1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

vprgpt

Discussion in 'Virus & Other Malware Removal' started by RoyP, Jan 19, 2015.

Thread Status:
Not open for further replies.
Advertisement
  1. RoyP

    RoyP Thread Starter

    Joined:
    Sep 23, 2012
    Messages:
    270
    How do i remove vprgpt when using google chrome?
     
  2. kevinf80

    kevinf80 Malware Specialist

    Joined:
    Mar 21, 2006
    Messages:
    11,383
    First Name:
    Kevin
    Hello and welcome to TSG...

    Run the following in the order given and post the produced logs....

    Download AdwCleaner by Xplode onto your Desktop.
    • Double click on Adwcleaner.exe to run the tool.
    • Click on Scan
    • Once the scan is done, click on the Clean button.
    • You will get a prompt asking to close all programs. Click OK.
    • Click OK again to reboot your computer.
    • A text file will open after the restart. Please post the content of that logfile in your reply.
    • You can also find the logfile at C:\AdwCleaner[Sn].txt. Where n in the scan reference number

    Next,

    [​IMG] Please download Junkware Removal Tool to your desktop.
    • Shut down your protection software now to avoid potential conflicts. (re-enable when done)
    • Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
    • The tool will open and start scanning your system.
    • Please be patient as this can take a while to complete depending on your system's specifications.
    • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
    • Post the contents of JRT.txt into your next message.

    Next,

    Download Farbar Recovery Scan Tool and save it to your desktop.

    Note: You need to run the version compatible with your system (32 bit or 64 bit). If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.
    • Double-click to run it. When the tool opens click Yes to disclaimer.
    • Press Scan button.
    • It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
    • The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

    Thank you,

    Kevin....
     
  3. RoyP

    RoyP Thread Starter

    Joined:
    Sep 23, 2012
    Messages:
    270
    I sort of jumped the gun and had already scanned etc with AdwCleaner and deleted the text file:mad:

    Will now follow your other instructions.

    Thanks for the assistance.
     
  4. kevinf80

    kevinf80 Malware Specialist

    Joined:
    Mar 21, 2006
    Messages:
    11,383
    First Name:
    Kevin
    Logs are saved here: C:\AdwCleaner folder....
     
  5. RoyP

    RoyP Thread Starter

    Joined:
    Sep 23, 2012
    Messages:
    270
    Logfiles as requested, my computer will not allow me to download Farbar Recovery Scan Tool!!

    # AdwCleaner v4.108 - Report created 19/01/2015 at 20:22:53
    # Updated 17/01/2015 by Xplode
    # Database : 2015-01-18.1 [Live]
    # Operating System : Windows 8.1 (64 bits)
    # Username : Roy - OUR-COMPUTER
    # Running from : C:\Users\Roy\Desktop\Cleaners & Trouble Shooters\adwcleaner_4.108.exe
    # Option : Clean

    ***** [ Services ] *****


    ***** [ Files / Folders ] *****

    File Deleted : C:\Users\Roy\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.superfish.com_0.localstorage
    File Deleted : C:\Users\Roy\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.superfish.com_0.localstorage-journal
    File Deleted : C:\Users\Roy\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_www.superfish.com_0.localstorage
    File Deleted : C:\Users\Roy\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_www.superfish.com_0.localstorage-journal
    File Deleted : C:\Users\Roy\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_static.publikeco00.publikeco.com_0.localstorage
    File Deleted : C:\Users\Roy\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_static.publikeco00.publikeco.com_0.localstorage-journal

    ***** [ Scheduled Tasks ] *****


    ***** [ Shortcuts ] *****


    ***** [ Registry ] *****


    ***** [ Browsers ] *****

    -\\ Internet Explorer v11.0.9600.17416


    -\\ Google Chrome v39.0.2171.99


    *************************

    AdwCleaner[R0].txt - [6108 octets] - [19/01/2015 19:39:10]
    AdwCleaner[R1].txt - [1681 octets] - [19/01/2015 20:20:17]
    AdwCleaner[S0].txt - [5347 octets] - [19/01/2015 19:40:15]
    AdwCleaner[S1].txt - [1614 octets] - [19/01/2015 20:22:53]

    ########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [1674 octets] ##########


    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    Junkware Removal Tool (JRT) by Thisisu
    Version: 6.4.1 (12.28.2014:1)
    OS: Windows 8.1 x64
    Ran by Roy on 19/01/2015 at 20:13:38.67
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




    ~~~ Services



    ~~~ Registry Values



    ~~~ Registry Keys



    ~~~ Files

    Successfully deleted: [File] "C:\Users\Roy\appdata\local\google\chrome\user data\default\local storage\http_www.superfish.com_0.localstorage"
    Successfully deleted: [File] "C:\Users\Roy\appdata\local\google\chrome\user data\default\local storage\http_www.superfish.com_0.localstorage-journal"



    ~~~ Folders

    Successfully deleted: [Folder] "C:\Users\Roy\appdata\local\free youtube downloader"
    Successfully deleted: [Folder] "C:\Program Files (x86)\free youtube downloader"
    Successfully deleted: [Folder] "C:\Windows\syswow64\ai_recyclebin"



    ~~~ Event Viewer Logs were cleared





    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    Scan was completed on 19/01/2015 at 20:17:23.91
    End of JRT log
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     
  6. kevinf80

    kevinf80 Malware Specialist

    Joined:
    Mar 21, 2006
    Messages:
    11,383
    First Name:
    Kevin
    What alert do you get when trying to d/l FRST, is it from your security...
     
  7. RoyP

    RoyP Thread Starter

    Joined:
    Sep 23, 2012
    Messages:
    270
    Yes Norton, I disable firewall and anti virus but it will still not allow it to download.
     
  8. kevinf80

    kevinf80 Malware Specialist

    Joined:
    Mar 21, 2006
    Messages:
    11,383
    First Name:
    Kevin
    If Norton is turned off FRST should now d/l, what alert do you get,
     
  9. RoyP

    RoyP Thread Starter

    Joined:
    Sep 23, 2012
    Messages:
    270
    Success!!

    Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 19-01-2015
    Ran by Roy (administrator) on OUR-COMPUTER on 19-01-2015 21:31:48
    Running from C:\Users\Roy\Downloads
    Loaded Profiles: Roy (Available profiles: Roy)
    Platform: Windows 8.1 (X64) OS Language: English (United Kingdom)
    Internet Explorer Version 11 (Default browser: Chrome)
    Boot Mode: Normal
    Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

    ==================== Processes (Whitelisted) =================

    (If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

    (IBM Corp.) C:\Program Files (x86)\Trusteer\Rapport\bin\RapportMgmtService.exe
    (Intel Corporation) C:\Windows\System32\igfxCUIService.exe
    (Kingsoft Corporation) C:\Program Files (x86)\cmcm\Clean Master\cmcore.exe
    (ABBYY) C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe
    (ArcSoft Inc.) C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
    (Acer Incorporated) C:\Program Files (x86)\Acer\AOP Framework\CCDMonitorService.exe
    (Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
    (Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\21.6.0.32\NIS.exe
    (Microsoft Corporation) C:\Windows\System32\dasHost.exe
    (Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\21.6.0.32\NIS.exe
    (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
    (Google Inc.) C:\Program Files (x86)\Google\Update\1.3.25.11\GoogleCrashHandler.exe
    (IBM Corp.) C:\Program Files (x86)\Trusteer\Rapport\bin\RapportService.exe
    (Acer Incorporated) C:\Program Files (x86)\Packard Bell\Hotkey Utility\HotkeyUtility.exe
    (Google Inc.) C:\Program Files (x86)\Google\Update\1.3.25.11\GoogleCrashHandler64.exe
    (Intel Corporation) C:\Windows\System32\igfxEM.exe
    (Intel Corporation) C:\Windows\System32\igfxHK.exe
    (Kingsoft Corporation) C:\Program Files (x86)\cmcm\Clean Master\cmtray.exe
    (Intel Corporation) C:\Windows\System32\igfxTray.exe
    (Acer Incorporate) C:\Program Files\Packard Bell\Packard Bell Quick Access\QASvc.exe
    (Acer Incorporate) C:\Program Files\Packard Bell\Packard Bell Quick Access\QAEvent.exe
    (Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
    (Acer Incorporate) C:\Program Files\Packard Bell\Packard Bell Quick Access\QAMsg.exe
    () C:\Program Files (x86)\Microsoft Office\Office\OSA.EXE
    (Acer Incorporated) C:\Program Files (x86)\Acer\AOP Framework\BackgroundAgent.exe
    (Acer Cloud Technology) C:\Program Files (x86)\Acer\AOP Framework\acer\ccd.exe
    (Microsoft Corporation) C:\Windows\System32\WWAHost.exe
    (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
    (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
    (Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
    (acer) C:\Program Files\Packard Bell\User Experience Improvement Program\Framework\UBTService.exe
    () C:\Program Files\WindowsApps\64655SofaScore.LiveScoreSofaScore_1.7.1.0_neutral__38dz11hfmf1km\Sofascore.W8.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe


    ==================== Registry (Whitelisted) ==================

    (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

    HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13650648 2013-08-21] (Realtek Semiconductor)
    HKLM\...\Run: [CanonMyPrinter] => C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [2726728 2010-03-25] (CANON INC.)
    HKLM-x32\...\Run: [BacKGround Agent] => C:\Program Files (x86)\Acer\AOP Framework\BackgroundAgent.exe [62208 2014-11-17] (Acer Incorporated)
    HKLM-x32\...\Run: [cmsc] => c:\program files (x86)\cmcm\Clean Master\cmtray.exe [468328 2014-11-25] (Kingsoft Corporation)
    HKLM-x32\...\Run: [ArcSoft Connection Service] => C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe [207360 2010-03-18] (ArcSoft Inc.)
    HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1021128 2014-11-20] (Adobe Systems Incorporated)
    HKU\S-1-5-21-447272969-2236016177-1254936844-1001\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
    Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Office Startup.lnk
    ShortcutTarget: Office Startup.lnk -> C:\Program Files (x86)\Microsoft Office\Office\OSA.EXE ()
    GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
    CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

    ==================== Internet (Whitelisted) ====================

    (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

    HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
    HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com
    SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
    SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
    SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
    SearchScopes: HKU\S-1-5-21-447272969-2236016177-1254936844-1001 -> {136E5A6A-7400-4785-B6FD-A0622F3CCB28} URL =
    BHO: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton Internet Security\Engine64\21.6.0.32\coIEPlg.dll (Symantec Corporation)
    BHO-x32: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton Internet Security\Engine\21.6.0.32\coIEPlg.dll (Symantec Corporation)
    BHO-x32: Norton Vulnerability Protection -> {6D53EC84-6AAE-4787-AEEE-F4628F01010C} -> C:\Program Files (x86)\Norton Internet Security\Engine\21.6.0.32\IPS\IPSBHO.DLL (Symantec Corporation)
    Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine64\21.6.0.32\coIEPlg.dll (Symantec Corporation)
    Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\21.6.0.32\coIEPlg.dll (Symantec Corporation)
    Tcpip\Parameters: [DhcpNameServer] 192.168.1.254

    FireFox:
    ========
    FF Plugin-x32: @canon.com/EPPEX -> C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
    FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
    FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
    FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
    FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
    FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
    FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
    FF HKLM-x32\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.6.0.32\coFFPlgn
    FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.6.0.32\coFFPlgn [2015-01-19]

    Chrome:
    =======
    CHR Profile: C:\Users\Roy\AppData\Local\Google\Chrome\User Data\Default
    CHR Extension: (Google Slides) - C:\Users\Roy\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-01-17]
    CHR Extension: (Google Docs) - C:\Users\Roy\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-01-17]
    CHR Extension: (Google Drive) - C:\Users\Roy\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-01-17]
    CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Roy\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2015-01-17]
    CHR Extension: (YouTube) - C:\Users\Roy\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-01-17]
    CHR Extension: (Adblock Plus) - C:\Users\Roy\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2015-01-18]
    CHR Extension: (Google Search) - C:\Users\Roy\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-01-17]
    CHR Extension: (Google Sheets) - C:\Users\Roy\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-01-17]
    CHR Extension: (AdBlock) - C:\Users\Roy\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2015-01-19]
    CHR Extension: (Norton Identity Safe) - C:\Users\Roy\AppData\Local\Google\Chrome\User Data\Default\Extensions\iikflkcanblccfahdhdonehdalibjnif [2015-01-17]
    CHR Extension: (Solution Real) - C:\Users\Roy\AppData\Local\Google\Chrome\User Data\Default\Extensions\mhobkkmfkjcnjbidcjgahclnibmdhhcm [2015-01-17]
    CHR Extension: (Google Wallet) - C:\Users\Roy\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-01-17]
    CHR Extension: (Gmail) - C:\Users\Roy\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-01-17]
    CHR HKLM\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - No Path
    CHR HKLM-x32\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - No Path

    ==================== Services (Whitelisted) =================

    (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

    R2 ABBYY.Licensing.FineReader.Sprint.9.0; C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [759048 2009-05-14] (ABBYY)
    R2 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
    R2 CCDMonitorService; C:\Program Files (x86)\Acer\AOP Framework\CCDMonitorService.exe [2709760 2014-11-17] (Acer Incorporated)
    R2 cmcore; c:\program files (x86)\cmcm\Clean Master\cmcore.exe [315240 2014-11-25] (Kingsoft Corporation)
    R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [282096 2014-03-11] (Intel Corporation)
    R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [747520 2013-08-27] (Intel(R) Corporation) [File not signed]
    S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [828376 2013-08-27] (Intel(R) Corporation)
    R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-09-16] (Intel Corporation)
    R2 NIS; C:\Program Files (x86)\Norton Internet Security\Engine\21.6.0.32\NIS.exe [276376 2014-09-21] (Symantec Corporation)
    R3 QASvc; C:\Program Files\Packard Bell\Packard Bell Quick Access\QASvc.exe [458984 2014-06-26] (Acer Incorporate)
    R2 RapportMgmtService; C:\Program Files (x86)\Trusteer\Rapport\bin\RapportMgmtService.exe [1919256 2014-12-22] (IBM Corp.)
    R3 UEIPSvc; C:\Program Files\Packard Bell\User Experience Improvement Program\Framework\UBTService.exe [233216 2014-06-23] (acer)
    S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-22] (Microsoft Corporation)
    S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-22] (Microsoft Corporation)

    ==================== Drivers (Whitelisted) ====================

    (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

    R3 athr; C:\Windows\system32\DRIVERS\athwbx.sys [3881472 2013-12-12] (Qualcomm Atheros Communications, Inc.)
    R1 BHDrvx64; C:\Program Files (x86)\Norton Internet Security\NortonData\21.6.0.32\Definitions\BASHDefs\20150106.001\BHDrvx64.sys [1622744 2015-01-06] (Symantec Corporation)
    R3 BTATH_LWFLT; C:\Windows\system32\DRIVERS\btath_lwflt.sys [77464 2013-12-24] (Qualcomm Atheros)
    R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [226304 2014-03-18] (Microsoft Corporation)
    R1 ccSet_NIS; C:\Windows\system32\drivers\NISx64\1506000.020\ccSetx64.sys [162392 2014-02-20] (Symantec Corporation)
    R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [487216 2014-12-11] (Symantec Corporation)
    R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [142640 2014-12-11] (Symantec Corporation)
    R1 IDSVia64; C:\Program Files (x86)\Norton Internet Security\NortonData\21.6.0.32\Definitions\IPSDefs\20150116.001\IDSvia64.sys [668888 2015-01-10] (Symantec Corporation)
    S3 ksapi64; C:\Windows\system32\drivers\ksapi64.sys [56680 2014-11-25] (Kingsoft Corporation)
    R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [99288 2013-09-16] (Intel Corporation)
    R3 NAVENG; C:\Program Files (x86)\Norton Internet Security\NortonData\21.6.0.32\Definitions\VirusDefs\20150118.025\ENG64.SYS [129752 2014-08-11] (Symantec Corporation)
    R3 NAVEX15; C:\Program Files (x86)\Norton Internet Security\NortonData\21.6.0.32\Definitions\VirusDefs\20150118.025\EX64.SYS [2137304 2014-08-11] (Symantec Corporation)
    R1 RapportCerberus_80120; C:\ProgramData\Trusteer\Rapport\store\exts\RapportCerberus\baseline\RapportCerberus64_80120.sys [845464 2015-01-14] (IBM Corp.)
    R1 RapportEI64; C:\Program Files (x86)\Trusteer\Rapport\bin\x64\RapportEI64.sys [445816 2014-12-22] (IBM Corp.)
    R0 RapportHades64; C:\Windows\System32\Drivers\RapportHades64.sys [290520 2014-12-22] (IBM Corp.)
    R0 RapportKE64; C:\Windows\System32\Drivers\RapportKE64.sys [535576 2014-12-22] (IBM Corp.)
    R1 RapportPG64; C:\Program Files (x86)\Trusteer\Rapport\bin\x64\RapportPG64.sys [558872 2014-12-22] (IBM Corp.)
    R2 RtkIOAC60; C:\Windows\system32\DRIVERS\RtkIOAC60.sys [29912 2013-07-19] (Realtek semiconductor corp)
    R3 SRTSP; C:\Windows\system32\drivers\NISx64\1506000.020\SRTSP64.SYS [876248 2014-08-26] (Symantec Corporation)
    R1 SRTSPX; C:\Windows\system32\drivers\NISx64\1506000.020\SRTSPX64.SYS [37592 2014-08-26] (Symantec Corporation)
    R0 SymDS; C:\Windows\System32\drivers\NISx64\1506000.020\SYMDS64.SYS [493656 2014-08-26] (Symantec Corporation)
    R0 SymEFA; C:\Windows\System32\drivers\NISx64\1506000.020\SYMEFA64.SYS [1148120 2014-08-26] (Symantec Corporation)
    S0 SymELAM; C:\Windows\System32\drivers\NISx64\1506000.020\SymELAM.sys [23568 2014-08-26] (Symantec Corporation)
    R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [177752 2014-12-01] (Symantec Corporation)
    R1 SymIRON; C:\Windows\system32\drivers\NISx64\1506000.020\Ironx64.SYS [266968 2014-08-06] (Symantec Corporation)
    R1 SymNetS; C:\Windows\system32\drivers\NISx64\1506000.020\SYMNETS.SYS [593112 2014-08-26] (Symantec Corporation)
    S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-22] (Microsoft Corporation)

    ==================== NetSvcs (Whitelisted) ===================

    (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


    ==================== One Month Created Files and Folders ========

    (If an entry is included in the fixlist, the file\folder will be moved.)

    2015-01-19 21:31 - 2015-01-19 21:32 - 00016110 _____ () C:\Users\Roy\Downloads\FRST.txt
    2015-01-19 21:31 - 2015-01-19 21:31 - 00000000 ____D () C:\FRST
    2015-01-19 21:30 - 2015-01-19 21:30 - 02126848 _____ (Farbar) C:\Users\Roy\Downloads\frst64.exe
    2015-01-19 20:26 - 2015-01-19 20:26 - 00001754 _____ () C:\Users\Roy\Desktop\AdwCleaner[S1].txt
    2015-01-19 20:17 - 2015-01-19 20:17 - 00001144 _____ () C:\Users\Roy\Documents\JRT.txt
    2015-01-19 20:17 - 2015-01-19 20:17 - 00001144 _____ () C:\Users\Roy\Desktop\JRT.txt
    2015-01-19 20:13 - 2015-01-19 20:13 - 00000000 ____D () C:\Windows\ERUNT
    2015-01-19 20:07 - 2015-01-19 20:07 - 01707939 _____ (Thisisu) C:\Users\Roy\Desktop\JRT.exe
    2015-01-19 19:45 - 2015-01-19 19:45 - 00000000 ____D () C:\Users\Public\Documents\sun
    2015-01-19 19:43 - 2015-01-19 20:24 - 00000232 _____ () C:\Windows\setupact.log
    2015-01-19 19:43 - 2015-01-19 20:23 - 00877476 _____ () C:\Windows\PFRO.log
    2015-01-19 19:43 - 2015-01-19 19:43 - 00374624 _____ () C:\Windows\system32\FNTCACHE.DAT
    2015-01-19 19:43 - 2015-01-19 19:43 - 00000000 _____ () C:\Windows\setuperr.log
    2015-01-19 19:38 - 2015-01-19 19:51 - 00001416 _____ () C:\Users\Roy\Desktop\adwcleaner.lnk
    2015-01-19 19:34 - 2015-01-19 20:28 - 00000000 ____D () C:\AdwCleaner
    2015-01-19 17:11 - 2015-01-19 19:40 - 00000000 ____D () C:\Windows\system32\log
    2015-01-19 11:47 - 2015-01-19 19:51 - 00000000 ____D () C:\Users\Roy\Desktop\Cleaners & Trouble Shooters
    2015-01-19 11:42 - 2015-01-19 11:42 - 00000000 ____D () C:\Windows\AUInstallAgent
    2015-01-19 11:22 - 2015-01-19 11:22 - 00001516 _____ () C:\Users\Public\Desktop\LibreOffice 4.3.lnk
    2015-01-19 11:22 - 2015-01-19 11:22 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LibreOffice 4.3
    2015-01-19 11:12 - 2015-01-19 20:25 - 00000000 ___RD () C:\Users\Roy\OneDrive
    2015-01-19 08:16 - 2014-04-15 23:35 - 00028352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aspnet_counters.dll
    2015-01-19 08:16 - 2014-04-15 23:34 - 00029888 _____ (Microsoft Corporation) C:\Windows\system32\aspnet_counters.dll
    2015-01-18 18:27 - 2015-01-18 18:27 - 00000258 __RSH () C:\ProgramData\ntuser.pol
    2015-01-18 17:32 - 2015-01-18 17:32 - 00000000 ____D () C:\Users\Roy\AppData\Local\Apps\2.0
    2015-01-17 17:07 - 2015-01-17 17:07 - 00002247 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
    2015-01-17 17:07 - 2015-01-17 17:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
    2015-01-17 08:34 - 2015-01-17 08:34 - 00001454 _____ () C:\Users\Roy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (2).lnk
    2015-01-16 21:37 - 2015-01-19 20:47 - 00000000 ____D () C:\Users\Roy\AppData\Local\Aviator
    2015-01-16 21:37 - 2015-01-16 21:37 - 00003628 _____ () C:\Windows\System32\Tasks\AviatorUpdateTask
    2015-01-16 21:37 - 2015-01-16 21:37 - 00002248 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Aviator.lnk
    2015-01-16 21:37 - 2015-01-16 21:37 - 00000000 ____D () C:\Program Files (x86)\Whitehat
    2015-01-16 21:36 - 2015-01-16 21:36 - 00000000 ____D () C:\Users\Roy\AppData\Local\Downloaded Installations
    2015-01-16 19:31 - 2015-01-16 19:31 - 00001087 _____ () C:\Users\Public\Desktop\Word To PDF.lnk
    2015-01-16 19:31 - 2015-01-16 19:31 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Free Word To PDF
    2015-01-16 19:31 - 2015-01-16 19:31 - 00000000 ____D () C:\Program Files (x86)\Free Word To PDF
    2015-01-15 17:30 - 2015-01-15 17:30 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
    2015-01-15 17:23 - 2015-01-17 08:20 - 00000000 ____D () C:\ProgramData\Mozilla
    2015-01-15 17:23 - 2015-01-15 17:23 - 00000000 ____D () C:\Users\Roy\AppData\Roaming\Mozilla
    2015-01-15 17:23 - 2015-01-15 17:23 - 00000000 ____D () C:\Users\Roy\AppData\Local\Mozilla
    2015-01-14 14:29 - 2014-12-19 06:26 - 00140800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
    2015-01-14 14:29 - 2014-12-12 02:04 - 00087040 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
    2015-01-14 14:29 - 2014-12-12 00:51 - 00075776 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ahcache.sys
    2015-01-14 14:29 - 2014-12-09 01:50 - 00225280 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
    2015-01-14 14:29 - 2014-12-08 19:42 - 00535640 _____ (Microsoft Corporation) C:\Windows\system32\wer.dll
    2015-01-14 14:29 - 2014-12-08 19:42 - 00531616 _____ (Microsoft Corporation) C:\Windows\system32\ci.dll
    2015-01-14 14:29 - 2014-12-08 19:42 - 00448792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wer.dll
    2015-01-14 14:29 - 2014-12-08 19:42 - 00413248 _____ (Microsoft Corporation) C:\Windows\system32\Faultrep.dll
    2015-01-14 14:29 - 2014-12-08 19:42 - 00372408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Faultrep.dll
    2015-01-14 14:29 - 2014-12-08 19:42 - 00108944 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll
    2015-01-14 14:29 - 2014-12-08 19:42 - 00038264 _____ (Microsoft Corporation) C:\Windows\system32\WerFaultSecure.exe
    2015-01-14 14:29 - 2014-12-08 19:42 - 00033584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WerFaultSecure.exe
    2015-01-14 14:29 - 2014-12-06 03:17 - 00360448 _____ (Microsoft Corporation) C:\Windows\system32\ncsi.dll
    2015-01-14 14:29 - 2014-12-06 01:41 - 00391680 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll
    2015-01-14 14:29 - 2014-12-06 01:35 - 00229888 _____ (Microsoft Corporation) C:\Windows\system32\AudioEndpointBuilder.dll
    2015-01-14 14:29 - 2014-10-29 04:00 - 00465320 _____ (Microsoft Corporation) C:\Windows\system32\WerFault.exe
    2015-01-14 14:29 - 2014-10-29 04:00 - 00139984 _____ (Microsoft Corporation) C:\Windows\system32\wermgr.exe
    2015-01-14 14:29 - 2014-10-29 03:52 - 00500016 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll
    2015-01-14 14:29 - 2014-10-29 03:52 - 00482872 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll
    2015-01-14 14:29 - 2014-10-29 03:52 - 00394120 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll
    2015-01-14 14:29 - 2014-10-29 03:52 - 00272248 _____ (Microsoft Corporation) C:\Windows\system32\audiodg.exe
    2015-01-14 14:29 - 2014-10-29 03:12 - 00413136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WerFault.exe
    2015-01-14 14:29 - 2014-10-29 03:12 - 00136296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wermgr.exe
    2015-01-14 14:29 - 2014-10-29 03:07 - 00424544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioEng.dll
    2015-01-14 14:29 - 2014-10-29 03:07 - 00370424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioSes.dll
    2015-01-14 14:29 - 2014-10-29 03:07 - 00344536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AUDIOKSE.dll
    2015-01-14 14:29 - 2014-10-29 02:44 - 00037888 _____ (Microsoft Corporation) C:\Windows\system32\werdiagcontroller.dll
    2015-01-14 14:29 - 2014-10-29 01:59 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\werdiagcontroller.dll
    2015-01-14 14:29 - 2014-10-29 01:24 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\nlaapi.dll
    2015-01-14 14:29 - 2014-10-29 01:02 - 00911360 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
    2015-01-14 14:29 - 2014-10-29 01:01 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll
    2015-01-09 21:03 - 2015-01-09 21:03 - 00000000 ____D () C:\Users\Roy\Documents\Choir Spring 2015
    2015-01-06 16:46 - 2015-01-15 08:40 - 00000000 ____D () C:\Users\Roy\Documents\Tony
    2015-01-06 10:16 - 2015-01-09 19:22 - 00001098 _____ () C:\Users\Roy\Sti_Trace.log
    2014-12-31 16:36 - 2010-05-12 16:09 - 00108032 _____ () C:\Windows\SysWOW64\ff_vfw.dll
    2014-12-31 16:35 - 2014-12-31 16:36 - 00000000 ____D () C:\Program Files (x86)\ffdshow
    2014-12-31 16:35 - 2014-12-31 16:35 - 00001096 _____ () C:\Users\Public\Desktop\Sothink Movie DVD Maker.lnk
    2014-12-31 16:35 - 2014-12-31 16:35 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sothink Movie DVD Maker
    2014-12-31 16:35 - 2014-12-31 16:35 - 00000000 ____D () C:\Program Files (x86)\Sothink Movie DVD Maker
    2014-12-31 16:35 - 2014-12-31 16:35 - 00000000 ____D () C:\Program Files (x86)\Haali
    2014-12-31 16:35 - 2014-12-31 16:35 - 00000000 ____D () C:\Program Files (x86)\AviSynth 2.5
    2014-12-31 16:35 - 2009-08-17 09:54 - 01184984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wvc1dmod.dll
    2014-12-31 16:35 - 2009-08-17 09:54 - 00438272 _____ (Gabest) C:\Windows\SysWOW64\Mpeg2DecFilter.ax
    2014-12-31 16:35 - 2009-08-17 09:54 - 00278528 _____ (Real Networks, Inc) C:\Windows\SysWOW64\pncrt.dll
    2014-12-31 16:35 - 2009-08-17 09:54 - 00217088 _____ (-) C:\Windows\SysWOW64\CoreFLACDecoder.ax
    2014-12-31 16:35 - 2009-04-28 13:44 - 00417792 _____ (Gabest) C:\Windows\SysWOW64\FLVSplitter.ax
    2014-12-31 16:35 - 2009-03-17 17:38 - 00070656 _____ () C:\Windows\SysWOW64\RLAPEDec.ax
    2014-12-31 16:22 - 2014-12-31 16:22 - 00000000 ____D () C:\Users\Roy\AppData\Roaming\HandBrake
    2014-12-31 16:21 - 2015-01-19 10:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Handbrake
    2014-12-31 16:12 - 2014-12-31 16:12 - 00000000 ____D () C:\Users\Roy\AppData\Roaming\Digiarty
    2014-12-31 15:46 - 2014-12-31 15:46 - 00000000 ____D () C:\Users\Roy\AppData\Local\Wondershare
    2014-12-31 09:06 - 2015-01-19 20:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Free YouTube Downloader
    2014-12-29 11:13 - 2014-12-29 11:13 - 00002204 _____ () C:\Users\Public\Desktop\Google Earth.lnk
    2014-12-29 11:13 - 2014-12-29 11:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth
    2014-12-29 10:55 - 2014-12-29 10:55 - 00000592 _____ () C:\Users\Public\Desktop\Train Simulator.lnk
    2014-12-29 10:55 - 2014-12-29 10:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Games
    2014-12-24 15:07 - 2014-12-24 15:07 - 00000000 ____D () C:\Users\Roy\AppData\Local\Open_Rails
    2014-12-23 21:01 - 2014-12-24 14:25 - 00000000 ____D () C:\Program Files (x86)\Microsoft Games
    2014-12-23 19:39 - 2014-12-23 19:39 - 00001010 _____ () C:\Users\Public\Desktop\Open Rails.lnk
    2014-12-23 19:39 - 2014-12-23 19:39 - 00000000 ____D () C:\Program Files (x86)\Open Rails
    2014-12-23 19:03 - 2014-12-23 19:03 - 00286720 _____ (Indigo Rose Corporation) C:\Windows\iun507.exe
    2014-12-23 19:03 - 2014-12-23 19:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\how in the world
    2014-12-22 19:22 - 2014-12-22 19:22 - 00000000 ____D () C:\Users\Roy\AppData\Local\AnyRail
    2014-12-22 19:22 - 2014-12-22 19:22 - 00000000 ____D () C:\ProgramData\DRail Modelspoor Software
    2014-12-22 19:21 - 2014-12-22 19:21 - 00000921 _____ () C:\Users\Public\Desktop\AnyRail 5.lnk
    2014-12-22 19:21 - 2014-12-22 19:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AnyRail5
    2014-12-22 19:21 - 2014-12-22 19:21 - 00000000 ____D () C:\Program Files (x86)\AnyRail5
    2014-12-22 10:36 - 2014-12-29 12:04 - 00000000 ____D () C:\Users\Roy\AppData\Roaming\Open Rails
    2014-12-22 10:35 - 2014-12-23 19:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Open Rails
    2014-12-22 10:35 - 2014-12-22 10:35 - 00000000 ____D () C:\Program Files (x86)\Microsoft XNA
    2014-12-22 09:53 - 2014-12-23 20:54 - 00000000 ____D () C:\Program Files\Microsoft Games
    2014-12-21 09:29 - 2014-12-21 09:29 - 00000091 _____ () C:\Users\Roy\AppData\Local\fusioncache.dat
    2014-12-20 15:35 - 2014-12-20 15:35 - 00872086 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
    2014-12-20 15:35 - 2014-12-20 15:35 - 00000000 ____D () C:\Windows\SysWOW64\URTTEMP

    ==================== One Month Modified Files and Folders =======

    (If an entry is included in the fixlist, the file\folder will be moved.)

    2015-01-19 21:25 - 2014-11-27 09:48 - 01185232 _____ () C:\Windows\WindowsUpdate.log
    2015-01-19 21:07 - 2014-12-01 16:02 - 00000918 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
    2015-01-19 21:02 - 2013-08-22 15:36 - 00000000 ____D () C:\Windows\system32\sru
    2015-01-19 20:45 - 2014-11-25 15:04 - 00003596 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-447272969-2236016177-1254936844-1001
    2015-01-19 20:40 - 2014-11-26 09:24 - 00000000 ____D () C:\Users\Roy\Documents\Computer
    2015-01-19 20:28 - 2014-03-18 10:03 - 00876144 _____ () C:\Windows\system32\PerfStringBackup.INI
    2015-01-19 20:25 - 2014-12-01 16:02 - 00000914 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
    2015-01-19 20:24 - 2013-08-22 14:45 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
    2015-01-19 19:47 - 2014-11-25 15:11 - 00003934 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{CA0F21F2-9223-4947-A9E2-E02AE76FC9A3}
    2015-01-19 18:48 - 2013-08-22 15:36 - 00000000 ____D () C:\Windows\LiveKernelReports
    2015-01-19 15:57 - 2013-08-22 13:25 - 00000194 _____ () C:\Windows\win.ini
    2015-01-19 12:13 - 2013-08-22 15:36 - 00000000 ____D () C:\Windows\AppReadiness
    2015-01-19 12:08 - 2014-11-25 14:58 - 00000000 ____D () C:\Users\Roy\AppData\Local\Packages
    2015-01-19 11:22 - 2014-11-26 11:04 - 00000000 ____D () C:\Program Files (x86)\LibreOffice 4
    2015-01-19 11:12 - 2014-11-30 20:48 - 00000000 ___RD () C:\Users\Roy\OneDrive.old
    2015-01-19 11:12 - 2014-11-25 14:57 - 00000000 ____D () C:\Users\Roy
    2015-01-19 10:20 - 2014-11-28 09:40 - 00000000 ____D () C:\Users\Roy\Documents\Homegroup
    2015-01-19 09:01 - 2014-11-30 19:36 - 00000000 ____D () C:\Users\Roy\AppData\Local\CrashDumps
    2015-01-19 08:21 - 2013-08-22 15:20 - 00000000 ____D () C:\Windows\CbsTemp
    2015-01-18 18:27 - 2014-09-14 14:43 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
    2015-01-18 09:46 - 2014-11-26 09:19 - 00000000 ____D () C:\Users\Roy\Documents\Railway
    2015-01-17 17:54 - 2014-12-02 20:02 - 00003478 _____ () C:\Windows\System32\Tasks\Sync-Toy Backup
    2015-01-17 17:37 - 2014-09-14 14:42 - 00000000 ____D () C:\ProgramData\Qualcomm Atheros
    2015-01-17 17:36 - 2014-09-14 14:43 - 00000000 ____D () C:\Program Files (x86)\Qualcomm Atheros
    2015-01-17 17:07 - 2014-11-25 15:14 - 00000000 ____D () C:\Users\Roy\AppData\Local\Google
    2015-01-17 17:07 - 2014-11-25 15:14 - 00000000 ____D () C:\Program Files (x86)\Google
    2015-01-17 07:35 - 2013-08-22 15:36 - 00000000 ____D () C:\Windows\system32\GroupPolicy
    2015-01-15 15:54 - 2014-11-26 09:00 - 00729088 ___SH () C:\Users\Roy\Desktop\Thumbs.db
    2015-01-14 19:42 - 2013-08-22 13:25 - 00262144 ___SH () C:\Windows\system32\config\BBI
    2015-01-14 15:16 - 2014-11-27 09:47 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Trusteer Endpoint Protection
    2015-01-14 15:15 - 2013-08-22 13:25 - 00262144 ___SH () C:\Windows\system32\config\ELAM
    2015-01-14 09:20 - 2014-11-26 09:21 - 00000000 ____D () C:\Users\Roy\Documents\Walking
    2015-01-12 15:14 - 2014-11-26 09:23 - 00000000 ____D () C:\Users\Roy\Documents\Church
    2015-01-10 08:58 - 2014-11-26 09:23 - 00000000 ____D () C:\Users\Roy\Documents\Art
    2015-01-09 19:13 - 2014-11-26 09:27 - 00491008 ___SH () C:\Users\Roy\Documents\Thumbs.db
    2015-01-08 09:02 - 2014-11-26 09:25 - 00000000 ____D () C:\Users\Roy\Documents\Letters
    2015-01-06 00:08 - 2014-07-17 08:17 - 00714720 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
    2015-01-06 00:08 - 2014-07-17 08:17 - 00106976 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
    2015-01-05 12:12 - 2014-12-03 10:31 - 00000000 ___RD () C:\Users\Roy\Documents\Photos
    2014-12-24 12:34 - 2014-12-17 19:49 - 00000000 _____ () C:\Users\Roy\AppData\Roaming\FileOut.cns
    2014-12-24 12:34 - 2014-12-17 19:49 - 00000000 _____ () C:\Users\Roy\AppData\Roaming\FileIn.cns
    2014-12-24 09:21 - 2014-11-26 09:02 - 00000000 ____D () C:\Users\Roy\Documents\Accounts
    2014-12-23 20:42 - 2014-12-16 14:09 - 00000000 ____D () C:\Program Files (x86)\CDBurnerXP
    2014-12-23 18:36 - 2014-12-17 20:02 - 00000000 _____ () C:\FileOut.Cns
    2014-12-23 18:36 - 2014-12-17 20:02 - 00000000 _____ () C:\FileIn.Cns
    2014-12-22 17:52 - 2014-11-27 09:48 - 00535576 _____ (IBM Corp.) C:\Windows\system32\Drivers\RapportKE64.sys
    2014-12-22 17:52 - 2014-11-27 09:48 - 00290520 _____ (IBM Corp.) C:\Windows\system32\Drivers\RapportHades64.sys
    2014-12-20 15:35 - 2013-08-22 15:36 - 00000000 ____D () C:\Windows\Registration

    ==================== Files in the root of some directories =======
    2014-12-17 19:49 - 2014-12-24 12:34 - 0000000 _____ () C:\Users\Roy\AppData\Roaming\FileIn.cns
    2014-12-17 19:49 - 2014-12-24 12:34 - 0000000 _____ () C:\Users\Roy\AppData\Roaming\FileOut.cns
    2014-12-21 09:29 - 2014-12-21 09:29 - 0000091 _____ () C:\Users\Roy\AppData\Local\fusioncache.dat
    2014-12-01 20:13 - 2014-12-01 20:13 - 0000017 _____ () C:\Users\Roy\AppData\Local\resmon.resmoncfg
    2014-09-14 14:55 - 2014-09-14 14:55 - 0000000 ____H () C:\ProgramData\DP45977C.lfl

    Some content of TEMP:
    ====================
    C:\Users\Roy\AppData\Local\Temp\Quarantine.exe
    C:\Users\Roy\AppData\Local\Temp\sqlite3.dll


    ==================== Bamital & volsnap Check =================

    (There is no automatic fix for files that do not pass verification.)

    C:\Windows\System32\winlogon.exe => File is digitally signed
    C:\Windows\System32\wininit.exe => File is digitally signed
    C:\Windows\explorer.exe => File is digitally signed
    C:\Windows\SysWOW64\explorer.exe => File is digitally signed
    C:\Windows\System32\svchost.exe => File is digitally signed
    C:\Windows\SysWOW64\svchost.exe => File is digitally signed
    C:\Windows\System32\services.exe => File is digitally signed
    C:\Windows\System32\User32.dll => File is digitally signed
    C:\Windows\SysWOW64\User32.dll => File is digitally signed
    C:\Windows\System32\userinit.exe => File is digitally signed
    C:\Windows\SysWOW64\userinit.exe => File is digitally signed
    C:\Windows\System32\rpcss.dll => File is digitally signed
    C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


    LastRegBack: 2015-01-19 16:22

    ==================== End Of Log ============================

    Additional scan result of Farbar Recovery Scan Tool (x64) Version: 19-01-2015
    Ran by Roy at 2015-01-19 21:32:22
    Running from C:\Users\Roy\Downloads
    Boot Mode: Normal
    ==========================================================


    ==================== Security Center ========================

    (If an entry is included in the fixlist, it will be removed.)

    AV: Norton Internet Security (Enabled - Up to date) {D87FA2C0-F526-77B1-D6EC-0EDF3936CEDB}
    AS: Norton Internet Security (Enabled - Up to date) {631E4324-D31C-783F-EC5C-35AD42B18466}
    FW: Norton Internet Security (Enabled) {E04423E5-BF49-76E9-FDB3-A7EAC7E589A0}

    ==================== Installed Programs ======================

    (Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

    ABBYY FineReader 9.0 Sprint (HKLM-x32\...\ABBYY FineReader 9.0 Sprint) (Version: 9.01.513.58212 - ABBYY)
    ABBYY FineReader 9.0 Sprint (x32 Version: 9.01.513.58212 - ABBYY) Hidden
    Acer Video Player (HKLM-x32\...\{B6846F20-4821-11E3-8F96-0800200C9A66}) (Version: 1.00.2005.0 - Acer Incorporated)
    Adobe Acrobat 4.0 (HKLM-x32\...\Adobe Acrobat 4.0) (Version: - )
    Adobe Reader XI (11.0.10) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
    AnyRail5 (HKLM-x32\...\AnyRail5 5.18.1) (Version: 5.18.1 - DRail Modelspoor Software)
    AnyRail5 (x32 Version: 5.18.1 - DRail Modelspoor Software) Hidden
    AOP Framework (HKLM-x32\...\{4A37A114-702F-4055-A4B6-16571D4A5353}) (Version: 3.03.2001.0 - Acer Incorporated)
    Apowersoft Free Audio Recorder V2.3.2 (HKLM-x32\...\{E35F91E4-C68C-43E8-BE90-35CDEE4E5730}_is1) (Version: 2.3.2 - APOWERSOFT LIMITED)
    ArcSoft MediaImpression 2 (HKLM-x32\...\{FB46F473-333E-4A06-A777-31C54188593E}) (Version: 2.0.14.672 - ArcSoft)
    ArcSoft Scan-n-Stitch Deluxe (HKLM-x32\...\{FF8455A9-21E8-457D-AC64-510A705D53B3}) (Version: 1.1.2.27 - ArcSoft)
    AviSynth 2.5 (HKLM-x32\...\AviSynth) (Version: - )
    Canon Easy-PhotoPrint EX (HKLM-x32\...\Easy-PhotoPrint EX) (Version: - )
    Canon iP4800 series Printer Driver (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_iP4800_series) (Version: - )
    Canon My Printer (HKLM-x32\...\CanonMyPrinter) (Version: - )
    CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.4.5143 - CDBurnerXP)
    Clean Master (HKLM-x32\...\Clean Master) (Version: 1.0 - Cheetah Mobile)
    CyberLink Power Media Player 12 (HKLM-x32\...\InstallShield_{B46BEA36-0B71-4A4E-AE41-87241643FA0A}) (Version: 12.0.3.4218 - CyberLink Corp.)
    EPSON Perfection V33/V330 Manual (HKLM-x32\...\EPSON Perfection V33_V330 Manual) (Version: - )
    EPSON Scan (HKLM-x32\...\EPSON Scanner) (Version: - Seiko Epson Corporation)
    ffdshow v1.1.3572 [2010-09-13] (HKLM-x32\...\ffdshow_is1) (Version: 1.1.3572.0 - )
    Free Word To PDF (HKLM-x32\...\Free Word To PDF_is1) (Version: - Free Word To PDF)
    Free YouTube Downloader 4.0.305 (HKLM-x32\...\{A7E19604-93AF-4611-8C9F-CE509C2B286F}_is1) (Version: - HOW Inc.)
    Google Chrome (HKLM-x32\...\Google Chrome) (Version: 39.0.2171.99 - Google Inc.)
    Google Earth (HKLM-x32\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
    Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
    Haali Media Splitter (HKLM-x32\...\HaaliMkx) (Version: - )
    Hotkey Utility (HKLM-x32\...\{A6DC88AD-501A-44BC-884D-57435F972E2C}) (Version: 3.00.8104 - Packard Bell)
    Identity Card (HKLM-x32\...\{3D9CB654-99AD-4301-89C6-0D12A790767C}) (Version: 2.00.8101 - Packard Bell)
    Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1011 - Intel Corporation)
    Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.15.1730 - Intel Corporation)
    Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3496 - Intel Corporation)
    LibreOffice 4.3.5.2 (HKLM-x32\...\{1D4E90DA-C33C-40ED-BA00-75F6E6DF9CB0}) (Version: 4.3.5.2 - The Document Foundation)
    Live Updater (HKLM-x32\...\{EE26E302-876A-48D9-9058-3129E5B99999}) (Version: 2.00.8100 - Packard Bell)
    Microsoft .NET Framework 1.1 (HKLM-x32\...\{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}) (Version: 1.1.4322 - Microsoft)
    Microsoft Money 5.0 (HKLM-x32\...\MSMONEYV50) (Version: - )
    Microsoft Office 97, Professional Edition (HKLM-x32\...\Office8.0) (Version: - )
    Microsoft Sync Framework 2.0 Core Components (x64) ENU (HKLM\...\{8CCBEC22-D2DB-4DC9-A58A-E1A1F3A38C8A}) (Version: 2.0.1578.0 - Microsoft Corporation)
    Microsoft Sync Framework 2.0 Provider Services (x64) ENU (HKLM\...\{03AC245F-4C64-425C-89CF-7783C1D3AB2C}) (Version: 2.0.1578.0 - Microsoft Corporation)
    Microsoft Train Simulator (HKLM-x32\...\Train Simulator 1.0) (Version: - )
    Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
    Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
    Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
    Microsoft XNA Framework Redistributable 3.1 (HKLM-x32\...\{19BFDA5D-1FE2-4F25-97F9-1A79DD04EE20}) (Version: 3.1.10527.0 - Microsoft Corporation)
    Norton Internet Security (HKLM-x32\...\NIS) (Version: 21.6.0.32 - Symantec Corporation)
    Open Rails version pre-v1.0 (HKLM-x32\...\{94E15E08-869D-4B69-B8D7-8C82075CB51C} ; Generat~67F3DAC8_is1) (Version: pre-v1.0 - Open Rails)
    Packard Bell Explorer Agent (HKLM\...\{4D0F42CF-1693-43D9-BDC8-19141D023EE0}) (Version: 2.00.3000 - Packard Bell)
    Packard Bell Quick Access (HKLM\...\{C1FA525F-D701-4B31-9D32-504FC0CF0B98}) (Version: 1.01.3016.0 - Packard Bell)
    Packard Bell Recovery Management (HKLM\...\{07F2005A-8CAC-4A4B-83A2-DA98A722CA61}) (Version: 6.00.8107 - Packard Bell)
    Packard Bell User Experience Improvement Program App Monitor Plugin (HKLM\...\{978724F6-1863-4DD5-9E66-FB77F5AB5613}) (Version: 1.02.3004 - Packard Bell)
    Packard Bell User Experience Improvement Program Framework (HKLM\...\{12A718F2-2357-4D41-9E1F-18583A4745F7}) (Version: 1.02.3004 - Packard Bell)
    PowerISO (HKLM-x32\...\PowerISO) (Version: 6.1 - Power Software Ltd)
    Qualcomm Atheros Bluetooth Suite (64) (HKLM\...\{A84A4FB1-D703-48DB-89E0-68B6499D2801}) (Version: 8.0.1.314 - Qualcomm Atheros Communications)
    Rapport (x32 Version: 3.5.1404.61 - Trusteer) Hidden
    Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.3.3.34 - Realtek Semiconductor Corp.)
    Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.18.621.2013 - Realtek)
    Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7023 - Realtek Semiconductor Corp.)
    ReNamer (HKLM-x32\...\ReNamer_is1) (Version: 6.1.0.0 - Denis Kozlov)
    Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
    SD40-2_Content_Update (HKLM-x32\...\{BF7C1B99-A250-45EF-B186-0C33B7308F95}) (Version: 1.00.0000 - Microsoft)
    Should I Remove It (HKU\S-1-5-21-447272969-2236016177-1254936844-1001\...\Should I Remove It 1.0.4) (Version: 1.0.4 - Reason Software Company Inc.)
    Should I Remove It (x32 Version: 1.0.4 - Reason Software Company Inc.) Hidden
    Sothink Movie DVD Maker (HKLM-x32\...\{4F94119D-1B71-400e-9F04-B4E5CEAE71F8}_is1) (Version: 3.8 - SourceTec Software Co., LTD)
    SyncToy 2.1 (x64) (HKLM\...\{88DAAF05-5A72-46D2-A7C5-C3759697E943}) (Version: 2.1.0 - Microsoft)
    Train Sim Interface Quick Fix (HKLM-x32\...\Product_Name) (Version: - )
    Trusteer Endpoint Protection (HKLM-x32\...\Rapport_msi) (Version: 3.5.1404.61 - Trusteer)

    ==================== Custom CLSID (selected items): ==========================

    (If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

    CustomCLSID: HKU\S-1-5-21-447272969-2236016177-1254936844-1001_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\Windows\system32\igfxEM.exe (Intel Corporation)

    ==================== Restore Points =========================

    05-01-2015 12:02:21 Installed Rapport
    14-01-2015 15:16:07 Installed Rapport
    15-01-2015 17:32:05 Revo Uninstaller's restore point - Google Chrome
    16-01-2015 21:45:49 Revo Uninstaller's restore point - Mozilla Firefox 35.0 (x86 en-US)
    19-01-2015 11:19:03 Installed LibreOffice 4.3.5.2

    ==================== Hosts content: ==========================

    (If needed Hosts: directive could be included in the fixlist to reset Hosts.)

    2013-08-22 13:25 - 2013-08-22 13:25 - 00000824 ____N C:\Windows\system32\Drivers\etc\hosts

    ==================== Scheduled Tasks (whitelisted) =============

    (If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

    Task: {01A4BC1C-8D50-4BB4-B7BF-1B912AB9FF21} - System32\Tasks\ALUAgent => C:\Program Files (x86)\Packard Bell\Live Updater\liveupdater_agent.exe [2013-01-22] ()
    Task: {079CD7ED-CBD1-40B1-844D-939E5DF4D44D} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-12-01] (Google Inc.)
    Task: {18E18DB1-54B8-4FB3-99CC-08F491C0E317} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows\system32\MRT.exe [2014-12-11] (Microsoft Corporation)
    Task: {19C778C9-0A7C-494B-A222-6916E3B5BCB3} - System32\Tasks\UbtFrameworkService => C:\Program Files\Packard Bell\User Experience Improvement Program\Framework\TriggerFramework.exe [2014-03-12] (TODO: <Company name>)
    Task: {21BA7ED7-5CA7-41EF-8085-3E33C62F851C} - System32\Tasks\Norton Internet Security\Norton Error Processor => C:\Program Files (x86)\Norton Internet Security\Engine\21.6.0.32\SymErr.exe [2014-01-30] (Symantec Corporation)
    Task: {35467A41-C40D-438E-A6D1-DE536BDBD2C6} - System32\Tasks\Quick Access => C:\Program Files\Packard Bell\Packard Bell Quick Access\QALauncher.exe [2014-06-26] (Acer Incorporate)
    Task: {374BAD0D-EC51-4759-BAA3-7342AB05FE88} - System32\Tasks\AviatorUpdateTask => Wscript.exe "C:\Program Files (x86)\WhiteHat\Aviator\Update\BatchLauncher.vbs" "C:\Program Files (x86)\WhiteHat\Aviator\Update\AviatorAutoUpdate.exe"
    Task: {3B1A119E-43ED-4414-9922-958F655DD78C} - System32\Tasks\Norton WSC Integration => C:\Program Files (x86)\Norton Internet Security\Engine\21.6.0.32\WSCStub.exe [2014-09-21] (Symantec Corporation)
    Task: {457DDC1E-E6B7-41D3-B47C-E136730BA66C} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-12-01] (Google Inc.)
    Task: {64178927-F49B-40FD-AC82-A7DC71CFB34C} - System32\Tasks\Norton Internet Security\Norton Error Analyzer => C:\Program Files (x86)\Norton Internet Security\Engine\21.6.0.32\SymErr.exe [2014-01-30] (Symantec Corporation)
    Task: {780931AB-1936-44C6-892C-C96F9F891B34} - System32\Tasks\Hotkey Utility => C:\Program Files (x86)\Packard Bell\Hotkey Utility\HotkeyUtility.exe [2014-03-03] (Acer Incorporated)
    Task: {893C0655-33E2-4947-9CB3-34526A73D3DC} - System32\Tasks\Sync-Toy Backup => C:\Program Files\SyncToy 2.1\SyncToyCmd.exe [2009-10-19] (Microsoft Corporation)
    Task: {B2E55DEF-A345-4843-BE63-F535EED05B79} - System32\Tasks\ALU => C:\Program Files (x86)\Packard Bell\Live Updater\updater.exe [2013-07-08] ()
    Task: {E77DDC40-3CF2-4A04-A5F7-19DC1DC404B8} - System32\Tasks\Quick Access Quick Launcher => C:\Program Files\Packard Bell\Packard Bell Quick Access\QALauncher.exe [2014-06-26] (Acer Incorporate)
    Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

    ==================== Loaded Modules (whitelisted) =============

    1997-08-01 00:00 - 1997-08-01 00:00 - 00051984 _____ () C:\Program Files (x86)\Microsoft Office\Office\OSA.EXE
    2015-01-19 12:08 - 2015-01-19 12:08 - 00592896 _____ () C:\Program Files\WindowsApps\64655SofaScore.LiveScoreSofaScore_1.7.1.0_neutral__38dz11hfmf1km\Sofascore.W8.exe
    2014-03-23 16:04 - 2014-03-23 16:04 - 00557056 _____ () C:\Program Files (x86)\Trusteer\Rapport\bin\js32.dll
    1997-08-01 00:00 - 1997-08-01 00:00 - 03782416 _____ () C:\Program Files (x86)\Microsoft Office\Office\MSO97.DLL
    2014-11-25 15:01 - 2014-11-25 15:01 - 00015616 _____ () C:\Windows\assembly\GAC_MSIL\MyService\1.0.0.1__2dfa3f50f0bed57d\MyService.dll
    2014-11-17 10:57 - 2014-11-17 10:57 - 00013568 _____ () C:\Program Files (x86)\Acer\AOP Framework\ServiceInterface.dll
    2014-11-17 10:53 - 2014-11-17 10:53 - 00279296 _____ () C:\Program Files (x86)\Acer\AOP Framework\libcurl.dll
    2014-09-14 14:54 - 2013-09-16 04:19 - 01242584 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll
    2015-01-19 16:26 - 2015-01-19 16:26 - 03530752 _____ () C:\Windows\assembly\NativeImages_v4.0.30319_32\Windows.UI.Xaml\0b2afd93fc0545b7b94339e8a4a7af97\Windows.UI.Xaml.ni.dll
    2015-01-19 16:26 - 2015-01-19 16:26 - 01131008 _____ () C:\Windows\assembly\NativeImages_v4.0.30319_32\Windows.App640a3541#\72dff8d45b73e9b02b3838d29765607a\Windows.ApplicationModel.ni.dll
    2015-01-19 16:26 - 2015-01-19 16:26 - 00960000 _____ () C:\Windows\assembly\NativeImages_v4.0.30319_32\Windows.UI\8ddd8ad15fe3fb05a871ef0115fb84e2\Windows.UI.ni.dll
    2015-01-19 16:26 - 2015-01-19 16:26 - 00228864 _____ () C:\Windows\assembly\NativeImages_v4.0.30319_32\Windows.Foundation\16c3eb7650767d95d002c998d0c73eb5\Windows.Foundation.ni.dll
    2015-01-19 16:26 - 2015-01-19 16:26 - 00808448 _____ () C:\Windows\assembly\NativeImages_v4.0.30319_32\Windows.Storage\7abff64c7c1ea1fae5bd170c8238b73e\Windows.Storage.ni.dll
    2015-01-19 16:26 - 2015-01-19 16:26 - 00770560 _____ () C:\Windows\assembly\NativeImages_v4.0.30319_32\Windows.Media\5c5cfababe2d392b06fa79f0052c0168\Windows.Media.ni.dll
    2015-01-19 16:26 - 2015-01-19 16:26 - 00133120 _____ () C:\Windows\assembly\NativeImages_v4.0.30319_32\Windows.System\c639835fe3da556a2cbe2e03540996c0\Windows.System.ni.dll
    2015-01-17 17:07 - 2015-01-09 00:35 - 01077064 _____ () C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.99\libglesv2.dll
    2015-01-17 17:07 - 2015-01-09 00:35 - 00211272 _____ () C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.99\libegl.dll
    2015-01-17 17:07 - 2015-01-09 00:35 - 09009480 _____ () C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.99\pdf.dll
    2015-01-17 17:07 - 2015-01-09 00:35 - 01677128 _____ () C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.99\ffmpegsumo.dll
    2015-01-17 17:07 - 2015-01-09 00:35 - 14913352 _____ () C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.99\PepperFlash\pepflashplayer.dll

    ==================== Alternate Data Streams (whitelisted) =========

    (If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

    AlternateDataStreams: C:\Users\Roy\OneDrive:ms-properties

    ==================== Safe Mode (whitelisted) ===================

    (If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


    ==================== EXE Association (whitelisted) =============

    (If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


    ==================== MSCONFIG/TASK MANAGER disabled items =========

    (Currently there is no automatic fix for this section.)

    HKLM\...\StartupApproved\Run: => "CanonMyPrinter"
    HKLM\...\StartupApproved\Run: => "RTHDVCPL"
    HKLM\...\StartupApproved\Run32: => "Adobe ARM"
    HKLM\...\StartupApproved\Run32: => "ArcSoft Connection Service"

    ========================= Accounts: ==========================

    Administrator (S-1-5-21-447272969-2236016177-1254936844-500 - Administrator - Disabled)
    ASPNET (S-1-5-21-447272969-2236016177-1254936844-1005 - Limited - Enabled)
    Guest (S-1-5-21-447272969-2236016177-1254936844-501 - Limited - Disabled)
    Roy (S-1-5-21-447272969-2236016177-1254936844-1001 - Administrator - Enabled) => C:\Users\Roy

    ==================== Faulty Device Manager Devices =============


    ==================== Event log errors: =========================

    Application errors:
    ==================
    Error: (01/19/2015 08:55:55 PM) (Source: Microsoft-Windows-AppModel-State) (EventID: 10) (User: OUR-COMPUTER)
    Description: BrowserChoice_cw5n1h2txyewy1009

    Error: (01/19/2015 08:25:08 PM) (Source: Microsoft-Windows-AppModel-State) (EventID: 10) (User: OUR-COMPUTER)
    Description: BrowserChoice_cw5n1h2txyewy1009


    System errors:
    =============
    Error: (01/19/2015 08:21:11 PM) (Source: DCOM) (EventID: 10010) (User: OUR-COMPUTER)
    Description: {9AA46009-3CE0-458A-A354-715610A075E6}

    Error: (01/19/2015 08:20:41 PM) (Source: DCOM) (EventID: 10010) (User: OUR-COMPUTER)
    Description: {9AA46009-3CE0-458A-A354-715610A075E6}

    Error: (01/19/2015 08:20:10 PM) (Source: DCOM) (EventID: 10010) (User: OUR-COMPUTER)
    Description: {9AA46009-3CE0-458A-A354-715610A075E6}

    Error: (01/19/2015 08:19:40 PM) (Source: DCOM) (EventID: 10010) (User: OUR-COMPUTER)
    Description: {9AA46009-3CE0-458A-A354-715610A075E6}

    Error: (01/19/2015 08:19:10 PM) (Source: DCOM) (EventID: 10010) (User: OUR-COMPUTER)
    Description: {9AA46009-3CE0-458A-A354-715610A075E6}

    Error: (01/19/2015 08:18:40 PM) (Source: DCOM) (EventID: 10010) (User: OUR-COMPUTER)
    Description: {9AA46009-3CE0-458A-A354-715610A075E6}


    Microsoft Office Sessions:
    =========================
    Error: (01/19/2015 08:55:55 PM) (Source: Microsoft-Windows-AppModel-State) (EventID: 10) (User: OUR-COMPUTER)
    Description: BrowserChoice_cw5n1h2txyewy1009

    Error: (01/19/2015 08:25:08 PM) (Source: Microsoft-Windows-AppModel-State) (EventID: 10) (User: OUR-COMPUTER)
    Description: BrowserChoice_cw5n1h2txyewy1009


    ==================== Memory info ===========================

    Processor: Intel(R) Core(TM) i5-4460 CPU @ 3.20GHz
    Percentage of memory in use: 26%
    Total physical RAM: 8001.43 MB
    Available physical RAM: 5917.04 MB
    Total Pagefile: 9281.43 MB
    Available Pagefile: 6943.8 MB
    Total Virtual: 131072 MB
    Available Virtual: 131071.8 MB

    ==================== Drives ================================

    Drive c: (Packard Bell) (Fixed) (Total:458.05 GB) (Free:400.78 GB) NTFS
    Drive d: (DATA) (Fixed) (Total:458.05 GB) (Free:455.21 GB) NTFS
    Drive f: (REMOTE HARD DRIVE) (Fixed) (Total:111.79 GB) (Free:85.75 GB) NTFS

    ==================== MBR & Partition Table ==================

    ========================================================
    Disk: 0 (Size: 931.5 GB) (Disk ID: 941D88DE)

    Partition: GPT Partition Type.

    ========================================================
    Disk: 1 (MBR Code: Windows 7 or 8) (Size: 111.8 GB) (Disk ID: 5619E95E)
    Partition 1: (Not Active) - (Size=111.8 GB) - (Type=07 NTFS)

    ==================== End Of Log ============================

    I have not a clue what the above means but will await your further instructions.
     
  10. kevinf80

    kevinf80 Malware Specialist

    Joined:
    Mar 21, 2006
    Messages:
    11,383
    First Name:
    Kevin
    Download attached fixlist.txt file (end of reply) and save it to the Desktop, or the folder you saved FRST into.
    NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work.

    Run FRST and press the Fix button just once and wait.
    The tool will make a log on the Desktop (Fixlog.txt) or the folder it was ran from. Please post it to your reply.

    Next,

    Download Malwarebytes Anti-Malware to your desktop.
    • Double-click mbam-setup and follow the prompts to install the program.
    • At the end, be sure a checkmark is placed next to the following:
    • Launch Malwarebytes Anti-Malware
    • A 14 day trial of the Premium features is pre-selected. You may deselect this if you wish, and it will not diminish the scanning and removal capabilities of the program.
    • Click Finish.
    • On the Dashboard, click the 'Update Now >>' link
    • After the update completes Select > Settings > Detection and Protection > Enable Scan for rootkit and Under Non Malware Protection set both PUP and PUM to Treat detections as malware.
    • Now select > Scan > Threat scan > Scan now
    • When the scan is complete, if there have been detections, click Apply Actions to allow MBAM to clean what was detected.
    • In most cases, a restart will be required.
    • Wait for the prompt to restart the computer to appear, then click on Yes.

    When the scan is completed from the main GUI click on History > Application Logs. Find your scan log, the date when run will identify it. Checkmark "select" box > then hit the "view" button. The history log window will open. At the bottom of that window are two options, "Copy to clipboard" and "Export"
    Select > "Copy to clipboard" that copies the full log to the windows clipboard, so at your reply you right click into the text field and select "Paste" the log is pasted (copied) to your reply.

    Or select "Export" you are given the option to export as a Text file (*.txt) or XML file (*.xml) Choose text file, save the exported file to a place of your choice. That file can be attached to your reply...

    Next,

    Download Microsoft's " Malicious Software Removal Tool" and save direct to the desktop
    Ensure to get the correct version for your system....
    32 Bit version:
    https://www.microsoft.com/downloads...E0-E72D-4F54-9AB3-75B8EB148356&displaylang=en
    64 Bit version:
    https://www.microsoft.com/downloads...DE-367F-495E-94E7-6349F4EFFC74&displaylang=en

    Right click on the Tool, select “Run as Administrator” the tool will expand to the options Window
    In the "Scan Type" window, select Quick Scan
    Perform a scan and Click Finish when the scan is done.
    Retrieve the MSRT log as follows, and post it in your next reply:

    1) Select the Windows key and R key together to open the "Run" function
    2) Type or Copy/Paste the following command to the "Run Line" and Press Enter:

    notepad c:\windows\debug\mrt.log

    Let me see those logs, also give an update on any remaining issues or concerns....

    Kevin..
     

    Attached Files:

  11. RoyP

    RoyP Thread Starter

    Joined:
    Sep 23, 2012
    Messages:
    270
    Thanks for all of that, I will sleep on it and come back tomorrow sometime.
     
  12. kevinf80

    kevinf80 Malware Specialist

    Joined:
    Mar 21, 2006
    Messages:
    11,383
    First Name:
    Kevin
    Thanks for the update, catch up later....
     
  13. RoyP

    RoyP Thread Starter

    Joined:
    Sep 23, 2012
    Messages:
    270
    All seem fine now.

    Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 19-01-2015
    Ran by Roy at 2015-01-20 15:35:59 Run:1
    Running from C:\Users\Roy\Desktop
    Loaded Profiles: Roy (Available profiles: Roy)
    Boot Mode: Normal
    ==============================================

    Content of fixlist:
    *****************
    start
    GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
    CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
    CHR HKLM\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - No Path
    CHR HKLM-x32\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - No Path
    C:\Users\Roy\AppData\Local\Temp\Quarantine.exe
    C:\Users\Roy\AppData\Local\Temp\sqlite3.dll
    Emptytemp:
    end



    *****************

    C:\Windows\system32\GroupPolicy\Machine => Moved successfully.
    C:\Windows\system32\GroupPolicy\GPT.ini => Moved successfully.
    "HKLM\SOFTWARE\Policies\Google" => Key deleted successfully.
    "HKLM\SOFTWARE\Google\Chrome\Extensions\iikflkcanblccfahdhdonehdalibjnif" => Key deleted successfully.
    "HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\iikflkcanblccfahdhdonehdalibjnif" => Key deleted successfully.
    "C:\Users\Roy\AppData\Local\Temp\Quarantine.exe" => File/Directory not found.
    "C:\Users\Roy\AppData\Local\Temp\sqlite3.dll" => File/Directory not found.
    EmptyTemp: => Removed 313.7 MB temporary data.


    The system needed a reboot.

    ==== End of Fixlog 15:36:20 ====

    Malwarebytes Anti-Malware
    www.malwarebytes.org


    Update, 20/01/2015 08:55:11, SYSTEM, OUR-COMPUTER, Manual, Remediation Database, 2013.10.16.1, 2014.12.6.1,
    Update, 20/01/2015 08:55:11, SYSTEM, OUR-COMPUTER, Manual, Rootkit Database, 2014.11.18.1, 2015.1.14.1,
    Update, 20/01/2015 08:55:20, SYSTEM, OUR-COMPUTER, Manual, Malware Database, 2014.11.20.6, 2015.1.20.3,
    Update, 20/01/2015 15:39:56, SYSTEM, OUR-COMPUTER, Manual, Malware Database, 2015.1.20.3, 2015.1.20.6,
    Scan, 20/01/2015 15:51:29, SYSTEM, OUR-COMPUTER, Manual, Start:20/01/2015 15:42:42, Duration:7 min 5 sec, Threat Scan, Completed, 0 Malware Detections, 4 Non-Malware Detections,

    (end)

    Microsoft Windows Malicious Software Removal Tool v5.20, January 2015 (build 5.20.11000.0)
    Started On Tue Jan 20 08:48:23 2015

    Engine: 1.1.11302.0
    Signatures: 1.191.1276.0
    Microsoft Windows Malicious Software Removal Tool Finished On Tue Jan 20 08:48:42 2015


    Return code: 0 (0x0)

    ---------------------------------------------------------------------------------------
    Microsoft Windows Malicious Software Removal Tool v5.20, January 2015 (build 5.20.11000.0)
    Started On Tue Jan 20 16:08:48 2015

    Engine: 1.1.11302.0
    Signatures: 1.191.1276.0

    Results Summary:
    ----------------
    No infection found.
    Microsoft Windows Malicious Software Removal Tool Finished On Tue Jan 20 16:10:57 2015


    Return code: 0 (0x0)

    Thanks so much for your time and clear instructions, much appreciated, any suggestions of how to stop this happening again?
     
  14. kevinf80

    kevinf80 Malware Specialist

    Joined:
    Mar 21, 2006
    Messages:
    11,383
    First Name:
    Kevin
    If all is well run the following to clean up....

    Download "Delfix by Xplode" and save it to your desktop.

    Or use the following if first link is down:

    "Delfix link mirror"

    Double Click to start the program. If you are using Vista or higher, please right-click and choose run as administrator

    Make Sure the following items are checked:


    • Activate UAC
    • Remove disinfection tools
    • Create registry backup
    • Purge System Restore
    • Reset system settings

    Now click on "Run" and wait patiently until the tool has completed.

    The tool will create a log when it has completed. We don't need you to post this.

    Part of the routine will be to create a registry back up with ERUNT, the back up will be created here:

    C:\Windows\ERUNT

    When all is known to be well with your system you can delete that back up folder if you consider it as not needed...

    Any remnant files/logs from tools we have used can be deleted…

    Next,

    Read the following link to fully understand PC security and best practices, you may find it useful....

    http://www.bleepingcomputer.com/for...curity-questions-best-practices/#entry2316629

    If no remaining issues or concerns hit the "Mark Solved" tab at the top of the thread...

    Thanks,

    Kevin..
     
  15. RoyP

    RoyP Thread Starter

    Joined:
    Sep 23, 2012
    Messages:
    270
    All up and running fine, many thanks.
     
  16. Sponsor

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/1141496

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice