[ Solved ] HELP. router hacked

bob12a · March 27, 2015

Ken,Nev

See my "before I go on"thread and my replies.

Could my router be hacked

Bob

Plastic Nev · March 27, 2015

Considering the computer itself is behaving oddly, I doubt that the router is to blame, however please let us know the make and model of your router as some makes did have a vulnerability.

In those cases, where they were hacked there was no sign of it on the computer anyway, they just let hackers see your personal outgoing stuff.

I assume you have now run scans with Malwarebytes and your antivirus, have they turned up anything?

One more thing, just check and see if the computers behaviour is because finally service pack 1 has managed to install behind the scenes.

Finally, if any sort of concern that malware is responsible for this behaviour, follow the guide and post the logs for one of our security guys to check.

Nev.

bob12a · March 27, 2015

Hi Nev

Will do all the tests you mention and get back thanks.

Router is BRIGHT BOX 2

SUPPLIED BY EE

Did run ESET NODE32

bob12a · March 28, 2015

Hi Ken Nev

Malware produced 25 PUPs I cleaned them. Ran another malware

Node 32 clean but with 25 items in quaritine. Left alone

One more thing, just check and see if the computers behaviour is because finally service pack 1 has managed to install behind the scenes.

The sp1 no show

It seems strange this change/fault happened on 2 laptops and I PC.I promise I was not mucking around.

Again thanks both for your help.

Plastic Nev · March 28, 2015

One of the malware guys might want to look at the PUP's and quarantined stuff Bob, so don't delete them just yet.

If at least one of the PUP's is common to all the laptops and desktop, it may well have been that, but lets see what is said by the experts.

Hopefully they will see this and ask.

Nev.

Starbuck · March 28, 2015

Hi Bob

Could my router be hacked

It's possible, but as only PuPs have been found.... I doubt it at the moment.

Malware produced 25 PUPs I cleaned them. Ran another malware
Node 32 clean but with 25 items in quaritine.

I suspect that Nod32 found the items that MBAM had quarantined.

Can you post the report from MBAM, so i can see exactly what was found.

Restart MBAM

Click on the History tab >> Application Logs.
Double click on the scan log which shows the Date and time of the scan that showed the infections.

http://img.photobucket.com/albums/v708/starbuck50/mbamlog_zpsa7413aad.png
Click 'Copy to Clipboard'

http://img.photobucket.com/albums/v708/starbuck50/mbamhis_zps7bfe6503.png
Paste the report into your next reply.

Thanks

bob12a · March 29, 2015

thank you Peter below as requested

Malwarebytes Anti-Malware

http://www.malwarebytes.org

Scan Date: 23/10/2014

Scan Time: 10:36:02

Logfile:

Administrator: Yes

Version: 2.00.3.1025

Malware Database: v2014.10.23.02

Rootkit Database: v2014.10.22.01

License: Free

Malware Protection: Disabled

Malicious Website Protection: Disabled

Self-protection: Disabled

OS: Windows 7

CPU: x86

File System: NTFS

User: BF2010

Scan Type: Threat Scan

Result: Completed

Objects Scanned: 352321

Time Elapsed: 26 min, 44 sec

Memory: Enabled

Startup: Enabled

Filesystem: Enabled

Archives: Enabled

Rootkits: Disabled

Heuristics: Enabled

PUP: Warn

PUM: Enabled

Processes: 0

(No malicious items detected)

Modules: 0

(No malicious items detected)

Registry Keys: 1

PUP.Optional.Updater.A, HKU\S-1-5-21-2785784116-2001642337-1380054423-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\Digital Sites, No Action By User, [96888296a6d621151e9ff11c7d8651af],

Registry Values: 0

(No malicious items detected)

Registry Data: 0

(No malicious items detected)

Folders: 8

PUP.Optional.SearchProtect.A, C:\Users\BF2010\AppData\Local\SearchProtect, No Action By User, [d34bff199fdd5fd7a0308b7ae320fe02],

PUP.Optional.SearchProtect.A, C:\Users\BF2010\AppData\Local\SearchProtect\Logs, No Action By User, [d34bff199fdd5fd7a0308b7ae320fe02],

PUP.Optional.Updater.A, C:\Users\BF2010\AppData\Roaming\DigitalSites\UpdateProc, No Action By User, [96888296a6d621151e9ff11c7d8651af],

PUP.Optional.Astromenda, C:\Program Files\WSE_Astromenda, No Action By User, [011d53c5027a3afcdf5216fdb05312ee],

PUP.Optional.Astromenda, C:\Program Files\WSE_Astromenda\bh, No Action By User, [011d53c5027a3afcdf5216fdb05312ee],

PUP.Optional.Astromenda.A, C:\Users\BF2010\AppData\Roaming\WSE_Astromenda, No Action By User, [f7271ff9661642f41733ce45bf4417e9],

PUP.Optional.Astromenda.A, C:\Users\BF2010\AppData\Roaming\WSE_Astromenda\icons_3.2.1.5, No Action By User, [f7271ff9661642f41733ce45bf4417e9],

PUP.Optional.Astromenda.A, C:\Users\BF2010\AppData\Roaming\WSE_Astromenda\UpdateProc, No Action By User, [f7271ff9661642f41733ce45bf4417e9],

Files: 18

PUP.Optional.InstalLCore, C:\Users\BF2010\AppData\Local\Temp\is1242154493\2982149_stp.EXE, No Action By User, [cb539f790a72f83ee9f12fdaf60fa957],

PUP.Optional.Conduit.A, C:\Users\BF2010\AppData\Local\Temp\nsc4D08.tmp\82\SPIdentifier.exe, No Action By User, [ef2f44d4b9c3f4424bca22005ca53ac6],

PUP.Optional.Astromenda, C:\Users\BF2010\AppData\Roaming\Mozilla\Firefox\Profiles\n0cs74ko.default\searchplugins\Astromenda.xml, No Action By User, [fb239e7a6c1060d676e8ed3aba4934cc],

PUP.Optional.SearchProtect.A, C:\Users\BF2010\AppData\Local\SearchProtect\Logs\sp_nsvEFAE.log, No Action By User, [d34bff199fdd5fd7a0308b7ae320fe02],

PUP.Optional.Updater.A, C:\Users\BF2010\AppData\Roaming\DigitalSites\UpdateProc\bkup.dat, No Action By User, [96888296a6d621151e9ff11c7d8651af],

PUP.Optional.Updater.A, C:\Users\BF2010\AppData\Roaming\DigitalSites\UpdateProc\config.dat, No Action By User, [96888296a6d621151e9ff11c7d8651af],

PUP.Optional.Updater.A, C:\Users\BF2010\AppData\Roaming\DigitalSites\UpdateProc\info.dat, No Action By User, [96888296a6d621151e9ff11c7d8651af],

PUP.Optional.Updater.A, C:\Users\BF2010\AppData\Roaming\DigitalSites\UpdateProc\prod.dat, No Action By User, [96888296a6d621151e9ff11c7d8651af],

PUP.Optional.Updater.A, C:\Users\BF2010\AppData\Roaming\DigitalSites\UpdateProc\STTL.DAT, No Action By User, [96888296a6d621151e9ff11c7d8651af],

PUP.Optional.Updater.A, C:\Users\BF2010\AppData\Roaming\DigitalSites\UpdateProc\TTL.DAT, No Action By User, [96888296a6d621151e9ff11c7d8651af],

PUP.Optional.Updater.A, C:\Users\BF2010\AppData\Roaming\DigitalSites\UpdateProc\UpdateTask.exe, No Action By User, [96888296a6d621151e9ff11c7d8651af],

PUP.Optional.Astromenda, C:\Program Files\WSE_Astromenda\astcnfg.dat, No Action By User, [011d53c5027a3afcdf5216fdb05312ee],

PUP.Optional.Astromenda, C:\Program Files\WSE_Astromenda\uninst.dat, No Action By User, [011d53c5027a3afcdf5216fdb05312ee],

PUP.Optional.Astromenda.A, C:\Users\BF2010\AppData\Roaming\WSE_Astromenda\UpdateProc\bkup.dat, No Action By User, [f7271ff9661642f41733ce45bf4417e9],

PUP.Optional.Astromenda.A, C:\Users\BF2010\AppData\Roaming\WSE_Astromenda\UpdateProc\config.dat, No Action By User, [f7271ff9661642f41733ce45bf4417e9],

PUP.Optional.Astromenda.A, C:\Users\BF2010\AppData\Roaming\WSE_Astromenda\UpdateProc\info.dat, No Action By User, [f7271ff9661642f41733ce45bf4417e9],

PUP.Optional.Astromenda.A, C:\Users\BF2010\AppData\Roaming\WSE_Astromenda\UpdateProc\STTL.DAT, No Action By User, [f7271ff9661642f41733ce45bf4417e9],

PUP.Optional.Astromenda.A, C:\Users\BF2010\AppData\Roaming\WSE_Astromenda\UpdateProc\TTL.DAT, No Action By User, [f7271ff9661642f41733ce45bf4417e9],

Physical Sectors: 0

(No malicious items detected)

(end)

Starbuck · March 29, 2015

Hi Bob,

Your version of MBAM is out of date:

Version: 2.00.3.1025

The latest version is: 2.1.4.1018

It's very important that the latest version is used.

Uninstall Malwarebytes' Anti-Malware using Add/Remove programs in the control panel.
Restart your computer (very important).
Download mbam clean and save to your Desktop.
Please close all open applications and temporarily shutdown your antivirus to avoid any conflicts when running the tool.
Locate the file mbam-clean.exe and double-click to run it... Vista/Windows 7/8 users right-click and select Run As Administrator.. and follow the onscreen prompts.
It will ask to restart your computer, please allow it to do so (very important)
After the computer restarts..........
Ensure that your antivirus is enabled and download the latest version of Malwarebytes Anti-Malware from Here and save it to your desktop.
Now close all open applications including your browser and again temporarily disable your antivirus as before and launch the Malwarebytes installer you just downloaded.
A 14 day trial of the Premium features is pre-selected. You may deselect this if you wish, and it will not diminish the scanning and removal capabilities of the program
I recommend that you UNtick this option.
Click Finish
When installation is complete....Make sure you re-enabled your Anti-Virus/Internet-Security applications.

If you are notified the Database is out of date click Update Now

http://img.photobucket.com/albums/v708/starbuck50/mbamnew_zpsdc989cc1.png
Click Scan Now >>
A Threat Scan will begin.
When the scan is complete, if there have been detections, click Apply Actions to allow MBAM to clean what was detected.
In most cases, a restart will be required.
Wait for the prompt to restart the computer to appear, then click on Yes.

.

(Copy to clipboard for pasting into forum replies)

After the restart once you are back at your desktop, open MBAM once more.
Click on the History tab >> Application Logs.

http://img.photobucket.com/albums/v708/starbuck50/mbamapplog_zps222887ef.png
Double click on the scan log which shows the Date and time of the scan just performed.
Click 'Copy to Clipboard'

http://img.photobucket.com/albums/v708/starbuck50/mbamhis_zps7bfe6503.png
Paste the contents of the clipboard into your reply.

Thanks

bob12a · March 29, 2015

Will follow your instructions tomorrow Thanks

Starbuck · March 29, 2015

Ok Bob,

Thanks for letting me know.

bob12a · March 30, 2015

Hope this is what you want

Malwarebytes Anti-Malware

http://www.malwarebytes.org

Scan Date: 30/03/2015

Scan Time: 08:51:59

Logfile:

Administrator: Yes

Version: 2.01.4.1018

Malware Database: v2015.03.30.04

Rootkit Database: v2015.03.26.01

License: Free

Malware Protection: Disabled

Malicious Website Protection: Disabled

Self-protection: Disabled

OS: Windows 7

CPU: x86

File System: NTFS

User: BF2010

Scan Type: Threat Scan

Result: Completed

Objects Scanned: 470627

Time Elapsed: 28 min, 24 sec

Memory: Enabled

Startup: Enabled

Filesystem: Enabled

Archives: Enabled

Rootkits: Disabled

Heuristics: Enabled

PUP: Enabled

PUM: Enabled

Processes: 0

(No malicious items detected)

Modules: 0

(No malicious items detected)

Registry Keys: 0

(No malicious items detected)

Registry Values: 0

(No malicious items detected)

Registry Data: 0

(No malicious items detected)

Folders: 0

(No malicious items detected)

Files: 0

(No malicious items detected)

Physical Sectors: 0

(No malicious items detected)

(end)

Starbuck · March 30, 2015

Hi Bob,

Hope this is what you want

Yep, that was it. :)

I can reset the text sizes and move the desktop icons around to what I want

Have you reset these yet?

Let's make sure that there's no PuP leftovers.

Step 1

Please download Junkware Removal Tool to your desktop.

Shut down your protection software now to avoid potential conflicts.
Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
The tool will open and start scanning your system.
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next message.

Please download AdwCleaner by Xplode onto your desktop.

Close all open programs and internet browsers.
Double click on adwcleaner.exe to run the tool.
Vista/Windows 7/8 users right-click and select Run As Administrator.
Click on the Scan button.
AdwCleaner will begin to scan your computer.
After the scan has finished...
Click on the Cleaning button.
Press OK when asked to close all programs and follow the onscreen prompts.
Press OK again to allow AdwCleaner to restart the computer and complete the removal process.
After rebooting, a logfile report (AdwCleaner[s0].txt) will open automatically.
Copy and paste the contents of that logfile in your next reply.
A copy of that logfile will also be saved in the C:\AdwCleaner folder.

Step 2

For x32 bit systems download Farbar Recovery Scan Tool and save it to your Desktop.

Double-click the downloaded icon to run the tool. Vista/Windows 7/8 users right-click and select Run As Administrator

http://img.photobucket.com/albums/v708/starbuck50/frsticon_zpsdc3cbdc3.png
When the tool opens click Yes to disclaimer.

http://img.photobucket.com/albums/v708/starbuck50/frstdis_zps7f598f12.png
Make sure that Addition.txt is selected at the bottom
Press Scan button.

http://img.photobucket.com/albums/v708/starbuck50/newfrst_zpsa63ffa3d.png
It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
The first time the tool is run, it also makes another log (Addition.txt). Please copy and paste it to your reply also.

In your next reply, please submit:

JRT.txt

AdwCleaner report

Both reports from FRST

Thanks.

bob12a · March 31, 2015

Hi Bob,

Have you reset these yet?
No problem resetting the size and moving icons on desktop

Let's make sure that there's no PuP leftovers.

Thanks.

Thank you for your time hope this is the logs/files you want.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 6.4.8 (03.30.2015:1)

OS: Windows 7 Home Premium x86

Ran by BF2010 on 31/03/2015 at 7:23:00.75

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Registry Values

~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\RoboTaskBarIcon_RASAPI32

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\RoboTaskBarIcon_RASMANCS

~~~ Files

Successfully deleted: [File] "C:\Windows\wininit.ini"

~~~ Folders

Successfully deleted: [Folder] "C:\ProgramData\apn"

Successfully deleted: [Empty Folder] C:\Users\BF2010\appdata\local\{49370636-461B-49FC-AD38-4188C7857F16}

Successfully deleted: [Empty Folder] C:\Users\BF2010\appdata\local\{891E73BA-0BFE-448F-B192-CCA6B8C4480C}

Successfully deleted: [Empty Folder] C:\Users\BF2010\appdata\local\{8AC0045E-C2D1-4C23-BEF9-561E6512B533}

Successfully deleted: [Empty Folder] C:\Users\BF2010\appdata\local\{9D1F4CD2-2AEC-4373-866C-CC82BF51336C}

Successfully deleted: [Empty Folder] C:\Users\BF2010\appdata\local\{C770D582-55FB-4746-9E20-D1457D6DE08B}

~~~ FireFox

Successfully deleted: [File] C:\Users\BF2010\AppData\Roaming\mozilla\firefox\profiles\smtw6sxf.default-1424709629288\user.js

Emptied folder: C:\Users\BF2010\AppData\Roaming\mozilla\firefox\profiles\smtw6sxf.default-1424709629288\minidumps [5 files]

~~~ Event Viewer Logs were cleared

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on 31/03/2015 at 7:24:45.73

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 11-03-2015

Ran by BF2010 (administrator) on BF2010-PC on 31-03-2015 07:44:23

Running from C:\Users\BF2010\Desktop\unwanted for now\pete

Loaded Profiles: BF2010 (Available profiles: BF2010 & bob02)

Platform: Microsoft Windows 7 Home Premium (X86) OS Language: English (United States)

Internet Explorer Version 9 (Default browser: FF)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(Acronis) C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe

(Microsoft Corporation) C:\Program Files\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe

(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe

(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe

(Microsoft Corporation) C:\Program Files\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe

(Microsoft Corporation) C:\Windows\System32\CISVC.EXE

(ESET) C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe

(Google Inc.) C:\Program Files\Google\Update\1.3.26.9\GoogleCrashHandler.exe

(Paramount Software UK Ltd) C:\Program Files\Macrium\Reflect\ReflectService.exe

(ESET) C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe

(Google) C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

(Secunia) C:\Program Files\Secunia\PSI\psia.exe

(Siber Systems) C:\Program Files\Siber Systems\AI RoboForm\robotaskbaricon.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

(Google Inc.) C:\Users\BF2010\AppData\Local\Programs\Google\Google+ Auto Backup\Google+ Auto Backup.exe

(Google) C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

(Secunia) C:\Program Files\Secunia\PSI\psi_tray.exe

(Firetrust) C:\Program Files\FireTrust\MailWasher\MailWasherPro.exe

(TuneUp Software) C:\Program Files\TuneUp Utilities 2014\TuneUpUtilitiesService32.exe

(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Update Core\NvBackend.exe

(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE

(TuneUp Software) C:\Program Files\TuneUp Utilities 2014\TuneUpUtilitiesApp32.exe

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [egui] => C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [5088456 2014-10-01] (ESET)

HKLM\...\Run: [Google Desktop Search] => C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [30192 2010-06-10] (Google)

HKU\S-1-5-21-2785784116-2001642337-1380054423-1000\...\Run: [RoboForm] => C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe [110160 2015-03-04] (Siber Systems)

HKU\S-1-5-21-2785784116-2001642337-1380054423-1000\...\Run: [Google+ Auto Backup] => C:\Users\BF2010\AppData\Local\Programs\Google\Google+ Auto Backup\Google+ Auto Backup.exe [3754312 2015-02-13] (Google Inc.)

HKU\S-1-5-18\...\Run: [samsung.PCSync] => C:\Program Files\Samsung\Samsung PC Studio 7\PcSync2.exe [1294336 2009-06-04] (Nokia)

IFEO\taskmgr.exe: [Debugger] C:\Program Files\TuneUp Utilities 2014\PMLauncher.exe

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk

ShortcutTarget: Secunia PSI Tray.lnk -> C:\Program Files\Secunia\PSI\psi_tray.exe (Secunia)

Startup: C:\Users\BF2010\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MailWasherPro.lnk

ShortcutTarget: MailWasherPro.lnk -> C:\Program Files\FireTrust\MailWasher\MailWasherPro.exe (Firetrust)

Startup: C:\Users\bob2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Uninstall LastPass RunOnce.lnk

ShortcutTarget: Uninstall LastPass RunOnce.lnk -> C:\Program Files\Common Files\lpuninstall.exe ()

ShellIconOverlayIdentifiers: [GDriveBlacklistedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42} => C:\Program Files\Google\Drive\googledrivesync32.dll (Google)

ShellIconOverlayIdentifiers: [GDriveSharedEditOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} => C:\Program Files\Google\Drive\googledrivesync32.dll (Google)

ShellIconOverlayIdentifiers: [GDriveSharedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} => C:\Program Files\Google\Drive\googledrivesync32.dll (Google)

ShellIconOverlayIdentifiers: [GDriveSharedViewOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43} => C:\Program Files\Google\Drive\googledrivesync32.dll (Google)

ShellIconOverlayIdentifiers: [GDriveSyncedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40} => C:\Program Files\Google\Drive\googledrivesync32.dll (Google)

ShellIconOverlayIdentifiers: [GDriveSyncingOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41} => C:\Program Files\Google\Drive\googledrivesync32.dll (Google)

CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =

HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

HKU\S-1-5-21-2785784116-2001642337-1380054423-1000\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.roboform.com

HKU\S-1-5-21-2785784116-2001642337-1380054423-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.msn.com/?ocid=EIE9HP&PC=UP50

HKU\S-1-5-21-2785784116-2001642337-1380054423-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/en-gb/?ocid=iehp

SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =

SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =

SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =

BHO: RoboForm Toolbar Helper -> {724d43a9-0d85-11d4-9908-00400523e39a} -> C:\Program Files\Siber Systems\AI RoboForm\roboform.dll [2015-03-04] (Siber Systems Inc.)

BHO: Java Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_40\bin\ssv.dll [2015-03-06] (Oracle Corporation)

BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28] (Microsoft Corp.)

BHO: Evernote extension -> {92EF2EAD-A7CE-4424-B0DB-499CF856608E} -> C:\Program Files\Evernote\Evernote\EvernoteIE.dll [2015-03-03] (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)

BHO: Windows Live Messenger Companion Helper -> {9FDDE16B-836F-4806-AB1F-1455CBEFF289} -> C:\Program Files\Windows Live\Companion\companioncore.dll [2012-03-08] (Microsoft Corporation)

BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2014-07-14] (Microsoft Corporation)

BHO: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_40\bin\jp2ssv.dll [2015-03-06] (Oracle Corporation)

Toolbar: HKLM - &RoboForm Toolbar - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll [2015-03-04] (Siber Systems Inc.)

Toolbar: HKU\S-1-5-21-2785784116-2001642337-1380054423-1000 -> &RoboForm Toolbar - {724D43A0-0D85-11D4-9908-00400523E39A} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll [2015-03-04] (Siber Systems Inc.)

DPF: {5AE58FCF-6F6A-49B2-B064-02492C66E3F4} http://catalog.update.microsoft.com/v7/site/ClientControl/en/x86/MuCatalogWebControl.cab?1417862258607

DPF: {CAFEEFAC-0017-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_05-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_05-windows-i586.cab

Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2014-07-14] (Microsoft Corporation)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:

========

FF ProfilePath: C:\Users\BF2010\AppData\Roaming\Mozilla\Firefox\Profiles\smtw6sxf.default-1424709629288

FF Homepage: hxxp://start.roboform.com

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_16_0_0_305.dll [2015-03-05] ()

FF Plugin: @canon.com/MycameraPlugin -> C:\Program Files\Canon\ZoomBrowser EX\Program\NPCIG.dll [2008-10-15] (CANON INC.)

FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll [2014-05-22] (DivX, LLC.)

FF Plugin: @divx.com/DivX Web Player Plug-In,version=1.0.0 -> C:\Program Files\DivX\DivX Web Player\npdivx32.dll [2014-06-03] (DivX, LLC)

FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll [2013-10-07] (Google)

FF Plugin: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files\Google\Picasa3\npPicasa3.dll [2014-08-13] (Google, Inc.)

FF Plugin: @java.com/DTPlugin,version=11.40.2 -> C:\Program Files\Java\jre1.8.0_40\bin\dtplugin\npDeployJava1.dll [2015-03-06] (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=11.40.2 -> C:\Program Files\Java\jre1.8.0_40\bin\plugin2\npjp2.dll [2015-03-06] (Oracle Corporation)

FF Plugin: @Microsoft.com/DownloadManager,version=1.1 -> C:\Windows\ [2015-03-06] ()

FF Plugin: @microsoft.com/GENUINE -> C:\Windows\system32\Wat\npWatWeb.dll [2010-06-02] (Microsoft Corporation)

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-14] ( Microsoft Corporation)

FF Plugin: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)

FF Plugin: @microsoft.com/WLPG,version=15.4.3555.0308 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)

FF Plugin: @nvidia.com/3DVision -> C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll [2014-09-10] (NVIDIA Corporation)

FF Plugin: @nvidia.com/3DVisionStreaming -> C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2014-09-10] (NVIDIA Corporation)

FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-07] (Google Inc.)

FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-07] (Google Inc.)

FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)

FF Plugin HKU\S-1-5-21-2785784116-2001642337-1380054423-1000: @talk.google.com/GoogleTalkPlugin -> C:\Users\BF2010\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll [2015-01-27] (Google)

FF Plugin HKU\S-1-5-21-2785784116-2001642337-1380054423-1000: @talk.google.com/O1DPlugin -> C:\Users\BF2010\AppData\Roaming\Mozilla\plugins\npo1d.dll [2015-01-27] (Google)

FF Plugin HKU\S-1-5-21-2785784116-2001642337-1380054423-1000: @tools.google.com/Google Update;version=3 -> C:\Users\BF2010\AppData\Local\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-07] (Google Inc.)

FF Plugin HKU\S-1-5-21-2785784116-2001642337-1380054423-1000: @tools.google.com/Google Update;version=9 -> C:\Users\BF2010\AppData\Local\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-07] (Google Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npOGAPlugin.dll [2009-08-03] (Microsoft Corporation)

FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll [2014-09-12] (Adobe Systems Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin.dll [2015-02-24] (Apple Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll [2015-02-24] (Apple Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll [2015-02-24] (Apple Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll [2015-02-24] (Apple Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll [2015-02-24] (Apple Inc.)

FF Plugin ProgramFiles/Appdata: C:\Users\BF2010\AppData\Roaming\mozilla\plugins\npgoogletalk.dll [2015-01-27] (Google)

FF Plugin ProgramFiles/Appdata: C:\Users\BF2010\AppData\Roaming\mozilla\plugins\npo1d.dll [2015-01-27] (Google)

FF Extension: Anaglyph 3D - C:\Users\BF2010\AppData\Roaming\Mozilla\Firefox\Profiles\smtw6sxf.default-1424709629288\Extensions\anaglyph3d@internauta1024a.pl.xpi [2015-02-24]

FF Extension: No Name - C:\Program Files\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2014-07-14]

FF HKLM\...\Firefox\Extensions: [{22119944-ED35-4ab1-910B-E619EA06A115}] - C:\Program Files\Siber Systems\AI RoboForm\Firefox

FF Extension: RoboForm Toolbar for Firefox - C:\Program Files\Siber Systems\AI RoboForm\Firefox [2010-03-25]

FF HKU\S-1-5-21-2785784116-2001642337-1380054423-1000\...\Firefox\Extensions: [{22119944-ED35-4ab1-910B-E619EA06A115}] - C:\Program Files\Siber Systems\AI RoboForm\Firefox

Chrome:

=======

CHR dev: Chrome dev build detected! <======= ATTENTION

CHR Profile: C:\Users\BF2010\AppData\Local\Google\Chrome\User Data\Default

CHR Profile: C:\Users\BF2010\AppData\Local\Google\Chrome\User Data\Profile 4

CHR Extension: (eSpeedCheck Start) - C:\Users\BF2010\AppData\Local\Google\Chrome\User Data\Profile 4\Extensions\ehchcmpfdjpoofcbkgaocnaogefilpci [2015-03-29]

CHR Extension: (My Search) - C:\Users\BF2010\AppData\Local\Google\Chrome\User Data\Profile 4\Extensions\igcjphndpn***fojcchcfeajgkgfefeb [2015-03-29]

CHR HKLM\...\Chrome\Extension: [jfmjfhklogoienhpfnppmbcbjfjnkonk] - No Path Or update_url value

CHR HKLM\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2014-07-14]

CHR HKLM\...\Chrome\Extension: [pnlccmojcmeohlpggmfnbbiapkmbliob] - C:\Program Files\Siber Systems\AI RoboForm\Chrome\rf-chrome.crx [2014-03-07]

CHR HKU\S-1-5-21-2785784116-2001642337-1380054423-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [apdfllckaahabafndbhieahigkjlhalf] - C:\Users\BF2010\AppData\Local\Google\Drive\apdfllckaahabafndbhieahigkjlhalf_live.crx [2014-12-16]

CHR HKU\S-1-5-21-2785784116-2001642337-1380054423-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh] - https://clients2.google.com/service/update2/crx

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AcrSch2Svc; C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe [821016 2012-04-27] (Acronis)

S4 afcdpsrv; C:\Program Files\Common Files\Acronis\CDP\afcdpsrv.exe [3459024 2012-05-15] (Acronis)

S4 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [276992 2014-04-17] (Advanced Micro Devices, Inc.) [File not signed]

R2 c2cautoupdatesvc; C:\Program Files\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)

R2 c2cpnrsvc; C:\Program Files\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)

R2 ekrn; C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe [1349576 2014-10-01] (ESET)

S4 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [915784 2014-09-17] (NVIDIA Corporation)

S4 GoogleDesktopManager-051210-111108; C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [30192 2010-06-10] (Google)

S4 IDriverT; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed]

S2 MBAMService; C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe [1080120 2015-03-17] (Malwarebytes Corporation)

S4 NvNetworkService; C:\Program Files\NVIDIA Corporation\NetService\NvNetworkService.exe [1795912 2014-09-17] (NVIDIA Corporation)

S4 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [18044744 2014-09-17] (NVIDIA Corporation)

R2 ReflectService.exe; C:\Program Files\Macrium\Reflect\ReflectService.exe [2462160 2014-07-21] (Paramount Software UK Ltd)

R2 Secunia PSI Agent; C:\Program Files\Secunia\PSI\PSIA.exe [1229528 2013-12-06] (Secunia)

S2 Secunia Update Agent; C:\Program Files\Secunia\PSI\sua.exe [662232 2013-12-06] (Secunia)

S4 ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [620544 2008-11-11] (Nokia.) [File not signed]

S4 SwitchBoard; C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]

S4 syncagentsrv; C:\Program Files\Common Files\Acronis\SyncAgent\syncagentsrv.exe [5914912 2012-04-27] (Acronis)

R2 TuneUp.UtilitiesSvc; C:\Program Files\TuneUp Utilities 2014\TuneUpUtilitiesService32.exe [1781048 2014-07-16] (TuneUp Software)

R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2009-07-14] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R0 amdide; C:\Windows\System32\DRIVERS\amdide.sys [11832 2009-07-07] (Advanced Micro Devices Inc.)

R0 amd_sata; C:\Windows\System32\DRIVERS\amd_sata.sys [70464 2014-07-14] (Advanced Micro Devices)

R0 amd_xata; C:\Windows\System32\DRIVERS\amd_xata.sys [34624 2014-07-14] (Advanced Micro Devices)

R2 AODDriver4.3; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\i386\AODDriver2.sys [50400 2014-02-11] (Advanced Micro Devices)

S3 AtiHdmiService; C:\Windows\System32\drivers\AtiHdmi.sys [100352 2009-11-19] (ATI Technologies, Inc.) [File not signed]

S3 btmhsf; C:\Windows\System32\DRIVERS\btmhsf.sys [225280 2011-07-19] (Intel Corporation)

S3 cpudrv; C:\Program Files\SystemRequirementsLab\cpudrv.sys [11336 2011-06-02] ()

R1 eamonm; C:\Windows\System32\DRIVERS\eamonm.sys [191928 2014-08-18] (ESET)

R1 ehdrv; C:\Windows\System32\DRIVERS\ehdrv.sys [135296 2014-08-18] (ESET)

R2 epfwwfpr; C:\Windows\System32\DRIVERS\epfwwfpr.sys [123424 2014-09-18] (ESET)

S3 iBtFltCoex; C:\Windows\System32\DRIVERS\iBtFltCoex.sys [47104 2011-07-20] (Intel Corporation)

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2015-03-17] (Malwarebytes Corporation)

S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2015-03-17] (Malwarebytes Corporation)

S3 NuidFltr; C:\Windows\System32\DRIVERS\NuidFltr.sys [25712 2013-05-13] (Microsoft Corporation)

S3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19272 2014-09-17] (NVIDIA Corporation)

R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad32v.sys [32928 2014-09-04] (NVIDIA Corporation)

R3 PSI; C:\Windows\System32\DRIVERS\psi_mf_x86.sys [16024 2013-12-06] (Secunia)

R0 pssnap; C:\Windows\System32\DRIVERS\pssnap.sys [16024 2012-04-26] (Macrium Software)

S3 ss_bbus; C:\Windows\System32\DRIVERS\ss_bbus.sys [98432 2009-09-19] (MCCI)

S3 ss_bmdfl; C:\Windows\System32\DRIVERS\ss_bmdfl.sys [14848 2009-09-19] (MCCI Corporation)

S3 ss_bmdm; C:\Windows\System32\DRIVERS\ss_bmdm.sys [123648 2009-09-19] (MCCI Corporation)

R0 tdrpman; C:\Windows\System32\DRIVERS\tdrpman.sys [775232 2012-05-15] (Acronis)

R3 TuneUpUtilitiesDrv; C:\Program Files\TuneUp Utilities 2014\TuneUpUtilitiesDriver32.sys [12320 2014-06-23] (TuneUp Software)

S3 USBPNPA; C:\Windows\System32\drivers\CM108.sys [1310720 2007-06-28] (C-Media Inc)

R0 vididr; C:\Windows\System32\DRIVERS\vididr.sys [126880 2012-05-15] (Acronis)

R0 vidsflt67; C:\Windows\System32\DRIVERS\vsflt67.sys [86496 2012-05-15] (Acronis)

S3 BTWAMPFL; system32\DRIVERS\btwampfl.sys [X]

S3 btwaudio; system32\drivers\btwaudio.sys [X]

S3 btwavdt; system32\DRIVERS\btwavdt.sys [X]

S3 btwl2cap; system32\DRIVERS\btwl2cap.sys [X]

S3 btwrchid; system32\DRIVERS\btwrchid.sys [X]

S3 DrvAgent32; \??\C:\Windows\system32\Drivers\DrvAgent32.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)

==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-31 07:32 - 2015-03-31 07:32 - 02208768 _____ () C:\Users\BF2010\Downloads\adwcleaner_4.200.exe

2015-03-31 07:24 - 2015-03-31 07:24 - 00001765 _____ () C:\Users\BF2010\Desktop\JRT.txt

2015-03-31 07:22 - 2015-03-31 07:22 - 01389097 _____ (Thisisu) C:\Users\BF2010\Downloads\JRT (8).exe

2015-03-31 07:20 - 2015-03-31 07:20 - 01389097 _____ (Thisisu) C:\Users\BF2010\Downloads\JRT (7).exe

2015-03-30 08:51 - 2015-03-30 08:51 - 00001048 _____ () C:\Users\BF2010\Desktop\mwb 30march.txt

2015-03-30 08:03 - 2015-03-30 08:03 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2015-03-30 08:01 - 2015-03-30 08:01 - 00001028 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2015-03-30 08:01 - 2015-03-30 08:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2015-03-30 08:01 - 2015-03-30 08:01 - 00000000 ____D () C:\ProgramData\Malwarebytes

2015-03-30 08:01 - 2015-03-30 08:01 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware

2015-03-30 08:01 - 2015-03-17 06:15 - 00092888 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2015-03-30 08:01 - 2015-03-17 06:15 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2015-03-30 08:01 - 2015-03-17 06:15 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2015-03-30 07:54 - 2015-03-30 07:53 - 21540440 _____ (Malwarebytes Corporation ) C:\Users\BF2010\Desktop\mbam-setup-2.1.4.1018 (1).exe

2015-03-30 07:53 - 2015-03-30 07:53 - 21540440 _____ (Malwarebytes Corporation ) C:\Users\BF2010\Downloads\mbam-setup-2.1.4.1018 (1).exe

2015-03-30 07:24 - 2015-03-30 07:24 - 00321848 _____ (Malwarebytes Corporation) C:\Users\BF2010\Downloads\mbam-clean-2.1.1.1001 (1).exe

2015-03-29 18:21 - 2015-03-29 18:22 - 00321848 _____ (Malwarebytes Corporation) C:\Users\BF2010\Downloads\mbam-clean-2.1.1.1001.exe

2015-03-29 16:31 - 2015-03-29 16:31 - 00002096 _____ () C:\Users\BF2010\Downloads\BTW Performance Test EE.html

2015-03-29 16:31 - 2015-03-29 16:31 - 00000000 ____D () C:\Users\BF2010\Downloads\BTW Performance Test EE_files

2015-03-29 16:23 - 2015-03-29 16:23 - 00000120 _____ () C:\Users\BF2010\Documents\EEORANGE.txt

2015-03-29 09:45 - 2015-03-29 09:45 - 00000054 _____ () C:\Users\BF2010\Documents\NEW PHONE.txt

2015-03-27 16:32 - 2015-03-27 16:32 - 00118195 _____ () C:\mal test 02 27th feb.txt

2015-03-27 16:30 - 2015-03-27 16:30 - 00117922 _____ () C:\mal test 27th feb.txt

2015-03-26 17:10 - 2015-03-26 17:10 - 00001785 _____ () C:\Users\BF2010\Downloads\IShouldntEvenBeDoingThis.acsm

2015-03-26 13:04 - 2015-03-27 13:38 - 00000000 ____D () C:\Windows\system32\SPReview

2015-03-26 12:59 - 2015-03-11 02:55 - 00818176 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll

2015-03-26 12:59 - 2015-03-11 02:55 - 00623616 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll

2015-03-26 12:59 - 2015-03-11 02:55 - 00534528 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll

2015-03-26 12:59 - 2015-03-11 02:55 - 00327168 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll

2015-03-26 12:59 - 2015-03-11 02:55 - 00202752 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll

2015-03-26 12:59 - 2015-03-11 02:55 - 00026112 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll

2015-03-26 12:59 - 2015-03-11 02:52 - 00892928 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

2015-03-25 19:11 - 2015-03-25 19:11 - 00001786 _____ () C:\Users\BF2010\Downloads\DanBrownEnigma9781843584582.acsm

2015-03-24 15:36 - 2015-03-24 15:37 - 21540440 _____ (Malwarebytes Corporation ) C:\Users\BF2010\Downloads\mbam-setup-2.1.4.1018.exe

2015-03-24 15:33 - 2015-03-24 15:33 - 00880208 _____ (Google Inc.) C:\Users\BF2010\Downloads\ChromeSetup (6).exe

2015-03-24 15:32 - 2015-03-24 15:32 - 00001932 _____ () C:\Users\BF2010\Desktop\FileHippo App Manager.lnk

2015-03-24 15:30 - 2015-03-24 15:30 - 00849352 _____ () C:\Users\BF2010\Downloads\AppManagerSetup_1.47.exe

2015-03-24 15:24 - 2015-03-24 15:24 - 01380448 _____ (Skype Technologies S.A.) C:\Users\BF2010\Downloads\SkypeSetup (12).exe

2015-03-24 12:33 - 2015-03-24 12:33 - 00000000 ____D () C:\Users\BF2010\Desktop\01 RIGHT 2015

2015-03-24 12:32 - 2015-03-24 12:33 - 00000000 ____D () C:\Users\BF2010\Desktop\01 LEFT 2015

2015-03-12 11:35 - 2015-03-12 11:35 - 00880208 _____ (Google Inc.) C:\Users\BF2010\Downloads\googledrivesync(1).exe

2015-03-12 10:35 - 2015-03-12 10:35 - 00880208 _____ (Google Inc.) C:\Users\BF2010\Downloads\ChromeSetup(1).exe

2015-03-11 16:47 - 2015-03-30 10:05 - 00036472 _____ () C:\Windows\PFRO.log

2015-03-11 16:41 - 2015-03-11 16:41 - 00243368 _____ () C:\Users\BF2010\Downloads\Firefox Setup Stub 36.0.1.exe

2015-03-10 18:29 - 2015-03-10 18:29 - 00000000 ____D () C:\Users\bob02\AppData\Local\NVIDIA

2015-03-10 13:15 - 2015-03-10 13:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Evernote

2015-03-10 08:25 - 2015-03-11 16:47 - 00000000 ____D () C:\Program Files\Mozilla Firefox

2015-03-08 17:08 - 2015-03-08 17:08 - 00880208 _____ (Google Inc.) C:\Users\BF2010\Downloads\ChromeSetup (5).exe

2015-03-08 10:15 - 2015-03-08 10:25 - 00000000 ____D () C:\Users\BF2010\Downloads\stphmkre506

2015-03-08 10:15 - 2014-09-30 18:37 - 03223552 _____ (Masuji SUTO & David Sykes) C:\Users\BF2010\Desktop\stphmkre.exe

2015-03-08 10:14 - 2014-09-30 18:37 - 03223552 _____ (Masuji SUTO & David Sykes) C:\Program Files\stphmkre.exe

2015-03-08 09:00 - 2015-03-08 09:00 - 01332608 _____ () C:\Users\BF2010\Downloads\stphmkre506.zip

2015-03-06 11:59 - 2015-03-06 12:03 - 396170445 _____ (NVIDIA Corporation ) C:\Users\BF2010\Downloads\NVIDIA 3D Vision PowerPack - Santa Cruz Beach Boardwalk (MPO).exe

2015-03-06 11:53 - 2015-03-06 11:53 - 00000000 ____D () C:\Users\BF2010\AppData\Roaming\Oracle

2015-03-06 11:39 - 2014-09-10 17:58 - 00608072 _____ (NVIDIA Corporation) C:\Windows\system32\nvStreaming.exe

2015-03-06 11:36 - 2015-03-06 11:36 - 00000000 ____D () C:\temp

2015-03-06 11:32 - 2014-09-11 01:39 - 00162592 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvhda32v.sys

2015-03-06 11:32 - 2014-09-11 01:39 - 00028448 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdap32.dll

2015-03-06 11:32 - 2014-09-11 01:31 - 00021316 _____ () C:\Windows\system32\nvinfo.pb

2015-03-06 11:32 - 2014-09-11 01:30 - 01053384 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco3234082.dll

2015-03-06 11:32 - 2014-09-11 01:30 - 00906568 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco3234082.dll

2015-03-06 11:32 - 2014-09-10 21:46 - 11283384 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll

2015-03-06 11:32 - 2014-09-10 21:46 - 11222088 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll

2015-03-06 11:32 - 2014-09-10 21:46 - 00305648 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim32.dll

2015-03-06 11:32 - 2014-09-10 21:45 - 15295296 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll

2015-03-06 11:32 - 2014-09-10 21:45 - 00846880 _____ (NVIDIA Corporation) C:\Windows\system32\nvumdshim.dll

2015-03-06 11:32 - 2014-09-10 21:45 - 00146528 _____ (NVIDIA Corporation) C:\Windows\system32\nvinit.dll

2015-03-06 11:32 - 2014-09-10 21:44 - 16122896 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2um.dll

2015-03-06 11:31 - 2014-09-10 21:46 - 03986632 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll

2015-03-06 11:31 - 2014-09-10 21:46 - 00905928 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR.dll

2015-03-06 11:31 - 2014-09-10 21:46 - 00867016 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC.dll

2015-03-06 11:31 - 2014-09-10 21:44 - 24549184 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv32.dll

2015-03-06 11:31 - 2014-09-10 21:44 - 10680008 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys

2015-03-06 11:28 - 2015-03-06 11:29 - 227607528 _____ (NVIDIA Corporation) C:\Users\BF2010\Downloads\340.82_geforce_win8_winvista_win7_international.exe

2015-03-06 10:56 - 2015-03-31 07:38 - 00003212 _____ () C:\Windows\setupact.log

2015-03-06 10:56 - 2015-03-06 10:56 - 00000000 _____ () C:\Windows\setuperr.log

2015-03-06 10:51 - 2015-03-06 10:51 - 02085240 _____ (NVIDIA Corporation ) C:\Users\BF2010\Downloads\NVIDIA_3D_Vision_v266.21_driver.exe

2015-03-06 09:14 - 2015-03-06 09:14 - 00000000 ____D () C:\Program Files\Common Files\Java

2015-03-06 09:14 - 2015-03-06 09:13 - 00096680 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll

2015-03-06 09:13 - 2015-03-10 08:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java

2015-03-06 09:10 - 2015-03-06 09:11 - 00561576 _____ (Oracle Corporation) C:\Users\BF2010\Downloads\chromeinstall-8u40.exe

2015-03-05 08:50 - 2015-03-05 08:50 - 00000995 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Secunia PSI.lnk

2015-03-04 11:05 - 2015-03-04 11:05 - 16441032 _____ (Siber Systems) C:\Users\BF2010\Downloads\RoboForm-Setup(3).exe

2015-03-04 08:35 - 2015-03-04 08:36 - 22893912 _____ (Siber Systems) C:\Users\BF2010\Downloads\GoodSync-Setup(1).exe

2015-03-01 15:53 - 2015-03-01 15:54 - 16441032 _____ (Siber Systems) C:\Users\BF2010\Downloads\RoboForm-Setup(2).exe

2015-03-01 15:52 - 2015-03-01 15:52 - 16441032 _____ (Siber Systems) C:\Users\BF2010\Downloads\RoboForm-Setup(1).exe

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-31 07:44 - 2014-10-23 11:19 - 00000000 ____D () C:\FRST

2015-03-31 07:44 - 2011-04-10 11:39 - 01212330 _____ () C:\Windows\WindowsUpdate.log

2015-03-31 07:43 - 2015-02-07 08:38 - 00000860 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2785784116-2001642337-1380054423-1000Core1d042a91e5b5bc2.job

2015-03-31 07:43 - 2014-07-18 16:09 - 00000912 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2785784116-2001642337-1380054423-1000UA.job

2015-03-31 07:43 - 2014-07-18 16:09 - 00000860 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2785784116-2001642337-1380054423-1000Core.job

2015-03-31 07:38 - 2015-02-07 08:53 - 00000882 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore1d042ab334f8992.job

2015-03-31 07:38 - 2014-07-25 10:36 - 00000882 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2015-03-31 07:38 - 2011-10-26 17:36 - 00000000 ____D () C:\ProgramData\NVIDIA

2015-03-31 07:38 - 2009-07-14 05:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2015-03-31 07:37 - 2010-03-25 11:47 - 00000000 ____D () C:\Users\BF2010

2015-03-31 07:36 - 2013-09-27 16:51 - 00000000 ____D () C:\AdwCleaner

2015-03-31 07:17 - 2009-07-14 05:34 - 00015792 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2015-03-31 07:17 - 2009-07-14 05:34 - 00015792 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2015-03-30 19:58 - 2015-02-07 08:53 - 00000886 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA1d042ab34e17a14.job

2015-03-30 19:58 - 2014-07-25 10:36 - 00000886 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2015-03-30 17:43 - 2013-07-14 07:05 - 00000000 ____D () C:\Users\BF2010\Desktop\PHEREO PICS

2015-03-29 08:13 - 2010-02-15 17:52 - 00127016 _____ () C:\Windows\system32\PerfStringBackup.INI

2015-03-28 09:08 - 2010-06-07 15:40 - 00000000 ___RD () C:\Users\BF2010\Desktop\unwanted for now

2015-03-27 13:38 - 2014-12-23 15:21 - 00000000 ____D () C:\Program Files\Common Files\Skype

2015-03-27 13:38 - 2014-12-13 13:18 - 00000000 ____D () C:\Windows\system32\appraiser

2015-03-27 13:38 - 2014-08-19 18:10 - 00000000 ___RD () C:\Program Files\Skype

2015-03-27 13:38 - 2014-07-11 13:19 - 00000000 ___SD () C:\Windows\system32\CompatTel

2015-03-27 13:38 - 2014-01-07 08:25 - 00000000 ____D () C:\Users\BF2010\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google+ Auto Backup

2015-03-27 13:38 - 2010-05-14 11:51 - 00000000 ____D () C:\ProgramData\Skype

2015-03-27 13:38 - 2010-03-26 11:45 - 00000000 ____D () C:\Users\BF2010\AppData\Roaming\IrfanView

2015-03-27 13:38 - 2010-03-26 09:54 - 00000000 ____D () C:\Program Files\FileHippo.com

2015-03-27 13:38 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\registration

2015-03-26 13:30 - 2013-08-14 06:56 - 00000000 ____D () C:\Windows\system32\MRT

2015-03-26 13:08 - 2010-02-16 11:43 - 119837696 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2015-03-25 07:42 - 2010-05-14 11:52 - 00000000 ____D () C:\Users\BF2010\AppData\Roaming\Skype

2015-03-24 15:54 - 2014-05-28 10:21 - 00000000 ____D () C:\Users\BF2010\Desktop\hals 3d

2015-03-24 15:19 - 2012-09-04 06:59 - 00000000 ___RD () C:\Users\BF2010\Desktop\quick

2015-03-24 12:01 - 2010-04-07 08:57 - 00000000 ____D () C:\ProgramData\ZoomBrowser

2015-03-14 19:00 - 2011-05-20 14:22 - 00000000 ____D () C:\Users\BF2010\AppData\Roaming\GoodSync

2015-03-14 15:28 - 2011-01-31 08:18 - 00000000 ____D () C:\Users\BF2010\AppData\Local\CrashDumps

2015-03-12 12:38 - 2014-11-27 11:07 - 00000000 ____D () C:\Program Files\OpenOffice 4

2015-03-12 12:35 - 2014-11-27 11:49 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenOffice 4.1.1

2015-03-12 11:36 - 2012-05-03 12:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive

2015-03-11 16:47 - 2015-02-17 16:12 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service

2015-03-11 16:44 - 2015-02-17 16:12 - 00001085 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk

2015-03-11 16:44 - 2015-02-17 16:12 - 00001073 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk

2015-03-11 16:23 - 2015-02-10 12:58 - 00000000 ____D () C:\Users\BF2010\AppData\Local\Windows Live

2015-03-10 18:29 - 2015-01-31 11:27 - 00000000 ____D () C:\Users\bob02\AppData\Local\Google

2015-03-10 18:25 - 2013-12-19 12:05 - 10392120 _____ () C:\Program Files\Common Files\lpuninstall.exe

2015-03-10 14:09 - 2014-10-19 08:52 - 00032620 _____ () C:\Windows\Tasks\SCHEDLGU.TXT

2015-03-10 08:55 - 2014-09-18 14:04 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation

2015-03-10 08:55 - 2014-09-18 11:46 - 00000000 ____D () C:\Program Files\NVIDIA Corporation

2015-03-10 08:55 - 2012-02-21 18:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RoboForm

2015-03-10 08:54 - 2010-04-20 11:25 - 00000000 ____D () C:\Windows\pss

2015-03-10 08:54 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\security

2015-03-10 08:54 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\Help

2015-03-06 09:12 - 2010-02-16 15:49 - 00000000 ____D () C:\Program Files\Java

2015-03-06 08:12 - 2011-08-13 12:27 - 00000000 ___RD () C:\Users\BF2010\Dropbox

2015-03-06 08:12 - 2011-08-13 12:24 - 00000000 ____D () C:\Users\BF2010\AppData\Roaming\Dropbox

2015-03-05 15:24 - 2011-12-09 19:15 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2015-03-05 08:52 - 2011-12-09 19:15 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe

2015-03-05 08:52 - 2011-09-09 07:22 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl

==================== Files in the root of some directories =======

2014-10-13 15:58 - 2011-02-20 00:03 - 0421200 _____ (Microsoft Corporation) C:\Program Files\msvcp100.dll

2014-10-13 15:58 - 2011-02-19 01:40 - 0773968 _____ (Microsoft Corporation) C:\Program Files\msvcr100.dll

2015-03-08 10:14 - 2014-09-30 18:37 - 3223552 _____ (Masuji SUTO & David Sykes) C:\Program Files\stphmkre.exe

2013-12-19 12:05 - 2015-03-10 18:25 - 10392120 _____ () C:\Program Files\Common Files\lpuninstall.exe

2010-10-09 09:39 - 2012-04-14 12:57 - 0000132 _____ () C:\Users\BF2010\AppData\Roaming\Adobe BMP Format CS5 Prefs

2010-10-22 15:45 - 2012-07-20 06:58 - 0000132 _____ () C:\Users\BF2010\AppData\Roaming\Adobe PNG Format CS5 Prefs

2010-08-12 12:50 - 2010-08-12 12:50 - 0038429 _____ () C:\Users\BF2010\AppData\Roaming\Comma Separated Values (DOS).ADR

2010-03-31 16:42 - 2011-11-07 13:00 - 0000141 _____ () C:\Users\BF2010\AppData\Roaming\default.rss

2010-06-01 15:31 - 2010-06-01 15:31 - 0000000 _____ () C:\Users\BF2010\AppData\Roaming\downloads.m3u

2014-11-16 17:53 - 2014-11-16 18:48 - 0000115 _____ () C:\Users\BF2010\AppData\Roaming\LogFile.txt

2010-06-25 06:54 - 2010-06-25 06:55 - 0000195 _____ () C:\Users\BF2010\AppData\Roaming\ltbpr.dat

2010-06-30 15:28 - 2010-07-12 17:26 - 0038131 _____ () C:\Users\BF2010\AppData\Roaming\mdbu.bin

2014-10-20 10:20 - 2014-10-20 10:20 - 0000528 _____ () C:\Users\BF2010\AppData\Roaming\NMM-MetaData.db

2012-05-02 10:45 - 2012-11-04 18:32 - 0282624 _____ () C:\Users\BF2010\AppData\Roaming\SettingsDB.sdf

2011-07-27 09:54 - 2012-08-12 10:30 - 0000268 ___RH () C:\Users\BF2010\AppData\Roaming\Static Library

2011-12-22 16:27 - 2014-10-16 06:57 - 0000268 ___RH () C:\Users\BF2010\AppData\Roaming\StatusSheet

2011-07-27 09:54 - 2012-08-12 10:30 - 0000268 ___RH () C:\Users\BF2010\AppData\Roaming\Stingers

2012-08-12 07:03 - 2014-07-11 16:06 - 0000000 _____ () C:\Users\BF2010\AppData\Roaming\Synth Textures

2014-10-21 16:43 - 2014-10-22 11:21 - 0000067 _____ () C:\Users\BF2010\AppData\Roaming\WB.CFG

2010-09-13 12:54 - 2014-04-04 07:46 - 0001456 _____ () C:\Users\BF2010\AppData\Local\Adobe Save for Web 12.0 Prefs

2010-03-26 18:52 - 2013-02-28 16:48 - 0033280 _____ () C:\Users\BF2010\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

2014-10-19 15:56 - 2014-10-19 15:56 - 0000001 _____ () C:\Users\BF2010\AppData\Local\DSI.DAT

2010-10-30 15:27 - 2014-04-13 09:06 - 0007648 _____ () C:\Users\BF2010\AppData\Local\resmon.resmoncfg

2011-08-13 16:24 - 2011-08-13 16:24 - 0000000 _____ () C:\Users\BF2010\AppData\Local\{CB311B15-645B-467F-AB72-A373C4B2F9EB}

2011-04-17 08:09 - 2011-04-17 08:14 - 0000088 __RSH () C:\ProgramData\DE100F8271.sys

2014-07-15 08:37 - 2014-07-15 08:37 - 0000000 ____H () C:\ProgramData\DP45977C.lfl

2010-05-14 12:23 - 2010-05-14 12:23 - 0000056 ____H () C:\ProgramData\ezsidmv.dat

2011-04-17 08:09 - 2011-04-17 08:19 - 0002828 ___SH () C:\ProgramData\KGyGaAvL.sys

2012-08-12 07:02 - 2014-07-11 16:06 - 0000000 ____H () C:\ProgramData\PKP_DLeo.DAT

2011-07-27 09:54 - 2014-10-16 06:57 - 0000020 ____H () C:\ProgramData\PKP_DLes.DAT

2011-07-27 09:54 - 2014-10-19 10:26 - 0000020 ____H () C:\ProgramData\PKP_DLet.DAT

2011-07-27 09:54 - 2014-02-04 17:29 - 0000020 ____H () C:\ProgramData\PKP_DLev.DAT

2012-08-12 08:45 - 2012-08-12 08:45 - 0000000 _____ () C:\ProgramData\StartupItems

2012-08-12 08:45 - 2012-08-12 08:45 - 0000000 _____ () C:\ProgramData\StatusSheet

2012-08-12 10:30 - 2012-08-12 10:30 - 0000268 ___RH () C:\ProgramData\String Ensemble

2014-10-16 06:57 - 2014-10-16 06:57 - 0000268 ___RH () C:\ProgramData\Strings

2012-08-12 10:30 - 2012-08-12 10:30 - 0000268 ___RH () C:\ProgramData\Super Strings

2014-10-16 06:57 - 2014-10-16 06:57 - 0000012 ___RH () C:\ProgramData\Textures

2012-08-12 10:30 - 2012-08-12 10:30 - 0000012 ___RH () C:\ProgramData\Track Settings

Some content of TEMP:

====================

C:\Users\BF2010\AppData\Local\Temp\APNSetup.exe

C:\Users\BF2010\AppData\Local\Temp\C-Users-BF2010-Downloads-stphmkre506.zip-stphmkre.exe

C:\Users\BF2010\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpforaoy.dll

C:\Users\BF2010\AppData\Local\Temp\nvStInst.exe

C:\Users\BF2010\AppData\Local\Temp\Quarantine.exe

C:\Users\BF2010\AppData\Local\Temp\sqlite3.dll

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\system32\winlogon.exe => File is digitally signed

C:\Windows\system32\wininit.exe => File is digitally signed

C:\Windows\system32\svchost.exe => File is digitally signed

C:\Windows\system32\services.exe => File is digitally signed

C:\Windows\system32\User32.dll => File is digitally signed

C:\Windows\system32\userinit.exe => File is digitally signed

C:\Windows\system32\rpcss.dll => File is digitally signed

C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2015-03-25 15:21

==================== End Of Log ============================

# AdwCleaner v4.200 - Logfile created 31/03/2015 at 07:35:57

# Updated 29/03/2015 by Xplode

# Database : 2015-03-29.1 [server]

# Operating system : Windows 7 Home Premium (x86)

# Username : BF2010 - BF2010-PC

# Running from : C:\Users\BF2010\Downloads\adwcleaner_4.200.exe

# Option : Cleaning

***** [ Services ] *****

***** [ Files / Folders ] *****

Folder Deleted : C:\ProgramData\Driver Manager

Folder Deleted : C:\Program Files\TotalSystemCare

Folder Deleted : C:\Program Files\DriverTuner

Folder Deleted : C:\Program Files\Driver Manager

[!] Folder Deleted : C:\Users\BF2010\hosts

Folder Deleted : C:\Users\BF2010\AppData\Local\DriverTuner

Folder Deleted : C:\Users\BF2010\AppData\Local\StormFall

Folder Deleted : C:\Users\bob2\AppData\Local\Google\Chrome\User Data\Default\Extensions\eekjldapjblgadclklmgolijbagmdnfk

File Deleted : C:\Users\bob2\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_eekjldapjblgadclklmgolijbagmdnfk_0.localstorage

File Deleted : C:\Users\bob2\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_eekjldapjblgadclklmgolijbagmdnfk_0.localstorage-journal

File Deleted : C:\Users\bob2\AppData\Local\Google\Chrome\User Data\Default\databases\chrome-extension_eekjldapjblgadclklmgolijbagmdnfk_0

***** [ Scheduled tasks ] *****

***** [ Shortcuts ] *****

***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\mjdepfkicdcciagbigfcmdhknnoaaegf

Key Deleted : HKLM\SOFTWARE\Classes\AppID\REI_AxControl.DLL

Key Deleted : HKLM\SOFTWARE\Classes\REI_AxControl.ReiEngine.1

Key Deleted : HKLM\SOFTWARE\Classes\REI_AxControl.ReiEngine

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{28FF42B8-A0DA-4BE5-9B81-E26DD59B350A}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{10ECCE17-29B5-4880-A8F5-EAD298611484}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{801B440B-1EE3-49B0-B05D-2AB076D4E8CB}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9BB31AD8-5DB2-459E-A901-DEA536F23BA4}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{BD51A48E-EB5F-4454-8774-EF962DF64546}

Key Deleted : HKCU\Software\DriverTuner_Init

Key Deleted : HKCU\Software\DriverTuner

Key Deleted : HKLM\SOFTWARE\TotalSystemCare

Data Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyOverride] - <local>

***** [ Web browsers ] *****

-\\ Internet Explorer v9.0.8112.16599

-\\ Mozilla Firefox v36.0.1 (x86 en-US)

-\\ Google Chrome v43.0.2342.2

[C:\Users\BF2010\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [search Provider] : hxxp://slirsredirect.search.aol.com/redirector/sredir?sredir=2706&query={searchTerms}&invocationType=tb50-ie-aim-chromesbox-en-us&tb_uuid=20120113144702133&tb_oid=13-01-2012&tb_mrud=13-01-2012

[C:\Users\BF2010\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [search Provider] : hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=dnldmsd&cd=2XzuyEtN2Y1L1QzuyEtDyCtCzzyCzyyDtCyCyB0EzzyB0F0DtN0D0Tzu0CyCtBtCtN1L2XzutBtFtBtFyEtFyBtAtCtN1L1Czu1Q1G1I1Q1H1B1Q&cr=1963939764&ir=

[C:\Users\BF2010\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [search Provider] : hxxp://isearch.avg.com/search?cid={2A2015BF-6395-48D3-B379-6487DAD9A87C}&mid=bb5fa39af0b147d0be1fd16b2f00eb96-7eb6571dbf07b5d1c1a910933d6d6d6b0c5f32d6&lang=en&ds=ft011&pr=sa&d=2012-06-25 11:43:53&v=14.2.0.1&pid=avg&sg=&sap=dsp&q={searchTerms}

[C:\Users\BF2010\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [search Provider] : hxxp://search.conduit.com/Results.aspx?ctid=CT3319613&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=2&UP=SP14A48A8A-755D-4FE4-909D-9F0D6F07A68D&q={searchTerms}&SSPV=

[C:\Users\BF2010\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [search Provider] : hxxp://search.conduit.com/Results.aspx?q={searchTerms}&SearchSource=49&CUI=UN38319773231728026&ctid=CT3289847&UM=2&sspv=CHNTI1

[C:\Users\BF2010\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [search Provider] : hxxp://search.conduit.com/Result***t.aspx?q={searchTerms}&SearchSource=4&ctid=CT3282134&CUI=UN79000941023695132

[C:\Users\BF2010\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [search Provider] : hxxp://feed.snap.do/?publisher=Download&dpid=Download&co=GB&userid=01f7e029-3f2c-4aa1-b9bf-5603c525bc08&searchtype=ds&q={searchTerms}

[C:\Users\BF2010\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [search Provider] : hxxp://www.crawler.com/search/dispatcher.aspx?tp=aus&qkw={searchTerms}&tbid=60308

[C:\Users\BF2010\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [search Provider] : hxxp://uk.ask.com/web?q={searchTerms}

[C:\Users\BF2010\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [search Provider] : hxxp://dts.search-results.com/sr?src=ieb&appid=101&systemid=406&sr=0&q={searchTerms}

[C:\Users\BF2010\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [search Provider] : hxxp://start.iminent.com/?appId=FB501CB0-7B16-4D7F-9B0F-46C293D57FC7&ref=toolbox&q={searchTerms}

[C:\Users\BF2010\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [search Provider] : hxxp://websearch.ask.com/redirect?client=ie&tb=X-TU&o=13983&src=kw&q={searchTerms}&locale=&apn_ptnrs=T3&apn_dtid=YYYYYYYYGB&apn_uid=e30a965a-29df-4a52-aa48-b8adeefed738&apn_sauid=A733475A-35C1-4804-9C7A-D6B2FB1804E4

[C:\Users\BF2010\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [search Provider] : hxxp://www.roboform.com/search-results?cx=015801006164109306571%3Ahfae6nedzr4&cof=FORID%3A11&ie=UTF-8&q={searchTerms}&commit=

[C:\Users\BF2010\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [search Provider] : hxxp://en.softonic.com/s/{searchTerms}

[C:\Users\bob02\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [search Provider] : hxxp://uk.ask.com/web?q={searchTerms}

[C:\Users\bob2\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [search Provider] : hxxp://slirsredirect.search.aol.com/redirector/sredir?sredir=2706&query={searchTerms}&invocationType=tb50-ie-aim-chromesbox-en-us&tb_uuid=20120113144702133&tb_oid=13-01-2012&tb_mrud=13-01-2012

[C:\Users\bob2\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [search Provider] : hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=dnldmsd&cd=2XzuyEtN2Y1L1QzuyEtDyCtCzzyCzyyDtCyCyB0EzzyB0F0DtN0D0Tzu0CyCtBtCtN1L2XzutBtFtBtFyEtFyBtAtCtN1L1Czu1Q1G1I1Q1H1B1Q&cr=1963939764&ir=

[C:\Users\bob2\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [search Provider] : hxxp://en.softonic.com/s/{searchTerms}

[C:\Users\bob2\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [search Provider] : hxxp://isearch.avg.com/search?cid={2A2015BF-6395-48D3-B379-6487DAD9A87C}&mid=bb5fa39af0b147d0be1fd16b2f00eb96-7eb6571dbf07b5d1c1a910933d6d6d6b0c5f32d6&lang=en&ds=ft011&pr=sa&d=2012-06-25 11:43:53&v=14.2.0.1&pid=avg&sg=&sap=dsp&q={searchTerms}

[C:\Users\bob2\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [search Provider] : hxxp://search.conduit.com/Results.aspx?ctid=CT3319613&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=2&UP=SP14A48A8A-755D-4FE4-909D-9F0D6F07A68D&q={searchTerms}&SSPV=

[C:\Users\bob2\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [search Provider] : hxxp://search.conduit.com/Results.aspx?q={searchTerms}&SearchSource=49&CUI=UN38319773231728026&ctid=CT3289847&UM=2&sspv=CHNTI1

[C:\Users\bob2\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [search Provider] : hxxp://www.roboform.com/search-results?cx=015801006164109306571%3Ahfae6nedzr4&cof=FORID%3A11&ie=UTF-8&q={searchTerms}&commit=

[C:\Users\bob2\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [search Provider] : hxxp://search.conduit.com/Result***t.aspx?q={searchTerms}&SearchSource=4&ctid=CT3282134&CUI=UN79000941023695132

[C:\Users\bob2\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [search Provider] : hxxp://feed.snap.do/?publisher=Download&dpid=Download&co=GB&userid=01f7e029-3f2c-4aa1-b9bf-5603c525bc08&searchtype=ds&q={searchTerms}

[C:\Users\bob2\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [search Provider] : hxxp://www.crawler.com/search/dispatcher.aspx?tp=aus&qkw={searchTerms}&tbid=60308

[C:\Users\bob2\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [search Provider] : hxxp://uk.ask.com/web?q={searchTerms}

[C:\Users\bob2\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [search Provider] : hxxp://dts.search-results.com/sr?src=ieb&appid=101&systemid=406&sr=0&q={searchTerms}

[C:\Users\bob2\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [search Provider] : hxxp://start.iminent.com/?appId=FB501CB0-7B16-4D7F-9B0F-46C293D57FC7&ref=toolbox&q={searchTerms}

[C:\Users\bob2\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [search Provider] : hxxp://websearch.ask.com/redirect?client=ie&tb=X-TU&o=13983&src=kw&q={searchTerms}&locale=&apn_ptnrs=T3&apn_dtid=YYYYYYYYGB&apn_uid=e30a965a-29df-4a52-aa48-b8adeefed738&apn_sauid=A733475A-35C1-4804-9C7A-D6B2FB1804E4

[C:\Users\bob2\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] - Deleted [Extension] : eekjldapjblgadclklmgolijbagmdnfk

[C:\Users\bob2\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] - Deleted [Homepage] : hxxp://start.mysearchdial.com/?f=1&a=dnldmsd&cd=2XzuyEtN2Y1L1QzuyEtDyCtCzzyCzyyDtCyCyB0EzzyB0F0DtN0D0Tzu0CyCtBtCtN1L2XzutBtFtBtFyEtFyBtAtCtN1L1Czu1Q1G1I1Q1H1B1Q&cr=1963939764&ir=

[C:\Users\bob2\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] - Deleted [startup_URLs] : hxxp://start.mysearchdial.com/?f=1&a=dnldmsd&cd=2XzuyEtN2Y1L1QzuyEtDyCtCzzyCzyyDtCyCyB0EzzyB0F0DtN0D0Tzu0CyCtBtCtN1L2XzutBtFtBtFyEtFyBtAtCtN1L1Czu1Q1G1I1Q1H1B1Q&cr=1963939764&ir=

[C:\Users\bob2\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] - Deleted [Default_Search_Provider_Data] :

-\\ Comodo Dragon v

-\\ Opera v0.0.0.0

-\\ Chrome Canary v

*************************

AdwCleaner[R0].txt - [1047 bytes] - [27/09/2013 16:54:27]

AdwCleaner[R1].txt - [1164 bytes] - [27/09/2013 17:43:44]

AdwCleaner[R2].txt - [4567 bytes] - [23/10/2014 15:25:28]

AdwCleaner[R3].txt - [8020 bytes] - [23/10/2014 15:28:09]

AdwCleaner[R4].txt - [3280 bytes] - [04/11/2014 17:00:41]

AdwCleaner[R5].txt - [6638 bytes] - [18/01/2015 11:18:36]

AdwCleaner[R6].txt - [6698 bytes] - [18/01/2015 15:50:24]

AdwCleaner[R7].txt - [1554 bytes] - [18/01/2015 16:03:25]

AdwCleaner[R8].txt - [40384 bytes] - [31/03/2015 07:33:02]

AdwCleaner[s0].txt - [1115 bytes] - [27/09/2013 16:55:10]

AdwCleaner[s1].txt - [1232 bytes] - [27/09/2013 17:44:54]

AdwCleaner[s2].txt - [8272 bytes] - [23/10/2014 15:33:14]

AdwCleaner[s3].txt - [3468 bytes] - [04/11/2014 17:03:23]

AdwCleaner[s4].txt - [6861 bytes] - [18/01/2015 15:53:15]

AdwCleaner[s5].txt - [1615 bytes] - [18/01/2015 16:05:50]

AdwCleaner[s6].txt - [11070 bytes] - [31/03/2015 07:35:57]

########## EOF - C:\AdwCleaner\AdwCleaner[s6].txt - [11130 bytes] ##########