8 replies to this topic

[chuck666]

Files are attached

Thanks for the help.

Attached Files

•  aswMBR.txt   23.64KB   464 downloads
•  FRST.txt   93.56KB   490 downloads
•  Addition.txt   160.38KB   500 downloads

[Juliet]

OK, lot to do here.

AVAST antivirus and Kaspersky antivirus?
Many problems come with running 2 antivirus, need to make a decssion which one to keep and uninstll the other.

~~~

I advise you avoid P2P file sharing programmes; they are a security risk which can make your computer susceptible to malware. File sharing networks are thoroughly infected and infested with malware - worms, backdoor Trojans, IRCBots, and rootkits propagate via P2P file sharing networks, gaming, and underground sites. Users visiting such pages may see innocuous-looking banner ads containing code which can trigger pop-up ads and malicious Flash ads that install viruses, Trojans, and spyware. The best way to reduce the risk of infection is to avoid these types of web sites and not use P2P applications. Please read the following articles for more information.

• Risks of File-Sharing Technology
• P2P Software User Advisories
• More malware is traveling on P2P networks these days

~~
Task: {7474C89C-42DC-419F-BE2F-1153AF84FBB5} - System32\Tasks\{AB4BA122-C960-4472-8716-BBE19C0D871B} => C:\Windows\system32\pcalua.exe -a "C:\Users\User\Desktop\Nero Burning ROM 2016 17.0.00300 FINAL + Crack [TechTools.NET]\neroburningrom2016-17.0.00300_trial.exe" -d "C:\Users\User\Desktop\Nero Burning ROM 2016 17.0.00300 FINAL + Crack [TechTools.NET]"

cracked/keygens are one of the fastest ways of infecting your system, 100% of Cracked/KeyGen software contains some form of malicious code. In the future I strongly suggest you stay away from using cracks and/or Keygens.

~~~~~~~~~~~~~~~`


Start Farbar Recovery Scan Tool with Administrator privileges
(Right click on the FRST icon and select Run as administrator)

highlight on the text below and select Copy.
beginning with Start:: and finishing with End::
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Highlight the entire content of the quote box below and select Copy.

 

Start::
CloseProcesses:
CreateRestorePoint:
HKLM-x32\...\Run: [YTDownloader] => "C:\Program Files (x86)\YTDownloader\YTDownloader.exe" /boot
C:\Program Files (x86)\YTDownloader
HKLM-x32\...\Run: [] => [X]
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
GroupPolicy: Restriction ? <==== ATTENTION
GroupPolicy\User: Restriction ? <==== ATTENTION
GroupPolicyScripts: Restriction <==== ATTENTION
Winsock: Catalog5 08 C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL => No File
Winsock: Catalog5 09 C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL => No File
Winsock: Catalog5-x64 08 C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL => No File
Winsock: Catalog5-x64 09 C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL => No File
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> DefaultScope {2A65DF7F-0826-4BB4-8B21-ED671ABE71F2} URL =
BHO-x32: Wondershare Video Converter Ultimate 7.1.0 -> {451C804F-C205-4F03-B48E-537EC94937BF} -> C:\PROGRA~3\WONDER~1\VIDEOC~1\WSBROW~1.DLL => No File
BHO-x32: No Name -> {50F4150A-48B2-417A-BE4C-C83F580FB904} -> No File
Handler: WSWSVCUchrome - {1CA93FF0-A218-44F1 - No File
FF HKLM-x32\...\Firefox\Extensions: [ocr@babylon.com] - C:\Program Files (x86)\Babylon\Babylon-Pro\Utils\ocr@babylon.com => not found
FF HKLM-x32\...\Firefox\Extensions: [{F003DA68-8256-4b37-A6C4-350FA04494DF}] - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt => not found
FF Plugin-x32: @qq.com/npQQGameAssist -> C:\Program Files\Tencent\QQGame\npQQGameAssistPlugin.dll [No File]
FF Plugin-x32: @qq.com/QQMusicHelper -> C:\Program Files (x86)\Tencent\QQMusicHelper\QQMusicHelper1254.10.36.13\npQQMusicHelper.dll [No File]
FF Plugin-x32: @qq.com/QQPhotoDrawEx -> C:\Program Files (x86)\Tencent\Qzone\npQQPhotoDrawEx.dll [No File]
FF Plugin-x32: @qq.com/QzoneMusic -> C:\Program Files (x86)\Tencent\QQMusic\QzoneMusic\npQzoneMusic.dll [No File]
FF Plugin-x32: @qq.com/TXSSO -> C:\Program Files (x86)\Common Files\Tencent\TXSSO\1.2.4.2\Bin\npSSOAxCtrlForPTLogin.dll [No File]
FF Plugin-x32: @tencent.com/npQQMailWebKit,version=1.0.0.1 -> C:\Program Files (x86)\QQMailPlugin\npQQMailWebKit.dll [No File]
FF Plugin-x32: @tencent.com/nptxftnWebKit,version=1.0.0.1 -> C:\Program Files (x86)\QQMailPlugin\nptxftnWebKit.dll [No File]
CHR HKLM-x32\...\Chrome\Extension: [bpegkgagfojjbcpkihigfmkojdmmimdf] - <no Path/update_url>
CHR HKLM-x32\...\Chrome\Extension: [cmaiofennmphjldldcpphcechfnnohja] - C:\Program Files (x86)\AdTrustMedia\PrivDog\PrivDog_chrome.crx <not found>
CHR HKLM-x32\...\Chrome\Extension: [ehgldbbpchgpcfagfpfjgoomddhccfgh] - <no Path/update_url>
S2 InstallerService; "C:\Program Files\TrueKey\Mcafee.TrueKey.InstallerService.exe" [X]
S2 NMSAccess; "C:\Program Files (x86)\Blaze Media Pro\NMSAccess32.exe" [X]
S2 ZAPrivacyService; "C:\Program Files (x86)\CheckPoint\ZoneAlarm\ZAPrivacyService.exe" [X]
U1 aswbdisk; no ImagePath
S3 b06bdrv; \SystemRoot\system32\drivers\bxvbda.sys [X]
S3 dbx; system32\DRIVERS\dbx.sys [X]
S3 dgderdrv; System32\drivers\dgderdrv.sys [X]
S3 pccsmcfd; system32\DRIVERS\pccsmcfdx64.sys [X]
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{000D0E00-0000-0000-C000-000000000046}\localserver32 -> "C:\Program Files\CMS\CMS IntelliCAD 8.1 Premium Edition Plus\icad.exe" => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{0099CFA7-40DE-9D9D-D707-5FFE2B2650F9}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{04411138-2A90-5B8C-B564-CD8AB21F2F63}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{083C82AE-568E-45dd-A92C-01422CA45760}\InprocServer32 -> C:\Program Files\Autodesk\Revit Structure 2011\Program\APIContext.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{0884B82D-BCEF-B184-2CA3-A699C29A777B}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{09BEBC5B-7AE6-BF07-3D8E-374A1D003178}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{0ADB5C42-8CB2-DD35-E7F5-5D3250E2D19D}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{0B628DE4-07AD-4284-81CA-5B439F67C5E6}\localserver32 -> C:\Program Files\Autodesk\AutoCAD 2016\acad.exe /Automation => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{0E3A2831-F34B-311D-1F2C-51669957B3D9}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{0E77E023-248B-ECF5-00AA-EB80BD24A918}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{0F22A205-CFB0-4679-8499-A6F44A80A208}\InprocServer32 -> C:\Users\User\AppData\Local\Google\Update\1.3.25.5\psuser_64.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{0F3E2C62-94E2-A6AF-EFEF-488244D2C350}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{10AD2F0E-24D7-4F3B-9527-DC122779BEE8}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{1423F872-3F7F-4E57-B621-8B1A9D49B448}\InprocServer32 -> C:\Users\User\AppData\Local\Google\Update\1.3.27.5\psuser_64.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{144DF3B2-2402-47AE-9583-5A045929A8D4}\InprocServer32 -> C:\Users\User\AppData\Local\Google\Update\1.3.33.5\psuser_64.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{149DD748-EA85-45A6-93C5-AC50D0260C98}\localserver32 -> C:\Program Files\Autodesk\AutoCAD 2016\acad.exe => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{1761BAD7-545D-1E26-62BA-9ED9E3129390}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{1992A01B-977E-30D7-CD11-95937AFEBB64}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{1BD9F7BD-00B8-A273-AE79-C7DF8953E2B8}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}\InprocServer32 -> C:\Users\User\AppData\Local\Microsoft\OneDrive\17.3.6386.0412\amd64\FileSyncShell64.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{209128F5-71C6-205D-7037-7EA3985CEDFF}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{2105A579-1F02-E681-1950-1E7CCE2C299A}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{210F070D-53AA-CAC9-0BF9-82F88AC4632E}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{2139E5B7-3241-FC3A-0B6C-4FB71D7D7646}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{21A90043-CB5B-04F7-09D9-0CE8529B9481}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{23872B08-F8C8-5BA1-3706-F7CEA839596C}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{24A74811-718F-4FCE-225F-B8D2CFC48EDE}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{2A1BE986-CFF9-2B5F-E0C3-84CF44F09EFC}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{2E949038-8103-C652-C06F-3E520A8AD344}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{2F018727-00DE-0891-E8FA-2B1D60C0C7E3}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{314AC707-0C11-4B4C-8CB1-564B3EE6BE5F}\localserver32 -> C:\Program Files\CMS\CMS IntelliCAD 8.1 Premium Edition Plus\icad.exe => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{34B3EA24-BDB0-AF97-CFCF-20DCEB20ECFC}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{35C807A3-6024-5F29-0ADF-5EEB2011B3C7}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{3C5857B4-6BA3-23B9-4CD9-C28998672DC9}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{3E0C1902-4A51-8497-57EA-D62089C33826}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{3faa4380-a399-11cf-a466-00805fe418f6}\InprocServer32 -> C:\Program Files\Autodesk\DWG TrueView 2016 - English\en-US\dwgviewrficn.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{473D92C5-4A50-E6DB-B302-25676FC8CEF4}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{4BCF72DA-684E-5A64-A0E8-2F5597EB918A}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{4EEB678D-4605-914D-347A-4EF22C3D954B}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{51E98CE2-AF9F-4F9D-5EDB-9DA5486F5DF6}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{529FD314-ED7E-9058-8CA8-B959396BA57A}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{5370C727-1451-4700-A960-77630950AF6D}\localserver32 -> C:\Program Files\Autodesk\AutoCAD 2016\acad.exe /Automation => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{58A4EBCA-52B9-3F3D-71B0-60226A6FD4A7}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{590C4387-5EBD-4D46-8A84-CD0BA2EF2856}\InprocServer32 -> C:\Users\User\AppData\Local\Google\Update\1.3.30.3\psuser_64.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{59B55F04-DE14-4BB8-92FF-C4A22EF2E5F4}\InprocServer32 -> C:\Users\User\AppData\Local\Google\Update\1.3.31.5\psuser_64.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{5C8C2A98-6133-4EBA-BBCC-34D9EA01FC2E}\InprocServer32 -> C:\Users\User\AppData\Local\Google\Update\1.3.28.1\psuser_64.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{5D02CD29-A2EE-2B02-B47B-067757CB2565}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{5E44874E-68AB-515A-5E71-22E33F9CE064}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{5F8A3072-41D2-7164-E1AB-BA65E32B2EDD}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{5FB36537-9B3C-6CFB-D515-3DE104240753}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{6142F40B-76F6-9DE0-A2D5-CA6FBC9DF960}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{615BA1EB-1CCA-948B-AAC4-56D5690F4B3C}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{61FDB5BC-6D47-7B88-62CC-7DC08311B39D}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{64D548CF-0D83-34A7-54A4-AC4429C26C73}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{65933717-4D32-5CBB-0037-F5E75AC4D7C7}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{6A221957-2D85-42A7-8E19-BE33950D1DEB}\localserver32 -> C:\Program Files\Autodesk\AutoCAD 2014\acad.exe => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{6A37D228-6D7D-5CF7-69BF-01951F547EBF}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{6C99CC47-9EA3-328E-B24D-837C19A33AD4}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{6CFB62AA-9D5C-EFD5-A37D-6D1E7AFBAEB3}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{6E210260-4389-512F-2454-0BCC2A32F68D}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{6E852F1D-53EA-E0F3-F137-435A55233594}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{7135B2E1-D078-8CCA-E845-312B1412EA53}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{71B10F0A-DE60-1D5A-06C2-5E30420425ED}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{78550997-5DEF-4A8A-BAF9-D5774E87AC98}\InprocServer32 -> C:\Users\User\AppData\Local\Google\Update\1.3.28.13\psuser_64.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{78A6AC9A-3070-9ED6-29D2-5AE4C2DE7B3F}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{793EE463-1304-471C-ADF1-68C2FFB01247}\InprocServer32 -> C:\Users\User\AppData\Local\Google\Update\1.3.29.5\psuser_64.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{79A8636B-7B98-EDC2-0C44-6F7E39DD6868}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{7A59699F-EA33-6D20-2291-C292F7EFD244}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}\InprocServer32 -> C:\Users\User\AppData\Local\Microsoft\OneDrive\17.3.6386.0412\amd64\FileSyncShell64.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{7B6A1858-E547-3187-9CC1-C91ECDF644FD}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{7C95469D-367E-F10D-93E9-05C7FA6E50AD}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{7DE1BE5C-CEBA-4F1D-ACBC-9CE11EE9A2A1}\localserver32 -> C:\Program Files\Autodesk\AutoCAD 2014\acad.exe /Automation => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{7EA2FC0E-D5C8-F83A-B584-C4811D0B1300}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{7EDCD7E5-E2B0-D35E-31A2-55643393857A}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{81AF0F32-3D60-AE3F-506D-02DB3884C0DE}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E}\InprocServer32 -> C:\Users\User\AppData\Local\Microsoft\OneDrive\17.3.6386.0412\amd64\FileSyncShell64.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{83A37DC5-310D-3F4F-5A26-CCF8F402F1AB}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{867FA47E-79EC-1BCF-94A0-DE4E6269F474}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{873B53D6-E4FA-BF1B-164D-936082305719}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{8742C155-05EA-3DCC-9F1C-F8E5D8078C3D}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{89628CCA-1B1A-1C61-70C0-FA8B941ACC08}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{8C15B215-08EF-A6B9-072B-893B3DB93B72}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{8C46158B-D978-483C-A312-16EE5013BE04}\InprocServer32 -> C:\Users\User\AppData\Local\Google\Update\1.3.33.3\psuser_64.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{8D79DAC4-BC7B-9EF9-E4E9-22D914242211}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{9062396A-8EAA-BE8A-2114-126FFF8A755D}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{90B3DFBF-AF6A-4EA0-8899-F332194690F8}\InprocServer32 -> C:\Users\User\AppData\Local\Google\Update\1.3.24.15\psuser_64.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{910B3874-1DC9-054D-A662-54206261C9A3}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{91A41FCC-BC02-42D8-A36E-0D27FF9BFFC8}\InprocServer32 -> C:\Users\User\AppData\Local\Google\Update\1.3.33.7\psuser_64.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{91AD5D5F-7148-FA24-D8BA-285E98FBF34D}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{924D8ADA-3D35-08EA-C26E-77B4A046002F}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{92ACF168-5B66-15C4-3BD6-52668EAA751C}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{9AA9CBF2-9967-5CD8-650F-6272187DCB7B}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{9BAD416A-3107-E2EF-C9D1-3AB4A4625D16}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{9CB2A27F-F39D-D869-B736-05C64AE1BC73}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{9DE8E9C1-4B2F-6417-D95F-789641BFC94F}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{9FDE4061-3B67-0283-DFF8-17D6722ABB01}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{A1783B66-0972-E760-B086-B4C93F834A97}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{A44AB5E0-40DC-5438-5623-DA019CABA56E}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{A7461C49-B122-2FA5-B6CF-5F023091356D}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{AFFD1D06-04B2-B9B8-A9FA-B5807A179F2C}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{B2B539E6-BE3D-3BD8-6472-6CEA00208E69}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{B5EB0446-4CEA-6744-1E14-546FEBDA9C5A}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{B77FE1AF-94A8-2F97-12FE-A87825335B45}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{B781DBA9-CAFE-610D-EB3A-B362BF412BC7}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{BA4F7AA3-CAAD-62CE-3BFC-48A46B8891D5}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{BD0DEB94-63DB-4392-9420-6EEE05094B1F}\localserver32 -> C:\Program Files\Autodesk\AutoCAD 2014\acad.exe /Automation => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{BD4BB03D-5295-6188-D36F-16680A07920E}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{C3BC25C0-FCD3-4F01-AFDD-41373F017C9A}\InprocServer32 -> C:\Users\User\AppData\Local\Google\Update\1.3.26.9\psuser_64.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{C4C34861-D306-93D5-B30F-A7F0D42D2D69}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{C591D97F-8486-AC2B-58ED-543546E9F184}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{C5EF8042-F768-BC19-D49A-541FD118ADFE}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{CB492AF1-2CEF-4E58-BE47-471C77D0C8BA}\InprocServer32 -> C:\Users\User\AppData\Local\Google\Update\1.3.32.7\psuser_64.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{CBDEFAAC-70DA-8F2E-2F07-6B17A939A2A5}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{CC182BE1-84CE-4A57-B85C-FD4BBDF78CB2}\InprocServer32 -> C:\Users\User\AppData\Local\Google\Update\1.3.29.1\psuser_64.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{CC243FF8-E189-45A0-9EAB-B46FDA99FCCA}\InprocServer32 -> C:\Users\User\AppData\Local\Google\Update\1.3.25.7\psuser_64.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{CD360D2D-595C-87CF-37F5-815AD591DBC4}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{CDBCA1D2-C8A7-A052-6D26-774DC3DCFFFC}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{CE7A9202-B9E3-C5A7-C144-6731A660A5EC}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{D0336C0B-7919-4C04-8CCE-2EBAE2ECE8C9}\InprocServer32 -> C:\Users\User\AppData\Local\Google\Update\1.3.25.11\psuser_64.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{D14F72D1-28A3-6A2E-A919-AF69B0E958B1}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{D1EDC4F5-7F4D-4B12-906A-614ECF66DDAF}\InprocServer32 -> C:\Users\User\AppData\Local\Google\Update\1.3.28.15\psuser_64.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{D1F5A6BC-B25B-4319-7501-8B56EFABD41D}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{D374F580-6AA7-5B04-B04D-22F55A38A1D9}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{D6FD15CA-7D04-3583-AD7D-E1454C6A04F8}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{D7284C75-802A-9C84-37ED-97991FFF2869}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{D7DB5A07-56E3-6D0D-EFCB-8BB39E57FDC0}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{DA35FC02-3B39-0965-A945-30C0A3D1910B}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{DAEDDF77-A975-3A67-4613-54A4365D5316}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{DD726CE9-69C8-3FF5-D897-84A1A3DE4E56}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{DE5085CD-0509-D588-3CF1-5BF9E64F60AE}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{DF1B703C-87EF-6650-A399-188CA41C6244}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{E17B459E-3157-9A6A-3EF1-D41F3B109F00}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{E59856CF-4604-A2AB-C809-72F9E0822B6D}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{E6B585EC-7147-23FA-F964-8B0BA659DC76}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{E7D81C3F-2283-80AF-F00D-32AAF57167A3}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{E9A74089-7508-1598-B918-3CA107BACB1B}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{EA666C34-165C-08AA-7E23-76799C3EFFF9}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{EC0F6A3A-7212-111C-3B18-8AAB9154F340}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{EDDB87CA-E44B-ECDC-F75E-F702179CF804}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{F441B67E-6438-F1A3-F6C3-1040BE5D80CA}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{F7749E6D-4338-12A1-168E-3E3E16ED004D}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{F777A613-7EEB-F594-0C06-591F125C7759}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{FEDB3A72-8276-586C-ECA4-69D898B9072C}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
CustomCLSID: HKU\S-1-5-21-2238981392-514392180-3092953287-1000_Classes\CLSID\{FF6A239C-37E6-5036-4FCD-ACFDB122933E}\InprocServer32 -> C:\Program Files\Nanosoft\nanoCAD x64 Plus en 7.0\bin\OdaX_csd.dll => No File
ShellIconOverlayIdentifiers: [ MEGA (Pending)] -> {056D528D-CE28-4194-9BA3-BA2E9197FF8C} => C:\ProgramData\MEGAsync\ShellExtX64.dll -> No File
ShellIconOverlayIdentifiers: [ MEGA (Synced)] -> {05B38830-F4E9-4329-978B-1DD28605D202} => C:\ProgramData\MEGAsync\ShellExtX64.dll -> No File
ShellIconOverlayIdentifiers: [ MEGA (Syncing)] -> {0596C850-7BDD-4C9D-AFDF-873BE6890637} => C:\ProgramData\MEGAsync\ShellExtX64.dll -> No File
ShellIconOverlayIdentifiers: [GDriveSharedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} => -> No File
ShellIconOverlayIdentifiers-x32: [ MEGA (Pending)] -> {056D528D-CE28-4194-9BA3-BA2E9197FF8C} => C:\ProgramData\MEGAsync\ShellExtX64.dll -> No File
ShellIconOverlayIdentifiers-x32: [ MEGA (Synced)] -> {05B38830-F4E9-4329-978B-1DD28605D202} => C:\ProgramData\MEGAsync\ShellExtX64.dll -> No File
ShellIconOverlayIdentifiers-x32: [ MEGA (Syncing)] -> {0596C850-7BDD-4C9D-AFDF-873BE6890637} => C:\ProgramData\MEGAsync\ShellExtX64.dll -> No File
ContextMenuHandlers1-x32: [WinArchiver] -> {A6630968-27DC-8DB8-9BCE-E12B3198A9B1} => C:\Program Files\WinArchiver\WASHELL.DLL -> No File
ContextMenuHandlers1-x32-x32: [ZLAVShExt] -> {D9872D13-7651-4471-9EEE-F0A00218BEBB} => C:\Program Files (x86)\CheckPoint\ZoneAlarm\zlavscan.dll -> No File
ContextMenuHandlers2: [MEGA (Context menu)] -> {0229E5E7-09E9-45CF-9228-0228EC7D5F17} => C:\ProgramData\MEGAsync\ShellExtX64.dll -> No File
ContextMenuHandlers3: [MEGA (Context menu)] -> {0229E5E7-09E9-45CF-9228-0228EC7D5F17} => C:\ProgramData\MEGAsync\ShellExtX64.dll -> No File
ContextMenuHandlers4: [MEGA (Context menu)] -> {0229E5E7-09E9-45CF-9228-0228EC7D5F17} => C:\ProgramData\MEGAsync\ShellExtX64.dll -> No File
ContextMenuHandlers4: [PowerISO] -> {967B2D40-8B7D-4127-9049-61EA0C2C6DCE} => -> No File
ContextMenuHandlers4: [WinArchiver] -> {A6630968-27DC-8DB8-9BCE-E12B3198A9B1} => C:\Program Files\WinArchiver\WASHELL.DLL -> No File
ContextMenuHandlers6: [PowerISO] -> {967B2D40-8B7D-4127-9049-61EA0C2C6DCE} => -> No File
ContextMenuHandlers6: [WinArchiver] -> {A6630968-27DC-8DB8-9BCE-E12B3198A9B1} => C:\Program Files\WinArchiver\WASHELL.DLL -> No File
ContextMenuHandlers6-x32: [ZLAVShExt] -> {D9872D13-7651-4471-9EEE-F0A00218BEBB} => C:\Program Files (x86)\CheckPoint\ZoneAlarm\zlavscan.dll -> No File
Task: {0039AD87-88EF-4E1C-8D71-BF359ADECC78} - \SimpleFiles Installer Starter -> No File <==== ATTENTION
Task: {51B1EEE8-19B2-4278-8ACA-AEA7967A8B35} - System32\Tasks\{FAE7CF79-0B52-4BE5-BF52-355C689BA959} => C:\Windows\system32\pcalua.exe -a C:\Users\User\AppData\Local\Temp\7zOF339.tmp\photo-print-calendar.exe -d C:\Users\User\AppData\Local\Temp\7zOF339.tmp\ <==== ATTENTION
Task: {7BEDBA40-C2E9-48A0-BAA8-0B683EE48CC7} - System32\Tasks\{43A689E6-301B-4426-BDC0-D32129F3885E} => C:\Windows\system32\pcalua.exe -a C:\Users\User\AppData\Local\Temp\jds328163.tmp\jre-8u73-windows-au.exe <==== ATTENTION
Task: {84C4F1B6-41D6-4B2C-B707-28491B4294F2} - System32\Tasks\{66F1DA9B-5333-4C4D-BAEE-EF4EB0E49868} => C:\Windows\system32\pcalua.exe -a "C:\Program Files (x86)\ShopperPro\SPremove.exe" <==== ATTENTION
Task: {AF972D14-1898-4058-B9FA-7E5892297685} - System32\Tasks\{5F3EA09C-F0FA-42B7-8F47-0854EDD225BE} => C:\Windows\system32\pcalua.exe -a "C:\Users\User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Q5GWZV0T\setup.exe" -d C:\Users\User\Desktop
ShortcutWithArgument: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\ALL-IN-ONE PACKAGE TRACKING _ 17TRACK (1).lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> --profile-directory=Default --app-id=jnaaieecoediidgcbekhghnaijdgeedi
ShortcutWithArgument: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\ALL-IN-ONE PACKAGE TRACKING _ 17TRACK.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> --profile-directory=Default --app-id=edghcbkjjekkmolghdoajjjibaabaikg
AlternateDataStreams: C:\7zip bat:Roxio EMC Stream [38]
AlternateDataStreams: C:\Windows:nlsPreferences [386]
AlternateDataStreams: C:\ProgramData\Temp:90EF0C9C [104]
AlternateDataStreams: C:\ProgramData\Temp:BF3D62E7 [180]
AlternateDataStreams: C:\Users\User\Desktop\Design Guide 13_ Wide-Flange Column Stiffening at Moment Connections (See errata listed at end of file.).pdf:com.dropbox.attributes [168]
AlternateDataStreams: C:\Users\User\Desktop\DILLION_Rs:com.dropbox.attributes [168]
AlternateDataStreams: C:\Users\User\Desktop\DILLION_Rs:com.dropbox.attrs [58]
AlternateDataStreams: C:\Users\User\Desktop\DTSL_ReactionReport_LSD_LRFD.xsr:com.dropbox.attributes [168]
AlternateDataStreams: C:\Users\User\Desktop\EMD Garage Permit Set (04-11-2018).pdf:com.dropbox.attributes [168]
AlternateDataStreams: C:\Users\User\Desktop\Pinnacle _Before_HR_Changes:com.dropbox.attributes [168]
AlternateDataStreams: C:\Users\User\Desktop\vocabulary.doc:Roxio EMC Stream [38]
C:\Windows\Temp\*.*
Emptytemp:
End::

Start FRST (FRST64) with Administrator privileges
Press the Fix button. FRST will process the lines copied above from the clipboard.
When finished, a log file Fixlog.txt will pop up and saved in the same location the tool was ran from.

Please copy and paste its contents in your next reply.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

AdwCleaner - Fix Mode

• Download AdwCleaner and move it to your Desktop
• Right-click on AdwCleaner.exe and select Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users)
• Accept the EULA (I accept), then click on Scan
• Let the scan complete. Once it's done, make sure that every item listed in the different tabs is checked and click on the Clean & Repair button. This will kill all the active processes
• Once the cleaning process is complete, AdwCleaner will ask to restart your computer, do it
• After the restart, a log will open when logging in. Please copy/paste the content of that log in your next reply
• ~~~~~~~~~~~~~~~`
  RogueKiller
  • Download the right version of RogueKiller for your Windows version (32 or 64-bit)
  • Once done, move the executable file to your Desktop, right-click on it and select Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users)
  • Click on the Start Scan button in the right panel, which will bring you to another tab, and click on it again (this time it'll be in the bottom right corner)
  • Wait for the scan to complete
  • On completion, the results will be displayed
  • Check every single entry (threat found), and click on the Remove Selected button
  • On completion, the results will be displayed. Click on the Open Report button in the bottom left corner, followed by the Open TXT button (also in the bottom left corner)
  • This will open the report in Notepad. Copy/paste its content in your next reply
  created by Aura
  
  ~~
  Your next reply(ies) should therefore contain:
  • Copy/pasted Fixlog.txt
  • Copy/pasted AdwCleaner clean log
  • Copy/pasted RogueKiller clean log

[chuck666]

I usually only use Kaspersky but since it was unable to remove the virus I tried other options, Avast & Malwarebytes.

As I was finishing this process Kaspersky notified me of the virus again.

Attached Files

•  Fixlog.txt   95.06KB   409 downloads
•  AdwCleanerC00.txt   21KB   461 downloads
•  RogueKiller.txt   10.89KB   440 downloads

Edited by chuck666, 06 December 2018 - 08:16 AM.

[Juliet]

Kaspersky notified me of the virus again

Any way to see or find  where Kaspersky says it's located?
 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~`
Let's update and run a scan with MBAM

• go to the Dashboard and click on SCAN NOW
• If threats are detected, click the Apply Actions button. You will now be prompted to reboot. Click Yes.
  Upon completion of the scan (or after the reboot), click the Reports tab.
  Double-click the Scan Log.
  At the bottom click Export and choose Text file.
  
  Save the file to your desktop and include its content in your next reply.
  
  You can access the logs by going in the "Reports" tab, clicking on the latest "Scan" entry (the one with detections), then clicking on the "Export" button in the bottom-left corner and select "Copy to clipboard". After that, all you have to do is paste it here
• Then click on POST
• Exit Malwarebytes

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Emsisoft Emergency Kit - Fix Mode
Follow the instructions below to run a scan using the Emsisoft Emergency Kit.

• Download the Emsisoft Emergency Kit and execute it. From there, click on the Install button to extract the program in the EEK folder;
• Once the extraction is complete, the EEK folder will open. Right-click on start emergency kit scanner.exe and select Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users);
• EEK will suggest that you run an online update before using the program. Click on Yes to launch it.
• After the update, click on Malware Scan under 2. Scan and accept to let EEK detect PUPs (click on Yes).
• Once the scan is complete, make sure that every item in the list is checked, and click on the Quarantine selected button;
• If it asks you for a reboot to delete some items, click on Ok to reboot automatically;
• After the restart, open EEK again (in the C:\EEK folder);
• This time, click on Logs;
• From there, go under the Quarantine Log tab, and click on the Export button;
• Save the log on your desktop, then open it, and copy/paste its content in your next reply;

~~~
 
Please click HERE to download Kaspersky Virus Removal Tool.

• Double click on the file you just downloaded and let it install.
• It will install to your desktop (be patient; it may take a while).
• Accept license agreement and click "Start" button.
• Click on Settings button
  • In Scan scope leave pre-checked items as they're and also checkmark My Computer
  • In Actions checkmark Select action: (disinfect; delete if disinfection fails) instead of preselected Prompt on detection
• Click on Automatic Scan tab and then click on Start scanning button.
• Before it is done it may prompt for action regardless of the setting so choose delete if prompted.
• When the scan is done NO log will be produced.
• Click on Report button then on Automatic Scan report tab.
• Right click anywhere within right pane, click Select All then right click again and click Copy.
• This will copy the items that it found to the clipboard you can then open notepad (go to start then run then type in notepad) and choose paste to paste the contents into Notepad.
• You can save this on the desktop.
• Post the contents of the document in your next reply.

Please post these 3 logs when finished.

Also, tell me how the computer is now.

Also, people are complaining of the same here at the below Kaspersky forums
https://forum.kasper...-system-memory/
https://forum.kasper...sstraum/&page=2

[chuck666]

MBAM found nothing. The log is below. EEK found stuff. The log is below. The real magic was the KVRT. It found a couple of adware PUPs and one trojan. The link you provided for KVRT was out of date and the UI was slightly different than your description. The detection pane gave two choices for the trojan, skip & cure. I selected cure. For the adware I selected delete. Once the process was complete KVRT started another scan. Not far into the second scan it reported that a reboot was needed. On restart KVRT started a command window that, I'm assuming, fixed the problem outside of the windows interface. When this was done it launched a third scan. This time no threats were detected. I was unable to select/copy/paste as you described. I took a snapshot of the first and last scan results and pasted them below. I don't know what the end result of all of this will be. It's too soon to tell.

 

Malwarebytes

www.malwarebytes.com

 

-Log Details-

Scan Date: 12/10/18

Scan Time: 8:57 AM

Log File: 87b5acce-fc83-11e8-b0bb-f46d0492a564.json

 

-Software Information-

Version: 3.6.1.2711

Components Version: 1.0.508

Update Package Version: 1.0.8247

License: Trial

 

-System Information-

OS: Windows 7 Service Pack 1

CPU: x64

File System: NTFS

User: CHUCK\Charles

 

-Scan Summary-

Scan Type: Threat Scan

Scan Initiated By: Manual

Result: Completed

Objects Scanned: 411307

Threats Detected: 0

Threats Quarantined: 0

Time Elapsed: 4 min, 39 sec

 

-Scan Options-

Memory: Enabled

Startup: Enabled

Filesystem: Enabled

Archives: Enabled

Rootkits: Disabled

Heuristics: Enabled

PUP: Detect

PUM: Detect

 

-Scan Details-

Process: 0

(No malicious items detected)

 

Module: 0

(No malicious items detected)

 

Registry Key: 0

(No malicious items detected)

 

Registry Value: 0

(No malicious items detected)

 

Registry Data: 0

(No malicious items detected)

 

Data Stream: 0

(No malicious items detected)

 

Folder: 0

(No malicious items detected)

 

File: 0

(No malicious items detected)

 

Physical Sector: 0

(No malicious items detected)

 

WMI: 0

(No malicious items detected)

 

 

(end)

 

Emsisoft Emergency Kit 2018.6.0.8742 stable [en-us]

OS: Windows 7 Service Pack 1 (Version 6.1, Build 7601, 64-bit Edition)

 

Forensics log

 

Date Component Action Details

12/10/18 9:10:41 AM User CHUCK\CHARLES Infection quarantined PUP "Application.AdStart (A)" in "RUN -> BROWSERPLUGINHELPER".

12/10/18 9:10:41 AM User CHUCK\CHARLES Infection quarantined PUP "Application.AdReg (A)" in "{3A0EFC4E-F167-4D0E-9C24-FC5519237993}".

12/10/18 9:10:41 AM User CHUCK\CHARLES Infection quarantined PUP "Application.AdReg (A)" in "{27DE7D30-BCCD-44D1-ADCB-A74A4259EBEF}".

12/10/18 9:10:41 AM User CHUCK\CHARLES Infection quarantined PUP "Application.AdReg (A)" in "{02DD8284-A49F-43E5-9D84-CF19DC9AD21D}".

12/10/18 9:10:11 AM Scanner Scan finished Found 4 objects , user to decide on further actions.

12/10/18 9:08:52 AM Scanner Detection PUP "Application.AdReg (A)" in "{02DD8284-A49F-43E5-9D84-CF19DC9AD21D}" and 3 other objects

12/10/18 9:08:40 AM User CHUCK\Charles Scan started Malware Scan

12/10/18 9:08:27 AM User CHUCK\Charles Setting modified "Detect PUPs" has been changed to "Enabled".

12/10/18 9:07:32 AM User Update Downloaded and installed 48 files (24137 kb) (12 sec.).

12/10/18 9:07:20 AM Core Notification "Recommended Reading:Beware: New wave of malware spreads via ISO file email attachments".

12/10/18 9:07:16 AM User Update Failed with error "Server returned error" (0 sec.).

 

 

Attached Thumbnails

• 
• 

[Juliet]

 

The link you provided for KVRT was out of date and the UI was slightly different than your description

I am so sorry about that I apologize.   I tried to copy and paste someone else's but it didn't take.

 

Well, how's the computer now?

[chuck666]

No apologies needed. I wasn't complaining, just attempting to keep you current. I've been using the computer for a day now and had no problems with it. I figured I would wait a few more days before I turned system restore on and create a restore point. Thanks for the help. Is there anything else I should know?

[Juliet]

What we/I normally do at this point is remove tools and quarantine folders.

• Please download DelFix or from Here and save the file to your Desktop.
• Double-click DelFix.exe to run the programme.
• Place a checkmark next to the following items:
• Activate UAC
• Remove disinfection tools
• Click the Run button.
• -- This will remove the specialized tools we used to disinfect your system.
  Any leftover logs, files, folders or tools remaining on your Desktop which were not removed can be deleted manually (right-click the file + delete).

*********

• Answers to common security questions - Best Practices by quietman7, MVP
• How Malware Spreads - How did I get infected? by quietman7, MVP
• Simple and easy ways to keep your computer safe and secure on the Internet by Lawrence Abrams, MVP
• How to Prevent Malware by miekiemoes, MVP
• How to backup and restore your data using Cobian Backup by YourHighness
• Slow Computer/browser? It May Not Be Malware by quietman7, MVP

• AdBlock is a browser add-on that blocks annoying banners, pop-ups and video ads.
• CryptoPrevent places policy restrictions on loading points for ransomware (eg. CryptoWall), helping prevent the execution of malware.
• Malwarebytes Anti-Exploit (MBAE) is designed to prevent zero-day malware from exploiting vulnerable software.
• Malwarebytes Anti-Malware Premium (MBAM) works in real-time along side your Anti-Virus to prevent malware execution.
• NoScript is a Firefox add-on that blocks the actions of malicious scripts by using whitelisting and other technology.
• Sandboxie isolates programmes of your choice, preventing files from being written to your HDD unless approved by you.
• Secunia PSI will scan your computer for vulnerable software that is outdated, and automatically find the latest update for you.
• Unchecky automatically removes checkmarks for bunlded software in programme installers; helping you avoid adware and PUPs.

[Juliet]

Glad we could help.
Since this issue appears resolved ... this Topic is closed.