Computer Shuts Down When Virus Scanner is Scanning

Status
This thread has been Locked and is not open to further replies. Please start a New Thread if you're having a similar issue. View our Welcome Guide to learn how to use this site.

laknz

Thread Starter
Joined
Jan 30, 2015
Messages
2
Hello!

My problem is, whenever I run Malwarebytes or diskcleaner my computer will shut itself down. It will turn off as if I have done a forced shutdown (holding down the power button).

A few months ago my mums computer suddenly decided to not start up again, she had possibly hundreds of viruses from downloading programs from bad sources. We did all we could to fix it, but decided there was no hope.
Recently, I went to try and start it up again, and it worked. I immediatly went into Avast and did a virus scan hoping I would get rid of all the viruses and it would work again. I deleted my mums user and uninstalled as many unused and un-needed programs as I could. It seemed to work. Everything was working fine for about a week. Then, the computer would randomly slow down so much that you couldn't press the start button, you would have to force shutdown. Sometimes it would completely freeze and you would have to do another force shutdown. Then, when I tried to start it up it would freeze as soon as the cursor appeared. Or when windows is starting up and the logo is about to appear, the lights which make up the windows logo would glitch and freeze.
I started it up in safe mode with networking. Everything is going fine in safe mode. I downloaded Malwarebytes - Anti Malware to try and clear up the remaining viruses including the one slowing and freezing the computer. Everytime I do a full scan or a quick scan the computer will shut its self down completely, preventing any virsuses from being cleared.

I have noticed a suspicous looking program called downloadkeeper, it had extra letters in the name, it looked like downnloaddkeepper I can't quite remember what it was. When I tried to delete it, it dissapeared from the list so I can no longer see its name.

I have previously scanned and deleted viruses with Avast, cleared away things I don't want and cleaned free space with CCleaner.

Here is the basic information about my computer. I got the infomation while my computer was in safemode (I can't run normally, the computer freezes)
Tech Support Guy System Info Utility version 1.0.0.2
OS Version: Microsoft Windows 7 Home Premium, Service Pack 1, 64 bit
Processor: AMD V120 Processor, AMD64 Family 16 Model 6 Stepping 3
Processor Count: 1
RAM: 1786 Mb
Graphics Card: AMD M880G with ATI Mobility Radeon HD 4250, 256 Mb
Hard Drives: C: Total - 224914 MB, Free - 161508 MB; D: Total - 13255 MB, Free - 1878 MB; E: Total - 99 MB, Free - 68 MB;
Motherboard: Hewlett-Packard, 1444
Antivirus: None

I hope you can help.
Thank you very much.
 

kevinf80

Kevin
Malware Specialist
Joined
Mar 21, 2006
Messages
11,470
Hello and welcome to TSG,

Use the instructions in the following link to show hidden files:

http://www.bleepingcomputer.com/tutorials/how-to-see-hidden-files-in-windows/

Next,

Run the following scans and post the produced logs:

Step 1

Download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system (32 bit or 64 bit). If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.
  • Double-click to run it. When the tool opens click Yes to disclaimer.
  • Press Scan button.
  • It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
  • The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

Step 2

Please download RogueKiller and save it to your desktop from the following link: http://www.bleepingcomputer.com/download/roguekiller/

  • Quit all running programs.
  • For Windows XP, double-click to start.
  • For Vista,Windows 7/8, Right-click on the program and select Run as Administrator to start and when prompted allow it to run.
  • Read and accept the EULA (End User Licene Agreement)
  • Click Scan to scan the system.
  • When the scan completes select "Report", log will open. Close the program > Don't Fix anything!
  • Post back the report which should also be located here:

C:\Programdata\RogueKiller\Logs <-------- W7/8
C:\Documents and Settings\All Users\Application Data\RogueKiller\Logs <------XP

Thank you,

Kevin...
 

laknz

Thread Starter
Joined
Jan 30, 2015
Messages
2
I ran all of the scans in safe mode. I'm not sure if this effects anything, but in case it does, I ran the scans in safemode with networking. I have attached addition.txt.

Fabar Recovery Scan Tool Log

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 28-01-2015
Ran by Lana (administrator) on SHARYN-PC on 31-01-2015 10:57:44
Running from C:\Users\Lana\Desktop
Loaded Profiles: Lana (Available profiles: Lana)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: English (United States)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Safe Mode (with Networking)
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Windows\HelpPane.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6160928 2010-02-06] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2046760 2010-02-06] (Synaptics Incorporated)
HKLM\...\Run: [HP Quick Launch] => C:\Program Files\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [451072 2010-01-13] (Hewlett-Packard Company)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-05] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [41056 2013-05-09] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-02-12] (Apple Inc.)
HKLM-x32\...\Run: [SSDMonitor] => C:\Program Files (x86)\Common Files\PC Tools\sMonitor\SSDMonitor.exe [105120 2012-08-21] (PC Tools)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\Alwil Software\Avast5\AvastUI.exe [5227112 2015-01-28] (AVAST Software)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-02-21] (Apple Inc.)
HKU\S-1-5-21-3709555391-908018771-1203518072-1253\...\Run: [HPAdvisorDock] => C:\Program Files (x86)\Hewlett-Packard\HP Advisor\DOCK\HPAdvisorDock.exe
HKU\S-1-5-21-3709555391-908018771-1203518072-1253\...\Run: [LightScribe Control Panel] => C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2363392 2010-02-23] (Hewlett-Packard Company)
HKU\S-1-5-21-3709555391-908018771-1203518072-1253\...\MountPoints2: {99b30087-7083-11df-8e61-806e6f6e6963} - F:\Autorun.exe
HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [301568 2013-05-21] (Microsoft Corporation)
AppInit_DLLs-x32: c:\progra~2\ss-hel~1\psupport.dll => "c:\progra~2\ss-hel~1\psupport.dll" File Not Found
AppInit_DLLs-x32: c:\progra~2\websea~1\sprote~1.dll => c:\Program Files (x86)\WebSearch\sprotector.dll [1044480 2013-01-24] ()
Startup: C:\Users\Lana\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Lana\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\Sharyn\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Lana\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\Sharyn\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk
ShortcutTarget: OpenOffice.org 3.2.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\Alwil Software\Avast5\ashShA64.dll (AVAST Software)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://websearch.wisesearch.info/?p...hid=14619573708274855592&lg=EN&cc=AU&unqvl=39
HKU\S-1-5-21-3709555391-908018771-1203518072-1253\Software\Microsoft\Internet Explorer\Main,Start Page = http://g.jp.msn.com/CQALL/13
HKU\S-1-5-21-3709555391-908018771-1203518072-1253\Software\Microsoft\Internet Explorer\Main,First Home Page = http://g.jp.msn.com/CQALL/13
HKU\S-1-5-21-3709555391-908018771-1203518072-1253\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.jp.msn.com/CQALL/13
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> DefaultScope {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} URL = http://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} URL = http://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01
SearchScopes: HKLM-x32 -> {BB74DE59-BC4C-4172-9AC4-73315F71CFFE} URL = http://websearch.wisesearch.info/?l=1&q={searchTerms}&pid=1675&r=2013/10/29&hid=14619573708274855592&lg=EN&cc=AU&unqvl=39
SearchScopes: HKLM-x32 -> {E7509A79-FEF2-4DCA-A255-ACF2EC6A0E29} URL = http://www.bing.com/search?q={searchTerms}&form=CPNTDF&pc=CPNTDF&src=IE-SearchBox
BHO: No Name -> {58185BEF-C198-29CA-298A-A3DE5863BC85} -> No File
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\Alwil Software\Avast5\aswWebRepIE64.dll (AVAST Software)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO: Skype add-on for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
BHO: No Name -> {C097DE93-4906-B2BA-0687-C2C6348E0534} -> No File
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre6\bin\jp2ssv.dll No File
BHO-x32: HP Print Enhancer -> {0347C33E-8762-4905-BF09-768834316C61} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: No Name -> {58185BEF-C198-29CA-298A-A3DE5863BC85} -> No File
BHO-x32: No Name -> {5C255C8A-E604-49b4-9D64-90988571CECB} -> No File
BHO-x32: Symantec NCO BHO -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton Internet Security\Engine\17.0.0.136\coIEPlg.dll (Symantec Corporation)
BHO-x32: Symantec Intrusion Prevention -> {6D53EC84-6AAE-4787-AEEE-F4628F01010C} -> C:\Program Files (x86)\Norton Internet Security\Engine\17.0.0.136\IPSBHO.DLL (Symantec Corporation)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll (AVAST Software)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Skype Browser Helper -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
BHO-x32: Google Toolbar Notifier BHO -> {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} -> C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.5.5126.1836\swg.dll (Google Inc.)
BHO-x32: No Name -> {C097DE93-4906-B2BA-0687-C2C6348E0534} -> No File
BHO-x32: Bing Bar Helper -> {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -> C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: HP Smart BHO Class -> {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File
Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - No File
Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\17.0.0.136\coIEPlg.dll (Symantec Corporation)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_296.dll ()
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_296.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1204144.dll (Adobe Systems, Inc.)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.21.2 -> C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin -> C:\Program Files (x86)\Java\jre7\bin\new_plugin\npjp2.dll No File
FF Plugin-x32: @java.com/JavaPlugin,version=10.21.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF HKLM-x32\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\IPSFFPlgn
FF HKLM-x32\...\Firefox\Extensions: [{4C0766D3-67A7-45a3-85A2-752F77312F32}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\coFFPlgn
FF HKLM-x32\...\Firefox\Extensions: [[email protected]] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010-10-09]
FF HKLM-x32\...\Firefox\Extensions: [[email protected]] - C:\Program Files\Alwil Software\Avast5\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\Alwil Software\Avast5\WebRep\FF [2011-06-20]

Chrome:
=======
CHR HomePage: Default -> hxxp://mystart.incredibar.com/?a=6Oz9pbSvHP&loc=skw
CHR StartupUrls: Default -> "hxxp://www.incredibar-search.com/?a=6Oz9pbSvHP&loc=skw&i=26&did=10963", "hxxp://www.google.com"
CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:inputType}{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}{google:searchVersion}{google:sessionToken}{google:prefetchQuery}sugkey={google:suggestAPIKeyParameter}
CHR Profile: C:\Users\Lana\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Slides) - C:\Users\Lana\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-01-21]
CHR Extension: (Google Docs) - C:\Users\Lana\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-01-21]
CHR Extension: (Google Drive) - C:\Users\Lana\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-01-21]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Lana\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2015-01-21]
CHR Extension: (YouTube) - C:\Users\Lana\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-01-21]
CHR Extension: (Google Search) - C:\Users\Lana\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-01-21]
CHR Extension: (Google Sheets) - C:\Users\Lana\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-01-21]
CHR Extension: (AdBlock) - C:\Users\Lana\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2015-01-21]
CHR Extension: (Avast Online Security) - C:\Users\Lana\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2015-01-21]
CHR Extension: (Page Refresh) - C:\Users\Lana\AppData\Local\Google\Chrome\User Data\Default\Extensions\hmooaemjmediafeacjplpbpenjnpcneg [2015-01-21]
CHR Extension: (Skype Click to Call) - C:\Users\Lana\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2015-01-21]
CHR Extension: (Cath Kidston) - C:\Users\Lana\AppData\Local\Google\Chrome\User Data\Default\Extensions\ndlpkmaeinmnbiadacenijnhlolneopm [2015-01-21]
CHR Extension: (Google Wallet) - C:\Users\Lana\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-01-21]
CHR Extension: (Gmail) - C:\Users\Lana\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-01-21]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\Alwil Software\Avast5\WebRep\Chrome\aswWebRepChrome.crx [2015-01-20]
CHR HKLM-x32\...\Chrome\Extension: [jfmjfhklogoienhpfnppmbcbjfjnkonk] - No Path
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2014-03-03]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S2 avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [50344 2015-01-20] (AVAST Software)
S2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1363584 2014-03-03] (Microsoft Corporation)
S2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1748608 2014-03-03] (Microsoft Corporation)
S2 HP Health Check Service; C:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exe [120832 2009-10-16] (Hewlett-Packard) [File not signed]
S2 HPWMISVC; C:\Program Files\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [19968 2010-01-13] () [File not signed]
S2 LightScribeService; C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe [73728 2010-02-23] (Hewlett-Packard Company) [File not signed]
S2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)
S2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2010-01-18] (Hewlett-Packard) [File not signed]
S2 NIS; C:\Program Files (x86)\Norton Internet Security\Engine\17.0.0.136\ccSvcHst.exe [126392 2009-08-25] (Symantec Corporation)
S2 PCToolsSSDMonitorSvc; C:\Program Files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe [794272 2012-08-21] (PC Tools)
S2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2010-01-18] (Hewlett-Packard) [File not signed]
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2015-01-20] ()
R0 aswKbd; C:\Windows\System32\Drivers\aswKbd.sys [22600 2013-05-09] (AVAST Software)
S2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [83280 2015-01-20] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2015-01-20] (AVAST Software)
S0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2015-01-20] ()
S1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1050432 2015-01-20] (AVAST Software)
S1 aswSP; C:\Windows\system32\drivers\aswSP.sys [436624 2015-01-20] (AVAST Software)
S2 aswStm; C:\Windows\system32\drivers\aswStm.sys [116728 2015-01-20] (AVAST Software)
S0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [267632 2015-01-20] ()
S3 FNETTHJM; C:\Windows\SysWOW64\drivers\fnetthjm.sys [24448 2013-12-03] (FNet Co., Ltd.) [File not signed]
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation)
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-01-30] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-11-21] (Malwarebytes Corporation)
S1 SRTSP; C:\Windows\system32\drivers\NISx64\1100000.088\SRTSP64.SYS [504880 2009-08-30] (Symantec Corporation)
S1 SRTSPX; C:\Windows\system32\drivers\NISx64\1100000.088\SRTSPX64.SYS [32304 2009-08-30] (Symantec Corporation)
S3 NAVENG; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\VirusDefs\20090829.019\ENG64.SYS [X]
S3 NAVEX15; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\VirusDefs\20090829.019\EX64.SYS [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-31 10:57 - 2015-01-31 10:58 - 00020578 _____ () C:\Users\Lana\Desktop\FRST.txt
2015-01-31 10:57 - 2015-01-31 10:57 - 00000000 ____D () C:\FRST
2015-01-31 10:57 - 2015-01-31 10:56 - 02130432 _____ (Farbar) C:\Users\Lana\Desktop\FRST64.exe
2015-01-31 10:56 - 2015-01-31 10:56 - 02130432 _____ (Farbar) C:\Users\Lana\Downloads\FRST64.exe
2015-01-30 20:40 - 2015-01-30 20:41 - 00509440 _____ (Tech Support Guy System) C:\Users\Lana\Downloads\SysInfo.exe
2015-01-30 19:13 - 2015-01-30 19:58 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-01-30 19:12 - 2015-01-30 19:12 - 00001102 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2015-01-30 19:12 - 2015-01-30 19:12 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-01-30 19:12 - 2015-01-30 19:12 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-01-30 19:12 - 2015-01-30 19:12 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2015-01-30 19:12 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-01-30 19:12 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-01-30 19:12 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-01-30 19:00 - 2015-01-30 19:10 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Lana\Downloads\mbam-setup-2.0.4.1028.exe
2015-01-29 19:00 - 2015-01-29 19:01 - 00721933 _____ () C:\Users\Lana\Downloads\Cozy Winter.Sims3Pack
2015-01-29 18:59 - 2015-01-29 18:59 - 00607356 _____ () C:\Users\Lana\Downloads\dress.Sims3Pack
2015-01-29 18:58 - 2015-01-29 18:59 - 00544912 _____ () C:\Users\Lana\Downloads\LHFC25 Fluttering off to Bed.Sims3Pack
2015-01-29 17:06 - 2015-01-29 17:07 - 00548754 _____ () C:\Users\Lana\Downloads\Pyjama pour bébé Winnie.Sims3Pack
2015-01-29 17:04 - 2015-01-29 17:04 - 00888215 _____ () C:\Users\Lana\Downloads\Toddler's Dot Nursery Cardigan with Pink Dress.Sims3Pack
2015-01-29 17:04 - 2015-01-29 17:04 - 00599098 _____ () C:\Users\Lana\Downloads\Sweet Baby.Sims3Pack
2015-01-29 16:46 - 2015-01-29 16:47 - 00494657 _____ () C:\Users\Lana\Downloads\Strapless Top No 25.Sims3Pack
2015-01-26 16:45 - 2015-01-26 16:45 - 00000000 ____D () C:\Users\Lana\AppData\Local\Apple
2015-01-24 21:22 - 2015-01-24 21:22 - 00000000 _____ () C:\Users\Lana\AppData\Local\{24F8E9EC-1C36-4E4D-8F37-C6B56FED7A37}
2015-01-23 19:29 - 2015-01-30 13:45 - 00000000 ___RD () C:\Users\Lana\Dropbox
2015-01-23 19:29 - 2015-01-23 19:29 - 00001123 _____ () C:\Users\Lana\Desktop\Dropbox.lnk
2015-01-23 19:29 - 2015-01-23 19:29 - 00000000 ____D () C:\Users\Lana\Dropbox (Old)
2015-01-23 19:22 - 2015-01-30 17:42 - 00000000 ____D () C:\Users\Lana\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-01-23 19:11 - 2015-01-30 13:45 - 00000000 ____D () C:\Users\Lana\AppData\Roaming\Dropbox
2015-01-23 19:10 - 2015-01-23 19:10 - 00324136 _____ (Dropbox, Inc.) C:\Users\Lana\Downloads\DropboxInstaller.exe
2015-01-21 14:22 - 2015-01-21 14:22 - 00000000 ____D () C:\Users\Lana\Documents\Electronic Arts
2015-01-21 14:20 - 2015-01-21 14:20 - 00000000 ____D () C:\Users\Lana\AppData\Roaming\hpqlog
2015-01-21 14:18 - 2015-01-21 14:18 - 00000000 ____D () C:\Users\Lana\AppData\Roaming\Hewlett-Packard
2015-01-21 14:13 - 2015-01-21 14:13 - 00000000 ____D () C:\Users\Lana\AppData\Local\Hewlett-Packard
2015-01-21 11:07 - 2015-01-21 13:06 - 00000000 ____D () C:\3590F75ABA9E485486C100C1A9D4FF06ZZZZZZ....Z....Z
2015-01-21 08:57 - 2015-01-21 08:57 - 00118520 _____ () C:\Users\Lana\AppData\Local\GDIPFONTCACHEV1.DAT
2015-01-21 08:46 - 2015-01-21 08:46 - 00000000 ____D () C:\Users\Lana\AppData\Roaming\AVAST Software
2015-01-21 08:46 - 2015-01-21 08:46 - 00000000 ____D () C:\Users\Lana\AppData\Roaming\Apple Computer
2015-01-21 08:45 - 2015-01-25 13:15 - 00000000 ____D () C:\Users\Lana\AppData\Local\Google
2015-01-21 08:45 - 2015-01-21 09:38 - 00002255 _____ () C:\Users\Lana\Desktop\Google Chrome.lnk
2015-01-21 08:45 - 2015-01-21 08:45 - 00001413 _____ () C:\Users\Lana\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-01-21 08:45 - 2015-01-21 08:45 - 00000000 ____D () C:\Users\Lana\AppData\Roaming\Adobe
2015-01-21 08:44 - 2015-01-21 08:44 - 00000000 ____D () C:\Users\Lana\AppData\Local\VirtualStore
2015-01-21 08:43 - 2015-01-30 17:42 - 00000000 ____D () C:\Users\Lana
2015-01-21 08:43 - 2015-01-21 08:43 - 00000020 ___SH () C:\Users\Lana\ntuser.ini
2015-01-21 08:43 - 2013-03-20 13:26 - 00000000 ____D () C:\Users\Lana\AppData\Roaming\Macromedia
2015-01-21 08:43 - 2010-06-15 21:26 - 00000000 ____D () C:\Users\Lana\AppData\Local\Microsoft Help
2015-01-21 08:43 - 2009-07-14 15:54 - 00000000 ___RD () C:\Users\Lana\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2015-01-21 08:43 - 2009-07-14 15:49 - 00000000 ___RD () C:\Users\Lana\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2015-01-21 08:30 - 2015-01-21 08:30 - 00000000 ____D () C:\Users\Public\Documents\My Deliveries
2015-01-21 08:25 - 2015-01-21 08:58 - 00002770 _____ () C:\Windows\System32\Tasks\CCleanerSkipUAC
2015-01-21 08:25 - 2015-01-21 08:26 - 00000000 ____D () C:\Program Files\CCleaner
2015-01-21 08:25 - 2015-01-21 08:25 - 00000822 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2015-01-21 08:25 - 2015-01-21 08:25 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2015-01-20 17:24 - 2015-01-20 17:23 - 00029208 _____ () C:\Windows\system32\Drivers\aswHwid.sys
2015-01-20 17:23 - 2015-01-20 17:23 - 00364512 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2015-01-20 17:23 - 2015-01-20 17:23 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2015-01-20 17:00 - 2015-01-20 17:00 - 00003344 _____ () C:\Windows\System32\Tasks\RealUpgradeScheduledTaskS-1-5-21-3709555391-908018771-1203518072-1000
2015-01-20 17:00 - 2015-01-20 17:00 - 00003212 _____ () C:\Windows\System32\Tasks\RealUpgradeLogonTaskS-1-5-21-3709555391-908018771-1203518072-1000

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-31 10:20 - 2013-11-30 11:53 - 00000000 ____D () C:\ProgramData\Recovery
2015-01-30 19:17 - 2010-07-19 09:47 - 00212872 _____ () C:\Windows\PFRO.log
2015-01-30 17:42 - 2010-06-05 16:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-01-30 17:42 - 2010-05-20 19:45 - 00000000 ____D () C:\ProgramData\Norton
2015-01-30 17:42 - 2009-07-14 14:20 - 00000000 ____D () C:\Windows\AppCompat
2015-01-30 17:39 - 2010-05-20 19:33 - 01707130 _____ () C:\Windows\WindowsUpdate.log
2015-01-30 16:55 - 2013-06-27 12:53 - 00028378 _____ () C:\Windows\setupact.log
2015-01-30 14:32 - 2010-06-05 15:55 - 00000898 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-01-30 14:06 - 2013-02-25 08:51 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-01-30 13:52 - 2009-07-14 15:45 - 00023248 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-01-30 13:52 - 2009-07-14 15:45 - 00023248 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-01-30 13:45 - 2012-07-09 10:28 - 00004184 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2015-01-30 13:44 - 2013-10-09 19:00 - 00000286 _____ () C:\Windows\Tasks\RMAutoUpdate.job
2015-01-30 13:44 - 2012-06-11 17:14 - 00000000 ____D () C:\Program Files (x86)\PC Tools Registry Mechanic
2015-01-30 13:43 - 2010-06-05 15:55 - 00000894 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-01-30 13:42 - 2009-07-14 16:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-01-29 19:27 - 2013-10-04 17:57 - 00000286 _____ () C:\Windows\Tasks\RMSchedule.job
2015-01-28 10:38 - 2010-04-01 12:12 - 00000000 ____D () C:\ProgramData\Temp
2015-01-27 15:25 - 2009-07-14 16:08 - 00032572 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-01-25 14:26 - 2013-02-25 08:51 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-01-25 14:26 - 2013-02-25 08:51 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-01-25 14:26 - 2013-02-25 08:51 - 00003768 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-01-21 10:28 - 2009-07-14 16:13 - 00788704 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-01-21 09:30 - 2010-04-01 12:55 - 00000000 ____D () C:\Program Files (x86)\CyberLink
2015-01-21 09:30 - 2010-04-01 10:54 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2015-01-21 09:22 - 2010-07-20 15:44 - 00000000 ____D () C:\ProgramData\Kontiki
2015-01-21 09:15 - 2010-06-05 13:25 - 00000000 ____D () C:\Users\Sharyn
2015-01-21 08:59 - 2012-08-21 16:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cakewalk
2015-01-21 08:59 - 2012-08-21 16:34 - 00000000 ____D () C:\Program Files (x86)\Cakewalk
2015-01-21 08:29 - 2010-06-06 11:16 - 00000000 ____D () C:\Writing
2015-01-21 08:19 - 2014-04-04 08:20 - 00000000 ___RD () C:\Users\Sharyn\Dropbox
2015-01-21 08:19 - 2014-04-04 08:14 - 00000000 ____D () C:\Users\Sharyn\AppData\Roaming\Dropbox
2015-01-20 20:29 - 2014-04-22 17:40 - 00000000 ____D () C:\Program Files\003
2015-01-20 20:29 - 2013-10-29 18:41 - 00000000 ____D () C:\ProgramData\SearchNewTab
2015-01-20 19:39 - 2013-10-29 18:36 - 00000000 ____D () C:\ProgramData\Dowwnlloaidd. keeperr
2015-01-20 19:35 - 2012-06-11 20:00 - 00000416 _____ () C:\Windows\SysWOW64\AppLog.log
2015-01-20 18:47 - 2012-10-01 16:03 - 00000000 ____D () C:\Users\Sharyn\AppData\Roaming\Real
2015-01-20 18:47 - 2012-10-01 16:03 - 00000000 ____D () C:\Program Files (x86)\Real
2015-01-20 18:46 - 2012-10-01 16:01 - 00000000 ____D () C:\ProgramData\Real
2015-01-20 18:45 - 2010-04-01 12:55 - 00000000 ____D () C:\ProgramData\CyberLink
2015-01-20 17:26 - 2010-06-05 15:55 - 00003894 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-01-20 17:26 - 2010-06-05 15:55 - 00003642 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-01-20 17:24 - 2011-06-20 10:40 - 01050432 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys
2015-01-20 17:23 - 2014-01-12 11:06 - 00116728 _____ (AVAST Software) C:\Windows\system32\Drivers\aswstm.sys
2015-01-20 17:23 - 2013-03-18 13:37 - 00267632 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2015-01-20 17:23 - 2013-03-18 13:37 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2015-01-20 17:23 - 2012-03-25 09:17 - 00093568 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2015-01-20 17:23 - 2010-06-05 15:55 - 00436624 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2015-01-20 17:23 - 2010-06-05 15:55 - 00083280 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2015-01-20 17:22 - 2014-04-04 08:17 - 00000000 ____D () C:\Users\Sharyn\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-01-20 17:20 - 2013-01-29 14:39 - 00000000 ____D () C:\Users\Sharyn\AppData\Roaming\.minecraft

==================== Files in the root of some directories =======

2015-01-24 21:22 - 2015-01-24 21:22 - 0000000 _____ () C:\Users\Lana\AppData\Local\{24F8E9EC-1C36-4E4D-8F37-C6B56FED7A37}
2010-08-06 15:29 - 2010-08-06 15:29 - 0000056 ____H () C:\ProgramData\ezsidmv.dat
2010-10-09 14:00 - 2010-10-09 14:10 - 0000782 _____ () C:\ProgramData\hpzinstall.log
2010-05-20 19:41 - 2010-05-20 19:41 - 0000032 _____ () C:\ProgramData\{051B9612-4D82-42AC-8C63-CD2DCEDC1CB3}.log
2010-04-01 13:03 - 2010-04-01 13:04 - 0000109 _____ () C:\ProgramData\{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}.log
2010-05-20 19:40 - 2010-05-20 19:40 - 0000032 _____ () C:\ProgramData\{23F3DA62-2D9E-4A69-B8D5-BE8E9E148092}.log
2010-04-01 12:56 - 2010-04-01 12:57 - 0000105 _____ () C:\ProgramData\{40BF1E83-20EB-11D8-97C5-0009C5020658}.log
2010-05-20 19:40 - 2010-05-20 19:40 - 0000032 _____ () C:\ProgramData\{4FC670EB-5F02-4B07-90DB-022B86BFEFD0}.log
2010-05-20 19:40 - 2010-05-20 19:40 - 0000032 _____ () C:\ProgramData\{9867824A-C86D-4A83-8F3C-E7A86BE0AFD3}.log
2010-04-01 12:56 - 2010-04-01 12:56 - 0000107 _____ () C:\ProgramData\{C59C179C-668D-49A9-B6EA-0121CCFC1243}.log
2010-04-01 12:58 - 2010-04-01 13:03 - 0000110 _____ () C:\ProgramData\{CB099890-1D5F-11D5-9EA9-0050BAE317E1}.log
2010-05-20 19:41 - 2010-05-20 19:41 - 0000105 _____ () C:\ProgramData\{d36dd326-7280-11d8-97c8-000129760cbe}.log

Some content of TEMP:
====================
C:\Users\Lana\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp98faep.dll
C:\Users\Sharyn\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmprw7ud5.dll
C:\Users\Sharyn\AppData\Local\Temp\SpotifyUninstall.exe
C:\Users\Sharyn\AppData\Local\Temp\sSetup-se.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-01-25 20:05

==================== End Of Log ============================

Here is the report from RougeKiller

RogueKiller V10.2.0.0 [Jan 19 2015] by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Website : http://www.adlice.com/softwares/roguekiller/
Blog : http://www.adlice.com

Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Safe mode with network support
User : Lana [Administrator]
Mode : Scan -- Date : 01/31/2015 11:17:41

¤¤¤ Processes : 0 ¤¤¤

¤¤¤ Registry : 8 ¤¤¤
[PUM.HomePage] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main | Start Page : http://websearch.wisesearch.info/?p...hid=14619573708274855592&lg=EN&cc=AU&unqvl=39 -> Found
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{11FD878F-AE45-44B9-A435-FFF3C9A621D5} | DhcpNameServer : 10.4.81.103 10.4.182.20 [(Private Address) (XX)][(Private Address) (XX)] -> Found
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{11FD878F-AE45-44B9-A435-FFF3C9A621D5} | DhcpNameServer : 10.4.81.103 10.4.182.20 [(Private Address) (XX)][(Private Address) (XX)] -> Found
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Tcpip\Parameters\Interfaces\{11FD878F-AE45-44B9-A435-FFF3C9A621D5} | DhcpNameServer : 10.4.81.103 10.4.182.20 [(Private Address) (XX)][(Private Address) (XX)] -> Found
[PUM.DesktopIcons] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> Found
[PUM.DesktopIcons] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1 -> Found
[PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> Found
[PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1 -> Found

¤¤¤ Tasks : 0 ¤¤¤

¤¤¤ Files : 0 ¤¤¤

¤¤¤ Hosts File : 0 ¤¤¤

¤¤¤ Antirootkit : 0 (Driver: Not loaded [0xc000035f]) ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ MBR Check : ¤¤¤
+++++ PhysicalDrive0: Hitachi HTS725025A9A364 SATA Disk Device +++++
--- User ---
[MBR] ef7df3c8396ce3eba596ff254c0cea0b
[BSP] b8f9af0bfc632918cff6943e8642fc8f : Unknown MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 199 MB [Unknown Bootstrap | Unknown Bootloader]
1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 409600 | Size: 224915 MB [Unknown Bootstrap | Unknown Bootloader]
2 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 461035520 | Size: 13256 MB [Unknown Bootstrap | Unknown Bootloader]
3 - [XXXXXX] FAT32-LBA (0xc) [VISIBLE] Offset (sectors): 488183808 | Size: 103 MB
User = LL1 ... OK
User = LL2 ... OK

I hope I have included all the information you need.
Thank you very much!
 

Attachments

kevinf80

Kevin
Malware Specialist
Joined
Mar 21, 2006
Messages
11,470
Download attached fixlist.txt file (end of reply) and save it to the Desktop, or the folder you saved FRST into.
NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work.

Run FRST and press the Fix button just once and wait.
The tool will make a log on the Desktop (Fixlog.txt) or the folder it was ran from. Please post it to your reply.

Boot back to normal mode.....

Next,

Open Malwarebytes Anti-Malware, from the Dashboard please Check for Updates by clicking the Update Now... link
When the update completes select > Settings > Detection and Protection > Enable Scan for rootkit and Under Non Malware Protection set both PUP and PUM to Treat detections as malware.


Click on the SCAN button and run a Threat Scan with Malwarebytes Anti-Malware by clicking the Scan Now>> button.

When the scan is complete, if there have been detections, click Apply Actions to allow MBAM to clean what was detected.

In most cases, a restart will be required.

Wait for the prompt to restart the computer to appear, then click on Yes.

When the scan is completed from the main GUI click on History > Application Logs. Find your scan log, the date when run will identify it. Checkmark "select" box > then hit the "view" button. The history log window will open. At the bottom of that window are two options, "Copy to clipboard" and "Export"
Select > "Copy to clipboard" that copies the full log to the windows clipboard, so at your reply you right click into the text field and select "Paste" the log is pasted (copied) to your reply.

Next,

Download AdwCleaner by Xplode onto your Desktop.
  • Double click on Adwcleaner.exe to run the tool.
  • Click on Scan
  • Once the scan is done, click on the Clean button.
  • You will get a prompt asking to close all programs. Click OK.
  • Click OK again to reboot your computer.
  • A text file will open after the restart. Please post the content of that logfile in your reply.
  • You can also find the logfile at C:\AdwCleaner[Sn].txt. Where n in the scan reference number

Next,

Please download Junkware Removal Tool to your desktop.
  • Shut down your protection software now to avoid potential conflicts. (re-enable when done)
  • Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
  • The tool will open and start scanning your system.
  • Please be patient as this can take a while to complete depending on your system's specifications.
  • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
  • Post the contents of JRT.txt into your next message.

Next,

Download Microsoft's " Malicious Software Removal Tool" and save direct to the desktop
Ensure to get the correct version for your system....
32 Bit version:
https://www.microsoft.com/downloads...E0-E72D-4F54-9AB3-75B8EB148356&displaylang=en
64 Bit version:
https://www.microsoft.com/downloads...DE-367F-495E-94E7-6349F4EFFC74&displaylang=en

Right click on the Tool, select “Run as Administrator” the tool will expand to the options Window
In the "Scan Type" window, select Quick Scan
Perform a scan and Click Finish when the scan is done.
Retrieve the MSRT log as follows, and post it in your next reply:

1) Select the Windows key and R key together to open the "Run" function
2) Type or Copy/Paste the following command to the "Run Line" and Press Enter:

notepad c:\windows\debug\mrt.log

Let me see those logs in your next reply, also give an update on any remaining issues or concerns...

Thank you,

Kevin...
 

Attachments

Status
This thread has been Locked and is not open to further replies. Please start a New Thread if you're having a similar issue. View our Welcome Guide to learn how to use this site.

Users Who Are Viewing This Thread (Users: 0, Guests: 1)

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 807,865 other people just like you!

Latest posts

Members online

Top