Welcome to MalwareRemoval.com,
What if we told you that you could get malware removal help from experts, and that it was 100% free? MalwareRemoval.com provides free support for people with infected computers. Our help, and the tools we use are always 100% free. No hidden catch. We simply enjoy helping others. You enjoy a clean, safe computer.

Malware Removal Instructions

Take the Coupon and More!

MalwareRemoval.com provides free support for people with infected computers. Using plain language that anyone can understand, our community of volunteer experts will walk you through each step.

Re: Take the Coupon and More!

Unread postby kokuorei » August 20th, 2015, 6:46 pm

Also, it restarted itself today while I was at work.
kokuorei
Active Member
 
Posts: 11
Joined: August 10th, 2015, 8:04 pm
Advertisement
Register to Remove

Re: Take the Coupon and More!

Unread postby Firefly » August 20th, 2015, 6:50 pm

Music CODEC pack. If you dont know what it is, you probably did not install it.
User avatar
Firefly
Regular Member
 
Posts: 949
Joined: March 5th, 2014, 4:33 pm

Re: Take the Coupon and More!

Unread postby Firefly » August 20th, 2015, 8:45 pm

Good news – I looked at the files I had you scan, and they are not a backdoor which would have potentially been an uncurable situation. Now that we know that, lets complete the main part of the cleaning and then see what we have left.


FRST fix

Before beginning, please delete the previous file we created called fixlist.txt.

  • Click Start
  • Type notepad.exe in the search programs and files box and click Enter.
  • A blank Notepad page should open.
    • Copy and Paste the following script into Notepad, Do not include the words Code: select all
    • (Click the select all button next to code to select the entire script).
    Code: Select all
    () C:\Program Files (x86)\Responsive Feel\Responsive Feel.exe
    () C:\Program Files (x86)\Scant Nerve\Scant Nerve.exe
    CHR HKU\S-1-5-21-3048285104-2006604149-165245714-1001\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
    CHR dev: Chrome dev build detected! <======= ATTENTION
    R2 Responsive Feel; C:\Program Files (x86)\Responsive Feel\Responsive Feel.exe [8016288 2015-07-07] () [File not signed] <==== ATTENTION
    R2 Scant Nerve; C:\Program Files (x86)\Scant Nerve\Scant Nerve.exe [8016353 2015-07-22] () [File not signed] <==== ATTENTION
    S2 gupdate; "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc [X]
    S3 gupdatem; "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /medsvc [X]
    S3 BRDriver64_1_3_3_E02B25FC; \??\C:\ProgramData\BitRaider\support\1.3.3\E02B25FC\BRDriver64.sys [X]
    C:\ProgramData\kglgcfnbkhgdnpdhkelddjehdhicddpk
    C:\ProgramData\lghldfnhhcodhcdihlokeohgjpbcjelk
    C:\Program Files (x86)\Scant Nerve
    C:\Program Files (x86)\Responsive Feel
    C:\Users\Claud\Favorites\StumbleUpon
    C:\Program Files (x86)\PragmaInstance
    C:\WINDOWS\SysWOW64\C2MP
    2015-07-07 21:23 - 2015-07-07 21:22 - 08016288 _____ () C:\Program Files (x86)\Responsive Feel\Responsive Feel.exe
    2015-07-22 09:02 - 2015-07-22 09:01 - 08016353 _____ () C:\Program Files (x86)\Scant Nerve\Scant Nerve.exe
    HKLM-x32\...\Run: [Codec Settings UAC Manager] => C:\WINDOWS\SysWOW64\C2MP\CodecUACManager.exe [60416 2015-03-05] ()
    HKU\S-1-5-21-3048285104-2006604149-165245714-1001\...\Run: [Codec Pack Update Checker] => "C:\WINDOWS\system32\C2MP\UpdateChecker.exe"
    Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\CodecPackTrayMenu.lnk [2015-03-15]
    ShortcutTarget: CodecPackTrayMenu.lnk -> C:\Windows\SysWOW64\C2MP\TrayMenu.exe ()
    Hosts:
    EmptyTemp:
    CMD: ipconfig /flushdns
    Reboot:
    
  • Save it next to FRST.exe as filename fixlist.txt
  • NOTE: It's important that both files, FRST/FRST64 and fixlist.txt are saved in the same location or the fix will not work.
  • Right-click FRST.exe and select " Run as administrator " to run it.
  • Press the Fix button just once. Then wait. The computer will restart.
  • When finished, it will create a Fixlog.txt log on your Desktop.
  • Please post the content of the Fixlog.txt in your next reply.

This should really clean the bulk of what I saw (if not all). Lets get a fresh scan so we can see how everything looks…


Revised FRST Scan

Please delete your copy of FRST/FRST64, and re-download FRST ... by Farbar, from the link below and save it to your Desktop (it gets updated very often, so a new copy is always important).

For 64 bit Systems

  • Right-click FRST.exe and select " Run as administrator " to run it.
  • When the tool opens click Yes to the disclaimer.
  • In addition to what is already checked, please place a check mark in the lower right hand box labeled “Addition.txt”
  • Press Scan button. ... When finished a log will be created, FRST.txt.
  • Please post the content of the FRST.txt in your next reply.
  • Please post the content of the Addition.txt in your next reply.


Next Steps

1. Post the new fixlog.txt log
2. Post the new FRST.txt log
3. Post the new additional.txt log

Please also try using the computer via Internet Explorer. Are you still getting pop-ups when using that program? How is it running?
User avatar
Firefly
Regular Member
 
Posts: 949
Joined: March 5th, 2014, 4:33 pm

Re: Take the Coupon and More!

Unread postby kokuorei » August 21st, 2015, 10:41 pm

Fix result of Farbar Recovery Scan Tool (x64) Version:20-08-2015
Ran by Claud (2015-08-21 22:11:18) Run:2
Running from C:\Users\Claud\Desktop\antimalware
Loaded Profiles: Claud (Available Profiles: Claud & Administrator)
Boot Mode: Normal
==============================================

fixlist content:
*****************
() C:\Program Files (x86)\Responsive Feel\Responsive Feel.exe
() C:\Program Files (x86)\Scant Nerve\Scant Nerve.exe
CHR HKU\S-1-5-21-3048285104-2006604149-165245714-1001\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
CHR dev: Chrome dev build detected! <======= ATTENTION
R2 Responsive Feel; C:\Program Files (x86)\Responsive Feel\Responsive Feel.exe [8016288 2015-07-07] () [File not signed] <==== ATTENTION
R2 Scant Nerve; C:\Program Files (x86)\Scant Nerve\Scant Nerve.exe [8016353 2015-07-22] () [File not signed] <==== ATTENTION
S2 gupdate; "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc [X]
S3 gupdatem; "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /medsvc [X]
S3 BRDriver64_1_3_3_E02B25FC; \??\C:\ProgramData\BitRaider\support\1.3.3\E02B25FC\BRDriver64.sys [X]
C:\ProgramData\kglgcfnbkhgdnpdhkelddjehdhicddpk
C:\ProgramData\lghldfnhhcodhcdihlokeohgjpbcjelk
C:\Program Files (x86)\Scant Nerve
C:\Program Files (x86)\Responsive Feel
C:\Users\Claud\Favorites\StumbleUpon
C:\Program Files (x86)\PragmaInstance
C:\WINDOWS\SysWOW64\C2MP
2015-07-07 21:23 - 2015-07-07 21:22 - 08016288 _____ () C:\Program Files (x86)\Responsive Feel\Responsive Feel.exe
2015-07-22 09:02 - 2015-07-22 09:01 - 08016353 _____ () C:\Program Files (x86)\Scant Nerve\Scant Nerve.exe
HKLM-x32\...\Run: [Codec Settings UAC Manager] => C:\WINDOWS\SysWOW64\C2MP\CodecUACManager.exe [60416 2015-03-05] ()
HKU\S-1-5-21-3048285104-2006604149-165245714-1001\...\Run: [Codec Pack Update Checker] => "C:\WINDOWS\system32\C2MP\UpdateChecker.exe"
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\CodecPackTrayMenu.lnk [2015-03-15]
ShortcutTarget: CodecPackTrayMenu.lnk -> C:\Windows\SysWOW64\C2MP\TrayMenu.exe ()
Hosts:
EmptyTemp:
CMD: ipconfig /flushdns
Reboot:
*****************

[2012] C:\Program Files (x86)\Responsive Feel\Responsive Feel.exe => process closed successfully.
C:\Program Files (x86)\Scant Nerve\Scant Nerve.exe => No running process found
HKU\S-1-5-21-3048285104-2006604149-165245714-1001\SOFTWARE\Policies\Google => key not found.
CHR dev: Chrome dev build detected! <======= ATTENTION => Error: No automatic fix found for this entry.
Responsive Feel => service removed successfully
Scant Nerve => service not found.
gupdate => service removed successfully
gupdatem => service removed successfully
BRDriver64_1_3_3_E02B25FC => service removed successfully
C:\ProgramData\kglgcfnbkhgdnpdhkelddjehdhicddpk => moved successfully
C:\ProgramData\lghldfnhhcodhcdihlokeohgjpbcjelk => moved successfully
C:\Program Files (x86)\Scant Nerve => moved successfully
C:\Program Files (x86)\Responsive Feel => moved successfully
"C:\Users\Claud\Favorites\StumbleUpon" => File/Folder not found.
"C:\Program Files (x86)\PragmaInstance" => File/Folder not found.
C:\WINDOWS\SysWOW64\C2MP => moved successfully
"C:\Program Files (x86)\Responsive Feel\Responsive Feel.exe" => File/Folder not found.
"C:\Program Files (x86)\Scant Nerve\Scant Nerve.exe" => File/Folder not found.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\Codec Settings UAC Manager => value removed successfully
HKU\S-1-5-21-3048285104-2006604149-165245714-1001\Software\Microsoft\Windows\CurrentVersion\Run\\Codec Pack Update Checker => value removed successfully
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\CodecPackTrayMenu.lnk => moved successfully
C:\Windows\SysWOW64\C2MP\TrayMenu.exe not found.
C:\Windows\System32\Drivers\etc\hosts => moved successfully
Hosts restored successfully.

========= ipconfig /flushdns =========


Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

========= End of CMD: =========

EmptyTemp: => 2.2 GB temporary data Removed.


The system needed a reboot..

==== End of Fixlog 22:13:32 ====

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:20-08-2015
Ran by Claud (administrator) on CLAUD (21-08-2015 22:33:59)
Running from C:\Users\Claud\Desktop\antimalware
Loaded Profiles: Claud (Available Profiles: Claud & Administrator)
Platform: Windows 8.1 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/33 ... scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Advanced Micro Devices, Inc.) C:\Program Files\AMD\ATI.ACE\Fuel\Fuel.Service.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Symantec Corporation) C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe
(Symantec Corporation) C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.18.15\ccSvcHst.exe
(TOSHIBA Corporation) C:\Windows\System32\TODDSrv.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\Teco\TecoService.exe
(Symantec Corporation) C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.18.15\ccSvcHst.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Avast Software) C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\Hotkey\TCrdMain_Win8.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\Teco\TecoResident.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Yahoo! Inc.) C:\Program Files (x86)\Yahoo!\Messenger\Ymsgr_tray.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Symantec Corporation) C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.18.15\SymcPCCULaunchSvc.exe
(TOSHIBA CORPORATION) C:\Program Files\Toshiba\HDD Accelerator\THAccelSvc.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\TOSHIBA Service Station\ToshibaServiceStation.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\TOSHIBA Service Station\TMachInfo.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20911_x64__8wekyb3d8bbwe\livecomm.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13196432 2012-09-26] (Realtek Semiconductor)
HKLM\...\Run: [TCrdMain] => C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe [2608040 2012-08-13] (TOSHIBA Corporation)
HKLM\...\Run: [TecoResident] => C:\Program Files\TOSHIBA\Teco\TecoResident.exe [169896 2012-08-13] (TOSHIBA Corporation)
HKLM\...\Run: [TODDMain] => C:\Program Files (x86)\TOSHIBA\System Setting\TODDMain.exe [213136 2012-08-04] ()
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2916152 2012-08-16] (Synaptics Incorporated)
HKLM-x32\...\Run: [Norton Online Backup] => C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe [2995904 2012-07-11] (Symantec Corporation)
HKLM-x32\...\Run: [ToshibaAppPlace] => C:\Program Files (x86)\Toshiba\Toshiba App Place\ToshibaAppPlace.exe [552960 2010-09-23] (Toshiba)
HKLM-x32\...\Run: [Arc] => C:\Program Files (x86)\Perfect World Entertainment\Arc\ArcLauncher.exe [416080 2015-07-31] (Perfect World Entertainment)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\amd64\CLIStart.exe [767176 2014-11-20] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [USB Optical Mouse] => C:\Program Files (x86)\USB Optical Mouse\USB Optical Mouse\MouseHid.exe [245248 2010-03-30] ()
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-02-06] (Apple Inc.)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [6109776 2015-08-19] (AVAST Software)
HKU\S-1-5-21-3048285104-2006604149-165245714-1001\...\Run: [Messenger (Yahoo!)] => C:\Program Files (x86)\Yahoo!\Messenger\YahooMessenger.exe [6595928 2012-05-25] (Yahoo! Inc.)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2015-08-19] (AVAST Software)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://toshiba13.msn.com
HKU\S-1-5-21-3048285104-2006604149-165245714-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://toshiba13.msn.com
HKU\S-1-5-21-3048285104-2006604149-165245714-1001\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://mystart.toshiba.com
SearchScopes: HKU\S-1-5-21-3048285104-2006604149-165245714-1001 -> DefaultScope {92544912-734A-4084-AB73-1C568654AB23} URL =
SearchScopes: HKU\S-1-5-21-3048285104-2006604149-165245714-1001 -> {92544912-734A-4084-AB73-1C568654AB23} URL =
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2015-08-19] (AVAST Software)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2015-08-19] (AVAST Software)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
Tcpip\..\Interfaces\{27A498BD-2781-454C-92A6-FEF977857437}: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Claud\AppData\Roaming\Mozilla\Firefox\Profiles\fei3oldc.default
FF DefaultSearchEngine.US: Google
FF Homepage: about:newtab
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_18_0_0_232.dll [2015-08-16] ()
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_18_0_0_232.dll [2015-08-16] ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-02-06] ()
FF Plugin-x32: @messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6 -> C:\Program Files (x86)\Yahoo!\Shared\npYState.dll [2012-05-25] (Yahoo! Inc.)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3503.0728 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-07-28] (Microsoft Corporation)
FF Plugin-x32: @perfectworld.com/npArcPlayNowPlugin -> C:\Program Files (x86)\Perfect World Entertainment\Arc\plugins\npArcPluginFF.dll [2015-07-31] (Perfect World Entertainment Inc)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-14] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-14] (Google Inc.)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll [2012-05-11] ()
FF Plugin HKU\S-1-5-21-3048285104-2006604149-165245714-1001: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Claud\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2015-05-11] (Unity Technologies ApS)
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2015-08-19]

Chrome:
=======
CHR dev: Chrome dev build detected! <======= ATTENTION
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-08-19]

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AMD FUEL Service; C:\Program Files\AMD\ATI.ACE\Fuel\Fuel.Service.exe [344064 2014-11-20] (Advanced Micro Devices, Inc.) [File not signed]
S3 ArcService; C:\Program Files (x86)\Perfect World Entertainment\Arc\ArcService.exe [88400 2015-07-31] (Perfect World Entertainment Inc)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [146600 2015-08-19] (AVAST Software)
R3 AvastVBoxSvc; C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe [4047768 2015-08-19] (Avast Software)
S3 BthHFSrv; C:\Windows\System32\BthHFSrv.dll [324608 2014-11-21] (Microsoft Corporation)
S4 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2015-04-14] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation)
R2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [3939008 2012-07-11] (Symantec Corporation)
R2 Norton PC Checkup Application Launcher; C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.18.15\SymcPCCULaunchSvc.exe [123320 2012-07-23] (Symantec Corporation)
R2 PCCUJobMgr; C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.18.15\ccSvcHst.exe [126392 2012-07-23] (Symantec Corporation)
R2 THAccelSvc; C:\Program Files\TOSHIBA\HDD Accelerator\THAccelSvc.exe [214488 2012-08-10] (TOSHIBA CORPORATION)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366552 2015-07-07] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2015-07-07] (Microsoft Corporation)

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S5 3ware; C:\Windows\System32\drivers\3ware.sys [108896 2013-08-22] (LSI)
R5 ACPI; C:\Windows\System32\drivers\ACPI.sys [533824 2014-11-21] (Microsoft Corporation)
R5 acpiex; C:\Windows\System32\Drivers\acpiex.sys [79712 2013-08-22] (Microsoft Corporation)
S5 ADP80XX; C:\Windows\System32\drivers\ADP80XX.SYS [782176 2013-08-22] (PMC-Sierra)
S5 agp440; C:\Windows\System32\drivers\agp440.sys [62304 2013-08-22] (Microsoft Corporation)
S5 amdsata; C:\Windows\System32\drivers\amdsata.sys [79200 2013-08-22] (Advanced Micro Devices)
S5 amdsbs; C:\Windows\System32\drivers\amdsbs.sys [259424 2013-08-22] (AMD Technologies Inc.)
S5 amdxata; C:\Windows\System32\drivers\amdxata.sys [25952 2013-08-22] (Advanced Micro Devices)
S5 arcsas; C:\Windows\System32\drivers\arcsas.sys [114016 2013-08-22] (PMC-Sierra, Inc.)
R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [28656 2015-08-19] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [90968 2015-08-19] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93528 2015-08-19] (AVAST Software)
R5 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65224 2015-08-19] (AVAST Software)
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1048344 2015-08-19] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [447944 2015-08-19] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [150672 2015-08-19] (AVAST Software)
R5 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [274808 2015-08-19] (AVAST Software)
S5 atapi; C:\Windows\System32\drivers\atapi.sys [26464 2013-08-22] (Microsoft Corporation)
S5 b06bdrv; C:\Windows\System32\drivers\bxvbda.sys [531296 2013-08-22] (Broadcom Corporation)
R1 ccSet_NARA; C:\Windows\system32\drivers\NARAx64\0401000.00B\ccSetx64.sys [168608 2012-05-25] (Symantec Corporation)
R5 CLFS; C:\Windows\System32\drivers\CLFS.sys [377152 2015-03-04] (Microsoft Corporation)
R5 CNG; C:\Windows\System32\Drivers\cng.sys [561928 2015-03-30] (Microsoft Corporation)
R5 disk; C:\Windows\System32\drivers\disk.sys [100192 2013-08-22] (Microsoft Corporation)
S5 ebdrv; C:\Windows\System32\drivers\evbda.sys [3357024 2013-08-22] (Broadcom Corporation)
R5 EhStorClass; C:\Windows\System32\drivers\EhStorClass.sys [82784 2013-08-22] (Microsoft Corporation)
S5 EhStorTcgDrv; C:\Windows\System32\drivers\EhStorTcgDrv.sys [114016 2013-08-22] (Microsoft Corporation)
R5 FileInfo; C:\Windows\System32\drivers\fileinfo.sys [79192 2014-11-21] (Microsoft Corporation)
R5 FltMgr; C:\Windows\System32\drivers\fltmgr.sys [354112 2014-11-21] (Microsoft Corporation)
U5 Fs_Rec; C:\Windows\System32\Drivers\Fs_Rec.sys [30048 2013-08-22] (Microsoft Corporation)
R5 fvevol; C:\Windows\System32\DRIVERS\fvevol.sys [589656 2014-11-21] (Microsoft Corporation)
S5 gagp30kx; C:\Windows\System32\drivers\gagp30kx.sys [65888 2013-08-22] (Microsoft Corporation)
S3 ghsandroid; C:\Windows\System32\Drivers\ghsandroid.sys [38424 2011-03-30] (Google Inc)
S5 HpSAMD; C:\Windows\System32\drivers\HpSAMD.sys [64352 2013-08-22] (Hewlett-Packard Company)
S5 hwpolicy; C:\Windows\System32\drivers\hwpolicy.sys [24416 2013-08-22] (Microsoft Corporation)
S5 iaStorAV; C:\Windows\System32\drivers\iaStorAV.sys [651248 2013-08-09] (Intel Corporation)
S5 iaStorV; C:\Windows\System32\drivers\iaStorV.sys [412000 2013-08-22] (Intel Corporation)
S5 intelide; C:\Windows\System32\drivers\intelide.sys [18272 2013-08-22] (Microsoft Corporation)
R5 intelpep; C:\Windows\System32\drivers\intelpep.sys [39744 2014-11-21] (Microsoft Corporation)
S5 isapnp; C:\Windows\System32\drivers\isapnp.sys [21856 2013-08-22] (Microsoft Corporation)
R5 KSecDD; C:\Windows\System32\Drivers\ksecdd.sys [100672 2014-11-21] (Microsoft Corporation)
R5 KSecPkg; C:\Windows\System32\Drivers\ksecpkg.sys [178008 2015-06-28] (Microsoft Corporation)
S5 LSI_SAS; C:\Windows\System32\drivers\lsi_sas.sys [109408 2013-08-22] (LSI Corporation)
S5 LSI_SAS2; C:\Windows\System32\drivers\lsi_sas2.sys [93536 2013-08-22] (LSI Corporation)
S5 LSI_SAS3; C:\Windows\System32\drivers\lsi_sas3.sys [81760 2013-08-22] (LSI Corporation)
S5 LSI_SSS; C:\Windows\System32\drivers\lsi_sss.sys [82784 2013-08-22] (LSI Corporation)
R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2015-04-14] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2015-04-14] (Malwarebytes Corporation)
S5 megasas; C:\Windows\System32\drivers\megasas.sys [56672 2013-08-22] (LSI Corporation)
S5 megasr; C:\Windows\System32\drivers\megasr.sys [575840 2013-08-22] (LSI Corporation, Inc.)
R5 mountmgr; C:\Windows\System32\drivers\mountmgr.sys [101720 2015-07-15] (Microsoft Corporation)
R5 msisadrv; C:\Windows\System32\drivers\msisadrv.sys [17248 2013-08-22] (Microsoft Corporation)
R5 Mup; C:\Windows\System32\Drivers\mup.sys [78688 2013-08-22] (Microsoft Corporation)
S5 mvumis; C:\Windows\System32\drivers\mvumis.sys [63840 2013-08-22] (Marvell Semiconductor, Inc.)
R5 NDIS; C:\Windows\System32\drivers\ndis.sys [1113944 2015-07-14] (Microsoft Corporation)
R5 ngvss; C:\Windows\System32\Drivers\ngvss.sys [115152 2015-08-19] (AVAST Software)
R3 NMgamingmsFltr; C:\Windows\system32\drivers\NMgamingms.sys [11648 2014-02-27] (LXD Development, Inc.)
S5 nvraid; C:\Windows\System32\drivers\nvraid.sys [150368 2013-08-22] (NVIDIA Corporation)
S5 nvstor; C:\Windows\System32\drivers\nvstor.sys [168288 2013-08-22] (NVIDIA Corporation)
S5 nv_agp; C:\Windows\System32\drivers\nv_agp.sys [124768 2013-08-22] (Microsoft Corporation)
R5 partmgr; C:\Windows\System32\drivers\partmgr.sys [88896 2014-11-21] (Microsoft Corporation)
R5 pci; C:\Windows\System32\drivers\pci.sys [280384 2014-11-21] (Microsoft Corporation)
S5 pciide; C:\Windows\System32\drivers\pciide.sys [14688 2013-08-22] (Microsoft Corporation)
S5 pcmcia; C:\Windows\System32\drivers\pcmcia.sys [114528 2013-08-22] (Microsoft Corporation)
R5 pcw; C:\Windows\System32\drivers\pcw.sys [50016 2013-08-22] (Microsoft Corporation)
R5 pdc; C:\Windows\System32\drivers\pdc.sys [86336 2014-11-21] (Microsoft Corporation)
R5 rdyboost; C:\Windows\System32\drivers\rdyboost.sys [249688 2014-11-21] (Microsoft Corporation)
R3 RTWlanE; C:\Windows\system32\DRIVERS\rtwlane.sys [1936088 2013-07-31] (Realtek Semiconductor Corporation )
S5 sbp2port; C:\Windows\System32\drivers\sbp2port.sys [107872 2013-08-22] (Microsoft Corporation)
S5 SiSRaid2; C:\Windows\System32\drivers\SiSRaid2.sys [44896 2013-08-22] (Silicon Integrated Systems Corp.)
S5 SiSRaid4; C:\Windows\System32\drivers\sisraid4.sys [81760 2013-08-22] (Silicon Integrated Systems)
R5 spaceport; C:\Windows\System32\drivers\spaceport.sys [415040 2014-11-21] (Microsoft Corporation)
S5 stexstor; C:\Windows\System32\drivers\stexstor.sys [31072 2013-08-22] (Promise Technology, Inc.)
R5 storahci; C:\Windows\System32\drivers\storahci.sys [107872 2013-08-22] (Microsoft Corporation)
S5 storflt; C:\Windows\System32\drivers\vmstorfl.sys [49944 2014-11-21] (Microsoft Corporation)
S5 stornvme; C:\Windows\System32\drivers\stornvme.sys [57176 2014-11-21] (Microsoft Corporation)
S5 storvsc; C:\Windows\System32\drivers\storvsc.sys [45888 2013-08-22] (Microsoft Corporation)
R5 Tcpip; C:\Windows\System32\drivers\tcpip.sys [2476376 2015-06-11] (Microsoft Corporation)
R5 THAccel; C:\Windows\System32\DRIVERS\THAccel.sys [131520 2012-08-10] (TOSHIBA CORPORATION)
R3 Thotkey; C:\Windows\System32\drivers\Thotkey.sys [28632 2012-07-31] (Windows (R) Win 7 DDK provider)
R5 tos_sps64; C:\Windows\System32\drivers\tos_sps64.sys [499096 2012-06-18] (TOSHIBA Corporation)
R5 TVALZ; C:\Windows\System32\drivers\TVALZ_O.SYS [32832 2012-07-25] (TOSHIBA Corporation)
S5 uagp35; C:\Windows\System32\drivers\uagp35.sys [64864 2013-08-22] (Microsoft Corporation)
S5 uliagpkx; C:\Windows\System32\drivers\uliagpkx.sys [65888 2013-08-22] (Microsoft Corporation)
R2 VBoxAswDrv; C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [273824 2015-08-19] (Avast Software)
R5 vdrvroot; C:\Windows\System32\drivers\vdrvroot.sys [37728 2013-08-22] (Microsoft Corporation)
S5 viaide; C:\Windows\System32\drivers\viaide.sys [19808 2013-08-22] (VIA Technologies, Inc.)
S5 vmbus; C:\Windows\System32\drivers\vmbus.sys [97048 2014-11-21] (Microsoft Corporation)
R5 volmgr; C:\Windows\System32\drivers\volmgr.sys [73568 2013-08-22] (Microsoft Corporation)
R5 volmgrx; C:\Windows\System32\drivers\volmgrx.sys [377696 2013-08-22] (Microsoft Corporation)
R5 volsnap; C:\Windows\System32\drivers\volsnap.sys [310080 2014-11-21] (Microsoft Corporation)
S5 vsmraid; C:\Windows\System32\drivers\vsmraid.sys [168800 2013-08-22] (VIA Technologies Inc.,Ltd)
S5 VSTXRAID; C:\Windows\System32\drivers\vstxraid.sys [305504 2013-08-22] (VIA Corporation)
R5 Wdf01000; C:\Windows\System32\drivers\Wdf01000.sys [839488 2013-08-22] (Microsoft Corporation)
R5 WdFilter; C:\Windows\System32\drivers\WdFilter.sys [270168 2015-07-07] (Microsoft Corporation)
R5 WFPLWFS; C:\Windows\System32\DRIVERS\wfplwfs.sys [136512 2014-11-21] (Microsoft Corporation)
R5 Wof; C:\Windows\System32\Drivers\Wof.sys [157016 2014-11-21] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-08-21 22:15 - 2015-08-21 22:16 - 00270872 _____ C:\WINDOWS\Minidump\082115-30453-01.dmp
2015-08-21 07:21 - 2015-08-21 22:13 - 00000000 ____D C:\Users\Claud\Desktop\antimalware
2015-08-19 19:39 - 2015-08-19 19:39 - 00000000 ____D C:\Users\Claud\AppData\Roaming\AVAST Software
2015-08-19 19:38 - 2015-08-19 19:40 - 00000000 ____D C:\WINDOWS\SysWOW64\vbox
2015-08-19 19:38 - 2015-08-19 19:40 - 00000000 ____D C:\WINDOWS\system32\vbox
2015-08-19 19:37 - 2015-08-21 18:01 - 00004182 _____ C:\WINDOWS\System32\Tasks\avast! Emergency Update
2015-08-19 19:37 - 2015-08-19 19:37 - 01048344 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswsnx.sys
2015-08-19 19:37 - 2015-08-19 19:37 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVAST Software
2015-08-19 19:37 - 2015-08-19 19:36 - 00447944 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswSP.sys
2015-08-19 19:37 - 2015-08-19 19:36 - 00378880 _____ (AVAST Software) C:\WINDOWS\system32\aswBoot.exe
2015-08-19 19:37 - 2015-08-19 19:36 - 00274808 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswVmm.sys
2015-08-19 19:37 - 2015-08-19 19:36 - 00150672 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswStm.sys
2015-08-19 19:37 - 2015-08-19 19:36 - 00115152 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\ngvss.sys
2015-08-19 19:37 - 2015-08-19 19:36 - 00093528 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswRdr2.sys
2015-08-19 19:37 - 2015-08-19 19:36 - 00090968 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswMonFlt.sys
2015-08-19 19:37 - 2015-08-19 19:36 - 00065224 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswRvrt.sys
2015-08-19 19:37 - 2015-08-19 19:36 - 00028656 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswHwid.sys
2015-08-19 19:36 - 2015-08-19 19:36 - 00043112 _____ (AVAST Software) C:\WINDOWS\avastSS.scr
2015-08-19 19:18 - 2015-08-19 19:18 - 00000000 ____D C:\Program Files\AVAST Software
2015-08-19 19:15 - 2015-08-19 19:15 - 00000000 ____D C:\ProgramData\AVAST Software
2015-08-19 07:35 - 2015-08-10 21:20 - 25191936 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2015-08-19 07:35 - 2015-08-10 20:20 - 19871232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2015-08-17 19:21 - 2015-08-17 19:52 - 00136408 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2015-08-17 19:21 - 2015-08-17 19:21 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-08-17 19:21 - 2015-08-17 19:21 - 00000000 ____D C:\ProgramData\Malwarebytes
2015-08-17 19:21 - 2015-08-17 19:21 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2015-08-17 19:21 - 2015-04-14 09:47 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys
2015-08-17 19:21 - 2015-04-14 09:46 - 00107736 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2015-08-17 19:21 - 2015-04-14 09:46 - 00025816 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
2015-08-17 19:14 - 2015-08-17 19:20 - 21547816 _____ (Malwarebytes Corporation ) C:\Users\Claud\Downloads\mbam-setup.exe
2015-08-17 19:09 - 2015-08-17 19:10 - 00013770 _____ C:\AdwCleaner[C1].txt
2015-08-17 19:07 - 2015-08-17 19:09 - 00021476 _____ C:\AdwCleaner[S1].txt
2015-08-17 19:07 - 2015-08-17 19:09 - 00000000 ____D C:\AdwCleaner
2015-08-17 07:16 - 2015-08-17 07:16 - 00280040 _____ C:\WINDOWS\Minidump\081715-51906-01.dmp
2015-08-16 09:30 - 2015-08-16 09:30 - 09284296 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerInstaller.exe
2015-08-14 20:02 - 2015-07-05 06:08 - 00300704 ____N (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe
2015-08-14 00:59 - 2015-08-14 01:00 - 00279984 _____ C:\WINDOWS\Minidump\081415-36343-01.dmp
2015-08-12 19:31 - 2015-08-12 19:32 - 00008443 _____ C:\Users\Claud\Documents\Uninstall STAR WARS The Old Republic.log
2015-08-11 22:51 - 2015-07-30 10:04 - 00124624 _____ (Microsoft Corporation) C:\WINDOWS\system32\PresentationCFFRasterizerNative_v0300.dll
2015-08-11 22:51 - 2015-07-30 09:48 - 00103120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2015-08-11 21:57 - 2015-07-16 16:26 - 05923328 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2015-08-11 21:57 - 2015-07-16 16:23 - 00615936 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieui.dll
2015-08-11 21:57 - 2015-07-16 15:41 - 00479232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieui.dll
2015-08-11 21:57 - 2015-07-16 15:34 - 14451200 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2015-08-11 21:57 - 2015-07-16 15:14 - 02880000 _____ (Microsoft Corporation) C:\WINDOWS\system32\actxprxy.dll
2015-08-11 21:57 - 2015-07-16 15:12 - 04520448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2015-08-11 21:57 - 2015-07-16 15:12 - 02427904 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2015-08-11 21:57 - 2015-07-16 15:10 - 12856832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2015-08-11 21:57 - 2015-07-16 15:01 - 01545728 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2015-08-11 21:57 - 2015-07-16 14:42 - 01951232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2015-08-11 21:56 - 2015-07-16 16:36 - 00584192 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2015-08-11 21:56 - 2015-07-16 16:36 - 00417792 _____ (Microsoft Corporation) C:\WINDOWS\system32\html.iec
2015-08-11 21:56 - 2015-07-16 16:35 - 02885632 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2015-08-11 21:56 - 2015-07-16 16:21 - 00816640 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2015-08-11 21:56 - 2015-07-16 15:53 - 00145408 _____ (Microsoft Corporation) C:\WINDOWS\system32\iepeers.dll
2015-08-11 21:56 - 2015-07-16 15:51 - 00504320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2015-08-11 21:56 - 2015-07-16 15:50 - 00341504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\html.iec
2015-08-11 21:56 - 2015-07-16 15:45 - 02279424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2015-08-11 21:56 - 2015-07-16 15:45 - 01032704 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll
2015-08-11 21:56 - 2015-07-16 15:39 - 00664064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2015-08-11 21:56 - 2015-07-16 15:38 - 00262144 _____ (Microsoft Corporation) C:\WINDOWS\system32\webcheck.dll
2015-08-11 21:56 - 2015-07-16 15:36 - 00801280 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2015-08-11 21:56 - 2015-07-16 15:32 - 02125824 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2015-08-11 21:56 - 2015-07-16 15:13 - 00880128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll
2015-08-11 21:56 - 2015-07-16 15:06 - 00689152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2015-08-11 21:56 - 2015-07-16 14:52 - 01048576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\actxprxy.dll
2015-08-11 21:56 - 2015-07-16 14:49 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2015-08-11 21:56 - 2015-07-16 14:38 - 01310720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2015-08-11 21:56 - 2015-07-16 14:37 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2015-08-11 21:54 - 2015-07-18 21:58 - 00136904 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe
2015-08-11 21:54 - 2015-07-18 14:51 - 03704320 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2015-08-11 21:54 - 2015-07-18 14:31 - 00140288 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuwebv.dll
2015-08-11 21:54 - 2015-07-18 14:31 - 00095744 _____ (Microsoft Corporation) C:\WINDOWS\system32\wudriver.dll
2015-08-11 21:54 - 2015-07-18 14:31 - 00035840 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapp.exe
2015-08-11 21:54 - 2015-07-18 14:29 - 00409088 _____ (Microsoft Corporation) C:\WINDOWS\system32\WUSettingsProvider.dll
2015-08-11 21:54 - 2015-07-18 14:29 - 00124928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuwebv.dll
2015-08-11 21:54 - 2015-07-18 14:29 - 00029696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapp.exe
2015-08-11 21:54 - 2015-07-18 14:28 - 00081920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wudriver.dll
2015-08-11 21:54 - 2015-07-18 14:12 - 02228736 _____ (Microsoft Corporation) C:\WINDOWS\system32\wucltux.dll
2015-08-11 21:54 - 2015-07-18 14:10 - 00891904 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll
2015-08-11 21:54 - 2015-07-18 14:09 - 00721920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll
2015-08-11 21:53 - 2015-07-29 10:37 - 01994752 _____ (Microsoft Corporation) C:\WINDOWS\system32\DWrite.dll
2015-08-11 21:53 - 2015-07-29 10:30 - 01381888 _____ (Microsoft Corporation) C:\WINDOWS\system32\FntCache.dll
2015-08-11 21:53 - 2015-07-29 10:23 - 01559552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DWrite.dll
2015-08-11 21:53 - 2015-07-24 14:57 - 04177408 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
2015-08-11 21:53 - 2015-07-24 14:57 - 00358912 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\atmfd.dll
2015-08-11 21:53 - 2015-07-24 14:52 - 00044032 _____ (Adobe Systems) C:\WINDOWS\system32\atmlib.dll
2015-08-11 21:53 - 2015-07-24 13:27 - 00301568 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\atmfd.dll
2015-08-11 21:53 - 2015-07-24 13:23 - 00035840 _____ (Adobe Systems) C:\WINDOWS\SysWOW64\atmlib.dll
2015-08-11 21:53 - 2015-06-09 14:27 - 00411133 _____ C:\WINDOWS\system32\ApnDatabase.xml
2015-08-11 21:50 - 2015-07-15 20:29 - 07458648 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2015-08-11 21:50 - 2015-07-15 20:29 - 01735000 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll
2015-08-11 21:50 - 2015-07-15 20:29 - 00101720 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mountmgr.sys
2015-08-11 21:50 - 2015-07-15 20:28 - 01499920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll
2015-08-11 21:50 - 2015-07-10 13:54 - 01217024 _____ (Microsoft Corporation) C:\WINDOWS\system32\sysmain.dll
2015-08-11 21:49 - 2015-06-12 13:03 - 18823680 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll
2015-08-11 21:49 - 2015-06-12 12:36 - 15159296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll
2015-08-11 21:48 - 2015-07-28 19:24 - 00025776 _____ (Microsoft Corporation) C:\WINDOWS\system32\CompatTelRunner.exe
2015-08-11 21:48 - 2015-07-28 10:24 - 01148416 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll
2015-08-11 21:48 - 2015-07-28 10:24 - 01116160 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll
2015-08-11 21:48 - 2015-07-28 10:24 - 00774144 _____ (Microsoft Corporation) C:\WINDOWS\system32\invagent.dll
2015-08-11 21:48 - 2015-07-28 10:24 - 00743424 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll
2015-08-11 21:48 - 2015-07-28 10:24 - 00437248 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll
2015-08-11 21:48 - 2015-07-28 10:24 - 00069120 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll
2015-08-11 21:48 - 2015-07-07 05:40 - 00270168 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdFilter.sys
2015-08-11 21:48 - 2015-07-07 05:40 - 00114520 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdNisDrv.sys
2015-08-11 21:48 - 2015-07-07 05:40 - 00044560 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdBoot.sys
2015-08-11 21:48 - 2015-07-01 18:19 - 00228864 _____ (Microsoft Corporation) C:\WINDOWS\system32\WebClnt.dll
2015-08-11 21:48 - 2015-07-01 18:16 - 00104448 _____ (Microsoft Corporation) C:\WINDOWS\system32\davclnt.dll
2015-08-11 21:48 - 2015-07-01 17:37 - 00198656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WebClnt.dll
2015-08-11 21:48 - 2015-07-01 17:35 - 00087040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\davclnt.dll
2015-08-11 21:42 - 2015-07-14 17:59 - 01113944 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ndis.sys
2015-08-11 21:42 - 2015-07-14 17:59 - 00487256 _____ (Microsoft Corporation) C:\WINDOWS\system32\netcfgx.dll
2015-08-11 21:42 - 2015-07-14 17:59 - 00393560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\netcfgx.dll
2015-08-11 21:42 - 2015-07-13 15:46 - 00059392 _____ (Microsoft Corporation) C:\WINDOWS\system32\csrsrv.dll
2015-08-11 21:42 - 2015-07-13 15:45 - 00059392 _____ (Microsoft Corporation) C:\WINDOWS\system32\basesrv.dll
2015-08-11 21:42 - 2015-07-09 13:13 - 00221184 _____ (Microsoft Corporation) C:\WINDOWS\system32\notepad.exe
2015-08-11 21:42 - 2015-07-09 13:13 - 00221184 _____ (Microsoft Corporation) C:\WINDOWS\notepad.exe
2015-08-11 21:42 - 2015-07-09 12:30 - 00212992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\notepad.exe
2015-08-11 21:41 - 2015-07-13 23:22 - 02529880 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml6.dll
2015-08-11 21:41 - 2015-07-13 23:21 - 01901776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml6.dll
2015-08-11 21:41 - 2015-07-10 14:19 - 01101824 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdvidcrl.dll
2015-08-11 21:41 - 2015-07-10 13:42 - 02345472 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml3.dll
2015-08-11 21:41 - 2015-07-10 13:14 - 00856064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdvidcrl.dll
2015-08-11 21:41 - 2015-07-10 13:13 - 07032320 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstscax.dll
2015-08-11 21:41 - 2015-07-10 12:47 - 01556992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml3.dll
2015-08-11 21:41 - 2015-07-10 12:31 - 06213120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstscax.dll
2015-08-11 21:41 - 2015-06-11 16:12 - 02476376 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tcpip.sys
2015-08-11 21:41 - 2015-06-11 16:12 - 00428888 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\FWPKCLNT.SYS
2015-08-11 21:41 - 2015-05-11 20:24 - 00536920 _____ (Microsoft Corporation) C:\WINDOWS\system32\mcupdate_GenuineIntel.dll
2015-08-10 20:28 - 2015-08-10 20:29 - 00036078 _____ C:\Users\Claud\Downloads\Addition.txt
2015-08-10 20:22 - 2015-08-21 22:34 - 00000000 ____D C:\FRST
2015-08-10 20:11 - 2015-08-10 20:11 - 00688992 _____ (Swearware) C:\Users\Claud\Downloads\dds (1).scr
2015-08-10 20:09 - 2015-08-10 20:10 - 00688992 _____ (Swearware) C:\Users\Claud\Downloads\dds.scr
2015-08-09 21:12 - 2015-08-17 19:49 - 00000000 ____D C:\Program Files (x86)\FreshStart Cross Browser Session Manager
2015-08-09 00:44 - 2015-08-09 00:44 - 01032744 _____ C:\WINDOWS\Minidump\080915-38671-01.dmp
2015-08-04 11:12 - 2015-08-04 11:13 - 00279984 _____ C:\WINDOWS\Minidump\080415-34406-01.dmp
2015-08-01 22:32 - 2015-08-01 22:32 - 00280040 _____ C:\WINDOWS\Minidump\080115-46875-01.dmp
2015-07-30 18:53 - 2015-07-30 18:56 - 32694320 _____ (Fitbit Inc.) C:\Users\Claud\Downloads\FitbitConnect_Win_20150619_2.0.0.6598.exe
2015-07-24 07:41 - 2015-07-24 07:41 - 00279984 _____ C:\WINDOWS\Minidump\072415-38015-01.dmp

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-08-21 22:33 - 2015-03-14 12:59 - 01381332 _____ C:\WINDOWS\WindowsUpdate.log
2015-08-21 22:30 - 2015-07-14 19:36 - 00000830 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2015-08-21 22:20 - 2014-11-21 04:44 - 00863592 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2015-08-21 22:16 - 2015-03-14 13:46 - 00000000 ___RD C:\Users\Claud\OneDrive
2015-08-21 22:16 - 2013-11-20 10:22 - 00837632 ___SH C:\Users\Claud\Desktop\Thumbs.db
2015-08-21 22:16 - 2013-08-22 10:46 - 00348447 _____ C:\WINDOWS\setupact.log
2015-08-21 22:16 - 2013-08-22 10:45 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2015-08-21 22:15 - 2015-03-14 12:57 - 00000000 ____D C:\WINDOWS\Minidump
2015-08-21 22:15 - 2015-03-14 12:56 - 178839712 _____ C:\WINDOWS\MEMORY.DMP
2015-08-21 22:15 - 2014-11-21 04:34 - 00888856 _____ C:\WINDOWS\PFRO.log
2015-08-21 22:00 - 2013-08-22 11:36 - 00000000 ____D C:\WINDOWS\system32\sru
2015-08-21 18:55 - 2015-02-28 17:58 - 00003598 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3048285104-2006604149-165245714-1001
2015-08-21 18:36 - 2015-02-28 15:20 - 00000000 ____D C:\Users\Claud\AppData\Local\CrashDumps
2015-08-20 07:31 - 2013-08-22 09:25 - 01048576 ___SH C:\WINDOWS\system32\config\BBI
2015-08-19 18:28 - 2015-03-27 15:06 - 00000000 ____D C:\Program Files (x86)\Java
2015-08-19 18:27 - 2015-02-28 15:11 - 00000000 ____D C:\Users\Claud\AppData\Local\Google
2015-08-19 18:27 - 2015-02-28 15:11 - 00000000 ____D C:\Program Files (x86)\Google
2015-08-19 18:25 - 2015-02-28 16:08 - 00000000 ____D C:\Users\Claud\AppData\Roaming\Skype
2015-08-19 17:32 - 2013-08-22 11:36 - 00000000 ____D C:\WINDOWS\system32\NDF
2015-08-19 17:31 - 2015-05-13 21:29 - 00000000 __SHD C:\Users\Claud\AppData\Local\EmieUserList
2015-08-19 17:31 - 2015-05-13 21:29 - 00000000 __SHD C:\Users\Claud\AppData\Local\EmieSiteList
2015-08-19 17:31 - 2015-05-13 21:29 - 00000000 __SHD C:\Users\Claud\AppData\Local\EmieBrowserModeList
2015-08-19 07:36 - 2012-07-26 03:59 - 00000000 ____D C:\WINDOWS\CbsTemp
2015-08-17 19:51 - 2013-08-22 11:36 - 00000000 ____D C:\WINDOWS\AppCompat
2015-08-17 19:10 - 2015-06-02 19:25 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2015-08-17 19:10 - 2015-03-14 13:12 - 00000000 ____D C:\Users\Claud
2015-08-16 16:54 - 2015-03-14 16:54 - 00000000 ___DC C:\WINDOWS\Panther
2015-08-16 16:27 - 2015-07-10 09:39 - 00000000 ___HD C:\$Windows.~BT
2015-08-16 09:30 - 2015-07-14 19:36 - 00003718 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2015-08-14 07:33 - 2013-08-22 11:36 - 00000000 ____D C:\WINDOWS\rescache
2015-08-13 19:11 - 2013-08-22 10:44 - 00362544 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2015-08-13 07:35 - 2013-08-22 11:36 - 00000000 ___RD C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2015-08-13 07:35 - 2013-08-22 11:36 - 00000000 ___RD C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2015-08-13 07:35 - 2013-08-22 11:36 - 00000000 ____D C:\Program Files\Windows Defender
2015-08-13 07:35 - 2013-08-22 11:36 - 00000000 ____D C:\Program Files (x86)\Windows Defender
2015-08-13 07:34 - 2015-03-16 12:20 - 00000000 ____D C:\WINDOWS\system32\appraiser
2015-08-13 07:34 - 2014-11-21 11:56 - 00000000 ___SD C:\WINDOWS\system32\CompatTel
2015-08-12 20:52 - 2015-03-03 15:28 - 00000000 ____D C:\WINDOWS\system32\MRT
2015-08-12 20:36 - 2015-03-03 15:27 - 132483416 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2015-08-12 19:33 - 2015-02-28 21:27 - 00000000 ____D C:\ProgramData\Yahoo!
2015-08-12 19:33 - 2015-02-28 16:36 - 00000000 ____D C:\Program Files (x86)\Yahoo!
2015-08-12 19:31 - 2013-10-10 16:05 - 00000000 ____D C:\Games
2015-08-12 19:22 - 2014-01-29 09:34 - 00000000 ____D C:\Users\Claud\Downloads\New folder
2015-08-11 22:52 - 2013-08-22 11:36 - 00000000 ____D C:\WINDOWS\AppReadiness
2015-08-11 22:48 - 2013-08-22 11:36 - 00000000 ___RD C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2015-08-11 22:48 - 2013-08-22 11:36 - 00000000 ___RD C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2015-08-08 09:55 - 2014-11-21 12:03 - 00794088 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2015-08-08 09:55 - 2014-11-21 12:03 - 00179688 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2015-08-05 19:21 - 2015-02-20 11:30 - 00000000 ____D C:\Users\Claud\AppData\Local\Packages
2015-08-05 14:32 - 2012-07-26 04:12 - 00000000 ____D C:\WINDOWS\LiveKernelReports
2015-08-02 10:05 - 2012-11-15 01:29 - 00000000 ____D C:\ProgramData\boost_interprocess
2015-07-25 21:18 - 2015-02-11 12:18 - 00000000 ____D C:\Users\Claud\Desktop\RP
2015-07-25 17:40 - 2015-05-13 21:29 - 00003914 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{D5DE5A82-040D-47C4-9DE5-DC979221DCAE}
2015-07-25 05:39 - 2015-04-04 00:15 - 00000000 ___SD C:\WINDOWS\system32\GWX

==================== Files in the root of some directories =======

2015-04-25 14:45 - 2015-05-19 19:42 - 0000020 _____ () C:\Users\Claud\AppData\Roaming\appdataFr3.bin
2015-04-30 18:12 - 2015-04-30 18:13 - 0000802 _____ () C:\Users\Claud\AppData\Local\Temp-log.txt

==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\wininit.exe => File is digitally signed
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-08-21 22:27

==================== End of log ============================

Additional scan result of Farbar Recovery Scan Tool (x64) Version:20-08-2015
Ran by Claud (2015-08-21 22:40:05)
Running from C:\Users\Claud\Desktop\antimalware
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-3048285104-2006604149-165245714-500 - Administrator - Disabled) => C:\Users\Administrator
Claud (S-1-5-21-3048285104-2006604149-165245714-1001 - Administrator - Enabled) => C:\Users\Claud
Guest (S-1-5-21-3048285104-2006604149-165245714-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-3048285104-2006604149-165245714-1006 - Limited - Enabled)

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Flash Player 18 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 18.0.0.232 - Adobe Systems Incorporated)
AMD Catalyst Install Manager (HKLM\...\{A3808FE1-6B99-1B1F-F18A-FE658F175C0E}) (Version: 8.0.916.0 - Advanced Micro Devices, Inc.)
Apple Application Support (HKLM-x32\...\{21FC2093-6E43-460B-B9B0-5F5AA35BBB0F}) (Version: 3.0 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{FE86CB0C-FCB3-4358-B4B0-B0A41E33B3DD}) (Version: 7.1.0.32 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Arc (HKLM-x32\...\{CED8E25B-122A-4E80-B612-7F99B93284B3}) (Version: 1.0.0.9668 - Perfect World Entertainment)
Avast Free Antivirus (HKLM-x32\...\Avast) (Version: 10.3.2225 - AVAST Software)
Bejeweled 3 (x32 Version: 2.2.0.97 - WildTangent) Hidden
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Catalyst Control Center (HKLM-x32\...\WUCCCApp) (Version: 1.00.0000 - AMD)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
FATE (x32 Version: 2.2.0.97 - WildTangent) Hidden
Gardenscapes: Mansion Makeover (x32 Version: 3.0.2.32 - WildTangent) Hidden
Google Update Helper (x32 Version: 1.3.21.165 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.28.1 - Google Inc.) Hidden
iTunes (HKLM\...\{96B53CA8-5ABB-49D8-96F1-F6C0D73A76C6}) (Version: 11.1.4.62 - Apple Inc.)
Malwarebytes Anti-Malware version 2.1.6.1022 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.6.1022 - Malwarebytes Corporation)
Media Player Codec Pack 4.3.6 (HKLM-x32\...\Media Player - Codec Pack) (Version: 4.3.6 - Media Player Codec Pack)
Microsoft Office (HKLM-x32\...\{90150000-0138-0409-0000-0000000FF1CE}) (Version: 15.0.4420.1017 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\...\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden
Mozilla Firefox 38.0.5 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 38.0.5 (x86 en-US)) (Version: 38.0.5 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 36.0 - Mozilla)
Norton Online Backup (HKLM-x32\...\{40A66DF6-22D3-44B5-A7D3-83B118A2C0DC}) (Version: 2.2.3.45 - Symantec Corporation)
Norton Online Backup ARA (x32 Version: 4.1.0.11 - Symantec Corporation) Hidden
Norton PC Checkup (HKLM-x32\...\NortonPCCheckup) (Version: 2.0.18.15 - Symantec Corporation)
Norton Security Dashboard (HKLM-x32\...\NortonSD) (Version: 1.1.1.9 - Symantec Corporation)
OpenOffice 4.1.1 (HKLM-x32\...\{9395F41D-0F80-432E-9A59-B8E477E7E163}) (Version: 4.11.9775 - Apache Software Foundation)
Origin (HKLM-x32\...\Origin) (Version: 9.0.15.60 - Electronic Arts, Inc.)
Penguins! (x32 Version: 2.2.0.98 - WildTangent) Hidden
Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.98 - WildTangent) Hidden
PlayReady PC Runtime amd64 (HKLM\...\{BCA9334F-B6C9-4F65-9A73-AC5A329A4D04}) (Version: 1.3.0 - Microsoft Corporation)
Polar Bowler (x32 Version: 2.2.0.97 - WildTangent) Hidden
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.2.612.2012 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6743 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.8400.39030 - Realtek Semiconductor Corp.)
Realtek WLAN Driver (HKLM-x32\...\{9D3D8C60-A55F-4fed-B2B9-173001290E16}) (Version: 2.00.0020 - REALTEK Semiconductor Corp.)
Star Wars The Old Republic (HKLM-x32\...\swtor_swtor) (Version: 8.0.0.24 - Bioware/EA)
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 16.2.10.5 - Synaptics Incorporated)
TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.16 - TeamSpeak Systems GmbH)
Toshiba App Place (HKLM-x32\...\{ED3CBA78-488F-4E8C-B33F-8E3BF4DDB4D2}) (Version: 1.0.6.3 - Toshiba)
TOSHIBA Application Installer (HKLM-x32\...\{970472D0-F5F9-4158-A6E3-1AE49EFEF2D3}) (Version: 9.0.1.4 - TOSHIBA)
TOSHIBA Audio Enhancement (HKLM\...\{F2DE0088-CF05-4DAB-AC4D-9D2C4D657456}) (Version: 1.0.2.8 - TOSHIBA Corporation)
Toshiba Book Place (HKLM-x32\...\{24B45620-22B6-4E4A-B836-FF30A0B0404E}) (Version: 3.1.9534 - K-NFB Reading Technology, Inc.)
TOSHIBA Desktop Assist (HKLM\...\{95CCACF0-010D-45F0-82BF-858643D8BC02}) (Version: 1.00.08.6402 - Toshiba Corporation)
TOSHIBA eco Utility (HKLM\...\{5944B9D4-3C2A-48DE-931E-26B31714A2F7}) (Version: 2.0.0.6414 - Toshiba Corporation)
TOSHIBA Function Key (HKLM\...\{16562A90-71BC-41A0-B890-D91B0C267120}) (Version: 1.00.6425 - Toshiba Corporation)
TOSHIBA HDD Accelerator (HKLM\...\{DB4D9937-0B14-4EF1-BF9A-BB7E3B9DCB04}) (Version: 1.1.0001 - Toshiba Corporation)
TOSHIBA Password Utility (HKLM-x32\...\{B1786E63-2127-42C9-95A3-146E5F727BF1}) (Version: v1.0.0.8 - TOSHIBA Corporation)
TOSHIBA Quality Application (HKLM-x32\...\{E69992ED-A7F6-406C-9280-1C156417BC49}) (Version: 1.0.8 - TOSHIBA)
TOSHIBA Recovery Media Creator (HKLM-x32\...\{B65BBB06-1F8E-48F5-8A54-B024A9E15FDF}) (Version: 2.2.0.54043005 - Toshiba Corporation)
TOSHIBA Service Station (HKLM\...\{B8C8422F-01F1-4791-B084-047AAFF9BFCC}) (Version: 2.4.4 - TOSHIBA)
TOSHIBA System Driver (HKLM-x32\...\{1E6A96A1-2BAB-43EF-8087-30437593C66C}) (Version: 1.00.0014 - Toshiba Corporation)
TOSHIBA System Settings (HKLM-x32\...\{05A55927-DB9B-4E26-BA44-828EBFF829F0}) (Version: 1.00.0002.32002 - Toshiba Corporation)
TOSHIBA User's Guide (HKLM-x32\...\{3384E1D9-3F18-4A98-8655-180FEF0DFC02}) (Version: 1.00.02 - TOSHIBA)
TOSHIBA VIDEO PLAYER (HKLM\...\{FF07604E-C860-40E9-A230-E37FA41F103A}) (Version: 5.1.0.12-A - Toshiba Corporation)
TOSHIBARegistration (HKLM-x32\...\{5AF550B4-BB67-4E7E-82F1-2C4300279050}) (Version: 1.1.6 - TOSHIBA)
Unity Web Player (HKU\S-1-5-21-3048285104-2006604149-165245714-1001\...\UnityWebPlayer) (Version: 5.0.2f1 - Unity Technologies ApS)
Update Installer for WildTangent Games App (x32 Version: - WildTangent) Hidden
USB Optical Mouse (HKLM-x32\...\{EEAE45EB-C1E3-4CCD-930D-D7B40F810063}) (Version: 1.00.0000 - )
Vacation Quest™ - Australia (x32 Version: 3.0.2.32 - WildTangent) Hidden
VASSAL (3.2.15) (HKLM\...\VASSAL (3.2.15)) (Version: 3.2.15 - vassalengine.org)
Virtual Villagers 5 - New Believers (x32 Version: 3.0.2.32 - WildTangent) Hidden
WildTangent Games (HKLM-x32\...\WildTangent wildgames Master Uninstall) (Version: 1.0.3.0 - WildTangent)
WildTangent Games App (Toshiba Games) (x32 Version: 4.0.9.7 - WildTangent) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3503.0728 - Microsoft Corporation)
Yahoo! Messenger (HKLM-x32\...\Yahoo! Messenger) (Version: - Yahoo! Inc.)
Youda Jewel Shop (x32 Version: 3.0.2.32 - WildTangent) Hidden

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== Restore Points =========================

19-08-2015 21:27:53 Restore Point Created by FRST

==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 09:25 - 2015-08-21 22:11 - 00000035 ____A C:\WINDOWS\system32\Drivers\etc\hosts

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {173D0C53-6F5A-42E7-9156-8CE2A146CB81} - System32\Tasks\Norton Anti-Theft\Norton Error Analyzer => C:\Program Files (x86)\Norton Anti-Theft\Engine\1.10.0.9\SymErr.exe
Task: {19847FC9-3716-4BF5-932B-F348F22C589A} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2015-08-12] (Microsoft Corporation)
Task: {3F69E13E-03C7-4186-8761-29F82D577F80} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2015-08-19] (AVAST Software)
Task: {66CF1948-960B-441B-A3A9-BBE06F1C2FD4} - System32\Tasks\Microsoft\Windows\Application Experience\ProgramDataUpdater => Rundll32.exe invagent.dll,RunUpdate -noappraiser
Task: {6A11C7D1-03F7-4353-9ACD-DDCBA2F2A0B3} - System32\Tasks\TOSHIBA\Service Station => C:\Program Files\TOSHIBA\Toshiba Service Station\ToshibaServiceStation.exe [2012-07-27] (TOSHIBA Corporation)
Task: {950AA0A4-C87D-4804-BEC7-6C3E41A7983C} - System32\Tasks\Norton Anti-Theft\Norton Error Processor => C:\Program Files (x86)\Norton Anti-Theft\Engine\1.10.0.9\SymErr.exe
Task: {B327BDAE-4687-4EF2-818B-AFC617F8E4BA} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {E3737216-265A-4F72-863C-F6E271E0E62B} - System32\Tasks\Adobe Flash Player Updater => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-08-16] (Adobe Systems Incorporated)
Task: {E5C92124-20B2-4FF6-BA10-394B1094C315} - System32\Tasks\Synaptics TouchPad Enhancements => \Program Files\Synaptics\SynTP\SynTPEnh.exe [2012-08-16] (Synaptics Incorporated)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\WINDOWS\Tasks\Synaptics TouchPad Enhancements.job => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

==================== Loaded Modules (Whitelisted) ==============

2014-11-20 21:23 - 2014-11-20 21:23 - 00127488 _____ () C:\Program Files\AMD\ATI.ACE\Fuel\Fuel.Container.Wlan.dll
2012-07-18 21:38 - 2012-07-18 21:38 - 00020904 _____ () C:\Program Files\TOSHIBA\Hotkey\SmoothView.dll
2012-07-18 21:38 - 2012-07-18 21:38 - 00049064 _____ () C:\Program Files\TOSHIBA\Hotkey\Hotkey\FnZ.dll
2012-08-13 22:13 - 2012-08-13 22:13 - 00018344 _____ () C:\Program Files\Toshiba\Teco\TecoMUI.dll
2015-07-22 09:10 - 2015-07-22 09:10 - 01459712 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\Windows.UI\4bd80968bf666252841ca7792faaff11\Windows.UI.ni.dll
2013-08-22 03:19 - 2013-08-22 02:54 - 00050176 _____ () C:\WINDOWS\system32\WinMetadata\Windows.Data.winmd
2015-07-22 09:10 - 2015-07-22 09:10 - 00363520 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\Windows.Foundation\6382e6f5ad8b7a9db4f5cd4817e70319\Windows.Foundation.ni.dll
2015-08-19 19:36 - 2015-08-19 19:36 - 00102864 _____ () C:\Program Files\AVAST Software\Avast\log.dll
2015-08-19 19:36 - 2015-08-19 19:36 - 00123976 _____ () C:\Program Files\AVAST Software\Avast\JsonRpcServer.dll
2015-08-20 18:04 - 2015-08-20 18:04 - 02960384 _____ () C:\Program Files\AVAST Software\Avast\defs\15082001\algo.dll
2014-02-06 00:52 - 2014-02-06 00:52 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2014-02-06 00:52 - 2014-02-06 00:52 - 01044808 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2015-08-19 19:36 - 2015-08-19 19:36 - 40540672 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2015-02-28 21:27 - 2012-05-25 05:25 - 00921600 _____ () C:\Program Files (x86)\Yahoo!\Messenger\yui.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

AlternateDataStreams: C:\Users\Claud\OneDrive:ms-properties
AlternateDataStreams: C:\Users\Claud\OneDrive.old:ms-properties

==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-3048285104-2006604149-165245714-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Claud\Pictures\facebook\10369212_826155914072088_1343644284898250007_n.jpg
DNS Servers: 192.168.2.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

HKLM\...\StartupApproved\StartupFolder: => "McAfee Security Scan Plus.lnk"
HKLM\...\StartupApproved\StartupFolder: => "CodecPackTrayMenu.lnk"
HKLM\...\StartupApproved\Run32: => "Arc"
HKLM\...\StartupApproved\Run32: => "Codec Settings UAC Manager"
HKLM\...\StartupApproved\Run32: => "SunJavaUpdateSched"
HKLM\...\StartupApproved\Run32: => "USB Optical Mouse"
HKLM\...\StartupApproved\Run32: => "Raptr"
HKU\S-1-5-21-3048285104-2006604149-165245714-1001\...\StartupApproved\StartupFolder: => " AD.lnk"
HKU\S-1-5-21-3048285104-2006604149-165245714-1001\...\StartupApproved\Run: => "Codec Pack Update Checker"

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [UDP Query User{87D9E16C-48BE-4E33-80DF-CB6D98352376}C:\program files (x86)\perfect world entertainment\star trek online_en\star trek online\live\gameclient.exe] => (Allow) C:\program files (x86)\perfect world entertainment\star trek online_en\star trek online\live\gameclient.exe
FirewallRules: [TCP Query User{4EE14804-1D51-486C-B76E-E529CEFE1E6B}C:\program files (x86)\perfect world entertainment\star trek online_en\star trek online\live\gameclient.exe] => (Allow) C:\program files (x86)\perfect world entertainment\star trek online_en\star trek online\live\gameclient.exe
FirewallRules: [{247992BA-0D3D-4F66-8022-BCBDB2344E12}] => (Allow) C:\Program Files (x86)\Yahoo!\Messenger\YahooMessenger.exe
FirewallRules: [{9D9E32BB-11EE-47F5-BE29-E95A424FDF29}] => (Allow) C:\Program Files (x86)\Yahoo!\Messenger\YahooMessenger.exe
FirewallRules: [{9D1E4D7C-5647-476F-AB66-ED95ACD4B147}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{B67A139A-0CAC-4790-AE45-9EE1F150AA1F}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{33B79F94-3DC3-44BE-8C6B-9D92B9753265}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{A138BF14-60A4-411D-B3EF-0686682919AC}] => (Allow) LPort=1900
FirewallRules: [{D7B5C841-1264-4E92-9244-3359506ACC47}] => (Allow) LPort=2869
FirewallRules: [{1AB94965-8F43-48F8-9679-146469AE3F09}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{E7E82843-2F85-4737-9C0F-3F118311F3D5}] => (Allow) C:\Program Files (x86)\Raptr\raptr.exe
FirewallRules: [{0242743E-B76B-45D1-9DC6-C5E124EA37C7}] => (Allow) C:\Program Files (x86)\Raptr\raptr.exe
FirewallRules: [{833902F0-BF8F-47F4-917B-9B63A8828494}] => (Allow) C:\Program Files (x86)\Raptr\raptr_im.exe
FirewallRules: [{5355C3B8-C7F1-45DE-B0F9-5BAD90065443}] => (Allow) C:\Program Files (x86)\Raptr\raptr_im.exe
FirewallRules: [TCP Query User{95C657E8-453C-4263-BE48-F34A36F47DDE}C:\program files (x86)\perfect world entertainment\star trek online_en\star trek online\live\gameclient.exe] => (Allow) C:\program files (x86)\perfect world entertainment\star trek online_en\star trek online\live\gameclient.exe
FirewallRules: [UDP Query User{05B53FBC-3885-4B75-A97F-5C3E19411B1D}C:\program files (x86)\perfect world entertainment\star trek online_en\star trek online\live\gameclient.exe] => (Allow) C:\program files (x86)\perfect world entertainment\star trek online_en\star trek online\live\gameclient.exe
FirewallRules: [{7D6AE275-9682-42C0-9816-C085813B3595}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{6DE21F2C-8A99-4571-91D1-1541D9F1F517}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{E175C2F4-8ABF-45DE-8162-286209D31252}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{CFB9B1B6-75B9-4B11-93BB-43080C67090A}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{79C1886E-8819-4521-8BA8-0A5173968A12}] => (Allow) C:\Program Files (x86)\iTunes\iTunes.exe
FirewallRules: [TCP Query User{76B54967-13F5-4D2E-AD4F-15B2AF5F86CA}C:\program files (x86)\perfect world entertainment\neverwinter_en\neverwinter\live\gameclient.exe] => (Allow) C:\program files (x86)\perfect world entertainment\neverwinter_en\neverwinter\live\gameclient.exe
FirewallRules: [UDP Query User{6017E710-85FF-42AA-92F8-AFFB1EA48D9E}C:\program files (x86)\perfect world entertainment\neverwinter_en\neverwinter\live\gameclient.exe] => (Allow) C:\program files (x86)\perfect world entertainment\neverwinter_en\neverwinter\live\gameclient.exe
FirewallRules: [{DB1F84E0-E694-463A-84FC-2567421C7151}] => (Allow) C:\Program Files\AVAST Software\Avast\ng\vbox\aswFe.exe
FirewallRules: [{2A2F5A9C-490B-4FA1-B530-ABD408F9A4B2}] => (Allow) C:\Program Files\AVAST Software\Avast\ng\vbox\aswFe.exe

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (08/21/2015 06:36:47 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: IEXPLORE.EXE, version: 11.0.9600.17840, time stamp: 0x555fe1bb
Faulting module name: jscript9.dll, version: 11.0.9600.17937, time stamp: 0x55a80206
Exception code: 0xc0000005
Fault offset: 0x0001deea
Faulting process id: 0x1718
Faulting application start time: 0xIEXPLORE.EXE0
Faulting application path: IEXPLORE.EXE1
Faulting module path: IEXPLORE.EXE2
Report Id: IEXPLORE.EXE3
Faulting package full name: IEXPLORE.EXE4
Faulting package-relative application ID: IEXPLORE.EXE5

Error: (08/21/2015 06:13:56 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: Explorer.EXE, version: 6.3.9600.17667, time stamp: 0x54c6f7c2
Faulting module name: Windows.UI.Immersive.dll, version: 6.3.9600.17415, time stamp: 0x5450388f
Exception code: 0xc0000005
Fault offset: 0x000000000001e74c
Faulting process id: 0xf5c
Faulting application start time: 0xExplorer.EXE0
Faulting application path: Explorer.EXE1
Faulting module path: Explorer.EXE2
Report Id: Explorer.EXE3
Faulting package full name: Explorer.EXE4
Faulting package-relative application ID: Explorer.EXE5

Error: (08/21/2015 07:20:50 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 11549031

Error: (08/21/2015 07:20:50 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 11549031

Error: (08/21/2015 07:20:50 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (08/20/2015 09:39:18 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: svchost.exe_defragsvc, version: 6.3.9600.17415, time stamp: 0x54504177
Faulting module name: ntdll.dll, version: 6.3.9600.17936, time stamp: 0x55a68e0c
Exception code: 0xc0000005
Fault offset: 0x0000000000061b07
Faulting process id: 0x14b8
Faulting application start time: 0xsvchost.exe_defragsvc0
Faulting application path: svchost.exe_defragsvc1
Faulting module path: svchost.exe_defragsvc2
Report Id: svchost.exe_defragsvc3
Faulting package full name: svchost.exe_defragsvc4
Faulting package-relative application ID: svchost.exe_defragsvc5

Error: (08/20/2015 06:54:27 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: IEXPLORE.EXE, version: 11.0.9600.17840, time stamp: 0x555fe1bb
Faulting module name: Flash.ocx, version: 18.0.0.232, time stamp: 0x55c43296
Exception code: 0xc0000005
Fault offset: 0x00332a2b
Faulting process id: 0x1040
Faulting application start time: 0xIEXPLORE.EXE0
Faulting application path: IEXPLORE.EXE1
Faulting module path: IEXPLORE.EXE2
Report Id: IEXPLORE.EXE3
Faulting package full name: IEXPLORE.EXE4
Faulting package-relative application ID: IEXPLORE.EXE5

Error: (08/19/2015 08:29:28 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: IEXPLORE.EXE, version: 11.0.9600.17840, time stamp: 0x555fe1bb
Faulting module name: jscript9.dll, version: 11.0.9600.17937, time stamp: 0x55a80206
Exception code: 0xc0000005
Fault offset: 0x0001c2be
Faulting process id: 0x22fc
Faulting application start time: 0xIEXPLORE.EXE0
Faulting application path: IEXPLORE.EXE1
Faulting module path: IEXPLORE.EXE2
Report Id: IEXPLORE.EXE3
Faulting package full name: IEXPLORE.EXE4
Faulting package-relative application ID: IEXPLORE.EXE5

Error: (08/19/2015 05:29:33 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 14307469

Error: (08/19/2015 05:29:33 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 14307469


System errors:
=============
Error: (08/21/2015 10:16:04 PM) (Source: BugCheck) (EventID: 1001) (User: )
Description: 0x0000007e (0xffffffffc0000005, 0xfffff80128afd1e6, 0xffffd001560b78e8, 0xffffd001560b70f0)C:\WINDOWS\MEMORY.DMP082115-30453-01

Error: (08/21/2015 10:11:18 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The Responsive Feel service terminated unexpectedly. It has done this 1 time(s).

Error: (08/21/2015 12:18:11 AM) (Source: NetBT) (EventID: 4321) (User: )
Description: The name "WORKGROUP :1d" could not be registered on the interface with IP address 192.168.2.7.
The computer with the IP address 192.168.2.4 did not allow the name to be claimed by
this computer.

Error: (08/20/2015 09:39:30 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The Optimize drives service terminated unexpectedly. It has done this 1 time(s).

Error: (08/20/2015 09:39:12 PM) (Source: Ntfs) (EventID: 131) (User: NT AUTHORITY)
Description: The file system structure on volume C: cannot be corrected.
Please run the chkdsk utility on the volume C:.

Error: (08/20/2015 06:48:23 PM) (Source: Schannel) (EventID: 4119) (User: NT AUTHORITY)
Description: A fatal alert was received from the remote endpoint. The TLS protocol defined fatal alert code is 40.

Error: (08/20/2015 06:48:01 PM) (Source: Schannel) (EventID: 4119) (User: NT AUTHORITY)
Description: A fatal alert was received from the remote endpoint. The TLS protocol defined fatal alert code is 40.

Error: (08/20/2015 06:30:27 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: Installation Failure: Windows failed to install the following update with error 0x80240020: Upgrade to Windows 10 Home.

Error: (08/20/2015 06:04:30 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Google Update Service (gupdate) service failed to start due to the following error:
%%2

Error: (08/20/2015 06:01:46 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Scant Nerve service failed to start due to the following error:
%%129


Microsoft Office:
=========================
Error: (08/21/2015 06:36:47 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: IEXPLORE.EXE11.0.9600.17840555fe1bbjscript9.dll11.0.9600.1793755a80206c00000050001deea171801d0dc5e421b7783C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXEC:\Windows\SYSTEM32\jscript9.dll1ac07de3-4855-11e5-bee4-008cfa617121

Error: (08/21/2015 06:13:56 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Explorer.EXE6.3.9600.1766754c6f7c2Windows.UI.Immersive.dll6.3.9600.174155450388fc0000005000000000001e74cf5c01d0db940e53489cC:\WINDOWS\Explorer.EXEC:\Windows\System32\Windows.UI.Immersive.dlle9dfbf78-4851-11e5-bee4-008cfa617121

Error: (08/21/2015 07:20:50 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 11549031

Error: (08/21/2015 07:20:50 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 11549031

Error: (08/21/2015 07:20:50 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (08/20/2015 09:39:18 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: svchost.exe_defragsvc6.3.9600.1741554504177ntdll.dll6.3.9600.1793655a68e0cc00000050000000000061b0714b801d0dbaf8becbf93C:\WINDOWS\system32\svchost.exeC:\WINDOWS\SYSTEM32\ntdll.dll6f9ae653-47a5-11e5-bee4-008cfa617121

Error: (08/20/2015 06:54:27 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: IEXPLORE.EXE11.0.9600.17840555fe1bbFlash.ocx18.0.0.23255c43296c000000500332a2b104001d0db94a6e89599C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXEC:\Windows\SYSTEM32\Macromed\Flash\Flash.ocx686875ba-478e-11e5-bee4-008cfa617121

Error: (08/19/2015 08:29:28 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: IEXPLORE.EXE11.0.9600.17840555fe1bbjscript9.dll11.0.9600.1793755a80206c00000050001c2be22fc01d0dad66328e4cdC:\Program Files (x86)\Internet Explorer\IEXPLORE.EXEC:\Windows\SYSTEM32\jscript9.dll83dd6667-46d2-11e5-bee3-008cfa617121

Error: (08/19/2015 05:29:33 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 14307469

Error: (08/19/2015 05:29:33 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 14307469


==================== Memory info ===========================

Processor: AMD E1-1200 APU with Radeon(tm) HD Graphics
Percentage of memory in use: 23%
Total physical RAM: 7774.01 MB
Available physical RAM: 5971.86 MB
Total Virtual: 15710.26 MB
Available Virtual: 13913.59 MB

==================== Drives ================================

Drive c: (TI10657600C) (Fixed) (Total:584.56 GB) (Free:405.99 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 596.2 GB) (Disk ID: 00000000)

Partition: GPT.

==================== End of log ============================

Also, I'm not having any popup's on either IE or Firefox.
kokuorei
Active Member
 
Posts: 11
Joined: August 10th, 2015, 8:04 pm

Re: Take the Coupon and More!

Unread postby Firefly » August 22nd, 2015, 8:39 am

good job kokuorei -

While i look at these logs, can you confirm for me that Chrome has been uninstalled? The virus set it to something called a "Developers build" which removes some security features. Thats not atypical, but it is still showing up in your logs. Most likely its simply an error from the uninstaller, but I want to confirm with you before we take the next steps.
User avatar
Firefly
Regular Member
 
Posts: 949
Joined: March 5th, 2014, 4:33 pm

Re: Take the Coupon and More!

Unread postby Firefly » August 22nd, 2015, 6:22 pm

One other question - there are some Norton programs on your computer which are fine, but you may not be using. Having two different AVs can cause conflicts and actually allow more infections to take hold. To be clear, none of the Norton products you are using are the actual AV product, but there are parts that **could** conflict. Therefore, if you are not using them, you may be better off removing them. If you are, we can definitely leave them as i see the chance of an issue being small.

Let me know so I can post my next set of instructions and we can get your computer put back together correctly.
User avatar
Firefly
Regular Member
 
Posts: 949
Joined: March 5th, 2014, 4:33 pm

Re: Take the Coupon and More!

Unread postby kokuorei » August 23rd, 2015, 9:16 am

Chrome is no longer in my uninstall list. Nor do I see it anywhere else.

I can remove all the Norton if it would be best. It came with my computer.
kokuorei
Active Member
 
Posts: 11
Joined: August 10th, 2015, 8:04 pm

Re: Take the Coupon and More!

Unread postby Firefly » August 23rd, 2015, 11:00 am

OK. Lets take a finla look to make sure everything is gone, then we can go about cleaning things up and rebuilding...


ESET online scannner

Note: If you are using Windows Vista or Windows 7, open your browser by right-clicking on its icon and select 'Run as administrator' to perform this scan.

This utility can only be run using Internet Explorer, Chrome, or Firefox. Chrome and Firefox users will need to download and run a small utility file when prompted before starting scan.

  • First please Disable any Antivirus you have active, as shown in This topic.
  • Note: Don't forget to re-enable it after the scan.
  • Next hold down Control then click on the following link to open a new window to ESET online scannner
  • When (and if) prompted, allow the Add-On/Active X to install.
  • Click on Run ESET Online Scanner, then elect the option YES, I accept the Terms of Use, then click Start.
  • Make sure that the option Remove found threats is NOT checked, and the option Scan archives is checked.
  • Now click on Advanced Settings and select the following:
    • Scan for potentially unwanted applications
    • Scan for potentially unsafe applications
    • Enable Anti-Stealth Technology
  • Now click on Start.
  • The virus signature database... will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
  • When completed the Online Scan will begin automatically.
  • Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
  • When completed select Uninstall application on close if you so wish, make sure you copy the logfile first!
  • Now click on Finish.
  • Use notepad to open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt.
  • Copy and paste that log as a reply to this topic.
User avatar
Firefly
Regular Member
 
Posts: 949
Joined: March 5th, 2014, 4:33 pm

Re: Take the Coupon and More!

Unread postby kokuorei » August 23rd, 2015, 2:51 pm

I ran it twice. Each time it froze at 98%. I left it for over an hour to see if it would do anything else. I shut off my screen saver for the second one, and had the mouse turned off. Not sure what happened.

However, I did get the log file for it.

C:\AdwCleaner\Quarantine\C\Program Files (x86)\mozilla firefox\dbghelp.dll.vir a variant of Win32/Adware.MultiPlug.IY application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\SaoLePlus\SaoLePlus.exe.vir Win32/Adware.SalePlus.A application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\TakeaTHeeCOupon\321Nes5BPIcog0.dll.vir a variant of Win32/Adware.MultiPlug.NW application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\TakeaTHeeCOupon\321Nes5BPIcog0.exe.vir Win32/Adware.MultiPlug.KG application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\TakeaTHeeCOupon\321Nes5BPIcog0.x64.dll.vir a variant of Win64/Adware.MultiPlug.K application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\TTakeTeheCOupoN\TTakeTeheCOupoN.exe.vir Win32/Adware.MultiPlug.KG application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\UpgradeLeader\UpgradeLeader.dll.vir a variant of Win32/Adware.MultiPlug.NV.gen application
C:\AdwCleaner\Quarantine\C\ProgramData\gcamlkdlbcdfmpdjgdngbfialmfnkbkd\content.js.vir JS/Adware.MultiPlug.G application
C:\AdwCleaner\Quarantine\C\ProgramData\gcamlkdlbcdfmpdjgdngbfialmfnkbkd\lsdb.js.vir JS/Adware.MultiPlug.G application
C:\AdwCleaner\Quarantine\C\ProgramData\gcamlkdlbcdfmpdjgdngbfialmfnkbkd\vGb.js.vir JS/Adware.MultiPlug.G application
C:\AdwCleaner\Quarantine\C\ProgramData\{03038c47-7473-8af3-0303-38c47747311d}\ AD.exe.vir a variant of Win32/Adware.MultiPlug.JB application
C:\AdwCleaner\Quarantine\C\ProgramData\{f34f0cd2-d6b6-5bd8-f34f-f0cd2d6b334b}\5907901995387593853b.exe.vir a variant of Win32/Adware.MultiPlug.LR application
C:\AdwCleaner\Quarantine\C\Users\Claud\AppData\Roaming\Mozilla\Firefox\Profiles\fei3oldc.default\Extensions\ysK@b.org\content\bg.js.vir JS/Adware.MultiPlug.I application
C:\Program Files (x86)\MultiHighlighter\MultiHighlighter.exe Win32/Adware.SalePlus.A application
kokuorei
Active Member
 
Posts: 11
Joined: August 10th, 2015, 8:04 pm

Re: Take the Coupon and More!

Unread postby Firefly » August 23rd, 2015, 3:59 pm

Good job running the scan. Most of that is stuff that AdwCleaner removed earlier. Let's move on:


FRST fix

  • Click Start
  • Type notepad.exe in the search programs and files box and click Enter.
  • A blank Notepad page should open.
    • Copy and Paste the following script into Notepad, Do not include the words Code: select all
    • (Click the select all button next to code to select the entire script).
    Code: Select all
    C:\Program Files (x86)\MultiHighlighter
    C:\Users\Claud\AppData\Local\Google
    C:\Program Files (x86)\Google
    Norton Online Backup ARA (x32 Version: 4.1.0.11 - Symantec Corporation) Hidden
    
  • Save it next to FRST.exe as filename fixlist.txt
  • NOTE: It's important that both files, FRST/FRST64 and fixlist.txt are saved in the same location or the fix will not work.
  • Right-click FRST.exe and select " Run as administrator " to run it.
  • Press the Fix button just once. Then wait.
  • When finished, it will create a Fixlog.txt log on your Desktop.
  • Please post the content of the Fixlog.txt in your next reply.


Uninstall programs

  • From the top or bottom right corner... a widget panel appears, select Settings.
  • Select, click Control Panel to open.
  • Depending on your current view setting ...
    • Double click on Programs and Features.
      or
    • Under Programs, click on Uninstall a program.
  • Locate the following program(s):
    Norton Online Backup
    Norton Online Backup ARA
    Norton PC Checkup
    Norton Security Dashboard
  • Select the program and click on Uninstall to uninstall it.
    Carefully read any prompts...
    Some uninstallers prompt in a way to trick you into keeping the program, sometimes, preventing them from being uninstalled again!
  • Repeat steps 4 - 5 for each program in the list. When finished... Close the Control Panel window.


Norton Removal Tool

Please download the Norton Removal Tool from the link below:

https://support.norton.com/sp/en/us/hom ... file_en_us

You will see instructions for running this tool. Please simply download and run per the instructions provided. The computer will restart and we can proceed.


Revised FRST Scan

Before beginning, please delete the file "frst.txt" which is on your desktop.

  • Right-click FRST.exe and select " Run as administrator " to run it.
  • When the tool opens click Yes to the disclaimer.
  • Press Scan button. ... When finished a log will be created, FRST.txt.
  • Please post the content of the FRST.txt in your next reply.


Next Steps

1. Confirm removal of Norton programs
2. Post fixlog.txt
3. post FRST.txt
User avatar
Firefly
Regular Member
 
Posts: 949
Joined: March 5th, 2014, 4:33 pm

Re: Take the Coupon and More!

Unread postby Firefly » August 25th, 2015, 9:02 pm

kokuorei - are you still with me? There is alot more to do...
User avatar
Firefly
Regular Member
 
Posts: 949
Joined: March 5th, 2014, 4:33 pm

Re: Take the Coupon and More!

Unread postby Cypher » August 27th, 2015, 6:06 am

Due to a lack of response, this topic is now closed.

If you still require help, please open a new thread in the Infected? Virus, malware, adware, ransomware, oh my! forum, include a fresh FRST log, and wait for a new helper.
User avatar
Cypher
Admin/Teacher
Admin/Teacher
 
Posts: 15148
Joined: October 29th, 2008, 12:49 pm
Location: Land Of The Leprechauns
Advertisement
Register to Remove

Previous

Return to Infected? Virus, malware, adware, ransomware, oh my!



Who is online

Users browsing this forum: No registered users and 128 guests

Contact us:

Advertisements do not imply our endorsement of that product or service. Register to remove all ads. The forum is run by volunteers who donate their time and expertise. We make every attempt to ensure that the help and advice posted is accurate and will not cause harm to your computer. However, we do not guarantee that they are accurate and they are to be used at your own risk. All trademarks are the property of their respective owners.

Member site: UNITE Against Malware