14 min read
I messed up and downloaded a file on my desktop (I'm on my laptop), realized the mistake, uninstalled 4 programs and am still infected. It shows up when I open firefox or chrome but not ms edge. It shows a screen that says "trusted…" something, so I know the computer is compromised. I won't start my desktop until I know what to do at this point.
Thanks in advance.
Lets run some scans and let me see the logs so I can try to determine whats going on
I tried sending the files earlier but it obviously didn't work. Here are the files:
aswMBR version 1.0.1.2252 Copyright© 2014 AVAST Software
Run date: 2016-04-10 00:52:38
—————————–
00:52:38.446 OS Version: Windows 6.2.9200
00:52:38.446 Number of processors: 2 586 0x170A
00:52:38.448 ComputerName: SPRINGFOURTEEN UserName: saturn89
00:52:59.718 Initialize success
00:52:59.756 VM: initialized successfully
00:52:59.758 VM: Intel CPU supported
00:57:52.080 VM: disk I/O atapi.sys
00:57:54.226 AVAST engine defs: 16040901
00:57:58.818 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-3
00:57:58.822 Disk 0 Vendor: ST3250318AS CC38 Size: 238475MB BusType: 3
00:57:58.913 Disk 0 MBR read successfully
00:57:58.919 Disk 0 MBR scan
00:57:58.928 Disk 0 Windows 7 default MBR code
00:57:58.934 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 238014 MB offset 63
00:57:58.967 Disk 0 Partition 2 00 27 Hidden NTFS WinRE NTFS 450 MB offset 487454720
00:57:58.982 Disk 0 scanning sectors +488376320
00:57:59.050 Disk 0 scanning C:\WINDOWS\system32\drivers
00:58:10.737 Service scanning
00:58:36.571 Modules scanning
00:58:36.591 Disk 0 trace - called modules:
00:58:36.616 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys halmacpi.dll ataport.SYS intelide.sys PCIIDEX.SYS atapi.sys
00:58:36.627 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x890dc030]
00:58:36.638 3 CLASSPNP.SYS[86b84f25] -> nt!IofCallDriver -> [0x89d9e2e8]
00:58:36.648 5 ACPI.sys[86501412] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP2T0L0-3[0x89dc4030]
00:58:37.065 AVAST engine scan C:\WINDOWS
00:58:39.162 AVAST engine scan C:\WINDOWS\system32
01:01:48.092 AVAST engine scan C:\WINDOWS\system32\drivers
01:02:04.143 AVAST engine scan C:\Users\saturn89
01:04:20.120 Disk 0 MBR has been saved successfully to "C:\Users\saturn89\Desktop\MBR.dat"
01:04:20.126 The log file has been saved successfully to "C:\Users\saturn89\Desktop\aswMBR 4-10-16.txt"
01:26:44.446 AVAST engine scan C:\ProgramData
01:30:28.731 Disk 0 statistics 3734583/0/0 @ 1.19 MB/s
01:30:28.757 Scan finished successfully
01:31:23.079 Disk 0 MBR has been saved successfully to "C:\Users\saturn89\Desktop\MBR.dat"
01:31:23.090 The log file has been saved successfully to "C:\Users\saturn89\Desktop\aswMBR 4-10-16 two.txt"
(Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Octoshape ApS) C:\Users\saturn89\AppData\Roaming\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(AVAST Software) C:\Users\saturn89\Downloads\aswMBR.exe
() C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1601.49020.0_x86__8wekyb3d8bbwe\Calculator.exe
==================== Registry (Whitelisted) ===========================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\…\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI.exe [7545088 2015-06-24] (Realtek Semiconductor)
HKLM\…\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [7139256 2016-03-23] (AVAST Software)
HKLM\…\Run: [SDTray] => C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe [4127488 2015-06-16] (Safer-Networking Ltd.)
HKLM\…\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [595480 2016-03-20] (Oracle Corporation)
HKLM\…\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [164152 2016-03-19] (Apple Inc.)
HKLM\…\RunOnce: [Malwarebytes Anti-Malware (cleanup)] => C:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware\mbamdor.exe [55264 2016-03-10] (Malwarebytes)
Winlogon\Notify\SDWinLogon: SDWinLogon.dll [X]
HKU\S-1-5-21-817363288-272500718-2324346864-1000\…\Run: [Octoshape Streaming Services] => C:\Users\saturn89\AppData\Roaming\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe [500016 2014-08-01] (Octoshape ApS)
HKU\S-1-5-21-817363288-272500718-2324346864-1000\…\Run: [SpybotPostWindows10UpgradeReInstall] => C:\Program Files\Common Files\AV\Spybot - Search and Destroy\Test.exe [1011200 2015-07-28] (Safer-Networking Ltd.)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShell.dll [2016-02-15] (AVAST Software)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Ralink Wireless Utility.lnk [2016-04-10]
ShortcutTarget: Ralink Wireless Utility.lnk -> (No File)
BootExecute: autocheck autochk * sdnclean.exe
GroupPolicy: Restriction - Chrome <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [122128 2015-08-12] (Apple Inc.)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 75.75.76.76 75.75.75.75
Tcpip\..\Interfaces\{934289ba-29f1-4151-8ce2-82772a8f164b}: [DhcpNameServer] 192.168.42.129
Tcpip\..\Interfaces\{f11aaca3-239c-4af4-91c7-c1a7026d315c}: [DhcpNameServer] 75.75.76.76 75.75.75.75
ManualProxies:
Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-817363288-272500718-2324346864-1000 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_77\bin\ssv.dll [2016-03-25] (Oracle Corporation)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2016-02-15] (AVAST Software)
BHO: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_77\bin\jp2ssv.dll [2016-03-25] (Oracle Corporation)
FireFox:
========
FF ProfilePath: C:\Users\saturn89\AppData\Roaming\Mozilla\Firefox\Profiles\d62kmg8u.default-1415672622796
FF DefaultSearchEngine.US: Default
FF Homepage: hxxp://searchinterneat-a.akamaihd.net/h?eq=U0EeCFZVBB8SRggScQANWQ9HFBhFIl1dTA1DQ1EOIQtbBxRCQAwUdQgPAA8XEwMFIk0FA18DB0VXfWFoKB8fHGZGIUtbCW4YT1FMN2tdEkwdVUY=
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF32_21_0_0_213.dll [2016-04-08] ()
FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll [2016-03-08] ()
FF Plugin: @java.com/DTPlugin,version=11.77.2 -> C:\Program Files\Java\jre1.8.0_77\bin\dtplugin\npDeployJava1.dll [2016-03-25] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.77.2 -> C:\Program Files\Java\jre1.8.0_77\bin\plugin2\npjp2.dll [2016-03-25] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-12] ( Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-02-02] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-02-02] (Google Inc.)
FF Plugin HKU\S-1-5-21-817363288-272500718-2324346864-1000: @octoshape.com/Octoshape Streaming Services,version=1.0 -> C:\Users\saturn89\AppData\Roaming\Octoshape\Octoshape Streaming Services\sua-1401100-0-npoctoshape.dll [2014-01-10] (Octoshape ApS)
FF Plugin ProgramFiles/Appdata: C:\Users\saturn89\AppData\Roaming\mozilla\plugins\npoctoshape.dll [2015-02-18] (Octoshape ApS)
FF Extension: Lightbeam - C:\Users\saturn89\AppData\Roaming\Mozilla\Firefox\Profiles\d62kmg8u.default-1415672622796\Extensions\[removed] [2015-12-05]
FF Extension: Cash Kitten - C:\Users\saturn89\AppData\Roaming\Mozilla\Firefox\Profiles\d62kmg8u.default-1415672622796\Extensions\{678d6e4d-d7f5-4a79-aa06-9ccabbf0f099}.xpi [2016-04-08] [not signed]
FF Extension: Search Window Results - C:\Users\saturn89\AppData\Roaming\Mozilla\Firefox\Profiles\d62kmg8u.default-1415672622796\Extensions\{89a8f836-6c9c-4a82-8b4a-d7ddbcdbbdf0}.xpi [2016-04-07] [not signed]
FF Extension: Default - C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}.xpi [2016-03-19] [not signed]
FF HKLM\…\Firefox\Extensions: [[removed]] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2016-02-25]
FF HKLM\…\Firefox\Extensions: [[removed]] - C:\Program Files\AVAST Software\Avast\SafePrice\FF
FF Extension: Avast SafePrice - C:\Program Files\AVAST Software\Avast\SafePrice\FF [2016-02-25]
FF ExtraCheck: C:\Program Files\mozilla firefox\defaults\pref\itms.js [2016-03-14]
Chrome:
=======
CHR HomePage: Default -> hxxp://www.dregol.com/?f=1&a;=drg_omxmedia_15_22&cd;=2XzuyEtN2Y1L1Qzu0EtD0C0ByE0EtDtCyE0C0CtAyByB0C0BtN0D0Tzu0StCtByEyCtN1L2XzutAtFtCtDtFtCtDtFtDtN1L1CzutCyEtBzytDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2SyEyDzztAtA0D0B0BtGtByCyD0AtG0A0ByB0FtGyBtBtCtBtGtB0CtD0FyBzyzytAtC0CyE0F2QtN1M1F1B2Z1V1N2Y1L1Qzu2Szz0ByC0Azz0CyD0CtG0A0CzytBtGyEzy0FzztGzzyEyDyEtGtCyByC0EyEzytC0AyEtBtDtD2QtN0A0LzuyE&cr;=16356787&ir;=
CHR DefaultSearchURL: Default -> hxxp://searchinterneat-a.akamaihd.net/s?eq=U0EeE1xZE1oZB1ZEfQgJWAxJFwMWbV9aBVxcFQdBJBRZU1oXDAZCeQ4NUA4QF1MRdh9aFQQTQkcFME0FBloEURNNfWpdAEsSSWJKLl1XFmsUUkBPNEo=&q;={searchTerms}
CHR DefaultSearchKeyword: Default -> searchinterneat-a.akamaihd.net
CHR DefaultNewTabURL: Default -> hxxp://searchinterneat-a.akamaihd.net/t?eq=U0EeFFhaR1oWHAQSeQwAVw9EDFNBJFwVVQsTRRhCclpeTAoQGAIWcQ5ZV19DFxNBNARaAktXUUEeJ1pNER8fHGZGIUtbCW4YT1FMN2tdEkwdVUY=
CHR Profile: C:\Users\saturn89\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\saturn89\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-02-04]
CHR Extension: (Google Drive) - C:\Users\saturn89\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-10-22]
CHR Extension: (YouTube) - C:\Users\saturn89\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-09-25]
CHR Extension: (Google Search) - C:\Users\saturn89\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-10-29]
CHR Extension: (Google Docs Offline) - C:\Users\saturn89\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-03-17]
CHR Extension: (Avast Online Security) - C:\Users\saturn89\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2016-04-07]
CHR Extension: (Chrome Web Store Payments) - C:\Users\saturn89\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-04-03]
CHR Extension: (Gmail) - C:\Users\saturn89\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-03-28]
CHR HKLM\…\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2016-02-15]
==================== Services (Whitelisted) ========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [237096 2016-02-15] (AVAST Software)
R2 RalinkRegistryWriter; C:\Program Files\Ralink\Common\RaRegistry.exe [391472 2013-06-26] (Ralink Technology, Corp.)
S3 RaMediaServer; C:\Program Files\Ralink\Common\RaMediaServer.exe [1863680 2012-07-06] (Ralink) [File not signed]
R2 SDScannerService; C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe [1750712 2015-06-16] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe [2102496 2015-06-16] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files\Spybot - Search & Destroy 2\SDWSCSvc.exe [224712 2015-07-24] (Safer-Networking Ltd.)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [280376 2015-10-30] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23256 2015-10-30] (Microsoft Corporation)
===================== Drivers (Whitelisted) ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R1 AsIO; C:\WINDOWS\System32\drivers\AsIO.sys [12400 2014-05-16] ()
R2 aswHwid; C:\WINDOWS\system32\drivers\aswHwid.sys [32792 2016-02-15] (AVAST Software)
R1 aswKbd; C:\WINDOWS\system32\drivers\aswKbd.sys [35096 2016-02-25] (AVAST Software)
R2 aswMonFlt; C:\WINDOWS\system32\drivers\aswMonFlt.sys [91168 2016-03-09] (AVAST Software)
R1 aswRdr; C:\WINDOWS\system32\drivers\aswRdr2.sys [91232 2016-02-15] (AVAST Software)
R0 aswRvrt; C:\WINDOWS\system32\Drivers\aswRvrt.sys [58776 2016-02-15] (AVAST Software)
R1 aswSnx; C:\WINDOWS\system32\drivers\aswSnx.sys [816304 2016-03-09] (AVAST Software)
R1 aswSP; C:\WINDOWS\system32\drivers\aswSP.sys [447848 2016-02-23] (AVAST Software)
R2 aswStm; C:\WINDOWS\system32\drivers\aswStm.sys [127432 2016-02-15] (AVAST Software)
R0 aswVmm; C:\WINDOWS\system32\Drivers\aswVmm.sys [221240 2016-02-15] (AVAST Software)
R3 MTsensor; C:\WINDOWS\system32\DRIVERS\ASACPI.sys [6504 2014-05-16] ()
R3 netr28u; C:\WINDOWS\System32\drivers\netr28u.sys [1800704 2015-10-30] (MediaTek Inc.)
S3 SWDUMon; C:\WINDOWS\system32\DRIVERS\SWDUMon.sys [13368 2015-10-05] (SlimWare Utilities, Inc.)
S3 WdBoot; C:\WINDOWS\system32\drivers\WdBoot.sys [37400 2015-10-30] (Microsoft Corporation)
S3 WdFilter; C:\WINDOWS\system32\drivers\WdFilter.sys [246104 2015-10-30] (Microsoft Corporation)
S3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [98648 2015-10-30] (Microsoft Corporation)
S3 WUDFWpdMtp; C:\WINDOWS\system32\DRIVERS\WUDFRd.sys [163328 2015-10-30] (Microsoft Corporation)
U3 aswMBR; C:\Users\saturn89\AppData\Local\Temp\aswMBR.sys [56704 2016-04-10] () [File not signed]
U3 idsvc; no ImagePath
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2016-04-10 01:36 - 2016-04-10 01:36 - 00014067 _____ C:\Users\saturn89\Downloads\FRST.txt
2016-04-10 01:35 - 2016-04-10 01:36 - 00000000 ____D C:\FRST
2016-04-10 01:34 - 2016-04-10 01:35 - 01725440 _____ (Farbar) C:\Users\saturn89\Downloads\FRST.exe
2016-04-10 01:31 - 2016-04-10 01:31 - 00002373 _____ C:\Users\saturn89\Desktop\aswMBR 4-10-16 two.txt
2016-04-10 01:04 - 2016-04-10 01:31 - 00000512 _____ C:\Users\saturn89\Desktop\MBR.dat
2016-04-10 01:04 - 2016-04-10 01:04 - 00002009 _____ C:\Users\saturn89\Desktop\aswMBR 4-10-16 one.txt
2016-04-10 00:56 - 2016-04-10 00:56 - 05198336 _____ (AVAST Software) C:\Users\saturn89\Downloads\aswMBR(2).exe
2016-04-10 00:55 - 2016-04-10 00:55 - 05198336 _____ (AVAST Software) C:\Users\saturn89\Downloads\aswMBR(1).exe
2016-04-10 00:52 - 2016-04-10 00:52 - 05198336 _____ (AVAST Software) C:\Users\saturn89\Downloads\aswMBR.exe
2016-04-10 00:46 - 2016-04-10 00:46 - 00009218 _____ C:\mwbytes scan 4-10-16.txt
2016-04-09 03:44 - 2016-04-09 03:44 - 00000258 __RSH C:\ProgramData\ntuser.pol
2016-04-09 02:37 - 2016-04-09 02:37 - 00000000 ____D C:\WINDOWS\system32\SSL
2016-04-09 02:35 - 2016-04-09 02:35 - 04282368 _____ C:\Users\saturn89\Downloads\Behringer_guitar_link_serial_number.iso
2016-04-08 03:20 - 2016-04-08 03:20 - 05934784 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerInstaller.exe
2016-03-28 12:23 - 2016-04-10 00:48 - 00001818 _____ C:\Users\Public\Desktop\iTunes.lnk
2016-03-28 12:23 - 2016-03-28 12:23 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2016-03-28 12:22 - 2016-03-28 12:23 - 00000000 ____D C:\Program Files\iTunes
2016-03-28 12:22 - 2016-03-28 12:22 - 00000000 ____D C:\Program Files\iPod
2016-03-25 13:10 - 2016-03-25 13:10 - 00007078 _____ C:\Users\saturn89\Downloads\CourtOrderInfo (1).pdf
2016-03-25 01:44 - 2016-03-25 01:44 - 00000000 ____D C:\Program Files\Common Files\Java
2016-03-24 09:32 - 2016-04-10 00:48 - 00002622 _____ C:\Users\Public\Desktop\Skype.lnk
2016-03-24 09:32 - 2016-03-24 09:32 - 00000000 ___RD C:\Program Files\Skype
2016-03-24 09:32 - 2016-03-24 09:32 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2016-03-24 09:32 - 2016-03-24 09:32 - 00000000 ____D C:\Program Files\Common Files\Skype
2016-03-23 02:06 - 2016-03-23 02:06 - 01117036 _____ C:\Users\saturn89\Downloads\PTO_PT_Hourly_Guide.PDF
2016-03-19 04:35 - 2016-03-28 05:06 - 00000000 ____D C:\Program Files\Mozilla Firefox
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2016-04-10 01:25 - 2014-05-01 21:06 - 00000924 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2016-04-10 01:20 - 2014-05-23 08:58 - 00000830 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2016-04-10 00:48 - 2016-02-25 08:33 - 00002078 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast Pro Antivirus.lnk
2016-04-10 00:48 - 2016-02-25 08:33 - 00002072 _____ C:\Users\Public\Desktop\Avast Pro Antivirus.lnk
2016-04-10 00:48 - 2016-02-25 08:33 - 00001281 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast SafeZone Browser.lnk
2016-04-10 00:48 - 2016-02-25 08:33 - 00001275 _____ C:\Users\Public\Desktop\Avast SafeZone Browser.lnk
2016-04-10 00:48 - 2016-02-18 15:03 - 00002523 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk
2016-04-10 00:48 - 2016-02-05 00:16 - 00001896 _____ C:\Users\Public\Desktop\AirDroid.lnk
2016-04-10 00:48 - 2015-12-26 03:08 - 00002190 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D; Start Center.lnk
2016-04-10 00:48 - 2015-12-26 03:08 - 00002184 _____ C:\Users\Public\Desktop\Spybot-S&D; Start Center.lnk
2016-04-10 00:48 - 2015-12-25 19:58 - 00001475 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2016-04-10 00:48 - 2015-08-06 21:11 - 00002372 _____ C:\Users\saturn89\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2016-04-10 00:48 - 2015-08-06 20:57 - 00002206 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2016-04-10 00:48 - 2015-07-17 19:31 - 00001125 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2016-04-10 00:48 - 2014-12-01 02:37 - 00000792 _____ C:\Users\Public\Desktop\Asoftech Data Recovery.lnk
2016-04-10 00:48 - 2014-05-21 06:06 - 00001924 _____ C:\Users\Public\Desktop\Generic Trader.lnk
2016-04-10 00:48 - 2014-05-01 21:06 - 00002212 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2016-04-10 00:48 - 2014-05-01 20:59 - 00001071 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2016-04-10 00:48 - 2014-05-01 20:59 - 00001065 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2016-04-10 00:47 - 2014-10-16 02:51 - 00000953 _____ C:\Users\saturn89\Desktop\Zen Bound 2.lnk
2016-04-10 00:47 - 2014-10-16 02:46 - 00000896 _____ C:\Users\saturn89\Desktop\Voxatron.lnk
2016-04-10 00:22 - 2015-07-17 19:32 - 00170200 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2016-04-10 00:18 - 2014-05-01 21:06 - 00000920 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2016-04-10 00:17 - 2015-12-25 20:08 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2016-04-09 04:13 - 2015-10-30 00:47 - 00000000 ____D C:\WINDOWS\INF
2016-04-09 04:13 - 2015-10-30 00:13 - 00262144 ___SH C:\WINDOWS\system32\config\BBI
2016-04-09 03:57 - 2015-12-25 19:53 - 00000000 ____D C:\Users\saturn89
2016-04-09 03:48 - 2015-10-30 00:48 - 00000000 ____D C:\WINDOWS\AppReadiness
2016-04-09 02:41 - 2015-10-05 02:41 - 00000372 _____ C:\WINDOWS\Tasks\SlimCleaner Plus (Scheduled Scan - saturn89).job
2016-04-09 02:39 - 2009-07-13 21:37 - 00000000 ____D C:\WINDOWS\system32\GroupPolicy
2016-04-07 22:38 - 2015-10-30 00:48 - 00000000 ___HD C:\Program Files\WindowsApps
2016-04-03 05:58 - 2015-07-17 19:31 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2016-04-03 05:58 - 2015-07-17 19:31 - 00000000 ____D C:\Program Files\Malwarebytes Anti-Malware
2016-03-28 12:22 - 2016-02-18 15:03 - 00000000 ____D C:\Program Files\Common Files\Apple
2016-03-28 05:14 - 2015-12-25 19:52 - 00988244 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2016-03-28 05:06 - 2014-05-01 20:59 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2016-03-25 01:45 - 2014-10-16 22:16 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2016-03-25 01:45 - 2014-10-16 22:16 - 00000000 ____D C:\Program Files\Java
2016-03-25 01:45 - 2014-05-01 21:25 - 00000000 ____D C:\ProgramData\Oracle
2016-03-25 01:44 - 2015-09-02 23:40 - 00000000 ____D C:\Users\saturn89\.oracle_jre_usage
2016-03-25 01:44 - 2014-10-16 22:16 - 00095808 _____ (Oracle Corporation) C:\WINDOWS\system32\WindowsAccessBridge.dll
2016-03-24 09:32 - 2014-09-15 23:17 - 00000000 ____D C:\Users\saturn89\AppData\Roaming\Skype
2016-03-24 09:32 - 2014-09-15 23:16 - 00000000 ____D C:\ProgramData\Skype
2016-03-23 07:33 - 2015-10-30 00:39 - 00000000 ____D C:\WINDOWS\CbsTemp
2016-03-13 19:51 - 2014-05-21 06:05 - 00000000 ____D C:\Program Files\Generic Trader
2016-03-11 03:31 - 2015-08-06 21:11 - 00000000 ___RD C:\Users\saturn89\OneDrive
==================== Files in the root of some directories =======
2015-07-13 11:08 - 2015-07-28 02:43 - 0007602 _____ () C:\Users\saturn89\AppData\Local\Resmon.ResmonCfg
2015-02-19 11:22 - 2015-02-19 11:22 - 0000000 _____ () C:\Users\saturn89\AppData\Local\{2E71F82C-79B5-4433-BBF8-8DBFF178EC02}
2015-01-12 13:11 - 2015-01-12 13:11 - 0000000 _____ () C:\Users\saturn89\AppData\Local\{35B7639C-412C-4707-899D-0B61CD44CDAD}
2015-06-20 12:33 - 2015-06-20 12:33 - 0000000 _____ () C:\Users\saturn89\AppData\Local\{FB45FF64-DE29-4703-9E15-C0324C817427}
2015-12-25 19:50 - 2015-12-25 19:50 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
Some files in TEMP:
====================
C:\Users\saturn89\AppData\Local\Temp\dnp6txih.dll
C:\Users\saturn89\AppData\Local\Temp\gNHSuOaSYq.exe
C:\Users\saturn89\AppData\Local\Temp\Iwa2T2bKPn.exe
C:\Users\saturn89\AppData\Local\Temp\jre-8u74-windows-au.exe
C:\Users\saturn89\AppData\Local\Temp\jre-8u77-windows-au.exe
C:\Users\saturn89\AppData\Local\Temp\kr8lqewl.dll
C:\Users\saturn89\AppData\Local\Temp\PoXetGmkXO.exe
C:\Users\saturn89\AppData\Local\Temp\yahzaooz.dll
C:\Users\saturn89\AppData\Local\Temp\ZYz1NFfPrQ.exe
==================== Bamital & volsnap =================
(There is no automatic fix for files that do not pass verification.)
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\wininit.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2016-03-31 06:07
==================== End of FRST.txt =====
Additional scan result of Farbar Recovery Scan Tool (x86) Version:05-03-2016 01
Ran by [removed] (2016-04-10 01:37:24)
Running from C:\Users\[removed]\Downloads
Microsoft Windows 10 Home Version 1511 (X86) (2015-12-26 01:13:08)
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
Administrator (S-1-5-21-817363288-272500718-2324346864-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-817363288-272500718-2324346864-503 - Limited - Disabled)
Guest (S-1-5-21-817363288-272500718-2324346864-501 - Limited - Disabled)
saturn89 (S-1-5-21-817363288-272500718-2324346864-1000 - Administrator - Enabled) => C:\Users\saturn89
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Spybot - Search and Destroy (Enabled - Up to date) {A16C3F68-9280-E053-1818-342707FECF4D}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
==================== Installed Programs ======================
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Adobe Flash Player 21 NPAPI (HKLM\…\Adobe Flash Player NPAPI) (Version: 21.0.0.213 - Adobe Systems Incorporated)
AirDroid 3.3.0.0 (HKLM\…\AirDroid) (Version: 3.3.0.0 - Sand Studio)
Apple Application Support (32-bit) (HKLM\…\{FE5C2FAA-118D-4509-B51D-3F71CC9E1B3E}) (Version: 4.3 - Apple Inc.)
Apple Mobile Device Support (HKLM\…\{15A0A9A6-6CF0-4EEE-8E12-096B33F92CA7}) (Version: 9.3.0.15 - Apple Inc.)
Apple Software Update (HKLM\…\{56EC47AA-5813-4FF6-8E75-544026FBEA83}) (Version: 2.2.0.150 - Apple Inc.)
Asoftech Data Recovery (HKLM\…\{1AED6EB7-8FEA-4021-B8FD-EBAA6B21679F}) (Version: 1.00 - )
Avast Pro Antivirus (HKLM\…\Avast) (Version: 11.1.2253 - AVAST Software)
Bonjour (HKLM\…\{D168AAD0-6686-47C1-B599-CDD4888B9D1A}) (Version: 3.1.0.1 - Apple Inc.)
Cisco EAP-FAST Module (HKLM\…\{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}) (Version: 2.2.14 - Cisco Systems, Inc.)
Cisco LEAP Module (HKLM\…\{51C7AD07-C3F6-4635-8E8A-231306D810FE}) (Version: 1.0.19 - Cisco Systems, Inc.)
Cisco PEAP Module (HKLM\…\{ED5776D5-59B4-46B7-AF81-5F2D94D7C640}) (Version: 1.1.6 - Cisco Systems, Inc.)
Generic Trader (HKLM\…\0372-4029-6571-2334) (Version: 8.1 - Certigo, Inc.)
Google Chrome (HKLM\…\Google Chrome) (Version: 49.0.2623.110 - Google Inc.)
Google Update Helper (Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (Version: 1.3.29.5 - Google Inc.) Hidden
HFSExplorer 0.23 (HKLM\…\HFSExplorer) (Version: 0.23 - Catacombae Software)
iCloud (HKLM\…\{C3867553-D9F8-416E-8F14-EFF234A48577}) (Version: 5.1.0.34 - Apple Inc.)
Infinite HD™ App (HKU\S-1-5-21-817363288-272500718-2324346864-1000\…\Octoshape Streaming Services) (Version: - Octoshape ApS)
iTunes (HKLM\…\{3079C5C8-325A-4354-A733-456BACA1E5FB}) (Version: 12.3.3.17 - Apple Inc.)
Java 8 Update 77 (HKLM\…\{26A24AE4-039D-4CA4-87B4-2F83218077F0}) (Version: 8.0.770.3 - Oracle Corporation)
Malwarebytes Anti-Malware version 2.2.1.1043 (HKLM\…\Malwarebytes Anti-Malware_is1) (Version: 2.2.1.1043 - Malwarebytes)
Microsoft Silverlight (HKLM\…\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.41212.0 - Microsoft Corporation)
Mozilla Firefox 45.0.1 (x86 en-US) (HKLM\…\Mozilla Firefox 45.0.1 (x86 en-US)) (Version: 45.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM\…\MozillaMaintenanceService) (Version: 45.0.1.5918 - Mozilla)
Ralink RT2870 Wireless LAN Card (HKLM\…\{28DA7D8B-F9A4-4F18-8AA0-551B1E084D0D}) (Version: 1.5.31.0 - Ralink)
Realtek High Definition Audio Driver (HKLM\…\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7535 - Realtek Semiconductor Corp.)
SafeZone Stable 1.48.2066.95 (Version: 1.48.2066.95 - Avast Software) Hidden
Skype™ 7.21 (HKLM\…\{FC965A47-4839-40CA-B618-18F486F042C6}) (Version: 7.21.100 - Skype Technologies S.A.)
Spybot - Search & Destroy (HKLM\…\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.5.43 - Safer-Networking Ltd.)
Voxatron 0.3.0 (HKLM\…\Voxatron) (Version: 0.3.0 - Lexaloffle Games)
Windows Phone app for desktop (HKLM\…\{5F71448B-88EB-4357-9A98-8658D4C49C48}) (Version: 1.1.2726.0 - Microsoft Corporation)
Zen Bound 2 (HKLM\…\Zen Bound 2) (Version: - )
==================== Custom CLSID (Whitelisted): ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
CustomCLSID: HKU\S-1-5-21-817363288-272500718-2324346864-1000_Classes\CLSID\{7D4733C0-C43B-4A81-AF43-F9B20D1F8348}\InprocServer32 -> C:\Users\saturn89\AppData\Roaming\Octoshape\Octoshape Streaming Services\sua-1401100-0-apoctoshape.dll (Octoshape ApS)
==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {058CAE06-98B8-4360-AE3C-6C5EBD40A77D} - System32\Tasks\Microsoft\Windows\Media Center\DispatchRecoveryTasks => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {0692679A-6E2F-4EDB-9210-5A2D32F091CD} - System32\Tasks\avastBCLRestart_chrome.exe => Chrome.exe
Task: {07C645E7-24C0-4296-8BE7-31EAA32CBB54} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2016-04-08] (Adobe Systems Incorporated)
Task: {099BCFF3-FC03-4A31-B557-8EC54CE75BC3} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> No File <==== ATTENTION
Task: {0F98E85B-B64D-4055-AF01-AF0F122BA442} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW1 => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {173B51C2-46E5-4243-8A96-69D0595001E1} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2016-02-23] (Apple Inc.)
Task: {313876C1-C40F-4262-A6C9-52773489CD2F} - System32\Tasks\SafeZone scheduled Autoupdate 1456407219 => C:\Program Files\AVAST Software\SZBrowser\launcher.exe [2016-03-08] (Avast Software)
Task: {3DC1D7A8-0B1C-44AE-89CE-1D190953EDCD} - System32\Tasks\Microsoft\Windows\Media Center\OCURDiscovery => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {43546740-2192-4F6F-AB39-ACD37A4C919D} - System32\Tasks\Microsoft\Windows\Media Center\RegisterSearch => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {43F14216-DD7A-41F1-BA79-52BB49C3BFD2} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTION
Task: {5F391B05-58B0-4582-9330-AD6664FFEBDD} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate => C:\WINDOWS\ehome\mcupdate.exe
Task: {60E375B5-6649-4DE2-8278-E78B973DBA54} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2016-02-15] (AVAST Software)
Task: {70800E6E-FA99-4DB3-B897-959A7F323885} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files\Spybot - Search & Destroy 2\SDScan.exe [2015-06-16] (Safer-Networking Ltd.)
Task: {750D1AF0-2E08-4208-A3B2-B6BCB84D9A58} - System32\Tasks\Microsoft\Windows\Media Center\RecordingRestart => C:\WINDOWS\ehome\ehrec.exe
Task: {76B57C0E-6B56-4410-969A-C082027A47BD} - System32\Tasks\Microsoft\Windows\Media Center\ReindexSearchRoot => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {79E85592-EEF4-4073-A22D-A55ACD7B6C3A} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> No File <==== ATTENTION
Task: {7C5586D0-21AA-4FAC-B7A4-0A569FBE8FFC} - System32\Tasks\Microsoft\Windows\Media Center\PvrScheduleTask => C:\WINDOWS\ehome\mcupdate.exe
Task: {7CEEC76B-9535-49FB-BF44-8E978633280F} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2016-03-10] (Microsoft Corporation)
Task: {7DBBBFEE-2D15-4394-BB9F-3A8270874566} - System32\Tasks\Microsoft\Windows\Media Center\OCURActivate => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {83B34BFF-5091-483C-94DD-3DFC4F4BB9B0} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files\Spybot - Search & Destroy 2\SDUpdate.exe [2015-06-16] (Safer-Networking Ltd.)
Task: {8A241BC3-A2FA-4954-911C-F14883CE98F0} - System32\Tasks\Microsoft\Windows\Media Center\ConfigureInternetTimeService => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {8DF0925F-9954-480D-8542-9EF6675EC435} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscovery => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {90E8C45F-ED05-4039-A385-6054CC9AC534} - System32\Tasks\Microsoft\Windows\Media Center\ObjectStoreRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe
Task: {9167EBFD-C120-453E-B5D7-4A2ABCFF258B} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> No File <==== ATTENTION
Task: {92118657-D36F-492B-91FA-0AB562B732E6} - System32\Tasks\Microsoft\Windows\Media Center\ehDRMInit => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {93BBC4C1-3199-45BC-9AFC-C3257C77FAC2} - System32\Tasks\Microsoft\Windows\Media Center\MediaCenterRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe
Task: {98BF98F8-ED4B-48C0-BD1B-F96E6C0A936F} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> No File <==== ATTENTION
Task: {9C38D319-D71B-4EBD-992F-1BEE82BE25A1} - System32\Tasks\Microsoft\Windows\Media Center\PeriodicScanRetry => C:\WINDOWS\ehome\MCUpdate.exe
Task: {9F256DB5-B508-4906-B569-CA656C2AE747} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> No File <==== ATTENTION
Task: {AE5B0007-B56F-4887-AF38-196EF31FE051} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2015-08-28] (Google Inc.)
Task: {B26A7A24-7657-4739-9FD1-26D412B44268} - System32\Tasks\Microsoft\Windows\Media Center\UpdateRecordPath => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {BC890042-9FBC-4F81-A017-B02E312C64A2} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION
Task: {C4C4143E-75AF-45C3-8D26-BC7D126CF4A8} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate_scheduled => C:\WINDOWS\ehome\mcupdate.exe
Task: {C50525C3-4BE1-408A-9726-8965A3CA5184} - System32\Tasks\Microsoft\Windows\Media Center\InstallPlayReady => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {CC8BC207-30E3-4E02-AB31-B0AB50DF83F5} - System32\Tasks\Microsoft\Windows\Media Center\PvrRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe
Task: {D48666ED-0C99-4A72-945E-9BD42A93F0CB} - System32\Tasks\SlimCleaner Plus (Scheduled Scan - saturn89) => C:\Program Files\SlimCleaner Plus\SlimCleanerPlus.exe
Task: {E1C16E16-0B00-4388-9072-B3151EF1B355} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> No File <==== ATTENTION
Task: {E30783F3-E961-4AB3-B5FF-34E80AB4B907} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files\Spybot - Search & Destroy 2\SDImmunize.exe [2015-06-16] (Safer-Networking Ltd.)
Task: {E55EA64D-6FA4-4049-9C29-36C8F36B01C6} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW2 => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {ED8D8A50-8133-40AF-B856-3CD01DAF3238} - System32\Tasks\Microsoft\Windows\Media Center\ActivateWindowsSearch => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {EEBC27FB-3026-4CEA-8079-402251BD4154} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> No File <==== ATTENTION
Task: {F38C68B4-65D7-4A61-9434-54C68A9C5B4F} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> No File <==== ATTENTION
Task: {FC14B947-5630-4B99-87A3-F5ED22A11C06} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2015-08-28] (Google Inc.)
Task: {FDDEDF02-6BF8-4A09-9126-4895EB8A49F4} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> No File <==== ATTENTION
Task: {FF3D3376-2C6A-42DA-9D0E-B24C915785C3} - System32\Tasks\Microsoft\Windows\Media Center\SqlLiteRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\SlimCleaner Plus (Scheduled Scan - saturn89).job => C:\Program Files\SlimCleaner Plus\SlimCleanerPlus.exe
==================== Shortcuts =============================
(The entries could be listed to be restored or removed.)
==================== Loaded Modules (Whitelisted) ==============
2015-10-30 00:44 - 2015-10-30 00:44 - 00149504 _____ () C:\WINDOWS\SYSTEM32\ism32k.dll
2016-02-15 02:58 - 2016-02-15 02:58 - 00113496 _____ () C:\Program Files\AVAST Software\Avast\log.dll
2016-02-15 02:58 - 2016-02-15 02:58 - 00133768 _____ () C:\Program Files\AVAST Software\Avast\JsonRpcServer.dll
2016-04-09 03:44 - 2016-04-09 03:44 - 02876416 _____ () C:\Program Files\AVAST Software\Avast\defs\16040900\algo.dll
2016-02-15 02:58 - 2016-02-15 02:58 - 00480760 _____ () C:\Program Files\AVAST Software\Avast\ffl2.dll
2016-04-10 00:18 - 2016-04-10 00:18 - 02876416 _____ () C:\Program Files\AVAST Software\Avast\defs\16040901\algo.dll
2016-03-18 22:56 - 2016-03-18 22:56 - 00080184 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2016-03-18 22:56 - 2016-03-18 22:56 - 01040656 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2015-12-26 03:08 - 2014-05-13 13:04 - 00109400 _____ () C:\Program Files\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2015-12-26 03:08 - 2014-05-13 13:04 - 00167768 _____ () C:\Program Files\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2015-12-26 03:08 - 2014-05-13 13:04 - 00416600 _____ () C:\Program Files\Spybot - Search & Destroy 2\DEC150.bpl
2015-12-26 03:08 - 2012-08-23 11:38 - 00574840 _____ () C:\Program Files\Spybot - Search & Destroy 2\sqlite3.dll
2016-03-02 01:57 - 2016-02-23 05:34 - 01859960 _____ () C:\WINDOWS\system32\CoreUIComponents.dll
2016-01-22 01:47 - 2016-01-22 01:47 - 00144384 _____ () C:\Program Files\WindowsApps\Microsoft.Messaging_2.13.20000.0_x86__8wekyb3d8bbwe\SkypeHost.exe
2016-01-22 01:47 - 2016-01-22 01:47 - 00141312 _____ () C:\Program Files\WindowsApps\Microsoft.Messaging_2.13.20000.0_x86__8wekyb3d8bbwe\SkypeBackgroundTasks.dll
2016-01-22 01:47 - 2016-01-22 01:47 - 22330368 _____ () C:\Program Files\WindowsApps\Microsoft.Messaging_2.13.20000.0_x86__8wekyb3d8bbwe\SkyWrap.dll
2016-03-02 01:57 - 2016-02-23 05:34 - 01859960 _____ () C:\WINDOWS\System32\CoreUIComponents.dll
2015-12-25 21:42 - 2015-12-25 21:42 - 00070656 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\Windows.UI.Shell.SharedUtilities.dll
2016-03-02 01:56 - 2016-02-23 02:48 - 00316416 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\QuickActions.dll
2016-01-13 04:16 - 2016-01-04 20:23 - 05340672 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll
2016-01-13 04:16 - 2016-01-04 20:19 - 00471552 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2016-01-27 13:13 - 2016-01-16 00:06 - 02366464 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll
2016-01-27 13:13 - 2016-01-16 00:09 - 02656768 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll
2015-12-11 16:37 - 2015-12-11 16:37 - 40539648 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2016-01-21 01:37 - 2016-01-21 01:37 - 03034624 _____ () C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1601.49020.0_x86__8wekyb3d8bbwe\Calculator.exe
2015-12-15 02:26 - 2015-12-15 02:26 - 00169984 _____ () C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1601.49020.0_x86__8wekyb3d8bbwe\StoreRatingPromotion.dll
==================== Alternate Data Streams (Whitelisted) =========
(If an entry is included in the fixlist, only the ADS will be removed.)
==================== Safe Mode (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" value will be restored.)
==================== EXE Association (Whitelisted) ===============
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, it will be removed from the registry.)
IE trusted site: HKU\S-1-5-21-817363288-272500718-2324346864-1000\…\driversupport.com -> hxxp://apps.driversupport.com
IE trusted site: HKU\S-1-5-21-817363288-272500718-2324346864-1000\…\driversupport.com -> hxxps://apps.driversupport.com
IE restricted site: HKU\S-1-5-21-817363288-272500718-2324346864-1000\…\007guard.com -> install.007guard.com
IE restricted site: HKU\S-1-5-21-817363288-272500718-2324346864-1000\…\008i.com -> 008i.com
IE restricted site: HKU\S-1-5-21-817363288-272500718-2324346864-1000\…\008k.com -> www.008k.com
IE restricted site: HKU\S-1-5-21-817363288-272500718-2324346864-1000\…\00hq.com -> www.00hq.com
IE restricted site: HKU\S-1-5-21-817363288-272500718-2324346864-1000\…\010402.com -> 010402.com
IE restricted site: HKU\S-1-5-21-817363288-272500718-2324346864-1000\…\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\S-1-5-21-817363288-272500718-2324346864-1000\…\0scan.com -> www.0scan.com
IE restricted site: HKU\S-1-5-21-817363288-272500718-2324346864-1000\…\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\S-1-5-21-817363288-272500718-2324346864-1000\…\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\S-1-5-21-817363288-272500718-2324346864-1000\…\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\S-1-5-21-817363288-272500718-2324346864-1000\…\1001namen.com -> www.1001namen.com
IE restricted site: HKU\S-1-5-21-817363288-272500718-2324346864-1000\…\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\S-1-5-21-817363288-272500718-2324346864-1000\…\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\S-1-5-21-817363288-272500718-2324346864-1000\…\10sek.com -> www.10sek.com
IE restricted site: HKU\S-1-5-21-817363288-272500718-2324346864-1000\…\12-26.net -> user1.12-26.net
IE restricted site: HKU\S-1-5-21-817363288-272500718-2324346864-1000\…\12-27.net -> user1.12-27.net
IE restricted site: HKU\S-1-5-21-817363288-272500718-2324346864-1000\…\123fporn.info -> www.123fporn.info
IE restricted site: HKU\S-1-5-21-817363288-272500718-2324346864-1000\…\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\S-1-5-21-817363288-272500718-2324346864-1000\…\123moviedownload.com -> www.123moviedownload.com
IE restricted site: HKU\S-1-5-21-817363288-272500718-2324346864-1000\…\123simsen.com -> www.123simsen.com
There are 7865 more sites.
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-13 21:04 - 2014-05-07 00:54 - 00450709 ___RA C:\WINDOWS\system32\Drivers\etc\hosts
127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com
127.0.0.1 www.0scan.com
127.0.0.1 0scan.com
127.0.0.1 1000gratisproben.com
127.0.0.1 www.1000gratisproben.com
127.0.0.1 1001namen.com
127.0.0.1 www.1001namen.com
127.0.0.1 100888290cs.com
127.0.0.1 www.100888290cs.com
127.0.0.1 www.100sexlinks.com
127.0.0.1 100sexlinks.com
127.0.0.1 10sek.com
127.0.0.1 www.10sek.com
127.0.0.1 www.1-2005-search.com
127.0.0.1 1-2005-search.com
127.0.0.1 123fporn.info
127.0.0.1 www.123fporn.info
127.0.0.1 123haustiereundmehr.com
127.0.0.1 www.123haustiereundmehr.com
127.0.0.1 123moviedownload.com
127.0.0.1 www.123moviedownload.com
There are 15461 more lines.
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-817363288-272500718-2324346864-1000\Control Panel\Desktop\\Wallpaper -> c:\windows\web\wallpaper\windows\img0.jpg
DNS Servers: 75.75.76.76 - 75.75.75.75
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-817363288-272500718-2324346864-1000\…\StartupApproved\StartupFolder: => "TurboYourPC.lnk"
==================== FirewallRules (Whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [MSMQ-In-TCP] => (Allow) %systemroot%\system32\mqsvc.exe
FirewallRules: [MSMQ-Out-TCP] => (Allow) %systemroot%\system32\mqsvc.exe
FirewallRules: [MSMQ-In-UDP] => (Allow) %systemroot%\system32\mqsvc.exe
FirewallRules: [MSMQ-Out-UDP] => (Allow) %systemroot%\system32\mqsvc.exe
FirewallRules: [WCF-NetTcpActivator-In-TCP-32bit] => (Allow) LPort=808
FirewallRules: [{817D2932-FC02-4A9B-BD02-E0E410F7513F}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{DF2B8375-A17B-4561-A08E-50BED31EF2D0}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{65ACD1BB-5BBD-440C-9FF0-0B8A4A5921C4}] => (Allow) C:\Program Files\Ralink\Common\RaMediaServer.exe
FirewallRules: [{189ED8C2-D4C9-43CF-9CDD-E6B44C3DB599}] => (Allow) C:\Program Files\Ralink\Common\RaMediaServer.exe
FirewallRules: [{B679054D-0E5C-4FBC-AF56-09D4BB59B419}] => (Allow) C:\Program Files\Ralink\Common\RaUI.exe
FirewallRules: [{40257434-3BE0-44FD-9A35-B2CA0861AD8E}] => (Allow) C:\Program Files\Ralink\Common\RaUI.exe
FirewallRules: [TCP Query User{FF62C8CD-95EE-4AB9-9F3B-ED76371AF853}C:\program files\generic trader\generictrader.exe] => (Allow) C:\program files\generic trader\generictrader.exe
FirewallRules: [UDP Query User{87E8EB78-2966-4C7F-B371-5C85C2BD1CF1}C:\program files\generic trader\generictrader.exe] => (Allow) C:\program files\generic trader\generictrader.exe
FirewallRules: [TCP Query User{447D8ECC-36C3-4C26-BF7D-0E3C2222F00B}C:\program files\generic trader\jre\bin\java.exe] => (Allow) C:\program files\generic trader\jre\bin\java.exe
FirewallRules: [UDP Query User{8A3DA177-06D8-49E6-B26F-8936FF7899F7}C:\program files\generic trader\jre\bin\java.exe] => (Allow) C:\program files\generic trader\jre\bin\java.exe
FirewallRules: [{938DF1CD-CE5B-453C-8ECC-D35F86BEDA6C}] => (Allow) C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
FirewallRules: [TCP Query User{3C017011-5EAC-41D0-966A-E5E113375D79}C:\program files\generic trader\generictrader.exe] => (Allow) C:\program files\generic trader\generictrader.exe
FirewallRules: [UDP Query User{237E1B3B-6B20-4CDF-8B46-23117CD5DF1D}C:\program files\generic trader\generictrader.exe] => (Allow) C:\program files\generic trader\generictrader.exe
FirewallRules: [TCP Query User{C440529B-E670-427F-A208-66452B302E96}C:\program files\generic trader\jre\bin\java.exe] => (Allow) C:\program files\generic trader\jre\bin\java.exe
FirewallRules: [UDP Query User{3A560CDA-C612-46D4-BE89-AF306F50C264}C:\program files\generic trader\jre\bin\java.exe] => (Allow) C:\program files\generic trader\jre\bin\java.exe
FirewallRules: [{CA3624E0-511A-4969-80F4-B6E4A5684DBC}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{3C35D563-1693-426D-96A1-3F597E3F9487}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [TCP Query User{D4C76E1E-B5F2-44D0-84F1-76EC194B95E4}C:\users\saturn89\appdata\roaming\octoshape\octoshape streaming services\octoshapeclient.exe] => (Allow) C:\users\saturn89\appdata\roaming\octoshape\octoshape streaming services\octoshapeclient.exe
FirewallRules: [UDP Query User{6CB58E30-A987-40DD-9E7F-2CFAAFABC7AD}C:\users\saturn89\appdata\roaming\octoshape\octoshape streaming services\octoshapeclient.exe] => (Allow) C:\users\saturn89\appdata\roaming\octoshape\octoshape streaming services\octoshapeclient.exe
FirewallRules: [TCP Query User{C6B02999-88D8-48A2-B467-818C473565CA}C:\program files\mozilla firefox\firefox.exe] => (Allow) C:\program files\mozilla firefox\firefox.exe
FirewallRules: [UDP Query User{F9CB2CBA-0C5A-44D4-802E-8957F4CA8208}C:\program files\mozilla firefox\firefox.exe] => (Allow) C:\program files\mozilla firefox\firefox.exe
FirewallRules: [TCP Query User{B01D604E-5F8A-4014-819C-EBEFE309F0C5}C:\program files\airdroid\airdroid.exe] => (Allow) C:\program files\airdroid\airdroid.exe
FirewallRules: [UDP Query User{C97F5A48-70EC-498A-92DD-8D7BA53C41B3}C:\program files\airdroid\airdroid.exe] => (Allow) C:\program files\airdroid\airdroid.exe
FirewallRules: [{86AA8D02-A0A4-4CB7-A088-A158FC9C222C}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{80C1EB45-8D3D-460D-8AAD-DA0DB892DE03}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{57985A79-6425-498E-AD7E-0A17610501B5}] => (Allow) C:\Program Files\Skype\Phone\Skype.exe
FirewallRules: [{6939F2E0-8DEC-4328-BCC2-4D4DEB1B8800}] => (Allow) C:\Program Files\iTunes\iTunes.exe
FirewallRules: [{FC363AF9-ABB9-4F2E-8C2B-12BD86CD609E}] => (Allow) C:\Program Files\Google\Chrome\Application\chrome.exe
FirewallRules: [{EB5F74DA-4A69-48AA-90F0-ECA4CFBABCD4}] => (Allow) C:\Program Files\SrpnFiles\SrpnFiles.exe
FirewallRules: [{0BFA0748-A3C4-4E66-9D8E-9B104A2DB43D}] => (Allow) C:\Program Files\SrpnFiles\SrpnFiles.exe
FirewallRules: [{510B1CBC-66F0-441E-A7D6-02FB4DC8A711}] => (Allow) C:\Program Files\SrpnFiles\downloader.exe
FirewallRules: [{0DD526C5-27EA-47C9-B096-59209FD01E53}] => (Allow) C:\Program Files\SrpnFiles\downloader.exe
StandardProfile\AuthorizedApplications: [C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe] => Enabled:Spybot - Search & Destroy tray access
StandardProfile\AuthorizedApplications: [C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe] => Enabled:Spybot-S&D; 2 Scanner Service
StandardProfile\AuthorizedApplications: [C:\Program Files\Spybot - Search & Destroy 2\SDUpdate.exe] => Enabled:Spybot-S&D; 2 Updater
StandardProfile\AuthorizedApplications: [C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe] => Enabled:Spybot-S&D; 2 Background update service
==================== Restore Points =========================
23-03-2016 07:31:55 Windows Update
31-03-2016 06:13:45 Scheduled Checkpoint
09-04-2016 00:43:30 Scheduled Checkpoint
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (04/10/2016 12:48:26 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: microsoftedgecp.exe, version: 11.0.10586.20, time stamp: 0x56540878
Faulting module name: EMODEL.dll, version: 11.0.10586.122, time stamp: 0x56cbfadd
Exception code: 0xc0000409
Fault offset: 0x0019c343
Faulting process id: 0x10f8
Faulting application start time: 0xmicrosoftedgecp.exe0
Faulting application path: microsoftedgecp.exe1
Faulting module path: microsoftedgecp.exe2
Report Id: microsoftedgecp.exe3
Faulting package full name: microsoftedgecp.exe4
Faulting package-relative application ID: microsoftedgecp.exe5
Error: (04/10/2016 12:48:10 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: microsoftedgecp.exe, version: 11.0.10586.20, time stamp: 0x56540878
Faulting module name: EMODEL.dll, version: 11.0.10586.122, time stamp: 0x56cbfadd
Exception code: 0xc0000409
Fault offset: 0x0019c343
Faulting process id: 0x658
Faulting application start time: 0xmicrosoftedgecp.exe0
Faulting application path: microsoftedgecp.exe1
Faulting module path: microsoftedgecp.exe2
Report Id: microsoftedgecp.exe3
Faulting package full name: microsoftedgecp.exe4
Faulting package-relative application ID: microsoftedgecp.exe5
Error: (04/10/2016 12:47:54 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: microsoftedgecp.exe, version: 11.0.10586.20, time stamp: 0x56540878
Faulting module name: EMODEL.dll, version: 11.0.10586.122, time stamp: 0x56cbfadd
Exception code: 0xc0000409
Fault offset: 0x0019c343
Faulting process id: 0xec4
Faulting application start time: 0xmicrosoftedgecp.exe0
Faulting application path: microsoftedgecp.exe1
Faulting module path: microsoftedgecp.exe2
Report Id: microsoftedgecp.exe3
Faulting package full name: microsoftedgecp.exe4
Faulting package-relative application ID: microsoftedgecp.exe5
Error: (04/10/2016 12:47:26 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: microsoftedgecp.exe, version: 11.0.10586.20, time stamp: 0x56540878
Faulting module name: EMODEL.dll, version: 11.0.10586.122, time stamp: 0x56cbfadd
Exception code: 0xc0000409
Fault offset: 0x0019c343
Faulting process id: 0x3c0
Faulting application start time: 0xmicrosoftedgecp.exe0
Faulting application path: microsoftedgecp.exe1
Faulting module path: microsoftedgecp.exe2
Report Id: microsoftedgecp.exe3
Faulting package full name: microsoftedgecp.exe4
Faulting package-relative application ID: microsoftedgecp.exe5
Error: (04/09/2016 03:57:44 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Activation context generation failed for "Microsoft.Windows.Networking.RtcDll,language="*",processorArchitecture="X86",publicKeyToken="6595b64144ccf1df",type="win32",version="5.2.1002.3"1".
Dependent Assembly Microsoft.Windows.Networking.RtcDll,language="*",processorArchitecture="X86",publicKeyToken="6595b64144ccf1df",type="win32",version="5.2.1002.3" could not be found.
Please use sxstrace.exe for detailed diagnosis.
Error: (04/09/2016 02:37:40 AM) (Source: MsiInstaller) (EventID: 11935) (User: springfourteen)
Description: Product: Itibiti RTC – Error 1935. An error occurred during the installation of assembly 'Microsoft.Windows.Networking.DxmRtp,type="win32",version="5.2.1002.3",processorArchitecture="x86",publicKeyToken="6595b64144ccf1df"'. Please refer to Help and Support for more information. HRESULT: 0x800736B3. assembly interface: IAssemblyCacheItem, function: Commit, component: {356EA90A-7323-4D9A-B1FB-2EA0B564B3EE}
Error: (04/09/2016 02:36:37 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Activation context generation failed for "Microsoft.Windows.Networking.RtcDll,language="*",processorArchitecture="X86",publicKeyToken="6595b64144ccf1df",type="win32",version="5.2.1002.3"1".
Dependent Assembly Microsoft.Windows.Networking.RtcDll,language="*",processorArchitecture="X86",publicKeyToken="6595b64144ccf1df",type="win32",version="5.2.1002.3" could not be found.
Please use sxstrace.exe for detailed diagnosis.
Error: (04/09/2016 12:43:39 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.
Details:
AddLegacyDriverFiles: Unable to back up image of binary Microsoft Link-Layer Discovery Protocol.
System Error:
Access is denied.
.
Error: (04/08/2016 03:03:43 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: BITSC:\Windows\System32\bitsperf.dll4
Error: (04/07/2016 02:25:20 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: springfourteen)
Description: Activation of app Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI failed with error: -2144927141 See the Microsoft-Windows-TWinUI/Operational log for additional information.
System errors:
=============
Error: (04/10/2016 01:03:34 AM) (Source: DCOM) (EventID: 10016) (User: springfourteen)
Description: machine-defaultLocalActivation{C2F03A33-21F5-47FA-B4BB-156362A2F239}{316CDED5-E4AE-4B15-9113-7055D84DCC97}springfourteensaturn89S-1-5-21-817363288-272500718-2324346864-1000LocalHost (Using LRPC)Microsoft.Windows.Cortana_1.6.1.52_neutral_neutral_cw5n1h2txyewyS-1-15-2-1861897761-1695161497-2927542615-642690995-327840285-2659745135-2630312742
Error: (04/10/2016 01:03:34 AM) (Source: DCOM) (EventID: 10016) (User: springfourteen)
Description: machine-defaultLocalActivation{C2F03A33-21F5-47FA-B4BB-156362A2F239}{316CDED5-E4AE-4B15-9113-7055D84DCC97}springfourteensaturn89S-1-5-21-817363288-272500718-2324346864-1000LocalHost (Using LRPC)Microsoft.Windows.Cortana_1.6.1.52_neutral_neutral_cw5n1h2txyewyS-1-15-2-1861897761-1695161497-2927542615-642690995-327840285-2659745135-2630312742
Error: (04/10/2016 01:03:34 AM) (Source: DCOM) (EventID: 10016) (User: springfourteen)
Description: machine-defaultLocalActivation{C2F03A33-21F5-47FA-B4BB-156362A2F239}{316CDED5-E4AE-4B15-9113-7055D84DCC97}springfourteensaturn89S-1-5-21-817363288-272500718-2324346864-1000LocalHost (Using LRPC)Microsoft.Windows.Cortana_1.6.1.52_neutral_neutral_cw5n1h2txyewyS-1-15-2-1861897761-1695161497-2927542615-642690995-327840285-2659745135-2630312742
Error: (04/10/2016 01:03:31 AM) (Source: DCOM) (EventID: 10016) (User: springfourteen)
Description: machine-defaultLocalActivation{C2F03A33-21F5-47FA-B4BB-156362A2F239}{316CDED5-E4AE-4B15-9113-7055D84DCC97}springfourteensaturn89S-1-5-21-817363288-272500718-2324346864-1000LocalHost (Using LRPC)Microsoft.Windows.Cortana_1.6.1.52_neutral_neutral_cw5n1h2txyewyS-1-15-2-1861897761-1695161497-2927542615-642690995-327840285-2659745135-2630312742
Error: (04/10/2016 01:03:31 AM) (Source: DCOM) (EventID: 10016) (User: springfourteen)
Description: machine-defaultLocalActivation{C2F03A33-21F5-47FA-B4BB-156362A2F239}{316CDED5-E4AE-4B15-9113-7055D84DCC97}springfourteensaturn89S-1-5-21-817363288-272500718-2324346864-1000LocalHost (Using LRPC)Microsoft.Windows.Cortana_1.6.1.52_neutral_neutral_cw5n1h2txyewyS-1-15-2-1861897761-1695161497-2927542615-642690995-327840285-2659745135-2630312742
Error: (04/10/2016 01:03:31 AM) (Source: DCOM) (EventID: 10016) (User: springfourteen)
Description: machine-defaultLocalActivation{C2F03A33-21F5-47FA-B4BB-156362A2F239}{316CDED5-E4AE-4B15-9113-7055D84DCC97}springfourteensaturn89S-1-5-21-817363288-272500718-2324346864-1000LocalHost (Using LRPC)Microsoft.Windows.Cortana_1.6.1.52_neutral_neutral_cw5n1h2txyewyS-1-15-2-1861897761-1695161497-2927542615-642690995-327840285-2659745135-2630312742
Error: (04/10/2016 12:18:30 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The NetPipeActivator service failed to start due to the following error:
%%1053
Error: (04/10/2016 12:18:30 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the NetPipeActivator service to connect.
Error: (04/10/2016 12:17:54 AM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The NetTcpActivator service depends on the NetTcpPortSharing service which failed to start because of the following error:
%%1058
Error: (04/09/2016 04:13:30 AM) (Source: DCOM) (EventID: 10010) (User: NT AUTHORITY)
Description: {7006698D-2974-4091-A424-85DD0B909E23}
CodeIntegrity:
===================================
Date: 2016-04-09 02:39:05.469
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.
Date: 2016-03-24 00:32:39.536
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.
Date: 2016-03-12 11:41:19.752
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.
Date: 2016-03-11 16:56:38.552
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.
Date: 2016-03-10 05:47:37.657
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.
Date: 2016-03-04 02:56:02.294
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.
Date: 2016-03-03 21:23:30.283
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.
Date: 2016-02-18 14:10:32.085
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.
Date: 2016-02-11 16:07:50.212
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.
Date: 2016-02-11 07:52:29.825
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.
==================== Memory info ===========================
Processor: Intel(R) Celeron(R) CPU E3200 @ 2.40GHz
Percentage of memory in use: 74%
Total physical RAM: 2013.05 MB
Available physical RAM: 517.24 MB
Total Virtual: 4061.05 MB
Available Virtual: 2429.84 MB
==================== Drives ================================
Drive c: (OS) (Fixed) (Total:232.44 GB) (Free:180.51 GB) NTFS ==>[drive with boot components (obtained from BCD)]
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 232.9 GB) (Disk ID: 1ADF1ADE)
Partition 1: (Active) - (Size=232.4 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=450 MB) - (Type=27)
==================== End of Addition.txt =================
Hi,
Lets go ahead and run some tools , there are a few things that need to be cleaned up
You have Malwarebytes installed, I am including instructions on how to set it up so bypass the download part
SlimCleaner Plus <– Also programs like this are not needed, sometimes they do more harm then good. Been at this for many years and never had no use for third party cleaners , you may want to think about uninstalling it
I had to run ADWCleaner twice. The first time it showed a file "swdmon", not sure of the spelling, then stopped. When I restarted it that file didn't show and it completed and gave a log file.
Here are the respective log files:
# AdwCleaner v5.110 - Logfile created 12/04/2016 at 03:59:51
# Updated 10/04/2016 by Xplode
# Database : 2016-04-11.4 [Server]
# Operating system : Windows 10 Home (X86)
# Username : saturn89 - SPRINGFOURTEEN
# Running from : C:\Users\saturn89\Downloads\AdwCleaner.exe
# Option : Clean
# Support : http://toolslib.net/forum
***** [ Services ] *****
***** [ Folders ] *****
[-] Folder Deleted : C:\Users\Public\Documents\Downloaded Installers
***** [ Files ] *****
[-] File Deleted : C:\Users\saturn89\AppData\Local\Chromium\User Data\Default\Local Storage\chrome-extension_ihokndmjeombjojnfkmapfnjeghjohim_0.localstorage
[-] File Deleted : C:\Users\saturn89\AppData\Local\Chromium\User Data\Default\Local Storage\hxxps_dwq4do82y8xi7.cloudfront.net_0.localstorage
[-] File Deleted : C:\Users\saturn89\AppData\Local\Chromium\User Data\Default\Local Storage\hxxps_dwq4do82y8xi7.cloudfront.net_0.localstorage-journal
[-] File Deleted : C:\Users\saturn89\AppData\Local\Chromium\User Data\Default\Local Storage\hxxps_d23716qn9q7omq.cloudfront.net_0.localstorage
[-] File Deleted : C:\Users\saturn89\AppData\Local\Chromium\User Data\Default\Local Storage\hxxps_d23716qn9q7omq.cloudfront.net_0.localstorage-journal
[#] File Deleted : C:\Users\saturn89\AppData\Local\Chromium\User Data\Default\Local Storage\hxxps_dwq4do82y8xi7.cloudfront.net_0.localstorage
[#] File Deleted : C:\Users\saturn89\AppData\Local\Chromium\User Data\Default\Local Storage\hxxps_dwq4do82y8xi7.cloudfront.net_0.localstorage-journal
[-] File Deleted : C:\Users\saturn89\AppData\Local\Chromium\User Data\Default\Local Storage\hxxp_us.ask.com_0.localstorage
[-] File Deleted : C:\Users\saturn89\AppData\Local\Chromium\User Data\Default\Local Storage\hxxp_us.ask.com_0.localstorage-journal
[-] File Deleted : C:\Users\saturn89\AppData\Local\Chromium\User Data\Default\Local Storage\hxxp_www.ask.com_0.localstorage
[-] File Deleted : C:\Users\saturn89\AppData\Local\Chromium\User Data\Default\Local Storage\hxxp_www.ask.com_0.localstorage-journal
[-] File Deleted : C:\Users\saturn89\AppData\Local\Chromium\User Data\Default\Local Storage\hxxp_www.dregol.com_0.localstorage
[-] File Deleted : C:\Users\saturn89\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_d22j4fzzszoii2.cloudfront.net_0.localstorage
[-] File Deleted : C:\Users\saturn89\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_d22j4fzzszoii2.cloudfront.net_0.localstorage-journal
[-] File Deleted : C:\Users\saturn89\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_dwq4do82y8xi7.cloudfront.net_0.localstorage
[-] File Deleted : C:\Users\saturn89\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_dwq4do82y8xi7.cloudfront.net_0.localstorage-journal
[-] File Deleted : C:\Users\saturn89\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_rndntpmgnj-a.akamaihd.net_0.localstorage
[-] File Deleted : C:\Users\saturn89\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_rndntpmgnj-a.akamaihd.net_0.localstorage-journal
[-] File Deleted : C:\Users\saturn89\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_xoncisfktn-a.akamaihd.net_0.localstorage
[-] File Deleted : C:\Users\saturn89\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_xoncisfktn-a.akamaihd.net_0.localstorage-journal
[-] File Deleted : C:\Users\saturn89\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_android-sync-manager-agent.en.softonic.com_0.localstorage
[-] File Deleted : C:\Users\saturn89\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_android-sync-manager-agent.en.softonic.com_0.localstorage-journal
[-] File Deleted : C:\Users\saturn89\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_android-sync-manager-wifi.en.softonic.com_0.localstorage
[-] File Deleted : C:\Users\saturn89\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_android-sync-manager-wifi.en.softonic.com_0.localstorage-journal
[-] File Deleted : C:\Users\saturn89\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_d2m2wsoho8qq12.cloudfront.net_0.localstorage
[-] File Deleted : C:\Users\saturn89\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_d2m2wsoho8qq12.cloudfront.net_0.localstorage-journal
[-] File Deleted : C:\Users\saturn89\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.driverupdate.net_0.localstorage
[-] File Deleted : C:\Users\saturn89\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.driverupdate.net_0.localstorage-journal
[-] File Deleted : C:\Users\saturn89\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.yourtango.com_0.localstorage
[-] File Deleted : C:\Users\saturn89\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.yourtango.com_0.localstorage-journal
[#] File Deleted : C:\Users\saturn89\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_dwq4do82y8xi7.cloudfront.net_0.localstorage
[#] File Deleted : C:\Users\saturn89\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_dwq4do82y8xi7.cloudfront.net_0.localstorage-journal
[-] File Deleted : C:\WINDOWS\system32\drivers\swdumon.sys
***** [ DLLs ] *****
***** [ Shortcuts ] *****
***** [ Scheduled tasks ] *****
***** [ Registry ] *****
[-] Key Deleted : HKLM\SOFTWARE\SrpnFiles
[-] Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [{EB5F74DA-4A69-48AA-90F0-ECA4CFBABCD4}]
[-] Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [{0BFA0748-A3C4-4E66-9D8E-9B104A2DB43D}]
[-] Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [{510B1CBC-66F0-441E-A7D6-02FB4DC8A711}]
[-] Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [{0DD526C5-27EA-47C9-B096-59209FD01E53}]
***** [ Web browsers ] *****
[-] [C:\Users\saturn89\AppData\Roaming\Mozilla\Firefox\Profiles\d62kmg8u.default-1415672622796\prefs.js] [Preference] Deleted : user_pref("browser.startup.homepage", "hxxp://searchinterneat-a.akamaihd.net/h?eq=U0EeCFZVBB8SRggScQANWQ9HFBhFIl1dTA1DQ1EOIQtbBxRCQAwUdQgPAA8XEwMFIk0FA18DB0VXfWFoKB8fHGZGIUtbCW4YT1FMN2tdEkwdVUY=");
[-] [C:\Users\saturn89\AppData\Roaming\Mozilla\Firefox\Profiles\d62kmg8u.default-1415672622796\prefs.js] [Preference] Deleted : user_pref("extensions.avastwrc.settings", "{\"current\":{\"callerId\":2018,\"userId\":\"f82f11d1053e93366692d4ff1644f94e\",\"edition\":0,\"lastApplicationEventSent\":1460312345548},\"features\":{\"phi[…]
[-] [C:\Users\saturn89\AppData\Local\Google\Chrome\User Data\Default\Web Data] [Search Provider] Deleted : aol.com
[-] [C:\Users\saturn89\AppData\Local\Google\Chrome\User Data\Default\Web Data] [Search Provider] Deleted : ask.com
[-] [C:\Users\saturn89\AppData\Local\Google\Chrome\User Data\Default\Web Data] [Search Provider] Deleted : us.ask.com
[-] [C:\Users\saturn89\AppData\Local\Google\Chrome\User Data\Default\Web Data] [Search Provider] Deleted : dregol.com
[-] [C:\Users\saturn89\AppData\Local\Google\Chrome\User Data\Default\Web Data] [Search Provider] Deleted : mozilla-firefox.en.softonic.com
[-] [C:\Users\saturn89\AppData\Local\Google\Chrome\User Data\Default\Web Data] [Search Provider] Deleted : android-sync-manager-wifi.en.softonic.com
[-] [C:\Users\saturn89\AppData\Local\Google\Chrome\User Data\Default\Web Data] [Search Provider] Deleted : flightaware.com
[-] [C:\Users\saturn89\AppData\Local\Google\Chrome\User Data\Default\Web Data] [Search Provider] Deleted : searchinterneat-a.akamaihd.net
[-] [C:\Users\saturn89\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] [Default_Search_Provider_Data] Deleted : hxxp://searchinterneat-a.akamaihd.net/s?eq=U0EeE1xZE1oZB1ZEfQgJWAxJFwMWbV9aBVxcFQdBJBRZU1oXDAZCeQ4NUA4QF1MRdh9aFQQTQkcFME0FBloEURNNfWpdAEsSSWJKLl1XFmsUUkBPNEo=&q={searchTerms}
[-] [C:\Users\saturn89\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] [Extension] Deleted : ihokndmjeombjojnfkmapfnjeghjohim
[-] [C:\Users\saturn89\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] [Homepage] Deleted : hxxp://www.dregol.com/?f=1&a=drg_omxmedia_15_22&cd=2XzuyEtN2Y1L1Qzu0EtD0C0ByE0EtDtCyE0C0CtAyByB0C0BtN0D0Tzu0StCtByEyCtN1L2XzutAtFtCtDtFtCtDtFtDtN1L1CzutCyEtBzytDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2SyEyDzztAtA0D0B0BtGtByCyD0AtG0A0ByB0FtGyBtBtCtBtGtB0CtD0FyBzyzytAtC0CyE0F2QtN1M1F1B2Z1V1N2Y1L1Qzu2Szz0ByC0Azz0CyD0CtG0A0CzytBtGyEzy0FzztGzzyEyDyEtGtCyByC0EyEzytC0AyEtBtDtD2QtN0A0LzuyE&cr=16356787&ir=
[-] [C:\Users\saturn89\AppData\Local\Chromium\User Data\Default\Secure Preferences] [Extension] Deleted : ihokndmjeombjojnfkmapfnjeghjohim
[-] [C:\Users\saturn89\AppData\Local\Chromium\User Data\Default\Secure Preferences] [Homepage] Deleted : hxxp://www.dregol.com/?f=1&a=drg_omxmedia_15_22&cd=2XzuyEtN2Y1L1Qzu0EtD0C0ByE0EtDtCyE0C0CtAyByB0C0BtN0D0Tzu0StCtByEyCtN1L2XzutAtFtCtDtFtCtDtFtDtN1L1CzutCyEtBzytDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2SyEyDzztAtA0D0B0BtGtByCyD0AtG0A0ByB0FtGyBtBtCtBtGtB0CtD0FyBzyzytAtC0CyE0F2QtN1M1F1B2Z1V1N2Y1L1Qzu2Szz0ByC0Azz0CyD0CtG0A0CzytBtGyEzy0FzztGzzyEyDyEtGtCyByC0EyEzytC0AyEtBtDtD2QtN0A0LzuyE&cr=16356787&ir=&uref=chmm
*************************
:: "Tracing" keys deleted
:: Winsock settings cleared
*************************
C:\AdwCleaner\AdwCleaner[C1].txt - [477 bytes] - [12/04/2016 03:55:11]
C:\AdwCleaner\AdwCleaner[C2].txt - [9558 bytes] - [12/04/2016 03:59:51]
C:\AdwCleaner\AdwCleaner[S1].txt - [9363 bytes] - [12/04/2016 03:52:41]
C:\AdwCleaner\AdwCleaner[S2].txt - [9370 bytes] - [12/04/2016 03:58:17]
########## EOF - C:\AdwCleaner\AdwCleaner[C2].txt - [9777 bytes] ##########
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.0.4 (03.14.2016)
Operating System: Windows 10 Home x86
Ran by [removed] (Administrator) on Tue 04/12/2016 at 4:06:22.25
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
File System: 9
Successfully deleted: C:\Program Files\mozilla firefox\defaults\pref\itms.js (File)
Successfully deleted: C:\Users\saturn89\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.lyricsfreak.com_0.localstorage-journal (File)
Successfully deleted: C:\Users\saturn89\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.lyricsfreak.com_0.localstorage (File)
Successfully deleted: C:\WINDOWS\System32\Tasks\SlimCleaner Plus (Scheduled Scan - saturn89) (Task)
Successfully deleted: C:\WINDOWS\Tasks\SlimCleaner Plus (Scheduled Scan - saturn89).job (Task)
Successfully deleted: C:\WINDOWS\wininit.ini (File)
Successfully deleted: C:\WINDOWS\prefetch\DRIVERSUPPORT.EXE-188CDF93.pf (File)
Successfully deleted: C:\WINDOWS\prefetch\DRIVERSUPPORT.EXE-8AAF2C22.pf (File)
Successfully deleted: C:\WINDOWS\prefetch\DRIVERSUPPORT.EXE-C80DBA97.pf (File)
Registry: 0
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Tue 04/12/2016 at 4:08:28.72
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Malwarebytes Anti-Malware
www.malwarebytes.org
Scan Date: 4/12/2016
Scan Time: 4:12 AM
Logfile: mwbytes scan 4-12-16.txt
Administrator: Yes
Version: 2.2.1.1043
Malware Database: v2016.04.12.03
Rootkit Database: v2016.04.09.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled
OS: Windows 10
CPU: x86
File System: NTFS
User: saturn89
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 366123
Time Elapsed: 18 min, 29 sec
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled
Processes: 0
Good Morning
Both AdwCleaner and Junkware removal removed a lot of garbage. Your Malwarebytes log is incomplete, did it find anything and remove it ??? You may have to run it again, do it like this
Yes, the first time I ran mwb it didn't find anything. This time it found two:
Malwarebytes Anti-Malware
www.malwarebytes.org
Scan Date: 4/13/2016
Scan Time: 3:12 AM
Logfile: mwbytes scan 4-13-16.txt two.txt
Administrator: Yes
Version: 2.2.1.1043
Malware Database: v2016.04.13.02
Rootkit Database: v2016.04.09.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled
OS: Windows 10
CPU: x86
File System: NTFS
User: saturn89
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 366961
Time Elapsed: 20 min, 22 sec
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled
Processes: 0
(No malicious items detected)
Modules: 0
(No malicious items detected)
Registry Keys: 0
(No malicious items detected)
Registry Values: 0
(No malicious items detected)
Registry Data: 0
(No malicious items detected)
Folders: 0
(No malicious items detected)
Files: 2
PUP.Optional.Yontoo, C:\Users\saturn89\AppData\Roaming\Mozilla\Firefox\Profiles\d62kmg8u.default-1415672622796\prefs.js, Good: (), Bad: (user_pref("browser.startup.homepage", "http://searchinterneat-a.akamaihd.net/h?eq=U0EeCFZVBB8SRggScQANWQ9HFBhFIl1dTA1DQ1EOIQtbBxRCQAwUdQgPAA8XEwMFIk0FA18DB0VXfWFoKB8fHGZGIUtbCW4YT1FMN2tdEkwdVUY=");),Replaced,[4610347a722724121e84d58eb74e22de]
PUP.Optional.Yontoo, C:\Users\saturn89\AppData\Roaming\Mozilla\Firefox\Profiles\d62kmg8u.default-1415672622796\prefs.js, Good: (user_pref("browser.startup.homepage", "https://www.malwarebytes.org/restorebrowser/),Bad: (user_pref("browser.startup.homepage", "http://searchinterneat-a.akamaihd.net/h?eq=U0EeCFZVBB8SRggScQANWQ9HFBhFIl1dTA1DQ1EOIQtbBxRCQAwUdQgPAA8XEwMFIk0FA18DB0VXfWFoKB8fHGZGIUtbCW4YT1FMN2tdEkwdVUY=");), Replaced,[e175ab035346a6900f8e92d3fc09bc44]
Physical Sectors: 0
(No malicious items detected)
(end)
Also, here's the example of the title on the screen I see when I open Chrome:
Index of C:\Program Files\Google\Chrome\Application\49.0.2623.112\
I see something similar when I open Firefox but not MS Edge, which I never use btw.
Lets try setting Chome and FF back to defaults
I'm not sure what FRST64 is, so I ran AdwCleaner and JRT again. Adw showed no logs and JRT had this one:
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.0.4 (03.14.2016)
Operating System: Windows 10 Home x86
Ran by [removed] (Administrator) on Fri 04/15/2016 at 5:13:59.20
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
File System: 1
Successfully deleted: C:\Program Files\mozilla firefox\defaults\pref\itms.js (File)
Registry: 0
I reset Chome and Firefox as directed but it only seemed to work with Chrome, and then only if I accessed it from the taskbar, not windows key or icon on the taskbar.
FRST64 is the program you ran and posted the FRST and Additions logs
Here's the log of the aswMBR:
aswMBR version 1.0.1.2252 Copyright© 2014 AVAST Software
Run date: 2016-04-17 12:32:43
—————————–
12:32:43.668 OS Version: Windows 6.2.9200
12:32:43.668 Number of processors: 2 586 0x170A
12:32:43.670 ComputerName: SPRINGFOURTEEN UserName: saturn89
12:32:48.320 Initialize success
12:32:48.356 VM: initialized successfully
12:32:48.357 VM: Intel CPU supported
12:32:55.019 VM: disk I/O atapi.sys
12:32:57.311 AVAST engine defs: 16041700
12:40:42.727 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-2
12:40:42.732 Disk 0 Vendor: ST3250318AS CC38 Size: 238475MB BusType: 3
12:40:42.832 Disk 0 MBR read successfully
12:40:42.840 Disk 0 MBR scan
12:40:42.872 Disk 0 Windows 7 default MBR code
12:40:42.880 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 238014 MB offset 63
12:40:42.911 Disk 0 Partition 2 00 27 Hidden NTFS WinRE NTFS 450 MB offset 487454720
12:40:42.927 Disk 0 scanning sectors +488376320
12:40:43.052 Disk 0 scanning C:\WINDOWS\system32\drivers
12:40:58.129 Service scanning
12:41:28.049 Modules scanning
12:41:28.070 Disk 0 trace - called modules:
12:41:28.094 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys halmacpi.dll ataport.SYS intelide.sys PCIIDEX.SYS atapi.sys
12:41:28.105 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x888df030]
12:41:28.113 3 CLASSPNP.SYS[82af4f25] -> nt!IofCallDriver -> [0x895a0ae8]
12:41:28.123 5 ACPI.sys[85f81412] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP2T0L0-2[0x895c3030]
12:41:29.113 AVAST engine scan C:\WINDOWS
12:41:31.217 AVAST engine scan C:\WINDOWS\system32
12:44:19.817 AVAST engine scan C:\WINDOWS\system32\drivers
12:44:35.209 AVAST engine scan C:\Users\saturn89
12:49:20.639 File: C:\Users\saturn89\AppData\Local\Temp\gNHSuOaSYq.exe **INFECTED** Win32:Adware-gen [Adw]
12:49:28.392 File: C:\Users\saturn89\AppData\Local\Temp\ZYz1NFfPrQ.exe **INFECTED** Win32:Evo-gen [Susp]
12:54:04.171 AVAST engine scan C:\ProgramData
12:58:51.094 Disk 0 statistics 3540291/0/0 @ 220.89 MB/s
12:58:51.111 Scan finished successfully
12:59:37.505 Disk 0 MBR has been saved successfully to "C:\Users\saturn89\Desktop\MBR.dat"
12:59:37.512 The log file has been saved successfully to "C:\Users\saturn89\Desktop\aswMBR 4-17-16.txt"
I need to see the FRST logs, you posted it before. Farbar Recovery Scan Tool
Here are the two files:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:17-04-2016
Ran by [removed] (administrator) on SPRINGFOURTEEN (18-04-2016 00:12:23)
Running from C:\Users\[removed]\Downloads
[removed]
Platform: Microsoft Windows 10 Home Version 1511 (X86) Language: English (United States)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Ralink Technology, Corp.) C:\Program Files\Ralink\Common\RaRegistry.exe
(Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDWSCSvc.exe
() C:\Program Files\WindowsApps\Microsoft.Messaging_2.13.20000.0_x86__8wekyb3d8bbwe\SkypeHost.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Octoshape ApS) C:\Users\saturn89\AppData\Roaming\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
() C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1601.49020.0_x86__8wekyb3d8bbwe\Calculator.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Farbar) C:\Users\saturn89\Downloads\FRST(1).exe
==================== Registry (Whitelisted) ===========================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\…\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI.exe [7545088 2015-06-24] (Realtek Semiconductor)
HKLM\…\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [7139256 2016-03-23] (AVAST Software)
HKLM\…\Run: [SDTray] => C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe [4127488 2015-06-16] (Safer-Networking Ltd.)
HKLM\…\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [595480 2016-03-20] (Oracle Corporation)
HKLM\…\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [164152 2016-03-19] (Apple Inc.)
Winlogon\Notify\SDWinLogon: SDWinLogon.dll [X]
HKU\S-1-5-21-817363288-272500718-2324346864-1000\…\Run: [Octoshape Streaming Services] => C:\Users\saturn89\AppData\Roaming\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe [500016 2014-08-01] (Octoshape ApS)
HKU\S-1-5-21-817363288-272500718-2324346864-1000\…\Run: [SpybotPostWindows10UpgradeReInstall] => C:\Program Files\Common Files\AV\Spybot - Search and Destroy\Test.exe [1011200 2015-07-28] (Safer-Networking Ltd.)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShell.dll [2016-02-15] (AVAST Software)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Ralink Wireless Utility.lnk [2016-04-10]
ShortcutTarget: Ralink Wireless Utility.lnk -> (No File)
BootExecute: autocheck autochk * sdnclean.exe
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
Winsock: Catalog5 04 C:\WINDOWS\system32\NLAapi.dll [65024 2015-10-30] (Microsoft Corporation) ATTENTION: LibraryPath should be "C:\WINDOWS)\system32\NLAapi.dll"
Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [122128 2015-08-12] (Apple Inc.)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 75.75.76.76 75.75.75.75
Tcpip\..\Interfaces\{934289ba-29f1-4151-8ce2-82772a8f164b}: [DhcpNameServer] 192.168.42.129
Tcpip\..\Interfaces\{f11aaca3-239c-4af4-91c7-c1a7026d315c}: [DhcpNameServer] 75.75.76.76 75.75.75.75
ManualProxies:
Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-817363288-272500718-2324346864-1000 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_77\bin\ssv.dll [2016-03-25] (Oracle Corporation)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2016-02-15] (AVAST Software)
BHO: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_77\bin\jp2ssv.dll [2016-03-25] (Oracle Corporation)
FireFox:
========
FF ProfilePath: C:\Users\saturn89\AppData\Roaming\Mozilla\Firefox\Profiles\zfj0hjah.default-1460914718117
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF32_21_0_0_213.dll [2016-04-08] ()
FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll [2016-03-08] ()
FF Plugin: @java.com/DTPlugin,version=11.77.2 -> C:\Program Files\Java\jre1.8.0_77\bin\dtplugin\npDeployJava1.dll [2016-03-25] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.77.2 -> C:\Program Files\Java\jre1.8.0_77\bin\plugin2\npjp2.dll [2016-03-25] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-12] ( Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-02-02] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-02-02] (Google Inc.)
FF Plugin HKU\S-1-5-21-817363288-272500718-2324346864-1000: @octoshape.com/Octoshape Streaming Services,version=1.0 -> C:\Users\saturn89\AppData\Roaming\Octoshape\Octoshape Streaming Services\sua-1401100-0-npoctoshape.dll [2014-01-10] (Octoshape ApS)
FF Plugin ProgramFiles/Appdata: C:\Users\saturn89\AppData\Roaming\mozilla\plugins\npoctoshape.dll [2015-02-18] (Octoshape ApS)
FF HKLM\…\Firefox\Extensions: [[removed]] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2016-02-25]
FF HKLM\…\Firefox\Extensions: [[removed]] - C:\Program Files\AVAST Software\Avast\SafePrice\FF
FF Extension: Avast SafePrice - C:\Program Files\AVAST Software\Avast\SafePrice\FF [2016-02-25]
Chrome:
=======
CHR Profile: C:\Users\saturn89\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\saturn89\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-02-04]
CHR Extension: (Google Drive) - C:\Users\saturn89\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-10-22]
CHR Extension: (YouTube) - C:\Users\saturn89\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-09-25]
CHR Extension: (Google Search) - C:\Users\saturn89\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-10-29]
CHR Extension: (Google Docs Offline) - C:\Users\saturn89\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-03-17]
CHR Extension: (Avast Online Security) - C:\Users\saturn89\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2016-04-07]
CHR Extension: (Chrome Web Store Payments) - C:\Users\saturn89\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-04-03]
CHR Extension: (Gmail) - C:\Users\saturn89\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-03-28]
CHR HKLM\…\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2016-02-15]
==================== Services (Whitelisted) ========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [237096 2016-02-15] (AVAST Software)
R2 RalinkRegistryWriter; C:\Program Files\Ralink\Common\RaRegistry.exe [391472 2013-06-26] (Ralink Technology, Corp.)
S3 RaMediaServer; C:\Program Files\Ralink\Common\RaMediaServer.exe [1863680 2012-07-06] (Ralink) [File not signed]
S2 SDScannerService; C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe [1750712 2015-06-16] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe [2102496 2015-06-16] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files\Spybot - Search & Destroy 2\SDWSCSvc.exe [224712 2015-07-24] (Safer-Networking Ltd.)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [280376 2015-10-30] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23256 2015-10-30] (Microsoft Corporation)
===================== Drivers (Whitelisted) ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R1 AsIO; C:\WINDOWS\System32\drivers\AsIO.sys [12400 2014-05-16] ()
R2 aswHwid; C:\WINDOWS\system32\drivers\aswHwid.sys [32792 2016-02-15] (AVAST Software)
R1 aswKbd; C:\WINDOWS\system32\drivers\aswKbd.sys [35096 2016-02-25] (AVAST Software)
R2 aswMonFlt; C:\WINDOWS\system32\drivers\aswMonFlt.sys [91168 2016-03-09] (AVAST Software)
R1 aswRdr; C:\WINDOWS\system32\drivers\aswRdr2.sys [91232 2016-02-15] (AVAST Software)
R0 aswRvrt; C:\WINDOWS\system32\Drivers\aswRvrt.sys [58776 2016-02-15] (AVAST Software)
R1 aswSnx; C:\WINDOWS\system32\drivers\aswSnx.sys [816304 2016-03-09] (AVAST Software)
R1 aswSP; C:\WINDOWS\system32\drivers\aswSP.sys [447848 2016-02-23] (AVAST Software)
R2 aswStm; C:\WINDOWS\system32\drivers\aswStm.sys [127432 2016-02-15] (AVAST Software)
R0 aswVmm; C:\WINDOWS\system32\Drivers\aswVmm.sys [221240 2016-02-15] (AVAST Software)
S3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [170200 2016-04-13] (Malwarebytes)
R3 MTsensor; C:\WINDOWS\system32\DRIVERS\ASACPI.sys [6504 2014-05-16] ()
R3 netr28u; C:\WINDOWS\System32\drivers\netr28u.sys [1800704 2015-10-30] (MediaTek Inc.)
S3 WdBoot; C:\WINDOWS\system32\drivers\WdBoot.sys [37400 2015-10-30] (Microsoft Corporation)
S3 WdFilter; C:\WINDOWS\system32\drivers\WdFilter.sys [246104 2015-10-30] (Microsoft Corporation)
S3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [98648 2015-10-30] (Microsoft Corporation)
S3 WUDFWpdMtp; C:\WINDOWS\system32\DRIVERS\WUDFRd.sys [163328 2015-10-30] (Microsoft Corporation)
U3 idsvc; no ImagePath
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2016-04-18 00:10 - 2016-04-18 00:10 - 00001496 _____ C:\Users\saturn89\Desktop\FRST(1) - Shortcut.lnk
2016-04-18 00:08 - 2016-04-18 00:11 - 01726464 _____ (Farbar) C:\Users\saturn89\Downloads\FRST(1).exe
2016-04-17 12:32 - 2016-04-17 12:32 - 05198336 _____ (AVAST Software) C:\Users\saturn89\Downloads\aswMBR(3).exe
2016-04-15 05:06 - 2016-04-15 05:06 - 03677760 _____ C:\Users\saturn89\Downloads\AdwCleaner.exe
2016-04-12 12:24 - 2016-04-01 22:26 - 00526336 _____ (Microsoft Corporation) C:\WINDOWS\system32\PhoneProviders.dll
2016-04-12 12:24 - 2016-04-01 22:22 - 00390144 _____ (Microsoft Corporation) C:\WINDOWS\system32\tileobjserver.dll
2016-04-12 12:24 - 2016-04-01 22:20 - 00826368 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll
2016-04-12 12:24 - 2016-04-01 22:17 - 00796672 _____ (Microsoft Corporation) C:\WINDOWS\system32\RDXService.dll
2016-04-12 12:24 - 2016-04-01 22:14 - 03197440 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_nt.dll
2016-04-12 12:24 - 2016-04-01 22:12 - 01887744 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll
2016-04-12 12:24 - 2016-04-01 22:11 - 01524736 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.dll
2016-04-12 12:24 - 2016-04-01 22:10 - 02871296 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettingsThresholdAdminFlowUI.dll
2016-04-12 12:24 - 2016-04-01 22:05 - 01074688 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Shell.dll
2016-04-12 12:24 - 2016-03-29 04:38 - 05797216 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2016-04-12 12:24 - 2016-03-29 04:37 - 01862008 _____ C:\WINDOWS\system32\CoreUIComponents.dll
2016-04-12 12:24 - 2016-03-29 04:36 - 01820512 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ntfs.sys
2016-04-12 12:24 - 2016-03-29 04:13 - 00986976 _____ (Microsoft Corporation) C:\WINDOWS\system32\LicenseManager.dll
2016-04-12 12:24 - 2016-03-29 03:44 - 00502104 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetSetupEngine.dll
2016-04-12 12:24 - 2016-03-29 03:32 - 00253088 _____ (Microsoft Corporation) C:\WINDOWS\system32\LockAppHost.exe
2016-04-12 12:24 - 2016-03-29 03:24 - 00294752 _____ (Microsoft Corporation) C:\WINDOWS\system32\msv1_0.dll
2016-04-12 12:24 - 2016-03-29 01:56 - 00415232 _____ (Microsoft Corporation) C:\WINDOWS\system32\StoreAgent.dll
2016-04-12 12:24 - 2016-03-29 01:43 - 00358400 _____ (Microsoft Corporation) C:\WINDOWS\system32\AccountsRt.dll
2016-04-12 12:24 - 2016-03-29 01:43 - 00237568 _____ (Microsoft Corporation) C:\WINDOWS\system32\RDXTaskFactory.dll
2016-04-12 12:24 - 2016-03-29 01:41 - 00538624 _____ (Microsoft Corporation) C:\WINDOWS\system32\XblAuthManager.dll
2016-04-12 12:24 - 2016-03-29 01:37 - 01444352 _____ (Microsoft Corporation) C:\WINDOWS\system32\SRHInproc.dll
2016-04-12 12:24 - 2016-03-29 01:37 - 00792064 _____ (Microsoft Corporation) C:\WINDOWS\system32\kerberos.dll
2016-04-12 12:24 - 2016-03-29 01:36 - 00649728 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.dll
2016-04-12 12:24 - 2016-03-29 01:35 - 00354304 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetSetupShim.dll
2016-04-12 12:24 - 2016-03-29 01:34 - 01152512 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys
2016-04-12 12:24 - 2016-03-29 01:34 - 00711680 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapControlCore.dll
2016-04-12 12:24 - 2016-03-29 01:32 - 01588224 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml3.dll
2016-04-12 12:24 - 2016-03-29 01:30 - 01139712 _____ (Microsoft Corporation) C:\WINDOWS\system32\UIAutomationCore.dll
2016-04-12 12:24 - 2016-03-29 01:28 - 01944576 _____ (Microsoft Corporation) C:\WINDOWS\system32\InputService.dll
2016-04-12 12:24 - 2016-03-29 01:28 - 00764928 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Cred.dll
2016-04-12 12:24 - 2016-03-29 01:14 - 02975232 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys
2016-04-12 12:24 - 2016-03-29 01:14 - 01072128 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Web.Http.dll
2016-04-12 12:24 - 2016-03-29 01:10 - 03671040 _____ (Microsoft Corporation) C:\WINDOWS\system32\msi.dll
2016-04-12 12:24 - 2016-03-29 01:06 - 00813056 _____ (Microsoft Corporation) C:\WINDOWS\system32\dosvc.dll
2016-04-12 12:24 - 2016-03-29 01:05 - 01894912 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2016-04-12 12:24 - 2016-03-29 01:05 - 01626624 _____ (Microsoft Corporation) C:\WINDOWS\system32\dwmcore.dll
2016-04-12 12:24 - 2016-03-29 01:05 - 01500672 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2016-04-12 12:24 - 2016-03-29 01:02 - 02229760 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2016-04-12 12:24 - 2016-03-29 01:01 - 13018624 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll
2016-04-12 12:24 - 2016-03-29 00:58 - 01799680 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Logon.dll
2016-04-12 12:24 - 2016-03-29 00:51 - 09918976 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll
2016-04-12 12:24 - 2016-03-29 00:49 - 05202944 _____ (Microsoft Corporation) C:\WINDOWS\system32\BingMaps.dll
2016-04-12 12:24 - 2016-03-29 00:49 - 01085952 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2016-04-12 12:24 - 2016-03-29 00:41 - 12125184 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2016-04-12 12:24 - 2016-03-29 00:38 - 18673664 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll
2016-04-12 12:24 - 2016-03-29 00:38 - 02798080 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.dll
2016-04-12 12:24 - 2016-03-29 00:37 - 19340800 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2016-04-12 12:24 - 2016-03-29 00:36 - 02722816 _____ (Microsoft Corporation) C:\WINDOWS\system32\esent.dll
2016-04-12 12:24 - 2016-03-29 00:27 - 05662208 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll
2016-04-12 12:24 - 2016-03-29 00:25 - 00712704 _____ (Microsoft Corporation) C:\WINDOWS\system32\RemoteNaturalLanguage.dll
2016-04-12 12:23 - 2016-04-01 23:17 - 00297072 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiodg.exe
2016-04-12 12:23 - 2016-04-01 23:14 - 00757192 _____ (Microsoft Corporation) C:\WINDOWS\system32\iuilp.dll
2016-04-12 12:23 - 2016-04-01 23:14 - 00613112 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Internal.Shell.Broker.dll
2016-04-12 12:23 - 2016-04-01 23:14 - 00305296 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettingsAdminFlows.exe
2016-04-12 12:23 - 2016-04-01 22:30 - 00118784 _____ (Microsoft Corporation) C:\WINDOWS\system32\VEStoreEventHandlers.dll
2016-04-12 12:23 - 2016-04-01 22:29 - 00083968 _____ (Microsoft Corporation) C:\WINDOWS\system32\VEDataLayerHelpers.dll
2016-04-12 12:23 - 2016-04-01 22:25 - 00239104 _____ (Microsoft Corporation) C:\WINDOWS\system32\NotificationObjFactory.dll
2016-04-12 12:23 - 2016-04-01 22:23 - 00219648 _____ (Microsoft Corporation) C:\WINDOWS\system32\VEEventDispatcher.dll
2016-04-12 12:23 - 2016-04-01 22:20 - 00738816 _____ (Microsoft Corporation) C:\WINDOWS\system32\SharedStartModel.dll
2016-04-12 12:23 - 2016-04-01 22:08 - 02193408 _____ (Microsoft Corporation) C:\WINDOWS\system32\actxprxy.dll
2016-04-12 12:23 - 2016-03-29 04:41 - 00875992 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi
2016-04-12 12:23 - 2016-03-29 04:41 - 00771120 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe
2016-04-12 12:23 - 2016-03-29 04:41 - 00228696 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\sdbus.sys
2016-04-12 12:23 - 2016-03-29 04:38 - 01051584 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi
2016-04-12 12:23 - 2016-03-29 04:38 - 00927072 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe
2016-04-12 12:23 - 2016-03-29 04:33 - 00084216 _____ (Microsoft Corporation) C:\WINDOWS\system32\omadmapi.dll
2016-04-12 12:23 - 2016-03-29 04:28 - 00535080 _____ (Microsoft Corporation) C:\WINDOWS\system32\dnsapi.dll
2016-04-12 12:23 - 2016-03-29 04:21 - 00922456 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ndis.sys
2016-04-12 12:23 - 2016-03-29 04:20 - 00856928 _____ (Microsoft Corporation) C:\WINDOWS\system32\SecConfig.efi
2016-04-12 12:23 - 2016-03-29 04:19 - 00296488 _____ (Microsoft Corporation) C:\WINDOWS\system32\policymanager.dll
2016-04-12 12:23 - 2016-03-29 03:44 - 00084832 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetSetupApi.dll
2016-04-12 12:23 - 2016-03-29 03:41 - 00203104 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ufx01000.sys
2016-04-12 12:23 - 2016-03-29 03:41 - 00051128 _____ (Microsoft Corporation) C:\WINDOWS\system32\SensorsNativeApi.dll
2016-04-12 12:23 - 2016-03-29 03:34 - 00153952 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dumpsd.sys
2016-04-12 12:23 - 2016-03-29 03:26 - 00073872 _____ (Microsoft Corporation) C:\WINDOWS\system32\srvcli.dll
2016-04-12 12:23 - 2016-03-29 03:25 - 00056320 _____ (Microsoft Corporation) C:\WINDOWS\system32\wkscli.dll
2016-04-12 12:23 - 2016-03-29 03:24 - 00063008 _____ (Microsoft Corporation) C:\WINDOWS\system32\easinvoker.exe
2016-04-12 12:23 - 2016-03-29 03:23 - 00069744 _____ (Microsoft Corporation) C:\WINDOWS\system32\netapi32.dll
2016-04-12 12:23 - 2016-03-29 03:01 - 00541304 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontdrvhost.exe
2016-04-12 12:23 - 2016-03-29 02:46 - 01861984 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tcpip.sys
2016-04-12 12:23 - 2016-03-29 02:46 - 00771424 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\http.sys
2016-04-12 12:23 - 2016-03-29 02:42 - 00287072 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBXHCI.SYS
2016-04-12 12:23 - 2016-03-29 02:30 - 00161792 _____ (Microsoft Corporation) C:\WINDOWS\system32\msorcl32.dll
2016-04-12 12:23 - 2016-03-29 02:30 - 00074752 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapsCSP.dll
2016-04-12 12:23 - 2016-03-29 02:28 - 00018944 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\xinputhid.sys
2016-04-12 12:23 - 2016-03-29 02:20 - 00080384 _____ (Microsoft Corporation) C:\WINDOWS\system32\SensorsNativeApi.V2.dll
2016-04-12 12:23 - 2016-03-29 02:20 - 00073728 _____ (Microsoft Corporation) C:\WINDOWS\system32\policymanagerprecheck.dll
2016-04-12 12:23 - 2016-03-29 02:20 - 00033792 _____ (Microsoft Corporation) C:\WINDOWS\system32\dmenterprisediagnostics.dll
2016-04-12 12:23 - 2016-03-29 02:20 - 00026112 _____ (Microsoft Corporation) C:\WINDOWS\system32\wsdchngr.dll
2016-04-12 12:23 - 2016-03-29 02:19 - 00037376 _____ (Adobe Systems) C:\WINDOWS\system32\atmlib.dll
2016-04-12 12:23 - 2016-03-29 02:19 - 00010240 _____ (Microsoft Corporation) C:\WINDOWS\system32\oleacchooks.dll
2016-04-12 12:23 - 2016-03-29 02:16 - 00093696 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontsub.dll
2016-04-12 12:23 - 2016-03-29 02:14 - 00059904 _____ (Microsoft Corporation) C:\WINDOWS\system32\fveskybackup.dll
2016-04-12 12:23 - 2016-03-29 02:14 - 00023552 _____ (Microsoft Corporation) C:\WINDOWS\system32\mapsupdatetask.dll
2016-04-12 12:23 - 2016-03-29 02:13 - 00022528 _____ (Microsoft Corporation) C:\WINDOWS\system32\LicenseManagerShellext.exe
2016-04-12 12:23 - 2016-03-29 02:12 - 00065536 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininetlui.dll
2016-04-12 12:23 - 2016-03-29 02:12 - 00045568 _____ (Microsoft Corporation) C:\WINDOWS\system32\jsproxy.dll
2016-04-12 12:23 - 2016-03-29 02:11 - 00161280 _____ (Microsoft Corporation) C:\WINDOWS\system32\InstallAgent.exe
2016-04-12 12:23 - 2016-03-29 02:11 - 00061440 _____ (Microsoft Corporation) C:\WINDOWS\system32\samlib.dll
2016-04-12 12:23 - 2016-03-29 02:11 - 00059904 _____ (Microsoft Corporation) C:\WINDOWS\system32\MosStorage.dll
2016-04-12 12:23 - 2016-03-29 02:11 - 00043520 _____ (Microsoft Corporation) C:\WINDOWS\system32\browcli.dll
2016-04-12 12:23 - 2016-03-29 02:09 - 00087040 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapsBtSvc.dll
2016-04-12 12:23 - 2016-03-29 02:09 - 00077824 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\serial.sys
2016-04-12 12:23 - 2016-03-29 02:09 - 00030208 _____ (Microsoft Corporation) C:\WINDOWS\system32\tbauth.dll
2016-04-12 12:23 - 2016-03-29 02:08 - 00118272 _____ (Microsoft Corporation) C:\WINDOWS\system32\mtxoci.dll
2016-04-12 12:23 - 2016-03-29 02:08 - 00085504 _____ (Microsoft Corporation) C:\WINDOWS\system32\FontProvider.dll
2016-04-12 12:23 - 2016-03-29 02:06 - 00137728 _____ (Microsoft Corporation) C:\WINDOWS\system32\dafBth.dll
2016-04-12 12:23 - 2016-03-29 02:06 - 00066560 _____ (Microsoft Corporation) C:\WINDOWS\system32\tzautoupdate.dll
2016-04-12 12:23 - 2016-03-29 02:06 - 00022528 _____ (Microsoft Corporation) C:\WINDOWS\system32\TokenBrokerCookies.exe
2016-04-12 12:23 - 2016-03-29 02:05 - 00088576 _____ (Microsoft Corporation) C:\WINDOWS\system32\BdeHdCfgLib.dll
2016-04-12 12:23 - 2016-03-29 02:05 - 00074240 _____ (Microsoft Corporation) C:\WINDOWS\system32\browserbroker.dll
2016-04-12 12:23 - 2016-03-29 02:05 - 00071680 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppxSysprep.dll
2016-04-12 12:23 - 2016-03-29 02:05 - 00052736 _____ (Microsoft Corporation) C:\WINDOWS\system32\OnDemandConnRouteHelper.dll
2016-04-12 12:23 - 2016-03-29 02:05 - 00050688 _____ (Microsoft Corporation) C:\WINDOWS\system32\moshost.dll
2016-04-12 12:23 - 2016-03-29 02:05 - 00028160 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuautoappupdate.dll
2016-04-12 12:23 - 2016-03-29 02:04 - 00103936 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Devices.dll
2016-04-12 12:23 - 2016-03-29 02:03 - 00070656 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppCapture.dll
2016-04-12 12:23 - 2016-03-29 02:02 - 00303104 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\atmfd.dll
2016-04-12 12:23 - 2016-03-29 02:02 - 00107520 _____ (Microsoft Corporation) C:\WINDOWS\system32\browser.dll
2016-04-12 12:23 - 2016-03-29 02:00 - 00193536 _____ (Microsoft Corporation) C:\WINDOWS\system32\DAFWSD.dll
2016-04-12 12:23 - 2016-03-29 01:59 - 00203264 _____ (Microsoft Corporation) C:\WINDOWS\system32\moshostcore.dll
2016-04-12 12:23 - 2016-03-29 01:55 - 00142336 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetSetupSvc.dll
2016-04-12 12:23 - 2016-03-29 01:54 - 00497664 _____ (Microsoft Corporation) C:\WINDOWS\system32\StorSvc.dll
2016-04-12 12:23 - 2016-03-29 01:53 - 00424448 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\nwifi.sys
2016-04-12 12:23 - 2016-03-29 01:53 - 00323072 _____ (Microsoft Corporation) C:\WINDOWS\system32\oleacc.dll
2016-04-12 12:23 - 2016-03-29 01:53 - 00193024 _____ (Microsoft Corporation) C:\WINDOWS\system32\credprovhost.dll
2016-04-12 12:23 - 2016-03-29 01:53 - 00150016 _____ (Microsoft Corporation) C:\WINDOWS\system32\storewuauth.dll
2016-04-12 12:23 - 2016-03-29 01:52 - 00464896 _____ (Microsoft Corporation) C:\WINDOWS\system32\enterprisecsps.dll
2016-04-12 12:23 - 2016-03-29 01:52 - 00306176 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieproxy.dll
2016-04-12 12:23 - 2016-03-29 01:52 - 00241664 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\portcls.sys
2016-04-12 12:23 - 2016-03-29 01:52 - 00222720 _____ (Microsoft Corporation) C:\WINDOWS\system32\dnsrslvr.dll
2016-04-12 12:23 - 2016-03-29 01:52 - 00141824 _____ (Microsoft Corporation) C:\WINDOWS\system32\easwrt.dll
2016-04-12 12:23 - 2016-03-29 01:51 - 00334336 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcastdvr.exe
2016-04-12 12:23 - 2016-03-29 01:49 - 00246272 _____ (Microsoft Corporation) C:\WINDOWS\system32\profsvc.dll
2016-04-12 12:23 - 2016-03-29 01:48 - 00346624 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapConfiguration.dll
2016-04-12 12:23 - 2016-03-29 01:47 - 00239616 _____ (Microsoft Corporation) C:\WINDOWS\system32\SensorService.dll
2016-04-12 12:23 - 2016-03-29 01:46 - 00130560 _____ (Microsoft Corporation) C:\WINDOWS\system32\mdmmigrator.dll
2016-04-12 12:23 - 2016-03-29 01:44 - 00498176 _____ (Microsoft Corporation) C:\WINDOWS\system32\MessagingDataModel2.dll
2016-04-12 12:23 - 2016-03-29 01:44 - 00497152 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdiWiFi.sys
2016-04-12 12:23 - 2016-03-29 01:42 - 00250880 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2016-04-12 12:23 - 2016-03-29 01:41 - 00129024 _____ (Microsoft Corporation) C:\WINDOWS\system32\AboveLockAppHost.dll
2016-04-12 12:23 - 2016-03-29 01:40 - 00445952 _____ (Microsoft Corporation) C:\WINDOWS\system32\PsmServiceExtHost.dll
2016-04-12 12:23 - 2016-03-29 01:39 - 00564224 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSDApi.dll
2016-04-12 12:23 - 2016-03-29 01:39 - 00496128 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Security.Authentication.Web.Core.dll
2016-04-12 12:23 - 2016-03-29 01:39 - 00350720 _____ (Microsoft Corporation) C:\WINDOWS\system32\CredProvDataModel.dll
2016-04-12 12:23 - 2016-03-29 01:38 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\JpMapControl.dll
2016-04-12 12:23 - 2016-03-29 01:38 - 00609280 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapsStore.dll
2016-04-12 12:23 - 2016-03-29 01:37 - 00799744 _____ (Microsoft Corporation) C:\WINDOWS\system32\SRH.dll
2016-04-12 12:23 - 2016-03-29 01:36 - 00453632 _____ (Microsoft Corporation) C:\WINDOWS\system32\bisrv.dll
2016-04-12 12:23 - 2016-03-29 01:34 - 00784896 _____ (Microsoft Corporation) C:\WINDOWS\system32\NMAA.dll
2016-04-12 12:23 - 2016-03-29 01:34 - 00682496 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Input.Inking.dll
2016-04-12 12:23 - 2016-03-29 01:32 - 00951808 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwansvc.dll
2016-04-12 12:23 - 2016-03-29 01:32 - 00854528 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Bluetooth.dll
2016-04-12 12:23 - 2016-03-29 01:32 - 00638464 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Networking.dll
2016-04-12 12:23 - 2016-03-29 01:32 - 00601600 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32spl.dll
2016-04-12 12:23 - 2016-03-29 01:31 - 01117184 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Speech.dll
2016-04-12 12:23 - 2016-03-29 01:31 - 00705536 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll
2016-04-12 12:23 - 2016-03-29 01:29 - 00114176 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dfsc.sys
2016-04-12 12:23 - 2016-03-29 01:27 - 00245760 _____ (Microsoft Corporation) C:\WINDOWS\system32\TextInputFramework.dll
2016-04-12 12:23 - 2016-03-29 01:27 - 00162816 _____ C:\WINDOWS\system32\MTF.dll
2016-04-12 12:23 - 2016-03-29 01:27 - 00133632 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Core.TextInput.dll
2016-04-12 12:23 - 2016-03-29 01:27 - 00083456 _____ (Microsoft Corporation) C:\WINDOWS\system32\InputLocaleManager.dll
2016-04-12 12:23 - 2016-03-29 01:26 - 00192512 _____ (Microsoft Corporation) C:\WINDOWS\system32\fveapibase.dll
2016-04-12 12:23 - 2016-03-29 01:26 - 00154112 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettings.DeviceEncryptionHandlers.dll
2016-04-12 12:23 - 2016-03-29 01:25 - 00110080 _____ (Microsoft Corporation) C:\WINDOWS\system32\BitLockerDeviceEncryption.exe
2016-04-12 12:23 - 2016-03-29 01:23 - 00777728 _____ (Microsoft Corporation) C:\WINDOWS\system32\MsSpellCheckingFacility.dll
2016-04-12 12:23 - 2016-03-29 01:22 - 00638464 _____ (Microsoft Corporation) C:\WINDOWS\system32\TokenBroker.dll
2016-04-12 12:23 - 2016-03-29 01:18 - 00265216 _____ (Microsoft Corporation) C:\WINDOWS\system32\fveui.dll
2016-04-12 12:23 - 2016-03-29 01:13 - 00592384 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Web.dll
2016-04-12 12:23 - 2016-03-29 01:07 - 00359936 _____ (Microsoft Corporation) C:\WINDOWS\system32\dmenrollengine.dll
2016-04-12 12:23 - 2016-03-29 01:06 - 00151040 _____ (Microsoft Corporation) C:\WINDOWS\system32\mdmregistration.dll
2016-04-12 12:23 - 2016-03-29 01:06 - 00141824 _____ (Microsoft Corporation) C:\WINDOWS\system32\enrollmentapi.dll
2016-04-12 12:23 - 2016-03-29 01:06 - 00106496 _____ (Microsoft Corporation) C:\WINDOWS\system32\dmcsps.dll
2016-04-12 12:23 - 2016-03-29 01:05 - 00450560 _____ (Microsoft Corporation) C:\WINDOWS\system32\SyncController.dll
2016-04-12 12:23 - 2016-03-29 01:04 - 00204800 _____ (Microsoft Corporation) C:\WINDOWS\system32\accountaccessor.dll
2016-04-12 12:23 - 2016-03-29 01:00 - 06297088 _____ (Microsoft Corporation) C:\WINDOWS\system32\mos.dll
2016-04-12 12:23 - 2016-03-29 00:55 - 00614912 _____ (Microsoft Corporation) C:\WINDOWS\system32\fveapi.dll
2016-04-12 12:23 - 2016-03-29 00:46 - 00307712 _____ (Microsoft Corporation) C:\WINDOWS\system32\bdesvc.dll
2016-04-12 12:23 - 2016-03-29 00:43 - 00521728 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Networking.Connectivity.dll
2016-04-12 12:23 - 2016-03-29 00:42 - 00705024 _____ (Microsoft Corporation) C:\WINDOWS\system32\samsrv.dll
2016-04-12 12:23 - 2016-03-29 00:36 - 00294912 _____ (Microsoft Corporation) C:\WINDOWS\system32\ncbservice.dll
2016-04-12 12:23 - 2016-03-29 00:32 - 00742400 _____ (Microsoft Corporation) C:\WINDOWS\system32\IKEEXT.DLL
2016-04-12 12:23 - 2016-03-29 00:30 - 00782336 _____ (Microsoft Corporation) C:\WINDOWS\system32\fvewiz.dll
2016-04-12 12:23 - 2016-03-29 00:25 - 00554496 _____ (Microsoft Corporation) C:\WINDOWS\system32\BFE.DLL
2016-04-12 12:23 - 2016-03-29 00:25 - 00269824 _____ (Microsoft Corporation) C:\WINDOWS\system32\FWPUCLNT.DLL
2016-04-12 12:23 - 2016-03-29 00:24 - 00310272 _____ (Microsoft Corporation) C:\WINDOWS\system32\fvecpl.dll
2016-04-12 12:23 - 2016-03-29 00:21 - 00055808 _____ (Microsoft Corporation) C:\WINDOWS\system32\basesrv.dll
2016-04-12 03:51 - 2016-04-15 05:07 - 00000000 ____D C:\AdwCleaner
2016-04-12 03:05 - 2016-04-15 05:13 - 00001456 _____ C:\Users\saturn89\Desktop\JRT - Shortcut.lnk
2016-04-12 03:05 - 2016-04-12 04:06 - 01610352 _____ (Malwarebytes) C:\Users\saturn89\Downloads\JRT.exe
2016-04-12 03:02 - 2016-04-15 05:20 - 00001529 _____ C:\Users\saturn89\Desktop\AdwCleaner - Shortcut.lnk
2016-04-12 02:21 - 2016-04-12 04:36 - 00000000 ____D C:\Program Files\Mozilla Firefox
2016-04-10 03:41 - 2016-04-10 03:41 - 00000258 __RSH C:\ProgramData\ntuser.pol
2016-04-10 01:37 - 2016-04-10 01:39 - 00039251 _____ C:\Users\saturn89\Downloads\Addition.txt
2016-04-10 01:36 - 2016-04-18 00:12 - 00011925 _____ C:\Users\saturn89\Downloads\FRST.txt
2016-04-10 01:35 - 2016-04-18 00:12 - 00000000 ____D C:\FRST
2016-04-10 01:34 - 2016-04-10 01:35 - 01725440 _____ (Farbar) C:\Users\saturn89\Downloads\FRST.exe
2016-04-10 00:56 - 2016-04-10 00:56 - 05198336 _____ (AVAST Software) C:\Users\saturn89\Downloads\aswMBR(2).exe
2016-04-10 00:55 - 2016-04-10 00:55 - 05198336 _____ (AVAST Software) C:\Users\saturn89\Downloads\aswMBR(1).exe
2016-04-10 00:52 - 2016-04-10 00:52 - 05198336 _____ (AVAST Software) C:\Users\saturn89\Downloads\aswMBR.exe
2016-04-10 00:46 - 2016-04-10 00:46 - 00009218 _____ C:\mwbytes scan 4-10-16.txt
2016-04-09 02:37 - 2016-04-09 02:37 - 00000000 ____D C:\WINDOWS\system32\SSL
2016-04-09 02:35 - 2016-04-09 02:35 - 04282368 _____ C:\Users\saturn89\Downloads\Behringer_guitar_link_serial_number.iso
2016-04-08 03:20 - 2016-04-08 03:20 - 05934784 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerInstaller.exe
2016-03-28 12:23 - 2016-04-10 03:43 - 00001818 _____ C:\Users\Public\Desktop\iTunes.lnk
2016-03-28 12:23 - 2016-03-28 12:23 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2016-03-28 12:22 - 2016-03-28 12:23 - 00000000 ____D C:\Program Files\iTunes
2016-03-28 12:22 - 2016-03-28 12:22 - 00000000 ____D C:\Program Files\iPod
2016-03-25 13:10 - 2016-03-25 13:10 - 00007078 _____ C:\Users\saturn89\Downloads\CourtOrderInfo (1).pdf
2016-03-25 01:44 - 2016-03-25 01:44 - 00000000 ____D C:\Program Files\Common Files\Java
2016-03-24 09:32 - 2016-04-10 03:43 - 00002622 _____ C:\Users\Public\Desktop\Skype.lnk
2016-03-24 09:32 - 2016-03-24 09:32 - 00000000 ___RD C:\Program Files\Skype
2016-03-24 09:32 - 2016-03-24 09:32 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2016-03-24 09:32 - 2016-03-24 09:32 - 00000000 ____D C:\Program Files\Common Files\Skype
2016-03-23 02:06 - 2016-03-23 02:06 - 01117036 _____ C:\Users\saturn89\Downloads\PTO_PT_Hourly_Guide.PDF
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2016-04-17 23:25 - 2014-05-01 21:06 - 00000924 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2016-04-17 23:20 - 2014-05-23 08:58 - 00000830 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2016-04-17 20:45 - 2014-05-01 21:06 - 00000920 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2016-04-17 20:44 - 2015-12-25 20:08 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2016-04-17 17:47 - 2015-10-30 00:13 - 00262144 ___SH C:\WINDOWS\system32\config\BBI
2016-04-17 12:38 - 2014-11-10 21:23 - 00000000 ____D C:\Users\saturn89\Desktop\Old Firefox Data
2016-04-17 02:46 - 2015-12-25 19:52 - 00988244 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2016-04-17 02:46 - 2015-10-30 00:47 - 00000000 ____D C:\WINDOWS\INF
2016-04-17 00:42 - 2015-10-30 00:48 - 00000000 ____D C:\WINDOWS\rescache
2016-04-17 00:03 - 2015-10-30 00:48 - 00000000 ____D C:\WINDOWS\AppReadiness
2016-04-15 23:47 - 2015-10-30 00:48 - 00000000 ___HD C:\Program Files\WindowsApps
2016-04-14 00:34 - 2015-12-25 19:53 - 00000000 ____D C:\Users\saturn89
2016-04-13 11:58 - 2015-12-25 19:48 - 00193080 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2016-04-13 04:45 - 2015-10-30 00:48 - 00000000 ____D C:\WINDOWS\system32\WinBioPlugIns
2016-04-13 04:45 - 2015-10-30 00:48 - 00000000 ____D C:\WINDOWS\system32\appraiser
2016-04-13 04:45 - 2015-10-30 00:48 - 00000000 ____D C:\WINDOWS\PolicyDefinitions
2016-04-13 04:45 - 2015-10-30 00:48 - 00000000 ____D C:\WINDOWS\bcastdvr
2016-04-13 04:28 - 2015-10-30 00:39 - 00000000 ____D C:\WINDOWS\CbsTemp
2016-04-13 04:25 - 2014-05-02 07:05 - 00000000 ____D C:\WINDOWS\system32\MRT
2016-04-13 04:16 - 2014-05-02 07:05 - 132539272 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2016-04-13 03:33 - 2015-08-06 21:05 - 00000000 ____D C:\Users\saturn89\AppData\Local\Packages
2016-04-13 03:10 - 2015-07-17 19:32 - 00170200 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2016-04-12 04:36 - 2014-05-01 20:59 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2016-04-12 02:32 - 2015-08-06 20:57 - 00002212 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2016-04-12 02:32 - 2014-05-01 21:06 - 00002224 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2016-04-10 03:43 - 2016-02-25 08:33 - 00002078 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast Pro Antivirus.lnk
2016-04-10 03:43 - 2016-02-25 08:33 - 00002072 _____ C:\Users\Public\Desktop\Avast Pro Antivirus.lnk
2016-04-10 03:43 - 2016-02-25 08:33 - 00001281 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast SafeZone Browser.lnk
2016-04-10 03:43 - 2016-02-25 08:33 - 00001275 _____ C:\Users\Public\Desktop\Avast SafeZone Browser.lnk
2016-04-10 03:43 - 2016-02-18 15:03 - 00002523 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk
2016-04-10 03:43 - 2016-02-05 00:16 - 00001896 _____ C:\Users\Public\Desktop\AirDroid.lnk
2016-04-10 03:43 - 2015-12-26 03:08 - 00002190 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D; Start Center.lnk
2016-04-10 03:43 - 2015-12-26 03:08 - 00002184 _____ C:\Users\Public\Desktop\Spybot-S&D; Start Center.lnk
2016-04-10 03:43 - 2015-12-25 19:58 - 00001475 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2016-04-10 03:43 - 2015-08-06 21:11 - 00002372 _____ C:\Users\saturn89\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2016-04-10 03:43 - 2015-07-17 19:31 - 00001125 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2016-04-10 03:43 - 2014-12-01 02:37 - 00000792 _____ C:\Users\Public\Desktop\Asoftech Data Recovery.lnk
2016-04-10 03:43 - 2014-05-21 06:06 - 00001924 _____ C:\Users\Public\Desktop\Generic Trader.lnk
2016-04-10 03:43 - 2014-05-01 20:59 - 00001071 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2016-04-10 03:43 - 2014-05-01 20:59 - 00001065 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2016-04-10 03:42 - 2014-10-16 02:51 - 00000953 _____ C:\Users\saturn89\Desktop\Zen Bound 2.lnk
2016-04-10 03:42 - 2014-10-16 02:46 - 00000896 _____ C:\Users\saturn89\Desktop\Voxatron.lnk
2016-04-09 02:39 - 2009-07-13 21:37 - 00000000 ____D C:\WINDOWS\system32\GroupPolicy
2016-04-06 13:32 - 2015-10-30 00:49 - 00829944 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerApp.exe
2016-04-06 13:32 - 2015-10-30 00:49 - 00176632 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerCPLApp.cpl
2016-04-03 05:58 - 2015-07-17 19:31 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2016-04-03 05:58 - 2015-07-17 19:31 - 00000000 ____D C:\Program Files\Malwarebytes Anti-Malware
2016-03-29 05:07 - 2014-05-01 23:09 - 00400302 __RSH C:\bootmgr
2016-03-28 12:22 - 2016-02-18 15:03 - 00000000 ____D C:\Program Files\Common Files\Apple
2016-03-25 01:45 - 2014-10-16 22:16 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2016-03-25 01:45 - 2014-10-16 22:16 - 00000000 ____D C:\Program Files\Java
2016-03-25 01:45 - 2014-05-01 21:25 - 00000000 ____D C:\ProgramData\Oracle
2016-03-25 01:44 - 2015-09-02 23:40 - 00000000 ____D C:\Users\saturn89\.oracle_jre_usage
2016-03-25 01:44 - 2014-10-16 22:16 - 00095808 _____ (Oracle Corporation) C:\WINDOWS\system32\WindowsAccessBridge.dll
2016-03-24 09:32 - 2014-09-15 23:17 - 00000000 ____D C:\Users\saturn89\AppData\Roaming\Skype
2016-03-24 09:32 - 2014-09-15 23:16 - 00000000 ____D C:\ProgramData\Skype
==================== Files in the root of some directories =======
2015-07-13 11:08 - 2015-07-28 02:43 - 0007602 _____ () C:\Users\saturn89\AppData\Local\Resmon.ResmonCfg
2015-02-19 11:22 - 2015-02-19 11:22 - 0000000 _____ () C:\Users\saturn89\AppData\Local\{2E71F82C-79B5-4433-BBF8-8DBFF178EC02}
2015-01-12 13:11 - 2015-01-12 13:11 - 0000000 _____ () C:\Users\saturn89\AppData\Local\{35B7639C-412C-4707-899D-0B61CD44CDAD}
2015-06-20 12:33 - 2015-06-20 12:33 - 0000000 _____ () C:\Users\saturn89\AppData\Local\{FB45FF64-DE29-4703-9E15-C0324C817427}
2015-12-25 19:50 - 2015-12-25 19:50 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
Some files in TEMP:
====================
C:\Users\saturn89\AppData\Local\Temp\dnp6txih.dll
C:\Users\saturn89\AppData\Local\Temp\gNHSuOaSYq.exe
C:\Users\saturn89\AppData\Local\Temp\Iwa2T2bKPn.exe
C:\Users\saturn89\AppData\Local\Temp\jre-8u74-windows-au.exe
C:\Users\saturn89\AppData\Local\Temp\jre-8u77-windows-au.exe
C:\Users\saturn89\AppData\Local\Temp\kr8lqewl.dll
C:\Users\saturn89\AppData\Local\Temp\PoXetGmkXO.exe
C:\Users\saturn89\AppData\Local\Temp\yahzaooz.dll
C:\Users\saturn89\AppData\Local\Temp\ZYz1NFfPrQ.exe
==================== Bamital & volsnap =================
(There is no automatic fix for files that do not pass verification.)
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\wininit.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2016-04-10 12:38
==================== End of FRST.txt ============================
Additional scan result of Farbar Recovery Scan Tool (x86) Version:17-04-2016
Ran by [removed] (2016-04-18 00:13:32)
Running from C:\Users\[removed]\Downloads
Microsoft Windows 10 Home Version 1511 (X86) (2015-12-26 01:13:08)
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
Administrator (S-1-5-21-817363288-272500718-2324346864-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-817363288-272500718-2324346864-503 - Limited - Disabled)
Guest (S-1-5-21-817363288-272500718-2324346864-501 - Limited - Disabled)
saturn89 (S-1-5-21-817363288-272500718-2324346864-1000 - Administrator - Enabled) => C:\Users\saturn89
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Spybot - Search and Destroy (Disabled - Out of date) {A16C3F68-9280-E053-1818-342707FECF4D}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
==================== Installed Programs ======================
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Adobe Flash Player 21 NPAPI (HKLM\…\Adobe Flash Player NPAPI) (Version: 21.0.0.213 - Adobe Systems Incorporated)
AirDroid 3.3.0.0 (HKLM\…\AirDroid) (Version: 3.3.0.0 - Sand Studio)
Apple Application Support (32-bit) (HKLM\…\{FE5C2FAA-118D-4509-B51D-3F71CC9E1B3E}) (Version: 4.3 - Apple Inc.)
Apple Mobile Device Support (HKLM\…\{15A0A9A6-6CF0-4EEE-8E12-096B33F92CA7}) (Version: 9.3.0.15 - Apple Inc.)
Apple Software Update (HKLM\…\{56EC47AA-5813-4FF6-8E75-544026FBEA83}) (Version: 2.2.0.150 - Apple Inc.)
Asoftech Data Recovery (HKLM\…\{1AED6EB7-8FEA-4021-B8FD-EBAA6B21679F}) (Version: 1.00 - )
Avast Pro Antivirus (HKLM\…\Avast) (Version: 11.1.2253 - AVAST Software)
Bonjour (HKLM\…\{D168AAD0-6686-47C1-B599-CDD4888B9D1A}) (Version: 3.1.0.1 - Apple Inc.)
Cisco EAP-FAST Module (HKLM\…\{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}) (Version: 2.2.14 - Cisco Systems, Inc.)
Cisco LEAP Module (HKLM\…\{51C7AD07-C3F6-4635-8E8A-231306D810FE}) (Version: 1.0.19 - Cisco Systems, Inc.)
Cisco PEAP Module (HKLM\…\{ED5776D5-59B4-46B7-AF81-5F2D94D7C640}) (Version: 1.1.6 - Cisco Systems, Inc.)
Generic Trader (HKLM\…\0372-4029-6571-2334) (Version: 8.1 - Certigo, Inc.)
Google Chrome (HKLM\…\Google Chrome) (Version: 49.0.2623.112 - Google Inc.)
Google Update Helper (Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (Version: 1.3.29.5 - Google Inc.) Hidden
HFSExplorer 0.23 (HKLM\…\HFSExplorer) (Version: 0.23 - Catacombae Software)
iCloud (HKLM\…\{C3867553-D9F8-416E-8F14-EFF234A48577}) (Version: 5.1.0.34 - Apple Inc.)
Infinite HD™ App (HKU\S-1-5-21-817363288-272500718-2324346864-1000\…\Octoshape Streaming Services) (Version: - Octoshape ApS)
iTunes (HKLM\…\{3079C5C8-325A-4354-A733-456BACA1E5FB}) (Version: 12.3.3.17 - Apple Inc.)
Java 8 Update 77 (HKLM\…\{26A24AE4-039D-4CA4-87B4-2F83218077F0}) (Version: 8.0.770.3 - Oracle Corporation)
Malwarebytes Anti-Malware version 2.2.1.1043 (HKLM\…\Malwarebytes Anti-Malware_is1) (Version: 2.2.1.1043 - Malwarebytes)
Microsoft Silverlight (HKLM\…\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.41212.0 - Microsoft Corporation)
Mozilla Firefox 45.0.2 (x86 en-US) (HKLM\…\Mozilla Firefox 45.0.2 (x86 en-US)) (Version: 45.0.2 - Mozilla)
Mozilla Maintenance Service (HKLM\…\MozillaMaintenanceService) (Version: 45.0.2.5941 - Mozilla)
Ralink RT2870 Wireless LAN Card (HKLM\…\{28DA7D8B-F9A4-4F18-8AA0-551B1E084D0D}) (Version: 1.5.31.0 - Ralink)
Realtek High Definition Audio Driver (HKLM\…\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7535 - Realtek Semiconductor Corp.)
SafeZone Stable 1.48.2066.95 (Version: 1.48.2066.95 - Avast Software) Hidden
Skype™ 7.21 (HKLM\…\{FC965A47-4839-40CA-B618-18F486F042C6}) (Version: 7.21.100 - Skype Technologies S.A.)
Spybot - Search & Destroy (HKLM\…\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.5.43 - Safer-Networking Ltd.)
Voxatron 0.3.0 (HKLM\…\Voxatron) (Version: 0.3.0 - Lexaloffle Games)
Windows Phone app for desktop (HKLM\…\{5F71448B-88EB-4357-9A98-8658D4C49C48}) (Version: 1.1.2726.0 - Microsoft Corporation)
Zen Bound 2 (HKLM\…\Zen Bound 2) (Version: - )
==================== Custom CLSID (Whitelisted): ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
CustomCLSID: HKU\S-1-5-21-817363288-272500718-2324346864-1000_Classes\CLSID\{7D4733C0-C43B-4A81-AF43-F9B20D1F8348}\InprocServer32 -> C:\Users\saturn89\AppData\Roaming\Octoshape\Octoshape Streaming Services\sua-1401100-0-apoctoshape.dll (Octoshape ApS)
==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {058CAE06-98B8-4360-AE3C-6C5EBD40A77D} - System32\Tasks\Microsoft\Windows\Media Center\DispatchRecoveryTasks => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {0692679A-6E2F-4EDB-9210-5A2D32F091CD} - System32\Tasks\avastBCLRestart_chrome.exe => Chrome.exe
Task: {07C645E7-24C0-4296-8BE7-31EAA32CBB54} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2016-04-08] (Adobe Systems Incorporated)
Task: {099BCFF3-FC03-4A31-B557-8EC54CE75BC3} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> No File <==== ATTENTION
Task: {0F98E85B-B64D-4055-AF01-AF0F122BA442} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW1 => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {173B51C2-46E5-4243-8A96-69D0595001E1} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2016-02-23] (Apple Inc.)
Task: {313876C1-C40F-4262-A6C9-52773489CD2F} - System32\Tasks\SafeZone scheduled Autoupdate 1456407219 => C:\Program Files\AVAST Software\SZBrowser\launcher.exe [2016-03-08] (Avast Software)
Task: {3DC1D7A8-0B1C-44AE-89CE-1D190953EDCD} - System32\Tasks\Microsoft\Windows\Media Center\OCURDiscovery => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {43546740-2192-4F6F-AB39-ACD37A4C919D} - System32\Tasks\Microsoft\Windows\Media Center\RegisterSearch => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {43F14216-DD7A-41F1-BA79-52BB49C3BFD2} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTION
Task: {5F391B05-58B0-4582-9330-AD6664FFEBDD} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate => C:\WINDOWS\ehome\mcupdate.exe
Task: {60E375B5-6649-4DE2-8278-E78B973DBA54} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2016-02-15] (AVAST Software)
Task: {70800E6E-FA99-4DB3-B897-959A7F323885} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files\Spybot - Search & Destroy 2\SDScan.exe [2015-06-16] (Safer-Networking Ltd.)
Task: {750D1AF0-2E08-4208-A3B2-B6BCB84D9A58} - System32\Tasks\Microsoft\Windows\Media Center\RecordingRestart => C:\WINDOWS\ehome\ehrec.exe
Task: {76B57C0E-6B56-4410-969A-C082027A47BD} - System32\Tasks\Microsoft\Windows\Media Center\ReindexSearchRoot => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {79E85592-EEF4-4073-A22D-A55ACD7B6C3A} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> No File <==== ATTENTION
Task: {7C5586D0-21AA-4FAC-B7A4-0A569FBE8FFC} - System32\Tasks\Microsoft\Windows\Media Center\PvrScheduleTask => C:\WINDOWS\ehome\mcupdate.exe
Task: {7CEEC76B-9535-49FB-BF44-8E978633280F} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2016-04-13] (Microsoft Corporation)
Task: {7DBBBFEE-2D15-4394-BB9F-3A8270874566} - System32\Tasks\Microsoft\Windows\Media Center\OCURActivate => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {83B34BFF-5091-483C-94DD-3DFC4F4BB9B0} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files\Spybot - Search & Destroy 2\SDUpdate.exe [2015-06-16] (Safer-Networking Ltd.)
Task: {8A241BC3-A2FA-4954-911C-F14883CE98F0} - System32\Tasks\Microsoft\Windows\Media Center\ConfigureInternetTimeService => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {8DF0925F-9954-480D-8542-9EF6675EC435} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscovery => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {90E8C45F-ED05-4039-A385-6054CC9AC534} - System32\Tasks\Microsoft\Windows\Media Center\ObjectStoreRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe
Task: {9167EBFD-C120-453E-B5D7-4A2ABCFF258B} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> No File <==== ATTENTION
Task: {92118657-D36F-492B-91FA-0AB562B732E6} - System32\Tasks\Microsoft\Windows\Media Center\ehDRMInit => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {93BBC4C1-3199-45BC-9AFC-C3257C77FAC2} - System32\Tasks\Microsoft\Windows\Media Center\MediaCenterRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe
Task: {98BF98F8-ED4B-48C0-BD1B-F96E6C0A936F} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> No File <==== ATTENTION
Task: {9C38D319-D71B-4EBD-992F-1BEE82BE25A1} - System32\Tasks\Microsoft\Windows\Media Center\PeriodicScanRetry => C:\WINDOWS\ehome\MCUpdate.exe
Task: {9F256DB5-B508-4906-B569-CA656C2AE747} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> No File <==== ATTENTION
Task: {AE5B0007-B56F-4887-AF38-196EF31FE051} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2015-08-28] (Google Inc.)
Task: {B26A7A24-7657-4739-9FD1-26D412B44268} - System32\Tasks\Microsoft\Windows\Media Center\UpdateRecordPath => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {BC890042-9FBC-4F81-A017-B02E312C64A2} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION
Task: {C4C4143E-75AF-45C3-8D26-BC7D126CF4A8} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate_scheduled => C:\WINDOWS\ehome\mcupdate.exe
Task: {C50525C3-4BE1-408A-9726-8965A3CA5184} - System32\Tasks\Microsoft\Windows\Media Center\InstallPlayReady => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {CC8BC207-30E3-4E02-AB31-B0AB50DF83F5} - System32\Tasks\Microsoft\Windows\Media Center\PvrRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe
Task: {E1C16E16-0B00-4388-9072-B3151EF1B355} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> No File <==== ATTENTION
Task: {E30783F3-E961-4AB3-B5FF-34E80AB4B907} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files\Spybot - Search & Destroy 2\SDImmunize.exe [2015-06-16] (Safer-Networking Ltd.)
Task: {E55EA64D-6FA4-4049-9C29-36C8F36B01C6} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW2 => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {ED8D8A50-8133-40AF-B856-3CD01DAF3238} - System32\Tasks\Microsoft\Windows\Media Center\ActivateWindowsSearch => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {EEBC27FB-3026-4CEA-8079-402251BD4154} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> No File <==== ATTENTION
Task: {F38C68B4-65D7-4A61-9434-54C68A9C5B4F} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> No File <==== ATTENTION
Task: {FC14B947-5630-4B99-87A3-F5ED22A11C06} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2015-08-28] (Google Inc.)
Task: {FDDEDF02-6BF8-4A09-9126-4895EB8A49F4} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> No File <==== ATTENTION
Task: {FF3D3376-2C6A-42DA-9D0E-B24C915785C3} - System32\Tasks\Microsoft\Windows\Media Center\SqlLiteRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
==================== Shortcuts =============================
(The entries could be listed to be restored or removed.)
==================== Loaded Modules (Whitelisted) ==============
2015-10-30 00:44 - 2015-10-30 00:44 - 00149504 _____ () C:\WINDOWS\SYSTEM32\ism32k.dll
2016-02-15 02:58 - 2016-02-15 02:58 - 00113496 _____ () C:\Program Files\AVAST Software\Avast\log.dll
2016-02-15 02:58 - 2016-02-15 02:58 - 00133768 _____ () C:\Program Files\AVAST Software\Avast\JsonRpcServer.dll
2016-04-17 17:44 - 2016-04-17 17:44 - 02890240 _____ () C:\Program Files\AVAST Software\Avast\defs\16041701\algo.dll
2016-04-14 11:40 - 2016-04-14 11:40 - 00509344 _____ () C:\Program Files\AVAST Software\Avast\ffl2.dll
2016-03-18 22:56 - 2016-03-18 22:56 - 00080184 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2016-03-18 22:56 - 2016-03-18 22:56 - 01040656 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2015-12-26 03:08 - 2014-05-13 13:04 - 00109400 _____ () C:\Program Files\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2015-12-26 03:08 - 2014-05-13 13:04 - 00167768 _____ () C:\Program Files\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2015-12-26 03:08 - 2014-05-13 13:04 - 00416600 _____ () C:\Program Files\Spybot - Search & Destroy 2\DEC150.bpl
2016-04-12 12:24 - 2016-03-29 04:37 - 01862008 _____ () C:\WINDOWS\system32\CoreUIComponents.dll
2016-04-12 12:24 - 2016-03-29 04:37 - 01862008 _____ () C:\WINDOWS\System32\CoreUIComponents.dll
2016-01-22 01:47 - 2016-01-22 01:47 - 00144384 _____ () C:\Program Files\WindowsApps\Microsoft.Messaging_2.13.20000.0_x86__8wekyb3d8bbwe\SkypeHost.exe
2016-01-22 01:47 - 2016-01-22 01:47 - 00141312 _____ () C:\Program Files\WindowsApps\Microsoft.Messaging_2.13.20000.0_x86__8wekyb3d8bbwe\SkypeBackgroundTasks.dll
2016-01-22 01:47 - 2016-01-22 01:47 - 22330368 _____ () C:\Program Files\WindowsApps\Microsoft.Messaging_2.13.20000.0_x86__8wekyb3d8bbwe\SkyWrap.dll
2015-12-25 21:42 - 2015-12-25 21:42 - 00070656 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\Windows.UI.Shell.SharedUtilities.dll
2016-04-12 12:23 - 2016-04-01 22:26 - 00316416 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\QuickActions.dll
2016-04-12 12:23 - 2016-04-01 22:09 - 05340672 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll
2016-04-12 12:23 - 2016-04-01 22:03 - 00471552 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2016-04-12 12:24 - 2016-04-01 22:03 - 02366976 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll
2016-04-12 12:24 - 2016-04-01 22:07 - 02657280 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll
2015-12-11 16:37 - 2015-12-11 16:37 - 40539648 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2016-01-21 01:37 - 2016-01-21 01:37 - 03034624 _____ () C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1601.49020.0_x86__8wekyb3d8bbwe\Calculator.exe
2015-12-15 02:26 - 2015-12-15 02:26 - 00169984 _____ () C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1601.49020.0_x86__8wekyb3d8bbwe\StoreRatingPromotion.dll
==================== Alternate Data Streams (Whitelisted) =========
(If an entry is included in the fixlist, only the ADS will be removed.)
==================== Safe Mode (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" value will be restored.)
==================== EXE Association (Whitelisted) ===============
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, it will be removed from the registry.)
IE trusted site: HKU\S-1-5-21-817363288-272500718-2324346864-1000\…\driversupport.com -> hxxp://apps.driversupport.com
IE trusted site: HKU\S-1-5-21-817363288-272500718-2324346864-1000\…\driversupport.com -> hxxps://apps.driversupport.com
IE restricted site: HKU\S-1-5-21-817363288-272500718-2324346864-1000\…\007guard.com -> install.007guard.com
IE restricted site: HKU\S-1-5-21-817363288-272500718-2324346864-1000\…\008i.com -> 008i.com
IE restricted site: HKU\S-1-5-21-817363288-272500718-2324346864-1000\…\008k.com -> www.008k.com
IE restricted site: HKU\S-1-5-21-817363288-272500718-2324346864-1000\…\00hq.com -> www.00hq.com
IE restricted site: HKU\S-1-5-21-817363288-272500718-2324346864-1000\…\010402.com -> 010402.com
IE restricted site: HKU\S-1-5-21-817363288-272500718-2324346864-1000\…\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\S-1-5-21-817363288-272500718-2324346864-1000\…\0scan.com -> www.0scan.com
IE restricted site: HKU\S-1-5-21-817363288-272500718-2324346864-1000\…\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\S-1-5-21-817363288-272500718-2324346864-1000\…\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\S-1-5-21-817363288-272500718-2324346864-1000\…\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\S-1-5-21-817363288-272500718-2324346864-1000\…\1001namen.com -> www.1001namen.com
IE restricted site: HKU\S-1-5-21-817363288-272500718-2324346864-1000\…\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\S-1-5-21-817363288-272500718-2324346864-1000\…\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\S-1-5-21-817363288-272500718-2324346864-1000\…\10sek.com -> www.10sek.com
IE restricted site: HKU\S-1-5-21-817363288-272500718-2324346864-1000\…\12-26.net -> user1.12-26.net
IE restricted site: HKU\S-1-5-21-817363288-272500718-2324346864-1000\…\12-27.net -> user1.12-27.net
IE restricted site: HKU\S-1-5-21-817363288-272500718-2324346864-1000\…\123fporn.info -> www.123fporn.info
IE restricted site: HKU\S-1-5-21-817363288-272500718-2324346864-1000\…\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\S-1-5-21-817363288-272500718-2324346864-1000\…\123moviedownload.com -> www.123moviedownload.com
IE restricted site: HKU\S-1-5-21-817363288-272500718-2324346864-1000\…\123simsen.com -> www.123simsen.com
There are 7865 more sites.
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-13 21:04 - 2014-05-07 00:54 - 00450709 ___RA C:\WINDOWS\system32\Drivers\etc\hosts
127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com
127.0.0.1 www.0scan.com
127.0.0.1 0scan.com
127.0.0.1 1000gratisproben.com
127.0.0.1 www.1000gratisproben.com
127.0.0.1 1001namen.com
127.0.0.1 www.1001namen.com
127.0.0.1 100888290cs.com
127.0.0.1 www.100888290cs.com
127.0.0.1 www.100sexlinks.com
127.0.0.1 100sexlinks.com
127.0.0.1 10sek.com
127.0.0.1 www.10sek.com
127.0.0.1 www.1-2005-search.com
127.0.0.1 1-2005-search.com
127.0.0.1 123fporn.info
127.0.0.1 www.123fporn.info
127.0.0.1 123haustiereundmehr.com
127.0.0.1 www.123haustiereundmehr.com
127.0.0.1 123moviedownload.com
127.0.0.1 www.123moviedownload.com
There are 15461 more lines.
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-817363288-272500718-2324346864-1000\Control Panel\Desktop\\Wallpaper -> c:\windows\web\wallpaper\windows\img0.jpg
DNS Servers: 75.75.76.76 - 75.75.75.75
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-817363288-272500718-2324346864-1000\…\StartupApproved\StartupFolder: => "TurboYourPC.lnk"
==================== FirewallRules (Whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [MSMQ-In-TCP] => (Allow) %systemroot%\system32\mqsvc.exe
FirewallRules: [MSMQ-Out-TCP] => (Allow) %systemroot%\system32\mqsvc.exe
FirewallRules: [MSMQ-In-UDP] => (Allow) %systemroot%\system32\mqsvc.exe
FirewallRules: [MSMQ-Out-UDP] => (Allow) %systemroot%\system32\mqsvc.exe
FirewallRules: [WCF-NetTcpActivator-In-TCP-32bit] => (Allow) LPort=808
FirewallRules: [{817D2932-FC02-4A9B-BD02-E0E410F7513F}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{DF2B8375-A17B-4561-A08E-50BED31EF2D0}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{65ACD1BB-5BBD-440C-9FF0-0B8A4A5921C4}] => (Allow) C:\Program Files\Ralink\Common\RaMediaServer.exe
FirewallRules: [{189ED8C2-D4C9-43CF-9CDD-E6B44C3DB599}] => (Allow) C:\Program Files\Ralink\Common\RaMediaServer.exe
FirewallRules: [{B679054D-0E5C-4FBC-AF56-09D4BB59B419}] => (Allow) C:\Program Files\Ralink\Common\RaUI.exe
FirewallRules: [{40257434-3BE0-44FD-9A35-B2CA0861AD8E}] => (Allow) C:\Program Files\Ralink\Common\RaUI.exe
FirewallRules: [TCP Query User{FF62C8CD-95EE-4AB9-9F3B-ED76371AF853}C:\program files\generic trader\generictrader.exe] => (Allow) C:\program files\generic trader\generictrader.exe
FirewallRules: [UDP Query User{87E8EB78-2966-4C7F-B371-5C85C2BD1CF1}C:\program files\generic trader\generictrader.exe] => (Allow) C:\program files\generic trader\generictrader.exe
FirewallRules: [TCP Query User{447D8ECC-36C3-4C26-BF7D-0E3C2222F00B}C:\program files\generic trader\jre\bin\java.exe] => (Allow) C:\program files\generic trader\jre\bin\java.exe
FirewallRules: [UDP Query User{8A3DA177-06D8-49E6-B26F-8936FF7899F7}C:\program files\generic trader\jre\bin\java.exe] => (Allow) C:\program files\generic trader\jre\bin\java.exe
FirewallRules: [{938DF1CD-CE5B-453C-8ECC-D35F86BEDA6C}] => (Allow) C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
FirewallRules: [TCP Query User{3C017011-5EAC-41D0-966A-E5E113375D79}C:\program files\generic trader\generictrader.exe] => (Allow) C:\program files\generic trader\generictrader.exe
FirewallRules: [UDP Query User{237E1B3B-6B20-4CDF-8B46-23117CD5DF1D}C:\program files\generic trader\generictrader.exe] => (Allow) C:\program files\generic trader\generictrader.exe
FirewallRules: [TCP Query User{C440529B-E670-427F-A208-66452B302E96}C:\program files\generic trader\jre\bin\java.exe] => (Allow) C:\program files\generic trader\jre\bin\java.exe
FirewallRules: [UDP Query User{3A560CDA-C612-46D4-BE89-AF306F50C264}C:\program files\generic trader\jre\bin\java.exe] => (Allow) C:\program files\generic trader\jre\bin\java.exe
FirewallRules: [{CA3624E0-511A-4969-80F4-B6E4A5684DBC}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{3C35D563-1693-426D-96A1-3F597E3F9487}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [TCP Query User{D4C76E1E-B5F2-44D0-84F1-76EC194B95E4}C:\users\saturn89\appdata\roaming\octoshape\octoshape streaming services\octoshapeclient.exe] => (Allow) C:\users\saturn89\appdata\roaming\octoshape\octoshape streaming services\octoshapeclient.exe
FirewallRules: [UDP Query User{6CB58E30-A987-40DD-9E7F-2CFAAFABC7AD}C:\users\saturn89\appdata\roaming\octoshape\octoshape streaming services\octoshapeclient.exe] => (Allow) C:\users\saturn89\appdata\roaming\octoshape\octoshape streaming services\octoshapeclient.exe
FirewallRules: [TCP Query User{C6B02999-88D8-48A2-B467-818C473565CA}C:\program files\mozilla firefox\firefox.exe] => (Allow) C:\program files\mozilla firefox\firefox.exe
FirewallRules: [UDP Query User{F9CB2CBA-0C5A-44D4-802E-8957F4CA8208}C:\program files\mozilla firefox\firefox.exe] => (Allow) C:\program files\mozilla firefox\firefox.exe
FirewallRules: [TCP Query User{B01D604E-5F8A-4014-819C-EBEFE309F0C5}C:\program files\airdroid\airdroid.exe] => (Allow) C:\program files\airdroid\airdroid.exe
FirewallRules: [UDP Query User{C97F5A48-70EC-498A-92DD-8D7BA53C41B3}C:\program files\airdroid\airdroid.exe] => (Allow) C:\program files\airdroid\airdroid.exe
FirewallRules: [{86AA8D02-A0A4-4CB7-A088-A158FC9C222C}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{80C1EB45-8D3D-460D-8AAD-DA0DB892DE03}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{57985A79-6425-498E-AD7E-0A17610501B5}] => (Allow) C:\Program Files\Skype\Phone\Skype.exe
FirewallRules: [{6939F2E0-8DEC-4328-BCC2-4D4DEB1B8800}] => (Allow) C:\Program Files\iTunes\iTunes.exe
FirewallRules: [{30E88EE8-7A12-485E-BB48-F6C192E7F849}] => (Allow) C:\Program Files\Google\Chrome\Application\chrome.exe
StandardProfile\AuthorizedApplications: [C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe] => Enabled:Spybot - Search & Destroy tray access
StandardProfile\AuthorizedApplications: [C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe] => Enabled:Spybot-S&D; 2 Scanner Service
StandardProfile\AuthorizedApplications: [C:\Program Files\Spybot - Search & Destroy 2\SDUpdate.exe] => Enabled:Spybot-S&D; 2 Updater
StandardProfile\AuthorizedApplications: [C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe] => Enabled:Spybot-S&D; 2 Background update service
==================== Restore Points =========================
31-03-2016 06:13:45 Scheduled Checkpoint
09-04-2016 00:43:30 Scheduled Checkpoint
12-04-2016 04:06:25 JRT Pre-Junkware Removal
15-04-2016 05:14:03 JRT Pre-Junkware Removal
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (04/17/2016 09:59:33 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: BITSC:\Windows\System32\bitsperf.dll4
Error: (04/17/2016 08:50:58 PM) (Source: Windows Backup) (EventID: 4103) (User: )
Description: The backup did not complete because of an error writing to the backup location E:\. The error is: The backup location cannot be found or is not valid. Review your backup settings and check the backup location. (0x81000006).
Error: (04/16/2016 01:00:42 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: svchost.exe, version: 10.0.10586.0, time stamp: 0x5632d73f
Faulting module name: ESENT.dll, version: 10.0.10586.212, time stamp: 0x56fa1470
Exception code: 0xc0000602
Fault offset: 0x0025088c
Faulting process id: 0x5e0
Faulting application start time: 0xsvchost.exe0
Faulting application path: svchost.exe1
Faulting module path: svchost.exe2
Report Id: svchost.exe3
Faulting package full name: svchost.exe4
Faulting package-relative application ID: svchost.exe5
Error: (04/16/2016 01:00:41 PM) (Source: ESENT) (EventID: 908) (User: )
Description: svchost (1504) Terminating process due to non-recoverable failure: PV: 10.0.10586.0 SV: 10.0.10586.0 GLE: 0 ERR: -1603(fucb.cxx:359): dllentry.cxx(103) (ESENT[10.0.10586.0] RETAIL RTM MBCS)
Error: (04/16/2016 12:48:41 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: BITSC:\Windows\System32\bitsperf.dll4
Error: (04/15/2016 11:30:50 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 5515
Error: (04/15/2016 11:30:50 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 5515
Error: (04/15/2016 11:30:50 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (04/15/2016 11:30:48 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 3781
Error: (04/15/2016 11:30:48 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 3781
System errors:
=============
Error: (04/17/2016 08:45:29 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The SDScannerService service failed to start due to the following error:
%%1053
Error: (04/17/2016 08:45:29 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the SDScannerService service to connect.
Error: (04/17/2016 08:44:59 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The NetTcpActivator service depends on the NetTcpPortSharing service which failed to start because of the following error:
%%1058
Error: (04/17/2016 05:47:09 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Sync Host_33c90 service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 10000 milliseconds: Restart the service.
Error: (04/17/2016 05:43:11 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The NetTcpActivator service depends on the NetTcpPortSharing service which failed to start because of the following error:
%%1058
Error: (04/17/2016 01:00:32 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Sync Host_35087 service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 10000 milliseconds: Restart the service.
Error: (04/17/2016 12:20:53 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The NetTcpActivator service depends on the NetTcpPortSharing service which failed to start because of the following error:
%%1058
Error: (04/17/2016 04:53:01 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the Sync Host_33277 service to connect.
Error: (04/17/2016 04:52:50 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Sync Host_33277 service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 10000 milliseconds: Restart the service.
Error: (04/17/2016 02:40:30 AM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The NetTcpActivator service depends on the NetTcpPortSharing service which failed to start because of the following error:
%%1058
CodeIntegrity:
===================================
Date: 2016-04-13 11:59:44.229
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.
Date: 2016-04-09 02:39:05.469
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.
Date: 2016-03-24 00:32:39.536
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.
Date: 2016-03-12 11:41:19.752
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.
Date: 2016-03-11 16:56:38.552
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.
Date: 2016-03-10 05:47:37.657
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.
Date: 2016-03-04 02:56:02.294
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.
Date: 2016-03-03 21:23:30.283
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.
Date: 2016-02-18 14:10:32.085
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.
Date: 2016-02-11 16:07:50.212
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.
==================== Memory info ===========================
Processor: Intel(R) Celeron(R) CPU E3200 @ 2.40GHz
Percentage of memory in use: 59%
Total physical RAM: 2013.05 MB
Available physical RAM: 815.57 MB
Total Virtual: 4061.05 MB
Available Virtual: 2664.89 MB
==================== Drives ================================
Drive c: (OS) (Fixed) (Total:232.44 GB) (Free:177.51 GB) NTFS ==>[drive with boot components (obtained from BCD)]
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 232.9 GB) (Disk ID: 1ADF1ADE)
Partition 1: (Active) - (Size=232.4 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=450 MB) - (Type=27)
==================== End of Addition.txt ============================
Ahh, thats better, thank you for the logs
I am looking over your logs and working on a quick fix but before i post it can you tell me about Octoshape, is this something you installed and use ???
http://www.sevenforums.com/general-discussion/350962-how-did-octoshape-client-get-my-system.html
Octoshape?!………never heard of it, until you mentioned it of course. Obviously that's something that got installed without my knowledge as a result of my corrupting download. BTW, that download was to look up a serial number on a musical instrument, which I was never able to do.
AI can make mistakes. Check the cited posts. Archived advice can be out-of-date
Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI