Page 1 of 6 12345 ... LastLast
Results 1 to 10 of 53

Thread: Many dllhost.exe *32 processes from Syswow64 folder

  1. #1
    Member
    Join Date
    Oct 2014
    Posts
    54

    Default Many dllhost.exe *32 processes from Syswow64 folder

    My computer has been slow and multiple dllhost.exe *32 processes are running in the task manager with properties that say they are located in the Syswow64 folder. Scans of Malwarebytes and Microsoft Security Essentials do not detect any threats. Attempts to download additional antivirus programs are met with a "Security Alert" that reads "Your current security settings do not allow this file to be downloaded." I've expended my ideas. Any help would be greatly appreciated!

    Note: I attempted to download the Registry Backup, Farbar Recovery Scan Tool, and the aswMBR program as instructed in the "Before You Post" sticky, but got the same "Your current security settings do not allow this file to be downloaded" message.

    Got the Registry Backup, Farbar Recovery Scan Tool, and the aswMBR program to download by resetting the security settings under Internet Options to the default level. I saved a registry backup. The Farbar and aswMBR logs are below:


    Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 30-10-2014
    Ran by Ryan (administrator) on RYAN-PC on 30-10-2014 03:06:46
    Running from C:\Users\Ryan\Desktop
    Loaded Profiles: UpdatusUser & Ryan (Available profiles: UpdatusUser & Ryan)
    Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: English (United States)
    Internet Explorer Version 11
    Boot Mode: Normal
    Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic...ery-scan-tool/

    ==================== Processes (Whitelisted) =================

    (If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

    (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
    (Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
    (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
    (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
    (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    (Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AdminService.exe
    (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
    (ESET) C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe
    (Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
    (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
    (Nalpeiron Ltd.) C:\Windows\SysWOW64\nlssrv32.exe
    (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
    (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
    (Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
    (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
    (Sentelic Corporation) C:\Program Files (x86)\VIZIO\VIZIO Wireless Touchpad\FspUip.exe
    (SRS Labs, Inc.) C:\Program Files\SRS Labs\SRS Control Panel\SRSPanel_64.exe
    (Intel Corporation) C:\Windows\System32\hkcmd.exe
    (Intel Corporation) C:\Windows\System32\igfxpers.exe
    (Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe
    (Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe
    (Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
    () C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe
    (GARMIN Corp.) C:\Program Files (x86)\Garmin\ANT Agent\ANT Agent.exe
    (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
    (Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
    (VIZIO Computer Inc.) C:\Program Files (x86)\VIZIO\VIZIO_FN_Key_Utility\XVx.exe
    (Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
    (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
    (Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
    (Microsoft Corporation) C:\Windows\System32\dllhost.exe
    () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
    (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
    (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
    (Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
    (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
    (Microsoft Corporation) C:\Windows\System32\dllhost.exe
    (Microsoft Corporation) C:\Windows\System32\dllhost.exe


    ==================== Registry (Whitelisted) ==================

    (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

    HKLM\...\Run: [FspUip] => C:\Program Files (x86)\VIZIO\VIZIO Wireless Touchpad\FspUip.exe [5406104 2012-05-01] (Sentelic Corporation)
    HKLM\...\Run: [SRS Premium Sound HD] => C:\Program Files\SRS Labs\SRS Control Panel\SRSPanel_64.exe [2170752 2012-05-09] (SRS Labs, Inc.)
    HKLM\...\Run: [AtherosBtStack] => C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [1020064 2012-02-13] (Atheros Commnucations)
    HKLM\...\Run: [AthBtTray] => C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe [800416 2012-02-13] (Atheros Commnucations)
    HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1331288 2014-08-22] (Microsoft Corporation)
    HKLM\...\Run: [CDAServer] => C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe [462712 2012-03-09] ()
    HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-02-26] (Intel Corporation)
    HKLM-x32\...\Run: [OSD Utility] => C:\Program Files (x86)\VIZIO\VIZIO_FN_Key_Utility\XVx.exe [7892992 2012-04-27] (VIZIO Computer Inc.)
    HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [40336 2014-09-04] (Adobe Systems Incorporated)
    HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-02-12] (Apple Inc.)
    HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
    HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-02-21] (Apple Inc.)
    HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [271744 2014-09-26] (Oracle Corporation)
    Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
    HKU\S-1-5-21-1987813687-3303645166-2786259458-1001\...\Run: [ANT Agent] => C:\Program Files (x86)\Garmin\ANT Agent\ANT Agent.exe [14731776 2013-02-15] (GARMIN Corp.)
    HKU\S-1-5-21-1987813687-3303645166-2786259458-1001\...\Run: [Google Update] => C:\Users\Ryan\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2013-10-27] (Google Inc.)
    HKU\S-1-5-21-1987813687-3303645166-2786259458-1001\...A8F59079A8D5}\localserver32: rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";eval("epdvnfou/xsjuf)(=tdsjqu!mbohvbhf>ktds (the data entry has 239 more characters). <==== Poweliks!
    AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [260928 2012-03-14] (NVIDIA Corporation)
    AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [215360 2012-03-14] (NVIDIA Corporation)

    ==================== Internet (Whitelisted) ====================

    (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

    HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bing.com/
    HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/?ocid=iehp
    HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x76D36B0F2FC9CC01
    HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-US
    BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
    BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
    BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
    BHO-x32: CIESpeechBHO Class -> {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} -> C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations)
    BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
    BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
    BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
    DPF: HKLM-x32 {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab
    DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/ge...sh/swflash.cab
    Tcpip\Parameters: [DhcpNameServer] 192.168.200.1

    FireFox:
    ========
    FF Plugin: @microsoft.com/GENUINE -> disabled No File
    FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
    FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~4\Office14\NPAUTHZ.DLL (Microsoft Corporation)
    FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
    FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
    FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
    FF Plugin-x32: @java.com/DTPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
    FF Plugin-x32: @java.com/JavaPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
    FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
    FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
    FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
    FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
    FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
    FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
    FF Plugin-x32: @videolan.org/vlc,version=2.0.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
    FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
    FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
    FF Plugin HKCU: @talk.google.com/GoogleTalkPlugin -> C:\Users\Ryan\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)
    FF Plugin HKCU: @talk.google.com/O1DPlugin -> C:\Users\Ryan\AppData\Roaming\Mozilla\plugins\npo1d.dll (Google)
    FF Plugin HKCU: @tools.google.com/Google Update;version=3 -> C:\Users\Ryan\AppData\Local\Google\Update\1.3.25.5\npGoogleUpdate3.dll (Google Inc.)
    FF Plugin HKCU: @tools.google.com/Google Update;version=9 -> C:\Users\Ryan\AppData\Local\Google\Update\1.3.25.5\npGoogleUpdate3.dll (Google Inc.)
    FF Plugin ProgramFiles/Appdata: C:\Users\Ryan\AppData\Roaming\mozilla\plugins\npgoogletalk.dll (Google)
    FF Plugin ProgramFiles/Appdata: C:\Users\Ryan\AppData\Roaming\mozilla\plugins\npo1d.dll (Google)

    Chrome:
    =======

    ==================== Services (Whitelisted) =================

    (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

    R2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [106144 2012-02-13] (Atheros Commnucations) [File not signed]
    R2 ekrn; C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe [1337752 2013-09-12] (ESET)
    R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [128280 2012-03-28] ()
    R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165144 2012-03-28] (Intel Corporation)
    R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23784 2014-08-22] (Microsoft Corporation)
    R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [368624 2014-08-22] (Microsoft Corporation)
    R2 nlsX86cc; C:\Windows\SysWOW64\nlssrv32.exe [66560 2012-11-12] (Nalpeiron Ltd.) [File not signed]

    ==================== Drivers (Whitelisted) ====================

    (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

    R3 CirrusLFD; C:\Windows\System32\DRIVERS\CSLFDx64.sys [35840 2012-04-02] (Cirrus Logic)
    S3 ESETOlmarikOlmascoCleaner; C:\Windows\system32\Drivers\ESETOlmarikOlmascoCleaner.sys [156360 2014-04-11] ()
    S3 libusb0; C:\Windows\System32\DRIVERS\libusb0.sys [44480 2011-05-17] (http://libusb-win32.sourceforge.net)
    R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [269008 2014-07-17] (Microsoft Corporation)
    R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [125584 2014-07-17] (Microsoft Corporation)
    R3 ViWDM; C:\Windows\System32\DRIVERS\ViWDM.SYS [14336 2012-03-07] (Primax Electronics Ltd.)
    R3 vrvd5; C:\Windows\System32\DRIVERS\vrvd5.sys [13344 2014-04-15] (Rsupport Corporation)

    ==================== NetSvcs (Whitelisted) ===================

    (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


    ==================== One Month Created Files and Folders ========

    (If an entry is included in the fixlist, the file\folder will be moved.)

    2014-10-30 03:07 - 2014-10-30 03:07 - 05192704 _____ (AVAST Software) C:\Users\Ryan\Desktop\aswMBR.exe
    2014-10-30 03:06 - 2014-10-30 03:07 - 00013622 _____ () C:\Users\Ryan\Desktop\FRST.txt
    2014-10-30 03:06 - 2014-10-30 03:06 - 02113536 _____ (Farbar) C:\Users\Ryan\Desktop\FRST64.exe
    2014-10-30 03:02 - 2014-10-30 03:02 - 00000000 ___RD () C:\Users\Ryan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BT Devices
    2014-10-30 01:51 - 2014-10-30 01:51 - 00000606 _____ () C:\Users\Ryan\Desktop\aswMBR.txt
    2014-10-30 01:32 - 2014-10-30 03:06 - 00000000 ____D () C:\FRST
    2014-10-30 01:30 - 2014-10-30 01:30 - 00000207 _____ () C:\Windows\tweaking.com-regbackup-RYAN-PC-Microsoft-Windows-7-Home-Premium-(64-bit).dat
    2014-10-30 01:28 - 2014-10-30 01:28 - 00000000 ____D () C:\RegBackup
    2014-10-30 01:27 - 2014-10-30 01:27 - 00002246 _____ () C:\Users\Public\Desktop\Tweaking.com - Registry Backup.lnk
    2014-10-30 01:27 - 2014-10-30 01:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tweaking.com
    2014-10-30 01:27 - 2014-10-30 01:27 - 00000000 ____D () C:\Program Files (x86)\Tweaking.com
    2014-10-29 19:45 - 2014-10-29 19:45 - 00000000 ____D () C:\Users\Ryan\AppData\Roaming\Mozilla
    2014-10-15 16:38 - 2014-10-15 16:38 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
    2014-10-15 16:38 - 2014-10-15 16:38 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
    2014-10-15 16:38 - 2014-10-15 16:38 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
    2014-10-15 16:38 - 2014-10-15 16:38 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
    2014-10-15 16:38 - 2014-10-15 16:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
    2014-10-15 16:38 - 2014-10-15 16:38 - 00000000 ____D () C:\Program Files (x86)\Java
    2014-10-14 20:39 - 2014-10-20 22:01 - 00000000 ____D () C:\Users\Ryan\Desktop\masque of red death
    2014-10-14 16:21 - 2014-09-28 20:58 - 03198976 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
    2014-10-14 16:21 - 2014-07-06 22:07 - 14632960 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
    2014-10-14 16:21 - 2014-07-06 22:07 - 00782848 _____ (Microsoft Corporation) C:\Windows\system32\wmdrmsdk.dll
    2014-10-14 16:21 - 2014-07-06 22:06 - 05552056 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
    2014-10-14 16:21 - 2014-07-06 22:06 - 04120576 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll
    2014-10-14 16:21 - 2014-07-06 22:06 - 01202176 _____ (Microsoft Corporation) C:\Windows\system32\drmv2clt.dll
    2014-10-14 16:21 - 2014-07-06 22:06 - 00842240 _____ (Microsoft Corporation) C:\Windows\system32\blackbox.dll
    2014-10-14 16:21 - 2014-07-06 22:06 - 00500224 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll
    2014-10-14 16:21 - 2014-07-06 21:41 - 03975096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
    2014-10-14 16:21 - 2014-07-06 21:41 - 03919288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
    2014-10-14 16:21 - 2014-07-06 21:40 - 00988160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drmv2clt.dll
    2014-10-14 16:21 - 2014-07-06 21:40 - 00744960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\blackbox.dll
    2014-10-14 16:21 - 2014-07-06 21:40 - 00617984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmdrmsdk.dll
    2014-10-14 16:21 - 2014-06-18 18:23 - 01943696 _____ (Microsoft Corporation) C:\Windows\system32\dfshim.dll
    2014-10-14 16:21 - 2014-06-18 18:23 - 01131664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dfshim.dll
    2014-10-14 16:21 - 2014-06-18 18:23 - 00156824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscorier.dll
    2014-10-14 16:21 - 2014-06-18 18:23 - 00156312 _____ (Microsoft Corporation) C:\Windows\system32\mscorier.dll
    2014-10-14 16:21 - 2014-06-18 18:23 - 00081560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscories.dll
    2014-10-14 16:21 - 2014-06-18 18:23 - 00073880 _____ (Microsoft Corporation) C:\Windows\system32\mscories.dll
    2014-10-14 16:20 - 2014-10-09 22:05 - 00507392 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
    2014-10-14 16:20 - 2014-10-09 22:05 - 00276480 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
    2014-10-14 16:20 - 2014-10-09 22:00 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
    2014-10-14 16:20 - 2014-10-06 22:54 - 00378552 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
    2014-10-14 16:20 - 2014-10-06 22:04 - 00331448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
    2014-10-14 16:20 - 2014-09-25 18:46 - 00365056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
    2014-10-14 16:20 - 2014-09-25 18:46 - 00243200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
    2014-10-14 16:20 - 2014-09-25 18:46 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
    2014-10-14 16:20 - 2014-09-25 18:43 - 11807232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
    2014-10-14 16:20 - 2014-09-25 18:32 - 02017280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
    2014-10-14 16:20 - 2014-09-25 18:31 - 02108416 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
    2014-10-14 16:20 - 2014-09-18 21:56 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
    2014-10-14 16:20 - 2014-09-18 21:55 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
    2014-10-14 16:20 - 2014-09-18 21:44 - 17484800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
    2014-10-14 16:20 - 2014-09-18 21:41 - 02796032 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
    2014-10-14 16:20 - 2014-09-18 21:40 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
    2014-10-14 16:20 - 2014-09-18 21:39 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
    2014-10-14 16:20 - 2014-09-18 21:30 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
    2014-10-14 16:20 - 2014-09-18 21:25 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
    2014-10-14 16:20 - 2014-09-18 21:14 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
    2014-10-14 16:20 - 2014-09-18 21:14 - 00446464 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
    2014-10-14 16:20 - 2014-09-18 21:06 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
    2014-10-14 16:20 - 2014-09-18 21:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
    2014-10-14 16:20 - 2014-09-18 21:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
    2014-10-14 16:20 - 2014-09-18 20:55 - 02187264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
    2014-10-14 16:20 - 2014-09-18 20:54 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
    2014-10-14 16:20 - 2014-09-18 20:53 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
    2014-10-14 16:20 - 2014-09-18 20:51 - 00440320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
    2014-10-14 16:20 - 2014-09-18 20:49 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
    2014-10-14 16:20 - 2014-09-18 20:42 - 00731136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
    2014-10-14 16:20 - 2014-09-18 20:42 - 00710656 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
    2014-10-14 16:20 - 2014-09-18 20:36 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
    2014-10-14 16:20 - 2014-09-18 20:20 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
    2014-10-14 16:20 - 2014-09-18 20:18 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
    2014-10-14 16:20 - 2014-09-18 20:14 - 01447936 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
    2014-10-14 16:20 - 2014-09-18 19:53 - 01190400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
    2014-10-14 16:20 - 2014-08-18 23:08 - 00693176 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
    2014-10-14 16:20 - 2014-08-18 23:08 - 00617376 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
    2014-10-14 16:20 - 2014-08-18 23:05 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
    2014-10-14 16:20 - 2014-08-18 23:05 - 00063488 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
    2014-10-14 16:20 - 2014-07-06 22:07 - 00229376 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
    2014-10-14 16:20 - 2014-07-06 22:06 - 01574400 _____ (Microsoft Corporation) C:\Windows\system32\quartz.dll
    2014-10-14 16:20 - 2014-07-06 22:06 - 01480192 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
    2014-10-14 16:20 - 2014-07-06 22:06 - 01069056 _____ (Microsoft Corporation) C:\Windows\system32\cryptui.dll
    2014-10-14 16:20 - 2014-07-06 22:06 - 00679424 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
    2014-10-14 16:20 - 2014-07-06 22:06 - 00641024 _____ (Microsoft Corporation) C:\Windows\system32\msscp.dll
    2014-10-14 16:20 - 2014-07-06 22:06 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\evr.dll
    2014-10-14 16:20 - 2014-07-06 22:06 - 00497664 _____ (Microsoft Corporation) C:\Windows\system32\drmmgrtn.dll
    2014-10-14 16:20 - 2014-07-06 22:06 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll
    2014-10-14 16:20 - 2014-07-06 22:06 - 00432128 _____ (Microsoft Corporation) C:\Windows\system32\mfplat.dll
    2014-10-14 16:20 - 2014-07-06 22:06 - 00325632 _____ (Microsoft Corporation) C:\Windows\system32\msnetobj.dll
    2014-10-14 16:20 - 2014-07-06 22:06 - 00296448 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll
    2014-10-14 16:20 - 2014-07-06 22:06 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll
    2014-10-14 16:20 - 2014-07-06 22:06 - 00206848 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll
    2014-10-14 16:20 - 2014-07-06 22:06 - 00188416 _____ (Microsoft Corporation) C:\Windows\system32\pcasvc.dll
    2014-10-14 16:20 - 2014-07-06 22:06 - 00187904 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
    2014-10-14 16:20 - 2014-07-06 22:06 - 00082432 _____ (Microsoft Corporation) C:\Windows\system32\cryptsp.dll
    2014-10-14 16:20 - 2014-07-06 22:06 - 00058880 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
    2014-10-14 16:20 - 2014-07-06 22:06 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\rrinstaller.exe
    2014-10-14 16:20 - 2014-07-06 22:06 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
    2014-10-14 16:20 - 2014-07-06 22:06 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\mfpmp.exe
    2014-10-14 16:20 - 2014-07-06 22:06 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll
    2014-10-14 16:20 - 2014-07-06 22:06 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx
    2014-10-14 16:20 - 2014-07-06 22:06 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll
    2014-10-14 16:20 - 2014-07-06 22:05 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
    2014-10-14 16:20 - 2014-07-06 22:05 - 00126464 _____ (Microsoft Corporation) C:\Windows\system32\audiodg.exe
    2014-10-14 16:20 - 2014-07-06 22:02 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\mferror.dll
    2014-10-14 16:20 - 2014-07-06 21:52 - 00663552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\PEAuth.sys
    2014-10-14 16:20 - 2014-07-06 21:40 - 11411456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
    2014-10-14 16:20 - 2014-07-06 21:40 - 03208704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll
    2014-10-14 16:20 - 2014-07-06 21:40 - 01329664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\quartz.dll
    2014-10-14 16:20 - 2014-07-06 21:40 - 01174528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
    2014-10-14 16:20 - 2014-07-06 21:40 - 01005056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptui.dll
    2014-10-14 16:20 - 2014-07-06 21:40 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msscp.dll
    2014-10-14 16:20 - 2014-07-06 21:40 - 00489984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\evr.dll
    2014-10-14 16:20 - 2014-07-06 21:40 - 00442880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AUDIOKSE.dll
    2014-10-14 16:20 - 2014-07-06 21:40 - 00406016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drmmgrtn.dll
    2014-10-14 16:20 - 2014-07-06 21:40 - 00374784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioEng.dll
    2014-10-14 16:20 - 2014-07-06 21:40 - 00354816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfplat.dll
    2014-10-14 16:20 - 2014-07-06 21:40 - 00265216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msnetobj.dll
    2014-10-14 16:20 - 2014-07-06 21:40 - 00195584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioSes.dll
    2014-10-14 16:20 - 2014-07-06 21:40 - 00179200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
    2014-10-14 16:20 - 2014-07-06 21:40 - 00143872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
    2014-10-14 16:20 - 2014-07-06 21:40 - 00103424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfps.dll
    2014-10-14 16:20 - 2014-07-06 21:40 - 00081408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsp.dll
    2014-10-14 16:20 - 2014-07-06 21:40 - 00050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appidapi.dll
    2014-10-14 16:20 - 2014-07-06 21:40 - 00008192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\spwmp.dll
    2014-10-14 16:20 - 2014-07-06 21:40 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdxm.ocx
    2014-10-14 16:20 - 2014-07-06 21:40 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxmasf.dll
    2014-10-14 16:20 - 2014-07-06 21:39 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
    2014-10-14 16:20 - 2014-07-06 21:39 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rrinstaller.exe
    2014-10-14 16:20 - 2014-07-06 21:39 - 00023040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfpmp.exe
    2014-10-14 16:20 - 2014-07-06 21:37 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mferror.dll
    2014-10-14 16:20 - 2014-07-06 21:04 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
    2014-10-14 16:20 - 2014-06-27 20:21 - 00619056 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
    2014-10-14 16:20 - 2014-06-27 20:21 - 00533200 _____ (Microsoft Corporation) C:\Windows\system32\winresume.exe
    2014-10-14 16:20 - 2014-06-27 20:21 - 00457400 _____ (Microsoft Corporation) C:\Windows\system32\ci.dll
    2014-10-14 16:19 - 2014-09-25 18:50 - 13619200 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
    2014-10-14 16:19 - 2014-09-18 22:25 - 23631360 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
    2014-10-14 16:19 - 2014-09-18 21:40 - 00547328 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
    2014-10-14 16:19 - 2014-09-18 21:38 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
    2014-10-14 16:19 - 2014-09-18 21:36 - 05829632 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
    2014-10-14 16:19 - 2014-09-18 21:31 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
    2014-10-14 16:19 - 2014-09-18 21:27 - 00595968 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
    2014-10-14 16:19 - 2014-09-18 21:26 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
    2014-10-14 16:19 - 2014-09-18 21:25 - 04201472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
    2014-10-14 16:19 - 2014-09-18 21:25 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
    2014-10-14 16:19 - 2014-09-18 21:18 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
    2014-10-14 16:19 - 2014-09-18 21:02 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
    2014-10-14 16:19 - 2014-09-18 21:01 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
    2014-10-14 16:19 - 2014-09-18 21:00 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
    2014-10-14 16:19 - 2014-09-18 20:59 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
    2014-10-14 16:19 - 2014-09-18 20:58 - 00289280 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
    2014-10-14 16:19 - 2014-09-18 20:50 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
    2014-10-14 16:19 - 2014-09-18 20:40 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
    2014-10-14 16:19 - 2014-09-18 20:33 - 02309632 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
    2014-10-14 16:19 - 2014-09-18 20:32 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
    2014-10-14 16:19 - 2014-09-18 19:59 - 01810944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
    2014-10-14 16:19 - 2014-09-18 19:59 - 00775168 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
    2014-10-14 16:19 - 2014-09-18 19:52 - 00678400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
    2014-10-14 16:18 - 2014-09-17 22:00 - 03241472 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
    2014-10-14 16:18 - 2014-09-17 21:32 - 02363904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
    2014-10-14 16:17 - 2014-09-12 21:58 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll
    2014-10-14 16:17 - 2014-09-12 21:40 - 00067072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\packager.dll
    2014-10-14 16:17 - 2014-09-04 01:23 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\rastls.dll
    2014-10-14 16:17 - 2014-09-04 01:04 - 00372736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rastls.dll
    2014-10-14 16:17 - 2014-07-16 22:07 - 03722240 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
    2014-10-14 16:17 - 2014-07-16 22:07 - 01118720 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe
    2014-10-14 16:17 - 2014-07-16 22:07 - 00681984 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll
    2014-10-14 16:17 - 2014-07-16 22:07 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
    2014-10-14 16:17 - 2014-07-16 22:07 - 00235520 _____ (Microsoft Corporation) C:\Windows\system32\winsta.dll
    2014-10-14 16:17 - 2014-07-16 22:07 - 00150528 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorekmts.dll
    2014-10-14 16:17 - 2014-07-16 22:07 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
    2014-10-14 16:17 - 2014-07-16 22:07 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
    2014-10-14 16:17 - 2014-07-16 21:40 - 00157696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winsta.dll
    2014-10-14 16:17 - 2014-07-16 21:39 - 03221504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
    2014-10-14 16:17 - 2014-07-16 21:39 - 01051136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstsc.exe
    2014-10-14 16:17 - 2014-07-16 21:39 - 00131584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aaclient.dll
    2014-10-14 16:17 - 2014-07-16 21:39 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
    2014-10-14 16:17 - 2014-07-16 21:39 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
    2014-10-14 16:17 - 2014-07-16 21:21 - 00212480 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpwd.sys
    2014-10-14 16:17 - 2014-07-16 21:21 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
    2014-10-07 17:52 - 2014-10-07 17:52 - 00013762 _____ () C:\Users\Ryan\Desktop\contacts.vcf
    2014-10-07 17:51 - 2014-10-07 17:51 - 00000000 ____D () C:\Users\Ryan\AppData\Local\{30047CF2-3191-430C-8641-B11BF8FDDAFF}
    2014-10-03 23:37 - 2014-10-03 23:37 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
    2014-09-30 17:47 - 2014-09-24 22:08 - 00371712 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
    2014-09-30 17:47 - 2014-09-24 21:40 - 00519680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll

    ==================== One Month Modified Files and Folders =======

    (If an entry is included in the fixlist, the file\folder will be moved.)

    2014-10-30 03:05 - 2012-06-09 03:40 - 02061892 _____ () C:\Windows\WindowsUpdate.log
    2014-10-30 03:01 - 2012-05-04 14:49 - 00072658 _____ () C:\Windows\setupact.log
    2014-10-30 03:01 - 2009-07-14 01:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
    2014-10-30 02:39 - 2012-01-02 05:18 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
    2014-10-30 02:36 - 2013-10-27 15:17 - 00000904 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1987813687-3303645166-2786259458-1001UA.job
    2014-10-30 01:08 - 2009-07-14 00:45 - 00027744 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
    2014-10-30 01:08 - 2009-07-14 00:45 - 00027744 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
    2014-10-30 01:00 - 2014-04-12 02:42 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
    2014-10-29 17:36 - 2013-10-27 15:17 - 00000852 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1987813687-3303645166-2786259458-1001Core.job
    2014-10-29 16:49 - 2014-04-12 02:42 - 00001113 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
    2014-10-29 16:49 - 2014-04-12 02:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
    2014-10-29 16:49 - 2014-04-12 02:42 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
    2014-10-29 16:45 - 2012-08-10 12:38 - 00000000 ____D () C:\Users\Ryan\AppData\Local\CrashDumps
    2014-10-29 14:05 - 2012-08-06 00:52 - 00000000 ____D () C:\Users\Ryan\Documents\Bluetooth Folder
    2014-10-22 17:31 - 2013-10-27 15:17 - 00003872 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1987813687-3303645166-2786259458-1001UA
    2014-10-22 17:31 - 2013-10-27 15:17 - 00003476 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1987813687-3303645166-2786259458-1001Core
    2014-10-21 11:22 - 2012-08-28 23:49 - 00000000 ____D () C:\Users\Ryan\AppData\Local\Microsoft Help
    2014-10-21 10:30 - 2013-10-16 06:44 - 00000000 ____D () C:\Users\Ryan\Documents\Postcolonial Medicine
    2014-10-15 19:46 - 2009-07-13 23:20 - 00000000 ____D () C:\Windows\rescache
    2014-10-15 16:38 - 2013-10-25 18:22 - 00000000 ____D () C:\ProgramData\Oracle
    2014-10-15 16:29 - 2009-07-14 01:09 - 00000000 ____D () C:\Windows\System32\Tasks\WPD
    2014-10-15 16:27 - 2009-07-14 00:45 - 00342240 _____ () C:\Windows\system32\FNTCACHE.DAT
    2014-10-15 16:25 - 2014-05-07 00:19 - 00000000 ___SD () C:\Windows\system32\CompatTel
    2014-10-15 16:25 - 2009-07-13 23:20 - 00000000 ____D () C:\Windows\SysWOW64\Dism
    2014-10-15 16:25 - 2009-07-13 23:20 - 00000000 ____D () C:\Windows\system32\Dism
    2014-10-15 03:01 - 2012-08-28 23:49 - 00000000 ____D () C:\ProgramData\Microsoft Help
    2014-10-15 02:57 - 2014-05-09 17:11 - 00000000 ____D () C:\Windows\system32\MRT
    2014-10-15 02:54 - 2014-05-09 17:11 - 103265616 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
    2014-10-13 17:36 - 2012-09-17 12:31 - 00000000 ____D () C:\Users\Ryan\Documents\Personal Statement Docs
    2014-10-13 16:01 - 2013-02-09 16:54 - 00000000 ____D () C:\Users\Ryan\Documents\Poems
    2014-10-12 23:37 - 2012-08-06 00:51 - 00000000 ____D () C:\Users\Ryan\AppData\Roaming\Skype
    2014-10-07 18:38 - 2013-01-18 23:39 - 00708608 ___SH () C:\Users\Ryan\Desktop\Thumbs.db
    2014-10-03 23:37 - 2014-03-06 04:01 - 00000000 ___RD () C:\Program Files (x86)\Skype
    2014-10-03 23:37 - 2012-01-02 04:58 - 00000000 ____D () C:\ProgramData\Skype
    2014-10-01 11:11 - 2014-04-12 02:42 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
    2014-10-01 11:11 - 2014-04-12 02:42 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
    2014-10-01 11:11 - 2014-04-12 02:42 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

    Some content of TEMP:
    ====================
    C:\Users\Ryan\AppData\Local\Temp\install_flashplayer11x32ax_gtbd_chrd_dn_aih.exe
    C:\Users\Ryan\AppData\Local\Temp\InstHelper.exe
    C:\Users\Ryan\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe
    C:\Users\Ryan\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe
    C:\Users\Ryan\AppData\Local\Temp\jre-7u51-windows-i586-iftw.exe
    C:\Users\Ryan\AppData\Local\Temp\jre-7u65-windows-i586-iftw.exe
    C:\Users\Ryan\AppData\Local\Temp\jre-7u67-windows-i586-iftw.exe
    C:\Users\Ryan\AppData\Local\Temp\jre-7u71-windows-i586-iftw.exe
    C:\Users\Ryan\AppData\Local\Temp\pslist.exe
    C:\Users\Ryan\AppData\Local\Temp\vlc-2.1.3-win32.exe


    ==================== Bamital & volsnap Check =================

    (There is no automatic fix for files that do not pass verification.)

    C:\Windows\System32\winlogon.exe => File is digitally signed
    C:\Windows\System32\wininit.exe => File is digitally signed
    C:\Windows\SysWOW64\wininit.exe => File is digitally signed
    C:\Windows\explorer.exe => File is digitally signed
    C:\Windows\SysWOW64\explorer.exe => File is digitally signed
    C:\Windows\System32\svchost.exe => File is digitally signed
    C:\Windows\SysWOW64\svchost.exe => File is digitally signed
    C:\Windows\System32\services.exe => File is digitally signed
    C:\Windows\System32\User32.dll => File is digitally signed
    C:\Windows\SysWOW64\User32.dll => File is digitally signed
    C:\Windows\System32\userinit.exe => File is digitally signed
    C:\Windows\SysWOW64\userinit.exe => File is digitally signed
    C:\Windows\System32\rpcss.dll => File is digitally signed
    C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


    LastRegBack: 2014-10-27 17:31

    ==================== End Of Log ============================






    Additional scan result of Farbar Recovery Scan Tool (x64) Version: 30-10-2014
    Ran by Ryan at 2014-10-30 03:07:38
    Running from C:\Users\Ryan\Desktop
    Boot Mode: Normal
    ==========================================================


    ==================== Security Center ========================

    (If an entry is included in the fixlist, it will be removed.)

    AV: Microsoft Security Essentials (Enabled - Up to date) {4F35CFC4-45A3-FC37-EF17-759A02E39AB1}
    AS: Microsoft Security Essentials (Enabled - Up to date) {F4542E20-6399-F3B9-D5A7-4EE87964D00C}
    AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

    ==================== Installed Programs ======================

    (Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

    Adobe Flash Player 15 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 15.0.0.167 - Adobe Systems Incorporated)
    Adobe Reader X (10.1.12) MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}) (Version: 10.1.12 - Adobe Systems Incorporated)
    Apple Application Support (HKLM-x32\...\{AAC5D43E-816D-4C2D-8E51-55FFF35BE301}) (Version: 3.0.1 - Apple Inc.)
    Apple Mobile Device Support (HKLM\...\{787136D2-F0F8-4625-AA3F-72D7795AC842}) (Version: 7.1.1.3 - Apple Inc.)
    Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
    Atheros Bluetooth Suite (64) (HKLM\...\{230D1595-57DA-4933-8C4E-375797EBB7E1}) (Version: 7.4.0.122 - Atheros)
    Atheros WLAN Client Installation Program (HKLM-x32\...\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 7.0 - Atheros)
    Audacity 2.0.5 (HKLM-x32\...\Audacity_is1) (Version: 2.0.5 - Audacity Team)
    Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
    Cirrus Logic Audio (HKLM-x32\...\{3A69FD31-5EE7-42C9-918B-81C07AA21043}) (Version: 10.14.0.0 - Cirrus Logic)
    Cirrus Logic Audio x64 (Version: 7.25.38.0 - Cirrus Logic) Hidden
    Common Desktop Agent (Version: 1.62.0 - OEM) Hidden
    Control ActiveX de Windows Live Mesh para conexiones remotas (HKLM-x32\...\{04668DF2-D32F-4555-9C7E-35523DCD6544}) (Version: 15.4.5722.2 - Microsoft Corporation)
    Contrôle ActiveX Windows Live Mesh pour connexions à distance (HKLM-x32\...\{55D003F4-9599-44BF-BA9E-95D060730DD3}) (Version: 15.4.5722.2 - Microsoft Corporation)
    D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
    Galería fotográfica de Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
    Galerie de photos Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
    Garmin ANT Agent (HKLM\...\{20B0E07B-12EA-4BAB-A3B1-E17D7568EB6F}) (Version: 2.3.4 - Garmin Ltd or its subsidiaries)
    Garmin USB Drivers (HKLM-x32\...\{3D5D6CFC-3097-425A-8D8F-7EAF5D57641D}) (Version: 2.3.1.0 - Garmin Ltd or its subsidiaries)
    GIMP 2.8.2 (HKLM\...\GIMP-2_is1) (Version: 2.8.2 - The GIMP Team)
    Google Talk Plugin (HKLM-x32\...\{95763F66-297E-30CE-9728-6D0F20BF97F5}) (Version: 5.38.5.0 - Google)
    GoToMeeting 5.3.0.1009 (HKCU\...\GoToMeeting) (Version: 5.3.0.1009 - CitrixOnline)
    Intel(R) Manageability Engine Firmware Recovery Agent (HKLM-x32\...\{A6C48A9F-694A-4234-B3AA-62590B668927}) (Version: 1.0.0.36279 - Intel Corporation)
    Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.0.10.1464 - Intel Corporation)
    Intel(R) OpenCL CPU Runtime (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: - Intel Corporation)
    Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2752 - Intel Corporation)
    Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.1.0.1006 - Intel Corporation)
    Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 1.0.4.220 - Intel Corporation)
    iTunes (HKLM\...\{B8BA155B-1E75-405F-9CB4-8A99615D09DC}) (Version: 11.1.5.5 - Apple Inc.)
    Java 7 Update 71 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217071FF}) (Version: 7.0.710 - Oracle)
    Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
    LAME v3.99.3 (for Windows) (HKLM-x32\...\LAME_is1) (Version: - )
    Malwarebytes Anti-Malware version 2.0.3.1025 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.3.1025 - Malwarebytes Corporation)
    Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
    Microsoft .NET Framework 4.5.1 (español) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 3082) (Version: 4.5.50938 - Microsoft Corporation)
    Microsoft .NET Framework 4.5.1 (Français) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1036) (Version: 4.5.50938 - Microsoft Corporation)
    Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
    Microsoft Office Home and Student 2010 (HKLM-x32\...\Office14.SingleImage) (Version: 14.0.7015.1000 - Microsoft Corporation)
    Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.6.305.0 - Microsoft Corporation)
    Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
    Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
    Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
    Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
    NVIDIA Graphics Driver 296.28 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 296.28 - NVIDIA Corporation)
    NVIDIA PhysX System Software 9.12.0213 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.12.0213 - NVIDIA Corporation)
    Perfect Photo Suite 7.0.1 (HKLM-x32\...\{6727F16E-6BF0-4E73-AC73-958A382AA09E}) (Version: 7.0.1 - onOne Software)
    Premium Sound HD (HKLM\...\{3007FF9F-5B2C-41FF-8BFC-08BF25DB2681}) (Version: 1.12.3000 - SRS Labs, Inc.)
    Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.52.203.2012 - Realtek)
    Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.7601.30130 - Realtek Semiconductor Corp.)
    Samsung Easy Printer Manager (HKLM-x32\...\Samsung Easy Printer Manager) (Version: 1.05.21.00(2/3/2014) - Samsung Electronics Co., Ltd.)
    Samsung Easy Wireless Setup (HKLM-x32\...\Easy Wireless Setup) (Version: 3.60.40.03 - Samsung Electronics Co., Ltd.)
    Samsung Printer Live Update (HKLM-x32\...\Samsung Printer Live Update) (Version: 1.01.00:04(2013-04-22) - Samsung Electronics Co., Ltd.)
    Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)
    SES Driver (HKLM\...\{D8CC254C-C671-4664-9A38-FA368D1E2C97}) (Version: 1.0.0 - Western Digital)
    Skype™ 6.20 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 6.20.104 - Skype Technologies S.A.)
    Tweaking.com - Registry Backup (HKLM-x32\...\Tweaking.com - Registry Backup) (Version: 1.10.1 - Tweaking.com)
    USB3Setup (HKLM-x32\...\{4814105D-5756-4CD7-9430-ADA474A3E192}) (Version: 1.0.4.220 - VIZIO)
    VIZIO Wireless Driver (HKLM-x32\...\{3A9C1D7A-A227-442F-B296-14AEBC4E85C1}) (Version: 1.00.0001 - VIZIO)
    VIZIO Wireless Touchpad (HKLM-x32\...\{3F0E78CA-735E-446D-8E60-69C6CA27EC95}) (Version: 1.00.0001 - VIZIO)
    VIZIO_FN_Key_Utility (HKLM-x32\...\{106AEB0E-1FF7-44BD-B510-6CF9A3934FAC}) (Version: 1.3.15 - VIZIO)
    VIZIOUtility version 1.0 (HKLM-x32\...\{4F949BD9-1E99-40C7-9102-C67E2D384995}_is1) (Version: 1.0 - VIZIO)
    VLC media player 2.1.3 (HKLM-x32\...\VLC media player) (Version: 2.1.3 - VideoLAN)
    Windows Driver Package - Dynastream Innovations (libusb0) LibUsbDevices (07/07/2009 1.12.2) (HKLM\...\24DA573F901348FFDFF7717497830D45BE0C362E) (Version: 07/07/2009 1.12.2 - Dynastream Innovations)
    Windows Driver Package - Garmin (grmnusb) GARMIN Devices (04/19/2012 2.3.1.0) (HKLM\...\98157A226B40B173301B0F53C8E98C47805D5152) (Version: 04/19/2012 2.3.1.0 - Garmin)
    Windows Driver Package - Silicon Labs Software (DSI_SiUSBXp_3_1) USB (02/06/2007 3.1) (HKLM\...\D1506E0025B5A3F9EB8270FE81C1EEDD9388B8A2) (Version: 02/06/2007 3.1 - Silicon Labs Software)
    Windows Driver Package - Western Digital Technologies (WDC_SAM) WDC_SAM (01/19/2011 1.0.0009.0) (HKLM\...\4CA7CFBB29889F25ACB3DF6E3A42BAE29EB43B20) (Version: 01/19/2011 1.0.0009.0 - Western Digital Technologies)
    Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3555.0308 - Microsoft Corporation)
    Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation)
    Zune (HKLM\...\Zune) (Version: 04.07.1404.01 - Microsoft Corporation)

    ==================== Custom CLSID (selected items): ==========================

    (If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

    CustomCLSID: HKU\S-1-5-21-1987813687-3303645166-2786259458-1001_Classes\CLSID\{0F22A205-CFB0-4679-8499-A6F44A80A208}\InprocServer32 -> C:\Users\Ryan\AppData\Local\Google\Update\1.3.25.5\psuser_64.dll (Google Inc.)
    CustomCLSID: HKU\S-1-5-21-1987813687-3303645166-2786259458-1001_Classes\CLSID\{355EC88A-02E2-4547-9DEE-F87426484BD1}\InprocServer32 -> C:\Users\Ryan\AppData\Local\Google\Update\1.3.23.9\psuser_64.dll No File
    CustomCLSID: HKU\S-1-5-21-1987813687-3303645166-2786259458-1001_Classes\CLSID\{84B5A313-CD5D-4904-8BA2-AFDC81C1B309}\InprocServer32 -> C:\Program Files (x86)\Citrix\GoToMeeting\1009\G2MOutlookAddin64.dll (Citrix Online, a division of Citrix Systems, Inc.)
    CustomCLSID: HKU\S-1-5-21-1987813687-3303645166-2786259458-1001_Classes\CLSID\{90B3DFBF-AF6A-4EA0-8899-F332194690F8}\InprocServer32 -> C:\Users\Ryan\AppData\Local\Google\Update\1.3.24.15\psuser_64.dll No File
    CustomCLSID: HKU\S-1-5-21-1987813687-3303645166-2786259458-1001_Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\localserver32 -> rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";eval("epdvnfou/xsjuf)(=tdsjqu!mbohvbhf>ktds (the data entry has 247 more characters). <==== Poweliks?
    CustomCLSID: HKU\S-1-5-21-1987813687-3303645166-2786259458-1001_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\Ryan\AppData\Local\Google\Update\1.3.25.5\psuser_64.dll (Google Inc.)
    CustomCLSID: HKU\S-1-5-21-1987813687-3303645166-2786259458-1001_Classes\CLSID\{FE498BAB-CB4C-4F88-AC3F-3641AAAF5E9E}\InprocServer32 -> C:\Users\Ryan\AppData\Local\Google\Update\1.3.24.7\psuser_64.dll No File

    ==================== Restore Points =========================


    ==================== Hosts content: ==========================

    (If needed Hosts: directive could be included in the fixlist to reset Hosts.)

    2009-07-13 22:34 - 2009-06-10 17:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

    ==================== Scheduled Tasks (whitelisted) =============

    (If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

    Task: {372C798C-A5B3-4AA4-BBF2-B7E73240D486} - System32\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon => c:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe [2012-03-26] (Intel Corporation)
    Task: {503D3F2D-3467-4AD0-AB8F-6DC6CC77FC61} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1987813687-3303645166-2786259458-1001UA => C:\Users\Ryan\AppData\Local\Google\Update\GoogleUpdate.exe [2013-10-27] (Google Inc.)
    Task: {795C9DD4-84DD-4612-B8E5-6C26954A7C70} - System32\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d => c:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe [2012-03-26] (Intel Corporation)
    Task: {7A4BB95A-5FCC-432C-90F8-E7E4AB110F1C} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1987813687-3303645166-2786259458-1001Core => C:\Users\Ryan\AppData\Local\Google\Update\GoogleUpdate.exe [2013-10-27] (Google Inc.)
    Task: {C5E1112F-43F2-4BEE-99A2-79ADA35DF515} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-09-23] (Adobe Systems Incorporated)
    Task: {F741AF84-829D-46EF-8DB7-4841CBC7DCCE} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
    Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
    Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1987813687-3303645166-2786259458-1001Core.job => C:\Users\Ryan\AppData\Local\Google\Update\GoogleUpdate.exe
    Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1987813687-3303645166-2786259458-1001UA.job => C:\Users\Ryan\AppData\Local\Google\Update\GoogleUpdate.exe
    Task: C:\Windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon.job => c:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe
    Task: C:\Windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d.job => c:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe

    ==================== Loaded Modules (whitelisted) =============

    2011-04-25 11:24 - 2011-04-25 11:24 - 00034304 _____ () C:\Windows\System32\ssj1mlm.dll
    2012-04-27 18:43 - 2012-03-19 18:09 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
    2012-03-09 09:58 - 2012-03-09 09:58 - 00462712 _____ () C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe
    2012-03-09 09:58 - 2012-03-09 09:58 - 00057208 _____ () C:\Program Files\Common Files\Common Desktop Agent\CDASrvPS.dll
    2012-04-17 12:20 - 2012-04-17 12:20 - 00293376 _____ () C:\Program Files (x86)\VIZIO\VIZIO_FN_Key_Utility\vCapture64.dll
    2012-03-28 14:15 - 2012-03-28 14:15 - 00013824 _____ () C:\Program Files (x86)\VIZIO\VIZIO_FN_Key_Utility\WMI_DLL64.dll
    2012-04-27 18:03 - 2012-03-28 10:36 - 00128280 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
    2014-01-20 14:17 - 2014-01-20 14:17 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
    2014-01-20 14:16 - 2014-01-20 14:16 - 01044808 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
    2012-05-18 19:30 - 2012-05-03 17:56 - 00089600 _____ () C:\Program Files (x86)\VIZIO\VIZIO Wireless Touchpad\FspLib.dll
    2012-05-18 19:30 - 2012-05-03 12:48 - 00093696 _____ () C:\Program Files (x86)\VIZIO\VIZIO Wireless Touchpad\move_ctrl.dll
    2012-05-18 19:30 - 2012-04-20 19:11 - 00034816 _____ () C:\Program Files (x86)\VIZIO\VIZIO Wireless Touchpad\KbdHook.dll
    2012-05-18 19:30 - 2012-03-15 13:19 - 00241664 _____ () C:\Program Files (x86)\VIZIO\VIZIO Wireless Touchpad\vCapture.dll
    2012-04-27 18:03 - 2012-03-28 10:18 - 01198872 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll

    ==================== Alternate Data Streams (whitelisted) =========

    (If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

    AlternateDataStreams: C:\Windows:nlsPreferences

    ==================== Safe Mode (whitelisted) ===================

    (If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ESETOlmarikOlmascoCleaner => ""="Service"
    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ESETOlmarikOlmascoCleaner.sys => ""="Driver"
    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\ESETOlmarikOlmascoCleaner => ""="Service"
    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\ESETOlmarikOlmascoCleaner.sys => ""="Driver"

    ==================== EXE Association (whitelisted) =============

    (If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


    ==================== MSCONFIG/TASK MANAGER disabled items =========

    (Currently there is no automatic fix for this section.)


    ========================= Accounts: ==========================

    Administrator (S-1-5-21-1987813687-3303645166-2786259458-500 - Administrator - Disabled)
    Guest (S-1-5-21-1987813687-3303645166-2786259458-501 - Limited - Disabled)
    HomeGroupUser$ (S-1-5-21-1987813687-3303645166-2786259458-1003 - Limited - Enabled)
    Ryan (S-1-5-21-1987813687-3303645166-2786259458-1001 - Administrator - Enabled) => C:\Users\Ryan
    UpdatusUser (S-1-5-21-1987813687-3303645166-2786259458-1000 - Limited - Enabled) => C:\Users\UpdatusUser

    ==================== Faulty Device Manager Devices =============


    ==================== Event log errors: =========================

    Application errors:
    ==================
    Error: (10/30/2014 03:02:16 AM) (Source: WinMgmt) (EventID: 10) (User: )
    Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

    Error: (10/30/2014 01:00:05 AM) (Source: WinMgmt) (EventID: 10) (User: )
    Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

    Error: (10/30/2014 01:00:01 AM) (Source: Application Error) (EventID: 1000) (User: )
    Description: Faulting application name: BtvStack.exe, version: 7.4.0.122, time stamp: 0x4f387d95
    Faulting module name: BtvStack.exe, version: 7.4.0.122, time stamp: 0x4f387d95
    Exception code: 0xc0000005
    Fault offset: 0x000000000007d778
    Faulting process id: 0xe9c
    Faulting application start time: 0xBtvStack.exe0
    Faulting application path: BtvStack.exe1
    Faulting module path: BtvStack.exe2
    Report Id: BtvStack.exe3

    Error: (10/30/2014 00:56:05 AM) (Source: WinMgmt) (EventID: 10) (User: )
    Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

    Error: (10/30/2014 00:49:20 AM) (Source: Bonjour Service) (EventID: 100) (User: )
    Description: Local Hostname Ryan-PC.local already in use; will try Ryan-PC-2.local instead

    Error: (10/30/2014 00:49:20 AM) (Source: Bonjour Service) (EventID: 100) (User: )
    Description: mDNSCoreReceiveResponse: ProbeCount 2; will deregister 4 Ryan-PC.local. Addr 192.168.200.26

    Error: (10/30/2014 00:49:20 AM) (Source: Bonjour Service) (EventID: 100) (User: )
    Description: mDNSCoreReceiveResponse: Received from 192.168.200.25:5353 4 Ryan-PC.local. Addr 192.168.200.25

    Error: (10/29/2014 08:55:15 PM) (Source: WinMgmt) (EventID: 10) (User: )
    Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

    Error: (10/29/2014 08:39:15 PM) (Source: WinMgmt) (EventID: 10) (User: )
    Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

    Error: (10/29/2014 07:54:02 PM) (Source: Application Error) (EventID: 1000) (User: )
    Description: Faulting application name: BtvStack.exe, version: 7.4.0.122, time stamp: 0x4f387d95
    Faulting module name: BtvStack.exe, version: 7.4.0.122, time stamp: 0x4f387d95
    Exception code: 0xc0000005
    Fault offset: 0x000000000007d778
    Faulting process id: 0xb18
    Faulting application start time: 0xBtvStack.exe0
    Faulting application path: BtvStack.exe1
    Faulting module path: BtvStack.exe2
    Report Id: BtvStack.exe3


    System errors:
    =============
    Error: (10/30/2014 03:02:42 AM) (Source: DCOM) (EventID: 10010) (User: )
    Description: {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}

    Error: (10/30/2014 03:01:51 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
    Description: The following boot-start or system-start driver(s) failed to load:
    cdrom

    Error: (10/30/2014 03:00:36 AM) (Source: iaStor) (EventID: 9) (User: )
    Description: The device, \Device\Ide\iaStor0, did not respond within the timeout period.

    Error: (10/30/2014 02:58:36 AM) (Source: iaStor) (EventID: 9) (User: )
    Description: The device, \Device\Ide\iaStor0, did not respond within the timeout period.

    Error: (10/30/2014 02:57:35 AM) (Source: iaStor) (EventID: 9) (User: )
    Description: The device, \Device\Ide\iaStor0, did not respond within the timeout period.

    Error: (10/30/2014 02:56:34 AM) (Source: iaStor) (EventID: 9) (User: )
    Description: The device, \Device\Ide\iaStor0, did not respond within the timeout period.

    Error: (10/30/2014 02:55:33 AM) (Source: iaStor) (EventID: 9) (User: )
    Description: The device, \Device\Ide\iaStor0, did not respond within the timeout period.

    Error: (10/30/2014 02:53:33 AM) (Source: iaStor) (EventID: 9) (User: )
    Description: The device, \Device\Ide\iaStor0, did not respond within the timeout period.

    Error: (10/30/2014 02:52:32 AM) (Source: iaStor) (EventID: 9) (User: )
    Description: The device, \Device\Ide\iaStor0, did not respond within the timeout period.

    Error: (10/30/2014 02:51:31 AM) (Source: iaStor) (EventID: 9) (User: )
    Description: The device, \Device\Ide\iaStor0, did not respond within the timeout period.


    Microsoft Office Sessions:
    =========================
    Error: (10/30/2014 03:02:16 AM) (Source: WinMgmt) (EventID: 10) (User: )
    Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

    Error: (10/30/2014 01:00:05 AM) (Source: WinMgmt) (EventID: 10) (User: )
    Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

    Error: (10/30/2014 01:00:01 AM) (Source: Application Error) (EventID: 1000) (User: )
    Description: BtvStack.exe7.4.0.1224f387d95BtvStack.exe7.4.0.1224f387d95c0000005000000000007d778e9c01cff3fe534dd6daC:\Program Files (x86)\Bluetooth Suite\BtvStack.exeC:\Program Files (x86)\Bluetooth Suite\BtvStack.exe9a33b6ca-5ff1-11e4-a198-006b9e00c96d

    Error: (10/30/2014 00:56:05 AM) (Source: WinMgmt) (EventID: 10) (User: )
    Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

    Error: (10/30/2014 00:49:20 AM) (Source: Bonjour Service) (EventID: 100) (User: )
    Description: Local Hostname Ryan-PC.local already in use; will try Ryan-PC-2.local instead

    Error: (10/30/2014 00:49:20 AM) (Source: Bonjour Service) (EventID: 100) (User: )
    Description: mDNSCoreReceiveResponse: ProbeCount 2; will deregister 4 Ryan-PC.local. Addr 192.168.200.26

    Error: (10/30/2014 00:49:20 AM) (Source: Bonjour Service) (EventID: 100) (User: )
    Description: mDNSCoreReceiveResponse: Received from 192.168.200.25:5353 4 Ryan-PC.local. Addr 192.168.200.25

    Error: (10/29/2014 08:55:15 PM) (Source: WinMgmt) (EventID: 10) (User: )
    Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

    Error: (10/29/2014 08:39:15 PM) (Source: WinMgmt) (EventID: 10) (User: )
    Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

    Error: (10/29/2014 07:54:02 PM) (Source: Application Error) (EventID: 1000) (User: )
    Description: BtvStack.exe7.4.0.1224f387d95BtvStack.exe7.4.0.1224f387d95c0000005000000000007d778b1801cff3d398da8f89C:\Program Files (x86)\Bluetooth Suite\BtvStack.exeC:\Program Files (x86)\Bluetooth Suite\BtvStack.exedb301af5-5fc6-11e4-844e-006b9e00c96d


    ==================== Memory info ===========================

    Processor: Intel(R) Core(TM) i7-3610QM CPU @ 2.30GHz
    Percentage of memory in use: 31%
    Total physical RAM: 8085.95 MB
    Available physical RAM: 5516.39 MB
    Total Pagefile: 16170.07 MB
    Available Pagefile: 13398.46 MB
    Total Virtual: 8192 MB
    Available Virtual: 8191.85 MB

    ==================== Drives ================================

    Drive c: (WINDOWS) (Fixed) (Total:919.21 GB) (Free:822.09 GB) NTFS

    ==================== MBR & Partition Table ==================

    ========================================================
    Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: 868B7EFA)
    Partition 1: (Active) - (Size=600 MB) - (Type=27)
    Partition 2: (Not Active) - (Size=919.2 GB) - (Type=07 NTFS)
    Partition 3: (Not Active) - (Size=11.7 GB) - (Type=27)

    ==================== End Of Log ============================

    The aswMBR scan ran all night but finally finished. Here is the log:

    aswMBR version 1.0.1.2161 Copyright(c) 2014 AVAST Software
    Run date: 2014-10-30 03:27:53
    -----------------------------
    03:27:53.920 OS Version: Windows x64 6.1.7601 Service Pack 1
    03:27:53.920 Number of processors: 8 586 0x3A09
    03:27:53.920 ComputerName: RYAN-PC UserName: Ryan
    03:27:55.449 Initialize success
    03:27:55.480 VM: initialized successfully
    03:27:55.496 VM: Intel CPU BiosDisabled
    03:27:58.108 VM: supported disk I/O iaStor.sys
    03:28:26.266 AVAST engine defs: 14102902
    03:28:35.876 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0
    03:28:35.876 Disk 0 Vendor: ST1000LM 2AR1 Size: 953869MB BusType: 8
    03:28:36.375 Disk 0 MBR read successfully
    03:28:36.375 Disk 0 MBR scan
    03:28:36.406 Disk 0 Windows 7 default MBR code
    03:28:36.437 Disk 0 Partition 1 80 (A) 27 Hidden NTFS WinRE NTFS 600 MB offset 2048
    03:28:36.437 Disk 0 default boot code
    03:28:36.468 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 941267 MB offset 1230848
    03:28:36.546 Disk 0 Partition 3 00 27 Hidden NTFS WinRE NTFS 12000 MB offset 1928945664
    03:28:36.908 Disk 0 scanning C:\Windows\system32\drivers
    03:29:01.702 Service scanning
    03:29:36.064 Modules scanning
    03:29:36.064 Disk 0 trace - called modules:
    03:29:36.094 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys iaStor.sys hal.dll
    03:29:36.094 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8007aa5790]
    03:29:36.094 3 CLASSPNP.SYS[fffff88000fcc43f] -> nt!IofCallDriver -> [0xfffffa8007534a40]
    03:29:36.104 5 ACPI.sys[fffff88000edf7a1] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-0[0xfffffa8007533050]
    03:29:38.609 AVAST engine scan C:\Windows
    03:29:47.929 AVAST engine scan C:\Windows\system32
    03:34:15.274 AVAST engine scan C:\Windows\system32\drivers
    03:34:47.109 AVAST engine scan C:\Users\Ryan
    12:16:25.655 File: C:\Users\Ryan\AppData\LocalLow\ynsvabi.dll **INFECTED** Win32:Malware-gen
    12:35:28.201 AVAST engine scan C:\ProgramData
    12:44:42.706 Disk 0 statistics 4836813/0/22 @ 0.50 MB/s
    12:44:42.722 Scan finished successfully
    14:02:02.140 Disk 0 MBR has been saved successfully to "C:\Users\Ryan\Desktop\MBR.dat"
    14:02:02.170 The log file has been saved successfully to "C:\Users\Ryan\Desktop\aswMBR.txt"
    Last edited by tashi; 2014-10-30 at 20:10. Reason: Merged four posts, please don't add another, as per forum FAQ

  2. #2
    Security Expert-emeritus Juliet's Avatar
    Join Date
    Feb 2007
    Location
    Deep South
    Posts
    4,084

    Default

    Open notepad. Please copy the contents of the quote box below. To do this highlight the contents of the box and right click on it and select copy.
    Paste this into the open notepad. save it to the Desktop as fixlist.txt
    NOTE. It's important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work.
    It needs to be saved Next to the "Farbar Recovery Scan Tool" (If asked to overwrite existing one please allow)

    start
    CloseProcesses:
    HKU\S-1-5-21-1987813687-3303645166-2786259458-1001\...A8F59079A8D5}\localserver32: rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";eval("epdvnfou/xsjuf)(=tdsjqu!mbohvbhf>ktds (the data entry has 239 more characters). <==== Poweliks!
    C:\Users\Ryan\AppData\Local\Temp\install_flashplayer11x32ax_gtbd_chrd_dn_aih.exe
    C:\Users\Ryan\AppData\Local\Temp\InstHelper.exe
    C:\Users\Ryan\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe
    C:\Users\Ryan\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe
    C:\Users\Ryan\AppData\Local\Temp\jre-7u51-windows-i586-iftw.exe
    C:\Users\Ryan\AppData\Local\Temp\jre-7u65-windows-i586-iftw.exe
    C:\Users\Ryan\AppData\Local\Temp\jre-7u67-windows-i586-iftw.exe
    C:\Users\Ryan\AppData\Local\Temp\jre-7u71-windows-i586-iftw.exe
    C:\Users\Ryan\AppData\Local\Temp\pslist.exe
    C:\Users\Ryan\AppData\Local\Temp\vlc-2.1.3-win32.exe
    CustomCLSID: HKU\S-1-5-21-1987813687-3303645166-2786259458-1001_Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\localserver32 -> rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";eval("epdvnfou/xsjuf)(=tdsjqu!mbohvbhf>ktds (the data entry has 247 more characters). <==== Poweliks?
    AlternateDataStreams: C:\Windows:nlsPreferences
    C:\Users\Ryan\AppData\LocalLow\ynsvabi.dll
    EmptyTemp:
    Hosts:
    End
    Open FRST/FRST64 and press the Fix button just once and wait.
    If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
    When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    -AdwCleaner-by Xplode

    Click on this link to download : ADWCleaner
    Click on ONE of the Two Blue Download Now buttons That have a blue arrow beside them and save it to your desktop.

    Do not click on any links in the top Advertisment.



    • Close all open programs and internet browsers.
    • Double click on AdwCleaner.exe to run the tool.
    • Click on Scan.
    • After the scan is complete click on "Clean"
    • Confirm each time with Ok.
    • Your computer will be rebooted automatically. A text file will open after the restart.
    • Please post the content of that logfile with your next answer.
    • You can find the logfile at C:\AdwCleaner[S1].txt as well.
    • NOTE: If you see AVG Secure Search being targeted for deletion, Here's Why and Here. You can always Reinstall it.

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~



    Please download Junkware Removal Tool to your desktop.
    • Shut down your protection software now to avoid potential conflicts.
    • Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
    • The tool will open and start scanning your system.
    • Please be patient as this can take a while to complete depending on your system's specifications.
    • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
    • Post the contents of JRT.txt into your next message.


    please post
    Fixlog.txt
    C:\AdwCleaner.txt
    JRT.txt
    Windows Insider MVP Consumer Security 2009 - 2017
    Please do not PM me for Malware help, we all benefit from posting on the open board.

  3. #3
    Member
    Join Date
    Oct 2014
    Posts
    54

    Default

    What light through yonder window breaks? It is the east, and Juliet is the sun!

    The FRST, ADWCleaner, and JRT logs are posted below. Thanks so much for your help!

    Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 30-10-2014
    Ran by Ryan at 2014-10-30 21:17:54 Run:1
    Running from C:\Users\Ryan\Desktop
    Loaded Profiles: UpdatusUser & Ryan (Available profiles: UpdatusUser & Ryan)
    Boot Mode: Normal
    ==============================================

    Content of fixlist:
    *****************
    start
    CloseProcesses:
    HKU\S-1-5-21-1987813687-3303645166-2786259458-1001\...A8F59079A8D5}\localserver32: rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";eval("epdvnfou/xsjuf)(=tdsjqu!mbohvbhf>ktds (the data entry has 239 more characters). <==== Poweliks!
    C:\Users\Ryan\AppData\Local\Temp\install_flashplayer11x32ax_gtbd_chrd_dn_aih.exe
    C:\Users\Ryan\AppData\Local\Temp\InstHelper.exe
    C:\Users\Ryan\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe
    C:\Users\Ryan\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe
    C:\Users\Ryan\AppData\Local\Temp\jre-7u51-windows-i586-iftw.exe
    C:\Users\Ryan\AppData\Local\Temp\jre-7u65-windows-i586-iftw.exe
    C:\Users\Ryan\AppData\Local\Temp\jre-7u67-windows-i586-iftw.exe
    C:\Users\Ryan\AppData\Local\Temp\jre-7u71-windows-i586-iftw.exe
    C:\Users\Ryan\AppData\Local\Temp\pslist.exe
    C:\Users\Ryan\AppData\Local\Temp\vlc-2.1.3-win32.exe
    CustomCLSID: HKU\S-1-5-21-1987813687-3303645166-2786259458-1001_Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\localserver32 -> rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";eval("epdvnfou/xsjuf)(=tdsjqu!mbohvbhf>ktds (the data entry has 247 more characters). <==== Poweliks?
    AlternateDataStreams: C:\Windows:nlsPreferences
    C:\Users\Ryan\AppData\LocalLow\ynsvabi.dll
    EmptyTemp:
    Hosts:
    End
    *****************

    Processes closed successfully.
    "HKU\S-1-5-21-1987813687-3303645166-2786259458-1001\Software\Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\localserver32" => Key Deleted Successfully.
    "HKU\S-1-5-21-1987813687-3303645166-2786259458-1001\Software\Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}" => Key deleted successfully.
    C:\Users\Ryan\AppData\Local\Temp\install_flashplayer11x32ax_gtbd_chrd_dn_aih.exe => Moved successfully.
    C:\Users\Ryan\AppData\Local\Temp\InstHelper.exe => Moved successfully.
    C:\Users\Ryan\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe => Moved successfully.
    C:\Users\Ryan\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe => Moved successfully.
    C:\Users\Ryan\AppData\Local\Temp\jre-7u51-windows-i586-iftw.exe => Moved successfully.
    C:\Users\Ryan\AppData\Local\Temp\jre-7u65-windows-i586-iftw.exe => Moved successfully.
    C:\Users\Ryan\AppData\Local\Temp\jre-7u67-windows-i586-iftw.exe => Moved successfully.
    C:\Users\Ryan\AppData\Local\Temp\jre-7u71-windows-i586-iftw.exe => Moved successfully.
    C:\Users\Ryan\AppData\Local\Temp\pslist.exe => Moved successfully.
    C:\Users\Ryan\AppData\Local\Temp\vlc-2.1.3-win32.exe => Moved successfully.
    "HKU\S-1-5-21-1987813687-3303645166-2786259458-1001_Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}" => Key not found.
    C:\Windows => ":nlsPreferences" ADS removed successfully.
    C:\Users\Ryan\AppData\LocalLow\ynsvabi.dll => Moved successfully.
    C:\Windows\System32\Drivers\etc\hosts => Moved successfully.
    Hosts was reset successfully.
    EmptyTemp: => Removed 11.6 GB temporary data.


    The system needed a reboot.

    ==== End of Fixlog ====





    # AdwCleaner v3.311 - Report created 30/10/2014 at 21:48:34
    # Updated 30/09/2014 by Xplode
    # Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
    # Username : Ryan - RYAN-PC
    # Running from : C:\Users\Ryan\Desktop\AdwCleaner.exe
    # Option : Clean

    ***** [ Services ] *****


    ***** [ Files / Folders ] *****

    Folder Deleted : C:\Users\Ryan\AppData\Roaming\Solvusoft

    ***** [ Scheduled Tasks ] *****


    ***** [ Shortcuts ] *****


    ***** [ Registry ] *****


    ***** [ Browsers ] *****

    -\\ Internet Explorer v11.0.9600.17344


    *************************

    AdwCleaner[R0].txt - [726 octets] - [30/10/2014 21:46:47]
    AdwCleaner[S0].txt - [650 octets] - [30/10/2014 21:48:34]

    ########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [709 octets] ##########





    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    Junkware Removal Tool (JRT) by Thisisu
    Version: 6.3.3 (10.21.2014:1)
    OS: Windows 7 Home Premium x64
    Ran by Ryan on Thu 10/30/2014 at 21:53:26.13
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




    ~~~ Services



    ~~~ Registry Values



    ~~~ Registry Keys



    ~~~ Files



    ~~~ Folders

    Successfully deleted: [Empty Folder] C:\Users\Ryan\appdata\local\{07397CED-C113-4AEF-A421-43CD550D59A4}
    Successfully deleted: [Empty Folder] C:\Users\Ryan\appdata\local\{103122E5-ADB8-449D-9D3C-FA50A076A103}
    Successfully deleted: [Empty Folder] C:\Users\Ryan\appdata\local\{123FCFA8-6980-44C3-9103-F1450F5ED467}
    Successfully deleted: [Empty Folder] C:\Users\Ryan\appdata\local\{128F720C-66E1-4B91-9003-C27E2E4C61B1}
    Successfully deleted: [Empty Folder] C:\Users\Ryan\appdata\local\{1C9D2752-9710-4091-8C51-E0EF7CBA2810}
    Successfully deleted: [Empty Folder] C:\Users\Ryan\appdata\local\{20EE7515-C355-4EB4-8AA3-910A702ECF2F}
    Successfully deleted: [Empty Folder] C:\Users\Ryan\appdata\local\{2490B311-7A6F-46C7-A329-68B137444195}
    Successfully deleted: [Empty Folder] C:\Users\Ryan\appdata\local\{27010542-2504-42DF-905D-4B9C3E524A31}
    Successfully deleted: [Empty Folder] C:\Users\Ryan\appdata\local\{2A177609-A760-443F-8A9C-E8ECF175EF80}
    Successfully deleted: [Empty Folder] C:\Users\Ryan\appdata\local\{30047CF2-3191-430C-8641-B11BF8FDDAFF}
    Successfully deleted: [Empty Folder] C:\Users\Ryan\appdata\local\{31457A5B-6FCE-46D0-B56B-4641E0624866}
    Successfully deleted: [Empty Folder] C:\Users\Ryan\appdata\local\{36F15617-7E6D-4732-A8F5-C2014132756F}
    Successfully deleted: [Empty Folder] C:\Users\Ryan\appdata\local\{3D105088-F9CA-4197-97A4-0EE339D6919D}
    Successfully deleted: [Empty Folder] C:\Users\Ryan\appdata\local\{3DBEA061-F8AE-4985-A87D-BD3042D51622}
    Successfully deleted: [Empty Folder] C:\Users\Ryan\appdata\local\{47384F25-150D-468F-92ED-27C554B7A9C5}
    Successfully deleted: [Empty Folder] C:\Users\Ryan\appdata\local\{4A0EC5E1-8F23-4596-B545-B8C7A0A022C4}
    Successfully deleted: [Empty Folder] C:\Users\Ryan\appdata\local\{4A526934-0DD6-4F5A-8CEC-91B81B2DBF12}
    Successfully deleted: [Empty Folder] C:\Users\Ryan\appdata\local\{4D2A057C-8B4D-4416-BD46-D1999D9FFF8D}
    Successfully deleted: [Empty Folder] C:\Users\Ryan\appdata\local\{51CDD243-DDD0-453A-B0F8-C7D65983F8D4}
    Successfully deleted: [Empty Folder] C:\Users\Ryan\appdata\local\{51D1A8BE-4F23-46E6-826C-75D3E1F19DA8}
    Successfully deleted: [Empty Folder] C:\Users\Ryan\appdata\local\{541B2A8D-7AC4-49E4-A286-F6C79250C68F}
    Successfully deleted: [Empty Folder] C:\Users\Ryan\appdata\local\{5479510F-5463-4F62-ADCA-9AC121A05631}
    Successfully deleted: [Empty Folder] C:\Users\Ryan\appdata\local\{54D72C00-DF35-4A47-BFBF-E1A2D6FA60FB}
    Successfully deleted: [Empty Folder] C:\Users\Ryan\appdata\local\{56909F63-5468-403A-8B9B-E792AF4B71D0}
    Successfully deleted: [Empty Folder] C:\Users\Ryan\appdata\local\{57C03F51-67F4-421B-BD3B-27B7F238533D}
    Successfully deleted: [Empty Folder] C:\Users\Ryan\appdata\local\{620C5AE6-A641-4C49-B3FB-4A9E39176727}
    Successfully deleted: [Empty Folder] C:\Users\Ryan\appdata\local\{68762BA5-4488-46D9-A6CE-29F3F555E8AE}
    Successfully deleted: [Empty Folder] C:\Users\Ryan\appdata\local\{6D427CBA-7E1C-4319-B941-728736DE4F3B}
    Successfully deleted: [Empty Folder] C:\Users\Ryan\appdata\local\{7125917B-1544-4763-9C53-DDE46031608A}
    Successfully deleted: [Empty Folder] C:\Users\Ryan\appdata\local\{71AF1285-D4DD-4BAA-B42F-7816893A331F}
    Successfully deleted: [Empty Folder] C:\Users\Ryan\appdata\local\{74A7198E-0AA4-4B19-A7BA-EF144F355E92}
    Successfully deleted: [Empty Folder] C:\Users\Ryan\appdata\local\{7616541C-0DC4-4C57-AB92-A7A05160A085}
    Successfully deleted: [Empty Folder] C:\Users\Ryan\appdata\local\{7955DE09-3A84-4ACD-B95B-E8BDC6953354}
    Successfully deleted: [Empty Folder] C:\Users\Ryan\appdata\local\{79C07A0E-4720-483D-A65C-209EE376F69D}
    Successfully deleted: [Empty Folder] C:\Users\Ryan\appdata\local\{7E7490AA-4C91-49FC-834F-AEC8A967B83C}
    Successfully deleted: [Empty Folder] C:\Users\Ryan\appdata\local\{83C3ED5C-BC51-49FB-AEE7-B3D05BF08CCB}
    Successfully deleted: [Empty Folder] C:\Users\Ryan\appdata\local\{8744B382-6735-4656-8601-D5CCFEAEFE55}
    Successfully deleted: [Empty Folder] C:\Users\Ryan\appdata\local\{8A6B9C74-6A39-4FE8-8A3A-8F6B185E3768}
    Successfully deleted: [Empty Folder] C:\Users\Ryan\appdata\local\{8B87624F-4827-4ABE-BCA1-14D2839349EB}
    Successfully deleted: [Empty Folder] C:\Users\Ryan\appdata\local\{94260274-7766-49A0-BFA1-F4BFD09B3E1D}
    Successfully deleted: [Empty Folder] C:\Users\Ryan\appdata\local\{94B5D653-6DD1-4F16-A3F5-637E52F61728}
    Successfully deleted: [Empty Folder] C:\Users\Ryan\appdata\local\{97C0F0AE-DDAC-4787-A166-51EEB7456632}
    Successfully deleted: [Empty Folder] C:\Users\Ryan\appdata\local\{9DAF574B-F62C-4421-8720-5A2DF9EB103A}
    Successfully deleted: [Empty Folder] C:\Users\Ryan\appdata\local\{A03CE0E0-D803-4CD7-896A-1B9EF7CAE5CF}
    Successfully deleted: [Empty Folder] C:\Users\Ryan\appdata\local\{A149A6B3-AB36-4DDB-A6C4-268D432FEECB}
    Successfully deleted: [Empty Folder] C:\Users\Ryan\appdata\local\{A41F4C3C-D3C5-4FB5-A608-A5EF4D77730D}
    Successfully deleted: [Empty Folder] C:\Users\Ryan\appdata\local\{A66D2B5A-576E-4E73-A420-5F955B19EB7E}
    Successfully deleted: [Empty Folder] C:\Users\Ryan\appdata\local\{AB81761D-7722-4CDC-9B38-4FDA2651F88E}
    Successfully deleted: [Empty Folder] C:\Users\Ryan\appdata\local\{AD057800-B9DD-43F2-8038-F44D8F1620A6}
    Successfully deleted: [Empty Folder] C:\Users\Ryan\appdata\local\{B06F65A6-93CC-4F15-AA0D-EA137533EE9F}
    Successfully deleted: [Empty Folder] C:\Users\Ryan\appdata\local\{B408126B-3BC0-45A9-9357-D980BE226B90}
    Successfully deleted: [Empty Folder] C:\Users\Ryan\appdata\local\{B81447F0-7E1C-4150-BE04-748296005013}
    Successfully deleted: [Empty Folder] C:\Users\Ryan\appdata\local\{B9C4CCE4-4926-4864-AFB9-01976BF03ED4}
    Successfully deleted: [Empty Folder] C:\Users\Ryan\appdata\local\{BA4A3B95-9C6B-4ABA-8502-846DB2A7C028}
    Successfully deleted: [Empty Folder] C:\Users\Ryan\appdata\local\{C1025160-97AC-4825-886D-DD41B19C4A2A}
    Successfully deleted: [Empty Folder] C:\Users\Ryan\appdata\local\{C6B83F69-CA19-40EB-B774-18C43669CEAB}
    Successfully deleted: [Empty Folder] C:\Users\Ryan\appdata\local\{C85BCAF0-7EA5-4C1C-9969-358398DD3051}
    Successfully deleted: [Empty Folder] C:\Users\Ryan\appdata\local\{C8939B13-C83F-437A-B18A-8744C11A611F}
    Successfully deleted: [Empty Folder] C:\Users\Ryan\appdata\local\{C97E757D-E486-4EB0-A975-39B9DBACC38C}
    Successfully deleted: [Empty Folder] C:\Users\Ryan\appdata\local\{CA115671-3F10-47E1-9BB0-82BF12977268}
    Successfully deleted: [Empty Folder] C:\Users\Ryan\appdata\local\{CD6772C3-8542-4EB7-AE1B-6C2AB62F1531}
    Successfully deleted: [Empty Folder] C:\Users\Ryan\appdata\local\{CFC6211F-73BF-437F-8C4D-4F089226B16F}
    Successfully deleted: [Empty Folder] C:\Users\Ryan\appdata\local\{D3824225-F60C-4EE3-A309-63723500B11E}
    Successfully deleted: [Empty Folder] C:\Users\Ryan\appdata\local\{D8B581FC-BD98-46BD-B0E1-6424B1C46D7D}
    Successfully deleted: [Empty Folder] C:\Users\Ryan\appdata\local\{DC429E13-5A1B-4B07-8BAE-69DF7173DDE8}
    Successfully deleted: [Empty Folder] C:\Users\Ryan\appdata\local\{DD9B655D-F6BA-445C-991E-C9A31102024C}
    Successfully deleted: [Empty Folder] C:\Users\Ryan\appdata\local\{E738C508-CA5C-4499-96E2-8528E41BA394}
    Successfully deleted: [Empty Folder] C:\Users\Ryan\appdata\local\{E78E85AA-986F-4A8C-B128-325770917D55}
    Successfully deleted: [Empty Folder] C:\Users\Ryan\appdata\local\{E800A4BA-4FA5-46B9-97D6-0FE5D8B686D9}
    Successfully deleted: [Empty Folder] C:\Users\Ryan\appdata\local\{E96DE630-615B-4BB6-AE18-9C2721A698DA}
    Successfully deleted: [Empty Folder] C:\Users\Ryan\appdata\local\{EB89FDA7-2CF2-423C-A79D-AD4F9536B020}
    Successfully deleted: [Empty Folder] C:\Users\Ryan\appdata\local\{EBD96251-DD30-416F-9225-C2105EDA9710}
    Successfully deleted: [Empty Folder] C:\Users\Ryan\appdata\local\{ECBE5515-125B-4294-9E2E-1F835BA3795D}
    Successfully deleted: [Empty Folder] C:\Users\Ryan\appdata\local\{EF3F1F2C-91F8-47E9-8510-FB0D5A7A418A}
    Successfully deleted: [Empty Folder] C:\Users\Ryan\appdata\local\{F200F341-52B6-4965-9389-DB4C750F501F}
    Successfully deleted: [Empty Folder] C:\Users\Ryan\appdata\local\{F4FE064A-9801-4FAD-BF35-14FE65FEBC6F}
    Successfully deleted: [Empty Folder] C:\Users\Ryan\appdata\local\{F5ABEF00-109E-4346-8120-902F9590621B}
    Successfully deleted: [Empty Folder] C:\Users\Ryan\appdata\local\{FAE3077C-C2FD-4EBA-AB28-F15132E00DD7}
    Successfully deleted: [Empty Folder] C:\Users\Ryan\appdata\local\{FD498B14-D1B3-40A2-A9B1-493D2C3856AE}
    Successfully deleted: [Empty Folder] C:\Users\Ryan\appdata\local\{FD9CF471-38D5-418D-B518-836A485FE4E9}
    Successfully deleted: [Empty Folder] C:\Users\Ryan\appdata\local\{FEFB282F-D34B-4E49-B893-3A8F04533A16}



    ~~~ Event Viewer Logs were cleared





    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    Scan was completed on Thu 10/30/2014 at 21:55:17.45
    End of JRT log
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

  4. #4
    Security Expert-emeritus Juliet's Avatar
    Join Date
    Feb 2007
    Location
    Deep South
    Posts
    4,084

    Default

    What light through yonder window breaks? It is the east, and Juliet is the sun!
    LOL

    That should had helped the machine?

    Download Malwarebytes' Anti-Malware to your desktop.

    • Windows XP : Double click on the icon to run it.
    • Windows Vista, Windows 7 & 8 : Right click and select "Run as Administrator"







    • On the Dashboard click on Update Now
    • Go to the Setting Tab
    • Under Setting go to Detection and Protection
    • Under PUP and PUM make sure both are set to show Treat Dections as Malware
    • Go to Advanced setting and make sure Automatically Quarantine Detected Items is checked
    • Then on the Dashboard click on Scan
    • Make sure to select THREAT SCAN
    • Then click on Scan
    • When the scan is finished and the log pops up...select Copy to Clipboard
    • Please paste the log back into this thread for review
    • Exit Malwarebytes
    Windows Insider MVP Consumer Security 2009 - 2017
    Please do not PM me for Malware help, we all benefit from posting on the open board.

  5. #5
    Member
    Join Date
    Oct 2014
    Posts
    54

    Default

    Malwarebytes Anti-Malware
    www.malwarebytes.org

    Scan Date: 10/31/2014
    Scan Time: 4:00:11 PM
    Logfile:
    Administrator: Yes

    Version: 2.00.3.1025
    Malware Database: v2014.10.31.10
    Rootkit Database: v2014.10.22.01
    License: Free
    Malware Protection: Disabled
    Malicious Website Protection: Disabled
    Self-protection: Disabled

    OS: Windows 7 Service Pack 1
    CPU: x64
    File System: NTFS
    User: Ryan

    Scan Type: Threat Scan
    Result: Completed
    Objects Scanned: 392031
    Time Elapsed: 12 min, 51 sec

    Memory: Enabled
    Startup: Enabled
    Filesystem: Enabled
    Archives: Enabled
    Rootkits: Disabled
    Heuristics: Enabled
    PUP: Enabled
    PUM: Enabled

    Processes: 0
    (No malicious items detected)

    Modules: 0
    (No malicious items detected)

    Registry Keys: 0
    (No malicious items detected)

    Registry Values: 0
    (No malicious items detected)

    Registry Data: 0
    (No malicious items detected)

    Folders: 0
    (No malicious items detected)

    Files: 0
    (No malicious items detected)

    Physical Sectors: 0
    (No malicious items detected)


    (end)

  6. #6
    Security Expert-emeritus Juliet's Avatar
    Join Date
    Feb 2007
    Location
    Deep South
    Posts
    4,084

    Default

    Update me please how the computer is at the moment.

    What we can do now is run an online scan with Eset, for the time being it is our most trusted scanner.
    Most reliable and thorough.
    The settings I suggest will show us items located in quarantine folders so don't be alarmed with this, also, in case of a false positive I ask that you not allow it to delete what it does find.
    This scanner can take quite a bit of time to run, depending of course how full your computer is.


    Go here to run an online scannner from ESET. Windows Vista/Windows 7/Windows 8 users will need to right click on their Internet Explorer shortcut, and select Run as Administrator
    • Note:
      For browsers other than Internet Explorer, you will be prompted to download and install esetsmartinstaller_enu.exe. Click on the link and save the file to a convenient location. Double click on it to install and a new window will open. Follow the prompts.
    • Turn off the real time scanner of any existing antivirus program while performing the online scan. Here's how.
    • Click the blue Run ESET Online Scanner button
    • Tick the box next to YES, I accept the Terms of Use.
    • Click Start
    • When asked, allow the program to install the "OnlineScanner.cab" activex control by clicking the Install button
    • Once the activex control is installed, on the next screen click on Enable detection of potentially unwanted applications
    • Click on Advanced Settings
    • Make sure that the option Remove found threats is unticked.
    • Ensure these options are ticked
      • Scan archives
      • Scan for potentially unsafe applications
      • Enable Anti-Stealth technology

    • Click Start
    • Wait for the scan to finish
    • When the scan is done, if it shows a screen that says "Threats found!", then click "List of found threats", and then click "Export to text file..."
    • Save that text file on your desktop. Copy and paste the contents of that log as a reply to this topic.
    • Close the ESET online scan.


    *************************************
    Windows Insider MVP Consumer Security 2009 - 2017
    Please do not PM me for Malware help, we all benefit from posting on the open board.

  7. #7
    Member
    Join Date
    Oct 2014
    Posts
    54

    Default

    The computer seems to be running normally now and there are no longer multiple dllhost.exe *32 processes running in the task manager. I ran the ESET Online scanner and the threat list is posted below:

    C:\FRST\Quarantine\C\Users\Ryan\AppData\LocalLow\ynsvabi.dll.xBAD a variant of Win32/Kryptik.COFU trojan
    C:\Users\Ryan\AppData\LocalLow\tioxkul.dll a variant of Win32/Kryptik.COYH trojan

  8. #8
    Security Expert-emeritus Juliet's Avatar
    Join Date
    Feb 2007
    Location
    Deep South
    Posts
    4,084

    Default

    The computer seems to be running normally now and there are no longer multiple dllhost.exe *32 processes running in the task manager
    Yes!

    Open notepad. Please copy the contents of the quote box below. To do this highlight the contents of the box and right click on it and select copy.
    Paste this into the open notepad. save it to the Desktop as fixlist.txt
    NOTE. It's important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work.
    It needs to be saved Next to the "Farbar Recovery Scan Tool" (If asked to overwrite existing one please allow)

    start
    CloseProcesses:
    C:\Users\Ryan\AppData\LocalLow\tioxkul.dll
    End
    Open FRST/FRST64 and press the Fix button just once and wait.
    If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
    When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.


    After we run this last script we're ready to remove tools and quarantine folders. Just want to see this fix above before we start.
    Windows Insider MVP Consumer Security 2009 - 2017
    Please do not PM me for Malware help, we all benefit from posting on the open board.

  9. #9
    Member
    Join Date
    Oct 2014
    Posts
    54

    Default

    Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 01-11-2014
    Ran by Ryan at 2014-11-01 18:01:58 Run:2
    Running from C:\Users\Ryan\Desktop
    Loaded Profiles: UpdatusUser & Ryan (Available profiles: UpdatusUser & Ryan)
    Boot Mode: Normal
    ==============================================

    Content of fixlist:
    *****************
    start
    CloseProcesses:
    C:\Users\Ryan\AppData\LocalLow\tioxkul.dll
    End
    *****************

    Processes closed successfully.
    C:\Users\Ryan\AppData\LocalLow\tioxkul.dll => Moved successfully.


    The system needed a reboot.

    ==== End of Fixlog ====

  10. #10
    Security Expert-emeritus Juliet's Avatar
    Join Date
    Feb 2007
    Location
    Deep South
    Posts
    4,084

    Default

    • Download Delfix from here
    • Ensure Remove disinfection tools is ticked
      Also tick:
    • Create registry backup
    • Click Run
    • Purge system restore



    Any other tools and files found can simply be deleted or uninstall via Add/Remove Programs in the Control Panel etc.

    ~~~~~~~~~~~~~~~~~~~~~~~
    Your good to go, good job!

    Please take the time to read over a few of my preventive tips.

    Please navigate to Microsoft Windows Updates and download all the "Critical Updates" for Windows.



    The following programmes come highly recommended in the security community.
    • AdBlock is a browser add-on that blocks annoying banners, pop-ups and video ads.
    • CryptoPrevent places policy restrictions on loading points for ransomware (eg.CryptoPrevent), preventing your files from being encrypted.
    • Malwarebytes Anti-Exploit (MBAE) is designed to prevent zero-day malware from exploiting vulnerable software.
    • Malwarebytes Anti-Malware Premium (MBAM) works in real-time along side your Anti-Virus to prevent malware execution.
    • NoScript is a Firefox add-on that blocks the actions of malicious scripts by using whitelisting and other technology.
    • Sandboxie isolates programmes of your choice, preventing files from being written to your HDD unless approved by you.
    • Secuina PSI will scan your computer for vulnerable softwarethat is outdated, and automatically find the latest update for you.
    • SpywareBlaster is a form of passive protection, designed to block the actions of malicious websites and tracking cookies.
    • Web of Trust (WOT) is a browser add-on designed to alert you before interacting with a potentially malicious website.
    Windows Insider MVP Consumer Security 2009 - 2017
    Please do not PM me for Malware help, we all benefit from posting on the open board.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •