1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

Computer Shuts Down When Virus Scanner is Scanning

Discussion in 'Virus & Other Malware Removal' started by laknz, Jan 30, 2015.

Thread Status:
Not open for further replies.
Advertisement
  1. laknz

    laknz Thread Starter

    Joined:
    Jan 30, 2015
    Messages:
    2
    Hello!

    My problem is, whenever I run Malwarebytes or diskcleaner my computer will shut itself down. It will turn off as if I have done a forced shutdown (holding down the power button).

    A few months ago my mums computer suddenly decided to not start up again, she had possibly hundreds of viruses from downloading programs from bad sources. We did all we could to fix it, but decided there was no hope.
    Recently, I went to try and start it up again, and it worked. I immediatly went into Avast and did a virus scan hoping I would get rid of all the viruses and it would work again. I deleted my mums user and uninstalled as many unused and un-needed programs as I could. It seemed to work. Everything was working fine for about a week. Then, the computer would randomly slow down so much that you couldn't press the start button, you would have to force shutdown. Sometimes it would completely freeze and you would have to do another force shutdown. Then, when I tried to start it up it would freeze as soon as the cursor appeared. Or when windows is starting up and the logo is about to appear, the lights which make up the windows logo would glitch and freeze.
    I started it up in safe mode with networking. Everything is going fine in safe mode. I downloaded Malwarebytes - Anti Malware to try and clear up the remaining viruses including the one slowing and freezing the computer. Everytime I do a full scan or a quick scan the computer will shut its self down completely, preventing any virsuses from being cleared.

    I have noticed a suspicous looking program called downloadkeeper, it had extra letters in the name, it looked like downnloaddkeepper I can't quite remember what it was. When I tried to delete it, it dissapeared from the list so I can no longer see its name.

    I have previously scanned and deleted viruses with Avast, cleared away things I don't want and cleaned free space with CCleaner.

    Here is the basic information about my computer. I got the infomation while my computer was in safemode (I can't run normally, the computer freezes)
    Tech Support Guy System Info Utility version 1.0.0.2
    OS Version: Microsoft Windows 7 Home Premium, Service Pack 1, 64 bit
    Processor: AMD V120 Processor, AMD64 Family 16 Model 6 Stepping 3
    Processor Count: 1
    RAM: 1786 Mb
    Graphics Card: AMD M880G with ATI Mobility Radeon HD 4250, 256 Mb
    Hard Drives: C: Total - 224914 MB, Free - 161508 MB; D: Total - 13255 MB, Free - 1878 MB; E: Total - 99 MB, Free - 68 MB;
    Motherboard: Hewlett-Packard, 1444
    Antivirus: None

    I hope you can help.
    Thank you very much.
     
  2. kevinf80

    kevinf80 Malware Specialist

    Joined:
    Mar 21, 2006
    Messages:
    11,383
    First Name:
    Kevin
    Hello and welcome to TSG,

    Use the instructions in the following link to show hidden files:

    http://www.bleepingcomputer.com/tutorials/how-to-see-hidden-files-in-windows/

    Next,

    Run the following scans and post the produced logs:

    Step 1

    Download Farbar Recovery Scan Tool and save it to your desktop.

    Note: You need to run the version compatible with your system (32 bit or 64 bit). If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.
    • Double-click to run it. When the tool opens click Yes to disclaimer.
    • Press Scan button.
    • It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
    • The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

    Step 2

    Please download RogueKiller and save it to your desktop from the following link: http://www.bleepingcomputer.com/download/roguekiller/

    • Quit all running programs.
    • For Windows XP, double-click to start.
    • For Vista,Windows 7/8, Right-click on the program and select Run as Administrator to start and when prompted allow it to run.
    • Read and accept the EULA (End User Licene Agreement)
    • Click Scan to scan the system.
    • When the scan completes select "Report", log will open. Close the program > Don't Fix anything!
    • Post back the report which should also be located here:

    C:\Programdata\RogueKiller\Logs <-------- W7/8
    C:\Documents and Settings\All Users\Application Data\RogueKiller\Logs <------XP

    Thank you,

    Kevin...
     
  3. laknz

    laknz Thread Starter

    Joined:
    Jan 30, 2015
    Messages:
    2
    I ran all of the scans in safe mode. I'm not sure if this effects anything, but in case it does, I ran the scans in safemode with networking. I have attached addition.txt.

    Fabar Recovery Scan Tool Log

    Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 28-01-2015
    Ran by Lana (administrator) on SHARYN-PC on 31-01-2015 10:57:44
    Running from C:\Users\Lana\Desktop
    Loaded Profiles: Lana (Available profiles: Lana)
    Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: English (United States)
    Internet Explorer Version 11 (Default browser: Chrome)
    Boot Mode: Safe Mode (with Networking)
    Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

    ==================== Processes (Whitelisted) =================

    (If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

    (Microsoft Corporation) C:\Windows\HelpPane.exe
    (Microsoft Corporation) C:\Windows\System32\dllhost.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe


    ==================== Registry (Whitelisted) ==================

    (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

    HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6160928 2010-02-06] (Realtek Semiconductor)
    HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2046760 2010-02-06] (Synaptics Incorporated)
    HKLM\...\Run: [HP Quick Launch] => C:\Program Files\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [451072 2010-01-13] (Hewlett-Packard Company)
    HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-05] (Adobe Systems Incorporated)
    HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [41056 2013-05-09] (Adobe Systems Incorporated)
    HKLM-x32\...\Run: [] => [X]
    HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-02-12] (Apple Inc.)
    HKLM-x32\...\Run: [SSDMonitor] => C:\Program Files (x86)\Common Files\PC Tools\sMonitor\SSDMonitor.exe [105120 2012-08-21] (PC Tools)
    HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\Alwil Software\Avast5\AvastUI.exe [5227112 2015-01-28] (AVAST Software)
    HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-02-21] (Apple Inc.)
    HKU\S-1-5-21-3709555391-908018771-1203518072-1253\...\Run: [HPAdvisorDock] => C:\Program Files (x86)\Hewlett-Packard\HP Advisor\DOCK\HPAdvisorDock.exe
    HKU\S-1-5-21-3709555391-908018771-1203518072-1253\...\Run: [LightScribe Control Panel] => C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2363392 2010-02-23] (Hewlett-Packard Company)
    HKU\S-1-5-21-3709555391-908018771-1203518072-1253\...\MountPoints2: {99b30087-7083-11df-8e61-806e6f6e6963} - F:\Autorun.exe
    HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [301568 2013-05-21] (Microsoft Corporation)
    AppInit_DLLs-x32: c:\progra~2\ss-hel~1\psupport.dll => "c:\progra~2\ss-hel~1\psupport.dll" File Not Found
    AppInit_DLLs-x32: c:\progra~2\websea~1\sprote~1.dll => c:\Program Files (x86)\WebSearch\sprotector.dll [1044480 2013-01-24] ()
    Startup: C:\Users\Lana\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
    ShortcutTarget: Dropbox.lnk -> C:\Users\Lana\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
    Startup: C:\Users\Sharyn\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
    ShortcutTarget: Dropbox.lnk -> C:\Users\Lana\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
    Startup: C:\Users\Sharyn\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk
    ShortcutTarget: OpenOffice.org 3.2.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
    ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\Alwil Software\Avast5\ashShA64.dll (AVAST Software)

    ==================== Internet (Whitelisted) ====================

    (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

    HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://websearch.wisesearch.info/?p...hid=14619573708274855592&lg=EN&cc=AU&unqvl=39
    HKU\S-1-5-21-3709555391-908018771-1203518072-1253\Software\Microsoft\Internet Explorer\Main,Start Page = http://g.jp.msn.com/CQALL/13
    HKU\S-1-5-21-3709555391-908018771-1203518072-1253\Software\Microsoft\Internet Explorer\Main,First Home Page = http://g.jp.msn.com/CQALL/13
    HKU\S-1-5-21-3709555391-908018771-1203518072-1253\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.jp.msn.com/CQALL/13
    SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
    SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
    SearchScopes: HKLM-x32 -> DefaultScope {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} URL = http://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01
    SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
    SearchScopes: HKLM-x32 -> {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} URL = http://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01
    SearchScopes: HKLM-x32 -> {BB74DE59-BC4C-4172-9AC4-73315F71CFFE} URL = http://websearch.wisesearch.info/?l=1&q={searchTerms}&pid=1675&r=2013/10/29&hid=14619573708274855592&lg=EN&cc=AU&unqvl=39
    SearchScopes: HKLM-x32 -> {E7509A79-FEF2-4DCA-A255-ACF2EC6A0E29} URL = http://www.bing.com/search?q={searchTerms}&form=CPNTDF&pc=CPNTDF&src=IE-SearchBox
    BHO: No Name -> {58185BEF-C198-29CA-298A-A3DE5863BC85} -> No File
    BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\Alwil Software\Avast5\aswWebRepIE64.dll (AVAST Software)
    BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
    BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
    BHO: Skype add-on for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
    BHO: No Name -> {C097DE93-4906-B2BA-0687-C2C6348E0534} -> No File
    BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre6\bin\jp2ssv.dll No File
    BHO-x32: HP Print Enhancer -> {0347C33E-8762-4905-BF09-768834316C61} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
    BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
    BHO-x32: No Name -> {58185BEF-C198-29CA-298A-A3DE5863BC85} -> No File
    BHO-x32: No Name -> {5C255C8A-E604-49b4-9D64-90988571CECB} -> No File
    BHO-x32: Symantec NCO BHO -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton Internet Security\Engine\17.0.0.136\coIEPlg.dll (Symantec Corporation)
    BHO-x32: Symantec Intrusion Prevention -> {6D53EC84-6AAE-4787-AEEE-F4628F01010C} -> C:\Program Files (x86)\Norton Internet Security\Engine\17.0.0.136\IPSBHO.DLL (Symantec Corporation)
    BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll (AVAST Software)
    BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
    BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
    BHO-x32: Skype Browser Helper -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
    BHO-x32: Google Toolbar Notifier BHO -> {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} -> C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.5.5126.1836\swg.dll (Google Inc.)
    BHO-x32: No Name -> {C097DE93-4906-B2BA-0687-C2C6348E0534} -> No File
    BHO-x32: Bing Bar Helper -> {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -> C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
    BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
    BHO-x32: HP Smart BHO Class -> {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
    Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
    Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File
    Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - No File
    Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\17.0.0.136\coIEPlg.dll (Symantec Corporation)
    Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
    Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
    Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
    Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
    Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
    Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
    Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
    Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

    FireFox:
    ========
    FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_296.dll ()
    FF Plugin: @microsoft.com/GENUINE -> disabled No File
    FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
    FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_296.dll ()
    FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1204144.dll (Adobe Systems, Inc.)
    FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
    FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
    FF Plugin-x32: @java.com/DTPlugin,version=10.21.2 -> C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
    FF Plugin-x32: @java.com/JavaPlugin -> C:\Program Files (x86)\Java\jre7\bin\new_plugin\npjp2.dll No File
    FF Plugin-x32: @java.com/JavaPlugin,version=10.21.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
    FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
    FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
    FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
    FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
    FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
    FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
    FF HKLM-x32\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\IPSFFPlgn
    FF HKLM-x32\...\Firefox\Extensions: [{4C0766D3-67A7-45a3-85A2-752F77312F32}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\coFFPlgn
    FF HKLM-x32\...\Firefox\Extensions: [[email protected]] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
    FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010-10-09]
    FF HKLM-x32\...\Firefox\Extensions: [[email protected]] - C:\Program Files\Alwil Software\Avast5\WebRep\FF
    FF Extension: Avast Online Security - C:\Program Files\Alwil Software\Avast5\WebRep\FF [2011-06-20]

    Chrome:
    =======
    CHR HomePage: Default -> hxxp://mystart.incredibar.com/?a=6Oz9pbSvHP&loc=skw
    CHR StartupUrls: Default -> "hxxp://www.incredibar-search.com/?a=6Oz9pbSvHP&loc=skw&i=26&did=10963", "hxxp://www.google.com"
    CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:inputType}{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}{google:searchVersion}{google:sessionToken}{google:prefetchQuery}sugkey={google:suggestAPIKeyParameter}
    CHR Profile: C:\Users\Lana\AppData\Local\Google\Chrome\User Data\Default
    CHR Extension: (Google Slides) - C:\Users\Lana\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-01-21]
    CHR Extension: (Google Docs) - C:\Users\Lana\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-01-21]
    CHR Extension: (Google Drive) - C:\Users\Lana\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-01-21]
    CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Lana\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2015-01-21]
    CHR Extension: (YouTube) - C:\Users\Lana\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-01-21]
    CHR Extension: (Google Search) - C:\Users\Lana\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-01-21]
    CHR Extension: (Google Sheets) - C:\Users\Lana\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-01-21]
    CHR Extension: (AdBlock) - C:\Users\Lana\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2015-01-21]
    CHR Extension: (Avast Online Security) - C:\Users\Lana\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2015-01-21]
    CHR Extension: (Page Refresh) - C:\Users\Lana\AppData\Local\Google\Chrome\User Data\Default\Extensions\hmooaemjmediafeacjplpbpenjnpcneg [2015-01-21]
    CHR Extension: (Skype Click to Call) - C:\Users\Lana\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2015-01-21]
    CHR Extension: (Cath Kidston) - C:\Users\Lana\AppData\Local\Google\Chrome\User Data\Default\Extensions\ndlpkmaeinmnbiadacenijnhlolneopm [2015-01-21]
    CHR Extension: (Google Wallet) - C:\Users\Lana\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-01-21]
    CHR Extension: (Gmail) - C:\Users\Lana\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-01-21]
    CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\Alwil Software\Avast5\WebRep\Chrome\aswWebRepChrome.crx [2015-01-20]
    CHR HKLM-x32\...\Chrome\Extension: [jfmjfhklogoienhpfnppmbcbjfjnkonk] - No Path
    CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2014-03-03]

    ==================== Services (Whitelisted) =================

    (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

    S2 avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [50344 2015-01-20] (AVAST Software)
    S2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1363584 2014-03-03] (Microsoft Corporation)
    S2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1748608 2014-03-03] (Microsoft Corporation)
    S2 HP Health Check Service; C:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exe [120832 2009-10-16] (Hewlett-Packard) [File not signed]
    S2 HPWMISVC; C:\Program Files\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [19968 2010-01-13] () [File not signed]
    S2 LightScribeService; C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe [73728 2010-02-23] (Hewlett-Packard Company) [File not signed]
    S2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)
    S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)
    S2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2010-01-18] (Hewlett-Packard) [File not signed]
    S2 NIS; C:\Program Files (x86)\Norton Internet Security\Engine\17.0.0.136\ccSvcHst.exe [126392 2009-08-25] (Symantec Corporation)
    S2 PCToolsSSDMonitorSvc; C:\Program Files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe [794272 2012-08-21] (PC Tools)
    S2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2010-01-18] (Hewlett-Packard) [File not signed]
    R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

    ==================== Drivers (Whitelisted) ====================

    (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

    S2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2015-01-20] ()
    R0 aswKbd; C:\Windows\System32\Drivers\aswKbd.sys [22600 2013-05-09] (AVAST Software)
    S2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [83280 2015-01-20] (AVAST Software)
    R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2015-01-20] (AVAST Software)
    S0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2015-01-20] ()
    S1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1050432 2015-01-20] (AVAST Software)
    S1 aswSP; C:\Windows\system32\drivers\aswSP.sys [436624 2015-01-20] (AVAST Software)
    S2 aswStm; C:\Windows\system32\drivers\aswStm.sys [116728 2015-01-20] (AVAST Software)
    S0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [267632 2015-01-20] ()
    S3 FNETTHJM; C:\Windows\SysWOW64\drivers\fnetthjm.sys [24448 2013-12-03] (FNet Co., Ltd.) [File not signed]
    S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation)
    S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-01-30] (Malwarebytes Corporation)
    S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-11-21] (Malwarebytes Corporation)
    S1 SRTSP; C:\Windows\system32\drivers\NISx64\1100000.088\SRTSP64.SYS [504880 2009-08-30] (Symantec Corporation)
    S1 SRTSPX; C:\Windows\system32\drivers\NISx64\1100000.088\SRTSPX64.SYS [32304 2009-08-30] (Symantec Corporation)
    S3 NAVENG; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\VirusDefs\20090829.019\ENG64.SYS [X]
    S3 NAVEX15; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\VirusDefs\20090829.019\EX64.SYS [X]

    ==================== NetSvcs (Whitelisted) ===================

    (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


    ==================== One Month Created Files and Folders ========

    (If an entry is included in the fixlist, the file\folder will be moved.)

    2015-01-31 10:57 - 2015-01-31 10:58 - 00020578 _____ () C:\Users\Lana\Desktop\FRST.txt
    2015-01-31 10:57 - 2015-01-31 10:57 - 00000000 ____D () C:\FRST
    2015-01-31 10:57 - 2015-01-31 10:56 - 02130432 _____ (Farbar) C:\Users\Lana\Desktop\FRST64.exe
    2015-01-31 10:56 - 2015-01-31 10:56 - 02130432 _____ (Farbar) C:\Users\Lana\Downloads\FRST64.exe
    2015-01-30 20:40 - 2015-01-30 20:41 - 00509440 _____ (Tech Support Guy System) C:\Users\Lana\Downloads\SysInfo.exe
    2015-01-30 19:13 - 2015-01-30 19:58 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
    2015-01-30 19:12 - 2015-01-30 19:12 - 00001102 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
    2015-01-30 19:12 - 2015-01-30 19:12 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
    2015-01-30 19:12 - 2015-01-30 19:12 - 00000000 ____D () C:\ProgramData\Malwarebytes
    2015-01-30 19:12 - 2015-01-30 19:12 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
    2015-01-30 19:12 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
    2015-01-30 19:12 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
    2015-01-30 19:12 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
    2015-01-30 19:00 - 2015-01-30 19:10 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Lana\Downloads\mbam-setup-2.0.4.1028.exe
    2015-01-29 19:00 - 2015-01-29 19:01 - 00721933 _____ () C:\Users\Lana\Downloads\Cozy Winter.Sims3Pack
    2015-01-29 18:59 - 2015-01-29 18:59 - 00607356 _____ () C:\Users\Lana\Downloads\dress.Sims3Pack
    2015-01-29 18:58 - 2015-01-29 18:59 - 00544912 _____ () C:\Users\Lana\Downloads\LHFC25 Fluttering off to Bed.Sims3Pack
    2015-01-29 17:06 - 2015-01-29 17:07 - 00548754 _____ () C:\Users\Lana\Downloads\Pyjama pour bébé Winnie.Sims3Pack
    2015-01-29 17:04 - 2015-01-29 17:04 - 00888215 _____ () C:\Users\Lana\Downloads\Toddler's Dot Nursery Cardigan with Pink Dress.Sims3Pack
    2015-01-29 17:04 - 2015-01-29 17:04 - 00599098 _____ () C:\Users\Lana\Downloads\Sweet Baby.Sims3Pack
    2015-01-29 16:46 - 2015-01-29 16:47 - 00494657 _____ () C:\Users\Lana\Downloads\Strapless Top No 25.Sims3Pack
    2015-01-26 16:45 - 2015-01-26 16:45 - 00000000 ____D () C:\Users\Lana\AppData\Local\Apple
    2015-01-24 21:22 - 2015-01-24 21:22 - 00000000 _____ () C:\Users\Lana\AppData\Local\{24F8E9EC-1C36-4E4D-8F37-C6B56FED7A37}
    2015-01-23 19:29 - 2015-01-30 13:45 - 00000000 ___RD () C:\Users\Lana\Dropbox
    2015-01-23 19:29 - 2015-01-23 19:29 - 00001123 _____ () C:\Users\Lana\Desktop\Dropbox.lnk
    2015-01-23 19:29 - 2015-01-23 19:29 - 00000000 ____D () C:\Users\Lana\Dropbox (Old)
    2015-01-23 19:22 - 2015-01-30 17:42 - 00000000 ____D () C:\Users\Lana\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
    2015-01-23 19:11 - 2015-01-30 13:45 - 00000000 ____D () C:\Users\Lana\AppData\Roaming\Dropbox
    2015-01-23 19:10 - 2015-01-23 19:10 - 00324136 _____ (Dropbox, Inc.) C:\Users\Lana\Downloads\DropboxInstaller.exe
    2015-01-21 14:22 - 2015-01-21 14:22 - 00000000 ____D () C:\Users\Lana\Documents\Electronic Arts
    2015-01-21 14:20 - 2015-01-21 14:20 - 00000000 ____D () C:\Users\Lana\AppData\Roaming\hpqlog
    2015-01-21 14:18 - 2015-01-21 14:18 - 00000000 ____D () C:\Users\Lana\AppData\Roaming\Hewlett-Packard
    2015-01-21 14:13 - 2015-01-21 14:13 - 00000000 ____D () C:\Users\Lana\AppData\Local\Hewlett-Packard
    2015-01-21 11:07 - 2015-01-21 13:06 - 00000000 ____D () C:\3590F75ABA9E485486C100C1A9D4FF06ZZZZZZ....Z....Z
    2015-01-21 08:57 - 2015-01-21 08:57 - 00118520 _____ () C:\Users\Lana\AppData\Local\GDIPFONTCACHEV1.DAT
    2015-01-21 08:46 - 2015-01-21 08:46 - 00000000 ____D () C:\Users\Lana\AppData\Roaming\AVAST Software
    2015-01-21 08:46 - 2015-01-21 08:46 - 00000000 ____D () C:\Users\Lana\AppData\Roaming\Apple Computer
    2015-01-21 08:45 - 2015-01-25 13:15 - 00000000 ____D () C:\Users\Lana\AppData\Local\Google
    2015-01-21 08:45 - 2015-01-21 09:38 - 00002255 _____ () C:\Users\Lana\Desktop\Google Chrome.lnk
    2015-01-21 08:45 - 2015-01-21 08:45 - 00001413 _____ () C:\Users\Lana\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
    2015-01-21 08:45 - 2015-01-21 08:45 - 00000000 ____D () C:\Users\Lana\AppData\Roaming\Adobe
    2015-01-21 08:44 - 2015-01-21 08:44 - 00000000 ____D () C:\Users\Lana\AppData\Local\VirtualStore
    2015-01-21 08:43 - 2015-01-30 17:42 - 00000000 ____D () C:\Users\Lana
    2015-01-21 08:43 - 2015-01-21 08:43 - 00000020 ___SH () C:\Users\Lana\ntuser.ini
    2015-01-21 08:43 - 2013-03-20 13:26 - 00000000 ____D () C:\Users\Lana\AppData\Roaming\Macromedia
    2015-01-21 08:43 - 2010-06-15 21:26 - 00000000 ____D () C:\Users\Lana\AppData\Local\Microsoft Help
    2015-01-21 08:43 - 2009-07-14 15:54 - 00000000 ___RD () C:\Users\Lana\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
    2015-01-21 08:43 - 2009-07-14 15:49 - 00000000 ___RD () C:\Users\Lana\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
    2015-01-21 08:30 - 2015-01-21 08:30 - 00000000 ____D () C:\Users\Public\Documents\My Deliveries
    2015-01-21 08:25 - 2015-01-21 08:58 - 00002770 _____ () C:\Windows\System32\Tasks\CCleanerSkipUAC
    2015-01-21 08:25 - 2015-01-21 08:26 - 00000000 ____D () C:\Program Files\CCleaner
    2015-01-21 08:25 - 2015-01-21 08:25 - 00000822 _____ () C:\Users\Public\Desktop\CCleaner.lnk
    2015-01-21 08:25 - 2015-01-21 08:25 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
    2015-01-20 17:24 - 2015-01-20 17:23 - 00029208 _____ () C:\Windows\system32\Drivers\aswHwid.sys
    2015-01-20 17:23 - 2015-01-20 17:23 - 00364512 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
    2015-01-20 17:23 - 2015-01-20 17:23 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
    2015-01-20 17:00 - 2015-01-20 17:00 - 00003344 _____ () C:\Windows\System32\Tasks\RealUpgradeScheduledTaskS-1-5-21-3709555391-908018771-1203518072-1000
    2015-01-20 17:00 - 2015-01-20 17:00 - 00003212 _____ () C:\Windows\System32\Tasks\RealUpgradeLogonTaskS-1-5-21-3709555391-908018771-1203518072-1000

    ==================== One Month Modified Files and Folders =======

    (If an entry is included in the fixlist, the file\folder will be moved.)

    2015-01-31 10:20 - 2013-11-30 11:53 - 00000000 ____D () C:\ProgramData\Recovery
    2015-01-30 19:17 - 2010-07-19 09:47 - 00212872 _____ () C:\Windows\PFRO.log
    2015-01-30 17:42 - 2010-06-05 16:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
    2015-01-30 17:42 - 2010-05-20 19:45 - 00000000 ____D () C:\ProgramData\Norton
    2015-01-30 17:42 - 2009-07-14 14:20 - 00000000 ____D () C:\Windows\AppCompat
    2015-01-30 17:39 - 2010-05-20 19:33 - 01707130 _____ () C:\Windows\WindowsUpdate.log
    2015-01-30 16:55 - 2013-06-27 12:53 - 00028378 _____ () C:\Windows\setupact.log
    2015-01-30 14:32 - 2010-06-05 15:55 - 00000898 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
    2015-01-30 14:06 - 2013-02-25 08:51 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
    2015-01-30 13:52 - 2009-07-14 15:45 - 00023248 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
    2015-01-30 13:52 - 2009-07-14 15:45 - 00023248 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
    2015-01-30 13:45 - 2012-07-09 10:28 - 00004184 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
    2015-01-30 13:44 - 2013-10-09 19:00 - 00000286 _____ () C:\Windows\Tasks\RMAutoUpdate.job
    2015-01-30 13:44 - 2012-06-11 17:14 - 00000000 ____D () C:\Program Files (x86)\PC Tools Registry Mechanic
    2015-01-30 13:43 - 2010-06-05 15:55 - 00000894 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
    2015-01-30 13:42 - 2009-07-14 16:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
    2015-01-29 19:27 - 2013-10-04 17:57 - 00000286 _____ () C:\Windows\Tasks\RMSchedule.job
    2015-01-28 10:38 - 2010-04-01 12:12 - 00000000 ____D () C:\ProgramData\Temp
    2015-01-27 15:25 - 2009-07-14 16:08 - 00032572 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
    2015-01-25 14:26 - 2013-02-25 08:51 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
    2015-01-25 14:26 - 2013-02-25 08:51 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
    2015-01-25 14:26 - 2013-02-25 08:51 - 00003768 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
    2015-01-21 10:28 - 2009-07-14 16:13 - 00788704 _____ () C:\Windows\system32\PerfStringBackup.INI
    2015-01-21 09:30 - 2010-04-01 12:55 - 00000000 ____D () C:\Program Files (x86)\CyberLink
    2015-01-21 09:30 - 2010-04-01 10:54 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
    2015-01-21 09:22 - 2010-07-20 15:44 - 00000000 ____D () C:\ProgramData\Kontiki
    2015-01-21 09:15 - 2010-06-05 13:25 - 00000000 ____D () C:\Users\Sharyn
    2015-01-21 08:59 - 2012-08-21 16:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cakewalk
    2015-01-21 08:59 - 2012-08-21 16:34 - 00000000 ____D () C:\Program Files (x86)\Cakewalk
    2015-01-21 08:29 - 2010-06-06 11:16 - 00000000 ____D () C:\Writing
    2015-01-21 08:19 - 2014-04-04 08:20 - 00000000 ___RD () C:\Users\Sharyn\Dropbox
    2015-01-21 08:19 - 2014-04-04 08:14 - 00000000 ____D () C:\Users\Sharyn\AppData\Roaming\Dropbox
    2015-01-20 20:29 - 2014-04-22 17:40 - 00000000 ____D () C:\Program Files\003
    2015-01-20 20:29 - 2013-10-29 18:41 - 00000000 ____D () C:\ProgramData\SearchNewTab
    2015-01-20 19:39 - 2013-10-29 18:36 - 00000000 ____D () C:\ProgramData\Dowwnlloaidd. keeperr
    2015-01-20 19:35 - 2012-06-11 20:00 - 00000416 _____ () C:\Windows\SysWOW64\AppLog.log
    2015-01-20 18:47 - 2012-10-01 16:03 - 00000000 ____D () C:\Users\Sharyn\AppData\Roaming\Real
    2015-01-20 18:47 - 2012-10-01 16:03 - 00000000 ____D () C:\Program Files (x86)\Real
    2015-01-20 18:46 - 2012-10-01 16:01 - 00000000 ____D () C:\ProgramData\Real
    2015-01-20 18:45 - 2010-04-01 12:55 - 00000000 ____D () C:\ProgramData\CyberLink
    2015-01-20 17:26 - 2010-06-05 15:55 - 00003894 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
    2015-01-20 17:26 - 2010-06-05 15:55 - 00003642 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
    2015-01-20 17:24 - 2011-06-20 10:40 - 01050432 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys
    2015-01-20 17:23 - 2014-01-12 11:06 - 00116728 _____ (AVAST Software) C:\Windows\system32\Drivers\aswstm.sys
    2015-01-20 17:23 - 2013-03-18 13:37 - 00267632 _____ () C:\Windows\system32\Drivers\aswVmm.sys
    2015-01-20 17:23 - 2013-03-18 13:37 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
    2015-01-20 17:23 - 2012-03-25 09:17 - 00093568 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
    2015-01-20 17:23 - 2010-06-05 15:55 - 00436624 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
    2015-01-20 17:23 - 2010-06-05 15:55 - 00083280 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
    2015-01-20 17:22 - 2014-04-04 08:17 - 00000000 ____D () C:\Users\Sharyn\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
    2015-01-20 17:20 - 2013-01-29 14:39 - 00000000 ____D () C:\Users\Sharyn\AppData\Roaming\.minecraft

    ==================== Files in the root of some directories =======

    2015-01-24 21:22 - 2015-01-24 21:22 - 0000000 _____ () C:\Users\Lana\AppData\Local\{24F8E9EC-1C36-4E4D-8F37-C6B56FED7A37}
    2010-08-06 15:29 - 2010-08-06 15:29 - 0000056 ____H () C:\ProgramData\ezsidmv.dat
    2010-10-09 14:00 - 2010-10-09 14:10 - 0000782 _____ () C:\ProgramData\hpzinstall.log
    2010-05-20 19:41 - 2010-05-20 19:41 - 0000032 _____ () C:\ProgramData\{051B9612-4D82-42AC-8C63-CD2DCEDC1CB3}.log
    2010-04-01 13:03 - 2010-04-01 13:04 - 0000109 _____ () C:\ProgramData\{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}.log
    2010-05-20 19:40 - 2010-05-20 19:40 - 0000032 _____ () C:\ProgramData\{23F3DA62-2D9E-4A69-B8D5-BE8E9E148092}.log
    2010-04-01 12:56 - 2010-04-01 12:57 - 0000105 _____ () C:\ProgramData\{40BF1E83-20EB-11D8-97C5-0009C5020658}.log
    2010-05-20 19:40 - 2010-05-20 19:40 - 0000032 _____ () C:\ProgramData\{4FC670EB-5F02-4B07-90DB-022B86BFEFD0}.log
    2010-05-20 19:40 - 2010-05-20 19:40 - 0000032 _____ () C:\ProgramData\{9867824A-C86D-4A83-8F3C-E7A86BE0AFD3}.log
    2010-04-01 12:56 - 2010-04-01 12:56 - 0000107 _____ () C:\ProgramData\{C59C179C-668D-49A9-B6EA-0121CCFC1243}.log
    2010-04-01 12:58 - 2010-04-01 13:03 - 0000110 _____ () C:\ProgramData\{CB099890-1D5F-11D5-9EA9-0050BAE317E1}.log
    2010-05-20 19:41 - 2010-05-20 19:41 - 0000105 _____ () C:\ProgramData\{d36dd326-7280-11d8-97c8-000129760cbe}.log

    Some content of TEMP:
    ====================
    C:\Users\Lana\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp98faep.dll
    C:\Users\Sharyn\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmprw7ud5.dll
    C:\Users\Sharyn\AppData\Local\Temp\SpotifyUninstall.exe
    C:\Users\Sharyn\AppData\Local\Temp\sSetup-se.exe


    ==================== Bamital & volsnap Check =================

    (There is no automatic fix for files that do not pass verification.)

    C:\Windows\System32\winlogon.exe => File is digitally signed
    C:\Windows\System32\wininit.exe => File is digitally signed
    C:\Windows\SysWOW64\wininit.exe => File is digitally signed
    C:\Windows\explorer.exe => File is digitally signed
    C:\Windows\SysWOW64\explorer.exe => File is digitally signed
    C:\Windows\System32\svchost.exe => File is digitally signed
    C:\Windows\SysWOW64\svchost.exe => File is digitally signed
    C:\Windows\System32\services.exe => File is digitally signed
    C:\Windows\System32\User32.dll => File is digitally signed
    C:\Windows\SysWOW64\User32.dll => File is digitally signed
    C:\Windows\System32\userinit.exe => File is digitally signed
    C:\Windows\SysWOW64\userinit.exe => File is digitally signed
    C:\Windows\System32\rpcss.dll => File is digitally signed
    C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


    LastRegBack: 2015-01-25 20:05

    ==================== End Of Log ============================

    Here is the report from RougeKiller

    RogueKiller V10.2.0.0 [Jan 19 2015] by Adlice Software
    mail : http://www.adlice.com/contact/
    Feedback : http://forum.adlice.com
    Website : http://www.adlice.com/softwares/roguekiller/
    Blog : http://www.adlice.com

    Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
    Started in : Safe mode with network support
    User : Lana [Administrator]
    Mode : Scan -- Date : 01/31/2015 11:17:41

    ¤¤¤ Processes : 0 ¤¤¤

    ¤¤¤ Registry : 8 ¤¤¤
    [PUM.HomePage] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main | Start Page : http://websearch.wisesearch.info/?p...hid=14619573708274855592&lg=EN&cc=AU&unqvl=39 -> Found
    [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{11FD878F-AE45-44B9-A435-FFF3C9A621D5} | DhcpNameServer : 10.4.81.103 10.4.182.20 [(Private Address) (XX)][(Private Address) (XX)] -> Found
    [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{11FD878F-AE45-44B9-A435-FFF3C9A621D5} | DhcpNameServer : 10.4.81.103 10.4.182.20 [(Private Address) (XX)][(Private Address) (XX)] -> Found
    [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Tcpip\Parameters\Interfaces\{11FD878F-AE45-44B9-A435-FFF3C9A621D5} | DhcpNameServer : 10.4.81.103 10.4.182.20 [(Private Address) (XX)][(Private Address) (XX)] -> Found
    [PUM.DesktopIcons] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> Found
    [PUM.DesktopIcons] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1 -> Found
    [PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> Found
    [PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1 -> Found

    ¤¤¤ Tasks : 0 ¤¤¤

    ¤¤¤ Files : 0 ¤¤¤

    ¤¤¤ Hosts File : 0 ¤¤¤

    ¤¤¤ Antirootkit : 0 (Driver: Not loaded [0xc000035f]) ¤¤¤

    ¤¤¤ Web browsers : 0 ¤¤¤

    ¤¤¤ MBR Check : ¤¤¤
    +++++ PhysicalDrive0: Hitachi HTS725025A9A364 SATA Disk Device +++++
    --- User ---
    [MBR] ef7df3c8396ce3eba596ff254c0cea0b
    [BSP] b8f9af0bfc632918cff6943e8642fc8f : Unknown MBR Code
    Partition table:
    0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 199 MB [Unknown Bootstrap | Unknown Bootloader]
    1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 409600 | Size: 224915 MB [Unknown Bootstrap | Unknown Bootloader]
    2 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 461035520 | Size: 13256 MB [Unknown Bootstrap | Unknown Bootloader]
    3 - [XXXXXX] FAT32-LBA (0xc) [VISIBLE] Offset (sectors): 488183808 | Size: 103 MB
    User = LL1 ... OK
    User = LL2 ... OK

    I hope I have included all the information you need.
    Thank you very much!
     

    Attached Files:

  4. kevinf80

    kevinf80 Malware Specialist

    Joined:
    Mar 21, 2006
    Messages:
    11,383
    First Name:
    Kevin
    Download attached fixlist.txt file (end of reply) and save it to the Desktop, or the folder you saved FRST into.
    NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work.

    Run FRST and press the Fix button just once and wait.
    The tool will make a log on the Desktop (Fixlog.txt) or the folder it was ran from. Please post it to your reply.

    Boot back to normal mode.....

    Next,

    Open Malwarebytes Anti-Malware, from the Dashboard please Check for Updates by clicking the Update Now... link
    When the update completes select > Settings > Detection and Protection > Enable Scan for rootkit and Under Non Malware Protection set both PUP and PUM to Treat detections as malware.


    Click on the SCAN button and run a Threat Scan with Malwarebytes Anti-Malware by clicking the Scan Now>> button.

    When the scan is complete, if there have been detections, click Apply Actions to allow MBAM to clean what was detected.

    In most cases, a restart will be required.

    Wait for the prompt to restart the computer to appear, then click on Yes.

    When the scan is completed from the main GUI click on History > Application Logs. Find your scan log, the date when run will identify it. Checkmark "select" box > then hit the "view" button. The history log window will open. At the bottom of that window are two options, "Copy to clipboard" and "Export"
    Select > "Copy to clipboard" that copies the full log to the windows clipboard, so at your reply you right click into the text field and select "Paste" the log is pasted (copied) to your reply.

    Next,

    Download AdwCleaner by Xplode onto your Desktop.
    • Double click on Adwcleaner.exe to run the tool.
    • Click on Scan
    • Once the scan is done, click on the Clean button.
    • You will get a prompt asking to close all programs. Click OK.
    • Click OK again to reboot your computer.
    • A text file will open after the restart. Please post the content of that logfile in your reply.
    • You can also find the logfile at C:\AdwCleaner[Sn].txt. Where n in the scan reference number

    Next,

    [​IMG] Please download Junkware Removal Tool to your desktop.
    • Shut down your protection software now to avoid potential conflicts. (re-enable when done)
    • Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
    • The tool will open and start scanning your system.
    • Please be patient as this can take a while to complete depending on your system's specifications.
    • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
    • Post the contents of JRT.txt into your next message.

    Next,

    Download Microsoft's " Malicious Software Removal Tool" and save direct to the desktop
    Ensure to get the correct version for your system....
    32 Bit version:
    https://www.microsoft.com/downloads...E0-E72D-4F54-9AB3-75B8EB148356&displaylang=en
    64 Bit version:
    https://www.microsoft.com/downloads...DE-367F-495E-94E7-6349F4EFFC74&displaylang=en

    Right click on the Tool, select “Run as Administrator” the tool will expand to the options Window
    In the "Scan Type" window, select Quick Scan
    Perform a scan and Click Finish when the scan is done.
    Retrieve the MSRT log as follows, and post it in your next reply:

    1) Select the Windows key and R key together to open the "Run" function
    2) Type or Copy/Paste the following command to the "Run Line" and Press Enter:

    notepad c:\windows\debug\mrt.log

    Let me see those logs in your next reply, also give an update on any remaining issues or concerns...

    Thank you,

    Kevin...
     

    Attached Files:

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Loading...
Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/1142133

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice