Popup infection that I just cannot get rid of, followed other threads already

[Mnemoch]

Thanks in advance for looking at the logs from FRST. I had a look through and corrected the hijacked DNS but not sure what else to do. I have run every scan in the book and comes back clear. At first I did have programs to remove etc. but now its a ghost. IE Reset doesn't even work, something blocks it best I can tell as my homepage is not reset even though it should be.

EDIT: I cannot click the upload button below. Will try again after I create the topic

 

[TwinHeadedEagle]

Hello,

Can you paste the reports?

 

[Mnemoch]

Upload button not working, sorry, I will post the log below:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 29-04-2015 01
Ran by Trevor (administrator) on MAPOO on 30-04-2015 16:10:06
Running from C:\Users\Trevor\Downloads
Loaded Profiles: Trevor (Available profiles: Trevor)
Platform: Windows 8.1 Pro (X64) OS Language: English (United States)
Internet Explorer Version 11 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\tv_w32.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\tv_x64.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\csisyncclient.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\office15\msosync.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch
HKU\S-1-5-21-1217871043-332092552-3241288942-1001\...\MountPoints2: {74d475cc-abc7-11e4-825f-60029255d7ee} - "D:\autorun.exe"
HKU\S-1-5-21-1217871043-332092552-3241288942-1001\...\MountPoints2: {74d4766d-abc7-11e4-825f-60029255d7ee} - "D:\autorun.exe"
HKU\S-1-5-18\...\RunOnce: [Application Restart #0] => C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe [372408 2014-11-08] (Microsoft Corporation)
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2015-02-10] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2015-02-10] (Microsoft Corporation)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2015-02-03] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{735FBFF0-AB84-4263-AE6D-7CD6921466CB}: [NameServer] 31.168.228.248,82.166.96.246
Tcpip\..\Interfaces\{85826326-C7E2-42FD-9D91-659F71E8C8B3}: [NameServer] 31.168.228.248,82.166.96.246
Tcpip\..\Interfaces\{A5703695-77F9-4375-8934-49E0BF8FD098}: [NameServer] 31.168.228.248,82.166.96.246
StartMenuInternet: IEXPLORE.EXE - iexplore.exe

FireFox:
========
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2015-02-03] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 BthHFSrv; C:\Windows\System32\BthHFSrv.dll [324608 2014-10-28] (Microsoft Corporation)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2714800 2015-02-10] (Microsoft Corporation)
R2 DiagTrack; C:\Windows\system32\diagtrack.dll [1429504 2015-03-04] (Microsoft Corporation)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2015-03-17] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1080120 2015-03-17] (Malwarebytes Corporation)
R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [5448976 2015-04-17] (TeamViewer GmbH)
S3 TunnelBearMaintenance; C:\Program Files (x86)\TunnelBear\TBear.Maintenance.exe [26048 2015-01-12] ()
R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366520 2015-02-03] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2015-02-03] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 AX88772; C:\Windows\system32\DRIVERS\ax88772.sys [113864 2013-07-18] (ASIX Electronics Corp.)
R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [226304 2014-05-08] (Microsoft Corporation)
R3 iaLPSS_GPIO; C:\Windows\System32\drivers\iaLPSS_GPIO.sys [24568 2013-10-07] (Intel Corporation)
R3 iaLPSS_I2C; C:\Windows\System32\drivers\iaLPSS_I2C.sys [99320 2013-10-07] (Intel Corporation)
R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25816 2015-03-17] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\windows\system32\drivers\MBAMSwissArmy.sys [136408 2015-04-30] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\windows\system32\drivers\mwac.sys [64216 2015-03-17] (Malwarebytes Corporation)
R3 MEIx64; C:\Windows\System32\drivers\TeeDriverx64.sys [100312 2014-01-31] (Intel Corporation)
R3 mrvlpcie8897; C:\Windows\system32\DRIVERS\mrvlpcie8897.sys [1002496 2014-12-24] (Marvell Semiconductors Inc.)
R3 SensorsHIDClassDriver; C:\Windows\System32\drivers\WUDFRd.sys [226304 2014-10-28] (Microsoft Corporation)
R3 SensorsServiceDriver; C:\Windows\System32\drivers\WUDFRd.sys [226304 2014-10-28] (Microsoft Corporation)
R3 SurfaceAccessoryDevice; C:\Windows\System32\drivers\SurfaceAccessoryDevice.sys [51856 2014-05-30] (Microsoft Corporation)
R3 SurfaceCapacitiveHomeButton; C:\Windows\System32\drivers\SurfaceCapacitiveHomeButton.sys [44152 2014-11-27] (Microsoft Corporation)
R3 SurfaceDisplayCalibration; C:\Windows\System32\drivers\SurfaceDisplayCalibration.sys [41616 2014-05-02] (Microsoft Corporation)
R3 SurfaceIntegrationDriver; C:\Windows\System32\drivers\SurfaceIntegrationDriver.sys [49776 2014-12-09] (Microsoft Corporation)
R0 SurfacePciController; C:\Windows\System32\drivers\SurfacePciController.sys [35440 2014-10-08] (Microsoft Corporation)
R3 SurfacePenDriver; C:\Windows\system32\DRIVERS\SurfacePenDriver.sys [72304 2015-01-14] (Microsoft Corporation)
S3 SurfaceTouchCover; C:\Windows\System32\drivers\SurfaceTouchCover.sys [35976 2014-04-14] (Microsoft Corporation)
S3 SurfaceTypeCover; C:\Windows\System32\drivers\SurfaceTypeCover.sys [35984 2014-03-19] (Microsoft Corporation)
R3 tap-tb-0901; C:\Windows\system32\DRIVERS\tap-tb-0901.sys [38656 2014-09-29] (The OpenVPN Project)
R3 TrueColor; C:\Windows\system32\DRIVERS\TrueColor.sys [35952 2014-07-07] ()
R2 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2015-02-03] (Microsoft Corporation)
R3 WiFiClass; C:\Windows\system32\DRIVERS\wificlass.sys [411648 2014-12-24] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-30 16:10 - 2015-04-30 16:10 - 00009841 _____ () C:\Users\Trevor\Downloads\FRST.txt
2015-04-30 16:10 - 2015-04-30 16:10 - 00000000 ____D () C:\FRST
2015-04-30 16:09 - 2015-04-30 16:09 - 02101248 _____ (Farbar) C:\Users\Trevor\Downloads\FRST64.exe
2015-04-30 14:14 - 2015-04-30 14:14 - 00000334 _____ () C:\windows\PFRO.log
2015-04-30 14:14 - 2015-04-30 14:01 - 00024064 _____ () C:\windows\zoek-delete.exe
2015-04-30 14:04 - 2015-04-30 14:04 - 00000460 _____ () C:\Users\Trevor\Desktop\Remove YourAdExchange.com pop-up ads (Removal Guide).website
2015-04-30 14:01 - 2015-04-30 14:41 - 00003598 _____ () C:\windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1217871043-332092552-3241288942-1001
2015-04-30 14:01 - 2015-04-30 14:13 - 00000000 ____D () C:\zoek_backup
2015-04-30 14:01 - 2015-04-30 14:01 - 01305600 _____ () C:\Users\Trevor\Downloads\zoek.exe
2015-04-30 13:50 - 2015-04-30 13:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2015-04-30 13:50 - 2015-04-30 13:50 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2015-04-30 13:50 - 2015-04-30 13:50 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2015-04-30 13:44 - 2015-04-30 13:44 - 00000738 _____ () C:\Users\Trevor\Downloads\JRT.txt
2015-04-30 13:42 - 2015-04-30 03:30 - 02716306 _____ (Thisisu) C:\Users\Trevor\Downloads\JRT_NEW.exe
2015-04-23 19:52 - 2015-04-23 19:52 - 00000000 ____D () C:\windows\system32\appraiser
2015-04-23 19:40 - 2014-04-15 19:35 - 00028352 _____ (Microsoft Corporation) C:\windows\SysWOW64\aspnet_counters.dll
2015-04-23 19:40 - 2014-04-15 19:34 - 00029888 _____ (Microsoft Corporation) C:\windows\system32\aspnet_counters.dll
2015-04-23 19:39 - 2015-01-05 23:01 - 00072192 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ndproxy.sys
2015-04-23 19:39 - 2015-01-05 22:59 - 00080896 _____ (Microsoft Corporation) C:\windows\system32\Drivers\wanarp.sys
2015-04-23 19:39 - 2015-01-05 21:12 - 00185856 _____ (Microsoft Corporation) C:\windows\system32\rascfg.dll
2015-04-23 19:39 - 2015-01-05 21:02 - 00164864 _____ (Microsoft Corporation) C:\windows\SysWOW64\rascfg.dll
2015-04-23 19:38 - 2015-04-23 19:38 - 00000448 _____ () C:\Users\Trevor\Desktop\Reinstalling Flash after uninstall - Windows 8.... Adobe Community.website
2015-04-23 19:38 - 2015-03-13 00:03 - 00239424 _____ (Microsoft Corporation) C:\windows\system32\Drivers\sdbus.sys
2015-04-23 19:38 - 2015-03-13 00:03 - 00154432 _____ (Microsoft Corporation) C:\windows\system32\Drivers\dumpsd.sys
2015-04-23 19:38 - 2015-03-12 22:59 - 00430080 _____ (Microsoft Corporation) C:\windows\system32\schannel.dll
2015-04-23 19:38 - 2015-03-12 22:38 - 00358912 _____ (Microsoft Corporation) C:\windows\SysWOW64\schannel.dll
2015-04-23 19:38 - 2015-03-05 23:08 - 02067968 _____ (Microsoft Corporation) C:\windows\system32\wpdshext.dll
2015-04-23 19:38 - 2015-03-05 22:47 - 01696256 _____ (Microsoft Corporation) C:\windows\system32\wevtsvc.dll
2015-04-23 19:38 - 2015-03-05 22:43 - 01969664 _____ (Microsoft Corporation) C:\windows\SysWOW64\wpdshext.dll
2015-04-23 19:38 - 2015-03-04 19:09 - 01429504 _____ (Microsoft Corporation) C:\windows\system32\diagtrack.dll
2015-04-23 19:38 - 2015-02-17 19:19 - 00186368 _____ (Microsoft Corporation) C:\windows\system32\dpapisrv.dll
2015-04-23 19:38 - 2015-02-12 22:22 - 00445440 _____ (Microsoft Corporation) C:\windows\system32\certcli.dll
2015-04-23 19:38 - 2015-02-12 21:46 - 00324096 _____ (Microsoft Corporation) C:\windows\SysWOW64\certcli.dll
2015-04-23 19:38 - 2014-11-17 16:17 - 00672984 _____ (Microsoft Corporation) C:\windows\system32\MDMAgent.exe
2015-04-23 19:38 - 2014-11-17 16:17 - 00273240 _____ (Microsoft Corporation) C:\windows\system32\SystemSettingsAdminFlows.exe
2015-04-23 19:38 - 2014-11-15 15:05 - 00801584 _____ (Microsoft Corporation) C:\windows\SysWOW64\mfplat.dll
2015-04-23 19:38 - 2014-11-15 02:29 - 00962216 _____ (Microsoft Corporation) C:\windows\system32\mfplat.dll
2015-04-23 19:38 - 2014-11-14 02:58 - 00116736 _____ (Microsoft Corporation) C:\windows\system32\SystemSettingsDatabase.dll
2015-04-23 19:38 - 2014-11-14 02:57 - 01027584 _____ (Microsoft Corporation) C:\windows\system32\MFMediaEngine.dll
2015-04-23 19:38 - 2014-11-14 02:54 - 00463872 _____ (Microsoft Corporation) C:\windows\system32\SystemSettings.Handlers.dll
2015-04-23 19:38 - 2014-11-14 02:46 - 02171904 _____ (Microsoft Corporation) C:\windows\system32\SystemSettingsAdminFlowUI.dll
2015-04-23 19:38 - 2014-11-14 02:39 - 02819584 _____ (Microsoft Corporation) C:\windows\system32\SettingsHandlers.dll
2015-04-23 19:38 - 2014-11-14 01:03 - 00885760 _____ (Microsoft Corporation) C:\windows\SysWOW64\MFMediaEngine.dll
2015-04-23 19:38 - 2014-11-10 14:06 - 02485056 _____ (Microsoft Corporation) C:\windows\system32\Drivers\tcpip.sys
2015-04-23 19:38 - 2014-11-10 14:06 - 00473408 _____ (Microsoft Corporation) C:\windows\system32\Drivers\netio.sys
2015-04-23 19:38 - 2014-11-10 14:06 - 00428864 _____ (Microsoft Corporation) C:\windows\system32\Drivers\FWPKCLNT.SYS
2015-04-23 19:38 - 2014-11-10 14:06 - 00136512 _____ (Microsoft Corporation) C:\windows\system32\Drivers\wfplwfs.sys
2015-04-23 19:38 - 2014-11-09 22:57 - 00096768 _____ (Microsoft Corporation) C:\windows\system32\Drivers\agilevpn.sys
2015-04-23 19:38 - 2014-11-09 21:37 - 00845312 _____ (Microsoft Corporation) C:\windows\system32\BFE.DLL
2015-04-23 19:38 - 2014-11-09 21:34 - 01084416 _____ (Microsoft Corporation) C:\windows\system32\IKEEXT.DLL
2015-04-23 19:38 - 2014-11-09 21:26 - 00422400 _____ (Microsoft Corporation) C:\windows\system32\FWPUCLNT.DLL
2015-04-23 19:38 - 2014-11-09 21:20 - 00420864 _____ (Microsoft Corporation) C:\windows\system32\vpnike.dll
2015-04-23 19:38 - 2014-11-09 21:09 - 00272384 _____ (Microsoft Corporation) C:\windows\SysWOW64\FWPUCLNT.DLL
2015-04-23 19:38 - 2014-11-09 21:08 - 00702464 _____ (Microsoft Corporation) C:\windows\system32\rasapi32.dll
2015-04-23 19:38 - 2014-11-09 21:06 - 00713216 _____ (Microsoft Corporation) C:\windows\system32\nshwfp.dll
2015-04-23 19:38 - 2014-11-09 20:57 - 00624640 _____ (Microsoft Corporation) C:\windows\SysWOW64\rasapi32.dll
2015-04-23 19:38 - 2014-11-09 20:57 - 00561664 _____ (Microsoft Corporation) C:\windows\SysWOW64\nshwfp.dll
2015-04-23 19:38 - 2014-11-08 00:00 - 00024576 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ndistapi.sys
2015-04-23 19:38 - 2014-11-07 23:58 - 00112640 _____ (Microsoft Corporation) C:\windows\system32\Drivers\rasl2tp.sys
2015-04-23 19:38 - 2014-11-07 23:56 - 00048128 _____ (Microsoft Corporation) C:\windows\system32\kmddsp.tsp
2015-04-23 19:38 - 2014-11-07 23:56 - 00043008 _____ (Microsoft Corporation) C:\windows\system32\rasmxs.dll
2015-04-23 19:38 - 2014-11-07 23:56 - 00030208 _____ (Microsoft Corporation) C:\windows\system32\rasser.dll
2015-04-23 19:38 - 2014-11-07 23:24 - 00077824 _____ (Microsoft Corporation) C:\windows\system32\rasdiag.dll
2015-04-23 19:38 - 2014-11-07 23:13 - 00039424 _____ (Microsoft Corporation) C:\windows\SysWOW64\kmddsp.tsp
2015-04-23 19:38 - 2014-11-07 23:13 - 00033280 _____ (Microsoft Corporation) C:\windows\SysWOW64\rasmxs.dll
2015-04-23 19:38 - 2014-11-07 23:13 - 00022528 _____ (Microsoft Corporation) C:\windows\SysWOW64\rasser.dll
2015-04-23 19:38 - 2014-11-07 22:48 - 00061440 _____ (Microsoft Corporation) C:\windows\SysWOW64\rasdiag.dll
2015-04-23 19:38 - 2014-11-07 22:38 - 00166912 _____ (Microsoft Corporation) C:\windows\system32\AppxAllUserStore.dll
2015-04-23 19:38 - 2014-11-07 22:17 - 00143360 _____ (Microsoft Corporation) C:\windows\SysWOW64\AppxAllUserStore.dll
2015-04-23 19:38 - 2014-11-07 22:03 - 00733696 _____ (Microsoft Corporation) C:\windows\system32\SkyDriveTelemetry.dll
2015-04-23 19:38 - 2014-11-07 21:58 - 04837376 _____ (Microsoft Corporation) C:\windows\system32\SyncEngine.dll
2015-04-23 19:38 - 2014-11-07 21:49 - 01154048 _____ (Microsoft Corporation) C:\windows\system32\SkyDrive.exe
2015-04-23 19:38 - 2014-11-06 23:58 - 00952896 _____ (Microsoft Corporation) C:\windows\system32\mfmp4srcsnk.dll
2015-04-23 19:38 - 2014-11-06 23:20 - 00786120 _____ (Microsoft Corporation) C:\windows\SysWOW64\mfmp4srcsnk.dll
2015-04-23 19:38 - 2014-11-04 22:12 - 00211968 _____ (Microsoft Corporation) C:\windows\system32\QSHVHOST.DLL
2015-04-23 19:38 - 2014-11-04 22:12 - 00128000 _____ (Microsoft Corporation) C:\windows\system32\QSVRMGMT.DLL
2015-04-23 19:38 - 2014-11-04 22:06 - 00514048 _____ (Microsoft Corporation) C:\windows\system32\DevicePairing.dll
2015-04-23 19:38 - 2014-11-04 21:44 - 00657920 _____ (Microsoft Corporation) C:\windows\system32\dnsapi.dll
2015-04-23 19:38 - 2014-11-04 21:43 - 00252416 _____ (Microsoft Corporation) C:\windows\system32\dnsrslvr.dll
2015-04-23 19:38 - 2014-11-04 21:41 - 00558080 _____ (Microsoft Corporation) C:\windows\system32\untfs.dll
2015-04-23 19:38 - 2014-11-04 21:39 - 00155648 _____ (Microsoft Corporation) C:\windows\SysWOW64\QSHVHOST.DLL
2015-04-23 19:38 - 2014-11-04 21:39 - 00094208 _____ (Microsoft Corporation) C:\windows\SysWOW64\QSVRMGMT.DLL
2015-04-23 19:38 - 2014-11-04 21:33 - 00465408 _____ (Microsoft Corporation) C:\windows\SysWOW64\DevicePairing.dll
2015-04-23 19:38 - 2014-11-04 21:21 - 00658432 _____ (Microsoft Corporation) C:\windows\system32\WSDApi.dll
2015-04-23 19:38 - 2014-11-04 21:20 - 00498688 _____ (Microsoft Corporation) C:\windows\SysWOW64\dnsapi.dll
2015-04-23 19:38 - 2014-11-04 21:18 - 00507392 _____ (Microsoft Corporation) C:\windows\SysWOW64\untfs.dll
2015-04-23 19:38 - 2014-11-04 21:14 - 00309760 _____ (Microsoft Corporation) C:\windows\system32\WSDMon.dll
2015-04-23 19:38 - 2014-11-04 21:06 - 00555520 _____ (Microsoft Corporation) C:\windows\SysWOW64\WSDApi.dll
2015-04-23 19:38 - 2014-11-04 15:33 - 00058176 _____ (Microsoft Corporation) C:\windows\system32\Drivers\dam.sys
2015-04-23 19:38 - 2014-11-04 15:25 - 00059712 _____ (Microsoft Corporation) C:\windows\system32\Drivers\kbdclass.sys
2015-04-23 19:38 - 2014-11-04 15:25 - 00051008 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mouclass.sys
2015-04-23 19:38 - 2014-11-04 02:55 - 00026112 _____ (Microsoft Corporation) C:\windows\system32\Drivers\sermouse.sys
2015-04-23 19:38 - 2014-11-04 02:54 - 00108544 _____ (Microsoft Corporation) C:\windows\system32\Drivers\i8042prt.sys
2015-04-23 19:38 - 2014-11-04 02:54 - 00032256 _____ (Microsoft Corporation) C:\windows\system32\Drivers\kbdhid.sys
2015-04-23 19:38 - 2014-11-04 02:54 - 00030208 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mouhid.sys
2015-04-23 19:38 - 2014-11-04 02:27 - 00128512 _____ (Microsoft Corporation) C:\windows\splwow64.exe
2015-04-23 19:38 - 2014-11-04 01:01 - 00827392 _____ (Microsoft Corporation) C:\windows\system32\spoolsv.exe
2015-04-23 19:38 - 2014-10-30 20:51 - 18823168 _____ (Microsoft Corporation) C:\windows\system32\Windows.UI.Xaml.dll
2015-04-23 19:38 - 2014-10-30 20:10 - 15158784 _____ (Microsoft Corporation) C:\windows\SysWOW64\Windows.UI.Xaml.dll
2015-04-23 19:38 - 2014-10-28 23:05 - 00551232 _____ (Microsoft Corporation) C:\windows\system32\Drivers\vhdmp.sys
2015-04-23 19:38 - 2014-10-28 21:55 - 00242176 _____ (Microsoft Corporation) C:\windows\system32\WinSCard.dll
2015-04-23 19:38 - 2014-10-28 21:13 - 00169984 _____ (Microsoft Corporation) C:\windows\SysWOW64\WinSCard.dll
2015-04-23 19:38 - 2014-10-20 21:59 - 00016896 _____ (Microsoft Corporation) C:\windows\system32\eventcls.dll
2015-04-23 19:38 - 2014-10-20 21:19 - 00015360 _____ (Microsoft Corporation) C:\windows\SysWOW64\eventcls.dll
2015-04-23 19:38 - 2014-10-20 20:50 - 00074752 _____ (Microsoft Corporation) C:\windows\system32\vsstrace.dll
2015-04-23 19:38 - 2014-10-20 20:31 - 01574400 _____ (Microsoft Corporation) C:\windows\system32\vssapi.dll
2015-04-23 19:38 - 2014-10-20 20:31 - 00055296 _____ (Microsoft Corporation) C:\windows\SysWOW64\vsstrace.dll
2015-04-23 19:38 - 2014-10-20 20:30 - 01454080 _____ (Microsoft Corporation) C:\windows\system32\VSSVC.exe
2015-04-23 19:38 - 2014-10-20 20:20 - 01142272 _____ (Microsoft Corporation) C:\windows\SysWOW64\vssapi.dll
2015-04-23 19:38 - 2014-10-17 00:56 - 00039744 _____ (Microsoft Corporation) C:\windows\system32\Drivers\intelpep.sys
2015-04-23 19:38 - 2014-10-16 23:35 - 00086336 _____ (Microsoft Corporation) C:\windows\system32\Drivers\pdc.sys
2015-04-23 19:33 - 2015-04-23 19:33 - 18782051 _____ () C:\Users\Trevor\Downloads\Windows8.1-KB3044132-x64.msu
2015-04-23 19:32 - 2015-03-23 17:59 - 07476032 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe
2015-04-23 19:32 - 2015-03-23 17:59 - 01733952 _____ (Microsoft Corporation) C:\windows\system32\ntdll.dll
2015-04-23 19:32 - 2015-03-23 17:59 - 00360480 _____ (Microsoft Corporation) C:\windows\system32\sechost.dll
2015-04-23 19:32 - 2015-03-23 17:58 - 01498872 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntdll.dll
2015-04-23 19:32 - 2015-03-23 17:45 - 00257216 _____ (Microsoft Corporation) C:\windows\SysWOW64\sechost.dll
2015-04-23 19:32 - 2015-03-20 00:12 - 00246272 _____ (Microsoft Corporation) C:\windows\system32\microsoft-windows-system-events.dll
2015-04-23 19:32 - 2015-03-20 00:10 - 00285184 _____ (Microsoft Corporation) C:\windows\system32\wow64.dll
2015-04-23 19:32 - 2015-03-20 00:10 - 00013312 _____ (Microsoft Corporation) C:\windows\system32\wow64cpu.dll
2015-04-23 19:32 - 2015-03-19 23:17 - 00411648 _____ (Microsoft Corporation) C:\windows\system32\tracerpt.exe
2015-04-23 19:32 - 2015-03-19 22:41 - 00369152 _____ (Microsoft Corporation) C:\windows\SysWOW64\tracerpt.exe
2015-04-23 19:32 - 2015-03-19 22:40 - 00950784 _____ (Microsoft Corporation) C:\windows\system32\tdh.dll
2015-04-23 19:32 - 2015-03-19 22:16 - 00749568 _____ (Microsoft Corporation) C:\windows\SysWOW64\tdh.dll
2015-04-23 19:32 - 2015-03-14 04:20 - 01385256 _____ (Microsoft Corporation) C:\windows\system32\msctf.dll
2015-04-23 19:32 - 2015-03-14 04:13 - 01124352 _____ (Microsoft Corporation) C:\windows\SysWOW64\msctf.dll
2015-04-23 19:32 - 2015-02-24 04:32 - 00991552 _____ (Microsoft Corporation) C:\windows\system32\Drivers\http.sys
2015-04-23 19:32 - 2015-02-20 19:49 - 00780800 _____ (Microsoft Corporation) C:\windows\system32\lsm.dll
2015-04-23 19:03 - 2015-04-23 19:03 - 00000207 _____ () C:\windows\tweaking.com-regbackup-MAPOO-Windows-8.1-Pro-(64-bit).dat
2015-04-23 19:03 - 2015-04-23 19:03 - 00000000 ____D () C:\RegBackup
2015-04-23 19:02 - 2015-04-30 13:42 - 00000572 _____ () C:\Users\Trevor\Desktop\Remove Ad.Adserverplus pop-up virus (Removal Guide).website
2015-04-23 19:02 - 2015-04-23 19:02 - 02685470 _____ (Thisisu) C:\Users\Trevor\Downloads\JRT.exe
2015-04-23 18:52 - 2015-04-30 16:00 - 00000696 _____ () C:\windows\setupact.log
2015-04-23 18:52 - 2015-04-23 18:52 - 00000000 _____ () C:\windows\setuperr.log
2015-04-23 18:51 - 2015-03-22 18:45 - 00227328 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll
2015-04-23 18:51 - 2015-03-22 18:09 - 01111552 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll
2015-04-23 18:51 - 2015-03-22 18:09 - 00957440 _____ (Microsoft Corporation) C:\windows\system32\appraiser.dll
2015-04-23 18:51 - 2015-03-22 18:09 - 00769024 _____ (Microsoft Corporation) C:\windows\system32\invagent.dll
2015-04-23 18:51 - 2015-03-22 18:09 - 00726528 _____ (Microsoft Corporation) C:\windows\system32\generaltel.dll
2015-04-23 18:51 - 2015-03-22 18:09 - 00419328 _____ (Microsoft Corporation) C:\windows\system32\devinv.dll
2015-04-23 18:51 - 2015-03-22 18:09 - 00030720 _____ (Microsoft Corporation) C:\windows\system32\acmigration.dll
2015-04-23 18:51 - 2015-03-14 04:54 - 00133256 _____ (Microsoft Corporation) C:\windows\system32\wuauclt.exe
2015-04-23 18:51 - 2015-03-13 21:56 - 00066048 _____ (Microsoft Corporation) C:\windows\system32\wups.dll
2015-04-23 18:51 - 2015-03-13 21:56 - 00052224 _____ (Microsoft Corporation) C:\windows\system32\wups2.dll
2015-04-23 18:51 - 2015-03-13 21:51 - 00015360 _____ (Microsoft Corporation) C:\windows\system32\wu.upgrade.ps.dll
2015-04-23 18:51 - 2015-03-13 21:37 - 00267264 _____ (Microsoft Corporation) C:\windows\system32\WinSetupUI.dll
2015-04-23 18:51 - 2015-03-13 21:14 - 00027136 _____ (Microsoft Corporation) C:\windows\SysWOW64\wups.dll
2015-04-23 18:51 - 2015-03-13 20:22 - 03678720 _____ (Microsoft Corporation) C:\windows\system32\wuaueng.dll
2015-04-23 18:51 - 2015-03-13 20:12 - 00140288 _____ (Microsoft Corporation) C:\windows\system32\wuwebv.dll
2015-04-23 18:51 - 2015-03-13 20:12 - 00035840 _____ (Microsoft Corporation) C:\windows\system32\wuapp.exe
2015-04-23 18:51 - 2015-03-13 20:09 - 00200192 _____ (Microsoft Corporation) C:\windows\system32\storewuauth.dll
2015-04-23 18:51 - 2015-03-13 20:08 - 00408064 _____ (Microsoft Corporation) C:\windows\system32\WUSettingsProvider.dll
2015-04-23 18:51 - 2015-03-13 20:08 - 00095744 _____ (Microsoft Corporation) C:\windows\system32\wudriver.dll
2015-04-23 18:51 - 2015-03-13 20:06 - 02373632 _____ (Microsoft Corporation) C:\windows\system32\wucltux.dll
2015-04-23 18:51 - 2015-03-13 20:06 - 00891392 _____ (Microsoft Corporation) C:\windows\system32\wuapi.dll
2015-04-23 18:51 - 2015-03-13 20:02 - 00124928 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuwebv.dll
2015-04-23 18:51 - 2015-03-13 20:02 - 00029696 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuapp.exe
2015-04-23 18:51 - 2015-03-13 19:59 - 00721920 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuapi.dll
2015-04-23 18:51 - 2015-03-13 19:59 - 00081920 _____ (Microsoft Corporation) C:\windows\SysWOW64\wudriver.dll
2015-04-23 18:51 - 2015-03-13 00:32 - 24980480 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2015-04-23 18:51 - 2015-03-13 00:08 - 00584192 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll
2015-04-23 18:51 - 2015-03-13 00:07 - 02886144 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2015-04-23 18:51 - 2015-03-12 23:53 - 00816128 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll
2015-04-23 18:51 - 2015-03-12 23:50 - 06025216 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2015-04-23 18:51 - 2015-03-12 23:42 - 19695616 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2015-04-23 18:51 - 2015-03-12 23:28 - 00503296 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll
2015-04-23 18:51 - 2015-03-12 23:26 - 00092160 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2015-04-23 18:51 - 2015-03-12 23:22 - 02278400 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2015-04-23 18:51 - 2015-03-12 23:17 - 01032704 _____ (Microsoft Corporation) C:\windows\system32\inetcomm.dll
2015-04-23 18:51 - 2015-03-12 23:16 - 00664064 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll
2015-04-23 18:51 - 2015-03-12 23:08 - 00720384 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2015-04-23 18:51 - 2015-03-12 23:07 - 00801280 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2015-04-23 18:51 - 2015-03-12 23:00 - 14397440 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2015-04-23 18:51 - 2015-03-12 22:58 - 00259072 _____ (Microsoft Corporation) C:\windows\system32\pku2u.dll
2015-04-23 18:51 - 2015-03-12 22:50 - 00880128 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcomm.dll
2015-04-23 18:51 - 2015-03-12 22:49 - 04305408 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2015-04-23 18:51 - 2015-03-12 22:45 - 02358784 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2015-04-23 18:51 - 2015-03-12 22:44 - 00689152 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2015-04-23 18:51 - 2015-03-12 22:37 - 00208896 _____ (Microsoft Corporation) C:\windows\SysWOW64\pku2u.dll
2015-04-23 18:51 - 2015-03-12 22:34 - 12825600 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2015-04-23 18:51 - 2015-03-12 22:33 - 01548288 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2015-04-23 18:51 - 2015-03-12 22:22 - 00800768 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll
2015-04-23 18:51 - 2015-03-12 22:20 - 01888256 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2015-04-23 18:51 - 2015-03-12 22:16 - 01311232 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2015-04-23 18:51 - 2015-03-12 22:14 - 00710144 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dll
2015-04-23 18:51 - 2015-03-04 06:25 - 00377152 _____ (Microsoft Corporation) C:\windows\system32\Drivers\clfs.sys
2015-04-23 18:51 - 2015-03-03 23:04 - 00075264 _____ (Microsoft Corporation) C:\windows\system32\clfsw32.dll
2015-04-23 18:51 - 2015-03-03 22:19 - 00058880 _____ (Microsoft Corporation) C:\windows\SysWOW64\clfsw32.dll
2015-04-23 18:51 - 2014-12-02 19:09 - 00192000 _____ (Microsoft Corporation) C:\windows\system32\aepic.dll
2015-04-23 18:50 - 2015-04-30 16:00 - 01804196 _____ () C:\windows\WindowsUpdate.log
2015-04-23 18:39 - 2015-04-23 18:39 - 00000834 _____ () C:\windows\system32\.crusader
2015-04-23 18:37 - 2015-04-23 18:39 - 00000000 ____D () C:\ProgramData\HitmanPro
2015-04-23 18:33 - 2015-04-23 19:03 - 00000589 _____ () C:\Users\Trevor\Desktop\Remove Adcash.com pop-up ads (Removal Guide).website
2015-04-23 18:32 - 2015-04-23 18:33 - 11028616 _____ (SurfRight B.V.) C:\Users\Trevor\Downloads\HitmanPro_x64.exe
2015-04-23 18:31 - 2015-04-30 13:48 - 00000000 ____D () C:\AdwCleaner
2015-04-23 18:31 - 2015-04-23 18:31 - 02224640 _____ () C:\Users\Trevor\Downloads\adwcleaner_4.202.exe
2015-04-22 09:04 - 2015-04-22 09:04 - 00000000 ____D () C:\Users\Trevor\Documents\Updater5
2015-04-22 09:04 - 2015-04-22 09:04 - 00000000 ____D () C:\Users\Trevor\Documents\GrandpaVCD
2015-04-22 09:04 - 2015-04-22 09:04 - 00000000 ____D () C:\Users\Trevor\Documents\Geoff Skeete History of Barbados CD Copy
2015-04-22 09:04 - 2008-10-09 13:45 - 00002234 _____ () C:\Users\Trevor\Documents\Stanford.txt
2015-04-22 09:04 - 2007-06-27 15:37 - 00000000 ____D () C:\Users\Trevor\Documents\My Received Files
2015-04-22 09:04 - 2005-12-30 09:25 - 00006134 _____ () C:\Users\Trevor\Documents\Congratulations.txt
2015-04-22 09:04 - 2005-12-11 17:21 - 00002941 _____ () C:\Users\Trevor\Documents\Silver Sands Development.txt
2015-04-22 09:04 - 2005-06-06 22:59 - 00001992 _____ () C:\Users\Trevor\Documents\Untitled.txt
2015-04-22 09:04 - 2004-10-08 08:23 - 00056832 _____ () C:\Users\Trevor\Documents\ABBAS ASSIGNMENT # 1.xls
2015-04-05 03:16 - 2015-04-23 18:05 - 00000000 ___SD () C:\windows\system32\GWX
2015-04-05 03:16 - 2015-04-05 03:16 - 00000000 ___SD () C:\windows\SysWOW64\GWX
2015-04-02 08:17 - 2015-04-02 08:17 - 41840320 _____ (Microsoft Corporation) C:\Users\Trevor\Downloads\Windows-KB890830-x64-V5.22.exe
2015-04-02 07:57 - 2015-04-02 07:57 - 05344528 _____ (Piriform Ltd) C:\Users\Trevor\Downloads\ccsetup504.exe
2015-04-02 07:55 - 2015-04-30 16:01 - 00136408 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2015-04-02 07:55 - 2015-04-23 18:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-04-02 07:55 - 2015-04-23 18:05 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2015-04-02 07:55 - 2015-04-02 07:55 - 00001121 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2015-04-02 07:55 - 2015-04-02 07:55 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-04-02 07:55 - 2015-03-17 06:15 - 00107736 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys
2015-04-02 07:55 - 2015-03-17 06:15 - 00064216 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys
2015-04-02 07:55 - 2015-03-17 06:15 - 00025816 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
2015-04-02 07:54 - 2015-04-02 07:55 - 21540440 _____ (Malwarebytes Corporation ) C:\Users\Trevor\Downloads\mbam-setup-2.1.4.1018.exe

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-30 16:05 - 2014-05-08 23:06 - 00863592 _____ () C:\windows\system32\PerfStringBackup.INI
2015-04-30 16:01 - 2015-02-03 12:21 - 00004966 _____ () C:\windows\System32\Tasks\Microsoft Office 15 Sync Maintenance for MAPOO-Trevor mapoo
2015-04-30 16:01 - 2014-10-14 09:15 - 00000000 __RDO () C:\Users\Trevor\OneDrive
2015-04-30 16:01 - 2013-08-22 10:45 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2015-04-30 16:00 - 2013-08-22 11:20 - 00000000 ____D () C:\windows\CbsTemp
2015-04-30 15:14 - 2013-08-22 11:36 - 00000000 ____D () C:\windows\system32\sru
2015-04-30 14:14 - 2013-08-22 09:25 - 00262144 ___SH () C:\windows\system32\config\BBI
2015-04-30 14:13 - 2015-02-03 11:59 - 00000000 ____D () C:\Users\Trevor\AppData\Local\Google
2015-04-26 20:55 - 2014-10-14 09:12 - 00000000 ____D () C:\Users\Trevor\AppData\Local\Packages
2015-04-26 06:11 - 2015-02-04 16:04 - 00000000 ____D () C:\Program Files (x86)\TeamViewer
2015-04-24 11:59 - 2014-10-20 00:49 - 00000000 ____D () C:\windows\system32\MRT
2015-04-24 05:53 - 2013-08-22 11:36 - 00000000 ____D () C:\windows\rescache
2015-04-23 20:04 - 2013-08-22 11:36 - 00000000 ____D () C:\windows\AppReadiness
2015-04-23 19:52 - 2015-03-04 17:29 - 00000000 ___SD () C:\windows\system32\CompatTel
2015-04-23 19:52 - 2013-08-22 11:36 - 00000000 ____D () C:\windows\SysWOW64\setup
2015-04-23 19:52 - 2013-08-22 11:36 - 00000000 ____D () C:\windows\system32\setup
2015-04-23 19:41 - 2013-08-22 11:36 - 00000000 ___RD () C:\windows\ImmersiveControlPanel
2015-04-23 18:33 - 2014-10-14 09:12 - 00000000 ____D () C:\Users\Trevor
2015-04-23 18:28 - 2015-02-04 16:04 - 00000990 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 10.lnk
2015-04-23 18:28 - 2015-02-04 16:04 - 00000978 _____ () C:\Users\Public\Desktop\TeamViewer 10.lnk
2015-04-23 18:26 - 2013-08-22 11:43 - 00000000 ____D () C:\windows\DigitalLocker
2015-04-23 18:22 - 2015-02-03 11:59 - 00000000 ____D () C:\Program Files (x86)\Google
2015-04-23 18:05 - 2013-08-22 11:36 - 00000000 __RSD () C:\windows\Media
2015-04-23 18:05 - 2013-08-22 11:36 - 00000000 ____D () C:\windows\SysWOW64\Macromed
2015-04-23 18:05 - 2013-08-22 11:36 - 00000000 ____D () C:\windows\PolicyDefinitions
2015-04-23 18:05 - 2013-08-22 09:36 - 00000000 ____D () C:\windows\system32\Sysprep
2015-04-23 18:04 - 2013-08-22 11:36 - 00000000 ____D () C:\windows\registration
2015-04-23 18:04 - 2013-08-22 11:36 - 00000000 ____D () C:\windows\AppCompat
2015-04-23 18:03 - 2015-02-10 12:24 - 00000000 __RHD () C:\MSOCache
2015-04-21 10:05 - 2013-08-22 11:36 - 00000000 ____D () C:\windows\system32\NDF
2015-04-15 16:14 - 2014-12-07 21:48 - 00017408 _____ (Microsoft Corporation) C:\windows\system32\wuaext.dll
2015-04-08 07:30 - 2015-02-14 18:46 - 00000000 ____D () C:\ProgramData\HP
2015-04-04 05:44 - 2014-10-14 09:12 - 00000000 ____D () C:\Users\Trevor\AppData\Roaming\Adobe
2015-04-03 10:57 - 2015-02-15 12:17 - 00000000 ____D () C:\Users\Trevor\AppData\Local\Windows Live
2015-04-02 08:12 - 2014-05-08 23:55 - 00000000 ____D () C:\windows\Panther
2015-04-02 08:02 - 2013-08-22 11:36 - 00000000 ____D () C:\windows\Speech
2015-04-02 07:41 - 2014-10-14 09:12 - 00001449 _____ () C:\Users\Trevor\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-04-01 11:16 - 2014-10-20 00:49 - 128913832 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe

==================== Files in the root of some directories =======

2015-04-22 08:51 - 2015-04-22 08:52 - 0011728 _____ () C:\Users\Trevor\AppData\Local\Temp-log.txt
2014-05-08 22:58 - 2014-05-08 22:58 - 0000000 ____H () C:\ProgramData\DP45977C.lfl

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-04-26 02:14

==================== End Of Log ============================

 

[Mnemoch]

Addition.txt:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 29-04-2015 01
Ran by Trevor at 2015-04-30 16:10:34
Running from C:\Users\Trevor\Downloads
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-1217871043-332092552-3241288942-500 - Administrator - Disabled)
Guest (S-1-5-21-1217871043-332092552-3241288942-501 - Limited - Disabled)
Trevor (S-1-5-21-1217871043-332092552-3241288942-1001 - Administrator - Enabled) => C:\Users\Trevor

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

7-Zip 9.20 (HKLM-x32\...\7-Zip) (Version: - )
Adobe Reader XI (11.0.10) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Malwarebytes Anti-Malware version 2.1.4.1018 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.4.1018 - Malwarebytes Corporation)
Microsoft Office 365 - en-us (HKLM\...\O365HomePremRetail - en-us) (Version: 15.0.4701.1002 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-1217871043-332092552-3241288942-1001\...\OneDriveSetup.exe) (Version: 17.3.4726.0226 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005 (HKLM-x32\...\{7f51bdb9-ee21-49ee-94d6-90afc321780e}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4701.1002 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4701.1002 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4701.1002 - Microsoft Corporation) Hidden
TeamViewer 10 (HKLM-x32\...\TeamViewer) (Version: 10.0.41459 - TeamViewer)
TunnelBear (x32 Version: 2.2.31.0 - TunnelBear) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-1217871043-332092552-3241288942-1001_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\Trevor\AppData\Local\Microsoft\OneDrive\17.3.4726.0226\amd64\FileSyncApi64.dll (Microsoft Corporation)

==================== Restore Points =========================

12-04-2015 05:51:18 Scheduled Checkpoint
16-04-2015 10:11:10 Windows Update
23-04-2015 18:02:53 Restore Operation
30-04-2015 13:24:34 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 09:25 - 2013-08-22 09:25 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {10429C76-4BBE-4D5B-89BB-63C58F3B42D3} - System32\Tasks\Microsoft Office 15 Sync Maintenance for MAPOO-Trevor mapoo => C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [2015-02-10] (Microsoft Corporation)
Task: {2D2FF638-E9DF-40B5-BBC2-2C008C92E533} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-23] (Microsoft Corporation)
Task: {38D96737-15E7-4E9E-960C-2239AACD4619} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\windows\system32\MRT.exe [2015-04-01] (Microsoft Corporation)
Task: {4025DBD4-D919-4593-A385-35B2FAC8B852} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonx86\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe [2015-02-10] (Microsoft Corporation)
Task: {417C9FB0-0B8A-453F-B08A-10408676F861} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxcontent => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-23] (Microsoft Corporation)
Task: {8809C372-E03F-4CE2-BC25-53221B165652} - System32\Tasks\Microsoft OneDrive Auto Update Task-S-1-5-21-1217871043-332092552-3241288942-1001 => %localappdata%\Microsoft\OneDrive\OneDrive.exe
Task: {BF613507-9578-4E85-9A7F-BD9B65B63DB4} - System32\Tasks\Microsoft\Windows\Setup\gwx\runappraiser => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-23] (Microsoft Corporation)
Task: {C048CD38-70A5-4488-A3CC-5184B4E51BD0} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-02-10] (Microsoft Corporation)
Task: {CEC72886-4996-4AB7-A4B0-130FE6D05443} - System32\Tasks\Microsoft\Windows\Setup\gwx\launchtrayprocess => C:\Windows\system32\GWX\GWX.exe [2015-03-23] (Microsoft Corporation)
Task: {F2367AA1-B8FA-4490-95AA-C224B46D0340} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-02-10] (Microsoft Corporation)
Task: {F5B8CC78-C5AD-4A2F-B592-E033466BC5CF} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)

==================== Loaded Modules (whitelisted) ==============

2015-02-03 12:15 - 2014-05-20 08:19 - 00105640 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
2015-03-14 20:53 - 2015-01-27 11:29 - 08898720 _____ () C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\1033\GrooveIntlResource.dll
2015-02-03 12:15 - 2015-02-03 14:27 - 00316576 _____ () C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\AppVIsvStream32.dll
2015-02-03 12:15 - 2015-02-03 14:25 - 00316576 _____ () C:\Program Files\Microsoft Office 15\Root\Office15\AppVIsvStream32.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\Users\Trevor\OneDrive:ms-properties

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, the associated entry will be removed from the registry.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-1217871043-332092552-3241288942-1001\Control Panel\Desktop\\Wallpaper -> C:\Windows\Web\Wallpaper\Theme1\img2.jpg
DNS Servers: 31.168.228.248 - 82.166.96.246

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)


==================== FirewallRules (whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppextcomobj.exe
FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppextcomobj.exe
FirewallRules: [{0C1150D7-1E2F-43B3-BE3C-C2DEA686EB9C}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\outlook.exe
FirewallRules: [{110C257A-5E10-4891-A769-29E810EAB29D}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{257E2865-5E8C-45A2-86FF-F3A644236F28}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{D1AA7FA6-F067-4D9E-B66C-3D3FC71B6B00}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{6962DB5E-3575-4B13-9961-BDAC58529264}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{FAC930C2-481E-48C7-94F0-986BA0874B7A}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{2697A96A-3103-44AE-B96A-FB891D8E3C0F}] => (Allow) LPort=2869
FirewallRules: [{BB5A1B4E-40FB-4956-8E60-609DBF28ABD4}] => (Allow) LPort=1900
FirewallRules: [{DCB3371B-9F5A-4681-872B-DF048A1BA8BB}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{B5A0984D-1FD1-4377-8066-6ED87817B732}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{51A3FA29-8B2D-46DA-B89D-230BB13CA328}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{6471FC19-12AF-48E9-84F9-CC8398AB27A2}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (04/30/2015 01:56:40 PM) (Source: ESENT) (EventID: 454) (User: )
Description: DllHost (3096) IndexedDb: Database recovery/restore failed with unexpected error -1216.

Error: (04/30/2015 01:56:40 PM) (Source: ESENT) (EventID: 494) (User: )
Description: DllHost (3096) IndexedDb: Database recovery failed with error -1216 because it encountered references to a database, 'C:\Users\Trevor\AppData\Local\Microsoft\Internet Explorer\Indexed DB\Internet.edb', which is no longer present. The database was not brought to a Clean Shutdown state before it was removed (or possibly moved or renamed). The database engine will not permit recovery to complete for this instance until the missing database is re-instated. If the database is truly no longer available and no longer required, procedures for recovering from this error are available in the Microsoft Knowledge Base or by following the "more information" link at the bottom of this message.

Error: (04/26/2015 01:13:36 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: TeamViewer_Service.exe, version: 10.0.41459.0, time stamp: 0x5530d8ea
Faulting module name: ntdll.dll, version: 6.3.9600.17668, time stamp: 0x54c846bb
Exception code: 0xc0000374
Fault offset: 0x000e5934
Faulting process id: 0x1230
Faulting application start time: 0xTeamViewer_Service.exe0
Faulting application path: TeamViewer_Service.exe1
Faulting module path: TeamViewer_Service.exe2
Report Id: TeamViewer_Service.exe3
Faulting package full name: TeamViewer_Service.exe4
Faulting package-relative application ID: TeamViewer_Service.exe5

Error: (04/24/2015 08:21:52 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: TeamViewer_Service.exe, version: 10.0.41459.0, time stamp: 0x5530d8ea
Faulting module name: ntdll.dll, version: 6.3.9600.17668, time stamp: 0x54c846bb
Exception code: 0xc0000374
Fault offset: 0x000e5934
Faulting process id: 0x6f0
Faulting application start time: 0xTeamViewer_Service.exe0
Faulting application path: TeamViewer_Service.exe1
Faulting module path: TeamViewer_Service.exe2
Report Id: TeamViewer_Service.exe3
Faulting package full name: TeamViewer_Service.exe4
Faulting package-relative application ID: TeamViewer_Service.exe5

Error: (04/23/2015 07:00:00 PM) (Source: ESENT) (EventID: 455) (User: )
Description: svchost (1296) SRUJet: Error -1811 (0xfffff8ed) occurred while opening logfile C:\windows\system32\SRU\SRU00434.log.

Error: (04/23/2015 06:42:53 PM) (Source: ESENT) (EventID: 454) (User: )
Description: DllHost (3164) IndexedDb: Database recovery/restore failed with unexpected error -1216.

Error: (04/23/2015 06:42:53 PM) (Source: ESENT) (EventID: 494) (User: )
Description: DllHost (3164) IndexedDb: Database recovery failed with error -1216 because it encountered references to a database, 'C:\Users\Trevor\AppData\Local\Microsoft\Internet Explorer\Indexed DB\Internet.edb', which is no longer present. The database was not brought to a Clean Shutdown state before it was removed (or possibly moved or renamed). The database engine will not permit recovery to complete for this instance until the missing database is re-instated. If the database is truly no longer available and no longer required, procedures for recovering from this error are available in the Microsoft Knowledge Base or by following the "more information" link at the bottom of this message.

Error: (04/23/2015 06:26:08 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: TeamViewer_Desktop.exe, version: 10.0.40798.0, time stamp: 0x55190bea
Faulting module name: TeamViewer_Desktop.exe, version: 10.0.40798.0, time stamp: 0x55190bea
Exception code: 0xc0000409
Fault offset: 0x0037f6ea
Faulting process id: 0x2d0
Faulting application start time: 0xTeamViewer_Desktop.exe0
Faulting application path: TeamViewer_Desktop.exe1
Faulting module path: TeamViewer_Desktop.exe2
Report Id: TeamViewer_Desktop.exe3
Faulting package full name: TeamViewer_Desktop.exe4
Faulting package-relative application ID: TeamViewer_Desktop.exe5

Error: (04/23/2015 06:22:20 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: chrome.exe, version: 41.0.2272.118, time stamp: 0x55199d5a
Faulting module name: chrome.dll, version: 41.0.2272.118, time stamp: 0x55199942
Exception code: 0x80000003
Fault offset: 0x004fe1b8
Faulting process id: 0x1280
Faulting application start time: 0xchrome.exe0
Faulting application path: chrome.exe1
Faulting module path: chrome.exe2
Report Id: chrome.exe3
Faulting package full name: chrome.exe4
Faulting package-relative application ID: chrome.exe5

Error: (04/23/2015 06:17:05 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: chrome.exe, version: 41.0.2272.118, time stamp: 0x55199d5a
Faulting module name: chrome.dll, version: 41.0.2272.118, time stamp: 0x55199942
Exception code: 0x80000003
Fault offset: 0x004fe1b8
Faulting process id: 0x10a0
Faulting application start time: 0xchrome.exe0
Faulting application path: chrome.exe1
Faulting module path: chrome.exe2
Report Id: chrome.exe3
Faulting package full name: chrome.exe4
Faulting package-relative application ID: chrome.exe5


System errors:
=============
Error: (04/30/2015 04:03:58 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Software Protection service failed to start due to the following error:
%%1053

Error: (04/30/2015 04:03:58 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the Software Protection service to connect.

Error: (04/30/2015 04:01:00 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: application-specificLocalActivation{D63B10C5-BB46-4990-A94F-E40B9D520160}{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}NT AUTHORITYSYSTEMS-1-5-18LocalHost (Using LRPC)UnavailableUnavailable

Error: (04/30/2015 04:00:36 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: Installation Failure: Windows failed to install the following update with error 0x800f0922: Security Update for Internet Explorer Flash Player for Windows 8.1 for x64-based Systems (KB3049508).

Error: (04/30/2015 02:40:30 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the ClickToRunSvc service.

Error: (04/30/2015 02:30:53 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: Installation Failure: Windows failed to install the following update with error 0x800f0922: Security Update for Internet Explorer Flash Player for Windows 8.1 for x64-based Systems (KB3049508).

Error: (04/30/2015 02:14:23 PM) (Source: DCOM) (EventID: 10010) (User: MAPOO)
Description: {9BA05972-F6A8-11CF-A442-00A0C90A8F39}

Error: (04/30/2015 02:13:00 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.

Error: (04/30/2015 02:12:59 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.

Error: (04/30/2015 02:12:59 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.


Microsoft Office Sessions:
=========================
Error: (04/30/2015 01:56:40 PM) (Source: ESENT) (EventID: 454) (User: )
Description: DllHost3096IndexedDb: -1216

Error: (04/30/2015 01:56:40 PM) (Source: ESENT) (EventID: 494) (User: )
Description: DllHost3096IndexedDb: -1216C:\Users\Trevor\AppData\Local\Microsoft\Internet Explorer\Indexed DB\Internet.edb

Error: (04/26/2015 01:13:36 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: TeamViewer_Service.exe10.0.41459.05530d8eantdll.dll6.3.9600.1766854c846bbc0000374000e5934123001d07eee22bc7e14C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exeC:\windows\SYSTEM32\ntdll.dllfd83265d-ebd2-11e4-8270-60029255d7ee

Error: (04/24/2015 08:21:52 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: TeamViewer_Service.exe10.0.41459.05530d8eantdll.dll6.3.9600.1766854c846bbc0000374000e59346f001d07e20a6cf6cabC:\Program Files (x86)\TeamViewer\TeamViewer_Service.exeC:\windows\SYSTEM32\ntdll.dll118dd779-eae1-11e4-8270-60029255d7ee

Error: (04/23/2015 07:00:00 PM) (Source: ESENT) (EventID: 455) (User: )
Description: svchost1296SRUJet: C:\windows\system32\SRU\SRU00434.log-1811 (0xfffff8ed)

Error: (04/23/2015 06:42:53 PM) (Source: ESENT) (EventID: 454) (User: )
Description: DllHost3164IndexedDb: -1216

Error: (04/23/2015 06:42:53 PM) (Source: ESENT) (EventID: 494) (User: )
Description: DllHost3164IndexedDb: -1216C:\Users\Trevor\AppData\Local\Microsoft\Internet Explorer\Indexed DB\Internet.edb

Error: (04/23/2015 06:26:08 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: TeamViewer_Desktop.exe10.0.40798.055190beaTeamViewer_Desktop.exe10.0.40798.055190beac00004090037f6ea2d001d07e12c1aaf50bC:\Program Files (x86)\TeamViewer\TeamViewer_Desktop.exeC:\Program Files (x86)\TeamViewer\TeamViewer_Desktop.exebcaccf59-ea07-11e4-826a-60029255d7ee

Error: (04/23/2015 06:22:20 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: chrome.exe41.0.2272.11855199d5achrome.dll41.0.2272.1185519994280000003004fe1b8128001d07e13f68d4728C:\Program Files (x86)\Google\Chrome\Application\chrome.exeC:\Program Files (x86)\Google\Chrome\Application\41.0.2272.118\chrome.dll3487907f-ea07-11e4-826a-60029255d7ee

Error: (04/23/2015 06:17:05 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: chrome.exe41.0.2272.11855199d5achrome.dll41.0.2272.1185519994280000003004fe1b810a001d07e133a403c79C:\Program Files (x86)\Google\Chrome\Application\chrome.exeC:\Program Files (x86)\Google\Chrome\Application\41.0.2272.118\chrome.dll78f88847-ea06-11e4-826a-60029255d7ee


==================== Memory info ===========================

Processor: Intel(R) Core(TM) i5-4300U CPU @ 1.90GHz
Percentage of memory in use: 47%
Total physical RAM: 4001.07 MB
Available physical RAM: 2118.18 MB
Total Pagefile: 4705.07 MB
Available Pagefile: 2640.62 MB
Total Virtual: 131072 MB
Available Virtual: 131071.79 MB

==================== Drives ================================

Drive c: (Windows) (Fixed) (Total:113.5 GB) (Free:63.97 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 119.2 GB) (Disk ID: AEDB64B9)

Partition: GPT Partition Type.

==================== End Of Log ============================

 

[TwinHeadedEagle]

Scan with ZOEK

Please download ZOEK by Smeenk and save it to your desktop (preferred version is the *.exe one)
Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

• Right-click on
  
  icon and select
  
  Run as Administrator to start the tool.
• Wait patiently until the main console will appear, it may take a minute or two.
• In the main box please paste in the following script:
  

  createsrpoint;
  autoclean;
  emptyalltemp;
  ipconfig /flushdns;b

• Make sure that Scan All Users option is checked.
• Push Run Script and wait patiently. The scan may take a couple of minutes.
• When the scan completes, a zoek-results logfile should open in notepad.
• If a reboot is needed, it will be opened after it. You may also find it at your main drive (usually C:\ drive)

Post its content into your next reply.

 

[Mnemoch]

Thanks very much! Sorry had actually tried that too (although not certain script was the same) but did it again and results below (I had to type the script, I couldn't select anything on the page because of the hidden overlay). Also, I have tried browsing and in 5 minutes no popups. I am also able to copy and paste on this page now. Fingers crossed! Any idea what I had?


Zoek.exe v5.0.0.0 Updated 23-04-2015
Tool run by Trevor on Fri 05/01/2015 at 5:49:40.08.
Microsoft Windows 8.1 Pro 6.3.9600 x64
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\Trevor\Downloads\zoek.exe [Scan all users] [Script inserted]

==== System Restore Info ======================

5/1/2015 5:51:01 AM Zoek.exe System Restore Point Created Successfully.

==== Deleting CLSID Registry Keys ======================


==== Deleting CLSID Registry Values ======================


==== Deleting Services ======================


==== Batch Command(s) Run By Tool======================


==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.google.com"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
{012E1000-F331-11DB-8314-0800200C9A66} Google Url="http://www.google.com/search?q={searchTerms}"
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02"

==== Empty IE Cache ======================

C:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Trevor\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\Users\Trevor\AppData\Local\Microsoft\Windows\INetCache\Low\Content.IE5 emptied successfully
C:\windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Trevor\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully
C:\Users\Trevor\AppData\Local\Microsoft\Windows\INetCache\Low\IE emptied successfully
C:\windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully

==== Empty FireFox Cache ======================

No FireFox Profiles found

==== Empty Chrome Cache ======================

No Chrome User Data found

==== Empty All Flash Cache ======================

No Flash Cache Found

==== Empty All Java Cache ======================

No Java Cache Found

==== C:\zoek_backup content ======================

C:\zoek_backup (files=16 folders=17 29165838 bytes)

==== Empty Temp Folders ======================

C:\Users\Default\AppData\Local\Temp emptied successfully
C:\Users\Default User\AppData\Local\Temp emptied successfully
C:\Users\Trevor\AppData\Local\Temp will be emptied at reboot
C:\windows\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully
C:\windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully
C:\windows\Temp will be emptied at reboot

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\windows\Temp successfully emptied
C:\Users\Trevor\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\$RECYCLE.BIN successfully emptied

==== EOF on Fri 05/01/2015 at 6:02:29.62 ======================

 

[TwinHeadedEagle]

I am not sure, maybe it was only some cached file.

Keep me updated.