API tools faq
paste
Advertisement
Lures

FRST scan

Lures
Jul 10th, 2015
362
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 39.90 KB | None | 0 0
raw download clone embed print report
  1. Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:05-07-2015
  2. Ran by Steven Bayles (administrator) on STEVENBAYLES-PC on 10-07-2015 01:24:53
  3. Running from C:\Users\Steven Bayles\Desktop\Malware Removal\Farbar
  4. Loaded Profiles: Steven Bayles (Available Profiles: Steven Bayles)
  5. Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: English (United States)
  6. Internet Explorer Version 11 (Default browser: Chrome)
  7. Boot Mode: Normal
  8. Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
  9.  
  10. ==================== Processes (Whitelisted) =================
  11.  
  12. (If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
  13.  
  14. (AMD) C:\Windows\System32\atiesrxx.exe
  15. (AMD) C:\Windows\System32\atieclxx.exe
  16. (Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
  17. (Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe
  18. (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
  19. (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  20. (LSI Corp.) C:\Program Files\ltmoh\ltmoh.exe
  21. (TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe
  22. (TOSHIBA Corporation) C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe
  23. (TOSHIBA Corporation) C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe
  24. (TOSHIBA Corporation) C:\Program Files\TOSHIBA\TECO\Teco.exe
  25. (TOSHIBA Corporation) C:\Program Files\TOSHIBA\BulletinBoard\TosNcCore.exe
  26. (TOSHIBA Corporation) C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe
  27. (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
  28. (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
  29. (Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
  30. (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
  31. (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
  32. (TOSHIBA Corporation) C:\Windows\System32\TODDSrv.exe
  33. (TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
  34. (TOSHIBA Corporation) C:\Program Files\TOSHIBA\TECO\TecoService.exe
  35. (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
  36. (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
  37. (TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\NDSTray.exe
  38. (Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avpui.exe
  39. (TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSwMgr.exe
  40. (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
  41. (Logitech Inc.) C:\Program Files\Logitech Gaming Software\LCore.exe
  42. (Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
  43. (Overwolf LTD) C:\Program Files (x86)\Overwolf\Overwolf.exe
  44. (Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE
  45. (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
  46. (TOSHIBA CORPORATION.) C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe
  47. (RealNetworks, Inc.) C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe
  48. (ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
  49. (Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
  50. (TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe
  51. (TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe
  52. (TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe
  53. (Microsoft Corporation) C:\Windows\System32\dllhost.exe
  54. (TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHWMsg.exe
  55. (LSI Corporation) C:\Program Files\LSI SoftModem\agr64svc.exe
  56. (TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe
  57. (TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFProcSRVC.exe
  58. (TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe
  59. (TOSHIBA Corporation) C:\Program Files\TOSHIBA\rselect\RSelSvc.exe
  60. (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
  61. (Overwolf LTD) C:\Program Files (x86)\Common Files\Overwolf\0.86.89.0\OverwolfHelper.exe
  62. (Overwolf LTD) C:\Program Files (x86)\Common Files\Overwolf\0.86.89.0\OverwolfHelper64.exe
  63. (Overwolf LTD) C:\Program Files (x86)\Overwolf\0.86.89.0\OverwolfBrowser.exe
  64. (Microsoft Corporation) C:\Windows\System32\dllhost.exe
  65.  
  66.  
  67. ==================== Registry (Whitelisted) ==================
  68.  
  69. (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
  70.  
  71. HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [7982112 2009-07-29] (Realtek Semiconductor)
  72. HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1815848 2009-07-20] (Synaptics Incorporated)
  73. HKLM\...\Run: [LtMoh] => C:\Program Files\ltmoh\Ltmoh.exe [195080 2008-09-25] (LSI Corp.)
  74. HKLM\...\Run: [TPwrMain] => C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE [497504 2009-08-21] (TOSHIBA Corporation)
  75. HKLM\...\Run: [SmoothView] => C:\Program Files\Toshiba\SmoothView\SmoothView.exe [508216 2009-07-28] (TOSHIBA Corporation)
  76. HKLM\...\Run: [00TCrdMain] => C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe [909624 2009-08-05] (TOSHIBA Corporation)
  77. HKLM\...\Run: [TosWaitSrv] => C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe [711000 2009-08-04] (TOSHIBA Corporation)
  78. HKLM\...\Run: [SmartFaceVWatcher] => C:\Program Files\Toshiba\SmartFaceV\SmartFaceVWatcher.exe [238080 2009-07-29] (TOSHIBA Corporation)
  79. HKLM\...\Run: [Teco] => C:\Program Files\TOSHIBA\TECO\Teco.exe [1482080 2009-08-11] (TOSHIBA Corporation)
  80. HKLM\...\Run: [TosSENotify] => C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe [709976 2009-09-17] (TOSHIBA Corporation)
  81. HKLM\...\Run: [TosNC] => C:\Program Files\Toshiba\BulletinBoard\TosNcCore.exe [595816 2009-10-28] (TOSHIBA Corporation)
  82. HKLM\...\Run: [TosReelTimeMonitor] => C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe [34648 2009-10-28] (TOSHIBA Corporation)
  83. HKLM\...\Run: [Launch LCore] => C:\Program Files\Logitech Gaming Software\LCore.exe [10396440 2014-04-14] (Logitech Inc.)
  84. HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [169768 2015-02-13] (Apple Inc.)
  85. HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2009-07-30] (Advanced Micro Devices, Inc.)
  86. HKLM-x32\...\Run: [TWebCamera] => C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe [2446648 2009-08-11] (TOSHIBA CORPORATION.)
  87. HKLM-x32\...\Run: [NortonOnlineBackupReminder] => C:\Program Files (x86)\TOSHIBA\Toshiba Online Backup\Activation\TobuActivation.exe [529256 2009-08-10] (Toshiba)
  88. HKLM-x32\...\Run: [TkBellExe] => C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe [274608 2010-11-29] (RealNetworks, Inc.)
  89. HKLM-x32\...\Run: [mcui_exe] => "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
  90. HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [60712 2015-02-13] (Apple Inc.)
  91. HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-10-02] (Apple Inc.)
  92. HKLM\...\Policies\Explorer: [NoControlPanel] 0
  93. HKLM\...\Policies\Explorer: [NoFolderOptions] 0
  94. HKU\S-1-5-21-3002102147-2724671930-295018516-1000\...\Run: [swg] => C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2010-12-21] (Google Inc.)
  95. HKU\S-1-5-21-3002102147-2724671930-295018516-1000\...\Run: [Overwolf] => C:\Program Files (x86)\Overwolf\Overwolf.exe [41200 2015-06-21] (Overwolf LTD)
  96. HKU\S-1-5-21-3002102147-2724671930-295018516-1000\...\Policies\Explorer: [NoFolderOptions] 0
  97. HKU\S-1-5-21-3002102147-2724671930-295018516-1000\...\Policies\Explorer: [NoControlPanel] 0
  98. HKU\S-1-5-18\...\RunOnce: [{91120000-002F-0000-0000-0000000FF1CE}] => C:\windows\system32\cmd.exe /C del "C:\ProgramData\Microsoft Help\Rgstrtn.lck" /Q /A:H
  99. Startup: C:\Users\Steven Bayles\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk [2010-03-13]
  100. ShortcutTarget: OneNote 2007 Screen Clipper and Launcher.lnk -> C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
  101.  
  102. ==================== Internet (Whitelisted) ====================
  103.  
  104. (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
  105.  
  106. HKU\S-1-5-21-3002102147-2724671930-295018516-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
  107. HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
  108. HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
  109. HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
  110. HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
  111. HKU\S-1-5-21-3002102147-2724671930-295018516-1000\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
  112. HKU\S-1-5-21-3002102147-2724671930-295018516-1000\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
  113. URLSearchHook: HKU\S-1-5-21-3002102147-2724671930-295018516-1000 - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll No File
  114. URLSearchHook: HKU\S-1-5-21-3002102147-2724671930-295018516-1000 - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll No File
  115. SearchScopes: HKLM -> DefaultScope {42F0BFFD-79EB-4319-A483-8AD88B06CC30} URL = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSNA
  116. SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
  117. SearchScopes: HKLM -> {42F0BFFD-79EB-4319-A483-8AD88B06CC30} URL = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSNA
  118. SearchScopes: HKLM-x32 -> DefaultScope {AABAE8F9-43BB-4185-B83C-A285712D888A} URL = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSNA
  119. SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
  120. SearchScopes: HKLM-x32 -> {AABAE8F9-43BB-4185-B83C-A285712D888A} URL = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSNA
  121. SearchScopes: HKU\S-1-5-21-3002102147-2724671930-295018516-1000 -> DefaultScope {8DE9FBEB-78C5-42C3-ACAB-BAE812D9A151} URL = https://search.yahoo.com/search?fr=mcafee&type=B011US0D20140711&p={searchTerms}
  122. SearchScopes: HKU\S-1-5-21-3002102147-2724671930-295018516-1000 -> {42F0BFFD-79EB-4319-A483-8AD88B06CC30} URL =
  123. SearchScopes: HKU\S-1-5-21-3002102147-2724671930-295018516-1000 -> {8DE9FBEB-78C5-42C3-ACAB-BAE812D9A151} URL = https://search.yahoo.com/search?fr=mcafee&type=B011US0D20140711&p={searchTerms}
  124. SearchScopes: HKU\S-1-5-21-3002102147-2724671930-295018516-1000 -> {8E5D799F-E028-4E17-8D15-E5D3804DB6DC} URL = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSNA
  125. SearchScopes: HKU\S-1-5-21-3002102147-2724671930-295018516-1000 -> {AABAE8F9-43BB-4185-B83C-A285712D888A} URL = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSNA_en
  126. BHO: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll [2014-03-26] (Kaspersky Lab ZAO)
  127. BHO: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll [2015-07-08] (Kaspersky Lab ZAO)
  128. BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21] (Microsoft Corp.)
  129. BHO: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\OnlineBanking\online_banking_bho.dll [2014-03-26] (Kaspersky Lab ZAO)
  130. BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-03-02] (Google Inc.)
  131. BHO: Skype add-on for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2013-08-14] (Skype Technologies S.A.)
  132. BHO: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\UrlAdvisor\klwtbbho.dll [2014-03-26] (Kaspersky Lab ZAO)
  133. BHO-x32: RealPlayer Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll [2010-11-29] (RealPlayer)
  134. BHO-x32: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll [2014-03-26] (Kaspersky Lab ZAO)
  135. BHO-x32: Symantec Intrusion Prevention -> {6D53EC84-6AAE-4787-AEEE-F4628F01010C} -> C:\Program Files (x86)\Norton Internet Security\Engine\17.0.0.136\IPSBHO.DLL No File
  136. BHO-x32: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll [2015-07-08] (Kaspersky Lab ZAO)
  137. BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21] (Microsoft Corp.)
  138. BHO-x32: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\OnlineBanking\online_banking_bho.dll [2014-03-26] (Kaspersky Lab ZAO)
  139. BHO-x32: Windows Live Messenger Companion Helper -> {9FDDE16B-836F-4806-AB1F-1455CBEFF289} -> C:\Program Files (x86)\Windows Live\Companion\companioncore.dll [2010-11-10] (Microsoft Corporation)
  140. BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-03-02] (Google Inc.)
  141. BHO-x32: Skype Browser Helper -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2013-08-14] (Skype Technologies S.A.)
  142. BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll [2009-11-12] (Sun Microsystems, Inc.)
  143. BHO-x32: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\UrlAdvisor\klwtbbho.dll [2014-03-26] (Kaspersky Lab ZAO)
  144. Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-03-02] (Google Inc.)
  145. Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\17.0.0.136\coIEPlg.dll No File
  146. Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-03-02] (Google Inc.)
  147. Toolbar: HKU\S-1-5-21-3002102147-2724671930-295018516-1000 -> Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-03-02] (Google Inc.)
  148. Toolbar: HKU\S-1-5-21-3002102147-2724671930-295018516-1000 -> No Name - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - No File
  149. DPF: HKLM-x32 {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} http://download.mcafee.com/molbin/iss-loc/mcfscan/3,0,0,6197/mcfscan.cab
  150. Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll No File
  151. Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll No File
  152. Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2013-08-14] (Skype Technologies S.A.)
  153. Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2013-08-14] (Skype Technologies S.A.)
  154. Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
  155. Tcpip\..\Interfaces\{21ED5DEC-0A50-4B4E-A975-36CF1E400A6A}: [DhcpNameServer] 10.95.15.248 10.95.15.247
  156. Tcpip\..\Interfaces\{35B9EE50-06C1-4A3A-978E-3F709BC1E728}: [DhcpNameServer] 192.168.1.1
  157.  
  158. FireFox:
  159. ========
  160. FF Plugin: @microsoft.com/GENUINE -> disabled No File
  161. FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-16] ( Microsoft Corporation)
  162. FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\windows\system32\Adobe\Director\np32dsw.dll No File
  163. FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-10-30] ()
  164. FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
  165. FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation)
  166. FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll [2010-04-26] (Microsoft Corp.)
  167. FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2010-11-10] (Microsoft Corporation)
  168. FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2010-11-10] (Microsoft Corporation)
  169. FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll [2013-08-24] (Pando Networks)
  170. FF Plugin-x32: @real.com/nppl3260;version=12.0.1.609 -> C:\Program Files (x86)\Real\RealPlayer\Netscape6\nppl3260.dll [2010-11-29] (RealNetworks, Inc.)
  171. FF Plugin-x32: @real.com/nprjplug;version=12.0.1.609 -> C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprjplug.dll [2010-11-29] (RealNetworks, Inc.)
  172. FF Plugin-x32: @real.com/nprphtml5videoshim;version=12.0.1.609 -> C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll [2010-11-29] (RealNetworks, Inc.)
  173. FF Plugin-x32: @real.com/nprpjplug;version=12.0.1.609 -> C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprpjplug.dll [2010-11-29] (RealNetworks, Inc.)
  174. FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-15] (Google Inc.)
  175. FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-15] (Google Inc.)
  176. FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-05-01] (Adobe Systems Inc.)
  177. FF Plugin HKU\S-1-5-21-3002102147-2724671930-295018516-1000: @nsroblox.roblox.com/launcher -> C:\Users\Steven Bayles\AppData\Local\Roblox\Versions\version-9d174e484c8b493e\\NPRobloxProxy.dll [2013-01-01] ( ROBLOX Corporation)
  178. FF Plugin HKU\S-1-5-21-3002102147-2724671930-295018516-1000: @nsroblox.roblox.com/launcher64 -> C:\Users\Steven Bayles\AppData\Local\Roblox\Versions\version-9d174e484c8b493e\\NPRobloxProxy64.dll [2013-01-01] ( ROBLOX Corporation)
  179. FF Plugin HKU\S-1-5-21-3002102147-2724671930-295018516-1000: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Steven Bayles\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2013-10-03] (Unity Technologies ApS)
  180. FF Plugin HKU\S-1-5-21-3002102147-2724671930-295018516-1000: @yahoo.com/BrowserPlus,version=2.9.8 -> C:\Users\Steven Bayles\AppData\Local\Yahoo!\BrowserPlus\2.9.8\Plugins\npybrowserplus_2.9.8.dll [2010-08-04] (Yahoo! Inc.)
  181. FF Plugin HKU\S-1-5-21-3002102147-2724671930-295018516-1000: pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll [2013-08-24] (Pando Networks)
  182. FF HKLM\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files (x86)\McAfee\SiteAdvisor
  183. FF HKLM-x32\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\IPSFFPlgn
  184. FF HKLM-x32\...\Firefox\Extensions: [{4C0766D3-67A7-45a3-85A2-752F77312F32}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\coFFPlgn
  185. FF HKLM-x32\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
  186. FF Extension: RealPlayer Browser Record Plugin - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2010-11-29]
  187. FF HKLM-x32\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files (x86)\McAfee\SiteAdvisor
  188. FF HKLM-x32\...\Firefox\Extensions: [url_advisor@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\url_advisor@kaspersky.com
  189. FF Extension: Kaspersky URL Advisor - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\url_advisor@kaspersky.com [2015-07-08]
  190. FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\virtual_keyboard@kaspersky.com
  191. FF Extension: Virtual Keyboard - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\virtual_keyboard@kaspersky.com [2015-07-08]
  192. FF HKLM-x32\...\Firefox\Extensions: [content_blocker@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\content_blocker@kaspersky.com
  193. FF Extension: Dangerous Websites Blocker - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\content_blocker@kaspersky.com [2015-07-08]
  194. FF HKLM-x32\...\Firefox\Extensions: [anti_banner@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\anti_banner@kaspersky.com
  195. FF Extension: Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\anti_banner@kaspersky.com [2015-07-08]
  196. FF HKLM-x32\...\Firefox\Extensions: [online_banking@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\online_banking@kaspersky.com
  197. FF Extension: Safe Money - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\online_banking@kaspersky.com [2015-07-08]
  198.  
  199. Chrome:
  200. =======
  201. CHR Profile: C:\Users\Steven Bayles\AppData\Local\Google\Chrome\User Data\Default
  202. CHR Extension: (Google Drive) - C:\Users\Steven Bayles\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-11-10]
  203. CHR Extension: (Kaspersky Protection) - C:\Users\Steven Bayles\AppData\Local\Google\Chrome\User Data\Default\Extensions\blbkdnmdcafmfhinpmnlhhddbepgkeaa [2015-07-08]
  204. CHR Extension: (Kaspersky URL Advisor) - C:\Users\Steven Bayles\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj [2015-07-08]
  205. CHR Extension: (SiteAdvisor) - C:\Users\Steven Bayles\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho [2012-10-01]
  206. CHR Extension: (Safe Money) - C:\Users\Steven Bayles\AppData\Local\Google\Chrome\User Data\Default\Extensions\hakdifolhalapjijoafobooafbilfakh [2015-07-08]
  207. CHR Extension: (Dangerous Websites Blocker) - C:\Users\Steven Bayles\AppData\Local\Google\Chrome\User Data\Default\Extensions\hghkgaeecgjhjkannahfamoehjmkjail [2015-07-08]
  208. CHR Extension: (Virtual Keyboard) - C:\Users\Steven Bayles\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh [2015-07-08]
  209. CHR Extension: (RealPlayer HTML5Video Downloader Extension) - C:\Users\Steven Bayles\AppData\Local\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk [2012-10-01]
  210. CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Steven Bayles\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-04]
  211. CHR Extension: (Skype Click to Call) - C:\Users\Steven Bayles\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2012-10-01]
  212. CHR Extension: (Google Wallet) - C:\Users\Steven Bayles\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-22]
  213. CHR Extension: (Anti-Banner) - C:\Users\Steven Bayles\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman [2015-07-08]
  214. CHR HKLM\...\Chrome\Extension: [blbkdnmdcafmfhinpmnlhhddbepgkeaa] - https://chrome.google.com/webstore/detail/blbkdnmdcafmfhinpmnlhhddbepgkeaa
  215. CHR HKLM\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - C:\Program Files (x86)\McAfee\SiteAdvisor\McChPlg.crx [Not Found]
  216. CHR HKLM\...\Chrome\Extension: [jagncdcchgajhfhijbbhecadmaiegcmh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\virtkbd.crx [2014-03-26]
  217. CHR HKLM-x32\...\Chrome\Extension: [blbkdnmdcafmfhinpmnlhhddbepgkeaa] - https://chrome.google.com/webstore/detail/blbkdnmdcafmfhinpmnlhhddbepgkeaa
  218. CHR HKLM-x32\...\Chrome\Extension: [dchlnpcodkpfdpacogkljefecpegganj] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\urladvisor.crx [2014-03-26]
  219. CHR HKLM-x32\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - C:\Program Files (x86)\McAfee\SiteAdvisor\McChPlg.crx [Not Found]
  220. CHR HKLM-x32\...\Chrome\Extension: [hakdifolhalapjijoafobooafbilfakh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\online_banking_chrome.crx [2014-03-26]
  221. CHR HKLM-x32\...\Chrome\Extension: [hghkgaeecgjhjkannahfamoehjmkjail] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\content_blocker_chrome.crx [2014-03-26]
  222. CHR HKLM-x32\...\Chrome\Extension: [jagncdcchgajhfhijbbhecadmaiegcmh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\virtkbd.crx [2014-03-26]
  223. CHR HKLM-x32\...\Chrome\Extension: [jfmjfhklogoienhpfnppmbcbjfjnkonk] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Chrome\Ext\rphtml5video.crx [2010-11-29]
  224. CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx [2013-08-14]
  225. CHR HKLM-x32\...\Chrome\Extension: [pjldcfjmnllhmgjclecdnfampinooman] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\ab.crx [2014-03-26]
  226.  
  227. ==================== Services (Whitelisted) =================
  228.  
  229. (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
  230.  
  231. R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77128 2015-01-20] (Apple Inc.)
  232. R2 AVP; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe [214512 2014-03-26] (Kaspersky Lab ZAO)
  233. R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2015-06-18] (Malwarebytes Corporation)
  234. R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1133880 2015-06-18] (Malwarebytes Corporation)
  235. S3 OverwolfUpdater; C:\Program Files (x86)\Overwolf\OverwolfUpdater.exe [1000688 2015-06-21] (Overwolf LTD)
  236. R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
  237. S2 McAfee SiteAdvisor Service; C:\Program Files (x86)\McAfee\SiteAdvisor\McSACore.exe [X]
  238.  
  239. ==================== Drivers (Whitelisted) ====================
  240.  
  241. (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
  242.  
  243. U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-13] (Microsoft Corporation)
  244. R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [458336 2014-03-26] (Kaspersky Lab ZAO)
  245. S4 klflt; C:\Windows\System32\DRIVERS\klflt.sys [115296 2014-03-26] (Kaspersky Lab ZAO)
  246. R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [625248 2014-03-26] (Kaspersky Lab ZAO)
  247. R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [29792 2014-03-26] (Kaspersky Lab ZAO)
  248. R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [29280 2014-03-26] (Kaspersky Lab ZAO)
  249. R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29280 2014-03-26] (Kaspersky Lab ZAO)
  250. R1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO)
  251. R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [55904 2013-05-14] (Kaspersky Lab ZAO)
  252. R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [178272 2014-03-26] (Kaspersky Lab ZAO)
  253. S3 LGSHidFilt; C:\Windows\System32\DRIVERS\LGSHidFilt.Sys [64280 2013-05-30] (Logitech Inc.)
  254. R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25816 2015-06-18] (Malwarebytes Corporation)
  255. R3 MBAMSwissArmy; C:\windows\system32\drivers\MBAMSwissArmy.sys [113880 2015-07-09] (Malwarebytes Corporation)
  256. R3 MBAMWebAccessControl; C:\windows\system32\drivers\mwac.sys [63704 2015-06-18] (Malwarebytes Corporation)
  257. S3 ssmirrdr; C:\Windows\System32\DRIVERS\ssmirrdr.sys [10112 2010-02-17] (support.com, Inc)
  258. S3 swmsflt; C:\Windows\System32\DRIVERS\swmsflt.sys [47104 2010-06-08] ()
  259. S3 SWNC5E00; C:\Windows\System32\DRIVERS\SWNC5E00.sys [285696 2010-06-08] (Sierra Wireless Inc.)
  260. S3 catchme; \??\C:\ComboFix\catchme.sys [X]
  261. S3 PCTINDIS5X64; \??\C:\windows\system32\PCTINDIS5X64.SYS [X]
  262. S3 RtsUIR; system32\DRIVERS\Rts516xIR.sys [X]
  263. S3 USBCCID; system32\DRIVERS\RtsUCcid.sys [X]
  264.  
  265. ==================== NetSvcs (Whitelisted) ===================
  266.  
  267. (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
  268.  
  269.  
  270. ==================== One Month Created files and folders ========
  271.  
  272. (If an entry is included in the fixlist, the file/folder will be moved.)
  273.  
  274. 2015-07-08 14:48 - 2015-07-08 14:48 - 00007552 _____ C:\Users\Steven Bayles\Desktop\JRT.txt
  275. 2015-07-08 14:39 - 2015-07-08 14:39 - 00000207 _____ C:\windows\tweaking.com-regbackup-STEVENBAYLES-PC-Windows-7-Home-Premium-(64-bit).dat
  276. 2015-07-08 14:38 - 2015-07-08 14:38 - 00000000 ____D C:\RegBackup
  277. 2015-07-08 14:34 - 2015-07-08 14:35 - 02953707 _____ (Malwarebytes Corporation) C:\Users\Steven Bayles\Desktop\JRT.exe
  278. 2015-07-08 13:07 - 2015-07-09 21:47 - 00113880 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
  279. 2015-07-08 13:07 - 2015-07-08 13:07 - 00001073 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
  280. 2015-07-08 13:07 - 2015-07-08 13:07 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
  281. 2015-07-08 13:07 - 2015-07-08 13:07 - 00000000 ____D C:\ProgramData\Malwarebytes
  282. 2015-07-08 13:07 - 2015-07-08 13:07 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
  283. 2015-07-08 13:07 - 2015-06-18 08:41 - 00109272 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys
  284. 2015-07-08 13:07 - 2015-06-18 08:41 - 00063704 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys
  285. 2015-07-08 13:07 - 2015-06-18 08:41 - 00025816 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
  286. 2015-07-08 13:06 - 2015-07-08 13:06 - 24345872 _____ (Malwarebytes Corporation ) C:\Users\Steven Bayles\Downloads\mbam-setup-2.1.8.1057.exe
  287. 2015-07-08 02:47 - 2015-07-08 02:47 - 00002301 _____ C:\Users\Steven Bayles\Desktop\Safe Money.lnk
  288. 2015-07-08 02:47 - 2015-07-08 02:47 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kaspersky Internet Security
  289. 2015-07-08 02:47 - 2015-07-08 02:46 - 00001095 _____ C:\Users\Public\Desktop\Kaspersky Internet Security.lnk
  290. 2015-07-08 02:46 - 2013-05-06 09:13 - 00110176 _____ (Kaspersky Lab ZAO) C:\windows\system32\klfphc.dll
  291. 2015-07-08 02:45 - 2015-07-10 01:08 - 00000000 ____D C:\ProgramData\Kaspersky Lab
  292. 2015-07-08 02:45 - 2015-07-08 02:45 - 00000000 ____D C:\windows\ELAMBKUP
  293. 2015-07-08 02:45 - 2015-07-08 02:45 - 00000000 ____D C:\Program Files (x86)\Kaspersky Lab
  294. 2015-07-08 02:44 - 2014-03-26 11:00 - 00625248 _____ (Kaspersky Lab ZAO) C:\windows\system32\Drivers\klif.sys
  295. 2015-07-08 02:44 - 2014-03-26 11:00 - 00115296 _____ (Kaspersky Lab ZAO) C:\windows\system32\Drivers\klflt.sys
  296. 2015-07-08 02:22 - 2015-07-08 02:22 - 00000000 ___HD C:\kleaner.tmp
  297. 2015-07-08 02:19 - 2015-07-08 02:19 - 00000290 _____ C:\windows\wininit.ini
  298. 2015-07-08 02:07 - 2015-07-08 02:07 - 00000000 ____D C:\ProgramData\WRData
  299. 2015-07-07 22:17 - 2015-07-09 22:26 - 00003534 _____ C:\windows\System32\Tasks\ReclaimerUpdateXML_Steven Bayles
  300. 2015-07-07 22:17 - 2015-07-09 21:17 - 00003540 _____ C:\windows\System32\Tasks\ReclaimerUpdateFiles_Steven Bayles
  301. 2015-07-07 22:17 - 2015-07-07 22:17 - 00003658 _____ C:\windows\System32\Tasks\RNUpgradeHelperResumePrompt_Steven Bayles
  302. 2015-07-07 22:17 - 2015-07-07 22:17 - 00003274 _____ C:\windows\System32\Tasks\RNUpgradeHelperLogonPrompt_Steven Bayles
  303. 2015-07-07 21:29 - 2015-07-07 21:30 - 00040578 _____ C:\Users\Steven Bayles\Desktop\Addition.txt
  304. 2015-07-07 21:28 - 2015-07-07 21:30 - 00060830 _____ C:\Users\Steven Bayles\Desktop\FRST.txt
  305. 2015-07-07 19:47 - 2015-07-09 16:34 - 00000000 ____D C:\AdwCleaner
  306. 2015-07-07 19:28 - 2015-07-10 01:24 - 00000000 ____D C:\FRST
  307. 2015-07-07 19:25 - 2015-07-08 14:36 - 00000000 ____D C:\Users\Steven Bayles\Desktop\Malware Removal
  308. 2015-07-07 19:20 - 2015-07-07 19:20 - 04176437 _____ C:\Users\Steven Bayles\Downloads\tdsskiller.zip
  309. 2015-07-07 19:19 - 2015-07-07 19:19 - 02244096 _____ C:\Users\Steven Bayles\Desktop\AdwCleaner.exe
  310. 2015-06-20 10:04 - 2015-06-20 10:04 - 00000000 ____D C:\Users\Steven Bayles\AppData\Local\GWX
  311.  
  312. ==================== One Month Modified files and folders ========
  313.  
  314. (If an entry is included in the fixlist, the file/folder will be moved.)
  315.  
  316. 2015-07-10 01:15 - 2012-04-20 15:55 - 00000830 _____ C:\windows\Tasks\Adobe Flash Player Updater.job
  317. 2015-07-10 00:53 - 2010-12-21 22:06 - 00000898 _____ C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
  318. 2015-07-09 23:46 - 2010-02-24 06:09 - 01306518 _____ C:\windows\WindowsUpdate.log
  319. 2015-07-09 20:15 - 2009-07-13 23:45 - 00018736 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
  320. 2015-07-09 20:15 - 2009-07-13 23:45 - 00018736 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
  321. 2015-07-09 17:43 - 2010-12-21 22:06 - 00000894 _____ C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
  322. 2015-07-09 17:15 - 2012-04-20 15:55 - 00778416 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
  323. 2015-07-09 17:15 - 2012-04-20 15:55 - 00142512 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
  324. 2015-07-09 17:15 - 2012-04-20 15:55 - 00003768 _____ C:\windows\System32\Tasks\Adobe Flash Player Updater
  325. 2015-07-09 16:33 - 2014-02-20 22:04 - 00000000 ____D C:\Users\Steven Bayles\AppData\Local\Overwolf
  326. 2015-07-09 16:30 - 2009-11-12 22:08 - 00345208 _____ C:\windows\PFRO.log
  327. 2015-07-09 16:30 - 2009-07-14 00:08 - 00000006 ____H C:\windows\Tasks\SA.DAT
  328. 2015-07-09 16:30 - 2009-07-13 23:51 - 00093467 _____ C:\windows\setupact.log
  329. 2015-07-08 02:45 - 2009-07-14 00:13 - 00782510 _____ C:\windows\system32\PerfStringBackup.INI
  330. 2015-07-08 02:23 - 2011-03-08 19:10 - 00000000 ____D C:\Program Files\Common Files\McAfee
  331. 2015-07-08 02:19 - 2010-03-11 13:01 - 00000000 ____D C:\ProgramData\McAfee
  332. 2015-07-08 02:13 - 2014-04-14 17:20 - 00000000 ____D C:\Program Files (x86)\Overwolf
  333. 2015-07-07 19:47 - 2012-10-01 15:50 - 00002154 _____ C:\Users\Public\Desktop\Google Chrome.lnk
  334. 2015-06-27 21:53 - 2012-12-28 16:32 - 00000000 ____D C:\Users\Steven Bayles\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Roblox
  335. 2015-06-27 21:51 - 2015-01-19 22:37 - 00003886 _____ C:\windows\System32\Tasks\Adobe Acrobat Update Task
  336. 2015-06-23 13:30 - 2010-03-11 10:40 - 00300704 ____N (Microsoft Corporation) C:\windows\system32\MpSigStub.exe
  337. 2015-06-12 21:05 - 2015-05-11 20:37 - 00000000 ____D C:\Program Files (x86)\Steam
  338. 2015-06-10 04:38 - 2009-07-13 22:20 - 00000000 ____D C:\windows\rescache
  339. 2015-06-10 03:49 - 2009-07-14 00:09 - 00000000 ____D C:\windows\System32\Tasks\WPD
  340. 2015-06-10 03:48 - 2009-07-13 23:45 - 00338960 _____ C:\windows\system32\FNTCACHE.DAT
  341. 2015-06-10 03:43 - 2014-12-13 15:22 - 00000000 ____D C:\windows\system32\appraiser
  342. 2015-06-10 03:43 - 2014-05-13 03:00 - 00000000 ___SD C:\windows\system32\CompatTel
  343. 2015-06-10 03:43 - 2009-07-13 22:20 - 00000000 ____D C:\windows\PolicyDefinitions
  344. 2015-06-10 03:18 - 2010-02-24 06:14 - 00000000 ____D C:\ProgramData\Microsoft Help
  345. 2015-06-10 03:15 - 2013-08-18 20:43 - 00000000 ____D C:\windows\system32\MRT
  346. 2015-06-10 03:05 - 2010-03-12 17:13 - 140135120 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
  347.  
  348. ==================== Files in the root of some directories =======
  349.  
  350. 2015-05-23 16:07 - 2015-05-23 16:07 - 0000097 _____ () C:\Users\Steven Bayles\AppData\Roaming\LauncherSettings_live.cfg
  351. 2015-05-23 00:59 - 2015-05-23 00:59 - 0000039 _____ () C:\Users\Steven Bayles\AppData\Roaming\TheHunterSettings_steam_live.cfg
  352. 2015-03-02 20:58 - 2015-03-02 20:58 - 0000000 _____ () C:\Users\Steven Bayles\AppData\Roaming\wklnhst.dat
  353. 2010-11-29 15:17 - 2013-10-28 18:41 - 0006144 _____ () C:\Users\Steven Bayles\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
  354. 2011-02-16 22:28 - 2011-02-16 22:28 - 0000000 _____ () C:\ProgramData\cmn_upld.log
  355. 2010-12-21 22:06 - 2010-12-21 22:06 - 0000056 ____H () C:\ProgramData\ezsidmv.dat
  356. 2011-01-13 21:45 - 2011-01-13 21:45 - 0000252 _____ () C:\ProgramData\FastPics.log
  357. 2011-01-17 00:10 - 2015-03-02 19:16 - 0038550 _____ () C:\ProgramData\lxea.log
  358. 2011-03-05 11:19 - 2014-05-27 16:01 - 0000614 _____ () C:\ProgramData\lxeaDiagnostics.log
  359. 2011-01-13 21:50 - 2014-05-27 16:12 - 0093309 _____ () C:\ProgramData\lxeaJSW.log
  360. 2011-01-13 21:21 - 2015-03-02 19:16 - 0054028 _____ () C:\ProgramData\lxeascan.log
  361. 2011-02-16 22:28 - 2011-02-16 22:28 - 0000000 _____ () C:\ProgramData\LxWbGwLog.log
  362. 2010-03-11 12:49 - 2010-03-11 13:29 - 0024658 _____ () C:\ProgramData\restorewl.ini
  363. 2011-01-13 21:16 - 2011-01-13 21:16 - 0000000 _____ () C:\ProgramData\UpdaterLog.txt
  364.  
  365. Files to move or delete:
  366. ====================
  367. C:\Users\Steven Bayles\jagex_runescape_preferences.dat
  368. C:\Users\Steven Bayles\jagex_runescape_preferences2.dat
  369.  
  370.  
  371. Some files in TEMP:
  372. ====================
  373. C:\Users\Steven Bayles\AppData\Local\Temp\McCSPInstall.dll
  374. C:\Users\Steven Bayles\AppData\Local\Temp\mccspuninstall.exe
  375. C:\Users\Steven Bayles\AppData\Local\Temp\_isA2BA.exe
  376.  
  377.  
  378. ==================== Bamital & volsnap Check =================
  379.  
  380. (There is no automatic fix for files that do not pass verification.)
  381.  
  382. C:\Windows\System32\winlogon.exe => File is digitally signed
  383. C:\Windows\System32\wininit.exe => File is digitally signed
  384. C:\Windows\SysWOW64\wininit.exe => File is digitally signed
  385. C:\Windows\explorer.exe => File is digitally signed
  386. C:\Windows\SysWOW64\explorer.exe => File is digitally signed
  387. C:\Windows\System32\svchost.exe => File is digitally signed
  388. C:\Windows\SysWOW64\svchost.exe => File is digitally signed
  389. C:\Windows\System32\services.exe => File is digitally signed
  390. C:\Windows\System32\User32.dll => File is digitally signed
  391. C:\Windows\SysWOW64\User32.dll => File is digitally signed
  392. C:\Windows\System32\userinit.exe => File is digitally signed
  393. C:\Windows\SysWOW64\userinit.exe => File is digitally signed
  394. C:\Windows\System32\rpcss.dll => File is digitally signed
  395. C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
  396.  
  397.  
  398. LastRegBack: 2015-07-08 05:38
  399.  
  400. ==================== End of log ============================
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!