This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

General Slowness and Regular Cleanup. BSOD on FRST... [Solved]

10 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

I've been generally careful on this machine, but I fear some stuff may have slipped through and I try to get regular checkups, and lately I've had a few highly suspicious signs. Part of it is CPU and general slowness (in fact, this one time Windows showed everything on screen in a massive delay fade out thing, even in this online game that became super slow even though chat was real time active). Then there's programs either failing to start or doing so later a bit. And an online game got corrupted at launcher somehow and just wouldn't start, had to reinstall.

I have decent protection and I tend to run ComboFix now and then just to be on the safe side, which I realize is kind of a bad habit, but it's kept me away from serious trouble. Also ran ESET online ocasionally. Either way I know some things require actual specialized coding, but I try not to rely on others that are already busy, but I figure it's better to be safe so here I am. I need to make sure going forward that I won't leak personal data, like finance and such.


Also, the first time I ran FRST scan for this, when I got back Windows was in Blue Screen of Death and dumping physical memory. But the logs were complete so here they are. I am on a Windows 7 64 bit laptop. 
 

aswMBR version 1.0.1.2252 Copyright© 2014 AVAST Software
Run date: 2016-05-21 18:11:37
—————————–
18:11:37.925    OS Version: Windows x64 6.1.7601 Service Pack 1
18:11:37.925    Number of processors: 2 586 0x3708
18:11:37.941    ComputerName: SALTYSKY  UserName: 
18:11:38.549    Initialize success
18:11:38.596    VM: initialized successfully
18:11:38.596    VM: Intel CPU BiosDisabled 
18:11:42.808    AVAST engine defs: 16052007
18:11:58.111    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
18:11:58.111    Disk 0 Vendor: TOSHIBA_MQ01ABF050 AM0Q5E Size: 476940MB BusType: 11
18:11:58.377    Disk 0 MBR read successfully
18:11:58.392    Disk 0 MBR scan
18:11:58.392    Disk 0 Windows 7 default MBR code
18:11:58.408    Disk 0 Partition 1 00     07    HPFS/NTFS NTFS       351940 MB offset 256000000
18:11:58.439    Disk 0 Partition 2 80 (A) 07    HPFS/NTFS NTFS       124999 MB offset 2048
18:11:58.501    Disk 0 Boot: NTFS     code=2
18:11:58.657    Disk 0 scanning C:\Windows\system32\drivers
18:12:10.014    Service scanning
18:12:33.251    Modules scanning
18:12:33.282    Disk 0 trace - called modules:
18:12:33.298    
18:12:33.969    AVAST engine scan C:\Windows
18:12:36.356    AVAST engine scan C:\Windows\system32
18:15:25.228    AVAST engine scan C:\Windows\system32\drivers
18:15:36.133    AVAST engine scan C:\Users\salty-san
18:22:11.069    AVAST engine scan C:\ProgramData
18:23:34.006    Disk 0 statistics 3767998/0/0 @ 4.02 MB/s
18:23:34.019    Scan finished successfully
18:24:39.259    Disk 0 MBR has been saved successfully to "D:\KIT!\Fixes\Lets\MBR.dat"
18:24:39.266    The log file has been saved successfully to "D:\KIT!\Fixes\Lets\aswMBR.txt"
 

Additional scan result of Farbar Recovery Scan Tool (x64) Version:19-05-2016
Ran by [removed] (2016-05-21 18:36:03)
Running from C:\Users\[removed]\Desktop
Windows 7 Ultimate Service Pack 1 (X64) (2015-11-01 10:20:21)
Boot Mode: Normal
==========================================================
 
 
==================== Accounts: =============================
 
Administrator (S-1-5-21-384921765-1548902971-3406650631-500 - Administrator - Disabled)
Guest (S-1-5-21-384921765-1548902971-3406650631-501 - Limited - Disabled)
salty-san (S-1-5-21-384921765-1548902971-3406650631-1000 - Administrator - Enabled) => C:\Users\salty-san
 
==================== Security Center ========================
 
(If an entry is included in the fixlist, it will be removed.)
 
AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
 
==================== Installed Programs ======================
 
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 
7-Zip 15.12 (x64) (HKLM\…\7-Zip) (Version: 15.12 - Igor Pavlov)
7-Zip 15.14 (x64 edition) (HKLM\…\{23170F69-40C1-2702-1514-000001000000}) (Version: 15.14.00.0 - Igor Pavlov)
Adobe Acrobat Reader DC (HKLM-x32\…\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}) (Version: 15.016.20039 - Adobe Systems Incorporated)
Avant Browser (remove only) (HKLM-x32\…\AvantBrowser) (Version: 12.5.0.0 - Avant Force)
Avast Free Antivirus (HKLM-x32\…\Avast) (Version: 11.2.2262 - AVAST Software)
Avidemux 2.6 - 64 bits (HKLM-x32\…\Avidemux 2.6 - 64 bits (64-bit)) (Version: 2.6.12.160304 - )
CamStudio 2.7.4 (HKLM\…\{04B83666-3A62-452B-85D3-70F8117F2329}_is1) (Version: 2.7.4 - CamStudio Open Source)
Canon MP180 (HKLM\…\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP180) (Version:  - )
Cheatbook Database 2016 (HKLM-x32\…\Cheatbook Database 2016) (Version:  - )
Cisco EAP-FAST Module (HKLM-x32\…\{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}) (Version: 2.2.14 - Cisco Systems, Inc.)
Cisco LEAP Module (HKLM-x32\…\{AF312B06-5C5C-468E-89B3-BE6DE2645722}) (Version: 1.0.19 - Cisco Systems, Inc.)
Cisco PEAP Module (HKLM-x32\…\{0A4EF0E6-A912-4CDE-A7F3-6E56E7C13A2F}) (Version: 1.1.6 - Cisco Systems, Inc.)
Comodo Dragon (HKLM-x32\…\Comodo Dragon) (Version: 49.13.20.400 - Comodo)
Dungeon Siege 2 (HKLM-x32\…\DungeonSiege2) (Version:  - Microsoft)
Epic Privacy Browser (HKU\S-1-5-21-384921765-1548902971-3406650631-1000\…\Epic) (Version: 48.0.2553.0 - Epic)
Eraser 6.2.0.2970 (HKLM\…\{58F37E51-2A83-49F3-9117-6005C63CF399}) (Version: 6.2.2970 - The Eraser Project)
ESET Online Scanner v3 (HKLM-x32\…\ESET Online Scanner) (Version:  - )
FlashPeak SlimBrowser (HKLM-x32\…\SlimBrowser) (Version: 7.00.143 - FlashPeak Inc.)
FlashRip(Full Version) (HKLM-x32\…\FlashRip(Full Version)_is1) (Version:  - )
foobar2000 v1.3.9 (HKLM-x32\…\foobar2000) (Version: 1.3.9 - Peter Pawlowski)
Fraps (HKLM-x32\…\Fraps) (Version:  - )
Free Virtual Keyboard 3.0.1.0 (HKLM-x32\…\{CA4F9519-1A83-4907-8651-F17073A0E1CE}_is1) (Version: 3.0 - Comfort Software Group)
FreeUndelete 2.1.36867.1 (HKLM-x32\…\{0F5ADA2F-C0B2-4AD6-8FF7-7DFA9D6B4CBA}) (Version: 2.1.36867.1 - Recoveronix)
FunnyGames - Gemcraft (HKU\S-1-5-21-384921765-1548902971-3406650631-1000\…\FunnyGames - gemcraft) (Version: 1 - FunnyGames)
Glary Undelete 5.0.1.19 (HKLM-x32\…\Glary Undelete) (Version: 5.0.1.19 - Glarysoft Ltd)
Google Chrome (HKLM-x32\…\Google Chrome) (Version: 50.0.2661.102 - Google Inc.)
Google Update Helper (x32 Version: 1.3.30.3 - Google Inc.) Hidden
Intel(R) Processor Graphics (HKLM-x32\…\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3958 - Intel Corporation)
Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM-x32\…\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 3.0.0.33 - Intel Corporation)
IrfanView 64 (remove only) (HKLM\…\IrfanView64) (Version: 4.41 - Irfan Skiljan)
League of Legends (HKLM-x32\…\League of Legends 3.0.1) (Version: 3.0.1 - Riot Games)
League of Legends (x32 Version: 3.0.1 - Riot Games) Hidden
LinuxLive USB Creator (HKLM-x32\…\LinuxLive USB Creator) (Version: 2.9 - Thibaut Lauziere)
LogMeIn Hamachi (HKLM-x32\…\LogMeIn Hamachi) (Version: 2.2.0.422 - LogMeIn, Inc.)
LogMeIn Hamachi (x32 Version: 2.2.0.422 - LogMeIn, Inc.) Hidden
Maxthon App Store (HKLM-x32\…\Maxthon App Store 1.1.0.10848) (Version: 1.1.0.10848 - Maxthon, Inc.)
Maxthon Cloud Browser (HKLM-x32\…\Maxthon3) (Version: 4.9.2.1000 - Maxthon International Limited)
Microsoft .NET Framework 4.6 (HKLM\…\{94A631D5-B30A-3DD8-B65C-1117C09DA73E}) (Version: 4.6.00081 - Microsoft Corporation)
Microsoft Office Professional Plus 2013 (HKLM\…\Office15.PROPLUS) (Version: 15.0.4420.1017 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\…\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\…\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319 (HKLM\…\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\…\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.23506 (HKLM-x32\…\{23daf363-3020-4059-b3ae-dc4ad39fed19}) (Version: 14.0.23506.0 - Microsoft Corporation)
Microsoft XNA Framework Redistributable 4.0 (HKLM-x32\…\{2BFC7AA0-544C-4E3A-8796-67F3BE655BE9}) (Version: 4.0.20823.0 - Microsoft Corporation)
Mount and Blade (HKLM-x32\…\1207666893_is1) (Version: 2.0.0.4 - GOG.com)
Mozilla Firefox 43.0.4 (x86 en-US) (HKLM-x32\…\Mozilla Firefox 43.0.4 (x86 en-US)) (Version: 43.0.4 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\…\MozillaMaintenanceService) (Version: 43.0.1.5828 - Mozilla)
MPC-HC 1.7.10 (64-bit) (HKLM\…\{2ACBF1FA-F5C3-4B19-A774-B22A31F231B9}_is1) (Version: 1.7.10 - MPC-HC Team)
MyDefrag v4.3.1 (HKLM\…\MyDefrag v4.3.1_is1) (Version: 4.0.0.0 - J.C. Kessels)
One Finger Death Punch 1.0 (HKLM-x32\…\One Finger Death Punch 1.0) (Version: 1.0 - Cat-A-Cat)
Opera Stable 37.0.2178.43 (HKLM-x32\…\Opera 37.0.2178.43) (Version: 37.0.2178.43 - Opera Software)
Outils de vérification linguistique 2013 de Microsoft Office - Français (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Panda Cloud Cleaner (HKLM-x32\…\{92B2B132-C7F0-43DC-921A-4493C04F78A4}_is1) (Version: 1.1.8 - Panda Security)
PCSX2 - Playstation 2 Emulator (HKLM-x32\…\pcsx2) (Version:  - )
PowerISO (HKLM-x32\…\PowerISO) (Version: 6.3 - Power Software Ltd)
Realtek Card Reader (HKLM-x32\…\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.3.9600.29084 - Realtek Semiconductor Corp.)
Realtek Ethernet Controller Driver (HKLM-x32\…\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.92.115.2015 - Realtek)
REALTEK Wireless LAN Driver (HKLM-x32\…\{9DAABC60-A5EF-41FF-B2B9-17329590CD5}) (Version: 1.00.0263 - REALTEK Semiconductor Corp.)
RMPrepUSB (HKLM-x32\…\RMPrepUSB) (Version:  - )
SafeZone Stable 1.48.2066.101 (x32 Version: 1.48.2066.101 - Avast Software) Hidden
SeaMonkey 2.40 (x86 en-US) (HKLM-x32\…\SeaMonkey 2.40 (x86 en-US)) (Version: 2.40 - Mozilla)
Shotty - Tiny but impressive screenshot utility (HKLM\…\2e730c18-03e8-4d1d-8fc2-0ee3ea04a765) (Version: 2.0.2.216 - Thomas Baumann)
SWF File Player (HKLM-x32\…\{6A86F611-906C-422D-B34A-103662CBC195}_is1) (Version:  - swffileplayer.com)
The Binding of Isaac Rebirth 1.0 (HKLM-x32\…\The Binding of Isaac Rebirth 1.0) (Version: 1.0 - Games on Cat-A-Cat.Net)
The I of the Dragon (HKLM-x32\…\The I of the Dragon) (Version: 1.00 Ger / Eng - Deep Silver (Koch Media))
Torchlight II © Runic Games version 1 (HKLM-x32\…\Torchlight II © Runic Games_is1) (Version: 1 - )
Tweaking.com - Registry Backup (HKLM-x32\…\Tweaking.com - Registry Backup) (Version: 3.3.1 - Tweaking.com)
UndeleteMyFiles Pro (HKLM-x32\…\UndeleteMyFiles Pro_is1) (Version:  - SeriousBit)
VLC media player (HKLM-x32\…\VLC media player) (Version: 2.2.1 - VideoLAN)
Wasteland 2 Directors Cut (HKLM-x32\…\Wasteland 2 Directors Cut_is1) (Version:  - )
Winamp (HKLM-x32\…\Winamp) (Version: 5.666  - Nullsoft, Inc)
WinPcap 4.1.3 (HKLM-x32\…\WinPcapInst) (Version: 4.1.0.2980 - Riverbed Technology, Inc.)
WinRAR 5.21 (64-bit) (HKLM\…\WinRAR archiver) (Version: 5.21.0 - win.rar GmbH)
WinToUSB version 2.8 (HKLM\…\WinToUSB_is1) (Version: 2.8 - The EasyUEFI Development Team.)
 
==================== Custom CLSID (Whitelisted): ==========================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
CustomCLSID: HKU\S-1-5-21-384921765-1548902971-3406650631-1000_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\Windows\system32\igfxEM.exe (Intel Corporation)
 
==================== Scheduled Tasks (Whitelisted) =============
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
Task: {0C38AE2D-18A0-48F0-B68B-E17B888171DD} - System32\Tasks\AVAST Software\Avast settings backup => C:\Program Files\Common Files\AV\avast! Antivirus\backup.exe [2016-05-19] (AVAST Software)
Task: {0D08902A-CF89-471C-862F-9D071783454C} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2016-04-22] (Adobe Systems Incorporated)
Task: {25EAF350-C587-4A49-9E13-F1D688B7AEAB} - System32\Tasks\SafeZone scheduled Autoupdate 1458763845 => C:\Program Files\AVAST Software\SZBrowser\launcher.exe [2016-04-15] (Avast Software)
Task: {439ADCDD-9069-427F-BA0A-FDAB1AD5F6DA} - System32\Tasks\{229E9532-8EC8-4310-8097-EDD225B446C7} => pcalua.exe -a C:\Users\salty-san\Desktop\unetbootin-windows-613.exe -d C:\Users\salty-san\Desktop
Task: {46878AA7-1AA3-4113-BEB4-F039108AF39F} - System32\Tasks\MyDefrag v4.3.1 Daily => C:\Program Files\MyDefrag v4.3.1\Scripts\AutomaticDaily.MyD [2010-05-21] ()
Task: {72FCCA83-504A-4CE8-881D-4DD1C857395E} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-11-08] (Google Inc.)
Task: {9E6528B5-9412-4D84-B808-4227D472358D} - System32\Tasks\Opera scheduled Autoupdate 1455818550 => C:\Program Files (x86)\Opera\launcher.exe [2016-05-09] (Opera Software)
Task: {9EF01225-A9E9-4907-B3A6-0BADE76FE6EF} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2016-05-09] (AVAST Software)
Task: {A37295E0-5544-4BDE-AAB5-9F122D4E6FC7} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-11-08] (Google Inc.)
Task: {A819E346-DD87-49B7-8F95-90430AFBC631} - System32\Tasks\Maxthon Update => C:\Program Files (x86)\Maxthon\Bin\Maxthon.exe [2016-04-15] (Maxthon International ltd.)
Task: {C673A044-1E70-4CC0-85C5-F079F0C6596C} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office\Office15\msoia.exe [2012-10-01] (Microsoft Corporation)
Task: {CA4A6E7F-6B77-414B-B595-97CDD1B0B259} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exe [2012-10-01] (Microsoft Corporation)
Task: {CE4E4352-61BE-4AEA-B41F-74A61CC1BA25} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office\Office15\msoia.exe [2012-10-01] (Microsoft Corporation)
Task: {E5DBA818-1F9F-4B43-AC1E-570F51A6036D} - System32\Tasks\MyDefrag v4.3.1 Monthly => C:\Program Files\MyDefrag v4.3.1\Scripts\AutomaticMonthly.MyD [2010-05-21] ()
 
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
 
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
 
==================== Shortcuts =============================
 
(The entries could be listed to be restored or removed.)
 
ShortcutWithArgument: C:\Users\salty-san\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\WarThunder.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> –app=hxxp://mmotraffic.com/catalog/goplay/1000932/MTE3NjYvLy8xMDAwOTMy/?subid=1&click;_id=f984d853cd97333527c0ee9ca74c3b195050a05f –start-fullscreen
 
==================== Loaded Modules (Whitelisted) ==============
 
2012-10-01 21:36 - 2012-10-01 21:36 - 06522480 _____ () C:\Program Files\Microsoft Office\Office15\1033\GrooveIntlResource.dll
2016-05-09 20:42 - 2016-05-09 20:42 - 00123344 _____ () C:\Program Files\AVAST Software\Avast\log.dll
2016-05-09 20:42 - 2016-05-09 20:42 - 00135816 _____ () C:\Program Files\AVAST Software\Avast\JsonRpcServer.dll
2016-05-20 23:04 - 2016-05-20 23:04 - 02972704 _____ () C:\Program Files\AVAST Software\Avast\defs\16052007\algo.dll
2016-05-09 20:42 - 2016-05-09 20:42 - 00309912 _____ () C:\Program Files\AVAST Software\Avast\browser_pass.dll
2016-05-09 20:42 - 2016-05-09 20:42 - 00479680 _____ () C:\Program Files\AVAST Software\Avast\ffl2.dll
2016-05-21 18:25 - 2016-05-21 18:25 - 02975840 _____ () C:\Program Files\AVAST Software\Avast\defs\16052100\algo.dll
2015-08-19 10:13 - 2015-08-19 10:13 - 00952232 _____ () C:\Program Files (x86)\Maxthon App Store\1.1.0.10848\Plugins\Plugin.ServShellEx\ServShellEx.dll
2016-01-04 22:52 - 2016-01-04 22:52 - 40539648 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
 
==================== Alternate Data Streams (Whitelisted) =========
 
(If an entry is included in the fixlist, only the ADS will be removed.)
 
AlternateDataStreams: C:\Users\salty-san\Desktop\rufus-2.4.exe:xdg.origin.url [45]
AlternateDataStreams: C:\Users\salty-san\Desktop\rufus-2.4.exe:xdg.referrer.url [22]
 
==================== Safe Mode (Whitelisted) ===================
 
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Hamachi2Svc => ""="Service"
 
==================== Association (Whitelisted) ===============
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
 
 
==================== Internet Explorer trusted/restricted ===============
 
(If an entry is included in the fixlist, it will be removed from the registry.)
 
 
==================== Hosts content: ===============================
 
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 
2009-07-14 05:34 - 2016-03-13 18:42 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
 
 
==================== Other Areas ============================
 
(Currently there is no automatic fix for this section.)
 
HKU\S-1-5-21-384921765-1548902971-3406650631-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\salty-san\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: Media is not connected to internet.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.
 
==================== MSCONFIG/TASK MANAGER disabled items ==
 
(Currently there is no automatic fix for this section.)
 
 
==================== FirewallRules (Whitelisted) ===============
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
FirewallRules: [{01DD5918-283F-4F3C-AC26-AF593412DF9F}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{4C05ACD7-2D66-4535-9966-F85B04F67719}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{508DDC13-5096-41A1-BE2C-A24C77183C13}] => (Block) D:\WASTELAND!\Wasteland 2 Directors Cut\Build\WL2.exe
FirewallRules: [TCP Query User{EEB53623-0283-483F-B645-04DD48C46786}C:\users\salty-san\documents\octgn\octgn\octgn.exe] => (Allow) C:\users\salty-san\documents\octgn\octgn\octgn.exe
FirewallRules: [UDP Query User{14C2698F-42A4-41BB-9169-2211FDC0ECB1}C:\users\salty-san\documents\octgn\octgn\octgn.exe] => (Allow) C:\users\salty-san\documents\octgn\octgn\octgn.exe
FirewallRules: [TCP Query User{DF6BC443-CABE-4E5A-9F0E-F4C4A78535F6}C:\users\salty-san\documents\octgn\octgn\octgn.exe] => (Allow) C:\users\salty-san\documents\octgn\octgn\octgn.exe
FirewallRules: [UDP Query User{0D9DECF9-7EE8-4932-81B6-5AA519CD2957}C:\users\salty-san\documents\octgn\octgn\octgn.exe] => (Allow) C:\users\salty-san\documents\octgn\octgn\octgn.exe
FirewallRules: [{F89C0384-F502-44A5-B00A-9826C8B9E172}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{BB9DFD0F-5CC0-4A92-A4C5-E4DE9031F0C6}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{19FBF323-28DA-4563-9196-790954D5F72D}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe
FirewallRules: [{5D4FF2EB-07A6-4F96-AFF0-58616E255410}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe
FirewallRules: [{95B66243-C6D0-4B85-90F6-547B69CE822E}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe
FirewallRules: [{BCFAED00-B5EE-4558-AFC6-E54BC68D9562}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe
FirewallRules: [TCP Query User{B247EA9C-0A1B-4E95-8AC0-562403FC4950}C:\users\salty-san\documents\octgn\octgn\octgn.online.standaloneserver.exe] => (Allow) C:\users\salty-san\documents\octgn\octgn\octgn.online.standaloneserver.exe
FirewallRules: [UDP Query User{260782A1-34CD-4BA2-9F89-72C24BA3BF7B}C:\users\salty-san\documents\octgn\octgn\octgn.online.standaloneserver.exe] => (Allow) C:\users\salty-san\documents\octgn\octgn\octgn.online.standaloneserver.exe
FirewallRules: [TCP Query User{AD90B0F5-5A10-4C62-A7A3-3CBA144F4692}D:\playboard\call of duty 2  full game  mp - sp  -=aviara=-\call of duty 2\cod2mp_s.exe] => (Block) D:\playboard\call of duty 2  full game  mp - sp  -=aviara=-\call of duty 2\cod2mp_s.exe
FirewallRules: [UDP Query User{E45AB548-5CA2-49FC-BCAA-420157AA80F9}D:\playboard\call of duty 2  full game  mp - sp  -=aviara=-\call of duty 2\cod2mp_s.exe] => (Block) D:\playboard\call of duty 2  full game  mp - sp  -=aviara=-\call of duty 2\cod2mp_s.exe
FirewallRules: [{9D79CD9D-1138-4471-9107-72DC3CDE88B1}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe
FirewallRules: [{3BFEB175-5043-44EA-B2C6-7D52F51741EE}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe
FirewallRules: [{2E2BBFA3-FB0B-479D-85AD-963E99B02215}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe
FirewallRules: [{2BEE2144-B70C-4420-BC9E-5A25585FF686}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe
FirewallRules: [{05C545A5-8C9C-41C3-B89E-E65D6D8A0192}] => (Allow) C:\Program Files (x86)\Winamp\winamp.exe
FirewallRules: [{E91111AF-B2E6-4408-A180-D898C8699190}] => (Allow) C:\Program Files (x86)\Winamp\winamp.exe
FirewallRules: [TCP Query User{69F0FD99-0EC7-4032-A241-6D327E2A6239}C:\users\salty-san\documents\octgn\octgn\octgn.online.standaloneserver.exe] => (Allow) C:\users\salty-san\documents\octgn\octgn\octgn.online.standaloneserver.exe
FirewallRules: [UDP Query User{68EFF557-0A01-48DF-ADF5-F95A6BCF5C2F}C:\users\salty-san\documents\octgn\octgn\octgn.online.standaloneserver.exe] => (Allow) C:\users\salty-san\documents\octgn\octgn\octgn.online.standaloneserver.exe
FirewallRules: [TCP Query User{78AF15E1-CC17-4FE7-BDCE-5427620D4861}D:\zergoth!\the minks!\portable\mirc\mirc.exe] => (Allow) D:\zergoth!\the minks!\portable\mirc\mirc.exe
FirewallRules: [UDP Query User{36A39718-5949-41EE-93B6-6318ACE5812B}D:\zergoth!\the minks!\portable\mirc\mirc.exe] => (Allow) D:\zergoth!\the minks!\portable\mirc\mirc.exe
FirewallRules: [TCP Query User{4CDB7BB9-A122-4B17-BA93-EF671730BED0}D:\playboard\duel masters civilization!\duelmasters\duelmasters.exe] => (Allow) D:\playboard\duel masters civilization!\duelmasters\duelmasters.exe
FirewallRules: [UDP Query User{9EDB7F0F-B21C-4096-9A73-82A834AABA6D}D:\playboard\duel masters civilization!\duelmasters\duelmasters.exe] => (Allow) D:\playboard\duel masters civilization!\duelmasters\duelmasters.exe
FirewallRules: [{4C549C43-8769-43DD-9C4C-D832FAD6EA76}] => (Block) D:\playboard\duel masters civilization!\duelmasters\duelmasters.exe
FirewallRules: [{EAC4EBEF-0920-44DC-BE2C-0C1DE5FD23B7}] => (Block) D:\playboard\duel masters civilization!\duelmasters\duelmasters.exe
FirewallRules: [{BF29B07C-1C68-4FFD-A4D3-2A5E6A990D3D}] => (Allow) C:\Program Files (x86)\Microsoft Games\Dungeon Siege 2\DungeonSiege2.exe
FirewallRules: [{CA9D005B-CFBA-4074-8BAC-879957D3F610}] => (Allow) C:\Program Files (x86)\Microsoft Games\Dungeon Siege 2\DungeonSiege2.exe
FirewallRules: [{7EC18199-F2F4-4E81-808E-B4AF8C069627}] => (Allow) C:\Program Files (x86)\Maxthon\Bin\MxUp.exe
FirewallRules: [{4051053A-8CCA-4822-B6DF-EB780F910B61}] => (Allow) C:\Program Files (x86)\Maxthon\Bin\Maxthon.exe
FirewallRules: [{D42F9D68-6F43-4682-B3ED-C973FE575538}] => (Allow) C:\Program Files (x86)\Maxthon\Bin\Maxthon.exe
FirewallRules: [{2478CB98-BB64-4FA9-842C-5FC7598BD6DB}] => (Allow) C:\Program Files (x86)\Maxthon\Bin\MxUp.exe
FirewallRules: [{1EE51A2D-F50E-4993-A34B-65E5CE39866A}] => (Allow) C:\Program Files (x86)\Maxthon\Bin\Maxthon.exe
FirewallRules: [{F5DD2F8C-BC93-471C-9078-4D647E90DCE4}] => (Allow) C:\Program Files (x86)\Maxthon\Bin\Maxthon.exe
FirewallRules: [{616F09ED-6DEE-4DB2-B541-38366AAC8A1C}] => (Allow) C:\Program Files (x86)\Maxthon\Bin\MxUp.exe
FirewallRules: [{C3F233A1-A686-4A64-9179-318E8C697C57}] => (Allow) C:\Program Files (x86)\Maxthon\Bin\MxUp.exe
FirewallRules: [{E7707FA7-619D-4097-BB68-C78DB33F533E}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
FirewallRules: [TCP Query User{947EFFAD-F69E-4185-AC31-C5B988C9D459}C:\gog games\impossible creatures\ic.exe] => (Allow) C:\gog games\impossible creatures\ic.exe
FirewallRules: [UDP Query User{350CBCCF-86C4-4DD0-9F00-93692E8138D8}C:\gog games\impossible creatures\ic.exe] => (Allow) C:\gog games\impossible creatures\ic.exe
 
==================== Restore Points =========================
 
18-05-2016 22:28:26 Scheduled Checkpoint
18-05-2016 23:25:13 Installed FreeUndelete 2.1.36867.1
18-05-2016 23:26:55 Installed FreeUndelete 2.1.36867.1
21-05-2016 10:19:27 ComboFix created restore point
 
==================== Faulty Device Manager Devices =============
 
Name: PCI Encryption/Decryption Controller
Description: PCI Encryption/Decryption Controller
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
 
Name: 
Description: 
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
 
Name: 
Description: 
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
 
Name: 
Description: 
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
 
Name: 
Description: 
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
 
Name: 
Description: 
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
 
 
==================== Event log errors: =========================
 
Application errors:
==================
Error: (05/21/2016 06:27:09 PM) (Source: lupdate) (EventID: 0) (User: )
Description: lupdateloopTime is  failed w/err 0x00002da0
 
Error: (05/21/2016 06:27:07 PM) (Source: lupdate) (EventID: 0) (User: )
Description: lupdateloopNum1++, loopNum1 is  failed w/err 0x00000001
 
Error: (05/21/2016 06:13:39 PM) (Source: lupdate) (EventID: 0) (User: )
Description: lupdateloopTime is  failed w/err 0x00000323
 
Error: (05/21/2016 06:10:28 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
Error: (05/21/2016 10:29:07 AM) (Source: lupdate) (EventID: 0) (User: )
Description: lupdateloopTime is  failed w/err 0x00002c1a
 
Error: (05/21/2016 10:29:07 AM) (Source: lupdate) (EventID: 0) (User: )
Description: lupdateloopNum1++, loopNum1 is  failed w/err 0x00000001
 
Error: (05/21/2016 10:24:32 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: PEV.exe, version: 0.0.0.0, time stamp: 0x4e06cfe8
Faulting module name: PEV.exe, version: 0.0.0.0, time stamp: 0x4e06cfe8
Exception code: 0x40000015
Fault offset: 0x0008d1c0
Faulting process id: 0x13d4
Faulting application start time: 0xPEV.exe0
Faulting application path: PEV.exe1
Faulting module path: PEV.exe2
Report Id: PEV.exe3
 
Error: (05/21/2016 10:19:37 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.
 
Details:
AddWin32ServiceFiles: Unable to back up image of service Panda Security CloudCLeaner Service since QueryServiceConfig API failed
 
System Error:
The system cannot find the file specified.
.
 
Error: (05/21/2016 10:18:34 AM) (Source: lupdate) (EventID: 0) (User: )
Description: lupdateloopTime is  failed w/err 0x0000026e
 
Error: (05/21/2016 10:15:25 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
 
System errors:
=============
Error: (05/21/2016 10:37:31 AM) (Source: DCOM) (EventID: 10010) (User: )
Description: {995C996E-D918-4A8C-A302-45719A6F4EA7}
 
Error: (05/21/2016 10:31:14 AM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: The PEVSystemStart service is marked as an interactive service.  However, the system is configured to not allow interactive services.  This service may not function properly.
 
Error: (05/21/2016 10:26:39 AM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: The PEVSystemStart service is marked as an interactive service.  However, the system is configured to not allow interactive services.  This service may not function properly.
 
Error: (05/21/2016 10:14:42 AM) (Source: Application Popup) (EventID: 1060) (User: )
Description: \SystemRoot\System32\DRIVERS\PSKMAD.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.
 
Error: (05/21/2016 09:44:37 AM) (Source: Application Popup) (EventID: 1060) (User: )
Description: \SystemRoot\System32\DRIVERS\PSKMAD.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.
 
Error: (05/21/2016 01:33:57 AM) (Source: DCOM) (EventID: 10010) (User: )
Description: {F9717507-6651-4EDB-BFF7-AE615179BCCF}
 
Error: (05/21/2016 12:52:28 AM) (Source: Application Popup) (EventID: 1060) (User: )
Description: \SystemRoot\System32\DRIVERS\PSKMAD.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.
 
Error: (05/19/2016 09:32:26 AM) (Source: Schannel) (EventID: 4119) (User: NT AUTHORITY)
Description: The following fatal alert was received: 80.
 
Error: (05/19/2016 09:30:33 AM) (Source: Schannel) (EventID: 4119) (User: NT AUTHORITY)
Description: The following fatal alert was received: 80.
 
Error: (05/19/2016 09:30:33 AM) (Source: Schannel) (EventID: 4119) (User: NT AUTHORITY)
Description: The following fatal alert was received: 80.
 
 
CodeIntegrity:
===================================
  Date: 2016-01-14 19:28:38.733
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Program Files (x86)\AVG\AVG PC TuneUp\avgdumpx.exe because the set of per-page image hashes could not be found on the system.
 
  Date: 2016-01-14 19:28:38.591
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Program Files (x86)\AVG\AVG PC TuneUp\avgdumpx.exe because the set of per-page image hashes could not be found on the system.
 
  Date: 2016-01-14 19:28:38.368
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Program Files (x86)\AVG\AVG PC TuneUp\avgdumpa.exe because the set of per-page image hashes could not be found on the system.
 
  Date: 2016-01-14 19:28:38.201
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Program Files (x86)\AVG\AVG PC TuneUp\avgdumpa.exe because the set of per-page image hashes could not be found on the system.
 
  Date: 2015-12-17 10:29:48.300
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Program Files (x86)\AVG\AVG PC TuneUp\avgdumpx.exe because the set of per-page image hashes could not be found on the system.
 
  Date: 2015-12-17 10:29:48.191
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Program Files (x86)\AVG\AVG PC TuneUp\avgdumpx.exe because the set of per-page image hashes could not be found on the system.
 
  Date: 2015-12-17 10:29:48.082
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Program Files (x86)\AVG\AVG PC TuneUp\avgdumpx.exe because the set of per-page image hashes could not be found on the system.
 
  Date: 2015-12-16 03:51:45.976
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Program Files (x86)\AVG\AVG PC TuneUp\avgdumpx.exe because the set of per-page image hashes could not be found on the system.
 
  Date: 2015-12-16 03:51:45.867
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Program Files (x86)\AVG\AVG PC TuneUp\avgdumpx.exe because the set of per-page image hashes could not be found on the system.
 
  Date: 2015-12-16 03:51:45.773
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Program Files (x86)\AVG\AVG PC TuneUp\avgdumpx.exe because the set of per-page image hashes could not be found on the system.
 
 
==================== Memory info =========================== 
 
Processor: Intel(R) Celeron(R) CPU N2840 @ 2.16GHz
Percentage of memory in use: 39%
Total physical RAM: 3981.36 MB
Available physical RAM: 2397.43 MB
Total Virtual: 7960.93 MB
Available Virtual: 6331.75 MB
 
==================== Drives ================================
 
Drive c: () (Fixed) (Total:122.07 GB) (Free:48.27 GB) NTFS ==>[drive with boot components (obtained from BCD)]
Drive d: (East) (Fixed) (Total:343.69 GB) (Free:14.28 GB) NTFS
 
==================== MBR & Partition Table ==================
 
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: D9FA2484)
Partition 1: (Not Active) - (Size=343.7 GB) - (Type=07 NTFS)
Partition 2: (Active) - (Size=122.1 GB) - (Type=07 NTFS)
 
==================== End of Addition.txt ============================


Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:19-05-2016
Ran by [removed] (administrator) on SALTYSKY (21-05-2016 18:35:04)
Running from C:\Users\[removed]\Desktop
[removed]
Platform: Windows 7 Ultimate Service Pack 1 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: "C:\Program Files (x86)\SeaMonkey\seamonkey.exe" -requestPending -osint -url "%1")
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 
==================== Processes (Whitelisted) =================
 
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Comodo) C:\Program Files (x86)\Comodo\Dragon\dragon_updater.exe
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe
(Maxthon Inc.) C:\Program Files (x86)\Maxthon App Store\1.1.0.10848\MasSvc.exe
(Maxthon) C:\Program Files (x86)\Maxthon App Store\1.1.0.10848\MaxthonAppstoreSvc.exe
(Maxthon) C:\Program Files (x86)\Maxthon\Modules\Service\Update\MaxthonUpdateSvc.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Epic Privacy Browser) C:\Users\salty-san\AppData\Local\Epic Privacy Browser\Installer\EpicUpdate.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Lenovo) C:\Windows\System32\LenovoUpdate.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(Intel Corporation) C:\Windows\System32\igfxTray.exe
(Power Software Ltd) C:\Program Files\PowerISO\PWRISOVM.EXE
(Nullsoft, Inc.) C:\Program Files (x86)\Winamp\winampa.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
 
 
==================== Registry (Whitelisted) ===========================
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 
HKLM\…\Run: [Eraser] => C:\Program Files\Eraser\Eraser.exe [1074088 2015-09-03] (The Eraser Project)
HKLM-x32\…\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [292848 2014-06-09] (Intel Corporation)
HKLM-x32\…\Run: [PWRISOVM.EXE] => C:\Program Files\PowerISO\PWRISOVM.EXE [408888 2015-07-23] (Power Software Ltd)
HKLM-x32\…\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [7400576 2016-05-12] (AVAST Software)
HKLM-x32\…\Run: [WinampAgent] => C:\Program Files (x86)\Winamp\winampa.exe [85600 2013-12-13] (Nullsoft, Inc.)
HKLM-x32\…\Run: [LogMeIn Hamachi Ui] => C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe [5565448 2016-04-05] (LogMeIn Inc.)
HKU\S-1-5-21-384921765-1548902971-3406650631-1000\…\Run: [Shotty] => C:\Program Files\Shotty\Shotty.exe [724480 2016-02-11] (hxxp://shotty.devs-on.net)
HKU\S-1-5-21-384921765-1548902971-3406650631-1000\…\Run: [Epic Privacy Browser Installer] => C:\Users\salty-san\AppData\Local\Epic Privacy Browser\Installer\EpicUpdate.exe [509096 2016-02-28] (Epic Privacy Browser)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2016-05-09] (AVAST Software)
BootExecute: autocheck autochk * PCloudBroom64.exe \systemroot\system32\BroomData.bitPCloudBroom64.exe \systemroot\system32\BroomData.bit
 
==================== Internet (Whitelisted) ====================
 
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 
Tcpip\..\Interfaces\{BB2A1C55-6917-4C3A-8770-C53876319A70}: [DhcpNameServer] 192.168.0.1
 
Internet Explorer:
==================
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\S-1-5-21-384921765-1548902971-3406650631-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar;=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar;=msnhome
HKU\S-1-5-21-384921765-1548902971-3406650631-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar;=iesearch
HKU\S-1-5-21-384921765-1548902971-3406650631-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.nyaa.se/
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office15\OCHelper.dll [2012-10-01] (Microsoft Corporation)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2016-05-09] (AVAST Software)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL [2012-10-01] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL [2012-10-01] (Microsoft Corporation)
BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll [2012-10-01] (Microsoft Corporation)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2016-05-09] (AVAST Software)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL [2012-10-01] (Microsoft Corporation)
BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL [2012-10-01] (Microsoft Corporation)
DPF: HKLM-x32 {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL [2012-10-01] (Microsoft Corporation)
 
FireFox:
========
FF ProfilePath: C:\Users\salty-san\AppData\Roaming\Mozilla\Firefox\Profiles\kl9fv1vt.default
FF DefaultSearchEngine: DuckDuckGo
FF Session Restore: -> is enabled.
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~2\Office15\NPSPWRAP.DLL [2012-10-01] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2012-10-01] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL [2012-10-01] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.30.3\npGoogleUpdate3.dll [2016-05-11] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.30.3\npGoogleUpdate3.dll [2016-05-11] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.2.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-04-13] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2016-05-03] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-384921765-1548902971-3406650631-1000: @updates.epicbrowser.com/Epic Privacy Browser Installer;version=3 -> C:\Users\salty-san\AppData\Local\Epic Privacy Browser\Installer\1.3.27.13\npEpicUpdate3.dll [2016-02-28] (Epic Privacy Browser)
FF Plugin HKU\S-1-5-21-384921765-1548902971-3406650631-1000: @updates.epicbrowser.com/Epic Privacy Browser Installer;version=9 -> C:\Users\salty-san\AppData\Local\Epic Privacy Browser\Installer\1.3.27.13\npEpicUpdate3.dll [2016-02-28] (Epic Privacy Browser)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll [2012-10-01] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2016-05-03] (Adobe Systems Inc.)
FF HKLM\…\Firefox\Extensions: [[removed]] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2016-05-09]
FF HKLM-x32\…\Firefox\Extensions: [[removed]] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF HKLM-x32\…\Firefox\Extensions: [[removed]] - C:\Program Files\AVAST Software\Avast\SafePrice\FF
FF Extension: Avast SafePrice - C:\Program Files\AVAST Software\Avast\SafePrice\FF [2016-05-09]
 
Chrome: 
=======
CHR Session Restore: Default -> is enabled.
CHR Profile: C:\Users\salty-san\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Slides) - C:\Users\salty-san\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-11-08]
CHR Extension: (Google Docs) - C:\Users\salty-san\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-11-08]
CHR Extension: (Google Drive) - C:\Users\salty-san\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-11-08]
CHR Extension: (YouTube) - C:\Users\salty-san\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-11-08]
CHR Extension: (Google Search) - C:\Users\salty-san\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-11-08]
CHR Extension: (Google Sheets) - C:\Users\salty-san\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-11-08]
CHR Extension: (Google Docs Offline) - C:\Users\salty-san\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-03-17]
CHR Extension: (Avast Online Security) - C:\Users\salty-san\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2016-04-08]
CHR Extension: (Chrome Web Store Payments) - C:\Users\salty-san\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-04-03]
CHR Extension: (Gmail) - C:\Users\salty-san\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-11-08]
CHR HKLM-x32\…\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2016-05-09]
 
==================== Services (Whitelisted) ========================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [243296 2016-05-09] (AVAST Software)
R2 DragonUpdater; C:\Program Files (x86)\Comodo\Dragon\dragon_updater.exe [2307768 2016-05-05] (Comodo)
R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [318568 2014-10-10] (Intel Corporation)
R3 LenovoUpdate; C:\Windows\System32\LenovoUpdate.exe [26608 2016-05-21] (Lenovo)
R2 LMIGuardianSvc; C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe [417552 2016-04-05] (LogMeIn, Inc.)
R2 MasSvc_{MaxthonAppStore_1.1.0.10848}; C:\Program Files (x86)\Maxthon App Store\1.1.0.10848\MasSvc.exe [563112 2015-08-19] (Maxthon Inc.)
R2 MaxthonAppStoreSvc; C:\Program Files (x86)\Maxthon App Store\1.1.0.10848\MaxthonAppstoreSvc.exe [1867544 2015-08-11] (Maxthon)
R2 MaxthonUpdateSvc; C:\Program Files (x86)\Maxthon\Modules\Service\Update\MaxthonUpdateSvc.exe [1872152 2015-05-11] (Maxthon)
S3 rpcapd; C:\Program Files (x86)\WinPcap\rpcapd.exe [118520 2013-03-01] (Riverbed Technology, Inc.)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2015-08-05] (Microsoft Corporation)
 
===================== Drivers (Whitelisted) ==========================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [37656 2016-05-09] (AVAST Software)
R1 aswKbd; C:\Windows\system32\drivers\aswKbd.sys [37144 2016-05-09] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [107792 2016-05-09] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [103064 2016-05-09] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [74544 2016-05-09] (AVAST Software)
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1070904 2016-05-09] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [465792 2016-05-09] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [166432 2016-05-09] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [287528 2016-05-09] (AVAST Software)
S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
R2 NPF; C:\Windows\System32\drivers\npf.sys [36600 2013-03-01] (Riverbed Technology, Inc.)
S3 PSKMAD; C:\Windows\System32\DRIVERS\PSKMAD.sys [50320 2015-01-29] (Panda Security, S.L.)
R3 RSP2STOR; C:\Windows\System32\DRIVERS\RtsP2Stor.sys [294104 2014-12-10] (Realtek Semiconductor Corp.)
R3 RTWlanE; C:\Windows\System32\DRIVERS\rtwlane.sys [3513048 2015-03-23] (Realtek Semiconductor Corporation                           )
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
U3 aswMBR; \??\C:\Users\SALTY-~1\AppData\Local\Temp\aswMBR.sys [X]
 
==================== NetSvcs (Whitelisted) ===================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
 
==================== One Month Created files and folders ========
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2016-05-21 18:35 - 2016-05-21 18:35 - 00014352 _____ C:\Users\salty-san\Desktop\FRST.txt
2016-05-21 10:33 - 2016-05-21 10:33 - 00015428 _____ C:\ComboFix.txt
2016-05-21 10:19 - 2011-06-26 09:45 - 00256000 _____ C:\Windows\PEV.exe
2016-05-21 10:19 - 2010-11-07 20:20 - 00208896 _____ C:\Windows\MBR.exe
2016-05-21 10:19 - 2000-08-31 03:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2016-05-21 10:19 - 2000-08-31 03:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2016-05-21 10:19 - 2000-08-31 03:00 - 00098816 _____ C:\Windows\sed.exe
2016-05-21 10:19 - 2000-08-31 03:00 - 00080412 _____ C:\Windows\grep.exe
2016-05-21 10:19 - 2000-08-31 03:00 - 00068096 _____ C:\Windows\zip.exe
2016-05-21 10:16 - 2016-05-21 10:16 - 05659526 ____R (Swearware) C:\Users\salty-san\Desktop\ItBe.exe
2016-05-21 01:30 - 2013-04-08 16:30 - 00022752 _____ C:\Windows\system32\PCloudBroom64.exe
2016-05-21 01:29 - 2016-05-21 10:11 - 00000322 _____ C:\Windows\SysWOW64\BroomData.bit
2016-05-19 09:48 - 2016-05-21 18:35 - 00000000 ____D C:\FRST
2016-05-19 09:48 - 2016-05-19 09:48 - 02382336 _____ (Farbar) C:\Users\salty-san\Desktop\FRST64.exe
2016-05-19 09:46 - 2016-05-19 09:46 - 05198336 _____ (AVAST Software) C:\Users\salty-san\Desktop\aswMBR.exe
2016-05-19 02:16 - 2016-05-19 02:16 - 00001035 _____ C:\Users\salty-san\Desktop\RMPrepUSB.lnk
2016-05-19 02:16 - 2016-05-19 02:16 - 00000000 ____D C:\Users\salty-san\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\RMPrepUSB
2016-05-19 02:16 - 2016-05-19 02:16 - 00000000 ____D C:\Program Files (x86)\RMPrepUSB
2016-05-19 01:44 - 2016-05-19 02:52 - 00000000 ____D C:\Make_PE3
2016-05-18 23:28 - 2016-05-18 23:28 - 00000000 ____D C:\Users\salty-san\AppData\Roaming\OfficeRecovery
2016-05-18 23:27 - 2016-05-18 23:27 - 00002419 _____ C:\Users\salty-san\Desktop\FreeUndelete.lnk
2016-05-18 23:27 - 2016-05-18 23:27 - 00000000 ____D C:\Users\salty-san\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FreeUndelete
2016-05-18 23:27 - 2016-05-18 23:27 - 00000000 ____D C:\Users\salty-san\AppData\Local\Apps\OfficeRecovery
2016-05-16 16:21 - 2016-05-16 16:21 - 00000902 _____ C:\Users\Public\Desktop\WinToUSB.lnk
2016-05-16 16:21 - 2016-05-16 16:21 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinToUSB
2016-05-16 16:21 - 2016-05-16 16:21 - 00000000 ____D C:\Program Files\WinToUSB
2016-05-16 02:42 - 2009-04-20 07:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2016-05-16 02:37 - 2016-05-16 02:37 - 00000000 ____D C:\TheIt301T
2016-05-16 01:32 - 2015-01-29 19:21 - 00050320 _____ (Panda Security, S.L.) C:\Windows\system32\Drivers\PSKMAD.sys
2016-05-16 01:30 - 2016-05-16 01:32 - 00001282 _____ C:\Users\Public\Desktop\Panda Cloud Cleaner.lnk
2016-05-16 01:30 - 2016-05-16 01:30 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Panda Security
2016-05-16 01:30 - 2016-05-16 01:30 - 00000000 ____D C:\Program Files (x86)\Panda Security
2016-05-12 22:29 - 2016-05-12 22:29 - 00000000 ____D C:\Program Files (x86)\Comodo
2016-05-12 17:33 - 2016-05-12 17:33 - 00000000 ____D C:\ProgramData\Realtek
2016-05-12 15:37 - 2016-05-12 15:37 - 00001649 _____ C:\Users\salty-san\Desktop\LiLi USB Creator - Shortcut.lnk
2016-05-12 10:53 - 2016-05-12 10:53 - 00001233 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Glary Undelete.lnk
2016-05-12 10:53 - 2016-05-12 10:53 - 00001221 _____ C:\Users\Public\Desktop\Glary Undelete.lnk
2016-05-12 10:53 - 2016-05-12 10:53 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Glarysoft
2016-05-12 10:53 - 2016-05-12 10:53 - 00000000 ____D C:\Program Files (x86)\Glarysoft
2016-05-12 10:52 - 2016-05-12 10:52 - 00001106 _____ C:\Users\Public\Desktop\UndeleteMyFiles Pro.lnk
2016-05-12 10:52 - 2016-05-12 10:52 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UndeleteMyFiles
2016-05-12 10:52 - 2016-05-12 10:52 - 00000000 ____D C:\Program Files (x86)\UndeleteMyFiles
2016-05-10 20:54 - 2016-05-10 20:54 - 00001081 _____ C:\Users\Public\Desktop\SWF File Player.lnk
2016-05-10 20:53 - 2016-05-10 20:54 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SWF File Player
2016-05-10 20:53 - 2016-05-10 20:53 - 00000000 ____D C:\Program Files (x86)\SWF File Player
2016-05-10 12:18 - 2016-05-10 12:18 - 00001190 _____ C:\Users\salty-san\Desktop\The I of the Dragon.lnk
2016-05-10 12:17 - 2016-05-10 12:17 - 00000000 ____D C:\Users\salty-san\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Zuxxez
2016-05-10 12:17 - 2016-05-10 12:17 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Zuxxez
2016-05-10 12:15 - 2016-05-10 12:15 - 00000000 ____D C:\Program Files (x86)\Zuxxez
2016-05-09 20:42 - 2016-05-09 20:42 - 00398152 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2016-05-09 20:42 - 2016-05-09 20:42 - 00052184 _____ (AVAST Software) C:\Windows\avastSS.scr
2016-05-08 23:36 - 2016-05-09 00:04 - 00000000 ____D C:\Users\salty-san\AppData\Roaming\avidemux
2016-05-08 23:36 - 2016-05-08 23:36 - 00000914 _____ C:\Users\Public\Desktop\Avidemux 2.6 - 64 bits.lnk
2016-05-08 23:36 - 2016-05-08 23:36 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avidemux (64 bits)
2016-05-08 23:36 - 2016-05-08 23:36 - 00000000 ____D C:\Program Files\Avidemux 2.6 - 64 bits
2016-05-08 20:18 - 2016-05-08 20:18 - 00000000 ____D C:\Users\salty-san\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FunnyGames
2016-05-08 20:18 - 2016-05-08 20:18 - 00000000 ____D C:\Users\salty-san\AppData\Roaming\FunnyGames
2016-05-08 20:18 - 2016-05-08 20:18 - 00000000 ____D C:\Users\salty-san\AppData\Local\FunnyGames
2016-05-04 16:47 - 2016-05-04 16:49 - 00000000 ____D C:\TheIt
2016-05-04 16:16 - 2016-05-05 16:25 - 00000000 ____D C:\Users\salty-san\AppData\Roaming\Avant Profiles
2016-05-04 16:16 - 2016-05-04 16:16 - 00001923 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Avant Browser.lnk
2016-05-04 16:16 - 2016-05-04 16:16 - 00001917 _____ C:\Users\Public\Desktop\Avant Browser.lnk
2016-05-04 16:16 - 2016-05-04 16:16 - 00000000 ____D C:\Users\salty-san\AppData\Roaming\Avant Downloader
2016-05-04 16:16 - 2016-05-04 16:16 - 00000000 ____D C:\Users\salty-san\AppData\Local\Chromium
2016-05-04 16:16 - 2016-05-04 16:16 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avant Browser
2016-05-04 16:16 - 2016-05-04 16:16 - 00000000 ____D C:\Program Files (x86)\Avant Browser
2016-05-04 16:13 - 2016-05-21 09:53 - 00000000 ____D C:\Users\salty-san\AppData\Roaming\SlimBrowser
2016-05-04 16:08 - 2016-05-16 02:03 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FlashPeak SlimBrowser
2016-05-04 16:08 - 2016-05-04 16:08 - 00001021 _____ C:\Users\Public\Desktop\FlashPeak SlimBrowser.lnk
2016-05-04 16:07 - 2016-05-04 16:08 - 00000000 ____D C:\Program Files (x86)\SlimBrowser
2016-05-04 15:54 - 2016-05-04 15:54 - 00001226 _____ C:\Users\Public\Desktop\Comodo Dragon.lnk
2016-05-04 15:54 - 2016-05-04 15:54 - 00000000 ____D C:\Users\salty-san\AppData\Local\Comodo
2016-05-04 15:54 - 2016-05-04 15:54 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Comodo
2016-05-04 15:52 - 2016-05-04 15:52 - 01700352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdiplus.dll
2016-05-04 15:52 - 2016-05-04 15:52 - 01060864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfc71.dll
2016-05-04 15:52 - 2016-05-04 15:52 - 00348160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcr71.dll
2016-05-04 15:24 - 2016-05-04 15:24 - 00003600 _____ C:\Windows\System32\Tasks\Maxthon Update
2016-05-04 15:24 - 2016-05-04 15:24 - 00001081 _____ C:\Users\Public\Desktop\Maxthon Cloud Browser.lnk
2016-05-04 15:24 - 2016-05-04 15:24 - 00000000 ____D C:\Users\salty-san\AppData\Roaming\Maxthon3
2016-05-04 15:23 - 2016-05-04 15:24 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maxthon Cloud Browser
2016-05-04 15:23 - 2016-05-04 15:24 - 00000000 ____D C:\Program Files (x86)\Maxthon
2016-05-04 15:23 - 2016-05-04 15:23 - 00001295 _____ C:\Users\Public\Desktop\Maxthon App Store.lnk
2016-05-04 15:23 - 2016-05-04 15:23 - 00000000 ____D C:\Users\salty-san\AppData\Roaming\Maxthon App Store
2016-05-04 15:23 - 2016-05-04 15:23 - 00000000 ____D C:\Users\Public\Documents\Baidu
2016-05-04 15:23 - 2016-05-04 15:23 - 00000000 ____D C:\Program Files (x86)\Maxthon App Store
2016-05-03 22:51 - 2016-05-21 00:23 - 00003942 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{F51745E5-CA05-4A07-82FD-E977DEA96A94}
2016-04-27 16:46 - 2016-04-27 16:46 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi
2016-04-27 16:46 - 2016-04-27 16:46 - 00000000 ____D C:\Program Files (x86)\LogMeIn Hamachi
2016-04-27 16:46 - 2016-04-05 16:18 - 00034720 ____H (LogMeIn, Inc.) C:\Windows\system32\hamachi.sys
2016-04-26 23:51 - 2016-04-26 23:51 - 00000000 ____D C:\ProgramData\RELOADED
2016-04-26 23:36 - 2016-04-26 23:36 - 00000850 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Torchlight II.lnk
2016-04-26 23:36 - 2016-04-26 23:36 - 00000838 _____ C:\Users\Public\Desktop\Torchlight II.lnk
2016-04-26 23:35 - 2016-04-26 23:41 - 00000000 ____D C:\Program Files (x86)\Torchlight II
 
==================== One Month Modified files and folders ========
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2016-05-21 18:21 - 2016-01-08 20:03 - 00000000 ____D C:\Program Files (x86)\Opera
2016-05-21 18:19 - 2009-07-14 07:45 - 00026352 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2016-05-21 18:19 - 2009-07-14 07:45 - 00026352 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2016-05-21 18:16 - 2016-01-04 22:52 - 00004182 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2016-05-21 18:16 - 2009-07-14 08:13 - 00781298 _____ C:\Windows\system32\PerfStringBackup.INI
2016-05-21 18:16 - 2009-07-14 06:20 - 00000000 ____D C:\Windows\inf
2016-05-21 18:10 - 2016-03-06 15:37 - 00000000 ____D C:\Users\salty-san\AppData\Local\LogMeIn Hamachi
2016-05-21 18:10 - 2016-02-11 19:04 - 00000000 ____D C:\Users\salty-san\AppData\Local\Shotty
2016-05-21 18:10 - 2015-11-08 00:30 - 00000894 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2016-05-21 18:09 - 2015-11-01 23:10 - 00097264 _____ (Lenovo (Beijing) Limited) C:\Windows\system32\LenovoCheck.exe
2016-05-21 18:09 - 2015-11-01 23:10 - 00026608 _____ (Lenovo) C:\Windows\system32\LenovoUpdate.exe
2016-05-21 18:09 - 2009-07-14 08:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-05-21 12:54 - 2015-11-08 00:30 - 00000898 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2016-05-21 10:33 - 2016-03-28 15:49 - 00000000 ____D C:\Qoobox
2016-05-21 10:31 - 2009-07-14 05:34 - 00000215 _____ C:\Windows\system.ini
2016-05-20 19:18 - 2016-02-10 21:08 - 00000000 ____D C:\Users\salty-san\Documents\Mount&Blade; Savegames
2016-05-19 21:16 - 2016-02-10 20:58 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GOG.com
2016-05-19 21:16 - 2009-07-14 08:32 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2016-05-19 20:52 - 2016-02-10 20:57 - 00000000 ____D C:\GOG Games
2016-05-19 20:49 - 2016-03-26 23:47 - 00000000 ____D C:\Games
2016-05-18 09:24 - 2015-12-04 12:06 - 00000000 ____D C:\Users\salty-san\AppData\Roaming\vlc
2016-05-17 15:12 - 2016-02-18 17:23 - 00000440 __RSH C:\ProgramData\ntuser.pol
2016-05-13 15:46 - 2016-02-18 21:02 - 00003846 _____ C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1455818550
2016-05-13 08:57 - 2015-11-08 00:30 - 00002195 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2016-05-13 08:57 - 2015-11-08 00:30 - 00002183 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2016-05-12 16:11 - 2016-03-31 15:41 - 00000000 ____D C:\Users\salty-san\Documents\Mami
2016-05-11 11:49 - 2015-11-08 00:30 - 00003894 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2016-05-11 11:49 - 2015-11-08 00:30 - 00003642 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2016-05-11 11:06 - 2016-01-03 02:38 - 00003886 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task
2016-05-11 11:05 - 2016-01-03 02:37 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2016-05-10 12:18 - 2016-01-03 22:46 - 00000000 ____D C:\Users\salty-san\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
2016-05-10 08:55 - 2016-03-23 23:11 - 00003890 _____ C:\Windows\System32\Tasks\SafeZone scheduled Autoupdate 1458763845
2016-05-09 20:42 - 2016-01-04 22:52 - 00465792 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2016-05-09 20:42 - 2016-01-04 22:52 - 00287528 _____ (AVAST Software) C:\Windows\system32\Drivers\aswVmm.sys
2016-05-09 20:42 - 2016-01-04 22:52 - 00166432 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys
2016-05-09 20:42 - 2016-01-04 22:52 - 00107792 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2016-05-09 20:42 - 2016-01-04 22:52 - 00103064 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2016-05-09 20:42 - 2016-01-04 22:52 - 00074544 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRvrt.sys
2016-05-09 20:42 - 2016-01-04 22:52 - 00037656 _____ (AVAST Software) C:\Windows\system32\Drivers\aswHwid.sys
2016-05-09 20:41 - 2016-03-23 23:10 - 00037144 _____ (AVAST Software) C:\Windows\system32\Drivers\aswKbd.sys
2016-05-09 20:41 - 2016-01-04 22:52 - 01070904 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2016-05-04 18:27 - 2009-07-14 08:08 - 00032654 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2016-05-04 16:35 - 2015-11-01 13:21 - 00000000 ____D C:\Users\salty-san
2016-04-30 00:08 - 2016-02-05 02:35 - 00000000 ____D C:\Program Files (x86)\SeaMonkey
2016-04-29 21:06 - 2015-11-05 17:02 - 00000000 ____D C:\Users\salty-san\AppData\Local\Microsoft Games
2016-04-26 23:51 - 2015-11-01 19:10 - 00000000 ____D C:\Users\salty-san\Documents\My Games
2016-04-21 06:35 - 2016-02-04 16:16 - 00000000 ____D C:\Program Files\MyDefrag v4.3.1
 
==================== Files in the root of some directories =======
 
2016-03-13 14:21 - 2016-03-21 22:53 - 0000129 _____ () C:\Users\salty-san\AppData\Roaming\Camdata.ini
2016-03-13 14:21 - 2016-03-21 22:53 - 0000408 _____ () C:\Users\salty-san\AppData\Roaming\CamLayout.ini
2016-03-13 14:21 - 2016-03-21 22:53 - 0000408 _____ () C:\Users\salty-san\AppData\Roaming\CamShapes.ini
2016-03-13 14:21 - 2016-03-21 22:53 - 0004548 _____ () C:\Users\salty-san\AppData\Roaming\CamStudio.cfg
2016-03-13 14:21 - 2016-03-21 22:50 - 0000096 _____ () C:\Users\salty-san\AppData\Roaming\version2.xml
 
==================== Bamital & volsnap =================
 
(There is no automatic fix for files that do not pass verification.)
 
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
 
 
LastRegBack: 2016-05-18 07:33
 
==================== End of FRST.txt ============================

:welcome:

 

I see you run Combofix now and then, let me explain why thats not a good idea. As part of the Malware Removal Community, we have been trained to use all the tools and programs that we post, we are also alerted to any updates and problems with them, the public is not. As an example, a few years ago Combofix was pulled offline because a bug in the upgrade causes severe problems with some users and then was put back online the next day after it was fixed. If you would have downloaded and run this program then it may have caused some problems with your system. If you upgrade to Windows 10, Combofix has not been upgrade to run on this system as of the last report I read. I know a lot of people read the forums and run tools that they see fixed other peoples computers…BUT all systems are different, what one tool can fix on one system can damage another so its best not to run tools on your own.

 

 

Lets do so general clean up and see if it helps

 

All our tools and scanners work more efficiently when run from the DESKTOP in lieu of being buried in some folder, so download and run these tools right from the DESKTOP
 
 
-AdwCleaner-by Xplode
 
Click on this link to download : ADWCleaner TO YOUR DESKTOP
 
Use my link only, do not do a search for AdwCleaner as there is a bogus copy going around by scammers
 
[external image: AdwCleaner4.201_zpsxrbk2llq.jpg]
 
 
  •  
  • Close all open programs and internet browsers.
  • Double click on AdwCleaner.exe to run the tool.
  • Click on Scan.
  • After the scan is complete click on "Clean"
  • Confirm each time with Ok.
  • Your computer will be rebooted automatically. A text file will open after the restart.
  • Please post the content of that logfile with your next reply.
  • You can find the logfile at C:\AdwCleaner[S1].txt as well.
 
 
 
===============================================================================
 
 
 
 
[external image: Capture_zpsge1t2tk9.jpg] Please download Junkware Removal Tool TO YOUR DESKTOP
  •  
  • Download the one from Bleeping Computer
  • Shut down your protection software now to avoid potential conflicts.
  • Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
  • The tool will open and start scanning your system.
  • Please be patient as this can take a while to complete depending on your system's specifications.
  • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
  • Post the contents of JRT.txt into your next message.
 
 
 
 
===============================================================================
 
Download Malwarebytes' Anti-Malware  TO YOUR DESKTOP
 
  •  
  • Windows XP : Double click on the icon to run it.
  • Windows Vista, Windows 7 , 8, 8.1 and 10 : Right click and select "Run as Administrator"
 
 
[external image: MBAM220_zpsox89gdej.jpg]
 
  •  
  • On the Dashboard click on Update Now
  • Go to the Setting Tab
  • Under Setting go to Detection and Protection
  • Under PUP and PUM make sure both are set to show Treat Detections as Malware
  • Go to Advanced setting and make sure Automatically Quarantine Detected Items is checked
  • Then on the Dashboard click on Scan
  • Make sure to select THREAT SCAN
  • Then click on Scan
  • When the scan is finished on the bottom right click on SAVE RESULTS then select Copy to Clipboard
  • Please paste the log back into this thread for review
  • Exit Malwarebytes
 

 

 

Yeah I want to break away from using ComboFix cause it caused troubles last time, I just used it cause I heard it's the overall best there is and all that, plus I don't want to waste people's time on forums if my problems are not that serious. But I will try to use other tools now that I am more aware of what they are and also try to seek advice when I can, plus it seems in general my comp is pretty clean nowadays.

The logs….
 

# AdwCleaner v5.117 - Logfile created 24/05/2016 at 15:07:01
# Updated 15/05/2016 by Xplode
# Database : 2016-05-15.2 [Local]
# Operating system : Windows 7 Ultimate Service Pack 1 (X64)
# Username : salty-san - SALTYSKY
# Running from : C:\Users\salty-san\Desktop\AdwCleaner.exe
# Option : Clean
# Support : http://toolslib.net/forum
 
***** [ Services ] *****
 
[-] Service Deleted : MasSvc_{MaxthonAppStore_1.1.0.10848}
 
***** [ Folders ] *****
 
[-] Folder Deleted : C:\ProgramData\ByteFence
[#] Folder Deleted : C:\ProgramData\Application Data\ByteFence
[-] Folder Deleted : C:\Users\salty-san\AppData\Local\torch
[-] Folder Deleted : C:\Users\salty-san\AppData\LocalLow\pandasecuritytb
[-] Folder Deleted : C:\Users\salty-san\AppData\Roaming\Mozilla\Firefox\Profiles\kl9fv1vt.default\pandasecuritytb
 
***** [ Files ] *****
 
 
***** [ DLLs ] *****
 
 
***** [ WMI ] *****
 
 
***** [ Shortcuts ] *****
 
[-] Shortcut Disinfected : C:\Users\salty-san\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\WarThunder.lnk
 
***** [ Scheduled tasks ] *****
 
 
***** [ Registry ] *****
 
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4}
[-] Key Deleted : HKCU\Software\PRODUCTSETUP
[-] Key Deleted : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\st.chatango.com
 
***** [ Web browsers ] *****
 
[-] [C:\Users\salty-san\AppData\Local\Google\Chrome\User Data\Default\Web Data] [Search Provider] Deleted : aol.com
[-] [C:\Users\salty-san\AppData\Local\Google\Chrome\User Data\Default\Web Data] [Search Provider] Deleted : ask.com
[-] [C:\Users\salty-san\AppData\Local\Comodo\Dragon\User Data\Default\Web Data] [Search Provider] Deleted : yahoo.com
[-] [C:\Users\salty-san\AppData\Local\Comodo\Dragon\User Data\Default\Web Data] [Search Provider] Deleted : aol.com
[-] [C:\Users\salty-san\AppData\Local\Comodo\Dragon\User Data\Default\Web Data] [Search Provider] Deleted : ask.com
 
*************************
 
:: "Tracing" keys deleted
:: Winsock settings cleared
 
*************************
 
C:\AdwCleaner\AdwCleaner[C1].txt - [2124 bytes] - [24/05/2016 15:07:01]
C:\AdwCleaner\AdwCleaner[S1].txt - [2335 bytes] - [24/05/2016 15:04:22]
 
########## EOF - C:\AdwCleaner\AdwCleaner[C1].txt - [2270 bytes] ##########


 
 
 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.0.6 (04.25.2016)
Operating System: Windows 7 Ultimate x64 
Ran by [removed] (Administrator) on Tue 05/24/2016 at 15:12:16.86
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 
 
 
File System: 10 
 
Successfully deleted: C:\Users\salty-san\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1340G93Q (Temporary Internet Files Folder) 
Successfully deleted: C:\Users\salty-san\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5Z6UAWP1 (Temporary Internet Files Folder) 
Successfully deleted: C:\Users\salty-san\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\702V2OPK (Temporary Internet Files Folder) 
Successfully deleted: C:\Users\salty-san\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OFETY4A1 (Temporary Internet Files Folder) 
Successfully deleted: C:\Users\salty-san\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RLSA1T03 (Temporary Internet Files Folder) 
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1340G93Q (Temporary Internet Files Folder) 
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5Z6UAWP1 (Temporary Internet Files Folder) 
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\702V2OPK (Temporary Internet Files Folder) 
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OFETY4A1 (Temporary Internet Files Folder) 
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RLSA1T03 (Temporary Internet Files Folder) 
 
 
 
Registry: 0 
 
 
 
 
 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Tue 05/24/2016 at 15:17:45.66
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
And the Malawarebytes one looks weird…
 
2016/05/24 15:25:35 +0300
mbam-log-2016-05-24 (15-25-29).xml
yes
2.2.1.1043
v2016.05.24.03
v2016.05.20.01
trial
enabled
enabled
disabled
SALTYSKY
192.168.0.100, 25.96.236.235
Windows 7 Service Pack 1
x64
salty-san
NTFS
threat
completed
304544
614
0
0
1
0
0
0
1
0
enabled
enabled
enabled
enabled
disabled
disabled
enabled
enabled
enabled
Adware.GameVancesuccessfdb65089abeebe78741e5e4cc23fb14f
Adware.GameVancesuccessfdb65089abeebe78741e5e4cc23fb14f
 

 

Hi

 

Yep, its best to not run any of out tools on your own, just under the guidance of a helper

 

Cant read your Malware log the way you posted it, do this

 

 
[external image: MBAM%20Application_zps7zm0ftdm.png]
 
1. Open up Malwarebytes and you will be on the Dashboard
2. Click on the History Tab
3. Then click on Application Logs
4. Double click on the SCAN LOG (Not Protection Log ) you just ran
5. When it opens it will look like this
 
 
 
[external image: MBAM%20Export_zpsjbtttjun.jpg]
 
6. Then click on Export
7. On the drop down list click on Copy to Clipboard
8. Then paste the log back into this thread

Ok here it is…
 

Malwarebytes Anti-Malware
www.malwarebytes.org
 
Scan Date: 5/24/2016
Scan Time: 3:25 PM
Logfile: 1st Malaware.txt
Administrator: Yes
 
Version: 2.2.1.1043
Malware Database: v2016.05.24.03
Rootkit Database: v2016.05.20.01
License: Trial
Malware Protection: Enabled
Malicious Website Protection: Enabled
Self-protection: Disabled
 
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: salty-san
 
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 304544
Time Elapsed: 10 min, 14 sec
 
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled
 
Processes: 0
(No malicious items detected)
 
Modules: 0
(No malicious items detected)
 
Registry Keys: 1
Adware.GameVance, HKU\S-1-5-21-384921765-1548902971-3406650631-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\FunnyGames - gemcraft, Quarantined, [fdb65089abeebe78741e5e4cc23fb14f], 
 
Registry Values: 0
(No malicious items detected)
 
Registry Data: 0
(No malicious items detected)
 
Folders: 0
(No malicious items detected)
 
Files: 1
Adware.GameVance, C:\Users\salty-san\AppData\Local\FunnyGames\gemcraft\gemcraft.exe, Quarantined, [fdb65089abeebe78741e5e4cc23fb14f], 
 
Physical Sectors: 0
(No malicious items detected)
 
 
(end)

Thank you.

 

Open up FRST64 by Right clicking on it and select RUN AS ADMINISTRATOR.  When it opens make sure there is a checkmark in ADDiTIONS , click on SCAN and post both the new FRST64 and Additions logs please

Here they are…Btw forgot to mention some of these problems before but I get weird Internet connection troubles sometimes (via wireless which always worked) and double click bug on Windows and maybe some other small nuisances I forget.
 

Additional scan result of Farbar Recovery Scan Tool (x64) Version:19-05-2016
Ran by [removed] (2016-05-25 19:23:23)
Running from C:\Users\[removed]\Desktop
Windows 7 Ultimate Service Pack 1 (X64) (2015-11-01 10:20:21)
Boot Mode: Normal
==========================================================
 
 
==================== Accounts: =============================
 
Administrator (S-1-5-21-384921765-1548902971-3406650631-500 - Administrator - Disabled)
Guest (S-1-5-21-384921765-1548902971-3406650631-501 - Limited - Disabled)
salty-san (S-1-5-21-384921765-1548902971-3406650631-1000 - Administrator - Enabled) => C:\Users\salty-san
 
==================== Security Center ========================
 
(If an entry is included in the fixlist, it will be removed.)
 
AV: avast! Antivirus (Disabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Disabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
 
==================== Installed Programs ======================
 
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 
7-Zip 15.12 (x64) (HKLM\…\7-Zip) (Version: 15.12 - Igor Pavlov)
7-Zip 15.14 (x64 edition) (HKLM\…\{23170F69-40C1-2702-1514-000001000000}) (Version: 15.14.00.0 - Igor Pavlov)
Adobe Acrobat Reader DC (HKLM-x32\…\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}) (Version: 15.016.20041 - Adobe Systems Incorporated)
Avant Browser (remove only) (HKLM-x32\…\AvantBrowser) (Version: 12.5.0.0 - Avant Force)
Avast Free Antivirus (HKLM-x32\…\Avast) (Version: 11.2.2262 - AVAST Software)
Avidemux 2.6 - 64 bits (HKLM-x32\…\Avidemux 2.6 - 64 bits (64-bit)) (Version: 2.6.12.160304 - )
CamStudio 2.7.4 (HKLM\…\{04B83666-3A62-452B-85D3-70F8117F2329}_is1) (Version: 2.7.4 - CamStudio Open Source)
Canon MP180 (HKLM\…\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP180) (Version:  - )
Cheatbook Database 2016 (HKLM-x32\…\Cheatbook Database 2016) (Version:  - )
Cisco EAP-FAST Module (HKLM-x32\…\{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}) (Version: 2.2.14 - Cisco Systems, Inc.)
Cisco LEAP Module (HKLM-x32\…\{AF312B06-5C5C-468E-89B3-BE6DE2645722}) (Version: 1.0.19 - Cisco Systems, Inc.)
Cisco PEAP Module (HKLM-x32\…\{0A4EF0E6-A912-4CDE-A7F3-6E56E7C13A2F}) (Version: 1.1.6 - Cisco Systems, Inc.)
Comodo Dragon (HKLM-x32\…\Comodo Dragon) (Version: 49.13.20.400 - Comodo)
Diablo II (HKLM-x32\…\Diablo II) (Version:  - )
Dungeon Siege 2 (HKLM-x32\…\DungeonSiege2) (Version:  - Microsoft)
Epic Privacy Browser (HKU\S-1-5-21-384921765-1548902971-3406650631-1000\…\Epic) (Version: 48.0.2553.0 - Epic)
Eraser 6.2.0.2970 (HKLM\…\{58F37E51-2A83-49F3-9117-6005C63CF399}) (Version: 6.2.2970 - The Eraser Project)
ESET Online Scanner v3 (HKLM-x32\…\ESET Online Scanner) (Version:  - )
FlashPeak SlimBrowser (HKLM-x32\…\SlimBrowser) (Version: 7.00.143 - FlashPeak Inc.)
FlashRip(Full Version) (HKLM-x32\…\FlashRip(Full Version)_is1) (Version:  - )
foobar2000 v1.3.9 (HKLM-x32\…\foobar2000) (Version: 1.3.9 - Peter Pawlowski)
Fraps (HKLM-x32\…\Fraps) (Version:  - )
Free Virtual Keyboard 3.0.1.0 (HKLM-x32\…\{CA4F9519-1A83-4907-8651-F17073A0E1CE}_is1) (Version: 3.0 - Comfort Software Group)
FreeUndelete 2.1.36867.1 (HKLM-x32\…\{0F5ADA2F-C0B2-4AD6-8FF7-7DFA9D6B4CBA}) (Version: 2.1.36867.1 - Recoveronix)
Glary Undelete 5.0.1.19 (HKLM-x32\…\Glary Undelete) (Version: 5.0.1.19 - Glarysoft Ltd)
Google Chrome (HKLM-x32\…\Google Chrome) (Version: 50.0.2661.102 - Google Inc.)
Google Update Helper (x32 Version: 1.3.30.3 - Google Inc.) Hidden
Hero Editor V1.04 (HKLM-x32\…\ST6UNST #1) (Version:  - )
Intel(R) Processor Graphics (HKLM-x32\…\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3958 - Intel Corporation)
Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM-x32\…\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 3.0.0.33 - Intel Corporation)
IrfanView 64 (remove only) (HKLM\…\IrfanView64) (Version: 4.41 - Irfan Skiljan)
League of Legends (HKLM-x32\…\League of Legends 3.0.1) (Version: 3.0.1 - Riot Games)
League of Legends (x32 Version: 3.0.1 - Riot Games) Hidden
LinuxLive USB Creator (HKLM-x32\…\LinuxLive USB Creator) (Version: 2.9 - Thibaut Lauziere)
LogMeIn Hamachi (HKLM-x32\…\LogMeIn Hamachi) (Version: 2.2.0.422 - LogMeIn, Inc.)
LogMeIn Hamachi (x32 Version: 2.2.0.422 - LogMeIn, Inc.) Hidden
Malwarebytes Anti-Malware version 2.2.1.1043 (HKLM-x32\…\Malwarebytes Anti-Malware_is1) (Version: 2.2.1.1043 - Malwarebytes)
Maxthon App Store (HKLM-x32\…\Maxthon App Store 1.1.0.10848) (Version: 1.1.0.10848 - Maxthon, Inc.)
Maxthon Cloud Browser (HKLM-x32\…\Maxthon3) (Version: 4.9.2.1000 - Maxthon International Limited)
Microsoft .NET Framework 4.6 (HKLM\…\{94A631D5-B30A-3DD8-B65C-1117C09DA73E}) (Version: 4.6.00081 - Microsoft Corporation)
Microsoft Office Professional Plus 2013 (HKLM\…\Office15.PROPLUS) (Version: 15.0.4420.1017 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\…\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\…\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319 (HKLM\…\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\…\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.23506 (HKLM-x32\…\{23daf363-3020-4059-b3ae-dc4ad39fed19}) (Version: 14.0.23506.0 - Microsoft Corporation)
Microsoft XNA Framework Redistributable 4.0 (HKLM-x32\…\{2BFC7AA0-544C-4E3A-8796-67F3BE655BE9}) (Version: 4.0.20823.0 - Microsoft Corporation)
Mount and Blade (HKLM-x32\…\1207666893_is1) (Version: 2.0.0.4 - GOG.com)
Mozilla Firefox 43.0.4 (x86 en-US) (HKLM-x32\…\Mozilla Firefox 43.0.4 (x86 en-US)) (Version: 43.0.4 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\…\MozillaMaintenanceService) (Version: 43.0.1.5828 - Mozilla)
MPC-HC 1.7.10 (64-bit) (HKLM\…\{2ACBF1FA-F5C3-4B19-A774-B22A31F231B9}_is1) (Version: 1.7.10 - MPC-HC Team)
MyDefrag v4.3.1 (HKLM\…\MyDefrag v4.3.1_is1) (Version: 4.0.0.0 - J.C. Kessels)
One Finger Death Punch 1.0 (HKLM-x32\…\One Finger Death Punch 1.0) (Version: 1.0 - Cat-A-Cat)
Opera Stable 37.0.2178.43 (HKLM-x32\…\Opera 37.0.2178.43) (Version: 37.0.2178.43 - Opera Software)
Outils de vérification linguistique 2013 de Microsoft Office - Français (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Panda Cloud Cleaner (HKLM-x32\…\{92B2B132-C7F0-43DC-921A-4493C04F78A4}_is1) (Version: 1.1.8 - Panda Security)
PCSX2 - Playstation 2 Emulator (HKLM-x32\…\pcsx2) (Version:  - )
PowerISO (HKLM-x32\…\PowerISO) (Version: 6.3 - Power Software Ltd)
Realtek Card Reader (HKLM-x32\…\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.3.9600.29084 - Realtek Semiconductor Corp.)
Realtek Ethernet Controller Driver (HKLM-x32\…\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.92.115.2015 - Realtek)
REALTEK Wireless LAN Driver (HKLM-x32\…\{9DAABC60-A5EF-41FF-B2B9-17329590CD5}) (Version: 1.00.0263 - REALTEK Semiconductor Corp.)
RMPrepUSB (HKLM-x32\…\RMPrepUSB) (Version:  - )
SafeZone Stable 1.48.2066.101 (x32 Version: 1.48.2066.101 - Avast Software) Hidden
SeaMonkey 2.40 (x86 en-US) (HKLM-x32\…\SeaMonkey 2.40 (x86 en-US)) (Version: 2.40 - Mozilla)
Shotty - Tiny but impressive screenshot utility (HKLM\…\2e730c18-03e8-4d1d-8fc2-0ee3ea04a765) (Version: 2.0.2.216 - Thomas Baumann)
SWF File Player (HKLM-x32\…\{6A86F611-906C-422D-B34A-103662CBC195}_is1) (Version:  - swffileplayer.com)
The Binding of Isaac Rebirth 1.0 (HKLM-x32\…\The Binding of Isaac Rebirth 1.0) (Version: 1.0 - Games on Cat-A-Cat.Net)
The I of the Dragon (HKLM-x32\…\The I of the Dragon) (Version: 1.00 Ger / Eng - Deep Silver (Koch Media))
Torchlight II © Runic Games version 1 (HKLM-x32\…\Torchlight II © Runic Games_is1) (Version: 1 - )
Tweaking.com - Registry Backup (HKLM-x32\…\Tweaking.com - Registry Backup) (Version: 3.3.1 - Tweaking.com)
UndeleteMyFiles Pro (HKLM-x32\…\UndeleteMyFiles Pro_is1) (Version:  - SeriousBit)
VLC media player (HKLM-x32\…\VLC media player) (Version: 2.2.1 - VideoLAN)
Wasteland 2 Directors Cut (HKLM-x32\…\Wasteland 2 Directors Cut_is1) (Version:  - )
Winamp (HKLM-x32\…\Winamp) (Version: 5.666  - Nullsoft, Inc)
WinPcap 4.1.3 (HKLM-x32\…\WinPcapInst) (Version: 4.1.0.2980 - Riverbed Technology, Inc.)
WinRAR 5.21 (64-bit) (HKLM\…\WinRAR archiver) (Version: 5.21.0 - win.rar GmbH)
WinToUSB version 2.8 (HKLM\…\WinToUSB_is1) (Version: 2.8 - The EasyUEFI Development Team.)
 
==================== Custom CLSID (Whitelisted): ==========================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
CustomCLSID: HKU\S-1-5-21-384921765-1548902971-3406650631-1000_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\Windows\system32\igfxEM.exe (Intel Corporation)
 
==================== Scheduled Tasks (Whitelisted) =============
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
Task: {0C38AE2D-18A0-48F0-B68B-E17B888171DD} - System32\Tasks\AVAST Software\Avast settings backup => C:\Program Files\Common Files\AV\avast! Antivirus\backup.exe [2016-05-19] (AVAST Software)
Task: {0D08902A-CF89-471C-862F-9D071783454C} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2016-04-22] (Adobe Systems Incorporated)
Task: {25EAF350-C587-4A49-9E13-F1D688B7AEAB} - System32\Tasks\SafeZone scheduled Autoupdate 1458763845 => C:\Program Files\AVAST Software\SZBrowser\launcher.exe [2016-04-15] (Avast Software)
Task: {439ADCDD-9069-427F-BA0A-FDAB1AD5F6DA} - System32\Tasks\{229E9532-8EC8-4310-8097-EDD225B446C7} => pcalua.exe -a C:\Users\salty-san\Desktop\unetbootin-windows-613.exe -d C:\Users\salty-san\Desktop
Task: {46878AA7-1AA3-4113-BEB4-F039108AF39F} - System32\Tasks\MyDefrag v4.3.1 Daily => C:\Program Files\MyDefrag v4.3.1\Scripts\AutomaticDaily.MyD [2010-05-21] ()
Task: {72FCCA83-504A-4CE8-881D-4DD1C857395E} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-11-08] (Google Inc.)
Task: {9E6528B5-9412-4D84-B808-4227D472358D} - System32\Tasks\Opera scheduled Autoupdate 1455818550 => C:\Program Files (x86)\Opera\launcher.exe [2016-05-09] (Opera Software)
Task: {9EF01225-A9E9-4907-B3A6-0BADE76FE6EF} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2016-05-09] (AVAST Software)
Task: {A37295E0-5544-4BDE-AAB5-9F122D4E6FC7} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-11-08] (Google Inc.)
Task: {A819E346-DD87-49B7-8F95-90430AFBC631} - System32\Tasks\Maxthon Update => C:\Program Files (x86)\Maxthon\Bin\Maxthon.exe [2016-04-15] (Maxthon International ltd.)
Task: {C673A044-1E70-4CC0-85C5-F079F0C6596C} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office\Office15\msoia.exe [2012-10-01] (Microsoft Corporation)
Task: {CA4A6E7F-6B77-414B-B595-97CDD1B0B259} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exe [2012-10-01] (Microsoft Corporation)
Task: {CE4E4352-61BE-4AEA-B41F-74A61CC1BA25} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office\Office15\msoia.exe [2012-10-01] (Microsoft Corporation)
Task: {E5DBA818-1F9F-4B43-AC1E-570F51A6036D} - System32\Tasks\MyDefrag v4.3.1 Monthly => C:\Program Files\MyDefrag v4.3.1\Scripts\AutomaticMonthly.MyD [2010-05-21] ()
 
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
 
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
 
==================== Shortcuts =============================
 
(The entries could be listed to be restored or removed.)
 
==================== Loaded Modules (Whitelisted) ==============
 
2012-10-01 21:36 - 2012-10-01 21:36 - 06522480 _____ () C:\Program Files\Microsoft Office\Office15\1033\GrooveIntlResource.dll
2016-05-09 20:42 - 2016-05-09 20:42 - 00123344 _____ () C:\Program Files\AVAST Software\Avast\log.dll
2016-05-09 20:42 - 2016-05-09 20:42 - 00135816 _____ () C:\Program Files\AVAST Software\Avast\JsonRpcServer.dll
2016-05-24 14:48 - 2016-05-24 14:48 - 02977888 _____ () C:\Program Files\AVAST Software\Avast\defs\16052401\algo.dll
2016-05-09 20:42 - 2016-05-09 20:42 - 00479680 _____ () C:\Program Files\AVAST Software\Avast\ffl2.dll
2016-05-09 20:42 - 2016-05-09 20:42 - 00309912 _____ () C:\Program Files\AVAST Software\Avast\browser_pass.dll
2016-05-25 19:21 - 2016-05-25 19:21 - 02977888 _____ () C:\Program Files\AVAST Software\Avast\defs\16052501\algo.dll
2012-10-01 21:37 - 2012-10-01 21:37 - 06522480 _____ () C:\Program Files (x86)\Microsoft Office\Office15\1033\GrooveIntlResource.dll
2016-01-04 22:52 - 2016-01-04 22:52 - 40539648 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2013-12-13 05:47 - 2013-12-13 05:47 - 00333824 _____ () C:\Program Files (x86)\Winamp\Plugins\freeform\wacs\freetype\freetype.wac
 
==================== Alternate Data Streams (Whitelisted) =========
 
(If an entry is included in the fixlist, only the ADS will be removed.)
 
AlternateDataStreams: C:\Users\salty-san\Desktop\rufus-2.4.exe:xdg.origin.url [45]
AlternateDataStreams: C:\Users\salty-san\Desktop\rufus-2.4.exe:xdg.referrer.url [22]
 
==================== Safe Mode (Whitelisted) ===================
 
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Hamachi2Svc => ""="Service"
 
==================== Association (Whitelisted) ===============
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
 
 
==================== Internet Explorer trusted/restricted ===============
 
(If an entry is included in the fixlist, it will be removed from the registry.)
 
 
==================== Hosts content: ===============================
 
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 
2009-07-14 05:34 - 2016-03-13 18:42 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
 
 
==================== Other Areas ============================
 
(Currently there is no automatic fix for this section.)
 
HKU\S-1-5-21-384921765-1548902971-3406650631-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\salty-san\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: Media is not connected to internet.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.
 
==================== MSCONFIG/TASK MANAGER disabled items ==
 
(Currently there is no automatic fix for this section.)
 
 
==================== FirewallRules (Whitelisted) ===============
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
FirewallRules: [{01DD5918-283F-4F3C-AC26-AF593412DF9F}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{4C05ACD7-2D66-4535-9966-F85B04F67719}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{508DDC13-5096-41A1-BE2C-A24C77183C13}] => (Block) D:\WASTELAND!\Wasteland 2 Directors Cut\Build\WL2.exe
FirewallRules: [TCP Query User{EEB53623-0283-483F-B645-04DD48C46786}C:\users\salty-san\documents\octgn\octgn\octgn.exe] => (Allow) C:\users\salty-san\documents\octgn\octgn\octgn.exe
FirewallRules: [UDP Query User{14C2698F-42A4-41BB-9169-2211FDC0ECB1}C:\users\salty-san\documents\octgn\octgn\octgn.exe] => (Allow) C:\users\salty-san\documents\octgn\octgn\octgn.exe
FirewallRules: [TCP Query User{DF6BC443-CABE-4E5A-9F0E-F4C4A78535F6}C:\users\salty-san\documents\octgn\octgn\octgn.exe] => (Allow) C:\users\salty-san\documents\octgn\octgn\octgn.exe
FirewallRules: [UDP Query User{0D9DECF9-7EE8-4932-81B6-5AA519CD2957}C:\users\salty-san\documents\octgn\octgn\octgn.exe] => (Allow) C:\users\salty-san\documents\octgn\octgn\octgn.exe
FirewallRules: [{F89C0384-F502-44A5-B00A-9826C8B9E172}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{BB9DFD0F-5CC0-4A92-A4C5-E4DE9031F0C6}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{19FBF323-28DA-4563-9196-790954D5F72D}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe
FirewallRules: [{5D4FF2EB-07A6-4F96-AFF0-58616E255410}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe
FirewallRules: [{95B66243-C6D0-4B85-90F6-547B69CE822E}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe
FirewallRules: [{BCFAED00-B5EE-4558-AFC6-E54BC68D9562}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe
FirewallRules: [TCP Query User{B247EA9C-0A1B-4E95-8AC0-562403FC4950}C:\users\salty-san\documents\octgn\octgn\octgn.online.standaloneserver.exe] => (Allow) C:\users\salty-san\documents\octgn\octgn\octgn.online.standaloneserver.exe
FirewallRules: [UDP Query User{260782A1-34CD-4BA2-9F89-72C24BA3BF7B}C:\users\salty-san\documents\octgn\octgn\octgn.online.standaloneserver.exe] => (Allow) C:\users\salty-san\documents\octgn\octgn\octgn.online.standaloneserver.exe
FirewallRules: [TCP Query User{AD90B0F5-5A10-4C62-A7A3-3CBA144F4692}D:\playboard\call of duty 2  full game  mp - sp  -=aviara=-\call of duty 2\cod2mp_s.exe] => (Block) D:\playboard\call of duty 2  full game  mp - sp  -=aviara=-\call of duty 2\cod2mp_s.exe
FirewallRules: [UDP Query User{E45AB548-5CA2-49FC-BCAA-420157AA80F9}D:\playboard\call of duty 2  full game  mp - sp  -=aviara=-\call of duty 2\cod2mp_s.exe] => (Block) D:\playboard\call of duty 2  full game  mp - sp  -=aviara=-\call of duty 2\cod2mp_s.exe
FirewallRules: [{9D79CD9D-1138-4471-9107-72DC3CDE88B1}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe
FirewallRules: [{3BFEB175-5043-44EA-B2C6-7D52F51741EE}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe
FirewallRules: [{2E2BBFA3-FB0B-479D-85AD-963E99B02215}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe
FirewallRules: [{2BEE2144-B70C-4420-BC9E-5A25585FF686}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe
FirewallRules: [{05C545A5-8C9C-41C3-B89E-E65D6D8A0192}] => (Allow) C:\Program Files (x86)\Winamp\winamp.exe
FirewallRules: [{E91111AF-B2E6-4408-A180-D898C8699190}] => (Allow) C:\Program Files (x86)\Winamp\winamp.exe
FirewallRules: [TCP Query User{69F0FD99-0EC7-4032-A241-6D327E2A6239}C:\users\salty-san\documents\octgn\octgn\octgn.online.standaloneserver.exe] => (Allow) C:\users\salty-san\documents\octgn\octgn\octgn.online.standaloneserver.exe
FirewallRules: [UDP Query User{68EFF557-0A01-48DF-ADF5-F95A6BCF5C2F}C:\users\salty-san\documents\octgn\octgn\octgn.online.standaloneserver.exe] => (Allow) C:\users\salty-san\documents\octgn\octgn\octgn.online.standaloneserver.exe
FirewallRules: [TCP Query User{78AF15E1-CC17-4FE7-BDCE-5427620D4861}D:\zergoth!\the minks!\portable\mirc\mirc.exe] => (Allow) D:\zergoth!\the minks!\portable\mirc\mirc.exe
FirewallRules: [UDP Query User{36A39718-5949-41EE-93B6-6318ACE5812B}D:\zergoth!\the minks!\portable\mirc\mirc.exe] => (Allow) D:\zergoth!\the minks!\portable\mirc\mirc.exe
FirewallRules: [TCP Query User{4CDB7BB9-A122-4B17-BA93-EF671730BED0}D:\playboard\duel masters civilization!\duelmasters\duelmasters.exe] => (Allow) D:\playboard\duel masters civilization!\duelmasters\duelmasters.exe
FirewallRules: [UDP Query User{9EDB7F0F-B21C-4096-9A73-82A834AABA6D}D:\playboard\duel masters civilization!\duelmasters\duelmasters.exe] => (Allow) D:\playboard\duel masters civilization!\duelmasters\duelmasters.exe
FirewallRules: [{4C549C43-8769-43DD-9C4C-D832FAD6EA76}] => (Block) D:\playboard\duel masters civilization!\duelmasters\duelmasters.exe
FirewallRules: [{EAC4EBEF-0920-44DC-BE2C-0C1DE5FD23B7}] => (Block) D:\playboard\duel masters civilization!\duelmasters\duelmasters.exe
FirewallRules: [{BF29B07C-1C68-4FFD-A4D3-2A5E6A990D3D}] => (Allow) C:\Program Files (x86)\Microsoft Games\Dungeon Siege 2\DungeonSiege2.exe
FirewallRules: [{CA9D005B-CFBA-4074-8BAC-879957D3F610}] => (Allow) C:\Program Files (x86)\Microsoft Games\Dungeon Siege 2\DungeonSiege2.exe
FirewallRules: [{7EC18199-F2F4-4E81-808E-B4AF8C069627}] => (Allow) C:\Program Files (x86)\Maxthon\Bin\MxUp.exe
FirewallRules: [{4051053A-8CCA-4822-B6DF-EB780F910B61}] => (Allow) C:\Program Files (x86)\Maxthon\Bin\Maxthon.exe
FirewallRules: [{D42F9D68-6F43-4682-B3ED-C973FE575538}] => (Allow) C:\Program Files (x86)\Maxthon\Bin\Maxthon.exe
FirewallRules: [{2478CB98-BB64-4FA9-842C-5FC7598BD6DB}] => (Allow) C:\Program Files (x86)\Maxthon\Bin\MxUp.exe
FirewallRules: [{1EE51A2D-F50E-4993-A34B-65E5CE39866A}] => (Allow) C:\Program Files (x86)\Maxthon\Bin\Maxthon.exe
FirewallRules: [{F5DD2F8C-BC93-471C-9078-4D647E90DCE4}] => (Allow) C:\Program Files (x86)\Maxthon\Bin\Maxthon.exe
FirewallRules: [{616F09ED-6DEE-4DB2-B541-38366AAC8A1C}] => (Allow) C:\Program Files (x86)\Maxthon\Bin\MxUp.exe
FirewallRules: [{C3F233A1-A686-4A64-9179-318E8C697C57}] => (Allow) C:\Program Files (x86)\Maxthon\Bin\MxUp.exe
FirewallRules: [{E7707FA7-619D-4097-BB68-C78DB33F533E}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
FirewallRules: [TCP Query User{947EFFAD-F69E-4185-AC31-C5B988C9D459}C:\gog games\impossible creatures\ic.exe] => (Allow) C:\gog games\impossible creatures\ic.exe
FirewallRules: [UDP Query User{350CBCCF-86C4-4DD0-9F00-93692E8138D8}C:\gog games\impossible creatures\ic.exe] => (Allow) C:\gog games\impossible creatures\ic.exe
 
==================== Restore Points =========================
 
24-05-2016 15:12:19 JRT Pre-Junkware Removal
 
==================== Faulty Device Manager Devices =============
 
Name: PCI Encryption/Decryption Controller
Description: PCI Encryption/Decryption Controller
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
 
Name: 
Description: 
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
 
Name: 
Description: 
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
 
Name: 
Description: 
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
 
Name: 
Description: 
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
 
Name: 
Description: 
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
 
 
==================== Event log errors: =========================
 
Application errors:
==================
Error: (05/25/2016 04:30:22 PM) (Source: lupdate) (EventID: 0) (User: )
Description: lupdateloopTime is  failed w/err 0x000036ec
 
Error: (05/25/2016 04:30:22 PM) (Source: lupdate) (EventID: 0) (User: )
Description: lupdateloopNum1++, loopNum1 is  failed w/err 0x00000003
 
Error: (05/25/2016 12:47:39 PM) (Source: lupdate) (EventID: 0) (User: )
Description: lupdateloopTime is  failed w/err 0x00003430
 
Error: (05/25/2016 12:47:39 PM) (Source: lupdate) (EventID: 0) (User: )
Description: lupdateloopNum1++, loopNum1 is  failed w/err 0x00000002
 
Error: (05/25/2016 09:30:14 AM) (Source: lupdate) (EventID: 0) (User: )
Description: lupdateloopTime is  failed w/err 0x00002e40
 
Error: (05/25/2016 09:30:14 AM) (Source: lupdate) (EventID: 0) (User: )
Description: lupdateloopNum1++, loopNum1 is  failed w/err 0x00000001
 
Error: (05/25/2016 09:19:57 AM) (Source: lupdate) (EventID: 0) (User: )
Description: lupdateloopTime is  failed w/err 0x00000261
 
Error: (05/25/2016 09:17:17 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
Error: (05/24/2016 11:12:09 PM) (Source: lupdate) (EventID: 0) (User: )
Description: lupdateloopTime is  failed w/err 0x000037f0
 
Error: (05/24/2016 11:12:09 PM) (Source: lupdate) (EventID: 0) (User: )
Description: lupdateloopNum1++, loopNum1 is  failed w/err 0x00000002
 
 
System errors:
=============
Error: (05/24/2016 03:07:38 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT AUTHORITY)
Description: WLAN Extensibility Module has stopped unexpectedly.
 
Module Path: C:\Windows\system32\Rtlihvs.dll
 
Error: (05/24/2016 03:07:38 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT AUTHORITY)
Description: WLAN Extensibility Module has stopped unexpectedly.
 
Module Path: C:\Windows\system32\Rtlihvs.dll
 
Error: (05/24/2016 03:07:35 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT AUTHORITY)
Description: WLAN Extensibility Module has stopped unexpectedly.
 
Module Path: C:\Windows\system32\Rtlihvs.dll
 
Error: (05/24/2016 03:07:31 PM) (Source: Service Control Manager) (EventID: 7032) (User: )
Description: The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Windows Search service, but this action failed with the following error: 
%%1056
 
Error: (05/24/2016 03:07:01 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Windows Media Player Network Sharing Service service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 30000 milliseconds: Restart the service.
 
Error: (05/24/2016 03:07:01 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Windows Search service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 30000 milliseconds: Restart the service.
 
Error: (05/24/2016 03:07:00 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Windows Presentation Foundation Font Cache 3.0.0.0 service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 0 milliseconds: Restart the service.
 
Error: (05/24/2016 03:07:00 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The lupdate service terminated unexpectedly.  It has done this 1 time(s).
 
Error: (05/24/2016 03:07:00 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The LogMeIn Hamachi Tunneling Engine service terminated unexpectedly.  It has done this 1 time(s).
 
Error: (05/24/2016 03:07:00 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The Office Software Protection Platform service terminated unexpectedly.  It has done this 1 time(s).
 
 
CodeIntegrity:
===================================
  Date: 2016-01-14 19:28:38.733
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Program Files (x86)\AVG\AVG PC TuneUp\avgdumpx.exe because the set of per-page image hashes could not be found on the system.
 
  Date: 2016-01-14 19:28:38.591
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Program Files (x86)\AVG\AVG PC TuneUp\avgdumpx.exe because the set of per-page image hashes could not be found on the system.
 
  Date: 2016-01-14 19:28:38.368
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Program Files (x86)\AVG\AVG PC TuneUp\avgdumpa.exe because the set of per-page image hashes could not be found on the system.
 
  Date: 2016-01-14 19:28:38.201
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Program Files (x86)\AVG\AVG PC TuneUp\avgdumpa.exe because the set of per-page image hashes could not be found on the system.
 
  Date: 2015-12-17 10:29:48.300
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Program Files (x86)\AVG\AVG PC TuneUp\avgdumpx.exe because the set of per-page image hashes could not be found on the system.
 
  Date: 2015-12-17 10:29:48.191
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Program Files (x86)\AVG\AVG PC TuneUp\avgdumpx.exe because the set of per-page image hashes could not be found on the system.
 
  Date: 2015-12-17 10:29:48.082
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Program Files (x86)\AVG\AVG PC TuneUp\avgdumpx.exe because the set of per-page image hashes could not be found on the system.
 
  Date: 2015-12-16 03:51:45.976
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Program Files (x86)\AVG\AVG PC TuneUp\avgdumpx.exe because the set of per-page image hashes could not be found on the system.
 
  Date: 2015-12-16 03:51:45.867
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Program Files (x86)\AVG\AVG PC TuneUp\avgdumpx.exe because the set of per-page image hashes could not be found on the system.
 
  Date: 2015-12-16 03:51:45.773
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Program Files (x86)\AVG\AVG PC TuneUp\avgdumpx.exe because the set of per-page image hashes could not be found on the system.
 
 
==================== Memory info =========================== 
 
Processor: Intel(R) Celeron(R) CPU N2840 @ 2.16GHz
Percentage of memory in use: 41%
Total physical RAM: 3981.36 MB
Available physical RAM: 2346.53 MB
Total Virtual: 7960.93 MB
Available Virtual: 6163.93 MB
 
==================== Drives ================================
 
Drive c: () (Fixed) (Total:122.07 GB) (Free:45.04 GB) NTFS ==>[drive with boot components (obtained from BCD)]
Drive d: (East) (Fixed) (Total:343.69 GB) (Free:13.4 GB) NTFS
 
==================== MBR & Partition Table ==================
 
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: D9FA2484)
Partition 1: (Not Active) - (Size=343.7 GB) - (Type=07 NTFS)
Partition 2: (Active) - (Size=122.1 GB) - (Type=07 NTFS)
 
==================== End of Addition.txt ============================




Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:19-05-2016
Ran by [removed] (administrator) on SALTYSKY (25-05-2016 19:22:18)
Running from C:\Users\[removed]\Desktop
[removed]
Platform: Windows 7 Ultimate Service Pack 1 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: "C:\Program Files (x86)\SeaMonkey\seamonkey.exe" -requestPending -osint -url "%1")
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 
==================== Processes (Whitelisted) =================
 
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Comodo) C:\Program Files (x86)\Comodo\Dragon\dragon_updater.exe
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe
(Maxthon) C:\Program Files (x86)\Maxthon App Store\1.1.0.10848\MaxthonAppstoreSvc.exe
(Maxthon) C:\Program Files (x86)\Maxthon\Modules\Service\Update\MaxthonUpdateSvc.exe
(Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
(LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe
(Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
(Epic Privacy Browser) C:\Users\salty-san\AppData\Local\Epic Privacy Browser\Installer\EpicUpdate.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Power Software Ltd) C:\Program Files\PowerISO\PWRISOVM.EXE
(Lenovo) C:\Windows\System32\LenovoUpdate.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(Intel Corporation) C:\Windows\System32\igfxTray.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(Nullsoft, Inc.) C:\Program Files (x86)\Winamp\winampa.exe
(Nullsoft, Inc.) C:\Program Files (x86)\Winamp\winamp.exe
 
 
==================== Registry (Whitelisted) ===========================
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 
HKLM\…\Run: [Eraser] => C:\Program Files\Eraser\Eraser.exe [1074088 2015-09-03] (The Eraser Project)
HKLM-x32\…\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [292848 2014-06-09] (Intel Corporation)
HKLM-x32\…\Run: [PWRISOVM.EXE] => C:\Program Files\PowerISO\PWRISOVM.EXE [408888 2015-07-23] (Power Software Ltd)
HKLM-x32\…\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [7400576 2016-05-12] (AVAST Software)
HKLM-x32\…\Run: [WinampAgent] => C:\Program Files (x86)\Winamp\winampa.exe [85600 2013-12-13] (Nullsoft, Inc.)
HKLM-x32\…\Run: [LogMeIn Hamachi Ui] => C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe [5565448 2016-04-05] (LogMeIn Inc.)
HKU\S-1-5-21-384921765-1548902971-3406650631-1000\…\Run: [Shotty] => C:\Program Files\Shotty\Shotty.exe [724480 2016-02-11] (hxxp://shotty.devs-on.net)
HKU\S-1-5-21-384921765-1548902971-3406650631-1000\…\Run: [Epic Privacy Browser Installer] => C:\Users\salty-san\AppData\Local\Epic Privacy Browser\Installer\EpicUpdate.exe [509096 2016-02-28] (Epic Privacy Browser)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2016-05-09] (AVAST Software)
BootExecute: autocheck autochk * PCloudBroom64.exe \systemroot\system32\BroomData.bitPCloudBroom64.exe \systemroot\system32\BroomData.bit
 
==================== Internet (Whitelisted) ====================
 
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 
Tcpip\..\Interfaces\{BB2A1C55-6917-4C3A-8770-C53876319A70}: [DhcpNameServer] 192.168.0.1
 
Internet Explorer:
==================
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\S-1-5-21-384921765-1548902971-3406650631-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar;=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar;=msnhome
HKU\S-1-5-21-384921765-1548902971-3406650631-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar;=iesearch
HKU\S-1-5-21-384921765-1548902971-3406650631-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.nyaa.se/
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office15\OCHelper.dll [2012-10-01] (Microsoft Corporation)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2016-05-09] (AVAST Software)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL [2012-10-01] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL [2012-10-01] (Microsoft Corporation)
BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll [2012-10-01] (Microsoft Corporation)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2016-05-09] (AVAST Software)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL [2012-10-01] (Microsoft Corporation)
BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL [2012-10-01] (Microsoft Corporation)
DPF: HKLM-x32 {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL [2012-10-01] (Microsoft Corporation)
 
FireFox:
========
FF ProfilePath: C:\Users\salty-san\AppData\Roaming\Mozilla\Firefox\Profiles\kl9fv1vt.default
FF DefaultSearchEngine: DuckDuckGo
FF Session Restore: -> is enabled.
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~2\Office15\NPSPWRAP.DLL [2012-10-01] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2012-10-01] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL [2012-10-01] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.30.3\npGoogleUpdate3.dll [2016-05-11] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.30.3\npGoogleUpdate3.dll [2016-05-11] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.2.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-04-13] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2016-05-03] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-384921765-1548902971-3406650631-1000: @updates.epicbrowser.com/Epic Privacy Browser Installer;version=3 -> C:\Users\salty-san\AppData\Local\Epic Privacy Browser\Installer\1.3.27.13\npEpicUpdate3.dll [2016-02-28] (Epic Privacy Browser)
FF Plugin HKU\S-1-5-21-384921765-1548902971-3406650631-1000: @updates.epicbrowser.com/Epic Privacy Browser Installer;version=9 -> C:\Users\salty-san\AppData\Local\Epic Privacy Browser\Installer\1.3.27.13\npEpicUpdate3.dll [2016-02-28] (Epic Privacy Browser)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll [2012-10-01] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2016-05-03] (Adobe Systems Inc.)
FF HKLM\…\Firefox\Extensions: [[removed]] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2016-05-09]
FF HKLM-x32\…\Firefox\Extensions: [[removed]] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF HKLM-x32\…\Firefox\Extensions: [[removed]] - C:\Program Files\AVAST Software\Avast\SafePrice\FF
FF Extension: Avast SafePrice - C:\Program Files\AVAST Software\Avast\SafePrice\FF [2016-05-09]
 
Chrome: 
=======
CHR Session Restore: Default -> is enabled.
CHR Profile: C:\Users\salty-san\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Slides) - C:\Users\salty-san\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-11-08]
CHR Extension: (Google Docs) - C:\Users\salty-san\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-11-08]
CHR Extension: (Google Drive) - C:\Users\salty-san\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-11-08]
CHR Extension: (YouTube) - C:\Users\salty-san\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-11-08]
CHR Extension: (Google Search) - C:\Users\salty-san\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-11-08]
CHR Extension: (Google Sheets) - C:\Users\salty-san\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-11-08]
CHR Extension: (Google Docs Offline) - C:\Users\salty-san\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-03-17]
CHR Extension: (Avast Online Security) - C:\Users\salty-san\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2016-04-08]
CHR Extension: (Chrome Web Store Payments) - C:\Users\salty-san\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-04-03]
CHR Extension: (Gmail) - C:\Users\salty-san\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-11-08]
CHR HKLM-x32\…\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2016-05-09]
 
==================== Services (Whitelisted) ========================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [243296 2016-05-09] (AVAST Software)
R2 DragonUpdater; C:\Program Files (x86)\Comodo\Dragon\dragon_updater.exe [2307768 2016-05-05] (Comodo)
R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [318568 2014-10-10] (Intel Corporation)
R3 LenovoUpdate; C:\Windows\System32\LenovoUpdate.exe [26608 2016-05-25] (Lenovo)
R2 LMIGuardianSvc; C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe [417552 2016-04-05] (LogMeIn, Inc.)
R2 MaxthonAppStoreSvc; C:\Program Files (x86)\Maxthon App Store\1.1.0.10848\MaxthonAppstoreSvc.exe [1867544 2015-08-11] (Maxthon)
R2 MaxthonUpdateSvc; C:\Program Files (x86)\Maxthon\Modules\Service\Update\MaxthonUpdateSvc.exe [1872152 2015-05-11] (Maxthon)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1514464 2016-03-10] (Malwarebytes)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1136608 2016-03-10] (Malwarebytes)
S3 rpcapd; C:\Program Files (x86)\WinPcap\rpcapd.exe [118520 2013-03-01] (Riverbed Technology, Inc.)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2015-08-05] (Microsoft Corporation)
 
===================== Drivers (Whitelisted) ==========================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [37656 2016-05-09] (AVAST Software)
R1 aswKbd; C:\Windows\system32\drivers\aswKbd.sys [37144 2016-05-09] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [107792 2016-05-09] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [103064 2016-05-09] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [74544 2016-05-09] (AVAST Software)
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1070904 2016-05-09] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [465792 2016-05-09] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [166432 2016-05-09] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [287528 2016-05-09] (AVAST Software)
S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [27008 2016-03-10] (Malwarebytes)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [192216 2016-05-25] (Malwarebytes)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64896 2016-03-10] (Malwarebytes Corporation)
R2 NPF; C:\Windows\System32\drivers\npf.sys [36600 2013-03-01] (Riverbed Technology, Inc.)
S3 PSKMAD; C:\Windows\System32\DRIVERS\PSKMAD.sys [50320 2015-01-29] (Panda Security, S.L.)
R3 RSP2STOR; C:\Windows\System32\DRIVERS\RtsP2Stor.sys [294104 2014-12-10] (Realtek Semiconductor Corp.)
R3 RTWlanE; C:\Windows\System32\DRIVERS\rtwlane.sys [3513048 2015-03-23] (Realtek Semiconductor Corporation                           )
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
 
==================== NetSvcs (Whitelisted) ===================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
 
==================== One Month Created files and folders ========
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2016-05-25 19:22 - 2016-05-25 19:22 - 00014689 _____ C:\Users\salty-san\Desktop\FRST.txt
2016-05-24 15:21 - 2016-05-25 11:42 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2016-05-24 15:21 - 2016-05-24 15:21 - 00001102 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2016-05-24 15:21 - 2016-05-24 15:21 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2016-05-24 15:21 - 2016-05-24 15:21 - 00000000 ____D C:\ProgramData\Malwarebytes
2016-05-24 15:21 - 2016-05-24 15:21 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2016-05-24 15:21 - 2016-03-10 14:09 - 00064896 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2016-05-24 15:21 - 2016-03-10 14:08 - 00140672 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamchameleon.sys
2016-05-24 15:21 - 2016-03-10 14:08 - 00027008 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys
2016-05-24 15:03 - 2016-05-24 15:07 - 00000000 ____D C:\AdwCleaner
2016-05-24 14:59 - 2016-05-24 14:59 - 22851472 _____ (Malwarebytes ) C:\Users\salty-san\Desktop\mbam-setup-2.2.1.1043.exe
2016-05-24 14:58 - 2016-05-24 14:58 - 01610816 _____ (Malwarebytes) C:\Users\salty-san\Desktop\JRT.exe
2016-05-24 14:57 - 2016-05-24 14:57 - 03651136 _____ C:\Users\salty-san\Desktop\AdwCleaner.exe
2016-05-24 13:32 - 2016-05-24 13:32 - 00000000 ____D C:\Users\salty-san\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Hero Editor
2016-05-24 13:32 - 2016-05-24 13:32 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hero Editor
2016-05-24 13:27 - 2016-05-24 13:31 - 00249856 ____N (Microsoft Corporation) C:\Windows\Setup1.exe
2016-05-24 13:27 - 2016-05-24 13:31 - 00073216 _____ (Microsoft Corporation) C:\Windows\ST6UNST.EXE
2016-05-24 13:27 - 2016-05-24 13:27 - 00001895 _____ C:\Windows\ST6UNST.000
2016-05-24 13:21 - 2016-05-24 13:21 - 00001578 _____ C:\Users\salty-san\Desktop\Diablo II - Lord of Destruction.lnk
2016-05-24 13:21 - 2016-05-24 13:21 - 00000000 ____D C:\Users\salty-san\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Diablo II
2016-05-24 13:18 - 2016-05-24 13:18 - 00000000 ____D C:\ProgramData\Mozilla
2016-05-24 13:17 - 2016-05-24 13:23 - 00030691 _____ C:\Windows\DIIUnin.dat
2016-05-24 13:17 - 2016-05-24 13:21 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Diablo II
2016-05-24 13:17 - 2016-05-24 13:17 - 00094208 _____ (Blizzard Entertainment) C:\Windows\DIIUnin.exe
2016-05-24 13:17 - 2016-05-24 13:17 - 00002829 _____ C:\Windows\DIIUnin.pif
2016-05-24 13:17 - 2016-05-24 13:17 - 00001578 _____ C:\Users\Public\Desktop\Diablo II.lnk
2016-05-21 19:25 - 2016-05-21 19:25 - 00001613 _____ C:\Users\Public\Desktop\League of Legends.lnk
2016-05-21 19:25 - 2016-05-21 19:25 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\League of Legends
2016-05-21 19:24 - 2016-05-21 19:24 - 27864920 _____ (Riot Games) C:\Users\salty-san\Downloads\LeagueofLegends_NA_Installer_9_15_2014.exe
2016-05-21 18:52 - 2016-05-21 18:52 - 780152425 _____ C:\Windows\MEMORY.DMP
2016-05-21 18:52 - 2016-05-21 18:52 - 00262144 _____ C:\Windows\Minidump\052116-18517-01.dmp
2016-05-21 18:52 - 2016-05-21 18:52 - 00000000 ____D C:\Windows\Minidump
2016-05-21 10:33 - 2016-05-21 10:33 - 00015428 _____ C:\ComboFix.txt
2016-05-21 10:19 - 2011-06-26 09:45 - 00256000 _____ C:\Windows\PEV.exe
2016-05-21 10:19 - 2010-11-07 20:20 - 00208896 _____ C:\Windows\MBR.exe
2016-05-21 10:19 - 2000-08-31 03:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2016-05-21 10:19 - 2000-08-31 03:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2016-05-21 10:19 - 2000-08-31 03:00 - 00098816 _____ C:\Windows\sed.exe
2016-05-21 10:19 - 2000-08-31 03:00 - 00080412 _____ C:\Windows\grep.exe
2016-05-21 10:19 - 2000-08-31 03:00 - 00068096 _____ C:\Windows\zip.exe
2016-05-21 10:16 - 2016-05-21 10:16 - 05659526 ____R (Swearware) C:\Users\salty-san\Desktop\ItBe.exe
2016-05-21 01:30 - 2013-04-08 16:30 - 00022752 _____ C:\Windows\system32\PCloudBroom64.exe
2016-05-21 01:29 - 2016-05-21 10:11 - 00000322 _____ C:\Windows\SysWOW64\BroomData.bit
2016-05-19 09:48 - 2016-05-25 19:22 - 00000000 ____D C:\FRST
2016-05-19 09:48 - 2016-05-19 09:48 - 02382336 _____ (Farbar) C:\Users\salty-san\Desktop\FRST64.exe
2016-05-19 09:46 - 2016-05-19 09:46 - 05198336 _____ (AVAST Software) C:\Users\salty-san\Desktop\aswMBR.exe
2016-05-19 02:16 - 2016-05-19 02:16 - 00001035 _____ C:\Users\salty-san\Desktop\RMPrepUSB.lnk
2016-05-19 02:16 - 2016-05-19 02:16 - 00000000 ____D C:\Users\salty-san\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\RMPrepUSB
2016-05-19 02:16 - 2016-05-19 02:16 - 00000000 ____D C:\Program Files (x86)\RMPrepUSB
2016-05-19 01:44 - 2016-05-19 02:52 - 00000000 ____D C:\Make_PE3
2016-05-18 23:28 - 2016-05-18 23:28 - 00000000 ____D C:\Users\salty-san\AppData\Roaming\OfficeRecovery
2016-05-18 23:27 - 2016-05-18 23:27 - 00002419 _____ C:\Users\salty-san\Desktop\FreeUndelete.lnk
2016-05-18 23:27 - 2016-05-18 23:27 - 00000000 ____D C:\Users\salty-san\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FreeUndelete
2016-05-18 23:27 - 2016-05-18 23:27 - 00000000 ____D C:\Users\salty-san\AppData\Local\Apps\OfficeRecovery
2016-05-16 16:21 - 2016-05-16 16:21 - 00000902 _____ C:\Users\Public\Desktop\WinToUSB.lnk
2016-05-16 16:21 - 2016-05-16 16:21 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinToUSB
2016-05-16 16:21 - 2016-05-16 16:21 - 00000000 ____D C:\Program Files\WinToUSB
2016-05-16 02:42 - 2009-04-20 07:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2016-05-16 02:37 - 2016-05-16 02:37 - 00000000 ____D C:\TheIt301T
2016-05-16 01:32 - 2015-01-29 19:21 - 00050320 _____ (Panda Security, S.L.) C:\Windows\system32\Drivers\PSKMAD.sys
2016-05-16 01:30 - 2016-05-16 01:32 - 00001282 _____ C:\Users\Public\Desktop\Panda Cloud Cleaner.lnk
2016-05-16 01:30 - 2016-05-16 01:30 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Panda Security
2016-05-16 01:30 - 2016-05-16 01:30 - 00000000 ____D C:\Program Files (x86)\Panda Security
2016-05-12 22:29 - 2016-05-12 22:29 - 00000000 ____D C:\Program Files (x86)\Comodo
2016-05-12 17:33 - 2016-05-12 17:33 - 00000000 ____D C:\ProgramData\Realtek
2016-05-12 15:37 - 2016-05-12 15:37 - 00001649 _____ C:\Users\salty-san\Desktop\LiLi USB Creator - Shortcut.lnk
2016-05-12 10:53 - 2016-05-12 10:53 - 00001233 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Glary Undelete.lnk
2016-05-12 10:53 - 2016-05-12 10:53 - 00001221 _____ C:\Users\Public\Desktop\Glary Undelete.lnk
2016-05-12 10:53 - 2016-05-12 10:53 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Glarysoft
2016-05-12 10:53 - 2016-05-12 10:53 - 00000000 ____D C:\Program Files (x86)\Glarysoft
2016-05-12 10:52 - 2016-05-12 10:52 - 00001106 _____ C:\Users\Public\Desktop\UndeleteMyFiles Pro.lnk
2016-05-12 10:52 - 2016-05-12 10:52 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UndeleteMyFiles
2016-05-12 10:52 - 2016-05-12 10:52 - 00000000 ____D C:\Program Files (x86)\UndeleteMyFiles
2016-05-10 20:54 - 2016-05-10 20:54 - 00001081 _____ C:\Users\Public\Desktop\SWF File Player.lnk
2016-05-10 20:53 - 2016-05-10 20:54 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SWF File Player
2016-05-10 20:53 - 2016-05-10 20:53 - 00000000 ____D C:\Program Files (x86)\SWF File Player
2016-05-10 12:18 - 2016-05-10 12:18 - 00001190 _____ C:\Users\salty-san\Desktop\The I of the Dragon.lnk
2016-05-10 12:17 - 2016-05-10 12:17 - 00000000 ____D C:\Users\salty-san\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Zuxxez
2016-05-10 12:17 - 2016-05-10 12:17 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Zuxxez
2016-05-10 12:15 - 2016-05-10 12:15 - 00000000 ____D C:\Program Files (x86)\Zuxxez
2016-05-09 20:42 - 2016-05-09 20:42 - 00398152 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2016-05-09 20:42 - 2016-05-09 20:42 - 00052184 _____ (AVAST Software) C:\Windows\avastSS.scr
2016-05-08 23:36 - 2016-05-09 00:04 - 00000000 ____D C:\Users\salty-san\AppData\Roaming\avidemux
2016-05-08 23:36 - 2016-05-08 23:36 - 00000914 _____ C:\Users\Public\Desktop\Avidemux 2.6 - 64 bits.lnk
2016-05-08 23:36 - 2016-05-08 23:36 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avidemux (64 bits)
2016-05-08 23:36 - 2016-05-08 23:36 - 00000000 ____D C:\Program Files\Avidemux 2.6 - 64 bits
2016-05-08 20:18 - 2016-05-08 20:18 - 00000000 ____D C:\Users\salty-san\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FunnyGames
2016-05-08 20:18 - 2016-05-08 20:18 - 00000000 ____D C:\Users\salty-san\AppData\Roaming\FunnyGames
2016-05-08 20:18 - 2016-05-08 20:18 - 00000000 ____D C:\Users\salty-san\AppData\Local\FunnyGames
2016-05-04 16:47 - 2016-05-04 16:49 - 00000000 ____D C:\TheIt
2016-05-04 16:16 - 2016-05-24 14:53 - 00000000 ____D C:\Users\salty-san\AppData\Roaming\Avant Profiles
2016-05-04 16:16 - 2016-05-04 16:16 - 00001923 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Avant Browser.lnk
2016-05-04 16:16 - 2016-05-04 16:16 - 00001917 _____ C:\Users\Public\Desktop\Avant Browser.lnk
2016-05-04 16:16 - 2016-05-04 16:16 - 00000000 ____D C:\Users\salty-san\AppData\Roaming\Avant Downloader
2016-05-04 16:16 - 2016-05-04 16:16 - 00000000 ____D C:\Users\salty-san\AppData\Local\Chromium
2016-05-04 16:16 - 2016-05-04 16:16 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avant Browser
2016-05-04 16:16 - 2016-05-04 16:16 - 00000000 ____D C:\Program Files (x86)\Avant Browser
2016-05-04 16:13 - 2016-05-22 19:05 - 00000000 ____D C:\Users\salty-san\AppData\Roaming\SlimBrowser
2016-05-04 16:08 - 2016-05-16 02:03 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FlashPeak SlimBrowser
2016-05-04 16:08 - 2016-05-04 16:08 - 00001021 _____ C:\Users\Public\Desktop\FlashPeak SlimBrowser.lnk
2016-05-04 16:07 - 2016-05-04 16:08 - 00000000 ____D C:\Program Files (x86)\SlimBrowser
2016-05-04 15:54 - 2016-05-04 15:54 - 00001226 _____ C:\Users\Public\Desktop\Comodo Dragon.lnk
2016-05-04 15:54 - 2016-05-04 15:54 - 00000000 ____D C:\Users\salty-san\AppData\Local\Comodo
2016-05-04 15:54 - 2016-05-04 15:54 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Comodo
2016-05-04 15:52 - 2016-05-04 15:52 - 01700352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdiplus.dll
2016-05-04 15:52 - 2016-05-04 15:52 - 01060864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfc71.dll
2016-05-04 15:52 - 2016-05-04 15:52 - 00348160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcr71.dll
2016-05-04 15:24 - 2016-05-04 15:24 - 00003600 _____ C:\Windows\System32\Tasks\Maxthon Update
2016-05-04 15:24 - 2016-05-04 15:24 - 00001081 _____ C:\Users\Public\Desktop\Maxthon Cloud Browser.lnk
2016-05-04 15:24 - 2016-05-04 15:24 - 00000000 ____D C:\Users\salty-san\AppData\Roaming\Maxthon3
2016-05-04 15:23 - 2016-05-04 15:24 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maxthon Cloud Browser
2016-05-04 15:23 - 2016-05-04 15:24 - 00000000 ____D C:\Program Files (x86)\Maxthon
2016-05-04 15:23 - 2016-05-04 15:23 - 00001295 _____ C:\Users\Public\Desktop\Maxthon App Store.lnk
2016-05-04 15:23 - 2016-05-04 15:23 - 00000000 ____D C:\Users\salty-san\AppData\Roaming\Maxthon App Store
2016-05-04 15:23 - 2016-05-04 15:23 - 00000000 ____D C:\Users\Public\Documents\Baidu
2016-05-04 15:23 - 2016-05-04 15:23 - 00000000 ____D C:\Program Files (x86)\Maxthon App Store
2016-05-03 22:51 - 2016-05-25 09:38 - 00003942 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{F51745E5-CA05-4A07-82FD-E977DEA96A94}
2016-04-27 16:46 - 2016-04-27 16:46 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi
2016-04-27 16:46 - 2016-04-27 16:46 - 00000000 ____D C:\Program Files (x86)\LogMeIn Hamachi
2016-04-27 16:46 - 2016-04-05 16:18 - 00034720 ____H (LogMeIn, Inc.) C:\Windows\system32\hamachi.sys
2016-04-26 23:51 - 2016-04-26 23:51 - 00000000 ____D C:\ProgramData\RELOADED
2016-04-26 23:36 - 2016-04-26 23:36 - 00000850 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Torchlight II.lnk
2016-04-26 23:36 - 2016-04-26 23:36 - 00000838 _____ C:\Users\Public\Desktop\Torchlight II.lnk
2016-04-26 23:35 - 2016-04-26 23:41 - 00000000 ____D C:\Program Files (x86)\Torchlight II
 
==================== One Month Modified files and folders ========
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2016-05-25 18:57 - 2015-11-08 00:30 - 00000898 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2016-05-25 15:47 - 2016-01-08 20:03 - 00000000 ____D C:\Program Files (x86)\Opera
2016-05-25 11:54 - 2015-11-08 00:30 - 00000894 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2016-05-25 11:25 - 2016-01-04 22:52 - 00004182 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2016-05-25 09:24 - 2009-07-14 07:45 - 00026352 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2016-05-25 09:24 - 2009-07-14 07:45 - 00026352 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2016-05-25 09:20 - 2009-07-14 08:13 - 00781298 _____ C:\Windows\system32\PerfStringBackup.INI
2016-05-25 09:20 - 2009-07-14 06:20 - 00000000 ____D C:\Windows\inf
2016-05-25 09:17 - 2016-03-06 15:37 - 00000000 ____D C:\Users\salty-san\AppData\Local\LogMeIn Hamachi
2016-05-25 09:17 - 2016-02-11 19:04 - 00000000 ____D C:\Users\salty-san\AppData\Local\Shotty
2016-05-25 09:16 - 2015-11-01 23:10 - 00097264 _____ (Lenovo (Beijing) Limited) C:\Windows\system32\LenovoCheck.exe
2016-05-25 09:16 - 2015-11-01 23:10 - 00026608 _____ (Lenovo) C:\Windows\system32\LenovoUpdate.exe
2016-05-25 09:16 - 2009-07-14 08:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-05-24 13:50 - 2016-03-26 23:47 - 00000000 ____D C:\Games
2016-05-24 13:26 - 2016-02-05 02:35 - 00000000 ____D C:\Program Files (x86)\SeaMonkey
2016-05-21 22:39 - 2016-01-03 02:37 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2016-05-21 19:26 - 2015-11-01 17:02 - 00000000 ____D C:\Users\salty-san\AppData\Roaming\Riot Games
2016-05-21 10:33 - 2016-03-28 15:49 - 00000000 ____D C:\Qoobox
2016-05-21 10:31 - 2009-07-14 05:34 - 00000215 _____ C:\Windows\system.ini
2016-05-20 19:18 - 2016-02-10 21:08 - 00000000 ____D C:\Users\salty-san\Documents\Mount&Blade; Savegames
2016-05-19 21:16 - 2016-02-10 20:58 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GOG.com
2016-05-19 21:16 - 2009-07-14 08:32 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2016-05-19 20:52 - 2016-02-10 20:57 - 00000000 ____D C:\GOG Games
2016-05-18 09:24 - 2015-12-04 12:06 - 00000000 ____D C:\Users\salty-san\AppData\Roaming\vlc
2016-05-17 15:12 - 2016-02-18 17:23 - 00000440 __RSH C:\ProgramData\ntuser.pol
2016-05-13 15:46 - 2016-02-18 21:02 - 00003846 _____ C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1455818550
2016-05-13 08:57 - 2015-11-08 00:30 - 00002195 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2016-05-13 08:57 - 2015-11-08 00:30 - 00002183 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2016-05-12 16:11 - 2016-03-31 15:41 - 00000000 ____D C:\Users\salty-san\Documents\Mami
2016-05-11 11:49 - 2015-11-08 00:30 - 00003894 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2016-05-11 11:49 - 2015-11-08 00:30 - 00003642 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2016-05-11 11:06 - 2016-01-03 02:38 - 00003886 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task
2016-05-10 12:18 - 2016-01-03 22:46 - 00000000 ____D C:\Users\salty-san\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
2016-05-10 08:55 - 2016-03-23 23:11 - 00003890 _____ C:\Windows\System32\Tasks\SafeZone scheduled Autoupdate 1458763845
2016-05-09 20:42 - 2016-01-04 22:52 - 00465792 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2016-05-09 20:42 - 2016-01-04 22:52 - 00287528 _____ (AVAST Software) C:\Windows\system32\Drivers\aswVmm.sys
2016-05-09 20:42 - 2016-01-04 22:52 - 00166432 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys
2016-05-09 20:42 - 2016-01-04 22:52 - 00107792 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2016-05-09 20:42 - 2016-01-04 22:52 - 00103064 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2016-05-09 20:42 - 2016-01-04 22:52 - 00074544 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRvrt.sys
2016-05-09 20:42 - 2016-01-04 22:52 - 00037656 _____ (AVAST Software) C:\Windows\system32\Drivers\aswHwid.sys
2016-05-09 20:41 - 2016-03-23 23:10 - 00037144 _____ (AVAST Software) C:\Windows\system32\Drivers\aswKbd.sys
2016-05-09 20:41 - 2016-01-04 22:52 - 01070904 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2016-05-04 18:27 - 2009-07-14 08:08 - 00032654 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2016-05-04 16:35 - 2015-11-01 13:21 - 00000000 ____D C:\Users\salty-san
2016-04-29 21:06 - 2015-11-05 17:02 - 00000000 ____D C:\Users\salty-san\AppData\Local\Microsoft Games
2016-04-26 23:51 - 2015-11-01 19:10 - 00000000 ____D C:\Users\salty-san\Documents\My Games
 
==================== Files in the root of some directories =======
 
2016-03-13 14:21 - 2016-03-21 22:53 - 0000129 _____ () C:\Users\salty-san\AppData\Roaming\Camdata.ini
2016-03-13 14:21 - 2016-03-21 22:53 - 0000408 _____ () C:\Users\salty-san\AppData\Roaming\CamLayout.ini
2016-03-13 14:21 - 2016-03-21 22:53 - 0000408 _____ () C:\Users\salty-san\AppData\Roaming\CamShapes.ini
2016-03-13 14:21 - 2016-03-21 22:53 - 0004548 _____ () C:\Users\salty-san\AppData\Roaming\CamStudio.cfg
2016-03-13 14:21 - 2016-03-21 22:50 - 0000096 _____ () C:\Users\salty-san\AppData\Roaming\version2.xml
 
Some files in TEMP:
====================
C:\Users\salty-san\AppData\Local\Temp\binkw32.dll
C:\Users\salty-san\AppData\Local\Temp\d2l_Install.exe
C:\Users\salty-san\AppData\Local\Temp\libeay32.dll
C:\Users\salty-san\AppData\Local\Temp\msvcr120.dll
C:\Users\salty-san\AppData\Local\Temp\sqlite3.dll
 
 
==================== Bamital & volsnap =================
 
(There is no automatic fix for files that do not pass verification.)
 
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
 
 
LastRegBack: 2016-05-18 07:33
 
==================== End of FRST.txt ============================

Hello,

 

Not sure what Combofix removed prior to you posting, it can cause some issues if not run correctly.

 

Open notepad , Go to Start –> All Programs –> Accessories –> Notepad.
Please copy the entire contents Inside of the code box below beginning with START and ending with END
(To do this highlight the contents of the box, right click on it and select copy. Right-click in the open notepad and select Paste).
Name the file Fixlist, Save it to your desktop where you have FRST/FRST64 or the fix wont work, . Then open up FRST/FRST64 and click on FIX (Not Scan) It won't take long, after your computer reboots you will find a FIXLOG.TXT on your desktop, post it please
 
Start
CloseProcesses:
CreateRestorePoint: 
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\S-1-5-21-384921765-1548902971-3406650631-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
CMD: ipconfig /flushdns
Hosts:
EmptyTemp:
End
 
NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Oh, well I was pretty careful with ComboFix and didn't ran it that much, so I have every scan log I think, which aren't that many. So I guess I could….give you the last one? I forgot to bring it up kinda, although I wanted to, and I just thought we are doing the "standard" tools scans first, but that's also out of the way now I suppose…

Ran the Fixlist for…
 

Fix result of Farbar Recovery Scan Tool (x64) Version:19-05-2016
Ran by [removed] (2016-05-25 21:33:50) Run:1
Running from C:\Users\[removed]\Desktop
[removed]
Boot Mode: Normal
==============================================
 
fixlist content:
*****************
Start
CloseProcesses:
CreateRestorePoint: 
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\S-1-5-21-384921765-1548902971-3406650631-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
CMD: ipconfig /flushdns
Hosts:
EmptyTemp:
End
*****************
 
Processes closed successfully.
Restore point was successfully created.
"HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer" => key removed successfully
"HKU\S-1-5-21-384921765-1548902971-3406650631-1000\SOFTWARE\Policies\Microsoft\Internet Explorer" => key removed successfully
 
=========  ipconfig /flushdns =========
 
 
Windows IP Configuration
 
Successfully flushed the DNS Resolver Cache.
 
========= End of CMD: =========
 
C:\Windows\System32\Drivers\etc\hosts => moved successfully
Hosts restored successfully.
EmptyTemp: => 314.6 MB temporary data Removed.
 
 
The system needed a reboot.
 
==== End of Fixlog 21:34:51 ====

Well, lets check a bit further , if there are any viruses ESET is pretty good and finding them.

 

First do this

 

Double click on AdwCleaner.exe to run the tool again.
  •  
  • Click on the Uninstall button.
  • Click Yes when asked are you sure you want to uninstall.
  • Both AdwCleaner.exe, its folder and all logs will be removed.
 
 
 
 

 
[external image: 3330203e-7304-4336-aa0a-eb3d8b6e3b35_zps]
 
Please run this Free Online Virus Scanner from ESET
  •  
  • Please be patient, depending on your system the scan can complete in 30 minutes and on others much longer.
  • You want the Online One-Time Scan
  • Note: It will run using Internet Explorer, Firefox or Chome.
  • Tick the box next to YES, I accept the Terms of Use.
  • Click Start
  • When asked, allow the activex control to install
  • Click Start
  • Make sure that the option Remove found threats is NOT TICKED, and the option Scan unwanted applications is checked
  • Click Scan
  • Wait for the scan to finish
  • Use notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
  • Copy and paste that log as a reply to this topic
 
 

So should I post the ComboFix log then? The last one was actually just a day before I started posting this cause something was ticking me off…Either way, let me know when.

I ran into some problems with ESET…The first two times I scanned it froze and blocked while scanning drive D up to about a quarter and had to End Task it, at which point it only found 2 threats, both of which are just "unwanted applications" that are pretty ok I feel. I had to scan a third time, and stopped it after the two ones to see what they were, so no real viruses found I guess? ESET changed its scanner look since last I used it (which was only a few months ago) so maybe that was it…it also used to list what it found as it scans, but now only does so after, so idk what changes were made to it or if you

are aware of this.
 

I don't know why it failed, maybe it was something it found, maybe it was because I was browsing and streaming on the Net at the time with no protection on or it was just the CPU strain. I could try again tomorrow or just set the scanner to only scan what it missed. The log file that I saved only has this…

 

C:\Users\salty-san\AppData\Roaming\PowerISO\Upgrade\PowerISO6-x64.exe a variant of Win32/DealPly.BX potentially unwanted application
D:\KIT!\camstudio.exe a variant of Win32/InstallCore.ACY.gen potentially unwanted application

Both of these are fine?

I'm sure being on the internet while it was scanning didn't help

 

Go ahead and post the Combofix logs, the first one you ran and the last one you ran

 

Then run this quick scanner

 

[external image: CKS_zpsugippntv.jpg]
Download CKScanner by askey127 from Here & save it to your Desktop.
  • Doubleclick CKScanner.exe then click Search For Files
  • When the cursor hourglass disappears, click Save List To File
  • A message box will verify the file saved
  • Please Run this program only once
  • Double-click the CKFiles.txt icon on your desktop then copy/paste the contents in your next reply
  • Was too busy to rescan with ESET and hence the delay but here they are…That program didn't turn up problems either it seems so maybe I am just being too paranoid? And then the Combofix logs, I only have 3, and before that my comp was cleaned up so if its something it should be here…2nd log is April 11th but its not the last one (3rd) so only posting those 2.
     

    CKScanner 2.5 - Additional Security Risks - These are not necessarily bad
    c:\gog games\mount and blade\sounds\fire_small_crackle_slick_op.ogg
    c:\new folder\pcsx2 1.4.0\pcsx2_keys.ini.default
    c:\users\salty-san\documents\my games\wasteland2dc\save games\safecracking and smart ass\safecracking and smart ass.bin
    c:\users\salty-san\documents\my games\wasteland2dc\save games\safecracking and smart ass\safecracking and smart ass.xml
    scanner sequence 3.BB.11.LVAPLZ
     —– EOF —– 


    ComboFix 16-04-29.01 - salty-san 05/04/2016  16:58:46.3.2 - x64
    Microsoft Windows 7 Ultimate   6.1.7601.1.1252.1.1033.18.3981.2606 [GMT 3:00]
    Running from: c:\users\[removed]\Desktop\TheIt.exe
    AV: avast! Antivirus *Disabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}
    SP: avast! Antivirus *Disabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
    SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
     * Created a new restore point
    .
    .
    (((((((((((((((((((((((((   Files Created from 2016-04-04 to 2016-05-04  )))))))))))))))))))))))))))))))
    .
    .
    2016-05-04 14:06 . 2016-05-04 14:06 ——– d—–w- c:\users\Public\AppData\Local\temp
    2016-05-04 14:06 . 2016-05-04 14:06 ——– d—–w- c:\users\Default\AppData\Local\temp
    2016-05-04 13:47 . 2016-05-04 13:49 ——– d—–w- C:\TheIt
    2016-05-04 13:16 . 2016-05-04 13:16 ——– d—–w- c:\users\salty-san\AppData\Local\Chromium
    2016-05-04 13:16 . 2016-05-04 13:16 ——– d—–w- c:\users\salty-san\AppData\Roaming\Avant Downloader
    2016-05-04 13:16 . 2016-05-04 13:16 ——– d—–w- c:\users\salty-san\AppData\Roaming\Avant Profiles
    2016-05-04 13:16 . 2016-05-04 13:16 ——– d—–w- c:\program files (x86)\Avant Browser
    2016-05-04 13:13 . 2016-05-04 13:53 ——– d—–w- c:\users\salty-san\AppData\Roaming\SlimBrowser
    2016-05-04 13:07 . 2016-05-04 13:08 ——– d—–w- c:\program files (x86)\SlimBrowser
    2016-05-04 13:00 . 2016-05-04 13:00 ——– d—–w- c:\program files (x86)\Comodo
    2016-05-04 12:54 . 2016-05-04 12:54 ——– d—–w- c:\users\salty-san\AppData\Local\Comodo
    2016-05-04 12:52 . 2016-05-04 12:52 348160 —-a-w- c:\windows\SysWow64\msvcr71.dll
    2016-05-04 12:52 . 2016-05-04 12:52 1700352 —-a-w- c:\windows\SysWow64\gdiplus.dll
    2016-05-04 12:52 . 2016-05-04 12:52 1060864 —-a-w- c:\windows\SysWow64\mfc71.dll
    2016-05-04 12:24 . 2016-05-04 12:24 ——– d—–w- c:\users\salty-san\AppData\Roaming\Maxthon3
    2016-05-04 12:23 . 2016-05-04 12:24 ——– d—–w- c:\program files (x86)\Maxthon
    2016-05-04 12:23 . 2016-05-04 12:23 ——– d—–w- c:\program files (x86)\Maxthon App Store
    2016-05-04 12:23 . 2016-05-04 12:23 ——– d—–w- c:\users\salty-san\AppData\Roaming\Maxthon App Store
    2016-04-27 13:46 . 2016-04-05 13:18 34720 —ha-w- c:\windows\system32\hamachi.sys
    2016-04-27 13:46 . 2016-04-27 13:46 ——– d—–w- c:\program files (x86)\LogMeIn Hamachi
    2016-04-26 20:51 . 2016-04-26 20:51 ——– d—–w- c:\programdata\RELOADED
    2016-04-26 20:35 . 2016-04-26 20:41 ——– d—–w- c:\program files (x86)\Torchlight II
    2016-04-12 18:54 . 2016-04-12 18:56 ——– d—–w- c:\program files (x86)\Cheatbook Database 2016
    2016-04-07 03:58 . 2016-04-07 03:58 ——– d—–w- c:\program files (x86)\Microsoft Games
    .
    .
    .
    ((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2016-05-04 13:37 . 2015-11-01 20:10 97264 —-a-w- c:\windows\system32\LenovoCheck.exe
    2016-05-04 13:37 . 2015-11-01 20:10 26608 —-a-w- c:\windows\system32\LenovoUpdate.exe
    2016-03-23 20:10 . 2016-03-23 20:10 37144 —-a-w- c:\windows\system32\drivers\aswKbd.sys
    2016-03-15 07:02 . 2016-01-04 19:52 107792 —-a-w- c:\windows\system32\drivers\aswmonflt.sys
    2016-03-15 07:02 . 2016-01-04 19:52 1070904 —-a-w- c:\windows\system32\drivers\aswsnx.sys
    2016-03-15 07:02 . 2016-01-04 19:52 463744 —-a-w- c:\windows\system32\drivers\aswsp.sys
    2016-03-15 07:02 . 2016-01-04 19:52 287016 —-a-w- c:\windows\system32\drivers\aswvmm.sys
    2016-03-15 07:01 . 2016-03-15 07:01 398152 —-a-w- c:\windows\system32\aswBoot.exe
    2016-03-15 07:01 . 2016-01-04 19:52 165344 —-a-w- c:\windows\system32\drivers\aswStm.sys
    2016-03-15 07:01 . 2016-01-04 19:52 74544 —-a-w- c:\windows\system32\drivers\aswRvrt.sys
    2016-03-15 07:01 . 2016-01-04 19:52 37656 —-a-w- c:\windows\system32\drivers\aswHwid.sys
    2016-03-15 07:01 . 2016-01-04 19:52 103064 —-a-w- c:\windows\system32\drivers\aswRdr2.sys
    2016-03-15 07:01 . 2016-03-15 07:01 52184 —-a-w- c:\windows\avastSS.scr
    .
    .
    (((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown 
    REGEDIT4
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro1 (ErrorConflict)]
    @="{8BA85C75-763B-4103-94EB-9470F12FE0F7}"
    [HKEY_CLASSES_ROOT\CLSID\{8BA85C75-763B-4103-94EB-9470F12FE0F7}]
    2012-10-01 18:38 1720976 —-a-w- c:\progra~2\MICROS~1\Office15\GROOVEEX.DLL
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro2 (SyncInProgress)]
    @="{CD55129A-B1A1-438E-A425-CEBC7DC684EE}"
    [HKEY_CLASSES_ROOT\CLSID\{CD55129A-B1A1-438E-A425-CEBC7DC684EE}]
    2012-10-01 18:38 1720976 —-a-w- c:\progra~2\MICROS~1\Office15\GROOVEEX.DLL
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro3 (InSync)]
    @="{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}"
    [HKEY_CLASSES_ROOT\CLSID\{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}]
    2012-10-01 18:38 1720976 —-a-w- c:\progra~2\MICROS~1\Office15\GROOVEEX.DLL
    .
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Shotty"="c:\program files\Shotty\Shotty.exe" [2016-02-11 724480]
    "Epic Privacy Browser Installer"="c:\users\salty-san\AppData\Local\Epic Privacy Browser\Installer\EpicUpdate.exe" [2016-02-28 509096]
    "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-21 1475584]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
    "USB3MON"="c:\program files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe" [2014-06-09 292848]
    "PWRISOVM.EXE"="c:\program files\PowerISO\PWRISOVM.EXE" [2015-07-23 408888]
    "AvastUI.exe"="c:\program files\AVAST Software\Avast\AvastUI.exe" [2016-03-23 7139256]
    "WinampAgent"="c:\program files (x86)\Winamp\winampa.exe" [2013-12-13 85600]
    "LogMeIn Hamachi Ui"="c:\program files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" [2016-04-05 5565448]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "ConsentPromptBehaviorAdmin"= 5 (0x5)
    "ConsentPromptBehaviorUser"= 3 (0x3)
    "EnableUIADesktopToggle"= 0 (0x0)
    "SoftwareSASGeneration"= 1 (0x1)
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
    "aux3"=wdmaud.drv
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
    "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe"
    .
    R2 aswStm;aswStm;c:\windows\system32\drivers\aswStm.sys;c:\windows\SYSNATIVE\drivers\aswStm.sys [x]
    R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
    R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys;c:\windows\SYSNATIVE\drivers\dmvsc.sys [x]
    R3 ICCS;Intel(R) Integrated Clock Controller Service - Intel(R) ICCS;c:\program files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe;c:\program files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe [x]
    R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
    R3 ose64;Office 64 Source Engine;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [x]
    R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
    R3 Synth3dVsc;Microsoft Virtual 3D Video Transport Driver;c:\windows\system32\drivers\Synth3dVsc.sys;c:\windows\SYSNATIVE\drivers\Synth3dVsc.sys [x]
    R3 terminpt;Microsoft Remote Desktop Input Driver;c:\windows\system32\drivers\terminpt.sys;c:\windows\SYSNATIVE\drivers\terminpt.sys [x]
    R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
    R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
    R3 tsusbhub;Remote Deskotop USB Hub;c:\windows\system32\drivers\tsusbhub.sys;c:\windows\SYSNATIVE\drivers\tsusbhub.sys [x]
    R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys;c:\windows\SYSNATIVE\drivers\rdvgkmd.sys [x]
    S0 aswRvrt;avast! Revert; [x]
    S0 aswVmm;avast! VM Monitor; [x]
    S0 iusb3hcs;Intel(R) USB 3.0 Host Controller Switch Driver;c:\windows\system32\DRIVERS\iusb3hcs.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3hcs.sys [x]
    S1 aswKbd;aswKbd;c:\windows\system32\drivers\aswKbd.sys;c:\windows\SYSNATIVE\drivers\aswKbd.sys [x]
    S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys;c:\windows\SYSNATIVE\drivers\aswSnx.sys [x]
    S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys;c:\windows\SYSNATIVE\drivers\aswSP.sys [x]
    S2 aswHwid;avast! HardwareID;c:\windows\system32\drivers\aswHwid.sys;c:\windows\SYSNATIVE\drivers\aswHwid.sys [x]
    S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys;c:\windows\SYSNATIVE\drivers\aswMonFlt.sys [x]
    S2 DiagTrack;Diagnostics Tracking Service;c:\windows\System32\svchost.exe;c:\windows\SYSNATIVE\svchost.exe [x]
    S2 DragonUpdater;COMODO Dragon Update Service;c:\program files (x86)\Comodo\Dragon\dragon_updater.exe;c:\program files (x86)\Comodo\Dragon\dragon_updater.exe [x]
    S2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;c:\program files (x86)\LogMeIn Hamachi\hamachi-2.exe;c:\program files (x86)\LogMeIn Hamachi\hamachi-2.exe [x]
    S2 igfxCUIService1.0.0.0;Intel(R) HD Graphics Control Panel Service;c:\windows\system32\igfxCUIService.exe;c:\windows\SYSNATIVE\igfxCUIService.exe [x]
    S2 LMIGuardianSvc;LMIGuardianSvc;c:\program files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe;c:\program files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe [x]
    S2 MasSvc_{MaxthonAppStore_1.1.0.10848};Maxthon App Store Service 1.1.0.10848;c:\program files (x86)\Maxthon App Store\1.1.0.10848\MasSvc.exe;c:\program files (x86)\Maxthon App Store\1.1.0.10848\MasSvc.exe [x]
    S2 MaxthonAppStoreSvc;Maxthon AppStore Update Service;c:\program files (x86)\Maxthon App Store\1.1.0.10848\MaxthonAppstoreSvc.exe;c:\program files (x86)\Maxthon App Store\1.1.0.10848\MaxthonAppstoreSvc.exe [x]
    S2 MaxthonUpdateSvc;Maxthon Core Update Service;c:\program files (x86)\Maxthon\Modules\Service\Update\MaxthonUpdateSvc.exe;c:\program files (x86)\Maxthon\Modules\Service\Update\MaxthonUpdateSvc.exe [x]
    S2 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys;c:\windows\SYSNATIVE\drivers\npf.sys [x]
    S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
    S3 iusb3hub;Intel(R) USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\iusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3hub.sys [x]
    S3 iusb3xhc;Intel(R) USB 3.0 eXtensible Host Controller Driver;c:\windows\system32\DRIVERS\iusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3xhc.sys [x]
    S3 LenovoUpdate;lupdate;c:\windows\system32\LenovoUpdate.exe;c:\windows\SYSNATIVE\LenovoUpdate.exe [x]
    S3 RSP2STOR;Realtek PCIE CardReader Driver - P2;c:\windows\system32\DRIVERS\RtsP2Stor.sys;c:\windows\SYSNATIVE\DRIVERS\RtsP2Stor.sys [x]
    S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
    S3 RTWlanE;Realtek Wireless LAN 802.11n PCI-E Network Adapter;c:\windows\system32\DRIVERS\rtwlane.sys;c:\windows\SYSNATIVE\DRIVERS\rtwlane.sys [x]
    .
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
    2016-05-02 19:48 1186968 —-a-w- c:\program files (x86)\Google\Chrome\Application\50.0.2661.94\Installer\chrmstp.exe
    .
    Contents of the 'Scheduled Tasks' folder
    .
    2016-05-04 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
    - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2015-11-07 21:29]
    .
    2016-05-04 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
    - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2015-11-07 21:29]
    .
    .
    ——— X64 Entries ———–
    .
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro1 (ErrorConflict)]
    @="{8BA85C75-763B-4103-94EB-9470F12FE0F7}"
    [HKEY_CLASSES_ROOT\CLSID\{8BA85C75-763B-4103-94EB-9470F12FE0F7}]
    2012-10-01 18:37 2322576 —-a-w- c:\progra~1\MICROS~2\Office15\GROOVEEX.DLL
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro2 (SyncInProgress)]
    @="{CD55129A-B1A1-438E-A425-CEBC7DC684EE}"
    [HKEY_CLASSES_ROOT\CLSID\{CD55129A-B1A1-438E-A425-CEBC7DC684EE}]
    2012-10-01 18:37 2322576 —-a-w- c:\progra~1\MICROS~2\Office15\GROOVEEX.DLL
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro3 (InSync)]
    @="{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}"
    [HKEY_CLASSES_ROOT\CLSID\{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}]
    2012-10-01 18:37 2322576 —-a-w- c:\progra~1\MICROS~2\Office15\GROOVEEX.DLL
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
    @="{472083B0-C522-11CF-8763-00608CC02F24}"
    [HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
    2016-03-15 07:01 905248 —-a-w- c:\program files\AVAST Software\Avast\ashShA64.dll
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Eraser"="c:\program files\Eraser\Eraser.exe" [2015-09-03 1074088]
    .
    ——- Supplementary Scan ——-
    .
    uLocal Page = c:\windows\system32\blank.htm
    uStart Page = hxxp://search.yahoo.com/?fr=avantsearch6
    mLocal Page = c:\windows\SysWOW64\blank.htm
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office15\EXCEL.EXE/3000
    IE: Se&nd to OneNote - c:\progra~1\MICROS~2\Office15\ONBttnIE.dll/105
    Filter: text/xml - {807583E5-5146-11D5-A672-00B0D022E945} - c:\program files (x86)\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL
    FF - ProfilePath - c:\users\salty-san\AppData\Roaming\Mozilla\Firefox\Profiles\kl9fv1vt.default\
    .
    - - - - ORPHANS REMOVED - - - -
    .
    AddRemove-Panda Security URL Filtering - c:\program files\Panda Security URL Filtering\uninstall.exe
    AddRemove-SlimBrowser - c:\program files (x86)\SlimBrowser\uninst.exe
    .
    .
    .
    ——————— LOCKED REGISTRY KEYS ———————
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
    @Denied: (Full) (Everyone)
    .
    Completion time: 2016-05-04  17:09:20
    ComboFix-quarantined-files.txt  2016-05-04 14:09
    ComboFix2.txt  2016-04-11 08:48
    ComboFix3.txt  2016-03-28 13:02
    .
    Pre-Run: 51,567,230,976 bytes free
    Post-Run: 51,576,774,656 bytes free
    .
    - - End Of File - - 9886ECD62CCEBE790788CC6D271C87DE
    A36C5E4F47E84449FF07ED3517B43A31





    ComboFix 16-05-18.01 - salty-san 05/21/2016  10:22:27.4.2 - x64
    Microsoft Windows 7 Ultimate   6.1.7601.1.1252.1.1033.18.3981.2736 [GMT 3:00]
    Running from: c:\users\[removed]\Desktop\ItBe.exe
    AV: avast! Antivirus *Disabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}
    SP: avast! Antivirus *Disabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
    SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    .
    .
    (((((((((((((((((((((((((   Files Created from 2016-04-21 to 2016-05-21  )))))))))))))))))))))))))))))))
    .
    .
    2016-05-21 07:31 . 2016-05-21 07:31 ——– d—–w- c:\users\Public\AppData\Local\temp
    2016-05-21 07:31 . 2016-05-21 07:31 ——– d—–w- c:\users\Default\AppData\Local\temp
    2016-05-20 22:30 . 2013-04-08 13:30 22752 —-a-w- c:\windows\system32\PCloudBroom64.exe
    2016-05-19 06:48 . 2016-05-19 06:49 ——– d—–w- C:\FRST
    2016-05-18 23:16 . 2016-05-18 23:16 ——– d—–w- c:\program files (x86)\RMPrepUSB
    2016-05-18 22:44 . 2016-05-18 23:52 ——– d—–w- C:\Make_PE3
    2016-05-18 20:28 . 2016-05-18 20:28 ——– d—–w- c:\users\salty-san\AppData\Roaming\OfficeRecovery
    2016-05-16 13:21 . 2016-05-16 13:21 ——– d—–w- c:\program files\WinToUSB
    2016-05-15 22:32 . 2015-01-29 16:21 50320 —-a-w- c:\windows\system32\drivers\PSKMAD.sys
    2016-05-15 22:30 . 2016-05-15 22:30 ——– d—–w- c:\program files (x86)\Panda Security
    2016-05-12 19:29 . 2016-05-12 19:29 ——– d—–w- c:\program files (x86)\Comodo
    2016-05-12 14:33 . 2016-05-12 14:33 ——– d—–w- c:\programdata\Realtek
    2016-05-12 07:53 . 2016-05-12 07:53 ——– d—–w- c:\program files (x86)\Glarysoft
    2016-05-12 07:52 . 2016-05-12 07:52 ——– d—–w- c:\program files (x86)\UndeleteMyFiles
    2016-05-10 17:53 . 2016-05-10 17:53 ——– d—–w- c:\program files (x86)\SWF File Player
    2016-05-10 09:15 . 2016-05-10 09:15 ——– d—–w- c:\program files (x86)\Zuxxez
    2016-05-09 17:42 . 2016-05-09 17:42 398152 —-a-w- c:\windows\system32\aswBoot.exe
    2016-05-09 17:42 . 2016-05-09 17:42 52184 —-a-w- c:\windows\avastSS.scr
    2016-05-08 20:36 . 2016-05-08 21:04 ——– d—–w- c:\users\salty-san\AppData\Roaming\avidemux
    2016-05-08 20:36 . 2016-05-08 20:36 ——– d—–w- c:\program files\Avidemux 2.6 - 64 bits
    2016-05-08 17:18 . 2016-05-08 17:18 ——– d—–w- c:\users\salty-san\AppData\Roaming\FunnyGames
    2016-05-08 17:18 . 2016-05-08 17:18 ——– d—–w- c:\users\salty-san\AppData\Local\FunnyGames
    2016-05-04 13:47 . 2016-05-04 13:49 ——– d—–w- C:\TheIt
    2016-05-04 13:16 . 2016-05-04 13:16 ——– d—–w- c:\users\salty-san\AppData\Local\Chromium
    2016-05-04 13:16 . 2016-05-04 13:16 ——– d—–w- c:\users\salty-san\AppData\Roaming\Avant Downloader
    2016-05-04 13:16 . 2016-05-05 13:25 ——– d—–w- c:\users\salty-san\AppData\Roaming\Avant Profiles
    2016-05-04 13:16 . 2016-05-04 13:16 ——– d—–w- c:\program files (x86)\Avant Browser
    2016-05-04 13:13 . 2016-05-21 06:53 ——– d—–w- c:\users\salty-san\AppData\Roaming\SlimBrowser
    2016-05-04 13:07 . 2016-05-04 13:08 ——– d—–w- c:\program files (x86)\SlimBrowser
    2016-05-04 12:54 . 2016-05-04 12:54 ——– d—–w- c:\users\salty-san\AppData\Local\Comodo
    2016-05-04 12:52 . 2016-05-04 12:52 348160 —-a-w- c:\windows\SysWow64\msvcr71.dll
    2016-05-04 12:52 . 2016-05-04 12:52 1700352 —-a-w- c:\windows\SysWow64\gdiplus.dll
    2016-05-04 12:52 . 2016-05-04 12:52 1060864 —-a-w- c:\windows\SysWow64\mfc71.dll
    2016-05-04 12:24 . 2016-05-04 12:24 ——– d—–w- c:\users\salty-san\AppData\Roaming\Maxthon3
    2016-05-04 12:23 . 2016-05-04 12:24 ——– d—–w- c:\program files (x86)\Maxthon
    2016-05-04 12:23 . 2016-05-04 12:23 ——– d—–w- c:\program files (x86)\Maxthon App Store
    2016-05-04 12:23 . 2016-05-04 12:23 ——– d—–w- c:\users\salty-san\AppData\Roaming\Maxthon App Store
    2016-05-03 14:41 . 2016-05-03 14:41 225976 —-a-w- c:\program files (x86)\Mozilla Firefox\plugins\nppdf32.dll
    2016-04-27 13:46 . 2016-04-05 13:18 34720 —ha-w- c:\windows\system32\hamachi.sys
    2016-04-27 13:46 . 2016-04-27 13:46 ——– d—–w- c:\program files (x86)\LogMeIn Hamachi
    2016-04-26 20:51 . 2016-04-26 20:51 ——– d—–w- c:\programdata\RELOADED
    2016-04-26 20:35 . 2016-04-26 20:41 ——– d—–w- c:\program files (x86)\Torchlight II
    .
    .
    .
    ((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2016-05-21 07:14 . 2015-11-01 20:10 97264 —-a-w- c:\windows\system32\LenovoCheck.exe
    2016-05-21 07:14 . 2015-11-01 20:10 26608 —-a-w- c:\windows\system32\LenovoUpdate.exe
    2016-05-09 17:42 . 2016-01-04 19:52 166432 —-a-w- c:\windows\system32\drivers\aswStm.sys
    2016-05-09 17:42 . 2016-01-04 19:52 287528 —-a-w- c:\windows\system32\drivers\aswVmm.sys
    2016-05-09 17:42 . 2016-01-04 19:52 74544 —-a-w- c:\windows\system32\drivers\aswRvrt.sys
    2016-05-09 17:42 . 2016-01-04 19:52 465792 —-a-w- c:\windows\system32\drivers\aswSP.sys
    2016-05-09 17:42 . 2016-01-04 19:52 107792 —-a-w- c:\windows\system32\drivers\aswMonFlt.sys
    2016-05-09 17:42 . 2016-01-04 19:52 37656 —-a-w- c:\windows\system32\drivers\aswHwid.sys
    2016-05-09 17:42 . 2016-01-04 19:52 103064 —-a-w- c:\windows\system32\drivers\aswRdr2.sys
    2016-05-09 17:41 . 2016-03-23 20:10 37144 —-a-w- c:\windows\system32\drivers\aswKbd.sys
    2016-05-09 17:41 . 2016-01-04 19:52 1070904 —-a-w- c:\windows\system32\drivers\aswSnx.sys
    .
    .
    (((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown 
    REGEDIT4
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro1 (ErrorConflict)]
    @="{8BA85C75-763B-4103-94EB-9470F12FE0F7}"
    [HKEY_CLASSES_ROOT\CLSID\{8BA85C75-763B-4103-94EB-9470F12FE0F7}]
    2012-10-01 18:38 1720976 —-a-w- c:\progra~2\MICROS~1\Office15\GROOVEEX.DLL
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro2 (SyncInProgress)]
    @="{CD55129A-B1A1-438E-A425-CEBC7DC684EE}"
    [HKEY_CLASSES_ROOT\CLSID\{CD55129A-B1A1-438E-A425-CEBC7DC684EE}]
    2012-10-01 18:38 1720976 —-a-w- c:\progra~2\MICROS~1\Office15\GROOVEEX.DLL
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro3 (InSync)]
    @="{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}"
    [HKEY_CLASSES_ROOT\CLSID\{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}]
    2012-10-01 18:38 1720976 —-a-w- c:\progra~2\MICROS~1\Office15\GROOVEEX.DLL
    .
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Shotty"="c:\program files\Shotty\Shotty.exe" [2016-02-11 724480]
    "Epic Privacy Browser Installer"="c:\users\salty-san\AppData\Local\Epic Privacy Browser\Installer\EpicUpdate.exe" [2016-02-28 509096]
    "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-21 1475584]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
    "USB3MON"="c:\program files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe" [2014-06-09 292848]
    "PWRISOVM.EXE"="c:\program files\PowerISO\PWRISOVM.EXE" [2015-07-23 408888]
    "AvastUI.exe"="c:\program files\AVAST Software\Avast\AvastUI.exe" [2016-05-12 7400576]
    "WinampAgent"="c:\program files (x86)\Winamp\winampa.exe" [2013-12-13 85600]
    "LogMeIn Hamachi Ui"="c:\program files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" [2016-04-05 5565448]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "ConsentPromptBehaviorAdmin"= 5 (0x5)
    "ConsentPromptBehaviorUser"= 3 (0x3)
    "EnableUIADesktopToggle"= 0 (0x0)
    "SoftwareSASGeneration"= 1 (0x1)
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
    "aux3"=wdmaud.drv
    .
    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
    BootExecute REG_MULTI_SZ   autocheck autochk *\0PCloudBroom64.exe \systemroot\system32\BroomData.bit\0PCloudBroom64.exe \systemroot\system32\BroomData.bit
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
    "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe"
    .
    R2 aswStm;aswStm;c:\windows\system32\drivers\aswStm.sys;c:\windows\SYSNATIVE\drivers\aswStm.sys [x]
    R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
    R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys;c:\windows\SYSNATIVE\drivers\dmvsc.sys [x]
    R3 ICCS;Intel(R) Integrated Clock Controller Service - Intel(R) ICCS;c:\program files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe;c:\program files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe [x]
    R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
    R3 ose64;Office 64 Source Engine;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [x]
    S0 aswRvrt;avast! Revert; [x]
    S0 aswVmm;avast! VM Monitor; [x]
    S0 iusb3hcs;Intel(R) USB 3.0 Host Controller Switch Driver;c:\windows\system32\DRIVERS\iusb3hcs.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3hcs.sys [x]
    S1 aswKbd;aswKbd;c:\windows\system32\drivers\aswKbd.sys;c:\windows\SYSNATIVE\drivers\aswKbd.sys [x]
    S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys;c:\windows\SYSNATIVE\drivers\aswSnx.sys [x]
    S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys;c:\windows\SYSNATIVE\drivers\aswSP.sys [x]
    S2 aswHwid;avast! HardwareID;c:\windows\system32\drivers\aswHwid.sys;c:\windows\SYSNATIVE\drivers\aswHwid.sys [x]
    S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys;c:\windows\SYSNATIVE\drivers\aswMonFlt.sys [x]
    S2 DiagTrack;Diagnostics Tracking Service;c:\windows\System32\svchost.exe;c:\windows\SYSNATIVE\svchost.exe [x]
    S2 DragonUpdater;COMODO Dragon Update Service;c:\program files (x86)\Comodo\Dragon\dragon_updater.exe;c:\program files (x86)\Comodo\Dragon\dragon_updater.exe [x]
    S2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;c:\program files (x86)\LogMeIn Hamachi\hamachi-2.exe;c:\program files (x86)\LogMeIn Hamachi\hamachi-2.exe [x]
    S2 igfxCUIService1.0.0.0;Intel(R) HD Graphics Control Panel Service;c:\windows\system32\igfxCUIService.exe;c:\windows\SYSNATIVE\igfxCUIService.exe [x]
    S2 LMIGuardianSvc;LMIGuardianSvc;c:\program files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe;c:\program files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe [x]
    S2 MasSvc_{MaxthonAppStore_1.1.0.10848};Maxthon App Store Service 1.1.0.10848;c:\program files (x86)\Maxthon App Store\1.1.0.10848\MasSvc.exe;c:\program files (x86)\Maxthon App Store\1.1.0.10848\MasSvc.exe [x]
    S2 MaxthonAppStoreSvc;Maxthon AppStore Update Service;c:\program files (x86)\Maxthon App Store\1.1.0.10848\MaxthonAppstoreSvc.exe;c:\program files (x86)\Maxthon App Store\1.1.0.10848\MaxthonAppstoreSvc.exe [x]
    S2 MaxthonUpdateSvc;Maxthon Core Update Service;c:\program files (x86)\Maxthon\Modules\Service\Update\MaxthonUpdateSvc.exe;c:\program files (x86)\Maxthon\Modules\Service\Update\MaxthonUpdateSvc.exe [x]
    S2 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys;c:\windows\SYSNATIVE\drivers\npf.sys [x]
    S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
    S3 iusb3hub;Intel(R) USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\iusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3hub.sys [x]
    S3 iusb3xhc;Intel(R) USB 3.0 eXtensible Host Controller Driver;c:\windows\system32\DRIVERS\iusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3xhc.sys [x]
    S3 LenovoUpdate;lupdate;c:\windows\system32\LenovoUpdate.exe;c:\windows\SYSNATIVE\LenovoUpdate.exe [x]
    .
    .
    — Other Services/Drivers In Memory —
    .
    *Deregistered* - DasPtct
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
    2016-05-13 05:56 1186968 —-a-w- c:\program files (x86)\Google\Chrome\Application\50.0.2661.102\Installer\chrmstp.exe
    .
    Contents of the 'Scheduled Tasks' folder
    .
    2016-05-21 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
    - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2015-11-07 21:29]
    .
    2016-05-21 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
    - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2015-11-07 21:29]
    .
    .
    ——— X64 Entries ———–
    .
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro1 (ErrorConflict)]
    @="{8BA85C75-763B-4103-94EB-9470F12FE0F7}"
    [HKEY_CLASSES_ROOT\CLSID\{8BA85C75-763B-4103-94EB-9470F12FE0F7}]
    2012-10-01 18:37 2322576 —-a-w- c:\progra~1\MICROS~2\Office15\GROOVEEX.DLL
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro2 (SyncInProgress)]
    @="{CD55129A-B1A1-438E-A425-CEBC7DC684EE}"
    [HKEY_CLASSES_ROOT\CLSID\{CD55129A-B1A1-438E-A425-CEBC7DC684EE}]
    2012-10-01 18:37 2322576 —-a-w- c:\progra~1\MICROS~2\Office15\GROOVEEX.DLL
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro3 (InSync)]
    @="{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}"
    [HKEY_CLASSES_ROOT\CLSID\{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}]
    2012-10-01 18:37 2322576 —-a-w- c:\progra~1\MICROS~2\Office15\GROOVEEX.DLL
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
    @="{472083B0-C522-11CF-8763-00608CC02F24}"
    [HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
    2016-05-09 17:42 920784 —-a-w- c:\program files\AVAST Software\Avast\ashShA64.dll
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Eraser"="c:\program files\Eraser\Eraser.exe" [2015-09-03 1074088]
    .
    ——- Supplementary Scan ——-
    .
    uLocal Page = c:\windows\system32\blank.htm
    uStart Page = hxxp://www.nyaa.se/
    mLocal Page = c:\windows\SysWOW64\blank.htm
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office15\EXCEL.EXE/3000
    IE: Se&nd to OneNote - c:\progra~1\MICROS~2\Office15\ONBttnIE.dll/105
    Filter: text/xml - {807583E5-5146-11D5-A672-00B0D022E945} - c:\program files (x86)\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL
    FF - ProfilePath - c:\users\salty-san\AppData\Roaming\Mozilla\Firefox\Profiles\kl9fv1vt.default\
    .
    - - - - ORPHANS REMOVED - - - -
    .
    AddRemove-Panda Security URL Filtering - c:\program files\Panda Security URL Filtering\uninstall.exe
    AddRemove-SlimBrowser - c:\program files (x86)\SlimBrowser\uninst.exe
    .
    .
    .
    ——————— LOCKED REGISTRY KEYS ———————
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
    @Denied: (Full) (Everyone)
    .
    Completion time: 2016-05-21  10:33:53
    ComboFix-quarantined-files.txt  2016-05-21 07:33
    ComboFix2.txt  2016-05-04 14:09
    ComboFix3.txt  2016-04-11 08:48
    ComboFix4.txt  2016-03-28 13:02
    .
    Pre-Run: 53,126,352,896 bytes free
    Post-Run: 53,260,570,624 bytes free
    .
    - - End Of File - - 9180B8D4327AF269232C69EEE386B1CF
    A36C5E4F47E84449FF07ED3517B43A31
     

     

    Your logs look fine, looks like Combofix never removed anything so we can rule out it causing damage. 

     

    We cleaned you up best we could, if your still having problems it  may not be malware so what I would do is post in our windows forum, describe your problems, link them to this thread so that they can see what we have done. Not sure at this point if its a driver / software or hardware issue. They can run you through some tests and try to find out whats wrong

     

    https://forums.whatthetech.com/index.php?showforum=119      <—Our windows forum

     

     

     

    Right click on the windows start icon and select RUN, copy and paste this in and it will remove Combofix

     

    Combofix /uninstall

     

     

     
    Please download DelFix and save the file to your Desktop.
     
    [external image: DelFix_zps139e2ea1.jpg]
     
    •  
    • Windows XP Double Click DelFix.exe to run the program. 
    • Windows Vista > Win 7 > Win 8 Right Click on DelFix.exe and select RUN AS ADMINISTRATOR 
    • Checkmark " Remove Disinfection Tools"
    • Click the Run button
     
     
    This will remove the specialised tools we used to clean your system. Any leftover logs, files, folders or tools remaining on your Desktop which were not removed can be deleted manually
     
     
     
     
    So How did I get infected in the first place <– Some reading for you to keep yourself safe online
     
     
    Safe Surfn
    Ken

     

    Yeah it's been looking like everything was fine for a while now with the scans and that makes me happy. As I originally intended it was mostly just routine and to be on the safe side before starting to work with data. Also a bit of paranoia, haha.

     

    So thanks a lot, this has in fact been very helpful, if only because it shows my current protection levels and security habits are solid enough.

     

    I did ran into some trouble again today, with connectivity in a game no less and so on. It looks a bit ominous like what I used to have on another comp that got FUBAR, so it's a bit shady but it was first time this happened. And general slowness still here but I tried something and I think maybe I found the source…

     

    Was checking processes…It turns out there's a lot of startup run things and everything went smoother once I ended them. Part of that is cause I installed several browsers so they all have an "active update check" or App Store. Also Lenovo himself has an update check. So if maybe I can work out turning these off I am sure all will be great. Also I have Hamachi, which still seems to be on even though I close it.

    Once I fix these I feel all will go back to normal, as that's what was the cause last time this happened a few months back. I did feel it had something to do with my recent installs, but everything looked normal, I just never checked Porcesses for some reason.

    Ask AI

    AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

    Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI