Welcome to MalwareRemoval.com,
What if we told you that you could get malware removal help from experts, and that it was 100% free? MalwareRemoval.com provides free support for people with infected computers. Our help, and the tools we use are always 100% free. No hidden catch. We simply enjoy helping others. You enjoy a clean, safe computer.

Malware Removal Instructions

Adware Hijackk!!!!!!!!!!!!!!!!

MalwareRemoval.com provides free support for people with infected computers. Using plain language that anyone can understand, our community of volunteer experts will walk you through each step.

Adware Hijackk!!!!!!!!!!!!!!!!

Unread postby kri234 » July 4th, 2016, 11:41 pm

Whenever I open the browser, the homepage (google) comes on for a second, and then redirects to the adware page - savemybiz.in or something. Then I realized my folly of installing a random program along with a required program and uninstalled the program which was causing this (springfiles downloader).
I also tries to remove the adware with a few programs such as malwaye bytes, etc.
Still the problem persists. The page now changes to another adware page, and so I enabled AdBlock Plus. each time I open my browser, it blocks two ads now and opens my required homepage (google). ALso, my system is visibly slowing down as I type this.
Please guide me to remove this permanently and save my system from my stupidity.

The FRST logs :
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 02-07-2016
Ran by Shri (administrator) on ALEXANDRIA (04-07-2016 07:57:45)
Running from C:\Users\Shri\Downloads
Loaded Profiles: Shri (Available Profiles: Shri)
Platform: Windows 7 Home Premium Service Pack 1 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/33 ... scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Autodesk Inc.) C:\Program Files (x86)\Common Files\Autodesk Shared\AppManager\R1\AdAppMgrSvc.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ElevationManager\AdobeUpdateService.exe
(Adobe Systems, Incorporated) C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
(Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Intel Corporation) C:\Program Files\Intel\STCServ\STCServ.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.30.3\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.30.3\GoogleCrashHandler64.exe
(Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
(Microsoft Corporation) C:\Windows\System32\cmd.exe
(Microsoft Corporation) C:\Windows\System32\cmd.exe
(Microsoft Corporation) C:\Windows\System32\cmd.exe
(Microsoft Corporation) C:\Windows\System32\cmd.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE
(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\BrYNSvc.exe
(Intel® Corporation) C:\Program Files\Intel\ConnectCenter\bin\CCFManager.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe
(Geek Uninstaller) C:\Users\Shri\Downloads\geek\geek.exe
(Geek Uninstaller) C:\Users\Shri\AppData\Local\Temp\geek_x64.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Framework\Common\avgsvca.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Framework\Common\avguix.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Framework\Common\avguix.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Av\avgidsagenta.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Av\avgcsrva.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Av\avgwdsvca.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Av\avgnsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Av\avgemca.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Av\avgrsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Av\avgui.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\taskmgr.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe


==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [IntelWireless] => C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe [1926928 2010-01-19] (Intel(R) Corporation)
HKLM\...\Run: [NVHotkey] => rundll32.exe C:\Windows\system32\nvHotkey.dll,Start
HKLM\...\Run: [IntelConnectCenter] => C:\Program Files\Intel\ConnectCenter\bin\ICCLauncher.exe [90112 2015-03-16] (Intel® Corporation)
HKLM-x32\...\Run: [ControlCenter4] => C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe [139776 2014-05-22] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [BrStsMon00] => C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe [4513792 2014-05-22] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [Dropbox] => C:\Program Files (x86)\Dropbox\Client\Dropbox.exe [24105936 2016-06-14] (Dropbox, Inc.)
HKLM-x32\...\Run: [AvgUi] => C:\Program Files (x86)\AVG\Framework\Common\avguirnx.exe [186640 2016-06-21] (AVG Technologies CZ, s.r.o.)
HKLM-x32\...\Run: [AVG_UI] => C:\Program Files (x86)\AVG\Av\avgui.exe [6723856 2016-06-29] (AVG Technologies CZ, s.r.o.)
HKLM\...\Policies\Explorer: [NoViewOnDrive] 0
HKLM\...\Policies\Explorer: [DisableLocalMachineRun] 0
HKLM\...\Policies\Explorer: [DisableLocalMachineRunOnce] 0
HKLM\...\Policies\Explorer: [DisableCurrentUserRun] 0
HKLM\...\Policies\Explorer: [DisableCurrentUserRunOnce] 0
HKLM\...\Policies\Explorer: [NoViewContextMenu] 0
HKLM\...\Policies\Explorer: [NoShellSearchButton] 0
HKLM\...\Policies\Explorer: [NoFind] 0
HKLM\...\Policies\Explorer: [NoFile] 0
HKLM\...\Policies\Explorer: [HideClock] 0
HKLM\...\Policies\Explorer: [NoTrayContextMenu] 0
HKLM\...\Policies\Explorer: [NoTrayItemsDisplay] 0
HKLM\...\Policies\Explorer: [NoSetFolders] 0
HKLM\...\Policies\Explorer: [NoDevMgrUpdate] 0
HKLM\...\Policies\Explorer: [NoSetTaskbar] 0
HKLM\...\Policies\Explorer: [NoDeletePrinter] 0
HKLM\...\Policies\Explorer: [NoDFSTab] 0
HKLM\...\Policies\Explorer: [NoChangeStartMenu] 0
HKLM\...\Policies\Explorer: [NoLogoff] 0
HKLM\...\Policies\Explorer: [NoWindowsUpdate] 0
HKLM\...\Policies\Explorer: [NoEncryptOnMove] 0
HKLM\...\Policies\Explorer: [NoRunasInstallPrompt] 0
HKLM\...\Policies\Explorer: [NoResolveSearch] 0
HKLM\...\Policies\Explorer: [NoSaveSettings] 0
HKLM\...\Policies\Explorer: [NoHardwareTab] 0
HKLM\...\Policies\Explorer: [NoStartMenuSubFolders] 0
HKLM\...\Policies\Explorer: [NoDesktop] 0
HKU\S-1-5-19\...\Policies\system: [DisableCMD] 0
HKU\S-1-5-19\...\Policies\system: [NoDispAppearancePage] 0
HKU\S-1-5-19\...\Policies\system: [NoDispBackgroundPage] 0
HKU\S-1-5-19\...\Policies\system: [NoDispSettingsPage] 0
HKU\S-1-5-19\...\Policies\Explorer: [NoViewOnDrive] 0
HKU\S-1-5-19\...\Policies\Explorer: [DisableLocalMachineRun] 0
HKU\S-1-5-19\...\Policies\Explorer: [DisableLocalMachineRunOnce] 0
HKU\S-1-5-19\...\Policies\Explorer: [DisableCurrentUserRun] 0
HKU\S-1-5-19\...\Policies\Explorer: [DisableCurrentUserRunOnce] 0
HKU\S-1-5-19\...\Policies\Explorer: [NoViewContextMenu] 0
HKU\S-1-5-19\...\Policies\Explorer: [NoShellSearchButton] 0
HKU\S-1-5-19\...\Policies\Explorer: [NoFind] 0
HKU\S-1-5-19\...\Policies\Explorer: [NoFile] 0
HKU\S-1-5-19\...\Policies\Explorer: [HideClock] 0
HKU\S-1-5-19\...\Policies\Explorer: [NoTrayContextMenu] 0
HKU\S-1-5-19\...\Policies\Explorer: [NoTrayItemsDisplay] 0
HKU\S-1-5-19\...\Policies\Explorer: [NoSetFolders] 0
HKU\S-1-5-19\...\Policies\Explorer: [NoDevMgrUpdate] 0
HKU\S-1-5-19\...\Policies\Explorer: [NoSetTaskbar] 0
HKU\S-1-5-19\...\Policies\Explorer: [NoDeletePrinter] 0
HKU\S-1-5-19\...\Policies\Explorer: [NoDFSTab] 0
HKU\S-1-5-19\...\Policies\Explorer: [NoChangeStartMenu] 0
HKU\S-1-5-19\...\Policies\Explorer: [NoLogoff] 0
HKU\S-1-5-19\...\Policies\Explorer: [NoWindowsUpdate] 0
HKU\S-1-5-19\...\Policies\Explorer: [NoEncryptOnMove] 0
HKU\S-1-5-19\...\Policies\Explorer: [NoRunasInstallPrompt] 0
HKU\S-1-5-19\...\Policies\Explorer: [NoResolveSearch] 0
HKU\S-1-5-19\...\Policies\Explorer: [NoSaveSettings] 0
HKU\S-1-5-19\...\Policies\Explorer: [NoHardwareTab] 0
HKU\S-1-5-19\...\Policies\Explorer: [NoStartMenuSubFolders] 0
HKU\S-1-5-20\...\Policies\system: [DisableCMD] 0
HKU\S-1-5-20\...\Policies\system: [NoDispAppearancePage] 0
HKU\S-1-5-20\...\Policies\system: [NoDispBackgroundPage] 0
HKU\S-1-5-20\...\Policies\system: [NoDispSettingsPage] 0
HKU\S-1-5-20\...\Policies\Explorer: [NoViewOnDrive] 0
HKU\S-1-5-20\...\Policies\Explorer: [DisableLocalMachineRun] 0
HKU\S-1-5-20\...\Policies\Explorer: [DisableLocalMachineRunOnce] 0
HKU\S-1-5-20\...\Policies\Explorer: [DisableCurrentUserRun] 0
HKU\S-1-5-20\...\Policies\Explorer: [DisableCurrentUserRunOnce] 0
HKU\S-1-5-20\...\Policies\Explorer: [NoViewContextMenu] 0
HKU\S-1-5-20\...\Policies\Explorer: [NoShellSearchButton] 0
HKU\S-1-5-20\...\Policies\Explorer: [NoFind] 0
HKU\S-1-5-20\...\Policies\Explorer: [NoFile] 0
HKU\S-1-5-20\...\Policies\Explorer: [HideClock] 0
HKU\S-1-5-20\...\Policies\Explorer: [NoTrayContextMenu] 0
HKU\S-1-5-20\...\Policies\Explorer: [NoTrayItemsDisplay] 0
HKU\S-1-5-20\...\Policies\Explorer: [NoSetFolders] 0
HKU\S-1-5-20\...\Policies\Explorer: [NoDevMgrUpdate] 0
HKU\S-1-5-20\...\Policies\Explorer: [NoSetTaskbar] 0
HKU\S-1-5-20\...\Policies\Explorer: [NoDeletePrinter] 0
HKU\S-1-5-20\...\Policies\Explorer: [NoDFSTab] 0
HKU\S-1-5-20\...\Policies\Explorer: [NoChangeStartMenu] 0
HKU\S-1-5-20\...\Policies\Explorer: [NoLogoff] 0
HKU\S-1-5-20\...\Policies\Explorer: [NoWindowsUpdate] 0
HKU\S-1-5-20\...\Policies\Explorer: [NoEncryptOnMove] 0
HKU\S-1-5-20\...\Policies\Explorer: [NoRunasInstallPrompt] 0
HKU\S-1-5-20\...\Policies\Explorer: [NoResolveSearch] 0
HKU\S-1-5-20\...\Policies\Explorer: [NoSaveSettings] 0
HKU\S-1-5-20\...\Policies\Explorer: [NoHardwareTab] 0
HKU\S-1-5-20\...\Policies\Explorer: [NoStartMenuSubFolders] 0
HKU\S-1-5-21-3111129010-2965567075-23443806-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [8698584 2016-04-16] (Piriform Ltd)
HKU\S-1-5-21-3111129010-2965567075-23443806-1000\...\Policies\system: [DisableLockWorkstation] 0
HKU\S-1-5-21-3111129010-2965567075-23443806-1000\...\Policies\system: [DisableCMD] 0
HKU\S-1-5-21-3111129010-2965567075-23443806-1000\...\Policies\system: [NoDispAppearancePage] 0
HKU\S-1-5-21-3111129010-2965567075-23443806-1000\...\Policies\system: [NoDispBackgroundPage] 0
HKU\S-1-5-21-3111129010-2965567075-23443806-1000\...\Policies\system: [NoDispSettingsPage] 0
HKU\S-1-5-21-3111129010-2965567075-23443806-1000\...\Policies\Explorer: []
HKU\S-1-5-21-3111129010-2965567075-23443806-1000\...\Policies\Explorer: [NoViewOnDrive] 0
HKU\S-1-5-21-3111129010-2965567075-23443806-1000\...\Policies\Explorer: [DisableLocalMachineRun] 0
HKU\S-1-5-21-3111129010-2965567075-23443806-1000\...\Policies\Explorer: [DisableLocalMachineRunOnce] 0
HKU\S-1-5-21-3111129010-2965567075-23443806-1000\...\Policies\Explorer: [DisableCurrentUserRun] 0
HKU\S-1-5-21-3111129010-2965567075-23443806-1000\...\Policies\Explorer: [DisableCurrentUserRunOnce] 0
HKU\S-1-5-21-3111129010-2965567075-23443806-1000\...\Policies\Explorer: [NoViewContextMenu] 0
HKU\S-1-5-21-3111129010-2965567075-23443806-1000\...\Policies\Explorer: [NoShellSearchButton] 0
HKU\S-1-5-21-3111129010-2965567075-23443806-1000\...\Policies\Explorer: [NoFind] 0
HKU\S-1-5-21-3111129010-2965567075-23443806-1000\...\Policies\Explorer: [NoFile] 0
HKU\S-1-5-21-3111129010-2965567075-23443806-1000\...\Policies\Explorer: [HideClock] 0
HKU\S-1-5-21-3111129010-2965567075-23443806-1000\...\Policies\Explorer: [NoTrayContextMenu] 0
HKU\S-1-5-21-3111129010-2965567075-23443806-1000\...\Policies\Explorer: [NoTrayItemsDisplay] 0
HKU\S-1-5-21-3111129010-2965567075-23443806-1000\...\Policies\Explorer: [NoSetFolders] 0
HKU\S-1-5-21-3111129010-2965567075-23443806-1000\...\Policies\Explorer: [NoDevMgrUpdate] 0
HKU\S-1-5-21-3111129010-2965567075-23443806-1000\...\Policies\Explorer: [NoSetTaskbar] 0
HKU\S-1-5-21-3111129010-2965567075-23443806-1000\...\Policies\Explorer: [NoDeletePrinter] 0
HKU\S-1-5-21-3111129010-2965567075-23443806-1000\...\Policies\Explorer: [NoDFSTab] 0
HKU\S-1-5-21-3111129010-2965567075-23443806-1000\...\Policies\Explorer: [NoChangeStartMenu] 0
HKU\S-1-5-21-3111129010-2965567075-23443806-1000\...\Policies\Explorer: [NoLogoff] 0
HKU\S-1-5-21-3111129010-2965567075-23443806-1000\...\Policies\Explorer: [NoWindowsUpdate] 0
HKU\S-1-5-21-3111129010-2965567075-23443806-1000\...\Policies\Explorer: [NoEncryptOnMove] 0
HKU\S-1-5-21-3111129010-2965567075-23443806-1000\...\Policies\Explorer: [NoRunasInstallPrompt] 0
HKU\S-1-5-21-3111129010-2965567075-23443806-1000\...\Policies\Explorer: [NoResolveSearch] 0
HKU\S-1-5-21-3111129010-2965567075-23443806-1000\...\Policies\Explorer: [NoSaveSettings] 0
HKU\S-1-5-21-3111129010-2965567075-23443806-1000\...\Policies\Explorer: [NoHardwareTab] 0
HKU\S-1-5-21-3111129010-2965567075-23443806-1000\...\Policies\Explorer: [NoStartMenuSubFolders] 0
HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [301568 2016-03-13] (Microsoft Corporation)
HKU\S-1-5-18\...\Policies\system: [DisableCMD] 0
HKU\S-1-5-18\...\Policies\system: [NoDispAppearancePage] 0
HKU\S-1-5-18\...\Policies\system: [NoDispBackgroundPage] 0
HKU\S-1-5-18\...\Policies\system: [NoDispSettingsPage] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoViewOnDrive] 0
HKU\S-1-5-18\...\Policies\Explorer: [DisableLocalMachineRun] 0
HKU\S-1-5-18\...\Policies\Explorer: [DisableLocalMachineRunOnce] 0
HKU\S-1-5-18\...\Policies\Explorer: [DisableCurrentUserRun] 0
HKU\S-1-5-18\...\Policies\Explorer: [DisableCurrentUserRunOnce] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoViewContextMenu] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoShellSearchButton] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoFind] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoFile] 0
HKU\S-1-5-18\...\Policies\Explorer: [HideClock] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoTrayContextMenu] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoTrayItemsDisplay] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoSetFolders] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoDevMgrUpdate] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoSetTaskbar] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoDeletePrinter] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoDFSTab] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoChangeStartMenu] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoLogoff] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoWindowsUpdate] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoEncryptOnMove] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoRunasInstallPrompt] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoResolveSearch] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoSaveSettings] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoHardwareTab] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoStartMenuSubFolders] 0
ShellIconOverlayIdentifiers: [ GoogleDriveBlacklisted] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2016-05-17] (Google)
ShellIconOverlayIdentifiers: [ GoogleDriveSynced] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2016-05-17] (Google)
ShellIconOverlayIdentifiers: [ GoogleDriveSyncing] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2016-05-17] (Google)
ShellIconOverlayIdentifiers: [ AccExtIco1] -> {AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2016-04-01] ()
ShellIconOverlayIdentifiers: [ AccExtIco2] -> {853B7E05-C47D-4985-909A-D0DC5C6D7303} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2016-04-01] ()
ShellIconOverlayIdentifiers: [ AccExtIco3] -> {42D38F2E-98E9-4382-B546-E24E4D6D04BB} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2016-04-01] ()
ShellIconOverlayIdentifiers: [ DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.34.dll [2016-06-14] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.34.dll [2016-06-14] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt3] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.34.dll [2016-06-14] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt4] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.34.dll [2016-06-14] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt5] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.34.dll [2016-06-14] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt6] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.34.dll [2016-06-14] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt7] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.34.dll [2016-06-14] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt8] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.34.dll [2016-06-14] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [AutoCAD Digital Signatures Icon Overlay Handler] -> {36A21736-36C2-4C11-8ACB-D4136F2B57BD} => C:\Windows\system32\AcSignIcon.dll [2015-02-06] (Autodesk, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.34.dll [2016-06-14] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.34.dll [2016-06-14] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt3] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.34.dll [2016-06-14] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt4] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.34.dll [2016-06-14] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt5] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.34.dll [2016-06-14] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt6] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.34.dll [2016-06-14] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt7] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.34.dll [2016-06-14] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt8] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.34.dll [2016-06-14] (Dropbox, Inc.)
Startup: C:\Users\Shri\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Send to OneNote.lnk [2016-06-14]
ShortcutTarget: Send to OneNote.lnk -> C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE (Microsoft Corporation)
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{4F6C61B5-3B60-4795-97BC-3F0068B5ECEB}: [DhcpNameServer] 192.168.1.1
ManualProxies:

Internet Explorer:
==================
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\OCHelper.dll [2016-06-10] (Microsoft Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\URLREDIR.DLL [2016-06-10] (Microsoft Corporation)
BHO: No Name -> {c8d5d964-2be8-4c5b-8cf5-6e975aa88504} -> No File
BHO: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\GROOVEEX.DLL [2016-06-10] (Microsoft Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\root\Office16\URLREDIR.DLL [2016-06-10] (Microsoft Corporation)
BHO-x32: No Name -> {c8d5d964-2be8-4c5b-8cf5-6e975aa88504} -> No File
Toolbar: HKLM - No Name - {97ab88ef-346b-4179-a0b1-7445896547a5} - No File
Toolbar: HKLM-x32 - No Name - {97ab88ef-346b-4179-a0b1-7445896547a5} - No File
Handler-x32: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2016-06-10] (Microsoft Corporation)
Handler-x32: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2016-06-10] (Microsoft Corporation)
Handler-x32: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2016-06-10] (Microsoft Corporation)
Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2016-06-10] (Microsoft Corporation)

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_21_0_0_213.dll [2016-04-10] ()
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll [2016-04-07] (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_21_0_0_213.dll [2016-04-10] ()
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files (x86)\Microsoft Office\root\Office16\NPSPWRAP.DLL [2016-06-10] (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2010-08-12] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2010-08-12] (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.30.3\npGoogleUpdate3.dll [2016-05-11] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.30.3\npGoogleUpdate3.dll [2016-05-11] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2016-05-28] (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll [2016-04-07] (Adobe Systems)

Chrome:
=======
CHR HomePage: Profile 3 -> hxxps://www.google.co.in/
CHR StartupUrls: Profile 3 -> "hxxps://www.google.com/"
CHR Profile: C:\Users\Shri\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Be Limitless) - C:\Users\Shri\AppData\Local\Google\Chrome\User Data\Default\Extensions\jdpnljppdhjpafeaokemhcggofohekbp [2016-03-10]
CHR Extension: (Reddit Enhancement Suite) - C:\Users\Shri\AppData\Local\Google\Chrome\User Data\Default\Extensions\kbmfpngjjgdllneeigpgjifpgocmfgmb [2016-03-18]
CHR Extension: (Pocket) - C:\Users\Shri\AppData\Local\Google\Chrome\User Data\Default\Extensions\mjcnijlhddpbdemagnpefmlkjdagkogk [2016-03-22]
CHR Extension: (Compare Hatke) - C:\Users\Shri\AppData\Local\Google\Chrome\User Data\Default\Extensions\nbeifcmllbkkjebeahalgcadeblbbfbe [2016-03-10]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Shri\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-04-04]
CHR Extension: (Gmail) - C:\Users\Shri\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-03-10]
CHR Profile: C:\Users\Shri\AppData\Local\Google\Chrome\User Data\Profile 1
CHR Profile: C:\Users\Shri\AppData\Local\Google\Chrome\User Data\Profile 3
CHR Extension: (Duolingo on the Web) - C:\Users\Shri\AppData\Local\Google\Chrome\User Data\Profile 3\Extensions\aiahmijlpehemcpleichkcokhegllfjl [2016-07-04]
CHR Extension: (Google Drive) - C:\Users\Shri\AppData\Local\Google\Chrome\User Data\Profile 3\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-07-04]
CHR Extension: (YouTube) - C:\Users\Shri\AppData\Local\Google\Chrome\User Data\Profile 3\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-07-04]
CHR Extension: (Adblock Plus) - C:\Users\Shri\AppData\Local\Google\Chrome\User Data\Profile 3\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2016-07-04]
CHR Extension: (Reddit Enhancement Suite) - C:\Users\Shri\AppData\Local\Google\Chrome\User Data\Profile 3\Extensions\kbmfpngjjgdllneeigpgjifpgocmfgmb [2016-07-04]
CHR Extension: (Pocket) - C:\Users\Shri\AppData\Local\Google\Chrome\User Data\Profile 3\Extensions\mjcnijlhddpbdemagnpefmlkjdagkogk [2016-07-04]
CHR Extension: (Compare Hatke) - C:\Users\Shri\AppData\Local\Google\Chrome\User Data\Profile 3\Extensions\nbeifcmllbkkjebeahalgcadeblbbfbe [2016-07-04]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Shri\AppData\Local\Google\Chrome\User Data\Profile 3\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-07-04]
CHR Extension: (Gmail) - C:\Users\Shri\AppData\Local\Google\Chrome\User Data\Profile 3\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-07-04]
CHR HKU\S-1-5-21-3111129010-2965567075-23443806-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [apdfllckaahabafndbhieahigkjlhalf] - C:\Users\Shri\AppData\Local\Google\Drive\user_default\apdfllckaahabafndbhieahigkjlhalf_live.crx [2016-04-13]
CHR HKU\S-1-5-21-3111129010-2965567075-23443806-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [ngkhgikojglcgnckopipfdajaifmmnnc] - hxxp://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AdAppMgrSvc; C:\Program Files (x86)\Common Files\Autodesk Shared\AppManager\R1\AdAppMgrSvc.exe [599944 2014-12-05] (Autodesk Inc.)
R2 AdobeUpdateService; C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ElevationManager\AdobeUpdateService.exe [694464 2016-04-07] (Adobe Systems Incorporated)
R2 AGSService; C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe [2021592 2016-04-05] (Adobe Systems, Incorporated)
S2 Autodesk Content Service; C:\Program Files\Autodesk\Content Service\Connect.Service.ContentService.exe [31160 2015-02-05] (Autodesk, Inc.)
S3 AvgAMPS; C:\Program Files (x86)\AVG\Av\avgamps.exe [637944 2016-06-29] (AVG Technologies CZ, s.r.o.)
S2 avgfws; C:\Program Files (x86)\AVG\Av\avgfwsa.exe [2007608 2016-06-29] (AVG Technologies CZ, s.r.o.)
R2 AVGIDSAgent; C:\Program Files (x86)\AVG\Av\avgidsagenta.exe [5251808 2016-06-29] (AVG Technologies CZ, s.r.o.)
R2 avgsvc; C:\Program Files (x86)\AVG\Framework\Common\avgsvca.exe [1080080 2016-06-21] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files (x86)\AVG\Av\avgwdsvca.exe [712792 2016-06-29] (AVG Technologies CZ, s.r.o.)
R3 BrYNSvc; C:\Program Files (x86)\Browny02\BrYNSvc.exe [282112 2013-09-25] (Brother Industries, Ltd.) [File not signed]
R2 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [2944768 2016-06-10] (Microsoft Corporation)
S2 dbupdate; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2016-05-17] (Dropbox, Inc.)
S3 dbupdatem; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2016-05-17] (Dropbox, Inc.)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1514464 2016-03-10] (Malwarebytes)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1136608 2016-03-10] (Malwarebytes)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [315664 2010-01-19] ()
R2 STCServ; C:\Program Files\Intel\STCServ\STCServ.exe [8095456 2015-03-16] (Intel Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [163072 2016-05-13] (AVG Technologies CZ, s.r.o.)
R1 Avgfwfd; C:\Windows\System32\DRIVERS\avgfwd6a.sys [73480 2016-06-06] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [310016 2016-06-09] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [261376 2016-06-01] (AVG Technologies CZ, s.r.o.)
R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [260352 2016-06-01] (AVG Technologies CZ, s.r.o.)
R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [360736 2016-02-16] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [249088 2016-06-02] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [52992 2016-06-01] (AVG Technologies CZ, s.r.o.)
R1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [280320 2016-06-01] (AVG Technologies CZ, s.r.o.)
R0 avguniva; C:\Windows\System32\DRIVERS\avguniva.sys [76544 2016-06-01] (AVG Technologies CZ, s.r.o.)
S3 ebdrv; C:\Windows\system32\DRIVERS\evbda.sys [3286016 2009-06-11] (Broadcom Corporation)
R3 hitmanpro37; C:\Windows\system32\drivers\hitmanpro37.sys [46960 2016-07-04] ()
R2 mbamchameleon; C:\Windows\system32\drivers\mbamchameleon.sys [140672 2016-03-10] (Malwarebytes)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [27008 2016-03-10] (Malwarebytes)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [192216 2016-07-04] (Malwarebytes)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64896 2016-03-10] (Malwarebytes Corporation)
U0 SR; no ImagePath
U2 srservice; no ImagePath

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-07-04 07:57 - 2016-07-04 08:00 - 00031391 _____ C:\Users\Shri\Downloads\FRST.txt
2016-07-04 07:57 - 2016-07-04 07:57 - 00000000 ____D C:\FRST
2016-07-04 07:56 - 2016-07-04 07:56 - 02390016 _____ (Farbar) C:\Users\Shri\Downloads\FRST64.exe
2016-07-04 07:33 - 2016-07-04 07:33 - 00000000 ____D C:\Users\Shri\AppData\Roaming\AVG
2016-07-04 07:32 - 2016-07-04 07:32 - 00000000 ____D C:\Users\Shri\AppData\Roaming\TuneUp Software
2016-07-04 07:32 - 2016-07-04 07:32 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG
2016-07-04 07:32 - 2016-07-04 07:32 - 00000000 ____D C:\Program Files\Common Files\AV
2016-07-04 07:30 - 2016-07-04 07:30 - 00000000 ___HD C:\$AVG
2016-07-04 07:25 - 2016-07-04 07:39 - 00000000 ____D C:\ProgramData\MFAData
2016-07-04 07:25 - 2016-07-04 07:25 - 00000000 ____D C:\Users\Shri\AppData\Local\MFAData
2016-07-04 07:24 - 2016-07-04 07:24 - 00000862 _____ C:\Users\Public\Desktop\AVG.lnk
2016-07-04 07:24 - 2016-07-04 07:24 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG Zen
2016-07-04 07:21 - 2016-07-04 07:29 - 00000000 ____D C:\Program Files (x86)\AVG
2016-07-04 07:19 - 2016-07-04 07:33 - 00000000 ____D C:\Users\Shri\AppData\Local\Avg
2016-07-04 07:19 - 2016-07-04 07:30 - 00000000 ____D C:\ProgramData\Avg
2016-07-04 07:19 - 2016-07-04 07:27 - 00000000 ____D C:\Users\Shri\AppData\Local\AvgSetupLog
2016-07-04 07:16 - 2016-07-04 07:17 - 03136824 _____ (AVG Technologies CZ, s.r.o.) C:\Users\Shri\Downloads\AVG_Protection_755.exe
2016-07-04 05:47 - 2016-07-04 05:47 - 00046960 _____ C:\Windows\system32\Drivers\hitmanpro37.sys
2016-07-04 05:41 - 2016-07-04 05:41 - 00002276 _____ C:\Windows\system32\.crusader
2016-07-04 05:08 - 2016-07-04 05:45 - 00000000 ____D C:\ProgramData\HitmanPro
2016-07-04 05:08 - 2016-07-04 05:08 - 00000000 ____D C:\Program Files\HitmanPro
2016-07-04 05:05 - 2016-07-04 05:07 - 11438608 _____ (SurfRight B.V.) C:\Users\Shri\Downloads\HitmanPro_x64.exe
2016-07-04 04:56 - 2016-07-04 07:16 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2016-07-04 04:56 - 2016-07-04 04:56 - 00001112 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2016-07-04 04:56 - 2016-07-04 04:56 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2016-07-04 04:56 - 2016-07-04 04:56 - 00000000 ____D C:\ProgramData\Malwarebytes
2016-07-04 04:56 - 2016-07-04 04:56 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2016-07-04 04:56 - 2016-03-10 14:09 - 00064896 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2016-07-04 04:56 - 2016-03-10 14:08 - 00140672 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamchameleon.sys
2016-07-04 04:56 - 2016-03-10 14:08 - 00027008 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys
2016-07-04 04:38 - 2016-07-04 04:39 - 22851472 _____ (Malwarebytes ) C:\Users\Shri\Downloads\mbam-setup-2.2.1.1043.exe
2016-07-04 04:37 - 2016-07-04 04:41 - 00000000 ____D C:\AdwCleaner
2016-07-04 04:37 - 2016-07-04 04:37 - 03712064 _____ C:\Users\Shri\Downloads\adwcleaner_5.201.exe
2016-07-03 08:36 - 2016-07-03 08:36 - 00000000 ____D C:\Users\Shri\Downloads\Camera
2016-07-03 07:58 - 2016-07-03 07:58 - 02621985 _____ C:\Users\Shri\Downloads\geek.zip
2016-07-03 07:47 - 2016-07-03 07:47 - 05050687 _____ C:\Users\Shri\Downloads\Luxion Keyshot 6.rar
2016-07-03 00:14 - 2016-07-03 00:14 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_WinUsb_01009.Wdf
2016-07-02 22:29 - 2016-07-02 22:29 - 00024704 _____ C:\Users\Shri\Downloads\205259.pdf
2016-07-02 22:28 - 2016-07-02 22:28 - 00027637 _____ C:\Users\Shri\Downloads\211350.pdf
2016-06-30 10:07 - 2016-06-30 10:07 - 06451310 _____ C:\Users\Shri\Downloads\Converted_file_ef3d8731.epub
2016-06-30 00:04 - 2016-06-30 00:04 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Phone
2016-06-30 00:04 - 2016-06-30 00:04 - 00000000 ____D C:\Program Files (x86)\Windows Phone
2016-06-30 00:03 - 2016-07-04 07:22 - 00000000 ____D C:\ProgramData\Applications
2016-06-29 23:59 - 2016-06-29 23:59 - 00000000 ____D C:\Users\Shri\Desktop\amma
2016-06-29 23:57 - 2016-06-29 23:57 - 00000000 ____D C:\Users\Shri\amma
2016-06-26 12:32 - 2016-06-26 12:41 - 281602712 _____ C:\Users\Shri\Downloads\Camera.zip
2016-06-26 02:08 - 2016-06-26 02:09 - 17880576 _____ C:\Users\Shri\Desktop\Copy of 2016_ITR2_PR2.xls
2016-06-26 02:03 - 2016-06-26 02:04 - 03673138 _____ C:\Users\Shri\Downloads\ITR2_2016.zip
2016-06-25 23:17 - 2016-06-25 23:50 - 00000000 ____D C:\Users\Shri\Documents\accounts
2016-06-25 23:06 - 2016-06-25 23:15 - 00010621 _____ C:\Users\Shri\Downloads\1466876208951THBPfoM3S8k1FYcH.xls
2016-06-25 22:40 - 2016-06-25 22:52 - 26356440 _____ C:\Users\Shri\Downloads\logo-design.zip
2016-06-25 15:04 - 2016-06-25 15:04 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dropbox
2016-06-24 19:03 - 2016-06-24 19:05 - 00001905 _____ C:\Users\Shri\Desktop\LD01_Exterior Lighting_A.dsd
2016-06-24 16:58 - 2016-06-24 16:58 - 00610930 _____ C:\Users\Shri\Documents\angle pull table.skp
2016-06-24 16:56 - 2016-06-24 18:59 - 00001905 _____ C:\Users\Shri\Desktop\esta exterior lighting.dsd
2016-06-24 16:37 - 2016-06-24 16:37 - 00000586 _____ C:\Users\Shri\Desktop\KeyShot 6 Resources.lnk
2016-06-24 16:37 - 2016-06-24 16:37 - 00000000 ____D C:\Users\Shri\Documents\KeyShot 6
2016-06-24 16:36 - 2016-06-24 16:36 - 00000000 ____D C:\Users\Shri\AppData\Local\Luxion
2016-06-24 16:35 - 2016-06-24 16:37 - 00000000 ____D C:\Users\Shri\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\KeyShot 6 64
2016-06-24 16:35 - 2016-06-24 16:35 - 00000766 _____ C:\Users\Shri\Desktop\KeyShot 6 64.lnk
2016-06-22 15:14 - 2016-06-22 15:14 - 19500668 _____ C:\Users\Shri\Downloads\TheHistoryProject.epub
2016-06-17 16:24 - 2016-06-17 16:24 - 00142490 _____ C:\Users\Shri\Documents\new block.bak
2016-06-17 16:11 - 2016-06-17 21:01 - 00137675 _____ C:\Users\Shri\Documents\new block.dwg
2016-06-16 10:29 - 2016-06-16 10:29 - 01020176 _____ (Microsoft Corporation) C:\Windows\system32\WinUSBCoInstaller2.dll
2016-06-16 10:27 - 2016-06-16 10:27 - 01739032 _____ (Microsoft Corporation) C:\Windows\system32\WdfCoInstaller01009.dll
2016-06-15 19:41 - 2016-07-04 04:20 - 00000000 ___RD C:\Users\Shri\Desktop\Manisha
2016-06-15 11:40 - 2016-05-24 05:07 - 00394960 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2016-06-15 11:40 - 2016-05-24 04:24 - 00346312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2016-06-15 11:40 - 2016-05-21 22:58 - 25802752 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2016-06-15 11:40 - 2016-05-21 22:27 - 20341248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2016-06-15 11:40 - 2016-05-21 03:57 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2016-06-15 11:40 - 2016-05-21 03:57 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2016-06-15 11:40 - 2016-05-21 03:44 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2016-06-15 11:40 - 2016-05-21 03:40 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2016-06-15 11:40 - 2016-05-21 03:39 - 00572416 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2016-06-15 11:40 - 2016-05-21 03:39 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2016-06-15 11:40 - 2016-05-21 03:39 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2016-06-15 11:40 - 2016-05-21 03:38 - 02895360 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2016-06-15 11:40 - 2016-05-21 03:38 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2016-06-15 11:40 - 2016-05-21 03:32 - 06051328 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2016-06-15 11:40 - 2016-05-21 03:30 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2016-06-15 11:40 - 2016-05-21 03:29 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2016-06-15 11:40 - 2016-05-21 03:27 - 00497664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2016-06-15 11:40 - 2016-05-21 03:27 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2016-06-15 11:40 - 2016-05-21 03:27 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2016-06-15 11:40 - 2016-05-21 03:26 - 00615936 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2016-06-15 11:40 - 2016-05-21 03:26 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2016-06-15 11:40 - 2016-05-21 03:25 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2016-06-15 11:40 - 2016-05-21 03:24 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2016-06-15 11:40 - 2016-05-21 03:24 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2016-06-15 11:40 - 2016-05-21 03:24 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2016-06-15 11:40 - 2016-05-21 03:24 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2016-06-15 11:40 - 2016-05-21 03:20 - 02287104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2016-06-15 11:40 - 2016-05-21 03:19 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2016-06-15 11:40 - 2016-05-21 03:18 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2016-06-15 11:40 - 2016-05-21 03:15 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2016-06-15 11:40 - 2016-05-21 03:15 - 00476160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2016-06-15 11:40 - 2016-05-21 03:14 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2016-06-15 11:40 - 2016-05-21 03:14 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2016-06-15 11:40 - 2016-05-21 03:13 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2016-06-15 11:40 - 2016-05-21 03:11 - 00489984 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2016-06-15 11:40 - 2016-05-21 03:03 - 00416256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2016-06-15 11:40 - 2016-05-21 03:03 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2016-06-15 11:40 - 2016-05-21 03:02 - 00107520 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2016-06-15 11:40 - 2016-05-21 02:59 - 13815808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2016-06-15 11:40 - 2016-05-21 02:58 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2016-06-15 11:40 - 2016-05-21 02:57 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2016-06-15 11:40 - 2016-05-21 02:57 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2016-06-15 11:40 - 2016-05-21 02:56 - 00091136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2016-06-15 11:40 - 2016-05-21 02:55 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2016-06-15 11:40 - 2016-05-21 02:53 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2016-06-15 11:40 - 2016-05-21 02:53 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2016-06-15 11:40 - 2016-05-21 02:52 - 00152064 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2016-06-15 11:40 - 2016-05-21 02:51 - 00279040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2016-06-15 11:40 - 2016-05-21 02:49 - 00130048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2016-06-15 11:40 - 2016-05-21 02:44 - 04610048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2016-06-15 11:40 - 2016-05-21 02:42 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2016-06-15 11:40 - 2016-05-21 02:41 - 15420928 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2016-06-15 11:40 - 2016-05-21 02:41 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2016-06-15 11:40 - 2016-05-21 02:39 - 00725504 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2016-06-15 11:40 - 2016-05-21 02:39 - 00693248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2016-06-15 11:40 - 2016-05-21 02:38 - 02055680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2016-06-15 11:40 - 2016-05-21 02:38 - 00806400 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2016-06-15 11:40 - 2016-05-21 02:37 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2016-06-15 11:40 - 2016-05-21 02:37 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2016-06-15 11:40 - 2016-05-21 02:36 - 02131968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2016-06-15 11:40 - 2016-05-21 02:16 - 02597888 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2016-06-15 11:40 - 2016-05-21 02:12 - 02121216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2016-06-15 11:40 - 2016-05-21 02:08 - 01310208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2016-06-15 11:40 - 2016-05-21 02:08 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2016-06-15 11:40 - 2016-05-21 02:04 - 01544192 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2016-06-15 11:40 - 2016-05-21 01:53 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2016-06-15 11:40 - 2016-05-18 21:40 - 00312832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2016-06-15 11:40 - 2016-05-18 21:39 - 00405504 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2016-06-15 11:40 - 2016-05-14 03:45 - 00382184 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2016-06-15 11:40 - 2016-05-14 03:39 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2016-06-15 11:40 - 2016-05-14 03:39 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2016-06-15 11:40 - 2016-05-14 03:39 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2016-06-15 11:40 - 2016-05-14 03:39 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2016-06-15 11:40 - 2016-05-14 03:24 - 00308456 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2016-06-15 11:40 - 2016-05-14 03:20 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2016-06-15 11:40 - 2016-05-14 03:19 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2016-06-15 11:40 - 2016-05-14 03:19 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2016-06-15 11:40 - 2016-05-14 02:57 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2016-06-15 11:40 - 2016-05-12 22:50 - 00154856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2016-06-15 11:40 - 2016-05-12 22:50 - 00095464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2016-06-15 11:40 - 2016-05-12 22:45 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2016-06-15 11:40 - 2016-05-12 22:45 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2016-06-15 11:40 - 2016-05-12 22:45 - 00105472 _____ (Microsoft Corporation) C:\Windows\system32\winipsec.dll
2016-06-15 11:40 - 2016-05-12 22:45 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2016-06-15 11:40 - 2016-05-12 22:45 - 00028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2016-06-15 11:40 - 2016-05-12 22:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2016-06-15 11:40 - 2016-05-12 22:44 - 01464320 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2016-06-15 11:40 - 2016-05-12 22:44 - 01212928 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2016-06-15 11:40 - 2016-05-12 22:44 - 00794624 _____ (Microsoft Corporation) C:\Windows\system32\gpsvc.dll
2016-06-15 11:40 - 2016-05-12 22:44 - 00730624 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2016-06-15 11:40 - 2016-05-12 22:44 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2016-06-15 11:40 - 2016-05-12 22:44 - 00502272 _____ (Microsoft Corporation) C:\Windows\system32\IPSECSVC.DLL
2016-06-15 11:40 - 2016-05-12 22:44 - 00463872 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2016-06-15 11:40 - 2016-05-12 22:44 - 00373760 _____ (Microsoft Corporation) C:\Windows\system32\polstore.dll
2016-06-15 11:40 - 2016-05-12 22:44 - 00344064 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2016-06-15 11:40 - 2016-05-12 22:44 - 00316416 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2016-06-15 11:40 - 2016-05-12 22:44 - 00312320 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2016-06-15 11:40 - 2016-05-12 22:44 - 00190464 _____ (Microsoft Corporation) C:\Windows\system32\rpchttp.dll
2016-06-15 11:40 - 2016-05-12 22:44 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2016-06-15 11:40 - 2016-05-12 22:44 - 00096256 _____ (Microsoft Corporation) C:\Windows\system32\gpapi.dll
2016-06-15 11:40 - 2016-05-12 22:44 - 00075776 _____ (Microsoft Corporation) C:\Windows\system32\FwRemoteSvr.dll
2016-06-15 11:40 - 2016-05-12 22:44 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2016-06-15 11:40 - 2016-05-12 22:44 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2016-06-15 11:40 - 2016-05-12 22:44 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2016-06-15 11:40 - 2016-05-12 22:44 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2016-06-15 11:40 - 2016-05-12 20:48 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2016-06-15 11:40 - 2016-05-12 20:48 - 00666112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2016-06-15 11:40 - 2016-05-12 20:48 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2016-06-15 11:40 - 2016-05-12 20:48 - 00342528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2016-06-15 11:40 - 2016-05-12 20:48 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\polstore.dll
2016-06-15 11:40 - 2016-05-12 20:48 - 00260608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2016-06-15 11:40 - 2016-05-12 20:48 - 00251392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2016-06-15 11:40 - 2016-05-12 20:48 - 00223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2016-06-15 11:40 - 2016-05-12 20:48 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2016-06-15 11:40 - 2016-05-12 20:48 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2016-06-15 11:40 - 2016-05-12 20:48 - 00141312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpchttp.dll
2016-06-15 11:40 - 2016-05-12 20:48 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2016-06-15 11:40 - 2016-05-12 20:48 - 00079360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gpapi.dll
2016-06-15 11:40 - 2016-05-12 20:48 - 00070144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winipsec.dll
2016-06-15 11:40 - 2016-05-12 20:48 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2016-06-15 11:40 - 2016-05-12 20:48 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2016-06-15 11:40 - 2016-05-12 20:48 - 00044032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FwRemoteSvr.dll
2016-06-15 11:40 - 2016-05-12 20:48 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2016-06-15 11:40 - 2016-05-12 20:48 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2016-06-15 11:40 - 2016-05-12 20:48 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2016-06-15 11:40 - 2016-05-12 20:35 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2016-06-15 11:40 - 2016-05-12 20:33 - 03217408 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2016-06-15 11:40 - 2016-05-12 20:28 - 00464896 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv.sys
2016-06-15 11:40 - 2016-05-12 20:28 - 00405504 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv2.sys
2016-06-15 11:40 - 2016-05-12 20:28 - 00291328 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2016-06-15 11:40 - 2016-05-12 20:28 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srvnet.sys
2016-06-15 11:40 - 2016-05-12 20:28 - 00159744 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2016-06-15 11:40 - 2016-05-12 20:28 - 00129536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2016-06-15 11:40 - 2016-05-12 20:27 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2016-06-15 11:40 - 2016-05-12 20:26 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2016-06-15 11:40 - 2016-05-12 20:21 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll
2016-06-15 11:40 - 2016-05-12 18:35 - 00459640 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2016-06-15 11:40 - 2016-05-12 18:35 - 00297984 _____ (Microsoft Corporation) C:\Windows\system32\bcryptprimitives.dll
2016-06-15 11:40 - 2016-05-12 18:34 - 00249352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bcryptprimitives.dll
2016-06-15 11:40 - 2016-05-11 22:32 - 00483840 _____ (Microsoft Corporation) C:\Windows\system32\StructuredQuery.dll
2016-06-15 11:40 - 2016-05-11 22:32 - 00444928 _____ (Microsoft Corporation) C:\Windows\system32\winhttp.dll
2016-06-15 11:40 - 2016-05-11 22:32 - 00327168 _____ (Microsoft Corporation) C:\Windows\system32\mswsock.dll
2016-06-15 11:40 - 2016-05-11 22:32 - 00296448 _____ (Microsoft Corporation) C:\Windows\system32\ws2_32.dll
2016-06-15 11:40 - 2016-05-11 20:49 - 00363520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\StructuredQuery.dll
2016-06-15 11:40 - 2016-05-11 20:49 - 00351744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winhttp.dll
2016-06-15 11:40 - 2016-05-11 20:49 - 00231424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mswsock.dll
2016-06-15 11:40 - 2016-05-11 20:49 - 00206336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ws2_32.dll
2016-06-15 11:40 - 2016-05-11 20:41 - 00025088 _____ (Microsoft Corporation) C:\Windows\system32\netbtugc.exe
2016-06-15 11:40 - 2016-05-11 20:31 - 00026624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netbtugc.exe
2016-06-15 11:40 - 2016-05-11 20:28 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netbt.sys
2016-06-14 22:49 - 2016-06-24 14:37 - 00000000 ____D C:\Users\Shri\Documents\OneNote Notebooks
2016-06-14 13:17 - 2016-06-15 20:53 - 01000792 _____ C:\Users\Shri\Desktop\ID19_DD-E.dwg
2016-06-10 11:56 - 2016-06-10 11:56 - 00958447 _____ C:\Users\Shri\Desktop\existing el layout.dwg
2016-06-10 10:17 - 2016-06-10 11:55 - 00887843 _____ C:\Users\Shri\Documents\existing electricla layout.dwg
2016-06-10 10:17 - 2016-06-10 10:58 - 00894425 _____ C:\Users\Shri\Documents\existing electricla layout.bak
2016-06-09 08:15 - 2016-06-09 08:15 - 00310016 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgidsdrivera.sys
2016-06-06 08:24 - 2016-06-06 08:24 - 00073480 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgfwd6a.sys

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-07-04 07:58 - 2016-05-17 15:53 - 00000904 _____ C:\Windows\Tasks\DropboxUpdateTaskMachineUA.job
2016-07-04 07:35 - 2016-03-11 11:08 - 00000000 ____D C:\Program Files\Common Files\Autodesk Shared
2016-07-04 07:31 - 2009-07-14 08:50 - 00000000 ____D C:\Windows\inf
2016-07-04 07:28 - 2016-04-29 10:47 - 00000000 ____D C:\Users\Shri\AppData\Local\CrashDumps
2016-07-04 07:28 - 2016-03-13 11:13 - 00000000 ____D C:\Users\Shri\AppData\Roaming\MPC-HC
2016-07-04 07:28 - 2016-03-10 23:42 - 00000000 ____D C:\Users\Shri\AppData\Roaming\uTorrent
2016-07-04 07:18 - 2016-03-10 18:34 - 00000000 ____D C:\ProgramData\Package Cache
2016-07-04 07:12 - 2016-03-10 18:40 - 00000898 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2016-07-04 06:03 - 2016-05-17 15:59 - 00000000 ___RD C:\Users\Shri\Dropbox
2016-07-04 05:56 - 2009-07-14 10:15 - 00014240 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2016-07-04 05:56 - 2009-07-14 10:15 - 00014240 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2016-07-04 05:54 - 2016-05-17 15:53 - 00000900 _____ C:\Windows\Tasks\DropboxUpdateTaskMachineCore.job
2016-07-04 05:54 - 2016-03-10 18:40 - 00000894 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2016-07-04 05:47 - 2016-03-10 18:34 - 00000000 ____D C:\ProgramData\NVIDIA
2016-07-04 05:47 - 2009-07-14 10:38 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-07-04 05:22 - 2016-04-10 06:14 - 00000000 ____D C:\Program Files\SketchUp
2016-07-04 04:50 - 2016-03-22 11:48 - 00000000 ____D C:\Users\Shri\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
2016-07-04 04:42 - 2016-03-10 23:20 - 00000439 _____ C:\Users\Shri\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Start Tor Browser.lnk
2016-07-04 04:42 - 2016-03-10 18:45 - 00001308 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2016-07-04 04:42 - 2016-03-10 18:12 - 00000997 _____ C:\Users\Shri\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2016-07-03 23:18 - 2009-07-14 10:15 - 00505960 _____ C:\Windows\system32\FNTCACHE.DAT
2016-07-03 10:54 - 2016-04-10 05:23 - 00000000 ____D C:\Users\Shri\AppData\LocalLow\uTorrent
2016-07-03 10:53 - 2016-03-11 10:58 - 00000000 ____D C:\ProgramData\Autodesk
2016-07-03 10:44 - 2016-03-11 11:08 - 00000000 ____D C:\Program Files\Autodesk
2016-07-03 08:49 - 2016-03-12 06:42 - 00000000 ____D C:\Users\Shri\Documents\3dsMax
2016-07-03 08:44 - 2016-03-11 11:07 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Autodesk
2016-07-03 08:42 - 2016-03-11 11:14 - 00000000 ____D C:\Users\Shri\AppData\Local\Autodesk
2016-07-03 08:33 - 2016-03-10 18:40 - 00143072 _____ C:\Users\Shri\AppData\Local\GDIPFONTCACHEV1.DAT
2016-07-03 08:30 - 2016-04-01 12:54 - 00000000 ____D C:\Program Files\Common Files\ChaosGroup
2016-07-03 08:30 - 2016-03-14 15:37 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Chaos Group
2016-07-03 07:37 - 2009-07-14 10:43 - 00781782 _____ C:\Windows\system32\PerfStringBackup.INI
2016-07-02 23:55 - 2016-04-08 14:38 - 00000000 ____D C:\Users\Shri\AppData\Local\ElevatedDiagnostics
2016-06-29 23:57 - 2016-03-10 18:12 - 00000000 ____D C:\Users\Shri
2016-06-29 16:18 - 2016-03-11 12:38 - 00000000 ___RD C:\Users\Shri\Google Drive
2016-06-26 00:16 - 2016-03-13 12:51 - 00000034 _____ C:\Users\Shri\AppData\Roaming\AdobeWLCMCache.dat
2016-06-25 15:05 - 2016-05-17 15:52 - 00000000 ____D C:\Program Files (x86)\Dropbox
2016-06-21 11:23 - 2016-05-30 00:27 - 00000000 ____D C:\Users\Shri\Desktop\85AD Projects
2016-06-21 11:22 - 2016-05-25 10:12 - 00000000 ____D C:\Users\Shri\Desktop\higher studies
2016-06-21 10:32 - 2016-05-23 13:37 - 00000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2016-06-21 10:30 - 2016-04-08 12:21 - 00000000 ____D C:\Program Files (x86)\Microsoft Office
2016-06-16 10:06 - 2016-03-11 03:00 - 00000000 ____D C:\Windows\system32\MRT
2016-06-16 10:00 - 2016-03-11 03:00 - 142482544 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2016-06-13 19:31 - 2016-03-10 18:43 - 00484008 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2016-06-09 22:23 - 2009-07-14 10:38 - 00032570 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2016-06-07 09:47 - 2016-03-11 09:42 - 00000000 ____D C:\Users\Shri\AppData\Local\Adobe

==================== Files in the root of some directories =======

2016-03-13 12:51 - 2016-06-26 00:16 - 0000034 _____ () C:\Users\Shri\AppData\Roaming\AdobeWLCMCache.dat
2016-03-11 11:12 - 2016-03-11 11:12 - 0000133 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.351.64.bc

Some files in TEMP:
====================
C:\Users\Shri\AppData\Local\Temp\AcDeltree.exe
C:\Users\Shri\AppData\Local\Temp\FNP_ACT_InstallerCA.dll
C:\Users\Shri\AppData\Local\Temp\geek_x64.exe
C:\Users\Shri\AppData\Local\Temp\libeay32.dll
C:\Users\Shri\AppData\Local\Temp\msvcr120.dll
C:\Users\Shri\AppData\Local\Temp\sqlite3.dll
C:\Users\Shri\AppData\Local\Temp\vrayuninst.dll


==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2016-06-08 16:44

==================== End of FRST.txt ============================
kri234
Active Member
 
Posts: 4
Joined: July 3rd, 2016, 10:30 pm
Advertisement
Register to Remove

Re: Adware Hijackk!!!!!!!!!!!!!!!!

Unread postby kri234 » July 4th, 2016, 11:43 pm

The addition logs:
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 02-07-2016
Ran by Shri (2016-07-04 08:01:13)
Running from C:\Users\Shri\Downloads
Windows 7 Home Premium Service Pack 1 (X64) (2016-03-10 12:41:53)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-3111129010-2965567075-23443806-500 - Administrator - Disabled)
Guest (S-1-5-21-3111129010-2965567075-23443806-501 - Limited - Disabled)
Shri (S-1-5-21-3111129010-2965567075-23443806-1000 - Administrator - Enabled) => C:\Users\Shri

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: AVG Internet Security (Enabled - Up to date) {4D41356F-32AD-7C42-C820-63775EE4F413}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: AVG Internet Security (Enabled - Up to date) {F620D48B-1497-73CC-F290-58052563BEAE}
FW: AVG Internet Security (Disabled) {757AB44A-78C2-7D1A-E37F-CA42A037B368}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

µTorrent (HKU\S-1-5-21-3111129010-2965567075-23443806-1000\...\uTorrent) (Version: 3.4.6.42094 - BitTorrent Inc.)
7-Zip 15.14 (x64) (HKLM\...\7-Zip) (Version: 15.14 - Igor Pavlov)
ACA & MEP 2016 Object Enabler (Version: 7.8.41.0 - Autodesk) Hidden
ACAD Private (Version: 20.1.49.0 - Autodesk) Hidden
Adobe Acrobat Reader DC (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}) (Version: 15.016.20045 - Adobe Systems Incorporated)
Adobe Creative Cloud (HKLM-x32\...\Adobe Creative Cloud) (Version: 3.6.0.248 - Adobe Systems Incorporated)
Adobe Flash Player 21 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 21.0.0.213 - Adobe Systems Incorporated)
Adobe Illustrator CC 2015 (HKLM-x32\...\{5680D629-B263-49CC-821E-3CEBD4507B51}) (Version: 19.0 - Adobe Systems Incorporated)
Adobe InDesign CC 2015 (HKLM-x32\...\{DBFD0312-6E55-1014-8952-E78D43BC0147}) (Version: 11.0 - Adobe Systems Incorporated)
Adobe Photoshop CC 2015 (HKLM-x32\...\{2D99B50E-431D-4AA8-85C1-172A6F8BCF01}) (Version: 16.0 - Adobe Systems Incorporated)
AutoCAD 2016 - English (Version: 20.1.49.0 - Autodesk) Hidden
AutoCAD 2016 (Version: 20.1.49.0 - Autodesk) Hidden
AutoCAD 2016 Language Pack - English (Version: 20.1.49.0 - Autodesk) Hidden
Autodesk Advanced Material Library Image Library 2016 (HKLM-x32\...\{94AD53E7-493B-4291-8714-7A3B761D2783}) (Version: 6.3.0.15 - Autodesk)
Autodesk App Manager 2016 (HKLM-x32\...\{4ECF9E00-2978-46AF-BD80-455EFEAB7A93}) (Version: 2.0.0 - Autodesk)
Autodesk Application Manager (HKLM-x32\...\Autodesk Application Manager) (Version: 4.0.69.0 - Autodesk)
Autodesk AutoCAD 2016 - English (HKLM\...\AutoCAD 2016 - English) (Version: 20.1.49.0 - Autodesk)
Autodesk AutoCAD Performance Feedback Tool 1.2.4 (HKLM-x32\...\{4E20873D-BC20-495C-AFD9-B18877B7F9BB}) (Version: 1.2.4.0 - Autodesk)
Autodesk Backburner 2016 (HKLM-x32\...\{8C5F38D2-9EFE-49A4-B3F5-BF3210FED168}) (Version: 16.0.0.0 - Autodesk)
Autodesk BIM 360 Glue AutoCAD 2016 Add-in 64 bit (HKLM\...\{4BEE127E-95C4-434D-ABAC-65155192BB24}) (Version: 4.35.1742 - Autodesk)
Autodesk Content Service (HKLM\...\Autodesk Content Service) (Version: 3.2.0.0 - Autodesk)
Autodesk Content Service (Version: 3.2.0.0 - Autodesk) Hidden
Autodesk Content Service Language Pack (Version: 3.2.0.0 - Autodesk) Hidden
Autodesk Material Library 2016 (HKLM-x32\...\{29A7D6EC-63C2-42FD-8143-5812ABD2923F}) (Version: 6.3.0.15 - Autodesk)
Autodesk Material Library Base Resolution Image Library 2016 (HKLM-x32\...\{6B4CFC6E-ECB0-47FE-95D3-65C680ED0687}) (Version: 6.3.0.15 - Autodesk)
Autodesk Material Library Medium Resolution Image Library 2016 (HKLM-x32\...\{415A5A54-325E-4815-9940-62A889CA3877}) (Version: 6.3.0.19 - Autodesk)
Autodesk Revit Interoperability for 3ds Max (Version: 16.0.394.0 - Autodesk) Hidden
AVG (HKLM\...\AvgZen) (Version: 1.72.2.24716 - AVG Technologies)
AVG (Version: 16.91.7688 - AVG Technologies) Hidden
AVG 2016 (Version: 16.0.4613 - AVG Technologies) Hidden
AVG Protection (HKLM\...\AVG) (Version: 2016.91.7688 - AVG Technologies)
AVG Zen (Version: 1.72.1 - AVG Technologies) Hidden
Brother MFL-Pro Suite DCP-1610NW series (HKLM-x32\...\{75E38F04-1BAF-4054-A059-57F831688943}) (Version: 1.0.2.0 - Brother Industries, Ltd.)
CCleaner (HKLM\...\CCleaner) (Version: 5.17 - Piriform)
Dropbox (HKLM-x32\...\Dropbox) (Version: 5.4.24 - Dropbox, Inc.)
Dropbox Update Helper (x32 Version: 1.3.41.1 - Dropbox, Inc.) Hidden
FMW 1 (Version: 1.102.4 - AVG Technologies) Hidden
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 51.0.2704.106 - Google Inc.)
Google Drive (HKLM-x32\...\{709316AD-161C-4D5C-9AE7-0B3A822DA271}) (Version: 1.30.2170.0459 - Google, Inc.)
Google Update Helper (x32 Version: 1.3.30.3 - Google Inc.) Hidden
Intel(R) C++ Redistributables on Intel(R) 64 (HKLM-x32\...\{F70BCE36-25F2-4475-A918-6209B3D85BF3}) (Version: 15.0.179 - Intel Corporation)
Intel(R) PROSet/Wireless WiFi Software (HKLM\...\{B90E5EBE-DF18-44D5-9D18-689ADEE9DA6C}) (Version: 13.01.1000 - Intel Corporation)
Intel® CCF Manager (HKLM-x32\...\{0f3d8dd5-54af-4404-a01c-4967e485a065}) (Version: 3.0.13.2211 - Intel Corporation)
KeyShot 6 64 bit (HKLM-x32\...\KeyShot 6_64) (Version: 6.2 64 bit - Luxion ApS)
Malwarebytes Anti-Malware version 2.2.1.1043 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.1.1043 - Malwarebytes)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Office 365 - en-us (HKLM\...\O365HomePremRetail - en-us) (Version: 16.0.6965.2058 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-3111129010-2965567075-23443806-1000\...\OneDriveSetup.exe) (Version: 17.3.6281.1202 - Microsoft Corporation)
Microsoft Visual Basic for Applications 7.1 (x64) (HKLM\...\{90120064-0070-0000-0000-4000000FF1CE}) (Version: 7.1.00.00 - Microsoft Corporation)
Microsoft Visual Basic for Applications 7.1 (x64) English (HKLM\...\{90F60409-7000-11D3-8CFE-0150048383C9}) (Version: 7.1.0.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6E8E85E8-CE4B-4FF5-91F7-04999C9FAE6A}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
NVIDIA Display Control Panel (HKLM\...\NVIDIA Display Control Panel) (Version: 6.14.12.5939 - NVIDIA Corporation)
NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version: 1.10.62.40 - NVIDIA Corporation)
NVIDIA Stereoscopic 3D Driver (HKLM-x32\...\NVIDIAStereo) (Version: 7.17.12.5939 - NVIDIA Corporation)
Office 16 Click-to-Run Extensibility Component (x32 Version: 16.0.6925.1018 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Licensing Component (Version: 16.0.6925.1018 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Localization Component (x32 Version: 16.0.6925.1018 - Microsoft Corporation) Hidden
SketchUp 2015 (HKLM\...\{350488A4-1540-4103-8F01-B27503891EB0}) (Version: 15.3.331 - Trimble Navigation Limited)
STCServ (Version: 3.0.0.1783 - Intel Corporation) Hidden
V-Ray for SketchUp adv (HKLM-x32\...\V-Ray for SketchUp adv 2.00.25244) (Version: 2.00.25244 - Chaos Software, Ltd)
Windows Phone app for desktop (HKLM-x32\...\{5F71448B-88EB-4357-9A98-8658D4C49C48}) (Version: 1.1.2726.0 - Microsoft Corporation)
WordWeb (HKLM-x32\...\WordWeb) (Version: 8 - WordWeb Software)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-3111129010-2965567075-23443806-1000_Classes\CLSID\{0B628DE4-07AD-4284-81CA-5B439F67C5E6}\localserver32 -> C:\Program Files\Autodesk\AutoCAD 2016\acad.exe (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-3111129010-2965567075-23443806-1000_Classes\CLSID\{149DD748-EA85-45A6-93C5-AC50D0260C98}\localserver32 -> C:\Program Files\Autodesk\AutoCAD 2016\acad.exe (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-3111129010-2965567075-23443806-1000_Classes\CLSID\{162C6FB5-44D3-435B-903D-E613FA093FB5}\InprocServer32 -> C:\Users\Shri\AppData\Local\Microsoft\OneDrive\17.3.6281.1202\amd64\FileCoAuthLib64.dll ()
CustomCLSID: HKU\S-1-5-21-3111129010-2965567075-23443806-1000_Classes\CLSID\{5370C727-1451-4700-A960-77630950AF6D}\localserver32 -> C:\Program Files\Autodesk\AutoCAD 2016\acad.exe (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-3111129010-2965567075-23443806-1000_Classes\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\localserver32 -> C:\Users\Shri\AppData\Local\Microsoft\OneDrive\17.3.6281.1202\FileCoAuth.exe (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3111129010-2965567075-23443806-1000_Classes\CLSID\{E2C40589-DE61-11ce-BAE0-0020AF6D7005}\InprocServer32 -> C:\Program Files\Autodesk\AutoCAD 2016\en-US\acadficn.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-3111129010-2965567075-23443806-1000_Classes\CLSID\{e8c77137-e224-5791-b6e9-ff0305797a13}\InprocServer32 -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll (Adobe Systems)

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {32E74443-5476-49F3-9CD0-C6CF03D25BE8} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2016-06-10] (Microsoft Corporation)
Task: {5E6C5D01-1515-4399-980C-443EFF1A0D20} - System32\Tasks\DropboxUpdateTaskMachineCore => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [2016-05-17] (Dropbox, Inc.)
Task: {62508FB5-837B-4BCB-8CB3-07855824D836} - System32\Tasks\DropboxUpdateTaskMachineUA => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [2016-05-17] (Dropbox, Inc.)
Task: {77E18E9E-989D-48B3-AC34-2595EE420783} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office16\OLicenseHeartbeat.exe
Task: {7ED60FB4-47D5-45C0-B175-5E88B74DA89A} - System32\Tasks\IntelBootstrapCCDashExe => C:\Program Files\Intel\ConnectCenter\bin\ICCLauncher.exe [2015-03-16] (Intel® Corporation)
Task: {8A9EAACB-183D-40CD-98B6-1037C4A9B58A} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2016-06-10] (Microsoft Corporation)
Task: {8AE9382B-374B-42A6-B5F6-1A69FAB1DC76} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonx86\Microsoft Shared\Office16\OLicenseHeartbeat.exe [2016-06-11] (Microsoft Corporation)
Task: {9D496D08-322B-495C-ADA0-7EDFC99C6314} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-03-10] (Google Inc.)
Task: {F575D790-4EBE-4D66-9C5F-8C10783FA80F} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2016-04-16] (Piriform Ltd)
Task: {F9A80892-2B51-4C6C-8A1C-40A6CA9563A1} - System32\Tasks\{0E28E0B4-ECB2-413F-AADD-33885A5FDEE0} => pcalua.exe -a C:\Users\Shri\Downloads\Autodesk_3ds_Max_2016\Crack\xf-adsk2016_x64.exe
Task: {FF7F80EC-D11A-4545-8DE4-E00C81A2E74F} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-03-10] (Google Inc.)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\DropboxUpdateTaskMachineCore.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
Task: C:\Windows\Tasks\DropboxUpdateTaskMachineUA.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Shortcuts =============================

(The entries could be listed to be restored or removed.)

Shortcut: C:\Users\Shri\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\KeyShot 6 64\Documentation\KeyShot Manual.lnk -> hxxp://keyshot.com/manual/keyshot6/KeyShot_6_Manual.pdf (No File)

==================== Loaded Modules (Whitelisted) ==============

2010-01-19 16:27 - 2010-01-19 16:27 - 01501696 _____ () C:\Program Files\Common Files\Intel\WirelessCommon\Libeay32.dll
2016-04-01 23:18 - 2016-04-01 23:18 - 00426160 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll
2010-01-19 16:27 - 2010-01-19 16:27 - 01501696 _____ () C:\Program Files\Common Files\Intel\WirelessCommon\LIBEAY32.dll
2015-03-16 12:58 - 2015-03-16 12:58 - 00127200 _____ () C:\Program Files\Intel\ConnectCenter\bin\Interop.STCServLib.dll
2016-05-23 13:55 - 2016-06-10 14:35 - 08919752 _____ () C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\1033\GrooveIntlResource.dll
2016-03-11 11:15 - 2014-12-05 07:57 - 00055688 _____ () C:\Program Files (x86)\Common Files\Autodesk Shared\AppManager\R1\QtSolutions_Service-head.dll
2016-03-11 11:15 - 2014-12-05 07:57 - 00104328 _____ () C:\Program Files (x86)\Common Files\Autodesk Shared\AppManager\R1\qjson0.dll
2016-03-16 14:05 - 2009-02-27 16:38 - 00139264 ____R () C:\Program Files (x86)\Brother\BrUtilities\BrLogAPI.dll
2016-03-16 14:07 - 2014-05-22 19:11 - 00954880 ____N () C:\Program Files (x86)\ControlCenter4\BrImgProc.dll
2016-07-04 07:21 - 2016-07-04 07:20 - 40500224 _____ () C:\Program Files (x86)\AVG\UiDll\2171\libcef.dll
2016-06-25 20:35 - 2016-06-23 20:38 - 01747784 _____ () C:\Program Files (x86)\Google\Chrome\Application\51.0.2704.106\libglesv2.dll
2016-06-25 20:35 - 2016-06-23 20:37 - 00093512 _____ () C:\Program Files (x86)\Google\Chrome\Application\51.0.2704.106\libegl.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

AlternateDataStreams: C:\ProgramData\Reprise:wupeogjxldtlfudivq`qsp`26hfm [0]

==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WRkrn => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WRSVC => ""="Service"

==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)

HKU\.DEFAULT\Software\Classes\exefile: "%1" %* <===== ATTENTION
HKU\.DEFAULT\Software\Classes\.exe: exefile => "%1" %* <===== ATTENTION
HKU\S-1-5-21-3111129010-2965567075-23443806-1000\Software\Classes\exefile: "%1" %* <===== ATTENTION
HKU\S-1-5-21-3111129010-2965567075-23443806-1000\Software\Classes\.exe: exefile => "%1" %* <===== ATTENTION
HKU\S-1-5-21-3111129010-2965567075-23443806-1000\Software\Classes\.scr: AutoCADScriptFile => C:\Windows\system32\notepad.exe "%1"

==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

IE trusted site: HKU\.DEFAULT\...\amazon.in -> hxxps://amazon.in
IE trusted site: HKU\S-1-5-21-3111129010-2965567075-23443806-1000\...\amazon.in -> hxxps://amazon.in
IE trusted site: HKU\S-1-5-21-3111129010-2965567075-23443806-1000\...\dell.com -> dell.com

==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 08:04 - 2009-06-11 02:30 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-3111129010-2965567075-23443806-1000\Control Panel\Desktop\\Wallpaper ->
DNS Servers: 192.168.1.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: ) (ConsentPromptBehaviorUser: ) (EnableLUA: 1)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\startupreg: AdobeAAMUpdater-1.0 => "C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"
MSCONFIG\startupreg: ADSKAppManager => "C:\Program Files (x86)\Common Files\Autodesk Shared\AppManager\R1\AdAppMgr.exe" -showminimized -checkautorun
MSCONFIG\startupreg: GoogleDriveSync => "C:\Program Files (x86)\Google\Drive\googledrivesync.exe" /autostart
MSCONFIG\startupreg: WordWeb => "D:\Programs\WordWeb\wweb32.exe" -startup

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [{522B560A-7F58-4D1D-8584-3D554DE9BA73}] => (Allow) C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe
FirewallRules: [{FED98071-569E-452D-A1F1-222A52D20BB2}] => (Allow) C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe
FirewallRules: [{F4A2FA2A-75D1-4991-BBB3-13ABEACB0830}] => (Allow) C:\Users\Shri\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{4524457A-313D-4C2F-BA20-3DAD26B8C41F}] => (Allow) C:\Users\Shri\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{09FF4E3D-37C7-40AB-9775-002A60AE8CCB}] => (Allow) C:\Users\Shri\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{DE91D7E1-9147-4E08-94CE-DE0254DABBBC}] => (Allow) C:\Users\Shri\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{31D0294A-6028-4BD3-8340-2147F853F256}] => (Allow) C:\Users\Shri\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{35283586-8E68-4F9A-A65E-12BE500EADCD}] => (Allow) C:\Users\Shri\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{4F9CCFF6-200A-4A4A-95B7-B4F49C58588F}] => (Allow) LPort=50248
FirewallRules: [TCP Query User{506126B7-CF48-4ADB-89C1-D1381D342D58}C:\program files\sketchup\sketchup 2015\sketchup.exe] => (Allow) C:\program files\sketchup\sketchup 2015\sketchup.exe
FirewallRules: [UDP Query User{6C207BB5-EE15-4D4B-A861-141AD48A1D15}C:\program files\sketchup\sketchup 2015\sketchup.exe] => (Allow) C:\program files\sketchup\sketchup 2015\sketchup.exe
FirewallRules: [TCP Query User{86B85D38-0859-42BD-B162-AC9BB3E7EC00}C:\programdata\asgvis\common\x64\vc101\distributed rendering\xmldrspawner.exe] => (Allow) C:\programdata\asgvis\common\x64\vc101\distributed rendering\xmldrspawner.exe
FirewallRules: [UDP Query User{AF218567-2164-4BA1-B3FF-73A48B3CABBC}C:\programdata\asgvis\common\x64\vc101\distributed rendering\xmldrspawner.exe] => (Allow) C:\programdata\asgvis\common\x64\vc101\distributed rendering\xmldrspawner.exe
FirewallRules: [{DF8D2D72-10F8-4AEA-9BB4-8F2AF6811258}] => (Block) C:\programdata\asgvis\common\x64\vc101\distributed rendering\xmldrspawner.exe
FirewallRules: [{4EB5B536-B522-462C-8E4E-1C6EE568112E}] => (Block) C:\programdata\asgvis\common\x64\vc101\distributed rendering\xmldrspawner.exe
FirewallRules: [{C8A31124-6654-49F8-AEF0-6AB7F90F0592}] => (Block) C:\program files\sketchup\sketchup 2015\sketchup.exe
FirewallRules: [{BCE5431A-C584-4250-BE2E-F769F318BE47}] => (Block) C:\program files\sketchup\sketchup 2015\sketchup.exe
FirewallRules: [{CF6CEE1A-447C-4A5E-9B39-1B809FC97C42}] => (Allow) C:\Program Files\Autodesk\3ds Max 2016\NVIDIA\Satellite\raysat_3dsmax2016_64server.exe
FirewallRules: [{6EC7C7F2-5EEB-4805-85E3-347767A59F8C}] => (Allow) C:\Program Files\Autodesk\3ds Max 2016\NVIDIA\Satellite\raysat_3dsmax2016_64server.exe
FirewallRules: [{0B7EA713-1173-42A6-A061-5606FE33DA43}] => (Allow) C:\Program Files\Autodesk\3ds Max 2016\NVIDIA\Satellite\raysat_3dsmax2016_64.exe
FirewallRules: [{5C968C78-10BB-4359-AF48-60D43710FEF1}] => (Allow) C:\Program Files\Autodesk\3ds Max 2016\NVIDIA\Satellite\raysat_3dsmax2016_64.exe
FirewallRules: [{AA82C2A1-735B-46C0-8843-10FD3DB0C228}] => (Allow) LPort=54925
FirewallRules: [{5384F88A-EF9C-457A-936A-B3225DB79103}] => (Allow) C:\Program Files\Chaos Group\V-Ray\3dsmax 2016 for x64\vrlservice.exe
FirewallRules: [{AE5D59C9-67B0-40A3-912D-490C96DFCF75}] => (Allow) C:\Program Files\Chaos Group\V-Ray\3dsmax 2016 for x64\vrlservice.exe
FirewallRules: [TCP Query User{D6DE3551-681A-4AC9-BA09-08E553B7DF0D}C:\program files\autodesk\3ds max 2016\3dsmax.exe] => (Allow) C:\program files\autodesk\3ds max 2016\3dsmax.exe
FirewallRules: [UDP Query User{A94EBE67-EA6C-499E-8431-5EC70F02B984}C:\program files\autodesk\3ds max 2016\3dsmax.exe] => (Allow) C:\program files\autodesk\3ds max 2016\3dsmax.exe
FirewallRules: [TCP Query User{3B6F544D-C608-4E7F-A8D1-2DA56C50125F}C:\program files\chaos group\v-ray\rt for 3ds max 2016 for x64\bin\vray.exe] => (Allow) C:\program files\chaos group\v-ray\rt for 3ds max 2016 for x64\bin\vray.exe
FirewallRules: [UDP Query User{0136852C-3E1A-411B-98D1-EF8480EB4789}C:\program files\chaos group\v-ray\rt for 3ds max 2016 for x64\bin\vray.exe] => (Allow) C:\program files\chaos group\v-ray\rt for 3ds max 2016 for x64\bin\vray.exe
FirewallRules: [TCP Query User{48FCEF18-A78D-46F3-9827-DBA31D424790}C:\program files\autodesk\3ds max 2016\3dsmax.exe] => (Allow) C:\program files\autodesk\3ds max 2016\3dsmax.exe
FirewallRules: [UDP Query User{FF21F43D-3DF1-4B9D-9CAB-2378677ED68F}C:\program files\autodesk\3ds max 2016\3dsmax.exe] => (Allow) C:\program files\autodesk\3ds max 2016\3dsmax.exe
FirewallRules: [TCP Query User{244BBB36-778F-4053-A076-54F7AE38BC9F}C:\program files\chaos group\v-ray\rt for 3ds max 2016 for x64\bin\vray.exe] => (Allow) C:\program files\chaos group\v-ray\rt for 3ds max 2016 for x64\bin\vray.exe
FirewallRules: [UDP Query User{DDBB790E-87A4-4794-83AE-699B350F5C0C}C:\program files\chaos group\v-ray\rt for 3ds max 2016 for x64\bin\vray.exe] => (Allow) C:\program files\chaos group\v-ray\rt for 3ds max 2016 for x64\bin\vray.exe
FirewallRules: [TCP Query User{50F801D4-4BF9-44DA-B5E1-265663074311}G:\easysetupassistant\easysetupassistant.exe] => (Allow) G:\easysetupassistant\easysetupassistant.exe
FirewallRules: [UDP Query User{37BA9E50-6AC9-42A6-A98C-A8C1AF42806F}G:\easysetupassistant\easysetupassistant.exe] => (Allow) G:\easysetupassistant\easysetupassistant.exe
FirewallRules: [TCP Query User{A8DAF890-72E9-42DA-9256-4BFFE1E03B28}G:\easysetupassistant\tssh2.exe] => (Allow) G:\easysetupassistant\tssh2.exe
FirewallRules: [UDP Query User{F46EB4F8-7B12-43A7-82CA-BA9B44215A3B}G:\easysetupassistant\tssh2.exe] => (Allow) G:\easysetupassistant\tssh2.exe
FirewallRules: [{642A7181-3622-48E6-BE70-E818EB2E738D}] => (Allow) C:\Program Files\Intel\STCServ\STCServ.exe
FirewallRules: [{2139AD96-113D-4C23-AFA7-834AB84299C5}] => (Allow) C:\Program Files\Intel\STCServ\STCServ.exe
FirewallRules: [{7E1EA4F4-C4E1-4A38-8452-E7BAF6C5ECA8}] => (Allow) C:\Program Files\Intel\STCServ\STCServ.exe
FirewallRules: [{B3A51944-57D4-454E-BA26-7E1DFF943D68}] => (Allow) LPort=475
FirewallRules: [{F35669E2-DB60-4510-BD57-126D2A641F3D}] => (Allow) LPort=475
FirewallRules: [{09B461BE-F756-4459-989E-4289AB26FB04}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\outlook.exe
FirewallRules: [{B4564C13-241C-4EB2-849C-14E25C9925FA}] => (Allow) D:\Programs\KeyShot6\bin\keyshot6.exe
FirewallRules: [{683D97FE-863A-4EFE-BBA7-DD21CDEEC372}] => (Allow) D:\Programs\KeyShot6\bin\keyshot_daemon.exe
FirewallRules: [{2B046FA0-2C1B-4DA9-A8C3-18878E9AF088}] => (Allow) C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
FirewallRules: [{AF206EDB-8D66-4766-8E20-C1AA7C26B359}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
FirewallRules: [{26BDC575-84E4-44EA-BC7F-12A38BBB06F5}] => (Allow) C:\Program Files (x86)\AVG\Av\avgnsa.exe
FirewallRules: [{7AECE4EF-AF6C-49E3-91D9-987AC6906264}] => (Allow) C:\Program Files (x86)\AVG\Av\avgnsa.exe
FirewallRules: [{EF144DFA-FD66-47A0-8529-3F33B20F39BB}] => (Allow) C:\Program Files (x86)\AVG\Av\avgdiagex.exe
FirewallRules: [{F3DD6123-8C11-47D3-B978-230D3BACA8FA}] => (Allow) C:\Program Files (x86)\AVG\Av\avgdiagex.exe
FirewallRules: [{73248D89-E6A7-483F-8307-7D09A8E037D2}] => (Allow) C:\Program Files (x86)\AVG\Av\avgmfapx.exe
FirewallRules: [{F18AE8AE-8FAF-45C0-97FF-16F7A177A353}] => (Allow) C:\Program Files (x86)\AVG\Av\avgmfapx.exe
FirewallRules: [{B2850CEF-8FBA-4E3C-8443-61EB33BEE9A1}] => (Allow) C:\Program Files (x86)\AVG\Av\avgemca.exe
FirewallRules: [{BFC48392-6240-4338-9D06-0AB17BE638BD}] => (Allow) C:\Program Files (x86)\AVG\Av\avgemca.exe

==================== Restore Points =========================

25-06-2016 14:01:14 Windows Update
29-06-2016 10:29:01 Windows Update
30-06-2016 00:03:50 Installed Windows Phone app for desktop
02-07-2016 21:30:37 Windows Update
03-07-2016 07:50:15 Removed Autodesk Inventor Server Engine for 3ds Max 2016.
03-07-2016 08:30:49 Removed OpenOffice 4.1.2
03-07-2016 10:44:49 Removed Autodesk Civil View for 3ds Max 2016 64-bit.
03-07-2016 23:29:22 Windows Backup
04-07-2016 05:04:21 Removed Java 8 Update 91
04-07-2016 05:24:13 Checkpoint by HitmanPro
04-07-2016 05:41:18 Checkpoint by HitmanPro
04-07-2016 07:18:00 Windows Driver Kit - Windows 10.0.10586.0
04-07-2016 07:23:20 Removed Visual Studio 2012 x64 Redistributables
04-07-2016 07:24:56 Removed Visual Studio 2012 x86 Redistributables
04-07-2016 07:28:45 Installed AVG 2016
04-07-2016 07:29:21 Installed AVG

==================== Faulty Device Manager Devices =============

Name: Base System Device
Description: Base System Device
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Base System Device
Description: Base System Device
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Base System Device
Description: Base System Device
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name:
Description:
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (07/04/2016 05:48:01 AM) (Source: Autodesk Content Service) (EventID: 0) (User: )
Description: Service cannot be started. System.IO.FileNotFoundException: no segments* file found in Lucene.Net.Store.SimpleFSDirectory@C:\ProgramData\Autodesk\Content Service\Server\index\: files: write.lock _0.cfs _1.cfs _2.cfs
at Lucene.Net.Index.IndexWriter.Init(Directory d, Analyzer a, Boolean create, Boolean closeDir, IndexDeletionPolicy deletionPolicy, Boolean autoCommit, Int32 maxFieldLength, IndexingChain indexingChain, IndexCommit commit)
at Lucene.Net.Index.IndexWriter..ctor(Directory d, Analyzer a, Boolean create, MaxFieldLength mfl)
at Connect.Indexing.Lucene.LuceneFactory..ctor(FSDirectory fds, Boolean exists, Dictionary`2 properties)
at Connect.Indexing.Lucene.LuceneIndexer.Initialize(Dictionary`2 properties)
at Connect.Indexing.Indexer.LoadIndexer()
at Connect.Indexing.Indexer.Initialize()
at Connect.IVault.IVault.OnStart(String[] args)
at System.ServiceProcess.ServiceBase.ServiceQueuedMainCallback(Object state)

Error: (07/04/2016 05:42:39 AM) (Source: VSS) (EventID: 8193) (User: )
Description: Volume Shadow Copy Service error: Unexpected error calling routine RegSetValueExW(0x00000224,SYSTEM\CurrentControlSet\Services\VSS\Diag\VssvcPublisher,0,REG_BINARY,00000000018EF140.72). hr = 0x80070005, Access is denied.
.

Error: (07/04/2016 05:42:39 AM) (Source: VSS) (EventID: 8193) (User: )
Description: Volume Shadow Copy Service error: Unexpected error calling routine RegSetValueExW(0x0000081c,(null),0,REG_BINARY,00000000028DE150.72). hr = 0x80070005, Access is denied.
.


Operation:
BackupShutdown Event

Context:
Execution Context: Writer
Writer Class Id: {a6ad56c2-b509-4e6c-bb19-49d8f43532f0}
Writer Name: WMI Writer
Writer Instance ID: {fe683bdf-92db-4d2b-960a-443153d45720}

Error: (07/04/2016 05:42:39 AM) (Source: VSS) (EventID: 8193) (User: )
Description: Volume Shadow Copy Service error: Unexpected error calling routine RegSetValueExW(0x00000498,(null),0,REG_BINARY,0000000001E0E440.72). hr = 0x80070005, Access is denied.
.


Operation:
BackupShutdown Event

Context:
Execution Context: Writer
Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
Writer Name: System Writer
Writer Instance ID: {a2f19e3c-9351-4b77-a20e-a6915a17931a}

Error: (07/04/2016 05:42:39 AM) (Source: VSS) (EventID: 8193) (User: )
Description: Volume Shadow Copy Service error: Unexpected error calling routine RegSetValueExW(0x00000ca0,(null),0,REG_BINARY,0000000008B7E400.72). hr = 0x80070005, Access is denied.
.


Operation:
BackupShutdown Event

Context:
Execution Context: Writer
Writer Class Id: {cd3f2362-8bef-46c7-9181-d62844cdc0b2}
Writer Name: MSSearch Service Writer
Writer Instance ID: {70c11c1c-d2ba-466d-a7cd-afda491a8325}

Error: (07/04/2016 05:42:39 AM) (Source: VSS) (EventID: 8193) (User: )
Description: Volume Shadow Copy Service error: Unexpected error calling routine RegSetValueExW(0x000001d4,SYSTEM\CurrentControlSet\Services\VSS\Diag\Registry Writer,0,REG_BINARY,000000000271E840.72). hr = 0x80070005, Access is denied.
.


Operation:
BackupShutdown Event

Context:
Execution Context: Writer
Writer Class Id: {afbab4a2-367d-4d15-a586-71dbb18f8485}
Writer Name: Registry Writer
Writer Instance ID: {217e1e4f-3ba9-4d98-a216-48842070c82e}

Error: (07/04/2016 05:42:39 AM) (Source: VSS) (EventID: 8193) (User: )
Description: Volume Shadow Copy Service error: Unexpected error calling routine RegSetValueExW(0x0000081c,(null),0,REG_BINARY,00000000028DE150.72). hr = 0x80070005, Access is denied.
.


Operation:
BackupShutdown Event

Context:
Execution Context: Writer
Writer Class Id: {a6ad56c2-b509-4e6c-bb19-49d8f43532f0}
Writer Name: WMI Writer
Writer Instance ID: {fe683bdf-92db-4d2b-960a-443153d45720}

Error: (07/04/2016 05:42:39 AM) (Source: VSS) (EventID: 8193) (User: )
Description: Volume Shadow Copy Service error: Unexpected error calling routine RegSetValueExW(0x00000498,(null),0,REG_BINARY,0000000001E0E440.72). hr = 0x80070005, Access is denied.
.


Operation:
BackupShutdown Event

Context:
Execution Context: Writer
Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
Writer Name: System Writer
Writer Instance ID: {a2f19e3c-9351-4b77-a20e-a6915a17931a}

Error: (07/04/2016 05:42:39 AM) (Source: VSS) (EventID: 8193) (User: )
Description: Volume Shadow Copy Service error: Unexpected error calling routine RegSetValueExW(0x00000ca0,(null),0,REG_BINARY,0000000008B7E400.72). hr = 0x80070005, Access is denied.
.


Operation:
BackupShutdown Event

Context:
Execution Context: Writer
Writer Class Id: {cd3f2362-8bef-46c7-9181-d62844cdc0b2}
Writer Name: MSSearch Service Writer
Writer Instance ID: {70c11c1c-d2ba-466d-a7cd-afda491a8325}

Error: (07/04/2016 05:42:39 AM) (Source: VSS) (EventID: 8193) (User: )
Description: Volume Shadow Copy Service error: Unexpected error calling routine RegSetValueExW(0x00000210,SYSTEM\CurrentControlSet\Services\VSS\Diag\Shadow Copy Optimization Writer,0,REG_BINARY,00000000024EEC30.72). hr = 0x80070005, Access is denied.
.


Operation:
BackupShutdown Event

Context:
Execution Context: Writer
Writer Class Id: {4dc3bdd4-ab48-4d07-adb0-3bee2926fd7f}
Writer Name: Shadow Copy Optimization Writer
Writer Instance ID: {684f02bf-bfab-4dc3-b0f9-2e2bbe3c2aa8}


System errors:
=============
Error: (07/04/2016 05:47:33 AM) (Source: Service Control Manager) (EventID: 7024) (User: )
Description: The HitmanPro 3.7 Crusader (Boot) service terminated with service-specific error %%0 = The operation completed successfully.
.

Error: (07/04/2016 04:43:34 AM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT AUTHORITY)
Description: WLAN Extensibility Module has stopped unexpectedly.

Module Path: C:\Windows\System32\IWMSSvc.dll

Error: (07/04/2016 04:43:34 AM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT AUTHORITY)
Description: WLAN Extensibility Module has stopped unexpectedly.

Module Path: C:\Windows\System32\IWMSSvc.dll

Error: (07/04/2016 04:43:33 AM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT AUTHORITY)
Description: WLAN Extensibility Module has stopped unexpectedly.

Module Path: C:\Windows\System32\IWMSSvc.dll

Error: (07/04/2016 04:43:27 AM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT AUTHORITY)
Description: WLAN Extensibility Module has stopped unexpectedly.

Module Path: C:\Windows\System32\IWMSSvc.dll

Error: (07/04/2016 04:42:19 AM) (Source: Service Control Manager) (EventID: 7032) (User: )
Description: The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Windows Search service, but this action failed with the following error:
%%1056 = An instance of the service is already running.


Error: (07/04/2016 04:41:50 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Windows Media Player Network Sharing Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 30000 milliseconds: Restart the service.

Error: (07/04/2016 04:41:50 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The Intel(R) Common Connectivity Framework service terminated unexpectedly. It has done this 1 time(s).

Error: (07/04/2016 04:41:49 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Windows Search service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 30000 milliseconds: Restart the service.

Error: (07/04/2016 04:41:49 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The BrYNSvc service terminated unexpectedly. It has done this 1 time(s).


CodeIntegrity:
===================================
Date: 2016-05-04 23:27:10.529
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\hardlock.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2016-05-04 23:27:10.404
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\hardlock.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2016-05-04 13:10:05.084
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\hardlock.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2016-05-04 13:10:05.012
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\hardlock.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.


==================== Memory info ===========================

Processor: Intel(R) Core(TM) i7 CPU Q 740 @ 1.73GHz
Percentage of memory in use: 76%
Total physical RAM: 4030.55 MB
Available physical RAM: 957.27 MB
Total Virtual: 8059.28 MB
Available Virtual: 4372.36 MB

==================== Drives ================================

Drive c: (Targaryan ) (Fixed) (Total:230.84 GB) (Free:163.44 GB) NTFS
Drive d: (Stark) (Fixed) (Total:227.3 GB) (Free:182.23 GB) NTFS
Drive e: (System Reserved) (Fixed) (Total:0.1 GB) (Free:0.03 GB) NTFS ==>[system with boot components (obtained from drive)]
Drive f: (RECOVERY) (Fixed) (Total:7.52 GB) (Free:3.64 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 3625173E)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=230.8 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=227.3 GB) - (Type=OF Extended)
Partition 4: (Not Active) - (Size=7.5 GB) - (Type=07 NTFS)

==================== End of Addition.txt ============================
kri234
Active Member
 
Posts: 4
Joined: July 3rd, 2016, 10:30 pm

Re: Adware Hijackk!!!!!!!!!!!!!!!!

Unread postby pgmigg » July 5th, 2016, 12:21 am

By posting your 2 logs separately you have effectively Replied to Your Own Topic

May I draw your attention to the topic: ALL USERS OF THIS FORUM MUST READ THIS FIRST, which you should have read before posting for help.

The section here explains why you should not reply to your topic before a helper replies.

Please start a new topic with just a single post, and this time attach your logs, then wait for a helper to reply. Thank you for your understanding.

This topic is now closed.
User avatar
pgmigg
Admin/Teacher
Admin/Teacher
 
Posts: 5457
Joined: July 8th, 2008, 1:25 pm
Location: GMT-05:00


  • Similar Topics
    Replies
    Views
    Last post

Return to Infected? Virus, malware, adware, ransomware, oh my!



Who is online

Users browsing this forum: No registered users and 144 guests

Contact us:

Advertisements do not imply our endorsement of that product or service. Register to remove all ads. The forum is run by volunteers who donate their time and expertise. We make every attempt to ensure that the help and advice posted is accurate and will not cause harm to your computer. However, we do not guarantee that they are accurate and they are to be used at your own risk. All trademarks are the property of their respective owners.

Member site: UNITE Against Malware