TechSpot

Notepad.exe and iexplorer.exe using all cpu

By Gavin Vukoder
Mar 29, 2015
  1. I know almost nothing about computers so you'll have to work with me here. I'm not quite sure how I got it but ive noticed my rather expensive computer that should be able to run almost anything with no lag is having trouble even watching a video in windows media player. I checked task manager to see what was wrong and I noticed there are either 2-6 notepad.exe processes running and they all are using 80,000k to 200,000k (not quite sure what that means) and there are also two processes of iexplorer.exe running and those both vary from 200,000k-400,000k. when I end the processes my CPU drops down from upper 80-100% to below 5%. The processes shortly come back within the minute of me ending them. If I try to delete them it says I don't have permission and ive also noticed that it is not allowing me to run antivirus programs or download it. all other internet features work fine but when it comes to downloading or using an antivirus it slows down immensely and often results in error.
     
  2. Broni

    Broni Malware Annihilator Posts: 52,892   +344

    Welcome aboard [​IMG]

    Please, complete all steps listed here: http://www.techspot.com/vb/topic58138.html
    Make sure, you PASTE all logs. If some log exceeds 50,000 characters post limit, split it between couple of replies.
    Attached logs won't be reviewed.

    Please, observe following rules:
    • Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
    • If you're stuck, or you're not sure about certain step, always ask before doing anything else.
    • Please refrain from running any tools, fixes or applying any changes to your computer other than those I suggest.
    • Never run more than one scan at a time.
    • Keep updating me regarding your computer behavior, good, or bad.
    • The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
    • If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
    • I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.
     
  3. Gavin Vukoder

    Gavin Vukoder TS Rookie Topic Starter Posts: 21

    I tried to install the farbar thing but the virus will not let me open up the link and I also tried to run avast which I previously had and it still will not let me, anything else I can try?
     
  4. Gavin Vukoder

    Gavin Vukoder TS Rookie Topic Starter Posts: 21

    This is the log I recieve when I try to run avast if this is any help to you.
    21:13:14Infoinstcont[7244,8528]--
    21:13:14Infoinstcont[7244,8528]2015/03/29 21:13:14 START: Avast installer/updater
    21:13:14Infoinstup[7244,8528]Command: '"C:\Users\LIQUID~1\AppData\Local\Temp\_av_iup.tm~a05168\instup.exe" /edition:1 /prod:ais /sfx:lite /sfxstorage:C:\Users\LIQUID~1\AppData\Local\Temp\_av_iup.tm~a05168'
    21:13:14Infoinstup[7244,8528]CPU: Intel(R) Core(TM) i5-4690K CPU @ 3.50GHz,4
    21:13:14Infoinstup[7244,8528]OS: Windows 7 SP1 x64
    21:13:14Infoinstup[7244,8528]Memory: 42% load. Phys:4194303/4194303K free, Page:4194303/4194303K free, Virt:4103848/4194176K free
    21:13:14Infoinstup[7244,8528]DISKs: C:\ - 1522GB free / 1862GB total
    21:13:14Infoinstup[7244,8528]Running module version: instup.exe - '10.2.2214.845'
    21:13:14Infoinstup[7244,8528]Running module version: Instup.dll - '10.2.2214.845'
    21:13:14Infosimutex[7244,8528]Checking for the mutex ownership.
    21:13:14Infosimutex[7244,8528]The mutex is signaled. We are owners of the mutex.
    21:13:14Infoguiwizard[7244,8528]Running module version: HTMLayout.dll - '3.3.2.169'
    21:13:14Infoguiwizard[7244,8528]Loaded module version: C:\Users\LIQUID~1\AppData\Local\Temp\_av_iup.tm~a05168\HTMLayout.dll - '3.3.2.169'
    21:13:14Infoguiwizard[7244,8528]Setup gui was successfully started.
    21:13:14Infoinstupcore[7244,8528]Setup update has started.
    21:13:14Infoservers[7244,8528]Server definition(s) loaded for 'C:\Users\LIQUID~1\AppData\Local\Temp\_av_iup.tm~a05168\servers.def': 29 (maintenance:0)
    21:13:14Infoservers[7244,8528]ChooseServer: selected server 'Download t8837365 AVAST9 Server' with current url 'http://t8837365.iavs9x.u.avast.com/iavs9x' of type 'URL_TYPE_DOWNLOAD_PROGRAM'.
    21:13:25Errordldwrap[7244,8528]GetFileWithRetry: An error 41222 (0x0000A106) [Host unreachable] has occured when downloading a file from 'http://t8837365.iavs9x.u.avast.com/iavs9x/servers.def.vpx'. Next try: 1
    21:13:25Infoservers[7244,8528]ChooseServer: selected server 'Download f2607758 AVAST9 Server' with current url 'http://f2607758.iavs9x.u.avast.com/iavs9x' of type 'URL_TYPE_DOWNLOAD_PROGRAM'.
    21:13:39Errordldwrap[7244,8528]GetFileWithRetry: An error 41222 (0x0000A106) [Host unreachable] has occured when downloading a file from 'http://f2607758.iavs9x.u.avast.com/iavs9x/servers.def.vpx'. Next try: 2
    21:13:39Infoservers[7244,8528]ChooseServer: selected server 'Download v5774150 AVAST9 Server' with current url 'http://v5774150.iavs9x.u.avast.com/iavs9x' of type 'URL_TYPE_DOWNLOAD_PROGRAM'.
    21:13:52Errordldwrap[7244,8528]GetFileWithRetry: An error 41222 (0x0000A106) [Host unreachable] has occured when downloading a file from 'http://v5774150.iavs9x.u.avast.com/iavs9x/servers.def.vpx'. Next try: 3
    21:13:52Infoservers[7244,8528]ChooseServer: selected server 'Download t4273201 AVAST9 Server' with current url 'http://t4273201.iavs9x.u.avast.com/iavs9x' of type 'URL_TYPE_DOWNLOAD_PROGRAM'.
    21:14:06Errordldwrap[7244,8528]GetFileWithRetry: An error 41222 (0x0000A106) [Host unreachable] has occured when downloading a file from 'http://t4273201.iavs9x.u.avast.com/iavs9x/servers.def.vpx'. Next try: 4
    21:14:06Infoservers[7244,8528]ChooseServer: selected server 'Download f2607758 AVAST9 Server' with current url 'http://f2607758.iavs9x.u.avast.com/iavs9x' of type 'URL_TYPE_DOWNLOAD_PROGRAM'.
    21:14:19Errordldwrap[7244,8528]GetFileWithRetry: An error 41222 (0x0000A106) [Host unreachable] has occured when downloading a file from 'http://f2607758.iavs9x.u.avast.com/iavs9x/servers.def.vpx'. Next try: 5
    21:14:19Infoservers[7244,8528]ChooseServer: selected server 'Download j8452007 AVAST9 Server' with current url 'http://j8452007.iavs9x.u.avast.com/iavs9x' of type 'URL_TYPE_DOWNLOAD_PROGRAM'.
    21:14:32Errordldwrap[7244,8528]GetFileWithRetry: An error 41222 (0x0000A106) [Host unreachable] has occured when downloading a file from 'http://j8452007.iavs9x.u.avast.com/iavs9x/servers.def.vpx'. Next try: 6
    21:14:32Infoservers[7244,8528]ChooseServer: selected server 'Download t4273201 AVAST9 Server' with current url 'http://t4273201.iavs9x.u.avast.com/iavs9x' of type 'URL_TYPE_DOWNLOAD_PROGRAM'.
    21:14:46Errordldwrap[7244,8528]GetFileWithRetry: An error 41222 (0x0000A106) [Host unreachable] has occured when downloading a file from 'http://t4273201.iavs9x.u.avast.com/iavs9x/servers.def.vpx'. Next try: 7
    21:14:46Infoservers[7244,8528]ChooseServer: selected server 'Download t1255314 AVAST9 Server' with current url 'http://t1255314.iavs9x.u.avast.com/iavs9x' of type 'URL_TYPE_DOWNLOAD_PROGRAM'.
    21:14:59Errordldwrap[7244,8528]GetFileWithRetry: An error 41222 (0x0000A106) [Host unreachable] has occured when downloading a file from 'http://t1255314.iavs9x.u.avast.com/iavs9x/servers.def.vpx'. Next try: 8
    21:14:59Infoservers[7244,8528]ChooseServer: selected server 'Download s0432176 AVAST9 Server' with current url 'http://s0432176.iavs9x.u.avast.com/iavs9x' of type 'URL_TYPE_DOWNLOAD_PROGRAM'.
    21:15:01Infodldwrap[7244,8528]GetFileWithRetry: 'servers.def.vpx' successfully downloaded and verified.
    21:15:01Infopkgengine[7244,8528]DownloadPackage(download): 'C:\Users\LIQUID~1\AppData\Local\Temp\_av_iup.tm~a05168\servers.def.vpx', ip: 184.26.143.179, size: 2375 bytes
    21:15:01Infoservers[7244,8528]ChooseServer: selected server 'Download z1336678 AVAST9 Server' with current url 'http://z1336678.iavs9x.u.avast.com/iavs9x' of type 'URL_TYPE_DOWNLOAD_PROGRAM'.
    21:15:02Infodldwrap[7244,8528]GetFileWithRetry: 'prod-ais.vpx' successfully downloaded and verified.
    21:15:02Infopkgengine[7244,8528]DownloadPackage(download): 'C:\Users\LIQUID~1\AppData\Local\Temp\_av_iup.tm~a05168\prod-ais.vpx', ip: 184.26.143.161, size: 359 bytes
    21:15:02Infopkgproduct[7244,8528]LoadPartInfo: program = prg_ais-8a7 returned 0x00000000
    21:15:02Infopkgproduct[7244,8528]LoadPartInfo: setup = setup_ais-8a7 returned 0x00000000
    21:15:02Infopkgengine[7244,8528]LoadLatestProdAndParts: product file 'prod-ais.vpx' was successfully loaded.
    21:15:02Infoservers[7244,8528]ChooseServer: selected server 'Download r2722366 AVAST9 Server' with current url 'http://r2722366.iavs9x.u.avast.com/iavs9x' of type 'URL_TYPE_DOWNLOAD_PROGRAM'.
    21:15:13Errordldwrap[7244,8528]GetFileWithRetry: An error 41222 (0x0000A106) [Host unreachable] has occured when downloading a file from 'http://r2722366.iavs9x.u.avast.com/iavs9x/part-prg_ais-8a7.vpx'. Next try: 1
    21:15:13Infoservers[7244,8528]ChooseServer: selected server 'Download s2757249 AVAST9 Server' with current url 'http://s2757249.iavs9x.u.avast.com/iavs9x' of type 'URL_TYPE_DOWNLOAD_PROGRAM'.
    21:15:26Errordldwrap[7244,8528]GetFileWithRetry: An error 41222 (0x0000A106) [Host unreachable] has occured when downloading a file from 'http://s2757249.iavs9x.u.avast.com/iavs9x/part-prg_ais-8a7.vpx'. Next try: 2
    21:15:26Infoservers[7244,8528]ChooseServer: selected server 'Download r8563071 AVAST9 Server' with current url 'http://r8563071.iavs9x.u.avast.com/iavs9x' of type 'URL_TYPE_DOWNLOAD_PROGRAM'.
    21:15:40Errordldwrap[7244,8528]GetFileWithRetry: An error 41222 (0x0000A106) [Host unreachable] has occured when downloading a file from 'http://r8563071.iavs9x.u.avast.com/iavs9x/part-prg_ais-8a7.vpx'. Next try: 3
    21:15:40Infoservers[7244,8528]ChooseServer: selected server 'Download y2970440 AVAST9 Server' with current url 'http://y2970440.iavs9x.u.avast.com/iavs9x' of type 'URL_TYPE_DOWNLOAD_PROGRAM'.
    21:15:53Errordldwrap[7244,8528]GetFileWithRetry: An error 41222 (0x0000A106) [Host unreachable] has occured when downloading a file from 'http://y2970440.iavs9x.u.avast.com/iavs9x/part-prg_ais-8a7.vpx'. Next try: 4
    21:15:53Infoservers[7244,8528]ChooseServer: selected server 'Download s0432176 AVAST9 Server' with current url 'http://s0432176.iavs9x.u.avast.com/iavs9x' of type 'URL_TYPE_DOWNLOAD_PROGRAM'.
    21:16:06Errordldwrap[7244,8528]GetFileWithRetry: An error 41222 (0x0000A106) [Host unreachable] has occured when downloading a file from 'http://s0432176.iavs9x.u.avast.com/iavs9x/part-prg_ais-8a7.vpx'. Next try: 5
    21:16:06Infoservers[7244,8528]ChooseServer: selected server 'Download s2757249 AVAST9 Server' with current url 'http://s2757249.iavs9x.u.avast.com/iavs9x' of type 'URL_TYPE_DOWNLOAD_PROGRAM'.
    21:16:19Errordldwrap[7244,8528]GetFileWithRetry: An error 41222 (0x0000A106) [Host unreachable] has occured when downloading a file from 'http://s2757249.iavs9x.u.avast.com/iavs9x/part-prg_ais-8a7.vpx'. Next try: 6
    21:16:19Infoservers[7244,8528]ChooseServer: selected server 'Download r2722366 AVAST9 Server' with current url 'http://r2722366.iavs9x.u.avast.com/iavs9x' of type 'URL_TYPE_DOWNLOAD_PROGRAM'.
    21:16:33Infodldwrap[7244,8528]GetFileWithRetry: 'part-prg_ais-8a7.vpx' successfully downloaded and verified.
    21:16:33Infopkgengine[7244,8528]DownloadPackage(download): 'C:\Users\LIQUID~1\AppData\Local\Temp\_av_iup.tm~a05168\part-prg_ais-8a7.vpx', ip: 184.26.143.201, size: 11220 bytes
    21:16:33Infopkgengine[7244,8528]LoadLatestProdAndParts: part file part-prg_ais-8a7.vpx was successfully loaded.
    21:16:33Infoservers[7244,8528]ChooseServer: selected server 'Download x8772551 AVAST9 Server' with current url 'http://x8772551.iavs9x.u.avast.com/iavs9x' of type 'URL_TYPE_DOWNLOAD_PROGRAM'.
    21:16:45Infodldwrap[7244,8528]GetFileWithRetry: 'part-setup_ais-8a7.vpx' successfully downloaded and verified.
    21:16:45Infopkgengine[7244,8528]DownloadPackage(download): 'C:\Users\LIQUID~1\AppData\Local\Temp\_av_iup.tm~a05168\part-setup_ais-8a7.vpx', ip: 184.26.143.201, size: 80395 bytes
    21:16:45Infopkgengine[7244,8528]LoadLatestProdAndParts: part file part-setup_ais-8a7.vpx was successfully loaded.
    21:16:45Infoservers[7244,8528]ChooseServer: selected server 'Download s2757249 AVAST9 Server' with current url 'http://s2757249.ivps9x.u.avast.com/ivps9x' of type 'URL_TYPE_DOWNLOAD_VPS'.
    21:16:56Errordldwrap[7244,8528]GetFileWithRetry: An error 41222 (0x0000A106) [Host unreachable] has occured when downloading a file from 'http://s2757249.ivps9x.u.avast.com/ivps9x/prod-vps.vpx'. Next try: 1
    21:16:56Infoservers[7244,8528]ChooseServer: selected server 'Download l1606592 AVAST9 Server' with current url 'http://l1606592.ivps9x.u.avast.com/ivps9x' of type 'URL_TYPE_DOWNLOAD_VPS'.
    21:17:10Errordldwrap[7244,8528]GetFileWithRetry: An error 41222 (0x0000A106) [Host unreachable] has occured when downloading a file from 'http://l1606592.ivps9x.u.avast.com/ivps9x/prod-vps.vpx'. Next try: 2
    21:17:10Infoservers[7244,8528]ChooseServer: selected server 'Download r2722366 AVAST9 Server' with current url 'http://r2722366.ivps9x.u.avast.com/ivps9x' of type 'URL_TYPE_DOWNLOAD_VPS'.
    21:17:12Infodldwrap[7244,8528]GetFileWithRetry: 'prod-vps.vpx' successfully downloaded and verified.
    21:17:12Infopkgengine[7244,8528]DownloadPackage(download): 'C:\Users\LIQUID~1\AppData\Local\Temp\_av_iup.tm~a05168\prod-vps.vpx', ip: 184.26.143.201, size: 451 bytes
    21:17:12Infopkgproduct[7244,8528]LoadPartInfo: iex = iex-4 returned 0x00000000
    21:17:12Infopkgproduct[7244,8528]LoadPartInfo: jrog2 = jrog2-d13 returned 0x00000000
    21:17:12Infopkgproduct[7244,8528]LoadPartInfo: vps = vps_win32-15032901 returned 0x00000000
    21:17:12Infopkgengine[7244,8528]LoadLatestProdAndParts: product file 'prod-vps.vpx' was successfully loaded.
    21:17:12Infoservers[7244,8528]ChooseServer: selected server 'Download f2607758 AVAST9 Server' with current url 'http://f2607758.ivps9x.u.avast.com/ivps9x' of type 'URL_TYPE_DOWNLOAD_VPS'.
    21:17:13Infodldwrap[7244,8528]GetFileWithRetry: 'part-iex-4.vpx' successfully downloaded and verified.
    21:17:13Infopkgengine[7244,8528]DownloadPackage(download): 'C:\Users\LIQUID~1\AppData\Local\Temp\_av_iup.tm~a05168\part-iex-4.vpx', ip: 184.26.143.201, size: 232 bytes
    21:17:13Infopkgengine[7244,8528]LoadLatestProdAndParts: part file part-iex-4.vpx was successfully loaded.
    21:17:13Infoservers[7244,8528]ChooseServer: selected server 'Download w9800018 AVAST9 Server' with current url 'http://w9800018.ivps9x.u.avast.com/ivps9x' of type 'URL_TYPE_DOWNLOAD_VPS'.
    21:17:13Infodldwrap[7244,8528]GetFileWithRetry: 'part-jrog2-d13.vpx' successfully downloaded and verified.
    21:17:13Infopkgengine[7244,8528]DownloadPackage(download): 'C:\Users\LIQUID~1\AppData\Local\Temp\_av_iup.tm~a05168\part-jrog2-d13.vpx', ip: 184.26.143.201, size: 916 bytes
    21:17:13Infopkgengine[7244,8528]LoadLatestProdAndParts: part file part-jrog2-d13.vpx was successfully loaded.
    21:17:13Infoservers[7244,8528]ChooseServer: selected server 'Download z1336678 AVAST9 Server' with current url 'http://z1336678.ivps9x.u.avast.com/ivps9x' of type 'URL_TYPE_DOWNLOAD_VPS'.
    21:17:25Errordldwrap[7244,8528]GetFileWithRetry: An error 41222 (0x0000A106) [Host unreachable] has occured when downloading a file from 'http://z1336678.ivps9x.u.avast.com/ivps9x/part-vps_win32-15032901.vpx'. Next try: 1
    21:17:25Infoservers[7244,8528]ChooseServer: selected server 'Download v1808189 AVAST9 Server' with current url 'http://v1808189.ivps9x.u.avast.com/ivps9x' of type 'URL_TYPE_DOWNLOAD_VPS'.
    21:17:27Infodldwrap[7244,8528]GetFileWithRetry: 'part-vps_win32-15032901.vpx' successfully downloaded and verified.
    21:17:27Infopkgengine[7244,8528]DownloadPackage(download): 'C:\Users\LIQUID~1\AppData\Local\Temp\_av_iup.tm~a05168\part-vps_win32-15032901.vpx', ip: 184.26.143.201, size: 2413 bytes
    21:17:27Infopkgengine[7244,8528]LoadLatestProdAndParts: part file part-vps_win32-15032901.vpx was successfully loaded.
    21:17:27Infoservers[7244,8528]ChooseServer: selected server 'Download h6434243 AVAST9 Server' with current url 'http://h6434243.iavs9x.u.avast.com/iavs9x' of type 'URL_TYPE_DOWNLOAD_PROGRAM'.
    21:17:27Noticepackageinfo[7244,8528]IsFullOkay: avbugreport_ais-8a7.vpx - not okay (doesn't exist)
    21:17:27Noticepackageinfo[7244,8528]IsFullOkay: avbugreport_ais-8a7.vpx - not okay (doesn't exist)
    21:17:27Infopackageinfo[7244,8528]SetFullAsMarked: Package avbugreport_ais set to 1
    21:17:35Infodldwrap[7244,8528]GetFileWithRetry: 'avbugreport_ais-8a7.vpx' successfully downloaded and verified.
    21:17:35Infopkgengine[7244,8528]DownloadPackage(download): 'C:\Users\LIQUID~1\AppData\Local\Temp\_av_iup.tm~a05168\avbugreport_ais-8a7.vpx', ip: 184.26.143.201, size: 558533 bytes
    21:17:35Noticepackageinfo[7244,8528]IsFullOkay: instcont_ais-8a7.vpx - not okay (doesn't exist)
    21:17:35Noticepackageinfo[7244,8528]IsFullOkay: instcont_ais-8a7.vpx - not okay (doesn't exist)
    21:17:35Infopackageinfo[7244,8528]SetFullAsMarked: Package instcont_ais set to 1
    21:17:43Infodldwrap[7244,8528]GetFileWithRetry: 'instcont_ais-8a7.vpx' successfully downloaded and verified.
    21:17:43Infopkgengine[7244,8528]DownloadPackage(download): 'C:\Users\LIQUID~1\AppData\Local\Temp\_av_iup.tm~a05168\instcont_ais-8a7.vpx', ip: 184.26.143.201, size: 206493 bytes
    21:17:43Noticepackageinfo[7244,8528]IsFullOkay: instup_ais-8a7.vpx - not okay (doesn't exist)
    21:17:43Noticepackageinfo[7244,8528]IsFullOkay: instup_ais-8a7.vpx - not okay (doesn't exist)
    21:17:43Infopackageinfo[7244,8528]SetFullAsMarked: Package instup_ais set to 1
    21:17:52Infodldwrap[7244,8528]GetFileWithRetry: 'instup_ais-8a7.vpx' successfully downloaded and verified.
    21:17:52Infopkgengine[7244,8528]DownloadPackage(download): 'C:\Users\LIQUID~1\AppData\Local\Temp\_av_iup.tm~a05168\instup_ais-8a7.vpx', ip: 184.26.143.201, size: 2664468 bytes
    21:17:52Noticepackageinfo[7244,8528]IsFullOkay: ngiodriver_x64_ais-8a7.vpx - not okay (doesn't exist)
    21:17:52Noticepackageinfo[7244,8528]IsFullOkay: ngiodriver_x64_ais-8a7.vpx - not okay (doesn't exist)
    21:17:52Infopackageinfo[7244,8528]SetFullAsMarked: Package ngiodriver_x64_ais set to 1
    21:18:00Infodldwrap[7244,8528]GetFileWithRetry: 'ngiodriver_x64_ais-8a7.vpx' successfully downloaded and verified.
    21:18:00Infopkgengine[7244,8528]DownloadPackage(download): 'C:\Users\LIQUID~1\AppData\Local\Temp\_av_iup.tm~a05168\ngiodriver_x64_ais-8a7.vpx', ip: 184.26.143.201, size: 8641 bytes
    21:18:00Noticepackageinfo[7244,8528]IsFullOkay: ngiodriver_x86_ais-8a7.vpx - not okay (doesn't exist)
    21:18:00Noticepackageinfo[7244,8528]IsFullOkay: ngiodriver_x86_ais-8a7.vpx - not okay (doesn't exist)
    21:18:00Infopackageinfo[7244,8528]SetFullAsMarked: Package ngiodriver_x86_ais set to 1
    21:18:11Errordldwrap[7244,8528]GetFileWithRetry: An error 41222 (0x0000A106) [Host unreachable] has occured when downloading a file from 'http://h6434243.iavs9x.u.avast.com/iavs9x/ngiodriver_x86_ais-8a7.vpx'. Next try: 1
    21:18:11Infoservers[7244,8528]ChooseServer: selected server 'Download j8985691 AVAST9 Server' with current url 'http://j8985691.iavs9x.u.avast.com/iavs9x' of type 'URL_TYPE_DOWNLOAD_PROGRAM'.
    21:18:25Errordldwrap[7244,8528]GetFileWithRetry: An error 41222 (0x0000A106) [Host unreachable] has occured when downloading a file from 'http://j8985691.iavs9x.u.avast.com/iavs9x/ngiodriver_x86_ais-8a7.vpx'. Next try: 2
    21:18:25Infoservers[7244,8528]ChooseServer: selected server 'Download v1808189 AVAST9 Server' with current url 'http://v1808189.iavs9x.u.avast.com/iavs9x' of type 'URL_TYPE_DOWNLOAD_PROGRAM'.
    21:18:38Errordldwrap[7244,8528]GetFileWithRetry: An error 41222 (0x0000A106) [Host unreachable] has occured when downloading a file from 'http://v1808189.iavs9x.u.avast.com/iavs9x/ngiodriver_x86_ais-8a7.vpx'. Next try: 3
    21:18:38Infoservers[7244,8528]ChooseServer: selected server 'Download l7094613 AVAST9 Server' with current url 'http://l7094613.iavs9x.u.avast.com/iavs9x' of type 'URL_TYPE_DOWNLOAD_PROGRAM'.
    21:18:52Errordldwrap[7244,8528]GetFileWithRetry: An error 41222 (0x0000A106) [Host unreachable] has occured when downloading a file from 'http://l7094613.iavs9x.u.avast.com/iavs9x/ngiodriver_x86_ais-8a7.vpx'. Next try: 4
    21:18:52Infoservers[7244,8528]ChooseServer: selected server 'Download w9800018 AVAST9 Server' with current url 'http://w9800018.iavs9x.u.avast.com/iavs9x' of type 'URL_TYPE_DOWNLOAD_PROGRAM'.
    21:19:05Errordldwrap[7244,8528]GetFileWithRetry: An error 41222 (0x0000A106) [Host unreachable] has occured when downloading a file from 'http://w9800018.iavs9x.u.avast.com/iavs9x/ngiodriver_x86_ais-8a7.vpx'. Next try: 5
    21:19:05Infoservers[7244,8528]ChooseServer: selected server 'Download s0432176 AVAST9 Server' with current url 'http://s0432176.iavs9x.u.avast.com/iavs9x' of type 'URL_TYPE_DOWNLOAD_PROGRAM'.
    21:19:18Errordldwrap[7244,8528]GetFileWithRetry: An error 41222 (0x0000A106) [Host unreachable] has occured when downloading a file from 'http://s0432176.iavs9x.u.avast.com/iavs9x/ngiodriver_x86_ais-8a7.vpx'. Next try: 6
    21:19:18Infoservers[7244,8528]ChooseServer: selected server 'Download m6455178 AVAST9 Server' with current url 'http://m6455178.iavs9x.u.avast.com/iavs9x' of type 'URL_TYPE_DOWNLOAD_PROGRAM'.
    21:19:31Errordldwrap[7244,8528]GetFileWithRetry: An error 41222 (0x0000A106) [Host unreachable] has occured when downloading a file from 'http://m6455178.iavs9x.u.avast.com/iavs9x/ngiodriver_x86_ais-8a7.vpx'. Next try: 7
    21:19:31Infoservers[7244,8528]ChooseServer: selected server 'Download f2607758 AVAST9 Server' with current url 'http://f2607758.iavs9x.u.avast.com/iavs9x' of type 'URL_TYPE_DOWNLOAD_PROGRAM'.
    21:19:45Errordldwrap[7244,8528]GetFileWithRetry: An error 41222 (0x0000A106) [Host unreachable] has occured when downloading a file from 'http://f2607758.iavs9x.u.avast.com/iavs9x/ngiodriver_x86_ais-8a7.vpx'. Next try: 8
    21:19:45Infoservers[7244,8528]ChooseServer: selected server 'Download r8563071 AVAST9 Server' with current url 'http://r8563071.iavs9x.u.avast.com/iavs9x' of type 'URL_TYPE_DOWNLOAD_PROGRAM'.
    21:19:58Errordldwrap[7244,8528]GetFileWithRetry: An error 41222 (0x0000A106) [Host unreachable] has occured when downloading a file from 'http://r8563071.iavs9x.u.avast.com/iavs9x/ngiodriver_x86_ais-8a7.vpx'. Next try: 9
    21:19:58Infoservers[7244,8528]ChooseServer: selected server 'Download t4273201 AVAST9 Server' with current url 'http://t4273201.iavs9x.u.avast.com/iavs9x' of type 'URL_TYPE_DOWNLOAD_PROGRAM'.
    21:20:11Errordldwrap[7244,8528]GetFileWithRetry: An error 41222 (0x0000A106) [Host unreachable] has occured when downloading a file from 'http://t4273201.iavs9x.u.avast.com/iavs9x/ngiodriver_x86_ais-8a7.vpx'. Next try: 10
    21:20:11Infoservers[7244,8528]ChooseServer: selected server 'Download t1255314 AVAST9 Server' with current url 'http://t1255314.iavs9x.u.avast.com/iavs9x' of type 'URL_TYPE_DOWNLOAD_PROGRAM'.
    21:20:13Errorpkgengine[7244,8528]DownloadPackage(download): 'C:\Users\LIQUID~1\AppData\Local\Temp\_av_iup.tm~a05168\ngiodriver_x86_ais-8a7.vpx', ip: unknown, has failed with code: 41222 (0x0000A106) [Host unreachable]
    21:20:13Errorpkgengine[7244,8528]UpdateVPXs: package ngiodriver_x86_ais was not updated. Status: 41222 (0x0000A106) [Host unreachable]
     
  5. Broni

    Broni Malware Annihilator Posts: 52,892   +344

  6. Gavin Vukoder

    Gavin Vukoder TS Rookie Topic Starter Posts: 21

    Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-03-2015
    Ran by LiquidGamma (administrator) on LIQUIDGAMMA-PC on 29-03-2015 20:57:51
    Running from C:\Users\LiquidGamma\Downloads
    Loaded Profiles: LiquidGamma (Available profiles: LiquidGamma)
    Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: English (United States)
    Internet Explorer Version 11 (Default browser: Chrome)
    Boot Mode: Normal
    Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

    ==================== Processes (Whitelisted) =================

    (If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

    (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
    (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
    (Logitech Inc.) C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
    (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
    (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
    (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
    (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
    (LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe
    (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
    (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
    (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
    (LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe
    (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
    (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
    (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
    (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
    (NVIDIA Corporation) C:\Users\LiquidGamma\AppData\Local\NVIDIA\NvBackend\ApplicationOntology\NvOAWrapperCache.exe
    (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
    (Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
    (Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
    (Microsoft Corporation) C:\Windows\SysWOW64\regsvr32.exe
    (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
    (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
    (Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
    (Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe
    (Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
    (Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
    (Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\IPC\AdobeIPCBroker.exe
    (WiseAndPath) C:\Users\LiquidGamma\AppData\Local\Ilsoft\tmp2786.exe
    () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync.exe
    (Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\HEX\Adobe CEF Helper.exe
    (©Wyebugur) C:\Users\LiquidGamma\AppData\Roaming\Microsoft\Windows\IEUpdate\notepad.exe
    (©Wyebugur) C:\Users\LiquidGamma\AppData\Roaming\Microsoft\Windows\IEUpdate\notepad.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (©Wyebugur) C:\Users\LiquidGamma\AppData\Roaming\Microsoft\Windows\IEUpdate\notepad.exe
    (©Wyebugur) C:\Users\LiquidGamma\AppData\Roaming\Microsoft\Windows\IEUpdate\notepad.exe
    (Microsoft Corporation) C:\Windows\SysWOW64\explorer.exe
    (©Wyebugur) C:\Users\LiquidGamma\AppData\Roaming\Microsoft\Windows\IEUpdate\notepad.exe
    (Microsoft Corporation) C:\Windows\SysWOW64\explorer.exe
    (Microsoft Corporation) C:\Windows\SysWOW64\explorer.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Microsoft Corporation) C:\Windows\SysWOW64\explorer.exe
    (Microsoft Corporation) C:\Windows\System32\wbem\WMIADAP.exe
    (©Wyebugur) C:\Users\LiquidGamma\AppData\Roaming\Microsoft\Windows\IEUpdate\notepad.exe
    (Microsoft Corporation) C:\Windows\SysWOW64\explorer.exe
    (Microsoft Corporation) C:\Windows\System32\dllhost.exe


    ==================== Registry (Whitelisted) ==================

    (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

    HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2460488 2014-09-16] (NVIDIA Corporation)
    HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
    HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch
    HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [557768 2014-10-14] (Adobe Systems Incorporated)
    HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-25] (Oracle Corporation)
    HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-09-01] (Apple Inc.)
    HKLM-x32\...\Run: [Adobe Creative Cloud] => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe [2694320 2014-10-15] (Adobe Systems Incorporated)
    HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-10-02] (Apple Inc.)
    HKLM-x32\...\Run: [LogMeIn Hamachi Ui] => C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe [3978600 2015-02-17] (LogMeIn Inc.)
    HKLM-x32\...\Run: [tagu] => C:\Users\LiquidGamma\AppData\Local\tagu\tagu.exe [350720 2015-03-26] ()
    HKLM\...\Policies\Explorer\Run: [tagu] => C:\Users\LiquidGamma\AppData\Local\tagu\tagu.exe [350720 2015-03-26] ( ())
    HKLM\Software\Policies\Microsoft\Windows NT\SystemRestore: [DisableSR/DisableConfig] <===== ATTENTION
    HKU\S-1-5-21-2271226647-762932056-463426160-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [30872168 2014-12-11] (Skype Technologies S.A.)
    HKU\S-1-5-21-2271226647-762932056-463426160-1000\...\Run: [BluetoothS] => rundll32.exe "%appdata%\BtvStack.dll",BTHF_Register
    HKU\S-1-5-21-2271226647-762932056-463426160-1000\...\Run: [notepad] => C:\Users\LiquidGamma\AppData\Roaming\Microsoft\Windows\IEUpdate\notepad.exe [290304 2014-03-04] (©Wyebugur)
    HKU\S-1-5-21-2271226647-762932056-463426160-1000\...\Run: [AdobeBridge] => [X]
    HKU\S-1-5-21-2271226647-762932056-463426160-1000\...\Run: [Ilsoft] => C:\Users\LiquidGamma\AppData\Local\Ilsoft\tmp2786.exe [159744 2015-03-27] (WiseAndPath)
    HKU\S-1-5-21-2271226647-762932056-463426160-1000\...\Run: [Imqsoft] => C:\Windows\SysWOW64\regsvr32.exe C:\Users\LiquidGamma\AppData\Local\Ilsoft\WhipFilter.dll
    HKU\S-1-5-21-2271226647-762932056-463426160-1000\...\RunOnce: [notepad] => C:\Users\LiquidGamma\AppData\Roaming\Microsoft\Windows\IEUpdate\notepad.exe [290304 2014-03-04] (©Wyebugur)
    HKU\S-1-5-21-2271226647-762932056-463426160-1000\...\Policies\Explorer: [Run] "C:\Users\LiquidGamma\AppData\Roaming\Microsoft\Windows\IEUpdate\notepad.exe"
    HKU\S-1-5-21-2271226647-762932056-463426160-1000\...\MountPoints2: {8ea73233-2deb-11e4-abe6-806e6f6e6963} - D:\setup.exe
    HKU\S-1-5-21-2271226647-762932056-463426160-1000\...\Command Processor: "C:\Users\LiquidGamma\AppData\Roaming\Microsoft\Windows\IEUpdate\notepad.exe" <===== ATTENTION!
    HKU\S-1-5-21-2271226647-762932056-463426160-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Users\LiquidGamma\AppData\Roaming\Microsoft\Windows\IEUpdate\notepad.exe [290304 2014-03-04] (©Wyebugur)
    Startup: C:\Users\LiquidGamma\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\notepad.lnk
    ShortcutTarget: notepad.lnk -> C:\Users\LiquidGamma\AppData\Roaming\Microsoft\Windows\IEUpdate\notepad.exe (©Wyebugur)
    ShellIconOverlayIdentifiers: [ AccExtIco1] -> {AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll ()
    ShellIconOverlayIdentifiers: [ AccExtIco2] -> {853B7E05-C47D-4985-909A-D0DC5C6D7303} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll ()
    ShellIconOverlayIdentifiers: [ AccExtIco3] -> {42D38F2E-98E9-4382-B546-E24E4D6D04BB} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll ()
    ShellIconOverlayIdentifiers: [0WinSecurityProvider] -> {F76FA5C2-3B6A-451E-8CA5-34C8D0AE0637} => C:\ProgramData\Microsoft\Security\Client\SecurityProvider.dll ()

    ==================== Internet (Whitelisted) ====================

    (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

    HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local: [ActivePolicy] SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local\ipsecPolicy{f17607cd-846b-4172-9076-6209d6a460e1} <======= ATTENTION (Policy Restriction on IP)
    HKU\S-1-5-21-2271226647-762932056-463426160-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/?ocid=iehp
    BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
    BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2014-08-27] (Oracle Corporation)
    BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
    BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2014-08-27] (Oracle Corporation)
    Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
    Tcpip\..\Interfaces\{58E7A3ED-04C3-43F6-920F-8755F905D8D2}: [NameServer] 8.8.8.8,8.8.8.8,8.8.8.8,8.8.8.8,8.8.8.8,8.8.8.8
    Tcpip\..\Interfaces\{9D014533-A042-41E3-9169-2141CCB2EEAA}: [NameServer] 8.8.8.8,8.8.8.8,8.8.8.8,8.8.8.8,8.8.8.8,8.8.8.8
    Tcpip\..\Interfaces\{F210D695-47AE-4DE6-A9AE-146AA6397065}: [NameServer] 8.8.8.8,8.8.8.8,8.8.8.8,8.8.8.8,8.8.8.8,8.8.8.8

    FireFox:
    ========
    FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll [2015-02-04] ()
    FF Plugin: @microsoft.com/GENUINE -> disabled No File
    FF Plugin: adobe.com/AdobeAAMDetect_x86_64 -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll [2014-10-15] (Adobe Systems)
    FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll [2015-02-04] ()
    FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-05-06] ()
    FF Plugin-x32: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll [2014-08-27] (Oracle Corporation)
    FF Plugin-x32: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll [2014-08-27] (Oracle Corporation)
    FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
    FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
    FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2014-09-13] (NVIDIA Corporation)
    FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2014-09-13] (NVIDIA Corporation)
    FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-08] (Google Inc.)
    FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-08] (Google Inc.)
    FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll [2014-10-15] (Adobe Systems)
    FF Plugin HKU\S-1-5-21-2271226647-762932056-463426160-1000: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\LiquidGamma\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2014-10-08] (Unity Technologies ApS)

    Chrome:
    =======
    CHR HomePage: Default -> hxxp://start.funmoods.com/?f=1&a=aln&chnl=aln&cd=2XzutAtN2Y1L1QzutDzzzzyCtA0Bzz0FyC0F0BtDtDyEtBzztN0D0TzutBtDtCtBtDyCtBtD&cr=897213179
    CHR StartupUrls: Default -> "hxxp://www.google.com/", "hxxp://youtube.com/"
    CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:inputType}{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}{google:searchVersion}{google:sessionToken}{google:prefetchQuery}sugkey={google:suggestAPIKeyParameter}
    CHR Profile: C:\Users\LiquidGamma\AppData\Local\Google\Chrome\User Data\Default
    CHR Extension: (Google Slides) - C:\Users\LiquidGamma\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2014-08-27]
    CHR Extension: (Angry Birds) - C:\Users\LiquidGamma\AppData\Local\Google\Chrome\User Data\Default\Extensions\aknpkdffaafgjchaibgeefbgmgeghloj [2014-08-27]
    CHR Extension: (Google Docs) - C:\Users\LiquidGamma\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-08-27]
    CHR Extension: (Google Drive) - C:\Users\LiquidGamma\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-08-27]
    CHR Extension: (Please enter your password) - C:\Users\LiquidGamma\AppData\Local\Google\Chrome\User Data\Default\Extensions\bfbmjmiodbnnpllbbbfblcplfjjepjdn [2015-03-25]
    CHR Extension: (YouTube) - C:\Users\LiquidGamma\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-08-27]
    CHR Extension: (Adblock Plus) - C:\Users\LiquidGamma\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2014-08-27]
    CHR Extension: (Kingdom Rush) - C:\Users\LiquidGamma\AppData\Local\Google\Chrome\User Data\Default\Extensions\ckmfhhjalnddapegkbbohfaodgbnocim [2014-08-27]
    CHR Extension: (Google Search) - C:\Users\LiquidGamma\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-08-27]
    CHR Extension: (Ocean Pacific) - C:\Users\LiquidGamma\AppData\Local\Google\Chrome\User Data\Default\Extensions\ecaabliejjdikjnkahhikeelbblahgoi [2015-03-25]
    CHR Extension: (Freefall Tournament) - C:\Users\LiquidGamma\AppData\Local\Google\Chrome\User Data\Default\Extensions\encjogopgacdjlkmpdknhlfnanoihodh [2014-08-27]
    CHR Extension: (Google Sheets) - C:\Users\LiquidGamma\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2014-08-27]
    CHR Extension: (Happy Wheels) - C:\Users\LiquidGamma\AppData\Local\Google\Chrome\User Data\Default\Extensions\hpljdpjoahbnnfilkiilnfdkdbfiabfc [2014-08-27]
    CHR Extension: (Cut the Rope) - C:\Users\LiquidGamma\AppData\Local\Google\Chrome\User Data\Default\Extensions\jfbadlndcminbkfojhlimnkgaackjmdo [2014-08-27]
    CHR Extension: (Chrome Hotword Shared Module) - C:\Users\LiquidGamma\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-15]
    CHR Extension: (Google Wallet) - C:\Users\LiquidGamma\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-08-27]
    CHR Extension: (Gmail) - C:\Users\LiquidGamma\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-08-27]
    CHR Extension: (Canvas Rider) - C:\Users\LiquidGamma\AppData\Local\Google\Chrome\User Data\Default\Extensions\poknhlcknimnnbfcombaooklofipaibk [2014-08-27]

    ==================== Services (Whitelisted) =================

    (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

    R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1148744 2014-09-16] (NVIDIA Corporation)
    R2 LMIGuardianSvc; C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe [417552 2015-02-16] (LogMeIn, Inc.)
    R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1795912 2014-09-16] (NVIDIA Corporation)
    R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [19439944 2014-09-16] (NVIDIA Corporation)
    R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

    ==================== Drivers (Whitelisted) ====================

    (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

    R3 ISCT; C:\Windows\System32\DRIVERS\ISCTD64.sys [46568 2013-01-19] ()
    R3 MEIx64; C:\Windows\System32\DRIVERS\TeeDriverx64.sys [129312 2014-09-30] (Intel Corporation)
    R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19272 2014-09-16] (NVIDIA Corporation)
    R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [38048 2014-09-04] (NVIDIA Corporation)

    ==================== NetSvcs (Whitelisted) ===================

    (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


    ==================== One Month Created Files and Folders ========

    (If an entry is included in the fixlist, the file\folder will be moved.)

    2015-03-29 20:57 - 2015-03-29 20:58 - 00018308 _____ () C:\Users\LiquidGamma\Downloads\FRST.txt
    2015-03-29 20:57 - 2015-03-29 20:57 - 00000000 ____D () C:\FRST
    2015-03-29 20:56 - 2015-03-29 20:57 - 02095616 _____ (Farbar) C:\Users\LiquidGamma\Downloads\FRST64.exe
    2015-03-29 17:15 - 2015-03-29 17:15 - 00033026 _____ () C:\Users\LiquidGamma\Downloads\Adobe After Effects (2).torrent
    2015-03-28 23:15 - 2015-03-28 23:15 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_TeeDriverx64_01011.Wdf
    2015-03-28 23:06 - 2015-03-28 23:06 - 00000000 ____D () C:\ProgramData\AVAST Software
    2015-03-28 23:05 - 2015-03-28 23:05 - 05475064 _____ (Avast Software s.r.o.) C:\Users\Public\Desktop\avast_free_antivirus_setup_online.exe
    2015-03-28 23:05 - 2015-03-28 23:05 - 05475064 _____ (Avast Software s.r.o.) C:\Users\LiquidGamma\Downloads\avast_free_antivirus_setup_online.exe
    2015-03-28 22:23 - 2015-03-28 22:23 - 00000000 __SHD () C:\Users\LiquidGamma\AppData\Local\EmieUserList
    2015-03-28 22:23 - 2015-03-28 22:23 - 00000000 __SHD () C:\Users\LiquidGamma\AppData\Local\EmieSiteList
    2015-03-28 22:23 - 2015-03-28 22:23 - 00000000 __SHD () C:\Users\LiquidGamma\AppData\Local\EmieBrowserModeList
    2015-03-28 22:05 - 2015-03-28 22:06 - 00001908 _____ () C:\Windows\diagwrn.xml
    2015-03-28 22:05 - 2015-03-28 22:06 - 00001908 _____ () C:\Windows\diagerr.xml
    2015-03-28 16:05 - 2015-03-28 16:05 - 00000000 ____D () C:\Windows\system32\appmgmt
    2015-03-27 19:18 - 2015-03-27 19:18 - 00000000 ____D () C:\Users\LiquidGamma\AppData\Local\Ilsoft
    2015-03-27 12:08 - 2015-03-27 12:08 - 02633407 _____ () C:\Users\LiquidGamma\Downloads\Logo Instructions.zip
    2015-03-27 12:08 - 2015-03-27 12:08 - 02633407 _____ () C:\Users\LiquidGamma\Desktop\Logo Instructions.zip
    2015-03-27 11:41 - 2015-03-27 11:40 - 04361185 _____ () C:\Users\LiquidGamma\Desktop\Blur Bars Visualizer.zip
    2015-03-27 11:40 - 2015-03-27 11:40 - 04361185 _____ () C:\Users\LiquidGamma\Downloads\Blur Bars Visualizer.zip
    2015-03-27 10:09 - 2015-03-28 20:30 - 03047819 _____ () C:\Users\LiquidGamma\Desktop\Template.aep
    2015-03-27 08:30 - 2015-03-27 08:30 - 00000000 ____D () C:\Users\LiquidGamma\Documents\Adobe
    2015-03-26 21:39 - 2015-03-26 21:29 - 180345979 _____ () C:\Users\LiquidGamma\Desktop\Spectrum Template by NoName.rar
    2015-03-26 21:23 - 2015-03-26 21:29 - 180345979 _____ () C:\Users\LiquidGamma\Downloads\Spectrum Template by NoName.rar
    2015-03-26 20:14 - 2015-03-28 21:20 - 00000000 ____D () C:\Users\LiquidGamma\Desktop\Adobe After Effects Auto-Save
    2015-03-26 18:22 - 2015-03-26 18:23 - 10570305 _____ () C:\Users\LiquidGamma\Downloads\Free Template (1).zip
    2015-03-26 18:02 - 2015-03-28 19:12 - 00001254 _____ () C:\Users\LiquidGamma\Desktop\Adobe After Effects CC 2014.lnk
    2015-03-26 17:42 - 2015-03-26 17:42 - 01325320 _____ () C:\Users\LiquidGamma\Downloads\The awesomest template ever.zip
    2015-03-26 17:29 - 2015-03-26 17:29 - 00000997 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Help.lnk
    2015-03-26 17:29 - 2015-03-26 17:29 - 00000000 ____D () C:\Users\Default\AppData\Roaming\Macromedia
    2015-03-26 17:29 - 2015-03-26 17:29 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\Macromedia
    2015-03-26 17:03 - 2015-03-26 17:03 - 00044976 _____ () C:\Users\LiquidGamma\Downloads\Classy.zip
    2015-03-25 19:44 - 2015-03-25 19:47 - 00000000 ____D () C:\Users\LiquidGamma\AppData\Local\tagu
    2015-03-25 19:29 - 2015-03-29 20:57 - 00003600 _____ () C:\Windows\System32\Tasks\notepad
    2015-03-25 19:05 - 2015-03-25 19:08 - 00000000 ____D () C:\Users\LiquidGamma\AppData\Roaming\Local Store
    2015-03-25 18:44 - 2015-03-25 18:44 - 00003006 _____ () C:\Windows\System32\Tasks\{49924DAD-81D9-42C9-924F-5292BBEB670A}
    2015-03-25 18:44 - 2015-03-25 18:44 - 00003006 _____ () C:\Windows\System32\Tasks\{1553A040-66A0-44CF-8DAC-995F0734F8BD}
    2015-03-25 18:43 - 2015-03-29 20:54 - 00000761 _____ () C:\Windows\system32\Drivers\etc\hosts.txt
    2015-03-25 18:40 - 2015-03-28 22:14 - 00000000 ____D () C:\Users\LiquidGamma\AppData\Roaming\uTorrent
    2015-03-25 18:38 - 2015-03-25 18:38 - 01741904 _____ (BitTorrent Inc.) C:\Users\LiquidGamma\Downloads\uTorrent.exe
    2015-03-25 18:28 - 2015-03-25 18:28 - 00033026 _____ () C:\Users\LiquidGamma\Downloads\Adobe After Effects (1).torrent
    2015-03-25 18:26 - 2015-03-28 15:01 - 00003484 _____ () C:\Windows\System32\Tasks\ProPCCleaner_Popup
    2015-03-25 18:26 - 2015-03-28 15:01 - 00000000 ____D () C:\Users\LiquidGamma\Documents\ProPCCleaner
    2015-03-25 18:26 - 2015-03-26 22:13 - 00000000 ____D () C:\Users\LiquidGamma\AppData\Roaming\Azureus
    2015-03-25 18:26 - 2015-03-25 18:26 - 00003220 _____ () C:\Windows\System32\Tasks\ProPCCleaner_Start
    2015-03-25 18:26 - 2015-03-25 18:26 - 00000000 ____D () C:\Users\LiquidGamma\AppData\Roaming\Rainmaker Software Group LLC.
    2015-03-25 18:26 - 2015-03-25 18:26 - 00000000 ____D () C:\Users\LiquidGamma\AppData\Local\Rainmaker_Software_Group_
    2015-03-25 18:26 - 2015-03-25 18:26 - 00000000 ____D () C:\Users\LiquidGamma\.swt
    2015-03-25 18:24 - 2015-03-25 18:24 - 00072008 _____ (Azureus Software, Inc.) C:\Users\LiquidGamma\Downloads\VuzeBittorrentClientInstaller.exe
    2015-03-25 18:24 - 2015-03-25 18:24 - 00033026 _____ () C:\Users\LiquidGamma\Downloads\Adobe After Effects.torrent
    2015-03-24 20:11 - 2015-03-24 20:12 - 06684059 _____ () C:\Users\LiquidGamma\Downloads\eightytown (loop)-HD.mp4
    2015-03-24 19:48 - 2015-03-24 19:49 - 10570305 _____ () C:\Users\LiquidGamma\Downloads\Free Template.zip
    2015-03-23 19:34 - 2015-03-23 19:34 - 02714417 _____ () C:\Users\LiquidGamma\Downloads\speakoniasetup-1.0.exe
    2015-03-23 19:34 - 2015-03-23 19:34 - 00002178 _____ () C:\Users\LiquidGamma\Desktop\Speakonia.lnk
    2015-03-23 19:34 - 2015-03-23 19:34 - 00000000 ____D () C:\Windows\lhsp
    2015-03-23 19:34 - 2015-03-23 19:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CFS-Technologies
    2015-03-23 19:34 - 2015-03-23 19:34 - 00000000 ____D () C:\Program Files (x86)\CFS-Technologies
    2015-03-22 18:49 - 2015-03-22 18:49 - 04859488 _____ () C:\Users\LiquidGamma\Downloads\blockpile.one (loop)-HD.mp4
    2015-03-19 21:17 - 2015-03-19 21:17 - 19953231 _____ () C:\Users\LiquidGamma\Downloads\Gematria-HD.mp4
    2015-03-19 21:16 - 2015-03-19 21:16 - 06539444 _____ () C:\Users\LiquidGamma\Downloads\danny tannigle-HD.mp4
    2015-03-19 21:15 - 2015-03-19 21:15 - 11730509 _____ () C:\Users\LiquidGamma\Downloads\base ten-HD.mp4
    2015-03-17 18:56 - 2015-03-17 18:57 - 07141443 _____ () C:\Users\LiquidGamma\Downloads\bilousby-HD.mp4
    2015-03-15 22:00 - 2015-03-15 22:01 - 11718072 _____ () C:\Users\LiquidGamma\Downloads\t-hawk (loop)-HD.mp4
    2015-03-11 19:50 - 2015-02-20 00:41 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
    2015-03-11 19:50 - 2015-02-20 00:40 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
    2015-03-11 19:50 - 2015-02-20 00:40 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
    2015-03-11 19:50 - 2015-02-20 00:40 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
    2015-03-11 19:50 - 2015-02-20 00:13 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
    2015-03-11 19:50 - 2015-02-20 00:13 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
    2015-03-11 19:50 - 2015-02-20 00:13 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
    2015-03-11 19:50 - 2015-02-20 00:12 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
    2015-03-11 19:50 - 2015-02-19 23:29 - 00372224 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
    2015-03-11 19:50 - 2015-02-19 23:09 - 00299008 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
    2015-03-11 19:49 - 2015-02-02 23:34 - 05554104 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
    2015-03-11 19:49 - 2015-02-02 23:34 - 00693176 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
    2015-03-11 19:49 - 2015-02-02 23:34 - 00094656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mountmgr.sys
    2015-03-11 19:49 - 2015-02-02 23:33 - 00616360 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
    2015-03-11 19:49 - 2015-02-02 23:31 - 14632960 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
    2015-03-11 19:49 - 2015-02-02 23:31 - 04121600 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll
    2015-03-11 19:49 - 2015-02-02 23:31 - 01574400 _____ (Microsoft Corporation) C:\Windows\system32\quartz.dll
    2015-03-11 19:49 - 2015-02-02 23:31 - 00782848 _____ (Microsoft Corporation) C:\Windows\system32\wmdrmsdk.dll
    2015-03-11 19:49 - 2015-02-02 23:31 - 00641024 _____ (Microsoft Corporation) C:\Windows\system32\msscp.dll
    2015-03-11 19:49 - 2015-02-02 23:31 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
    2015-03-11 19:49 - 2015-02-02 23:31 - 00500224 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll
    2015-03-11 19:49 - 2015-02-02 23:31 - 00432128 _____ (Microsoft Corporation) C:\Windows\system32\mfplat.dll
    2015-03-11 19:49 - 2015-02-02 23:31 - 00371712 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
    2015-03-11 19:49 - 2015-02-02 23:31 - 00325632 _____ (Microsoft Corporation) C:\Windows\system32\msnetobj.dll
    2015-03-11 19:49 - 2015-02-02 23:31 - 00229376 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
    2015-03-11 19:49 - 2015-02-02 23:31 - 00206848 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll
    2015-03-11 19:49 - 2015-02-02 23:31 - 00188416 _____ (Microsoft Corporation) C:\Windows\system32\pcasvc.dll
    2015-03-11 19:49 - 2015-02-02 23:31 - 00063488 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
    2015-03-11 19:49 - 2015-02-02 23:31 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
    2015-03-11 19:49 - 2015-02-02 23:31 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\pcadm.dll
    2015-03-11 19:49 - 2015-02-02 23:31 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\msmmsp.dll
    2015-03-11 19:49 - 2015-02-02 23:31 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll
    2015-03-11 19:49 - 2015-02-02 23:31 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx
    2015-03-11 19:49 - 2015-02-02 23:31 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll
    2015-03-11 19:49 - 2015-02-02 23:30 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
    2015-03-11 19:49 - 2015-02-02 23:30 - 01480192 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
    2015-03-11 19:49 - 2015-02-02 23:30 - 01202176 _____ (Microsoft Corporation) C:\Windows\system32\drmv2clt.dll
    2015-03-11 19:49 - 2015-02-02 23:30 - 01069056 _____ (Microsoft Corporation) C:\Windows\system32\cryptui.dll
    2015-03-11 19:49 - 2015-02-02 23:30 - 00842240 _____ (Microsoft Corporation) C:\Windows\system32\blackbox.dll
    2015-03-11 19:49 - 2015-02-02 23:30 - 00680960 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
    2015-03-11 19:49 - 2015-02-02 23:30 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\evr.dll
    2015-03-11 19:49 - 2015-02-02 23:30 - 00497664 _____ (Microsoft Corporation) C:\Windows\system32\drmmgrtn.dll
    2015-03-11 19:49 - 2015-02-02 23:30 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll
    2015-03-11 19:49 - 2015-02-02 23:30 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
    2015-03-11 19:49 - 2015-02-02 23:30 - 00296448 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll
    2015-03-11 19:49 - 2015-02-02 23:30 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll
    2015-03-11 19:49 - 2015-02-02 23:30 - 00187904 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
    2015-03-11 19:49 - 2015-02-02 23:30 - 00146944 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
    2015-03-11 19:49 - 2015-02-02 23:30 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
    2015-03-11 19:49 - 2015-02-02 23:30 - 00126464 _____ (Microsoft Corporation) C:\Windows\system32\audiodg.exe
    2015-03-11 19:49 - 2015-02-02 23:30 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
    2015-03-11 19:49 - 2015-02-02 23:30 - 00082432 _____ (Microsoft Corporation) C:\Windows\system32\cryptsp.dll
    2015-03-11 19:49 - 2015-02-02 23:30 - 00058880 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
    2015-03-11 19:49 - 2015-02-02 23:30 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\rrinstaller.exe
    2015-03-11 19:49 - 2015-02-02 23:30 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
    2015-03-11 19:49 - 2015-02-02 23:30 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
    2015-03-11 19:49 - 2015-02-02 23:30 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\mfpmp.exe
    2015-03-11 19:49 - 2015-02-02 23:30 - 00017920 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
    2015-03-11 19:49 - 2015-02-02 23:30 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\pcawrk.exe
    2015-03-11 19:49 - 2015-02-02 23:30 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\pcalua.exe
     
  7. Gavin Vukoder

    Gavin Vukoder TS Rookie Topic Starter Posts: 21

    2015-03-11 19:49 - 2015-02-02 23:29 - 00008704 _____ (Microsoft Corporation) C:\Windows\system32\pcaevts.dll
    2015-03-11 19:49 - 2015-02-02 23:28 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
    2015-03-11 19:49 - 2015-02-02 23:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\mferror.dll
    2015-03-11 19:49 - 2015-02-02 23:19 - 00663552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\PEAuth.sys
    2015-03-11 19:49 - 2015-02-02 23:16 - 03973048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
    2015-03-11 19:49 - 2015-02-02 23:16 - 03917760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
    2015-03-11 19:49 - 2015-02-02 23:12 - 11411968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
    2015-03-11 19:49 - 2015-02-02 23:12 - 03209728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll
    2015-03-11 19:49 - 2015-02-02 23:12 - 01329664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\quartz.dll
    2015-03-11 19:49 - 2015-02-02 23:12 - 01174528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
    2015-03-11 19:49 - 2015-02-02 23:12 - 01005056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptui.dll
    2015-03-11 19:49 - 2015-02-02 23:12 - 00988160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drmv2clt.dll
    2015-03-11 19:49 - 2015-02-02 23:12 - 00744960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\blackbox.dll
    2015-03-11 19:49 - 2015-02-02 23:12 - 00617984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmdrmsdk.dll
    2015-03-11 19:49 - 2015-02-02 23:12 - 00519680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll
    2015-03-11 19:49 - 2015-02-02 23:12 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msscp.dll
    2015-03-11 19:49 - 2015-02-02 23:12 - 00489984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\evr.dll
    2015-03-11 19:49 - 2015-02-02 23:12 - 00442880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AUDIOKSE.dll
    2015-03-11 19:49 - 2015-02-02 23:12 - 00406016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drmmgrtn.dll
    2015-03-11 19:49 - 2015-02-02 23:12 - 00374784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioEng.dll
    2015-03-11 19:49 - 2015-02-02 23:12 - 00354816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfplat.dll
    2015-03-11 19:49 - 2015-02-02 23:12 - 00265216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msnetobj.dll
    2015-03-11 19:49 - 2015-02-02 23:12 - 00195584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioSes.dll
    2015-03-11 19:49 - 2015-02-02 23:12 - 00179200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
    2015-03-11 19:49 - 2015-02-02 23:12 - 00143872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
    2015-03-11 19:49 - 2015-02-02 23:12 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
    2015-03-11 19:49 - 2015-02-02 23:12 - 00103424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfps.dll
    2015-03-11 19:49 - 2015-02-02 23:12 - 00081408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsp.dll
    2015-03-11 19:49 - 2015-02-02 23:12 - 00050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appidapi.dll
    2015-03-11 19:49 - 2015-02-02 23:12 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
    2015-03-11 19:49 - 2015-02-02 23:12 - 00008192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\spwmp.dll
    2015-03-11 19:49 - 2015-02-02 23:12 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdxm.ocx
    2015-03-11 19:49 - 2015-02-02 23:12 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxmasf.dll
    2015-03-11 19:49 - 2015-02-02 23:11 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
    2015-03-11 19:49 - 2015-02-02 23:11 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rrinstaller.exe
    2015-03-11 19:49 - 2015-02-02 23:11 - 00023040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfpmp.exe
    2015-03-11 19:49 - 2015-02-02 23:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mferror.dll
    2015-03-11 19:49 - 2015-02-02 23:08 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
    2015-03-11 19:49 - 2015-02-02 22:32 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
    2015-03-11 19:49 - 2014-10-31 18:24 - 00619056 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
    2015-03-11 19:49 - 2014-06-27 20:21 - 00532176 _____ (Microsoft Corporation) C:\Windows\system32\winresume.exe
    2015-03-11 19:49 - 2014-06-27 20:21 - 00457400 _____ (Microsoft Corporation) C:\Windows\system32\ci.dll
    2015-03-11 19:48 - 2015-02-13 01:26 - 12875264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
    2015-03-11 19:48 - 2015-02-13 01:22 - 14177280 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
    2015-03-11 19:48 - 2015-02-02 23:31 - 00215552 _____ (Microsoft Corporation) C:\Windows\system32\ubpm.dll
    2015-03-11 19:48 - 2015-02-02 23:12 - 00171520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ubpm.dll
    2015-03-11 19:47 - 2015-03-06 01:56 - 00155576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
    2015-03-11 19:47 - 2015-03-06 01:56 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
    2015-03-11 19:47 - 2015-03-06 01:42 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
    2015-03-11 19:47 - 2015-03-06 01:42 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
    2015-03-11 19:47 - 2015-03-06 01:42 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
    2015-03-11 19:47 - 2015-03-06 01:42 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
    2015-03-11 19:47 - 2015-03-06 01:42 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
    2015-03-11 19:47 - 2015-03-06 01:42 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
    2015-03-11 19:47 - 2015-03-06 01:42 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
    2015-03-11 19:47 - 2015-03-06 01:42 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
    2015-03-11 19:47 - 2015-03-06 01:42 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
    2015-03-11 19:47 - 2015-03-06 01:42 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
    2015-03-11 19:47 - 2015-03-06 01:42 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
    2015-03-11 19:47 - 2015-03-06 01:41 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
    2015-03-11 19:47 - 2015-03-06 01:41 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
    2015-03-11 19:47 - 2015-03-06 01:39 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
    2015-03-11 19:47 - 2015-03-06 01:38 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
    2015-03-11 19:47 - 2015-03-06 01:36 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
    2015-03-11 19:47 - 2015-03-06 01:10 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
    2015-03-11 19:47 - 2015-03-06 01:10 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
    2015-03-11 19:47 - 2015-03-06 01:10 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
    2015-03-11 19:47 - 2015-03-06 01:10 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
    2015-03-11 19:47 - 2015-03-06 01:10 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
    2015-03-11 19:47 - 2015-03-06 01:10 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
    2015-03-11 19:47 - 2015-03-06 01:10 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
    2015-03-11 19:47 - 2015-03-06 01:10 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
    2015-03-11 19:47 - 2015-03-06 01:09 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
    2015-03-11 19:47 - 2015-03-06 01:09 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
    2015-03-11 19:47 - 2015-03-06 01:07 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
    2015-03-11 19:47 - 2015-03-06 01:07 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
    2015-03-11 19:47 - 2015-03-06 01:06 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
    2015-03-11 19:47 - 2015-01-30 19:56 - 00459336 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
    2015-03-11 19:47 - 2015-01-16 22:48 - 01067520 _____ (Microsoft Corporation) C:\Windows\system32\msctf.dll
    2015-03-11 19:47 - 2015-01-16 22:30 - 00828928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msctf.dll
    2015-03-11 19:46 - 2015-02-25 23:25 - 03204096 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
    2015-03-11 19:46 - 2015-02-23 23:15 - 00389800 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
    2015-03-11 19:46 - 2015-02-23 22:32 - 00342696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
    2015-03-11 19:46 - 2015-02-20 21:16 - 25021440 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
    2015-03-11 19:46 - 2015-02-20 20:41 - 12827648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
    2015-03-11 19:46 - 2015-02-20 20:27 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
    2015-03-11 19:46 - 2015-02-20 20:27 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
    2015-03-11 19:46 - 2015-02-20 20:25 - 19720192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
    2015-03-11 19:46 - 2015-02-20 19:58 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
    2015-03-11 19:46 - 2015-02-20 19:32 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
    2015-03-11 19:46 - 2015-02-19 23:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
    2015-03-11 19:46 - 2015-02-19 23:05 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
    2015-03-11 19:46 - 2015-02-19 22:50 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
    2015-03-11 19:46 - 2015-02-19 22:49 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
    2015-03-11 19:46 - 2015-02-19 22:49 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
    2015-03-11 19:46 - 2015-02-19 22:48 - 02886144 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
    2015-03-11 19:46 - 2015-02-19 22:47 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
    2015-03-11 19:46 - 2015-02-19 22:41 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
    2015-03-11 19:46 - 2015-02-19 22:40 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
    2015-03-11 19:46 - 2015-02-19 22:36 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
    2015-03-11 19:46 - 2015-02-19 22:35 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
    2015-03-11 19:46 - 2015-02-19 22:35 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
    2015-03-11 19:46 - 2015-02-19 22:34 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
    2015-03-11 19:46 - 2015-02-19 22:32 - 06035456 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
    2015-03-11 19:46 - 2015-02-19 22:26 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
    2015-03-11 19:46 - 2015-02-19 22:22 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
    2015-03-11 19:46 - 2015-02-19 22:22 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
    2015-03-11 19:46 - 2015-02-19 22:13 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
    2015-03-11 19:46 - 2015-02-19 22:09 - 00503296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
    2015-03-11 19:46 - 2015-02-19 22:08 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
    2015-03-11 19:46 - 2015-02-19 22:08 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
    2015-03-11 19:46 - 2015-02-19 22:08 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
    2015-03-11 19:46 - 2015-02-19 22:06 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
    2015-03-11 19:46 - 2015-02-19 22:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
    2015-03-11 19:46 - 2015-02-19 22:03 - 02278400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
    2015-03-11 19:46 - 2015-02-19 22:01 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
    2015-03-11 19:46 - 2015-02-19 22:00 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
    2015-03-11 19:46 - 2015-02-19 21:58 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
    2015-03-11 19:46 - 2015-02-19 21:56 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
    2015-03-11 19:46 - 2015-02-19 21:56 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
    2015-03-11 19:46 - 2015-02-19 21:49 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
    2015-03-11 19:46 - 2015-02-19 21:49 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
    2015-03-11 19:46 - 2015-02-19 21:47 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
    2015-03-11 19:46 - 2015-02-19 21:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
    2015-03-11 19:46 - 2015-02-19 21:43 - 14398976 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
    2015-03-11 19:46 - 2015-02-19 21:41 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
    2015-03-11 19:46 - 2015-02-19 21:37 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
    2015-03-11 19:46 - 2015-02-19 21:30 - 04300288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
    2015-03-11 19:46 - 2015-02-19 21:28 - 02358784 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
    2015-03-11 19:46 - 2015-02-19 21:24 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
    2015-03-11 19:46 - 2015-02-19 21:24 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
    2015-03-11 19:46 - 2015-02-19 21:23 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
    2015-03-11 19:46 - 2015-02-19 21:16 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
    2015-03-11 19:46 - 2015-02-19 21:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
    2015-03-11 19:46 - 2015-02-19 21:01 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
    2015-03-11 19:46 - 2015-02-19 20:57 - 01311232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
    2015-03-11 19:46 - 2015-02-19 20:55 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
    2015-03-11 19:46 - 2015-02-02 23:31 - 01424896 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
    2015-03-11 19:46 - 2015-02-02 23:12 - 01230848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
    2015-03-11 19:44 - 2015-02-03 23:16 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
    2015-03-11 19:44 - 2015-02-03 22:54 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
    2015-03-04 19:47 - 2015-03-04 19:47 - 09175018 _____ () C:\Users\LiquidGamma\Downloads\This video will make you MLG.mp4
    2015-03-03 23:09 - 2015-03-03 23:09 - 06798221 _____ () C:\Users\LiquidGamma\Downloads\VID_34451017_101942.mp4
    2015-03-02 22:04 - 2015-03-02 22:04 - 03372868 _____ () C:\Users\LiquidGamma\Downloads\scream-HD.mp4
    2015-03-01 11:49 - 2015-03-01 11:49 - 11062061 _____ () C:\Users\LiquidGamma\Downloads\hyperwangg (loop)-HD.mp4
    2015-02-28 08:48 - 2015-02-28 08:48 - 06655332 _____ () C:\Users\LiquidGamma\Downloads\sphere.daemon-HD.mp4

    ==================== One Month Modified Files and Folders =======

    (If an entry is included in the fixlist, the file\folder will be moved.)

    2015-03-29 20:56 - 2014-08-27 18:17 - 01236059 _____ () C:\Windows\WindowsUpdate.log
    2015-03-29 20:55 - 2014-08-27 22:19 - 00000000 ____D () C:\Users\LiquidGamma\AppData\Roaming\Skype
    2015-03-29 20:53 - 2014-09-02 11:05 - 00000000 ____D () C:\Users\LiquidGamma\AppData\Local\LogMeIn Hamachi
    2015-03-29 20:53 - 2014-08-27 21:56 - 00000000 ____D () C:\ProgramData\NVIDIA
    2015-03-29 20:53 - 2014-08-27 21:36 - 00000894 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
    2015-03-29 20:53 - 2009-07-14 01:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
    2015-03-29 20:53 - 2009-07-14 00:51 - 00003048 _____ () C:\Windows\setupact.log
    2015-03-29 18:04 - 2009-07-14 00:45 - 00021072 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
    2015-03-29 18:04 - 2009-07-14 00:45 - 00021072 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
    2015-03-29 17:51 - 2014-08-27 21:36 - 00000000 ____D () C:\Users\LiquidGamma\AppData\Local\Apps\2.0
    2015-03-29 17:20 - 2014-12-29 21:25 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
    2015-03-29 17:15 - 2014-08-27 21:36 - 00000898 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
    2015-03-29 17:09 - 2009-07-14 01:13 - 00782470 _____ () C:\Windows\system32\PerfStringBackup.INI
    2015-03-29 08:45 - 2014-12-29 21:24 - 00000000 ____D () C:\Users\LiquidGamma\AppData\Local\Adobe
    2015-03-28 22:29 - 2014-09-11 19:03 - 00000000 ____D () C:\Users\LiquidGamma\AppData\Roaming\Notepad++
    2015-03-28 22:21 - 2014-08-27 22:05 - 00000000 ____D () C:\Program Files (x86)\Steam
    2015-03-28 22:17 - 2015-01-05 11:39 - 00000000 ____D () C:\Program Files\Common Files\Adobe
    2015-03-28 22:16 - 2015-01-05 11:39 - 00000000 ____D () C:\Program Files\Adobe
    2015-03-28 22:16 - 2015-01-05 11:18 - 00000000 ____D () C:\Program Files (x86)\Adobe
    2015-03-28 22:05 - 2009-07-14 00:51 - 00000000 _____ () C:\Windows\setuperr.log
    2015-03-28 22:00 - 2010-11-20 23:47 - 00160374 _____ () C:\Windows\PFRO.log
    2015-03-28 20:32 - 2015-01-14 18:57 - 00000000 ____D () C:\Users\LiquidGamma\Desktop\Upload Queue
    2015-03-27 12:38 - 2015-01-08 19:32 - 00000000 ____D () C:\Users\LiquidGamma\Desktop\random
    2015-03-27 10:05 - 2014-09-02 12:04 - 00000000 ____D () C:\Users\LiquidGamma\AppData\Local\CrashDumps
    2015-03-27 08:09 - 2009-07-14 00:45 - 04959904 _____ () C:\Windows\system32\FNTCACHE.DAT
    2015-03-26 18:25 - 2014-08-27 21:36 - 00058352 _____ () C:\Users\LiquidGamma\AppData\Local\GDIPFONTCACHEV1.DAT
    2015-03-26 18:03 - 2015-01-05 12:49 - 00000000 ____D () C:\ProgramData\regid.1986-12.com.adobe
    2015-03-26 18:03 - 2014-08-29 18:58 - 00000000 ____D () C:\Users\LiquidGamma\AppData\Roaming\Adobe
    2015-03-26 17:29 - 2015-01-05 11:20 - 00000000 ____D () C:\ProgramData\Adobe
    2015-03-25 19:30 - 2014-12-29 21:25 - 00778928 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
    2015-03-25 19:30 - 2014-12-29 21:25 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
    2015-03-25 19:30 - 2014-12-29 21:25 - 00003768 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
    2015-03-25 18:26 - 2014-08-27 18:17 - 00000000 ____D () C:\Users\LiquidGamma
    2015-03-24 21:52 - 2015-01-29 22:55 - 00000000 ____D () C:\Users\LiquidGamma\Desktop\Video Making
    2015-03-23 19:34 - 2009-07-13 23:20 - 00000000 ____D () C:\Windows\Speech
    2015-03-22 18:40 - 2014-10-19 14:11 - 00000000 _____ () C:\Windows\system32\Drivers\lvuvc.hs
    2015-03-21 16:51 - 2009-07-14 01:09 - 00000000 ____D () C:\Windows\System32\Tasks\WPD
    2015-03-19 21:55 - 2015-02-22 21:55 - 00000000 ____D () C:\Users\LiquidGamma\AppData\Local\Game Dev Tycoon - Steam
    2015-03-17 18:50 - 2009-07-13 23:20 - 00000000 ____D () C:\Windows\rescache
    2015-03-17 16:29 - 2009-07-13 23:20 - 00000000 ____D () C:\Windows\SysWOW64\Dism
    2015-03-17 16:29 - 2009-07-13 23:20 - 00000000 ____D () C:\Windows\system32\Dism
    2015-03-12 15:05 - 2014-09-29 20:22 - 00000000 ____D () C:\Windows\system32\MRT
    2015-03-12 15:02 - 2014-09-29 20:22 - 122905848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

    ==================== Files in the root of some directories =======

    2011-05-18 18:59 - 2011-05-18 18:59 - 0269480 _____ () C:\Users\LiquidGamma\AppData\Roaming\BtvStack.dll

    Files to move or delete:
    ====================
    C:\Users\LiquidGamma\AppData\Roaming\Microsoft\Windows\IEUpdate\notepad.exe


    ==================== Bamital & volsnap Check =================

    (There is no automatic fix for files that do not pass verification.)

    C:\Windows\System32\winlogon.exe => File is digitally signed
    C:\Windows\System32\wininit.exe => File is digitally signed
    C:\Windows\SysWOW64\wininit.exe => File is digitally signed
    C:\Windows\explorer.exe => File is digitally signed
    C:\Windows\SysWOW64\explorer.exe => File is digitally signed
    C:\Windows\System32\svchost.exe => File is digitally signed
    C:\Windows\SysWOW64\svchost.exe => File is digitally signed
    C:\Windows\System32\services.exe => File is digitally signed
    C:\Windows\System32\User32.dll => File is digitally signed
    C:\Windows\SysWOW64\User32.dll => File is digitally signed
    C:\Windows\System32\userinit.exe => File is digitally signed
    C:\Windows\SysWOW64\userinit.exe => File is digitally signed
    C:\Windows\System32\rpcss.dll => File is digitally signed
    C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


    LastRegBack: 2015-03-25 00:28

    ==================== End Of Log ============================
     
  8. Gavin Vukoder

    Gavin Vukoder TS Rookie Topic Starter Posts: 21

    Additional scan result of Farbar Recovery Scan Tool (x64) Version: 11-03-2015
    Ran by LiquidGamma at 2015-03-29 20:58:36
    Running from C:\Users\LiquidGamma\Downloads
    Boot Mode: Normal
    ==========================================================


    ==================== Security Center ========================

    (If an entry is included in the fixlist, it will be removed.)

    AS: Windows Defender (Enabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

    ==================== Installed Programs ======================

    (Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

    Adobe After Effects CC 2014 (HKLM-x32\...\{2B22C750-5C3B-4738-B621-BA786AC7A494}) (Version: 13.0.0 - Adobe Systems Incorporated)
    Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 3.1.0.4880 - Adobe Systems Incorporated)
    Adobe Creative Cloud (HKLM-x32\...\Adobe Creative Cloud) (Version: 2.8.1.451 - Adobe Systems Incorporated)
    Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)
    Adobe Flash Player 17 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 17.0.0.134 - Adobe Systems Incorporated)
    Adobe Help Manager (HKLM-x32\...\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 4.0.244 - Adobe Systems Incorporated)
    Apple Application Support (HKLM-x32\...\{78002155-F025-4070-85B3-7C0453561701}) (Version: 3.0.6 - Apple Inc.)
    Apple Mobile Device Support (HKLM\...\{B678797F-DF38-4556-8A31-8B818E261868}) (Version: 8.0.0.23 - Apple Inc.)
    Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
    Belkin USB Wireless Adaptor (HKLM-x32\...\InstallShield_{8524BBAC-E3A7-42F5-9B9A-5AE50A10C500}) (Version: 1.0.0.10 - Belkin)
    Belkin USB Wireless Adaptor (x32 Version: 1.0.0.10 - Belkin) Hidden
    Besiege (HKLM-x32\...\Steam App 346010) (Version: - Spiderling Studios)
    Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
    Camtasia Studio 8 (HKLM-x32\...\{474DFABF-E55B-4905-ABAA-40791A6AC77F}) (Version: 8.4.4.1859 - TechSmith Corporation)
    Counter-Strike: Global Offensive (HKLM-x32\...\Steam App 730) (Version: - Valve)
    D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
    Dizzel (HKLM-x32\...\Steam App 315640) (Version: - NSStudio)
    Fraps (remove only) (HKLM-x32\...\Fraps) (Version: - )
    Game Dev Tycoon (HKLM-x32\...\Steam App 239820) (Version: - Greenheart Games)
    Garry's Mod (HKLM-x32\...\Steam App 4000) (Version: - Facepunch Studios)
    Gear Up (HKLM-x32\...\Steam App 214420) (Version: - Doctor Entertainment AB)
    Goat Simulator (HKLM-x32\...\Steam App 265930) (Version: - Coffee Stain Studios)
    Google Chrome (HKLM-x32\...\Google Chrome) (Version: 41.0.2272.101 - Google Inc.)
    Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
    Google Update Helper (x32 Version: 1.3.26.9 - Google Inc.) Hidden
    Guns and Robots (HKLM-x32\...\Steam App 293540) (Version: - Masthead Studios Ltd)
    iTunes (HKLM\...\{F46AA0F1-E284-4878-A462-5F11B9166C0E}) (Version: 11.4.0.18 - Apple Inc.)
    Java 7 Update 67 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217067FF}) (Version: 7.0.670 - Oracle)
    Lernout & Hauspie TruVoice American English TTS Engine (HKLM-x32\...\tv_enua) (Version: - )
    Loadout (HKLM-x32\...\Steam App 208090) (Version: - Edge of Reality)
    LogMeIn Hamachi (HKLM-x32\...\LogMeIn Hamachi) (Version: 2.2.0.319 - LogMeIn, Inc.)
    LogMeIn Hamachi (x32 Version: 2.2.0.319 - LogMeIn, Inc.) Hidden
    Max Gentlemen (HKLM-x32\...\Steam App 257710) (Version: - The Men Who Wear Many Hats)
    Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
    Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
    Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
    Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
    Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
    Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
    Movie Maker (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
    Notepad++ (HKLM-x32\...\Notepad++) (Version: 6.6.9 - Notepad++ Team)
    NVIDIA 3D Vision Controller Driver 344.11 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 344.11 - NVIDIA Corporation)
    NVIDIA 3D Vision Driver 344.11 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 344.11 - NVIDIA Corporation)
    NVIDIA GeForce Experience 2.1.2 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.1.2 - NVIDIA Corporation)
    NVIDIA Graphics Driver 344.11 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 344.11 - NVIDIA Corporation)
    NVIDIA HD Audio Driver 1.3.32.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.32.1 - NVIDIA Corporation)
    NVIDIA PhysX (HKLM-x32\...\{8B922CF8-8A6C-41CE-A858-F1755D7F5D29}) (Version: 9.12.1031 - NVIDIA Corporation)
    paint.net (HKLM\...\{19BD2C33-16A8-4ED1-B9EA-D9E35B21EC42}) (Version: 4.0.5 - dotPDN LLC)
    PAYDAY 2 (HKLM-x32\...\Steam App 218620) (Version: - OVERKILL - a Starbreeze Studio.)
    PlanetSide 2 (HKLM-x32\...\Steam App 218230) (Version: - Sony Online Entertainment)
    PlanetSide 2 (HKU\S-1-5-21-2271226647-762932056-463426160-1000\...\SOE-PlanetSide 2) (Version: - Sony Online Entertainment)
    QuickTime 7 (HKLM-x32\...\{3D2CBC2C-65D4-4463-87AB-BB2C859C1F3E}) (Version: 7.76.80.95 - Apple Inc.)
    Robocraft (HKLM-x32\...\Steam App 301520) (Version: - Freejam)
    Rust (HKLM-x32\...\Steam App 252490) (Version: - Facepunch Studios)
    SHIELD Streaming (Version: 3.1.200 - NVIDIA Corporation) Hidden
    SHIELD Wireless Controller Driver (Version: 16.13.42 - NVIDIA Corporation) Hidden
    Skype™ 7.0 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.0.102 - Skype Technologies S.A.)
    Speakonia (HKLM-x32\...\Speakonia_is1) (Version: 1.0.3.5 - CFS-Technologies)
    Steam (HKLM-x32\...\Steam) (Version: - Valve Corporation)
    Team Fortress 2 (HKLM-x32\...\Steam App 440) (Version: - Valve)
    The Binding of Isaac (HKLM-x32\...\Steam App 113200) (Version: - Edmund McMillen and Florian Himsl)
    Toribash (HKLM-x32\...\Steam App 248570) (Version: - Nabi Studios)
    Transformice (HKLM-x32\...\Steam App 335240) (Version: - Atelier 801)
    Unity Web Player (HKU\S-1-5-21-2271226647-762932056-463426160-1000\...\UnityWebPlayer) (Version: 4.5.5f1 - Unity Technologies ApS)
    VideoPad Video Editor (HKLM-x32\...\VideoPad) (Version: 3.74 - NCH Software)
    WavePad Sound Editor (HKLM-x32\...\WavePad) (Version: 6.02 - NCH Software)
    WhiteCap (HKLM-x32\...\WhiteCap) (Version: 6.3.1 - SoundSpectrum)
    Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)
    WinRAR 5.11 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.11.0 - win.rar GmbH)

    ==================== Custom CLSID (selected items): ==========================

    (If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

    CustomCLSID: HKU\S-1-5-21-2271226647-762932056-463426160-1000_Classes\CLSID\{8A791F0C-C63C-4EC5-B97F-FBCE74EDBC54}\InprocServer32 -> C:\Program Files\TextPad 7\System\shellext64.dll No File

    ==================== Restore Points =========================


    ==================== Hosts content: ==========================

    (If needed Hosts: directive could be included in the fixlist to reset Hosts.)

    2009-07-13 22:34 - 2015-03-29 20:54 - 00001518 _RASH C:\Windows\system32\Drivers\etc\hosts
    127.0.0.1 localhost
    136.243.254.253 www.google-analytics.com.
    136.243.254.253 google-analytics.com.
    136.243.254.253 connect.facebook.net.
    195.162.69.252 www.google-analytics.com.
    195.162.69.252 google-analytics.com.
    195.162.69.252 connect.facebook.net.
    89.163.213.177 www.google-analytics.com.
    89.163.213.177 google-analytics.com.
    89.163.213.177 connect.facebook.net.


    ==================== Scheduled Tasks (whitelisted) =============

    (If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

    Task: {24CEDCF0-5C80-41C7-970B-35F20B0ED900} - System32\Tasks\{1553A040-66A0-44CF-8DAC-995F0734F8BD} => C:\Users\LiquidGamma\AppData\Roaming\uTorrent\uTorrent.exe
    Task: {2BEDCE9A-AAA1-47D2-BB5A-235EBD1B0CB1} - System32\Tasks\ProPCCleaner_Start => C:\Program Files (x86)\Pro PC Cleaner\ProPCCleaner.exe <==== ATTENTION
    Task: {805536B4-7C76-4983-921F-12FF2E03BBE1} - System32\Tasks\ProPCCleaner_Popup => C:\Program Files (x86)\Pro PC Cleaner\Splash.exe <==== ATTENTION
    Task: {843FA045-998D-4356-A34D-E1265B6C3D21} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
    Task: {8C1DC555-171D-4129-98D7-EDEC53575F7E} - System32\Tasks\notepad => C:\Users\LiquidGamma\AppData\Roaming\Microsoft\Windows\IEUpdate\notepad.exe [2014-03-04] (©Wyebugur)
    Task: {9D4AC6B4-1D48-440D-B9E2-1BA4D2CF93F6} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-08-27] (Google Inc.)
    Task: {B80E38C7-277F-4FAA-B387-0BC80CAB9E6E} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-03-25] (Adobe Systems Incorporated)
    Task: {DCEFE66F-2E90-4252-A4FC-C773D0A8F45B} - System32\Tasks\{49924DAD-81D9-42C9-924F-5292BBEB670A} => C:\Users\LiquidGamma\AppData\Roaming\uTorrent\uTorrent.exe
    Task: {E7A73D72-FD79-49B6-B946-09FDD9F7B202} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-08-27] (Google Inc.)
    Task: {F6A28C13-B01C-4A6B-B5A1-54DACFE6346E} - System32\Tasks\AdobeAAMUpdater-1.0-LiquidGamma-PC-LiquidGamma => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2014-10-14] (Adobe Systems Incorporated)
    Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
    Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

    ==================== Loaded Modules (whitelisted) ==============

    2014-08-27 21:56 - 2014-09-13 17:53 - 00116880 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
    2014-09-26 15:41 - 2014-09-26 15:41 - 01021088 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll
    2015-03-25 18:43 - 2015-03-25 18:43 - 04247552 _____ () C:\ProgramData\Microsoft\Security\Client\SecurityProvider.dll
    2015-03-25 18:43 - 2015-03-25 18:43 - 02934272 _____ () C:\ProgramData\Microsoft\Security\Client\SecurityHelper.dll
    2014-09-26 15:40 - 2014-09-26 15:40 - 06237856 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync.exe
    2014-07-31 12:16 - 2014-07-31 12:16 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
    2014-07-31 12:16 - 2014-07-31 12:16 - 01044776 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
    2015-03-27 19:18 - 2015-03-27 19:18 - 01272320 _____ () C:\Users\LiquidGamma\AppData\Local\Ilsoft\WhipFilter.dll
    2014-09-28 22:01 - 2014-09-28 22:01 - 36730032 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CEF\libcef.dll
    2015-03-21 17:23 - 2015-03-14 06:12 - 01174856 _____ () C:\Program Files (x86)\Google\Chrome\Application\41.0.2272.101\libglesv2.dll
    2015-03-21 17:23 - 2015-03-14 06:12 - 00080200 _____ () C:\Program Files (x86)\Google\Chrome\Application\41.0.2272.101\libegl.dll
    2015-03-21 17:23 - 2015-03-14 06:12 - 09278792 _____ () C:\Program Files (x86)\Google\Chrome\Application\41.0.2272.101\pdf.dll
    2015-03-21 17:23 - 2015-03-14 06:12 - 14974280 _____ () C:\Program Files (x86)\Google\Chrome\Application\41.0.2272.101\PepperFlash\pepflashplayer.dll
    2011-05-18 18:59 - 2011-05-18 18:59 - 00269480 _____ () C:\Users\LiquidGamma\AppData\Roaming\BtvStack.dll
    2015-03-25 19:08 - 2015-03-25 19:08 - 38714368 _____ () C:\Users\LiquidGamma\AppData\Roaming\Local Store\libcef.dll
    2015-03-25 19:08 - 2015-03-25 19:08 - 00873472 _____ () C:\Users\LiquidGamma\AppData\Roaming\Local Store\ffmpegsumo.dll
    2015-03-25 19:08 - 2015-03-25 19:08 - 16858288 _____ () C:\Users\LiquidGamma\AppData\Roaming\Local Store\NPSWF32.dll

    ==================== Alternate Data Streams (whitelisted) =========

    (If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


    ==================== Safe Mode (whitelisted) ===================

    (If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Hamachi2Svc => ""="Service"

    ==================== EXE Association (whitelisted) ===============

    (If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


    ==================== Other Areas ============================

    (Currently there is no automatic fix for this section.)

    HKU\S-1-5-21-2271226647-762932056-463426160-1000\Control Panel\Desktop\\Wallpaper ->
    DNS Servers: 8.8.8.8

    ==================== MSCONFIG/TASK MANAGER disabled items ==

    (Currently there is no automatic fix for this section.)


    ==================== Accounts: =============================

    Administrator (S-1-5-21-2271226647-762932056-463426160-500 - Administrator - Disabled)
    Guest (S-1-5-21-2271226647-762932056-463426160-501 - Limited - Disabled)
    LiquidGamma (S-1-5-21-2271226647-762932056-463426160-1000 - Administrator - Enabled) => C:\Users\LiquidGamma

    ==================== Faulty Device Manager Devices =============

    Name: SM Bus Controller
    Description: SM Bus Controller
    Class Guid:
    Manufacturer:
    Service:
    Problem: : The drivers for this device are not installed. (Code 28)
    Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

    Name: Ethernet Controller
    Description: Ethernet Controller
    Class Guid:
    Manufacturer:
    Service:
    Problem: : The drivers for this device are not installed. (Code 28)
    Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

    Name: Universal Serial Bus (USB) Controller
    Description: Universal Serial Bus (USB) Controller
    Class Guid:
    Manufacturer:
    Service:
    Problem: : The drivers for this device are not installed. (Code 28)
    Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.


    ==================== Event log errors: =========================

    Application errors:
    ==================
    Error: (03/29/2015 08:55:07 PM) (Source: WinMgmt) (EventID: 10) (User: )
    Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

    Error: (03/29/2015 05:05:36 PM) (Source: WinMgmt) (EventID: 10) (User: )
    Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

    Error: (03/29/2015 08:37:02 AM) (Source: WinMgmt) (EventID: 10) (User: )
    Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

    Error: (03/29/2015 08:30:10 AM) (Source: WinMgmt) (EventID: 10) (User: )
    Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

    Error: (03/28/2015 10:59:09 PM) (Source: WinMgmt) (EventID: 10) (User: )
    Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

    Error: (03/28/2015 10:19:00 PM) (Source: Application Hang) (EventID: 1002) (User: )
    Description: The program chrome.exe version 41.0.2272.101 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

    Process ID: 23fc

    Start Time: 01d069c6ac20d283

    Termination Time: 12

    Application Path: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

    Report Id: f2950586-d5b9-11e4-9c5f-c260e467179f

    Error: (03/28/2015 10:02:03 PM) (Source: WinMgmt) (EventID: 10) (User: )
    Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

    Error: (03/28/2015 04:03:34 PM) (Source: WinMgmt) (EventID: 10) (User: )
    Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

    Error: (03/28/2015 02:58:15 PM) (Source: WinMgmt) (EventID: 10) (User: )
    Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

    Error: (03/27/2015 00:41:40 PM) (Source: WinMgmt) (EventID: 10) (User: )
    Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


    System errors:
    =============
    Error: (03/29/2015 05:25:40 PM) (Source: Schannel) (EventID: 4120) (User: NT AUTHORITY)
    Description: The following fatal alert was generated: 40. The internal error state is 252.

    Error: (03/29/2015 09:00:48 AM) (Source: nvlddmkm) (EventID: 13) (User: )
    Description: \Device\Video7Graphics Exception: ESR 0x405840=0x82040000

    Error: (03/29/2015 09:00:48 AM) (Source: nvlddmkm) (EventID: 13) (User: )
    Description: \Device\Video7Graphics Exception: Shader Program Header 18 Error

    Error: (03/29/2015 09:00:48 AM) (Source: nvlddmkm) (EventID: 13) (User: )
    Description: \Device\Video7Graphics Exception: ESR 0x405840=0x82040000

    Error: (03/29/2015 09:00:48 AM) (Source: nvlddmkm) (EventID: 13) (User: )
    Description: \Device\Video7Graphics Exception: Shader Program Header 18 Error

    Error: (03/29/2015 08:59:17 AM) (Source: Schannel) (EventID: 4119) (User: NT AUTHORITY)
    Description: The following fatal alert was received: 40.

    Error: (03/29/2015 08:28:20 AM) (Source: EventLog) (EventID: 6008) (User: )
    Description: The previous system shutdown at 11:18:16 PM on ‎3/‎28/‎2015 was unexpected.

    Error: (03/28/2015 10:36:08 PM) (Source: nvlddmkm) (EventID: 13) (User: )
    Description: \Device\Video7Graphics Exception: ESR 0x405840=0x82040000

    Error: (03/28/2015 10:36:08 PM) (Source: nvlddmkm) (EventID: 13) (User: )
    Description: \Device\Video7Graphics Exception: Shader Program Header 18 Error

    Error: (03/28/2015 10:17:17 PM) (Source: Schannel) (EventID: 4120) (User: NT AUTHORITY)
    Description: The following fatal alert was generated: 40. The internal error state is 252.


    Microsoft Office Sessions:
    =========================
    Error: (03/29/2015 08:55:07 PM) (Source: WinMgmt) (EventID: 10) (User: )
    Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

    Error: (03/29/2015 05:05:36 PM) (Source: WinMgmt) (EventID: 10) (User: )
    Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

    Error: (03/29/2015 08:37:02 AM) (Source: WinMgmt) (EventID: 10) (User: )
    Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

    Error: (03/29/2015 08:30:10 AM) (Source: WinMgmt) (EventID: 10) (User: )
    Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

    Error: (03/28/2015 10:59:09 PM) (Source: WinMgmt) (EventID: 10) (User: )
    Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

    Error: (03/28/2015 10:19:00 PM) (Source: Application Hang) (EventID: 1002) (User: )
    Description: chrome.exe41.0.2272.10123fc01d069c6ac20d28312C:\Program Files (x86)\Google\Chrome\Application\chrome.exef2950586-d5b9-11e4-9c5f-c260e467179f

    Error: (03/28/2015 10:02:03 PM) (Source: WinMgmt) (EventID: 10) (User: )
    Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

    Error: (03/28/2015 04:03:34 PM) (Source: WinMgmt) (EventID: 10) (User: )
    Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

    Error: (03/28/2015 02:58:15 PM) (Source: WinMgmt) (EventID: 10) (User: )
    Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

    Error: (03/27/2015 00:41:40 PM) (Source: WinMgmt) (EventID: 10) (User: )
    Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


    ==================== Memory info ===========================

    Processor: Intel(R) Core(TM) i5-4690K CPU @ 3.50GHz
    Percentage of memory in use: 54%
    Total physical RAM: 8141.32 MB
    Available physical RAM: 3707.91 MB
    Total Pagefile: 30754.51 MB
    Available Pagefile: 25430.29 MB
    Total Virtual: 8192 MB
    Available Virtual: 8191.83 MB

    ==================== Drives ================================

    Drive c: () (Fixed) (Total:1862.92 GB) (Free:1522.43 GB) NTFS

    ==================== MBR & Partition Table ==================

    ========================================================
    Disk: 0 (MBR Code: Windows 7 or 8) (Size: 1863 GB) (Disk ID: 05AD3597)
    Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
    Partition 2: (Not Active) - (Size=1862.9 GB) - (Type=07 NTFS)

    ==================== End Of Log ============================
     
  9. Broni

    Broni Malware Annihilator Posts: 52,892   +344

    Download attached fixlist.txt file and save it to the Desktop.
    NOTE. It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work.

    NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

    Run FRST(FRST64) and press the Fix button just once and wait.
    The tool will make a log on the Desktop (Fixlog.txt). Please post it to your reply.
     

    Attached Files:

  10. Gavin Vukoder

    Gavin Vukoder TS Rookie Topic Starter Posts: 21

    Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 11-03-2015
    Ran by LiquidGamma at 2015-03-30 13:28:51 Run:1
    Running from C:\Users\LiquidGamma\Desktop
    Loaded Profiles: LiquidGamma (Available profiles: LiquidGamma)
    Boot Mode: Normal
    ==============================================

    Content of fixlist:
    *****************
    HKLM\Software\Policies\Microsoft\Windows NT\SystemRestore: [DisableSR/DisableConfig] <===== ATTENTION
    (WiseAndPath) C:\Users\LiquidGamma\AppData\Local\Ilsoft\tmp2786.exe
    C:\Users\LiquidGamma\AppData\Local\Ilsoft\tmp2786.exe
    (©Wyebugur) C:\Users\LiquidGamma\AppData\Roaming\Microsoft\Windows\IEUpdate\notepad.exe
    (©Wyebugur) C:\Users\LiquidGamma\AppData\Roaming\Microsoft\Windows\IEUpdate\notepad.exe
    C:\Users\LiquidGamma\AppData\Roaming\Microsoft\Windows\IEUpdate\notepad.exe
    (©Wyebugur) C:\Users\LiquidGamma\AppData\Roaming\Microsoft\Windows\IEUpdate\notepad.exe
    (©Wyebugur) C:\Users\LiquidGamma\AppData\Roaming\Microsoft\Windows\IEUpdate\notepad.exe
    (©Wyebugur) C:\Users\LiquidGamma\AppData\Roaming\Microsoft\Windows\IEUpdate\notepad.exe
    (©Wyebugur) C:\Users\LiquidGamma\AppData\Roaming\Microsoft\Windows\IEUpdate\notepad.exe
    HKLM-x32\...\Run: [tagu] => C:\Users\LiquidGamma\AppData\Local\tagu\tagu.exe [350720 2015-03-26] ()
    C:\Users\LiquidGamma\AppData\Local\tagu\tagu.exe
    HKU\S-1-5-21-2271226647-762932056-463426160-1000\...\Run: [BluetoothS] => rundll32.exe "%appdata%\BtvStack.dll",BTHF_Register
    %appdata%\BtvStack.dll
    HKU\S-1-5-21-2271226647-762932056-463426160-1000\...\Run: [notepad] => C:\Users\LiquidGamma\AppData\Roaming\Microsoft\Windows\IEUpdate\notepad.exe [290304 2014-03-04] (©Wyebugur)
    HKU\S-1-5-21-2271226647-762932056-463426160-1000\...\Run: [AdobeBridge] => [X]
    HKU\S-1-5-21-2271226647-762932056-463426160-1000\...\Run: [Ilsoft] => C:\Users\LiquidGamma\AppData\Local\Ilsoft\tmp2786.exe [159744 2015-03-27] (WiseAndPath)
    HKU\S-1-5-21-2271226647-762932056-463426160-1000\...\Run: [Imqsoft] => C:\Windows\SysWOW64\regsvr32.exe C:\Users\LiquidGamma\AppData\Local\Ilsoft\WhipFilter.dll
    C:\Users\LiquidGamma\AppData\Local\Ilsoft\WhipFilter.dll
    HKU\S-1-5-21-2271226647-762932056-463426160-1000\...\RunOnce: [notepad] => C:\Users\LiquidGamma\AppData\Roaming\Microsoft\Windows\IEUpdate\notepad.exe [290304 2014-03-04] (©Wyebugur)
    HKU\S-1-5-21-2271226647-762932056-463426160-1000\...\Policies\Explorer: [Run] "C:\Users\LiquidGamma\AppData\Roaming\Microsoft\Windows\IEUpdate\notepad.exe"
    HKU\S-1-5-21-2271226647-762932056-463426160-1000\...\MountPoints2: {8ea73233-2deb-11e4-abe6-806e6f6e6963} - D:\setup.exe
    HKU\S-1-5-21-2271226647-762932056-463426160-1000\...\Command Processor: "C:\Users\LiquidGamma\AppData\Roaming\Microsoft\Windows\IEUpdate\notepad.exe" <===== ATTENTION!
    HKU\S-1-5-21-2271226647-762932056-463426160-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Users\LiquidGamma\AppData\Roaming\Microsoft\Windows\IEUpdate\notepad.exe [290304 2014-03-04] (©Wyebugur)
    Startup: C:\Users\LiquidGamma\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\notepad.lnk
    ShortcutTarget: notepad.lnk -> C:\Users\LiquidGamma\AppData\Roaming\Microsoft\Windows\IEUpdate\notepad.exe (©Wyebugur)
    C:\Users\LiquidGamma\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\notepad.lnk
    Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
    Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
    CHR HomePage: Default -> hxxp://start.funmoods.com/?f=1&a=aln&chnl=aln&cd=2XzutAtN2Y1L1QzutDzzzzyCtA0Bzz0FyC0F0BtDtDyEtBzztN0D0TzutBtDtCtBtDyCtBtD&cr=897213179
    2015-03-25 19:29 - 2015-03-29 20:57 - 00003600 _____ () C:\Windows\System32\Tasks\notepad
    2011-05-18 18:59 - 2011-05-18 18:59 - 0269480 _____ () C:\Users\LiquidGamma\AppData\Roaming\BtvStack.dll
    C:\Users\LiquidGamma\AppData\Roaming\Microsoft\Windows\IEUpdate\notepad.exe
    Hosts:
    Task: {2BEDCE9A-AAA1-47D2-BB5A-235EBD1B0CB1} - System32\Tasks\ProPCCleaner_Start => C:\Program Files (x86)\Pro PC Cleaner\ProPCCleaner.exe <==== ATTENTION
    Task: {805536B4-7C76-4983-921F-12FF2E03BBE1} - System32\Tasks\ProPCCleaner_Popup => C:\Program Files (x86)\Pro PC Cleaner\Splash.exe <==== ATTENTION
    C:\Program Files (x86)\Pro PC Cleaner
    Task: {8C1DC555-171D-4129-98D7-EDEC53575F7E} - System32\Tasks\notepad => C:\Users\LiquidGamma\AppData\Roaming\Microsoft\Windows\IEUpdate\notepad.exe [2014-03-04] (©Wyebugur)



    *****************

    "HKLM\Software\Policies\Microsoft\Windows NT\SystemRestore" => Key deleted successfully.
    [2184] C:\Users\LiquidGamma\AppData\Local\Ilsoft\tmp2786.exe => Process closed successfully.
    C:\Users\LiquidGamma\AppData\Local\Ilsoft\tmp2786.exe => Moved successfully.
    [5644] C:\Users\LiquidGamma\AppData\Roaming\Microsoft\Windows\IEUpdate\notepad.exe => Process closed successfully.
    [7504] C:\Users\LiquidGamma\AppData\Roaming\Microsoft\Windows\IEUpdate\notepad.exe => Process closed successfully.
    C:\Users\LiquidGamma\AppData\Roaming\Microsoft\Windows\IEUpdate\notepad.exe => Moved successfully.
    C:\Users\LiquidGamma\AppData\Roaming\Microsoft\Windows\IEUpdate\notepad.exe => No running process found
    C:\Users\LiquidGamma\AppData\Roaming\Microsoft\Windows\IEUpdate\notepad.exe => No running process found
    C:\Users\LiquidGamma\AppData\Roaming\Microsoft\Windows\IEUpdate\notepad.exe => No running process found
    C:\Users\LiquidGamma\AppData\Roaming\Microsoft\Windows\IEUpdate\notepad.exe => No running process found
    HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\tagu => value deleted successfully.
    Could not move "C:\Users\LiquidGamma\AppData\Local\tagu\tagu.exe" => Scheduled to move on reboot.
    HKU\S-1-5-21-2271226647-762932056-463426160-1000\Software\Microsoft\Windows\CurrentVersion\Run\\BluetoothS => value deleted successfully.
    %appdata%\BtvStack.dll => Error: No automatic fix found for this entry.
    HKU\S-1-5-21-2271226647-762932056-463426160-1000\Software\Microsoft\Windows\CurrentVersion\Run\\notepad => value deleted successfully.
    HKU\S-1-5-21-2271226647-762932056-463426160-1000\Software\Microsoft\Windows\CurrentVersion\Run\\AdobeBridge => value deleted successfully.
    HKU\S-1-5-21-2271226647-762932056-463426160-1000\Software\Microsoft\Windows\CurrentVersion\Run\\Ilsoft => value deleted successfully.
    HKU\S-1-5-21-2271226647-762932056-463426160-1000\Software\Microsoft\Windows\CurrentVersion\Run\\Imqsoft => value deleted successfully.
    C:\Users\LiquidGamma\AppData\Local\Ilsoft\WhipFilter.dll => Moved successfully.
    HKU\S-1-5-21-2271226647-762932056-463426160-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\\notepad => value deleted successfully.
    HKU\S-1-5-21-2271226647-762932056-463426160-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\\Run => value deleted successfully.
    "HKU\S-1-5-21-2271226647-762932056-463426160-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8ea73233-2deb-11e4-abe6-806e6f6e6963}" => Key deleted successfully.
    HKCR\CLSID\{8ea73233-2deb-11e4-abe6-806e6f6e6963} => Key not found.
    HKU\S-1-5-21-2271226647-762932056-463426160-1000\Software\Microsoft\Command Processor\\AutoRun => value deleted successfully.
    HKU\S-1-5-21-2271226647-762932056-463426160-1000\Control Panel\Desktop\\SCRNSAVE.EXE => value deleted successfully.
    C:\Users\LiquidGamma\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\notepad.lnk => Moved successfully.
    C:\Users\LiquidGamma\AppData\Roaming\Microsoft\Windows\IEUpdate\notepad.exe not found.
    "C:\Users\LiquidGamma\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\notepad.lnk" => File/Directory not found.

    ========= reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f =========

    The operation completed successfully.



    ========= End of Reg: =========


    ========= reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f =========

    The operation completed successfully.



    ========= End of Reg: =========

    Chrome HomePage deleted successfully.
    C:\Windows\System32\Tasks\notepad => Moved successfully.
    C:\Users\LiquidGamma\AppData\Roaming\BtvStack.dll => Moved successfully.
    "C:\Users\LiquidGamma\AppData\Roaming\Microsoft\Windows\IEUpdate\notepad.exe" => File/Directory not found.
    C:\Windows\System32\Drivers\etc\hosts => Moved successfully.
    Hosts was reset successfully.
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{2BEDCE9A-AAA1-47D2-BB5A-235EBD1B0CB1}" => Key deleted successfully.
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{2BEDCE9A-AAA1-47D2-BB5A-235EBD1B0CB1}" => Key deleted successfully.
    C:\Windows\System32\Tasks\ProPCCleaner_Start => Moved successfully.
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\ProPCCleaner_Start" => Key deleted successfully.
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{805536B4-7C76-4983-921F-12FF2E03BBE1}" => Key deleted successfully.
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{805536B4-7C76-4983-921F-12FF2E03BBE1}" => Key deleted successfully.
    C:\Windows\System32\Tasks\ProPCCleaner_Popup => Moved successfully.
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\ProPCCleaner_Popup" => Key deleted successfully.
    "C:\Program Files (x86)\Pro PC Cleaner" => File/Directory not found.
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{8C1DC555-171D-4129-98D7-EDEC53575F7E}" => Key deleted successfully.
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{8C1DC555-171D-4129-98D7-EDEC53575F7E}" => Key deleted successfully.
    C:\Windows\System32\Tasks\notepad not found.
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\notepad" => Key deleted successfully.

    => Result of Scheduled Files to move (Boot Mode: Normal) (Date&Time: 2015-03-30 13:30:03)<=

    C:\Users\LiquidGamma\AppData\Local\tagu\tagu.exe => Is moved successfully.

    ==== End of Fixlog 13:30:03 ====
     
  11. Broni

    Broni Malware Annihilator Posts: 52,892   +344

    Good :)

    [​IMG] Download RogueKiller from one of the following links and save it to your Desktop:

    Link 1
    Link 2

    • Close all the running programs
    • Windows Vista/7/8 users: right click on RogueKiller.exe, click Run as Administrator
    • Otherwise just double-click on RogueKiller.exe
    • Pre-scan will start. Let it finish.
    • Click on SCAN button.
    • Wait until the Status box shows Scan Finished
    • Click on Delete.
    • Wait until the Status box shows Deleting Finished.
    • Click on Report and copy/paste the content of the Notepad into your next reply.
    • RKreport.txt could also be found on your desktop.
    • If more than one log is produced post all logs.
    • If RogueKiller has been blocked, do not hesitate to try a few times more. If really won't run, rename it to winlogon.exe (or winlogon.com) and try again

    [​IMG] Please download Malwarebytes Anti-Malware (MBAM) to your desktop.
    NOTE. If you already have MBAM 2.0 installed scroll down.

    • Double-click mbam-setup-2.0.0.1000.exe and follow the prompts to install the program.
    • At the end, be sure a checkmark is placed next to the following:
      • Launch Malwarebytes Anti-Malware
      • A 14 day trial of the Premium features is pre-selected. You may deselect this if you wish, and it will not diminish the scanning and removal capabilities of the program.
    • Click Finish.
    • On the Dashboard, click the 'Update Now >>' link
    • After the update completes, click the 'Scan Now >>' button.
    • Or, on the Dashboard, click the Scan Now >> button.
    • If an update is available, click the Update Now button.
    • A Threat Scan will begin.
    • When the scan is complete, if there have been detections, click Apply Actions to allow MBAM to clean what was detected.
    • In most cases, a restart will be required.
    • Wait for the prompt to restart the computer to appear, then click on Yes.


    If you already have MBAM 2.0 installed:

    • On the Dashboard, click the 'Update Now >>' link
    • After the update completes, click the 'Scan Now >>' button.
    • Or, on the Dashboard, click the Scan Now >> button.
    • If an update is available, click the Update Now button.
    • A Threat Scan will begin.
    • When the scan is complete, if there have been detections, click Apply Actions to allow MBAM to clean what was detected.
    • In most cases, a restart will be required.
    • Wait for the prompt to restart the computer to appear, then click on Yes.

    How to get logs:
    (Export log to save as txt)


    • After the restart once you are back at your desktop, open MBAM once more.
    • Click on the History tab > Application Logs.
    • Double click on the Scan Log which shows the Date and time of the scan just performed.
    • Click 'Export'.
    • Click 'Text file (*.txt)'
    • In the Save File dialog box which appears, click on Desktop.
    • In the File name: box type a name for your scan log.
    • A message box named 'File Saved' should appear stating "Your file has been successfully exported".
    • Click Ok
    • Attach that saved log to your next reply.


    (Copy to clipboard for pasting into forum replies or tickets)

    • After the restart once you are back at your desktop, open MBAM once more.
    • Click on the History tab > Application Logs.
    • Double click on the Scan Log which shows the Date and time of the scan just performed.
    • Click 'Copy to Clipboard'
    • Paste the contents of the clipboard into your reply.

    [​IMG] Please download AdwCleaner by Xplode onto your desktop.
    • Close all open programs and internet browsers.
    • Double click on adwcleaner.exe to run the tool.
    • Click on Scan button.
    • When the scan has finished click on Clean button.
    • Your computer will be rebooted automatically. A text file will open after the restart.
    • Please post the contents of that logfile with your next reply.
    • You can find the logfile at C:\AdwCleaner[S1].txt as well.

    [​IMG] Please download Junkware Removal Tool to your desktop.
    • Shut down your protection software now to avoid potential conflicts.
    • Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
    • The tool will open and start scanning your system.
    • Please be patient as this can take a while to complete depending on your system's specifications.
    • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
    • Post the contents of JRT.txt into your next message.
     
  12. Gavin Vukoder

    Gavin Vukoder TS Rookie Topic Starter Posts: 21

    RogueKiller V10.5.8.0 [Mar 30 2015] by Adlice Software
    mail : http://www.adlice.com/contact/
    Feedback : http://forum.adlice.com
    Website : http://www.adlice.com/softwares/roguekiller/
    Blog : http://www.adlice.com

    Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
    Started in : Normal mode
    User : LiquidGamma [Administrator]
    Started from : C:\Users\LiquidGamma\Desktop\RogueKiller.exe
    Mode : Delete -- Date : 03/30/2015 14:59:14

    ¤¤¤ Processes : 0 ¤¤¤

    ¤¤¤ Registry : 13 ¤¤¤
    [Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\0WinSecurityProvider | (default) : {F76FA5C2-3B6A-451E-8CA5-34C8D0AE0637} -> Deleted
    [Suspicious.Path] (X64) HKEY_USERS\S-1-5-21-2271226647-762932056-463426160-1000\Software\Microsoft\Windows\CurrentVersion\Run | BluetoothS : rundll32.exe "%appdata%\BtvStack.dll",BTHF_Register [7][x] -> Deleted
    [Suspicious.Path] (X64) HKEY_USERS\S-1-5-21-2271226647-762932056-463426160-1000\Software\Microsoft\Windows\CurrentVersion\Run | tagu : "C:\Users\LiquidGamma\AppData\Local\tagu\tagu.exe" [x] -> Deleted
    [Suspicious.Path] (X86) HKEY_USERS\S-1-5-21-2271226647-762932056-463426160-1000\Software\Microsoft\Windows\CurrentVersion\Run | BluetoothS : rundll32.exe "%appdata%\BtvStack.dll",BTHF_Register -> ERROR [2]
    [Suspicious.Path] (X86) HKEY_USERS\S-1-5-21-2271226647-762932056-463426160-1000\Software\Microsoft\Windows\CurrentVersion\Run | tagu : "C:\Users\LiquidGamma\AppData\Local\tagu\tagu.exe" -> ERROR [2]
    [Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run | tagu : "C:\Users\LiquidGamma\AppData\Local\tagu\tagu.exe" [x] -> Deleted
    [Suspicious.Path] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run | tagu : "C:\Users\LiquidGamma\AppData\Local\tagu\tagu.exe" -> ERROR [2]
    [PUM.StartMenu] (X64) HKEY_USERS\S-1-5-21-2271226647-762932056-463426160-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowMyGames : 0 -> Not selected
    [PUM.StartMenu] (X86) HKEY_USERS\S-1-5-21-2271226647-762932056-463426160-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowMyGames : 0 -> Not selected
    [PUM.DesktopIcons] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> Not selected
    [PUM.DesktopIcons] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1 -> Not selected
    [PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> Not selected
    [PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1 -> Not selected

    ¤¤¤ Tasks : 0 ¤¤¤

    ¤¤¤ Files : 0 ¤¤¤

    ¤¤¤ Hosts File : 0 ¤¤¤

    ¤¤¤ Antirootkit : 7 (Driver: Not loaded [0xc000036b]) ¤¤¤
    [IAT:Inl(Hook.IEAT)] (iexplore.exe) user32.DLL - MessageBeep : @ 0x0 ()
    [IAT:Inl(Hook.IEAT)] (iexplore.exe) user32.DLL - DrawTextExW : @ 0x0 ()
    [IAT:Inl(Hook.IEAT)] (iexplore.exe) user32.DLL - DrawTextW : @ 0x0 ()
    [IAT:Inl(Hook.IEAT)] (iexplore.exe) WININET.dll - HttpOpenRequestW : @ 0x0 ()
    [IAT:Inl(Hook.IEAT)] (iexplore.exe) ws2_32.dll - WSASend : @ 0x0 ()
    [IAT:Inl(Hook.IEAT)] (iexplore.exe) winmm.dll - waveOutOpen : @ 0x0 ()
    [IAT:Inl(Hook.IEAT)] (iexplore.exe) WININET.dll - HttpOpenRequestA : @ 0x0 ()

    ¤¤¤ Web browsers : 0 ¤¤¤

    ¤¤¤ MBR Check : ¤¤¤
    +++++ PhysicalDrive0: ST2000DX001-1CM164 ATA Device +++++
    --- User ---
    [MBR] b0d595899f338ad98f08482644c46748
    [BSP] 9c7a63ffad36bba9b62b74619026fc98 : Windows Vista/7/8 MBR Code
    Partition table:
    User = LL1 ... OK
    User = LL2 ... OK


    ============================================
    RKreport_SCN_03302015_145853.log
     
  13. Gavin Vukoder

    Gavin Vukoder TS Rookie Topic Starter Posts: 21

    Malwarebytes Anti-Malware
    www.malwarebytes.org

    Scan Date: 3/30/2015
    Scan Time: 3:01:52 PM
    Logfile: scan.txt
    Administrator: Yes

    Version: 2.01.4.1018
    Malware Database: v2015.03.30.07
    Rootkit Database: v2015.03.26.01
    License: Trial
    Malware Protection: Enabled
    Malicious Website Protection: Enabled
    Self-protection: Disabled

    OS: Windows 7 Service Pack 1
    CPU: x64
    File System: NTFS
    User: LiquidGamma

    Scan Type: Threat Scan
    Result: Completed
    Objects Scanned: 347404
    Time Elapsed: 4 min, 28 sec

    Memory: Enabled
    Startup: Enabled
    Filesystem: Enabled
    Archives: Enabled
    Rootkits: Disabled
    Heuristics: Enabled
    PUP: Enabled
    PUM: Enabled

    Processes: 0
    (No malicious items detected)

    Modules: 0
    (No malicious items detected)

    Registry Keys: 1
    Trojan.Sathurbot, HKLM\SOFTWARE\CLASSES\CLSID\{F76FA5C2-3B6A-451E-8CA5-34C8D0AE0637}, Quarantined, [3a75ae9dc3c7ba7c0427c0abf11234cc],

    Registry Values: 0
    (No malicious items detected)

    Registry Data: 0
    (No malicious items detected)

    Folders: 0
    (No malicious items detected)

    Files: 3
    Trojan.Sathurbot, C:\ProgramData\Microsoft\Security\Client\SecurityProvider.dll, Delete-on-Reboot, [3a75ae9dc3c7ba7c0427c0abf11234cc],
    PUP.Optional.MultiPlug, C:\Users\LiquidGamma\Downloads\Diskord - Freak.mp3.exe, Quarantined, [e7c8e06b7d0de254408521d015ec52ae],
    Trojan.Sathurbot, C:\ProgramData\Microsoft\Security\Client\SecurityHelper.dll, Delete-on-Reboot, [4e619fac5a30b4823c806fde11f4f10f],

    Physical Sectors: 0
    (No malicious items detected)


    (end)​
     
  14. Gavin Vukoder

    Gavin Vukoder TS Rookie Topic Starter Posts: 21

    # AdwCleaner v4.200 - Logfile created 30/03/2015 at 15:14:02
    # Updated 29/03/2015 by Xplode
    # Database : 2015-03-29.1 [Server]
    # Operating system : Windows 7 Professional Service Pack 1 (x64)
    # Username : LiquidGamma - LIQUIDGAMMA-PC
    # Running from : C:\Users\LiquidGamma\Desktop\adwcleaner_4.200.exe
    # Option : Cleaning

    ***** [ Services ] *****


    ***** [ Files / Folders ] *****

    Folder Deleted : C:\Users\LiquidGamma\AppData\Local\Rainmaker_Software_Group_
    Folder Deleted : C:\Users\LiquidGamma\AppData\Roaming\Rainmaker Software Group LLC.?
    Folder Deleted : C:\Users\LiquidGamma\Documents\ProPCCleaner

    ***** [ Scheduled tasks ] *****


    ***** [ Shortcuts ] *****


    ***** [ Registry ] *****

    Key Deleted : HKCU\Software\ProPCCleanerLanguage
    Key Deleted : HKCU\Software\ProPCCleanerConfig
    Data Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyOverride] - *.local

    ***** [ Web browsers ] *****

    -\\ Internet Explorer v11.0.9600.17689


    -\\ Google Chrome v41.0.2272.101

    [C:\Users\LiquidGamma\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] - Deleted [Default_Search_Provider_Data] :

    *************************

    AdwCleaner[R0].txt - [27834 bytes] - [30/03/2015 15:12:53]
    AdwCleaner[S0].txt - [1263 bytes] - [30/03/2015 15:14:02]

    ########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [1322 bytes] ##########
     
  15. Gavin Vukoder

    Gavin Vukoder TS Rookie Topic Starter Posts: 21

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    Junkware Removal Tool (JRT) by Thisisu
    Version: 6.4.8 (03.30.2015:1)
    OS: Windows 7 Professional x64
    Ran by LiquidGamma on Mon 03/30/2015 at 15:18:48.68
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




    ~~~ Services



    ~~~ Registry Values

    Successfully repaired: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\\Start Page
    Successfully repaired: [Registry Value] HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main\\Start Page
    Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Main\\Start Page
    Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-19\Software\Microsoft\Internet Explorer\Main\\Start Page
    Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-20\Software\Microsoft\Internet Explorer\Main\\Start Page
    Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-21-2271226647-762932056-463426160-1000\Software\Microsoft\Internet Explorer\Main\\Start Page



    ~~~ Registry Keys



    ~~~ Files



    ~~~ Folders



    ~~~ Event Viewer Logs were cleared





    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    Scan was completed on Mon 03/30/2015 at 15:20:52.63
    End of JRT log
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     
  16. Broni

    Broni Malware Annihilator Posts: 52,892   +344

    Please download ComboFix from Here, Here or Here to your Desktop.

    **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
    • Never rename Combofix unless instructed.
    • Close any open browsers.
    • Very Important! Temporarily disable your anti-virus and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
    • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
    • Close any open browsers.
    • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
    • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
    • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
      If the connection is not there use restore point you created prior to running Combofix.
    • Double click on combofix.exe & follow the prompts.

    • NOTE1. If Combofix asks you to install Recovery Console, please allow it.
      NOTE 2. If Combofix asks you to update the program, always do so.
    • When finished, it will produce a report for you.
    • Please post the "C:\ComboFix.txt"
    **Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
    **Note 2 for AVG and CA Internet Security (Total Defense Internet Security) users: ComboFix will not run until AVG/CA Internet Security is uninstalled as a protective measure against the anti-virus. This is because AVG/CA Internet Security "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG/CA Internet Security cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG/CA Internet Security first.
    Use AppRemover to uninstall it: http://www.appremover.com/
    We can reinstall it when we're done with CF.
    **Note 3: If you receive an error Illegal operation attempted on a registery key that has been marked for deletion, restart computer to fix the issue.
    **Note 4: Some infections may take some significant time to be cured. As long as your computer clock is running Combofix is still working. Be patient.


    Make sure, you re-enable your security programs, when you're done with Combofix.

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    NOTE.
    If, for some reason, Combofix refuses to run, try the following...

    Delete Combofix file, download fresh one, but rename combofix.exe to your_name.exe BEFORE saving it to your desktop.
    Do NOT run it yet.
    Download Rkill (courtesy of BleepingComputer.com) to your desktop.
    There are 2 different versions. If one of them won't run then download and try to run the other one.
    You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

    rKill.exe: http://www.bleepingcomputer.com/download/rkill/dl/10/
    iExplore.exe (renamed rKill.exe): http://www.bleepingcomputer.com/download/rkill/dl/11/

    Restart computer in safe mode

    • Double-click on the Rkill desktop icon to run the tool.
    • If using Windows Vista, 7 or 8 right-click on it and choose Run As Administrator.
    • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
    • If not, delete the file, then download and use the one provided in Link 2.
    • Do not reboot until instructed.
    • If the tool does not run from any of the links provided, please let me know.

    When the scan is done Notepad will open with rKill.txt log.
    NOTE. rKill.txt log will also be present on your desktop.

    Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

    IF you had to run rKill post BOTH logs, rKill.txt and Combofix.txt.
     
  17. Gavin Vukoder

    Gavin Vukoder TS Rookie Topic Starter Posts: 21

    It gets stuck after it completes scan 50
     
  18. Gavin Vukoder

    Gavin Vukoder TS Rookie Topic Starter Posts: 21

    ComboFix 15-03-29.01 - LiquidGamma 03/30/2015 16:27:10.4.4 - x64
    Microsoft Windows 7 Professional 6.1.7601.1.1252.1.1033.18.8141.5457 [GMT -4:00]
    Running from: c:\users\LiquidGamma\Desktop\ComboFix.exe
    SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    .
    .
    ((((((((((((((((((((((((( Files Created from 2015-02-28 to 2015-03-30 )))))))))))))))))))))))))))))))
    .
    .
    2015-03-30 20:30 . 2015-03-30 20:30 -------- d-----w- c:\users\Default\AppData\Local\temp
    2015-03-30 19:12 . 2015-03-30 19:14 -------- d-----w- C:\AdwCleaner
    2015-03-30 19:01 . 2015-03-30 20:19 136408 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
    2015-03-30 19:01 . 2015-03-30 19:01 -------- d-----w- c:\program files (x86)\Malwarebytes Anti-Malware
    2015-03-30 19:01 . 2015-03-30 19:01 -------- d-----w- c:\programdata\Malwarebytes
    2015-03-30 19:01 . 2015-03-17 10:15 63704 ----a-w- c:\windows\system32\drivers\mwac.sys
    2015-03-30 19:01 . 2015-03-17 10:15 107736 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
    2015-03-30 19:01 . 2015-03-17 10:15 25816 ----a-w- c:\windows\system32\drivers\mbam.sys
    2015-03-30 19:00 . 2015-03-30 19:00 -------- d-----w- c:\users\LiquidGamma\AppData\Local\Programs
    2015-03-30 18:56 . 2015-03-30 18:56 35064 ----a-w- c:\windows\system32\drivers\TrueSight.sys
    2015-03-30 18:56 . 2015-03-30 18:56 -------- d-----w- c:\programdata\RogueKiller
    2015-03-30 01:54 . 2015-03-30 01:54 346671 ----a-w- c:\programdata\Microsoft\Security\Client\temp\tmp40DB.exe
    2015-03-30 01:33 . 2015-03-30 01:34 -------- d-----w- c:\users\LiquidGamma\AppData\Local\YPVPack
    2015-03-30 01:23 . 2015-03-30 01:23 147456 ----a-w- c:\programdata\Microsoft\Security\Client\temp\tmp3B5D.exe
    2015-03-30 01:08 . 2015-03-30 01:08 295816 ----a-w- c:\programdata\Microsoft\Security\Client\temp\tmp76C5.exe
    2015-03-30 00:57 . 2015-03-30 17:30 -------- d-----w- C:\FRST
    2015-03-29 03:06 . 2015-03-29 03:06 -------- d-----w- c:\programdata\AVAST Software
    2015-03-29 02:23 . 2015-03-29 02:23 -------- d-sh--w- c:\users\LiquidGamma\AppData\Local\EmieUserList
    2015-03-29 02:23 . 2015-03-29 02:23 -------- d-sh--w- c:\users\LiquidGamma\AppData\Local\EmieSiteList
    2015-03-29 02:23 . 2015-03-29 02:23 -------- d-sh--w- c:\users\LiquidGamma\AppData\Local\EmieBrowserModeList
    2015-03-28 20:05 . 2015-03-28 20:05 -------- d-----w- c:\windows\system32\appmgmt
    2015-03-27 23:46 . 2015-03-27 23:46 343593 ----a-w- c:\programdata\Microsoft\Security\Client\temp\tmpC7EC.exe
    2015-03-27 23:18 . 2015-03-30 17:28 -------- d-----w- c:\users\LiquidGamma\AppData\Local\Ilsoft
    2015-03-27 23:16 . 2015-03-27 23:16 159744 ----a-w- c:\programdata\Microsoft\Security\Client\temp\tmp2786.exe
    2015-03-27 23:01 . 2015-03-27 23:01 287024 ----a-w- c:\programdata\Microsoft\Security\Client\temp\tmp5F37.exe
    2015-03-26 21:29 . 2015-03-26 21:29 -------- d-----w- c:\program files (x86)\Common Files\Adobe AIR
    2015-03-25 23:44 . 2015-03-30 17:29 -------- d-----w- c:\users\LiquidGamma\AppData\Local\tagu
    2015-03-25 23:29 . 2015-03-25 23:29 215040 ----a-w- c:\programdata\Microsoft\Security\Client\temp\tmp4BAE.exe
    2015-03-25 23:13 . 2015-03-25 23:13 180224 ----a-w- c:\programdata\Microsoft\Security\Client\temp\tmp444D.exe
    2015-03-25 23:05 . 2015-03-25 23:08 -------- d-----w- c:\users\LiquidGamma\AppData\Roaming\Local Store
    2015-03-25 22:40 . 2015-03-29 02:14 -------- d-----w- c:\users\LiquidGamma\AppData\Roaming\uTorrent
    2015-03-25 22:26 . 2015-03-25 22:26 -------- d-----w- c:\users\LiquidGamma\.swt
    2015-03-25 22:26 . 2015-03-27 02:13 -------- d-----w- c:\users\LiquidGamma\AppData\Roaming\Azureus
    2015-03-23 23:34 . 2015-03-23 23:34 -------- d-----w- c:\windows\lhsp
    2015-03-23 23:34 . 2015-03-23 23:34 -------- d-----w- c:\program files (x86)\CFS-Technologies
    2015-03-11 23:50 . 2015-02-20 04:41 41984 ----a-w- c:\windows\system32\lpk.dll
    2015-03-11 23:50 . 2015-02-20 04:40 100864 ----a-w- c:\windows\system32\fontsub.dll
    2015-03-11 23:50 . 2015-02-20 04:40 14336 ----a-w- c:\windows\system32\dciman32.dll
    2015-03-11 23:50 . 2015-02-20 04:40 46080 ----a-w- c:\windows\system32\atmlib.dll
    2015-03-11 23:50 . 2015-02-20 04:13 70656 ----a-w- c:\windows\SysWow64\fontsub.dll
    2015-03-11 23:50 . 2015-02-20 04:13 10240 ----a-w- c:\windows\SysWow64\dciman32.dll
    2015-03-11 23:50 . 2015-02-20 04:13 34304 ----a-w- c:\windows\SysWow64\atmlib.dll
    2015-03-11 23:50 . 2015-02-20 04:12 25600 ----a-w- c:\windows\SysWow64\lpk.dll
    2015-03-11 23:50 . 2015-02-20 03:29 372224 ----a-w- c:\windows\system32\atmfd.dll
    2015-03-11 23:50 . 2015-02-20 03:09 299008 ----a-w- c:\windows\SysWow64\atmfd.dll
    2015-03-11 23:48 . 2015-02-03 03:31 215552 ----a-w- c:\windows\system32\ubpm.dll
    2015-03-11 23:48 . 2015-02-03 03:12 171520 ----a-w- c:\windows\SysWow64\ubpm.dll
    2015-03-11 23:48 . 2015-02-13 05:22 14177280 ----a-w- c:\windows\system32\shell32.dll
    2015-03-11 23:46 . 2015-02-03 03:31 1424896 ----a-w- c:\windows\system32\WindowsCodecs.dll
    2015-03-11 23:44 . 2015-02-04 03:16 465920 ----a-w- c:\windows\system32\WMPhoto.dll
    2015-03-11 23:44 . 2015-02-04 02:54 417792 ----a-w- c:\windows\SysWow64\WMPhoto.dll
    .
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2015-03-25 23:30 . 2014-12-30 01:25 778928 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
    2015-03-25 23:30 . 2014-12-30 01:25 142512 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
    2015-03-25 10:20 . 2015-02-05 22:42 75888 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{5D4C6826-3A3C-4C16-83C0-DE2D72BBD773}\offreg.dll
    2015-03-12 19:02 . 2014-09-30 00:22 122905848 ----a-w- c:\windows\system32\MRT.exe
    2015-02-16 21:20 . 2014-09-08 14:01 33856 ---ha-w- c:\windows\system32\hamachi.sys
    .
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2014-12-11 30872168]
    "YPVPack"="c:\users\LiquidGamma\AppData\Local\YPVPack\LX___uict.DLL" [2015-03-30 1282048]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
    "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2014-07-25 256896]
    "iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2014-09-01 152392]
    "Adobe Creative Cloud"="c:\program files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe" [2014-10-16 2694320]
    "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2014-10-02 421888]
    "LogMeIn Hamachi Ui"="c:\program files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" [2015-02-17 3978600]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "ConsentPromptBehaviorAdmin"= 5 (0x5)
    "ConsentPromptBehaviorUser"= 3 (0x3)
    "EnableUIADesktopToggle"= 0 (0x0)
    .
    R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
    R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
    R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys;c:\windows\SYSNATIVE\drivers\dmvsc.sys [x]
    R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
    R3 LVUVC64;Logitech Webcam 905(UVC);c:\windows\system32\DRIVERS\lvuvc64.sys;c:\windows\SYSNATIVE\DRIVERS\lvuvc64.sys [x]
    R3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\drivers\nusb3hub.sys;c:\windows\SYSNATIVE\drivers\nusb3hub.sys [x]
    R3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\drivers\nusb3xhc.sys;c:\windows\SYSNATIVE\drivers\nusb3xhc.sys [x]
    R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
    R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
    R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
    R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
    S2 GfExperienceService;NVIDIA GeForce Experience Service;c:\program files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe;c:\program files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [x]
    S2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;c:\program files (x86)\LogMeIn Hamachi\hamachi-2.exe;c:\program files (x86)\LogMeIn Hamachi\hamachi-2.exe [x]
    S2 LMIGuardianSvc;LMIGuardianSvc;c:\program files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe;c:\program files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe [x]
    S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe;c:\program files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [x]
    S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes Anti-Malware\mbamservice.exe;c:\program files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [x]
    S2 NvNetworkService;NVIDIA Network Service;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [x]
    S2 NvStreamSvc;NVIDIA Streamer Service;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [x]
    S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
    S2 UMVPFSrv;UMVPFSrv;c:\program files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe;c:\program files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe [x]
    S3 ISCT;Intel(R) Smart Connect Technology Device Driver;c:\windows\system32\DRIVERS\ISCTD64.sys;c:\windows\SYSNATIVE\DRIVERS\ISCTD64.sys [x]
    S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]
    S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\MBAMSwissArmy.sys;c:\windows\SYSNATIVE\drivers\MBAMSwissArmy.sys [x]
    S3 MBAMWebAccessControl;MBAMWebAccessControl;c:\windows\system32\drivers\mwac.sys;c:\windows\SYSNATIVE\drivers\mwac.sys [x]
    S3 NvStreamKms;NvStreamKms;c:\program files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys;c:\program files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [x]
    S3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM);c:\windows\system32\drivers\nvvad64v.sys;c:\windows\SYSNATIVE\drivers\nvvad64v.sys [x]
    S3 RTL8192su;%RTL8192su.DeviceDesc.DispName%;c:\windows\system32\DRIVERS\RTL8192su.sys;c:\windows\SYSNATIVE\DRIVERS\RTL8192su.sys [x]
    .
    .
    --- Other Services/Drivers In Memory ---
    .
    *NewlyCreated* - MBAMSWISSARMY
    *NewlyCreated* - NVSTREAMKMS
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
    2015-03-21 21:21 1061704 ----a-w- c:\program files (x86)\Google\Chrome\Application\41.0.2272.101\Installer\chrmstp.exe
    .
    Contents of the 'Scheduled Tasks' folder
    .
    2015-03-30 c:\windows\Tasks\Adobe Flash Player Updater.job
    - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-12-30 23:30]
    .
    2015-03-30 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
    - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2014-08-28 01:36]
    .
    2015-03-30 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
    - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2014-08-28 01:36]
    .
    .
    --------- X64 Entries -----------
    .
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ AccExtIco1]
    @="{AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47}"
    [HKEY_CLASSES_ROOT\CLSID\{AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47}]
    2014-09-26 19:41 1021088 ----a-w- c:\program files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ AccExtIco2]
    @="{853B7E05-C47D-4985-909A-D0DC5C6D7303}"
    [HKEY_CLASSES_ROOT\CLSID\{853B7E05-C47D-4985-909A-D0DC5C6D7303}]
    2014-09-26 19:41 1021088 ----a-w- c:\program files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ AccExtIco3]
    @="{42D38F2E-98E9-4382-B546-E24E4D6D04BB}"
    [HKEY_CLASSES_ROOT\CLSID\{42D38F2E-98E9-4382-B546-E24E4D6D04BB}]
    2014-09-26 19:41 1021088 ----a-w- c:\program files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "NvBackend"="c:\program files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe" [2014-09-17 2460488]
    "ShadowPlay"="c:\windows\system32\nvspcap64.dll" [2014-09-17 2799784]
    "Logitech Download Assistant"="c:\windows\System32\LogiLDA.dll" [2012-09-20 1832760]
    "AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2014-10-14 557768]
    .
    ------- Supplementary Scan -------
    .
    uLocal Page = c:\windows\system32\blank.htm
    uStart Page = hxxp://www.google.com
    mLocal Page = c:\windows\SysWOW64\blank.htm
    Trusted Zone: clonewarsadventures.com
    Trusted Zone: freerealms.com
    Trusted Zone: soe.com
    Trusted Zone: sony.com
    TCP: Interfaces\{58E7A3ED-04C3-43F6-920F-8755F905D8D2}: NameServer = 8.8.8.8,8.8.8.8,8.8.8.8,8.8.8.8,8.8.8.8,8.8.8.8
    TCP: Interfaces\{9D014533-A042-41E3-9169-2141CCB2EEAA}: NameServer = 8.8.8.8,8.8.8.8,8.8.8.8,8.8.8.8,8.8.8.8,8.8.8.8
    TCP: Interfaces\{F210D695-47AE-4DE6-A9AE-146AA6397065}: NameServer = 8.8.8.8,8.8.8.8,8.8.8.8,8.8.8.8,8.8.8.8,8.8.8.8
    .
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
    @Denied: (A 2) (Everyone)
    @="FlashBroker"
    "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_17_0_0_134_ActiveX.exe,-101"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
    "Enabled"=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
    @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_17_0_0_134_ActiveX.exe"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
    @Denied: (A 2) (Everyone)
    @="IFlashBroker6"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
    @="{00020424-0000-0000-C000-000000000046}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    "Version"="1.0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
    @Denied: (A 2) (Everyone)
    @="FlashBroker"
    "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_17_0_0_134_ActiveX.exe,-101"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
    "Enabled"=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_17_0_0_134_ActiveX.exe"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
    @Denied: (A 2) (Everyone)
    @="Shockwave Flash Object"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_17_0_0_134.ocx"
    "ThreadingModel"="Apartment"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
    @="0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
    @="ShockwaveFlash.ShockwaveFlash.17"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_17_0_0_134.ocx, 1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
    @="1.0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
    @="ShockwaveFlash.ShockwaveFlash"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
    @Denied: (A 2) (Everyone)
    @="Macromedia Flash Factory Object"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_17_0_0_134.ocx"
    "ThreadingModel"="Apartment"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
    @="FlashFactory.FlashFactory.1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_17_0_0_134.ocx, 1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
    @="1.0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
    @="FlashFactory.FlashFactory"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
    @Denied: (A 2) (Everyone)
    @="IFlashBroker6"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
    @="{00020424-0000-0000-C000-000000000046}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    "Version"="1.0"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
    @Denied: (Full) (Everyone)
    .
    Completion time: 2015-03-30 16:37:22
    ComboFix-quarantined-files.txt 2015-03-30 20:37
    .
    Pre-Run: 1,706,814,521,344 bytes free
    Post-Run: 1,708,952,977,408 bytes free
    .
    - - End Of File - - 0089E632CE854266ADEA55DCCF04B343
    A36C5E4F47E84449FF07ED3517B43A31
     
  19. Broni

    Broni Malware Annihilator Posts: 52,892   +344

    [​IMG] I don't see any AV program running.
    Install ONE of these:

    - Avast! free antivirus: http://www.avast.com/eng/download-avast-home.html

    - free Microsoft Security Essentials: http://windows.microsoft.com/en-GB/windows/products/security-essentials
    Note for Windows 8 users: Microsoft Security Essentials comes preinstalled and renamed as Windows Defender.
    You can keep it or you have to disable it before installing another AV program. How to...

    - free Comodo Antivirus: http://www.comodo.com/home/internet-security/antivirus.php

    Next....

    [​IMG] Re-run Farbar Recovery Scan Tool (FRST/FRST64) you ran at the very beginning of this topic.

    • Double-click to run it. When the tool opens click Yes to disclaimer.
    • Make sure you checkmark Addition.txt box.
    • Press Scan button.
    • Scan will create two logs, FRST.txt and Addition.txt in the same directory the tool is run. Please copy and paste them to your reply.
     
  20. Gavin Vukoder

    Gavin Vukoder TS Rookie Topic Starter Posts: 21

    Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-03-2015
    Ran by LiquidGamma (administrator) on LIQUIDGAMMA-PC on 30-03-2015 21:03:07
    Running from C:\Users\LiquidGamma\Desktop
    Loaded Profiles: LiquidGamma (Available profiles: LiquidGamma)
    Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: English (United States)
    Internet Explorer Version 11 (Default browser: IE)
    Boot Mode: Normal
    Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

    ==================== Processes (Whitelisted) =================

    (If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

    (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
    (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
    (Logitech Inc.) C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
    (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
    (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
    (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
    (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
    (LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe
    (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
    (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
    (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
    (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
    (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
    (LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe
    (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
    (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
    (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
    (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
    (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
    (Microsoft Corporation) C:\Windows\System32\regsvr32.exe
    (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
    (Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
    (Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe
    (Microsoft Corporation) C:\Windows\SysWOW64\regsvr32.exe
    (Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\IPC\AdobeIPCBroker.exe
    (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
    () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync.exe
    (Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
    (Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\HEX\Adobe CEF Helper.exe
    (Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
    (Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
    (Avast Software s.r.o.) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
    (AVAST Software) C:\Program Files\AVAST Software\Avast\ng\ngtool.exe
    (Avast Software) C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe
    (Avast Software s.r.o.) C:\Program Files\AVAST Software\Avast\AvastUI.exe
    (Microsoft Corporation) C:\Windows\System32\dllhost.exe
    (Microsoft Corporation) C:\Windows\System32\dllhost.exe
    (Microsoft Corporation) C:\Windows\System32\dllhost.exe


    ==================== Registry (Whitelisted) ==================

    (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

    HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2460488 2014-09-16] (NVIDIA Corporation)
    HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
    HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch
    HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [557768 2014-10-14] (Adobe Systems Incorporated)
    HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-25] (Oracle Corporation)
    HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-09-01] (Apple Inc.)
    HKLM-x32\...\Run: [Adobe Creative Cloud] => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe [2694320 2014-10-15] (Adobe Systems Incorporated)
    HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-10-02] (Apple Inc.)
    HKLM-x32\...\Run: [LogMeIn Hamachi Ui] => C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe [3978600 2015-02-17] (LogMeIn Inc.)
    HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5512912 2015-03-30] (Avast Software s.r.o.)
    HKLM-x32\...\RunOnce: [20150107] => C:\Program Files\AVAST Software\Avast\setup\emupdate\e39f1705-8cd2-4463-90c2-16b069e28d69.exe [183232 2015-03-30] (AVAST Software)
    HKU\S-1-5-21-2271226647-762932056-463426160-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [30872168 2014-12-11] (Skype Technologies S.A.)
    ShellIconOverlayIdentifiers: [ AccExtIco1] -> {AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll ()
    ShellIconOverlayIdentifiers: [ AccExtIco2] -> {853B7E05-C47D-4985-909A-D0DC5C6D7303} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll ()
    ShellIconOverlayIdentifiers: [ AccExtIco3] -> {42D38F2E-98E9-4382-B546-E24E4D6D04BB} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll ()
    ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (Avast Software s.r.o.)
    BootExecute: autocheck autochk * aswBoot.exe /M:14caa169b9 /wow /dir:"C:\Program Files\AVAST Software\Avast"

    ==================== Internet (Whitelisted) ====================

    (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

    HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
    HKU\S-1-5-21-2271226647-762932056-463426160-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
    HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
    HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
    HKU\S-1-5-21-2271226647-762932056-463426160-1000\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
    SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
    SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
    BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2015-03-30] (Avast Software s.r.o.)
    BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
    BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2014-08-27] (Oracle Corporation)
    BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2015-03-30] (Avast Software s.r.o.)
    BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
    BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2014-08-27] (Oracle Corporation)
    Tcpip\..\Interfaces\{58E7A3ED-04C3-43F6-920F-8755F905D8D2}: [NameServer] 8.8.8.8,8.8.8.8,8.8.8.8,8.8.8.8,8.8.8.8,8.8.8.8
    Tcpip\..\Interfaces\{9D014533-A042-41E3-9169-2141CCB2EEAA}: [NameServer] 8.8.8.8,8.8.8.8,8.8.8.8,8.8.8.8,8.8.8.8,8.8.8.8
    Tcpip\..\Interfaces\{F210D695-47AE-4DE6-A9AE-146AA6397065}: [NameServer] 8.8.8.8,8.8.8.8,8.8.8.8,8.8.8.8,8.8.8.8,8.8.8.8

    FireFox:
    ========
    FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll [2015-02-04] ()
    FF Plugin: @microsoft.com/GENUINE -> disabled No File
    FF Plugin: adobe.com/AdobeAAMDetect_x86_64 -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll [2014-10-15] (Adobe Systems)
    FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll [2015-02-04] ()
    FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-05-06] ()
    FF Plugin-x32: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll [2014-08-27] (Oracle Corporation)
    FF Plugin-x32: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll [2014-08-27] (Oracle Corporation)
    FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
    FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
    FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2014-09-13] (NVIDIA Corporation)
    FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2014-09-13] (NVIDIA Corporation)
    FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-08] (Google Inc.)
    FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-08] (Google Inc.)
    FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll [2014-10-15] (Adobe Systems)
    FF Plugin HKU\S-1-5-21-2271226647-762932056-463426160-1000: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\LiquidGamma\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2014-10-08] (Unity Technologies ApS)
    FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
    FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2015-03-30]

    Chrome:
    =======
    CHR StartupUrls: Default -> "hxxp://google.com/", "hxxp://youtube.com/"
    CHR Profile: C:\Users\LiquidGamma\AppData\Local\Google\Chrome\User Data\Default
    CHR Extension: (Adblock Plus) - C:\Users\LiquidGamma\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2015-03-30]
    CHR Extension: (Ocean Pacific) - C:\Users\LiquidGamma\AppData\Local\Google\Chrome\User Data\Default\Extensions\ecaabliejjdikjnkahhikeelbblahgoi [2015-03-25]
    CHR Extension: (Chrome Hotword Shared Module) - C:\Users\LiquidGamma\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-15]
    CHR Extension: (Google Wallet) - C:\Users\LiquidGamma\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-08-27]
    CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-03-30]

    ==================== Services (Whitelisted) =================

    (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

    R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [343336 2015-03-30] (Avast Software s.r.o.)
    R3 AvastVBoxSvc; C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe [4030800 2015-03-30] (Avast Software)
    R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1148744 2014-09-16] (NVIDIA Corporation)
    R2 LMIGuardianSvc; C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe [417552 2015-02-16] (LogMeIn, Inc.)
    R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2015-03-17] (Malwarebytes Corporation)
    R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1080120 2015-03-17] (Malwarebytes Corporation)
    R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1795912 2014-09-16] (NVIDIA Corporation)
    R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [19439944 2014-09-16] (NVIDIA Corporation)
    R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

    ==================== Drivers (Whitelisted) ====================

    (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

    R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29168 2015-03-30] ()
    R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [88408 2015-03-30] (Avast Software s.r.o.)
    R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93528 2015-03-30] (Avast Software s.r.o.)
    S0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65736 2015-03-30] ()
    R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1047320 2015-03-30] (Avast Software s.r.o.)
    R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [442264 2015-03-30] (Avast Software s.r.o.)
    R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [136752 2015-03-30] (Avast Software s.r.o.)
    R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [271200 2015-03-30] ()
    R3 ISCT; C:\Windows\System32\DRIVERS\ISCTD64.sys [46568 2013-01-19] ()
    R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-03-17] (Malwarebytes Corporation)
    R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [136408 2015-03-30] (Malwarebytes Corporation)
    R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-03-17] (Malwarebytes Corporation)
    R3 MEIx64; C:\Windows\System32\DRIVERS\TeeDriverx64.sys [129312 2014-09-30] (Intel Corporation)
    R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19272 2014-09-16] (NVIDIA Corporation)
    R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [38048 2014-09-04] (NVIDIA Corporation)
    U3 TrueSight; C:\Windows\System32\drivers\TrueSight.sys [35064 2015-03-30] ()
    R2 VBoxAswDrv; C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [273824 2015-03-30] (Avast Software)
    S3 catchme; \??\C:\ComboFix\catchme.sys [X]

    ==================== NetSvcs (Whitelisted) ===================

    (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


    ==================== One Month Created Files and Folders ========

    (If an entry is included in the fixlist, the file\folder will be moved.)

    2015-03-30 21:03 - 2015-03-30 21:03 - 00015646 _____ () C:\Users\LiquidGamma\Desktop\FRST.txt
    2015-03-30 21:02 - 2015-03-30 21:02 - 00000000 ____D () C:\Users\LiquidGamma\AppData\Roaming\Dropbox
    2015-03-30 21:01 - 2015-03-30 21:03 - 00000000 ____D () C:\Windows\system32\vbox
    2015-03-30 21:01 - 2015-03-30 21:01 - 01047320 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswSnx.sys
    2015-03-30 21:01 - 2015-03-30 21:01 - 00442264 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswSP.sys
    2015-03-30 21:01 - 2015-03-30 21:01 - 00364472 _____ (Avast Software s.r.o.) C:\Windows\system32\aswBoot.exe
    2015-03-30 21:01 - 2015-03-30 21:01 - 00271200 _____ () C:\Windows\system32\Drivers\aswVmm.sys
    2015-03-30 21:01 - 2015-03-30 21:01 - 00136752 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswStm.sys
    2015-03-30 21:01 - 2015-03-30 21:01 - 00093528 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswRdr2.sys
    2015-03-30 21:01 - 2015-03-30 21:01 - 00088408 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswMonFlt.sys
    2015-03-30 21:01 - 2015-03-30 21:01 - 00065736 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
    2015-03-30 21:01 - 2015-03-30 21:01 - 00043112 _____ (Avast Software s.r.o.) C:\Windows\avastSS.scr
    2015-03-30 21:01 - 2015-03-30 21:01 - 00029168 _____ () C:\Windows\system32\Drivers\aswHwid.sys
    2015-03-30 21:01 - 2015-03-30 21:01 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
    2015-03-30 21:01 - 2015-03-30 21:01 - 00001922 _____ () C:\Users\Public\Desktop\Avast Free Antivirus.lnk
    2015-03-30 21:01 - 2015-03-30 21:01 - 00000000 ____D () C:\Windows\SysWOW64\vbox
    2015-03-30 21:01 - 2015-03-30 21:01 - 00000000 ____D () C:\Users\LiquidGamma\AppData\Roaming\AVAST Software
    2015-03-30 21:01 - 2015-03-30 21:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVAST Software
    2015-03-30 20:59 - 2015-03-30 20:59 - 00000000 ____D () C:\Program Files\AVAST Software
    2015-03-30 16:37 - 2015-03-30 16:37 - 00019198 _____ () C:\ComboFix.txt
    2015-03-30 16:26 - 2015-03-30 16:37 - 00000000 ____D () C:\ComboFix
    2015-03-30 15:42 - 2015-03-30 16:37 - 00000000 ____D () C:\Qoobox
    2015-03-30 15:42 - 2015-03-30 16:36 - 00000000 ____D () C:\Windows\erdnt
    2015-03-30 15:42 - 2011-06-26 02:45 - 00256000 _____ () C:\Windows\PEV.exe
    2015-03-30 15:42 - 2010-11-07 13:20 - 00208896 _____ () C:\Windows\MBR.exe
    2015-03-30 15:42 - 2009-04-20 00:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
    2015-03-30 15:42 - 2000-08-30 20:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
    2015-03-30 15:42 - 2000-08-30 20:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
    2015-03-30 15:42 - 2000-08-30 20:00 - 00098816 _____ () C:\Windows\sed.exe
    2015-03-30 15:42 - 2000-08-30 20:00 - 00080412 _____ () C:\Windows\grep.exe
    2015-03-30 15:42 - 2000-08-30 20:00 - 00068096 _____ () C:\Windows\zip.exe
    2015-03-30 15:40 - 2015-03-30 15:40 - 05617067 ____R (Swearware) C:\Users\LiquidGamma\Desktop\ComboFix.exe
    2015-03-30 15:40 - 2015-03-30 15:40 - 05617067 _____ (Swearware) C:\Users\LiquidGamma\Downloads\ComboFix.exe
    2015-03-30 15:24 - 2015-03-30 16:15 - 00000000 ____D () C:\Users\LiquidGamma\Desktop\Pc Help
    2015-03-30 15:20 - 2015-03-30 15:20 - 00001365 _____ () C:\Users\LiquidGamma\Desktop\JRT.txt
    2015-03-30 15:17 - 2015-03-30 15:17 - 01389097 _____ (Thisisu) C:\Users\LiquidGamma\Downloads\JRT.exe
    2015-03-30 15:17 - 2015-03-30 15:17 - 01389097 _____ (Thisisu) C:\Users\LiquidGamma\Desktop\JRT.exe
    2015-03-30 15:16 - 2015-03-30 15:16 - 02208768 _____ () C:\Users\LiquidGamma\Downloads\adwcleaner_4.200 (1).exe
    2015-03-30 15:12 - 2015-03-30 15:14 - 00000000 ____D () C:\AdwCleaner
    2015-03-30 15:12 - 2015-03-30 15:12 - 02208768 _____ () C:\Users\LiquidGamma\Downloads\adwcleaner_4.200.exe
    2015-03-30 15:12 - 2015-03-30 15:12 - 02208768 _____ () C:\Users\LiquidGamma\Desktop\adwcleaner_4.200.exe
    2015-03-30 15:11 - 2015-03-30 15:11 - 00001539 _____ () C:\Users\LiquidGamma\Desktop\scan.txt
    2015-03-30 15:01 - 2015-03-30 17:06 - 00136408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
    2015-03-30 15:01 - 2015-03-30 15:01 - 00001102 _____ () C:\Users\LiquidGamma\Desktop\Malwarebytes Anti-Malware.lnk
    2015-03-30 15:01 - 2015-03-30 15:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
    2015-03-30 15:01 - 2015-03-30 15:01 - 00000000 ____D () C:\ProgramData\Malwarebytes
    2015-03-30 15:01 - 2015-03-30 15:01 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
    2015-03-30 15:01 - 2015-03-17 06:15 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
    2015-03-30 15:01 - 2015-03-17 06:15 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
    2015-03-30 15:01 - 2015-03-17 06:15 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
    2015-03-30 15:00 - 2015-03-30 15:00 - 21540440 _____ (Malwarebytes Corporation ) C:\Users\LiquidGamma\Downloads\mbam-setup-2.1.4.1018.exe
    2015-03-30 14:56 - 2015-03-30 14:56 - 00035064 _____ () C:\Windows\system32\Drivers\TrueSight.sys
    2015-03-30 14:56 - 2015-03-30 14:56 - 00000000 ____D () C:\ProgramData\RogueKiller
    2015-03-30 14:55 - 2015-03-30 14:55 - 16748632 _____ () C:\Users\LiquidGamma\Downloads\RogueKiller.exe
    2015-03-30 14:55 - 2015-03-30 14:55 - 16748632 _____ () C:\Users\LiquidGamma\Desktop\RogueKiller.exe
    2015-03-30 13:28 - 2015-03-30 13:28 - 00004053 _____ () C:\Users\LiquidGamma\Downloads\fixlist.txt
    2015-03-30 13:27 - 2015-03-29 20:57 - 02095616 _____ (Farbar) C:\Users\LiquidGamma\Desktop\FRST64.exe
    2015-03-29 21:33 - 2015-03-30 21:02 - 00000000 ____D () C:\Users\LiquidGamma\AppData\Local\YPVPack
    2015-03-29 20:58 - 2015-03-29 20:58 - 00023852 _____ () C:\Users\LiquidGamma\Downloads\Addition.txt
    2015-03-29 20:57 - 2015-03-30 21:03 - 00000000 ____D () C:\FRST
    2015-03-29 20:57 - 2015-03-29 20:58 - 00053639 _____ () C:\Users\LiquidGamma\Downloads\FRST.txt
    2015-03-29 20:56 - 2015-03-29 20:57 - 02095616 _____ (Farbar) C:\Users\LiquidGamma\Downloads\FRST64.exe
    2015-03-29 17:15 - 2015-03-29 17:15 - 00033026 _____ () C:\Users\LiquidGamma\Downloads\Adobe After Effects (2).torrent
    2015-03-28 23:15 - 2015-03-28 23:15 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_TeeDriverx64_01011.Wdf
    2015-03-28 23:06 - 2015-03-28 23:06 - 00000000 ____D () C:\ProgramData\AVAST Software
    2015-03-28 23:05 - 2015-03-28 23:05 - 05475064 _____ (Avast Software s.r.o.) C:\Users\LiquidGamma\Downloads\avast_free_antivirus_setup_online.exe
    2015-03-28 23:05 - 2015-03-28 23:05 - 05475064 _____ (Avast Software s.r.o.) C:\Users\LiquidGamma\Desktop\avast_free_antivirus_setup_online.exe
    2015-03-28 22:23 - 2015-03-28 22:23 - 00000000 __SHD () C:\Users\LiquidGamma\AppData\Local\EmieUserList
    2015-03-28 22:23 - 2015-03-28 22:23 - 00000000 __SHD () C:\Users\LiquidGamma\AppData\Local\EmieSiteList
    2015-03-28 22:23 - 2015-03-28 22:23 - 00000000 __SHD () C:\Users\LiquidGamma\AppData\Local\EmieBrowserModeList
    2015-03-28 22:05 - 2015-03-28 22:06 - 00001908 _____ () C:\Windows\diagwrn.xml
    2015-03-28 22:05 - 2015-03-28 22:06 - 00001908 _____ () C:\Windows\diagerr.xml
    2015-03-28 16:05 - 2015-03-28 16:05 - 00000000 ____D () C:\Windows\system32\appmgmt
    2015-03-27 19:18 - 2015-03-30 13:28 - 00000000 ____D () C:\Users\LiquidGamma\AppData\Local\Ilsoft
    2015-03-27 12:08 - 2015-03-27 12:08 - 02633407 _____ () C:\Users\LiquidGamma\Downloads\Logo Instructions.zip
    2015-03-27 11:40 - 2015-03-27 11:40 - 04361185 _____ () C:\Users\LiquidGamma\Downloads\Blur Bars Visualizer.zip
    2015-03-27 08:30 - 2015-03-27 08:30 - 00000000 ____D () C:\Users\LiquidGamma\Documents\Adobe
    2015-03-26 21:23 - 2015-03-26 21:29 - 180345979 _____ () C:\Users\LiquidGamma\Downloads\Spectrum Template by NoName.rar
    2015-03-26 18:22 - 2015-03-26 18:23 - 10570305 _____ () C:\Users\LiquidGamma\Downloads\Free Template (1).zip
    2015-03-26 17:42 - 2015-03-26 17:42 - 01325320 _____ () C:\Users\LiquidGamma\Downloads\The awesomest template ever.zip
    2015-03-26 17:29 - 2015-03-26 17:29 - 00000997 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Help.lnk
    2015-03-26 17:29 - 2015-03-26 17:29 - 00000000 ____D () C:\Users\Default\AppData\Roaming\Macromedia
    2015-03-26 17:29 - 2015-03-26 17:29 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\Macromedia
    2015-03-26 17:03 - 2015-03-26 17:03 - 00044976 _____ () C:\Users\LiquidGamma\Downloads\Classy.zip
    2015-03-25 19:44 - 2015-03-30 13:29 - 00000000 ____D () C:\Users\LiquidGamma\AppData\Local\tagu
    2015-03-25 19:05 - 2015-03-25 19:08 - 00000000 ____D () C:\Users\LiquidGamma\AppData\Roaming\Local Store
    2015-03-25 18:44 - 2015-03-25 18:44 - 00003006 _____ () C:\Windows\System32\Tasks\{49924DAD-81D9-42C9-924F-5292BBEB670A}
    2015-03-25 18:44 - 2015-03-25 18:44 - 00003006 _____ () C:\Windows\System32\Tasks\{1553A040-66A0-44CF-8DAC-995F0734F8BD}
    2015-03-25 18:43 - 2015-03-29 20:54 - 00000761 _____ () C:\Windows\system32\Drivers\etc\hosts.txt
    2015-03-25 18:40 - 2015-03-28 22:14 - 00000000 ____D () C:\Users\LiquidGamma\AppData\Roaming\uTorrent
    2015-03-25 18:38 - 2015-03-25 18:38 - 01741904 _____ (BitTorrent Inc.) C:\Users\LiquidGamma\Downloads\uTorrent.exe
    2015-03-25 18:28 - 2015-03-25 18:28 - 00033026 _____ () C:\Users\LiquidGamma\Downloads\Adobe After Effects (1).torrent
    2015-03-25 18:26 - 2015-03-26 22:13 - 00000000 ____D () C:\Users\LiquidGamma\AppData\Roaming\Azureus
    2015-03-25 18:26 - 2015-03-25 18:26 - 00000000 ____D () C:\Users\LiquidGamma\.swt
    2015-03-25 18:24 - 2015-03-25 18:24 - 00072008 _____ (Azureus Software, Inc.) C:\Users\LiquidGamma\Downloads\VuzeBittorrentClientInstaller.exe
    2015-03-25 18:24 - 2015-03-25 18:24 - 00033026 _____ () C:\Users\LiquidGamma\Downloads\Adobe After Effects.torrent
    2015-03-24 20:11 - 2015-03-24 20:12 - 06684059 _____ () C:\Users\LiquidGamma\Downloads\eightytown (loop)-HD.mp4
    2015-03-24 19:48 - 2015-03-24 19:49 - 10570305 _____ () C:\Users\LiquidGamma\Downloads\Free Template.zip
    2015-03-23 19:34 - 2015-03-23 19:34 - 02714417 _____ () C:\Users\LiquidGamma\Downloads\speakoniasetup-1.0.exe
    2015-03-23 19:34 - 2015-03-23 19:34 - 00002178 _____ () C:\Users\LiquidGamma\Desktop\Speakonia.lnk
    2015-03-23 19:34 - 2015-03-23 19:34 - 00000000 ____D () C:\Windows\lhsp
    2015-03-23 19:34 - 2015-03-23 19:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CFS-Technologies
    2015-03-23 19:34 - 2015-03-23 19:34 - 00000000 ____D () C:\Program Files (x86)\CFS-Technologies
    2015-03-22 18:49 - 2015-03-22 18:49 - 04859488 _____ () C:\Users\LiquidGamma\Downloads\blockpile.one (loop)-HD.mp4
    2015-03-19 21:17 - 2015-03-19 21:17 - 19953231 _____ () C:\Users\LiquidGamma\Downloads\Gematria-HD.mp4
    2015-03-19 21:16 - 2015-03-19 21:16 - 06539444 _____ () C:\Users\LiquidGamma\Downloads\danny tannigle-HD.mp4
    2015-03-19 21:15 - 2015-03-19 21:15 - 11730509 _____ () C:\Users\LiquidGamma\Downloads\base ten-HD.mp4
    2015-03-17 18:56 - 2015-03-17 18:57 - 07141443 _____ () C:\Users\LiquidGamma\Downloads\bilousby-HD.mp4
    2015-03-15 22:00 - 2015-03-15 22:01 - 11718072 _____ () C:\Users\LiquidGamma\Downloads\t-hawk (loop)-HD.mp4
    2015-03-11 19:50 - 2015-02-20 00:41 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
    2015-03-11 19:50 - 2015-02-20 00:40 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
    2015-03-11 19:50 - 2015-02-20 00:40 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
    2015-03-11 19:50 - 2015-02-20 00:40 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
    2015-03-11 19:50 - 2015-02-20 00:13 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
    2015-03-11 19:50 - 2015-02-20 00:13 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
    2015-03-11 19:50 - 2015-02-20 00:13 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
    2015-03-11 19:50 - 2015-02-20 00:12 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
    2015-03-11 19:50 - 2015-02-19 23:29 - 00372224 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
    2015-03-11 19:50 - 2015-02-19 23:09 - 00299008 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
    2015-03-11 19:49 - 2015-02-02 23:34 - 05554104 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
    2015-03-11 19:49 - 2015-02-02 23:34 - 00693176 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
     
  21. Gavin Vukoder

    Gavin Vukoder TS Rookie Topic Starter Posts: 21

    2015-03-11 19:49 - 2015-02-02 23:34 - 00094656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mountmgr.sys
    2015-03-11 19:49 - 2015-02-02 23:33 - 00616360 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
    2015-03-11 19:49 - 2015-02-02 23:31 - 14632960 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
    2015-03-11 19:49 - 2015-02-02 23:31 - 04121600 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll
    2015-03-11 19:49 - 2015-02-02 23:31 - 01574400 _____ (Microsoft Corporation) C:\Windows\system32\quartz.dll
    2015-03-11 19:49 - 2015-02-02 23:31 - 00782848 _____ (Microsoft Corporation) C:\Windows\system32\wmdrmsdk.dll
    2015-03-11 19:49 - 2015-02-02 23:31 - 00641024 _____ (Microsoft Corporation) C:\Windows\system32\msscp.dll
    2015-03-11 19:49 - 2015-02-02 23:31 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
    2015-03-11 19:49 - 2015-02-02 23:31 - 00500224 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll
    2015-03-11 19:49 - 2015-02-02 23:31 - 00432128 _____ (Microsoft Corporation) C:\Windows\system32\mfplat.dll
    2015-03-11 19:49 - 2015-02-02 23:31 - 00371712 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
    2015-03-11 19:49 - 2015-02-02 23:31 - 00325632 _____ (Microsoft Corporation) C:\Windows\system32\msnetobj.dll
    2015-03-11 19:49 - 2015-02-02 23:31 - 00229376 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
    2015-03-11 19:49 - 2015-02-02 23:31 - 00206848 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll
    2015-03-11 19:49 - 2015-02-02 23:31 - 00188416 _____ (Microsoft Corporation) C:\Windows\system32\pcasvc.dll
    2015-03-11 19:49 - 2015-02-02 23:31 - 00063488 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
    2015-03-11 19:49 - 2015-02-02 23:31 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
    2015-03-11 19:49 - 2015-02-02 23:31 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\pcadm.dll
    2015-03-11 19:49 - 2015-02-02 23:31 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\msmmsp.dll
    2015-03-11 19:49 - 2015-02-02 23:31 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll
    2015-03-11 19:49 - 2015-02-02 23:31 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx
    2015-03-11 19:49 - 2015-02-02 23:31 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll
    2015-03-11 19:49 - 2015-02-02 23:30 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
    2015-03-11 19:49 - 2015-02-02 23:30 - 01480192 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
    2015-03-11 19:49 - 2015-02-02 23:30 - 01202176 _____ (Microsoft Corporation) C:\Windows\system32\drmv2clt.dll
    2015-03-11 19:49 - 2015-02-02 23:30 - 01069056 _____ (Microsoft Corporation) C:\Windows\system32\cryptui.dll
    2015-03-11 19:49 - 2015-02-02 23:30 - 00842240 _____ (Microsoft Corporation) C:\Windows\system32\blackbox.dll
    2015-03-11 19:49 - 2015-02-02 23:30 - 00680960 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
    2015-03-11 19:49 - 2015-02-02 23:30 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\evr.dll
    2015-03-11 19:49 - 2015-02-02 23:30 - 00497664 _____ (Microsoft Corporation) C:\Windows\system32\drmmgrtn.dll
    2015-03-11 19:49 - 2015-02-02 23:30 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll
    2015-03-11 19:49 - 2015-02-02 23:30 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
    2015-03-11 19:49 - 2015-02-02 23:30 - 00296448 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll
    2015-03-11 19:49 - 2015-02-02 23:30 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll
    2015-03-11 19:49 - 2015-02-02 23:30 - 00187904 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
    2015-03-11 19:49 - 2015-02-02 23:30 - 00146944 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
    2015-03-11 19:49 - 2015-02-02 23:30 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
    2015-03-11 19:49 - 2015-02-02 23:30 - 00126464 _____ (Microsoft Corporation) C:\Windows\system32\audiodg.exe
    2015-03-11 19:49 - 2015-02-02 23:30 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
    2015-03-11 19:49 - 2015-02-02 23:30 - 00082432 _____ (Microsoft Corporation) C:\Windows\system32\cryptsp.dll
    2015-03-11 19:49 - 2015-02-02 23:30 - 00058880 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
    2015-03-11 19:49 - 2015-02-02 23:30 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\rrinstaller.exe
    2015-03-11 19:49 - 2015-02-02 23:30 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
    2015-03-11 19:49 - 2015-02-02 23:30 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
    2015-03-11 19:49 - 2015-02-02 23:30 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\mfpmp.exe
    2015-03-11 19:49 - 2015-02-02 23:30 - 00017920 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
    2015-03-11 19:49 - 2015-02-02 23:30 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\pcawrk.exe
    2015-03-11 19:49 - 2015-02-02 23:30 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\pcalua.exe
    2015-03-11 19:49 - 2015-02-02 23:29 - 00008704 _____ (Microsoft Corporation) C:\Windows\system32\pcaevts.dll
    2015-03-11 19:49 - 2015-02-02 23:28 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
    2015-03-11 19:49 - 2015-02-02 23:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\mferror.dll
    2015-03-11 19:49 - 2015-02-02 23:19 - 00663552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\PEAuth.sys
    2015-03-11 19:49 - 2015-02-02 23:16 - 03973048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
    2015-03-11 19:49 - 2015-02-02 23:16 - 03917760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
    2015-03-11 19:49 - 2015-02-02 23:12 - 11411968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
    2015-03-11 19:49 - 2015-02-02 23:12 - 03209728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll
    2015-03-11 19:49 - 2015-02-02 23:12 - 01329664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\quartz.dll
    2015-03-11 19:49 - 2015-02-02 23:12 - 01174528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
    2015-03-11 19:49 - 2015-02-02 23:12 - 01005056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptui.dll
    2015-03-11 19:49 - 2015-02-02 23:12 - 00988160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drmv2clt.dll
    2015-03-11 19:49 - 2015-02-02 23:12 - 00744960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\blackbox.dll
    2015-03-11 19:49 - 2015-02-02 23:12 - 00617984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmdrmsdk.dll
    2015-03-11 19:49 - 2015-02-02 23:12 - 00519680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll
    2015-03-11 19:49 - 2015-02-02 23:12 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msscp.dll
    2015-03-11 19:49 - 2015-02-02 23:12 - 00489984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\evr.dll
    2015-03-11 19:49 - 2015-02-02 23:12 - 00442880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AUDIOKSE.dll
    2015-03-11 19:49 - 2015-02-02 23:12 - 00406016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drmmgrtn.dll
    2015-03-11 19:49 - 2015-02-02 23:12 - 00374784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioEng.dll
    2015-03-11 19:49 - 2015-02-02 23:12 - 00354816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfplat.dll
    2015-03-11 19:49 - 2015-02-02 23:12 - 00265216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msnetobj.dll
    2015-03-11 19:49 - 2015-02-02 23:12 - 00195584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioSes.dll
    2015-03-11 19:49 - 2015-02-02 23:12 - 00179200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
    2015-03-11 19:49 - 2015-02-02 23:12 - 00143872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
    2015-03-11 19:49 - 2015-02-02 23:12 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
    2015-03-11 19:49 - 2015-02-02 23:12 - 00103424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfps.dll
    2015-03-11 19:49 - 2015-02-02 23:12 - 00081408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsp.dll
    2015-03-11 19:49 - 2015-02-02 23:12 - 00050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appidapi.dll
    2015-03-11 19:49 - 2015-02-02 23:12 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
    2015-03-11 19:49 - 2015-02-02 23:12 - 00008192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\spwmp.dll
    2015-03-11 19:49 - 2015-02-02 23:12 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdxm.ocx
    2015-03-11 19:49 - 2015-02-02 23:12 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxmasf.dll
    2015-03-11 19:49 - 2015-02-02 23:11 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
    2015-03-11 19:49 - 2015-02-02 23:11 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rrinstaller.exe
    2015-03-11 19:49 - 2015-02-02 23:11 - 00023040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfpmp.exe
    2015-03-11 19:49 - 2015-02-02 23:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mferror.dll
    2015-03-11 19:49 - 2015-02-02 23:08 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
    2015-03-11 19:49 - 2015-02-02 22:32 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
    2015-03-11 19:49 - 2014-10-31 18:24 - 00619056 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
    2015-03-11 19:49 - 2014-06-27 20:21 - 00532176 _____ (Microsoft Corporation) C:\Windows\system32\winresume.exe
    2015-03-11 19:49 - 2014-06-27 20:21 - 00457400 _____ (Microsoft Corporation) C:\Windows\system32\ci.dll
    2015-03-11 19:48 - 2015-02-13 01:26 - 12875264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
    2015-03-11 19:48 - 2015-02-13 01:22 - 14177280 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
    2015-03-11 19:48 - 2015-02-02 23:31 - 00215552 _____ (Microsoft Corporation) C:\Windows\system32\ubpm.dll
    2015-03-11 19:48 - 2015-02-02 23:12 - 00171520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ubpm.dll
    2015-03-11 19:47 - 2015-03-06 01:56 - 00155576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
    2015-03-11 19:47 - 2015-03-06 01:56 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
    2015-03-11 19:47 - 2015-03-06 01:42 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
    2015-03-11 19:47 - 2015-03-06 01:42 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
    2015-03-11 19:47 - 2015-03-06 01:42 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
    2015-03-11 19:47 - 2015-03-06 01:42 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
    2015-03-11 19:47 - 2015-03-06 01:42 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
    2015-03-11 19:47 - 2015-03-06 01:42 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
    2015-03-11 19:47 - 2015-03-06 01:42 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
    2015-03-11 19:47 - 2015-03-06 01:42 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
    2015-03-11 19:47 - 2015-03-06 01:42 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
    2015-03-11 19:47 - 2015-03-06 01:42 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
    2015-03-11 19:47 - 2015-03-06 01:42 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
    2015-03-11 19:47 - 2015-03-06 01:41 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
    2015-03-11 19:47 - 2015-03-06 01:41 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
    2015-03-11 19:47 - 2015-03-06 01:39 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
    2015-03-11 19:47 - 2015-03-06 01:38 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
    2015-03-11 19:47 - 2015-03-06 01:36 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
    2015-03-11 19:47 - 2015-03-06 01:10 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
    2015-03-11 19:47 - 2015-03-06 01:10 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
    2015-03-11 19:47 - 2015-03-06 01:10 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
    2015-03-11 19:47 - 2015-03-06 01:10 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
    2015-03-11 19:47 - 2015-03-06 01:10 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
    2015-03-11 19:47 - 2015-03-06 01:10 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
    2015-03-11 19:47 - 2015-03-06 01:10 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
    2015-03-11 19:47 - 2015-03-06 01:10 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
    2015-03-11 19:47 - 2015-03-06 01:09 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
    2015-03-11 19:47 - 2015-03-06 01:09 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
    2015-03-11 19:47 - 2015-03-06 01:07 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
    2015-03-11 19:47 - 2015-03-06 01:07 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
    2015-03-11 19:47 - 2015-03-06 01:06 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
    2015-03-11 19:47 - 2015-01-30 19:56 - 00459336 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
    2015-03-11 19:47 - 2015-01-16 22:48 - 01067520 _____ (Microsoft Corporation) C:\Windows\system32\msctf.dll
    2015-03-11 19:47 - 2015-01-16 22:30 - 00828928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msctf.dll
    2015-03-11 19:46 - 2015-02-25 23:25 - 03204096 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
    2015-03-11 19:46 - 2015-02-23 23:15 - 00389800 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
    2015-03-11 19:46 - 2015-02-23 22:32 - 00342696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
    2015-03-11 19:46 - 2015-02-20 21:16 - 25021440 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
    2015-03-11 19:46 - 2015-02-20 20:41 - 12827648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
    2015-03-11 19:46 - 2015-02-20 20:27 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
    2015-03-11 19:46 - 2015-02-20 20:27 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
    2015-03-11 19:46 - 2015-02-20 20:25 - 19720192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
    2015-03-11 19:46 - 2015-02-20 19:58 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
    2015-03-11 19:46 - 2015-02-20 19:32 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
    2015-03-11 19:46 - 2015-02-19 23:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
    2015-03-11 19:46 - 2015-02-19 23:05 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
    2015-03-11 19:46 - 2015-02-19 22:50 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
    2015-03-11 19:46 - 2015-02-19 22:49 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
    2015-03-11 19:46 - 2015-02-19 22:49 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
    2015-03-11 19:46 - 2015-02-19 22:48 - 02886144 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
    2015-03-11 19:46 - 2015-02-19 22:47 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
    2015-03-11 19:46 - 2015-02-19 22:41 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
    2015-03-11 19:46 - 2015-02-19 22:40 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
    2015-03-11 19:46 - 2015-02-19 22:36 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
    2015-03-11 19:46 - 2015-02-19 22:35 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
    2015-03-11 19:46 - 2015-02-19 22:35 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
    2015-03-11 19:46 - 2015-02-19 22:34 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
    2015-03-11 19:46 - 2015-02-19 22:32 - 06035456 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
    2015-03-11 19:46 - 2015-02-19 22:26 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
    2015-03-11 19:46 - 2015-02-19 22:22 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
    2015-03-11 19:46 - 2015-02-19 22:22 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
    2015-03-11 19:46 - 2015-02-19 22:13 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
    2015-03-11 19:46 - 2015-02-19 22:09 - 00503296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
    2015-03-11 19:46 - 2015-02-19 22:08 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
    2015-03-11 19:46 - 2015-02-19 22:08 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
    2015-03-11 19:46 - 2015-02-19 22:08 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
    2015-03-11 19:46 - 2015-02-19 22:06 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
    2015-03-11 19:46 - 2015-02-19 22:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
    2015-03-11 19:46 - 2015-02-19 22:03 - 02278400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
    2015-03-11 19:46 - 2015-02-19 22:01 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
    2015-03-11 19:46 - 2015-02-19 22:00 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
    2015-03-11 19:46 - 2015-02-19 21:58 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
    2015-03-11 19:46 - 2015-02-19 21:56 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
    2015-03-11 19:46 - 2015-02-19 21:56 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
    2015-03-11 19:46 - 2015-02-19 21:49 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
    2015-03-11 19:46 - 2015-02-19 21:49 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
    2015-03-11 19:46 - 2015-02-19 21:47 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
    2015-03-11 19:46 - 2015-02-19 21:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
    2015-03-11 19:46 - 2015-02-19 21:43 - 14398976 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
    2015-03-11 19:46 - 2015-02-19 21:41 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
    2015-03-11 19:46 - 2015-02-19 21:37 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
    2015-03-11 19:46 - 2015-02-19 21:30 - 04300288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
    2015-03-11 19:46 - 2015-02-19 21:28 - 02358784 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
    2015-03-11 19:46 - 2015-02-19 21:24 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
    2015-03-11 19:46 - 2015-02-19 21:24 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
    2015-03-11 19:46 - 2015-02-19 21:23 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
    2015-03-11 19:46 - 2015-02-19 21:16 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
    2015-03-11 19:46 - 2015-02-19 21:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
    2015-03-11 19:46 - 2015-02-19 21:01 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
    2015-03-11 19:46 - 2015-02-19 20:57 - 01311232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
    2015-03-11 19:46 - 2015-02-19 20:55 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
    2015-03-11 19:46 - 2015-02-02 23:31 - 01424896 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
    2015-03-11 19:46 - 2015-02-02 23:12 - 01230848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
    2015-03-11 19:44 - 2015-02-03 23:16 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
    2015-03-11 19:44 - 2015-02-03 22:54 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
    2015-03-04 19:47 - 2015-03-04 19:47 - 09175018 _____ () C:\Users\LiquidGamma\Downloads\This video will make you MLG.mp4
    2015-03-03 23:09 - 2015-03-03 23:09 - 06798221 _____ () C:\Users\LiquidGamma\Downloads\VID_34451017_101942.mp4
    2015-03-02 22:04 - 2015-03-02 22:04 - 03372868 _____ () C:\Users\LiquidGamma\Downloads\scream-HD.mp4
    2015-03-01 11:49 - 2015-03-01 11:49 - 11062061 _____ () C:\Users\LiquidGamma\Downloads\hyperwangg (loop)-HD.mp4
    2015-02-28 08:48 - 2015-02-28 08:48 - 06655332 _____ () C:\Users\LiquidGamma\Downloads\sphere.daemon-HD.mp4

    ==================== One Month Modified Files and Folders =======

    (If an entry is included in the fixlist, the file\folder will be moved.)

    2015-03-30 20:56 - 2014-08-27 18:17 - 01310416 _____ () C:\Windows\WindowsUpdate.log
    2015-03-30 20:56 - 2009-07-14 00:45 - 00021072 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
    2015-03-30 20:56 - 2009-07-14 00:45 - 00021072 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
    2015-03-30 20:20 - 2014-12-29 21:25 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
    2015-03-30 20:15 - 2014-08-27 21:36 - 00000898 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
    2015-03-30 19:15 - 2014-08-27 21:36 - 00000894 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
    2015-03-30 17:06 - 2014-09-02 11:05 - 00000000 ____D () C:\Users\LiquidGamma\AppData\Local\LogMeIn Hamachi
    2015-03-30 17:06 - 2014-08-27 22:19 - 00000000 ____D () C:\Users\LiquidGamma\AppData\Roaming\Skype
    2015-03-30 17:01 - 2009-07-14 01:13 - 00782470 _____ () C:\Windows\system32\PerfStringBackup.INI
    2015-03-30 16:54 - 2014-08-27 21:56 - 00000000 ____D () C:\ProgramData\NVIDIA
    2015-03-30 16:54 - 2010-11-20 23:47 - 00164352 _____ () C:\Windows\PFRO.log
    2015-03-30 16:54 - 2009-07-14 01:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
    2015-03-30 16:54 - 2009-07-14 00:51 - 00004056 _____ () C:\Windows\setupact.log
    2015-03-30 16:52 - 2015-01-14 18:57 - 00000000 ____D () C:\Users\LiquidGamma\Desktop\Upload Queue
    2015-03-30 16:37 - 2009-07-13 23:20 - 00000000 __RHD () C:\Users\Default
    2015-03-30 16:36 - 2009-07-13 22:34 - 00000215 _____ () C:\Windows\system.ini
    2015-03-30 15:06 - 2009-07-13 23:20 - 00000000 ____D () C:\Windows\Globalization
    2015-03-30 13:27 - 2014-08-27 18:17 - 00000000 ____D () C:\Users\LiquidGamma
    2015-03-30 10:50 - 2014-12-29 21:24 - 00000000 ____D () C:\Users\LiquidGamma\AppData\Local\Adobe
    2015-03-29 17:51 - 2014-08-27 21:36 - 00000000 ____D () C:\Users\LiquidGamma\AppData\Local\Apps\2.0
    2015-03-28 22:29 - 2014-09-11 19:03 - 00000000 ____D () C:\Users\LiquidGamma\AppData\Roaming\Notepad++
    2015-03-28 22:21 - 2014-08-27 22:05 - 00000000 ____D () C:\Program Files (x86)\Steam
    2015-03-28 22:17 - 2015-01-05 11:39 - 00000000 ____D () C:\Program Files\Common Files\Adobe
    2015-03-28 22:16 - 2015-01-05 11:39 - 00000000 ____D () C:\Program Files\Adobe
    2015-03-28 22:16 - 2015-01-05 11:18 - 00000000 ____D () C:\Program Files (x86)\Adobe
    2015-03-28 22:05 - 2009-07-14 00:51 - 00000000 _____ () C:\Windows\setuperr.log
    2015-03-27 12:38 - 2015-01-08 19:32 - 00000000 ____D () C:\Users\LiquidGamma\Desktop\random
    2015-03-27 10:05 - 2014-09-02 12:04 - 00000000 ____D () C:\Users\LiquidGamma\AppData\Local\CrashDumps
    2015-03-27 08:09 - 2009-07-14 00:45 - 04959904 _____ () C:\Windows\system32\FNTCACHE.DAT
    2015-03-26 18:25 - 2014-08-27 21:36 - 00058352 _____ () C:\Users\LiquidGamma\AppData\Local\GDIPFONTCACHEV1.DAT
    2015-03-26 18:03 - 2015-01-05 12:49 - 00000000 ____D () C:\ProgramData\regid.1986-12.com.adobe
    2015-03-26 18:03 - 2014-08-29 18:58 - 00000000 ____D () C:\Users\LiquidGamma\AppData\Roaming\Adobe
    2015-03-26 17:29 - 2015-01-05 11:20 - 00000000 ____D () C:\ProgramData\Adobe
    2015-03-25 19:30 - 2014-12-29 21:25 - 00778928 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
    2015-03-25 19:30 - 2014-12-29 21:25 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
    2015-03-25 19:30 - 2014-12-29 21:25 - 00003768 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
    2015-03-24 21:52 - 2015-01-29 22:55 - 00000000 ____D () C:\Users\LiquidGamma\Desktop\Video Making
    2015-03-23 19:34 - 2009-07-13 23:20 - 00000000 ____D () C:\Windows\Speech
    2015-03-22 18:40 - 2014-10-19 14:11 - 00000000 _____ () C:\Windows\system32\Drivers\lvuvc.hs
    2015-03-21 16:51 - 2009-07-14 01:09 - 00000000 ____D () C:\Windows\System32\Tasks\WPD
    2015-03-19 21:55 - 2015-02-22 21:55 - 00000000 ____D () C:\Users\LiquidGamma\AppData\Local\Game Dev Tycoon - Steam
    2015-03-17 18:50 - 2009-07-13 23:20 - 00000000 ____D () C:\Windows\rescache
    2015-03-17 16:29 - 2009-07-13 23:20 - 00000000 ____D () C:\Windows\SysWOW64\Dism
    2015-03-17 16:29 - 2009-07-13 23:20 - 00000000 ____D () C:\Windows\system32\Dism
    2015-03-12 15:05 - 2014-09-29 20:22 - 00000000 ____D () C:\Windows\system32\MRT
    2015-03-12 15:02 - 2014-09-29 20:22 - 122905848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

    ==================== Bamital & volsnap Check =================

    (There is no automatic fix for files that do not pass verification.)

    C:\Windows\System32\winlogon.exe => File is digitally signed
    C:\Windows\System32\wininit.exe => File is digitally signed
    C:\Windows\SysWOW64\wininit.exe => File is digitally signed
    C:\Windows\explorer.exe => File is digitally signed
    C:\Windows\SysWOW64\explorer.exe => File is digitally signed
    C:\Windows\System32\svchost.exe => File is digitally signed
    C:\Windows\SysWOW64\svchost.exe => File is digitally signed
    C:\Windows\System32\services.exe => File is digitally signed
    C:\Windows\System32\User32.dll => File is digitally signed
    C:\Windows\SysWOW64\User32.dll => File is digitally signed
    C:\Windows\System32\userinit.exe => File is digitally signed
    C:\Windows\SysWOW64\userinit.exe => File is digitally signed
    C:\Windows\System32\rpcss.dll => File is digitally signed
    C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


    LastRegBack: 2015-03-25 00:28

    ==================== End Of Log ============================
     
  22. Gavin Vukoder

    Gavin Vukoder TS Rookie Topic Starter Posts: 21

    Additional scan result of Farbar Recovery Scan Tool (x64) Version: 11-03-2015
    Ran by LiquidGamma at 2015-03-30 21:03:46
    Running from C:\Users\LiquidGamma\Desktop
    Boot Mode: Normal
    ==========================================================


    ==================== Security Center ========================

    (If an entry is included in the fixlist, it will be removed.)

    AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
    AS: Windows Defender (Enabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

    ==================== Installed Programs ======================

    (Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

    Adobe After Effects CC 2014 (HKLM-x32\...\{2B22C750-5C3B-4738-B621-BA786AC7A494}) (Version: 13.0.0 - Adobe Systems Incorporated)
    Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 3.1.0.4880 - Adobe Systems Incorporated)
    Adobe Creative Cloud (HKLM-x32\...\Adobe Creative Cloud) (Version: 2.8.1.451 - Adobe Systems Incorporated)
    Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)
    Adobe Flash Player 17 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 17.0.0.134 - Adobe Systems Incorporated)
    Adobe Help Manager (HKLM-x32\...\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 4.0.244 - Adobe Systems Incorporated)
    Apple Application Support (HKLM-x32\...\{78002155-F025-4070-85B3-7C0453561701}) (Version: 3.0.6 - Apple Inc.)
    Apple Mobile Device Support (HKLM\...\{B678797F-DF38-4556-8A31-8B818E261868}) (Version: 8.0.0.23 - Apple Inc.)
    Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
    Avast Free Antivirus (HKLM-x32\...\Avast) (Version: 10.2.2215 - AVAST Software)
    Belkin USB Wireless Adaptor (HKLM-x32\...\InstallShield_{8524BBAC-E3A7-42F5-9B9A-5AE50A10C500}) (Version: 1.0.0.10 - Belkin)
    Belkin USB Wireless Adaptor (x32 Version: 1.0.0.10 - Belkin) Hidden
    Besiege (HKLM-x32\...\Steam App 346010) (Version: - Spiderling Studios)
    Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
    Camtasia Studio 8 (HKLM-x32\...\{474DFABF-E55B-4905-ABAA-40791A6AC77F}) (Version: 8.4.4.1859 - TechSmith Corporation)
    Counter-Strike: Global Offensive (HKLM-x32\...\Steam App 730) (Version: - Valve)
    D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
    Dizzel (HKLM-x32\...\Steam App 315640) (Version: - NSStudio)
    Fraps (remove only) (HKLM-x32\...\Fraps) (Version: - )
    Game Dev Tycoon (HKLM-x32\...\Steam App 239820) (Version: - Greenheart Games)
    Garry's Mod (HKLM-x32\...\Steam App 4000) (Version: - Facepunch Studios)
    Gear Up (HKLM-x32\...\Steam App 214420) (Version: - Doctor Entertainment AB)
    Goat Simulator (HKLM-x32\...\Steam App 265930) (Version: - Coffee Stain Studios)
    Google Chrome (HKLM-x32\...\Google Chrome) (Version: 41.0.2272.101 - Google Inc.)
    Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
    Google Update Helper (x32 Version: 1.3.26.9 - Google Inc.) Hidden
    Guns and Robots (HKLM-x32\...\Steam App 293540) (Version: - Masthead Studios Ltd)
    iTunes (HKLM\...\{F46AA0F1-E284-4878-A462-5F11B9166C0E}) (Version: 11.4.0.18 - Apple Inc.)
    Java 7 Update 67 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217067FF}) (Version: 7.0.670 - Oracle)
    Lernout & Hauspie TruVoice American English TTS Engine (HKLM-x32\...\tv_enua) (Version: - )
    Loadout (HKLM-x32\...\Steam App 208090) (Version: - Edge of Reality)
    LogMeIn Hamachi (HKLM-x32\...\LogMeIn Hamachi) (Version: 2.2.0.319 - LogMeIn, Inc.)
    LogMeIn Hamachi (x32 Version: 2.2.0.319 - LogMeIn, Inc.) Hidden
    Malwarebytes Anti-Malware version 2.1.4.1018 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.4.1018 - Malwarebytes Corporation)
    Max Gentlemen (HKLM-x32\...\Steam App 257710) (Version: - The Men Who Wear Many Hats)
    Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
    Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
    Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
    Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
    Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
    Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
    Movie Maker (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
    Notepad++ (HKLM-x32\...\Notepad++) (Version: 6.6.9 - Notepad++ Team)
    NVIDIA 3D Vision Controller Driver 344.11 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 344.11 - NVIDIA Corporation)
    NVIDIA 3D Vision Driver 344.11 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 344.11 - NVIDIA Corporation)
    NVIDIA GeForce Experience 2.1.2 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.1.2 - NVIDIA Corporation)
    NVIDIA Graphics Driver 344.11 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 344.11 - NVIDIA Corporation)
    NVIDIA HD Audio Driver 1.3.32.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.32.1 - NVIDIA Corporation)
    NVIDIA PhysX (HKLM-x32\...\{8B922CF8-8A6C-41CE-A858-F1755D7F5D29}) (Version: 9.12.1031 - NVIDIA Corporation)
    paint.net (HKLM\...\{19BD2C33-16A8-4ED1-B9EA-D9E35B21EC42}) (Version: 4.0.5 - dotPDN LLC)
    PAYDAY 2 (HKLM-x32\...\Steam App 218620) (Version: - OVERKILL - a Starbreeze Studio.)
    PlanetSide 2 (HKLM-x32\...\Steam App 218230) (Version: - Sony Online Entertainment)
    PlanetSide 2 (HKU\S-1-5-21-2271226647-762932056-463426160-1000\...\SOE-PlanetSide 2) (Version: - Sony Online Entertainment)
    QuickTime 7 (HKLM-x32\...\{3D2CBC2C-65D4-4463-87AB-BB2C859C1F3E}) (Version: 7.76.80.95 - Apple Inc.)
    Robocraft (HKLM-x32\...\Steam App 301520) (Version: - Freejam)
    Rust (HKLM-x32\...\Steam App 252490) (Version: - Facepunch Studios)
    SHIELD Streaming (Version: 3.1.200 - NVIDIA Corporation) Hidden
    SHIELD Wireless Controller Driver (Version: 16.13.42 - NVIDIA Corporation) Hidden
    Skype™ 7.0 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.0.102 - Skype Technologies S.A.)
    Speakonia (HKLM-x32\...\Speakonia_is1) (Version: 1.0.3.5 - CFS-Technologies)
    Steam (HKLM-x32\...\Steam) (Version: - Valve Corporation)
    Team Fortress 2 (HKLM-x32\...\Steam App 440) (Version: - Valve)
    The Binding of Isaac (HKLM-x32\...\Steam App 113200) (Version: - Edmund McMillen and Florian Himsl)
    Toribash (HKLM-x32\...\Steam App 248570) (Version: - Nabi Studios)
    Transformice (HKLM-x32\...\Steam App 335240) (Version: - Atelier 801)
    Unity Web Player (HKU\S-1-5-21-2271226647-762932056-463426160-1000\...\UnityWebPlayer) (Version: 4.5.5f1 - Unity Technologies ApS)
    VideoPad Video Editor (HKLM-x32\...\VideoPad) (Version: 3.74 - NCH Software)
    WavePad Sound Editor (HKLM-x32\...\WavePad) (Version: 6.02 - NCH Software)
    WhiteCap (HKLM-x32\...\WhiteCap) (Version: 6.3.1 - SoundSpectrum)
    Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)
    WinRAR 5.11 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.11.0 - win.rar GmbH)

    ==================== Custom CLSID (selected items): ==========================

    (If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

    CustomCLSID: HKU\S-1-5-21-2271226647-762932056-463426160-1000_Classes\CLSID\{8A791F0C-C63C-4EC5-B97F-FBCE74EDBC54}\InprocServer32 -> C:\Program Files\TextPad 7\System\shellext64.dll No File

    ==================== Restore Points =========================

    30-03-2015 20:59:18 avast! antivirus system restore point

    ==================== Hosts content: ==========================

    (If needed Hosts: directive could be included in the fixlist to reset Hosts.)

    2009-07-13 22:34 - 2015-03-30 13:28 - 00000035 ____A C:\Windows\system32\Drivers\etc\hosts

    ==================== Scheduled Tasks (whitelisted) =============

    (If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

    Task: {24CEDCF0-5C80-41C7-970B-35F20B0ED900} - System32\Tasks\{1553A040-66A0-44CF-8DAC-995F0734F8BD} => C:\Users\LiquidGamma\AppData\Roaming\uTorrent\uTorrent.exe
    Task: {2B1380B9-58FE-404F-ABF2-1F045EDCB449} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2015-03-30] (Avast Software s.r.o.)
    Task: {843FA045-998D-4356-A34D-E1265B6C3D21} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
    Task: {9D4AC6B4-1D48-440D-B9E2-1BA4D2CF93F6} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-08-27] (Google Inc.)
    Task: {B80E38C7-277F-4FAA-B387-0BC80CAB9E6E} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-03-25] (Adobe Systems Incorporated)
    Task: {DCEFE66F-2E90-4252-A4FC-C773D0A8F45B} - System32\Tasks\{49924DAD-81D9-42C9-924F-5292BBEB670A} => C:\Users\LiquidGamma\AppData\Roaming\uTorrent\uTorrent.exe
    Task: {E7A73D72-FD79-49B6-B946-09FDD9F7B202} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-08-27] (Google Inc.)
    Task: {F6A28C13-B01C-4A6B-B5A1-54DACFE6346E} - System32\Tasks\AdobeAAMUpdater-1.0-LiquidGamma-PC-LiquidGamma => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2014-10-14] (Adobe Systems Incorporated)
    Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
    Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

    ==================== Loaded Modules (whitelisted) ==============

    2014-08-27 21:56 - 2014-09-13 17:53 - 00116880 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
    2014-09-26 15:41 - 2014-09-26 15:41 - 01021088 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll
    2014-05-12 05:49 - 2014-05-12 05:49 - 00222720 _____ () C:\Program Files (x86)\Notepad++\NppShell_06.dll
    2014-09-26 15:40 - 2014-09-26 15:40 - 06237856 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync.exe
    2014-07-31 12:16 - 2014-07-31 12:16 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
    2014-07-31 12:16 - 2014-07-31 12:16 - 01044776 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
    2014-09-28 22:01 - 2014-09-28 22:01 - 36730032 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CEF\libcef.dll
    2015-03-30 21:01 - 2015-03-30 21:01 - 00104400 _____ () C:\Program Files\AVAST Software\Avast\log.dll
    2015-03-30 21:01 - 2015-03-30 21:01 - 00081728 _____ () C:\Program Files\AVAST Software\Avast\JsonRpcServer.dll
    2015-03-30 21:01 - 2015-03-30 21:01 - 02924032 _____ () C:\Program Files\AVAST Software\Avast\defs\15033001\algo.dll
    2015-03-30 21:01 - 2015-03-30 21:01 - 40540672 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll

    ==================== Alternate Data Streams (whitelisted) =========

    (If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


    ==================== Safe Mode (whitelisted) ===================

    (If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Hamachi2Svc => ""="Service"

    ==================== EXE Association (whitelisted) ===============

    (If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


    ==================== Other Areas ============================

    (Currently there is no automatic fix for this section.)

    HKU\S-1-5-21-2271226647-762932056-463426160-1000\Control Panel\Desktop\\Wallpaper ->
    DNS Servers: 8.8.8.8

    ==================== MSCONFIG/TASK MANAGER disabled items ==

    (Currently there is no automatic fix for this section.)


    ==================== Accounts: =============================

    Administrator (S-1-5-21-2271226647-762932056-463426160-500 - Administrator - Disabled)
    Guest (S-1-5-21-2271226647-762932056-463426160-501 - Limited - Disabled)
    LiquidGamma (S-1-5-21-2271226647-762932056-463426160-1000 - Administrator - Enabled) => C:\Users\LiquidGamma

    ==================== Faulty Device Manager Devices =============

    Name: SM Bus Controller
    Description: SM Bus Controller
    Class Guid:
    Manufacturer:
    Service:
    Problem: : The drivers for this device are not installed. (Code 28)
    Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

    Name: Ethernet Controller
    Description: Ethernet Controller
    Class Guid:
    Manufacturer:
    Service:
    Problem: : The drivers for this device are not installed. (Code 28)
    Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

    Name: Universal Serial Bus (USB) Controller
    Description: Universal Serial Bus (USB) Controller
    Class Guid:
    Manufacturer:
    Service:
    Problem: : The drivers for this device are not installed. (Code 28)
    Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.


    ==================== Event log errors: =========================

    Application errors:
    ==================
    Error: (03/30/2015 04:56:02 PM) (Source: WinMgmt) (EventID: 10) (User: )
    Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


    System errors:
    =============
    Error: (03/30/2015 06:30:35 PM) (Source: volsnap) (EventID: 36) (User: )
    Description: The shadow copies of volume C: were aborted because the shadow copy storage could not grow due to a user imposed limit.

    Error: (03/30/2015 04:36:15 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
    Description: The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.

    Error: (03/30/2015 04:29:09 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
    Description: The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.

    Error: (03/30/2015 04:11:56 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
    Description: The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.

    Error: (03/30/2015 04:10:59 PM) (Source: DCOM) (EventID: 10010) (User: )
    Description: {995C996E-D918-4A8C-A302-45719A6F4EA7}

    Error: (03/30/2015 03:58:58 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
    Description: The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.

    Error: (03/30/2015 03:49:24 PM) (Source: Application Popup) (EventID: 1060) (User: )
    Description: \??\C:\ComboFix\catchme.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.

    Error: (03/30/2015 03:48:03 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
    Description: The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.


    Microsoft Office Sessions:
    =========================
    Error: (03/30/2015 04:56:02 PM) (Source: WinMgmt) (EventID: 10) (User: )
    Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


    CodeIntegrity Errors:
    ===================================
    Date: 2015-03-30 15:49:24.413
    Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

    Date: 2015-03-30 15:49:24.403
    Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.


    ==================== Memory info ===========================

    Processor: Intel(R) Core(TM) i5-4690K CPU @ 3.50GHz
    Percentage of memory in use: 26%
    Total physical RAM: 8141.32 MB
    Available physical RAM: 5943.17 MB
    Total Pagefile: 30754.51 MB
    Available Pagefile: 28407.21 MB
    Total Virtual: 8192 MB
    Available Virtual: 8191.84 MB

    ==================== Drives ================================

    Drive c: () (Fixed) (Total:1862.92 GB) (Free:1589.2 GB) NTFS

    ==================== MBR & Partition Table ==================

    ========================================================
    Disk: 0 (MBR Code: Windows 7 or 8) (Size: 1863 GB) (Disk ID: 05AD3597)
    Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
    Partition 2: (Not Active) - (Size=1862.9 GB) - (Type=07 NTFS)

    ==================== End Of Log ============================
     
  23. Broni

    Broni Malware Annihilator Posts: 52,892   +344

    Download attached fixlist.txt file and save it to the Desktop.
    NOTE. It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work.

    NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

    Run FRST(FRST64) and press the Fix button just once and wait.
    The tool will make a log on the Desktop (Fixlog.txt). Please post it to your reply.
     

    Attached Files:

  24. Gavin Vukoder

    Gavin Vukoder TS Rookie Topic Starter Posts: 21

    Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 11-03-2015
    Ran by LiquidGamma at 2015-03-30 21:25:42 Run:2
    Running from C:\Users\LiquidGamma\Desktop
    Loaded Profiles: LiquidGamma (Available profiles: LiquidGamma)
    Boot Mode: Normal
    ==============================================

    Content of fixlist:
    *****************
    HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
    HKU\S-1-5-21-2271226647-762932056-463426160-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
    S3 catchme; \??\C:\ComboFix\catchme.sys [X]
    2015-03-25 19:44 - 2015-03-30 13:29 - 00000000 ____D () C:\Users\LiquidGamma\AppData\Local\tagu
    CustomCLSID: HKU\S-1-5-21-2271226647-762932056-463426160-1000_Classes\CLSID\{8A791F0C-C63C-4EC5-B97F-FBCE74EDBC54}\InprocServer32 -> C:\Program Files\TextPad 7\System\shellext64.dll No File

    *****************

    "HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer" => Key deleted successfully.
    "HKU\S-1-5-21-2271226647-762932056-463426160-1000\SOFTWARE\Policies\Microsoft\Internet Explorer" => Key deleted successfully.
    catchme => Service deleted successfully.
    C:\Users\LiquidGamma\AppData\Local\tagu => Moved successfully.
    "HKU\S-1-5-21-2271226647-762932056-463426160-1000_Classes\CLSID\{8A791F0C-C63C-4EC5-B97F-FBCE74EDBC54}" => Key deleted successfully.

    ==== End of Fixlog 21:25:42 ====
     
  25. Broni

    Broni Malware Annihilator Posts: 52,892   +344

    Last scans...

    [​IMG] Download Security Check from here or here and save it to your Desktop.
    • Double-click SecurityCheck.exe
    • Follow the onscreen instructions inside of the black box.
    • A Notepad document should open automatically called checkup.txt; please post the contents of that document.
    NOTE 1. If one of your security applications (e.g., third-party firewall) requests permission to allow DIG.EXE access the Internet, allow it to do so.
    NOTE 2. SecurityCheck may produce some false warning(s), so leave the results reading to me.
    NOTE 3. If you receive UNSUPPORTED OPERATING SYSTEM! ABORTED! message restart computer and Security Check should run


    [​IMG] Please download Farbar Service Scanner (FSS) and run it on the computer with the issue.
    • Make sure the following options are checked:
      • Internet Services
      • Windows Firewall
      • System Restore
      • Security Center
      • Windows Update
      • Windows Defender
      • Other Services
    • Press "Scan".
    • It will create a log (FSS.txt) in the same directory the tool is run.
    • Please copy and paste the log to your reply.

    [​IMG] Download Temp File Cleaner (TFC)
    Alternate download: http://www.itxassociates.com/OT-Tools/TFC.exe
    • Double click on TFC.exe to run the program.
    • Click on Start button to begin cleaning process.
    • TFC will close all running programs, and it may ask you to restart computer.

    [​IMG] Download Sophos Free Virus Removal Tool and save it to your desktop.
    • Double click the icon and select Run
    • Click Next
    • Select I accept the terms in this license agreement, then click Next twice
    • Click Install
    • Click Finish to launch the program
    • Once the virus database has been updated click Start Scanning
    • If any threats are found click Details, then View log file... (bottom left hand corner)
    • Copy and paste the results in your reply
    • Close the Notepad document, close the Threat Details screen, then click Start cleanup
    • Click Exit to close the program
     

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...