-
Mbam scan results
Hi 545,
I guess I don't have to worry now.:thanks:
Thanks "from the bottom of my heart" as the saying goes.
Really thank you.
And here we say
SHALOM
laksi - Yaakov Laks - Arad, Israel
Malwarebytes Anti-Malware
www.malwarebytes.org
Scan Date: 13/10/2014
Scan Time: 22:44:11
Logfile:
Administrator: Yes
Version: 2.00.3.1025
Malware Database: v2014.10.13.07
Rootkit Database: v2014.10.11.01
License: Trial
Malware Protection: Enabled
Malicious Website Protection: Enabled
Self-protection: Disabled
OS: Windows 7 Service Pack 1
CPU: x86
File System: NTFS
User: Yaakov Laks
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 315942
Time Elapsed: 1 hr, 1 min, 25 sec
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled
Processes: 0
(No malicious items detected)
Modules: 0
(No malicious items detected)
Registry Keys: 0
(No malicious items detected)
Registry Values: 0
(No malicious items detected)
Registry Data: 0
(No malicious items detected)
Folders: 0
(No malicious items detected)
Files: 0
(No malicious items detected)
Physical Sectors: 0
(No malicious items detected)
(end)
-
Shalom Yaakov
Did you ever uninstall IObit ?
Why don't you go ahead and run a new scan with FRST , be sure to checkmark Additions, post both new logs please and let me take one final look
-
uninstall iobit
Shalom Ken,
I uninstalled iobit alright, but I'll run a search on the registry and wipe off any remains.
Shalom, yours
laksi
-
If you post a new FRST log along with the Additions I can help you remove leftovers if we find them
-
2 Attachment(s)
frst scan results logs
Shalom Ken,
Logs are attached,
thanks
laksi
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 15-10-2014 02
Ran by Yaakov Laks (administrator) on LAPTOSH-PC on 16-10-2014 08:42:56
Running from E:\F\Downloads\DLSoftware 15\SpyBot
Loaded Profile: Yaakov Laks (Available profiles: Yaakov Laks)
Platform: Microsoft Windows 7 Home Premium Service Pack 1 (X86) OS Language: English (United States)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic...ery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(IObit) C:\Program Files\IObit\Advanced SystemCare 7\ASCService.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(Microsoft Corporation) C:\Program Files\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Brio) D:\Program Files\1Utils\Folder Size\FolderSizeSvc.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
(Giraffic) C:\Program Files\Giraffic\GirafficWatchdog.exe
(Malwarebytes Corporation) D:\Program Files\1AntiVandals\Malwarebytes Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) D:\Program Files\1AntiVandals\Malwarebytes Anti-Malware\mbamservice.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\VS7DEBUG\mdm.exe
(Giraffic) C:\Program Files\Giraffic\Giraffic.exe
(Secunia) C:\Program Files\Secunia\PSI\psia.exe
(Secunia) C:\Program Files\Secunia\PSI\sua.exe
(Toshiba Europe GmbH) D:\Program Files\1Maint\Toshiba TEMPRO\TemproSvc.exe
(TOSHIBA Corporation) D:\Program Files\TOSHIBA\TOSHIBA DVD PLAYER\TNaviSrv.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Safer-Networking Ltd.) D:\Program Files\1AntiVandals\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(Safer-Networking Ltd.) D:\Program Files\1AntiVandals\Spybot - Search & Destroy 2\SDWSCSvc.exe
(StorageCraft Technology Corporation) D:\Program Files\1Maint\StorageCraft\vsnapvss.exe
(Safer-Networking Ltd.) D:\Program Files\1AntiVandals\Spybot - Search & Destroy 2\SDFSSvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Malwarebytes Corporation) D:\Program Files\1AntiVandals\Malwarebytes Anti-Malware\mbam.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(IObit) C:\Program Files\IObit\Smart Defrag 3\SmartDefrag.exe
(Safer-Networking Ltd.) D:\Program Files\1AntiVandals\Spybot - Search & Destroy 2\SDTray.exe
(Chicony) C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe
() C:\Program Files\Hosts_Anti_Adwares_PUPs\HOSTS_Anti-Adware_main.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Google Inc.) C:\Program Files\Google\Update\1.3.24.15\GoogleCrashHandler.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Nokia) C:\Program Files\Nokia\Nokia Suite\NokiaSuite.exe
(Akamai Technologies, Inc.) C:\Users\Yaakov Laks\AppData\Local\Akamai\netsession_win.exe
() C:\Program Files\G9G11_ScreenCapture\ScreenCapture.exe
(Akamai Technologies, Inc.) C:\Users\Yaakov Laks\AppData\Local\Akamai\netsession_win.exe
(Secunia) C:\Program Files\Secunia\PSI\psi_tray.exe
(Firetrust Ltd) D:\Program Files\1AntiVandals\MailWasher Pro654\MailWasher Pro\MailWasher.exe
(Piriform Ltd) D:\Program Files\1Maint\ccleaner\CCleaner.exe
(LSI Corporation) C:\Program Files\LSI SoftModem\agrsmsvc.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(Nokia) C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
(Nokia) C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
(Nokia) C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe
(Privacyware/PWI, Inc.) D:\Program Files\1AntiVandals\private firewall\pfsvc.exe
(Privacyware/PWI, Inc.) D:\Program Files\1AntiVandals\private firewall\PFGUI.exe
(Microsoft Corporation) C:\Program Files\Windows Live\Mail\wlmail.exe
(Microsoft Corporation) C:\Program Files\Windows Live\Contacts\wlcomm.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\WINWORD.EXE
(StorageCraft Technology Corporation) D:\Program Files\1Maint\StorageCraft\ShadowProtect.exe
(StorageCraft Technology Corporation) D:\Program Files\1Maint\StorageCraft\ShadowProtectSvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Games\FreeCell\FreeCell.exe
(Mozilla Corporation) D:\Program Files\Firefox\firefox.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [974432 2014-08-22] (Microsoft Corporation)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1348904 2008-08-14] (Synaptics, Inc.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [12021464 2014-07-21] (Realtek Semiconductor)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKLM\...\Run: [SDTray] => D:\Program Files\1AntiVandals\Spybot - Search & Destroy 2\SDTray.exe [5624784 2013-07-25] (Safer-Networking Ltd.)
HKLM\...\Run: [Camera Assistant Software] => C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe [417792 2009-04-10] (Chicony)
HKLM\...\Run: [HOSTS Anti-Adware_PUPs] => C:\Program Files\Hosts_Anti_Adwares_PUPs\HOSTS_Anti-Adware_main.exe [302961 2013-10-07] ()
HKLM\...\Run: [] => [X]
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [256896 2014-07-25] (Oracle Corporation)
HKLM\...\Run: [Privatefirewall] => D:\Program Files\1AntiVandals\private firewall\PFGUI.exe [3048480 2013-12-17] (Privacyware/PWI, Inc.)
Winlogon\Notify\SDWinLogon: SDWinLogon.dll [X]
HKU\S-1-5-21-2920106312-904050420-1618604034-1001\...\Run: [] => [X]
HKU\S-1-5-21-2920106312-904050420-1618604034-1001\...\Run: [NokiaSuite.exe] => C:\Program Files\Nokia\Nokia Suite\NokiaSuite.exe [1090912 2013-10-02] (Nokia)
HKU\S-1-5-21-2920106312-904050420-1618604034-1001\...\Run: [Akamai NetSession Interface] => C:\Users\Yaakov Laks\AppData\Local\Akamai\netsession_win.exe [4672920 2014-04-17] (Akamai Technologies, Inc.)
HKU\S-1-5-21-2920106312-904050420-1618604034-1001\...\Run: [OscarEditor] => C:\Program Files\G9G11_ScreenCapture\ScreenCapture.exe [3538944 2012-05-18] ()
HKU\S-1-5-21-2920106312-904050420-1618604034-1001\...\Run: [CCleaner Monitoring] => D:\Program Files\1Maint\ccleaner\CCleaner.exe [4811032 2014-09-26] (Piriform Ltd)
HKU\S-1-5-21-2920106312-904050420-1618604034-1001\...\Policies\Explorer: [NoFavoritesMenu] 1
HKU\S-1-5-18\...\Run: [Advanced SystemCare 7] => C:\Program Files\IObit\Advanced SystemCare 7\ASCTray.exe [2295584 2014-04-21] (IObit)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk
ShortcutTarget: Secunia PSI Tray.lnk -> C:\Program Files\Secunia\PSI\psi_tray.exe (Secunia)
Startup: C:\Users\Yaakov Laks\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MailWasherPro.lnk
ShortcutTarget: MailWasherPro.lnk -> D:\Program Files\1AntiVandals\MailWasher Pro654\MailWasher Pro\MailWasher.exe (Firetrust Ltd)
ShellIconOverlayIdentifiers: [GDriveBlacklistedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42} => C:\Program Files\Google\Drive\googledrivesync32.dll (Google)
ShellIconOverlayIdentifiers: [GDriveSharedEditOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} => C:\Program Files\Google\Drive\googledrivesync32.dll (Google)
ShellIconOverlayIdentifiers: [GDriveSharedViewOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43} => C:\Program Files\Google\Drive\googledrivesync32.dll (Google)
ShellIconOverlayIdentifiers: [GDriveSyncedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40} => C:\Program Files\Google\Drive\googledrivesync32.dll (Google)
ShellIconOverlayIdentifiers: [GDriveSyncingOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41} => C:\Program Files\Google\Drive\googledrivesync32.dll (Google)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = he-IL
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x4C67C112E0E3CF01
SearchScopes: HKCU - {7DAAAB92-E210-43F8-AA79-83FD3E90890A} URL = http://search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=902615&p={searchTerms}
BHO: ExplorerWnd Helper -> {10921475-03CE-4E04-90CE-E2E7EF20C814} -> D:\Program Files\1Maint\IObit Uninstaller\UninstallExplorer32.dll No File
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Ads Removal -> {9D974C8C-6D92-44FB-BEAF-B45A1C0CF17F} -> C:\Program Files\IObit\IObit Malware Fighter\adsremoval\IE\Adblock.dll (Adblock)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files\Belarc\Advisor\System\BAVoilaX.dll (Belarc, Inc.)
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 80.179.52.100 80.179.55.100
FireFox:
========
FF ProfilePath: C:\Users\Yaakov Laks\AppData\Roaming\Mozilla\Firefox\Profiles\9l7tyrid.default-1405248970516
FF Homepage: about:home
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
FF Plugin: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw_1213153.dll (Adobe Systems, Inc.)
FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/VirtualEarth3D,version=4.0 -> C:\Program Files\Virtual Earth 3D\ ()
FF Plugin: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @nokia.com/EnablerPlugin -> C:\Program Files\Nokia\Nokia Suite\npNokiaSuiteEnabler.dll ( )
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.0.8 -> D:\Program Files\1Viewers\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.2 -> D:\Program Files\1Viewers\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.3 -> D:\Program Files\1Viewers\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.5 -> D:\Program Files\1Viewers\VLC\npvlc.dll (VideoLAN)
FF Plugin: Adobe Reader -> D:\Program Files\Adobe\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Yaakov Laks\AppData\Roaming\Mozilla\Firefox\Profiles\9l7tyrid.default-1405248970516\searchplugins\nana10-customized-web-search.xml
FF Extension: Ads Removal - C:\Users\Yaakov Laks\AppData\Roaming\Mozilla\Firefox\Profiles\9l7tyrid.default-1405248970516\Extensions\adremoveext@adremoveext.net [2014-08-25]
FF Extension: Adblock Plus - C:\Users\Yaakov Laks\AppData\Roaming\Mozilla\Firefox\Profiles\9l7tyrid.default-1405248970516\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-08-21]
FF StartMenuInternet: FIREFOX.EXE - D:\Program Files\Firefox\firefox.exe
Chrome:
=======
CHR HomePage: Default ->
CHR StartupUrls: Default -> ""
CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:inputType}{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}{google:searchVersion}{google:sessionToken}{google:prefetchQuery}sugkey={google:suggestAPIKeyParameter}
CHR Profile: C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-09-08]
CHR Extension: (כונן Google) - C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-09-08]
CHR Extension: (Advanced SystemCare Surfing Protection) - C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Default\Extensions\bbmegnmpleoagolcnjnejdacakedpcgd [2014-03-20]
CHR Extension: (YouTube) - C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-09-08]
CHR Extension: (חיפוש Google) - C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-09-08]
CHR Extension: (AD Block) - C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Default\Extensions\lfgjbmhakaffflkjecineeaadpidgikb [2014-01-15]
CHR Extension: (Advanced SystemCare Surfing Protection) - C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Default\Extensions\nfengeggddojhakldhlpjdlddgkkjkdd [2014-03-20]
CHR Extension: (תוספת RSS Subscription (מאת Google)) - C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Default\Extensions\nlbjncdgjeocebhnmkbbbdekmmmcbfjd [2014-03-09]
CHR Extension: (Google Wallet) - C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-08]
CHR Extension: (Gmail) - C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-09-08]
CHR Profile: C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Profile 1
CHR Extension: (Google Docs) - C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\aohghmighlieiainnegkcijnfilokake [2014-05-24]
CHR Extension: (Google Drive) - C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-05-24]
CHR Extension: (YouTube) - C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-05-24]
CHR Extension: (Google Search) - C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-05-24]
CHR Extension: (Advanced SystemCare Surfing Protection) - C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\nfengeggddojhakldhlpjdlddgkkjkdd [2014-05-24]
CHR Extension: (Google Wallet) - C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-05-24]
CHR Extension: (No Name) - C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\okemjkdkkihnhdaanohnleknbaddlddb [2014-10-03]
CHR Extension: (Gmail) - C:\Users\Yaakov Laks\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-05-24]
CHR HKLM\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2014-07-14]
CHR HKLM\...\Chrome\Extension: [nfengeggddojhakldhlpjdlddgkkjkdd] - C:\Program Files\IObit\Surfing Protection\BrowerProtect\ASC_GhromePlugin.crx [2014-07-14]
========================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 AdvancedSystemCareService7; C:\Program Files\IObit\Advanced SystemCare 7\ASCService.exe [881952 2014-01-14] (IObit)
R2 AgereModemAudio; C:\Program Files\LSI SoftModem\agrsmsvc.exe [14336 2000-01-01] (LSI Corporation)
R2 c2cautoupdatesvc; C:\Program Files\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)
R2 FolderSize; D:\Program Files\1Utils\Folder Size\FolderSizeSvc.exe [116224 2010-04-06] (Brio) [File not signed]
R2 Giraffic; C:\Program Files\Giraffic\GirafficWatchdog.exe [2245232 2013-05-13] (Giraffic)
S2 HOSTS Anti-PUPs; C:\Program Files\Hosts_Anti_Adwares_PUPs\HOSTS_Anti-Adware.exe [285795 2013-10-07] () [File not signed]
S2 LiveUpdateSvc; C:\Program Files\IObit\LiveUpdate\LiveUpdate.exe [2152736 2014-05-04] (IObit)
R2 MBAMScheduler; D:\Program Files\1AntiVandals\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2014-10-01] (Malwarebytes Corporation)
R2 MBAMService; D:\Program Files\1AntiVandals\Malwarebytes Anti-Malware\mbamservice.exe [968504 2014-10-01] (Malwarebytes Corporation)
R2 MDM; C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe [335872 2006-10-26] (Microsoft Corporation) [File not signed]
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [22192 2014-08-22] (Microsoft Corporation)
R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [288120 2014-08-22] (Microsoft Corporation)
R2 PFNet; D:\Program Files\1AntiVandals\private firewall\pfsvc.exe [374600 2013-12-17] (Privacyware/PWI, Inc.)
R2 SDScannerService; D:\Program Files\1AntiVandals\Spybot - Search & Destroy 2\SDFSSvc.exe [1817560 2013-05-16] (Safer-Networking Ltd.)
R2 SDUpdateService; D:\Program Files\1AntiVandals\Spybot - Search & Destroy 2\SDUpdSvc.exe [1033688 2013-05-16] (Safer-Networking Ltd.)
R2 SDWSCService; D:\Program Files\1AntiVandals\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2013-05-15] (Safer-Networking Ltd.)
R2 Secunia PSI Agent; C:\Program Files\Secunia\PSI\PSIA.exe [1228504 2013-07-03] (Secunia)
R2 Secunia Update Agent; C:\Program Files\Secunia\PSI\sua.exe [660184 2013-07-03] (Secunia)
S2 ShadowProtectSvc; D:\Program Files\1Maint\StorageCraft\ShadowProtectSvc.exe [4672336 2014-10-12] (StorageCraft Technology Corporation)
R2 TemproMonitoringService; D:\Program Files\1Maint\Toshiba TEMPRO\TemproSvc.exe [112080 2011-02-10] (Toshiba Europe GmbH)
R2 TNaviSrv; D:\Program Files\TOSHIBA\TOSHIBA DVD PLAYER\TNaviSrv.exe [83312 2008-07-18] (TOSHIBA Corporation)
R2 VSNAPVSS; D:\Program Files\1Maint\StorageCraft\vsnapvss.exe [71976 2014-10-12] (StorageCraft Technology Corporation)
S2 HPSLPSVC; C:\Users\Yaakov Laks\AppData\Local\Temp\7zS669C\hpslpsvc32.dll [X]
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R1 Amfilter; C:\Windows\System32\DRIVERS\Amfilter.sys [8704 2009-08-27] (A4Tech Co.,Ltd.) [File not signed]
S3 Amusbprt; C:\Windows\System32\DRIVERS\Amusbprt.sys [14336 2009-08-27] (A4Tech Co.,Ltd.) [File not signed]
R3 athr; C:\Windows\System32\DRIVERS\athr.sys [3234304 2014-07-22] (Qualcomm Atheros Communications, Inc.)
S3 BroadcomWModem; C:\Windows\System32\DRIVERS\bcmww.sys [118400 2005-06-02] (Broadcom Corporation)
S3 BroadcomWWNIC; C:\Windows\System32\DRIVERS\bcmwwNet.sys [58496 2005-02-09] (Broadcom Corporation)
R0 giveio; C:\Windows\System32\giveio.sys [5248 1996-04-03] () [File not signed]
S3 IT9135BDA; C:\Windows\System32\Drivers\IT9135BDA.sys [123008 2010-12-19] (ITE )
R3 KeyScrambler; C:\Windows\System32\drivers\keyscrambler.sys [209016 2013-05-31] (QFX Software Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2014-10-01] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [114904 2014-10-16] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2014-10-01] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [231800 2014-07-17] (Microsoft Corporation)
R2 PfFilter; C:\Program Files\IObit\Protected Folder\pffilter.sys [34336 2013-04-03] (IObit Information Technology)
S3 PSI; C:\Windows\System32\DRIVERS\psi_mf_x86.sys [16024 2013-07-03] (Secunia)
R1 pwipf6; C:\Windows\System32\DRIVERS\pwipf6.sys [130568 2013-09-29] (Privacyware/PWI, Inc.)
S3 RTHDMIAzAudService; C:\Windows\System32\drivers\RtHDMIV.sys [141408 2008-02-27] (Realtek Semiconductor Corp.)
R3 rusb3hub; C:\Windows\System32\DRIVERS\rusb3hub.sys [91016 2012-08-27] (Renesas Electronics Corporation)
R3 rusb3xhc; C:\Windows\System32\DRIVERS\rusb3xhc.sys [181128 2012-08-27] (Renesas Electronics Corporation)
R0 SmartDefragDriver; C:\Windows\System32\Drivers\SmartDefragDriver.sys [18624 2014-06-04] (IObit)
R3 SmbDrvI; C:\Windows\System32\DRIVERS\Smb_driver_Intel.sys [27888 2014-01-26] (Synaptics Incorporated)
R0 speedfan; C:\Windows\System32\speedfan.sys [24184 2012-12-29] (Almico Software)
S3 SWDUMon; C:\Windows\System32\DRIVERS\SWDUMon.sys [13464 2014-08-13] ()
R3 UVCFTR; C:\Windows\System32\Drivers\UVCFTR_S.SYS [17960 2009-04-10] (Chicony Electronics Co., Ltd.)
S1 BAPIDRV; system32\DRIVERS\BAPIDRV.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-10-15 19:35 - 2014-10-15 19:35 - 00025600 ____C (Gibson Research Corp.) C:\Users\Yaakov Laks\Downloads\leaktest(1).exe
2014-10-15 19:07 - 2014-10-15 19:07 - 00000000 ___DC () C:\Users\Yaakov Laks\AppData\Local\Privatefirewall
2014-10-15 09:34 - 2014-10-15 09:34 - 00000000 ___DC () C:\Windows\Tasks\360Disabled
2014-10-15 09:23 - 2014-10-15 20:10 - 00000146 ____C () C:\Windows\ODBC.INI
2014-10-15 09:23 - 2014-10-15 20:10 - 00000000 ___DC () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Privatefirewall 7.0
2014-10-15 09:23 - 2014-10-15 09:23 - 00000000 ___DC () C:\ProgramData\Privacyware
2014-10-15 09:23 - 2013-09-29 21:24 - 00130568 ____C (Privacyware/PWI, Inc.) C:\Windows\system32\Drivers\pwipf6.sys
2014-10-15 09:19 - 2014-10-15 19:06 - 00000000 ___DC () C:\Program Files\360
2014-10-15 00:19 - 2014-10-15 19:50 - 02379264 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-10-15 00:18 - 2014-10-15 19:46 - 00372736 _____ (Microsoft Corporation) C:\Windows\system32\rastls.dll
2014-10-15 00:18 - 2014-10-15 19:41 - 17484800 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-10-15 00:18 - 2014-10-15 19:41 - 11807232 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-10-15 00:18 - 2014-10-15 19:41 - 04201472 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-10-15 00:18 - 2014-10-15 19:41 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-10-15 00:18 - 2014-10-15 19:41 - 02187264 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-10-15 00:18 - 2014-10-15 19:41 - 02017280 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-10-15 00:18 - 2014-10-15 19:41 - 01810944 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-10-15 00:18 - 2014-10-15 19:41 - 01190400 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-10-15 00:18 - 2014-10-15 19:41 - 01068032 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-10-15 00:18 - 2014-10-15 19:41 - 00678400 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-10-15 00:18 - 2014-10-15 19:41 - 00677888 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-10-15 00:18 - 2014-10-15 19:41 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-10-15 00:18 - 2014-10-15 19:41 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-10-15 00:18 - 2014-10-15 19:41 - 00597504 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-10-15 00:18 - 2014-10-15 19:41 - 00454656 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-10-15 00:18 - 2014-10-15 19:41 - 00440320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-10-15 00:18 - 2014-10-15 19:41 - 00365056 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-10-15 00:18 - 2014-10-15 19:41 - 00331448 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-10-15 00:18 - 2014-10-15 19:41 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-10-15 00:18 - 2014-10-15 19:41 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-10-15 00:18 - 2014-10-15 19:41 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-10-15 00:18 - 2014-10-15 19:41 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-10-15 00:18 - 2014-10-15 19:41 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-10-15 00:18 - 2014-10-15 19:41 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-10-15 00:18 - 2014-10-15 19:41 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-10-15 00:18 - 2014-10-15 19:41 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-10-15 00:18 - 2014-10-15 19:41 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-10-15 00:18 - 2014-10-15 19:41 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-10-15 00:18 - 2014-10-15 19:41 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-10-15 00:18 - 2014-10-15 19:41 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-10-15 00:18 - 2014-10-15 19:25 - 01131664 _____ (Microsoft Corporation) C:\Windows\system32\dfshim.dll
2014-10-15 00:18 - 2014-10-15 19:25 - 00156824 _____ (Microsoft Corporation) C:\Windows\system32\mscorier.dll
2014-10-15 00:18 - 2014-10-15 19:25 - 00081560 _____ (Microsoft Corporation) C:\Windows\system32\mscories.dll
2014-10-15 00:18 - 2014-10-15 19:24 - 02744320 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2014-10-15 00:17 - 2014-10-15 19:21 - 05703168 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2014-10-15 00:17 - 2014-10-15 19:21 - 00523264 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll
2014-10-15 00:17 - 2014-10-15 19:21 - 00304128 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2014-10-15 00:17 - 2014-10-15 19:21 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpwd.sys
2014-10-15 00:17 - 2014-10-15 19:21 - 00157696 _____ (Microsoft Corporation) C:\Windows\system32\winsta.dll
2014-10-15 00:17 - 2014-10-15 19:21 - 00130048 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorekmts.dll
2014-10-15 00:17 - 2014-10-15 19:21 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-10-15 00:17 - 2014-10-15 19:21 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2014-10-15 00:17 - 2014-10-15 19:21 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-10-15 00:16 - 2014-10-15 19:19 - 02363904 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-10-15 00:15 - 2014-10-15 19:18 - 12625408 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2014-10-15 00:15 - 2014-10-15 19:18 - 11411456 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2014-10-15 00:15 - 2014-10-15 19:18 - 03970488 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2014-10-15 00:15 - 2014-10-15 19:18 - 03914680 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2014-10-15 00:15 - 2014-10-15 19:18 - 03208704 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll
2014-10-15 00:15 - 2014-10-15 19:18 - 01329664 _____ (Microsoft Corporation) C:\Windows\system32\quartz.dll
2014-10-15 00:15 - 2014-10-15 19:18 - 01174528 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2014-10-15 00:15 - 2014-10-15 19:18 - 01005056 _____ (Microsoft Corporation) C:\Windows\system32\cryptui.dll
2014-10-15 00:15 - 2014-10-15 19:18 - 00988160 _____ (Microsoft Corporation) C:\Windows\system32\drmv2clt.dll
2014-10-15 00:15 - 2014-10-15 19:18 - 00744960 _____ (Microsoft Corporation) C:\Windows\system32\blackbox.dll
2014-10-15 00:15 - 2014-10-15 19:18 - 00617984 _____ (Microsoft Corporation) C:\Windows\system32\wmdrmsdk.dll
2014-10-15 00:15 - 2014-10-15 19:18 - 00593920 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\PEAuth.sys
2014-10-15 00:15 - 2014-10-15 19:18 - 00521384 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
2014-10-15 00:15 - 2014-10-15 19:18 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msscp.dll
2014-10-15 00:15 - 2014-10-15 19:18 - 00489984 _____ (Microsoft Corporation) C:\Windows\system32\evr.dll
2014-10-15 00:15 - 2014-10-15 19:18 - 00473600 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2014-10-15 00:15 - 2014-10-15 19:18 - 00455752 _____ (Microsoft Corporation) C:\Windows\system32\winresume.exe
2014-10-15 00:15 - 2014-10-15 19:18 - 00442880 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll
2014-10-15 00:15 - 2014-10-15 19:18 - 00409272 _____ (Microsoft Corporation) C:\Windows\system32\ci.dll
2014-10-15 00:15 - 2014-10-15 19:18 - 00406016 _____ (Microsoft Corporation) C:\Windows\system32\drmmgrtn.dll
2014-10-15 00:15 - 2014-10-15 19:18 - 00374784 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll
2014-10-15 00:15 - 2014-10-15 19:18 - 00354816 _____ (Microsoft Corporation) C:\Windows\system32\mfplat.dll
2014-10-15 00:15 - 2014-10-15 19:18 - 00275968 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll
2014-10-15 00:15 - 2014-10-15 19:18 - 00265216 _____ (Microsoft Corporation) C:\Windows\system32\msnetobj.dll
2014-10-15 00:15 - 2014-10-15 19:18 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll
2014-10-15 00:15 - 2014-10-15 19:18 - 00179200 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2014-10-15 00:15 - 2014-10-15 19:18 - 00157184 _____ (Microsoft Corporation) C:\Windows\system32\pcasvc.dll
2014-10-15 00:15 - 2014-10-15 19:18 - 00143872 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2014-10-15 00:15 - 2014-10-15 19:18 - 00103424 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll
2014-10-15 00:15 - 2014-10-15 19:18 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\audiodg.exe
2014-10-15 00:15 - 2014-10-15 19:18 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
2014-10-15 00:15 - 2014-10-15 19:18 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\cryptsp.dll
2014-10-15 00:15 - 2014-10-15 19:18 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll
2014-10-15 00:15 - 2014-10-15 19:18 - 00050688 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
2014-10-15 00:15 - 2014-10-15 19:18 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
2014-10-15 00:15 - 2014-10-15 19:18 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\rrinstaller.exe
2014-10-15 00:15 - 2014-10-15 19:18 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
2014-10-15 00:15 - 2014-10-15 19:18 - 00027648 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
2014-10-15 00:15 - 2014-10-15 19:18 - 00023040 _____ (Microsoft Corporation) C:\Windows\system32\mfpmp.exe
2014-10-15 00:15 - 2014-10-15 19:18 - 00016896 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
2014-10-15 00:15 - 2014-10-15 19:18 - 00008192 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll
2014-10-15 00:15 - 2014-10-15 19:18 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx
2014-10-15 00:15 - 2014-10-15 19:18 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll
2014-10-15 00:15 - 2014-10-15 19:18 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\mferror.dll
2014-10-14 22:16 - 2014-10-16 07:14 - 00114904 ____C (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-10-14 22:16 - 2014-10-14 22:16 - 00000892 ____C () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-10-14 22:16 - 2014-10-14 22:16 - 00000000 ___DC () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-10-14 22:16 - 2014-10-01 11:11 - 00075480 ____C (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-10-14 22:16 - 2014-10-01 11:11 - 00051928 ____C (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-10-14 22:16 - 2014-10-01 11:11 - 00023256 ____C (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-10-14 21:27 - 2014-10-14 21:27 - 00025600 ___RC (Gibson Research Corp.) C:\Users\Yaakov Laks\Downloads\LeakTest.exe
2014-10-14 19:04 - 2014-10-14 21:57 - 00001057 ____C () C:\Users\Yaakov Laks\Desktop\mbam20141013.txt
2014-10-14 17:52 - 2014-10-14 17:52 - 00023556 ____C () C:\Users\Yaakov Laks\Desktop\1501 manual0002.tif
2014-10-14 17:52 - 2014-10-14 17:52 - 00010438 ____C () C:\Users\Yaakov Laks\Desktop\1501 manual0001.tif
2014-10-13 22:28 - 2014-10-13 22:29 - 19828376 ____C (Malwarebytes Corporation ) C:\Users\Yaakov Laks\Desktop\mbam-setup-2.0.3.1025.exe
2014-10-13 17:14 - 2014-10-13 17:14 - 00002209 ____C () C:\Users\Yaakov Laks\Desktop\JRT.txt
2014-10-13 17:11 - 2014-10-13 17:11 - 00000000 ___DC () C:\Windows\ERUNT
2014-10-13 16:13 - 2014-10-15 18:58 - 00004958 ____C () C:\Windows\PFRO.log
2014-10-13 13:20 - 2014-10-16 08:43 - 00000000 ___DC () C:\FRST
2014-10-13 12:54 - 2014-10-13 12:54 - 00000000 ___DC () C:\Users\Yaakov Laks\Desktop\RegBackup
2014-10-13 12:53 - 2014-10-13 12:53 - 00000207 ____C () C:\Windows\tweaking.com-regbackup-LAPTOSH-PC-Microsoft-Windows-7-Home-Premium-(32-bit).dat
2014-10-13 12:52 - 2014-10-13 12:52 - 00000000 ___DC () C:\RegBackup
2014-10-13 12:51 - 2014-10-13 12:51 - 00001002 ____C () C:\Users\Public\Desktop\Tweaking.com - Registry Backup.lnk
2014-10-13 12:51 - 2014-10-13 12:51 - 00000000 ___DC () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tweaking.com
2014-10-12 18:56 - 2014-10-12 18:56 - 00123160 ____C () C:\Users\Yaakov Laks\AppData\Local\GDIPFONTCACHEV1.DAT
2014-10-12 18:55 - 2014-10-15 19:59 - 00000728 ____C () C:\Windows\setupact.log
2014-10-12 18:55 - 2014-10-12 18:55 - 00000000 ____C () C:\Windows\setuperr.log
2014-10-12 18:54 - 2014-10-15 19:54 - 00442096 ____C () C:\Windows\system32\FNTCACHE.DAT
2014-10-12 01:56 - 2014-10-12 01:56 - 00004096 ___SH () C:\VSM000.IDX
2014-10-12 01:45 - 2014-10-12 01:53 - 00000000 ___DC () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StorageCraft
2014-10-11 17:43 - 2014-10-14 15:25 - 00000000 ___DC () C:\Users\Yaakov Laks\Desktop\spybot
2014-10-10 23:29 - 2014-10-10 23:30 - 14349744 ____C (Malwarebytes Corp.) C:\Users\Yaakov Laks\Downloads\mbar-1.07.0.1012.exe
2014-10-10 12:18 - 2014-10-10 12:18 - 00000528 ____C () C:\Users\Yaakov Laks\Desktop\תת עריכה עד 2-1-14.txt
2014-10-09 13:01 - 2014-10-09 13:01 - 00000000 ___HC () C:\Users\Yaakov Laks\Documents\Default.rdp
2014-10-08 18:12 - 2014-10-16 02:32 - 00000000 ___DC () C:\Users\Yaakov Laks\Desktop\מסמך טיוטת מדיניות 201308
2014-10-06 21:17 - 2014-10-06 21:17 - 00000841 ____C () C:\Users\Yaakov Laks\Desktop\אילתי בפייס.URL
2014-10-06 17:06 - 2014-10-06 17:06 - 00895120 ____C (Google Inc.) C:\Users\Yaakov Laks\Downloads\GoogleEarthSetup(1).exe
2014-10-06 11:22 - 2014-10-06 11:22 - 00895120 ____C (Google Inc.) C:\Users\Yaakov Laks\Downloads\GoogleEarthSetup.exe
2014-10-03 09:03 - 2014-10-03 09:04 - 00000000 ___DC () C:\Users\Yaakov Laks\Desktop\תמונות למיון
2014-10-03 01:44 - 2014-10-03 01:44 - 00000000 ___DC () C:\Users\Yaakov Laks\AppData\Local\TB
2014-10-01 09:39 - 2014-10-01 09:45 - 00519680 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2014-09-30 01:17 - 2014-09-30 01:18 - 04965896 ____C (Piriform Ltd) C:\Users\Yaakov Laks\Downloads\ccsetup418(1).exe
2014-09-30 01:17 - 2014-09-30 01:17 - 04965896 ____C (Piriform Ltd) C:\Users\Yaakov Laks\Downloads\ccsetup418.exe
2014-09-25 18:41 - 2014-09-25 18:41 - 01626568 ____C () C:\Users\Yaakov Laks\Downloads\setup_Pixum_Fotoboek.exe
2014-09-24 19:44 - 2014-09-25 00:03 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-09-23 18:59 - 2014-09-23 18:59 - 00000000 ___DC () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2014-09-23 18:59 - 2014-09-23 18:59 - 00000000 ___DC () C:\Program Files\Common Files\Skype
2014-09-22 23:00 - 2014-09-22 23:00 - 00718552 ____C (Realtek ) C:\Windows\system32\Drivers\Rt86win7.sys
2014-09-22 23:00 - 2014-09-22 23:00 - 00076872 ____C (Realtek Semiconductor Corporation) C:\Windows\system32\RtNicProp32.dll
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-10-16 08:44 - 2013-08-29 09:28 - 00000926 ____C () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-10-16 08:42 - 2014-01-26 00:44 - 00000830 ____C () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-10-16 08:31 - 2014-03-13 17:44 - 00000000 ___DC () C:\Program Files\Giraffic
2014-10-16 08:22 - 2013-08-25 17:32 - 00000000 ___DC () C:\Users\Yaakov Laks\AppData\Roaming\MailWasherPro
2014-10-16 06:44 - 2013-08-29 09:28 - 00000922 ____C () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-10-16 05:05 - 2009-07-14 05:37 - 00000000 ___DC () C:\Windows\Microsoft.NET
2014-10-16 03:24 - 2014-06-01 23:20 - 01843658 ____C () C:\Windows\WindowsUpdate.log
2014-10-16 02:01 - 2013-08-24 04:21 - 00000000 ___DC () C:\Users\Yaakov Laks\Desktop\111פוספטים
2014-10-15 20:12 - 2009-07-14 07:34 - 00014832 ___HC () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-10-15 20:12 - 2009-07-14 07:34 - 00014832 ___HC () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-10-15 20:01 - 2014-03-13 17:44 - 00000000 ___DC () C:\ProgramData\Giraffic
2014-10-15 19:59 - 2009-07-14 07:53 - 00000006 ___HC () C:\Windows\Tasks\SA.DAT
2014-10-15 19:50 - 2013-08-24 01:10 - 00000000 ___DC () C:\ProgramData\Microsoft Help
2014-10-15 19:41 - 2013-08-23 17:47 - 00000000 ___DC () C:\Windows\system32\MRT
2014-10-15 19:25 - 2013-08-23 17:47 - 100290944 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-10-15 19:23 - 2009-07-14 05:37 - 00000000 ___DC () C:\Program Files\Common Files\microsoft shared
2014-10-15 19:18 - 2008-08-28 12:51 - 00391640 __RSH () C:\bootmgr
2014-10-15 18:59 - 2013-08-23 16:41 - 00000000 ___DC () C:\Users\Yaakov Laks
2014-10-15 18:58 - 2013-09-06 02:32 - 00000000 ___DC () C:\Windows\Minidump
2014-10-15 18:58 - 2012-03-24 20:52 - 00179521 ____N () C:\Windows\Minidump\101514-29905-01.dmp
2014-10-14 22:04 - 2013-11-05 08:40 - 00000000 ___DC () C:\ProgramData\ProductData
2014-10-14 09:24 - 2009-07-14 05:37 - 00000000 ___DC () C:\Windows\system32\LogFiles
2014-10-13 16:05 - 2013-10-07 10:46 - 00000000 ___DC () C:\AdwCleaner
2014-10-13 11:54 - 2009-07-14 05:37 - 00000000 ___DC () C:\Windows\system32\NDF
2014-10-12 20:47 - 2013-08-23 16:41 - 00782470 ____C () C:\Windows\system32\PerfStringBackup.INI
2014-10-12 19:14 - 2013-08-23 18:08 - 00000000 ___DC () C:\Users\Yaakov Laks\AppData\Roaming\Skype
2014-10-12 01:53 - 2014-09-07 02:15 - 00102824 ____C (StorageCraft Technology Corporation) C:\Windows\system32\Drivers\sbmount.sys
2014-10-12 00:22 - 2013-09-07 08:06 - 00000000 ___DC () C:\Users\Yaakov Laks\AppData\Roaming\Notepad++
2014-10-11 05:22 - 2013-08-31 13:37 - 00000000 ___DC () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2014-10-10 00:48 - 2014-08-16 07:29 - 00000000 ___DC () C:\Users\Yaakov Laks\AppData\Local\Adobe
2014-10-10 00:47 - 2013-12-04 06:33 - 00701104 ____C (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-10-10 00:47 - 2013-12-04 06:33 - 00071344 ____C (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-10-09 13:29 - 2014-03-20 16:06 - 00000000 ___DC () C:\Users\Yaakov Laks\.gimp-2.8
2014-10-09 13:02 - 2014-04-21 10:18 - 00001259 ____C () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Movie Maker.lnk
2014-10-09 13:02 - 2014-04-21 10:18 - 00000000 __RDC () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live
2014-10-09 13:02 - 2013-08-24 02:55 - 00001328 ____C () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Photo Gallery.lnk
2014-10-09 13:00 - 2013-08-24 02:55 - 00001412 ____C () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Mail.lnk
2014-10-07 22:40 - 2013-09-08 09:39 - 00000000 ___DC () C:\Users\Yaakov Laks\AppData\Roaming\Audacity
2014-10-07 22:40 - 2013-08-24 02:15 - 00000000 ___DC () C:\Users\Yaakov Laks\AppData\Roaming\vlc
2014-10-07 16:04 - 2013-08-24 04:21 - 00000000 ___DC () C:\Users\Yaakov Laks\Desktop\111עבודה שחורה
2014-10-06 11:21 - 2013-12-03 11:17 - 00044569 ____C () C:\Users\Yaakov Laks\Desktop\קליאו.xlsx
2014-09-27 10:58 - 2013-08-24 05:45 - 00000000 ___DC () C:\Users\Yaakov Laks\Desktop\11מפלגת העבודה
2014-09-26 19:34 - 2013-08-26 23:40 - 00000000 ___DC () C:\Windows\rescache
2014-09-24 08:25 - 2013-08-27 19:47 - 00002441 ____C () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-09-23 19:01 - 2013-08-23 18:08 - 00000000 __RDC () C:\Program Files\Skype
2014-09-23 18:59 - 2013-08-23 18:08 - 00000000 ___DC () C:\ProgramData\Skype
2014-09-22 23:00 - 2011-06-10 06:34 - 00100896 ____C (Realtek Semiconductor Corporation) C:\Windows\system32\RTNUninst32.dll
2014-09-22 09:41 - 2013-08-23 17:14 - 00231568 ____C (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
Some content of TEMP:
====================
C:\Users\Yaakov Laks\AppData\Local\Temp\BackupSetup.exe
C:\Users\Yaakov Laks\AppData\Local\Temp\NOSEventMessages.dll
C:\Users\Yaakov Laks\AppData\Local\Temp\PF7_87d4.exe
C:\Users\Yaakov Laks\AppData\Local\Temp\Quarantine.exe
C:\Users\Yaakov Laks\AppData\Local\Temp\sqlite3.dll
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-10-12 04:50
==================== End Of Log ============================
-
Open notepad (Start --> All Programs --> Accessories --> Notepad).
Please copy the entire contents of the code box below.
(To do this highlight the contents of the box, right click on it and select copy. Right-click in the open notepad and select Paste).
Save it to the same directory as FRST or FRST64 as fixlist.txt. (it has to be right next to FRST or FRST64) either in a directory you saved FRST or FRST64 or on your desktop if thats where you saved it.
You can use your mouse to drag Fixlist right next to FRST or FRST64, either above or below it but not on top of it.
Code:
Start
CloseProcesses:
(IObit) C:\Program Files\IObit\Advanced SystemCare 7\ASCService.exe
(IObit) C:\Program Files\IObit\Smart Defrag 3\SmartDefrag.exe
C:\Program Files\IObit
HKU\S-1-5-18\...\Run: [Advanced SystemCare 7] => C:\Program Files\IObit\Advanced SystemCare 7\ASCTray.exe [2295584 2014-04-21] (IObit)
BHO: ExplorerWnd Helper -> {10921475-03CE-4E04-90CE-E2E7EF20C814} -> D:\Program Files\1Maint\IObit Uninstaller\UninstallExplorer32.dll No File
CHR HKLM\...\Chrome\Extension: [nfengeggddojhakldhlpjdlddgkkjkdd] - C:\Program Files\IObit\Surfing Protection\BrowerProtect\ASC_GhromePlugin.crx [2014-07-14]
R2 AdvancedSystemCareService7; C:\Program Files\IObit\Advanced SystemCare 7\ASCService.exe [881952 2014-01-14] (IObit)
S2 LiveUpdateSvc; C:\Program Files\IObit\LiveUpdate\LiveUpdate.exe [2152736 2014-05-04] (IObit)
R2 PfFilter; C:\Program Files\IObit\Protected Folder\pffilter.sys [34336 2013-04-03] (IObit Information Technology)
R0 SmartDefragDriver; C:\Windows\System32\Drivers\SmartDefragDriver.sys [18624 2014-06-04] (IObit)
IObit Apps Toolbar v9.0 (HKLM\...\{48C13178-64E2-4964-9927-B71A04074D08}) (Version: 9.0 - Spigot, Inc.) <==== ATTENTION
Task: {10E97F4F-0DFB-45D8-900F-E382E39C8576} - System32\Tasks\LaunchSignup => C:\Program Files\MyPC Backup\Signup Wizard.exe <==== ATTENTION
C:\Program Files\MyPC Backup
Task: {22E7CAFD-204F-4241-9690-CF391713F5A8} - System32\Tasks\SmartDefrag3_Update => C:\Program Files\IObit\Smart Defrag 3\AutoUpdate.exe [2014-07-03] (IObit)
Task: {93854466-00E7-4E7D-8F16-2A6F59186783} - \Driver Booster SkipUAC (Yaakov Laks) No Task File <==== ATTENTION
Task: {BAD370E6-0C9E-43E3-BA3C-7E15B5F7CAF3} - System32\Tasks\SmartDefrag3_Startup => C:\Program Files\IObit\Smart Defrag 3\SmartDefrag.exe [2014-07-02] (IObit)
Task: {D813746A-2799-4837-9DF2-CB42F33576E7} - \Driver Booster SkipUAC (SYSTEM) No Task File <==== ATTENTION
Task: {DDBC0950-20BB-43A1-85CE-F57DACB08C1F} - System32\Tasks\ASC7_SkipUac_Yaakov Laks => C:\Program Files\IObit\Advanced SystemCare 7\ASC.exe [2014-05-29] (IObit)
2014-03-20 10:12 - 2013-10-25 12:08 - 00517408 ____C () C:\Program Files\IObit\Advanced SystemCare 7\sqlite3.dll
Hosts:
EmptyTemp:
End
NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system
Then open FRST or FRST64 and click on fix
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.
-
1 Attachment(s)
frst fix log
Shalom Ken,
Frst fixed using the script you sent.
I looked at the log and found the following which I'll try correct manually.
At least one looks like a typo: ghrome instead of chrome.
I 'll use find in regedit to locate the spigot and try to get a special sytem permit in case i'll have no access.
When finished I'll tell you.
The log file was too large, I zipped it.:angel:
yours
laksi
C:\Program Files\IObit\Surfing Protection\BrowerProtect\ASC_GhromePlugin.crx" => File/Directory not found.
IObit Apps Toolbar v9.0 (HKLM\...\{48C13178-64E2-4964-9927-B71A04074D08}) (Version: 9.0 - Spigot, Inc.) <==== ATTENTION => Error: No automatic fix found for this entry.
"C:\Program Files\MyPC Backup" => File/Directory not found.
"C:\Program Files\IObit\Advanced SystemCare 7\sqlite3.dll" => File/Directory not found.
-
Good, looks like your good to go.
-
Manual cleaning
Shalom Ken,
I found and deleted two Iobit folders under c:/users/yaakov laks/AppData/LocalLow
One of them contained 5 Files, 3 Folders, The Other one "IObit Apps" contained 1 File, 2 Folders
c:/users/yaakov laks/AppData/roaming also had an IObit folder 123 Files, 25 Folders - all deleted
c:/users/all users/IObit 42 Files, 9 Folders - all deleted for these I had to use admin auth.
users/default had them under AppData/Roaming I forgot to check number of folders and files - deleted using admin.
These guys really get under your (comuter's) skin :-)
MyPC Backup was found under Program Data Quarantined by... Spybot CHEERS :-)
Spigot was found also under HKLM/.../HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\34B66CF356D744245B0C8EDE24AC03DC.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\62F013B2CCF0DEE4EB7CB83D7A21280C
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8740C21CF79D2514E94A247F4DEFE091
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E83F13912F1FBF64390A163E8464B6C7
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F3157AA407841454BB0C9BE8D1982BC9
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\87131C842E46469499727BA14070D480\InstallProperties
HKEY_USERS\S-1-5-21-2920106312-904050420-1618604034-1001\Software\Microsoft\Internet Explorer\SearchScopes\{7DAAAB92-E210-43F8-AA79-83FD3E90890A}
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes
I didn't delete them, waiting for your instructions
I deleted this one: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{48C13178-64E2-4964-9927-B71A04074D08}
While searching for spigot I saw IObit in the registry, searched the registry, found and deleted a few dozen.
I'll now use my Jv16 or ccleaner to wipe the rest of them.
yours
laksi
-
Go ahead and clean them the best you can, when your done open FRST and copy and paste this in
Iobit
Then click on Search Files
When its done
Iobit
Search Registry