TechSpot

Audio ads playing in the background

By cokeguy
Nov 12, 2014
  1. I saw this problem was solved many times on the forums, but didn't want to follow the steps in case they were meant only for the other people's unique situations. So I decided to make an account and ask for help.
    These ads usually play around 3-4 am, but happen throughout the day and in the volume mixer, its shown its done through chrome. Also recently, chrome has been eating up a lot of CPU usage even when it's not doing anything, so I think thats related.
    Used malwarebytes, Kaspersky, doesn't detect anything.
    Thanks in advance.
     
  2. Broni

    Broni Malware Annihilator Posts: 52,892   +344

    Welcome aboard [​IMG]


    Please, complete all steps listed here: http://www.techspot.com/vb/topic58138.html
    Make sure, you PASTE all logs. If some log exceeds 50,000 characters post limit, split it between couple of replies.
    Attached logs won't be reviewed.


    Please, observe following rules:
    • Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
    • If you're stuck, or you're not sure about certain step, always ask before doing anything else.
    • Please refrain from running any tools, fixes or applying any changes to your computer other than those I suggest.
    • Never run more than one scan at a time.
    • Keep updating me regarding your computer behavior, good, or bad.
    • The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
    • If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
    • I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.
     
  3. cokeguy

    cokeguy TS Rookie Topic Starter Posts: 21

    Thank you broni, I've read a lot of posts you've made regarding this problem
    Step 1: didn't have an AV, so I installed Avast
    Step 2: In progress
    I have a question actually pertaining to the MBAM scan.
    I have some things that it always picks up on from my torrents like crackers or pirated games. I don't believe they are the source of the problem as they are all 5+ years old, would it be fine to ignore them instead of applying actions to all files detected? Thanks.
    EDIT: Apparently, the threat scanner doesn't pick it up. Only when I do a complete scan including all of my hard drives, it does.
     
  4. cokeguy

    cokeguy TS Rookie Topic Starter Posts: 21

    MBAM Logs:
    Malwarebytes Anti-Malware
    www.malwarebytes.org

    Scan Date: 12/11/2014
    Scan Time: 7:05:33 PM
    Logfile: mbam.txt
    Administrator: Yes

    Version: 2.00.3.1025
    Malware Database: v2014.11.12.10
    Rootkit Database: v2014.11.12.01
    License: Free
    Malware Protection: Disabled
    Malicious Website Protection: Disabled
    Self-protection: Disabled

    OS: Windows 7
    CPU: x64
    File System: NTFS
    User: Calvin

    Scan Type: Threat Scan
    Result: Completed
    Objects Scanned: 329856
    Time Elapsed: 5 min, 14 sec

    Memory: Enabled
    Startup: Enabled
    Filesystem: Enabled
    Archives: Enabled
    Rootkits: Disabled
    Heuristics: Enabled
    PUP: Warn
    PUM: Enabled

    Processes: 0
    (No malicious items detected)

    Modules: 0
    (No malicious items detected)

    Registry Keys: 0
    (No malicious items detected)

    Registry Values: 0
    (No malicious items detected)

    Registry Data: 0
    (No malicious items detected)

    Folders: 0
    (No malicious items detected)

    Files: 1
    PUP.Optional.Softonic, E:\$Recycle.Bin\S-1-5-21-1199268278-559096122-390045334-1000\$RF3K4WS.crdownload, Quarantined, [8a60ec4ee09cb08624620753f60a06fa],

    Physical Sectors: 0
    (No malicious items detected)


    (end)
     
  5. cokeguy

    cokeguy TS Rookie Topic Starter Posts: 21

    .
    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT
    .
    DDS (Ver_2012-11-20.01)
    .
    Microsoft Windows 7 Ultimate
    Boot Device: \Device\HarddiskVolume2
    Install Date: 17/12/2013 6:29:06 PM
    System Uptime: 12/11/2014 4:01:20 PM (3 hours ago)
    .
    Motherboard: ASRock | | Z77 Extreme3
    Processor: Intel(R) Core(TM) i5-3570K CPU @ 3.40GHz | CPUSocket | 3401/100mhz
    .
    ==== Disk Partitions =========================
    .
    C: is FIXED (NTFS) - 1863 GiB total, 867.177 GiB free.
    D: is FIXED (NTFS) - 298 GiB total, 9.616 GiB free.
    E: is FIXED (NTFS) - 119 GiB total, 23.692 GiB free.
    F: is CDROM ()
    H: is CDROM ()
    Z: is NetworkDisk (NTFS) - 153 GiB total, 142.626 GiB free.
    .
    ==== Disabled Device Manager Items =============
    .
    ==== System Restore Points ===================
    .
    RP92: 12/11/2014 7:05:52 PM - avast! antivirus system restore point
    .
    ==== Installed Programs ======================
    .
    Adobe After Effects CS6
    Adobe AIR
    Adobe Flash Player 15 Plugin
    Adobe Help Manager
    Adobe Photoshop CS6
    Adobe Reader 9.5.5
    Archeage
    Archeblade
    ASIO4ALL
    ASRock eXtreme Tuner v0.1.270
    ASRock InstantBoot v1.29
    ASRock XFast RAM v2.0.9
    µTorrent
    Audacity 2.0.5
    Avast Free Antivirus
    Battle.net
    Battlefield 3™
    Battlelog Web Plugins
    Belkin Setup and Router Monitor
    Belkin USB Print and Storage Center
    BF3 Borderless
    BioShock Infinite
    Brother MFL-Pro Suite HL-2280DW
    Burnout™ Paradise: The Ultimate Box
    CDisplay 1.8
    Counter-Strike: Global Offensive
    CPUID CPU-Z 1.67.1
    CPUID HWMonitor 1.24
    dBpoweramp [Calculate Audio CRC] Codec
    dBpoweramp Dalet Codec
    dBpoweramp DSP Effects
    dBpoweramp Monkeys Audio Codec
    dBpoweramp mp3 (Fraunhofer IIS) Codec
    dBpoweramp Music Converter
    dBpoweramp Ogg Vorbis Codec
    dBPowerAMP Real Audio (Helix) Encoder
    dBpoweramp WavPack Codec
    Deckadance 2
    DirectWave
    Dropbox
    DX10
    Edison
    EPUB File Reader
    Evolve
    f.lux
    FAHClient
    Fallout New Vegas
    FL Studio 11
    FlowStone FL 3.0
    Glyph
    Google Chrome
    Google Update Helper
    Groove Machine
    GunboundIS
    Guns and Robots
    GunZ 2: The Second Duel
    Hardcore
    Hearthstone
    Heaven Benchmark version 4.0
    Hotfix for Microsoft .NET Framework 4 Client Profile (KB2461678)
    IL Download Manager
    IL DrumSynth Live
    IL Gross Beat
    IL Juice Pack
    IL MiniHost
    IL Shared Libraries
    IL Vocodex
    InfiniteCrisis_7C9F5EC32A45
    Intel(R) Control Center
    Intel(R) Management Engine Components
    Intel(R) OpenCL CPU Runtime
    Intel(R) Processor Graphics
    Intel(R) Rapid Storage Technology
    Intel(R) Smart Connect Technology 2.0 x64
    Intel(R) Update Manager
    Intel(R) USB 3.0 eXtensible Host Controller Driver
    Intel® Trusted Connect Service Client
    Java 7 Update 71
    Java Auto Updater
    JDownloader 0.9
    Kaspersky Anti-Virus
    LAME v3.99.3 (for Windows)
    Last.fm Scrobbler 2.1.36
    Logitech Gaming Software
    Logitech Gaming Software 8.55
    Malwarebytes Anti-Malware version 2.0.3.1025
    MapleStory
    Maximus
    Microsoft .NET Framework 4 Client Profile
    Microsoft .NET Framework 4 Extended
    Microsoft Corporation
    Microsoft LifeCam
    Microsoft Office Access MUI (English) 2010
    Microsoft Office Access Setup Metadata MUI (English) 2010
    Microsoft Office Excel MUI (English) 2010
    Microsoft Office Groove MUI (English) 2010
    Microsoft Office InfoPath MUI (English) 2010
    Microsoft Office Office 32-bit Components 2010
    Microsoft Office OneNote MUI (English) 2010
    Microsoft Office Outlook MUI (English) 2010
    Microsoft Office PowerPoint MUI (English) 2010
    Microsoft Office Professional Plus 2010
    Microsoft Office Proof (English) 2010
    Microsoft Office Proof (French) 2010
    Microsoft Office Proof (Spanish) 2010
    Microsoft Office Proofing (English) 2010
    Microsoft Office Publisher MUI (English) 2010
    Microsoft Office Shared 32-bit MUI (English) 2010
    Microsoft Office Shared MUI (English) 2010
    Microsoft Office Shared Setup Metadata MUI (English) 2010
    Microsoft Office Word MUI (English) 2010
    Microsoft Silverlight
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Visual C++ 2005 Redistributable (x64)
    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
    Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219
    Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
    Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030
    Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.51106
    Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.61030
    Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.61030
    Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.51106
    Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.51106
    Microsoft XNA Framework Redistributable 4.0
    Microsoft_VC80_CRT_x86
    Microsoft_VC90_CRT_x86
    MiKTeX 2.9
    mIRC
    Morphine
    Mozilla Firefox 30.0 (x86 en-US)
    Mozilla Maintenance Service
    Mp3tag v2.63
    MSI Afterburner 2.3.1
    MSVCRT Redists
    MSXML 4.0 SP3 Parser
    MultiBit 0.5.16
    MuseScore 1.3
    Native Instruments Massive
    Native Instruments Service Center
    Natural Selection 2
    Nexon Game Manager
    Nuance PaperPort 12
    Nuance PDF Viewer Plus
    NVIDIA 3D Vision Controller Driver 344.46
    NVIDIA 3D Vision Driver 344.60
    NVIDIA Control Panel 344.60
    NVIDIA GeForce Experience 2.1.2
    NVIDIA GeForce Experience Service
    NVIDIA Graphics Driver 344.60
    NVIDIA HD Audio Driver 1.3.32.1
    NVIDIA Install Application
    NVIDIA LED Visualizer 1.0
    NVIDIA Network Service
    NVIDIA Optimus Update 10.11.15
    NVIDIA PhysX
    NVIDIA PhysX System Software 9.14.0702
    NVIDIA ShadowPlay 16.13.42
    NVIDIA Stereoscopic 3D Driver
    NVIDIA Update 16.13.42
    NVIDIA Update Core
    NVIDIA Virtual Audio 1.2.25
    NyxLauncherIS
    Origin
    ORION: Dino Horde
    PaperPort Image Printer 64-bit
    Path of Exile
    PDF Settings CS6
    PSUCalc
    PunkBuster Services
    Python 3.3.3 (64-bit)
    Ragnarok
    Razer Synapse 2.0
    Realtek Ethernet Controller Driver
    Realtek High Definition Audio Driver
    reFX Slayer Demo 2.6.0
    Robocraft
    RocketDock 1.3.5
    Rust
    Samsung Kies
    SAMSUNG USB Driver for Mobile Phones
    Scansoft PDF Professional
    SHIELD Streaming
    SHIELD Wireless Controller Driver
    Skype™ 6.21
    Sony Mobile Update Engine
    Sony PC Companion 2.10.228
    Steam
    Strife
    Team Fortress Classic
    TeamSpeak 3 Client
    TechPowerUp GPU-Z
    TeXstudio 2.5.2
    TikiOne Steam Cleaner
    Unity Web Player
    Universe Gamers Gunz
    Unlocker 1.9.2
    Unturned
    Vegas Pro 13.0 (64-bit)
    Video Mover
    VirtualCloneDrive
    VLC media player
    Winamp
    Wing IDE 101 4.1.13-1
    WinRAR 4.20 (64-bit)
    WinX HD Video Converter Deluxe 5.0.7
    XFast LAN v6.61
    XFastUSB
    ZIP Password Unlocker
    .
    ==== Event Viewer Messages From Past Week ========
    .
    12/11/2014 4:02:32 PM, Error: Microsoft-Windows-DistributedCOM [10016] - The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID {C97FCC79-E628-407D-AE68-A06AD6D8B4D1} and APPID {344ED43D-D086-4961-86A6-1106F4ACAD9B} to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.
    12/11/2014 4:01:31 PM, Error: Service Control Manager [7000] - The Hotspot Shield Service service failed to start due to the following error: The system cannot find the file specified.
    12/11/2014 4:01:31 PM, Error: Service Control Manager [7000] - The Hotspot Shield Monitoring Service service failed to start due to the following error: The system cannot find the file specified.
    11/11/2014 4:36:46 AM, Error: Service Control Manager [7034] - The Office Software Protection Platform service terminated unexpectedly. It has done this 1 time(s).
    11/11/2014 4:36:46 AM, Error: Service Control Manager [7034] - The NVIDIA Stereoscopic 3D Driver Service service terminated unexpectedly. It has done this 1 time(s).
    11/11/2014 4:36:46 AM, Error: Service Control Manager [7034] - The NVIDIA Display Driver Service service terminated unexpectedly. It has done this 1 time(s).
    11/11/2014 4:36:46 AM, Error: Service Control Manager [7034] - The Intel(R) Rapid Storage Technology service terminated unexpectedly. It has done this 1 time(s).
    11/11/2014 4:36:46 AM, Error: Service Control Manager [7034] - The Intel(R) ME Service service terminated unexpectedly. It has done this 1 time(s).
    11/11/2014 4:36:46 AM, Error: Service Control Manager [7034] - The Intel(R) Management and Security Application User Notification Service service terminated unexpectedly. It has done this 1 time(s).
    11/11/2014 4:36:46 AM, Error: Service Control Manager [7031] - The Windows Media Player Network Sharing Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 30000 milliseconds: Restart the service.
    11/11/2014 4:36:46 AM, Error: Service Control Manager [7031] - The Windows Installer service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
    11/11/2014 4:36:46 AM, Error: Service Control Manager [7031] - The Kaspersky Anti-Virus Service 15.0.0 service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 10000 milliseconds: Restart the service.
    11/11/2014 4:36:46 AM, Error: Service Control Manager [7031] - The Intel(R) Management and Security Application Local Management Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 10000 milliseconds: Restart the service.
    11/11/2014 4:36:45 AM, Error: Service Control Manager [7034] - The PnkBstrA service terminated unexpectedly. It has done this 1 time(s).
    11/11/2014 4:36:45 AM, Error: Service Control Manager [7034] - The PDFProFiltSrvPP service terminated unexpectedly. It has done this 1 time(s).
    11/11/2014 4:36:45 AM, Error: Service Control Manager [7034] - The NVIDIA Streamer Service service terminated unexpectedly. It has done this 1 time(s).
    11/11/2014 4:36:45 AM, Error: Service Control Manager [7034] - The NVIDIA Network Service service terminated unexpectedly. It has done this 1 time(s).
    11/11/2014 4:36:45 AM, Error: Service Control Manager [7034] - The NVIDIA GeForce Experience Service service terminated unexpectedly. It has done this 1 time(s).
    11/11/2014 4:36:45 AM, Error: Service Control Manager [7034] - The MSCamSvc service terminated unexpectedly. It has done this 1 time(s).
    11/11/2014 4:36:45 AM, Error: Service Control Manager [7034] - The Intel(R) Dynamic Application Loader Host Interface Service service terminated unexpectedly. It has done this 1 time(s).
    11/11/2014 4:36:45 AM, Error: Service Control Manager [7034] - The Hotspot Shield Monitoring Service service terminated unexpectedly. It has done this 1 time(s).
    11/11/2014 4:36:45 AM, Error: Service Control Manager [7034] - The Evolve Service service terminated unexpectedly. It has done this 1 time(s).
    11/11/2014 4:36:45 AM, Error: Service Control Manager [7034] - The cFosSpeed System Service service terminated unexpectedly. It has done this 1 time(s).
    11/11/2014 4:36:45 AM, Error: Service Control Manager [7034] - The Belkin Network USB Helper service terminated unexpectedly. It has done this 1 time(s).
    11/11/2014 4:36:45 AM, Error: Service Control Manager [7034] - The Belkin Local Backup Service service terminated unexpectedly. It has done this 1 time(s).
    11/11/2014 4:36:45 AM, Error: Service Control Manager [7034] - The AffinegyService service terminated unexpectedly. It has done this 1 time(s).
    11/11/2014 4:36:45 AM, Error: Service Control Manager [7031] - The Windows Search service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 30000 milliseconds: Restart the service.
    11/11/2014 4:36:45 AM, Error: Service Control Manager [7031] - The Print Spooler service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
    11/11/2014 4:36:45 AM, Error: Service Control Manager [7031] - The ISCT Always Updated Agent service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 5000 milliseconds: Restart the service.
    11/11/2014 4:36:45 AM, Error: Service Control Manager [7031] - The Intel(R) Capability Licensing Service Interface service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 0 milliseconds: Restart the service.
    11/11/2014 4:36:45 AM, Error: Service Control Manager [7031] - The Hotspot Shield Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 0 milliseconds: Restart the service.
    10/11/2014 1:34:20 AM, Error: volsnap [36] - The shadow copies of volume E: were aborted because the shadow copy storage could not grow due to a user imposed limit.
    .
    ==== End Of File ===========================
     
  6. cokeguy

    cokeguy TS Rookie Topic Starter Posts: 21

    DDS (Ver_2012-11-20.01) - NTFS_AMD64
    Internet Explorer: 8.0.7600.16385 BrowserJavaVersion: 10.71.2
    Run by Calvin at 19:12:47 on 2014-11-12
    Microsoft Windows 7 Ultimate 6.1.7600.0.1252.2.1033.18.8074.3248 [GMT -5:00]
    .
    AV: Kaspersky Anti-Virus *Enabled/Updated* {179979E8-273D-D14E-0543-2861940E4886}
    AV: avast! Antivirus *Enabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}
    SP: Kaspersky Anti-Virus *Enabled/Updated* {ACF8980C-0107-DEC0-3FF3-1313EF89023B}
    SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    SP: avast! Antivirus *Enabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
    .
    ============== Running Processes ===============
    .
    E:\Windows\system32\lsm.exe
    E:\Windows\system32\svchost.exe -k DcomLaunch
    E:\Windows\system32\nvvsvc.exe
    E:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
    E:\Windows\system32\svchost.exe -k RPCSS
    E:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    E:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    E:\Windows\system32\svchost.exe -k netsvcs
    E:\Windows\system32\svchost.exe -k LocalService
    E:\Windows\system32\svchost.exe -k NetworkService
    E:\Windows\System32\spoolsv.exe
    E:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    E:\Program Files (x86)\Belkin\Router Setup and Monitor\BelkinService.exe
    E:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
    E:\Windows\system32\nvvsvc.exe
    E:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\avp.exe
    E:\Program Files\Belkin\Belkin USB Print and Storage Center\BkBackupScheduler.exe
    E:\Program Files\Belkin\Belkin USB Print and Storage Center\Bkapcs.exe
    E:\Program Files\ASRock\XFast LAN\spd.exe
    E:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
    E:\Program Files\Intel\iCLS Client\HeciServer.exe
    E:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe
    E:\Windows\system32\taskhost.exe
    E:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
    E:\Program Files\Microsoft LifeCam\MSCamS64.exe
    E:\Windows\system32\Dwm.exe
    E:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
    E:\Windows\Explorer.EXE
    E:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
    E:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe
    E:\Windows\SysWOW64\PnkBstrA.exe
    E:\Windows\system32\svchost.exe -k imgsvc
    E:\Windows\system32\svchost.exe -k bthsvcs
    E:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
    E:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
    E:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\avpui.exe
    E:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
    E:\Windows\System32\rundll32.exe
    E:\Windows\System32\igfxpers.exe
    E:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
    E:\Program Files\ASRock\XFast LAN\cfosspeed.exe
    E:\Program Files\Logitech Gaming Software\LCore.exe
    E:\Program Files\Echobit\Evolve\EvolveClient.exe
    E:\Users\Calvin\AppData\Local\FluxSoftware\Flux\flux.exe
    E:\Users\Calvin\AppData\Roaming\uTorrent\uTorrent.exe
    E:\Program Files (x86)\RocketDock\RocketDock.exe
    E:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    E:\Program Files (x86)\Samsung\Kies\Kies.exe
    E:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe
    E:\Windows\System32\StikyNot.exe
    E:\Program Files (x86)\Skype\Phone\Skype.exe
    E:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe
    E:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    E:\Users\Calvin\AppData\Roaming\Dropbox\bin\Dropbox.exe
    E:\Program Files (x86)\Sony\Sony PC Companion\PCCompanionInfo.exe
    E:\Program Files (x86)\Steam\Steam.exe
    E:\Program Files (x86)\FAHClient\FAHClient.exe
    E:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
    E:\Program Files (x86)\XFastUSB\XFastUsb.exe
    E:\Program Files (x86)\Razer\Synapse\RzSynapse.exe
    C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
    E:\Windows\system32\SearchIndexer.exe
    E:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
    E:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
    E:\Program Files (x86)\Belkin\Router Setup and Monitor\BelkinRouterMonitor.exe
    E:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe
    E:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    E:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    E:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    E:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    E:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    E:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    E:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    E:\Program Files (x86)\Nuance\PDF Viewer Plus\pdfPro5Hook.exe
    E:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    E:\Program Files\Echobit\Evolve\EvoSvc.exe
    E:\Windows\SysWOW64\cmd.exe
    E:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
    E:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\plugin-nm-server.exe
    E:\Program Files (x86)\Steam\bin\steamwebhelper.exe
    E:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\klwtblfs.exe
    E:\Program Files\Belkin\Belkin USB Print and Storage Center\connect.exe
    E:\Program Files (x86)\Belkin\Router Setup and Monitor\BelkinSetup.exe
    E:\Program Files (x86)\Belkin\Router Setup and Monitor\dlnaPlugin.exe
    E:\Program Files\Echobit\Evolve\Drivers\EvolveTracker_64.exe
    E:\Program Files\NVIDIA Corporation\Display\nvtray.exe
    E:\Program Files\Windows Media Player\wmpnetwk.exe
    E:\Windows\System32\svchost.exe -k LocalServicePeerNet
    E:\Windows\system32\wbem\wmiprvse.exe
    E:\Program Files\Echobit\Evolve\EvolveUI.exe
    E:\Program Files (x86)\Steam\bin\steamwebhelper.exe
    E:\Program Files\Echobit\Evolve\EvolveUI.exe
    E:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
    E:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    E:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
    E:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
    E:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
    E:\Windows\System32\svchost.exe -k secsvcs
    E:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
    E:\Program Files (x86)\Winamp\winamp.exe
    E:\Program Files (x86)\Last.fm\Last.fm Scrobbler.exe
    E:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    E:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    E:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    E:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    E:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    E:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    E:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    E:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
    E:\Windows\System32\svchost.exe -k swprv
    E:\Program Files\AVAST Software\Avast\AvastSvc.exe
    E:\Windows\system32\wbem\wmiprvse.exe
    E:\Program Files\AVAST Software\Avast\avastUi.exe
    E:\Windows\system32\wbem\unsecapp.exe
    E:\Program Files\AVAST Software\Avast\ng\ngservice.exe
    E:\Windows\system32\vssvc.exe
    E:\Windows\system32\SearchProtocolHost.exe
    E:\Windows\system32\SearchFilterHost.exe
    E:\Windows\system32\taskeng.exe
    E:\Windows\system32\NOTEPAD.EXE
    E:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe
    E:\Windows\System32\cscript.exe
    .
    ============== Pseudo HJT Report ===============
    .
    uProxyServer = 179.43.143.126:8089
    mWinlogon: Userinit = userinit.exe,
    BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - E:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    BHO: PlusIEEventHelper Class: {551A852F-39A6-44A7-9C13-AFBEC9185A9D} - E:\Program Files (x86)\Nuance\PDF Viewer Plus\bin\PlusIEContextMenu.dll
    BHO: Content Blocker Plugin: {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - E:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll
    BHO: Virtual Keyboard Plugin: {73455575-E40C-433C-9784-C78DC7761455} - E:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll
    BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Program Files (x86)\Java\jre7\bin\ssv.dll
    BHO: avast! Online Security: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - E:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
    BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - E:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL
    BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - E:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
    BHO: URL Advisor Plugin: {E33CF602-D945-461A-83F0-819F76A199F8} - E:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\IEExt\UrlAdvisor\klwtbbho.dll
    uRun: [ASRockXTU] <no file>
    mRun: [IAStorIcon] E:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIconLaunch.exe "E:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" 60
    mRun: [USB3MON] "E:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe"
    mRun: [XFastUSB] "E:\Program Files (x86)\XFastUSB\XFastUsb.exe"
    mRun: [Razer Synapse] "E:\Program Files (x86)\Razer\Synapse\RzSynapse.exe"
    mRun: [VirtualCloneDrive] "C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s
    mRun: [SwitchBoard] E:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
    mRun: [AdobeCS6ServiceManager] "E:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" -launchedbylogin
    mRun: [LifeCam] "E:\Program Files (x86)\Microsoft LifeCam\LifeExp.exe"
    mRun: [KiesTrayAgent] E:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
    mRun: [Adobe Reader Speed Launcher] "E:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
    mRun: [Adobe ARM] "E:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
    mRun: [InstaLAN] "E:\Program Files (x86)\Belkin\Router Setup and Monitor\BelkinRouterMonitor.exe" startup
    mRun: [IndexSearch] "E:\Program Files (x86)\Nuance\PaperPort\IndexSearch.exe"
    mRun: [PaperPort PTD] "E:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe"
    mRun: [PPort12reminder] "E:\Program Files (x86)\Nuance\PaperPort\Ereg\Ereg.exe" -r "E:\ProgramData\ScanSoft\PaperPort\12\Config\Ereg\Ereg.ini"
    mRun: [PDFHook] E:\Program Files (x86)\Nuance\PDF Viewer Plus\pdfpro5hook.exe
    mRun: [PDF5 Registry Controller] E:\Program Files (x86)\Nuance\PDF Viewer Plus\RegistryController.exe
    mRun: [SunJavaUpdateSched] "E:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
    mRun: [AvastUI.exe] "E:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui
    mRunOnce: [Malwarebytes Anti-Malware (cleanup)] "E:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware\mbamdor.exe" "E:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware"
    StartupFolder: E:\Users\Calvin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Dropbox.lnk - E:\Users\Calvin\AppData\Roaming\Dropbox\bin\Dropbox.exe
    StartupFolder: E:\Users\Calvin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\FOLDIN~1.LNK - E:\Program Files (x86)\FAHClient\HideConsole.exe
    StartupFolder: E:\Users\Calvin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Steam.lnk - E:\Program Files (x86)\Steam\Steam.exe
    mPolicies-Explorer: NoActiveDesktop = dword:1
    mPolicies-Explorer: NoActiveDesktopChanges = dword:1
    mPolicies-System: ConsentPromptBehaviorAdmin = dword:0
    mPolicies-System: ConsentPromptBehaviorUser = dword:3
    mPolicies-System: EnableLUA = dword:0
    mPolicies-System: EnableUIADesktopToggle = dword:0
    mPolicies-System: PromptOnSecureDesktop = dword:0
    mPolicies-System: SoftwareSASGeneration = dword:1
    IE: E&xport to Microsoft Excel - C:\PROGRA~1\MICROS~2\Office14\EXCEL.EXE/3000
    IE: Open with PDF Viewer Plus - E:\Program Files (x86)\Nuance\PDF Viewer Plus\Bin\PlusIEContextMenu.dll/PlusIEContextMenu.htm
    IE: {0C4CC089-D306-440D-9772-464E226F6539} - {0BA14598-4178-4CE5-B1F1-B5C6408A3F2E} - E:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll
    IE: {CCF151D8-D089-449F-A5A4-D9909053F20F} - {CCF151D8-D089-449F-A5A4-D9909053F20F} - E:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\IEExt\UrlAdvisor\klwtbbho.dll
    TCP: NameServer = 192.168.2.1
    TCP: Interfaces\{5E8F097A-AB4B-4823-9A78-FCB586AF8F71} : DHCPNameServer = 8.8.8.8
    TCP: Interfaces\{88C4E110-D93B-41F6-9AEA-39F1A7BF6F5B} : DHCPNameServer = 192.168.2.1
    TCP: Interfaces\{E3907387-68D1-4B88-84B8-14B415789DBC} : DHCPNameServer = 192.168.42.129
    Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - E:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
    Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - E:\Program Files (x86)\Common Files\Skype\Skype4COM.dll
    SSODL: WebCheck - <orphaned>
    mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "E:\Program Files (x86)\Google\Chrome\Application\38.0.2125.111\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome
    x64-BHO: Content Blocker Plugin: {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - E:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll
    x64-BHO: Virtual Keyboard Plugin: {73455575-E40C-433C-9784-C78DC7761455} - E:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll
    x64-BHO: avast! Online Security: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - E:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll
    x64-BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL
    x64-BHO: URL Advisor Plugin: {E33CF602-D945-461A-83F0-819F76A199F8} - E:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\x64\IEExt\UrlAdvisor\klwtbbho.dll
    x64-Run: [IgfxTray] E:\Windows\System32\igfxtray.exe
    x64-Run: [HotKeysCmds] E:\Windows\System32\hkcmd.exe
    x64-Run: [Persistence] E:\Windows\System32\igfxpers.exe
    x64-Run: [RTHDVCPL] E:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s
    x64-Run: [XFast LAN] E:\Program Files\ASRock\XFast LAN\cFosSpeed.exe
    x64-Run: [NvBackend] "E:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe"
    x64-Run: [ShadowPlay] E:\Windows\System32\rundll32.exe E:\Windows\System32\nvspcap64.dll,ShadowPlayOnSystemStart
    x64-Run: [AdobeAAMUpdater-1.0] "E:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"
    x64-Run: [Launch LCore] E:\Program Files\Logitech Gaming Software\LCore.exe /minimized
    x64-IE: {0C4CC089-D306-440D-9772-464E226F6539} - {0BA14598-4178-4CE5-B1F1-B5C6408A3F2E} - E:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll
    x64-IE: {CCF151D8-D089-449F-A5A4-D9909053F20F} - {CCF151D8-D089-449F-A5A4-D9909053F20F} - E:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\x64\IEExt\UrlAdvisor\klwtbbho.dll
    x64-Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - E:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
    x64-Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - <orphaned>
    x64-Notify: igfxcui - igfxdev.dll
    x64-SSODL: WebCheck - <orphaned>
    .
    ================= FIREFOX ===================
    .
    FF - ProfilePath - E:\Users\Calvin\AppData\Roaming\Mozilla\Firefox\Profiles\thb1obiy.default\
    FF - plugin: D:\Game\SoftnyxGame\NyxLauncherIS\npSoftnyx.dll
    FF - plugin: E:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL
    FF - plugin: E:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL
    FF - plugin: E:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll
    FF - plugin: E:\Program Files (x86)\Battlelog Web Plugins\2.4.0\npbattlelog.dll
    FF - plugin: E:\Program Files (x86)\Battlelog Web Plugins\2.5.1\npbattlelog.dll
    FF - plugin: E:\Program Files (x86)\Battlelog Web Plugins\2.5.1\npbattlelogx64.dll
    FF - plugin: E:\Program Files (x86)\Google\Update\1.3.25.5\npGoogleUpdate3.dll
    FF - plugin: E:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll
    FF - plugin: E:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll
    FF - plugin: E:\Program Files (x86)\Java\jre7\bin\dtplugin\npdeployJava1.dll
    FF - plugin: E:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll
    FF - plugin: E:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrlui.dll
    FF - plugin: E:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll
    FF - plugin: E:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll
    FF - plugin: E:\ProgramData\NexonUS\NGM\npNxGameUS.dll
    FF - plugin: E:\Users\Calvin\AppData\Local\Google\Update\1.3.25.5\npGoogleUpdate3.dll
    FF - plugin: E:\Users\Calvin\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll
    FF - plugin: E:\Users\Calvin\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll
    FF - plugin: E:\Users\Calvin\AppData\Roaming\Mozilla\plugins\npo1d.dll
    FF - plugin: E:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll
    .
    ============= SERVICES / DRIVERS ===============
    .
    R0 AsrRamDisk;AsrRamDisk;E:\Windows\System32\drivers\AsrRamDisk.sys [2013-12-17 31016]
    R0 aswVmm;avast! VM Monitor;E:\Windows\System32\drivers\aswVmm.sys [2014-11-12 267632]
    R0 iusb3hcs;Intel(R) USB 3.0 Host Controller Switch Driver;E:\Windows\System32\drivers\iusb3hcs.sys [2013-12-17 19264]
    R1 aswSnx;aswSnx;E:\Windows\System32\drivers\aswSnx.sys [2014-11-12 1050432]
    R1 FNETURPX;FNETURPX;E:\Windows\System32\drivers\FNETURPX.SYS [2013-12-17 15936]
    R1 HssDRV6;Hotspot Shield Routing Driver 6;E:\Windows\System32\drivers\hssdrv6.sys [2014-8-4 44744]
    R1 klhk;klhk;E:\Windows\System32\drivers\klhk.sys [2014-11-7 243808]
    R1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;E:\Windows\System32\drivers\klim6.sys [2014-2-25 30304]
    R1 klpd;klpd;E:\Windows\System32\drivers\klpd.sys [2013-4-12 15456]
    R1 kltdi;kltdi;E:\Windows\System32\drivers\kltdi.sys [2014-3-25 55904]
    R1 kneps;kneps;E:\Windows\System32\drivers\kneps.sys [2014-3-26 179296]
    R2 aswHwid;avast! HardwareID;E:\Windows\System32\drivers\aswHwid.sys [2014-11-12 29208]
    R2 aswMonFlt;aswMonFlt;E:\Windows\System32\drivers\aswMonFlt.sys [2014-11-12 83280]
    R2 aswStm;aswStm;E:\Windows\System32\drivers\aswStm.sys [2014-11-12 116728]
    R2 avast! Antivirus;avast! Antivirus;E:\Program Files\AVAST Software\Avast\AvastSvc.exe [2014-11-12 50344]
    R2 AVP15.0.0;Kaspersky Anti-Virus Service 15.0.0;E:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\avp.exe [2014-4-20 233552]
    R2 Belkin Local Backup Service;Belkin Local Backup Service;E:\Program Files\Belkin\Belkin USB Print and Storage Center\BkBackupScheduler.exe [2014-3-20 181760]
    R2 Belkin Network USB Helper;Belkin Network USB Helper;E:\Program Files\Belkin\Belkin USB Print and Storage Center\Bkapcs.exe [2014-3-20 55296]
    R2 GfExperienceService;NVIDIA GeForce Experience Service;E:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [2014-9-20 1148744]
    R2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;E:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2013-12-17 13632]
    R2 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface;E:\Program Files\Intel\iCLS Client\HeciServer.exe [2012-4-20 635104]
    R2 Intel(R) ME Service;Intel(R) ME Service;E:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [2013-12-17 129856]
    R2 ISCTAgent;ISCT Always Updated Agent;E:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe [2012-2-9 133632]
    R2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service;E:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe [2013-12-17 166720]
    R2 NvNetworkService;NVIDIA Network Service;E:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [2013-12-17 1795912]
    R2 NvStreamSvc;NVIDIA Streamer Service;E:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [2013-12-17 19439944]
    R2 PDFProFiltSrvPP;PDFProFiltSrvPP;E:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe [2010-3-8 144672]
    R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;E:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2014-11-10 411968]
    R2 sxuptp;SXUPTP Driver;E:\Windows\System32\drivers\sxuptp.sys [2014-3-20 291352]
    R2 UNS;Intel(R) Management and Security Application User Notification Service;E:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2013-12-17 365376]
    R2 VBoxAswDrv;VBoxAsw Support Driver;E:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [2014-11-12 271752]
    R3 AvastVBoxSvc;AvastVBox COM Service;E:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe [2014-11-12 4012248]
    R3 EvoSvc;Evolve Service;E:\Program Files\Echobit\Evolve\EvoSvc.exe [2013-12-17 1579936]
    R3 IntcDAud;Intel(R) Display Audio;E:\Windows\System32\drivers\IntcDAud.sys [2013-12-17 331264]
    R3 ISCT;Intel(R) Smart Connect Technology Device Driver;E:\Windows\System32\drivers\ISCTD64.sys [2012-2-9 44992]
    R3 iusb3hub;Intel(R) USB 3.0 Hub Driver;E:\Windows\System32\drivers\iusb3hub.sys [2013-12-17 357184]
    R3 iusb3xhc;Intel(R) USB 3.0 eXtensible Host Controller Driver;E:\Windows\System32\drivers\iusb3xhc.sys [2013-12-17 789824]
    R3 klflt;Kaspersky Lab Kernel DLL;E:\Windows\System32\drivers\klflt.sys [2014-11-7 141320]
    R3 klkbdflt;Kaspersky Lab KLKBDFLT;E:\Windows\System32\drivers\klkbdflt.sys [2014-3-28 28768]
    R3 klmouflt;Kaspersky Lab KLMOUFLT;E:\Windows\System32\drivers\klmouflt.sys [2013-8-8 29280]
    R3 LGBusEnum;Logitech GamePanel Virtual Bus Enumerator Driver;E:\Windows\System32\drivers\LGBusEnum.sys [2009-11-23 22408]
    R3 LGSHidFilt;Logitech Gaming KMDF HID Filter Driver;E:\Windows\System32\drivers\LGSHidFilt.Sys [2013-5-30 64280]
    R3 LGVirHid;Logitech Gamepanel Virtual HID Device Driver;E:\Windows\System32\drivers\LGVirHid.sys [2009-11-23 16008]
    R3 MBAMSwissArmy;MBAMSwissArmy;E:\Windows\System32\drivers\MBAMSwissArmy.sys [2014-8-16 129752]
    R3 MBfilt;MBfilt;E:\Windows\System32\drivers\MBfilt64.sys [2013-12-17 32344]
    R3 MSHUSBVideo;NX6000/NX3000/VX2000/VX5000/VX5500/VX7000/Cinema Filter Driver;E:\Windows\System32\drivers\nx6000.sys [2010-12-13 36720]
    R3 NvStreamKms;NvStreamKms;E:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [2014-5-14 19272]
    R3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM);E:\Windows\System32\drivers\nvvad64v.sys [2014-9-20 38048]
    R3 RTL8167;Realtek 8167 NT Driver;E:\Windows\System32\drivers\Rt64win7.sys [2013-12-17 565352]
    R3 rzendpt;rzendpt;E:\Windows\System32\drivers\rzendpt.sys [2013-11-15 39080]
    R3 rzudd;Razer Mouse Driver;E:\Windows\System32\drivers\rzudd.sys [2013-11-15 149160]
    R3 taphss6;Anchorfree HSS VPN Adapter;E:\Windows\System32\drivers\taphss6.sys [2014-5-16 42184]
    R3 WPRO_41_2001;WinPcap Packet Driver (WPRO_41_2001);E:\Windows\System32\drivers\WPRO_41_2001.sys [2013-12-17 34752]
    RUnknown xddhlscx;xddhlscx; [x]
    S0 aswRvrt;avast! Revert;E:\Windows\System32\drivers\aswRvrt.sys [2014-11-12 65776]
    S1 aswSP;aswSP;E:\Windows\System32\drivers\aswSP.sys [2014-11-12 436624]
    S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;E:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
    S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;E:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
    S2 hshld;Hotspot Shield Service;E:\Program Files (x86)\Hotspot Shield\bin\cmw_srv.exe --> E:\Program Files (x86)\Hotspot Shield\bin\cmw_srv.exe [?]
    S2 HssWd;Hotspot Shield Monitoring Service;E:\Program Files (x86)\Hotspot Shield\bin\hsswd.exe --> E:\Program Files (x86)\Hotspot Shield\bin\hsswd.exe [?]
    S2 SkypeUpdate;Skype Updater;E:\Program Files (x86)\Skype\Updater\Updater.exe [2014-4-3 315008]
    S3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);E:\Windows\System32\drivers\ssudbus.sys [2014-1-13 103576]
    S3 FNETTBOH_305;FNETTBOH_305;E:\Windows\System32\drivers\FNETTBOH_305.SYS [2014-1-5 32320]
    S3 ggflt;SOMC USB Flash Driver Filter;E:\Windows\System32\drivers\ggflt.sys [2014-7-28 16088]
    S3 ggsomc;SOMC USB Flash Driver;E:\Windows\System32\drivers\ggsomc.sys [2014-7-28 30424]
    S3 GunBod;GunBod;D:\Game\SoftnyxGame\GunboundIS\avital\gunbod64.sys [2014-7-27 86352]
    S3 iumsvc;Intel(R) Update Manager;E:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [2014-2-28 174368]
    S3 Origin Client Service;Origin Client Service;C:\Program Files (x86)\Origin\OriginClientService.exe [2014-3-8 1900400]
    S3 ose64;Office 64 Source Engine;E:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-1-9 174440]
    S3 Sony PC Companion;Sony PC Companion;E:\Program Files (x86)\Sony\Sony PC Companion\PCCService.exe [2014-3-15 155824]
    S3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);E:\Windows\System32\drivers\ssudmdm.sys [2014-1-13 204568]
    S3 SwitchBoard;Adobe SwitchBoard;E:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-2-19 517096]
    S3 WSDScan;WSD Scan Support via UMB;E:\Windows\System32\drivers\WSDScan.sys [2009-7-13 25088]
    .
    =============== Created Last 30 ================
    .
    2014-11-13 00:05:58 -------- d-----w- E:\Program Files\AVAST Software
    2014-11-13 00:04:54 -------- d-----w- E:\ProgramData\AVAST Software
    2014-11-12 20:12:42 71344 ----a-w- E:\Windows\SysWow64\FlashPlayerCPLApp.cpl
    2014-11-12 20:12:42 701104 ----a-w- E:\Windows\SysWow64\FlashPlayerApp.exe
    2014-11-12 06:54:32 -------- d-----w- E:\Program Files (x86)\CDisplay
    2014-11-11 09:35:34 -------- d-----w- E:\AdwCleaner
    2014-11-10 06:35:55 614728 ----a-w- E:\Windows\SysWow64\nvStreaming.exe
    2014-11-07 06:44:03 110176 ----a-w- E:\Windows\System32\klfphc.dll
    2014-11-07 06:43:57 -------- d-----w- E:\Windows\ELAMBKUP
    2014-11-07 06:43:57 -------- d-----w- E:\ProgramData\Kaspersky Lab
    2014-11-07 06:43:57 -------- d-----w- E:\Program Files (x86)\Kaspersky Lab
    2014-11-07 06:43:54 243808 ----a-w- E:\Windows\System32\drivers\klhk.sys
    2014-11-07 06:43:54 141320 ----a-w- E:\Windows\System32\drivers\klflt.sys
    2014-10-23 20:53:25 -------- d-----r- E:\Users\Calvin\AppData\Roaming\Brother
    2014-10-23 16:12:55 2558792 ----a-w- E:\Windows\System32\nvsvcr.dll
    2014-10-23 16:12:08 1876296 ----a-w- E:\Windows\System32\nvdispco6434448.dll
    2014-10-23 16:12:08 1539272 ----a-w- E:\Windows\System32\nvdispgenco6434448.dll
    2014-10-18 23:55:17 -------- d-----w- E:\Users\Calvin\AppData\Roaming\Cycling '74
    2014-10-18 23:44:57 -------- d-----w- E:\Users\Calvin\AppData\Roaming\FLEXnet
    .
    ==================== Find3M ====================
    .
    2014-11-13 00:06:15 116728 ----a-w- E:\Windows\System32\drivers\aswStm.sys
    2014-11-13 00:06:14 93568 ----a-w- E:\Windows\System32\drivers\aswRdr2.sys
    2014-11-13 00:06:14 83280 ----a-w- E:\Windows\System32\drivers\aswMonFlt.sys
    2014-11-13 00:06:14 65776 ----a-w- E:\Windows\System32\drivers\aswRvrt.sys
    2014-11-13 00:06:14 43152 ----a-w- E:\Windows\avastSS.scr
    2014-11-13 00:06:14 29208 ----a-w- E:\Windows\System32\drivers\aswHwid.sys
    2014-11-13 00:06:14 267632 ----a-w- E:\Windows\System32\drivers\aswVmm.sys
    2014-11-13 00:06:12 1050432 ----a-w- E:\Windows\System32\drivers\aswSnx.sys
    2014-11-13 00:05:16 129752 ----a-w- E:\Windows\System32\drivers\MBAMSwissArmy.sys
    2014-11-12 21:01:32 94656 ----a-w- E:\Windows\System32\WPRO_41_2001woem.tmp
    2014-11-12 21:01:32 34752 ----a-w- E:\Windows\System32\drivers\WPRO_41_2001.sys
    2014-10-30 02:10:36 6880968 ----a-w- E:\Windows\System32\nvcpl.dll
    2014-10-30 02:10:36 3533632 ----a-w- E:\Windows\System32\nvsvc64.dll
    2014-10-30 02:10:34 935232 ----a-w- E:\Windows\System32\nvvsvc.exe
    2014-10-30 02:10:34 61640 ----a-w- E:\Windows\System32\nvshext.dll
    2014-10-30 02:10:33 385352 ----a-w- E:\Windows\System32\nvmctray.dll
    2014-10-27 00:34:52 4066553 ----a-w- E:\Windows\System32\nvcoproc.bin
    2014-10-08 20:35:15 32320 ----a-w- E:\Windows\System32\drivers\FNETTBOH_305.SYS
    2014-10-01 16:11:26 63704 ----a-w- E:\Windows\System32\drivers\mwac.sys
    2014-10-01 16:11:16 93400 ----a-w- E:\Windows\System32\drivers\mbamchameleon.sys
    2014-10-01 16:11:12 25816 ----a-w- E:\Windows\System32\drivers\mbam.sys
    2014-09-26 22:42:22 98216 ----a-w- E:\Windows\SysWow64\WindowsAccessBridge-32.dll
    2014-09-17 04:51:20 31520 ----a-w- E:\Windows\System32\nvhdap64.dll
    2014-09-17 04:51:20 197408 ----a-w- E:\Windows\System32\drivers\nvhda64v.sys
    2014-09-17 04:51:20 1538880 ----a-w- E:\Windows\System32\nvhdagenco6420103.dll
    2014-09-17 02:13:36 2193560 ----a-w- E:\Windows\SysWow64\nvspcap.dll
    2014-09-17 02:13:36 1291280 ----a-w- E:\Windows\SysWow64\nvspbridge.dll
    2014-09-17 02:12:40 2799784 ----a-w- E:\Windows\System32\nvspcap64.dll
    2014-09-17 02:12:39 1715224 ----a-w- E:\Windows\System32\nvspbridge64.dll
    2014-09-13 23:48:03 1876296 ----a-w- E:\Windows\System32\nvdispco6434411.dll
    2014-09-13 23:48:03 1539272 ----a-w- E:\Windows\System32\nvdispgenco6434411.dll
    2014-09-13 09:11:21 297088 ----a-w- E:\Windows\SysWow64\PnkBstrB.xtr
    2014-09-13 09:11:21 297088 ----a-w- E:\Windows\SysWow64\PnkBstrB.exe
    2014-09-13 09:11:01 280904 ----a-w- E:\Windows\SysWow64\PnkBstrB.ex0
    2014-09-04 19:14:38 38048 ----a-w- E:\Windows\System32\drivers\nvvad64v.sys
    2014-09-04 19:14:38 34976 ----a-w- E:\Windows\System32\nvaudcap64v.dll
    2014-09-04 19:14:38 32416 ----a-w- E:\Windows\SysWow64\nvaudcap32v.dll
    2014-08-21 17:22:03 18960 ----a-w- E:\Windows\System32\drivers\LNonPnP.sys
    2013-12-17 23:43:18 4188160 ----a-w- E:\Program Files (x86)\GUT686.tmp
    .
    ============= FINISH: 19:13:07.39 ===============
     
  7. Broni

    Broni Malware Annihilator Posts: 52,892   +344

    [​IMG] You're running two AV programs, Kaspersky and Avast.
    You must uninstall one of them.

    [​IMG] Download RogueKiller from one of the following links and save it to your Desktop:

    Link 1
    Link 2

    • Close all the running programs
    • Windows Vista/7/8 users: right click on RogueKiller.exe, click Run as Administrator
    • Otherwise just double-click on RogueKiller.exe
    • Pre-scan will start. Let it finish.
    • Click on SCAN button.
    • Wait until the Status box shows Scan Finished
    • Click on Delete.
    • Wait until the Status box shows Deleting Finished.
    • Click on Report and copy/paste the content of the Notepad into your next reply.
    • RKreport.txt could also be found on your desktop.
    • If more than one log is produced post all logs.
    • If RogueKiller has been blocked, do not hesitate to try a few times more. If really won't run, rename it to winlogon.exe (or winlogon.com) and try again

    [​IMG] Create new restore point before proceeding with the next step....
    How to: http://www.smartestcomputing.us.com/topic/63983-how-to-create-new-restore-point-all-windows/

    Download [​IMG] Malwarebytes Anti-Rootkit to your desktop.
    • Warning! Malwarebytes Anti-Rootkit needs to be run from an account with administrator rights.
    • Double click on downloaded file. OK self extracting prompt.
    • MBAR will start. Click "Next" to continue.
    • Click in the following screen "Update" to obtain the latest malware definitions.
    • Once the update is complete select "Next" and click "Scan".
    • When the scan is finished and no malware has been found select "Exit".
    • If malware was detected, make sure to check all the items and click "Cleanup". Reboot your computer.
    • Open the MBAR folder located on your Desktop and paste the content of the following files in your next reply:
      • "mbar-log-{date} (xx-xx-xx).txt"
      • "system-log.txt"
     
  8. cokeguy

    cokeguy TS Rookie Topic Starter Posts: 21

    Oh, I didn't know Kaspersky was an AV, I use it for scan. Gonna uninstall Avast now right after installing it.

    RogueKiller V10.0.4.0 [Oct 29 2014] by Adlice Software
    mail : http://www.adlice.com/contact/
    Feedback : http://forum.adlice.com
    Website : http://www.adlice.com/softwares/roguekiller/
    Blog : http://www.adlice.com

    Operating System : Windows 7 (6.1.7600 ) 64 bits version
    Started in : Normal mode
    User : Calvin [Administrator]
    Mode : Delete -- Date : 11/12/2014 19:24:58

    ¤¤¤ Processes : 0 ¤¤¤

    ¤¤¤ Registry : 18 ¤¤¤
    [PUP] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\hshld (E:\Program Files (x86)\Hotspot Shield\bin\cmw_srv.exe) -> Not selected
    [PUP] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\HssTrayService (E:\Program Files (x86)\Hotspot Shield\bin\HssTrayService.EXE) -> Not selected
    [PUP] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\HssWd (E:\Program Files (x86)\Hotspot Shield\bin\hsswd.exe) -> Not selected
    [Hidden.From.SCM] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\UnlockerDriver5 (\??\E:\Program Files\Unlocker\UnlockerDriver5.sys) -> Not selected
    [PUP] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\hshld (E:\Program Files (x86)\Hotspot Shield\bin\cmw_srv.exe) -> Not selected
    [PUP] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\HssTrayService (E:\Program Files (x86)\Hotspot Shield\bin\HssTrayService.EXE) -> Not selected
    [PUP] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\HssWd (E:\Program Files (x86)\Hotspot Shield\bin\hsswd.exe) -> Not selected
    [PUP] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\hshld (E:\Program Files (x86)\Hotspot Shield\bin\cmw_srv.exe) -> Not selected
    [PUP] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\HssTrayService (E:\Program Files (x86)\Hotspot Shield\bin\HssTrayService.EXE) -> Not selected
    [PUP] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\HssWd (E:\Program Files (x86)\Hotspot Shield\bin\hsswd.exe) -> Not selected
    [PUM.Proxy] (X64) HKEY_USERS\S-1-5-21-1199268278-559096122-390045334-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyServer : 179.43.143.126:8089 -> Not selected
    [PUM.Proxy] (X86) HKEY_USERS\S-1-5-21-1199268278-559096122-390045334-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyServer : 179.43.143.126:8089 -> Not selected
    [PUM.Policies] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System | ConsentPromptBehaviorAdmin : 0 -> Not selected
    [PUM.Policies] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System | ConsentPromptBehaviorAdmin : 0 -> Not selected
    [PUM.DesktopIcons] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> Not selected
    [PUM.DesktopIcons] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1 -> Not selected
    [PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> Not selected
    [PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1 -> Not selected

    ¤¤¤ Tasks : 0 ¤¤¤

    ¤¤¤ Files : 0 ¤¤¤

    ¤¤¤ Hosts File : 0 ¤¤¤

    ¤¤¤ Antirootkit : 0 (Driver: Not loaded [0xc000036b]) ¤¤¤

    ¤¤¤ Web browsers : 1 ¤¤¤
    [PUP][FIREFX:Addon] thb1obiy.default : Hotspot Shield Extension [afproxy@anchorfree.com] -> Not selected

    ¤¤¤ MBR Check : ¤¤¤
    +++++ PhysicalDrive0: +++++
    --- User ---
    [MBR] 146bc81598019e0f9557f53f056d66f3
    [BSP] fa18ef80d527e13b3ecfb1511cb0333c : Windows Vista/7/8 MBR Code
    Partition table:
    0 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 122102 MB
    User = LL1 ... OK
    User = LL2 ... OK

    +++++ PhysicalDrive1: +++++
    --- User ---
    [MBR] 88ed92496ab2b0f72414a976b27ae451
    [BSP] dc740e2d54a18bd3c4d542757b327be5 : Windows Vista/7/8 MBR Code
    Partition table:
    0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 1907727 MB
    User = LL1 ... OK
    User = LL2 ... OK

    +++++ PhysicalDrive2: +++++
    --- User ---
    [MBR] 44871ad4c0b1c6f686c8e2112ac2388c
    [BSP] 8c0f2f607a9a5d12744cd65d0dd8d28a : Windows XP MBR Code
    Partition table:
    0 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 63 | Size: 305245 MB
    User = LL1 ... OK
    User = LL2 ... OK


    ============================================
    RKreport_SCN_11122014_192411.log
     
  9. cokeguy

    cokeguy TS Rookie Topic Starter Posts: 21

    Malwarebytes Anti-Rootkit BETA 1.08.1.1001
    www.malwarebytes.org

    Database version: v2014.11.13.01

    Windows 7 x64 NTFS
    Internet Explorer 8.0.7600.16385
    Calvin :: 420YOLOSWAGGER [administrator]

    12/11/2014 7:28:16 PM
    mbar-log-2014-11-12 (19-28-16).txt

    Scan type: Quick scan
    Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
    Scan options disabled:
    Objects scanned: 331363
    Time elapsed: 3 minute(s), 53 second(s)

    Memory Processes Detected: 0
    (No malicious items detected)

    Memory Modules Detected: 0
    (No malicious items detected)

    Registry Keys Detected: 0
    (No malicious items detected)

    Registry Values Detected: 0
    (No malicious items detected)

    Registry Data Items Detected: 0
    (No malicious items detected)

    Folders Detected: 0
    (No malicious items detected)

    Files Detected: 0
    (No malicious items detected)

    Physical Sectors Detected: 0
    (No malicious items detected)

    (end)


    ---------------------------------------
    Malwarebytes Anti-Rootkit BETA 1.08.1.1001

    (c) Malwarebytes Corporation 2011-2012

    OS version: 6.1.7600 Windows 7 x64

    Account is Administrative

    Internet Explorer version: 8.0.7600.16385

    File system is: NTFS
    Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED, E:\ DRIVE_FIXED
    CPU speed: 3.400000 GHz
    Memory total: 8465821696, free: 2588626944

    Downloaded database version: v2014.11.13.01
    Downloaded database version: v2014.11.12.01
    =======================================
    Initializing...
    ------------ Kernel report ------------
    11/12/2014 19:28:10
    ------------ Loaded modules -----------
    \SystemRoot\system32\ntoskrnl.exe
    \SystemRoot\system32\hal.dll
    \SystemRoot\system32\kdcom.dll
    \SystemRoot\system32\mcupdate_GenuineIntel.dll
    \SystemRoot\system32\PSHED.dll
    \SystemRoot\system32\CLFS.SYS
    \SystemRoot\system32\CI.dll
    \SystemRoot\system32\drivers\Wdf01000.sys
    \SystemRoot\system32\drivers\WDFLDR.SYS
    \SystemRoot\system32\DRIVERS\kl1.sys
    \SystemRoot\system32\DRIVERS\ACPI.sys
    \SystemRoot\system32\DRIVERS\WMILIB.SYS
    \SystemRoot\system32\DRIVERS\msisadrv.sys
    \SystemRoot\system32\DRIVERS\pci.sys
    \SystemRoot\system32\DRIVERS\vdrvroot.sys
    \SystemRoot\system32\DRIVERS\iusb3hcs.sys
    \SystemRoot\System32\drivers\partmgr.sys
    \SystemRoot\system32\DRIVERS\volmgr.sys
    \SystemRoot\System32\drivers\volmgrx.sys
    \SystemRoot\System32\drivers\mountmgr.sys
    \SystemRoot\system32\DRIVERS\iaStor.sys
    \SystemRoot\system32\DRIVERS\atapi.sys
    \SystemRoot\system32\DRIVERS\ataport.SYS
    \SystemRoot\system32\DRIVERS\msahci.sys
    \SystemRoot\system32\DRIVERS\PCIIDEX.SYS
    \SystemRoot\system32\DRIVERS\AsrRamDisk.sys
    \SystemRoot\system32\DRIVERS\storport.sys
    \SystemRoot\system32\DRIVERS\amdxata.sys
    \SystemRoot\system32\drivers\fltmgr.sys
    \SystemRoot\system32\drivers\fileinfo.sys
    \SystemRoot\System32\Drivers\Ntfs.sys
    \SystemRoot\System32\Drivers\msrpc.sys
    \SystemRoot\System32\Drivers\ksecdd.sys
    \SystemRoot\System32\Drivers\cng.sys
    \SystemRoot\System32\drivers\pcw.sys
    \SystemRoot\System32\Drivers\Fs_Rec.sys
    \SystemRoot\system32\drivers\ndis.sys
    \SystemRoot\system32\drivers\NETIO.SYS
    \SystemRoot\System32\Drivers\ksecpkg.sys
    \SystemRoot\System32\drivers\tcpip.sys
    \SystemRoot\System32\drivers\fwpkclnt.sys
    \SystemRoot\system32\DRIVERS\vmstorfl.sys
    \SystemRoot\system32\DRIVERS\volsnap.sys
    \SystemRoot\System32\Drivers\spldr.sys
    \SystemRoot\System32\drivers\rdyboost.sys
    \SystemRoot\System32\Drivers\mup.sys
    \SystemRoot\System32\drivers\hwpolicy.sys
    \SystemRoot\System32\DRIVERS\fvevol.sys
    \SystemRoot\system32\DRIVERS\disk.sys
    \SystemRoot\system32\DRIVERS\CLASSPNP.SYS
    \SystemRoot\system32\DRIVERS\cdrom.sys
    \SystemRoot\system32\DRIVERS\klif.sys
    \SystemRoot\system32\DRIVERS\klflt.sys
    \SystemRoot\system32\DRIVERS\klhk.sys
    \SystemRoot\system32\DRIVERS\ks.sys
    \SystemRoot\System32\Drivers\Null.SYS
    \SystemRoot\System32\Drivers\Beep.SYS
    \SystemRoot\System32\drivers\FNETURPX.SYS
    \SystemRoot\System32\drivers\vga.sys
    \SystemRoot\System32\drivers\VIDEOPRT.SYS
    \SystemRoot\System32\drivers\watchdog.sys
    \SystemRoot\System32\DRIVERS\RDPCDD.sys
    \SystemRoot\system32\drivers\rdpencdd.sys
    \SystemRoot\system32\drivers\rdprefmp.sys
    \SystemRoot\System32\Drivers\Msfs.SYS
    \SystemRoot\System32\Drivers\Npfs.SYS
    \SystemRoot\system32\DRIVERS\tdx.sys
    \SystemRoot\system32\DRIVERS\TDI.SYS
    \SystemRoot\system32\DRIVERS\kltdi.sys
    \SystemRoot\system32\drivers\afd.sys
    \SystemRoot\System32\DRIVERS\netbt.sys
    \SystemRoot\system32\DRIVERS\wfplwf.sys
    \SystemRoot\system32\DRIVERS\pacer.sys
    \SystemRoot\system32\DRIVERS\cfosspeed6.sys
    \SystemRoot\system32\DRIVERS\hssdrv6.sys
    \SystemRoot\system32\DRIVERS\klim6.sys
    \SystemRoot\system32\DRIVERS\netbios.sys
    \SystemRoot\system32\DRIVERS\serial.sys
    \SystemRoot\system32\DRIVERS\wanarp.sys
    \SystemRoot\system32\DRIVERS\termdd.sys
    \SystemRoot\system32\DRIVERS\rdbss.sys
    \SystemRoot\system32\drivers\nsiproxy.sys
    \SystemRoot\system32\DRIVERS\mssmbios.sys
    \SystemRoot\system32\DRIVERS\kneps.sys
    \SystemRoot\system32\DRIVERS\klpd.sys
    \SystemRoot\System32\Drivers\ElbyCDIO.sys
    \SystemRoot\System32\drivers\discache.sys
    \SystemRoot\system32\drivers\csc.sys
    \SystemRoot\System32\Drivers\dfsc.sys
    \SystemRoot\system32\DRIVERS\blbdrive.sys
    \SystemRoot\system32\DRIVERS\tunnel.sys
    \SystemRoot\system32\DRIVERS\nvlddmkm.sys
    \SystemRoot\System32\drivers\dxgkrnl.sys
    \SystemRoot\System32\drivers\dxgmms1.sys
    \SystemRoot\system32\DRIVERS\HDAudBus.sys
    \SystemRoot\system32\DRIVERS\igdkmd64.sys
    \SystemRoot\system32\DRIVERS\iusb3xhc.sys
    \SystemRoot\system32\DRIVERS\USBD.SYS
    \SystemRoot\system32\DRIVERS\HECIx64.sys
    \SystemRoot\system32\DRIVERS\usbehci.sys
    \SystemRoot\system32\DRIVERS\USBPORT.SYS
    \SystemRoot\system32\DRIVERS\Rt64win7.sys
    \SystemRoot\system32\DRIVERS\serenum.sys
    \SystemRoot\system32\DRIVERS\wmiacpi.sys
    \SystemRoot\system32\DRIVERS\intelppm.sys
    \SystemRoot\system32\DRIVERS\ISCTD64.sys
    \SystemRoot\system32\DRIVERS\CompositeBus.sys
    \SystemRoot\system32\DRIVERS\AgileVpn.sys
    \SystemRoot\system32\DRIVERS\rasl2tp.sys
    \SystemRoot\system32\DRIVERS\ndistapi.sys
    \SystemRoot\system32\DRIVERS\ndiswan.sys
    \SystemRoot\system32\DRIVERS\raspppoe.sys
    \SystemRoot\system32\DRIVERS\raspptp.sys
    \SystemRoot\system32\DRIVERS\rassstp.sys
    \SystemRoot\system32\DRIVERS\taphss6.sys
    \SystemRoot\system32\DRIVERS\rdpbus.sys
    \SystemRoot\system32\DRIVERS\kbdclass.sys
    \SystemRoot\system32\DRIVERS\mouclass.sys
    \SystemRoot\system32\DRIVERS\VClone.sys
    \SystemRoot\system32\DRIVERS\SCSIPORT.SYS
    \SystemRoot\system32\DRIVERS\swenum.sys
    \SystemRoot\system32\DRIVERS\sxuptp.sys
    \SystemRoot\system32\drivers\LGBusEnum.sys
    \SystemRoot\system32\DRIVERS\umbus.sys
    \SystemRoot\system32\drivers\nvvad64v.sys
    \SystemRoot\system32\drivers\portcls.sys
    \SystemRoot\system32\drivers\drmk.sys
    \SystemRoot\system32\drivers\ksthunk.sys
    \SystemRoot\system32\DRIVERS\usbhub.sys
    \SystemRoot\System32\Drivers\NDProxy.SYS
    \SystemRoot\system32\drivers\nvhda64v.sys
    \SystemRoot\system32\DRIVERS\iusb3hub.sys
    \SystemRoot\system32\drivers\RTKVHD64.sys
    \SystemRoot\system32\drivers\MBfilt64.sys
    \SystemRoot\system32\DRIVERS\IntcDAud.sys
    \SystemRoot\system32\DRIVERS\usbccgp.sys
    \SystemRoot\system32\DRIVERS\hidusb.sys
    \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
    \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
    \SystemRoot\system32\DRIVERS\LGSHidFilt.Sys
    \SystemRoot\system32\DRIVERS\mouhid.sys
    \SystemRoot\system32\DRIVERS\klmouflt.sys
    \SystemRoot\system32\DRIVERS\kbdhid.sys
    \SystemRoot\system32\DRIVERS\klkbdflt.sys
    \SystemRoot\system32\DRIVERS\rzendpt.sys
    \SystemRoot\system32\DRIVERS\rzudd.sys
    \SystemRoot\System32\Drivers\BTHUSB.sys
    \SystemRoot\System32\Drivers\bthport.sys
    \SystemRoot\system32\drivers\usbaudio.sys
    \SystemRoot\system32\DRIVERS\rfcomm.sys
    \SystemRoot\system32\DRIVERS\BthEnum.sys
    \SystemRoot\system32\DRIVERS\bthpan.sys
    \SystemRoot\system32\DRIVERS\hidbth.sys
    \SystemRoot\System32\Drivers\nx6000.sys
    \SystemRoot\System32\win32k.sys
    \SystemRoot\System32\drivers\Dxapi.sys
    \SystemRoot\System32\Drivers\usbvideo.sys
    \SystemRoot\System32\Drivers\crashdmp.sys
    \SystemRoot\System32\Drivers\dump_iaStor.sys
    \SystemRoot\System32\Drivers\dump_dumpfve.sys
    \SystemRoot\system32\DRIVERS\monitor.sys
    \SystemRoot\System32\TSDDD.dll
    \SystemRoot\System32\cdd.dll
    \SystemRoot\System32\ATMFD.DLL
    \SystemRoot\system32\drivers\luafv.sys
    \SystemRoot\system32\drivers\WudfPf.sys
    \SystemRoot\system32\DRIVERS\lltdio.sys
    \SystemRoot\system32\DRIVERS\nwifi.sys
    \SystemRoot\system32\DRIVERS\ndisuio.sys
    \SystemRoot\system32\DRIVERS\rspndr.sys
    \SystemRoot\system32\drivers\HTTP.sys
    \SystemRoot\system32\DRIVERS\bowser.sys
    \SystemRoot\System32\drivers\mpsdrv.sys
    \SystemRoot\system32\DRIVERS\mrxsmb.sys
    \SystemRoot\system32\DRIVERS\mrxsmb10.sys
    \SystemRoot\system32\DRIVERS\mrxsmb20.sys
    \SystemRoot\system32\drivers\peauth.sys
    \SystemRoot\System32\Drivers\secdrv.SYS
    \SystemRoot\System32\DRIVERS\srvnet.sys
    \SystemRoot\System32\drivers\tcpipreg.sys
    \SystemRoot\System32\DRIVERS\srv2.sys
    \SystemRoot\System32\DRIVERS\srv.sys
    \SystemRoot\system32\drivers\WPRO_41_2001.sys
    \??\E:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys
    \SystemRoot\system32\drivers\LGVirHid.sys
    \SystemRoot\System32\Drivers\xddhlscx.SYS
    \SystemRoot\System32\Drivers\aswVmm.SYS
    \SystemRoot\system32\drivers\aswSnx.sys
    \SystemRoot\system32\drivers\aswRdr2.sys
    \SystemRoot\system32\drivers\aswMonFlt.sys
    \SystemRoot\system32\DRIVERS\WinUsb.sys
    \SystemRoot\system32\DRIVERS\WUDFRd.sys
    \??\E:\Windows\system32\drivers\mbamchameleon.sys
    \??\E:\Windows\system32\drivers\MBAMSwissArmy.sys
    \Windows\System32\ntdll.dll
    \Windows\System32\smss.exe
    \Windows\System32\apisetschema.dll
    \Windows\System32\autochk.exe
    \Windows\System32\normaliz.dll
    \Windows\System32\usp10.dll
    \Windows\System32\comdlg32.dll
    \Windows\System32\ws2_32.dll
    \Windows\System32\msctf.dll
    \Windows\System32\rpcrt4.dll
    \Windows\System32\difxapi.dll
    \Windows\System32\Wldap32.dll
    \Windows\System32\user32.dll
    \Windows\System32\psapi.dll
    \Windows\System32\advapi32.dll
    \Windows\System32\sechost.dll
    \Windows\System32\nsi.dll
    \Windows\System32\imagehlp.dll
    \Windows\System32\wininet.dll
    \Windows\System32\msvcrt.dll
    \Windows\System32\imm32.dll
    \Windows\System32\clbcatq.dll
    \Windows\System32\kernel32.dll
    \Windows\System32\ole32.dll
    \Windows\System32\gdi32.dll
    \Windows\System32\urlmon.dll
    \Windows\System32\iertutil.dll
    \Windows\System32\setupapi.dll
    \Windows\System32\oleaut32.dll
    \Windows\System32\shlwapi.dll
    \Windows\System32\shell32.dll
    \Windows\System32\lpk.dll
    \Windows\System32\cfgmgr32.dll
    \Windows\System32\comctl32.dll
    \Windows\System32\devobj.dll
    \Windows\System32\KernelBase.dll
    \Windows\System32\crypt32.dll
    \Windows\System32\wintrust.dll
    \Windows\System32\msasn1.dll
    \Windows\SysWOW64\normaliz.dll
    ----------- End -----------
    Done!
    <<<1>>>
    Upper Device Name: \Device\Harddisk2\DR2
    Upper Device Object: 0xfffffa800a0d1060
    Upper Device Driver Name: \Driver\Disk\
    Lower Device Name: \Device\Ide\IAAStorageDevice-3\
    Lower Device Object: 0xfffffa80076f7050
    Lower Device Driver Name: \Driver\iaStor\
    <<<1>>>
    Upper Device Name: \Device\Harddisk1\DR1
    Upper Device Object: 0xfffffa800a0d0060
    Upper Device Driver Name: \Driver\Disk\
    Lower Device Name: \Device\Ide\IAAStorageDevice-2\
    Lower Device Object: 0xfffffa80076f1050
    Lower Device Driver Name: \Driver\iaStor\
    <<<1>>>
    Upper Device Name: \Device\Harddisk0\DR0
    Upper Device Object: 0xfffffa800a0cf060
    Upper Device Driver Name: \Driver\Disk\
    Lower Device Name: \Device\Ide\IAAStorageDevice-1\
    Lower Device Object: 0xfffffa80076f3050
    Lower Device Driver Name: \Driver\iaStor\
    <<<2>>>
    Physical Sector Size: 512
    Drive: 0, DevicePointer: 0xfffffa800a0cf060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
    --------- Disk Stack ------
    DevicePointer: 0xfffffa800a0cfb90, DeviceName: Unknown, DriverName: \Driver\partmgr\
    DevicePointer: 0xfffffa800a0cf060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
    DevicePointer: 0xfffffa80076eb240, DeviceName: Unknown, DriverName: \Driver\ACPI\
    DevicePointer: 0xfffffa80076f3050, DeviceName: \Device\Ide\IAAStorageDevice-1\, DriverName: \Driver\iaStor\
    ------------ End ----------
    Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
    Upper DeviceData: 0x0, 0x0, 0x0
    Lower DeviceData: 0x0, 0x0, 0x0
    <<<3>>>
    Volume: E:
    File system type: NTFS
    SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
    <<<2>>>
    <<<3>>>
    Volume: E:
    File system type: NTFS
    SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
    Scanning drivers directory: E:\WINDOWS\SYSTEM32\drivers...
    Done!
    Drive 0
    This is a System drive
    Scanning MBR on drive 0...
    Inspecting partition table:
    MBR Signature: 55AA
    Disk Signature: 94918886

    Partition information:

    Partition 0 type is Primary (0x7)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 2048 Numsec = 250064896

    Partition 1 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0 Numsec = 0

    Partition 2 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0 Numsec = 0

    Partition 3 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0 Numsec = 0

    Disk Size: 128035676160 bytes
    Sector size: 512 bytes

    Done!
    Physical Sector Size: 512
    Drive: 1, DevicePointer: 0xfffffa800a0d0060, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\
    --------- Disk Stack ------
    DevicePointer: 0xfffffa800a0d0b90, DeviceName: Unknown, DriverName: \Driver\partmgr\
    DevicePointer: 0xfffffa800a0d0060, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\
    DevicePointer: 0xfffffa80076f0e40, DeviceName: Unknown, DriverName: \Driver\ACPI\
    DevicePointer: 0xfffffa80076f1050, DeviceName: \Device\Ide\IAAStorageDevice-2\, DriverName: \Driver\iaStor\
    ------------ End ----------
    Alternate DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\
    Upper DeviceData: 0x0, 0x0, 0x0
    Lower DeviceData: 0x0, 0x0, 0x0
    Drive 1
    Scanning MBR on drive 1...
    Inspecting partition table:
    MBR Signature: 55AA
    Disk Signature: 9307F35D

    Partition information:

    Partition 0 type is Primary (0x7)
    Partition is ACTIVE.
    Partition starts at LBA: 2048 Numsec = 3907024896
    Partition file system is NTFS
    Partition is bootable

    Partition 1 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0 Numsec = 0

    Partition 2 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0 Numsec = 0

    Partition 3 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0 Numsec = 0

    Disk Size: 2000398934016 bytes
    Sector size: 512 bytes

    Done!
    Physical Sector Size: 512
    Drive: 2, DevicePointer: 0xfffffa800a0d1060, DeviceName: \Device\Harddisk2\DR2\, DriverName: \Driver\Disk\
    --------- Disk Stack ------
    DevicePointer: 0xfffffa800a0d1b90, DeviceName: Unknown, DriverName: \Driver\partmgr\
    DevicePointer: 0xfffffa800a0d1060, DeviceName: \Device\Harddisk2\DR2\, DriverName: \Driver\Disk\
    DevicePointer: 0xfffffa8006d1b040, DeviceName: Unknown, DriverName: \Driver\ACPI\
    DevicePointer: 0xfffffa80076f7050, DeviceName: \Device\Ide\IAAStorageDevice-3\, DriverName: \Driver\iaStor\
    ------------ End ----------
    Alternate DeviceName: \Device\Harddisk2\DR2\, DriverName: \Driver\Disk\
    Upper DeviceData: 0x0, 0x0, 0x0
    Lower DeviceData: 0x0, 0x0, 0x0
    Drive 2
    Scanning MBR on drive 2...
    Inspecting partition table:
    MBR Signature: 55AA
    Disk Signature: 4DFDDF

    Partition information:

    Partition 0 type is Primary (0x7)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 63 Numsec = 625142385

    Partition 1 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0 Numsec = 0

    Partition 2 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0 Numsec = 0

    Partition 3 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0 Numsec = 0

    Disk Size: 320072933376 bytes
    Sector size: 512 bytes

    Done!
    Infected file E:\Users\Calvin\AppData\Local\Temp\is1070216317\408884394_stp\wajam_validate.exe could not be remediated because backup file is not available
    Scan finished
    =======================================


    Removal queue found; removal started
    Removing E:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-0-I.mbam...
    Removing E:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-0-r.mbam...
    Removing E:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-1-I.mbam...
    Removing E:\ProgramData\Malwarebytes' Anti-Malware (portable)\VBR-1-0-2048-I.mbam...
    Removing E:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-1-r.mbam...
    Removing E:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-2-I.mbam...
    Removing E:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-2-r.mbam...
    Removing E:\ProgramData\Malwarebytes' Anti-Malware (portable)\wajam_validate.exe-k.mbam...
    Removing E:\ProgramData\Malwarebytes' Anti-Malware (portable)\wajam_validate.exe-u.mbam...
    Removing E:\ProgramData\Malwarebytes' Anti-Malware (portable)\wajam_validate.exe-r.mbam...
    Removal finished
     
  10. Broni

    Broni Malware Annihilator Posts: 52,892   +344

    Please download ComboFix from Here, Here or Here to your Desktop.

    **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
    • Never rename Combofix unless instructed.
    • Close any open browsers.
    • Very Important! Temporarily disable your anti-virus and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
    • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
    • Close any open browsers.
    • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
    • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
    • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
      If the connection is not there use restore point you created prior to running Combofix.
    • Double click on combofix.exe & follow the prompts.

    • NOTE1. If Combofix asks you to install Recovery Console, please allow it.
      NOTE 2. If Combofix asks you to update the program, always do so.
    • When finished, it will produce a report for you.
    • Please post the "C:\ComboFix.txt"
    **Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
    **Note 2 for AVG and CA Internet Security (Total Defense Internet Security) users: ComboFix will not run until AVG/CA Internet Security is uninstalled as a protective measure against the anti-virus. This is because AVG/CA Internet Security "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG/CA Internet Security cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG/CA Internet Security first.
    Use AppRemover to uninstall it: http://www.appremover.com/
    We can reinstall it when we're done with CF.
    **Note 3: If you receive an error Illegal operation attempted on a registery key that has been marked for deletion, restart computer to fix the issue.
    **Note 4: Some infections may take some significant time to be cured. As long as your computer clock is running Combofix is still working. Be patient.


    Make sure, you re-enable your security programs, when you're done with Combofix.

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    NOTE.
    If, for some reason, Combofix refuses to run, try the following...

    Delete Combofix file, download fresh one, but rename combofix.exe to your_name.exe BEFORE saving it to your desktop.
    Do NOT run it yet.
    Download Rkill (courtesy of BleepingComputer.com) to your desktop.
    There are 2 different versions. If one of them won't run then download and try to run the other one.
    You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

    rKill.exe: http://www.bleepingcomputer.com/download/rkill/dl/10/
    iExplore.exe (renamed rKill.exe): http://www.bleepingcomputer.com/download/rkill/dl/11/

    Restart computer in safe mode

    • Double-click on the Rkill desktop icon to run the tool.
    • If using Vista or Windows 7 right-click on it and choose Run As Administrator.
    • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
    • If not, delete the file, then download and use the one provided in Link 2.
    • Do not reboot until instructed.
    • If the tool does not run from any of the links provided, please let me know.

    When the scan is done Notepad will open with rKill.txt log.
    NOTE. rKill.txt log will also be present on your desktop.

    Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

    IF you had to run rKill post BOTH logs, rKill.txt and Combofix.txt.
     
  11. cokeguy

    cokeguy TS Rookie Topic Starter Posts: 21

    Been waiting for combofix to finish preparing the log report for maybe 15 minutes now, is this normal?
     
  12. Broni

    Broni Malware Annihilator Posts: 52,892   +344

    Yes. Be patient.
     
  13. cokeguy

    cokeguy TS Rookie Topic Starter Posts: 21

    Haha got scared it might be broken, will report back in a few hours if it doesn't finish before I leave. Will you be here then?
     
  14. Broni

    Broni Malware Annihilator Posts: 52,892   +344

    I'll be around for few more hours.
     
  15. cokeguy

    cokeguy TS Rookie Topic Starter Posts: 21

    I'm leaving soon, hopefully I can get another step done. Here is the combofix log.

    ComboFix 14-11-12.01 - Calvin 12/11/2014 19:37:44.1.4 - x64
    Microsoft Windows 7 Ultimate 6.1.7600.0.1252.2.1033.18.8074.3410 [GMT -5:00]
    Running from: E:\Users\Calvin\Downloads\ComboFix.exe
    AV: Kaspersky Anti-Virus *Disabled/Updated* {179979E8-273D-D14E-0543-2861940E4886}
    SP: Kaspersky Anti-Virus *Disabled/Updated* {ACF8980C-0107-DEC0-3FF3-1313EF89023B}
    SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}


    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


    E:\Users\Calvin\AppData\Local\Temp\AFF1.tmp\F_IN_BOX.dll
    E:\Users\Calvin\AppData\Roaming\mIRC\logs\status.log
    E:\Windows\isRS-000.tmp


    ((((((((((((((((((((((((( Files Created from 2014-10-13 to 2014-11-13 )))))))))))))))))))))))))))))))


    2014-11-13 00:47:45 . 2014-11-13 00:47:45 -------- d-----w- E:\Users\Default\AppData\Local\temp
    2014-11-13 00:28:10 . 2014-11-13 00:32:14 -------- d-----w- E:\ProgramData\Malwarebytes' Anti-Malware (portable)
    2014-11-13 00:20:15 . 2014-11-13 00:21:58 34808 ----a-w- E:\Windows\system32\drivers\TrueSight.sys
    2014-11-13 00:20:13 . 2014-11-13 00:20:15 -------- d-----w- E:\ProgramData\RogueKiller
    2014-11-13 00:18:51 . 2014-11-13 00:18:51 -------- d-s---w- E:\Windows\SysWow64\Microsoft
    2014-11-13 00:06:43 . 2014-11-13 00:06:43 -------- d-----w- E:\Users\Calvin\AppData\Roaming\AVAST Software
    2014-11-13 00:06:26 . 2014-11-13 00:06:31 -------- d-----w- E:\Windows\SysWow64\vbox
    2014-11-13 00:06:26 . 2014-11-13 00:06:31 -------- d-----w- E:\Windows\system32\vbox
    2014-11-13 00:06:14 . 2014-11-13 00:06:14 43152 ----a-w- E:\Windows\avastSS.scr
    2014-11-13 00:05:58 . 2014-11-13 00:05:58 -------- d-----w- E:\Program Files\AVAST Software
    2014-11-13 00:04:54 . 2014-11-13 00:05:58 -------- d-----w- E:\ProgramData\AVAST Software
    2014-11-12 20:12:42 . 2014-11-12 20:12:42 71344 ----a-w- E:\Windows\SysWow64\FlashPlayerCPLApp.cpl
    2014-11-12 20:12:42 . 2014-11-12 20:12:42 701104 ----a-w- E:\Windows\SysWow64\FlashPlayerApp.exe
    2014-11-12 06:54:32 . 2014-11-12 06:54:32 -------- d-----w- E:\Program Files (x86)\CDisplay
    2014-11-11 09:35:34 . 2014-11-11 09:36:46 -------- d-----w- E:\AdwCleaner
    2014-11-10 06:35:55 . 2014-10-30 00:56:29 614728 ----a-w- E:\Windows\SysWow64\nvStreaming.exe
    2014-11-07 06:44:03 . 2013-05-06 14:13:26 110176 ----a-w- E:\Windows\system32\klfphc.dll
    2014-11-07 06:43:57 . 2014-11-13 00:48:54 -------- d-----w- E:\ProgramData\Kaspersky Lab
    2014-11-07 06:43:57 . 2014-11-07 06:43:57 -------- d-----w- E:\Windows\ELAMBKUP
    2014-11-07 06:43:57 . 2014-11-07 06:43:57 -------- d-----w- E:\Program Files (x86)\Kaspersky Lab
    2014-11-07 06:43:54 . 2014-11-07 06:52:46 793800 ----a-w- E:\Windows\system32\drivers\klif.sys
    2014-11-07 06:43:54 . 2014-11-07 06:52:46 141320 ----a-w- E:\Windows\system32\drivers\klflt.sys
    2014-11-07 06:43:54 . 2014-04-10 22:25:34 243808 ----a-w- E:\Windows\system32\drivers\klhk.sys
    2014-10-23 20:53:25 . 2014-10-23 20:53:25 -------- d-----r- E:\Users\Calvin\AppData\Roaming\Brother
    2014-10-23 16:12:55 . 2014-10-30 02:10:34 2558792 ----a-w- E:\Windows\system32\nvsvcr.dll
    2014-10-23 16:12:08 . 2014-10-16 16:54:03 1876296 ----a-w- E:\Windows\system32\nvdispco6434448.dll
    2014-10-23 16:12:08 . 2014-10-16 16:54:03 1539272 ----a-w- E:\Windows\system32\nvdispgenco6434448.dll
    2014-10-18 23:55:17 . 2014-10-18 23:55:17 -------- d-----w- E:\Users\Calvin\AppData\Roaming\Cycling '74
    2014-10-18 23:44:57 . 2014-10-18 23:44:57 -------- d-----w- E:\Users\Calvin\AppData\Roaming\FLEXnet
    2014-10-16 16:41:36 . 2014-10-16 16:41:36 -------- d-----w- E:\Program Files (x86)\Common Files\Java
    .


    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

    2014-11-13 00:48:53 . 2014-03-08 23:24:56 94656 ----a-w- E:\Windows\system32\WPRO_41_2001woem.tmp
    2014-11-13 00:48:53 . 2013-12-17 23:43:00 34752 ----a-w- E:\Windows\system32\drivers\WPRO_41_2001.sys
    2014-11-13 00:28:10 . 2014-08-16 09:22:59 131800 ----a-w- E:\Windows\system32\drivers\MBAMSwissArmy.sys
    2014-11-13 00:27:33 . 2014-08-16 09:22:54 96472 ----a-w- E:\Windows\system32\drivers\mbamchameleon.sys
    2014-10-30 04:53:26 . 2014-06-20 21:18:13 11333848 ----a-w- E:\Windows\SysWow64\nvcuda.dll
    2014-10-30 04:53:26 . 2013-12-18 00:04:21 987008 ----a-w- E:\Windows\system32\nvumdshimx.dll
    2014-10-30 04:53:26 . 2013-12-18 00:04:15 16886168 ----a-w- E:\Windows\SysWow64\nvd3dum.dll
    2014-10-30 04:53:26 . 2013-12-18 00:04:01 3237528 ----a-w- E:\Windows\system32\nvapi64.dll
    2014-10-30 04:53:26 . 2013-12-18 00:04:00 2849224 ----a-w- E:\Windows\SysWow64\nvapi.dll
    2014-10-30 02:10:36 . 2014-01-03 00:03:56 6880968 ----a-w- E:\Windows\system32\nvcpl.dll
    2014-10-30 02:10:36 . 2014-01-03 00:03:56 3533632 ----a-w- E:\Windows\system32\nvsvc64.dll
    2014-10-30 02:10:34 . 2014-01-03 00:03:56 935232 ----a-w- E:\Windows\system32\nvvsvc.exe
    2014-10-30 02:10:34 . 2014-01-03 00:03:56 61640 ----a-w- E:\Windows\system32\nvshext.dll
    2014-10-30 02:10:33 . 2014-01-03 00:03:56 385352 ----a-w- E:\Windows\system32\nvmctray.dll
    2014-10-27 00:34:52 . 2014-01-03 00:03:56 4066553 ----a-w- E:\Windows\system32\nvcoproc.bin
    2014-10-08 20:35:15 . 2014-01-05 21:58:47 32320 ----a-w- E:\Windows\system32\drivers\FNETTBOH_305.SYS
    2014-10-01 16:11:26 . 2014-08-16 09:22:54 63704 ----a-w- E:\Windows\system32\drivers\mwac.sys
    2014-10-01 16:11:12 . 2013-12-19 02:55:34 25816 ----a-w- E:\Windows\system32\drivers\mbam.sys
    2014-09-26 22:42:22 . 2013-12-18 13:09:51 98216 ----a-w- E:\Windows\SysWow64\WindowsAccessBridge-32.dll
    2014-09-17 04:51:20 . 2014-09-20 23:28:08 31520 ----a-w- E:\Windows\system32\nvhdap64.dll
    2014-09-17 04:51:20 . 2014-09-20 23:28:08 197408 ----a-w- E:\Windows\system32\drivers\nvhda64v.sys
    2014-09-17 04:51:20 . 2014-01-31 08:17:12 1538880 ----a-w- E:\Windows\system32\nvhdagenco6420103.dll
    2014-09-17 02:13:36 . 2014-06-20 20:32:53 1291280 ----a-w- E:\Windows\SysWow64\nvspbridge.dll
    2014-09-17 02:13:36 . 2013-12-17 23:53:23 2193560 ----a-w- E:\Windows\SysWow64\nvspcap.dll
    2014-09-17 02:12:40 . 2013-12-17 23:53:23 2799784 ----a-w- E:\Windows\system32\nvspcap64.dll
    2014-09-17 02:12:39 . 2014-06-20 20:32:53 1715224 ----a-w- E:\Windows\system32\nvspbridge64.dll
    2014-09-13 23:48:03 . 2014-09-20 23:28:08 1876296 ----a-w- E:\Windows\system32\nvdispco6434411.dll
    2014-09-13 23:48:03 . 2014-09-20 23:28:08 1539272 ----a-w- E:\Windows\system32\nvdispgenco6434411.dll
    2014-09-13 09:11:21 . 2014-02-11 22:12:24 297088 ----a-w- E:\Windows\SysWow64\PnkBstrB.xtr
    2014-09-13 09:11:21 . 2014-02-11 22:03:09 297088 ----a-w- E:\Windows\SysWow64\PnkBstrB.exe
    2014-09-13 09:11:01 . 2014-02-11 22:03:09 280904 ----a-w- E:\Windows\SysWow64\PnkBstrB.ex0
    2014-09-04 19:14:38 . 2014-09-20 23:09:52 38048 ----a-w- E:\Windows\system32\drivers\nvvad64v.sys
    2014-09-04 19:14:38 . 2014-09-20 23:09:52 32416 ----a-w- E:\Windows\SysWow64\nvaudcap32v.dll
    2014-09-04 19:14:38 . 2013-12-18 00:24:15 34976 ----a-w- E:\Windows\system32\nvaudcap64v.dll
    2014-08-21 17:22:03 . 2014-08-21 17:22:03 18960 ----a-w- E:\Windows\system32\drivers\LNonPnP.sys
    2013-12-17 23:43:18 . 2013-12-17 23:43:09 4188160 ----a-w- E:\Program Files (x86)\GUT686.tmp


    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt1"]
    @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
    2014-06-24 22:04:54 131480 ----a-w- E:\Users\Calvin\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll

    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt2"]
    @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
    2014-06-24 22:04:54 131480 ----a-w- E:\Users\Calvin\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll

    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt3"]
    @="{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}]
    2014-06-24 22:04:54 131480 ----a-w- E:\Users\Calvin\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll

    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt4"]
    @="{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}]
    2014-06-24 22:04:54 131480 ----a-w- E:\Users\Calvin\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll

    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt5"]
    @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
    2014-06-24 22:04:54 131480 ----a-w- E:\Users\Calvin\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll

    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt6"]
    @="{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}]
    2014-06-24 22:04:54 131480 ----a-w- E:\Users\Calvin\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll

    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt7"]
    @="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
    2014-06-24 22:04:54 131480 ----a-w- E:\Users\Calvin\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll

    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt8"]
    @="{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}]
    2014-06-24 22:04:54 131480 ----a-w- E:\Users\Calvin\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "EvolveClient"="E:\Program Files\Echobit\Evolve\EvolveClient.exe" [2014-09-17 11:21:56 3332512]
    "f.lux"="E:\Users\Calvin\AppData\Local\FluxSoftware\Flux\flux.exe" [2013-10-23 22:39:14 1017224]
    "uTorrent"="E:\Users\Calvin\AppData\Roaming\uTorrent\uTorrent.exe" [2014-10-30 00:03:03 1385808]
    "RocketDock"="E:\Program Files (x86)\RocketDock\RocketDock.exe" [2007-09-02 18:58:52 495616]
    "KiesPreload"="E:\Program Files (x86)\Samsung\Kies\Kies.exe" [2013-12-11 23:52:04 1564528]
    "EADM"="C:\Program Files (x86)\Origin\Origin.exe" [2014-11-05 23:19:03 3618648]
    "Sony PC Companion"="E:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe" [2014-09-01 20:43:40 468192]
    "Skype"="E:\Program Files (x86)\Skype\Phone\Skype.exe" [2014-10-01 14:43:52 22065760]
    "ISUSPM"="E:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe" [2009-05-05 20:06:06 222496]
    "GoogleChromeAutoLaunch_C7B769EDBBCCE7FB80A6816B8CB269D6"="E:\Program Files (x86)\Google\Chrome\Application\chrome.exe" [2014-10-22 04:05:02 854344]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
    "IAStorIcon"="E:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIconLaunch.exe" [2012-06-07 17:18:40 56128]
    "USB3MON"="E:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe" [2012-05-20 16:26:26 291648]
    "XFastUSB"="E:\Program Files (x86)\XFastUSB\XFastUsb.exe" [2013-12-17 23:43:59 5019360]
    "Razer Synapse"="E:\Program Files (x86)\Razer\Synapse\RzSynapse.exe" [2014-03-07 17:39:00 444760]
    "VirtualCloneDrive"="C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" [2009-05-26 22:31:29 85160]
    "SwitchBoard"="E:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 18:37:14 517096]
    "AdobeCS6ServiceManager"="E:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" [2012-03-09 21:26:58 1073312]
    "LifeCam"="E:\Program Files (x86)\Microsoft LifeCam\LifeExp.exe" [2010-12-13 19:37:16 135536]
    "KiesTrayAgent"="E:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe" [2013-12-11 23:52:06 311152]
    "Adobe Reader Speed Launcher"="E:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2013-05-08 21:20:00 41056]
    "Adobe ARM"="E:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 08:36:40 958576]
    "InstaLAN"="E:\Program Files (x86)\Belkin\Router Setup and Monitor\BelkinRouterMonitor.exe" [2011-12-07 17:06:26 1884064]
    "IndexSearch"="E:\Program Files (x86)\Nuance\PaperPort\IndexSearch.exe" [2010-03-09 04:37:26 46368]
    "PaperPort PTD"="E:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe" [2010-03-09 04:42:02 29984]
    "PPort12reminder"="E:\Program Files (x86)\Nuance\PaperPort\Ereg\Ereg.exe" [2010-02-09 17:42:26 328992]
    "PDFHook"="E:\Program Files (x86)\Nuance\PDF Viewer Plus\pdfpro5hook.exe" [2010-03-06 00:11:30 636192]
    "PDF5 Registry Controller"="E:\Program Files (x86)\Nuance\PDF Viewer Plus\RegistryController.exe" [2010-03-05 23:11:04 62752]
    "SunJavaUpdateSched"="E:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" [2014-09-26 22:19:22 271744]

    E:\Users\Calvin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
    Dropbox.lnk - E:\Users\Calvin\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2014-9-12 36414624]
    Folding@home.lnk - E:\Program Files (x86)\FAHClient\HideConsole.exe E:\Program Files (x86)\FAHClient\FAHClient.exe [2013-2-18 2674688]
    Steam.lnk - E:\Program Files (x86)\Steam\Steam.exe [2013-11-26 1940160]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "ConsentPromptBehaviorAdmin"= 0 (0x0)
    "ConsentPromptBehaviorUser"= 3 (0x3)
    "EnableLUA"= 0 (0x0)
    "EnableUIADesktopToggle"= 0 (0x0)
    "PromptOnSecureDesktop"= 0 (0x0)
    "SoftwareSASGeneration"= 1 (0x1)

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
    "DisableMonitoring"=dword:00000001

    R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;E:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;E:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
    R2 hshld;Hotspot Shield Service;E:\Program Files (x86)\Hotspot Shield\bin\cmw_srv.exe;E:\Program Files (x86)\Hotspot Shield\bin\cmw_srv.exe [x]
    R2 HssWd;Hotspot Shield Monitoring Service;E:\Program Files (x86)\Hotspot Shield\bin\hsswd.exe;E:\Program Files (x86)\Hotspot Shield\bin\hsswd.exe [x]
    R2 SkypeUpdate;Skype Updater;E:\Program Files (x86)\Skype\Updater\Updater.exe;E:\Program Files (x86)\Skype\Updater\Updater.exe [x]
    R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);E:\Windows\system32\DRIVERS\ssudbus.sys;E:\Windows\SYSNATIVE\DRIVERS\ssudbus.sys [x]
    R3 EagleX64;EagleX64;E:\Windows\system32\drivers\EagleX64.sys;E:\Windows\SYSNATIVE\drivers\EagleX64.sys [x]
    R3 FNETTBOH_305;FNETTBOH_305;E:\Windows\system32\drivers\FNETTBOH_305.SYS;E:\Windows\SYSNATIVE\drivers\FNETTBOH_305.SYS [x]
    R3 ggflt;SOMC USB Flash Driver Filter;E:\Windows\system32\DRIVERS\ggflt.sys;E:\Windows\SYSNATIVE\DRIVERS\ggflt.sys [x]
    R3 ggsomc;SOMC USB Flash Driver;E:\Windows\system32\DRIVERS\ggsomc.sys;E:\Windows\SYSNATIVE\DRIVERS\ggsomc.sys [x]
    R3 GunBod;GunBod;D:\Game\SoftnyxGame\GunBoundIS\avital\gunbod64.sys;D:\Game\SoftnyxGame\GunBoundIS\avital\gunbod64.sys [x]
    R3 iumsvc;Intel(R) Update Manager;E:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe;E:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [x]
    R3 MSICDSetup;MSICDSetup;G:\CDriver64.sys;G:\CDriver64.sys [x]
    R3 Origin Client Service;Origin Client Service;C:\Program Files (x86)\Origin\OriginClientService.exe;C:\Program Files (x86)\Origin\OriginClientService.exe [x]
    R3 ose64;Office 64 Source Engine;E:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE;E:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [x]
    R3 Sony PC Companion;Sony PC Companion;E:\Program Files (x86)\Sony\Sony PC Companion\PCCService.exe;E:\Program Files (x86)\Sony\Sony PC Companion\PCCService.exe [x]
    R3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);E:\Windows\system32\DRIVERS\ssudmdm.sys;E:\Windows\SYSNATIVE\DRIVERS\ssudmdm.sys [x]
    R3 SwitchBoard;Adobe SwitchBoard;E:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe;E:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [x]
    R3 WSDScan;WSD Scan Support via UMB;E:\Windows\system32\DRIVERS\WSDScan.sys;E:\Windows\SYSNATIVE\DRIVERS\WSDScan.sys [x]
    S0 AsrRamDisk;AsrRamDisk;E:\Windows\system32\DRIVERS\AsrRamDisk.sys;E:\Windows\SYSNATIVE\DRIVERS\AsrRamDisk.sys [x]
    S0 iusb3hcs;Intel(R) USB 3.0 Host Controller Switch Driver;E:\Windows\system32\DRIVERS\iusb3hcs.sys;E:\Windows\SYSNATIVE\DRIVERS\iusb3hcs.sys [x]
    S1 FNETURPX;FNETURPX;E:\Windows\system32\drivers\FNETURPX.SYS;E:\Windows\SYSNATIVE\drivers\FNETURPX.SYS [x]
    S1 HssDRV6;Hotspot Shield Routing Driver 6;E:\Windows\system32\DRIVERS\hssdrv6.sys;E:\Windows\SYSNATIVE\DRIVERS\hssdrv6.sys [x]
    S1 klhk;klhk;E:\Windows\system32\DRIVERS\klhk.sys;E:\Windows\SYSNATIVE\DRIVERS\klhk.sys [x]
    S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;E:\Windows\system32\DRIVERS\klim6.sys;E:\Windows\SYSNATIVE\DRIVERS\klim6.sys [x]
    S1 klpd;klpd;E:\Windows\system32\DRIVERS\klpd.sys;E:\Windows\SYSNATIVE\DRIVERS\klpd.sys [x]
    S1 kltdi;kltdi;E:\Windows\system32\DRIVERS\kltdi.sys;E:\Windows\SYSNATIVE\DRIVERS\kltdi.sys [x]
    S1 kneps;kneps;E:\Windows\system32\DRIVERS\kneps.sys;E:\Windows\SYSNATIVE\DRIVERS\kneps.sys [x]
    S2 AVP15.0.0;Kaspersky Anti-Virus Service 15.0.0;E:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\avp.exe;E:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\avp.exe [x]
    S2 Belkin Local Backup Service;Belkin Local Backup Service;E:\Program Files\Belkin\Belkin USB Print and Storage Center\BkBackupScheduler.exe;E:\Program Files\Belkin\Belkin USB Print and Storage Center\BkBackupScheduler.exe [x]
    S2 Belkin Network USB Helper;Belkin Network USB Helper;E:\Program Files\Belkin\Belkin USB Print and Storage Center\Bkapcs.exe;E:\Program Files\Belkin\Belkin USB Print and Storage Center\Bkapcs.exe [x]
    S2 GfExperienceService;NVIDIA GeForce Experience Service;E:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe;E:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [x]
    S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;E:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe;E:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [x]
    S2 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface;E:\Program Files\Intel\iCLS Client\HeciServer.exe;E:\Program Files\Intel\iCLS Client\HeciServer.exe [x]
    S2 Intel(R) ME Service;Intel(R) ME Service;E:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe;E:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [x]
    S2 ISCTAgent;ISCT Always Updated Agent;E:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe;E:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe [x]
    S2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service;E:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe;E:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [x]
    S2 NvNetworkService;NVIDIA Network Service;E:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe;E:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [x]
    S2 NvStreamSvc;NVIDIA Streamer Service;E:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe;E:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [x]
    S2 PDFProFiltSrvPP;PDFProFiltSrvPP;E:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe;E:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe [x]
    S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;E:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;E:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
    S2 sxuptp;SXUPTP Driver;E:\Windows\system32\DRIVERS\sxuptp.sys;E:\Windows\SYSNATIVE\DRIVERS\sxuptp.sys [x]
    S2 UNS;Intel(R) Management and Security Application User Notification Service;E:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;E:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
    S3 EvoSvc;Evolve Service;E:\Program Files\Echobit\Evolve\EvoSvc.exe;E:\Program Files\Echobit\Evolve\EvoSvc.exe [x]
    S3 IntcDAud;Intel(R) Display Audio;E:\Windows\system32\DRIVERS\IntcDAud.sys;E:\Windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
    S3 ISCT;Intel(R) Smart Connect Technology Device Driver;E:\Windows\system32\DRIVERS\ISCTD64.sys;E:\Windows\SYSNATIVE\DRIVERS\ISCTD64.sys [x]
    S3 iusb3hub;Intel(R) USB 3.0 Hub Driver;E:\Windows\system32\DRIVERS\iusb3hub.sys;E:\Windows\SYSNATIVE\DRIVERS\iusb3hub.sys [x]
    S3 iusb3xhc;Intel(R) USB 3.0 eXtensible Host Controller Driver;E:\Windows\system32\DRIVERS\iusb3xhc.sys;E:\Windows\SYSNATIVE\DRIVERS\iusb3xhc.sys [x]
    S3 klflt;Kaspersky Lab Kernel DLL;E:\Windows\system32\DRIVERS\klflt.sys;E:\Windows\SYSNATIVE\DRIVERS\klflt.sys [x]
    S3 klkbdflt;Kaspersky Lab KLKBDFLT;E:\Windows\system32\DRIVERS\klkbdflt.sys;E:\Windows\SYSNATIVE\DRIVERS\klkbdflt.sys [x]
    S3 klmouflt;Kaspersky Lab KLMOUFLT;E:\Windows\system32\DRIVERS\klmouflt.sys;E:\Windows\SYSNATIVE\DRIVERS\klmouflt.sys [x]
    S3 LGBusEnum;Logitech GamePanel Virtual Bus Enumerator Driver;E:\Windows\system32\drivers\LGBusEnum.sys;E:\Windows\SYSNATIVE\drivers\LGBusEnum.sys [x]
    S3 LGSHidFilt;Logitech Gaming KMDF HID Filter Driver;E:\Windows\system32\DRIVERS\LGSHidFilt.Sys;E:\Windows\SYSNATIVE\DRIVERS\LGSHidFilt.Sys [x]
    S3 LGVirHid;Logitech Gamepanel Virtual HID Device Driver;E:\Windows\system32\drivers\LGVirHid.sys;E:\Windows\SYSNATIVE\drivers\LGVirHid.sys [x]
    S3 MBfilt;MBfilt;E:\Windows\system32\drivers\MBfilt64.sys;E:\Windows\SYSNATIVE\drivers\MBfilt64.sys [x]
    S3 MSHUSBVideo;NX6000/NX3000/VX2000/VX5000/VX5500/VX7000/Cinema Filter Driver;E:\Windows\system32\Drivers\nx6000.sys;E:\Windows\SYSNATIVE\Drivers\nx6000.sys [x]
    S3 NvStreamKms;NvStreamKms;E:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys;E:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [x]
    S3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM);E:\Windows\system32\drivers\nvvad64v.sys;E:\Windows\SYSNATIVE\drivers\nvvad64v.sys [x]
    S3 RTL8167;Realtek 8167 NT Driver;E:\Windows\system32\DRIVERS\Rt64win7.sys;E:\Windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
    S3 rzendpt;rzendpt;E:\Windows\system32\DRIVERS\rzendpt.sys;E:\Windows\SYSNATIVE\DRIVERS\rzendpt.sys [x]
    S3 rzudd;Razer Mouse Driver;E:\Windows\system32\DRIVERS\rzudd.sys;E:\Windows\SYSNATIVE\DRIVERS\rzudd.sys [x]
    S3 taphss6;Anchorfree HSS VPN Adapter;E:\Windows\system32\DRIVERS\taphss6.sys;E:\Windows\SYSNATIVE\DRIVERS\taphss6.sys [x]
    S3 WPRO_41_2001;WinPcap Packet Driver (WPRO_41_2001);E:\Windows\system32\drivers\WPRO_41_2001.sys;E:\Windows\SYSNATIVE\drivers\WPRO_41_2001.sys [x]


    --- Other Services/Drivers In Memory ---

    *NewlyCreated* - WS2IFSL

    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
    2014-10-27 20:20:09 1089352 ----a-w- E:\Program Files (x86)\Google\Chrome\Application\38.0.2125.111\Installer\chrmstp.exe

    Contents of the 'Scheduled Tasks' folder

    2014-11-13 E:\Windows\Tasks\Adobe Flash Player Updater.job
    - E:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-12-18 01:52:08 . 2014-11-12 20:12:42]

    2014-11-13 E:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
    - E:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-12-17 23:43:10 . 2013-12-17 23:43:09]

    2014-11-13 E:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
    - E:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-12-17 23:43:10 . 2013-12-17 23:43:09]


    --------- X64 Entries -----------


    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt1"]
    @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
    2014-06-24 22:04:54 164760 ----a-w- E:\Users\Calvin\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt2"]
    @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
    2014-06-24 22:04:54 164760 ----a-w- E:\Users\Calvin\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt3"]
    @="{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}]
    2014-06-24 22:04:54 164760 ----a-w- E:\Users\Calvin\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt4"]
    @="{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}]
    2014-06-24 22:04:54 164760 ----a-w- E:\Users\Calvin\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt5"]
    @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
    2014-06-24 22:04:54 164760 ----a-w- E:\Users\Calvin\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt6"]
    @="{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}]
    2014-06-24 22:04:54 164760 ----a-w- E:\Users\Calvin\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt7"]
    @="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
    2014-06-24 22:04:54 164760 ----a-w- E:\Users\Calvin\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt8"]
    @="{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}]
    2014-06-24 22:04:54 164760 ----a-w- E:\Users\Calvin\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "IgfxTray"="E:\Windows\system32\igfxtray.exe" [2012-05-24 07:16:46 170304]
    "HotKeysCmds"="E:\Windows\system32\hkcmd.exe" [2012-05-24 07:16:36 398656]
    "Persistence"="E:\Windows\system32\igfxpers.exe" [2012-05-24 07:16:42 440128]
    "RTHDVCPL"="E:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe" [2012-07-13 10:53:34 12936848]
    "XFast LAN"="E:\Program Files\ASRock\XFast LAN\cFosSpeed.exe" [2011-10-19 21:19:28 1441152]
    "NvBackend"="E:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe" [2014-09-17 02:15:08 2460488]
    "ShadowPlay"="E:\Windows\system32\nvspcap64.dll" [2014-09-17 02:12:40 2799784]
    "AdobeAAMUpdater-1.0"="E:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2012-04-04 10:09:46 446392]
    "Launch LCore"="E:\Program Files\Logitech Gaming Software\LCore.exe" [2014-07-28 18:22:58 10801944]

    ------- Supplementary Scan -------

    uLocal Page = E:\Windows\system32\blank.htm
    mLocal Page = E:\Windows\SysWOW64\blank.htm
    uInternet Settings,ProxyServer = 179.43.143.126:8089
    IE: E&xport to Microsoft Excel - C:\PROGRA~1\MICROS~2\Office14\EXCEL.EXE/3000
    IE: Open with PDF Viewer Plus - E:\Program Files (x86)\Nuance\PDF Viewer Plus\Bin\PlusIEContextMenu.dll/PlusIEContextMenu.htm
    TCP: DhcpNameServer = 192.168.2.1
    FF - ProfilePath - E:\Users\Calvin\AppData\Roaming\Mozilla\Firefox\Profiles\thb1obiy.default\

    - - - - ORPHANS REMOVED - - - -

    Wow6432Node-HKCU-Run-ASRockXTU - (no file)
    Wow6432Node-HKCU-Run-zASRockInstantBoot - (no file)
    Wow6432Node-HKCU-Run-AdobeBridge - (no file)
    Wow6432Node-HKCU-Run-KiesAirMessage - E:\Program Files (x86)\Samsung\Kies\KiesAirMessage.exe
    Wow6432Node-HKCU-Run-RESTART_STICKY_NOTES - E:\Windows\System32\StikyNot.exe
    Wow6432Node-HKLM-Run-<NO NAME> - (no file)
    ShellIconOverlayIdentifiers-{472083B0-C522-11CF-8763-00608CC02F24} - (no file)
    AddRemove-dBpoweramp Dalet Codec - E:\Windows\system32\SpoonUninstall.exe
    AddRemove-dBpoweramp DSP Effects - E:\Windows\system32\SpoonUninstall.exe
    AddRemove-dBpoweramp Monkeys Audio Codec - E:\Windows\system32\SpoonUninstall.exe
    AddRemove-dBpoweramp mp3 (Fraunhofer IIS) Codec - E:\Windows\system32\SpoonUninstall.exe
    AddRemove-dBpoweramp Music Converter - E:\Windows\system32\SpoonUninstall.exe
    AddRemove-dBpoweramp Ogg Vorbis Codec - E:\Windows\system32\SpoonUninstall.exe
    AddRemove-dBPowerAMP Real Audio (Helix) Encoder - E:\Windows\system32\SpoonUninstall.exe
    AddRemove-dBpoweramp WavPack Codec - E:\Windows\system32\SpoonUninstall.exe
    AddRemove-dBpoweramp [Calculate Audio CRC] Codec - E:\Windows\system32\SpoonUninstall.exe
    AddRemove-Deckadance 2 - E:\Program Files (x86)\VstPlugins\Image-Line\Deckadance2\uninstall.exe
    AddRemove-DirectWave - E:\Program Files (x86)\VstPlugins\\DirectWave\DirectWave\uninstall.exe
    AddRemove-reFX Slayer Demo 2.6.0_is1 - E:\Program Files (x86)\VstPlugins\unins000.exe



    --------------------- LOCKED REGISTRY KEYS ---------------------

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BEB3C0C7-B648-4257-96D9-B5D024816E27}\Version*Version]
    "Version"=hex:3b,a6,ad,08,0a,d9,ae,9b,00,3f,e8,fc,2c,e6,29,fc,d8,24,9c,4c,34,
    4c,0b,fe,f4,24,ee,b4,6f,85,7e,0c,e2,cb,1c,24,10,2f,97,9e,11,90,99,23,08,ce,\

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
    @Denied: (Full) (Everyone)

    ------------------------ Other Running Processes ------------------------

    E:\Program Files (x86)\Belkin\Router Setup and Monitor\BelkinService.exe
    E:\Windows\SysWOW64\PnkBstrA.exe
    E:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\avpui.exe
    E:\Program Files (x86)\Sony\Sony PC Companion\PCCompanionInfo.exe
    E:\Users\Calvin\AppData\Roaming\Dropbox\bin\Dropbox.exe
    E:\Program Files (x86)\Belkin\Router Setup and Monitor\BelkinSetup.exe
    E:\Program Files (x86)\Belkin\Router Setup and Monitor\dlnaPlugin.exe
    E:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\plugin-nm-server.exe
    E:\Program Files (x86)\Steam\bin\steamwebhelper.exe
    E:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\klwtblfs.exe
    E:\Program Files\Echobit\Evolve\EvolveUI.exe
    E:\Program Files (x86)\Steam\bin\steamwebhelper.exe
    E:\Program Files\Echobit\Evolve\EvolveUI.exe
    E:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
    E:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

    **************************************************************************

    Completion time: 2014-11-12 20:06:51 - machine was rebooted
    ComboFix-quarantined-files.txt 2014-11-13 01:06:39

    Pre-Run: 27,155,591,168 bytes free
    Post-Run: 30,162,919,424 bytes free
     
  16. Broni

    Broni Malware Annihilator Posts: 52,892   +344

    Looks good.

    [​IMG] Please download AdwCleaner by Xplode onto your desktop.
    • Close all open programs and internet browsers.
    • Double click on adwcleaner.exe to run the tool.
    • Click on Scan button.
    • When the scan has finished click on Clean button.
    • Your computer will be rebooted automatically. A text file will open after the restart.
    • Please post the contents of that logfile with your next reply.
    • You can find the logfile at C:\AdwCleaner[S1].txt as well.

    [​IMG] Please download Junkware Removal Tool to your desktop.
    • Shut down your protection software now to avoid potential conflicts.
    • Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
    • The tool will open and start scanning your system.
    • Please be patient as this can take a while to complete depending on your system's specifications.
    • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
    • Post the contents of JRT.txt into your next message.

    [​IMG] Please download Farbar Recovery Scan Tool and save it to your Desktop.

    Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.
    • Double-click to run it. When the tool opens click Yes to disclaimer.
    • Press Scan button.
    • It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
    • The first time the tool is run, it makes also another log (Addition.txt). Please copy and paste it to your reply.
     
  17. cokeguy

    cokeguy TS Rookie Topic Starter Posts: 21

    # AdwCleaner v4.101 - Report created 12/11/2014 at 20:12:01
    # Updated 09/11/2014 by Xplode
    # Database : 2014-11-12.2 [Live]
    # Operating System : Windows 7 Ultimate (64 bits)
    # Username : Calvin - 420YOLOSWAGGER
    # Running from : E:\Users\Calvin\Downloads\adwcleaner_4.101.exe
    # Option : Clean

    ***** [ Services ] *****

    [#] Service Deleted : hshld
    [#] Service Deleted : hsstrayservice
    [#] Service Deleted : hsswd

    ***** [ Files / Folders ] *****


    ***** [ Scheduled Tasks ] *****


    ***** [ Shortcuts ] *****


    ***** [ Registry ] *****


    ***** [ Browsers ] *****

    -\\ Internet Explorer v8.0.7600.16385


    -\\ Mozilla Firefox v30.0 (en-US)


    -\\ Google Chrome v38.0.2125.111


    *************************

    AdwCleaner[R0].txt - [3543 octets] - [11/11/2014 04:35:35]
    AdwCleaner[R1].txt - [979 octets] - [12/11/2014 20:11:11]
    AdwCleaner[S0].txt - [3664 octets] - [11/11/2014 04:36:45]
    AdwCleaner[S1].txt - [919 octets] - [12/11/2014 20:12:01]

    ########## EOF - E:\AdwCleaner\AdwCleaner[S1].txt - [978 octets] ##########
     
  18. cokeguy

    cokeguy TS Rookie Topic Starter Posts: 21

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    Junkware Removal Tool (JRT) by Thisisu
    Version: 6.3.7 (11.08.2014:1)
    OS: Windows 7 Ultimate x64
    Ran by Calvin on 12/11/2014 at 20:13:46.06
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




    ~~~ Services



    ~~~ Registry Values



    ~~~ Registry Keys



    ~~~ Files



    ~~~ Folders



    ~~~ FireFox

    Emptied folder: E:\Users\Calvin\AppData\Roaming\mozilla\firefox\profiles\thb1obiy.default\minidumps [1 files]



    ~~~ Event Viewer Logs were cleared





    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    Scan was completed on 12/11/2014 at 20:16:29.50
    End of JRT log
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     
  19. cokeguy

    cokeguy TS Rookie Topic Starter Posts: 21

    Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 10-11-2014
    Ran by Calvin (administrator) on 420YOLOSWAGGER on 12-11-2014 20:20:16
    Running from E:\Users\Calvin\Downloads
    Loaded Profile: Calvin (Available profiles: Calvin)
    Platform: Windows 7 Ultimate (X64) OS Language: English (United States)
    Internet Explorer Version 8
    Boot Mode: Normal
    Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

    ==================== Processes (Whitelisted) =================

    (If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

    (NVIDIA Corporation) E:\Windows\System32\nvvsvc.exe
    (NVIDIA Corporation) E:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
    (Affinegy, Inc.) E:\Program Files (x86)\Belkin\Router Setup and Monitor\BelkinService.exe
    () E:\Program Files\Belkin\Belkin USB Print and Storage Center\BkBackupScheduler.exe
    () E:\Program Files\Belkin\Belkin USB Print and Storage Center\Bkapcs.exe
    (cFos Software GmbH) E:\Program Files\ASRock\XFast LAN\spd.exe
    (NVIDIA Corporation) E:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
    (Intel(R) Corporation) E:\Program Files\Intel\iCLS Client\HeciServer.exe
    () E:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe
    (Intel Corporation) E:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
    (Microsoft Corporation) E:\Program Files\Microsoft LifeCam\MSCamS64.exe
    (NVIDIA Corporation) E:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
    (NVIDIA Corporation) E:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
    (Nuance Communications, Inc.) E:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe
    () E:\Windows\SysWOW64\PnkBstrA.exe
    (NVIDIA Corporation) E:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
    (NVIDIA Corporation) E:\Windows\System32\nvvsvc.exe
    (NVIDIA Corporation) E:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
    (NVIDIA Corporation) E:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
    (NVIDIA Corporation) E:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
    (Intel Corporation) E:\Windows\System32\igfxpers.exe
    (Realtek Semiconductor) E:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
    (cFos Software GmbH) E:\Program Files\ASRock\XFast LAN\cfosspeed.exe
    (Logitech Inc.) E:\Program Files\Logitech Gaming Software\LCore.exe
    (Echobit LLC) E:\Program Files\Echobit\Evolve\EvolveClient.exe
    (Flux Software LLC) E:\Users\Calvin\AppData\Local\FluxSoftware\Flux\flux.exe
    (BitTorrent Inc.) E:\Users\Calvin\AppData\Roaming\uTorrent\uTorrent.exe
    () E:\Program Files (x86)\RocketDock\RocketDock.exe
    (Samsung) E:\Program Files (x86)\Samsung\Kies\Kies.exe
    (Sony) E:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe
    (Microsoft Corporation) E:\Windows\System32\StikyNot.exe
    (Skype Technologies S.A.) E:\Program Files (x86)\Skype\Phone\Skype.exe
    (Acresso Corporation) E:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe
    () E:\Program Files (x86)\Sony\Sony PC Companion\PCCompanionInfo.exe
    (Dropbox, Inc.) E:\Users\Calvin\AppData\Roaming\Dropbox\bin\Dropbox.exe
    (Valve Corporation) E:\Program Files (x86)\Steam\Steam.exe
    () E:\Program Files (x86)\FAHClient\FAHClient.exe
    (Intel Corporation) E:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
    (FNet Co., Ltd.) E:\Program Files (x86)\XFastUSB\XFastUsb.exe
    (Razer Inc.) E:\Program Files (x86)\Razer\Synapse\RzSynapse.exe
    (Elaborate Bytes AG) C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
    (Samsung Electronics Co., Ltd.) E:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
    (Affinegy, Inc.) E:\Program Files (x86)\Belkin\Router Setup and Monitor\BelkinRouterMonitor.exe
    (Nuance Communications, Inc.) E:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe
    (Echobit LLC) E:\Program Files\Echobit\Evolve\EvoSvc.exe
    (Nuance Communications, Inc.) E:\Program Files (x86)\Nuance\PDF Viewer Plus\pdfPro5Hook.exe
    (Oracle Corporation) E:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
    (Echobit, LLC) E:\Program Files\Echobit\Evolve\Drivers\EvolveTracker_64.exe
    (Belkin International, Inc.) E:\Program Files\Belkin\Belkin USB Print and Storage Center\Connect.exe
    (Affinegy, Inc.) E:\Program Files (x86)\Belkin\Router Setup and Monitor\BelkinSetup.exe
    (Affinegy, Inc.) E:\Program Files (x86)\Belkin\Router Setup and Monitor\dlnaPlugin.exe
    (NVIDIA Corporation) E:\Program Files\NVIDIA Corporation\Display\nvtray.exe
    (Valve Corporation) E:\Program Files (x86)\Steam\bin\steamwebhelper.exe
    (Echobit, LLC) E:\Program Files\Echobit\Evolve\EvolveUI.exe
    (Valve Corporation) E:\Program Files (x86)\Steam\bin\steamwebhelper.exe
    (Echobit, LLC) E:\Program Files\Echobit\Evolve\EvolveUI.exe
    (Intel Corporation) E:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
    (Intel Corporation) E:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
    (Intel Corporation) E:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
    (Intel Corporation) E:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
    (Intel Corporation) E:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
    (Google Inc.) E:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) E:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) E:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) E:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) E:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) E:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) E:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) E:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) E:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) E:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) E:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) E:\Program Files (x86)\Google\Chrome\Application\chrome.exe


    ==================== Registry (Whitelisted) ==================

    (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

    HKLM\...\Run: [RTHDVCPL] => E:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12936848 2012-07-13] (Realtek Semiconductor)
    HKLM\...\Run: [XFast LAN] => E:\Program Files\ASRock\XFast LAN\cFosSpeed.exe [1441152 2011-10-19] (cFos Software GmbH)
    HKLM\...\Run: [NvBackend] => E:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2460488 2014-09-16] (NVIDIA Corporation)
    HKLM\...\Run: [ShadowPlay] => E:\Windows\system32\rundll32.exe E:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
    HKLM\...\Run: [AdobeAAMUpdater-1.0] => E:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [446392 2012-04-04] (Adobe Systems Incorporated)
    HKLM\...\Run: [Launch LCore] => E:\Program Files\Logitech Gaming Software\LCore.exe [10801944 2014-07-28] (Logitech Inc.)
    HKLM-x32\...\Run: [IAStorIcon] => E:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284480 2012-05-30] (Intel Corporation)
    HKLM-x32\...\Run: [USB3MON] => E:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291648 2012-05-20] (Intel Corporation)
    HKLM-x32\...\Run: [XFastUSB] => E:\Program Files (x86)\XFastUSB\XFastUsb.exe [5019360 2013-12-17] (FNet Co., Ltd.)
    HKLM-x32\...\Run: [] => [X]
    HKLM-x32\...\Run: [Razer Synapse] => E:\Program Files (x86)\Razer\Synapse\RzSynapse.exe [444760 2014-03-07] (Razer Inc.)
    HKLM-x32\...\Run: [VirtualCloneDrive] => C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe [85160 2009-05-26] (Elaborate Bytes AG)
    HKLM-x32\...\Run: [SwitchBoard] => E:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
    HKLM-x32\...\Run: [AdobeCS6ServiceManager] => E:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [1073312 2012-03-09] (Adobe Systems Incorporated)
    HKLM-x32\...\Run: [LifeCam] => E:\Program Files (x86)\Microsoft LifeCam\LifeExp.exe [135536 2010-12-13] (Microsoft Corporation)
    HKLM-x32\...\Run: [KiesTrayAgent] => E:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [311152 2013-12-11] (Samsung Electronics Co., Ltd.)
    HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => E:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [41056 2013-05-08] (Adobe Systems Incorporated)
    HKLM-x32\...\Run: [Adobe ARM] => E:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
    HKLM-x32\...\Run: [InstaLAN] => E:\Program Files (x86)\Belkin\Router Setup and Monitor\BelkinRouterMonitor.exe [1884064 2011-12-07] (Affinegy, Inc.)
    HKLM-x32\...\Run: [IndexSearch] => E:\Program Files (x86)\Nuance\PaperPort\IndexSearch.exe [46368 2010-03-08] (Nuance Communications, Inc.)
    HKLM-x32\...\Run: [PaperPort PTD] => E:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe [29984 2010-03-08] (Nuance Communications, Inc.)
    HKLM-x32\...\Run: [PPort12reminder] => E:\Program Files (x86)\Nuance\PaperPort\Ereg\Ereg.exe [328992 2010-02-09] (Nuance Communications, Inc.)
    HKLM-x32\...\Run: [PDFHook] => E:\Program Files (x86)\Nuance\PDF Viewer Plus\pdfpro5hook.exe [636192 2010-03-05] (Nuance Communications, Inc.)
    HKLM-x32\...\Run: [PDF5 Registry Controller] => E:\Program Files (x86)\Nuance\PDF Viewer Plus\RegistryController.exe [62752 2010-03-05] (Nuance Communications, Inc.)
    HKLM-x32\...\Run: [SunJavaUpdateSched] => E:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [271744 2014-09-26] (Oracle Corporation)
    Winlogon\Notify\igfxcui: E:\Windows\system32\igfxdev.dll (Intel Corporation)
    HKU\S-1-5-21-1199268278-559096122-390045334-1000\...\Run: [ASRockXTU] => [X]
    HKU\S-1-5-21-1199268278-559096122-390045334-1000\...\Run: [zASRockInstantBoot] => [X]
    HKU\S-1-5-21-1199268278-559096122-390045334-1000\...\Run: [EvolveClient] => E:\Program Files\Echobit\Evolve\EvolveClient.exe [3332512 2014-09-17] (Echobit LLC)
    HKU\S-1-5-21-1199268278-559096122-390045334-1000\...\Run: [f.lux] => E:\Users\Calvin\AppData\Local\FluxSoftware\Flux\flux.exe [1017224 2013-10-23] (Flux Software LLC)
    HKU\S-1-5-21-1199268278-559096122-390045334-1000\...\Run: [uTorrent] => E:\Users\Calvin\AppData\Roaming\uTorrent\uTorrent.exe [1385808 2014-10-29] (BitTorrent Inc.)
    HKU\S-1-5-21-1199268278-559096122-390045334-1000\...\Run: [AdobeBridge] => [X]
    HKU\S-1-5-21-1199268278-559096122-390045334-1000\...\Run: [RocketDock] => E:\Program Files (x86)\RocketDock\RocketDock.exe [495616 2007-09-02] ()
    HKU\S-1-5-21-1199268278-559096122-390045334-1000\...\Run: [KiesPreload] => E:\Program Files (x86)\Samsung\Kies\Kies.exe [1564528 2013-12-11] (Samsung)
    HKU\S-1-5-21-1199268278-559096122-390045334-1000\...\Run: [KiesAirMessage] => E:\Program Files (x86)\Samsung\Kies\KiesAirMessage.exe -startup
    HKU\S-1-5-21-1199268278-559096122-390045334-1000\...\Run: [EADM] => C:\Program Files (x86)\Origin\Origin.exe [3618648 2014-11-05] (Electronic Arts)
    HKU\S-1-5-21-1199268278-559096122-390045334-1000\...\Run: [Sony PC Companion] => E:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe [468192 2014-09-01] (Sony)
    HKU\S-1-5-21-1199268278-559096122-390045334-1000\...\Run: [RESTART_STICKY_NOTES] => E:\Windows\System32\StikyNot.exe [427520 2009-07-13] (Microsoft Corporation)
    HKU\S-1-5-21-1199268278-559096122-390045334-1000\...\Run: [Skype] => E:\Program Files (x86)\Skype\Phone\Skype.exe [22065760 2014-10-01] (Skype Technologies S.A.)
    HKU\S-1-5-21-1199268278-559096122-390045334-1000\...\Run: [ISUSPM] => E:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe [222496 2009-05-05] (Acresso Corporation)
    HKU\S-1-5-21-1199268278-559096122-390045334-1000\...\Run: [GoogleChromeAutoLaunch_C7B769EDBBCCE7FB80A6816B8CB269D6] => E:\Program Files (x86)\Google\Chrome\Application\chrome.exe [854344 2014-10-21] (Google Inc.)
    Startup: E:\Users\Calvin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
    ShortcutTarget: Dropbox.lnk -> E:\Users\Calvin\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
    Startup: E:\Users\Calvin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Folding@home.lnk
    ShortcutTarget: Folding@home.lnk -> E:\Program Files (x86)\FAHClient\HideConsole.exe ()
    Startup: E:\Users\Calvin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Steam.lnk
    ShortcutTarget: Steam.lnk -> E:\Program Files (x86)\Steam\Steam.exe (Valve Corporation)
    ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => No File

    ==================== Internet (Whitelisted) ====================

    (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

    ProxyServer: 179.43.143.126:8089
    HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
    HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xCAFC2E2F50BCCF01
    HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-ca
    HKU\S-1-5-21-1199268278-559096122-390045334-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
    StartMenuInternet: IEXPLORE.EXE - E:\Program Files (x86)\Internet Explorer\iexplore.exe
    SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://ca.search.yahoo.com/search?p={searchTerms}&fr=chr-devicevm&type=ASRK
    SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://ca.search.yahoo.com/search?p={searchTerms}&fr=chr-devicevm&type=ASRK
    SearchScopes: HKCU - {B1E1E994-213C-4e3d-B228-4F725AC86D3D} URL = http://www.google.com/custom?client...0FF;GIMP:0000FF;FORID:1&hl=en&q={searchTerms}
    BHO: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> E:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
    BHO: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> E:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
    BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
    BHO: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> E:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
    BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> E:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
    BHO-x32: PlusIEEventHelper Class -> {551A852F-39A6-44A7-9C13-AFBEC9185A9D} -> E:\Program Files (x86)\Nuance\PDF Viewer Plus\Bin\PlusIEContextMenu.dll (Zeon Corporation)
    BHO-x32: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> E:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
    BHO-x32: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> E:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
    BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> E:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
    BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> E:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
    BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> E:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
    BHO-x32: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> E:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
    Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - E:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
    Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

    FireFox:
    ========
    FF ProfilePath: E:\Users\Calvin\AppData\Roaming\Mozilla\Firefox\Profiles\thb1obiy.default
    FF Plugin: @adobe.com/FlashPlayer -> E:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_223.dll ()
    FF Plugin: @esn/npbattlelog,version=2.5.1 -> E:\Program Files (x86)\Battlelog Web Plugins\2.5.1\npbattlelogx64.dll (EA Digital Illusions CE AB)
    FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
    FF Plugin-x32: @adobe.com/FlashPlayer -> E:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_223.dll ()
    FF Plugin-x32: @esn/npbattlelog,version=2.4.0 -> E:\Program Files (x86)\Battlelog Web Plugins\2.4.0\npbattlelog.dll (EA Digital Illusions CE AB)
    FF Plugin-x32: @esn/npbattlelog,version=2.5.1 -> E:\Program Files (x86)\Battlelog Web Plugins\2.5.1\npbattlelog.dll (EA Digital Illusions CE AB)
    FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> E:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
    FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> E:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
    FF Plugin-x32: @java.com/DTPlugin,version=10.71.2 -> E:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
    FF Plugin-x32: @java.com/JavaPlugin,version=10.71.2 -> E:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
    FF Plugin-x32: @kaspersky.com/content_blocker -> E:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\FFExt\content_blocker@kaspersky.com ()
    FF Plugin-x32: @kaspersky.com/virtual_keyboard -> E:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\FFExt\virtual_keyboard@kaspersky.com ()
    FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> E:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
    FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> E:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
    FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> E:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
    FF Plugin-x32: @nexon.net/NxGame -> E:\ProgramData\NexonUS\NGM\npNxGameUS.dll (Nexon)
    FF Plugin-x32: @nvidia.com/3DVision -> E:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
    FF Plugin-x32: @nvidia.com/3DVisionStreaming -> E:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
    FF Plugin-x32: @softnyxNpruntime -> D:\Game\SoftnyxGame\NyxLauncherIS\npSoftnyx.dll ( )
    FF Plugin-x32: @tools.google.com/Google Update;version=3 -> E:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
    FF Plugin-x32: @tools.google.com/Google Update;version=9 -> E:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
    FF Plugin-x32: @videolan.org/vlc,version=2.1.2 -> E:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
    FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> E:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
    FF Plugin-x32: Adobe Reader -> E:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
    FF Plugin HKU\S-1-5-21-1199268278-559096122-390045334-1000: @unity3d.com/UnityPlayer,version=1.0 -> E:\Users\Calvin\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
    FF Extension: Firefox Old Version Update Hotfix - E:\Users\Calvin\AppData\Roaming\Mozilla\Firefox\Profiles\thb1obiy.default\Extensions\firefox-hotfix@mozilla.org.xpi [2014-10-09]
    FF Extension: Hotspot Shield Extension - E:\Program Files (x86)\Mozilla Firefox\browser\extensions\afproxy@anchorfree.com [2014-08-04]
    FF HKLM-x32\...\Firefox\Extensions: [content_blocker@kaspersky.com] - E:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\FFExt\content_blocker@kaspersky.com
    FF Extension: Ngăn chặn trang web nguy hiểm - E:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\FFExt\content_blocker@kaspersky.com [2014-11-07]
    FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] - E:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\FFExt\virtual_keyboard@kaspersky.com
    FF Extension: Bàn phím ảo - E:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\FFExt\virtual_keyboard@kaspersky.com [2014-11-07]
    FF HKLM-x32\...\Firefox\Extensions: [url_advisor@kaspersky.com] - E:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\FFExt\url_advisor@kaspersky.com
    FF Extension: Công cụ kiểm tra liên kết của Kaspersky - E:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\FFExt\url_advisor@kaspersky.com [2014-11-07]

    Chrome:
    =======
    CHR HomePage: Default ->
    CHR Profile: E:\Users\Calvin\AppData\Local\Google\Chrome\User Data\Default
    CHR Extension: (Google Docs) - E:\Users\Calvin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-12-17]
    CHR Extension: (Google Drive) - E:\Users\Calvin\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-12-17]
    CHR Extension: (Google Voice Search Hotword (Beta)) - E:\Users\Calvin\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-06-03]
    CHR Extension: (YouTube) - E:\Users\Calvin\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-12-17]
    CHR Extension: (Honey) - E:\Users\Calvin\AppData\Local\Google\Chrome\User Data\Default\Extensions\bmnlcjabgnpnenekpadlanbbkooimhnj [2014-01-19]
    CHR Extension: (Adblock Plus) - E:\Users\Calvin\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2013-12-17]
    CHR Extension: (Google Search) - E:\Users\Calvin\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-12-17]
    CHR Extension: (Kaspersky Protection) - E:\Users\Calvin\AppData\Local\Google\Chrome\User Data\Default\Extensions\dbhjdbfgekjfcfkkfjjmlmojhbllhbho [2014-11-10]
    CHR Extension: (EditThisCookie) - E:\Users\Calvin\AppData\Local\Google\Chrome\User Data\Default\Extensions\fngmhnnpilhplaeedifhccceomclgfbg [2014-01-19]
    CHR Extension: (AdBlock) - E:\Users\Calvin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2014-05-22]
    CHR Extension: (Allow Right-Click) - E:\Users\Calvin\AppData\Local\Google\Chrome\User Data\Default\Extensions\hompjdfbfmmmgflfjdlnkohcplmboaeo [2014-04-02]
    CHR Extension: (Reddit Enhancement Suite) - E:\Users\Calvin\AppData\Local\Google\Chrome\User Data\Default\Extensions\kbmfpngjjgdllneeigpgjifpgocmfgmb [2013-12-17]
    CHR Extension: (Cookie Manager) - E:\Users\Calvin\AppData\Local\Google\Chrome\User Data\Default\Extensions\kbnfbcpkiaganjpcanopcgeoehkleeck [2013-12-17]
    CHR Extension: (Lazarus: Form Recovery) - E:\Users\Calvin\AppData\Local\Google\Chrome\User Data\Default\Extensions\loljledaigphbcpfhfmgopdkppkifgno [2013-12-17]
    CHR Extension: (Google Wallet) - E:\Users\Calvin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-12-17]
    CHR Extension: (Gmail) - E:\Users\Calvin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-12-17]
    CHR HKLM\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho []
    CHR HKLM-x32\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho []

    ==================== Services (Whitelisted) =================

    (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

    R2 AffinegyService; E:\Program Files (x86)\Belkin\Router Setup and Monitor\BelkinService.exe [563104 2011-12-07] (Affinegy, Inc.)
    S2 AVP15.0.0; E:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\avp.exe [233552 2014-04-20] (Kaspersky Lab ZAO)
    R2 Belkin Local Backup Service; E:\Program Files\Belkin\Belkin USB Print and Storage Center\BkBackupScheduler.exe [181760 2011-04-19] () [File not signed]
    R2 Belkin Network USB Helper; E:\Program Files\Belkin\Belkin USB Print and Storage Center\Bkapcs.exe [55296 2010-02-09] () [File not signed]
    R2 cFosSpeedS; E:\Program Files\ASRock\XFast LAN\spd.exe [395136 2011-10-19] (cFos Software GmbH)
    R3 EvoSvc; E:\Program Files\Echobit\Evolve\EvoSvc.exe [1579936 2014-09-17] (Echobit LLC)
    R2 GfExperienceService; E:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1148744 2014-09-16] (NVIDIA Corporation)
    R2 Intel(R) ME Service; E:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [129856 2012-06-27] (Intel Corporation)
    R2 ISCTAgent; E:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe [133632 2012-02-09] ()
    S3 iumsvc; E:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [174368 2014-02-28] ()
    R2 jhi_service; E:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-06-25] (Intel Corporation)
    R2 NvNetworkService; E:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1795912 2014-09-16] (NVIDIA Corporation)
    R2 NvStreamSvc; E:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [19439944 2014-09-16] (NVIDIA Corporation)
    S3 Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [1900400 2014-11-05] (Electronic Arts)
    R2 PDFProFiltSrvPP; E:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe [144672 2010-03-08] (Nuance Communications, Inc.)
    R2 PnkBstrA; E:\Windows\SysWOW64\PnkBstrA.exe [76152 2014-07-10] ()
    S3 SwitchBoard; E:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]

    ==================== Drivers (Whitelisted) ====================

    (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

    R0 AsrRamDisk; E:\Windows\System32\DRIVERS\AsrRamDisk.sys [31016 2012-01-13] (ASRock Inc.)
    S3 FNETTBOH_305; E:\Windows\System32\drivers\FNETTBOH_305.SYS [32320 2014-10-08] (FNet Co., Ltd.)
    R1 FNETURPX; E:\Windows\System32\drivers\FNETURPX.SYS [15936 2013-12-17] (FNet Co., Ltd.)
    S3 ggsomc; E:\Windows\System32\DRIVERS\ggsomc.sys [30424 2014-07-28] (Sony Mobile Communications)
    S3 GunBod; D:\Game\SoftnyxGame\GunBoundIS\avital\gunbod64.sys [86352 2014-07-27] ()
    R1 HssDRV6; E:\Windows\System32\DRIVERS\hssdrv6.sys [44744 2014-05-16] (AnchorFree Inc.)
    R3 ISCT; E:\Windows\System32\DRIVERS\ISCTD64.sys [44992 2012-02-09] ()
    R0 kl1; E:\Windows\System32\DRIVERS\kl1.sys [457824 2014-02-20] (Kaspersky Lab ZAO)
    R3 klflt; E:\Windows\System32\DRIVERS\klflt.sys [141320 2014-11-07] (Kaspersky Lab ZAO)
    R1 klhk; E:\Windows\System32\DRIVERS\klhk.sys [243808 2014-04-10] (Kaspersky Lab ZAO)
    R1 KLIF; E:\Windows\System32\DRIVERS\klif.sys [793800 2014-11-07] (Kaspersky Lab ZAO)
    R1 KLIM6; E:\Windows\System32\DRIVERS\klim6.sys [30304 2014-02-25] (Kaspersky Lab ZAO)
    R3 klkbdflt; E:\Windows\System32\DRIVERS\klkbdflt.sys [28768 2014-03-28] (Kaspersky Lab ZAO)
    R3 klmouflt; E:\Windows\System32\DRIVERS\klmouflt.sys [29280 2013-08-08] (Kaspersky Lab ZAO)
    R1 klpd; E:\Windows\System32\DRIVERS\klpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO)
    R1 kltdi; E:\Windows\System32\DRIVERS\kltdi.sys [55904 2014-03-25] (Kaspersky Lab ZAO)
    R1 kneps; E:\Windows\System32\DRIVERS\kneps.sys [179296 2014-03-26] (Kaspersky Lab ZAO)
    R3 LGSHidFilt; E:\Windows\System32\DRIVERS\LGSHidFilt.Sys [64280 2013-05-30] (Logitech Inc.)
    R3 NvStreamKms; E:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19272 2014-09-16] (NVIDIA Corporation)
    R3 nvvad_WaveExtensible; E:\Windows\System32\drivers\nvvad64v.sys [38048 2014-09-04] (NVIDIA Corporation)
    R3 rzendpt; E:\Windows\System32\DRIVERS\rzendpt.sys [39080 2013-11-15] (Razer Inc)
    R2 sxuptp; E:\Windows\System32\DRIVERS\sxuptp.sys [291352 2009-06-22] (silex technology, Inc.)
    R3 taphss6; E:\Windows\System32\DRIVERS\taphss6.sys [42184 2014-05-16] (Anchorfree Inc.)
    U3 TrueSight; E:\Windows\System32\drivers\TrueSight.sys [34808 2014-11-12] ()
    R3 WPRO_41_2001; E:\Windows\System32\drivers\WPRO_41_2001.sys [34752 2014-11-12] ()
    S3 catchme; \??\E:\ComboFix\catchme.sys [X]
    S3 EagleX64; \??\E:\Windows\system32\drivers\EagleX64.sys [X]
    S3 MSICDSetup; \??\G:\CDriver64.sys [X]

    ==================== NetSvcs (Whitelisted) ===================

    (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


    ==================== One Month Created Files and Folders ========

    (If an entry is included in the fixlist, the file\folder will be moved.)

    2014-11-12 20:20 - 2014-11-12 20:20 - 00029809 _____ () E:\Users\Calvin\Downloads\FRST.txt
    2014-11-12 20:20 - 2014-11-12 20:20 - 00000000 ____D () E:\FRST
    2014-11-12 20:16 - 2014-11-12 20:16 - 00000754 _____ () E:\Users\Calvin\Desktop\JRT.txt
    2014-11-12 20:13 - 2014-11-12 20:13 - 00000000 ____D () E:\Windows\ERUNT
    2014-11-12 20:10 - 2014-11-12 20:10 - 02116096 _____ (Farbar) E:\Users\Calvin\Downloads\FRST64.exe
    2014-11-12 19:36 - 2014-11-12 20:06 - 00000000 ____D () E:\Qoobox
    2014-11-12 19:36 - 2014-11-12 20:06 - 00000000 ____D () E:\ComboFix
    2014-11-12 19:36 - 2014-11-12 20:00 - 00000000 ____D () E:\Windows\erdnt
    2014-11-12 19:36 - 2011-06-26 01:45 - 00256000 _____ () E:\Windows\PEV.exe
    2014-11-12 19:36 - 2010-11-07 12:20 - 00208896 _____ () E:\Windows\MBR.exe
    2014-11-12 19:36 - 2009-04-19 23:56 - 00060416 _____ (NirSoft) E:\Windows\NIRCMD.exe
    2014-11-12 19:36 - 2000-08-30 19:00 - 00518144 _____ (SteelWerX) E:\Windows\SWREG.exe
    2014-11-12 19:36 - 2000-08-30 19:00 - 00406528 _____ (SteelWerX) E:\Windows\SWSC.exe
    2014-11-12 19:36 - 2000-08-30 19:00 - 00098816 _____ () E:\Windows\sed.exe
    2014-11-12 19:36 - 2000-08-30 19:00 - 00080412 _____ () E:\Windows\grep.exe
    2014-11-12 19:36 - 2000-08-30 19:00 - 00068096 _____ () E:\Windows\zip.exe
    2014-11-12 19:28 - 2014-11-12 19:32 - 00000000 ____D () E:\ProgramData\Malwarebytes' Anti-Malware (portable)
    2014-11-12 19:27 - 2014-11-12 19:32 - 00000000 ____D () E:\Users\Calvin\Desktop\mbar
    2014-11-12 19:20 - 2014-11-12 19:21 - 00034808 _____ () E:\Windows\system32\Drivers\TrueSight.sys
    2014-11-12 19:20 - 2014-11-12 19:20 - 00000000 ____D () E:\ProgramData\RogueKiller
    2014-11-12 19:13 - 2014-11-12 19:13 - 00030034 _____ () E:\Users\Calvin\Desktop\dds.txt
    2014-11-12 19:13 - 2014-11-12 19:13 - 00013235 _____ () E:\Users\Calvin\Desktop\attach.txt
    2014-11-12 19:11 - 2014-11-12 19:11 - 00001165 _____ () E:\Users\Calvin\Downloads\mbam.txt
    2014-11-12 19:06 - 2014-11-12 19:06 - 00043152 _____ (AVAST Software) E:\Windows\avastSS.scr
    2014-11-12 19:06 - 2014-11-12 19:06 - 00000000 ____D () E:\Windows\SysWOW64\vbox
    2014-11-12 19:06 - 2014-11-12 19:06 - 00000000 ____D () E:\Windows\system32\vbox
    2014-11-12 19:06 - 2014-11-12 19:06 - 00000000 ____D () E:\Users\Calvin\AppData\Roaming\AVAST Software
    2014-11-12 19:05 - 2014-11-12 19:05 - 00000000 ____D () E:\Program Files\AVAST Software
    2014-11-12 19:04 - 2014-11-12 19:05 - 00000000 ____D () E:\ProgramData\AVAST Software
    2014-11-12 15:12 - 2014-11-12 20:12 - 00000830 _____ () E:\Windows\Tasks\Adobe Flash Player Updater.job
    2014-11-12 15:12 - 2014-11-12 15:12 - 00701104 _____ (Adobe Systems Incorporated) E:\Windows\SysWOW64\FlashPlayerApp.exe
    2014-11-12 15:12 - 2014-11-12 15:12 - 00071344 _____ (Adobe Systems Incorporated) E:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
    2014-11-12 15:12 - 2014-11-12 15:12 - 00003768 _____ () E:\Windows\System32\Tasks\Adobe Flash Player Updater
    2014-11-12 03:16 - 2014-11-12 03:17 - 00000000 ____D () E:\Users\Calvin\Downloads\oct - nov pics
    2014-11-12 02:43 - 2014-11-12 08:06 - 990212472 _____ () E:\Users\Calvin\Downloads\Mayli - SpermSuckers.zip
    2014-11-12 01:54 - 2014-11-12 01:54 - 00000946 _____ () E:\Users\Calvin\Desktop\CDisplay.lnk
    2014-11-12 01:54 - 2014-11-12 01:54 - 00000000 ____D () E:\ProgramData\Microsoft\Windows\Start Menu\Programs\CDisplay
    2014-11-12 01:54 - 2014-11-12 01:54 - 00000000 ____D () E:\Program Files (x86)\CDisplay
    2014-11-11 04:35 - 2014-11-12 20:12 - 00000000 ____D () E:\AdwCleaner
    2014-11-11 04:29 - 2014-11-11 04:29 - 01153912 _____ (Emsi Software GmbH) E:\Users\Calvin\Downloads\BlitzBlank.exe
    2014-11-10 19:56 - 2014-11-10 20:03 - 02465089 _____ () E:\Users\Calvin\Documents\2deep4me.mp4
    2014-11-10 01:35 - 2014-10-29 19:56 - 00614728 _____ (NVIDIA Corporation) E:\Windows\SysWOW64\nvStreaming.exe
    2014-11-10 01:34 - 2014-10-29 23:53 - 31890064 _____ (NVIDIA Corporation) E:\Windows\system32\nvoglv64.dll
    2014-11-10 01:34 - 2014-10-29 23:53 - 24554824 _____ (NVIDIA Corporation) E:\Windows\SysWOW64\nvoglv32.dll
    2014-11-10 01:34 - 2014-10-29 23:53 - 20966504 _____ (NVIDIA Corporation) E:\Windows\system32\nvwgf2umx.dll
    2014-11-10 01:34 - 2014-10-29 23:53 - 20922696 _____ (NVIDIA Corporation) E:\Windows\system32\nvcompiler.dll
    2014-11-10 01:34 - 2014-10-29 23:53 - 19966856 _____ (NVIDIA Corporation) E:\Windows\system32\nvd3dumx.dll
    2014-11-10 01:34 - 2014-10-29 23:53 - 18497600 _____ (NVIDIA Corporation) E:\Windows\SysWOW64\nvwgf2um.dll
    2014-11-10 01:34 - 2014-10-29 23:53 - 17258696 _____ (NVIDIA Corporation) E:\Windows\SysWOW64\nvcompiler.dll
    2014-11-10 01:34 - 2014-10-29 23:53 - 14029400 _____ (NVIDIA Corporation) E:\Windows\system32\nvopencl.dll
    2014-11-10 01:34 - 2014-10-29 23:53 - 13942368 _____ (NVIDIA Corporation) E:\Windows\system32\nvcuda.dll
    2014-11-10 01:34 - 2014-10-29 23:53 - 13189832 _____ (NVIDIA Corporation) E:\Windows\system32\Drivers\nvlddmkm.sys
    2014-11-10 01:34 - 2014-10-29 23:53 - 11395672 _____ (NVIDIA Corporation) E:\Windows\SysWOW64\nvopencl.dll
    2014-11-10 01:34 - 2014-10-29 23:53 - 04289856 _____ (NVIDIA Corporation) E:\Windows\system32\nvcuvid.dll
    2014-11-10 01:34 - 2014-10-29 23:53 - 04011840 _____ (NVIDIA Corporation) E:\Windows\SysWOW64\nvcuvid.dll
    2014-11-10 01:34 - 2014-10-29 23:53 - 01876296 _____ (NVIDIA Corporation) E:\Windows\system32\nvdispco6434460.dll
    2014-11-10 01:34 - 2014-10-29 23:53 - 01539272 _____ (NVIDIA Corporation) E:\Windows\system32\nvdispgenco6434460.dll
    2014-11-10 01:34 - 2014-10-29 23:53 - 00961224 _____ (NVIDIA Corporation) E:\Windows\system32\NvIFR64.dll
    2014-11-10 01:34 - 2014-10-29 23:53 - 00932168 _____ (NVIDIA Corporation) E:\Windows\system32\NvFBC64.dll
    2014-11-10 01:34 - 2014-10-29 23:53 - 00922944 _____ (NVIDIA Corporation) E:\Windows\SysWOW64\NvIFR.dll
    2014-11-10 01:34 - 2014-10-29 23:53 - 00896144 _____ (NVIDIA Corporation) E:\Windows\SysWOW64\NvFBC.dll
    2014-11-10 01:34 - 2014-10-29 23:53 - 00870112 _____ (NVIDIA Corporation) E:\Windows\SysWOW64\nvumdshim.dll
    2014-11-10 01:34 - 2014-10-29 23:53 - 00352016 _____ (NVIDIA Corporation) E:\Windows\system32\nvoglshim64.dll
    2014-11-10 01:34 - 2014-10-29 23:53 - 00303600 _____ (NVIDIA Corporation) E:\Windows\SysWOW64\nvoglshim32.dll
    2014-11-10 01:34 - 2014-10-29 23:53 - 00174856 _____ (NVIDIA Corporation) E:\Windows\system32\nvinitx.dll
    2014-11-10 01:34 - 2014-10-29 23:53 - 00156840 _____ (NVIDIA Corporation) E:\Windows\SysWOW64\nvinit.dll
    2014-11-07 20:46 - 2014-11-07 20:46 - 00028616 _____ () E:\Users\Calvin\Documents\gas pedal strip 2002.veg
    2014-11-07 01:44 - 2014-11-07 01:44 - 00001142 _____ () E:\Users\Public\Desktop\Kaspersky Anti-Virus.lnk
    2014-11-07 01:44 - 2014-11-07 01:44 - 00000000 ____D () E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kaspersky Anti-Virus
    2014-11-07 01:44 - 2013-05-06 09:13 - 00110176 _____ (Kaspersky Lab ZAO) E:\Windows\system32\klfphc.dll
    2014-11-07 01:43 - 2014-11-12 20:12 - 00000000 ____D () E:\ProgramData\Kaspersky Lab
    2014-11-07 01:43 - 2014-11-07 01:52 - 00793800 _____ (Kaspersky Lab ZAO) E:\Windows\system32\Drivers\klif.sys
    2014-11-07 01:43 - 2014-11-07 01:52 - 00141320 _____ (Kaspersky Lab ZAO) E:\Windows\system32\Drivers\klflt.sys
    2014-11-07 01:43 - 2014-11-07 01:43 - 00000000 ____D () E:\Windows\ELAMBKUP
    2014-11-07 01:43 - 2014-11-07 01:43 - 00000000 ____D () E:\Program Files (x86)\Kaspersky Lab
    2014-11-07 01:43 - 2014-04-10 17:25 - 00243808 _____ (Kaspersky Lab ZAO) E:\Windows\system32\Drivers\klhk.sys
    2014-10-28 14:42 - 2014-10-28 14:42 - 00148177 _____ () E:\Users\Calvin\Downloads\jfsplit-1_0_1-jar.jar
    2014-10-28 13:52 - 2014-10-28 14:18 - 2291925688 _____ () E:\Users\Calvin\Downloads\snowleopard_10a432_userdvd.dmg
    2014-10-26 13:26 - 2014-10-26 13:27 - 83703231 _____ () E:\Users\Calvin\Documents\Untitled2.mp4
    2014-10-26 13:25 - 2014-10-26 13:27 - 00879480 _____ () E:\Users\Calvin\Documents\Untitled.mp3.sfk
    2014-10-26 13:11 - 2014-10-26 13:11 - 06180375 _____ () E:\Users\Calvin\Documents\michael.mp4
    2014-10-25 14:52 - 2014-10-25 14:53 - 00000000 ____D () E:\Users\Calvin\Downloads\The Brothers Karamazov by Fyodor Dostoyevsky
    2014-10-24 23:39 - 2014-10-24 23:39 - 00000574 _____ () E:\Windows\system32\https--fbcdn-sphotos-h-a.akamaihd.net-hphotos-ak-xpa1-v-t35.0-12-10742617_10152839449518384_1006.jpgoh=720b803d4b753965de926b89b08a9f90&oe=544E0A80&__gda__=1414407085_fdf4d4fe57b498a2076095bd5caec628.lnk
    2014-10-23 15:53 - 2014-10-23 15:53 - 00000000 ___RD () E:\Users\Calvin\AppData\Roaming\Brother
    2014-10-23 11:12 - 2014-10-29 21:10 - 02558792 _____ (NVIDIA Corporation) E:\Windows\system32\nvsvcr.dll
    2014-10-23 11:12 - 2014-10-16 11:54 - 01876296 _____ (NVIDIA Corporation) E:\Windows\system32\nvdispco6434448.dll
    2014-10-23 11:12 - 2014-10-16 11:54 - 01539272 _____ (NVIDIA Corporation) E:\Windows\system32\nvdispgenco6434448.dll
    2014-10-20 21:59 - 2014-10-20 23:36 - 00000000 ____D () E:\Users\Calvin\Downloads\random pics to send
    2014-10-20 21:58 - 2014-11-08 16:39 - 00000000 ____D () E:\Users\Calvin\Downloads\yung lean
    2014-10-20 21:57 - 2014-10-26 18:13 - 00000000 ____D () E:\Users\Calvin\Downloads\B01 Study
    2014-10-20 21:57 - 2014-10-25 01:22 - 00000000 ____D () E:\Users\Calvin\Downloads\Lily
    2014-10-20 21:57 - 2014-10-20 22:01 - 00000000 ____D () E:\Users\Calvin\Downloads\B65 Study
    2014-10-18 18:55 - 2014-10-18 18:55 - 00000000 ____D () E:\Users\Calvin\Documents\Max
    2014-10-18 18:55 - 2014-10-18 18:55 - 00000000 ____D () E:\Users\Calvin\AppData\Roaming\Cycling '74
    2014-10-18 18:44 - 2014-10-18 18:44 - 00000000 ____D () E:\Users\Calvin\AppData\Roaming\FLEXnet
    2014-10-16 11:41 - 2014-10-16 11:41 - 00004298 _____ () E:\Windows\SysWOW64\jupdate-1.7.0_71-b14.log
    2014-10-16 11:41 - 2014-10-16 11:41 - 00000000 ____D () E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
    2014-10-13 13:02 - 2014-10-13 13:03 - 11543512 _____ () E:\Users\Calvin\Documents\cuffs.mp4
    2014-10-13 11:54 - 2014-10-13 11:54 - 03315714 _____ () E:\Users\Calvin\Documents\elliot soft.mp4

    ==================== One Month Modified Files and Folders =======

    (If an entry is included in the fixlist, the file\folder will be moved.)

    2014-11-12 20:19 - 2013-12-17 21:53 - 00000000 ____D () E:\Users\Calvin\AppData\Roaming\uTorrent
    2014-11-12 20:18 - 2009-07-14 00:13 - 00779266 _____ () E:\Windows\system32\PerfStringBackup.INI
    2014-11-12 20:17 - 2009-07-13 23:45 - 00010016 ____H () E:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
    2014-11-12 20:17 - 2009-07-13 23:45 - 00010016 ____H () E:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
    2014-11-12 20:15 - 2013-12-17 18:31 - 00389363 _____ () E:\Windows\WindowsUpdate.log
    2014-11-12 20:13 - 2013-12-17 19:53 - 00000000 ____D () E:\Users\Calvin\AppData\Roaming\Skype
    2014-11-12 20:12 - 2014-03-08 18:24 - 00094656 _____ (CACE Technologies) E:\Windows\system32\WPRO_41_2001woem.tmp
    2014-11-12 20:12 - 2014-01-02 19:04 - 00000000 ____D () E:\ProgramData\NVIDIA
    2014-11-12 20:12 - 2013-12-18 21:58 - 00000000 ____D () E:\Users\Calvin\AppData\Roaming\FAHClient
    2014-11-12 20:12 - 2013-12-18 16:07 - 00000000 ____D () E:\Users\Calvin\AppData\Roaming\Dropbox
    2014-11-12 20:12 - 2013-12-17 20:15 - 00000000 ____D () E:\ProgramData\Origin
    2014-11-12 20:12 - 2013-12-17 20:13 - 00000000 ____D () E:\Program Files (x86)\Steam
    2014-11-12 20:12 - 2013-12-17 18:43 - 00728466 _____ () E:\Windows\PFRO.log
    2014-11-12 20:12 - 2013-12-17 18:43 - 00034752 _____ () E:\Windows\system32\Drivers\WPRO_41_2001.sys
    2014-11-12 20:12 - 2013-12-17 18:43 - 00000894 _____ () E:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
    2014-11-12 20:12 - 2009-07-14 00:08 - 00000006 ____H () E:\Windows\Tasks\SA.DAT
    2014-11-12 20:12 - 2009-07-13 23:51 - 00106049 _____ () E:\Windows\setupact.log
    2014-11-12 19:49 - 2009-07-13 21:34 - 00000215 _____ () E:\Windows\system.ini
    2014-11-12 19:28 - 2014-08-16 04:22 - 00131800 _____ (Malwarebytes Corporation) E:\Windows\system32\Drivers\MBAMSwissArmy.sys
    2014-11-12 19:27 - 2014-08-16 04:22 - 00096472 _____ (Malwarebytes Corporation) E:\Windows\system32\Drivers\mbamchameleon.sys
    2014-11-12 19:25 - 2013-12-17 18:43 - 00000898 _____ () E:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
    2014-11-12 19:19 - 2014-09-11 06:14 - 00000000 ____D () E:\Users\Calvin\AppData\Local\Last.fm
    2014-11-12 17:20 - 2013-12-17 18:43 - 00003894 _____ () E:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
    2014-11-12 17:20 - 2013-12-17 18:43 - 00003642 _____ () E:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
    2014-11-12 15:11 - 2014-08-21 23:30 - 00000000 ____D () E:\Users\Calvin\AppData\Local\Adobe
    2014-11-12 05:00 - 2013-12-17 22:23 - 00000000 ____D () E:\Users\Calvin\AppData\Roaming\vlc
    2014-11-12 03:15 - 2013-12-05 15:24 - 00000000 ____D () E:\Users\Calvin\Downloads\Random Sound Clips
    2014-11-11 05:02 - 2013-12-17 18:41 - 00000000 ____D () E:\Users\Calvin\AppData\Local\Google
    2014-11-11 04:37 - 2009-07-14 00:32 - 00000000 ____D () E:\Windows\addins
    2014-11-11 04:31 - 2014-01-01 15:21 - 00000000 ____D () E:\Users\Calvin\AppData\Roaming\Mozilla
    2014-11-10 23:40 - 2014-01-29 20:54 - 00000132 _____ () E:\Users\Calvin\AppData\Roaming\Adobe PNG Format CS6 Prefs
    2014-11-10 23:34 - 2014-05-29 03:04 - 00000000 ____D () E:\Users\Calvin\Downloads\Pics
    2014-11-10 20:05 - 2014-03-11 23:04 - 00119808 ___SH () E:\Users\Calvin\Documents\Thumbs.db
    2014-11-10 19:34 - 2014-07-08 02:42 - 00001041 _____ () E:\Users\Calvin\Desktop\WinX HD Video Converter Deluxe.lnk
    2014-11-10 01:36 - 2013-12-17 19:11 - 00000000 ____D () E:\Users\Calvin\AppData\Local\CrashDumps
    2014-11-10 01:36 - 2013-12-17 18:46 - 00000000 ____D () E:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
    2014-11-10 01:35 - 2013-12-17 18:45 - 00000000 ____D () E:\Program Files (x86)\NVIDIA Corporation
    2014-11-07 01:41 - 2014-08-16 04:22 - 00001105 _____ () E:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
    2014-11-07 01:41 - 2014-08-16 04:22 - 00000000 ____D () E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
    2014-11-07 01:41 - 2014-08-16 04:22 - 00000000 ____D () E:\Program Files (x86)\Malwarebytes Anti-Malware
    2014-11-05 18:31 - 2013-12-28 03:40 - 00000000 ____D () E:\Program Files (x86)\JDownloader
    2014-11-05 18:15 - 2013-12-17 20:08 - 00000000 ____D () E:\Users\Calvin\AppData\Local\Battle.net
    2014-11-04 02:46 - 2014-06-17 04:47 - 00000000 ____D () E:\Users\Calvin\Desktop\txt
    2014-11-04 02:09 - 2009-07-13 22:20 - 00000000 ____D () E:\Windows\system32\NDF
    2014-11-01 16:22 - 2013-12-20 09:29 - 00000000 ____D () E:\Users\Calvin\AppData\Roaming\Audacity
    2014-10-29 23:53 - 2014-06-20 16:18 - 11333848 _____ (NVIDIA Corporation) E:\Windows\SysWOW64\nvcuda.dll
    2014-10-29 23:53 - 2013-12-17 19:04 - 16886168 _____ (NVIDIA Corporation) E:\Windows\SysWOW64\nvd3dum.dll
    2014-10-29 23:53 - 2013-12-17 19:04 - 03237528 _____ (NVIDIA Corporation) E:\Windows\system32\nvapi64.dll
    2014-10-29 23:53 - 2013-12-17 19:04 - 02849224 _____ (NVIDIA Corporation) E:\Windows\SysWOW64\nvapi.dll
    2014-10-29 23:53 - 2013-12-17 19:04 - 00987008 _____ (NVIDIA Corporation) E:\Windows\system32\nvumdshimx.dll
    2014-10-29 23:53 - 2013-12-17 19:04 - 00027024 _____ () E:\Windows\system32\nvinfo.pb
    2014-10-29 21:39 - 2013-12-17 20:10 - 00000000 ____D () E:\Program Files (x86)\Hearthstone
    2014-10-29 21:10 - 2014-01-02 19:03 - 06880968 _____ (NVIDIA Corporation) E:\Windows\system32\nvcpl.dll
    2014-10-29 21:10 - 2014-01-02 19:03 - 03533632 _____ (NVIDIA Corporation) E:\Windows\system32\nvsvc64.dll
    2014-10-29 21:10 - 2014-01-02 19:03 - 00935232 _____ (NVIDIA Corporation) E:\Windows\system32\nvvsvc.exe
    2014-10-29 21:10 - 2014-01-02 19:03 - 00385352 _____ (NVIDIA Corporation) E:\Windows\system32\nvmctray.dll
    2014-10-29 21:10 - 2014-01-02 19:03 - 00061640 _____ (NVIDIA Corporation) E:\Windows\system32\nvshext.dll
    2014-10-29 20:58 - 2014-01-12 17:58 - 00000000 ____D () E:\Users\Calvin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
    2014-10-29 20:58 - 2013-12-17 20:08 - 00000000 ____D () E:\Program Files (x86)\Battle.net
    2014-10-28 16:19 - 2014-01-26 12:32 - 00000000 ____D () E:\Users\Calvin\AppData\Local\Wing 101 4
    2014-10-28 16:19 - 2014-01-26 12:31 - 00000000 ____D () E:\Users\Calvin\AppData\Roaming\Wing 101 4
    2014-10-28 04:20 - 2014-09-27 15:52 - 00000000 ___RD () E:\Program Files (x86)\Skype
    2014-10-28 04:20 - 2013-12-17 19:53 - 00000000 ____D () E:\ProgramData\Skype
    2014-10-26 19:34 - 2014-01-02 19:03 - 04066553 _____ () E:\Windows\system32\nvcoproc.bin
    2014-10-23 11:25 - 2014-08-30 15:18 - 00000000 ____D () E:\Users\Calvin\AppData\Roaming\Mp3tag
    2014-10-22 13:15 - 2014-09-22 18:19 - 00000000 ____D () E:\Users\Calvin\Documents\ArcheAge
    2014-10-21 01:36 - 2014-09-21 11:07 - 00000000 ____D () E:\Users\Calvin\Downloads\Inferno_ A Novel
    2014-10-18 18:56 - 2013-12-17 19:25 - 00000000 ____D () E:\Windows\system32\appmgmt
    2014-10-18 18:44 - 2014-01-01 15:21 - 00000000 ____D () E:\Program Files (x86)\Mozilla Maintenance Service
    2014-10-18 18:44 - 2014-01-01 15:21 - 00000000 ____D () E:\Program Files (x86)\Mozilla Firefox
    2014-10-18 18:44 - 2009-07-13 23:45 - 04930520 _____ () E:\Windows\system32\FNTCACHE.DAT
    2014-10-16 11:49 - 2013-12-18 08:09 - 00000000 ____D () E:\ProgramData\Oracle
    2014-10-16 11:41 - 2013-12-18 08:09 - 00000000 ____D () E:\Program Files (x86)\Java
    2014-10-15 17:45 - 2014-10-06 22:38 - 00000000 ____D () E:\ProgramData\Nuance
    2014-10-13 17:33 - 2014-09-28 02:48 - 00001014 _____ () E:\Users\Public\Desktop\TeamSpeak 3 Client.lnk

    Some content of TEMP:
    ====================
    E:\Users\Calvin\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmped4ci7.dll
    E:\Users\Calvin\AppData\Local\Temp\Quarantine.exe
    E:\Users\Calvin\AppData\Local\Temp\sqlite3.dll


    ==================== Bamital & volsnap Check =================

    (There is no automatic fix for files that do not pass verification.)

    E:\Windows\System32\winlogon.exe => File is digitally signed
    E:\Windows\System32\wininit.exe => File is digitally signed
    E:\Windows\SysWOW64\wininit.exe => File is digitally signed
    E:\Windows\explorer.exe => File is digitally signed
    E:\Windows\SysWOW64\explorer.exe => File is digitally signed
    E:\Windows\System32\svchost.exe => File is digitally signed
    E:\Windows\SysWOW64\svchost.exe => File is digitally signed
    E:\Windows\System32\services.exe => File is digitally signed
    E:\Windows\System32\User32.dll => File is digitally signed
    E:\Windows\SysWOW64\User32.dll => File is digitally signed
    E:\Windows\System32\userinit.exe => File is digitally signed
    E:\Windows\SysWOW64\userinit.exe => File is digitally signed
    E:\Windows\System32\rpcss.dll => File is digitally signed
    E:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


    LastRegBack: 2014-11-05 00:28

    ==================== End Of Log ============================
     
  20. cokeguy

    cokeguy TS Rookie Topic Starter Posts: 21

    Last log! The addition.txt
    I will be back in a few hours, thanks again

    Additional scan result of Farbar Recovery Scan Tool (x64) Version: 10-11-2014
    Ran by Calvin at 2014-11-12 20:20:35
    Running from E:\Users\Calvin\Downloads
    Boot Mode: Normal
    ==========================================================


    ==================== Security Center ========================

    (If an entry is included in the fixlist, it will be removed.)

    AV: Kaspersky Anti-Virus (Disabled - Up to date) {179979E8-273D-D14E-0543-2861940E4886}
    AS: Kaspersky Anti-Virus (Disabled - Up to date) {ACF8980C-0107-DEC0-3FF3-1313EF89023B}
    AS: Windows Defender (Enabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

    ==================== Installed Programs ======================

    (Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

    µTorrent (HKU\S-1-5-21-1199268278-559096122-390045334-1000\...\uTorrent) (Version: 3.4.2.34944 - BitTorrent Inc.)
    Adobe After Effects CS6 (HKLM-x32\...\{4817D846-700B-474E-A31B-80892B3E92E3}) (Version: 11 - Adobe Systems Incorporated)
    Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 3.1.0.4880 - Adobe Systems Incorporated)
    Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.223 - Adobe Systems Incorporated)
    Adobe Help Manager (HKLM-x32\...\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 4.0.244 - Adobe Systems Incorporated)
    Adobe Photoshop CS6 (HKLM-x32\...\{74EB3499-8B95-4B5C-96EB-7B342F3FD0C6}) (Version: 13.0 - Adobe Systems Incorporated)
    Adobe Reader 9.5.5 (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-A95000000001}) (Version: 9.5.5 - Adobe Systems Incorporated)
    Archeage (HKLM-x32\...\Glyph Archeage) (Version: - Trion Worlds, Inc.)
    Archeblade (HKLM-x32\...\Steam App 207230) (Version: - CodeBrush Games)
    ASIO4ALL (HKLM-x32\...\ASIO4ALL) (Version: 2.11 - Michael Tippach)
    ASRock eXtreme Tuner v0.1.270 (HKLM-x32\...\ASRock eXtreme Tuner_is1) (Version: - )
    ASRock InstantBoot v1.29 (HKLM-x32\...\ASRock InstantBoot_is1) (Version: - )
    ASRock XFast RAM v2.0.9 (HKLM\...\ASRock XFast RAM_is1) (Version: - ASRock Inc.)
    Audacity 2.0.5 (HKLM-x32\...\Audacity_is1) (Version: 2.0.5 - Audacity Team)
    Battle.net (HKLM-x32\...\Battle.net) (Version: - Blizzard Entertainment)
    Battlefield 3™ (HKLM-x32\...\{76285C16-411A-488A-BCE3-C83CB933D8CF}) (Version: 1.6.0.0 - Electronic Arts)
    Battlelog Web Plugins (HKLM-x32\...\Battlelog Web Plugins) (Version: 2.5.1 - EA Digital Illusions CE AB)
    Belkin Setup and Router Monitor (HKLM-x32\...\Belkin Setup and Router Monitor_is1) (Version: - )
    Belkin USB Print and Storage Center (HKLM\...\Belkin USB Print and Storage Center) (Version: 1.1.4 - Belkin International, Inc.)
    BF3 Borderless (HKLM\...\{52A384E2-343B-4FD1-BE97-068D973F267E}) (Version: 1.2 - Realmware)
    BioShock Infinite (HKLM-x32\...\Steam App 8870) (Version: - Irrational Games)
    Brother MFL-Pro Suite HL-2280DW (HKLM-x32\...\{3ACCCFB3-7B17-4E9F-ACB0-46868FCD4487}) (Version: 1.1.3.0 - Brother Industries, Ltd.)
    Burnout™ Paradise: The Ultimate Box (HKLM-x32\...\{9A996B6A-846E-4A89-B9C4-17546B7BE49F}) (Version: 1.1.0.0 - Electronic Arts)
    CDisplay 1.8 (HKLM-x32\...\CDisplay_is1) (Version: - dvd8n)
    Counter-Strike: Global Offensive (HKLM-x32\...\Steam App 730) (Version: - Valve)
    CPUID CPU-Z 1.67.1 (HKLM\...\CPUID CPU-Z_is1) (Version: - )
    CPUID HWMonitor 1.24 (HKLM\...\CPUID HWMonitor_is1) (Version: - )
    dBpoweramp [Calculate Audio CRC] Codec (HKLM-x32\...\dBpoweramp [Calculate Audio CRC] Codec) (Version: Release 1 - Illustrate)
    dBpoweramp Dalet Codec (HKLM-x32\...\dBpoweramp Dalet Codec) (Version: Release 5 - Illustrate)
    dBpoweramp DSP Effects (HKLM-x32\...\dBpoweramp DSP Effects) (Version: Release 9 - Illustrate)
    dBpoweramp Monkeys Audio Codec (HKLM-x32\...\dBpoweramp Monkeys Audio Codec) (Version: Release 10 (Monkeys v4.06) - Illustrate)
    dBpoweramp mp3 (Fraunhofer IIS) Codec (HKLM-x32\...\dBpoweramp mp3 (Fraunhofer IIS) Codec) (Version: Release 2a (v4.0.3) - Illustrate)
    dBpoweramp Music Converter (HKLM-x32\...\dBpoweramp Music Converter) (Version: Release 14.4 - Illustrate)
    dBpoweramp Ogg Vorbis Codec (HKLM-x32\...\dBpoweramp Ogg Vorbis Codec) (Version: Release 21 (Vorbis v1.3.2) - Illustrate)
    dBPowerAMP Real Audio (Helix) Encoder (HKLM-x32\...\dBPowerAMP Real Audio (Helix) Encoder) (Version: Release 6 - Illustrate)
    dBpoweramp WavPack Codec (HKLM-x32\...\dBpoweramp WavPack Codec) (Version: Release 8 (WavPack v4.60) - Illustrate)
    Deckadance 2 (HKLM-x32\...\Deckadance 2) (Version: 2.0 - Image-Line)
    DirectWave (HKLM-x32\...\DirectWave) (Version: - Image-Line)
    Dropbox (HKU\S-1-5-21-1199268278-559096122-390045334-1000\...\Dropbox) (Version: 2.10.30 - Dropbox, Inc.)
    DX10 (HKLM-x32\...\DX10) (Version: - Image-Line)
    Edison (HKLM-x32\...\Edison) (Version: - Image-Line)
    EPUB File Reader (HKLM-x32\...\{818C5857-5C74-4CAC-9F43-E5597086852D}_is1) (Version: - )
    Evolve (HKLM\...\{670B1B49-9FD3-4827-9B41-471EFF580AA8}) (Version: 1.8.8 - Echobit, LLC)
    f.lux (HKU\S-1-5-21-1199268278-559096122-390045334-1000\...\Flux) (Version: - )
    FAHClient (HKLM-x32\...\FAHClient) (Version: 7.3.6 - Stanford University)
    Fallout New Vegas (HKLM-x32\...\Fallout New Vegas_is1) (Version: - )
    FL Studio 11 (HKLM-x32\...\FL Studio 11) (Version: - Image-Line)
    FlowStone FL 3.0 (HKLM-x32\...\FlowStone) (Version: - )
    Glyph (HKLM-x32\...\Glyph) (Version: - Trion Worlds, Inc.)
    Google Chrome (HKLM-x32\...\Google Chrome) (Version: 38.0.2125.111 - Google Inc.)
    Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
    Groove Machine (HKLM-x32\...\Groove Machine) (Version: - Image-Line)
    GunboundIS (HKLM-x32\...\GunboundIS_is1) (Version: - Softnyx co.,ltd.)
    Guns and Robots (HKLM-x32\...\Steam App 293540) (Version: - Masthead Studios Ltd)
    GunZ 2: The Second Duel (HKLM-x32\...\Steam App 242720) (Version: - MAIET Entertainment)
    Hardcore (HKLM-x32\...\Hardcore) (Version: - Image-Line bvba)
    Hearthstone (HKLM-x32\...\Hearthstone) (Version: - Blizzard Entertainment)
    Heaven Benchmark version 4.0 (HKLM-x32\...\Unigine Heaven Benchmark (Basic Edition)_is1) (Version: 4.0 - Unigine Corp.)
    IL Download Manager (HKLM-x32\...\IL Download Manager) (Version: - Image-Line)
    IL DrumSynth Live (HKLM-x32\...\IL DrumSynth Live) (Version: - Image-Line)
    IL Gross Beat (HKLM-x32\...\IL Gross Beat) (Version: - Image-Line)
    IL Juice Pack (HKLM-x32\...\IL Juice Pack) (Version: - Image-Line)
    IL MiniHost (HKLM-x32\...\IL MiniHost) (Version: - Image-Line)
    IL Shared Libraries (HKLM-x32\...\IL Shared Libraries) (Version: - Image-Line)
    IL Vocodex (HKLM-x32\...\IL Vocodex) (Version: - Image-Line)
    InfiniteCrisis_7C9F5EC32A45 (HKLM-x32\...\InfiniteCrisis_7C9F5EC32A45) (Version: - Turbine, Inc)
    Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1008 - Intel Corporation)
    Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1252 - Intel Corporation)
    Intel(R) OpenCL CPU Runtime (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: - Intel Corporation)
    Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2761 - Intel Corporation)
    Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.2.0.1006 - Intel Corporation)
    Intel(R) Smart Connect Technology 2.0 x64 (HKLM\...\{D1B033E8-A077-4B0D-9831-5798E19E861E}) (Version: 2.0.1083.0 - Intel)
    Intel(R) Update Manager (HKLM-x32\...\{12914061-EB9B-4AE7-AC7E-0B8A607C7DF4}) (Version: 2.3.1338 - Intel Corporation)
    Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 1.0.5.235 - Intel Corporation)
    Java 7 Update 71 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217045FF}) (Version: 7.0.710 - Oracle)
    JDownloader 0.9 (HKLM-x32\...\5513-1208-7298-9440) (Version: 0.9 - AppWork GmbH)
    Kaspersky Anti-Virus (HKLM-x32\...\InstallWIX_{653C1B5A-3287-47B1-8613-0745D4E771C4}) (Version: 15.0.0.463 - Kaspersky Lab)
    Kaspersky Anti-Virus (x32 Version: 15.0.0.463 - Kaspersky Lab) Hidden
    LAME v3.99.3 (for Windows) (HKLM-x32\...\LAME_is1) (Version: - )
    Last.fm Scrobbler 2.1.36 (HKLM-x32\...\LastFM_is1) (Version: - Last.fm)
    Logitech Gaming Software 8.55 (HKLM\...\Logitech Gaming Software) (Version: 8.55.137 - Logitech Inc.)
    Malwarebytes Anti-Malware version 2.0.3.1025 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.3.1025 - Malwarebytes Corporation)
    MapleStory (HKLM-x32\...\MapleStory) (Version: - )
    Maximus (HKLM-x32\...\Maximus) (Version: - Image-Line)
    Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30320 - Microsoft Corporation)
    Microsoft .NET Framework 4 Extended (HKLM\...\Microsoft .NET Framework 4 Extended) (Version: 4.0.30320 - Microsoft Corporation)
    Microsoft LifeCam (HKLM\...\{5CE7E3F5-9803-4F32-AA89-2D8848A80109}) (Version: 3.60.253.0 - Microsoft Corporation)
    Microsoft Office Professional Plus 2010 (HKLM\...\Office14.PROPLUS) (Version: 14.0.4763.1000 - Microsoft Corporation)
    Microsoft Silverlight (HKLM-x32\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
    Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
    Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
    Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
    Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.51106 (HKLM-x32\...\{8e70e4e1-06d7-470b-9f74-a51bef21088e}) (Version: 11.0.51106.1 - Microsoft Corporation)
    Microsoft XNA Framework Redistributable 4.0 (HKLM-x32\...\{2BFC7AA0-544C-4E3A-8796-67F3BE655BE9}) (Version: 4.0.20823.0 - Microsoft Corporation)
    MiKTeX 2.9 (HKLM\...\MiKTeX 2.9) (Version: 2.9 - MiKTeX.org)
    mIRC (HKLM-x32\...\mIRC) (Version: 7.25 - mIRC Co. Ltd.)
    Morphine (HKLM-x32\...\Morphine) (Version: - Image-Line bvba)
    Mozilla Firefox 30.0 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 30.0 (x86 en-US)) (Version: 30.0 - Mozilla)
    Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 30.0 - Mozilla)
    Mp3tag v2.63 (HKLM-x32\...\Mp3tag) (Version: v2.63 - Florian Heidenreich)
    MSI Afterburner 2.3.1 (HKLM-x32\...\Afterburner) (Version: 2.3.1 - MSI Co., LTD)
    MSVCRT Redists (Version: 1.0 - Sony Creative Software Inc.) Hidden
    MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
    MultiBit 0.5.16 (HKLM-x32\...\MultiBit 0.5.16) (Version: 0.5.16 - )
    MuseScore 1.3 (HKLM-x32\...\MuseScore) (Version: 1.3.0 - Werner Schweer and Others)
    Native Instruments Massive (HKLM-x32\...\Native Instruments Massive) (Version: - Native Instruments)
    Native Instruments Service Center (HKLM-x32\...\Native Instruments Service Center) (Version: - Native Instruments)
    Natural Selection 2 (HKLM-x32\...\Steam App 4920) (Version: - Unknown Worlds Entertainment)
    Nexon Game Manager (HKLM-x32\...\{EA2DB6E0-72C5-4ef9-A3A0-E6705F4A6A9E}) (Version: - )
    Nuance PaperPort 12 (HKLM-x32\...\{6C0A559F-8583-4B5A-8B50-20BEE15D8E64}) (Version: 12.1.0000 - Nuance Communications, Inc.)
    Nuance PDF Viewer Plus (HKLM-x32\...\{28656860-4728-433C-8AD4-D1A930437BC8}) (Version: 5.30.3290 - Nuance Communications, Inc)
    NVIDIA 3D Vision Controller Driver 344.46 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 344.46 - NVIDIA Corporation)
    NVIDIA 3D Vision Driver 344.60 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 344.60 - NVIDIA Corporation)
    NVIDIA GeForce Experience 2.1.2 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.1.2 - NVIDIA Corporation)
    NVIDIA Graphics Driver 344.60 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 344.60 - NVIDIA Corporation)
    NVIDIA HD Audio Driver 1.3.32.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.32.1 - NVIDIA Corporation)
    NVIDIA PhysX System Software 9.14.0702 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.14.0702 - NVIDIA Corporation)
    NyxLauncherIS (HKLM-x32\...\NyxLauncherIS_is1) (Version: - Softnyx co.,ltd.)
    Origin (HKLM-x32\...\Origin) (Version: 9.4.6.2792 - Electronic Arts, Inc.)
    ORION: Dino Horde (HKLM-x32\...\Steam App 104900) (Version: - Spiral Game Studios)
    PaperPort Image Printer 64-bit (HKLM\...\{715CAACC-579B-4831-A5F4-A83A8DE3EFE2}) (Version: 1.00.0001 - Nuance Communications, Inc.)
    Path of Exile (HKLM-x32\...\Steam App 238960) (Version: - Grinding Gear Games)
    PDF Settings CS6 (x32 Version: 11.0 - Adobe Systems Incorporated) Hidden
    PSUCalc (HKLM-x32\...\{F03A4724-EBD9-42DF-BCBC-107DD1A520BF}) (Version: 1.5.0000 - PSUCalc)
    PunkBuster Services (HKLM-x32\...\PunkBusterSvc) (Version: 0.993 - Even Balance, Inc.)
    Python 3.3.3 (64-bit) (HKLM\...\{e9d90870-ab19-32a8-aa93-f8348ba21d05}) (Version: 3.3.3150 - Python Software Foundation)
    Ragnarok (HKLM-x32\...\Steam App 215100) (Version: - Gravity Interactive)
    Razer Synapse 2.0 (HKLM-x32\...\{0D78BEE2-F8FF-4498-AF1A-3FF81CED8AC6}) (Version: 1.17.22 - Razer Inc.)
    Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.48.823.2011 - Realtek)
    Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6690 - Realtek Semiconductor Corp.)
    reFX Slayer Demo 2.6.0 (HKLM-x32\...\reFX Slayer Demo 2.6.0_is1) (Version: - )
    Robocraft (HKLM-x32\...\Steam App 301520) (Version: - Freejam)
    RocketDock 1.3.5 (HKLM-x32\...\RocketDock_is1) (Version: - Punk Software)
    Rust (HKLM-x32\...\Steam App 252490) (Version: - Facepunch Studios)
    Samsung Kies (HKLM-x32\...\InstallShield_{758C8301-2696-4855-AF45-534B1200980A}) (Version: 2.6.1.13105_7 - Samsung Electronics Co., Ltd.)
    Samsung Kies (x32 Version: 2.6.1.13105_7 - Samsung Electronics Co., Ltd.) Hidden
    SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.29.0 - SAMSUNG Electronics Co., Ltd.)
    Scansoft PDF Professional (x32 Version: - ) Hidden
    SHIELD Streaming (Version: 3.1.200 - NVIDIA Corporation) Hidden
    SHIELD Wireless Controller Driver (Version: 16.13.42 - NVIDIA Corporation) Hidden
    Skype™ 6.21 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 6.21.104 - Skype Technologies S.A.)
    Sony Mobile Update Engine (HKLM-x32\...\Update Engine) (Version: 2.14.10.201407111005 - Sony Mobile Communications AB)
    Sony PC Companion 2.10.228 (HKLM-x32\...\{F09EF8F2-0976-42C1-8D9D-8DF78337C6E3}) (Version: 2.10.228 - Sony)
    Steam (HKLM-x32\...\Steam) (Version: - Valve Corporation)
    Strife (HKLM-x32\...\Strife) (Version: - S2 Games)
    Team Fortress Classic (HKLM-x32\...\Steam App 20) (Version: - Valve)
    TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.16 - TeamSpeak Systems GmbH)
    TechPowerUp GPU-Z (HKLM-x32\...\TechPowerUp GPU-Z) (Version: - TechPowerUp)
    TeXstudio 2.5.2 (HKLM-x32\...\TeXstudio_is1) (Version: 2.5.2 - Benito van der Zander)
    TikiOne Steam Cleaner (HKLM-x32\...\TikiOneSteamCleaner) (Version: - Jonathan Lermitage)
    Unity Web Player (HKU\S-1-5-21-1199268278-559096122-390045334-1000\...\UnityWebPlayer) (Version: - Unity Technologies ApS)
    Universe Gamers Gunz (HKLM-x32\...\Universe Gamers Gunz) (Version: - )
    Unlocker 1.9.2 (HKLM\...\Unlocker) (Version: 1.9.2 - Cedrick Collomb)
    Unturned (HKLM-x32\...\Steam App 304930) (Version: - Nelson Sexton)
    Vegas Pro 13.0 (64-bit) (HKLM\...\{CDA02BF0-BFBC-11E3-AFA0-F04DA23A5C58}) (Version: 13.0.290 - Sony)
    Video Mover (HKLM-x32\...\Video Mover_is1) (Version: - )
    VirtualCloneDrive (HKLM-x32\...\VirtualCloneDrive) (Version: - Elaborate Bytes)
    VLC media player (HKLM-x32\...\VLC media player) (Version: 2.1.5 - VideoLAN)
    Winamp (HKLM-x32\...\Winamp) (Version: 5.66 - Nullsoft, Inc)
    Wing IDE 101 4.1.13-1 (HKLM-x32\...\Wing IDE 101 4.1_is1) (Version: - )
    WinRAR 4.20 (64-bit) (HKLM\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)
    WinX HD Video Converter Deluxe 5.0.7 (HKLM-x32\...\WinX HD Video Converter Deluxe_is1) (Version: - Digiarty Software, Inc.)
    XFast LAN v6.61 (HKLM\...\XFast LAN) (Version: 6.61 - cFos Software GmbH, Bonn)
    XFastUSB (HKLM-x32\...\XFastUSB) (Version: 3.02.30 - ASRock Inc.)
    ZIP Password Unlocker (HKLM-x32\...\{FC309FDB-7E37-47B9-9CCB-A4A9898507D1}_is1) (Version: - ZIP Password Unlocker, Inc.)

    ==================== Custom CLSID (selected items): ==========================

    (If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

    CustomCLSID: HKU\S-1-5-21-1199268278-559096122-390045334-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> E:\Users\Calvin\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
    CustomCLSID: HKU\S-1-5-21-1199268278-559096122-390045334-1000_Classes\CLSID\{355EC88A-02E2-4547-9DEE-F87426484BD1}\InprocServer32 -> E:\Users\Calvin\AppData\Local\Google\Update\1.3.23.9\psuser_64.dll No File
    CustomCLSID: HKU\S-1-5-21-1199268278-559096122-390045334-1000_Classes\CLSID\{90B3DFBF-AF6A-4EA0-8899-F332194690F8}\InprocServer32 -> E:\Users\Calvin\AppData\Local\Google\Update\1.3.24.15\psuser_64.dll No File
    CustomCLSID: HKU\S-1-5-21-1199268278-559096122-390045334-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> E:\Users\Calvin\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
    CustomCLSID: HKU\S-1-5-21-1199268278-559096122-390045334-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> E:\Users\Calvin\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
    CustomCLSID: HKU\S-1-5-21-1199268278-559096122-390045334-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> E:\Users\Calvin\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
    CustomCLSID: HKU\S-1-5-21-1199268278-559096122-390045334-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> E:\Users\Calvin\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
    CustomCLSID: HKU\S-1-5-21-1199268278-559096122-390045334-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> E:\Users\Calvin\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
    CustomCLSID: HKU\S-1-5-21-1199268278-559096122-390045334-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> E:\Users\Calvin\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
    CustomCLSID: HKU\S-1-5-21-1199268278-559096122-390045334-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> E:\Users\Calvin\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
    CustomCLSID: HKU\S-1-5-21-1199268278-559096122-390045334-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> E:\Users\Calvin\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
    CustomCLSID: HKU\S-1-5-21-1199268278-559096122-390045334-1000_Classes\CLSID\{FE498BAB-CB4C-4F88-AC3F-3641AAAF5E9E}\InprocServer32 -> E:\Users\Calvin\AppData\Local\Google\Update\1.3.24.7\psuser_64.dll No File

    ==================== Restore Points =========================

    13-11-2014 00:05:52 avast! antivirus system restore point
    13-11-2014 00:18:40 avast! antivirus system restore point
    13-11-2014 00:27:00 After RogueKiller

    ==================== Hosts content: ==========================

    (If needed Hosts: directive could be included in the fixlist to reset Hosts.)

    2009-07-13 21:34 - 2014-11-12 19:48 - 00000027 ____A E:\Windows\system32\Drivers\etc\hosts
    127.0.0.1 localhost

    ==================== Scheduled Tasks (whitelisted) =============

    (If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

    Task: {33684E24-3358-40F3-842B-25AEA5BAD4D0} - System32\Tasks\GoogleUpdateTaskMachineUA => E:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-12-17] (Google Inc.)
    Task: {6A428EAE-0DF4-42B0-99AE-B9000E978A92} - System32\Tasks\Adobe Flash Player Updater => E:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-11-12] (Adobe Systems Incorporated)
    Task: {70BFBCDA-DA50-493F-A1F4-ED0F3F3708DF} - System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473 => E:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [2014-02-28] ()
    Task: {AE758D44-0277-4619-ACBC-DFFC560482B2} - System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473-Logon => E:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [2014-02-28] ()
    Task: {D0A9652A-D204-470F-93F6-B536C1423EC8} - System32\Tasks\GoogleUpdateTaskMachineCore => E:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-12-17] (Google Inc.)
    Task: E:\Windows\Tasks\Adobe Flash Player Updater.job => E:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
    Task: E:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => E:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    Task: E:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => E:\Program Files (x86)\Google\Update\GoogleUpdate.exe

    ==================== Loaded Modules (whitelisted) =============

    2014-03-20 07:42 - 2011-04-19 15:31 - 00181760 ____N () E:\Program Files\Belkin\Belkin USB Print and Storage Center\BkBackupScheduler.exe
    2014-03-20 07:42 - 2010-02-09 14:55 - 00055296 ____N () E:\Program Files\Belkin\Belkin USB Print and Storage Center\Bkapcs.exe
    2012-02-09 16:26 - 2012-02-09 16:26 - 00133632 _____ () E:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe
    2012-02-09 16:26 - 2012-02-09 16:26 - 00048128 _____ () E:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\NetworkHeuristic.dll
    2012-02-09 16:26 - 2012-02-09 16:26 - 00036864 _____ () E:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\ISCTNetDetect.dll
    2014-02-11 17:03 - 2014-07-10 23:54 - 00076152 _____ () E:\Windows\SysWOW64\PnkBstrA.exe
    2014-01-02 19:03 - 2014-10-29 21:10 - 00117064 _____ () E:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
    2013-12-17 18:36 - 2012-05-20 21:38 - 00094208 _____ () E:\Windows\System32\IccLibDll_x64.dll
    2014-07-28 13:29 - 2014-07-28 13:29 - 00866584 _____ () E:\Program Files\Logitech Gaming Software\libGLESv2.dll
    2014-07-28 13:32 - 2014-07-28 13:32 - 01050904 _____ () E:\Program Files\Logitech Gaming Software\platforms\qwindows.dll
    2014-07-28 13:29 - 2014-07-28 13:29 - 00059160 _____ () E:\Program Files\Logitech Gaming Software\libEGL.dll
    2014-07-28 13:31 - 2014-07-28 13:31 - 00242456 _____ () E:\Program Files\Logitech Gaming Software\imageformats\qjpeg.dll
    2013-12-17 19:59 - 2007-09-02 13:58 - 00495616 _____ () E:\Program Files (x86)\RocketDock\RocketDock.exe
    2014-03-15 17:51 - 2014-06-23 08:07 - 00113376 _____ () E:\Program Files (x86)\Sony\Sony PC Companion\PCCompanionInfo.exe
    2013-02-18 18:28 - 2013-02-18 18:28 - 14800896 _____ () E:\Program Files (x86)\FAHClient\FAHClient.exe
    2014-03-20 07:42 - 2011-04-19 15:31 - 00150016 ____N () E:\Program Files\Belkin\Belkin USB Print and Storage Center\BkLocalBackup.dll
    2014-03-20 07:41 - 2011-12-07 12:06 - 00022944 _____ () E:\Program Files (x86)\Belkin\Router Setup and Monitor\BelkinServicePS.dll
    2013-12-17 19:59 - 2007-09-02 13:57 - 00069632 _____ () E:\Program Files (x86)\RocketDock\RocketDock.dll
    2013-12-17 20:50 - 2013-12-17 20:50 - 00718848 _____ () E:\Windows\assembly\NativeImages_v4.0.30319_32\SteamHelper\d2cbbd7777ff6ac532563eb1d2446050\SteamHelper.ni.dll
    2013-12-17 20:50 - 2013-12-17 20:50 - 00189440 _____ () E:\Program Files\Echobit\Evolve\libidn.dll
    2013-12-17 20:50 - 2013-12-17 20:50 - 00047616 _____ () E:\Program Files\Echobit\Evolve\boost_thread-vc100-mt-1_46_1.dll
    2013-12-17 20:50 - 2013-12-17 20:50 - 00044032 _____ () E:\Program Files\Echobit\Evolve\boost_date_time-vc100-mt-1_46_1.dll
    2013-12-17 20:50 - 2013-12-17 20:50 - 00046592 _____ () E:\Program Files\Echobit\Evolve\boost_signals-vc100-mt-1_46_1.dll
    2013-12-17 20:50 - 2013-12-17 20:50 - 00135168 _____ () E:\Program Files\Echobit\Evolve\boost_filesystem-vc100-mt-1_46_1.dll
    2013-12-17 20:50 - 2013-12-17 20:50 - 00015360 _____ () E:\Program Files\Echobit\Evolve\boost_system-vc100-mt-1_46_1.dll
    2013-12-17 20:50 - 2013-12-17 20:50 - 00611328 _____ () E:\Program Files\Echobit\Evolve\boost_regex-vc100-mt-1_46_1.dll
    2013-12-17 20:50 - 2013-12-17 20:50 - 00321536 _____ () E:\Program Files\Echobit\Evolve\boost_program_options-vc100-mt-1_46_1.dll
    2013-12-17 20:50 - 2013-12-17 20:50 - 00079360 _____ () E:\Program Files\Echobit\Evolve\EvolveEasyHook_32.dll
    2013-12-17 20:50 - 2013-12-17 20:50 - 38599680 _____ () E:\Program Files\Echobit\Evolve\libcef.DLL
    2014-03-15 17:51 - 2012-04-30 10:57 - 00039936 _____ () E:\Program Files (x86)\Sony\Sony PC Companion\TMonitorAPI.dll
    2014-03-15 17:51 - 2013-09-13 10:02 - 00208896 _____ () E:\Program Files (x86)\Sony\Sony PC Companion\MExplorer.dll
    2011-07-07 13:54 - 2011-07-07 13:54 - 00233984 _____ () E:\Program Files (x86)\Sony\Sony PC Companion\Report.dll
    2014-03-15 17:51 - 2013-05-20 11:58 - 00620718 _____ () E:\Program Files (x86)\Sony\Sony PC Companion\sqlite3.dll
    2014-03-15 17:51 - 2010-01-11 15:44 - 00053248 _____ () E:\Program Files (x86)\Sony\Sony PC Companion\VObject.dll
    2014-06-12 09:19 - 2014-06-12 09:19 - 00643584 _____ () E:\Program Files (x86)\Sony\Sony PC Companion\PhoneUpdate.dll
    2014-11-12 20:12 - 2014-11-12 20:12 - 00043008 _____ () e:\users\calvin\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmped4ci7.dll
    2013-08-23 14:01 - 2013-08-23 14:01 - 25100288 _____ () E:\Users\Calvin\AppData\Roaming\Dropbox\bin\libcef.dll
    2014-08-28 18:19 - 2014-11-11 13:48 - 01171456 _____ () E:\Program Files (x86)\Steam\libavcodec-56.dll
    2014-08-28 18:19 - 2014-11-11 13:48 - 00442368 _____ () E:\Program Files (x86)\Steam\libavutil-54.dll
    2014-08-28 18:19 - 2014-11-11 13:48 - 00332800 _____ () E:\Program Files (x86)\Steam\libavresample-2.dll
    2013-12-17 20:14 - 2014-11-11 13:47 - 00774656 _____ () E:\Program Files (x86)\Steam\SDL2.dll
    2014-05-21 18:14 - 2014-11-11 20:04 - 02227904 _____ () E:\Program Files (x86)\Steam\video.dll
    2014-08-28 18:19 - 2014-11-11 13:48 - 00403968 _____ () E:\Program Files (x86)\Steam\libavformat-56.dll
    2014-08-28 18:19 - 2014-11-11 13:48 - 00485888 _____ () E:\Program Files (x86)\Steam\libswscale-3.dll
    2013-12-17 20:14 - 2014-11-11 20:04 - 00690880 _____ () E:\Program Files (x86)\Steam\bin\chromehtml.DLL
    2014-03-20 07:41 - 2010-08-22 19:01 - 00325632 _____ () E:\Program Files (x86)\Belkin\Router Setup and Monitor\QtXml4.dll
    2014-03-20 07:41 - 2010-08-22 19:01 - 01954304 _____ () E:\Program Files (x86)\Belkin\Router Setup and Monitor\QtCore4.dll
    2014-03-20 07:41 - 2010-08-22 19:01 - 07187456 _____ () E:\Program Files (x86)\Belkin\Router Setup and Monitor\QtGui4.dll
    2014-03-20 07:41 - 2010-08-22 19:01 - 00847360 _____ () E:\Program Files (x86)\Belkin\Router Setup and Monitor\QtNetwork4.dll
    2014-03-20 07:41 - 2010-08-22 18:32 - 00119808 _____ () E:\Program Files (x86)\Belkin\Router Setup and Monitor\imageformats\qjpeg4.dll
    2014-03-20 07:41 - 2011-12-07 11:29 - 00669184 _____ () E:\Program Files (x86)\Belkin\Router Setup and Monitor\gateways\GenericBelkinGatewayLOC.dll
    2013-12-17 20:14 - 2014-11-11 13:48 - 34589888 _____ () E:\Program Files (x86)\Steam\bin\libcef.dll
    2013-12-17 20:50 - 2013-12-17 20:50 - 38599680 _____ () E:\Program Files\Echobit\Evolve\libcef.dll
    2013-12-17 20:50 - 2013-12-17 20:50 - 00874496 _____ () E:\Program Files\Echobit\Evolve\ffmpegsumo.dll
    2014-08-14 12:56 - 2014-11-11 13:48 - 00837824 _____ () E:\Program Files (x86)\Steam\bin\ffmpegsumo.dll
    2013-12-17 18:39 - 2013-12-17 18:39 - 00172544 _____ () E:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\c0efb322f8364c8759531666774c0627\IsdiInterop.ni.dll
    2013-12-17 18:39 - 2012-05-30 13:55 - 00059904 _____ () E:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll
    2013-12-17 18:41 - 2012-06-25 10:41 - 01198912 _____ () E:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
    2014-10-27 15:20 - 2014-10-21 23:04 - 01042760 _____ () E:\Program Files (x86)\Google\Chrome\Application\38.0.2125.111\libglesv2.dll
    2014-10-27 15:20 - 2014-10-21 23:04 - 00211272 _____ () E:\Program Files (x86)\Google\Chrome\Application\38.0.2125.111\libegl.dll
    2014-10-27 15:20 - 2014-10-21 23:04 - 08910664 _____ () E:\Program Files (x86)\Google\Chrome\Application\38.0.2125.111\pdf.dll
    2014-10-27 15:20 - 2014-10-21 23:04 - 01681224 _____ () E:\Program Files (x86)\Google\Chrome\Application\38.0.2125.111\ffmpegsumo.dll
    2014-10-27 15:20 - 2014-10-21 23:05 - 14902600 _____ () E:\Program Files (x86)\Google\Chrome\Application\38.0.2125.111\PepperFlash\pepflashplayer.dll

    ==================== Alternate Data Streams (whitelisted) =========

    (If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

    AlternateDataStreams: E:\Program Files\Common Files\System:M6Z7J4bLoVKswYqtdlEr
    AlternateDataStreams: E:\ProgramData\Microsoft:I5iZESjff46SMgOimzb9DQX
    AlternateDataStreams: E:\ProgramData\Microsoft:y4atmG0JWc1ctnFRbaEwMOS
    AlternateDataStreams: E:\Users\Calvin\Cookies:Dw4oZoQEs4jhSmzSZRXsvWz

    ==================== Safe Mode (whitelisted) ===================

    (If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart => ""="Service"
    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys => ""="Driver"
    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\PEVSystemStart => ""="Service"
    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\procexp90.Sys => ""="Driver"

    ==================== EXE Association (whitelisted) =============

    (If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


    ==================== MSCONFIG/TASK MANAGER disabled items =========

    (Currently there is no automatic fix for this section.)


    ========================= Accounts: ==========================

    Administrator (S-1-5-21-1199268278-559096122-390045334-500 - Administrator - Disabled)
    Calvin (S-1-5-21-1199268278-559096122-390045334-1000 - Administrator - Enabled) => E:\Users\Calvin
    Guest (S-1-5-21-1199268278-559096122-390045334-501 - Limited - Disabled)
    HomeGroupUser$ (S-1-5-21-1199268278-559096122-390045334-1002 - Limited - Enabled)

    ==================== Faulty Device Manager Devices =============


    ==================== Event log errors: =========================

    Application errors:
    ==================

    System errors:
    =============

    Microsoft Office Sessions:
    =========================

    CodeIntegrity Errors:
    ===================================
    Date: 2014-11-12 19:44:01.309
    Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume1\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

    Date: 2014-11-12 19:44:01.306
    Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume1\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

    Date: 2014-11-12 08:13:23.865
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\ELAMBKUP\klelam.sys because the set of per-page image hashes could not be found on the system.

    Date: 2014-11-12 08:13:23.864
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\ELAMBKUP\klelam.sys because the set of per-page image hashes could not be found on the system.

    Date: 2014-11-12 08:13:23.864
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\ELAMBKUP\klelam.sys because the set of per-page image hashes could not be found on the system.

    Date: 2014-11-12 08:13:23.861
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\KLELAMX64\klelam.sys because the set of per-page image hashes could not be found on the system.

    Date: 2014-11-12 08:13:23.861
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\KLELAMX64\klelam.sys because the set of per-page image hashes could not be found on the system.

    Date: 2014-11-12 08:13:23.859
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\KLELAMX64\klelam.sys because the set of per-page image hashes could not be found on the system.

    Date: 2014-11-11 07:50:44.914
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\ELAMBKUP\klelam.sys because the set of per-page image hashes could not be found on the system.

    Date: 2014-11-11 07:50:44.914
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\ELAMBKUP\klelam.sys because the set of per-page image hashes could not be found on the system.


    ==================== Memory info ===========================

    Processor: Intel(R) Core(TM) i5-3570K CPU @ 3.40GHz
    Percentage of memory in use: 42%
    Total physical RAM: 8073.64 MB
    Available physical RAM: 4673.91 MB
    Total Pagefile: 16145.42 MB
    Available Pagefile: 12284.65 MB
    Total Virtual: 8192 MB
    Available Virtual: 8191.81 MB

    ==================== Drives ================================

    Drive c: () (Fixed) (Total:1863.01 GB) (Free:870.33 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
    Drive d: () (Fixed) (Total:298.09 GB) (Free:18.6 GB) NTFS
    Drive e: (SSD) (Fixed) (Total:119.24 GB) (Free:27.94 GB) NTFS
    Drive z: () (Network) (Total:152.67 GB) (Free:142.63 GB)

    ==================== MBR & Partition Table ==================

    ========================================================
    Disk: 0 (MBR Code: Windows 7 or 8) (Size: 119.2 GB) (Disk ID: 94918886)
    Partition 1: (Not Active) - (Size=119.2 GB) - (Type=07 NTFS)

    ========================================================
    Disk: 1 (MBR Code: Windows 7 or 8) (Size: 1863 GB) (Disk ID: 9307F35D)
    Partition 1: (Active) - (Size=1863 GB) - (Type=07 NTFS)

    ========================================================
    Disk: 2 (Size: 298.1 GB) (Disk ID: 004DFDDF)
    Partition 1: (Not Active) - (Size=298.1 GB) - (Type=07 NTFS)

    ==================== End Of Log ============================
     
  21. Broni

    Broni Malware Annihilator Posts: 52,892   +344

    Download attached fixlist.txt file and save it to the Desktop.
    NOTE. It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work.

    NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

    Run FRST(FRST64) and press the Fix button just once and wait.
    The tool will make a log on the Desktop (Fixlog.txt). Please post it to your reply.
     

    Attached Files:

  22. cokeguy

    cokeguy TS Rookie Topic Starter Posts: 21

    Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 10-11-2014
    Ran by Calvin at 2014-11-12 22:32:03 Run:1
    Running from E:\Users\Calvin\Downloads
    Loaded Profile: Calvin (Available profiles: Calvin)
    Boot Mode: Normal
    ==============================================

    Content of fixlist:
    *****************
    HKLM-x32\...\Run: [] => [X]
    HKU\S-1-5-21-1199268278-559096122-390045334-1000\...\Run: [ASRockXTU] => [X]
    HKU\S-1-5-21-1199268278-559096122-390045334-1000\...\Run: [zASRockInstantBoot] => [X]
    HKU\S-1-5-21-1199268278-559096122-390045334-1000\...\Run: [AdobeBridge] => [X]
    ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => No File
    ProxyServer: 179.43.143.126:8089
    HKU\S-1-5-21-1199268278-559096122-390045334-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
    CHR HKLM\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho []
    CHR HKLM-x32\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho []
    S3 catchme; \??\E:\ComboFix\catchme.sys [X]
    S3 EagleX64; \??\E:\Windows\system32\drivers\EagleX64.sys [X]
    S3 MSICDSetup; \??\G:\CDriver64.sys [X]
    E:\Users\Calvin\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmped4ci7.dll
    E:\Users\Calvin\AppData\Local\Temp\Quarantine.exe
    E:\Users\Calvin\AppData\Local\Temp\sqlite3.dll
    CustomCLSID: HKU\S-1-5-21-1199268278-559096122-390045334-1000_Classes\CLSID\{355EC88A-02E2-4547-9DEE-F87426484BD1}\InprocServer32 -> E:\Users\Calvin\AppData\Local\Google\Update\1.3.23.9\psuser_64.dll No File
    CustomCLSID: HKU\S-1-5-21-1199268278-559096122-390045334-1000_Classes\CLSID\{90B3DFBF-AF6A-4EA0-8899-F332194690F8}\InprocServer32 -> E:\Users\Calvin\AppData\Local\Google\Update\1.3.24.15\psuser_64.dll No File
    CustomCLSID: HKU\S-1-5-21-1199268278-559096122-390045334-1000_Classes\CLSID\{FE498BAB-CB4C-4F88-AC3F-3641AAAF5E9E}\InprocServer32 -> E:\Users\Calvin\AppData\Local\Google\Update\1.3.24.7\psuser_64.dll No File
    AlternateDataStreams: E:\Program Files\Common Files\System:M6Z7J4bLoVKswYqtdlEr
    AlternateDataStreams: E:\ProgramData\Microsoft:I5iZESjff46SMgOimzb9DQX
    AlternateDataStreams: E:\ProgramData\Microsoft:y4atmG0JWc1ctnFRbaEwMOS
    AlternateDataStreams: E:\Users\Calvin\Cookies:Dw4oZoQEs4jhSmzSZRXsvWz

    *****************

    HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\ => value deleted successfully.
    HKU\S-1-5-21-1199268278-559096122-390045334-1000\Software\Microsoft\Windows\CurrentVersion\Run\\ASRockXTU => value deleted successfully.
    HKU\S-1-5-21-1199268278-559096122-390045334-1000\Software\Microsoft\Windows\CurrentVersion\Run\\zASRockInstantBoot => value deleted successfully.
    HKU\S-1-5-21-1199268278-559096122-390045334-1000\Software\Microsoft\Windows\CurrentVersion\Run\\AdobeBridge => value deleted successfully.
    "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\00avast" => Key deleted successfully.
    "HKCR\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}" => Key not found.
    HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer => value deleted successfully.
    "HKU\S-1-5-21-1199268278-559096122-390045334-1000\SOFTWARE\Policies\Microsoft\Internet Explorer" => Key deleted successfully.
    "HKLM\SOFTWARE\Google\Chrome\Extensions\dbhjdbfgekjfcfkkfjjmlmojhbllhbho" => Key deleted successfully.
    "https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho" => File/Directory not found.
    "HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\dbhjdbfgekjfcfkkfjjmlmojhbllhbho" => Key deleted successfully.
    "https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho" => File/Directory not found.
    catchme => Service deleted successfully.
    EagleX64 => Service deleted successfully.
    MSICDSetup => Service deleted successfully.
    E:\Users\Calvin\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmped4ci7.dll => Moved successfully.
    E:\Users\Calvin\AppData\Local\Temp\Quarantine.exe => Moved successfully.
    E:\Users\Calvin\AppData\Local\Temp\sqlite3.dll => Moved successfully.
    "HKU\S-1-5-21-1199268278-559096122-390045334-1000_Classes\CLSID\{355EC88A-02E2-4547-9DEE-F87426484BD1}" => Key deleted successfully.
    "HKU\S-1-5-21-1199268278-559096122-390045334-1000_Classes\CLSID\{90B3DFBF-AF6A-4EA0-8899-F332194690F8}" => Key deleted successfully.
    "HKU\S-1-5-21-1199268278-559096122-390045334-1000_Classes\CLSID\{FE498BAB-CB4C-4F88-AC3F-3641AAAF5E9E}" => Key deleted successfully.
    E:\Program Files\Common Files\System => ":M6Z7J4bLoVKswYqtdlEr" ADS removed successfully.
    E:\ProgramData\Microsoft => ":I5iZESjff46SMgOimzb9DQX" ADS removed successfully.
    E:\ProgramData\Microsoft => ":y4atmG0JWc1ctnFRbaEwMOS" ADS removed successfully.
    "E:\Users\Calvin\Cookies" => ":Dw4oZoQEs4jhSmzSZRXsvWz" ADS not found.

    ==== End of Fixlog ====
     
  23. Broni

    Broni Malware Annihilator Posts: 52,892   +344

    How is computer doing?

    Last scans...

    [​IMG] Download Security Check from here or here and save it to your Desktop.
    • Double-click SecurityCheck.exe
    • Follow the onscreen instructions inside of the black box.
    • A Notepad document should open automatically called checkup.txt; please post the contents of that document.
    NOTE 1. If one of your security applications (e.g., third-party firewall) requests permission to allow DIG.EXE access the Internet, allow it to do so.
    NOTE 2. SecurityCheck may produce some false warning(s), so leave the results reading to me.
    NOTE 3. If you receive UNSUPPORTED OPERATING SYSTEM! ABORTED! message restart computer and Security Check should run


    [​IMG] Please download Farbar Service Scanner (FSS) and run it on the computer with the issue.
    • Make sure the following options are checked:
      • Internet Services
      • Windows Firewall
      • System Restore
      • Security Center
      • Windows Update
      • Windows Defender
      • Other Services
    • Press "Scan".
    • It will create a log (FSS.txt) in the same directory the tool is run.
    • Please copy and paste the log to your reply.

    [​IMG] Download Temp File Cleaner (TFC)
    Alternate download: http://www.itxassociates.com/OT-Tools/TFC.exe
    • Double click on TFC.exe to run the program.
    • Click on Start button to begin cleaning process.
    • TFC will close all running programs, and it may ask you to restart computer.

    [​IMG] Please run a free online scan with the ESET Online Scanner

    • Disable your antivirus program
    • Internet Explorer users - Click on this link to open ESET OnlineScan.
    • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
      • Click on ESET Smart Installer to download the ESET Smart Installer. Save it to your desktop.
      • Double click on the [img=[url]http://www.bleepstatic.com/fhost/uploads/0/esetsmartinstaller_enu.png][/url] icon on your desktop.
    • Check "YES, I accept the Terms of Use."
    • Click the Start button.
    • Accept any security warnings from your browser.
    • Check "Enable detection of potentially unwanted applications".
    • Click Advanced settings and make sure all 4 boxes are checkmarked (two of them are already checkmarked by default).
      Do NOT checkmark "Use custom proxy settings"
    • Click the Start button.
    • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
    • When the scan completes, click List Threats
    • Click Export, and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
    • Click the Back button.
    • Click the Finish button.
     
  24. cokeguy

    cokeguy TS Rookie Topic Starter Posts: 21

    Uh so far, no ads, but it's usually quiet for most of the time except for blips so I'm not sure.
     
  25. cokeguy

    cokeguy TS Rookie Topic Starter Posts: 21

    Results of screen317's Security Check version 0.99.89
    Windows 7 x64 (UAC is disabled!)
    Out of date service pack!!
    ``````````````Antivirus/Firewall Check:``````````````
    Windows Firewall Enabled!
    Kaspersky Anti-Virus
    Antivirus up to date!
    `````````Anti-malware/Other Utilities Check:`````````
    TikiOne Steam Cleaner
    Java 7 Update 71
    Java version out of Date!
    Adobe Flash Player 15.0.0.223
    Adobe Reader 9 Adobe Reader out of Date!
    Mozilla Firefox 30.0 Firefox out of Date!
    Google Chrome 38.0.2125.104
    Google Chrome 38.0.2125.111
    ````````Process Check: objlist.exe by Laurent````````
    Kaspersky Lab Kaspersky Anti-Virus 15.0.0 avp.exe
    Kaspersky Lab Kaspersky Anti-Virus 15.0.0 avpui.exe
    `````````````````System Health check`````````````````
    Total Fragmentation on Drive E: 9%
    ````````````````````End of Log``````````````````````
     

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...