Spyware / Malware / Virus Removal

Ads by coupongiant [Closed]

5 min read

Looking for the outcome? Ask AI

Kitgee123 Topic Starter

Post #1July 29, 2015, 5:46 AM UTC last edited July 29, 2015, 11:22 AM UTC

This is all of the info I needed to post. I think I got ads by coupongiant from the talking tom app, it showed a video that my son pressed and well all of a sudden an add by the virus popped up. I need to get rid of this thing I cannot stand it. Please help!

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:26-07-2015

Ran by [removed] (administrator) on ALOHILANI (29-07-2015 00:42:30)

Running from C:\Users\[removed]\Downloads

[removed]

Platform: Windows 8.1 Pro (X64) Language: English (United States)

Internet Explorer Version 11 (Default browser: Chrome)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(SEIKO EPSON CORPORATION) C:\Program Files (x86)\Common Files\EPSON\EBAPI\eEBSvc.exe

(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe

(Microsoft Corporation) C:\Windows\System32\dasHost.exe

(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe

(Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe

(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe

(Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe

(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe

(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe

(SEIKO EPSON CORPORATION) C:\Windows\System32\spool\drivers\x64\3\E_IATIGXA.EXE

(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe

(AVAST Software) C:\Users\kitana\Downloads\aswMBR.exe

(SEIKO EPSON CORPORATION) C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe

(SEIKO EPSON CORPORATION) C:\Program Files (x86)\Epson Software\FAX Utility\FUFAXSTM.exe

(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\…\Run: [3D BubbleSound] => "C:\Program Files\BubbleSound\3D BubbleSound.exe"

HKLM\…\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [170280 2015-07-11] (Apple Inc.)

HKLM-x32\…\Run: [EEventManager] => C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe [976320 2009-12-03] (SEIKO EPSON CORPORATION)

HKLM-x32\…\Run: [FUFAXSTM] => C:\Program Files (x86)\Epson Software\FAX Utility\FUFAXSTM.exe [847872 2009-12-03] (SEIKO EPSON CORPORATION)

HKLM-x32\…\Run: [ospd_us_001010003] => [X]

HKU\S-1-5-21-1837632124-2214114528-1467929312-1001\…\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [43816 2015-04-26] (Apple Inc.)

HKU\S-1-5-21-1837632124-2214114528-1467929312-1001\…\Run: [ApplePhotoStreams] => C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [43816 2015-04-26] (Apple Inc.)

HKU\S-1-5-21-1837632124-2214114528-1467929312-1001\…\Run: [iCloudDrive] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe [43816 2015-04-26] (Apple Inc.)

HKU\S-1-5-21-1837632124-2214114528-1467929312-1001\…\Run: [Artisan 830(Network)] => C:\windows\system32\spool\DRIVERS\x64\3\E_IATIGXA.EXE [224768 2010-01-12] (SEIKO EPSON CORPORATION)

HKU\S-1-5-21-1837632124-2214114528-1467929312-1001\…\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [53760128 2015-07-18] (Skype Technologies S.A.)

HKU\S-1-5-18\…\RunOnce: [Application Restart #0] => C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe [372400 2014-10-28] (Microsoft Corporation)

AppInit_DLLs-x32: C:\PROGRA~3\{90007~1\1173~1.1\nefa.dll => "C:\PROGRA~3\{90007~1\1173~1.1\nefa.dll" File not found

Startup: C:\Users\kitana\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Send to OneNote.lnk [2014-10-23]

ShortcutTarget: Send to OneNote.lnk -> C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE (Microsoft Corporation)

ShellIconOverlayIdentifiers-x32: [ SkyDrivePro1 (ErrorConflict)] -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2015-06-16] (Microsoft Corporation)

ShellIconOverlayIdentifiers-x32: [ SkyDrivePro2 (SyncInProgress)] -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2015-06-16] (Microsoft Corporation)

ShellIconOverlayIdentifiers-x32: [ SkyDrivePro3 (InSync)] -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2015-06-16] (Microsoft Corporation)

CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION

HKU\S-1-5-21-1837632124-2214114528-1467929312-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION

HKU\S-1-5-21-1837632124-2214114528-1467929312-1001\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bing.com/

SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =

SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =

SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =

Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2015-02-03] (Microsoft Corporation)

Tcpip\Parameters: [DhcpNameServer] [removed] [removed]

Tcpip\..\Interfaces\{63DCB409-4129-49E7-8CE8-66B6A04659D9}: [NameServer] 208.69.150.252,208.69.150.250

Tcpip\..\Interfaces\{8718928D-CBEB-45EA-A621-800A9249001D}: [NameServer] 208.69.150.252,208.69.150.250

Tcpip\..\Interfaces\{AF692B55-CF12-4A2B-BCAA-179F21505E24}: [DhcpNameServer] [removed] [removed]

StartMenuInternet: IEXPLORE.EXE - iexplore.exe

FireFox:

========

FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF64_17_0_0_169.dll [2015-06-15] ()

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_169.dll [2015-06-15] ()

FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\windows\SysWOW64\Adobe\Director\np32dsw_1217157.dll [2015-02-16] (Adobe Systems, Inc.)

FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2015-01-06] ()

FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2015-02-17] (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2014-08-31] (Microsoft Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-29] (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-29] (Google Inc.)

FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-05-01] (Adobe Systems Inc.)

Chrome:

=======

CHR dev: Chrome dev build detected! <======= ATTENTION

CHR Profile: C:\Users\kitana\AppData\Local\Google\Chrome\User Data\Default

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77128 2015-05-29] (Apple Inc.)

S3 BthHFSrv; C:\Windows\System32\BthHFSrv.dll [324608 2014-10-28] (Microsoft Corporation)

R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2753720 2015-07-01] (Microsoft Corporation)

R2 EpsonBidirectionalService; C:\Program Files (x86)\Common Files\EPSON\EBAPI\eEBSVC.exe [94208 2006-12-19] (SEIKO EPSON CORPORATION) [File not signed]

R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366520 2015-02-03] (Microsoft Corporation)

R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2015-02-03] (Microsoft Corporation)

S2 Update eye perform; "C:\Program Files (x86)\eye perform\updateeyeperform.exe" [X]

S2 Util eye perform; "C:\Program Files (x86)\eye perform\bin\utileyeperform.exe" [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 AX88772; C:\Windows\system32\DRIVERS\ax88772.sys [113864 2013-07-18] (ASIX Electronics Corp.)

R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [226304 2014-05-08] (Microsoft Corporation)

R3 iaLPSS_GPIO; C:\Windows\System32\drivers\iaLPSS_GPIO.sys [24568 2013-10-07] (Intel Corporation)

R3 iaLPSS_I2C; C:\Windows\System32\drivers\iaLPSS_I2C.sys [99320 2013-10-07] (Intel Corporation)

R3 MEIx64; C:\Windows\System32\drivers\TeeDriverx64.sys [100312 2014-01-31] (Intel Corporation)

R3 mrvlpcie8897; C:\Windows\system32\DRIVERS\mrvlpcie8897.sys [1015304 2015-06-10] (Marvell Semiconductors Inc.)

R3 SensorsHIDClassDriver; C:\Windows\System32\drivers\WUDFRd.sys [226304 2014-10-28] (Microsoft Corporation)

R3 SensorsServiceDriver; C:\Windows\System32\drivers\WUDFRd.sys [226304 2014-10-28] (Microsoft Corporation)

R3 SurfaceAccessoryDevice; C:\Windows\System32\drivers\SurfaceAccessoryDevice.sys [51856 2014-05-30] (Microsoft Corporation)

R3 SurfaceCapacitiveHomeButton; C:\Windows\System32\drivers\SurfaceCapacitiveHomeButton.sys [44152 2014-11-27] (Microsoft Corporation)

R3 SurfaceDisplayCalibration; C:\Windows\System32\drivers\SurfaceDisplayCalibration.sys [41616 2014-05-02] (Microsoft Corporation)

R3 SurfaceIntegrationDriver; C:\Windows\System32\drivers\SurfaceIntegrationDriver.sys [49776 2014-12-09] (Microsoft Corporation)

R0 SurfacePciController; C:\Windows\System32\drivers\SurfacePciController.sys [35440 2014-10-08] (Microsoft Corporation)

R3 SurfacePenDriver; C:\Windows\system32\DRIVERS\SurfacePenDriver.sys [76424 2015-03-31] (Microsoft Corporation)

S3 SurfaceTouchCover; C:\Windows\System32\drivers\SurfaceTouchCover.sys [35976 2014-04-14] (Microsoft Corporation)

S3 SurfaceTypeCover; C:\Windows\System32\drivers\SurfaceTypeCover.sys [35984 2014-03-18] (Microsoft Corporation)

R3 TrueColor; C:\Windows\system32\DRIVERS\TrueColor.sys [35952 2014-07-07] ()

S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [54784 2014-07-28] (Apple, Inc.) [File not signed]

R2 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2015-02-03] (Microsoft Corporation)

R3 WiFiClass; C:\Windows\system32\DRIVERS\wificlass.sys [420352 2015-06-10] (Microsoft Corporation)

S1 wsfd_vw_1_10_0_20; system32\drivers\wsfd_vw_1_10_0_20.sys [X]

U3 aswMBR; \??\C:\Users\kitana\AppData\Local\Temp\aswMBR.sys [X]

U3 aswVmm; \??\C:\Users\kitana\AppData\Local\Temp\aswVmm.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-07-29 00:42 - 2015-07-29 00:42 - 00012486 _____ C:\Users\kitana\Downloads\FRST.txt

2015-07-29 00:42 - 2015-07-29 00:42 - 00000000 ____D C:\FRST

2015-07-29 00:41 - 2015-07-29 00:41 - 02146816 _____ (Farbar) C:\Users\kitana\Downloads\FRST64.exe

2015-07-29 00:37 - 2015-07-29 00:37 - 00000586 _____ C:\Users\kitana\Documents\aswMBR.txt

2015-07-29 00:19 - 2015-07-29 00:19 - 05198336 _____ (AVAST Software) C:\Users\kitana\Downloads\aswMBR.exe

2015-07-29 00:18 - 2015-07-29 00:18 - 00772245 _____ C:\Users\kitana\Downloads\setup.zip

2015-07-29 00:13 - 2015-07-29 00:27 - 00000922 _____ C:\windows\Tasks\GoogleUpdateTaskMachineCore.job

2015-07-29 00:13 - 2015-07-29 00:23 - 00000926 _____ C:\windows\Tasks\GoogleUpdateTaskMachineUA.job

2015-07-29 00:13 - 2015-07-29 00:18 - 00003898 _____ C:\windows\System32\Tasks\GoogleUpdateTaskMachineUA

2015-07-29 00:13 - 2015-07-29 00:18 - 00003662 _____ C:\windows\System32\Tasks\GoogleUpdateTaskMachineCore

2015-07-27 23:42 - 2015-07-27 23:42 - 00000000 _____ C:\autoexec.bat

2015-07-27 23:31 - 2015-07-27 23:32 - 00000000 ____D C:\windows\pss

2015-07-22 21:41 - 2015-07-22 21:41 - 00000000 ____D C:\Users\kitana\Tracing

2015-07-22 21:39 - 2015-07-29 00:28 - 00000000 ____D C:\Users\kitana\AppData\Roaming\Skype

2015-07-22 21:39 - 2015-07-22 21:39 - 00002713 _____ C:\Users\Public\Desktop\Skype.lnk

2015-07-22 21:39 - 2015-07-22 21:39 - 00000000 ___RD C:\Program Files (x86)\Skype

2015-07-22 21:39 - 2015-07-22 21:39 - 00000000 ____D C:\Users\kitana\AppData\Local\Skype

2015-07-22 21:39 - 2015-07-22 21:39 - 00000000 ____D C:\ProgramData\Skype

2015-07-22 21:39 - 2015-07-22 21:39 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype

2015-07-22 11:31 - 2015-07-23 14:52 - 00000000 ____D C:\Program Files (x86)\Slippery Bicycle

2015-07-20 22:09 - 2015-07-14 09:14 - 00358912 _____ (Adobe Systems Incorporated) C:\windows\system32\atmfd.dll

2015-07-20 22:09 - 2015-07-14 09:14 - 00301056 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\atmfd.dll

2015-07-20 22:09 - 2015-07-14 09:14 - 00035840 _____ (Adobe Systems) C:\windows\SysWOW64\atmlib.dll

2015-07-20 22:09 - 2015-07-14 09:13 - 00044032 _____ (Adobe Systems) C:\windows\system32\atmlib.dll

2015-07-20 15:36 - 2015-07-20 15:36 - 00000000 ____D C:\Users\kitana\AppData\Local\GWX

2015-07-19 22:17 - 2015-07-28 22:17 - 00000374 _____ C:\windows\Tasks\JewelJazz.job

2015-07-19 22:17 - 2015-07-19 22:17 - 00003262 _____ C:\windows\System32\Tasks\JewelJazz

2015-07-19 01:05 - 2015-07-19 01:05 - 00001772 _____ C:\Users\Public\Desktop\iTunes.lnk

2015-07-19 01:05 - 2015-07-19 01:05 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes

2015-07-19 01:04 - 2015-07-19 01:04 - 00000000 ____D C:\Program Files\iTunes

2015-07-19 01:04 - 2015-07-19 01:04 - 00000000 ____D C:\Program Files\iPod

2015-07-15 17:03 - 2015-05-07 12:50 - 22292672 _____ (Microsoft Corporation) C:\windows\system32\shell32.dll

2015-07-15 17:03 - 2015-05-07 12:00 - 03109376 _____ (Microsoft Corporation) C:\windows\system32\ExplorerFrame.dll

2015-07-15 17:03 - 2015-05-07 11:53 - 19734960 _____ (Microsoft Corporation) C:\windows\SysWOW64\shell32.dll

2015-07-15 17:03 - 2015-05-07 11:12 - 02706432 _____ (Microsoft Corporation) C:\windows\SysWOW64\ExplorerFrame.dll

2015-07-15 16:51 - 2015-05-01 18:33 - 00410739 _____ C:\windows\system32\ApnDatabase.xml

2015-07-15 16:36 - 2015-06-29 17:43 - 00026288 _____ (Microsoft Corporation) C:\windows\system32\CompatTelRunner.exe

2015-07-15 16:36 - 2015-06-29 10:07 - 01145856 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll

2015-07-15 16:36 - 2015-06-29 10:07 - 01084928 _____ (Microsoft Corporation) C:\windows\system32\appraiser.dll

2015-07-15 16:36 - 2015-06-29 10:07 - 00764928 _____ (Microsoft Corporation) C:\windows\system32\invagent.dll

2015-07-15 16:36 - 2015-06-29 10:07 - 00433152 _____ (Microsoft Corporation) C:\windows\system32\devinv.dll

2015-07-15 16:36 - 2015-06-29 10:07 - 00067584 _____ (Microsoft Corporation) C:\windows\system32\acmigration.dll

2015-07-15 16:36 - 2015-06-26 18:21 - 00726528 _____ (Microsoft Corporation) C:\windows\system32\generaltel.dll

2015-07-15 16:36 - 2015-06-26 18:21 - 00227328 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll

2015-07-15 16:36 - 2015-05-12 08:19 - 00294912 _____ (Microsoft Corporation) C:\windows\system32\SystemEventsBrokerServer.dll

2015-07-15 16:36 - 2015-05-11 13:17 - 01201664 ____C (Microsoft Corporation) C:\windows\system32\Drivers\bthport.sys

2015-07-15 16:36 - 2015-05-11 11:34 - 00332800 _____ (Microsoft Corporation) C:\windows\system32\fhcpl.dll

2015-07-15 16:36 - 2015-05-07 10:21 - 00522240 _____ (Microsoft Corporation) C:\windows\system32\GeofenceMonitorService.dll

2015-07-15 16:36 - 2015-05-07 10:05 - 00367104 _____ (Microsoft Corporation) C:\windows\SysWOW64\GeofenceMonitorService.dll

2015-07-15 16:36 - 2015-05-03 10:09 - 00274944 _____ (Microsoft Corporation) C:\windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll

2015-07-15 16:36 - 2015-05-03 10:07 - 07784448 _____ (Microsoft Corporation) C:\windows\system32\Windows.Data.Pdf.dll

2015-07-15 16:36 - 2015-05-03 09:58 - 00210944 _____ (Microsoft Corporation) C:\windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll

2015-07-15 16:36 - 2015-05-03 09:57 - 05264384 _____ (Microsoft Corporation) C:\windows\SysWOW64\Windows.Data.Pdf.dll

2015-07-15 16:36 - 2015-05-03 09:55 - 00971776 _____ (Microsoft Corporation) C:\windows\system32\WSShared.dll

2015-07-15 16:36 - 2015-05-03 09:49 - 00811008 _____ (Microsoft Corporation) C:\windows\SysWOW64\WSShared.dll

2015-07-15 16:36 - 2015-05-02 19:39 - 00227328 _____ (Microsoft Corporation) C:\windows\system32\profsvc.dll

2015-07-15 16:36 - 2015-04-29 18:22 - 00130048 _____ (Microsoft Corporation) C:\windows\system32\WiFiDisplay.dll

2015-07-15 16:36 - 2015-04-28 08:13 - 00513480 _____ C:\windows\SysWOW64\locale.nls

2015-07-15 16:36 - 2015-04-28 08:13 - 00513480 _____ C:\windows\system32\locale.nls

2015-07-15 16:36 - 2015-04-24 21:25 - 00020992 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usb8023.sys

2015-07-15 16:36 - 2015-04-23 10:47 - 03084288 _____ (Microsoft Corporation) C:\windows\system32\msftedit.dll

2015-07-15 16:36 - 2015-04-23 10:16 - 02471424 _____ (Microsoft Corporation) C:\windows\SysWOW64\msftedit.dll

2015-07-15 16:36 - 2014-11-04 14:25 - 00059712 ____C (Microsoft Corporation) C:\windows\system32\Drivers\kbdclass.sys

2015-07-15 16:36 - 2014-11-04 14:25 - 00051008 ____C (Microsoft Corporation) C:\windows\system32\Drivers\mouclass.sys

2015-07-15 16:36 - 2014-11-04 01:55 - 00026112 ____C (Microsoft Corporation) C:\windows\system32\Drivers\sermouse.sys

2015-07-15 16:36 - 2014-11-04 01:54 - 00108544 ____C (Microsoft Corporation) C:\windows\system32\Drivers\i8042prt.sys

2015-07-15 16:36 - 2014-11-04 01:54 - 00032256 ____C (Microsoft Corporation) C:\windows\system32\Drivers\kbdhid.sys

2015-07-15 16:36 - 2014-11-04 01:54 - 00030208 ____C (Microsoft Corporation) C:\windows\system32\Drivers\mouhid.sys

2015-07-14 16:17 - 2015-07-28 22:17 - 00000374 _____ C:\windows\Tasks\RockRecord.job

2015-07-14 16:17 - 2015-07-14 16:17 - 00003262 _____ C:\windows\System32\Tasks\RockRecord

2015-07-14 15:29 - 2015-06-28 00:07 - 00442712 _____ (Microsoft Corporation) C:\windows\system32\msv1_0.dll

2015-07-14 15:29 - 2015-06-28 00:07 - 00178008 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecpkg.sys

2015-07-14 15:29 - 2015-06-28 00:06 - 01311960 _____ (Microsoft Corporation) C:\windows\system32\rpcrt4.dll

2015-07-14 15:29 - 2015-06-28 00:06 - 00332120 _____ (Microsoft Corporation) C:\windows\SysWOW64\msv1_0.dll

2015-07-14 15:29 - 2015-06-27 11:42 - 00747520 _____ (Microsoft Corporation) C:\windows\SysWOW64\rpcrt4.dll

2015-07-14 15:29 - 2015-06-26 22:13 - 00202240 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxsmb20.sys

2015-07-14 15:29 - 2015-06-26 22:12 - 00401408 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxsmb.sys

2015-07-14 15:29 - 2015-06-26 22:12 - 00284672 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxsmb10.sys

2015-07-14 15:29 - 2015-06-26 21:40 - 00445440 _____ (Microsoft Corporation) C:\windows\system32\certcli.dll

2015-07-14 15:29 - 2015-06-26 21:05 - 01441792 _____ (Microsoft Corporation) C:\windows\system32\lsasrv.dll

2015-07-14 15:29 - 2015-06-26 21:00 - 00989184 _____ (Microsoft Corporation) C:\windows\system32\kerberos.dll

2015-07-14 15:29 - 2015-06-26 20:53 - 00324096 _____ (Microsoft Corporation) C:\windows\SysWOW64\certcli.dll

2015-07-14 15:29 - 2015-06-26 20:26 - 00802816 _____ (Microsoft Corporation) C:\windows\SysWOW64\kerberos.dll

2015-07-14 15:29 - 2015-06-24 21:31 - 04177920 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys

2015-07-14 15:29 - 2015-06-15 17:41 - 00065024 _____ (Microsoft Corporation) C:\windows\system32\msiexec.exe

2015-07-14 15:29 - 2015-06-15 17:24 - 03320320 _____ (Microsoft Corporation) C:\windows\system32\msi.dll

2015-07-14 15:29 - 2015-06-15 16:16 - 00059904 _____ (Microsoft Corporation) C:\windows\SysWOW64\msiexec.exe

2015-07-14 15:29 - 2015-06-15 16:09 - 03607552 _____ (Microsoft Corporation) C:\windows\SysWOW64\msi.dll

2015-07-14 15:29 - 2015-06-15 15:50 - 02774528 _____ (Microsoft Corporation) C:\windows\system32\authui.dll

2015-07-14 15:29 - 2015-06-15 14:57 - 02460160 _____ (Microsoft Corporation) C:\windows\SysWOW64\authui.dll

2015-07-14 15:29 - 2015-03-08 21:02 - 00067584 _____ (Microsoft Corporation) C:\windows\system32\Drivers\storvsp.sys

2015-07-14 15:28 - 2015-07-09 14:51 - 00136904 _____ (Microsoft Corporation) C:\windows\system32\wuauclt.exe

2015-07-14 15:28 - 2015-07-09 13:40 - 00359936 _____ (Microsoft Corporation) C:\windows\system32\WinSetupUI.dll

2015-07-14 15:28 - 2015-07-09 11:03 - 03701760 _____ (Microsoft Corporation) C:\windows\system32\wuaueng.dll

2015-07-14 15:28 - 2015-07-09 10:54 - 00035840 _____ (Microsoft Corporation) C:\windows\system32\wuapp.exe

2015-07-14 15:28 - 2015-07-09 10:53 - 00140288 _____ (Microsoft Corporation) C:\windows\system32\wuwebv.dll

2015-07-14 15:28 - 2015-07-09 10:50 - 00409088 _____ (Microsoft Corporation) C:\windows\system32\WUSettingsProvider.dll

2015-07-14 15:28 - 2015-07-09 10:50 - 00095744 _____ (Microsoft Corporation) C:\windows\system32\wudriver.dll

2015-07-14 15:28 - 2015-07-09 10:48 - 00891904 _____ (Microsoft Corporation) C:\windows\system32\wuapi.dll

2015-07-14 15:28 - 2015-07-09 10:46 - 02229248 _____ (Microsoft Corporation) C:\windows\system32\wucltux.dll

2015-07-14 15:28 - 2015-07-09 10:38 - 00029696 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuapp.exe

2015-07-14 15:28 - 2015-07-09 10:37 - 00124928 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuwebv.dll

2015-07-14 15:28 - 2015-07-09 10:35 - 00081920 _____ (Microsoft Corporation) C:\windows\SysWOW64\wudriver.dll

2015-07-14 15:28 - 2015-07-09 10:34 - 00721920 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuapi.dll

2015-07-14 15:28 - 2015-07-01 17:08 - 05923840 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll

2015-07-14 15:28 - 2015-07-01 16:14 - 04520448 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll

2015-07-14 15:28 - 2015-06-26 22:08 - 00066048 _____ (Microsoft Corporation) C:\windows\system32\wups.dll

2015-07-14 15:28 - 2015-06-26 22:08 - 00052224 _____ (Microsoft Corporation) C:\windows\system32\wups2.dll

2015-07-14 15:28 - 2015-06-26 21:14 - 00027136 _____ (Microsoft Corporation) C:\windows\SysWOW64\wups.dll

2015-07-14 15:28 - 2015-05-30 16:18 - 00037888 _____ (Microsoft Corporation) C:\windows\system32\werdiagcontroller.dll

2015-07-14 15:28 - 2015-05-30 14:36 - 00230400 _____ (Microsoft Corporation) C:\windows\system32\AudioEndpointBuilder.dll

2015-07-14 15:28 - 2015-05-30 14:35 - 00911360 _____ (Microsoft Corporation) C:\windows\system32\audiosrv.dll

2015-07-14 15:27 - 2015-07-02 16:21 - 19877376 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll

2015-07-14 15:27 - 2015-07-02 15:50 - 02279424 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll

2015-07-14 15:27 - 2015-07-02 15:49 - 25193984 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll

2015-07-14 15:27 - 2015-07-02 15:23 - 02885632 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll

2015-07-14 15:27 - 2015-07-02 15:19 - 12855296 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll

2015-07-14 15:27 - 2015-07-02 14:55 - 01310720 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll

2015-07-14 15:27 - 2015-07-02 14:20 - 14453248 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll

2015-07-14 15:27 - 2015-07-02 13:59 - 01545728 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll

2015-07-14 15:26 - 2015-06-16 00:36 - 01661576 _____ (Microsoft Corporation) C:\windows\system32\ole32.dll

2015-07-14 15:26 - 2015-06-16 00:36 - 01212248 _____ (Microsoft Corporation) C:\windows\SysWOW64\ole32.dll

2015-07-14 15:26 - 2015-06-15 17:39 - 00584192 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll

2015-07-14 15:26 - 2015-06-15 17:38 - 00088064 _____ (Microsoft Corporation) C:\windows\system32\MshtmlDac.dll

2015-07-14 15:26 - 2015-06-15 17:26 - 00633856 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll

2015-07-14 15:26 - 2015-06-15 17:24 - 00816640 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll

2015-07-14 15:26 - 2015-06-15 17:02 - 00087552 _____ (Microsoft Corporation) C:\windows\system32\tdc.ocx

2015-07-14 15:26 - 2015-06-15 16:58 - 00199680 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll

2015-07-14 15:26 - 2015-06-15 16:57 - 00092160 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll

2015-07-14 15:26 - 2015-06-15 16:56 - 00145408 _____ (Microsoft Corporation) C:\windows\system32\iepeers.dll

2015-07-14 15:26 - 2015-06-15 16:55 - 00316928 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll

2015-07-14 15:26 - 2015-06-15 16:49 - 01032704 _____ (Microsoft Corporation) C:\windows\system32\inetcomm.dll

2015-07-14 15:26 - 2015-06-15 16:41 - 00262144 _____ (Microsoft Corporation) C:\windows\system32\webcheck.dll

2015-07-14 15:26 - 2015-06-15 16:38 - 00801280 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll

2015-07-14 15:26 - 2015-06-15 16:36 - 02125824 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl

2015-07-14 15:26 - 2015-06-15 16:17 - 02880000 _____ (Microsoft Corporation) C:\windows\system32\actxprxy.dll

2015-07-14 15:26 - 2015-06-15 16:16 - 02427392 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll

2015-07-14 15:26 - 2015-06-15 16:15 - 00504320 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll

2015-07-14 15:26 - 2015-06-15 16:13 - 00064000 _____ (Microsoft Corporation) C:\windows\SysWOW64\MshtmlDac.dll

2015-07-14 15:26 - 2015-06-15 16:04 - 00478208 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll

2015-07-14 15:26 - 2015-06-15 16:03 - 00664064 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll

2015-07-14 15:26 - 2015-06-15 15:52 - 00800768 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll

2015-07-14 15:26 - 2015-06-15 15:47 - 00073216 _____ (Microsoft Corporation) C:\windows\SysWOW64\tdc.ocx

2015-07-14 15:26 - 2015-06-15 15:44 - 00168960 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll

2015-07-14 15:26 - 2015-06-15 15:43 - 00076288 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll

2015-07-14 15:26 - 2015-06-15 15:42 - 00128000 _____ (Microsoft Corporation) C:\windows\SysWOW64\iepeers.dll

2015-07-14 15:26 - 2015-06-15 15:41 - 00285696 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll

2015-07-14 15:26 - 2015-06-15 15:37 - 00880128 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcomm.dll

2015-07-14 15:26 - 2015-06-15 15:32 - 00230400 _____ (Microsoft Corporation) C:\windows\SysWOW64\webcheck.dll

2015-07-14 15:26 - 2015-06-15 15:31 - 00689152 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll

2015-07-14 15:26 - 2015-06-15 15:30 - 02052608 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl

2015-07-14 15:26 - 2015-06-15 15:30 - 00327168 _____ (Microsoft Corporation) C:\windows\SysWOW64\iedkcs32.dll

2015-07-14 15:26 - 2015-06-15 15:17 - 01048576 _____ (Microsoft Corporation) C:\windows\SysWOW64\actxprxy.dll

2015-07-14 15:26 - 2015-06-15 15:07 - 01951232 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll

2015-07-14 15:26 - 2015-06-15 15:02 - 00710144 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dll

2015-07-14 15:26 - 2015-06-10 22:49 - 01380600 _____ (Microsoft Corporation) C:\windows\system32\gdi32.dll

2015-07-14 15:26 - 2015-06-10 11:13 - 01097216 _____ (Microsoft Corporation) C:\windows\SysWOW64\gdi32.dll

2015-07-14 15:26 - 2015-05-07 11:47 - 00564224 _____ (Microsoft Corporation) C:\windows\system32\apphelp.dll

2015-07-13 22:17 - 2015-07-28 22:17 - 00000376 _____ C:\windows\Tasks\DataMarker.job

2015-07-13 22:17 - 2015-07-13 22:17 - 00003264 _____ C:\windows\System32\Tasks\DataMarker

2015-07-12 22:22 - 2015-07-12 22:22 - 00000000 _____ C:\Users\kitana\AppData\Local\Temp.dat

2015-07-12 22:19 - 2015-07-27 09:53 - 00000024 _____ C:\Users\kitana\AppData\Roaming\appdataFr25.bin

2015-07-12 22:19 - 2015-07-12 22:19 - 00000000 ____D C:\Program Files (x86)\Streak for Gmail

2015-07-12 22:17 - 2015-07-28 22:17 - 00000374 _____ C:\windows\Tasks\DailyDrive.job

2015-07-12 22:17 - 2015-07-12 22:17 - 00003262 _____ C:\windows\System32\Tasks\DailyDrive

2015-07-11 05:27 - 2015-07-11 05:27 - 00000912 _____ C:\windows\SysWOW64\${LOGFILE}

2015-07-10 04:17 - 2015-07-28 22:17 - 00000376 _____ C:\windows\Tasks\BakerBunny.job

2015-07-10 04:17 - 2015-07-10 04:17 - 00003264 _____ C:\windows\System32\Tasks\BakerBunny

2015-07-08 04:17 - 2015-07-23 14:52 - 00000000 ____D C:\Program Files (x86)\Glamorous Worry

2015-07-08 04:17 - 2015-07-08 04:17 - 00010752 _____ (UG North) C:\windows\system32\Hibiki.dll

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-07-29 00:39 - 2014-07-28 20:52 - 01959097 _____ C:\windows\WindowsUpdate.log

2015-07-29 00:32 - 2014-07-28 21:01 - 00003598 _____ C:\windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1837632124-2214114528-1467929312-1001

2015-07-29 00:31 - 2014-05-08 22:06 - 00863592 _____ C:\windows\system32\PerfStringBackup.INI

2015-07-29 00:27 - 2015-05-14 10:55 - 00011738 _____ C:\windows\setupact.log

2015-07-29 00:27 - 2014-10-13 01:41 - 00000000 ___RD C:\Users\kitana\iCloudDrive

2015-07-29 00:27 - 2014-07-28 20:58 - 00000000 ___DO C:\Users\kitana\OneDrive

2015-07-29 00:27 - 2013-08-22 09:45 - 00000006 ____H C:\windows\Tasks\SA.DAT

2015-07-29 00:10 - 2013-08-22 10:36 - 00000000 ____D C:\windows\system32\sru

2015-07-28 23:27 - 2015-06-15 16:20 - 00000830 _____ C:\windows\Tasks\Adobe Flash Player Updater.job

2015-07-28 22:24 - 2013-08-22 10:36 - 00000000 ____D C:\windows\AppReadiness

2015-07-28 22:17 - 2015-06-15 16:17 - 00000362 _____ C:\windows\Tasks\Bidaily Synchronize Task[3c32].job

2015-07-28 21:30 - 2013-08-22 10:20 - 00000000 ____D C:\windows\CbsTemp

2015-07-28 18:48 - 2014-07-28 20:54 - 00000000 ____D C:\Users\kitana

2015-07-28 18:41 - 2014-07-28 21:01 - 00003934 _____ C:\windows\System32\Tasks\User_Feed_Synchronization-{31A87D0C-978D-41CB-9969-2A6BCC9EF49E}

2015-07-28 12:34 - 2013-08-22 08:25 - 00524288 ___SH C:\windows\system32\config\BBI

2015-07-28 00:44 - 2013-08-22 10:36 - 00000000 ____D C:\windows\system32\NDF

2015-07-28 00:10 - 2014-10-13 01:41 - 00000000 ____D C:\Users\kitana\Documents\Outlook Files

2015-07-28 00:07 - 2014-10-13 01:41 - 00000000 ____D C:\Users\kitana\AppData\Local\352E36AF-792B-4AC9-92A7-530BA3B8CB87.aplzod

2015-07-25 18:24 - 2015-06-15 16:23 - 00000000 ____D C:\ProgramData\abc

2015-07-25 03:47 - 2015-04-06 23:16 - 00000000 ___SD C:\windows\system32\GWX

2015-07-24 13:23 - 2014-07-28 20:54 - 00000000 ____D C:\Users\kitana\AppData\Local\Packages

2015-07-22 02:33 - 2014-08-31 18:37 - 00000000 ____D C:\Program Files\Microsoft Office 15

2015-07-21 12:04 - 2013-08-22 09:44 - 00481880 _____ C:\windows\system32\FNTCACHE.DAT

2015-07-19 01:44 - 2014-09-01 17:15 - 00000000 ____D C:\windows\system32\MRT

2015-07-19 01:04 - 2015-04-10 16:53 - 00000000 ____D C:\Program Files (x86)\iTunes

2015-07-19 01:04 - 2014-09-24 18:59 - 00000000 ____D C:\Program Files\Common Files\Apple

2015-07-18 21:29 - 2015-04-06 23:16 - 00000000 ___SD C:\windows\SysWOW64\GWX

2015-07-18 21:29 - 2013-08-22 10:36 - 00000000 ___RD C:\windows\ToastData

2015-07-17 03:04 - 2013-08-22 10:36 - 00000000 ____D C:\windows\rescache

2015-07-15 22:58 - 2015-01-21 10:55 - 00003886 _____ C:\windows\System32\Tasks\Adobe Acrobat Update Task

2015-07-15 22:44 - 2013-08-22 10:36 - 00000000 ____D C:\windows\WinStore

2015-07-15 16:53 - 2014-12-13 14:10 - 00000000 ____D C:\windows\system32\appraiser

2015-07-15 16:53 - 2014-09-01 17:15 - 00000000 ___SD C:\windows\system32\CompatTel

2015-07-14 16:22 - 2013-08-22 10:36 - 00000000 ____D C:\windows\PolicyDefinitions

2015-07-13 16:10 - 2013-08-22 10:38 - 00792568 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe

2015-07-13 16:10 - 2013-08-22 10:38 - 00178168 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl

2015-07-11 05:53 - 2014-05-08 21:57 - 00041336 _____ C:\windows\PFRO.log

2015-07-11 05:26 - 2013-08-22 08:25 - 00000194 _____ C:\windows\win.ini

2015-07-08 04:07 - 2015-04-10 16:53 - 00000000 ____D C:\ProgramData\E1864A66-75E3-486a-BD95-D1B7D99A84A7

2015-07-07 16:07 - 2014-08-31 12:24 - 00002210 _____ C:\Users\Public\Desktop\Google Chrome.lnk

2015-07-05 05:08 - 2014-07-28 21:29 - 00300704 ____N (Microsoft Corporation) C:\windows\system32\MpSigStub.exe

2015-07-03 08:43 - 2014-09-01 17:15 - 130333168 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe

2015-06-30 15:35 - 2014-07-28 23:09 - 00000000 ____D C:\Users\kitana\AppData\Roaming\DVDVideoSoft

==================== Files in the root of some directories =======

2015-07-12 22:19 - 2015-07-27 09:53 - 0000024 _____ () C:\Users\kitana\AppData\Roaming\appdataFr25.bin

2015-06-15 16:16 - 2015-06-15 16:16 - 0000064 _____ () C:\Users\kitana\AppData\Local\aca72bb0cc4a016bcb24550c0881c267

2015-07-12 22:22 - 2015-07-12 22:22 - 0000000 _____ () C:\Users\kitana\AppData\Local\Temp.dat

2014-05-08 21:58 - 2014-05-08 21:58 - 0000000 ____H () C:\ProgramData\DP45977C.lfl

Some files in TEMP:

====================

C:\Users\kitana\AppData\Local\Temp\101169424667237921c.exe

C:\Users\kitana\AppData\Local\Temp\210629742019572405c.exe

C:\Users\kitana\AppData\Local\Temp\7295035863475703378c.exe

C:\Users\kitana\AppData\Local\Temp\8409408362856285087c.exe

C:\Users\kitana\AppData\Local\Temp\consumerinput_c54.exe

C:\Users\kitana\AppData\Local\Temp\Coupoon72.exe

C:\Users\kitana\AppData\Local\Temp\FlashPlayerPro.exe

C:\Users\kitana\AppData\Local\Temp\gb-installer-nsi22.exe

C:\Users\kitana\AppData\Local\Temp\Hibiki.dll

C:\Users\kitana\AppData\Local\Temp\LookSafe17.exe

C:\Users\kitana\AppData\Local\Temp\OptimizerPro41.exe

C:\Users\kitana\AppData\Local\Temp\optprosetup.exe

C:\Users\kitana\AppData\Local\Temp\Quarantine.exe

C:\Users\kitana\AppData\Local\Temp\SearchProtect34.exe

C:\Users\kitana\AppData\Local\Temp\sqlite3.dll

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2015-07-28 02:04

==================== End of log ============================

Additional scan result of Farbar Recovery Scan Tool (x64) Version:26-07-2015

Ran by [removed] at 2015-07-29 00:43:12

Running from C:\Users\[removed]\Downloads

Boot Mode: Normal

==========================================================

==================== Accounts: =============================

Administrator (S-1-5-21-1837632124-2214114528-1467929312-500 - Administrator - Disabled)

Guest (S-1-5-21-1837632124-2214114528-1467929312-501 - Limited - Disabled)

kitana (S-1-5-21-1837632124-2214114528-1467929312-1001 - Administrator - Enabled) => C:\Users\kitana

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Flash Player 17 NPAPI (HKLM-x32\…\Adobe Flash Player NPAPI) (Version: 17.0.0.169 - Adobe Systems Incorporated)

Adobe Reader XI (11.0.11) (HKLM-x32\…\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.11 - Adobe Systems Incorporated)

Adobe Shockwave Player 12.1 (HKLM-x32\…\Adobe Shockwave Player) (Version: 12.1.7.157 - Adobe Systems, Inc.)

Apple Application Support (32-bit) (HKLM-x32\…\{7FE25256-B7C1-480D-B736-10A67A833AEA}) (Version: 3.2 - Apple Inc.)

Apple Application Support (64-bit) (HKLM\…\{B255D495-4734-4E9B-B4F5-96702FD4A7B9}) (Version: 3.2 - Apple Inc.)

Apple Mobile Device Support (HKLM\…\{5D61F006-168C-4B8B-B7FD-F113C10AE0E4}) (Version: 8.2.1.3 - Apple Inc.)

Apple Software Update (HKLM-x32\…\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)

Bonjour (HKLM\…\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)

EPSON Artisan 830 Series Printer Uninstall (HKLM\…\EPSON Artisan 830 Series) (Version: - SEIKO EPSON Corporation)

Epson Event Manager (HKLM-x32\…\{03B8AA32-F23C-4178-B8E6-09ECD07EAA47}) (Version: 2.40.0001 - SEIKO EPSON CORPORATION)

Epson FAX Utility (HKLM-x32\…\{0CBE6C93-CB2E-4378-91EE-12BE6D4E2E4A}) (Version: 1.10.00 - SEIKO EPSON CORPORATION)

Epson PC-FAX Driver (HKLM-x32\…\EPSON PC-FAX Driver 2) (Version: - )

EPSON Scan (HKLM-x32\…\EPSON Scanner) (Version: - Seiko Epson Corporation)

EpsonNet Print (HKLM-x32\…\{3E31400D-274E-4647-916C-2CACC3741799}) (Version: 2.4j - SEIKO EPSON CORPORATION)

EpsonNet Setup 3.3 (HKLM-x32\…\{C9D8A041-2963-4B31-8FFC-1500F3DB9293}) (Version: 3.3b - SEIKO EPSON CORPORATION)

Free Studio version 6.4.2.113 (HKLM-x32\…\Free Studio_is1) (Version: 6.4.2.113 - DVDVideoSoft Ltd.)

Google Chrome (HKLM-x32\…\Google Chrome) (Version: 43.0.2357.132 - Google Inc.)

Google Update Helper (x32 Version: 1.3.28.1 - Google Inc.) Hidden

iCloud (HKLM\…\{709A2D23-C25E-47B5-9268-CB6FEE648504}) (Version: 4.1.1.53 - Apple Inc.)

iTunes (HKLM\…\{6CF1A7E2-8001-4870-9F18-3C6CDD6FE9E3}) (Version: 12.2.1.16 - Apple Inc.)

Microsoft Office Professional Plus 2013 - en-us (HKLM\…\ProPlusRetail - en-us) (Version: 15.0.4737.1003 - Microsoft Corporation)

Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4727.1003 - Microsoft Corporation) Hidden

Office 15 Click-to-Run Licensing Component (Version: 15.0.4727.1003 - Microsoft Corporation) Hidden

Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4727.1003 - Microsoft Corporation) Hidden

Skype™ 7.7 (HKLM-x32\…\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.7.102 - Skype Technologies S.A.)

swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== Restore Points =========================

==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 08:25 - 2013-08-22 08:25 - 00000824 ____N C:\windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {032F2472-E1C3-4E04-84F9-59F247F70222} - System32\Tasks\DataMarker => c:\programdata\{239f5618-46ee-29c8-239f-f561846e5861}\8409408362856285087c.exe <==== ATTENTION

Task: {045F11C5-81CD-4107-9C0C-3BE94AA88216} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-07-07] (Adobe Systems Incorporated)

Task: {07F8D2BC-E040-472B-80B1-285310E231EA} - System32\Tasks\RockRecord => c:\programdata\{4034670d-c0c6-7aff-4034-4670dc0c9c37}\101169424667237921c.exe <==== ATTENTION

Task: {2CFB8B32-B699-45A9-88FF-901C66E41E7B} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-07-01] (Microsoft Corporation)

Task: {42316044-FB33-4CE2-9DA2-C1F2C3C76F64} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office 15\root\Office15\msoia.exe [2015-05-12] (Microsoft Corporation)

Task: {44914D73-09E1-4275-86A9-1DF944FC9DA1} - System32\Tasks\DailyDrive => c:\programdata\{2d75dfbd-332c-54ca-2d75-5dfbd3327ef4}\210629742019572405c.exe <==== ATTENTION

Task: {77522BF3-9629-418F-BFDD-A30CC382AE63} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-06-15] (Adobe Systems Incorporated)

Task: {7EA82EA5-A77A-4A3C-BA6F-CC8AEF60599C} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office 15\root\Office15\msoia.exe [2015-05-12] (Microsoft Corporation)

Task: {7F0152C2-D3A1-495D-87C4-DD365ED84BE7} - System32\Tasks\BakerBunny => c:\programdata\{0c5c1f7c-0f6c-e6d3-0c5c-c1f7c0f67df0}\7295035863475703378c.exe <==== ATTENTION

Task: {7F628604-6706-4490-AAAE-9A320C9DA4DE} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\windows\system32\MRT.exe [2015-07-03] (Microsoft Corporation)

Task: {9E1215D4-DC9A-4DA6-9ACF-E11CBDD7A1DB} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-07-29] (Google Inc.)

Task: {A3913D3C-AA40-4BDA-BC54-19C73F20A724} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-07-01] (Microsoft Corporation)

Task: {B7F501F9-A742-4519-ABED-310FFB4209F5} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)

Task: {BB188FB9-BAFC-4C97-82FE-96AD2C63BFF8} - System32\Tasks\JewelJazz => c:\programdata\{ffb77555-4323-e47c-ffb7-77555432d555}\156187394529644956c.exe <==== ATTENTION

Task: {BD714EBE-BD98-48E8-BCFB-061F76E6D8C3} - System32\Tasks\Bidaily Synchronize Task[3c32] => c:\programdata\{ff12eaee-c25f-c780-ff12-2eaeec25abbb}\hqghumeaylnlf.exe <==== ATTENTION

Task: {EEB477CF-31BE-4C9A-B0C9-660045C6B535} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-07-29] (Google Inc.)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\windows\Tasks\BakerBunny.job => c:\programdata\{0c5c1f7c-0f6c-e6d3-0c5c-c1f7c0f67df0}\7295035863475703378c.exe <==== ATTENTION

Task: C:\windows\Tasks\Bidaily Synchronize Task[3c32].job => c:\programdata\{ff12eaee-c25f-c780-ff12-2eaeec25abbb}\hqghumeaylnlf.exe <==== ATTENTION

Task: C:\windows\Tasks\DailyDrive.job => c:\programdata\{2d75dfbd-332c-54ca-2d75-5dfbd3327ef4}\210629742019572405c.exe <==== ATTENTION

Task: C:\windows\Tasks\DataMarker.job => c:\programdata\{239f5618-46ee-29c8-239f-f561846e5861}\8409408362856285087c.exe <==== ATTENTION

Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\windows\Tasks\JewelJazz.job => c:\programdata\{ffb77555-4323-e47c-ffb7-77555432d555}\156187394529644956c.exe <==== ATTENTION

Task: C:\windows\Tasks\RockRecord.job => c:\programdata\{4034670d-c0c6-7aff-4034-4670dc0c9c37}\101169424667237921c.exe <==== ATTENTION

==================== Loaded Modules (Whitelisted) ==============

2015-01-20 23:35 - 2015-01-20 23:35 - 00085832 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll

2015-05-15 16:26 - 2015-05-15 16:26 - 01346344 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll

2014-08-31 18:37 - 2014-05-20 09:19 - 00105640 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll

2015-02-24 20:46 - 2015-01-27 10:29 - 08898720 _____ () C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\1033\GrooveIntlResource.dll

2015-05-15 16:27 - 2015-05-15 16:27 - 01044776 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll

2014-07-07 19:21 - 2014-07-07 19:21 - 00410744 _____ () C:\windows\SYSTEM32\TrueColor5.2\LcProxy2.ax

2014-07-07 19:21 - 2014-07-07 19:21 - 00749168 _____ () C:\windows\SYSTEM32\TrueColor5.2\CAL2.dll

2014-07-07 19:21 - 2014-07-07 19:21 - 00336496 _____ () C:\windows\SYSTEM32\TrueColor5.2\LcMft.dll

2015-02-24 20:46 - 2015-01-27 09:13 - 08898720 _____ () C:\Program Files\Microsoft Office 15\root\Office15\1033\GrooveIntlResource.dll

2015-07-07 16:07 - 2015-07-06 22:49 - 01281864 _____ () C:\Program Files (x86)\Google\Chrome\Application\43.0.2357.132\libglesv2.dll

2015-07-07 16:07 - 2015-07-06 22:49 - 00080712 _____ () C:\Program Files (x86)\Google\Chrome\Application\43.0.2357.132\libegl.dll

2015-07-15 11:50 - 2015-07-13 10:14 - 16307888 _____ () C:\Users\kitana\AppData\Local\Google\Chrome\User Data\PepperFlash\18.0.0.209\pepflashplayer.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

AlternateDataStreams: C:\Users\kitana\OneDrive:ms-properties

==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)

==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-1837632124-2214114528-1467929312-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\kitana\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper

DNS Servers: [removed] - [removed]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)

Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-1837632124-2214114528-1467929312-1001\…\StartupApproved\StartupFolder: => "Send to OneNote.lnk"

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139

FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppextcomobj.exe

FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppextcomobj.exe

FirewallRules: [{FFEA8AB1-E271-492A-A73B-88B1817D1A1C}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\outlook.exe

FirewallRules: [{4FC589AA-B6F2-44CE-BD62-5ED90E3173A5}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\Lync.exe

FirewallRules: [{E5088BAD-B133-41CC-A2E3-AC1FBAC616A0}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\UcMapi.exe

FirewallRules: [{AA3D8B8B-95F2-4EC5-BD46-8550616143A1}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe

FirewallRules: [{CCF7FC1D-C897-4478-B64A-50BC33896352}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe

FirewallRules: [{A2863B21-5AB1-4D61-B7E8-084158E45FF7}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe

FirewallRules: [{4D043799-9760-414F-815A-206428388C23}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe

FirewallRules: [{F62F6C4D-E4A9-4E76-BC28-8BFD89B47EC7}] => (Allow) C:\Program Files (x86)\DVDVideoSoft\Free Torrent Download\FreeTorrentDownload.exe

FirewallRules: [{2F71E1BE-39CC-4A13-AB15-C3B8621F0F0F}] => (Allow) C:\Program Files (x86)\DVDVideoSoft\Free Torrent Download\FreeTorrentDownload.exe

FirewallRules: [{38400F82-F945-4137-972B-B9084B6857A8}] => (Allow) C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe

FirewallRules: [{4126EB8B-406B-4324-9C10-B87BE211EF83}] => (Allow) C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe

FirewallRules: [{5BE3F334-6A5E-4F64-BAA6-9390A6EB368F}] => (Allow) C:\Program Files (x86)\EpsonNet\EpsonNet Setup\tool10\ENEasyApp.exe

FirewallRules: [{AF55FF8B-63E8-470B-83C0-915AB58AFF1E}] => (Allow) C:\Program Files (x86)\EpsonNet\EpsonNet Setup\tool10\ENEasyApp.exe

FirewallRules: [TCP Query User{E0755F7C-A33D-4B3A-887D-E4E7E7D3D568}C:\program files (x86)\epson software\event manager\eeventmanager.exe] => (Block) C:\program files (x86)\epson software\event manager\eeventmanager.exe

FirewallRules: [UDP Query User{9FC58650-4A1E-479E-BDC7-9496888DC909}C:\program files (x86)\epson software\event manager\eeventmanager.exe] => (Block) C:\program files (x86)\epson software\event manager\eeventmanager.exe

FirewallRules: [{E39FDC09-1DD6-41FF-8465-303E9FC9066D}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\Lync.exe

FirewallRules: [{88AA7539-30F2-4FFF-987B-BC90248E7110}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\UcMapi.exe

FirewallRules: [{9B40BA53-74CA-4EC6-967C-C5744403C307}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

FirewallRules: [{7D0F9DA7-6597-4F77-AA97-90FC64F3DA90}] => (Allow) C:\Program Files\iTunes\iTunes.exe

FirewallRules: [TCP Query User{B6DE9F2A-F503-4284-B6D0-FF2FCA2B8037}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe

FirewallRules: [UDP Query User{6F071570-400F-426B-8F5D-780CE552742E}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe

FirewallRules: [TCP Query User{92034BBC-5EFB-46DF-A21A-AB84FEAFF563}C:\program files (x86)\skype\phone\skype.exe] => (Block) C:\program files (x86)\skype\phone\skype.exe

FirewallRules: [UDP Query User{727E2593-0FBC-4BC1-9319-C8AB09A3EBF7}C:\program files (x86)\skype\phone\skype.exe] => (Block) C:\program files (x86)\skype\phone\skype.exe

==================== Faulty Device Manager Devices =============

==================== Event log errors: =========================

Application errors:

==================

Error: (07/29/2015 12:12:16 AM) (Source: SideBySide) (EventID: 33) (User: )

Description: Activation context generation failed for "45.0.2422.0,language="*",type="win32",version="45.0.2422.0"1".

Dependent Assembly 45.0.2422.0,language="*",type="win32",version="45.0.2422.0" could not be found.

Please use sxstrace.exe for detailed diagnosis.

Error: (07/28/2015 10:32:01 PM) (Source: MsiInstaller) (EventID: 1024) (User: ALOHILANI)

Description: Product: Adobe Reader XI (11.0.12) - Update 'Adobe Reader XI (11.0.12)' could not be installed. Error code 1603. Windows Installer can create logs to help troubleshoot issues with installing software packages. Use the following link for instructions on turning on logging support: http://go.microsoft.com/fwlink/?LinkId=23127

Error: (07/28/2015 10:31:55 PM) (Source: MsiInstaller) (EventID: 11402) (User: ALOHILANI)

Description: Product: Adobe Reader XI (11.0.12) – Error 1402.Could not open key: HKEY_LOCAL_MACHINE32\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroExt.exe. System error 5. Verify that you have sufficient access to that key, or contact your support personnel.

Error: (07/28/2015 10:31:24 PM) (Source: MsiInstaller) (EventID: 1024) (User: ALOHILANI)

Description: Product: Adobe Reader XI (11.0.11) - Update '{AC76BA86-7AD7-0000-2550-7A8C40011012}' could not be installed. Error code 1625. Windows Installer can create logs to help troubleshoot issues with installing software packages. Use the following link for instructions on turning on logging support: http://go.microsoft.com/fwlink/?LinkId=23127

Error: (07/28/2015 11:43:05 AM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )

Description: 80070005

Error: (07/28/2015 02:04:30 AM) (Source: Microsoft-Windows-Defrag) (EventID: 257) (User: )

Description: The volume Windows RE tools was not optimized because an error was encountered: The parameter is incorrect. (0x80070057)

Error: (07/28/2015 12:22:53 AM) (Source: SideBySide) (EventID: 33) (User: )

Description: Activation context generation failed for "45.0.2422.0,language="*",type="win32",version="45.0.2422.0"1".

Dependent Assembly 45.0.2422.0,language="*",type="win32",version="45.0.2422.0" could not be found.

Please use sxstrace.exe for detailed diagnosis.

Error: (07/28/2015 12:17:07 AM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application name: iiwjljrnpc64.exe, version: 0.0.0.0, time stamp: 0x551bf9ee

Faulting module name: ntdll.dll, version: 6.3.9600.17736, time stamp: 0x550f4336

Exception code: 0xc0000374

Fault offset: 0x00000000000f0f20

Faulting process id: 0x68c

Faulting application start time: 0xiiwjljrnpc64.exe0

Faulting application path: iiwjljrnpc64.exe1

Faulting module path: iiwjljrnpc64.exe2

Report Id: iiwjljrnpc64.exe3

Faulting package full name: iiwjljrnpc64.exe4

Faulting package-relative application ID: iiwjljrnpc64.exe5

Error: (07/27/2015 11:38:07 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application name: iiwjljrnpc64.exe, version: 0.0.0.0, time stamp: 0x551bf9ee

Faulting module name: ntdll.dll, version: 6.3.9600.17736, time stamp: 0x550f4336

Exception code: 0xc0000374

Fault offset: 0x00000000000f0f20

Faulting process id: 0x6b4

Faulting application start time: 0xiiwjljrnpc64.exe0

Faulting application path: iiwjljrnpc64.exe1

Faulting module path: iiwjljrnpc64.exe2

Report Id: iiwjljrnpc64.exe3

Faulting package full name: iiwjljrnpc64.exe4

Faulting package-relative application ID: iiwjljrnpc64.exe5

Error: (07/27/2015 11:27:21 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application name: iiwjljrnpc64.exe, version: 0.0.0.0, time stamp: 0x551bf9ee

Faulting module name: ntdll.dll, version: 6.3.9600.17736, time stamp: 0x550f4336

Exception code: 0xc0000374

Fault offset: 0x00000000000f0f20

Faulting process id: 0x6ac

Faulting application start time: 0xiiwjljrnpc64.exe0

Faulting application path: iiwjljrnpc64.exe1

Faulting module path: iiwjljrnpc64.exe2

Report Id: iiwjljrnpc64.exe3

Faulting package full name: iiwjljrnpc64.exe4

Faulting package-relative application ID: iiwjljrnpc64.exe5

System errors:

=============

Error: (07/29/2015 12:27:02 AM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: The Util eye perform service failed to start due to the following error:

%%2

Error: (07/29/2015 12:27:02 AM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: The Update eye perform service failed to start due to the following error:

%%2

Error: (07/29/2015 12:27:00 AM) (Source: EventLog) (EventID: 6008) (User: )

Description: The previous system shutdown at 6:48:50 PM on ‎7/‎28/‎2015 was unexpected.

Error: (07/29/2015 12:11:49 AM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: The Google Update Service (gupdate) service failed to start due to the following error:

%%2

Error: (07/28/2015 06:48:51 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: The Util eye perform service failed to start due to the following error:

%%2

Error: (07/28/2015 06:48:51 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: The Update eye perform service failed to start due to the following error:

%%2

Error: (07/28/2015 06:48:50 PM) (Source: EventLog) (EventID: 6008) (User: )

Description: The previous system shutdown at 6:48:44 PM on ‎7/‎28/‎2015 was unexpected.

Error: (07/28/2015 06:50:42 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: The Google Update Service (gupdate) service failed to start due to the following error:

%%2

Error: (07/28/2015 06:48:42 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: The Util eye perform service failed to start due to the following error:

%%2

Error: (07/28/2015 06:48:42 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: The Update eye perform service failed to start due to the following error:

%%2

Microsoft Office:

=========================

Error: (07/29/2015 12:12:16 AM) (Source: SideBySide) (EventID: 33) (User: )

Description: 45.0.2422.0,language="*",type="win32",version="45.0.2422.0"c:\users\kitana\appdata\local\chromium\application\chrome.exe

Error: (07/28/2015 10:32:01 PM) (Source: MsiInstaller) (EventID: 1024) (User: ALOHILANI)

Description: Adobe Reader XI (11.0.12)Adobe Reader XI (11.0.12)1603(NULL)(NULL)(NULL)

Error: (07/28/2015 10:31:55 PM) (Source: MsiInstaller) (EventID: 11402) (User: ALOHILANI)

Error: (07/28/2015 10:31:24 PM) (Source: MsiInstaller) (EventID: 1024) (User: ALOHILANI)

Description: Adobe Reader XI (11.0.11){AC76BA86-7AD7-0000-2550-7A8C40011012}1625(NULL)(NULL)(NULL)

Error: (07/28/2015 11:43:05 AM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )

Description: 80070005

Error: (07/28/2015 02:04:30 AM) (Source: Microsoft-Windows-Defrag) (EventID: 257) (User: )

Description: Windows RE toolsThe parameter is incorrect. (0x80070057)

Error: (07/28/2015 12:22:53 AM) (Source: SideBySide) (EventID: 33) (User: )

Description: 45.0.2422.0,language="*",type="win32",version="45.0.2422.0"c:\users\kitana\appdata\local\chromium\application\chrome.exe

Error: (07/28/2015 12:17:07 AM) (Source: Application Error) (EventID: 1000) (User: )

Description: iiwjljrnpc64.exe0.0.0.0551bf9eentdll.dll6.3.9600.17736550f4336c000037400000000000f0f2068c01d0c8f458bbce61C:\Program Files (x86)\coupoon\iiwjljrnpc64.exeC:\windows\SYSTEM32\ntdll.dlle3c2c4bb-34e7-11e5-82d4-600292518980

Error: (07/27/2015 11:38:07 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: iiwjljrnpc64.exe0.0.0.0551bf9eentdll.dll6.3.9600.17736550f4336c000037400000000000f0f206b401d0c8ef2c985513C:\Program Files (x86)\coupoon\iiwjljrnpc64.exeC:\windows\SYSTEM32\ntdll.dll70a52c74-34e2-11e5-82d3-600292518980

Error: (07/27/2015 11:27:21 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: iiwjljrnpc64.exe0.0.0.0551bf9eentdll.dll6.3.9600.17736550f4336c000037400000000000f0f206ac01d0c8ed6e9f81beC:\Program Files (x86)\coupoon\iiwjljrnpc64.exeC:\windows\SYSTEM32\ntdll.dllefccdb9c-34e0-11e5-82d1-600292518980

CodeIntegrity Error:

===================================

Date: 2015-07-29 00:20:06.354

Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements.

Date: 2015-07-29 00:20:06.117

Date: 2015-07-29 00:19:00.693

Date: 2015-07-29 00:19:00.204

Date: 2015-06-18 11:35:01.082

Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Program Files\BubbleSound\BubbleSound.dll because the set of per-page image hashes could not be found on the system.

Date: 2015-06-18 11:35:00.906

==================== Memory info ===========================

Processor: Intel(R) Core(TM) i3-4020Y CPU @ 1.50GHz

Percentage of memory in use: 60%

Total physical RAM: 4001.07 MB

Available physical RAM: 1580.97 MB

Total Virtual: 4998.48 MB

Available Virtual: 2347.55 MB

==================== Drives ================================

Drive c: (Windows) (Fixed) (Total:53.88 GB) (Free:0.68 GB) NTFS

==================== MBR & Partition Table ==================

========================================================

Disk: 0 (Size: 59.6 GB) (Disk ID: EE68D539)

Partition: GPT Partition Type.

==================== End of log ============================

Attachments:

ken545

Post #2July 29, 2015, 11:25 AM UTC

You do have a bit going one, lets do this

-AdwCleaner-by Xplode

Click on this link to download : ADWCleaner TO YOUR DESKTOP

Click on ONE of the Two Blue Download Now buttons That have a blue arrow beside them and save it to your desktop.

Use my link only, do not do a search for AdwCleaner as there is a bogus copy going around by scammers

Do not click on any links in the top Advertisment.

[external image: AdwCleaner4.201_zpsxrbk2llq.jpg]

Close all open programs and internet browsers.

Double click on AdwCleaner.exe to run the tool.

Click on Scan.

After the scan is complete click on "Clean"

Confirm each time with Ok.

Your computer will be rebooted automatically. A text file will open after the restart.

Please post the content of that logfile with your next reply.

You can find the logfile at C:\AdwCleaner[S1].txt as well.

===============================================================================

[external image: thisisujrt.gif] Please download Junkware Removal Tool TO YOUR DESKTOP

Shut down your protection software now to avoid potential conflicts.

Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".

The tool will open and start scanning your system.

Please be patient as this can take a while to complete depending on your system's specifications.

On completion, a log (JRT.txt) is saved to your desktop and will automatically open.

Post the contents of JRT.txt into your next message.

===============================================================================

Download Malwarebytes' Anti-Malware TO YOUR DESKTOP

Windows XP : Double click on the icon to run it.

Windows Vista, Windows 7 & 8 : Right click and select "Run as Administrator"

[external image: MBAM_zpsr1ew7hep.png]

On the Dashboard click on Update Now

Go to the Setting Tab

Under Setting go to Detection and Protection

Under PUP and PUM make sure both are set to show Treat Detections as Malware

Go to Advanced setting and make sure Automatically Quarantine Detected Items is checked

Then on the Dashboard click on Scan

Make sure to select THREAT SCAN

Then click on Scan

When the scan is finished and the log pops up…select Copy to Clipboard

Please paste the log back into this thread for review

Exit Malwarebytes

Kitgee123

Post #3July 30, 2015, 12:55 AM UTC

[attachment removed]

Attachments:

📎AdwCleanerS1.txt

Kitgee123

Post #4July 30, 2015, 1:02 AM UTC

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Malwarebytes

Version: 7.5.4 (07.27.2015:1)

OS: Windows 8.1 Pro x64

Ran by [removed] on Wed 07/29/2015 at 19:56:33.46

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

Successfully deleted: [Service] Update eye perform [Reboot required]

Successfully deleted: [Service] Util eye perform [Reboot required]

Successfully deleted: [Service] wsfd_vw_1_10_0_20 [Reboot required]

~~~ Tasks

Successfully deleted: [Task] C:\windows\system32\tasks\BakerBunny

Successfully deleted: [Task] C:\windows\system32\tasks\Bidaily Synchronize Task[3c32]

Successfully deleted: [Task] C:\windows\system32\tasks\DailyDrive

Successfully deleted: [Task] C:\windows\system32\tasks\DataMarker

Successfully deleted: [Task] C:\windows\system32\tasks\RockRecord

Successfully deleted: [Task] C:\windows\Tasks\BakerBunny.job

Successfully deleted: [Task] C:\windows\Tasks\Bidaily Synchronize Task[3c32].job

Successfully deleted: [Task] C:\windows\Tasks\DailyDrive.job

Successfully deleted: [Task] C:\windows\Tasks\DataMarker.job

Successfully deleted: [Task] C:\windows\Tasks\RockRecord.job

~~~ Registry Values

Successfully deleted: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ospd_us_001010003

~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Eventlog\Application\Update eye perform

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Eventlog\Application\Util eye perform

~~~ Files

Successfully deleted: [File] C:\Users\kitana\AppData\Roaming\appdataFr25.bin

Successfully deleted: [File] C:\Users\kitana\Appdata\Local\aca72bb0cc4a016bcb24550c0881c267

Successfully deleted: [File] C:\Users\kitana\Appdata\Local\google\chrome\user data\default\local storage\chrome-extension_ogminpmldncgcmokldnmmapddoccmhfl_0.localstorage

Successfully deleted: [File] C:\Users\kitana\Appdata\Local\google\chrome\user data\default\local storage\hxxp_www.azlyrics.com_0.localstorage

Successfully deleted: [File] C:\Users\kitana\Appdata\Local\google\chrome\user data\default\local storage\hxxp_www.azlyrics.com_0.localstorage-journal

~~~ Folders

Successfully deleted: [Folder] C:\Program Files (x86)\looksafe utility

Successfully deleted: [Folder] C:\ProgramData\abc

~~~ Chrome

[C:\Users\kitana\Appdata\Local\Google\Chrome\User Data\Default\Preferences] - default search provider reset

[C:\Users\kitana\Appdata\Local\Google\Chrome\User Data\Default\Preferences] - Extensions Deleted:

[C:\Users\kitana\Appdata\Local\Google\Chrome\User Data\Default\Secure Preferences] - default search provider reset

[C:\Users\kitana\Appdata\Local\Google\Chrome\User Data\Default\Secure Preferences] - Extensions Deleted:

[]

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on Wed 07/29/2015 at 20:00:34.96

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

was not letting me upload this as an attachment

ken545

Post #5July 30, 2015, 1:18 AM UTC

Thats fine, I prefer that the logs be copied and pasted into the thread anyway,

Lets see what Malwarebytes finds

Kitgee123

Post #6July 30, 2015, 1:20 AM UTC

Malwarebytes[external image: arrow-10x10.png]Anti-Malware

www.malwarebytes.org

Scan Date: 7/29/2015

Scan Time: 8:06 PM

Logfile:

Administrator: Yes

Version: 2.1.8.1057

Malware Database: v2015.07.29.07

Rootkit Database: v2015.07.29.02

License: Trial

Malware Protection[external image: arrow-10x10.png] Enabled

Malicious Website Protection: Enabled

Self-protection: Disabled[external image: arrow-10x10.png]

OS: Windows 8[external image: arrow-10x10.png].1

CPU: x64

File System: NTFS

User: kitana

Scan Type: Threat Scan

Result: Completed

Objects Scanned: 350732

Time Elapsed: 12 min, 14 sec

Memory: Enabled

Startup: Enabled

Filesystem: Enabled

Archives: Enabled

Rootkits: Disabled[external image: arrow-10x10.png]

Heuristics: Enabled

PUP: Enabled

PUM: Enabled

Processes: 0

(No malicious items detected)

Modules: 0

(No malicious items detected)

Registry Keys: 7

PUP.Optional.ConsumerInput.A, HKU\S-1-5-18\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{B49699FC-1665-4414-A1CB-C4A2A4A13EEC}, , [5c2f1fc8a3e78fa7b448325f5ba7fd03],

PUM.Security.Hijack.DisableChromeUpdates, HKLM\SOFTWARE\POLICIES\GOOGLE\UPDATE, , [e0ab42a51e6ca4924dacdfbca36159a7],

PUP.Optional.WordShark.A, HKLM\SOFTWARE\WOW6432NODE\WordShark_1.10.0.20, , [0c7fc1263951a39382dca3fb8480ee12],

PUP.Optional.MultiPlug.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{1146AC44-2F03-4431-B4FD-889BC837521F}{53a1c4d9}, , [018a6e795f2bd6602728acee867ea35d],

PUM.Security.Hijack.DisableChromeUpdates, HKLM\SOFTWARE\WOW6432NODE\POLICIES\GOOGLE\UPDATE, , [b6d5d01735551d19bb3e0f8c0ef65da3],

PUP.Optional.SuperOptimizer.C, HKU\S-1-5-18\SOFTWARE\APPDATALOW\{1146AC44-2F03-4431-B4FD-889BC837521F}, , [4f3ccf181377d561feeec3dac73ddb25],

PUP.Optional.Coupoon.A, HKU\S-1-5-18\SOFTWARE\APPDATALOW\SOFTWARE\coupoon, , [6328d215098189ad9bb8593a1de732ce],

Registry Values[external image: arrow-10x10.png] 4

PUP.Optional.3DBubbleSound.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|3D BubbleSound, "C:\Program Files\BubbleSound\3D BubbleSound.exe", , [4f3c21c6c8c2f145879b4bc4d62d47b9]

PUM Security[external image: arrow-10x10.png].Hijack.DisableChromeUpdates, HKLM\SOFTWARE\POLICIES\GOOGLE\UPDATE|DisableAutoUpdateChecksCheckboxValue, 1, , [e0ab42a51e6ca4924dacdfbca36159a7]

PUP.Optional.Cassiopesa.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT INTERNET EXPLORER[external image: arrow-10x10.png]\LOW RIGHTS\ELEVATIONPOLICY|AppPath, C:\Program Files (x86)\Tny_Cassiopesa\\, , [c8c3bc2b2466a29482152b7146be60a0]

PUM.Security.Hijack.DisableChromeUpdates, HKLM\SOFTWARE\WOW6432NODE\POLICIES\GOOGLE\UPDATE|DisableAutoUpdateChecksCheckboxValue, 1, , [b6d5d01735551d19bb3e0f8c0ef65da3]

Registry Data: 2

Trojan.DNSChanger, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\TCPIP\PARAMETERS\Interfaces\{63DCB409-4129-49E7-8CE8-66B6A04659D9}|NameServer, 208.69.150.252,208.69.150.250, Good: (), Bad: (208.69.150.252,208.69.150.250),,[305be403eb9f2f07d9643b07010455ab]

Trojan.DNSChanger, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\TCPIP\PARAMETERS\Interfaces\{8718928D-CBEB-45EA-A621-800A9249001D}|NameServer, 208.69.150.252,208.69.150.250, Good: (), Bad: (208.69.150.252,208.69.150.250),,[0982c2256d1dff375de01f23ac59ab55]

Folders: 0

(No malicious items detected)

Files: 36

PUP.Optional.Multiplug.A, C:\Program Files (x86)\Streak for Gmail\Streak for Gmail.exe, , [e2a9c5224347c17568b53e3e9a6715eb],

Trojan.Downloader, C:\Users\kitana\AppData\Local\Temp\101169424667237921c.exe, , [c7c49651880271c5bcccc8fc956c8d73],

PUP.Optional.Multiplug, C:\Users\kitana\AppData\Local\Temp\210629742019572405c.exe, , [90fb2dba0a8037ff68b378494db4b64a],

PUP.Optional.MultiPlug, C:\Users\kitana\AppData\Local\Temp\7295035863475703378c.exe, , [c3c8f7f01f6bf5412a5913ae9b66e41c],

Trojan.Downloader, C:\Users\kitana\AppData\Local\Temp\8409408362856285087c.exe, , [96f50bdc8bff0036ea9eecd81ce526da],

PUP.Optional.Compete, C:\Users\kitana\AppData\Local\Temp\consumerinput_c54.exe, , [0388b4333258d363baf0ea897e878b75],

PUP.Optional.Bundle, C:\Users\kitana\AppData\Local\Temp\Coupoon72.exe, , [18735295b5d582b42f5b3a1acc347d83],

PUP.Optional.PCOptimizerPro, C:\Users\kitana\AppData\Local\Temp\OptimizerPro41.exe, , [addeb92ed7b32214bde2990a6f9252ae],

PUP.optional.OptimizerPro.A, C:\Users\kitana\AppData\Local\Temp\optprosetup.exe, , [9deed61102889d99906f05b9c33e29d7],

PUP.Optional.SearchProtect.A, C:\Users\kitana\AppData\Local\Temp\SearchProtect34.exe, , [a4e733b4e5a5f244cc4fa783d22f946c],

PUP.Optional.Nosibay.A, C:\Users\kitana\AppData\Local\Temp\117201552558\Bubble Dock Uninstall.exe, , [7d0ed7103e4cd26479befa79b2537090],

PUP.Optional.Nosibay.A, C:\Users\kitana\AppData\Local\Temp\117201555624\WindApp Uninstall.exe, , [c5c692559af0310551e6f87b13f2c63a],

PUP.Optional.Nosibay.A, C:\Users\kitana\AppData\Local\Temp\117201555733\Selection Tools Uninstall.exe, , [286345a2b4d68ea8ee497003877e7789],

Trojan.Downloader, C:\Users\kitana\AppData\Local\Temp\41A0\temp\8409408362856285087c.exe, , [9cef30b78505c670e99f18ac629f44bc],

Trojan.Downloader, C:\Users\kitana\AppData\Local\Temp\5370\temp\101169424667237921c.exe, , [a6e5cd1a890102349bed08bc26db18e8],

PUP.Optional.MultiPlug, C:\Users\kitana\AppData\Local\Temp\5B88\temp\7295035863475703378c.exe, , [c1cae50271193204e79cb809e61b5ea2],

PUP.Optional.Multiplug, C:\Users\kitana\AppData\Local\Temp\7CE0\temp\210629742019572405c.exe, , [a1ea0dda701a82b4b269cbf6689936ca],

Trojan.Downloader, C:\Users\kitana\AppData\Local\Temp\ECA0\temp\2237843004083219229c.exe, , [2764c126167462d4c7c15e66df2245bb],

Adware.EoRezo, C:\Users\kitana\AppData\Local\Temp\is-8MU7P.tmp\393.exe, , [45467f681f6b58de596e6a4ab05113ed],

Adware.EoRezo, C:\Users\kitana\AppData\Local\Temp\is-8MU7P.tmp\package_AnySend_installer_multilang.exe, , [8efd6483107ae3539b2c684cab56af51],

Adware.EoRezo, C:\Users\kitana\AppData\Local\Temp\is-8MU7P.tmp\package_bubbledock_installer_multilang.exe, , [8cff66811377fa3c7b4cab09679a8977],

Adware.EoRezo, C:\Users\kitana\AppData\Local\Temp\is-8MU7P.tmp\package_ceppink_installer_multilang.exe, , [26658760a7e3f244ab1cded64ab7c53b],

Adware.EoRezo, C:\Users\kitana\AppData\Local\Temp\is-8MU7P.tmp\package_SByoutube_installer_multilang.exe, , [f695d215f19996a08047447005fc8c74],

Adware.EoRezo, C:\Users\kitana\AppData\Local\Temp\is-8MU7P.tmp\package_vuupc_installer_multilang.exe, , [6a21dc0b4c3e87af3b8c783c768b1fe1],

PUP.Optional.Vitruvian.A, C:\Users\kitana\AppData\Local\Temp\vitruvian-installer-hardwareprofile-v0001, , [bfcc83647515c17554644745db29966a],

PUP.Optional.Vitruvian.A, C:\Users\kitana\AppData\Local\Temp\vitruvian-installer-install-v0003, , [f299bc2b3b4f71c513a53458ac5829d7],

PUP.Optional.Vitruvian.A, C:\Users\kitana\AppData\Local\Temp\vitruvian-installer-processes-v0002, , [6a218562e5a563d33a7ed9b333d1738d],

PUP.Optional.Vitruvian.A, C:\Users\kitana\AppData\Local\Temp\vitruvian-installer-scheduledtasks-v0001, , [107b25c2bfcb3cfaa1175d2f25df6f91],

PUP.Optional.Vitruvian.A, C:\Users\kitana\AppData\Local\Temp\vitruvian-installer-softwareregkeys-v0002, , [4b4020c713777eb801b790fc34d0bf41],

PUP.Optional.Vitruvian.A, C:\Users\kitana\AppData\Local\Temp\vitruvian-installer-uninstall-v0002, , [0a81d90e8a0058de63559defed17728e],

PUP.Optional.Cassiopesa.A, C:\Users\kitana\AppData\Local Chromium[external image: arrow-10x10.png]\Application\Cassiopesa.ico, , [0289eff8b6d4d660d2ac3a6092724ab6],

PUP.Optional.BubbleDock.A, C:\Users\kitana\AppData\Local\Temp\LBubble Dock.txt, , [711a06e1781244f2fc1a930cb252e917],

PUP.Optional.BestPriceNinja.A, C:\Users\kitana\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_pstatic.bestpriceninja.com_0.localstorage, , [8605cf18701a3402c3ae970cec18df21],

PUP.Optional.BestPriceNinja.A, C:\Users\kitana\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_pstatic.bestpriceninja.com_0.localstorage-journal, , [8a01c4238dfd9f976110a102b74deb15],

PUP.Optional.BestPriceNinja.A, C:\Users\kitana\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_pstatic.bestpriceninja.com_0.localstorage, , [1378df081971f83e3a37a4ffbf45ec14],

PUP.Optional.BestPriceNinja.A, C:\Users\kitana\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_pstatic.bestpriceninja.com_0.localstorage-journal, , [7c0f8d5a6426fb3bf0810c97b4503ec2],

Physical Sectors: 0

(No malicious items detected)

(end)

ken545

Post #7July 30, 2015, 1:33 AM UTC

When you ran Malwarebytes, did you set it like I posted because all those entries that it found should be in Quarantine and its not showing that,

On the Dashboard click on Update Now

Go to the Setting Tab

Under Setting go to Detection and Protection

Under PUP and PUM make sure both are set to show Treat Detections as Malware

Go to Advanced setting and make sure Automatically Quarantine Detected Items is checked <<<<<<————–Make sure this is done

Then on the Dashboard click on Scan

Make sure to select THREAT SCAN

Then click on Scan

When the scan is finished and the log pops up…select Copy to Clipboard

Please paste the log back into this thread for review

Exit Malwarebytes

Run Malwarebytes again per my above instructions , run it until it comes back clean

After it comes back clean, open FRST, checkmark Additions, run a new scan and post both new logs please. Take your time as its been a loooooong day, will be back in the am.

Kitgee123

Post #8July 30, 2015, 2:00 AM UTC

I followed it to the T, but here it is again hopefully I did it right.

Malwarebytes Anti-Malware

www.malwarebytes.org

Scan Date: 7/29/2015

Scan Time: 8:42 PM

Logfile:

Administrator: Yes

Version: 2.1.8.1057

Malware Database: v2015.07.29.07

Rootkit Database: v2015.07.29.02

License: Trial

Malware Protection: Enabled

Malicious Website Protection: Enabled

Self-protection: Disabled

OS: Windows 8.1

CPU: x64

File System: NTFS

User: kitana

Scan Type: Threat Scan

Result: Completed

Objects Scanned: 351359

Time Elapsed: 12 min, 35 sec

Memory: Enabled

Startup: Enabled

Filesystem: Enabled

Archives: Enabled

Rootkits: Disabled

Heuristics: Enabled

PUP: Enabled

PUM: Enabled

Processes: 0

(No malicious items detected)

Modules: 0

(No malicious items detected)

Registry Keys: 7

PUP.Optional.ConsumerInput.A, HKU\S-1-5-18\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{B49699FC-1665-4414-A1CB-C4A2A4A13EEC}, , [612a22c5f3978babdc20bdd4da28b54b],

PUM.Security.Hijack.DisableChromeUpdates, HKLM\SOFTWARE\POLICIES\GOOGLE\UPDATE, , [2a61895e6e1cf93d7188d1cac242d030],

PUP.Optional.WordShark.A, HKLM\SOFTWARE\WOW6432NODE\WordShark_1.10.0.20, , [0388a740305aa78f80deb0ee0df7bc44],

PUP.Optional.MultiPlug.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{1146AC44-2F03-4431-B4FD-889BC837521F}{53a1c4d9}, , [f09bcb1ccac000363d123d5dde26bc44],

PUM.Security.Hijack.DisableChromeUpdates, HKLM\SOFTWARE\WOW6432NODE\POLICIES\GOOGLE\UPDATE, , [4d3e64837c0eee48b7429efd82827b85],

PUP.Optional.SuperOptimizer.C, HKU\S-1-5-18\SOFTWARE\APPDATALOW\{1146AC44-2F03-4431-B4FD-889BC837521F}, , [3c4f7374a3e7b97d8c606d305ea67987],

PUP.Optional.Coupoon.A, HKU\S-1-5-18\SOFTWARE\APPDATALOW\SOFTWARE\coupoon, , [9fecdb0cddad42f43320eba8d23225db],

Registry Values: 4

PUP.Optional.3DBubbleSound.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|3D BubbleSound, "C:\Program Files\BubbleSound\3D BubbleSound.exe", , [c2c95d8adfabea4cc75b0f002fd4946c]

PUM.Security.Hijack.DisableChromeUpdates, HKLM\SOFTWARE\POLICIES\GOOGLE\UPDATE|DisableAutoUpdateChecksCheckboxValue, 1, , [2a61895e6e1cf93d7188d1cac242d030]

PUP.Optional.Cassiopesa.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY|AppPath, C:\Program Files (x86)\Tny_Cassiopesa\\, , [d4b7bc2b8efc53e33f582b7118ecbb45]

PUM.Security.Hijack.DisableChromeUpdates, HKLM\SOFTWARE\WOW6432NODE\POLICIES\GOOGLE\UPDATE|DisableAutoUpdateChecksCheckboxValue, 1, , [4d3e64837c0eee48b7429efd82827b85]

Registry Data: 2

Folders: 0

(No malicious items detected)

Files: 36

PUP.Optional.Multiplug.A, C:\Program Files (x86)\Streak for Gmail\Streak for Gmail.exe, , [513aa5421773ea4c1805f785ea17ca36],

Trojan.Downloader, C:\Users\kitana\AppData\Local\Temp\101169424667237921c.exe, , [513ab5323357da5cb6d2af156f924ab6],

PUP.Optional.Multiplug, C:\Users\kitana\AppData\Local\Temp\210629742019572405c.exe, , [5c2f0ed98604cb6bf625af12e91824dc],

PUP.Optional.MultiPlug, C:\Users\kitana\AppData\Local\Temp\7295035863475703378c.exe, , [4249b532cfbbb1857211734eec154ab6],

Trojan.Downloader, C:\Users\kitana\AppData\Local\Temp\8409408362856285087c.exe, , [a6e57077a9e1f73fb5d3665e0af79f61],

PUP.Optional.Compete, C:\Users\kitana\AppData\Local\Temp\consumerinput_c54.exe, , [6526b136b3d7a1957d2dacc70005a35d],

PUP.Optional.Bundle, C:\Users\kitana\AppData\Local\Temp\Coupoon72.exe, , [c6c582658dfdc96de5a5ee6647b957a9],

PUP.Optional.PCOptimizerPro, C:\Users\kitana\AppData\Local\Temp\OptimizerPro41.exe, , [f79467801c6eca6ce2bdfba808f9d22e],

PUP.optional.OptimizerPro.A, C:\Users\kitana\AppData\Local\Temp\optprosetup.exe, , [593208df0e7c5ed89a653688907144bc],

PUP.Optional.SearchProtect.A, C:\Users\kitana\AppData\Local\Temp\SearchProtect34.exe, , [67245493ef9bd95d7e9dc36724dd3cc4],

PUP.Optional.Nosibay.A, C:\Users\kitana\AppData\Local\Temp\117201552558\Bubble Dock Uninstall.exe, , [53387077acded95d2d0a670c45c0847c],

PUP.Optional.Nosibay.A, C:\Users\kitana\AppData\Local\Temp\117201555624\WindApp Uninstall.exe, , [8704f7f0c8c2d66052e50271897cca36],

PUP.Optional.Nosibay.A, C:\Users\kitana\AppData\Local\Temp\117201555733\Selection Tools Uninstall.exe, , [dead6483206aa393f245581b35d0f709],

Trojan.Downloader, C:\Users\kitana\AppData\Local\Temp\41A0\temp\8409408362856285087c.exe, , [adde1ccbd7b3d95d6226259f48b98977],

Trojan.Downloader, C:\Users\kitana\AppData\Local\Temp\5370\temp\101169424667237921c.exe, , [d7b4e30413773ef83652e3e15ea3758b],

PUP.Optional.MultiPlug, C:\Users\kitana\AppData\Local\Temp\5B88\temp\7295035863475703378c.exe, , [f09b03e47218ea4c7c07dce523de38c8],

PUP.Optional.Multiplug, C:\Users\kitana\AppData\Local\Temp\7CE0\temp\210629742019572405c.exe, , [a0eb82650288ec4a65b631906b9636ca],

Trojan.Downloader, C:\Users\kitana\AppData\Local\Temp\ECA0\temp\2237843004083219229c.exe, , [3e4d37b0fa9084b23553418334cd29d7],

Adware.EoRezo, C:\Users\kitana\AppData\Local\Temp\is-8MU7P.tmp\393.exe, , [c3c8dc0b8ffb2c0aaa1ddcd87d842ad6],

Adware.EoRezo, C:\Users\kitana\AppData\Local\Temp\is-8MU7P.tmp\package_AnySend_installer_multilang.exe, , [fa91d611aae060d663645e56e81920e0],

Adware.EoRezo, C:\Users\kitana\AppData\Local\Temp\is-8MU7P.tmp\package_bubbledock_installer_multilang.exe, , [04870fd8642691a58344605491700bf5],

Adware.EoRezo, C:\Users\kitana\AppData\Local\Temp\is-8MU7P.tmp\package_ceppink_installer_multilang.exe, , [0388d01761292a0c04c35b597889a65a],

Adware.EoRezo, C:\Users\kitana\AppData\Local\Temp\is-8MU7P.tmp\package_SByoutube_installer_multilang.exe, , [bfcccc1b8dfde2549c2bdada956c44bc],

Adware.EoRezo, C:\Users\kitana\AppData\Local\Temp\is-8MU7P.tmp\package_vuupc_installer_multilang.exe, , [14773aad3c4e32040abd9123ff0236ca],

PUP.Optional.Vitruvian.A, C:\Users\kitana\AppData\Local\Temp\vitruvian-installer-hardwareprofile-v0001, , [87044c9b5a30b581a90f484430d4867a],

PUP.Optional.Vitruvian.A, C:\Users\kitana\AppData\Local\Temp\vitruvian-installer-install-v0003, , [e9a29e491d6d55e16355523aea1ade22],

PUP.Optional.Vitruvian.A, C:\Users\kitana\AppData\Local\Temp\vitruvian-installer-processes-v0002, , [4645d0177e0c45f1f4c4830938cc748c],

PUP.Optional.Vitruvian.A, C:\Users\kitana\AppData\Local\Temp\vitruvian-installer-scheduledtasks-v0001, , [2d5e04e37218e65093255636c04422de],

PUP.Optional.Vitruvian.A, C:\Users\kitana\AppData\Local\Temp\vitruvian-installer-softwareregkeys-v0002, , [b7d4ad3aacde1c1ac3f57517f0140000],

PUP.Optional.Vitruvian.A, C:\Users\kitana\AppData\Local\Temp\vitruvian-installer-uninstall-v0002, , [eba0f7f0d9b156e0b206b1dbcb398b75],

PUP.Optional.Cassiopesa.A, C:\Users\kitana\AppData\Local\Chromium\Application\Cassiopesa.ico, , [2962e205d6b480b6a9d5cbcf8d777b85],

PUP.Optional.BubbleDock.A, C:\Users\kitana\AppData\Local\Temp\LBubble Dock.txt, , [8efda83f51398fa79482c0df4db745bb],

PUP.Optional.BestPriceNinja.A, C:\Users\kitana\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_pstatic.bestpriceninja.com_0.localstorage, , [008be502a9e1e2544b266f3458ac26da],

PUP.Optional.BestPriceNinja.A, C:\Users\kitana\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_pstatic.bestpriceninja.com_0.localstorage, , [96f5b92e7515f04673fe4360739105fb],

Physical Sectors: 0

(No malicious items detected)

(end)

Kitgee123

Post #9July 30, 2015, 2:16 AM UTC

Its not coupongiant anymore, its ads by WorldWideWebCoupon.. I don't if that makes a difference and we'll need to start again?

ken545

Post #10July 30, 2015, 11:30 AM UTC last edited July 30, 2015, 11:30 AM UTC

Morning

You need to have Malwarebytes remove all those entries, we cant move forward until you do

This is from another users log, its not yours, just want to show you how it should look when entires are Quarantined and yours does not

PUP.Optional.Amonetize.A, HKLM\SOFTWARE\CLASSES\TYPELIB\{B0660298-91AA-421F-BF0D-BFF6BB8BF3AE}, Quarantined, [d8771a9c444610265bd9f3af73904ab6],
PUP.Optional.Amonetize.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{EAC7DE5C-9520-435D-91AA-4A02E4773CEA}, Quarantined, [d8771a9c444610265bd9f3af73904ab6],
PUP.Optional.Amonetize.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{EAC7DE5C-9520-435D-91AA-4A02E4773CEA}, Quarantined, [d8771a9c444610265bd9f3af73904ab6],

Those entries Malwarebytes is picking up are bad and need to go, run the program again , this time when it picks up all those entries, right click inside one of the boxes and CHECK ALL ITEMS and then REMOVE SELECTED

ken545

Post #11August 5, 2015, 12:44 PM UTC

Due to inactivity this topic will be closed.
If you need help please start a new thread.

New members follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.htmland start a new topic

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Ads by coupongiant [Closed]

✨ Ask AI

Ask AI