Spyware / Malware / Virus Removal

PC slow, Popups, several processes with .exe *32 [Solved]

18 min read

Looking for the outcome? Ask AI

naah Topic Starter

Post #1January 16, 2015, 8:52 PM UTC

I am having issues with internet pop ups and windows showing constantly. I have run the utilities mentioned on your website. Below are the text files from these utilitites. I have also attached the outputs.

I would appreciate if you could guide me on how to fix this problem.

thanks for your help

naah

Avast text -

aswMBR version 1.0.1.2252 Copyright© 2014 AVAST Software
Run date: 2015-01-16 10:07:44
—————————–
10:07:44.860    OS Version: Windows x64 6.1.7601 Service Pack 1
10:07:44.860    Number of processors: 2 586 0x1001
10:07:44.870    ComputerName: KOMALYDATECPA UserName:
10:07:49.322    Initialize success
10:07:49.594    VM: initialized successfully
10:07:49.594    VM: Amd CPU BiosDisabled
10:09:43.463    AVAST engine defs: 15011600
10:10:44.932    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\00000064
10:10:44.932    Disk 0 Vendor: ST640LM0 2AJ1 Size: 610480MB BusType: 11
10:10:45.104    Disk 0 MBR read successfully
10:10:45.104    Disk 0 MBR scan
10:10:45.256    Disk 0 Windows 7 default MBR code
10:10:45.276    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS          199 MB offset 2048
10:10:45.286    Disk 0 default boot code
10:10:45.346    Disk 0 Partition 2 00     07    HPFS/NTFS NTFS       589551 MB offset 409600
10:10:45.426    Disk 0 Partition 3 00     07    HPFS/NTFS NTFS        20625 MB offset 1207810048
10:10:45.516    Disk 0 Partition 4 00     0C    FAT32 LBA MSDOS5.0      103 MB offset 1250050048
10:10:45.786    Disk 0 scanning C:\Windows\system32\drivers
10:11:20.834    Service scanning
10:12:33.326    Modules scanning
10:12:33.336    Disk 0 trace - called modules:
10:12:33.367    ntoskrnl.exe CLASSPNP.SYS disk.sys hpdskflt.sys amd_xata.sys storport.sys hal.dll amd_sata.sys
10:12:33.378    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa80047df060]
10:12:33.390    3 CLASSPNP.SYS[fffff88000c8743f] -> nt!IofCallDriver -> [0xfffffa80047de590]
10:12:33.402    5 hpdskflt.sys[fffff88001625189] -> nt!IofCallDriver -> [0xfffffa8004766040]
10:12:33.408    7 amd_xata.sys[fffff88001112d00] -> nt!IofCallDriver -> \Device\00000064[0xfffffa8004762060]
10:12:36.116    AVAST engine scan C:\Windows
10:12:42.153    AVAST engine scan C:\Windows\system32
10:22:05.138    AVAST engine scan C:\Windows\system32\drivers
10:22:48.719    AVAST engine scan C:\Users\Komal Y Date CPA
13:38:51.946    AVAST engine scan C:\ProgramData
13:45:49.409    Disk 0 statistics 6432688/0/0 @ 0.66 MB/s
13:45:49.429    Scan finished successfully
15:18:43.926    Disk 0 MBR has been saved successfully to "C:\Users\Komal Y Date CPA\Desktop\MBR.dat"
15:18:44.050    The log file has been saved successfully to "C:\Users\Komal Y Date CPA\Desktop\aswMBR.txt"

FRST.txt

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 15-01-2015 01
Ran by [removed] (administrator) on KOMALYDATECPA on 16-01-2015 15:25:01
Running from C:\Users\[removed]\Desktop
[removed] Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: English (United States)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
(Hewlett-Packard Company) C:\Windows\System32\hpservice.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(ArcSoft Inc.) C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(HP) C:\Program Files (x86)\HP\HPLaserJetService\HPLaserJetService.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe
(HP) C:\Program Files\HP\HP LaserJet M1210 MFP Series\ReceiveFaxUtility.exe
(HP) C:\Windows\System32\HPSIsvc.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn\x64\ramaint.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee\SiteAdvisor\mcsacore.exe
(McAfee, Inc.) C:\Windows\System32\mfevtps.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Intuit) C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Intuit Inc.) C:\Program Files (x86)\Common Files\Intuit\DataProtect\QBIDPService.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Client Connect LTD) C:\Program Files (x86)\SearchProtect\Main\bin\CltMngSvc.exe
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn\x64\LogMeIn.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(McAfee, Inc.) C:\Program Files\McAfee\MSC\McAPExe.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\AMCore\mcshield.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe
(Intuit, Inc.) C:\Program Files (x86)\Intuit\QuickBooks 2013\QBDBMgrN.exe
(Client Connect LTD) C:\Program Files (x86)\SearchProtect\SearchProtect\bin\cltmng.exe
(Client Connect LTD) C:\Program Files (x86)\SearchProtect\UI\bin\cltmngui.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe
(Intuit Inc.) C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe
(ArcSoft Inc.) C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(ArcSoft, Inc.) C:\Program Files (x86)\ArcSoft\TotalMedia Backup\uBBMonitor.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\Platform\McUICnt.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
() C:\Program Files (x86)\neurowise\bin\utilneurowise.exe
() C:\Program Files (x86)\neurowise\updateneurowise.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(AVAST Software) C:\Users\Komal Y Date CPA\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TGYYWIS8\aswMBR.exe
(McAfee, Inc.) C:\Program Files\McAfee\MSM\McSmtFwk.exe
(McAfee, Inc.) C:\Program Files\McAfee\VirusScan\mcods.exe

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\…\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2832168 2011-09-30] (Synaptics Incorporated)
HKLM\…\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [1425408 2012-01-04] (IDT, Inc.)
HKLM\…\Run: [SetDefault] => C:\Program Files\Hewlett-Packard\HP LaunchBox\SetDefault.exe [44880 2011-12-20] (Hewlett-Packard Development Company, L.P.)
HKLM\…\Run: [LogMeIn GUI] => C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe [57928 2012-11-29] (LogMeIn, Inc.)
HKLM-x32\…\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [630912 2012-02-10] (Advanced Micro Devices, Inc.)
HKLM-x32\…\Run: [HPOSD] => C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe [379960 2011-08-19] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\…\Run: [mcui_exe] => C:\Program Files\McAfee.com\Agent\mcagent.exe [537992 2014-04-25] (McAfee, Inc.)
HKLM-x32\…\Run: [ArcSoft Connection Service] => C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe [207424 2010-10-27] (ArcSoft Inc.)
HKLM-x32\…\Run: [] => [X]
HKLM-x32\…\Run: [HPUsageTrackingLEDM] => C:\Program Files (x86)\HP\HP UT LEDM\bin\hppusg.exe [30264 2009-10-15] (Hewlett-Packard Company)
HKLM-x32\…\Run: [Intuit SyncManager] => C:\Program Files (x86)\Common Files\Intuit\Sync\IntuitSyncManager.exe [3774776 2014-01-16] (Intuit Inc. All rights reserved.)
HKLM-x32\…\Run: [HP Quick Launch] => C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [578944 2012-03-05] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\…\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [60712 2014-10-11] (Apple Inc.)
HKLM-x32\…\Run: [mcpltui_exe] => C:\Program Files\McAfee.com\Agent\mcagent.exe [537992 2014-04-25] (McAfee, Inc.)
HKLM-x32\…\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [157480 2014-10-15] (Apple Inc.)
HKLM\…\RunOnce: [NCPluginUpdater] => C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\NCPluginUpdater.exe [21720 2014-12-16] (Hewlett-Packard)
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Symantec <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files\McAfee <====== ATTENTION
HKLM\…\Policies\Explorer: [NoControlPanel] 0
HKLM\…\Policies\Explorer: [NoFolderOptions] 0
HKU\S-1-5-21-1386202753-562040-1781798146-1001\…\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [43816 2014-10-17] (Apple Inc.)
HKU\S-1-5-21-1386202753-562040-1781798146-1001\…\Policies\Explorer: [NoFolderOptions] 0
HKU\S-1-5-21-1386202753-562040-1781798146-1001\…\Policies\Explorer: [NoControlPanel] 0
HKU\S-1-5-21-1386202753-562040-1781798146-1001\…\MountPoints2: {60353a37-7d23-11e2-b42d-a0b3cc736570} - F:\DTLplus_Launcher.exe
HKU\S-1-5-18\…\RunOnce: [{91120000-0014-0000-0000-0000000FF1CE}] => C:\Windows\system32\cmd.exe /C del "C:\ProgramData\Microsoft Help\Rgstrtn.lck" /Q /A:H
AppInit_DLLs: C:\PROGRA~2\SearchProtect\SearchProtect\bin\VC64Loader.dll => C:\Program Files (x86)\SearchProtect\SearchProtect\bin\VC64Loader.dll [245008 2015-01-05] (Client Connect LTD)
AppInit_DLLs-x32: C:\PROGRA~2\SearchProtect\SearchProtect\bin\VC32Loader.dll => C:\Program Files (x86)\SearchProtect\SearchProtect\bin\VC32Loader.dll [215312 2015-01-05] (Client Connect LTD)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Intuit Data Protect.lnk
ShortcutTarget: Intuit Data Protect.lnk -> C:\Program Files (x86)\Common Files\Intuit\DataProtect\IntuitDataProtect.exe (Intuit Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk
ShortcutTarget: QuickBooks Update Agent.lnk -> C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe (Intuit Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\QuickBooks_Standard_21.lnk
ShortcutTarget: QuickBooks_Standard_21.lnk -> C:\Program Files (x86)\Intuit\QuickBooks 2013\QBW32.EXE (Intuit Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\TotalMedia Backup Monitor.lnk
ShortcutTarget: TotalMedia Backup Monitor.lnk -> C:\Program Files (x86)\ArcSoft\TotalMedia Backup\uBBMonitor.exe (ArcSoft, Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-1386202753-562040-1781798146-1001\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-1386202753-562040-1781798146-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/HPNOT/1
HKU\S-1-5-21-1386202753-562040-1781798146-1005\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-1386202753-562040-1781798146-1005\Software\Microsoft\Internet Explorer\Main,First Home Page = http://g.msn.com/HPNOT/1
HKU\S-1-5-21-1386202753-562040-1781798146-1005\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/HPNOT/1
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
SearchScopes: HKLM -> {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL =
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
SearchScopes: HKLM -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = http://search.ask.com/web?q={searchterms}&l=dis&o=HPNTDF
SearchScopes: HKLM -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = http://search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKLM -> {CB35D052-ADB4-4701-988F-01259B2F5C00} URL = http://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us2-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM -> {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = http://en.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKLM -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.com/rover/1/711-30572-11896-2/4?mpre=http://www.ebay.com/sch/i.html?_nkw={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
SearchScopes: HKLM-x32 -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = http://search.ask.com/web?q={searchterms}&l=dis&o=HPNTDF
SearchScopes: HKLM-x32 -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = http://search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKLM-x32 -> {CB35D052-ADB4-4701-988F-01259B2F5C00} URL = http://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us2-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM-x32 -> {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = http://en.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKLM-x32 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.com/rover/1/711-30572-11896-2/4?mpre=http://www.ebay.com/sch/i.html?_nkw={searchTerms}
SearchScopes: HKU\S-1-5-21-1386202753-562040-1781798146-1001 -> DefaultScope {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = http://www.trovi.com/Results.aspx?gd=&ctid=CT3324775&octid=EB_ORIGINAL_CTID&ISID=M08373CA9-3220-4E05-B867-CF8C21A096B1&SearchSource=58&CUI=&UM=8&UP=SP4E79AB38-1F8C-438E-A6A8-D82D43B09455&q={searchTerms}&SSPV=
SearchScopes: HKU\S-1-5-21-1386202753-562040-1781798146-1001 -> {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = http://www.trovi.com/Results.aspx?gd=&ctid=CT3324775&octid=EB_ORIGINAL_CTID&ISID=M08373CA9-3220-4E05-B867-CF8C21A096B1&SearchSource=58&CUI=&UM=8&UP=SP4E79AB38-1F8C-438E-A6A8-D82D43B09455&q={searchTerms}&SSPV=
SearchScopes: HKU\S-1-5-21-1386202753-562040-1781798146-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?FORM=U164DF&PC=U164&q={searchTerms}&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-1386202753-562040-1781798146-1001 -> {48D7B374-8777-4072-A3AB-C9DAE76172D9} URL = https://search.yahoo.com/search?fr=mcafee&type=B011US714D20120722&p={SearchTerms}
SearchScopes: HKU\S-1-5-21-1386202753-562040-1781798146-1001 -> {A38F2B5C-DC4A-484F-B763-EC7FA66672D2} URL = https://www.google.com/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-1386202753-562040-1781798146-1001 -> {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL =
SearchScopes: HKU\S-1-5-21-1386202753-562040-1781798146-1001 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL =
SearchScopes: HKU\S-1-5-21-1386202753-562040-1781798146-1005 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-1386202753-562040-1781798146-1005 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-1386202753-562040-1781798146-1005 -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = http://search.ask.com/web?q={searchterms}&l=dis&o=HPNTDF
SearchScopes: HKU\S-1-5-21-1386202753-562040-1781798146-1005 -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = http://search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKU\S-1-5-21-1386202753-562040-1781798146-1005 -> {CB35D052-ADB4-4701-988F-01259B2F5C00} URL = http://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us2-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKU\S-1-5-21-1386202753-562040-1781798146-1005 -> {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = http://en.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKU\S-1-5-21-1386202753-562040-1781798146-1005 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.com/rover/1/711-30572-11896-2/4?mpre=http://www.ebay.com/sch/i.html?_nkw={searchTerms}
BHO: SteadyVideoBHO Class -> {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} -> C:\Program Files\AMD\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
BHO: McAfee SiteAdvisor BHO -> {B164E929-A1B6-4A06-B104-2CD0E90A88FF} -> c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll (Hewlett-Packard)
BHO-x32: SteadyVideoBHO Class -> {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} -> C:\Program Files (x86)\amd\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
BHO-x32: McAfee SiteAdvisor BHO -> {B164E929-A1B6-4A06-B104-2CD0E90A88FF} -> c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
BHO-x32: neurowise 1.0.0.6 -> {d08ab008-0647-4784-8e2c-5769cd4a7c3a} -> C:\Program Files (x86)\neurowise\neurowisebho.dll (neurowise)
BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
Toolbar: HKLM - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKU\S-1-5-21-1386202753-562040-1781798146-1001 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
DPF: HKLM-x32 {E06E2E99-0AA1-11D4-ABA6-0060082AA75C}
Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
Handler-x32: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
Handler-x32: intu-help-qb4 - {ACE22922-D07C-4860-B51B-8CF472FEC2CB} - C:\Program Files (x86)\Intuit\QuickBooks 2011\HelpAsyncPluggableProtocol.dll (Intuit, Inc.)
Handler-x32: intu-help-qb6 - {6898B29B-BF49-43cb-A0B1-D0B9496AF491} - C:\Program Files (x86)\Intuit\QuickBooks 2013\HelpAsyncPluggableProtocol.dll (Intuit, Inc.)
Handler-x32: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation)
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
Handler-x32: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files\McAfee\MSC\McSnIePl64.dll (McAfee, Inc.)
Filter-x32: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files (x86)\McAfee\MSC\McSnIePl.dll (McAfee, Inc.)
Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter-x32: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter-x32: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Tcpip\Parameters: [DhcpNameServer] 75.75.75.75 75.75.76.76

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()
FF Plugin: @mcafee.com/MSC,version=10 -> c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL ()
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1206147.dll (Adobe Systems, Inc.)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @mcafee.com/MSC,version=10 -> c:\PROGRA~2\mcafee\msc\NPMCSN~1.DLL ()
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-1386202753-562040-1781798146-1001: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Komal Y Date CPA\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF HKLM-x32\…\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files (x86)\McAfee\SiteAdvisor
FF Extension: McAfee SiteAdvisor - C:\Program Files (x86)\McAfee\SiteAdvisor [2012-07-22]
FF HKLM-x32\…\Firefox\Extensions: [[removed]] - C:\Program Files (x86)\Hewlett-Packard\SmartPrint\QPExtension
FF Extension: SmartPrintButton - C:\Program Files (x86)\Hewlett-Packard\SmartPrint\QPExtension [2012-07-22]

Chrome:
=======
CHR DefaultSearchKeyword: Default -> mcafee
CHR DefaultSearchURL: Default -> https://search.yahoo.com/search?fr=mcafee&type=B211US714D20120722&p={searchTerms}
CHR DefaultSuggestURL: Default ->
CHR Profile: C:\Users\Komal Y Date CPA\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\Komal Y Date CPA\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-04-29]
CHR Extension: (Google Drive) - C:\Users\Komal Y Date CPA\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-04-29]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Komal Y Date CPA\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2015-01-06]
CHR Extension: (YouTube) - C:\Users\Komal Y Date CPA\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-04-29]
CHR Extension: (Google Search) - C:\Users\Komal Y Date CPA\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-04-29]
CHR Extension: (SiteAdvisor) - C:\Users\Komal Y Date CPA\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho [2013-04-29]
CHR Extension: (Cisco WebEx Extension) - C:\Users\Komal Y Date CPA\AppData\Local\Google\Chrome\User Data\Default\Extensions\jlhmfgmfgeifomenelglieieghnjghma [2014-12-20]
CHR Extension: (Skype Click to Call) - C:\Users\Komal Y Date CPA\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2014-03-29]
CHR Extension: (Google Wallet) - C:\Users\Komal Y Date CPA\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-10]
CHR Extension: (Gmail) - C:\Users\Komal Y Date CPA\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-04-29]
CHR HKLM\…\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - C:\Program Files (x86)\McAfee\SiteAdvisor\McChPlg.crx [2015-01-13]
CHR HKU\S-1-5-21-1386202753-562040-1781798146-1001\…\Chrome\Extension: [bmkckgpgekmanipelfidlhmkfcjicion] - No Path
CHR HKLM-x32\…\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - C:\Program Files (x86)\McAfee\SiteAdvisor\McChPlg.crx [2015-01-13]
CHR HKLM-x32\…\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2014-07-14]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [361984 2012-02-10] (Advanced Micro Devices, Inc.) [File not signed]
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)
R2 CltMngSvc; C:\Program Files (x86)\SearchProtect\Main\bin\CltMngSvc.exe [3342608 2015-01-05] (Client Connect LTD)
R2 HomeNetSvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
R2 HP LaserJet Service; C:\Program Files (x86)\HP\HPLaserJetService\HPLaserJetService.exe [136192 2009-10-15] (HP) [File not signed]
R2 HP Support Assistant Service; C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [92160 2013-11-04] (Hewlett-Packard Company) [File not signed]
R2 HPM1210RcvFaxSrvc; C:\Program Files\HP\HP LaserJet M1210 MFP Series\ReceiveFaxUtility.exe [362296 2010-05-11] (HP)
R2 LMIGuardianSvc; C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe [376168 2014-11-25] (LogMeIn, Inc.)
R2 LMIMaint; C:\Program Files (x86)\LogMeIn\x64\RaMaint.exe [226152 2014-11-25] (LogMeIn, Inc.)
R2 LogMeIn; C:\Program Files (x86)\LogMeIn\x64\LogMeIn.exe [407424 2012-11-29] (LogMeIn, Inc.)
R2 McAfee SiteAdvisor Service; C:\Program Files (x86)\McAfee\SiteAdvisor\McSACore.exe [156904 2014-11-13] (McAfee, Inc.)
R2 McAPExe; C:\Program Files\McAfee\MSC\McAPExe.exe [178528 2014-04-25] (McAfee, Inc.)
R2 McMPFSvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
R2 McNaiAnn; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
R3 McODS; C:\Program Files\McAfee\VirusScan\mcods.exe [603424 2014-09-04] (McAfee, Inc.)
R2 mcpltsvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
R2 McProxy; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
R2 mfecore; C:\Program Files\Common Files\McAfee\AMCore\mcshield.exe [1041192 2014-08-20] (McAfee, Inc.)
R2 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [219752 2014-06-20] (McAfee, Inc.)
R2 mfevtp; C:\Windows\system32\mfevtps.exe [189912 2014-06-20] (McAfee, Inc.)
R2 Orbiter; C:/Program Files (x86)/ORBTR/orbiter.dll [558544 2015-01-10] (Client Connect LTD)
R2 QBCFMonitorService; C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe [45056 2014-01-16] (Intuit) [File not signed]
S3 QBFCService; C:\Program Files (x86)\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe [61440 2009-07-23] (Intuit Inc.) [File not signed]
R2 QBVSS; C:\Program Files (x86)\Common Files\Intuit\DataProtect\QBIDPService.exe [1248256 2012-03-09] (Intuit Inc.) [File not signed]
S4 QuickBooksDB21; C:\Program Files (x86)\Intuit\QuickBooks 2011\QBDBMgrN.exe [679936 2010-04-27] (Intuit, Inc.) [File not signed]
R3 QuickBooksDB23; C:\Program Files (x86)\Intuit\QuickBooks 2013\QBDBMgrN.exe [679936 2013-03-11] (Intuit, Inc.) [File not signed]
R2 Update neurowise; C:\Program Files (x86)\neurowise\updateneurowise.exe [529696 2015-01-16] ()
R2 Util neurowise; C:\Program Files (x86)\neurowise\bin\utilneurowise.exe [529696 2015-01-16] ()
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R0 amdkmpfd; C:\Windows\System32\drivers\amdkmpfd.sys [31872 2012-02-02] (Advanced Micro Devices, Inc.)
R3 cfwids; C:\Windows\System32\drivers\cfwids.sys [72128 2014-06-20] (McAfee, Inc.)
S3 HipShieldK; C:\Windows\System32\drivers\HipShieldK.sys [197704 2013-09-23] (McAfee, Inc.)
S3 HP1210FAX; C:\Windows\System32\Drivers\HPM1210FAX.sys [16384 2011-04-15] ()
R2 LMIInfo; C:\Program Files (x86)\LogMeIn\x64\RaInfo.sys [16056 2012-11-29] (LogMeIn, Inc.)
S4 LMIRfsClientNP; No ImagePath
R3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [181704 2014-06-20] (McAfee, Inc.)
R3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [313544 2014-06-20] (McAfee, Inc.)
R3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [523792 2014-06-20] (McAfee, Inc.)
R0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [786296 2014-06-20] (McAfee, Inc.)
R3 mfencbdc; C:\Windows\System32\DRIVERS\mfencbdc.sys [445512 2014-08-20] (McAfee, Inc.)
S3 mfencrk; C:\Windows\System32\DRIVERS\mfencrk.sys [96592 2014-08-20] (McAfee, Inc.)
R0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [348552 2014-06-20] (McAfee, Inc.)
S3 mvusbews; C:\Windows\System32\Drivers\mvusbews.sys [20480 2011-04-15] (Marvell Semiconductor, Inc.)
R3 RSP2STOR; C:\Windows\System32\DRIVERS\RtsP2Stor.sys [258664 2011-09-21] (Realtek Semiconductor Corp.)
R3 SPPD; \??\C:\Windows\system32\drivers\SPPD.sys [X]
U3 aswMBR; \??\C:\Users\KOMALY~1\AppData\Local\Temp\aswMBR.sys [X]
U3 aswVmm; \??\C:\Users\KOMALY~1\AppData\Local\Temp\aswVmm.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)

==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-16 15:25 - 2015-01-16 15:30 - 00032386 _____ () C:\Users\Komal Y Date CPA\Desktop\FRST.txt
2015-01-16 15:24 - 2015-01-16 15:25 - 00000000 ____D () C:\FRST
2015-01-16 15:24 - 2015-01-16 15:24 - 02125312 _____ (Farbar) C:\Users\Komal Y Date CPA\Desktop\FRST64.exe
2015-01-16 15:18 - 2015-01-16 15:18 - 00002427 _____ () C:\Users\Komal Y Date CPA\Desktop\aswMBR.txt
2015-01-16 15:18 - 2015-01-16 15:18 - 00000512 _____ () C:\Users\Komal Y Date CPA\Desktop\MBR.dat
2015-01-16 08:32 - 2015-01-16 08:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee
2015-01-14 09:10 - 2014-12-12 00:11 - 03971512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-01-14 09:10 - 2014-12-12 00:11 - 03916728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-01-14 09:10 - 2014-12-12 00:07 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-01-14 09:09 - 2014-12-12 00:35 - 05553592 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-01-14 09:09 - 2014-12-12 00:31 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-01-14 09:09 - 2014-12-12 00:31 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-01-14 09:09 - 2014-12-12 00:31 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-01-13 16:03 - 2014-12-18 22:06 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2015-01-13 16:03 - 2014-12-18 20:46 - 00141312 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2015-01-13 16:03 - 2014-12-11 12:47 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2015-01-13 16:03 - 2014-12-05 23:17 - 00303616 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll
2015-01-13 16:03 - 2014-12-05 22:50 - 00156672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncsi.dll
2015-01-13 16:03 - 2014-12-05 22:50 - 00052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll
2015-01-13 16:03 - 2012-10-03 12:44 - 00216576 _____ (Microsoft Corporation) C:\Windows\system32\ncsi.dll
2015-01-13 16:03 - 2012-10-03 12:44 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\nlaapi.dll
2015-01-13 11:38 - 2015-01-13 16:16 - 00000000 ____D () C:\Windows\system32\MpEngineStore
2015-01-10 17:38 - 2015-01-11 10:33 - 00001158 _____ () C:\Users\Komal Y Date CPA\Desktop\Live PC Help.lnk
2015-01-10 17:18 - 2015-01-10 17:18 - 00000000 ____D () C:\Users\Komal Y Date CPA\AppData\Roaming\Roxio Log Files
2015-01-10 16:46 - 2015-01-16 08:25 - 00000672 _____ () C:\Windows\setupact.log
2015-01-10 16:46 - 2015-01-10 16:46 - 00000000 _____ () C:\Windows\setuperr.log
2015-01-10 16:37 - 2015-01-15 20:41 - 00000000 ____D () C:\Program Files (x86)\neurowise
2015-01-10 16:34 - 2015-01-10 16:35 - 00000000 ____D () C:\Users\Komal Y Date CPA\AppData\Local\SearchProtect
2015-01-10 16:34 - 2015-01-10 16:34 - 00000000 ____D () C:\Program Files (x86)\SearchProtect
2015-01-10 16:34 - 2015-01-10 16:34 - 00000000 ____D () C:\Program Files (x86)\ORBTR
2015-01-10 16:11 - 2015-01-10 16:12 - 00000000 ____D () C:\Users\Komal Y Date CPA\AppData\Roaming\K9AMW
2015-01-10 16:06 - 2015-01-05 17:06 - 00018992 _____ () C:\Windows\system32\roboot64.exe
2015-01-06 15:06 - 2015-01-06 15:06 - 00000590 _____ () C:\Users\QBDataServiceUser23\Desktop\Drake 2015 CWU - C Drive.Lnk
2015-01-06 15:06 - 2015-01-06 15:06 - 00000590 _____ () C:\Users\QBDataServiceUser21\Desktop\Drake 2015 CWU - C Drive.Lnk
2015-01-06 15:06 - 2015-01-06 15:06 - 00000590 _____ () C:\Users\Komal Y Date CPA\Desktop\Drake 2015 CWU - C Drive.Lnk
2015-01-06 15:05 - 2015-01-06 15:24 - 00000000 ____D () C:\CWU2015
2015-01-04 10:15 - 2015-01-04 10:15 - 04996096 _____ () C:\Users\Komal Y Date CPA\Desktop\M3 Logix (Backup Dec 31,2014).QBB
2015-01-02 17:01 - 2015-01-02 17:01 - 00393728 _____ () C:\Users\Komal Y Date CPA\Desktop\M3 Logix (Acct Transfer Jan 02,2015 04 05 PM).QBX
2014-12-23 09:30 - 2014-12-23 09:30 - 00003886 _____ () C:\Windows\System32\Tasks\Adobe Acrobat Update Task
2014-12-20 09:32 - 2014-12-20 09:32 - 00000000 ____D () C:\Users\Komal Y Date CPA\AppData\Roaming\Mozilla
2014-12-17 17:40 - 2014-12-13 00:09 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-12-17 17:40 - 2014-12-12 22:33 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-16 15:27 - 2009-07-13 23:45 - 00031472 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-01-16 15:27 - 2009-07-13 23:45 - 00031472 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-01-16 15:08 - 2009-07-13 22:20 - 00000000 ____D () C:\Windows\tracing
2015-01-16 14:53 - 2012-10-22 06:28 - 00000898 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-01-16 14:42 - 2014-07-29 09:50 - 00000560 _____ () C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-1386202753-562040-1781798146-1001.job
2015-01-16 12:53 - 2012-10-22 06:28 - 00000894 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-01-16 10:00 - 2012-07-07 23:38 - 01237741 _____ () C:\Windows\WindowsUpdate.log
2015-01-16 08:34 - 2012-07-22 10:35 - 00003990 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{A4073903-C70C-427D-929F-E3DA80EF19FA}
2015-01-16 08:33 - 2014-01-28 08:53 - 00000964 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Client.lnk
2015-01-16 08:33 - 2014-01-28 08:53 - 00000948 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Control Panel.lnk
2015-01-16 08:25 - 2014-08-05 10:48 - 00065536 _____ () C:\Windows\system32\Ikeext.etl
2015-01-16 08:25 - 2009-07-14 00:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-01-16 08:08 - 2009-07-13 22:20 - 00000000 ____D () C:\Windows\system32\NDF
2015-01-16 07:13 - 2013-04-09 07:44 - 00000000 ____D () C:\ProgramData\LogMeIn
2015-01-13 21:13 - 2013-10-12 15:39 - 00000000 ____D () C:\Windows\system32\MRT
2015-01-13 21:00 - 2013-10-12 15:39 - 113365784 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-01-13 15:58 - 2012-07-23 20:28 - 00000000 ____D () C:\Users\Komal Y Date CPA\AppData\Local\CutePDF Writer
2015-01-13 14:38 - 2012-07-22 11:11 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-01-13 12:13 - 2012-07-24 16:02 - 00000000 ____D () C:\Users\Komal Y Date CPA\AppData\Local\CrashDumps
2015-01-13 11:55 - 2013-01-22 21:53 - 00000000 _____ () C:\Windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt
2015-01-13 11:55 - 2012-07-24 15:35 - 00000052 _____ () C:\Windows\SysWOW64\DOErrors.log
2015-01-13 11:42 - 2012-07-22 11:05 - 00000000 ____D () C:\Program Files (x86)\McAfee
2015-01-13 11:42 - 2010-11-20 22:47 - 00921962 _____ () C:\Windows\PFRO.log
2015-01-10 17:39 - 2012-03-01 02:46 - 00000000 ____D () C:\Program Files (x86)\Microsoft Office
2015-01-10 17:24 - 2012-03-01 02:29 - 00000000 ____D () C:\Program Files (x86)\Hewlett-Packard
2015-01-10 17:18 - 2012-07-22 12:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP
2015-01-10 17:18 - 2012-07-22 11:59 - 00000000 ____D () C:\Program Files (x86)\HP
2015-01-10 17:16 - 2012-03-01 02:38 - 00000000 ____D () C:\Program Files (x86)\HP Games
2015-01-10 17:11 - 2009-07-14 00:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2015-01-10 16:59 - 2012-03-01 02:38 - 00000000 ____D () C:\ProgramData\WildTangent
2015-01-10 16:55 - 2009-07-14 00:13 - 00783334 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-01-10 16:53 - 2013-12-07 19:50 - 00000000 ____D () C:\Users\Komal Y Date CPA\AppData\Roaming\WildTangent
2015-01-10 16:38 - 2012-03-01 02:54 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP Help and Support
2015-01-10 16:36 - 2012-07-22 10:33 - 00000000 ____D () C:\Users\Komal Y Date CPA\AppData\Roaming\hpqlog
2015-01-10 16:36 - 2012-03-01 02:34 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Productivity and Tools
2015-01-10 16:36 - 2011-10-12 19:57 - 00000000 ____D () C:\Program Files\Hewlett-Packard
2015-01-10 16:35 - 2012-03-01 02:33 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\eReaders and Document Viewers
2015-01-10 16:33 - 2009-07-13 22:20 - 00000000 ____D () C:\Windows\Resources
2015-01-10 16:19 - 2012-11-14 07:25 - 00000000 ____D () C:\found.000
2015-01-10 16:19 - 2012-11-05 15:09 - 00000000 ____D () C:\Windows\Minidump
2015-01-10 15:38 - 2014-11-03 07:51 - 00000000 ____D () C:\Program Files (x86)\NTI
2015-01-10 15:09 - 2014-04-28 06:16 - 00000000 ____D () C:\MWACCT
2015-01-08 21:12 - 2012-07-22 11:40 - 00000000 ____D () C:\Users\Komal Y Date CPA\F
2015-01-07 18:54 - 2012-07-22 13:14 - 00000000 ____D () C:\Users\Komal Y Date CPA\AppData\Roaming\Skype
2015-01-06 23:21 - 2014-06-20 07:53 - 00000000 ____D () C:\Ishita
2015-01-06 15:06 - 2012-07-22 13:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Drake Software
2015-01-03 20:37 - 2012-11-19 12:30 - 00000000 ____D () C:\Users\Komal Y Date CPA\Documents\qb data
2015-01-01 12:02 - 2012-07-07 17:55 - 00000000 ____D () C:\Users\Komal Y Date CPA
2014-12-27 09:53 - 2013-11-14 15:22 - 00000000 __SHD () C:\Users\Komal Y Date CPA\Documents\cache
2014-12-27 09:28 - 2013-11-14 15:22 - 00000000 ____D () C:\Users\Komal Y Date CPA\AppData\Roaming\webex
2014-12-26 10:57 - 2009-07-13 23:45 - 00506840 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-12-23 20:54 - 2012-07-22 10:36 - 00143264 _____ () C:\Users\Komal Y Date CPA\AppData\Local\GDIPFONTCACHEV1.DAT
2014-12-23 14:55 - 2014-12-06 22:28 - 00000000 ____D () C:\CWU2014
2014-12-20 09:32 - 2014-11-22 09:02 - 00000000 ____D () C:\Users\Komal Y Date CPA\AppData\Local\WebEx

Some content of TEMP:
====================
C:\Users\Komal Y Date CPA\AppData\Local\Temp\ose00000.exe

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2015-01-16 07:31

Addition.txt is blank

Attachments:

OCD

Post #2January 17, 2015, 4:58 AM UTC

Hi naah,

My name is OCD. I would be more than happy to take a look at your log and help you with solving any malware problems you might have. Logs can take a while to research, so please be patient and know that I am working hard to get you a clean and functional system back in your hands. I'd be grateful if you would note the following:

I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
The fixes are specific to your problem and should only be used for the issues on this machine.
Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
It's often worth reading through these instructions and printing them for ease of reference.
If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
Please reply to this thread. Do not start a new topic.
Copy and Paste logs directly into the reply window. DO NOT attach the logs unless specifically instructed to do so.

IMPORTANT NOTE : Please do not delete, download or install anything unless instructed to do so.

DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision. Doing so could make your system inoperable and could require a full reinstall of your Operating System and losing all your programs and data.

Please stay with this topic until I let you know that your system appears to be "All Clear"

Important: All tools MUST be run from the Desktop.

=========================

[external image: bullseye_zpse9eaf36e.gif] Security Check

Download Security Check by screen317 from here or here.

Save it to your Desktop.
- Windows XP : Double click on the icon to run it.
- Windows Vista, Windows 7 & 8 : Right click and select "Run as Administrator"
A Notepad document should open automatically called checkup.txt; please post the contents of that document.

=========================

[external image: bullseye_zpse9eaf36e.gif] AdwCleaner: Scan & Clean

- Windows XP : Double click on the icon to run it.
- Windows Vista, Windows 7 & 8 : Right click and select "Run as Administrator"
Click on the Scan button.
AdwCleaner will begin to scan your computer like it did before.
After the scan has finished…
Click on the Clean button.
Press OK when asked to close all programs and follow the onscreen prompts.
Press OK again to allow AdwCleaner to restart the computer and complete the removal process.
After rebooting, a log file report (AdwCleaner[S0].txt) will open automatically.
Copy and paste the contents of that log file in your next reply.
A copy of that log file will also be saved in the C:\AdwCleaner folder.

=========================

[external image: bullseye_zpse9eaf36e.gif] Junkware Removal Tool

Download Junkware Removal Tool to your desktop.

- Windows XP : Double click on the icon to run it.
- Windows Vista, Windows 7 & 8 : Right click and select "Run as Administrator"
Shut down your protection software now to avoid potential conflicts.
The tool will open and start scanning your system.
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next message.

=========================

[external image: bullseye_zpse9eaf36e.gif] Re-run Farbar Recovery Scan Tool it should be on your desktop.

- Windows XP : Double click on the icon to run it.
- Windows Vista, Windows 7 & 8 : Right click and select "Run as Administrator"
When the tool opens click Yes to disclaimer.
Press Scan button.
It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.

=========================

In your next post please provide the following:

checkup.txt
AdwCleaner[S0].txt
JRT.txt
new FRST.txt

naah

Post #3January 17, 2015, 3:30 PM UTC

Hello

Thank you for your help.

I ran the utilities you mentioned. Below are the results. I am also attaching the files

Checkup.txt -

Results of screen317's Security Check version 0.99.93
Windows 7 Service Pack 1 x64 (UAC is disabled!)
Internet Explorer 11
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Enabled!
McAfee Anti-Virus and Anti-Spyware
WMI entry may not exist for antivirus; attempting automatic update.
`````````Anti-malware/Other Utilities Check:`````````
McAfee SiteAdvisor
Adobe Flash Player 11.8.800.94 Flash Player out of Date!
Adobe Reader XI
````````Process Check: objlist.exe by Laurent````````
McAfee VirusScan mcods.exe
Komal Y Date CPA AppData Local Microsoft\Windows\Temporary Internet Files\Content.IE5\TGYYWIS8\aswMBR.exe
Komal Y Date CPA Desktop SecurityCheck.exe
KOMALY~1 AppData Local Temp\RarSFX0\SecurityCheck\Objlist.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: 0%
````````````````````End of Log``````````````````````

_____________________________________________________________

Adwcleaner.txt

# AdwCleaner v4.108 - Report created 17/01/2015 at 09:54:30
# Updated 17/01/2015 by Xplode
# Database : 2015-01-13.2 [Live]
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
# Username : Komal Y Date CPA - KOMALYDATECPA
# Running from : C:\Users\Komal Y Date CPA\Desktop\AdwCleaner.exe
# Option : Clean

***** [ Services ] *****

Service Deleted : CltMngSvc
Service Deleted : SPPD
Service Deleted : Orbiter
[#] Service Deleted : Util neurowise
[#] Service Deleted : Update neurowise

***** [ Files / Folders ] *****

Folder Deleted : C:\Program Files (x86)\SearchProtect
[!] Folder Deleted : C:\Program Files (x86)\ORBTR
Folder Deleted : C:\Program Files (x86)\neurowise
Folder Deleted : C:\Users\KOMALY~1\AppData\Local\Temp\neurowise
Folder Deleted : C:\Users\Komal Y Date CPA\AppData\Local\SearchProtect
File Deleted : C:\Windows\System32\roboot64.exe
File Deleted : C:\Users\Komal Y Date CPA\Desktop\Live PC Help.lnk
File Deleted : C:\Users\Komal Y Date CPA\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.ask.com_0.localstorage
File Deleted : C:\Users\Komal Y Date CPA\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.ask.com_0.localstorage-journal

***** [ Scheduled Tasks ] *****

***** [ Shortcuts ] *****

***** [ Registry ] *****

Key Deleted : HKCU\Software\MICROSOFT\INTERNET EXPLORER\DOMSTORAGE\superfish.com
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\DOMStorage\www.superfish.com
Key Deleted : HKLM\SOFTWARE\Classes\protector_dll.protectorbho
Key Deleted : HKLM\SOFTWARE\Classes\protector_dll.protectorbho.1
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{4AA46D49-459F-4358-B4D1-169048547C23}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{6E993643-8FBC-44FE-BC85-D318495C4D96}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{4AA46D49-459F-4358-B4D1-169048547C23}
Key Deleted : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}
Key Deleted : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{D43B3890-80C7-4010-A95D-1E77B5924DC3}
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{D43B3890-80C7-4010-A95D-1E77B5924DC3}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827}
Key Deleted : HKLM\SOFTWARE\SearchProtect
Key Deleted : HKLM\SOFTWARE\ORBTR
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchProtect
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{ac225167-00fc-452d-94c5-bb93600e7d9a}
Data Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows [AppInit_DLLs] - C:\PROGRA~2\SearchProtect\SearchProtect\bin\VC32Loader.dll
Data Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows [AppInit_DLLs] - C:\PROGRA~2\SearchProtect\SearchProtect\bin\VC64Loader.dll

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.17496

-\\ Google Chrome v

[C:\Users\Komal Y Date CPA\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [Search Provider] : hxxp://search.aol.com/aol/search?q={searchTerms}
[C:\Users\Komal Y Date CPA\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [Search Provider] : hxxp://www.ask.com/web?q={searchTerms}

*************************

AdwCleaner[R0].txt - [4186 octets] - [17/01/2015 09:48:50]
AdwCleaner[S0].txt - [3824 octets] - [17/01/2015 09:54:30]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [3884 octets] ##########

_____________________________________________________________

JRT.txt

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.4.1 (12.28.2014:1)
OS: Windows 7 Home Premium x64
Ran by [removed] on Sat 01/17/2015 at 10:08:47.95
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Registry Values

~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}

~~~ Files

~~~ Folders

Successfully deleted: [Empty Folder] C:\Users\Komal Y Date CPA\appdata\local\{1E6F6032-280F-468D-8FD0-E0A9AB816411}
Successfully deleted: [Empty Folder] C:\Users\Komal Y Date CPA\appdata\local\{2673F619-7606-4936-9A3A-038173D321BC}
Successfully deleted: [Empty Folder] C:\Users\Komal Y Date CPA\appdata\local\{2D338BBB-E874-4475-BDC1-A3E78E4474A7}
Successfully deleted: [Empty Folder] C:\Users\Komal Y Date CPA\appdata\local\{5A7D26F8-3473-45F6-B5AB-FF0A4D316D74}
Successfully deleted: [Empty Folder] C:\Users\Komal Y Date CPA\appdata\local\{A348A91F-62E9-4EBF-8587-A1F2CBF9DC91}
Successfully deleted: [Empty Folder] C:\Users\Komal Y Date CPA\appdata\local\{C712AB28-7524-44A2-9535-25762000F4EE}

~~~ Event Viewer Logs were cleared

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Sat 01/17/2015 at 10:15:04.44
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

_____________________________________________________________________________

FRST.TXT

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 17-01-2015 01
Ran by [removed] (administrator) on KOMALYDATECPA on 17-01-2015 10:18:09
Running from C:\Users\[removed]\Desktop
[removed] Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: English (United States)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
(Hewlett-Packard Company) C:\Windows\System32\hpservice.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(ArcSoft Inc.) C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(HP) C:\Program Files (x86)\HP\HPLaserJetService\HPLaserJetService.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe
(HP) C:\Program Files\HP\HP LaserJet M1210 MFP Series\ReceiveFaxUtility.exe
(HP) C:\Windows\System32\HPSIsvc.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn\x64\ramaint.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee\SiteAdvisor\mcsacore.exe
(McAfee, Inc.) C:\Windows\System32\mfevtps.exe
(Intuit) C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
(Intuit Inc.) C:\Program Files (x86)\Common Files\Intuit\DataProtect\QBIDPService.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn\x64\LogMeIn.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(McAfee, Inc.) C:\Program Files\McAfee\MSC\McAPExe.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\AMCore\mcshield.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe
(Intuit Inc.) C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
(ArcSoft Inc.) C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
(Hewlett-Packard Company) C:\Program Files (x86)\HP\HP UT LEDM\bin\hppusg.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\Platform\McUICnt.exe
(CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(ArcSoft, Inc.) C:\Program Files (x86)\ArcSoft\TotalMedia Backup\uBBMonitor.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Intuit, Inc.) C:\Program Files (x86)\Intuit\QuickBooks 2013\QBDBMgrN.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\…\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2832168 2011-09-30] (Synaptics Incorporated)
HKLM\…\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [1425408 2012-01-04] (IDT, Inc.)
HKLM\…\Run: [SetDefault] => C:\Program Files\Hewlett-Packard\HP LaunchBox\SetDefault.exe [44880 2011-12-20] (Hewlett-Packard Development Company, L.P.)
HKLM\…\Run: [LogMeIn GUI] => C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe [57928 2012-11-29] (LogMeIn, Inc.)
HKLM-x32\…\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [630912 2012-02-10] (Advanced Micro Devices, Inc.)
HKLM-x32\…\Run: [HPOSD] => C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe [379960 2011-08-19] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\…\Run: [mcui_exe] => C:\Program Files\McAfee.com\Agent\mcagent.exe [537992 2014-04-25] (McAfee, Inc.)
HKLM-x32\…\Run: [ArcSoft Connection Service] => C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe [207424 2010-10-27] (ArcSoft Inc.)
HKLM-x32\…\Run: [] => [X]
HKLM-x32\…\Run: [HPUsageTrackingLEDM] => C:\Program Files (x86)\HP\HP UT LEDM\bin\hppusg.exe [30264 2009-10-15] (Hewlett-Packard Company)
HKLM-x32\…\Run: [Intuit SyncManager] => C:\Program Files (x86)\Common Files\Intuit\Sync\IntuitSyncManager.exe [3774776 2014-01-16] (Intuit Inc. All rights reserved.)
HKLM-x32\…\Run: [HP Quick Launch] => C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [578944 2012-03-05] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\…\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [60712 2014-10-11] (Apple Inc.)
HKLM-x32\…\Run: [mcpltui_exe] => C:\Program Files\McAfee.com\Agent\mcagent.exe [537992 2014-04-25] (McAfee, Inc.)
HKLM-x32\…\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [157480 2014-10-15] (Apple Inc.)
HKLM\…\RunOnce: [NCPluginUpdater] => C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\NCPluginUpdater.exe [21720 2014-12-16] (Hewlett-Packard)
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Symantec <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files\McAfee <====== ATTENTION
HKLM\…\Policies\Explorer: [NoControlPanel] 0
HKLM\…\Policies\Explorer: [NoFolderOptions] 0
HKU\S-1-5-21-1386202753-562040-1781798146-1001\…\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [43816 2014-10-17] (Apple Inc.)
HKU\S-1-5-21-1386202753-562040-1781798146-1001\…\Policies\Explorer: [NoFolderOptions] 0
HKU\S-1-5-21-1386202753-562040-1781798146-1001\…\Policies\Explorer: [NoControlPanel] 0
HKU\S-1-5-21-1386202753-562040-1781798146-1001\…\MountPoints2: {60353a37-7d23-11e2-b42d-a0b3cc736570} - F:\DTLplus_Launcher.exe
HKU\S-1-5-18\…\RunOnce: [{91120000-0014-0000-0000-0000000FF1CE}] => C:\Windows\system32\cmd.exe /C del "C:\ProgramData\Microsoft Help\Rgstrtn.lck" /Q /A:H
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Intuit Data Protect.lnk
ShortcutTarget: Intuit Data Protect.lnk -> C:\Program Files (x86)\Common Files\Intuit\DataProtect\IntuitDataProtect.exe (Intuit Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk
ShortcutTarget: QuickBooks Update Agent.lnk -> C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe (Intuit Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\QuickBooks_Standard_21.lnk
ShortcutTarget: QuickBooks_Standard_21.lnk -> C:\Program Files (x86)\Intuit\QuickBooks 2013\QBW32.EXE (Intuit Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\TotalMedia Backup Monitor.lnk
ShortcutTarget: TotalMedia Backup Monitor.lnk -> C:\Program Files (x86)\ArcSoft\TotalMedia Backup\uBBMonitor.exe (ArcSoft, Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-1386202753-562040-1781798146-1001\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-1386202753-562040-1781798146-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/HPNOT/1
HKU\S-1-5-21-1386202753-562040-1781798146-1005\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-1386202753-562040-1781798146-1005\Software\Microsoft\Internet Explorer\Main,First Home Page = http://g.msn.com/HPNOT/1
HKU\S-1-5-21-1386202753-562040-1781798146-1005\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/HPNOT/1
SearchScopes: HKLM -> {CB35D052-ADB4-4701-988F-01259B2F5C00} URL = http://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us2-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.com/rover/1/711-30572-11896-2/4?mpre=http://www.ebay.com/sch/i.html?_nkw={searchTerms}
SearchScopes: HKLM-x32 -> {CB35D052-ADB4-4701-988F-01259B2F5C00} URL = http://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us2-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM-x32 -> {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = http://en.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKLM-x32 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.com/rover/1/711-30572-11896-2/4?mpre=http://www.ebay.com/sch/i.html?_nkw={searchTerms}
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-1386202753-562040-1781798146-1001 -> DefaultScope {48D7B374-8777-4072-A3AB-C9DAE76172D9} URL = https://search.yahoo.com/search?fr=mcafee&type=B011US714D20120722&p={SearchTerms}
SearchScopes: HKU\S-1-5-21-1386202753-562040-1781798146-1001 -> {48D7B374-8777-4072-A3AB-C9DAE76172D9} URL = https://search.yahoo.com/search?fr=mcafee&type=B011US714D20120722&p={SearchTerms}
SearchScopes: HKU\S-1-5-21-1386202753-562040-1781798146-1001 -> {A38F2B5C-DC4A-484F-B763-EC7FA66672D2} URL = https://www.google.com/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-1386202753-562040-1781798146-1001 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL =
SearchScopes: HKU\S-1-5-21-1386202753-562040-1781798146-1005 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-1386202753-562040-1781798146-1005 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-1386202753-562040-1781798146-1005 -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = http://search.ask.com/web?q={searchterms}&l=dis&o=HPNTDF
SearchScopes: HKU\S-1-5-21-1386202753-562040-1781798146-1005 -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = http://search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKU\S-1-5-21-1386202753-562040-1781798146-1005 -> {CB35D052-ADB4-4701-988F-01259B2F5C00} URL = http://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us2-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKU\S-1-5-21-1386202753-562040-1781798146-1005 -> {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = http://en.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKU\S-1-5-21-1386202753-562040-1781798146-1005 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.com/rover/1/711-30572-11896-2/4?mpre=http://www.ebay.com/sch/i.html?_nkw={searchTerms}
BHO: SteadyVideoBHO Class -> {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} -> C:\Program Files\AMD\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
BHO: McAfee SiteAdvisor BHO -> {B164E929-A1B6-4A06-B104-2CD0E90A88FF} -> c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll (Hewlett-Packard)
BHO-x32: SteadyVideoBHO Class -> {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} -> C:\Program Files (x86)\amd\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
BHO-x32: McAfee SiteAdvisor BHO -> {B164E929-A1B6-4A06-B104-2CD0E90A88FF} -> c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
BHO-x32: neurowise 1.0.0.6 -> {d08ab008-0647-4784-8e2c-5769cd4a7c3a} -> C:\Program Files (x86)\neurowise\neurowisebho.dll No File
BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
Toolbar: HKLM - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKU\S-1-5-21-1386202753-562040-1781798146-1001 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
DPF: HKLM-x32 {E06E2E99-0AA1-11D4-ABA6-0060082AA75C}
Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
Handler-x32: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
Handler-x32: intu-help-qb4 - {ACE22922-D07C-4860-B51B-8CF472FEC2CB} - C:\Program Files (x86)\Intuit\QuickBooks 2011\HelpAsyncPluggableProtocol.dll (Intuit, Inc.)
Handler-x32: intu-help-qb6 - {6898B29B-BF49-43cb-A0B1-D0B9496AF491} - C:\Program Files (x86)\Intuit\QuickBooks 2013\HelpAsyncPluggableProtocol.dll (Intuit, Inc.)
Handler-x32: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation)
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
Handler-x32: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files\McAfee\MSC\McSnIePl64.dll (McAfee, Inc.)
Filter-x32: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files (x86)\McAfee\MSC\McSnIePl.dll (McAfee, Inc.)
Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter-x32: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter-x32: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Tcpip\Parameters: [DhcpNameServer] 75.75.75.75 75.75.76.76

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [361984 2012-02-10] (Advanced Micro Devices, Inc.) [File not signed]
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)
R2 HomeNetSvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
R2 HP LaserJet Service; C:\Program Files (x86)\HP\HPLaserJetService\HPLaserJetService.exe [136192 2009-10-15] (HP) [File not signed]
R2 HP Support Assistant Service; C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [92160 2013-11-04] (Hewlett-Packard Company) [File not signed]
R2 HPM1210RcvFaxSrvc; C:\Program Files\HP\HP LaserJet M1210 MFP Series\ReceiveFaxUtility.exe [362296 2010-05-11] (HP)
R2 LMIGuardianSvc; C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe [376168 2014-11-25] (LogMeIn, Inc.)
R2 LMIMaint; C:\Program Files (x86)\LogMeIn\x64\RaMaint.exe [226152 2014-11-25] (LogMeIn, Inc.)
R2 LogMeIn; C:\Program Files (x86)\LogMeIn\x64\LogMeIn.exe [407424 2012-11-29] (LogMeIn, Inc.)
R2 McAfee SiteAdvisor Service; C:\Program Files (x86)\McAfee\SiteAdvisor\McSACore.exe [156904 2014-11-13] (McAfee, Inc.)
R2 McAPExe; C:\Program Files\McAfee\MSC\McAPExe.exe [178528 2014-04-25] (McAfee, Inc.)
R2 McMPFSvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
R2 McNaiAnn; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
S3 McODS; C:\Program Files\McAfee\VirusScan\mcods.exe [603424 2014-09-04] (McAfee, Inc.)
R2 mcpltsvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
R2 McProxy; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
R2 mfecore; C:\Program Files\Common Files\McAfee\AMCore\mcshield.exe [1041192 2014-08-20] (McAfee, Inc.)
R2 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [219752 2014-06-20] (McAfee, Inc.)
R2 mfevtp; C:\Windows\system32\mfevtps.exe [189912 2014-06-20] (McAfee, Inc.)
R2 QBCFMonitorService; C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe [45056 2014-01-16] (Intuit) [File not signed]
S3 QBFCService; C:\Program Files (x86)\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe [61440 2009-07-23] (Intuit Inc.) [File not signed]
R2 QBVSS; C:\Program Files (x86)\Common Files\Intuit\DataProtect\QBIDPService.exe [1248256 2012-03-09] (Intuit Inc.) [File not signed]
S4 QuickBooksDB21; C:\Program Files (x86)\Intuit\QuickBooks 2011\QBDBMgrN.exe [679936 2010-04-27] (Intuit, Inc.) [File not signed]
R3 QuickBooksDB23; C:\Program Files (x86)\Intuit\QuickBooks 2013\QBDBMgrN.exe [679936 2013-03-11] (Intuit, Inc.) [File not signed]
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)

==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-17 10:18 - 2015-01-17 10:18 - 00000000 ____D () C:\Users\Komal Y Date CPA\Desktop\FRST-OlderVersion
2015-01-17 10:15 - 2015-01-17 10:15 - 00001496 _____ () C:\Users\Komal Y Date CPA\Desktop\JRT.txt
2015-01-17 10:08 - 2015-01-17 10:08 - 00000000 ____D () C:\Windows\ERUNT
2015-01-17 10:07 - 2015-01-17 10:07 - 01707939 _____ (Thisisu) C:\Users\Komal Y Date CPA\Desktop\JRT.exe
2015-01-17 10:05 - 2015-01-17 10:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee
2015-01-17 10:01 - 2015-01-17 10:01 - 00004000 _____ () C:\Users\Komal Y Date CPA\Desktop\AdwCleaner[S0].txt
2015-01-17 09:48 - 2015-01-17 09:55 - 00000000 ____D () C:\AdwCleaner
2015-01-17 09:45 - 2015-01-17 09:45 - 02186752 _____ () C:\Users\Komal Y Date CPA\Desktop\AdwCleaner.exe
2015-01-17 09:39 - 2015-01-17 09:39 - 00001089 _____ () C:\Users\Komal Y Date CPA\Desktop\checkup.txt
2015-01-17 09:38 - 2015-01-17 09:38 - 00001089 _____ () C:\Users\Komal Y Date CPA\Documents\checkup.txt
2015-01-17 09:00 - 2015-01-17 09:00 - 00852504 _____ () C:\Users\Komal Y Date CPA\Desktop\SecurityCheck.exe
2015-01-16 15:31 - 2015-01-16 15:35 - 00033040 _____ () C:\Users\Komal Y Date CPA\Desktop\Addition.txt
2015-01-16 15:25 - 2015-01-17 10:18 - 00028953 _____ () C:\Users\Komal Y Date CPA\Desktop\FRST.txt
2015-01-16 15:24 - 2015-01-17 10:18 - 02125824 _____ (Farbar) C:\Users\Komal Y Date CPA\Desktop\FRST64.exe
2015-01-16 15:24 - 2015-01-17 10:18 - 00000000 ____D () C:\FRST
2015-01-16 15:18 - 2015-01-16 15:18 - 00002427 _____ () C:\Users\Komal Y Date CPA\Desktop\aswMBR.txt
2015-01-16 15:18 - 2015-01-16 15:18 - 00000512 _____ () C:\Users\Komal Y Date CPA\Desktop\MBR.dat
2015-01-14 09:10 - 2014-12-12 00:11 - 03971512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-01-14 09:10 - 2014-12-12 00:11 - 03916728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-01-14 09:10 - 2014-12-12 00:07 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-01-14 09:09 - 2014-12-12 00:35 - 05553592 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-01-14 09:09 - 2014-12-12 00:31 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-01-14 09:09 - 2014-12-12 00:31 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-01-14 09:09 - 2014-12-12 00:31 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-01-13 16:03 - 2014-12-18 22:06 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2015-01-13 16:03 - 2014-12-18 20:46 - 00141312 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2015-01-13 16:03 - 2014-12-11 12:47 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2015-01-13 16:03 - 2014-12-05 23:17 - 00303616 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll
2015-01-13 16:03 - 2014-12-05 22:50 - 00156672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncsi.dll
2015-01-13 16:03 - 2014-12-05 22:50 - 00052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll
2015-01-13 16:03 - 2012-10-03 12:44 - 00216576 _____ (Microsoft Corporation) C:\Windows\system32\ncsi.dll
2015-01-13 16:03 - 2012-10-03 12:44 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\nlaapi.dll
2015-01-13 11:38 - 2015-01-13 16:16 - 00000000 ____D () C:\Windows\system32\MpEngineStore
2015-01-10 17:18 - 2015-01-10 17:18 - 00000000 ____D () C:\Users\Komal Y Date CPA\AppData\Roaming\Roxio Log Files
2015-01-10 16:46 - 2015-01-17 09:59 - 00000728 _____ () C:\Windows\setupact.log
2015-01-10 16:46 - 2015-01-10 16:46 - 00000000 _____ () C:\Windows\setuperr.log
2015-01-10 16:11 - 2015-01-10 16:12 - 00000000 ____D () C:\Users\Komal Y Date CPA\AppData\Roaming\K9AMW
2015-01-06 15:06 - 2015-01-06 15:06 - 00000590 _____ () C:\Users\QBDataServiceUser23\Desktop\Drake 2015 CWU - C Drive.Lnk
2015-01-06 15:06 - 2015-01-06 15:06 - 00000590 _____ () C:\Users\QBDataServiceUser21\Desktop\Drake 2015 CWU - C Drive.Lnk
2015-01-06 15:06 - 2015-01-06 15:06 - 00000590 _____ () C:\Users\Komal Y Date CPA\Desktop\Drake 2015 CWU - C Drive.Lnk
2015-01-06 15:05 - 2015-01-06 15:24 - 00000000 ____D () C:\CWU2015
2015-01-04 10:15 - 2015-01-04 10:15 - 04996096 _____ () C:\Users\Komal Y Date CPA\Desktop\M3 Logix (Backup Dec 31,2014).QBB
2015-01-02 17:01 - 2015-01-02 17:01 - 00393728 _____ () C:\Users\Komal Y Date CPA\Desktop\M3 Logix (Acct Transfer Jan 02,2015 04 05 PM).QBX
2014-12-23 09:30 - 2014-12-23 09:30 - 00003886 _____ () C:\Windows\System32\Tasks\Adobe Acrobat Update Task
2014-12-20 09:32 - 2014-12-20 09:32 - 00000000 ____D () C:\Users\Komal Y Date CPA\AppData\Roaming\Mozilla

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-17 10:10 - 2009-07-13 23:45 - 00031472 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-01-17 10:10 - 2009-07-13 23:45 - 00031472 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-01-17 10:00 - 2012-07-07 23:38 - 01301558 _____ () C:\Windows\WindowsUpdate.log
2015-01-17 09:59 - 2014-08-05 10:48 - 00065536 _____ () C:\Windows\system32\Ikeext.etl
2015-01-17 09:59 - 2014-01-28 08:53 - 00000964 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Client.lnk
2015-01-17 09:59 - 2014-01-28 08:53 - 00000948 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Control Panel.lnk
2015-01-17 09:59 - 2012-10-22 06:28 - 00000894 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-01-17 09:59 - 2010-11-20 22:47 - 00922736 _____ () C:\Windows\PFRO.log
2015-01-17 09:59 - 2009-07-14 00:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-01-17 09:53 - 2012-10-22 06:28 - 00000898 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-01-17 09:45 - 2009-07-14 00:13 - 00783334 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-01-17 09:45 - 2009-07-13 22:20 - 00000000 ____D () C:\Windows\tracing
2015-01-17 09:42 - 2014-07-29 09:50 - 00000560 _____ () C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-1386202753-562040-1781798146-1001.job
2015-01-17 09:41 - 2009-07-13 22:20 - 00000000 ____D () C:\Windows\system32\NDF
2015-01-17 09:15 - 2012-07-22 10:35 - 00003990 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{A4073903-C70C-427D-929F-E3DA80EF19FA}
2015-01-17 08:56 - 2013-04-09 07:44 - 00000000 ____D () C:\ProgramData\LogMeIn
2015-01-13 21:13 - 2013-10-12 15:39 - 00000000 ____D () C:\Windows\system32\MRT
2015-01-13 21:00 - 2013-10-12 15:39 - 113365784 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-01-13 15:58 - 2012-07-23 20:28 - 00000000 ____D () C:\Users\Komal Y Date CPA\AppData\Local\CutePDF Writer
2015-01-13 14:38 - 2012-07-22 11:11 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-01-13 12:13 - 2012-07-24 16:02 - 00000000 ____D () C:\Users\Komal Y Date CPA\AppData\Local\CrashDumps
2015-01-13 11:55 - 2013-01-22 21:53 - 00000000 _____ () C:\Windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt
2015-01-13 11:55 - 2012-07-24 15:35 - 00000052 _____ () C:\Windows\SysWOW64\DOErrors.log
2015-01-13 11:42 - 2012-07-22 11:05 - 00000000 ____D () C:\Program Files (x86)\McAfee
2015-01-10 17:39 - 2012-03-01 02:46 - 00000000 ____D () C:\Program Files (x86)\Microsoft Office
2015-01-10 17:24 - 2012-03-01 02:29 - 00000000 ____D () C:\Program Files (x86)\Hewlett-Packard
2015-01-10 17:18 - 2012-07-22 12:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP
2015-01-10 17:18 - 2012-07-22 11:59 - 00000000 ____D () C:\Program Files (x86)\HP
2015-01-10 17:16 - 2012-03-01 02:38 - 00000000 ____D () C:\Program Files (x86)\HP Games
2015-01-10 17:11 - 2009-07-14 00:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2015-01-10 16:59 - 2012-03-01 02:38 - 00000000 ____D () C:\ProgramData\WildTangent
2015-01-10 16:53 - 2013-12-07 19:50 - 00000000 ____D () C:\Users\Komal Y Date CPA\AppData\Roaming\WildTangent
2015-01-10 16:38 - 2012-03-01 02:54 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP Help and Support
2015-01-10 16:36 - 2012-07-22 10:33 - 00000000 ____D () C:\Users\Komal Y Date CPA\AppData\Roaming\hpqlog
2015-01-10 16:36 - 2012-03-01 02:34 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Productivity and Tools
2015-01-10 16:36 - 2011-10-12 19:57 - 00000000 ____D () C:\Program Files\Hewlett-Packard
2015-01-10 16:35 - 2012-03-01 02:33 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\eReaders and Document Viewers
2015-01-10 16:33 - 2009-07-13 22:20 - 00000000 ____D () C:\Windows\Resources
2015-01-10 16:19 - 2012-11-14 07:25 - 00000000 ____D () C:\found.000
2015-01-10 16:19 - 2012-11-05 15:09 - 00000000 ____D () C:\Windows\Minidump
2015-01-10 15:38 - 2014-11-03 07:51 - 00000000 ____D () C:\Program Files (x86)\NTI
2015-01-10 15:09 - 2014-04-28 06:16 - 00000000 ____D () C:\MWACCT
2015-01-08 21:12 - 2012-07-22 11:40 - 00000000 ____D () C:\Users\Komal Y Date CPA\F
2015-01-07 18:54 - 2012-07-22 13:14 - 00000000 ____D () C:\Users\Komal Y Date CPA\AppData\Roaming\Skype
2015-01-06 23:21 - 2014-06-20 07:53 - 00000000 ____D () C:\Ishita
2015-01-06 15:06 - 2012-07-22 13:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Drake Software
2015-01-03 20:37 - 2012-11-19 12:30 - 00000000 ____D () C:\Users\Komal Y Date CPA\Documents\qb data
2015-01-01 12:02 - 2012-07-07 17:55 - 00000000 ____D () C:\Users\Komal Y Date CPA
2014-12-27 09:53 - 2013-11-14 15:22 - 00000000 __SHD () C:\Users\Komal Y Date CPA\Documents\cache
2014-12-27 09:28 - 2013-11-14 15:22 - 00000000 ____D () C:\Users\Komal Y Date CPA\AppData\Roaming\webex
2014-12-26 10:57 - 2009-07-13 23:45 - 00506840 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-12-23 20:54 - 2012-07-22 10:36 - 00143264 _____ () C:\Users\Komal Y Date CPA\AppData\Local\GDIPFONTCACHEV1.DAT
2014-12-23 14:55 - 2014-12-06 22:28 - 00000000 ____D () C:\CWU2014
2014-12-20 09:32 - 2014-11-22 09:02 - 00000000 ____D () C:\Users\Komal Y Date CPA\AppData\Local\WebEx

==================== Files in the root of some directories =======
2012-11-16 09:57 - 2012-11-16 09:57 - 0023351 _____ () C:\Users\Komal Y Date CPA\AppData\Roaming\Comma Separated Values (Windows).ADR
2013-05-17 06:18 - 2013-05-17 06:18 - 0007597 _____ () C:\Users\Komal Y Date CPA\AppData\Local\Resmon.ResmonCfg
2013-06-06 20:42 - 2013-06-06 20:42 - 0000217 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.351.64.bc
2013-10-10 17:51 - 2010-03-30 10:12 - 0024772 _____ () C:\ProgramData\P1210DEF.css
2013-10-10 17:51 - 2013-10-10 17:51 - 0015719 _____ () C:\ProgramData\P1210OS.HTM
2013-10-10 17:51 - 2010-03-30 10:12 - 0002944 _____ () C:\ProgramData\P1210SIG.GIF

Some content of TEMP:
====================
C:\Users\Komal Y Date CPA\AppData\Local\Temp\ose00000.exe
C:\Users\Komal Y Date CPA\AppData\Local\Temp\Quarantine.exe
C:\Users\Komal Y Date CPA\AppData\Local\Temp\sqlite3.dll

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

LastRegBack: 2015-01-16 07:31

==================== End Of Log ============================

Thank you for your help

regards

Naah

Attachments:

OCD

Post #4January 18, 2015, 4:05 AM UTC

Hi naah,

[external image: bullseye_zpse9eaf36e.gif] FRST Fix Script

Open notepad. Please copy the contents of the code box below. To do this highlight the contents of the box and right click on it. Paste this into the open notepad. Save it on the desktop as fixlist.txt

Start
CloseProcesses:
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Symantec <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files\McAfee <====== ATTENTION
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-1386202753-562040-1781798146-1005 -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = http://search.ask.co…&l=dis&o=HPNTDF
BHO-x32: neurowise 1.0.0.6 -> {d08ab008-0647-4784-8e2c-5769cd4a7c3a} -> C:\Program Files (x86)\neurowise\neurowisebho.dll No File
Toolbar: HKU\S-1-5-21-1386202753-562040-1781798146-1001 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File
CHR HKU\S-1-5-21-1386202753-562040-1781798146-1001\…\Chrome\Extension: [bmkckgpgekmanipelfidlhmkfcjicion] - No Path
EmptyTemp:
CMD: ipconfig /flushdns
End

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Run FRST and press the Fix button just once and wait.
The tool will make a log (Fixlog.txt) please post it to your reply.

=========================

In your next post please provide the following:

Fixlog.txt
How is the computer running, any symptoms?

naah

Post #5January 19, 2015, 2:16 PM UTC

Thank you for your help. These fixes removed the popups. But I still see some .exe *32 processes active in the pc. CPU utilization is also very high and the computer is slow. I am copying the text file you have asked for. Is there anything else I can do?

thanks

FIXLOG.txt

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 18-01-2015
Ran by [removed] at 2015-01-18 09:28:03 Run:1
Running from C:\Users\[removed]\Desktop
[removed] Boot Mode: Normal
==============================================

Content of fixlist:
*****************
Start
CloseProcesses:
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Symantec <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files\McAfee <====== ATTENTION
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-1386202753-562040-1781798146-1005 -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = http://search.ask.co…&l=dis&o=HPNTDF
BHO-x32: neurowise 1.0.0.6 ->
{d08ab008-0647-4784-8e2c-5769cd4a7c3a} -> C:\Program Files (x86)\neurowise\neurowisebho.dll No File
Toolbar: HKU\S-1-5-21-1386202753-562040-1781798146-1001 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
CHR HKU\S-1-5-21-1386202753-562040-1781798146-1001\…\Chrome\Extension: [bmkckgpgekmanipelfidlhmkfcjicion] - No Path
EmptyTemp:
CMD: ipconfig /flushdns
End

*****************

Processes closed successfully.
HKLM => Group Policy Restriction on software restored successfully.
HKLM => Group Policy Restriction on software restored successfully.
HKLM => Group Policy Restriction on software restored successfully.
HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
HKU\S-1-5-21-1386202753-562040-1781798146-1005\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827} => Key not found.
HKCR\CLSID\{2fa28606-de77-4029-af96-b231e3b8f827} => Key not found.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\BHO-x32: neurowise 1.0.0.6 -> => Key not found.
HKCR\Wow6432Node\CLSID\BHO-x32: neurowise 1.0.0.6 -> => Key not found.
{d08ab008-0647-4784-8e2c-5769cd4a7c3a} -> C:\Program Files (x86)\neurowise\neurowisebho.dll No File => Error: No automatic fix found for this entry.
HKU\S-1-5-21-1386202753-562040-1781798146-1001\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} => value deleted successfully.
HKCR\CLSID\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} => Key not found.
"HKU\S-1-5-21-1386202753-562040-1781798146-1001\SOFTWARE\Google\Chrome\Extensions\bmkckgpgekmanipelfidlhmkfcjicion" => Key deleted successfully.

========= ipconfig /flushdns =========

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

========= End of CMD: =========

EmptyTemp: => Removed 2.6 GB temporary data.

The system needed a reboot.

==== End of Fixlog 09:28:44 ====

Attachments:

📎Fixlog.txt

OCD

Post #6January 19, 2015, 4:27 PM UTC

Hi naah,

But I still see some .exe *32 processes active in the pc.

What are the name of the Processes that are running?

=========================

[external image: bullseye_zpse9eaf36e.gif] Hard Disk Information

Go the Start menu > type "msinfo32" (without quotes) into the search filed.
Open System Summary > expand Components > Storage > Disks
Open notepad, highlight the information in the right window pane, press CTRL + C, the into notepad press CTRL + V
Save as Disk Summary.txt, and post in your next reply.

=========================

In your next post please provide the following:

Disk Summary.txt

naah

Post #7January 19, 2015, 4:48 PM UTC

They are ACDaemon.exe *32 , ACService.exe *32, armsvc.ext *32

thanks

Naah

OCD

Post #8January 19, 2015, 7:00 PM UTC

Hi naah,

These are all legitimate processes.

http://www.bleepingcomputer.com/startups/armsvc.exe-26600.html
http://www.bleepingcomputer.com/startups/ACService.exe-25612.html
http://www.bleepingcomputer.com/startups/ACDaemon.exe-26519.html

Although all are not required to run at start-up.

Please run the Disk Summary step and post the log

naah

Post #9January 19, 2015, 7:48 PM UTC

Hello

Here is Disk Summary.txt

Description Disk drive
Manufacturer (Standard disk drives)
Model ST640LM0 00 HM641JI SATA Disk Device
Bytes/Sector 512
Media Loaded Yes
Media Type Fixed hard disk
Partitions 4
SCSI Bus 0
SCSI Logical Unit 0
SCSI Port 0
SCSI Target ID 0
Sectors/Track 63
Size 596.17 GB (640,132,416,000 bytes)
Total Cylinders 77,825
Total Sectors 1,250,258,625
Total Tracks 19,845,375
Tracks/Cylinder 255
Partition Disk #0, Partition #0
Partition Size 199.00 MB (208,666,624 bytes)
Partition Starting Offset 1,048,576 bytes
Partition Disk #0, Partition #1
Partition Size 575.73 GB (618,189,029,376 bytes)
Partition Starting Offset 209,715,200 bytes
Partition Disk #0, Partition #2
Partition Size 20.14 GB (21,626,880,000 bytes)
Partition Starting Offset 618,398,744,576 bytes
Partition Disk #0, Partition #3
Partition Size 103.00 MB (108,003,328 bytes)
Partition Starting Offset 640,025,624,576 bytes

thanks

Naah

OCD

Post #10January 19, 2015, 8:16 PM UTC

Hi naah,

I apologize for the error in my instructions. I need the System Summary, not the Disk Summary.

[external image: bullseye_zpse9eaf36e.gif] System Summary

Go the Start menu > type "msinfo32" (without quotes) into the search filed.
Open System Summary
Open notepad, highlight the information in the right window pane, press CTRL + C, the into notepad press CTRL + V
Save as System Summary.txt, and post in your next reply.

=========================

In your next post please provide the following:

System Summary.txt

naah

Post #11January 19, 2015, 11:38 PM UTC

Hello

Below is the system summary.txt file

OS Name Microsoft Windows 7 Home Premium
Version 6.1.7601 Service Pack 1 Build 7601
Other OS Description Not Available
OS Manufacturer Microsoft Corporation
System Name KOMALYDATECPA
System Manufacturer Hewlett-Packard
System Model HP Pavilion g6 Notebook PC
System Type x64-based PC
Processor AMD A6-4400M APU with Radeon™ HD Graphics, 2700 Mhz, 2 Core(s), 2 Logical Processor(s)
BIOS Version/Date Insyde F.05, 5/10/2012
SMBIOS Version 2.7
Windows Directory C:\Windows
System Directory C:\Windows\system32
Boot Device \Device\HarddiskVolume1
Locale United States
Hardware Abstraction Layer Version = "6.1.7601.17514"
User Name KomalYDateCPA\Komal Y Date CPA
Time Zone Eastern Standard Time
Installed Physical Memory (RAM) 4.00 GB
Total Physical Memory 3.48 GB
Available Physical Memory 1.82 GB
Total Virtual Memory 6.95 GB
Available Virtual Memory 4.41 GB
Page File Space 3.48 GB
Page File C:\pagefile.sys

thx

OCD

Post #12January 20, 2015, 3:36 AM UTC

Hi naah,

Thanks for that information.

[external image: bullseye_zpse9eaf36e.gif] Malwarebytes' Anti-Malware

Download Malwarebytes' Anti-Malware (save it to your desktop).

- Windows XP : Double click on the icon to run it.
- Windows Vista, Windows 7 & 8 : Right click and select "Run as Administrator"
Select Scan tab.
[external image: MBAMDashboard_zpsddef9b5f.gif]
Select type of scan to perform:
[external image: MBAMScanTab_zps2c5e74bd.gif]
- Threat Scan < — Select this type of scan
- Custom Scan
- Hyper Scan
Next click the Scan button.
When the scan is complete, if no malicious items are found you can close the program.
If malicious items are found be sure that everything is checked, and click Quarantine .
When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot.

=========================

[external image: bullseye_zpse9eaf36e.gif] ESET Online Scanner

*Note:

It is recommended to disable on-board antivirus program and anti-spyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your antivirus along with your anti-spyware programs.

** You need to run your browser with Administrator Rights, to do so right click your browsers short cut and select "Run as Administrator".

= = = = = = = = = = = = = = = = = = = =

Go here to run ESET Online Scanner

(Note: You can use Internet Explorer or FireFox for this scan. If you use FireFox you will be asked to install an additional component. Please allow this.)

Tick the box next to YES, I accept the Terms of Use.
Click Start
When asked, allow the activex control to install
Disable your Antivirus software. You can usually do this with its Notification Tray icon near the clock
Click Start
Make sure that the option "Remove found threats" is Checked, and the option "Scan unwanted applications" is Checked.
Click Scan.
Wait for the scan to finish.
When the scan completes, click List of found threats
click Export to Text file and save the file to your desktop using a unique name, such as ESETScan.
Include the contents of this report in your next reply

Note - when ESET doesn't find any threats, no report will be created.
Push the back button.
Push Finish
Re-enable your Antivirus software.

=========================

In your next post please provide the following:

MBAM log
ESET's log.txt

naah

Post #13January 20, 2015, 5:03 PM UTC

I ran Malwarebytes utility and was able to quarantine the malware. Below is the log.

But I was not able to run ESET online scanner. I used the link you provided but there is no way to run the one time online scanner on their webpage. Can you please check

thanks

Naah

MBAMLOG

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 1/20/2015
Scan Time: 11:04:28 AM
Logfile: malwarebytes log.txt
Administrator: Yes

Version: 2.00.4.1028
Malware Database: v2015.01.20.07
Rootkit Database: v2015.01.14.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: Komal Y Date CPA

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 425072
Time Elapsed: 30 min, 4 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 13
PUP.Optional.Neurowise.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{d08ab008-0647-4784-8e2c-5769cd4a7c3a}, Quarantined, [7b2cab4ee6a330063315bc3156ac05fb],
PUP.Optional.Neurowise.A, HKLM\SOFTWARE\CLASSES\TYPELIB\{724dd777-5654-4d06-b3bc-c2ff56615998}, Quarantined, [7b2cab4ee6a330063315bc3156ac05fb],
PUP.Optional.Neurowise.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{E693A372-A8D4-4CBD-B011-66358BEA2F48}, Quarantined, [7b2cab4ee6a330063315bc3156ac05fb],
PUP.Optional.Neurowise.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{E693A372-A8D4-4CBD-B011-66358BEA2F48}, Quarantined, [7b2cab4ee6a330063315bc3156ac05fb],
PUP.Optional.Neurowise.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{724dd777-5654-4d06-b3bc-c2ff56615998}, Quarantined, [7b2cab4ee6a330063315bc3156ac05fb],
PUP.Optional.Neurowise.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{D08AB008-0647-4784-8E2C-5769CD4A7C3A}, Quarantined, [7b2cab4ee6a330063315bc3156ac05fb],
PUP.Optional.Neurowise.A, HKU\S-1-5-21-1386202753-562040-1781798146-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{D08AB008-0647-4784-8E2C-5769CD4A7C3A}, Quarantined, [7b2cab4ee6a330063315bc3156ac05fb],
PUP.Optional.Neurowise.A, HKU\S-1-5-21-1386202753-562040-1781798146-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{D08AB008-0647-4784-8E2C-5769CD4A7C3A}, Quarantined, [7b2cab4ee6a330063315bc3156ac05fb],
PUP.Optional.SearchProtect, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\INSTALLEDSDB\{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}, Quarantined, [b6f147b27b0edd59ec42658ff90b7987],
PUP.Optional.SearchProtect, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\INSTALLEDSDB\{cf2797aa-b7ec-e311-8ed9-005056c00008}, Quarantined, [66416693e6a389ad77b68d672ed6a45c],
PUP.Optional.Neurowise.A, HKLM\SOFTWARE\WOW6432NODE\neurowise, Quarantined, [b8ef2ccdbccdc37390d3aae59f6429d7],
PUP.Optional.ConduitSearchProtect, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\CltMngSvc, Quarantined, [05a23ebb137650e6c773b4192cd8f808],
PUP.Optional.Neurowise.A, HKU\S-1-5-21-1386202753-562040-1781798146-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\neurowise, Quarantined, [5453e4157f0a91a599cb96f97192a55b],

Registry Values: 0
(No malicious items detected)

Registry Data: 2
Windows.Tool.Disabled, HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS NT\SYSTEMRESTORE|DisableConfig, 1, Good: (0), Bad: (1),Replaced,[5651ad4cf59459dd25cda8f2e02552ae]
Windows.Tool.Disabled, HKLM\SOFTWARE\WOW6432NODE\POLICIES\MICROSOFT\WINDOWS NT\SYSTEMRESTORE|DisableConfig, 1, Good: (0), Bad: (1),Replaced,[693e4eabc1c8bd7938ba633783829769]

Folders: 0
(No malicious items detected)

Files: 3
PUP.Optional.SearchProtect.A, C:\Windows\AppPatch\AppPatch64\VCLdr64.dll, Quarantined, [64436990068354e273904967c73a8977],
PUP.Optional.SearchProtect.A, C:\Windows\AppPatch\nbin\VC32Loader.dll, Quarantined, [268149b03851e74fae55169a9170ce32],
PUP.Optional.SearchProtect, C:\Windows\AppPatch\Custom\Custom64\{cf2797aa-b7ec-e311-8ed9-005056c00008}.sdb, Quarantined, [81263ebbbbceff3741f0ef05fc086799],

Physical Sectors: 0
(No malicious items detected)

(end)

Attachments:

📎mbamlog.txt

OCD

Post #14January 20, 2015, 5:12 PM UTC

Hi naah,

[external image: bullseye_zpse9eaf36e.gif] TrendMicro HouseCall Online Scanner

Go to http://housecall.trendmicro.com/
Download HouseCall - Free Online Scanner
Select get HouseCall Now, save the file to your computer.
Double-click to launch HouseCall
Click Yes for the UAC
Click the Scan Now button
Fix any problems found
Copy and paste the results in your next reply

=========================

In your next post please provide the following:

Housecall results

naah

Post #15January 20, 2015, 6:43 PM UTC

Hello

Housecall scanner did not find any issues. There was not log

Do you think my PC is now free of viruses and malware? Should I carry out any other checks?

thank you for your help

Naah

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

PC slow, Popups, several processes with .exe *32 [Solved]

✨ Ask AI

Ask AI