1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Chrome Popups/LinkAds

Discussion in 'Windows - Virus and spyware problems' started by outoftune, Mar 24, 2014.

  1. outoftune

    outoftune Member

    Joined:
    May 31, 2006
    Messages:
    18
    Likes Received:
    0
    Trophy Points:
    11
    I have some malware which I have been trying to get rid of for some time but just can't seem to shake it. I get a lot of ads in chrome and even when I do a search additional add links appear on top of the list. I tried some programs out I have seen on here. Thanks in advance!

    # AdwCleaner v3.022 - Report created 24/03/2014 at 21:33:59
    # Updated 13/03/2014 by Xplode
    # Operating System : Windows 8.1 (64 bits)
    # Username : outof_000 - ASUS-LAPTOP
    # Running from : C:\Users\outof_000\Desktop\adwcleaner.exe
    # Option : Scan

    ***** [ Services ] *****


    ***** [ Files / Folders ] *****

    File Found : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Search.lnk
    File Found : C:\Users\outof_000\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_app.mam.conduit.com_0.localstorage
    File Found : C:\Users\outof_000\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_app.mam.conduit.com_0.localstorage-journal
    File Found : C:\Users\outof_000\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_fastcontent.conduit.com_0.localstorage
    File Found : C:\Users\outof_000\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_fastcontent.conduit.com_0.localstorage-journal
    File Found : C:\WINDOWS\System32\Tasks\SpyHunter4Startup
    Folder Found C:\Program Files (x86)\Conduit
    Folder Found C:\Program Files (x86)\WebConnect
    Folder Found C:\ProgramData\Conduit
    Folder Found C:\ProgramData\Microsoft\Windows\Start Menu\Programs\optimizer pro v3.2
    Folder Found C:\Users\outof_000\AppData\Local\emaze
    Folder Found C:\Users\outof_000\AppData\Local\WordLayers
    Folder Found C:\Users\outof_000\AppData\LocalLow\Conduit
    Folder Found C:\Users\outof_000\AppData\LocalLow\PriceGong

    ***** [ Shortcuts ] *****


    ***** [ Registry ] *****

    Key Found : HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}
    Key Found : HKCU\Software\AppDataLow\Software\Conduit
    Key Found : HKCU\Software\AppDataLow\Software\ConduitSearchScopes
    Key Found : HKCU\Software\AppDataLow\Software\SmartBar
    Key Found : HKCU\Software\Microsoft\Internet Explorer\DOMStorage\conduit.com
    Key Found : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\conduit.com
    Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
    Key Found : HKCU\Software\visualbee
    Key Found : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
    Key Found : [x64] HKCU\Software\visualbee
    Key Found : HKLM\Software\{1146AC44-2F03-4431-B4FD-889BC837521F}
    Key Found : HKLM\Software\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
    Key Found : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
    Key Found : HKLM\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}
    Key Found : HKLM\SOFTWARE\Classes\S
    Key Found : HKLM\SOFTWARE\Classes\Toolbar.CT3287806
    Key Found : HKLM\SOFTWARE\Classes\Toolbar.CT3291327
    Key Found : HKLM\Software\Conduit
    Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}
    Key Found : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchProtect

    ***** [ Browsers ] *****

    -\\ Internet Explorer v11.0.9600.16518


    -\\ Google Chrome v32.0.1700.76

    [ File : C:\Users\outof_000\AppData\Local\Google\Chrome\User Data\Default\preferences ]


    *************************

    AdwCleaner[R0].txt - [3110 octets] - [24/03/2014 21:33:59]

    ########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [3170 octets] ##########


    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    Junkware Removal Tool (JRT) by Thisisu
    Version: 6.1.3 (03.23.2014:1)
    OS: Windows 8.1 x64
    Ran by outof_000 on Mon 03/24/2014 at 21:42:45.89
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




    ~~~ Services



    ~~~ Registry Values



    ~~~ Registry Keys

    Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\AppDataLow\software\lyricsing



    ~~~ Files



    ~~~ Folders

    Successfully deleted: [Folder] "C:\Users\outof_000\appdata\local\cre"



    ~~~ Event Viewer Logs were cleared





    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    Scan was completed on Mon 03/24/2014 at 21:50:09.48
    End of JRT log
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     
  2. ddp

    ddp Moderator Staff Member

    Joined:
    Oct 15, 2004
    Messages:
    39,011
    Likes Received:
    77
    Trophy Points:
    128
    these are not good.
    File Found : C:\Users\outof_000\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_app.mam.conduit.com_0.localstorage
    File Found : C:\Users\outof_000\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_app.mam.conduit.com_0.localstorage-journal
    File Found : C:\Users\outof_000\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_fastcontent.conduit.com_0.localstorage
    File Found : C:\Users\outof_000\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_fastcontent.conduit.com_0.localstorage-journal

    Folder Found C:\Program Files (x86)\Conduit
    Folder Found C:\ProgramData\Conduit
    Folder Found C:\ProgramData\Microsoft\Windows\Start Menu\Programs\optimizer pro v3.2
    Folder Found C:\Users\outof_000\AppData\LocalLow\Conduit
    Folder Found C:\Users\outof_000\AppData\LocalLow\PriceGong

    Key Found : HKCU\Software\AppDataLow\Software\Conduit
    Key Found : HKCU\Software\AppDataLow\Software\ConduitSearchScopes
    Key Found : HKCU\Software\AppDataLow\Software\SmartBar
    Key Found : HKCU\Software\Microsoft\Internet Explorer\DOMStorage\conduit.com
    Key Found : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\conduit.com

    what anti-malware\spyware programs are you running or do you have any?
     
  3. aldan

    aldan Active member

    Joined:
    Mar 24, 2007
    Messages:
    1,522
    Likes Received:
    15
    Trophy Points:
    68
    good old conduit.i have to remove this from my kids machines at least once a month.
     
  4. outoftune

    outoftune Member

    Joined:
    May 31, 2006
    Messages:
    18
    Likes Received:
    0
    Trophy Points:
    11
    I believe when I first started having the problems I had AVG free. Following that I installed the full Webroot software through Ally. Then I have downloaded and run adaware and spybot.
     
  5. 2oldGeek

    2oldGeek Active member

    Joined:
    Jun 16, 2005
    Messages:
    3,687
    Likes Received:
    35
    Trophy Points:
    78
    Hi outoftune,

    If you need more help cleaning, follow these instructions:

    -Security Check-

    Download Security Check by screen317.
    Save it to your Desktop.

    Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
    A Notepad document should open automatically called checkup.txt; please post the contents of that document.



    --RogueKiller--

    • Download & SAVE to your Desktop RogueKiller for 32bit or Roguekiller for 64bit
    • Quit all programs that you may have started.
    • Please disconnect any USB or external drives from the computer before you run this scan!
    • For Vista or Windows 7, right-click and select "Run as Administrator to start"
    • For Windows XP, double-click to start.
    • Wait until pre-scan has finished ...
    • Then Click on "Scan" button
    • Wait until the Status box shows "Scan Finished"
    • click on "delete" < -- be sure to delete.
    • Wait until the Status box shows "Deleting Finished"
    • Click on "Report" and copy/paste the content of the Notepad into your next reply.
    • The log should be found in RKreport[1].txt on your Desktop
    • Exit/Close RogueKiller+



    -- Farbar Recovery Scan Tool --

    Please download Farbar Recovery Scan Tool and save it to your Desktop.

    Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, which will be the right version.


    * Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
    * Press Scan button.
    * It will produce a log called FRST.txt in the same directory the tool is run from.
    * Please copy and paste log back here.
    * The first time the tool is run it generates another log (Addition.txt - also located in the same directory as FRST.exe/FRST64.exe). Please also paste that along with the FRST.txt into your reply.



    Please paste the logs in your next reply.
    Let me know what problem persists.


    2oG
     
  6. outoftune

    outoftune Member

    Joined:
    May 31, 2006
    Messages:
    18
    Likes Received:
    0
    Trophy Points:
    11
    I should probably have mentioned I am running windows 8.1... so the first program didn't work. I ran the other two. Some of the issues appear to be gone but when I do a google search the correct results appear and then about 1 second later a bunch of add links appear at the top of the search results. Thanks again for the help.

    RogueKiller V8.8.15 _x64_ [Mar 27 2014] by Adlice Software
    mail : http://www.adlice.com/contact/
    Feedback : http://forum.adlice.com
    Website : http://www.adlice.com/softwares/roguekiller/
    Blog : http://www.adlice.com

    Operating System : Windows 8.1 (6.3.9200 ) 64 bits version
    Started in : Normal mode
    User : outof_000 [Admin rights]
    Mode : Remove -- Date : 03/28/2014 19:34:28
    | ARK || FAK || MBR |

    ¤¤¤ Bad processes : 0 ¤¤¤

    ¤¤¤ Registry Entries : 11 ¤¤¤
    [HJ POL][PUM] HKCU\[...]\System : DisableTaskMgr (0) -> DELETED
    [HJ POL][PUM] HKCU\[...]\System : DisableRegistryTools (0) -> DELETED
    [HJ POL][PUM] HKCU\[...]\System : DisableCMD (0) -> DELETED
    [HJ POL][PUM] HKLM\[...]\System : DisableTaskMgr (0) -> DELETED
    [HJ POL][PUM] HKLM\[...]\System : DisableRegistryTools (0) -> DELETED
    [HJ POL][PUM] HKLM\[...]\System : DisableCMD (0) -> DELETED
    [HJ POL][PUM] HKLM\[...]\Wow6432Node\[...]\System : DisableTaskMgr (0) -> [0x2] The system cannot find the file specified.
    [HJ POL][PUM] HKLM\[...]\Wow6432Node\[...]\System : DisableRegistryTools (0) -> [0x2] The system cannot find the file specified.
    [HJ POL][PUM] HKLM\[...]\Wow6432Node\[...]\System : DisableCMD (0) -> [0x2] The system cannot find the file specified.
    [HJ DESK][PUM] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> REPLACED (0)
    [HJ DESK][PUM] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0)

    ¤¤¤ Scheduled tasks : 0 ¤¤¤

    ¤¤¤ Startup Entries : 0 ¤¤¤

    ¤¤¤ Web browsers : 0 ¤¤¤

    ¤¤¤ Browser Addons : 0 ¤¤¤

    ¤¤¤ Particular Files / Folders: ¤¤¤

    ¤¤¤ Driver : [NOT LOADED 0x0] ¤¤¤
    [Address] EAT @explorer.exe (DllCanUnloadNow) : taskschd.dll -> HOOKED (C:\WINDOWS\System32\shacct.dll @ 0xA2A71010)
    [Address] EAT @explorer.exe (DllGetClassObject) : taskschd.dll -> HOOKED (C:\WINDOWS\System32\shacct.dll @ 0xA2A71130)
    [Address] EAT @explorer.exe (DllCanUnloadNow) : wercplsupport.dll -> HOOKED (C:\WINDOWS\system32\twinui.dll @ 0x9E631598)
    [Address] EAT @explorer.exe (DllGetActivationFactory) : wercplsupport.dll -> HOOKED (C:\WINDOWS\system32\twinui.dll @ 0x9E6BC13C)
    [Address] EAT @explorer.exe (DllGetClassObject) : wercplsupport.dll -> HOOKED (C:\WINDOWS\system32\twinui.dll @ 0x9E65C540)

    ¤¤¤ External Hives: ¤¤¤

    ¤¤¤ Infection : ¤¤¤

    ¤¤¤ HOSTS File: ¤¤¤
    --> %SystemRoot%\System32\drivers\etc\hosts




    ¤¤¤ MBR Check: ¤¤¤

    +++++ PhysicalDrive0: (\\.\PHYSICALDRIVE0 @ IDE) Hitachi HTS545050A7E380 +++++
    --- User ---
    [MBR] bbba86c7737e2dfc1f08ad77b19f1da1
    [BSP] 5b3e831facc0a502a786e80fa31f13f4 : Empty MBR Code
    Partition table:
    0 - [XXXXXX] UNKNOWN (0x00) [VISIBLE] Offset (sectors): 1 | Size: 476940 MB
    User = LL1 ... OK!
    User = LL2 ... OK!

    Finished : << RKreport[0]_D_03282014_193428.txt >>
    RKreport[0]_S_03282014_193421.txt



    Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-03-2014
    Ran by outof_000 (administrator) on ASUS-LAPTOP on 28-03-2014 19:37:07
    Running from C:\Users\outof_000\Desktop
    Windows 8.1 (X64) OS Language: English(US)
    Internet Explorer Version 11
    Boot Mode: Normal

    The only official download link for FRST:
    Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
    Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
    Download link from any site other than Bleeping Computer is unpermitted or outdated.
    See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

    ==================== Processes (Whitelisted) =================

    (Enigma Software Group USA, LLC.) C:\Program Files\Enigma Software Group\SpyHunter\SH4Service.exe
    (ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe
    (ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
    (ASUS) C:\Program Files (x86)\ASUS\ASUS InstantOn\InsOnSrv.exe
    (Apple Inc.) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
    () C:\Program Files (x86)\BubbleUPnP Server\BubbleUPnPServer.exe
    (Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
    (Microsoft Corporation) C:\WINDOWS\system32\dashost.exe
    (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
    (ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe
    (ASUS) C:\Program Files (x86)\ASUS\ASUS InstantOn\InsOnWMI.exe
    (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
    (Microsoft Corporation) c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
    (Microsoft Corporation) c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
    (ASUS) C:\Program Files\ASUS\P4G\BatteryLife.exe
    (ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\USBChargerPlus\USBChargerPlus.exe
    (ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe
    (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
    (Google Inc.) C:\Program Files (x86)\Google\Update\1.3.22.3\GoogleCrashHandler.exe
    (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
    (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
    (VIA Technologies, Inc.) C:\WINDOWS\system32\viakaraokesrv.exe
    (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
    (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
    (Google Inc.) C:\Program Files (x86)\Google\Update\1.3.22.3\GoogleCrashHandler64.exe
    (ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
    (ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
    (Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
    (Microsoft Corporation) C:\Windows\System32\skydrive.exe
    (Intel Corporation) C:\Windows\System32\igfxtray.exe
    (Intel Corporation) C:\Windows\System32\hkcmd.exe
    (Intel Corporation) C:\Windows\System32\igfxpers.exe
    (VIA) C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe
    (VIA) C:\Program Files (x86)\VIA\VIAudioi\VDeck\viaaud.exe
    (ASUS) C:\Program Files (x86)\ASUS\Splendid\ACMON.exe
    (Google Inc.) C:\Users\outof_000\AppData\Local\Google\Update\GoogleUpdate.exe
    () C:\Program Files (x86)\IDMSQ\idmsq.exe
    (ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Live Update\LiveUpdate.exe
    (ASUSTeK) C:\Windows\SysWOW64\ACEngSvr.exe
    (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
    (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
    (Microsoft Corporation) C:\WINDOWS\system32\printfilterpipelinesvc.exe
    (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
    (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
    (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
    (Webroot) C:\Program Files\Webroot\WRSA.exe
    (Webroot) C:\Program Files\Webroot\WRSA.exe
    (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe


    ==================== Registry (Whitelisted) ==================

    HKLM\...\Run: [HDAudDeck] - C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe [5292688 2012-09-17] (VIA)
    HKLM\...\Run: [VIAAUD] - C:\Program Files (x86)\VIA\VIAudioi\VDeck\viaaud.exe [2540176 2012-09-17] (VIA)
    HKLM\...\Run: [ACMON] - C:\Program Files (x86)\ASUS\Splendid\ACMON.exe [107192 2012-08-24] (ASUS)
    HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [40312 2013-12-18] (Adobe Systems Incorporated)
    HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
    HKLM-x32\...\Run: [AvastUI.exe] - "C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui
    HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
    HKLM-x32\...\Run: [WRSVC] - C:\Program Files\Webroot\WRSA.exe [766040 2014-03-28] (Webroot)
    HKLM-x32\...\Run: [SDTray] - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [5624784 2013-07-25] (Safer-Networking Ltd.)
    Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)
    Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
    HKLM\...\Policies\Explorer: [NoFolderOptions] 0
    HKLM\...\Policies\Explorer: [NoViewOnDrive] 0
    HKLM\...\Policies\Explorer: [NoControlPanel] 0
    HKLM\...\Policies\Explorer: [DisableLocalMachineRun] 0
    HKLM\...\Policies\Explorer: [DisableLocalMachineRunOnce] 0
    HKLM\...\Policies\Explorer: [DisableCurrentUserRun] 0
    HKLM\...\Policies\Explorer: [DisableCurrentUserRunOnce] 0
    HKLM\...\Policies\Explorer: [NoViewContextMenu] 0
    HKLM\...\Policies\Explorer: [NoShellSearchButton] 0
    HKLM\...\Policies\Explorer: [NoFind] 0
    HKLM\...\Policies\Explorer: [NoFile] 0
    HKLM\...\Policies\Explorer: [HideClock] 0
    HKLM\...\Policies\Explorer: [NoTrayContextMenu] 0
    HKLM\...\Policies\Explorer: [NoTrayItemsDisplay] 0
    HKLM\...\Policies\Explorer: [NoSetFolders] 0
    HKLM\...\Policies\Explorer: [NoDevMgrUpdate] 0
    HKLM\...\Policies\Explorer: [NoSetTaskbar] 0
    HKLM\...\Policies\Explorer: [NoDeletePrinter] 0
    HKLM\...\Policies\Explorer: [NoDFSTab] 0
    HKLM\...\Policies\Explorer: [NoChangeStartMenu] 0
    HKLM\...\Policies\Explorer: [NoLogoff] 0
    HKLM\...\Policies\Explorer: [NoWindowsUpdate] 0
    HKLM\...\Policies\Explorer: [NoEncryptOnMove] 0
    HKLM\...\Policies\Explorer: [NoRunasInstallPrompt] 0
    HKLM\...\Policies\Explorer: [NoResolveSearch] 0
    HKLM\...\Policies\Explorer: [NoSaveSettings] 0
    HKLM\...\Policies\Explorer: [NoHardwareTab] 0
    HKLM\...\Policies\Explorer: [NoStartMenuSubFolders] 0
    HKLM\...\Policies\Explorer: [NoDesktop] 0
    HKU\S-1-5-21-3593858388-4215303024-77723331-1001\...\Run: [Google Update] - C:\Users\outof_000\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2013-08-23] (Google Inc.)
    HKU\S-1-5-21-3593858388-4215303024-77723331-1001\...\Run: [uTorrent] - C:\Users\outof_000\AppData\Roaming\uTorrent\uTorrent.exe [900440 2013-11-15] (BitTorrent Inc.)
    HKU\S-1-5-21-3593858388-4215303024-77723331-1001\...\Run: [Spybot-S&D Cleaning] - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDCleaner.exe [3666224 2013-09-20] (Safer-Networking Ltd.)
    HKU\S-1-5-21-3593858388-4215303024-77723331-1001\...\Run: [IDMSQ] - C:\Program Files (x86)\IDMSQ\idmsq.exe [2561088 2013-10-30] ()
    HKU\S-1-5-21-3593858388-4215303024-77723331-1001\...\Policies\system: [NoDispAppearancePage] 0
    HKU\S-1-5-21-3593858388-4215303024-77723331-1001\...\Policies\system: [NoDispBackgroundPage] 0
    HKU\S-1-5-21-3593858388-4215303024-77723331-1001\...\Policies\system: [NoDispSettingsPage] 0
    HKU\S-1-5-21-3593858388-4215303024-77723331-1001\...\Policies\Explorer: [NoFolderOptions] 0
    HKU\S-1-5-21-3593858388-4215303024-77723331-1001\...\Policies\Explorer: [NoViewOnDrive] 0
    HKU\S-1-5-21-3593858388-4215303024-77723331-1001\...\Policies\Explorer: [NoControlPanel] 0
    HKU\S-1-5-21-3593858388-4215303024-77723331-1001\...\Policies\Explorer: [DisableLocalMachineRun] 0
    HKU\S-1-5-21-3593858388-4215303024-77723331-1001\...\Policies\Explorer: [DisableLocalMachineRunOnce] 0
    HKU\S-1-5-21-3593858388-4215303024-77723331-1001\...\Policies\Explorer: [DisableCurrentUserRun] 0
    HKU\S-1-5-21-3593858388-4215303024-77723331-1001\...\Policies\Explorer: [DisableCurrentUserRunOnce] 0
    HKU\S-1-5-21-3593858388-4215303024-77723331-1001\...\Policies\Explorer: [NoViewContextMenu] 0
    HKU\S-1-5-21-3593858388-4215303024-77723331-1001\...\Policies\Explorer: [NoShellSearchButton] 0
    HKU\S-1-5-21-3593858388-4215303024-77723331-1001\...\Policies\Explorer: [NoFind] 0
    HKU\S-1-5-21-3593858388-4215303024-77723331-1001\...\Policies\Explorer: [NoFile] 0
    HKU\S-1-5-21-3593858388-4215303024-77723331-1001\...\Policies\Explorer: [HideClock] 0
    HKU\S-1-5-21-3593858388-4215303024-77723331-1001\...\Policies\Explorer: [NoTrayContextMenu] 0
    HKU\S-1-5-21-3593858388-4215303024-77723331-1001\...\Policies\Explorer: [NoTrayItemsDisplay] 0
    HKU\S-1-5-21-3593858388-4215303024-77723331-1001\...\Policies\Explorer: [NoSetFolders] 0
    HKU\S-1-5-21-3593858388-4215303024-77723331-1001\...\Policies\Explorer: [NoDevMgrUpdate] 0
    HKU\S-1-5-21-3593858388-4215303024-77723331-1001\...\Policies\Explorer: [NoSetTaskbar] 0
    HKU\S-1-5-21-3593858388-4215303024-77723331-1001\...\Policies\Explorer: [NoDeletePrinter] 0
    HKU\S-1-5-21-3593858388-4215303024-77723331-1001\...\Policies\Explorer: [NoDFSTab] 0
    HKU\S-1-5-21-3593858388-4215303024-77723331-1001\...\Policies\Explorer: [NoChangeStartMenu] 0
    HKU\S-1-5-21-3593858388-4215303024-77723331-1001\...\Policies\Explorer: [NoLogoff] 0
    HKU\S-1-5-21-3593858388-4215303024-77723331-1001\...\Policies\Explorer: [NoWindowsUpdate] 0
    HKU\S-1-5-21-3593858388-4215303024-77723331-1001\...\Policies\Explorer: [NoEncryptOnMove] 0
    HKU\S-1-5-21-3593858388-4215303024-77723331-1001\...\Policies\Explorer: [NoRunasInstallPrompt] 0
    HKU\S-1-5-21-3593858388-4215303024-77723331-1001\...\Policies\Explorer: [NoResolveSearch] 0
    HKU\S-1-5-21-3593858388-4215303024-77723331-1001\...\Policies\Explorer: [NoSaveSettings] 0
    HKU\S-1-5-21-3593858388-4215303024-77723331-1001\...\Policies\Explorer: [NoHardwareTab] 0
    HKU\S-1-5-21-3593858388-4215303024-77723331-1001\...\Policies\Explorer: [NoStartMenuSubFolders] 0
    GroupPolicy: Group Policy on Chrome detected <======= ATTENTION

    ==================== Internet (Whitelisted) ====================

    HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.findwide.com/v/2/?guid={F87E6CE3-8062-4D51-90DD-F1E3E58BE818}&serpv=22
    HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://start.findwide.com/v/2/?guid={F87E6CE3-8062-4D51-90DD-F1E3E58BE818}&serpv=22
    SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?q={searchTerms}&amp;form=IE10TR&amp;src=IE10TR&amp;pc=ASU2JS
    SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?q={searchTerms}&amp;form=IE10TR&amp;src=IE10TR&amp;pc=ASU2JS
    SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
    SearchScopes: HKCU - {3F1E1EE6-CDA8-4100-A520-89469E8B7FEF} URL = http://findwide.com/serp?guid={F87E...ction=default_search&serpv=22&k={searchTerms}
    SearchScopes: HKCU - {559D0C6F-6268-40F2-A2AA-D7DC6789B4B5} URL = http://search.yahoo.com/search?p={searchTerms}&fr=tightropetb&type=10753
    BHO: avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll No File
    BHO: ApptoUU - {839C88C4-2084-CCC7-5F05-394EF623248E} - C:\ProgramData\ApptoUU\4rD.x64.dll No File
    BHO: Webroot Filtering Extension - {C9C42510-9B41-42c1-9DCD-7282A2D07C61} - C:\Program Files\Webroot\WRData\PKG\Vistax64\wrflt.dll (Webroot)
    BHO: EXEcheckER - {EB538218-9106-7D45-5338-BD9D8FA12747} - C:\ProgramData\EXEcheckER\ZOaoJwBVh.x64.dll No File
    BHO: DaiiScountLocatorr - {F0511C29-E278-712B-5087-8C55D8C05CD0} - C:\ProgramData\DaiiScountLocatorr\j6JVq.x64.dll No File
    BHO: SAAver box - {F0838AD1-8EF9-C48C-BB15-2561EBB3C156} - C:\ProgramData\SAAver box\q3kFcfVT_I.x64.dll No File
    BHO-x32: Idmsq Extension - {3AA4FC9D-FB51-44a2-B09F-0457857CA7C2} - C:\Users\outof_000\AppData\Roaming\IDMSQ\idmsqext.dll (Or Interactive Ltd)
    BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
    BHO-x32: ApptoUU - {839C88C4-2084-CCC7-5F05-394EF623248E} - C:\ProgramData\ApptoUU\4rD.dll No File
    BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll No File
    BHO-x32: Webroot Filtering Extension - {C9C42510-9B41-42c1-9DCD-7282A2D07C61} - C:\Program Files\Webroot\WRData\PKG\Vistax86\wrflt.dll (Webroot)
    BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
    BHO-x32: EXEcheckER - {EB538218-9106-7D45-5338-BD9D8FA12747} - C:\ProgramData\EXEcheckER\ZOaoJwBVh.dll No File
    BHO-x32: DaiiScountLocatorr - {F0511C29-E278-712B-5087-8C55D8C05CD0} - C:\ProgramData\DaiiScountLocatorr\j6JVq.dll No File
    Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll No File
    Toolbar: HKLM-x32 - avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll No File
    Toolbar: HKCU - No Name - {E84515C9-1B09-493B-93EC-50F2BF4D3F11} - No File
    Tcpip\Parameters: [DhcpNameServer] 68.105.28.11 68.105.29.11

    Chrome:
    =======
    CHR HomePage: hxxp://www.google.com
    CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.76\PepperFlash\pepflashplayer.dll ()
    CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
    CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.76\ppGoogleNaClPluginChrome.dll ()
    CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.76\pdf.dll ()
    CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
    CHR Plugin: (IntelÃ&#131;Â&#130;Ã&#130;® Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
    CHR Plugin: (IntelÃ&#131;Â&#130;Ã&#130;® Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
    CHR Plugin: (Google Update) - C:\Users\outof_000\AppData\Local\Google\Update\1.3.21.153\npGoogleUpdate3.dll No File
    CHR Extension: (Google Drive) - C:\Users\outof_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-10-20]
    CHR Extension: (YouTube) - C:\Users\outof_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-10-20]
    CHR Extension: (Google Cast) - C:\Users\outof_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\boadgeojelhgndaghljhdicfkmllpafd [2013-10-20]
    CHR Extension: (Google Search) - C:\Users\outof_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-10-20]
    CHR Extension: (Play to XBMC) - C:\Users\outof_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\fncjhcjfnnooidlkijollckpakkebden [2014-03-24]
    CHR Extension: (PDFescape Free PDF Editor) - C:\Users\outof_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\gdefoklganepljiopdnglodohlgfikkl [2013-10-20]
    CHR Extension: (AdBlock) - C:\Users\outof_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2014-03-22]
    CHR Extension: (A Journey through Middle-earth) - C:\Users\outof_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\gjgkjeheegjnnmheaflhdocglkiegoni [2013-12-12]
    CHR Extension: (EXEcheckER) - C:\Users\outof_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\gkdmkfpfchaedcbbphhbenompflbaegp [2014-03-20]
    CHR Extension: (SlingPlayer for DISH Anywhere ) - C:\Users\outof_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\jcnpmlegoehfgohpkmjhpohjchokamnn [2013-10-20]
    CHR Extension: (Cargo Bridge) - C:\Users\outof_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\keembkgclppcbilkekfgpobhldjjhpmn [2013-10-20]
    CHR Extension: (Webroot Filtering Extension) - C:\Users\outof_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\kjeghcllfecehndceplomkocgfbklffd [2014-02-15]
    CHR Extension: (Google Wallet) - C:\Users\outof_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-01]
    CHR Extension: (Google Chrome to Phone Extension) - C:\Users\outof_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\oadboiipflhobonjjffjbfekfjcgkhco [2013-10-20]
    CHR Extension: (Gmail) - C:\Users\outof_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-10-20]
    CHR Extension: (ApptoUU) - C:\ProgramData\jlbcajicgjbjokhelkliinkcpalkchdm [2014-01-05]
    CHR HKCU\...\Chrome\Extension: [acohkacenjkkllhbfgfflibmenakobco] - C:\Users\outof_000\AppData\Local\CRE\acohkacenjkkllhbfgfflibmenakobco.crx [2014-01-05]
    CHR HKCU\...\Chrome\Extension: [dnmlhhbehhdmajijfenoldcajelckpmn] - C:\Users\outof_000\AppData\Local\CRE\dnmlhhbehhdmajijfenoldcajelckpmn.crx [2014-01-05]
    CHR HKLM-x32\...\Chrome\Extension: [acohkacenjkkllhbfgfflibmenakobco] - C:\Users\outof_000\AppData\Local\CRE\acohkacenjkkllhbfgfflibmenakobco.crx [2014-01-05]
    CHR HKLM-x32\...\Chrome\Extension: [dnmlhhbehhdmajijfenoldcajelckpmn] - C:\Users\outof_000\AppData\Local\CRE\dnmlhhbehhdmajijfenoldcajelckpmn.crx [2014-01-05]
    CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-01-05]
    CHR HKLM-x32\...\Chrome\Extension: [kjeghcllfecehndceplomkocgfbklffd] - C:\ProgramData\WRData\PKG\CHROME\CHROME_1.0.0.26.crx [2014-02-14]
    CHR HKLM-x32\...\Chrome\Extension: [ohenffmfbnoidogjgebadealdkecjdal] - C:\Users\outof_000\AppData\Roaming\IDMSQ\IDMSQ.crx [2013-09-24]
    CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

    ==================== Services (Whitelisted) =================

    R2 ASUS InstantOn; C:\Program Files (x86)\ASUS\ASUS InstantOn\InsOnSrv.exe [277120 2012-04-13] (ASUS)
    R2 BubbleUPnP Server; C:\Program Files (x86)\BubbleUPnP Server\BubbleUPnPServer.exe [196608 2011-11-16] ()
    R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [129856 2012-06-27] (Intel Corporation)
    R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-06-25] (Intel Corporation)
    R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
    R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
    R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [3921880 2013-10-15] (Safer-Networking Ltd.)
    R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1042272 2013-09-20] (Safer-Networking Ltd.)
    R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171416 2013-09-13] (Safer-Networking Ltd.)
    R2 SpyHunter 4 Service; C:\Program Files\Enigma Software Group\SpyHunter\SH4Service.exe [1025408 2014-01-09] (Enigma Software Group USA, LLC.)
    R2 VIAKaraokeService; C:\Windows\system32\viakaraokesrv.exe [27792 2012-09-14] (VIA Technologies, Inc.)
    S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [348392 2013-10-30] (Microsoft Corporation)
    S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2013-10-30] (Microsoft Corporation)
    R2 WRSVC; C:\Program Files\Webroot\WRSA.exe [766040 2014-03-28] (Webroot)

    ==================== Drivers (Whitelisted) ====================

    S0 ADP80XX; C:\Windows\System32\drivers\ADP80XX.SYS [782176 2013-08-22] (PMC-Sierra)
    S3 ATP; C:\Windows\System32\drivers\AsusTP.sys [61824 2012-10-31] (ASUS Corporation)
    S3 bcmfn2; C:\Windows\System32\drivers\bcmfn2.sys [17624 2013-08-12] (Windows (R) Win 7 DDK provider)
    S3 esgiguard; C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [14872 2014-01-07] ()
    R2 EsgScanner; C:\Windows\System32\DRIVERS\EsgScanner.sys [22704 2012-06-22] ()
    S3 iaLPSSi_GPIO; C:\Windows\System32\drivers\iaLPSSi_GPIO.sys [24568 2013-07-30] (Intel Corporation)
    S3 iaLPSSi_I2C; C:\Windows\System32\drivers\iaLPSSi_I2C.sys [99320 2013-07-25] (Intel Corporation)
    S0 iaStorAV; C:\Windows\System32\drivers\iaStorAV.sys [651248 2013-08-09] (Intel Corporation)
    R0 intelpep; C:\Windows\System32\drivers\intelpep.sys [39768 2014-02-23] (Microsoft Corporation)
    R3 kbfiltr; C:\Windows\System32\drivers\kbfiltr.sys [14992 2012-08-01] ( )
    S0 LSI_SAS3; C:\Windows\System32\drivers\lsi_sas3.sys [81760 2013-08-22] (LSI Corporation)
    R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
    R3 NdisVirtualBus; C:\Windows\System32\drivers\NdisVirtualBus.sys [16384 2013-08-22] (Microsoft Corporation)
    S3 netvsc; C:\Windows\system32\DRIVERS\netvsc63.sys [87040 2013-08-22] (Microsoft Corporation)
    S3 ReFS; C:\Windows\System32\Drivers\ReFS.sys [924512 2013-08-22] (Microsoft Corporation)
    S3 SerCx2; C:\Windows\System32\drivers\SerCx2.sys [146776 2014-02-23] (Microsoft Corporation)
    S0 stornvme; C:\Windows\System32\drivers\stornvme.sys [57176 2013-11-14] (Microsoft Corporation)
    S3 UEFI; C:\Windows\System32\drivers\UEFI.sys [26976 2013-08-22] (Microsoft Corporation)
    S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [124760 2013-10-30] (Microsoft Corporation)
    R0 WRkrn; C:\Windows\System32\drivers\WRkrn.sys [115168 2014-03-28] (Webroot)

    ==================== NetSvcs (Whitelisted) ===================


    ==================== One Month Created Files and Folders ========

    2014-03-28 19:36 - 2014-03-28 19:36 - 02157056 _____ (Farbar) C:\Users\outof_000\Desktop\FRST64 (1).exe
    2014-03-28 19:36 - 2014-03-28 19:36 - 00002905 _____ () C:\Users\outof_000\Desktop\RKreport[1].txt
    2014-03-28 19:34 - 2014-03-28 19:34 - 00002905 _____ () C:\Users\outof_000\Desktop\RKreport[0]_D_03282014_193428.txt
    2014-03-28 19:34 - 2014-03-28 19:34 - 00002712 _____ () C:\Users\outof_000\Desktop\RKreport[0]_S_03282014_193421.txt
    2014-03-28 19:30 - 2014-03-28 19:36 - 00000000 ____D () C:\Users\outof_000\Desktop\RK_Quarantine
    2014-03-28 19:24 - 2014-03-28 19:24 - 04527616 _____ () C:\Users\outof_000\Desktop\RogueKillerX64.exe
    2014-03-28 19:23 - 2014-03-28 19:23 - 00987448 _____ () C:\Users\outof_000\Desktop\SecurityCheck.exe
    2014-03-24 23:03 - 2014-02-22 08:16 - 00139776 _____ (Microsoft Corporation) C:\WINDOWS\system32\poqexec.exe
    2014-03-24 23:03 - 2014-02-22 07:24 - 00124416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\poqexec.exe
    2014-03-24 22:03 - 2014-03-24 22:03 - 00024210 _____ () C:\Users\outof_000\Desktop\Addition.txt
    2014-03-24 22:02 - 2014-03-28 19:37 - 00022617 _____ () C:\Users\outof_000\Desktop\FRST.txt
    2014-03-24 22:02 - 2014-03-28 19:37 - 00000000 ____D () C:\FRST
    2014-03-24 22:01 - 2014-03-24 22:01 - 02157056 _____ (Farbar) C:\Users\outof_000\Desktop\FRST64.exe
    2014-03-24 22:01 - 2014-03-24 22:01 - 00294568 _____ (VLCPlayer) C:\Users\outof_000\Desktop\Software_Update__CD5MTCD4349_0beaec9c-9198-45eb-9efe-008507fa0964_vK9QKAI26Q7C82GAGU63JUOCJO_0_0_0.exe
    2014-03-24 21:50 - 2014-03-24 21:50 - 00000796 _____ () C:\Users\outof_000\Desktop\JRT.txt
    2014-03-24 21:42 - 2014-03-24 21:42 - 00000000 ____D () C:\WINDOWS\ERUNT
    2014-03-24 21:37 - 2014-03-24 21:37 - 00003266 _____ () C:\Users\outof_000\Desktop\AdwCleaner[R0].txt
    2014-03-24 21:35 - 2014-03-24 21:35 - 00003027 _____ () C:\Users\outof_000\Desktop\HiJackThis.lnk
    2014-03-24 21:35 - 2014-03-24 21:35 - 00000000 ____D () C:\Users\outof_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HiJackThis
    2014-03-24 21:35 - 2014-03-24 21:35 - 00000000 ____D () C:\Program Files (x86)\Trend Micro
    2014-03-24 21:33 - 2014-03-24 21:38 - 00000000 ____D () C:\AdwCleaner
    2014-03-24 21:32 - 2014-03-24 21:32 - 01038974 _____ (Thisisu) C:\Users\outof_000\Desktop\JRT.exe
    2014-03-24 21:31 - 2014-03-24 21:32 - 01950720 _____ () C:\Users\outof_000\Desktop\adwcleaner.exe
    2014-03-24 21:30 - 2014-03-24 21:30 - 01402880 _____ () C:\Users\outof_000\Desktop\HijackThis.msi
    2014-03-24 21:25 - 2014-03-28 19:28 - 00000000 ____D () C:\Users\outof_000\AppData\Roaming\IDMSQ
    2014-03-24 21:25 - 2014-03-24 21:25 - 00000000 ____D () C:\Users\outof_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\IDMSQ
    2014-03-24 21:25 - 2014-03-24 21:25 - 00000000 ____D () C:\Program Files (x86)\IDMSQ
    2014-03-24 21:25 - 2014-03-24 21:25 - 00000000 ____D () C:\MININT
    2014-03-24 21:24 - 2014-03-24 21:24 - 01075264 _____ (OR Interactive Ltd) C:\Users\outof_000\Desktop\IDM2.exe
    2014-03-23 18:04 - 2014-03-23 18:05 - 63290992 _____ (Plex, Inc.) C:\Users\outof_000\Desktop\Plex-Media-Server-0.9.907.429-f80a8d6-en-US.exe
    2014-03-20 20:50 - 2014-03-20 20:50 - 00000258 __RSH () C:\ProgramData\ntuser.pol
    2014-03-20 19:08 - 2014-03-20 19:08 - 00000000 ____D () C:\WINDOWS\System32\Tasks\Apple
    2014-03-20 19:08 - 2014-03-20 19:08 - 00000000 ____D () C:\Users\outof_000\AppData\Local\Apple
    2014-03-20 19:08 - 2014-03-20 19:08 - 00000000 ____D () C:\ProgramData\Apple
    2014-03-20 19:08 - 2014-03-20 19:08 - 00000000 ____D () C:\Program Files\Bonjour Print Services
    2014-03-20 19:08 - 2014-03-20 19:08 - 00000000 ____D () C:\Program Files\Bonjour
    2014-03-20 19:08 - 2014-03-20 19:08 - 00000000 ____D () C:\Program Files (x86)\Bonjour
    2014-03-20 19:08 - 2014-03-20 19:08 - 00000000 ____D () C:\Program Files (x86)\Apple Software Update
    2014-03-20 19:07 - 2014-03-20 19:07 - 05436744 _____ (Apple Inc.) C:\Users\outof_000\Desktop\BonjourPSSetup.exe
    2014-03-20 18:52 - 2014-03-20 20:58 - 00000000 ____D () C:\Users\outof_000\AppData\Roaming\XBMC
    2014-03-19 21:22 - 2014-03-19 21:22 - 00000000 ____D () C:\Users\outof_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\XBMC
    2014-03-19 21:21 - 2014-03-19 21:22 - 00000000 ____D () C:\Program Files (x86)\XBMC
    2014-03-19 21:15 - 2014-03-19 21:15 - 59604731 _____ () C:\Users\outof_000\Desktop\xbmc-12.3.exe
    2014-03-17 19:56 - 2014-01-07 21:46 - 00325464 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBXHCI.SYS
    2014-03-17 19:56 - 2014-01-07 21:41 - 01530712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys
    2014-03-17 19:56 - 2014-01-07 21:41 - 00382808 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms1.sys
    2014-03-17 19:56 - 2014-01-04 11:54 - 00138240 _____ () C:\WINDOWS\system32\OEMLicense.dll
    2014-03-17 19:56 - 2014-01-04 11:08 - 00103936 _____ () C:\WINDOWS\SysWOW64\OEMLicense.dll
    2014-03-17 19:56 - 2014-01-04 10:08 - 00206336 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSClient.dll
    2014-03-17 19:56 - 2014-01-04 09:53 - 00174592 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSClient.dll
    2014-03-17 19:56 - 2014-01-02 19:54 - 00461312 _____ (Microsoft Corporation) C:\WINDOWS\system32\XpsGdiConverter.dll
    2014-03-17 19:56 - 2014-01-02 19:48 - 00336896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XpsGdiConverter.dll
    2014-03-17 19:56 - 2013-12-31 21:55 - 01720560 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll
    2014-03-17 19:56 - 2013-12-31 21:52 - 00481944 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfsvr.dll
    2014-03-17 19:56 - 2013-12-31 20:56 - 01472048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll
    2014-03-17 19:56 - 2013-12-31 20:55 - 00381168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfsvr.dll
    2014-03-17 19:56 - 2013-12-31 19:59 - 00802816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFMediaEngine.dll
    2014-03-17 19:56 - 2013-12-31 19:57 - 01214976 _____ (Microsoft Corporation) C:\WINDOWS\system32\schedsvc.dll
    2014-03-17 19:56 - 2013-12-31 19:56 - 00960512 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFMediaEngine.dll
    2014-03-17 19:56 - 2013-12-30 19:34 - 00218112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sti.dll
    2014-03-17 19:56 - 2013-12-30 19:33 - 00770560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ReAgent.dll
    2014-03-17 19:56 - 2013-12-30 19:32 - 00303616 _____ (Microsoft Corporation) C:\WINDOWS\system32\sti.dll
    2014-03-17 19:56 - 2013-12-30 19:31 - 00947712 _____ (Microsoft Corporation) C:\WINDOWS\system32\reseteng.dll
    2014-03-17 19:56 - 2013-12-30 19:31 - 00914944 _____ (Microsoft Corporation) C:\WINDOWS\system32\ReAgent.dll
    2014-03-17 19:56 - 2013-12-27 11:09 - 00419160 _____ (Microsoft Corporation) C:\WINDOWS\system32\hal.dll
    2014-03-17 19:56 - 2013-12-27 04:57 - 00842752 _____ (Microsoft Corporation) C:\WINDOWS\system32\MsSpellCheckingFacility.dll
    2014-03-17 19:56 - 2013-12-27 04:57 - 00628736 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncHost.exe
    2014-03-17 19:56 - 2013-12-27 04:23 - 00749056 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncCore.dll
    2014-03-17 19:56 - 2013-12-27 03:03 - 00630272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MsSpellCheckingFacility.dll
    2014-03-17 19:56 - 2013-12-27 03:03 - 00478208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncHost.exe
    2014-03-17 19:56 - 2013-12-27 02:37 - 00588800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncCore.dll
    2014-03-17 19:56 - 2013-12-21 03:21 - 00376320 _____ (Microsoft Corporation) C:\WINDOWS\system32\pnrpsvc.dll
    2014-03-17 19:56 - 2013-12-17 03:21 - 00408576 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\rdbss.sys
    2014-03-17 19:56 - 2013-12-14 02:31 - 13949440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll
    2014-03-17 19:56 - 2013-12-14 02:19 - 18576384 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll
    2014-03-17 19:56 - 2013-12-13 06:54 - 00131160 _____ (Microsoft Corporation) C:\WINDOWS\system32\easinvoker.exe
    2014-03-17 19:56 - 2013-12-13 02:36 - 00178176 _____ (Microsoft Corporation) C:\WINDOWS\system32\easwrt.dll
    2014-03-17 19:56 - 2013-12-13 01:32 - 00140800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\easwrt.dll
    2014-03-17 19:56 - 2013-12-09 04:05 - 21199256 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
    2014-03-17 19:56 - 2013-12-09 00:51 - 18643560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
    2014-03-14 15:09 - 2014-03-01 02:05 - 23133696 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
    2014-03-14 15:09 - 2014-03-01 00:30 - 17074688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
    2014-03-14 15:09 - 2014-02-28 23:18 - 13051904 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
    2014-03-14 15:08 - 2014-03-01 00:58 - 02765824 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
    2014-03-14 15:08 - 2014-03-01 00:17 - 00218624 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
    2014-03-14 15:08 - 2014-02-28 23:54 - 05768704 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
    2014-03-14 15:08 - 2014-02-28 23:47 - 02168320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
    2014-03-14 15:08 - 2014-02-28 23:42 - 00627200 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
    2014-03-14 15:08 - 2014-02-28 23:14 - 04244480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
    2014-03-14 15:08 - 2014-02-28 23:10 - 02334208 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
    2014-03-14 15:08 - 2014-02-28 23:03 - 00524288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
    2014-03-14 15:08 - 2014-02-28 22:57 - 11266048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
    2014-03-14 15:08 - 2014-02-28 22:38 - 01393664 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
    2014-03-14 15:08 - 2014-02-28 22:32 - 01820160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
    2014-03-14 15:08 - 2014-02-28 22:27 - 01156096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
    2014-03-14 15:08 - 2014-02-28 22:25 - 00817664 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
    2014-03-14 15:08 - 2014-02-28 22:25 - 00703488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
    2014-03-13 20:07 - 2013-10-30 20:29 - 00236888 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdFilter.sys
    2014-03-13 20:07 - 2013-10-30 20:29 - 00124760 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdNisDrv.sys
    2014-03-13 20:07 - 2013-10-30 20:28 - 00035856 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdBoot.sys
    2014-03-12 20:17 - 2014-02-10 23:04 - 04189184 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
    2014-03-12 20:17 - 2014-02-10 22:43 - 00488448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\qedit.dll
    2014-03-12 20:17 - 2014-02-10 22:04 - 00586240 _____ (Microsoft Corporation) C:\WINDOWS\system32\qedit.dll
    2014-03-12 20:17 - 2014-01-31 12:15 - 00311640 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\volsnap.sys
    2014-03-12 20:17 - 2014-01-31 12:07 - 00233920 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfps.dll
    2014-03-12 20:17 - 2014-01-31 12:06 - 02133208 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfcore.dll
    2014-03-12 20:17 - 2014-01-31 09:47 - 02143960 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfcore.dll
    2014-03-12 20:17 - 2014-01-31 05:06 - 00716288 _____ (Microsoft Corporation) C:\WINDOWS\system32\swprv.dll
    2014-03-12 20:17 - 2014-01-29 05:55 - 01287064 _____ (Microsoft Corporation) C:\WINDOWS\system32\kernel32.dll
    2014-03-12 20:17 - 2014-01-29 04:53 - 00458616 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFault.exe
    2014-03-12 20:17 - 2014-01-29 04:53 - 00407024 _____ (Microsoft Corporation) C:\WINDOWS\system32\Faultrep.dll
    2014-03-12 20:17 - 2014-01-29 04:49 - 01928144 _____ (Microsoft Corporation) C:\WINDOWS\system32\combase.dll
    2014-03-12 20:17 - 2014-01-29 04:47 - 02543960 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tcpip.sys
    2014-03-12 20:17 - 2014-01-29 03:44 - 01371824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\combase.dll
    2014-03-12 20:17 - 2014-01-29 03:44 - 00408480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFault.exe
    2014-03-12 20:17 - 2014-01-29 03:44 - 00369280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Faultrep.dll
    2014-03-12 20:17 - 2014-01-29 02:41 - 00208896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdpencom.dll
    2014-03-12 20:17 - 2014-01-28 20:36 - 00249856 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpencom.dll
    2014-03-12 20:17 - 2014-01-27 15:07 - 04175360 _____ (Microsoft Corporation) C:\WINDOWS\system32\dbgeng.dll
    2014-03-12 20:17 - 2014-01-27 15:06 - 00064512 _____ (Microsoft Corporation) C:\WINDOWS\system32\tsgqec.dll
    2014-03-12 20:17 - 2014-01-27 15:04 - 00160256 _____ (Microsoft Corporation) C:\WINDOWS\system32\DWWIN.EXE
    2014-03-12 20:17 - 2014-01-27 14:52 - 01036288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kernel32.dll
    2014-03-12 20:17 - 2014-01-27 14:23 - 02873344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dbgeng.dll
    2014-03-12 20:17 - 2014-01-27 14:21 - 00053248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tsgqec.dll
    2014-03-12 20:17 - 2014-01-27 14:20 - 00138752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DWWIN.EXE
    2014-03-12 20:17 - 2014-01-27 14:15 - 01057280 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdvidcrl.dll
    2014-03-12 20:17 - 2014-01-27 13:43 - 00855552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdvidcrl.dll
    2014-03-12 20:17 - 2014-01-27 13:18 - 01486848 _____ (Microsoft Corporation) C:\WINDOWS\system32\dbghelp.dll
    2014-03-12 20:17 - 2014-01-27 13:00 - 01238016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dbghelp.dll
    2014-03-12 20:17 - 2014-01-27 11:58 - 05770752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstscax.dll
    2014-03-12 20:17 - 2014-01-27 11:50 - 06640640 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstscax.dll
    2014-03-12 20:17 - 2014-01-27 07:45 - 00386722 _____ () C:\WINDOWS\system32\ApnDatabase.xml
    2014-03-12 20:17 - 2014-01-17 19:04 - 00764864 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmpeg2srcsnk.dll
    2014-03-12 20:17 - 2014-01-17 17:54 - 00669352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmpeg2srcsnk.dll
    2014-03-12 20:17 - 2013-12-21 10:51 - 06353960 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppsvc.exe
    2014-03-12 20:17 - 2013-12-21 04:54 - 00447488 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppcomapi.dll
    2014-03-12 20:17 - 2013-12-20 06:18 - 01643584 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi
    2014-03-12 20:17 - 2013-12-20 06:18 - 01507704 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe
    2014-03-12 20:13 - 2014-03-28 19:35 - 00003954 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{3E8D0D21-A270-4A1B-825A-71BEAD3DC29E}
    2014-03-01 20:19 - 2014-03-01 20:19 - 00000000 ____D () C:\Users\outof_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\DISH Anywhere Video Player
    2014-03-01 20:19 - 2014-03-01 20:19 - 00000000 ____D () C:\Users\outof_000\AppData\Roaming\DISH Anywhere
    2014-03-01 18:45 - 2014-03-01 18:45 - 29601600 _____ (DISH Anywhere) C:\Users\outof_000\Desktop\DISH_Anywhere_Video_Player_Installer_2.8.1.exe
    2014-03-01 13:00 - 2014-03-01 16:38 - 00000000 ____D () C:\Users\outof_000\AppData\Local\DishWorld_cache
    2014-03-01 13:00 - 2014-03-01 13:00 - 00000000 ____D () C:\Users\outof_000\AppData\Roaming\SecureMedia
    2014-03-01 12:59 - 2014-03-01 12:59 - 00000000 ____D () C:\Users\outof_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\DishWorld
    2014-03-01 12:59 - 2014-03-01 12:59 - 00000000 ____D () C:\ProgramData\DishWorld
    2014-03-01 12:55 - 2014-03-01 12:55 - 18481152 _____ () C:\Users\outof_000\Desktop\DishWorld.msi

    ==================== One Month Modified Files and Folders =======

    2014-03-28 19:37 - 2014-03-24 22:02 - 00022617 _____ () C:\Users\outof_000\Desktop\FRST.txt
    2014-03-28 19:37 - 2014-03-24 22:02 - 00000000 ____D () C:\FRST
    2014-03-28 19:36 - 2014-03-28 19:36 - 02157056 _____ (Farbar) C:\Users\outof_000\Desktop\FRST64 (1).exe
    2014-03-28 19:36 - 2014-03-28 19:36 - 00002905 _____ () C:\Users\outof_000\Desktop\RKreport[1].txt
    2014-03-28 19:36 - 2014-03-28 19:30 - 00000000 ____D () C:\Users\outof_000\Desktop\RK_Quarantine
    2014-03-28 19:35 - 2014-03-12 20:13 - 00003954 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{3E8D0D21-A270-4A1B-825A-71BEAD3DC29E}
    2014-03-28 19:35 - 2013-08-23 18:20 - 00000948 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-3593858388-4215303024-77723331-1001UA.job
    2014-03-28 19:34 - 2014-03-28 19:34 - 00002905 _____ () C:\Users\outof_000\Desktop\RKreport[0]_D_03282014_193428.txt
    2014-03-28 19:34 - 2014-03-28 19:34 - 00002712 _____ () C:\Users\outof_000\Desktop\RKreport[0]_S_03282014_193421.txt
    2014-03-28 19:33 - 2014-02-14 21:46 - 00154248 _____ (Webroot) C:\WINDOWS\SysWOW64\WRusr.dll
    2014-03-28 19:33 - 2014-02-14 21:46 - 00115168 _____ (Webroot) C:\WINDOWS\system32\Drivers\WRkrn.sys
    2014-03-28 19:33 - 2014-02-14 21:46 - 00105320 _____ (Webroot) C:\WINDOWS\system32\WRusr.dll
    2014-03-28 19:33 - 2013-06-22 11:09 - 00003594 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3593858388-4215303024-77723331-1001
    2014-03-28 19:31 - 2014-02-14 21:46 - 00000000 ____D () C:\ProgramData\WRData
    2014-03-28 19:30 - 2013-06-22 11:15 - 00002203 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
    2014-03-28 19:28 - 2014-03-24 21:25 - 00000000 ____D () C:\Users\outof_000\AppData\Roaming\IDMSQ
    2014-03-28 19:28 - 2014-02-23 14:06 - 00000000 ___RD () C:\Users\outof_000\SkyDrive
    2014-03-28 19:28 - 2014-02-15 01:02 - 00000401 _____ () C:\Users\outof_000\AppData\Roaming\sp_data.sys
    2014-03-28 19:28 - 2013-11-24 22:04 - 00000000 ____D () C:\Program Files (x86)\BubbleUPnP Server
    2014-03-28 19:27 - 2013-08-22 10:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
    2014-03-28 19:27 - 2013-06-22 11:15 - 00000924 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
    2014-03-28 19:26 - 2014-02-23 13:55 - 01688479 _____ () C:\WINDOWS\WindowsUpdate.log
    2014-03-28 19:24 - 2014-03-28 19:24 - 04527616 _____ () C:\Users\outof_000\Desktop\RogueKillerX64.exe
    2014-03-28 19:23 - 2014-03-28 19:23 - 00987448 _____ () C:\Users\outof_000\Desktop\SecurityCheck.exe
    2014-03-28 19:22 - 2013-08-22 11:36 - 00000000 ____D () C:\WINDOWS\AppReadiness
    2014-03-28 19:16 - 2013-08-22 11:36 - 00000000 ____D () C:\WINDOWS\system32\sru
    2014-03-25 21:41 - 2013-06-22 11:15 - 00000928 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
    2014-03-25 18:56 - 2014-02-17 23:26 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
    2014-03-25 11:35 - 2013-08-23 18:20 - 00000896 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-3593858388-4215303024-77723331-1001Core.job
    2014-03-24 22:03 - 2014-03-24 22:03 - 00024210 _____ () C:\Users\outof_000\Desktop\Addition.txt
    2014-03-24 22:01 - 2014-03-24 22:01 - 02157056 _____ (Farbar) C:\Users\outof_000\Desktop\FRST64.exe
    2014-03-24 22:01 - 2014-03-24 22:01 - 00294568 _____ (VLCPlayer) C:\Users\outof_000\Desktop\Software_Update__CD5MTCD4349_0beaec9c-9198-45eb-9efe-008507fa0964_vK9QKAI26Q7C82GAGU63JUOCJO_0_0_0.exe
    2014-03-24 21:50 - 2014-03-24 21:50 - 00000796 _____ () C:\Users\outof_000\Desktop\JRT.txt
    2014-03-24 21:42 - 2014-03-24 21:42 - 00000000 ____D () C:\WINDOWS\ERUNT
    2014-03-24 21:40 - 2013-08-22 10:44 - 00344472 _____ () C:\WINDOWS\system32\FNTCACHE.DAT
    2014-03-24 21:38 - 2014-03-24 21:33 - 00000000 ____D () C:\AdwCleaner
    2014-03-24 21:37 - 2014-03-24 21:37 - 00003266 _____ () C:\Users\outof_000\Desktop\AdwCleaner[R0].txt
    2014-03-24 21:35 - 2014-03-24 21:35 - 00003027 _____ () C:\Users\outof_000\Desktop\HiJackThis.lnk
    2014-03-24 21:35 - 2014-03-24 21:35 - 00000000 ____D () C:\Users\outof_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HiJackThis
    2014-03-24 21:35 - 2014-03-24 21:35 - 00000000 ____D () C:\Program Files (x86)\Trend Micro
    2014-03-24 21:32 - 2014-03-24 21:32 - 01038974 _____ (Thisisu) C:\Users\outof_000\Desktop\JRT.exe
    2014-03-24 21:32 - 2014-03-24 21:31 - 01950720 _____ () C:\Users\outof_000\Desktop\adwcleaner.exe
    2014-03-24 21:30 - 2014-03-24 21:30 - 01402880 _____ () C:\Users\outof_000\Desktop\HijackThis.msi
    2014-03-24 21:25 - 2014-03-24 21:25 - 00000000 ____D () C:\Users\outof_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\IDMSQ
    2014-03-24 21:25 - 2014-03-24 21:25 - 00000000 ____D () C:\Program Files (x86)\IDMSQ
    2014-03-24 21:25 - 2014-03-24 21:25 - 00000000 ____D () C:\MININT
    2014-03-24 21:24 - 2014-03-24 21:24 - 01075264 _____ (OR Interactive Ltd) C:\Users\outof_000\Desktop\IDM2.exe
    2014-03-23 18:06 - 2014-01-11 12:22 - 00000000 ____D () C:\ProgramData\Package Cache
    2014-03-23 18:05 - 2014-03-23 18:04 - 63290992 _____ (Plex, Inc.) C:\Users\outof_000\Desktop\Plex-Media-Server-0.9.907.429-f80a8d6-en-US.exe
    2014-03-22 10:39 - 2013-08-22 11:36 - 00000000 ____D () C:\WINDOWS\rescache
    2014-03-21 18:44 - 2013-08-22 09:25 - 00262144 ___SH () C:\WINDOWS\system32\config\ELAM
    2014-03-20 21:23 - 2013-11-14 03:28 - 00863592 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
    2014-03-20 21:15 - 2013-08-22 09:25 - 00262144 ___SH () C:\WINDOWS\system32\config\BBI
    2014-03-20 20:58 - 2014-03-20 18:52 - 00000000 ____D () C:\Users\outof_000\AppData\Roaming\XBMC
    2014-03-20 20:57 - 2013-06-22 11:03 - 00000000 ___RD () C:\Users\outof_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
    2014-03-20 20:57 - 2013-06-22 11:03 - 00000000 ___RD () C:\Users\outof_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
    2014-03-20 20:50 - 2014-03-20 20:50 - 00000258 __RSH () C:\ProgramData\ntuser.pol
    2014-03-20 20:48 - 2013-11-18 20:18 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
    2014-03-20 20:48 - 2013-11-18 20:18 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
    2014-03-20 20:45 - 2013-08-22 11:36 - 00000000 ___RD () C:\WINDOWS\ToastData
    2014-03-20 20:45 - 2013-08-22 11:36 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
    2014-03-20 20:45 - 2013-08-22 11:36 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
    2014-03-20 20:45 - 2013-08-22 11:36 - 00000000 ____D () C:\Program Files\Windows Defender
    2014-03-20 20:45 - 2013-08-22 11:36 - 00000000 ____D () C:\Program Files (x86)\Windows Defender
    2014-03-20 19:08 - 2014-03-20 19:08 - 00000000 ____D () C:\WINDOWS\System32\Tasks\Apple
    2014-03-20 19:08 - 2014-03-20 19:08 - 00000000 ____D () C:\Users\outof_000\AppData\Local\Apple
    2014-03-20 19:08 - 2014-03-20 19:08 - 00000000 ____D () C:\ProgramData\Apple
    2014-03-20 19:08 - 2014-03-20 19:08 - 00000000 ____D () C:\Program Files\Bonjour Print Services
    2014-03-20 19:08 - 2014-03-20 19:08 - 00000000 ____D () C:\Program Files\Bonjour
    2014-03-20 19:08 - 2014-03-20 19:08 - 00000000 ____D () C:\Program Files (x86)\Bonjour
    2014-03-20 19:08 - 2014-03-20 19:08 - 00000000 ____D () C:\Program Files (x86)\Apple Software Update
    2014-03-20 19:07 - 2014-03-20 19:07 - 05436744 _____ (Apple Inc.) C:\Users\outof_000\Desktop\BonjourPSSetup.exe
    2014-03-19 21:54 - 2013-09-08 19:57 - 00000000 ____D () C:\Users\outof_000\AppData\Roaming\uTorrent
    2014-03-19 21:22 - 2014-03-19 21:22 - 00000000 ____D () C:\Users\outof_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\XBMC
    2014-03-19 21:22 - 2014-03-19 21:21 - 00000000 ____D () C:\Program Files (x86)\XBMC
    2014-03-19 21:15 - 2014-03-19 21:15 - 59604731 _____ () C:\Users\outof_000\Desktop\xbmc-12.3.exe
    2014-03-19 20:44 - 2013-08-15 18:51 - 00000000 ____D () C:\WINDOWS\system32\MRT
    2014-03-19 20:40 - 2013-06-26 19:16 - 90015360 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
    2014-03-08 13:42 - 2013-08-22 10:46 - 00287604 _____ () C:\WINDOWS\setupact.log
    2014-03-04 18:53 - 2013-08-22 11:38 - 00693240 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
    2014-03-04 18:53 - 2013-08-22 11:38 - 00105464 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
    2014-03-01 20:19 - 2014-03-01 20:19 - 00000000 ____D () C:\Users\outof_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\DISH Anywhere Video Player
    2014-03-01 20:19 - 2014-03-01 20:19 - 00000000 ____D () C:\Users\outof_000\AppData\Roaming\DISH Anywhere
    2014-03-01 18:45 - 2014-03-01 18:45 - 29601600 _____ (DISH Anywhere) C:\Users\outof_000\Desktop\DISH_Anywhere_Video_Player_Installer_2.8.1.exe
    2014-03-01 16:38 - 2014-03-01 13:00 - 00000000 ____D () C:\Users\outof_000\AppData\Local\DishWorld_cache
    2014-03-01 13:00 - 2014-03-01 13:00 - 00000000 ____D () C:\Users\outof_000\AppData\Roaming\SecureMedia
    2014-03-01 12:59 - 2014-03-01 12:59 - 00000000 ____D () C:\Users\outof_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\DishWorld
    2014-03-01 12:59 - 2014-03-01 12:59 - 00000000 ____D () C:\ProgramData\DishWorld
    2014-03-01 12:55 - 2014-03-01 12:55 - 18481152 _____ () C:\Users\outof_000\Desktop\DishWorld.msi
    2014-03-01 12:44 - 2014-02-23 16:29 - 00000000 ___DC () C:\WINDOWS\Panther
    2014-03-01 02:05 - 2014-03-14 15:09 - 23133696 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
    2014-03-01 00:58 - 2014-03-14 15:08 - 02765824 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
    2014-03-01 00:30 - 2014-03-14 15:09 - 17074688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
    2014-03-01 00:17 - 2014-03-14 15:08 - 00218624 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
    2014-02-28 23:54 - 2014-03-14 15:08 - 05768704 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
    2014-02-28 23:47 - 2014-03-14 15:08 - 02168320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
    2014-02-28 23:42 - 2014-03-14 15:08 - 00627200 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
    2014-02-28 23:18 - 2014-03-14 15:09 - 13051904 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
    2014-02-28 23:14 - 2014-03-14 15:08 - 04244480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
    2014-02-28 23:10 - 2014-03-14 15:08 - 02334208 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
    2014-02-28 23:03 - 2014-03-14 15:08 - 00524288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
    2014-02-28 22:57 - 2014-03-14 15:08 - 11266048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
    2014-02-28 22:38 - 2014-03-14 15:08 - 01393664 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
    2014-02-28 22:32 - 2014-03-14 15:08 - 01820160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
    2014-02-28 22:27 - 2014-03-14 15:08 - 01156096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
    2014-02-28 22:25 - 2014-03-14 15:08 - 00817664 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
    2014-02-28 22:25 - 2014-03-14 15:08 - 00703488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
    2014-02-27 21:41 - 2013-08-22 11:36 - 00000000 ____D () C:\WINDOWS\system32\restore

    Some content of TEMP:
    ====================
    C:\Users\outof_000\AppData\Local\Temp\ntdll_dump.dll
    C:\Users\outof_000\AppData\Local\Temp\Quarantine.exe


    ==================== Bamital & volsnap Check =================

    C:\Windows\System32\winlogon.exe => MD5 is legit
    C:\Windows\System32\wininit.exe => MD5 is legit
    C:\Windows\explorer.exe => MD5 is legit
    C:\Windows\SysWOW64\explorer.exe => MD5 is legit
    C:\Windows\System32\svchost.exe => MD5 is legit
    C:\Windows\SysWOW64\svchost.exe => MD5 is legit
    C:\Windows\System32\services.exe => MD5 is legit
    C:\Windows\System32\User32.dll => MD5 is legit
    C:\Windows\SysWOW64\User32.dll => MD5 is legit
    C:\Windows\System32\userinit.exe => MD5 is legit
    C:\Windows\SysWOW64\userinit.exe => MD5 is legit
    C:\Windows\System32\rpcss.dll => MD5 is legit
    C:\Windows\System32\Drivers\volsnap.sys
    [2014-03-12 20:17] - [2014-01-31 12:15] - 0311640 ___AC (Microsoft Corporation) C85C075DE5B6D0FE116043054DE8EE02



    LastRegBack: 2014-03-24 22:27

    ==================== End Of Log ============================


    Unfortunately I had already run Farbar once before so the Addition.txt file is old. Here it is though in case it is still helpful.

    Additional scan result of Farbar Recovery Scan Tool (x64) Version: 13-03-2014
    Ran by outof_000 at 2014-03-24 22:03:09
    Running from C:\Users\outof_000\Desktop
    Boot Mode: Normal
    ==========================================================


    ==================== Security Center ========================

    AV: Webroot SecureAnywhere (Disabled - Up to date) {66A6FE14-08CB-F415-3742-517201416109}
    AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    AS: Webroot SecureAnywhere (Disabled - Up to date) {DDC71FF0-2EF1-FB9B-0DF2-6A007AC62BB4}
    AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    AS: Spybot - Search and Destroy (Enabled - Up to date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}

    ==================== Installed Programs ======================

    µTorrent (HKCU\...\uTorrent) (Version: 3.3.2.30303 - BitTorrent Inc.)
    7-Zip 9.20 (HKLM-x32\...\7-Zip) (Version: - )
    7-Zip Packages (HKCU\...\7-Zip Packages) (Version: - ) <==== ATTENTION
    Adobe Reader X (10.1.9) MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}) (Version: 10.1.9 - Adobe Systems Incorporated)
    Age of Empires II: HD Edition (HKLM-x32\...\Steam App 221380) (Version: - Hidden Path Entertainment, Ensemble Studios)
    Alcor Micro USB Card Reader (HKLM-x32\...\AmUStor) (Version: 3.4.117.01527 - Alcor Micro Corp.)
    Alcor Micro USB Card Reader (x32 Version: 3.4.117.01527 - Alcor Micro Corp.) Hidden
    Apple Software Update (HKLM-x32\...\{6956856F-B6B3-4BE0-BA0B-8F495BE32033}) (Version: 2.1.1.116 - Apple Inc.)
    ASUS Instant Connect (HKLM-x32\...\{89ECB85A-D933-4CEA-9116-5CBC9C2ED95B}) (Version: 1.2.8 - ASUS)
    ASUS InstantOn (HKLM-x32\...\{749F674B-2674-47E8-879C-5626A06B2A91}) (Version: 3.0.2 - ASUS)
    ASUS LifeFrame3 (HKLM-x32\...\{1DBD1F12-ED93-49C0-A7CC-56CBDE488158}) (Version: 3.1.7 - ASUS)
    ASUS Live Update (HKLM-x32\...\{FA540E67-095C-4A1B-97BA-4D547DEC9AF4}) (Version: 3.1.9 - ASUS)
    ASUS Power4Gear Hybrid (HKLM\...\{9B6239BF-4E85-4590-8D72-51E30DB1A9AA}) (Version: 2.1.7 - ASUS)
    ASUS Splendid Video Enhancement Technology (HKLM-x32\...\{0969AF05-4FF6-4C00-9406-43599238DE0D}) (Version: 1.03.0004 - ASUS)
    ASUS Tutor (HKLM-x32\...\{58172D66-2F69-4215-9AEC-ED8196023736}) (Version: 1.0.7 - ASUS)
    ASUS USB Charger Plus (HKLM-x32\...\{A859E3E5-C62F-4BFA-AF1D-2B95E03166AF}) (Version: 2.1.4 - ASUS)
    ASUS VivoBook (HKLM\...\{04FDBE69-F9FD-42A2-9008-E5CE7F60C6BE}) (Version: 1.0.8 - ASUS)
    Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (HKLM-x32\...\{3108C217-BE83-42E4-AE9E-A56A2A92E549}) (Version: 2.1.0.7 - Atheros Communications Inc.)
    ATK Package (HKLM-x32\...\{AB5C933E-5C7D-4D30-B314-9C83A49B94BE}) (Version: 1.0.0023 - ASUS)
    avast! Free Antivirus (HKLM-x32\...\Avast) (Version: 9.0.2008 - Avast Software)
    Bonjour (HKLM\...\{B91110FB-33B4-468B-90C2-4D5E8AE3FAE1}) (Version: 2.0.2.0 - Apple Inc.)
    Bonjour Print Services (HKLM\...\{0DA20600-6130-443B-9D4B-F30520315FA6}) (Version: 2.0.2.0 - Apple Inc.)
    BubbleUPnP Server (HKLM-x32\...\BubbleUPnP Server) (Version: - )
    ChromecastApp (HKCU\...\{079ede36-133d-44b0-8053-c7c1fa8d2e0d}_is1) (Version: 1.1.266.0 - Google Inc.)
    DISH Anywhere Video Player (HKLM-x32\...\{628D4D4A-1335-48EA-AC62-34B00B724908}) (Version: 2.8.1.0 - DISH Anywhere)
    DishWorld (HKLM-x32\...\{E45D6DBD-0E4B-41D0-BA0E-D004ADB82C01}) (Version: 2.4.139 - Echostar)
    Google Chrome (HKLM-x32\...\Google Chrome) (Version: 32.0.1700.76 - Google Inc.)
    Google Update Helper (x32 Version: 1.3.22.3 - Google Inc.) Hidden
    HiJackThis (HKLM-x32\...\{45A66726-69BC-466B-A7A4-12FCBA4883D7}) (Version: 1.0.0 - Trend Micro)
    Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1252 - Intel Corporation)
    Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.17.10.3347 - Intel Corporation)
    Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 2.0.0.37149 - Intel Corporation)
    Intel® Trusted Connect Service Client (Version: 1.24.388.1 - Intel Corporation) Hidden
    Internet Download Manager² 1.0 (HKLM-x32\...\IDMSQ) (Version: 1.0 - OR Interactive Ltd)
    Java 7 Update 45 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217021FF}) (Version: 7.0.450 - Oracle)
    Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
    Malwarebytes Anti-Malware version 1.75.0.1300 (HKLM-x32\...\Malwarebytes' Anti-Malware_is1) (Version: 1.75.0.1300 - Malwarebytes Corporation)
    Microsoft Mouse and Keyboard Center (HKLM\...\Microsoft Mouse and Keyboard Center) (Version: 2.2.173.0 - Microsoft Corporation)
    Microsoft Mouse and Keyboard Center (Version: 2.2.173.0 - Microsoft Corporation) Hidden
    Microsoft Office (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.6120.5004 - Microsoft Corporation)
    Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
    Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
    Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
    Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (HKLM-x32\...\{a1909659-0a08-4554-8af1-2175904903a1}) (Version: 11.0.60610.1 - Microsoft Corporation)
    Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (HKLM-x32\...\{95716cce-fc71-413f-8ad5-56c2892d4b3a}) (Version: 11.0.60610.1 - Microsoft Corporation)
    Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.60610 (Version: 11.0.60610 - Microsoft Corporation) Hidden
    Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.60610 (Version: 11.0.60610 - Microsoft Corporation) Hidden
    Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.60610 (x32 Version: 11.0.60610 - Microsoft Corporation) Hidden
    Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.60610 (x32 Version: 11.0.60610 - Microsoft Corporation) Hidden
    Platform (x32 Version: 1.39 - VIA Technologies, Inc.) Hidden
    Qualcomm Atheros Client Installation Program (HKLM-x32\...\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 10.0 - Qualcomm Atheros)
    Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.2.25 - Safer-Networking Ltd.)
    SpyHunter (HKLM\...\{ACF5FE1B-3772-4068-8B87-2D2A6EFD0A05}) (Version: 4.17.6.4336 - Enigma Software Group USA, LLC)
    Steam (HKLM-x32\...\Steam) (Version: - Valve Corporation)
    VIA Platform Device Manager (HKLM-x32\...\InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}) (Version: 1.39 - VIA Technologies, Inc.)
    VLC media player 2.0.0 (HKLM-x32\...\VLC media player) (Version: 2.0.0 - VideoLAN)
    WD Discovery (HKLM-x32\...\{02DC675D-4BA4-40D9-A94D-6895D07C7419}) (Version: 102.0.0.116 - Western Digital Technologies, Inc.)
    Webroot SecureAnywhere (HKLM-x32\...\WRUNINST) (Version: 8.0.4.66 - Webroot)
    WinFlash (HKLM-x32\...\{8F21291E-0444-4B1D-B9F9-4370A73E346D}) (Version: 2.41.1 - ASUS)
    XBMC (HKCU\...\XBMC) (Version: - Team XBMC)

    ==================== Restore Points =========================

    01-03-2014 16:59:03 Installed DishWorld
    10-03-2014 11:16:13 Scheduled Checkpoint
    13-03-2014 23:36:53 Windows Update
    20-03-2014 00:35:08 Windows Update
    23-03-2014 21:49:36 Removed SpyHunter
    25-03-2014 01:31:04 Installed HiJackThis

    ==================== Hosts content: ==========================

    2013-08-22 09:25 - 2013-08-22 09:25 - 00000824 ____N C:\WINDOWS\system32\Drivers\etc\hosts

    ==================== Scheduled Tasks (whitelisted) =============

    Task: {010AC2D0-13EE-40DB-97DD-FFABE070EC34} - System32\Tasks\Microsoft_Hardware_Launch_mousekeyboardcenter_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\mousekeyboardcenter.exe [2013-05-13] (Microsoft)
    Task: {02407824-9B59-4F5E-8951-1EB7F4CA9AD1} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2008-07-30] (Apple Inc.)
    Task: {040352D7-729F-4568-8E32-D951BBA1DBAD} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3593858388-4215303024-77723331-1001UA => C:\Users\outof_000\AppData\Local\Google\Update\GoogleUpdate.exe [2013-08-23] (Google Inc.)
    Task: {05293577-D647-4185-B859-C94839A0B2E3} - System32\Tasks\Microsoft\Windows\SettingSync\NetworkStateChangeTask
    Task: {062AF882-3353-49E5-8D9F-17FBC0E96FED} - System32\Tasks\Microsoft_MKC_Logon_Task_ipoint.exe => c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2013-05-13] (Microsoft Corporation)
    Task: {0B545118-B563-42FC-8D07-B78F602FCF34} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => Rundll32.exe WSClient.dll,RefreshBannedAppsList
    Task: {0B9F157F-4B75-4CEC-A7B0-83D739823BE5} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2014-03-19] (Microsoft Corporation)
    Task: {0FF90CCC-ADFE-4066-A8F8-BE7A73ED3A56} - System32\Tasks\ASUS USB Charger Plus => C:\Program Files (x86)\ASUS\USBChargerPlus\USBChargerPlus.exe [2012-07-24] (ASUSTek Computer Inc.)
    Task: {1A8CCDF9-6F7F-4959-A5F1-39E328B616D4} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDUpdate.exe
    Task: {1F9FDFE5-5160-47FE-A70C-DBE3345B4754} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDScan.exe
    Task: {2085BF56-520D-4951-B7C0-DF34AF90CC6A} - System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask => Rundll32.exe sysmain.dll,PfSvWsSwapAssessmentTask
    Task: {2C9C0C6C-2A74-46F2-858A-4389D253EAD0} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCachePrepopulate
    Task: {2D7B4090-11E6-46CD-A0EB-EDD70CC96BED} - System32\Tasks\Microsoft_MKC_Logon_Task_itype.exe => c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2013-05-13] (Microsoft Corporation)
    Task: {352E6CA0-7314-4DF4-89C4-682368D80D57} - System32\Tasks\Microsoft\Windows\Workplace Join\Automatic-Workplace-Join => C:\Windows\System32\AutoWorkplace.exe [2013-08-22] (Microsoft Corporation)
    Task: {3B6D8A73-F20B-4C93-B8FB-56A154F172D2} - System32\Tasks\Microsoft\Windows\Time Zone\SynchronizeTimeZone => C:\Windows\system32\tzsync.exe [2013-08-22] (Microsoft Corporation)
    Task: {40E1BE54-00E2-40DF-A589-DF73CCA7B0B2} - System32\Tasks\Microsoft_Hardware_Launch_itype_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2013-05-13] (Microsoft Corporation)
    Task: {49754026-21E1-41FC-94FD-727AFE414FE7} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCacheRebalance
    Task: {6AA91E8C-DDBD-4979-8464-4062F7681A19} - System32\Tasks\Microsoft\Windows\Plug and Play\Plug and Play Cleanup
    Task: {6DFCB649-0769-4F83-BB10-F60F235F6D3D} - System32\Tasks\Microsoft\Windows\SkyDrive\Idle Sync Maintenance Task
    Task: {73B1B253-CE67-4501-AE1A-377DD1D68B65} - System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask => Rundll32.exe Startupscan.dll,SusRunTask
    Task: {77F1D869-6E65-4079-A2A0-E2023408EF97} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => Rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState
    Task: {837F6EFC-AD2C-493B-8893-620BFE31E5C7} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-06-22] (Google Inc.)
    Task: {870BAAD7-F5A2-4C67-9846-A1402E011F28} - System32\Tasks\ASUS P4G => C:\Program Files\ASUS\P4G\BatteryLife.exe [2012-08-24] (ASUS)
    Task: {872D0E53-FD2E-41E3-B431-698AF82882CE} - System32\Tasks\Microsoft\Windows\SkyDrive\Routine Maintenance Task
    Task: {8CC813C9-712A-41EF-9512-B233444FC669} - System32\Tasks\Microsoft\Windows\AppxDeploymentClient\Pre-staged app cleanup => Rundll32.exe %windir%\system32\AppxDeploymentClient.dll,AppxPreStageCleanupRunTask
    Task: {9088F09F-7E95-445D-AC24-27DDE2986BEB} - System32\Tasks\ASUS Live Update => C:\Program Files (x86)\ASUS\ASUS Live Update\LiveUpdate.exe [2012-08-22] (ASUSTeK Computer Inc.)
    Task: {9FF4C139-5234-410C-B7FA-23EE2FD2AB53} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Maintenance Work
    Task: {ACB72CE5-0DFF-4C6E-B429-B92E57117256} - System32\Tasks\Microsoft_Hardware_Launch_ipoint_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2013-05-13] (Microsoft Corporation)
    Task: {B3804839-8D15-47D5-A296-BAA830543198} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDImmunize.exe
    Task: {C92571F8-1FB2-413E-893E-9BEE9AFB4E15} - \SpyHunter4Startup No Task File
    Task: {CCD6939C-C2BB-4D5C-91E9-0A8041B3C667} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-06-22] (Google Inc.)
    Task: {CFD7C21A-808B-487B-A6EC-8A10E44E8360} - System32\Tasks\Microsoft\Windows\SettingSync\BackupTask
    Task: {D88FEC9E-A82A-46F9-87E2-B6B97B301C1A} - System32\Tasks\Microsoft\Windows\WS\License Validation => Rundll32.exe WSClient.dll,WSpTLR licensing
    Task: {DA46820F-FF8A-4B5E-A6B2-B12185DCFFFB} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Logon Synchronization
    Task: {E6D378FA-E068-4BCB-80DE-56D43A249507} - System32\Tasks\Microsoft\Windows\RecoveryEnvironment\VerifyWinRE
    Task: {F02A2975-03C8-40FF-8ACF-5709A794CBE0} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3593858388-4215303024-77723331-1001Core => C:\Users\outof_000\AppData\Local\Google\Update\GoogleUpdate.exe [2013-08-23] (Google Inc.)
    Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    Task: C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-3593858388-4215303024-77723331-1001Core.job => C:\Users\outof_000\AppData\Local\Google\Update\GoogleUpdate.exe
    Task: C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-3593858388-4215303024-77723331-1001UA.job => C:\Users\outof_000\AppData\Local\Google\Update\GoogleUpdate.exe

    ==================== Loaded Modules (whitelisted) =============

    2011-11-16 10:52 - 2011-11-16 10:52 - 00196608 _____ () C:\Program Files (x86)\BubbleUPnP Server\BubbleUPnPServer.exe
    2012-08-24 17:26 - 2012-08-24 17:26 - 00031360 _____ () C:\Program Files\ASUS\P4G\DevMng.dll
    2014-01-30 00:02 - 2014-01-30 00:02 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
    2012-09-29 20:11 - 2012-09-17 22:47 - 00078480 _____ () C:\Program Files (x86)\VIA\VIAudioi\VDeck\QsApoApi64.dll
    2012-09-29 20:11 - 2012-09-17 22:47 - 00386192 _____ () C:\Program Files (x86)\VIA\VIAudioi\VDeck\Dts2ApoApi64.dll
    2013-10-30 02:21 - 2013-10-30 02:21 - 02561088 _____ () C:\Program Files (x86)\IDMSQ\idmsq.exe
    2014-02-17 23:26 - 2012-08-23 11:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
    2014-02-17 23:26 - 2013-05-16 11:55 - 00113496 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
    2014-02-17 23:26 - 2013-05-16 11:55 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
    2014-02-17 23:26 - 2013-05-16 11:55 - 00161112 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
    2012-08-24 20:17 - 2012-08-24 20:17 - 00009216 _____ () C:\Program Files (x86)\ASUS\Splendid\GLCDdll.dll
    2012-09-29 20:11 - 2012-06-25 13:41 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
    2014-01-14 20:43 - 2014-01-11 06:28 - 00715544 _____ () C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.76\libglesv2.dll
    2014-01-14 20:43 - 2014-01-11 06:28 - 00100120 _____ () C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.76\libegl.dll
    2014-01-14 20:44 - 2014-01-11 06:29 - 04055320 _____ () C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.76\pdf.dll
    2014-01-14 20:44 - 2014-01-11 06:29 - 00399640 _____ () C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.76\ppGoogleNaClPluginChrome.dll
    2014-01-14 20:43 - 2014-01-11 06:28 - 01634584 _____ () C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.76\ffmpegsumo.dll
    2014-01-14 20:44 - 2014-01-11 06:29 - 13615896 _____ () C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.76\PepperFlash\pepflashplayer.dll

    ==================== Alternate Data Streams (whitelisted) =========

    AlternateDataStreams: C:\Users\outof_000\SkyDrive:ms-properties

    ==================== Safe Mode (whitelisted) ===================


    ==================== Disabled items from MSCONFIG ==============


    ==================== Faulty Device Manager Devices =============


    ==================== Event log errors: =========================

    Application errors:
    ==================
    Error: (03/24/2014 08:50:31 PM) (Source: Customer Experience Improvement Program) (User: )
    Description: 80070005

    Error: (03/24/2014 08:08:46 PM) (Source: Bonjour Service) (User: )
    Description: Task Scheduling Error: m->NextScheduledSPRetry 77363906

    Error: (03/24/2014 08:08:46 PM) (Source: Bonjour Service) (User: )
    Description: Task Scheduling Error: m->NextScheduledEvent 77363906

    Error: (03/24/2014 08:08:46 PM) (Source: Bonjour Service) (User: )
    Description: Task Scheduling Error: Continuously busy for more than a second

    Error: (03/23/2014 05:45:37 PM) (Source: Application Error) (User: )
    Description: Faulting application name: delegate_execute.exe, version: 32.0.1700.76, time stamp: 0x52d0ece9
    Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
    Exception code: 0xc0000005
    Fault offset: 0x00000000
    Faulting process id: 0x164c
    Faulting application start time: 0xdelegate_execute.exe0
    Faulting application path: delegate_execute.exe1
    Faulting module path: delegate_execute.exe2
    Report Id: delegate_execute.exe3
    Faulting package full name: delegate_execute.exe4
    Faulting package-relative application ID: delegate_execute.exe5

    Error: (03/23/2014 05:43:00 PM) (Source: Bonjour Service) (User: )
    Description: Task Scheduling Error: m->NextScheduledSPRetry 111266172

    Error: (03/23/2014 05:43:00 PM) (Source: Bonjour Service) (User: )
    Description: Task Scheduling Error: m->NextScheduledEvent 111266172

    Error: (03/23/2014 05:43:00 PM) (Source: Bonjour Service) (User: )
    Description: Task Scheduling Error: Continuously busy for more than a second

    Error: (03/22/2014 09:17:53 AM) (Source: Bonjour Service) (User: )
    Description: Task Scheduling Error: m->NextScheduledSPRetry 45864875

    Error: (03/22/2014 09:17:53 AM) (Source: Bonjour Service) (User: )
    Description: Task Scheduling Error: m->NextScheduledEvent 45864875


    System errors:
    =============
    Error: (03/24/2014 08:11:54 PM) (Source: DCOM) (User: NT AUTHORITY)
    Description: machine-defaultLocalActivation{C2F03A33-21F5-47FA-B4BB-156362A2F239}{316CDED5-E4AE-4B15-9113-7055D84DCC97}NT AUTHORITYLOCAL SERVICES-1-5-19LocalHost (Using LRPC)UnavailableUnavailable

    Error: (03/23/2014 05:46:08 PM) (Source: DCOM) (User: NT AUTHORITY)
    Description: machine-defaultLocalActivation{C2F03A33-21F5-47FA-B4BB-156362A2F239}{316CDED5-E4AE-4B15-9113-7055D84DCC97}NT AUTHORITYLOCAL SERVICES-1-5-19LocalHost (Using LRPC)UnavailableUnavailable

    Error: (03/22/2014 10:00:34 AM) (Source: DCOM) (User: NT AUTHORITY)
    Description: machine-defaultLocalActivation{C2F03A33-21F5-47FA-B4BB-156362A2F239}{316CDED5-E4AE-4B15-9113-7055D84DCC97}NT AUTHORITYLOCAL SERVICES-1-5-19LocalHost (Using LRPC)UnavailableUnavailable

    Error: (03/21/2014 06:02:57 PM) (Source: DCOM) (User: NT AUTHORITY)
    Description: machine-defaultLocalActivation{C2F03A33-21F5-47FA-B4BB-156362A2F239}{316CDED5-E4AE-4B15-9113-7055D84DCC97}NT AUTHORITYLOCAL SERVICES-1-5-19LocalHost (Using LRPC)UnavailableUnavailable

    Error: (03/20/2014 06:38:40 PM) (Source: DCOM) (User: NT AUTHORITY)
    Description: machine-defaultLocalActivation{C2F03A33-21F5-47FA-B4BB-156362A2F239}{316CDED5-E4AE-4B15-9113-7055D84DCC97}NT AUTHORITYLOCAL SERVICES-1-5-19LocalHost (Using LRPC)UnavailableUnavailable

    Error: (03/19/2014 10:00:01 AM) (Source: DCOM) (User: NT AUTHORITY)
    Description: machine-defaultLocalActivation{C2F03A33-21F5-47FA-B4BB-156362A2F239}{316CDED5-E4AE-4B15-9113-7055D84DCC97}NT AUTHORITYLOCAL SERVICES-1-5-19LocalHost (Using LRPC)UnavailableUnavailable

    Error: (03/18/2014 10:00:01 AM) (Source: DCOM) (User: NT AUTHORITY)
    Description: machine-defaultLocalActivation{C2F03A33-21F5-47FA-B4BB-156362A2F239}{316CDED5-E4AE-4B15-9113-7055D84DCC97}NT AUTHORITYLOCAL SERVICES-1-5-19LocalHost (Using LRPC)UnavailableUnavailable

    Error: (03/17/2014 10:00:01 AM) (Source: DCOM) (User: NT AUTHORITY)
    Description: machine-defaultLocalActivation{C2F03A33-21F5-47FA-B4BB-156362A2F239}{316CDED5-E4AE-4B15-9113-7055D84DCC97}NT AUTHORITYLOCAL SERVICES-1-5-19LocalHost (Using LRPC)UnavailableUnavailable

    Error: (03/16/2014 10:00:01 AM) (Source: DCOM) (User: NT AUTHORITY)
    Description: machine-defaultLocalActivation{C2F03A33-21F5-47FA-B4BB-156362A2F239}{316CDED5-E4AE-4B15-9113-7055D84DCC97}NT AUTHORITYLOCAL SERVICES-1-5-19LocalHost (Using LRPC)UnavailableUnavailable

    Error: (03/15/2014 10:00:01 AM) (Source: DCOM) (User: NT AUTHORITY)
    Description: machine-defaultLocalActivation{C2F03A33-21F5-47FA-B4BB-156362A2F239}{316CDED5-E4AE-4B15-9113-7055D84DCC97}NT AUTHORITYLOCAL SERVICES-1-5-19LocalHost (Using LRPC)UnavailableUnavailable


    Microsoft Office Sessions:
    =========================
    Error: (03/24/2014 08:50:31 PM) (Source: Customer Experience Improvement Program)(User: )
    Description: 80070005

    Error: (03/24/2014 08:08:46 PM) (Source: Bonjour Service)(User: )
    Description: Task Scheduling Error: m->NextScheduledSPRetry 77363906

    Error: (03/24/2014 08:08:46 PM) (Source: Bonjour Service)(User: )
    Description: Task Scheduling Error: m->NextScheduledEvent 77363906

    Error: (03/24/2014 08:08:46 PM) (Source: Bonjour Service)(User: )
    Description: Task Scheduling Error: Continuously busy for more than a second

    Error: (03/23/2014 05:45:37 PM) (Source: Application Error)(User: )
    Description: delegate_execute.exe32.0.1700.7652d0ece9unknown0.0.0.000000000c000000500000000164c01cf46e10385f8cbC:\Program Files (x86)\Google\Chrome\Application\32.0.1700.76\delegate_execute.exeunknown77e68553-b2d4-11e3-be96-50465d329146

    Error: (03/23/2014 05:43:00 PM) (Source: Bonjour Service)(User: )
    Description: Task Scheduling Error: m->NextScheduledSPRetry 111266172

    Error: (03/23/2014 05:43:00 PM) (Source: Bonjour Service)(User: )
    Description: Task Scheduling Error: m->NextScheduledEvent 111266172

    Error: (03/23/2014 05:43:00 PM) (Source: Bonjour Service)(User: )
    Description: Task Scheduling Error: Continuously busy for more than a second

    Error: (03/22/2014 09:17:53 AM) (Source: Bonjour Service)(User: )
    Description: Task Scheduling Error: m->NextScheduledSPRetry 45864875

    Error: (03/22/2014 09:17:53 AM) (Source: Bonjour Service)(User: )
    Description: Task Scheduling Error: m->NextScheduledEvent 45864875


    ==================== Memory info ===========================

    Percentage of memory in use: 49%
    Total physical RAM: 3979.6 MB
    Available physical RAM: 2004.91 MB
    Total Pagefile: 8843.6 MB
    Available Pagefile: 6640.02 MB
    Total Virtual: 131072 MB
    Available Virtual: 131071.79 MB

    ==================== Drives ================================

    Drive c: () (Fixed) (Total:444.42 GB) (Free:306.54 GB) NTFS ==>[System with boot components (obtained from reading drive)]

    ==================== MBR & Partition Table ==================

    ========================================================
    Disk: 0 (Size: 466 GB) (Disk ID: F97C441A)

    Partition: GPT Partition Type.

    ==================== End Of Log ============================
     
  7. outoftune

    outoftune Member

    Joined:
    May 31, 2006
    Messages:
    18
    Likes Received:
    0
    Trophy Points:
    11
    Also, i forgot to mention earlier but it just happened again, a popup randomly will occur and it will prompt me for a save location for .exe file download. it says it is an hdplayer or something like that. i obviously hit cancel and then close the popup.
     
  8. 2oldGeek

    2oldGeek Active member

    Joined:
    Jun 16, 2005
    Messages:
    3,687
    Likes Received:
    35
    Trophy Points:
    78
    Is this happening in Chrome or IE? or both....
     
  9. outoftune

    outoftune Member

    Joined:
    May 31, 2006
    Messages:
    18
    Likes Received:
    0
    Trophy Points:
    11
    It seems like only Chrome. I don't really use IE but I just did for a few minutes and didn't have any issues. The other issue as well doesn't occur in IE (google search adds at top)
     
  10. 2oldGeek

    2oldGeek Active member

    Joined:
    Jun 16, 2005
    Messages:
    3,687
    Likes Received:
    35
    Trophy Points:
    78
    Yeah, it looks like you have a lot of unnecessary plug-ins in your Chrome. It will take me some time to wade through the log so hold tight and I'll post as I can.

    2oG
     
  11. 2oldGeek

    2oldGeek Active member

    Joined:
    Jun 16, 2005
    Messages:
    3,687
    Likes Received:
    35
    Trophy Points:
    78
    outoftune,
    Please run this one for me to get rid of some of those Browser Hijackers, hopefully..

    [​IMG] —Junkware Removal Tool--

    Please download Junkware Removal Tool to your Desktop.
    Please close your security software to avoid potential conflicts.
    • Run the tool by double-clicking it. If you are using Windows Vista or 7, right-mouse click it and select Run as administrator.
    • The tool will open and start scanning your system.
    • Please be patient as this can take a while to complete, depending on your system's specifications.
    • On completion, a log (JRT.txt) is saved to your Desktop and will automatically open.
    • Please post the contents of JRT.txt into your reply.

    On your desktop or where ever you put FRST.exe there should be a Log File called Addition.txt. It's the second log from the Farbar scan Please post it for me also.
    Nevermind the Addition.txt - I found it. just wasn't looking far enough. lol
    TNX
    2oG
     
    Last edited: Mar 28, 2014
  12. ddp

    ddp Moderator Staff Member

    Joined:
    Oct 15, 2004
    Messages:
    39,011
    Likes Received:
    77
    Trophy Points:
    128
    can also try resetting google chrome back to defaults as found that to work.
     
  13. 2oldGeek

    2oldGeek Active member

    Joined:
    Jun 16, 2005
    Messages:
    3,687
    Likes Received:
    35
    Trophy Points:
    78
    Thanks, o late one, that's already on the table...
     
  14. ddp

    ddp Moderator Staff Member

    Joined:
    Oct 15, 2004
    Messages:
    39,011
    Likes Received:
    77
    Trophy Points:
    128
    i'm not late as was here before you so you are the late one.
     
  15. 2oldGeek

    2oldGeek Active member

    Joined:
    Jun 16, 2005
    Messages:
    3,687
    Likes Received:
    35
    Trophy Points:
    78
    took you a long time to figure that out lol
     
  16. ddp

    ddp Moderator Staff Member

    Joined:
    Oct 15, 2004
    Messages:
    39,011
    Likes Received:
    77
    Trophy Points:
    128
    nope as "d" comes before "o".
     
  17. 2oldGeek

    2oldGeek Active member

    Joined:
    Jun 16, 2005
    Messages:
    3,687
    Likes Received:
    35
    Trophy Points:
    78
    Hi outoftune,

    If you were able to run JRT.exe, I would like to see the log..

    Here is a fix for FRST and how to reset Chrome:

    Do the following:

    Please open Notepad. Ensure that word wrap is turned off. Click on Format and make sure that there is not a tick next to Word Wrap. If there's one, click on Word Wrap to remove it. Copy and paste the following in the code box into Notepad:

    Code:
    (Enigma Software Group USA, LLC.) C:\Program Files\Enigma Software Group\SpyHunter\SH4Service.exe
    BHO: ApptoUU - {839C88C4-2084-CCC7-5F05-394EF623248E} - C:\ProgramData\ApptoUU\4rD.x64.dll No File
    C:\ProgramData\ApptoUU
    BHO: EXEcheckER - {EB538218-9106-7D45-5338-BD9D8FA12747} - C:\ProgramData\EXEcheckER\ZOaoJwBVh.x64.dll No File
    C:\ProgramData\EXEcheckER
    BHO: DaiiScountLocatorr - {F0511C29-E278-712B-5087-8C55D8C05CD0} - C:\ProgramData\DaiiScountLocatorr\j6JVq.x64.dll No File
    C:\ProgramData\DaiiScountLocatorr
    BHO: SAAver box - {F0838AD1-8EF9-C48C-BB15-2561EBB3C156} - C:\ProgramData\SAAver box\q3kFcfVT_I.x64.dll No File
    C:\ProgramData\SAAver box
    BHO-x32: Idmsq Extension - {3AA4FC9D-FB51-44a2-B09F-0457857CA7C2} - C:\Users\outof_000\AppData\Roaming\IDMSQ\idmsqext.dll (Or Interactive Ltd)
    C:\Users\outof_000\AppData\Roaming\IDMSQ
    BHO-x32: ApptoUU - {839C88C4-2084-CCC7-5F05-394EF623248E} - C:\ProgramData\ApptoUU\4rD.dll No File
    C:\ProgramData\ApptoUU
    BHO-x32: EXEcheckER - {EB538218-9106-7D45-5338-BD9D8FA12747} - C:\ProgramData\EXEcheckER\ZOaoJwBVh.dll No File
    C:\ProgramData\EXEcheckER
    BHO-x32: DaiiScountLocatorr - {F0511C29-E278-712B-5087-8C55D8C05CD0} - C:\ProgramData\DaiiScountLocatorr\j6JVq.dll No File
    C:\ProgramData\DaiiScountLocatorr
    CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
    R2 SpyHunter 4 Service; C:\Program Files\Enigma Software Group\SpyHunter\SH4Service.exe [1025408 2014-01-09] (Enigma Software Group USA, LLC.)
    C:\Program Files\Enigma Software Group
    S3 esgiguard; C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [14872 2014-01-07] ()
    C:\Users\outof_000\AppData\Local\Temp\ntdll_dump.dll
    C:\Users\outof_000\AppData\Local\Temp\Quarantine.exe
    SpyHunter (HKLM\...\{ACF5FE1B-3772-4068-8B87-2D2A6EFD0A05}) (Version: 4.17.6.4336 - Enigma Software Group USA, LLC)
    2013-08-22 09:25 - 2013-08-22 09:25 - 00000824 ____N C:\WINDOWS\system32\Drivers\etc\hosts 



    Click on File > Save As....

    In the File Name box, copy and paste in fixlist.txt

    Click Save and save it to the same folder containing FRST (desktop?).

    Double click on FRST.exe click the Fix button then OK.



    Reset your browser settings: HERE



    Let me know how it’s doing now.

    2oG

    P.S. Please post the Fixlog.txt for me :)
     
  18. outoftune

    outoftune Member

    Joined:
    May 31, 2006
    Messages:
    18
    Likes Received:
    0
    Trophy Points:
    11
    Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 13-03-2014
    Ran by outof_000 at 2014-04-06 13:07:59 Run:1
    Running from C:\Users\outof_000\Desktop
    Boot Mode: Normal
    ==============================================

    Content of fixlist:
    *****************
    (Enigma Software Group USA, LLC.) C:\Program Files\Enigma Software Group\SpyHunter\SH4Service.exe

    BHO: ApptoUU - {839C88C4-2084-CCC7-5F05-394EF623248E} - C:\ProgramData\ApptoUU\4rD.x64.dll No File

    C:\ProgramData\ApptoUU

    BHO: EXEcheckER - {EB538218-9106-7D45-5338-BD9D8FA12747} - C:\ProgramData\EXEcheckER\ZOaoJwBVh.x64.dll No File

    C:\ProgramData\EXEcheckER

    BHO: DaiiScountLocatorr - {F0511C29-E278-712B-5087-8C55D8C05CD0} - C:\ProgramData\DaiiScountLocatorr\j6JVq.x64.dll No File

    C:\ProgramData\DaiiScountLocatorr

    BHO: SAAver box - {F0838AD1-8EF9-C48C-BB15-2561EBB3C156} - C:\ProgramData\SAAver box\q3kFcfVT_I.x64.dll No File

    C:\ProgramData\SAAver box

    BHO-x32: Idmsq Extension - {3AA4FC9D-FB51-44a2-B09F-0457857CA7C2} - C:\Users\outof_000\AppData\Roaming\IDMSQ\idmsqext.dll (Or Interactive Ltd)

    C:\Users\outof_000\AppData\Roaming\IDMSQ

    BHO-x32: ApptoUU - {839C88C4-2084-CCC7-5F05-394EF623248E} - C:\ProgramData\ApptoUU\4rD.dll No File

    C:\ProgramData\ApptoUU

    BHO-x32: EXEcheckER - {EB538218-9106-7D45-5338-BD9D8FA12747} - C:\ProgramData\EXEcheckER\ZOaoJwBVh.dll No File

    C:\ProgramData\EXEcheckER

    BHO-x32: DaiiScountLocatorr - {F0511C29-E278-712B-5087-8C55D8C05CD0} - C:\ProgramData\DaiiScountLocatorr\j6JVq.dll No File

    C:\ProgramData\DaiiScountLocatorr

    CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

    R2 SpyHunter 4 Service; C:\Program Files\Enigma Software Group\SpyHunter\SH4Service.exe [1025408 2014-01-09] (Enigma Software Group USA, LLC.)

    C:\Program Files\Enigma Software Group

    S3 esgiguard; C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [14872 2014-01-07] ()

    C:\Users\outof_000\AppData\Local\Temp\ntdll_dump.dll

    C:\Users\outof_000\AppData\Local\Temp\Quarantine.exe

    SpyHunter (HKLM\...\{ACF5FE1B-3772-4068-8B87-2D2A6EFD0A05}) (Version: 4.17.6.4336 - Enigma Software Group USA, LLC)

    2013-08-22 09:25 - 2013-08-22 09:25 - 00000824 ____N C:\WINDOWS\system32\Drivers\etc\hosts
    *****************

    C:\Program Files\Enigma Software Group\SpyHunter\SH4Service.exe => No running process found
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{839C88C4-2084-CCC7-5F05-394EF623248E} => Key deleted successfully.
    HKCR\CLSID\{839C88C4-2084-CCC7-5F05-394EF623248E} => Key deleted successfully.
    C:\ProgramData\ApptoUU => Moved successfully.
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EB538218-9106-7D45-5338-BD9D8FA12747} => Key deleted successfully.
    HKCR\CLSID\{EB538218-9106-7D45-5338-BD9D8FA12747} => Key deleted successfully.
    C:\ProgramData\EXEcheckER => Moved successfully.
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F0511C29-E278-712B-5087-8C55D8C05CD0} => Key deleted successfully.
    HKCR\CLSID\{F0511C29-E278-712B-5087-8C55D8C05CD0} => Key deleted successfully.
    C:\ProgramData\DaiiScountLocatorr => Moved successfully.
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F0838AD1-8EF9-C48C-BB15-2561EBB3C156} => Key deleted successfully.
    HKCR\CLSID\{F0838AD1-8EF9-C48C-BB15-2561EBB3C156} => Key deleted successfully.
    C:\ProgramData\SAAver box => Moved successfully.
    HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3AA4FC9D-FB51-44a2-B09F-0457857CA7C2} => Key deleted successfully.
    HKCR\Wow6432Node\CLSID\{3AA4FC9D-FB51-44a2-B09F-0457857CA7C2} => Key deleted successfully.

    "C:\Users\outof_000\AppData\Roaming\IDMSQ" directory move:

    C:\Users\outof_000\AppData\Roaming\IDMSQ\IDMSQ.crx => Moved successfully.
    Could not move "C:\Users\outof_000\AppData\Roaming\IDMSQ\idmsq.db" => Scheduled to move on reboot.
    C:\Users\outof_000\AppData\Roaming\IDMSQ\idmsqext.dll => Moved successfully.
    Could not move "C:\Users\outof_000\AppData\Roaming\IDMSQ" directory. => Scheduled to move on reboot.

    HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{839C88C4-2084-CCC7-5F05-394EF623248E} => Key deleted successfully.
    HKCR\Wow6432Node\CLSID\{839C88C4-2084-CCC7-5F05-394EF623248E} => Key deleted successfully.
    "C:\ProgramData\ApptoUU" => File/Directory not found.
    HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EB538218-9106-7D45-5338-BD9D8FA12747} => Key deleted successfully.
    HKCR\Wow6432Node\CLSID\{EB538218-9106-7D45-5338-BD9D8FA12747} => Key deleted successfully.
    "C:\ProgramData\EXEcheckER" => File/Directory not found.
    HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F0511C29-E278-712B-5087-8C55D8C05CD0} => Key deleted successfully.
    HKCR\Wow6432Node\CLSID\{F0511C29-E278-712B-5087-8C55D8C05CD0} => Key deleted successfully.
    "C:\ProgramData\DaiiScountLocatorr" => File/Directory not found.
    HKLM\SOFTWARE\Policies\Google => Key deleted successfully.
    SpyHunter 4 Service => Service not found.
    C:\Program Files\Enigma Software Group => Moved successfully.
    esgiguard => Service deleted successfully.
    C:\Users\outof_000\AppData\Local\Temp\ntdll_dump.dll => Moved successfully.
    C:\Users\outof_000\AppData\Local\Temp\Quarantine.exe => Moved successfully.
    Could not move "C:\WINDOWS\system32\Drivers\etc\hosts" => Scheduled to move on reboot.

    => Result of Scheduled Files to move (Boot Mode: Normal) (Date&Time: 2014-04-06 13:10:08)<=

    C:\Users\outof_000\AppData\Roaming\IDMSQ\idmsq.db => Is moved successfully.
    C:\Users\outof_000\AppData\Roaming\IDMSQ => Moved successfully.
    C:\WINDOWS\system32\Drivers\etc\hosts => Is moved successfully.

    ==== End of Fixlog ====
     
  19. 2oldGeek

    2oldGeek Active member

    Joined:
    Jun 16, 2005
    Messages:
    3,687
    Likes Received:
    35
    Trophy Points:
    78
    Hi outoftune,

    Did you reset your browser? Still getting pop-ups?

    What's up? How you doing?

    2oG
     
  20. outoftune

    outoftune Member

    Joined:
    May 31, 2006
    Messages:
    18
    Likes Received:
    0
    Trophy Points:
    11
    Yes I reset the browser and I am still having issues. Sorry I didn't check in for a while, I didn't use chrome during the time and hardly used me computer, just got really busy. I'm thinking I may just do a whole system reset. I don't have a ton of software I would have to reinstall as I mostly use my netbook for web browsing. What do you think?
     

Share This Page