Spyware / Malware / Virus Removal

"New" Used Computer Can Someone Give it a Look [Solved]

7 min read

Looking for the outcome? Ask AI

joeyfor Topic Starter

Post #1May 30, 2016, 1:48 AM UTC

I just got it and want to make sure it is clean before I Reformat it.

Thanks in advance!!!!!

joeyfor

Post #2May 30, 2016, 1:49 AM UTC

📎FRST.txt

ken545

Post #3May 30, 2016, 11:48 AM UTC

Please reply to this topic and do not start a new topic for each reply or else your posts will be all over the forum and I wont be able to keep track of you.

When you ran FRST64, the first time its run there should have been an Additions log also, it should be on your desktop, post it please. If you cant find it than run FRST64 again by right clicking on FRST64 and selecting RUN AS ADMINISTRATOR, make sure to put a checkmark in ADDITIONS , click on scan and post the Additions log. Also, all the logs from the tools we run will open up in Notepad, I prefer if you would copy and paste the logs into this thread in lieu of attaching them.

I see a few issues with the log you posted, but lets wait until I see the Additions log before we take any action

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:29-05-2016 02

Ran by [removed] (administrator) on WINDOWS (29-05-2016 18:40:15)

Running from C:\Users\[removed]\Desktop

[removed]

Platform: Windows 8.1 (Update) (X64) Language: English (United States)

Internet Explorer Version 11 (Default browser: Chrome)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(IObit) C:\Program Files (x86)\IObit\Advanced SystemCare\ASCService.exe

() C:\Program Files (x86)\AVG Web TuneUp\WtuSystemSupport.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe

(Microsoft Corporation) C:\Windows\System32\wlanext.exe

(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgwdsvc.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe

(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe

(Cypress Semiconductor Corporation) C:\Program Files\Cypress\TrackPad\CyTpService.exe

() C:\Windows\System32\DptfParticipantProcessorService.exe

() C:\Windows\System32\DptfPolicyConfigTDPService.exe

(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe

(Freemake) C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe

(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe

(Intel Corporation) C:\Windows\SysWOW64\irstrtsv.exe

() C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe

(IObit) C:\Program Files (x86)\IObit\LiveUpdate\LiveUpdate.exe

(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe

(AVG Secure Search) C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\40.2.9\ToolbarUpdater.exe

(Microsoft) C:\Program Files (x86)\Intel Corporation\Intel(R) Sensor Solution Service\wakeupSensor.exe

(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe

(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe

(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe

(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

(SoftThinks SAS) C:\Program Files (x86)\Dell Backup and Recovery\SftService.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

(Intel) C:\Program Files (x86)\Intel\irstrt\RapidStartConfig.exe

(IObit) C:\Program Files (x86)\IObit\Advanced SystemCare\Monitor.exe

(Cypress Semiconductor, Inc.) C:\Program Files\Cypress\TrackPad\CyHidWin.exe

(Cypress Semiconductor Corporation) C:\Program Files\Cypress\TrackPad\CyCpIo.exe

(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe

(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe

(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\OFFICE15\CSISYNCCLIENT.EXE

(Intel Corporation) C:\Windows\System32\igfxtray.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe

(Compal Electronics, INC.) C:\Program Files\Dell\QuickSet\ResetTouch.exe

(Dell Inc.) C:\Program Files\Dell\QuickSet\quickset.exe

(Microsoft Corporation) C:\Windows\System32\rundll32.exe

(Dropbox, Inc.) C:\Users\Windows8\AppData\Local\Dropbox\Update\DropboxUpdate.exe

(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe

(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe

(Dropbox, Inc.) C:\Users\Windows8\AppData\Roaming\Dropbox\bin\Dropbox.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe

(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe

() C:\Program Files (x86)\AVG Web TuneUp\vprot.exe

() C:\Program Files (x86)\Common Files\Freemake Shared\ProductUpdater\ProductUpdater.exe

(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe

(IObit) C:\Program Files (x86)\IObit\Advanced SystemCare\ASCTray.exe

(IObit) C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallMonitor.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe

(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20911_x64__8wekyb3d8bbwe\livecomm.exe

(Microsoft Corporation) C:\Windows\System32\WWAHost.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWelcome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(BitTorrent Inc.) C:\Users\Windows8\AppData\Roaming\uTorrent\uTorrent.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\…\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6827664 2012-08-14] (Realtek Semiconductor)

HKLM\…\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1215632 2012-08-06] (Realtek Semiconductor)

HKLM\…\Run: [ResetTouch] => c:\Program Files\Dell\QuickSet\ResetTouch.exe [8500120 2012-10-17] (Compal Electronics, INC.)

HKLM\…\Run: [QuickSet] => c:\Program Files\Dell\QuickSet\QuickSet.exe [5757328 2012-10-17] (Dell Inc.)

HKLM\…\Run: [BTMTrayAgent] => rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll",TrayApp

HKLM-x32\…\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [277504 2012-07-09] (Intel Corporation)

HKLM-x32\…\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43816 2014-07-03] (Apple Inc.)

HKLM-x32\…\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [5624784 2013-07-25] (Safer-Networking Ltd.)

HKLM-x32\…\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-07-08] (Apple Inc.)

HKLM-x32\…\Run: [AVG_UI] => C:\Program Files (x86)\AVG\AVG2015\avgui.exe [3820440 2016-04-21] (AVG Technologies CZ, s.r.o.)

HKLM-x32\…\Run: [vProt] => C:\Program Files (x86)\AVG Web TuneUp\vprot.exe [1941064 2016-05-29] ()

HKLM-x32\…\Run: [ProductUpdater] => C:\Program Files (x86)\Common Files\Freemake Shared\ProductUpdater\ProductUpdater.exe [73216 2016-01-19] ()

Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)

Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]

HKU\S-1-5-21-1111288859-4143947986-3219784061-1001\…\Run: [Spybot-S&D; Cleaning] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDCleaner.exe [5915776 2016-03-21] (Safer-Networking Ltd.)

HKU\S-1-5-21-1111288859-4143947986-3219784061-1001\…\Run: [Google Update] => C:\Users\Windows8\AppData\Local\Google\Update\GoogleUpdate.exe [107848 2015-03-24] (Google Inc.)

HKU\S-1-5-21-1111288859-4143947986-3219784061-1001\…\Run: [Dropbox Update] => C:\Users\Windows8\AppData\Local\Dropbox\Update\DropboxUpdate.exe [134512 2015-06-07] (Dropbox, Inc.)

HKU\S-1-5-21-1111288859-4143947986-3219784061-1001\…\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [50599552 2016-02-10] (Skype Technologies S.A.)

HKU\S-1-5-21-1111288859-4143947986-3219784061-1001\…\Run: [Advanced SystemCare 9] => C:\Program Files (x86)\IObit\Advanced SystemCare\ASCTray.exe [2019616 2016-01-11] (IObit)

HKU\S-1-5-21-1111288859-4143947986-3219784061-1001\…\Run: [SpybotPostWindows10UpgradeReInstall] => C:\Program Files\Common Files\AV\Spybot - Search and Destroy\Test.exe [1011200 2015-07-28] (Safer-Networking Ltd.)

HKU\S-1-5-21-1111288859-4143947986-3219784061-1001\…\Policies\Explorer: [NolowDiskSpaceChecks] 1

HKU\S-1-5-21-1111288859-4143947986-3219784061-1001\…\MountPoints2: {72a0de9a-f1ef-11e3-bea8-c48508fe0b3b} - "D:\PhotoViewer.exe"

HKU\S-1-5-21-1111288859-4143947986-3219784061-1001\…\MountPoints2: {7ebd172e-4acd-11e5-beda-c48508fe0b3b} - "D:\VZW_Software_upgrade_assistant.exe"

HKU\S-1-5-18\…\RunOnce: [Application Restart #0] => C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe [372424 2016-02-08] (Microsoft Corporation)

ShellIconOverlayIdentifiers: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => C:\Users\Windows8\AppData\Local\Microsoft\OneDrive\17.3.6386.0412\amd64\FileSyncShell64.dll [2016-04-21] (Microsoft Corporation)

ShellIconOverlayIdentifiers: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => C:\Users\Windows8\AppData\Local\Microsoft\OneDrive\17.3.6386.0412\amd64\FileSyncShell64.dll [2016-04-21] (Microsoft Corporation)

ShellIconOverlayIdentifiers: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => C:\Users\Windows8\AppData\Local\Microsoft\OneDrive\17.3.6386.0412\amd64\FileSyncShell64.dll [2016-04-21] (Microsoft Corporation)

ShellIconOverlayIdentifiers: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Windows8\AppData\Roaming\Dropbox\bin\DropboxExt64.34.dll [2016-05-06] (Dropbox, Inc.)

ShellIconOverlayIdentifiers: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Windows8\AppData\Roaming\Dropbox\bin\DropboxExt64.34.dll [2016-05-06] (Dropbox, Inc.)

ShellIconOverlayIdentifiers: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Windows8\AppData\Roaming\Dropbox\bin\DropboxExt64.34.dll [2016-05-06] (Dropbox, Inc.)

ShellIconOverlayIdentifiers: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Windows8\AppData\Roaming\Dropbox\bin\DropboxExt64.34.dll [2016-05-06] (Dropbox, Inc.)

ShellIconOverlayIdentifiers: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Windows8\AppData\Roaming\Dropbox\bin\DropboxExt64.34.dll [2016-05-06] (Dropbox, Inc.)

ShellIconOverlayIdentifiers: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Windows8\AppData\Roaming\Dropbox\bin\DropboxExt64.34.dll [2016-05-06] (Dropbox, Inc.)

ShellIconOverlayIdentifiers: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Windows8\AppData\Roaming\Dropbox\bin\DropboxExt64.34.dll [2016-05-06] (Dropbox, Inc.)

ShellIconOverlayIdentifiers: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Windows8\AppData\Roaming\Dropbox\bin\DropboxExt64.34.dll [2016-05-06] (Dropbox, Inc.)

ShellIconOverlayIdentifiers-x32: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => C:\Users\Windows8\AppData\Local\Microsoft\OneDrive\17.3.6386.0412\FileSyncShell.dll [2016-04-21] (Microsoft Corporation)

ShellIconOverlayIdentifiers-x32: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => C:\Users\Windows8\AppData\Local\Microsoft\OneDrive\17.3.6386.0412\FileSyncShell.dll [2016-04-21] (Microsoft Corporation)

ShellIconOverlayIdentifiers-x32: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => C:\Users\Windows8\AppData\Local\Microsoft\OneDrive\17.3.6386.0412\FileSyncShell.dll [2016-04-21] (Microsoft Corporation)

Startup: C:\Users\Windows8\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2016-05-11]

ShortcutTarget: Dropbox.lnk -> C:\Users\Windows8\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

BootExecute: autocheck autochk * sdnclean64.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt

Tcpip\Parameters: [DhcpNameServer] 10.0.0.1

Tcpip\..\Interfaces\{4105E6F7-9EEA-471D-9BDD-A85D657353AC}: [DhcpNameServer] 10.0.0.1

Internet Explorer:

==================

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION

HKU\S-1-5-21-1111288859-4143947986-3219784061-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://mysearch.avg.com/?cid={D6ACD94B-A806-468C-BF2F-7A79F28E2140}∣=b44dc21ea30447d2a1f515cc4e1ae2c8-e5330d70026651cc34e2857f33dfffeb5b36bc74⟨=en&ds;=AVG&coid;=avgtbavg&cmpid;=0715av≺=fr&d;=2015-07-16 18:15:11&v;=4.1.4.948&pid;=wtu&sg;=&sap;=hp

HKU\S-1-5-21-1111288859-4143947986-3219784061-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://dell13.msn.com

SearchScopes: HKLM -> DefaultScope {0F4D66F3-7CE2-49F0-BC37-4A0711EBE9C0} URL = hxxp://Taplika.com/results.php?f=4&q;={searchTerms}&a;=tpl_idaddy_15_01&cd;=2XzuyEtN2Y1L1Qzu0CyEzzyDtDzz0F0EtD0BtAzzyBzzyE0EtN0D0Tzu0StCtDzyzztN1L2XzutAtFyCtFyCtFtDtN1L1Czu2Z1E1I1V1L1Q1T1Q1Q2UtN1L1G1B1V1N2Y1L1Qzu2SyDtCtAtByEtA0BzytG0D0DyC0DtGtCzy0CyBtGyDtByD0DtGtDyEyCyC0AyDyCyB0D0DtCyE2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyDyCyB0FyCzztByEtGyB0F0BtAtGyEtC0FzztG0AyB0DtAtGyDtC0EzyyBzyyB0EzzyBtDyD2Q&cr;=519532889&ir;=

SearchScopes: HKLM -> {0F4D66F3-7CE2-49F0-BC37-4A0711EBE9C0} URL = hxxp://Taplika.com/results.php?f=4&q;={searchTerms}&a;=tpl_idaddy_15_01&cd;=2XzuyEtN2Y1L1Qzu0CyEzzyDtDzz0F0EtD0BtAzzyBzzyE0EtN0D0Tzu0StCtDzyzztN1L2XzutAtFyCtFyCtFtDtN1L1Czu2Z1E1I1V1L1Q1T1Q1Q2UtN1L1G1B1V1N2Y1L1Qzu2SyDtCtAtByEtA0BzytG0D0DyC0DtGtCzy0CyBtGyDtByD0DtGtDyEyCyC0AyDyCyB0D0DtCyE2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyDyCyB0FyCzztByEtGyB0F0BtAtGyEtC0FzztG0AyB0DtAtGyDtC0EzyyBzyyB0EzzyBtDyD2Q&cr;=519532889&ir;=

SearchScopes: HKU\S-1-5-21-1111288859-4143947986-3219784061-1001 -> DefaultScope {0F4D66F3-7CE2-49F0-BC37-4A0711EBE9C0} URL = hxxp://Taplika.com/results.php?f=4&q;={searchTerms}&a;=tpl_idaddy_15_01&cd;=2XzuyEtN2Y1L1Qzu0CyEzzyDtDzz0F0EtD0BtAzzyBzzyE0EtN0D0Tzu0StCtDzyzztN1L2XzutAtFyCtFyCtFtDtN1L1Czu2Z1E1I1V1L1Q1T1Q1Q2UtN1L1G1B1V1N2Y1L1Qzu2SyDtCtAtByEtA0BzytG0D0DyC0DtGtCzy0CyBtGyDtByD0DtGtDyEyCyC0AyDyCyB0D0DtCyE2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyDyCyB0FyCzztByEtGyB0F0BtAtGyEtC0FzztG0AyB0DtAtGyDtC0EzyyBzyyB0EzzyBtDyD2Q&cr;=519532889&ir;=

SearchScopes: HKU\S-1-5-21-1111288859-4143947986-3219784061-1001 -> {0F4D66F3-7CE2-49F0-BC37-4A0711EBE9C0} URL = hxxp://Taplika.com/results.php?f=4&q;={searchTerms}&a;=tpl_idaddy_15_01&cd;=2XzuyEtN2Y1L1Qzu0CyEzzyDtDzz0F0EtD0BtAzzyBzzyE0EtN0D0Tzu0StCtDzyzztN1L2XzutAtFyCtFyCtFtDtN1L1Czu2Z1E1I1V1L1Q1T1Q1Q2UtN1L1G1B1V1N2Y1L1Qzu2SyDtCtAtByEtA0BzytG0D0DyC0DtGtCzy0CyBtGyDtByD0DtGtDyEyCyC0AyDyCyB0D0DtCyE2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyDyCyB0FyCzztByEtGyB0F0BtAtGyEtC0FzztG0AyB0DtAtGyDtC0EzyyBzyyB0EzzyBtDyD2Q&cr;=519532889&ir;=

SearchScopes: HKU\S-1-5-21-1111288859-4143947986-3219784061-1001 -> {589B893E-773C-4941-88C2-0DCC718E621C} URL =

SearchScopes: HKU\S-1-5-21-1111288859-4143947986-3219784061-1001 -> {95B7759C-8C7F-4BF1-B163-73684A933233} URL = hxxps://mysearch.avg.com/search?cid={D6ACD94B-A806-468C-BF2F-7A79F28E2140}∣=b44dc21ea30447d2a1f515cc4e1ae2c8-e5330d70026651cc34e2857f33dfffeb5b36bc74⟨=en&ds;=AVG&coid;=avgtbavg&cmpid;=0715av≺=fr&d;=2015-07-16 18:15:11&v;=4.1.4.948&pid;=wtu&sg;=&sap;=dsp&q;={searchTerms}

BHO: ExplorerWnd Helper -> {10921475-03CE-4E04-90CE-E2E7EF20C814} -> C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallExplorer.dll [2015-11-12] (IObit)

BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office15\OCHelper.dll [2016-03-15] (Microsoft Corporation)

BHO: AVG Web TuneUp -> {95B7759C-8C7F-4BF1-B163-73684A933233} -> C:\Program Files\AVG Web TuneUp\4.2.9.726\AVG Web TuneUp.dll [2016-04-21] (AVG)

BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2016-01-08] (Microsoft Corporation)

BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)

BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL [2016-03-15] (Microsoft Corporation)

BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll [2016-03-15] (Microsoft Corporation)

BHO-x32: AVG Web TuneUp -> {95B7759C-8C7F-4BF1-B163-73684A933233} -> C:\Program Files (x86)\AVG Web TuneUp\4.2.9.726\AVG Web TuneUp.dll [2016-04-21] (AVG)

BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2016-01-08] (Microsoft Corporation)

BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)

BHO-x32: Advanced SystemCare Surfing Protection -> {BA0C978D-D909-49B6-AFE2-8BDE245DC7E6} -> C:\Program Files (x86)\IObit\Surfing Protection\BrowerProtect\ASCPlugin_Protection.dll [2015-07-09] (IObit)

BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL [2016-03-15] (Microsoft Corporation)

Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL [2014-03-12] (Microsoft Corporation)

Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2016-01-08] (Microsoft Corporation)

Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2016-01-08] (Microsoft Corporation)

StartMenuInternet: IEXPLORE.EXE - iexplore.exe

FireFox:

========

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-12] ( Microsoft Corporation)

FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)

FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office15\NPSPWRAP.DLL [2014-01-23] (Microsoft Corporation)

FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-02-21] ()

FF Plugin-x32: @avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin -> C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\40.2.9\\npsitesafety.dll [No File]

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2012-06-06] (Intel Corporation)

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2012-06-06] (Intel Corporation)

FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2015-11-18] (Microsoft Corporation)

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-12] ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL [2014-01-22] (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-09-12] (Microsoft Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.30.3\npGoogleUpdate3.dll [2016-05-29] (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.30.3\npGoogleUpdate3.dll [2016-05-29] (Google Inc.)

FF Plugin HKU\S-1-5-21-1111288859-4143947986-3219784061-1001: @tools.google.com/Google Update;version=3 -> C:\Users\Windows8\AppData\Local\Google\Update\1.3.30.3\npGoogleUpdate3.dll [2016-05-29] (Google Inc.)

FF Plugin HKU\S-1-5-21-1111288859-4143947986-3219784061-1001: @tools.google.com/Google Update;version=9 -> C:\Users\Windows8\AppData\Local\Google\Update\1.3.30.3\npGoogleUpdate3.dll [2016-05-29] (Google Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll [2015-11-18] (Microsoft Corporation)

Chrome:

=======

CHR HomePage: Default -> hxxps://www.google.com/webhp?sourceid=chrome-instant&ion;=1&espv;=2&ie;=UTF-8

CHR StartupUrls: Default -> "hxxp://Taplika.com/?f=7&a;=tpl_idaddy_15_01&cd;=2XzuyEtN2Y1L1Qzu0CyEzzyDtDzz0F0EtD0BtAzzyBzzyE0EtN0D0Tzu0StCtDzyzztN1L2XzutAtFyCtFyCtFtDtN1L1Czu2Z1E1I1V1L1Q1T1Q1Q2UtN1L1G1B1V1N2Y1L1Qzu2SyDtCtAtByEtA0BzytG0D0DyC0DtGtCzy0CyBtGyDtByD0DtGtDyEyCyC0AyDyCyB0D0DtCyE2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyDyCyB0FyCzztByEtGyB0F0BtAtGyEtC0FzztG0AyB0DtAtGyDtC0EzyyBzyyB0EzzyBtDyD2Q&cr;=519532889&ir;=","hxxp://www.msn.com/?pc=UP97&ocid;=UP97DHP"

CHR Profile: C:\Users\Windows8\AppData\Local\Google\Chrome\User Data\Default

CHR Extension: (Google Docs) - C:\Users\Windows8\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-02-06]

CHR Extension: (Google Drive) - C:\Users\Windows8\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-10-28]

CHR Extension: (YouTube) - C:\Users\Windows8\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-09-29]

CHR Extension: (Google Cast) - C:\Users\Windows8\AppData\Local\Google\Chrome\User Data\Default\Extensions\boadgeojelhgndaghljhdicfkmllpafd [2016-05-11]

CHR Extension: (Google Search) - C:\Users\Windows8\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-10-28]

CHR Extension: (Google Docs Offline) - C:\Users\Windows8\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-03-18]

CHR Extension: (Chrome Web Store Payments) - C:\Users\Windows8\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-05-11]

CHR Extension: (Gmail) - C:\Users\Windows8\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-04-01]

CHR HKLM\…\Chrome\Extension: [lfkjojacgdjkninepeghaamnapdjmlfn] - hxxps://clients2.google.com/service/update2/crx

CHR HKLM-x32\…\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2016-01-08]

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AdvancedSystemCareService9; C:\Program Files (x86)\IObit\Advanced SystemCare\ASCService.exe [446240 2016-01-05] (IObit)

S2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2015\avgidsagent.exe [3646888 2016-02-04] (AVG Technologies CZ, s.r.o.)

R2 avgwd; C:\Program Files (x86)\AVG\AVG2015\avgwdsvc.exe [335656 2016-02-04] (AVG Technologies CZ, s.r.o.)

R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1433216 2016-01-08] (Microsoft Corporation)

R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1773696 2016-01-08] (Microsoft Corporation)

R2 CyTpService; C:\Program Files\Cypress\TrackPad\CyTpService.exe [30208 2012-10-24] (Cypress Semiconductor Corporation)

R2 DptfParticipantProcessorService; C:\Windows\system32\DptfParticipantProcessorService.exe [29056 2012-07-30] ()

R2 DptfPolicyConfigTDPService; C:\Windows\system32\DptfPolicyConfigTDPService.exe [30592 2012-07-30] ()

R2 Freemake Improver; C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe [108032 2016-01-19] (Freemake) [File not signed]

R2 IAStorDataMgrSvc; C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [7168 2012-07-09] (Intel Corporation) [File not signed]

R2 irstrtsv; C:\Windows\SysWOW64\irstrtsv.exe [193576 2012-07-28] (Intel Corporation)

R2 ISCTAgent; c:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe [149032 2012-08-16] ()

R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-06-25] (Intel Corporation)

R2 LiveUpdateSvc; C:\Program Files (x86)\IObit\LiveUpdate\LiveUpdate.exe [2945312 2016-01-14] (IObit)

S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [273136 2013-08-28] ()

R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [200808 2012-05-09] (Realtek Semiconductor)

R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [3921880 2013-10-15] (Safer-Networking Ltd.)

R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1042272 2013-09-20] (Safer-Networking Ltd.)

R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171416 2013-09-13] (Safer-Networking Ltd.)

R2 SftService; C:\Program Files (x86)\Dell Backup and Recovery\sftservice.exe [1915408 2013-10-09] (SoftThinks SAS)

R2 vToolbarUpdater40.2.9; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\40.2.9\ToolbarUpdater.exe [1964616 2016-04-21] (AVG Secure Search)

R2 WakeupService; C:\Program Files (x86)\Intel Corporation\Intel(R) Sensor Solution Service\wakeupSensor.exe [8704 2012-08-30] (Microsoft) [File not signed]

S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366552 2015-07-07] (Microsoft Corporation)

S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2015-07-07] (Microsoft Corporation)

R2 WtuSystemSupport; C:\Program Files (x86)\AVG Web TuneUp\WtuSystemSupport.exe [1223752 2016-04-21] ()

R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3378416 2013-08-28] (Intel® Corporation)

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S0 Avgboota; C:\Windows\System32\DRIVERS\avgboota.sys [21152 2015-03-27] (AVG Technologies CZ, s.r.o.)

R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [296368 2015-12-16] (AVG Technologies CZ, s.r.o.)

R3 cyhid; C:\Windows\System32\drivers\cyhid.sys [143360 2012-11-07] (Cypress Semiconductor, Inc.)

R3 cykbfltrService; C:\Windows\system32\DRIVERS\cykbfltr.sys [20992 2012-11-07] (Cypress Semiconductor, Inc.)

R3 cymfltrService; C:\Windows\system32\DRIVERS\cymfltr.sys [98816 2012-11-07] (Cypress Semiconductor, Inc.)

S3 CySmb; C:\Windows\System32\drivers\CySmb.sys [10752 2012-11-07] (Cypress Semiconductor, Inc.)

S3 DellRbtn; C:\Windows\System32\drivers\DellRbtn.sys [10752 2012-08-04] (OSR Open Systems Resources, Inc.)

R3 DptfDevDram; C:\Windows\system32\DRIVERS\DptfDevDram.sys [107328 2012-07-13] (Intel Corporation)

R3 DptfDevFan; C:\Windows\system32\DRIVERS\DptfDevFan.sys [42816 2012-07-13] (Intel Corporation)

R3 DptfDevGen; C:\Windows\system32\DRIVERS\DptfDevGen.sys [64832 2012-07-13] (Intel Corporation)

R3 DptfDevPch; C:\Windows\system32\DRIVERS\DptfDevPch.sys [96064 2012-07-13] (Intel Corporation)

R3 DptfDevProc; C:\Windows\system32\DRIVERS\DptfDevProc.sys [228672 2012-07-13] (Intel Corporation)

R3 DptfManager; C:\Windows\system32\DRIVERS\DptfManager.sys [361792 2012-07-13] (Intel Corporation)

S0 ebdrv; C:\Windows\System32\drivers\evbda.sys [3357024 2013-08-22] (Broadcom Corporation)

R1 HWiNFO32; C:\WINDOWS\SysWOW64\drivers\HWiNFO64A.SYS [27552 2016-02-08] (REALiX™)

R3 ikbevent; C:\Windows\system32\DRIVERS\ikbevent.sys [20968 2012-08-16] ()

R3 imsevent; C:\Windows\system32\DRIVERS\imsevent.sys [19944 2012-08-16] ()

R3 irstrtdv; C:\Windows\System32\drivers\irstrtdv.sys [43800 2012-07-28] (Intel Corporation)

R3 ISCT; C:\Windows\System32\drivers\ISCTD64.sys [46016 2012-08-18] ()

R3 NETwNe64; C:\Windows\system32\DRIVERS\Netwew00.sys [3345376 2013-10-08] (Intel Corporation)

R3 SensorsAlsDriver; C:\Windows\System32\drivers\WUDFRd.sys [226304 2014-10-28] (Microsoft Corporation)

R3 SensorsServiceDriver; C:\Windows\System32\drivers\WUDFRd.sys [226304 2014-10-28] (Microsoft Corporation)

S3 SWDUMon; C:\Windows\system32\DRIVERS\SWDUMon.sys [16152 2016-02-08] ()

R3 usb3Hub; C:\Windows\System32\drivers\usb3Hub.sys [47072 2012-10-09] (Windows (R) Win 7 DDK provider)

S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [44560 2015-07-07] (Microsoft Corporation)

S3 WdFilter; C:\Windows\system32\drivers\WdFilter.sys [270168 2015-07-07] (Microsoft Corporation)

S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114520 2015-07-07] (Microsoft Corporation)

R3 WPRO_41_2001; C:\Windows\System32\drivers\WPRO_41_2001.sys [34752 2016-05-29] ()

R3 XHCIPort; C:\Windows\System32\drivers\XHCIPort.sys [188896 2012-10-09] (Windows (R) Win 7 DDK provider)

U3 aswMBR; \??\C:\Users\Windows8\AppData\Local\Temp\aswMBR.sys [X]

U3 aswVmm; \??\C:\Users\Windows8\AppData\Local\Temp\aswVmm.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-05-29 18:40 - 2016-05-29 18:40 - 00030786 _____ C:\Users\Windows8\Desktop\FRST.txt

2016-05-29 18:40 - 2016-05-29 18:40 - 00000000 ____D C:\FRST

2016-05-29 18:38 - 2016-05-29 18:39 - 02383872 _____ (Farbar) C:\Users\Windows8\Desktop\FRST64.exe

2016-05-29 18:37 - 2016-05-29 18:37 - 00001564 _____ C:\Users\Windows8\Desktop\aswMBR.txt

2016-05-29 18:37 - 2016-05-29 18:37 - 00000512 _____ C:\Users\Windows8\Desktop\MBR.dat

2016-05-29 18:35 - 2016-05-29 18:36 - 05198336 _____ (AVAST Software) C:\Users\Windows8\Downloads\aswMBR.exe

2016-05-29 18:33 - 2016-05-29 18:35 - 2746903220 _____ C:\Users\Windows8\Downloads\[ www.CpasBien.cm ] Zootopia.2016.MULTi.1080p.BluRay.x264-VENUE.mkv

2016-05-29 18:32 - 2016-05-29 18:32 - 00538073 _____ C:\Users\Windows8\Downloads\Zootopia+2016+MULTi+1080p+BluRay+x264-VENUE+mkv.torrent

2016-05-29 18:15 - 2016-05-29 18:15 - 00388608 _____ (Trend Micro Inc.) C:\Users\Windows8\Downloads\HijackThis.exe

2016-05-29 18:13 - 2015-07-28 17:52 - 00821920 _____ (Safer-Networking Ltd. ) C:\Users\Public\Desktop\Post Win10 Spybot-install.exe

2016-05-29 17:59 - 2016-05-29 18:04 - 00000936 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-1111288859-4143947986-3219784061-1001UA.job

2016-05-29 17:59 - 2016-05-29 18:04 - 00000884 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-1111288859-4143947986-3219784061-1001Core.job

2016-05-29 17:57 - 2016-05-29 18:02 - 00000918 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job

2016-05-29 17:57 - 2016-05-29 17:57 - 00000922 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job

2016-05-29 17:54 - 2016-05-29 17:54 - 00094656 _____ (CACE Technologies) C:\WINDOWS\system32\WPRO_41_2001woem.tmp

2016-05-11 19:58 - 2016-05-11 19:58 - 00000000 ____D C:\Users\Windows8\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox

2016-05-11 19:50 - 2016-04-05 14:53 - 00829944 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe

2016-05-11 19:50 - 2016-04-05 14:53 - 00176632 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl

2016-05-11 19:48 - 2016-05-11 19:48 - 00000988 _____ C:\Users\Public\Desktop\AVG 2015.lnk

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-05-29 18:39 - 2015-01-03 21:02 - 00000000 ____D C:\Users\Windows8\AppData\Roaming\uTorrent

2016-05-29 18:19 - 2012-07-26 00:59 - 00000000 ____D C:\WINDOWS\CbsTemp

2016-05-29 18:13 - 2015-06-26 19:50 - 00000000 ____D C:\Program Files\Common Files\AV

2016-05-29 18:13 - 2013-12-25 18:50 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2

2016-05-29 18:09 - 2013-12-04 12:41 - 00003598 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1111288859-4143947986-3219784061-1001

2016-05-29 18:08 - 2013-08-22 08:36 - 00000000 ___HD C:\Program Files\WindowsApps

2016-05-29 18:08 - 2013-08-22 08:36 - 00000000 ____D C:\WINDOWS\AppReadiness

2016-05-29 18:04 - 2013-12-04 12:42 - 00002222 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk

2016-05-29 18:04 - 2013-12-04 12:42 - 00002210 _____ C:\Users\Public\Desktop\Google Chrome.lnk

2016-05-29 18:02 - 2013-11-14 00:28 - 00865408 _____ C:\WINDOWS\system32\PerfStringBackup.INI

2016-05-29 18:02 - 2013-08-22 06:36 - 00000000 ____D C:\WINDOWS\Inf

2016-05-29 18:01 - 2016-02-08 18:43 - 00003246 _____ C:\WINDOWS\System32\Tasks\Driver Booster Scheduler

2016-05-29 18:01 - 2016-02-08 18:43 - 00002878 _____ C:\WINDOWS\System32\Tasks\Driver Booster SkipUAC (Windows8)

2016-05-29 17:59 - 2015-03-24 18:51 - 00003888 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1111288859-4143947986-3219784061-1001UA

2016-05-29 17:59 - 2015-03-24 18:51 - 00003508 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1111288859-4143947986-3219784061-1001Core

2016-05-29 17:59 - 2013-12-04 12:39 - 00000000 ____D C:\ProgramData\MFAData

2016-05-29 17:58 - 2015-07-16 18:15 - 00000000 ____D C:\ProgramData\AVG Web TuneUp

2016-05-29 17:58 - 2014-12-01 18:21 - 00000000 ___RD C:\Users\Windows8\Dropbox

2016-05-29 17:58 - 2014-09-02 20:00 - 00000000 ____D C:\Users\Windows8\AppData\Roaming\Skype

2016-05-29 17:58 - 2014-02-15 16:30 - 00980480 ___SH C:\Users\Windows8\Desktop\Thumbs.db

2016-05-29 17:58 - 2013-12-24 17:42 - 00000000 ___DO C:\Users\Windows8\SkyDrive

2016-05-29 17:57 - 2015-06-07 19:47 - 00000946 _____ C:\WINDOWS\Tasks\DropboxUpdateTaskUserS-1-5-21-1111288859-4143947986-3219784061-1001UA.job

2016-05-29 17:57 - 2013-12-04 12:41 - 00003894 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA

2016-05-29 17:57 - 2013-12-04 12:41 - 00003658 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore

2016-05-29 17:57 - 2013-08-22 06:25 - 00262144 ___SH C:\WINDOWS\system32\config\ELAM

2016-05-29 17:56 - 2013-01-23 03:01 - 00000000 ____D C:\Program Files (x86)\Dell Backup and Recovery

2016-05-29 17:54 - 2013-08-22 07:45 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT

2016-05-29 17:54 - 2013-08-22 07:44 - 00481744 _____ C:\WINDOWS\system32\FNTCACHE.DAT

2016-05-29 17:54 - 2013-01-23 02:57 - 00034752 _____ C:\WINDOWS\system32\Drivers\WPRO_41_2001.sys

2016-05-29 17:52 - 2016-02-08 18:43 - 00000000 ____D C:\ProgramData\ProductData

2016-05-29 17:52 - 2015-07-16 18:15 - 00000000 ____D C:\Program Files\AVG Web TuneUp

2016-05-29 17:52 - 2015-07-16 18:15 - 00000000 ____D C:\Program Files (x86)\AVG Web TuneUp

2016-05-29 17:52 - 2013-08-22 06:25 - 00524288 ___SH C:\WINDOWS\system32\config\BBI

2016-05-29 17:51 - 2014-12-11 19:58 - 00000000 ____D C:\WINDOWS\system32\appraiser

2016-05-29 17:51 - 2013-08-22 08:36 - 00000000 ___RD C:\WINDOWS\ToastData

2016-05-11 20:00 - 2013-12-24 17:34 - 00000000 ____D C:\Users\Windows8

2016-05-11 20:00 - 2013-12-21 14:09 - 00000000 ____D C:\WINDOWS\system32\MRT

2016-05-11 19:59 - 2014-10-21 19:28 - 00325120 ___SH C:\Users\Windows8\Downloads\Thumbs.db

2016-05-11 19:58 - 2014-12-01 18:17 - 00000000 ____D C:\Users\Windows8\AppData\Roaming\Dropbox

2016-05-11 19:56 - 2013-12-24 17:13 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013

2016-05-11 19:56 - 2013-12-21 14:09 - 135176864 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe

2016-05-11 19:51 - 2015-04-11 20:18 - 00000000 ___SD C:\WINDOWS\SysWOW64\GWX

2016-05-11 19:51 - 2015-04-11 20:18 - 00000000 ___SD C:\WINDOWS\system32\GWX

2016-05-11 19:49 - 2014-04-20 13:41 - 00003934 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{64551A90-571D-4DB0-89BB-C3EF1BA1C0F0}

2016-05-11 19:48 - 2014-04-03 21:45 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG

2016-05-11 19:47 - 2016-02-08 18:42 - 00002283 _____ C:\Users\Public\Desktop\Advanced SystemCare 9.lnk

==================== Files in the root of some directories =======

2015-01-04 19:47 - 2015-01-14 20:47 - 0000128 _____ () C:\Users\Windows8\AppData\Roaming\WB.CFG

2015-01-06 11:47 - 2015-01-06 11:47 - 0000001 _____ () C:\Users\Windows8\AppData\Local\DSI.DAT

==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\system32\winlogon.exe => File is digitally signed

C:\WINDOWS\system32\wininit.exe => File is digitally signed

C:\WINDOWS\explorer.exe => File is digitally signed

C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed

C:\WINDOWS\system32\svchost.exe => File is digitally signed

C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed

C:\WINDOWS\system32\services.exe => File is digitally signed

C:\WINDOWS\system32\User32.dll => File is digitally signed

C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed

C:\WINDOWS\system32\userinit.exe => File is digitally signed

C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed

C:\WINDOWS\system32\rpcss.dll => File is digitally signed

C:\WINDOWS\system32\dnsapi.dll => File is digitally signed

C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed

C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2016-04-21 19:58

==================== End of FRST.txt ============================

joeyfor

Post #4May 30, 2016, 12:41 PM UTC