Spyware / Malware / Virus Removal

can't download or run malwarebyts [Solved]

5 min read

Looking for the outcome? Ask AI

Deleted Member Topic Starter

Post #1March 19, 2015, 5:16 PM UTC

good afternoon;

Thank you in advance for trying to help me.

I can install malwarebyts ibn safe mode and run it. When I try to tun it in reg mode I get a message that my subscription is expired.

Her is the

Run date: 2015-03-19 12:44:09

—————————–

12:44:09.249 OS Version: Windows x64 6.1.7601 Service Pack 1

12:44:09.249 Number of processors: 4 586 0x2A07

12:44:09.249 ComputerName: WILL-PC UserName: Will

12:44:10.767 Initialize success

12:44:14.654 VM: initialized successfully

12:44:14.656 VM: Intel CPU supported

12:45:06.153 VM: supported disk I/O iaStor.sys

12:49:01.222 AVAST engine defs: 15031900

12:49:19.069 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-2

12:49:19.072 Disk 0 Vendor: Hitachi_ MSJO Size: 715404MB BusType: 3

12:49:19.077 Disk 1 \Device\Harddisk1\DR1 -> \Device\Ide\IAAStorageDevice-3

12:49:19.081 Disk 1 Vendor: ST500DM0 KC48 Size: 476940MB BusType: 3

12:49:19.207 VM: Disk 0 MBR read successfully

12:49:19.211 Disk 0 MBR scan

12:49:19.240 Disk 0 Windows VISTA default MBR code

12:49:19.245 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 500 MB offset 2048

12:49:19.251 Disk 0 Boot: NTFS code=1

12:49:19.271 Disk 0 Partition - 00 0F Extended LBA 40960 MB offset 1026048

12:49:19.303 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 673942 MB offset 84912128

12:49:19.371 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 40958 MB offset 1028096

12:49:19.557 Disk 0 scanning C:\Windows\system32\drivers

12:49:41.129 Service scanning

12:50:15.321 Modules scanning

12:50:15.328 Disk 0 trace - called modules:

12:50:15.387 ntoskrnl.exe CLASSPNP.SYS disk.sys iaStor.sys hal.dll

12:50:15.393 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa80065f6060]

12:50:15.399 3 CLASSPNP.SYS[fffff88001a9e43f] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-2[0xfffffa8004772050]

12:50:16.798 AVAST engine scan C:\Windows

12:50:25.064 AVAST engine scan C:\Windows\system32

12:58:23.256 AVAST engine scan C:\Windows\system32\drivers

12:58:48.414 AVAST engine scan C:\Users\Will

13:02:17.396 Disk 0 MBR has been saved successfully to "C:\Users\Will\Desktop\MBR.dat"

13:02:17.406 The log file has been saved successfully to "C:\Users\Will\Desktop\aswMBR.txt"

and the farbar log

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-03-2015

Ran by [removed] (administrator) on WILL-PC on 19-03-2015 13:00:01

Running from C:\Users\[removed]\Downloads

[removed]

Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: English (United States)

Internet Explorer Version 11 (Default browser: Chrome)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(COMODO) C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe

(AMD) C:\Windows\System32\atiesrxx.exe

(AMD) C:\Windows\System32\atieclxx.exe

(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

(AOMEI Tech Co., Ltd.) C:\Program Files (x86)\AOMEI Backupper Standard Edition 2.2\ABService.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

(Nero AG) C:\Program Files (x86)\Motorola Media Link\Lite\NServiceEntry.exe

(Softland) C:\Program Files (x86)\Softland\FBackup 5\bService.exe

(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe

(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe

(COMODO) C:\Program Files\COMODO\COMODO Internet Security\cistray.exe

(Ellora Assets Corp.) C:\Program Files (x86)\Freemake\CaptureLib\CaptureLibService.exe

(Ruiware LLC) C:\Program Files (x86)\Ruiware\WinPatrol\WinPatrol.exe

(Microsoft Corporation) C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe

(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe

(Hewlett-Packard Company) C:\Program Files (x86)\HP\Common\HPSupportSolutionsFrameworkService.exe

(Macrovision Corporation) C:\Program Files (x86)\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe

(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe

(Atheros Communications, Inc.) C:\Program Files (x86)\NETGEAR\WNA1100\jswpsapi.exe

(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

() C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe

(RealNetworks, Inc.) C:\Program Files (x86)\real\realplayer\RPDS\Bin\rpdsvc.exe

(Paramount Software UK Ltd) C:\Program Files\Macrium\Reflect\ReflectService.exe

(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe

(Microsoft Corporation) C:\Windows\System32\UI0Detect.exe

(RealNetworks, Inc.) C:\Program Files (x86)\real\realplayer\Update\realsched.exe

(KEDMI Scientific Computing) C:\Program Files (x86)\tinySpell\tinyspell.exe

(http://shotty.devs-on.net) C:\Program Files\Shotty\Shotty.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE

(COMODO) C:\Program Files\COMODO\COMODO Internet Security\cavwp.exe

(COMODO) C:\Program Files\COMODO\COMODO Internet Security\cis.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe

(Intuit Inc.) C:\Program Files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

() C:\Program Files (x86)\RealNetworks\RealDownloader\downloader2.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(AVAST Software) C:\Users\Will\Downloads\aswMBR.exe

(COMODO) C:\Program Files\COMODO\COMODO Internet Security\cmdvirth.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\…\Run: [COMODO Internet Security] => C:\Program Files\COMODO\COMODO Internet Security\cistray.exe [1297624 2015-02-03] (COMODO)

HKLM-x32\…\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1021128 2015-02-26] (Adobe Systems Incorporated)

Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)

HKLM\…\Policies\Explorer: [NoInternetOpenWith] 1

HKLM\…\Policies\Explorer: [MemCheckBoxInRunDlg] 1

HKU\S-1-5-21-2812265994-3346922550-1866879431-1000\…\Run: [WinPatrol] => C:\Program Files (x86)\Ruiware\WinPatrol\winpatrol.exe [1154112 2014-07-20] (Ruiware LLC)

HKU\S-1-5-21-2812265994-3346922550-1866879431-1000\…\Run: [HP] => C:\PROGRAM FILES\HP\HP PHOTOSMART 6520 SERIES\BIN\SCANTOPCACTIVATIONAPP.EXE [2573416 2012-10-17] (Hewlett-Packard Co.)

HKU\S-1-5-21-2812265994-3346922550-1866879431-1000\…\Run: [WinPatrol Background Change Monitor] => C:\Program Files (x86)\Ruiware\WinPatrol\WinPatrol.exe [1154112 2014-07-20] (Ruiware LLC)

HKU\S-1-5-21-2812265994-3346922550-1866879431-1000\…\Run: [WinPatrol Explorer ] => C:\Program Files (x86)\Ruiware\WinPatrol\WinPatrolEx.exe [1680456 2014-07-20] (Ruiware LLC)

HKU\S-1-5-21-2812265994-3346922550-1866879431-1000\…\Policies\Explorer: [NoLowDiskSpaceChecks] 1

HKU\S-1-5-21-2812265994-3346922550-1866879431-1000\…\Policies\Explorer: [NoResolveSearch] 1

HKU\S-1-5-21-2812265994-3346922550-1866879431-1000\…\Policies\Explorer: [LinkResolveIgnoreLinkInfo] 1

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Install LastPass FF RunOnce.lnk

ShortcutTarget: Install LastPass FF RunOnce.lnk -> C:\Program Files (x86)\Common Files\lpuninstall.exe (LastPass)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Install LastPass IE RunOnce.lnk

ShortcutTarget: Install LastPass IE RunOnce.lnk -> C:\Program Files (x86)\Common Files\lpuninstall.exe (LastPass)

Startup: C:\Users\Will\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hpqtra08.exe (Hewlett-Packard Co.)

Startup: C:\Users\Will\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Monitor Ink Alerts - HP Photosmart 6520 series (Network).lnk

ShortcutTarget: Monitor Ink Alerts - HP Photosmart 6520 series (Network).lnk -> C:\Program Files\HP\HP Photosmart 6520 series\Bin\HPStatusBL.dll (Hewlett-Packard Co.)

BootExecute: autocheck autochk * sdnclean64.exe

CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION

HKU\S-1-5-21-2812265994-3346922550-1866879431-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Local Page = about:blank

HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKU\S-1-5-21-2812265994-3346922550-1866879431-1000\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.bing.com/search?q={searchTerms}

HKU\S-1-5-21-2812265994-3346922550-1866879431-1000\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/

SearchScopes: HKLM -> DefaultScope {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = http://www.google.com/search?q={searchTerms}

SearchScopes: HKLM -> Backup.Old.DefaultScope {7CCCA2B3-EE78-4266-9D60-A932C239082B}

SearchScopes: HKLM -> {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = http://www.google.com/search?q={searchTerms}

SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}

SearchScopes: HKLM -> {7CCCA2B3-EE78-4266-9D60-A932C239082B} URL = http://start.funmoods.com/results.php?f=4&q={searchTerms}&a=axl&chnl=axl&cd=2XzuyEtN2Y1L1QzutDtDtCzy0DtCtA0BtBtByDtAtDtAzyzytN0D0Tzu0CtCzytAtN1L2XzutBtFtCtFtDtFtAtDtC&cr=1862129524

SearchScopes: HKLM-x32 -> DefaultScope {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = http://www.google.com/search?q={searchTerms}

SearchScopes: HKLM-x32 -> {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = http://www.google.com/search?q={searchTerms}

SearchScopes: HKU\S-1-5-21-2812265994-3346922550-1866879431-1000 -> Backup.Old.DefaultScope {7CCCA2B3-EE78-4266-9D60-A932C239082B}

SearchScopes: HKU\S-1-5-21-2812265994-3346922550-1866879431-1000 -> {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = http://www.google.com/search?q={searchTerms}

SearchScopes: HKU\S-1-5-21-2812265994-3346922550-1866879431-1000 -> {0753F9C6-E743-8F1D-6DA7-27AAC1EC8B6E} URL =

SearchScopes: HKU\S-1-5-21-2812265994-3346922550-1866879431-1000 -> {E68068A2-1DD9-408E-B674-614EF2216E40} URL = http://us.search.yahoo.com/search?p={searchTerms}&fr=chr-comodo

BHO: RealNetworks Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\Program Files (x86)\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin64.dll [2014-10-27] (RealDownloader)

BHO: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll [2013-04-25] (Oracle Corporation)

BHO: No Name -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> No File

BHO: LastPass Vault -> {95D9ECF5-2A4D-4550-BE49-70D42F71296E} -> C:\Program Files (x86)\LastPass\LPToolbar_x64.dll [2014-02-05] (LastPass)

BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-03-02] (Google Inc.)

BHO: Skype add-on for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> No File

BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)

BHO: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll [2013-04-25] (Oracle Corporation)

BHO-x32: No Name -> Disabled:{2018eb71-06b5-4438-abf4-e40df31e0be5} -> No File

BHO-x32: No Name -> Disabled:{3049C3E9-B461-4BC5-8870-4C09146192CA} -> No File

BHO-x32: No Name -> Disabled:{326E768D-4182-46FD-9C16-1449A49795F4} -> No File

BHO-x32: No Name -> Disabled:{B4F3A835-0E21-4959-BA22-42B3008E02FF} -> No File

BHO-x32: HP Print Enhancer -> {0347C33E-8762-4905-BF09-768834316C61} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll [2009-09-20] (Hewlett-Packard Co.)

BHO-x32: RealNetworks Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\Program Files (x86)\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll [2014-10-27] (RealDownloader)

BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll [2015-02-16] (Oracle Corporation)

BHO-x32: LastPass Vault -> {95D9ECF5-2A4D-4550-BE49-70D42F71296E} -> C:\Program Files (x86)\LastPass\LPToolbar.dll [2014-02-05] (LastPass)

BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-03-02] (Google Inc.)

BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)

BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll [2015-02-16] (Oracle Corporation)

BHO-x32: HP Smart BHO Class -> {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll [2009-09-20] (Hewlett-Packard Co.)

Toolbar: HKLM - LastPass Toolbar - {9f6b5cc3-5c7b-4b5c-97af-19dec1e380e5} - C:\Program Files (x86)\LastPass\LPToolbar_x64.dll [2014-02-05] (LastPass)

Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-03-02] (Google Inc.)

Toolbar: HKLM-x32 - LastPass Toolbar - {9f6b5cc3-5c7b-4b5c-97af-19dec1e380e5} - C:\Program Files (x86)\LastPass\LPToolbar.dll [2014-02-05] (LastPass)

Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-03-02] (Google Inc.)

Toolbar: HKU\.DEFAULT -> Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-03-02] (Google Inc.)

Toolbar: HKU\S-1-5-21-2812265994-3346922550-1866879431-1000 -> Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-03-02] (Google Inc.)

DPF: HKLM-x32 {02BCC737-B171-4746-94C9-0D8A0B2C0089} http://office.microsoft.com/_layouts/ClientBin/ieawsdc32.cab

DPF: HKLM-x32 {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab

DPF: HKLM-x32 {233C1507-6A77-46A4-9443-F871F945D258} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

DPF: HKLM-x32 {67DABFBF-D0AB-41FA-9C46-CC0F21721616} http://download.divx.com/player/DivXBrowserPlugin.cab

DPF: HKLM-x32 {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} http://h20614.www2.hp.com/ediags/gmd/Install/Cab/hpIdfPlugin.cab

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)

ShellExecuteHooks: - {AEB6717E-7E19-11d0-97EE-00C04FD91972} - No File [ ]

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

Tcpip\..\Interfaces\{D01FC6C2-F9DD-4360-8CCC-0D917F740762}: [NameServer] 208.67.222.222,208.67.220.220

FireFox:

========

FF ProfilePath: C:\Users\Will\AppData\Roaming\Mozilla\Firefox\Profiles\r875a98f.default

FF NewTab: hxxp://www.google.com

FF DefaultSearchUrl:

FF SearchEngineOrder.1: Google

FF SelectedSearchEngine: Messenger Plus Smartbar Search

FF Homepage: hxxp://www.google.com

FF Keyword.URL: hxxp://feed.plusnetwork.com/?publisher=MessengerPlus&dpid=pb2&co=TJ&userid=d255f793-6257-4574-84ff-31fcf177a402&sp=faddr&t=c0127&uid=88f97096&q=

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll [2015-02-04] ()

FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll [2011-06-20] (DivX, LLC.)

FF Plugin: @java.com/DTPlugin,version=10.21.2 -> C:\Windows\system32\npDeployJava1.dll [2013-04-25] (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=10.21.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll [2013-04-25] (Oracle Corporation)

FF Plugin: @lastpass.com/NPLastPass -> C:\Program Files (x86)\LastPass\nplastpass64.dll [2014-02-05] (LastPass)

FF Plugin: @microsoft.com/GENUINE -> disabled No File

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)

FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll [2015-02-04] ()

FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1210150.dll [2014-03-11] (Adobe Systems, Inc.)

FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2015-02-19] ()

FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll [2011-06-20] (DivX, LLC.)

FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll [2015-02-16] (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll [2015-02-16] (Oracle Corporation)

FF Plugin-x32: @lastpass.com/NPLastPass -> C:\Program Files (x86)\LastPass\nplastpass.dll [2014-02-05] (LastPass)

FF Plugin-x32: @messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6 -> C:\Program Files (x86)\Yahoo!\Shared\npYState.dll [2012-05-25] (Yahoo! Inc.)

FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)

FF Plugin-x32: @Nero.com/KM -> C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL [2012-08-31] (Nero AG)

FF Plugin-x32: @real.com/nppl3260;version=17.0.15.10 -> c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll [2014-11-21] (RealNetworks, Inc.)

FF Plugin-x32: @real.com/nprndlhtml5videoshim;version=17.0.15 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll [2014-10-27] (RealNetworks, Inc.)

FF Plugin-x32: @real.com/nprpplugin;version=17.0.15.10 -> c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll [2014-11-21] (RealPlayer Cloud)

FF Plugin-x32: @rocketlife.com/RocketLife Secure Plug-In Layer;version=1.0.5 -> C:\ProgramData\Visan\plugins\npRLSecurePluginLayer.dll [2011-11-18] (RocketLife, LLP)

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-05] (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-05] (Google Inc.)

FF Plugin-x32: @videolan.org/vlc,version=2.0.4 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2014-07-22] (VideoLAN)

FF Plugin-x32: @videolan.org/vlc,version=2.1.2 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2014-07-22] (VideoLAN)

FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2014-07-22] (VideoLAN)

FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)

FF Plugin HKU\S-1-5-21-2812265994-3346922550-1866879431-1000: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Will\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2013-08-27] (Unity Technologies ApS)

FF SearchPlugin: C:\Users\Will\AppData\Roaming\Mozilla\Firefox\Profiles\r875a98f.default\searchplugins\bingp.xml [2014-10-29]

FF SearchPlugin: C:\Users\Will\AppData\Roaming\Mozilla\Firefox\Profiles\r875a98f.default\searchplugins\Messenger Plus Smartbar Search.xml [2014-11-04]

FF Extension: LastPass - C:\Users\Will\AppData\Roaming\Mozilla\Firefox\Profiles\r875a98f.default\Extensions\[removed] [2015-03-12]

FF Extension: EPUBReader - C:\Users\Will\AppData\Roaming\Mozilla\Firefox\Profiles\r875a98f.default\Extensions\{5384767E-00D9-40E9-B72F-9CC39D655D6F} [2015-02-10]

FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Users\Will\AppData\Roaming\Mozilla\Firefox\Profiles\r875a98f.default\Extensions\{B64D9B05-48E1-4CEB-BF58-E0643994E900} [2014-12-06]

FF Extension: 1-Click Dailymotion Video Downloader - C:\Users\Will\AppData\Roaming\Mozilla\Firefox\Profiles\r875a98f.default\Extensions\[removed] [2014-11-12]

FF Extension: Video Downloader professional - C:\Users\Will\AppData\Roaming\Mozilla\Firefox\Profiles\r875a98f.default\Extensions\[removed] [2014-11-12]

FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{B64D9B05-48E1-4CEB-BF58-E0643994E900}.xpi [2015-03-10]

FF HKLM-x32\…\Firefox\Extensions: [[removed]] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3

FF Extension: No Name - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2012-09-03]

FF HKLM-x32\…\Firefox\Extensions: [[removed]] - C:\Program Files (x86)\Freemake\Freemake Youtube Mp3 Converter\BrowserPlugin\Firefox\[removed]

FF Extension: Freemake Video Downloader Plugin - C:\Program Files (x86)\Freemake\Freemake Youtube Mp3 Converter\BrowserPlugin\Firefox\[removed] [2013-11-25]

FF HKLM-x32\…\Firefox\Extensions: [[removed]] - C:\Program Files (x86)\Freemake\Freemake Youtube Mp3 Converter\BrowserPlugin\Firefox\[removed]

FF Extension: Freemake Youtube Download Button - C:\Program Files (x86)\Freemake\Freemake Youtube Mp3 Converter\BrowserPlugin\Firefox\[removed] [2013-11-25]

FF HKLM-x32\…\Firefox\Extensions: [{338950EA-82DB-44C1-930D-0C28E023C9F0}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext

FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext [2014-11-21]

FF HKU\S-1-5-21-2812265994-3346922550-1866879431-1000\…\Firefox\Extensions: [[removed]] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3

FF HKU\S-1-5-21-2812265994-3346922550-1866879431-1000\…\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff

FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff [2014-12-06]

Chrome:

=======

CHR HomePage: Default -> https://www.google.com/

CHR StartupUrls: Default -> "hxxp://www.mymsn.com/", "https://www.google.com/"

CHR DefaultSearchKeyword: Default -> google_

CHR DefaultSuggestURL: Default ->

CHR Profile: C:\Users\Will\AppData\Local\Google\Chrome\User Data\Default

CHR Extension: (Floorplanner) - C:\Users\Will\AppData\Local\Google\Chrome\User Data\Default\Extensions\abopacaefhbognnmeigicfpgnmpideag [2014-06-06]

CHR Extension: (Instrumente) - C:\Users\Will\AppData\Local\Google\Chrome\User Data\Default\Extensions\ahchimdkljhhfjkklkafookapgikdhkk [2014-06-06]

CHR Extension: (Google Docs) - C:\Users\Will\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-06-06]

CHR Extension: (Dictanote - Speech Recognizer) - C:\Users\Will\AppData\Local\Google\Chrome\User Data\Default\Extensions\aomjekmpappghadlogpigifkghlmebjk [2014-06-06]

CHR Extension: (Google Drive) - C:\Users\Will\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-06-06]

CHR Extension: (BeFunky Photo Editor) - C:\Users\Will\AppData\Local\Google\Chrome\User Data\Default\Extensions\apfkepiiddolifkgjmfdgpnipgnfejab [2014-06-06]

CHR Extension: (Send this page by email) - C:\Users\Will\AppData\Local\Google\Chrome\User Data\Default\Extensions\bcamgnkjooghefjjfgfhnepedkodbgec [2015-03-13]

CHR Extension: (Bookmark Sentry (scanner)) - C:\Users\Will\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdglbbcbmgnimogcmcdenggkpdmihlga [2014-06-06]

CHR Extension: (Chrome Tips Beta (by Google)) - C:\Users\Will\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdmbgfhokojnnaliemjgbahnfeggocpe [2015-03-13]

CHR Extension: (WiBit) - C:\Users\Will\AppData\Local\Google\Chrome\User Data\Default\Extensions\bejaaogemoligmkbmeafkhnaegkggihf [2014-06-06]

CHR Extension: (Build Shed Plans) - C:\Users\Will\AppData\Local\Google\Chrome\User Data\Default\Extensions\blefhmkjdbclnlfegkdhmkepeoikhgpg [2014-06-06]

CHR Extension: (YouTube) - C:\Users\Will\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-06-06]

CHR Extension: (Form Filler) - C:\Users\Will\AppData\Local\Google\Chrome\User Data\Default\Extensions\bnjjngeaknajbdcgpfkgnonkmififhfo [2014-06-06]

CHR Extension: (Fight Depression!) - C:\Users\Will\AppData\Local\Google\Chrome\User Data\Default\Extensions\bpcanhncamomjgapncfnedcimpcmlbnf [2014-06-06]

CHR Extension: (FVD Suggestions) - C:\Users\Will\AppData\Local\Google\Chrome\User Data\Default\Extensions\caoielngcdpgeldnckhponffkiajaobo [2015-03-13]

CHR Extension: (Webmail Ad Blocker) - C:\Users\Will\AppData\Local\Google\Chrome\User Data\Default\Extensions\cbhfdchmklhpcngcgjmpdbjakdggkkjp [2014-12-01]

CHR Extension: (Adblock Plus) - C:\Users\Will\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2014-06-06]

CHR Extension: (Google Search) - C:\Users\Will\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-06-06]

CHR Extension: (Email this page (by Google)) - C:\Users\Will\AppData\Local\Google\Chrome\User Data\Default\Extensions\dbeoemfhkdniadbojeencpkgmobndpai [2015-03-13]

CHR Extension: (Video downloader pro) - C:\Users\Will\AppData\Local\Google\Chrome\User Data\Default\Extensions\dbjlfogfpagepnaojhfbdlhjhildeaem [2014-12-04]

CHR Extension: (Logitech Smooth Scrolling) - C:\Users\Will\AppData\Local\Google\Chrome\User Data\Default\Extensions\dkpejdfnpdkhifgbancbammdijojoffk [2015-03-13]

CHR Extension: (SoundGecko) - C:\Users\Will\AppData\Local\Google\Chrome\User Data\Default\Extensions\dnpdaiiodhbjjcfmmflmidbhgibekagi [2014-06-06]

CHR Extension: (ICE Quick Stream) - C:\Users\Will\AppData\Local\Google\Chrome\User Data\Default\Extensions\dpioikmjnfipgphjldakcaocbbpnfabl [2015-03-13]

CHR Extension: (Hotel Search and Compare (Multilingual)) - C:\Users\Will\AppData\Local\Google\Chrome\User Data\Default\Extensions\eciljddmloccnknaallbgekopdbhndon [2015-03-13]

CHR Extension: (Bloody Pressure) - C:\Users\Will\AppData\Local\Google\Chrome\User Data\Default\Extensions\eemipfoeaegklklcngpmdbaemegjdbdl [2014-06-06]

CHR Extension: (Pixlr-o-matic) - C:\Users\Will\AppData\Local\Google\Chrome\User Data\Default\Extensions\ehcibdjmpjlekgjhepbfmenfppliikcj [2014-06-06]

CHR Extension: (Video Downloader professional) - C:\Users\Will\AppData\Local\Google\Chrome\User Data\Default\Extensions\elicpjhcidhpjomhibiffojpinpmmpil [2014-06-06]

CHR Extension: (Converter) - C:\Users\Will\AppData\Local\Google\Chrome\User Data\Default\Extensions\elogiihmdefhdcainoihdcfpnfbimpnd [2014-06-06]

CHR Extension: (Snapshot 2) - C:\Users\Will\AppData\Local\Google\Chrome\User Data\Default\Extensions\ffgfedebnhmhkcfhhjoikplfafgpihpo [2014-06-06]

CHR Extension: (Chrome Web Store Launcher (by Google)) - C:\Users\Will\AppData\Local\Google\Chrome\User Data\Default\Extensions\gecgipfabdickgidpmbicneamekgbaej [2014-07-30]

CHR Extension: (Video Downloader Super) - C:\Users\Will\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghciphhakbampjemlfbahnhhaemoeolf [2015-02-28]

CHR Extension: (Dictionary by Dictionary.com) - C:\Users\Will\AppData\Local\Google\Chrome\User Data\Default\Extensions\gikhgcaliglmioibbockkmjknfnepbdh [2014-06-06]

CHR Extension: (History Eraser) - C:\Users\Will\AppData\Local\Google\Chrome\User Data\Default\Extensions\gjieilkfnnjoihjjonajndjldjoagffm [2014-06-06]

CHR Extension: (Downloads Folder Launcher) - C:\Users\Will\AppData\Local\Google\Chrome\User Data\Default\Extensions\gmhianpphjibhflcnebkmkkdojjigbjd [2014-06-06]

CHR Extension: (Webcam) - C:\Users\Will\AppData\Local\Google\Chrome\User Data\Default\Extensions\gnbhgamgannegfcmholgllkakldhajeg [2014-06-06]

CHR Extension: (LastPass: Free Password Manager) - C:\Users\Will\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdokiejnpimakedhajhdlcegeplioahd [2014-06-06]

CHR Extension: (FabCam) - C:\Users\Will\AppData\Local\Google\Chrome\User Data\Default\Extensions\hejilffmihldhlfocnabcgndjjpgadfl [2014-06-06]

CHR Extension: (Where to delete an account) - C:\Users\Will\AppData\Local\Google\Chrome\User Data\Default\Extensions\hfpofkfbabpbbmchmiekfnlcgaedbgcf [2014-06-06]

CHR Extension: (Street Maps) - C:\Users\Will\AppData\Local\Google\Chrome\User Data\Default\Extensions\hgkgohkhjofgjpcebjdhkjompkabdoaj [2014-06-06]

CHR Extension: (Video Downloader) - C:\Users\Will\AppData\Local\Google\Chrome\User Data\Default\Extensions\hnmpgleggfcndpeflbjhpjfckfmojnpo [2014-11-06]

CHR Extension: (Apps Launcher) - C:\Users\Will\AppData\Local\Google\Chrome\User Data\Default\Extensions\ijmgkhchjindcjamnckoiahagecjnkdc [2015-02-28]

CHR Extension: (Clearly) - C:\Users\Will\AppData\Local\Google\Chrome\User Data\Default\Extensions\iooicodkiihhpojmmeghjclgihfjdjhj [2014-06-06]

CHR Extension: (Vine Video Download) - C:\Users\Will\AppData\Local\Google\Chrome\User Data\Default\Extensions\jebahcljabjndemkadpdnablhinojkil [2014-06-06]

CHR Extension: (Family Medical Info) - C:\Users\Will\AppData\Local\Google\Chrome\User Data\Default\Extensions\jobbajojigcglfmadbkgjmnacpifklbp [2014-06-06]

CHR Extension: (Photo Calendar Maker) - C:\Users\Will\AppData\Local\Google\Chrome\User Data\Default\Extensions\kannbcclbpngpkjklmplofgclliddlgj [2014-06-06]

CHR Extension: (Autodesk Homestyler) - C:\Users\Will\AppData\Local\Google\Chrome\User Data\Default\Extensions\kdmmkfaghgcicheaimnpffeeekheafkb [2014-06-06]

CHR Extension: (Malware Search) - C:\Users\Will\AppData\Local\Google\Chrome\User Data\Default\Extensions\kgleioieeffejophokeklefchfglgmnk [2015-03-13]

CHR Extension: (Mustachio) - C:\Users\Will\AppData\Local\Google\Chrome\User Data\Default\Extensions\khaoakmndhjandiaaadnjgnbchillcdj [2015-03-13]

CHR Extension: (FLV Video Downloader) - C:\Users\Will\AppData\Local\Google\Chrome\User Data\Default\Extensions\khgbngepgkjeffdkkpnblnlogfjehbjn [2014-11-06]

CHR Extension: (Unit Convertor) - C:\Users\Will\AppData\Local\Google\Chrome\User Data\Default\Extensions\kkaklafnbnpegjnlplfgadnobkgdkinf [2014-06-06]

CHR Extension: (TouristEye Planner) - C:\Users\Will\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpjpejalhlnocbhggpnokneghfenoneg [2014-06-06]

CHR Extension: (Cheapstamatic) - C:\Users\Will\AppData\Local\Google\Chrome\User Data\Default\Extensions\lamcdjgcnmmghjceofmdaghmgoehlkbn [2014-06-06]

CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Will\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-13]

CHR Extension: (Webcam Toy) - C:\Users\Will\AppData\Local\Google\Chrome\User Data\Default\Extensions\lfbgimoladefibpklnfmkpknadbklade [2014-06-06]

CHR Extension: (FVD Downloader) - C:\Users\Will\AppData\Local\Google\Chrome\User Data\Default\Extensions\lfmhcpmkbdkbgbmkjoiopeeegenkdikp [2014-11-08]

CHR Extension: (Google Maps) - C:\Users\Will\AppData\Local\Google\Chrome\User Data\Default\Extensions\lneaknkopdijkpnocmklfnjbeapigfbh [2014-06-06]

CHR Extension: (Google Dictionary (by Google)) - C:\Users\Will\AppData\Local\Google\Chrome\User Data\Default\Extensions\mgijmajocgfcbeboacabfgobmjgjcoja [2014-06-06]

CHR Extension: (Google Mail Checker) - C:\Users\Will\AppData\Local\Google\Chrome\User Data\Default\Extensions\mihcahmgecmbnbcchbopgniflfhgnkff [2014-06-06]

CHR Extension: (CashControl) - C:\Users\Will\AppData\Local\Google\Chrome\User Data\Default\Extensions\mioaopmpfgkncgbbfnmpoegppfcgmoek [2014-06-06]

CHR Extension: (Universal Unit Converter) - C:\Users\Will\AppData\Local\Google\Chrome\User Data\Default\Extensions\nafkejlpknmikohhgdelefdeeieplkog [2014-06-06]

CHR Extension: (Similar Sites) - C:\Users\Will\AppData\Local\Google\Chrome\User Data\Default\Extensions\necpbmbhhdiplmfhmjicabdeighkndkn [2014-06-06]

CHR Extension: (Webutation) - C:\Users\Will\AppData\Local\Google\Chrome\User Data\Default\Extensions\nfclfmabiojpommfcalfdgjjeaahnjbj [2014-06-06]

CHR Extension: (QR Image from URL) - C:\Users\Will\AppData\Local\Google\Chrome\User Data\Default\Extensions\nioihlfoddilijjjeknopfcbglallkce [2014-06-06]

CHR Extension: (Google Wallet) - C:\Users\Will\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-06-06]

CHR Extension: (Personal Blocklist (by Google)) - C:\Users\Will\AppData\Local\Google\Chrome\User Data\Default\Extensions\nolijncfnkgaikbjbdaogikpmpbdcdef [2014-06-06]

CHR Extension: (PotatoSmile) - C:\Users\Will\AppData\Local\Google\Chrome\User Data\Default\Extensions\oalbpfagfhfkcmklpdanadjpbfdedndn [2014-06-06]

CHR Extension: (Camera) - C:\Users\Will\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofmpffnppnlgkgmbgidhhjcglloeejpg [2014-06-06]

CHR Extension: (Click&Clean App) - C:\Users\Will\AppData\Local\Google\Chrome\User Data\Default\Extensions\pdabfienifkbhoihedcgeogidfmibmhp [2014-06-06]

CHR Extension: (Gmail) - C:\Users\Will\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-06-06]

CHR Extension: (Trap Music) - C:\Users\Will\AppData\Local\Google\Chrome\User Data\Default\Extensions\pledapfhaobifoekiipdkhhloekhodoh [2014-06-06]

CHR HKU\S-1-5-21-2812265994-3346922550-1866879431-1000\SOFTWARE\Google\Chrome\Extensions\…\Chrome\Extension: [fcfenmboojpjinhpgggodefccipikbpd] - https://clients2.google.com/service/update2/crx

CHR HKU\S-1-5-21-2812265994-3346922550-1866879431-1000\SOFTWARE\Google\Chrome\Extensions\…\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh] - https://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77128 2015-01-30] (Apple Inc.)

R2 Backupper Service; C:\Program Files (x86)\AOMEI Backupper Standard Edition 2.2\ABService.exe [29912 2015-03-09] (AOMEI Tech Co., Ltd.)

R2 cmdAgent; C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe [7618952 2015-02-03] (COMODO)

R3 cmdvirth; C:\Program Files\COMODO\COMODO Internet Security\cmdvirth.exe [2265304 2015-02-03] (COMODO)

R2 FBackup5Srv; C:\Program Files (x86)\Softland\FBackup 5\bService.exe [4643896 2015-03-09] (Softland)

R2 FreemakeVideoCapture; C:\Program Files (x86)\Freemake\CaptureLib\CaptureLibService.exe [9216 2014-01-13] (Ellora Assets Corp.) [File not signed]

R2 hpqcxs08; C:\Program Files (x86)\HP\Digital Imaging\bin\hpqcxs08.dll [249344 2009-09-20] (Hewlett-Packard Co.) [File not signed]

R2 hpqddsvc; C:\Program Files (x86)\HP\Digital Imaging\bin\hpqddsvc.dll [133120 2009-09-20] (Hewlett-Packard Co.) [File not signed]

R2 HPSLPSVC; C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL [1039360 2010-10-22] (Hewlett-Packard Co.) [File not signed]

R2 HPSupportSolutionsFrameworkService; C:\Program Files (x86)\Hp\Common\HPSupportSolutionsFrameworkService.exe [89864 2015-03-18] (Hewlett-Packard Company)

R2 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe [69632 2005-11-14] (Macrovision Corporation) [File not signed]

S3 Motorola Device Manager; C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperService.exe [137528 2013-11-15] (Motorola Mobility LLC)

S2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2013-06-20] (Microsoft Corporation)

R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2010-08-06] (Hewlett-Packard) [File not signed]

R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2010-08-06] (Hewlett-Packard) [File not signed]

S4 PST Service; C:\Program Files (x86)\Motorola\MotForwardDaemon\ForwardDaemon.exe [65657 2011-09-02] (Motorola) [File not signed]

R2 RealNetworks Downloader Resolver Service; C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [39568 2014-10-26] ()

R2 RealPlayer Cloud Service; c:\program files (x86)\real\realplayer\RPDS\Bin\rpdsvc.exe [1141848 2014-11-21] (RealNetworks, Inc.)

S4 RealPlayerUpdateSvc; C:\Program Files (x86)\Real\UpdateService\RealPlayerUpdateSvc.exe [31856 2014-10-30] ()

R2 ReflectService.exe; C:\Program Files\Macrium\Reflect\ReflectService.exe [1142768 2014-04-22] (Paramount Software UK Ltd)

S4 VIAKaraokeService; C:\Windows\system32\viakaraokesrv.exe [27768 1999-12-31] (VIA Technologies, Inc.)

R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

S2 WiseBootAssistant; C:\Program Files (x86)\Wise\Wise Care 365\BootTime.exe [580232 2014-01-21] (WiseCleaner.com)

S4 WSWNA1100; C:\Program Files (x86)\NETGEAR\WNA1100\WifiSvc.exe [266240 2010-08-04] () [File not signed]

S2 rpcapd; "%ProgramFiles(x86)%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles(x86)%\WinPcap\rpcapd.ini" [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R0 ambakdrv; C:\Windows\System32\ambakdrv.sys [30648 2015-03-09] () [File not signed]

R2 ammntdrv; C:\Windows\system32\ammntdrv.sys [151480 2015-03-09] () [File not signed]

R2 amwrtdrv; C:\Windows\system32\amwrtdrv.sys [17848 2015-03-09] () [File not signed]

R3 anvsnddrv; C:\Windows\System32\drivers\anvsnddrv.sys [33872 2011-11-28] (AnvSoft Inc.)

R1 cmderd; C:\Windows\System32\DRIVERS\cmderd.sys [20184 2015-01-30] (COMODO)

R1 cmdGuard; C:\Windows\System32\DRIVERS\cmdguard.sys [792648 2015-01-30] (COMODO)

R3 hxctlflt; C:\Windows\System32\Drivers\hxctlflt.sys [111104 2009-02-09] (Guillemot Corporation)

S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-03-17] (Malwarebytes Corporation)

R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [247216 2013-06-18] (Microsoft Corporation)

S3 MTsensor; C:\Windows\system32\drivers\ASACPI.sys [15416 2009-05-14] ()

S3 PSMounterEx; C:\Windows\system32\drivers\psmounterex.sys [76408 2013-08-01] (Paramount Software UK Ltd)

S3 SANDRA; No ImagePath

S3 SIVDriver; C:\Windows\system32\Drivers\SIVX64.sys [151800 2014-02-14] (Ray Hinchliffe)

S3 sscdserd; C:\Windows\System32\DRIVERS\sscdserd.sys [141384 2010-11-11] (MCCI Corporation)

S3 StkTMini; C:\Windows\System32\Drivers\StkTMini.sys [528256 2007-11-15] (Syntek)

S3 SWDUMon; C:\Windows\System32\DRIVERS\SWDUMon.sys [16152 2014-10-05] ()

S3 TridVid; C:\Windows\System32\DRIVERS\TridVid.sys [292056 2009-03-23] (Trident Multimedia Technologies Co.,Ltd) [File not signed]

U3 aswMBR; \??\C:\Users\Will\AppData\Local\Temp\aswMBR.sys [X]

U3 aswVmm; \??\C:\Users\Will\AppData\Local\Temp\aswVmm.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)

==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-19 13:02 - 2015-03-19 13:02 - 00002245 _____ () C:\Users\Will\Desktop\aswMBR.txt

2015-03-19 13:02 - 2015-03-19 13:02 - 00000512 _____ () C:\Users\Will\Desktop\MBR.dat

2015-03-19 13:00 - 2015-03-19 13:02 - 00040965 _____ () C:\Users\Will\Downloads\FRST.txt

2015-03-19 12:58 - 2015-03-19 13:00 - 00000000 ____D () C:\FRST

2015-03-19 12:57 - 2015-03-19 12:57 - 02095616 _____ (Farbar) C:\Users\Will\Downloads\FRST64.exe

2015-03-19 12:43 - 2015-03-19 12:43 - 05198336 _____ (AVAST Software) C:\Users\Will\Downloads\aswMBR.exe

2015-03-19 11:41 - 2015-03-19 11:41 - 00000000 ____D () C:\Users\Will\Documents\cbc

2015-03-19 09:50 - 2015-03-19 09:50 - 06578176 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll

2015-03-19 09:50 - 2015-03-19 09:50 - 05698048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll

2015-03-19 09:50 - 2015-03-19 09:50 - 01147392 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe

2015-03-19 09:50 - 2015-03-19 09:50 - 01068544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstsc.exe

2015-03-19 09:50 - 2015-03-19 09:50 - 01057280 _____ (Microsoft Corporation) C:\Windows\system32\rdvidcrl.dll

2015-03-19 09:50 - 2015-03-19 09:50 - 00855552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdvidcrl.dll

2015-03-19 09:50 - 2015-03-19 09:50 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\wksprt.exe

2015-03-19 09:50 - 2015-03-19 09:50 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe

2015-03-19 09:50 - 2015-03-19 09:50 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll

2015-03-19 09:50 - 2015-03-19 09:50 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\MsRdpWebAccess.dll

2015-03-19 09:50 - 2015-03-19 09:50 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\TsUsbFlt.sys

2015-03-19 09:50 - 2015-03-19 09:50 - 00053248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll

2015-03-19 09:50 - 2015-03-19 09:50 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MsRdpWebAccess.dll

2015-03-19 09:50 - 2015-03-19 09:50 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbGDCoInstaller.dll

2015-03-19 09:50 - 2015-03-19 09:50 - 00018944 _____ (Microsoft Corporation) C:\Windows\system32\wksprtPS.dll

2015-03-19 09:50 - 2015-03-19 09:50 - 00017920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wksprtPS.dll

2015-03-19 09:50 - 2015-03-19 09:50 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyControl.exe

2015-03-19 09:50 - 2015-03-19 09:50 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyExtension.dll

2015-03-19 09:05 - 2015-03-19 09:06 - 39578161 _____ () C:\Users\Will\Downloads\Scratch-433.exe

2015-03-18 11:08 - 2015-03-18 11:08 - 00201697 ____N () C:\Windows\hpoins18.dat.temp

2015-03-18 11:08 - 2009-10-07 21:33 - 00005355 ____N () C:\Windows\hpomdl18.dat.temp

2015-03-18 11:03 - 2015-03-18 11:03 - 05197824 _____ () C:\Users\Will\Downloads\HPSupportSolutionsFramework-en-11.51.0048 (1).msi

2015-03-18 10:49 - 2015-03-18 10:49 - 05197824 _____ () C:\Users\Will\Downloads\HPSupportSolutionsFramework-en-11.51.0048.msi

2015-03-18 10:00 - 2015-03-18 10:00 - 00302011 _____ () C:\Users\Will\Downloads\WindowsUpdateDiagnostic.diagcab

2015-03-17 17:12 - 2015-03-17 17:12 - 00000000 ____D () C:\Users\Will\Tracing

2015-03-17 16:43 - 2015-03-17 16:44 - 00450352 _____ (Microsoft Corporation) C:\Users\Will\Downloads\FixitCenter_Run(1).exe

2015-03-17 16:40 - 2015-03-17 16:41 - 00347440 _____ (Microsoft Corporation) C:\Users\Will\Downloads\MicrosoftFixit-portable(1).exe

2015-03-17 13:09 - 2015-03-17 13:10 - 39739064 _____ (Microsoft Corporation) C:\Users\Will\Downloads\Windows-KB890830-x64-V5.21.exe

2015-03-17 12:27 - 2015-03-17 16:49 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2015-03-17 12:26 - 2015-03-17 12:26 - 00001073 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2015-03-17 12:26 - 2015-03-17 12:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2015-03-17 12:25 - 2015-03-17 12:26 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2015-03-17 12:25 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2015-03-17 12:25 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2015-03-17 12:25 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2015-03-17 12:24 - 2015-03-17 12:25 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Will\Downloads\mbam-setup-2.0.4.1028 (1).exe

2015-03-17 12:23 - 2015-03-17 12:23 - 00347440 _____ (Microsoft Corporation) C:\Users\Will\Downloads\MicrosoftFixit-portable (1).exe

2015-03-17 12:21 - 2015-03-17 12:21 - 00347440 _____ (Microsoft Corporation) C:\Users\Will\Downloads\MicrosoftFixit-portable.exe

2015-03-17 11:25 - 2015-03-17 11:26 - 00276536 _____ () C:\Windows\Minidump\031715-26488-01.dmp

2015-03-17 11:25 - 2015-03-17 11:25 - 637940602 _____ () C:\Windows\MEMORY.DMP

2015-03-16 18:05 - 2015-03-16 18:05 - 02347384 _____ (ESET) C:\Users\Will\Downloads\esetsmartinstaller_enu (1).exe

2015-03-16 18:00 - 2015-03-16 18:01 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Will\Downloads\mbam-setup-2.0.4.1028.exe

2015-03-16 16:00 - 2015-03-16 16:02 - 20447176 _____ (Malwarebytes Corporation ) C:\Users\Will\Downloads\mbam-setup.exe

2015-03-15 14:39 - 2015-03-15 09:32 - 200589766 _____ () C:\Users\Will\Documents\CbsPersist_20150315133359.log

2015-03-15 14:30 - 2015-03-13 10:51 - 105946358 _____ () C:\Users\Will\CbsPersist_20150313160530.log

2015-03-15 14:09 - 2015-03-19 12:00 - 00474616 _____ () C:\Windows\WindowsUpdate.log

2015-03-15 14:05 - 2015-03-19 08:14 - 00003336 _____ () C:\Windows\System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-2812265994-3346922550-1866879431-1000

2015-03-15 14:05 - 2015-03-19 08:14 - 00003200 _____ () C:\Windows\System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-2812265994-3346922550-1866879431-1000

2015-03-15 11:50 - 2015-03-15 14:04 - 00235912 _____ () C:\Users\Will\AppData\Local\GDIPFONTCACHEV1.DAT

2015-03-15 11:49 - 2015-03-19 11:54 - 00002871 _____ () C:\Windows\setupact.log

2015-03-15 11:49 - 2015-03-18 10:20 - 00000000 _____ () C:\Windows\setuperr.log

2015-03-15 11:48 - 2015-03-19 03:19 - 01338014 _____ () C:\Windows\PFRO.log

2015-03-15 11:45 - 2015-03-15 11:45 - 00450352 _____ (Microsoft Corporation) C:\Users\Will\Downloads\FixitCenter_Run.exe

2015-03-15 10:38 - 2015-03-15 10:48 - 00000000 ____D () C:\Users\Will\Downloads\techtips

2015-03-15 10:29 - 2015-03-15 10:35 - 00000000 ____D () C:\Users\Will\Downloads\scratch

2015-03-13 09:41 - 2015-03-13 09:41 - 01918032 _____ (SoftPerfect Research ) C:\Users\Will\Downloads\wifiguard_windows_setup.exe

2015-03-13 08:48 - 2015-03-18 10:31 - 00002270 _____ () C:\Windows\CompatibilityIssues.txt

2015-03-12 11:44 - 2015-03-12 13:33 - 3320903680 _____ () C:\Users\Will\Downloads\Windows_7_64-bit_Professional_x64.iso

2015-03-11 10:26 - 2015-03-15 11:35 - 00000000 ____D () C:\Program Files (x86)\FFMPEG Addon

2015-03-11 10:25 - 2015-03-15 11:35 - 00000000 ____D () C:\Program Files (x86)\ChrisPC YTD Downloader MP3 Converter Pro

2015-03-11 10:25 - 2015-03-11 10:25 - 03207960 _____ (Chris P.C. srl ) C:\Users\Will\Downloads\setup_chrispc_ytd_downloader_mp3_converter_pro_1_40.exe

2015-03-11 10:25 - 2015-03-11 10:25 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ChrisPC YTD Downloader MP3 Converter Pro

2015-03-11 10:10 - 2015-03-11 10:10 - 00002540 _____ () C:\Users\Will\Uninstall-VzInHomeAgentlog.log

2015-03-11 01:47 - 2015-03-11 01:47 - 00372224 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll

2015-03-11 01:47 - 2015-03-11 01:47 - 00299008 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll

2015-03-11 01:47 - 2015-03-11 01:47 - 00215552 _____ (Microsoft Corporation) C:\Windows\system32\ubpm.dll

2015-03-11 01:47 - 2015-03-11 01:47 - 00171520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ubpm.dll

2015-03-11 01:47 - 2015-03-11 01:47 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll

2015-03-11 01:47 - 2015-03-11 01:47 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll

2015-03-11 01:47 - 2015-03-11 01:47 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll

2015-03-11 01:47 - 2015-03-11 01:47 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll

2015-03-11 01:47 - 2015-03-11 01:47 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll

2015-03-11 01:47 - 2015-03-11 01:47 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll

2015-03-11 01:47 - 2015-03-11 01:47 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll

2015-03-11 01:47 - 2015-03-11 01:47 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll

2015-03-11 01:46 - 2015-03-11 01:46 - 05554104 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe

2015-03-11 01:46 - 2015-03-11 01:46 - 03973048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe

2015-03-11 01:46 - 2015-03-11 01:46 - 03917752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe

2015-03-11 01:46 - 2015-03-11 01:46 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll

2015-03-11 01:46 - 2015-03-11 01:46 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe

2015-03-11 01:46 - 2015-03-11 01:46 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe

2015-03-11 01:46 - 2015-03-11 01:46 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll

2015-03-11 01:46 - 2015-03-11 01:46 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll

2015-03-11 01:46 - 2015-03-11 01:46 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll

2015-03-11 01:46 - 2015-03-11 01:46 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll

2015-03-11 01:46 - 2015-03-11 01:46 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll

2015-03-11 01:45 - 2015-03-11 01:45 - 14177280 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll

2015-03-11 01:45 - 2015-03-11 01:45 - 12875264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll

2015-03-11 01:44 - 2015-03-11 01:44 - 03204096 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2015-03-11 01:44 - 2015-03-11 01:44 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll

2015-03-11 01:44 - 2015-03-11 01:44 - 01424896 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll

2015-03-11 01:44 - 2015-03-11 01:44 - 01311232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2015-03-11 01:44 - 2015-03-11 01:44 - 01230848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll

2015-03-11 01:44 - 2015-03-11 01:44 - 01067520 _____ (Microsoft Corporation) C:\Windows\system32\msctf.dll

2015-03-11 01:44 - 2015-03-11 01:44 - 00828928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msctf.dll

2015-03-11 01:44 - 2015-03-11 01:44 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll

2015-03-11 01:44 - 2015-03-11 01:44 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2015-03-11 01:44 - 2015-03-11 01:44 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll

2015-03-11 01:44 - 2015-03-11 01:44 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll

2015-03-11 01:44 - 2015-03-11 01:44 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll

2015-03-11 01:44 - 2015-03-11 01:44 - 00459336 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys

2015-03-11 01:44 - 2015-03-11 01:44 - 00342696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll

2015-03-11 01:44 - 2015-03-11 01:44 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll

2015-03-11 01:44 - 2015-03-11 01:44 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll

2015-03-11 01:44 - 2015-03-11 01:44 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll

2015-03-11 01:44 - 2015-03-11 01:44 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll

2015-03-11 01:44 - 2015-03-11 01:44 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll

2015-03-11 01:44 - 2015-03-11 01:44 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll

2015-03-11 01:44 - 2015-03-11 01:44 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll

2015-03-11 01:44 - 2015-03-11 01:44 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll

2015-03-11 01:44 - 2015-03-11 01:44 - 00155576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys

2015-03-11 01:44 - 2015-03-11 01:44 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll

2015-03-11 01:44 - 2015-03-11 01:44 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll

2015-03-11 01:44 - 2015-03-11 01:44 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll

2015-03-11 01:44 - 2015-03-11 01:44 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe

2015-03-11 01:44 - 2015-03-11 01:44 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll

2015-03-11 01:44 - 2015-03-11 01:44 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys

2015-03-11 01:44 - 2015-03-11 01:44 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll

2015-03-11 01:44 - 2015-03-11 01:44 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2015-03-11 01:44 - 2015-03-11 01:44 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll

2015-03-11 01:44 - 2015-03-11 01:44 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll

2015-03-11 01:44 - 2015-03-11 01:44 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe

2015-03-11 01:44 - 2015-03-11 01:44 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll

2015-03-11 01:44 - 2015-03-11 01:44 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll

2015-03-11 01:44 - 2015-03-11 01:44 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll

2015-03-11 01:44 - 2015-03-11 01:44 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe

2015-03-11 01:44 - 2015-03-11 01:44 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll

2015-03-11 01:44 - 2015-03-11 01:44 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll

2015-03-11 01:44 - 2015-03-11 01:44 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2015-03-11 01:44 - 2015-03-11 01:44 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe

2015-03-11 01:44 - 2015-03-11 01:44 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2015-03-11 01:44 - 2015-03-11 01:44 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll

2015-03-11 01:44 - 2015-03-11 01:44 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll

2015-03-11 01:44 - 2015-03-11 01:44 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll

2015-03-11 01:44 - 2015-03-11 01:44 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll

2015-03-11 01:44 - 2015-03-11 01:44 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll

2015-03-11 01:44 - 2015-02-19 23:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2015-03-11 01:43 - 2015-03-11 01:43 - 25021440 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2015-03-11 01:43 - 2015-03-11 01:43 - 19720192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2015-03-11 01:43 - 2015-03-11 01:43 - 14398976 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2015-03-11 01:43 - 2015-03-11 01:43 - 12827648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2015-03-11 01:43 - 2015-03-11 01:43 - 06035456 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2015-03-11 01:43 - 2015-03-11 01:43 - 04300288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2015-03-11 01:43 - 2015-03-11 01:43 - 02886144 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2015-03-11 01:43 - 2015-03-11 01:43 - 02358784 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2015-03-11 01:43 - 2015-03-11 01:43 - 02278400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2015-03-11 01:43 - 2015-03-11 01:43 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2015-03-11 01:43 - 2015-03-11 01:43 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2015-03-11 01:43 - 2015-03-11 01:43 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2015-03-11 01:43 - 2015-03-11 01:43 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2015-03-11 01:43 - 2015-03-11 01:43 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll

2015-03-11 01:43 - 2015-03-11 01:43 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll

2015-03-11 01:43 - 2015-03-11 01:43 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe

2015-03-11 01:43 - 2015-03-11 01:43 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2015-03-11 01:43 - 2015-03-11 01:43 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2015-03-11 01:43 - 2015-03-11 01:43 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2015-03-11 01:43 - 2015-03-11 01:43 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2015-03-11 01:43 - 2015-03-11 01:43 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2015-03-11 01:43 - 2015-03-11 01:43 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2015-03-11 01:43 - 2015-03-11 01:43 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll

2015-03-11 01:43 - 2015-03-11 01:43 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2015-03-11 01:43 - 2015-03-11 01:43 - 00503296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2015-03-11 01:43 - 2015-03-11 01:43 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll

2015-03-11 01:43 - 2015-03-11 01:43 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2015-03-11 01:43 - 2015-03-11 01:43 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll

2015-03-11 01:43 - 2015-03-11 01:43 - 00389800 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll

2015-03-11 01:43 - 2015-03-11 01:43 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2015-03-11 01:43 - 2015-03-11 01:43 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll

2015-03-11 01:43 - 2015-03-11 01:43 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2015-03-11 01:43 - 2015-03-11 01:43 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll

2015-03-11 01:43 - 2015-03-11 01:43 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2015-03-11 01:43 - 2015-03-11 01:43 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2015-03-11 01:43 - 2015-03-11 01:43 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2015-03-11 01:43 - 2015-03-11 01:43 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll

2015-03-11 01:43 - 2015-03-11 01:43 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll

2015-03-11 01:43 - 2015-03-11 01:43 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2015-03-11 01:43 - 2015-03-11 01:43 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2015-03-11 01:43 - 2015-03-11 01:43 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2015-03-11 01:43 - 2015-03-11 01:43 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2015-03-11 01:43 - 2015-03-11 01:43 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll

2015-03-11 01:43 - 2015-02-19 22:22 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2015-03-11 01:42 - 2015-03-11 01:42 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll

2015-03-11 01:42 - 2015-03-11 01:42 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll

2015-03-10 16:06 - 2015-03-10 16:06 - 00001777 _____ () C:\Users\Public\Desktop\Quicken Deluxe 2013.lnk

2015-03-10 16:05 - 2015-03-10 16:14 - 00000000 ____D () C:\Program Files (x86)\Quicken

2015-03-10 16:05 - 2015-03-10 16:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Quicken 2013

2015-03-10 08:42 - 2015-03-15 11:35 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

2015-03-10 08:31 - 2015-03-10 08:31 - 00000000 ____D () C:\Users\Will\Documents\Wondershare PDF to Word

2015-03-09 14:52 - 2015-03-15 11:35 - 00000000 ____D () C:\Program Files (x86)\AOMEI Backupper Standard Edition 2.2

2015-03-09 14:52 - 2015-03-09 14:52 - 00001181 _____ () C:\Users\Public\Desktop\AOMEI Backupper Standard Edition 2.2.lnk

2015-03-09 14:52 - 2015-03-09 14:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AOMEI Backupper Standard Edition 2.2

2015-03-09 14:31 - 2015-03-09 14:32 - 20084288 _____ (AOMEI Technology Co., Ltd. ) C:\Users\Will\Documents\Backupper (1).exe

2015-03-09 11:29 - 2015-03-09 11:34 - 00000000 ____D () C:\Users\Will\Downloads\ezd2535new

2015-03-09 11:26 - 2015-03-09 11:26 - 00000000 ____D () C:\Program Files (x86)\FNet

2015-03-09 11:25 - 2015-03-09 11:25 - 00887850 _____ (FNet Company ) C:\Users\Will\Downloads\OTB-PCClone.exe

2015-03-09 11:14 - 2015-03-09 11:14 - 00002557 _____ () C:\Users\Public\Desktop\FBackup 5.lnk

2015-03-09 11:14 - 2015-03-09 11:14 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FBackup 5

2015-03-09 11:13 - 2015-03-09 11:13 - 00000000 ____D () C:\ProgramData\regid.2006-01.com.fbackup

2015-03-07 15:34 - 2015-03-07 15:34 - 00000000 _____ () C:\Windows\system32\sfc

2015-03-06 12:15 - 2015-03-06 12:15 - 00002938 _____ () C:\Windows\System32\Tasks\{D69D8BE0-2013-4C3A-B044-6A1A79D325DC}

2015-03-06 12:14 - 2015-03-06 12:14 - 00002938 _____ () C:\Windows\System32\Tasks\{F5DE0543-01B7-48C0-B73B-E6B36EF74E6B}

2015-03-06 12:13 - 2015-03-06 12:13 - 00002938 _____ () C:\Windows\System32\Tasks\{920B29B9-6D94-4498-BC4B-049B02C7A276}

2015-03-06 12:00 - 2015-03-06 12:14 - 00249856 ____N (Microsoft Corporation) C:\Windows\Setup1.exe

2015-03-06 12:00 - 2015-03-06 12:14 - 00073216 _____ (Microsoft Corporation) C:\Windows\ST6UNST.EXE

2015-03-06 11:11 - 2015-03-18 10:32 - 00001908 _____ () C:\Windows\diagwrn.xml

2015-03-06 11:11 - 2015-03-18 10:32 - 00001908 _____ () C:\Windows\diagerr.xml

2015-03-06 10:45 - 2015-03-06 10:48 - 20046315 _____ () C:\Users\Will\Downloads\PCCLONEEX_2_01_12_FNET.zip

2015-03-05 13:15 - 2015-03-05 13:15 - 00000000 ____D () C:\Users\Public\Documents\My FBackup

2015-03-05 11:50 - 2015-03-05 11:50 - 00000000 __SHD () C:\Windows\SysWOW64\AI_RecycleBin

2015-03-05 10:59 - 2015-03-05 10:59 - 00000000 ____D () C:\Windows\System32\Tasks\Softland

2015-03-05 10:53 - 2015-03-05 10:57 - 00000000 ____D () C:\ProgramData\Softland

2015-03-05 10:53 - 2015-03-05 10:54 - 56969008 _____ (Softland) C:\Users\Will\Downloads\fbsetup-full.exe

2015-03-05 10:52 - 2015-03-10 08:31 - 00000000 ____D () C:\Program Files (x86)\Softland

2015-03-05 10:52 - 2015-03-05 10:58 - 00000000 ____D () C:\Users\Will\AppData\Roaming\Softland

2015-03-04 04:01 - 2015-03-04 04:01 - 00000000 ____D () C:\Windows\tracing

2015-03-03 15:46 - 2015-03-03 15:46 - 00950272 _____ (Microsoft Corporation) C:\Windows\system32\perftrack.dll

2015-03-03 15:46 - 2015-03-03 15:46 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\wdi.dll

2015-03-03 15:46 - 2015-03-03 15:46 - 00076800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdi.dll

2015-03-03 15:46 - 2015-03-03 15:46 - 00029696 _____ (Microsoft Corporation) C:\Windows\system32\powertracker.dll

2015-03-02 16:47 - 2015-03-02 16:48 - 05165056 _____ () C:\Users\Will\Downloads\HPSupportSolutionsFramework-11.51.0048.msi

2015-03-01 12:21 - 2015-03-01 12:50 - 243958281 _____ () C:\Users\Will\Downloads\v.mp4

2015-02-26 10:22 - 2015-02-26 10:22 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk

2015-02-26 10:22 - 2015-02-26 10:22 - 00001986 _____ () C:\Users\Public\Desktop\Adobe Reader XI.lnk

2015-02-25 04:12 - 2015-01-08 19:44 - 00419936 _____ () C:\Windows\SysWOW64\locale.nls

2015-02-25 04:12 - 2015-01-08 19:43 - 00419936 _____ () C:\Windows\system32\locale.nls

2015-02-19 11:06 - 2015-02-19 11:06 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes

2015-02-19 11:06 - 2015-02-19 11:06 - 00000000 ____D () C:\Program Files\iPod

2015-02-19 11:06 - 2015-02-19 11:06 - 00000000 ____D () C:\Program Files (x86)\iTunes

2015-02-19 11:05 - 2015-02-19 11:06 - 00000000 ____D () C:\Program Files\iTunes

2015-02-19 11:03 - 2015-02-19 11:05 - 00000000 ____D () C:\ProgramData\E1864A66-75E3-486a-BD95-D1B7D99A84A7

2015-02-17 15:26 - 2015-02-17 15:26 - 01217184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FM20.DLL

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-19 12:57 - 2014-04-02 19:19 - 00030246 _____ () C:\Windows\system32\Drivers\fvstore.dat

2015-03-19 12:53 - 2013-10-09 15:26 - 01474832 _____ () C:\Windows\system32\Drivers\sfi.dat

2015-03-19 12:49 - 2013-08-16 09:51 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2015-03-19 12:45 - 2012-11-22 11:02 - 00000336 _____ () C:\Windows\Tasks\HP Photo Creations Communicator.job

2015-03-19 12:38 - 2012-08-30 15:54 - 00000898 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2015-03-19 12:02 - 2009-07-14 00:45 - 00027568 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2015-03-19 12:02 - 2009-07-14 00:45 - 00027568 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2015-03-19 12:00 - 2009-07-14 01:13 - 00937600 _____ () C:\Windows\system32\PerfStringBackup.INI

2015-03-19 11:59 - 2013-07-16 07:28 - 00003918 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{70B937ED-2D2C-4ECB-8C88-A5D155B39F65}

2015-03-19 11:56 - 2014-02-16 10:12 - 00000000 ____D () C:\Users\Will\AppData\Roaming\Wise Care 365

2015-03-19 11:56 - 2012-09-03 12:15 - 00051738 _____ () C:\ProgramData\hpzinstall.log

2015-03-19 11:54 - 2012-08-30 15:54 - 00000894 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2015-03-19 11:54 - 2011-12-13 20:23 - 00000000 ____D () C:\TEMP

2015-03-19 11:54 - 2009-07-14 01:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2015-03-19 11:54 - 2009-07-13 23:20 - 00000000 ____D () C:\Windows\registration

2015-03-19 10:10 - 2009-07-13 23:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories

2015-03-19 09:59 - 2009-07-13 23:20 - 00000000 ____D () C:\Windows\SysWOW64\Dism

2015-03-19 09:59 - 2009-07-13 23:20 - 00000000 ____D () C:\Windows\system32\Dism

2015-03-19 09:29 - 2014-10-08 14:06 - 00000000 ____D () C:\Users\Will\AppData\Roaming\Skype

2015-03-19 04:03 - 2009-07-13 23:20 - 00000000 ____D () C:\Windows\rescache

2015-03-18 14:32 - 2009-07-13 22:34 - 00000513 _____ () C:\Windows\win.ini

2015-03-18 14:23 - 2012-09-03 11:58 - 00000000 ____D () C:\ProgramData\HP

2015-03-18 14:13 - 2013-09-13 07:02 - 00000000 ____D () C:\Users\Will\AppData\Local\CrashDumps

2015-03-18 11:08 - 2012-09-03 12:15 - 00201697 ____N () C:\Windows\hpoins18.dat

2015-03-18 09:00 - 2014-02-19 10:18 - 00000400 _____ () C:\Windows\Tasks\Wise Turbo Checker.job

2015-03-18 03:12 - 2013-07-15 03:00 - 00000000 ____D () C:\Windows\system32\MRT

2015-03-18 03:00 - 2012-09-01 06:28 - 122905848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2015-03-17 17:12 - 2012-08-27 10:51 - 00000000 ____D () C:\Users\Will

2015-03-17 17:11 - 2014-10-08 10:23 - 00000000 ___RD () C:\Program Files (x86)\Skype

2015-03-17 17:11 - 2012-08-29 11:27 - 00000000 ____D () C:\ProgramData\Skype

2015-03-17 16:45 - 2009-07-13 23:20 - 00000000 ____D () C:\Windows\IME

2015-03-17 13:08 - 2015-01-29 10:04 - 00000000 ____D () C:\Program Files (x86)\Elex-tech

2015-03-17 13:08 - 2015-01-29 10:03 - 00000000 ____D () C:\Users\Will\AppData\Roaming\Elex-tech

2015-03-17 11:25 - 2014-08-28 05:37 - 00000000 ____D () C:\Windows\Minidump

2015-03-16 15:57 - 2014-10-30 21:10 - 00000235 _____ () C:\Windows\SysWOW64\_WKERNEL.SYL

2015-03-15 14:40 - 2014-03-02 12:02 - 00000000 ____D () C:\Users\Will\Desktop\Utilities

2015-03-14 12:06 - 2014-09-15 09:19 - 00000000 ____D () C:\Users\Will\AppData\Roaming\ChemTable Software

2015-03-14 12:06 - 2014-09-15 09:19 - 00000000 ____D () C:\Users\Will\AppData\Local\ChemTable Software

2015-03-14 08:33 - 2012-12-04 12:51 - 00000000 ____D () C:\Users\Will\AppData\Roaming\vlc

2015-03-13 23:07 - 2014-04-23 09:30 - 00000490 _____ () C:\Windows\Tasks\WinUtilities_DiskDefrag_D81CDF27E9284404.job

2015-03-13 21:10 - 2014-04-23 09:30 - 00000490 _____ () C:\Windows\Tasks\WinUtilities_Registry_Cleaner_D81CDF27E9284402.job

2015-03-13 12:20 - 2014-04-23 09:29 - 00000504 _____ () C:\Windows\Tasks\WinUtilities_History_Cleaner_D81CDF27E9284403.job

2015-03-13 12:03 - 2014-04-23 09:29 - 00000488 _____ () C:\Windows\Tasks\WinUtilities_Disk_Cleaner_D81CDF27E9284401.job

2015-03-13 10:29 - 2013-04-23 13:01 - 00000000 ____D () C:\Users\Will\.gstreamer-0.10

2015-03-13 10:29 - 2013-04-23 12:56 - 00000000 ____D () C:\Users\Will\AppData\Roaming\MotoCast

2015-03-13 10:26 - 2014-03-01 11:38 - 00000000 ____D () C:\Users\Will\AppData\Roaming\Ditto

2015-03-13 10:26 - 2012-12-09 10:38 - 00000000 ___RD () C:\Users\Will\Google Drive

2015-03-13 09:42 - 2014-01-18 11:28 - 00000922 _____ () C:\Users\Public\Desktop\SoftPerfect WiFi Guard.lnk

2015-03-13 09:42 - 2014-01-18 11:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SoftPerfect WiFi Guard

2015-03-13 09:42 - 2014-01-18 11:28 - 00000000 ____D () C:\Program Files\SoftPerfect WiFi Guard

2015-03-13 09:41 - 2012-12-09 10:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive

2015-03-13 08:45 - 2012-08-29 10:23 - 00000000 ____D () C:\Users\Will\AppData\Local\Google

2015-03-12 23:40 - 2014-06-06 08:29 - 00002069 _____ () C:\Users\Public\Desktop\Google Chrome.lnk

2015-03-11 11:04 - 2012-08-29 10:28 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service

2015-03-11 10:19 - 2013-02-18 16:37 - 00000000 ____D () C:\Program Files (x86)\Haali

2015-03-11 10:13 - 2012-12-08 13:04 - 00000000 ____D () C:\Program Files (x86)\TomTom International B.V

2015-03-11 10:10 - 2012-11-04 11:57 - 00000000 ____D () C:\Users\Will\AppData\Roaming\Verizon

2015-03-11 10:10 - 2012-11-04 11:57 - 00000000 ____D () C:\Program Files (x86)\Verizon

2015-03-11 09:02 - 2014-03-02 12:03 - 00000000 ____D () C:\Users\Will\Desktop\Photo

2015-03-11 09:02 - 2014-03-02 11:54 - 00000000 ___RD () C:\Users\Will\Desktop\video

2015-03-11 09:02 - 2012-08-27 11:15 - 00000000 ___DC () C:\Users\Will\AppData\Local\MigWiz

2015-03-11 04:08 - 2009-07-14 00:45 - 05338040 _____ () C:\Windows\system32\FNTCACHE.DAT

2015-03-11 03:29 - 2012-08-29 16:24 - 00000000 ____D () C:\ProgramData\Microsoft Help

2015-03-10 16:05 - 2012-08-27 16:30 - 00000126 _____ () C:\Windows\QUICKEN.INI

2015-03-09 14:54 - 2014-04-30 12:56 - 00000000 ____D () C:\ProgramData\AomeiBR

2015-03-09 14:53 - 2014-04-30 13:00 - 00001024 ____H () C:\SYSTAG.BIN

2015-03-09 14:53 - 2014-04-30 12:48 - 00000082 _____ () C:\Windows\SysWOW64\winsevr.dat

2015-03-09 14:52 - 2014-04-30 12:47 - 00151480 _____ () C:\Windows\system32\ammntdrv.sys

2015-03-09 14:52 - 2014-04-30 12:47 - 00030648 _____ () C:\Windows\system32\ambakdrv.sys

2015-03-09 14:52 - 2014-04-30 12:47 - 00017848 _____ () C:\Windows\system32\amwrtdrv.sys

2015-03-09 11:13 - 2014-04-23 09:52 - 00000000 ____D () C:\ProgramData\Package Cache

2015-03-09 11:10 - 2012-07-27 09:55 - 00000000 ____D () C:\ProgramData\Temp

2015-03-07 12:42 - 2013-04-28 08:23 - 00000000 ____D () C:\Users\Will\Documents\manuals

2015-03-07 11:21 - 2015-01-20 11:11 - 00000000 ____D () C:\Windows\system32\FxsTmp

2015-03-06 13:00 - 2010-11-20 23:27 - 00295552 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe

2015-03-06 12:13 - 2000-05-21 19:00 - 00115920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSINET.OCX

2015-03-06 12:13 - 1999-11-29 20:26 - 00057344 _____ (LogicDriven, Incorporated) C:\Windows\SysWOW64\LDMinMax6.ocx

2015-03-05 12:00 - 2012-11-22 11:59 - 00000000 ____D () C:\Program Files (x86)\The Print Shop 22

2015-03-05 11:55 - 2012-11-22 12:36 - 00000000 ____D () C:\Users\Will\AppData\Roaming\PrimoPDF

2015-03-05 11:54 - 2012-11-22 12:34 - 00000000 ____D () C:\Program Files (x86)\Nitro PDF

2015-03-05 11:52 - 2014-02-24 10:11 - 00000000 ____D () C:\Program Files (x86)\SlimCleaner

2015-03-05 11:44 - 2014-02-16 10:11 - 00000000 ____D () C:\Program Files (x86)\Wise

2015-03-05 11:42 - 2012-08-30 15:54 - 00000000 ____D () C:\Program Files (x86)\Google

2015-03-05 11:40 - 2014-05-28 08:37 - 00000000 ____D () C:\Program Files (x86)\Belarc

2015-03-05 11:39 - 2012-12-06 12:52 - 00000000 ____D () C:\Program Files (x86)\DivX

2015-03-05 11:39 - 2012-12-06 12:51 - 00000000 ____D () C:\ProgramData\DivX

2015-03-05 11:38 - 2012-12-06 12:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DivX Plus

2015-03-05 11:37 - 2014-11-24 12:22 - 00000000 ____D () C:\Program Files (x86)\Debenu

2015-03-05 11:31 - 2013-04-20 09:43 - 00000000 ____D () C:\Users\Will\AppData\Local\Quicken WillMaker Plus 2010

2015-03-05 08:56 - 2013-11-06 11:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\honestech VHS to DVD 3.0 SE

2015-03-05 08:56 - 2012-09-03 12:19 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP

2015-03-03 12:54 - 2013-11-06 11:43 - 00000000 ____D () C:\Program Files (x86)\honestech VHS to DVD 3.0 SE

2015-03-03 12:53 - 2015-02-14 20:06 - 00000000 ____D () C:\Program Files (x86)\ESET

2015-03-03 12:53 - 2014-10-24 10:56 - 00000000 ____D () C:\Windows\ERUNT

2015-03-03 12:53 - 2014-10-10 11:26 - 00000000 ____D () C:\Program Files (x86)\TomTom HOME 2

2015-03-03 12:53 - 2014-10-10 11:23 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TomTom

2015-03-03 12:53 - 2014-04-16 10:37 - 00000000 ____D () C:\Users\Will\AppData\Roaming\QFX Software

2015-03-03 12:53 - 2014-04-16 10:37 - 00000000 ____D () C:\ProgramData\QFX Software

2015-03-03 12:53 - 2013-10-09 15:27 - 00000000 ____D () C:\Windows\System32\Tasks\COMODO

2015-03-03 12:53 - 2012-09-03 12:16 - 00000000 ____D () C:\Program Files\HP

2015-03-03 12:53 - 2012-09-03 11:56 - 00000000 ____D () C:\Program Files (x86)\HP

2015-03-03 12:53 - 2012-08-27 12:19 - 00000000 ____D () C:\Users\HomeGroupUser$

2015-03-03 12:53 - 2012-07-27 09:39 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information

2015-03-03 12:51 - 2014-05-10 09:16 - 00000000 ____D () C:\Program Files\Microsoft Mouse and Keyboard Center

2015-03-03 12:51 - 2012-08-31 11:04 - 00000000 ____D () C:\ProgramData\Real

2015-03-02 15:06 - 2012-08-30 15:46 - 00000000 ____D () C:\Users\Will\AppData\Roaming\InstallShield

2015-03-01 12:55 - 2012-11-29 12:39 - 00000000 ____D () C:\Users\Will\AppData\Roaming\dvdcss

2015-02-28 08:56 - 2013-02-11 11:19 - 00000000 ____D () C:\Users\Will\Documents\TurboTax

2015-02-26 10:32 - 2012-07-27 09:42 - 00000000 ____D () C:\ProgramData\Adobe

2015-02-26 10:23 - 2014-08-24 10:53 - 00000000 ____D () C:\Users\Will\AppData\Local\Adobe

2015-02-26 10:15 - 2014-02-03 10:47 - 00000000 ____D () C:\Users\Will\AppData\Roaming\Foxit Software

2015-02-26 10:15 - 2012-11-22 12:46 - 00000000 ____D () C:\Users\Will\AppData\Roaming\Nitro

2015-02-25 04:05 - 2012-07-27 09:46 - 00929722 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI

2015-02-21 10:56 - 2012-11-30 11:14 - 00000000 ____D () C:\Users\Will\AppData\Roaming\Apple Computer

2015-02-21 10:56 - 2012-11-30 11:14 - 00000000 ____D () C:\Users\Will\AppData\Local\Apple Computer

2015-02-19 11:06 - 2012-11-30 11:12 - 00000000 ____D () C:\Program Files\Common Files\Apple

2015-02-19 11:04 - 2012-08-21 14:01 - 00125872 _____ (GEAR Software Inc.) C:\Windows\system32\GEARAspi64.dll

2015-02-19 11:04 - 2012-08-21 14:01 - 00106928 _____ (GEAR Software Inc.) C:\Windows\SysWOW64\GEARAspi.dll

2015-02-19 10:43 - 2014-07-28 14:52 - 06112072 _____ (Apple, Inc.) C:\Windows\system32\usbaaplrc.dll

2015-02-19 10:43 - 2014-07-28 14:52 - 00054784 _____ (Apple, Inc.) C:\Windows\system32\Drivers\usbaapl64.sys

==================== Files in the root of some directories =======

2013-01-03 23:16 - 2013-01-03 23:16 - 2174976 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\Common Files\atimpenc.dll

2013-01-22 11:30 - 2014-02-05 11:27 - 13024768 _____ (LastPass) C:\Program Files (x86)\Common Files\lpuninstall.exe

2013-12-26 10:36 - 2013-12-28 12:29 - 0000373 _____ () C:\Users\Will\AppData\Roaming\burnaware.ini

2013-01-16 11:34 - 2014-01-12 10:11 - 0007859 _____ () C:\Users\Will\AppData\Roaming\pcouffin.cat

2013-01-16 11:34 - 2014-01-12 10:11 - 0001167 _____ () C:\Users\Will\AppData\Roaming\pcouffin.inf

2013-01-16 11:34 - 2014-01-12 10:11 - 0000033 _____ () C:\Users\Will\AppData\Roaming\pcouffin.log

2013-01-16 11:34 - 2014-01-12 10:11 - 0082816 _____ (VSO Software) C:\Users\Will\AppData\Roaming\pcouffin.sys

2012-11-04 11:57 - 2012-11-04 11:57 - 0012520 _____ () C:\Users\Will\AppData\Roaming\VCA-install.log

2013-12-03 10:48 - 2013-12-03 10:48 - 0004464 _____ () C:\Users\Will\AppData\Roaming\VCA-uninstall.log

2013-08-14 12:23 - 2013-08-14 12:23 - 0000056 _____ () C:\Users\Will\AppData\Roaming\WB.CFG

2013-08-14 12:23 - 2013-08-18 00:23 - 0000005 _____ () C:\Users\Will\AppData\Roaming\WBPU-TTL.DAT

2014-01-27 12:05 - 2014-01-27 12:05 - 0000000 _____ () C:\Users\Will\AppData\Roaming\wklnhst.dat

2013-07-14 10:59 - 2014-10-05 10:05 - 0223946 _____ () C:\Users\Will\AppData\Local\ars.cache

2013-07-14 11:01 - 2014-10-05 10:05 - 1310545 _____ () C:\Users\Will\AppData\Local\census.cache

2013-07-14 10:42 - 2013-07-14 10:42 - 0000036 _____ () C:\Users\Will\AppData\Local\housecall.guid.cache

2014-02-03 10:58 - 2014-02-03 10:58 - 0006207 _____ () C:\Users\Will\AppData\Local\HWVendorDetection.log

2013-03-23 09:21 - 2014-01-31 09:44 - 0007597 _____ () C:\Users\Will\AppData\Local\Resmon.ResmonCfg

2014-10-05 09:53 - 2014-10-05 09:53 - 0000010 _____ () C:\Users\Will\AppData\Local\sponge.last.runtime.cache

2013-09-17 13:20 - 2013-09-17 13:20 - 0000057 _____ () C:\ProgramData\Ament.ini

2012-09-03 12:15 - 2015-03-19 11:56 - 0051738 _____ () C:\ProgramData\hpzinstall.log

2013-01-10 09:46 - 2015-01-20 10:12 - 0000935 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.400.32.bc

Files to move or delete:

====================

C:\Users\Will\productkey.vbs

C:\Users\Will\xp.reg

Some content of TEMP:

====================

C:\Users\Will\AppData\Local\Temp\SkypeSetup.exe

Some zero byte size files/folders:

==========================

C:\Windows\System32\D3DIM700.DLL

C:\Windows\System32\igdumd32.dll

C:\Windows\System32\olepro32.dll

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\SysWOW64\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2015-03-15 00:59

==================== End Of Log ============================

ken545

Post #2March 19, 2015, 6:35 PM UTC

Malwarebytes needs to be completely removed from your system, first uninstall it via Programs and Features in the Control Panel, reboot your system and then run there removal tool

Download and run their removal utility HERE

It will ask to restart your computer (please allow it to).

Then download Malwarebytes' Anti-Malware Version 2.0.4 from HERE

On the Dashboard click on Update Now

Go to the Setting Tab

Under Setting go to Detection and Protection

Under PUP and PUM make sure both are set to show Threat Detections as Malware

Go to Advanced setting and make sure Automatically Quarantine Detected Items is checked

Then on the Dashboard click on Scan

Make sure to select THREAT SCAN

Then click on Scan

When the scan is finished and the log pops up…select Copy to Clipboard

Please paste the log back into this thread for review

Exit Malwarebytes

ken545

Post #3March 19, 2015, 7:51 PM UTC

New version of Malwarebytes just came out today

http://www.malwarebytes.org/mwb-download/confirm/?utm_source=facebook&utm_medium=social

Deleted Member

Post #4March 19, 2015, 9:25 PM UTC

Thanks for the fast reply. The log is a little different than old version.

Malwarebytes Anti-Malware

www.malwarebytes.org

Scan Date: 3/19/2015

Scan Time: 15:26:22

Logfile:

Administrator: Yes

Version: 2.01.4.1018

Malware Database: v2015.03.19.07

Rootkit Database: v2015.02.25.01

License: Free

Malware Protection: Disabled

Malicious Website Protection: Disabled

Self-protection: Disabled

OS: Windows 7 Service Pack 1

CPU: x64

File System: NTFS

User: Will

Scan Type: Threat Scan

Result: Completed

Objects Scanned: 478634

Time Elapsed: 35 min, 58 sec

Memory: Enabled

Startup: Enabled

Filesystem: Enabled

Archives: Enabled

Rootkits: Disabled

Heuristics: Enabled

PUP: Enabled

PUM: Enabled

Processes: 0

(No malicious items detected)

Modules: 0

(No malicious items detected)

Registry Keys: 0

(No malicious items detected)

Registry Values: 0

(No malicious items detected)

Registry Data: 0

(No malicious items detected)

Folders: 0

(No malicious items detected)

Files: 0

(No malicious items detected)

Physical Sectors: 0

(No malicious items detected)

(end)

Malwarebytes Anti-Malware

www.malwarebytes.org

This is protection log.

Update, 3/19/2015 15:22:45, SYSTEM, WILL-PC, Manual, Malware Database, 2015.3.9.5, 2015.3.19.7,

Scan, 3/19/2015 15:23:35, SYSTEM, WILL-PC, Manual, Start:3/19/2015 15:22:55, Duration:0 min 40 sec, Threat Scan, Cancelled, 0 Malware Detections, 0 Non-Malware Detections,

Scan, 3/19/2015 15:25:37, SYSTEM, WILL-PC, Manual, Start:3/19/2015 15:25:16, Duration:0 min 20 sec, Threat Scan, Cancelled, 0 Malware Detections, 0 Non-Malware Detections,

Scan, 3/19/2015 16:02:21, SYSTEM, WILL-PC, Manual, Start:3/19/2015 15:26:22, Duration:35 min 58 sec, Threat Scan, Completed, 0 Malware Detections, 0 Non-Malware Detections,

(end)

ken545

Post #5March 19, 2015, 10:06 PM UTC

I saw a few entries on your FRST log that need to go, lets do this

-AdwCleaner-by Xplode

Click on this link to download : ADWCleaner
Click on ONE of the Two Blue Download Now buttons That have a blue arrow beside them and save it to your desktop.

Do not click on any links in the top Advertisment.

Close all open programs and internet browsers.
Double click on AdwCleaner.exe to run the tool.
Click on Scan.
After the scan is complete click on "Clean"
Confirm each time with Ok.
Your computer will be rebooted automatically. A text file will open after the restart.
Please post the content of that logfile with your next reply.
You can find the logfile at C:\AdwCleaner[S1].txt as well.

===============================================================================

[external image: thisisujrt.gif] Please download Junkware Removal Tool to your desktop.

Shut down your protection software now to avoid potential conflicts.
Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
The tool will open and start scanning your system.
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next message.

Then go ahead and run a new scan with FRST, be sure Additions is checked and post both new logs please

Deleted Member

Post #6March 20, 2015, 12:51 AM UTC

Here are the logs:

ADW

# AdwCleaner v4.112 - Logfile created 19/03/2015 at 19:40:05

# Updated 09/03/2015 by Xplode

# Database : 2015-03-15.1 [Server]

# Operating system : Windows 7 Professional Service Pack 1 (x64)

# Username : Will - WILL-PC

# Running from : C:\Users\Will\Downloads\AdwCleaner.exe

# Option : Cleaning

***** [ Services ] *****

***** [ Files / Folders ] *****

Folder Deleted : C:\Program Files (x86)\GreenTree Applications

Folder Deleted : C:\Program Files (x86)\Elex-tech

Folder Deleted : C:\Users\Will\AppData\Local\Temp\iSafeRightKeyScan

Folder Deleted : C:\Users\Will\AppData\LocalLow\HPAppData

Folder Deleted : C:\Users\Will\AppData\Roaming\eCyber

Folder Deleted : C:\Users\Will\AppData\Roaming\Elex-tech

Folder Deleted : C:\Users\Will\AppData\Local\Google\Chrome\User Data\Default\Extensions\oalbpfagfhfkcmklpdanadjpbfdedndn

Folder Deleted : C:\Users\Will\AppData\Local\Google\Chrome\User Data\Default\Extensions\caoielngcdpgeldnckhponffkiajaobo

Folder Deleted : C:\Users\Will\AppData\Local\Google\Chrome\User Data\Default\Extensions\cbhfdchmklhpcngcgjmpdbjakdggkkjp

File Deleted : C:\Windows\System32\log\iSafeKrnlCall.log

File Deleted : C:\Users\Will\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\YAC.lnk

File Deleted : C:\Users\Will\AppData\Roaming\Mozilla\Firefox\Profiles\r875a98f.default\searchplugins\bingp.xml

File Deleted : C:\Users\Will\AppData\Roaming\Mozilla\Firefox\Profiles\r875a98f.default\searchplugins\Messenger Plus Smartbar Search.xml

File Deleted : C:\Users\Will\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.superfish.com_0.localstorage

File Deleted : C:\Users\Will\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.superfish.com_0.localstorage-journal

File Deleted : C:\Users\Will\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_www.superfish.com_0.localstorage

File Deleted : C:\Users\Will\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_www.superfish.com_0.localstorage-journal

File Deleted : C:\Users\Will\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.best-deals-products.com_0.localstorage

File Deleted : C:\Users\Will\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_www.best-deals-products.com_0.localstorage

***** [ Scheduled tasks ] *****

Task Deleted : HDvid Codec V6.0-codedownloader

***** [ Shortcuts ] *****

***** [ Registry ] *****

Key Deleted : HKCU\Software\Google\Chrome\Extensions\fcfenmboojpjinhpgggodefccipikbpd

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{7CCCA2B3-EE78-4266-9D60-A932C239082B}

Key Deleted : HKCU\Software\usyndication.com

Key Deleted : HKLM\SOFTWARE\Elex-tech

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3152E1F19977892449DC968802CE8964

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\649A52D257CA5DB4EAAE8BA9EB23E467

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\75D5168E5E176C24981B4E5DBD991078

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F754C503375A13344B22388E18DFE87E

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\B2FD9C0A5B9838449838816A28001F4B

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\EB6AF8AEEB922FA4392548F13812E50B

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\789034A89BAC50E4782F0A7BDBF75632

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\A97CEC23332751B47BA4B95BAA50C9D0

Data Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyOverride] - *.local;192.168.*.*

***** [ Web browsers ] *****

-\\ Internet Explorer v11.0.9600.17689

-\\ Mozilla Firefox v36.0.1 (x86 en-US)

[r875a98f.default\prefs.js] - Line Deleted : user_pref("browser.search.selectedEngine", "Messenger Plus Smartbar Search");

[r875a98f.default\prefs.js] - Line Deleted : user_pref("extensions.trusted-ads.ExLst", "{\"u\":{\"v\":\"1.77\",\"d\":\"042914\"},\"h\":{\"pogo.com\":{\"p\":[{\"e\":\"/.*/\",\"r\":[\"/connect\\\\.facebook\\\\.net\\\\/en_US\\\\/all\\\\.js$/i\"]}]}[…]

[r875a98f.default\prefs.js] - Line Deleted : user_pref("keyword.URL", "hxxp://feed.plusnetwork.com/?publisher=MessengerPlus&dpid=pb2&co=TJ&userid=d255f793-6257-4574-84ff-31fcf177a402&sp=faddr&t=c0127&uid=88f97096&q=");

-\\ Google Chrome v41.0.2272.89

[C:\Users\Will\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [Search Provider] : hxxp://en.softonic.com/s/{searchTerms}

[C:\Users\Will\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [Search Provider] : hxxp://search.aol.com/aol/search?q={searchTerms}

[C:\Users\Will\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [Search Provider] : hxxp://www.ask.com/web?q={searchTerms}

*************************

AdwCleaner[R1].txt - [5363 bytes] - [19/03/2015 19:09:14]

AdwCleaner[S0].txt - [5311 bytes] - [19/03/2015 19:40:05]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [5370 bytes] ##########

JTR

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 6.3.3 (10.21.2014:1)

OS: Windows 7 Professional x64

Ran by [removed] on Thu 03/19/2015 at 19:45:49.65

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Registry Values

~~~ Registry Keys

Successfully deleted: [Registry Key - Orphan] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\Disabled:{2018eb71-06b5-4438-abf4-e40d

Successfully deleted: [Registry Key - Orphan] HKEY_CLASSES_ROOT\CLSID\Disabled:{2018eb71-06b5-4438-abf4-e40d

Successfully deleted: [Registry Key - Orphan] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\Disabled:{3049C3E9-B461-4BC5-8870-4C09

Successfully deleted: [Registry Key - Orphan] HKEY_CLASSES_ROOT\CLSID\Disabled:{3049C3E9-B461-4BC5-8870-4C09

Successfully deleted: [Registry Key - Orphan] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\Disabled:{326E768D-4182-46FD-9C16-1449

Successfully deleted: [Registry Key - Orphan] HKEY_CLASSES_ROOT\CLSID\Disabled:{326E768D-4182-46FD-9C16-1449

Successfully deleted: [Registry Key - Orphan] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\Disabled:{B4F3A835-0E21-4959-BA22-42B3

Successfully deleted: [Registry Key - Orphan] HKEY_CLASSES_ROOT\CLSID\Disabled:{B4F3A835-0E21-4959-BA22-42B3

Successfully deleted: [Registry Key - Orphan] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\Disabled:{2018eb71-06b5-4438-abf4-e40d

Successfully deleted: [Registry Key - Orphan] HKEY_CLASSES_ROOT\CLSID\Disabled:{2018eb71-06b5-4438-abf4-e40d

Successfully deleted: [Registry Key - Orphan] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\Disabled:{3049C3E9-B461-4BC5-8870-4C09

Successfully deleted: [Registry Key - Orphan] HKEY_CLASSES_ROOT\CLSID\Disabled:{3049C3E9-B461-4BC5-8870-4C09

Successfully deleted: [Registry Key - Orphan] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\Disabled:{326E768D-4182-46FD-9C16-1449

Successfully deleted: [Registry Key - Orphan] HKEY_CLASSES_ROOT\CLSID\Disabled:{326E768D-4182-46FD-9C16-1449

Successfully deleted: [Registry Key - Orphan] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\Disabled:{B4F3A835-0E21-4959-BA22-42B3

Successfully deleted: [Registry Key - Orphan] HKEY_CLASSES_ROOT\CLSID\Disabled:{B4F3A835-0E21-4959-BA22-42B3

~~~ Files

~~~ Folders

Successfully deleted: [Folder] "C:\Windows\syswow64\ai_recyclebin"

~~~ FireFox

Successfully deleted: [Folder] C:\Users\Will\AppData\Roaming\mozilla\firefox\profiles\r875a98f.default\extensions\staged

Emptied folder: C:\Users\Will\AppData\Roaming\mozilla\firefox\profiles\r875a98f.default\minidumps [1 files]

~~~ Event Viewer Logs were cleared

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on Thu 03/19/2015 at 20:03:48.70

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

ken545

Post #7March 20, 2015, 11:25 AM UTC last edited March 20, 2015, 11:25 AM UTC

Morning Will

Running from C:\Users\[removed]\Downloads <– Your running FRST from your download folder, all of our tools run better right from the desktop in lew of being buried in some folder, open up your downloads folder and look for FRST64, right click on it and select CUT, come back to your desktop and right click on a blank space and select PASTE

Then open up FRST64, be sure to put a checkmark in Additions and run a new scan, when its done post both the FRST64 log and the Additions log, they will both be on your desktop

Deleted Member

Post #8March 21, 2015, 12:14 PM UTC

good morning'

I will remember to run all the tools from the desktop.

here are the logs

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-03-2015

Ran by [removed] (administrator) on WILL-PC on 20-03-2015 19:39:01

Running from C:\Users\[removed]\Desktop