Solved ads, ads, ads everywhere

Status
This thread has been Locked and is not open to further replies. Please start a New Thread if you're having a similar issue. View our Welcome Guide to learn how to use this site.

xions

Thread Starter
Joined
Dec 28, 2015
Messages
7
Okay so, i have always been very careful of what i download, never downloaded softwares from shady websites etc etc..

But i opened my browser today to see it filled with ads, i mean COMPLETELY overrun with ads and pop-ups (to the point where i couldn't log in anywhere because every time i would hit enter it would take me to a cougar dating website.)
Of course i did what every sane person does which is frantically searching for solutions online, and after doing everything google recommended: downloading google clean-up, malwarebytes, antiviruses (and after doing everything yahoo users recommended: giving that cougar dating website a try) i probably ended up damaging my computer more than helping it.

I have no idea where all these ads could come from but i deleted the latest software i had downloaded (a video editing tool) and ran a checkup with malwarebytes, it told me i had 81 or so malwares and i proceeded to delete them, but nothing changed after!!(it just tells me i have no malwares anymore...), i also reset all my google settings,deleted extensions and so on; and still nothing.

Oh and also, Malwarebytes keeps aggressively showing me pop-ups such as these:



But again, i run a checkup and it tells me that there's nothing suspicious on my browser.

I'm not really the type to make threads asking for help (i'm just content reading help from other people's threads) but NOTHING i've been told to do works so far. I'm out of ideas and don't know what to do.

____
Tech Support Guy System Info Utility version 1.0.0.2
OS Version: Microsoft Windows 7 Ultimate, Service Pack 1, 64 bit
Processor: Intel(R) Pentium(R) CPU N3540 @ 2.16GHz, Intel64 Family 6 Model 55 Stepping 8
Processor Count: 4
RAM: 3982 Mb
Graphics Card: NVIDIA GeForce 810M, 1024 Mb
Hard Drives: C: Total - 176837 MB, Free - 18846 MB; D: Total - 299999 MB, Free - 299901 MB;
Motherboard: Acer, Aspire E5-511G
Antivirus: avast! Antivirus, Updated and Enabled
 
Last edited:

kevinf80

Kevin
Malware Specialist
Joined
Mar 21, 2006
Messages
11,390
Hello xions and welcome to TSG,

My name is kevinf80 (Kevin) I will help with your issues, continue as follows please:

Download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system (32 bit or 64 bit). If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

If your security alerts to FRST either, accept the alert or turn your security off to allow FRST to run. It is not malicious or infected in any way...

  • Double-click to run it. When the tool opens click Yes to disclaimer.
    (Windows 8/10 users will be prompted about Windows SmartScreen protection - click More information and Run.)
  • Make sure Addition.txt is checkmarked under "Optional scans"
  • Press Scan button to run the tool....
  • It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
  • The tool will also make a log named (Addition.txt) Please attach those logs to your reply.

Next,

Please download RogueKiller and save it to your desktop from the following link: http://www.bleepingcomputer.com/download/roguekiller/

  • Quit all running programs.
  • For Windows XP, double-click to start.
  • For Vista,Windows 7/8/8.1/10, Right-click on the program and select Run as Administrator to start and when prompted allow it to run.
  • Read and accept the EULA (End User Licene Agreement)
  • Click Scan to scan the system.
  • When the scan completes select "Report",in the next window select "Export txt" the log will open as a text file post that log... Also save to your Desktop for reference. log will open.
  • Close the program > Don't Fix anything!

Let me see those logs in your reply....

Thank you,

Kevin
 

xions

Thread Starter
Joined
Dec 28, 2015
Messages
7
Hello, thank you for replying!

Alright so here they are Kevin:

The FRST.txt:

Additional scan result of Farbar Recovery Scan Tool (x64) Version:28-12-2015 Ran by user (2015-12-29 10:31:21) Running from C:\Users\user\Downloads Windows 7 Ultimate Service Pack 1 (X64) (2015-10-21 12:36:46) Boot Mode: Normal ========================================================== ==================== Accounts: ============================= Administrator (S-1-5-21-648563939-3901689258-777139593-500 - Administrator - Disabled) Guest (S-1-5-21-648563939-3901689258-777139593-501 - Limited - Disabled) HomeGroupUser$ (S-1-5-21-648563939-3901689258-777139593-1002 - Limited - Enabled) user (S-1-5-21-648563939-3901689258-777139593-1000 - Administrator - Enabled) => C:\Users\user ==================== Security Center ======================== (If an entry is included in the fixlist, it will be removed.) AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B} AS: Windows Defender (Enabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736} FW: avast! Antivirus (Enabled) {2F96FC65-F07D-9D1E-5A6E-3DA5C487EAF0} ==================== Installed Programs ====================== (Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.) Adobe Flash Player 19 PPAPI (HKLM-x32\...\Adobe Flash Player PPAPI) (Version: 19.0.0.245 - Adobe Systems Incorporated) ALPS Touch Pad Driver (HKLM\...\{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}) (Version: 7.106.2015.1105 - Alps Electric) Avast Internet Security (HKLM-x32\...\Avast) (Version: 11.1.2245 - AVAST Software) BitTorrent (HKU\S-1-5-21-648563939-3901689258-777139593-1000\...\BitTorrent) (Version: 7.9.5.41373 - BitTorrent Inc.) BitTorrent (HKU\S-1-5-21-648563939-3901689258-777139593-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\BitTorrent) (Version: 7.9.5.41373 - BitTorrent Inc.) Dll-Files Fixer (HKLM-x32\...\Dll-Files Fixer_is1) (Version: 3.3.90 - Dll-Files.com) Google Chrome (HKLM-x32\...\Google Chrome) (Version: 47.0.2526.106 - Google Inc.) Google Update Helper (x32 Version: 1.3.29.1 - Google Inc.) Hidden Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.4226 - Intel Corporation) Malwarebytes Anti-Malware version 2.2.0.1024 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.0.1024 - Malwarebytes) Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation) Microsoft .NET Framework 4 Extended (HKLM\...\Microsoft .NET Framework 4 Extended) (Version: 4.0.30319 - Microsoft Corporation) Microsoft Office Enterprise 2007 (HKLM-x32\...\ENTERPRISE) (Version: 12.0.4518.1014 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation) Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation) NVIDIA Graphics Driver 355.82 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 355.82 - NVIDIA Corporation) NVIDIA Update 2.5.14.5 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 2.5.14.5 - NVIDIA Corporation) Opera Stable 34.0.2036.25 (HKLM-x32\...\Opera 34.0.2036.25) (Version: 34.0.2036.25 - Opera Software) Origin (HKLM-x32\...\Origin) (Version: 9.0.14.2148 - Electronic Arts, Inc.) PhotoFiltre (HKU\S-1-5-21-648563939-3901689258-777139593-1000\...\PhotoFiltre) (Version: - ) PhotoFiltre (HKU\S-1-5-21-648563939-3901689258-777139593-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\PhotoFiltre) (Version: - ) PhotoFiltre 7 (HKU\S-1-5-21-648563939-3901689258-777139593-1000\...\PhotoFiltre 7) (Version: - ) PhotoFiltre 7 (HKU\S-1-5-21-648563939-3901689258-777139593-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\PhotoFiltre 7) (Version: - ) Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7592 - Realtek Semiconductor Corp.) SafeZone Stable 1.46.1990.139 (x32 Version: 1.46.1990.139 - Avast Software) Hidden Skype™ 7.15 (HKLM-x32\...\{6A0549A9-1B96-498C-ACBC-3943001FEB19}) (Version: 7.15.102 - Skype Technologies S.A.) Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 19.0.9.4 - Synaptics Incorporated) The Sims Medieval (HKLM-x32\...\{83BEEFB4-8C28-4F4F-8A9D-E0D1ADCE335B}) (Version: 1.0.0 - Electronic Arts) The Sims™ 3 (HKLM-x32\...\{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}) (Version: 1.69.36.024017 - Electronic Arts Inc.) The Sims™ 3 Ambitions (HKLM-x32\...\{910F4A29-1134-49E0-AD8B-56E4A3152BD1}) (Version: 4.0.87 - Electronic Arts) The Sims™ 3 Generations (HKLM-x32\...\{E6B88BD6-E4B2-4701-A648-B6DAC6E491CC}) (Version: 8.0.152 - Electronic Arts) The Sims™ 3 Island Paradise (HKLM-x32\...\{DB21639E-FE55-432C-BCA2-0C5249E3F79E}) (Version: 19.0.101 - Electronic Arts) The Sims™ 3 Late Night (HKLM-x32\...\{45057FCE-5784-48BE-8176-D9D00AF56C3C}) (Version: 6.0.81 - Electronic Arts) The Sims™ 3 Pets (HKLM-x32\...\{C12631C6-804D-4B32-B0DD-8A496462F106}) (Version: 10.0.96 - Electronic Arts) The Sims™ 3 Seasons (HKLM-x32\...\{3DE92282-CB49-434F-81BF-94E5B380E889}) (Version: 16.0.136 - Electronic Arts) The Sims™ 3 Supernatural (HKLM-x32\...\{B37DAFA5-717D-41F8-BDFB-3A4B68C0B3A1}) (Version: 15.0.135 - Electronic Arts) The Sims™ 3 University Life (HKLM-x32\...\{F26DE8EF-F2CF-40DC-8CDA-CC0D82D11B36}) (Version: 18.0.126 - Electronic Arts) VideoPad Video Editor (HKLM-x32\...\VideoPad) (Version: 4.22 - NCH Software) WinRAR 5.30 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.30.0 - win.rar GmbH) ==================== Custom CLSID (Whitelisted): ========================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) CustomCLSID: HKU\S-1-5-21-648563939-3901689258-777139593-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\Windows\system32\igfxEM.exe (Intel Corporation) CustomCLSID: HKU\S-1-5-21-648563939-3901689258-777139593-1000_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\Windows\system32\igfxEM.exe (Intel Corporation) ==================== Scheduled Tasks (Whitelisted) ============= (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) Task: {237C2BB7-CCEA-4611-91D7-DBEA137C8890} - System32\Tasks\SafeZone scheduled Autoupdate 1451313571 => C:\Program Files\AVAST Software\SZBrowser\launcher.exe [2015-12-01] (Avast Software) Task: {2DA09B75-8ABB-4886-B53A-70020DB63BFC} - System32\Tasks\Adobe Flash Player PPAPI Notifier => C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_19_0_0_245_pepper.exe [2015-11-24] (Adobe Systems Incorporated) Task: {30D07540-10F1-47BB-A95D-D4866732095A} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2015-12-28] (AVAST Software) Task: {3F34F31F-6C75-439C-B373-DF6259A4B69A} - System32\Tasks\RDReminder => C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe [2015-10-30] (Dll-FIles.Com) Task: {419974CC-CC69-4C70-B366-B26BBF17FA2A} - System32\Tasks\DLL-Files.Com Fixer_Updates => C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe [2015-10-30] (Dll-FIles.Com) Task: {427CED9C-271F-49AE-AB8E-17A8D31F4F15} - System32\Tasks\DLL-Files.Com Fixer_MONTHLY => C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe [2015-10-30] (Dll-FIles.Com) Task: {4FC002AB-AD00-48B5-99D1-56C2D78854AE} - System32\Tasks\AVAST Software\Avast settings backup => C:\Program Files\Common Files\AV\avast! Antivirus\backup.exe [2015-12-28] (AVAST Software) Task: {56884CEC-CEF6-4BF6-834C-4763C66D3C37} - System32\Tasks\Opera scheduled Autoupdate 1445512388 => C:\Program Files (x86)\Opera\launcher.exe [2015-12-04] (Opera Software) Task: {7F6B0611-E57F-4E57-B8FA-D5F22F5D037A} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-11-22] (Google Inc.) Task: {85985F01-D52E-416D-AC96-9881758BE0E4} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-11-22] (Google Inc.) (If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.) Task: C:\Windows\Tasks\Adobe Flash Player PPAPI Notifier.job => C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_19_0_0_245_pepper.exe Task: C:\Windows\Tasks\DLL-Files.Com Fixer_MONTHLY.job => C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe Task: C:\Windows\Tasks\DLL-Files.Com Fixer_Updates.job => C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe ==================== Shortcuts ============================= (The entries could be listed to be restored or removed.) ==================== Loaded Modules (Whitelisted) ============== 2015-10-21 17:35 - 2015-08-25 22:46 - 00011896 _____ () C:\Program Files\NVIDIA Corporation\CoProcManager\detoured.dll 2015-10-21 17:37 - 2015-08-25 18:24 - 00116344 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll 2015-05-20 19:20 - 2000-04-27 17:15 - 00643072 _____ () C:\KDWin\KDWIN.EXE 2015-10-21 17:25 - 2015-08-27 15:33 - 00135216 _____ () C:\Program Files\Realtek\Audio\HDA\FMAPP.exe 2015-10-21 17:35 - 2015-08-25 22:46 - 00011896 _____ () C:\Program Files (x86)\NVIDIA Corporation\CoProcManager\detoured.dll 2015-11-14 03:30 - 2015-11-14 03:30 - 00147136 ____R () C:\Program Files (x86)\Skype\Phone\ssScreenVVS2.dll 2015-05-20 19:20 - 2000-04-28 14:33 - 00126976 _____ () C:\KDWin\KDWKeys.dll 2015-12-28 18:29 - 2015-12-28 18:29 - 00103888 _____ () C:\Program Files\AVAST Software\Avast\log.dll 2015-12-28 18:29 - 2015-12-28 18:29 - 00125512 _____ () C:\Program Files\AVAST Software\Avast\JsonRpcServer.dll 2015-12-28 18:29 - 2015-12-28 18:29 - 02990080 _____ () C:\Program Files\AVAST Software\Avast\defs\15110499\algo.dll 2015-12-28 18:29 - 2015-12-28 18:29 - 00469008 _____ () C:\Program Files\AVAST Software\Avast\ffl2.dll 2015-12-28 18:29 - 2015-12-28 18:29 - 00241896 _____ () C:\Program Files\AVAST Software\Avast\browser_pass.dll 2015-12-28 22:37 - 2015-12-28 22:37 - 02806272 _____ () C:\Program Files\AVAST Software\Avast\defs\15122802\algo.dll 2015-12-28 18:29 - 2015-12-28 18:29 - 40539648 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll 2015-11-26 17:45 - 2015-11-26 17:45 - 01016832 _____ () C:\Program Files (x86)\Origin\platforms\qwindows.dll 2015-11-26 17:45 - 2015-11-26 17:45 - 00028160 _____ () C:\Program Files (x86)\Origin\imageformats\qgif.dll 2015-11-26 17:45 - 2015-11-26 17:45 - 00029696 _____ () C:\Program Files (x86)\Origin\imageformats\qico.dll 2015-11-26 17:45 - 2015-11-26 17:45 - 00256000 _____ () C:\Program Files (x86)\Origin\imageformats\qjpeg.dll 2015-11-26 17:45 - 2015-11-26 17:45 - 00266240 _____ () C:\Program Files (x86)\Origin\imageformats\qmng.dll 2015-11-26 17:45 - 2015-11-26 17:45 - 00023552 _____ () C:\Program Files (x86)\Origin\imageformats\qtga.dll 2015-11-26 17:45 - 2015-11-26 17:45 - 00346112 _____ () C:\Program Files (x86)\Origin\imageformats\qtiff.dll 2015-11-26 17:45 - 2015-11-26 17:45 - 00023552 _____ () C:\Program Files (x86)\Origin\imageformats\qwbmp.dll 2015-11-26 17:45 - 2015-11-26 17:45 - 00243200 _____ () C:\Program Files (x86)\Origin\mediaservice\wmfengine.dll 2015-12-17 17:32 - 2015-12-11 07:54 - 01583432 _____ () C:\Program Files (x86)\Google\Chrome\Application\47.0.2526.106\libglesv2.dll 2015-12-17 17:32 - 2015-12-11 07:54 - 00081224 _____ () C:\Program Files (x86)\Google\Chrome\Application\47.0.2526.106\libegl.dll 2015-12-26 10:45 - 2015-12-24 07:46 - 16792256 _____ () C:\Users\user\AppData\Local\Google\Chrome\User Data\PepperFlash\20.0.0.267\pepflashplayer.dll ==================== Alternate Data Streams (Whitelisted) ========= (If an entry is included in the fixlist, only the ADS will be removed.) ==================== Safe Mode (Whitelisted) =================== (If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.) ==================== EXE Association (Whitelisted) =============== (If an entry is included in the fixlist, the registry item will be restored to default or removed.) ==================== Internet Explorer trusted/restricted =============== (If an entry is included in the fixlist, it will be removed from the registry.) ==================== Hosts content: =============================== (If needed Hosts: directive could be included in the fixlist to reset Hosts.) 2009-07-14 06:34 - 2009-06-11 01:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts ==================== Other Areas ============================ (Currently there is no automatic fix for this section.) HKU\S-1-5-21-648563939-3901689258-777139593-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\user\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg HKU\S-1-5-21-648563939-3901689258-777139593-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Control Panel\Desktop\\Wallpaper -> DNS Servers: 192.168.1.1 HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1) Windows Firewall is enabled. ==================== MSCONFIG/TASK MANAGER disabled items == (Currently there is no automatic fix for this section.) ==================== FirewallRules (Whitelisted) =============== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) FirewallRules: [{30E1523E-14BB-4D16-ADF6-1CF13AE93A96}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe FirewallRules: [{EA92BA8E-38EB-4039-B57E-0789970552F8}] => (Allow) C:\Users\user\AppData\Roaming\BitTorrent\BitTorrent.exe FirewallRules: [{9BE393DC-7636-48C2-B44D-760D24BF05FD}] => (Allow) C:\Users\user\AppData\Roaming\BitTorrent\BitTorrent.exe FirewallRules: [{C0354B1B-159D-4AB9-AA57-6238CFAAA551}] => (Allow) C:\Users\user\AppData\Roaming\BitTorrent\BitTorrent.exe FirewallRules: [{AB643C32-66A0-41FA-91E1-62B1D1E6552B}] => (Allow) C:\Users\user\AppData\Roaming\BitTorrent\BitTorrent.exe FirewallRules: [{2C4DFF5D-1992-4242-959A-F572ADD15C99}] => (Allow) C:\Users\user\AppData\Roaming\BitTorrent\BitTorrent.exe FirewallRules: [{2E3EB63A-A543-427B-B9F2-B334A4D4807B}] => (Allow) C:\Users\user\AppData\Roaming\BitTorrent\BitTorrent.exe FirewallRules: [{5E43AFC7-6099-48E0-A34F-D3F303F98C1E}] => (Allow) C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe FirewallRules: [{50AFB2CC-DDD8-4AC0-88EE-5ABFF6286545}] => (Allow) C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe FirewallRules: [{B6590EA6-5374-4D32-9E9E-C90F3611CC49}] => (Allow) C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe FirewallRules: [{B787A3BA-22D5-4D3E-9BA4-99DFDF015C65}] => (Allow) C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe FirewallRules: [{05C5603A-892B-4E98-80E3-E442DEF99137}] => (Allow) C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe FirewallRules: [{0BC06465-D609-4EF0-A6FD-3DE958BB3725}] => (Allow) C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe FirewallRules: [{5025AEA9-DCBD-46C2-929D-ED28FE4FA863}] => (Allow) C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe FirewallRules: [{8181ACF5-2E79-4C40-85C7-423AD571A643}] => (Allow) C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe FirewallRules: [{3EF363FB-35EA-4FD5-9597-9C9B3638896B}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe FirewallRules: [{7FB74ABB-23A4-49F9-BB0B-74FC36DEA0F1}] => (Allow) C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe FirewallRules: [{69B4C01F-3F22-4B91-9D4B-123DED4D99C1}] => (Allow) C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe FirewallRules: [{3E4FF3AA-3735-4D0D-91A6-E8C9CB55624B}] => (Allow) C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe FirewallRules: [{956035AE-1C1D-44C3-B444-07DC4BF3C534}] => (Allow) C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe ==================== Restore Points ========================= 26-12-2015 13:55:29 Scheduled Checkpoint 26-12-2015 15:34:31 Installed TheSims3EP4 28-12-2015 10:02:35 Installed Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 28-12-2015 18:31:07 Device Driver Package Install: Avast Network Service ==================== Faulty Device Manager Devices ============= Name: Bluetooth USB Module Description: Bluetooth USB Module Class Guid: {e0cbf06c-cd8b-4647-bb8a-263b43f0f974} Manufacturer: Qualcomm Atheros Communications Service: BTHUSB Problem: : Windows has stopped this device because it has reported problems. (Code 43) Resolution: One of the drivers controlling the device notified the operating system that the device failed in some manner. For more information about how to diagnose the problem, see the hardware documentation. Name: Intel(R) USB 3.0 eXtensible Host Controller Description: Intel(R) USB 3.0 eXtensible Host Controller Class Guid: {36fc9e60-c465-11cf-8056-444553540000} Manufacturer: Intel(R) Corporation Service: iusb3xhc Problem: : This device cannot start. (Code10) Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device. On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard. ==================== Event log errors: ========================= Application errors: ================== Error: (12/28/2015 06:14:53 PM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (12/28/2015 10:02:27 AM) (Source: SideBySide) (EventID: 33) (User: ) Description: Activation context generation failed for "Microsoft.VC90.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.30729.6161"1". Dependent Assembly Microsoft.VC90.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.30729.6161" could not be found. Please use sxstrace.exe for detailed diagnosis. Error: (12/28/2015 10:02:27 AM) (Source: SideBySide) (EventID: 33) (User: ) Description: Activation context generation failed for "Microsoft.VC90.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.30729.6161"1". Dependent Assembly Microsoft.VC90.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.30729.6161" could not be found. Please use sxstrace.exe for detailed diagnosis. Error: (12/28/2015 10:02:27 AM) (Source: SideBySide) (EventID: 33) (User: ) Description: Activation context generation failed for "Microsoft.VC90.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.30729.6161"1". Dependent Assembly Microsoft.VC90.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.30729.6161" could not be found. Please use sxstrace.exe for detailed diagnosis. Error: (12/28/2015 10:02:27 AM) (Source: SideBySide) (EventID: 33) (User: ) Description: Activation context generation failed for "Microsoft.VC90.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.30729.6161"1". Dependent Assembly Microsoft.VC90.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.30729.6161" could not be found. Please use sxstrace.exe for detailed diagnosis. Error: (12/28/2015 10:02:27 AM) (Source: SideBySide) (EventID: 33) (User: ) Description: Activation context generation failed for "Microsoft.VC90.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.30729.6161"1". Dependent Assembly Microsoft.VC90.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.30729.6161" could not be found. Please use sxstrace.exe for detailed diagnosis. Error: (12/28/2015 10:02:27 AM) (Source: SideBySide) (EventID: 33) (User: ) Description: Activation context generation failed for "Microsoft.VC90.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.30729.6161"1". Dependent Assembly Microsoft.VC90.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.30729.6161" could not be found. Please use sxstrace.exe for detailed diagnosis. Error: (12/28/2015 10:02:27 AM) (Source: SideBySide) (EventID: 33) (User: ) Description: Activation context generation failed for "Microsoft.VC90.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.30729.6161"1". Dependent Assembly Microsoft.VC90.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.30729.6161" could not be found. Please use sxstrace.exe for detailed diagnosis. Error: (12/28/2015 10:02:27 AM) (Source: SideBySide) (EventID: 33) (User: ) Description: Activation context generation failed for "Microsoft.VC90.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.30729.6161"1". Dependent Assembly Microsoft.VC90.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.30729.6161" could not be found. Please use sxstrace.exe for detailed diagnosis. Error: (12/28/2015 10:02:27 AM) (Source: SideBySide) (EventID: 33) (User: ) Description: Activation context generation failed for "Microsoft.VC90.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.30729.6161"1". Dependent Assembly Microsoft.VC90.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.30729.6161" could not be found. Please use sxstrace.exe for detailed diagnosis. System errors: ============= Error: (12/29/2015 10:19:38 AM) (Source: BTHUSB) (EventID: 17) (User: ) Description: The local Bluetooth adapter has failed in an undetermined manner and will not be used. The driver has been unloaded. Error: (12/24/2015 03:50:08 PM) (Source: volsnap) (EventID: 36) (User: ) Description: The shadow copies of volume C: were aborted because the shadow copy storage could not grow due to a user imposed limit. Error: (12/21/2015 06:18:43 AM) (Source: Service Control Manager) (EventID: 7011) (User: ) Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Netman service. Error: (12/20/2015 01:42:54 PM) (Source: Service Control Manager) (EventID: 7011) (User: ) Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the ShellHWDetection service. Error: (12/16/2015 03:31:22 PM) (Source: volsnap) (EventID: 36) (User: ) Description: The shadow copies of volume C: were aborted because the shadow copy storage could not grow due to a user imposed limit. Error: (12/15/2015 10:24:07 PM) (Source: BTHUSB) (EventID: 17) (User: ) Description: The local Bluetooth adapter has failed in an undetermined manner and will not be used. The driver has been unloaded. Error: (12/13/2015 03:50:30 PM) (Source: Server) (EventID: 2505) (User: ) Description: The server could not bind to the transport \Device\NetBT_Tcpip_{88FF4958-04E4-4305-921D-674F7A075739} because another computer on the network has the same name. The server could not start. Error: (12/12/2015 09:52:14 AM) (Source: Server) (EventID: 2505) (User: ) Description: The server could not bind to the transport \Device\NetBT_Tcpip_{88FF4958-04E4-4305-921D-674F7A075739} because another computer on the network has the same name. The server could not start. Error: (12/02/2015 01:31:38 PM) (Source: volsnap) (EventID: 36) (User: ) Description: The shadow copies of volume C: were aborted because the shadow copy storage could not grow due to a user imposed limit. Error: (11/30/2015 04:55:54 PM) (Source: Service Control Manager) (EventID: 7011) (User: ) Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the SynTPEnhService service.
==================== Memory info ===========================
Processor: Intel(R) Pentium(R) CPU N3540 @ 2.16GHz Percentage of memory in use: 91% Total physical RAM: 3982.36 MB Available physical RAM: 347.22 MB Total Virtual: 7962.93 MB Available Virtual: 2481.36 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:172.69 GB) (Free:17.86 GB) NTFS Drive d: () (Fixed) (Total:292.97 GB) (Free:292.51 GB) NTFS Drive e: (Sims3EP10) (CDROM) (Total:4.37 GB) (Free:0 GB) UDF ==================== MBR & Partition Table ==================
======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 14D9A6E2) Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=172.7 GB) - (Type=07 NTFS) Partition 3: (Not Active) - (Size=293 GB) - (Type=07 NTFS) ==================== End of Addition.txt ============================"]

And here is the Roguekiller text:

RogueKiller V11.0.5.0 [Dec 28 2015] (Free) by Adlice Software mail : http://www.adlice.com/contact/ Feedback : http://forum.adlice.com Website : http://www.adlice.com/software/roguekiller/ Blog : http://www.adlice.com Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version Started in : Normal mode User : user [Administrator] Started from : C:\Users\user\Downloads\RogueKiller.exe Mode : Scan -- Date : 12/29/2015 11:24:49 ¤¤¤ Processes : 0 ¤¤¤ ¤¤¤ Registry : 0 ¤¤¤ ¤¤¤ Tasks : 0 ¤¤¤ ¤¤¤ Files : 0 ¤¤¤ ¤¤¤ Hosts File : 0 ¤¤¤ ¤¤¤ Antirootkit : 8 (Driver: Not loaded [0xc000036b]) ¤¤¤ [IAT:Inl(Hook.IEAT)] (chrome.exe @ KERNEL32.dll) ntdll!LdrUnloadDll : Unknown @ 0x303fc (jmp 0x8874f225|jmp 0x6b36d334) [IAT:Inl(Hook.IEAT)] (chrome.exe @ KERNEL32.dll) ntdll!LdrUnloadDll : Unknown @ 0x7603fc (jmp 0x88e7f225|jmp 0x6ac3d334) [IAT:Inl(Hook.IEAT)] (chrome.exe @ KERNEL32.dll) ntdll!LdrUnloadDll : Unknown @ 0x10003fc (jmp 0x8971f225|jmp 0x6a39d334) [IAT:Inl(Hook.IEAT)] (chrome.exe @ USER32.dll) ntdll!NlsAnsiCodePage : Unknown @ 0x77708b2c (call 0xffd68b17) [IAT:Inl(Hook.IEAT)] (chrome.exe @ KERNEL32.dll) ntdll!LdrUnloadDll : Unknown @ 0xf103fc (jmp 0x8962f225|jmp 0x6a48d334) [IAT:Inl(Hook.IEAT)] (chrome.exe @ KERNEL32.dll) ntdll!LdrUnloadDll : Unknown @ 0x4703fc (jmp 0x88b8f225|jmp 0x6af2d334) [IAT:Inl(Hook.IEAT)] (chrome.exe @ KERNEL32.dll) ntdll!LdrUnloadDll : Unknown @ 0x7703fc (jmp 0x88e8f225|jmp 0x6ac2d334) [IAT:Inl(Hook.IEAT)] (chrome.exe @ KERNEL32.dll) ntdll!LdrUnloadDll : Unknown @ 0x1303fc (jmp 0x8884f225|jmp 0x6b26d334) ¤¤¤ Web browsers : 0 ¤¤¤ ¤¤¤ MBR Check : ¤¤¤ +++++ PhysicalDrive0: WDC WD5000LPVX-22V0TT0 ATA Device +++++ --- User --- [MBR] d8bb9081d19848ca3529bf5ec80d89c0 [BSP] 2c6db87d84e6f34314bec7ac7332c5f8 : Windows Vista/7/8|VT.Unknown MBR Code Partition table: 0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 100 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader] 1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 206848 | Size: 176838 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader] 2 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 362371072 | Size: 300000 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader] User = LL1 ... OK User = LL2 ... OK"
 

kevinf80

Kevin
Malware Specialist
Joined
Mar 21, 2006
Messages
11,390
Unable to read those logs, they are in wrong context... Open Notepad select "Format" from menubar, make sure word wrap is not selected.... We now need to run the scans again as follows:

Run FRST one more time, ensure all boxes are checkmarked under "Whitelist" but only Addition.txt under "Optional scan" Select scan, when done post the new logs....

Next,

Open RogueKiller....

  • Quit all running programs.
  • For Windows XP, double-click to start.
  • For Vista,Windows 7/8/8.1/10, Right-click on the program and select Run as Administrator to start and when prompted allow it to run.
  • Read and accept the EULA (End User Licene Agreement)
  • Click Scan to scan the system.
  • When the scan completes select "Report",in the next window select "Export txt" the log will open as a text file post that log... Also save to your Desktop for reference. log will open.
  • Close the program > Don't Fix anything!

Post those produced logs....

Thank you,

Kevin
 

xions

Thread Starter
Joined
Dec 28, 2015
Messages
7
Hello again Kevin (and happy new year!!)
I'm sending you the logs below
but before that i wanted to tell you something i have overlooked; a lot of these ads (most of them) have a little grey text above them that says "Related search by Constant Fun", which definitely means it came with another software i probably downloaded, but the problem is that Constant Fun is not in my programs, therefore i can't uninstall it, i thought maybe it's hidden under another name and so i deleted pretty much everything (only leaving a couple of my safe and trusted softwares, some "malware scanners" that i was too lazy to uninstall along with my sims games), i also checked my google extensions,tried cleaning everything, but i failed once again. I have no idea how "Constant Fun" is still hidden in my computer but i hope i can delete it.

Alright, enough talking. Here are the logs:

FRST:

Additional scan result of Farbar Recovery Scan Tool (x64) Version:28-12-2015
Ran by user (2016-01-01 18:41:42)
Running from C:\Users\user\Downloads
Windows 7 Ultimate Service Pack 1 (X64) (2015-10-21 12:36:46)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-648563939-3901689258-777139593-500 - Administrator - Disabled)
Guest (S-1-5-21-648563939-3901689258-777139593-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-648563939-3901689258-777139593-1002 - Limited - Enabled)
user (S-1-5-21-648563939-3901689258-777139593-1000 - Administrator - Enabled) => C:\Users\user

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Enabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
FW: avast! Antivirus (Enabled) {2F96FC65-F07D-9D1E-5A6E-3DA5C487EAF0}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Flash Player 19 PPAPI (HKLM-x32\...\Adobe Flash Player PPAPI) (Version: 19.0.0.245 - Adobe Systems Incorporated)
ALPS Touch Pad Driver (HKLM\...\{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}) (Version: 7.106.2015.1105 - Alps Electric)
Avast Internet Security (HKLM-x32\...\Avast) (Version: 11.1.2245 - AVAST Software)
BitTorrent (HKU\S-1-5-21-648563939-3901689258-777139593-1000\...\BitTorrent) (Version: 7.9.5.41373 - BitTorrent Inc.)
Dll-Files Fixer (HKLM-x32\...\Dll-Files Fixer_is1) (Version: 3.3.90 - Dll-Files.com)
ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version: - )
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 47.0.2526.106 - Google Inc.)
Google Update Helper (x32 Version: 1.3.29.1 - Google Inc.) Hidden
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.4226 - Intel Corporation)
Malwarebytes Anti-Malware version 2.2.0.1024 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.0.1024 - Malwarebytes)
Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended (HKLM\...\Microsoft .NET Framework 4 Extended) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft Office Enterprise 2007 (HKLM-x32\...\ENTERPRISE) (Version: 12.0.4518.1014 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
NVIDIA Graphics Driver 355.82 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 355.82 - NVIDIA Corporation)
NVIDIA Update 2.5.14.5 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 2.5.14.5 - NVIDIA Corporation)
Opera Stable 34.0.2036.25 (HKLM-x32\...\Opera 34.0.2036.25) (Version: 34.0.2036.25 - Opera Software)
Origin (HKLM-x32\...\Origin) (Version: 9.0.14.2148 - Electronic Arts, Inc.)
PhotoFiltre (HKU\S-1-5-21-648563939-3901689258-777139593-1000\...\PhotoFiltre) (Version: - )
PhotoFiltre 7 (HKU\S-1-5-21-648563939-3901689258-777139593-1000\...\PhotoFiltre 7) (Version: - )
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7592 - Realtek Semiconductor Corp.)
SafeZone Stable 1.46.1990.144 (x32 Version: 1.46.1990.144 - Avast Software) Hidden
Skype™ 7.15 (HKLM-x32\...\{6A0549A9-1B96-498C-ACBC-3943001FEB19}) (Version: 7.15.102 - Skype Technologies S.A.)
SpyHunter 4 (HKLM-x32\...\SpyHunter) (Version: 4.21.10.4584 - Enigma Software Group, LLC)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 19.0.9.4 - Synaptics Incorporated)
The Sims Medieval (HKLM-x32\...\{83BEEFB4-8C28-4F4F-8A9D-E0D1ADCE335B}) (Version: 1.0.0 - Electronic Arts)
The Sims™ 3 (HKLM-x32\...\{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}) (Version: 1.69.36.024017 - Electronic Arts Inc.)
The Sims™ 3 Ambitions (HKLM-x32\...\{910F4A29-1134-49E0-AD8B-56E4A3152BD1}) (Version: 4.0.87 - Electronic Arts)
The Sims™ 3 Generations (HKLM-x32\...\{E6B88BD6-E4B2-4701-A648-B6DAC6E491CC}) (Version: 8.0.152 - Electronic Arts)
The Sims™ 3 Island Paradise (HKLM-x32\...\{DB21639E-FE55-432C-BCA2-0C5249E3F79E}) (Version: 19.0.101 - Electronic Arts)
The Sims™ 3 Late Night (HKLM-x32\...\{45057FCE-5784-48BE-8176-D9D00AF56C3C}) (Version: 6.0.81 - Electronic Arts)
The Sims™ 3 Pets (HKLM-x32\...\{C12631C6-804D-4B32-B0DD-8A496462F106}) (Version: 10.0.96 - Electronic Arts)
The Sims™ 3 Seasons (HKLM-x32\...\{3DE92282-CB49-434F-81BF-94E5B380E889}) (Version: 16.0.136 - Electronic Arts)
The Sims™ 3 Supernatural (HKLM-x32\...\{B37DAFA5-717D-41F8-BDFB-3A4B68C0B3A1}) (Version: 15.0.135 - Electronic Arts)
The Sims™ 3 University Life (HKLM-x32\...\{F26DE8EF-F2CF-40DC-8CDA-CC0D82D11B36}) (Version: 18.0.126 - Electronic Arts)
WinRAR 5.30 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.30.0 - win.rar GmbH)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-648563939-3901689258-777139593-1000_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\Windows\system32\igfxEM.exe (Intel Corporation)

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {27CC4857-3369-476B-AB0D-6F8B31FD375C} - System32\Tasks\SafeZone scheduled Autoupdate 1451313571 => C:\Program Files\AVAST Software\SZBrowser\launcher.exe [2015-12-21] (Avast Software)
Task: {2DA09B75-8ABB-4886-B53A-70020DB63BFC} - System32\Tasks\Adobe Flash Player PPAPI Notifier => C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_19_0_0_245_pepper.exe [2015-11-24] (Adobe Systems Incorporated)
Task: {30D07540-10F1-47BB-A95D-D4866732095A} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2015-12-28] (AVAST Software)
Task: {419974CC-CC69-4C70-B366-B26BBF17FA2A} - System32\Tasks\DLL-Files.Com Fixer_Updates => C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe [2015-10-30] (Dll-FIles.Com)
Task: {427CED9C-271F-49AE-AB8E-17A8D31F4F15} - System32\Tasks\DLL-Files.Com Fixer_MONTHLY => C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe [2015-10-30] (Dll-FIles.Com)
Task: {4FC002AB-AD00-48B5-99D1-56C2D78854AE} - System32\Tasks\AVAST Software\Avast settings backup => C:\Program Files\Common Files\AV\avast! Antivirus\backup.exe [2015-12-28] (AVAST Software)
Task: {56884CEC-CEF6-4BF6-834C-4763C66D3C37} - System32\Tasks\Opera scheduled Autoupdate 1445512388 => C:\Program Files (x86)\Opera\launcher.exe [2015-12-04] (Opera Software)
Task: {70512FFE-F47D-428C-BDD7-5E5A51DE8E94} - System32\Tasks\RDReminder => C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe [2015-10-30] (Dll-FIles.Com)
Task: {7F6B0611-E57F-4E57-B8FA-D5F22F5D037A} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-11-22] (Google Inc.)
Task: {85985F01-D52E-416D-AC96-9881758BE0E4} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-11-22] (Google Inc.)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player PPAPI Notifier.job => C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_19_0_0_245_pepper.exe
Task: C:\Windows\Tasks\DLL-Files.Com Fixer_MONTHLY.job => C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe
Task: C:\Windows\Tasks\DLL-Files.Com Fixer_Updates.job => C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Shortcuts =============================

(The entries could be listed to be restored or removed.)

==================== Loaded Modules (Whitelisted) ==============

2015-10-21 17:35 - 2015-08-25 22:46 - 00011896 _____ () C:\Program Files\NVIDIA Corporation\CoProcManager\detoured.dll
2015-10-21 17:37 - 2015-08-25 18:24 - 00116344 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2015-05-20 19:20 - 2000-04-27 17:15 - 00643072 _____ () C:\KDWin\KDWIN.EXE
2016-01-01 18:29 - 2015-05-14 11:54 - 00422600 _____ () C:\Program Files (x86)\ESET\ESET Online Scanner\OnlineCmdLineScanner.exe
2015-12-28 18:29 - 2015-12-28 18:29 - 00103888 _____ () C:\Program Files\AVAST Software\Avast\log.dll
2015-12-28 18:29 - 2015-12-28 18:29 - 00125512 _____ () C:\Program Files\AVAST Software\Avast\JsonRpcServer.dll
2016-01-01 14:24 - 2016-01-01 14:24 - 02808832 _____ () C:\Program Files\AVAST Software\Avast\defs\16010100\algo.dll
2015-12-28 18:29 - 2015-12-28 18:29 - 00469008 _____ () C:\Program Files\AVAST Software\Avast\ffl2.dll
2015-10-21 17:35 - 2015-08-25 22:46 - 00011896 _____ () C:\Program Files (x86)\NVIDIA Corporation\CoProcManager\detoured.dll
2015-11-14 03:30 - 2015-11-14 03:30 - 00147136 ____R () C:\Program Files (x86)\Skype\Phone\ssScreenVVS2.dll
2015-05-20 19:20 - 2000-04-28 14:33 - 00126976 _____ () C:\KDWin\KDWKeys.dll
2015-12-28 18:29 - 2015-12-28 18:29 - 40539648 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2015-12-17 17:32 - 2015-12-11 07:54 - 01583432 _____ () C:\Program Files (x86)\Google\Chrome\Application\47.0.2526.106\libglesv2.dll
2015-12-17 17:32 - 2015-12-11 07:54 - 00081224 _____ () C:\Program Files (x86)\Google\Chrome\Application\47.0.2526.106\libegl.dll
2015-12-26 10:45 - 2015-12-24 07:46 - 16792256 _____ () C:\Users\user\AppData\Local\Google\Chrome\User Data\PepperFlash\20.0.0.267\pepflashplayer.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)


==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)


==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 06:34 - 2009-06-11 01:00 - 00000824 ____N C:\Windows\system32\Drivers\etc\hosts


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-648563939-3901689258-777139593-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\user\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.1.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)


==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [{30E1523E-14BB-4D16-ADF6-1CF13AE93A96}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{EA92BA8E-38EB-4039-B57E-0789970552F8}] => (Allow) C:\Users\user\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{9BE393DC-7636-48C2-B44D-760D24BF05FD}] => (Allow) C:\Users\user\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{C0354B1B-159D-4AB9-AA57-6238CFAAA551}] => (Allow) C:\Users\user\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{AB643C32-66A0-41FA-91E1-62B1D1E6552B}] => (Allow) C:\Users\user\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{2C4DFF5D-1992-4242-959A-F572ADD15C99}] => (Allow) C:\Users\user\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{2E3EB63A-A543-427B-B9F2-B334A4D4807B}] => (Allow) C:\Users\user\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{5E43AFC7-6099-48E0-A34F-D3F303F98C1E}] => (Allow) C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe
FirewallRules: [{50AFB2CC-DDD8-4AC0-88EE-5ABFF6286545}] => (Allow) C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe
FirewallRules: [{B6590EA6-5374-4D32-9E9E-C90F3611CC49}] => (Allow) C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe
FirewallRules: [{B787A3BA-22D5-4D3E-9BA4-99DFDF015C65}] => (Allow) C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe
FirewallRules: [{05C5603A-892B-4E98-80E3-E442DEF99137}] => (Allow) C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe
FirewallRules: [{0BC06465-D609-4EF0-A6FD-3DE958BB3725}] => (Allow) C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe
FirewallRules: [{5025AEA9-DCBD-46C2-929D-ED28FE4FA863}] => (Allow) C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe
FirewallRules: [{8181ACF5-2E79-4C40-85C7-423AD571A643}] => (Allow) C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe
FirewallRules: [{3EF363FB-35EA-4FD5-9597-9C9B3638896B}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
FirewallRules: [{7FB74ABB-23A4-49F9-BB0B-74FC36DEA0F1}] => (Allow) C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe
FirewallRules: [{69B4C01F-3F22-4B91-9D4B-123DED4D99C1}] => (Allow) C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe
FirewallRules: [{3E4FF3AA-3735-4D0D-91A6-E8C9CB55624B}] => (Allow) C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe
FirewallRules: [{956035AE-1C1D-44C3-B444-07DC4BF3C534}] => (Allow) C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe
FirewallRules: [{83D0A8B5-D092-4CF5-B697-84EE6D6198B1}] => (Allow) C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe

==================== Restore Points =========================

28-12-2015 10:02:35 Installed Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
28-12-2015 18:31:07 Device Driver Package Install: Avast Network Service
31-12-2015 13:33:04 Removed Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

==================== Faulty Device Manager Devices =============

Name: Intel(R) USB 3.0 eXtensible Host Controller
Description: Intel(R) USB 3.0 eXtensible Host Controller
Class Guid: {36fc9e60-c465-11cf-8056-444553540000}
Manufacturer: Intel(R) Corporation
Service: iusb3xhc
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (01/01/2016 06:39:01 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Activation context generation failed for "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1".Error in manifest or policy file "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" on line C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Component 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (01/01/2016 06:28:26 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Activation context generation failed for "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1".Error in manifest or policy file "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" on line C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Component 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (01/01/2016 05:40:09 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/01/2016 05:21:25 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: TS3.exe, version: 0.0.0.0, time stamp: 0x56381026
Faulting module name: TS3.exe, version: 0.0.0.0, time stamp: 0x56381026
Exception code: 0xc0000005
Fault offset: 0x005becbc
Faulting process id: 0xd1c
Faulting application start time: 0xTS3.exe0
Faulting application path: TS3.exe1
Faulting module path: TS3.exe2
Report Id: TS3.exe3

Error: (12/29/2015 10:55:54 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program mbam.exe version 2.3.125.0 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

Process ID: 8c8

Start Time: 01d14179e897f691

Termination Time: 171

Application Path: C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe

Report Id:

Error: (12/29/2015 10:55:54 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program Skype.exe version 7.15.0.102 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

Process ID: 7dc

Start Time: 01d1417a459f091f

Termination Time: 261

Application Path: C:\Program Files (x86)\Skype\Phone\Skype.exe

Report Id:

Error: (12/29/2015 10:48:44 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program FRST64.exe version 28.12.2015.0 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

Process ID: 17c8

Start Time: 01d14201e8180ee6

Termination Time: 5

Application Path: C:\Users\user\Downloads\FRST64.exe

Report Id:

Error: (12/28/2015 06:14:53 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/28/2015 10:02:27 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Activation context generation failed for "Microsoft.VC90.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.30729.6161"1".
Dependent Assembly Microsoft.VC90.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.30729.6161" could not be found.
Please use sxstrace.exe for detailed diagnosis.

Error: (12/28/2015 10:02:27 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Activation context generation failed for "Microsoft.VC90.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.30729.6161"1".
Dependent Assembly Microsoft.VC90.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.30729.6161" could not be found.
Please use sxstrace.exe for detailed diagnosis.


System errors:
=============
Error: (01/01/2016 06:34:34 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The eapihdrv service failed to start due to the following error:
%%1275

Error: (01/01/2016 06:34:34 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: \??\C:\Users\user\AppData\Local\Temp\ehdrv.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.

Error: (01/01/2016 06:34:34 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The eapihdrv service failed to start due to the following error:
%%1275

Error: (01/01/2016 06:34:34 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: \??\C:\Users\user\AppData\Local\Temp\ehdrv.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.

Error: (01/01/2016 06:34:33 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The eapihdrv service failed to start due to the following error:
%%1275

Error: (01/01/2016 06:34:33 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: \??\C:\Users\user\AppData\Local\Temp\ehdrv.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.

Error: (01/01/2016 06:30:21 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The eapihdrv service failed to start due to the following error:
%%1275

Error: (01/01/2016 06:30:21 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: \??\C:\Users\user\AppData\Local\Temp\ehdrv.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.

Error: (01/01/2016 06:30:20 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The eapihdrv service failed to start due to the following error:
%%1275

Error: (01/01/2016 06:30:20 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: \??\C:\Users\user\AppData\Local\Temp\ehdrv.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.


CodeIntegrity:
===================================
Date: 2015-12-29 10:45:00.954
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\TrueSight.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2015-12-29 10:45:00.935
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\TrueSight.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2015-12-29 10:42:53.570
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\TrueSight.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2015-12-29 10:42:53.552
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\TrueSight.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.


==================== Memory info ===========================

Processor: Intel(R) Pentium(R) CPU N3540 @ 2.16GHz
Percentage of memory in use: 71%
Total physical RAM: 3982.36 MB
Available physical RAM: 1126.36 MB
Total Virtual: 7962.93 MB
Available Virtual: 4807.79 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:172.69 GB) (Free:21.75 GB) NTFS
Drive d: () (Fixed) (Total:292.97 GB) (Free:292.51 GB) NTFS
Drive e: (Sims3EP10) (CDROM) (Total:4.37 GB) (Free:0 GB) UDF

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 14D9A6E2)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=172.7 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=293 GB) - (Type=07 NTFS)

==================== End of Addition.txt ============================

Roguekiller:


RogueKiller V11.0.5.0 [Dec 28 2015] (Free) by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Website : http://www.adlice.com/software/roguekiller/
Blog : http://www.adlice.com

Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User : user [Administrator]
Started from : C:\Users\user\Downloads\RogueKiller.exe
Mode : Scan -- Date : 01/01/2016 19:18:41

¤¤¤ Processes : 0 ¤¤¤

¤¤¤ Registry : 0 ¤¤¤

¤¤¤ Tasks : 0 ¤¤¤

¤¤¤ Files : 0 ¤¤¤

¤¤¤ Hosts File : 0 ¤¤¤

¤¤¤ Antirootkit : 8 (Driver: Not loaded [0xc000036b]) ¤¤¤
[IAT:Inl(Hook.IEAT)] (chrome.exe @ KERNEL32.dll) ntdll!LdrUnloadDll : Unknown @ 0x303fc (jmp 0x8862f225|jmp 0x6c9dd334)
[IAT:Inl(Hook.IEAT)] (chrome.exe @ KERNEL32.dll) ntdll!LdrUnloadDll : Unknown @ 0x10703fc (jmp 0x8966f225|jmp 0x6b99d334)
[IAT:Inl(Hook.IEAT)] (chrome.exe @ KERNEL32.dll) ntdll!LdrUnloadDll : Unknown @ 0x1e03fc (jmp 0x887df225|jmp 0x6c82d334)
[IAT:Inl(Hook.IEAT)] (chrome.exe @ KERNEL32.dll) ntdll!LdrUnloadDll : Unknown @ 0x4d03fc (jmp 0x88acf225|jmp 0x6c53d334)
[IAT:Inl(Hook.IEAT)] (chrome.exe @ KERNEL32.dll) ntdll!LdrUnloadDll : Unknown @ 0xce03fc (jmp 0x892df225|jmp 0x6bd2d334)
[IAT:Inl(Hook.IEAT)] (chrome.exe @ KERNEL32.dll) ntdll!LdrUnloadDll : Unknown @ 0xe303fc (jmp 0x8942f225|jmp 0x6bbdd334)
[IAT:Inl(Hook.IEAT)] (chrome.exe @ KERNEL32.dll) ntdll!LdrUnloadDll : Unknown @ 0x7d03fc (jmp 0x88dcf225|jmp 0x6c23d334)
[IAT:Inl(Hook.IEAT)] (chrome.exe @ KERNEL32.dll) ntdll!LdrUnloadDll : Unknown @ 0x3103fc (jmp 0x8890f225|jmp 0x6c6fd334)

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ MBR Check : ¤¤¤
+++++ PhysicalDrive0: WDC WD5000LPVX-22V0TT0 ATA Device +++++
--- User ---
[MBR] d8bb9081d19848ca3529bf5ec80d89c0
[BSP] 2c6db87d84e6f34314bec7ac7332c5f8 : Windows Vista/7/8|VT.Unknown MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 100 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 206848 | Size: 176838 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
2 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 362371072 | Size: 300000 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
User = LL1 ... OK
User = LL2 ... OK
 
Last edited:

kevinf80

Kevin
Malware Specialist
Joined
Mar 21, 2006
Messages
11,390
Also need the primary log from FRST, FRST.txt logs are saved here:

C:\FRST\Logs
 

xions

Thread Starter
Joined
Dec 28, 2015
Messages
7
This seems to be the first FRST text in the folder, i hope it's the right one

Additional scan result of Farbar Recovery Scan Tool (x64) Version:28-12-2015
Ran by user (2015-12-29 10:37:10)
Running from C:\Users\user\Downloads
Windows 7 Ultimate Service Pack 1 (X64) (2015-10-21 12:36:46)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-648563939-3901689258-777139593-500 - Administrator - Disabled)
Guest (S-1-5-21-648563939-3901689258-777139593-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-648563939-3901689258-777139593-1002 - Limited - Enabled)
user (S-1-5-21-648563939-3901689258-777139593-1000 - Administrator - Enabled) => C:\Users\user

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Enabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
FW: avast! Antivirus (Enabled) {2F96FC65-F07D-9D1E-5A6E-3DA5C487EAF0}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Flash Player 19 PPAPI (HKLM-x32\...\Adobe Flash Player PPAPI) (Version: 19.0.0.245 - Adobe Systems Incorporated)
ALPS Touch Pad Driver (HKLM\...\{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}) (Version: 7.106.2015.1105 - Alps Electric)
Avast Internet Security (HKLM-x32\...\Avast) (Version: 11.1.2245 - AVAST Software)
BitTorrent (HKU\S-1-5-21-648563939-3901689258-777139593-1000\...\BitTorrent) (Version: 7.9.5.41373 - BitTorrent Inc.)
BitTorrent (HKU\S-1-5-21-648563939-3901689258-777139593-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\BitTorrent) (Version: 7.9.5.41373 - BitTorrent Inc.)
Dll-Files Fixer (HKLM-x32\...\Dll-Files Fixer_is1) (Version: 3.3.90 - Dll-Files.com)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 47.0.2526.106 - Google Inc.)
Google Update Helper (x32 Version: 1.3.29.1 - Google Inc.) Hidden
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.4226 - Intel Corporation)
Malwarebytes Anti-Malware version 2.2.0.1024 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.0.1024 - Malwarebytes)
Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended (HKLM\...\Microsoft .NET Framework 4 Extended) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft Office Enterprise 2007 (HKLM-x32\...\ENTERPRISE) (Version: 12.0.4518.1014 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
NVIDIA Graphics Driver 355.82 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 355.82 - NVIDIA Corporation)
NVIDIA Update 2.5.14.5 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 2.5.14.5 - NVIDIA Corporation)
Opera Stable 34.0.2036.25 (HKLM-x32\...\Opera 34.0.2036.25) (Version: 34.0.2036.25 - Opera Software)
Origin (HKLM-x32\...\Origin) (Version: 9.0.14.2148 - Electronic Arts, Inc.)
PhotoFiltre (HKU\S-1-5-21-648563939-3901689258-777139593-1000\...\PhotoFiltre) (Version: - )
PhotoFiltre (HKU\S-1-5-21-648563939-3901689258-777139593-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\PhotoFiltre) (Version: - )
PhotoFiltre 7 (HKU\S-1-5-21-648563939-3901689258-777139593-1000\...\PhotoFiltre 7) (Version: - )
PhotoFiltre 7 (HKU\S-1-5-21-648563939-3901689258-777139593-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\PhotoFiltre 7) (Version: - )
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7592 - Realtek Semiconductor Corp.)
SafeZone Stable 1.46.1990.139 (x32 Version: 1.46.1990.139 - Avast Software) Hidden
Skype™ 7.15 (HKLM-x32\...\{6A0549A9-1B96-498C-ACBC-3943001FEB19}) (Version: 7.15.102 - Skype Technologies S.A.)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 19.0.9.4 - Synaptics Incorporated)
The Sims Medieval (HKLM-x32\...\{83BEEFB4-8C28-4F4F-8A9D-E0D1ADCE335B}) (Version: 1.0.0 - Electronic Arts)
The Sims™ 3 (HKLM-x32\...\{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}) (Version: 1.69.36.024017 - Electronic Arts Inc.)
The Sims™ 3 Ambitions (HKLM-x32\...\{910F4A29-1134-49E0-AD8B-56E4A3152BD1}) (Version: 4.0.87 - Electronic Arts)
The Sims™ 3 Generations (HKLM-x32\...\{E6B88BD6-E4B2-4701-A648-B6DAC6E491CC}) (Version: 8.0.152 - Electronic Arts)
The Sims™ 3 Island Paradise (HKLM-x32\...\{DB21639E-FE55-432C-BCA2-0C5249E3F79E}) (Version: 19.0.101 - Electronic Arts)
The Sims™ 3 Late Night (HKLM-x32\...\{45057FCE-5784-48BE-8176-D9D00AF56C3C}) (Version: 6.0.81 - Electronic Arts)
The Sims™ 3 Pets (HKLM-x32\...\{C12631C6-804D-4B32-B0DD-8A496462F106}) (Version: 10.0.96 - Electronic Arts)
The Sims™ 3 Seasons (HKLM-x32\...\{3DE92282-CB49-434F-81BF-94E5B380E889}) (Version: 16.0.136 - Electronic Arts)
The Sims™ 3 Supernatural (HKLM-x32\...\{B37DAFA5-717D-41F8-BDFB-3A4B68C0B3A1}) (Version: 15.0.135 - Electronic Arts)
The Sims™ 3 University Life (HKLM-x32\...\{F26DE8EF-F2CF-40DC-8CDA-CC0D82D11B36}) (Version: 18.0.126 - Electronic Arts)
VideoPad Video Editor (HKLM-x32\...\VideoPad) (Version: 4.22 - NCH Software)
WinRAR 5.30 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.30.0 - win.rar GmbH)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-648563939-3901689258-777139593-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\Windows\system32\igfxEM.exe (Intel Corporation)
CustomCLSID: HKU\S-1-5-21-648563939-3901689258-777139593-1000_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\Windows\system32\igfxEM.exe (Intel Corporation)

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {237C2BB7-CCEA-4611-91D7-DBEA137C8890} - System32\Tasks\SafeZone scheduled Autoupdate 1451313571 => C:\Program Files\AVAST Software\SZBrowser\launcher.exe [2015-12-01] (Avast Software)
Task: {2DA09B75-8ABB-4886-B53A-70020DB63BFC} - System32\Tasks\Adobe Flash Player PPAPI Notifier => C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_19_0_0_245_pepper.exe [2015-11-24] (Adobe Systems Incorporated)
Task: {30D07540-10F1-47BB-A95D-D4866732095A} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2015-12-28] (AVAST Software)
Task: {3F34F31F-6C75-439C-B373-DF6259A4B69A} - System32\Tasks\RDReminder => C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe [2015-10-30] (Dll-FIles.Com)
Task: {419974CC-CC69-4C70-B366-B26BBF17FA2A} - System32\Tasks\DLL-Files.Com Fixer_Updates => C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe [2015-10-30] (Dll-FIles.Com)
Task: {427CED9C-271F-49AE-AB8E-17A8D31F4F15} - System32\Tasks\DLL-Files.Com Fixer_MONTHLY => C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe [2015-10-30] (Dll-FIles.Com)
Task: {4FC002AB-AD00-48B5-99D1-56C2D78854AE} - System32\Tasks\AVAST Software\Avast settings backup => C:\Program Files\Common Files\AV\avast! Antivirus\backup.exe [2015-12-28] (AVAST Software)
Task: {56884CEC-CEF6-4BF6-834C-4763C66D3C37} - System32\Tasks\Opera scheduled Autoupdate 1445512388 => C:\Program Files (x86)\Opera\launcher.exe [2015-12-04] (Opera Software)
Task: {7F6B0611-E57F-4E57-B8FA-D5F22F5D037A} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-11-22] (Google Inc.)
Task: {85985F01-D52E-416D-AC96-9881758BE0E4} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-11-22] (Google Inc.)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player PPAPI Notifier.job => C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_19_0_0_245_pepper.exe
Task: C:\Windows\Tasks\DLL-Files.Com Fixer_MONTHLY.job => C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe
Task: C:\Windows\Tasks\DLL-Files.Com Fixer_Updates.job => C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Shortcuts =============================

(The entries could be listed to be restored or removed.)

==================== Loaded Modules (Whitelisted) ==============

2015-10-21 17:35 - 2015-08-25 22:46 - 00011896 _____ () C:\Program Files\NVIDIA Corporation\CoProcManager\detoured.dll
2015-10-21 17:37 - 2015-08-25 18:24 - 00116344 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2015-05-20 19:20 - 2000-04-27 17:15 - 00643072 _____ () C:\KDWin\KDWIN.EXE
2015-10-21 17:25 - 2015-08-27 15:33 - 00135216 _____ () C:\Program Files\Realtek\Audio\HDA\FMAPP.exe
2015-10-21 17:35 - 2015-08-25 22:46 - 00011896 _____ () C:\Program Files (x86)\NVIDIA Corporation\CoProcManager\detoured.dll
2015-11-14 03:30 - 2015-11-14 03:30 - 00147136 ____R () C:\Program Files (x86)\Skype\Phone\ssScreenVVS2.dll
2015-05-20 19:20 - 2000-04-28 14:33 - 00126976 _____ () C:\KDWin\KDWKeys.dll
2015-12-28 18:29 - 2015-12-28 18:29 - 00103888 _____ () C:\Program Files\AVAST Software\Avast\log.dll
2015-12-28 18:29 - 2015-12-28 18:29 - 00125512 _____ () C:\Program Files\AVAST Software\Avast\JsonRpcServer.dll
2015-12-28 18:29 - 2015-12-28 18:29 - 02990080 _____ () C:\Program Files\AVAST Software\Avast\defs\15110499\algo.dll
2015-12-28 18:29 - 2015-12-28 18:29 - 00469008 _____ () C:\Program Files\AVAST Software\Avast\ffl2.dll
2015-12-28 18:29 - 2015-12-28 18:29 - 00241896 _____ () C:\Program Files\AVAST Software\Avast\browser_pass.dll
2015-12-28 22:37 - 2015-12-28 22:37 - 02806272 _____ () C:\Program Files\AVAST Software\Avast\defs\15122802\algo.dll
2015-12-28 18:29 - 2015-12-28 18:29 - 40539648 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2015-11-26 17:45 - 2015-11-26 17:45 - 01016832 _____ () C:\Program Files (x86)\Origin\platforms\qwindows.dll
2015-11-26 17:45 - 2015-11-26 17:45 - 00028160 _____ () C:\Program Files (x86)\Origin\imageformats\qgif.dll
2015-11-26 17:45 - 2015-11-26 17:45 - 00029696 _____ () C:\Program Files (x86)\Origin\imageformats\qico.dll
2015-11-26 17:45 - 2015-11-26 17:45 - 00256000 _____ () C:\Program Files (x86)\Origin\imageformats\qjpeg.dll
2015-11-26 17:45 - 2015-11-26 17:45 - 00266240 _____ () C:\Program Files (x86)\Origin\imageformats\qmng.dll
2015-11-26 17:45 - 2015-11-26 17:45 - 00023552 _____ () C:\Program Files (x86)\Origin\imageformats\qtga.dll
2015-11-26 17:45 - 2015-11-26 17:45 - 00346112 _____ () C:\Program Files (x86)\Origin\imageformats\qtiff.dll
2015-11-26 17:45 - 2015-11-26 17:45 - 00023552 _____ () C:\Program Files (x86)\Origin\imageformats\qwbmp.dll
2015-11-26 17:45 - 2015-11-26 17:45 - 00243200 _____ () C:\Program Files (x86)\Origin\mediaservice\wmfengine.dll
2015-12-17 17:32 - 2015-12-11 07:54 - 01583432 _____ () C:\Program Files (x86)\Google\Chrome\Application\47.0.2526.106\libglesv2.dll
2015-12-17 17:32 - 2015-12-11 07:54 - 00081224 _____ () C:\Program Files (x86)\Google\Chrome\Application\47.0.2526.106\libegl.dll
2015-12-26 10:45 - 2015-12-24 07:46 - 16792256 _____ () C:\Users\user\AppData\Local\Google\Chrome\User Data\PepperFlash\20.0.0.267\pepflashplayer.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)


==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)


==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 06:34 - 2009-06-11 01:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-648563939-3901689258-777139593-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\user\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
HKU\S-1-5-21-648563939-3901689258-777139593-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Control Panel\Desktop\\Wallpaper ->
DNS Servers: 192.168.1.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)


==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [{30E1523E-14BB-4D16-ADF6-1CF13AE93A96}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{EA92BA8E-38EB-4039-B57E-0789970552F8}] => (Allow) C:\Users\user\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{9BE393DC-7636-48C2-B44D-760D24BF05FD}] => (Allow) C:\Users\user\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{C0354B1B-159D-4AB9-AA57-6238CFAAA551}] => (Allow) C:\Users\user\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{AB643C32-66A0-41FA-91E1-62B1D1E6552B}] => (Allow) C:\Users\user\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{2C4DFF5D-1992-4242-959A-F572ADD15C99}] => (Allow) C:\Users\user\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{2E3EB63A-A543-427B-B9F2-B334A4D4807B}] => (Allow) C:\Users\user\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{5E43AFC7-6099-48E0-A34F-D3F303F98C1E}] => (Allow) C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe
FirewallRules: [{50AFB2CC-DDD8-4AC0-88EE-5ABFF6286545}] => (Allow) C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe
FirewallRules: [{B6590EA6-5374-4D32-9E9E-C90F3611CC49}] => (Allow) C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe
FirewallRules: [{B787A3BA-22D5-4D3E-9BA4-99DFDF015C65}] => (Allow) C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe
FirewallRules: [{05C5603A-892B-4E98-80E3-E442DEF99137}] => (Allow) C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe
FirewallRules: [{0BC06465-D609-4EF0-A6FD-3DE958BB3725}] => (Allow) C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe
FirewallRules: [{5025AEA9-DCBD-46C2-929D-ED28FE4FA863}] => (Allow) C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe
FirewallRules: [{8181ACF5-2E79-4C40-85C7-423AD571A643}] => (Allow) C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe
FirewallRules: [{3EF363FB-35EA-4FD5-9597-9C9B3638896B}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
FirewallRules: [{7FB74ABB-23A4-49F9-BB0B-74FC36DEA0F1}] => (Allow) C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe
FirewallRules: [{69B4C01F-3F22-4B91-9D4B-123DED4D99C1}] => (Allow) C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe
FirewallRules: [{3E4FF3AA-3735-4D0D-91A6-E8C9CB55624B}] => (Allow) C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe
FirewallRules: [{956035AE-1C1D-44C3-B444-07DC4BF3C534}] => (Allow) C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe

==================== Restore Points =========================

26-12-2015 13:55:29 Scheduled Checkpoint
26-12-2015 15:34:31 Installed TheSims3EP4
28-12-2015 10:02:35 Installed Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
28-12-2015 18:31:07 Device Driver Package Install: Avast Network Service

==================== Faulty Device Manager Devices =============

Name: Bluetooth USB Module
Description: Bluetooth USB Module
Class Guid: {e0cbf06c-cd8b-4647-bb8a-263b43f0f974}
Manufacturer: Qualcomm Atheros Communications
Service: BTHUSB
Problem: : Windows has stopped this device because it has reported problems. (Code 43)
Resolution: One of the drivers controlling the device notified the operating system that the device failed in some manner. For more information about how to diagnose the problem, see the hardware documentation.

Name: Intel(R) USB 3.0 eXtensible Host Controller
Description: Intel(R) USB 3.0 eXtensible Host Controller
Class Guid: {36fc9e60-c465-11cf-8056-444553540000}
Manufacturer: Intel(R) Corporation
Service: iusb3xhc
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (12/28/2015 06:14:53 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/28/2015 10:02:27 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Activation context generation failed for "Microsoft.VC90.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.30729.6161"1".
Dependent Assembly Microsoft.VC90.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.30729.6161" could not be found.
Please use sxstrace.exe for detailed diagnosis.

Error: (12/28/2015 10:02:27 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Activation context generation failed for "Microsoft.VC90.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.30729.6161"1".
Dependent Assembly Microsoft.VC90.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.30729.6161" could not be found.
Please use sxstrace.exe for detailed diagnosis.

Error: (12/28/2015 10:02:27 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Activation context generation failed for "Microsoft.VC90.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.30729.6161"1".
Dependent Assembly Microsoft.VC90.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.30729.6161" could not be found.
Please use sxstrace.exe for detailed diagnosis.

Error: (12/28/2015 10:02:27 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Activation context generation failed for "Microsoft.VC90.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.30729.6161"1".
Dependent Assembly Microsoft.VC90.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.30729.6161" could not be found.
Please use sxstrace.exe for detailed diagnosis.

Error: (12/28/2015 10:02:27 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Activation context generation failed for "Microsoft.VC90.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.30729.6161"1".
Dependent Assembly Microsoft.VC90.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.30729.6161" could not be found.
Please use sxstrace.exe for detailed diagnosis.

Error: (12/28/2015 10:02:27 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Activation context generation failed for "Microsoft.VC90.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.30729.6161"1".
Dependent Assembly Microsoft.VC90.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.30729.6161" could not be found.
Please use sxstrace.exe for detailed diagnosis.

Error: (12/28/2015 10:02:27 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Activation context generation failed for "Microsoft.VC90.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.30729.6161"1".
Dependent Assembly Microsoft.VC90.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.30729.6161" could not be found.
Please use sxstrace.exe for detailed diagnosis.

Error: (12/28/2015 10:02:27 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Activation context generation failed for "Microsoft.VC90.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.30729.6161"1".
Dependent Assembly Microsoft.VC90.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.30729.6161" could not be found.
Please use sxstrace.exe for detailed diagnosis.

Error: (12/28/2015 10:02:27 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Activation context generation failed for "Microsoft.VC90.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.30729.6161"1".
Dependent Assembly Microsoft.VC90.CRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.30729.6161" could not be found.
Please use sxstrace.exe for detailed diagnosis.


System errors:
=============
Error: (12/29/2015 10:19:38 AM) (Source: BTHUSB) (EventID: 17) (User: )
Description: The local Bluetooth adapter has failed in an undetermined manner and will not be used. The driver has been unloaded.

Error: (12/24/2015 03:50:08 PM) (Source: volsnap) (EventID: 36) (User: )
Description: The shadow copies of volume C: were aborted because the shadow copy storage could not grow due to a user imposed limit.

Error: (12/21/2015 06:18:43 AM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Netman service.

Error: (12/20/2015 01:42:54 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the ShellHWDetection service.

Error: (12/16/2015 03:31:22 PM) (Source: volsnap) (EventID: 36) (User: )
Description: The shadow copies of volume C: were aborted because the shadow copy storage could not grow due to a user imposed limit.

Error: (12/15/2015 10:24:07 PM) (Source: BTHUSB) (EventID: 17) (User: )
Description: The local Bluetooth adapter has failed in an undetermined manner and will not be used. The driver has been unloaded.

Error: (12/13/2015 03:50:30 PM) (Source: Server) (EventID: 2505) (User: )
Description: The server could not bind to the transport \Device\NetBT_Tcpip_{88FF4958-04E4-4305-921D-674F7A075739} because another computer on the network has the same name. The server could not start.

Error: (12/12/2015 09:52:14 AM) (Source: Server) (EventID: 2505) (User: )
Description: The server could not bind to the transport \Device\NetBT_Tcpip_{88FF4958-04E4-4305-921D-674F7A075739} because another computer on the network has the same name. The server could not start.

Error: (12/02/2015 01:31:38 PM) (Source: volsnap) (EventID: 36) (User: )
Description: The shadow copies of volume C: were aborted because the shadow copy storage could not grow due to a user imposed limit.

Error: (11/30/2015 04:55:54 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the SynTPEnhService service.


==================== Memory info ===========================

Processor: Intel(R) Pentium(R) CPU N3540 @ 2.16GHz
Percentage of memory in use: 88%
Total physical RAM: 3982.36 MB
Available physical RAM: 462.05 MB
Total Virtual: 7962.93 MB
Available Virtual: 2516.86 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:172.69 GB) (Free:17.86 GB) NTFS
Drive d: () (Fixed) (Total:292.97 GB) (Free:292.51 GB) NTFS
Drive e: (Sims3EP10) (CDROM) (Total:4.37 GB) (Free:0 GB) UDF

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 14D9A6E2)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=172.7 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=293 GB) - (Type=07 NTFS)

==================== End of Addition.txt ============================
 

kevinf80

Kevin
Malware Specialist
Joined
Mar 21, 2006
Messages
11,390
No, that is the secondary log "Addition.txt". You`ve already posted that one...
 

xions

Thread Starter
Joined
Dec 28, 2015
Messages
7
OH! Ah yes, ahah i totally knew that.. that was on purpose yeah ahah...

Here is the real one(i hope):

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:28-12-2015
Ran by user (administrator) on USER-PC (29-12-2015 10:27:36)
Running from C:\Users\user\Downloads
Loaded Profiles: user & (Available Profiles: user)
Platform: Windows 7 Ultimate Service Pack 1 (X64) Language: English (United States)
Internet Explorer Version 8 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe
(Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(Intel Corporation) C:\Windows\System32\igfxTray.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(BitTorrent Inc.) C:\Users\user\AppData\Roaming\BitTorrent\BitTorrent.exe
() C:\KDWin\KDWIN.EXE
(BitTorrent Inc.) C:\Users\user\AppData\Roaming\BitTorrent\updates\7.9.5_41373\utorrentie.exe
(BitTorrent Inc.) C:\Users\user\AppData\Roaming\BitTorrent\updates\7.9.5_41373\utorrentie.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\afwServ.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Electronic Arts) C:\Program Files (x86)\Origin\Origin.exe
(Electronic Arts) C:\Program Files (x86)\Origin\OriginClientService.exe
(Electronic Arts Inc.) C:\Program Files (x86)\Origin Games\The Sims 3\Game\Bin\TS3.exe
() C:\Program Files\Realtek\Audio\HDA\FMAPP.exe
(Microsoft Corporation) C:\Windows\System32\slui.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avBugReport.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe


==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [16404224 2015-08-27] (Realtek Semiconductor)
HKLM\...\Run: [Apoint] => C:\Program Files\Apoint2K\Apoint.exe [369520 2010-09-18] (Alps Electric Co., Ltd.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [3935400 2015-05-29] (Synaptics Incorporated)
HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [31016 2006-10-26] (Microsoft Corporation)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [7021880 2015-12-28] (AVAST Software)
HKLM-x32\...\RunOnce: [20150107] => C:\Program Files\AVAST Software\Avast\setup\emupdate\e0a33115-8f35-4c51-9955-4d45f476bce2.exe [183232 2015-12-28] (AVAST Software)
HKU\S-1-5-21-648563939-3901689258-777139593-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [50509440 2015-11-17] (Skype Technologies S.A.)
HKU\S-1-5-21-648563939-3901689258-777139593-1000\...\Run: [BitTorrent] => C:\Users\user\AppData\Roaming\BitTorrent\BitTorrent.exe [1873952 2015-11-22] (BitTorrent Inc.)
HKU\S-1-5-21-648563939-3901689258-777139593-1000\...\Run: [EADM] => C:\Program Files (x86)\Origin\Origin.exe [3638256 2015-11-26] (Electronic Arts)
HKU\S-1-5-21-648563939-3901689258-777139593-1000\...\MountPoints2: {acf04bb8-7853-11e5-bd3b-806e6f6e6963} - E:\Autorun.exe
HKU\S-1-5-21-648563939-3901689258-777139593-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [50509440 2015-11-17] (Skype Technologies S.A.)
HKU\S-1-5-21-648563939-3901689258-777139593-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [BitTorrent] => C:\Users\user\AppData\Roaming\BitTorrent\BitTorrent.exe [1873952 2015-11-22] (BitTorrent Inc.)
HKU\S-1-5-21-648563939-3901689258-777139593-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [EADM] => C:\Program Files (x86)\Origin\Origin.exe [3638256 2015-11-26] (Electronic Arts)
HKU\S-1-5-21-648563939-3901689258-777139593-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {acf04bb8-7853-11e5-bd3b-806e6f6e6963} - E:\Autorun.exe
AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [176904 2015-08-25] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [155792 2015-08-25] (NVIDIA Corporation)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2015-12-28] (AVAST Software)
Startup: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\KDWin Keyboard Driver.lnk [2015-10-21]
ShortcutTarget: KDWin Keyboard Driver.lnk -> C:\KDWin\KDWIN.EXE ()
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{88FF4958-04E4-4305-921D-674F7A075739}: [DhcpNameServer] 192.168.1.1

Internet Explorer:
==================
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2015-12-28] (AVAST Software)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2006-10-26] (Microsoft Corporation)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2015-12-28] (AVAST Software)
Filter: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2010-11-21] (Microsoft Corporation)
Filter-x32: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2010-11-21] (Microsoft Corporation)
Filter: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2010-11-21] (Microsoft Corporation)
Filter-x32: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2010-11-21] (Microsoft Corporation)

FireFox:
========
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-05] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-05] (Google Inc.)
FF HKLM-x32\...\Firefox\Extensions: [[email protected]] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2015-12-28]

Chrome:
=======
CHR Profile: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Slides) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-11-22]
CHR Extension: (Google Docs) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-11-22]
CHR Extension: (Google Drive) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-11-22]
CHR Extension: (YouTube) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-11-22]
CHR Extension: (Google Search) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-11-22]
CHR Extension: (Google Sheets) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-11-22]
CHR Extension: (Google Docs Offline) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2015-11-22]
CHR Extension: (AdBlock) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2015-12-05]
CHR Extension: (Avast Online Security) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2015-12-28]
CHR Extension: (Chrome Web Store Payments) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-11-22]
CHR Extension: (Gmail) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-11-22]
CHR Profile: C:\Users\user\AppData\Local\Google\Chrome\User Data\Profile 2
CHR Extension: (Google Slides) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-12-05]
CHR Extension: (Google Docs) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\aohghmighlieiainnegkcijnfilokake [2015-12-05]
CHR Extension: (Google Drive) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-12-05]
CHR Extension: (YouTube) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-12-05]
CHR Extension: (Google Search) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-12-05]
CHR Extension: (Google Sheets) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-12-05]
CHR Extension: (Google Docs Offline) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2015-12-05]
CHR Extension: (AdBlock) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2015-12-05]
CHR Extension: (Avast Online Security) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\gomekmidlodglbbmalcneegieacbdmki [2015-12-28]
CHR Extension: (Chrome Web Store Payments) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-12-05]
CHR Extension: (Gmail) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-12-05]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-12-28]

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [226440 2015-12-28] (AVAST Software)
R2 avast! Firewall; C:\Program Files\AVAST Software\Avast\afwServ.exe [109520 2015-12-28] (AVAST Software)
R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [319080 2015-06-04] (Intel Corporation)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1513784 2015-10-05] (Malwarebytes)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1135416 2015-10-05] (Malwarebytes)
R3 Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [2099720 2015-11-26] (Electronic Arts)
R2 SynTPEnhService; C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe [240296 2015-05-29] (Synaptics Incorporated)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2009-07-14] (Microsoft Corporation)

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [28656 2015-12-28] (AVAST Software)
S1 aswKbd; C:\Windows\system32\drivers\aswKbd.sys [28144 2015-12-28] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [97648 2015-12-28] (AVAST Software)
R0 aswNdisFlt; C:\Windows\System32\DRIVERS\aswNdisFlt.sys [466400 2015-12-28] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93528 2015-12-28] (AVAST Software)
S0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65224 2015-12-28] (AVAST Software)
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1055560 2015-12-28] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [451040 2015-12-28] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [155304 2015-12-28] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [273784 2015-12-28] (AVAST Software)
S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3286016 2009-06-11] (Broadcom Corporation)
R3 int0800; C:\Windows\System32\DRIVERS\flashud.sys [51712 2009-09-09] (Intel Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-10-05] (Malwarebytes)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [192216 2015-12-29] (Malwarebytes)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-10-05] (Malwarebytes Corporation)
R3 RTSPER; C:\Windows\System32\DRIVERS\RtsPer.sys [752856 2015-05-29] (Realsil Semiconductor Corporation)
R3 SmbDrvI; C:\Windows\System32\DRIVERS\Smb_driver_Intel.sys [33960 2015-05-29] (Synaptics Incorporated)
R3 TXEIx64; C:\Windows\System32\DRIVERS\TXEIx64.sys [88592 2014-01-16] (Intel Corporation)
S3 VGPU; System32\drivers\rdvgkmd.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-12-29 10:27 - 2015-12-29 10:30 - 00015133 _____ C:\Users\user\Downloads\FRST.txt
2015-12-29 10:27 - 2015-12-29 10:27 - 00000000 ____D C:\Users\user\Desktop\New folder
2015-12-29 10:26 - 2015-12-29 10:27 - 00000000 ____D C:\FRST
2015-12-29 10:25 - 2015-12-29 10:26 - 02370560 _____ (Farbar) C:\Users\user\Downloads\FRST64.exe
2015-12-28 19:09 - 2015-12-28 19:09 - 00509440 _____ (Tech Support Guy System) C:\Users\user\Downloads\SysInfo.exe
2015-12-28 18:39 - 2015-12-28 18:39 - 00003030 _____ C:\Windows\System32\Tasks\SafeZone scheduled Autoupdate 1451313571
2015-12-28 18:39 - 2015-12-28 18:39 - 00001037 _____ C:\Users\Public\Desktop\Avast SafeZone Browser.lnk
2015-12-28 18:39 - 2015-12-28 18:39 - 00001037 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast SafeZone Browser.lnk
2015-12-28 18:38 - 2015-12-28 18:37 - 00028144 _____ (AVAST Software) C:\Windows\system32\Drivers\aswKbd.sys
2015-12-28 18:38 - 2015-12-28 18:30 - 00451040 _____ (AVAST Software) C:\Windows\system32\Drivers\asw6544.tmp
2015-12-28 18:38 - 2015-12-28 18:30 - 00097648 _____ (AVAST Software) C:\Windows\system32\Drivers\asw5D94.tmp
2015-12-28 18:38 - 2015-12-28 18:29 - 01055560 _____ (AVAST Software) C:\Windows\system32\Drivers\asw5103.tmp
2015-12-28 18:38 - 2015-12-28 18:29 - 00386096 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2015-12-28 18:38 - 2015-12-28 18:29 - 00273784 _____ (AVAST Software) C:\Windows\system32\Drivers\asw6870.tmp
2015-12-28 18:38 - 2015-12-28 18:29 - 00155304 _____ (AVAST Software) C:\Windows\system32\Drivers\asw6B1F.tmp
2015-12-28 18:38 - 2015-12-28 18:29 - 00093528 _____ (AVAST Software) C:\Windows\system32\Drivers\asw56ED.tmp
2015-12-28 18:38 - 2015-12-28 18:29 - 00065224 _____ (AVAST Software) C:\Windows\system32\Drivers\asw6294.tmp
2015-12-28 18:38 - 2015-12-28 18:29 - 00028656 _____ (AVAST Software) C:\Windows\system32\Drivers\asw5A77.tmp
2015-12-28 18:33 - 2015-12-28 18:33 - 00000000 ____D C:\Users\user\AppData\Roaming\AVAST Software
2015-12-28 18:32 - 2015-12-28 18:32 - 00001922 _____ C:\Users\Public\Desktop\Avast Internet Security.lnk
2015-12-28 18:32 - 2015-12-28 18:32 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVAST Software
2015-12-28 18:30 - 2015-12-28 18:38 - 00003924 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2015-12-28 18:30 - 2015-12-28 18:30 - 00000000 ____D C:\Windows\System32\Tasks\AVAST Software
2015-12-28 18:30 - 2015-12-28 18:30 - 00000000 ____D C:\Program Files\Common Files\AV
2015-12-28 18:29 - 2015-12-28 18:30 - 00451040 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2015-12-28 18:29 - 2015-12-28 18:30 - 00097648 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2015-12-28 18:29 - 2015-12-28 18:29 - 01055560 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2015-12-28 18:29 - 2015-12-28 18:29 - 00466400 _____ (AVAST Software) C:\Windows\system32\Drivers\aswNdisFlt.sys
2015-12-28 18:29 - 2015-12-28 18:29 - 00450504 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys.1451313043229
2015-12-28 18:29 - 2015-12-28 18:29 - 00273784 _____ (AVAST Software) C:\Windows\system32\Drivers\aswVmm.sys
2015-12-28 18:29 - 2015-12-28 18:29 - 00155304 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys
2015-12-28 18:29 - 2015-12-28 18:29 - 00097648 _____ (AVAST Software) C:\Windows\system32\Drivers\aswmonflt.sys.1451313043229
2015-12-28 18:29 - 2015-12-28 18:29 - 00093528 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2015-12-28 18:29 - 2015-12-28 18:29 - 00065224 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRvrt.sys
2015-12-28 18:29 - 2015-12-28 18:29 - 00043112 _____ (AVAST Software) C:\Windows\avastSS.scr
2015-12-28 18:29 - 2015-12-28 18:29 - 00028656 _____ (AVAST Software) C:\Windows\system32\Drivers\aswHwid.sys
2015-12-28 18:26 - 2015-12-28 18:37 - 00000000 ____D C:\Program Files\AVAST Software
2015-12-28 18:24 - 2015-12-28 18:38 - 00000000 ____D C:\ProgramData\AVAST Software
2015-12-28 18:24 - 2015-12-28 18:24 - 05037264 _____ (AVAST Software) C:\Users\user\Downloads\avast_internet_security_setup_online.exe
2015-12-28 17:50 - 2015-12-29 00:57 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-12-28 17:49 - 2015-12-28 17:49 - 00001102 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2015-12-28 17:49 - 2015-12-28 17:49 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-12-28 17:49 - 2015-12-28 17:49 - 00000000 ____D C:\ProgramData\Malwarebytes
2015-12-28 17:49 - 2015-12-28 17:49 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2015-12-28 17:49 - 2015-10-05 09:50 - 00109272 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-12-28 17:49 - 2015-10-05 09:50 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-12-28 17:49 - 2015-10-05 09:50 - 00025816 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys
2015-12-28 17:44 - 2015-12-28 17:45 - 22908888 _____ (Malwarebytes ) C:\Users\user\Downloads\mbam-setup-2.2.0.1024.exe
2015-12-28 15:25 - 2015-12-28 18:15 - 00000258 __RSH C:\ProgramData\ntuser.pol
2015-12-28 10:03 - 2015-12-28 10:03 - 00000000 ____D C:\Users\user\Documents\FlashIntegro
2015-12-28 10:03 - 2015-12-28 10:03 - 00000000 ____D C:\Users\user\AppData\Roaming\VideoEditor
2015-12-28 10:03 - 2015-12-28 10:03 - 00000000 ____D C:\Users\user\AppData\Roaming\FlashIntegro
2015-12-28 10:02 - 2015-12-09 15:13 - 00081792 _____ (Flash-Integro LLC) C:\Windows\SysWOW64\mslvddsfilter2.ax
2015-12-28 10:02 - 2011-12-07 18:32 - 00216064 _____ ( ) C:\Windows\SysWOW64\Lagarith.dll
2015-12-28 10:02 - 2005-08-01 18:43 - 00245760 _____ () C:\Windows\SysWOW64\lame.ax
2015-12-28 10:02 - 2004-09-06 15:06 - 00053248 _____ C:\Windows\SysWOW64\xvid.ax
2015-12-28 10:02 - 2004-07-03 20:08 - 00139264 _____ C:\Windows\SysWOW64\xvidvfw.dll
2015-12-28 10:02 - 2004-07-03 19:59 - 00524288 _____ C:\Windows\SysWOW64\xvidcore.dll
2015-12-28 10:02 - 2004-02-04 20:11 - 00081920 _____ (fccHandler) C:\Windows\SysWOW64\AC3ACM.acm
2015-12-28 10:02 - 2003-05-22 11:26 - 00638976 _____ (DivXNetworks, Inc.) C:\Windows\SysWOW64\divx.dll
2015-12-28 10:02 - 2003-05-22 11:26 - 00221215 _____ (DivXNetworks, Inc.) C:\Windows\SysWOW64\divxdec.ax
2015-12-28 10:02 - 2003-05-21 22:50 - 01700352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\GdiPlus.dll
2015-12-28 10:02 - 2003-05-21 22:50 - 00261632 _____ (MainConcept) C:\Windows\SysWOW64\mcdvd_32.dll
2015-12-28 10:02 - 2003-05-21 22:50 - 00156910 _____ C:\Windows\WMSysPr8.prx
2015-12-28 10:02 - 2003-05-21 22:50 - 00082944 _____ (Voxware, Inc.) C:\Windows\SysWOW64\vct3216.acm
2015-12-28 10:02 - 2003-05-21 22:50 - 00038912 _____ (NCT Company) C:\Windows\SysWOW64\alf2cd.acm
2015-12-28 10:02 - 2003-05-21 22:50 - 00024576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3a.dll
2015-12-28 10:02 - 2003-03-25 04:49 - 00098304 _____ (Fraunhofer Institut Integrierte Schaltungen IIS) C:\Windows\SysWOW64\L3CODECX.AX
2015-12-28 10:02 - 2003-03-18 22:14 - 00499712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcp71.dll
2015-12-28 10:02 - 2003-02-21 02:42 - 00348160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcr71.dll
2015-12-28 10:02 - 2002-08-19 23:41 - 00413760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mpg4c32.dll
2015-12-28 10:02 - 2000-03-14 19:55 - 00013239 _____ (SHARP Corporation) C:\Windows\SysWOW64\Scg726.acm
2015-12-27 20:29 - 2015-12-27 20:39 - 07188704 _____ C:\Users\user\Downloads\Family Home Movies 70's.avi
2015-12-27 20:26 - 2015-12-27 20:56 - 21940505 _____ C:\Users\user\Downloads\Rex & Doris Candland - Home video footage - circa 1940.avi
2015-12-27 20:21 - 2015-12-27 20:33 - 31146592 _____ (Flash-Integro LLC ) C:\Users\user\Downloads\video_editor_download.exe
2015-12-26 15:29 - 2015-12-28 19:29 - 00000000 ____D C:\Users\user\Desktop\Support
2015-12-24 15:58 - 2015-12-24 15:58 - 00000000 ____D C:\ProgramData\EA Core
2015-12-24 15:53 - 2015-12-24 15:53 - 01627468 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2015-12-22 17:11 - 2015-12-26 17:20 - 00000000 ____D C:\Users\user\Downloads\GameData
2015-12-21 19:48 - 2015-12-21 19:55 - 00007721 _____ C:\Users\user\Desktop\Untitled.vpj
2015-12-21 19:48 - 2015-12-21 19:48 - 00000000 ____D C:\Users\user\Documents\VideoPad Projects
2015-12-18 22:05 - 2015-12-18 22:05 - 00000000 ____D C:\Users\user\Downloads\New folder
2015-12-15 15:18 - 2015-12-21 18:04 - 00000000 ____D C:\Windows\System32\Tasks\NCH Software
2015-12-15 15:18 - 2015-12-15 15:19 - 00000000 ____D C:\Users\user\AppData\Roaming\NCH Software
2015-12-15 15:18 - 2015-12-15 15:18 - 00001286 _____ C:\Users\Public\Desktop\NCH Suite.lnk
2015-12-15 15:18 - 2015-12-15 15:18 - 00001146 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoPad Video Editor.lnk
2015-12-15 15:18 - 2015-12-15 15:18 - 00001134 _____ C:\Users\Public\Desktop\VideoPad Video Editor.lnk
2015-12-15 15:18 - 2015-12-15 15:18 - 00000000 ____D C:\ProgramData\NCH Software
2015-12-15 15:18 - 2015-12-15 15:18 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Video Related Programs
2015-12-15 15:18 - 2015-12-15 15:18 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite
2015-12-15 15:18 - 2015-12-15 15:18 - 00000000 ____D C:\Program Files (x86)\NCH Software
2015-12-15 15:06 - 2008-06-27 10:49 - 00518064 _____ (Codejock Software) C:\Windows\SysWOW64\framework.ocx
2015-12-14 17:00 - 2015-12-14 18:46 - 00000000 ____D C:\Users\user\AppData\Local\WMTools Downloaded Files
2015-12-14 16:48 - 2015-12-15 15:13 - 00009216 _____ C:\Users\user\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2015-12-14 16:46 - 2015-12-14 19:05 - 00000000 ____D C:\Users\user\Desktop\youth
2015-12-10 16:24 - 2015-12-10 16:24 - 00002156 _____ C:\Users\Public\Desktop\The Sims™ 3 Pets.lnk
2015-12-05 11:58 - 2015-12-05 11:58 - 00002202 _____ C:\Users\Public\Desktop\The Sims™ 3 Ambitions.lnk
2015-12-05 00:43 - 2015-12-05 00:43 - 00001394 _____ C:\Users\Public\Desktop\The Sims 3.lnk
2015-12-05 00:43 - 2015-12-05 00:43 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\The Sims 3
2015-12-02 09:29 - 2015-12-02 09:30 - 00000000 ____D C:\Program Files (x86)\Origin Games
2015-12-02 09:24 - 2015-12-02 09:25 - 202839602 _____ C:\Users\user\Desktop\potato.reg
2015-11-29 21:51 - 2015-11-29 21:51 - 00000000 ____D C:\Users\user\AppData\Roaming\WinRAR
2015-11-29 21:12 - 2015-11-29 21:12 - 00000000 ____D C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2015-11-29 21:12 - 2015-11-29 21:12 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
2015-11-29 21:12 - 2015-11-29 21:12 - 00000000 ____D C:\Program Files\WinRAR
2015-11-29 20:34 - 2015-11-29 20:34 - 00002256 _____ C:\Users\Public\Desktop\The Sims™ 3 Island Paradise.lnk
2015-11-29 20:24 - 2015-11-29 20:24 - 00002184 _____ C:\Users\Public\Desktop\The Sims™ 3 Seasons.lnk
2015-11-29 20:19 - 2015-11-29 20:19 - 00002256 _____ C:\Users\Public\Desktop\The Sims™ 3 University Life.lnk
2015-11-29 20:13 - 2015-12-26 15:34 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2015-11-29 20:13 - 2015-12-26 15:34 - 00000000 ____D C:\Program Files (x86)\Electronic Arts
2015-11-29 20:10 - 2015-12-24 15:58 - 00000000 ____D C:\Users\user\Documents\Electronic Arts
2015-11-29 19:55 - 2004-12-10 09:03 - 00438272 _____ (On2.com) C:\Windows\SysWOW64\vp6vfw.dll
2015-11-29 19:54 - 2006-09-28 16:05 - 03977496 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_31.dll
2015-11-29 19:54 - 2006-09-28 16:05 - 02414360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_31.dll
2015-11-29 15:27 - 2015-12-26 15:43 - 00000000 ____D C:\Users\user\Documents\vikuk

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-12-29 10:30 - 2015-11-22 17:38 - 00000000 ____D C:\Users\user\AppData\Roaming\BitTorrent
2015-12-29 10:27 - 2009-07-14 07:20 - 00000000 ____D C:\Windows
2015-12-29 10:21 - 2015-11-22 16:22 - 00000898 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-12-29 10:20 - 2015-11-22 16:22 - 00000894 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-12-29 10:19 - 2009-07-14 08:45 - 00025936 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-12-29 10:19 - 2009-07-14 08:45 - 00025936 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-12-28 19:30 - 2015-11-26 17:40 - 00000000 ____D C:\ProgramData\Origin
2015-12-28 18:32 - 2009-07-14 07:20 - 00000000 ____D C:\Windows\inf
2015-12-28 18:18 - 2011-01-21 21:27 - 00721994 _____ C:\Windows\system32\perfh019.dat
2015-12-28 18:18 - 2011-01-21 21:27 - 00149000 _____ C:\Windows\system32\perfc019.dat
2015-12-28 18:18 - 2009-07-14 09:13 - 01640642 _____ C:\Windows\system32\PerfStringBackup.INI
2015-12-28 18:16 - 2015-11-22 17:42 - 00000000 ____D C:\Users\user\AppData\LocalLow\BitTorrent
2015-12-28 18:16 - 2015-11-22 16:44 - 00000000 ____D C:\Users\user\AppData\Roaming\Skype
2015-12-28 18:15 - 2015-10-21 17:39 - 00000000 __SHD C:\Users\user\IntelGraphicsProfiles
2015-12-28 18:14 - 2015-11-23 22:10 - 00003112 _____ C:\Windows\System32\Tasks\RDReminder
2015-12-28 18:13 - 2009-07-14 09:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-12-28 18:12 - 2009-07-14 07:20 - 00000000 ____D C:\Windows\security
2015-12-28 10:04 - 2009-07-14 07:20 - 00000000 ____D C:\Windows\system32\GroupPolicy
2015-12-27 10:01 - 2015-11-24 17:54 - 00000892 _____ C:\Windows\Tasks\Adobe Flash Player PPAPI Notifier.job
2015-12-26 20:39 - 2015-11-23 22:10 - 00000290 _____ C:\Windows\Tasks\DLL-Files.Com Fixer_Updates.job
2015-12-26 15:36 - 2009-07-14 09:32 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2015-12-24 16:11 - 2015-11-24 17:53 - 00000000 ____D C:\Users\user\AppData\Local\Adobe
2015-12-23 20:40 - 2015-11-23 22:10 - 00000274 _____ C:\Windows\Tasks\DLL-Files.Com Fixer_MONTHLY.job
2015-12-17 17:32 - 2015-11-22 16:24 - 00002183 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2015-12-10 16:14 - 2015-10-22 15:13 - 00003844 _____ C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1445512388
2015-12-10 16:14 - 2015-10-22 15:11 - 00000000 ____D C:\Program Files (x86)\Opera
2015-12-08 16:38 - 2015-11-22 16:22 - 00000000 ____D C:\Users\user\AppData\Local\Google
2015-12-05 11:59 - 2015-11-26 17:40 - 00000000 ____D C:\ProgramData\Electronic Arts
2015-12-05 05:28 - 2015-11-22 16:22 - 00003894 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-12-05 05:28 - 2015-11-22 16:22 - 00003642 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore

==================== Files in the root of some directories =======

2015-12-14 16:48 - 2015-12-15 15:13 - 0009216 _____ () C:\Users\user\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2015-10-21 16:56 - 2015-10-21 16:56 - 0000017 _____ () C:\Users\user\AppData\Local\resmon.resmoncfg
2015-10-21 17:27 - 2015-10-21 17:27 - 0000000 ____H () C:\ProgramData\DP45977C.lfl

==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-12-22 19:43

==================== End of FRST.txt ============================
 

kevinf80

Kevin
Malware Specialist
Joined
Mar 21, 2006
Messages
11,390
Thanks for those logs, continue please:

Download attached fixlist.txt file (end of reply) and save it to the Desktop, or the folder you saved FRST into.
NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work.

Run FRST and press the Fix button just once and wait.
The tool will make a log on the Desktop (Fixlog.txt) or the folder it was ran from. Please post it to your reply.

Next,

Please open Malwarebytes Anti-Malware.

  • On the Settings tab > Detection and Protection sub tab, Detection Options, tick the box "Scan for rootkits".
  • Under Non-Malware Protection sub tab Change PUP and PUM entries to Treat detections as Malware
  • Click on the Scan tab, then click on Scan Now >> . If an update is available, click the Update Now button.
  • A Threat Scan will begin.
  • When the scan is complete, click Apply Actions.
  • Wait for the prompt to restart the computer to appear (if applicable), then click on Yes.
  • After the restart once you are back at your desktop, open MBAM once more.

To get the log from Malwarebytes do the following:

  • Click on the History tab > Application Logs.
  • Double click on the scan log which shows the Date and time of the scan just performed.
  • Click Export > From export you have three options:

    Copy to Clipboard - if seleted right click to your reply and select "Paste" log will be pasted to your reply
    Text file (*.txt) - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply
    XML file (*.xml) - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply
  • Please use "Copy to Clipboard, then Right click to your reply > select "Paste" that will copy the log to your reply…

Next,

Download AdwCleaner by Xplode onto your Desktop.

  • Double click on Adwcleaner.exe to run the tool.
  • Click on the Scan in the Actions box
  • Please wait fot the scan to finish..
  • When "Waiting for action.Please uncheck elements you want to keep" shows in top line..
  • Click on the Cleaning box.
  • Next click OK on the "Closing Programs" pop up box.
  • Click OK on the Information box & again OK to allow the necessary reboot
  • After restart the AdwCleaner(C*)-Notepad log will appear, please copy/paste it in your next reply. Where * is the number relative to list of scans completed...

Next,

Download Microsoft's " Malicious Software Removal Tool" and save direct to the desktop

Ensure to get the correct version for your system....

32 Bit version:
https://www.microsoft.com/downloads...E0-E72D-4F54-9AB3-75B8EB148356&displaylang=en

64 Bit version:
https://www.microsoft.com/downloads...DE-367F-495E-94E7-6349F4EFFC74&displaylang=en

Right click on the Tool, select “Run as Administrator” the tool will expand to the options Window
In the "Scan Type" window, select Quick Scan
Perform a scan and Click Finish when the scan is done.

Retrieve the MSRT log as follows, and post it in your next reply:

1) Select the Windows key and R key together to open the "Run" function
2) Type or Copy/Paste the following command to the "Run Line" and Press Enter:

notepad c:\windows\debug\mrt.log

Post those logs, also let me know if any remaining issues or concerns.....

Thnk you,

Kevin....
 

Attachments

xions

Thread Starter
Joined
Dec 28, 2015
Messages
7
This is the Fixlog:

Fix result of Farbar Recovery Scan Tool (x64) Version:28-12-2015
Ran by user (2016-01-02 15:07:35) Run:1
Running from C:\Users\user\Downloads
Loaded Profiles: user (Available Profiles: user)
Boot Mode: Normal
==============================================

fixlist content:
*****************
Start
CoseProcesses:
CreateRestorePoint:
HKU\S-1-5-21-648563939-3901689258-777139593-1000\...\MountPoints2: {acf04bb8-7853-11e5-bd3b-806e6f6e6963} - E:\Autorun.exe
HKU\S-1-5-21-648563939-3901689258-777139593-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {acf04bb8-7853-11e5-bd3b-806e6f6e6963} - E:\Autorun.exe
Startup: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\KDWin Keyboard Driver.lnk [2015-10-21]
ShortcutTarget: KDWin Keyboard Driver.lnk -> C:\KDWin\KDWIN.EXE ()
C:\KDWin\KDWIN.EXE
C:\KDWin
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
Task: {419974CC-CC69-4C70-B366-B26BBF17FA2A} - System32\Tasks\DLL-Files.Com Fixer_Updates => C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe [2015-10-30] (Dll-FIles.Com)
Task: {427CED9C-271F-49AE-AB8E-17A8D31F4F15} - System32\Tasks\DLL-Files.Com Fixer_MONTHLY => C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe [2015-10-30] (Dll-FIles.Com)
Task: {70512FFE-F47D-428C-BDD7-5E5A51DE8E94} - System32\Tasks\RDReminder => C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe [2015-10-30] (Dll-FIles.Com)
Task: C:\Windows\Tasks\DLL-Files.Com Fixer_MONTHLY.job => C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe
Task: C:\Windows\Tasks\DLL-Files.Com Fixer_Updates.job => C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe
FirewallRules: [{5E43AFC7-6099-48E0-A34F-D3F303F98C1E}] => (Allow) C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe
FirewallRules: [{50AFB2CC-DDD8-4AC0-88EE-5ABFF6286545}] => (Allow) C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe
FirewallRules: [{B6590EA6-5374-4D32-9E9E-C90F3611CC49}] => (Allow) C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe
FirewallRules: [{B787A3BA-22D5-4D3E-9BA4-99DFDF015C65}] => (Allow) C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe
FirewallRules: [{05C5603A-892B-4E98-80E3-E442DEF99137}] => (Allow) C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe
FirewallRules: [{0BC06465-D609-4EF0-A6FD-3DE958BB3725}] => (Allow) C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe
FirewallRules: [{5025AEA9-DCBD-46C2-929D-ED28FE4FA863}] => (Allow) C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe
FirewallRules: [{8181ACF5-2E79-4C40-85C7-423AD571A643}] => (Allow) C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe
FirewallRules: [{7FB74ABB-23A4-49F9-BB0B-74FC36DEA0F1}] => (Allow) C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe
FirewallRules: [{69B4C01F-3F22-4B91-9D4B-123DED4D99C1}] => (Allow) C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe
FirewallRules: [{3E4FF3AA-3735-4D0D-91A6-E8C9CB55624B}] => (Allow) C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe
FirewallRules: [{956035AE-1C1D-44C3-B444-07DC4BF3C534}] => (Allow) C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe
FirewallRules: [{83D0A8B5-D092-4CF5-B697-84EE6D6198B1}] => (Allow) C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe
EmptyTemp:
end
*****************

CoseProcesses: => Error: No automatic fix found for this entry.
Restore point was successfully created.
"HKU\S-1-5-21-648563939-3901689258-777139593-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{acf04bb8-7853-11e5-bd3b-806e6f6e6963}" => key removed successfully
HKCR\CLSID\{acf04bb8-7853-11e5-bd3b-806e6f6e6963} => key not found.
HKU\S-1-5-21-648563939-3901689258-777139593-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4} => key not found.
HKCR\CLSID\{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4} => key not found.
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\KDWin Keyboard Driver.lnk => moved successfully
C:\KDWin\KDWIN.EXE => moved successfully
"C:\KDWin\KDWIN.EXE" => not found.

"C:\KDWin" folder move:

Could not move "C:\KDWin" => Scheduled to move on reboot.

VGPU => service removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{419974CC-CC69-4C70-B366-B26BBF17FA2A}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{419974CC-CC69-4C70-B366-B26BBF17FA2A}" => key removed successfully
C:\Windows\System32\Tasks\DLL-Files.Com Fixer_Updates => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\DLL-Files.Com Fixer_Updates" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{427CED9C-271F-49AE-AB8E-17A8D31F4F15}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{427CED9C-271F-49AE-AB8E-17A8D31F4F15}" => key removed successfully
C:\Windows\System32\Tasks\DLL-Files.Com Fixer_MONTHLY => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\DLL-Files.Com Fixer_MONTHLY" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{70512FFE-F47D-428C-BDD7-5E5A51DE8E94}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{70512FFE-F47D-428C-BDD7-5E5A51DE8E94}" => key removed successfully
C:\Windows\System32\Tasks\RDReminder => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\RDReminder" => key removed successfully
C:\Windows\Tasks\DLL-Files.Com Fixer_MONTHLY.job => moved successfully
C:\Windows\Tasks\DLL-Files.Com Fixer_Updates.job => moved successfully
HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{5E43AFC7-6099-48E0-A34F-D3F303F98C1E} => value removed successfully
HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{50AFB2CC-DDD8-4AC0-88EE-5ABFF6286545} => value removed successfully
HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{B6590EA6-5374-4D32-9E9E-C90F3611CC49} => value removed successfully
HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{B787A3BA-22D5-4D3E-9BA4-99DFDF015C65} => value removed successfully
HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{05C5603A-892B-4E98-80E3-E442DEF99137} => value removed successfully
HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{0BC06465-D609-4EF0-A6FD-3DE958BB3725} => value removed successfully
HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{5025AEA9-DCBD-46C2-929D-ED28FE4FA863} => value removed successfully
HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{8181ACF5-2E79-4C40-85C7-423AD571A643} => value removed successfully
HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{7FB74ABB-23A4-49F9-BB0B-74FC36DEA0F1} => value removed successfully
HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{69B4C01F-3F22-4B91-9D4B-123DED4D99C1} => value removed successfully
HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{3E4FF3AA-3735-4D0D-91A6-E8C9CB55624B} => value removed successfully
HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{956035AE-1C1D-44C3-B444-07DC4BF3C534} => value removed successfully
HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{83D0A8B5-D092-4CF5-B697-84EE6D6198B1} => value removed successfully
EmptyTemp: => 2.1 GB temporary data Removed.

Result of scheduled files to move (Boot Mode: Normal) (Date&Time: 2016-01-02 15:41:11)

C:\KDWin => moved successfully

==== End of Fixlog 15:41:11 ====

Malwarebytes:

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 02.01.2016
Scan Time: 16:01
Logfile: luke i am malware.txt
Administrator: Yes

Version: 2.2.0.1024
Malware Database: v2016.01.02.04
Rootkit Database: v2015.12.26.01
License: Trial
Malware Protection: Enabled
Malicious Website Protection: Enabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: user

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 319460
Time Elapsed: 20 min, 27 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 4
PUP.Optional.Yontoo, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_constantfun-a.akamaihd.net_0.localstorage, Delete-on-Reboot, [7d5fd65efd9cba7c37ea47d3bd47f010],
PUP.Optional.Yontoo, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_constantfun-a.akamaihd.net_0.localstorage-journal, Delete-on-Reboot, [5785b97ba3f64fe7ef32a179bd4727d9],
PUP.Optional.PriceMoon, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_pstatic.pricemoon.co_0.localstorage, Delete-on-Reboot, [865661d34554280e0e0396854cb813ed],
PUP.Optional.PriceMoon, C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_pstatic.pricemoon.co_0.localstorage-journal, Delete-on-Reboot, [f2eafa3a10891224e32e1b00cb39758b],

Physical Sectors: 0
(No malicious items detected)


(end)

Adwcleaner:

# AdwCleaner v5.027 - Logfile created 02/01/2016 at 16:40:21
# Updated 30/12/2015 by Xplode
# Database : 2015-12-30.1 [Server]
# Operating system : Windows 7 Ultimate Service Pack 1 (x64)
# Username : user - USER-PC
# Running from : C:\Users\user\Downloads\New folder\adwcleaner_5.027.exe
# Option : Cleaning
# Support : http://toolslib.net/forum

***** [ Services ] *****


***** [ Folders ] *****

[-] Folder Deleted : C:\Users\Public\Documents\iWin

***** [ Files ] *****


***** [ DLLs ] *****


***** [ Shortcuts ] *****


***** [ Scheduled tasks ] *****


***** [ Registry ] *****


***** [ Web browsers ] *****


*************************

:: "Tracing" keys removed
:: Winsock settings cleared

########## EOF - C:\AdwCleaner\AdwCleaner[C1].txt - [739 bytes] ##########

Last but not least Microsoft's Malicious software removal tool:


---------------------------------------------------------------------------------------
Microsoft Windows Malicious Software Removal Tool v5.31, December 2015 (build 5.31.12100.0)
Started On Sat Jan 02 16:48:06 2016

Engine: 1.1.12300.0
Signatures: 1.211.637.0

Results Summary:
----------------
No infection found.
Microsoft Windows Malicious Software Removal Tool Finished On Sat Jan 02 16:55:44 2016


Return code: 0 (0x0)



AH this is so frustrating, i feel like i'm a person with delusional parasitosis: clearly concerned about something that apparently isn't there.
Most of these cleanup tools just told me that i didn't have any kind of serious malware (besides some "PUP.Optional.Yontoo" thing, which malwarebytes asks me to delete everytime)
The ads are still there, Constant Fun is still here and the pop ups aren't going away either. Maybe i need to delete them from my registry? Who knows.

But thank you very much for your patience and help Kevin!!
 

kevinf80

Kevin
Malware Specialist
Joined
Mar 21, 2006
Messages
11,390
Thanks for the logs and the update, I see Chrome is listed as your default browser I assume that is where the ads happen? if so lets go for a clean install..

If your Chrome Bookmarks are important do this first:

Go to this link: http://www.wikihow.com/Export-Bookmarks-from-Chrome follow the instructions and Export your Bookmarks from Chrome, save to your Desktop or similar. Note the instructions can also be used to Import the bookmarks.....

Continue for a clean install:

Remove all synced data from Chrome go here: http://www.howtogeek.com/103655/how-to-delete-your-google-chrome-browser-sync-data/ follow those instructions...

Uninstall Chrome: https://support.google.com/chrome/answer/95319?hl=en-GB follow those instructions, ensure the option to "Also delete your browsing data" is selected. <<--- Very important!!

Navigate to C:\Users\Your user name\Appdata\Local from that folder delete the folder named Google (you will need to show hidden files/folders to see the folder Appdata)

How to show hidden files and folders for windows: http://www.howtogeek.com/howto/windows-vista/show-hidden-files-and-folders-in-windows-vista/

Install Google Chrome from here: https://www.google.com/intl/en_uk/chrome/browser/desktop/index.html

Install Adblock Plus to Chrome: https://chrome.google.com/webstore/detail/adblock-plus/cfhdojbkjhnklbpkdaibdccddilifddb

Next,

If Constant Fun is still causing problems run the following for information:

Please download SystemLook from the following link below and save it to your Desktop. Use the correct version 32bit or 64bit.

http://jpshortstuff.247fixes.com/SystemLook_x64.exe <<- 64 bit….

http://images.malwareremoval.com/jpshortstuff/SystemLook.exe <<- 32 bit

  • Double-click SystemLook.exe to run it.
  • Copy the content of the following codebox into the main textfield:

    Code:
    :filefind
    Constant Fun.*
    :folderfind
    Constant Fun
    :regfind
    *Constant Fun*
  • Click the Look button to start the scan.
  • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

Let me know if the clean install for Chrome is successful, also post the other two logs...

Thank you,

Kevin
 

xions

Thread Starter
Joined
Dec 28, 2015
Messages
7
Hey Kevin! I followed all your instructions and cleaned my sync data, uninstalled chrome and

finally! no more pesky ads, my browser is smooth again and no pop ups!

Thank you a lot Kevin, i will go ahead and mark this thread as solved! :)
 

kevinf80

Kevin
Malware Specialist
Joined
Mar 21, 2006
Messages
11,390
Ok if you are sure all is well we still need to clean up as follows:

Download "Delfix by Xplode" and save it to your desktop.

Or use the following if first link is down:

"Delfix link mirror"

If your security program alerts to Delfix either, accept the alert or turn your security off.

Double Click to start the program. If you are using Vista or higher, please right-click and choose run as administrator

Make Sure the following items are checked:


  • Remove disinfection tools
  • Purge System Restore <--- this will remove all previous and possibly exploited restore points, a new point relative to system status at present will be created.
  • Reset system settings

Now click on "Run" and wait patiently until the tool has completed.

The tool will create a log when it has completed. We don't need you to post this.

Any remnant files/logs from tools we have used can be deleted…

Next,

Read the following links to fully understand PC Security and Best Practices, you may find them useful....

Answers to Common Security Questions and best Practices

Do I need a Registry Cleaner?

Take care and surf safe

Kevin...
 
Status
This thread has been Locked and is not open to further replies. Please start a New Thread if you're having a similar issue. View our Welcome Guide to learn how to use this site.

Users Who Are Viewing This Thread (Users: 0, Guests: 1)

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 807,865 other people just like you!

Latest posts

Staff online

Top