TechSpot

Windows 7 Start Recovery Loop Virus and Other?

By Tyler Olsen
Dec 24, 2015
  1. Was unable to get computer to boot. Kept going to start recovery. Was able to correct with info from SevenForums but want check for possible viruses.

    Logs are in two threads due to length:
    Here are the logs:

    Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:23-12-2015
    Ran by Tyler (administrator) on TYLER-HP (23-12-2015 23:41:08)
    Running from C:\Users\Tyler\Desktop
    Loaded Profiles: Tyler (Available Profiles: Tyler)
    Platform: Windows 7 Home Premium Service Pack 1 (X64) Language: English (United States)
    Internet Explorer Version 11 (Default browser: Chrome)
    Boot Mode: Normal
    Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

    ==================== Processes (Whitelisted) =================

    (If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

    (AMD) C:\Windows\System32\atiesrxx.exe
    (IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
    (AMD) C:\Windows\System32\atieclxx.exe
    (Advanced Micro Devices) C:\Program Files\ATI Technologies\ATI.ACE\Reservation Manager\AMD Reservation Manager.exe
    (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
    (EasyBits Software AS) C:\Windows\SysWOW64\ezSharedSvcHost.exe
    (Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe
    (Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe
    (Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
    (Roxio) C:\Program Files (x86)\Roxio\RoxioNow Player\RNowSvc.exe
    (Microsoft Corporation) C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
    (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
    (Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
    (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
    (Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
    (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
    (CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
    (Microsoft Corporation) C:\Windows\System32\dllhost.exe
    (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
    (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
    (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
    (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Microsoft Corporation) C:\Windows\System32\dllhost.exe


    ==================== Registry (Whitelisted) ===========================

    (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

    HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch
    HKLM-x32\...\Run: [] => [X]
    HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-11] (Oracle Corporation)
    HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [7021880 2015-12-23] (AVAST Software)
    HKLM-x32\...\RunOnce: [20150107] => C:\Program Files\AVAST Software\Avast\setup\emupdate\409a18f2-bd6b-4d13-af39-a53ddee07141.exe [183232 2015-12-23] (AVAST Software)
    HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
    ShellExecuteHooks-x32: EasyBits ShellExecute Hook - {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWOW64\ezUPBHook.dll [52920 2011-05-31] (EasyBits Software Corp.)
    ShellIconOverlayIdentifiers: [ GoogleDriveBlacklisted] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2015-11-04] (Google)
    ShellIconOverlayIdentifiers: [ GoogleDriveSynced] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2015-11-04] (Google)
    ShellIconOverlayIdentifiers: [ GoogleDriveSyncing] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2015-11-04] (Google)
    ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2015-12-23] (AVAST Software)
    ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => No File
    ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => No File
    ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => No File
    ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => No File
    ShellIconOverlayIdentifiers: [GDriveSharedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} => No File

    ==================== Internet (Whitelisted) ====================

    (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

    Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
    Tcpip\..\Interfaces\{6F6C1F7F-40F9-4570-825E-019054F4CF0C}: [DhcpNameServer] 192.168.1.1

    Internet Explorer:
    ==================
    SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
    SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
    SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
    SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
    SearchScopes: HKU\S-1-5-21-1678204619-2015826032-607794690-1001 -> {B4ECF1EC-7A0D-4E36-BD28-B1C2A481F8B6} URL = hxxp://www.bing.com/search?FORM=U038DF&PC=U038&dt=061713&q={searchTerms}&src=IE-SearchBox
    BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll [2013-11-15] (Oracle Corporation)
    BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2015-12-23] (AVAST Software)
    BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21] (Microsoft Corp.)
    BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll [2013-11-15] (Oracle Corporation)
    BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-11-15] (Adobe Systems Incorporated)
    BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2014-07-11] (Oracle Corporation)
    BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2015-12-23] (AVAST Software)
    BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21] (Microsoft Corp.)
    BHO-x32: Bing Bar Helper -> {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -> C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll [2011-03-01] (Microsoft Corporation.)
    BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2014-07-11] (Oracle Corporation)
    Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll [2011-03-01] (Microsoft Corporation.)
    Toolbar: HKU\S-1-5-21-1678204619-2015826032-607794690-1001 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File

    FireFox:
    ========
    FF ProfilePath: C:\Users\Tyler\AppData\Roaming\Mozilla\Firefox\Profiles\45aro5td.default-1423777539203
    FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_20_0_0_235.dll [2015-12-08] ()
    FF Plugin: @java.com/DTPlugin,version=10.45.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll [2013-11-15] (Oracle Corporation)
    FF Plugin: @java.com/JavaPlugin,version=10.45.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll [2013-11-15] (Oracle Corporation)
    FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
    FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)
    FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_20_0_0_235.dll [2015-12-08] ()
    FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw.dll [No File]
    FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-02-21] ()
    FF Plugin-x32: @java.com/DTPlugin,version=10.65.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll [2014-07-11] (Oracle Corporation)
    FF Plugin-x32: @java.com/JavaPlugin,version=10.65.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll [2014-07-11] (Oracle Corporation)
    FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
    FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)
    FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2010-11-10] (Microsoft Corporation)
    FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2010-11-10] (Microsoft Corporation)
    FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-05] (Google Inc.)
    FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-05] (Google Inc.)
    FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll [2010-12-07] ()
    FF Plugin HKU\S-1-5-21-1678204619-2015826032-607794690-1001: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Tyler\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2013-11-09] (Unity Technologies ApS)
    FF Plugin HKU\S-1-5-21-1678204619-2015826032-607794690-1001: thehappycloud.com/HappyCloudPlugin -> C:\ProgramData\HappyCloud\Application\npHappyCloudPlugin.dll [2013-11-17] (The Happy Cloud)
    FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
    FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2015-12-23]

    Chrome:
    =======
    CHR HomePage: Default -> hxxp://www.msn.com/?pc=U038&ocid=U038DHP&dt=061713
    CHR StartupUrls: Default -> "hxxp://www.msn.com/?pc=U038&ocid=U038DHP&dt=061713"
    CHR DefaultSearchURL: Default -> hxxps://www.bing.com/search?q={searchTerms}&PC=U316&FORM=CHROMN
    CHR DefaultSearchKeyword: Default -> bing.com
    CHR DefaultNewTabURL: Default -> hxxps://www.bing.com/chrome/newtab
    CHR DefaultSuggestURL: Default -> hxxps://www.bing.com/osjson.aspx?query={searchTerms}&language={language}&PC=U316
    CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\47.0.2526.106\PepperFlash\pepflashplayer.dll ()
    CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\47.0.2526.106\ppGoogleNaClPluginChrome.dll => No File
    CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\47.0.2526.106\pdf.dll => No File
    CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
    CHR Plugin: (Java Deployment Toolkit 6.0.240.7) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll => No File
    CHR Plugin: (Java(TM) Platform SE 6 U24) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll => No File
    CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll => No File
    CHR Plugin: (Windows Live™ Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
    CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_202.dll => No File
    CHR Plugin: (Shockwave for Director) - C:\Windows\system32\Adobe\Director\np32dsw.dll => No File
    CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll => No File
    CHR Profile: C:\Users\Tyler\AppData\Local\Google\Chrome\User Data\Default
    CHR Extension: (Avast Online Security) - C:\Users\Tyler\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2015-12-23]
    CHR Extension: (Chrome Web Store Payments) - C:\Users\Tyler\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-12-23]
    CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-12-23]

    ==================== Services (Whitelisted) ========================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [354304 2011-02-28] (Advanced Micro Devices, Inc.) [File not signed]
    R2 AMD Reservation Manager; C:\Program Files\ATI Technologies\ATI.ACE\Reservation Manager\AMD Reservation Manager.exe [194496 2010-06-17] (Advanced Micro Devices)
    R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [226440 2015-12-23] (AVAST Software)
    R2 ezSharedSvc; C:\Windows\SysWOW64\ezSharedSvcHost.exe [514232 2010-04-23] (EasyBits Software AS) [File not signed]
    R2 HP Support Assistant Service; C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [92160 2013-11-04] (Hewlett-Packard Company) [File not signed]
    S4 HPAuto; C:\Program Files\Hewlett-Packard\HP Auto\HPAuto.exe [682040 2011-02-17] (Hewlett-Packard)
    R2 IconMan_R; C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [2375168 2011-03-07] (Realsil Microelectronics Inc.) [File not signed]
    R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

    ===================== Drivers (Whitelisted) ==========================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [28656 2015-12-23] (AVAST Software)
    R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [97648 2015-12-23] (AVAST Software)
    R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93528 2015-12-23] (AVAST Software)
    S0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65224 2015-12-23] (AVAST Software)
    R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1055560 2015-12-23] (AVAST Software)
    S1 aswSP; C:\Windows\system32\drivers\aswSP.sys [451040 2015-12-23] (AVAST Software)
    R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [155304 2015-12-23] (AVAST Software)
    R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [273784 2015-12-23] (AVAST Software)
    S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
    S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]
    S3 MBAMSwissArmy; \??\C:\Windows\system32\drivers\MBAMSwissArmy.sys [X]

    ==================== NetSvcs (Whitelisted) ===================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


    ==================== One Month Created files and folders ========

    (If an entry is included in the fixlist, the file/folder will be moved.)

    2015-12-24 01:59 - 2015-12-24 02:00 - 00000000 ____D C:\Windows\system32\config\mybackup
    2015-12-23 23:41 - 2015-12-23 23:43 - 00016064 _____ C:\Users\Tyler\Desktop\FRST.txt
    2015-12-23 23:39 - 2015-12-23 23:41 - 00000000 ____D C:\FRST
    2015-12-23 23:34 - 2015-12-23 23:34 - 00000000 ____D C:\Users\Tyler\AppData\Roaming\AVAST Software
    2015-12-23 23:33 - 2015-12-23 23:33 - 00003924 _____ C:\Windows\System32\Tasks\avast! Emergency Update
    2015-12-23 23:33 - 2015-12-23 23:33 - 00001922 _____ C:\Users\Public\Desktop\Avast Free Antivirus.lnk
    2015-12-23 23:33 - 2015-12-23 23:33 - 00000000 ____D C:\Windows\System32\Tasks\AVAST Software
    2015-12-23 23:33 - 2015-12-23 23:33 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVAST Software
    2015-12-23 23:32 - 2015-12-23 23:32 - 00002255 _____ C:\Users\Public\Desktop\Google Chrome.lnk
    2015-12-23 23:32 - 2015-12-23 23:32 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
    2015-12-23 23:31 - 2015-12-23 23:33 - 00451040 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys
    2015-12-23 23:31 - 2015-12-23 23:33 - 00097648 _____ (AVAST Software) C:\Windows\system32\Drivers\aswmonflt.sys
    2015-12-23 23:31 - 2015-12-23 23:31 - 02370560 _____ (Farbar) C:\Users\Tyler\Desktop\FRST64.exe
    2015-12-23 23:31 - 2015-12-23 23:31 - 01055560 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
    2015-12-23 23:31 - 2015-12-23 23:31 - 00450504 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys.1450931605098
    2015-12-23 23:31 - 2015-12-23 23:31 - 00386096 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
    2015-12-23 23:31 - 2015-12-23 23:31 - 00273784 _____ (AVAST Software) C:\Windows\system32\Drivers\aswVmm.sys
    2015-12-23 23:31 - 2015-12-23 23:31 - 00155304 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys
    2015-12-23 23:31 - 2015-12-23 23:31 - 00097648 _____ (AVAST Software) C:\Windows\system32\Drivers\aswmonflt.sys.1450931605098
    2015-12-23 23:31 - 2015-12-23 23:31 - 00093528 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
    2015-12-23 23:31 - 2015-12-23 23:31 - 00065224 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRvrt.sys
    2015-12-23 23:31 - 2015-12-23 23:31 - 00043112 _____ (AVAST Software) C:\Windows\avastSS.scr
    2015-12-23 23:31 - 2015-12-23 23:31 - 00028656 _____ (AVAST Software) C:\Windows\system32\Drivers\aswHwid.sys
    2015-12-23 23:29 - 2015-12-23 23:29 - 00450504 _____ (AVAST Software) C:\Windows\system32\Drivers\orgntxal.sys
    2015-12-23 23:29 - 2015-12-23 23:29 - 00000000 ____D C:\ProgramData\AVAST Software
    2015-12-23 23:29 - 2015-12-23 23:29 - 00000000 ____D C:\Program Files\AVAST Software
    2015-12-23 23:28 - 2015-12-23 23:29 - 161199376 _____ (AVAST Software) C:\Users\Tyler\Downloads\avast_free_antivirus_setup(1).exe
    2015-12-23 23:25 - 2015-12-23 23:26 - 161199376 _____ (AVAST Software) C:\Users\Tyler\Downloads\avast_free_antivirus_setup.exe
    2015-12-23 23:20 - 2015-12-23 23:20 - 00275208 _____ C:\Windows\Minidump\122315-39951-01.dmp
    2015-12-23 20:56 - 2015-02-02 22:30 - 00296448 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll
    2015-12-18 21:48 - 2015-12-18 21:48 - 00275208 _____ C:\Windows\Minidump\121815-37065-01.dmp
    2015-12-08 16:20 - 2015-12-08 19:52 - 00000000 ____D C:\51adb6f5be27b08953c7
    2015-12-06 18:09 - 2015-12-06 18:09 - 00275208 _____ C:\Windows\Minidump\120615-29889-01.dmp
    2015-12-05 05:24 - 2015-11-20 14:40 - 00163328 _____ C:\Windows\ERDNT.E_E
    2015-12-05 05:24 - 2015-11-20 14:40 - 00157696 _____ C:\Windows\ERUNT.exe
    2015-12-05 05:24 - 2015-11-20 14:36 - 00004090 _____ C:\Windows\ERUNT.LOC
    2015-12-05 05:24 - 2015-11-20 14:36 - 00003275 _____ C:\Windows\ERDNTWIN.LOC
    2015-12-05 05:24 - 2015-11-20 14:36 - 00002815 _____ C:\Windows\ERDNTDOS.LOC
    2015-12-03 15:09 - 2015-12-03 15:09 - 00275208 _____ C:\Windows\Minidump\120315-69280-01.dmp

    ==================== One Month Modified files and folders ========

    (If an entry is included in the fixlist, the file/folder will be moved.)

    2015-12-24 01:54 - 2015-04-05 18:30 - 00000000 ___SD C:\Windows\SysWOW64\GWX
    2015-12-24 01:54 - 2015-04-05 18:30 - 00000000 ___SD C:\Windows\system32\GWX
    2015-12-24 01:54 - 2014-12-10 03:25 - 00000000 ____D C:\Windows\system32\appraiser
    2015-12-24 01:54 - 2014-05-06 19:03 - 00000000 ___SD C:\Windows\system32\CompatTel
    2015-12-24 01:54 - 2013-06-26 20:21 - 00000000 ____D C:\Program Files (x86)\Steam
    2015-12-24 01:54 - 2013-05-29 18:58 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
    2015-12-24 01:54 - 2013-05-29 18:58 - 00000000 ____D C:\Program Files\Microsoft Silverlight
    2015-12-24 01:54 - 2013-05-29 18:58 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
    2015-12-24 01:54 - 2011-05-31 14:59 - 00000000 ____D C:\ProgramData\RoxioNow
    2015-12-24 01:54 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\SysWOW64\Dism
    2015-12-24 01:54 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\system32\Dism
    2015-12-24 01:54 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\servicing
    2015-12-24 01:54 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\PolicyDefinitions
    2015-12-24 01:54 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\inf
    2015-12-24 01:54 - 2009-07-13 22:20 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared
    2015-12-24 01:52 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\registration
    2015-12-23 23:39 - 2009-07-13 22:20 - 00000000 ____D C:\Windows
    2015-12-23 23:33 - 2015-08-21 07:42 - 00000000 ____D C:\Program Files\Common Files\AV
    2015-12-23 23:32 - 2013-05-19 12:41 - 00000000 ____D C:\Program Files (x86)\Google
    2015-12-23 23:29 - 2009-07-13 23:45 - 00032064 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
    2015-12-23 23:29 - 2009-07-13 23:45 - 00032064 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
    2015-12-23 23:21 - 2013-05-19 12:41 - 00000894 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
    2015-12-23 23:21 - 2009-07-14 00:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
    2015-12-23 23:20 - 2013-06-17 14:14 - 559640583 _____ C:\Windows\MEMORY.DMP
    2015-12-23 23:20 - 2013-06-17 14:14 - 00000000 ____D C:\Windows\Minidump
    2015-12-23 23:20 - 2011-06-13 09:46 - 00000000 ____D C:\ProgramData\Norton
    2015-12-23 23:05 - 2013-05-19 12:03 - 00000000 ____D C:\Users\Tyler
    2015-12-20 02:21 - 2013-05-19 12:40 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
    2015-12-20 01:58 - 2013-05-19 12:41 - 00000898 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
    2015-12-20 00:23 - 2009-07-14 00:13 - 00782510 _____ C:\Windows\system32\PerfStringBackup.INI
    2015-12-19 00:16 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\rescache
    2015-12-08 18:21 - 2013-05-19 12:40 - 00796864 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
    2015-12-08 18:21 - 2013-05-19 12:40 - 00142528 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
    2015-12-08 18:21 - 2013-05-19 12:40 - 00003768 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
    2015-12-08 17:10 - 2015-02-25 17:41 - 00000000 ____D C:\Users\Tyler\AppData\Local\Steam
    2015-12-05 11:53 - 2013-05-19 12:41 - 00003894 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
    2015-12-05 11:53 - 2013-05-19 12:41 - 00003642 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
    2015-12-03 01:10 - 2013-05-19 12:41 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive
    2015-12-02 13:18 - 2010-11-20 22:27 - 00301728 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
    2015-11-28 07:04 - 2011-06-13 10:30 - 00000000 ___RD C:\Users\Public\Recorded TV
    2015-11-27 03:57 - 2014-11-23 10:59 - 00000000 ____D C:\Users\Tyler\AppData\Local\Battle.net
    2015-11-26 19:02 - 2013-06-26 19:14 - 00000000 ____D C:\Users\Tyler\Documents\StarCraft II
    2015-11-26 19:02 - 2013-06-26 19:14 - 00000000 ____D C:\Program Files (x86)\StarCraft II
    2015-11-26 15:43 - 2013-06-11 19:43 - 00000000 ____D C:\Users\Public\Downloads\Norton
    2015-11-26 15:30 - 2014-11-23 10:59 - 00000000 ____D C:\Program Files (x86)\Battle.net

    ==================== Files in the root of some directories =======

    2014-02-26 17:19 - 2014-02-26 17:19 - 4216840 _____ (Microsoft Corporation) C:\Program Files (x86)\Common Files\vcredist.exe
    2014-05-13 16:53 - 2014-05-13 16:53 - 0000017 _____ () C:\Users\Tyler\AppData\Local\resmon.resmoncfg
    2015-09-01 08:51 - 2015-09-01 08:51 - 0000000 _____ () C:\Users\Tyler\AppData\Local\{3FDC0C10-1031-4610-8702-F62F1EA865E3}
    2015-08-23 11:07 - 2015-08-23 11:16 - 0001318 _____ () C:\ProgramData\hpzinstall.log
    2014-05-05 16:44 - 2014-05-05 16:44 - 0000113 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.400.32.bc
    C:\Windows\svchost.exe
    ATTENTION ====> Check for partition/boot infection.

    Some files in TEMP:
    ====================
    C:\Users\Tyler\AppData\Local\Temp\contentDATs.exe
    C:\Users\Tyler\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpodovoa.dll
    C:\Users\Tyler\AppData\Local\Temp\Extract.exe
    C:\Users\Tyler\AppData\Local\Temp\HPHelpUpdater.exe
    C:\Users\Tyler\AppData\Local\Temp\ICReinstall_Firefox_Setup_21.0.exe
    C:\Users\Tyler\AppData\Local\Temp\jre-7u21-windows-i586-iftw.exe
    C:\Users\Tyler\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe
    C:\Users\Tyler\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe
    C:\Users\Tyler\AppData\Local\Temp\mssinstaller.exe
    C:\Users\Tyler\AppData\Local\Temp\PCPTUpdate.exe
    C:\Users\Tyler\AppData\Local\Temp\Resource.exe
    C:\Users\Tyler\AppData\Local\Temp\SecurityScan_Release.exe
    C:\Users\Tyler\AppData\Local\Temp\SP53394.exe
    C:\Users\Tyler\AppData\Local\Temp\SP55040.exe
    C:\Users\Tyler\AppData\Local\Temp\SP55151.exe
    C:\Users\Tyler\AppData\Local\Temp\SP55152.exe
    C:\Users\Tyler\AppData\Local\Temp\SP56878.exe
    C:\Users\Tyler\AppData\Local\Temp\SP56929.exe
    C:\Users\Tyler\AppData\Local\Temp\SP57538.exe
    C:\Users\Tyler\AppData\Local\Temp\sp58915.exe
    C:\Users\Tyler\AppData\Local\Temp\SP60593.exe
    C:\Users\Tyler\AppData\Local\Temp\sp64126.exe
    C:\Users\Tyler\AppData\Local\Temp\UninstallHPSA.exe
    C:\Users\Tyler\AppData\Local\Temp\UninstallHPTCA.exe
    C:\Users\Tyler\AppData\Local\Temp\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}_NIS_7707.exe


    ==================== Bamital & volsnap =================

    (There is no automatic fix for files that do not pass verification.)

    C:\Windows\system32\winlogon.exe => File is digitally signed
    C:\Windows\system32\wininit.exe => File is digitally signed
    C:\Windows\SysWOW64\wininit.exe => File is digitally signed
    C:\Windows\explorer.exe => File is digitally signed
    C:\Windows\SysWOW64\explorer.exe => File is digitally signed
    C:\Windows\system32\svchost.exe => File is digitally signed
    C:\Windows\SysWOW64\svchost.exe => File is digitally signed
    C:\Windows\system32\services.exe => File is digitally signed
    C:\Windows\system32\User32.dll => File is digitally signed
    C:\Windows\SysWOW64\User32.dll => File is digitally signed
    C:\Windows\system32\userinit.exe => File is digitally signed
    C:\Windows\SysWOW64\userinit.exe => File is digitally signed
    C:\Windows\system32\rpcss.dll => File is digitally signed
    C:\Windows\system32\dnsapi.dll => File is digitally signed
    C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
    C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

    TDL4: custom:26000022 <===== ATTENTION


    LastRegBack: 2015-12-16 21:58

    ==================== End of FRST.txt ============================
     
  2. Tyler Olsen

    Tyler Olsen TS Rookie Topic Starter

    Here is the other log:

    Additional scan result of Farbar Recovery Scan Tool (x64) Version:23-12-2015
    Ran by Tyler (2015-12-23 23:44:05)
    Running from C:\Users\Tyler\Desktop
    Windows 7 Home Premium Service Pack 1 (X64) (2013-05-19 17:03:23)
    Boot Mode: Normal
    ==========================================================


    ==================== Accounts: =============================

    Administrator (S-1-5-21-1678204619-2015826032-607794690-500 - Administrator - Disabled)
    Guest (S-1-5-21-1678204619-2015826032-607794690-501 - Limited - Disabled)
    HomeGroupUser$ (S-1-5-21-1678204619-2015826032-607794690-1003 - Limited - Enabled)
    Tyler (S-1-5-21-1678204619-2015826032-607794690-1001 - Administrator - Enabled) => C:\Users\Tyler

    ==================== Security Center ========================

    (If an entry is included in the fixlist, it will be removed.)

    AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
    AS: Windows Defender (Enabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

    ==================== Installed Programs ======================

    (Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

    Adobe Flash Player 20 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 20.0.0.228 - Adobe Systems Incorporated)
    Adobe Flash Player 20 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 20.0.0.235 - Adobe Systems Incorporated)
    Adobe Reader X MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}) (Version: 10.0.0 - Adobe Systems Incorporated)
    Adobe Shockwave Player 11.5 (HKLM-x32\...\Adobe Shockwave Player) (Version: 11.5.9.620 - Adobe Systems, Inc.)
    Agatha Christie - Peril at End House (x32 Version: 2.2.0.95 - WildTangent) Hidden
    Age of Empires II: HD Edition (HKLM-x32\...\Steam App 221380) (Version: - Hidden Path Entertainment, Ensemble Studios)
    Apple Application Support (32-bit) (HKLM-x32\...\{7FE25256-B7C1-480D-B736-10A67A833AEA}) (Version: 3.2 - Apple Inc.)
    Apple Application Support (HKLM-x32\...\{D9DAD0FF-495A-472B-9F10-BAE430A26682}) (Version: 3.0.3 - Apple Inc.)
    Apple Mobile Device Support (HKLM\...\{787136D2-F0F8-4625-AA3F-72D7795AC842}) (Version: 7.1.1.3 - Apple Inc.)
    Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
    ATI Catalyst Install Manager (HKLM\...\{7FBA6627-88F8-0AE0-9326-FB8488DD26E0}) (Version: 3.0.812.0 - ATI Technologies, Inc.)
    Avast Free Antivirus (HKLM-x32\...\Avast) (Version: 11.1.2245 - AVAST Software)
    Battle.net (HKLM-x32\...\Battle.net) (Version: - Blizzard Entertainment)
    BeamNG-Techdemo-0.3 (remove only) (HKU\S-1-5-21-1678204619-2015826032-607794690-1001\...\BeamNG-Techdemo-0.3) (Version: - )
    Bejeweled 2 Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
    Bejeweled 3 (x32 Version: 2.2.0.95 - WildTangent) Hidden
    Bing Bar (HKLM-x32\...\{1E03DB52-D5CB-4338-A338-E526DD4D4DB1}) (Version: 7.0.610.0 - Microsoft Corporation)
    Blackhawk Striker 2 (x32 Version: 2.2.0.95 - WildTangent) Hidden
    Blasterball 3 (x32 Version: 2.2.0.95 - WildTangent) Hidden
    Blio (HKLM-x32\...\{9368DDD5-CE7F-4BD7-A83A-F00FABE338EC}) (Version: 2.2.6699 - K-NFB Reading Technology, Inc.)
    Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
    Bounce Symphony (x32 Version: 2.2.0.95 - WildTangent) Hidden
    Build-a-lot 2 (x32 Version: 2.2.0.95 - WildTangent) Hidden
    Cake Mania (x32 Version: 2.2.0.95 - WildTangent) Hidden
    ccc-core-static (x32 Version: 2011.0228.1151.21177 - ATI) Hidden
    Chuzzle Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
    Classic PDF Editor 12.0 (HKLM-x32\...\Classic PDF Editor_is1) (Version: - )
    CyberLink YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 3.5.1.3922 - CyberLink Corp.)
    D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
    Diner Dash 2 Restaurant Rescue (x32 Version: 2.2.0.95 - WildTangent) Hidden
    Dora's World Adventure (x32 Version: 2.2.0.95 - WildTangent) Hidden
    Dota 2 (HKLM-x32\...\Steam App 570) (Version: - Valve)
    Dota 2 Test (HKLM-x32\...\Steam App 205790) (Version: - )
    Energy Star Digital Logo (HKLM-x32\...\{BD1A34C9-4764-4F79-AE1F-112F8C89D3D4}) (Version: 1.0.1 - Hewlett-Packard)
    ESU for Microsoft Windows 7 (HKLM-x32\...\{3877C901-7B90-4727-A639-B6ED2DD59D43}) (Version: 1.0.0 - Hewlett-Packard)
    Evernote v. 4.2.2 (HKLM-x32\...\{F761359C-9CED-45AE-9A51-9D6605CD55C4}) (Version: 4.2.2.3979 - Evernote Corp.)
    Farm Frenzy (x32 Version: 2.2.0.95 - WildTangent) Hidden
    FATE - The Traitor Soul (x32 Version: 2.2.0.95 - WildTangent) Hidden
    Garry's Mod (HKLM-x32\...\Steam App 4000) (Version: - Garry)
    Google Chrome (HKLM-x32\...\Google Chrome) (Version: 47.0.2526.106 - Google Inc.)
    Google Drive (HKLM-x32\...\{1C3D2F92-D25E-4D98-B810-3F3B0857BF26}) (Version: 1.26.0707.2863 - Google, Inc.)
    Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
    Google Update Helper (x32 Version: 1.3.29.1 - Google Inc.) Hidden
    Happy Cloud Client (HKU\S-1-5-21-1678204619-2015826032-607794690-1001\...\HappyCloud) (Version: 4.54 - Happy Cloud, Inc.)
    HP Connection Manager (HKLM-x32\...\{7A6B4340-7090-418F-8976-EE9650B35550}) (Version: 4.1.22.1 - Hewlett-Packard Company)
    HP Documentation (HKLM-x32\...\{6C453C9C-38AE-494D-BF89-7AA0DE87F3E5}) (Version: 1.2.0.0 - Hewlett-Packard)
    HP Games (HKLM-x32\...\WildTangent hp Master Uninstall) (Version: 1.0.2.4 - WildTangent)
    HP MovieStore (HKLM-x32\...\{9008D736-35CA-40DB-A2BE-5F32D954E5AA}) (Version: 2.0 - Hewlett-Packard)
    HP On Screen Display (HKLM-x32\...\{ED1BD69A-07E3-418C-91F1-D856582581BF}) (Version: 1.3.5 - Hewlett-Packard Company)
    HP Power Manager (HKLM-x32\...\{E44578C7-4667-4124-8BC2-1161BCA54978}) (Version: 1.4.4 - Hewlett-Packard Company)
    HP Quick Launch (HKLM-x32\...\{53B17A98-5BF0-40BC-AAFF-850A357975AC}) (Version: 2.7.2 - Hewlett-Packard Company)
    HP Setup (HKLM-x32\...\{210A03F5-B2ED-4947-B27E-516F50CBB292}) (Version: 8.6.4530.3651 - Hewlett-Packard Company)
    HP Setup Manager (HKLM-x32\...\{AE856388-AFAD-4753-81DF-D96B19D0A17C}) (Version: 1.1.13253.3682 - Hewlett-Packard Company)
    HP Software Framework (HKLM-x32\...\{962CB079-85E6-405F-8704-1C62365AE46F}) (Version: 4.5.10.1 - Hewlett-Packard Company)
    iCloud (HKLM\...\{81E20D41-C277-4526-934D-F2380AF91B78}) (Version: 3.1.0.40 - Apple Inc.)
    IDT Audio (HKLM-x32\...\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6327.0 - IDT)
    iTunes (HKLM\...\{1CF5754A-545B-4360-BFDE-2847BC728DFC}) (Version: 11.2.0.115 - Apple Inc.)
    Java 7 Update 45 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86417045FF}) (Version: 7.0.450 - Oracle)
    Java 7 Update 65 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217025FF}) (Version: 7.0.650 - Oracle)
    Java(TM) 6 Update 24 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86416024FF}) (Version: 6.0.240 - Oracle)
    Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
    Magic Desktop (HKLM-x32\...\EasyBits Magic Desktop) (Version: 3.0 - EasyBits Software AS)
    Magic: The Gathering – Tactics (HKLM-x32\...\Steam App 201190) (Version: - Sony Online Entertainment, LLC.)
    Mah Jong Medley (x32 Version: 2.2.0.95 - WildTangent) Hidden
    March of War (HKLM-x32\...\Steam App 234310) (Version: - ISOTX)
    Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
    Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
    Microsoft Office 2010 (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
    Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40728.0 - Microsoft Corporation)
    Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{A49F249F-0C91-497F-86DF-B2585E8E76B7}) (Version: 8.0.50727.42 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
    Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
    Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
    Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
    Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
    Mount&Blade (HKLM-x32\...\Mount&Blade) (Version: - )
    Mount&Blade Warband (HKLM-x32\...\Mount&Blade Warband) (Version: - )
    Mozilla Firefox 40.0.3 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 40.0.3 (x86 en-US)) (Version: 40.0.3 - Mozilla)
    Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 40.0.3 - Mozilla)
    MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
    MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
    Mystery P.I. - Stolen in San Francisco (x32 Version: 2.2.0.95 - WildTangent) Hidden
    Namco All-Stars PAC-MAN (x32 Version: 2.2.0.95 - WildTangent) Hidden
    OpenOffice 4.1.1 (HKLM-x32\...\{9395F41D-0F80-432E-9A59-B8E477E7E163}) (Version: 4.11.9775 - Apache Software Foundation)
    Paint XP version 1.2 (HKLM-x32\...\{2367FAB6-055A-4923-835F-F57F7BBBA363}_is1) (Version: 1.2 - MSPAINTXP.COM)
    Pearson IT Certification Practice Test (HKLM-x32\...\Pearson IT Certification Practice Test_is1) (Version: 1.0.0.21 - Pearson IT Certification)
    Penguins! (x32 Version: 2.2.0.95 - WildTangent) Hidden
    Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.95 - WildTangent) Hidden
    PlayReady PC Runtime x86 (HKLM-x32\...\{CCA5EAAD-92F4-4B7A-B5EE-14294C66AB61}) (Version: 1.3.0 - Microsoft Corporation)
    Poker Superstars III (x32 Version: 2.2.0.95 - WildTangent) Hidden
    Polar Bowler (x32 Version: 2.2.0.95 - WildTangent) Hidden
    Polar Golfer (x32 Version: 2.2.0.95 - WildTangent) Hidden
    Portal 2 (HKLM-x32\...\Steam App 620) (Version: - Valve)
    Portal 2 Publishing Tool (HKLM-x32\...\Steam App 644) (Version: - )
    QuickTime 7 (HKLM-x32\...\{111EE7DF-FC45-40C7-98A7-753AC46B12FB}) (Version: 7.75.80.95 - Apple Inc.)
    Ralink RT5390 802.11b/g/n WiFi Adapter (HKLM-x32\...\{8FC4F1DD-F7FD-4766-804D-3C8FF1D309AF}) (Version: 3.2.13.0 - Ralink)
    Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.46.610.2011 - Realtek)
    Realtek PCIE Card Reader (HKLM-x32\...\{C1594429-8296-4652-BF54-9DBE4932A44C}) (Version: 6.1.7600.77 - Realtek Semiconductor Corp.)
    Recovery Manager (x32 Version: 2.0.0 - Hewlett-Packard) Hidden
    RoxioNow Player (HKLM-x32\...\{0EDEB615-1A60-425E-8306-0E10519C7B55}) (Version: 1.9.5.103 - RoxioNow)
    Slingo Supreme (x32 Version: 2.2.0.95 - WildTangent) Hidden
    StarCraft II (HKLM-x32\...\StarCraft II) (Version: - Blizzard Entertainment)
    Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)
    Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.2.7.0 - Synaptics Incorporated)
    System Requirements Lab Detection (HKLM-x32\...\{E5F486A0-2AAB-4B32-82E1-36FFBFB06A27}) (Version: 2.0.0.0 - Husdawg, LLC)
    Team Fortress 2 (HKLM-x32\...\Steam App 440) (Version: - Valve)
    TERA (HKU\S-1-5-21-1678204619-2015826032-607794690-1001\...\teraenmasse) (Version: - )
    The Witcher 2: Assassins of Kings Enhanced Edition (HKLM-x32\...\Steam App 20920) (Version: - CD Projekt RED)
    The Witcher Enhanced Edition version 1.6 (HKLM-x32\...\The Witcher Enhanced Edition_is1) (Version: 1.6 - CD Projekt RED)
    Toribash (HKLM-x32\...\Steam App 248570) (Version: - Nabi Studios)
    Unity Web Player (HKU\S-1-5-21-1678204619-2015826032-607794690-1001\...\UnityWebPlayer) (Version: - Unity Technologies ApS)
    Update Installer for WildTangent Games App (x32 Version: - WildTangent) Hidden
    Vindictus (HKLM-x32\...\Steam App 212160) (Version: - Nexon)
    Virtual Villagers 4 - The Tree of Life (x32 Version: 2.2.0.95 - WildTangent) Hidden
    Warframe (HKLM-x32\...\Steam App 230410) (Version: - Digital Extremes)
    Wheel of Fortune 2 (x32 Version: 2.2.0.95 - WildTangent) Hidden
    WildTangent Games App (HP Games) (x32 Version: 4.0.5.2 - WildTangent) Hidden
    Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3508.1109 - Microsoft Corporation)
    Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation)
    WinRAR 4.20 (64-bit) (HKLM\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)
    WMV9/VC-1 Video Playback (Version: 1.00.0000 - ATI Technologies Inc.) Hidden
    World of Guns: Gun Disassembly (HKLM-x32\...\Steam App 262410) (Version: - Noble Empire Corp.)
    Zuma Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden

    ==================== Custom CLSID (Whitelisted): ==========================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    CustomCLSID: HKU\S-1-5-21-1678204619-2015826032-607794690-1001_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Tyler\AppData\Roaming\Dropbox\bin\Dropbox.exe /autoplay => No File

    ==================== Restore Points =========================

    20-12-2015 18:52:18 Windows Update
    23-12-2015 19:36:10 Windows Update

    ==================== Hosts content: ===============================

    (If needed Hosts: directive could be included in the fixlist to reset Hosts.)

    2009-07-13 21:34 - 2009-06-10 16:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts


    ==================== Scheduled Tasks (Whitelisted) =============

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    Task: {16C5582F-7601-494A-8B32-AE8E5D025976} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2015-12-23] (AVAST Software)
    Task: {277E38F3-D563-4650-BFD7-2405B0415030} - System32\Tasks\MirageAgent => C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe [2011-03-22] (CyberLink)
    Task: {30E091AB-02F0-47E1-9EE6-45F981C49E19} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> No File <==== ATTENTION
    Task: {428DCFD7-902E-4319-A25C-081CE620076A} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> No File <==== ATTENTION
    Task: {42ACCD36-B458-478D-89FC-F5E3DF34ADFF} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HPSAObjUtilTask => C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\UtilTask.exe
    Task: {4EE574B7-3DF3-445F-B9E3-36C085ECD2A6} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_DeviceScan => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2013-10-15] (Hewlett-Packard)
    Task: {4F1BC21B-E09F-4DAC-9EE0-95D31E612159} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
    Task: {555F9802-DDDC-46F5-8D83-1909DB0B3FD7} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2013-10-15] (Hewlett-Packard)
    Task: {833D74F3-C3A5-4195-8D51-2882BEC81961} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-09-01] (Google Inc.)
    Task: {97F8AAE5-DACA-4853-811A-A6A21985E15F} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> No File <==== ATTENTION
    Task: {BB03E254-1D23-456A-820C-62A3DE5ADA36} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION
    Task: {C62A5195-EE4F-4E56-81B0-4BD047D9EBC9} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> No File <==== ATTENTION
    Task: {CC904A7B-B7FF-45F8-B44F-212B10B9EDE6} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> No File <==== ATTENTION
    Task: {D5835D46-47BA-4166-B757-23DFC04381C5} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-12-08] (Adobe Systems Incorporated)
    Task: {E311FF06-9681-41F8-89F9-A43F11000555} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-09-01] (Google Inc.)
    Task: {E3E2A214-6E94-4968-8CB1-D1FCCF5B046D} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> No File <==== ATTENTION
    Task: {FEF11329-E2C2-4990-88A5-1F63DEE50D57} - System32\Tasks\AVAST Software\Avast settings backup => C:\Program Files\Common Files\AV\avast! Antivirus\backup.exe [2015-12-23] (AVAST Software)

    (If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

    Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
    Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

    ==================== Shortcuts =============================

    (The entries could be listed to be restored or removed.)

    ==================== Loaded Modules (Whitelisted) ==============

    2011-02-28 14:01 - 2011-02-28 14:01 - 00079872 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Container.Services.dll
    2011-02-28 14:01 - 2011-02-28 14:01 - 00073728 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Container.Wlan.dll
    2014-04-23 15:05 - 2014-04-23 15:05 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
    2015-05-15 15:27 - 2015-05-15 15:27 - 01044776 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
    2015-12-23 23:31 - 2015-12-23 23:31 - 00103888 _____ () C:\Program Files\AVAST Software\Avast\log.dll
    2015-12-23 23:31 - 2015-12-23 23:31 - 00125512 _____ () C:\Program Files\AVAST Software\Avast\JsonRpcServer.dll
    2015-12-23 23:31 - 2015-12-23 23:31 - 02813440 _____ () C:\Program Files\AVAST Software\Avast\defs\15120101\algo.dll
    2015-12-23 23:31 - 2015-12-23 23:31 - 00469008 _____ () C:\Program Files\AVAST Software\Avast\ffl2.dll
    2015-12-23 23:31 - 2015-12-23 23:31 - 00241896 _____ () C:\Program Files\AVAST Software\Avast\browser_pass.dll
    2015-12-23 23:36 - 2015-12-23 23:36 - 02806272 _____ () C:\Program Files\AVAST Software\Avast\defs\15122302\algo.dll
    2015-12-23 23:31 - 2015-12-23 23:31 - 40539648 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
    2015-12-23 23:32 - 2015-12-10 22:54 - 01583432 _____ () C:\Program Files (x86)\Google\Chrome\Application\47.0.2526.106\libglesv2.dll
    2015-12-23 23:32 - 2015-12-10 22:54 - 00081224 _____ () C:\Program Files (x86)\Google\Chrome\Application\47.0.2526.106\libegl.dll
    2015-12-23 23:32 - 2015-12-10 22:54 - 16573256 _____ () C:\Program Files (x86)\Google\Chrome\Application\47.0.2526.106\PepperFlash\pepflashplayer.dll

    ==================== Alternate Data Streams (Whitelisted) =========

    (If an entry is included in the fixlist, only the ADS will be removed.)


    ==================== Safe Mode (Whitelisted) ===================

    (If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


    ==================== EXE Association (Whitelisted) ===============

    (If an entry is included in the fixlist, the registry item will be restored to default or removed.)


    ==================== Internet Explorer trusted/restricted ===============

    (If an entry is included in the fixlist, it will be removed from the registry.)

    IE trusted site: HKU\S-1-5-21-1678204619-2015826032-607794690-1001\...\clonewarsadventures.com -> clonewarsadventures.com
    IE trusted site: HKU\S-1-5-21-1678204619-2015826032-607794690-1001\...\freerealms.com -> freerealms.com
    IE trusted site: HKU\S-1-5-21-1678204619-2015826032-607794690-1001\...\soe.com -> soe.com
    IE trusted site: HKU\S-1-5-21-1678204619-2015826032-607794690-1001\...\sony.com -> sony.com

    ==================== Other Areas ============================

    (Currently there is no automatic fix for this section.)

    HKU\S-1-5-21-1678204619-2015826032-607794690-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Tyler\AppData\Roaming\Mozilla\Firefox\Desktop Background.bmp
    DNS Servers: 192.168.1.1
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
    Windows Firewall is enabled.

    ==================== MSCONFIG/TASK MANAGER disabled items ==

    (Currently there is no automatic fix for this section.)

    MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^McAfee Security Scan Plus.lnk => C:\Windows\pss\McAfee Security Scan Plus.lnk.CommonStartup
    MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
    MSCONFIG\startupreg: Adobe Reader Speed Launcher => "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe"
    MSCONFIG\startupreg: APSDaemon => "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
    MSCONFIG\startupreg: Easybits Recovery => C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe
    MSCONFIG\startupreg: HP Quick Launch => C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
    MSCONFIG\startupreg: HPConnectionManager => C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\HPCMDelayStart.exe
    MSCONFIG\startupreg: HPOSD => C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe
    MSCONFIG\startupreg: iTunesHelper => "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
    MSCONFIG\startupreg: Logitech Download Assistant => C:\Windows\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch
    MSCONFIG\startupreg: Magic Desktop for HP notification => "C:\ProgramData\Easybits Magic Desktop for HP\mdhpSUN.exe"
    MSCONFIG\startupreg: PDFVPrinter => C:\Program Files (x86)\Classic PDF Editor\PDFVPrinter.exe
    MSCONFIG\startupreg: QuickTime Task => "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
    MSCONFIG\startupreg: StartCCC => "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
    MSCONFIG\startupreg: Steam => "C:\Program Files (x86)\Steam\steam.exe" -silent
    MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
    MSCONFIG\startupreg: SynTPEnh => %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
    MSCONFIG\startupreg: SysTrayApp => C:\Program Files\IDT\WDM\sttray64.exe

    ==================== FirewallRules (Whitelisted) ===============

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    FirewallRules: [{D80812DA-0736-46D3-8F6A-D036080F593A}] => (Allow) C:\Program Files (x86)\Roxio\RoxioNow Player\RNowShell.exe
    FirewallRules: [{6F006E3A-F14A-4E44-9419-9D2AE4D2A323}] => (Allow) C:\Program Files (x86)\Roxio\RoxioNow Player\RNowShell.exe
    FirewallRules: [{9D639BBC-A1F2-4292-87E4-729859EC0906}] => (Allow) C:\Program Files (x86)\Hewlett-Packard\MediaSmart\RoxioNow\RNow.exe
    FirewallRules: [{7E0BBBB3-EA91-47D7-B2F7-BD04A5E9D299}] => (Allow) C:\Program Files (x86)\Hewlett-Packard\MediaSmart\RoxioNow\RNow.exe
    FirewallRules: [{D0A5D0EE-B7E7-4E3B-8B87-335F571245E3}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
    FirewallRules: [{91525777-5653-4D2C-95B4-E15B13419CCE}] => (Allow) LPort=2869
    FirewallRules: [{E15AEDE4-CEA9-40B2-82FF-74942785388F}] => (Allow) LPort=1900
    FirewallRules: [{F597AA5A-C59E-4F6E-BDB3-42BD86EE4BE2}] => (Allow) C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
    FirewallRules: [{ABCBAF38-FB38-4D32-80DE-3B608FEAB3EE}] => (Allow) C:\Program Files (x86)\Windows Live\Mesh\MOE.exe
    FirewallRules: [{B82BE985-578C-49BF-9CA5-2A7CDB884FF2}] => (Allow) C:\Windows\system32\ezSharedSvcHost.exe
    FirewallRules: [{F62ECF7E-2BEB-42C0-AB5B-F2D209652F3B}] => (Allow) C:\Program Files (x86)\EasyBits For Kids\ezDesktop.exe
    FirewallRules: [{7215093A-0AB7-41F7-B5B4-794AD2398F37}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.1675\Agent.exe
    FirewallRules: [{5FC40F34-313E-4413-980E-01D4A05E2D36}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.1675\Agent.exe
    FirewallRules: [{5B41CAF3-FE39-4375-AF72-A01FFE2D1E83}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.1737\Agent.exe
    FirewallRules: [{AB78F274-1494-443D-97E3-601D1781EB85}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.1737\Agent.exe
    FirewallRules: [{778ED716-D00C-4594-9CEC-6D29D18FECFC}] => (Allow) C:\Program Files (x86)\StarCraft II\StarCraft II.exe
    FirewallRules: [{38EF5443-736C-42ED-BC97-2F536DDC2E9A}] => (Allow) C:\Program Files (x86)\StarCraft II\StarCraft II.exe
    FirewallRules: [{E6951663-BEB3-4F43-A9CE-2D044345FBFF}] => (Allow) C:\Program Files (x86)\StarCraft II\StarCraft II Public Test.exe
    FirewallRules: [{2BEC42CF-7A33-42CF-9C52-8642ACBB16C5}] => (Allow) C:\Program Files (x86)\StarCraft II\StarCraft II Public Test.exe
    FirewallRules: [{BC86281A-8EFB-4EEE-A9B6-ACF4FE71C177}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
    FirewallRules: [{6151DFF3-373F-48E2-9412-43484D3D9DA5}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
    FirewallRules: [{5AC3F912-86CD-4566-BBA4-4C2DBE0C94FC}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Warframe\Warframe.exe
    FirewallRules: [{BFD8B518-D0C2-41FD-AFF6-82C789973675}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Warframe\Warframe.x64.exe
    FirewallRules: [{711A348D-C5E0-4EC5-80BF-B0BBCEFF769C}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Warframe\Warframe.exe
    FirewallRules: [{04E0693D-EE5B-42FD-9E49-A0568DA47B4F}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Warframe\Warframe.x64.exe
    FirewallRules: [{99ABC882-D92A-463E-A194-C4AC15E34360}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Warframe\Warframe.exe
    FirewallRules: [{A9F18873-0AE3-4828-A1DC-EAED03607BB6}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Warframe\Warframe.x64.exe
    FirewallRules: [{D9071DB6-9195-40E1-980B-5C8DB002543B}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Warframe\Tools\Launcher.exe
    FirewallRules: [{360452A2-B797-437E-962D-915B0B28DEE1}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Vindictus\en-US\NMService.exe
    FirewallRules: [{0E34808A-0FD8-4C66-8209-AB82B2C61C61}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Vindictus\en-US\NMService.exe
    FirewallRules: [TCP Query User{C8C87125-7D41-43E3-B394-DF7E2D0D2FF6}C:\program files\java\jre6\bin\javaw.exe] => (Allow) C:\program files\java\jre6\bin\javaw.exe
    FirewallRules: [UDP Query User{267D0F12-F9B1-4EC1-9018-BE940982FAD2}C:\program files\java\jre6\bin\javaw.exe] => (Allow) C:\program files\java\jre6\bin\javaw.exe
    FirewallRules: [TCP Query User{94EDFF17-BF37-4BB6-9314-B356FC5C229C}C:\program files\java\jre6\bin\javaw.exe] => (Allow) C:\program files\java\jre6\bin\javaw.exe
    FirewallRules: [UDP Query User{D2D73008-CF5F-4904-A3F5-0162DFC3B965}C:\program files\java\jre6\bin\javaw.exe] => (Allow) C:\program files\java\jre6\bin\javaw.exe
    FirewallRules: [{75B2299F-27DA-4FAA-A7E1-2B5B3B8C0CA7}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2045\Agent.exe
    FirewallRules: [{59399AD6-AEC4-4138-AF93-9ACAF679339B}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2045\Agent.exe
    FirewallRules: [TCP Query User{E717D5A2-AD16-4E67-9DC4-29053F7877EE}C:\program files (x86)\starcraft ii\versions\base24944\sc2.exe] => (Allow) C:\program files (x86)\starcraft ii\versions\base24944\sc2.exe
    FirewallRules: [UDP Query User{324902F3-3180-471F-B870-08018CE3E0AE}C:\program files (x86)\starcraft ii\versions\base24944\sc2.exe] => (Allow) C:\program files (x86)\starcraft ii\versions\base24944\sc2.exe
    FirewallRules: [TCP Query User{F2F695DF-D86F-4D69-99D2-E364E155FC35}C:\program files (x86)\steam\steamapps\common\the witcher 2\bin\witcher2.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\the witcher 2\bin\witcher2.exe
    FirewallRules: [UDP Query User{2D4B482F-051C-4687-80C8-C723CC166687}C:\program files (x86)\steam\steamapps\common\the witcher 2\bin\witcher2.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\the witcher 2\bin\witcher2.exe
    FirewallRules: [{7F77E439-A455-4CB1-BAB8-1B06A1071EE9}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Team Fortress 2\hl2.exe
    FirewallRules: [{F148CA37-7584-4C80-8392-D1274E7199FF}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Team Fortress 2\hl2.exe
    FirewallRules: [{3C7691E2-FE94-4C78-9EA9-319636E78110}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Team Fortress 2\hl2.exe
    FirewallRules: [{C8C43894-3BE1-4AE5-A8A1-BCE6AB9A9319}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Team Fortress 2\hl2.exe
    FirewallRules: [TCP Query User{9FBF6AA6-E638-4F91-B50A-416AFA3B3758}C:\program files\java\jre7\bin\javaw.exe] => (Allow) C:\program files\java\jre7\bin\javaw.exe
    FirewallRules: [UDP Query User{FBACCD05-3472-496E-B60C-2E4A321BDB8A}C:\program files\java\jre7\bin\javaw.exe] => (Allow) C:\program files\java\jre7\bin\javaw.exe
    FirewallRules: [{793912B0-03EC-4CAC-8997-675FED34BB1A}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\MarchOfWar\game.exe
    FirewallRules: [{8F33FBF9-0994-42A5-BD14-68B05DCCB6C4}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\MarchOfWar\game.exe
    FirewallRules: [{C02D92D9-8881-4299-916E-40F151CEC581}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Portal 2\portal2.exe
    FirewallRules: [{B3885DE3-1154-47F8-9495-9ECD30880CAF}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Portal 2\portal2.exe
    FirewallRules: [{11EBCBFF-2502-4D28-80FC-C141E4BE9625}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\the witcher 2\Launcher.exe
    FirewallRules: [{732F84AB-04C6-4131-B1DC-6A81806E8B48}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\the witcher 2\Launcher.exe
    FirewallRules: [{5925F068-2F82-4A8F-80D6-D3E2C74390F4}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Magic The Gathering Tactics\LaunchPad.exe
    FirewallRules: [{3683F5F6-4D92-4054-8A77-9F88EC424DA0}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Magic The Gathering Tactics\LaunchPad.exe
    FirewallRules: [{AC33FED8-CD1A-40E1-8A0B-7503094B8FAB}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Warframe\Tools\Launcher.exe
    FirewallRules: [{101CCAEC-E83E-4683-885C-6D6DEEBA037D}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Warframe\Tools\Launcher.exe
    FirewallRules: [{AA42513B-2544-4FE0-9815-81C1A2B0D07E}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2380\Agent.exe
    FirewallRules: [{C5CAFD4C-D198-472A-84DD-24B82E465190}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2380\Agent.exe
    FirewallRules: [TCP Query User{6443EDE2-0BA1-45D6-961B-587BF4B0F8E3}C:\program files (x86)\starcraft ii\versions\base26490\sc2.exe] => (Allow) C:\program files (x86)\starcraft ii\versions\base26490\sc2.exe
    FirewallRules: [UDP Query User{1F88362F-EAB6-462B-9ECF-6E16242F20BA}C:\program files (x86)\starcraft ii\versions\base26490\sc2.exe] => (Allow) C:\program files (x86)\starcraft ii\versions\base26490\sc2.exe
    FirewallRules: [{F654E831-D632-428E-A355-E8404C8CD35F}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\GarrysMod\hl2.exe
    FirewallRules: [{1B5B4298-A2FC-4500-9C23-180722461FB1}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\GarrysMod\hl2.exe
    FirewallRules: [{4CEEAC21-9868-41A4-82E4-5EAB7B179287}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
    FirewallRules: [{985AF26A-3B9A-4351-882A-4A264BA5E515}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
    FirewallRules: [{1553E3BB-A512-4F26-8363-1B0AD04DACC7}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
    FirewallRules: [{BEAF4772-2574-4322-9CD1-EAF86944022B}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
    FirewallRules: [{A6C29D58-8B01-4C0C-8355-A881F220873B}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\GarrysMod\hl2.exe
    FirewallRules: [{48FC73FF-D728-4520-9F40-783EA487C2B3}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\GarrysMod\hl2.exe
    FirewallRules: [{25F72D03-709C-490D-9AFC-5CDB3A11DFAE}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Warframe\Tools\RemoteCrashSender.exe
    FirewallRules: [TCP Query User{B1533E63-09F3-45A5-8D5B-CA8B34061466}C:\program files (x86)\starcraft ii\versions\base28667\sc2.exe] => (Allow) C:\program files (x86)\starcraft ii\versions\base28667\sc2.exe
    FirewallRules: [UDP Query User{E2585ED7-BB45-46A5-B4EE-5947ABEA1B34}C:\program files (x86)\starcraft ii\versions\base28667\sc2.exe] => (Allow) C:\program files (x86)\starcraft ii\versions\base28667\sc2.exe
    FirewallRules: [{8C330267-1183-43A9-809B-73C080D2ABBD}] => (Allow) C:\ProgramData\HappyCloud\Cache\TERA\TERA-Launcher.exe
    FirewallRules: [{01F057F5-028D-49E8-9464-8C177868FB7D}] => (Allow) C:\ProgramData\HappyCloud\Cache\TERA\TERA-Launcher.exe
    FirewallRules: [{81466F15-EB8F-4FF7-8951-57E2E0F6EA84}] => (Allow) C:\ProgramData\HappyCloud\Cache\TERA\Client\TL.exe
    FirewallRules: [{575807A6-C1C6-44C6-B1F9-18D0052202DA}] => (Allow) C:\ProgramData\HappyCloud\Cache\TERA\Client\TL.exe
    FirewallRules: [{F35EE6F8-5275-41F4-AA61-7278DAFBF202}] => (Allow) C:\ProgramData\HappyCloud\Cache\TERA\Client\Binaries\TERA.exe
    FirewallRules: [{E0318326-884D-4ED1-89EB-91E8921B860A}] => (Allow) C:\ProgramData\HappyCloud\Cache\TERA\Client\Binaries\TERA.exe
    FirewallRules: [{6B832386-F6F8-4971-AEB7-65EC5F91A286}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2689\Agent.exe
    FirewallRules: [{1D7F532C-4D46-41AB-B57F-8B6102979A84}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2689\Agent.exe
    FirewallRules: [TCP Query User{E24C2341-CB0F-4708-85DF-4E266FA17681}C:\program files (x86)\goat simulator\binaries\win32\goatgame-win32-shipping.exe] => (Allow) C:\program files (x86)\goat simulator\binaries\win32\goatgame-win32-shipping.exe
    FirewallRules: [UDP Query User{0485347E-945F-4E7B-9084-02F36FAF6F9E}C:\program files (x86)\goat simulator\binaries\win32\goatgame-win32-shipping.exe] => (Allow) C:\program files (x86)\goat simulator\binaries\win32\goatgame-win32-shipping.exe
    FirewallRules: [{826180BE-2993-4B7F-8087-AA39361E5540}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2816\Agent.exe
    FirewallRules: [{A8777B14-E09D-4A64-89FD-4D7A114173E8}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2816\Agent.exe
    FirewallRules: [{88205CC1-11F6-43A4-8A7B-8AA771A07936}] => (Allow) C:\Program Files (x86)\iTunes\iTunes.exe
    FirewallRules: [{D53E5191-1325-4D79-B347-66128F79A946}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\WOG\disasm.exe
    FirewallRules: [{9B29F92C-A819-405D-8723-2526545BF7E9}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\WOG\disasm.exe
    FirewallRules: [{E8560589-721B-4236-8B96-3A7397B9D9C2}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Toribash\toribash.exe
    FirewallRules: [{B474ACF1-FB07-4825-890C-15819EF214EA}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Toribash\toribash.exe
    FirewallRules: [TCP Query User{71083820-BEFB-4FF2-B085-31220B886993}C:\program files (x86)\goat simulator\binaries\win32\goatgame-win32-shipping.exe] => (Allow) C:\program files (x86)\goat simulator\binaries\win32\goatgame-win32-shipping.exe
    FirewallRules: [UDP Query User{72B01AC7-AB53-4890-B6F8-899F9239A9C5}C:\program files (x86)\goat simulator\binaries\win32\goatgame-win32-shipping.exe] => (Allow) C:\program files (x86)\goat simulator\binaries\win32\goatgame-win32-shipping.exe
    FirewallRules: [{A2D4D0AD-40EA-4359-A56E-F9DD36CDD7B3}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Vindictus\en-US\vslauncher.exe
    FirewallRules: [{D282F4ED-D587-471D-96AB-FC68588D6D16}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Vindictus\en-US\vslauncher.exe
    FirewallRules: [{7C0582EB-371A-4005-A85A-F688254FDFF2}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
    FirewallRules: [{7D74ED51-DA72-457D-AB23-D4D85CA28392}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
    FirewallRules: [TCP Query User{A65B1A91-F047-4784-AD40-BEF6CF2986EF}C:\program files (x86)\steam\steamapps\common\dota 2 beta\dota_ugc\game\bin\win64\dota2.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\dota 2 beta\dota_ugc\game\bin\win64\dota2.exe
    FirewallRules: [UDP Query User{1F839DA3-4364-4A24-B75D-E12D826F4AFC}C:\program files (x86)\steam\steamapps\common\dota 2 beta\dota_ugc\game\bin\win64\dota2.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\dota 2 beta\dota_ugc\game\bin\win64\dota2.exe
    FirewallRules: [{11312D9D-4D6D-4949-AFB1-FC8715DAA792}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3526\Agent.exe
    FirewallRules: [{83F91642-1009-4EE6-BB24-84F40580A171}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3526\Agent.exe
    FirewallRules: [{D1E95D57-3A19-4D16-BBB3-4BB9CC270D5E}] => (Allow) C:\Program Files (x86)\Battle.net\Battle.net.exe
    FirewallRules: [{2FEA0C22-7F53-4E28-88EE-DA130BD837D7}] => (Allow) C:\Program Files (x86)\Battle.net\Battle.net.exe
    FirewallRules: [TCP Query User{B99BA24B-7D19-4776-B273-4AA1CCE5482B}C:\program files (x86)\starcraft ii\versions\base32283\sc2.exe] => (Block) C:\program files (x86)\starcraft ii\versions\base32283\sc2.exe
    FirewallRules: [UDP Query User{2AE5FBDA-25DA-4C5F-BBDC-B1DF05965685}C:\program files (x86)\starcraft ii\versions\base32283\sc2.exe] => (Block) C:\program files (x86)\starcraft ii\versions\base32283\sc2.exe
    FirewallRules: [{6D0F47A9-D9B3-4FFD-B2AA-5E27FFD39CE4}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Age2HD\Launcher.exe
    FirewallRules: [{342B3F2C-3D68-4B43-A5DE-53CBDECC5875}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Age2HD\Launcher.exe
    FirewallRules: [{8B5071C6-306A-4DA6-AB53-02285B9261E7}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3634\Agent.exe
    FirewallRules: [{495D051A-55A2-47F6-B108-79ACF29FA59A}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3634\Agent.exe
    FirewallRules: [{99AA36FB-6191-4C72-AFFB-18C9EF0794B1}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\dota 2 beta\dota.exe
    FirewallRules: [{16AFF6FC-1C69-49CD-965F-4FEDECC24BA7}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\dota 2 beta\dota.exe
    FirewallRules: [{2A86ED7C-5760-4504-AFF5-95E3D3B84DD0}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\dota 2 test\dota.exe
    FirewallRules: [{8B67A351-6106-4BEF-8EA6-D68CD570982A}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\dota 2 test\dota.exe
    FirewallRules: [{04C4C1ED-B846-49E8-8169-DF8FBB80BC07}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\dota 2 beta\game\bin\win32\dota2.exe
    FirewallRules: [{9E8B2321-DEEA-4970-9F42-0CF3E9FCAA8A}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\dota 2 beta\game\bin\win32\dota2.exe
    FirewallRules: [{7BCA0C5B-C3B2-4FB6-B5AB-95943121061A}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\dota 2 beta\game\bin\win64\dota2cfg.exe
    FirewallRules: [{0E162F0C-36B7-42E2-AE2A-A877F853FFFB}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\dota 2 beta\game\bin\win64\dota2cfg.exe
    FirewallRules: [{EA7C878C-C396-463B-B4F8-ED7622171128}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
    FirewallRules: [{70D5C188-2BA8-406E-8732-D902F22FC7CD}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
    FirewallRules: [{4277E67F-E0FB-4A53-8AAC-119198EA6F11}] => (Allow) C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe
    FirewallRules: [TCP Query User{A2E6E42B-C77D-4898-83D2-6CCE1FAF9DE0}C:\program files (x86)\starcraft ii\versions\base38996\sc2_x64.exe] => (Allow) C:\program files (x86)\starcraft ii\versions\base38996\sc2_x64.exe
    FirewallRules: [UDP Query User{B8762D76-7B83-443C-888E-6BB8F5FDCCD4}C:\program files (x86)\starcraft ii\versions\base38996\sc2_x64.exe] => (Allow) C:\program files (x86)\starcraft ii\versions\base38996\sc2_x64.exe
    FirewallRules: [{8922FD7A-F6DE-42E1-9F72-5F22524DF9BB}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\dota 2 beta\game\bin\win64\dota2.exe
    FirewallRules: [{D6F21661-9273-446E-AD32-14F6F9A9AD80}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\dota 2 beta\game\bin\win64\dota2.exe
    FirewallRules: [{EC93D6D2-CE4F-40DA-8920-9E7507BD0346}] => (Allow) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPDeviceDetection3.exe
    FirewallRules: [{B179EAD4-872D-4910-90F5-BB06E449DF36}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Vindictus\en-US\nxsteam.exe
    FirewallRules: [{03CC272E-1ABC-456D-A508-4476873A4266}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Vindictus\en-US\nxsteam.exe
    FirewallRules: [{36B9B11E-3E26-43DD-9AD3-EC45979D2EEB}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

    ==================== Faulty Device Manager Devices =============


    ==================== Event log errors: =========================

    Application errors:
    ==================
    Error: (12/23/2015 11:40:45 PM) (Source: Application Hang) (EventID: 1002) (User: )
    Description: The program FRST64.exe version 23.12.2015.0 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

    Process ID: 360

    Start Time: 01d13e050714eb2d

    Termination Time: 4

    Application Path: C:\Users\Tyler\Desktop\FRST64.exe

    Report Id: 73196c16-a9f8-11e5-ac7a-78e3b550891e

    Error: (12/23/2015 11:37:54 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 4101) (User: )
    Description: Failed auto update retrieval of third-party root certificate from: <http://ctldl.windowsupdate.com/msdo...039EEDB80BE7A03C6953893B20D2D9323A4C2AFD.crt> with error: The specified server cannot perform the requested operation.
    .

    Error: (12/23/2015 11:37:54 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 4101) (User: )
    Description: Failed auto update retrieval of third-party root certificate from: <http://ctldl.windowsupdate.com/msdo...039EEDB80BE7A03C6953893B20D2D9323A4C2AFD.crt> with error: This operation returned because the timeout period expired.
    .

    Error: (12/23/2015 11:33:23 PM) (Source: SideBySide) (EventID: 33) (User: )
    Description: Activation context generation failed for "Avast.VC110.DebugCRT,processorArchitecture="x86",publicKeyToken="2036b14a11e83e4a",type="win32",version="11.0.60610.1"1".
    Dependent Assembly Avast.VC110.DebugCRT,processorArchitecture="x86",publicKeyToken="2036b14a11e83e4a",type="win32",version="11.0.60610.1" could not be found.
    Please use sxstrace.exe for detailed diagnosis.

    Error: (12/23/2015 11:22:15 PM) (Source: WinMgmt) (EventID: 10) (User: )
    Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

    Error: (12/23/2015 11:06:15 PM) (Source: WinMgmt) (EventID: 10) (User: )
    Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

    Error: (12/23/2015 07:29:37 PM) (Source: WinMgmt) (EventID: 10) (User: )
    Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

    Error: (12/23/2015 05:49:13 PM) (Source: WinMgmt) (EventID: 10) (User: )
    Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

    Error: (12/20/2015 08:28:20 PM) (Source: WinMgmt) (EventID: 10) (User: )
    Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

    Error: (12/20/2015 06:48:20 PM) (Source: WinMgmt) (EventID: 10) (User: )
    Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


    System errors:
    =============
    Error: (12/23/2015 11:33:26 PM) (Source: bowser) (EventID: 8003) (User: )
    Description: The master browser has received a server announcement from the computer DSOLSEN-PC
    that believes that it is the master browser for the domain on transport NetBT_Tcpip_{6F6C1F7F-40F9-4570-825E-019054F4CF0C}.
    The master browser is stopping or an election is being forced.

    Error: (12/23/2015 11:20:58 PM) (Source: BugCheck) (EventID: 1001) (User: )
    Description: 0x0000001e (0xffffffffc0000005, 0xfffff80002eb04ef, 0x0000000000000000, 0x000000007efa0000)C:\Windows\MEMORY.DMP122315-39951-01

    Error: (12/23/2015 11:20:54 PM) (Source: EventLog) (EventID: 6008) (User: )
    Description: The previous system shutdown at 11:18:58 PM on ‎12/‎23/‎2015 was unexpected.

    Error: (12/23/2015 11:09:52 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
    Description: Installation Failure: Windows failed to install the following update with error 0x800f0816: Security Update for Windows 7 for x64-based Systems (KB3087039).

    Error: (12/23/2015 11:09:52 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
    Description: Installation Failure: Windows failed to install the following update with error 0x800f0816: Security Update for Windows 7 for x64-based Systems (KB3100213).

    Error: (12/23/2015 11:09:52 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
    Description: Installation Failure: Windows failed to install the following update with error 0x800f0816: Security Update for Windows 7 for x64-based Systems (KB3108371).

    Error: (12/23/2015 11:09:52 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
    Description: Installation Failure: Windows failed to install the following update with error 0x800f0816: Security Update for Windows 7 for x64-based Systems (KB3101722).

    Error: (12/23/2015 11:09:52 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
    Description: Installation Failure: Windows failed to install the following update with error 0x800f0816: Cumulative Security Update for Internet Explorer 11 for Windows 7 for x64-based Systems (KB3104002).

    Error: (12/23/2015 11:09:52 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
    Description: Installation Failure: Windows failed to install the following update with error 0x800f0816: Update for Windows 7 for x64-based Systems (KB3092627).

    Error: (12/23/2015 11:09:52 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
    Description: Installation Failure: Windows failed to install the following update with error 0x80242016: Update for Windows 7 for x64-based Systems (KB3035583).


    ==================== Memory info ===========================

    Processor: AMD Phenom(tm) II P650 Dual-Core Processor
    Percentage of memory in use: 49%
    Total physical RAM: 3834.9 MB
    Available physical RAM: 1926.52 MB
    Total Virtual: 7668.01 MB
    Available Virtual: 5551.85 MB

    ==================== Drives ================================

    Drive c: () (Fixed) (Total:450.74 GB) (Free:155.66 GB) NTFS ==>[system with boot components (obtained from drive)]
    Drive d: (RECOVERY) (Fixed) (Total:14.72 GB) (Free:1.63 GB) NTFS ==>[system with boot components (obtained from drive)]

    ==================== MBR & Partition Table ==================

    ========================================================
    Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 8DE81F56)
    Partition 1: (Active) - (Size=199 MB) - (Type=07 NTFS)
    Partition 2: (Not Active) - (Size=450.7 GB) - (Type=07 NTFS)
    Partition 3: (Not Active) - (Size=14.7 GB) - (Type=07 NTFS)
    Partition 4: (Not Active) - (Size=103 MB) - (Type=0C)

    ==================== End of Addition.txt ============================
     
  3. Broni

    Broni Malware Annihilator Posts: 52,895   +344

    Welcome aboard [​IMG]

    Please, observe following rules:
    • Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
    • If you're stuck, or you're not sure about certain step, always ask before doing anything else.
    • Please refrain from running any tools, fixes or applying any changes to your computer other than those I suggest.
    • Never run more than one scan at a time.
    • Keep updating me regarding your computer behavior, good, or bad.
    • The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
    • If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
    • I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

    =========================================

    Yes, you're infected with a rootkit.

    Download attached fixlist.txt file and save it to the Desktop.
    NOTE. It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work.

    NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

    Run FRST(FRST64) and press the Fix button just once and wait.
    The tool will make a log on the Desktop (Fixlog.txt). Please post it to your reply.
     

    Attached Files:

  4. Tyler Olsen

    Tyler Olsen TS Rookie Topic Starter

    Thanks for the quick response, I ran the FRST tool with the fixlist.txt, here is the log

    Fix result of Farbar Recovery Scan Tool (x64) Version:23-12-2015
    Ran by Tyler (2015-12-24 13:33:58) Run:1
    Running from C:\Users\Tyler\Desktop
    Loaded Profiles: Tyler (Available Profiles: Tyler)
    Boot Mode: Normal
    ==============================================

    fixlist content:
    *****************
    HKLM-x32\...\Run: [] => [X]
    ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => No File
    ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => No File
    ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => No File
    ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => No File
    ShellIconOverlayIdentifiers: [GDriveSharedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} => No File
    Toolbar: HKU\S-1-5-21-1678204619-2015826032-607794690-1001 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
    FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw.dll [No File]
    CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\47.0.2526.106\ppGoogleNaClPluginChrome.dll => No File
    CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\47.0.2526.106\pdf.dll => No File
    CHR Plugin: (Java Deployment Toolkit 6.0.240.7) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll => No File
    CHR Plugin: (Java(TM) Platform SE 6 U24) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll => No File
    CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll => No File
    CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_202.dll => No File
    CHR Plugin: (Shockwave for Director) - C:\Windows\system32\Adobe\Director\np32dsw.dll => No File
    CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll => No File
    S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]
    S3 MBAMSwissArmy; \??\C:\Windows\system32\drivers\MBAMSwissArmy.sys [X]
    2014-02-26 17:19 - 2014-02-26 17:19 - 4216840 _____ (Microsoft Corporation) C:\Program Files (x86)\Common Files\vcredist.exe
    2014-05-13 16:53 - 2014-05-13 16:53 - 0000017 _____ () C:\Users\Tyler\AppData\Local\resmon.resmoncfg
    2015-09-01 08:51 - 2015-09-01 08:51 - 0000000 _____ () C:\Users\Tyler\AppData\Local\{3FDC0C10-1031-4610-8702-F62F1EA865E3}
    2015-08-23 11:07 - 2015-08-23 11:16 - 0001318 _____ () C:\ProgramData\hpzinstall.log
    2014-05-05 16:44 - 2014-05-05 16:44 - 0000113 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.400.32.bc
    C:\Windows\svchost.exe
    C:\Users\Tyler\AppData\Local\Temp\contentDATs.exe
    C:\Users\Tyler\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpodovoa.dll
    C:\Users\Tyler\AppData\Local\Temp\Extract.exe
    C:\Users\Tyler\AppData\Local\Temp\HPHelpUpdater.exe
    C:\Users\Tyler\AppData\Local\Temp\ICReinstall_Firefox_Setup_21.0.exe
    C:\Users\Tyler\AppData\Local\Temp\jre-7u21-windows-i586-iftw.exe
    C:\Users\Tyler\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe
    C:\Users\Tyler\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe
    C:\Users\Tyler\AppData\Local\Temp\mssinstaller.exe
    C:\Users\Tyler\AppData\Local\Temp\PCPTUpdate.exe
    C:\Users\Tyler\AppData\Local\Temp\Resource.exe
    C:\Users\Tyler\AppData\Local\Temp\SecurityScan_Release.exe
    C:\Users\Tyler\AppData\Local\Temp\SP53394.exe
    C:\Users\Tyler\AppData\Local\Temp\SP55040.exe
    C:\Users\Tyler\AppData\Local\Temp\SP55151.exe
    C:\Users\Tyler\AppData\Local\Temp\SP55152.exe
    C:\Users\Tyler\AppData\Local\Temp\SP56878.exe
    C:\Users\Tyler\AppData\Local\Temp\SP56929.exe
    C:\Users\Tyler\AppData\Local\Temp\SP57538.exe
    C:\Users\Tyler\AppData\Local\Temp\sp58915.exe
    C:\Users\Tyler\AppData\Local\Temp\SP60593.exe
    C:\Users\Tyler\AppData\Local\Temp\sp64126.exe
    C:\Users\Tyler\AppData\Local\Temp\UninstallHPSA.exe
    C:\Users\Tyler\AppData\Local\Temp\UninstallHPTCA.exe
    C:\Users\Tyler\AppData\Local\Temp\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}_NIS_7707.exe
    TDL4: custom:26000022 <===== ATTENTION
    CustomCLSID: HKU\S-1-5-21-1678204619-2015826032-607794690-1001_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Tyler\AppData\Roaming\Dropbox\bin\Dropbox.exe /autoplay => No File
    Task: {30E091AB-02F0-47E1-9EE6-45F981C49E19} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> No File <==== ATTENTION
    Task: {428DCFD7-902E-4319-A25C-081CE620076A} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> No File <==== ATTENTION
    Task: {97F8AAE5-DACA-4853-811A-A6A21985E15F} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> No File <==== ATTENTION
    Task: {BB03E254-1D23-456A-820C-62A3DE5ADA36} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION
    Task: {C62A5195-EE4F-4E56-81B0-4BD047D9EBC9} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> No File <==== ATTENTION
    Task: {CC904A7B-B7FF-45F8-B44F-212B10B9EDE6} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> No File <==== ATTENTION
    Task: {E3E2A214-6E94-4968-8CB1-D1FCCF5B046D} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> No File <==== ATTENTION

    *****************

    HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\ => value removed successfully
    "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\DropboxExt1" => key removed successfully
    HKCR\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => key not found.
    "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\DropboxExt2" => key removed successfully
    HKCR\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => key not found.
    "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\DropboxExt3" => key removed successfully
    HKCR\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => key not found.
    "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\DropboxExt4" => key removed successfully
    HKCR\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => key not found.
    "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\GDriveSharedOverlay" => key removed successfully
    HKCR\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} => key not found.
    HKU\S-1-5-21-1678204619-2015826032-607794690-1001\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} => value removed successfully
    HKCR\CLSID\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} => key not found.
    "HKLM\Software\Wow6432Node\MozillaPlugins\@adobe.com/ShockwavePlayer" => key removed successfully
    C:\Program Files (x86)\Google\Chrome\Application\47.0.2526.106\ppGoogleNaClPluginChrome.dll => not found.
    C:\Program Files (x86)\Google\Chrome\Application\47.0.2526.106\pdf.dll => not found.
    C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll => not found.
    C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll => not found.
    C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll => not found.
    C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_202.dll => not found.
    C:\Windows\system32\Adobe\Director\np32dsw.dll => not found.
    c:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll => not found.
    EagleX64 => service removed successfully
    MBAMSwissArmy => service removed successfully
    C:\Program Files (x86)\Common Files\vcredist.exe => moved successfully
    C:\Users\Tyler\AppData\Local\resmon.resmoncfg => moved successfully
    C:\Users\Tyler\AppData\Local\{3FDC0C10-1031-4610-8702-F62F1EA865E3} => moved successfully
    C:\ProgramData\hpzinstall.log => moved successfully
    C:\ProgramData\Microsoft.SqlServer.Compact.400.32.bc => moved successfully
    C:\Windows\svchost.exe => moved successfully
    C:\Users\Tyler\AppData\Local\Temp\contentDATs.exe => moved successfully
    C:\Users\Tyler\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpodovoa.dll => moved successfully
    C:\Users\Tyler\AppData\Local\Temp\Extract.exe => moved successfully
    C:\Users\Tyler\AppData\Local\Temp\HPHelpUpdater.exe => moved successfully
    C:\Users\Tyler\AppData\Local\Temp\ICReinstall_Firefox_Setup_21.0.exe => moved successfully
    C:\Users\Tyler\AppData\Local\Temp\jre-7u21-windows-i586-iftw.exe => moved successfully
    C:\Users\Tyler\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe => moved successfully
    C:\Users\Tyler\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe => moved successfully
    C:\Users\Tyler\AppData\Local\Temp\mssinstaller.exe => moved successfully
    C:\Users\Tyler\AppData\Local\Temp\PCPTUpdate.exe => moved successfully
    C:\Users\Tyler\AppData\Local\Temp\Resource.exe => moved successfully
    C:\Users\Tyler\AppData\Local\Temp\SecurityScan_Release.exe => moved successfully
    C:\Users\Tyler\AppData\Local\Temp\SP53394.exe => moved successfully
    C:\Users\Tyler\AppData\Local\Temp\SP55040.exe => moved successfully
    C:\Users\Tyler\AppData\Local\Temp\SP55151.exe => moved successfully
    C:\Users\Tyler\AppData\Local\Temp\SP55152.exe => moved successfully
    C:\Users\Tyler\AppData\Local\Temp\SP56878.exe => moved successfully
    C:\Users\Tyler\AppData\Local\Temp\SP56929.exe => moved successfully
    C:\Users\Tyler\AppData\Local\Temp\SP57538.exe => moved successfully
    C:\Users\Tyler\AppData\Local\Temp\sp58915.exe => moved successfully
    C:\Users\Tyler\AppData\Local\Temp\SP60593.exe => moved successfully
    C:\Users\Tyler\AppData\Local\Temp\sp64126.exe => moved successfully
    C:\Users\Tyler\AppData\Local\Temp\UninstallHPSA.exe => moved successfully
    C:\Users\Tyler\AppData\Local\Temp\UninstallHPTCA.exe => moved successfully
    C:\Users\Tyler\AppData\Local\Temp\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}_NIS_7707.exe => moved successfully

    ========================= bcdedit ========================


    The operation completed successfully.

    ========= End of bcdedit =========


    ========================= bcdedit ========================


    The operation completed successfully.

    ========= End of bcdedit =========

    "HKU\S-1-5-21-1678204619-2015826032-607794690-1001_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}" => key removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{30E091AB-02F0-47E1-9EE6-45F981C49E19}" => key removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{30E091AB-02F0-47E1-9EE6-45F981C49E19}" => key removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d" => key removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{428DCFD7-902E-4319-A25C-081CE620076A}" => key removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{428DCFD7-902E-4319-A25C-081CE620076A}" => key removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\Time-5d" => key removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{97F8AAE5-DACA-4853-811A-A6A21985E15F}" => key removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{97F8AAE5-DACA-4853-811A-A6A21985E15F}" => key removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd" => key removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{BB03E254-1D23-456A-820C-62A3DE5ADA36}" => key removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{BB03E254-1D23-456A-820C-62A3DE5ADA36}" => key removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B" => key removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{C62A5195-EE4F-4E56-81B0-4BD047D9EBC9}" => key removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C62A5195-EE4F-4E56-81B0-4BD047D9EBC9}" => key removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d" => key removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{CC904A7B-B7FF-45F8-B44F-212B10B9EDE6}" => key removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{CC904A7B-B7FF-45F8-B44F-212B10B9EDE6}" => key removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\Logon-5d" => key removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{E3E2A214-6E94-4968-8CB1-D1FCCF5B046D}" => key removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{E3E2A214-6E94-4968-8CB1-D1FCCF5B046D}" => key removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d" => key removed successfully

    ==== End of Fixlog 13:34:07 ====
     
  5. Broni

    Broni Malware Annihilator Posts: 52,895   +344

    Good :)

    [​IMG] Download RogueKiller from one of the following links and save it to your Desktop:

    Link 1
    Link 2
    • Close all the running programs
    • Windows Vista/7/8 users: right click on RogueKiller.exe, click Run as Administrator
    • Otherwise just double-click on RogueKiller.exe
    • Pre-scan will start. Let it finish.
    • Click on SCAN button.
    • Wait until the Status box shows Scan Finished
    • Click on Delete.
    • Wait until the Status box shows Deleting Finished.
    • Click on Report and copy/paste the content of the Notepad into your next reply.
    • RKreport.txt could also be found on your desktop.
    • If more than one log is produced post all logs.
    • If RogueKiller has been blocked, do not hesitate to try a few times more. If really won't run, rename it to winlogon.exe (or winlogon.com) and try again
    [​IMG] Please download Malwarebytes Anti-Malware (MBAM) to your desktop.
    NOTE. If you already have MBAM 2.0 installed scroll down.
    • Double-click mbam-setup-2.0.0.1000.exe and follow the prompts to install the program.
    • At the end, be sure a checkmark is placed next to the following:
    • Launch Malwarebytes Anti-Malware
    • A 14 day trial of the Premium features is pre-selected. You may deselect this if you wish, and it will not diminish the scanning and removal capabilities of the program.
    • Click Finish.
    • On the Dashboard, click the 'Update Now >>' link
    • After the update completes, click the 'Scan Now >>' button.
    • Or, on the Dashboard, click the Scan Now >> button.
    • If an update is available, click the Update Now button.
    • A Threat Scan will begin.
    • When the scan is complete, if there have been detections, click Apply Actions to allow MBAM to clean what was detected.
    • In most cases, a restart will be required.
    • Wait for the prompt to restart the computer to appear, then click on Yes.
    If you already have MBAM 2.0 installed:
    • On the Dashboard, click the 'Update Now >>' link
    • After the update completes, click the 'Scan Now >>' button.
    • Or, on the Dashboard, click the Scan Now >> button.
    • If an update is available, click the Update Now button.
    • A Threat Scan will begin.
    • When the scan is complete, if there have been detections, click Apply Actions to allow MBAM to clean what was detected.
    • In most cases, a restart will be required.
    • Wait for the prompt to restart the computer to appear, then click on Yes.
    How to get logs:
    (Export log to save as txt)
    • After the restart once you are back at your desktop, open MBAM once more.
    • Click on the History tab > Application Logs.
    • Double click on the Scan Log which shows the Date and time of the scan just performed.
    • Click 'Export'.
    • Click 'Text file (*.txt)'
    • In the Save File dialog box which appears, click on Desktop.
    • In the File name: box type a name for your scan log.
    • A message box named 'File Saved' should appear stating "Your file has been successfully exported".
    • Click Ok
    • Attach that saved log to your next reply.
    (Copy to clipboard for pasting into forum replies or tickets)
    • After the restart once you are back at your desktop, open MBAM once more.
    • Click on the History tab > Application Logs.
    • Double click on the Scan Log which shows the Date and time of the scan just performed.
    • Click 'Copy to Clipboard'
    • Paste the contents of the clipboard into your reply.
    [​IMG] Please download AdwCleaner by Xplode onto your desktop.
    • Close all open programs and internet browsers.
    • Double click on adwcleaner.exe to run the tool.
    • Click on Scan button.
    • When the scan has finished click on Clean button.
    • Your computer will be rebooted automatically. A text file will open after the restart.
    • Please post the contents of that logfile with your next reply.
    • You can find the logfile at C:\AdwCleaner[S1].txt as well.
    [​IMG] Please download Junkware Removal Tool to your desktop.
    • Shut down your protection software now to avoid potential conflicts.
    • Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
    • The tool will open and start scanning your system.
    • Please be patient as this can take a while to complete depending on your system's specifications.
    • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
    • Post the contents of JRT.txt into your next message.
     
  6. Tyler Olsen

    Tyler Olsen TS Rookie Topic Starter

    Hey, ran all of those and got the logs. Posting them in the same order done.

    RogueKiller V11.0.4.0 [Dec 20 2015] (Free) by Adlice Software
    mail : http://www.adlice.com/contact/
    Feedback : http://forum.adlice.com
    Website : http://www.adlice.com/software/roguekiller/
    Blog : http://www.adlice.com

    Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
    Started in : Normal mode
    User : Tyler [Administrator]
    Started from : C:\Users\Tyler\Desktop\RogueKiller.exe
    Mode : Delete -- Date : 12/27/2015 16:40:04

    ¤¤¤ Processes : 2 ¤¤¤
    [Proc.Injected] ccsvchst.exe(2148) -- C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\ccsvchst.exe[7] -> Killed [TermProc]
    [Suspicious.Path] DismHost.exe(4112) -- C:\Windows\Temp\E566FE3E-24C9-43B8-99E5-8090184E6D32\DismHost.exe[x] -> Killed [TermThr]

    ¤¤¤ Registry : 0 ¤¤¤

    ¤¤¤ Tasks : 0 ¤¤¤

    ¤¤¤ Files : 4 ¤¤¤
    [Hj.Name][File] C:\Windows\svchost.exe -> Deleted
    [PUP][Folder] C:\ProgramData\{18165758-115C-4DC0-9EC2-FF89F725767F} -> Deleted
    [PUP][File] C:\ProgramData\{18165758-115C-4DC0-9EC2-FF89F725767F}\0x0409.ini -> Deleted
    [PUP][File] C:\ProgramData\{18165758-115C-4DC0-9EC2-FF89F725767F}\HP Support Assistant.msi -> Deleted
    [PUP][Folder] C:\Program Files (x86)\B1 Free Archiver -> Deleted
    [PUP][File] C:\Program Files (x86)\B1 Free Archiver\installer.exe -> Deleted
    [PUP][Folder] C:\Program Files (x86)\Coupons -> Deleted
    [PUP][File] C:\Program Files (x86)\Coupons\CouponsCom.url -> Deleted
    [PUP][File] C:\Program Files (x86)\Coupons\Uninstall\IRIMG1.JPG -> Deleted
    [PUP][File] C:\Program Files (x86)\Coupons\Uninstall\IRIMG2.JPG -> Deleted
    [PUP][File] C:\Program Files (x86)\Coupons\Uninstall\IRIMG3.JPG -> Deleted
    [PUP][File] C:\Program Files (x86)\Coupons\Uninstall\IRIMG4.JPG -> Deleted
    [PUP][File] C:\Program Files (x86)\Coupons\Uninstall\IRIMG5.JPG -> Deleted
    [PUP][File] C:\Program Files (x86)\Coupons\Uninstall\IRIMG6.JPG -> Deleted
    [PUP][File] C:\Program Files (x86)\Coupons\Uninstall\IRIMG7.JPG -> Deleted
    [PUP][File] C:\Program Files (x86)\Coupons\Uninstall\IRIMG8.JPG -> Deleted
    [PUP][File] C:\Program Files (x86)\Coupons\Uninstall\uninstall.dat -> Deleted
    [PUP][File] C:\Program Files (x86)\Coupons\Uninstall\uninstall.xml -> Deleted
    [PUP][Folder] C:\Program Files (x86)\Coupons\Uninstall -> Deleted



    Malwarebytes Anti-Malware
    www.malwarebytes.org

    Scan Date: 12/27/2015
    Scan Time: 4:43 PM
    Logfile: Anti Malware Log.txt
    Administrator: Yes

    Version: 2.2.0.1024
    Malware Database: v2015.12.27.05
    Rootkit Database: v2015.12.26.01
    License: Trial
    Malware Protection: Enabled
    Malicious Website Protection: Enabled
    Self-protection: Disabled

    OS: Windows 7 Service Pack 1
    CPU: x64
    File System: NTFS
    User: Tyler

    Scan Type: Threat Scan
    Result: Completed
    Objects Scanned: 360974
    Time Elapsed: 32 min, 43 sec

    Memory: Enabled
    Startup: Enabled
    Filesystem: Enabled
    Archives: Enabled
    Rootkits: Disabled
    Heuristics: Enabled
    PUP: Enabled
    PUM: Enabled

    Processes: 0
    (No malicious items detected)

    Modules: 0
    (No malicious items detected)

    Registry Keys: 0
    (No malicious items detected)

    Registry Values: 0
    (No malicious items detected)

    Registry Data: 0
    (No malicious items detected)

    Folders: 0
    (No malicious items detected)

    Files: 3
    PUP.Optional.InstallCore, C:\Users\Tyler\AppData\Local\Temp\ICReinstall_Firefox_Setup_21.0.exe, Quarantined, [33de29810586bb7b52da55dc39c8a858],
    PUP.Optional.InstallCore, C:\Users\Tyler\Downloads\Firefox_Setup_21.0.exe, Quarantined, [dd34efbb08834beb81ab141dcc35916f],
    Trojan.Agent, C:\Windows\svchost.exe, Quarantined, [729fb2f86b202a0c3a0af2f6c939a15f],

    Physical Sectors: 0
    (No malicious items detected)


    (end)

    ¤¤¤ Hosts File : 0 ¤¤¤

    ¤¤¤ Antirootkit : 0 (Driver: Not loaded [0xc000036b]) ¤¤¤

    ¤¤¤ Web browsers : 0 ¤¤¤

    ¤¤¤ MBR Check : ¤¤¤
    \\.\PHYSICALDRIVE0 Root.PiHar|VT.Unknown -> Not selected

    +++++ PhysicalDrive0: Hitachi HTS545050B9A300 SATA Disk Device +++++
    --- User ---
    [MBR] ce18acc2843d4e4c7449aa8029cb6b63
    [BSP] d9a5f1b1e6cf8c8e38496c1c6199aa83 : Windows Vista/7/8 MBR Code
    Partition table:
    0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 199 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
    1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 409600 | Size: 461561 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
    2 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 945686528 | Size: 15075 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
    3 - [XXXXXX] FAT32-LBA (0xc) [VISIBLE] Offset (sectors): 976560128 | Size: 103 MB
    User = LL1 ... OK
    User != LL2 ... KO!
    --- LL2 ---
    [MBR] 2aba9e201989756fa9bc8738e3f503e3
    [BSP] cfc12681ea201b500b5fe92b022e2406 : Root.PiHar|VT.Unknown MBR Code [Malware!]
    Partition table:
    0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 199 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
    1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 409600 | Size: 461561 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
    2 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 945686528 | Size: 15075 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
    3 - [XXXXXX] FAT32-LBA (0xc) [VISIBLE] Offset (sectors): 976560128 | Size: 103 MB

    # AdwCleaner v5.026 - Logfile created 27/12/2015 at 17:41:13
    # Updated 21/12/2015 by Xplode
    # Database : 2015-12-23.1 [Server]
    # Operating system : Windows 7 Home Premium Service Pack 1 (x64)
    # Username : Tyler - TYLER-HP
    # Running from : C:\Users\Tyler\Desktop\adwcleaner_5.026.exe
    # Option : Cleaning
    # Support : http://toolslib.net/forum

    ***** [ Services ] *****


    ***** [ Folders ] *****


    ***** [ Files ] *****


    ***** [ DLLs ] *****


    ***** [ Shortcuts ] *****


    ***** [ Scheduled tasks ] *****


    ***** [ Registry ] *****

    [-] Key Deleted : HKCU\Software\b1.org
    [-] Key Deleted : HKLM\SOFTWARE\b1.org
    [-] Key Deleted : [x64] HKLM\SOFTWARE\b1.org
    [-] Key Deleted : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\softonic.com

    ***** [ Web browsers ] *****

    [-] [C:\Users\Tyler\AppData\Local\Google\Chrome\User Data\Default\Web Data] [Search Provider] Deleted : aol.com
    [-] [C:\Users\Tyler\AppData\Local\Google\Chrome\User Data\Default\Web Data] [Search Provider] Deleted : ask.com
    [-] [C:\Users\Tyler\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] [Startup_URLs] Deleted : hxxp://search.babylon.com/home?affID=17425&tt=3812_1

    *************************

    :: "Tracing" keys removed
    :: Winsock settings cleared

    ########## EOF - C:\AdwCleaner\AdwCleaner[C1].txt - [1290 bytes] ##########



    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    Junkware Removal Tool (JRT) by Malwarebytes
    Version: 8.0.1 (11.24.2015)
    Operating System: Windows 7 Home Premium x64
    Ran by Tyler (Administrator) on Sun 12/27/2015 at 17:46:35.67
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




    File System: 1

    Successfully deleted: C:\Windows\svchost.exe (File)



    Registry: 1

    Successfully deleted: HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} (Registry Key)




    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    Scan was completed on Sun 12/27/2015 at 18:00:45.43
    End of JRT log
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     
  7. Broni

    Broni Malware Annihilator Posts: 52,895   +344

    Please download ComboFix from Here, Here or Here to your Desktop.

    **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
    • Never rename Combofix unless instructed.
    • Close any open browsers.
    • Very Important! Temporarily disable your anti-virus and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
    • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
    • Close any open browsers.
    • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
    • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
    • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
      If the connection is not there use restore point you created prior to running Combofix.
    • Double click on combofix.exe & follow the prompts.

    • NOTE1. If Combofix asks you to install Recovery Console, please allow it.
      NOTE 2. If Combofix asks you to update the program, always do so.
    • When finished, it will produce a report for you.
    • Please post the "C:\ComboFix.txt"
    **Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
    **Note 2 for AVG and CA Internet Security (Total Defense Internet Security) users: ComboFix will not run until AVG/CA Internet Security is uninstalled as a protective measure against the anti-virus. This is because AVG/CA Internet Security "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG/CA Internet Security cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG/CA Internet Security first.
    Use AppRemover to uninstall it: http://www.appremover.com/
    We can reinstall it when we're done with CF.
    **Note 3: If you receive an error Illegal operation attempted on a registery key that has been marked for deletion, restart computer to fix the issue.
    **Note 4: Some infections may take some significant time to be cured. As long as your computer clock is running Combofix is still working. Be patient.


    Make sure, you re-enable your security programs, when you're done with Combofix.

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    NOTE.
    If, for some reason, Combofix refuses to run, try the following...

    Delete Combofix file, download fresh one, but rename combofix.exe to your_name.exe BEFORE saving it to your desktop.
    Do NOT run it yet.
    Download Rkill (courtesy of BleepingComputer.com) to your desktop.
    There are 2 different versions. If one of them won't run then download and try to run the other one.
    You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

    rKill.exe: http://www.bleepingcomputer.com/download/rkill/dl/10/
    iExplore.exe (renamed rKill.exe): http://www.bleepingcomputer.com/download/rkill/dl/11/

    Restart computer in safe mode

    • Double-click on the Rkill desktop icon to run the tool.
    • If using Windows Vista, 7 or 8 right-click on it and choose Run As Administrator.
    • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
    • If not, delete the file, then download and use the one provided in Link 2.
    • Do not reboot until instructed.
    • If the tool does not run from any of the links provided, please let me know.

    When the scan is done Notepad will open with rKill.txt log.
    NOTE. rKill.txt log will also be present on your desktop.

    Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

    IF you had to run rKill post BOTH logs, rKill.txt and Combofix.txt.
     
  8. Broni

    Broni Malware Annihilator Posts: 52,895   +344

    Still with me?
     
  9. Broni

    Broni Malware Annihilator Posts: 52,895   +344

    This topic is marked as abandoned and closed due to inactivity.

    This member will NOT be eligible to receive any more help in malware removal forum.
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...