 11:16 - 2014-07-31 11:16 - 01044776 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)

==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

MSCONFIG\startupreg: Adobe ARM => "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: APSDaemon => "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"
MSCONFIG\startupreg: BCSSync => "C:\Program Files\Microsoft Office\Office14\BCSSync.exe" /DelayServices
MSCONFIG\startupreg: EPSON Stylus CX7800 Series => C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATIAFA.EXE /FU "C:\Windows\TEMP\E_SDA2D.tmp" /EF "HKCU"
MSCONFIG\startupreg: Google Update => "C:\Users\Toni.Ron-PC\AppData\Local\Google\Update\GoogleUpdate.exe" /c
MSCONFIG\startupreg: HotKeysCmds => C:\Windows\system32\hkcmd.exe
MSCONFIG\startupreg: IgfxTray => C:\Windows\system32\igfxtray.exe
MSCONFIG\startupreg: iTunesHelper => "C:\Program Files\iTunes\iTunesHelper.exe"
MSCONFIG\startupreg: MSC => "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
MSCONFIG\startupreg: Persistence => C:\Windows\system32\igfxpers.exe
MSCONFIG\startupreg: Sidebar => C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
MSCONFIG\startupreg: Zune Launcher => "C:\Program Files\Zune\ZuneLauncher.exe"

========================= Accounts: ==========================

Administrator (S-1-5-21-4106215785-1409883783-339786315-500 - Administrator - Disabled)
Guest (S-1-5-21-4106215785-1409883783-339786315-501 - Limited - Disabled)
Toni (S-1-5-21-4106215785-1409883783-339786315-1001 - Administrator - Enabled) => C:\Users\Toni.Ron-PC
UpdatusUser (S-1-5-21-4106215785-1409883783-339786315-1002 - Limited - Enabled) => C:\Users\UpdatusUser

==================== Faulty Device Manager Devices =============

Name: PS/2 Compatible Mouse
Description: PS/2 Compatible Mouse
Class Guid: {4d36e96f-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: i8042prt
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.

Name: Standard PS/2 Keyboard
Description: Standard PS/2 Keyboard
Class Guid: {4d36e96b-e325-11ce-bfc1-08002be10318}
Manufacturer: (Standard keyboards)
Service: i8042prt
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.

==================== Event log errors: =========================

Application errors:
==================
Error: (11/14/2014 05:31:50 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (11/14/2014 05:18:02 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (11/09/2014 09:11:33 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (11/09/2014 08:34:51 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (11/09/2014 03:54:38 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 9002

Error: (11/09/2014 03:54:38 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 9002

Error: (11/09/2014 03:54:38 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (11/08/2014 00:02:24 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 9984

Error: (11/08/2014 00:02:24 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 9984

Error: (11/08/2014 00:02:24 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

System errors:
=============
Error: (11/14/2014 05:31:06 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the Browser System Enahncer service to connect.

Error: (11/14/2014 05:29:13 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: %NT AUTHORITY60 has encountered an error trying to update signatures.

 New Signature Version:

 Previous Signature Version: 1.187.1704.0

 Update Source: %NT AUTHORITY59

 Update Stage: 4.6.0305.00

 Source Path: 4.6.0305.01

 Signature Type: %NT AUTHORITY602

 Update Type: %NT AUTHORITY604

 User: NT AUTHORITY\SYSTEM

 Current Engine Version: %NT AUTHORITY605

 Previous Engine Version: %NT AUTHORITY606

 Error code: %NT AUTHORITY607

 Error description: %NT AUTHORITY608

Error: (11/14/2014 05:29:13 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: %NT AUTHORITY60 has encountered an error trying to update signatures.

 New Signature Version:

 Previous Signature Version: 1.187.1704.0

 Update Source: %NT AUTHORITY59

 Update Stage: 4.6.0305.00

 Source Path: 4.6.0305.01

 Signature Type: %NT AUTHORITY602

 Update Type: %NT AUTHORITY604

 User: NT AUTHORITY\SYSTEM

 Current Engine Version: %NT AUTHORITY605

 Previous Engine Version: %NT AUTHORITY606

 Error code: %NT AUTHORITY607

 Error description: %NT AUTHORITY608

Error: (11/14/2014 05:17:15 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the Browser System Enahncer service to connect.

Error: (11/09/2014 09:10:30 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the Browser System Enahncer service to connect.

Error: (11/09/2014 08:33:43 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the Browser System Enahncer service to connect.

Error: (11/04/2014 09:36:57 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The MBAMService service terminated unexpectedly.  It has done this 1 time(s).

Error: (11/04/2014 09:36:26 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the MBAMScheduler service.

Error: (11/04/2014 09:30:30 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the MBAMScheduler service.

Error: (10/20/2014 07:29:58 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the Browser System Enahncer service to connect.

Microsoft Office Sessions:
=========================
Error: (11/14/2014 05:31:50 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (11/14/2014 05:18:02 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (11/09/2014 09:11:33 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (11/09/2014 08:34:51 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (11/09/2014 03:54:38 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 9002

Error: (11/09/2014 03:54:38 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 9002

Error: (11/09/2014 03:54:38 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (11/08/2014 00:02:24 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 9984

Error: (11/08/2014 00:02:24 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 9984

Error: (11/08/2014 00:02:24 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

CodeIntegrity Errors:
===================================
  Date: 2014-11-09 21:08:56.798
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\AVG\AVG2015\avghookx.dll because the set of per-page image hashes could not be found on the system.

==================== Memory info ===========================

Processor: Intel® Core™2 Duo CPU E8400 @ 3.00GHz
Percentage of memory in use: 49%
Total physical RAM: 3543.25 MB
Available physical RAM: 1775.03 MB
Total Pagefile: 7084.78 MB
Available Pagefile: 5299.07 MB
Total Virtual: 2047.88 MB
Available Virtual: 1896.32 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:297.99 GB) (Free:146.45 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298.1 GB) (Disk ID: D47CFC6E)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=298 GB) - (Type=07 NTFS)

==================== End Of Log ============================

 


    Advertisements

Register to Remove

#2 LiquidTension

LiquidTension

    SuperMember

  • Retired Classroom Teacher
  • 2,566 posts

Posted 16 November 2014 - 07:01 AM

Hello tonilo, welcome to WhatTheTech's Malware Removal forum!
 
My username is LiquidTension, but you can call me Adam. I will be assisting you with your malware-related problems.
If you would allow me to call you by your first name I would prefer that. :)
 
======================================================
 
Please read through the points below to ensure this process moves as quickly and efficiently as possible.

  • Please ensure you read through my instructions thoroughly, and carry out each step in the order specified.
  • Please do not post logs using the CODE, QUOTE or ATTACHMENT format. Logs should be posted directly in plain text. If you receive an error whilst posting, please break the log in half and use multiple posts.
  • Please do not run any tools or take any steps other than those I provide for you. Independent efforts may make matters worse, and will affect my ability in ascertaining the current situation and providing the best set of instructions for you.
  • Please backup important files before proceeding with my instructions. Malware removal can be unpredictable.  
  • If you come across any issues whilst following my instructions, please stop and inform me of the issue in as much detail as possible. Please do not hesitate to ask before proceeding.
  • Topics are locked if no response is made after 4 days. Please inform me if you require additional time to complete my instructions.
  • Ensure you are following this topic. Click etYzdbu.png at the top of the page. 
     

======================================================
 
Please consider the following suggestion, and proceed with the instructions below. 
 

goGMWSt.gifMultiple Anti-Virus Software Installed
 
------------------------------
 
It is inadvisable to have more than one Anti-Virus installed on your computer at the same time. Doing so may:

  • Cause conflicts, negatively impacting the effectiveness of each Anti-Virus installed. 
  • Trigger false-positives.
  • Trigger false-negatives, where neither programme detects malware. 
  • Cause system instability/performance issues. Your system may lock up or slow down due to both software attempting to access the same file at the same time. 
Please remove all but one Anti-Virus from your computer.
  • Press the Windows Key pdKOQKY.png + r on your keyboard at the same time.
  • Type appwiz.cpl and click OK.
  • Search for and uninstall all but one of the programmes listed below by right-clicking and clicking Uninstall.
    • Microsoft Security Essentials 
    • AVG AntiVirus 2015 
  • ​Follow the prompts, and reboot your computer once uninstalled. 

 
STEP 1
xlK5Hdb.png Farbar Recovery Scan Tool (FRST) Script

  • Press the Windows Key pdKOQKY.png + r on your keyboard at the same time. Type Notepad and click OK.
  • Copy the entire contents of the codebox below and paste into the Notepad document.
    start
HKU\S-1-5-21-4106215785-1409883783-339786315-1001\...\MountPoints2: E - E:\LaunchU3.exe -a
HKU\S-1-5-21-4106215785-1409883783-339786315-1001\...\MountPoints2: {834e473f-0175-11e4-88e1-d48564132670} - E:\LaunchU3.exe -a
HKU\S-1-5-21-4106215785-1409883783-339786315-1001\...\MountPoints2: {c07cff79-55d7-11e4-8930-d48564132670} - E:\windows\AutoRun.exe {430A8AE3-8898-4DAB-8C5B-5E8ADA7D571E} 3.0.0.02 VID_19D2&PID_0358 {9B00E99F-83A4-40d4-B987-7EB04F722BB7}
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
SearchScopes: HKLM - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = http://dts.search-re...&q={searchTerms}
SearchScopes: HKCU - {77D1CA7D-336C-437E-8F96-680E2428975F} URL = https://search.yahoo...&p={searchTerms}
SearchScopes: HKCU - {92B5EDEB-7FCF-47D9-A390-71E96B84E724} URL = http://search.yahoo....rms}&fr=chr-att
SearchScopes: HKCU - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = http://dts.search-re...&q={searchTerms}
BHO: No Name -> {02478D38-C3F9-4efb-9B51-7695ECA05670} ->  No File
BHO: No Name -> {D40C654D-7C51-4EB3-95B2-1E23905C2A2D} ->  No File
S2 671c50b0; "C:\Windows\system32\rundll32.exe" "c:\progra~2\browse~1\BrowserSystemEnahncerSvc.dll",service
c:\progra~2\browse~1
2014-11-14 19:42 - 2014-11-14 19:42 - 00399224 _____ (Premium Installer ) C:\Users\Toni.Ron-PC\Downloads\setup (1).exe
2014-11-14 19:36 - 2014-11-14 19:36 - 00399224 _____ (Premium Installer ) C:\Users\Toni.Ron-PC\Downloads\setup.exe
2014-11-14 17:25 - 2014-11-14 17:25 - 00000000 ____D () C:\Users\Default\AppData\Roaming\TuneUp Software
2014-11-14 17:25 - 2014-11-14 17:25 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\TuneUp Software
2014-10-27 20:08 - 2014-10-27 20:09 - 00000000 ____D () C:\Users\Toni.Ron-PC\AppData\Local\{52C980EF-72E7-485E-BDB5-2B4588EDE283}
2014-10-20 06:36 - 2014-10-20 06:36 - 00000000 ____D () C:\Program Files\webSaver
2014-10-20 06:35 - 2014-10-20 06:35 - 00000000 ____D () C:\Program Files\sAVer box
2014-10-20 06:35 - 2014-10-20 06:35 - 00000000 ____D () C:\Program Files\saiviingetoyoU
2014-10-17 01:58 - 2014-10-20 07:16 - 00000000 ____D () C:\ProgramData\saiviingetoyoU
2014-11-09 21:38 - 2014-07-16 22:04 - 00000000 ____D () C:\Program Files\Optimizer Pro
2014-10-20 07:16 - 2014-10-07 07:59 - 00000000 ____D () C:\ProgramData\sAVer box
2014-10-20 07:16 - 2014-08-07 20:02 - 00000000 ____D () C:\ProgramData\webSaver
Folder: C:\ProgramData\935d36f68bd5f941
C:\Users\Toni.Ron-PC\CTX.DAT
CustomCLSID: HKU\S-1-5-21-4106215785-1409883783-339786315-1001_Classes\CLSID\{035FBE31-3755-450A-A775-5E6BBD43D344}\InprocServer32 -> C:\Users\Toni.Ron-PC\AppData\Local\Google\Update\1.3.21.135\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-4106215785-1409883783-339786315-1001_Classes\CLSID\{355EC88A-02E2-4547-9DEE-F87426484BD1}\InprocServer32 -> C:\Users\Toni.Ron-PC\AppData\Local\Google\Update\1.3.23.9\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-4106215785-1409883783-339786315-1001_Classes\CLSID\{62A0D750-DED9-448C-B693-406B34BB0892}\InprocServer32 -> C:\Users\Toni.Ron-PC\AppData\Local\Google\Update\1.3.21.145\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-4106215785-1409883783-339786315-1001_Classes\CLSID\{634059C0-D264-4B2C-AE80-F73E48D33E5B}\InprocServer32 -> C:\Users\Toni.Ron-PC\AppData\Local\Google\Update\1.3.21.123\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-4106215785-1409883783-339786315-1001_Classes\CLSID\{6D7374DE-63AA-473C-8C02-60D9CDCD84C5}\InprocServer32 -> C:\Users\Toni.Ron-PC\AppData\Local\Google\Update\1.3.21.153\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-4106215785-1409883783-339786315-1001_Classes\CLSID\{A45426FB-E444-42B2-AA56-419F8FBEEC61}\InprocServer32 -> C:\Users\Toni.Ron-PC\AppData\Local\Google\Update\1.3.22.3\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-4106215785-1409883783-339786315-1001_Classes\CLSID\{A54D478D-4F70-4F72-9A74-17C9986E35AB}\InprocServer32 -> C:\Users\Toni.Ron-PC\AppData\Local\Google\Update\1.3.21.165\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-4106215785-1409883783-339786315-1001_Classes\CLSID\{C5A2122B-A05B-4FD8-AE49-91990AE10998}\InprocServer32 -> C:\Users\Toni.Ron-PC\AppData\Local\Google\Update\1.3.21.115\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-4106215785-1409883783-339786315-1001_Classes\CLSID\{EB06378B-ABB6-4B3C-9B40-D488DD8A6E93}\InprocServer32 -> C:\Users\Toni.Ron-PC\AppData\Local\Google\Update\1.3.22.5\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-4106215785-1409883783-339786315-1001_Classes\CLSID\{FB994D36-B312-46CE-A40B-CF63980641F9}\InprocServer32 -> C:\Users\Toni.Ron-PC\AppData\Local\Google\Update\1.3.21.111\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-4106215785-1409883783-339786315-1001_Classes\CLSID\{FE498BAB-CB4C-4F88-AC3F-3641AAAF5E9E}\InprocServer32 -> C:\Users\Toni.Ron-PC\AppData\Local\Google\Update\1.3.24.7\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-4106215785-1409883783-339786315-1002_Classes\CLSID\{22181302-A8A6-4F84-A541-E5CBFC70CC43}\localserver32 -> "C:\Users\Toni.Ron-PC\AppData\Local\Google\Update\1.3.21.111\GoogleUpdateOnDemand.exe" No File
CustomCLSID: HKU\S-1-5-21-4106215785-1409883783-339786315-1002_Classes\CLSID\{2F0E2680-9FF5-43C0-B76E-114A56E93598}\localserver32 -> "C:\Users\Toni.Ron-PC\AppData\Local\Google\Update\1.3.21.111\GoogleUpdateOnDemand.exe" No File
CustomCLSID: HKU\S-1-5-21-4106215785-1409883783-339786315-1002_Classes\CLSID\{51F9E8EF-59D7-475B-A106-C7EA6F30C119}\localserver32 -> "C:\Users\Toni.Ron-PC\AppData\Local\Google\Update\1.3.21.111\GoogleUpdateOnDemand.exe" No File
CustomCLSID: HKU\S-1-5-21-4106215785-1409883783-339786315-1002_Classes\CLSID\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}\InprocServer32 -> C:\Users\UpdatusUser\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
CustomCLSID: HKU\S-1-5-21-4106215785-1409883783-339786315-1002_Classes\CLSID\{C442AC41-9200-4770-8CC0-7CDB4F245C55}\InprocServer32 -> C:\Users\UpdatusUser\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
CustomCLSID: HKU\S-1-5-21-4106215785-1409883783-339786315-1002_Classes\CLSID\{E67BE843-BBBE-4484-95FB-05271AE86750}\localserver32 -> "C:\Users\Toni.Ron-PC\AppData\Local\Google\Update\1.3.21.111\GoogleUpdateOnDemand.exe" No File
CustomCLSID: HKU\S-1-5-21-4106215785-1409883783-339786315-1002_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\UpdatusUser\AppData\Local\Google\Update\1.3.21.111\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-4106215785-1409883783-339786315-1002_Classes\CLSID\{FB994D36-B312-46CE-A40B-CF63980641F9}\InprocServer32 -> C:\Users\UpdatusUser\AppData\Local\Google\Update\1.3.21.111\psuser.dll No File
Task: {69E07F76-8F46-4432-BB36-940F31A49E71} - System32\Tasks\Optimizer Pro Schedule => C:\Program Files\Optimizer Pro\OptProLauncher.exe <==== ATTENTION
CMD: ipconfig /flushdns
CMD: netsh winsock reset all
CMD: netsh int ipv4 reset
CMD: netsh int ipv6 reset
EmptyTemp:
end
  • Click File, Save As and type fixlist.txt as the File Name. 
  • Important: The file must be saved in the same location as FRST.exe. 

NOTICE: This script is intended for use on this particular machine. Do not use this script on any other machine; doing so may cause damage to your Operating System.

  • Right-Click FRST.exe and select AVOiBNU.jpg Run as administrator to run the programme.
  • Click Fix.
  • A log (Fixlog.txt) will open on your desktop. Copy the contents of the log and paste in your next reply.
     

STEP 2
b8zkrsY.png Browser Reset
 
Instructions on how to backup your Favourites/Bookmarks and other data can be found below.

Proceed with the reset once done.

STEP 3
BY4dvz9.png AdwCleaner

  • Please download AdwCleaner and save the file to your Desktop.
  • Right-Click AdwCleaner.exe and select AVOiBNU.jpg Run as administrator to run the programme.
  • Follow the prompts. 
  • Click Scan. 
  • Upon completion, click Report. A log (AdwCleaner[R0].txt) will open. Briefly check the log for anything you know to be legitimate. 
  • Ensure anything you know to be legitimate does not have a checkmark, and click Clean. 
  • Follow the prompts and allow your computer to reboot. 
  • After rebooting, a log (AdwCleaner[S0].txt) will open. Copy the contents of the log and paste in your next reply.

-- File and registry key backups are made for anything removed using this tool. Should a legitimate entry be removed (otherwise known as a 'false-positive'), simple steps can be taken to restore the entry. Please do not overly concern yourself with the contents of AdwCleaner[R0].txt.
 
 
STEP 4
E3feWj5.png Junkware Removal Tool (JRT)

  • Please download Junkware Removal Tool and save the file to your Desktop.
  • Note: If you unchecked any items in AdwCleaner, please backup the associated folders/files before running JRT.
  • Temporarily disable your anti-virus software. For instructions, please refer to the following link.
  • Right-Click JRT.exe and select AVOiBNU.jpg Run as administrator to run the programme.
  • Follow the prompts and allow the scan to run uninterrupted. 
  • Upon completion, a log (JRT.txt) will open on your desktop.
  • Re-enable your anti-virus software.
  • Copy the contents of JRT.txt and paste in your next reply.
     

======================================================
 
STEP 5
pfNZP4A.png Logs
In your next reply please include the following logs. Please be sure to copy and paste the requested logs, as well as provide information on any questions I may have asked.

  • Which Anti-Virus did you uninstall?
  • Fixlog.txt
  • Did your browsers reset OK?
  • AdwCleaner[S0].txt
  • JRT.txt

50QfLth.png

 

Would you like to help others with malware removal? Join our Classroom and learn how!

#3 tonilo

tonilo

    Authentic Member

  • Authentic Member
  • PipPip
  • 53 posts

Posted 16 November 2014 - 07:18 PM

Hi Adam, You can call me Toni by-the-way. I'm already stuck as I absolutely cannot find Frst.exe. I know I had it because I copied it when I first began this topic and was sure I saved it to my desktop or else in Notepad. It's nowhere to be found. I'll go back and download from a link on your site.

#4 LiquidTension

LiquidTension

    SuperMember

  • Retired Classroom Teacher
  • 2,566 posts

Posted 16 November 2014 - 08:24 PM

Hi Toni, 

 

Please redownload FRST.exe and save the file to your Desktop. 

Then proceed with Step 1. 


50QfLth.png

 

Would you like to help others with malware removal? Join our Classroom and learn how!

#5 tonilo

tonilo

    Authentic Member

  • Authentic Member
  • PipPip
  • 53 posts

Posted 16 November 2014 - 08:38 PM

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 16-11-2014 03
Ran by Toni at 2014-11-16 20:13:06 Run:1
Running from C:\Users\Toni.Ron-PC\Desktop
Loaded Profiles: Toni & UpdatusUser (Available profiles: Toni & UpdatusUser)
Boot Mode: Normal

==============================================

Content of fixlist:
*****************
start
HKU\S-1-5-21-4106215785-1409883783-339786315-1001\...\MountPoints2: E - E:\LaunchU3.exe -a
HKU\S-1-5-21-4106215785-1409883783-339786315-1001\...\MountPoints2: {834e473f-0175-11e4-88e1-d48564132670} - E:\LaunchU3.exe -a
HKU\S-1-5-21-4106215785-1409883783-339786315-1001\...\MountPoints2: {c07cff79-55d7-11e4-8930-d48564132670} - E:\windows\AutoRun.exe {430A8AE3-8898-4DAB-8C5B-5E8ADA7D571E} 3.0.0.02 VID_19D2&PID_0358 {9B00E99F-83A4-40d4-B987-7EB04F722BB7}
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
SearchScopes: HKLM - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = http://dts.search-re...q={searchTerms}
SearchScopes: HKCU - {77D1CA7D-336C-437E-8F96-680E2428975F} URL = https://search.yahoo...&p={searchTerms}
SearchScopes: HKCU - {92B5EDEB-7FCF-47D9-A390-71E96B84E724} URL = http://search.yahoo....rms}&fr=chr-att
SearchScopes: HKCU - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = http://dts.search-re...q={searchTerms}
BHO: No Name -> {02478D38-C3F9-4efb-9B51-7695ECA05670} -> No File
BHO: No Name -> {D40C654D-7C51-4EB3-95B2-1E23905C2A2D} -> No File
S2 671c50b0; "C:\Windows\system32\rundll32.exe" "c:\progra~2\browse~1\BrowserSystemEnahncerSvc.dll",service
c:\progra~2\browse~1
2014-11-14 19:42 - 2014-11-14 19:42 - 00399224 _____ (Premium Installer ) C:\Users\Toni.Ron-PC\Downloads\setup (1).exe
2014-11-14 19:36 - 2014-11-14 19:36 - 00399224 _____ (Premium Installer ) C:\Users\Toni.Ron-PC\Downloads\setup.exe
2014-11-14 17:25 - 2014-11-14 17:25 - 00000000 ____D () C:\Users\Default\AppData\Roaming\TuneUp Software
2014-11-14 17:25 - 2014-11-14 17:25 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\TuneUp Software
2014-10-27 20:08 - 2014-10-27 20:09 - 00000000 ____D () C:\Users\Toni.Ron-PC\AppData\Local\{52C980EF-72E7-485E-BDB5-2B4588EDE283}
2014-10-20 06:36 - 2014-10-20 06:36 - 00000000 ____D () C:\Program Files\webSaver
2014-10-20 06:35 - 2014-10-20 06:35 - 00000000 ____D () C:\Program Files\sAVer box
2014-10-20 06:35 - 2014-10-20 06:35 - 00000000 ____D () C:\Program Files\saiviingetoyoU
2014-10-17 01:58 - 2014-10-20 07:16 - 00000000 ____D () C:\ProgramData\saiviingetoyoU
2014-11-09 21:38 - 2014-07-16 22:04 - 00000000 ____D () C:\Program Files\Optimizer Pro
2014-10-20 07:16 - 2014-10-07 07:59 - 00000000 ____D () C:\ProgramData\sAVer box
2014-10-20 07:16 - 2014-08-07 20:02 - 00000000 ____D () C:\ProgramData\webSaver
Folder: C:\ProgramData\935d36f68bd5f941
C:\Users\Toni.Ron-PC\CTX.DAT
CustomCLSID: HKU\S-1-5-21-4106215785-1409883783-339786315-1001_Classes\CLSID\{035FBE31-3755-450A-A775-5E6BBD43D344}\InprocServer32 -> C:\Users\Toni.Ron-PC\AppData\Local\Google\Update\1.3.21.135\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-4106215785-1409883783-339786315-1001_Classes\CLSID\{355EC88A-02E2-4547-9DEE-F87426484BD1}\InprocServer32 -> C:\Users\Toni.Ron-PC\AppData\Local\Google\Update\1.3.23.9\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-4106215785-1409883783-339786315-1001_Classes\CLSID\{62A0D750-DED9-448C-B693-406B34BB0892}\InprocServer32 -> C:\Users\Toni.Ron-PC\AppData\Local\Google\Update\1.3.21.145\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-4106215785-1409883783-339786315-1001_Classes\CLSID\{634059C0-D264-4B2C-AE80-F73E48D33E5B}\InprocServer32 -> C:\Users\Toni.Ron-PC\AppData\Local\Google\Update\1.3.21.123\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-4106215785-1409883783-339786315-1001_Classes\CLSID\{6D7374DE-63AA-473C-8C02-60D9CDCD84C5}\InprocServer32 -> C:\Users\Toni.Ron-PC\AppData\Local\Google\Update\1.3.21.153\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-4106215785-1409883783-339786315-1001_Classes\CLSID\{A45426FB-E444-42B2-AA56-419F8FBEEC61}\InprocServer32 -> C:\Users\Toni.Ron-PC\AppData\Local\Google\Update\1.3.22.3\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-4106215785-1409883783-339786315-1001_Classes\CLSID\{A54D478D-4F70-4F72-9A74-17C9986E35AB}\InprocServer32 -> C:\Users\Toni.Ron-PC\AppData\Local\Google\Update\1.3.21.165\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-4106215785-1409883783-339786315-1001_Classes\CLSID\{C5A2122B-A05B-4FD8-AE49-91990AE10998}\InprocServer32 -> C:\Users\Toni.Ron-PC\AppData\Local\Google\Update\1.3.21.115\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-4106215785-1409883783-339786315-1001_Classes\CLSID\{EB06378B-ABB6-4B3C-9B40-D488DD8A6E93}\InprocServer32 -> C:\Users\Toni.Ron-PC\AppData\Local\Google\Update\1.3.22.5\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-4106215785-1409883783-339786315-1001_Classes\CLSID\{FB994D36-B312-46CE-A40B-CF63980641F9}\InprocServer32 -> C:\Users\Toni.Ron-PC\AppData\Local\Google\Update\1.3.21.111\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-4106215785-1409883783-339786315-1001_Classes\CLSID\{FE498BAB-CB4C-4F88-AC3F-3641AAAF5E9E}\InprocServer32 -> C:\Users\Toni.Ron-PC\AppData\Local\Google\Update\1.3.24.7\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-4106215785-1409883783-339786315-1002_Classes\CLSID\{22181302-A8A6-4F84-A541-E5CBFC70CC43}\localserver32 -> "C:\Users\Toni.Ron-PC\AppData\Local\Google\Update\1.3.21.111\GoogleUpdateOnDemand.exe" No File
CustomCLSID: HKU\S-1-5-21-4106215785-1409883783-339786315-1002_Classes\CLSID\{2F0E2680-9FF5-43C0-B76E-114A56E93598}\localserver32 -> "C:\Users\Toni.Ron-PC\AppData\Local\Google\Update\1.3.21.111\GoogleUpdateOnDemand.exe" No File
CustomCLSID: HKU\S-1-5-21-4106215785-1409883783-339786315-1002_Classes\CLSID\{51F9E8EF-59D7-475B-A106-C7EA6F30C119}\localserver32 -> "C:\Users\Toni.Ron-PC\AppData\Local\Google\Update\1.3.21.111\GoogleUpdateOnDemand.exe" No File
CustomCLSID: HKU\S-1-5-21-4106215785-1409883783-339786315-1002_Classes\CLSID\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}\InprocServer32 -> C:\Users\UpdatusUser\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
CustomCLSID: HKU\S-1-5-21-4106215785-1409883783-339786315-1002_Classes\CLSID\{C442AC41-9200-4770-8CC0-7CDB4F245C55}\InprocServer32 -> C:\Users\UpdatusUser\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
CustomCLSID: HKU\S-1-5-21-4106215785-1409883783-339786315-1002_Classes\CLSID\{E67BE843-BBBE-4484-95FB-05271AE86750}\localserver32 -> "C:\Users\Toni.Ron-PC\AppData\Local\Google\Update\1.3.21.111\GoogleUpdateOnDemand.exe" No File
CustomCLSID: HKU\S-1-5-21-4106215785-1409883783-339786315-1002_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\UpdatusUser\AppData\Local\Google\Update\1.3.21.111\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-4106215785-1409883783-339786315-1002_Classes\CLSID\{FB994D36-B312-46CE-A40B-CF63980641F9}\InprocServer32 -> C:\Users\UpdatusUser\AppData\Local\Google\Update\1.3.21.111\psuser.dll No File
Task: {69E07F76-8F46-4432-BB36-940F31A49E71} - System32\Tasks\Optimizer Pro Schedule => C:\Program Files\Optimizer Pro\OptProLauncher.exe <==== ATTENTION
CMD: ipconfig /flushdns
CMD: netsh winsock reset all
CMD: netsh int ipv4 reset
CMD: netsh int ipv6 reset
EmptyTemp:
end
*****************

"HKU\S-1-5-21-4106215785-1409883783-339786315-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\S-1-5-21-4106215785-1409883783-339786315-1001" => Key not found.
"HKU\S-1-5-21-4106215785-1409883783-339786315-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{834e473f-0175-11e4-88e1-d48564132670}" => Key deleted successfully.
"HKCR\CLSID\{834e473f-0175-11e4-88e1-d48564132670}" => Key not found.
"HKU\S-1-5-21-4106215785-1409883783-339786315-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c07cff79-55d7-11e4-8930-d48564132670} - E:\windows\AutoRun.exe {430A8AE3-8898-4DAB-8C5B-5E8ADA7D571E} 3.0.0.02 VID_19D2&PID_0358 {9B00E99F-83A4-40d4-B987-7EB04F722BB7}" => Key not found.
"HKCR\CLSID\{c07cff79-55d7-11e4-8930-d48564132670} - E:\windows\AutoRun.exe {430A8AE3-8898-4DAB-8C5B-5E8ADA7D571E} 3.0.0.02 VID_19D2&PID_0358 {9B00E99F-83A4-40d4-B987-7EB04F722BB7}" => Key not found.
"HKLM\SOFTWARE\Policies\Google" => Key deleted successfully.
"HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}" => Key deleted successfully.
"HKCR\CLSID\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}" => Key not found.
"HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{77D1CA7D-336C-437E-8F96-680E2428975F}" => Key deleted successfully.
"HKCR\CLSID\{77D1CA7D-336C-437E-8F96-680E2428975F}" => Key not found.
"HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{92B5EDEB-7FCF-47D9-A390-71E96B84E724}" => Key deleted successfully.
"HKCR\CLSID\{92B5EDEB-7FCF-47D9-A390-71E96B84E724}" => Key not found.
"HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}" => Key deleted successfully.
"HKCR\CLSID\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}" => Key not found.
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}" => Key deleted successfully.
"HKCR\CLSID\{02478D38-C3F9-4efb-9B51-7695ECA05670}" => Key not found.
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D40C654D-7C51-4EB3-95B2-1E23905C2A2D}" => Key deleted successfully.
"HKCR\CLSID\{D40C654D-7C51-4EB3-95B2-1E23905C2A2D}" => Key not found.
671c50b0 => Service deleted successfully.
"c:\progra~2\browse~1" => File/Directory not found.
C:\Users\Toni.Ron-PC\Downloads\setup (1).exe => Moved successfully.
C:\Users\Toni.Ron-PC\Downloads\setup.exe => Moved successfully.
C:\Users\Default\AppData\Roaming\TuneUp Software => Moved successfully.
"C:\Users\Default User\AppData\Roaming\TuneUp Software" => File/Directory not found.
C:\Users\Toni.Ron-PC\AppData\Local\{52C980EF-72E7-485E-BDB5-2B4588EDE283} => Moved successfully.
C:\Program Files\webSaver => Moved successfully.
C:\Program Files\sAVer box => Moved successfully.
C:\Program Files\saiviingetoyoU => Moved successfully.
C:\ProgramData\saiviingetoyoU => Moved successfully.
C:\Program Files\Optimizer Pro => Moved successfully.
C:\ProgramData\sAVer box => Moved successfully.
C:\ProgramData\webSaver => Moved successfully.

========================= Folder: C:\ProgramData\935d36f68bd5f941 ========================

2014-10-20 06:36 - 2014-10-20 06:36 - 0002460 _____ () C:\ProgramData\935d36f68bd5f941\{5CDF2354-26AF-2DBC-1012-44FEDFCC75BB}.20141020073653
2014-10-20 06:35 - 2014-10-20 06:35 - 0002486 _____ () C:\ProgramData\935d36f68bd5f941\{614925F9-841A-53FE-A28F-DC30FA07239B}.20141020073520
2014-10-20 06:35 - 2014-10-20 06:35 - 0002486 _____ () C:\ProgramData\935d36f68bd5f941\{70BD2558-27DA-8B02-02D0-D8704ECD2EDF}.20141020073525
2014-10-20 06:35 - 2014-10-20 06:35 - 0002486 _____ () C:\ProgramData\935d36f68bd5f941\{A2616871-3463-BCEE-5AFA-73773317A381}.20141020073509
2014-10-20 06:35 - 2014-10-20 06:35 - 0002486 _____ () C:\ProgramData\935d36f68bd5f941\{CA8C94BE-9F47-1B2E-90F8-D8C07119BD96}.20141020073515
2014-09-21 15:13 - 2014-09-21 15:13 - 0000164 _____ () C:\ProgramData\935d36f68bd5f941\0cce5965ff17cebed14a25938d082f8d.ini
2014-09-21 15:14 - 2014-09-21 15:14 - 0000506 _____ () C:\ProgramData\935d36f68bd5f941\136b7ecfc5ec71fad14a25938d082f8d.ini
2014-10-17 01:58 - 2014-10-17 01:58 - 0000161 _____ () C:\ProgramData\935d36f68bd5f941\1bb7f0e90631ad50d14a25938d082f8d.ini
2014-09-21 15:14 - 2014-09-21 15:14 - 0000368 _____ () C:\ProgramData\935d36f68bd5f941\22affb673f9fac70d14a25938d082f8d.ini
2014-08-07 20:02 - 2014-08-07 20:02 - 0000504 _____ () C:\ProgramData\935d36f68bd5f941\34e2e82387c90a76d14a25938d082f8d.ini
2014-08-07 20:02 - 2014-08-07 20:02 - 0000373 _____ () C:\ProgramData\935d36f68bd5f941\391d8035b5bee621d14a25938d082f8d.ini
2014-09-02 20:38 - 2014-09-02 20:38 - 0000162 _____ () C:\ProgramData\935d36f68bd5f941\3d289782c33f5626d14a25938d082f8d.ini
2014-10-07 08:00 - 2014-10-07 08:00 - 0000504 _____ () C:\ProgramData\935d36f68bd5f941\5f2014ba7c14068fd14a25938d082f8d.ini
2014-10-17 01:58 - 2014-10-17 01:58 - 0000369 _____ () C:\ProgramData\935d36f68bd5f941\6c691faf49e7ea54d14a25938d082f8d.ini
2014-10-17 01:58 - 2014-10-17 01:58 - 0000513 _____ () C:\ProgramData\935d36f68bd5f941\70c836b690445aecd14a25938d082f8d.ini
2014-10-07 08:00 - 2014-10-07 08:00 - 0000366 _____ () C:\ProgramData\935d36f68bd5f941\72fd14ba52a386cfd14a25938d082f8d.ini
2014-09-02 20:38 - 2014-09-02 20:38 - 0000365 _____ () C:\ProgramData\935d36f68bd5f941\85545f1f0ca86049d14a25938d082f8d.ini
2014-09-02 20:38 - 2014-09-02 20:38 - 0000504 _____ () C:\ProgramData\935d36f68bd5f941\896afcd2047681a7d14a25938d082f8d.ini
2014-08-07 20:02 - 2014-08-07 20:02 - 0000165 _____ () C:\ProgramData\935d36f68bd5f941\b6a46afacac9d2f2d14a25938d082f8d.ini
2014-10-07 08:00 - 2014-10-07 08:00 - 0000161 _____ () C:\ProgramData\935d36f68bd5f941\b9a553ecd277599ed14a25938d082f8d.ini

====== End of Folder: ======

C:\Users\Toni.Ron-PC\CTX.DAT => Moved successfully.
"HKU\S-1-5-21-4106215785-1409883783-339786315-1001_Classes\CLSID\{035FBE31-3755-450A-A775-5E6BBD43D344}" => Key deleted successfully.
"HKU\S-1-5-21-4106215785-1409883783-339786315-1001_Classes\CLSID\{355EC88A-02E2-4547-9DEE-F87426484BD1}" => Key deleted successfully.
"HKU\S-1-5-21-4106215785-1409883783-339786315-1001_Classes\CLSID\{62A0D750-DED9-448C-B693-406B34BB0892}" => Key deleted successfully.
"HKU\S-1-5-21-4106215785-1409883783-339786315-1001_Classes\CLSID\{634059C0-D264-4B2C-AE80-F73E48D33E5B}" => Key deleted successfully.
"HKU\S-1-5-21-4106215785-1409883783-339786315-1001_Classes\CLSID\{6D7374DE-63AA-473C-8C02-60D9CDCD84C5}" => Key deleted successfully.
"HKU\S-1-5-21-4106215785-1409883783-339786315-1001_Classes\CLSID\{A45426FB-E444-42B2-AA56-419F8FBEEC61}" => Key deleted successfully.
"HKU\S-1-5-21-4106215785-1409883783-339786315-1001_Classes\CLSID\{A54D478D-4F70-4F72-9A74-17C9986E35AB}" => Key deleted successfully.
"HKU\S-1-5-21-4106215785-1409883783-339786315-1001_Classes\CLSID\{C5A2122B-A05B-4FD8-AE49-91990AE10998}" => Key deleted successfully.
"HKU\S-1-5-21-4106215785-1409883783-339786315-1001_Classes\CLSID\{EB06378B-ABB6-4B3C-9B40-D488DD8A6E93}" => Key deleted successfully.
"HKU\S-1-5-21-4106215785-1409883783-339786315-1001_Classes\CLSID\{FB994D36-B312-46CE-A40B-CF63980641F9}" => Key deleted successfully.
"HKU\S-1-5-21-4106215785-1409883783-339786315-1001_Classes\CLSID\{FE498BAB-CB4C-4F88-AC3F-3641AAAF5E9E}" => Key deleted successfully.
"HKU\S-1-5-21-4106215785-1409883783-339786315-1002_Classes\CLSID\{22181302-A8A6-4F84-A541-E5CBFC70CC43}" => Key deleted successfully.
"HKU\S-1-5-21-4106215785-1409883783-339786315-1002_Classes\CLSID\{2F0E2680-9FF5-43C0-B76E-114A56E93598}" => Key deleted successfully.
"HKU\S-1-5-21-4106215785-1409883783-339786315-1002_Classes\CLSID\{51F9E8EF-59D7-475B-A106-C7EA6F30C119}" => Key deleted successfully.
"HKU\S-1-5-21-4106215785-1409883783-339786315-1002_Classes\CLSID\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}" => Key deleted successfully.
"HKU\S-1-5-21-4106215785-1409883783-339786315-1002_Classes\CLSID\{C442AC41-9200-4770-8CC0-7CDB4F245C55}" => Key deleted successfully.
"HKU\S-1-5-21-4106215785-1409883783-339786315-1002_Classes\CLSID\{E67BE843-BBBE-4484-95FB-05271AE86750}" => Key deleted successfully.
"HKU\S-1-5-21-4106215785-1409883783-339786315-1002_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}" => Key deleted successfully.
"HKU\S-1-5-21-4106215785-1409883783-339786315-1002_Classes\CLSID\{FB994D36-B312-46CE-A40B-CF63980641F9}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{69E07F76-8F46-4432-BB36-940F31A49E71}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{69E07F76-8F46-4432-BB36-940F31A49E71}" => Key deleted successfully.
C:\Windows\System32\Tasks\Optimizer Pro Schedule => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Optimizer Pro Schedule" => Key deleted successfully.

========= ipconfig /flushdns =========


Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

========= End of CMD: =========


========= netsh winsock reset all =========


Sucessfully reset the Winsock Catalog.
You must restart the computer in order to complete the reset.


========= End of CMD: =========


========= netsh int ipv4 reset =========

Reseting Global, OK!
Reseting Interface, OK!
Restart the computer to complete this action.


========= End of CMD: =========


========= netsh int ipv6 reset =========

Reseting Interface, OK!
Restart the computer to complete this action.


========= End of CMD: =========

EmptyTemp: => Removed 1.6 GB temporary data.


The system needed a reboot.

==== End of Fixlog ====

#6 tonilo

tonilo

    Authentic Member

  • Authentic Member
  • PipPip
  • 53 posts

Posted 16 November 2014 - 09:30 PM

I'm on step 3 Adwcleaner and all of these have a checkmark. I take it I should clean all of them? I have no idea.

# AdwCleaner v4.101 - Report created 16/11/2014 at 21:04:40
# Updated 09/11/2014 by Xplode
# Database : 2014-11-16.1 [Live]
# Operating System : Windows 7 Professional Service Pack 1 (32 bits)
# Username : Toni - TONY-PC
# Running from : C:\Users\Toni.Ron-PC\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CEYPG02S\AdwCleaner.exe
# Option : Scan

***** [ Services ] *****


***** [ Files / Folders ] *****

Folder Found : C:\ProgramData\935d36f68bd5f941

***** [ Scheduled Tasks ] *****


***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Found : HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}
Key Found : HKCU\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}
Key Found : HKCU\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}
Key Found : HKCU\Software\AppDataLow\Software\searchqutoolbar
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{12D80ADE-14C8-72D6-0249-54B536152134}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{4C2A4845-843F-F37D-E72D-C0CF574923BE}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D40C654D-7C51-4EB3-95B2-1E23905C2A2D}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{DD9213C7-93F6-64AB-8138-1A4A23275FA6}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{12D80ADE-14C8-72D6-0249-54B536152134}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{4C2A4845-843F-F37D-E72D-C0CF574923BE}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D40C654D-7C51-4EB3-95B2-1E23905C2A2D}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DD9213C7-93F6-64AB-8138-1A4A23275FA6}
Key Found : HKCU\Software\Optimizer Pro
Key Found : HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}
Key Found : HKLM\SOFTWARE\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
Key Found : HKLM\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}
Key Found : HKLM\SOFTWARE\{6791A2F3-FC80-475C-A002-C014AF797E9C}
Key Found : HKLM\SOFTWARE\Classes\Applications\ilividsetup.exe
Key Found : HKLM\SOFTWARE\Classes\Applications\ilividsetupv1.exe
Key Found : HKLM\SOFTWARE\Classes\CLSID\{058F0E48-61CA-4964-9FBA-1978A1BB060D}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{058F0E48-61CA-4964-9FBA-1978A1BB060D}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{12D80ADE-14C8-72D6-0249-54B536152134}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{18F33C35-8EF2-40D7-8BA4-932B0121B472}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{18F33C35-8EF2-40D7-8BA4-932B0121B472}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{4C2A4845-843F-F37D-E72D-C0CF574923BE}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{923E5E34-AD44-58BE-D73B-431A21F354CA}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{DD9213C7-93F6-64AB-8138-1A4A23275FA6}
Key Found : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
Key Found : HKLM\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}
Key Found : HKLM\SOFTWARE\Classes\protector_dll.protectorbho
Key Found : HKLM\SOFTWARE\Classes\protector_dll.protectorbho.1
Key Found : HKLM\SOFTWARE\Classes\saaVinshaoop.saaVinshaoop
Key Found : HKLM\SOFTWARE\Classes\saaVinshaoop.saaVinshaoop.2.3
Key Found : HKLM\SOFTWARE\Classes\savvingtoyoou.savvingtoyoou
Key Found : HKLM\SOFTWARE\Classes\savvingtoyoou.savvingtoyoou.2.1
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}
Key Found : HKLM\SOFTWARE\Classes\weBsaver.weBsaver
Key Found : HKLM\SOFTWARE\Classes\weBsaver.weBsaver.6.2
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{D40C654D-7C51-4EB3-95B2-1E23905C2A2D}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{12D80ADE-14C8-72D6-0249-54B536152134}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{4C2A4845-843F-F37D-E72D-C0CF574923BE}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{923E5E34-AD44-58BE-D73B-431A21F354CA}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{DD9213C7-93F6-64AB-8138-1A4A23275FA6}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{614925F9-841A-53FE-A28F-DC30FA07239B}

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.17420


-\\ Google Chrome v


*************************

AdwCleaner[R0].txt - [4695 octets] - [16/11/2014 21:04:40]

########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [4755 octets] ##########

#7 LiquidTension

LiquidTension

    SuperMember

  • Retired Classroom Teacher
  • 2,566 posts

Posted 16 November 2014 - 09:34 PM

Yes, that's fine Toni. 

 

Leave everything checked, and click Clean. 


50QfLth.png

 

Would you like to help others with malware removal? Join our Classroom and learn how!

#8 tonilo

tonilo

    Authentic Member

  • Authentic Member
  • PipPip
  • 53 posts

Posted 16 November 2014 - 10:06 PM

I went ahead and cleaned it in ADW.  Sorry I've not answered in the order you requested.  I removed AVG anti-virus.  Browsers came back just fine without having to use my backup.  Here are the ADW and JRT txt.

 

# AdwCleaner v4.101 - Report created 16/11/2014 at 21:45:42
# Updated 09/11/2014 by Xplode
# Database : 2014-11-16.1 [Live]
# Operating System : Windows 7 Professional Service Pack 1 (32 bits)
# Username : Toni - TONY-PC
# Running from : C:\Users\Toni.Ron-PC\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CEYPG02S\AdwCleaner.exe
# Option : Clean

***** [ Services ] *****

***** [ Files / Folders ] *****

Folder Deleted : C:\ProgramData\935d36f68bd5f941

***** [ Scheduled Tasks ] *****

***** [ Shortcuts ] *****

***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Classes\Applications\ilividsetup.exe
Key Deleted : HKLM\SOFTWARE\Classes\Applications\ilividsetupv1.exe
Key Deleted : HKLM\SOFTWARE\Classes\protector_dll.protectorbho
Key Deleted : HKLM\SOFTWARE\Classes\protector_dll.protectorbho.1
Key Deleted : HKLM\SOFTWARE\Classes\weBsaver.weBsaver
Key Deleted : HKLM\SOFTWARE\Classes\weBsaver.weBsaver.6.2
Key Deleted : HKLM\SOFTWARE\Classes\saaVinshaoop.saaVinshaoop
Key Deleted : HKLM\SOFTWARE\Classes\saaVinshaoop.saaVinshaoop.2.3
Key Deleted : HKLM\SOFTWARE\Classes\savvingtoyoou.savvingtoyoou
Key Deleted : HKLM\SOFTWARE\Classes\savvingtoyoou.savvingtoyoou.2.1
Key Deleted : HKCU\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{058F0E48-61CA-4964-9FBA-1978A1BB060D}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{18F33C35-8EF2-40D7-8BA4-932B0121B472}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{12D80ADE-14C8-72D6-0249-54B536152134}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{4C2A4845-843F-F37D-E72D-C0CF574923BE}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{923E5E34-AD44-58BE-D73B-431A21F354CA}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{DD9213C7-93F6-64AB-8138-1A4A23275FA6}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D40C654D-7C51-4EB3-95B2-1E23905C2A2D}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{12D80ADE-14C8-72D6-0249-54B536152134}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{4C2A4845-843F-F37D-E72D-C0CF574923BE}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DD9213C7-93F6-64AB-8138-1A4A23275FA6}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D40C654D-7C51-4EB3-95B2-1E23905C2A2D}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{12D80ADE-14C8-72D6-0249-54B536152134}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{4C2A4845-843F-F37D-E72D-C0CF574923BE}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{DD9213C7-93F6-64AB-8138-1A4A23275FA6}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{12D80ADE-14C8-72D6-0249-54B536152134}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{4C2A4845-843F-F37D-E72D-C0CF574923BE}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{923E5E34-AD44-58BE-D73B-431A21F354CA}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{DD9213C7-93F6-64AB-8138-1A4A23275FA6}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{D40C654D-7C51-4EB3-95B2-1E23905C2A2D}
Key Deleted : HKCU\Software\Optimizer Pro
Key Deleted : HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}
Key Deleted : HKCU\Software\AppDataLow\Software\searchqutoolbar
Key Deleted : HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}
Key Deleted : HKLM\SOFTWARE\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
Key Deleted : HKLM\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}
Key Deleted : HKLM\SOFTWARE\{6791A2F3-FC80-475C-A002-C014AF797E9C}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{614925F9-841A-53FE-A28F-DC30FA07239B}

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.17420

-\\ Google Chrome v

*************************

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.3.9 (11.15.2014:2)
OS: Windows 7 Professional x86
Ran by Toni on Sun 11/16/2014 at 21:52:08.39
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

~~~ Services

 

~~~ Registry Values

 

~~~ Registry Keys

 

~~~ Files

Successfully deleted: [File] "C:\Users\Toni.Ron-PC\appdata\local\google\chrome\user data\default\local storage\http_www.ask.com_0.localstorage"
Successfully deleted: [File] "C:\Users\Toni.Ron-PC\appdata\local\google\chrome\user data\default\local storage\http_www.azlyrics.com_0.localstorage"
Successfully deleted: [File] "C:\Users\Toni.Ron-PC\appdata\local\google\chrome\user data\default\local storage\http_www.superfish.com_0.localstorage"

 

~~~ Folders

Successfully deleted: [Folder] "C:\Users\Toni.Ron-PC\Local Settings\Application Data\ilivid player"
Successfully deleted: [Folder] "C:\Users\Toni.Ron-PC\documents\optimizer pro"
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{01764BCA-C5BF-4FB0-9E46-DB3BFAA18616}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{0433C2DF-0C01-4E7B-8588-73AD7EE45258}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{050A436B-7719-4630-9D33-6A1476546005}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{089CEB60-077E-40E8-A51E-E8596A5EF5B6}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{09248E92-4D32-463B-A6AD-C9AB6A607683}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{0BA99B48-D043-4C6F-9B73-D3DE6B9A37DE}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{0F4AF93F-0AF8-480D-94F2-153DA9BCDBB4}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{105C54FF-E23E-4831-A916-0A06E0B4A668}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{11537417-1901-47E5-B1C6-DAB47CCAF8B2}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{127D2F6C-2DA5-4F99-ADEE-81B279956EAF}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{12E563AD-C1D6-49EE-ACCC-B079931FE03F}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{136C3715-3196-4D05-B0AB-6C9444A800D9}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{15C54D4A-62D5-45B8-8764-7A8D90872F27}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{15EEEE4E-8039-4299-B6A9-0E7DB3CE5447}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{1AC0D3B1-1F2A-4C82-ABB7-6D6FB2E45EFC}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{1C4714F2-A032-42C5-8D96-1C3262F40886}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{200B87FB-061B-4017-9FCD-6B1609198C25}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{2827B2A8-285D-4538-9FEF-D6FC70F80E70}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{28EEBFF3-ECF6-487B-B3F1-36C629402559}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{2A3FD7F3-D3CE-4C1B-94C5-8E621D661DE2}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{2BD52CDD-3A09-4054-A6B8-C78F9F413D48}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{32138417-D053-4C72-83D1-FF65831F9792}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{3229698C-47A2-463A-9845-42597E933FD3}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{355FEF17-BBC3-4781-A4BB-14E51DFB7743}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{3EF088D6-14FE-4B0B-AACE-43380B88D4B1}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{43C2D3DA-0C83-4C41-932A-D683F451EDAE}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{46C3B396-7406-4C26-AAA0-B810CAE72392}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{493167B7-B067-41D5-8689-454EDB9F6698}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{497FB733-CBB6-4F6C-AC93-D70F463E3D4F}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{4B938F78-192A-4CEF-99AE-98074860D90F}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{4EB19A16-C9AC-4414-A863-B7E33B589D1D}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{4FB2B42B-62E8-4F29-A6A5-837F4C17011E}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{50037F67-3A4E-4D0A-9109-6396B2F53931}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{52D747F8-5414-444F-9727-A42E66CCB83D}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{549409BB-E53E-4F7D-AA91-FF7050488C6D}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{571C3F7A-CC2D-47E5-94A9-BC8A11A2CABA}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{59455629-16F0-4B3C-86AB-55F92F050B26}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{5A9D8201-F85A-4D47-9F6F-8F63C908C918}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{5AC6916E-FB2C-4F2D-885E-6D441F7A198C}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{5FE30781-35C4-454D-91AE-56BBE5360FBC}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{626000DA-B7C0-49F6-9E9D-16F19ADBDEF3}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{63E3AC8B-0D0D-44D9-96F4-DE9639DCB392}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{66BAAD87-BE50-4DFA-A836-93F540576AB7}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{69AA2967-39D4-4BA3-B33E-9956F198A76D}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{6BE01DA3-1C28-4596-9D07-EB20643E53D0}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{6BFA57B3-7BD8-4BE7-A033-54500CDCC0E4}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{6D08E796-EFD2-46D5-8369-7C664EA5F39F}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{6ED1807F-B9E5-4942-B0C9-D8EC56583399}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{759C5B2C-11FC-49BB-80A9-D5C38E0C9F9D}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{7646DB60-1DBA-40C3-B1D9-3B1D63827601}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{76758909-A9C3-44DB-9FA2-45C79CF6EDA9}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{779E28AE-C7F4-4522-96BB-5BDB5D1778F9}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{7906F419-F22F-478F-B8FD-AC5896894F08}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{7C3C0907-B238-4C98-8662-71945B2C38A7}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{7DD40DB6-406E-4F53-84BB-ED6E3CD7ECB8}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{7E41393E-6D5A-474E-8552-0B694BC189CD}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{7F5B5FF3-65C1-4195-8B31-4C166BE3445A}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{816DC17E-F4B2-4823-A395-3DF1961B1F26}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{82E52956-83DC-47C3-B13F-E3437EB790D8}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{8420DC59-617C-4A9C-922B-5F246F10AAE8}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{869EA23D-78AD-43CC-BA82-C0CF2CD359B2}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{88D9B7EF-1BDC-45A5-BBF5-80C88D402963}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{8AA7A6D1-2D46-41C0-B1DC-85DE94F74C85}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{8B48F145-8AF2-4FE1-8FC4-18F8529E8A36}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{8B49ED17-CB6D-41F7-B050-0182E79345CA}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{8FF2602B-9770-482D-A45D-19D351F6B9E6}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{900A9A41-3662-4D94-A04A-37FE3C352229}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{91A4D474-6BC4-4EF1-B6ED-1E2521F50EF6}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{9489BD5E-CC9D-417D-B04C-9CDF65A1DB98}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{9672E4DA-4EF4-4081-A071-A62FE32E2447}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{96B40648-4468-42BF-824D-2E7DD2C254A1}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{9885D23C-89BE-43BB-A027-9E1FD0BD35AF}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{98B796A4-E26F-47D1-AEDC-2996A5B67985}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{993948C7-1416-4A18-9B82-BCC7DE00E8BD}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{9A09DE56-6A1E-4256-AD32-3C7A491DE3E7}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{9A1D10F4-5B2C-4790-B161-534D8CFCF24E}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{9D9E5205-C242-4B9E-AE55-5E42D304E257}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{A09F1E52-A397-4EFD-9C38-A4ED85C2F426}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{A5579C92-DE28-4378-9E4D-BA522C5387D7}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{AD5B6B18-07D6-4B0B-A1DF-B8B1FB9737E7}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{B1CEDD1A-0078-4E3A-895D-23D7D68216A1}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{B4D5304C-D463-43AA-A963-A58D119FB1EE}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{B78B89E3-B809-4408-9A03-BAFE55AFEEA9}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{BC0B3970-7D1B-492D-9E9E-4C4BF69A0D8B}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{BEC70217-4140-4F6A-9CE5-3575EBDDBEE3}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{C0B9EDE5-6CBE-4AA2-B11A-72C22B9E7626}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{C39AEF4C-8AA7-47DF-915A-6B978BEFF06D}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{C971AD8C-4BD1-43DA-A2D3-537636339F04}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{CB166E34-FA76-48BC-9469-79C13D17E54A}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{CB7B27A4-E9B3-4927-8B42-497277FE2842}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{D1A8F76F-A403-4AC4-BD4E-62F097A7C8BF}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{D29B676D-FA2F-491A-B613-C424BDC2D2D6}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{D5F00465-F5D7-400F-B481-33891F7B35B6}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{D6FD5480-30A6-457E-AF34-8FA548F832A9}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{DB838360-4407-47A6-8B93-119FEC8AF538}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{E4093239-2BC6-4484-936A-102748BDBE40}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{E58E7CFD-2011-4201-A2B0-60FF66995300}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{EBAD9908-55D6-41CA-B9F4-734996063C42}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{EF175F9E-5B22-41E1-AAB4-8CB997BD65F6}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{EFA49B24-E96C-4B6B-835A-D12AA73651FF}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{F2710A34-E1E5-4FAB-BD30-61F84D55FBCD}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{F42619BF-94CF-4081-AB29-E976210D5DA4}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{F58D7D93-0110-49EB-B5F3-F450E2C6007D}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{F5C77A74-9ABB-49B2-8607-B3A5CE7A731F}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{F9153F75-3708-4FE3-90A8-63C05EA62E8B}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{FB883DD1-195C-4946-AE69-0C5BCB27A5CA}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{FB9E47F9-F5CA-4390-8735-5A3AB865D5D9}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{FBC5F17B-3724-4350-A3FF-86F1494AD6A5}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{FD0BEB5D-169F-431E-B9C1-3790D4CD779E}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{FD30A7D8-8292-47C1-A88C-F7CE6890A26C}
Successfully deleted: [Empty Folder] C:\Users\Toni.Ron-PC\appdata\local\{FE9B3C7E-B228-48AD-AB6C-74DF1C3A3006}

 

~~~ Event Viewer Logs were cleared

 

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Sun 11/16/2014 at 21:53:50.15
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

 

It's very late where I live so have to log off till tomorrow night.  Thanks for your help, Adam.
 


#9 LiquidTension

LiquidTension

    SuperMember

  • Retired Classroom Teacher
  • 2,566 posts

Posted 17 November 2014 - 09:47 AM

That's quite alright, Toni. 

 

Please provide an update on your computer. 


50QfLth.png

 

Would you like to help others with malware removal? Join our Classroom and learn how!

#10 tonilo

tonilo

    Authentic Member

  • Authentic Member
  • PipPip
  • 53 posts

Posted 17 November 2014 - 08:59 PM

Adam,  I've played around on Yahoo and did get a popup asking for my e-mail addy to login to some site but I don't know what the site was.  It came up within an article but I was unable to get it to repeat.  Still kinda afraid to login to my e-mail or online accounts.


    Advertisements

Register to Remove

#11 LiquidTension

LiquidTension

    SuperMember

  • Retired Classroom Teacher
  • 2,566 posts

Posted 17 November 2014 - 09:08 PM

Hi Toni, 
 
These are the programmes I'd like you to run next. We'll review the situation afterwards. 
 
STEP 1
GfiJrQ9.png Malwarebytes Anti-Malware (MBAM)

  • Open Malwarebytes Anti-Malware and click Update Now.
  • Once updated, click the Settings tab, followed by Detection and Protection and tick Scan for rootkits.
  • Click the Scan tab, ensure Threat Scan is checked and click Scan Now.
  • Note: You may see the following message, "Could not load DDA driver". Click Yes, allow your PC to reboot and continue afterwards. 
  • If threats are detected, click the Apply Actions button. You will now be prompted to reboot. Click Yes.
  • Upon completion of the scan (or after the reboot), click the History tab.
  • Click Application Logs and double-click the Scan Log.
  • Click Copy to Clipboard and paste the log in your next reply. 
     

STEP 2
GzlsbnV.png ESET Online Scan
Note: This scan may take a long time to complete. Please do not browse the Internet whilst your Anti-Virus is disabled.

  • Please download ESET Online Scan and save the file to your Desktop.
  • Temporarily disable your anti-virus software. For instructions, please refer to the following link.
  • Double-click esetsmartinstaller_enu.exe to run the programme. 
  • Agree to the EULA by placing a checkmark next to Yes, I accept the Terms of Use. Then click Start.
  • Agree to the Terms of Use once more and click Start. Allow components to download.
  • Place a checkmark next to Enable detection of potentially unwanted applications.
  • Click Hide advanced settings. Place a checkmark next to:
    • Scan archives
    • Scan for potentially unsafe applications
    • Enable Anti-Stealth technology
  • Ensure Remove found threats is unchecked.
  • Click Start.
  • Wait for the scan to finish. Please be patient as this can take some time.
  • Upon completion, click esetListThreats.png. If no threats were found, skip the next two bullet points. 
  • Click esetExport.png and save the file to your Desktop, naming it something such as "MyEsetScan".
  • Push the Back button.
  • Place a checkmark next to xKN1w2nv.png.pagespeed.ic.JWqIaEgZi7.png and click SzOC1p0.png.pagespeed.ce.OWDP45O6oG.png.
  • Re-enable your anti-virus software.
  • Copy the contents of the log and paste in your next reply.
     

STEP 3
xlK5Hdb.png Farbar Recovery Scan Tool (FRST) Scan

  • Right-Click FRST.exe and select AVOiBNU.jpg Run as administrator to run the programme.
  • Click Yes to the disclaimer.
  • Ensure the Addition.txt box is checked.
  • Click the Scan button and let the programme run.
  • Upon completion, click OK, then OK on the Addition.txt pop up screen.
  • Two logs (FRST.txt & Addition.txt) will now be open on your Desktop. Copy the contents of both logs and paste in your next reply. 
     

======================================================
 
STEP 4
pfNZP4A.png Logs
In your next reply please include the following logs. Please be sure to copy and paste the requested logs, as well as provide information on any questions I may have asked.

  • MBAM Scan log
  • ESET Online Scan log
  • FRST.txt
  • Addition.txt

50QfLth.png

 

Would you like to help others with malware removal? Join our Classroom and learn how!

#12 tonilo

tonilo

    Authentic Member

  • Authentic Member
  • PipPip
  • 53 posts

Posted 18 November 2014 - 10:43 PM

Not so good, Adam.  Here are the logs.

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 11/18/2014
Scan Time: 6:12:33 PM
Logfile:
Administrator: Yes

Version: 2.00.3.1025
Malware Database: v2014.11.18.09
Rootkit Database: v2014.11.18.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x86
File System: NTFS
User: Toni

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 413164
Time Elapsed: 17 min, 43 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 0
(No malicious items detected)

Physical Sectors: 0
(No malicious items detected)

(end)

 

 

Now the ESET and by the way, I did not see at all  the following that you told me to check "Hide Advanced Settings, Scan Archives, Scan Unsafe, Enable Anti-Stealth or Uncheck remove threats" so it quarantined or removed all of them all.

 

ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=5287a24706016345b76f67bd021e4fef
# engine=21155
# end=finished
# remove_checked=true
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-11-19 04:22:40
# local_time=2014-11-18 10:22:40 (-0600, Central Standard Time)
# country="United States"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='Microsoft Security Essentials'
# compatibility_mode=5895 16777213 100 100 4097567 110440564 0 0
# scanned=138943
# found=5
# cleaned=5
# scan_time=1712
sh=944D187F9D4ABE7851F642692D4AF13E5128C0B9 ft=1 fh=f14ab541f5561ed1 vn="a variant of Win32/Adware.iBryte.BR application (cleaned by deleting - quarantined)" ac=C fn="C:\FRST\Quarantine\C\Users\Toni.Ron-PC\Downloads\setup (1).exe.xBAD"
sh=959442D528DAE0B5D86BB9F331E2A4E92B3DE9EB ft=1 fh=df5497445cb92417 vn="a variant of Win32/Adware.iBryte.BR application (cleaned by deleting - quarantined)" ac=C fn="C:\FRST\Quarantine\C\Users\Toni.Ron-PC\Downloads\setup.exe.xBAD"
sh=69BACA112E5F46D9C27E14C60BD7E955FF26B631 ft=0 fh=0000000000000000 vn="JS/Chromex.Agent.L trojan (cleaned by deleting - quarantined)" ac=C fn="C:\Users\Toni.Ron-PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\jipdnfibhldikgcjhfnomkfpcebammhp\137\content.js"
sh=CFCCEB58544537DD7E82625B431248BAC6126325 ft=0 fh=0000000000000000 vn="JS/Chromex.Agent.L trojan (cleaned by deleting - quarantined)" ac=C fn="C:\Users\Toni.Ron-PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\oalbpfagfhfkcmklpdanadjpbfdedndn\180\content.js"
sh=E4B3BB5763ACC49D322158221C95BA192854BB61 ft=1 fh=18a64e3c17421b85 vn="Win32/Toolbar.SearchSuite potentially unwanted application (deleted - quarantined)" ac=C fn="C:\Users\Toni.Ron-PC\Pictures\Class reunion 2012\iLividSetup.exe"
 

 

 


#13 tonilo

tonilo

    Authentic Member

  • Authentic Member
  • PipPip
  • 53 posts

Posted 18 November 2014 - 10:54 PM

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 16-11-2014 03
Ran by Toni (administrator) on TONY-PC on 18-11-2014 22:45:29
Running from C:\Users\Toni.Ron-PC\Desktop
Loaded Profiles: Toni & UpdatusUser (Available profiles: Toni & UpdatusUser)
Platform: Microsoft Windows 7 Professional Service Pack 1 (X86) OS Language: English (United States)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Yahoo! Inc.) C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Adobe Systems Incorporated) C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
() C:\Program Files\DivX\DivX Update\DivXUpdate.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Internet Services\iCloudServices.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
(Google Inc.) C:\Users\Toni.Ron-PC\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Toni.Ron-PC\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Toni.Ron-PC\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Toni.Ron-PC\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Toni.Ron-PC\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Toni.Ron-PC\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Toni.Ron-PC\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Toni.Ron-PC\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Toni.Ron-PC\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Toni.Ron-PC\AppData\Local\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [974432 2014-08-22] (Microsoft Corporation)
HKLM\...\Run: [APSDaemon] => C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [43816 2014-07-31] (Apple Inc.)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKLM\...\Run: [BCSSync] => C:\Program Files\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM\...\Run: [DivXMediaServer] => C:\Program Files\DivX\DivX Media Server\DivXMediaServer.exe [455512 2014-05-27] (DivX, LLC)
HKLM\...\Run: [DivXUpdate] => C:\Program Files\DivX\DivX Update\DivXUpdate.exe [1861968 2014-01-09] ()
HKLM\...\Run: [QuickTime Task] => C:\Program Files\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [152392 2014-09-01] (Apple Inc.)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [507776 2014-10-07] (Oracle Corporation)
HKU\S-1-5-21-4106215785-1409883783-339786315-1001\...\Run: [Google Update] => C:\Users\Toni.Ron-PC\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2012-04-06] (Google Inc.)
HKU\S-1-5-21-4106215785-1409883783-339786315-1001\...\Run: [iCloudServices] => C:\Program Files\Common Files\Apple\Internet Services\iCloudServices.exe [43816 2014-08-07] (Apple Inc.)
HKU\S-1-5-21-4106215785-1409883783-339786315-1001\...\Run: [ApplePhotoStreams] => C:\Program Files\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [43816 2014-08-14] (Apple Inc.)
HKU\S-1-5-21-4106215785-1409883783-339786315-1001\...\MountPoints2: E - E:\LaunchU3.exe -a
HKU\S-1-5-21-4106215785-1409883783-339786315-1001\...\MountPoints2: {c07cff79-55d7-11e4-8930-d48564132670} - E:\windows\AutoRun.exe {430A8AE3-8898-4DAB-8C5B-5E8ADA7D571E} 3.0.0.02 VID_19D2&PID_0358 {9B00E99F-83A4-40d4-B987-7EB04F722BB7}

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-4106215785-1409883783-339786315-1001\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
HKU\S-1-5-21-4106215785-1409883783-339786315-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/?ocid=iehp
HKU\S-1-5-21-4106215785-1409883783-339786315-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_25\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Windows Live Messenger Companion Helper -> {9FDDE16B-836F-4806-AB1F-1455CBEFF289} -> C:\Program Files\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_25\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKU\S-1-5-21-4106215785-1409883783-339786315-1001 -> Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} https://fpdownload.m...ash/swflash.cab
Winsock: Catalog5 09 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.254

FireFox:
========
FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @canon.com/MycameraPlugin -> C:\Program Files\Canon\ZoomBrowser EX\Program\NPCIG.dll (CANON INC.)
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files\Java\jre1.8.0_25\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3555.0308 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-4106215785-1409883783-339786315-1001: @tools.google.com/Google Update;version=3 -> C:\Users\Toni.Ron-PC\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll No File

Chrome:
=======
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\Toni.Ron-PC\AppData\Local\Google\Chrome\Application\36.0.1985.125\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Users\Toni.Ron-PC\AppData\Local\Google\Chrome\Application\36.0.1985.125\pdf.dll ()
CHR Plugin: (Shockwave Flash) - C:\Users\Toni.Ron-PC\AppData\Local\Google\Chrome\Application\36.0.1985.125\gcswf32.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (NPCIG.dll) - C:\Program Files\Canon\ZoomBrowser EX\Program\NPCIG.dll (CANON INC.)
CHR Plugin: (Picasa) - C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
CHR Plugin: (Java™ Platform SE 7 U4) - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll No File
CHR Plugin: (Java Deployment Toolkit 7.0.40.255) - C:\Windows\system32\npDeployJava1.dll No File
CHR Plugin: (Windows Live™ Photo Gallery) - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (Google Update) - C:\Users\Toni.Ron-PC\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files\Microsoft Silverlight\4.0.50401.0\npctrl.dll No File
CHR Profile: C:\Users\Toni.Ron-PC\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Toni.Ron-PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-05-25]
CHR Extension: (YouTube) - C:\Users\Toni.Ron-PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-04-06]
CHR Extension: (Google Search) - C:\Users\Toni.Ron-PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-04-06]
CHR Extension: (Facebook Image Zoom and Downloader) - C:\Users\Toni.Ron-PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\edefbbbcggajdncnoingicdckbhngpcj [2014-09-21]
CHR Extension: (fbmemes) - C:\Users\Toni.Ron-PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\hmfcioabbebeebdcfkkbjaajjjffmngn [2014-10-17]
CHR Extension: (rikaikun) - C:\Users\Toni.Ron-PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\jipdnfibhldikgcjhfnomkfpcebammhp [2014-09-02]
CHR Extension: (Anydo Extension) - C:\Users\Toni.Ron-PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\kdadialhpiikehpdeejjeiikopddkjem [2014-10-07]
CHR Extension: (Google Wallet) - C:\Users\Toni.Ron-PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-02]
CHR Extension: (PotatoSmile) - C:\Users\Toni.Ron-PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\oalbpfagfhfkcmklpdanadjpbfdedndn [2014-08-07]
CHR Extension: (Gmail) - C:\Users\Toni.Ron-PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-04-06]

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [654848 2014-08-01] (Macrovision Europe Ltd.) [File not signed]
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [22192 2014-08-22] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [288120 2014-08-22] (Microsoft Corporation)
R2 nvUpdatusService; C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2214504 2011-05-21] (NVIDIA Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 e1kexpress; C:\Windows\System32\DRIVERS\e1k6032.sys [164864 2009-07-13] (Intel Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [231800 2014-07-17] (Microsoft Corporation)
R3 netr28u; C:\Windows\System32\DRIVERS\netr28u.sys [657408 2009-07-13] (Ralink Technology Corp.)

==================== NetSvcs (Whitelisted) ===================


(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-11-18 22:45 - 2014-11-18 22:46 - 00014822 _____ () C:\Users\Toni.Ron-PC\Desktop\FRST.txt
2014-11-18 21:40 - 2014-11-18 21:40 - 00000000 ____D () C:\Program Files\ESET
2014-11-18 21:26 - 2014-11-18 21:26 - 02347384 _____ (ESET) C:\Users\Toni.Ron-PC\Downloads\esetsmartinstaller_enu.exe
2014-11-16 21:53 - 2014-11-16 21:53 - 00013694 _____ () C:\Users\Toni.Ron-PC\Desktop\JRT.txt
2014-11-16 21:52 - 2014-11-16 21:52 - 00000000 ____D () C:\Windows\ERUNT
2014-11-16 21:50 - 2014-11-16 21:51 - 01707532 _____ (Thisisu) C:\Users\Toni.Ron-PC\Downloads\JRT.exe
2014-11-16 21:04 - 2014-11-18 21:25 - 00000000 ____D () C:\AdwCleaner
2014-11-16 19:20 - 2014-11-16 19:21 - 01108992 _____ (Farbar) C:\Users\Toni.Ron-PC\Desktop\FRST.exe
2014-11-16 18:59 - 2014-11-16 18:59 - 00006989 _____ () C:\Users\Toni.Ron-PC\fixlist.txt
2014-11-15 09:13 - 2014-11-15 09:13 - 00000000 __SHD () C:\Users\Toni.Ron-PC\AppData\Local\EmieBrowserModeList
2014-11-14 20:47 - 2014-11-18 22:45 - 00000000 ____D () C:\FRST
2014-11-14 20:41 - 2014-11-14 20:41 - 00002092 _____ () C:\Users\Toni.Ron-PC\Desktop\aswMBR.txt
2014-11-14 20:41 - 2014-11-14 20:41 - 00000512 _____ () C:\Users\Toni.Ron-PC\Desktop\MBR.dat
2014-11-14 20:18 - 2014-11-14 20:20 - 05198336 _____ (AVAST Software) C:\Users\Toni.Ron-PC\Downloads\aswMBR.exe
2014-11-14 17:41 - 2014-10-13 19:50 - 02363904 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-11-14 17:40 - 2014-11-05 11:50 - 00254464 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2014-11-14 17:40 - 2014-11-05 11:50 - 00203776 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-11-14 17:40 - 2014-11-05 11:47 - 00302592 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-11-14 17:40 - 2014-10-17 19:33 - 00571904 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2014-11-14 17:40 - 2014-10-09 18:45 - 02379264 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-11-14 17:40 - 2014-10-02 19:44 - 00475136 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2014-11-14 17:40 - 2014-10-02 19:44 - 00442880 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll
2014-11-14 17:40 - 2014-10-02 19:44 - 00374784 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll
2014-11-14 17:40 - 2014-10-02 19:44 - 00275968 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll
2014-11-14 17:40 - 2014-10-02 19:44 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll
2014-11-14 17:40 - 2014-09-19 03:23 - 00550912 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-11-14 17:40 - 2014-09-19 03:23 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-11-14 17:40 - 2014-09-19 03:23 - 00248832 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-11-14 17:40 - 2014-09-19 03:23 - 00221184 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2014-11-14 17:40 - 2014-09-19 03:23 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-11-14 17:40 - 2014-09-19 03:23 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-11-14 17:40 - 2014-09-19 03:23 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-11-14 17:40 - 2014-08-21 00:26 - 01237504 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-11-14 17:40 - 2014-08-21 00:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2014-11-14 17:40 - 2014-08-11 19:36 - 00701440 _____ (Microsoft Corporation) C:\Windows\system32\IMJP10K.DLL
2014-11-14 17:38 - 2014-10-13 19:56 - 00136632 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2014-11-14 17:38 - 2014-10-13 19:50 - 01059840 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-11-14 17:38 - 2014-10-13 19:50 - 00523776 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll
2014-11-14 17:38 - 2014-10-13 19:47 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2014-11-14 17:38 - 2014-10-13 19:46 - 00681984 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2014-11-14 17:37 - 2014-10-24 19:32 - 00067584 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll
2014-11-14 17:36 - 2014-11-07 13:23 - 00341168 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-11-14 17:36 - 2014-11-05 21:28 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-11-14 17:36 - 2014-11-05 21:28 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-11-14 17:36 - 2014-11-05 21:13 - 00501248 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-11-14 17:36 - 2014-11-05 21:13 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-11-14 17:36 - 2014-11-05 21:12 - 00047616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-11-14 17:36 - 2014-11-05 21:10 - 19781632 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-11-14 17:36 - 2014-11-05 21:10 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-11-14 17:36 - 2014-11-05 21:05 - 02277376 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-11-14 17:36 - 2014-11-05 21:04 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-11-14 17:36 - 2014-11-05 21:03 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-11-14 17:36 - 2014-11-05 21:00 - 00478208 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-11-14 17:36 - 2014-11-05 20:59 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-11-14 17:36 - 2014-11-05 20:59 - 00102912 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-11-14 17:36 - 2014-11-05 20:58 - 00620032 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-11-14 17:36 - 2014-11-05 20:51 - 00667648 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-11-14 17:36 - 2014-11-05 20:48 - 00418304 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-11-14 17:36 - 2014-11-05 20:42 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-11-14 17:36 - 2014-11-05 20:37 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-11-14 17:36 - 2014-11-05 20:36 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-11-14 17:36 - 2014-11-05 20:34 - 00285696 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-11-14 17:36 - 2014-11-05 20:22 - 00688640 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-11-14 17:36 - 2014-11-05 20:22 - 00683008 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-11-14 17:36 - 2014-11-05 20:21 - 04298240 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-11-14 17:36 - 2014-11-05 20:21 - 02051072 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-11-14 17:36 - 2014-11-05 20:20 - 01155072 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-11-14 17:36 - 2014-11-05 20:03 - 12819456 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-11-14 17:36 - 2014-11-05 19:52 - 01892864 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-11-14 17:36 - 2014-11-05 19:48 - 01310208 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-11-14 17:36 - 2014-11-05 19:47 - 00708096 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-11-09 21:08 - 2014-11-09 21:08 - 00000000 ____D () C:\Users\Toni.Ron-PC\AppData\Roaming\AVG2015
2014-11-09 21:06 - 2014-11-16 18:52 - 00000000 ____D () C:\ProgramData\AVG2015
2014-11-09 21:00 - 2014-11-09 21:19 - 00000000 ____D () C:\Users\Toni.Ron-PC\AppData\Local\Avg2015
2014-11-06 19:49 - 2014-11-18 21:24 - 00114904 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-11-06 19:48 - 2014-11-06 19:48 - 00001060 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-11-06 19:48 - 2014-11-06 19:48 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-11-06 19:48 - 2014-11-06 19:48 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware
2014-11-06 19:48 - 2014-10-01 11:11 - 00075480 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-11-06 19:48 - 2014-10-01 11:11 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-11-06 19:48 - 2014-10-01 11:11 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-11-06 19:37 - 2014-11-06 19:41 - 19828376 _____ (Malwarebytes Corporation ) C:\Users\Toni.Ron-PC\Downloads\mbam-setup-2.0.3.1025 (1).exe
2014-11-06 19:34 - 2014-11-06 19:35 - 19828376 _____ (Malwarebytes Corporation ) C:\Users\Toni.Ron-PC\Downloads\mbam-setup-2.0.3.1025.exe
2014-10-20 06:51 - 2014-10-20 06:51 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-10-20 06:31 - 2014-10-20 06:31 - 00000000 ____D () C:\Program Files\Common Files\Java
2014-10-20 06:27 - 2014-10-20 06:31 - 00000000 ____D () C:\ProgramData\Oracle

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-11-18 22:45 - 2012-01-04 15:14 - 01426809 _____ () C:\Windows\WindowsUpdate.log
2014-11-18 22:25 - 2012-04-06 14:48 - 00000918 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4106215785-1409883783-339786315-1001UA.job
2014-11-18 22:24 - 2013-02-18 17:26 - 00000886 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-11-18 22:08 - 2012-04-06 14:46 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-11-18 21:37 - 2012-03-16 09:59 - 00002127 _____ () C:\Windows\epplauncher.mif
2014-11-18 20:24 - 2013-02-18 17:25 - 00000882 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-11-18 20:24 - 2012-04-06 14:48 - 00000866 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4106215785-1409883783-339786315-1001Core.job
2014-11-18 07:13 - 2010-11-20 15:01 - 00782510 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-11-18 06:56 - 2014-10-17 02:30 - 00001904 _____ () C:\Windows\setupact.log
2014-11-16 21:54 - 2009-07-13 22:34 - 00031728 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-11-16 21:54 - 2009-07-13 22:34 - 00031728 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-11-16 21:47 - 2010-11-20 15:48 - 00083364 _____ () C:\Windows\PFRO.log
2014-11-16 21:47 - 2009-07-13 22:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-11-16 20:14 - 2012-03-16 09:44 - 00000000 ____D () C:\Users\Toni.Ron-PC
2014-11-16 18:52 - 2013-12-15 19:57 - 00000000 ____D () C:\Program Files\AVG
2014-11-16 18:52 - 2013-12-15 19:55 - 00000000 ____D () C:\ProgramData\MFAData
2014-11-15 09:13 - 2009-07-13 20:37 - 00000000 ____D () C:\Windows\rescache
2014-11-15 09:12 - 2012-03-16 09:45 - 00109280 _____ () C:\Users\Toni.Ron-PC\AppData\Local\GDIPFONTCACHEV1.DAT
2014-11-15 03:45 - 2009-07-13 20:37 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-11-15 03:38 - 2009-07-13 22:33 - 01747152 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-11-15 03:35 - 2014-05-07 02:00 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-11-15 03:20 - 2012-04-06 14:18 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-11-15 03:11 - 2013-08-13 20:06 - 00000000 ____D () C:\Windows\system32\MRT
2014-11-15 03:02 - 2012-03-16 10:11 - 100445232 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-11-14 18:08 - 2012-04-06 14:46 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-11-14 18:08 - 2012-04-06 14:46 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-11-09 21:51 - 2014-07-17 20:01 - 00000000 ____D () C:\Users\Toni.Ron-PC\Downloads\WinRAR420
2014-11-09 20:59 - 2009-07-13 20:37 - 00000000 ____D () C:\Windows\system32\NDF
2014-10-30 05:24 - 2012-03-16 10:01 - 00229000 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-10-20 07:44 - 2014-06-18 10:55 - 00000000 ____D () C:\Users\Toni.Ron-PC\AppData\Roaming\uTorrent
2014-10-20 06:36 - 2014-07-27 11:49 - 00000000 ____D () C:\Program Files\VideoLAN
2014-10-20 06:36 - 2014-07-20 16:03 - 00000000 ____D () C:\Program Files\WinRAR
2014-10-20 06:29 - 2013-12-07 12:07 - 00000000 ____D () C:\Program Files\Java
2014-10-20 06:27 - 2013-12-07 12:07 - 00272296 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-10-20 06:27 - 2013-12-07 12:07 - 00176552 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-10-20 06:27 - 2013-12-07 12:07 - 00176552 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-10-20 06:27 - 2013-12-07 12:07 - 00096680 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll

Some content of TEMP:
====================
C:\Users\Toni.Ron-PC\AppData\Local\Temp\Quarantine.exe
C:\Users\Toni.Ron-PC\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-11-15 03:04

==================== End Of Log ============================

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 16-11-2014 03
Ran by Toni at 2014-11-18 22:46:21
Running from C:\Users\Toni.Ron-PC\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Microsoft Security Essentials (Enabled - Up to date) {4F35CFC4-45A3-FC37-EF17-759A02E39AB1}
AS: Microsoft Security Essentials (Enabled - Up to date) {F4542E20-6399-F3B9-D5A7-4EE87964D00C}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Flash Player 15 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 15.0.0.223 - Adobe Systems Incorporated)
Adobe Photoshop CS3 (HKLM\...\Adobe_2ac78060bc5856b0c1cf873bb919b58) (Version: 10.0 - Adobe Systems Incorporated)
Adobe Reader X (10.1.12) (HKLM\...\{AC76BA86-7AD7-1033-7B44-AA1000000001}) (Version: 10.1.12 - Adobe Systems Incorporated)
Apple Application Support (HKLM\...\{78002155-F025-4070-85B3-7C0453561701}) (Version: 3.0.6 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{C0CC75CD-F5B7-46AD-B016-17C0F5171718}) (Version: 8.0.0.23 - Apple Inc.)
Apple Software Update (HKLM\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Bonjour (HKLM\...\{79155F2B-9895-49D7-8612-D92580E0DE5B}) (Version: 3.0.0.10 - Apple Inc.)
CANON iMAGE GATEWAY Task for ZoomBrowser EX (HKLM\...\CANON iMAGE GATEWAY Task) (Version: 1.7.0.4 - Canon Inc.)
Canon Internet Library for ZoomBrowser EX (HKLM\...\Canon Internet Library for ZoomBrowser EX) (Version: 1.6.3.9 - Canon Inc.)
Canon MovieEdit Task for ZoomBrowser EX (HKLM\...\MovieEditTask) (Version: 3.0.0.20 - Canon Inc.)
Canon Utilities CameraWindow (HKLM\...\CameraWindowLauncher) (Version: 7.2.0.2 - Canon Inc.)
Canon Utilities CameraWindow DC (HKLM\...\CameraWindowDC) (Version: 7.4.0.9 - Canon Inc.)
Canon Utilities CameraWindow DC_DV 6 for ZoomBrowser EX (HKLM\...\CameraWindowDVC6) (Version: 6.5.0.3 - Canon Inc.)
Canon Utilities MyCamera (HKLM\...\MyCamera) (Version: 7.2.0.4 - Canon Inc.)
Canon Utilities MyCamera DC (HKLM\...\MyCameraDC) (Version: 7.2.0.5 - Canon Inc.)
Canon Utilities RemoteCapture Task for ZoomBrowser EX (HKLM\...\RemoteCaptureTask) (Version: 1.8.0.1 - Canon Inc.)
Canon Utilities ZoomBrowser EX (HKLM\...\ZoomBrowser EX) (Version: 6.3.0.7 - Canon Inc.)
Canon ZoomBrowser EX Memory Card Utility (HKLM\...\ZoomBrowser EX Memory Card Utility) (Version: 1.2.0.9 - Canon Inc.)
D3DX10 (Version: 15.4.2368.0902 - Microsoft) Hidden
DivX Setup (HKLM\...\DivX Setup) (Version: 2.6.3.52 - DivX, LLC)
EPSON Printer Software (HKLM\...\EPSON Printer and Utilities) (Version: - SEIKO EPSON Corporation)
EPSON Scan (HKLM\...\EPSON Scanner) (Version: - )
ESET Online Scanner v3 (HKLM\...\ESET Online Scanner) (Version: - )
Google Chrome (HKU\S-1-5-21-4106215785-1409883783-339786315-1001\...\Google Chrome) (Version: 36.0.1985.125 - Google Inc.)
Google Toolbar for Internet Explorer (HKLM\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.5111.1712 - Google Inc.)
Google Toolbar for Internet Explorer (Version: 1.0.0 - Google Inc.) Hidden
Google Update Helper (Version: 1.3.25.11 - Google Inc.) Hidden
Google+ Auto Backup (HKLM\...\{A50DE037-B5C0-4C8A-8049-B0C576B313D1}) (Version: 1.0.21.81 - Google)
Google+ Auto Backup (HKU\S-1-5-21-4106215785-1409883783-339786315-1001\...\Google+ Auto Backup) (Version: 1.0.26.151 - Google, Inc.)
iCloud (HKLM\...\{8D9592B4-7E22-4D1F-B2CB-B5F0F2F619CB}) (Version: 4.0.3.56 - Apple Inc.)
iTunes (HKLM\...\{F32DC846-4457-40A8-BECA-BCC0E960BC53}) (Version: 11.4.0.18 - Apple Inc.)
Java 8 Update 25 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83218025F0}) (Version: 8.0.250 - Oracle Corporation)
Junk Mail filter update (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Malwarebytes Anti-Malware version 2.0.3.1025 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.3.1025 - Malwarebytes Corporation)
Mesh Runtime (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Messenger Companion (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office Outlook Connector (HKLM\...\{95140000-007A-0409-0000-0000000FF1CE}) (Version: 14.0.5118.5000 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (HKLM\...\Office14.PROPLUSR) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Outlook Social Connector Provider for Windows Live Messenger 32-bit (HKLM\...\{95140000-007D-0409-0000-0000000FF1CE}) (Version: 14.0.5120.5000 - Microsoft Corporation)
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.6.305.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
MSVCRT (Version: 15.4.2862.0708 - Microsoft) Hidden
NVIDIA Graphics Driver 275.33 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 275.33 - NVIDIA Corporation)
NVIDIA Update 1.3.5 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 1.3.5 - NVIDIA Corporation)
OpooSoft JPEG To PDF Converter v6.6 (HKLM\...\JPEG To PDF Converter_is1) (Version: - OpooSoft.com Inc)
PDF Settings (Version: 1.0 - Adobe Systems Incorporated) Hidden
Picasa 3 (HKLM\...\Picasa 3) (Version: 3.9 - Google, Inc.)
Pin It (HKLM\...\Pin It_is1) (Version: 0.0.3 - Pinterest)
QuickTime 7 (HKLM\...\{111EE7DF-FC45-40C7-98A7-753AC46B12FB}) (Version: 7.75.80.95 - Apple Inc.)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)
VC80CRTRedist - 8.0.50727.6195 (Version: 1.2.0 - DivX, Inc) Hidden
Visual Studio 2012 x86 Redistributables (HKLM\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
Windows Live Essentials (HKLM\...\WinLiveSuite) (Version: 15.4.3555.0308 - Microsoft Corporation)
Windows Live Mesh ActiveX Control for Remote Connections (HKLM\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Phone app for desktop (HKLM\...\{5F71448B-88EB-4357-9A98-8658D4C49C48}) (Version: 1.1.2726.0 - Microsoft Corporation)
Yahoo! Software Update (HKLM\...\Yahoo! Software Update) (Version: - )

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-4106215785-1409883783-339786315-1001_Classes\CLSID\{022105BD-948A-40C9-AB42-A3300DDF097F}\localserver32 -> C:\Users\Toni.Ron-PC\AppData\Local\Google\Update\GoogleUpdate.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-4106215785-1409883783-339786315-1001_Classes\CLSID\{22181302-A8A6-4F84-A541-E5CBFC70CC43}\localserver32 -> "C:\Users\Toni.Ron-PC\AppData\Local\Google\Update\1.3.24.15\GoogleUpdateOnDemand.exe" No File
CustomCLSID: HKU\S-1-5-21-4106215785-1409883783-339786315-1001_Classes\CLSID\{2F0E2680-9FF5-43C0-B76E-114A56E93598}\localserver32 -> "C:\Users\Toni.Ron-PC\AppData\Local\Google\Update\1.3.24.15\GoogleUpdateOnDemand.exe" No File
CustomCLSID: HKU\S-1-5-21-4106215785-1409883783-339786315-1001_Classes\CLSID\{51F9E8EF-59D7-475B-A106-C7EA6F30C119}\localserver32 -> "C:\Users\Toni.Ron-PC\AppData\Local\Google\Update\1.3.24.15\GoogleUpdateOnDemand.exe" No File
CustomCLSID: HKU\S-1-5-21-4106215785-1409883783-339786315-1001_Classes\CLSID\{5C65F4B0-3651-4514-B207-D10CB699B14B}\localserver32 -> C:\Users\Toni.Ron-PC\AppData\Local\Google\Chrome\Application\36.0.1985.125\delegate_execute.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-4106215785-1409883783-339786315-1001_Classes\CLSID\{90B3DFBF-AF6A-4EA0-8899-F332194690F8}\InprocServer32 -> C:\Users\Toni.Ron-PC\AppData\Local\Google\Update\1.3.24.15\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-4106215785-1409883783-339786315-1001_Classes\CLSID\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}\InprocServer32 -> C:\Users\Toni.Ron-PC\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll No File
CustomCLSID: HKU\S-1-5-21-4106215785-1409883783-339786315-1001_Classes\CLSID\{C442AC41-9200-4770-8CC0-7CDB4F245C55}\InprocServer32 -> C:\Users\Toni.Ron-PC\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll No File
CustomCLSID: HKU\S-1-5-21-4106215785-1409883783-339786315-1001_Classes\CLSID\{E67BE843-BBBE-4484-95FB-05271AE86750}\localserver32 -> "C:\Users\Toni.Ron-PC\AppData\Local\Google\Update\1.3.24.15\GoogleUpdateOnDemand.exe" No File
CustomCLSID: HKU\S-1-5-21-4106215785-1409883783-339786315-1001_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\Toni.Ron-PC\AppData\Local\Google\Update\1.3.24.15\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-4106215785-1409883783-339786315-1002_Classes\CLSID\{022105BD-948A-40C9-AB42-A3300DDF097F}\localserver32 -> C:\Users\Toni.Ron-PC\AppData\Local\Google\Update\GoogleUpdate.exe (Google Inc.)

==================== Restore Points =========================

23-10-2014 23:30:37 Windows Update
27-10-2014 02:49:54 Windows Update
31-10-2014 22:34:51 Windows Update
05-11-2014 03:41:12 Windows Update
08-11-2014 04:49:42 Windows Update
10-11-2014 03:05:38 Installed AVG 2015
10-11-2014 03:06:04 Installed AVG 2015
14-11-2014 23:49:30 Windows Update
15-11-2014 09:00:55 Windows Update
17-11-2014 00:47:14 Removed AVG 2015
17-11-2014 00:51:37 Removed AVG 2015
18-11-2014 12:59:38 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-13 20:04 - 2009-06-10 15:39 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {2C743EC3-BC3F-467E-A6D2-38FC88E4770B} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-11-16] (Google Inc.)
Task: {32D98768-F73E-4699-AF5B-5F1B7C14AC6E} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {41762979-887D-4542-87DA-BE79D8138446} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {44DB7EF3-C3CC-4A7B-A7A5-7A31E08FB341} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-4106215785-1409883783-339786315-1001UA => C:\Users\Toni.Ron-PC\AppData\Local\Google\Update\GoogleUpdate.exe [2012-04-06] (Google Inc.)
Task: {9B9981CF-544A-4E46-BBEA-0536F25B9412} - System32\Tasks\PinItAutoUpdate => C:\Program Files\Pinterest\Pin It\AutoUpdater.exe [2013-10-17] ()
Task: {B5BF6911-7D0D-4412-B2A0-B79E2A1AC64D} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-11-14] (Adobe Systems Incorporated)
Task: {C8A0E098-68EC-43C6-B346-8CC1D32E170E} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-11-16] (Google Inc.)
Task: {CAB99260-6056-4ED4-B4BA-D828B1D63115} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-4106215785-1409883783-339786315-1001Core => C:\Users\Toni.Ron-PC\AppData\Local\Google\Update\GoogleUpdate.exe [2012-04-06] (Google Inc.)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4106215785-1409883783-339786315-1001Core.job => C:\Users\Toni.Ron-PC\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4106215785-1409883783-339786315-1001UA.job => C:\Users\Toni.Ron-PC\AppData\Local\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2014-07-31 11:16 - 2014-07-31 11:16 - 00073544 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2014-07-31 11:16 - 2014-07-31 11:16 - 01044776 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2014-01-09 23:26 - 2014-01-09 23:26 - 01861968 _____ () C:\Program Files\DivX\DivX Update\DivXUpdate.exe
2014-01-09 23:28 - 2014-01-09 23:28 - 00100688 _____ () C:\Program Files\DivX\DivX Update\DivXUpdateCheck.dll
2013-09-05 00:14 - 2013-09-05 00:14 - 04300456 _____ () C:\Program Files\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
2010-10-20 14:45 - 2010-10-20 14:45 - 08801120 _____ () C:\Program Files\Microsoft Office\Office14\1033\GrooveIntlResource.dll
2014-07-17 15:10 - 2014-07-15 03:24 - 00718664 _____ () C:\Users\Toni.Ron-PC\AppData\Local\Google\Chrome\Application\36.0.1985.125\libglesv2.dll
2014-07-17 15:10 - 2014-07-15 03:24 - 00126280 _____ () C:\Users\Toni.Ron-PC\AppData\Local\Google\Chrome\Application\36.0.1985.125\libegl.dll
2014-07-17 15:10 - 2014-07-15 03:24 - 08537928 _____ () C:\Users\Toni.Ron-PC\AppData\Local\Google\Chrome\Application\36.0.1985.125\pdf.dll
2014-07-17 15:10 - 2014-07-15 03:24 - 00353096 _____ () C:\Users\Toni.Ron-PC\AppData\Local\Google\Chrome\Application\36.0.1985.125\ppGoogleNaClPluginChrome.dll
2014-07-17 15:10 - 2014-07-15 03:24 - 01732936 _____ () C:\Users\Toni.Ron-PC\AppData\Local\Google\Chrome\Application\36.0.1985.125\ffmpegsumo.dll
2014-07-17 15:10 - 2014-07-15 03:24 - 14664008 _____ () C:\Users\Toni.Ron-PC\AppData\Local\Google\Chrome\Application\36.0.1985.125\PepperFlash\pepflashplayer.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

MSCONFIG\startupreg: Adobe ARM => "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: APSDaemon => "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"
MSCONFIG\startupreg: BCSSync => "C:\Program Files\Microsoft Office\Office14\BCSSync.exe" /DelayServices
MSCONFIG\startupreg: EPSON Stylus CX7800 Series => C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATIAFA.EXE /FU "C:\Windows\TEMP\E_SDA2D.tmp" /EF "HKCU"
MSCONFIG\startupreg: Google Update => "C:\Users\Toni.Ron-PC\AppData\Local\Google\Update\GoogleUpdate.exe" /c
MSCONFIG\startupreg: HotKeysCmds => C:\Windows\system32\hkcmd.exe
MSCONFIG\startupreg: IgfxTray => C:\Windows\system32\igfxtray.exe
MSCONFIG\startupreg: iTunesHelper => "C:\Program Files\iTunes\iTunesHelper.exe"
MSCONFIG\startupreg: MSC => "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
MSCONFIG\startupreg: Persistence => C:\Windows\system32\igfxpers.exe
MSCONFIG\startupreg: Sidebar => C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
MSCONFIG\startupreg: Zune Launcher => "C:\Program Files\Zune\ZuneLauncher.exe"

========================= Accounts: ==========================

Administrator (S-1-5-21-4106215785-1409883783-339786315-500 - Administrator - Disabled)
Guest (S-1-5-21-4106215785-1409883783-339786315-501 - Limited - Disabled)
Toni (S-1-5-21-4106215785-1409883783-339786315-1001 - Administrator - Enabled) => C:\Users\Toni.Ron-PC
UpdatusUser (S-1-5-21-4106215785-1409883783-339786315-1002 - Limited - Enabled) => C:\Users\UpdatusUser

==================== Faulty Device Manager Devices =============

Name: PS/2 Compatible Mouse
Description: PS/2 Compatible Mouse
Class Guid: {4d36e96f-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: i8042prt
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.

Name: Standard PS/2 Keyboard
Description: Standard PS/2 Keyboard
Class Guid: {4d36e96b-e325-11ce-bfc1-08002be10318}
Manufacturer: (Standard keyboards)
Service: i8042prt
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.


==================== Event log errors: =========================

Application errors:
==================
Error: (11/18/2014 09:37:16 PM) (Source: Microsoft Security Client Setup) (EventID: 100) (User: TONY-PC)
Description: HRESULT:0x8004FF0A
Description:Security Essentials is still installed on your computer.. Security Essentials was not removed from your computer. It will continue to monitor your computer and help protect it from potential threats. Error code:0x8004FF0A.


System errors:
=============
Error: (11/18/2014 09:35:54 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {995C996E-D918-4A8C-A302-45719A6F4EA7}

Error: (11/17/2014 07:36:30 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {995C996E-D918-4A8C-A302-45719A6F4EA7}


Microsoft Office Sessions:
=========================
Error: (11/18/2014 09:37:16 PM) (Source: Microsoft Security Client Setup) (EventID: 100) (User: TONY-PC)
Description: HRESULT:0x8004FF0A
Description:Security Essentials is still installed on your computer.. Security Essentials was not removed from your computer. It will continue to monitor your computer and help protect it from potential threats. Error code:0x8004FF0A.


CodeIntegrity Errors:
===================================
Date: 2014-11-09 21:08:56.798
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\AVG\AVG2015\avghookx.dll because the set of per-page image hashes could not be found on the system.


==================== Memory info ===========================

Processor: Intel® Core™2 Duo CPU E8400 @ 3.00GHz
Percentage of memory in use: 49%
Total physical RAM: 3543.25 MB
Available physical RAM: 1792.48 MB
Total Pagefile: 7084.78 MB
Available Pagefile: 5099.49 MB
Total Virtual: 2047.88 MB
Available Virtual: 1911.81 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:297.99 GB) (Free:148.81 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298.1 GB) (Disk ID: D47CFC6E)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=298 GB) - (Type=07 NTFS)

==================== End Of Log ============================

#14 LiquidTension

LiquidTension

    SuperMember

  • Retired Classroom Teacher
  • 2,566 posts

Posted 19 November 2014 - 07:54 AM

Hi Toni, 
 
That ESET log is OK. 
 
Download and run the AVG Anti-Virus removal tool. 
Then run the programme below. 
 
mlEX1wH.png RogueKiller

  • Please download RogueKiller (x32) and save the file to your Desktop.
  • Close any running programmes.
  • Right-Click RogueKiller.exe and select AVOiBNU.jpg Run as administrator to run the programme.
  • Allow the Prescan to complete. Upon completion, a window will open. Click Accept.
  • A browser window may open. Close the browser window.
  • Click jpgUwzp.png. Upon completion, click phPvmc6.png.
  • Close the programme. Do not fix anything!
  • A log (RKreport.txt) will be open. Copy the contents of the log and paste in your next reply.

50QfLth.png

 

Would you like to help others with malware removal? Join our Classroom and learn how!

#15 tonilo

tonilo

    Authentic Member

  • Authentic Member
  • PipPip
  • 53 posts

Posted 19 November 2014 - 10:02 PM

RogueKiller V10.0.6.0 [Nov 13 2014] by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Website : http://www.adlice.co...es/roguekiller/
Blog : http://www.adlice.com

Operating System : Windows 7 (6.1.7601 Service Pack 1) 32 bits version
Started in : Normal mode
User : Toni [Administrator]
Mode : Scan -- Date : 11/19/2014 21:57:21

¤¤¤ Processes : 0 ¤¤¤

¤¤¤ Registry : 5 ¤¤¤
[PUM.HomePage] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main | Start Page : www.google.com -> Found
[PUM.HomePage] HKEY_USERS\S-1-5-21-4106215785-1409883783-339786315-1001\Software\Microsoft\Internet Explorer\Main | Start Page : http://www.yahoo.com/ -> Found
[PUM.StartMenu] HKEY_USERS\S-1-5-21-4106215785-1409883783-339786315-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowMyGames : 0 -> Found
[PUM.DesktopIcons] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> Found
[PUM.DesktopIcons] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1 -> Found

¤¤¤ Tasks : 0 ¤¤¤

¤¤¤ Files : 0 ¤¤¤

¤¤¤ Hosts File : 0 ¤¤¤

¤¤¤ Antirootkit : 1 (Driver: Loaded) ¤¤¤
[Filter(Kernel.Filter)] \Driver\atapi @ \Device\CdRom0 : \Driver\GEARAspiWDM @ Unknown (\SystemRoot\system32\drivers\tpm.sys)

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ MBR Check : ¤¤¤
+++++ PhysicalDrive0: ST3320418AS ATA Device +++++
--- User ---
[MBR] 53b067be937f6e47563bb18db6fefdf2
[BSP] f6f1ead11c0c391fe3b896dc34d9b61a : Windows Vista/7/8 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 100 MB
1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 206848 | Size: 305143 MB
User = LL1 ... OK
User = LL2 ... OK

Related Topics

Back to Virus, Spyware & Malware Removal · Next Unread Topic →

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. What the Tech
  2. → Spyware / Malware / Virus Removal
  3. → Virus, Spyware & Malware Removal
  4. Privacy Policy
  5. Terms of Use ·