general/checkup [Archive] - Safer-Networking Forums

se7ered

2015-03-29, 18:39

Friend had an attack recently. I don't think it was anything serious, but i'm posting these to make sure.

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-03-2015
Ran by Mikasaurous (administrator) on IRDINOSAUR on 29-03-2015 11:03:09
Running from C:\Frst64
Loaded Profiles: Mikasaurous (Available profiles: Mikasaurous)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: English (United States)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(Creative Technology Ltd) C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(Creative Technology Ltd) C:\Windows\SysWOW64\CtHdaSvc.exe
(Avid Technology, Inc.) C:\Program Files (x86)\Digidesign\Drivers\MMERefresh.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
( ) C:\Windows\System32\lxebcoms.exe
(Avid) C:\Program Files (x86)\Avid\Mbox\AudioDevMon.exe
(Avid) C:\Program Files (x86)\Avid\Mbox Mini\AudioDevMon.exe
(Avid) C:\Program Files (x86)\Avid\Mbox Pro\AudioDevMon.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee\SiteAdvisor\mcsacore.exe
(McAfee, Inc.) C:\Windows\System32\mfevtps.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(SoftThinks SAS) C:\Program Files (x86)\AlienRespawn\SftService.exe
(DEVGURU Co., LTD.) C:\Program Files (x86)\Samsung\USB Drivers\25_escape\conn\ss_conn_service.exe
(Dell Inc.) C:\Program Files (x86)\Dell\SupportAssistAgent\bin\SupportAssistAgent.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
(McAfee, Inc.) C:\Program Files\McAfee\MSC\McAPExe.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\AMCore\mcshield.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(SoftThinks - Dell) C:\Program Files (x86)\AlienRespawn\Toaster.exe
() C:\Program Files (x86)\AlienRespawn\Components\Scheduler\STService.exe
(SoftThinks - Dell) C:\Program Files (x86)\AlienRespawn\Components\DSUpdate\DSUpd.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\BleServicesCtrl.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
() C:\Program Files (x86)\Lexmark Pro200-S500 Series\ezprint.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
() C:\Program Files (x86)\Alienware On-Screen Display\AlienwareOn-ScreenDisplay.exe
(Creative Technology Ltd) C:\Program Files (x86)\Creative\Sound Blaster Recon3Di\Sound Blaster Recon3Di Control Panel\SBRcni.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\btplayerctrl.exe
(Alienware) C:\Program Files\Alienware\Command Center\AWCCServiceController.exe
() C:\Program Files (x86)\Lexmark Pro200-S500 Series\lxebmon.exe
(Creative Technology Ltd) C:\Program Files (x86)\Creative\Sound Blaster Recon3Di\Sound Blaster Recon3Di Control Panel\CTJckCfg.exe
(Alienware) C:\Program Files\Alienware\Command Center\AlienwareAlienFXController.exe
(Alienware) C:\Program Files\Alienware\Command Center\AWCCApplicationWatcher32.exe
(Alienware) C:\Program Files\Alienware\Command Center\AWCCApplicationWatcher64.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee\SiteAdvisor\saUI.exe
(Alienware) C:\Program Files\Alienware\Command Center\AlienFusionService.exe
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(Alienware) C:\Program Files\Alienware\Command Center\AlienFusionController.exe
(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
(Dell Inc.) C:\Program Files\Dell\DellDataVault\DellDataVaultWiz.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\CSP\1.3.336.0\McCSPServiceHost.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\Platform\McUICnt.exe
(Dell Inc.) C:\Program Files\Dell\DellDataVault\DellDataVault.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2890000 2012-03-15] (Synaptics Incorporated)
HKLM\...\Run: [IntelPROSet] => C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe [4756240 2012-02-26] (Intel(R) Corporation)
HKLM\...\Run: [BLEServicesCtrl] => C:\Program Files (x86)\Intel\Bluetooth\BleServicesCtrl.exe [177936 2012-02-17] (Intel Corporation)
HKLM\...\Run: [BTMTrayAgent] => rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll",TrayApp
HKLM\...\Run: [] => [X]
HKLM\...\Run: [Command Center Controllers] => C:\Program Files\Alienware\Command Center\AWCCStartupOrchestrator.exe [12656 2012-06-15] (Alienware)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2461504 2014-09-16] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1332296 2015-01-30] (Microsoft Corporation)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-02-17] (Intel Corporation)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [285240 2012-09-01] (Intel Corporation)
HKLM-x32\...\Run: [AlienwareOn-ScreenDisplay] => C:\Program Files (x86)\Alienware On-Screen Display\AlienwareOn-ScreenDisplay.exe [1636208 2011-12-01] ()
HKLM-x32\...\Run: [Sound Blaster Recon3Di Control Panel] => c:\Program Files (x86)\Creative\Sound Blaster Recon3Di\Sound Blaster Recon3Di Control Panel\SBRcni.exe [880640 2011-12-21] (Creative Technology Ltd)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKLM\...\Policies\Explorer: [NoControlPanel] 0
HKLM\...\Policies\Explorer: [NoFolderOptions] 0
HKU\S-1-5-21-1932925490-2154617342-1019310170-1001\...\Run: [Steam] => C:\Program Files (x86)\Steam\Steam.exe [2888896 2015-03-23] (Valve Corporation)
HKU\S-1-5-21-1932925490-2154617342-1019310170-1001\...\Run: [Google Update] => C:\Users\Mikasaurous\AppData\Local\Google\Update\GoogleUpdate.exe [107912 2015-01-18] (Google Inc.)
HKU\S-1-5-21-1932925490-2154617342-1019310170-1001\...\RunOnce: [Uninstall C:\Users\Mikasaurous\AppData\Local\Microsoft\SkyDrive\17.0.2003.1112\amd64] => C:\Windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Mikasaurous\AppData\Local\Microsoft\SkyDrive\17.0.2003.1112\amd64"
HKU\S-1-5-21-1932925490-2154617342-1019310170-1001\...\RunOnce: [Uninstall C:\Users\Mikasaurous\AppData\Local\Microsoft\SkyDrive\17.0.2003.1112\fr] => C:\Windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Mikasaurous\AppData\Local\Microsoft\SkyDrive\17.0.2003.1112\fr"
HKU\S-1-5-21-1932925490-2154617342-1019310170-1001\...\RunOnce: [Uninstall C:\Users\Mikasaurous\AppData\Local\Microsoft\SkyDrive\17.0.2003.1112\ha-latn-ng] => C:\Windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Mikasaurous\AppData\Local\Microsoft\SkyDrive\17.0.2003.1112\ha-latn-ng"
HKU\S-1-5-21-1932925490-2154617342-1019310170-1001\...\RunOnce: [Uninstall C:\Users\Mikasaurous\AppData\Local\Microsoft\SkyDrive\17.0.2003.1112\hi] => C:\Windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Mikasaurous\AppData\Local\Microsoft\SkyDrive\17.0.2003.1112\hi"
HKU\S-1-5-21-1932925490-2154617342-1019310170-1001\...\RunOnce: [Uninstall C:\Users\Mikasaurous\AppData\Local\Microsoft\SkyDrive\17.0.2003.1112\hr] => C:\Windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Mikasaurous\AppData\Local\Microsoft\SkyDrive\17.0.2003.1112\hr"
HKU\S-1-5-21-1932925490-2154617342-1019310170-1001\...\MountPoints2: {37be40b8-9aa6-11e2-97fc-6036ddd7e6e5} - E:\LaunchU3.exe -a
HKU\S-1-5-21-1932925490-2154617342-1019310170-1001\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\scrnsave.scr [11264 2009-07-13] (Microsoft Corporation)
AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [177624 2015-02-05] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [164752 2015-02-05] (NVIDIA Corporation)
ShellIconOverlayIdentifiers: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => C:\Users\Mikasaurous\AppData\Local\Microsoft\OneDrive\17.3.4726.0226\amd64\FileSyncShell64.dll (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => C:\Users\Mikasaurous\AppData\Local\Microsoft\OneDrive\17.3.4726.0226\amd64\FileSyncShell64.dll (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => C:\Users\Mikasaurous\AppData\Local\Microsoft\OneDrive\17.3.4726.0226\amd64\FileSyncShell64.dll (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => C:\Users\Mikasaurous\AppData\Local\Microsoft\OneDrive\17.3.4726.0226\FileSyncShell.dll (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => C:\Users\Mikasaurous\AppData\Local\Microsoft\OneDrive\17.3.4726.0226\FileSyncShell.dll (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => C:\Users\Mikasaurous\AppData\Local\Microsoft\OneDrive\17.3.4726.0226\FileSyncShell.dll (Microsoft Corporation)
BootExecute: autocheck autochk * sdnclean64.exe
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-1932925490-2154617342-1019310170-1001\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-1932925490-2154617342-1019310170-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://dell13.msn.com
HKU\S-1-5-21-1932925490-2154617342-1019310170-1001\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://www.alienwarearena.com/welcome-us
HKU\S-1-5-21-1932925490-2154617342-1019310170-1001\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = http://www.alienwarearena.com/welcome-us
URLSearchHook: HKU\S-1-5-21-1932925490-2154617342-1019310170-1001 - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
URLSearchHook: HKU\S-1-5-21-1932925490-2154617342-1019310170-1001 - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> DefaultScope value is missing.
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-1932925490-2154617342-1019310170-1001 -> DefaultScope {D1C724C6-DB17-47D2-89DD-17176CF8898F} URL = https://search.yahoo.com/search?fr=mcafee&type=B011US105D20130305&p={searchTerms}
SearchScopes: HKU\S-1-5-21-1932925490-2154617342-1019310170-1001 -> {D1C724C6-DB17-47D2-89DD-17176CF8898F} URL = https://search.yahoo.com/search?fr=mcafee&type=B011US105D20130305&p={searchTerms}
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2015-02-10] (Microsoft Corporation)
BHO: McAfee SiteAdvisor BHO -> {B164E929-A1B6-4A06-B104-2CD0E90A88FF} -> c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll [2015-01-28] (McAfee, Inc.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\URLREDIR.DLL [2015-02-10] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2015-02-10] (Microsoft Corporation)
BHO-x32: McAfee SiteAdvisor BHO -> {B164E929-A1B6-4A06-B104-2CD0E90A88FF} -> c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll [2015-01-28] (McAfee, Inc.)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\Office15\URLREDIR.DLL [2015-02-10] (Microsoft Corporation)
Toolbar: HKLM - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll [2015-01-28] (McAfee, Inc.)
Toolbar: HKLM-x32 - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll [2015-01-28] (McAfee, Inc.)
DPF: HKLM-x32 {6C269571-C6D7-4818-BCA4-32A035E8C884} http://ccfiles.creative.com/Web/softwareupdate/su/ocx/15102/CTSUEng.cab
DPF: HKLM-x32 {D4B68B83-8710-488B-A692-D74B50BA558E} http://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab
DPF: HKLM-x32 {F6ACF75C-C32C-447B-9BEF-46B766368D29} http://ccfiles.creative.com/Web/softwareupdate/ocx/130321/CTPID.cab
Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll [2015-01-28] (McAfee, Inc.)
Handler-x32: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll [2015-01-28] (McAfee, Inc.)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2015-02-03] (Microsoft Corporation)
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll [2015-01-28] (McAfee, Inc.)
Handler-x32: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll [2015-01-28] (McAfee, Inc.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)
Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files\McAfee\MSC\McSnIePl64.dll [2015-01-13] (McAfee, Inc.)
Filter-x32: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files (x86)\McAfee\MSC\McSnIePl.dll [2015-01-13] (McAfee, Inc.)
Tcpip\Parameters: [DhcpNameServer] 209.18.47.61 209.18.47.62

FireFox:
========
FF ProfilePath: C:\Users\Mikasaurous\AppData\Roaming\Mozilla\Firefox\Profiles\lj6fllmj.default-1378494018390
FF DefaultSearchEngine: Secure Search
FF DefaultSearchEngine,S: WebSearch
FF DefaultSearchEngine.US: Google
FF DefaultSearchUrl: hxxp://websearch.searchdominion.info/?pid=22194&r=2015/02/24&hid=14286914863345694860&lg=EN&cc=US&l=1&q=
FF SearchEngineOrder.1: Secure Search
FF SearchEngineOrder.1,S: WebSearch
FF SelectedSearchEngine: Secure Search
FF SelectedSearchEngine,S: WebSearch
FF Homepage: about:home
FF Keyword.URL: https://search.yahoo.com/search?fr=mcafee&type=B111US105D20130305&p=
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_17_0_0_134.dll [2015-03-19] ()
FF Plugin: @mcafee.com/MSC,version=10 -> c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL [2015-01-13] ()
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-14] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_134.dll [2015-03-19] ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1202122.dll [2013-04-03] (Adobe Systems, Inc.)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-02-18] ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2012-02-01] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2012-02-01] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll [2015-02-01] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll [2015-02-01] (Oracle Corporation)
FF Plugin-x32: @mcafee.com/MSC,version=10 -> c:\PROGRA~2\mcafee\msc\NPMCSN~1.DLL [2015-01-13] ()
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-14] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2014-02-16] (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2015-02-05] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2015-02-05] (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll [2013-05-02] (Pando Networks)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-1932925490-2154617342-1019310170-1001: @talk.google.com/GoogleTalkPlugin -> C:\Users\Mikasaurous\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll [2015-01-27] (Google)
FF Plugin HKU\S-1-5-21-1932925490-2154617342-1019310170-1001: @talk.google.com/O1DPlugin -> C:\Users\Mikasaurous\AppData\Roaming\Mozilla\plugins\npo1d.dll [2015-01-27] (Google)
FF Plugin HKU\S-1-5-21-1932925490-2154617342-1019310170-1001: @tools.google.com/Google Update;version=3 -> C:\Users\Mikasaurous\AppData\Local\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-05] (Google Inc.)
FF Plugin HKU\S-1-5-21-1932925490-2154617342-1019310170-1001: @tools.google.com/Google Update;version=9 -> C:\Users\Mikasaurous\AppData\Local\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-05] (Google Inc.)
FF Plugin HKU\S-1-5-21-1932925490-2154617342-1019310170-1001: pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll [2013-05-02] (Pando Networks)
FF Plugin ProgramFiles/Appdata: C:\Users\Mikasaurous\AppData\Roaming\mozilla\plugins\npgoogletalk.dll [2015-01-27] (Google)
FF Plugin ProgramFiles/Appdata: C:\Users\Mikasaurous\AppData\Roaming\mozilla\plugins\npo1d.dll [2015-01-27] (Google)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\McSiteAdvisor.xml [2015-03-13]
FF HKLM-x32\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files (x86)\McAfee\SiteAdvisor
FF Extension: McAfee SiteAdvisor - C:\Program Files (x86)\McAfee\SiteAdvisor [2013-03-05]
FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK
FF Extension: McAfee Anti-Spam Thunderbird Extension - C:\Program Files\McAfee\MSK [2013-03-05]

Chrome:
=======
CHR dev: Chrome dev build detected! <======= ATTENTION
CHR HKLM\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - C:\Program Files (x86)\McAfee\SiteAdvisor\McChPlg.crx [2015-03-02]
CHR HKLM-x32\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - C:\Program Files (x86)\McAfee\SiteAdvisor\McChPlg.crx [2015-03-02]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2714800 2015-02-10] (Microsoft Corporation)
S3 Creative ALchemy AL6 Licensing Service; C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [79360 2013-02-27] (Creative Labs) [File not signed]
S3 Creative Audio Engine Licensing Service; C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [79360 2013-02-27] (Creative Labs) [File not signed]
R2 CTAudSvcService; c:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe [423424 2011-10-19] (Creative Technology Ltd) [File not signed]
R2 CtHdaSvc; C:\Windows\sysWow64\CtHdaSvc.exe [124928 2014-10-21] (Creative Technology Ltd)
R2 DellDataVault; C:\Program Files\Dell\DellDataVault\DellDataVault.exe [2557136 2015-02-26] (Dell Inc.)
R2 DellDataVaultWiz; C:\Program Files\Dell\DellDataVault\DellDataVaultWiz.exe [201936 2015-02-26] (Dell Inc.)
R2 DigiRefresh; C:\Program Files (x86)\Digidesign\Drivers\MMERefresh.exe [77824 2011-03-03] (Avid Technology, Inc.) [File not signed]
S3 digiSPTIService; C:\Program Files (x86)\Digidesign\Pro Tools\digiSPTIService.exe [159744 2011-03-02] (Avid Technology, Inc.) [File not signed]
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1149760 2014-09-16] (NVIDIA Corporation)
R2 HomeNetSvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [335064 2014-10-31] (McAfee, Inc.)
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [73728 2004-10-22] (Macrovision Corporation) [File not signed]
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [161560 2012-02-01] (Intel Corporation)
S2 lxebCATSCustConnectService; C:\Windows\system32\spool\DRIVERS\x64\3\\lxebserv.exe [45736 2010-04-14] (Lexmark International, Inc.)
R2 lxeb_device; C:\Windows\system32\lxebcoms.exe [1052328 2010-04-14] ( )
R2 lxeb_device; C:\Windows\SysWOW64\lxebcoms.exe [598696 2010-04-14] ( )
S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1080120 2015-03-17] (Malwarebytes Corporation)
R2 McAfee SiteAdvisor Service; C:\Program Files (x86)\McAfee\SiteAdvisor\McSACore.exe [155368 2015-02-19] (McAfee, Inc.)
R2 McAPExe; C:\Program Files\McAfee\MSC\McAPExe.exe [562200 2015-01-13] (McAfee, Inc.)
R2 mccspsvc; C:\Program Files\Common Files\McAfee\CSP\1.3.336.0\McCSPServiceHost.exe [422632 2014-11-21] (McAfee, Inc.)
R2 McMPFSvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [335064 2014-10-31] (McAfee, Inc.)
R2 McNaiAnn; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [335064 2014-10-31] (McAfee, Inc.)
S2 McODS; C:\Program Files\McAfee\VirusScan\mcods.exe [601864 2015-01-07] (McAfee, Inc.)
R2 mcpltsvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [335064 2014-10-31] (McAfee, Inc.)
R2 McProxy; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [335064 2014-10-31] (McAfee, Inc.)
R2 mfecore; C:\Program Files\Common Files\McAfee\AMCore\mcshield.exe [1050952 2014-11-06] (McAfee, Inc.)
R2 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [221832 2014-10-01] (McAfee, Inc.)
R2 mfevtp; C:\Windows\system32\mfevtps.exe [189920 2014-10-01] (McAfee, Inc.)
R2 MSK80Service; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [335064 2014-10-31] (McAfee, Inc.)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23784 2015-01-30] (Microsoft Corporation)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [273168 2012-02-26] ()
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [366512 2015-01-30] (Microsoft Corporation)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1796928 2014-09-16] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [19440960 2014-09-16] (NVIDIA Corporation)
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)
R2 ss_conn_service; C:\Program Files (x86)\Samsung\USB Drivers\25_escape\conn\ss_conn_service.exe [743688 2014-10-13] (DEVGURU Co., LTD.)
R2 SupportAssistAgent; C:\Program Files (x86)\Dell\SupportAssistAgent\bin\SupportAssistAgent.exe [19288 2015-03-04] (Dell Inc.)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [2669840 2012-02-26] (Intel® Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 cfwids; C:\Windows\System32\drivers\cfwids.sys [72136 2014-10-01] (McAfee, Inc.)
R3 cthda; C:\Windows\System32\drivers\cthda.sys [1066752 2014-10-21] (Creative Technology Ltd)
S3 dalwdmservice; C:\Windows\System32\drivers\dalwdm.sys [139792 2009-12-18] (Avid, Inc. All rights reserved.)
R3 DDDriver; C:\Windows\System32\drivers\DDDriver64Dcsa.sys [23760 2015-01-30] (Dell Computer Corporation)
R3 DellProf; C:\Windows\System32\drivers\DellProf.sys [23312 2015-01-30] (Dell Computer Corporation)
S3 DGUSBAP; C:\Windows\System32\DRIVERS\dgmbx2.sys [194864 2011-02-13] (Avid Technology, Inc.)
S3 HipShieldK; C:\Windows\System32\drivers\HipShieldK.sys [197704 2013-09-23] (McAfee, Inc.)
R0 iaStorF; C:\Windows\System32\drivers\iaStorF.sys [28216 2012-09-17] (Intel Corporation)
R3 IntcDAud; C:\Windows\System32\DRIVERS\IntcDAud.sys [331264 2011-12-06] (Intel(R) Corporation) [File not signed]
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-03-17] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-03-17] (Malwarebytes Corporation)
S3 MBX2DFU; C:\Windows\System32\DRIVERS\dgmbx2fu.sys [32944 2011-02-13] (Avid Technology, Inc.)
S3 MBX2MIDK; C:\Windows\System32\drivers\mbx2midk.sys [32400 2009-12-18] (Avid, Inc. All rights reserved.)
R3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [181584 2014-10-01] (McAfee, Inc.)
R3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [313680 2014-10-01] (McAfee, Inc.)
R3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [526360 2014-10-01] (McAfee, Inc.)
R0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [786304 2014-10-01] (McAfee, Inc.)
R3 mfencbdc; C:\Windows\System32\DRIVERS\mfencbdc.sys [447440 2014-09-19] (McAfee, Inc.)
S3 mfencrk; C:\Windows\System32\DRIVERS\mfencrk.sys [96600 2014-09-19] (McAfee, Inc.)
R0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [348560 2014-10-01] (McAfee, Inc.)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [274696 2014-11-15] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [124560 2014-11-15] (Microsoft Corporation)
R1 nvkflt; C:\Windows\System32\DRIVERS\nvkflt.sys [299848 2015-02-05] (NVIDIA Corporation)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [20288 2014-09-16] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [38048 2014-09-04] (NVIDIA Corporation)
R3 ST_ACCEL; C:\Windows\System32\DRIVERS\ST_ACCEL.sys [67184 2012-01-03] (STMicroelectronics)
U3 swmidi; No ImagePath

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)

==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-29 11:01 - 2015-03-29 11:03 - 00000000 ____D () C:\Frst64
2015-03-29 11:01 - 2015-03-29 11:03 - 00000000 ____D () C:\FRST
2015-03-29 10:56 - 2015-03-29 10:56 - 00000207 _____ () C:\Windows\tweaking.com-regbackup-IRDINOSAUR-Windows-7-Home-Premium-(64-bit).dat
2015-03-29 10:55 - 2015-03-29 10:55 - 00000000 ____D () C:\RegBackup
2015-03-29 10:54 - 2015-03-29 10:54 - 00002201 _____ () C:\Users\Public\Desktop\Tweaking.com - Registry Backup.lnk
2015-03-29 10:54 - 2015-03-29 10:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tweaking.com
2015-03-29 10:54 - 2015-03-29 10:54 - 00000000 ____D () C:\Program Files (x86)\Tweaking.com
2015-03-29 10:53 - 2015-03-29 10:53 - 04720448 _____ () C:\Users\Mikasaurous\Desktop\tweaking.com_registry_backup_setup.exe
2015-03-29 05:23 - 2015-03-29 10:39 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2015-03-29 05:23 - 2015-03-29 05:29 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2015-03-29 05:23 - 2015-03-29 05:23 - 00001357 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
2015-03-29 05:23 - 2015-03-29 05:23 - 00001345 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2015-03-29 05:23 - 2015-03-29 05:23 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
2015-03-29 05:23 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe
2015-03-29 05:21 - 2015-03-29 05:21 - 46525608 _____ (Safer-Networking Ltd. ) C:\Users\Mikasaurous\Downloads\spybot-2.4.exe
2015-03-29 04:52 - 2015-03-29 04:52 - 00136408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-03-29 04:51 - 2015-03-29 04:51 - 00001068 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2015-03-29 04:51 - 2015-03-29 04:51 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-03-29 04:51 - 2015-03-29 04:51 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-03-29 04:51 - 2015-03-29 04:51 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2015-03-29 04:51 - 2015-03-17 06:15 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-03-29 04:51 - 2015-03-17 06:15 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-03-29 04:51 - 2015-03-17 06:15 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-03-29 04:49 - 2015-03-29 04:50 - 21540440 _____ (Malwarebytes Corporation ) C:\Users\Mikasaurous\Downloads\mbam-setup-2.1.4.1018.exe
2015-03-29 02:05 - 2015-03-29 02:05 - 00000000 ____D () C:\AdwCleaner
2015-03-29 01:58 - 2015-03-29 01:58 - 00002079 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk
2015-03-29 01:58 - 2015-03-29 01:58 - 00001945 _____ () C:\Windows\epplauncher.mif
2015-03-29 01:58 - 2015-03-29 01:58 - 00000000 ____D () C:\Program Files\Microsoft Security Client
2015-03-29 01:58 - 2015-03-29 01:58 - 00000000 ____D () C:\Program Files (x86)\Microsoft Security Client
2015-03-29 01:56 - 2015-03-29 01:56 - 02168320 _____ () C:\Users\Mikasaurous\Downloads\adwcleaner_4.113.exe
2015-03-29 01:54 - 2015-03-29 01:54 - 14160536 _____ (Microsoft Corporation) C:\Users\Mikasaurous\Downloads\mseinstall.exe
2015-03-29 00:49 - 2015-03-29 00:49 - 00002184 _____ () C:\Users\Mikasaurous\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft OneDrive.lnk
2015-03-29 00:49 - 2015-03-29 00:49 - 00000000 ____D () C:\ProgramData\Microsoft OneDrive
2015-03-29 00:46 - 2015-03-29 00:46 - 00000000 __SHD () C:\Users\Mikasaurous\AppData\Local\EmieUserList
2015-03-29 00:46 - 2015-03-29 00:46 - 00000000 __SHD () C:\Users\Mikasaurous\AppData\Local\EmieSiteList
2015-03-29 00:46 - 2015-03-29 00:46 - 00000000 __SHD () C:\Users\Mikasaurous\AppData\Local\EmieBrowserModeList
2015-03-29 00:38 - 2015-03-29 00:38 - 00000000 ____D () C:\Users\Mikasaurous\Tracing
2015-03-22 03:29 - 2015-03-22 03:29 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-03-21 14:26 - 2015-03-21 14:26 - 00004015 _____ () C:\Users\Mikasaurous\Documents\Week One Payment Request text.txt
2015-03-21 04:24 - 2015-03-21 04:24 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_ssadadb_01005.Wdf
2015-03-21 04:18 - 2015-03-29 00:07 - 00000000 ____D () C:\Users\Mikasaurous\Documents\samsung
2015-03-21 04:18 - 2015-03-22 19:29 - 00000000 ____D () C:\Users\Mikasaurous\AppData\Roaming\Samsung
2015-03-21 04:16 - 2013-12-30 10:53 - 00144664 _____ (MAPILab Ltd. & Add-in Express Ltd.) C:\Windows\SysWOW64\secman.dll
2015-03-21 04:15 - 2015-03-22 19:29 - 00000000 ____D () C:\Program Files (x86)\Samsung
2015-03-21 04:15 - 2013-12-30 10:53 - 04659712 _____ (Dmitry Streblechenko) C:\Windows\SysWOW64\Redemption.dll
2015-03-12 00:05 - 2015-03-12 00:05 - 00000000 __HDC () C:\ProgramData\{6AACA38B-2810-4B47-BDEC-D7A1F38B1531}
2015-03-10 02:18 - 2015-03-10 02:18 - 00000000 ____D () C:\Windows\SysWOW64\NV
2015-03-10 02:18 - 2015-03-10 02:18 - 00000000 ____D () C:\Windows\system32\NV
2015-03-10 02:18 - 2015-02-05 12:57 - 00621384 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe
2015-03-10 02:16 - 2015-02-05 16:01 - 32106640 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll
2015-03-10 02:16 - 2015-02-05 16:01 - 25460880 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll
2015-03-10 02:16 - 2015-02-05 16:01 - 24768144 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll
2015-03-10 02:16 - 2015-02-05 16:01 - 20466496 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll
2015-03-10 02:16 - 2015-02-05 16:01 - 18575880 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll
2015-03-10 02:16 - 2015-02-05 16:01 - 17253848 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll
2015-03-10 02:16 - 2015-02-05 16:01 - 16017040 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll
2015-03-10 02:16 - 2015-02-05 16:01 - 13294528 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll
2015-03-10 02:16 - 2015-02-05 16:01 - 13208200 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll
2015-03-10 02:16 - 2015-02-05 16:01 - 10773704 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll
2015-03-10 02:16 - 2015-02-05 16:01 - 10713256 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll
2015-03-10 02:16 - 2015-02-05 16:01 - 10284872 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys
2015-03-10 02:16 - 2015-02-05 16:01 - 03610768 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll
2015-03-10 02:16 - 2015-02-05 16:01 - 03247248 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll
2015-03-10 02:16 - 2015-02-05 16:01 - 02902784 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvapi.dll
2015-03-10 02:16 - 2015-02-05 16:01 - 01895240 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6434752.dll
2015-03-10 02:16 - 2015-02-05 16:01 - 01557648 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6434752.dll
2015-03-10 02:16 - 2015-02-05 16:01 - 00969872 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll
2015-03-10 02:16 - 2015-02-05 16:01 - 00943760 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll
2015-03-10 02:16 - 2015-02-05 16:01 - 00929936 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll
2015-03-10 02:16 - 2015-02-05 16:01 - 00908104 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll
2015-03-10 02:16 - 2015-02-05 16:01 - 00496272 _____ (NVIDIA Corporation) C:\Windows\system32\nvEncodeAPI64.dll
2015-03-10 02:16 - 2015-02-05 16:01 - 00399504 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvEncodeAPI.dll
2015-03-10 02:16 - 2015-02-05 16:01 - 00390472 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFROpenGL.dll
2015-03-10 02:16 - 2015-02-05 16:01 - 00353224 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll
2015-03-10 02:16 - 2015-02-05 16:01 - 00345744 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFROpenGL.dll
2015-03-10 02:16 - 2015-02-05 16:01 - 00305136 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll
2015-03-10 02:16 - 2015-02-05 16:01 - 00299848 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvkflt.sys
2015-03-10 02:16 - 2015-02-05 16:01 - 00031376 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvpciflt.sys
2015-03-05 21:22 - 2015-03-05 21:22 - 00000000 ____D () C:\Users\Mikasaurous\AppData\Local\UnrealEngineLauncher
2015-03-05 21:22 - 2010-02-04 11:01 - 00024920 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_7.dll
2015-03-05 21:22 - 2007-04-04 19:54 - 00107368 _____ (Microsoft Corporation) C:\Windows\system32\xinput1_3.dll
2015-03-05 21:21 - 2015-03-05 21:21 - 00001200 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Epic Games Launcher.lnk
2015-03-05 21:21 - 2015-03-05 21:21 - 00001188 _____ () C:\Users\Public\Desktop\Epic Games Launcher.lnk
2015-03-05 21:18 - 2015-03-05 21:18 - 63463424 _____ () C:\Users\Mikasaurous\Downloads\EpicGamesLauncherInstaller-2.0.1-2467307.msi
2015-03-05 21:07 - 2015-03-05 21:08 - 107836956 _____ () C:\Users\Mikasaurous\Downloads\fmodstudio10513win-installer.exe
2015-03-03 18:47 - 2015-03-03 18:47 - 00000000 ____D () C:\Users\Mikasaurous\AppData\Local\EpicGamesLauncher
2015-03-03 18:45 - 2015-03-05 21:22 - 00000000 ____D () C:\ProgramData\Epic
2015-03-03 18:45 - 2015-03-03 18:45 - 00000000 ____D () C:\Program Files\Epic Games
2015-03-03 12:30 - 2015-03-03 12:30 - 00000000 ____D () C:\Users\Public\Creative
2015-03-03 12:24 - 2015-01-08 18:44 - 00419936 _____ () C:\Windows\SysWOW64\locale.nls
2015-03-03 12:24 - 2015-01-08 18:43 - 00419936 _____ () C:\Windows\system32\locale.nls
2015-03-03 12:13 - 2015-01-08 22:14 - 00950272 _____ (Microsoft Corporation) C:\Windows\system32\perftrack.dll
2015-03-03 12:13 - 2015-01-08 22:14 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\wdi.dll
2015-03-03 12:13 - 2015-01-08 22:14 - 00029696 _____ (Microsoft Corporation) C:\Windows\system32\powertracker.dll
2015-03-03 12:13 - 2015-01-08 21:48 - 00076800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdi.dll
2015-03-02 23:16 - 2015-03-02 23:16 - 00000248 _____ () C:\ProgramData\lxebDiagnostics.log

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-29 11:03 - 2015-01-18 00:48 - 00000932 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1932925490-2154617342-1019310170-1001UA.job
2015-03-29 10:45 - 2013-03-05 21:34 - 00000000 ____D () C:\Users\Mikasaurous
2015-03-29 10:37 - 2013-02-27 13:57 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-03-29 07:08 - 2013-02-27 15:50 - 01382232 _____ () C:\Windows\WindowsUpdate.log
2015-03-29 05:23 - 2009-07-13 23:45 - 00021296 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-03-29 05:23 - 2009-07-13 23:45 - 00021296 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-03-29 05:19 - 2009-07-14 00:13 - 00006432 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-03-29 05:15 - 2013-07-13 13:55 - 00000000 ____D () C:\Program Files (x86)\Steam
2015-03-29 05:14 - 2013-12-27 12:04 - 00000000 ____D () C:\Program Files (x86)\AlienRespawn
2015-03-29 05:14 - 2013-09-02 16:16 - 00010177 _____ () C:\ProgramData\lxebscan.log
2015-03-29 05:13 - 2013-02-27 14:36 - 00000000 ____D () C:\Users\Default\AppData\Local\SoftThinks
2015-03-29 05:13 - 2013-02-27 14:36 - 00000000 ____D () C:\Users\Default User\AppData\Local\SoftThinks
2015-03-29 05:13 - 2009-07-14 00:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-03-29 05:13 - 2009-07-13 23:51 - 00071335 _____ () C:\Windows\setupact.log
2015-03-29 05:12 - 2013-02-27 14:25 - 00000000 ____D () C:\ProgramData\NVIDIA
2015-03-29 05:12 - 2013-02-27 14:24 - 00000000 ____D () C:\Windows\nvmup
2015-03-29 05:12 - 2010-11-20 22:47 - 00272290 _____ () C:\Windows\PFRO.log
2015-03-29 04:42 - 2013-05-02 14:10 - 00000000 ____D () C:\Users\Mikasaurous\AppData\Local\PMB Files
2015-03-29 02:08 - 2013-04-17 22:53 - 00000000 ____D () C:\Users\Mikasaurous\AppData\Roaming\Skype
2015-03-29 01:32 - 2013-03-05 22:17 - 00000000 ____D () C:\Program Files (x86)\McAfee
2015-03-29 00:38 - 2014-04-01 23:44 - 00000000 ___RD () C:\Program Files (x86)\Skype
2015-03-29 00:38 - 2013-04-17 22:53 - 00000000 ____D () C:\ProgramData\Skype
2015-03-29 00:07 - 2014-05-06 20:54 - 00000000 ____D () C:\Users\Mikasaurous\Documents\Interview Info
2015-03-28 20:56 - 2015-02-10 21:07 - 00003504 _____ () C:\Windows\System32\Tasks\PCDEventLauncherTask
2015-03-28 20:51 - 2015-01-18 00:48 - 00000880 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1932925490-2154617342-1019310170-1001Core.job
2015-03-26 17:53 - 2015-02-12 12:05 - 00000000 ____D () C:\ProgramData\SupportAssistAgent
2015-03-22 19:29 - 2014-05-06 20:53 - 00000000 ____D () C:\ProgramData\Samsung
2015-03-19 05:17 - 2013-03-06 21:31 - 00000000 ____D () C:\Users\Mikasaurous\AppData\Local\Adobe
2015-03-19 05:15 - 2013-02-27 13:57 - 00778928 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-03-19 05:15 - 2013-02-27 13:57 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-03-19 05:15 - 2013-02-27 13:57 - 00003768 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-03-13 15:37 - 2013-11-11 01:54 - 00000000 ____D () C:\Program Files\Microsoft Office 15
2015-03-12 00:05 - 2015-02-12 12:06 - 00003608 _____ () C:\Windows\System32\Tasks\Dell SupportAssistAgent AutoUpdate
2015-03-10 02:19 - 2013-02-27 14:45 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
2015-03-10 02:19 - 2013-02-27 14:31 - 00000000 ____D () C:\Temp
2015-03-07 18:59 - 2014-10-03 20:10 - 00000000 ____D () C:\Users\Mikasaurous\Desktop\Phone Stuff 10-3
2015-03-06 19:55 - 2009-07-13 22:20 - 00000000 ____D () C:\Windows\rescache
2015-03-06 17:52 - 2013-09-02 16:18 - 00000000 ____D () C:\ProgramData\Lx_cats
2015-03-05 22:33 - 2013-09-02 16:18 - 00007394 _____ () C:\ProgramData\lxeb.log
2015-03-05 21:22 - 2014-03-28 22:30 - 00033221 _____ () C:\Windows\DirectX.log
2015-03-05 20:58 - 2015-02-25 12:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee
2015-03-05 20:58 - 2013-05-02 14:10 - 00000000 ____D () C:\ProgramData\PMB Files
2015-03-05 20:58 - 2009-07-13 22:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
2015-03-05 20:58 - 2009-07-13 22:20 - 00000000 ____D () C:\Windows\security
2015-03-05 20:57 - 2009-07-13 22:20 - 00000000 ____D () C:\Windows\registration
2015-03-05 20:57 - 2009-07-13 22:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2015-03-05 20:55 - 2013-02-27 15:49 - 00000000 ____D () C:\Program Files (x86)\Intel
2015-03-05 20:55 - 2013-02-27 14:11 - 00000000 ____D () C:\Program Files\Intel
2015-03-03 16:12 - 2013-02-27 15:49 - 00000000 ____D () C:\Intel
2015-03-03 12:28 - 2009-07-13 22:20 - 00000000 ____D () C:\Windows\tracing
2015-03-03 12:14 - 2009-07-13 22:20 - 00000000 ____D () C:\Program Files\Common Files\Microsoft Shared
2015-03-03 08:17 - 2010-11-20 22:27 - 00295552 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2015-03-02 23:16 - 2013-12-16 01:58 - 00000000 ____D () C:\ProgramData\Lexmark Pro200-S500 Series
2015-02-27 15:39 - 2015-02-24 15:08 - 00000000 ____D () C:\ProgramData\{24eb61e4-9630-47d0-24eb-b61e49638792}
2015-02-27 15:39 - 2015-02-24 14:57 - 00000000 ____D () C:\ProgramData\{1d137714-51ec-5586-1d13-3771451edc51}
2015-02-27 15:39 - 2015-02-24 14:53 - 00000000 ____D () C:\ProgramData\{6847f59c-49da-3d51-6847-7f59c49dd671}

==================== Files in the root of some directories =======

2014-03-24 20:32 - 2014-11-21 01:32 - 0006656 _____ () C:\Users\Mikasaurous\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-12-16 01:58 - 2013-12-16 01:58 - 0000000 _____ () C:\ProgramData\cmn_upld.log
2013-09-02 16:18 - 2013-09-02 16:18 - 0000252 _____ () C:\ProgramData\FastPics.log
2013-09-02 16:18 - 2015-03-05 22:33 - 0007394 _____ () C:\ProgramData\lxeb.log
2015-03-02 23:16 - 2015-03-02 23:16 - 0000248 _____ () C:\ProgramData\lxebDiagnostics.log
2013-09-02 16:20 - 2013-12-16 01:58 - 0005070 _____ () C:\ProgramData\lxebJSW.log
2013-09-02 16:16 - 2015-03-29 05:14 - 0010177 _____ () C:\ProgramData\lxebscan.log
2013-12-16 01:58 - 2013-12-16 01:58 - 0000000 _____ () C:\ProgramData\LxWbGwLog.log
2014-10-04 22:30 - 2014-10-04 22:30 - 7106999 _____ () C:\ProgramData\SPL8303.tmp
2013-09-02 16:10 - 2013-09-02 16:10 - 0000000 _____ () C:\ProgramData\UpdaterLog.txt

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2015-03-29 06:22

==================== End Of Log ============================

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 11-03-2015
Ran by Mikasaurous at 2015-03-29 11:03:42
Running from C:\Frst64
Boot Mode: Normal
==========================================================

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Microsoft Security Essentials (Enabled - Up to date) {B7ECF8CD-0188-6703-DBA4-AA65C6ACFB0A}
AV: McAfee Anti-Virus and Anti-Spyware (Enabled - Up to date) {DA9F8ED0-D0DE-39CC-F55A-51AB4CC1B556}
AS: Microsoft Security Essentials (Enabled - Up to date) {0C8D1929-27B2-688D-E114-9117BD2BB1B7}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Up to date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
AS: McAfee Anti-Virus and Anti-Spyware (Enabled - Up to date) {61FE6F34-F6E4-3642-CFEA-6AD93746FFEB}
FW: McAfee Firewall (Enabled) {E2A40FF5-9AB1-3894-DE05-F89EB212F22D}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Flash Player 16 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Flash Player 17 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 17.0.0.134 - Adobe Systems Incorporated)
Adobe Reader X (10.1.13) MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}) (Version: 10.1.13 - Adobe Systems Incorporated)
Adobe Shockwave Player 12.0 (HKLM-x32\...\Adobe Shockwave Player) (Version: 12.0.2.122 - Adobe Systems, Inc.)
Advanced Audio FX Engine (HKLM-x32\...\Advanced Audio FX Engine) (Version: 1.12.05 - Creative Technology Ltd)
Alice: Madness Returns (HKLM-x32\...\Steam App 19680) (Version: - Spicy Horse Games)
AlienRespawn - Support Software (HKLM-x32\...\{A9668246-FB70-4103-A1E3-66C9BC2EFB49}) (Version: 9.4.67 - Alienware)
AlienRespawn (HKLM-x32\...\{0ED7EE95-6A97-47AA-AD73-152C08A15B04}) (Version: 9.4.67 - Alienware)
Alienware Command Center (HKLM-x32\...\InstallShield_{FD1AE10F-163C-4D4B-9FCE-AC667AF1DC6E}) (Version: 2.8.8.0 - Alienware Corp.)
Alienware Command Center (Version: 2.8.8.0 - Alienware Corp.) Hidden
Alienware On-Screen Display (HKLM-x32\...\InstallShield_{0D69462F-99CC-4F8D-942E-666E21CE59F8}) (Version: 0.32.0.2C - )
Alienware On-Screen Display (x32 Version: 0.32.0.2C - ) Hidden
Apple Application Support (HKLM-x32\...\{83CAF0DE-8D3B-4C37-A631-2B8F16EC3031}) (Version: 3.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{BDD99690-3541-4619-9D2A-3CDDB3E15F9E}) (Version: 8.0.5.6 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Avid Audio Drivers (x64) (HKLM\...\{2F227ACA-204C-4529-BA33-D095C42C72DB}) (Version: 8.0.5 - Avid Technology)
Avid Mbox Driver 1.0.19 (x64) (HKLM\...\{282EA548-CEF6-4014-96B4-CC06C58A5E88}) (Version: 1.0.19 - Avid)
Avid Mbox Mini Driver 1.0.6 (x64) (HKLM\...\{B9F2C1A5-4080-4F9B-B3EA-A182DAD69A85}) (Version: 1.0.6 - Avid)
Avid Mbox Pro Driver 1.0.11 (x64) (HKLM\...\{62C2B2D5-8650-4889-8FF2-4479532F9397}) (Version: 1.0.11 - Avid)
Avid Pro Tools Creative Collection 8.0.5 (HKLM-x32\...\{3BB2CF34-1FC8-46E2-9D64-4A8D1D577549}) (Version: 8.0.5 - Avid Technology, Inc.)
Avid Pro Tools LE 8.0.5 (HKLM-x32\...\{409A13BD-5F3E-442B-BA7B-A1E32B2D8927}) (Version: 8.0.5 - Avid Technology, Inc.)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Borderlands 2 (HKLM-x32\...\Steam App 49520) (Version: - Gearbox Software)
Borderlands: The Pre-Sequel (HKLM-x32\...\Steam App 261640) (Version: - 2K Australia)
DC Universe Online (HKLM-x32\...\Steam App 24200) (Version: - Sony Online Entertainment)
DC Universe Online (HKU\S-1-5-21-1932925490-2154617342-1019310170-1001\...\SOE-DC Universe Online) (Version: 1.0.3.183 - Sony Online Entertainment)
DC Universe Online Live (HKU\S-1-5-21-1932925490-2154617342-1019310170-1001\...\SOE-DC Universe Online Live) (Version: - Sony Online Entertainment)
Dell Data Vault (Version: 4.2.2.0 - Dell Inc.) Hidden
Dell SupportAssist (HKLM\...\PC-Doctor for Windows) (Version: 1.0.6584.52 - Dell)
Dell SupportAssistAgent (HKLM-x32\...\{287348C8-8B47-4C36-AF28-441A3B7D8722}) (Version: 1.0.2.57295 - Dell)
Digidesign ElevenRack Driver 1.0.8 (x64) (HKLM\...\{DFE96CF0-A611-40C4-AE24-2E4C21E3FF3E}) (Version: 1.0.8 - Digidesign)
EMSC (x32 Version: 0.0.0.22C - Compal Electronics, Inc.) Hidden
Epic Games Launcher (HKLM\...\{325AC861-EDAF-440B-97DD-259906E216D3}) (Version: 1.1.24.0 - Epic Games, Inc.)
Free DigiRack Plug-Ins 8.0.5 (HKLM-x32\...\{A24C2C43-4312-493E-96B3-5D1DCE24DEBF}) (Version: 8.0.5 - Avid Technology, Inc.)
Google Talk Plugin (HKLM-x32\...\{C77CC230-7417-3F01-B70D-52583DC9FEC9}) (Version: 5.40.2.0 - Google)
H1Z1 (HKLM-x32\...\Steam App 295110) (Version: - Sony Online Entertainment)
Integrated Webcam Live! Central (HKLM-x32\...\Integrated Webcam Live! Central) (Version: 2.01.18 - Creative Technology Ltd)
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1008 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.0.1.1399 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2653 - Intel Corporation)
Intel(R) PROSet/Wireless for Bluetooth(R) + High Speed (HKLM\...\{37EC048A-81A2-452A-8D1F-3BE2018E767D}) (Version: 15.1.0.0096 - Intel Corporation)
Intel(R) PROSet/Wireless Software for Bluetooth(R) Technology (HKLM\...\{520C4DD4-2BC7-409B-BA48-E1A4F832662D}) (Version: 2.1.0.0140 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.6.0.1030 - Intel Corporation)
Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 1.0.3.214 - Intel Corporation)
Intel® PROSet/Wireless WiFi Software (HKLM\...\{E97F409F-9E1C-42A0-B72D-765A78DF3696}) (Version: 15.01.0000.0830 - Intel Corporation)
Intel® Trusted Connect Service Client (HKLM\...\{538B98C3-773F-4F20-9C66-802D104DCBE2}) (Version: 1.23.219.2 - Intel Corporation)
Interlok driver setup x64 (HKLM\...\{25613C10-27D2-410B-942B-D922D5C3A7BE}) (Version: 5.8.13 - PACE Anti-Piracy)
iTunes (HKLM\...\{2ABBBD91-91E5-4AD7-929A-FE15D1DC0576}) (Version: 12.0.1.26 - Apple Inc.)
Java 8 Update 31 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218031F0}) (Version: 8.0.310 - Oracle Corporation)
League of Legends (HKLM-x32\...\League of Legends 3.0.0) (Version: 3.0.0 - Riot Games)
League of Legends (x32 Version: 3.0.0 - Riot Games) Hidden
Lexmark Pro200-S500 Series (HKLM\...\Lexmark Pro200-S500 Series) (Version: - Lexmark International, Inc.)
Malwarebytes Anti-Malware version 2.1.4.1018 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.4.1018 - Malwarebytes Corporation)
McAfee SecurityCenter (HKLM-x32\...\MSC) (Version: 13.6.1529 - McAfee, Inc.)
McAfee SiteAdvisor (HKLM-x32\...\{35ED3F83-4BDC-4c44-8EC6-6A8301C7413A}) (Version: 3.7.194 - McAfee, Inc.)
MelodyneEssential 1.8 (HKLM-x32\...\{9A17B0B6-AD89-4321-99E6-09D9ABFA254D}) (Version: 1.08.0103 - Celemony Software GmbH)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Office 365 - en-us (HKLM\...\O365HomePremRetail - en-us) (Version: 15.0.4701.1002 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-1932925490-2154617342-1019310170-1001\...\OneDriveSetup.exe) (Version: 17.3.4726.0226 - Microsoft Corporation)
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.7.205.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{A49F249F-0C91-497F-86DF-B2585E8E76B7}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{820B6609-4C97-3A2B-B644-573B06A0F0CC}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Mozilla Firefox 36.0.4 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 36.0.4 (x86 en-US)) (Version: 36.0.4 - Mozilla)
NVIDIA 3D Vision Driver 347.52 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 347.52 - NVIDIA Corporation)
NVIDIA GeForce Experience 2.1.2 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.1.2 - NVIDIA Corporation)
NVIDIA Graphics Driver 347.52 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 347.52 - NVIDIA Corporation)
NVIDIA HD Audio Driver 1.3.33.0 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.33.0 - NVIDIA Corporation)
NVIDIA PhysX System Software 9.14.0702 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.14.0702 - NVIDIA Corporation)
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4701.1002 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4701.1002 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4701.1002 - Microsoft Corporation) Hidden
Pando Media Booster (HKLM-x32\...\{980A182F-E0A2-4A40-94C1-AE0C1235902E}) (Version: 2.6.0.9 - Pando Networks Inc.)
QualxServ Service Agreement (HKLM-x32\...\{18401E1E-1E44-461A-A4B2-E48B1A727818}) (Version: 2.0.0 - Dell Inc.)
QuickTime 7 (HKLM-x32\...\{3D2CBC2C-65D4-4463-87AB-BB2C859C1F3E}) (Version: 7.76.80.95 - Apple Inc.)
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.49.0 - SAMSUNG Electronics Co., Ltd.)
Shared C Run-time for x64 (HKLM\...\{EF79C448-6946-4D71-8134-03407888C054}) (Version: 10.0.0 - McAfee)
SHIELD Streaming (Version: 3.1.200 - NVIDIA Corporation) Hidden
SHIELD Wireless Controller Driver (Version: 16.13.42 - NVIDIA Corporation) Hidden
Skype™ 7.2 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.2.103 - Skype Technologies S.A.)
Sound Blaster Recon3Di (HKLM-x32\...\{C8AAFCDC-CD3A-40AD-9FA9-07FB70F08224}) (Version: 1.00.08 - Creative Technology Limited)
Sound Blaster Recon3Di Extras (HKLM-x32\...\{C45E715E-442E-4D82-BD46-A08A0870957C}) (Version: 1.0 - Creative Technology Limited)
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.4.40 - Safer-Networking Ltd.)
ST Microelectronics 3 Axis Digital Accelerometer Solution (HKLM-x32\...\{9C24F411-9CA7-4A8A-91F3-F08A4A38EB31}) (Version: 4.12.0018 - ST Microelectronics)
Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 16.0.4.0 - Synaptics Incorporated)
The Walking Dead (HKLM-x32\...\Steam App 207610) (Version: - )
Tomb Raider: Anniversary (HKLM-x32\...\Steam App 8000) (Version: - Crystal Dynamics)
Torchlight II (HKLM-x32\...\Steam App 200710) (Version: - Runic Games)
Torq LE 1.0.7 (Build 017 - 03 Oct 2008) (HKLM-x32\...\Torq LE_is1) (Version: - M-Audio)
Tweaking.com - Registry Backup (HKLM-x32\...\Tweaking.com - Registry Backup) (Version: 2.2.0 - Tweaking.com)
Ventrilo Client (HKLM-x32\...\{789289CA-F73A-4A16-A331-54D498CE069F}) (Version: 3.0.8 - Flagship Industries, Inc.)
World of Warcraft (HKLM-x32\...\World of Warcraft) (Version: - Blizzard Entertainment)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-1932925490-2154617342-1019310170-1001_Classes\CLSID\{5AB7172C-9C11-405C-8DD5-AF20F3606282}\InprocServer32 -> C:\Users\Mikasaurous\AppData\Local\Microsoft\OneDrive\17.3.4726.0226\amd64\FileSyncShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1932925490-2154617342-1019310170-1001_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32 -> C:\Users\Mikasaurous\AppData\Local\Microsoft\OneDrive\17.3.4726.0226\amd64\FileSyncShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1932925490-2154617342-1019310170-1001_Classes\CLSID\{A78ED123-AB77-406B-9962-2A5D9D2F7F30}\InprocServer32 -> C:\Users\Mikasaurous\AppData\Local\Microsoft\OneDrive\17.3.4726.0226\amd64\FileSyncShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1932925490-2154617342-1019310170-1001_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32 -> C:\Users\Mikasaurous\AppData\Local\Microsoft\OneDrive\17.3.4726.0226\amd64\FileSyncShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1932925490-2154617342-1019310170-1001_Classes\CLSID\{C3BC25C0-FCD3-4F01-AFDD-41373F017C9A}\InprocServer32 -> C:\Users\Mikasaurous\AppData\Local\Google\Update\1.3.26.9\psuser_64.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-1932925490-2154617342-1019310170-1001_Classes\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32 -> C:\Users\Mikasaurous\AppData\Local\Microsoft\OneDrive\17.3.4726.0226\amd64\FileSyncShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1932925490-2154617342-1019310170-1001_Classes\CLSID\{D0336C0B-7919-4C04-8CCE-2EBAE2ECE8C9}\InprocServer32 -> C:\Users\Mikasaurous\AppData\Local\Google\Update\1.3.25.11\psuser_64.dll No File
CustomCLSID: HKU\S-1-5-21-1932925490-2154617342-1019310170-1001_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\Mikasaurous\AppData\Local\Google\Update\1.3.26.9\psuser_64.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-1932925490-2154617342-1019310170-1001_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 -> C:\Users\Mikasaurous\AppData\Local\Microsoft\OneDrive\17.3.4726.0226\amd64\FileSyncShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1932925490-2154617342-1019310170-1001_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\Mikasaurous\AppData\Local\Microsoft\OneDrive\17.3.4726.0226\amd64\FileSyncApi64.dll (Microsoft Corporation)

==================== Restore Points =========================

21-03-2015 04:14:33 Installed Samsung Kies
22-03-2015 19:28:34 Removed Samsung Kies
29-03-2015 02:02:44 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-13 21:34 - 2009-06-10 16:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {24C4EA2C-4950-4B0A-8C2C-BBFA3B296986} - System32\Tasks\{90BDD434-7727-4056-82CF-AFF71D34C77A} => pcalua.exe -a C:\Users\Mikasaurous\Desktop\Setup.exe -d C:\Users\Mikasaurous\Desktop
Task: {569EE759-8610-48C2-8AD1-1A11BC32B7D4} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1932925490-2154617342-1019310170-1001Core => C:\Users\Mikasaurous\AppData\Local\Google\Update\GoogleUpdate.exe [2015-01-18] (Google Inc.)
Task: {5EC2E794-7D8A-4CD8-9491-1C4A7B2CD6C3} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonx86\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe [2015-02-10] (Microsoft Corporation)
Task: {7B939CAA-8629-46D4-8901-2A798B38A452} - System32\Tasks\PCDEventLauncherTask => C:\Program Files\Alienware\SupportAssist\sessionchecker.exe [2015-02-03] (PC-Doctor, Inc.)
Task: {93E3EB30-2D2C-4B6D-9B73-57CA9D47239C} - System32\Tasks\{F9CAB6E3-8B7F-499C-817D-63F4D79B3920} => pcalua.exe -a C:\Users\MIKASA~1\AppData\Local\Temp\030546fb-774d-45dd-bbcf-e279d84416bb\vcredist_x64.exe -d "C:\Program Files (x86)\InstallShield Installation Information\{409A13BD-5F3E-442B-BA7B-A1E32B2D8927}\Digidesign Audio Drivers" -c /q:a /c:"vcredist_x64.exe /q:a /c:""msiexec /i vcredist.msi /qb"" "
Task: {96CFF7EA-E22B-410C-A979-1B6D48781957} - System32\Tasks\Dell SupportAssistAgent AutoUpdate => C:\Program Files (x86)\Dell\SupportAssistAgent\bin\SupportAssist.exe [2015-03-04] (Dell Inc.)
Task: {AA685195-951F-4EE6-AF66-A9EC080D06ED} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1932925490-2154617342-1019310170-1001UA => C:\Users\Mikasaurous\AppData\Local\Google\Update\GoogleUpdate.exe [2015-01-18] (Google Inc.)
Task: {B4EA5DEE-40C9-4444-AAFE-72C17628CD09} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-02-10] (Microsoft Corporation)
Task: {B6BF1B7B-5D62-4B24-AE01-7351EB9ACD57} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {B91BFC0B-DAB4-4B9D-A768-5091FDF8084D} - System32\Tasks\{9C06221C-1B6C-41F5-90F6-664DEF77FE6F} => Firefox.exe http://ui.skype.com/ui/0/6.5.0.158/en/go/help.faq.installer?source=lightinstaller&LastError=1618
Task: {CC2CA3E5-F0FF-4C6E-A244-F9F525DAE9EA} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-03-19] (Adobe Systems Incorporated)
Task: {D0776D47-C51A-4D34-BA77-F08944A71262} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-02-10] (Microsoft Corporation)
Task: {DF001770-263B-471B-B373-F82BA22507E5} - System32\Tasks\SystemToolsDailyTest => uaclauncher.exe
Task: {F263BCE9-10F8-47B7-AAD6-156AB0E7212B} - System32\Tasks\PCDoctorBackgroundMonitorTask => C:\Program Files\Alienware\SupportAssist\uaclauncher.exe [2015-02-03] (PC-Doctor, Inc.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1932925490-2154617342-1019310170-1001Core.job => C:\Users\Mikasaurous\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1932925490-2154617342-1019310170-1001UA.job => C:\Users\Mikasaurous\AppData\Local\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) ==============

2013-02-27 14:24 - 2015-02-05 16:01 - 00012104 _____ () C:\Program Files\NVIDIA Corporation\CoProcManager\detoured.dll
2013-02-27 14:25 - 2015-02-05 14:07 - 00117576 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2013-09-02 16:16 - 2009-11-04 09:17 - 00189440 _____ () C:\Windows\system32\spool\PRTPROCS\x64\lxebdrpp.dll
2014-03-21 22:06 - 2014-05-20 08:19 - 00105640 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
2015-03-13 15:34 - 2015-01-27 10:29 - 08898720 _____ () C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\1033\GrooveIntlResource.dll
2013-12-27 12:04 - 2012-01-26 22:49 - 02751808 ____N () C:\Program Files (x86)\AlienRespawn\COMPONENTS\SCHEDULER\STSERVICE.EXE
2013-02-27 15:36 - 2012-02-14 12:53 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2013-09-02 16:12 - 2009-10-01 10:45 - 00139944 _____ () C:\Program Files (x86)\Lexmark Pro200-S500 Series\ezprint.exe
2011-12-01 21:00 - 2011-12-01 21:00 - 01636208 _____ () C:\Program Files (x86)\Alienware On-Screen Display\AlienwareOn-ScreenDisplay.exe
2013-09-02 16:12 - 2011-01-23 21:00 - 00770728 _____ () C:\Program Files (x86)\Lexmark Pro200-S500 Series\lxebmon.exe
2014-10-11 14:06 - 2014-10-11 14:06 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2014-10-11 14:05 - 2014-10-11 14:05 - 01044776 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2013-02-27 14:24 - 2015-02-05 16:01 - 00011920 _____ () C:\Program Files (x86)\NVIDIA Corporation\CoProcManager\detoured.dll
2013-09-02 16:12 - 2009-03-30 07:37 - 00708608 _____ () C:\Program Files (x86)\Lexmark Pro200-S500 Series\Epwizard.DLL
2013-09-02 16:12 - 2009-03-30 07:35 - 00159744 _____ () C:\Program Files (x86)\Lexmark Pro200-S500 Series\customui.dll
2013-09-02 16:12 - 2009-03-30 07:35 - 00118784 _____ () C:\Program Files (x86)\Lexmark Pro200-S500 Series\Eputil.DLL
2013-09-02 16:12 - 2009-03-30 07:35 - 00139264 _____ () C:\Program Files (x86)\Lexmark Pro200-S500 Series\Imagutil.DLL
2013-09-02 16:12 - 2009-03-30 07:35 - 00061440 _____ () C:\Program Files (x86)\Lexmark Pro200-S500 Series\Epfunct.DLL
2013-09-02 16:12 - 2010-04-05 06:56 - 02203803 _____ () C:\Program Files (x86)\Lexmark Pro200-S500 Series\EPWizRes.dll
2013-09-02 16:12 - 2009-03-30 07:37 - 00045056 _____ () C:\Program Files (x86)\Lexmark Pro200-S500 Series\epstring.dll
2013-09-02 16:12 - 2009-03-30 07:37 - 00094208 _____ () C:\Program Files (x86)\Lexmark Pro200-S500 Series\EPOEMDll.dll
2013-09-02 16:12 - 2009-04-07 15:25 - 00409600 _____ () C:\Program Files (x86)\Lexmark Pro200-S500 Series\iptk.dll
2013-09-02 16:12 - 2009-03-02 10:25 - 00151552 _____ () C:\Program Files (x86)\Lexmark Pro200-S500 Series\lxebptp.dll
2009-12-18 12:07 - 2009-12-18 12:07 - 00577536 _____ () C:\Program Files (x86)\Alienware On-Screen Display\EMSC.dll
2013-09-02 16:12 - 2010-04-01 13:23 - 00389120 _____ () C:\Program Files (x86)\Lexmark Pro200-S500 Series\lxebscw.dll
2013-09-02 16:12 - 2009-05-27 08:16 - 00192512 _____ () C:\Program Files (x86)\Lexmark Pro200-S500 Series\lxebdatr.dll
2013-09-02 16:12 - 2010-04-01 13:24 - 01159168 _____ () C:\Program Files (x86)\Lexmark Pro200-S500 Series\lxebDRS.dll
2013-09-02 16:12 - 2009-03-10 01:43 - 00155648 _____ () C:\Program Files (x86)\Lexmark Pro200-S500 Series\lxebcaps.dll
2013-09-02 16:10 - 2009-02-20 03:48 - 00381440 _____ () C:\Windows\system32\lxebsm.dll
2013-09-02 16:10 - 2009-02-20 03:48 - 00023552 _____ () C:\Windows\system32\lxebsmr.dll
2015-03-05 22:10 - 2015-03-05 22:10 - 00016384 _____ () C:\Windows\assembly\NativeImages_v4.0.30319_32\PSIClient\bc9bcf53b97e0180a22783ef8b2567c2\PSIClient.ni.dll
2013-02-27 14:11 - 2012-02-01 17:44 - 01198872 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
2015-03-29 05:23 - 2014-05-13 12:04 - 00109400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2015-03-29 05:23 - 2014-05-13 12:04 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2015-03-29 05:23 - 2014-05-13 12:04 - 00167768 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2015-03-29 05:23 - 2012-08-23 10:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2015-03-29 05:23 - 2012-04-03 17:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\ProgramData\Microsoft:AweRqRWsS9xntmZlMJXm62
AlternateDataStreams: C:\ProgramData\Microsoft:IlaQEWuixHZEJK91mayraW491QLt
AlternateDataStreams: C:\Users\Mikasaurous\Cookies:dDi7HNjED042Bqa6rkxyTxT
AlternateDataStreams: C:\Users\Mikasaurous\Cookies:Hp1d0rmzm1Nqsyxxi12P9Wv
AlternateDataStreams: C:\Users\Mikasaurous\Cookies:SdnVC1k7Ypba12QxBq3gvNsRTxC
AlternateDataStreams: C:\Users\Mikasaurous\AppData\Local\Temp:QWbVi0uB3qxoJNfLTplyc1QL1w

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\McMPFSvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MCODS => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefire => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefirek => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefirek.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfehidk => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfehidk.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfevtp => ""="Driver"

==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-1932925490-2154617342-1019310170-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Mikasaurous\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 209.18.47.61 - 209.18.47.62

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: Adobe Reader Speed Launcher => "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe"
MSCONFIG\startupreg: APSDaemon => "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
MSCONFIG\startupreg: DigidesignMMERefresh => C:\Program Files (x86)\Digidesign\Drivers\MMERefresh.exe
MSCONFIG\startupreg: EzPrint => "C:\Program Files (x86)\Lexmark Pro200-S500 Series\ezprint.exe"
MSCONFIG\startupreg: Integrated Webcam Live! Central => "C:\Program Files (x86)\Integrated Webcam\Live! Central\WebcamInt.exe" /mode2
MSCONFIG\startupreg: iTunesHelper => "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
MSCONFIG\startupreg: lxebmon.exe => "C:\Program Files (x86)\Lexmark Pro200-S500 Series\lxebmon.exe"
MSCONFIG\startupreg: mcpltui_exe => "C:\Program Files\Common~1\McAfee\Platform\mcuicnt.exe" /platui /runkey
MSCONFIG\startupreg: mcui_exe => "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
MSCONFIG\startupreg: Pando Media Booster => C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe
MSCONFIG\startupreg: QuickTime Task => "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
MSCONFIG\startupreg: SDTray => "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe"
MSCONFIG\startupreg: UpdReg => C:\Windows\UpdReg.EXE

==================== Accounts: =============================

068C9DEAA98D4ACEB8E8 (S-1-5-21-1932925490-2154617342-1019310170-1006 - Limited - Enabled)
Administrator (S-1-5-21-1932925490-2154617342-1019310170-500 - Administrator - Disabled)
Guest (S-1-5-21-1932925490-2154617342-1019310170-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1932925490-2154617342-1019310170-1003 - Limited - Enabled)
Mikasaurous (S-1-5-21-1932925490-2154617342-1019310170-1001 - Administrator - Enabled) => C:\Users\Mikasaurous

==================== Faulty Device Manager Devices =============

==================== Event log errors: =========================

Application errors:
==================
Error: (03/29/2015 05:19:51 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT AUTHORITY)
Description: Unloading the performance counter strings for service WmiApRpl (WmiApRpl) failed. The first DWORD in the Data section contains the error code.

Error: (03/29/2015 05:19:51 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT AUTHORITY)
Description: The performance strings in the Performance registry value is corrupted when process Performance extension counter provider. The BaseIndex value from the Performance registry is the first DWORD in the Data section, LastCounter value is the second DWORD in the Data section, and LastHelp value is the third DWORD in the Data section.

Error: (03/29/2015 05:13:24 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (03/29/2015 04:47:29 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT AUTHORITY)
Description: Unloading the performance counter strings for service WmiApRpl (WmiApRpl) failed. The first DWORD in the Data section contains the error code.

Error: (03/29/2015 04:47:29 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT AUTHORITY)
Description: The performance strings in the Performance registry value is corrupted when process Performance extension counter provider. The BaseIndex value from the Performance registry is the first DWORD in the Data section, LastCounter value is the second DWORD in the Data section, and LastHelp value is the third DWORD in the Data section.

Error: (03/29/2015 04:44:37 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (03/29/2015 04:26:23 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: ZeroConfigService.exe, version: 15.1.0.2, time stamp: 0x4f4a262d
Faulting module name: MurocApi.dll, version: 15.1.0.1, time stamp: 0x4f4a2503
Exception code: 0xc0000005
Fault offset: 0x000000000002be1b
Faulting process id: 0x1518
Faulting application start time: 0xZeroConfigService.exe0
Faulting application path: ZeroConfigService.exe1
Faulting module path: ZeroConfigService.exe2
Report Id: ZeroConfigService.exe3

Error: (03/29/2015 04:26:18 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (03/29/2015 02:14:41 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT AUTHORITY)
Description: Unloading the performance counter strings for service WmiApRpl (WmiApRpl) failed. The first DWORD in the Data section contains the error code.

Error: (03/29/2015 02:14:41 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT AUTHORITY)
Description: The performance strings in the Performance registry value is corrupted when process Performance extension counter provider. The BaseIndex value from the Performance registry is the first DWORD in the Data section, LastCounter value is the second DWORD in the Data section, and LastHelp value is the third DWORD in the Data section.

System errors:
=============
Error: (03/29/2015 05:13:06 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The lxebCATSCustConnectService service failed to start due to the following error:
%%1053

Error: (03/29/2015 05:13:06 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the lxebCATSCustConnectService service to connect.

Error: (03/29/2015 04:44:31 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Dell SupportAssist Agent service failed to start due to the following error:
%%1053

Error: (03/29/2015 04:44:31 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the Dell SupportAssist Agent service to connect.

Error: (03/29/2015 04:43:56 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The lxebCATSCustConnectService service failed to start due to the following error:
%%1053

Error: (03/29/2015 04:43:56 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the lxebCATSCustConnectService service to connect.

Error: (03/29/2015 04:34:16 AM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: The ScRegSetValueExW call failed for FailureCommand with the following error:
%%5

Error: (03/29/2015 04:34:11 AM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: The ScRegSetValueExW call failed for Start with the following error:
%%5

Error: (03/29/2015 04:33:41 AM) (Source: NetBT) (EventID: 4321) (User: )
Description: The name "WORKGROUP :1d" could not be registered on the interface with IP address 192.168.0.21.
The computer with the IP address 192.168.0.14 did not allow the name to be claimed by
this computer.

Error: (03/29/2015 04:26:37 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The Intel(R) PROSet/Wireless Zero Configuration Service service terminated unexpectedly. It has done this 1 time(s).

Microsoft Office Sessions:
=========================
Error: (03/29/2015 05:19:51 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT AUTHORITY)
Description: WmiApRplWmiApRpl8F20300004D070000

Error: (03/29/2015 05:19:51 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT AUTHORITY)
Description: Performance1637070000000000000000000009030000

Error: (03/29/2015 05:13:24 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (03/29/2015 04:47:29 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT AUTHORITY)
Description: WmiApRplWmiApRpl8F20300004D070000

Error: (03/29/2015 04:47:29 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT AUTHORITY)
Description: Performance1637070000000000000000000009030000

Error: (03/29/2015 04:44:37 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (03/29/2015 04:26:23 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: ZeroConfigService.exe15.1.0.24f4a262dMurocApi.dll15.1.0.14f4a2503c0000005000000000002be1b151801d06a024896ae6eC:\Program Files\Intel\WiFi\bin\ZeroConfigService.exeC:\Program Files\Intel\WiFi\bin\MurocApi.dlla9f1fc6b-d5f5-11e4-ab60-6036ddd7e6e5

Error: (03/29/2015 04:26:18 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (03/29/2015 02:14:41 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT AUTHORITY)
Description: WmiApRplWmiApRpl8F20300004D070000

Error: (03/29/2015 02:14:41 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT AUTHORITY)
Description: Performance1637070000000000000000000009030000

==================== Memory info ===========================

Processor: Intel(R) Core(TM) i7-3630QM CPU @ 2.40GHz
Percentage of memory in use: 59%
Total physical RAM: 6026.31 MB
Available physical RAM: 2418.65 MB
Total Pagefile: 12050.8 MB
Available Pagefile: 7897.77 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:452.1 GB) (Free:186.89 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 465.8 GB) (Disk ID: A1CC4059)
Partition 1: (Not Active) - (Size=39 MB) - (Type=DE)
Partition 2: (Active) - (Size=13.6 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=452.1 GB) - (Type=07 NTFS)

==================== End Of Log ============================

aswMBR version 1.0.1.2252 Copyright(c) 2014 AVAST Software
Run date: 2015-03-29 11:08:04
-----------------------------
11:08:04.926 OS Version: Windows x64 6.1.7601 Service Pack 1
11:08:04.926 Number of processors: 8 586 0x3A09
11:08:04.926 ComputerName: IRDINOSAUR UserName:
11:08:08.841 Initialize success
11:08:08.841 VM: initialized successfully
11:08:08.841 VM: Intel CPU supported
11:08:11.222 VM: disk I/O iaStorA.sys
11:16:34.038 AVAST engine defs: 15032900
11:18:57.636 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\00000080
11:18:57.636 Disk 0 Vendor: ATA_____ DEM1 Size: 476940MB BusType: 8
11:18:57.761 Disk 0 MBR read successfully
11:18:57.761 Disk 0 MBR scan
11:18:57.792 Disk 0 Windows VISTA default MBR code
11:18:57.792 Disk 0 Partition 1 00 DE Dell Utility DELL 4.1 39 MB offset 63
11:18:57.824 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 13944 MB offset 81920
11:18:57.839 Disk 0 Boot: NTFS code=1
11:18:57.855 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 462952 MB offset 28639232
11:18:57.948 Disk 0 scanning C:\Windows\system32\drivers
11:19:14.687 Service scanning
11:19:54.031 Modules scanning
11:19:54.031 Disk 0 trace - called modules:
11:19:54.046 ntoskrnl.exe CLASSPNP.SYS disk.sys stdcfltn.sys iaStorF.sys storport.sys hal.dll iaStorA.sys
11:19:54.046 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8006d60060]
11:19:54.046 3 CLASSPNP.SYS[fffff880011ae43f] -> nt!IofCallDriver -> [0xfffffa8006bb3cb0]
11:19:54.062 5 stdcfltn.sys[fffff88001ba5d12] -> nt!IofCallDriver -> [0xfffffa8006bb0c50]
11:19:54.062 7 iaStorF.sys[fffff88001a01168] -> nt!IofCallDriver -> \Device\00000080[0xfffffa8006664060]
11:20:02.018 AVAST engine scan C:\Windows
11:20:04.997 AVAST engine scan C:\Windows\system32
11:25:31.079 AVAST engine scan C:\Windows\system32\drivers
11:25:53.574 AVAST engine scan C:\Users\Mikasaurous
11:28:16.907 Disk 0 MBR has been saved successfully to "C:\aswmbr\MBR.dat"
11:28:16.938 The log file has been saved successfully to "C:\aswmbr\aswMBR.txt"

Juliet

2015-03-29, 23:22

AV: Microsoft Security Essentials (Enabled - Up to date) {B7ECF8CD-0188-6703-DBA4-AA65C6ACFB0A}
AV: McAfee Anti-Virus and Anti-Spyware (Enabled - Up to date) {DA9F8ED0-D0DE-39CC-F55A-51AB4CC1B556}
AS: Microsoft Security Essentials (Enabled - Up to date) {0C8D1929-27B2-688D-E114-9117BD2BB1B7}

Your using two antivirus. Please uninstall one or conflicts with tools and scripts we need to use will be complicated.
Also, this can use a tremendous amount of resources.

~~~~~~~~~~~~~~~~~~~~~~~

We need to completely uninstall then reinstall Google Chrome.

Instructions on how to backup your Favourites/Bookmarks and other data can be found below.
http://i.imgur.com/U5NwUGc.png Backup Chrome Bookmarks (http://www.wikihow.com/Export-Bookmarks-from-Chrome)

Please download and install Revo Uninstaller Free (http://www.revouninstaller.com/)

Double click Revo Uninstaller to run it.
From the list of programs double click Google Chrome to remove
When prompted if you want to uninstall click Yes.
Be sure the Moderate option is selected then click Next.
The program will run, If prompted again click Yes
when the built-in uninstaller is finished click on Next.
Once the program has searched for leftovers click Next.
Check/tick the bolded items only on the list then click Delete
when prompted click on Yes and then on next.
put a check on any folders that are found and select delete
when prompted select yes then on next
Once done click Finish.

Then, it can be reinstalled from
http://www.google.com/chrome/

~~~~~~~

Running from C:\Frst64
It's best we move FRST to desktop.

Please go to your C drive, locate Farbar Recovery Scan Tool, right click and select CUT
Go to an open spot on your desktop, right click and select PASTE
You should now have Farbar Recovery Scan Tool on your desktop.

Please open Notepad *Do Not Use Wordpad!* or use any other text editor than Notepad or the script will fail. (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the quote box below:
To do this highlight the contents of the box and right click on it and select copy.
Paste this into the open notepad. save it to the Desktop as fixlist.txt
NOTE. It's important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work.
It needs to be saved Next to the "Farbar Recovery Scan Tool" (If asked to overwrite existing one please allow)

https://dl.dropboxusercontent.com/u/73555776/FRSTfix.JPG

start
CreateRestorePoint:
CloseProcesses:
CHR dev: Chrome dev build detected! <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> DefaultScope value is missing.
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
FF DefaultSearchUrl: hxxp://websearch.searchdominion.info/?pid=22194&r=2015/02/24&hid=14286914863345694860&lg=EN&cc=US&l=1&q=
FF DefaultSearchEngine,S: WebSearch
FF SearchEngineOrder.1: Secure Search
FF SearchEngineOrder.1,S: WebSearch
FF SelectedSearchEngine: Secure Search
FF SelectedSearchEngine,S: WebSearch
CustomCLSID: HKU\S-1-5-21-1932925490-2154617342-1019310170-1001_Classes\CLSID\{D0336C0B-7919-4C04-8CCE-2EBAE2ECE8C9}\InprocServer32 -> C:\Users\Mikasaurous\AppData\Local\Google\Update\1.3.25.11\psuser_64.dll No File
AlternateDataStreams: C:\ProgramData\Microsoft:AweRqRWsS9xntmZlMJXm62
AlternateDataStreams: C:\ProgramData\Microsoft:IlaQEWuixHZEJK91mayraW491QLt
AlternateDataStreams: C:\Users\Mikasaurous\Cookies:dDi7HNjED042Bqa6rkxyTxT
AlternateDataStreams: C:\Users\Mikasaurous\Cookies:Hp1d0rmzm1Nqsyxxi12P9Wv
AlternateDataStreams: C:\Users\Mikasaurous\Cookies:SdnVC1k7Ypba12QxBq3gvNsRTxC
AlternateDataStreams: C:\Users\Mikasaurous\AppData\Local\Temp:QWbVi0uB3qxoJNfLTplyc1QL1w
EmptyTemp:
End

Open FRST/FRST64 and press the Fix button just once and wait.
If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.

~~~~~~~~~~~~~~~~~~~~~~`

http://i.imgur.com/BY4dvz9.png AdwCleaner

Please download AdwCleaner (http://www.bleepingcomputer.com/download/adwcleaner/) and save the file to your Desktop.
Right-Click AdwCleaner.exe and select http://i.imgur.com/AVOiBNU.jpg Run as administrator to run the programme.
Follow the prompts.
Click Scan.
Upon completion, click Report. A log (AdwCleaner[R0].txt) will open. Briefly check the log for anything you know to be legitimate.
Ensure anything you know to be legitimate does not have a checkmark, and click Clean.
Follow the prompts and allow your computer to reboot.
After rebooting, a log (AdwCleaner[S0].txt) will open. Copy the contents of the log and paste in your next reply.

-- File and registry key backups are made for anything removed using this tool. Should a legitimate entry be removed (otherwise known as a 'false-positive'), simple steps can be taken to restore the entry. Please do not overly concern yourself with the contents of AdwCleaner[R0].txt.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

http://imageshack.us/a/img841/7292/thisisujrt.gif
Please download Junkware Removal Tool (http://www.bleepingcomputer.com/download/junkware-removal-tool/) to your desktop.

Shut down your protection software now to avoid potential conflicts.
Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
The tool will open and start scanning your system.
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next message.

~~~~
please post
Fixlog.txt
C:\AdwCleaner.txt
JRT.txt

se7ered

2015-03-30, 01:28

Thanks for the reply. Even though it came up in the scan, Chrome is not installed on the system. Do I skip this step or is there something else that needs to be done instead?

Juliet

2015-03-30, 11:52

Thanks for the reply. Even though it came up in the scan, Chrome is not installed on the system. Do I skip this step or is there something else that needs to be done instead?

Must be remnants.

Install Revo Uninstaller and let it search, if found, allow it to remove whats left then continue with the rest of the instructions.

Juliet

2015-04-02, 17:11

Still need help?

se7ered

2015-04-03, 04:15

Yes. Waiting on friend with log files. Should be soon. Thanks for being patient.

se7ered

2015-04-03, 05:28

Conversation opened. 2 messages. 1 message unread.

instructions
Inbox
x

Attachments9:53 PM (32 minutes ago)

to me
There were two adwcleaner files so i just sent both. wasn't sure which was needed.
4 Attachments
Preview attachment Fixlog.txt
[Text]
Preview attachment JRT.txt
[Text]
Preview attachment AdwCleaner[R0].txt
[Text]
Preview attachment AdwCleaner[S0].txt
[Text]

Click here to Reply or Forward
3.72 GB (24%) of 15 GB used
Manage
Terms - Privacy
Last account activity: 42 minutes ago
Details

Show details
Fixlog.txt

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 11-03-2015
Ran by Mikasaurous at 2015-04-02 21:19:10 Run:1
Running from C:\Users\Mikasaurous\Desktop
Loaded Profiles: Mikasaurous (Available profiles: Mikasaurous)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
start
CreateRestorePoint:
CloseProcesses:
CHR dev: Chrome dev build detected! <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> DefaultScope value is missing.
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
FF DefaultSearchUrl: hxxp://websearch.searchdominion.info/?pid=22194&r=2015/02/24&hid=14286914863345694860&lg=EN&cc=US&l=1&q=
FF DefaultSearchEngine,S: WebSearch
FF SearchEngineOrder.1: Secure Search
FF SearchEngineOrder.1,S: WebSearch
FF SelectedSearchEngine: Secure Search
FF SelectedSearchEngine,S: WebSearch
CustomCLSID: HKU\S-1-5-21-1932925490-2154617342-1019310170-1001_Classes\CLSID\{D0336C0B-7919-4C04-8CCE-2EBAE2ECE8C9}\InprocServer32 -> C:\Users\Mikasaurous\AppData\Local\Google\Update\1.3.25.11\psuser_64.dll No File
AlternateDataStreams: C:\ProgramData\Microsoft:AweRqRWsS9xntmZlMJXm62
AlternateDataStreams: C:\ProgramData\Microsoft:IlaQEWuixHZEJK91mayraW491QLt
AlternateDataStreams: C:\Users\Mikasaurous\Cookies:dDi7HNjED042Bqa6rkxyTxT
AlternateDataStreams: C:\Users\Mikasaurous\Cookies:Hp1d0rmzm1Nqsyxxi12P9Wv
AlternateDataStreams: C:\Users\Mikasaurous\Cookies:SdnVC1k7Ypba12QxBq3gvNsRTxC
AlternateDataStreams: C:\Users\Mikasaurous\AppData\Local\Temp:QWbVi0uB3qxoJNfLTplyc1QL1w
EmptyTemp:
End
*****************

Restore point was successfully created.
Processes closed successfully.
CHR dev: Chrome dev build detected! <======= ATTENTION => Error: No automatic fix found for this entry.
"HKLM\SOFTWARE\Policies\Google" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" => Key deleted successfully.
HKCR\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => Key not found.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully.
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" => Key deleted successfully.
HKCR\Wow6432Node\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => Key not found.
Firefox DefaultSearchUrl deleted successfully.
Firefox DefaultSearchEngine,S deleted successfully.
Firefox SearchEngineOrder.1 deleted successfully.
Firefox SearchEngineOrder.1,S deleted successfully.
Firefox SelectedSearchEngine deleted successfully.
Firefox SelectedSearchEngine,S deleted successfully.
"HKU\S-1-5-21-1932925490-2154617342-1019310170-1001_Classes\CLSID\{D0336C0B-7919-4C04-8CCE-2EBAE2ECE8C9}" => Key deleted successfully.
C:\ProgramData\Microsoft => ":AweRqRWsS9xntmZlMJXm62" ADS removed successfully.
C:\ProgramData\Microsoft => ":IlaQEWuixHZEJK91mayraW491QLt" ADS removed successfully.
"C:\Users\Mikasaurous\Cookies" => ":dDi7HNjED042Bqa6rkxyTxT" ADS not found.
"C:\Users\Mikasaurous\Cookies" => ":Hp1d0rmzm1Nqsyxxi12P9Wv" ADS not found.
"C:\Users\Mikasaurous\Cookies" => ":SdnVC1k7Ypba12QxBq3gvNsRTxC" ADS not found.
C:\Users\Mikasaurous\AppData\Local\Temp => ":QWbVi0uB3qxoJNfLTplyc1QL1w" ADS removed successfully.
EmptyTemp: => Removed 1 GB temporary data.

The system needed a reboot.

==== End of Fixlog 21:20:34 ====

Displaying Fixlog.txt.

Conversation opened. 2 messages. 1 message unread.

Skip to content

instructions
Inbox
x

Attachments9:53 PM (33 minutes ago)

to me
There were two adwcleaner files so i just sent both. wasn't sure which was needed.
4 Attachments
Preview attachment Fixlog.txt
[Text]
Preview attachment JRT.txt
[Text]
Preview attachment AdwCleaner[R0].txt
[Text]
Preview attachment AdwCleaner[S0].txt
[Text]

Click here to Reply or Forward
3.72 GB (24%) of 15 GB used
Manage
Terms - Privacy
Last account activity: 42 minutes ago
Details

JRT.txt

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.5.1 (04.02.2015:1)
OS: Windows 7 Home Premium x64
Ran by Mikasaurous on Thu 04/02/2015 at 21:48:23.01
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Registry Values

~~~ Registry Keys

~~~ Files

Successfully deleted: [File] C:\Windows\prefetch\ENABLETOOLBARW32.EXE-79A77B09.pf

~~~ Folders

Successfully deleted: [Folder] "C:\ProgramData\pcdr"
Successfully deleted: [Folder] "C:\Users\Mikasaurous\AppData\Roaming\pcdr"
Successfully deleted: [Folder] "C:\Windows\syswow64\ai_recyclebin"

~~~ FireFox

Successfully deleted the following from C:\Users\Mikasaurous\AppData\Roaming\mozilla\firefox\profiles\lj6fllmj.default-1378494018390\prefs.js

user_pref("extensions.3Ve8nHWYW96fuW45.scode", "(function(){try{if(window.self.location.href.indexOf(\"rjnGpdg4rjn5qTrHqdk7pjn5qTa\")>-1){return;}}catch(e){}try{var d=[[\"aceb
user_pref("extensions.RQhQ76v9riQTbWmQ.epoch", "1425005813");
user_pref("extensions.RQhQ76v9riQTbWmQ.scode", "(function(){try{if(window.self.location.href.indexOf(\"rjnGpdg4rjn5qTrHqdk7pjn5qTa\")>-1){return;}}catch(e){}try{var d=[[\"aceb
user_pref("extensions.RQhQ76v9riQTbWmQ.url", "hxxp://extsync.info/sync2/?q=hfZ9oe4MhyhHhdUMCyVUojsGrjU9tMqLDe49CNU0llrMCMlNhd9FqjaGrTnFpjk9qjrMBzqUojw8rdsGqdw4qjgEqGh7hfs0pihP
user_pref("extensions.wpfyLyhMsL3IHNWd.scode", "(function(){try{if(window.self.location.href.indexOf(\"rjnGpdg4rjn5qTrHqdk7pjn5qTa\")>-1){return;}}catch(e){}try{var d=[[\"aceb
user_pref("extensions.wpfyLyhMsL3IHNWd.url", "hxxp://getsrv1.info/sync2/?q=hfZ9ofV9CShEAen0rTsFpjnMg708BNmGWj8lkGhGheDUojw8rdsGqdw4qjkGrchIC7n0rjkErTs9rjU8qTa6tNhVCT94tMVKhd97
Emptied folder: C:\Users\Mikasaurous\AppData\Roaming\mozilla\firefox\profiles\lj6fllmj.default-1378494018390\minidumps [31 files]

~~~ Event Viewer Logs were cleared

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Thu 04/02/2015 at 21:51:58.66
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Displaying Fixlog.txt.

Conversation opened. 2 messages. 1 message unread.

Skip to content
Using Gmail with screen readers

Inbox
x

Attachments9:53 PM (34 minutes ago)

to me
There were two adwcleaner files so i just sent both. wasn't sure which was needed.
4 Attachments
Preview attachment Fixlog.txt
[Text]
Preview attachment JRT.txt
[Text]
Preview attachment AdwCleaner[R0].txt
[Text]
Preview attachment AdwCleaner[S0].txt
[Text]

Click here to Reply or Forward
3.72 GB (24%) of 15 GB used
Manage
Terms - Privacy
Last account activity: 42 minutes ago
Details

AdwCleaner[S0].txt

# AdwCleaner v4.200 - Logfile created 02/04/2015 at 21:40:24
# Updated 29/03/2015 by Xplode
# Database : 2015-03-29.1 [Server]
# Operating system : Windows 7 Home Premium Service Pack 1 (x64)
# Username : Mikasaurous - IRDINOSAUR
# Running from : C:\Users\Mikasaurous\Downloads\adwcleaner_4.200.exe
# Option : Cleaning

***** [ Services ] *****

***** [ Files / Folders ] *****

Folder Deleted : C:\Users\Mikasaurous\AppData\Roaming\download Manager

***** [ Scheduled tasks ] *****

***** [ Shortcuts ] *****

***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{4D076AB4-7562-427A-B5D2-BD96E19DEE56}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{11549FE4-7C5A-4C17-9FC3-56FC5162A994}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{89310413-97E0-4F09-AA75-390A7F4D4918}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}
Key Deleted : HKCU\Software\AppDataLow\{4A0F38A9-FE55-4B89-B73F-E60FDC0F72E9}
Key Deleted : HKLM\SOFTWARE\{4A0F38A9-FE55-4B89-B73F-E60FDC0F72E9}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{AD11DADE-C597-45D9-D8C5-1D2EB0B89613}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\websearch.searchdominion.info
Data Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyOverride] - *.local

***** [ Web browsers ] *****

-\\ Internet Explorer v11.0.9600.17631

-\\ Mozilla Firefox v36.0.4 (x86 en-US)

[lj6fllmj.default-1378494018390\prefs.js] - Line Deleted : user_pref("browser.search.hiddenOneOffs", "Yahoo,Bing,Amazon.com,DuckDuckGo,eBay,Secure Search,Twitter,WebSearch");
[lj6fllmj.default-1378494018390\prefs.js] - Line Deleted : user_pref("extensions.3Ve8nHWYW96fuW45.scode", "(function(){try{if(window.self.location.href.indexOf(\"rjnGpdg4rjn5qTrHqdk7pjn5qTa\")>-1){return;}}catch(e){}try{var d=[[\"acebook\",\"flybrain.com\",\"[...]
[lj6fllmj.default-1378494018390\prefs.js] - Line Deleted : user_pref("extensions.RQhQ76v9riQTbWmQ.scode", "(function(){try{if(window.self.location.href.indexOf(\"rjnGpdg4rjn5qTrHqdk7pjn5qTa\")>-1){return;}}catch(e){}try{var d=[[\"acebook\",\"flybrain.com\",\"[...]
[lj6fllmj.default-1378494018390\prefs.js] - Line Deleted : user_pref("extensions.SwDJ2cXsLRqHmCx4.scode", "(function(){try{if(window.self.location.href.indexOf(\"rjnGpdg4rjn5qTrHqdk7pjn5qTa\")>-1){return;}}catch(e){}try{var d=[[\"acebook\",\"flybrain.com\",\"[...]
[lj6fllmj.default-1378494018390\prefs.js] - Line Deleted : user_pref("extensions.wpfyLyhMsL3IHNWd.scode", "(function(){try{if(window.self.location.href.indexOf(\"rjnGpdg4rjn5qTrHqdk7pjn5qTa\")>-1){return;}}catch(e){}try{var d=[[\"acebook\",\"flybrain.com\",\"[...]

*************************

AdwCleaner[R0].txt - [3249 bytes] - [02/04/2015 21:31:00]
AdwCleaner[S0].txt - [3251 bytes] - [02/04/2015 21:40:24]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [3310 bytes] ##########

Displaying AdwCleaner[S0].txt.

Juliet

2015-04-03, 14:21

I edited out personal names on your contacts, remember this is the internet and spammers read topics too.

I can see Malwarebytes Anti-Malware is already on the computer. Let's open it, click on the update button and allow it to update to the latest virus definitions. Then I want you to run a Threat scan and allow it to quarantine what it finds.

Right click and choose "Run as administrator" to open Malwarebytes Anti-Malware and from the Dashboard please Check for Updates by clicking the Update Now... link
Open up Malwarebytes > Settings > Detection and Protection > Enable Scan for rootkit and Under Non Malware Protection set both PUP and PUM to Treat detections as malware.
Click on the SCAN button and run a Threat Scan with Malwarebytes Anti-Malware by clicking the Scan Now>> button.
Go to Advanced setting and make sure Automatically Quarantine Detected Items is checked
Once completed please click on the History > Application Logs and find your scan log and open it and then click on the "copy to clipboard" button and post back the results on your next reply.

~~~~~~~~~~~~~~~

ESET Online Scanner
I'd like us to scan your machine with ESET OnlineScan

*Note
It is recommended to disable onboard antivirus program and antispyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your antivirus along with your antispyware programs.

Hold down Control and click on the following link to open ESET OnlineScan in a new window.

ESET OnlineScan (http://eset.com/onlinescan)

Click the http://billy-oneal.com/Canned%20Speeches/speechimages/eset/esetOnline.png button.

For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)

Click on http://billy-oneal.com/Canned%20Speeches/speechimages/eset/esetSmartInstall.png to download the ESET Smart Installer. Save it to your desktop.

Double click on the http://billy-oneal.com/Canned%20Speeches/speechimages/eset/esetSmartInstallDesktopIcon.png icon on your desktop.

Check http://billy-oneal.com/Canned%20Speeches/speechimages/eset/esetAcceptTerms.png
Click the http://billy-oneal.com/Canned%20Speeches/speechimages/eset/esetStart.png button.

Accept any security warnings from your browser.
Check http://billy-oneal.com/Canned%20Speeches/speechimages/eset/esetScanArchives.png

Make sure that the option "Remove found threats" is Unchecked

Push the Start button.

ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.

When the scan completes, push http://billy-oneal.com/Canned%20Speeches/speechimages/eset/esetListThreats.png

Push http://billy-oneal.com/Canned%20Speeches/speechimages/eset/esetExport.png, and save the file to your desktop using a unique name, such as

ESETScan. Include the contents of this report in your next reply.

Push the http://billy-oneal.com/Canned%20Speeches/speechimages/eset/esetBack.png button.

Push http://billy-oneal.com/Canned%20Speeches/speechimages/eset/esetFinish.png

Please make sure you include the following items in your next post:
The log that was produced after running ESET Online Scanner.

Please post these 2 logs when finished and I need comments on how the computer is at the moment.

se7ered

2015-04-04, 03:08

Thanks for the edit. I noticed after I had posted that contacts got attached to the copied text and I couldn't see an option to edit the post myself. I'll post logs as soon as my friend gets the scans done.

Juliet

2015-04-04, 03:17

Your welcome

post the log information when you can.

se7ered

2015-04-05, 11:02

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 4/4/2015
Scan Time: 1:46:09 PM
Logfile:
Administrator: Yes

Version: 2.01.4.1018
Malware Database: v2015.04.04.05
Rootkit Database: v2015.03.31.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: Mikasaurous

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 359245
Time Elapsed: 15 min, 36 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 0
(No malicious items detected)

Physical Sectors: 0
(No malicious items detected)

(end)

ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=7aa801d37014b5458b7423b217f73b5b
# engine=23235
# end=finished
# remove_checked=false
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-04-04 09:14:47
# local_time=2015-04-04 04:14:47 (-0600, Central Daylight Time)
# country="United States"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 0 179725537 0 0
# scanned=509205
# found=0
# cleaned=0
# scan_time=7126

She said the system is running fine. All the issues we had are not reoccurring. Just wanted to make sure everything was cleaned out. If you aren't seeing anything in the logs we can call this fixed.

Juliet

2015-04-05, 12:52

Good to hear.

http://i.imgur.com/AFZxnZc.jpg DelFix

Please download DelFix (http://general-changelog-team.fr/en/downloads/finish/20-outils-de-xplode/9-delfix)
or from here http://www.bleepingcomputer.com/download/delfix/ and save the file to your Desktop.
Double-click DelFix.exe to run the programme.
Place a checkmark next to the following items:

Activate UAC
Remove disinfection tools
Create registry backup

Click the Run button.

-- This will remove the specialised tools we used to disinfect your system. Any leftover logs, files, folders or tools remaining on your Desktop which were not removed can be deleted manually (right-click the file + delete).

Answers to common security questions - Best Practices (http://www.bleepingcomputer.com/forums/t/407147/answers-to-common-security-questions-best-practices/) by quietman7, MVP
How Malware Spreads - How did I get infected? (http://www.bleepingcomputer.com/forums/t/287710/how-malware-spreads-how-did-i-get-infected/) by quietman7, MVP
Simple and easy ways to keep your computer safe and secure on the Internet (http://www.bleepingcomputer.com/tutorials/keep-your-computer-safe-online/) by Lawrence Abrams, MVP
How to Prevent Malware (http://users.telenet.be/bluepatchy/miekiemoes/prevention.html) by miekiemoes, MVP
How to backup and restore your data using Cobian Backup (http://www.bleepingcomputer.com/tutorials/backup-and-restore-data-with-cobian-backup/) by YourHighness
Slow Computer/browser? It May Not Be Malware (http://www.bleepingcomputer.com/forums/t/87058/slow-computerbrowser-check-here-first;-it-may-not-be-malware/) by quietman7, MVP

The following programmes come highly recommended in the security community.

http://3-ps.googleusercontent.com/x/forums.whatthetech.com/i.imgur.com/xKsUqI5A.png.pagespeed.ic.vn1Hlvqi8h.jpgAdBlock (https://adblockplus.org/en/firefox) is a browser add-on that blocks annoying banners, pop-ups and video ads.
http://i.imgur.com/E8I37RF.pngCryptoPrevent (https://www.foolishit.com/) places policy restrictions on loading points for ransomware (eg.CryptoPrevent), preventing your files from being encrypted.
http://i.imgur.com/EG85Vjt.png Malwarebytes Anti-Exploit (https://www.malwarebytes.org/antiexploit/) (MBAE) is designed to prevent zero-day malware from exploiting vulnerable software.
http://3-ps.googleusercontent.com/x/forums.whatthetech.com/i.imgur.com/x6YRrgUC.png.pagespeed.ic.HjgFxjvw2Z.jpgMalwarebytes Anti-Malware Premium (https://www.malwarebytes.org/) (MBAM) works in real-time along side your Anti-Virus to prevent malware execution.
http://1-ps.googleusercontent.com/x/forums.whatthetech.com/i.imgur.com/xjv4nhMJ.png.pagespeed.ic.A5YbWn1eDO.png NoScript (http://noscript.net/) is a Firefox add-on that blocks the actions of malicious scripts by using whitelisting and other technology.
http://i.imgur.com/3O8r9Uq.png (http://www.sandboxie.com/) Sandboxie (http://www.sandboxie.com/) isolates programmes of your choice, preventing files from being written to your HDD unless approved by you.
http://1-ps.googleusercontent.com/x/forums.whatthetech.com/i.imgur.com/DgW1XL2.png.pagespeed.ce.v1OlJl_ZAS.png Secuina PSI (http://secunia.com/vulnerability_scanning/personal/) will scan your computer for vulnerable software that is outdated, and automatically find the latest update for you.
http://3-ps.googleusercontent.com/x/forums.whatthetech.com/i.imgur.com/xj1OLIec.png.pagespeed.ic.k6hhwopU0q.jpg SpywareBlaster (https://www.brightfort.com/spywareblaster.html) is a form of passive protection, designed to block the actions of malicious websites and tracking cookies.
http://3-ps.googleusercontent.com/x/forums.whatthetech.com/i.imgur.com/xJEP5iWI.png.pagespeed.ic.4tmM1lM7DQ.pngWeb of Trust (https://www.mywot.com/) (WOT) is a browser add-on designed to alert you before interacting with a potentially malicious website.

Want to help others? Join the ClassRoom (http://forums.whatthetech.com/What_the_Tech_Classroom_t80368.html) and learn how.

Juliet

2015-04-07, 13:07

Glad we could help. :)http://i204.photobucket.com/albums/bb106/Juliet702/sparkle.gif

Since this issue appears resolved ... this Topic is closed.