Spyware / Malware / Virus Removal

CleanerPro and PC Mechanic [Solved]

26 min read

Looking for the outcome? Ask AI

Svinlesha Topic Starter

Post #1January 25, 2015, 4:10 PM UTC

Hi!

My 12 year old son tried to download a WoW client on his computer and has managed to download some malware with it. Afterwards when he started his computer PC Mechanic would run automatically, and then a pop-up for CleanerPro would appear. When he closed the CleanerPro window PC Mechanic popped up again briefly and then the screen turned black. Nothing else happened.

I was able to use f8 to start the computer in safe mode and uninstall PC Mechanic (as if it were a regular program). Still can't get rid of Cleaner Pro that way and discovered that he also has something called Vosteron installed, a browser hijacker. At restart in normal mode Cleaner Pro automatically starts and once again we can't get past the starting pop up.

I've forbidden him from downloading anything from here on out, granted this is a bit like closing the gate after the horse got out. But in the meantime, we would appreaciate any and all help. Thanks in advance,

Tim and Isaac

OCD

Post #2January 26, 2015, 3:18 AM UTC

Hi Svinlesha,

My name is OCD. I would be more than happy to take a look at your log and help you with solving any malware problems you might have. Logs can take a while to research, so please be patient and know that I am working hard to get you a clean and functional system back in your hands. I'd be grateful if you would note the following:

I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
The fixes are specific to your problem and should only be used for the issues on this machine.
Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
It's often worth reading through these instructions and printing them for ease of reference.
If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
Please reply to this thread. Do not start a new topic.
Copy and Paste logs directly into the reply window. DO NOT attach the logs unless specifically instructed to do so.

IMPORTANT NOTE : Please do not delete, download or install anything unless instructed to do so.

DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision. Doing so could make your system inoperable and could require a full reinstall of your Operating System and losing all your programs and data.

Please stay with this topic until I let you know that your system appears to be "All Clear"

Important: All tools MUST be run from the Desktop.

=========================

Since booting in Normal Mode prompts the Cleaner Pro program to load, boot in Safe Mode w/ Networking and download the following tools and run the scans requested.

=========================

[external image: bullseye_zpse9eaf36e.gif] aswMBR

Download aswMBR.exe and save it to your desktop.

- Windows XP : Double click on the icon to run it.
- Windows Vista, Windows 7 & 8 : Right click and select "Run as Administrator"
When asked if you want to download Avast's virus definitions please select Yes.
Click Scan
Upon completion of the scan, click Save log and save it to your desktop, and post that log in your next reply for review. Note - do NOT attempt any Fix yet.
You will also notice another file created on the desktop named MBR.dat. Right click that file and select Send To>Compressed (zipped) file. Attach that zipped file in your next reply as well.

=========================

[external image: bullseye_zpse9eaf36e.gif] Download Farbar Recovery Scan Tool and save to your desktop.

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

Right click and select "Run as Administrator" to run it. When the tool opens click Yes to disclaimer.
Press Scan button.
It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply

=========================

In your next post please provide the following:

aswMBR.txt
attach MBR.zip
FRST.txt
Addition.txt

Svinlesha

Post #3January 27, 2015, 5:35 PM UTC last edited January 27, 2015, 5:39 PM UTC

Hi OCD!

1) Thank you very much for taking out the time to help us!

2) I'm posting this now from my son's computer in safemode. Note that we are in Sweden and that some of the items in the logs may be in Swedish.

Here is the text of the aswMBR log:

____

aswMBR version 1.0.1.2252 Copyright© 2014 AVAST Software
Run date: 2015-01-27 17:40:21
—————————–
17:40:21.866    OS Version: Windows x64 6.1.7601 Service Pack 1
17:40:21.866    Number of processors: 4 586 0x1E05
17:40:21.866    ComputerName: INET UserName: Tim
17:40:22.710    Initialize success
17:40:24.471    AVAST engine defs: 15012700
17:41:03.448    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP4T0L0-8
17:41:03.449    Disk 0 Vendor: ST1000DM003-1CH162 CC47 Size: 953869MB BusType: 11
17:41:03.540    Disk 0 MBR read successfully
17:41:03.541    Disk 0 MBR scan
17:41:03.838    Disk 0 Windows 7 default MBR code
17:41:03.840    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS       953867 MB offset 2048
17:41:03.843    Disk 0 Boot: NTFS     code=1
17:41:03.940    Disk 0 scanning C:\Windows\system32\drivers
17:41:10.964    Service scanning
17:41:22.917    Modules scanning
17:41:22.922    Disk 0 trace - called modules:
17:41:22.933    ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys ataport.SYS PCIIDEX.SYS hal.dll msahci.sys
17:41:22.936    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa800476a060]
17:41:22.939    3 CLASSPNP.SYS[fffff880018c143f] -> nt!IofCallDriver -> [0xfffffa80044cd090]
17:41:22.943    5 ACPI.sys[fffff88000f9f7a1] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP4T0L0-8[0xfffffa8004491060]
17:41:23.591    AVAST engine scan C:\Windows
17:41:25.341    AVAST engine scan C:\Windows\system32
17:43:25.819    AVAST engine scan C:\Windows\system32\drivers
17:43:34.373    AVAST engine scan C:\Users\Tim
17:52:49.582    AVAST engine scan C:\ProgramData
17:53:38.882    File: C:\ProgramData\Surf annd ekeEp\B1zeEWuh.exe **INFECTED** Win32:Malware-gen
17:53:38.956    File: C:\ProgramData\surff annd kkeep\ymcZgDCvy.exe **INFECTED** Win32:Malware-gen
17:53:48.073    Disk 0 statistics 5057526/0/0 @ 4,36 MB/s
17:53:48.078    Scan finished successfully
18:00:54.597    Disk 0 MBR has been saved successfully to "C:\Users\Tim\Desktop\MBR.dat"
18:00:54.600    The log file has been saved successfully to "C:\Users\Tim\Desktop\aswMBR.txt"
________

Here is the text of the FRST log:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 24-01-2015 01
Ran by [removed] (administrator) on INET on 27-01-2015 18:04:27
Running from C:\Users\[removed]\Desktop
[removed] Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Svenska (Sverige)
Internet Explorer Version 11 (Default browser: Vosteran)
Boot Mode: Safe Mode (with Networking)
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_117.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_117.exe

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\…\Run: [Nvtmru] => "C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe"
HKLM\…\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2352072 2014-05-30] (NVIDIA Corporation)
HKLM\…\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM-x32\…\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5227112 2015-01-09] (AVAST Software)
HKLM-x32\…\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-25] (Oracle Corporation)
HKLM-x32\…\RunOnce: [WSE_Vosteran] => C:\Windows\SysWOW64\wscript.exe /E:vbscript /B "C:\Users\Tim\AppData\Roaming\WSE_Vosteran\UpdateProc\bkup.dat"
HKU\S-1-5-21-3767168050-546541148-904736753-1000\…\Run: [GoogleChromeAutoLaunch_77DB27ED30D96DC6FB2B344658AE2828] => C:\Users\Tim\AppData\Local\Vosteran\Application\vosteran.exe [1014272 2015-01-15] ()
HKU\S-1-5-21-3767168050-546541148-904736753-1000\…\RunOnce: [WSE_Vosteran] => C:\Windows\SysWOW64\wscript.exe /E:vbscript /B "C:\Users\Tim\AppData\Roaming\WSE_Vosteran\UpdateProc\bkup.dat"
HKU\S-1-5-21-3767168050-546541148-904736753-1000\…\RunOnce: [FlashPlayerUpdate] => C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_9_900_117_Plugin.exe [829832 2013-10-22] (Adobe Systems Incorporated)
HKU\S-1-5-21-3767168050-546541148-904736753-1000\…\MountPoints2: E - E:\AutoRun.exe
HKU\S-1-5-21-3767168050-546541148-904736753-1000\…\MountPoints2: {5480bd08-e76f-11e3-a348-00241dc449fa} - E:\AutoRun.exe
HKU\S-1-5-21-3767168050-546541148-904736753-1000\…\MountPoints2: {5b757370-e676-11e3-ba8d-00241dc449fa} - E:\AutoRun.exe
HKU\S-1-5-21-3767168050-546541148-904736753-1000\…\MountPoints2: {5b757384-e676-11e3-ba8d-00241dc449fa} - E:\AutoRun.exe
AppInit_DLLs-x32: C:/PROGRA~3/{C6092~1/190~1.1/rati.dll => C:/PROGRA~3/{C6092~1/190~1.1/rati.dll [966144 2015-01-24] ()
Startup: C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyPC Backup.lnk
ShortcutTarget: MyPC Backup.lnk -> C:\Program Files (x86)\MyPC Backup\MyPC Backup.exe (MyPCBackup.com)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-3767168050-546541148-904736753-1000\Software\Microsoft\Internet Explorer\Main,Start Page = http://vosteran.com/?f=1&a;=vst_ggbg_15_04_ff&cd;=2XzuyEtN2Y1L1QzutDtDtByEtC0D0CyEyEzy0F0AtDtByD0EtN0D0Tzu0StCtCtCzytN1L2XzutAtFyBtFtAtFtBtN1L1CzutCyEtBzytDyD1V1ByEtN1L1G1B1V1N2Y1L1Qzu2SyE0F0A0FyCtDtCyBtGzztCyB0AtG0C0D0AyDtGzytB0D0FtGtA0CyEyEtAtDtC0EzyyCtAtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyB0D0EtAtBtA0EtAtGtByB0A0FtGyE0BzztDtGzzzzzzyDtGyBtB0Azzzy0EyCyByC0A0ByE2Q&cr;=668876811&ir;=
HKU\S-1-5-21-3767168050-546541148-904736753-1000\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://www.inet.se
HKU\S-1-5-21-3767168050-546541148-904736753-1000\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = http://www.inet.se
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://vosteran.com/results.php?f=4&q;={searchTerms}&a;=vst_ggbg_15_04_ff&cd;=2XzuyEtN2Y1L1QzutDtDtByEtC0D0CyEyEzy0F0AtDtByD0EtN0D0Tzu0StCtCtCzytN1L2XzutAtFyBtFtAtFtBtN1L1CzutCyEtBzytDyD1V1ByEtN1L1G1B1V1N2Y1L1Qzu2SyE0F0A0FyCtDtCyBtGzztCyB0AtG0C0D0AyDtGzytB0D0FtGtA0CyEyEtAtDtC0EzyyCtAtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyB0D0EtAtBtA0EtAtGtByB0A0FtGyE0BzztDtGzzzzzzyDtGyBtB0Azzzy0EyCyByC0A0ByE2Q&cr;=668876811&ir;=
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://vosteran.com/results.php?f=4&q;={searchTerms}&a;=vst_ggbg_15_04_ff&cd;=2XzuyEtN2Y1L1QzutDtDtByEtC0D0CyEyEzy0F0AtDtByD0EtN0D0Tzu0StCtCtCzytN1L2XzutAtFyBtFtAtFtBtN1L1CzutCyEtBzytDyD1V1ByEtN1L1G1B1V1N2Y1L1Qzu2SyE0F0A0FyCtDtCyBtGzztCyB0AtG0C0D0AyDtGzytB0D0FtGtA0CyEyEtAtDtC0EzyyCtAtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyB0D0EtAtBtA0EtAtGtByB0A0FtGyE0BzztDtGzzzzzzyDtGyBtB0Azzzy0EyCyByC0A0ByE2Q&cr;=668876811&ir;=
SearchScopes: HKU\S-1-5-21-3767168050-546541148-904736753-1000 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://vosteran.com/results.php?f=4&q;={searchTerms}&a;=vst_ggbg_15_04_ff&cd;=2XzuyEtN2Y1L1QzutDtDtByEtC0D0CyEyEzy0F0AtDtByD0EtN0D0Tzu0StCtCtCzytN1L2XzutAtFyBtFtAtFtBtN1L1CzutCyEtBzytDyD1V1ByEtN1L1G1B1V1N2Y1L1Qzu2SyE0F0A0FyCtDtCyBtGzztCyB0AtG0C0D0AyDtGzytB0D0FtGtA0CyEyEtAtDtC0EzyyCtAtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyB0D0EtAtBtA0EtAtGtByB0A0FtGyE0BzztDtGzzzzzzyDtGyBtB0Azzzy0EyCyByC0A0ByE2Q&cr;=668876811&ir;=
SearchScopes: HKU\S-1-5-21-3767168050-546541148-904736753-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://vosteran.com/results.php?f=4&q;={searchTerms}&a;=vst_ggbg_15_04_ff&cd;=2XzuyEtN2Y1L1QzutDtDtByEtC0D0CyEyEzy0F0AtDtByD0EtN0D0Tzu0StCtCtCzytN1L2XzutAtFyBtFtAtFtBtN1L1CzutCyEtBzytDyD1V1ByEtN1L1G1B1V1N2Y1L1Qzu2SyE0F0A0FyCtDtCyBtGzztCyB0AtG0C0D0AyDtGzytB0D0FtGtA0CyEyEtAtDtC0EzyyCtAtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyB0D0EtAtBtA0EtAtGtByB0A0FtGyE0BzztDtGzzzzzzyDtGyBtB0Azzzy0EyCyByC0A0ByE2Q&cr;=668876811&ir;=
BHO: No Name -> {73CF76E3-40B6-C299-001B-0B0C06AB79F5} -> No File
BHO: No Name -> {764E787A-518C-E931-F013-BD3BA3F0F7A3} -> No File
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
BHO: No Name -> {BAC79AB2-0EEE-C9A4-1577-7355E883D4F8} -> No File
BHO-x32: ace race 1.0.0.6 -> {68182220-3c75-49d9-a9c4-4093d3986279} -> C:\Program Files (x86)\ace race\aceracebho.dll (ace race)
BHO-x32: No Name -> {73CF76E3-40B6-C299-001B-0B0C06AB79F5} -> No File
BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: No Name -> {764E787A-518C-E931-F013-BD3BA3F0F7A3} -> No File
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
BHO-x32: No Name -> {BAC79AB2-0EEE-C9A4-1577-7355E883D4F8} -> No File
BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - No Name - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File
Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - No File
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\Tim\AppData\Roaming\Mozilla\Firefox\Profiles\trq1irq0.default
FF DefaultSearchEngine: Vosteran
FF DefaultSearchUrl: https://se.search.yahoo.com/yhs/search
FF SearchEngineOrder.1: Yahoo! (Avast)
FF SearchEngineOrder.3: Bing
FF SelectedSearchEngine: Vosteran
FF Homepage: hxxp://vosteran.com/?f=1&a;=vst_ggbg_15_04_ff&cd;=2XzuyEtN2Y1L1QzutDtDtByEtC0D0CyEyEzy0F0AtDtByD0EtN0D0Tzu0StCtCtCzytN1L2XzutAtFyBtFtAtFtBtN1L1CzutCyEtBzytDyD1V1ByEtN1L1G1B1V1N2Y1L1Qzu2SyE0F0A0FyCtDtCyBtGzztCyB0AtG0C0D0AyDtGzytB0D0FtGtA0CyEyEtAtDtC0EzyyCtAtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyB0D0EtAtBtA0EtAtGtByB0A0FtGyE0BzztDtGzzzzzzyDtGyBtB0Azzzy0EyCyByC0A0ByE2Q&cr;=668876811&ir;=
FF Keyword.URL: https://se.search.yahoo.com/yhs/search
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_117.dll ()
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_117.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\4.0.60310.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKU\S-1-5-21-3767168050-546541148-904736753-1000: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Tim\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Plugin HKU\S-1-5-21-3767168050-546541148-904736753-1000: pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin HKU\S-1-5-21-3767168050-546541148-904736753-1000: thehappycloud.com/HappyCloudPlugin -> C:\ProgramData\HappyCloud\Application\npHappyCloudPlugin.dll (The Happy Cloud)
FF user.js: detected! => C:\Users\Tim\AppData\Roaming\Mozilla\Firefox\Profiles\trq1irq0.default\user.js
FF SearchPlugin: C:\Users\Tim\AppData\Roaming\Mozilla\Firefox\Profiles\trq1irq0.default\searchplugins\ask-search.xml
FF SearchPlugin: C:\Users\Tim\AppData\Roaming\Mozilla\Firefox\Profiles\trq1irq0.default\searchplugins\bingp.xml
FF SearchPlugin: C:\Users\Tim\AppData\Roaming\Mozilla\Firefox\Profiles\trq1irq0.default\searchplugins\Vosteran.xml
FF SearchPlugin: C:\Users\Tim\AppData\Roaming\Mozilla\Firefox\Profiles\trq1irq0.default\searchplugins\yahoo-avast.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\allaannonser-sv-SE.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\prisjakt-sv-SE.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\tyda-sv-SE.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\wikipedia-sv-SE.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-sv-SE.xml
FF Extension: ace race 1.0.1 - C:\Users\Tim\AppData\Roaming\Mozilla\Firefox\Profiles\trq1irq0.default\Extensions\{4a90d0b9-0668-4ad5-92c2-d78786884485}.xpi [2015-01-24]
FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2014-12-02]
FF HKLM-x32\…\Firefox\Extensions: [[removed]] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2013-10-22]
StartMenuInternet: FIREFOX.EXE - firefox.exe

Chrome:
=======
CHR HomePage: Default -> hxxp://vosteran.com/?f=1&a;=vst_ggbg_15_04_ff&cd;=2XzuyEtN2Y1L1QzutDtDtByEtC0D0CyEyEzy0F0AtDtByD0EtN0D0Tzu0StCtCtCzytN1L2XzutAtFyBtFtAtFtBtN1L1CzutCyEtBzytDyD1V1ByEtN1L1G1B1V1N2Y1L1Qzu2SyE0F0A0FyCtDtCyBtGzztCyB0AtG0C0D0AyDtGzytB0D0FtGtA0CyEyEtAtDtC0EzyyCtAtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyB0D0EtAtBtA0EtAtGtByB0A0FtGyE0BzztDtGzzzzzzyDtGyBtB0Azzzy0EyCyByC0A0ByE2Q&cr;=668876811&ir;=
CHR StartupUrls: Default -> "hxxp://vosteran.com/?f=7&a;=vst_ggbg_15_04_ff&cd;=2XzuyEtN2Y1L1QzutDtDtByEtC0D0CyEyEzy0F0AtDtByD0EtN0D0Tzu0StCtCtCzytN1L2XzutAtFyBtFtAtFtBtN1L1CzutCyEtBzytDyD1V1ByEtN1L1G1B1V1N2Y1L1Qzu2SyE0F0A0FyCtDtCyBtGzztCyB0AtG0C0D0AyDtGzytB0D0FtGtA0CyEyEtAtDtC0EzyyCtAtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyB0D0EtAtBtA0EtAtGtByB0A0FtGyE0BzztDtGzzzzzzyDtGyBtB0Azzzy0EyCyByC0A0ByE2Q&cr;=668876811&ir;=", "https://se.yahoo.com/?fr=hp-avast&type;=avastbcl"
CHR DefaultSearchKeyword: Default -> vosteran.com
CHR DefaultSearchURL: Default -> http://vosteran.com/results.php?f=4&q;={searchTerms}&a;=vst_ggbg_15_04_ff&cd;=2XzuyEtN2Y1L1QzutDtDtByEtC0D0CyEyEzy0F0AtDtByD0EtN0D0Tzu0StCtCtCzytN1L2XzutAtFyBtFtAtFtBtN1L1CzutCyEtBzytDyD1V1ByEtN1L1G1B1V1N2Y1L1Qzu2SyE0F0A0FyCtDtCyBtGzztCyB0AtG0C0D0AyDtGzytB0D0FtGtA0CyEyEtAtDtC0EzyyCtAtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyB0D0EtAtBtA0EtAtGtByB0A0FtGyE0BzztDtGzzzzzzyDtGyBtB0Azzzy0EyCyByC0A0ByE2Q&cr;=668876811&ir;=
CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?client=chrome&hl;={language}&q;={searchTerms}
CHR Profile: C:\Users\Tim\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Dokument) - C:\Users\Tim\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-08-08]
CHR Extension: (Google Drive) - C:\Users\Tim\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-08-08]
CHR Extension: (YouTube) - C:\Users\Tim\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-08-08]
CHR Extension: (Battlefield Heroes) - C:\Users\Tim\AppData\Local\Google\Chrome\User Data\Default\Extensions\cehdakiococlfmjcbebbkjkfjhbieknh [2015-01-09]
CHR Extension: (Sök på Google) - C:\Users\Tim\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-08-08]
CHR Extension: (ace race) - C:\Users\Tim\AppData\Local\Google\Chrome\User Data\Default\Extensions\eiknpkdjaijoilnmlcmkgcelkafbnpbl [2015-01-25]
CHR Extension: (Avast Online Security) - C:\Users\Tim\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2014-08-08]
CHR Extension: (Google Wallet) - C:\Users\Tim\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-08-08]
CHR Extension: (Vosteran New Tab) - C:\Users\Tim\AppData\Local\Google\Chrome\User Data\Default\Extensions\oilkkkefbalmbfppgjmgjoefbclebkce [2015-01-24]
CHR Extension: (Gmail) - C:\Users\Tim\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-08-08]
CHR HKLM\…\Chrome\Extension: [oilkkkefbalmbfppgjmgjoefbclebkce] - No Path
CHR HKU\S-1-5-21-3767168050-546541148-904736753-1000\…\Chrome\Extension: [oilkkkefbalmbfppgjmgjoefbclebkce] - No Path
CHR HKLM-x32\…\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-12-04]
CHR HKLM-x32\…\Chrome\Extension: [oilkkkefbalmbfppgjmgjoefbclebkce] - No Path
StartMenuInternet: Google Chrome - chrome.exe

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-12-04] (AVAST Software)
S3 AvastVBoxSvc; C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe [4012248 2014-12-04] (Avast Software)
S2 BackupStack; C:\Program Files (x86)\MyPC Backup\BackupStack.exe [53832 2014-11-25] (Just Develop It) <==== ATTENTION
S2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)
S2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)
S2 HiPatchService; C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe [9216 2014-02-28] (Hi-Rez Studios) [File not signed]
S2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1631008 2014-05-30] (NVIDIA Corporation)
S2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [21055432 2014-05-30] (NVIDIA Corporation)
S2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2015-01-09] ()
S2 Update ace race; C:\Program Files (x86)\ace race\updateacerace.exe [664816 2015-01-25] ()
S2 Util ace race; C:\Program Files (x86)\ace race\bin\utilacerace.exe [681200 2015-01-27] ()
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-12-04] ()
S2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [83280 2014-12-04] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-12-04] (AVAST Software)
S0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-12-04] ()
S1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1050432 2014-12-04] (AVAST Software)
S1 aswSP; C:\Windows\system32\drivers\aswSP.sys [436624 2014-12-04] (AVAST Software)
S2 aswStm; C:\Windows\system32\drivers\aswStm.sys [116728 2014-12-04] (AVAST Software)
U5 ewusbnet; C:\Windows\System32\Drivers\ewusbnet.sys [243200 2009-10-21] (Huawei Technologies Co., Ltd.)
S3 hwusbdev; C:\Windows\System32\DRIVERS\ewusbdev.sys [114304 2009-10-12] (Huawei Technologies Co., Ltd.)
S3 IAMTVE; C:\Windows\system32\drivers\IAMTVE.sys [43416 2010-11-30] (Intel Corporation)
S3 IAMTXPE; C:\Windows\system32\drivers\IAMTXPE.sys [51096 2010-11-30] (Intel Corporation)
S3 MTsensor; C:\Windows\system32\drivers\ASACPI.sys [15416 2009-05-14] ()
S3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [20256 2014-05-30] (NVIDIA Corporation)
S3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [40392 2014-03-31] (NVIDIA Corporation)
S2 VBoxAswDrv; C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [271752 2014-12-04] (Avast Software)
R1 {4a90d0b9-0668-4ad5-92c2-d78786884485}Gw64; C:\Windows\System32\drivers\{4a90d0b9-0668-4ad5-92c2-d78786884485}Gw64.sys [48784 2015-01-24] (StdLib)
R1 {56db9de0-c769-4563-8e82-7e39885bf1ad}Gw64; C:\Windows\System32\drivers\{56db9de0-c769-4563-8e82-7e39885bf1ad}Gw64.sys [48784 2015-01-25] (StdLib)
S3 aswVmm; \??\C:\Users\Tim\AppData\Local\Temp\aswVmm.sys [X]
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]
S3 X6va029; \??\C:\Windows\SysWOW64\Drivers\X6va029 [X]
U3 aswMBR; \??\C:\Users\Tim\AppData\Local\Temp\aswMBR.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)

==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-27 18:04 - 2015-01-27 18:04 - 00020598 _____ () C:\Users\Tim\Desktop\FRST.txt
2015-01-27 18:04 - 2015-01-27 18:04 - 00000000 ____D () C:\FRST
2015-01-27 18:02 - 2015-01-27 18:02 - 02129920 _____ (Farbar) C:\Users\Tim\Desktop\FRST64.exe
2015-01-27 18:01 - 2015-01-27 18:01 - 00000544 _____ () C:\Users\Tim\Desktop\MBR.zip
2015-01-27 18:00 - 2015-01-27 18:00 - 00002137 _____ () C:\Users\Tim\Desktop\aswMBR.txt
2015-01-27 18:00 - 2015-01-27 18:00 - 00000512 _____ () C:\Users\Tim\Desktop\MBR.dat
2015-01-27 17:37 - 2015-01-27 17:37 - 05198336 _____ (AVAST Software) C:\Users\Tim\Desktop\aswMBR.exe
2015-01-27 17:28 - 2015-01-27 17:28 - 00000197 _____ () C:\Windows\system32\2015-01-27-16-28-06.013-AvastVBoxSVC.exe-2452.log
2015-01-25 17:05 - 2015-01-25 17:05 - 00000197 _____ () C:\Windows\system32\2015-01-25-16-05-46.072-AvastVBoxSVC.exe-2384.log
2015-01-25 17:00 - 2015-01-25 17:00 - 00000197 _____ () C:\Windows\system32\2015-01-25-16-00-29.011-AvastVBoxSVC.exe-1428.log
2015-01-25 16:18 - 2015-01-25 16:18 - 00000197 _____ () C:\Windows\system32\2015-01-25-15-18-00.026-AvastVBoxSVC.exe-2732.log
2015-01-25 16:18 - 2015-01-25 05:46 - 00048784 _____ (StdLib) C:\Windows\system32\Drivers\{56db9de0-c769-4563-8e82-7e39885bf1ad}Gw64.sys
2015-01-25 09:39 - 2015-01-25 09:39 - 00000197 _____ () C:\Windows\system32\2015-01-25-08-39-04.097-AvastVBoxSVC.exe-3736.log
2015-01-25 09:36 - 2015-01-25 09:36 - 00000254 __RSH () C:\ProgramData\ntuser.pol
2015-01-24 18:35 - 2015-01-25 17:35 - 00000057 _____ () C:\Users\Tim\AppData\Roaming\WB.CFG
2015-01-24 17:57 - 2015-01-24 17:57 - 00001238 _____ () C:\Users\Public\Desktop\World of Warcraft.lnk
2015-01-24 17:57 - 2015-01-24 17:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\World of Warcraft
2015-01-24 17:55 - 2015-01-24 21:47 - 00000000 ____D () C:\Program Files (x86)\World of Warcraft
2015-01-24 17:51 - 2015-01-24 17:51 - 02942368 _____ (Blizzard Entertainment) C:\Users\Tim\Downloads\World-of-Warcraft-Setup-enGB.exe
2015-01-24 17:45 - 2015-01-24 03:40 - 00048784 _____ (StdLib) C:\Windows\system32\Drivers\{4a90d0b9-0668-4ad5-92c2-d78786884485}Gw64.sys
2015-01-24 17:38 - 2015-01-25 00:06 - 00000000 ____D () C:\Users\Tim\AppData\Local\Battle.net
2015-01-24 17:38 - 2015-01-24 17:55 - 00000000 ____D () C:\Users\Tim\AppData\Roaming\Battle.net
2015-01-24 17:38 - 2015-01-24 17:38 - 00000000 ____D () C:\Users\Tim\AppData\Local\Blizzard Entertainment
2015-01-24 17:37 - 2015-01-24 17:38 - 00000000 ____D () C:\Program Files (x86)\Battle.net
2015-01-24 17:37 - 2015-01-24 17:37 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Battle.net
2015-01-24 17:37 - 2015-01-24 17:37 - 00000000 ____D () C:\ProgramData\Blizzard Entertainment
2015-01-24 17:36 - 2015-01-24 17:36 - 00003602 _____ () C:\Windows\System32\Tasks\Pirates WW2
2015-01-24 17:36 - 2015-01-24 17:36 - 00003602 _____ () C:\Windows\System32\Tasks\Pirates WW1
2015-01-24 17:36 - 2015-01-24 17:36 - 00003602 _____ () C:\Windows\System32\Tasks\Pirates W1
2015-01-24 17:36 - 2015-01-24 17:36 - 00003532 _____ () C:\Windows\System32\Tasks\GoodGameEmpire W1
2015-01-24 17:36 - 2015-01-24 17:36 - 00003532 _____ () C:\Windows\System32\Tasks\GoodGameEmpire NextW2
2015-01-24 17:36 - 2015-01-24 17:36 - 00003532 _____ () C:\Windows\System32\Tasks\GoodGameEmpire NextW1
2015-01-24 17:36 - 2015-01-24 17:36 - 00003440 _____ () C:\Windows\System32\Tasks\WOT WWED1
2015-01-24 17:36 - 2015-01-24 17:36 - 00003440 _____ () C:\Windows\System32\Tasks\WOT WW2
2015-01-24 17:36 - 2015-01-24 17:36 - 00003440 _____ () C:\Windows\System32\Tasks\WOT WW1
2015-01-24 17:36 - 2015-01-24 17:36 - 00003440 _____ () C:\Windows\System32\Tasks\WOT WTUE1
2015-01-24 17:36 - 2015-01-24 17:36 - 00003440 _____ () C:\Windows\System32\Tasks\WOT WTHUR1
2015-01-24 17:36 - 2015-01-24 17:36 - 00003440 _____ () C:\Windows\System32\Tasks\WOT WFRI1
2015-01-24 17:36 - 2015-01-24 17:36 - 00003440 _____ () C:\Windows\System32\Tasks\WOT W1
2015-01-24 17:36 - 2015-01-24 17:36 - 00000000 ____D () C:\Users\Tim\AppData\Roaming\WorldofTanks
2015-01-24 17:36 - 2015-01-24 17:36 - 00000000 ____D () C:\Users\Tim\AppData\Roaming\Pirates946
2015-01-24 17:36 - 2015-01-24 17:36 - 00000000 ____D () C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Vosteran
2015-01-24 17:36 - 2015-01-24 17:36 - 00000000 ____D () C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WorldofTanks
2015-01-24 17:36 - 2015-01-24 17:36 - 00000000 ____D () C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Pirates
2015-01-24 17:36 - 2015-01-24 17:36 - 00000000 ____D () C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\GoodGameEmpire
2015-01-24 17:36 - 2015-01-24 17:36 - 00000000 ____D () C:\Users\Tim\AppData\Roaming\GGEmpire441
2015-01-24 17:36 - 2015-01-24 17:36 - 00000000 ____D () C:\Users\Tim\AppData\Local\WorldofTanks
2015-01-24 17:36 - 2015-01-24 17:36 - 00000000 ____D () C:\Users\Tim\AppData\Local\GGEmpire
2015-01-24 17:36 - 2015-01-24 17:36 - 00000000 ____D () C:\ProgramData\Battle.net
2015-01-24 17:35 - 2015-01-27 17:28 - 00000000 ____D () C:\Program Files (x86)\ace race
2015-01-24 17:35 - 2015-01-25 17:35 - 00000284 _____ () C:\Windows\Tasks\WSE_Vosteran.job
2015-01-24 17:35 - 2015-01-25 17:06 - 00003438 _____ () C:\Windows\System32\Tasks\CleanerPro_Popup
2015-01-24 17:35 - 2015-01-25 17:06 - 00000000 ____D () C:\Users\Tim\Documents\CleanerPro
2015-01-24 17:35 - 2015-01-24 17:36 - 00000000 ____D () C:\Users\Tim\AppData\Local\Vosteran
2015-01-24 17:35 - 2015-01-24 17:36 - 00000000 ____D () C:\Users\Tim\AppData\Local\Pirates
2015-01-24 17:35 - 2015-01-24 17:35 - 123231216 _____ (Blizzard Entertainment) C:\Users\Tim\Downloads\WorldOfWarCraftSetup.exe
2015-01-24 17:35 - 2015-01-24 17:35 - 00004086 _____ () C:\Windows\System32\Tasks\Vosteran rati
2015-01-24 17:35 - 2015-01-24 17:35 - 00003212 _____ () C:\Windows\System32\Tasks\WSE_Vosteran
2015-01-24 17:35 - 2015-01-24 17:35 - 00003174 _____ () C:\Windows\System32\Tasks\CleanerPro_Start
2015-01-24 17:35 - 2015-01-24 17:35 - 00000000 ____D () C:\Users\Tim\AppData\Roaming\WSE_Vosteran
2015-01-24 17:35 - 2015-01-24 17:35 - 00000000 ____D () C:\Users\Tim\AppData\Roaming\1H1Q1V0B1L1G1N1V0M1P1Q1L1T0D1P1E2Z
2015-01-24 17:35 - 2015-01-24 17:35 - 00000000 ____D () C:\Users\Tim\AppData\Local\CleanerPro
2015-01-24 17:35 - 2015-01-24 17:35 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cleaner Pro
2015-01-24 17:35 - 2015-01-24 17:35 - 00000000 ____D () C:\ProgramData\{C6092ECA-968B-FF4C-270D-8FCEF78F5C40}
2015-01-24 17:35 - 2015-01-24 17:35 - 00000000 ____D () C:\Program Files (x86)\WSE_Vosteran
2015-01-24 17:35 - 2015-01-24 17:35 - 00000000 ____D () C:\Program Files (x86)\Cleaner Pro
2015-01-24 17:34 - 2015-01-24 17:34 - 00003664 _____ () C:\Windows\System32\Tasks\StormFall W1
2015-01-24 17:34 - 2015-01-24 17:34 - 00003664 _____ () C:\Windows\System32\Tasks\StormFall TW2
2015-01-24 17:34 - 2015-01-24 17:34 - 00003664 _____ () C:\Windows\System32\Tasks\StormFall TW1
2015-01-24 17:34 - 2015-01-24 17:34 - 00000000 ____D () C:\Users\Tim\AppData\Roaming\StormFall
2015-01-24 17:34 - 2015-01-24 17:34 - 00000000 ____D () C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StormFall
2015-01-24 17:34 - 2015-01-24 17:34 - 00000000 ____D () C:\Users\Tim\AppData\Roaming\Cleaner Pro
2015-01-24 17:34 - 2015-01-24 17:34 - 00000000 ____D () C:\Users\Tim\AppData\Local\StormFall
2015-01-24 17:33 - 2015-01-24 17:34 - 00819816 _____ (%VENDOR%) C:\Users\Tim\Downloads\WorldofWarCraft_Setup.exe
2015-01-24 13:47 - 2015-01-24 13:48 - 00000197 _____ () C:\Windows\system32\2015-01-24-12-47-40.045-AvastVBoxSVC.exe-3452.log
2015-01-24 08:41 - 2015-01-24 08:41 - 00000197 _____ () C:\Windows\system32\2015-01-24-07-41-44.020-AvastVBoxSVC.exe-4040.log
2015-01-23 21:40 - 2015-01-23 21:40 - 00000197 _____ () C:\Windows\system32\2015-01-23-20-40-03.016-AvastVBoxSVC.exe-4508.log
2015-01-23 16:57 - 2015-01-23 16:58 - 00000197 _____ () C:\Windows\system32\2015-01-23-15-57-47.063-AvastVBoxSVC.exe-3636.log
2015-01-23 07:35 - 2015-01-23 07:36 - 00000197 _____ () C:\Windows\system32\2015-01-23-06-35-43.037-AvastVBoxSVC.exe-3552.log
2015-01-22 15:05 - 2015-01-22 15:06 - 00000197 _____ () C:\Windows\system32\2015-01-22-14-05-49.099-AvastVBoxSVC.exe-3720.log
2015-01-22 07:32 - 2015-01-22 07:32 - 00000197 _____ () C:\Windows\system32\2015-01-22-06-32-43.034-AvastVBoxSVC.exe-3040.log
2015-01-21 19:31 - 2015-01-21 19:32 - 00000000 ____D () C:\Users\Tim\Downloads\Slender_v0_9_7 (1)
2015-01-21 19:31 - 2015-01-21 19:31 - 00000000 ____D () C:\Users\Tim\Desktop\Slender v0.9.7
2015-01-21 19:23 - 2015-01-21 19:30 - 65812970 _____ () C:\Users\Tim\Downloads\Slender_v0_9_7 (1).zip
2015-01-21 19:13 - 2015-01-21 19:13 - 00004002 _____ () C:\Windows\System32\Tasks\LaunchSignup
2015-01-21 19:13 - 2015-01-21 19:13 - 00001971 _____ () C:\Users\Tim\Desktop\Sync Folder.lnk
2015-01-21 19:12 - 2015-01-22 07:29 - 00000000 ____D () C:\Program Files (x86)\MyPC Backup
2015-01-21 19:12 - 2015-01-21 19:12 - 01060200 _____ (Uniblue Systems Limited ) C:\Users\Tim\Downloads\pcmechanicpm.exe
2015-01-21 19:12 - 2015-01-21 19:12 - 00003200 _____ () C:\Windows\System32\Tasks\PC-Mechanic Maintenance
2015-01-21 19:12 - 2015-01-21 19:12 - 00002488 _____ () C:\Windows\System32\Tasks\PC-Mechanic Startup
2015-01-21 19:12 - 2015-01-21 19:12 - 00001071 _____ () C:\Users\Tim\Desktop\MyPC Backup.lnk
2015-01-21 19:12 - 2015-01-21 19:12 - 00000000 ____D () C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MyPC Backup
2015-01-21 19:08 - 2015-01-21 19:09 - 00000197 _____ () C:\Windows\system32\2015-01-21-18-08-51.048-AvastVBoxSVC.exe-3480.log
2015-01-21 19:01 - 2015-01-21 19:01 - 65812970 _____ () C:\Users\Tim\Downloads\Slender_v0_9_7.zip
2015-01-21 14:27 - 2015-01-21 14:27 - 00000197 _____ () C:\Windows\system32\2015-01-21-13-27-01.087-AvastVBoxSVC.exe-2708.log
2015-01-21 06:17 - 2015-01-21 06:18 - 00000197 _____ () C:\Windows\system32\2015-01-21-05-17-40.013-AvastVBoxSVC.exe-3284.log
2015-01-21 05:32 - 2015-01-21 05:32 - 00000197 _____ () C:\Windows\system32\2015-01-21-04-32-11.025-AvastVBoxSVC.exe-2500.log
2015-01-20 15:42 - 2015-01-20 15:43 - 00000197 _____ () C:\Windows\system32\2015-01-20-14-42-54.082-AvastVBoxSVC.exe-3380.log
2015-01-20 07:21 - 2015-01-20 07:21 - 00000197 _____ () C:\Windows\system32\2015-01-20-06-21-05.091-AvastVBoxSVC.exe-3240.log
2015-01-19 13:43 - 2015-01-19 13:44 - 00000197 _____ () C:\Windows\system32\2015-01-19-12-43-55.039-AvastVBoxSVC.exe-3832.log
2015-01-19 07:27 - 2015-01-19 07:27 - 00000197 _____ () C:\Windows\system32\2015-01-19-06-27-12.003-AvastVBoxSVC.exe-3452.log
2015-01-18 09:31 - 2015-01-18 09:31 - 00000197 _____ () C:\Windows\system32\2015-01-18-08-31-40.030-AvastVBoxSVC.exe-3352.log
2015-01-17 09:13 - 2015-01-17 09:13 - 00000197 _____ () C:\Windows\system32\2015-01-17-08-13-20.071-AvastVBoxSVC.exe-3536.log
2015-01-16 18:40 - 2015-01-16 18:40 - 00000000 __SHD () C:\Users\Tim\AppData\Local\EmieUserList
2015-01-16 18:40 - 2015-01-16 18:40 - 00000000 __SHD () C:\Users\Tim\AppData\Local\EmieSiteList
2015-01-16 18:40 - 2015-01-16 18:40 - 00000000 __SHD () C:\Users\Tim\AppData\Local\EmieBrowserModeList
2015-01-16 18:34 - 2015-01-16 18:34 - 00000222 _____ () C:\Users\Tim\Desktop\MicroVolts Surge.url
2015-01-16 17:58 - 2015-01-16 17:58 - 00000197 _____ () C:\Windows\system32\2015-01-16-16-58-01.044-AvastVBoxSVC.exe-3048.log
2015-01-16 11:45 - 2015-01-16 11:45 - 00000197 _____ () C:\Windows\system32\2015-01-16-10-45-04.007-AvastVBoxSVC.exe-3160.log
2015-01-16 07:57 - 2015-01-16 07:58 - 00000197 _____ () C:\Windows\system32\2015-01-16-06-57-44.044-AvastVBoxSVC.exe-3596.log
2015-01-15 15:19 - 2015-01-15 15:19 - 00000197 _____ () C:\Windows\system32\2015-01-15-14-19-09.002-AvastVBoxSVC.exe-2148.log
2015-01-15 06:46 - 2015-01-15 06:46 - 00000197 _____ () C:\Windows\system32\2015-01-15-05-46-18.056-AvastVBoxSVC.exe-3440.log
2015-01-15 06:42 - 2015-01-15 06:42 - 00000197 _____ () C:\Windows\system32\2015-01-15-05-42-40.094-AvastVBoxSVC.exe-2848.log
2015-01-14 16:29 - 2015-01-14 16:29 - 00000197 _____ () C:\Windows\system32\2015-01-14-15-29-36.005-AvastVBoxSVC.exe-3388.log
2015-01-14 14:43 - 2015-01-14 14:44 - 00000197 _____ () C:\Windows\system32\2015-01-14-13-43-43.031-AvastVBoxSVC.exe-2500.log
2015-01-14 07:51 - 2014-12-19 04:06 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2015-01-14 07:51 - 2014-12-19 02:46 - 00141312 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2015-01-14 07:51 - 2014-12-12 06:35 - 05553592 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-01-14 07:51 - 2014-12-12 06:31 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-01-14 07:51 - 2014-12-12 06:31 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-01-14 07:51 - 2014-12-12 06:31 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-01-14 07:51 - 2014-12-12 06:11 - 03971512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-01-14 07:51 - 2014-12-12 06:11 - 03916728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-01-14 07:51 - 2014-12-12 06:07 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-01-14 07:51 - 2014-12-11 18:47 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2015-01-14 07:51 - 2014-12-06 05:17 - 00303616 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll
2015-01-14 07:51 - 2014-12-06 04:50 - 00156672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncsi.dll
2015-01-14 07:51 - 2014-12-06 04:50 - 00052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll
2015-01-14 07:51 - 2012-10-03 18:44 - 00216576 _____ (Microsoft Corporation) C:\Windows\system32\ncsi.dll
2015-01-14 07:51 - 2012-10-03 18:44 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\nlaapi.dll
2015-01-14 07:48 - 2015-01-14 07:48 - 00000197 _____ () C:\Windows\system32\2015-01-14-06-48-14.075-AvastVBoxSVC.exe-1388.log
2015-01-13 14:37 - 2015-01-13 14:38 - 00000197 _____ () C:\Windows\system32\2015-01-13-13-37-39.065-AvastVBoxSVC.exe-3848.log
2015-01-13 07:54 - 2015-01-13 07:55 - 00000197 _____ () C:\Windows\system32\2015-01-13-06-54-26.047-AvastVBoxSVC.exe-2908.log
2015-01-12 13:45 - 2015-01-12 13:45 - 00000197 _____ () C:\Windows\system32\2015-01-12-12-45-02.016-AvastVBoxSVC.exe-3228.log
2015-01-12 07:55 - 2015-01-12 07:55 - 00000197 _____ () C:\Windows\system32\2015-01-12-06-55-17.056-AvastVBoxSVC.exe-2700.log
2015-01-11 10:10 - 2015-01-11 10:10 - 00000197 _____ () C:\Windows\system32\2015-01-11-09-10-12.019-AvastVBoxSVC.exe-2992.log
2015-01-10 17:56 - 2015-01-10 17:56 - 08229276 _____ () C:\Users\Tim\Downloads\1964_11.rar
2015-01-10 17:54 - 2015-01-10 17:54 - 00065552 _____ () C:\Users\Tim\Downloads\Zelda_1.zip
2015-01-10 17:53 - 2015-01-10 17:53 - 03029593 _____ () C:\Users\Tim\Downloads\fceux-2.2.2-win32.zip
2015-01-10 17:14 - 2015-01-10 17:14 - 00000000 ____D () C:\Users\Tim\AppData\Roaming\Unity
2015-01-10 15:36 - 2015-01-10 15:36 - 00000197 _____ () C:\Windows\system32\2015-01-10-14-36-08.039-AvastVBoxSVC.exe-3096.log
2015-01-10 09:54 - 2015-01-10 09:55 - 00000197 _____ () C:\Windows\system32\2015-01-10-08-54-54.090-AvastVBoxSVC.exe-2936.log
2015-01-09 21:01 - 2015-01-10 12:43 - 00282296 _____ () C:\Windows\SysWOW64\PnkBstrB.xtr
2015-01-09 21:00 - 2015-01-09 21:00 - 00000000 ____D () C:\Users\Tim\AppData\Local\PunkBuster
2015-01-09 19:26 - 2015-01-09 21:38 - 00000000 ____D () C:\Users\Tim\Documents\Battlefield Heroes
2015-01-09 19:25 - 2015-01-10 12:43 - 00282296 _____ () C:\Windows\SysWOW64\PnkBstrB.exe
2015-01-09 19:25 - 2015-01-10 10:12 - 00282296 _____ () C:\Windows\SysWOW64\PnkBstrB.ex0
2015-01-09 19:25 - 2015-01-09 21:07 - 00076888 _____ () C:\Windows\SysWOW64\PnkBstrA.exe
2015-01-09 19:25 - 2015-01-09 19:25 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EA Games
2015-01-09 19:23 - 2015-01-09 19:23 - 00000000 ____D () C:\Program Files (x86)\EA Games
2015-01-09 17:48 - 2015-01-09 17:48 - 00000000 ____D () C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Ubisoft
2015-01-09 17:48 - 2015-01-09 17:48 - 00000000 ____D () C:\Users\Tim\AppData\Local\Ubisoft Game Launcher
2015-01-09 17:48 - 2015-01-09 17:48 - 00000000 ____D () C:\Program Files (x86)\Ubisoft
2015-01-09 15:13 - 2015-01-09 15:13 - 00000197 _____ () C:\Windows\system32\2015-01-09-14-13-11.016-AvastVBoxSVC.exe-3340.log
2015-01-09 11:45 - 2015-01-09 11:46 - 00000197 _____ () C:\Windows\system32\2015-01-09-10-45-23.092-AvastVBoxSVC.exe-3372.log
2015-01-09 07:47 - 2015-01-09 07:47 - 00000197 _____ () C:\Windows\system32\2015-01-09-06-47-16.002-AvastVBoxSVC.exe-3136.log
2015-01-08 15:07 - 2015-01-08 15:08 - 00000197 _____ () C:\Windows\system32\2015-01-08-14-07-54.027-AvastVBoxSVC.exe-3892.log
2015-01-08 07:33 - 2015-01-08 07:33 - 00000197 _____ () C:\Windows\system32\2015-01-08-06-33-12.020-AvastVBoxSVC.exe-2848.log
2015-01-07 10:19 - 2015-01-07 10:20 - 00000197 _____ () C:\Windows\system32\2015-01-07-09-19-56.023-AvastVBoxSVC.exe-2908.log
2015-01-06 12:11 - 2015-01-06 12:12 - 00000197 _____ () C:\Windows\system32\2015-01-06-11-11-48.071-AvastVBoxSVC.exe-2448.log
2015-01-05 07:53 - 2015-01-05 07:53 - 00000197 _____ () C:\Windows\system32\2015-01-05-06-53-36.086-AvastVBoxSVC.exe-3104.log
2015-01-04 17:51 - 2015-01-04 17:51 - 00000197 _____ () C:\Windows\system32\2015-01-04-16-51-18.021-AvastVBoxSVC.exe-3220.log
2015-01-03 00:50 - 2015-01-03 00:50 - 00003262 _____ () C:\Windows\System32\Tasks\avastBCLRestartS-1-5-21-3767168050-546541148-904736753-1000
2015-01-02 18:00 - 2015-01-02 18:00 - 00000197 _____ () C:\Windows\system32\2015-01-02-17-00-10.085-AvastVBoxSVC.exe-1404.log
2015-01-02 14:06 - 2015-01-02 14:06 - 00000197 _____ () C:\Windows\system32\2015-01-02-13-06-19.086-AvastVBoxSVC.exe-2344.log
2015-01-02 13:58 - 2015-01-02 13:58 - 00086398 _____ () C:\Users\Tim\Downloads\[1-7-2]_Lucky_Block_v5-0-0.jar
2015-01-02 13:49 - 2015-01-02 13:49 - 00000000 ____D () C:\Users\Tim\AppData\Local\Mindspark_Interactive_Net
2015-01-02 13:48 - 2015-01-02 13:48 - 00000000 ____D () C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Elite Unzip
2015-01-02 13:48 - 2015-01-02 13:48 - 00000000 ____D () C:\Program Files (x86)\EliteUnzip
2015-01-02 13:47 - 2015-01-02 13:48 - 04161288 _____ (Mindspark Interactive Network) C:\Users\Tim\Downloads\EliteUnzipSetup.EliteUnzip_aa.gafhhbahpojnjfhpepjjfjojbphnogmn.ch.exe
2015-01-02 12:02 - 2015-01-02 12:03 - 00000197 _____ () C:\Windows\system32\2015-01-02-11-02-31.002-AvastVBoxSVC.exe-2616.log
2015-01-01 14:53 - 2015-01-01 14:53 - 00000197 _____ () C:\Windows\system32\2015-01-01-13-53-14.082-AvastVBoxSVC.exe-3504.log
2014-12-31 16:21 - 2014-12-31 16:21 - 00000197 _____ () C:\Windows\system32\2014-12-31-15-21-48.034-AvastVBoxSVC.exe-708.log
2014-12-31 10:31 - 2014-12-31 10:32 - 00000197 _____ () C:\Windows\system32\2014-12-31-09-31-21.063-AvastVBoxSVC.exe-3084.log
2014-12-30 10:14 - 2014-12-30 10:15 - 00000197 _____ () C:\Windows\system32\2014-12-30-09-14-36.048-AvastVBoxSVC.exe-2212.log
2014-12-29 17:50 - 2014-12-29 17:50 - 00000197 _____ () C:\Windows\system32\2014-12-29-16-50-58.090-AvastVBoxSVC.exe-2600.log
2014-12-29 11:01 - 2014-12-29 11:01 - 00000197 _____ () C:\Windows\system32\2014-12-29-10-01-13.002-AvastVBoxSVC.exe-3084.log
2014-12-28 20:53 - 2014-12-28 20:54 - 00000000 ____D () C:\Users\Tim\Documents\Shadow Warrior
2014-12-28 20:14 - 2014-12-28 20:14 - 00000222 _____ () C:\Users\Tim\Desktop\Shadow Warrior.url
2014-12-28 17:22 - 2010-06-02 04:55 - 00527192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_7.dll
2014-12-28 17:22 - 2010-06-02 04:55 - 00518488 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_7.dll
2014-12-28 17:22 - 2010-06-02 04:55 - 00239960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_7.dll
2014-12-28 17:22 - 2010-06-02 04:55 - 00176984 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_7.dll
2014-12-28 17:22 - 2010-06-02 04:55 - 00077656 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_5.dll
2014-12-28 17:22 - 2010-06-02 04:55 - 00074072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_5.dll
2014-12-28 17:22 - 2010-05-26 11:41 - 02526056 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_43.dll
2014-12-28 17:22 - 2010-05-26 11:41 - 02106216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_43.dll
2014-12-28 17:22 - 2010-05-26 11:41 - 01907552 _____ (Microsoft Corporation) C:\Windows\system32\d3dcsx_43.dll
2014-12-28 17:22 - 2010-05-26 11:41 - 01868128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dcsx_43.dll
2014-12-28 17:21 - 2010-02-04 10:01 - 00530776 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_6.dll
2014-12-28 17:21 - 2010-02-04 10:01 - 00528216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_6.dll
2014-12-28 17:21 - 2010-02-04 10:01 - 00238936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_6.dll
2014-12-28 17:21 - 2010-02-04 10:01 - 00176984 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_6.dll
2014-12-28 17:21 - 2010-02-04 10:01 - 00078680 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_4.dll
2014-12-28 17:21 - 2010-02-04 10:01 - 00074072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_4.dll
2014-12-28 17:21 - 2010-02-04 10:01 - 00024920 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_7.dll
2014-12-28 17:21 - 2010-02-04 10:01 - 00022360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_7.dll
2014-12-28 17:21 - 2009-09-04 17:44 - 00517960 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_5.dll
2014-12-28 17:21 - 2009-09-04 17:44 - 00515416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_5.dll
2014-12-28 17:21 - 2009-09-04 17:44 - 00238936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_5.dll
2014-12-28 17:21 - 2009-09-04 17:44 - 00176968 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_5.dll
2014-12-28 17:21 - 2009-09-04 17:44 - 00073544 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_3.dll
2014-12-28 17:21 - 2009-09-04 17:44 - 00069464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_3.dll
2014-12-28 17:21 - 2009-09-04 17:29 - 05554512 _____ (Microsoft Corporation) C:\Windows\system32\d3dcsx_42.dll
2014-12-28 17:21 - 2009-09-04 17:29 - 05501792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dcsx_42.dll
2014-12-28 17:21 - 2009-09-04 17:29 - 02582888 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_42.dll
2014-12-28 17:21 - 2009-09-04 17:29 - 02475352 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_42.dll
2014-12-28 17:21 - 2009-09-04 17:29 - 00523088 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_42.dll
2014-12-28 17:21 - 2009-09-04 17:29 - 00285024 _____ (Microsoft Corporation) C:\Windows\system32\d3dx11_42.dll
2014-12-28 17:21 - 2008-10-27 10:04 - 00518480 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_3.dll
2014-12-28 17:21 - 2008-10-27 10:04 - 00235856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_3.dll
2014-12-28 17:21 - 2008-10-27 10:04 - 00175440 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_3.dll
2014-12-28 17:21 - 2008-10-27 10:04 - 00074576 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_2.dll
2014-12-28 17:21 - 2008-10-27 10:04 - 00025936 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_5.dll
2014-12-28 17:21 - 2008-07-31 10:41 - 00238088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_2.dll
2014-12-28 17:21 - 2008-07-31 10:41 - 00177672 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_2.dll
2014-12-28 17:21 - 2008-07-31 10:41 - 00072200 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_1.dll
2014-12-28 17:21 - 2008-07-31 10:41 - 00068616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_1.dll
2014-12-28 17:21 - 2008-07-31 10:40 - 00513544 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_2.dll
2014-12-28 17:21 - 2008-07-31 10:40 - 00509448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_2.dll
2014-12-28 17:09 - 2014-12-28 17:09 - 00000222 _____ () C:\Users\Tim\Desktop\Castle Crashers.url
2014-12-28 16:28 - 2014-12-28 16:28 - 00000197 _____ () C:\Windows\system32\2014-12-28-15-28-52.077-AvastVBoxSVC.exe-3820.log
2014-12-28 10:33 - 2014-12-28 10:33 - 00000197 _____ () C:\Windows\system32\2014-12-28-09-33-25.088-AvastVBoxSVC.exe-2900.log

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-27 17:33 - 2010-11-21 12:38 - 00670622 _____ () C:\Windows\system32\perfh01D.dat
2015-01-27 17:33 - 2010-11-21 12:38 - 00146498 _____ () C:\Windows\system32\perfc01D.dat
2015-01-27 17:33 - 2009-07-14 06:13 - 01602714 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-01-27 17:28 - 2009-07-14 03:34 - 00000505 _____ () C:\Windows\win.ini
2015-01-27 17:27 - 2014-08-08 10:43 - 00000990 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-01-27 17:27 - 2009-07-14 05:51 - 00165825 _____ () C:\Windows\setupact.log
2015-01-27 17:26 - 2013-09-30 14:53 - 00000000 ____D () C:\ProgramData\NVIDIA
2015-01-27 17:26 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-01-25 17:38 - 2013-09-30 14:37 - 01792190 _____ () C:\Windows\WindowsUpdate.log
2015-01-25 17:11 - 2009-07-14 05:45 - 00021888 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-01-25 17:11 - 2009-07-14 05:45 - 00021888 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-01-25 16:41 - 2013-12-02 16:51 - 00000000 ____D () C:\ProgramData\Surf annd ekeEp
2015-01-25 16:40 - 2014-08-08 10:43 - 00000994 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-01-25 16:17 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\tracing
2015-01-25 09:34 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\GroupPolicy
2015-01-25 09:27 - 2010-11-21 04:47 - 00101736 _____ () C:\Windows\PFRO.log
2015-01-24 17:35 - 2014-08-08 10:44 - 00002181 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2015-01-24 17:35 - 2013-10-22 09:18 - 00001149 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2015-01-24 17:17 - 2013-10-22 09:51 - 00000000 ____D () C:\Users\Tim\AppData\Roaming\.minecraft
2015-01-24 15:45 - 2013-10-23 08:34 - 00000000 ____D () C:\Program Files (x86)\Steam
2015-01-24 13:47 - 2013-11-13 07:41 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2015-01-20 19:01 - 2013-12-02 16:47 - 00000000 ____D () C:\ProgramData\YoutubeAdblocker
2015-01-16 19:34 - 2014-05-29 07:50 - 00000000 ____D () C:\Users\Tim\AppData\Local\Microsoft Games
2015-01-16 18:34 - 2013-10-23 09:01 - 00000000 ____D () C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2015-01-14 08:28 - 2013-09-30 15:30 - 00000000 ____D () C:\Windows\system32\MRT
2015-01-14 08:24 - 2013-09-30 15:30 - 113365784 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-01-09 18:07 - 2013-10-27 12:27 - 00267107 _____ () C:\Windows\DirectX.log
2015-01-09 17:53 - 2009-07-14 06:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2015-01-06 04:36 - 2010-11-21 04:27 - 00298120 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2015-01-05 18:16 - 2013-10-22 10:01 - 22764208 _____ () C:\Users\Tim\Desktop\TechnicLauncher.exe
2015-01-05 18:16 - 2013-10-22 10:01 - 00000000 ____D () C:\Users\Tim\AppData\Roaming\.technic
2015-01-03 00:50 - 2013-10-22 09:18 - 00001137 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-01-02 17:41 - 2014-06-09 15:34 - 00000000 ____D () C:\Users\Tim\AppData\Roaming\Skype
2015-01-02 16:32 - 2014-06-09 15:34 - 00000000 ___RD () C:\Program Files (x86)\Skype
2015-01-02 16:32 - 2014-06-09 15:34 - 00000000 ____D () C:\ProgramData\Skype
2015-01-02 12:01 - 2009-07-14 06:08 - 00032514 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-12-30 23:55 - 2014-10-18 07:25 - 00000000 ____D () C:\Users\Tim\AppData\Local\CSO

==================== Files in the root of some directories =======

2015-01-24 18:35 - 2015-01-25 17:35 - 0000057 _____ () C:\Users\Tim\AppData\Roaming\WB.CFG
2013-11-28 18:17 - 2013-11-28 18:17 - 0000091 _____ () C:\Users\Tim\AppData\Local\fusioncache.dat
2014-10-04 13:14 - 2014-10-04 13:14 - 0000000 _____ () C:\Users\Tim\AppData\Local\{26F9D811-A740-4CF8-B01D-202083068605}

Some content of TEMP:
====================
C:\Users\Tim\AppData\Local\Temp\APNSetup.exe
C:\Users\Tim\AppData\Local\Temp\CloudBackup3885.exe
C:\Users\Tim\AppData\Local\Temp\DataCard_Setup64.exe
C:\Users\Tim\AppData\Local\Temp\fp_pl_pfs_installer-1.exe
C:\Users\Tim\AppData\Local\Temp\fp_pl_pfs_installer.exe
C:\Users\Tim\AppData\Local\Temp\jre-7u51-windows-i586-iftw.exe
C:\Users\Tim\AppData\Local\Temp\jre-7u60-windows-i586-iftw.exe
C:\Users\Tim\AppData\Local\Temp\jre-7u67-windows-i586-iftw.exe
C:\Users\Tim\AppData\Local\Temp\MobileCM.exe
C:\Users\Tim\AppData\Local\Temp\nvSCPAPI.dll
C:\Users\Tim\AppData\Local\Temp\nvSCPAPI64.dll
C:\Users\Tim\AppData\Local\Temp\nvStInst.exe
C:\Users\Tim\AppData\Local\Temp\pcspeedup.exe
C:\Users\Tim\AppData\Local\Temp\ResetDevice.exe
C:\Users\Tim\AppData\Local\Temp\SimBundD.exe
C:\Users\Tim\AppData\Local\Temp\swt-win32-3349.dll
C:\Users\Tim\AppData\Local\Temp\vcredist_x64.exe

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2015-01-24 16:08

==================== End Of Log ============================

I've attached the MBR.dat zip and the Addition txt as per your instructions. I was a bit uncertain if you wanted addition.txt as an attachment or not. Please let me know if I got anything wrong!

(PS: By the way, I didn't receive a message to download the lastest avast! virus definitions when I ran aswMBR. Could be because we already have avast! installed.)

Attachments:

OCD

Post #4January 27, 2015, 6:55 PM UTC

Hi Svinlesha,

Note that we are in Sweden and that some of the items in the logs may be in Swedish.

Thanks for that information. Should I need anything translated I will be sure to ask.

=========================

Please run this first script in Safe Mode (probably the only way you can boot at the moment). After completing this first step try and boot in Normal Mode, then continue on with the steps. If you still cannot boot in Normal Mode then go back to Safe Mode w/ Networking to complete the steps.

=========================

[external image: bullseye_zpse9eaf36e.gif] FRST Fix Script

Open notepad. Please copy the contents of the code box below. To do this highlight the contents of the box and right click on it. Paste this into the open notepad. Save it on the desktop as fixlist.txt

Start
CloseProcesses:
Folder: C:\ProgramData\Surf annd ekeEp
Folder: C:\ProgramData\surff annd kkeep
HKLM-x32\…\RunOnce: [WSE_Vosteran] => C:\Windows\SysWOW64\wscript.exe /E:vbscript /B "C:\Users\Tim\AppData\Roaming\WSE_Vosteran\UpdateProc\bkup.dat"
HKU\S-1-5-21-3767168050-546541148-904736753-1000\…\RunOnce: [WSE_Vosteran] => C:\Windows\SysWOW64\wscript.exe /E:vbscript /B "C:\Users\Tim\AppData\Roaming\WSE_Vosteran\UpdateProc\bkup.dat"
HKU\S-1-5-21-3767168050-546541148-904736753-1000\…\MountPoints2: E - E:\AutoRun.exe
HKU\S-1-5-21-3767168050-546541148-904736753-1000\…\MountPoints2: {5480bd08-e76f-11e3-a348-00241dc449fa} - E:\AutoRun.exe
HKU\S-1-5-21-3767168050-546541148-904736753-1000\…\MountPoints2: {5b757370-e676-11e3-ba8d-00241dc449fa} - E:\AutoRun.exe
HKU\S-1-5-21-3767168050-546541148-904736753-1000\…\MountPoints2: {5b757384-e676-11e3-ba8d-00241dc449fa} - E:\AutoRun.exe
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
HKU\S-1-5-21-3767168050-546541148-904736753-1000\Software\Microsoft\Internet Explorer\Main,Start Page = http://vosteran.com/…r=668876811&ir=
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://vosteran.com/…r=668876811&ir=
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://vosteran.com/…r=668876811&ir=
SearchScopes: HKU\S-1-5-21-3767168050-546541148-904736753-1000 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://vosteran.com/…r=668876811&ir=
SearchScopes: HKU\S-1-5-21-3767168050-546541148-904736753-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://vosteran.com/…r=668876811&ir=
BHO: No Name -> {73CF76E3-40B6-C299-001B-0B0C06AB79F5} ->  No File
BHO: No Name -> {764E787A-518C-E931-F013-BD3BA3F0F7A3} ->  No File
BHO: No Name -> {BAC79AB2-0EEE-C9A4-1577-7355E883D4F8} ->  No File
BHO-x32: ace race 1.0.0.6 -> {68182220-3c75-49d9-a9c4-4093d3986279} -> C:\Program Files (x86)\ace race\aceracebho.dll (ace race)
BHO-x32: No Name -> {73CF76E3-40B6-C299-001B-0B0C06AB79F5} ->  No File
BHO-x32: No Name -> {764E787A-518C-E931-F013-BD3BA3F0F7A3} ->  No File
BHO-x32: No Name -> {BAC79AB2-0EEE-C9A4-1577-7355E883D4F8} ->  No File
Toolbar: HKLM - No Name - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} -  No File
Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} -  No File
FF DefaultSearchEngine: Vosteran
FF DefaultSearchUrl: https://se.search.yahoo.com/yhs/search
FF SelectedSearchEngine: Vosteran
FF Homepage: hxxp://vosteran.com/?f=1&a=vst_ggbg_15_04_ff&cd=2XzuyEtN2Y1L1QzutDtDtByEtC0D0CyEyEzy0F0AtDtByD0EtN0D0Tzu0StCtCtCzytN1L2XzutAtFyBtFtAtFtBtN1L1CzutCyEtBzytDyD1V1ByEtN1L1G1B1V1N2Y1L1Qzu2SyE0F0A0FyCtDtCyBtGzztCyB0AtG0C0D0AyDtGzytB0D0FtGtA0CyEyEtAtDtC0EzyyCtAtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyB0D0EtAtBtA0EtAtGtByB0A0FtGyE0BzztDtGzzzzzzyDtGyBtB0Azzzy0EyCyByC0A0ByE2Q&cr=668876811&ir=
FF Keyword.URL: https://se.search.yahoo.com/yhs/search
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin HKU\S-1-5-21-3767168050-546541148-904736753-1000: pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF SearchPlugin: C:\Users\Tim\AppData\Roaming\Mozilla\Firefox\Profiles\trq1irq0.default\searchplugins\ask-search.xml
FF SearchPlugin: C:\Users\Tim\AppData\Roaming\Mozilla\Firefox\Profiles\trq1irq0.default\searchplugins\Vosteran.xml
FF Extension: ace race 1.0.1 - C:\Users\Tim\AppData\Roaming\Mozilla\Firefox\Profiles\trq1irq0.default\Extensions\{4a90d0b9-0668-4ad5-92c2-d78786884485}.xpi [2015-01-24]
CHR HomePage: Default -> hxxp://vosteran.com/?f=1&a=vst_ggbg_15_04_ff&cd=2XzuyEtN2Y1L1QzutDtDtByEtC0D0CyEyEzy0F0AtDtByD0EtN0D0Tzu0StCtCtCzytN1L2XzutAtFyBtFtAtFtBtN1L1CzutCyEtBzytDyD1V1ByEtN1L1G1B1V1N2Y1L1Qzu2SyE0F0A0FyCtDtCyBtGzztCyB0AtG0C0D0AyDtGzytB0D0FtGtA0CyEyEtAtDtC0EzyyCtAtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyB0D0EtAtBtA0EtAtGtByB0A0FtGyE0BzztDtGzzzzzzyDtGyBtB0Azzzy0EyCyByC0A0ByE2Q&cr=668876811&ir=
CHR StartupUrls: Default -> "hxxp://vosteran.com/?f=7&a=vst_ggbg_15_04_ff&cd=2XzuyEtN2Y1L1QzutDtDtByEtC0D0CyEyEzy0F0AtDtByD0EtN0D0Tzu0StCtCtCzytN1L2XzutAtFyBtFtAtFtBtN1L1CzutCyEtBzytDyD1V1ByEtN1L1G1B1V1N2Y1L1Qzu2SyE0F0A0FyCtDtCyBtGzztCyB0AtG0C0D0AyDtGzytB0D0FtGtA0CyEyEtAtDtC0EzyyCtAtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyB0D0EtAtBtA0EtAtGtByB0A0FtGyE0BzztDtGzzzzzzyDtGyBtB0Azzzy0EyCyByC0A0ByE2Q&cr=668876811&ir=", "https://se.yahoo.com…&type=avastbcl"
CHR DefaultSearchKeyword: Default -> vosteran.com
CHR DefaultSearchURL: Default -> http://vosteran.com/…r=668876811&ir=
CHR Extension: (ace race) - C:\Users\Tim\AppData\Local\Google\Chrome\User Data\Default\Extensions\eiknpkdjaijoilnmlcmkgcelkafbnpbl [2015-01-25]
CHR Extension: (Vosteran New Tab) - C:\Users\Tim\AppData\Local\Google\Chrome\User Data\Default\Extensions\oilkkkefbalmbfppgjmgjoefbclebkce [2015-01-24]
CHR HKLM\…\Chrome\Extension: [oilkkkefbalmbfppgjmgjoefbclebkce] - No Path
CHR HKU\S-1-5-21-3767168050-546541148-904736753-1000\…\Chrome\Extension: [oilkkkefbalmbfppgjmgjoefbclebkce] - No Path
CHR HKLM-x32\…\Chrome\Extension: [oilkkkefbalmbfppgjmgjoefbclebkce] - No Path
S2 BackupStack;C:\Program Files (x86)\MyPC Backup\BackupStack.exe [53832 2014-11-25] (Just Develop It) <==== ATTENTION
Startup: C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyPC Backup.lnk
ShortcutTarget: MyPC Backup.lnk -> C:\Program Files (x86)\MyPC Backup\MyPC Backup.exe (MyPCBackup.com)
S2 Update ace race; C:\Program Files (x86)\ace race\updateacerace.exe [664816 2015-01-25] ()
S2 Util ace race; C:\Program Files (x86)\ace race\bin\utilacerace.exe [681200 2015-01-27] ()
2015-01-24 17:35 - 2015-01-25 17:35 - 00000284 _____ () C:\Windows\Tasks\WSE_Vosteran.job
2015-01-24 17:35 - 2015-01-24 17:36 - 00000000 ____D () C:\Users\Tim\AppData\Local\Vosteran
2015-01-24 17:35 - 2015-01-27 17:28 - 00000000 ____D () C:\Program Files (x86)\ace race
2015-01-24 17:35 - 2015-01-25 17:35 - 00000284 _____ () C:\Windows\Tasks\WSE_Vosteran.job
2015-01-24 17:35 - 2015-01-25 17:06 - 00003438 _____ () C:\Windows\System32\Tasks\CleanerPro_Popup
2015-01-24 17:35 - 2015-01-25 17:06 - 00000000 ____D () C:\Users\Tim\Documents\CleanerPro
2015-01-24 17:35 - 2015-01-24 17:36 - 00000000 ____D () C:\Users\Tim\AppData\Local\Vosteran
2015-01-24 17:35 - 2015-01-24 17:35 - 00004086 _____ () C:\Windows\System32\Tasks\Vosteran rati
2015-01-24 17:35 - 2015-01-24 17:35 - 00003212 _____ () C:\Windows\System32\Tasks\WSE_Vosteran
2015-01-24 17:35 - 2015-01-24 17:35 - 00003174 _____ () C:\Windows\System32\Tasks\CleanerPro_Start
2015-01-24 17:35 - 2015-01-24 17:35 - 00000000 ____D () C:\Users\Tim\AppData\Roaming\WSE_Vosteran
2015-01-24 17:35 - 2015-01-24 17:35 - 00000000 ____D () C:\Users\Tim\AppData\Roaming\1H1Q1V0B1L1G1N1V0M1P1Q1L1T0D1P1E2Z
2015-01-24 17:35 - 2015-01-24 17:35 - 00000000 ____D () C:\Users\Tim\AppData\Local\CleanerPro
2015-01-24 17:35 - 2015-01-24 17:35 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cleaner Pro
2015-01-24 17:35 - 2015-01-24 17:35 - 00000000 ____D () C:\ProgramData\{C6092ECA-968B-FF4C-270D-8FCEF78F5C40}
2015-01-24 17:35 - 2015-01-24 17:35 - 00000000 ____D () C:\Program Files (x86)\WSE_Vosteran
2015-01-24 17:35 - 2015-01-24 17:35 - 00000000 ____D () C:\Program Files (x86)\Cleaner Pro
2015-01-21 19:12 - 2015-01-22 07:29 - 00000000 ____D () C:\Program Files (x86)\MyPC Backup
2015-01-21 19:12 - 2015-01-21 19:12 - 01060200 _____ (Uniblue Systems Limited ) C:\Users\Tim\Downloads\pcmechanicpm.exe
2015-01-21 19:12 - 2015-01-21 19:12 - 00003200 _____ () C:\Windows\System32\Tasks\PC-Mechanic Maintenance
2015-01-21 19:12 - 2015-01-21 19:12 - 00002488 _____ () C:\Windows\System32\Tasks\PC-Mechanic Startup
2015-01-21 19:12 - 2015-01-21 19:12 - 00001071 _____ () C:\Users\Tim\Desktop\MyPC Backup.lnk
2015-01-25 16:41 - 2013-12-02 16:51 - 00000000 ____D () C:\ProgramData\Surf annd ekeEp
C:\Users\Tim\AppData\Local\Temp\APNSetup.exe
C:\Users\Tim\AppData\Local\Temp\CloudBackup3885.exe
C:\Users\Tim\AppData\Local\Temp\DataCard_Setup64.exe
C:\Users\Tim\AppData\Local\Temp\fp_pl_pfs_installer-1.exe
C:\Users\Tim\AppData\Local\Temp\fp_pl_pfs_installer.exe
C:\Users\Tim\AppData\Local\Temp\jre-7u51-windows-i586-iftw.exe
C:\Users\Tim\AppData\Local\Temp\jre-7u60-windows-i586-iftw.exe
C:\Users\Tim\AppData\Local\Temp\jre-7u67-windows-i586-iftw.exe
C:\Users\Tim\AppData\Local\Temp\MobileCM.exe
C:\Users\Tim\AppData\Local\Temp\nvSCPAPI.dll
C:\Users\Tim\AppData\Local\Temp\nvSCPAPI64.dll
C:\Users\Tim\AppData\Local\Temp\nvStInst.exe
C:\Users\Tim\AppData\Local\Temp\pcspeedup.exe
C:\Users\Tim\AppData\Local\Temp\ResetDevice.exe
C:\Users\Tim\AppData\Local\Temp\SimBundD.exe
C:\Users\Tim\AppData\Local\Temp\swt-win32-3349.dll
C:\Users\Tim\AppData\Local\Temp\vcredist_x64.exe
ace race (HKLM\…\ace race) (Version: 2015.01.24.132342 - ace race) <==== ATTENTION!
GoodGameEmpire (HKU\S-1-5-21-3767168050-546541148-904736753-1000\…\GoodGameEmpire) (Version:  - GoodGameEmpire) <==== ATTENTION!
MyPC Backup  (HKLM\…\MyPC Backup) (Version:  - JDi Backup Ltd) <==== ATTENTION
Pirates (HKU\S-1-5-21-3767168050-546541148-904736753-1000\…\Pirates) (Version:  - Pirates) <==== ATTENTION!
Ryzom (HKLM-x32\…\Ryzom) (Version:  - Ryzom) <==== ATTENTION!
SK.Enhancer (HKLM-x32\…\S-161304646) (Version: 1.1.0.1444 - PremiumSoft) <==== ATTENTION
StormFall (HKU\S-1-5-21-3767168050-546541148-904736753-1000\…\StormFall) (Version:  - StormFall) <==== ATTENTION!
Surf annd ekeEp (HKLM-x32\…\{A35CA8FF-CB7D-8361-1CB9-83219CD11C78}) (Version: 3.0.0.1080 - suRf anDD keepo) <==== ATTENTION
World Of WarCraft Packages (HKU\S-1-5-21-3767168050-546541148-904736753-1000\…\World Of WarCraft Packages) (Version:  - ) <==== ATTENTION
WorldofTanks (HKU\S-1-5-21-3767168050-546541148-904736753-1000\…\WorldofTanks) (Version:  - WorldofTanks) <==== ATTENTION!
Vosteran (HKU\S-1-5-21-3767168050-546541148-904736753-1000\…\Vosteran) (Version: 31.0.1650.23 - Vosteran) <==== ATTENTION!
WSE_Vosteran (HKLM-x32\…\WSE_Vosteran) (Version:  - WSE_Vosteran) <==== ATTENTION!
YoutubeAdblocker (HKLM-x32\…\{4820778D-AB0D-6D18-C316-52A6A0E1D507}) (Version: 1.1.0.1227 - YoutubeAdblocker) <==== ATTENTION
Task: {0054B32A-9A08-4880-B781-1A0144D02163} - System32\Tasks\WOT WTUE1 => Firefox.exe http://mmotraffic.com/catalog/goplay/1327/MTE3NjYvLy8xMzI3/ <==== ATTENTION
Task: {1A8E4D96-B77B-42E2-9032-DE0842EBF59C} - System32\Tasks\PC SpeedUp Service Deactivator => C:\Program Files (x86)\PC Speed Up\PCSUSD.exe <==== ATTENTION
Task: {4F65FDC1-CE4B-4547-878D-1F940CC69919} - System32\Tasks\LaunchSignup => C:\Program Files (x86)\MyPC Backup\Signup Wizard.exe [2014-11-25] (MyPC Backup) <==== ATTENTION
Task: {531EACD5-1D26-4083-89DA-AA81134C14ED} - System32\Tasks\Vosteran rati => C:\ProgramData\{C6092ECA-968B-FF4C-270D-8FCEF78F5C40}\1.9.0.1\f <==== ATTENTION
Task: {591EB1BA-19E3-4379-A9EB-107166A00CE0} - System32\Tasks\WOT WFRI1 => Firefox.exe http://mmotraffic.com/catalog/goplay/1327/MTE3NjYvLy8xMzI3/ <==== ATTENTION
Task: {5F997847-8013-40F0-8FBF-BB2C27ED4C08} - System32\Tasks\GoodGameEmpire NextW2 => Chrome.exe –app=http://a2g-secure.com/?E=bwsPamg0MAiwFF%2bnM1a0Fg%3d%3d&s1= –app-window-size=1440,900 <==== ATTENTION
Task: {60738156-F346-4BC0-914E-804846C4D2D7} - System32\Tasks\GoodGameEmpire NextW1 => Chrome.exe –app=http://a2g-secure.com/?E=bwsPamg0MAiwFF%2bnM1a0Fg%3d%3d&s1= –app-window-size=1440,900 <==== ATTENTION
Task: {85A9F0D6-47C9-44E7-B76B-27612BCCB044} - System32\Tasks\WOT W1 => Firefox.exe http://mmotraffic.com/catalog/goplay/1327/MTE3NjYvLy8xMzI3/ <==== ATTENTION
Task: {B14D944C-8ADA-47AA-A2AB-B35C6C5DF3E1} - System32\Tasks\WOT WW1 => Firefox.exe http://mmotraffic.com/catalog/goplay/1327/MTE3NjYvLy8xMzI3/ <==== ATTENTION
Task: {C6DE6D19-4CF0-415F-889C-CF050AA36C29} - System32\Tasks\WSE_Vosteran => C:\Users\Tim\AppData\Roaming\WSE_Vosteran\UpdateProc\UpdateTask.exe [2015-01-24] () <==== ATTENTION
Task: {C8C2EBB5-1778-4517-86CB-2DA25C933965} - System32\Tasks\WOT WTHUR1 => Firefox.exe http://mmotraffic.com/catalog/goplay/1327/MTE3NjYvLy8xMzI3/ <==== ATTENTION
Task: {E3FA7E52-4FB0-4BD9-AEBD-8C05F3BE2F8D} - System32\Tasks\WOT WW2 => Firefox.exe http://mmotraffic.com/catalog/goplay/1327/MTE3NjYvLy8xMzI3/ <==== ATTENTION
Task: {EB4DFD11-4059-4241-A212-EE714CD8AFEC} - System32\Tasks\WOT WWED1 => Firefox.exe http://mmotraffic.com/catalog/goplay/1327/MTE3NjYvLy8xMzI3/ <==== ATTENTION
Task: {F136AE5F-C6BF-4882-AC89-3B662C25EAF9} - System32\Tasks\GoodGameEmpire W1 => Chrome.exe –app=http://a2g-secure.com/?E=bwsPamg0MAiwFF%2bnM1a0Fg%3d%3d&s1= –app-window-size=1440,900 <==== ATTENTION
Task: C:\Windows\Tasks\WSE_Vosteran.job => C:\Users\Tim\AppData\Roaming\WSE_VO~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
EmptyTemp:
Hosts:
CMD: ipconfig /flushdns
End

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Run FRST and press the Fix button just once and wait.
The tool will make a log (Fixlog.txt) please post it to your reply.

=========================

[external image: bullseye_zpse9eaf36e.gif] Reboot in Normal Mode (if possible)

=========================

[external image: bullseye_zpse9eaf36e.gif] AdwCleaner v3: Scan & Clean

- Windows XP : Double click on the icon to run it.
- Windows Vista, Windows 7 & 8 : Right click and select "Run as Administrator"
Click on the Scan button.
AdwCleaner will begin to scan your computer like it did before.
After the scan has finished…
Click on the Clean button.
Press OK when asked to close all programs and follow the onscreen prompts.
Press OK again to allow AdwCleaner to restart the computer and complete the removal process.
After rebooting, a log file report (AdwCleaner[S0].txt) will open automatically.
Copy and paste the contents of that log file in your next reply.
A copy of that log file will also be saved in the C:\AdwCleaner folder.

=========================

[external image: bullseye_zpse9eaf36e.gif] Junkware Removal Tool

Download Junkware Removal Tool to your desktop.

- Windows XP : Double click on the icon to run it.
- Windows Vista, Windows 7 & 8 : Right click and select "Run as Administrator"
Shut down your protection software now to avoid potential conflicts.
The tool will open and start scanning your system.
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next message.

=========================

[external image: bullseye_zpse9eaf36e.gif] Reboot

=========================

[external image: bullseye_zpse9eaf36e.gif] Re-run Farbar Recovery Scan Tool it should be on your desktop.

- Windows XP : Double click on the icon to run it.
- Windows Vista, Windows 7 & 8 : Right click and select "Run as Administrator"
When the tool opens click Yes to disclaimer.
Select the Addition box
Press Scan button.
It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
It will also make (Addition.txt). Please attach it to your reply

=========================

In your next post please provide the following:

Fixlog.txt
AdwCleaner[S0].txt
JRT.txt
new FRST.txt
new Addition.txt

Svinlesha

Post #5January 28, 2015, 12:10 PM UTC

Hiya OCD!

Here are the logs per your request:

FIXLOG.TXT:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 24-01-2015 01

Ran by [removed] at 2015-01-28 11:58:36 Run:1

Running from C:\Users\[removed]\Desktop

[removed]

Boot Mode: Safe Mode (with Networking)

==============================================

Content of fixlist:

*****************

Start

CloseProcesses:

Folder: C:\ProgramData\Surf annd ekeEp

Folder: C:\ProgramData\surff annd kkeep

HKLM-x32\…\RunOnce: [WSE_Vosteran] => C:\Windows\SysWOW64\wscript.exe /E:vbscript /B "C:\Users\Tim\AppData\Roaming\WSE_Vosteran\UpdateProc\bkup.dat"

HKU\S-1-5-21-3767168050-546541148-904736753-1000\…\RunOnce: [WSE_Vosteran] => C:\Windows\SysWOW64\wscript.exe /E:vbscript /B "C:\Users\Tim\AppData\Roaming\WSE_Vosteran\UpdateProc\bkup.dat"

HKU\S-1-5-21-3767168050-546541148-904736753-1000\…\MountPoints2: E - E:\AutoRun.exe

HKU\S-1-5-21-3767168050-546541148-904736753-1000\…\MountPoints2: {5480bd08-e76f-11e3-a348-00241dc449fa} - E:\AutoRun.exe

HKU\S-1-5-21-3767168050-546541148-904736753-1000\…\MountPoints2: {5b757370-e676-11e3-ba8d-00241dc449fa} - E:\AutoRun.exe

HKU\S-1-5-21-3767168050-546541148-904736753-1000\…\MountPoints2: {5b757384-e676-11e3-ba8d-00241dc449fa} - E:\AutoRun.exe

GroupPolicy: Group Policy on Chrome detected <======= ATTENTION

CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

HKU\S-1-5-21-3767168050-546541148-904736753-1000\Software\Microsoft\Internet Explorer\Main,Start Page = http://vosteran.com/…r=668876811&ir;=

SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://vosteran.com/…r=668876811&ir;=

SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://vosteran.com/…r=668876811&ir;=

SearchScopes: HKU\S-1-5-21-3767168050-546541148-904736753-1000 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://vosteran.com/…r=668876811&ir;=

SearchScopes: HKU\S-1-5-21-3767168050-546541148-904736753-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://vosteran.com/…r=668876811&ir;=

BHO: No Name -> {73CF76E3-40B6-C299-001B-0B0C06AB79F5} -> No File

BHO: No Name -> {764E787A-518C-E931-F013-BD3BA3F0F7A3} -> No File

BHO: No Name -> {BAC79AB2-0EEE-C9A4-1577-7355E883D4F8} -> No File

BHO-x32: ace race 1.0.0.6 -> {68182220-3c75-49d9-a9c4-4093d3986279} -> C:\Program Files (x86)\ace race\aceracebho.dll (ace race)

BHO-x32: No Name -> {73CF76E3-40B6-C299-001B-0B0C06AB79F5} -> No File

BHO-x32: No Name -> {764E787A-518C-E931-F013-BD3BA3F0F7A3} -> No File

BHO-x32: No Name -> {BAC79AB2-0EEE-C9A4-1577-7355E883D4F8} -> No File

Toolbar: HKLM - No Name - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File

Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - No File

FF DefaultSearchEngine: Vosteran

FF DefaultSearchUrl: https://se.search.yahoo.com/yhs/search

FF SelectedSearchEngine: Vosteran

FF Homepage: hxxp://vosteran.com/?f=1&a;=vst_ggbg_15_04_ff&cd;=2XzuyEtN2Y1L1QzutDtDtByEtC0D0CyEyEzy0F0AtDtByD0EtN0D0Tzu0StCtCtCzytN1L2XzutAtFyBtFtAtFtBtN1L1CzutCyEtBzytDyD1V1ByEtN1L1G1B1V1N2Y1L1Qzu2SyE0F0A0FyCtDtCyBtGzztCyB0AtG0C0D0AyDtGzytB0D0FtGtA0CyEyEtAtDtC0EzyyCtAtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyB0D0EtAtBtA0EtAtGtByB0A0FtGyE0BzztDtGzzzzzzyDtGyBtB0Azzzy0EyCyByC0A0ByE2Q&cr;=668876811&ir;=

FF Keyword.URL: https://se.search.yahoo.com/yhs/search

FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

FF Plugin HKU\S-1-5-21-3767168050-546541148-904736753-1000: pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

FF SearchPlugin: C:\Users\Tim\AppData\Roaming\Mozilla\Firefox\Profiles\trq1irq0.default\searchplugins\ask-search.xml

FF SearchPlugin: C:\Users\Tim\AppData\Roaming\Mozilla\Firefox\Profiles\trq1irq0.default\searchplugins\Vosteran.xml

FF Extension: ace race 1.0.1 - C:\Users\Tim\AppData\Roaming\Mozilla\Firefox\Profiles\trq1irq0.default\Extensions\{4a90d0b9-0668-4ad5-92c2-d78786884485}.xpi [2015-01-24]

CHR HomePage: Default -> hxxp://vosteran.com/?f=1&a;=vst_ggbg_15_04_ff&cd;=2XzuyEtN2Y1L1QzutDtDtByEtC0D0CyEyEzy0F0AtDtByD0EtN0D0Tzu0StCtCtCzytN1L2XzutAtFyBtFtAtFtBtN1L1CzutCyEtBzytDyD1V1ByEtN1L1G1B1V1N2Y1L1Qzu2SyE0F0A0FyCtDtCyBtGzztCyB0AtG0C0D0AyDtGzytB0D0FtGtA0CyEyEtAtDtC0EzyyCtAtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyB0D0EtAtBtA0EtAtGtByB0A0FtGyE0BzztDtGzzzzzzyDtGyBtB0Azzzy0EyCyByC0A0ByE2Q&cr;=668876811&ir;=

CHR StartupUrls: Default -> "hxxp://vosteran.com/?f=7&a;=vst_ggbg_15_04_ff&cd;=2XzuyEtN2Y1L1QzutDtDtByEtC0D0CyEyEzy0F0AtDtByD0EtN0D0Tzu0StCtCtCzytN1L2XzutAtFyBtFtAtFtBtN1L1CzutCyEtBzytDyD1V1ByEtN1L1G1B1V1N2Y1L1Qzu2SyE0F0A0FyCtDtCyBtGzztCyB0AtG0C0D0AyDtGzytB0D0FtGtA0CyEyEtAtDtC0EzyyCtAtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyB0D0EtAtBtA0EtAtGtByB0A0FtGyE0BzztDtGzzzzzzyDtGyBtB0Azzzy0EyCyByC0A0ByE2Q&cr;=668876811&ir;=", "https://se.yahoo.com…&type;=avastbcl"

CHR DefaultSearchKeyword: Default -> vosteran.com

CHR DefaultSearchURL: Default -> http://vosteran.com/…r=668876811&ir;=

CHR Extension: (ace race) - C:\Users\Tim\AppData\Local\Google\Chrome\User Data\Default\Extensions\eiknpkdjaijoilnmlcmkgcelkafbnpbl [2015-01-25]

CHR Extension: (Vosteran New Tab) - C:\Users\Tim\AppData\Local\Google\Chrome\User Data\Default\Extensions\oilkkkefbalmbfppgjmgjoefbclebkce [2015-01-24]

CHR HKLM\…\Chrome\Extension: [oilkkkefbalmbfppgjmgjoefbclebkce] - No Path

CHR HKU\S-1-5-21-3767168050-546541148-904736753-1000\…\Chrome\Extension: [oilkkkefbalmbfppgjmgjoefbclebkce] - No Path

CHR HKLM-x32\…\Chrome\Extension: [oilkkkefbalmbfppgjmgjoefbclebkce] - No Path

S2 BackupStack;C:\Program Files (x86)\MyPC Backup\BackupStack.exe [53832 2014-11-25] (Just Develop It) <==== ATTENTION

Startup: C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyPC Backup.lnk

ShortcutTarget: MyPC Backup.lnk -> C:\Program Files (x86)\MyPC Backup\MyPC Backup.exe (MyPCBackup.com)

S2 Update ace race; C:\Program Files (x86)\ace race\updateacerace.exe [664816 2015-01-25] ()

S2 Util ace race; C:\Program Files (x86)\ace race\bin\utilacerace.exe [681200 2015-01-27] ()

2015-01-24 17:35 - 2015-01-25 17:35 - 00000284 _____ () C:\Windows\Tasks\WSE_Vosteran.job

2015-01-24 17:35 - 2015-01-24 17:36 - 00000000 ____D () C:\Users\Tim\AppData\Local\Vosteran

2015-01-24 17:35 - 2015-01-27 17:28 - 00000000 ____D () C:\Program Files (x86)\ace race

2015-01-24 17:35 - 2015-01-25 17:35 - 00000284 _____ () C:\Windows\Tasks\WSE_Vosteran.job

2015-01-24 17:35 - 2015-01-25 17:06 - 00003438 _____ () C:\Windows\System32\Tasks\CleanerPro_Popup

2015-01-24 17:35 - 2015-01-25 17:06 - 00000000 ____D () C:\Users\Tim\Documents\CleanerPro

2015-01-24 17:35 - 2015-01-24 17:36 - 00000000 ____D () C:\Users\Tim\AppData\Local\Vosteran

2015-01-24 17:35 - 2015-01-24 17:35 - 00004086 _____ () C:\Windows\System32\Tasks\Vosteran rati

2015-01-24 17:35 - 2015-01-24 17:35 - 00003212 _____ () C:\Windows\System32\Tasks\WSE_Vosteran

2015-01-24 17:35 - 2015-01-24 17:35 - 00003174 _____ () C:\Windows\System32\Tasks\CleanerPro_Start

2015-01-24 17:35 - 2015-01-24 17:35 - 00000000 ____D () C:\Users\Tim\AppData\Roaming\WSE_Vosteran

2015-01-24 17:35 - 2015-01-24 17:35 - 00000000 ____D () C:\Users\Tim\AppData\Roaming\1H1Q1V0B1L1G1N1V0M1P1Q1L1T0D1P1E2Z

2015-01-24 17:35 - 2015-01-24 17:35 - 00000000 ____D () C:\Users\Tim\AppData\Local\CleanerPro

2015-01-24 17:35 - 2015-01-24 17:35 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cleaner Pro

2015-01-24 17:35 - 2015-01-24 17:35 - 00000000 ____D () C:\ProgramData\{C6092ECA-968B-FF4C-270D-8FCEF78F5C40}

2015-01-24 17:35 - 2015-01-24 17:35 - 00000000 ____D () C:\Program Files (x86)\WSE_Vosteran

2015-01-24 17:35 - 2015-01-24 17:35 - 00000000 ____D () C:\Program Files (x86)\Cleaner Pro

2015-01-21 19:12 - 2015-01-22 07:29 - 00000000 ____D () C:\Program Files (x86)\MyPC Backup

2015-01-21 19:12 - 2015-01-21 19:12 - 01060200 _____ (Uniblue Systems Limited ) C:\Users\Tim\Downloads\pcmechanicpm.exe

2015-01-21 19:12 - 2015-01-21 19:12 - 00003200 _____ () C:\Windows\System32\Tasks\PC-Mechanic Maintenance

2015-01-21 19:12 - 2015-01-21 19:12 - 00002488 _____ () C:\Windows\System32\Tasks\PC-Mechanic Startup

2015-01-21 19:12 - 2015-01-21 19:12 - 00001071 _____ () C:\Users\Tim\Desktop\MyPC Backup.lnk

2015-01-25 16:41 - 2013-12-02 16:51 - 00000000 ____D () C:\ProgramData\Surf annd ekeEp

C:\Users\Tim\AppData\Local\Temp\APNSetup.exe

C:\Users\Tim\AppData\Local\Temp\CloudBackup3885.exe

C:\Users\Tim\AppData\Local\Temp\DataCard_Setup64.exe

C:\Users\Tim\AppData\Local\Temp\fp_pl_pfs_installer-1.exe

C:\Users\Tim\AppData\Local\Temp\fp_pl_pfs_installer.exe

C:\Users\Tim\AppData\Local\Temp\jre-7u51-windows-i586-iftw.exe

C:\Users\Tim\AppData\Local\Temp\jre-7u60-windows-i586-iftw.exe

C:\Users\Tim\AppData\Local\Temp\jre-7u67-windows-i586-iftw.exe

C:\Users\Tim\AppData\Local\Temp\MobileCM.exe

C:\Users\Tim\AppData\Local\Temp\nvSCPAPI.dll

C:\Users\Tim\AppData\Local\Temp\nvSCPAPI64.dll

C:\Users\Tim\AppData\Local\Temp\nvStInst.exe

C:\Users\Tim\AppData\Local\Temp\pcspeedup.exe

C:\Users\Tim\AppData\Local\Temp\ResetDevice.exe

C:\Users\Tim\AppData\Local\Temp\SimBundD.exe

C:\Users\Tim\AppData\Local\Temp\swt-win32-3349.dll

C:\Users\Tim\AppData\Local\Temp\vcredist_x64.exe

ace race (HKLM\…\ace race) (Version: 2015.01.24.132342 - ace race) <==== ATTENTION!

GoodGameEmpire (HKU\S-1-5-21-3767168050-546541148-904736753-1000\…\GoodGameEmpire) (Version: - GoodGameEmpire) <==== ATTENTION!

MyPC Backup (HKLM\…\MyPC Backup) (Version: - JDi Backup Ltd) <==== ATTENTION

Pirates (HKU\S-1-5-21-3767168050-546541148-904736753-1000\…\Pirates) (Version: - Pirates) <==== ATTENTION!

Ryzom (HKLM-x32\…\Ryzom) (Version: - Ryzom) <==== ATTENTION!

SK.Enhancer (HKLM-x32\…\S-161304646) (Version: 1.1.0.1444 - PremiumSoft) <==== ATTENTION

StormFall (HKU\S-1-5-21-3767168050-546541148-904736753-1000\…\StormFall) (Version: - StormFall) <==== ATTENTION!

Surf annd ekeEp (HKLM-x32\…\{A35CA8FF-CB7D-8361-1CB9-83219CD11C78}) (Version: 3.0.0.1080 - suRf anDD keepo) <==== ATTENTION

World Of WarCraft Packages (HKU\S-1-5-21-3767168050-546541148-904736753-1000\…\World Of WarCraft Packages) (Version: - ) <==== ATTENTION

WorldofTanks (HKU\S-1-5-21-3767168050-546541148-904736753-1000\…\WorldofTanks) (Version: - WorldofTanks) <==== ATTENTION!

Vosteran (HKU\S-1-5-21-3767168050-546541148-904736753-1000\…\Vosteran) (Version: 31.0.1650.23 - Vosteran) <==== ATTENTION!

WSE_Vosteran (HKLM-x32\…\WSE_Vosteran) (Version: - WSE_Vosteran) <==== ATTENTION!

YoutubeAdblocker (HKLM-x32\…\{4820778D-AB0D-6D18-C316-52A6A0E1D507}) (Version: 1.1.0.1227 - YoutubeAdblocker) <==== ATTENTION

Task: {0054B32A-9A08-4880-B781-1A0144D02163} - System32\Tasks\WOT WTUE1 => Firefox.exe http://mmotraffic.com/catalog/goplay/1327/MTE3NjYvLy8xMzI3/ <==== ATTENTION

Task: {1A8E4D96-B77B-42E2-9032-DE0842EBF59C} - System32\Tasks\PC SpeedUp Service Deactivator => C:\Program Files (x86)\PC Speed Up\PCSUSD.exe <==== ATTENTION

Task: {4F65FDC1-CE4B-4547-878D-1F940CC69919} - System32\Tasks\LaunchSignup => C:\Program Files (x86)\MyPC Backup\Signup Wizard.exe [2014-11-25] (MyPC Backup) <==== ATTENTION

Task: {531EACD5-1D26-4083-89DA-AA81134C14ED} - System32\Tasks\Vosteran rati => C:\ProgramData\{C6092ECA-968B-FF4C-270D-8FCEF78F5C40}\1.9.0.1\f <==== ATTENTION

Task: {591EB1BA-19E3-4379-A9EB-107166A00CE0} - System32\Tasks\WOT WFRI1 => Firefox.exe http://mmotraffic.com/catalog/goplay/1327/MTE3NjYvLy8xMzI3/ <==== ATTENTION

Task: {5F997847-8013-40F0-8FBF-BB2C27ED4C08} - System32\Tasks\GoodGameEmpire NextW2 => Chrome.exe –app=http://a2g-secure.com/?E=bwsPamg0MAiwFF%2bnM1a0Fg%3d%3d&s1;= –app-window-size=1440,900 <==== ATTENTION

Task: {60738156-F346-4BC0-914E-804846C4D2D7} - System32\Tasks\GoodGameEmpire NextW1 => Chrome.exe –app=http://a2g-secure.com/?E=bwsPamg0MAiwFF%2bnM1a0Fg%3d%3d&s1;= –app-window-size=1440,900 <==== ATTENTION

Task: {85A9F0D6-47C9-44E7-B76B-27612BCCB044} - System32\Tasks\WOT W1 => Firefox.exe http://mmotraffic.com/catalog/goplay/1327/MTE3NjYvLy8xMzI3/ <==== ATTENTION

Task: {B14D944C-8ADA-47AA-A2AB-B35C6C5DF3E1} - System32\Tasks\WOT WW1 => Firefox.exe http://mmotraffic.com/catalog/goplay/1327/MTE3NjYvLy8xMzI3/ <==== ATTENTION

Task: {C6DE6D19-4CF0-415F-889C-CF050AA36C29} - System32\Tasks\WSE_Vosteran => C:\Users\Tim\AppData\Roaming\WSE_Vosteran\UpdateProc\UpdateTask.exe [2015-01-24] () <==== ATTENTION

Task: {C8C2EBB5-1778-4517-86CB-2DA25C933965} - System32\Tasks\WOT WTHUR1 => Firefox.exe http://mmotraffic.com/catalog/goplay/1327/MTE3NjYvLy8xMzI3/ <==== ATTENTION

Task: {E3FA7E52-4FB0-4BD9-AEBD-8C05F3BE2F8D} - System32\Tasks\WOT WW2 => Firefox.exe http://mmotraffic.com/catalog/goplay/1327/MTE3NjYvLy8xMzI3/ <==== ATTENTION

Task: {EB4DFD11-4059-4241-A212-EE714CD8AFEC} - System32\Tasks\WOT WWED1 => Firefox.exe http://mmotraffic.com/catalog/goplay/1327/MTE3NjYvLy8xMzI3/ <==== ATTENTION

Task: {F136AE5F-C6BF-4882-AC89-3B662C25EAF9} - System32\Tasks\GoodGameEmpire W1 => Chrome.exe –app=http://a2g-secure.com/?E=bwsPamg0MAiwFF%2bnM1a0Fg%3d%3d&s1;= –app-window-size=1440,900 <==== ATTENTION

Task: C:\Windows\Tasks\WSE_Vosteran.job => C:\Users\Tim\AppData\Roaming\WSE_VO~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION

EmptyTemp:

Hosts:

CMD: ipconfig /flushdns

End

*****************

Processes closed successfully.

========================= Folder: C:\ProgramData\Surf annd ekeEp ========================

2013-12-02 16:51 - 2013-12-02 16:51 - 0003950 _____ () C:\ProgramData\Surf annd ekeEp\B1zeEWuh.dat

2013-12-02 16:51 - 2013-12-02 16:51 - 0494080 _____ (Setup) C:\ProgramData\Surf annd ekeEp\B1zeEWuh.exe

====== End of Folder: ======

========================= Folder: C:\ProgramData\surff annd kkeep ========================

2013-12-02 16:47 - 2013-12-02 16:47 - 0003418 _____ () C:\ProgramData\surff annd kkeep\ymcZgDCvy.dat

2012-12-02 16:47 - 2012-12-02 16:47 - 0494080 _____ (Setup) C:\ProgramData\surff annd kkeep\ymcZgDCvy.exe

====== End of Folder: ======

HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\\WSE_Vosteran => value deleted successfully.

HKU\S-1-5-21-3767168050-546541148-904736753-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\\WSE_Vosteran => value deleted successfully.

"HKU\S-1-5-21-3767168050-546541148-904736753-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\E" => Key deleted successfully.

"HKU\S-1-5-21-3767168050-546541148-904736753-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5480bd08-e76f-11e3-a348-00241dc449fa}" => Key deleted successfully.

HKCR\CLSID\{5480bd08-e76f-11e3-a348-00241dc449fa} => Key not found.

"HKU\S-1-5-21-3767168050-546541148-904736753-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5b757370-e676-11e3-ba8d-00241dc449fa}" => Key deleted successfully.

HKCR\CLSID\{5b757370-e676-11e3-ba8d-00241dc449fa} => Key not found.

"HKU\S-1-5-21-3767168050-546541148-904736753-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5b757384-e676-11e3-ba8d-00241dc449fa}" => Key deleted successfully.

HKCR\CLSID\{5b757384-e676-11e3-ba8d-00241dc449fa} => Key not found.

C:\Windows\system32\GroupPolicy\Machine => Moved successfully.

C:\Windows\system32\GroupPolicy\GPT.ini => Moved successfully.

"HKLM\SOFTWARE\Policies\Google" => Key deleted successfully.

HKU\S-1-5-21-3767168050-546541148-904736753-1000\Software\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully.

HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully.

"HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" => Key deleted successfully.

HKCR\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => Key not found.

HKU\S-1-5-21-3767168050-546541148-904736753-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.

"HKU\S-1-5-21-3767168050-546541148-904736753-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" => Key deleted successfully.

HKCR\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => Key not found.

"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{73CF76E3-40B6-C299-001B-0B0C06AB79F5}" => Key deleted successfully.

HKCR\CLSID\{73CF76E3-40B6-C299-001B-0B0C06AB79F5} => Key not found.

"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{764E787A-518C-E931-F013-BD3BA3F0F7A3}" => Key deleted successfully.

HKCR\CLSID\{764E787A-518C-E931-F013-BD3BA3F0F7A3} => Key not found.

"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BAC79AB2-0EEE-C9A4-1577-7355E883D4F8}" => Key deleted successfully.

HKCR\CLSID\{BAC79AB2-0EEE-C9A4-1577-7355E883D4F8} => Key not found.

"HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{68182220-3c75-49d9-a9c4-4093d3986279}" => Key deleted successfully.

"HKCR\Wow6432Node\CLSID\{68182220-3c75-49d9-a9c4-4093d3986279}" => Key deleted successfully.

"HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{73CF76E3-40B6-C299-001B-0B0C06AB79F5}" => Key deleted successfully.

HKCR\Wow6432Node\CLSID\{73CF76E3-40B6-C299-001B-0B0C06AB79F5} => Key not found.

"HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{764E787A-518C-E931-F013-BD3BA3F0F7A3}" => Key deleted successfully.

HKCR\Wow6432Node\CLSID\{764E787A-518C-E931-F013-BD3BA3F0F7A3} => Key not found.

"HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BAC79AB2-0EEE-C9A4-1577-7355E883D4F8}" => Key deleted successfully.

HKCR\Wow6432Node\CLSID\{BAC79AB2-0EEE-C9A4-1577-7355E883D4F8} => Key not found.

HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\\{318A227B-5E9F-45bd-8999-7F8F10CA4CF5} => value deleted successfully.

HKCR\CLSID\{318A227B-5E9F-45bd-8999-7F8F10CA4CF5} => Key not found.

HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\\{CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} => value deleted successfully.

HKCR\CLSID\{CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} => Key not found.

Firefox DefaultSearchEngine deleted successfully.

Firefox DefaultSearchUrl deleted successfully.

Firefox SelectedSearchEngine deleted successfully.

Firefox homepage deleted successfully.

Firefox Keyword.URL deleted successfully.

"HKLM\Software\Wow6432Node\MozillaPlugins\@pandonetworks.com/PandoWebPlugin" => Key deleted successfully.

C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll => Moved successfully.

"HKU\S-1-5-21-3767168050-546541148-904736753-1000\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin" => Key deleted successfully.

C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll not found.

C:\Users\Tim\AppData\Roaming\Mozilla\Firefox\Profiles\trq1irq0.default\searchplugins\ask-search.xml => Moved successfully.

C:\Users\Tim\AppData\Roaming\Mozilla\Firefox\Profiles\trq1irq0.default\searchplugins\Vosteran.xml => Moved successfully.

C:\Users\Tim\AppData\Roaming\Mozilla\Firefox\Profiles\trq1irq0.default\Extensions\{4a90d0b9-0668-4ad5-92c2-d78786884485}.xpi => Moved successfully.

Chrome HomePage deleted successfully.

Chrome StartupUrls deleted successfully.

Chrome DefaultSearchKeyword deleted successfully.

Chrome DefaultSearchURL deleted successfully.

C:\Users\Tim\AppData\Local\Google\Chrome\User Data\Default\Extensions\eiknpkdjaijoilnmlcmkgcelkafbnpbl => Moved successfully.

C:\Users\Tim\AppData\Local\Google\Chrome\User Data\Default\Extensions\oilkkkefbalmbfppgjmgjoefbclebkce => Moved successfully.

"HKLM\SOFTWARE\Google\Chrome\Extensions\oilkkkefbalmbfppgjmgjoefbclebkce" => Key deleted successfully.

"HKU\S-1-5-21-3767168050-546541148-904736753-1000\SOFTWARE\Google\Chrome\Extensions\oilkkkefbalmbfppgjmgjoefbclebkce" => Key deleted successfully.

"HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\oilkkkefbalmbfppgjmgjoefbclebkce" => Key deleted successfully.

BackupStack => Service deleted successfully.

C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyPC Backup.lnk => Moved successfully.

C:\Program Files (x86)\MyPC Backup\MyPC Backup.exe => Moved successfully.

Update ace race => Service deleted successfully.

Util ace race => Service deleted successfully.

C:\Windows\Tasks\WSE_Vosteran.job => Moved successfully.

C:\Users\Tim\AppData\Local\Vosteran => Moved successfully.

C:\Program Files (x86)\ace race => Moved successfully.

"C:\Windows\Tasks\WSE_Vosteran.job" => File/Directory not found.

C:\Windows\System32\Tasks\CleanerPro_Popup => Moved successfully.

C:\Users\Tim\Documents\CleanerPro => Moved successfully.

"C:\Users\Tim\AppData\Local\Vosteran" => File/Directory not found.

C:\Windows\System32\Tasks\Vosteran rati => Moved successfully.

C:\Windows\System32\Tasks\WSE_Vosteran => Moved successfully.

C:\Windows\System32\Tasks\CleanerPro_Start => Moved successfully.

C:\Users\Tim\AppData\Roaming\WSE_Vosteran => Moved successfully.

C:\Users\Tim\AppData\Roaming\1H1Q1V0B1L1G1N1V0M1P1Q1L1T0D1P1E2Z => Moved successfully.

C:\Users\Tim\AppData\Local\CleanerPro => Moved successfully.

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cleaner Pro => Moved successfully.

C:\ProgramData\{C6092ECA-968B-FF4C-270D-8FCEF78F5C40} => Moved successfully.

C:\Program Files (x86)\WSE_Vosteran => Moved successfully.

C:\Program Files (x86)\Cleaner Pro => Moved successfully.

C:\Program Files (x86)\MyPC Backup => Moved successfully.

C:\Users\Tim\Downloads\pcmechanicpm.exe => Moved successfully.

C:\Windows\System32\Tasks\PC-Mechanic Maintenance => Moved successfully.

C:\Windows\System32\Tasks\PC-Mechanic Startup => Moved successfully.

C:\Users\Tim\Desktop\MyPC Backup.lnk => Moved successfully.

C:\ProgramData\Surf annd ekeEp => Moved successfully.

C:\Users\Tim\AppData\Local\Temp\APNSetup.exe => Moved successfully.

C:\Users\Tim\AppData\Local\Temp\CloudBackup3885.exe => Moved successfully.

C:\Users\Tim\AppData\Local\Temp\DataCard_Setup64.exe => Moved successfully.

C:\Users\Tim\AppData\Local\Temp\fp_pl_pfs_installer-1.exe => Moved successfully.

C:\Users\Tim\AppData\Local\Temp\fp_pl_pfs_installer.exe => Moved successfully.

C:\Users\Tim\AppData\Local\Temp\jre-7u51-windows-i586-iftw.exe => Moved successfully.

C:\Users\Tim\AppData\Local\Temp\jre-7u60-windows-i586-iftw.exe => Moved successfully.

C:\Users\Tim\AppData\Local\Temp\jre-7u67-windows-i586-iftw.exe => Moved successfully.

C:\Users\Tim\AppData\Local\Temp\MobileCM.exe => Moved successfully.

C:\Users\Tim\AppData\Local\Temp\nvSCPAPI.dll => Moved successfully.

C:\Users\Tim\AppData\Local\Temp\nvSCPAPI64.dll => Moved successfully.

C:\Users\Tim\AppData\Local\Temp\nvStInst.exe => Moved successfully.

C:\Users\Tim\AppData\Local\Temp\pcspeedup.exe => Moved successfully.

C:\Users\Tim\AppData\Local\Temp\ResetDevice.exe => Moved successfully.

C:\Users\Tim\AppData\Local\Temp\SimBundD.exe => Moved successfully.

C:\Users\Tim\AppData\Local\Temp\swt-win32-3349.dll => Moved successfully.

C:\Users\Tim\AppData\Local\Temp\vcredist_x64.exe => Moved successfully.

ace race (HKLM\…\ace race) (Version: 2015.01.24.132342 - ace race) <==== ATTENTION! => Error: No automatic fix found for this entry.

GoodGameEmpire (HKU\S-1-5-21-3767168050-546541148-904736753-1000\…\GoodGameEmpire) (Version: - GoodGameEmpire) <==== ATTENTION! => Error: No automatic fix found for this entry.

MyPC Backup (HKLM\…\MyPC Backup) (Version: - JDi Backup Ltd) <==== ATTENTION => Error: No automatic fix found for this entry.

Pirates (HKU\S-1-5-21-3767168050-546541148-904736753-1000\…\Pirates) (Version: - Pirates) <==== ATTENTION! => Error: No automatic fix found for this entry.

Ryzom (HKLM-x32\…\Ryzom) (Version: - Ryzom) <==== ATTENTION! => Error: No automatic fix found for this entry.

SK.Enhancer (HKLM-x32\…\S-161304646) (Version: 1.1.0.1444 - PremiumSoft) <==== ATTENTION => Error: No automatic fix found for this entry.

StormFall (HKU\S-1-5-21-3767168050-546541148-904736753-1000\…\StormFall) (Version: - StormFall) <==== ATTENTION! => Error: No automatic fix found for this entry.

Surf annd ekeEp (HKLM-x32\…\{A35CA8FF-CB7D-8361-1CB9-83219CD11C78}) (Version: 3.0.0.1080 - suRf anDD keepo) <==== ATTENTION => Error: No automatic fix found for this entry.

World Of WarCraft Packages (HKU\S-1-5-21-3767168050-546541148-904736753-1000\…\World Of WarCraft Packages) (Version: - ) <==== ATTENTION => Error: No automatic fix found for this entry.

WorldofTanks (HKU\S-1-5-21-3767168050-546541148-904736753-1000\…\WorldofTanks) (Version: - WorldofTanks) <==== ATTENTION! => Error: No automatic fix found for this entry.

Vosteran (HKU\S-1-5-21-3767168050-546541148-904736753-1000\…\Vosteran) (Version: 31.0.1650.23 - Vosteran) <==== ATTENTION! => Error: No automatic fix found for this entry.

WSE_Vosteran (HKLM-x32\…\WSE_Vosteran) (Version: - WSE_Vosteran) <==== ATTENTION! => Error: No automatic fix found for this entry.

YoutubeAdblocker (HKLM-x32\…\{4820778D-AB0D-6D18-C316-52A6A0E1D507}) (Version: 1.1.0.1227 - YoutubeAdblocker) <==== ATTENTION => Error: No automatic fix found for this entry.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{0054B32A-9A08-4880-B781-1A0144D02163}" => Key deleted successfully.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{0054B32A-9A08-4880-B781-1A0144D02163}" => Key deleted successfully.

C:\Windows\System32\Tasks\WOT WTUE1 => Moved successfully.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\WOT WTUE1" => Key deleted successfully.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{1A8E4D96-B77B-42E2-9032-DE0842EBF59C}" => Key deleted successfully.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{1A8E4D96-B77B-42E2-9032-DE0842EBF59C}" => Key deleted successfully.

C:\Windows\System32\Tasks\PC SpeedUp Service Deactivator => Moved successfully.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\PC SpeedUp Service Deactivator" => Key deleted successfully.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{4F65FDC1-CE4B-4547-878D-1F940CC69919}" => Key deleted successfully.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{4F65FDC1-CE4B-4547-878D-1F940CC69919}" => Key deleted successfully.

C:\Windows\System32\Tasks\LaunchSignup => Moved successfully.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\LaunchSignup" => Key deleted successfully.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{531EACD5-1D26-4083-89DA-AA81134C14ED}" => Key deleted successfully.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{531EACD5-1D26-4083-89DA-AA81134C14ED}" => Key deleted successfully.

C:\Windows\System32\Tasks\Vosteran rati not found.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Vosteran rati" => Key deleted successfully.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{591EB1BA-19E3-4379-A9EB-107166A00CE0}" => Key deleted successfully.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{591EB1BA-19E3-4379-A9EB-107166A00CE0}" => Key deleted successfully.

C:\Windows\System32\Tasks\WOT WFRI1 => Moved successfully.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\WOT WFRI1" => Key deleted successfully.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{5F997847-8013-40F0-8FBF-BB2C27ED4C08}" => Key deleted successfully.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{5F997847-8013-40F0-8FBF-BB2C27ED4C08}" => Key deleted successfully.

C:\Windows\System32\Tasks\GoodGameEmpire NextW2 => Moved successfully.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\GoodGameEmpire NextW2" => Key deleted successfully.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{60738156-F346-4BC0-914E-804846C4D2D7}" => Key deleted successfully.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{60738156-F346-4BC0-914E-804846C4D2D7}" => Key deleted successfully.

C:\Windows\System32\Tasks\GoodGameEmpire NextW1 => Moved successfully.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\GoodGameEmpire NextW1" => Key deleted successfully.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{85A9F0D6-47C9-44E7-B76B-27612BCCB044}" => Key deleted successfully.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{85A9F0D6-47C9-44E7-B76B-27612BCCB044}" => Key deleted successfully.

C:\Windows\System32\Tasks\WOT W1 => Moved successfully.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\WOT W1" => Key deleted successfully.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{B14D944C-8ADA-47AA-A2AB-B35C6C5DF3E1}" => Key deleted successfully.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{B14D944C-8ADA-47AA-A2AB-B35C6C5DF3E1}" => Key deleted successfully.

C:\Windows\System32\Tasks\WOT WW1 => Moved successfully.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\WOT WW1" => Key deleted successfully.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{C6DE6D19-4CF0-415F-889C-CF050AA36C29}" => Key deleted successfully.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C6DE6D19-4CF0-415F-889C-CF050AA36C29}" => Key deleted successfully.

C:\Windows\System32\Tasks\WSE_Vosteran not found.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\WSE_Vosteran" => Key deleted successfully.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{C8C2EBB5-1778-4517-86CB-2DA25C933965}" => Key deleted successfully.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C8C2EBB5-1778-4517-86CB-2DA25C933965}" => Key deleted successfully.

C:\Windows\System32\Tasks\WOT WTHUR1 => Moved successfully.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\WOT WTHUR1" => Key deleted successfully.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{E3FA7E52-4FB0-4BD9-AEBD-8C05F3BE2F8D}" => Key deleted successfully.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{E3FA7E52-4FB0-4BD9-AEBD-8C05F3BE2F8D}" => Key deleted successfully.

C:\Windows\System32\Tasks\WOT WW2 => Moved successfully.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\WOT WW2" => Key deleted successfully.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{EB4DFD11-4059-4241-A212-EE714CD8AFEC}" => Key deleted successfully.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{EB4DFD11-4059-4241-A212-EE714CD8AFEC}" => Key deleted successfully.

C:\Windows\System32\Tasks\WOT WWED1 => Moved successfully.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\WOT WWED1" => Key deleted successfully.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{F136AE5F-C6BF-4882-AC89-3B662C25EAF9}" => Key deleted successfully.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F136AE5F-C6BF-4882-AC89-3B662C25EAF9}" => Key deleted successfully.

C:\Windows\System32\Tasks\GoodGameEmpire W1 => Moved successfully.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\GoodGameEmpire W1" => Key deleted successfully.

C:\Windows\Tasks\WSE_Vosteran.job not found.

C:\Windows\System32\Drivers\etc\hosts => Moved successfully.

Hosts was reset successfully.

========= ipconfig /flushdns =========

IP-konfiguration f�r Windows

DNS-matcharens cacheminne har rensats.

========= End of CMD: =========

EmptyTemp: => Removed 4.4 GB temporary data.

The system needed a reboot.

==== End of Fixlog 11:59:44 ====

AdwCleaner[S0].txt:

# AdwCleaner v4.109 - Report created 28/01/2015 at 12:21:34

# Updated 24/01/2015 by Xplode

# Database : 2015-01-26.1 [Live]

# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)

# Username : Tim - INET

# Running from : C:\Users\Tim\Desktop\AdwCleaner.exe

# Option : Clean

***** [ Services ] *****

Service Deleted : {4a90d0b9-0668-4ad5-92c2-d78786884485}Gw64

Service Deleted : {56db9de0-c769-4563-8e82-7e39885bf1ad}Gw64

***** [ Files / Folders ] *****

Folder Deleted : C:\ProgramData\apn

Folder Deleted : C:\ProgramData\QuickSet

Folder Deleted : C:\ProgramData\surff annd kkeep

Folder Deleted : C:\ProgramData\YoutubeAdblocker

Folder Deleted : C:\ProgramData\d96b0b4e1ec89f20

Folder Deleted : C:\Program Files (x86)\EliteUnzip

Folder Deleted : C:\Program Files (x86)\surff annd kkeep

Folder Deleted : C:\Program Files (x86)\YoutubeAdblocker

Folder Deleted : C:\Program Files (x86)\Surf annd ekeEp

Folder Deleted : C:\Users\Tim\AppData\Local\Vosteran

Folder Deleted : C:\Users\Tim\AppData\Local\Mindspark_Interactive_Net

Folder Deleted : C:\Users\Tim\AppData\Roaming\WebExtend

Folder Deleted : C:\Users\Tim\AppData\Roaming\Cleaner Pro

Folder Deleted : C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MyPC Backup

Folder Deleted : C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Elite Unzip

Folder Deleted : C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Vosteran

File Deleted : C:\Windows\System32\drivers\{4a90d0b9-0668-4ad5-92c2-d78786884485}Gw64.sys

File Deleted : C:\Windows\System32\drivers\{56db9de0-c769-4563-8e82-7e39885bf1ad}Gw64.sys

File Deleted : C:\Users\Tim\Desktop\Sync Folder.lnk

File Deleted : C:\Users\Tim\AppData\Roaming\Mozilla\Firefox\Profiles\trq1irq0.default\searchplugins\bingp.xml

File Deleted : C:\Users\Tim\AppData\Roaming\Mozilla\Firefox\Profiles\trq1irq0.default\user.js

File Deleted : C:\Users\Tim\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.superfish.com_0.localstorage

File Deleted : C:\Users\Tim\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_www.superfish.com_0.localstorage

File Deleted : C:\Users\Tim\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_eliteunzip.dl.tb.ask.com_0.localstorage

***** [ Scheduled Tasks ] *****

Task Deleted : WOT WMON1

Task Deleted : WOT W2

Task Deleted : WOT T

Task Deleted : WOT N

Task Deleted : PC-Mechanic Startup

Task Deleted : PC-Mechanic Maintenance

Task Deleted : GoodGameEmpire W2

***** [ Shortcuts ] *****

Shortcut Disinfected : C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WorldofTanks\WorldofTanks.lnk

Shortcut Disinfected : C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\GoodGameEmpire\GoodGameEmpire.lnk

Shortcut Disinfected : C:\Users\Tim\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\GoodGameEmpire.lnk

Shortcut Disinfected : C:\Users\Tim\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\WorldofTanks.lnk

***** [ Registry ] *****

Key Deleted : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\superfish.com

Key Deleted : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\www.superfish.com

Key Deleted : HKLM\SOFTWARE\Classes\and

Key Deleted : HKLM\SOFTWARE\Classes\surf

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\mypc backup

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\S-161304646

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{4AA46D49-459F-4358-B4D1-169048547C23}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{5A4E3A41-FA55-4BDA-AED7-CEBE6E7BCB52}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{4E6354DE-9115-4AEE-BD21-C46C3E8A49DB}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{FC073BDA-C115-4A1D-9DF9-9B5C461482E5}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{A2D733A7-73B0-4C6B-B0C7-06A432950B66}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{4AA46D49-459F-4358-B4D1-169048547C23}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{5A4E3A41-FA55-4BDA-AED7-CEBE6E7BCB52}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{4E6354DE-9115-4AEE-BD21-C46C3E8A49DB}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{FC073BDA-C115-4A1D-9DF9-9B5C461482E5}

Key Deleted : HKCU\Software\InstallCore

Key Deleted : HKCU\Software\RegisteredApplicationsEx

Key Deleted : HKCU\Software\Softonic

Key Deleted : HKCU\Software\Vosteran Browser

Key Deleted : HKCU\Software\WSE_Vosteran

Key Deleted : HKCU\Software\Vosteran

Key Deleted : HKLM\SOFTWARE\Uniblue

Key Deleted : HKLM\SOFTWARE\SK.Enhancer

Key Deleted : HKLM\SOFTWARE\Mindspark

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Vosteran

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\WorldofTanks

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4820778D-AB0D-6D18-C316-52A6A0E1D507}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A35CA8FF-CB7D-8361-1CB9-83219CD11C78}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WSE_Vosteran

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyPC Backup

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.17496

-\\ Mozilla Firefox v35.0.1 (x86 sv-SE)

[trq1irq0.default\prefs.js] - Line Deleted : user_pref("extensions.srchvstrn.hmpgUrl", "hxxp://vosteran.com/?f=1&a;=vst_ggbg_15_04_ff&cd;=2XzuyEtN2Y1L1QzutDtDtByEtC0D0CyEyEzy0F0AtDtByD0EtN0D0Tzu0StCtCtCzytN1L2XzutAtFyBtFtAtFtBtN1L1CzutCyEtBzytDyD1[…]

[trq1irq0.default\prefs.js] - Line Deleted : user_pref("extensions.srchvstrn.newTabUrl", "hxxp://vosteran.com/?f=2&a;=vst_ggbg_15_04_ff&cd;=2XzuyEtN2Y1L1QzutDtDtByEtC0D0CyEyEzy0F0AtDtByD0EtN0D0Tzu0StCtCtCzytN1L2XzutAtFyBtFtAtFtBtN1L1CzutCyEtBzytDy[…]

[trq1irq0.default\prefs.js] - Line Deleted : user_pref("extensions.srchvstrn.prtnrId", "WSE_Vosteran");

[trq1irq0.default\prefs.js] - Line Deleted : user_pref("extensions.srchvstrn.srchPrvdr", "Vosteran");

[trq1irq0.default\prefs.js] - Line Deleted : user_pref("extensions.srchvstrn.tlbrSrchUrl", "hxxp://vosteran.com/?f=3&a;=vst_ggbg_15_04_ff&cd;=2XzuyEtN2Y1L1QzutDtDtByEtC0D0CyEyEzy0F0AtDtByD0EtN0D0Tzu0StCtCtCzytN1L2XzutAtFyBtFtAtFtBtN1L1CzutCyEtBzyt[…]

[trq1irq0.default\prefs.js] - Line Deleted : user_pref("[removed]-event-fired", true);

-\\ Google Chrome v40.0.2214.91

[C:\Users\Tim\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [Search Provider] : hxxp://vosteran.com/results.php?f=4&q;={searchTerms}&a;=vst_ggbg_15_04_ff&cd;=2XzuyEtN2Y1L1QzutDtDtByEtC0D0CyEyEzy0F0AtDtByD0EtN0D0Tzu0StCtCtCzytN1L2XzutAtFyBtFtAtFtBtN1L1CzutCyEtBzytDyD1V1ByEtN1L1G1B1V1N2Y1L1Qzu2SyE0F0A0FyCtDtCyBtGzztCyB0AtG0C0D0AyDtGzytB0D0FtGtA0CyEyEtAtDtC0EzyyCtAtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyB0D0EtAtBtA0EtAtGtByB0A0FtGyE0BzztDtGzzzzzzyDtGyBtB0Azzzy0EyCyByC0A0ByE2Q&cr;=668876811&ir;=

-\\ Chromium v

*************************

AdwCleaner[R0].txt - [8477 octets] - [28/01/2015 12:08:18]

AdwCleaner[S0].txt - [9261 octets] - [28/01/2015 12:21:34]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [9321 octets] ##########

JRT.TXT:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 6.4.1 (12.28.2014:1)

OS: Windows 7 Home Premium x64

Ran by [removed] on 2015-01-28 at 12:32:39,86

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Registry Values

~~~ Registry Keys

~~~ Files

~~~ Folders

Successfully deleted: [Folder] "C:\Windows\syswow64\ai_recyclebin"

~~~ FireFox

Emptied folder: C:\Users\Tim\AppData\Roaming\mozilla\firefox\profiles\trq1irq0.default\minidumps [102 files]

~~~ Event Viewer Logs were cleared

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on 2015-01-28 at 12:36:00,47

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

NEW FRST.TXT:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 24-01-2015 01

Ran by [removed] (administrator) on INET on 28-01-2015 12:52:25

Running from C:\Users\[removed]\Desktop

[removed]

Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Svenska (Sverige)

Internet Explorer Version 11 (Default browser: FF)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe

(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe

(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe

(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

() C:\Windows\SysWOW64\PnkBstrA.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

(Avast Software) C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe

(AVAST Software) C:\Program Files\AVAST Software\Avast\ng\ngservice.exe

(Microsoft Corporation) C:\Windows\System32\wbem\WMIADAP.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\…\Run: [Nvtmru] => "C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe"

HKLM\…\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2352072 2014-05-30] (NVIDIA Corporation)

HKLM\…\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart

HKLM-x32\…\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5227112 2015-01-28] (AVAST Software)

HKLM-x32\…\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-25] (Oracle Corporation)

HKU\S-1-5-21-3767168050-546541148-904736753-1000\…\Run: [GoogleChromeAutoLaunch_77DB27ED30D96DC6FB2B344658AE2828] => "C:\Users\Tim\AppData\Local\Vosteran\Application\vosteran.exe" –no-startup-window –auto-launch-at-startup –profile-directory="Default"

AppInit_DLLs-x32: C:/PROGRA~3/{C6092~1/190~1.1/rati.dll => "C:/PROGRA~3/{C6092~1/190~1.1/rati.dll" File Not Found

ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-3767168050-546541148-904736753-1000\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://www.inet.se

HKU\S-1-5-21-3767168050-546541148-904736753-1000\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = http://www.inet.se

StartMenuInternet: IEXPLORE.EXE - iexplore.exe

SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =

SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =

SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =

BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)

BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)

BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)

BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)

BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)

Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:

========

FF ProfilePath: C:\Users\Tim\AppData\Roaming\Mozilla\Firefox\Profiles\trq1irq0.default

FF SearchEngineOrder.1: Yahoo! (Avast)

FF SearchEngineOrder.3: Bing

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_117.dll ()

FF Plugin: @microsoft.com/GENUINE -> disabled No File

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_117.dll ()

FF Plugin-x32: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\4.0.60310.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)

FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)

FF Plugin HKU\S-1-5-21-3767168050-546541148-904736753-1000: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Tim\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)

FF Plugin HKU\S-1-5-21-3767168050-546541148-904736753-1000: thehappycloud.com/HappyCloudPlugin -> C:\ProgramData\HappyCloud\Application\npHappyCloudPlugin.dll (The Happy Cloud)

FF SearchPlugin: C:\Users\Tim\AppData\Roaming\Mozilla\Firefox\Profiles\trq1irq0.default\searchplugins\yahoo-avast.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\allaannonser-sv-SE.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\prisjakt-sv-SE.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\tyda-sv-SE.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\wikipedia-sv-SE.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-sv-SE.xml

FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2015-01-27]

FF HKLM-x32\…\Firefox\Extensions: [[removed]] - C:\Program Files\AVAST Software\Avast\WebRep\FF

FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2013-10-22]

Chrome:

=======

CHR Profile: C:\Users\Tim\AppData\Local\Google\Chrome\User Data\Default

CHR Extension: (Google Dokument) - C:\Users\Tim\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-08-08]

CHR Extension: (Google Drive) - C:\Users\Tim\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-08-08]

CHR Extension: (YouTube) - C:\Users\Tim\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-08-08]

CHR Extension: (Battlefield Heroes) - C:\Users\Tim\AppData\Local\Google\Chrome\User Data\Default\Extensions\cehdakiococlfmjcbebbkjkfjhbieknh [2015-01-09]

CHR Extension: (Sök på Google) - C:\Users\Tim\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-08-08]

CHR Extension: (Avast Online Security) - C:\Users\Tim\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2014-08-08]

CHR Extension: (Google Wallet) - C:\Users\Tim\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-08-08]

CHR Extension: (Gmail) - C:\Users\Tim\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-08-08]

CHR HKLM-x32\…\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-12-04]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-12-04] (AVAST Software)

R3 AvastVBoxSvc; C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe [4012248 2014-12-04] (Avast Software)

R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)

R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)

S2 HiPatchService; C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe [9216 2014-02-28] (Hi-Rez Studios) [File not signed]

R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1631008 2014-05-30] (NVIDIA Corporation)

R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [21055432 2014-05-30] (NVIDIA Corporation)

R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2015-01-09] ()

R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-12-04] ()

R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [83280 2014-12-04] (AVAST Software)

R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-12-04] (AVAST Software)

R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-12-04] ()

R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1050432 2014-12-04] (AVAST Software)

R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [436624 2014-12-04] (AVAST Software)

R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [116728 2014-12-04] (AVAST Software)

U5 ewusbnet; C:\Windows\System32\Drivers\ewusbnet.sys [243200 2009-10-21] (Huawei Technologies Co., Ltd.)

S3 hwusbdev; C:\Windows\System32\DRIVERS\ewusbdev.sys [114304 2009-10-12] (Huawei Technologies Co., Ltd.)

S3 IAMTVE; C:\Windows\system32\drivers\IAMTVE.sys [43416 2010-11-30] (Intel Corporation)

S3 IAMTXPE; C:\Windows\system32\drivers\IAMTXPE.sys [51096 2010-11-30] (Intel Corporation)

S3 MTsensor; C:\Windows\system32\drivers\ASACPI.sys [15416 2009-05-14] ()

R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [20256 2014-05-30] (NVIDIA Corporation)

R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [40392 2014-03-31] (NVIDIA Corporation)

R2 VBoxAswDrv; C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [271752 2014-12-04] (Avast Software)

S3 aswVmm; \??\C:\Users\Tim\AppData\Local\Temp\aswVmm.sys [X]

S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]

S3 X6va029; \??\C:\Windows\SysWOW64\Drivers\X6va029 [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)

==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-28 12:52 - 2015-01-28 12:52 - 00013630 _____ () C:\Users\Tim\Desktop\FRST.txt

2015-01-28 12:48 - 2015-01-28 12:48 - 00000197 _____ () C:\Windows\system32\2015-01-28-11-48-37.047-AvastVBoxSVC.exe-3220.log

2015-01-28 12:36 - 2015-01-28 12:36 - 00000824 _____ () C:\Users\Tim\Desktop\JRT.txt

2015-01-28 12:32 - 2015-01-28 12:32 - 00000000 ____D () C:\Windows\ERUNT

2015-01-28 12:30 - 2015-01-28 12:30 - 01707939 _____ (Thisisu) C:\Users\Tim\Desktop\JRT.exe

2015-01-28 12:27 - 2015-01-28 12:27 - 00009433 _____ () C:\Users\Tim\Desktop\AdwCleaner[S0].txt

2015-01-28 12:26 - 2015-01-28 12:26 - 00000197 _____ () C:\Windows\system32\2015-01-28-11-26-05.093-AvastVBoxSVC.exe-3520.log

2015-01-28 12:08 - 2015-01-28 12:21 - 00000000 ____D () C:\AdwCleaner

2015-01-28 12:06 - 2015-01-28 12:06 - 02194432 _____ () C:\Users\Tim\Desktop\AdwCleaner.exe

2015-01-28 12:02 - 2015-01-28 12:03 - 00000197 _____ () C:\Windows\system32\2015-01-28-11-02-45.051-AvastVBoxSVC.exe-1584.log

2015-01-27 18:40 - 2015-01-27 18:40 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

2015-01-27 18:04 - 2015-01-28 12:52 - 00000000 ____D () C:\FRST

2015-01-27 18:02 - 2015-01-27 18:02 - 02129920 _____ (Farbar) C:\Users\Tim\Desktop\FRST64.exe

2015-01-27 17:37 - 2015-01-27 17:37 - 05198336 _____ (AVAST Software) C:\Users\Tim\Desktop\aswMBR.exe

2015-01-27 17:28 - 2015-01-27 17:28 - 00000197 _____ () C:\Windows\system32\2015-01-27-16-28-06.013-AvastVBoxSVC.exe-2452.log

2015-01-25 17:05 - 2015-01-25 17:05 - 00000197 _____ () C:\Windows\system32\2015-01-25-16-05-46.072-AvastVBoxSVC.exe-2384.log

2015-01-25 17:00 - 2015-01-25 17:00 - 00000197 _____ () C:\Windows\system32\2015-01-25-16-00-29.011-AvastVBoxSVC.exe-1428.log

2015-01-25 16:18 - 2015-01-25 16:18 - 00000197 _____ () C:\Windows\system32\2015-01-25-15-18-00.026-AvastVBoxSVC.exe-2732.log

2015-01-25 09:39 - 2015-01-25 09:39 - 00000197 _____ () C:\Windows\system32\2015-01-25-08-39-04.097-AvastVBoxSVC.exe-3736.log

2015-01-25 09:36 - 2015-01-28 12:01 - 00000008 __RSH () C:\ProgramData\ntuser.pol

2015-01-24 18:35 - 2015-01-25 17:35 - 00000057 _____ () C:\Users\Tim\AppData\Roaming\WB.CFG

2015-01-24 17:57 - 2015-01-24 17:57 - 00001238 _____ () C:\Users\Public\Desktop\World of Warcraft.lnk

2015-01-24 17:57 - 2015-01-24 17:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\World of Warcraft

2015-01-24 17:55 - 2015-01-24 21:47 - 00000000 ____D () C:\Program Files (x86)\World of Warcraft

2015-01-24 17:51 - 2015-01-24 17:51 - 02942368 _____ (Blizzard Entertainment) C:\Users\Tim\Downloads\World-of-Warcraft-Setup-enGB.exe

2015-01-24 17:38 - 2015-01-25 00:06 - 00000000 ____D () C:\Users\Tim\AppData\Local\Battle.net

2015-01-24 17:38 - 2015-01-24 17:55 - 00000000 ____D () C:\Users\Tim\AppData\Roaming\Battle.net

2015-01-24 17:38 - 2015-01-24 17:38 - 00000000 ____D () C:\Users\Tim\AppData\Local\Blizzard Entertainment

2015-01-24 17:37 - 2015-01-24 17:38 - 00000000 ____D () C:\Program Files (x86)\Battle.net

2015-01-24 17:37 - 2015-01-24 17:37 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Battle.net

2015-01-24 17:37 - 2015-01-24 17:37 - 00000000 ____D () C:\ProgramData\Blizzard Entertainment

2015-01-24 17:36 - 2015-01-28 12:21 - 00000000 ____D () C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WorldofTanks

2015-01-24 17:36 - 2015-01-28 12:21 - 00000000 ____D () C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\GoodGameEmpire

2015-01-24 17:36 - 2015-01-24 17:36 - 00003602 _____ () C:\Windows\System32\Tasks\Pirates WW2

2015-01-24 17:36 - 2015-01-24 17:36 - 00003602 _____ () C:\Windows\System32\Tasks\Pirates WW1

2015-01-24 17:36 - 2015-01-24 17:36 - 00003602 _____ () C:\Windows\System32\Tasks\Pirates W1

2015-01-24 17:36 - 2015-01-24 17:36 - 00000000 ____D () C:\Users\Tim\AppData\Roaming\WorldofTanks

2015-01-24 17:36 - 2015-01-24 17:36 - 00000000 ____D () C:\Users\Tim\AppData\Roaming\Pirates946

2015-01-24 17:36 - 2015-01-24 17:36 - 00000000 ____D () C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Pirates

2015-01-24 17:36 - 2015-01-24 17:36 - 00000000 ____D () C:\Users\Tim\AppData\Roaming\GGEmpire441

2015-01-24 17:36 - 2015-01-24 17:36 - 00000000 ____D () C:\Users\Tim\AppData\Local\WorldofTanks

2015-01-24 17:36 - 2015-01-24 17:36 - 00000000 ____D () C:\Users\Tim\AppData\Local\GGEmpire

2015-01-24 17:36 - 2015-01-24 17:36 - 00000000 ____D () C:\ProgramData\Battle.net

2015-01-24 17:35 - 2015-01-24 17:36 - 00000000 ____D () C:\Users\Tim\AppData\Local\Pirates

2015-01-24 17:35 - 2015-01-24 17:35 - 123231216 _____ (Blizzard Entertainment) C:\Users\Tim\Downloads\WorldOfWarCraftSetup.exe

2015-01-24 17:34 - 2015-01-24 17:34 - 00003664 _____ () C:\Windows\System32\Tasks\StormFall W1

2015-01-24 17:34 - 2015-01-24 17:34 - 00003664 _____ () C:\Windows\System32\Tasks\StormFall TW2

2015-01-24 17:34 - 2015-01-24 17:34 - 00003664 _____ () C:\Windows\System32\Tasks\StormFall TW1

2015-01-24 17:34 - 2015-01-24 17:34 - 00000000 ____D () C:\Users\Tim\AppData\Roaming\StormFall

2015-01-24 17:34 - 2015-01-24 17:34 - 00000000 ____D () C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StormFall

2015-01-24 17:34 - 2015-01-24 17:34 - 00000000 ____D () C:\Users\Tim\AppData\Local\StormFall

2015-01-24 17:33 - 2015-01-24 17:34 - 00819816 _____ (%VENDOR%) C:\Users\Tim\Downloads\WorldofWarCraft_Setup.exe

2015-01-24 13:47 - 2015-01-24 13:48 - 00000197 _____ () C:\Windows\system32\2015-01-24-12-47-40.045-AvastVBoxSVC.exe-3452.log

2015-01-24 08:41 - 2015-01-24 08:41 - 00000197 _____ () C:\Windows\system32\2015-01-24-07-41-44.020-AvastVBoxSVC.exe-4040.log

2015-01-23 21:40 - 2015-01-23 21:40 - 00000197 _____ () C:\Windows\system32\2015-01-23-20-40-03.016-AvastVBoxSVC.exe-4508.log

2015-01-23 16:57 - 2015-01-23 16:58 - 00000197 _____ () C:\Windows\system32\2015-01-23-15-57-47.063-AvastVBoxSVC.exe-3636.log

2015-01-23 07:35 - 2015-01-23 07:36 - 00000197 _____ () C:\Windows\system32\2015-01-23-06-35-43.037-AvastVBoxSVC.exe-3552.log

2015-01-22 15:05 - 2015-01-22 15:06 - 00000197 _____ () C:\Windows\system32\2015-01-22-14-05-49.099-AvastVBoxSVC.exe-3720.log

2015-01-22 07:32 - 2015-01-22 07:32 - 00000197 _____ () C:\Windows\system32\2015-01-22-06-32-43.034-AvastVBoxSVC.exe-3040.log

2015-01-21 19:31 - 2015-01-21 19:32 - 00000000 ____D () C:\Users\Tim\Downloads\Slender_v0_9_7 (1)

2015-01-21 19:31 - 2015-01-21 19:31 - 00000000 ____D () C:\Users\Tim\Desktop\Slender v0.9.7

2015-01-21 19:23 - 2015-01-21 19:30 - 65812970 _____ () C:\Users\Tim\Downloads\Slender_v0_9_7 (1).zip

2015-01-21 19:08 - 2015-01-21 19:09 - 00000197 _____ () C:\Windows\system32\2015-01-21-18-08-51.048-AvastVBoxSVC.exe-3480.log

2015-01-21 19:01 - 2015-01-21 19:01 - 65812970 _____ () C:\Users\Tim\Downloads\Slender_v0_9_7.zip

2015-01-21 14:27 - 2015-01-21 14:27 - 00000197 _____ () C:\Windows\system32\2015-01-21-13-27-01.087-AvastVBoxSVC.exe-2708.log

2015-01-21 06:17 - 2015-01-21 06:18 - 00000197 _____ () C:\Windows\system32\2015-01-21-05-17-40.013-AvastVBoxSVC.exe-3284.log

2015-01-21 05:32 - 2015-01-21 05:32 - 00000197 _____ () C:\Windows\system32\2015-01-21-04-32-11.025-AvastVBoxSVC.exe-2500.log

2015-01-20 15:42 - 2015-01-20 15:43 - 00000197 _____ () C:\Windows\system32\2015-01-20-14-42-54.082-AvastVBoxSVC.exe-3380.log

2015-01-20 07:21 - 2015-01-20 07:21 - 00000197 _____ () C:\Windows\system32\2015-01-20-06-21-05.091-AvastVBoxSVC.exe-3240.log

2015-01-19 13:43 - 2015-01-19 13:44 - 00000197 _____ () C:\Windows\system32\2015-01-19-12-43-55.039-AvastVBoxSVC.exe-3832.log

2015-01-19 07:27 - 2015-01-19 07:27 - 00000197 _____ () C:\Windows\system32\2015-01-19-06-27-12.003-AvastVBoxSVC.exe-3452.log

2015-01-18 09:31 - 2015-01-18 09:31 - 00000197 _____ () C:\Windows\system32\2015-01-18-08-31-40.030-AvastVBoxSVC.exe-3352.log

2015-01-17 09:13 - 2015-01-17 09:13 - 00000197 _____ () C:\Windows\system32\2015-01-17-08-13-20.071-AvastVBoxSVC.exe-3536.log

2015-01-16 18:40 - 2015-01-16 18:40 - 00000000 __SHD () C:\Users\Tim\AppData\Local\EmieUserList

2015-01-16 18:40 - 2015-01-16 18:40 - 00000000 __SHD () C:\Users\Tim\AppData\Local\EmieSiteList

2015-01-16 18:40 - 2015-01-16 18:40 - 00000000 __SHD () C:\Users\Tim\AppData\Local\EmieBrowserModeList

2015-01-16 18:34 - 2015-01-16 18:34 - 00000222 _____ () C:\Users\Tim\Desktop\MicroVolts Surge.url

2015-01-16 17:58 - 2015-01-16 17:58 - 00000197 _____ () C:\Windows\system32\2015-01-16-16-58-01.044-AvastVBoxSVC.exe-3048.log

2015-01-16 11:45 - 2015-01-16 11:45 - 00000197 _____ () C:\Windows\system32\2015-01-16-10-45-04.007-AvastVBoxSVC.exe-3160.log

2015-01-16 07:57 - 2015-01-16 07:58 - 00000197 _____ () C:\Windows\system32\2015-01-16-06-57-44.044-AvastVBoxSVC.exe-3596.log

2015-01-15 15:19 - 2015-01-15 15:19 - 00000197 _____ () C:\Windows\system32\2015-01-15-14-19-09.002-AvastVBoxSVC.exe-2148.log

2015-01-15 06:46 - 2015-01-15 06:46 - 00000197 _____ () C:\Windows\system32\2015-01-15-05-46-18.056-AvastVBoxSVC.exe-3440.log

2015-01-15 06:42 - 2015-01-15 06:42 - 00000197 _____ () C:\Windows\system32\2015-01-15-05-42-40.094-AvastVBoxSVC.exe-2848.log

2015-01-14 16:29 - 2015-01-14 16:29 - 00000197 _____ () C:\Windows\system32\2015-01-14-15-29-36.005-AvastVBoxSVC.exe-3388.log

2015-01-14 14:43 - 2015-01-14 14:44 - 00000197 _____ () C:\Windows\system32\2015-01-14-13-43-43.031-AvastVBoxSVC.exe-2500.log

2015-01-14 07:51 - 2014-12-19 04:06 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll

2015-01-14 07:51 - 2014-12-19 02:46 - 00141312 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys

2015-01-14 07:51 - 2014-12-12 06:35 - 05553592 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe

2015-01-14 07:51 - 2014-12-12 06:31 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll

2015-01-14 07:51 - 2014-12-12 06:31 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe

2015-01-14 07:51 - 2014-12-12 06:31 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll

2015-01-14 07:51 - 2014-12-12 06:11 - 03971512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe

2015-01-14 07:51 - 2014-12-12 06:11 - 03916728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe

2015-01-14 07:51 - 2014-12-12 06:07 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll

2015-01-14 07:51 - 2014-12-11 18:47 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe

2015-01-14 07:51 - 2014-12-06 05:17 - 00303616 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll

2015-01-14 07:51 - 2014-12-06 04:50 - 00156672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncsi.dll

2015-01-14 07:51 - 2014-12-06 04:50 - 00052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll

2015-01-14 07:51 - 2012-10-03 18:44 - 00216576 _____ (Microsoft Corporation) C:\Windows\system32\ncsi.dll

2015-01-14 07:51 - 2012-10-03 18:44 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\nlaapi.dll

2015-01-14 07:48 - 2015-01-14 07:48 - 00000197 _____ () C:\Windows\system32\2015-01-14-06-48-14.075-AvastVBoxSVC.exe-1388.log

2015-01-13 14:37 - 2015-01-13 14:38 - 00000197 _____ () C:\Windows\system32\2015-01-13-13-37-39.065-AvastVBoxSVC.exe-3848.log

2015-01-13 07:54 - 2015-01-13 07:55 - 00000197 _____ () C:\Windows\system32\2015-01-13-06-54-26.047-AvastVBoxSVC.exe-2908.log

2015-01-12 13:45 - 2015-01-12 13:45 - 00000197 _____ () C:\Windows\system32\2015-01-12-12-45-02.016-AvastVBoxSVC.exe-3228.log

2015-01-12 07:55 - 2015-01-12 07:55 - 00000197 _____ () C:\Windows\system32\2015-01-12-06-55-17.056-AvastVBoxSVC.exe-2700.log

2015-01-11 10:10 - 2015-01-11 10:10 - 00000197 _____ () C:\Windows\system32\2015-01-11-09-10-12.019-AvastVBoxSVC.exe-2992.log

2015-01-10 17:56 - 2015-01-10 17:56 - 08229276 _____ () C:\Users\Tim\Downloads\1964_11.rar

2015-01-10 17:54 - 2015-01-10 17:54 - 00065552 _____ () C:\Users\Tim\Downloads\Zelda_1.zip

2015-01-10 17:53 - 2015-01-10 17:53 - 03029593 _____ () C:\Users\Tim\Downloads\fceux-2.2.2-win32.zip

2015-01-10 17:14 - 2015-01-10 17:14 - 00000000 ____D () C:\Users\Tim\AppData\Roaming\Unity

2015-01-10 15:36 - 2015-01-10 15:36 - 00000197 _____ () C:\Windows\system32\2015-01-10-14-36-08.039-AvastVBoxSVC.exe-3096.log

2015-01-10 09:54 - 2015-01-10 09:55 - 00000197 _____ () C:\Windows\system32\2015-01-10-08-54-54.090-AvastVBoxSVC.exe-2936.log

2015-01-09 21:01 - 2015-01-10 12:43 - 00282296 _____ () C:\Windows\SysWOW64\PnkBstrB.xtr

2015-01-09 21:00 - 2015-01-09 21:00 - 00000000 ____D () C:\Users\Tim\AppData\Local\PunkBuster

2015-01-09 19:26 - 2015-01-09 21:38 - 00000000 ____D () C:\Users\Tim\Documents\Battlefield Heroes

2015-01-09 19:25 - 2015-01-10 12:43 - 00282296 _____ () C:\Windows\SysWOW64\PnkBstrB.exe

2015-01-09 19:25 - 2015-01-10 10:12 - 00282296 _____ () C:\Windows\SysWOW64\PnkBstrB.ex0

2015-01-09 19:25 - 2015-01-09 21:07 - 00076888 _____ () C:\Windows\SysWOW64\PnkBstrA.exe

2015-01-09 19:25 - 2015-01-09 19:25 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EA Games

2015-01-09 19:23 - 2015-01-09 19:23 - 00000000 ____D () C:\Program Files (x86)\EA Games

2015-01-09 17:48 - 2015-01-09 17:48 - 00000000 ____D () C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Ubisoft

2015-01-09 17:48 - 2015-01-09 17:48 - 00000000 ____D () C:\Users\Tim\AppData\Local\Ubisoft Game Launcher

2015-01-09 17:48 - 2015-01-09 17:48 - 00000000 ____D () C:\Program Files (x86)\Ubisoft

2015-01-09 15:13 - 2015-01-09 15:13 - 00000197 _____ () C:\Windows\system32\2015-01-09-14-13-11.016-AvastVBoxSVC.exe-3340.log

2015-01-09 11:45 - 2015-01-09 11:46 - 00000197 _____ () C:\Windows\system32\2015-01-09-10-45-23.092-AvastVBoxSVC.exe-3372.log

2015-01-09 07:47 - 2015-01-09 07:47 - 00000197 _____ () C:\Windows\system32\2015-01-09-06-47-16.002-AvastVBoxSVC.exe-3136.log

2015-01-08 15:07 - 2015-01-08 15:08 - 00000197 _____ () C:\Windows\system32\2015-01-08-14-07-54.027-AvastVBoxSVC.exe-3892.log

2015-01-08 07:33 - 2015-01-08 07:33 - 00000197 _____ () C:\Windows\system32\2015-01-08-06-33-12.020-AvastVBoxSVC.exe-2848.log

2015-01-07 10:19 - 2015-01-07 10:20 - 00000197 _____ () C:\Windows\system32\2015-01-07-09-19-56.023-AvastVBoxSVC.exe-2908.log

2015-01-06 12:11 - 2015-01-06 12:12 - 00000197 _____ () C:\Windows\system32\2015-01-06-11-11-48.071-AvastVBoxSVC.exe-2448.log

2015-01-05 07:53 - 2015-01-05 07:53 - 00000197 _____ () C:\Windows\system32\2015-01-05-06-53-36.086-AvastVBoxSVC.exe-3104.log

2015-01-04 17:51 - 2015-01-04 17:51 - 00000197 _____ () C:\Windows\system32\2015-01-04-16-51-18.021-AvastVBoxSVC.exe-3220.log

2015-01-03 00:50 - 2015-01-03 00:50 - 00003262 _____ () C:\Windows\System32\Tasks\avastBCLRestartS-1-5-21-3767168050-546541148-904736753-1000

2015-01-02 18:00 - 2015-01-02 18:00 - 00000197 _____ () C:\Windows\system32\2015-01-02-17-00-10.085-AvastVBoxSVC.exe-1404.log

2015-01-02 14:06 - 2015-01-02 14:06 - 00000197 _____ () C:\Windows\system32\2015-01-02-13-06-19.086-AvastVBoxSVC.exe-2344.log

2015-01-02 13:58 - 2015-01-02 13:58 - 00086398 _____ () C:\Users\Tim\Downloads\[1-7-2]_Lucky_Block_v5-0-0.jar

2015-01-02 13:47 - 2015-01-02 13:48 - 04161288 _____ (Mindspark Interactive Network) C:\Users\Tim\Downloads\EliteUnzipSetup.EliteUnzip_aa.gafhhbahpojnjfhpepjjfjojbphnogmn.ch.exe

2015-01-02 12:02 - 2015-01-02 12:03 - 00000197 _____ () C:\Windows\system32\2015-01-02-11-02-31.002-AvastVBoxSVC.exe-2616.log

2015-01-01 14:53 - 2015-01-01 14:53 - 00000197 _____ () C:\Windows\system32\2015-01-01-13-53-14.082-AvastVBoxSVC.exe-3504.log

2014-12-31 16:21 - 2014-12-31 16:21 - 00000197 _____ () C:\Windows\system32\2014-12-31-15-21-48.034-AvastVBoxSVC.exe-708.log

2014-12-31 10:31 - 2014-12-31 10:32 - 00000197 _____ () C:\Windows\system32\2014-12-31-09-31-21.063-AvastVBoxSVC.exe-3084.log

2014-12-30 10:14 - 2014-12-30 10:15 - 00000197 _____ () C:\Windows\system32\2014-12-30-09-14-36.048-AvastVBoxSVC.exe-2212.log

2014-12-29 17:50 - 2014-12-29 17:50 - 00000197 _____ () C:\Windows\system32\2014-12-29-16-50-58.090-AvastVBoxSVC.exe-2600.log

2014-12-29 11:01 - 2014-12-29 11:01 - 00000197 _____ () C:\Windows\system32\2014-12-29-10-01-13.002-AvastVBoxSVC.exe-3084.log

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-28 12:49 - 2013-09-30 14:37 - 01856158 _____ () C:\Windows\WindowsUpdate.log

2015-01-28 12:46 - 2009-07-14 05:51 - 00166329 _____ () C:\Windows\setupact.log

2015-01-28 12:45 - 2014-08-08 10:43 - 00000990 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2015-01-28 12:45 - 2013-09-30 14:53 - 00000000 ____D () C:\ProgramData\NVIDIA

2015-01-28 12:45 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2015-01-28 12:41 - 2014-08-08 10:44 - 00002181 _____ () C:\Users\Public\Desktop\Google Chrome.lnk

2015-01-28 12:41 - 2014-08-08 10:43 - 00000994 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2015-01-28 12:31 - 2009-07-14 05:45 - 00021888 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2015-01-28 12:31 - 2009-07-14 05:45 - 00021888 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2015-01-28 12:30 - 2010-11-21 12:38 - 00670622 _____ () C:\Windows\system32\perfh01D.dat

2015-01-28 12:30 - 2010-11-21 12:38 - 00146498 _____ () C:\Windows\system32\perfc01D.dat

2015-01-28 12:30 - 2009-07-14 06:13 - 01602714 _____ () C:\Windows\system32\PerfStringBackup.INI

2015-01-28 12:23 - 2013-11-13 07:41 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update

2015-01-28 12:23 - 2010-11-21 04:47 - 00102046 _____ () C:\Windows\PFRO.log

2015-01-28 12:00 - 2013-10-22 09:18 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service

2015-01-28 11:58 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\GroupPolicy

2015-01-27 17:28 - 2009-07-14 03:34 - 00000505 _____ () C:\Windows\win.ini

2015-01-25 16:17 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\tracing

2015-01-24 17:35 - 2013-10-22 09:18 - 00001149 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk

2015-01-24 17:17 - 2013-10-22 09:51 - 00000000 ____D () C:\Users\Tim\AppData\Roaming\.minecraft

2015-01-24 15:45 - 2013-10-23 08:34 - 00000000 ____D () C:\Program Files (x86)\Steam

2015-01-16 19:34 - 2014-05-29 07:50 - 00000000 ____D () C:\Users\Tim\AppData\Local\Microsoft Games

2015-01-16 18:34 - 2013-10-23 09:01 - 00000000 ____D () C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam

2015-01-14 08:28 - 2013-09-30 15:30 - 00000000 ____D () C:\Windows\system32\MRT

2015-01-14 08:24 - 2013-09-30 15:30 - 113365784 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2015-01-09 18:07 - 2013-10-27 12:27 - 00267107 _____ () C:\Windows\DirectX.log

2015-01-09 17:53 - 2009-07-14 06:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games

2015-01-06 04:36 - 2010-11-21 04:27 - 00298120 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe

2015-01-05 18:16 - 2013-10-22 10:01 - 22764208 _____ () C:\Users\Tim\Desktop\TechnicLauncher.exe

2015-01-05 18:16 - 2013-10-22 10:01 - 00000000 ____D () C:\Users\Tim\AppData\Roaming\.technic

2015-01-03 00:50 - 2013-10-22 09:18 - 00001137 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk

2015-01-02 17:41 - 2014-06-09 15:34 - 00000000 ____D () C:\Users\Tim\AppData\Roaming\Skype

2015-01-02 16:32 - 2014-06-09 15:34 - 00000000 ___RD () C:\Program Files (x86)\Skype

2015-01-02 16:32 - 2014-06-09 15:34 - 00000000 ____D () C:\ProgramData\Skype

2015-01-02 12:01 - 2009-07-14 06:08 - 00032514 _____ () C:\Windows\Tasks\SCHEDLGU.TXT

2014-12-30 23:55 - 2014-10-18 07:25 - 00000000 ____D () C:\Users\Tim\AppData\Local\CSO

==================== Files in the root of some directories =======

2015-01-24 18:35 - 2015-01-25 17:35 - 0000057 _____ () C:\Users\Tim\AppData\Roaming\WB.CFG

2013-11-28 18:17 - 2013-11-28 18:17 - 0000091 _____ () C:\Users\Tim\AppData\Local\fusioncache.dat

2014-10-04 13:14 - 2014-10-04 13:14 - 0000000 _____ () C:\Users\Tim\AppData\Local\{26F9D811-A740-4CF8-B01D-202083068605}

Some content of TEMP:

====================

C:\Users\Tim\AppData\Local\Temp\Quarantine.exe

C:\Users\Tim\AppData\Local\Temp\sqlite3.dll

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\SysWOW64\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2015-01-24 16:08

==================== End Of Log ============================

I was able to reboot in normal mode after the first fix. Feels much better now, thanks.

My son wants me to thank you for your help as well. (I'm making him help me do this to learn more about his computer.)

Firefox doesn't want to connect to the net anymore, however, it seems to think everything is unverified. I've got no problem with simply uninstalling and reinstalling it though, if that is the easiest solution to the problem. Or it might be connected to fact that the Firefox avast plugin is disabled atm.

Finally, please find the addition.txt file enclosed as an attachment.

Thanks again, see you soon!

Attachments:

📎Addition.txt

OCD

Post #6January 28, 2015, 7:06 PM UTC last edited January 28, 2015, 7:07 PM UTC

Hi Svinlesha,

Both you and your son are quite welcome. And I think it's a great idea for him to be sitting in on the fixing of the computer. We all have to learn somtime, let's just be thankful it wasn't one of the more severe infections out there.

[external image: bullseye_zpse9eaf36e.gif] Reset Firefox to its default state

At the top of the Firefox window, click the Firefox button, go over to the Help sub-menu
(on Windows XP, click the Help menu at the top of the Firefox window) and select Troubleshooting Information.
[external image: restfirefox1.png]
Click the Reset Firefox button in the upper-right corner of the Troubleshooting Information page.
[external image: resetfirefox2.png]
To continue, click Reset Firefox in the confirmation window that opens.
Firefox will close and be reset. When it's done, a window will list the information that was imported. Click Finish and Firefox will open.

=========================

[external image: bullseye_zpse9eaf36e.gif] Uninstall via Programs and Features

Click Start > Control Panel > Programs and Features. Locate and select the following that are present on the list and click the Remove button:

ace race
Cleaner Pro
GoodGameEmpire
Pirates
Ryzom
StormFall
World Of WarCraft Packages

=========================

[external image: bullseye_zpse9eaf36e.gif] FRST Fix Script

Open notepad. Please copy the contents of the code box below. To do this highlight the contents of the box and right click on it. Paste this into the open notepad. Save it on the desktop as fixlist.txt

Start
CloseProcesses:
C:\Users\Tim\AppData\Local\Vosteran
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
EmptyTemp:
End

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Run FRST and press the Fix button just once and wait.
The tool will make a log (Fixlog.txt) please post it to your reply.

=========================

[external image: bullseye_zpse9eaf36e.gif] Re-run Farbar Recovery Scan Tool it should be on your desktop.

- Windows XP : Double click on the icon to run it.
- Windows Vista, Windows 7 & 8 : Right click and select "Run as Administrator"
When the tool opens click Yes to disclaimer.
Press Scan button.
It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.

=========================

In your next post please provide the following:

Fixlog.txt
new FRST.txt

Svinlesha

Post #7January 29, 2015, 4:34 PM UTC last edited January 29, 2015, 4:35 PM UTC

Hi OCD!

Well, before we continue: we could not uninstall ace race (a message said it was already unintalled, but we continue getting a warning from Avast about it every time we start up a browser), and the Cleaner Pro uninstaller didn't work because of a missing DLL. Continuing, the control panel claims that Good Game Empire is "maybe" already unintalled, as well as Stormfall and WoW Packages. So we've been unable to uninstall any program, and I thought I better check back with you before continuing.

Should I go ahead and run your fixscript?

OCD

Post #8January 29, 2015, 4:49 PM UTC

Hi Svinlesha,

Yes, please continue with the outlined steps. We will address those items down the road.

I'm headed out the door for work so I will have to pick back up later tonight (or morning for you).

Svinlesha

Post #9January 29, 2015, 5:42 PM UTC

Hello OCD

here is the fixlogtext

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 28-01-2015

Ran by [removed] at 2015-01-29 18:24:34 Run:2

Running from C:\Users\[removed]\Desktop

[removed]

Boot Mode: Normal

==============================================

Content of fixlist:

*****************

Start

CloseProcesses:

C:\Users\Tim\AppData\Local\Vosteran

SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =

SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =

SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =

EmptyTemp:

End

*****************

Processes closed successfully.

"C:\Users\Tim\AppData\Local\Vosteran" => File/Directory not found.

HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.

HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.

HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.

EmptyTemp: => Removed 51.8 MB temporary data.

The system needed a reboot.

==== End of Fixlog 18:24:42 ====

here is the new frst text

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 28-01-2015

Ran by [removed] (administrator) on INET on 29-01-2015 18:29:43

Running from C:\Users\[removed]\Desktop

[removed]

Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Svenska (Sverige)

Internet Explorer Version 11 (Default browser: FF)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe

(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe

(Hi-Rez Studios) C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe