5 min read
Hi,
I am getting dialog saying "Local Security Authority Process has changed since the last time you used it" intermittently. I am not sure why it is showing everytime and is it hacking attempt by someone. Please advise what needs to be done in this case.
I have attached snapshot of the dialog.
This could have been caused by Norton or possibly a bad windows update. First lets check that file and see if its ok
============================================================
1) https://virusscan.jotti.org/en-US/filescanjob/w86wovne8p
2) CMD Results: Windows Resource Protection did not find any integrity violations.
Well, it looks like we can rule out a virus or any malware related to this issue, lets run this scan and see if we can see whats maybe causing it
FRST.txt:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 21-08-2016 01
Ran by [removed] (administrator) on VIJAY-PC (21-08-2016 23:09:40)
Running from C:\Users\[removed]\Downloads
[removed]
Platform: Microsoft Windows 7 Enterprise Service Pack 1 (X86) Language: English (United States)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(AMD) C:\Windows\System32\atiesrxx.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Hewlett-Packard Company) C:\Windows\System32\hpservice.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(IVT Corporation) C:\Program Files\Ralink Corporation\Ralink Bluetooth Stack\BlueSoleilCS.exe
(Check Point Software Technologies Ltd.) C:\Program Files\CheckPoint\Endpoint Connect\Watchdog\EPWD.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Hotkey Support\HPHotkeyMonitor.exe
(Ralink Technology, Corp.) C:\Program Files\Ralink\Common\RaCountryRegion.exe
(Ralink Technology, Corp.) C:\Program Files\Ralink\Common\RaRegistry.exe
(cyberlink) C:\Program Files\CyberLink\Webcam Sharing Manager\StreamProvider.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Hotkey Support\QLBController.exe
(Realtek Semiconductor Corp.) C:\Windows\RtsCM.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP 3D DriveGuard\AccelerometerSt.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray.exe
(IVT Corporation) C:\Program Files\Ralink Corporation\Ralink Bluetooth Stack\BtTray.exe
(Check Point Software Technologies) C:\Program Files\CheckPoint\Endpoint Connect\TrGUI.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
(Microsoft Corporation) C:\Windows\WindowsMobile\wmdc.exe
(Ralink Technology, Inc.) C:\Program Files\Ralink\Common\RaWiFi.exe
() C:\Program Files\PdaNet for Android\PdaNetPC.exe
(Symantec Corporation) C:\Program Files\Symantec\Symantec Endpoint Protection\12.1.5337.5000.105\Bin\ccSvcHst.exe
(Check Point Software Technologies) C:\Program Files\CheckPoint\Endpoint Connect\TracSrvWrapper.exe
(Symantec Corporation) C:\Program Files\Symantec\Symantec Endpoint Protection\12.1.5337.5000.105\Bin\ccSvcHst.exe
(Vodafone) C:\Program Files\Vodafone\Vodafone Mobile Broadband\Bin\VmbService.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe
(IVT Corporation) C:\Program Files\Ralink Corporation\Ralink Bluetooth Stack\BsHelpCS.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
==================== Registry (Whitelisted) ===========================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\…\Run: [CLWCSM] => c:\Program Files\CyberLink\Webcam Sharing Manager\StreamProvider.exe [249096 2013-02-20] (cyberlink)
HKLM\…\Run: [StartCCC] => C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\x86\CLIStart.exe [747264 2013-09-25] (Advanced Micro Devices, Inc.)
HKLM\…\Run: [YouCam Mirage] => "C:\Program Files\CyberLink\YouCam\YCMMirage.exe"
HKLM\…\Run: [YouCam Tray] => C:\Program Files\CyberLink\YouCam\YouCamTray.exe [167488 2013-06-24] (CyberLink Corp.)
HKLM\…\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2444016 2013-10-25] (Synaptics Incorporated)
HKLM\…\Run: [QLBController] => C:\Program Files\Hewlett-Packard\HP Hotkey Support\QLBController.exe [337184 2013-10-16] (Hewlett-Packard Company)
HKLM\…\Run: [] => [X]
HKLM\…\Run: [RtsCM] => C:\Windows\RTSCM.EXE [146136 2013-11-14] (Realtek Semiconductor Corp.)
HKLM\…\Run: [AccelerometerSysTrayApplet] => C:\Program Files\Hewlett-Packard\HP 3D DriveGuard\AccelerometerST.exe [72992 2013-10-16] (Hewlett-Packard Company)
HKLM\…\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray.exe [1704028 2013-11-07] (IDT, Inc.)
HKLM\…\Run: [BtTray] => C:\Program Files\Ralink Corporation\Ralink Bluetooth Stack\BtTray.exe [389368 2014-02-17] (IVT Corporation)
HKLM\…\Run: [Check Point VPN] => C:\Program Files\CheckPoint\Endpoint Connect\TrGui.exe [1258024 2014-10-26] (Check Point Software Technologies)
HKLM\…\Run: [GrooveMonitor] => C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM\…\Run: [SunJavaUpdateSched] => "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
HKLM\…\Run: [Adobe Reader Speed Launcher] => C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [34672 2008-06-12] (Adobe Systems Incorporated)
HKLM\…\Run: [MobileBroadband] => C:\Program Files\Vodafone\Vodafone Mobile Broadband\Bin\MobileBroadband.exe [279552 2011-06-28] (Vodafone)
HKLM\…\Run: [Windows Mobile Device Center] => C:\Windows\WindowsMobile\wmdc.exe [648072 2007-05-31] (Microsoft Corporation)
HKU\S-1-5-21-3771350486-3931040076-2305587813-1000\…\Run: [GoogleChromeAutoLaunch_B3E63A82D5B1F30B6033570B48B5087A] => "C:\Users\Vijay\AppData\Local\Chromium\Application\chrome.exe" –auto-launch-at-startup –profile-directory="Default" –restore-last-session
HKU\S-1-5-21-3771350486-3931040076-2305587813-1000\…\MountPoints2: F - F:\setup_vmb_lite.exe /checkApplicationPresence
HKU\S-1-5-21-3771350486-3931040076-2305587813-1000\…\MountPoints2: G - G:\setup_vmb_lite.exe /checkApplicationPresence
HKU\S-1-5-21-3771350486-3931040076-2305587813-1000\…\MountPoints2: {7d0bc763-fe20-11e5-b15e-3c77e60aa402} - F:\setup_vmb_lite.exe /checkApplicationPresence
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Ralink Wireless Utility.lnk [2016-04-19]
ShortcutTarget: Ralink Wireless Utility.lnk -> C:\Program Files\Ralink\Common\RaWiFi.exe (Ralink Technology, Inc.)
Startup: C:\Users\Vijay\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PdaNet Desktop.lnk [2016-05-23]
ShortcutTarget: PdaNet Desktop.lnk -> C:\Program Files\PdaNet for Android\PdaNetPC.exe ()
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
Tcpip\Parameters: [DhcpNameServer] 10.166.124.212 10.166.124.214
Tcpip\..\Interfaces\{9E39BD94-F661-4B8C-BCE3-6931F1EE69D2}: [NameServer] 10.166.124.212,10.166.124.214
Tcpip\..\Interfaces\{B62AC996-19C8-49A7-8C21-9D675ADB8F89}: [DhcpNameServer] 192.168.43.1
Tcpip\..\Interfaces\{BAC37BA1-B8D6-4743-815F-E2E4920816FE}: [NameServer] 10.166.124.212 10.166.124.214
Tcpip\..\Interfaces\{BAC37BA1-B8D6-4743-815F-E2E4920816FE}: [DhcpNameServer] 10.166.124.212 10.166.124.214
Tcpip\..\Interfaces\{F53B2498-2D93-413D-B7B2-94D744767E52}: [DhcpNameServer] 172.27.0.84 172.27.0.81
Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.bing.com/search?FORM=INCOH1&PC;=IC05&PTAG;=ICO-fa878984
HKU\S-1-5-21-3771350486-3931040076-2305587813-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.bing.com/search?FORM=INCOH1&PC;=IC05&PTAG;=ICO-fa878984
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?FORM=INCOH2&PC;=IC05&PTAG;=ICO-fa878984&q;={searchTerms}
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?FORM=INCOH2&PC;=IC05&PTAG;=ICO-fa878984&q;={searchTerms}
SearchScopes: HKU\S-1-5-21-3771350486-3931040076-2305587813-1000 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?FORM=INCOH2&PC;=IC05&PTAG;=ICO-fa878984&q;={searchTerms}
SearchScopes: HKU\S-1-5-21-3771350486-3931040076-2305587813-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?FORM=INCOH2&PC;=IC05&PTAG;=ICO-fa878984&q;={searchTerms}
BHO: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2008-06-11] (Adobe Systems Incorporated)
BHO: SteadyVideoBHO Class -> {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} -> C:\Program Files\AMD\SteadyVideo\SteadyVideo.dll [2012-02-14] (Advanced Micro Devices)
BHO: Symantec Vulnerability Protection -> {6D53EC84-6AAE-4787-AEEE-F4628F01010C} -> C:\Program Files\Symantec\Symantec Endpoint Protection\12.1.5337.5000.105\bin\IPS\IPSBHO.DLL [2014-09-13] (Symantec Corporation)
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)
BHO: Javaâ„¢ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_74\bin\ssv.dll [2016-02-07] (Oracle Corporation)
BHO: Javaâ„¢ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_74\bin\jp2ssv.dll [2016-02-07] (Oracle Corporation)
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll [2009-02-26] (Microsoft Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Windows\system32\skype4com.dll [2013-12-16] (Skype Technologies)
Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll [2011-06-08] (Advanced Micro Devices)
Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll [2011-06-08] (Advanced Micro Devices)
FireFox:
========
FF ProfilePath: C:\Users\Vijay\AppData\Roaming\Mozilla\Firefox\Profiles\04j30u0j.default
FF NewTab: about:newtab
FF DefaultSearchEngine: Search Provided by Bing
FF SelectedSearchEngine: Search Provided by Bing
FF Homepage: hxxp://www.bing.com/search?FORM=INCOH1&PC;=IC04&PTAG;=ICO-fa878984
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_22_0_0_209.dll [2016-07-15] ()
FF Plugin: @java.com/DTPlugin,version=11.74.2 -> C:\Program Files\Java\jre1.8.0_74\bin\dtplugin\npDeployJava1.dll [2016-02-07] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.74.2 -> C:\Program Files\Java\jre1.8.0_74\bin\plugin2\npjp2.dll [2016-02-07] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.50428.0\npctrl.dll [2016-04-27] ( Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-07-29] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-07-29] (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.0.1 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2012-03-17] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.0 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2012-03-17] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.2.1 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2012-03-17] (VideoLAN)
FF Plugin HKU\S-1-5-21-3771350486-3931040076-2305587813-1000: @citrixonline.com/appdetectorplugin -> C:\Users\Vijay\AppData\Local\Citrix\Plugins\104\npappdetector.dll [2016-05-25] (Citrix Online)
FF SearchPlugin: C:\Users\Vijay\AppData\Roaming\Mozilla\Firefox\Profiles\04j30u0j.default\searchplugins\Search Provided by Bing.xml [2016-07-17]
FF Extension: FirePath - C:\Users\Vijay\AppData\Roaming\Mozilla\Firefox\Profiles\04j30u0j.default\extensions\[removed] [2016-05-04]
FF Extension: Selenium IDE - C:\Users\Vijay\AppData\Roaming\Mozilla\Firefox\Profiles\04j30u0j.default\extensions\{a6fd85ed-e919-4a43-a5af-8da18bda539f}.xpi [2016-05-04]
FF Extension: ADB Helper - C:\Users\Vijay\AppData\Roaming\Mozilla\Firefox\Profiles\04j30u0j.default\Extensions\[removed] [2016-07-28]
FF Extension: Firebug - C:\Users\Vijay\AppData\Roaming\Mozilla\Firefox\Profiles\04j30u0j.default\Extensions\[removed] [2016-06-09]
FF Extension: MEGA - C:\Users\Vijay\AppData\Roaming\Mozilla\Firefox\Profiles\04j30u0j.default\Extensions\[removed] [2016-08-18]
FF Extension: Video DownloadHelper - C:\Users\Vijay\AppData\Roaming\Mozilla\Firefox\Profiles\04j30u0j.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}.xpi [2016-08-03]
FF Extension: Adblock Plus - C:\Users\Vijay\AppData\Roaming\Mozilla\Firefox\Profiles\04j30u0j.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2016-05-29]
Chrome:
=======
CHR DefaultSearchURL: Default -> hxxp://srch.bar/{searchTerms}
CHR DefaultSuggestURL: Default -> hxxp://srch.bar/?s={searchTerms}
CHR Profile: C:\Users\Vijay\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\Vijay\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2016-02-03]
CHR Extension: (Google Drive) - C:\Users\Vijay\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-02-03]
CHR Extension: (YouTube) - C:\Users\Vijay\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-02-03]
CHR Extension: (Adblock Plus) - C:\Users\Vijay\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2016-07-06]
CHR Extension: (Google Search) - C:\Users\Vijay\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2016-02-03]
CHR Extension: (Video Downloader professional) - C:\Users\Vijay\AppData\Local\Google\Chrome\User Data\Default\Extensions\elicpjhcidhpjomhibiffojpinpmmpil [2016-07-20]
CHR Extension: (Google Docs Offline) - C:\Users\Vijay\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-03-17]
CHR Extension: (Video DownloadHelper) - C:\Users\Vijay\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmjnegcaeklhafolokijcfjliaokphfk [2016-03-18]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Vijay\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-04-04]
CHR Extension: (Gmail) - C:\Users\Vijay\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-02-03]
CHR Extension: (Chrome Media Router) - C:\Users\Vijay\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2016-08-19]
CHR HKLM\…\Chrome\Extension: [bahkljhhdeciiaodlkppoonappfnheoi] - hxxps://clients2.google.com/service/update2/crx
CHR HKU\S-1-5-21-3771350486-3931040076-2305587813-1000\SOFTWARE\Google\Chrome\Extensions\…\Chrome\Extension: [bahkljhhdeciiaodlkppoonappfnheoi] - hxxps://clients2.google.com/service/update2/crx
==================== Services (Whitelisted) ========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 BlueSoleilCS; C:\Program Files\Ralink Corporation\Ralink Bluetooth Stack\BlueSoleilCS.exe [1579880 2014-02-17] (IVT Corporation)
R3 BsHelpCS; C:\Program Files\Ralink Corporation\Ralink Bluetooth Stack\BsHelpCS.exe [76640 2013-12-16] (IVT Corporation)
R2 EPWD; C:\Program Files\CheckPoint\Endpoint Connect\Watchdog\EPWD.exe [282664 2014-08-18] (Check Point Software Technologies Ltd.)
R2 hpHotkeyMonitor; C:\Program Files\Hewlett-Packard\HP Hotkey Support\HPHotkeyMonitor.exe [681760 2013-10-16] (Hewlett-Packard Company)
R3 hpqwmiex; C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe [1006424 2013-01-23] (Hewlett-Packard Company) [File not signed]
R2 RalinkCountryRegion; C:\Program Files\Ralink\Common\RaCountryRegion.exe [33280 2012-07-27] (Ralink Technology, Corp.) [File not signed]
R2 RalinkRegistryWriter; C:\Program Files\Ralink\Common\RaRegistry.exe [372736 2012-07-04] (Ralink Technology, Corp.) [File not signed]
S2 RaMediaServer; C:\Program Files\Ralink\Common\RaMediaServer.exe [1863680 2012-07-06] (Ralink) [File not signed]
R2 SepMasterService; C:\Program Files\Symantec\Symantec Endpoint Protection\12.1.5337.5000.105\Bin\ccSvcHst.exe [144496 2014-09-13] (Symantec Corporation)
S3 SNAC; C:\Program Files\Symantec\Symantec Endpoint Protection\12.1.5337.5000.105\Bin\snac.exe [337248 2014-09-13] (Symantec Corporation)
R2 STacSV; C:\Program Files\IDT\WDM\STacSV.exe [319570 2013-11-07] (IDT, Inc.) [File not signed]
R2 TracSrvWrapper; C:\Program Files\CheckPoint\Endpoint Connect\TracSrvWrapper.exe [5266984 2014-10-26] (Check Point Software Technologies)
R2 VmbService; C:\Program Files\Vodafone\Vodafone Mobile Broadband\Bin\VmbService.exe [9216 2011-06-28] (Vodafone) [File not signed]
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-27] (Microsoft Corporation)
S2 peservice; "C:\Program Files\photoSync\peservice.exe" [X]
===================== Drivers (Whitelisted) ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R3 amdhub30; C:\Windows\System32\DRIVERS\amdhub30.sys [86184 2012-11-29] (Advanced Micro Devices, INC.)
R3 amdxhc; C:\Windows\System32\DRIVERS\amdxhc.sys [178856 2012-11-29] (Advanced Micro Devices, INC.)
R0 amd_sata; C:\Windows\System32\DRIVERS\amd_sata.sys [70824 2012-10-12] (Advanced Micro Devices)
R0 amd_xata; C:\Windows\System32\DRIVERS\amd_xata.sys [34984 2012-10-12] (Advanced Micro Devices)
R1 BHDrvx86; C:\ProgramData\Symantec\Symantec Endpoint Protection\12.1.5337.5000.105\Data\Definitions\BASHDefs\20160810.001\BHDrvx86.sys [1317624 2016-05-24] (Symantec Corporation)
S3 BlueletAudio; C:\Windows\System32\DRIVERS\blueletaudio.sys [29872 2012-12-19] (IVT Corporation)
R3 BtAudioBusSrv; C:\Windows\System32\Drivers\BtAudioBus.sys [20320 2012-06-15] (IVT Corporation)
R3 BthL2caScoIfSrv; C:\Windows\System32\Drivers\BtL2caScoIf.sys [43312 2013-04-26] (Ralink Corporation)
R3 btUrbFilterDrv; C:\Windows\System32\Drivers\IvtUrbBtFlt.sys [43744 2014-01-20] (Ralink Corporation)
R1 ccSettings_{7EC551EC-6FEE-44A6-BD12-987F87D7C525}; C:\Windows\System32\Drivers\SEP\0C0114D9\1388.105\x86\ccSetx86.sys [127064 2014-09-13] (Symantec Corporation)
R3 clwcsm; C:\Windows\System32\DRIVERS\clwcsm.sys [36288 2013-02-19] (CyberLink Corporation)
R1 eeCtrl; C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [388848 2016-05-06] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [124144 2016-05-06] (Symantec Corporation)
R1 IDSVix86; C:\ProgramData\Symantec\Symantec Endpoint Protection\12.1.5337.5000.105\Data\Definitions\IPSDefs\20160819.011\IDSvix86.sys [580856 2016-07-08] (Symantec Corporation)
R3 NAVENG; C:\ProgramData\Symantec\Symantec Endpoint Protection\12.1.5337.5000.105\Data\Definitions\VirusDefs\20160820.001\NAVENG.SYS [104408 2016-05-17] (Symantec Corporation)
R3 NAVEX15; C:\ProgramData\Symantec\Symantec Endpoint Protection\12.1.5337.5000.105\Data\Definitions\VirusDefs\20160820.001\NAVEX15.SYS [1647192 2016-05-17] (Symantec Corporation)
R3 netr28; C:\Windows\System32\DRIVERS\netr28.sys [2085008 2014-12-31] (MediaTek Inc.)
R3 pneteth; C:\Windows\System32\DRIVERS\pneteth.sys [13440 2011-11-25] (June Fabrics Technology Inc.)
R3 RSP2STOR; C:\Windows\System32\DRIVERS\RtsP2Stor.sys [219352 2013-08-19] (Realtek Semiconductor Corp.)
R3 rtbth; C:\Windows\System32\DRIVERS\rtbth.sys [936560 2014-12-24] (Ralink Technology, Corp.)
R3 rtsuvc; C:\Windows\System32\DRIVERS\rtsuvc.sys [6867160 2013-11-14] (Realtek Semiconductor Corp.)
R1 SRTSP; C:\Windows\System32\Drivers\SEP\0C0114D9\1388.105\x86\SRTSP.SYS [668888 2014-09-13] (Symantec Corporation)
R1 SRTSPX; C:\Windows\System32\Drivers\SEP\0C0114D9\1388.105\x86\SRTSPX.SYS [32984 2014-09-13] (Symantec Corporation)
S3 SyDvCtrl; C:\Program Files\Symantec\Symantec Endpoint Protection\12.1.5337.5000.105\Bin\SyDvCtrl32.sys [30736 2014-09-13] (Symantec Corporation)
R0 SymEFASI; C:\Windows\System32\drivers\symefasi\0500010.01F\symefasi.sys [1278680 2016-02-03] (Symantec Corporation)
R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT.SYS [142936 2016-02-03] (Symantec Corporation)
R1 SymIRON; C:\Windows\System32\Drivers\SEP\0C0114D9\1388.105\x86\Ironx86.SYS [209624 2014-09-13] (Symantec Corporation)
R1 SYMNETS; C:\Windows\System32\Drivers\SEP\0C0114D9\1388.105\x86\SYMNETS.SYS [447704 2014-09-13] (Symantec Corporation)
R1 SysPlant; C:\Windows\System32\Drivers\SysPlant.sys [131176 2016-02-03] (Symantec Corporation)
R1 Teefer2; C:\Windows\System32\DRIVERS\Teefer.sys [83832 2014-09-13] (Symantec Corporation)
R3 vna_ap; C:\Windows\System32\DRIVERS\vnaap.sys [129304 2009-02-15] (Check Point Software Technologies)
R3 vodafone_K3805-z_dc_enum; C:\Windows\System32\DRIVERS\vodafone_K3805-z_dc_enum.sys [61952 2010-09-01] (Vodafone)
R3 vodafone_zte_cdc_acm; C:\Windows\System32\DRIVERS\vodafone_zte_cdc_acm.sys [67968 2011-05-20] (Vodafone)
R3 vodafone_zte_cdc_ecm; C:\Windows\System32\DRIVERS\vodafone_zte_cdc_ecm.sys [52224 2011-05-20] (Vodafone)
S3 vodafone_zte_cpo; C:\Windows\System32\DRIVERS\vodafone_zte_cpo.sys [9984 2011-05-20] (Vodafone)
R3 vodafone_zte_ecm_enum; C:\Windows\System32\DRIVERS\vodafone_zte_ecm_enum.sys [47488 2011-05-20] (Vodafone)
R3 vodafone_zte_ecm_enum_filter; C:\Windows\System32\DRIVERS\vodafone_zte_ecm_enum_filter.sys [47488 2011-05-20] (Vodafone)
R1 vsdatant; C:\Windows\System32\DRIVERS\vsdatant.sys [365864 2014-10-05] (Check Point Software Technologies Ltd.)
U5 RTSPER; C:\Windows\System32\Drivers\RTSPER.sys [334552 2013-08-21] (Realsil Semiconductor Corporation)
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2016-08-21 23:09 - 2016-08-21 23:10 - 00022607 _____ C:\Users\Vijay\Downloads\FRST.txt
2016-08-21 23:09 - 2016-08-21 23:09 - 00000000 ____D C:\FRST
2016-08-21 23:08 - 2016-08-21 23:08 - 01746432 _____ (Farbar) C:\Users\Vijay\Downloads\FRST.exe
2016-08-20 19:33 - 2016-08-21 12:36 - 00000098 _____ C:\Users\Vijay\Desktop\network.txt
2016-08-17 09:10 - 2016-07-07 20:50 - 01309928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2016-08-17 09:10 - 2016-07-07 20:50 - 00240872 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2016-08-17 09:10 - 2016-07-07 20:50 - 00187624 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS
2016-08-17 09:10 - 2016-07-07 20:27 - 00035840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpipreg.sys
2016-08-17 09:10 - 2016-07-01 20:43 - 00741888 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll
2016-08-17 09:10 - 2016-07-01 20:43 - 00084480 _____ (Microsoft Corporation) C:\Windows\system32\INETRES.dll
2016-08-17 09:10 - 2016-07-01 20:20 - 00313856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv2.sys
2016-08-17 09:10 - 2016-07-01 20:20 - 00310784 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv.sys
2016-08-17 09:10 - 2016-07-01 20:20 - 00116224 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srvnet.sys
2016-08-17 08:58 - 2016-07-08 20:46 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2016-08-15 21:40 - 2016-08-15 21:41 - 00002419 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Mobile Device Center.lnk
2016-08-15 21:39 - 2016-08-15 21:41 - 00000000 ____D C:\Windows\WindowsMobile
2016-08-15 21:28 - 2016-08-15 21:28 - 00000000 ____D C:\Windows\system32\ivtMobCache
2016-08-15 21:18 - 2016-08-15 21:38 - 12644232 _____ (Microsoft Corporation) C:\Users\Vijay\Downloads\drvupdate-x86.exe
2016-08-15 14:41 - 2016-08-15 14:49 - 00000000 ____D C:\Program Files\MyPublicWiFi
2016-08-15 14:41 - 2012-12-07 10:34 - 00025416 _____ (Khalil Azzouzi) C:\Windows\system32\Drivers\ndiskhaz.sys
2016-08-15 14:09 - 2016-08-15 14:09 - 00002166 _____ C:\Users\Public\Desktop\Vodafone Mobile Broadband.lnk
2016-08-15 14:09 - 2016-08-15 14:09 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Vodafone
2016-08-15 14:09 - 2016-08-15 14:09 - 00000000 ____D C:\Program Files\Vodafone
2016-08-15 13:48 - 2016-08-15 13:48 - 01143096 _____ (TRUE Software ) C:\Users\Vijay\Downloads\MyPublicWiFi.exe
2016-08-15 13:41 - 2016-08-15 13:43 - 00000605 _____ C:\Users\Vijay\Desktop\hotSpot.bat
2016-08-15 13:26 - 2016-08-15 13:26 - 00000000 ____D C:\Users\Vijay\AppData\Local\Chris_Pietschmann_(http__
2016-08-15 12:59 - 2016-08-15 13:37 - 00000000 ____D C:\Program Files\Virtual Router
2016-08-15 12:58 - 2016-08-15 12:58 - 01373696 _____ C:\Users\Vijay\Downloads\VirtualRouterInstaller.msi
2016-08-15 12:34 - 2016-08-15 12:34 - 00031616 _____ (Connectify) C:\Windows\system32\Drivers\cfywlan1.sys
2016-08-15 12:32 - 2016-08-15 12:39 - 00000000 ____D C:\ProgramData\Connectify
2016-08-15 12:31 - 2016-08-15 12:32 - 09229200 _____ (Connectify) C:\Users\Vijay\Downloads\Connectify2016Installer.exe
2016-08-10 02:35 - 2016-07-08 20:52 - 00137960 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2016-08-10 02:35 - 2016-07-08 20:52 - 00067304 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2016-08-10 02:35 - 2016-07-08 20:46 - 01062912 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2016-08-10 02:35 - 2016-07-08 20:46 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2016-08-10 02:35 - 2016-07-08 20:46 - 00655360 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2016-08-10 02:35 - 2016-07-08 20:46 - 00553472 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2016-08-10 02:35 - 2016-07-08 20:46 - 00260608 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2016-08-10 02:35 - 2016-07-08 20:46 - 00251392 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2016-08-10 02:35 - 2016-07-08 20:46 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2016-08-10 02:35 - 2016-07-08 20:46 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2016-08-10 02:35 - 2016-07-08 20:46 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2016-08-10 02:35 - 2016-07-08 20:46 - 00141312 _____ (Microsoft Corporation) C:\Windows\system32\rpchttp.dll
2016-08-10 02:35 - 2016-07-08 20:46 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2016-08-10 02:35 - 2016-07-08 20:46 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2016-08-10 02:35 - 2016-07-08 20:46 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2016-08-10 02:35 - 2016-07-08 20:46 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2016-08-10 02:35 - 2016-07-08 20:46 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2016-08-10 02:35 - 2016-07-08 20:25 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2016-08-10 02:35 - 2016-07-08 20:23 - 02399232 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2016-08-10 02:35 - 2016-07-08 20:21 - 00226304 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2016-08-10 02:35 - 2016-07-08 20:21 - 00124416 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2016-08-10 02:35 - 2016-07-08 20:21 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2016-08-10 02:35 - 2016-07-08 20:20 - 00036352 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2016-08-10 02:35 - 2016-07-08 20:20 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2016-08-10 02:35 - 2016-07-08 20:20 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2016-08-10 02:34 - 2016-08-02 19:38 - 00346312 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2016-08-10 02:34 - 2016-08-02 11:33 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2016-08-10 02:34 - 2016-08-02 11:33 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2016-08-10 02:34 - 2016-08-02 11:24 - 20343808 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2016-08-10 02:34 - 2016-08-02 11:21 - 00497664 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2016-08-10 02:34 - 2016-08-02 11:21 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2016-08-10 02:34 - 2016-08-02 11:21 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2016-08-10 02:34 - 2016-08-02 11:21 - 00047616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2016-08-10 02:34 - 2016-08-02 11:20 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2016-08-10 02:34 - 2016-08-02 11:17 - 02286592 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2016-08-10 02:34 - 2016-08-02 11:15 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2016-08-10 02:34 - 2016-08-02 11:14 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2016-08-10 02:34 - 2016-08-02 11:12 - 00476160 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2016-08-10 02:34 - 2016-08-02 11:11 - 00663552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2016-08-10 02:34 - 2016-08-02 11:11 - 00620032 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2016-08-10 02:34 - 2016-08-02 11:11 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2016-08-10 02:34 - 2016-08-02 11:11 - 00102912 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2016-08-10 02:34 - 2016-08-02 11:06 - 00667648 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2016-08-10 02:34 - 2016-08-02 11:03 - 00416256 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2016-08-10 02:34 - 2016-08-02 10:59 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2016-08-10 02:34 - 2016-08-02 10:58 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2016-08-10 02:34 - 2016-08-02 10:56 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2016-08-10 02:34 - 2016-08-02 10:55 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2016-08-10 02:34 - 2016-08-02 10:54 - 00279040 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2016-08-10 02:34 - 2016-08-02 10:52 - 00130048 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2016-08-10 02:34 - 2016-08-02 10:51 - 04608000 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2016-08-10 02:34 - 2016-08-02 10:46 - 00230400 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2016-08-10 02:34 - 2016-08-02 10:45 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2016-08-10 02:34 - 2016-08-02 10:44 - 02055680 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2016-08-10 02:34 - 2016-08-02 10:44 - 01155072 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2016-08-10 02:34 - 2016-08-02 10:44 - 00689152 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2016-08-10 02:34 - 2016-08-02 10:41 - 13808128 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2016-08-10 02:34 - 2016-08-02 10:26 - 02393088 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2016-08-10 02:34 - 2016-08-02 10:23 - 01316352 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2016-08-10 02:34 - 2016-08-02 10:21 - 00710144 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2016-08-05 00:04 - 2016-08-05 00:30 - 00000000 __SHD C:\Users\Vijay\Documents\cache
2016-08-05 00:04 - 2016-08-05 00:04 - 00000000 ____D C:\Users\Vijay\AppData\Roaming\webex
2016-08-05 00:03 - 2016-08-05 00:03 - 00526775 _____ C:\Users\Vijay\AppData\LocalLow\Pre3582.tmp
2016-08-05 00:03 - 2016-08-05 00:03 - 00224434 _____ C:\Users\Vijay\AppData\LocalLow\Pre4EBE.tmp
2016-08-05 00:03 - 2016-08-05 00:03 - 00204352 _____ C:\Users\Vijay\AppData\LocalLow\Pre28F4.tmp
2016-08-05 00:03 - 2016-08-05 00:03 - 00000000 ____D C:\Users\Vijay\AppData\Local\WebEx
2016-08-05 00:02 - 2016-08-05 00:04 - 00000000 ____D C:\Users\Vijay\AppData\LocalLow\WebEx
2016-08-05 00:02 - 2016-08-05 00:04 - 00000000 ____D C:\ProgramData\WebEx
2016-08-04 10:02 - 2016-08-09 12:38 - 00000000 ____D C:\ProgramData\photoSync
2016-08-04 10:02 - 2016-08-09 10:37 - 00000000 ____D C:\Users\Vijay\AppData\Roaming\photoSync
2016-08-04 10:02 - 2016-08-04 10:02 - 00000000 ____D C:\Users\Vijay\Documents\photoSync
2016-08-02 22:02 - 2016-08-09 12:37 - 00000000 ____D C:\Windows\system32\appmgmt
2016-07-31 14:59 - 2016-06-06 20:53 - 01176064 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2016-07-31 14:59 - 2016-06-06 20:53 - 00179200 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2016-07-31 14:59 - 2016-06-06 20:53 - 00145920 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2016-07-31 14:59 - 2016-06-06 20:53 - 00106496 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2016-07-31 14:59 - 2016-05-17 04:48 - 03998952 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2016-07-31 14:59 - 2016-05-17 04:48 - 03943144 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2016-07-31 14:59 - 2016-05-17 04:46 - 01311064 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2016-07-31 14:59 - 2016-05-17 04:44 - 00644096 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2016-07-31 14:59 - 2016-05-17 04:44 - 00400896 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2016-07-31 14:59 - 2016-05-17 04:44 - 00050688 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
2016-07-31 14:59 - 2016-05-17 04:44 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
2016-07-31 14:59 - 2016-05-17 04:44 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2016-07-31 14:59 - 2016-05-17 04:44 - 00038912 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2016-07-31 14:59 - 2016-05-17 04:44 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2016-07-31 14:59 - 2016-05-17 02:45 - 00050688 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
2016-07-31 14:59 - 2016-05-17 02:44 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
2016-07-31 14:59 - 2016-05-17 02:44 - 00029696 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
2016-07-31 14:59 - 2016-05-17 02:44 - 00016896 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
2016-07-31 14:59 - 2016-05-17 02:42 - 00262656 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2016-07-31 14:59 - 2016-05-17 02:39 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2016-07-31 14:59 - 2016-05-14 03:20 - 02945536 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2016-07-31 14:59 - 2016-05-14 03:20 - 00174080 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2016-07-31 14:59 - 2016-05-14 03:17 - 00073728 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2016-07-31 14:59 - 2016-05-14 03:09 - 02060288 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2016-07-31 14:59 - 2016-05-14 03:08 - 00573440 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2016-07-31 14:59 - 2016-05-14 03:08 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2016-07-31 14:59 - 2016-05-14 03:08 - 00093696 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2016-07-31 14:59 - 2016-05-14 03:08 - 00035840 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2016-07-31 14:59 - 2016-05-14 03:08 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2016-07-31 14:59 - 2016-05-14 03:08 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2016-07-31 14:59 - 2016-05-14 03:08 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\wu.upgrade.ps.dll
2016-07-31 14:59 - 2016-05-12 20:48 - 00572416 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2016-07-31 14:59 - 2016-05-12 20:48 - 00090624 _____ (Microsoft Corporation) C:\Windows\system32\olepro32.dll
2016-07-31 14:59 - 2016-05-12 20:48 - 00067584 _____ (Microsoft Corporation) C:\Windows\system32\asycfilt.dll
2016-07-31 14:59 - 2016-05-04 22:51 - 00105192 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2016-07-31 14:59 - 2016-05-04 22:47 - 02365440 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2016-07-31 14:59 - 2016-05-04 22:47 - 01806848 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2016-07-31 14:59 - 2016-05-04 22:47 - 00337408 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2016-07-31 14:59 - 2016-05-04 22:47 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll
2016-07-31 14:59 - 2016-05-04 22:47 - 00025088 _____ (Microsoft Corporation) C:\Windows\system32\msimsg.dll
2016-07-31 14:59 - 2016-05-04 20:25 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\msiexec.exe
2016-07-31 14:57 - 2016-06-26 01:31 - 00037096 _____ (Microsoft Corporation) C:\Windows\system32\CompatTelRunner.exe
2016-07-31 14:57 - 2016-06-26 01:23 - 01004544 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2016-07-31 14:57 - 2016-06-22 18:36 - 00208896 _____ (Microsoft Corporation) C:\Windows\system32\centel.dll
2016-07-31 14:57 - 2016-06-17 23:53 - 01288192 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2016-07-31 14:57 - 2016-06-17 23:53 - 00468992 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2016-07-31 14:57 - 2016-06-17 23:53 - 00461312 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2016-07-31 14:57 - 2016-06-17 23:53 - 00251392 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2016-07-31 14:57 - 2016-06-17 23:53 - 00179712 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2016-07-31 14:57 - 2016-06-17 23:53 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2016-07-31 09:33 - 2016-07-31 09:33 - 00000000 ____D C:\Program Files\Common Files\DESIGNER
2016-07-30 11:25 - 2016-07-30 11:25 - 00000000 ____D C:\Users\Default\AppData\Local\Microsoft Help
2016-07-30 11:25 - 2016-07-30 11:25 - 00000000 ____D C:\Users\Default User\AppData\Local\Microsoft Help
2016-07-29 17:05 - 2016-08-02 22:02 - 00000000 ____D C:\Program Files\Microsoft Lync
2016-07-29 17:05 - 2016-07-30 11:32 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2016-07-29 17:04 - 2016-08-02 21:48 - 00000000 ____D C:\Users\Vijay\Tracing
2016-07-29 17:04 - 2016-07-30 11:49 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2016-07-24 20:45 - 2016-08-20 13:53 - 00000000 ____D C:\Users\Vijay\AppData\Roaming\vlc
2016-07-24 20:45 - 2016-07-24 20:45 - 00001028 _____ C:\Users\Public\Desktop\VLC media player.lnk
2016-07-24 20:45 - 2016-07-24 20:45 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
2016-07-23 22:47 - 2016-07-23 22:47 - 00000000 ____D C:\Users\Vijay\Downloads\Spellbound (1945)
2016-07-23 22:38 - 2016-07-23 23:45 - 00000000 ____D C:\Users\Vijay\Downloads\Vertigo (1958) HD 1080p X265.AC3 - Z@M@N
2016-07-23 22:32 - 2016-08-02 22:10 - 00000000 ____D C:\Users\Vijay\AppData\LocalLow\uTorrent
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2016-08-21 23:10 - 2016-05-22 14:51 - 00000000 ____D C:\Users\Vijay\AppData\Roaming\NetSpeedMonitor
2016-08-21 23:03 - 2016-02-03 12:29 - 00000886 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2016-08-21 22:42 - 2016-05-25 22:10 - 00000562 _____ C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-3771350486-3931040076-2305587813-1000.job
2016-08-21 22:18 - 2016-04-09 12:27 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2016-08-21 22:14 - 2009-07-14 10:04 - 00012368 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2016-08-21 22:14 - 2009-07-14 10:04 - 00012368 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2016-08-21 22:11 - 2016-02-03 11:27 - 00781782 _____ C:\Windows\system32\PerfStringBackup.INI
2016-08-21 22:11 - 2009-07-14 08:07 - 00000000 ____D C:\Windows\inf
2016-08-21 22:06 - 2016-03-24 23:14 - 00000362 _____ C:\Windows\system32\REMOTEDEVICE.INI
2016-08-21 22:06 - 2016-02-03 12:14 - 00003620 _____ C:\Windows\system32\LOCALSERVICE.INI
2016-08-21 22:06 - 2015-01-05 15:20 - 00001048 _____ C:\Windows\system32\bscs.ini
2016-08-21 22:05 - 2016-02-03 12:29 - 00000882 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2016-08-21 22:05 - 2016-02-03 12:14 - 00000043 _____ C:\Windows\system32\LOCALDEVICE.INI
2016-08-21 22:05 - 2009-07-14 10:23 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-08-21 16:01 - 2016-02-07 12:36 - 00065536 _____ C:\Windows\system32\spu_storage.bin
2016-08-21 15:49 - 2016-05-25 22:10 - 00000658 _____ C:\Windows\Tasks\G2MUploadTask-S-1-5-21-3771350486-3931040076-2305587813-1000.job
2016-08-21 15:28 - 2016-05-02 12:24 - 00000711 _____ C:\Windows\system32\Drivers\etc\hosts.ics
2016-08-21 12:38 - 2016-02-03 21:48 - 00000000 ____D C:\ProgramData\Symantec
2016-08-20 23:32 - 2009-07-14 08:07 - 00000000 ____D C:\Windows\system32\NDF
2016-08-20 15:12 - 2016-02-03 12:27 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2016-08-20 14:18 - 2016-02-03 12:27 - 00000000 ____D C:\Program Files\Mozilla Firefox
2016-08-20 14:09 - 2016-02-03 22:19 - 00002324 ____H C:\Users\Vijay\Documents\Default.rdp
2016-08-20 13:47 - 2016-02-03 22:08 - 00006149 _____ C:\Windows\system32\Drivers\DisconnectedPolicy.xml
2016-08-17 10:50 - 2009-07-14 08:07 - 00000000 ____D C:\Windows\rescache
2016-08-17 08:54 - 2016-02-03 12:18 - 00000000 ____D C:\Users\Vijay\AppData\Local\ElevatedDiagnostics
2016-08-15 17:20 - 2016-05-05 22:37 - 00002875 _____ C:\Windows\system32\SHORTCUT.INI
2016-08-15 14:39 - 2009-07-14 10:03 - 00414576 _____ C:\Windows\system32\FNTCACHE.DAT
2016-08-15 14:12 - 2016-02-03 11:51 - 00110536 _____ C:\Users\Vijay\AppData\Local\GDIPFONTCACHEV1.DAT
2016-08-10 03:13 - 2016-02-04 11:17 - 00000000 ____D C:\Windows\system32\MRT
2016-08-10 03:04 - 2016-02-04 11:16 - 144884648 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe
2016-08-09 11:05 - 2016-02-03 12:31 - 00002141 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2016-08-09 11:05 - 2016-02-03 12:31 - 00002129 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2016-08-05 00:04 - 2016-02-03 11:23 - 00000000 ____D C:\Users\Vijay
2016-08-02 22:45 - 2016-03-18 01:01 - 00000000 ____D C:\Users\Vijay\AppData\Roaming\uTorrent
2016-07-31 15:38 - 2016-02-07 12:35 - 00000000 ____D C:\Windows\system32\appraiser
2016-07-31 14:23 - 2016-02-06 17:04 - 00000000 ____D C:\Program Files\Microsoft Office
2016-07-31 09:27 - 2009-07-14 08:07 - 00000000 ____D C:\Program Files\Common Files\System
2016-07-31 09:27 - 2009-07-14 07:34 - 00000478 _____ C:\Windows\win.ini
2016-07-30 11:27 - 2016-02-06 17:08 - 00000000 ____D C:\Program Files\Microsoft Works
2016-07-30 11:27 - 2009-07-14 08:07 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
==================== Files in the root of some directories =======
2011-06-27 19:26 - 2011-06-27 19:26 - 0232496 ____R () C:\ProgramData\DeviceManager.xml.rc4
Some files in TEMP:
====================
C:\Users\Vijay\AppData\Local\Temp\vlc-2.2.1-win32.exe
C:\Users\Vijay\AppData\Local\Temp\vlc-2.2.4-win32.exe
==================== Bamital & volsnap =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2016-08-17 10:18
==================== End of FRST.txt ============================
Addition.txt:
Additional scan result of Farbar Recovery Scan Tool (x86) Version: 21-08-2016 01
Ran by [removed] (21-08-2016 23:11:19)
Running from C:\Users\[removed]\Downloads
Microsoft Windows 7 Enterprise Service Pack 1 (X86) (2016-02-03 05:53:52)
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
Administrator (S-1-5-21-3771350486-3931040076-2305587813-500 - Administrator - Disabled)
Guest (S-1-5-21-3771350486-3931040076-2305587813-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-3771350486-3931040076-2305587813-1002 - Limited - Enabled)
Vijay (S-1-5-21-3771350486-3931040076-2305587813-1000 - Administrator - Enabled) => C:\Users\Vijay
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Symantec Endpoint Protection (Enabled - Up to date) {53C7D717-52E2-B95E-FA61-6F32ECC805DB}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Symantec Endpoint Protection (Enabled - Up to date) {E8A636F3-74D8-B6D0-C0D1-5440974F4F66}
FW: Symantec Endpoint Protection (Enabled) {6BFC5632-188D-B806-D13E-C607121B42A0}
==================== Installed Programs ======================
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
µTorrent (HKU\S-1-5-21-3771350486-3931040076-2305587813-1000\…\uTorrent) (Version: 3.4.7.42330 - BitTorrent Inc.)
Adobe AIR (HKLM\…\Adobe AIR) (Version: 1.0.4990 - Adobe Systems Inc.)
Adobe Flash Player 22 NPAPI (HKLM\…\Adobe Flash Player NPAPI) (Version: 22.0.0.209 - Adobe Systems Incorporated)
Adobe Reader 9 (HKLM\…\{AC76BA86-7AD7-1033-7B44-A90000000001}) (Version: 9.0.0 - Adobe Systems Incorporated)
AMD Catalyst Install Manager (HKLM\…\{8F0B2629-0725-55F9-8CF6-40705CA15504}) (Version: 8.0.915.0 - Advanced Micro Devices, Inc.)
Appium (HKLM\…\{9E863C9E-3A59-4D73-B207-2D91E575AC49}_is1) (Version: 1.4.13.1 - Appium Contributors)
Check Point VPN (HKLM\…\{00B5C96B-7A86-4762-8FF8-C789F53FC1E2}) (Version: 98.60.276 - Check Point Software Technologies Ltd.)
Citrix Online Launcher (HKLM\…\{09DA5EE2-7E46-4DC4-96F9-BFEE50D40659}) (Version: 1.0.408 - Citrix)
ConvertHelper 3.1.1 (HKLM\…\{27CC6AB1-E72B-4179-AF1A-EAE507EBAF52}}_is1) (Version: - DownloadHelper)
CyberLink Webcam Sharing Manager 4 (HKLM\…\InstallShield_{296F7F3B-C75A-45e9-AD22-CC19DF86E9D3}) (Version: 4.2.1.1419 - CyberLink Corp.)
CyberLink YouCam (HKLM\…\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 4.2.1.4225 - CyberLink Corp.)
Google Chrome (HKLM\…\Google Chrome) (Version: 52.0.2743.116 - Google Inc.)
Google Update Helper (Version: 1.3.31.5 - Google Inc.) Hidden
GoToMeeting 7.21.0.5387 (HKU\S-1-5-21-3771350486-3931040076-2305587813-1000\…\GoToMeeting) (Version: 7.21.0.5387 - CitrixOnline)
HP 3D DriveGuard (HKLM\…\{84663FDA-1374-4048-9869-DD4A8784785A}) (Version: 6.0.16.1 - Hewlett-Packard Company)
HP ESU for Microsoft Windows 7 (HKLM\…\{D562B3BB-4405-4FA8-BCE2-D5DB89E8D5CE}) (Version: 2.2.1 - Hewlett-Packard Company)
HP HD Webcam Driver (HKLM\…\{E0A7ED39-8CD6-4351-93C3-69CCA00D12B4}) (Version: 6.2.9200.10251 - Realtek Semiconductor Corp.)
HP Hotkey Support (HKLM\…\{7F7E2060-7212-4A53-9875-55173E4BA3F0}) (Version: 5.0.21.1 - Hewlett-Packard Company)
IDT Audio (HKLM\…\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6496.0 - IDT)
Java 8 Update 74 (HKLM\…\{26A24AE4-039D-4CA4-87B4-2F83218074F0}) (Version: 8.0.740.2 - Oracle Corporation)
Java SE Development Kit 8 Update 74 (HKLM\…\{32A3A4F4-B792-11D6-A78A-00B0D0180740}) (Version: 8.0.740.2 - Oracle Corporation)
Mediatek Bluetooth (HKLM\…\{9C203E29-E38A-53CB-061F-6BCAEA707910}) (Version: 11.0.759.0 - Mediatek)
Microsoft .NET Framework 4.6.1 (HKLM\…\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.6.01055 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM\…\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
Microsoft Office Enterprise 2007 (HKLM\…\ENTERPRISE) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office File Validation Add-In (HKLM\…\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Silverlight (HKLM\…\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50428.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\…\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM\…\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\…\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\…\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319 (HKLM\…\{196BB40D-1578-3D01-B289-BEFC77A11A1E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM\…\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)
Mozilla Firefox 48.0.1 (x86 en-US) (HKLM\…\Mozilla Firefox 48.0.1 (x86 en-US)) (Version: 48.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM\…\MozillaMaintenanceService) (Version: 48.0.1.6073 - Mozilla)
NetSpeedMonitor 2.5.4.0 x86 (HKLM\…\{86501894-E722-4385-A792-B7C2F28FAE7B}) (Version: 2.5.4.0 - Florian Gilles)
Node.js (HKLM\…\{BFEBEB40-33EF-41DF-96E1-06C7B2967DFB}) (Version: 4.4.4 - Node.js Foundation)
PdaNet+ for Android 4.19 (HKLM\…\PdaNet_is1) (Version: - June Fabrics Technology Inc)
Ralink RT3290 802.11bgn Wi-Fi Adapter (HKLM\…\{8FC4F1DD-F7FD-4766-804D-3C8FF1D309AF}) (Version: 5.0.53.0 - Mediatek)
Realtek Card Reader (HKLM\…\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 1.1.9200.23 - Realtek Semiconductor Corp.)
Realtek Ethernet Controller Driver (HKLM\…\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.73.618.2013 - Realtek)
Sublime Text 2.0.2 (HKLM\…\Sublime Text 2_is1) (Version: - )
Symantec Endpoint Protection (HKLM\…\{0E251D4D-316C-4F8B-A4C5-2722000764BE}) (Version: 12.1.5337.5000 - Symantec Corporation)
Synaptics Pointing Device Driver (HKLM\…\SynTPDeinstKey) (Version: 17.0.18.8 - Synaptics Incorporated)
Update for 2007 Microsoft Office System (KB967642) (HKLM\…\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
VLC media player 2.0.1 (HKLM\…\VLC media player) (Version: 2.0.1 - VideoLAN)
Vodafone Mobile Broadband Lite (HKLM\…\{6C29152D-3FF9-43B2-84E4-9B35FC0BF5C2}) (Version: 10.2.301.32820 - Vodafone)
Windows Mobile Device Center (HKLM\…\{904CCF62-818D-4675-BC76-D37EB399F917}) (Version: 6.1.6965.0 - Microsoft Corporation)
Windows Mobile Device Center Driver Update (HKLM\…\{E7044E25-3038-4A76-9064-344AC038043E}) (Version: 6.1.6965.0 - Microsoft Corporation)
WinRAR 5.01 (32-bit) (HKLM\…\WinRAR archiver) (Version: 5.01.0 - win.rar GmbH)
==================== Custom CLSID (Whitelisted): ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
CustomCLSID: HKU\S-1-5-21-3771350486-3931040076-2305587813-1000_Classes\CLSID\{32E26FD9-F435-4A20-A561-35D4B987CFDC}\InprocServer32 -> c:\programdata\webex\WebEx\T31_UMC\atucfobj.dll (Cisco WebEx LLC)
CustomCLSID: HKU\S-1-5-21-3771350486-3931040076-2305587813-1000_Classes\CLSID\{84B5A313-CD5D-4904-8BA2-AFDC81C1B309}\InprocServer32 -> C:\Users\Vijay\AppData\Local\Citrix\GoToMeeting\4911\G2MOutlookAddin.dll (Citrix Online, a division of Citrix Systems, Inc.)
CustomCLSID: HKU\S-1-5-21-3771350486-3931040076-2305587813-1000_Classes\CLSID\{A2DF06F9-A21A-44A8-8A99-8B9C84F29160}\localserver32 -> "C:\Users\Vijay\AppData\Local\Chromium\Application\46.0.2480.0\delegate_execute.exe" => No File <==== ATTENTION
==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {007ADB1D-88AD-4A0F-8311-44453001862F} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2016-02-03] (Google Inc.)
Task: {25824AD0-62E0-42E9-9D21-A7E490AAD26A} - System32\Tasks\G2MUploadTask-S-1-5-21-3771350486-3931040076-2305587813-1000 => C:\Users\Vijay\AppData\Local\Citrix\GoToMeeting\5387\g2mupload.exe [2016-08-12] (Citrix Online, a division of Citrix Systems, Inc.)
Task: {2C4646AB-B245-4014-8521-C0C9607476CF} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2016-07-15] (Adobe Systems Incorporated)
Task: {3321553C-5DDE-49A5-AE32-2CB7F0B44889} - System32\Tasks\{7E6955B1-93DD-4035-BE09-2531CE1510A9} => pcalua.exe -a "F:\vijay\probook\I drive\hp new driver\sp70859.exe" -d "F:\vijay\probook\I drive\hp new driver"
Task: {9D191A3F-82F9-45CD-9011-095C2BD4C0F4} - System32\Tasks\G2MUpdateTask-S-1-5-21-3771350486-3931040076-2305587813-1000 => C:\Users\Vijay\AppData\Local\Citrix\GoToMeeting\5387\g2mupdate.exe [2016-08-12] (Citrix Online, a division of Citrix Systems, Inc.)
Task: {9F640961-7D82-49CA-8E50-7B189C346B73} - System32\Tasks\{274EF9F2-7B81-4C01-BF4C-4FF1C9D92F2E} => pcalua.exe -a "F:\vijay\probook\I drive\hp new driver\sp61101.exe" -d "F:\vijay\probook\I drive\hp new driver"
Task: {B63D05D8-63CB-4058-B26F-F26F238549CE} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2016-02-03] (Google Inc.)
Task: {ED7BE6DA-763C-4D5D-A4A1-AB79D08B1631} - System32\Tasks\{BA47DED3-501C-41E7-B5EC-F47AFB5157CE} => pcalua.exe -a "F:\vijay\probook\I drive\hp new driver\sp66924.exe" -d "F:\vijay\probook\I drive\hp new driver"
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-3771350486-3931040076-2305587813-1000.job => C:\Users\Vijay\AppData\Local\Citrix\GoToMeeting\5387\g2mupdate.exe
Task: C:\Windows\Tasks\G2MUploadTask-S-1-5-21-3771350486-3931040076-2305587813-1000.job => C:\Users\Vijay\AppData\Local\Citrix\GoToMeeting\5387\g2mupload.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
==================== Shortcuts =============================
(The entries could be listed to be restored or removed.)
==================== Loaded Modules (Whitelisted) ==============
2013-05-24 10:22 - 2013-05-24 10:22 - 00334648 _____ () C:\Program Files\Ralink Corporation\Ralink Bluetooth Stack\Driver\USB\tl_filter.dll
2011-07-05 10:53 - 2011-07-05 10:53 - 00012800 _____ () C:\Program Files\Ralink Corporation\Ralink Bluetooth Stack\Driver\AMP\IVTAMPRL.dll
2013-12-16 15:44 - 2013-12-16 15:44 - 00031480 _____ () C:\Windows\system32\BsHelpCSps.dll
2013-12-16 15:44 - 2013-12-16 15:44 - 00641784 _____ () C:\Windows\system32\BlueSoleilCSps.dll
2013-12-16 15:44 - 2013-12-16 15:44 - 00070904 _____ () C:\Windows\system32\BsProfilefunc.dll
2013-12-16 15:44 - 2013-12-16 15:44 - 00360184 _____ () C:\Windows\system32\BsExtendFunc.dll
2013-12-16 11:24 - 2013-12-16 11:24 - 00011264 _____ () C:\Windows\system32\SCChangeMonitor.dll
2016-02-03 12:12 - 2012-08-03 15:22 - 01212416 _____ () C:\Program Files\Ralink\Common\RaWLAPI.dll
2016-05-23 00:38 - 2016-04-28 19:33 - 01058616 _____ () C:\Program Files\PdaNet for Android\PdaNetPC.exe
==================== Alternate Data Streams (Whitelisted) =========
(If an entry is included in the fixlist, only the ADS will be removed.)
==================== Safe Mode (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" value will be restored.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\ccSettings_{7EC551EC-6FEE-44A6-BD12-987F87D7C525}.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SepMasterService => ""="Service"
==================== Association (Whitelisted) ===============
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, it will be removed from the registry.)
==================== Hosts content: ===============================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 07:34 - 2009-06-11 03:09 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-3771350486-3931040076-2305587813-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Vijay\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 10.166.124.212 - 10.166.124.214
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 0) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
MSCONFIG\startupreg: MobileBroadband => C:\Program Files\Vodafone\Vodafone Mobile Broadband\Bin\MobileBroadband.exe /silent
==================== FirewallRules (Whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [{7205F977-1AE2-4FCB-B86A-ED487BDDB554}] => (Allow) C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
FirewallRules: [{26B93D17-80D0-48CE-8413-45F336086F3D}] => (Allow) C:\Program Files\Ralink Corporation\Ralink Bluetooth Stack\BlueSoleilCS.exe
FirewallRules: [{BE9360E3-E0E3-4933-A909-FDC46B2035C1}] => (Allow) C:\Program Files\Ralink\Common\RaMediaServer.exe
FirewallRules: [{AD693B0C-537F-459B-8205-4D4CB14F8912}] => (Allow) C:\Program Files\Ralink\Common\RaMediaServer.exe
FirewallRules: [{FE20C2A0-8BF5-4962-9B98-98BBC616892B}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{278D7E34-36EC-43C2-91BF-90F82610AF0E}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{8D80865D-A12B-4FB6-BBB3-A003BBDFC75F}] => (Allow) C:\Program Files\Symantec\Symantec Endpoint Protection\12.1.5337.5000.105\Bin\Smc.exe
FirewallRules: [{873AB1FF-E22B-44B3-A663-92EA7416411B}] => (Allow) C:\Program Files\Symantec\Symantec Endpoint Protection\12.1.5337.5000.105\Bin\Smc.exe
FirewallRules: [{61E762C8-71EC-4A0A-B7B6-88230EEBAC67}] => (Allow) C:\Program Files\Symantec\Symantec Endpoint Protection\12.1.5337.5000.105\Bin\snac.exe
FirewallRules: [{5B5B01BF-4473-45D7-BCFD-B6FD47E5EADB}] => (Allow) C:\Program Files\Symantec\Symantec Endpoint Protection\12.1.5337.5000.105\Bin\snac.exe
FirewallRules: [{BBD3EC11-07C8-44EB-B5B4-BBB0C6CB327B}] => (Allow) C:\Program Files\CheckPoint\Endpoint Connect\TrGUI.exe
FirewallRules: [{12C0AD7E-94C4-40F5-8625-2FDA7E90AA69}] => (Allow) C:\Program Files\CheckPoint\Endpoint Connect\TracSrvWrapper.exe
FirewallRules: [{34DC67E6-3EEF-4D14-8289-2EA4D48AC107}] => (Allow) C:\Users\Vijay\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{6D572C71-C2D7-4717-9617-2D32648E547E}] => (Allow) C:\Users\Vijay\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{0194896B-525E-486F-BD77-7EF600F9CD5B}] => (Allow) C:\Users\Vijay\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{4F56519E-4996-4CB4-A032-131471FDA36D}] => (Allow) C:\Users\Vijay\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{A08CCB67-D8A8-421D-AC98-4B01D645D6FD}] => (Allow) C:\Users\Vijay\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{5A61DD01-C3F4-4772-BC00-94811F1F2FA2}] => (Allow) C:\Users\Vijay\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{51CD098D-BD39-4B69-900B-2755578FE1D0}] => (Allow) C:\Program Files\Ralink\Common\RaWiFi.exe
FirewallRules: [{BD57476E-D4FF-40D0-BDC9-23DC393FE0F9}] => (Allow) C:\Program Files\Ralink\Common\RaWiFi.exe
FirewallRules: [{7F36C516-A3D1-4834-85A4-83384DBD8E74}] => (Allow) C:\Users\Vijay\AppData\Local\Chromium\Application\chrome.exe
FirewallRules: [{609711B4-514C-4BFD-A7FB-B9693EF69547}] => (Allow) C:\Program Files\Google\Chrome\Application\chrome.exe
FirewallRules: [{C9C1C814-2328-404F-9463-FC4704EEAAA2}] => (Allow) C:\Program Files\MyPublicWiFi\MyPublicWiFi.exe
FirewallRules: [{368BEF4C-5611-4D01-9F57-B77FDCDB4DA3}] => (Allow) C:\Program Files\MyPublicWiFi\MyPublicWiFi.exe
==================== Restore Points =========================
15-08-2016 12:35:05 Device Driver Package Install: Connectify Network Service
15-08-2016 12:36:11 Device Driver Package Install: Connectify Network Service
15-08-2016 12:59:06 Installed Virtual Router v1.0
15-08-2016 13:36:37 Removed Virtual Router v1.0
15-08-2016 13:48:52 Device Driver Package Install: Khalil Azzouzi Network Service
15-08-2016 13:57:07 ##IDS_ERROR_1717##
15-08-2016 13:58:27 ##IDS_ERROR_1717##
15-08-2016 14:09:08 ##IDS_ERROR_1715##
15-08-2016 21:38:55 Installed Windows Mobile Device Center Driver Update
15-08-2016 21:40:46 Installed Windows Mobile Device Center
17-08-2016 09:06:36 Windows Update
17-08-2016 09:10:18 Windows Update
20-08-2016 14:06:22 Windows Update
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (08/21/2016 10:06:16 PM) (Source: VmbService) (EventID: 0) (User: )
Description: conflictManagerTypeValue
Error: (08/21/2016 03:28:44 PM) (Source: VmbService) (EventID: 0) (User: )
Description: conflictManagerTypeValue
Error: (08/21/2016 12:58:13 PM) (Source: VmbService) (EventID: 0) (User: )
Description: GetLoggedOnUser
Error: (08/21/2016 10:47:03 AM) (Source: VmbService) (EventID: 0) (User: )
Description: conflictManagerTypeValue
Error: (08/20/2016 10:23:56 PM) (Source: VmbService) (EventID: 0) (User: )
Description: conflictManagerTypeValue
Error: (08/20/2016 09:32:27 PM) (Source: VmbService) (EventID: 0) (User: )
Description: GetLoggedOnUser
Error: (08/20/2016 08:58:31 PM) (Source: VmbService) (EventID: 0) (User: )
Description: conflictManagerTypeValue
Error: (08/20/2016 07:35:18 PM) (Source: VmbService) (EventID: 0) (User: )
Description: conflictManagerTypeValue
Error: (08/20/2016 05:38:47 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: RaWiFi.exe, version: 2.0.0.8, time stamp: 0x501ba703
Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
Exception code: 0xc0000005
Fault offset: 0x6a0004c2
Faulting process id: 0xc90
Faulting application start time: 0xRaWiFi.exe0
Faulting application path: RaWiFi.exe1
Faulting module path: RaWiFi.exe2
Report Id: RaWiFi.exe3
Error: (08/20/2016 05:08:50 PM) (Source: VmbService) (EventID: 0) (User: )
Description: conflictManagerTypeValue
System errors:
=============
Error: (08/21/2016 10:06:20 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: The following boot-start or system-start driver(s) failed to load:
cdrom
Error: (08/21/2016 10:06:14 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the Ralink UPnP Media Server service to connect.
Error: (08/21/2016 10:05:43 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The photoSync service service failed to start due to the following error:
%%2 = The system cannot find the file specified.
Error: (08/21/2016 03:28:48 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: The following boot-start or system-start driver(s) failed to load:
cdrom
Error: (08/21/2016 03:28:43 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the Ralink UPnP Media Server service to connect.
Error: (08/21/2016 03:28:10 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The photoSync service service failed to start due to the following error:
%%2 = The system cannot find the file specified.
Error: (08/21/2016 12:57:57 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {F9717507-6651-4EDB-BFF7-AE615179BCCF}
Error: (08/21/2016 12:57:53 PM) (Source: ipnathlp) (EventID: 1233) (User: )
Description:
Error: (08/21/2016 12:24:26 PM) (Source: ipnathlp) (EventID: 1233) (User: )
Description:
Error: (08/21/2016 12:21:38 PM) (Source: ipnathlp) (EventID: 1233) (User: )
Description:
==================== Memory info ===========================
Processor: AMD A6-5350M APU with Radeonâ„¢ HD Graphics
Percentage of memory in use: 61%
Total physical RAM: 2266.43 MB
Available physical RAM: 877.46 MB
Total Virtual: 4531.18 MB
Available Virtual: 2690.37 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:99.27 GB) (Free:55.29 GB) NTFS
Drive d: () (Fixed) (Total:99.36 GB) (Free:91.13 GB) NTFS
Drive e: () (Fixed) (Total:99.36 GB) (Free:75 GB) NTFS
Drive f: (10.2.301.27703) (CDROM) (Total:0.04 GB) (Free:0 GB) CDFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298.1 GB) (Disk ID: 000A3742)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=99.3 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=99.4 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=99.4 GB) - (Type=07 NTFS)
==================== End of Addition.txt ============================
Thanks for the logs VJ
I strongly recommend that you uninstall uTorrent as almost 100% or programs files downloaded via the torrents are infected.
Your log does not look to bad but a few things have to be fixed, lets do this
# AdwCleaner v6.000 - Logfile created 24/08/2016 at 01:17:32
# Updated on 12/08/2016 by ToolsLib
# Database : 2016-08-22.1 [Server]
# Operating System : Windows 7 Enterprise Service Pack 1 (X86)
# Username : Vijay - VIJAY-PC
# Running from : C:\Users\Vijay\Desktop\AdwCleaner.exe
# Mode: Scan
# Support : https://toolslib.net/forum
***** [ Services ] *****
No malicious services found.
***** [ Folders ] *****
No malicious folders found.
***** [ Files ] *****
File Found: C:\Users\Vijay\AppData\Roaming\Mozilla\Firefox\Profiles\04j30u0j.default\searchplugins\Search Provided by Bing.xml
***** [ DLL ] *****
No malicious DLLs found.
***** [ WMI ] *****
No malicious keys found.
***** [ Shortcuts ] *****
No infected shortcut found.
***** [ Scheduled Tasks ] *****
No malicious task found.
***** [ Registry ] *****
Key Found: HKLM\SOFTWARE\Classes\OCComSDK.ComSDK
Key Found: HKLM\SOFTWARE\Classes\OCComSDK.ComSDK.1
Key Found: HKLM\SOFTWARE\Classes\CLSID\{B9D64D3B-BE75-4FA2-B94A-C4AE772A0146}
Key Found: HKLM\SOFTWARE\Classes\CLSID\{47A1DF02-BCE4-40C3-AE47-E3EA09A65E4A}
Key Found: HKLM\SOFTWARE\Classes\Interface\{FA7B2795-C0C8-4A58-8672-3F8D80CC0270}
Key Found: HKLM\SOFTWARE\Classes\Interface\{47A1DF02-BCE4-40C3-AE47-E3EA09A65E4A}
Key Found: HKLM\SOFTWARE\Classes\TypeLib\{1112F282-7099-4624-A439-DB29D6551552}
Key Found: HKU\S-1-5-21-3771350486-3931040076-2305587813-1000\Software\PRODUCTSETUP
Key Found: HKU\S-1-5-21-3771350486-3931040076-2305587813-1000\Software\csastats
Key Found: HKCU\Software\PRODUCTSETUP
Key Found: HKCU\Software\csastats
Value Found: HKCU\Software\Google\Chrome\Extensions\bahkljhhdeciiaodlkppoonappfnheoi []
Value Found: HKLM\SOFTWARE\Google\Chrome\Extensions\bahkljhhdeciiaodlkppoonappfnheoi []
***** [ Web browsers ] *****
No malicious Firefox based browser items found.
Chrome pref Found: [C:\Users\Vijay\AppData\Local\Google\Chrome\User Data\Default\Web data] - aol.com
Chrome pref Found: [C:\Users\Vijay\AppData\Local\Google\Chrome\User Data\Default\Web data] - ask.com
Chrome pref Found: [C:\Users\Vijay\AppData\Local\Google\Chrome\User Data\Default\Web data] - hdd-low-level-format-tool.en.softonic.com
Chrome pref Found: [C:\Users\Vijay\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences ] - bahkljhhdeciiaodlkppoonappfnheoi
*************************
C:\AdwCleaner\AdwCleaner[S0].txt - [2423 Bytes] - [24/08/2016 01:17:32]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [2496 Bytes] ##########
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.0.7 (07.03.2016)
Operating System: Windows 7 Enterprise x86
Ran by [removed] (Administrator) on Wed 08/24/2016 at 1:26:52.70
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
File System: 24
Successfully deleted: C:\Users\Vijay\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0E8JPDIW (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Vijay\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0J7QZLY0 (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Vijay\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2S3S5216 (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Vijay\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7BINHQ58 (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Vijay\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\993LTPOU (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Vijay\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ELPQ1TZP (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Vijay\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\G4LJCNAS (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Vijay\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SD11Q9LG (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Vijay\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TRNUYIUJ (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Vijay\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VQG49MLG (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Vijay\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XC1IVZ1U (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Vijay\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZF1RGI0T (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0E8JPDIW (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0J7QZLY0 (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2S3S5216 (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7BINHQ58 (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\993LTPOU (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ELPQ1TZP (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\G4LJCNAS (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SD11Q9LG (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TRNUYIUJ (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VQG49MLG (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XC1IVZ1U (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZF1RGI0T (Temporary Internet Files Folder)
Registry: 1
Successfully deleted: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\\GoogleChromeAutoLaunch_B3E63A82D5B1F30B6033570B48B5087A (Registry Value)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Wed 08/24/2016 at 1:29:35.28
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Malwarebytes Anti-Malware
www.malwarebytes.org
Scan Date: 8/24/2016
Scan Time: 1:35 AM
Logfile:
Administrator: Yes
Version: 2.2.1.1043
Malware Database: v2016.08.23.11
Rootkit Database: v2016.08.15.01
License: Trial
Malware Protection: Enabled
Malicious Website Protection: Enabled
Self-protection: Disabled
OS: Windows 7 Service Pack 1
CPU: x86
File System: NTFS
User: Vijay
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 266157
Time Elapsed: 9 min, 24 sec
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled
Processes: 0
(No malicious items detected)
Modules: 0
(No malicious items detected)
Registry Keys: 2
PUP.Optional.SearchManager.ChrPRST, HKLM\SOFTWARE\GOOGLE\CHROME\EXTENSIONS\bahkljhhdeciiaodlkppoonappfnheoi, , [5d2a3d117a20be78859b777d48bbc43c],
PUP.Optional.SearchManager.ChrPRST, HKU\S-1-5-21-3771350486-3931040076-2305587813-1000\SOFTWARE\GOOGLE\CHROME\EXTENSIONS\bahkljhhdeciiaodlkppoonappfnheoi, , [3c4b97b7a2f81f172fd659a1d23115eb],
Registry Values: 0
(No malicious items detected)
Registry Data: 0
(No malicious items detected)
Folders: 0
(No malicious items detected)
Files: 0
(No malicious items detected)
Physical Sectors: 0
(No malicious items detected)
(end)
These I would be concerned about, did Malwarebytes remove these entries and quarantine them ??
PUP.Optional.SearchManager.ChrPRST, HKLM\SOFTWARE\GOOGLE\CHROME\EXTENSIONS\bahkljhhdeciiaodlkppoonappfnheoi, , [5d2a3d117a20be78859b777d48bbc43c],
PUP.Optional.SearchManager.ChrPRST, HKU\S-1-5-21-3771350486-3931040076-2305587813-1000\SOFTWARE\GOOGLE\CHROME\EXTENSIONS\bahkljhhdeciiaodlkppoonappfnheoi, , [3c4b97b7a2f81f172fd659a1d23115eb],
Are things any better now ?
I am not sure. I only scanned (Threat Scan), did settings as you say and did not cleaned the infections. Do I do it after scanning it again?
Try running Malwarebytes again and if comes back clean then your ok, if it finds those two entries you can remove like this
Thanks Ken. I have cleaned these infections.
As I mentioned in my original post, the original issue is happening intermittently. So, I cannot say that it is resolved or not. However, I did not understand why the issue was happening. Was it the normal thing to happen ?
Also, please let me know, what are the infections till now that I found using all the tools.
And if the process is complete, then should I delete/uninstall all the tools?
These I would be concerned about, did Malwarebytes remove these entries and quarantine them ??
PUP.Optional.SearchManager.ChrPRST, HKLM\SOFTWARE\GOOGLE\CHROME\EXTENSIONS\bahkljhhdeciiaodlkppoonappfnheoi, , [5d2a3d117a20be78859b777d48bbc43c],
PUP.Optional.SearchManager.ChrPRST, HKU\S-1-5-21-3771350486-3931040076-2305587813-1000\SOFTWARE\GOOGLE\CHROME\EXTENSIONS\bahkljhhdeciiaodlkppoonappfnheoi, , [3c4b97b7a2f81f172fd659a1d23115eb],
Are things any better now ?
What Malwarebytes found was a Chome Browser add on but it looks like it was just left over registry entries and not the full infection, everything else that the other scans found where just some garbage that is not needed.
If you look at your FRST Additions log under Firewall Rules you will see that uTorrent has free access both incoming and outgoing on your computer…NOT NICE. I would uninstall it. I would never allow any form of P2P (File Sharing ) on any of my systems.
The original issue you posted about does not appear to be malware related, its possible your anti virus program may have caused this error , not sure. You can post in our windows forum for help to sort that out if you like. But like i said earlier maybe a System Restore prior to the issue will fix it . None of your personal docs and pictures will be removed.
These instructions will remove the tools we used to clean you up, Malwarebytes will not be removed, for more protection I would upgrade to the Premium version that has a protecton module that blocks known bad websites from loading, the cost is minamal but this is entirely up to you
Thanks Ken. I will post in the windows forum if it happens again.
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.
If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.
Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.
AI can make mistakes. Check the cited posts. Archived advice can be out-of-date
Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI
