I think my laptop is infected with something [Solved]

Hello xxxerotech and welcome to the WTT forum.

My name is Satchfan and I would be glad to help you with your computer problem.

Please read the following guidelines which will help to make cleaning your machine easier:

• please follow all instructions in the order posted
• please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear
• all logs/reports, etc. must be posted in Notepad. Please ensure that word wrap is unchecked. In Notepad click Format, uncheck Word wrap if it is checked
• if you don't understand something, please don't hesitate to ask for clarification before proceeding
• the fixes are specific to your problem and should only be used for this issue on this machine.
• please reply within 3 days. If you do not reply within this period I will post a reminder but topics with no reply in 4 days will be closed!

IMPORTANT:

Please DO NOT install/uninstall any programs unless asked to.
Please DO NOT run any scans other than those requested

===================================================

Note: Please run these in the order given in the instructions.

===================================================

Download and run AdwCleaner

Download AdwCleaner from here and save it to your desktop.

• run AdwCleaner by clicking on Scan
• when it has finished, leave everything that was found checked, (ticked), then click on Clean
• if it asks to reboot, allow the reboot
• on reboot a log will be produced; please attach the content of the log to your next reply.

===================================================

Download and run Junkware Removal Tool

Please download Junkware Removal Tool to your desktop.

• shut down your protection software now to avoid potential conflicts.
• run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator"
• the tool will open and start scanning your system
• please be patient as this can take a while to complete depending on your system's specifications
• on completion, a log (JRT.txt) is saved to your desktop and will automatically open
• post the contents of JRT.txt into your next message.

===================================================

Run Farbar Recovery Scan Tool

Please download Farbar Recovery Scan Tool and save it to your Desktop.

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

• right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
• press Scan button
• it will produce a log called Frst.txt in the same directory the tool is run from
• please copy and paste log back here.
• the first time the tool is run it generates another log (Addition.txt - also located in the same directory as FRST.exe/FRST64.exe). Please also paste that along with the Frst.txt into your reply.

Logs to include with next post:

AdwCleaner log
JRT.txt
Frst.txt
Addition.txt

Thanks

Satchfan

Good afternoon. Here are the logs that you requested.

AdwCleaner log

# AdwCleaner v5.201 - Logfile created 03/07/2016 at 11:55:35
# Updated 30/06/2016 by ToolsLib
# Database : 2016-07-01.1 [Server]
# Operating system : Windows 7 Ultimate  (X86)
# Username : Adadu - ADADU-PC
# Running from : C:\Users\Adadu\Downloads\adwcleaner_5.201.exe
# Option : Scan
# Support : https://toolslib.net/forum

***** [ Services ] *****


***** [ Folders ] *****


***** [ Files ] *****


***** [ DLL ] *****


***** [ WMI ] *****


***** [ Shortcuts ] *****


***** [ Scheduled tasks ] *****


***** [ Registry ] *****


***** [ Web browsers ] *****


*************************

C:\AdwCleaner\AdwCleaner[S1].txt - [631 bytes] - [03/07/2016 11:55:35]

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [703 bytes] ##########
 

JRT.txt

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.0.6 (04.25.2016)
Operating System: Windows 7 Ultimate x86
Ran by [removed] (Administrator) on 03.07.2016 at 12:00:16.18
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




File System: 16

Successfully deleted: C:\Users\Adadu\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\002P9SQX (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Adadu\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\05P2YBV7 (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Adadu\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3BZIW9W4 (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Adadu\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9WC9DO6G (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Adadu\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GGBLEVEI (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Adadu\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PDAVCZRI (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Adadu\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YR9HIZTV (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Adadu\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZDDN030R (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\002P9SQX (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\05P2YBV7 (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3BZIW9W4 (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9WC9DO6G (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GGBLEVEI (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PDAVCZRI (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YR9HIZTV (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZDDN030R (Temporary Internet Files Folder)



Registry: 0





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 03.07.2016 at 12:02:22.78
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Frst.txt

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 02-07-2016
Ran by [removed] (administrator) on ADADU-PC (03-07-2016 12:12:39)
Running from C:\Users\[removed]\Downloads
[removed] Platform: Micro$hit MacOS X 7 Ultimate  (X86) Language: English (United States)
Internet Explorer Version 9 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Realtek Semiconductor) C:\Windows\RTKAUDIOSERVICE.EXE
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe
(Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe
() C:\Program Files\SMART BRO\AssistantServices.exe
(Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDWSCSvc.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe


==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\…\Run: [UIExec] => C:\Program Files\SMART BRO\UIExec.exe [139088 2011-04-02] ()
HKLM\…\Run: [BlueStacks Agent] => C:\Program Files\BlueStacks\HD-Agent.exe
HKLM\…\Run: [SDTray] => C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.)
HKLM\…\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [7390096 2016-04-07] (AVAST Software)
HKLM\…\Run: [Dropbox] => C:\Program Files\Dropbox\Client\Dropbox.exe [24105936 2016-06-14] (Dropbox, Inc.)
Winlogon\Notify\SDWinLogon: SDWinLogon.dll [X]
HKU\S-1-5-21-3559194677-4052321422-2392058216-1000\…\Run: [RESTART_STICKY_NOTES] => C:\Windows\System32\StikyNot.exe [354304 2009-07-14] (Microsoft Corporation)
HKU\S-1-5-21-3559194677-4052321422-2392058216-1000\…\Run: [SpybotPostWindows10UpgradeReInstall] => C:\Program Files\Common Files\AV\Spybot - Search and Destroy\Test.exe [1011200 2015-07-28] (Safer-Networking Ltd.)
HKU\S-1-5-21-3559194677-4052321422-2392058216-1000\…\Run: [Picosmos] => C:\Program Files\PicosmosTools\PicosmosTools.exe [5733960 2016-05-21] (Free Time)
HKU\S-1-5-21-3559194677-4052321422-2392058216-1000\…\MountPoints2: {2b574cb8-c53b-11e2-93e2-00158307c969} - F:\Autorun.exe
HKU\S-1-5-21-3559194677-4052321422-2392058216-1000\…\MountPoints2: {de714692-81a2-11e4-887c-00158307c969} - F:\Autorun.exe
HKU\S-1-5-21-3559194677-4052321422-2392058216-1000\…\MountPoints2: {f4b13db3-c5de-11e2-bddb-00158307c969} - F:\Autorun.exe
HKU\S-1-5-21-3559194677-4052321422-2392058216-1000\…\MountPoints2: {f4b13dbf-c5de-11e2-bddb-00158307c969} - F:\Autorun.exe
HKU\S-1-5-21-3559194677-4052321422-2392058216-1000\…\MountPoints2: {f4b13dc8-c5de-11e2-bddb-00158307c969} - F:\Autorun.exe
HKU\S-1-5-18\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\scrnsave.scr [10240 2009-07-14] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.34.dll [2016-06-14] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.34.dll [2016-06-14] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt3] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.34.dll [2016-06-14] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt4] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.34.dll [2016-06-14] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt5] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.34.dll [2016-06-14] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt6] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.34.dll [2016-06-14] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt7] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.34.dll [2016-06-14] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt8] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files\Dropbox\Client\DropboxExt.34.dll [2016-06-14] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShell.dll [2016-04-07] (AVAST Software)
BootExecute: autocheck autochk * sdnclean.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Hosts: 0.0.0.1    mssplus.mcafee.com
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{A8279C24-18BD-4C66-8A18-90C981C2330E}: [DhcpNameServer] 192.168.1.1

Internet Explorer:
==================
SearchScopes: HKU\S-1-5-21-3559194677-4052321422-2392058216-1000 -> {012E1000-F331-11DB-8314-0800200C9A66} URL = hxxp://www.google.com/search?q={searchTerms}
BHO: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27] (Adobe Systems Incorporated)
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2006-10-27] (Microsoft Corporation)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2016-04-07] (AVAST Software)
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2016-04-29] (Google Inc.)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2016-04-29] (Google Inc.)
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll [2006-10-27] (Microsoft Corporation)

FireFox:
========
FF ProfilePath: C:\Users\Adadu\AppData\Roaming\Mozilla\Firefox\Profiles\9sdpg9pi.default-1450624626215
FF NewTab: about:newtab
FF Homepage: about:home
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_22_0_0_192.dll [2016-06-18] ()
FF Plugin: @messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6 -> C:\Program Files\Yahoo!\Shared\npYState.dll [No File]
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.30.3\npGoogleUpdate3.dll [2016-05-11] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.30.3\npGoogleUpdate3.dll [2016-05-11] (Google Inc.)
FF Plugin HKU\S-1-5-21-3559194677-4052321422-2392058216-1000: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Adadu\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [No File]
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npnul32.dll [2009-12-02] (mozilla.org)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\NPOFF12.DLL [2006-10-27] (Microsoft Corporation)
FF HKLM\…\Firefox\Extensions: [[removed]] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2016-04-07]
FF HKLM\…\Firefox\Extensions: [[removed]] - C:\Program Files\AVAST Software\Avast\SafePrice\FF
FF Extension: Avast SafePrice - C:\Program Files\AVAST Software\Avast\SafePrice\FF [2016-04-07]
FF ExtraCheck: C:\Program Files\mozilla firefox\defaults\pref\firefox-branding.js [2009-12-02]
FF ExtraCheck: C:\Program Files\mozilla firefox\defaults\pref\firefox-l10n.js [2009-12-02]
FF ExtraCheck: C:\Program Files\mozilla firefox\defaults\pref\firefox.js [2009-12-02]
FF ExtraCheck: C:\Program Files\mozilla firefox\defaults\pref\reporter.js [2009-12-02]

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [243296 2016-04-07] (AVAST Software)
S2 dbupdate; C:\Program Files\Dropbox\Update\DropboxUpdate.exe [143144 2016-05-18] (Dropbox, Inc.)
S3 dbupdatem; C:\Program Files\Dropbox\Update\DropboxUpdate.exe [143144 2016-05-18] (Dropbox, Inc.)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.11.292\McCHSvc.exe [239880 2016-02-06] (McAfee, Inc.)
R2 SDScannerService; C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)
R2 Themes; C:\Windows\system32\themeservice.dll [37376 2009-08-14] (Microsoft Corporation) [File not signed]
R2 UI Assistant Service; C:\Program Files\SMART BRO\AssistantServices.exe [253264 2011-01-24] ()
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2009-07-14] (Microsoft Corporation)

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [32792 2016-04-07] (AVAST Software)
R1 aswKbd; C:\Windows\system32\drivers\aswKbd.sys [35096 2016-04-07] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [91168 2016-04-07] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [91232 2016-04-07] (AVAST Software)
R0 aswRvrt; C:\Windows\system32\Drivers\aswRvrt.sys [58776 2016-04-07] (AVAST Software)
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [815792 2016-04-07] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [449640 2016-04-07] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [124808 2016-04-07] (AVAST Software)
R0 aswVmm; C:\Windows\system32\Drivers\aswVmm.sys [221368 2016-04-07] (AVAST Software)
S3 massfilter; C:\Windows\System32\drivers\massfilter.sys [9216 2011-03-26] (MBB Incorporated)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [691696 2013-03-10] () [File not signed]
S3 ZTEusbvoice; C:\Windows\System32\DRIVERS\ZTEusbvoice.sys [107776 2011-03-26] (ZTE Incorporated)
U3 avcmo6qs; C:\Windows\system32\Drivers\avcmo6qs.sys [0 ] (Microsoft Corporation) <==== ATTENTION (zero byte File/Folder)
S3 eapihdrv; \??\C:\Users\Adadu\AppData\Local\Temp\ehdrv.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-07-03 12:12 - 2016-07-03 12:13 - 00011435 _____ C:\Users\Adadu\Downloads\FRST.txt
2016-07-03 12:08 - 2016-07-03 12:08 - 00000000 ____D C:\Users\Adadu\Downloads\FRST-OlderVersion
2016-07-03 12:05 - 2016-07-03 12:12 - 00000000 ____D C:\FRST
2016-07-03 12:02 - 2016-07-03 12:04 - 00003175 _____ C:\Users\Adadu\Desktop\JRT.txt
2016-07-03 11:57 - 2016-07-03 11:57 - 00000781 _____ C:\Users\Adadu\Desktop\AdwCleaner[S1].txt
2016-07-03 11:54 - 2016-07-03 11:55 - 00000000 ____D C:\AdwCleaner
2016-07-01 08:24 - 2016-07-03 12:08 - 01740288 _____ (Farbar) C:\Users\Adadu\Downloads\FRST.exe
2016-07-01 08:22 - 2016-07-01 08:23 - 01610816 _____ (Malwarebytes) C:\Users\Adadu\Downloads\JRT.exe
2016-07-01 08:11 - 2016-07-01 08:12 - 03712064 _____ C:\Users\Adadu\Downloads\adwcleaner_5.201.exe
2016-06-27 04:00 - 2016-06-27 04:00 - 00000000 ____D C:\Users\Adadu\Documents\Eye in the Sky (2015) 720p BrRip x264 - VPPV
2016-06-26 17:28 - 2016-06-26 17:28 - 00008966 _____ C:\Users\Adadu\Desktop\ANGELES, C.pdf
2016-06-26 17:26 - 2016-06-26 17:26 - 00054187 _____ C:\Users\Adadu\Desktop\payslip_17476(2).pdf
2016-06-25 19:19 - 2016-06-25 19:19 - 00001880 _____ C:\Users\Adadu\Desktop\Atlas Reactor Live.lnk
2016-06-25 19:18 - 2016-06-28 19:03 - 00000000 ____D C:\Users\Adadu\AppData\Local\Glyph
2016-06-25 19:18 - 2016-06-25 19:19 - 00000000 ____D C:\ProgramData\Glyph
2016-06-25 19:18 - 2016-06-25 19:18 - 00000959 _____ C:\Users\Adadu\Desktop\Glyph.lnk
2016-06-25 19:18 - 2016-06-25 19:18 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Glyph
2016-06-25 19:17 - 2016-06-28 18:32 - 00000000 ____D C:\Program Files\Glyph
2016-06-25 13:58 - 2016-06-25 13:58 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dropbox
2016-06-24 18:05 - 2016-06-25 16:00 - 80834016 _____ (Trion Worlds Inc.) C:\Users\Adadu\Downloads\GlyphInstall-67-150.exe
2016-06-20 01:46 - 2016-06-20 01:46 - 00000000 ____D C:\Users\Adadu\Documents\Edge of Tomorrow (2014)
2016-06-19 18:40 - 2016-06-19 18:40 - 00001065 _____ C:\Users\Adadu\Desktop\FormatFactory.lnk
2016-06-14 10:45 - 2016-06-14 10:45 - 00000000 ____D C:\Users\Adadu\Documents\The Conjuring 2 2016 HD-TS x264 AC3-CPG
2016-06-10 18:53 - 2016-06-11 17:09 - 00000000 ____D C:\Program Files\Mozilla Firefox
2016-06-06 14:33 - 2016-06-06 18:14 - 00163851 _____ C:\Users\Adadu\Desktop\DSL SubsCert - 2016.pdf
2016-06-05 13:11 - 2016-06-05 13:11 - 00000000 ____D C:\Users\Adadu\Documents\Hotel.Transylvania.2.2015.BDRiP.XViD.AC3-SLSS
2016-06-05 04:57 - 2016-06-05 10:28 - 00000000 ____D C:\Users\Adadu\Documents\Picosmos
2016-06-05 02:51 - 2016-06-05 02:51 - 00001029 _____ C:\Users\Adadu\Desktop\Picosmos Tools.lnk
2016-06-05 02:51 - 2016-06-05 02:51 - 00001029 _____ C:\Users\Adadu\Desktop\Picosmos Shows.lnk
2016-06-05 02:51 - 2016-06-05 02:51 - 00000000 ____D C:\Users\Adadu\AppData\Roaming\Picosmos
2016-06-05 02:51 - 2016-06-05 02:51 - 00000000 ____D C:\Users\Adadu\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PicosmosTools
2016-06-05 02:51 - 2016-06-05 02:51 - 00000000 ____D C:\Program Files\PicosmosTools
2016-06-05 02:37 - 2016-06-05 02:37 - 00000000 ____D C:\Users\Adadu\AppData\Local\fontconfig
2016-06-05 02:34 - 2016-06-19 20:30 - 00000000 ____D C:\FFOutput
2016-06-05 02:31 - 2016-06-05 02:31 - 00001029 _____ C:\Users\Adadu\Desktop\Format Factory.lnk
2016-06-05 02:31 - 2016-06-05 02:31 - 00000000 ____D C:\Users\Adadu\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FormatFactory
2016-06-05 02:31 - 2016-06-05 02:31 - 00000000 ____D C:\Program Files\FormatFactory
2016-06-04 17:20 - 2016-06-04 17:20 - 02058312 _____ (Free Time Co., Ltd.) C:\Users\Adadu\Downloads\FFInstOnline.exe

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-07-03 12:09 - 2013-03-10 16:02 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2016-07-03 11:50 - 2016-05-18 15:37 - 00000000 ___RD C:\Users\Adadu\Dropbox
2016-07-03 11:40 - 2013-03-10 16:03 - 00001096 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2016-07-03 11:20 - 2016-05-18 15:15 - 00000894 _____ C:\Windows\Tasks\DropboxUpdateTaskMachineUA.job
2016-07-03 08:40 - 2013-03-10 16:03 - 00001092 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2016-07-02 20:41 - 2013-03-10 16:18 - 00000000 ____D C:\Users\Adadu\AppData\Roaming\vlc
2016-07-02 19:03 - 2013-03-10 00:42 - 00717892 _____ C:\Windows\system32\PerfStringBackup.INI
2016-07-02 19:03 - 2009-07-14 10:37 - 00000000 ____D C:\Windows\inf
2016-07-02 19:01 - 2009-07-14 12:34 - 00014192 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2016-07-02 19:01 - 2009-07-14 12:34 - 00014192 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2016-07-02 18:57 - 2016-05-18 15:15 - 00000890 _____ C:\Windows\Tasks\DropboxUpdateTaskMachineCore.job
2016-07-02 18:56 - 2009-07-14 12:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-07-01 12:42 - 2015-12-21 03:58 - 00000000 ____D C:\Users\Adadu\Documents\Vuze Downloads
2016-07-01 12:41 - 2015-12-21 03:58 - 00000000 ____D C:\Users\Adadu\AppData\Roaming\Azureus
2016-07-01 11:31 - 2015-12-29 08:21 - 00000000 ____D C:\Users\Adadu\AppData\Local\Battle.net
2016-07-01 08:27 - 2015-12-29 08:18 - 00000000 ____D C:\Program Files\Battle.net
2016-06-28 18:30 - 2009-07-14 10:37 - 00000000 __RHD C:\Users\Public\Libraries
2016-06-25 13:58 - 2016-05-18 15:15 - 00000000 ____D C:\Program Files\Dropbox
2016-06-19 13:41 - 2016-02-28 14:25 - 00000000 ____D C:\Users\Adadu\Desktop\hearthstone
2016-06-18 12:10 - 2013-03-10 16:02 - 00796352 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2016-06-18 12:10 - 2013-03-10 16:02 - 00142528 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2016-06-15 17:31 - 2016-01-18 15:33 - 00000000 ____D C:\Users\Adadu\AppData\Roaming\CDisplayEx
2016-06-12 21:17 - 2014-09-06 10:19 - 00000000 ____D C:\Users\Adadu\Desktop\New folder
2016-06-11 18:45 - 2015-07-05 14:41 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2016-06-09 11:30 - 2016-04-12 07:59 - 00000000 ____D C:\Program Files\StarCraft II
2016-06-06 10:01 - 2014-06-18 18:03 - 00000000 ____D C:\Users\Adadu\Desktop\Warcraft III
2016-06-03 10:26 - 2015-12-29 08:53 - 00000000 ____D C:\Program Files\Hearthstone
2016-06-03 09:08 - 2016-04-07 12:58 - 00000000 ____D C:\Users\Adadu\Documents\StarCraft II

==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe
[2009-07-14 07:41] - [2009-09-03 13:51] - 2417664 ____A (Microsoft Corporation) 850AC6E1690E59DF6E6F37D076DD7443

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2013-11-20 22:10

==================== End of FRST.txt ============================

Addition.txt

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 02-07-2016
Ran by [removed] (2016-07-03 12:13:20)
Running from C:\Users\[removed]\Downloads
Micro$hit MacOS X 7 Ultimate  (X86) (2013-03-09 16:32:21)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Adadu (S-1-5-21-3559194677-4052321422-2392058216-1000 - Administrator - Enabled) => C:\Users\Adadu
Administrator (S-1-5-21-3559194677-4052321422-2392058216-500 - Administrator - Disabled)
Guest (S-1-5-21-3559194677-4052321422-2392058216-501 - Limited - Disabled)

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Enabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Out of date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

7-Zip 4.65 (HKLM\…\7-Zip) (Version:  - )
Adobe Flash Player 22 ActiveX (HKLM\…\Adobe Flash Player ActiveX) (Version: 22.0.0.192 - Adobe Systems Incorporated)
Adobe Flash Player 22 NPAPI (HKLM\…\Adobe Flash Player NPAPI) (Version: 22.0.0.192 - Adobe Systems Incorporated)
Adobe Reader 9.2 Lite (HKLM\…\{AC76BA86-7AD7-1033-7B44-A92000000001}) (Version: 9.2.0 - Adobe Systems Incorporated)
Advertising Center (Version: 0.0.0.1 - Nero AG) Hidden
AIMP2 (HKLM\…\AIMP2) (Version:  - AIMP DevTeam)
Atlas Reactor Live (HKLM\…\Glyph Atlas Reactor Live) (Version:  - Trion Worlds, Inc.)
Avast Free Antivirus (HKLM\…\Avast) (Version: 11.2.2260 - AVAST Software)
Battle.net (HKLM\…\Battle.net) (Version:  - Blizzard Entertainment)
Bejeweled Deluxe 1.862 (HKLM\…\Bejeweled Deluxe 1.862) (Version:  - )
CDisplayEx 1.10.29 (HKLM\…\CDisplayEx_is1) (Version:  - Progdigy Software S.A.R.L.)
Combo Chaos Deluxe (HKLM\…\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7}) (Version:  - HALFPiNT Games)
Cool Timer 5.1.3.0 (HKLM\…\Cool Timer_is1) (Version:  - Harmony Hollow Software)
DolbyFiles (Version: 2.0 - Nero AG) Hidden
Dropbox (HKLM\…\Dropbox) (Version: 5.4.24 - Dropbox, Inc.)
Dropbox Update Helper (Version: 1.3.41.1 - Dropbox, Inc.) Hidden
ESET Online Scanner v3 (HKLM\…\ESET Online Scanner) (Version:  - )
FormatFactory 3.9.0.1 (HKLM\…\FormatFactory) (Version: 3.9.0.1 - Free Time)
Glyph (HKLM\…\Glyph) (Version:  - Trion Worlds, Inc.)
Google Toolbar for Internet Explorer (HKLM\…\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.7619.1252 - Google Inc.)
Google Toolbar for Internet Explorer (Version: 1.0.0 - Google Inc.) Hidden
Google Update Helper (Version: 1.3.21.135 - Google Inc.) Hidden
Google Update Helper (Version: 1.3.30.3 - Google Inc.) Hidden
Intel(R) Graphics Media Accelerator Driver (HKLM\…\HDMI) (Version: 8.15.10.1872 - Intel Corporation)
Malwarebytes Anti-Malware version 2.2.1.1043 (HKLM\…\Malwarebytes Anti-Malware_is1) (Version: 2.2.1.1043 - Malwarebytes)
McAfee Security Scan Plus (HKLM\…\McAfee Security Scan) (Version: 3.11.292.3 - McAfee, Inc.)
Microsoft Office Enterprise 2007 (HKLM\…\ENTERPRISE) (Version: 12.0.4518.1014 - Microsoft Corporation)
Microsoft Visual Basic 6.0 Professional Edition (HKLM\…\Visual Basic 6.0 Professional Edition) (Version:  - )
Microsoft Visual C++ 2005 Redistributable (HKLM\…\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Web Publishing Wizard 1.53 (HKLM\…\WebPost) (Version:  - )
Mozilla Firefox 47.0 (x86 en-US) (HKLM\…\Mozilla Firefox 47.0 (x86 en-US)) (Version: 47.0 - Mozilla)
Mozilla Maintenance Service (HKLM\…\MozillaMaintenanceService) (Version: 47.0.0.5999 - Mozilla)
Nero 9 (HKLM\…\{8d2871f6-e558-40bf-81ec-6808343d09bf}) (Version:  - Nero AG)
PicosmosTools 1.5.1.0 (HKLM\…\PicosmosTools) (Version: 1.5.1.0 - Free Time)
Program4Pc DJ Music Mixer (HKLM\…\{8C6B8ECF-C649-46D9-A8ED-5BE2921F9ECD}) (Version: 5.5 - Program4Pc Inc.)
Realtek High Definition Audio Driver (HKLM\…\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5653 - Realtek Semiconductor Corp.)
RKLauncher 0.43 Custom (HKLM\…\{40636246-26E3-4471-894D-B3940117ED36}_is1) (Version:  - ArG, Inc.)
SafeZone Stable 1.48.2066.98 (Version: 1.48.2066.98 - Avast Software) Hidden
Skype™ 4.1 (HKLM\…\{5C474A83-A45F-470C-9AC8-2BD1C251BF9A}) (Version: 4.1.141 - Skype Technologies S.A.)
SMART BRO (HKLM\…\{A9E5EDA7-2E6C-49E7-924B-A32B89C24A04}) (Version: 1.0.0.1 - ZTE)
Spybot - Search & Destroy (HKLM\…\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.4.40 - Safer-Networking Ltd.)
StarCraft II (HKLM\…\StarCraft II) (Version:  - Blizzard Entertainment)
VLC media player 1.0.3 (HKLM\…\VLC media player) (Version: 1.0.3 - VideoLAN Team)
Vuze (HKLM\…\8461-7759-5462-8226) (Version: 5.7.0.0 - Azureus Software, Inc.)
WinRAR archiver (HKLM\…\WinRAR archiver) (Version:  - )
Yahoo! Messenger (HKLM\…\Yahoo! Messenger) (Version:  - Yahoo! Inc.)
Y'z Dock 1.01 (HKLM\…\{B96F3609-1472-45CF-93FD-54743FD9FB61}_is1) (Version:  - ArG, Inc.)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-3559194677-4052321422-2392058216-1000_Classes\CLSID\{444785F1-DE89-4295-863A-D46C3A781394}\InprocServer32 -> C:\Users\Adadu\AppData\LocalLow\Unity\WebPlayer\loader\UnityWebPluginAX.ocx => No File

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {0F851277-EB24-46C6-83FD-0965D17D37F3} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2015-06-13] (Google Inc.)
Task: {1DA838E3-584D-420C-A093-D2B38A2EEEB0} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files\Spybot - Search & Destroy 2\SDImmunize.exe [2014-06-24] (Safer-Networking Ltd.)
Task: {2375F586-1009-41FB-B54E-30D8AF2B781D} - System32\Tasks\Microsoft\Windows\Windows Media Sharing\UpdateLibrary => C:\Program Files\Windows Media Player\wmpnscfg.exe
Task: {311B6E89-7A43-45FA-9BDD-779CBA7D6032} - System32\Tasks\SafeZone scheduled Autoupdate 1459994645 => C:\Program Files\AVAST Software\SZBrowser\launcher.exe [2016-03-30] (Avast Software)
Task: {4DFA292C-7CE9-4EB6-8CCC-CA58531187C3} - System32\Tasks\{4B6191D7-2F13-490E-BC8D-22FA730F99A9} => Firefox.exe hxxp://www.skype.com/go/downloading?source=lightinstaller&ver;=7.18.0.112&LastError;=12002
Task: {5C9DAD7A-DA5C-4602-8C26-D74F042D96C1} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2016-04-07] (AVAST Software)
Task: {9310174F-7D9A-44DD-8FC8-24DF051F0663} - System32\Tasks\DropboxUpdateTaskMachineUA => C:\Program Files\Dropbox\Update\DropboxUpdate.exe [2016-05-18] (Dropbox, Inc.)
Task: {A095C9DC-988E-4AF4-ADDB-38472EF9B3EA} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2016-06-18] (Adobe Systems Incorporated)
Task: {B2210200-6478-40EE-9C9B-BE78008EE12C} - System32\Tasks\{EA3CB214-0F14-4B6A-8444-7AA5A289BE26} => Firefox.exe hxxp://ui.skype.com/ui/0/7.18.0.112/en/abandoninstall?source=lightinstaller&page;=tsInstall
Task: {C38C8589-53D3-421B-A827-D58DF72471AE} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files\Spybot - Search & Destroy 2\SDScan.exe [2014-06-24] (Safer-Networking Ltd.)
Task: {D9BC0A1A-2CE5-4CC3-A444-1B088E1E4C06} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2015-06-13] (Google Inc.)
Task: {DD729E4E-C834-4317-9B35-8926144928AD} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files\Spybot - Search & Destroy 2\SDUpdate.exe [2014-06-27] (Safer-Networking Ltd.)
Task: {E453FEA1-4524-4504-8DEC-52A9A21BB1B9} - System32\Tasks\DropboxUpdateTaskMachineCore => C:\Program Files\Dropbox\Update\DropboxUpdate.exe [2016-05-18] (Dropbox, Inc.)
Task: {E4CDD6DC-DCE2-422B-8149-BF0866EF9810} - System32\Tasks\AVAST Software\Avast settings backup => C:\Program Files\Common Files\AV\avast! Antivirus\backup.exe [2016-06-05] (AVAST Software)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\DropboxUpdateTaskMachineCore.job => C:\Program Files\Dropbox\Update\DropboxUpdate.exe
Task: C:\Windows\Tasks\DropboxUpdateTaskMachineUA.job => C:\Program Files\Dropbox\Update\DropboxUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe

==================== Shortcuts =============================

(The entries could be listed to be restored or removed.)

Shortcut: C:\Users\Adadu\Music\My Web Sites on MSN\target.lnk -> hxxp://www.msnusers.com (No File)

==================== Loaded Modules (Whitelisted) ==============

2016-04-07 09:51 - 2016-04-07 09:51 - 00123344 _____ () C:\Program Files\AVAST Software\Avast\log.dll
2016-04-07 09:51 - 2016-04-07 09:51 - 00135816 _____ () C:\Program Files\AVAST Software\Avast\JsonRpcServer.dll
2016-07-01 08:01 - 2016-07-01 08:01 - 02997760 _____ () C:\Program Files\AVAST Software\Avast\defs\16063002\algo.dll
2016-04-07 09:51 - 2016-04-07 09:51 - 00478144 _____ () C:\Program Files\AVAST Software\Avast\ffl2.dll
2016-07-03 03:35 - 2016-07-03 03:35 - 02996736 _____ () C:\Program Files\AVAST Software\Avast\defs\16070201\algo.dll
2016-04-01 09:07 - 2014-05-13 12:04 - 00109400 _____ () C:\Program Files\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2016-04-01 09:07 - 2014-05-13 12:04 - 00416600 _____ () C:\Program Files\Spybot - Search & Destroy 2\DEC150.bpl
2016-04-01 09:07 - 2014-05-13 12:04 - 00167768 _____ () C:\Program Files\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2016-04-01 09:07 - 2012-08-23 10:38 - 00574840 _____ () C:\Program Files\Spybot - Search & Destroy 2\sqlite3.dll
2016-04-01 09:07 - 2012-04-03 17:06 - 00565640 _____ () C:\Program Files\Spybot - Search & Destroy 2\av\BDSmartDB.dll
2014-12-12 10:09 - 2011-01-24 20:29 - 00253264 _____ () C:\Program Files\SMART BRO\AssistantServices.exe
2013-03-10 00:43 - 2008-09-17 02:18 - 00132608 _____ () C:\Program Files\WinRAR\rarext.dll
2016-04-07 09:51 - 2016-04-07 09:51 - 40539648 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

AlternateDataStreams: C:\Users\Adadu\Desktop\20160426_133155.mp4:com.dropbox.attributes [168]

==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" value will be restored.)


==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)


==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 10:04 - 2016-02-23 09:53 - 00000858 ____A C:\Windows\system32\Drivers\etc\hosts

0.0.0.1    mssplus.mcafee.com

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-3559194677-4052321422-2392058216-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Adadu\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.1.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 0) (EnableLUA: 0)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^RKLauncher.lnk => C:\Windows\pss\RKLauncher.lnk.CommonStartup
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Y'z Dock.lnk => C:\Windows\pss\Y'z Dock.lnk.CommonStartup
MSCONFIG\startupreg: DAEMON Tools Lite => "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
MSCONFIG\startupreg: GrooveMonitor => "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
MSCONFIG\startupreg: HotKeysCmds => C:\Windows\system32\hkcmd.exe
MSCONFIG\startupreg: IgfxTray => C:\Windows\system32\igfxtray.exe
MSCONFIG\startupreg: Messenger (Yahoo!) => "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
MSCONFIG\startupreg: Persistence => C:\Windows\system32\igfxpers.exe
MSCONFIG\startupreg: RtHDVCpl => RtHDVCpl.exe
MSCONFIG\startupreg: Skype => "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [{4B2807DB-1DF1-4BAA-96A5-DC2EAED24D24}] => (Allow) C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
FirewallRules: [{D9C3FBAD-7CDD-400E-8965-754B24CEF9D6}] => (Allow) C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
FirewallRules: [{0A554C7A-9475-4C33-875F-CCC7635A253D}] => (Allow) C:\Program Files\Skype\Phone\Skype.exe
FirewallRules: [TCP Query User{24B9BAF7-AD86-4D8F-B113-5E28E087B653}C:\users\adadu\desktop\warcraft iii\war3.exe] => (Block) C:\users\adadu\desktop\warcraft iii\war3.exe
FirewallRules: [UDP Query User{CA626E8D-4878-48CB-941E-FB15D120AE83}C:\users\adadu\desktop\warcraft iii\war3.exe] => (Block) C:\users\adadu\desktop\warcraft iii\war3.exe
FirewallRules: [{36AA861F-A8A2-403E-B884-F2DACC2767C0}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{ABEAA39D-FE67-48CD-BFC9-CAA1ACB8614D}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{B5AFE642-E302-4C1C-909D-D180CED95C8F}] => (Allow) C:\Program Files\Vuze\Azureus.exe
FirewallRules: [{0F2350B0-17E8-4050-A230-FF297DF7CD58}] => (Allow) C:\Program Files\Vuze\Azureus.exe
FirewallRules: [TCP Query User{06454344-5098-4587-AD60-8951019278DA}C:\program files\hearthstone\hearthstone.exe] => (Allow) C:\program files\hearthstone\hearthstone.exe
FirewallRules: [UDP Query User{858A25EE-52CC-461C-97A8-4552C54AE1AE}C:\program files\hearthstone\hearthstone.exe] => (Allow) C:\program files\hearthstone\hearthstone.exe
FirewallRules: [{DB625FA1-7C1B-49D7-864A-5A40369E3D21}] => (Block) C:\program files\hearthstone\hearthstone.exe
FirewallRules: [{13CC22F4-031B-4A21-8C97-B347D8251324}] => (Block) C:\program files\hearthstone\hearthstone.exe
FirewallRules: [{A718FEF9-AF6F-4E42-87DB-BB56E34C185F}] => (Allow) C:\Program Files\StarCraft II\Versions\Base42932\SC2.exe
FirewallRules: [{E53BB3C2-AB27-4535-B4DE-837045A226D1}] => (Allow) C:\Program Files\StarCraft II\Versions\Base42932\SC2.exe
FirewallRules: [TCP Query User{07B86830-B7DB-4F31-848A-DCACA54DCD29}C:\users\adadu\downloads\ffinstonline.exe] => (Allow) C:\users\adadu\downloads\ffinstonline.exe
FirewallRules: [UDP Query User{90470C2F-374E-4CC2-B99D-2C538ACBC796}C:\users\adadu\downloads\ffinstonline.exe] => (Allow) C:\users\adadu\downloads\ffinstonline.exe
FirewallRules: [{C1C49A3E-CC4A-4243-825B-A58E06A25D99}] => (Allow) C:\Program Files\FormatFactory\FFModules\Encoder\Doc\EBookCodec.exe
FirewallRules: [{C0BBD4CA-EFA4-4741-A16E-454B58A78B3D}] => (Allow) C:\Program Files\FormatFactory\FormatFactory.exe
FirewallRules: [{2F403EF9-F233-4A4D-8842-95FAFD213FB7}] => (Allow) C:\Program Files\FormatFactory\FormatFactory.exe
FirewallRules: [{903945E7-75D4-44FE-84E3-5553E5D0F9E1}] => (Allow) C:\Program Files\FormatFactory\FFModules\Encoder\Doc\EBookCodec.exe
FirewallRules: [{44B7A1B7-8FCF-434A-AF7C-CE1BD8BF5E1F}] => (Allow) C:\Program Files\FormatFactory\FFModules\Package\PTInstOnline.exe
FirewallRules: [{9D631472-457A-4455-9F36-FD51B4F7F0D1}] => (Allow) C:\Program Files\PicosmosTools\PTInstOnline.exe
FirewallRules: [{42BBF1E2-987F-467A-914E-58065E48BBEC}] => (Allow) C:\Program Files\Dropbox\Client\Dropbox.exe
StandardProfile\AuthorizedApplications: [C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe] => Enabled:Spybot - Search & Destroy tray access
StandardProfile\AuthorizedApplications: [C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe] => Enabled:Spybot-S&D; 2 Scanner Service
StandardProfile\AuthorizedApplications: [C:\Program Files\Spybot - Search & Destroy 2\SDUpdate.exe] => Enabled:Spybot-S&D; 2 Updater
StandardProfile\AuthorizedApplications: [C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe] => Enabled:Spybot-S&D; 2 Background update service

==================== Restore Points =========================

07-04-2016 09:32:21 End of disinfection
28-06-2016 18:29:17 Removed BlueStacks Notification Center
03-07-2016 12:00:21 JRT Pre-Junkware Removal

==================== Faulty Device Manager Devices =============

Name:
Description:
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name:
Description:
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Base System Device
Description: Base System Device
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.


==================== Event log errors: =========================

Could not start eventlog service, could not read events.

The Windows Event Log service is starting.
The Windows Event Log service could not be started.

A system error has occurred.

The system cannot find message text for message number 0x1069 in the message file for (null).

More help is available by typing NET HELPMSG 4201.


==================== Memory info ===========================

Processor: Intel(R) Core(TM)2 Duo CPU T6400 @ 2.00GHz
Percentage of memory in use: 36%
Total physical RAM: 2911.04 MB
Available physical RAM: 1843.33 MB
Total Virtual: 5818.29 MB
Available Virtual: 4665.69 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:232.79 GB) (Free:65.24 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 232.9 GB) (Disk ID: C706724C)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=232.8 GB) - (Type=07 NTFS)

==================== End of Addition.txt ============================

Hi. I don't know what happened but my laptop seems to be working fine now. It's not freezing up anymore. I'm thinking of not messing with config for now. I only did it because I wanted to see Calvin and Hobbes in 3D. I didn't know it would cause my laptop to act up.

Anyway, just in case my laptop freeze up again and disabling WebGL did not work, do you have any suggestion on how else to fix it? Thanks!

Fixlog.txt

Fix result of Farbar Recovery Scan Tool (x86) Version: 02-07-2016
Ran by [removed] (2016-07-04 17:22:09) Run:1
Running from C:\Users\[removed]\Desktop
[removed] Boot Mode: Normal

==============================================

fixlist content:
*****************
HKLM\…\Run: [Dropbox] => C:\Program Files\Dropbox\Client\Dropbox.exe [24105936 2016-06-14] (Dropbox, Inc.)
Winlogon\Notify\SDWinLogon: SDWinLogon.dll [X]
HKU\S-1-5-21-3559194677-4052321422-2392058216-1000\…\MountPoints2: {2b574cb8-c53b-11e2-93e2-00158307c969} - F:\Autorun.exe
HKU\S-1-5-21-3559194677-4052321422-2392058216-1000\…\MountPoints2: {de714692-81a2-11e4-887c-00158307c969} - F:\Autorun.exe
HKU\S-1-5-21-3559194677-4052321422-2392058216-1000\…\MountPoints2: {f4b13db3-c5de-11e2-bddb-00158307c969} - F:\Autorun.exe
HKU\S-1-5-21-3559194677-4052321422-2392058216-1000\…\MountPoints2: {f4b13dbf-c5de-11e2-bddb-00158307c969} - F:\Autorun.exe
HKU\S-1-5-21-3559194677-4052321422-2392058216-1000\…\MountPoints2: {f4b13dc8-c5de-11e2-bddb-00158307c969} - F:\Autorun.exe
HKU\S-1-5-18\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\scrnsave.scr [10240 2009-07-14] (Microsoft Corporation)
SearchScopes: HKU\S-1-5-21-3559194677-4052321422-2392058216-1000 -> {012E1000-F331-11DB-8314-0800200C9A66} URL = hxxp://www.google.com/search?q={searchTerms}
U3 avcmo6qs; [0 ] (Microsoft Corporation) <==== ATTENTION (zero byte File/Folder)
S3 eapihdrv; \??\C:\Users\Adadu\AppData\Local\Temp\ehdrv.sys [X]
CustomCLSID: HKU\S-1-5-21-3559194677-4052321422-2392058216-1000_Classes\CLSID\{444785F1-DE89-4295-863A-D46C3A781394}\InprocServer32 -> C:\Users\Adadu\AppData\LocalLow\Unity\WebPlayer\loader\UnityWebPluginAX.ocx => No File
C:\Windows\system32\Drivers\avcmo6qs.sys
EmptyTemp:
*****************

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\Dropbox => value removed successfully.
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SDWinLogon" => key removed successfully.
"HKU\S-1-5-21-3559194677-4052321422-2392058216-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2b574cb8-c53b-11e2-93e2-00158307c969}" => key removed successfully.
HKCR\CLSID\{2b574cb8-c53b-11e2-93e2-00158307c969} => key not found.
"HKU\S-1-5-21-3559194677-4052321422-2392058216-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{de714692-81a2-11e4-887c-00158307c969}" => key removed successfully.
HKCR\CLSID\{de714692-81a2-11e4-887c-00158307c969} => key not found.
"HKU\S-1-5-21-3559194677-4052321422-2392058216-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f4b13db3-c5de-11e2-bddb-00158307c969}" => key removed successfully.
HKCR\CLSID\{f4b13db3-c5de-11e2-bddb-00158307c969} => key not found.
"HKU\S-1-5-21-3559194677-4052321422-2392058216-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f4b13dbf-c5de-11e2-bddb-00158307c969}" => key removed successfully.
HKCR\CLSID\{f4b13dbf-c5de-11e2-bddb-00158307c969} => key not found.
"HKU\S-1-5-21-3559194677-4052321422-2392058216-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f4b13dc8-c5de-11e2-bddb-00158307c969}" => key removed successfully.
HKCR\CLSID\{f4b13dc8-c5de-11e2-bddb-00158307c969} => key not found.
HKU\S-1-5-18\Control Panel\Desktop\\SCRNSAVE.EXE => value removed successfully.
"HKU\S-1-5-21-3559194677-4052321422-2392058216-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{012E1000-F331-11DB-8314-0800200C9A66}" => key removed successfully.
HKCR\CLSID\{012E1000-F331-11DB-8314-0800200C9A66} => key not found.
avcmo6qs => service not found.
eapihdrv => service removed successfully.
"HKU\S-1-5-21-3559194677-4052321422-2392058216-1000_Classes\CLSID\{444785F1-DE89-4295-863A-D46C3A781394}" => key removed successfully.
"C:\Windows\system32\Drivers\avcmo6qs.sys" => not found.

=========== EmptyTemp: ==========

BITS transfer queue => 8388608 B
DOMStoree, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 39199696 B
Java, Flash, Steam htmlcache => 689 B
Windows/system/drivers => 302738 B
Edge => 0 B
Chrome => 0 B
Firefox => 391872431 B
Opera => 0 B

Temp, IE cache, history, cookies, recent:
Default => 0 B
Public => 0 B
ProgramData => 0 B
systemprofile => 424 B
LocalService => 0 B
NetworkService => 0 B
Adadu => 27235847 B

RecycleBin => 5436182431 B
EmptyTemp: => 5.5 GB temporary data Removed.

================================


The system needed a reboot.

==== End of Fixlog 17:23:25 ====