TechSpot

Do I have a virus?

Solved
By theRadiantChild
Aug 14, 2014
  1. Did a scan with Malwarebytes and I exported the log...I did not clean anything yet

    Malwarebytes Anti-Malware
    www.malwarebytes.org

    Scan Date: 8/14/2014
    Scan Time: 7:57:22 AM
    Logfile: mbam.txt
    Administrator: Yes

    Version: 2.00.2.1012
    Malware Database: v2014.08.14.04
    Rootkit Database: v2014.08.04.01
    License: Trial
    Malware Protection: Enabled
    Malicious Website Protection: Enabled
    Self-protection: Disabled

    OS: Windows 7 Service Pack 1
    CPU: x64
    File System: NTFS
    User: Radiant

    Scan Type: Threat Scan
    Result: Completed
    Objects Scanned: 300585
    Time Elapsed: 5 min, 8 sec

    Memory: Enabled
    Startup: Enabled
    Filesystem: Enabled
    Archives: Enabled
    Rootkits: Disabled
    Heuristics: Enabled
    PUP: Warn
    PUM: Enabled

    Processes: 4
    PUP.Optional.EnhanceEmpire.A, C:\Program Files (x86)\EnhanceEmpire\updateEnhanceEmpire.exe, 3044, , [43395b6b7b00ea4cce63bdd939c8e51b]
    PUP.Optional.EnhanceEmpire.A, C:\Program Files (x86)\EnhanceEmpire\bin\utilEnhanceEmpire.exe, 3096, , [85f79e283f3ce6502f0293030ef32cd4]
    PUP.Optional.EnhanceEmpire.A, C:\Program Files (x86)\EnhanceEmpire\bin\EnhanceEmpire.BrowserAdapter.exe, 14368, , [3e3e1caa2c4f70c6e0f14b9c17eb1ce4]
    PUP.Optional.EnhanceEmpire.A, C:\Program Files (x86)\EnhanceEmpire\bin\EnhanceEmpire.PurBrowse64.exe, 4764, , [3e3e1caa2c4f70c6e0f14b9c17eb1ce4]

    Modules: 3
    PUP.Optional.EnhanceEmpire.A, C:\Program Files (x86)\EnhanceEmpire\bin\EnhanceEmpireBAApp.dll, , [3e3e1caa2c4f70c6e0f14b9c17eb1ce4],
    PUP.Optional.EnhanceEmpire.A, C:\Program Files (x86)\EnhanceEmpire\bin\{7951da45-7bdd-437b-929a-ec3e88ff6c84}.dll, , [3e3e1caa2c4f70c6e0f14b9c17eb1ce4],
    PUP.Optional.EnhanceEmpire.A, C:\Program Files (x86)\EnhanceEmpire\bin\{7951da45-7bdd-437b-929a-ec3e88ff6c84}.dll, , [3e3e1caa2c4f70c6e0f14b9c17eb1ce4],

    Registry Keys: 21
    PUP.Optional.EnhanceEmpire.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\Update EnhanceEmpire, , [43395b6b7b00ea4cce63bdd939c8e51b],
    PUP.Optional.EnhanceEmpire.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\Util EnhanceEmpire, , [85f79e283f3ce6502f0293030ef32cd4],
    PUP.Optional.BrowseFox.A, HKLM\SOFTWARE\CLASSES\CLSID\{4AA46D49-459F-4358-B4D1-169048547C23}, , [8eeec402bcbf83b3867b2b78e02254ac],
    PUP.Optional.BrowseFox.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{4AA46D49-459F-4358-B4D1-169048547C23}, , [8eeec402bcbf83b3867b2b78e02254ac],
    PUP.Optional.EnhanceEmpire.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{e39519a5-9d10-478c-98d8-9c486f3190a4}, , [c9b325a1403b68ce0bb6f17820e227d9],
    PUP.Optional.EnhanceEmpire.A, HKLM\SOFTWARE\CLASSES\TYPELIB\{046F59B8-3AB5-445C-B397-B7CFF9A1B2A3}, , [c9b325a1403b68ce0bb6f17820e227d9],
    PUP.Optional.EnhanceEmpire.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{375D4D68-E576-449F-B588-A1E17C29F32D}, , [c9b325a1403b68ce0bb6f17820e227d9],
    PUP.Optional.EnhanceEmpire.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{375D4D68-E576-449F-B588-A1E17C29F32D}, , [c9b325a1403b68ce0bb6f17820e227d9],
    PUP.Optional.EnhanceEmpire.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{046F59B8-3AB5-445C-B397-B7CFF9A1B2A3}, , [c9b325a1403b68ce0bb6f17820e227d9],
    PUP.Optional.EnhanceEmpire.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{E39519A5-9D10-478C-98D8-9C486F3190A4}, , [c9b325a1403b68ce0bb6f17820e227d9],
    PUP.Optional.Sanbreel.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\{75e31400-eac4-49b7-986c-d198f0b97db7}Gw64, , [7408d2f45229e452ba523ca43ac815eb],
    PUP.Optional.EnhanceEmpire.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\EnhanceEmpire, , [3e3e1caa2c4f70c6e0f14b9c17eb1ce4],
    PUP.Optional.EnhanceEmpire.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{5A4E3A41-FA55-4BDA-AED7-CEBE6E7BCB52}, , [3e3e1caa2c4f70c6e0f14b9c17eb1ce4],
    PUP.Optional.EnhanceEmpire.A, HKLM\SOFTWARE\CLASSES\TYPELIB\{A2D733A7-73B0-4C6B-B0C7-06A432950B66}, , [3e3e1caa2c4f70c6e0f14b9c17eb1ce4],
    PUP.Optional.EnhanceEmpire.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{4E6354DE-9115-4AEE-BD21-C46C3E8A49DB}, , [3e3e1caa2c4f70c6e0f14b9c17eb1ce4],
    PUP.Optional.EnhanceEmpire.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{FC073BDA-C115-4A1D-9DF9-9B5C461482E5}, , [3e3e1caa2c4f70c6e0f14b9c17eb1ce4],
    PUP.Optional.EnhanceEmpire.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{4E6354DE-9115-4AEE-BD21-C46C3E8A49DB}, , [3e3e1caa2c4f70c6e0f14b9c17eb1ce4],
    PUP.Optional.EnhanceEmpire.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{FC073BDA-C115-4A1D-9DF9-9B5C461482E5}, , [3e3e1caa2c4f70c6e0f14b9c17eb1ce4],
    PUP.Optional.EnhanceEmpire.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{A2D733A7-73B0-4C6B-B0C7-06A432950B66}, , [3e3e1caa2c4f70c6e0f14b9c17eb1ce4],
    PUP.Optional.EnhanceEmpire.A, HKLM\SOFTWARE\WOW6432NODE\EnhanceEmpire, , [7507d7ef91eaf2445b77bb2c3ac89a66],
    PUP.Optional.EnhanceEmpire.A, HKU\S-1-5-21-3277094342-1709878510-195001535-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\EnhanceEmpire, , [bac2daec6714e650ce0538af55adcc34],

    Registry Values: 0
    (No malicious items detected)

    Registry Data: 0
    (No malicious items detected)

    Folders: 4
    PUP.Optional.EnhanceEmpire.A, C:\Program Files (x86)\EnhanceEmpire, , [3e3e1caa2c4f70c6e0f14b9c17eb1ce4],
    PUP.Optional.EnhanceEmpire.A, C:\Program Files (x86)\EnhanceEmpire\bin, , [3e3e1caa2c4f70c6e0f14b9c17eb1ce4],
    PUP.Optional.EnhanceEmpire.A, C:\Program Files (x86)\EnhanceEmpire\bin\plugins, , [3e3e1caa2c4f70c6e0f14b9c17eb1ce4],
    PUP.Optional.EnhanceEmpire.A, C:\Program Files (x86)\EnhanceEmpire\bin\TEMP, , [3e3e1caa2c4f70c6e0f14b9c17eb1ce4],

    Files: 28
    PUP.Optional.EnhanceEmpire.A, C:\Program Files (x86)\EnhanceEmpire\updateEnhanceEmpire.exe, , [43395b6b7b00ea4cce63bdd939c8e51b],
    PUP.Optional.EnhanceEmpire.A, C:\Program Files (x86)\EnhanceEmpire\bin\utilEnhanceEmpire.exe, , [85f79e283f3ce6502f0293030ef32cd4],
    PUP.Optional.EnhanceEmpire.A, C:\Program Files (x86)\EnhanceEmpire\EnhanceEmpireBHO.dll, , [c9b325a1403b68ce0bb6f17820e227d9],
    PUP.Optional.OpenCandy, C:\Users\Radiant\Downloads\SetupImgBurn_2.5.8.0.exe, , [b1cb774f2952f64099e61ed6f50fd22e],
    PUP.Optional.Sanbreel.A, C:\Windows\System32\drivers\{75e31400-eac4-49b7-986c-d198f0b97db7}Gw64.sys, , [7408d2f45229e452ba523ca43ac815eb],
    PUP.Optional.EnhanceEmpire.A, C:\Program Files (x86)\EnhanceEmpire\EnhanceEmpire.ico, , [3e3e1caa2c4f70c6e0f14b9c17eb1ce4],
    PUP.Optional.EnhanceEmpire.A, C:\Program Files (x86)\EnhanceEmpire\0, , [3e3e1caa2c4f70c6e0f14b9c17eb1ce4],
    PUP.Optional.EnhanceEmpire.A, C:\Program Files (x86)\EnhanceEmpire\7za.exe, , [3e3e1caa2c4f70c6e0f14b9c17eb1ce4],
    PUP.Optional.EnhanceEmpire.A, C:\Program Files (x86)\EnhanceEmpire\EnhanceEmpireUninstall.exe, , [3e3e1caa2c4f70c6e0f14b9c17eb1ce4],
    PUP.Optional.EnhanceEmpire.A, C:\Program Files (x86)\EnhanceEmpire\updateEnhanceEmpire.InstallState, , [3e3e1caa2c4f70c6e0f14b9c17eb1ce4],
    PUP.Optional.EnhanceEmpire.A, C:\Program Files (x86)\EnhanceEmpire\bin\7za.exe, , [3e3e1caa2c4f70c6e0f14b9c17eb1ce4],
    PUP.Optional.EnhanceEmpire.A, C:\Program Files (x86)\EnhanceEmpire\bin\BrowserAdapterS.7z, , [3e3e1caa2c4f70c6e0f14b9c17eb1ce4],
    PUP.Optional.EnhanceEmpire.A, C:\Program Files (x86)\EnhanceEmpire\bin\EnhanceEmpire.BrowserAdapter.exe, , [3e3e1caa2c4f70c6e0f14b9c17eb1ce4],
    PUP.Optional.EnhanceEmpire.A, C:\Program Files (x86)\EnhanceEmpire\bin\EnhanceEmpire.PurBrowse64.exe, , [3e3e1caa2c4f70c6e0f14b9c17eb1ce4],
    PUP.Optional.EnhanceEmpire.A, C:\Program Files (x86)\EnhanceEmpire\bin\EnhanceEmpire.PurBrowseG.zip, , [3e3e1caa2c4f70c6e0f14b9c17eb1ce4],
    PUP.Optional.EnhanceEmpire.A, C:\Program Files (x86)\EnhanceEmpire\bin\EnhanceEmpireBAApp.dll, , [3e3e1caa2c4f70c6e0f14b9c17eb1ce4],
    PUP.Optional.EnhanceEmpire.A, C:\Program Files (x86)\EnhanceEmpire\bin\utilEnhanceEmpire.InstallState, , [3e3e1caa2c4f70c6e0f14b9c17eb1ce4],
    PUP.Optional.EnhanceEmpire.A, C:\Program Files (x86)\EnhanceEmpire\bin\{7951da45-7bdd-437b-929a-ec3e88ff6c84}.dll, , [3e3e1caa2c4f70c6e0f14b9c17eb1ce4],
    PUP.Optional.EnhanceEmpire.A, C:\Program Files (x86)\EnhanceEmpire\bin\plugins\EnhanceEmpire.Bromon.dll, , [3e3e1caa2c4f70c6e0f14b9c17eb1ce4],
    PUP.Optional.EnhanceEmpire.A, C:\Program Files (x86)\EnhanceEmpire\bin\plugins\EnhanceEmpire.BroStats.dll, , [3e3e1caa2c4f70c6e0f14b9c17eb1ce4],
    PUP.Optional.EnhanceEmpire.A, C:\Program Files (x86)\EnhanceEmpire\bin\plugins\EnhanceEmpire.BrowserAdapterS.dll, , [3e3e1caa2c4f70c6e0f14b9c17eb1ce4],
    PUP.Optional.EnhanceEmpire.A, C:\Program Files (x86)\EnhanceEmpire\bin\plugins\EnhanceEmpire.CompatibilityChecker.dll, , [3e3e1caa2c4f70c6e0f14b9c17eb1ce4],
    PUP.Optional.EnhanceEmpire.A, C:\Program Files (x86)\EnhanceEmpire\bin\plugins\EnhanceEmpire.FFUpdate.dll, , [3e3e1caa2c4f70c6e0f14b9c17eb1ce4],
    PUP.Optional.EnhanceEmpire.A, C:\Program Files (x86)\EnhanceEmpire\bin\plugins\EnhanceEmpire.IEUpdate.dll, , [3e3e1caa2c4f70c6e0f14b9c17eb1ce4],
    PUP.Optional.EnhanceEmpire.A, C:\Program Files (x86)\EnhanceEmpire\bin\plugins\EnhanceEmpire.PurBrowseG.dll, , [3e3e1caa2c4f70c6e0f14b9c17eb1ce4],
    PUP.Optional.EnhanceEmpire.A, C:\Program Files (x86)\EnhanceEmpire\bin\TEMP\mfs830C.tmp, , [3e3e1caa2c4f70c6e0f14b9c17eb1ce4],
    PUP.Optional.Superfish.A, C:\Users\Radiant\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.superfish.com_0.localstorage, , [a4d8a224d8a391a5a93fd41dd929af51],
    PUP.Optional.Superfish.A, C:\Users\Radiant\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.superfish.com_0.localstorage-journal, , [4d2fb016740752e444a4d71a639f1fe1],

    Physical Sectors: 0
    (No malicious items detected)


    (end)
     
  2. Broni

    Broni Malware Annihilator Posts: 47,078   +258

    Please, complete all steps listed here: http://www.techspot.com/vb/topic58138.html
    Make sure, you PASTE all logs. If some log exceeds 50,000 characters post limit, split it between couple of replies.
    Attached logs won't be reviewed.


    Please, observe following rules:
    • Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
    • If you're stuck, or you're not sure about certain step, always ask before doing anything else.
    • Please refrain from running any tools, fixes or applying any changes to your computer other than those I suggest.
    • Never run more than one scan at a time.
    • Keep updating me regarding your computer behavior, good, or bad.
    • The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
    • If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
    • I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

    ===================================

    Re-run MBAM and fix all issues.
     
  3. theRadiantChild

    theRadiantChild TS Enthusiast Topic Starter Posts: 319

    Malwarebytes Anti-Malware
    www.malwarebytes.org

    Scan Date: 8/14/2014
    Scan Time: 7:57:22 AM
    Logfile:
    Administrator: Yes

    Version: 2.00.2.1012
    Malware Database: v2014.08.14.04
    Rootkit Database: v2014.08.04.01
    License: Trial
    Malware Protection: Enabled
    Malicious Website Protection: Enabled
    Self-protection: Disabled

    OS: Windows 7 Service Pack 1
    CPU: x64
    File System: NTFS
    User: Radiant

    Scan Type: Threat Scan
    Result: Completed
    Objects Scanned: 300585
    Time Elapsed: 5 min, 8 sec

    Memory: Enabled
    Startup: Enabled
    Filesystem: Enabled
    Archives: Enabled
    Rootkits: Disabled
    Heuristics: Enabled
    PUP: Warn
    PUM: Enabled

    Processes: 4
    PUP.Optional.EnhanceEmpire.A, C:\Program Files (x86)\EnhanceEmpire\updateEnhanceEmpire.exe, 3044, Delete-on-Reboot, [43395b6b7b00ea4cce63bdd939c8e51b]
    PUP.Optional.EnhanceEmpire.A, C:\Program Files (x86)\EnhanceEmpire\bin\utilEnhanceEmpire.exe, 3096, Delete-on-Reboot, [85f79e283f3ce6502f0293030ef32cd4]
    PUP.Optional.EnhanceEmpire.A, C:\Program Files (x86)\EnhanceEmpire\bin\EnhanceEmpire.BrowserAdapter.exe, 14368, Delete-on-Reboot, [3e3e1caa2c4f70c6e0f14b9c17eb1ce4]
    PUP.Optional.EnhanceEmpire.A, C:\Program Files (x86)\EnhanceEmpire\bin\EnhanceEmpire.PurBrowse64.exe, 4764, Delete-on-Reboot, [3e3e1caa2c4f70c6e0f14b9c17eb1ce4]

    Modules: 3
    PUP.Optional.EnhanceEmpire.A, C:\Program Files (x86)\EnhanceEmpire\bin\EnhanceEmpireBAApp.dll, Delete-on-Reboot, [3e3e1caa2c4f70c6e0f14b9c17eb1ce4],
    PUP.Optional.EnhanceEmpire.A, C:\Program Files (x86)\EnhanceEmpire\bin\{7951da45-7bdd-437b-929a-ec3e88ff6c84}.dll, Delete-on-Reboot, [3e3e1caa2c4f70c6e0f14b9c17eb1ce4],
    PUP.Optional.EnhanceEmpire.A, C:\Program Files (x86)\EnhanceEmpire\bin\{7951da45-7bdd-437b-929a-ec3e88ff6c84}.dll, Delete-on-Reboot, [3e3e1caa2c4f70c6e0f14b9c17eb1ce4],

    Registry Keys: 21
    PUP.Optional.EnhanceEmpire.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\Update EnhanceEmpire, Quarantined, [43395b6b7b00ea4cce63bdd939c8e51b],
    PUP.Optional.EnhanceEmpire.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\Util EnhanceEmpire, Quarantined, [85f79e283f3ce6502f0293030ef32cd4],
    PUP.Optional.BrowseFox.A, HKLM\SOFTWARE\CLASSES\CLSID\{4AA46D49-459F-4358-B4D1-169048547C23}, Quarantined, [8eeec402bcbf83b3867b2b78e02254ac],
    PUP.Optional.BrowseFox.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{4AA46D49-459F-4358-B4D1-169048547C23}, Quarantined, [8eeec402bcbf83b3867b2b78e02254ac],
    PUP.Optional.EnhanceEmpire.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{e39519a5-9d10-478c-98d8-9c486f3190a4}, Quarantined, [c9b325a1403b68ce0bb6f17820e227d9],
    PUP.Optional.EnhanceEmpire.A, HKLM\SOFTWARE\CLASSES\TYPELIB\{046F59B8-3AB5-445C-B397-B7CFF9A1B2A3}, Quarantined, [c9b325a1403b68ce0bb6f17820e227d9],
    PUP.Optional.EnhanceEmpire.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{375D4D68-E576-449F-B588-A1E17C29F32D}, Quarantined, [c9b325a1403b68ce0bb6f17820e227d9],
    PUP.Optional.EnhanceEmpire.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{375D4D68-E576-449F-B588-A1E17C29F32D}, Quarantined, [c9b325a1403b68ce0bb6f17820e227d9],
    PUP.Optional.EnhanceEmpire.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{046F59B8-3AB5-445C-B397-B7CFF9A1B2A3}, Quarantined, [c9b325a1403b68ce0bb6f17820e227d9],
    PUP.Optional.EnhanceEmpire.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{E39519A5-9D10-478C-98D8-9C486F3190A4}, Quarantined, [c9b325a1403b68ce0bb6f17820e227d9],
    PUP.Optional.Sanbreel.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\{75e31400-eac4-49b7-986c-d198f0b97db7}Gw64, Quarantined, [7408d2f45229e452ba523ca43ac815eb],
    PUP.Optional.EnhanceEmpire.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\EnhanceEmpire, Quarantined, [3e3e1caa2c4f70c6e0f14b9c17eb1ce4],
    PUP.Optional.EnhanceEmpire.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{5A4E3A41-FA55-4BDA-AED7-CEBE6E7BCB52}, Quarantined, [3e3e1caa2c4f70c6e0f14b9c17eb1ce4],
    PUP.Optional.EnhanceEmpire.A, HKLM\SOFTWARE\CLASSES\TYPELIB\{A2D733A7-73B0-4C6B-B0C7-06A432950B66}, Quarantined, [3e3e1caa2c4f70c6e0f14b9c17eb1ce4],
    PUP.Optional.EnhanceEmpire.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{4E6354DE-9115-4AEE-BD21-C46C3E8A49DB}, Quarantined, [3e3e1caa2c4f70c6e0f14b9c17eb1ce4],
    PUP.Optional.EnhanceEmpire.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{FC073BDA-C115-4A1D-9DF9-9B5C461482E5}, Quarantined, [3e3e1caa2c4f70c6e0f14b9c17eb1ce4],
    PUP.Optional.EnhanceEmpire.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{4E6354DE-9115-4AEE-BD21-C46C3E8A49DB}, Quarantined, [3e3e1caa2c4f70c6e0f14b9c17eb1ce4],
    PUP.Optional.EnhanceEmpire.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{FC073BDA-C115-4A1D-9DF9-9B5C461482E5}, Quarantined, [3e3e1caa2c4f70c6e0f14b9c17eb1ce4],
    PUP.Optional.EnhanceEmpire.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{A2D733A7-73B0-4C6B-B0C7-06A432950B66}, Quarantined, [3e3e1caa2c4f70c6e0f14b9c17eb1ce4],
    PUP.Optional.EnhanceEmpire.A, HKLM\SOFTWARE\WOW6432NODE\EnhanceEmpire, Quarantined, [7507d7ef91eaf2445b77bb2c3ac89a66],
    PUP.Optional.EnhanceEmpire.A, HKU\S-1-5-21-3277094342-1709878510-195001535-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\EnhanceEmpire, Quarantined, [bac2daec6714e650ce0538af55adcc34],

    Registry Values: 0
    (No malicious items detected)

    Registry Data: 0
    (No malicious items detected)

    Folders: 4
    PUP.Optional.EnhanceEmpire.A, C:\Program Files (x86)\EnhanceEmpire, Delete-on-Reboot, [3e3e1caa2c4f70c6e0f14b9c17eb1ce4],
    PUP.Optional.EnhanceEmpire.A, C:\Program Files (x86)\EnhanceEmpire\bin, Delete-on-Reboot, [3e3e1caa2c4f70c6e0f14b9c17eb1ce4],
    PUP.Optional.EnhanceEmpire.A, C:\Program Files (x86)\EnhanceEmpire\bin\plugins, Quarantined, [3e3e1caa2c4f70c6e0f14b9c17eb1ce4],
    PUP.Optional.EnhanceEmpire.A, C:\Program Files (x86)\EnhanceEmpire\bin\TEMP, Quarantined, [3e3e1caa2c4f70c6e0f14b9c17eb1ce4],

    Files: 28
    PUP.Optional.EnhanceEmpire.A, C:\Program Files (x86)\EnhanceEmpire\updateEnhanceEmpire.exe, Delete-on-Reboot, [43395b6b7b00ea4cce63bdd939c8e51b],
    PUP.Optional.EnhanceEmpire.A, C:\Program Files (x86)\EnhanceEmpire\bin\utilEnhanceEmpire.exe, Delete-on-Reboot, [85f79e283f3ce6502f0293030ef32cd4],
    PUP.Optional.EnhanceEmpire.A, C:\Program Files (x86)\EnhanceEmpire\EnhanceEmpireBHO.dll, Quarantined, [c9b325a1403b68ce0bb6f17820e227d9],
    PUP.Optional.OpenCandy, C:\Users\Radiant\Downloads\SetupImgBurn_2.5.8.0.exe, Quarantined, [b1cb774f2952f64099e61ed6f50fd22e],
    PUP.Optional.Sanbreel.A, C:\Windows\System32\drivers\{75e31400-eac4-49b7-986c-d198f0b97db7}Gw64.sys, Quarantined, [7408d2f45229e452ba523ca43ac815eb],
    PUP.Optional.EnhanceEmpire.A, C:\Program Files (x86)\EnhanceEmpire\EnhanceEmpire.ico, Quarantined, [3e3e1caa2c4f70c6e0f14b9c17eb1ce4],
    PUP.Optional.EnhanceEmpire.A, C:\Program Files (x86)\EnhanceEmpire\0, Quarantined, [3e3e1caa2c4f70c6e0f14b9c17eb1ce4],
    PUP.Optional.EnhanceEmpire.A, C:\Program Files (x86)\EnhanceEmpire\7za.exe, Quarantined, [3e3e1caa2c4f70c6e0f14b9c17eb1ce4],
    PUP.Optional.EnhanceEmpire.A, C:\Program Files (x86)\EnhanceEmpire\EnhanceEmpireUninstall.exe, Quarantined, [3e3e1caa2c4f70c6e0f14b9c17eb1ce4],
    PUP.Optional.EnhanceEmpire.A, C:\Program Files (x86)\EnhanceEmpire\updateEnhanceEmpire.InstallState, Quarantined, [3e3e1caa2c4f70c6e0f14b9c17eb1ce4],
    PUP.Optional.EnhanceEmpire.A, C:\Program Files (x86)\EnhanceEmpire\bin\7za.exe, Quarantined, [3e3e1caa2c4f70c6e0f14b9c17eb1ce4],
    PUP.Optional.EnhanceEmpire.A, C:\Program Files (x86)\EnhanceEmpire\bin\BrowserAdapterS.7z, Quarantined, [3e3e1caa2c4f70c6e0f14b9c17eb1ce4],
    PUP.Optional.EnhanceEmpire.A, C:\Program Files (x86)\EnhanceEmpire\bin\EnhanceEmpire.BrowserAdapter.exe, Delete-on-Reboot, [3e3e1caa2c4f70c6e0f14b9c17eb1ce4],
    PUP.Optional.EnhanceEmpire.A, C:\Program Files (x86)\EnhanceEmpire\bin\EnhanceEmpire.PurBrowse64.exe, Delete-on-Reboot, [3e3e1caa2c4f70c6e0f14b9c17eb1ce4],
    PUP.Optional.EnhanceEmpire.A, C:\Program Files (x86)\EnhanceEmpire\bin\EnhanceEmpire.PurBrowseG.zip, Quarantined, [3e3e1caa2c4f70c6e0f14b9c17eb1ce4],
    PUP.Optional.EnhanceEmpire.A, C:\Program Files (x86)\EnhanceEmpire\bin\EnhanceEmpireBAApp.dll, Delete-on-Reboot, [3e3e1caa2c4f70c6e0f14b9c17eb1ce4],
    PUP.Optional.EnhanceEmpire.A, C:\Program Files (x86)\EnhanceEmpire\bin\utilEnhanceEmpire.InstallState, Quarantined, [3e3e1caa2c4f70c6e0f14b9c17eb1ce4],
    PUP.Optional.EnhanceEmpire.A, C:\Program Files (x86)\EnhanceEmpire\bin\{7951da45-7bdd-437b-929a-ec3e88ff6c84}.dll, Delete-on-Reboot, [3e3e1caa2c4f70c6e0f14b9c17eb1ce4],
    PUP.Optional.EnhanceEmpire.A, C:\Program Files (x86)\EnhanceEmpire\bin\plugins\EnhanceEmpire.Bromon.dll, Quarantined, [3e3e1caa2c4f70c6e0f14b9c17eb1ce4],
    PUP.Optional.EnhanceEmpire.A, C:\Program Files (x86)\EnhanceEmpire\bin\plugins\EnhanceEmpire.BroStats.dll, Quarantined, [3e3e1caa2c4f70c6e0f14b9c17eb1ce4],
    PUP.Optional.EnhanceEmpire.A, C:\Program Files (x86)\EnhanceEmpire\bin\plugins\EnhanceEmpire.BrowserAdapterS.dll, Quarantined, [3e3e1caa2c4f70c6e0f14b9c17eb1ce4],
    PUP.Optional.EnhanceEmpire.A, C:\Program Files (x86)\EnhanceEmpire\bin\plugins\EnhanceEmpire.CompatibilityChecker.dll, Quarantined, [3e3e1caa2c4f70c6e0f14b9c17eb1ce4],
    PUP.Optional.EnhanceEmpire.A, C:\Program Files (x86)\EnhanceEmpire\bin\plugins\EnhanceEmpire.FFUpdate.dll, Quarantined, [3e3e1caa2c4f70c6e0f14b9c17eb1ce4],
    PUP.Optional.EnhanceEmpire.A, C:\Program Files (x86)\EnhanceEmpire\bin\plugins\EnhanceEmpire.IEUpdate.dll, Quarantined, [3e3e1caa2c4f70c6e0f14b9c17eb1ce4],
    PUP.Optional.EnhanceEmpire.A, C:\Program Files (x86)\EnhanceEmpire\bin\plugins\EnhanceEmpire.PurBrowseG.dll, Quarantined, [3e3e1caa2c4f70c6e0f14b9c17eb1ce4],
    PUP.Optional.EnhanceEmpire.A, C:\Program Files (x86)\EnhanceEmpire\bin\TEMP\mfs830C.tmp, Quarantined, [3e3e1caa2c4f70c6e0f14b9c17eb1ce4],
    PUP.Optional.Superfish.A, C:\Users\Radiant\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.superfish.com_0.localstorage, Delete-on-Reboot, [a4d8a224d8a391a5a93fd41dd929af51],
    PUP.Optional.Superfish.A, C:\Users\Radiant\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.superfish.com_0.localstorage-journal, Quarantined, [4d2fb016740752e444a4d71a639f1fe1],

    Physical Sectors: 0
    (No malicious items detected)


    (end)
     
  4. theRadiantChild

    theRadiantChild TS Enthusiast Topic Starter Posts: 319

    .
    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT
    .
    DDS (Ver_2012-11-20.01)
    .
    Microsoft Windows 7 Home Premium
    Boot Device: \Device\HarddiskVolume4
    Install Date: 3/12/2013 2:30:17 AM
    System Uptime: 8/15/2014 9:36:35 AM (0 hours ago)
    .
    Motherboard: LENOVO | | 2306CTO
    Processor: Intel(R) Core(TM) i5-3210M CPU @ 2.50GHz | CPU Socket - U3E1 | 2501/100mhz
    .
    ==== Disk Partitions =========================
    .
    C: is FIXED (NTFS) - 223 GiB total, 149.895 GiB free.
    D: is FIXED (NTFS) - 1 GiB total, 0.753 GiB free.
    E: is FIXED (NTFS) - 283 GiB total, 201.981 GiB free.
    F: is FIXED (NTFS) - 14 GiB total, 2.351 GiB free.
    G: is CDROM ()
    Q: is FIXED (NTFS) - 14 GiB total, 3.378 GiB free.
    .
    ==== Disabled Device Manager Items =============
    .
    Class GUID:
    Description: Bluetooth Peripheral Device
    Device ID: BTHENUM\{936DA01F-9ABD-4D9D-80C7-02AF85C822A8}_VID&00010075_PID&0100\8&59DC476&0&0808C2714A28_C00000000
    Manufacturer:
    Name: Bluetooth Peripheral Device
    PNP Device ID: BTHENUM\{936DA01F-9ABD-4D9D-80C7-02AF85C822A8}_VID&00010075_PID&0100\8&59DC476&0&0808C2714A28_C00000000
    Service:
    .
    Class GUID:
    Description: Bluetooth Peripheral Device
    Device ID: BTHENUM\{B3093027-F77A-4C37-860A-6502360DDA76}_VID&00010075_PID&0100\8&59DC476&0&0808C2714A28_C00000000
    Manufacturer:
    Name: Bluetooth Peripheral Device
    PNP Device ID: BTHENUM\{B3093027-F77A-4C37-860A-6502360DDA76}_VID&00010075_PID&0100\8&59DC476&0&0808C2714A28_C00000000
    Service:
    .
    Class GUID:
    Description: Bluetooth Peripheral Device
    Device ID: BTHENUM\{453994D5-D58B-96F9-6616-B37F586BA2EC}_VID&00010075_PID&0100\8&59DC476&0&0808C2714A28_C00000000
    Manufacturer:
    Name: Bluetooth Peripheral Device
    PNP Device ID: BTHENUM\{453994D5-D58B-96F9-6616-B37F586BA2EC}_VID&00010075_PID&0100\8&59DC476&0&0808C2714A28_C00000000
    Service:
    .
    Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}
    Description: Microsoft Teredo Tunneling Adapter
    Device ID: ROOT\*TEREDO\0000
    Manufacturer: Microsoft
    Name: Teredo Tunneling Pseudo-Interface
    PNP Device ID: ROOT\*TEREDO\0000
    Service: tunnel
    .
    ==== System Restore Points ===================
    .
    RP54: 2/25/2013 9:14:25 PM - Windows Update
    RP55: 2/27/2013 3:00:10 AM - Windows Update
    RP56: 3/2/2013 1:28:40 AM - Installed Power Manager
    RP57: 3/2/2013 11:51:42 PM - Windows Update
    RP58: 3/7/2013 2:04:58 AM - Windows Update
    RP59: 3/10/2013 7:48:09 PM - Windows Update
    .
    ==== Installed Programs ======================
    .
    µTorrent
    7-Zip 9.20 (x64 edition)
    Adobe AIR
    Adobe Flash Player 14 Plugin
    Adobe Reader X (10.1.0) MUI
    Apple Application Support
    Apple Software Update
    Bastion
    CCleaner
    Cole2k Media - Codec Pack (Advanced) 8.0.2
    Create Recovery Media
    D3DX10
    DAEMON Tools Lite
    Definition Update for Microsoft Office 2013 (KB2760587) 64-Bit Edition
    Disable AMT Profile Synchronization Pop-up for Windows XP/Vista/7
    DivX Setup
    Dolby Advanced Audio v2
    Evernote v. 4.2.3
    Google Chrome
    Google Earth
    Google Talk Plugin
    Google Update Helper
    ImgBurn
    Integrated Camera Driver Installer Package Ver.1.2.1.18
    Intel(R) Control Center
    Intel(R) Management Engine Components
    Intel(R) Processor Graphics
    Intel(R) PROSet/Wireless WiFi Software Driver
    Intel(R) SDK for OpenCL - CPU Only Runtime Package
    Intel(R) USB 3.0 eXtensible Host Controller Driver
    Intel(R) WiDi
    Intel(R) Wireless Display
    Intel® PROSet/Wireless Software
    Intel® PROSet/Wireless WiFi Software
    Intel® Trusted Connect Service Client
    Java 7 Update 65
    Java Auto Updater
    Junk Mail filter update
    LastPass (uninstall only)
    Lenovo Auto Scroll Utility
    Lenovo Patch Utility
    Lenovo Patch Utility 64 bit
    Lenovo Power Management Driver
    Lenovo Registration
    Lenovo SimpleTap
    Lenovo Solution Center
    Lenovo System Update
    Lenovo User Guide
    Lenovo Warranty Information
    Lenovo Welcome
    Malwarebytes Anti-Exploit version 1.03.1.1220
    Malwarebytes Anti-Malware version 2.0.2.1012
    Mesh Runtime
    Message Center Plus
    Microsoft .NET Framework 4.5.1
    Microsoft Access MUI (English) 2013
    Microsoft Access Setup Metadata MUI (English) 2013
    Microsoft Application Error Reporting
    Microsoft DCF MUI (English) 2013
    Microsoft Excel MUI (English) 2013
    Microsoft Groove MUI (English) 2013
    Microsoft InfoPath MUI (English) 2013
    Microsoft Lync MUI (English) 2013
    Microsoft Office 32-bit Components 2013
    Microsoft Office OSM MUI (English) 2013
    Microsoft Office OSM UX MUI (English) 2013
    Microsoft Office Professional Plus 2013
    Microsoft Office Proofing (English) 2013
    Microsoft Office Proofing Tools 2013 - English
    Microsoft Office Proofing Tools 2013 - Español
    Microsoft Office Shared 32-bit MUI (English) 2013
    Microsoft Office Shared MUI (English) 2013
    Microsoft Office Shared Setup Metadata MUI (English) 2013
    Microsoft OneNote MUI (English) 2013
    Microsoft Outlook MUI (English) 2013
    Microsoft PowerPoint MUI (English) 2013
    Microsoft Publisher MUI (English) 2013
    Microsoft Security Client
    Microsoft Security Essentials
    Microsoft Silverlight
    Microsoft SQL Server 2005 Compact Edition [ENU]
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
    Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219
    Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
    Microsoft Word MUI (English) 2013
    Microsoft XNA Framework Redistributable 3.1
    Mortal Kombat Komplete Edition
    MSVCRT
    MSVCRT_amd64
    MyFreeCodec
    Nalpeiron License Management
    Nitro Pro 7
    On Screen Display
    Outils de vérification linguistique 2013 de Microsoft Office - Français
    PeerBlock 1.2 (r693)
    Power Manager
    QuickTime
    RapidBoot HDD Accelerator
    RapidBoot Shield
    Realtek High Definition Audio Driver
    Registry Patch to Enable Maximum Power Saving on WiFi Adapters for Windows 7
    RICOH_Media_Driver_v2.14.18.01
    Samsung Kies
    Samsung Kies3
    SAMSUNG USB Driver for Mobile Phones
    Security Update for Microsoft .NET Framework 4.5.1 (KB2898869)
    Security Update for Microsoft .NET Framework 4.5.1 (KB2901126)
    Security Update for Microsoft .NET Framework 4.5.1 (KB2931368)
    Service Pack 1 for Microsoft Office 2013 (KB2850036) 64-Bit Edition
    Skype Click to Call
    Skype™ 6.16
    Spotify
    StreetSmart Edge®
    SugarSync Manager
    Superbrothers: Sword & Sworcery EP
    TeamViewer 9
    The KMPlayer (remove only)
    ThinkPad Bluetooth with Enhanced Data Rate Software
    ThinkPad UltraNav Driver
    ThinkVantage Active Protection System
    ThinkVantage Communications Utility
    ThinkVantage Fingerprint Software
    Update for Microsoft Excel 2013 (KB2883061) 64-Bit Edition
    Update for Microsoft Lync 2013 (KB2881070) 64-Bit Edition
    Update for Microsoft Lync 2013 (KB2881083) 64-Bit Edition
    Update for Microsoft Office 2013 (KB2760249) 64-Bit Edition
    Update for Microsoft Office 2013 (KB2760344) 64-Bit Edition
    Update for Microsoft Office 2013 (KB2760544) 64-Bit Edition
    Update for Microsoft Office 2013 (KB2768012) 64-Bit Edition
    Update for Microsoft Office 2013 (KB2817302) 64-Bit Edition
    Update for Microsoft Office 2013 (KB2826040) 64-Bit Edition
    Update for Microsoft Office 2013 (KB2837644) 64-Bit Edition
    Update for Microsoft Office 2013 (KB2863843) 64-Bit Edition
    Update for Microsoft Office 2013 (KB2880457) 64-Bit Edition
    Update for Microsoft Office 2013 (KB2880462) 64-Bit Edition
    Update for Microsoft Office 2013 (KB2880478) 64-Bit Edition
    Update for Microsoft Office 2013 (KB2880987) 64-Bit Edition
    Update for Microsoft Office 2013 (KB2881009) 64-Bit Edition
    Update for Microsoft Office 2013 (KB2881035) 64-Bit Edition
    Update for Microsoft Office 2013 (KB2883036) 64-Bit Edition
    Update for Microsoft Office 2013 (KB2883049) 64-Bit Edition
    Update for Microsoft Office 2013 (KB2883060) 64-Bit Edition
    Update for Microsoft Office 2013 (KB2883062) 64-Bit Edition
    Update for Microsoft OneDrive for Business (KB2883066) 64-Bit Edition
    Update for Microsoft OneNote 2013 (KB2881082) 64-Bit Edition
    Update for Microsoft Outlook 2013 (KB2881011) 64-Bit Edition
    Update for Microsoft PowerPoint 2013 (KB2883051) 64-Bit Edition
    Update for Microsoft Publisher 2013 (KB2880999) 64-Bit Edition
    Update for Microsoft Visio 2013 (KB2837632) 64-Bit Edition
    Update for Microsoft Visio Viewer 2013 (KB2817301) 64-Bit Edition
    Update for Microsoft Word 2013 (KB2878319) 64-Bit Edition
    Update for Microsoft Word 2013 (KB2881080) 64-Bit Edition
    VC80CRTRedist - 8.0.50727.6195
    VIP Access
    VLC media player
    Windows Driver Package - Intel (e1cexpress) Net (01/11/2012 11.15.16.0)
    Windows Driver Package - Intel System (01/11/2012 9.3.0.1020)
    Windows Driver Package - Intel System (08/26/2011 9.3.0.1011)
    Windows Driver Package - Intel USB (08/26/2011 9.3.0.1011)
    Windows Driver Package - Lenovo 1.65.05.20 (02/29/2012 1.65.05.20)
    Windows Driver Package - Synaptics (SynTP) Mouse (04/06/2012 16.1.1.0)
    Windows Live Communications Platform
    Windows Live Essentials
    Windows Live ID Sign-in Assistant
    Windows Live Installer
    Windows Live Language Selector
    Windows Live Mail
    Windows Live Mesh
    Windows Live Mesh ActiveX Control for Remote Connections
    Windows Live Messenger
    Windows Live MIME IFilter
    Windows Live Movie Maker
    Windows Live Photo Common
    Windows Live Photo Gallery
    Windows Live PIMT Platform
    Windows Live Remote Client
    Windows Live Remote Client Resources
    Windows Live Remote Service
    Windows Live Remote Service Resources
    Windows Live SOXE
    Windows Live SOXE Definitions
    Windows Live UX Platform
    Windows Live UX Platform Language Pack
    Windows Live Writer
    Windows Live Writer Resources
    .
    ==== Event Viewer Messages From Past Week ========
    .
    8/15/2014 9:37:44 AM, Error: Microsoft-Windows-DistributedCOM [10016] - The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID {C97FCC79-E628-407D-AE68-A06AD6D8B4D1} and APPID {344ED43D-D086-4961-86A6-1106F4ACAD9B} to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.
    8/14/2014 3:28:08 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Microsoft .NET Framework NGEN v4.0.30319_X86 service to connect.
    8/14/2014 3:19:33 AM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x800f0902: Security Update for Windows 7 for x64-based Systems (KB2978742).
    8/12/2014 10:10:43 PM, Error: Service Control Manager [7031] - The LSCWinService service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 5000 milliseconds: Restart the service.
    .
    ==== End Of File ===========================
     
  5. theRadiantChild

    theRadiantChild TS Enthusiast Topic Starter Posts: 319

    DDS (Ver_2012-11-20.01) - NTFS_AMD64
    Internet Explorer: 11.0.9600.17239 BrowserJavaVersion: 10.65.2
    Run by Radiant at 9:47:06 on 2014-08-15
    Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.7888.5291 [GMT -4:00]
    .
    AV: Microsoft Security Essentials *Enabled/Updated* {641105E6-77ED-3F35-A304-765193BCB75F}
    SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    SP: Microsoft Security Essentials *Enabled/Updated* {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}
    .
    ============== Running Processes ===============
    .
    C:\Windows\system32\lsm.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    C:\Windows\system32\ibmpmsvc.exe
    C:\Windows\system32\svchost.exe -k RPCSS
    C:\Program Files\Microsoft Security Client\MsMpEng.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    C:\Windows\system32\svchost.exe -k netsvcs
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    C:\Windows\system32\svchost.exe -k LocalService
    C:\Windows\system32\svchost.exe -k NetworkService
    C:\Windows\System32\WUDFHost.exe
    C:\Windows\system32\WLANExt.exe
    C:\Windows\System32\spoolsv.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
    C:\Program Files\ThinkPad\Bluetooth Software\btwdins.exe
    C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
    C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
    C:\Program Files\Intel\WiFi\bin\EvtEng.exe
    C:\Program Files (x86)\Lenovo\RapidBoot HDD Accelerator\FBService.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    C:\Program Files\Intel\iCLS Client\HeciServer.exe
    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
    C:\Program Files\Lenovo\Communications Utility\CAMMUTE.exe
    C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe
    C:\Program Files\Lenovo\Communications Utility\vcamsvc.exe
    C:\Program Files\LENOVO\VIRTSCRL\lvvsst.exe
    C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae-svc.exe
    C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
    C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
    C:\Program Files\Common Files\Nitro PDF\Professional\7.0\NitroPDFDriverService2x64.exe
    C:\Windows\SysWOW64\NLSSRV32.EXE
    C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
    C:\Windows\system32\svchost.exe -k imgsvc
    C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
    C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe
    C:\Program Files\ThinkVantage Fingerprint Software\upeksvr.exe
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
    C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
    C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe
    C:\Program Files\LENOVO\HOTKEY\TPHKLOAD.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    C:\Windows\system32\wbem\unsecapp.exe
    C:\Program Files\Microsoft Security Client\NisSrv.exe
    C:\Windows\system32\svchost.exe -k bthsvcs
    C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
    C:\Windows\system32\SearchIndexer.exe
    C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
    C:\Program Files (x86)\Google\Update\1.3.24.15\GoogleCrashHandler.exe
    C:\Program Files (x86)\Google\Update\1.3.24.15\GoogleCrashHandler64.exe
    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
    C:\Program Files (x86)\Symantec\VIP Access Client\VIPAppService.exe
    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
    C:\Windows\system32\taskhost.exe
    C:\PROGRA~1\LENOVO\VIRTSCRL\virtscrl.exe
    C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
    C:\Windows\system32\Dwm.exe
    C:\Windows\Explorer.EXE
    C:\Windows\system32\igfxsrvc.exe
    C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
    C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
    C:\Windows\System32\TpShocks.exe
    C:\Program Files\Microsoft Security Client\msseces.exe
    C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe
    C:\Windows\System32\hkcmd.exe
    C:\Windows\System32\igfxpers.exe
    C:\Program Files (x86)\Schwab\StreetSmart Edge\QuickLaunch.exe
    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe
    C:\Users\Radiant\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
    C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe
    C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe
    C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
    C:\Windows\SysWOW64\rundll32.exe
    C:\Program Files (x86)\Dolby Advanced Audio v2\pcee4.exe
    D:\Kies\KiesTrayAgent.exe
    C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
    E:\Users\Radiant\AppData\Roaming\Dropbox\bin\Dropbox.exe
    C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe
    C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
    C:\Windows\system32\rundll32.exe
    C:\Windows\system32\taskeng.exe
    C:\Windows\system32\rundll32.exe
    C:\PROGRA~1\Lenovo\HOTKEY\TPONSCR.EXE
    C:\PROGRA~1\Lenovo\HOTKEY\SHTCTKY.EXE
    C:\PROGRA~1\LENOVO\HOTKEY\tpnumlkd.exe
    C:\Windows\system32\taskeng.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Windows\System32\svchost.exe -k LocalServicePeerNet
    C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE
    C:\Program Files\Windows Media Player\wmpnetwk.exe
    C:\Program Files (x86)\ThinkPad\Utilities\SCHTASK.exe
    C:\Windows\SysWOW64\RunDll32.exe
    C:\Program Files\ThinkPad\Bluetooth Software\BtStackServer.exe
    C:\Windows\servicing\TrustedInstaller.exe
    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    C:\Program Files\Microsoft Office\Office15\MsoSync.exe
    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PrivacyIconClient.exe
    C:\Program Files (x86)\Lenovo\message center plus\mcplaunch.exe
    C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.EXE
    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    C:\Windows\system32\consent.exe
    C:\Windows\system32\SearchProtocolHost.exe
    C:\Windows\system32\SearchFilterHost.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    C:\Windows\System32\cscript.exe
    .
    ============== Pseudo HJT Report ===============
    .
    uStart Page = hxxp://www.google.com/ig/redirectdomain?brand=LENP&bmod=LENP
    uDefault_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=LENP&bmod=LENP
    mWinlogon: Userinit = userinit.exe,
    BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
    BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    BHO: Skype Click to Call for Internet Explorer: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
    BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL
    BHO: Symantec VIP Access Add-On: {C63CD127-A1CB-4D49-A4F7-D6F88A917BE6} - C:\Program Files (x86)\Symantec\VIP Access Client\VIPAddOnForIE.dll
    BHO: Microsoft SkyDrive Pro Browser Helper: {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL
    BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
    uRun: [QuickLaunch] C:\Program Files (x86)\Schwab\StreetSmart Edge\QuickLaunch.exe
    uRun: [C314E45AE8FE8AEA0C1C3F2DD924C1E2FD66C5B6._service_run] "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=service
    uRun: [Spotify Web Helper] "C:\Users\Radiant\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe"
    uRun: [Google Update] "C:\Users\Radiant\AppData\Local\Google\Update\GoogleUpdate.exe" /c
    uRun: [uTorrent] "C:\Users\Radiant\AppData\Roaming\uTorrent\uTorrent.exe" /MINIMIZED
    mRun: [RotateImage] C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe
    mRun: [USB3MON] "C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe"
    mRun: [IMSS] "C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe"
    mRun: [PWMTRV] rundll32 "C:\Program Files (x86)\ThinkPad\Utilities\PWMTR64V.DLL",PwrMgrBkGndMonitor
    mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
    mRun: [Fastboot] C:\Program Files (x86)\Lenovo\RapidBoot HDD Accelerator\FBConsole.exe
    mRun: [Lenovo Registration] C:\Program Files (x86)\Lenovo Registration\LenovoReg.exe /boot
    mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
    mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
    mRun: [Dolby Advanced Audio v2] "C:\Program Files (x86)\Dolby Advanced Audio v2\pcee4.exe" -autostart
    mRun: [DivXMediaServer] C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe
    mRun: [KiesTrayAgent] D:\Kies\KiesTrayAgent.exe
    mRun: [DivXUpdate] "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
    mRun: [Malwarebytes Anti-Exploit] C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe
    mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
    mRunOnce: [B Register C:\Program Files (x86)\DivX\DivX Transcode Engine\plugins\mc_demux_mp2_ds.ax] "C:\Windows\System32\rundll32.exe" "C:\Program Files (x86)\DivX\DivX Transcode Engine\plugins\mc_demux_mp2_ds.ax",DllRegisterServer
    StartupFolder: C:\Users\Radiant\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Dropbox.lnk - E:\Users\Radiant\AppData\Roaming\Dropbox\bin\Dropbox.exe
    StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\BLUETO~1.LNK - C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe
    mPolicies-Explorer: NoActiveDesktop = dword:1
    mPolicies-Explorer: NoActiveDesktopChanges = dword:1
    mPolicies-System: ConsentPromptBehaviorAdmin = dword:5
    mPolicies-System: ConsentPromptBehaviorUser = dword:3
    mPolicies-System: EnableUIADesktopToggle = dword:0
    mPolicies-System: DisableCAD = dword:1
    IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
    IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
    IE: {A95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll/204
    TCP: NameServer = 192.168.0.1
    TCP: Interfaces\{73F12F4C-5CCA-4742-BE75-A084CC6D1938} : DHCPNameServer = 192.168.0.1
    TCP: Interfaces\{73F12F4C-5CCA-4742-BE75-A084CC6D1938}\3516D647563675966696 : DHCPNameServer = 4.2.2.1 8.8.8.8 4.2.2.2
    TCP: Interfaces\{73F12F4C-5CCA-4742-BE75-A084CC6D1938}\46C696E6B6 : DHCPNameServer = 192.168.0.1
    TCP: Interfaces\{73F12F4C-5CCA-4742-BE75-A084CC6D1938}\55272616E60274575637470275966496 : DHCPNameServer = 208.67.222.220 208.67.222.222
    TCP: Interfaces\{73F12F4C-5CCA-4742-BE75-A084CC6D1938}\84F65686E675966496 : DHCPNameServer = 192.168.1.1
    TCP: Interfaces\{73F12F4C-5CCA-4742-BE75-A084CC6D1938}\96E63796768647F577966696F553832414 : DHCPNameServer = 172.16.0.1
    TCP: Interfaces\{73F12F4C-5CCA-4742-BE75-A084CC6D1938}\D4F67684F6573756 : DHCPNameServer = 192.168.1.1
    TCP: Interfaces\{FFB16501-291B-499F-8370-431B13FA81EB} : DHCPNameServer = 209.18.47.61 209.18.47.62
    Filter: text/xml - {807583E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE15\MSOXMLMF.DLL
    Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files (x86)\Microsoft Office\Office15\MSOSB.DLL
    Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll
    Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
    Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
    SSODL: WebCheck - <orphaned>
    LSA: Notification Packages = scecli C:\Program Files\ThinkVantage Fingerprint Software\psqlpwd.dll C:\Program Files\ThinkPad\Bluetooth Software\BtwProximityCP.dll
    mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\36.0.1985.143\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome
    x64-BHO: Lync Browser Helper: {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\Office15\OCHelper.dll
    x64-BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    x64-BHO: Skype Click to Call for Internet Explorer: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll
    x64-BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL
    x64-BHO: Symantec VIP Access Add-On: {C63CD127-A1CB-4D49-A4F7-D6F88A917BE6} - C:\Program Files (x86)\Symantec\VIP Access Client\64bit\VIPAddOnForIE64.dll
    x64-Run: [RTHDVCPL] "C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe" -s
    x64-Run: [RtHDVBg_Dolby] "C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe" /FORPCEE4
    x64-Run: [TpShocks] TpShocks.exe
    x64-Run: [MSC] "C:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
    x64-Run: [LENOVO.TPKNRRES] C:\Program Files\Lenovo\Communications Utility\TPKNRRES.exe
    x64-Run: [IgfxTray] "C:\Windows\System32\igfxtray.exe"
    x64-Run: [HotKeysCmds] "C:\Windows\System32\hkcmd.exe"
    x64-Run: [Persistence] "C:\Windows\System32\igfxpers.exe"
    x64-IE: {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\Office15\OCHelper.dll
    x64-IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll
    x64-Filter: text/xml - {807583E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE15\MSOXMLMF.DLL
    x64-Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL
    x64-Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - <orphaned>
    x64-Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll
    x64-Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - <orphaned>
    x64-Notify: igfxcui - igfxdev.dll
    x64-Notify: psfus - C:\Program Files\ThinkVantage Fingerprint Software\psqlpwd.dll
    x64-SSODL: WebCheck - <orphaned>
    .
    ============= SERVICES / DRIVERS ===============
    .
    R0 DzHDD64;DzHDD64;C:\Windows\System32\drivers\DZHDD64.SYS [2012-11-28 29512]
    R0 Fastboot;Fastboot;C:\Windows\System32\drivers\Fastboot.sys [2012-11-28 70416]
    R0 iaStorA;iaStorA;C:\Windows\System32\drivers\iaStorA.sys [2014-2-3 644968]
    R0 iaStorF;iaStorF;C:\Windows\System32\drivers\iaStorF.sys [2014-2-3 28008]
    R0 iusb3hcs;Intel(R) USB 3.0 Host Controller Switch Driver;C:\Windows\System32\drivers\iusb3hcs.sys [2014-2-3 20464]
    R0 MpFilter;Microsoft Malware Protection Driver;C:\Windows\System32\drivers\MpFilter.sys [2014-1-25 268512]
    R0 TPDIGIMN;TPDIGIMN;C:\Windows\System32\drivers\ApsHM64.sys [2011-12-29 25416]
    R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;C:\Windows\System32\drivers\dtsoftbus01.sys [2014-5-25 283064]
    R1 ESProtectionDriver;Malwarebytes Anti-Exploit;C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae64.sys [2014-6-28 62392]
    R1 PHCORE;PHCORE;C:\Program Files\Lenovo\RapidBoot\PHCORE64.sys [2012-3-26 33344]
    R2 c2cautoupdatesvc;Skype Click to Call Updater;C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [2014-7-14 1390176]
    R2 c2cpnrsvc;Skype Click to Call PNR Service;C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [2014-7-14 1767520]
    R2 FastbootService;FastbootService;C:\Program Files (x86)\Lenovo\RapidBoot HDD Accelerator\FBService.exe [2012-11-28 169776]
    R2 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface;C:\Program Files\Intel\iCLS Client\HeciServer.exe [2012-2-3 628448]
    R2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe [2012-11-28 161560]
    R2 LENOVO.CAMMUTE;Lenovo Camera Mute;C:\Program Files\Lenovo\Communications Utility\CamMute.exe [2013-11-22 58224]
    R2 LENOVO.MICMUTE;Lenovo Microphone Mute;C:\Program Files\Lenovo\HOTKEY\micmute.exe [2014-7-18 110128]
    R2 LENOVO.TPKNRSVC;Lenovo Keyboard Noise Reduction;C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe [2013-11-22 61296]
    R2 LENOVO.TVTVCAM;ThinkVantage Virtual Camera Controller;C:\Program Files\Lenovo\Communications Utility\vcamsvc.exe [2013-11-22 179568]
    R2 Lenovo.VIRTSCRLSVC;Lenovo Auto Scroll;C:\Program Files\Lenovo\VIRTSCRL\lvvsst.exe [2013-6-13 136288]
    R2 MbaeSvc;Malwarebytes Anti-Exploit Service;C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae-svc.exe [2014-6-28 360592]
    R2 MBAMScheduler;MBAMScheduler;C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [2014-8-14 1809720]
    R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [2014-8-14 860472]
    R2 NisDrv;Microsoft Network Inspection System;C:\Windows\System32\drivers\NisDrvWFP.sys [2013-1-20 133928]
    R2 NitroDriverReadSpool2;NitroPDFDriverCreatorReadSpool2;C:\Program Files\Common Files\Nitro PDF\Professional\7.0\NitroPDFDriverService2x64.exe [2012-5-24 216072]
    R2 nlsX86cc;Nalpeiron Licensing Service;C:\Windows\SysWOW64\NLSSRV32.EXE [2012-11-8 70152]
    R2 risdxc;risdxc;C:\Windows\System32\drivers\risdxc64.sys [2012-11-28 101888]
    R2 smihlp;SMI Helper Driver (smihlp);C:\Program Files\ThinkVantage Fingerprint Software\smihlp.sys [2011-5-30 13128]
    R2 TeamViewer9;TeamViewer 9;C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe [2013-12-21 5037888]
    R2 TPHKLOAD;Lenovo Hotkey Client Loader;C:\Program Files\Lenovo\HOTKEY\tphkload.exe [2014-7-18 124400]
    R2 TPHKSVC;On Screen Display;C:\Program Files\Lenovo\HOTKEY\TPHKSVC.exe [2014-7-18 126512]
    R2 UNS;Intel(R) Management and Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2012-11-28 363800]
    R2 VIPAppService;VIPAppService;C:\Program Files (x86)\Symantec\VIP Access Client\VIPAppService.exe [2012-4-19 84080]
    R2 ZeroConfigService;Intel(R) PROSet/Wireless Zero Configuration Service;C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [2013-2-8 3386608]
    R3 5U877;5U877;C:\Windows\System32\drivers\5U877.sys [2012-11-28 216704]
    R3 bcbtums;Bluetooth RAM Firmware Download USB Filter;C:\Windows\System32\drivers\bcbtums.sys [2012-11-28 170200]
    R3 btwampfl;btwampfl Bluetooth filter driver;C:\Windows\System32\drivers\btwampfl.sys [2012-11-28 598808]
    R3 btwl2cap;Bluetooth L2CAP Service;C:\Windows\System32\drivers\btwl2cap.sys [2014-2-3 39976]
    R3 ICCS;Intel(R) Integrated Clock Controller Service - Intel(R) ICCS;C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe [2014-2-3 169752]
    R3 IntcDAud;Intel(R) Display Audio;C:\Windows\System32\drivers\IntcDAud.sys [2014-2-3 449496]
    R3 iusb3hub;Intel(R) USB 3.0 Hub Driver;C:\Windows\System32\drivers\iusb3hub.sys [2014-2-3 358896]
    R3 iusb3xhc;Intel(R) USB 3.0 eXtensible Host Controller Driver;C:\Windows\System32\drivers\iusb3xhc.sys [2014-2-3 795632]
    R3 iwdbus;IWD Bus Enumerator;C:\Windows\System32\drivers\iwdbus.sys [2012-4-19 25528]
    R3 MBAMProtector;MBAMProtector;C:\Windows\System32\drivers\mbam.sys [2013-9-13 25816]
    R3 MBAMSwissArmy;MBAMSwissArmy;C:\Windows\System32\drivers\MBAMSwissArmy.sys [2014-8-14 122584]
    R3 MBAMWebAccessControl;MBAMWebAccessControl;C:\Windows\System32\drivers\mwac.sys [2014-8-14 63704]
    R3 NisSrv;Microsoft Network Inspection;C:\Program Files\Microsoft Security Client\NisSrv.exe [2014-3-11 347872]
    R3 Power Manager DBC Service;Power Manager Service;C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.exe [2012-11-28 1669976]
    R3 SmbDrvI;SmbDrvI;C:\Windows\System32\drivers\Smb_driver_Intel.sys [2013-6-13 44784]
    R3 TVTI2C;Lenovo SM bus driver;C:\Windows\System32\drivers\tvti2c.sys [2012-2-7 40248]
    R3 tvtvcamd;ThinkVantage Virtual Camera;C:\Windows\System32\drivers\tvtvcamd.sys [2012-11-28 27432]
    S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2013-9-11 105144]
    S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2013-9-11 124088]
    S2 HyperW7Svc;HyperW7 Service;C:\Program Files\Lenovo\RapidBoot\HyperW7Svc64.exe [2012-5-29 144992]
    S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2013-10-23 172192]
    S3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);C:\Windows\System32\drivers\ssudbus.sys [2014-2-21 108800]
    S3 DozeSvc;Lenovo Doze Mode Service;C:\Program Files (x86)\ThinkPad\Utilities\DZSVC64.EXE [2013-3-12 320560]
    S3 IEEtwCollectorService;Internet Explorer ETW Collector Service;C:\Windows\System32\ieetwcollector.exe [2014-8-13 111616]
    S3 intaud_WaveExtensible;Intel WiDi Audio Device;C:\Windows\System32\drivers\intelaud.sys [2012-4-19 35256]
    S3 LSCWinService;LSCWinService;C:\Program Files\Lenovo\Lenovo Solution Center\App\LSCWinService.exe [2014-5-6 1663880]
    S3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [2013-2-8 273136]
    S3 ose64;Office 64 Source Engine;C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2014-1-23 178760]
    S3 PwmEWSvc;Cisco EnergyWise Enabler;C:\Program Files (x86)\ThinkPad\Utilities\PWMEWSVC.exe [2012-11-28 1664856]
    S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:\Windows\System32\drivers\rdpvideominiport.sys [2013-3-12 19456]
    S3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);C:\Windows\System32\drivers\ssudmdm.sys [2014-2-21 206080]
    S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2014-2-22 56832]
    S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\System32\drivers\TsUsbGD.sys [2013-3-12 30208]
    S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2013-3-12 1255736]
    S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-22 57184]
    .
    =============== Created Last 30 ================
    .
    2014-08-15 13:10:31 10924376 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{A5A7570A-3A18-4889-8184-DC807CC73888}\mpengine.dll
    2014-08-14 11:57:02 122584 ----a-w- C:\Windows\System32\drivers\MBAMSwissArmy.sys
    2014-08-14 11:56:44 91352 ----a-w- C:\Windows\System32\drivers\mbamchameleon.sys
    2014-08-14 11:56:44 63704 ----a-w- C:\Windows\System32\drivers\mwac.sys
    2014-08-14 11:56:44 -------- d-----w- C:\Program Files (x86)\Malwarebytes Anti-Malware
    2014-08-14 07:19:50 10924376 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
    2014-08-14 07:00:51 99480 ----a-w- C:\Windows\SysWow64\infocardapi.dll
    2014-08-14 07:00:51 619672 ----a-w- C:\Windows\SysWow64\icardagt.exe
    2014-08-14 07:00:51 171160 ----a-w- C:\Windows\System32\infocardapi.dll
    2014-08-14 07:00:51 1389208 ----a-w- C:\Windows\System32\icardagt.exe
    2014-08-14 07:00:50 8856 ----a-w- C:\Windows\SysWow64\icardres.dll
    2014-08-14 07:00:50 8856 ----a-w- C:\Windows\System32\icardres.dll
    2014-08-14 07:00:39 35480 ----a-w- C:\Windows\SysWow64\TsWpfWrp.exe
    2014-08-14 07:00:39 35480 ----a-w- C:\Windows\System32\TsWpfWrp.exe
    2014-08-14 07:00:27 -------- d-----w- C:\Users\Radiant\AppData\Local\{883A5D6D-BC82-47C8-A41D-2EFFC7F54D08}
    2014-08-13 09:11:03 1216000 ----a-w- C:\Windows\System32\rpcrt4.dll
    2014-08-13 09:11:02 664064 ----a-w- C:\Windows\SysWow64\rpcrt4.dll
    2014-08-13 08:58:14 -------- d-----w- C:\Users\Radiant\AppData\Local\{1650C3AB-3091-4A5C-9ACB-25A0B1BAD6DD}
    2014-08-13 03:44:16 -------- d-----w- C:\The KMPlayer
    2014-08-13 03:38:26 -------- d-----w- C:\Users\Radiant\AppData\Local\Apple Computer
    2014-08-13 02:22:34 1031560 ------w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{C89039FC-8471-492D-A4A4-1FA9E1EA544E}\gapaengine.dll
    2014-08-04 01:12:27 -------- d-----w- C:\Users\Radiant\AppData\Local\{AB3EDE1D-D3A2-4D0F-B77F-A76342FBD172}
    2014-08-04 01:02:05 -------- d-----w- C:\Users\Radiant\AppData\Roaming\LSC
    2014-07-27 15:45:32 5532368 ----a-w- C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE15\CMigrate.exe
    2014-07-27 15:45:32 5233848 ----a-w- C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE15\Csi.dll
    2014-07-27 15:41:20 7501528 ----a-w- C:\Program Files\Common Files\Microsoft Shared\OFFICE15\CMigrate.exe
    2014-07-27 15:41:20 7259328 ----a-w- C:\Program Files\Common Files\Microsoft Shared\OFFICE15\Csi.dll
    2014-07-27 15:41:18 197328 ----a-w- C:\Program Files\Common Files\Microsoft Shared\OFFICE15\LICLUA.EXE
    2014-07-27 05:09:50 -------- d-----w- C:\Users\Radiant\AppData\Local\{D6BBE6BE-9F91-4EDD-9999-50224F7593C6}
    2014-07-25 10:26:25 -------- d-----w- C:\Users\Radiant\AppData\Local\{7532D8C7-CD62-4744-B85E-05EC2E926DB9}
    2014-07-24 20:14:04 -------- d-----w- C:\Users\Radiant\AppData\Local\{BF1692D4-3ABC-4D54-8440-4E13BBD50FF6}
    2014-07-21 18:18:50 98216 ----a-w- C:\Windows\SysWow64\WindowsAccessBridge-32.dll
    .
    ==================== Find3M ====================
    .
    2014-07-25 14:02:12 2724864 ----a-w- C:\Windows\System32\mshtml.tlb
    2014-07-25 14:01:41 4096 ----a-w- C:\Windows\System32\ieetwcollectorres.dll
    2014-07-25 13:30:30 66048 ----a-w- C:\Windows\System32\iesetup.dll
    2014-07-25 13:28:35 48640 ----a-w- C:\Windows\System32\ieetwproxystub.dll
    2014-07-25 13:28:27 548352 ----a-w- C:\Windows\System32\vbscript.dll
    2014-07-25 13:25:45 83968 ----a-w- C:\Windows\System32\MshtmlDac.dll
    2014-07-25 13:04:40 2724864 ----a-w- C:\Windows\SysWow64\mshtml.tlb
    2014-07-25 13:00:51 139264 ----a-w- C:\Windows\System32\ieUnatt.exe
    2014-07-25 13:00:25 111616 ----a-w- C:\Windows\System32\ieetwcollector.exe
    2014-07-25 12:59:28 758272 ----a-w- C:\Windows\System32\jscript9diag.dll
    2014-07-25 12:47:25 940032 ----a-w- C:\Windows\System32\MsSpellCheckingFacility.exe
    2014-07-25 12:34:49 61952 ----a-w- C:\Windows\SysWow64\iesetup.dll
    2014-07-25 12:34:03 455168 ----a-w- C:\Windows\SysWow64\vbscript.dll
    2014-07-25 12:33:08 51200 ----a-w- C:\Windows\SysWow64\ieetwproxystub.dll
    2014-07-25 12:30:32 61952 ----a-w- C:\Windows\SysWow64\MshtmlDac.dll
    2014-07-25 12:28:15 5824512 ----a-w- C:\Windows\System32\jscript9.dll
    2014-07-25 12:28:05 72704 ----a-w- C:\Windows\System32\JavaScriptCollectionAgent.dll
    2014-07-25 12:10:15 112128 ----a-w- C:\Windows\SysWow64\ieUnatt.exe
    2014-07-25 12:08:47 597504 ----a-w- C:\Windows\SysWow64\jscript9diag.dll
    2014-07-25 12:06:47 4204032 ----a-w- C:\Windows\SysWow64\jscript9.dll
    2014-07-25 11:43:16 60416 ----a-w- C:\Windows\SysWow64\JavaScriptCollectionAgent.dll
    2014-07-25 11:39:29 2087936 ----a-w- C:\Windows\System32\inetcpl.cpl
    2014-07-25 11:39:25 1249280 ----a-w- C:\Windows\System32\mshtmlmedia.dll
    2014-07-25 11:07:49 2001920 ----a-w- C:\Windows\SysWow64\inetcpl.cpl
    2014-07-25 11:07:10 1068032 ----a-w- C:\Windows\SysWow64\mshtmlmedia.dll
    2014-07-25 10:52:06 2266624 ----a-w- C:\Windows\System32\wininet.dll
    2014-07-25 10:05:23 1792512 ----a-w- C:\Windows\SysWow64\wininet.dll
    2014-07-16 03:25:04 404480 ----a-w- C:\Windows\System32\gdi32.dll
    2014-07-16 03:23:41 2048 ----a-w- C:\Windows\System32\tzres.dll
    2014-07-16 02:46:24 311808 ----a-w- C:\Windows\SysWow64\gdi32.dll
    2014-07-16 02:46:02 2048 ----a-w- C:\Windows\SysWow64\tzres.dll
    2014-07-16 02:12:11 3163648 ----a-w- C:\Windows\System32\win32k.sys
    2014-07-09 08:44:17 71344 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
    2014-07-09 08:44:17 699056 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe
    2014-07-09 02:03:23 7168 ----a-w- C:\Windows\System32\KBDYAK.DLL
    2014-07-09 02:03:22 7168 ----a-w- C:\Windows\System32\KBDBASH.DLL
    2014-07-09 01:31:42 7168 ----a-w- C:\Windows\SysWow64\KBDYAK.DLL
    2014-07-09 01:31:41 6656 ----a-w- C:\Windows\SysWow64\KBDBASH.DLL
    2014-06-18 02:18:30 692736 ----a-w- C:\Windows\System32\osk.exe
    2014-06-18 01:51:32 646144 ----a-w- C:\Windows\SysWow64\osk.exe
    2014-06-16 02:10:19 985536 ----a-w- C:\Windows\System32\drivers\dxgkrnl.sys
    2014-06-06 10:10:34 624128 ----a-w- C:\Windows\System32\qedit.dll
    2014-06-06 09:44:17 509440 ----a-w- C:\Windows\SysWow64\qedit.dll
    2014-06-05 14:45:15 1460736 ----a-w- C:\Windows\System32\lsasrv.dll
    2014-06-05 14:26:58 22016 ----a-w- C:\Windows\SysWow64\secur32.dll
    2014-06-05 14:25:49 96768 ----a-w- C:\Windows\SysWow64\sspicli.dll
    2014-06-03 10:02:37 112064 ----a-w- C:\Windows\System32\consent.exe
    2014-06-03 10:02:21 504320 ----a-w- C:\Windows\System32\msihnd.dll
    2014-06-03 10:02:21 3241984 ----a-w- C:\Windows\System32\msi.dll
    2014-06-03 10:02:12 1941504 ----a-w- C:\Windows\System32\authui.dll
    2014-06-03 09:29:50 337408 ----a-w- C:\Windows\SysWow64\msihnd.dll
    2014-06-03 09:29:50 2363392 ----a-w- C:\Windows\SysWow64\msi.dll
    2014-06-03 09:29:40 1805824 ----a-w- C:\Windows\SysWow64\authui.dll
    2014-05-30 08:08:52 210944 ----a-w- C:\Windows\System32\wdigest.dll
    2014-05-30 08:08:49 86528 ----a-w- C:\Windows\System32\TSpkg.dll
    2014-05-30 08:08:47 340992 ----a-w- C:\Windows\System32\schannel.dll
    2014-05-30 08:08:41 314880 ----a-w- C:\Windows\System32\msv1_0.dll
    2014-05-30 08:08:41 307200 ----a-w- C:\Windows\System32\ncrypt.dll
    2014-05-30 08:08:36 728064 ----a-w- C:\Windows\System32\kerberos.dll
    2014-05-30 08:08:31 22016 ----a-w- C:\Windows\System32\credssp.dll
    2014-05-30 07:52:51 172032 ----a-w- C:\Windows\SysWow64\wdigest.dll
    2014-05-30 07:52:49 65536 ----a-w- C:\Windows\SysWow64\TSpkg.dll
    2014-05-30 07:52:45 247808 ----a-w- C:\Windows\SysWow64\schannel.dll
    2014-05-30 07:52:41 220160 ----a-w- C:\Windows\SysWow64\ncrypt.dll
    2014-05-30 07:52:40 259584 ----a-w- C:\Windows\SysWow64\msv1_0.dll
    2014-05-30 07:52:36 550912 ----a-w- C:\Windows\SysWow64\kerberos.dll
    2014-05-30 07:52:30 17408 ----a-w- C:\Windows\SysWow64\credssp.dll
    2014-05-30 06:45:52 497152 ----a-w- C:\Windows\System32\drivers\afd.sys
    2014-05-26 03:27:06 283064 ----a-w- C:\Windows\System32\drivers\dtsoftbus01.sys
    .
    ============= FINISH: 9:47:19.93 ===============
     
  6. theRadiantChild

    theRadiantChild TS Enthusiast Topic Starter Posts: 319

    Is this everything you needed Broni?
     
  7. Broni

    Broni Malware Annihilator Posts: 47,078   +258

    [​IMG] Download RogueKiller from one of the following links and save it to your Desktop:

    Link 1
    Link 2

    • Close all the running programs
    • Windows Vista/7/8 users: right click on RogueKiller.exe, click Run as Administrator
    • Otherwise just double-click on RogueKiller.exe
    • Pre-scan will start. Let it finish.
    • Click on SCAN button.
    • Wait until the Status box shows Scan Finished
    • Click on Delete.
    • Wait until the Status box shows Deleting Finished.
    • Click on Report and copy/paste the content of the Notepad into your next reply.
    • RKreport.txt could also be found on your desktop.
    • If more than one log is produced post all logs.
    • If RogueKiller has been blocked, do not hesitate to try a few times more. If really won't run, rename it to winlogon.exe (or winlogon.com) and try again

    [​IMG] Create new restore point before proceeding with the next step....
    How to: http://www.smartestcomputing.us.com/topic/63983-how-to-create-new-restore-point-all-windows/

    Download [img=[url]http://www.imgdumper.nl/uploads6/51a5f31352f71/51a5f31352b88-icon_MBAR.png][/url]Malwarebytes Anti-Rootkit to your desktop.
    • Warning! Malwarebytes Anti-Rootkit needs to be run from an account with administrator rights.
    • Double click on downloaded file. OK self extracting prompt.
    • MBAR will start. Click "Next" to continue.
    • Click in the following screen "Update" to obtain the latest malware definitions.
    • Once the update is complete select "Next" and click "Scan".
    • When the scan is finished and no malware has been found select "Exit".
    • If malware was detected, make sure to check all the items and click "Cleanup". Reboot your computer.
    • Open the MBAR folder located on your Desktop and paste the content of the following files in your next reply:
      • "mbar-log-{date} (xx-xx-xx).txt"
      • "system-log.txt"
     
  8. theRadiantChild

    theRadiantChild TS Enthusiast Topic Starter Posts: 319

    RogueKiller V9.2.8.0 [Jul 11 2014] by Adlice Software
    mail : http://www.adlice.com/contact/
    Feedback : http://forum.adlice.com
    Website : http://www.adlice.com/softwares/roguekiller/
    Blog : http://www.adlice.com

    Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
    Started in : Normal mode
    User : Radiant [Admin rights]
    Mode : Remove -- Date : 08/16/2014 08:01:15

    ¤¤¤ Bad processes : 11 ¤¤¤
    [Proc.Hidden] -- [x] -> KILLED [TermThr]
    [Proc.Hidden] -- [x] -> KILLED [TermThr]
    [Proc.Hidden] -- [x] -> KILLED [TermThr]
    [Proc.Hidden] -- [x] -> KILLED [TermThr]
    [Proc.Hidden] -- [x] -> KILLED [TermThr]
    [Proc.Hidden] -- [x] -> KILLED [TermThr]
    [Proc.Hidden] -- [x] -> KILLED [TermThr]
    [Proc.Hidden] -- [x] -> KILLED [TermThr]
    [Proc.Hidden] -- [x] -> KILLED [TermThr]
    [Proc.Hidden] -- [x] -> KILLED [TermThr]
    [Proc.Hidden] -- [x] -> KILLED [TermThr]

    ¤¤¤ Registry Entries : 17 ¤¤¤
    [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{FFB16501-291B-499F-8370-431B13FA81EB} | DhcpNameServer : 209.18.47.61 209.18.47.62 -> NOT SELECTED
    [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\RK_System_ON_E_A7B6\ControlSet001\Services\Tcpip\Parameters\Interfaces\{FFB16501-291B-499F-8370-431B13FA81EB} | DhcpNameServer : 172.168.12.2 -> NOT SELECTED
    [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{FFB16501-291B-499F-8370-431B13FA81EB} | DhcpNameServer : 209.18.47.61 209.18.47.62 -> NOT SELECTED
    [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\RK_System_ON_E_A7B6\ControlSet002\Services\Tcpip\Parameters\Interfaces\{FFB16501-291B-499F-8370-431B13FA81EB} | DhcpNameServer : 172.168.12.2 -> NOT SELECTED
    [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Tcpip\Parameters\Interfaces\{FFB16501-291B-499F-8370-431B13FA81EB} | DhcpNameServer : 209.18.47.61 209.18.47.62 -> NOT SELECTED
    [PUM.Policies] (X64) HKEY_LOCAL_MACHINE\RK_Software_ON_E_8984\Microsoft\Windows\CurrentVersion\Policies\System | EnableLUA : 0 -> NOT SELECTED
    [PUM.Policies] (X86) HKEY_LOCAL_MACHINE\RK_Software_ON_E_8984\Microsoft\Windows\CurrentVersion\Policies\System | EnableLUA : 0 -> NOT SELECTED
    [PUM.Policies] (X64) HKEY_LOCAL_MACHINE\RK_Software_ON_E_8984\Microsoft\Windows\CurrentVersion\Policies\System | ConsentPromptBehaviorAdmin : 0 -> NOT SELECTED
    [PUM.Policies] (X86) HKEY_LOCAL_MACHINE\RK_Software_ON_E_8984\Microsoft\Windows\CurrentVersion\Policies\System | ConsentPromptBehaviorAdmin : 0 -> NOT SELECTED
    [PUM.DesktopIcons] (X64) HKEY_LOCAL_MACHINE\RK_Software_ON_E_8984\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> NOT SELECTED
    [PUM.DesktopIcons] (X64) HKEY_LOCAL_MACHINE\RK_Software_ON_E_8984\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1 -> NOT SELECTED
    [PUM.DesktopIcons] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> NOT SELECTED
    [PUM.DesktopIcons] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1 -> NOT SELECTED
    [PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\RK_Software_ON_E_8984\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> NOT SELECTED
    [PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\RK_Software_ON_E_8984\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1 -> NOT SELECTED
    [PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> NOT SELECTED
    [PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1 -> NOT SELECTED

    ¤¤¤ Scheduled tasks : 0 ¤¤¤

    ¤¤¤ Files : 2 ¤¤¤
    [Keylogger][Folder] FK_Monitor -- C:\Users\Radiant\AppData\Roaming\FK_Monitor -> DELETED
    [Keylogger][File] delme.bat -- C:\Users\Radiant\AppData\Roaming\FK_Monitor\delme.bat -> DELETED
    [Keylogger][Folder] FK_Monitor -- C:\Program Files (x86)\FK_Monitor -> DELETED
    [Keylogger][File] guide.htm -- C:\Program Files (x86)\FK_Monitor\guide.htm -> DELETED
    [Keylogger][File] start.htm -- C:\Program Files (x86)\FK_Monitor\start.htm -> DELETED
    [Keylogger][File] tray.png -- C:\Program Files (x86)\FK_Monitor\tray.png -> DELETED

    ¤¤¤ HOSTS File : 0 ¤¤¤

    ¤¤¤ Antirootkit : 0 (Driver: NOT LOADED [0xc000036b]) ¤¤¤

    ¤¤¤ Web browsers : 0 ¤¤¤

    ¤¤¤ MBR Check : ¤¤¤
    +++++ PhysicalDrive0: ST320LT007-9ZV142 +++++
    --- User ---
    [MBR] 6b03bef6dd02bad7797196566ce61fbe
    [BSP] f947d4a549a4a347d3b83b5223dd49b8 : Lenovo MBR Code
    Partition table:
    0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 1500 MB
    1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 3074048 | Size: 289743 MB
    2 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 596467712 | Size: 14000 MB
    User = LL1 ... OK
    User != LL2 ... KO!
    --- LL2 ---
    [MBR] 34968e522a1f91b73fe5fda59e43e328
    [BSP] 9a617a7f314452d6fa51ef48f7bc548d : Windows Vista/7/8 MBR Code
    Partition table:
    0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 1500 MB
    1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 3074048 | Size: 289743 MB
    2 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 596467712 | Size: 14000 MB

    +++++ PhysicalDrive1: M4-CT256M4SSD3 +++++
    --- User ---
    [MBR] 479a6233f7582a0d8bd432d806af33a3
    [BSP] 62717d4e4577b0f5446c78333628804b : Lenovo MBR Code
    Partition table:
    0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 1499 MB
    1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 3072000 | Size: 228698 MB
    2 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 471445504 | Size: 13999 MB
    User = LL1 ... OK
    User != LL2 ... KO!
    --- LL2 ---
    [MBR] eb27214d36f5b27fe53636d36e434f4c
    [BSP] dbc54abcd25ff253ffd1397e10b31752 : Windows Vista/7/8 MBR Code
    Partition table:
    0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 1499 MB
    1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 3072000 | Size: 228698 MB
    2 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 471445504 | Size: 13999 MB


    ============================================
    RKreport_SCN_08162014_080016.log
     
  9. theRadiantChild

    theRadiantChild TS Enthusiast Topic Starter Posts: 319

    ---------------------------------------
    Malwarebytes Anti-Rootkit BETA 1.07.0.1012

    (c) Malwarebytes Corporation 2011-2012

    OS version: 6.1.7601 Windows 7 Service Pack 1 x64

    Account is Administrative

    Internet Explorer version: 11.0.9600.17239

    File system is: NTFS
    Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED, E:\ DRIVE_FIXED, F:\ DRIVE_FIXED, Q:\ DRIVE_FIXED
    CPU speed: 2.494000 GHz
    Memory total: 8270950400, free: 3699044352

    Downloaded database version: v2014.08.16.02
    Downloaded database version: v2014.08.15.01
    =======================================
    Done!
    Scanning drivers directory: C:\WINDOWS\SYSTEM32\drivers...
    Done!
    Drive 0
    Scanning MBR on drive 0...
    Inspecting partition table:
    MBR Signature: 55AA
    Disk Signature: 4A1F934E

    Partition information:

    Partition 0 type is Primary (0x7)
    Partition is ACTIVE.
    Partition starts at LBA: 2048 Numsec = 3072000
    Partition file system is NTFS
    Partition is bootable

    Partition 1 type is Primary (0x7)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 3074048 Numsec = 593393664

    Partition 2 type is Primary (0x7)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 596467712 Numsec = 28672000

    Partition 3 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0 Numsec = 0

    Disk Size: 320072933376 bytes
    Sector size: 512 bytes

    Done!
    Drive 1
    This is a System drive
    Scanning MBR on drive 1...
    Inspecting partition table:
    MBR Signature: 55AA
    Disk Signature: E86D497C

    Partition information:

    Partition 0 type is Primary (0x7)
    Partition is ACTIVE.
    Partition starts at LBA: 2048 Numsec = 3069952
    Partition file system is NTFS
    Partition is bootable

    Partition 1 type is Primary (0x7)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 3072000 Numsec = 468373504

    Partition 2 type is Primary (0x7)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 471445504 Numsec = 28669952

    Partition 3 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0 Numsec = 0

    Disk Size: 256060514304 bytes
    Sector size: 512 bytes

    Scanning physical sectors of unpartitioned space on drive 1 (1-2047-500098192-500118192)...
    Done!
    Infected: C:\Users\Radiant\Desktop\KMS Activator for Microsoft Office 2010 Applications x86 x64 Multilingual-FIXISO~DiBYA\mini-KMS_Activator_v1.053.exe --> [Riskware.Crk]
    Scan finished
    Creating System Restore point...
    Cleaning up...
    Removal scheduling successful. System shutdown needed.
    System shutdown occurred
    =======================================


    Removal queue found; removal started
    Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-0-I.mbam...
    Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\VBR-0-0-2048-I.mbam...
    Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-0-r.mbam...
    Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-1-I.mbam...
    Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\VBR-1-0-2048-I.mbam...
    Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-1-r.mbam...
    Removal finished
     
  10. theRadiantChild

    theRadiantChild TS Enthusiast Topic Starter Posts: 319

    Malwarebytes Anti-Rootkit BETA 1.07.0.1012
    www.malwarebytes.org

    Database version: v2014.08.16.02

    Windows 7 Service Pack 1 x64 NTFS
    Internet Explorer 11.0.9600.17239
    Radiant :: RADIANT-THINK [administrator]

    8/16/2014 8:08:46 AM
    mbar-log-2014-08-16 (08-08-46).txt

    Scan type: Quick scan
    Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
    Scan options disabled:
    Objects scanned: 302669
    Time elapsed: 4 minute(s), 41 second(s)

    Memory Processes Detected: 0
    (No malicious items detected)

    Memory Modules Detected: 0
    (No malicious items detected)

    Registry Keys Detected: 0
    (No malicious items detected)

    Registry Values Detected: 0
    (No malicious items detected)

    Registry Data Items Detected: 0
    (No malicious items detected)

    Folders Detected: 0
    (No malicious items detected)

    Files Detected: 1
    C:\Users\Radiant\Desktop\KMS Activator for Microsoft Office 2010 Applications x86 x64 Multilingual-FIXISO~DiBYA\mini-KMS_Activator_v1.053.exe (Riskware.Crk) -> Delete on reboot. [a1474d792655de58543a30b410f0dd23]

    Physical Sectors Detected: 0
    (No malicious items detected)

    (end)
     
  11. Broni

    Broni Malware Annihilator Posts: 47,078   +258

    Please download ComboFix from Here, Here or Here to your Desktop.

    **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
    • Never rename Combofix unless instructed.
    • Close any open browsers.
    • Very Important! Temporarily disable your anti-virus and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
    • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
    • Close any open browsers.
    • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
    • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
    • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
      If the connection is not there use restore point you created prior to running Combofix.
    • Double click on combofix.exe & follow the prompts.

    • NOTE1. If Combofix asks you to install Recovery Console, please allow it.
      NOTE 2. If Combofix asks you to update the program, always do so.
    • When finished, it will produce a report for you.
    • Please post the "C:\ComboFix.txt"
    **Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
    **Note 2 for AVG and CA Internet Security (Total Defense Internet Security) users: ComboFix will not run until AVG/CA Internet Security is uninstalled as a protective measure against the anti-virus. This is because AVG/CA Internet Security "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG/CA Internet Security cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG/CA Internet Security first.
    Use AppRemover to uninstall it: http://www.appremover.com/
    We can reinstall it when we're done with CF.
    **Note 3: If you receive an error Illegal operation attempted on a registery key that has been marked for deletion, restart computer to fix the issue.
    **Note 4: Some infections may take some significant time to be cured. As long as your computer clock is running Combofix is still working. Be patient.


    Make sure, you re-enable your security programs, when you're done with Combofix.

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    NOTE.
    If, for some reason, Combofix refuses to run, try the following...

    Delete Combofix file, download fresh one, but rename combofix.exe to your_name.exe BEFORE saving it to your desktop.
    Do NOT run it yet.
    Download Rkill (courtesy of BleepingComputer.com) to your desktop.
    There are 2 different versions. If one of them won't run then download and try to run the other one.
    You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

    rKill.exe: http://www.bleepingcomputer.com/download/rkill/dl/10/
    iExplore.exe (renamed rKill.exe): http://www.bleepingcomputer.com/download/rkill/dl/11/

    Restart computer in safe mode

    • Double-click on the Rkill desktop icon to run the tool.
    • If using Vista or Windows 7 right-click on it and choose Run As Administrator.
    • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
    • If not, delete the file, then download and use the one provided in Link 2.
    • Do not reboot until instructed.
    • If the tool does not run from any of the links provided, please let me know.

    When the scan is done Notepad will open with rKill.txt log.
    NOTE. rKill.txt log will also be present on your desktop.

    Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

    IF you had to run rKill post BOTH logs, rKill.txt and Combofix.txt.
     
     
  12. theRadiantChild

    theRadiantChild TS Enthusiast Topic Starter Posts: 319

    ComboFix 14-08-15.01 - Radiant 08/16/2014 18:29:29.1.4 - x64
    Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.7888.4965 [GMT -4:00]
    Running from: c:\users\Radiant\Desktop\ComboFix.exe
    AV: Microsoft Security Essentials *Disabled/Updated* {641105E6-77ED-3F35-A304-765193BCB75F}
    SP: Microsoft Security Essentials *Disabled/Updated* {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}
    SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    .
    ADS - Windows: deleted 192 bytes in 1 streams.
    .
    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    C:\END
    c:\program files\Lenovo\Lenovo Solution Center\Microsoft Fix it\FixitUi\_desktop.ini
    c:\programdata\Roaming
    Q:\Autorun.inf
    .
    .
    ((((((((((((((((((((((((( Files Created from 2014-07-16 to 2014-08-16 )))))))))))))))))))))))))))))))
    .
    .
    2014-08-16 22:54 . 2014-08-16 22:54 -------- d-----w- c:\users\Default\AppData\Local\temp
    2014-08-16 22:27 . 2014-07-02 03:09 10924376 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{8F903292-1F3D-4EE1-A6A0-4CFE9CB64B7E}\mpengine.dll
    2014-08-16 12:08 . 2014-08-16 12:16 -------- d-----w- c:\programdata\Malwarebytes' Anti-Malware (portable)
    2014-08-16 11:55 . 2014-08-16 11:55 33512 ----a-w- c:\windows\SysWow64\drivers\TrueSight.sys
    2014-08-16 11:55 . 2014-08-16 11:55 -------- d-----w- c:\programdata\RogueKiller
    2014-08-15 13:10 . 2014-07-02 03:09 10924376 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
    2014-08-14 11:57 . 2014-08-16 12:54 122584 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
    2014-08-14 11:56 . 2014-08-16 12:08 92888 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
    2014-08-14 11:56 . 2014-08-14 11:56 -------- d-----w- c:\program files (x86)\Malwarebytes Anti-Malware
    2014-08-14 11:56 . 2014-05-12 11:26 63704 ----a-w- c:\windows\system32\drivers\mwac.sys
    2014-08-14 07:00 . 2014-03-09 21:48 171160 ----a-w- c:\windows\system32\infocardapi.dll
    2014-08-14 07:00 . 2014-03-09 21:48 1389208 ----a-w- c:\windows\system32\icardagt.exe
    2014-08-14 07:00 . 2014-03-09 21:47 99480 ----a-w- c:\windows\SysWow64\infocardapi.dll
    2014-08-14 07:00 . 2014-03-09 21:47 619672 ----a-w- c:\windows\SysWow64\icardagt.exe
    2014-08-14 07:00 . 2014-06-30 22:24 8856 ----a-w- c:\windows\system32\icardres.dll
    2014-08-14 07:00 . 2014-06-30 22:14 8856 ----a-w- c:\windows\SysWow64\icardres.dll
    2014-08-14 07:00 . 2014-06-06 06:16 35480 ----a-w- c:\windows\SysWow64\TsWpfWrp.exe
    2014-08-14 07:00 . 2014-06-06 06:12 35480 ----a-w- c:\windows\system32\TsWpfWrp.exe
    2014-08-13 09:11 . 2014-07-14 02:02 1216000 ----a-w- c:\windows\system32\rpcrt4.dll
    2014-08-13 09:11 . 2014-07-14 01:40 664064 ----a-w- c:\windows\SysWow64\rpcrt4.dll
    2014-08-13 03:44 . 2014-08-15 13:34 -------- d-----w- C:\The KMPlayer
    2014-08-13 03:40 . 2014-08-13 03:40 -------- d-----w- c:\users\Radiant\AppData\Roaming\dvdcss
    2014-08-13 03:38 . 2014-08-13 03:38 -------- d-----w- c:\users\Radiant\AppData\Local\Apple Computer
    2014-08-13 02:22 . 2014-05-02 12:08 1031560 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{C89039FC-8471-492D-A4A4-1FA9E1EA544E}\gapaengine.dll
    2014-08-04 01:02 . 2014-08-04 01:02 -------- d-----w- c:\users\Radiant\AppData\Roaming\LSC
    2014-07-27 15:45 . 2014-07-27 15:45 5532368 ----a-w- c:\program files (x86)\Common Files\Microsoft Shared\OFFICE15\CMigrate.exe
    2014-07-27 15:45 . 2014-07-27 15:45 5233848 ----a-w- c:\program files (x86)\Common Files\Microsoft Shared\OFFICE15\Csi.dll
    2014-07-27 15:41 . 2014-07-27 15:41 7501528 ----a-w- c:\program files\Common Files\Microsoft Shared\OFFICE15\CMigrate.exe
    2014-07-27 15:41 . 2014-07-27 15:41 7259328 ----a-w- c:\program files\Common Files\Microsoft Shared\OFFICE15\Csi.dll
    2014-07-27 15:41 . 2014-07-27 15:41 197328 ----a-w- c:\program files\Common Files\Microsoft Shared\OFFICE15\LICLUA.EXE
    2014-07-21 18:19 . 2014-07-21 18:19 -------- d-----w- c:\program files (x86)\Common Files\Java
    2014-07-21 18:18 . 2014-07-11 07:02 98216 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
    .
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2014-08-14 07:05 . 2013-03-12 06:10 99218768 ----a-w- c:\windows\system32\MRT.exe
    2014-07-09 08:44 . 2013-03-25 07:03 71344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
    2014-07-09 08:44 . 2013-03-25 07:03 699056 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
    2014-06-18 02:18 . 2014-07-10 11:11 692736 ----a-w- c:\windows\system32\osk.exe
    2014-06-18 01:51 . 2014-07-10 11:11 646144 ----a-w- c:\windows\SysWow64\osk.exe
    2014-06-06 10:10 . 2014-07-10 11:11 624128 ----a-w- c:\windows\system32\qedit.dll
    2014-06-06 09:44 . 2014-07-10 11:11 509440 ----a-w- c:\windows\SysWow64\qedit.dll
    2014-06-05 14:45 . 2014-07-10 11:10 1460736 ----a-w- c:\windows\system32\lsasrv.dll
    2014-06-05 14:26 . 2014-07-10 11:10 22016 ----a-w- c:\windows\SysWow64\secur32.dll
    2014-06-05 14:25 . 2014-07-10 11:10 96768 ----a-w- c:\windows\SysWow64\sspicli.dll
    2014-05-30 08:08 . 2014-07-10 11:10 210944 ----a-w- c:\windows\system32\wdigest.dll
    2014-05-30 08:08 . 2014-07-10 11:10 86528 ----a-w- c:\windows\system32\TSpkg.dll
    2014-05-30 08:08 . 2014-07-10 11:10 340992 ----a-w- c:\windows\system32\schannel.dll
    2014-05-30 08:08 . 2014-07-10 11:10 314880 ----a-w- c:\windows\system32\msv1_0.dll
    2014-05-30 08:08 . 2014-07-10 11:10 307200 ----a-w- c:\windows\system32\ncrypt.dll
    2014-05-30 08:08 . 2014-07-10 11:10 728064 ----a-w- c:\windows\system32\kerberos.dll
    2014-05-30 08:08 . 2014-07-10 11:10 22016 ----a-w- c:\windows\system32\credssp.dll
    2014-05-30 07:52 . 2014-07-10 11:10 172032 ----a-w- c:\windows\SysWow64\wdigest.dll
    2014-05-30 07:52 . 2014-07-10 11:10 65536 ----a-w- c:\windows\SysWow64\TSpkg.dll
    2014-05-30 07:52 . 2014-07-10 11:10 247808 ----a-w- c:\windows\SysWow64\schannel.dll
    2014-05-30 07:52 . 2014-07-10 11:10 220160 ----a-w- c:\windows\SysWow64\ncrypt.dll
    2014-05-30 07:52 . 2014-07-10 11:10 259584 ----a-w- c:\windows\SysWow64\msv1_0.dll
    2014-05-30 07:52 . 2014-07-10 11:10 550912 ----a-w- c:\windows\SysWow64\kerberos.dll
    2014-05-30 07:52 . 2014-07-10 11:10 17408 ----a-w- c:\windows\SysWow64\credssp.dll
    2014-05-30 06:45 . 2014-07-10 11:11 497152 ----a-w- c:\windows\system32\drivers\afd.sys
    2014-05-26 03:27 . 2014-05-26 03:27 283064 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys
    .
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro1 (ErrorConflict)]
    @="{8BA85C75-763B-4103-94EB-9470F12FE0F7}"
    [HKEY_CLASSES_ROOT\CLSID\{8BA85C75-763B-4103-94EB-9470F12FE0F7}]
    2014-07-27 15:45 1730256 ----a-w- c:\progra~2\MICROS~3\Office15\GROOVEEX.DLL
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro2 (SyncInProgress)]
    @="{CD55129A-B1A1-438E-A425-CEBC7DC684EE}"
    [HKEY_CLASSES_ROOT\CLSID\{CD55129A-B1A1-438E-A425-CEBC7DC684EE}]
    2014-07-27 15:45 1730256 ----a-w- c:\progra~2\MICROS~3\Office15\GROOVEEX.DLL
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro3 (InSync)]
    @="{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}"
    [HKEY_CLASSES_ROOT\CLSID\{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}]
    2014-07-27 15:45 1730256 ----a-w- c:\progra~2\MICROS~3\Office15\GROOVEEX.DLL
    .
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "QuickLaunch"="c:\program files (x86)\Schwab\StreetSmart Edge\QuickLaunch.exe" [2013-03-27 12288]
    "C314E45AE8FE8AEA0C1C3F2DD924C1E2FD66C5B6._service_run"="c:\program files (x86)\Google\Chrome\Application\chrome.exe" [2014-08-07 860488]
    "Spotify Web Helper"="c:\users\Radiant\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [2014-04-10 1171000]
    "uTorrent"="c:\users\Radiant\AppData\Roaming\uTorrent\uTorrent.exe" [2014-08-13 1329744]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
    "RotateImage"="c:\program files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe" [2008-10-30 55808]
    "USB3MON"="c:\program files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe" [2013-07-18 292088]
    "IMSS"="c:\program files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe" [2012-02-28 133400]
    "PWMTRV"="c:\program files (x86)\ThinkPad\Utilities\PWMTR64V.DLL" [2013-12-09 6623576]
    "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]
    "Fastboot"="c:\program files (x86)\Lenovo\RapidBoot HDD Accelerator\FBConsole.exe" [2012-01-17 1091376]
    "Lenovo Registration"="c:\program files (x86)\Lenovo Registration\LenovoReg.exe" [2011-07-14 4351712]
    "APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-09-27 59240]
    "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2011-10-24 421888]
    "Dolby Advanced Audio v2"="c:\program files (x86)\Dolby Advanced Audio v2\pcee4.exe" [2012-09-01 508656]
    "DivXMediaServer"="c:\program files (x86)\DivX\DivX Media Server\DivXMediaServer.exe" [2014-04-03 450560]
    "KiesTrayAgent"="d:\kies\KiesTrayAgent.exe" [2014-02-14 311616]
    "DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" [2014-01-10 1861968]
    "Malwarebytes Anti-Exploit"="c:\program files (x86)\Malwarebytes Anti-Exploit\mbae.exe" [2014-06-04 382608]
    "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2014-07-11 256896]
    .
    c:\users\Radiant\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
    Dropbox.lnk - e:\users\Radiant\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2013-1-20 28539272]
    .
    c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
    Bluetooth.lnk - c:\program files\ThinkPad\Bluetooth Software\BTTray.exe [2013-5-14 1395416]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "ConsentPromptBehaviorAdmin"= 5 (0x5)
    "ConsentPromptBehaviorUser"= 3 (0x3)
    "EnableUIADesktopToggle"= 0 (0x0)
    "DisableCAD"= 1 (0x1)
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
    "aux1"=wdmaud.drv
    .
    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
    Notification Packages REG_MULTI_SZ scecli c:\program files\ThinkVantage Fingerprint Software\psqlpwd.dll c:\program files\ThinkPad\Bluetooth Software\BtwProximityCP.dll
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
    @="Service"
    .
    R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
    R2 HyperW7Svc;HyperW7 Service;c:\program files\Lenovo\RapidBoot\HyperW7Svc64.exe;c:\program files\Lenovo\RapidBoot\HyperW7Svc64.exe [x]
    R2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe;c:\program files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [x]
    R2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes Anti-Malware\mbamservice.exe;c:\program files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [x]
    R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
    R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssudbus.sys [x]
    R3 DozeSvc;Lenovo Doze Mode Service;c:\program files (x86)\ThinkPad\Utilities\DZSVC64.EXE;c:\program files (x86)\ThinkPad\Utilities\DZSVC64.EXE [x]
    R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
    R3 intaud_WaveExtensible;Intel WiDi Audio Device;c:\windows\system32\drivers\intelaud.sys;c:\windows\SYSNATIVE\drivers\intelaud.sys [x]
    R3 LSCWinService;LSCWinService;c:\program files\Lenovo\Lenovo Solution Center\App\LSCWinService.exe;c:\program files\Lenovo\Lenovo Solution Center\App\LSCWinService.exe [x]
    R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]
    R3 MBAMWebAccessControl;MBAMWebAccessControl;c:\windows\system32\drivers\mwac.sys;c:\windows\SYSNATIVE\drivers\mwac.sys [x]
    R3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe [x]
    R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys;c:\windows\SYSNATIVE\DRIVERS\NisDrvWFP.sys [x]
    R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe;c:\program files\Microsoft Security Client\NisSrv.exe [x]
    R3 ose64;Office 64 Source Engine;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [x]
    R3 PwmEWSvc;Cisco EnergyWise Enabler;c:\program files (x86)\ThinkPad\Utilities\PWMEWSVC.EXE;c:\program files (x86)\ThinkPad\Utilities\PWMEWSVC.EXE [x]
    R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
    R3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ssudmdm.sys [x]
    R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
    R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
    R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
    R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]
    S0 DzHDD64;DzHDD64;c:\windows\System32\DRIVERS\DzHDD64.sys;c:\windows\SYSNATIVE\DRIVERS\DzHDD64.sys [x]
    S0 Fastboot;Fastboot;c:\windows\System32\DRIVERS\Fastboot.sys;c:\windows\SYSNATIVE\DRIVERS\Fastboot.sys [x]
    S0 iaStorA;iaStorA;c:\windows\system32\DRIVERS\iaStorA.sys;c:\windows\SYSNATIVE\DRIVERS\iaStorA.sys [x]
    S0 iaStorF;iaStorF;c:\windows\system32\DRIVERS\iaStorF.sys;c:\windows\SYSNATIVE\DRIVERS\iaStorF.sys [x]
    S0 iusb3hcs;Intel(R) USB 3.0 Host Controller Switch Driver;c:\windows\system32\DRIVERS\iusb3hcs.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3hcs.sys [x]
    S0 TPDIGIMN;TPDIGIMN;c:\windows\System32\DRIVERS\ApsHM64.sys;c:\windows\SYSNATIVE\DRIVERS\ApsHM64.sys [x]
    S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys;c:\windows\SYSNATIVE\DRIVERS\dtsoftbus01.sys [x]
    S1 ESProtectionDriver;Malwarebytes Anti-Exploit;c:\program files (x86)\Malwarebytes Anti-Exploit\mbae64.sys;c:\program files (x86)\Malwarebytes Anti-Exploit\mbae64.sys [x]
    S1 PHCORE;PHCORE;c:\program files\Lenovo\RapidBoot\PHCORE64.SYS;c:\program files\Lenovo\RapidBoot\PHCORE64.SYS [x]
    S2 c2cautoupdatesvc;Skype Click to Call Updater;c:\program files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe;c:\program files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [x]
    S2 c2cpnrsvc;Skype Click to Call PNR Service;c:\program files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe;c:\program files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [x]
    S2 FastbootService;FastbootService;c:\program files (x86)\Lenovo\RapidBoot HDD Accelerator\FBService.exe;c:\program files (x86)\Lenovo\RapidBoot HDD Accelerator\FBService.exe [x]
    S2 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface;c:\program files\Intel\iCLS Client\HeciServer.exe;c:\program files\Intel\iCLS Client\HeciServer.exe [x]
    S2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [x]
    S2 LENOVO.CAMMUTE;Lenovo Camera Mute;c:\program files\Lenovo\Communications Utility\CAMMUTE.exe;c:\program files\Lenovo\Communications Utility\CAMMUTE.exe [x]
    S2 LENOVO.MICMUTE;Lenovo Microphone Mute;c:\program files\LENOVO\HOTKEY\MICMUTE.exe;c:\program files\LENOVO\HOTKEY\MICMUTE.exe [x]
    S2 LENOVO.TPKNRSVC;Lenovo Keyboard Noise Reduction;c:\program files\Lenovo\Communications Utility\TPKNRSVC.exe;c:\program files\Lenovo\Communications Utility\TPKNRSVC.exe [x]
    S2 LENOVO.TVTVCAM;ThinkVantage Virtual Camera Controller;c:\program files\Lenovo\Communications Utility\vcamsvc.exe;c:\program files\Lenovo\Communications Utility\vcamsvc.exe [x]
    S2 Lenovo.VIRTSCRLSVC;Lenovo Auto Scroll;c:\program files\LENOVO\VIRTSCRL\lvvsst.exe;c:\program files\LENOVO\VIRTSCRL\lvvsst.exe [x]
    S2 MbaeSvc;Malwarebytes Anti-Exploit Service;c:\program files (x86)\Malwarebytes Anti-Exploit\mbae-svc.exe;c:\program files (x86)\Malwarebytes Anti-Exploit\mbae-svc.exe [x]
    S2 NitroDriverReadSpool2;NitroPDFDriverCreatorReadSpool2;c:\program files\Common Files\Nitro PDF\Professional\7.0\NitroPDFDriverService2x64.exe;c:\program files\Common Files\Nitro PDF\Professional\7.0\NitroPDFDriverService2x64.exe [x]
    S2 nlsX86cc;Nalpeiron Licensing Service;c:\windows\SysWOW64\NLSSRV32.EXE;c:\windows\SysWOW64\NLSSRV32.EXE [x]
    S2 risdxc;risdxc;c:\windows\system32\DRIVERS\risdxc64.sys;c:\windows\SYSNATIVE\DRIVERS\risdxc64.sys [x]
    S2 smihlp;SMI Helper Driver (smihlp);c:\program files\ThinkVantage Fingerprint Software\smihlp.sys;c:\program files\ThinkVantage Fingerprint Software\smihlp.sys [x]
    S2 TeamViewer9;TeamViewer 9;c:\program files (x86)\TeamViewer\Version9\TeamViewer_Service.exe;c:\program files (x86)\TeamViewer\Version9\TeamViewer_Service.exe [x]
    S2 TPHKLOAD;Lenovo Hotkey Client Loader;c:\program files\LENOVO\HOTKEY\TPHKLOAD.exe;c:\program files\LENOVO\HOTKEY\TPHKLOAD.exe [x]
    S2 TPHKSVC;On Screen Display;c:\program files\LENOVO\HOTKEY\TPHKSVC.exe;c:\program files\LENOVO\HOTKEY\TPHKSVC.exe [x]
    S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
    S2 VIPAppService;VIPAppService;c:\program files (x86)\Symantec\VIP Access Client\VIPAppService.exe;c:\program files (x86)\Symantec\VIP Access Client\VIPAppService.exe [x]
    S2 ZeroConfigService;Intel(R) PROSet/Wireless Zero Configuration Service;c:\program files\Intel\WiFi\bin\ZeroConfigService.exe;c:\program files\Intel\WiFi\bin\ZeroConfigService.exe [x]
    S3 5U877;5U877;c:\windows\system32\DRIVERS\5U877.sys;c:\windows\SYSNATIVE\DRIVERS\5U877.sys [x]
    S3 bcbtums;Bluetooth RAM Firmware Download USB Filter;c:\windows\system32\drivers\bcbtums.sys;c:\windows\SYSNATIVE\drivers\bcbtums.sys [x]
    S3 btwampfl;btwampfl Bluetooth filter driver;c:\windows\system32\drivers\btwampfl.sys;c:\windows\SYSNATIVE\drivers\btwampfl.sys [x]
    S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys;c:\windows\SYSNATIVE\DRIVERS\btwl2cap.sys [x]
    S3 ICCS;Intel(R) Integrated Clock Controller Service - Intel(R) ICCS;c:\program files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe;c:\program files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe [x]
    S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
    S3 iusb3hub;Intel(R) USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\iusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3hub.sys [x]
    S3 iusb3xhc;Intel(R) USB 3.0 eXtensible Host Controller Driver;c:\windows\system32\DRIVERS\iusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3xhc.sys [x]
    S3 iwdbus;IWD Bus Enumerator;c:\windows\system32\DRIVERS\iwdbus.sys;c:\windows\SYSNATIVE\DRIVERS\iwdbus.sys [x]
    S3 Power Manager DBC Service;Power Manager Service;c:\program files (x86)\ThinkPad\Utilities\PWMDBSVC.EXE;c:\program files (x86)\ThinkPad\Utilities\PWMDBSVC.EXE [x]
    S3 SmbDrvI;SmbDrvI;c:\windows\system32\DRIVERS\Smb_driver_Intel.sys;c:\windows\SYSNATIVE\DRIVERS\Smb_driver_Intel.sys [x]
    S3 TVTI2C;Lenovo SM bus driver;c:\windows\system32\DRIVERS\Tvti2c.sys;c:\windows\SYSNATIVE\DRIVERS\Tvti2c.sys [x]
    S3 tvtvcamd;ThinkVantage Virtual Camera;c:\windows\system32\DRIVERS\tvtvcamd.sys;c:\windows\SYSNATIVE\DRIVERS\tvtvcamd.sys [x]
    .
    .
    --- Other Services/Drivers In Memory ---
    .
    *Deregistered* - mbamchameleon
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
    2014-08-14 07:01 1104200 ----a-w- c:\program files (x86)\Google\Chrome\Application\36.0.1985.143\Installer\chrmstp.exe
    .
    Contents of the 'Scheduled Tasks' folder
    .
    2014-08-16 c:\windows\Tasks\Adobe Flash Player Updater.job
    - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-03-25 08:44]
    .
    2014-08-16 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
    - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-11-28 08:02]
    .
    2014-08-16 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
    - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-11-28 08:02]
    .
    2014-08-16 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3277094342-1709878510-195001535-1001Core.job
    - c:\users\Radiant\AppData\Local\Google\Update\GoogleUpdate.exe [2014-03-29 21:12]
    .
    2014-08-16 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3277094342-1709878510-195001535-1001UA.job
    - c:\users\Radiant\AppData\Local\Google\Update\GoogleUpdate.exe [2014-03-29 21:12]
    .
    .
    --------- X64 Entries -----------
    .
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SugarSyncBackedUp]
    @="{0C4A258A-3F3B-4FFF-80A7-9B3BEC139472}"
    [HKEY_CLASSES_ROOT\CLSID\{0C4A258A-3F3B-4FFF-80A7-9B3BEC139472}]
    2012-05-14 17:39 463952 ----a-w- c:\program files (x86)\SugarSync\SugarSyncShellExt_x64.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SugarSyncPending]
    @="{62CCD8E3-9C21-41E1-B55E-1E26DFC68511}"
    [HKEY_CLASSES_ROOT\CLSID\{62CCD8E3-9C21-41E1-B55E-1E26DFC68511}]
    2012-05-14 17:39 463952 ----a-w- c:\program files (x86)\SugarSync\SugarSyncShellExt_x64.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SugarSyncRoot]
    @="{A759AFF6-5851-457D-A540-F4ECED148351}"
    [HKEY_CLASSES_ROOT\CLSID\{A759AFF6-5851-457D-A540-F4ECED148351}]
    2012-05-14 17:39 463952 ----a-w- c:\program files (x86)\SugarSync\SugarSyncShellExt_x64.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SugarSyncShared]
    @="{1574C9EF-7D58-488F-B358-8B78C1538F51}"
    [HKEY_CLASSES_ROOT\CLSID\{1574C9EF-7D58-488F-B358-8B78C1538F51}]
    2012-05-14 17:39 463952 ----a-w- c:\program files (x86)\SugarSync\SugarSyncShellExt_x64.dll
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2013-05-21 13538376]
    "RtHDVBg_Dolby"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2013-05-20 1308232]
    "TpShocks"="TpShocks.exe" [2012-09-20 228744]
    "MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2014-03-11 1271072]
    "LENOVO.TPKNRRES"="c:\program files\Lenovo\Communications Utility\TPKNRRES.exe" [2012-06-02 290160]
    "IgfxTray"="c:\windows\system32\igfxtray.exe" [2013-11-29 165872]
    "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2013-11-29 407536]
    "Persistence"="c:\windows\system32\igfxpers.exe" [2013-11-29 444400]
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.google.com/ig/redirectdomain?brand=LENP&bmod=LENP
    uLocal Page = c:\windows\system32\blank.htm
    mLocal Page = c:\windows\SysWOW64\blank.htm
    TCP: DhcpNameServer = 192.168.0.1
    Filter: text/xml - {807583E5-5146-11D5-A672-00B0D022E945} - c:\program files (x86)\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL
    .
    - - - - ORPHANS REMOVED - - - -
    .
    Toolbar-Locked - (no file)
    HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
    Toolbar-Locked - (no file)
    .
    .
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Fastboot]
    "ImagePath"=multi:"System32\DRIVERS\Fastboot.sys\00"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Fastboot]
    "ImagePath"=multi:"System32\DRIVERS\Fastboot.sys\00"
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
    @Denied: (Full) (Everyone)
    .
    Completion time: 2014-08-16 19:56:51
    ComboFix-quarantined-files.txt 2014-08-16 23:56
    .
    Pre-Run: 159,078,858,752 bytes free
    Post-Run: 159,129,628,672 bytes free
    .
    - - End Of File - - 08DA9F8CCF82417339A8DDF6B987F19A
     
  13. theRadiantChild

    theRadiantChild TS Enthusiast Topic Starter Posts: 319

    So I take it I had a virus? :D
     
  14. Broni

    Broni Malware Annihilator Posts: 47,078   +258

    We keep checking...

    [​IMG] Please download AdwCleaner by Xplode onto your desktop.
    • Close all open programs and internet browsers.
    • Double click on adwcleaner.exe to run the tool.
    • Click on Scan button.
    • When the scan has finished click on Clean button.
    • Your computer will be rebooted automatically. A text file will open after the restart.
    • Please post the contents of that logfile with your next reply.
    • You can find the logfile at C:\AdwCleaner[S1].txt as well.

    [​IMG] Please download Junkware Removal Tool to your desktop.
    • Shut down your protection software now to avoid potential conflicts.
    • Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
    • The tool will open and start scanning your system.
    • Please be patient as this can take a while to complete depending on your system's specifications.
    • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
    • Post the contents of JRT.txt into your next message.

    [​IMG] Please download Farbar Recovery Scan Tool and save it to your Desktop.

    Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.
    • Double-click to run it. When the tool opens click Yes to disclaimer.
    • Press Scan button.
    • It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
    • The first time the tool is run, it makes also another log (Addition.txt). Please copy and paste it to your reply.
     
  15. theRadiantChild

    theRadiantChild TS Enthusiast Topic Starter Posts: 319

    # AdwCleaner v3.307 - Report created 17/08/2014 at 09:28:43
    # Updated 17/08/2014 by Xplode
    # Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
    # Username : Radiant - RADIANT-THINK
    # Running from : C:\Users\Radiant\Downloads\adwcleaner_3.307.exe
    # Option : Clean

    ***** [ Services ] *****


    ***** [ Files / Folders ] *****

    Folder Deleted : C:\ProgramData\Partner
    Folder Deleted : C:\Windows\util
    File Deleted : C:\Users\Radiant\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_static.boostsaves.com_0.localstorage
    File Deleted : C:\Users\Radiant\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_static.boostsaves.com_0.localstorage-journal

    ***** [ Scheduled Tasks ] *****


    ***** [ Shortcuts ] *****


    ***** [ Registry ] *****

    Key Deleted : HKLM\SOFTWARE\Classes\AppID\secman.DLL
    Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{74F475FA-6C75-43BD-AAB9-ECDA6184F600}
    Key Deleted : HKLM\SOFTWARE\Classes\AppID\{4D076AB4-7562-427A-B5D2-BD96E19DEE56}
    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}
    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}
    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}
    Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}
    Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}
    Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
    Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}
    Key Deleted : HKCU\Software\Conduit
    Key Deleted : HKCU\Software\Myfree Codec
    Key Deleted : HKLM\SOFTWARE\Myfree Codec
    Key Deleted : [x64] HKLM\SOFTWARE\DivX\Install\Setup\WizardLayout\ConduitToolbar
    Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\08121C32A9C319F4CB0C11FF059552A4

    ***** [ Browsers ] *****

    -\\ Internet Explorer v11.0.9600.17239


    -\\ Google Chrome v36.0.1985.143

    [ File : C:\Users\Radiant\AppData\Local\Google\Chrome\User Data\Default\preferences ]

    Deleted [Search Provider] : hxxp://search.aol.com/aol/search?q={searchTerms}
    Deleted [Search Provider] : hxxp://www.ask.com/web?q={searchTerms}

    *************************

    AdwCleaner[R0].txt - [2820 octets] - [17/08/2014 09:27:52]
    AdwCleaner[S0].txt - [2682 octets] - [17/08/2014 09:28:43]

    ########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [2742 octets] ##########
     
  16. theRadiantChild

    theRadiantChild TS Enthusiast Topic Starter Posts: 319

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    Junkware Removal Tool (JRT) by Thisisu
    Version: 6.1.4 (04.06.2014:1)
    OS: Windows 7 Home Premium x64
    Ran by Radiant on Sun 08/17/2014 at 9:32:40.77
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




    ~~~ Services



    ~~~ Registry Values



    ~~~ Registry Keys



    ~~~ Files



    ~~~ Folders

    Successfully deleted: [Folder] "C:\Users\Radiant\appdata\locallow\boost_interprocess"
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{041B9FC6-9DD0-4A13-AD8A-3CE9A3A4E268}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{076A05BB-2EF4-4D17-B090-83117D239A92}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{08A83121-B7AB-4B22-A508-DA42F89A87FF}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{08B700A1-004F-4F50-8AA5-FF0E0D32B175}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{0F43068D-99C5-42D2-9E13-DC2E46D3A701}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{1650C3AB-3091-4A5C-9ACB-25A0B1BAD6DD}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{17C0D004-9586-4C19-B0D8-5132864E8806}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{1B8A5D4F-EB60-48D9-8E12-BD4523B295AB}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{1F54CFE0-898F-42ED-9823-CA966681DE0C}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{1FDD24D7-F675-4E88-8534-0795CF90BDDE}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{203AA4B0-CD64-4A7F-ACCD-CD9F9650844E}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{22854B62-55A9-49A1-901C-000D8A5CC59B}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{232F94DF-289A-4605-8C15-D7B966A31220}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{26E8AD08-020F-426D-88D7-867C1D252060}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{29DF1FDD-0449-4B3D-B892-E56CC9C32AFF}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{29E1938A-67F3-4078-A797-A9789DB5DFCC}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{2A792C84-D9AF-46A7-86B4-051AB9E4CD12}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{30B8D016-8340-44C7-8858-4E8BEB8C9E70}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{30EDEB50-F3A4-499B-B2FA-4675507E8418}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{34518835-7867-4443-A235-E545ED6C8BD6}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{34877009-C623-476A-87A4-70FDE8E87FFB}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{39998EDD-B590-401E-BDF3-80F52AD324B2}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{3E34EDCA-C96F-44A2-B388-E19E363DB6E5}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{3FB11681-F9FF-44D4-A17B-6D13AEFEE84A}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{44079F0E-BE73-4E31-B61B-212F3701C47C}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{452DBFCA-7E2F-43CE-BD7B-F936962CCEEE}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{453DF706-8036-4ED3-BD85-3B37EAE915F2}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{45A23B6C-75F0-4DA7-8023-B399443D9EF1}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{45DF8F17-85AD-4704-A38F-8944A8E09F05}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{45E43381-C65F-48AE-A18A-07DC249CA4C7}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{4A7F5720-5C49-469D-A644-ABEBDFFE289A}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{4B189387-9C10-4F50-A135-43B19F2D9454}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{4C6F2AC0-0B80-4A49-A373-3A6EBED333A7}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{4F23DDD4-2D79-483A-A1CD-49FF433BB3A9}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{4F95EBAA-7AAE-40DB-BDD6-CAB507082894}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{527BE957-572E-47E3-94AC-49AD4F34DB03}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{532B790E-4989-4B28-951B-71705EA46006}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{544B4700-ACB5-4941-ACE0-20D7855DDF67}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{54F6A0A1-BCB6-4473-9866-36D5D913BB24}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{57066478-4156-4816-9CF0-554970F7D179}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{5736DA5A-154D-4E83-B3CD-57D5E90E0F8B}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{5B7922F7-1B48-4924-8C0C-77C34BDE76F1}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{68350F50-5B2A-4EF8-9EEC-68C21FDD04B8}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{68652A07-ADCC-44B6-8495-221296BE9692}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{6DA1A04C-38FE-4F1F-A04D-670FAC9A07D8}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{6DC9CEBF-700E-4E41-8E4C-AD37D3507672}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{6ED7BE84-39E2-4DC8-A6C2-DEE33679F8E9}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{72B49BE1-E7EE-4D2F-9511-AEEEF0BBBEA4}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{741DFED4-341D-42AF-BA9B-EA9427A2220B}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{74F49FBA-8A7B-48CA-92A6-075773E594AD}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{7532D8C7-CD62-4744-B85E-05EC2E926DB9}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{7689AAF7-D3D6-448A-BDCB-FA25DF970F3D}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{76B093B9-7197-4920-891B-0FAB2661ACEB}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{7865D2D0-97D7-4BB5-936A-2E568A92FC1A}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{799C234C-CC26-4521-9806-BD0DA586293F}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{79DF4E57-704C-4BC7-8AA1-E8F4C6EEC70D}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{79FE1DE7-BAEB-44DC-871C-3E116C1529AF}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{7B3E67EA-3D56-4140-9521-CFB4F3A47D89}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{7D63D2CA-D640-4174-B0F2-85EECA517579}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{7E6B7DCE-BC55-417B-A54F-4F044B98DC28}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{7E9F3DB4-43C2-44EF-BA50-8223FB3C663B}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{7EAA49A1-038A-4EBD-92F0-176B0086B7A0}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{7F30A50B-95EE-4EEC-9AC7-FA6271443067}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{7FEA53D4-1ED8-48D8-ADEC-713464AA2874}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{828E47F7-F00E-49BC-BE17-C98109743C40}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{83887E33-4516-4348-B9FA-4FF0BF2699F8}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{83DBEE40-B254-49B3-90D7-03F9D75B873D}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{85B63621-7F93-4C1F-97BB-A43022FBD7E0}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{87836EAE-435C-418E-B546-399D303A1C37}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{883A5D6D-BC82-47C8-A41D-2EFFC7F54D08}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{8950AB4D-921A-434D-806F-2DF1A1C59226}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{89D9796B-CA20-45FE-9884-5974DEB1A78D}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{8AFC774D-95AA-443A-B84E-9A6DB4C05A08}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{8C29FE56-F041-4924-8386-AFC7904E8557}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{8E56B61E-2D85-4438-9A83-47DA046670AB}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{9118774E-ED11-4646-A89F-ECD8886D8DFC}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{93B5F9C4-DD8D-45D7-B1D4-9A527CF72AB9}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{93DA1D13-0E74-4C82-A153-98A63F97BBD2}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{94A7092D-BD1C-4FF1-8989-74082F727DAD}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{971A3AB5-2553-4514-A1D8-E5738D9EB5C0}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{9C499EBC-7341-470B-A786-6DF0AD8CA966}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{9CECB32B-D33A-4296-B062-99BF80EF653B}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{A321779D-3957-4E7F-9B2E-A10D10D1C2AA}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{A3720741-3EE2-4D5E-BB06-0EDD251AA6A0}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{A6ECF0BA-32CB-4754-A6C6-85973036329C}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{AA1F834B-4508-4CF6-97CD-D801D65AEC30}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{AB2DAA19-6A2A-4AB7-BAA4-77A92EF037D6}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{AB3EDE1D-D3A2-4D0F-B77F-A76342FBD172}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{AEED0250-C2A0-443B-8DE3-B567CD53A6C6}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{B25CD083-339A-469A-B000-07CFAACA4D30}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{B5C4BD52-6939-4367-A835-BD612E537DE4}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{B6F7873E-0869-415B-99C9-D39A5F8D379E}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{B879C59F-36E0-4C0C-85FB-306C2B2A1282}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{BDB38EC7-9C09-49CB-B82E-A7704E687241}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{BE8B0AD0-6100-4A0B-8CB4-5064A231C307}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{BF1692D4-3ABC-4D54-8440-4E13BBD50FF6}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{C76FA34C-C08E-4AC2-8969-162F4F951436}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{C891B041-F05E-46CD-939A-69E48670A7E2}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{C9593C0D-E6C4-4FE1-B0BF-EFE218B6E43A}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{C9EB7E59-FFDF-4098-A791-31E7E6F4FB2C}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{CB059BDF-0646-4051-B525-740F2899C4EA}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{CB42DC6B-6C9A-4948-BEDF-9BB3E4E4297E}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{CDB553F0-B097-41B6-8331-6B84DC5AE2DA}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{CE4BDECA-CBB8-4719-9A46-44F11A1D6278}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{D6BBE6BE-9F91-4EDD-9999-50224F7593C6}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{DA54AFF4-459E-4C9F-8265-77AE59A70B96}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{DB6968ED-626F-481A-ACAC-7062D0F45B92}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{DB85051C-7ADB-49FA-B11D-8BBA7263C00E}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{DC02E6E6-435D-4323-8E76-E4E167365774}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{DE6DA3E8-2954-4B97-9A05-02CAC0602B44}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{E0BD5563-836F-4DFC-9D3D-9352A7869ADB}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{E201FF3B-D92A-4962-A0C9-D3B5616C92D8}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{E20536A7-9BD9-40E9-B666-5E99E7BFD733}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{E23B6BE6-2505-4A57-85A9-8B756FD722F7}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{E4E6FE2C-C3E8-419A-821F-238AC0453414}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{E5E63D02-8AAD-4F14-BD99-F5D317ED97CF}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{E61D0484-CD5B-4F23-A3D7-6479FFB0A7B9}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{E868FE24-3199-46D8-BE10-B12585584D34}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{EA529FB9-4A46-48EC-AF99-FBE6A5DF007B}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{EBC9F1D8-2FFD-420F-80AB-868CE4EE5887}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{ED8CB69F-E6F6-4735-9AAC-2CD18A68EBA5}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{EEEC120D-1DA3-4514-9989-877552931949}
    Successfully deleted: [Empty Folder] C:\Users\Radiant\appdata\local\{FD3ED83E-1C1C-4EDD-AF0C-EAF3358D391E}



    ~~~ Event Viewer Logs were cleared





    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    Scan was completed on Sun 08/17/2014 at 9:41:13.23
    End of JRT log
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     
  17. theRadiantChild

    theRadiantChild TS Enthusiast Topic Starter Posts: 319

    Additional scan result of Farbar Recovery Scan Tool (x64) Version: 16-08-2014 04
    Ran by Radiant at 2014-08-17 09:43:54
    Running from C:\Users\Radiant\Desktop
    Boot Mode: Normal
    ==========================================================


    ==================== Security Center ========================

    (If an entry is included in the fixlist, it will be removed.)

    AV: Microsoft Security Essentials (Disabled - Up to date) {641105E6-77ED-3F35-A304-765193BCB75F}
    AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    AS: Microsoft Security Essentials (Disabled - Up to date) {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}

    ==================== Installed Programs ======================

    (Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

    µTorrent (HKCU\...\uTorrent) (Version: 3.4.2.32239 - BitTorrent Inc.)
    7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
    Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 13.0.0.83 - Adobe Systems Incorporated)
    Adobe AIR (x32 Version: 13.0.0.83 - Adobe Systems Incorporated) Hidden
    Adobe Flash Player 14 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 14.0.0.145 - Adobe Systems Incorporated)
    Adobe Reader X (10.1.0) MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}) (Version: 10.1.0 - Adobe Systems Incorporated)
    Apple Application Support (HKLM-x32\...\{A83279FD-CA4B-4206-9535-90974DE76654}) (Version: 2.1.5 - Apple Inc.)
    Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
    Bastion (HKLM-x32\...\Steam App 107100) (Version: - Supergiant Games)
    CCleaner (HKLM\...\CCleaner) (Version: 4.14 - Piriform)
    Cole2k Media - Codec Pack (Advanced) 8.0.2 (HKLM-x32\...\Cole2k Media - Codec Pack) (Version: 8.0.2 - Cole2k Media)
    Create Recovery Media (HKLM-x32\...\{50DC5136-21E8-48BC-97E5-1AD055F6B0B6}) (Version: 1.20.0.00 - Lenovo Group Limited)
    D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
    DAEMON Tools Lite (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.49.1.0356 - Disc Soft Ltd)
    Definition Update for Microsoft Office 2013 (KB2760587) 64-Bit Edition (HKLM\...\{91150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{8E17BF11-A72D-4DA8-BFAA-DD262C17C2DE}) (Version: - Microsoft)
    Disable AMT Profile Synchronization Pop-up for Windows XP/Vista/7 (HKLM\...\DisableAMTPopup) (Version: 1.00 - )
    DivX Setup (HKLM-x32\...\DivX Setup) (Version: 2.6.3.52 - DivX, LLC)
    Dolby Advanced Audio v2 (HKLM-x32\...\{B9E70C7A-9F85-4A39-A4A3-BFA3C3BF7613}) (Version: 7.2.8000.17 - Dolby Laboratories Inc)
    Evernote v. 4.2.3 (HKLM-x32\...\{F761359C-9CED-45AE-9A51-9D6605CD55C4}) (Version: 4.2.3.15 - Evernote Corp.)
    Google Chrome (HKLM-x32\...\Google Chrome) (Version: 36.0.1985.143 - Google Inc.)
    Google Earth (HKLM-x32\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
    Google Talk Plugin (HKLM-x32\...\{C1E3DFE7-4EAD-3E9E-A826-E06055BA5921}) (Version: 5.4.2.18903 - Google)
    Google Update Helper (x32 Version: 1.3.24.15 - Google Inc.) Hidden
    ImgBurn (HKLM-x32\...\ImgBurn) (Version: 2.5.8.0 - LIGHTNING UK!)
    Integrated Camera Driver Installer Package Ver.1.2.1.18 (HKLM-x32\...\{A78800AF-1779-4AE8-8EBE-16E1BE727C71}) (Version: 1.2.1.18 - RICOH)
    Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)
    Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.0.3.1427 - Intel Corporation)
    Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.18.10.3359 - Intel Corporation)
    Intel(R) PROSet/Wireless WiFi Software Driver (Version: 15.06.1000.0167 - Intel Corporation) Hidden
    Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 3.0.0.66956 - Intel Corporation)
    Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 1.0.9.254 - Intel Corporation)
    Intel(R) WiDi (HKLM\...\{728985C5-A04B-457C-9D62-15360F3EAF85}) (Version: 3.1.29.0 - Intel Corporation)
    Intel(R) Wireless Display (HKLM\...\{28EF7372-9087-4AC3-9B9F-D9751FCDF830}) (Version: - )
    Intel® PROSet/Wireless Software (HKLM-x32\...\{fad118b4-798f-4755-9e67-a622eec95b62}) (Version: 15.6.1 - Intel Corporation)
    Intel® PROSet/Wireless WiFi Software (Version: 15.06.1000.0142 - Intel Corporation) Hidden
    Intel® Trusted Connect Service Client (HKLM\...\{09536BA1-E498-4CC3-B834-D884A67D7E34}) (Version: 1.23.605.1 - Intel Corporation)
    Java 7 Update 65 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217051FF}) (Version: 7.0.650 - Oracle)
    Java Auto Updater (x32 Version: 2.1.65.20 - Oracle, Inc.) Hidden
    Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
    LastPass (uninstall only) (HKLM-x32\...\LastPass) (Version: - LastPass)
    Lenovo Auto Scroll Utility (HKLM\...\LenovoAutoScrollUtility) (Version: 2.02 - )
    Lenovo Patch Utility (x32 Version: 1.4.0.4 - Lenovo Group Limited) Hidden
    Lenovo Patch Utility 64 bit (Version: 1.4.0.4 - Lenovo Group Limited) Hidden
    Lenovo Power Management Driver (HKLM\...\Power Management Driver) (Version: 1.67.04.04 - )
    Lenovo Registration (HKLM-x32\...\{6707C034-ED6B-4B6A-B21F-969B3606FBDE}) (Version: 1.0.4 - Lenovo Inc.)
    Lenovo SimpleTap (HKLM\...\{BF601122-9F0A-41A9-BA06-3158D9FB4B80}) (Version: 3.2.0004.00 - Lenovo Group Limited)
    Lenovo Solution Center (HKLM\...\{2F45A217-E9C7-4984-B0AC-5BE31FF4712B}) (Version: 2.4.003.00 - Lenovo Group Limited)
    Lenovo System Update (HKLM-x32\...\{25C64847-B900-48AD-A164-1B4F9B774650}) (Version: 5.05.0009 - Lenovo)
    Lenovo User Guide (HKLM-x32\...\{13F59938-C595-479C-B479-F171AB9AF64F}) (Version: 1.0.0009.00 - Lenovo Group Limited)
    Lenovo Warranty Information (HKLM-x32\...\{FD4EC278-C1B1-4496-99ED-C0BE1B0AA521}) (Version: 1.0.0005.00 - Lenovo)
    Lenovo Welcome (HKLM-x32\...\{2DC26D10-CC6A-494F-BEA3-B5BC21126D5E}) (Version: 3.1.0020.00 - Lenovo Group Limited)
    Malwarebytes Anti-Exploit version 1.03.1.1220 (HKLM\...\Malwarebytes Anti-Exploit_is1) (Version: 1.03.1.1220 - Malwarebytes)
    Malwarebytes Anti-Malware version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
    Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
    Message Center Plus (HKLM\...\{3849486C-FF09-4F5D-B491-3E179D58EE15}) (Version: 3.1.0004.00 - Lenovo Group Limited)
    Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
    Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
    Microsoft Access MUI (English) 2013 (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
    Microsoft Access Setup Metadata MUI (English) 2013 (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
    Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
    Microsoft DCF MUI (English) 2013 (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
    Microsoft Excel MUI (English) 2013 (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
    Microsoft Groove MUI (English) 2013 (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
    Microsoft InfoPath MUI (English) 2013 (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
    Microsoft Lync MUI (English) 2013 (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
    Microsoft Office 32-bit Components 2013 (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
    Microsoft Office OSM MUI (English) 2013 (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
    Microsoft Office OSM UX MUI (English) 2013 (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
    Microsoft Office Professional Plus 2013 (HKLM\...\Office15.PROPLUSR) (Version: 15.0.4569.1506 - Microsoft Corporation)
    Microsoft Office Professional Plus 2013 (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
    Microsoft Office Proofing (English) 2013 (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
    Microsoft Office Proofing Tools 2013 - English (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
    Microsoft Office Proofing Tools 2013 - Español (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
    Microsoft Office Shared 32-bit MUI (English) 2013 (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
    Microsoft Office Shared MUI (English) 2013 (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
    Microsoft Office Shared Setup Metadata MUI (English) 2013 (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
    Microsoft OneNote MUI (English) 2013 (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
    Microsoft Outlook MUI (English) 2013 (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
    Microsoft PowerPoint MUI (English) 2013 (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
    Microsoft Publisher MUI (English) 2013 (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
    Microsoft Security Client (Version: 4.5.0216.0 - Microsoft Corporation) Hidden
    Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.5.216.0 - Microsoft Corporation)
    Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
    Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
    Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
    Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
    Microsoft Word MUI (English) 2013 (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
    Microsoft XNA Framework Redistributable 3.1 (HKLM-x32\...\{19BFDA5D-1FE2-4F25-97F9-1A79DD04EE20}) (Version: 3.1.10527.0 - Microsoft Corporation)
    Mortal Kombat Komplete Edition (HKLM-x32\...\Steam App 237110) (Version: - NetherRealm Studios)
    MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
    MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
    MyFreeCodec (HKCU\...\MyFreeCodec) (Version: - )
    Nalpeiron License Management (x32 Version: 6.3.9.1 - Nalpeiron) Hidden
    Nitro Pro 7 (HKLM\...\{8E0790DA-185E-4DC1-8A88-750B2A6218FD}) (Version: 7.4.1.4 - Nitro PDF Software)
    On Screen Display (HKLM\...\OnScreenDisplay) (Version: 8.33.00 - )
    Outils de vérification linguistique 2013 de Microsoft Office - Français (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
    PeerBlock 1.2 (r693) (HKLM\...\{015C5B35-B678-451C-9AEE-821E8D69621C}_is1) (Version: 1.2.0.693 - PeerBlock, LLC)
    Power Manager (HKLM-x32\...\{DAC01CEE-5BAE-42D5-81FC-B687E84E8405}) (Version: 6.64.2 - Lenovo Group Limited)
    QuickTime (HKLM-x32\...\{7BE15435-2D3E-4B58-867F-9C75BED0208C}) (Version: 7.71.80.42 - Apple Inc.)
    RapidBoot HDD Accelerator (HKLM-x32\...\Fastboot) (Version: 1.00.0802 - Lenovo)
    RapidBoot Shield (HKLM\...\{5E2652DF-743F-482B-A593-C95F431A5769}) (Version: 1.23 - Lenovo)
    Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6914 - Realtek Semiconductor Corp.)
    Registry Patch to Enable Maximum Power Saving on WiFi Adapters for Windows 7 (HKLM\...\EnablePS) (Version: 1.00 - )
    RICOH_Media_Driver_v2.14.18.01 (HKLM-x32\...\{FE041B02-234C-4AAA-9511-80DF6482A458}) (Version: 2.14.18.01 - RICOH)
    Samsung Kies (HKLM-x32\...\InstallShield_{758C8301-2696-4855-AF45-534B1200980A}) (Version: 2.6.2.14014_6 - Samsung Electronics Co., Ltd.)
    Samsung Kies (x32 Version: 2.6.2.14014_6 - Samsung Electronics Co., Ltd.) Hidden
    Samsung Kies3 (HKLM-x32\...\InstallShield_{88547073-C566-4895-9005-EBE98EA3F7C7}) (Version: 3.2.14024.11 - Samsung Electronics Co., Ltd.)
    Samsung Kies3 (x32 Version: 3.2.14024.11 - Samsung Electronics Co., Ltd.) Hidden
    SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.34.0 - SAMSUNG Electronics Co., Ltd.)
    Service Pack 1 for Microsoft Office 2013 (KB2850036) 64-Bit Edition (HKLM\...\{91150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{D82063A8-7C8C-4C3B-A9BB-95138CA55D26}) (Version: - Microsoft)
    Service Pack 1 for Microsoft Office 2013 (KB2850036) 64-Bit Edition (Version: - Microsoft) Hidden
    Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.3.16540.9015 - Microsoft Corporation)
    Skype™ 6.16 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.16.105 - Skype Technologies S.A.)
    Spotify (HKCU\...\Spotify) (Version: 0.9.8.296.g91f68827 - Spotify AB)
    StreetSmart Edge® (HKLM-x32\...\{5646676A-5A97-4B66-BE71-1B1770AD982B}) (Version: 1.21.28.0 - Schwab)
    SugarSync Manager (HKLM-x32\...\SugarSync) (Version: 1.9.61.90905 - SugarSync, Inc.)
    Superbrothers: Sword & Sworcery EP (HKLM-x32\...\Steam App 204060) (Version: - )
    TeamViewer 9 (HKLM-x32\...\TeamViewer 9) (Version: 9.0.29947 - TeamViewer)
    The KMPlayer (remove only) (HKLM-x32\...\The KMPlayer) (Version: 3.9.0.126 - PandoraTV)
    ThinkPad Bluetooth with Enhanced Data Rate Software (HKLM\...\{A1439D4F-FD46-47F2-A1D3-FEE097C29A09}) (Version: 6.5.1.4500 - Broadcom Corporation)
    ThinkPad UltraNav Driver (HKLM\...\SynTPDeinstKey) (Version: 16.2.19.7 - )
    ThinkVantage Active Protection System (HKLM\...\{46A84694-59EC-48F0-964C-7E76E9F8A2ED}) (Version: 1.77.0.9 - Lenovo)
    ThinkVantage Communications Utility (HKLM\...\{88C6A6D9-324C-46E8-BA87-563D14021442}_is1) (Version: 3.0.34.0 - Lenovo)
    ThinkVantage Fingerprint Software (HKLM\...\{F58DA859-016E-492D-A588-317D9BB28002}) (Version: 5.9.9.7282 - Authentec Inc.)
    Update for Microsoft Excel 2013 (KB2883061) 64-Bit Edition (HKLM\...\{90150000-0016-0409-1000-0000000FF1CE}_Office15.PROPLUSR_{B74255AD-6736-4648-A35E-CCB2D38D3818}) (Version: - Microsoft)
    Update for Microsoft Excel 2013 (KB2883061) 64-Bit Edition (HKLM\...\{90150000-0018-0409-1000-0000000FF1CE}_Office15.PROPLUSR_{B74255AD-6736-4648-A35E-CCB2D38D3818}) (Version: - Microsoft)
    Update for Microsoft Excel 2013 (KB2883061) 64-Bit Edition (HKLM\...\{90150000-001B-0409-1000-0000000FF1CE}_Office15.PROPLUSR_{B74255AD-6736-4648-A35E-CCB2D38D3818}) (Version: - Microsoft)
    Update for Microsoft Excel 2013 (KB2883061) 64-Bit Edition (HKLM\...\{91150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{B74255AD-6736-4648-A35E-CCB2D38D3818}) (Version: - Microsoft)
    Update for Microsoft Lync 2013 (KB2881070) 64-Bit Edition (HKLM\...\{90150000-00C1-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{2B0BC4FE-4936-4EC6-8521-526CF31B3DC4}) (Version: - Microsoft)
    Update for Microsoft Lync 2013 (KB2881070) 64-Bit Edition (HKLM\...\{90150000-012B-0409-1000-0000000FF1CE}_Office15.PROPLUSR_{2B0BC4FE-4936-4EC6-8521-526CF31B3DC4}) (Version: - Microsoft)
    Update for Microsoft Lync 2013 (KB2881070) 64-Bit Edition (HKLM\...\{91150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{2B0BC4FE-4936-4EC6-8521-526CF31B3DC4}) (Version: - Microsoft)
    Update for Microsoft Lync 2013 (KB2881083) 64-Bit Edition (HKLM\...\{90150000-012B-0409-1000-0000000FF1CE}_Office15.PROPLUSR_{8260F0BF-F234-41FC-AB11-218A9925F77B}) (Version: - Microsoft)
    Update for Microsoft Office 2013 (KB2760249) 64-Bit Edition (HKLM\...\{91150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{7A4AB8E1-C091-4BD3-B308-844BA6EE752A}) (Version: - Microsoft)
    Update for Microsoft Office 2013 (KB2760344) 64-Bit Edition (HKLM\...\{91150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{EF77B4A6-DFEC-4010-A87D-9B6BF87FABEC}) (Version: - Microsoft)
    Update for Microsoft Office 2013 (KB2760544) 64-Bit Edition (HKLM\...\{91150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{62857CDD-2985-4939-91BA-19ED0B0031A5}) (Version: - Microsoft)
    Update for Microsoft Office 2013 (KB2768012) 64-Bit Edition (HKLM\...\{91150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{0814662C-FD28-4DE0-ACE5-EE50D1D6C8FB}) (Version: - Microsoft)
    Update for Microsoft Office 2013 (KB2817302) 64-Bit Edition (HKLM\...\{90150000-0016-0409-1000-0000000FF1CE}_Office15.PROPLUSR_{E79EFFDB-192A-4D9E-A2DB-C0F774E6EC32}) (Version: - Microsoft)
    Update for Microsoft Office 2013 (KB2817302) 64-Bit Edition (HKLM\...\{91150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{E79EFFDB-192A-4D9E-A2DB-C0F774E6EC32}) (Version: - Microsoft)
    Update for Microsoft Office 2013 (KB2826040) 64-Bit Edition (HKLM\...\{91150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{C4AEA56A-0759-4D08-9FAB-31A92137D0B8}) (Version: - Microsoft)
    Update for Microsoft Office 2013 (KB2837644) 64-Bit Edition (HKLM\...\{91150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{D692E9FF-84BF-4F44-A0EA-D58ECE0D538E}) (Version: - Microsoft)
    Update for Microsoft Office 2013 (KB2863843) 64-Bit Edition (HKLM\...\{91150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{290D80DE-03AB-47EC-9402-108AF4CE4F66}) (Version: - Microsoft)
    Update for Microsoft Office 2013 (KB2880457) 64-Bit Edition (HKLM\...\{91150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{EC2AF602-2730-4B05-9438-06CDE43153F2}) (Version: - Microsoft)
    Update for Microsoft Office 2013 (KB2880462) 64-Bit Edition (HKLM\...\{90150000-006E-0409-1000-0000000FF1CE}_Office15.PROPLUSR_{24584DD4-C680-4FEB-A464-D760C7A5B041}) (Version: - Microsoft)
    Update for Microsoft Office 2013 (KB2880462) 64-Bit Edition (HKLM\...\{90150000-00C1-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{24584DD4-C680-4FEB-A464-D760C7A5B041}) (Version: - Microsoft)
    Update for Microsoft Office 2013 (KB2880462) 64-Bit Edition (HKLM\...\{91150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{24584DD4-C680-4FEB-A464-D760C7A5B041}) (Version: - Microsoft)
    Update for Microsoft Office 2013 (KB2880478) 64-Bit Edition (HKLM\...\{91150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{8116ED50-F1E7-49E1-9D8D-421497D34B0F}) (Version: - Microsoft)
    Update for Microsoft Office 2013 (KB2880987) 64-Bit Edition (HKLM\...\{90150000-006E-0409-1000-0000000FF1CE}_Office15.PROPLUSR_{6F540E80-4BB2-413F-9648-52031AA237B7}) (Version: - Microsoft)
    Update for Microsoft Office 2013 (KB2880987) 64-Bit Edition (HKLM\...\{90150000-00C1-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{6F540E80-4BB2-413F-9648-52031AA237B7}) (Version: - Microsoft)
    Update for Microsoft Office 2013 (KB2880987) 64-Bit Edition (HKLM\...\{91150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{6F540E80-4BB2-413F-9648-52031AA237B7}) (Version: - Microsoft)
    Update for Microsoft Office 2013 (KB2881009) 64-Bit Edition (HKLM\...\{91150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{3033838D-15E0-4199-8CBD-A7F2057AE653}) (Version: - Microsoft)
    Update for Microsoft Office 2013 (KB2881035) 64-Bit Edition (HKLM\...\{90150000-0016-0409-1000-0000000FF1CE}_Office15.PROPLUSR_{885C981B-F1E3-430A-A099-31CA9D28C251}) (Version: - Microsoft)
    Update for Microsoft Office 2013 (KB2881035) 64-Bit Edition (HKLM\...\{90150000-0090-0409-1000-0000000FF1CE}_Office15.PROPLUSR_{885C981B-F1E3-430A-A099-31CA9D28C251}) (Version: - Microsoft)
    Update for Microsoft Office 2013 (KB2881035) 64-Bit Edition (HKLM\...\{91150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{885C981B-F1E3-430A-A099-31CA9D28C251}) (Version: - Microsoft)
    Update for Microsoft Office 2013 (KB2883036) 64-Bit Edition (HKLM\...\{91150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{E919ACF4-A1D7-4CAA-A103-5EB115563721}) (Version: - Microsoft)
    Update for Microsoft Office 2013 (KB2883049) 64-Bit Edition (HKLM\...\{91150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{39D9DAC1-16A7-430A-B2F3-4D3D000454D0}) (Version: - Microsoft)
    Update for Microsoft Office 2013 (KB2883060) 64-Bit Edition (HKLM\...\{90150000-001F-0409-1000-0000000FF1CE}_Office15.PROPLUSR_{F9C35D99-CA8E-4D17-B785-66AC654D5664}) (Version: - Microsoft)
    Update for Microsoft Office 2013 (KB2883060) 64-Bit Edition (HKLM\...\{90150000-001F-040C-1000-0000000FF1CE}_Office15.PROPLUSR_{18C53DCB-FA98-4A7B-BC2E-6DA30D4E4901}) (Version: - Microsoft)
    Update for Microsoft Office 2013 (KB2883060) 64-Bit Edition (HKLM\...\{90150000-001F-0C0A-1000-0000000FF1CE}_Office15.PROPLUSR_{6E2862B8-C10A-4FD0-9B82-8D9761301AAA}) (Version: - Microsoft)
    Update for Microsoft Office 2013 (KB2883062) 64-Bit Edition (HKLM\...\{90150000-00C1-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{4A0B4ED7-3652-42C9-9D7E-42686986F69A}) (Version: - Microsoft)
    Update for Microsoft Office 2013 (KB2883062) 64-Bit Edition (HKLM\...\{91150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{4A0B4ED7-3652-42C9-9D7E-42686986F69A}) (Version: - Microsoft)
    Update for Microsoft OneDrive for Business (KB2883066) 64-Bit Edition (HKLM\...\{90150000-00BA-0409-1000-0000000FF1CE}_Office15.PROPLUSR_{5E9FA8D8-45A9-4223-A5A8-285CB6188592}) (Version: - Microsoft)
    Update for Microsoft OneDrive for Business (KB2883066) 64-Bit Edition (HKLM\...\{90150000-00C1-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{5E9FA8D8-45A9-4223-A5A8-285CB6188592}) (Version: - Microsoft)
    Update for Microsoft OneDrive for Business (KB2883066) 64-Bit Edition (HKLM\...\{90150000-00C1-0409-1000-0000000FF1CE}_Office15.PROPLUSR_{5E9FA8D8-45A9-4223-A5A8-285CB6188592}) (Version: - Microsoft)
    Update for Microsoft OneDrive for Business (KB2883066) 64-Bit Edition (HKLM\...\{91150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{5E9FA8D8-45A9-4223-A5A8-285CB6188592}) (Version: - Microsoft)
    Update for Microsoft OneNote 2013 (KB2881082) 64-Bit Edition (HKLM\...\{90150000-00A1-0409-1000-0000000FF1CE}_Office15.PROPLUSR_{BFD66A5D-F608-441E-9282-41E13F5E7412}) (Version: - Microsoft)
    Update for Microsoft OneNote 2013 (KB2881082) 64-Bit Edition (HKLM\...\{90150000-00C1-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{BFD66A5D-F608-441E-9282-41E13F5E7412}) (Version: - Microsoft)
    Update for Microsoft OneNote 2013 (KB2881082) 64-Bit Edition (HKLM\...\{91150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{BFD66A5D-F608-441E-9282-41E13F5E7412}) (Version: - Microsoft)
    Update for Microsoft Outlook 2013 (KB2881011) 64-Bit Edition (HKLM\...\{90150000-001A-0409-1000-0000000FF1CE}_Office15.PROPLUSR_{679E6BE6-50D5-4D94-A10E-CB4FE1C5695B}) (Version: - Microsoft)
    Update for Microsoft Outlook 2013 (KB2881011) 64-Bit Edition (HKLM\...\{91150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{679E6BE6-50D5-4D94-A10E-CB4FE1C5695B}) (Version: - Microsoft)
    Update for Microsoft PowerPoint 2013 (KB2883051) 64-Bit Edition (HKLM\...\{90150000-0018-0409-1000-0000000FF1CE}_Office15.PROPLUSR_{E2C51083-2E10-4E61-8F36-E6308DD0FA94}) (Version: - Microsoft)
    Update for Microsoft PowerPoint 2013 (KB2883051) 64-Bit Edition (HKLM\...\{91150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{E2C51083-2E10-4E61-8F36-E6308DD0FA94}) (Version: - Microsoft)
    Update for Microsoft Publisher 2013 (KB2880999) 64-Bit Edition (HKLM\...\{90150000-0019-0409-1000-0000000FF1CE}_Office15.PROPLUSR_{C07147B9-CC0B-4CC1-A107-A705889A54F2}) (Version: - Microsoft)
    Update for Microsoft Publisher 2013 (KB2880999) 64-Bit Edition (HKLM\...\{91150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{C07147B9-CC0B-4CC1-A107-A705889A54F2}) (Version: - Microsoft)
    Update for Microsoft Visio 2013 (KB2837632) 64-Bit Edition (HKLM\...\{91150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{97183E08-6B06-40F1-80A9-585C4AEF98F1}) (Version: - Microsoft)
    Update for Microsoft Visio Viewer 2013 (KB2817301) 64-Bit Edition (HKLM\...\{90150000-006E-0409-1000-0000000FF1CE}_Office15.PROPLUSR_{8E5CD68A-CDF8-4930-88DF-B7778B1871A9}) (Version: - Microsoft)
    Update for Microsoft Visio Viewer 2013 (KB2817301) 64-Bit Edition (HKLM\...\{91150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{8E5CD68A-CDF8-4930-88DF-B7778B1871A9}) (Version: - Microsoft)
    Update for Microsoft Word 2013 (KB2878319) 64-Bit Edition (HKLM\...\{91150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{BC51FE30-3A56-4802-8D9E-E9BC05B56B49}) (Version: - Microsoft)
    Update for Microsoft Word 2013 (KB2881080) 64-Bit Edition (HKLM\...\{90150000-001A-0409-1000-0000000FF1CE}_Office15.PROPLUSR_{F96FE9BB-CD90-472B-852E-156342618C54}) (Version: - Microsoft)
    Update for Microsoft Word 2013 (KB2881080) 64-Bit Edition (HKLM\...\{90150000-001B-0409-1000-0000000FF1CE}_Office15.PROPLUSR_{F96FE9BB-CD90-472B-852E-156342618C54}) (Version: - Microsoft)
    Update for Microsoft Word 2013 (KB2881080) 64-Bit Edition (HKLM\...\{90150000-012B-0409-1000-0000000FF1CE}_Office15.PROPLUSR_{F96FE9BB-CD90-472B-852E-156342618C54}) (Version: - Microsoft)
    Update for Microsoft Word 2013 (KB2881080) 64-Bit Edition (HKLM\...\{91150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUSR_{F96FE9BB-CD90-472B-852E-156342618C54}) (Version: - Microsoft)
    VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0 - DivX, Inc) Hidden
    VIP Access (HKLM-x32\...\{E8D46836-CD55-453C-A107-A59EC51CB8DC}) (Version: 2.0.5.13 - VeriSign)
    VLC media player (HKLM-x32\...\VLC media player) (Version: 2.1.5 - VideoLAN)
    Windows Driver Package - Intel (e1cexpress) Net (01/11/2012 11.15.16.0) (HKLM\...\EC2A0F2B229770EC589265FCF2B4839A0C221993) (Version: 01/11/2012 11.15.16.0 - Intel)
    Windows Driver Package - Intel System (01/11/2012 9.3.0.1020) (HKLM\...\09839A9B5EDA69DA2DCC34637B5140AAF8A53B44) (Version: 01/11/2012 9.3.0.1020 - Intel)
    Windows Driver Package - Intel System (08/26/2011 9.3.0.1011) (HKLM\...\9D7CD466F7FC8B18FF1B84943B7BB8648D17FCE8) (Version: 08/26/2011 9.3.0.1011 - Intel)
    Windows Driver Package - Intel System (08/26/2011 9.3.0.1011) (HKLM\...\D8EF6CACF49BD33CC1FACD124C8CC2B1A8E8AE35) (Version: 08/26/2011 9.3.0.1011 - Intel)
    Windows Driver Package - Intel USB (08/26/2011 9.3.0.1011) (HKLM\...\97EE1802A0385A37DE6323FA39EC76BEB2D73E41) (Version: 08/26/2011 9.3.0.1011 - Intel)
    Windows Driver Package - Lenovo 1.65.05.20 (02/29/2012 1.65.05.20) (HKLM\...\E3535F123E7F666D573665142F90D3E5004DC326) (Version: 02/29/2012 1.65.05.20 - Lenovo)
    Windows Driver Package - Synaptics (SynTP) Mouse (04/06/2012 16.1.1.0) (HKLM\...\64B3C27E4CF7B6AD920184EFFF6C488C55EF2892) (Version: 04/06/2012 16.1.1.0 - Synaptics)
    Windows Live Communications Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
    Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3555.0308 - Microsoft Corporation)
    Windows Live Essentials (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
    Windows Live ID Sign-in Assistant (Version: 7.250.4232.0 - Microsoft Corporation) Hidden
    Windows Live Installer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
    Windows Live Language Selector (Version: 15.4.3555.0308 - Microsoft Corporation) Hidden
    Windows Live Mail (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
    Windows Live Mesh (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
    Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation)
    Windows Live Messenger (x32 Version: 15.4.3538.0513 - Microsoft Corporation) Hidden
    Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
    Windows Live Movie Maker (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
    Windows Live Photo Common (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
    Windows Live Photo Gallery (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
    Windows Live PIMT Platform (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
    Windows Live Remote Client (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
    Windows Live Remote Client Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
    Windows Live Remote Service (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
    Windows Live Remote Service Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
    Windows Live SOXE (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
    Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
    Windows Live UX Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
    Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
    Windows Live Writer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
    Windows Live Writer Resources (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

    ==================== Custom CLSID (selected items): ==========================

    (If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

    CustomCLSID: HKU\S-1-5-21-3277094342-1709878510-195001535-1001_Classes\CLSID\{90B3DFBF-AF6A-4EA0-8899-F332194690F8}\InprocServer32 -> C:\Users\Radiant\AppData\Local\Google\Update\1.3.24.15\psuser_64.dll (Google Inc.)
    CustomCLSID: HKU\S-1-5-21-3277094342-1709878510-195001535-1001_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\Radiant\AppData\Local\Google\Update\1.3.24.15\psuser_64.dll (Google Inc.)
    CustomCLSID: HKU\S-1-5-21-3277094342-1709878510-195001535-1001_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> E:\Users\Radiant\AppData\Roaming\Dropbox\bin\DropboxExt64.17.dll (Dropbox, Inc.)
    CustomCLSID: HKU\S-1-5-21-3277094342-1709878510-195001535-1001_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> E:\Users\Radiant\AppData\Roaming\Dropbox\bin\DropboxExt64.17.dll (Dropbox, Inc.)
    CustomCLSID: HKU\S-1-5-21-3277094342-1709878510-195001535-1001_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> E:\Users\Radiant\AppData\Roaming\Dropbox\bin\DropboxExt64.17.dll (Dropbox, Inc.)
    CustomCLSID: HKU\S-1-5-21-3277094342-1709878510-195001535-1001_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> E:\Users\Radiant\AppData\Roaming\Dropbox\bin\DropboxExt64.17.dll (Dropbox, Inc.)
    CustomCLSID: HKU\S-1-5-21-3277094342-1709878510-195001535-1001_Classes\CLSID\{FE498BAB-CB4C-4F88-AC3F-3641AAAF5E9E}\InprocServer32 -> C:\Users\Radiant\AppData\Local\Google\Update\1.3.24.7\psuser_64.dll No File

    ==================== Restore Points =========================

    26-02-2013 02:14:25 Windows Update
    27-02-2013 08:00:10 Windows Update
    02-03-2013 06:28:40 Installed Power Manager
    03-03-2013 04:51:42 Windows Update
    07-03-2013 07:04:58 Windows Update
    10-03-2013 23:48:09 Windows Update
    16-08-2014 12:06:35 rest
    16-08-2014 12:14:43 Malwarebytes Anti-Rootkit Restore Point
    16-08-2014 15:09:23 Windows Update

    ==================== Hosts content: ==========================

    (If needed Hosts: directive could be included in the fixlist to reset Hosts.)

    2009-07-13 22:34 - 2014-08-16 18:54 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
    127.0.0.1 localhost

    ==================== Scheduled Tasks (whitelisted) =============

    (If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

    Task: {04913723-8F49-4F5C-9F8F-A0D43292835A} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-07-09] (Adobe Systems Incorporated)
    Task: {04D256DF-20A4-4C6A-B12A-2930BE2D0E98} - System32\Tasks\Lenovo\LSC\LSCHardwareScan => C:\Program Files\Lenovo\Lenovo Solution Center\LSC.exe [2014-05-06] ()
    Task: {179C2582-47FA-4A03-9849-18B0D101B501} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program => C:\Program Files\Lenovo\Customer Feedback Program\Lenovo.TVT.CustomerFeedback.Agent.exe [2013-05-17] (Lenovo)
    Task: {202AED59-D050-42F8-86A2-8D61B2D49E55} - System32\Tasks\CCleanerSkipUAC => D:\Program Files\CCleaner\CCleaner.exe [2014-05-20] (Piriform Ltd)
    Task: {28F378BA-3C33-4040-889D-4FAB5E835755} - System32\Tasks\TVT\LenovoWERMonitor => C:\Program Files (x86)\Common Files\lenovo\SUP\sup_wermonitor.exe [2014-01-21] (Microsoft)
    Task: {3DBA0189-C1A1-48F7-9E42-579291AE014F} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-11-28] (Google Inc.)
    Task: {3E7C42DA-58BC-4118-AD0B-213F15E3A6E6} - System32\Tasks\Synaptics TouchPad Enhancements => \Program Files\Synaptics\SynTP\SynTPEnh.exe [2013-04-17] (Synaptics Incorporated)
    Task: {4D5DFE69-A9D9-4FF1-A736-1D3DCF52652F} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program 64 => C:\Program Files (x86)\Lenovo\Customer Feedback Program\Lenovo.TVT.CustomerFeedback.Agent.exe [2014-02-13] (Lenovo)
    Task: {66876B31-A90C-49A4-8BCA-6C9509225D97} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-23] (Microsoft Corporation)
    Task: {7C426496-DAA0-48B1-A3CA-09DFB6344CFB} - System32\Tasks\Microsoft Office 15 Sync Maintenance for Radiant-THINK-Radiant Radiant-THINK => C:\Program Files\Microsoft Office\Office15\MsoSync.exe [2014-07-27] (Microsoft Corporation)
    Task: {8B187BBC-DA3B-4CD3-B78D-C4AA8C73F0FB} - System32\Tasks\Lenovo\LSC\LSCHardwareScanPostpone => C:\Program Files\Lenovo\Lenovo Solution Center\LSC.exe [2014-05-06] ()
    Task: {8BA188AE-762F-4BF8-AD29-74D641F7E3A9} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-11-28] (Google Inc.)
    Task: {96DF410C-716B-462B-A55E-B65D5F81687B} - System32\Tasks\Microsoft\Windows\PLA\LSC Memory => Rundll32.exe C:\Windows\system32\pla.dll,PlaHost "LSC Memory" "$(Arg0)"
    Task: {A15AECFB-728A-46B9-AF68-4EDF569BB4DB} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exe [2014-01-23] (Microsoft Corporation)
    Task: {A7C64DE7-B031-4CC7-B2D5-960AAD5E3722} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-23] (Microsoft Corporation)
    Task: {B7B8701B-E5A1-4439-B327-9E03493D4545} - System32\Tasks\Lenovo\Lenovo Solution Center Launcher => C:\Program Files\lenovo\lenovo solution center\App\LSCService.exe [2014-05-06] (Lenovo)
    Task: {C2EEC5F4-9ECD-4EE1-A37E-A992552A82B7} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3277094342-1709878510-195001535-1001Core => C:\Users\Radiant\AppData\Local\Google\Update\GoogleUpdate.exe [2014-03-29] (Google Inc.)
    Task: {C4BCE9DD-4384-45E6-AE5E-B11FED46275C} - System32\Tasks\Lenovo\SimpleTap\Start SimpleTap for Radiant-THINK.Radiant => C:\Program Files\Lenovo\SimpleTap\SimpleTap.exe [2012-05-15] (Lenovo)
    Task: {CC5DA997-2E8A-476C-A948-46DB1EE05362} - System32\Tasks\DiskUpdate => C:\SWTOOLS\OSFIXES\DISKUPDT\DiskUpdate.exe [2009-02-09] ()
    Task: {DEF08910-9DB8-4907-AEA8-2BF020DC838D} - System32\Tasks\Lenovo\Message Center Plus Launcher => C:\Program Files (x86)\Lenovo\message center plus\mcplaunch.exe [2012-05-15] (Lenovo)
    Task: {E3ABFA12-7C15-4C3F-B816-396896AD53B1} - System32\Tasks\TVT\TVSUUpdateTask => C:\Program Files (x86)\Lenovo\System Update\tvsuShim.exe [2014-02-21] ()
    Task: {E3FF0474-81C0-432F-9B67-91999639EBC9} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3277094342-1709878510-195001535-1001UA => C:\Users\Radiant\AppData\Local\Google\Update\GoogleUpdate.exe [2014-03-29] (Google Inc.)
    Task: {F940AD2D-E9DF-426E-8768-2E6F80CAA630} - System32\Tasks\Lenovo\LSC\Time72Task => C:\Program Files\Lenovo\Lenovo Solution Center\App\LSCService.exe [2014-05-06] (Lenovo)
    Task: {F971D309-AE07-451C-9A6D-5A619739C43E} - System32\Tasks\PMTask => C:\Program Files (x86)\ThinkPad\Utilities\PwmIdTsv.exe [2013-12-09] (Lenovo Group Limited)
    Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
    Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3277094342-1709878510-195001535-1001Core.job => C:\Users\Radiant\AppData\Local\Google\Update\GoogleUpdate.exe
    Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3277094342-1709878510-195001535-1001UA.job => C:\Users\Radiant\AppData\Local\Google\Update\GoogleUpdate.exe

    ==================== Loaded Modules (whitelisted) =============

    2012-11-28 03:54 - 2012-03-19 02:09 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
    2014-01-10 01:26 - 2014-01-10 01:26 - 01861968 _____ () C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
    2012-11-28 03:58 - 2013-12-09 07:04 - 00104448 ____N () C:\Program Files (x86)\ThinkPad\Utilities\US\PWMRT64V.DLL
    2012-11-28 04:01 - 2012-01-17 02:29 - 00030512 _____ () C:\Program Files (x86)\Lenovo\RapidBoot HDD Accelerator\FBServiceps.dll
    2013-11-22 07:47 - 2011-08-02 05:58 - 02201088 _____ () C:\Program Files\Lenovo\Communications Utility\cxcore210.dll
    2013-11-22 07:47 - 2011-08-02 05:58 - 02085888 _____ () C:\Program Files\Lenovo\Communications Utility\cv210.dll
    2013-03-13 15:36 - 2013-03-13 15:36 - 03500544 _____ () C:\Windows\SysWow64\ffdshow.ax
    2014-01-10 01:28 - 2014-01-10 01:28 - 00100688 _____ () C:\Program Files (x86)\DivX\DivX Update\DivXUpdateCheck.dll
    2012-11-28 03:51 - 2012-02-20 23:09 - 01198872 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll

    ==================== Alternate Data Streams (whitelisted) =========

    (If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


    ==================== Safe Mode (whitelisted) ===================

    (If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


    ==================== EXE Association (whitelisted) =============

    (If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


    ==================== MSCONFIG/TASK MANAGER disabled items =========

    (Currently there is no automatic fix for this section.)


    ==================== Faulty Device Manager Devices =============

    Name: Bluetooth Peripheral Device
    Description: Bluetooth Peripheral Device
    Class Guid:
    Manufacturer:
    Service:
    Problem: : The drivers for this device are not installed. (Code 28)
    Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

    Name: Bluetooth Peripheral Device
    Description: Bluetooth Peripheral Device
    Class Guid:
    Manufacturer:
    Service:
    Problem: : The drivers for this device are not installed. (Code 28)
    Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

    Name: Bluetooth Peripheral Device
    Description: Bluetooth Peripheral Device
    Class Guid:
    Manufacturer:
    Service:
    Problem: : The drivers for this device are not installed. (Code 28)
    Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

    Name: Teredo Tunneling Pseudo-Interface
    Description: Microsoft Teredo Tunneling Adapter
    Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
    Manufacturer: Microsoft
    Service: tunnel
    Problem: : This device cannot start. (Code10)
    Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
    On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.


    ==================== Event log errors: =========================

    Application errors:
    ==================

    System errors:
    =============

    Microsoft Office Sessions:
    =========================

    CodeIntegrity Errors:
    ===================================
    Date: 2014-08-16 18:39:20.907
    Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume5\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

    Date: 2014-08-16 18:39:20.849
    Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume5\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

    Date: 2014-06-17 06:54:25.289
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\dsound.dll because the set of per-page image hashes could not be found on the system.

    Date: 2014-06-10 17:10:29.407
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\dsound.dll because the set of per-page image hashes could not be found on the system.

    Date: 2014-06-10 16:39:58.423
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\dsound.dll because the set of per-page image hashes could not be found on the system.

    Date: 2014-05-30 21:49:17.258
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\dsound.dll because the set of per-page image hashes could not be found on the system.

    Date: 2014-03-09 08:41:42.171
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\dsound.dll because the set of per-page image hashes could not be found on the system.

    Date: 2014-03-09 06:50:44.567
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\dsound.dll because the set of per-page image hashes could not be found on the system.

    Date: 2014-03-06 05:52:08.031
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\dsound.dll because the set of per-page image hashes could not be found on the system.

    Date: 2014-02-22 09:57:03.446
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\dsound.dll because the set of per-page image hashes could not be found on the system.


    ==================== Memory info ===========================

    Processor: Intel(R) Core(TM) i5-3210M CPU @ 2.50GHz
    Percentage of memory in use: 26%
    Total physical RAM: 7887.79 MB
    Available physical RAM: 5793.08 MB
    Total Pagefile: 15773.77 MB
    Available Pagefile: 13484.15 MB
    Total Virtual: 8192 MB
    Available Virtual: 8191.83 MB

    ==================== Drives ================================

    Drive c: (Windows7_OS) (Fixed) (Total:223.34 GB) (Free:147.85 GB) NTFS ==>[System with boot components (obtained from reading drive)]
    Drive d: (SYSTEM_DRV) (Fixed) (Total:1.46 GB) (Free:0.75 GB) NTFS ==>[System with boot components (obtained from reading drive)]
    Drive e: (Windows7_OS) (Fixed) (Total:282.95 GB) (Free:201.98 GB) NTFS ==>[System with boot components (obtained from reading drive)]
    Drive f: (songs) (Fixed) (Total:13.67 GB) (Free:2.35 GB) NTFS
    Drive q: (Lenovo_Recovery) (Fixed) (Total:13.67 GB) (Free:3.38 GB) NTFS

    ==================== MBR & Partition Table ==================

    ========================================================
    Disk: 0 (Size: 298.1 GB) (Disk ID: 4A1F934E)
    Partition 1: (Active) - (Size=1.5 GB) - (Type=07 NTFS)
    Partition 2: (Not Active) - (Size=283 GB) - (Type=07 NTFS)
    Partition 3: (Not Active) - (Size=13.7 GB) - (Type=07 NTFS)

    ========================================================
    Disk: 1 (Size: 238.5 GB) (Disk ID: E86D497C)
    Partition 1: (Active) - (Size=1.5 GB) - (Type=07 NTFS)
    Partition 2: (Not Active) - (Size=223.3 GB) - (Type=07 NTFS)
    Partition 3: (Not Active) - (Size=13.7 GB) - (Type=07 NTFS)

    ==================== End Of Log ============================
     
  18. theRadiantChild

    theRadiantChild TS Enthusiast Topic Starter Posts: 319

    Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 16-08-2014 04
    Ran by Radiant (administrator) on RADIANT-THINK on 17-08-2014 09:43:10
    Running from C:\Users\Radiant\Desktop
    Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: English (United States)
    Internet Explorer Version 11
    Boot Mode: Normal

    The only official download link for FRST:
    Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
    Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
    Download link from any site other than Bleeping Computer is unpermitted or outdated.
    See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

    ==================== Processes (Whitelisted) =================

    (If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

    (Lenovo.) C:\Windows\System32\ibmpmsvc.exe
    (Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
    (Microsoft Corporation) C:\Windows\System32\wlanext.exe
    (Authentec Inc.) C:\Program Files\ThinkVantage Fingerprint Software\upeksvr.exe
    (Broadcom Corporation.) C:\Program Files\ThinkPad\Bluetooth Software\btwdins.exe
    (Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
    (Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
    (Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
    (Lenovo) C:\Program Files (x86)\Lenovo\RapidBoot HDD Accelerator\FBService.exe
    (Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
    (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
    (Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\CamMute.exe
    (Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe
    (Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\vcamsvc.exe
    (Lenovo Group Limited) C:\Program Files\Lenovo\VIRTSCRL\lvvsst.exe
    (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae-svc.exe
    (Nitro PDF Software) C:\Program Files\Common Files\Nitro PDF\Professional\7.0\NitroPDFDriverService2x64.exe
    (Nalpeiron Ltd.) C:\Windows\SysWOW64\NLSSRV32.EXE
    (Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
    (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
    (Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\TPHKSVC.exe
    (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
    (Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
    (Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\micmute.exe
    (Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tphkload.exe
    (Intel Corporation) C:\Windows\System32\igfxsrvc.exe
    (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
    (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
    (Lenovo.) C:\Windows\System32\TpShocks.exe
    (Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
    (Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe
    (Intel Corporation) C:\Windows\System32\hkcmd.exe
    (Intel Corporation) C:\Windows\System32\igfxpers.exe
    (Charles Schwab & Co., Inc.) C:\Program Files (x86)\Schwab\StreetSmart Edge\QuickLaunch.exe
    (Spotify Ltd) C:\Users\Radiant\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
    (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe
    (BitTorrent Inc.) C:\Users\Radiant\AppData\Roaming\uTorrent\uTorrent.exe
    (Broadcom Corporation.) C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe
    (Ricoh co.,Ltd.) C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe
    (Dropbox, Inc.) E:\Users\Radiant\AppData\Roaming\Dropbox\bin\Dropbox.exe
    (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
    (Dolby Laboratories Inc.) C:\Program Files (x86)\Dolby Advanced Audio v2\pcee4.exe
    (Samsung Electronics Co., Ltd.) D:\Kies\KiesTrayAgent.exe
    () C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
    (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe
    (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
    (Lenovo Group Limited) C:\Program Files\Lenovo\VIRTSCRL\virtscrl.exe
    (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
    (Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe
    (Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\shtctky.exe
    (Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tpnumlkd.exe
    (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    (Google Inc.) C:\Program Files (x86)\Google\Update\1.3.24.15\GoogleCrashHandler.exe
    (Google Inc.) C:\Program Files (x86)\Google\Update\1.3.24.15\GoogleCrashHandler64.exe
    (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
    (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
    (Lenovo Group Limited) C:\Program Files (x86)\ThinkPad\Utilities\SCHTASK.EXE
    (Broadcom Corporation.) C:\Program Files\ThinkPad\Bluetooth Software\BTStackServer.exe
    (Microsoft Corporation) C:\Windows\System32\dllhost.exe
    (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
    (Symantec Corporation) C:\Program Files (x86)\Symantec\VIP Access Client\VIPAppService.exe
    (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
    (Lenovo) C:\Program Files (x86)\Lenovo\Message Center Plus\MCPLaunch.exe
    (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PrivacyIconClient.exe
    (Lenovo) C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.exe
    (Microsoft Corporation) C:\Windows\System32\rundll32.exe


    ==================== Registry (Whitelisted) ==================

    (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

    HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13538376 2013-05-21] (Realtek Semiconductor)
    HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1308232 2013-05-20] (Realtek Semiconductor)
    HKLM\...\Run: [TpShocks] => C:\Windows\system32\TpShocks.exe [228744 2012-09-20] (Lenovo.)
    HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [1271072 2014-03-11] (Microsoft Corporation)
    HKLM\...\Run: [LENOVO.TPKNRRES] => C:\Program Files\Lenovo\Communications Utility\TPKNRRES.exe [290160 2012-06-01] (Lenovo Group Limited)
    HKLM-x32\...\Run: [RotateImage] => C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe [55808 2008-10-30] (Ricoh co.,Ltd.)
    HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [292088 2013-07-18] (Intel Corporation)
    HKLM-x32\...\Run: [IMSS] => C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [133400 2012-02-28] (Intel Corporation)
    HKLM-x32\...\Run: [PWMTRV] => rundll32 "C:\Program Files (x86)\ThinkPad\Utilities\PWMTR64V.DLL",PwrMgrBkGndMonitor
    HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [937920 2011-06-06] (Adobe Systems Incorporated)
    HKLM-x32\...\Run: [Fastboot] => C:\Program Files (x86)\Lenovo\RapidBoot HDD Accelerator\FBConsole.exe [1091376 2012-01-17] (Lenovo)
    HKLM-x32\...\Run: [Lenovo Registration] => C:\Program Files (x86)\Lenovo Registration\LenovoReg.exe [4351712 2011-07-13] (Lenovo, Inc.)
    HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59240 2011-09-27] (Apple Inc.)
    HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2011-10-24] (Apple Inc.)
    HKLM-x32\...\Run: [Dolby Advanced Audio v2] => C:\Program Files (x86)\Dolby Advanced Audio v2\pcee4.exe [508656 2012-08-31] (Dolby Laboratories Inc.)
    HKLM-x32\...\Run: [DivXMediaServer] => C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe [450560 2014-04-03] (DivX, LLC)
    HKLM-x32\...\Run: [KiesTrayAgent] => D:\Kies\KiesTrayAgent.exe [311616 2014-02-14] (Samsung Electronics Co., Ltd.)
    HKLM-x32\...\Run: [DivXUpdate] => C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1861968 2014-01-10] ()
    HKLM-x32\...\Run: [Malwarebytes Anti-Exploit] => C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe [382608 2014-06-04] (Malwarebytes Corporation)
    HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-11] (Oracle Corporation)
    HKLM-x32\...\RunOnce: [B Register C:\Program Files (x86)\DivX\DivX Transcode Engine\plugins\mc_demux_mp2_ds.ax] => "C:\Windows\system32\rundll32.exe" "C:\Program Files (x86)\DivX\DivX Transcode Engine\plugins\mc_demux_mp2_ds.ax",DllRegisterServer
    Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
    Winlogon\Notify\psfus: C:\Program Files\ThinkVantage Fingerprint Software\psqlpwd.dll (Authentec Inc.)
    HKU\S-1-5-21-3277094342-1709878510-195001535-1001\...\Run: [QuickLaunch] => C:\Program Files (x86)\Schwab\StreetSmart Edge\QuickLaunch.exe [12288 2013-03-27] (Charles Schwab & Co., Inc.)
    HKU\S-1-5-21-3277094342-1709878510-195001535-1001\...\Run: [C314E45AE8FE8AEA0C1C3F2DD924C1E2FD66C5B6._service_run] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [860488 2014-08-06] (Google Inc.)
    HKU\S-1-5-21-3277094342-1709878510-195001535-1001\...\Run: [Spotify Web Helper] => C:\Users\Radiant\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1171000 2014-04-10] (Spotify Ltd)
    Lsa: [Notification Packages] scecli C:\Program Files\ThinkVantage Fingerprint Software\psqlpwd.dll C:\Program Files\ThinkPad\Bluetooth Software\BtwProximityCP.dll
    Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk
    ShortcutTarget: Bluetooth.lnk -> C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
    Startup: C:\Users\Radiant\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
    ShortcutTarget: Dropbox.lnk -> E:\Users\Radiant\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
    ShellIconOverlayIdentifiers: SugarSyncBackedUp -> {0C4A258A-3F3B-4FFF-80A7-9B3BEC139472} => C:\Program Files (x86)\SugarSync\SugarSyncShellExt_x64.dll (SugarSync, Inc.)
    ShellIconOverlayIdentifiers: SugarSyncPending -> {62CCD8E3-9C21-41E1-B55E-1E26DFC68511} => C:\Program Files (x86)\SugarSync\SugarSyncShellExt_x64.dll (SugarSync, Inc.)
    ShellIconOverlayIdentifiers: SugarSyncRoot -> {A759AFF6-5851-457D-A540-F4ECED148351} => C:\Program Files (x86)\SugarSync\SugarSyncShellExt_x64.dll (SugarSync, Inc.)
    ShellIconOverlayIdentifiers: SugarSyncShared -> {1574C9EF-7D58-488F-B358-8B78C1538F51} => C:\Program Files (x86)\SugarSync\SugarSyncShellExt_x64.dll (SugarSync, Inc.)

    ==================== Internet (Whitelisted) ====================

    (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

    HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/ig/redirectdomain?brand=LENP&bmod=LENP
    HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
    HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = http://www.lenovo.com/welcome/thinkpad
    StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = http://www.google.com/search?source...ding}&oe={outputEncoding}&rlz=1I7LENP_enUS527
    BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
    BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
    BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
    BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)
    BHO: Symantec VIP Access Add-On -> {C63CD127-A1CB-4D49-A4F7-D6F88A917BE6} -> C:\Program Files (x86)\Symantec\VIP Access Client\64bit\VIPAddOnForIE64.dll (Symantec Corporation)
    BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
    BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
    BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
    BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
    BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)
    BHO-x32: Symantec VIP Access Add-On -> {C63CD127-A1CB-4D49-A4F7-D6F88A917BE6} -> C:\Program Files (x86)\Symantec\VIP Access Client\VIPAddOnForIE.dll (Symantec Corporation)
    BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
    BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
    Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
    Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL (Microsoft Corporation)
    Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
    Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
    Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
    Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

    FireFox:
    ========
    FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_145.dll ()
    FF Plugin: @lastpass.com/NPLastPass -> C:\Program Files (x86)\LastPass\nplastpass64.dll (LastPass)
    FF Plugin: @microsoft.com/GENUINE -> disabled No File
    FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
    FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~4\Office15\NPSPWRAP.DLL (Microsoft Corporation)
    FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll ()
    FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
    FF Plugin-x32: @divx.com/DivX Web Player Plug-In,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX Web Player\npdivx32.dll (DivX, LLC)
    FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
    FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
    FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
    FF Plugin-x32: @java.com/DTPlugin,version=10.65.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
    FF Plugin-x32: @java.com/JavaPlugin,version=10.65.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
    FF Plugin-x32: @lastpass.com/NPLastPass -> C:\Program Files (x86)\LastPass\nplastpass.dll (LastPass)
    FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
    FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll (Microsoft Corporation)
    FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
    FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~3\Office15\NPSPWRAP.DLL (Microsoft Corporation)
    FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
    FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
    FF Plugin-x32: @nitropdf.com/NitroPDF -> C:\Program Files (x86)\Nitro PDF\Professional 7\npnitromozilla.dll ( )
    FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
    FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
    FF Plugin-x32: @videolan.org/vlc,version=2.0.6 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
    FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
    FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
    FF Plugin HKCU: @talk.google.com/GoogleTalkPlugin -> C:\Users\Radiant\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)
    FF Plugin HKCU: @talk.google.com/O1DPlugin -> C:\Users\Radiant\AppData\Roaming\Mozilla\plugins\npo1d.dll (Google)
    FF Plugin HKCU: @tools.google.com/Google Update;version=3 -> C:\Users\Radiant\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
    FF Plugin HKCU: @tools.google.com/Google Update;version=9 -> C:\Users\Radiant\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
    FF Plugin HKCU: intel.com/AppUp -> C:\Program Files (x86)\Intel\IntelAppStore\bin\npAppUp.dll No File
    FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll (Microsoft Corporation)
    FF Plugin ProgramFiles/Appdata: C:\Users\Radiant\AppData\Roaming\mozilla\plugins\npgoogletalk.dll (Google)
    FF Plugin ProgramFiles/Appdata: C:\Users\Radiant\AppData\Roaming\mozilla\plugins\npo1d.dll (Google)
    FF HKLM-x32\...\Firefox\Extensions: [VIP5X@verisign.com] - C:\Program Files (x86)\Symantec\VIP Access Client
    FF Extension: Symantec VIP Access Add-On - C:\Program Files (x86)\Symantec\VIP Access Client [2012-11-28]

    Chrome:
    =======
    CHR HomePage:
    CHR StartupUrls: "hxxp://google.com/", "hxxp://www.google.com/ig/redirectdomain?brand=LENP&bmod=LENP"
    CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\36.0.1985.143\PepperFlash\pepflashplayer.dll ()
    CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
    CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\36.0.1985.143\ppGoogleNaClPluginChrome.dll ()
    CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\36.0.1985.143\pdf.dll ()
    CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
    CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll No File
    CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
    CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
    CHR Plugin: (Nitro PDF Plug-In) - C:\Program Files (x86)\Nitro PDF\Professional 7\npnitromozilla.dll ( )
    CHR Plugin: (Windows Live™ Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
    CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\4.0.50401.0\npctrl.dll No File
    CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Radiant\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-05-26]
    CHR Extension: (WOT) - C:\Users\Radiant\AppData\Local\Google\Chrome\User Data\Default\Extensions\bhmmomiinigofkjcapegjjndpbikblnp [2013-03-12]
    CHR Extension: (Shoptimate : automatic price comparison) - C:\Users\Radiant\AppData\Local\Google\Chrome\User Data\Default\Extensions\bibdombdcdbbnfdjkaajfgnfhlapibde [2014-03-25]
    CHR Extension: (AdBlock) - C:\Users\Radiant\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2013-03-12]
    CHR Extension: (LastPass: Free Password Manager) - C:\Users\Radiant\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdokiejnpimakedhajhdlcegeplioahd [2013-03-12]
    CHR Extension: (Skype Click to Call) - C:\Users\Radiant\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2014-02-20]
    CHR Extension: (Google Wallet) - C:\Users\Radiant\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-25]
    CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2014-07-14]

    ==================== Services (Whitelisted) =================

    (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

    R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)
    R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)
    S3 DozeSvc; C:\Program Files (x86)\ThinkPad\Utilities\DZSVC64.EXE [320560 2013-12-09] (Lenovo.)
    R2 FastbootService; C:\Program Files (x86)\Lenovo\RapidBoot HDD Accelerator\FBService.exe [169776 2012-01-17] (Lenovo)
    R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [161560 2012-02-28] (Intel Corporation)
    R2 LENOVO.TVTVCAM; C:\Program Files\Lenovo\Communications Utility\vcamsvc.exe [179568 2012-06-01] (Lenovo Group Limited)
    R2 Lenovo.VIRTSCRLSVC; C:\Program Files\LENOVO\VIRTSCRL\lvvsst.exe [136288 2012-08-10] (Lenovo Group Limited)
    S3 LSCWinService; C:\Program Files\Lenovo\Lenovo Solution Center\App\LSCWinService.exe [1663880 2014-05-06] ()
    R2 MbaeSvc; C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae-svc.exe [360592 2014-06-04] (Malwarebytes Corporation)
    S2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)
    S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)
    R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2014-03-11] (Microsoft Corporation)
    S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [273136 2013-02-08] ()
    S3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [347872 2014-03-11] (Microsoft Corporation)
    R2 NitroDriverReadSpool2; C:\Program Files\Common Files\Nitro PDF\Professional\7.0\NitroPDFDriverService2x64.exe [216072 2012-05-24] (Nitro PDF Software)
    S3 SUService; C:\Program Files (x86)\Lenovo\System Update\SUService.exe [24120 2014-02-21] ()
    R2 VIPAppService; C:\Program Files (x86)\Symantec\VIP Access Client\VIPAppService.exe [84080 2012-04-19] (Symantec Corporation)
    R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3386608 2013-02-08] (Intel® Corporation)
     
  19. theRadiantChild

    theRadiantChild TS Enthusiast Topic Starter Posts: 319

    ==================== Drivers (Whitelisted) ====================

    (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

    U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-13] (Microsoft Corporation)
    R3 bcbtums; C:\Windows\System32\drivers\bcbtums.sys [170200 2013-03-27] (Broadcom Corporation.)
    R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2014-05-25] (Disc Soft Ltd)
    R1 ESProtectionDriver; C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae64.sys [62392 2014-06-04] ()
    R0 Fastboot; C:\Windows\System32\DRIVERS\Fastboot.sys [70416 2012-01-17] (Windows (R) Win 7 DDK provider)
    R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28008 2013-08-02] (Intel Corporation)
    S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation)
    S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-05-12] (Malwarebytes Corporation)
    R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [268512 2014-01-25] (Microsoft Corporation)
    S3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [133928 2014-03-11] (Microsoft Corporation)
    R3 SmbDrvI; C:\Windows\System32\DRIVERS\Smb_driver_Intel.sys [44784 2013-04-17] (Synaptics Incorporated)
    R2 smihlp; C:\Program Files\ThinkVantage Fingerprint Software\smihlp.sys [13128 2011-05-30] (Authentec Inc.)
    U3 TrueSight; C:\Windows\SysWOW64\drivers\TrueSight.sys [33512 2014-08-16] ()
    R3 TVTI2C; C:\Windows\System32\DRIVERS\Tvti2c.sys [40248 2011-05-29] (Lenovo Information Product(ShenZhen China) Inc.)
    R3 tvtvcamd; C:\Windows\System32\DRIVERS\tvtvcamd.sys [27432 2011-12-07] (ThinkVantage Communications Utility)
    S3 catchme; \??\C:\ComboFix\catchme.sys [X]

    ==================== NetSvcs (Whitelisted) ===================

    (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


    ==================== One Month Created Files and Folders ========

    (If an entry is included in the fixlist, the file\folder will be moved.)

    2014-08-17 09:43 - 2014-08-17 09:43 - 00026884 _____ () C:\Users\Radiant\Desktop\FRST.txt
    2014-08-17 09:43 - 2014-08-17 09:43 - 00000000 ____D () C:\FRST
    2014-08-17 09:41 - 2014-08-17 09:41 - 00014008 _____ () C:\Users\Radiant\Desktop\JRT.txt
    2014-08-17 09:32 - 2014-08-17 09:32 - 00000000 ____D () C:\Windows\ERUNT
    2014-08-17 09:28 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll
    2014-08-17 09:27 - 2014-08-17 09:28 - 00000000 ____D () C:\AdwCleaner
    2014-08-17 09:25 - 2014-08-17 09:25 - 02101760 _____ (Farbar) C:\Users\Radiant\Desktop\FRST64.exe
    2014-08-17 09:25 - 2014-08-17 09:25 - 01361671 _____ () C:\Users\Radiant\Desktop\adwcleaner_3.307.exe
    2014-08-17 09:25 - 2014-08-17 09:25 - 01016261 _____ (Thisisu) C:\Users\Radiant\Desktop\JRT.exe
    2014-08-17 09:24 - 2014-08-17 09:24 - 00000913 _____ () C:\Users\Radiant\Desktop\Downloads - Shortcut.lnk
    2014-08-16 19:57 - 2014-08-16 19:57 - 00025621 _____ () C:\ComboFix.txt
    2014-08-16 18:28 - 2014-08-16 20:01 - 00000000 ____D () C:\Qoobox
    2014-08-16 18:28 - 2014-08-16 19:39 - 00000000 ____D () C:\Windows\erdnt
    2014-08-16 18:28 - 2011-06-26 02:45 - 00256000 _____ () C:\Windows\PEV.exe
    2014-08-16 18:28 - 2010-11-07 13:20 - 00208896 _____ () C:\Windows\MBR.exe
    2014-08-16 18:28 - 2009-04-20 00:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
    2014-08-16 18:28 - 2000-08-30 20:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
    2014-08-16 18:28 - 2000-08-30 20:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
    2014-08-16 18:28 - 2000-08-30 20:00 - 00098816 _____ () C:\Windows\sed.exe
    2014-08-16 18:28 - 2000-08-30 20:00 - 00080412 _____ () C:\Windows\grep.exe
    2014-08-16 18:28 - 2000-08-30 20:00 - 00068096 _____ () C:\Windows\zip.exe
    2014-08-16 18:23 - 2014-08-16 18:24 - 05571320 ____R (Swearware) C:\Users\Radiant\Desktop\ComboFix.exe
    2014-08-16 08:08 - 2014-08-17 09:29 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
    2014-08-16 08:08 - 2014-08-16 08:14 - 00000000 ____D () C:\Users\Radiant\Desktop\mbar
    2014-08-16 08:07 - 2014-08-16 08:07 - 14349744 _____ (Malwarebytes Corp.) C:\Users\Radiant\Desktop\mbar-1.07.0.1012.exe
    2014-08-16 07:55 - 2014-08-16 07:55 - 04851288 _____ () C:\Users\Radiant\Desktop\RogueKiller.exe
    2014-08-16 07:55 - 2014-08-16 07:55 - 00033512 _____ () C:\Windows\SysWOW64\Drivers\TrueSight.sys
    2014-08-16 07:55 - 2014-08-16 07:55 - 00000000 ____D () C:\ProgramData\RogueKiller
    2014-08-15 09:47 - 2014-08-15 09:47 - 00031572 _____ () C:\Users\Radiant\Desktop\dds.txt
    2014-08-15 09:47 - 2014-08-15 09:47 - 00011068 _____ () C:\Users\Radiant\Desktop\attach.txt
    2014-08-15 09:32 - 2014-08-15 09:32 - 00688992 ____R (Swearware) C:\Users\Radiant\Desktop\dds.scr
    2014-08-14 07:57 - 2014-08-17 09:29 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
    2014-08-14 07:56 - 2014-08-16 08:08 - 00092888 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
    2014-08-14 07:56 - 2014-08-14 07:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
    2014-08-14 07:56 - 2014-08-14 07:56 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
    2014-08-14 07:56 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
    2014-08-14 03:00 - 2014-06-30 18:24 - 00008856 _____ (Microsoft Corporation) C:\Windows\system32\icardres.dll
    2014-08-14 03:00 - 2014-06-30 18:14 - 00008856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardres.dll
    2014-08-14 03:00 - 2014-06-06 02:16 - 00035480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TsWpfWrp.exe
    2014-08-14 03:00 - 2014-06-06 02:12 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe
    2014-08-14 03:00 - 2014-03-09 17:48 - 01389208 _____ (Microsoft Corporation) C:\Windows\system32\icardagt.exe
    2014-08-14 03:00 - 2014-03-09 17:48 - 00171160 _____ (Microsoft Corporation) C:\Windows\system32\infocardapi.dll
    2014-08-14 03:00 - 2014-03-09 17:47 - 00619672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardagt.exe
    2014-08-14 03:00 - 2014-03-09 17:47 - 00099480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\infocardapi.dll
    2014-08-13 05:12 - 2014-07-31 19:41 - 00348856 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
    2014-08-13 05:12 - 2014-07-31 19:16 - 00307384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
    2014-08-13 05:12 - 2014-07-25 10:52 - 23645696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
    2014-08-13 05:12 - 2014-07-25 10:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
    2014-08-13 05:12 - 2014-07-25 10:01 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
    2014-08-13 05:12 - 2014-07-25 09:51 - 17524224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
    2014-08-13 05:12 - 2014-07-25 09:30 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
    2014-08-13 05:12 - 2014-07-25 09:28 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
    2014-08-13 05:12 - 2014-07-25 09:28 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
    2014-08-13 05:12 - 2014-07-25 09:25 - 02774528 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
    2014-08-13 05:12 - 2014-07-25 09:25 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
    2014-08-13 05:12 - 2014-07-25 09:11 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
    2014-08-13 05:12 - 2014-07-25 09:10 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
    2014-08-13 05:12 - 2014-07-25 09:04 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
    2014-08-13 05:12 - 2014-07-25 09:03 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
    2014-08-13 05:12 - 2014-07-25 09:00 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
    2014-08-13 05:12 - 2014-07-25 09:00 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
    2014-08-13 05:12 - 2014-07-25 08:59 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
    2014-08-13 05:12 - 2014-07-25 08:47 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
    2014-08-13 05:12 - 2014-07-25 08:40 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
    2014-08-13 05:12 - 2014-07-25 08:34 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
    2014-08-13 05:12 - 2014-07-25 08:34 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
    2014-08-13 05:12 - 2014-07-25 08:33 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
    2014-08-13 05:12 - 2014-07-25 08:30 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
    2014-08-13 05:12 - 2014-07-25 08:28 - 05824512 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
    2014-08-13 05:12 - 2014-07-25 08:28 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
    2014-08-13 05:12 - 2014-07-25 08:21 - 02184704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
    2014-08-13 05:12 - 2014-07-25 08:19 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
    2014-08-13 05:12 - 2014-07-25 08:18 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
    2014-08-13 05:12 - 2014-07-25 08:17 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
    2014-08-13 05:12 - 2014-07-25 08:17 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
    2014-08-13 05:12 - 2014-07-25 08:12 - 00438784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
    2014-08-13 05:12 - 2014-07-25 08:10 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
    2014-08-13 05:12 - 2014-07-25 08:10 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
    2014-08-13 05:12 - 2014-07-25 08:08 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
    2014-08-13 05:12 - 2014-07-25 08:06 - 04204032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
    2014-08-13 05:12 - 2014-07-25 07:52 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
    2014-08-13 05:12 - 2014-07-25 07:47 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
    2014-08-13 05:12 - 2014-07-25 07:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
    2014-08-13 05:12 - 2014-07-25 07:42 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
    2014-08-13 05:12 - 2014-07-25 07:39 - 02087936 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
    2014-08-13 05:12 - 2014-07-25 07:39 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
    2014-08-13 05:12 - 2014-07-25 07:36 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
    2014-08-13 05:12 - 2014-07-25 07:34 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
    2014-08-13 05:12 - 2014-07-25 07:29 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
    2014-08-13 05:12 - 2014-07-25 07:23 - 13547008 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
    2014-08-13 05:12 - 2014-07-25 07:13 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
    2014-08-13 05:12 - 2014-07-25 07:07 - 02001920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
    2014-08-13 05:12 - 2014-07-25 07:07 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
    2014-08-13 05:12 - 2014-07-25 07:03 - 11772928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
    2014-08-13 05:12 - 2014-07-25 06:52 - 02266624 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
    2014-08-13 05:12 - 2014-07-25 06:26 - 01431040 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
    2014-08-13 05:12 - 2014-07-25 06:17 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
    2014-08-13 05:12 - 2014-07-25 06:09 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
    2014-08-13 05:12 - 2014-07-25 06:05 - 01792512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
    2014-08-13 05:12 - 2014-07-25 06:00 - 01169920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
    2014-08-13 05:12 - 2014-07-15 23:25 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
    2014-08-13 05:12 - 2014-07-15 23:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
    2014-08-13 05:12 - 2014-07-15 22:46 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
    2014-08-13 05:12 - 2014-07-15 22:46 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
    2014-08-13 05:12 - 2014-07-15 22:12 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
    2014-08-13 05:12 - 2014-07-08 22:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDYAK.DLL
    2014-08-13 05:12 - 2014-07-08 22:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDTAT.DLL
    2014-08-13 05:12 - 2014-07-08 22:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU1.DLL
    2014-08-13 05:12 - 2014-07-08 22:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDBASH.DLL
    2014-08-13 05:12 - 2014-07-08 22:03 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU.DLL
    2014-08-13 05:12 - 2014-07-08 21:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDYAK.DLL
    2014-08-13 05:12 - 2014-07-08 21:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDTAT.DLL
    2014-08-13 05:12 - 2014-07-08 21:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU1.DLL
    2014-08-13 05:12 - 2014-07-08 21:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU.DLL
    2014-08-13 05:12 - 2014-07-08 21:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDBASH.DLL
    2014-08-13 05:12 - 2014-07-08 18:38 - 00419992 _____ () C:\Windows\system32\locale.nls
    2014-08-13 05:12 - 2014-07-08 18:30 - 00419992 _____ () C:\Windows\SysWOW64\locale.nls
    2014-08-13 05:12 - 2014-06-24 22:05 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
    2014-08-13 05:12 - 2014-06-24 21:41 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
    2014-08-13 05:12 - 2014-06-15 22:10 - 00985536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
    2014-08-13 05:12 - 2014-06-03 06:02 - 03241984 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
    2014-08-13 05:12 - 2014-06-03 06:02 - 01941504 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
    2014-08-13 05:12 - 2014-06-03 06:02 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
    2014-08-13 05:12 - 2014-06-03 06:02 - 00112064 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
    2014-08-13 05:12 - 2014-06-03 05:29 - 02363392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
    2014-08-13 05:12 - 2014-06-03 05:29 - 01805824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
    2014-08-13 05:12 - 2014-06-03 05:29 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll
    2014-08-13 05:11 - 2014-07-13 22:02 - 01216000 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
    2014-08-13 05:11 - 2014-07-13 21:40 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
    2014-08-13 00:23 - 2014-08-17 09:30 - 00004986 _____ () C:\Windows\System32\Tasks\Microsoft Office 15 Sync Maintenance for Radiant-THINK-Radiant Radiant-THINK
    2014-08-12 23:52 - 2014-08-12 23:52 - 00016971 _____ () C:\Users\Radiant\Downloads\Drumming_Torrents_(updated_6_march_2011)-_=demonoid.ph=__11083846.4694.torrent
    2014-08-12 23:44 - 2014-08-15 09:34 - 00000000 ____D () C:\The KMPlayer
    2014-08-12 23:44 - 2014-08-12 23:44 - 00001933 _____ () C:\Users\Radiant\Desktop\KMP Games.lnk
    2014-08-12 23:44 - 2014-08-12 23:44 - 00000645 _____ () C:\Users\Radiant\Desktop\KMPlayer.lnk
    2014-08-12 23:44 - 2014-08-12 23:44 - 00000000 ____D () C:\Users\Radiant\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\The KMPlayer
    2014-08-12 23:43 - 2014-08-12 23:43 - 32829856 _____ (PandoraTV) C:\Users\Radiant\Downloads\KMPlayer_3.9.0.126.exe
    2014-08-12 23:40 - 2014-08-12 23:40 - 00000000 ____D () C:\Users\Radiant\AppData\Roaming\dvdcss
    2014-08-12 23:38 - 2014-08-12 23:38 - 00000000 ____D () C:\Users\Radiant\AppData\Local\Apple Computer
    2014-08-03 21:02 - 2014-08-03 21:02 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_ldiagio_uefi_01009.Wdf
    2014-08-03 21:02 - 2014-08-03 21:02 - 00000000 ____D () C:\Users\Radiant\AppData\Roaming\LSC
    2014-07-21 14:19 - 2014-07-11 02:56 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
    2014-07-21 14:18 - 2014-07-21 14:18 - 00004489 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_65-b20.log
    2014-07-21 14:18 - 2014-07-21 14:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
    2014-07-21 14:18 - 2014-07-11 03:02 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
    2014-07-21 14:18 - 2014-07-11 02:56 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
    2014-07-21 14:18 - 2014-07-11 02:55 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
    2014-07-18 09:28 - 2014-07-18 09:28 - 00002002 _____ () C:\Users\Public\Desktop\Lenovo Solution Center.lnk

    ==================== One Month Modified Files and Folders =======

    (If an entry is included in the fixlist, the file\folder will be moved.)

    2014-08-17 09:43 - 2014-08-17 09:43 - 00026884 _____ () C:\Users\Radiant\Desktop\FRST.txt
    2014-08-17 09:43 - 2014-08-17 09:43 - 00000000 ____D () C:\FRST
    2014-08-17 09:41 - 2014-08-17 09:41 - 00014008 _____ () C:\Users\Radiant\Desktop\JRT.txt
    2014-08-17 09:40 - 2014-05-25 14:01 - 00000000 ____D () C:\Users\Radiant\AppData\Roaming\uTorrent
    2014-08-17 09:39 - 2014-06-02 02:46 - 00028022 _____ () C:\Windows\setupact.log
    2014-08-17 09:36 - 2009-07-14 00:45 - 00031472 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
    2014-08-17 09:36 - 2009-07-14 00:45 - 00031472 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
    2014-08-17 09:34 - 2012-11-28 03:46 - 01765678 _____ () C:\Windows\WindowsUpdate.log
    2014-08-17 09:34 - 2009-07-14 01:13 - 00782510 _____ () C:\Windows\system32\PerfStringBackup.INI
    2014-08-17 09:32 - 2014-08-17 09:32 - 00000000 ____D () C:\Windows\ERUNT
    2014-08-17 09:32 - 2013-03-12 01:38 - 00000000 ____D () C:\Users\Radiant\AppData\Roaming\Nitro PDF
    2014-08-17 09:30 - 2014-08-13 00:23 - 00004986 _____ () C:\Windows\System32\Tasks\Microsoft Office 15 Sync Maintenance for Radiant-THINK-Radiant Radiant-THINK
    2014-08-17 09:30 - 2013-03-12 19:30 - 00000000 ___RD () C:\Users\Radiant\Dropbox
    2014-08-17 09:30 - 2013-03-12 04:26 - 00000000 ____D () C:\Users\Radiant\AppData\Roaming\Dropbox
    2014-08-17 09:29 - 2014-08-16 08:08 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
    2014-08-17 09:29 - 2014-08-14 07:57 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
    2014-08-17 09:29 - 2014-07-05 20:23 - 00011684 _____ () C:\Windows\PFRO.log
    2014-08-17 09:29 - 2012-11-28 04:02 - 00000908 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
    2014-08-17 09:29 - 2009-07-14 01:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
    2014-08-17 09:29 - 2009-07-14 00:45 - 00378072 _____ () C:\Windows\system32\FNTCACHE.DAT
    2014-08-17 09:28 - 2014-08-17 09:27 - 00000000 ____D () C:\AdwCleaner
    2014-08-17 09:25 - 2014-08-17 09:25 - 02101760 _____ (Farbar) C:\Users\Radiant\Desktop\FRST64.exe
    2014-08-17 09:25 - 2014-08-17 09:25 - 01361671 _____ () C:\Users\Radiant\Desktop\adwcleaner_3.307.exe
    2014-08-17 09:25 - 2014-08-17 09:25 - 01016261 _____ (Thisisu) C:\Users\Radiant\Desktop\JRT.exe
    2014-08-17 09:24 - 2014-08-17 09:24 - 00000913 _____ () C:\Users\Radiant\Desktop\Downloads - Shortcut.lnk
    2014-08-17 09:23 - 2014-03-29 17:12 - 00000916 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3277094342-1709878510-195001535-1001UA.job
    2014-08-17 09:23 - 2013-03-25 03:03 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
    2014-08-17 09:23 - 2012-11-28 04:02 - 00000912 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
    2014-08-17 06:26 - 2014-03-29 17:12 - 00000864 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3277094342-1709878510-195001535-1001Core.job
    2014-08-16 20:01 - 2014-08-16 18:28 - 00000000 ____D () C:\Qoobox
    2014-08-16 20:00 - 2009-07-13 23:20 - 00000000 __RHD () C:\Users\Default
    2014-08-16 19:57 - 2014-08-16 19:57 - 00025621 _____ () C:\ComboFix.txt
    2014-08-16 19:39 - 2014-08-16 18:28 - 00000000 ____D () C:\Windows\erdnt
    2014-08-16 18:57 - 2009-07-13 22:34 - 00000215 _____ () C:\Windows\system.ini
    2014-08-16 18:24 - 2014-08-16 18:23 - 05571320 ____R (Swearware) C:\Users\Radiant\Desktop\ComboFix.exe
    2014-08-16 16:17 - 2014-06-28 06:25 - 00000000 ____D () C:\ProgramData\Malwarebytes Anti-Exploit
    2014-08-16 08:15 - 2009-07-14 01:32 - 00000000 ____D () C:\Windows\addins
    2014-08-16 08:14 - 2014-08-16 08:08 - 00000000 ____D () C:\Users\Radiant\Desktop\mbar
    2014-08-16 08:14 - 2013-03-12 04:26 - 00000000 ____D () C:\Users\Radiant\Desktop\KMS Activator for Microsoft Office 2010 Applications x86 x64 Multilingual-FIXISO~DiBYA
    2014-08-16 08:08 - 2014-08-14 07:56 - 00092888 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
    2014-08-16 08:07 - 2014-08-16 08:07 - 14349744 _____ (Malwarebytes Corp.) C:\Users\Radiant\Desktop\mbar-1.07.0.1012.exe
    2014-08-16 08:06 - 2009-07-14 01:32 - 00000000 ____D () C:\Windows\system32\restore
    2014-08-16 07:55 - 2014-08-16 07:55 - 04851288 _____ () C:\Users\Radiant\Desktop\RogueKiller.exe
    2014-08-16 07:55 - 2014-08-16 07:55 - 00033512 _____ () C:\Windows\SysWOW64\Drivers\TrueSight.sys
    2014-08-16 07:55 - 2014-08-16 07:55 - 00000000 ____D () C:\ProgramData\RogueKiller
    2014-08-15 09:47 - 2014-08-15 09:47 - 00031572 _____ () C:\Users\Radiant\Desktop\dds.txt
    2014-08-15 09:47 - 2014-08-15 09:47 - 00011068 _____ () C:\Users\Radiant\Desktop\attach.txt
    2014-08-15 09:34 - 2014-08-12 23:44 - 00000000 ____D () C:\The KMPlayer
    2014-08-15 09:32 - 2014-08-15 09:32 - 00688992 ____R (Swearware) C:\Users\Radiant\Desktop\dds.scr
    2014-08-14 07:56 - 2014-08-14 07:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
    2014-08-14 07:56 - 2014-08-14 07:56 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
    2014-08-14 07:56 - 2013-09-13 07:06 - 00001113 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
    2014-08-14 07:56 - 2013-09-13 07:06 - 00000000 ____D () C:\Users\Radiant\AppData\Roaming\Malwarebytes
    2014-08-14 07:56 - 2013-09-13 07:06 - 00000000 ____D () C:\ProgramData\Malwarebytes
    2014-08-14 07:56 - 2013-09-13 07:06 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
    2014-08-14 06:27 - 2009-07-13 23:20 - 00000000 ____D () C:\Windows\rescache
    2014-08-14 03:27 - 2009-07-13 22:34 - 00000505 _____ () C:\Windows\win.ini
    2014-08-14 03:26 - 2009-07-13 23:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
    2014-08-14 03:11 - 2013-10-01 17:07 - 00000000 ____D () C:\ProgramData\Microsoft Help
    2014-08-14 03:07 - 2013-08-15 03:00 - 00000000 ____D () C:\Windows\system32\MRT
    2014-08-14 03:05 - 2013-03-12 02:10 - 99218768 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
    2014-08-14 03:02 - 2013-10-01 17:12 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013
    2014-08-13 03:48 - 2014-05-25 14:02 - 00000870 _____ () C:\Users\Radiant\Desktop\µTorrent.lnk
    2014-08-13 03:48 - 2014-05-25 14:02 - 00000850 _____ () C:\Users\Radiant\AppData\Roaming\Microsoft\Windows\Start Menu\µTorrent.lnk
    2014-08-12 23:52 - 2014-08-12 23:52 - 00016971 _____ () C:\Users\Radiant\Downloads\Drumming_Torrents_(updated_6_march_2011)-_=demonoid.ph=__11083846.4694.torrent
    2014-08-12 23:44 - 2014-08-12 23:44 - 00001933 _____ () C:\Users\Radiant\Desktop\KMP Games.lnk
    2014-08-12 23:44 - 2014-08-12 23:44 - 00000645 _____ () C:\Users\Radiant\Desktop\KMPlayer.lnk
    2014-08-12 23:44 - 2014-08-12 23:44 - 00000000 ____D () C:\Users\Radiant\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\The KMPlayer
    2014-08-12 23:43 - 2014-08-12 23:43 - 32829856 _____ (PandoraTV) C:\Users\Radiant\Downloads\KMPlayer_3.9.0.126.exe
    2014-08-12 23:40 - 2014-08-12 23:40 - 00000000 ____D () C:\Users\Radiant\AppData\Roaming\dvdcss
    2014-08-12 23:38 - 2014-08-12 23:38 - 00000000 ____D () C:\Users\Radiant\AppData\Local\Apple Computer
    2014-08-12 23:34 - 2014-05-25 23:33 - 00000000 ____D () C:\Users\Radiant\AppData\Roaming\vlc
    2014-08-12 23:34 - 2013-06-01 04:31 - 00001077 _____ () C:\Users\Public\Desktop\VLC media player.lnk
    2014-08-12 23:34 - 2013-06-01 04:31 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
    2014-08-10 05:11 - 2014-02-17 13:08 - 00000000 ___RD () C:\Program Files (x86)\Skype
    2014-08-03 21:02 - 2014-08-03 21:02 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_ldiagio_uefi_01009.Wdf
    2014-08-03 21:02 - 2014-08-03 21:02 - 00000000 ____D () C:\Users\Radiant\AppData\Roaming\LSC
    2014-08-03 14:48 - 2013-03-13 03:00 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
    2014-08-03 14:48 - 2013-03-13 03:00 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
    2014-07-31 19:41 - 2014-08-13 05:12 - 00348856 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
    2014-07-31 19:16 - 2014-08-13 05:12 - 00307384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
    2014-07-26 03:01 - 2013-03-13 03:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
    2014-07-25 10:52 - 2014-08-13 05:12 - 23645696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
    2014-07-25 10:02 - 2014-08-13 05:12 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
    2014-07-25 10:01 - 2014-08-13 05:12 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
    2014-07-25 09:51 - 2014-08-13 05:12 - 17524224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
    2014-07-25 09:30 - 2014-08-13 05:12 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
    2014-07-25 09:28 - 2014-08-13 05:12 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
    2014-07-25 09:28 - 2014-08-13 05:12 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
    2014-07-25 09:25 - 2014-08-13 05:12 - 02774528 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
    2014-07-25 09:25 - 2014-08-13 05:12 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
    2014-07-25 09:11 - 2014-08-13 05:12 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
    2014-07-25 09:10 - 2014-08-13 05:12 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
    2014-07-25 09:04 - 2014-08-13 05:12 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
    2014-07-25 09:03 - 2014-08-13 05:12 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
    2014-07-25 09:00 - 2014-08-13 05:12 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
    2014-07-25 09:00 - 2014-08-13 05:12 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
    2014-07-25 08:59 - 2014-08-13 05:12 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
    2014-07-25 08:47 - 2014-08-13 05:12 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
    2014-07-25 08:40 - 2014-08-13 05:12 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
    2014-07-25 08:34 - 2014-08-13 05:12 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
    2014-07-25 08:34 - 2014-08-13 05:12 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
    2014-07-25 08:33 - 2014-08-13 05:12 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
    2014-07-25 08:30 - 2014-08-13 05:12 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
    2014-07-25 08:28 - 2014-08-13 05:12 - 05824512 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
    2014-07-25 08:28 - 2014-08-13 05:12 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
    2014-07-25 08:21 - 2014-08-13 05:12 - 02184704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
    2014-07-25 08:19 - 2014-08-13 05:12 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
    2014-07-25 08:18 - 2014-08-13 05:12 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
    2014-07-25 08:17 - 2014-08-13 05:12 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
    2014-07-25 08:17 - 2014-08-13 05:12 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
    2014-07-25 08:12 - 2014-08-13 05:12 - 00438784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
    2014-07-25 08:10 - 2014-08-13 05:12 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
    2014-07-25 08:10 - 2014-08-13 05:12 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
    2014-07-25 08:08 - 2014-08-13 05:12 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
    2014-07-25 08:06 - 2014-08-13 05:12 - 04204032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
    2014-07-25 07:52 - 2014-08-13 05:12 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
    2014-07-25 07:47 - 2014-08-13 05:12 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
    2014-07-25 07:43 - 2014-08-13 05:12 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
    2014-07-25 07:42 - 2014-08-13 05:12 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
    2014-07-25 07:39 - 2014-08-13 05:12 - 02087936 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
    2014-07-25 07:39 - 2014-08-13 05:12 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
    2014-07-25 07:36 - 2014-08-13 05:12 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
    2014-07-25 07:34 - 2014-08-13 05:12 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
    2014-07-25 07:29 - 2014-08-13 05:12 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
    2014-07-25 07:23 - 2014-08-13 05:12 - 13547008 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
    2014-07-25 07:13 - 2014-08-13 05:12 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
    2014-07-25 07:07 - 2014-08-13 05:12 - 02001920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
    2014-07-25 07:07 - 2014-08-13 05:12 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
    2014-07-25 07:03 - 2014-08-13 05:12 - 11772928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
    2014-07-25 06:52 - 2014-08-13 05:12 - 02266624 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
    2014-07-25 06:26 - 2014-08-13 05:12 - 01431040 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
    2014-07-25 06:17 - 2014-08-13 05:12 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
    2014-07-25 06:09 - 2014-08-13 05:12 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
    2014-07-25 06:05 - 2014-08-13 05:12 - 01792512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
    2014-07-25 06:00 - 2014-08-13 05:12 - 01169920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
    2014-07-21 14:25 - 2014-02-17 09:59 - 00000000 ____D () C:\ProgramData\Oracle
    2014-07-21 14:18 - 2014-07-21 14:18 - 00004489 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_65-b20.log
    2014-07-21 14:18 - 2014-07-21 14:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
    2014-07-21 14:18 - 2014-02-17 09:59 - 00000000 ____D () C:\Program Files (x86)\Java
    2014-07-18 21:51 - 2013-03-21 01:51 - 00000000 ____D () C:\ProgramData\DivX
    2014-07-18 21:51 - 2013-03-21 01:51 - 00000000 ____D () C:\Program Files (x86)\DivX
    2014-07-18 09:28 - 2014-07-18 09:28 - 00002002 _____ () C:\Users\Public\Desktop\Lenovo Solution Center.lnk
    2014-07-18 09:28 - 2013-03-12 01:51 - 00000000 ____D () C:\Users\Radiant\AppData\Local\LSC
    2014-07-18 09:28 - 2012-11-28 03:59 - 00000000 ____D () C:\Windows\System32\Tasks\Lenovo
    2014-07-18 09:28 - 2012-11-28 03:59 - 00000000 ____D () C:\Windows\Downloaded Installations
    2014-07-18 09:28 - 2012-11-28 03:50 - 00000000 ____D () C:\Program Files\Lenovo
    2014-07-18 09:28 - 2012-11-27 11:25 - 00000000 ____D () C:\ProgramData\Lenovo

    Some content of TEMP:
    ====================
    C:\Users\Radiant\AppData\Local\Temp\Quarantine.exe


    ==================== Bamital & volsnap Check =================

    (There is no automatic fix for files that do not pass verification.)

    C:\Windows\System32\winlogon.exe => File is digitally signed
    C:\Windows\System32\wininit.exe => File is digitally signed
    C:\Windows\SysWOW64\wininit.exe => File is digitally signed
    C:\Windows\explorer.exe => File is digitally signed
    C:\Windows\SysWOW64\explorer.exe => File is digitally signed
    C:\Windows\System32\svchost.exe => File is digitally signed
    C:\Windows\SysWOW64\svchost.exe => File is digitally signed
    C:\Windows\System32\services.exe => File is digitally signed
    C:\Windows\System32\User32.dll => File is digitally signed
    C:\Windows\SysWOW64\User32.dll => File is digitally signed
    C:\Windows\System32\userinit.exe => File is digitally signed
    C:\Windows\SysWOW64\userinit.exe => File is digitally signed
    C:\Windows\System32\rpcss.dll => File is digitally signed
    C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


    LastRegBack: 2014-08-17 00:28

    ==================== End Of Log ============================
     
  20. Broni

    Broni Malware Annihilator Posts: 47,078   +258

    Download attached fixlist.txt file and save it to the Desktop.
    NOTE. It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work.

    NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

    Run FRST(FRST64) and press the Fix button just once and wait.
    The tool will make a log on the Desktop (Fixlog.txt). Please post it to your reply.
     

    Attached Files:

  21. theRadiantChild

    theRadiantChild TS Enthusiast Topic Starter Posts: 319

    Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 16-08-2014 04
    Ran by Radiant at 2014-08-17 17:20:40 Run:1
    Running from C:\Users\Radiant\Desktop
    Boot Mode: Normal
    ==============================================

    Content of fixlist:
    *****************
    CustomCLSID: HKU\S-1-5-21-3277094342-1709878510-195001535-1001_Classes\CLSID\{FE498BAB-CB4C-4F88-AC3F-3641AAAF5E9E}\InprocServer32 -> C:\Users\Radiant\AppData\Local\Google\Update\1.3.24.7\psuser_64.dll No File
    Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
    CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\4.0.50401.0\npctrl.dll No File
    CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll No File
    S3 catchme; \??\C:\ComboFix\catchme.sys [X]
    C:\Users\Radiant\AppData\Local\Temp\Quarantine.exe
    *****************

    "HKU\S-1-5-21-3277094342-1709878510-195001535-1001_Classes\CLSID\{FE498BAB-CB4C-4F88-AC3F-3641AAAF5E9E}" => Key deleted successfully.
    HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} => value deleted successfully.
    "HKCR\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}" => Key not found.
    c:\Program Files (x86)\Microsoft Silverlight\4.0.50401.0\npctrl.dll not found.
    C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll not found.
    catchme => Service deleted successfully.
    C:\Users\Radiant\AppData\Local\Temp\Quarantine.exe => Moved successfully.

    ==== End of Fixlog ====
     
  22. Broni

    Broni Malware Annihilator Posts: 47,078   +258

    Good:)

    Last scans...

    [​IMG] Download Security Check from here or here and save it to your Desktop.
    • Double-click SecurityCheck.exe
    • Follow the onscreen instructions inside of the black box.
    • A Notepad document should open automatically called checkup.txt; please post the contents of that document.
    NOTE 1. If one of your security applications (e.g., third-party firewall) requests permission to allow DIG.EXE access the Internet, allow it to do so.
    NOTE 2 SecurityCheck may produce some false warning(s), so leave the results reading to me.


    [​IMG] Please download Farbar Service Scanner (FSS) and run it on the computer with the issue.
    • Make sure the following options are checked:
      • Internet Services
      • Windows Firewall
      • System Restore
      • Security Center
      • Windows Update
      • Windows Defender
      • Other Services
    • Press "Scan".
    • It will create a log (FSS.txt) in the same directory the tool is run.
    • Please copy and paste the log to your reply.

    [​IMG] Download Temp File Cleaner (TFC)
    Alternate download: http://www.itxassociates.com/OT-Tools/TFC.exe
    • Double click on TFC.exe to run the program.
    • Click on Start button to begin cleaning process.
    • TFC will close all running programs, and it may ask you to restart computer.

    [​IMG] Please run a free online scan with the ESET Online Scanner

    • Disable your antivirus program
    • Click on "Run ESET Online Scanner" button.
    • Tick the box next to YES, I accept the Terms of Use
    • Click Start
    • Accept any security warnings from your browser.
    • Check Scan archives
    • Click Start
    • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
    • When the scan completes, click on List of found threats
    • Click on Export to text file , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
    • NOTE. If Eset won't find any threats, it won't produce any log.
     
  23. theRadiantChild

    theRadiantChild TS Enthusiast Topic Starter Posts: 319

    UNSUPPORTED OPERATING SYSTEM! ABORTED!
    I get this in notepad when I try to run security check. No idea why.
     
  24. Broni

    Broni Malware Annihilator Posts: 47,078   +258

    Go ahead with other steps.
     
  25. theRadiantChild

    theRadiantChild TS Enthusiast Topic Starter Posts: 319

    Farbar Service Scanner Version: 21-07-2014
    Ran by Radiant (administrator) on 17-08-2014 at 17:28:17
    Running from "C:\Users\Radiant\Desktop"
    Microsoft Windows 7 Home Premium Service Pack 1 (X64)
    Boot Mode: Normal
    ****************************************************************

    Internet Services:
    ============

    Connection Status:
    ==============
    Localhost is accessible.
    LAN connected.
    Google IP is accessible.
    Google.com is accessible.
    Yahoo.com is accessible.


    Windows Firewall:
    =============

    Firewall Disabled Policy:
    ==================


    System Restore:
    ============

    System Restore Disabled Policy:
    ========================


    Action Center:
    ============


    Windows Update:
    ============

    Windows Autoupdate Disabled Policy:
    ============================


    Windows Defender:
    ==============
    WinDefend Service is not running. Checking service configuration:
    The start type of WinDefend service is set to Demand. The default start type is Auto.
    The ImagePath of WinDefend service is OK.
    The ServiceDll of WinDefend service is OK.


    Windows Defender Disabled Policy:
    ==========================
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender]
    "DisableAntiSpyware"=DWORD:1


    Other Services:
    ==============


    File Check:
    ========
    C:\Windows\System32\nsisvc.dll => File is digitally signed
    C:\Windows\System32\drivers\nsiproxy.sys => File is digitally signed
    C:\Windows\System32\dhcpcore.dll => File is digitally signed
    C:\Windows\System32\drivers\afd.sys => File is digitally signed
    C:\Windows\System32\drivers\tdx.sys => File is digitally signed
    C:\Windows\System32\Drivers\tcpip.sys => File is digitally signed
    C:\Windows\System32\dnsrslvr.dll => File is digitally signed
    C:\Windows\System32\mpssvc.dll => File is digitally signed
    C:\Windows\System32\bfe.dll => File is digitally signed
    C:\Windows\System32\drivers\mpsdrv.sys => File is digitally signed
    C:\Windows\System32\SDRSVC.dll => File is digitally signed
    C:\Windows\System32\vssvc.exe => File is digitally signed
    C:\Windows\System32\wscsvc.dll => File is digitally signed
    C:\Windows\System32\wbem\WMIsvc.dll => File is digitally signed
    C:\Windows\System32\wuaueng.dll => File is digitally signed
    C:\Windows\System32\qmgr.dll => File is digitally signed
    C:\Windows\System32\es.dll => File is digitally signed
    C:\Windows\System32\cryptsvc.dll => File is digitally signed
    C:\Program Files\Windows Defender\MpSvc.dll => File is digitally signed
    C:\Windows\System32\ipnathlp.dll => File is digitally signed
    C:\Windows\System32\iphlpsvc.dll => File is digitally signed
    C:\Windows\System32\svchost.exe => File is digitally signed
    C:\Windows\System32\rpcss.dll => File is digitally signed


    **** End of log ****
     


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.