Infected [Closed]

Hello guys,

2 days ago i downloaded a fake pulgin for teamspeak 3 today i downloaded norton 360 and it saying: an intrusison attempt by

skybarddownloadstar.net was blocked as far as i understand it blocks it every time it trys to get in my computer but i want to delete the danger i know its the fake pulgin beacuse number of reason i downloaded the pulgin from a ts3 server that its admins were from sweden and then after a couple of minutes i got an email that an attept to login my steam account was made from sweden and an attemp to sign in my email too every time i boot my computer there is a wierd process too i do not remember how its called but its basically a couple of letter and numbers mixed 

how can i spot the torjan file and delete it?

hope you can help me 

Hello ExTASY and welcome to the WTT forum.

My name is Satchfan and I would be glad to help you with your computer problem.

Please read the following guidelines which will help to make cleaning your machine easier:

• please follow all instructions in the order posted
• please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear
• all logs/reports, etc. must be posted in Notepad. Please ensure that word wrap is unchecked. In Notepad click Format, uncheck Word wrap if it is checked
• if you don't understand something, please don't hesitate to ask for clarification before proceeding
• the fixes are specific to your problem and should only be used for this issue on this machine.
• please reply within 3 days. If you do not reply within this period I will post a reminder but topics with no reply in 4 days will be closed!

IMPORTANT:

Please DO NOT install/uninstall any programs unless asked to.
Please DO NOT run any scans other than those requested

===================================================

Run RogueKiller

IMPORTANT: Please remove any usb or external drives from the computer before you run this scan!

Close all running programs.

Download RogueKiller to your desktop

• close all running programs
• for Windows Vista/Seven, right click -> run as administrator, for XP simply double-click on RogueKiller.exe
• when the pre-scan is finished, click on Scan
• click on Report and copy/paste the content in your next post
• NOTE: DO NOT attempt to remove anything that the scan detects –everything that is reported is not necessarily bad

If the program is blocked, continue to try it several times. If it still doesn’t work, (it could happen), rename it to winlogon.exe.

Please post the contents of the RKreport.txt in your next reply.

===================================================

Run Farbar Recovery Scan Tool

Please download Farbar Recovery Scan Tool and save it to your Desktop.

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

• right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
• press Scan button
• it will produce a log called Frst.txt in the same directory the tool is run from
• please copy and paste log back here.
• the first time the tool is run it generates another log (Addition.txt - also located in the same directory as FRST.exe/FRST64.exe). Please also paste that along with the Frst.txt into your reply.

Logs to include with next post:

RKreport.txt
Frst.txt
Addition.txt

Thanks

Satchfan

Hello ExTASY and welcome to the WTT forum.

My name is Satchfan and I would be glad to help you with your computer problem.

Please read the following guidelines which will help to make cleaning your machine easier:

• please follow all instructions in the order posted
• please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear
• all logs/reports, etc. must be posted in Notepad. Please ensure that word wrap is unchecked. In Notepad click Format, uncheck Word wrap if it is checked
• if you don't understand something, please don't hesitate to ask for clarification before proceeding
• the fixes are specific to your problem and should only be used for this issue on this machine.
• please reply within 3 days. If you do not reply within this period I will post a reminder but topics with no reply in 4 days will be closed!

IMPORTANT:

Please DO NOT install/uninstall any programs unless asked to.
Please DO NOT run any scans other than those requested

===================================================

Run RogueKiller

IMPORTANT: Please remove any usb or external drives from the computer before you run this scan!

Close all running programs.

Download RogueKiller to your desktop

• close all running programs
• for Windows Vista/Seven, right click -> run as administrator, for XP simply double-click on RogueKiller.exe
• when the pre-scan is finished, click on Scan
• click on Report and copy/paste the content in your next post
• NOTE: DO NOT attempt to remove anything that the scan detects –everything that is reported is not necessarily bad

If the program is blocked, continue to try it several times. If it still doesn’t work, (it could happen), rename it to winlogon.exe.

Please post the contents of the RKreport.txt in your next reply.

===================================================

Run Farbar Recovery Scan Tool

Please download Farbar Recovery Scan Tool and save it to your Desktop.

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

• right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
• press Scan button
• it will produce a log called Frst.txt in the same directory the tool is run from
• please copy and paste log back here.
• the first time the tool is run it generates another log (Addition.txt - also located in the same directory as FRST.exe/FRST64.exe). Please also paste that along with the Frst.txt into your reply.

Logs to include with next post:

RKreport.txt
Frst.txt
Addition.txt

Thanks

Satchfan

 

Wow thank you for the quick replay

RKreport.txt:

Mode : Scan – Date : 07/05/2015  17:43:20

Sorry for the late reply but I’ve been busy this evening.

I’d like you to run another scan.

Download and run AdwCleaner

Download AdwCleaner from here and save it to your desktop.

• run AdwCleaner
• when it has finished, select Clean
• if it asks to reboot, allow the reboot
• on reboot a log will be produced; please attach the content of the log to your next reply.

When you’ve done that, please run FRST again and send a new log with the AdwCleaner log.

Thanks

Satchfan

Sorry for the late reply but I’ve been busy this evening.

I’d like you to run another scan.

Download and run AdwCleaner

Download AdwCleaner from here and save it to your desktop.

• run AdwCleaner
• when it has finished, select Clean
• if it asks to reboot, allow the reboot
• on reboot a log will be produced; please attach the content of the log to your next reply.

When you’ve done that, please run FRST again and send a new log with the AdwCleaner log.

Thanks

Satchfan

AdwCleaner: 

# Option : Cleaning

 

***** [ Services ] *****

 

 

***** [ Files / Folders ] *****

 

Folder Deleted : C:\ProgramData\IePluginService

Folder Deleted : C:\ProgramData\WPM

Folder Deleted : C:\ProgramData\9632e060000014d5

Folder Deleted : C:\ProgramData\{861300b5-b777-7434-8613-300b5b7702d6}

Folder Deleted : C:\Program Files (x86)\VideoCnv

Folder Deleted : C:\Program Files (x86)\bestadblocker

Folder Deleted : C:\Program Files (x86)\PriceMinus

Folder Deleted : C:\Program Files (x86)\LightningDownloader

Folder Deleted : C:\Program Files (x86)\ProicaeMinuus

Folder Deleted : C:\Users\Oz Domer\AppData\Roaming\337Games

Folder Deleted : C:\Users\Oz Domer\AppData\Roaming\qone8

Folder Deleted : C:\Users\Oz Domer\AppData\Roaming\SupTab

Folder Deleted : C:\ProgramData\oenlakaaoabjjkibkgifjdgnobocfaag

File Deleted : C:\Users\Oz Domer\AppData\Local\Google\Chrome\User Data\Default\Extensions\newtabv3.crx

 

***** [ Scheduled tasks ] *****

 

 

***** [ Shortcuts ] *****

 

Shortcut Disinfected : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk

Shortcut Disinfected : C:\Users\Oz Domer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk

Shortcut Disinfected : C:\Users\Oz Domer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk

Shortcut Disinfected : C:\Users\Oz Domer\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk

Shortcut Disinfected : C:\Users\Oz Domer\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk

 

***** [ Registry ] *****

 

Key Deleted : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\IePluginService

Key Deleted : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Wpm

Key Deleted : HKLM\SOFTWARE\06a878d3-aa5d-a6c8-b9a9-89cdbc4197a2

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{A63C49A5-6CC1-4579-A883-AE6B3E91108D}

Key Deleted : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{BB82DE59-BC4C-4172-9AC4-73315F71CFFE}

Data Restored : HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command

Data Restored : HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\Google Chrome\shell\open\command

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{BB82DE59-BC4C-4172-9AC4-73315F71CFFE}

Key Deleted : HKCU\Software\Softonic

Key Deleted : HKCU\Software\tinydm.com

Key Deleted : HKCU\Software\AppDataLow\{4A0F38A9-FE55-4B89-B73F-E60FDC0F72E9}

Key Deleted : HKLM\SOFTWARE\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}

Key Deleted : HKLM\SOFTWARE\{4A0F38A9-FE55-4B89-B73F-E60FDC0F72E9}

Key Deleted : HKLM\SOFTWARE\delta-homesSoftware

Key Deleted : HKLM\SOFTWARE\IePlugin

Key Deleted : HKLM\SOFTWARE\qone8Software

Key Deleted : HKLM\SOFTWARE\Wpm

Key Deleted : HKLM\SOFTWARE\{12A61307-94CD-4F8E-94BC-918E511FAA81}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4820778D-AB0D-6D18-C316-52A6A0E1D507}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\qone8 uninstaller

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{AD11DADE-C597-45D9-D8C5-1D2EB0B89613}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{06B99631-BFA2-3B7A-F58B-D067C2BA59B7}

 

***** [ Web browsers ] *****

 

-\\ Internet Explorer v11.0.9600.17496

 

 

-\\ Google Chrome v35.0.1916.114

 

[C:\Users\Oz Domer\AppData\Local\Google\Chrome\User Data\Default\Preferences] - Deleted [Extension] : oenlakaaoabjjkibkgifjdgnobocfaag

[C:\Users\Oz Domer\AppData\Local\Google\Chrome\User Data\Default\Preferences] - Deleted [Homepage] : hxxp://search.conduit.com/?ctid=CT3220468&SearchSource;=48

[C:\Users\Oz Domer\AppData\Local\Google\Chrome\User Data\Default\Preferences] - Deleted [Startup_URLs] : hxxp://search.conduit.com/?ctid=CT3220468&SearchSource;=48

 

-\\ Chromium v

 

 

*************************

 

AdwCleaner[R0].txt - [5230 bytes] - [06/07/2015 00:19:38]

AdwCleaner[S0].txt - [4338 bytes] - [06/07/2015 00:20:58]

 

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [4397  bytes] ##########

FRST:

Platform: Windows 7 Ultimate Service Pack 1 (X64) OS Language: English (United States)

Internet Explorer Version 11 (Default browser: Chrome)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

 

==================== Processes (Whitelisted) =================

 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

 

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe

(Giraffic) C:\Program Files (x86)\Giraffic\GirafficWatchdog.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe

(Giraffic) C:\Program Files (x86)\Giraffic\Giraffic.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

() C:\Windows\SysWOW64\PnkBstrA.exe

(Razer Inc.) C:\Program Files (x86)\Razer\Razer Game Booster\RzKLService.exe

(NETGEAR) C:\Program Files (x86)\NETGEAR\WN111v2\WN111v2.exe

(SteelSeries ApS) C:\Program Files\SteelSeries\SteelSeries Engine 3\SteelSeriesEngine3.exe

(Company) C:\Program Files (x86)\Popcorn Time\Updater.exe

(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

(Symantec Corporation) C:\Program Files (x86)\Norton 360\Engine\20.6.0.27\ccsvchst.exe

(Symantec Corporation) C:\Program Files (x86)\Norton 360\Engine\20.6.0.27\ccsvchst.exe

 

 

==================== Registry (Whitelisted) ==================

 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

 

HKLM\…\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2531472 2014-12-13] (NVIDIA Corporation)

HKLM\…\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart

HKLM\…\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13530184 2013-04-22] (Realtek Semiconductor)

HKLM-x32\…\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [334896 2015-04-30] (Oracle Corporation)

HKU\S-1-5-21-3789109175-3304859141-1081259157-1000\…\Run: [Steam] => D:\Steam\steam.exe [2895552 2015-07-04] (Valve Corporation)

HKU\S-1-5-21-3789109175-3304859141-1081259157-1000\…\Run: [BitTorrent] => C:\Users\Oz Domer\AppData\Roaming\BitTorrent\BitTorrent.exe [1696104 2015-05-13] (BitTorrent Inc.)

HKU\S-1-5-21-3789109175-3304859141-1081259157-1000\…\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3696912 2014-03-04] (Disc Soft Ltd)

HKU\S-1-5-21-3789109175-3304859141-1081259157-1000\…\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [53288576 2015-06-29] (Skype Technologies S.A.)

HKU\S-1-5-21-3789109175-3304859141-1081259157-1000\…\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7063832 2014-11-21] (Piriform Ltd)

HKU\S-1-5-21-3789109175-3304859141-1081259157-1000\…\MountPoints2: {3b0f57cd-1faa-11e4-8b42-50e5492d8837} - H:\HTC_Sync_Manager_PC.exe

HKU\S-1-5-18\…\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [301568 2014-03-20] (Microsoft Corporation)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\NETGEAR WN111v2 Smart Wizard.lnk [2014-03-14]

ShortcutTarget: NETGEAR WN111v2 Smart Wizard.lnk -> C:\Program Files (x86)\NETGEAR\WN111v2\WN111v2.exe (NETGEAR)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\SteelSeries Engine 3.lnk [2014-06-21]

ShortcutTarget: SteelSeries Engine 3.lnk -> C:\Program Files\SteelSeries\SteelSeries Engine 3\SteelSeriesEngine3.exe (SteelSeries ApS)

Startup: C:\Users\Oz Domer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\j6bIXtKRz.lnk [2015-07-03]

ShortcutTarget: j6bIXtKRz.lnk -> C:\Users\Oz Domer\AppData\Roaming\uSILlzCwXBSr\aQ1Vb72t.exe (No File)

ShellIconOverlayIdentifiers: [OverlayExcluded] -> {4433A54A-1AC8-432F-90FC-85F045CF383C} => C:\Program Files (x86)\Norton 360\Engine64\20.6.0.27\buShell.dll [2013-05-29] (Symantec Corporation)

ShellIconOverlayIdentifiers: [OverlayPending] -> {F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225} => C:\Program Files (x86)\Norton 360\Engine64\20.6.0.27\buShell.dll [2013-05-29] (Symantec Corporation)

ShellIconOverlayIdentifiers: [OverlayProtected] -> {476D0EA3-80F9-48B5-B70B-05E677C9C148} => C:\Program Files (x86)\Norton 360\Engine64\20.6.0.27\buShell.dll [2013-05-29] (Symantec Corporation)

CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

 

==================== Internet (Whitelisted) ====================

 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

 

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.symantec.com/redirects/security_response/fix_homepage/index.jsp?lg=en&pid;=N360&pvid;=20.4.0.40

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://www.symantec.com/redirects/security_response/fix_homepage/index.jsp?lg=en&pid;=N360&pvid;=20.4.0.40

HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar;=iesearch

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar;=iesearch

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver;=5.5&ar;=msnhome

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver;=5.5&ar;=msnhome

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar;=iesearch

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar;=iesearch

HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver;=5.5&ar;=msnhome

HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar;=iesearch

HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.symantec.com/redirects/security_response/fix_homepage/index.jsp?lg=en&pid;=N360&pvid;=20.4.0.40

HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar;=iesearch

HKU\S-1-5-19\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver;=5.5&ar;=msnhome

HKU\S-1-5-19\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar;=iesearch

HKU\S-1-5-19\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.symantec.com/redirects/security_response/fix_homepage/index.jsp?lg=en&pid;=N360&pvid;=20.4.0.40

HKU\S-1-5-19\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar;=iesearch

HKU\S-1-5-20\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver;=5.5&ar;=msnhome

HKU\S-1-5-20\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar;=iesearch

HKU\S-1-5-20\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.symantec.com/redirects/security_response/fix_homepage/index.jsp?lg=en&pid;=N360&pvid;=20.4.0.40

HKU\S-1-5-20\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar;=iesearch

HKU\S-1-5-21-3789109175-3304859141-1081259157-1000\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar;=iesearch

HKU\S-1-5-21-3789109175-3304859141-1081259157-1000\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.symantec.com/redirects/security_response/fix_homepage/index.jsp?lg=en&pid;=N360&pvid;=20.4.0.40

HKU\S-1-5-21-3789109175-3304859141-1081259157-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://il.msn.com/?rd=1&ucc;=IL&dcc;=IL&opt;=0&ocid;=iehp

HKU\S-1-5-21-3789109175-3304859141-1081259157-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver;=5.5&ar;=msnhome

HKU\S-1-5-21-3789109175-3304859141-1081259157-1000\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar;=iesearch

SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

BHO: Virtual Keyboard Plugin -> {4A66AD60-A03D-4D01-86F0-5F0F7C0EF1AD} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Total Security 15.0.2\x64\IEExt\ie_plugin.dll [2014-12-23] (Kaspersky Lab ZAO)

BHO: Content Blocker Plugin -> {93BC2EA7-2F17-4729-948A-D2E03FFB2412} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Total Security 15.0.2\x64\IEExt\ie_plugin.dll [2014-12-23] (Kaspersky Lab ZAO)

BHO: Safe Money Plugin -> {AB379017-4C03-4E00-8EDF-E6D6AF7CCF82} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Total Security 15.0.2\x64\IEExt\ie_plugin.dll [2014-12-23] (Kaspersky Lab ZAO)

BHO-x32: Virtual Keyboard Plugin -> {4A66AD60-A03D-4D01-86F0-5F0F7C0EF1AD} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Total Security 15.0.2\IEExt\ie_plugin.dll [2014-12-23] (Kaspersky Lab ZAO)

BHO-x32: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton 360\Engine\20.6.0.27\coIEPlg.dll [2014-11-28] (Symantec Corporation)

BHO-x32: Norton Vulnerability Protection -> {6D53EC84-6AAE-4787-AEEE-F4628F01010C} -> C:\Program Files (x86)\Norton 360\Engine\20.6.0.27\IPS\IPSBHO.DLL [2013-04-09] (Symantec Corporation)

BHO-x32: Content Blocker Plugin -> {93BC2EA7-2F17-4729-948A-D2E03FFB2412} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Total Security 15.0.2\IEExt\ie_plugin.dll [2014-12-23] (Kaspersky Lab ZAO)

BHO-x32: Safe Money Plugin -> {AB379017-4C03-4E00-8EDF-E6D6AF7CCF82} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Total Security 15.0.2\IEExt\ie_plugin.dll [2014-12-23] (Kaspersky Lab ZAO)

Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton 360\Engine\20.6.0.27\coIEPlg.dll [2014-11-28] (Symantec Corporation)

DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL [2012-10-01] (Microsoft Corporation)

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)

Tcpip\Parameters: [DhcpNameServer] 10.0.0.138

Tcpip\..\Interfaces\{23E8E0EE-E76F-40D6-B1AC-9EB21DAEFB40}: [DhcpNameServer] 10.0.0.138

Tcpip\..\Interfaces\{44C27C33-100A-449B-AAF3-CBF7651D6389}: [DhcpNameServer] 10.0.0.138

Tcpip\..\Interfaces\{E7E187C8-2D1F-4395-801D-63AE0A339969}: [DhcpNameServer] 192.168.42.129

 

FireFox:

========

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_17_0_0_190.dll [2015-07-01] ()

FF Plugin: @esn/npbattlelog,version=2.5.1 -> C:\Program Files (x86)\Battlelog Web Plugins\2.5.1\npbattlelogx64.dll [2014-09-01] (EA Digital Illusions CE AB)

FF Plugin: @microsoft.com/GENUINE -> disabled No File

FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~2\Office15\NPSPWRAP.DLL [2012-10-01] (Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_190.dll [2015-07-01] ()

FF Plugin-x32: @esn/npbattlelog,version=2.5.1 -> C:\Program Files (x86)\Battlelog Web Plugins\2.5.1\npbattlelog.dll [2014-09-01] (EA Digital Illusions CE AB)

FF Plugin-x32: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-05-16] (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-05-16] (Oracle Corporation)

FF Plugin-x32: @kaspersky.com/content_blocker_663BE84DBCC949E88C7600F63CA7F098 -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Total Security 15.0.2\FFExt\[removed] [2015-07-05] ()

FF Plugin-x32: @kaspersky.com/online_banking_08806E753BE44495B44E90AA2513BDC5 -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Total Security 15.0.2\FFExt\[removed] [2015-07-05] ()

FF Plugin-x32: @kaspersky.com/virtual_keyboard_07402848C2F6470194F131B0F3DE025E -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Total Security 15.0.2\FFExt\[removed] [2015-07-05] ()

FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File

FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2012-10-01] (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL [2012-10-01] (Microsoft Corporation)

FF Plugin-x32: @nexon.net/NxGame -> C:\ProgramData\NexonUS\NGM\npNxGameUS.dll No File

FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2014-10-16] (NVIDIA Corporation)

FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2014-10-16] (NVIDIA Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll [2014-05-19] (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll [2014-05-19] (Google Inc.)

FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2014-02-05] (VideoLAN)

FF Plugin HKU\S-1-5-21-3789109175-3304859141-1081259157-1000: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Oz Domer\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2014-05-26] (Unity Technologies ApS)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll [2012-10-01] (Microsoft Corporation)

FF HKLM-x32\…\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.4.0.40\coFFPlgn

FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.4.0.40\coFFPlgn [2015-07-06]

FF HKLM-x32\…\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.4.0.40\IPSFFPlgn

FF Extension: Norton Vulnerability Protection - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.4.0.40\IPSFFPlgn [2015-07-05]

FF HKLM-x32\…\Firefox\Extensions: [[removed]] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Total Security 15.0.2\FFExt\[removed]

FF Extension: Dangerous Websites Blocker - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Total Security 15.0.2\FFExt\[removed] [2015-07-05]

FF HKLM-x32\…\Firefox\Extensions: [[removed]] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Total Security 15.0.2\FFExt\[removed]

FF Extension: Virtual Keyboard - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Total Security 15.0.2\FFExt\[removed] [2015-07-05]

FF HKLM-x32\…\Firefox\Extensions: [[removed]] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Total Security 15.0.2\FFExt\[removed]

FF Extension: Safe Money - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Total Security 15.0.2\FFExt\[removed] [2015-07-05]

 

Chrome: 

=======

CHR dev: Chrome dev build detected! <======= ATTENTION

CHR Profile: C:\Users\Oz Domer\AppData\Local\Google\Chrome\User Data\Default

CHR Extension: (Google Docs) - C:\Users\Oz Domer\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-03-14]

CHR Extension: (Google Drive) - C:\Users\Oz Domer\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-03-14]

CHR Extension: (Norton Identity Protection) - C:\Users\Oz Domer\AppData\Local\Google\Chrome\User Data\Default\Extensions\bejnhdlplbjhffionohbdnpcbobfejcc [2015-07-05]

CHR Extension: (CS Portable) - C:\Users\Oz Domer\AppData\Local\Google\Chrome\User Data\Default\Extensions\bijcilgmpgmllbihfhofoobmbjbbkenl [2014-03-14]

CHR Extension: (YouTube) - C:\Users\Oz Domer\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-03-14]

CHR Extension: (Battlefield Heroes) - C:\Users\Oz Domer\AppData\Local\Google\Chrome\User Data\Default\Extensions\cehdakiococlfmjcbebbkjkfjhbieknh [2015-01-26]

CHR Extension: (Easy SteamGifts) - C:\Users\Oz Domer\AppData\Local\Google\Chrome\User Data\Default\Extensions\cklbilaeedbblhpkhjfcnmaocjdodcnm [2014-03-14]

CHR Extension: (Google Search) - C:\Users\Oz Domer\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-03-14]

CHR Extension: (Kaspersky Protection) - C:\Users\Oz Domer\AppData\Local\Google\Chrome\User Data\Default\Extensions\dbhjdbfgekjfcfkkfjjmlmojhbllhbho [2015-07-05]

CHR Extension: (PartyCloud DJ) - C:\Users\Oz Domer\AppData\Local\Google\Chrome\User Data\Default\Extensions\defekohaofmambflfpfoojkmfdpcbgko [2014-03-14]

CHR Extension: (Tampermonkey) - C:\Users\Oz Domer\AppData\Local\Google\Chrome\User Data\Default\Extensions\dhdgffkkebhmkfjojejmpbldmpobfkfo [2014-03-14]

CHR Extension: (Rush Team) - C:\Users\Oz Domer\AppData\Local\Google\Chrome\User Data\Default\Extensions\ecdnoeebfjlplfkljdedokbcmebojbpb [2014-03-27]

CHR Extension: (LoungeDestroyer) - C:\Users\Oz Domer\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghahcnmfjfckcedfajbhekgknjdplfcl [2015-01-27]

CHR Extension: (Norton Identity Safe) - C:\Users\Oz Domer\AppData\Local\Google\Chrome\User Data\Default\Extensions\iikflkcanblccfahdhdonehdalibjnif [2015-07-06]

CHR Extension: (CS:GO Lounge Bump Bot) - C:\Users\Oz Domer\AppData\Local\Google\Chrome\User Data\Default\Extensions\jhfkidfnhjcjjamcbdepeohblphlamgk [2014-12-16]

CHR Extension: (No Name) - C:\Users\Oz Domer\AppData\Local\Google\Chrome\User Data\Default\Extensions\loamdenijebhollnjgehcfbnpeelfhlk [2015-06-29]

CHR Extension: (Google Wallet) - C:\Users\Oz Domer\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-03-14]

CHR Extension: (Simple Adblock) - C:\Users\Oz Domer\AppData\Local\Google\Chrome\User Data\Default\Extensions\ockogkkjjhgjelcddamlnjcfnmiegjfg [2014-09-09]

CHR Extension: (My Chrome Theme) - C:\Users\Oz Domer\AppData\Local\Google\Chrome\User Data\Default\Extensions\oehpjpccmlcalbenfhnacjeocbjdonic [2014-03-14]

CHR Extension: (Enhanced Steam) - C:\Users\Oz Domer\AppData\Local\Google\Chrome\User Data\Default\Extensions\okadibdjfemgnhjiembecghcbfknbfhg [2015-01-28]

CHR Extension: (Bitdefender QuickScan) - C:\Users\Oz Domer\AppData\Local\Google\Chrome\User Data\Default\Extensions\pdnkcidphdcakpkheohlhocaicfamjie [2014-11-21]

CHR Extension: (Gmail) - C:\Users\Oz Domer\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-03-14]

CHR HKLM\…\Chrome\Extension: [bejnhdlplbjhffionohbdnpcbobfejcc] - C:\Program Files (x86)\Norton 360\Engine\20.6.0.27\Exts\Chrome.crx [2015-07-05]

CHR HKLM\…\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho

CHR HKLM\…\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - https://clients2.google.com/service/update2/crx

CHR HKLM-x32\…\Chrome\Extension: [bejnhdlplbjhffionohbdnpcbobfejcc] - C:\Program Files (x86)\Norton 360\Engine\20.6.0.27\Exts\Chrome.crx [2015-07-05]

CHR HKLM-x32\…\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho

CHR HKLM-x32\…\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - https://clients2.google.com/service/update2/crx

 

==================== Services (Whitelisted) =================

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

S2 AVP15.0.2; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Total Security 15.0.2\avp.exe [193400 2014-12-23] (Kaspersky Lab ZAO)

R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1148560 2014-12-13] (NVIDIA Corporation)

R2 Giraffic; C:\Program Files (x86)\Giraffic\GirafficWatchdog.exe [2245232 2013-05-13] (Giraffic)

S3 jswpsapi; C:\Program Files (x86)\NETGEAR\WN111v2\jswpsapi.exe [942080 2008-02-29] (Atheros Communications, Inc.) [File not signed]

R2 N360; C:\Program Files (x86)\Norton 360\Engine\20.6.0.27\ccSvcHst.exe [144368 2013-05-21] (Symantec Corporation)

R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1701520 2014-12-13] (NVIDIA Corporation)

R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [19823248 2014-12-13] (NVIDIA Corporation)

R2 PnkBstrA; C:\Windows\system32\PnkBstrA.exe [76152 2014-12-08] ()

R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2015-02-02] ()

R2 RzKLService; C:\Program Files (x86)\Razer\Razer Game Booster\RzKLService.exe [105448 2014-02-25] (Razer Inc.)

R2 Update service; C:\Program Files (x86)\Popcorn Time\Updater.exe [335360 2014-12-17] (Company) [File not signed]

R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

 

==================== Drivers (Whitelisted) ====================

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

R1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.4.0.40\Definitions\BASHDefs\20150625.001\BHDrvx64.sys [1648880 2015-06-25] (Symantec Corporation)

S3 busenum; C:\Windows\System32\DRIVERS\SteelBus64.sys [145408 2014-01-08] (SteelSeries Corporation) [File not signed]

R1 ccSet_N360; C:\Windows\system32\drivers\N360x64\1406000.01B\ccSetx64.sys [169048 2013-04-16] (Symantec Corporation)

R0 cm_km_w; C:\Windows\System32\DRIVERS\cm_km_w.sys [238288 2013-01-14] (Kaspersky Lab UK Ltd)

R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2014-04-02] (Disc Soft Ltd)

R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [498512 2015-07-04] (Symantec Corporation)

R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [153936 2015-07-04] (Symantec Corporation)

R1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.4.0.40\Definitions\IPSDefs\20150703.001\IDSvia64.sys [692984 2015-07-03] (Symantec Corporation)

R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [468576 2014-03-31] (Kaspersky Lab ZAO)

R2 kldisk; C:\Windows\System32\DRIVERS\kldisk.sys [47112 2014-08-19] (Kaspersky Lab ZAO)

R3 klflt; C:\Windows\System32\DRIVERS\klflt.sys [151240 2014-11-28] (Kaspersky Lab ZAO)

R1 klhk; C:\Windows\System32\DRIVERS\klhk.sys [245960 2014-10-22] (Kaspersky Lab ZAO)

R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [843448 2014-12-13] (Kaspersky Lab ZAO)

R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [30920 2014-10-10] (Kaspersky Lab ZAO)

R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [30920 2014-10-30] (Kaspersky Lab ZAO)

R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29280 2013-08-08] (Kaspersky Lab ZAO)

R1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO)

R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [57032 2014-10-09] (Kaspersky Lab ZAO)

R1 Klwtp; C:\Windows\System32\DRIVERS\klwtp.sys [77000 2014-11-22] (Kaspersky Lab ZAO)

R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [181960 2014-11-10] (Kaspersky Lab ZAO)

R3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.4.0.40\Definitions\VirusDefs\20150704.003\ENG64.SYS [138488 2015-07-04] (Symantec Corporation)

R3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.4.0.40\Definitions\VirusDefs\20150704.003\EX64.SYS [2146040 2015-07-04] (Symantec Corporation)

S3 netr28ux; C:\Windows\System32\DRIVERS\Dnetr28ux.sys [1660480 2011-09-09] (Ralink Technology Corp.)

R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19600 2014-12-13] (NVIDIA Corporation)

R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [38032 2014-11-22] (NVIDIA Corporation)

S3 PCAMp50a64; C:\Windows\System32\Drivers\PCAMp50a64.sys [43328 2006-11-28] (Printing Communications Assoc., Inc. (PCAUSA))

S3 PCASp50a64; C:\Windows\System32\Drivers\PCASp50a64.sys [41280 2006-11-28] (Printing Communications Assoc., Inc. (PCAUSA))

S3 SAlphamHid; C:\Windows\System32\DRIVERS\SAlpham64.sys [38016 2013-05-31] (SteelSeries Corporation) [File not signed]

R3 SRTSP; C:\Windows\System32\Drivers\N360x64\1406000.01B\SRTSP64.SYS [796760 2013-05-16] (Symantec Corporation)

R1 SRTSPX; C:\Windows\system32\drivers\N360x64\1406000.01B\SRTSPX64.SYS [36952 2013-03-05] (Symantec Corporation)

R3 ssdevfactory; C:\Windows\System32\DRIVERS\ssdevfactory.sys [32792 2015-06-02] (SteelSeries ApS)

R3 sshid; C:\Windows\System32\DRIVERS\sshid.sys [43616 2015-06-02] (SteelSeries ApS)

R0 SymDS; C:\Windows\System32\drivers\N360x64\1406000.01B\SYMDS64.SYS [493656 2013-05-21] (Symantec Corporation)

R0 SymEFA; C:\Windows\System32\drivers\N360x64\1406000.01B\SYMEFA64.SYS [1139800 2013-05-23] (Symantec Corporation)

R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [177312 2015-07-05] (Symantec Corporation)

R1 SymIRON; C:\Windows\system32\drivers\N360x64\1406000.01B\Ironx64.SYS [224416 2013-03-05] (Symantec Corporation)

R1 SymNetS; C:\Windows\System32\Drivers\N360x64\1406000.01B\SYMNETS.SYS [433752 2013-04-25] (Symantec Corporation)

U3 TrueSight; C:\Windows\System32\drivers\TrueSight.sys [35064 2015-07-05] ()

S3 usbrndis6; C:\Windows\System32\DRIVERS\usb80236.sys [19968 2013-02-12] (Microsoft Corporation)

S3 WN111v2; C:\Windows\System32\DRIVERS\WN111v2w7x.sys [783360 2010-04-27] (Atheros Communications, Inc.)

S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]

U4 klkbdflt2; system32\DRIVERS\klkbdflt2.sys [X]

S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]

S3 tsusbhub; system32\drivers\tsusbhub.sys [X]

S3 VGPU; System32\drivers\rdvgkmd.sys [X]

U4 vsserv; No ImagePath

S3 X6va029; \??\C:\Windows\SysWOW64\Drivers\X6va029 [X]

 

==================== NetSvcs (Whitelisted) ===================

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

 

==================== One Month Created files and folders ========

 

(If an entry is included in the fixlist, the file/folder will be moved.)

 

2015-07-06 00:27 - 2015-07-06 00:28 - 00028456 _____ C:\Users\Oz Domer\Desktop\FRST.txt

2015-07-06 00:25 - 2015-07-06 00:25 - 00004481 _____ C:\Users\Oz Domer\Desktop\AdwCleaner[S0].txt

2015-07-06 00:19 - 2015-07-06 00:21 - 00000000 ____D C:\AdwCleaner

2015-07-06 00:19 - 2015-07-06 00:19 - 02244096 _____ C:\Users\Oz Domer\Desktop\adwcleaner_4.207.exe

2015-07-05 17:45 - 2015-07-06 00:27 - 00000000 ____D C:\FRST

2015-07-05 17:39 - 2015-07-05 17:45 - 00000000 ____D C:\ProgramData\RogueKiller

2015-07-05 17:39 - 2015-07-05 17:39 - 00035064 _____ C:\Windows\system32\Drivers\TrueSight.sys

2015-07-05 17:38 - 2015-07-05 17:38 - 02112512 _____ (Farbar) C:\Users\Oz Domer\Desktop\FRST64.exe

2015-07-05 17:37 - 2015-07-05 17:45 - 00005841 _____ C:\Users\Oz Domer\Desktop\Rough Killer.txt

2015-07-05 17:36 - 2015-07-05 17:38 - 17853688 _____ C:\Users\Oz Domer\Desktop\RogueKiller.exe

2015-07-05 13:07 - 2015-07-05 13:07 - 00002307 _____ C:\Users\Oz Domer\Desktop\Safe Money.lnk

2015-07-05 13:03 - 2015-07-05 13:03 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kaspersky Total Security

2015-07-05 13:03 - 2015-07-05 13:02 - 00002053 _____ C:\Users\Public\Desktop\Kaspersky Total Security.lnk

2015-07-05 13:02 - 2015-07-06 00:24 - 00000000 ____D C:\ProgramData\Kaspersky Lab

2015-07-05 13:02 - 2015-07-05 13:02 - 00000000 ____D C:\Windows\ELAMBKUP

2015-07-05 13:02 - 2015-07-05 13:02 - 00000000 ____D C:\Program Files (x86)\Kaspersky Lab

2015-07-05 13:02 - 2013-05-06 08:13 - 00110176 _____ (Kaspersky Lab ZAO) C:\Windows\system32\klfphc.dll

2015-07-05 13:01 - 2014-12-13 18:21 - 00843448 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klif.sys

2015-07-05 13:01 - 2014-11-28 18:19 - 00151240 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klflt.sys

2015-07-05 13:01 - 2014-10-22 21:13 - 00245960 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klhk.sys

2015-07-05 12:57 - 2015-07-05 12:59 - 196444992 _____ (Kaspersky Lab) C:\Users\Oz Domer\Downloads\kts15.0.2.361en_7342.exe

2015-07-05 10:21 - 2015-07-06 00:24 - 00002319 _____ C:\Users\Public\Desktop\Norton 360.lnk

2015-07-05 10:14 - 2015-07-06 00:24 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton 360 Premier Edition

2015-07-05 09:56 - 2015-07-06 00:26 - 00000000 ____D C:\Windows\system32\Drivers\N360x64

2015-07-05 09:56 - 2015-07-06 00:24 - 00003206 _____ C:\Windows\System32\Tasks\Norton WSC Integration

2015-07-05 09:56 - 2015-07-05 10:15 - 00177312 _____ (Symantec Corporation) C:\Windows\system32\Drivers\SYMEVENT64x86.SYS

2015-07-05 09:56 - 2015-07-05 10:15 - 00007631 _____ C:\Windows\system32\Drivers\SYMEVENT64x86.CAT

2015-07-05 09:56 - 2015-07-05 09:56 - 00000000 ____D C:\Program Files\Symantec

2015-07-05 09:56 - 2015-07-05 09:56 - 00000000 ____D C:\Program Files\Common Files\Symantec Shared

2015-07-05 09:56 - 2015-07-05 09:56 - 00000000 ____D C:\Program Files (x86)\Norton 360

2015-07-04 13:37 - 2015-07-04 13:37 - 00000000 ____D C:\Users\Oz Domer\AppData\Local\CEF

2015-07-03 17:42 - 2015-07-03 17:42 - 00001219 _____ C:\Users\Oz Domer\Desktop\TeamSpeak 3 Client.lnk

2015-07-03 17:42 - 2015-07-03 17:42 - 00000000 ____D C:\Users\Oz Domer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client

2015-07-03 17:37 - 2015-07-03 17:37 - 00000010 _____ C:\Users\Oz Domer\AppData\Local\sponge.last.runtime.cache

2015-07-03 17:35 - 2015-07-03 17:35 - 00376926 _____ C:\Users\Oz Domer\AppData\Local\census.cache

2015-07-03 17:35 - 2015-07-03 17:35 - 00164929 _____ C:\Users\Oz Domer\AppData\Local\ars.cache

2015-07-03 17:23 - 2015-07-03 17:23 - 02494944 _____ (Trend Micro Inc.) C:\Users\Oz Domer\Downloads\HousecallLauncher64.exe

2015-07-03 17:23 - 2015-07-03 17:23 - 00000036 _____ C:\Users\Oz Domer\AppData\Local\housecall.guid.cache

2015-07-03 17:23 - 2013-09-28 05:56 - 00285208 _____ (Trend Micro Inc.) C:\Windows\system32\Drivers\tmcomm.sys

2015-07-03 17:01 - 2015-07-05 10:25 - 00000000 ____D C:\Users\Oz Domer\AppData\Roaming\uSILlzCwXBSr

2015-07-03 17:01 - 2015-07-05 10:19 - 00000000 ____D C:\Users\Oz Domer\AppData\Roaming\8D21C8D9-D6D8-48DB-84D2-5F71DFD60C2C

2015-07-03 16:57 - 2015-07-03 17:45 - 00000000 ____D C:\Users\Oz Domer\AppData\Roaming\TS3Client

2015-07-03 16:57 - 2015-07-03 16:57 - 00000000 ____D C:\Users\Oz Domer\AppData\Local\TeamSpeak 3 Client

2015-07-03 16:56 - 2015-07-03 16:56 - 30014480 _____ (TeamSpeak Systems GmbH) C:\Users\Oz Domer\Downloads\TeamSpeak3-Client-win64-3.0.16.exe

2015-07-03 12:34 - 2015-05-16 14:05 - 00271968 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe

2015-07-03 01:38 - 2015-07-03 01:38 - 00000000 ____D C:\ProgramData\Riot Games

2015-07-03 01:36 - 2015-07-03 01:36 - 00000000 ____D C:\Riot Games

2015-07-03 01:34 - 2015-07-03 01:37 - 00000000 ____D C:\Users\Oz Domer\AppData\Roaming\Riot Games

2015-07-03 01:34 - 2015-07-03 01:34 - 30993712 _____ (Riot Games) C:\Users\Oz Domer\Downloads\LeagueofLegends_EUNE_Installer_9_15_2014.exe

2015-06-28 11:22 - 2015-06-28 11:22 - 00000000 ____D C:\Users\Oz Domer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome

2015-06-19 23:38 - 2015-06-19 23:38 - 00000000 ____D C:\GOG Games

2015-06-19 21:25 - 2015-06-19 21:25 - 00000000 ____D C:\Users\Oz Domer\Documents\Klei

2015-06-17 20:20 - 2015-06-17 20:20 - 00000000 ____D C:\Users\Oz Domer\Documents\SavedGames

2015-06-17 16:42 - 2015-06-17 16:43 - 00000000 ____D C:\Users\Oz Domer\AppData\Local\PAYDAY 2

2015-06-17 16:42 - 2015-06-17 16:42 - 00000000 ____D C:\Program Files (x86)\AGEIA Technologies

2015-06-14 10:18 - 2015-07-03 14:41 - 00037174 _____ C:\Windows\DirectX.log

2015-06-08 17:53 - 2015-06-08 17:53 - 00005024 _____ C:\Windows\DPINST.LOG

2015-06-08 17:50 - 2015-06-08 17:51 - 76379784 _____ C:\Users\Oz Domer\Downloads\SteelSeriesEngine3.3.7.1Setup.exe

 

==================== One Month Modified files and folders ========

 

(If an entry is included in the fixlist, the file/folder will be moved.)

 

2015-07-06 00:26 - 2014-04-06 19:42 - 00000000 ____D C:\Program Files (x86)\Giraffic

2015-07-06 00:25 - 2014-03-17 15:49 - 00000000 ____D C:\Users\Oz Domer\AppData\Roaming\Skype

2015-07-06 00:25 - 2014-03-14 20:13 - 00000000 ____D C:\Users\Oz Domer\AppData\Roaming\BitTorrent

2015-07-06 00:24 - 2015-06-03 07:21 - 00008718 _____ C:\Windows\setupact.log

2015-07-06 00:24 - 2015-05-30 12:24 - 00000348 _____ C:\Windows\Tasks\Bidaily Synchronize Task[973b].job

2015-07-06 00:24 - 2014-03-14 16:14 - 00000898 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2015-07-06 00:23 - 2015-06-03 07:21 - 00011710 _____ C:\Windows\PFRO.log

2015-07-06 00:23 - 2014-03-14 16:21 - 00000000 ____D C:\ProgramData\NVIDIA

2015-07-06 00:23 - 2009-07-14 08:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2015-07-06 00:21 - 2014-03-14 16:15 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome

2015-07-06 00:21 - 2014-03-14 14:59 - 00000995 _____ C:\Users\Oz Domer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk

2015-07-05 23:56 - 2014-03-14 16:14 - 00000902 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2015-07-05 23:44 - 2014-07-17 20:05 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job

2015-07-05 14:53 - 2014-04-16 12:34 - 00690672 _____ C:\Windows\system32\perfh00C.dat

2015-07-05 14:53 - 2014-04-16 12:34 - 00479062 _____ C:\Windows\system32\perfh001.dat

2015-07-05 14:53 - 2014-04-16 12:34 - 00130340 _____ C:\Windows\system32\perfc00C.dat

2015-07-05 14:53 - 2014-04-16 12:34 - 00094880 _____ C:\Windows\system32\perfc001.dat

2015-07-05 14:53 - 2014-03-14 19:53 - 00392392 _____ C:\Windows\system32\perfh00D.dat

2015-07-05 14:53 - 2014-03-14 19:53 - 00084866 _____ C:\Windows\system32\perfc00D.dat

2015-07-05 14:53 - 2009-07-14 08:13 - 02624136 _____ C:\Windows\system32\PerfStringBackup.INI

2015-07-05 14:52 - 2014-04-06 19:42 - 00000000 ____D C:\ProgramData\Giraffic

2015-07-05 13:03 - 2014-06-18 15:12 - 00000000 ____D C:\Users\admin

2015-07-05 13:03 - 2009-07-14 08:08 - 00000000 ____D C:\Users\Administrator

2015-07-05 12:47 - 2015-05-30 12:25 - 00000000 ____D C:\Program Files (x86)\ThunderQQDownload FlashGet Files Downloader Pro

2015-07-05 11:14 - 2015-03-31 14:14 - 00006532 _____ C:\Users\Oz Domer\Downloads\Oppai Trainer 2015 0.4.7a.zip

2015-07-05 09:56 - 2014-03-14 20:30 - 00000000 ____D C:\ProgramData\Norton

2015-07-05 09:38 - 2014-09-19 11:21 - 00000000 ___RD C:\Program Files (x86)\Skype

2015-07-05 09:38 - 2014-03-17 15:48 - 00000000 ____D C:\ProgramData\Skype

2015-07-04 13:33 - 2015-05-30 13:08 - 00000000 ____D C:\ProgramData\ProductData

2015-07-03 12:38 - 2015-04-22 14:44 - 00000000 ____D C:\Program Files (x86)\R.G. Mechanics

2015-07-03 12:37 - 2014-09-05 23:14 - 00000000 ____D C:\Program Files (x86)\Origin

2015-07-03 12:37 - 2014-03-21 08:24 - 00000000 ____D C:\ProgramData\Origin

2015-07-03 12:36 - 2015-02-10 13:50 - 00000000 ____D C:\ProgramData\NexonUS

2015-07-03 12:36 - 2014-08-09 14:37 - 00000000 ____D C:\Program Files (x86)\MyFree Codec

2015-07-03 12:35 - 2015-05-26 14:20 - 00000000 ____D C:\Program Files (x86)\MicroVolts

2015-07-03 12:35 - 2015-03-31 13:56 - 00000000 ____D C:\Nexon

2015-07-03 12:35 - 2014-07-09 11:47 - 00000000 ____D C:\Program Files (x86)\Minecraft

2015-07-03 12:35 - 2014-07-09 02:58 - 00000000 ____D C:\Users\Oz Domer\AppData\Roaming\.minecraft

2015-07-03 12:34 - 2014-12-24 08:29 - 00000000 ____D C:\Program Files (x86)\Hp

2015-07-03 12:32 - 2015-05-30 13:07 - 00000000 ____D C:\Program Files (x86)\IObit

2015-07-03 12:32 - 2015-01-26 20:18 - 00000000 ____D C:\Users\Oz Domer\Documents\Battlefield Heroes

2015-07-03 12:31 - 2014-05-28 06:50 - 00000000 ____D C:\Program Files (x86)\abgx360

2015-07-02 10:28 - 2014-03-14 23:44 - 01300258 _____ C:\Windows\WindowsUpdate.log

2015-07-01 12:44 - 2014-07-17 20:05 - 00003768 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater

2015-07-01 12:44 - 2014-07-17 20:04 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2015-07-01 12:44 - 2014-07-17 20:04 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2015-06-27 03:13 - 2009-07-14 07:45 - 00010240 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2015-06-27 03:13 - 2009-07-14 07:45 - 00010240 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2015-06-20 01:16 - 2014-07-19 13:19 - 00000000 ____D C:\Users\Oz Domer\Documents\My Games

2015-06-19 23:40 - 2009-07-14 08:32 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games

2015-06-19 23:39 - 2014-09-13 15:20 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GOG.com

2015-06-17 20:20 - 2014-05-22 22:19 - 00000000 ____D C:\ProgramData\Package Cache

2015-06-17 16:42 - 2014-03-14 16:25 - 00000000 ____D C:\Program Files (x86)\NVIDIA Corporation

2015-06-15 01:41 - 2014-06-21 01:22 - 00000000 ____D C:\Users\Oz Domer\AppData\Local\SteelSeries Engine 3 Client

2015-06-09 12:49 - 2014-03-25 14:40 - 00000000 ____D C:\Users\Oz Domer\AppData\Roaming\vlc

2015-06-07 07:37 - 2015-05-30 13:09 - 00000000 ____D C:\Users\Oz Domer\AppData\Roaming\ProductData

 

==================== Files in the root of some directories =======

 

2015-06-17 20:20 - 2015-06-17 21:24 - 0002152 _____ () C:\Users\Oz Domer\AppData\Roaming\SpeedRunnersLog.txt

2015-07-03 17:35 - 2015-07-03 17:35 - 0164929 _____ () C:\Users\Oz Domer\AppData\Local\ars.cache

2015-07-03 17:35 - 2015-07-03 17:35 - 0376926 _____ () C:\Users\Oz Domer\AppData\Local\census.cache

2015-07-03 17:23 - 2015-07-03 17:23 - 0000036 _____ () C:\Users\Oz Domer\AppData\Local\housecall.guid.cache

2015-07-03 17:37 - 2015-07-03 17:37 - 0000010 _____ () C:\Users\Oz Domer\AppData\Local\sponge.last.runtime.cache

2014-11-21 20:13 - 2014-11-21 20:13 - 0000739 _____ () C:\ProgramData\1416590012.1044.bin

2014-11-21 20:13 - 2014-11-21 20:13 - 0005775 _____ () C:\ProgramData\1416590012.3472.bin

2014-11-21 20:13 - 2014-11-21 20:13 - 0009471 _____ () C:\ProgramData\1416590012.3492.bin

2014-11-21 20:13 - 2014-11-21 20:17 - 0015355 _____ () C:\ProgramData\1416590012.4100.bin

2014-11-21 20:13 - 2014-11-21 20:13 - 0000739 _____ () C:\ProgramData\1416590012.4284.bin

2014-11-21 20:13 - 2014-11-21 20:17 - 0000991 _____ () C:\ProgramData\1416590012.4788.bin

2014-11-21 20:13 - 2014-11-21 20:17 - 0003190 _____ () C:\ProgramData\1416590012.5116.bin

2014-11-21 20:13 - 2014-11-21 20:13 - 0017952 _____ () C:\ProgramData\1416590012.5848.bin

2014-11-21 20:17 - 2014-11-21 20:17 - 0086875 _____ () C:\ProgramData\1416590012.5880.bin

2014-11-21 20:13 - 2014-11-21 20:13 - 0002959 _____ () C:\ProgramData\1416590012.6128.bin

2014-11-21 20:13 - 2014-11-21 20:17 - 0118798 _____ () C:\ProgramData\1416590012.7140.bin

 

Some files in TEMP:

====================

C:\Users\Oz Domer\AppData\Local\Temp\dllnt_dump.dll

C:\Users\Oz Domer\AppData\Local\Temp\Quarantine.exe

C:\Users\Oz Domer\AppData\Local\Temp\sqlite3.dll

 

 

Some zero byte size files/folders:

==========================

C:\Windows\System32\BDSandBoxUH.dll

C:\Windows\System32\BDSandBoxUISkin.dll

C:\Windows\System32\BDSandBoxUISkin32.dll

 

==================== Bamital & volsnap Check =================

 

(There is no automatic fix for files that do not pass verification.)

 

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\SysWOW64\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed

 

 

LastRegBack: 2015-07-03 00:18

 

==================== End of log ============================

Sorry for the late reply but I’ve been busy this evening.

I’d like you to run another scan.

Download and run AdwCleaner

Download AdwCleaner from here and save it to your desktop.

• run AdwCleaner
• when it has finished, select Clean
• if it asks to reboot, allow the reboot
• on reboot a log will be produced; please attach the content of the log to your next reply.

When you’ve done that, please run FRST again and send a new log with the AdwCleaner log.

Thanks

Satchfan

AdwCleaner: 

# Option : Cleaning

 

***** [ Services ] *****

 

 

***** [ Files / Folders ] *****

 

Folder Deleted : C:\ProgramData\IePluginService

Folder Deleted : C:\ProgramData\WPM

Folder Deleted : C:\ProgramData\9632e060000014d5

Folder Deleted : C:\ProgramData\{861300b5-b777-7434-8613-300b5b7702d6}

Folder Deleted : C:\Program Files (x86)\VideoCnv

Folder Deleted : C:\Program Files (x86)\bestadblocker

Folder Deleted : C:\Program Files (x86)\PriceMinus

Folder Deleted : C:\Program Files (x86)\LightningDownloader

Folder Deleted : C:\Program Files (x86)\ProicaeMinuus

Folder Deleted : C:\Users\Oz Domer\AppData\Roaming\337Games

Folder Deleted : C:\Users\Oz Domer\AppData\Roaming\qone8

Folder Deleted : C:\Users\Oz Domer\AppData\Roaming\SupTab

Folder Deleted : C:\ProgramData\oenlakaaoabjjkibkgifjdgnobocfaag

File Deleted : C:\Users\Oz Domer\AppData\Local\Google\Chrome\User Data\Default\Extensions\newtabv3.crx

 

***** [ Scheduled tasks ] *****

 

 

***** [ Shortcuts ] *****

 

Shortcut Disinfected : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk

Shortcut Disinfected : C:\Users\Oz Domer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk

Shortcut Disinfected : C:\Users\Oz Domer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk

Shortcut Disinfected : C:\Users\Oz Domer\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk

Shortcut Disinfected : C:\Users\Oz Domer\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk

 

***** [ Registry ] *****

 

Key Deleted : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\IePluginService

Key Deleted : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Wpm

Key Deleted : HKLM\SOFTWARE\06a878d3-aa5d-a6c8-b9a9-89cdbc4197a2

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{A63C49A5-6CC1-4579-A883-AE6B3E91108D}

Key Deleted : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{BB82DE59-BC4C-4172-9AC4-73315F71CFFE}

Data Restored : HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command

Data Restored : HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\Google Chrome\shell\open\command

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{BB82DE59-BC4C-4172-9AC4-73315F71CFFE}

Key Deleted : HKCU\Software\Softonic

Key Deleted : HKCU\Software\tinydm.com

Key Deleted : HKCU\Software\AppDataLow\{4A0F38A9-FE55-4B89-B73F-E60FDC0F72E9}

Key Deleted : HKLM\SOFTWARE\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}

Key Deleted : HKLM\SOFTWARE\{4A0F38A9-FE55-4B89-B73F-E60FDC0F72E9}

Key Deleted : HKLM\SOFTWARE\delta-homesSoftware

Key Deleted : HKLM\SOFTWARE\IePlugin

Key Deleted : HKLM\SOFTWARE\qone8Software

Key Deleted : HKLM\SOFTWARE\Wpm

Key Deleted : HKLM\SOFTWARE\{12A61307-94CD-4F8E-94BC-918E511FAA81}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4820778D-AB0D-6D18-C316-52A6A0E1D507}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\qone8 uninstaller

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{AD11DADE-C597-45D9-D8C5-1D2EB0B89613}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{06B99631-BFA2-3B7A-F58B-D067C2BA59B7}

 

***** [ Web browsers ] *****

 

-\\ Internet Explorer v11.0.9600.17496

 

 

-\\ Google Chrome v35.0.1916.114

 

[C:\Users\Oz Domer\AppData\Local\Google\Chrome\User Data\Default\Preferences] - Deleted [Extension] : oenlakaaoabjjkibkgifjdgnobocfaag

[C:\Users\Oz Domer\AppData\Local\Google\Chrome\User Data\Default\Preferences] - Deleted [Homepage] : hxxp://search.conduit.com/?ctid=CT3220468&SearchSource;=48

[C:\Users\Oz Domer\AppData\Local\Google\Chrome\User Data\Default\Preferences] - Deleted [Startup_URLs] : hxxp://search.conduit.com/?ctid=CT3220468&SearchSource;=48

 

-\\ Chromium v

 

 

*************************

 

AdwCleaner[R0].txt - [5230 bytes] - [06/07/2015 00:19:38]

AdwCleaner[S0].txt - [4338 bytes] - [06/07/2015 00:20:58]

 

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [4397  bytes] ##########

FRST:

Platform: Windows 7 Ultimate Service Pack 1 (X64) OS Language: English (United States)

Internet Explorer Version 11 (Default browser: Chrome)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

 

==================== Processes (Whitelisted) =================

 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

 

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe

(Giraffic) C:\Program Files (x86)\Giraffic\GirafficWatchdog.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe

(Giraffic) C:\Program Files (x86)\Giraffic\Giraffic.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

() C:\Windows\SysWOW64\PnkBstrA.exe

(Razer Inc.) C:\Program Files (x86)\Razer\Razer Game Booster\RzKLService.exe

(NETGEAR) C:\Program Files (x86)\NETGEAR\WN111v2\WN111v2.exe

(SteelSeries ApS) C:\Program Files\SteelSeries\SteelSeries Engine 3\SteelSeriesEngine3.exe

(Company) C:\Program Files (x86)\Popcorn Time\Updater.exe

(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

(Symantec Corporation) C:\Program Files (x86)\Norton 360\Engine\20.6.0.27\ccsvchst.exe

(Symantec Corporation) C:\Program Files (x86)\Norton 360\Engine\20.6.0.27\ccsvchst.exe

 

 

==================== Registry (Whitelisted) ==================

 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

 

HKLM\…\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2531472 2014-12-13] (NVIDIA Corporation)

HKLM\…\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart

HKLM\…\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13530184 2013-04-22] (Realtek Semiconductor)

HKLM-x32\…\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [334896 2015-04-30] (Oracle Corporation)

HKU\S-1-5-21-3789109175-3304859141-1081259157-1000\…\Run: [Steam] => D:\Steam\steam.exe [2895552 2015-07-04] (Valve Corporation)

HKU\S-1-5-21-3789109175-3304859141-1081259157-1000\…\Run: [BitTorrent] => C:\Users\Oz Domer\AppData\Roaming\BitTorrent\BitTorrent.exe [1696104 2015-05-13] (BitTorrent Inc.)

HKU\S-1-5-21-3789109175-3304859141-1081259157-1000\…\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3696912 2014-03-04] (Disc Soft Ltd)

HKU\S-1-5-21-3789109175-3304859141-1081259157-1000\…\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [53288576 2015-06-29] (Skype Technologies S.A.)

HKU\S-1-5-21-3789109175-3304859141-1081259157-1000\…\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7063832 2014-11-21] (Piriform Ltd)

HKU\S-1-5-21-3789109175-3304859141-1081259157-1000\…\MountPoints2: {3b0f57cd-1faa-11e4-8b42-50e5492d8837} - H:\HTC_Sync_Manager_PC.exe

HKU\S-1-5-18\…\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [301568 2014-03-20] (Microsoft Corporation)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\NETGEAR WN111v2 Smart Wizard.lnk [2014-03-14]

ShortcutTarget: NETGEAR WN111v2 Smart Wizard.lnk -> C:\Program Files (x86)\NETGEAR\WN111v2\WN111v2.exe (NETGEAR)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\SteelSeries Engine 3.lnk [2014-06-21]

ShortcutTarget: SteelSeries Engine 3.lnk -> C:\Program Files\SteelSeries\SteelSeries Engine 3\SteelSeriesEngine3.exe (SteelSeries ApS)

Startup: C:\Users\Oz Domer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\j6bIXtKRz.lnk [2015-07-03]

ShortcutTarget: j6bIXtKRz.lnk -> C:\Users\Oz Domer\AppData\Roaming\uSILlzCwXBSr\aQ1Vb72t.exe (No File)

ShellIconOverlayIdentifiers: [OverlayExcluded] -> {4433A54A-1AC8-432F-90FC-85F045CF383C} => C:\Program Files (x86)\Norton 360\Engine64\20.6.0.27\buShell.dll [2013-05-29] (Symantec Corporation)

ShellIconOverlayIdentifiers: [OverlayPending] -> {F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225} => C:\Program Files (x86)\Norton 360\Engine64\20.6.0.27\buShell.dll [2013-05-29] (Symantec Corporation)

ShellIconOverlayIdentifiers: [OverlayProtected] -> {476D0EA3-80F9-48B5-B70B-05E677C9C148} => C:\Program Files (x86)\Norton 360\Engine64\20.6.0.27\buShell.dll [2013-05-29] (Symantec Corporation)

CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

 

==================== Internet (Whitelisted) ====================

 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

 

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.symantec.com/redirects/security_response/fix_homepage/index.jsp?lg=en&pid;=N360&pvid;=20.4.0.40

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://www.symantec.com/redirects/security_response/fix_homepage/index.jsp?lg=en&pid;=N360&pvid;=20.4.0.40

HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar;=iesearch

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar;=iesearch

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver;=5.5&ar;=msnhome

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver;=5.5&ar;=msnhome

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar;=iesearch

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar;=iesearch

HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver;=5.5&ar;=msnhome

HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar;=iesearch

HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.symantec.com/redirects/security_response/fix_homepage/index.jsp?lg=en&pid;=N360&pvid;=20.4.0.40

HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar;=iesearch

HKU\S-1-5-19\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver;=5.5&ar;=msnhome

HKU\S-1-5-19\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar;=iesearch

HKU\S-1-5-19\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.symantec.com/redirects/security_response/fix_homepage/index.jsp?lg=en&pid;=N360&pvid;=20.4.0.40

HKU\S-1-5-19\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar;=iesearch

HKU\S-1-5-20\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver;=5.5&ar;=msnhome

HKU\S-1-5-20\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar;=iesearch

HKU\S-1-5-20\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.symantec.com/redirects/security_response/fix_homepage/index.jsp?lg=en&pid;=N360&pvid;=20.4.0.40

HKU\S-1-5-20\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar;=iesearch

HKU\S-1-5-21-3789109175-3304859141-1081259157-1000\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar;=iesearch

HKU\S-1-5-21-3789109175-3304859141-1081259157-1000\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.symantec.com/redirects/security_response/fix_homepage/index.jsp?lg=en&pid;=N360&pvid;=20.4.0.40

HKU\S-1-5-21-3789109175-3304859141-1081259157-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://il.msn.com/?rd=1&ucc;=IL&dcc;=IL&opt;=0&ocid;=iehp

HKU\S-1-5-21-3789109175-3304859141-1081259157-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver;=5.5&ar;=msnhome

HKU\S-1-5-21-3789109175-3304859141-1081259157-1000\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar;=iesearch

SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

BHO: Virtual Keyboard Plugin -> {4A66AD60-A03D-4D01-86F0-5F0F7C0EF1AD} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Total Security 15.0.2\x64\IEExt\ie_plugin.dll [2014-12-23] (Kaspersky Lab ZAO)

BHO: Content Blocker Plugin -> {93BC2EA7-2F17-4729-948A-D2E03FFB2412} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Total Security 15.0.2\x64\IEExt\ie_plugin.dll [2014-12-23] (Kaspersky Lab ZAO)

BHO: Safe Money Plugin -> {AB379017-4C03-4E00-8EDF-E6D6AF7CCF82} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Total Security 15.0.2\x64\IEExt\ie_plugin.dll [2014-12-23] (Kaspersky Lab ZAO)

BHO-x32: Virtual Keyboard Plugin -> {4A66AD60-A03D-4D01-86F0-5F0F7C0EF1AD} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Total Security 15.0.2\IEExt\ie_plugin.dll [2014-12-23] (Kaspersky Lab ZAO)

BHO-x32: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton 360\Engine\20.6.0.27\coIEPlg.dll [2014-11-28] (Symantec Corporation)

BHO-x32: Norton Vulnerability Protection -> {6D53EC84-6AAE-4787-AEEE-F4628F01010C} -> C:\Program Files (x86)\Norton 360\Engine\20.6.0.27\IPS\IPSBHO.DLL [2013-04-09] (Symantec Corporation)

BHO-x32: Content Blocker Plugin -> {93BC2EA7-2F17-4729-948A-D2E03FFB2412} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Total Security 15.0.2\IEExt\ie_plugin.dll [2014-12-23] (Kaspersky Lab ZAO)

BHO-x32: Safe Money Plugin -> {AB379017-4C03-4E00-8EDF-E6D6AF7CCF82} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Total Security 15.0.2\IEExt\ie_plugin.dll [2014-12-23] (Kaspersky Lab ZAO)

Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton 360\Engine\20.6.0.27\coIEPlg.dll [2014-11-28] (Symantec Corporation)

DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL [2012-10-01] (Microsoft Corporation)

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)

Tcpip\Parameters: [DhcpNameServer] 10.0.0.138

Tcpip\..\Interfaces\{23E8E0EE-E76F-40D6-B1AC-9EB21DAEFB40}: [DhcpNameServer] 10.0.0.138

Tcpip\..\Interfaces\{44C27C33-100A-449B-AAF3-CBF7651D6389}: [DhcpNameServer] 10.0.0.138

Tcpip\..\Interfaces\{E7E187C8-2D1F-4395-801D-63AE0A339969}: [DhcpNameServer] 192.168.42.129

 

FireFox:

========

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_17_0_0_190.dll [2015-07-01] ()

FF Plugin: @esn/npbattlelog,version=2.5.1 -> C:\Program Files (x86)\Battlelog Web Plugins\2.5.1\npbattlelogx64.dll [2014-09-01] (EA Digital Illusions CE AB)

FF Plugin: @microsoft.com/GENUINE -> disabled No File

FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~2\Office15\NPSPWRAP.DLL [2012-10-01] (Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_190.dll [2015-07-01] ()

FF Plugin-x32: @esn/npbattlelog,version=2.5.1 -> C:\Program Files (x86)\Battlelog Web Plugins\2.5.1\npbattlelog.dll [2014-09-01] (EA Digital Illusions CE AB)

FF Plugin-x32: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-05-16] (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-05-16] (Oracle Corporation)

FF Plugin-x32: @kaspersky.com/content_blocker_663BE84DBCC949E88C7600F63CA7F098 -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Total Security 15.0.2\FFExt\[removed] [2015-07-05] ()

FF Plugin-x32: @kaspersky.com/online_banking_08806E753BE44495B44E90AA2513BDC5 -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Total Security 15.0.2\FFExt\[removed] [2015-07-05] ()

FF Plugin-x32: @kaspersky.com/virtual_keyboard_07402848C2F6470194F131B0F3DE025E -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Total Security 15.0.2\FFExt\[removed] [2015-07-05] ()

FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File

FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2012-10-01] (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL [2012-10-01] (Microsoft Corporation)

FF Plugin-x32: @nexon.net/NxGame -> C:\ProgramData\NexonUS\NGM\npNxGameUS.dll No File

FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2014-10-16] (NVIDIA Corporation)

FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2014-10-16] (NVIDIA Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll [2014-05-19] (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll [2014-05-19] (Google Inc.)

FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2014-02-05] (VideoLAN)

FF Plugin HKU\S-1-5-21-3789109175-3304859141-1081259157-1000: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Oz Domer\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2014-05-26] (Unity Technologies ApS)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll [2012-10-01] (Microsoft Corporation)

FF HKLM-x32\…\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.4.0.40\coFFPlgn

FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.4.0.40\coFFPlgn [2015-07-06]

FF HKLM-x32\…\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.4.0.40\IPSFFPlgn

FF Extension: Norton Vulnerability Protection - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.4.0.40\IPSFFPlgn [2015-07-05]

FF HKLM-x32\…\Firefox\Extensions: [[removed]] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Total Security 15.0.2\FFExt\[removed]

FF Extension: Dangerous Websites Blocker - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Total Security 15.0.2\FFExt\[removed] [2015-07-05]

FF HKLM-x32\…\Firefox\Extensions: [[removed]] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Total Security 15.0.2\FFExt\[removed]

FF Extension: Virtual Keyboard - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Total Security 15.0.2\FFExt\[removed] [2015-07-05]

FF HKLM-x32\…\Firefox\Extensions: [[removed]] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Total Security 15.0.2\FFExt\[removed]

FF Extension: Safe Money - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Total Security 15.0.2\FFExt\[removed] [2015-07-05]

 

Chrome: 

=======

CHR dev: Chrome dev build detected! <======= ATTENTION

CHR Profile: C:\Users\Oz Domer\AppData\Local\Google\Chrome\User Data\Default

CHR Extension: (Google Docs) - C:\Users\Oz Domer\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-03-14]

CHR Extension: (Google Drive) - C:\Users\Oz Domer\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-03-14]

CHR Extension: (Norton Identity Protection) - C:\Users\Oz Domer\AppData\Local\Google\Chrome\User Data\Default\Extensions\bejnhdlplbjhffionohbdnpcbobfejcc [2015-07-05]

CHR Extension: (CS Portable) - C:\Users\Oz Domer\AppData\Local\Google\Chrome\User Data\Default\Extensions\bijcilgmpgmllbihfhofoobmbjbbkenl [2014-03-14]

CHR Extension: (YouTube) - C:\Users\Oz Domer\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-03-14]

CHR Extension: (Battlefield Heroes) - C:\Users\Oz Domer\AppData\Local\Google\Chrome\User Data\Default\Extensions\cehdakiococlfmjcbebbkjkfjhbieknh [2015-01-26]

CHR Extension: (Easy SteamGifts) - C:\Users\Oz Domer\AppData\Local\Google\Chrome\User Data\Default\Extensions\cklbilaeedbblhpkhjfcnmaocjdodcnm [2014-03-14]

CHR Extension: (Google Search) - C:\Users\Oz Domer\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-03-14]

CHR Extension: (Kaspersky Protection) - C:\Users\Oz Domer\AppData\Local\Google\Chrome\User Data\Default\Extensions\dbhjdbfgekjfcfkkfjjmlmojhbllhbho [2015-07-05]

CHR Extension: (PartyCloud DJ) - C:\Users\Oz Domer\AppData\Local\Google\Chrome\User Data\Default\Extensions\defekohaofmambflfpfoojkmfdpcbgko [2014-03-14]

CHR Extension: (Tampermonkey) - C:\Users\Oz Domer\AppData\Local\Google\Chrome\User Data\Default\Extensions\dhdgffkkebhmkfjojejmpbldmpobfkfo [2014-03-14]

CHR Extension: (Rush Team) - C:\Users\Oz Domer\AppData\Local\Google\Chrome\User Data\Default\Extensions\ecdnoeebfjlplfkljdedokbcmebojbpb [2014-03-27]

CHR Extension: (LoungeDestroyer) - C:\Users\Oz Domer\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghahcnmfjfckcedfajbhekgknjdplfcl [2015-01-27]

CHR Extension: (Norton Identity Safe) - C:\Users\Oz Domer\AppData\Local\Google\Chrome\User Data\Default\Extensions\iikflkcanblccfahdhdonehdalibjnif [2015-07-06]

CHR Extension: (CS:GO Lounge Bump Bot) - C:\Users\Oz Domer\AppData\Local\Google\Chrome\User Data\Default\Extensions\jhfkidfnhjcjjamcbdepeohblphlamgk [2014-12-16]

CHR Extension: (No Name) - C:\Users\Oz Domer\AppData\Local\Google\Chrome\User Data\Default\Extensions\loamdenijebhollnjgehcfbnpeelfhlk [2015-06-29]

CHR Extension: (Google Wallet) - C:\Users\Oz Domer\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-03-14]

CHR Extension: (Simple Adblock) - C:\Users\Oz Domer\AppData\Local\Google\Chrome\User Data\Default\Extensions\ockogkkjjhgjelcddamlnjcfnmiegjfg [2014-09-09]

CHR Extension: (My Chrome Theme) - C:\Users\Oz Domer\AppData\Local\Google\Chrome\User Data\Default\Extensions\oehpjpccmlcalbenfhnacjeocbjdonic [2014-03-14]

CHR Extension: (Enhanced Steam) - C:\Users\Oz Domer\AppData\Local\Google\Chrome\User Data\Default\Extensions\okadibdjfemgnhjiembecghcbfknbfhg [2015-01-28]

CHR Extension: (Bitdefender QuickScan) - C:\Users\Oz Domer\AppData\Local\Google\Chrome\User Data\Default\Extensions\pdnkcidphdcakpkheohlhocaicfamjie [2014-11-21]

CHR Extension: (Gmail) - C:\Users\Oz Domer\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-03-14]

CHR HKLM\…\Chrome\Extension: [bejnhdlplbjhffionohbdnpcbobfejcc] - C:\Program Files (x86)\Norton 360\Engine\20.6.0.27\Exts\Chrome.crx [2015-07-05]

CHR HKLM\…\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho

CHR HKLM\…\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - https://clients2.google.com/service/update2/crx

CHR HKLM-x32\…\Chrome\Extension: [bejnhdlplbjhffionohbdnpcbobfejcc] - C:\Program Files (x86)\Norton 360\Engine\20.6.0.27\Exts\Chrome.crx [2015-07-05]

CHR HKLM-x32\…\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho

CHR HKLM-x32\…\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - https://clients2.google.com/service/update2/crx

 

==================== Services (Whitelisted) =================

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

S2 AVP15.0.2; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Total Security 15.0.2\avp.exe [193400 2014-12-23] (Kaspersky Lab ZAO)

R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1148560 2014-12-13] (NVIDIA Corporation)

R2 Giraffic; C:\Program Files (x86)\Giraffic\GirafficWatchdog.exe [2245232 2013-05-13] (Giraffic)

S3 jswpsapi; C:\Program Files (x86)\NETGEAR\WN111v2\jswpsapi.exe [942080 2008-02-29] (Atheros Communications, Inc.) [File not signed]

R2 N360; C:\Program Files (x86)\Norton 360\Engine\20.6.0.27\ccSvcHst.exe [144368 2013-05-21] (Symantec Corporation)

R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1701520 2014-12-13] (NVIDIA Corporation)

R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [19823248 2014-12-13] (NVIDIA Corporation)

R2 PnkBstrA; C:\Windows\system32\PnkBstrA.exe [76152 2014-12-08] ()

R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2015-02-02] ()

R2 RzKLService; C:\Program Files (x86)\Razer\Razer Game Booster\RzKLService.exe [105448 2014-02-25] (Razer Inc.)

R2 Update service; C:\Program Files (x86)\Popcorn Time\Updater.exe [335360 2014-12-17] (Company) [File not signed]

R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

 

==================== Drivers (Whitelisted) ====================

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

R1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.4.0.40\Definitions\BASHDefs\20150625.001\BHDrvx64.sys [1648880 2015-06-25] (Symantec Corporation)

S3 busenum; C:\Windows\System32\DRIVERS\SteelBus64.sys [145408 2014-01-08] (SteelSeries Corporation) [File not signed]

R1 ccSet_N360; C:\Windows\system32\drivers\N360x64\1406000.01B\ccSetx64.sys [169048 2013-04-16] (Symantec Corporation)

R0 cm_km_w; C:\Windows\System32\DRIVERS\cm_km_w.sys [238288 2013-01-14] (Kaspersky Lab UK Ltd)

R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2014-04-02] (Disc Soft Ltd)

R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [498512 2015-07-04] (Symantec Corporation)

R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [153936 2015-07-04] (Symantec Corporation)

R1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.4.0.40\Definitions\IPSDefs\20150703.001\IDSvia64.sys [692984 2015-07-03] (Symantec Corporation)

R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [468576 2014-03-31] (Kaspersky Lab ZAO)

R2 kldisk; C:\Windows\System32\DRIVERS\kldisk.sys [47112 2014-08-19] (Kaspersky Lab ZAO)

R3 klflt; C:\Windows\System32\DRIVERS\klflt.sys [151240 2014-11-28] (Kaspersky Lab ZAO)

R1 klhk; C:\Windows\System32\DRIVERS\klhk.sys [245960 2014-10-22] (Kaspersky Lab ZAO)

R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [843448 2014-12-13] (Kaspersky Lab ZAO)

R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [30920 2014-10-10] (Kaspersky Lab ZAO)

R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [30920 2014-10-30] (Kaspersky Lab ZAO)

R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29280 2013-08-08] (Kaspersky Lab ZAO)

R1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO)

R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [57032 2014-10-09] (Kaspersky Lab ZAO)

R1 Klwtp; C:\Windows\System32\DRIVERS\klwtp.sys [77000 2014-11-22] (Kaspersky Lab ZAO)

R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [181960 2014-11-10] (Kaspersky Lab ZAO)

R3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.4.0.40\Definitions\VirusDefs\20150704.003\ENG64.SYS [138488 2015-07-04] (Symantec Corporation)

R3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.4.0.40\Definitions\VirusDefs\20150704.003\EX64.SYS [2146040 2015-07-04] (Symantec Corporation)

S3 netr28ux; C:\Windows\System32\DRIVERS\Dnetr28ux.sys [1660480 2011-09-09] (Ralink Technology Corp.)

R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19600 2014-12-13] (NVIDIA Corporation)

R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [38032 2014-11-22] (NVIDIA Corporation)

S3 PCAMp50a64; C:\Windows\System32\Drivers\PCAMp50a64.sys [43328 2006-11-28] (Printing Communications Assoc., Inc. (PCAUSA))

S3 PCASp50a64; C:\Windows\System32\Drivers\PCASp50a64.sys [41280 2006-11-28] (Printing Communications Assoc., Inc. (PCAUSA))

S3 SAlphamHid; C:\Windows\System32\DRIVERS\SAlpham64.sys [38016 2013-05-31] (SteelSeries Corporation) [File not signed]

R3 SRTSP; C:\Windows\System32\Drivers\N360x64\1406000.01B\SRTSP64.SYS [796760 2013-05-16] (Symantec Corporation)

R1 SRTSPX; C:\Windows\system32\drivers\N360x64\1406000.01B\SRTSPX64.SYS [36952 2013-03-05] (Symantec Corporation)

R3 ssdevfactory; C:\Windows\System32\DRIVERS\ssdevfactory.sys [32792 2015-06-02] (SteelSeries ApS)

R3 sshid; C:\Windows\System32\DRIVERS\sshid.sys [43616 2015-06-02] (SteelSeries ApS)

R0 SymDS; C:\Windows\System32\drivers\N360x64\1406000.01B\SYMDS64.SYS [493656 2013-05-21] (Symantec Corporation)

R0 SymEFA; C:\Windows\System32\drivers\N360x64\1406000.01B\SYMEFA64.SYS [1139800 2013-05-23] (Symantec Corporation)

R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [177312 2015-07-05] (Symantec Corporation)

R1 SymIRON; C:\Windows\system32\drivers\N360x64\1406000.01B\Ironx64.SYS [224416 2013-03-05] (Symantec Corporation)

R1 SymNetS; C:\Windows\System32\Drivers\N360x64\1406000.01B\SYMNETS.SYS [433752 2013-04-25] (Symantec Corporation)

U3 TrueSight; C:\Windows\System32\drivers\TrueSight.sys [35064 2015-07-05] ()

S3 usbrndis6; C:\Windows\System32\DRIVERS\usb80236.sys [19968 2013-02-12] (Microsoft Corporation)

S3 WN111v2; C:\Windows\System32\DRIVERS\WN111v2w7x.sys [783360 2010-04-27] (Atheros Communications, Inc.)

S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]

U4 klkbdflt2; system32\DRIVERS\klkbdflt2.sys [X]

S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]

S3 tsusbhub; system32\drivers\tsusbhub.sys [X]

S3 VGPU; System32\drivers\rdvgkmd.sys [X]

U4 vsserv; No ImagePath

S3 X6va029; \??\C:\Windows\SysWOW64\Drivers\X6va029 [X]

 

==================== NetSvcs (Whitelisted) ===================

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

 

==================== One Month Created files and folders ========

 

(If an entry is included in the fixlist, the file/folder will be moved.)

 

2015-07-06 00:27 - 2015-07-06 00:28 - 00028456 _____ C:\Users\Oz Domer\Desktop\FRST.txt

2015-07-06 00:25 - 2015-07-06 00:25 - 00004481 _____ C:\Users\Oz Domer\Desktop\AdwCleaner[S0].txt

2015-07-06 00:19 - 2015-07-06 00:21 - 00000000 ____D C:\AdwCleaner

2015-07-06 00:19 - 2015-07-06 00:19 - 02244096 _____ C:\Users\Oz Domer\Desktop\adwcleaner_4.207.exe

2015-07-05 17:45 - 2015-07-06 00:27 - 00000000 ____D C:\FRST

2015-07-05 17:39 - 2015-07-05 17:45 - 00000000 ____D C:\ProgramData\RogueKiller

2015-07-05 17:39 - 2015-07-05 17:39 - 00035064 _____ C:\Windows\system32\Drivers\TrueSight.sys

2015-07-05 17:38 - 2015-07-05 17:38 - 02112512 _____ (Farbar) C:\Users\Oz Domer\Desktop\FRST64.exe

2015-07-05 17:37 - 2015-07-05 17:45 - 00005841 _____ C:\Users\Oz Domer\Desktop\Rough Killer.txt

2015-07-05 17:36 - 2015-07-05 17:38 - 17853688 _____ C:\Users\Oz Domer\Desktop\RogueKiller.exe

2015-07-05 13:07 - 2015-07-05 13:07 - 00002307 _____ C:\Users\Oz Domer\Desktop\Safe Money.lnk

2015-07-05 13:03 - 2015-07-05 13:03 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kaspersky Total Security

2015-07-05 13:03 - 2015-07-05 13:02 - 00002053 _____ C:\Users\Public\Desktop\Kaspersky Total Security.lnk

2015-07-05 13:02 - 2015-07-06 00:24 - 00000000 ____D C:\ProgramData\Kaspersky Lab

2015-07-05 13:02 - 2015-07-05 13:02 - 00000000 ____D C:\Windows\ELAMBKUP

2015-07-05 13:02 - 2015-07-05 13:02 - 00000000 ____D C:\Program Files (x86)\Kaspersky Lab

2015-07-05 13:02 - 2013-05-06 08:13 - 00110176 _____ (Kaspersky Lab ZAO) C:\Windows\system32\klfphc.dll

2015-07-05 13:01 - 2014-12-13 18:21 - 00843448 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klif.sys

2015-07-05 13:01 - 2014-11-28 18:19 - 00151240 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klflt.sys

2015-07-05 13:01 - 2014-10-22 21:13 - 00245960 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klhk.sys

2015-07-05 12:57 - 2015-07-05 12:59 - 196444992 _____ (Kaspersky Lab) C:\Users\Oz Domer\Downloads\kts15.0.2.361en_7342.exe

2015-07-05 10:21 - 2015-07-06 00:24 - 00002319 _____ C:\Users\Public\Desktop\Norton 360.lnk

2015-07-05 10:14 - 2015-07-06 00:24 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton 360 Premier Edition

2015-07-05 09:56 - 2015-07-06 00:26 - 00000000 ____D C:\Windows\system32\Drivers\N360x64

2015-07-05 09:56 - 2015-07-06 00:24 - 00003206 _____ C:\Windows\System32\Tasks\Norton WSC Integration

2015-07-05 09:56 - 2015-07-05 10:15 - 00177312 _____ (Symantec Corporation) C:\Windows\system32\Drivers\SYMEVENT64x86.SYS

2015-07-05 09:56 - 2015-07-05 10:15 - 00007631 _____ C:\Windows\system32\Drivers\SYMEVENT64x86.CAT

2015-07-05 09:56 - 2015-07-05 09:56 - 00000000 ____D C:\Program Files\Symantec

2015-07-05 09:56 - 2015-07-05 09:56 - 00000000 ____D C:\Program Files\Common Files\Symantec Shared

2015-07-05 09:56 - 2015-07-05 09:56 - 00000000 ____D C:\Program Files (x86)\Norton 360

2015-07-04 13:37 - 2015-07-04 13:37 - 00000000 ____D C:\Users\Oz Domer\AppData\Local\CEF

2015-07-03 17:42 - 2015-07-03 17:42 - 00001219 _____ C:\Users\Oz Domer\Desktop\TeamSpeak 3 Client.lnk

2015-07-03 17:42 - 2015-07-03 17:42 - 00000000 ____D C:\Users\Oz Domer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client

2015-07-03 17:37 - 2015-07-03 17:37 - 00000010 _____ C:\Users\Oz Domer\AppData\Local\sponge.last.runtime.cache

2015-07-03 17:35 - 2015-07-03 17:35 - 00376926 _____ C:\Users\Oz Domer\AppData\Local\census.cache

2015-07-03 17:35 - 2015-07-03 17:35 - 00164929 _____ C:\Users\Oz Domer\AppData\Local\ars.cache

2015-07-03 17:23 - 2015-07-03 17:23 - 02494944 _____ (Trend Micro Inc.) C:\Users\Oz Domer\Downloads\HousecallLauncher64.exe

2015-07-03 17:23 - 2015-07-03 17:23 - 00000036 _____ C:\Users\Oz Domer\AppData\Local\housecall.guid.cache

2015-07-03 17:23 - 2013-09-28 05:56 - 00285208 _____ (Trend Micro Inc.) C:\Windows\system32\Drivers\tmcomm.sys

2015-07-03 17:01 - 2015-07-05 10:25 - 00000000 ____D C:\Users\Oz Domer\AppData\Roaming\uSILlzCwXBSr

2015-07-03 17:01 - 2015-07-05 10:19 - 00000000 ____D C:\Users\Oz Domer\AppData\Roaming\8D21C8D9-D6D8-48DB-84D2-5F71DFD60C2C

2015-07-03 16:57 - 2015-07-03 17:45 - 00000000 ____D C:\Users\Oz Domer\AppData\Roaming\TS3Client

2015-07-03 16:57 - 2015-07-03 16:57 - 00000000 ____D C:\Users\Oz Domer\AppData\Local\TeamSpeak 3 Client

2015-07-03 16:56 - 2015-07-03 16:56 - 30014480 _____ (TeamSpeak Systems GmbH) C:\Users\Oz Domer\Downloads\TeamSpeak3-Client-win64-3.0.16.exe

2015-07-03 12:34 - 2015-05-16 14:05 - 00271968 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe

2015-07-03 01:38 - 2015-07-03 01:38 - 00000000 ____D C:\ProgramData\Riot Games

2015-07-03 01:36 - 2015-07-03 01:36 - 00000000 ____D C:\Riot Games

2015-07-03 01:34 - 2015-07-03 01:37 - 00000000 ____D C:\Users\Oz Domer\AppData\Roaming\Riot Games

2015-07-03 01:34 - 2015-07-03 01:34 - 30993712 _____ (Riot Games) C:\Users\Oz Domer\Downloads\LeagueofLegends_EUNE_Installer_9_15_2014.exe

2015-06-28 11:22 - 2015-06-28 11:22 - 00000000 ____D C:\Users\Oz Domer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome

2015-06-19 23:38 - 2015-06-19 23:38 - 00000000 ____D C:\GOG Games

2015-06-19 21:25 - 2015-06-19 21:25 - 00000000 ____D C:\Users\Oz Domer\Documents\Klei

2015-06-17 20:20 - 2015-06-17 20:20 - 00000000 ____D C:\Users\Oz Domer\Documents\SavedGames

2015-06-17 16:42 - 2015-06-17 16:43 - 00000000 ____D C:\Users\Oz Domer\AppData\Local\PAYDAY 2

2015-06-17 16:42 - 2015-06-17 16:42 - 00000000 ____D C:\Program Files (x86)\AGEIA Technologies

2015-06-14 10:18 - 2015-07-03 14:41 - 00037174 _____ C:\Windows\DirectX.log

2015-06-08 17:53 - 2015-06-08 17:53 - 00005024 _____ C:\Windows\DPINST.LOG

2015-06-08 17:50 - 2015-06-08 17:51 - 76379784 _____ C:\Users\Oz Domer\Downloads\SteelSeriesEngine3.3.7.1Setup.exe

 

==================== One Month Modified files and folders ========

 

(If an entry is included in the fixlist, the file/folder will be moved.)

 

2015-07-06 00:26 - 2014-04-06 19:42 - 00000000 ____D C:\Program Files (x86)\Giraffic

2015-07-06 00:25 - 2014-03-17 15:49 - 00000000 ____D C:\Users\Oz Domer\AppData\Roaming\Skype

2015-07-06 00:25 - 2014-03-14 20:13 - 00000000 ____D C:\Users\Oz Domer\AppData\Roaming\BitTorrent

2015-07-06 00:24 - 2015-06-03 07:21 - 00008718 _____ C:\Windows\setupact.log

2015-07-06 00:24 - 2015-05-30 12:24 - 00000348 _____ C:\Windows\Tasks\Bidaily Synchronize Task[973b].job

2015-07-06 00:24 - 2014-03-14 16:14 - 00000898 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2015-07-06 00:23 - 2015-06-03 07:21 - 00011710 _____ C:\Windows\PFRO.log

2015-07-06 00:23 - 2014-03-14 16:21 - 00000000 ____D C:\ProgramData\NVIDIA

2015-07-06 00:23 - 2009-07-14 08:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2015-07-06 00:21 - 2014-03-14 16:15 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome

2015-07-06 00:21 - 2014-03-14 14:59 - 00000995 _____ C:\Users\Oz Domer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk

2015-07-05 23:56 - 2014-03-14 16:14 - 00000902 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2015-07-05 23:44 - 2014-07-17 20:05 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job

2015-07-05 14:53 - 2014-04-16 12:34 - 00690672 _____ C:\Windows\system32\perfh00C.dat

2015-07-05 14:53 - 2014-04-16 12:34 - 00479062 _____ C:\Windows\system32\perfh001.dat

2015-07-05 14:53 - 2014-04-16 12:34 - 00130340 _____ C:\Windows\system32\perfc00C.dat

2015-07-05 14:53 - 2014-04-16 12:34 - 00094880 _____ C:\Windows\system32\perfc001.dat

2015-07-05 14:53 - 2014-03-14 19:53 - 00392392 _____ C:\Windows\system32\perfh00D.dat

2015-07-05 14:53 - 2014-03-14 19:53 - 00084866 _____ C:\Windows\system32\perfc00D.dat

2015-07-05 14:53 - 2009-07-14 08:13 - 02624136 _____ C:\Windows\system32\PerfStringBackup.INI

2015-07-05 14:52 - 2014-04-06 19:42 - 00000000 ____D C:\ProgramData\Giraffic

2015-07-05 13:03 - 2014-06-18 15:12 - 00000000 ____D C:\Users\admin

2015-07-05 13:03 - 2009-07-14 08:08 - 00000000 ____D C:\Users\Administrator

2015-07-05 12:47 - 2015-05-30 12:25 - 00000000 ____D C:\Program Files (x86)\ThunderQQDownload FlashGet Files Downloader Pro

2015-07-05 11:14 - 2015-03-31 14:14 - 00006532 _____ C:\Users\Oz Domer\Downloads\Oppai Trainer 2015 0.4.7a.zip

2015-07-05 09:56 - 2014-03-14 20:30 - 00000000 ____D C:\ProgramData\Norton

2015-07-05 09:38 - 2014-09-19 11:21 - 00000000 ___RD C:\Program Files (x86)\Skype

2015-07-05 09:38 - 2014-03-17 15:48 - 00000000 ____D C:\ProgramData\Skype

2015-07-04 13:33 - 2015-05-30 13:08 - 00000000 ____D C:\ProgramData\ProductData

2015-07-03 12:38 - 2015-04-22 14:44 - 00000000 ____D C:\Program Files (x86)\R.G. Mechanics

2015-07-03 12:37 - 2014-09-05 23:14 - 00000000 ____D C:\Program Files (x86)\Origin

2015-07-03 12:37 - 2014-03-21 08:24 - 00000000 ____D C:\ProgramData\Origin

2015-07-03 12:36 - 2015-02-10 13:50 - 00000000 ____D C:\ProgramData\NexonUS

2015-07-03 12:36 - 2014-08-09 14:37 - 00000000 ____D C:\Program Files (x86)\MyFree Codec

2015-07-03 12:35 - 2015-05-26 14:20 - 00000000 ____D C:\Program Files (x86)\MicroVolts

2015-07-03 12:35 - 2015-03-31 13:56 - 00000000 ____D C:\Nexon

2015-07-03 12:35 - 2014-07-09 11:47 - 00000000 ____D C:\Program Files (x86)\Minecraft

2015-07-03 12:35 - 2014-07-09 02:58 - 00000000 ____D C:\Users\Oz Domer\AppData\Roaming\.minecraft

2015-07-03 12:34 - 2014-12-24 08:29 - 00000000 ____D C:\Program Files (x86)\Hp

2015-07-03 12:32 - 2015-05-30 13:07 - 00000000 ____D C:\Program Files (x86)\IObit

2015-07-03 12:32 - 2015-01-26 20:18 - 00000000 ____D C:\Users\Oz Domer\Documents\Battlefield Heroes

2015-07-03 12:31 - 2014-05-28 06:50 - 00000000 ____D C:\Program Files (x86)\abgx360

2015-07-02 10:28 - 2014-03-14 23:44 - 01300258 _____ C:\Windows\WindowsUpdate.log

2015-07-01 12:44 - 2014-07-17 20:05 - 00003768 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater

2015-07-01 12:44 - 2014-07-17 20:04 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2015-07-01 12:44 - 2014-07-17 20:04 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2015-06-27 03:13 - 2009-07-14 07:45 - 00010240 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2015-06-27 03:13 - 2009-07-14 07:45 - 00010240 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2015-06-20 01:16 - 2014-07-19 13:19 - 00000000 ____D C:\Users\Oz Domer\Documents\My Games

2015-06-19 23:40 - 2009-07-14 08:32 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games

2015-06-19 23:39 - 2014-09-13 15:20 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GOG.com

2015-06-17 20:20 - 2014-05-22 22:19 - 00000000 ____D C:\ProgramData\Package Cache

2015-06-17 16:42 - 2014-03-14 16:25 - 00000000 ____D C:\Program Files (x86)\NVIDIA Corporation

2015-06-15 01:41 - 2014-06-21 01:22 - 00000000 ____D C:\Users\Oz Domer\AppData\Local\SteelSeries Engine 3 Client

2015-06-09 12:49 - 2014-03-25 14:40 - 00000000 ____D C:\Users\Oz Domer\AppData\Roaming\vlc

2015-06-07 07:37 - 2015-05-30 13:09 - 00000000 ____D C:\Users\Oz Domer\AppData\Roaming\ProductData

 

==================== Files in the root of some directories =======

 

2015-06-17 20:20 - 2015-06-17 21:24 - 0002152 _____ () C:\Users\Oz Domer\AppData\Roaming\SpeedRunnersLog.txt

2015-07-03 17:35 - 2015-07-03 17:35 - 0164929 _____ () C:\Users\Oz Domer\AppData\Local\ars.cache

2015-07-03 17:35 - 2015-07-03 17:35 - 0376926 _____ () C:\Users\Oz Domer\AppData\Local\census.cache

2015-07-03 17:23 - 2015-07-03 17:23 - 0000036 _____ () C:\Users\Oz Domer\AppData\Local\housecall.guid.cache

2015-07-03 17:37 - 2015-07-03 17:37 - 0000010 _____ () C:\Users\Oz Domer\AppData\Local\sponge.last.runtime.cache

2014-11-21 20:13 - 2014-11-21 20:13 - 0000739 _____ () C:\ProgramData\1416590012.1044.bin

2014-11-21 20:13 - 2014-11-21 20:13 - 0005775 _____ () C:\ProgramData\1416590012.3472.bin

2014-11-21 20:13 - 2014-11-21 20:13 - 0009471 _____ () C:\ProgramData\1416590012.3492.bin

2014-11-21 20:13 - 2014-11-21 20:17 - 0015355 _____ () C:\ProgramData\1416590012.4100.bin

2014-11-21 20:13 - 2014-11-21 20:13 - 0000739 _____ () C:\ProgramData\1416590012.4284.bin

2014-11-21 20:13 - 2014-11-21 20:17 - 0000991 _____ () C:\ProgramData\1416590012.4788.bin

2014-11-21 20:13 - 2014-11-21 20:17 - 0003190 _____ () C:\ProgramData\1416590012.5116.bin

2014-11-21 20:13 - 2014-11-21 20:13 - 0017952 _____ () C:\ProgramData\1416590012.5848.bin

2014-11-21 20:17 - 2014-11-21 20:17 - 0086875 _____ () C:\ProgramData\1416590012.5880.bin

2014-11-21 20:13 - 2014-11-21 20:13 - 0002959 _____ () C:\ProgramData\1416590012.6128.bin

2014-11-21 20:13 - 2014-11-21 20:17 - 0118798 _____ () C:\ProgramData\1416590012.7140.bin

 

Some files in TEMP:

====================

C:\Users\Oz Domer\AppData\Local\Temp\dllnt_dump.dll

C:\Users\Oz Domer\AppData\Local\Temp\Quarantine.exe

C:\Users\Oz Domer\AppData\Local\Temp\sqlite3.dll

 

 

Some zero byte size files/folders:

==========================

C:\Windows\System32\BDSandBoxUH.dll

C:\Windows\System32\BDSandBoxUISkin.dll

C:\Windows\System32\BDSandBoxUISkin32.dll

 

==================== Bamital & volsnap Check =================

 

(There is no automatic fix for files that do not pass verification.)

 

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\SysWOW64\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed

 

 

LastRegBack: 2015-07-03 00:18

 

==================== End of log ============================

Sorry for the late reply but I’ve been busy this evening.

I’d like you to run another scan.

Download and run AdwCleaner

Download AdwCleaner from here and save it to your desktop.

• run AdwCleaner
• when it has finished, select Clean
• if it asks to reboot, allow the reboot
• on reboot a log will be produced; please attach the content of the log to your next reply.

When you’ve done that, please run FRST again and send a new log with the AdwCleaner log.

Thanks

Satchfan

 

AdwCleaner:

 Operating system : Windows 7 Ultimate Service Pack 1 (x64)

Sorry for the late reply but I’ve been busy this evening.

I’d like you to run another scan.

Download and run AdwCleaner

Download AdwCleaner from here and save it to your desktop.

• run AdwCleaner
• when it has finished, select Clean
• if it asks to reboot, allow the reboot
• on reboot a log will be produced; please attach the content of the log to your next reply.

When you’ve done that, please run FRST again and send a new log with the AdwCleaner log.

Thanks

Satchfan

 

AdwCleaner:

 Operating system : Windows 7 Ultimate Service Pack 1 (x64)

Sorry for the late reply but I’ve been busy this evening.

I’d like you to run another scan.

Download and run AdwCleaner

Download AdwCleaner from here and save it to your desktop.

• run AdwCleaner
• when it has finished, select Clean
• if it asks to reboot, allow the reboot
• on reboot a log will be produced; please attach the content of the log to your next reply.

When you’ve done that, please run FRST again and send a new log with the AdwCleaner log.

Thanks

Satchfan

 

AdwCleaner:

 Operating system : Windows 7 Ultimate Service Pack 1 (x64)

AdwCleaner:

 Operating system : Windows 7 Ultimate Service Pack 1 (x64)

AdwCleaner:

 Operating system : Windows 7 Ultimate Service Pack 1 (x64)

Sorry for the late reply but I’ve been busy this evening.

I’d like you to run another scan.

Download and run AdwCleaner

Download AdwCleaner from here and save it to your desktop.

• run AdwCleaner
• when it has finished, select Clean
• if it asks to reboot, allow the reboot
• on reboot a log will be produced; please attach the content of the log to your next reply.

When you’ve done that, please run FRST again and send a new log with the AdwCleaner log.

Thanks

Satchfan

 

AdwCleaner:

 Operating system : Windows 7 Ultimate Service Pack 1 (x64)

AdwCleaner:

 Operating system : Windows 7 Ultimate Service Pack 1 (x64)

AdwCleaner:

 Operating system : Windows 7 Ultimate Service Pack 1 (x64)

AdwCleaner:

 Operating system : Windows 7 Ultimate Service Pack 1 (x64)