Spyware / Malware / Virus Removal

Malware Infection [Closed]

3 min read

Looking for the outcome? Ask AI

bagahan Topic Starter

Post #1July 17, 2015, 1:36 PM UTC

Thanks in advance for the support!

I'm not sure if it's a specific type of Malware because various pop-ups appear. The main one might be adcash.com

I commonly get the pop-up "There is a .net frame work file missing…" with the blue background that says to call a phone # to address the issue

I have tried all the basic fixes like looking for programs/chrome extensions to remove (none appear), using malware bytes, adw cleaner, junk removal tool, etc.

The pop-ups appear to happen when clicking on links within websites. Usually when i first access a website, there's no pop-up.

Please let me know how to proceed

-Brenton

ken545

Post #2July 18, 2015, 2:53 PM UTC

The problem with you running those tools on your own is that I dont know what it found and removed, if it removed anything at all, this leaves me in the dark, did you have AdwCleaner just scan or to clean, you can find the report here, post it please

C:\AdwCleaner[S1].txt

You can also find the report for Malwarebytes like this, did it remove what it found ?? Seeing these reports will give a clue about what we might be dealing with

Open Malwarebytes and on the Dashboard click on History….then Application Logs ….Then Scan log and select the date of the scan you just ran….then click Export and on the dropdown list select Copy to Clipboard and paste it into this thread

Please download Farbar Recovery Scan Tool and save it to your DESKTOP

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

How to determine whether a computer is running a 32-bit version or 64-bit version of the Windows operating system

A simple way to check your system: Start –> Computer (right click) –> Properties

[external image: FRST_zps5d956a1a.jpg]

Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.

Please make sure All Users is checked

Just keep the defaults as in the picture checkmarked

Press Scan button.

It will produce a log called FRST.txt in the same directory the tool is run from.

Please copy and paste log back here.

The first time the tool is run it generates another log (Addition.txt - also located in the same directory as FRST.exe/FRST64.exe). Please also paste that along with the FRST.txt into your reply.

bagahan

Post #3July 18, 2015, 7:58 PM UTC

My apologies Ken545! I've never had to turn to a forum for help because I can usually remove these things myself. Apparently not on this 1!

My apologies again, and thanks so much for the help!

We think the issue might be related to the router/network since the pop-ups appear to be happening on multiple devices.

Here are the various logs you requested:

Here's the ADW Log (it was [S0] instead of [S1] )

# AdwCleaner v4.208 - Logfile created 16/07/2015 at 22:47:18

# Updated 09/07/2015 by Xplode

# Database : 2015-07-15.1 [Server]

# Operating system : Windows 7 Professional Service Pack 1 (x64)

# Username : Brenton - BRENTON-PC

# Running from : C:\Users\Brenton\Downloads\adwcleaner_4.208.exe

# Option : Cleaning

***** [ Services ] *****

***** [ Files / Folders ] *****

Folder Deleted : C:\ProgramData\apn

Folder Deleted : C:\Users\Brenton\AppData\Local\Google\Chrome\User Data\Default\Extensions\niloccemoadcdkdjlinkgdfekeahmflj

Folder Deleted : C:\Users\Brenton\AppData\Local\Google\Chrome\User Data\Default\Extensions\pbjikboenpfhbbejgkoklgkhjpfogcam

File Deleted : C:\Users\Brenton\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_niloccemoadcdkdjlinkgdfekeahmflj_0.localstorage

File Deleted : C:\Users\Brenton\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_niloccemoadcdkdjlinkgdfekeahmflj_0.localstorage-journal

File Deleted : C:\Users\Brenton\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pbjikboenpfhbbejgkoklgkhjpfogcam

***** [ Scheduled tasks ] *****

***** [ Shortcuts ] *****

***** [ Registry ] *****

Key Deleted : HKCU\Software\Google\Chrome\Extensions\lmjegmlicamnimmfhcmpkclmigmmcbeh

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{6E993643-8FBC-44FE-BC85-D318495C4D96}

Key Deleted : HKCU\Software\Avg Secure Update

Key Deleted : HKCU\Software\AppDataLow\Software\adawarebp

Key Deleted : HKU\.DEFAULT\Software\Avg Secure Update

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\UN900120

Data Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyOverride] - *.local

***** [ Web browsers ] *****

-\\ Internet Explorer v11.0.9600.17909

-\\ Google Chrome v43.0.2357.134

[C:\Users\Brenton\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [Search Provider] : hxxp://search.aol.com/aol/search?q={searchTerms}

[C:\Users\Brenton\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [Search Provider] : hxxp://www.ask.com/web?q={searchTerms}

*************************

AdwCleaner[R0].txt - [2104 bytes] - [16/07/2015 05:59:03]

AdwCleaner[R1].txt - [2406 bytes] - [16/07/2015 22:46:09]

AdwCleaner[S0].txt - [2310 bytes] - [16/07/2015 22:47:18]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [2369 bytes] ##########

MALWARE BYTES LOG (didn't find anything)

Malwarebytes Anti-Malware

www.malwarebytes.org

Scan Date: 7/17/2015

Scan Time: 12:50 AM

Logfile:

Administrator: Yes

Version: 2.1.8.1057

Malware Database: v2015.07.17.01

Rootkit Database: v2015.07.16.01

License: Free

Malware Protection: Disabled

Malicious Website Protection: Disabled

Self-protection: Disabled

OS: Windows 7 Service Pack 1

CPU: x64

File System: NTFS

User: Brenton

Scan Type: Threat Scan

Result: Completed

Objects Scanned: 372842

Time Elapsed: 7 min, 38 sec

Memory: Enabled

Startup: Enabled

Filesystem: Enabled

Archives: Enabled

Rootkits: Disabled

Heuristics: Enabled

PUP: Enabled

PUM: Enabled

Processes: 0

(No malicious items detected)

Modules: 0

(No malicious items detected)

Registry Keys: 0

(No malicious items detected)

Registry Values: 0

(No malicious items detected)

Registry Data: 0

(No malicious items detected)

Folders: 0

(No malicious items detected)

Files: 0

(No malicious items detected)

Physical Sectors: 0

(No malicious items detected)

(end)

FRST log

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:18-07-2015 01

Ran by [removed] (administrator) on BRENTON-PC on 18-07-2015 12:52:57

Running from C:\Users\[removed]\Desktop

[removed]

Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: English (United States)

Internet Explorer Version 11 (Default browser: Chrome)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgrsa.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgcsrva.exe

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe

(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgidsagent.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgwdsvc.exe

() C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.7.485.8398\AdAwareService.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgnsa.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgemca.exe

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe

(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

(Intel Corporation) C:\Windows\System32\igfxtray.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe

(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe

() C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.7.485.8398\AdAwareTray.exe

(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe

(Spotify Ltd) C:\Users\Brenton\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe

(Plex, Inc.) C:\Program Files (x86)\Plex\Plex Media Server\Plex Media Server.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

() C:\Program Files (x86)\TP-LINK\TP-LINK Wireless Configuration Utility\TWCU.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgui.exe

(Wondershare) C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe

(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe

(Python Software Foundation) C:\Program Files (x86)\Plex\Plex Media Server\PlexScriptHost.exe

(Plex, Inc.) C:\Program Files (x86)\Plex\Plex Media Server\PlexDlnaServer.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\…\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [1337000 2015-04-30] (Microsoft Corporation)

HKLM\…\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [169768 2015-04-07] (Apple Inc.)

HKLM\…\Run: [] => [X]

HKLM\…\Run: [AdAwareTray] => C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.7.485.8398\AdAwareTray.exe [9549808 2015-06-24] ()

HKLM-x32\…\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [285240 2012-09-01] (Intel Corporation)

HKLM-x32\…\Run: [AVG_UI] => C:\Program Files (x86)\AVG\AVG2015\avgui.exe [3730344 2015-06-30] (AVG Technologies CZ, s.r.o.)

HKLM-x32\…\Run: [Wondershare Helper Compact.exe] => C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe [2072928 2014-10-31] (Wondershare)

Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)

HKU\S-1-5-21-1656001472-1405054058-1540687034-1000\…\Run: [GoogleDriveSync] => C:\Program Files (x86)\Google\Drive\googledrivesync.exe [21969480 2015-05-19] (Google)

HKU\S-1-5-21-1656001472-1405054058-1540687034-1000\…\Run: [Spotify Web Helper] => C:\Users\Brenton\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1514040 2014-11-22] (Spotify Ltd)

HKU\S-1-5-21-1656001472-1405054058-1540687034-1000\…\Run: [Plex Media Server] => C:\Program Files (x86)\Plex\Plex Media Server\Plex Media Server.exe [5961864 2015-06-03] (Plex, Inc.)

HKU\S-1-5-21-1656001472-1405054058-1540687034-1000\…\Run: [Google Update] => C:\Users\Brenton\AppData\Local\Google\Update\GoogleUpdate.exe [144200 2015-06-12] (Google Inc.)

HKU\S-1-5-21-1656001472-1405054058-1540687034-1000\…\Run: [GoogleChromeAutoLaunch_82C4ABCF143E349E2CDBAA74020E79F3] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [813896 2015-07-13] (Google Inc.)

HKU\S-1-5-18\…\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [301568 2013-06-16] (Microsoft Corporation)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\TP-LINK Wireless Configuration Utility.lnk [2015-02-10]

ShortcutTarget: TP-LINK Wireless Configuration Utility.lnk -> C:\Program Files (x86)\TP-LINK\TP-LINK Wireless Configuration Utility\TWCU.exe ()

BootExecute: autocheck autochk * sdnclean64.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-1656001472-1405054058-1540687034-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/?ocid=iehp

BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL [2010-01-21] (Microsoft Corporation)

BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)

BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2010-01-16] (Microsoft Corporation)

BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL [2010-01-21] (Microsoft Corporation)

BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll [2015-01-23] (Oracle Corporation)

BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)

BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2010-01-16] (Microsoft Corporation)

BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll [2015-01-23] (Oracle Corporation)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

Tcpip\..\Interfaces\{081BB81B-3F5B-4522-A359-6C239803B5BF}: [DhcpNameServer] [removed] [removed]

Tcpip\..\Interfaces\{1458768B-76FD-4E45-9372-82FE83384807}: [DhcpNameServer] 192.168.1.1

Tcpip\..\Interfaces\{193AB145-20A8-4E67-A956-236A7ADE56EF}: [DhcpNameServer] 192.168.42.129

Tcpip\..\Interfaces\{FDD97FD0-8C3C-4ADD-94AE-5F2829E37817}: [DhcpNameServer] 192.168.42.129

FireFox:

========

FF Plugin: @java.com/DTPlugin,version=10.21.2 -> C:\Windows\system32\npDeployJava1.dll [2013-05-21] (Oracle Corporation)

FF Plugin: @microsoft.com/GENUINE -> disabled No File

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-16] ( Microsoft Corporation)

FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)

FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-10-30] ()

FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll [2015-02-13] (Google, Inc.)

FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll [2015-01-23] (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll [2015-01-23] (Oracle Corporation)

FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL [2010-01-10] (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3508.0205 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2013-02-05] (Microsoft Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-16] (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-16] (Google Inc.)

FF Plugin-x32: @videolan.org/vlc,version=2.0.6 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-04-13] (VideoLAN)

FF Plugin-x32: @videolan.org/vlc,version=2.2.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-04-13] (VideoLAN)

FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-06-29] (Adobe Systems Inc.)

FF Plugin HKU\S-1-5-21-1656001472-1405054058-1540687034-1000: @tools.google.com/Google Update;version=3 -> C:\Users\Brenton\AppData\Local\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-16] (Google Inc.)

FF Plugin HKU\S-1-5-21-1656001472-1405054058-1540687034-1000: @tools.google.com/Google Update;version=9 -> C:\Users\Brenton\AppData\Local\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-16] (Google Inc.)

FF Plugin HKU\S-1-5-21-1656001472-1405054058-1540687034-1000: thehappycloud.com/HappyCloudPlugin -> C:\ProgramData\HappyCloud\Application\npHappyCloudPlugin.dll [2013-05-26] (The Happy Cloud)

Chrome:

=======

CHR Profile: C:\Users\Brenton\AppData\Local\Google\Chrome\User Data\Default

CHR Extension: (Easy Auto Refresh) - C:\Users\Brenton\AppData\Local\Google\Chrome\User Data\Default\Extensions\aabcgdmkeabbnleenpncegpcngjpnjkc [2015-07-16]

CHR Extension: (Google Slides) - C:\Users\Brenton\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-07-16]

CHR Extension: (Google Docs) - C:\Users\Brenton\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-07-16]

CHR Extension: (Google Drive) - C:\Users\Brenton\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-07-16]

CHR Extension: (YouTube) - C:\Users\Brenton\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-07-16]

CHR Extension: (Google Cast) - C:\Users\Brenton\AppData\Local\Google\Chrome\User Data\Default\Extensions\boadgeojelhgndaghljhdicfkmllpafd [2015-07-16]

CHR Extension: (Videostream for Google Chromecast™) - C:\Users\Brenton\AppData\Local\Google\Chrome\User Data\Default\Extensions\cnciopoikihiagdjbjpnocolokfelagl [2015-07-16]

CHR Extension: (Google Search) - C:\Users\Brenton\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-07-16]

CHR Extension: (Google Sheets) - C:\Users\Brenton\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-07-16]

CHR Extension: (SMS from Gmail™ & Facebook™ (MightyText)) - C:\Users\Brenton\AppData\Local\Google\Chrome\User Data\Default\Extensions\iffdacemhfpnchinokehhnppllonacfj [2015-07-16]

CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Brenton\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-07-16]

CHR Extension: (Application Launcher for Drive (by Google)) - C:\Users\Brenton\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmjegmlicamnimmfhcmpkclmigmmcbeh [2015-07-16]

CHR Extension: (Save to Pocket) - C:\Users\Brenton\AppData\Local\Google\Chrome\User Data\Default\Extensions\niloccemoadcdkdjlinkgdfekeahmflj [2015-07-16]

CHR Extension: (Google Wallet) - C:\Users\Brenton\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-07-16]

CHR Extension: (Amazon 1Button App for Chrome) - C:\Users\Brenton\AppData\Local\Google\Chrome\User Data\Default\Extensions\pbjikboenpfhbbejgkoklgkhjpfogcam [2015-07-17]

CHR Extension: (Gmail) - C:\Users\Brenton\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-07-16]

CHR HKU\S-1-5-21-1656001472-1405054058-1540687034-1000\SOFTWARE\Google\Chrome\Extensions\…\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh] - https://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77128 2015-01-19] (Apple Inc.)

R2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2015\avgidsagent.exe [3518376 2015-06-30] (AVG Technologies CZ, s.r.o.)

R2 avgwd; C:\Program Files (x86)\AVG\AVG2015\avgwdsvc.exe [314304 2015-06-30] (AVG Technologies CZ, s.r.o.)

S3 Futuremark SystemInfo Service; C:\Program Files (x86)\Futuremark\SystemInfo\FMSISvc.exe [344288 2015-03-20] (Futuremark)

S3 HPSLPSVC; C:\Users\Brenton\AppData\Local\Temp\7zS326E\hpslpsvc64.dll [1039360 2013-02-06] (Hewlett-Packard Co.) [File not signed]

R2 LavasoftAdAwareService11; C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.7.485.8398\AdAwareService.exe [716664 2015-06-24] ()

S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1133880 2015-06-18] (Malwarebytes Corporation)

R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23816 2015-04-30] (Microsoft Corporation)

R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [366544 2015-04-30] (Microsoft Corporation)

S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-26] (Microsoft Corporation)

S3 WsDrvInst; "C:\Program Files (x86)\Wondershare\MobileTrans\DriverInstall.exe" [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 amdkmdag; C:\Windows\System32\DRIVERS\atikmdag.sys [18959360 2014-11-20] (Advanced Micro Devices, Inc.) [File not signed]

S3 amdkmdap; C:\Windows\System32\DRIVERS\atikmpag.sys [589312 2014-11-20] (Advanced Micro Devices, Inc.) [File not signed]

R0 asahci64; C:\Windows\System32\DRIVERS\asahci64.sys [49760 2011-09-21] (Asmedia Technology)

S3 AtiHDAudioService; C:\Windows\System32\drivers\AtihdW76.sys [94720 2014-06-21] (Advanced Micro Devices) [File not signed]

R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [162784 2015-03-11] (AVG Technologies CZ, s.r.o.)

R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [293296 2015-06-26] (AVG Technologies CZ, s.r.o.)

R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [253408 2015-05-12] (AVG Technologies CZ, s.r.o.)

R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [259040 2015-06-16] (AVG Technologies CZ, s.r.o.)

R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [378336 2015-05-07] (AVG Technologies CZ, s.r.o.)

R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [226784 2015-06-10] (AVG Technologies CZ, s.r.o.)

R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [40928 2015-03-20] (AVG Technologies CZ, s.r.o.)

R1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [281568 2015-05-12] (AVG Technologies CZ, s.r.o.)

R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28216 2012-09-01] (Intel Corporation)

R3 ISCT; C:\Windows\System32\DRIVERS\ISCTD64.sys [46568 2013-01-19] ()

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-06-18] (Malwarebytes Corporation)

S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-06-18] (Malwarebytes Corporation)

R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [280376 2015-03-04] (Microsoft Corporation)

R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [124568 2015-03-04] (Microsoft Corporation)

R3 RTL8192cu; C:\Windows\System32\DRIVERS\RTL8192cu.sys [926824 2013-03-12] (Realtek Semiconductor Corporation )

S3 Trufos; C:\Windows\System32\DRIVERS\Trufos.sys [452040 2015-01-22] (BitDefender S.R.L.)

S3 ucgnsta; C:\Windows\System32\DRIVERS\ucgnstax.sys [987648 2009-08-05] (Ralink Technology Corp.)

S3 AsrCDDrv; \??\C:\Windows\SysWOW64\Drivers\AsrCDDrv.sys [X]

S3 cpuz138; \??\C:\Windows\TEMP\cpuz138\cpuz138_x64.sys [X]

S3 GPUZ; \??\C:\Windows\TEMP\GPUZ.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-07-18 12:52 - 2015-07-18 12:53 - 00018982 _____ C:\Users\Brenton\Desktop\FRST.txt

2015-07-18 12:51 - 2015-07-18 12:52 - 00000000 ____D C:\FRST

2015-07-18 12:50 - 2015-07-18 12:50 - 02134528 _____ (Farbar) C:\Users\Brenton\Downloads\FRST64.exe

2015-07-18 12:50 - 2015-07-18 12:50 - 02134528 _____ (Farbar) C:\Users\Brenton\Desktop\FRST64.exe

2015-07-17 23:44 - 2015-07-18 08:40 - 00003244 _____ C:\Windows\System32\Tasks\IORRT

2015-07-17 06:15 - 2015-07-17 06:20 - 00000000 ____D C:\ProgramData\HitmanPro

2015-07-17 06:14 - 2015-07-17 06:15 - 11032736 _____ (SurfRight B.V.) C:\Users\Brenton\Downloads\HitmanPro_x64.exe

2015-07-17 00:38 - 2015-07-17 00:38 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2015-07-17 00:38 - 2015-06-18 08:41 - 00109272 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2015-07-17 00:38 - 2015-06-18 08:41 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2015-07-17 00:38 - 2015-06-18 08:41 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2015-07-17 00:35 - 2015-07-17 00:35 - 24345872 _____ (Malwarebytes Corporation ) C:\Users\Brenton\Downloads\mbam-setup-2.1.8.1057.exe

2015-07-17 00:27 - 2015-07-17 00:27 - 01798288 _____ (Malwarebytes Corporation) C:\Users\Brenton\Downloads\JRT.exe

2015-07-17 00:26 - 2015-07-17 00:27 - 63344904 _____ (PortableApps.com) C:\Users\Brenton\Downloads\SpybotPortable_2.4.paf (1).exe

2015-07-17 00:00 - 2015-07-17 00:00 - 00000000 ____D C:\Users\Brenton\Downloads\SpybotPortable

2015-07-16 23:58 - 2015-07-16 23:59 - 63344904 _____ (PortableApps.com) C:\Users\Brenton\Downloads\SpybotPortable_2.4.paf.exe

2015-07-16 23:51 - 2015-07-16 23:51 - 00002259 _____ C:\Users\Public\Desktop\Google Chrome.lnk

2015-07-16 23:51 - 2015-07-16 23:51 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome

2015-07-16 23:51 - 2015-07-16 23:51 - 00000000 ____D C:\Program Files (x86)\GUM8229.tmp

2015-07-16 23:20 - 2015-07-16 23:20 - 00000000 _____ C:\autoexec.bat

2015-07-16 23:12 - 2015-07-16 23:13 - 00000000 ____D C:\Program Files (x86)\GUM41EF.tmp

2015-07-16 07:15 - 2015-07-16 07:15 - 00000000 ____D C:\Users\Brenton\AppData\Local\GWX

2015-07-16 06:20 - 2015-07-18 09:17 - 00113880 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2015-07-16 06:19 - 2015-07-17 00:38 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware

2015-07-16 06:19 - 2015-07-16 06:19 - 00000000 ____D C:\ProgramData\Malwarebytes

2015-07-16 06:06 - 2015-07-16 06:06 - 03839960 _____ (AVAST Software) C:\Users\Brenton\Downloads\avast-browser-cleanup-sfx.exe

2015-07-16 06:06 - 2015-07-16 06:06 - 00000000 ____D C:\Users\Brenton\AppData\Roaming\AVAST Software

2015-07-16 05:58 - 2015-07-16 22:47 - 00000000 ____D C:\AdwCleaner

2015-07-16 00:01 - 2015-07-16 00:01 - 00000000 ____D C:\ProgramData\Sophos

2015-07-16 00:00 - 2015-07-16 00:00 - 00000000 ____D C:\Program Files (x86)\Sophos

2015-07-15 23:33 - 2015-07-15 23:33 - 00000274 _____ C:\Users\Brenton\Downloads\debug.log

2015-07-15 23:25 - 2015-07-15 23:26 - 00668702 _____ C:\Users\Brenton\Downloads\MacKeeper.pkg

2015-07-15 22:13 - 2015-07-15 22:15 - 00000000 ____D C:\Program Files (x86)\GUM9AF7.tmp

2015-06-29 15:34 - 2015-06-29 15:34 - 00020910 _____ C:\Users\Brenton\Downloads\[kat.cr]girl.meets.world.season.1.w4f.qcf.torrent

2015-06-29 15:34 - 2015-06-29 15:34 - 00020910 _____ C:\Users\Brenton\Downloads\[kat.cr]girl.meets.world.season.1.w4f.qcf (1).torrent

2015-06-29 08:59 - 2015-07-16 22:59 - 00000000 ____D C:\Program Files\Common Files\AV

2015-06-28 14:06 - 2015-06-28 14:06 - 00053048 _____ C:\Users\Brenton\Downloads\[kat.cr]girl.meets.world.season.1.complete.bonus.episode.1080p.torrent

2015-06-28 14:06 - 2015-06-28 14:06 - 00053048 _____ C:\Users\Brenton\Downloads\[kat.cr]girl.meets.world.season.1.complete.bonus.episode.1080p (1).torrent

2015-06-28 13:29 - 2015-07-16 23:02 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lavasoft

2015-06-28 13:28 - 2015-07-16 22:59 - 00000000 ____D C:\Program Files\Common Files\Lavasoft

2015-06-28 13:26 - 2015-06-28 13:26 - 02009904 _____ C:\Users\Brenton\Downloads\Adaware_Installer (1).exe

2015-06-26 09:49 - 2015-06-26 09:49 - 00293296 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgidsdrivera.sys

2015-06-18 23:47 - 2015-06-18 23:47 - 00057453 _____ C:\Users\Brenton\Downloads\[kat.cr]silicon.valley.s02e10.720p.hdtv.x264.0sec.rartv.torrent

2015-06-18 23:44 - 2015-06-18 23:44 - 00061791 _____ C:\Users\Brenton\Downloads\[kat.cr]game.of.thrones.s05e10.1080p.hdtv.x264.batv.rartv.torrent

2015-06-18 23:44 - 2015-06-18 23:44 - 00061791 _____ C:\Users\Brenton\Downloads\[kat.cr]game.of.thrones.s05e10.1080p.hdtv.x264.batv.rartv (1).torrent

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-07-18 12:20 - 2013-06-28 10:52 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job

2015-07-18 12:17 - 2015-06-12 16:02 - 00000916 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1656001472-1405054058-1540687034-1000UA.job

2015-07-18 12:17 - 2013-05-20 13:59 - 00000898 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2015-07-18 11:47 - 2015-03-31 21:29 - 00000000 ____D C:\ProgramData\MFAData

2015-07-18 08:48 - 2009-07-13 21:45 - 00019168 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2015-07-18 08:48 - 2009-07-13 21:45 - 00019168 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2015-07-18 08:44 - 2009-07-13 22:13 - 00783606 _____ C:\Windows\system32\PerfStringBackup.INI

2015-07-18 08:43 - 2013-05-20 13:33 - 01980485 _____ C:\Windows\WindowsUpdate.log

2015-07-18 08:41 - 2015-01-03 13:48 - 00000000 ___RD C:\Users\Brenton\Google Drive

2015-07-18 08:41 - 2013-05-20 13:59 - 00000894 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2015-07-18 08:40 - 2009-07-13 22:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2015-07-18 08:40 - 2009-07-13 21:51 - 00108573 _____ C:\Windows\setupact.log

2015-07-18 00:20 - 2013-06-28 10:52 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2015-07-18 00:20 - 2013-06-28 10:52 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2015-07-18 00:20 - 2013-06-28 10:52 - 00003768 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater

2015-07-17 23:44 - 2013-05-20 14:03 - 00037074 _____ C:\Windows\PFRO.log

2015-07-16 23:51 - 2013-05-20 13:59 - 00000000 ____D C:\Users\Brenton\AppData\Local\Google

2015-07-16 23:51 - 2013-05-20 13:59 - 00000000 ____D C:\Program Files (x86)\Google

2015-07-16 23:17 - 2015-06-12 16:02 - 00000864 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1656001472-1405054058-1540687034-1000Core.job

2015-07-16 23:13 - 2015-06-13 10:16 - 00000000 ____D C:\Users\Brenton\AppData\Local\CrashDumps

2015-07-16 23:12 - 2015-06-12 16:02 - 00003890 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1656001472-1405054058-1540687034-1000UA

2015-07-16 23:12 - 2015-06-12 16:02 - 00003494 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1656001472-1405054058-1540687034-1000Core

2015-07-16 23:12 - 2013-05-20 13:59 - 00003894 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA

2015-07-16 23:12 - 2013-05-20 13:59 - 00003642 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore

2015-07-16 23:07 - 2013-05-20 13:31 - 00000000 ____D C:\Users\Brenton

2015-07-16 23:03 - 2015-01-03 13:48 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive

2015-07-16 23:03 - 2013-05-25 11:38 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office

2015-07-16 23:02 - 2015-06-12 16:03 - 00000000 ____D C:\Users\Brenton\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chromecast

2015-07-16 23:02 - 2015-06-10 18:58 - 00000000 ____D C:\ProgramData\E1864A66-75E3-486a-BD95-D1B7D99A84A7

2015-07-16 23:02 - 2015-06-07 15:26 - 00000000 ____D C:\Users\Brenton\AppData\Local\Plex Media Server

2015-07-16 23:02 - 2015-06-07 15:26 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Plex Media Server

2015-07-16 23:02 - 2015-06-01 19:46 - 00000000 ____D C:\Program Files\GIMP 2

2015-07-16 23:02 - 2015-05-30 10:09 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Picasa 3

2015-07-16 23:02 - 2015-05-02 23:29 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes

2015-07-16 23:02 - 2015-05-02 23:29 - 00000000 ____D C:\Program Files\iTunes

2015-07-16 23:02 - 2015-05-02 23:29 - 00000000 ____D C:\Program Files\iPod

2015-07-16 23:02 - 2015-05-02 23:29 - 00000000 ____D C:\Program Files (x86)\iTunes

2015-07-16 23:02 - 2015-04-14 21:51 - 00000000 ___SD C:\Windows\system32\CompatTel

2015-07-16 23:02 - 2015-04-14 21:51 - 00000000 ____D C:\Windows\system32\appraiser

2015-07-16 23:02 - 2015-04-01 21:26 - 00000000 ____D C:\ProgramData\Avg_Update_0215pi

2015-07-16 23:02 - 2015-03-31 21:31 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG

2015-07-16 23:02 - 2015-03-27 23:05 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Futuremark

2015-07-16 23:02 - 2015-03-27 22:52 - 00000000 ___SD C:\Windows\SysWOW64\GWX

2015-07-16 23:02 - 2015-03-27 22:52 - 00000000 ___SD C:\Windows\system32\GWX

2015-07-16 23:02 - 2015-03-26 20:41 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CPUID

2015-07-16 23:02 - 2015-03-26 20:34 - 00000000 ____D C:\Users\Brenton\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AMD

2015-07-16 23:02 - 2015-03-26 20:33 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GPU Temp

2015-07-16 23:02 - 2015-03-26 20:33 - 00000000 ____D C:\Program Files (x86)\GPU Temp

2015-07-16 23:02 - 2015-03-26 00:44 - 00000000 ____D C:\ProgramData\Package Cache

2015-07-16 23:02 - 2015-03-26 00:44 - 00000000 ____D C:\Program Files\Common Files\ATI Technologies

2015-07-16 23:02 - 2015-02-10 20:43 - 00000000 ____D C:\Users\Brenton\AppData\Roaming\TP-LINK

2015-07-16 23:02 - 2015-02-10 20:42 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TP-LINK

2015-07-16 23:02 - 2015-01-15 00:56 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Samsung SSD 840 EVO Performance Restoration

2015-07-16 23:02 - 2015-01-15 00:56 - 00000000 ____D C:\Program Files (x86)\Samsung SSD 840 EVO Performance Restoration

2015-07-16 23:02 - 2014-11-29 00:33 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java

2015-07-16 23:02 - 2014-08-21 23:56 - 00000000 ___RD C:\Users\Public\Recorded TV

2015-07-16 23:02 - 2014-07-11 21:17 - 00000000 ___RD C:\Program Files (x86)\Skype

2015-07-16 23:02 - 2014-07-11 21:17 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype

2015-07-16 23:02 - 2014-06-30 21:40 - 00000000 ____D C:\Users\Brenton\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\TechPowerUp GPU-Z

2015-07-16 23:02 - 2014-06-30 21:40 - 00000000 ____D C:\Program Files (x86)\GPU-Z

2015-07-16 23:02 - 2014-06-18 17:25 - 00000000 ____D C:\Program Files (x86)\Origin

2015-07-16 23:02 - 2013-12-31 17:58 - 00000000 ____D C:\Windows\en

2015-07-16 23:02 - 2013-12-31 17:57 - 00000000 ____D C:\Program Files (x86)\Windows Live

2015-07-16 23:02 - 2013-12-31 17:53 - 00000000 ____D C:\Users\Brenton\Documents\DVD Photo Slideshow

2015-07-16 23:02 - 2013-12-31 17:50 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVD Photo Slideshow Professional

2015-07-16 23:02 - 2013-12-31 17:50 - 00000000 ____D C:\Program Files (x86)\DVD Photo Slideshow Professional

2015-07-16 23:02 - 2013-12-23 11:02 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AnvSoft

2015-07-16 23:02 - 2013-11-26 19:44 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2

2015-07-16 23:02 - 2013-11-23 23:49 - 00000000 ____D C:\Users\Brenton\.android

2015-07-16 23:02 - 2013-11-23 23:44 - 00000000 ____D C:\Android-adb

2015-07-16 23:02 - 2013-11-05 21:41 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Handbrake

2015-07-16 23:02 - 2013-11-05 21:41 - 00000000 ____D C:\Program Files\Handbrake

2015-07-16 23:02 - 2013-10-21 00:36 - 00000000 ____D C:\Users\Brenton\AppData\Local\gtk-2.0

2015-07-16 23:02 - 2013-09-02 12:23 - 00000000 ____D C:\Users\Brenton\Documents\FIFA 13 Demo

2015-07-16 23:02 - 2013-09-02 12:23 - 00000000 ____D C:\Users\Brenton\Documents\FIFA 13

2015-07-16 23:02 - 2013-07-30 22:17 - 00000000 ____D C:\Windows\SysWOW64\RTCOM

2015-07-16 23:02 - 2013-07-26 15:04 - 00000000 ____D C:\Users\Brenton\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\TERA

2015-07-16 23:02 - 2013-07-25 17:31 - 00000000 ____D C:\ProgramData\Apple Computer

2015-07-16 23:02 - 2013-07-25 17:29 - 00000000 ____D C:\ProgramData\Apple

2015-07-16 23:02 - 2013-07-25 17:29 - 00000000 ____D C:\Program Files\Common Files\Apple

2015-07-16 23:02 - 2013-07-25 17:29 - 00000000 ____D C:\Program Files\Bonjour

2015-07-16 23:02 - 2013-07-25 17:29 - 00000000 ____D C:\Program Files (x86)\Bonjour

2015-07-16 23:02 - 2013-07-25 17:29 - 00000000 ____D C:\Program Files (x86)\Apple Software Update

2015-07-16 23:02 - 2013-07-20 12:56 - 00000000 ____D C:\Users\Brenton\AppData\Roaming\Spotify

2015-07-16 23:02 - 2013-07-19 16:49 - 00000000 ____D C:\Windows\Minidump

2015-07-16 23:02 - 2013-07-19 16:19 - 00000000 ____D C:\Users\Brenton\AppData\Roaming\Ventrilo

2015-07-16 23:02 - 2013-07-19 16:19 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ventrilo

2015-07-16 23:02 - 2013-07-19 16:19 - 00000000 ____D C:\Program Files (x86)\Ventrilo

2015-07-16 23:02 - 2013-07-15 23:59 - 00000000 ____D C:\Users\Brenton\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Happy Cloud

2015-07-16 23:02 - 2013-06-28 10:52 - 00000000 ____D C:\Windows\SysWOW64\Macromed

2015-07-16 23:02 - 2013-06-28 10:52 - 00000000 ____D C:\Windows\system32\Macromed

2015-07-16 23:02 - 2013-06-26 02:03 - 00000000 ____D C:\Users\Brenton\AppData\Roaming\Skype

2015-07-16 23:02 - 2013-06-26 02:02 - 00000000 ____D C:\ProgramData\Skype

2015-07-16 23:02 - 2013-06-22 08:49 - 00000000 ____D C:\Users\Brenton\Desktop\Tools

2015-07-16 23:02 - 2013-06-22 08:48 - 00000000 ___HD C:\IORRT

2015-07-16 23:02 - 2013-06-19 00:52 - 00000000 ____D C:\Program Files (x86)\Microsoft Security Client

2015-07-16 23:02 - 2013-06-16 13:05 - 00000000 ____D C:\Windows\system32\SPReview

2015-07-16 23:02 - 2013-06-16 13:04 - 00000000 ____D C:\Windows\system32\EventProviders

2015-07-16 23:02 - 2013-06-09 13:05 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip

2015-07-16 23:02 - 2013-06-09 13:05 - 00000000 ____D C:\Program Files\7-Zip

2015-07-16 23:02 - 2013-06-02 17:06 - 00000000 ____D C:\Users\Brenton\Desktop\Videos that need to be Converted

2015-07-16 23:02 - 2013-05-25 11:38 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SharePoint

2015-07-16 23:02 - 2013-05-25 11:37 - 00000000 ____D C:\Windows\System32\Tasks\OfficeSoftwareProtectionPlatform

2015-07-16 23:02 - 2013-05-25 11:36 - 00000000 ____D C:\Users\Brenton\AppData\Local\Microsoft Help

2015-07-16 23:02 - 2013-05-25 11:36 - 00000000 ____D C:\ProgramData\Microsoft Help

2015-07-16 23:02 - 2013-05-22 11:42 - 00000000 ____D C:\Users\Brenton\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam

2015-07-16 23:02 - 2013-05-21 09:19 - 00000000 ____D C:\Users\Brenton\AppData\Roaming\vlc

2015-07-16 23:02 - 2013-05-21 09:16 - 00000000 ____D C:\Program Files (x86)\Pidgin

2015-07-16 23:02 - 2013-05-21 09:15 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN

2015-07-16 23:02 - 2013-05-21 09:15 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\K-Lite Codec Pack

2015-07-16 23:02 - 2013-05-21 09:15 - 00000000 ____D C:\Program Files (x86)\K-Lite Codec Pack

2015-07-16 23:02 - 2013-05-21 09:13 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\K-Lite Codec Pack x64

2015-07-16 23:02 - 2013-05-21 09:13 - 00000000 ____D C:\Program Files\K-Lite Codec Pack x64

2015-07-16 23:02 - 2013-05-21 09:12 - 00000000 ____D C:\Users\Brenton\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR

2015-07-16 23:02 - 2013-05-21 09:12 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR

2015-07-16 23:02 - 2013-05-21 09:12 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam

2015-07-16 23:02 - 2013-05-21 09:12 - 00000000 ____D C:\Program Files\WinRAR

2015-07-16 23:02 - 2013-05-21 09:11 - 00000000 ____D C:\Users\Brenton\AppData\Roaming\uTorrent

2015-07-16 23:02 - 2013-05-21 09:11 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight

2015-07-16 23:02 - 2013-05-21 09:11 - 00000000 ____D C:\Program Files (x86)\uTorrent

2015-07-16 23:02 - 2013-05-21 09:10 - 00000000 ____D C:\Program Files\Microsoft Silverlight

2015-07-16 23:02 - 2013-05-21 09:10 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight

2015-07-16 23:02 - 2013-05-20 13:52 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BUFFALO

2015-07-16 23:02 - 2013-05-20 13:47 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Intel

2015-07-16 23:02 - 2013-05-20 13:46 - 00000000 ____D C:\Program Files (x86)\ASM106xSATA

2015-07-16 23:02 - 2013-05-20 13:45 - 00000000 ____D C:\Program Files\Broadcom

2015-07-16 23:02 - 2013-05-20 13:44 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Asmedia Technology

2015-07-16 23:02 - 2013-05-20 13:44 - 00000000 ____D C:\Program Files (x86)\ASM104xUSB3

2015-07-16 23:02 - 2013-05-20 13:31 - 00000000 ___RD C:\Users\Brenton\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance

2015-07-16 23:02 - 2013-05-20 13:31 - 00000000 ___RD C:\Users\Brenton\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories

2015-07-16 23:02 - 2009-07-14 00:46 - 00000000 ____D C:\Windows\ShellNew

2015-07-16 23:02 - 2009-07-13 22:32 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games

2015-07-16 23:02 - 2009-07-13 22:32 - 00000000 ____D C:\Windows\Offline Web Pages

2015-07-16 23:02 - 2009-07-13 22:32 - 00000000 ____D C:\Program Files\Windows Sidebar

2015-07-16 23:02 - 2009-07-13 22:32 - 00000000 ____D C:\Program Files (x86)\Windows Sidebar

2015-07-16 23:02 - 2009-07-13 22:32 - 00000000 ____D C:\Program Files (x86)\MSBuild

2015-07-16 23:02 - 2009-07-13 21:45 - 00000000 ____D C:\Windows\Setup

2015-07-16 23:02 - 2009-07-13 20:20 - 00000000 __RSD C:\Windows\Media

2015-07-16 23:02 - 2009-07-13 20:20 - 00000000 __RHD C:\Users\Public\Libraries

2015-07-16 23:02 - 2009-07-13 20:20 - 00000000 ___RD C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance

2015-07-16 23:02 - 2009-07-13 20:20 - 00000000 ___RD C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories

2015-07-16 23:02 - 2009-07-13 20:20 - 00000000 ___RD C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance

2015-07-16 23:02 - 2009-07-13 20:20 - 00000000 ___RD C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories

2015-07-16 23:02 - 2009-07-13 20:20 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance

2015-07-16 23:02 - 2009-07-13 20:20 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories

2015-07-16 23:02 - 2009-07-13 20:20 - 00000000 ____D C:\Windows\TAPI

2015-07-16 23:02 - 2009-07-13 20:20 - 00000000 ____D C:\Windows\SysWOW64\Recovery

2015-07-16 23:02 - 2009-07-13 20:20 - 00000000 ____D C:\Windows\SysWOW64\GroupPolicy

2015-07-16 23:02 - 2009-07-13 20:20 - 00000000 ____D C:\Windows\system32\NDF

2015-07-16 23:02 - 2009-07-13 20:20 - 00000000 ____D C:\Windows\system32\Msdtc

2015-07-16 23:02 - 2009-07-13 20:20 - 00000000 ____D C:\Windows\system32\ias

2015-07-16 23:02 - 2009-07-13 20:20 - 00000000 ____D C:\Windows\system32\AdvancedInstallers

2015-07-16 23:02 - 2009-07-13 20:20 - 00000000 ____D C:\Windows\servicing

2015-07-16 23:02 - 2009-07-13 20:20 - 00000000 ____D C:\Windows\security

2015-07-16 23:02 - 2009-07-13 20:20 - 00000000 ____D C:\Windows\rescache

2015-07-16 23:02 - 2009-07-13 20:20 - 00000000 ____D C:\Windows\PolicyDefinitions

2015-07-16 23:02 - 2009-07-13 20:20 - 00000000 ____D C:\Windows\AppCompat

2015-07-16 23:02 - 2009-07-13 20:20 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared

2015-07-16 23:01 - 2009-07-13 20:20 - 00000000 ____D C:\Windows\registration

2015-07-16 22:59 - 2015-06-07 15:26 - 00000000 ____D C:\Program Files (x86)\Plex

2015-07-16 22:59 - 2015-05-28 19:33 - 00000000 ____D C:\Program Files\Lavasoft

2015-07-16 22:59 - 2015-03-31 21:31 - 00000000 ____D C:\ProgramData\AVG2015

2015-07-16 22:59 - 2013-06-19 00:52 - 00000000 ____D C:\Program Files\Microsoft Security Client

2015-07-15 23:45 - 2014-11-29 00:00 - 00000000 __SHD C:\Users\Brenton\AppData\Local\EmieBrowserModeList

2015-07-15 23:45 - 2014-04-20 16:50 - 00000000 __SHD C:\Users\Brenton\AppData\Local\EmieUserList

2015-07-15 23:45 - 2014-04-20 16:50 - 00000000 __SHD C:\Users\Brenton\AppData\Local\EmieSiteList

2015-07-14 23:04 - 2013-07-10 23:37 - 00000000 ____D C:\Windows\system32\MRT

2015-07-14 22:37 - 2013-06-17 11:16 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk

2015-07-14 22:36 - 2014-12-24 11:15 - 00003886 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task

2015-07-05 03:08 - 2013-05-20 14:28 - 00300704 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe

==================== Files in the root of some directories =======

2015-05-28 20:07 - 2015-05-28 20:07 - 0000036 _____ () C:\Users\Brenton\AppData\Local\housecall.guid.cache

2015-06-02 19:09 - 2015-06-02 19:09 - 0017435 _____ () C:\Users\Brenton\AppData\Local\recently-used.xbel

Some files in TEMP:

====================

C:\Users\Brenton\AppData\Local\Temp\handbrake-setup.exe

C:\Users\Brenton\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe

C:\Users\Brenton\AppData\Local\Temp\jre-8u31-windows-au.exe

C:\Users\Brenton\AppData\Local\Temp\ose00000.exe

C:\Users\Brenton\AppData\Local\Temp\sfamcc00001.dll

C:\Users\Brenton\AppData\Local\Temp\sfextra.dll

C:\Users\Brenton\AppData\Local\Temp\utt470D.tmp.exe

C:\Users\Brenton\AppData\Local\Temp\utt85CE.tmp.exe

C:\Users\Brenton\AppData\Local\Temp\uttA0FF.tmp.exe

C:\Users\Brenton\AppData\Local\Temp\uttABC4.tmp.exe

C:\Users\Brenton\AppData\Local\Temp\uttD72E.tmp.exe

C:\Users\Brenton\AppData\Local\Temp\uttFDF8.tmp.exe

C:\Users\Brenton\AppData\Local\Temp\vcredist_x64.exe

C:\Users\Brenton\AppData\Local\Temp\vcredist_x86.exe

C:\Users\Brenton\AppData\Local\Temp\vlc-2.1.5-win32.exe

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\SysWOW64\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2015-07-13 23:16

==================== End of log ============================

ADDITION LOG

Additional scan result of Farbar Recovery Scan Tool (x64) Version:18-07-2015 01

Ran by [removed] at 2015-07-18 12:53:16

Running from C:\Users\[removed]\Desktop

Boot Mode: Normal

==========================================================

==================== Accounts: =============================

Administrator (S-1-5-21-1656001472-1405054058-1540687034-500 - Administrator - Disabled)

Brenton (S-1-5-21-1656001472-1405054058-1540687034-1000 - Administrator - Enabled) => C:\Users\Brenton

Guest (S-1-5-21-1656001472-1405054058-1540687034-501 - Limited - Enabled)

HomeGroupUser$ (S-1-5-21-1656001472-1405054058-1540687034-1004 - Limited - Enabled)

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Ad-Aware Antivirus (Disabled - Out of date) {D87B6541-12A1-DAEA-0033-9B8057AAB996}

AV: Microsoft Security Essentials (Enabled - Up to date) {B7ECF8CD-0188-6703-DBA4-AA65C6ACFB0A}

AV: AVG AntiVirus Free Edition 2015 (Enabled - Up to date) {4D41356F-32AD-7C42-C820-63775EE4F413}

AS: Ad-Aware Antivirus (Disabled - Out of date) {631A84A5-349B-D564-3A83-A0F22C2DF32B}

AS: Microsoft Security Essentials (Enabled - Up to date) {0C8D1929-27B2-688D-E114-9117BD2BB1B7}

AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: AVG AntiVirus Free Edition 2015 (Enabled - Up to date) {F620D48B-1497-73CC-F290-58052563BEAE}

FW: Ad-Aware Firewall (Disabled) {E040E464-58CE-DBB2-2B6C-32B5A979FEED}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

µTorrent (HKU\S-1-5-21-1656001472-1405054058-1540687034-1000\…\uTorrent) (Version: 3.4.2.36802 - BitTorrent Inc.)

3DMark (HKLM-x32\…\{66847f67-7331-422f-bc6c-d961c453d7df}) (Version: 1.5.884.0 - Futuremark)

3DMark (Version: 1.5.884.0 - Futuremark) Hidden

7-Zip 9.20 (x64 edition) (HKLM\…\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)

Ad-Aware Antivirus (HKLM\…\{A041066D-37EF-46FC-9DF7-465A07F1C5CF}_AdAwareUpdater) (Version: 11.7.485.8398 - Lavasoft)

AdAwareInstaller (Version: 11.7.485.8398 - Lavasoft) Hidden

AdAwareUpdater (Version: 11.7.485.8398 - Lavasoft) Hidden

Adobe AIR (HKLM-x32\…\Adobe AIR) (Version: 3.7.0.1860 - Adobe Systems Incorporated)

Adobe Flash Player 18 ActiveX (HKLM-x32\…\Adobe Flash Player ActiveX) (Version: 18.0.0.209 - Adobe Systems Incorporated)

Adobe Reader XI (11.0.12) (HKLM-x32\…\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.12 - Adobe Systems Incorporated)

Alien Swarm (HKLM-x32\…\Steam App 630) (Version: - Valve)

AMD Catalyst Install Manager (HKLM\…\{F2A7CE36-57BF-5C86-952D-90DBF3746D82}) (Version: 8.0.916.0 - Advanced Micro Devices, Inc.)

AMD System Monitor (HKLM-x32\…\{6EFD0C42-4CC1-4716-A0CA-21C1A062CF34}) (Version: 1.0.9 - Advanced Micro Devices, Inc.)

AntimalwareEngine (Version: 3.0.98.0 - Lavasoft) Hidden

Any Video Converter 5.5.3 (HKLM-x32\…\Any Video Converter_is1) (Version: - Any-Video-Converter.com)

Apple Application Support (32-bit) (HKLM-x32\…\{AFA1153A-F547-409B-B837-3A0D6C5A3FEC}) (Version: 3.1.3 - Apple Inc.)

Apple Application Support (64-bit) (HKLM\…\{D7B824DE-DA32-4772-9E5E-39C5158136A7}) (Version: 3.1.3 - Apple Inc.)

Apple Mobile Device Support (HKLM\…\{C4123106-B685-48E6-B9BD-E4F911841EB4}) (Version: 8.1.1.3 - Apple Inc.)

Apple Software Update (HKLM-x32\…\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)

Asmedia ASM104x USB 3.0 Host Controller Driver (HKLM-x32\…\{E4FB0B39-C991-4EE7-95DD-1A1A7857D33D}) (Version: 1.10.1.0 - Asmedia Technology)

Asmedia ASM106x SATA Host Controller Driver (HKLM-x32\…\{61942EF5-2CD8-47D4-869C-2E9A8BB085F1}) (Version: 1.3.1.000 - Asmedia Technology)

Auslogics DiskDefrag (HKLM-x32\…\{DF6A13C0-77DF-41FE-BD05-6D5201EB0CE7}_is1) (Version: 4.5.5.0 - Auslogics Labs Pty Ltd)

AVG 2015 (HKLM\…\AVG) (Version: 2015.0.6081 - AVG Technologies)

AVG 2015 (Version: 15.0.4392 - AVG Technologies) Hidden

AVG 2015 (Version: 15.0.6081 - AVG Technologies) Hidden

Bonjour (HKLM\…\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)

Broadcom NetLink Controller (HKLM\…\{C91DCB72-F5BB-410D-A91A-314F5D1B4284}) (Version: 14.8.5.1 - Broadcom Corporation)

BUFFALO AirStation Bandwidth Selection Tool (HKLM-x32\…\UN900120) (Version: - BUFFALO INC.)

ChromecastApp (HKU\S-1-5-21-1656001472-1405054058-1540687034-1000\…\{079ede36-133d-44b0-8053-c7c1fa8d2e0d}_is1) (Version: 1.5.1383.0 - Google Inc.)

Counter-Strike (HKLM-x32\…\Steam App 10) (Version: - Valve)

Counter-Strike: Global Offensive (HKLM-x32\…\Steam App 730) (Version: - Valve)

Counter-Strike: Source (HKLM-x32\…\Steam App 240) (Version: - Valve)

CPUID HWMonitor 1.27 (HKLM\…\CPUID HWMonitor_is1) (Version: - )

D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden

DVD Photo Slideshow Professional 8.07 (HKLM-x32\…\DVD Photo Slideshow Professional_is1) (Version: - dvd-photo-slideshow.com)

Futuremark SystemInfo (HKLM-x32\…\{79659071-4B68-4EC8-833C-49C97B68FCD0}) (Version: 4.36.512.0 - Futuremark)

GIMP 2.8.14 (HKLM\…\GIMP-2_is1) (Version: 2.8.14 - The GIMP Team)

Google Chrome (HKLM-x32\…\Google Chrome) (Version: 43.0.2357.134 - Google Inc.)

Google Drive (HKLM-x32\…\{CBC9F5FD-5CFA-4A33-81CD-369EAB77E3A6}) (Version: 1.22.9403.0223 - Google, Inc.)

Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden

Google Update Helper (x32 Version: 1.3.28.1 - Google Inc.) Hidden

GPU Temp version 1.0 (HKLM-x32\…\{8C8711FD-0FC8-4801-B33E-ED19BB0350B1}_is1) (Version: 1.0 - gputemp.com)

HandBrake 0.10.0 (HKLM-x32\…\HandBrake) (Version: 0.10.0 - )

Happy Cloud Client (HKU\S-1-5-21-1656001472-1405054058-1540687034-1000\…\HappyCloud) (Version: 3.36 - Happy Cloud, Inc.)

Intel(R) Processor Graphics (HKLM-x32\…\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.17.10.2932 - Intel Corporation)

Intel(R) Rapid Storage Technology (HKLM-x32\…\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.6.0.1030 - Intel Corporation)

Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\…\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 2.0.0.37149 - Intel Corporation)

iTunes (HKLM\…\{93F2A022-6C37-48B8-B241-FFABD9F60C30}) (Version: 12.1.2.27 - Apple Inc.)

Java 8 Update 31 (HKLM-x32\…\{26A24AE4-039D-4CA4-87B4-2F83218031F0}) (Version: 8.0.310 - Oracle Corporation)

K-Lite Codec Pack 9.9.0 (64-bit) (HKLM\…\KLiteCodecPack64_is1) (Version: 9.9.0 - )

K-Lite Codec Pack 9.9.0 (Full) (HKLM-x32\…\KLiteCodecPack_is1) (Version: 9.9.0 - )

Malwarebytes Anti-Malware version 2.1.8.1057 (HKLM-x32\…\Malwarebytes Anti-Malware_is1) (Version: 2.1.8.1057 - Malwarebytes Corporation)

Microsoft .NET Framework 4.5.2 (HKLM\…\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)

Microsoft Office Professional Plus 2010 (HKLM-x32\…\Office14.PROPLUS) (Version: 14.0.4734.1000 - Microsoft Corporation)

Microsoft Security Essentials (HKLM\…\Microsoft Security Client) (Version: 4.8.204.0 - Microsoft Corporation)

Microsoft Silverlight (HKLM\…\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40416.0 - Microsoft Corporation)

Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\…\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\…\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\…\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\…\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\…\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\…\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\…\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\…\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\…\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)

Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\…\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)

Movie Maker (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden

Picasa 3 (HKLM-x32\…\Picasa 3) (Version: 3.9 - Google, Inc.)

Pidgin (HKLM-x32\…\Pidgin) (Version: 2.10.7 - )

Plex Media Server (HKLM-x32\…\{60ad9444-b93c-473d-a800-e99ca5aa5558}) (Version: 0.9.1203 - Plex, Inc.)

Plex Media Server (x32 Version: 0.9.1203 - Plex, Inc.) Hidden

Realtek High Definition Audio Driver (HKLM-x32\…\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6873 - Realtek Semiconductor Corp.)

Samsung SSD 840 EVO Performance Restoration (HKLM-x32\…\{B4B18E77-4C37-46F2-BC38-9451E65C9AEC}_is1) (Version: 1.1 - Samsung Electronics)

Skype™ 6.18 (HKLM-x32\…\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.18.105 - Skype Technologies S.A.)

Spotify (HKU\S-1-5-21-1656001472-1405054058-1540687034-1000\…\Spotify) (Version: 0.9.14.13.gba5645ad - Spotify AB)

Steam (HKLM-x32\…\Steam) (Version: - Valve Corporation)

Team Fortress 2 (HKLM-x32\…\Steam App 440) (Version: - Valve)

TechPowerUp GPU-Z (HKLM-x32\…\TechPowerUp GPU-Z) (Version: - TechPowerUp)

TERA (HKU\S-1-5-21-1656001472-1405054058-1540687034-1000\…\teraenmasse) (Version: - )

TP-LINK TL-WN821N(C)_TL-WN822N_TL-WN823N Driver (HKLM-x32\…\{852E893E-E4FD-45BB-8B17-72ADDF686974}) (Version: 1.3.1 - TP-LINK)

TP-LINK Wireless Configuration Utility (HKLM-x32\…\{319D91C6-3D44-436C-9F79-36C0D22372DC}) (Version: 1.3.1 - TP-LINK)

Ventrilo Client (HKLM-x32\…\{789289CA-F73A-4A16-A331-54D498CE069F}) (Version: 3.0.8 - Flagship Industries, Inc.)

Visual Studio 2012 x64 Redistributables (HKLM\…\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)

Visual Studio 2012 x86 Redistributables (HKLM-x32\…\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)

VLC media player (HKLM-x32\…\VLC media player) (Version: 2.2.1 - VideoLAN)

Windows Live Essentials (HKLM-x32\…\WinLiveSuite) (Version: 16.4.3508.0205 - Microsoft Corporation)

WinRAR 4.20 (64-bit) (HKLM\…\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-1656001472-1405054058-1540687034-1000_Classes\CLSID\{1423F872-3F7F-4E57-B621-8B1A9D49B448}\InprocServer32 -> C:\Users\Brenton\AppData\Local\Google\Update\1.3.27.5\psuser_64.dll No File

CustomCLSID: HKU\S-1-5-21-1656001472-1405054058-1540687034-1000_Classes\CLSID\{5C8C2A98-6133-4EBA-BBCC-34D9EA01FC2E}\InprocServer32 -> C:\Users\Brenton\AppData\Local\Google\Update\1.3.28.1\psuser_64.dll (Google Inc.)

CustomCLSID: HKU\S-1-5-21-1656001472-1405054058-1540687034-1000_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\Brenton\AppData\Local\Google\Update\1.3.28.1\psuser_64.dll (Google Inc.)

==================== Restore Points =========================

16-07-2015 00:00:36 Installed Sophos Virus Removal Tool.

16-07-2015 00:02:41 Removed Sophos Virus Removal Tool.

16-07-2015 00:03:39 Installed Sophos Virus Removal Tool.

16-07-2015 22:50:04 Restore Operation

16-07-2015 23:14:41 Windows Update

17-07-2015 00:27:55 JRT Pre-Junkware Removal

17-07-2015 06:19:54 Checkpoint by HitmanPro

==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-13 19:34 - 2009-06-10 14:00 - 00000824 ____N C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {0175EAE5-47D5-4E62-AE3F-A7CD7E904A50} - System32\Tasks\{88CE8CEB-4DEC-4F5F-8BA3-DF7BB285F56D} => C:\Program Files (x86)\Origin\Origin.exe

Task: {1F460A28-C72B-4746-9180-51D26D3EE9A5} - System32\Tasks\IORRT => C:\IORRT\IORRT.bat [2013-06-22] ()

Task: {20A69620-B41A-413C-9EEB-4B9C19F86236} - System32\Tasks\{88684E78-99B8-4E13-AB7A-87C7E2FF297C} => C:\ProgramData\HappyCloud\Application\HCTeraLoader.exe [2013-07-11] ()

Task: {39D3C618-7319-43BA-ADB8-92557A72E5B9} - System32\Tasks\{10D7BA36-EF0B-4F80-904E-F06AB1A9606B} => C:\Program Files (x86)\Origin\Origin.exe

Task: {3C8939DF-BC90-4F46-BD07-A1D669F6D6F5} - System32\Tasks\0215piUpdateInfo => C:\ProgramData\Avg_Update_0215pi\0215pi_AVG-Secure-Search-Update.exe [2015-02-17] ()

Task: {7254F31D-D037-4E9A-BEBE-F309F75CB2F4} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1656001472-1405054058-1540687034-1000Core => C:\Users\Brenton\AppData\Local\Google\Update\GoogleUpdate.exe [2015-06-12] (Google Inc.)

Task: {76253896-2DAF-4C86-9FFE-52F35AFF930D} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-08-19] (Adobe Systems Incorporated)

Task: {7AAD264F-61BE-4A16-8350-A5E9BF264434} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-05-20] (Google Inc.)

Task: {7E289719-FBBD-4FB9-9F96-572808E87599} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-07-07] (Adobe Systems Incorporated)

Task: {80D5137C-507A-4477-A4B4-384E454D74BD} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-05-20] (Google Inc.)

Task: {82F81D53-8953-4C1E-AF74-C1825023B520} - System32\Tasks\Hybrid => C:\IORRT\IORRT.bat [2013-06-22] ()

Task: {8CE01085-7AA0-453E-8C49-4D3F6F982831} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1656001472-1405054058-1540687034-1000UA => C:\Users\Brenton\AppData\Local\Google\Update\GoogleUpdate.exe [2015-06-12] (Google Inc.)

Task: {FEC1DD24-4A6F-42F1-A75B-11FBEEFA726C} - System32\Tasks\{4ACE019A-666F-4D2A-98D4-7B77B8AA2EF5} => C:\Program Files (x86)\Origin\Origin.exe

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\0215piUpdateInfo.job => C:\ProgramData\Avg_Update_0215pi\0215pi_AVG-Secure-Search-Update.exe

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1656001472-1405054058-1540687034-1000Core.job => C:\Users\Brenton\AppData\Local\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1656001472-1405054058-1540687034-1000UA.job => C:\Users\Brenton\AppData\Local\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (Whitelisted) ==============

2015-03-20 18:12 - 2015-03-20 18:12 - 00085832 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll

2015-03-20 18:12 - 2015-03-20 18:12 - 01346344 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll

2015-06-24 19:14 - 2015-06-24 19:14 - 00716664 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.7.485.8398\AdAwareService.exe

2015-06-24 19:18 - 2015-06-24 19:18 - 00107536 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.7.485.8398\boost_thread-vc120-mt-1_58.dll

2015-06-24 19:18 - 2015-06-24 19:18 - 00025616 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.7.485.8398\boost_system-vc120-mt-1_58.dll

2015-06-24 19:18 - 2015-06-24 19:18 - 00034832 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.7.485.8398\boost_chrono-vc120-mt-1_58.dll

2015-06-24 19:18 - 2015-06-24 19:18 - 00056856 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.7.485.8398\boost_date_time-vc120-mt-1_58.dll

2015-06-24 19:18 - 2015-06-24 19:18 - 00122904 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.7.485.8398\boost_filesystem-vc120-mt-1_58.dll

2015-06-24 19:18 - 2015-06-24 19:18 - 12893184 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.7.485.8398\AdAwareServiceKernel.dll

2015-06-24 19:18 - 2015-06-24 19:18 - 03480032 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.7.485.8398\RCF.dll

2015-06-24 19:18 - 2015-06-24 19:18 - 00911376 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.7.485.8398\boost_regex-vc120-mt-1_58.dll

2015-06-24 19:17 - 2015-06-24 19:17 - 00709120 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.7.485.8398\AdAwareActivation.dll

2015-06-24 19:18 - 2015-06-24 19:18 - 00474128 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.7.485.8398\AdAwareApplicationUpdater.dll

2015-06-24 19:18 - 2015-06-24 19:18 - 00847360 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.7.485.8398\AdAwareGamingMode.dll

2015-06-24 19:18 - 2015-06-24 19:18 - 00100848 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.7.485.8398\AdAwareReset.dll

2015-06-24 19:18 - 2015-06-24 19:18 - 00122864 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.7.485.8398\AdAwareTime.dll

2015-06-24 19:18 - 2015-06-24 19:18 - 01010704 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.7.485.8398\AdAwareDefinitionsUpdater.dll

2015-06-24 19:18 - 2015-06-24 19:18 - 00905248 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.7.485.8398\AdAwareDefinitionsUpdaterScheduler.dll

2015-06-24 19:18 - 2015-06-24 19:18 - 01146368 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.7.485.8398\AdAwareIgnoreList.dll

2015-06-24 19:18 - 2015-06-24 19:18 - 00243200 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.7.485.8398\AdAwareQuarantine.dll

2015-06-24 19:17 - 2015-06-24 19:17 - 01050120 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.7.485.8398\AdAwareAntiMalwareEngine.dll

2015-06-24 19:17 - 2015-06-24 19:17 - 00205832 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.7.485.8398\AdAwareAntiRootkitEngine.dll

2015-06-24 19:18 - 2015-06-24 19:18 - 01210376 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.7.485.8398\AdAwareScannerHistory.dll

2015-06-24 19:18 - 2015-06-24 19:18 - 01337336 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.7.485.8398\AdAwareScanner.dll

2015-06-24 19:18 - 2015-06-24 19:18 - 00035856 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.7.485.8398\boost_timer-vc120-mt-1_58.dll

2015-06-24 19:18 - 2015-06-24 19:18 - 01018888 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.7.485.8398\AdAwareScannerScheduler.dll

2015-06-24 19:18 - 2015-06-24 19:18 - 01174544 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.7.485.8398\AdAwareRealTimeProtection.dll

2015-06-24 19:18 - 2015-06-24 19:18 - 00244224 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.7.485.8398\AdAwareIncompatibles.dll

2015-06-24 19:17 - 2015-06-24 19:17 - 00933368 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.7.485.8398\AdAwareAntiSpam.dll

2015-06-24 19:17 - 2015-06-24 19:17 - 00883200 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.7.485.8398\AdAwareAntiPhishing.dll

2015-06-24 19:18 - 2015-06-24 19:18 - 03263496 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.7.485.8398\AdAwareParentalControl.dll

2015-06-24 19:18 - 2015-06-24 19:18 - 02984960 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.7.485.8398\AdAwareWebProtection.dll

2015-06-24 19:18 - 2015-06-24 19:18 - 01324040 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.7.485.8398\AdAwareEmailProtection.dll

2015-06-24 19:18 - 2015-06-24 19:18 - 00059416 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.7.485.8398\boost_iostreams-vc120-mt-1_58.dll

2015-06-24 19:18 - 2015-06-24 19:18 - 01312264 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.7.485.8398\AdAwareNetworkProtection.dll

2015-06-24 19:18 - 2015-06-24 19:18 - 01013744 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.7.485.8398\AdAwarePromo.dll

2015-06-24 19:18 - 2015-06-24 19:18 - 00365560 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.7.485.8398\AdAwareFeedback.dll

2015-06-24 19:18 - 2015-06-24 19:18 - 02958352 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.7.485.8398\AdAwareThreatWorkAlliance.dll

2015-06-24 19:18 - 2015-06-24 19:18 - 01261560 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.7.485.8398\AdAwarePinCode.dll

2015-06-24 19:18 - 2015-06-24 19:18 - 01014264 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.7.485.8398\AdAwareNotice.dll

2015-06-24 19:18 - 2015-06-24 19:18 - 01002488 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.7.485.8398\AdAwareAvcEngine.dll

2015-06-24 19:18 - 2015-06-24 19:18 - 01222168 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.7.485.8398\AdAwareRealTimeProtectionHistory.dll

2015-06-24 19:18 - 2015-06-24 19:18 - 00468992 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.7.485.8398\AdAwareStatistics.dll

2010-01-09 20:17 - 2010-01-09 20:17 - 04254560 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF

2010-01-21 01:40 - 2010-01-21 01:40 - 08794464 _____ () C:\Program Files\Microsoft Office\Office14\1033\GrooveIntlResource.dll

2015-06-24 19:18 - 2015-06-24 19:18 - 02790408 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.7.485.8398\AdAwareShellExtension.dll

2013-05-20 14:09 - 2012-09-17 01:23 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll

2015-06-24 19:18 - 2015-06-24 19:18 - 09549808 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.7.485.8398\AdAwareTray.exe

2015-06-24 19:18 - 2015-06-24 19:18 - 00492048 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.7.485.8398\boost_locale-vc120-mt-1_58.dll

2015-06-24 19:18 - 2015-06-24 19:18 - 02266104 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.7.485.8398\HtmlFramework.dll

2015-06-24 19:18 - 2015-06-24 19:18 - 00868360 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.7.485.8398\AdAwareTrayDefaultSkin.dll

2015-02-10 20:42 - 2013-04-08 16:29 - 00846848 _____ () C:\Program Files (x86)\TP-LINK\TP-LINK Wireless Configuration Utility\TWCU.exe

2015-06-03 23:52 - 2015-06-03 23:52 - 00072840 _____ () C:\Program Files (x86)\Plex\Plex Media Server\zlib.dll

2015-06-03 23:52 - 2015-06-03 23:52 - 00196232 _____ () C:\Program Files (x86)\Plex\Plex Media Server\libidn.dll

2015-06-03 23:52 - 2015-06-03 23:52 - 00838792 _____ () C:\Program Files (x86)\Plex\Plex Media Server\libxml2.dll

2015-06-03 23:52 - 2015-06-03 23:52 - 00049800 _____ () C:\Program Files (x86)\Plex\Plex Media Server\soci_sqlite3-vc80-3_0.dll

2015-06-03 23:52 - 2015-06-03 23:52 - 00086664 _____ () C:\Program Files (x86)\Plex\Plex Media Server\soci_core-vc80-3_0.dll

2015-06-03 23:52 - 2015-06-03 23:52 - 02092680 _____ () C:\Program Files (x86)\Plex\Plex Media Server\opencv_core249.dll

2015-06-03 23:52 - 2015-06-03 23:52 - 01883272 _____ () C:\Program Files (x86)\Plex\Plex Media Server\opencv_imgproc249.dll

2015-06-03 23:52 - 2015-06-03 23:52 - 00502920 _____ () C:\Program Files (x86)\Plex\Plex Media Server\tag.dll

2010-01-09 20:18 - 2010-01-09 20:18 - 04254560 _____ () C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF

2010-01-21 01:34 - 2010-01-21 01:34 - 08793952 _____ () C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveIntlResource.dll

2015-02-10 20:42 - 2013-03-12 21:48 - 01411072 _____ () C:\Program Files (x86)\TP-LINK\TP-LINK Wireless Configuration Utility\nicLan.dll

2015-02-10 20:42 - 2013-04-02 12:34 - 00193024 _____ () C:\Program Files (x86)\TP-LINK\TP-LINK Wireless Configuration Utility\DC_WFF.dll

2015-02-10 20:42 - 2013-04-02 12:34 - 00297472 _____ () C:\Program Files (x86)\TP-LINK\TP-LINK Wireless Configuration Utility\WJRtl.dll

2015-05-02 23:15 - 2014-10-31 16:37 - 01498112 _____ () C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\DAQExp.dll

2015-05-02 23:15 - 2014-05-19 17:19 - 00137728 _____ () C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\CBSCreateVC.dll

2015-07-18 08:41 - 2015-07-18 08:41 - 00098816 _____ () C:\Users\Brenton\AppData\Local\Temp\_MEI41762\win32api.pyd

2015-07-18 08:41 - 2015-07-18 08:41 - 00110080 _____ () C:\Users\Brenton\AppData\Local\Temp\_MEI41762\pywintypes27.dll

2015-07-18 08:41 - 2015-07-18 08:41 - 00364544 _____ () C:\Users\Brenton\AppData\Local\Temp\_MEI41762\pythoncom27.dll

2015-07-18 08:41 - 2015-07-18 08:41 - 00045568 _____ () C:\Users\Brenton\AppData\Local\Temp\_MEI41762\_socket.pyd

2015-07-18 08:41 - 2015-07-18 08:41 - 01161216 _____ () C:\Users\Brenton\AppData\Local\Temp\_MEI41762\_ssl.pyd

2015-07-18 08:41 - 2015-07-18 08:41 - 00320512 _____ () C:\Users\Brenton\AppData\Local\Temp\_MEI41762\win32com.shell.shell.pyd

2015-07-18 08:41 - 2015-07-18 08:41 - 00713216 _____ () C:\Users\Brenton\AppData\Local\Temp\_MEI41762\_hashlib.pyd

2015-07-18 08:41 - 2015-07-18 08:41 - 01175040 _____ () C:\Users\Brenton\AppData\Local\Temp\_MEI41762\wx._core_.pyd

2015-07-18 08:41 - 2015-07-18 08:41 - 00805888 _____ () C:\Users\Brenton\AppData\Local\Temp\_MEI41762\wx._gdi_.pyd

2015-07-18 08:41 - 2015-07-18 08:41 - 00811008 _____ () C:\Users\Brenton\AppData\Local\Temp\_MEI41762\wx._windows_.pyd

2015-07-18 08:41 - 2015-07-18 08:41 - 01062400 _____ () C:\Users\Brenton\AppData\Local\Temp\_MEI41762\wx._controls_.pyd

2015-07-18 08:41 - 2015-07-18 08:41 - 00735232 _____ () C:\Users\Brenton\AppData\Local\Temp\_MEI41762\wx._misc_.pyd

2015-07-18 08:41 - 2015-07-18 08:41 - 00682496 _____ () C:\Users\Brenton\AppData\Local\Temp\_MEI41762\pysqlite2._sqlite.pyd

2015-07-18 08:41 - 2015-07-18 08:41 - 00087552 _____ () C:\Users\Brenton\AppData\Local\Temp\_MEI41762\_ctypes.pyd

2015-07-18 08:41 - 2015-07-18 08:41 - 00119808 _____ () C:\Users\Brenton\AppData\Local\Temp\_MEI41762\win32file.pyd

2015-07-18 08:41 - 2015-07-18 08:41 - 00108544 _____ () C:\Users\Brenton\AppData\Local\Temp\_MEI41762\win32security.pyd

2015-07-18 08:41 - 2015-07-18 08:41 - 00007168 _____ () C:\Users\Brenton\AppData\Local\Temp\_MEI41762\hashobjs_ext.pyd

2015-07-18 08:41 - 2015-07-18 08:41 - 00026624 _____ () C:\Users\Brenton\AppData\Local\Temp\_MEI41762\usb_ext.pyd

2015-07-18 08:41 - 2015-07-18 08:41 - 00167936 _____ () C:\Users\Brenton\AppData\Local\Temp\_MEI41762\win32gui.pyd

2015-07-18 08:41 - 2015-07-18 08:41 - 00018432 _____ () C:\Users\Brenton\AppData\Local\Temp\_MEI41762\win32event.pyd

2015-07-18 08:41 - 2015-07-18 08:41 - 00128512 _____ () C:\Users\Brenton\AppData\Local\Temp\_MEI41762\_elementtree.pyd

2015-07-18 08:41 - 2015-07-18 08:41 - 00127488 _____ () C:\Users\Brenton\AppData\Local\Temp\_MEI41762\pyexpat.pyd

2015-07-18 08:41 - 2015-07-18 08:41 - 00013824 _____ () C:\Users\Brenton\AppData\Local\Temp\_MEI41762\common.time34.pyd

2015-07-18 08:41 - 2015-07-18 08:41 - 00036864 _____ () C:\Users\Brenton\AppData\Local\Temp\_MEI41762\_psutil_windows.pyd

2015-07-18 08:41 - 2015-07-18 08:41 - 00038912 _____ () C:\Users\Brenton\AppData\Local\Temp\_MEI41762\win32inet.pyd

2015-07-18 08:41 - 2015-07-18 08:41 - 00011264 _____ () C:\Users\Brenton\AppData\Local\Temp\_MEI41762\win32crypt.pyd

2015-07-18 08:41 - 2015-07-18 08:41 - 00070656 _____ () C:\Users\Brenton\AppData\Local\Temp\_MEI41762\wx._html2.pyd

2015-07-18 08:41 - 2015-07-18 08:41 - 00027136 _____ () C:\Users\Brenton\AppData\Local\Temp\_MEI41762\_multiprocessing.pyd

2015-07-18 08:41 - 2015-07-18 08:41 - 00020480 _____ () C:\Users\Brenton\AppData\Local\Temp\_MEI41762\_yappi.pyd

2015-07-18 08:41 - 2015-07-18 08:41 - 00035840 _____ () C:\Users\Brenton\AppData\Local\Temp\_MEI41762\win32process.pyd

2015-07-18 08:41 - 2015-07-18 08:41 - 00686080 _____ () C:\Users\Brenton\AppData\Local\Temp\_MEI41762\unicodedata.pyd

2015-07-18 08:41 - 2015-07-18 08:41 - 00122368 _____ () C:\Users\Brenton\AppData\Local\Temp\_MEI41762\wx._wizard.pyd

2015-07-18 08:41 - 2015-07-18 08:41 - 00024064 _____ () C:\Users\Brenton\AppData\Local\Temp\_MEI41762\win32pipe.pyd

2015-07-18 08:41 - 2015-07-18 08:41 - 00010240 _____ () C:\Users\Brenton\AppData\Local\Temp\_MEI41762\select.pyd

2015-07-18 08:41 - 2015-07-18 08:41 - 00025600 _____ () C:\Users\Brenton\AppData\Local\Temp\_MEI41762\win32pdh.pyd

2015-07-18 08:41 - 2015-07-18 08:41 - 00525640 _____ () C:\Users\Brenton\AppData\Local\Temp\_MEI41762\windows._lib_cacheinvalidation.pyd

2015-07-18 08:41 - 2015-07-18 08:41 - 00017408 _____ () C:\Users\Brenton\AppData\Local\Temp\_MEI41762\win32profile.pyd

2015-07-18 08:41 - 2015-07-18 08:41 - 00022528 _____ () C:\Users\Brenton\AppData\Local\Temp\_MEI41762\win32ts.pyd

2015-07-18 08:41 - 2015-07-18 08:41 - 00078336 _____ () C:\Users\Brenton\AppData\Local\Temp\_MEI41762\wx._animate.pyd

2015-06-03 23:52 - 2015-06-03 23:52 - 00044680 _____ () C:\Program Files (x86)\Plex\Plex Media Server\DLLs\_socket.pyd

2015-06-03 23:52 - 2015-06-03 23:52 - 00027784 _____ () C:\Program Files (x86)\Plex\Plex Media Server\DLLs\_ssl.pyd

2015-06-03 23:52 - 2015-06-03 23:52 - 00018568 _____ () C:\Program Files (x86)\Plex\Plex Media Server\DLLs\_hashlib.pyd

2015-06-03 23:52 - 2015-06-03 23:52 - 00034952 _____ () C:\Program Files (x86)\Plex\Plex Media Server\Exts\simplejson\_speedups.pyd

2015-06-03 23:52 - 2015-06-03 23:52 - 00836232 _____ () C:\Program Files (x86)\Plex\Plex Media Server\Exts\lxml\etree.pyd

2015-06-03 23:52 - 2015-06-03 23:52 - 00062600 _____ () C:\Program Files (x86)\Plex\Plex Media Server\libexslt.dll

2015-06-03 23:52 - 2015-06-03 23:52 - 00166024 _____ () C:\Program Files (x86)\Plex\Plex Media Server\libxslt.dll

2015-06-03 23:52 - 2015-06-03 23:52 - 00192136 _____ () C:\Program Files (x86)\Plex\Plex Media Server\Exts\lxml\objectify.pyd

2015-06-03 23:52 - 2015-06-03 23:52 - 00016520 _____ () C:\Program Files (x86)\Plex\Plex Media Server\DLLs\select.pyd

2015-06-03 23:52 - 2015-06-03 23:52 - 00054920 _____ () C:\Program Files (x86)\Plex\Plex Media Server\Exts\OpenSSL\crypto.pyd

2015-06-03 23:52 - 2015-06-03 23:52 - 00017032 _____ () C:\Program Files (x86)\Plex\Plex Media Server\Exts\OpenSSL\rand.pyd

2015-06-03 23:52 - 2015-06-03 23:52 - 00043656 _____ () C:\Program Files (x86)\Plex\Plex Media Server\Exts\OpenSSL\SSL.pyd

2015-06-03 23:52 - 2015-06-03 23:52 - 00081544 _____ () C:\Program Files (x86)\Plex\Plex Media Server\DLLs\_ctypes.pyd

2015-06-03 23:52 - 2015-06-03 23:52 - 00111240 _____ () C:\Program Files (x86)\Plex\Plex Media Server\DLLs\pyexpat.pyd

2015-06-03 23:52 - 2015-06-03 23:52 - 00689800 _____ () C:\Program Files (x86)\Plex\Plex Media Server\DLLs\unicodedata.pyd

2015-01-17 15:50 - 2015-01-17 15:50 - 00016384 _____ () C:\Windows\assembly\NativeImages_v4.0.30319_32\PSIClient\bc9bcf53b97e0180a22783ef8b2567c2\PSIClient.ni.dll

2015-07-17 00:54 - 2014-02-10 13:44 - 04592128 _____ () C:\Users\Brenton\AppData\Local\Google\Chrome\User Data\SwiftShader\3.2.6.45159\libglesv2.dll

2015-07-17 00:54 - 2014-02-10 13:44 - 00112128 _____ () C:\Users\Brenton\AppData\Local\Google\Chrome\User Data\SwiftShader\3.2.6.45159\libegl.dll

2015-02-14 17:40 - 2015-02-14 17:40 - 00381440 _____ () C:\Windows\mod_frst.exe

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

==================== Safe Mode (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)

==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

IE trusted site: HKU\S-1-5-21-1656001472-1405054058-1540687034-1000\…\clonewarsadventures.com -> clonewarsadventures.com

IE trusted site: HKU\S-1-5-21-1656001472-1405054058-1540687034-1000\…\freerealms.com -> freerealms.com

IE trusted site: HKU\S-1-5-21-1656001472-1405054058-1540687034-1000\…\soe.com -> soe.com

IE trusted site: HKU\S-1-5-21-1656001472-1405054058-1540687034-1000\…\sony.com -> sony.com

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-1656001472-1405054058-1540687034-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Brenton\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg

DNS Servers: 192.168.1.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\Services: AdobeARMservice => 2

MSCONFIG\Services: AeLookupSvc => 3

MSCONFIG\Services: Apple Mobile Device => 2

MSCONFIG\Services: Bonjour Service => 2

MSCONFIG\Services: IEEtwCollectorService => 3

MSCONFIG\Services: iPod Service => 3

MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

MSCONFIG\startupreg: APSDaemon => "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"

MSCONFIG\startupreg: BCSSync => "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" /DelayServices

MSCONFIG\startupreg: Eye-Fi => "C:\Program Files (x86)\Eye-Fi\Helper\EyeFiHelper.exe"

MSCONFIG\startupreg: iTunesHelper => "C:\Program Files (x86)\iTunes\iTunesHelper.exe"

MSCONFIG\startupreg: RTHDVCPL => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s

MSCONFIG\startupreg: Skype => "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun

MSCONFIG\startupreg: Spotify => "C:\Users\Brenton\AppData\Roaming\Spotify\Spotify.exe" /uri spotify:autostart

MSCONFIG\startupreg: Spotify Web Helper => "C:\Users\Brenton\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe"

MSCONFIG\startupreg: Steam => "C:\Program Files (x86)\Steam\Steam.exe" -silent

MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

MSCONFIG\startupreg: uTorrent => "C:\Users\Brenton\AppData\Roaming\uTorrent\uTorrent.exe" /MINIMIZED

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppsvc.exe

FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppsvc.exe

FirewallRules: [{61CC69E3-7215-4120-843A-586E8B2C4EA9}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe

FirewallRules: [{18D3F28A-B62E-44F1-94B7-509B4A9430AE}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe

FirewallRules: [TCP Query User{3D1A3834-380C-4474-95AF-DE5E3D80FCA4}C:\program files (x86)\utorrent\utorrent.exe] => (Allow) C:\program files (x86)\utorrent\utorrent.exe

FirewallRules: [UDP Query User{14EE7C6D-2CAB-476C-902A-C276A46E2109}C:\program files (x86)\utorrent\utorrent.exe] => (Allow) C:\program files (x86)\utorrent\utorrent.exe

FirewallRules: [{7836833D-BF84-407A-B5B8-37D915F438D1}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Half-Life\hl.exe

FirewallRules: [{B98D6CA4-174D-4E73-820C-FBBF2CCC9859}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Half-Life\hl.exe

FirewallRules: [{1EEAEB96-7E94-4C19-8D94-E803119C0045}] => (Allow) C:\Users\Brenton\AppData\Local\Temp\7zS326E\hppiw.exe

FirewallRules: [{D2F697D8-6D87-466E-A44C-B205561C85EB}] => (Allow) C:\Users\Brenton\AppData\Local\Temp\7zS326E\hppiw.exe

FirewallRules: [{93D9FEE0-7569-4F53-A344-B58802BD07B8}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\DC Universe Online\LaunchPad.exe

FirewallRules: [{0EF65250-8C13-4049-9C06-78FBEA99A4C4}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\DC Universe Online\LaunchPad.exe

FirewallRules: [TCP Query User{FA6E4225-B8A4-4717-8C39-42F9927F426C}E:\steam\half-life\hl.exe] => (Allow) E:\steam\half-life\hl.exe

FirewallRules: [UDP Query User{6CF35C65-0738-4DD1-9C3D-7C108A12C449}E:\steam\half-life\hl.exe] => (Allow) E:\steam\half-life\hl.exe

FirewallRules: [{3F138D65-D06D-41F7-9CFD-E415B96EB690}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Counter-Strike Source\hl2.exe

FirewallRules: [{D2BA21FB-A935-42F1-B432-40138CAE0F3A}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Counter-Strike Source\hl2.exe

FirewallRules: [{AC67B161-ADD0-4183-8318-F3BE27B1779E}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe

FirewallRules: [TCP Query User{BC524A02-8B0E-4B9B-94A1-4A27500911AD}E:\steam\dc universe online\unreal3\binaries\win32\dcgame.exe] => (Block) E:\steam\dc universe online\unreal3\binaries\win32\dcgame.exe

FirewallRules: [UDP Query User{31778955-1CD0-4D61-8E47-8B970E07A951}E:\steam\dc universe online\unreal3\binaries\win32\dcgame.exe] => (Block) E:\steam\dc universe online\unreal3\binaries\win32\dcgame.exe

FirewallRules: [{FAB2E7DB-3B8C-4814-8837-D027595DCC13}] => (Allow) E:\HappyCloud\Cache\TERA\TERA-Launcher.exe

FirewallRules: [{4C8A2655-9779-42F3-BB88-09DE3FADB74C}] => (Allow) E:\HappyCloud\Cache\TERA\TERA-Launcher.exe

FirewallRules: [{3F54FCCC-2819-4BD6-967B-783B52F9E389}] => (Allow) E:\HappyCloud\Cache\TERA\Client\TL.exe

FirewallRules: [{54E78C39-F747-46E4-9A1C-45973327291E}] => (Allow) E:\HappyCloud\Cache\TERA\Client\TL.exe

FirewallRules: [{7E852713-743F-4461-B859-16AFFBC6C749}] => (Allow) E:\HappyCloud\Cache\TERA\Client\Binaries\TERA.exe

FirewallRules: [{E32E66B0-BCE3-414A-9357-C01716C1AA30}] => (Allow) E:\HappyCloud\Cache\TERA\Client\Binaries\TERA.exe

FirewallRules: [{FCD12AF9-812E-499A-A62C-18E1A5F7605E}] => (Allow) C:\Program Files (x86)\Ventrilo\Ventrilo.exe

FirewallRules: [{637230E6-EEB4-4BCC-9581-02E72EE3E7B6}] => (Allow) C:\Program Files (x86)\Ventrilo\Ventrilo.exe

FirewallRules: [TCP Query User{1329AD95-B091-4DBB-99CB-3E51A3631048}C:\users\brenton\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\brenton\appdata\roaming\spotify\spotify.exe

FirewallRules: [UDP Query User{3E9721C0-72A4-4DB9-8F40-BCBFD39DFEAE}C:\users\brenton\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\brenton\appdata\roaming\spotify\spotify.exe

FirewallRules: [TCP Query User{EEF4163F-D1A2-45CF-B6A2-3FA73A58023A}C:\users\brenton\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\brenton\appdata\roaming\spotify\spotify.exe

FirewallRules: [UDP Query User{64B65AEE-0F26-47EA-96F3-92686E5F2B9C}C:\users\brenton\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\brenton\appdata\roaming\spotify\spotify.exe

FirewallRules: [{2BA7BB07-AB47-4B4D-B510-52A1C2558C19}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe

FirewallRules: [{323109C9-1125-4793-ADC3-60AE25611748}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe

FirewallRules: [{8C1D88CB-2982-4A8C-B17A-F434E3ACC379}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe

FirewallRules: [{86205082-B109-47F6-A5A4-6B769896A0C5}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe

FirewallRules: [{E6F1CA64-1763-44B8-93D2-A59C8958EE57}] => (Allow) C:\Users\Brenton\AppData\Roaming\uTorrent\uTorrent.exe

FirewallRules: [{31067B58-BCD0-4DB1-9E47-34AE777DC2D2}] => (Allow) C:\Users\Brenton\AppData\Roaming\uTorrent\uTorrent.exe

FirewallRules: [{84784B33-4686-495E-B0DD-91EC91668C3A}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\BioShock Infinite\Binaries\Win32\BioShockInfinite.exe

FirewallRules: [{4983FE74-A465-4EA2-86A9-BBA70105658E}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\BioShock Infinite\Binaries\Win32\BioShockInfinite.exe

FirewallRules: [{F9FEDF35-CB27-41EF-812E-E3C2B76185E9}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\BioShock Infinite\Binaries\Win32\Benchmark.bat

FirewallRules: [{BE9C46D2-B39B-4A94-88FE-8F1F37A7B4AA}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\BioShock Infinite\Binaries\Win32\Benchmark.bat

FirewallRules: [TCP Query User{0D52C974-1D5D-4244-BB2F-7CF76E544A6B}C:\program files (x86)\pidgin\pidgin.exe] => (Allow) C:\program files (x86)\pidgin\pidgin.exe

FirewallRules: [UDP Query User{BEAB319D-959E-4B84-A893-04434231C539}C:\program files (x86)\pidgin\pidgin.exe] => (Allow) C:\program files (x86)\pidgin\pidgin.exe

FirewallRules: [{3DFCBA2C-923C-45B9-A336-779023CF00D3}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe

FirewallRules: [{B7C71472-1BCE-4328-89F7-42625153FDC3}] => (Allow) LPort=2869

FirewallRules: [{FD670F69-C143-431A-999B-B18A15DE55C0}] => (Allow) LPort=1900

FirewallRules: [{1772D539-19D5-41FB-A977-154321B0F12A}] => (Allow) D:\Steam\Steam.exe

FirewallRules: [{5CB998C4-F0C6-4E8D-8B62-F159308B5CDC}] => (Allow) D:\Steam\Steam.exe

FirewallRules: [{AAED1C61-748A-4633-8E49-937E54CD77A8}] => (Allow) D:\Steam\SteamApps\common\Half-Life\hl.exe

FirewallRules: [{80FEE8DE-163B-422C-A7BC-37BA7FA4AD20}] => (Allow) D:\Steam\SteamApps\common\Half-Life\hl.exe

FirewallRules: [{636BA679-4322-4C35-92BB-71E3E644C6B9}] => (Allow) D:\Steam\SteamApps\common\Counter-Strike Source\hl2.exe

FirewallRules: [{246A682F-AC36-4C21-B7C3-0EEE651BD6EB}] => (Allow) D:\Steam\SteamApps\common\Counter-Strike Source\hl2.exe

FirewallRules: [TCP Query User{B954BE22-CE62-4B17-9A2C-905EBACE094E}C:\users\brenton\downloads\utorrent.exe] => (Allow) C:\users\brenton\downloads\utorrent.exe

FirewallRules: [UDP Query User{9C35B446-A471-4D2D-A0F0-9F4384B312A8}C:\users\brenton\downloads\utorrent.exe] => (Allow) C:\users\brenton\downloads\utorrent.exe

FirewallRules: [{70C7C3DF-ED00-421F-B449-25E4D466F093}] => (Allow) C:\Users\Brenton\AppData\Roaming\uTorrent\uTorrent.exe

FirewallRules: [{E8D85439-5242-449E-8707-B470CA1E373C}] => (Allow) C:\Users\Brenton\AppData\Roaming\uTorrent\uTorrent.exe

FirewallRules: [{DFF3A61A-31AD-479B-82DD-32D362BC4258}] => (Allow) D:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo.exe

FirewallRules: [{4AC368C9-E417-4A88-99A8-7C678439AF8F}] => (Allow) D:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo.exe

FirewallRules: [TCP Query User{D7547014-142C-48ED-89D9-43A916D202B2}C:\program files (x86)\eye-fi\helper\eyefihelper.exe] => (Allow) C:\program files (x86)\eye-fi\helper\eyefihelper.exe

FirewallRules: [UDP Query User{277DFD4B-667A-40C8-88FB-CDAEB15510CF}C:\program files (x86)\eye-fi\helper\eyefihelper.exe] => (Allow) C:\program files (x86)\eye-fi\helper\eyefihelper.exe

FirewallRules: [TCP Query User{BAA26C91-626E-445D-82A1-FE4DC3DA33DA}C:\program files (x86)\eye-fi\helper\eyefihelper.exe] => (Block) C:\program files (x86)\eye-fi\helper\eyefihelper.exe

FirewallRules: [UDP Query User{3F21D4C5-7DCD-448B-BC2A-952AFCF2C2E4}C:\program files (x86)\eye-fi\helper\eyefihelper.exe] => (Block) C:\program files (x86)\eye-fi\helper\eyefihelper.exe

FirewallRules: [{DCC7FA14-4E7D-4771-9FC2-81C786C71B78}] => (Allow) D:\Steam\SteamApps\common\Team Fortress 2\hl2.exe

FirewallRules: [{E79A79DB-005C-4F26-9EA8-390CFBCB8548}] => (Allow) D:\Steam\SteamApps\common\Team Fortress 2\hl2.exe

FirewallRules: [{A854AA3E-1961-49E4-8FCF-639BDBB76639}] => (Allow) D:\Steam\SteamApps\common\Alien Swarm\swarm.exe

FirewallRules: [{B45ED16E-FDFB-40A2-A11B-3B37709E6E38}] => (Allow) D:\Steam\SteamApps\common\Alien Swarm\swarm.exe

FirewallRules: [TCP Query User{89C129AA-E88C-4681-9B12-52963B1B0BB4}C:\users\brenton\appdata\roaming\utorrent\updates\3.4.2_38913.exe] => (Allow) C:\users\brenton\appdata\roaming\utorrent\updates\3.4.2_38913.exe

FirewallRules: [UDP Query User{32300E25-FCDE-4A87-8065-AE1C3ACF4E9F}C:\users\brenton\appdata\roaming\utorrent\updates\3.4.2_38913.exe] => (Allow) C:\users\brenton\appdata\roaming\utorrent\updates\3.4.2_38913.exe

FirewallRules: [{1A20DD45-C297-493F-A481-533C606D30E5}] => (Allow) C:\Program Files (x86)\AVG\AVG2015\avgmfapx.exe

FirewallRules: [{63C06688-A2BC-4817-8793-36BAEBC52983}] => (Allow) C:\Program Files (x86)\AVG\AVG2015\avgmfapx.exe

FirewallRules: [{68810F08-C92C-43D3-A4B9-C7350A9E5362}] => (Allow) C:\Program Files\iTunes\iTunes.exe

FirewallRules: [TCP Query User{39239C67-3EDC-4148-BFA2-1F1255CD7ED4}C:\users\brenton\appdata\roaming\utorrent\updates\3.4.2_38913.exe] => (Allow) C:\users\brenton\appdata\roaming\utorrent\updates\3.4.2_38913.exe

FirewallRules: [UDP Query User{42E358E0-7D56-4DA2-A4A8-6B0270DBF167}C:\users\brenton\appdata\roaming\utorrent\updates\3.4.2_38913.exe] => (Allow) C:\users\brenton\appdata\roaming\utorrent\updates\3.4.2_38913.exe

FirewallRules: [TCP Query User{B1DB8380-729F-40A4-892E-423AEFDB15FF}C:\users\brenton\appdata\roaming\utorrent\updates\3.4.3_40298.exe] => (Allow) C:\users\brenton\appdata\roaming\utorrent\updates\3.4.3_40298.exe

FirewallRules: [UDP Query User{231CF7CA-3849-45DB-A5CA-FDB16B74A3B8}C:\users\brenton\appdata\roaming\utorrent\updates\3.4.3_40298.exe] => (Allow) C:\users\brenton\appdata\roaming\utorrent\updates\3.4.3_40298.exe

FirewallRules: [{B9309EC2-7CF5-4237-8F2E-B37C0707B837}] => (Allow) C:\Program Files (x86)\Plex\Plex Media Server\Plex Media Server.exe

FirewallRules: [{E286BC43-4B46-4F89-AA5C-D760310980AB}] => (Allow) C:\Program Files (x86)\Plex\Plex Media Server\PlexScriptHost.exe

FirewallRules: [{00F79E68-F3E0-46D0-B91D-E647236E93DF}] => (Allow) C:\Program Files (x86)\Plex\Plex Media Server\PlexDlnaServer.exe

FirewallRules: [{4FD4C034-DA9E-4FDC-83EC-A6A060A6ABD7}] => (Allow) LPort=5556

FirewallRules: [{FB537D8B-250D-4F8F-B33D-78E4DCF768BA}] => (Allow) LPort=5558

FirewallRules: [{8887962B-B11E-4438-9A2B-98301333C8D1}] => (Allow) C:\Program Files (x86)\AVG\AVG2015\avgnsa.exe

FirewallRules: [{75EE4D2F-1F56-4153-8694-35703A526706}] => (Allow) C:\Program Files (x86)\AVG\AVG2015\avgnsa.exe

FirewallRules: [{CE591B1E-EE0C-4342-88B1-AEE936B931A7}] => (Allow) C:\Program Files (x86)\AVG\AVG2015\avgdiagex.exe

FirewallRules: [{5E21BE01-9462-4325-9723-13E2B3AF4C00}] => (Allow) C:\Program Files (x86)\AVG\AVG2015\avgdiagex.exe

FirewallRules: [{B20E6FF8-98DC-4313-B3DE-EF3B6E915CCB}] => (Allow) C:\Program Files (x86)\AVG\AVG2015\avgemca.exe

FirewallRules: [{030B2752-7836-4C9C-B7D0-A4FF6BA50336}] => (Allow) C:\Program Files (x86)\AVG\AVG2015\avgemca.exe

FirewallRules: [{DCE41093-C68D-4C7F-A8E1-A82F529B7240}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Faulty Device Manager Devices =============

Name: Standard VGA Graphics Adapter

Description: Standard VGA Graphics Adapter

Class Guid: {4d36e968-e325-11ce-bfc1-08002be10318}

Manufacturer: (Standard display types)

Service: vga

Problem: : This device cannot start. (Code10)

Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.

On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.

Name: Universal Serial Bus (USB) Controller

Description: Universal Serial Bus (USB) Controller

Class Guid:

Manufacturer:

Service:

Problem: : The drivers for this device are not installed. (Code 28)

Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

==================== Event log errors: =========================

Application errors:

==================

Error: (07/17/2015 12:26:10 AM) (Source: SideBySide) (EventID: 81) (User: )

Description: Activation context generation failed for "http://schemas.microsoft.com/SMI/2005/WindowsSettings^antispywareProductDisplayName1".

The setting http://schemas.microsoft.com/SMI/2005/WindowsSettings^antispywareProductDisplayNameis not registered.

Error: (07/17/2015 12:25:16 AM) (Source: Application Hang) (EventID: 1002) (User: )

Description: The program SDScan.exe version 2.4.40.181 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

Process ID: 199c

Start Time: 01d0c05f36f1789e

Termination Time: 0

Application Path: C:\Users\Brenton\Downloads\SpybotPortable\App\Spybot\SDScan.exe

Report Id: f21fe57b-2c54-11e5-8982-bc5ff49707bf

Error: (07/16/2015 11:15:03 PM) (Source: .NET Runtime) (EventID: 1022) (User: )

Description: .NET Runtime version 4.0.30319.34209 - There was a failure initializing profiling API attach infrastructure. This process will not allow a profiler to attach. HRESULT: 0x80004005. Process ID (decimal): 6240. Message ID: [0x2509].

Error: (07/16/2015 11:13:20 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application name: chrome.exe, version: 43.0.2357.132, time stamp: 0x559b2699

Faulting module name: chrome.dll, version: 43.0.2357.132, time stamp: 0x559b2249

Exception code: 0xc0000005

Fault offset: 0x00d729cf

Faulting process id: 0x474

Faulting application start time: 0xchrome.exe0

Faulting application path: chrome.exe1

Faulting module path: chrome.exe2

Report Id: chrome.exe3

Error: (07/16/2015 10:56:27 PM) (Source: System Restore) (EventID: 8210) (User: )

Description: An unspecified error occurred during System Restore: (Windows Update). Additional information: 0x80070005.

Error: (07/15/2015 11:47:11 PM) (Source: Application Hang) (EventID: 1002) (User: )

Description: The program iexplore.exe version 11.0.9600.17910 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

Process ID: 1994

Start Time: 01d0bf92f903a7f2

Termination Time: 0

Application Path: C:\Program Files\Internet Explorer\iexplore.exe

Report Id:

Error: (07/15/2015 11:47:07 PM) (Source: Application Hang) (EventID: 1002) (User: )

Description: The program IEXPLORE.EXE version 11.0.9600.17909 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

Process ID: 12b0

Start Time: 01d0bf930fc7dc60

Termination Time: 0

Application Path: C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

Report Id:

Error: (06/13/2015 02:02:23 AM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application name: Plex Media Scanner.exe, version: 0.9.12.3, time stamp: 0x556ff0a4

Faulting module name: ntdll.dll, version: 6.1.7601.18798, time stamp: 0x5507b3e0

Exception code: 0xc0000374

Fault offset: 0x000cea0b

Faulting process id: 0x1c88

Faulting application start time: 0xPlex Media Scanner.exe0

Faulting application path: Plex Media Scanner.exe1

Faulting module path: Plex Media Scanner.exe2

Report Id: Plex Media Scanner.exe3

Error: (06/12/2015 07:59:39 PM) (Source: .NET Runtime) (EventID: 1022) (User: )

Error: (05/15/2015 10:49:35 PM) (Source: MsiInstaller) (EventID: 1023) (User: NT AUTHORITY)

Description: Microsoft .NET Framework 4.5.2KB30232241603C:\Windows\TEMP\KB3023224_20150515_214930682-Microsoft .NET Framework 4.5.2-MSP0.txt(NULL)(NULL)

System errors:

=============

Error: (07/18/2015 08:40:35 AM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10000) (User: NT AUTHORITY)

Description: WLAN Extensibility Module has failed to start.

Module Path: C:\Windows\system32\Rtlihvs.dll

Error Code: 126

Error: (07/17/2015 11:44:30 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10000) (User: NT AUTHORITY)

Description: WLAN Extensibility Module has failed to start.

Module Path: C:\Windows\system32\Rtlihvs.dll

Error Code: 126

Error: (07/17/2015 12:28:35 AM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: The Intel(R) Rapid Storage Technology service terminated unexpectedly. It has done this 1 time(s).

Error: (07/17/2015 12:28:34 AM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: The Office Software Protection Platform service terminated unexpectedly. It has done this 1 time(s).

Error: (07/17/2015 12:28:34 AM) (Source: Service Control Manager) (EventID: 7031) (User: )

Description: The Windows Media Player Network Sharing Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 30000 milliseconds: Restart the service.

Error: (07/17/2015 12:28:34 AM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: The iPod Service service terminated unexpectedly. It has done this 1 time(s).

Error: (07/17/2015 12:28:33 AM) (Source: Service Control Manager) (EventID: 7031) (User: )

Description: The Windows Live ID Sign-in Assistant service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 10000 milliseconds: Restart the service.

Error: (07/17/2015 12:28:33 AM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: The Ad-Aware Service 11 service terminated unexpectedly. It has done this 1 time(s).

Error: (07/17/2015 12:28:33 AM) (Source: Service Control Manager) (EventID: 7031) (User: )

Description: The Apple Mobile Device Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.

Error: (07/17/2015 12:28:32 AM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: The Adobe Acrobat Update Service service terminated unexpectedly. It has done this 1 time(s).

Microsoft Office:

=========================

Error: (07/17/2015 12:26:10 AM) (Source: SideBySide) (EventID: 81) (User: )

Description: http://schemas.microsoft.com/SMI/2005/WindowsSettings^antispywareProductDisplayNameC:\Users\Brenton\Downloads\SpybotPortable\App\Spybot\SDWSCSvc.exe

Error: (07/17/2015 12:25:16 AM) (Source: Application Hang) (EventID: 1002) (User: )

Description: SDScan.exe2.4.40.181199c01d0c05f36f1789e0C:\Users\Brenton\Downloads\SpybotPortable\App\Spybot\SDScan.exef21fe57b-2c54-11e5-8982-bc5ff49707bf

Error: (07/16/2015 11:15:03 PM) (Source: .NET Runtime) (EventID: 1022) (User: )

Error: (07/16/2015 11:13:20 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: chrome.exe43.0.2357.132559b2699chrome.dll43.0.2357.132559b2249c000000500d729cf47401d0c0577a81568aC:\Program Files (x86)\Google\Chrome\Application\chrome.exeC:\Program Files (x86)\Google\Chrome\Application\43.0.2357.132\chrome.dllebbfec5f-2c4a-11e5-88a9-bc5ff49707bf

Error: (07/16/2015 10:56:27 PM) (Source: System Restore) (EventID: 8210) (User: )

Description: Windows Update0x80070005

Error: (07/15/2015 11:47:11 PM) (Source: Application Hang) (EventID: 1002) (User: )

Description: iexplore.exe11.0.9600.17910199401d0bf92f903a7f20C:\Program Files\Internet Explorer\iexplore.exe

Error: (07/15/2015 11:47:07 PM) (Source: Application Hang) (EventID: 1002) (User: )

Description: IEXPLORE.EXE11.0.9600.1790912b001d0bf930fc7dc600C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

Error: (06/13/2015 02:02:23 AM) (Source: Application Error) (EventID: 1000) (User: )

Description: Plex Media Scanner.exe0.9.12.3556ff0a4ntdll.dll6.1.7601.187985507b3e0c0000374000cea0b1c8801d0a5b7a7d0519cC:\Program Files (x86)\Plex\Plex Media Server\Plex Media Scanner.exeC:\Windows\SysWOW64\ntdll.dlle7089d2c-11aa-11e5-924e-bc5ff49707bf

Error: (06/12/2015 07:59:39 PM) (Source: .NET Runtime) (EventID: 1022) (User: )

Error: (05/15/2015 10:49:35 PM) (Source: MsiInstaller) (EventID: 1023) (User: NT AUTHORITY)

Description: Microsoft .NET Framework 4.5.2KB30232241603C:\Windows\TEMP\KB3023224_20150515_214930682-Microsoft .NET Framework 4.5.2-MSP0.txt(NULL)(NULL)

==================== Memory info ===========================

Processor: Intel(R) Core(TM) i5-3570K CPU @ 3.40GHz

Percentage of memory in use: 42%

Total physical RAM: 7885.88 MB

Available physical RAM: 4511.44 MB

Total Virtual: 15769.96 MB

Available Virtual: 12946.71 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:119.14 GB) (Free:27.2 GB) NTFS

Drive d: (SSD 840) (Fixed) (Total:111.79 GB) (Free:57.16 GB) NTFS

Drive f: (Elements) (Fixed) (Total:1397.26 GB) (Free:532.02 GB) NTFS

==================== MBR & Partition Table ==================

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 111.8 GB) (Disk ID: 5AE9060F)

Partition 1: (Not Active) - (Size=111.8 GB) - (Type=07 NTFS)

========================================================

Disk: 1 (MBR Code: Windows 7 or 8) (Size: 119.2 GB) (Disk ID: 61E5D726)

Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=119.1 GB) - (Type=07 NTFS)

========================================================

Disk: 2 (MBR Code: Windows XP) (Size: 1397.3 GB) (Disk ID: 0019B707)

Partition 1: (Not Active) - (Size=1397.3 GB) - (Type=07 NTFS)

==================== End of log ============================

ken545

Post #4July 19, 2015, 1:26 AM UTC

This is how you infected this computer by using the Torrents, not all but the greater percentage of files and programs downloaded via the torrents are infected

Go here and delete everything in your downloads folder but not the downloads folder itself

C:\Users\Brenton\Downloads

Go to Program and Features in the Control Panel and uninstall uTorrent, if you look at your Additions log under FireWall Rules you can see that uTorrent has free access in and out or your computer bringing along anything that is bundled with that file or program you downloaded, not nice

Then run a new scan with FRST, be sure to checkmark additions and post both logs please

bagahan

Post #5July 19, 2015, 2:15 AM UTC

Hey Ken,

Thanks for the help. I actually a few hours ago got the pop-ups to stop by changing my DNS router settings to obtain automatically. I think the malware affected it by creating IP ranges to use instead of obtaining the IP address automatically. I also updated my router's firmware and everything is working great again. I still did as you advised and here are the logs below.

FRST

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:18-07-2015 01

Ran by [removed] (administrator) on BRENTON-PC on 18-07-2015 19:11:37