uapgs
Posts: 16 +0
A svchost.exe located outside System32 has been maxing CPU usage. Process can be terminated and executable deleted, but they return on reboot. There was a suspicious lsass.exe file, but as far as I know it hasn't returned since anti-virus nailed it. FRST.txt and Addition.txt logs follow.
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:13-06-2015
Ran by David (administrator) on DAVID-PC on 18-06-2015 00:34:14
Running from C:\Users\David\Desktop\antivirus\FRST
Loaded Profiles: David (Available Profiles: David)
Platform: Windows 7 Ultimate (X64) OS Language: English (United States)
Internet Explorer Version 8 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool:
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Apple Inc.) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
(VIA Technologies, Inc.) C:\Windows\System32\ViakaraokeSrv.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Microsoft Corporation) C:\Windows\System32\wscript.exe
(Microsoft Corporation) C:\Windows\System32\schtasks.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Razer USA Ltd.) E:\Programs\Razer\Reclusa\razerhid.exe
() E:\Programs\Rainmeter\Rainmeter.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\CCC.exe
() E:\Programs\Razer\Reclusa\razertra.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Valve Corporation) E:\Steam\Steam.exe
(Valve Corporation) E:\Steam\bin\steamwebhelper.exe
(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
(Valve Corporation) E:\Steam\bin\steamwebhelper.exe
(Steven Mayall) E:\Programs\MusicBee\MusicBee.exe
(Valve Corporation) E:\Steam\bin\steamwebhelper.exe
(Mozilla Corporation) E:\Programs\Firefox\firefox.exe
(Mozilla Corporation) E:\Programs\Firefox\plugin-container.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_305.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_305.exe
() C:\Users\David\Desktop\VIRUS IS KILL YES\FRST\FRST64.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
() C:\Users\David\Desktop\VIRUS IS KILL YES\FRST\FRST64.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [1289704 2012-09-12] (Microsoft Corporation)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-02-27] (Intel Corporation)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2010-09-08] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] => E:\Programs\iTunes\iTunesHelper.exe [421160 2010-09-24] (Apple Inc.)
HKLM-x32\...\Run: [amd_dc_opt] => C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe [77824 2008-07-22] (AMD)
HKLM-x32\...\Run: [Reclusa] => E:\Programs\Razer\Reclusa\razerhid.exe [151552 2009-08-12] (Razer USA Ltd.)
HKLM-x32\...\Run: [VirtualCloneDrive] => E:\Programs\VirtualCloneDrive\VCDDaemon.exe [88984 2013-03-11] (Elaborate Bytes AG)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [Razer Synapse] => C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe [442712 2014-01-16] (Razer Inc.)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\amd64\CLIStart.exe [767176 2015-03-31] (Advanced Micro Devices, Inc.)
HKU\S-1-5-21-3785795450-969359344-1186745032-1000\...\Run: [Steam] => E:\Steam\steam.exe [2892992 2015-06-05] (Valve Corporation)
HKU\S-1-5-21-3785795450-969359344-1186745032-1000\...\Run: [RGSC] => E:\Games\GTA IV\Rockstar Games Social Club\RGSCLauncher.exe /silent
HKU\S-1-5-21-3785795450-969359344-1186745032-1000\...\MountPoints2: {b128f636-6865-11e3-a516-10bf48785970} - F:\autorun.exe
Startup: C:\Users\David\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2014-07-13]
ShortcutTarget: Dropbox.lnk -> C:\Users\David\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\David\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Rainmeter.lnk [2014-09-28]
ShortcutTarget: Rainmeter.lnk -> E:\Programs\Rainmeter\Rainmeter.exe ()
ShellIconOverlayIdentifiers: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\David\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\David\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\David\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\David\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\David\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\David\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\David\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\David\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKU\S-1-5-21-3785795450-969359344-1186745032-1000\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-3785795450-969359344-1186745032-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/en-au/?ocid=iehp
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\.DEFAULT -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll [2014-02-27] (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll [2014-02-27] (Oracle Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2012-12-16] (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2012-12-16] (Oracle Corporation)
Filter: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2009-07-14] (Microsoft Corporation)
Filter-x32: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2009-07-14] (Microsoft Corporation)
Filter: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2009-07-14] (Microsoft Corporation)
Filter-x32: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2009-07-14] (Microsoft Corporation)
Hosts: 127.0.0.1 motd.pinion.gg
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
FireFox:
========
FF ProfilePath: C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\sifj1b9r.default
FF Homepage: about:blank
FF NetworkProxy: "autoconfig_url", "http://proxy.newcastle.edu.au/proxy.pac"
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll [2015-02-20] ()
FF Plugin: @esn/npbattlelog,version=2.5.0 -> C:\Program Files (x86)\Battlelog Web Plugins\2.5.0\npbattlelogx64.dll No File
FF Plugin: @esn/npbattlelog,version=2.5.1 -> C:\Program Files (x86)\Battlelog Web Plugins\2.5.1\npbattlelogx64.dll [2014-09-02] (EA Digital Illusions CE AB)
FF Plugin: @esn/npbattlelog,version=2.6.2 -> C:\Program Files (x86)\Battlelog Web Plugins\2.6.2\npbattlelogx64.dll [2015-01-14] (EA Digital Illusions CE AB)
FF Plugin: @java.com/DTPlugin,version=10.51.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll [2014-02-27] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.51.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll [2014-02-27] (Oracle Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll [2015-02-20] ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> E:\Programs\iTunes\Mozilla Plugins\npitunes.dll [2010-09-22] ()
FF Plugin-x32: @esn/npbattlelog,version=2.3.2 -> C:\Program Files (x86)\Battlelog Web Plugins\2.3.2\npbattlelog.dll No File
FF Plugin-x32: @esn/npbattlelog,version=2.4.0 -> C:\Program Files (x86)\Battlelog Web Plugins\2.4.0\npbattlelog.dll No File
FF Plugin-x32: @esn/npbattlelog,version=2.5.1 -> C:\Program Files (x86)\Battlelog Web Plugins\2.5.1\npbattlelog.dll [2014-09-02] (EA Digital Illusions CE AB)
FF Plugin-x32: @esn/npbattlelog,version=2.6.2 -> C:\Program Files (x86)\Battlelog Web Plugins\2.6.2\npbattlelog.dll [2015-01-14] (EA Digital Illusions CE AB)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf -> E:\Programs\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2014-04-15] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf -> E:\Programs\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2014-04-15] (Foxit Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.9.2 -> C:\Windows\SysWOW64\npDeployJava1.dll [2012-12-16] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.9.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll [2012-12-16] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll [2012-03-29] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
FF Plugin HKU\S-1-5-21-3785795450-969359344-1186745032-1000: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\David\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2014-05-31] (Unity Technologies ApS)
FF Plugin HKU\S-1-5-21-3785795450-969359344-1186745032-1000: sony.com/MediaGoDetector -> E:\Programs\Media Go\npMediaGoDetector.dll [2013-08-22] (Sony Network Entertainment International LLC)
FF Plugin HKU\S-1-5-21-3785795450-969359344-1186745032-1000: ubisoft.com/uplaypc -> C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll [2015-05-01] ()
FF user.js: detected! => C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\sifj1b9r.default\user.js [2012-04-10]
FF Extension: DoNotTrackPlus - C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\sifj1b9r.default\Extensions\donottrackplus@abine.com [2013-01-15]
FF Extension: HTTPS-Everywhere - C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\sifj1b9r.default\Extensions\https-everywhere@eff.org [2013-01-15]
FF Extension: Better Battlelog (BBLog) - C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\sifj1b9r.default\Extensions\jid1-qQSMEVsYTOjgYA@jetpack [2014-09-18]
FF Extension: Rikaichan Japanese-English Dictionary File - C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\sifj1b9r.default\Extensions\rikaichan-jpen@polarcloud.com [2013-01-15]
FF Extension: Echofon - C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\sifj1b9r.default\Extensions\twitternotifier@naan.net [2014-03-20]
FF Extension: Rikaichan - C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\sifj1b9r.default\Extensions\{0AA9101C-D3C1-4129-A9B7-D778C6A17F82} [2013-01-15]
FF Extension: DownloadHelper - C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\sifj1b9r.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2013-01-15]
FF Extension: Open Image In New Tab (update) - C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\sifj1b9r.default\Extensions\daigonet@gmail.com.xpi [2014-01-06]
FF Extension: Enhanced Steam - C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\sifj1b9r.default\Extensions\jid0-SmvlvxGpvCyG252KbVMqIKR79Uc@jetpack.xpi [2014-03-20]
FF Extension: Reddit Enhancement Suite - C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\sifj1b9r.default\Extensions\jid1-xUfzOsOFlzSOXg@jetpack.xpi [2014-06-06]
FF Extension: µBlock - C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\sifj1b9r.default\Extensions\{2b10c1c8-a11f-4bad-fe9c-1c11e82cac42}.xpi [2015-01-21]
FF Extension: SmoothWheel (mozdev.org) - C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\sifj1b9r.default\Extensions\{5F590AA2-1221-4113-A6F4-A4BB62414FAC}.xpi [2013-01-15]
FF Extension: Adblock Plus - C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\sifj1b9r.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-01-15]
StartMenuInternet: FIREFOX.EXE - E:\Programs\Firefox\firefox.exe
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
S2 FoxitCloudUpdateService; E:\Programs\Foxit Reader\Foxit Cloud\FCUpdateService.exe [242728 2014-07-01] (Foxit Corporation)
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [22072 2012-09-12] (Microsoft Corporation)
R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [368896 2012-09-12] (Microsoft Corporation)
S3 Origin Client Service; E:\Programs\Origin\OriginClientService.exe [1931632 2015-04-11] (Electronic Arts)
S4 PnkBstrA; C:\Windows\system32\PnkBstrA.exe [76152 2014-11-29] ()
S4 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2014-11-29] ()
S3 TunngleService; E:\Programs\Tunngle\TnglCtrl.exe [762320 2014-11-04] (Tunngle.net GmbH)
R2 VIAKaraokeService; C:\Windows\system32\viakaraokesrv.exe [27760 2011-11-11] (VIA Technologies, Inc.)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2009-07-14] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R0 amdkmpfd; C:\Windows\System32\DRIVERS\amdkmpfd.sys [62152 2014-10-28] (Advanced Micro Devices, Inc.)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [228768 2012-08-30] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [128456 2012-08-30] (Microsoft Corporation)
R3 RecFltr; C:\Windows\System32\drivers\RecFltr.sys [45824 2009-08-12] ()
S3 rzendpt; C:\Windows\System32\DRIVERS\rzendpt.sys [39080 2013-11-15] () [File not signed]
R3 tap0901t; C:\Windows\System32\DRIVERS\tap0901t.sys [31232 2009-09-16] (Tunngle.net)
R3 VBAudioVMVAIOMME; C:\Windows\System32\DRIVERS\vbaudio_vmvaio64_win7.sys [41192 2015-05-17] (Windows (R) Win 7 DDK provider)
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-06-18 00:29 - 2015-06-18 00:34 - 00000000 ____D C:\FRST
2015-06-18 00:28 - 2015-06-18 00:29 - 00000000 ____D C:\Users\David\Desktop\antivirus
2015-06-17 03:22 - 2015-06-17 21:08 - 00000080 _____ C:\Users\David\AppData\Local剜捯獫慴慇敭屳呇⁁屖湥楴汴浥湥湩潦
2015-06-15 23:38 - 2015-06-15 23:38 - 00000000 ____D C:\Users\David\AppData\Roaming\TownOfSalem
2015-06-14 14:15 - 2015-06-16 15:16 - 00007600 _____ C:\Users\David\AppData\Local\Resmon.ResmonCfg
2015-06-02 09:55 - 2015-06-02 10:06 - 00000000 ____D C:\Users\David\AppData\Roaming\Mp3tag
2015-05-24 15:36 - 2015-05-24 21:42 - 00000001 _____ C:\Users\David\AppData\Roaming\update.dat
2015-05-23 01:16 - 2015-05-23 01:16 - 00001269 _____ C:\Users\David\Desktop\skse_loader - Shortcut.lnk
2015-05-19 18:13 - 2015-05-19 18:13 - 00000183 _____ C:\Users\David\Desktop\Grand Theft Auto V.url
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-06-18 00:29 - 2009-07-14 15:13 - 00782470 _____ C:\Windows\system32\PerfStringBackup.INI
2015-06-17 22:52 - 2012-11-09 20:10 - 02034526 _____ C:\Windows\WindowsUpdate.log
2015-06-17 03:28 - 2015-04-11 17:04 - 00000000 ____D C:\Program Files\Rockstar Games
2015-06-17 03:28 - 2015-04-11 17:04 - 00000000 ____D C:\Program Files (x86)\Rockstar Games
2015-06-16 15:09 - 2009-07-14 14:45 - 00010208 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-06-16 15:09 - 2009-07-14 14:45 - 00010208 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-06-16 15:02 - 2014-07-13 21:29 - 00000000 ____D C:\Users\David\AppData\Roaming\Dropbox
2015-06-16 15:01 - 2009-07-14 15:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-06-16 15:01 - 2009-07-14 14:51 - 00124883 _____ C:\Windows\setupact.log
2015-06-14 23:13 - 2013-09-04 13:23 - 00000000 ____D C:\Users\David\AppData\Roaming\OBS
2015-06-14 23:04 - 2012-11-09 20:17 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2015-06-14 22:49 - 2012-11-09 20:08 - 00000000 ____D C:\Users\David
2015-06-14 22:46 - 2014-12-05 23:50 - 00000000 ____D C:\Users\David\AppData\Roaming\MusicBee
2015-06-14 22:46 - 2014-09-28 19:47 - 00000000 ____D C:\Users\David\AppData\Roaming\Rainmeter
2015-06-14 22:46 - 2014-07-10 21:13 - 00000000 ____D C:\Users\David\AppData\Roaming\Talisman
2015-06-14 22:46 - 2014-01-23 07:24 - 00000000 ____D C:\Users\David\AppData\Roaming\qBittorrent
2015-06-14 22:46 - 2013-01-20 23:49 - 00000000 ____D C:\Users\David\AppData\Roaming\vlc
2015-06-14 22:46 - 2012-11-10 18:16 - 00000000 ____D C:\Users\David\Documents\My Games
2015-06-14 22:46 - 2009-07-14 13:20 - 00000000 ____D C:\Windows\registration
2015-06-14 22:46 - 2009-07-14 13:20 - 00000000 ____D C:\Windows\AppCompat
2015-06-04 17:57 - 2015-04-05 13:31 - 00000132 _____ C:\Users\David\AppData\Roaming\Adobe Targa Format CS6 Prefs
2015-06-02 10:07 - 2014-07-15 19:38 - 00000132 _____ C:\Users\David\AppData\Roaming\Adobe PNG Format CS6 Prefs
2015-05-31 18:23 - 2015-01-02 07:29 - 00000000 ____D C:\Users\David\AppData\Local\THQ
2015-05-31 18:23 - 2012-11-10 09:45 - 00482003 _____ C:\Windows\DirectX.log
2015-05-26 20:37 - 2013-08-16 19:35 - 00000000 ____D C:\ProgramData\Origin
2015-05-26 20:28 - 2014-11-29 17:18 - 00226680 _____ C:\Windows\SysWOW64\PnkBstrB.exe
2015-05-26 01:29 - 2014-02-16 07:31 - 00000000 ____D C:\Users\David\AppData\Local\The Witcher
2015-05-26 00:55 - 2015-04-25 20:33 - 00000000 ____D C:\Users\David\AppData\Local\nuclearthrone
2015-05-24 15:36 - 2013-12-22 01:51 - 00000000 ____D C:\Users\David\Documents\Electronic Arts
2015-05-24 14:38 - 2013-02-02 18:45 - 00000000 ____D C:\ProgramData\Package Cache
2015-05-19 12:06 - 2015-05-17 11:41 - 00002867 _____ C:\Users\David\AppData\Roaming\VoiceMeeterDefault.xml
==================== Files in the root of some directories =======
2014-10-15 21:11 - 2014-10-25 20:19 - 0000132 _____ () C:\Users\David\AppData\Roaming\Adobe BMP Format CS6 Prefs
2014-07-15 19:38 - 2015-06-02 10:07 - 0000132 _____ () C:\Users\David\AppData\Roaming\Adobe PNG Format CS6 Prefs
2015-04-05 13:31 - 2015-06-04 17:57 - 0000132 _____ () C:\Users\David\AppData\Roaming\Adobe Targa Format CS6 Prefs
2013-12-02 11:35 - 2013-12-02 10:14 - 0012005 _____ () C:\Users\David\AppData\Roaming\alsoft.ini
2015-01-02 15:55 - 2015-01-02 16:50 - 0002034 _____ () C:\Users\David\AppData\Roaming\SpeedRunnersLog.txt
2015-05-24 15:36 - 2015-05-24 21:42 - 0000001 _____ () C:\Users\David\AppData\Roaming\update.dat
2015-05-17 11:41 - 2015-05-19 12:06 - 0002867 _____ () C:\Users\David\AppData\Roaming\VoiceMeeterDefault.xml
2014-02-18 17:02 - 2014-02-18 17:05 - 0009940 _____ () C:\Users\David\AppData\Local\CleanupUninstall.txt
2014-05-25 18:00 - 2014-05-25 18:05 - 0000600 _____ () C:\Users\David\AppData\Local\PUTTY.RND
2015-06-14 14:15 - 2015-06-16 15:16 - 0007600 _____ () C:\Users\David\AppData\Local\Resmon.ResmonCfg
Files to move or delete:
====================
C:\Users\David\AppData\Roaming\Origin\update.vbe
Some files in TEMP:
====================
C:\Users\David\AppData\Local\Temp\13-12_win7_win8_64_dd_ccc_whql.exe
C:\Users\David\AppData\Local\Temp\ApplicationUpdate.Client.dll
C:\Users\David\AppData\Local\Temp\binkw32.dll
C:\Users\David\AppData\Local\Temp\ccc.exe
C:\Users\David\AppData\Local\Temp\ChangeIcon.exe
C:\Users\David\AppData\Local\Temp\Checkupdate.exe
C:\Users\David\AppData\Local\Temp\CmdLineExt02.dll
C:\Users\David\AppData\Local\Temp\CmdLineExt03.dll
C:\Users\David\AppData\Local\Temp\CountInstallation.exe
C:\Users\David\AppData\Local\Temp\d2l_Install.exe
C:\Users\David\AppData\Local\Temp\d2l_PlayD2.exe
C:\Users\David\AppData\Local\Temp\drm_dyndata_7400009.dll
C:\Users\David\AppData\Local\Temp\drm_dyndata_7410004.dll
C:\Users\David\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmptswup7.dll
C:\Users\David\AppData\Local\Temp\Foxit Reader Updater.exe
C:\Users\David\AppData\Local\Temp\Foxit Updater.exe
C:\Users\David\AppData\Local\Temp\gcapi_dll.dll
C:\Users\David\AppData\Local\Temp\gtapi_signed.dll
C:\Users\David\AppData\Local\Temp\i4jdel0.exe
C:\Users\David\AppData\Local\Temp\patcher_lib.dll
C:\Users\David\AppData\Local\Temp\patcher_update.exe
C:\Users\David\AppData\Local\Temp\raptrpatch.exe
C:\Users\David\AppData\Local\Temp\SIntf16.dll
C:\Users\David\AppData\Local\Temp\SIntf32.dll
C:\Users\David\AppData\Local\Temp\SIntfNT.dll
C:\Users\David\AppData\Local\Temp\sldlext.dll
C:\Users\David\AppData\Local\Temp\SLDL_DLL.dll
C:\Users\David\AppData\Local\Temp\sonarinst.exe
C:\Users\David\AppData\Local\Temp\StartUp.exe
C:\Users\David\AppData\Local\Temp\swt-win32-3349.dll
C:\Users\David\AppData\Local\Temp\TempRealCharacterBuilderUpdater.exe
C:\Users\David\AppData\Local\Temp\tmp4756.exe
C:\Users\David\AppData\Local\Temp\tmpD1BF.exe
C:\Users\David\AppData\Local\Temp\TnPCacheEngine.exe
C:\Users\David\AppData\Local\Temp\TnPUI.dll
C:\Users\David\AppData\Local\Temp\Uninstall.exe
C:\Users\David\AppData\Local\Temp\war3_Install.exe
C:\Users\David\AppData\Local\Temp\xmlUpdater.exe
C:\Users\David\AppData\Local\Temp\_is106C.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-06-13 01:11
==================== End of log ============================
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:13-06-2015
Ran by David (administrator) on DAVID-PC on 18-06-2015 00:34:14
Running from C:\Users\David\Desktop\antivirus\FRST
Loaded Profiles: David (Available Profiles: David)
Platform: Windows 7 Ultimate (X64) OS Language: English (United States)
Internet Explorer Version 8 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool:
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Apple Inc.) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
(VIA Technologies, Inc.) C:\Windows\System32\ViakaraokeSrv.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Microsoft Corporation) C:\Windows\System32\wscript.exe
(Microsoft Corporation) C:\Windows\System32\schtasks.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Razer USA Ltd.) E:\Programs\Razer\Reclusa\razerhid.exe
() E:\Programs\Rainmeter\Rainmeter.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\CCC.exe
() E:\Programs\Razer\Reclusa\razertra.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Valve Corporation) E:\Steam\Steam.exe
(Valve Corporation) E:\Steam\bin\steamwebhelper.exe
(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
(Valve Corporation) E:\Steam\bin\steamwebhelper.exe
(Steven Mayall) E:\Programs\MusicBee\MusicBee.exe
(Valve Corporation) E:\Steam\bin\steamwebhelper.exe
(Mozilla Corporation) E:\Programs\Firefox\firefox.exe
(Mozilla Corporation) E:\Programs\Firefox\plugin-container.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_305.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_305.exe
() C:\Users\David\Desktop\VIRUS IS KILL YES\FRST\FRST64.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
() C:\Users\David\Desktop\VIRUS IS KILL YES\FRST\FRST64.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [1289704 2012-09-12] (Microsoft Corporation)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-02-27] (Intel Corporation)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2010-09-08] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] => E:\Programs\iTunes\iTunesHelper.exe [421160 2010-09-24] (Apple Inc.)
HKLM-x32\...\Run: [amd_dc_opt] => C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe [77824 2008-07-22] (AMD)
HKLM-x32\...\Run: [Reclusa] => E:\Programs\Razer\Reclusa\razerhid.exe [151552 2009-08-12] (Razer USA Ltd.)
HKLM-x32\...\Run: [VirtualCloneDrive] => E:\Programs\VirtualCloneDrive\VCDDaemon.exe [88984 2013-03-11] (Elaborate Bytes AG)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [Razer Synapse] => C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe [442712 2014-01-16] (Razer Inc.)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\amd64\CLIStart.exe [767176 2015-03-31] (Advanced Micro Devices, Inc.)
HKU\S-1-5-21-3785795450-969359344-1186745032-1000\...\Run: [Steam] => E:\Steam\steam.exe [2892992 2015-06-05] (Valve Corporation)
HKU\S-1-5-21-3785795450-969359344-1186745032-1000\...\Run: [RGSC] => E:\Games\GTA IV\Rockstar Games Social Club\RGSCLauncher.exe /silent
HKU\S-1-5-21-3785795450-969359344-1186745032-1000\...\MountPoints2: {b128f636-6865-11e3-a516-10bf48785970} - F:\autorun.exe
Startup: C:\Users\David\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2014-07-13]
ShortcutTarget: Dropbox.lnk -> C:\Users\David\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\David\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Rainmeter.lnk [2014-09-28]
ShortcutTarget: Rainmeter.lnk -> E:\Programs\Rainmeter\Rainmeter.exe ()
ShellIconOverlayIdentifiers: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\David\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\David\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\David\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\David\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\David\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\David\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\David\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\David\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKU\S-1-5-21-3785795450-969359344-1186745032-1000\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-3785795450-969359344-1186745032-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/en-au/?ocid=iehp
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\.DEFAULT -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll [2014-02-27] (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll [2014-02-27] (Oracle Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2012-12-16] (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2012-12-16] (Oracle Corporation)
Filter: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2009-07-14] (Microsoft Corporation)
Filter-x32: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2009-07-14] (Microsoft Corporation)
Filter: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2009-07-14] (Microsoft Corporation)
Filter-x32: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2009-07-14] (Microsoft Corporation)
Hosts: 127.0.0.1 motd.pinion.gg
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
FireFox:
========
FF ProfilePath: C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\sifj1b9r.default
FF Homepage: about:blank
FF NetworkProxy: "autoconfig_url", "http://proxy.newcastle.edu.au/proxy.pac"
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll [2015-02-20] ()
FF Plugin: @esn/npbattlelog,version=2.5.0 -> C:\Program Files (x86)\Battlelog Web Plugins\2.5.0\npbattlelogx64.dll No File
FF Plugin: @esn/npbattlelog,version=2.5.1 -> C:\Program Files (x86)\Battlelog Web Plugins\2.5.1\npbattlelogx64.dll [2014-09-02] (EA Digital Illusions CE AB)
FF Plugin: @esn/npbattlelog,version=2.6.2 -> C:\Program Files (x86)\Battlelog Web Plugins\2.6.2\npbattlelogx64.dll [2015-01-14] (EA Digital Illusions CE AB)
FF Plugin: @java.com/DTPlugin,version=10.51.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll [2014-02-27] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.51.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll [2014-02-27] (Oracle Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll [2015-02-20] ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> E:\Programs\iTunes\Mozilla Plugins\npitunes.dll [2010-09-22] ()
FF Plugin-x32: @esn/npbattlelog,version=2.3.2 -> C:\Program Files (x86)\Battlelog Web Plugins\2.3.2\npbattlelog.dll No File
FF Plugin-x32: @esn/npbattlelog,version=2.4.0 -> C:\Program Files (x86)\Battlelog Web Plugins\2.4.0\npbattlelog.dll No File
FF Plugin-x32: @esn/npbattlelog,version=2.5.1 -> C:\Program Files (x86)\Battlelog Web Plugins\2.5.1\npbattlelog.dll [2014-09-02] (EA Digital Illusions CE AB)
FF Plugin-x32: @esn/npbattlelog,version=2.6.2 -> C:\Program Files (x86)\Battlelog Web Plugins\2.6.2\npbattlelog.dll [2015-01-14] (EA Digital Illusions CE AB)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf -> E:\Programs\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2014-04-15] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf -> E:\Programs\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2014-04-15] (Foxit Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.9.2 -> C:\Windows\SysWOW64\npDeployJava1.dll [2012-12-16] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.9.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll [2012-12-16] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll [2012-03-29] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
FF Plugin HKU\S-1-5-21-3785795450-969359344-1186745032-1000: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\David\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2014-05-31] (Unity Technologies ApS)
FF Plugin HKU\S-1-5-21-3785795450-969359344-1186745032-1000: sony.com/MediaGoDetector -> E:\Programs\Media Go\npMediaGoDetector.dll [2013-08-22] (Sony Network Entertainment International LLC)
FF Plugin HKU\S-1-5-21-3785795450-969359344-1186745032-1000: ubisoft.com/uplaypc -> C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll [2015-05-01] ()
FF user.js: detected! => C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\sifj1b9r.default\user.js [2012-04-10]
FF Extension: DoNotTrackPlus - C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\sifj1b9r.default\Extensions\donottrackplus@abine.com [2013-01-15]
FF Extension: HTTPS-Everywhere - C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\sifj1b9r.default\Extensions\https-everywhere@eff.org [2013-01-15]
FF Extension: Better Battlelog (BBLog) - C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\sifj1b9r.default\Extensions\jid1-qQSMEVsYTOjgYA@jetpack [2014-09-18]
FF Extension: Rikaichan Japanese-English Dictionary File - C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\sifj1b9r.default\Extensions\rikaichan-jpen@polarcloud.com [2013-01-15]
FF Extension: Echofon - C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\sifj1b9r.default\Extensions\twitternotifier@naan.net [2014-03-20]
FF Extension: Rikaichan - C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\sifj1b9r.default\Extensions\{0AA9101C-D3C1-4129-A9B7-D778C6A17F82} [2013-01-15]
FF Extension: DownloadHelper - C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\sifj1b9r.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2013-01-15]
FF Extension: Open Image In New Tab (update) - C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\sifj1b9r.default\Extensions\daigonet@gmail.com.xpi [2014-01-06]
FF Extension: Enhanced Steam - C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\sifj1b9r.default\Extensions\jid0-SmvlvxGpvCyG252KbVMqIKR79Uc@jetpack.xpi [2014-03-20]
FF Extension: Reddit Enhancement Suite - C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\sifj1b9r.default\Extensions\jid1-xUfzOsOFlzSOXg@jetpack.xpi [2014-06-06]
FF Extension: µBlock - C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\sifj1b9r.default\Extensions\{2b10c1c8-a11f-4bad-fe9c-1c11e82cac42}.xpi [2015-01-21]
FF Extension: SmoothWheel (mozdev.org) - C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\sifj1b9r.default\Extensions\{5F590AA2-1221-4113-A6F4-A4BB62414FAC}.xpi [2013-01-15]
FF Extension: Adblock Plus - C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\sifj1b9r.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-01-15]
StartMenuInternet: FIREFOX.EXE - E:\Programs\Firefox\firefox.exe
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
S2 FoxitCloudUpdateService; E:\Programs\Foxit Reader\Foxit Cloud\FCUpdateService.exe [242728 2014-07-01] (Foxit Corporation)
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [22072 2012-09-12] (Microsoft Corporation)
R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [368896 2012-09-12] (Microsoft Corporation)
S3 Origin Client Service; E:\Programs\Origin\OriginClientService.exe [1931632 2015-04-11] (Electronic Arts)
S4 PnkBstrA; C:\Windows\system32\PnkBstrA.exe [76152 2014-11-29] ()
S4 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2014-11-29] ()
S3 TunngleService; E:\Programs\Tunngle\TnglCtrl.exe [762320 2014-11-04] (Tunngle.net GmbH)
R2 VIAKaraokeService; C:\Windows\system32\viakaraokesrv.exe [27760 2011-11-11] (VIA Technologies, Inc.)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2009-07-14] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R0 amdkmpfd; C:\Windows\System32\DRIVERS\amdkmpfd.sys [62152 2014-10-28] (Advanced Micro Devices, Inc.)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [228768 2012-08-30] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [128456 2012-08-30] (Microsoft Corporation)
R3 RecFltr; C:\Windows\System32\drivers\RecFltr.sys [45824 2009-08-12] ()
S3 rzendpt; C:\Windows\System32\DRIVERS\rzendpt.sys [39080 2013-11-15] () [File not signed]
R3 tap0901t; C:\Windows\System32\DRIVERS\tap0901t.sys [31232 2009-09-16] (Tunngle.net)
R3 VBAudioVMVAIOMME; C:\Windows\System32\DRIVERS\vbaudio_vmvaio64_win7.sys [41192 2015-05-17] (Windows (R) Win 7 DDK provider)
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-06-18 00:29 - 2015-06-18 00:34 - 00000000 ____D C:\FRST
2015-06-18 00:28 - 2015-06-18 00:29 - 00000000 ____D C:\Users\David\Desktop\antivirus
2015-06-17 03:22 - 2015-06-17 21:08 - 00000080 _____ C:\Users\David\AppData\Local剜捯獫慴慇敭屳呇⁁屖湥楴汴浥湥湩潦
2015-06-15 23:38 - 2015-06-15 23:38 - 00000000 ____D C:\Users\David\AppData\Roaming\TownOfSalem
2015-06-14 14:15 - 2015-06-16 15:16 - 00007600 _____ C:\Users\David\AppData\Local\Resmon.ResmonCfg
2015-06-02 09:55 - 2015-06-02 10:06 - 00000000 ____D C:\Users\David\AppData\Roaming\Mp3tag
2015-05-24 15:36 - 2015-05-24 21:42 - 00000001 _____ C:\Users\David\AppData\Roaming\update.dat
2015-05-23 01:16 - 2015-05-23 01:16 - 00001269 _____ C:\Users\David\Desktop\skse_loader - Shortcut.lnk
2015-05-19 18:13 - 2015-05-19 18:13 - 00000183 _____ C:\Users\David\Desktop\Grand Theft Auto V.url
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-06-18 00:29 - 2009-07-14 15:13 - 00782470 _____ C:\Windows\system32\PerfStringBackup.INI
2015-06-17 22:52 - 2012-11-09 20:10 - 02034526 _____ C:\Windows\WindowsUpdate.log
2015-06-17 03:28 - 2015-04-11 17:04 - 00000000 ____D C:\Program Files\Rockstar Games
2015-06-17 03:28 - 2015-04-11 17:04 - 00000000 ____D C:\Program Files (x86)\Rockstar Games
2015-06-16 15:09 - 2009-07-14 14:45 - 00010208 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-06-16 15:09 - 2009-07-14 14:45 - 00010208 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-06-16 15:02 - 2014-07-13 21:29 - 00000000 ____D C:\Users\David\AppData\Roaming\Dropbox
2015-06-16 15:01 - 2009-07-14 15:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-06-16 15:01 - 2009-07-14 14:51 - 00124883 _____ C:\Windows\setupact.log
2015-06-14 23:13 - 2013-09-04 13:23 - 00000000 ____D C:\Users\David\AppData\Roaming\OBS
2015-06-14 23:04 - 2012-11-09 20:17 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2015-06-14 22:49 - 2012-11-09 20:08 - 00000000 ____D C:\Users\David
2015-06-14 22:46 - 2014-12-05 23:50 - 00000000 ____D C:\Users\David\AppData\Roaming\MusicBee
2015-06-14 22:46 - 2014-09-28 19:47 - 00000000 ____D C:\Users\David\AppData\Roaming\Rainmeter
2015-06-14 22:46 - 2014-07-10 21:13 - 00000000 ____D C:\Users\David\AppData\Roaming\Talisman
2015-06-14 22:46 - 2014-01-23 07:24 - 00000000 ____D C:\Users\David\AppData\Roaming\qBittorrent
2015-06-14 22:46 - 2013-01-20 23:49 - 00000000 ____D C:\Users\David\AppData\Roaming\vlc
2015-06-14 22:46 - 2012-11-10 18:16 - 00000000 ____D C:\Users\David\Documents\My Games
2015-06-14 22:46 - 2009-07-14 13:20 - 00000000 ____D C:\Windows\registration
2015-06-14 22:46 - 2009-07-14 13:20 - 00000000 ____D C:\Windows\AppCompat
2015-06-04 17:57 - 2015-04-05 13:31 - 00000132 _____ C:\Users\David\AppData\Roaming\Adobe Targa Format CS6 Prefs
2015-06-02 10:07 - 2014-07-15 19:38 - 00000132 _____ C:\Users\David\AppData\Roaming\Adobe PNG Format CS6 Prefs
2015-05-31 18:23 - 2015-01-02 07:29 - 00000000 ____D C:\Users\David\AppData\Local\THQ
2015-05-31 18:23 - 2012-11-10 09:45 - 00482003 _____ C:\Windows\DirectX.log
2015-05-26 20:37 - 2013-08-16 19:35 - 00000000 ____D C:\ProgramData\Origin
2015-05-26 20:28 - 2014-11-29 17:18 - 00226680 _____ C:\Windows\SysWOW64\PnkBstrB.exe
2015-05-26 01:29 - 2014-02-16 07:31 - 00000000 ____D C:\Users\David\AppData\Local\The Witcher
2015-05-26 00:55 - 2015-04-25 20:33 - 00000000 ____D C:\Users\David\AppData\Local\nuclearthrone
2015-05-24 15:36 - 2013-12-22 01:51 - 00000000 ____D C:\Users\David\Documents\Electronic Arts
2015-05-24 14:38 - 2013-02-02 18:45 - 00000000 ____D C:\ProgramData\Package Cache
2015-05-19 12:06 - 2015-05-17 11:41 - 00002867 _____ C:\Users\David\AppData\Roaming\VoiceMeeterDefault.xml
==================== Files in the root of some directories =======
2014-10-15 21:11 - 2014-10-25 20:19 - 0000132 _____ () C:\Users\David\AppData\Roaming\Adobe BMP Format CS6 Prefs
2014-07-15 19:38 - 2015-06-02 10:07 - 0000132 _____ () C:\Users\David\AppData\Roaming\Adobe PNG Format CS6 Prefs
2015-04-05 13:31 - 2015-06-04 17:57 - 0000132 _____ () C:\Users\David\AppData\Roaming\Adobe Targa Format CS6 Prefs
2013-12-02 11:35 - 2013-12-02 10:14 - 0012005 _____ () C:\Users\David\AppData\Roaming\alsoft.ini
2015-01-02 15:55 - 2015-01-02 16:50 - 0002034 _____ () C:\Users\David\AppData\Roaming\SpeedRunnersLog.txt
2015-05-24 15:36 - 2015-05-24 21:42 - 0000001 _____ () C:\Users\David\AppData\Roaming\update.dat
2015-05-17 11:41 - 2015-05-19 12:06 - 0002867 _____ () C:\Users\David\AppData\Roaming\VoiceMeeterDefault.xml
2014-02-18 17:02 - 2014-02-18 17:05 - 0009940 _____ () C:\Users\David\AppData\Local\CleanupUninstall.txt
2014-05-25 18:00 - 2014-05-25 18:05 - 0000600 _____ () C:\Users\David\AppData\Local\PUTTY.RND
2015-06-14 14:15 - 2015-06-16 15:16 - 0007600 _____ () C:\Users\David\AppData\Local\Resmon.ResmonCfg
Files to move or delete:
====================
C:\Users\David\AppData\Roaming\Origin\update.vbe
Some files in TEMP:
====================
C:\Users\David\AppData\Local\Temp\13-12_win7_win8_64_dd_ccc_whql.exe
C:\Users\David\AppData\Local\Temp\ApplicationUpdate.Client.dll
C:\Users\David\AppData\Local\Temp\binkw32.dll
C:\Users\David\AppData\Local\Temp\ccc.exe
C:\Users\David\AppData\Local\Temp\ChangeIcon.exe
C:\Users\David\AppData\Local\Temp\Checkupdate.exe
C:\Users\David\AppData\Local\Temp\CmdLineExt02.dll
C:\Users\David\AppData\Local\Temp\CmdLineExt03.dll
C:\Users\David\AppData\Local\Temp\CountInstallation.exe
C:\Users\David\AppData\Local\Temp\d2l_Install.exe
C:\Users\David\AppData\Local\Temp\d2l_PlayD2.exe
C:\Users\David\AppData\Local\Temp\drm_dyndata_7400009.dll
C:\Users\David\AppData\Local\Temp\drm_dyndata_7410004.dll
C:\Users\David\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmptswup7.dll
C:\Users\David\AppData\Local\Temp\Foxit Reader Updater.exe
C:\Users\David\AppData\Local\Temp\Foxit Updater.exe
C:\Users\David\AppData\Local\Temp\gcapi_dll.dll
C:\Users\David\AppData\Local\Temp\gtapi_signed.dll
C:\Users\David\AppData\Local\Temp\i4jdel0.exe
C:\Users\David\AppData\Local\Temp\patcher_lib.dll
C:\Users\David\AppData\Local\Temp\patcher_update.exe
C:\Users\David\AppData\Local\Temp\raptrpatch.exe
C:\Users\David\AppData\Local\Temp\SIntf16.dll
C:\Users\David\AppData\Local\Temp\SIntf32.dll
C:\Users\David\AppData\Local\Temp\SIntfNT.dll
C:\Users\David\AppData\Local\Temp\sldlext.dll
C:\Users\David\AppData\Local\Temp\SLDL_DLL.dll
C:\Users\David\AppData\Local\Temp\sonarinst.exe
C:\Users\David\AppData\Local\Temp\StartUp.exe
C:\Users\David\AppData\Local\Temp\swt-win32-3349.dll
C:\Users\David\AppData\Local\Temp\TempRealCharacterBuilderUpdater.exe
C:\Users\David\AppData\Local\Temp\tmp4756.exe
C:\Users\David\AppData\Local\Temp\tmpD1BF.exe
C:\Users\David\AppData\Local\Temp\TnPCacheEngine.exe
C:\Users\David\AppData\Local\Temp\TnPUI.dll
C:\Users\David\AppData\Local\Temp\Uninstall.exe
C:\Users\David\AppData\Local\Temp\war3_Install.exe
C:\Users\David\AppData\Local\Temp\xmlUpdater.exe
C:\Users\David\AppData\Local\Temp\_is106C.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-06-13 01:11
==================== End of log ============================