- Feb 26, 2015
- 4
Need help removing nextcoup and pricechopp from extensions
- Thread starter Steele Duke
- Start date
- Mar 8, 2013
- 22,627
Hello,
They call me TwinHeadedEagle around here, and I'll be working with you.
Before we start please read and note the following:
Rules and policies
We won't support any piracy.
That being told, if any evidence of illegal OS, software, cracks/keygens or any other will be revealed, any further assistance will be suspended. If you are aware that there is this kind of stuff on your machine, remove it before proceeding!
The same applies to any use of P2P software: uTorrent, BitTorrent, Vuze, Kazaa, Ares... We don't provide any help for P2P, except for their removal. All P2P software has to be uninstalled or at least fully disabled before proceeding!
Failure to follow these guidelines will result with closing your topic and withdrawning any assistance.
Scan with Farbar Recovery Scan Tool
Please download Farbar Recovery Scan Tool and save it to your desktop.
Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them.
Only one of them will run on your system, that will be the right version.
They call me TwinHeadedEagle around here, and I'll be working with you.
Before we start please read and note the following:
- At the top of your post, please click on the "Watch thread" button and make sure to check Watch this thread...and receive email notifications. This will send an email to you as soon as I reply to your topic, allowing me to solve your problem faster.
- Please do not install any new software during the cleaning process other than the tools I provide for you. This can hinder the cleaning process. Please do not perform System Restore or any other restore.
- Instructions I give to you are very simple and made for complete beginner to follow. That's why you need to read through my instructions carefully and completely before executing them.
- Please do not run any tools other than the ones I ask you to, when I ask you to. Some of these tools can be very dangerous if used improperly. Also, if you use a tool that I have not requested you use, it can cause false positives, thereby delaying the complete cleaning of your machine.
- All tools we use here are completely clean and do not contain any malware. If your antivirus detects them as malicious, please disable your antivirus and then continue.
- If during the process you run across anything that is not in my instructions, please stop and ask. If any tool is running too much time (few hours), please stop and inform me.
- I visit forum several times at day, making sure to respond to everyone's topic as fast as possible. But bear in mind that I have private life like everyone and I cannot be here 24/7. So please be patient with me. Also, some infections require less, and some more time to be removed completely, so bear this in mind and be patient.
- Please stay with me until the end of all steps and procedures and I declare your system clean. Just because there is a lack of symptoms does not indicate a clean machine. If you solved your problem yourself, set aside two minutes to let me know.
- Please attach all report using
button below. Doing this, you make it easier for me to analyze and fix your problem.
- Do not ask for help for your business PC. Companies are making revenue via computers, so it is good thing to pay for the repair.
- If I don't hear from you within 3 days from this initial or any subsequent post, then this thread will be closed.
We won't support any piracy.
That being told, if any evidence of illegal OS, software, cracks/keygens or any other will be revealed, any further assistance will be suspended. If you are aware that there is this kind of stuff on your machine, remove it before proceeding!
The same applies to any use of P2P software: uTorrent, BitTorrent, Vuze, Kazaa, Ares... We don't provide any help for P2P, except for their removal. All P2P software has to be uninstalled or at least fully disabled before proceeding!
Failure to follow these guidelines will result with closing your topic and withdrawning any assistance.
Please download Farbar Recovery Scan Tool and save it to your desktop.
Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them.
Only one of them will run on your system, that will be the right version.
- Double-click to run it. When the tool opens click Yes to disclaimer.
- Press Scan button.
- It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
- The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.
- Feb 26, 2015
- 4
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 25-02-2015 01
Ran by jerry (administrator) on JENNIFER-PC on 26-02-2015 17:01:24
Running from C:\Users\jerry\Downloads
Loaded Profiles: jerry (Available profiles: jerry)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: English (United States)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Conexant Systems, Inc.) C:\Program Files\CONEXANT\cAudioFilterAgent\cAudioFilterAgent64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(Sun Microsystems, Inc.) C:\Program Files (x86)\Java\jre6\bin\ssvagent.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Microsoft Corporation) C:\Windows\System32\dinotify.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae-svc.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae64.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [] => [X]
HKLM\...\Run: [cAudioFilterAgent] => C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [520760 2010-03-10] (Conexant Systems, Inc.)
HKLM\...\Run: [SmartAudio] => C:\Program Files\CONEXANT\SAII\SAIICpl.exe [307768 2009-11-19] ()
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2052392 2010-03-10] (Synaptics Incorporated)
HKLM\...\Run: [TosVolRegulator] => C:\Program Files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe [24376 2009-11-11] (TOSHIBA Corporation)
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1331288 2014-08-22] (Microsoft Corporation)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [Malwarebytes Anti-Exploit] => C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe [2561848 2014-12-10] (Malwarebytes Corporation)
Winlogon\Notify\igfxcui: C:\windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-1608575498-428315075-3764911856-1003\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7416088 2015-02-19] (Piriform Ltd)
HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\windows\System32\SPReview\SPReview.exe [301568 2013-05-21] (Microsoft Corporation)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
ProxyServer: [S-1-5-21-1608575498-428315075-3764911856-1003] => http=127.0.0.1:57914;https=127.0.0.1:57914
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
HKU\S-1-5-21-1608575498-428315075-3764911856-1003\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com/ig?brand=TSNA&bmod=TSNA
SearchScopes: HKLM -> DefaultScope {BF47E6B2-ED0A-40C0-A260-69DF9E0FC686} URL = http://www.google.com/search?source...nputEncoding}&oe={outputEncoding}&rlz=1I7TSNA
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM -> {BF47E6B2-ED0A-40C0-A260-69DF9E0FC686} URL = http://www.google.com/search?source...nputEncoding}&oe={outputEncoding}&rlz=1I7TSNA
SearchScopes: HKLM-x32 -> DefaultScope value is missing.
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> {6B3F49F9-BDC7-49E7-8CB7-B5052FFBE44E} URL = http://www.google.com/search?source...nputEncoding}&oe={outputEncoding}&rlz=1I7TSNA
SearchScopes: HKU\S-1-5-21-1608575498-428315075-3764911856-1003 -> DefaultScope {6C4FF731-A058-460D-B6C7-8D5C42153056} URL = https://www.google.com/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-1608575498-428315075-3764911856-1003 -> {6C4FF731-A058-460D-B6C7-8D5C42153056} URL = https://www.google.com/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-1608575498-428315075-3764911856-1003 -> {BF47E6B2-ED0A-40C0-A260-69DF9E0FC686} URL =
SearchScopes: HKU\S-1-5-21-1608575498-428315075-3764911856-1003 -> {EC43DE6D-2551-4562-B52A-3660817F235C} URL = http://www.google.com/search?source...nputEncoding}&oe={outputEncoding}&rlz=1I7TSNA
BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.43.1
FireFox:
========
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin -> C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKU\S-1-5-21-1608575498-428315075-3764911856-1003: @citrixonline.com/appdetectorplugin -> C:\Users\jerry\AppData\Local\Citrix\Plugins\104\npappdetector.dll (Citrix Online)
Chrome:
=======
CHR HomePage: Default -> hxxp://www.google.com/
CHR StartupUrls: Default -> "hxxp://google.com/"
CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:inputType}{google:cursorPosition}{google:currentPageUrl}{google
ageClassification}{google:searchVersion}{google:sessionToken}{googlerefetchQuery}sugkey={google:suggestAPIKeyParameter}
CHR Profile: C:\Users\jerry\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (pricechopp) - C:\Users\jerry\AppData\Local\Google\Chrome\User Data\Default\Extensions\akbhfeplmhgobbfpagoocjhoflolfeel [2014-08-05]
CHR Extension: (Google Drive) - C:\Users\jerry\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-08-04]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\jerry\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-08-05]
CHR Extension: (YouTube) - C:\Users\jerry\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-08-04]
CHR Extension: (Google Search) - C:\Users\jerry\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-08-04]
CHR Extension: (Gmail Offline) - C:\Users\jerry\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejidjjhkpiempkbhmpbfngldlkglhimk [2014-09-23]
CHR Extension: (priciecchop) - C:\Users\jerry\AppData\Local\Google\Chrome\User Data\Default\Extensions\hhjjeefmnjpgeblclenngnklodenplap [2014-08-05]
CHR Extension: (NextCoup) - C:\Users\jerry\AppData\Local\Google\Chrome\User Data\Default\Extensions\mfdjhdenipmoeffffojjehmkefiedeno [2014-08-05]
CHR Extension: (emails2docs) - C:\Users\jerry\AppData\Local\Google\Chrome\User Data\Default\Extensions\mokbchipfpaaoioeljkgpojddoecnbce [2014-09-23]
CHR Extension: (Google Wallet) - C:\Users\jerry\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-08-04]
CHR Extension: (Salesforce.com) - C:\Users\jerry\AppData\Local\Google\Chrome\User Data\Default\Extensions\ooaoeobbhfgkohkegpbidjjnkhjfccao [2014-08-04]
CHR Extension: (Gmail) - C:\Users\jerry\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-08-04]
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77128 2015-01-19] (Apple Inc.)
R2 MbaeSvc; C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae-svc.exe [555320 2014-12-10] (Malwarebytes Corporation)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23784 2014-08-22] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [368624 2014-08-22] (Microsoft Corporation)
S2 PnkBstrA; C:\windows\SysWOW64\PnkBstrA.exe [66872 2013-10-31] ()
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-26] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R1 ESProtectionDriver; C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae64.sys [63064 2014-12-10] ()
R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-02-26] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\windows\system32\drivers\mwac.sys [63704 2014-11-21] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [269008 2014-07-17] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [125584 2014-07-17] (Microsoft Corporation)
S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [54784 2012-12-13] (Apple, Inc.) [File not signed]
S3 RSUSBSTOR; System32\Drivers\RtsUStor.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-02-26 17:01 - 2015-02-26 17:02 - 00013069 _____ () C:\Users\jerry\Downloads\FRST.txt
2015-02-26 17:01 - 2015-02-26 17:01 - 00000000 ____D () C:\FRST
2015-02-26 17:00 - 2015-02-26 17:00 - 02087936 _____ (Farbar) C:\Users\jerry\Downloads\FRST64.exe
2015-02-26 16:59 - 2015-02-26 16:59 - 01127424 _____ (Farbar) C:\Users\jerry\Downloads\FRST.exe
2015-02-26 16:47 - 2015-02-26 16:48 - 00000000 ____D () C:\ProgramData\Malwarebytes Anti-Exploit
2015-02-26 16:47 - 2015-02-26 16:47 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Exploit
2015-02-26 16:47 - 2015-02-26 16:47 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Exploit
2015-02-26 16:43 - 2015-02-26 16:45 - 02967032 _____ (Malwarebytes ) C:\Users\jerry\Downloads\mbae-setup-1.05.1.1016.exe
2015-02-26 16:43 - 2015-02-26 16:45 - 00448512 _____ (OldTimer Tools) C:\Users\jerry\Downloads\TFC.exe
2015-02-26 16:33 - 2015-02-26 16:33 - 00002266 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2015-02-26 16:29 - 2015-02-26 16:33 - 00000000 ____D () C:\Program Files (x86)\Google
2015-02-26 16:28 - 2015-02-26 16:28 - 00000000 ____D () C:\Users\jerry\AppData\Local\Deployment
2015-02-26 16:28 - 2015-02-26 16:28 - 00000000 ____D () C:\Users\jerry\AppData\Local\Apps\2.0
2015-02-26 15:53 - 2015-02-26 15:53 - 00010902 _____ () C:\Users\jerry\Documents\cc_20150226_155313.reg
2015-02-26 15:52 - 2015-02-26 15:53 - 00110586 _____ () C:\Users\jerry\Documents\cc_20150226_155243.reg
2015-02-26 15:35 - 2015-02-26 15:38 - 05325352 _____ (Piriform Ltd) C:\Users\jerry\Downloads\ccsetup503pro.exe
2015-02-12 23:16 - 2015-02-26 16:29 - 00003640 _____ () C:\windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-02-12 23:10 - 2015-02-12 23:14 - 00000000 ____D () C:\Users\jerry\AppData\Roaming\Apple Computer
2015-02-12 23:10 - 2015-02-12 23:10 - 00000000 ____D () C:\Users\jerry\AppData\Local\Apple Computer
2015-02-12 23:09 - 2015-02-12 23:09 - 00001764 _____ () C:\Users\Public\Desktop\iTunes.lnk
2015-02-12 23:09 - 2015-02-12 23:09 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2015-02-12 23:08 - 2012-10-03 16:14 - 00033240 _____ (GEAR Software Inc.) C:\windows\system32\Drivers\GEARAspiWDM.sys
2015-02-12 23:06 - 2015-02-12 23:06 - 00000000 ____D () C:\Program Files\iPod
2015-02-12 23:06 - 2015-02-12 23:06 - 00000000 ____D () C:\Program Files (x86)\iTunes
2015-02-12 23:05 - 2015-02-12 23:08 - 00000000 ____D () C:\ProgramData\E1864A66-75E3-486a-BD95-D1B7D99A84A7
2015-02-12 23:03 - 2015-02-12 23:03 - 00002519 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk
2015-02-12 23:03 - 2015-02-12 23:03 - 00000000 ____D () C:\windows\System32\Tasks\Apple
2015-02-12 23:03 - 2015-02-12 23:03 - 00000000 ____D () C:\Users\jerry\AppData\Local\Apple
2015-02-12 23:02 - 2015-02-12 23:03 - 00000000 ____D () C:\Program Files (x86)\Apple Software Update
2015-02-12 23:00 - 2015-02-12 23:01 - 00000000 ____D () C:\Program Files\Bonjour
2015-02-12 23:00 - 2015-02-12 23:01 - 00000000 ____D () C:\Program Files (x86)\Bonjour
2015-02-12 22:59 - 2015-02-12 23:05 - 00000000 ____D () C:\Program Files\Common Files\Apple
2015-02-12 22:38 - 2015-02-12 22:40 - 152439600 _____ (Apple Inc.) C:\Users\jerry\Downloads\itunes6464setup.exe
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-02-26 16:57 - 2014-08-05 11:09 - 00129752 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2015-02-26 16:47 - 2013-04-21 18:53 - 00000892 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-02-26 16:46 - 2013-03-30 09:55 - 01770429 _____ () C:\windows\WindowsUpdate.log
2015-02-26 16:34 - 2013-04-21 18:53 - 00000896 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-02-26 16:29 - 2013-04-21 18:53 - 00003892 _____ () C:\windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-02-26 15:43 - 2013-04-24 20:09 - 00000000 ____D () C:\Program Files\CCleaner
2015-02-26 15:41 - 2013-04-24 20:09 - 00002772 _____ () C:\windows\System32\Tasks\CCleanerSkipUAC
2015-02-26 15:41 - 2013-04-24 20:09 - 00000833 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2015-02-13 00:47 - 2009-07-13 22:45 - 00018736 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-02-13 00:47 - 2009-07-13 22:45 - 00018736 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-02-12 23:50 - 2014-08-05 11:09 - 00001113 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2015-02-12 23:50 - 2014-08-05 11:09 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-02-12 23:50 - 2014-08-05 11:08 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2015-02-12 23:41 - 2009-07-13 22:57 - 00001547 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2015-02-12 22:58 - 2013-11-26 21:36 - 00000000 ____D () C:\ProgramData\Apple
2015-02-12 22:53 - 2014-09-12 09:39 - 00005617 _____ () C:\windows\system32\lvcoinst.log
2015-02-12 22:53 - 2014-09-12 09:39 - 00000000 ____D () C:\Program Files\Common Files\logishrd
2015-02-12 22:50 - 2014-09-12 08:29 - 00000000 ____D () C:\Program Files (x86)\Logitech
2015-02-12 22:44 - 2009-07-13 23:13 - 00782510 _____ () C:\windows\system32\PerfStringBackup.INI
2015-02-12 22:36 - 2009-07-13 23:08 - 00000006 ____H () C:\windows\Tasks\SA.DAT
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-02-13 00:41
==================== End Of Log ============================
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 25-02-2015 01
Ran by jerry at 2015-02-26 17:02:35
Running from C:\Users\jerry\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Microsoft Security Essentials (Enabled - Up to date) {4F35CFC4-45A3-FC37-EF17-759A02E39AB1}
AS: Microsoft Security Essentials (Enabled - Up to date) {F4542E20-6399-F3B9-D5A7-4EE87964D00C}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Adobe Flash Player 10 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 10.0.42.34 - Adobe Systems Incorporated)
Adobe Reader 9.3 (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-A93000000001}) (Version: 9.3.0 - Adobe Systems Incorporated)
Apple Application Support (32-bit) (HKLM-x32\...\{2FE00055-C4F3-4F7A-AEDD-E198D54CF12F}) (Version: 3.1.1 - Apple Inc.)
Apple Application Support (64-bit) (HKLM\...\{28791292-D18D-42FA-AE66-3D3D20AA8618}) (Version: 3.1.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{5ED7462B-EF58-4757-B609-53755021EC34}) (Version: 8.1.0.18 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (HKLM-x32\...\{3108C217-BE83-42E4-AE9E-A56A2A92E549}) (Version: 1.0.0.27 - Atheros Communications Inc.)
Atheros Driver Installation Program (HKLM-x32\...\{C3A32068-8AB1-4327-BB16-BED9C6219DC7}) (Version: 5.2 - Atheros)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
CCleaner (HKLM\...\CCleaner) (Version: 5.03 - Piriform)
Conexant HD Audio (HKLM\...\CNXT_AUDIO_HDA) (Version: 4.111.0.64 - Conexant)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 40.0.2214.115 - Google Inc.)
Google Update Helper (x32 Version: 1.3.25.5 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.26.9 - Google Inc.) Hidden
Intel(R) Graphics Media Accelerator Driver (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2086 - Intel Corporation)
Intel® Matrix Storage Manager (HKLM\...\{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}) (Version: - Intel Corporation)
iTunes (HKLM\...\{7B8D4E8A-EA2B-4A71-BFEB-A4AAAB87C5D0}) (Version: 12.1.0.71 - Apple Inc.)
Java 7 Update 51 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217045FF}) (Version: 7.0.510 - Oracle)
Java(TM) 6 Update 17 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83216017FF}) (Version: 6.0.170 - Sun Microsystems, Inc.)
Malwarebytes Anti-Exploit version 1.05.1.1016 (HKLM\...\Malwarebytes Anti-Exploit_is1) (Version: 1.05.1.1016 - Malwarebytes)
Malwarebytes Anti-Malware version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.6.305.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB973685) (HKLM-x32\...\{859DFA95-E4A6-48CD-B88E-A3E483E89B44}) (Version: 4.30.2107.0 - Microsoft Corporation)
PlayReady PC Runtime amd64 (HKLM\...\{BCA9334F-B6C9-4F65-9A73-AC5A329A4D04}) (Version: 1.3.0 - Microsoft Corporation)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.0.8.1 - Synaptics Incorporated)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
==================== Restore Points =========================
12-09-2014 16:05:37 Windows Update
12-09-2014 17:25:51 Installed Webassessor Sentinel Security Shield™ x64
13-09-2014 02:00:11 Windows Update
14-09-2014 02:00:12 Windows Update
23-09-2014 13:31:44 Windows Update
23-09-2014 13:57:38 Installed AT&T Connect Participant Application v10.7.114.
23-09-2014 14:07:00 Removed AT&T Connect Participant Application v10.7.114.
23-09-2014 14:10:03 Removed Bonjour
23-09-2014 14:12:53 Removed Microsoft Office File Validation Add-In
23-09-2014 14:13:17 Removed Microsoft PowerPoint Viewer
23-09-2014 14:15:15 Removed Microsoft Works
25-09-2014 12:45:57 Windows Update
23-10-2014 14:52:52 Scheduled Checkpoint
23-10-2014 14:53:18 Windows Update
12-02-2015 22:46:10 Removed Webassessor Sentinel Security Shield™ x64
12-02-2015 23:03:34 Installed iTunes
26-02-2015 16:11:32 Windows Update
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-13 20:34 - 2009-06-10 15:00 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {27E0CBD2-1912-421B-8B0D-48CBEB964A2F} - System32\Tasks\{8E77E671-FD11-402A-BB70-1B0DD76E39F3} => pcalua.exe -a C:\Users\jerry\Downloads\Impactor_0.9.14\impactor\installer_x86.exe -d C:\Users\jerry\Downloads\Impactor_0.9.14\impactor
Task: {502A5686-CC6E-4661-953C-A3BD84C4A245} - System32\Tasks\LaunchApp => C:\Program Files (x86)\MyPC Backup\MyPC Backup.exe <==== ATTENTION
Task: {939335F8-FEE1-4F7A-92AC-1AF8BB932045} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-02-26] (Google Inc.)
Task: {A2C5E0AA-82B4-4660-A0BF-285A1F418E2B} - System32\Tasks\{2DD3EE5F-22D2-4E9B-86C8-21F05D23691D} => pcalua.exe -a C:\Users\jennifer\Downloads\wlsetup-web.exe -d C:\Users\jennifer\Downloads
Task: {AE47C330-7824-4137-9889-803BEF5988C1} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {D3345348-5D94-4D6E-8D4F-3ED0BA4D362E} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-02-26] (Google Inc.)
Task: {E9E87C08-088E-4314-B079-0E20FFED6BD0} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2015-02-19] (Piriform Ltd)
Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) ==============
2015-01-20 22:35 - 2015-01-20 22:35 - 00085832 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2015-01-20 22:35 - 2015-01-20 22:35 - 01346344 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2015-02-26 16:33 - 2015-02-17 16:44 - 01117512 _____ () C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.115\libglesv2.dll
2015-02-26 16:33 - 2015-02-17 16:44 - 00211272 _____ () C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.115\libegl.dll
2015-02-26 16:33 - 2015-02-17 16:44 - 09171272 _____ () C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.115\pdf.dll
2015-02-26 16:33 - 2015-02-17 16:44 - 14965064 _____ () C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.115\PepperFlash\pepflashplayer.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) ===============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-1608575498-428315075-3764911856-1003\Control Panel\Desktop\\Wallpaper -> C:\Users\jerry\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.43.1
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
MSCONFIG\Services: ehRecvr => 3
MSCONFIG\Services: ehSched => 3
MSCONFIG\Services: Fax => 3
MSCONFIG\Services: HomeGroupListener => 3
MSCONFIG\Services: HomeGroupProvider => 3
MSCONFIG\Services: iphlpsvc => 2
MSCONFIG\Services: napagent => 3
MSCONFIG\Services: SCardSvr => 3
MSCONFIG\Services: SCPolicySvc => 3
MSCONFIG\Services: TabletInputService => 3
MSCONFIG\Services: WMPNetworkSvc => 2
MSCONFIG\Services: WPCSvc => 3
MSCONFIG\startupfolder: C:^Users^jerry^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Logitech . Product Registration.lnk => C:\windows\pss\Logitech . Product Registration.lnk.Startup
MSCONFIG\startupreg: LogitechVideoRepair => C:\Program Files (x86)\Logitech\Video\ISStart.exe
MSCONFIG\startupreg: LogitechVideoTray => C:\Program Files (x86)\Logitech\Video\LogiTray.exe
MSCONFIG\startupreg: Safer-Surf => C:\Program Files (x86)\ver5Safer-Surf\Safer-Surf.exe
==================== Accounts: =============================
Administrator (S-1-5-21-1608575498-428315075-3764911856-500 - Administrator - Disabled)
Guest (S-1-5-21-1608575498-428315075-3764911856-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1608575498-428315075-3764911856-1002 - Limited - Enabled)
jerry (S-1-5-21-1608575498-428315075-3764911856-1003 - Administrator - Enabled) => C:\Users\jerry
==================== Faulty Device Manager Devices =============
Name: Microsoft Teredo Tunneling Adapter
Description: Microsoft Teredo Tunneling Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
==================== Event log errors: =========================
Application errors:
==================
Error: (02/26/2015 04:18:36 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Activation context generation failed for "37.0.2062.124,language="*",type="win32",version="37.0.2062.124"1".
Dependent Assembly 37.0.2062.124,language="*",type="win32",version="37.0.2062.124" could not be found.
Please use sxstrace.exe for detailed diagnosis.
Error: (02/26/2015 04:15:32 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Activation context generation failed for "40.0.2214.111,language="*",type="win32",version="40.0.2214.111"1".
Dependent Assembly 40.0.2214.111,language="*",type="win32",version="40.0.2214.111" could not be found.
Please use sxstrace.exe for detailed diagnosis.
Error: (02/26/2015 04:15:32 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Activation context generation failed for "40.0.2214.111,language="*",type="win32",version="40.0.2214.111"1".
Dependent Assembly 40.0.2214.111,language="*",type="win32",version="40.0.2214.111" could not be found.
Please use sxstrace.exe for detailed diagnosis.
Error: (09/12/2014 09:01:07 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program msinfo32.exe version 6.1.7601.17514 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.
Process ID: 1380
Start Time: 01cfce9a0f701e65
Termination Time: 62
Application Path: C:\windows\system32\msinfo32.exe
Report Id: 969d1b33-3a8d-11e4-ae63-00266c513509
Error: (09/12/2014 08:33:57 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.
Details:
AddWin32ServiceFiles: Unable to back up image of service vulsrsebjh64 since QueryServiceConfig API failed
System Error:
The system cannot find the file specified.
.
Error: (09/12/2014 08:33:57 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.
Details:
AddWin32ServiceFiles: Unable to back up image of service SW-Sustainer since QueryServiceConfig API failed
System Error:
The system cannot find the file specified.
.
Error: (09/12/2014 08:33:56 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.
Details:
AddWin32ServiceFiles: Unable to back up image of service AllDaySavingsService64 since QueryServiceConfig API failed
System Error:
The system cannot find the file specified.
.
Error: (09/12/2014 08:33:56 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.
Details:
AddLegacyDriverFiles: Unable to back up image of binary netfilter64.
System Error:
The system cannot find the file specified.
.
Error: (09/12/2014 08:32:33 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.
Details:
AddWin32ServiceFiles: Unable to back up image of service vulsrsebjh64 since QueryServiceConfig API failed
System Error:
The system cannot find the file specified.
.
Error: (09/12/2014 08:32:33 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.
Details:
AddWin32ServiceFiles: Unable to back up image of service SW-Sustainer since QueryServiceConfig API failed
System Error:
The system cannot find the file specified.
.
System errors:
=============
Error: (02/26/2015 04:46:57 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The PnkBstrA service terminated unexpectedly. It has done this 1 time(s).
Error: (02/26/2015 03:09:41 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: %NT AUTHORITY60 has encountered an error trying to update signatures.
New Signature Version:
Previous Signature Version: 113.69.0.0
Update Source: %NT AUTHORITY51
Update Stage: 4.6.0305.00
Source Path: 4.6.0305.01
Signature Type: %NT AUTHORITY602
Update Type: %NT AUTHORITY604
User: NT AUTHORITY\NETWORK SERVICE
Current Engine Version: %NT AUTHORITY605
Previous Engine Version: %NT AUTHORITY606
Error code: %NT AUTHORITY607
Error description: %NT AUTHORITY608
Error: (02/26/2015 03:09:41 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: %NT AUTHORITY60 has encountered an error trying to update signatures.
New Signature Version:
Previous Signature Version: 1.191.4826.0
Update Source: %NT AUTHORITY51
Update Stage: 4.6.0305.00
Source Path: 4.6.0305.01
Signature Type: %NT AUTHORITY602
Update Type: %NT AUTHORITY604
User: NT AUTHORITY\NETWORK SERVICE
Current Engine Version: %NT AUTHORITY605
Previous Engine Version: %NT AUTHORITY606
Error code: %NT AUTHORITY607
Error description: %NT AUTHORITY608
Error: (02/26/2015 03:09:41 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: %NT AUTHORITY60 has encountered an error trying to update signatures.
New Signature Version:
Previous Signature Version: 1.191.4826.0
Update Source: %NT AUTHORITY51
Update Stage: 4.6.0305.00
Source Path: 4.6.0305.01
Signature Type: %NT AUTHORITY602
Update Type: %NT AUTHORITY604
User: NT AUTHORITY\NETWORK SERVICE
Current Engine Version: %NT AUTHORITY605
Previous Engine Version: %NT AUTHORITY606
Error code: %NT AUTHORITY607
Error description: %NT AUTHORITY608
Error: (02/26/2015 03:09:41 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: %NT AUTHORITY60 has encountered an error trying to update signatures.
New Signature Version:
Previous Signature Version: 1.191.4826.0
Update Source: %NT AUTHORITY59
Update Stage: 4.6.0305.00
Source Path: 4.6.0305.01
Signature Type: %NT AUTHORITY602
Update Type: %NT AUTHORITY604
User: NT AUTHORITY\SYSTEM
Current Engine Version: %NT AUTHORITY605
Previous Engine Version: %NT AUTHORITY606
Error code: %NT AUTHORITY607
Error description: %NT AUTHORITY608
Error: (02/26/2015 03:07:45 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: %NT AUTHORITY60 has encountered an error trying to update signatures.
New Signature Version:
Previous Signature Version: 113.69.0.0
Update Source: %NT AUTHORITY51
Update Stage: 4.6.0305.00
Source Path: 4.6.0305.01
Signature Type: %NT AUTHORITY602
Update Type: %NT AUTHORITY604
User: NT AUTHORITY\NETWORK SERVICE
Current Engine Version: %NT AUTHORITY605
Previous Engine Version: %NT AUTHORITY606
Error code: %NT AUTHORITY607
Error description: %NT AUTHORITY608
Error: (02/26/2015 03:07:45 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: %NT AUTHORITY60 has encountered an error trying to update signatures.
New Signature Version:
Previous Signature Version: 1.191.4826.0
Update Source: %NT AUTHORITY51
Update Stage: 4.6.0305.00
Source Path: 4.6.0305.01
Signature Type: %NT AUTHORITY602
Update Type: %NT AUTHORITY604
User: NT AUTHORITY\NETWORK SERVICE
Current Engine Version: %NT AUTHORITY605
Previous Engine Version: %NT AUTHORITY606
Error code: %NT AUTHORITY607
Error description: %NT AUTHORITY608
Error: (02/26/2015 03:07:45 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: %NT AUTHORITY60 has encountered an error trying to update signatures.
New Signature Version:
Previous Signature Version: 1.191.4826.0
Update Source: %NT AUTHORITY51
Update Stage: 4.6.0305.00
Source Path: 4.6.0305.01
Signature Type: %NT AUTHORITY602
Update Type: %NT AUTHORITY604
User: NT AUTHORITY\NETWORK SERVICE
Current Engine Version: %NT AUTHORITY605
Previous Engine Version: %NT AUTHORITY606
Error code: %NT AUTHORITY607
Error description: %NT AUTHORITY608
Error: (02/26/2015 03:07:45 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: %NT AUTHORITY60 has encountered an error trying to update signatures.
New Signature Version:
Previous Signature Version: 1.191.4826.0
Update Source: %NT AUTHORITY59
Update Stage: 4.6.0305.00
Source Path: 4.6.0305.01
Signature Type: %NT AUTHORITY602
Update Type: %NT AUTHORITY604
User: NT AUTHORITY\SYSTEM
Current Engine Version: %NT AUTHORITY605
Previous Engine Version: %NT AUTHORITY606
Error code: %NT AUTHORITY607
Error description: %NT AUTHORITY608
Error: (02/12/2015 10:46:10 PM) (Source: Schannel) (EventID: 4120) (User: NT AUTHORITY)
Description: The following fatal alert was generated: 10. The internal error state is 10.
Microsoft Office Sessions:
=========================
Error: (02/26/2015 04:18:36 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: 37.0.2062.124,language="*",type="win32",version="37.0.2062.124"C:\$Recycle.Bin\S-1-5-21-1608575498-428315075-3764911856-1003\$RATX73Q.exe
Error: (02/26/2015 04:15:32 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: 40.0.2214.111,language="*",type="win32",version="40.0.2214.111"C:\$Recycle.Bin\S-1-5-21-1608575498-428315075-3764911856-1003\$RMJIWFK.exe
Error: (02/26/2015 04:15:32 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: 40.0.2214.111,language="*",type="win32",version="40.0.2214.111"C:\$Recycle.Bin\S-1-5-21-1608575498-428315075-3764911856-1003\$RMJIWFK.exe
Error: (09/12/2014 09:01:07 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: msinfo32.exe6.1.7601.17514138001cfce9a0f701e6562C:\windows\system32\msinfo32.exe969d1b33-3a8d-11e4-ae63-00266c513509
Error: (09/12/2014 08:33:57 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description:
Details:
AddWin32ServiceFiles: Unable to back up image of service vulsrsebjh64 since QueryServiceConfig API failed
System Error:
The system cannot find the file specified.
Error: (09/12/2014 08:33:57 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description:
Details:
AddWin32ServiceFiles: Unable to back up image of service SW-Sustainer since QueryServiceConfig API failed
System Error:
The system cannot find the file specified.
Error: (09/12/2014 08:33:56 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description:
Details:
AddWin32ServiceFiles: Unable to back up image of service AllDaySavingsService64 since QueryServiceConfig API failed
System Error:
The system cannot find the file specified.
Error: (09/12/2014 08:33:56 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description:
Details:
AddLegacyDriverFiles: Unable to back up image of binary netfilter64.
System Error:
The system cannot find the file specified.
Error: (09/12/2014 08:32:33 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description:
Details:
AddWin32ServiceFiles: Unable to back up image of service vulsrsebjh64 since QueryServiceConfig API failed
System Error:
The system cannot find the file specified.
Error: (09/12/2014 08:32:33 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description:
Details:
AddWin32ServiceFiles: Unable to back up image of service SW-Sustainer since QueryServiceConfig API failed
System Error:
The system cannot find the file specified.
==================== Memory info ===========================
Processor: Intel(R) Celeron(R) CPU 900 @ 2.20GHz
Percentage of memory in use: 65%
Total physical RAM: 1915.98 MB
Available physical RAM: 662.13 MB
Total Pagefile: 3831.95 MB
Available Pagefile: 1905.42 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB
==================== Drives ================================
Drive c: (TI105847W0E) (Fixed) (Total:127.88 GB) (Free:96.23 GB) NTFS ==>[System with boot components (obtained from reading drive)]
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 232.9 GB) (Disk ID: A3418076)
Partition 1: (Active) - (Size=1.5 GB) - (Type=27)
Partition 2: (Not Active) - (Size=127.9 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=8.9 GB) - (Type=17)
==================== End Of Log ============================
Ran by jerry (administrator) on JENNIFER-PC on 26-02-2015 17:01:24
Running from C:\Users\jerry\Downloads
Loaded Profiles: jerry (Available profiles: jerry)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: English (United States)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Conexant Systems, Inc.) C:\Program Files\CONEXANT\cAudioFilterAgent\cAudioFilterAgent64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(Sun Microsystems, Inc.) C:\Program Files (x86)\Java\jre6\bin\ssvagent.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Microsoft Corporation) C:\Windows\System32\dinotify.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae-svc.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae64.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [] => [X]
HKLM\...\Run: [cAudioFilterAgent] => C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [520760 2010-03-10] (Conexant Systems, Inc.)
HKLM\...\Run: [SmartAudio] => C:\Program Files\CONEXANT\SAII\SAIICpl.exe [307768 2009-11-19] ()
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2052392 2010-03-10] (Synaptics Incorporated)
HKLM\...\Run: [TosVolRegulator] => C:\Program Files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe [24376 2009-11-11] (TOSHIBA Corporation)
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1331288 2014-08-22] (Microsoft Corporation)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [Malwarebytes Anti-Exploit] => C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe [2561848 2014-12-10] (Malwarebytes Corporation)
Winlogon\Notify\igfxcui: C:\windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-1608575498-428315075-3764911856-1003\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7416088 2015-02-19] (Piriform Ltd)
HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\windows\System32\SPReview\SPReview.exe [301568 2013-05-21] (Microsoft Corporation)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
ProxyServer: [S-1-5-21-1608575498-428315075-3764911856-1003] => http=127.0.0.1:57914;https=127.0.0.1:57914
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
HKU\S-1-5-21-1608575498-428315075-3764911856-1003\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com/ig?brand=TSNA&bmod=TSNA
SearchScopes: HKLM -> DefaultScope {BF47E6B2-ED0A-40C0-A260-69DF9E0FC686} URL = http://www.google.com/search?source...nputEncoding}&oe={outputEncoding}&rlz=1I7TSNA
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM -> {BF47E6B2-ED0A-40C0-A260-69DF9E0FC686} URL = http://www.google.com/search?source...nputEncoding}&oe={outputEncoding}&rlz=1I7TSNA
SearchScopes: HKLM-x32 -> DefaultScope value is missing.
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> {6B3F49F9-BDC7-49E7-8CB7-B5052FFBE44E} URL = http://www.google.com/search?source...nputEncoding}&oe={outputEncoding}&rlz=1I7TSNA
SearchScopes: HKU\S-1-5-21-1608575498-428315075-3764911856-1003 -> DefaultScope {6C4FF731-A058-460D-B6C7-8D5C42153056} URL = https://www.google.com/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-1608575498-428315075-3764911856-1003 -> {6C4FF731-A058-460D-B6C7-8D5C42153056} URL = https://www.google.com/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-1608575498-428315075-3764911856-1003 -> {BF47E6B2-ED0A-40C0-A260-69DF9E0FC686} URL =
SearchScopes: HKU\S-1-5-21-1608575498-428315075-3764911856-1003 -> {EC43DE6D-2551-4562-B52A-3660817F235C} URL = http://www.google.com/search?source...nputEncoding}&oe={outputEncoding}&rlz=1I7TSNA
BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.43.1
FireFox:
========
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin -> C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKU\S-1-5-21-1608575498-428315075-3764911856-1003: @citrixonline.com/appdetectorplugin -> C:\Users\jerry\AppData\Local\Citrix\Plugins\104\npappdetector.dll (Citrix Online)
Chrome:
=======
CHR HomePage: Default -> hxxp://www.google.com/
CHR StartupUrls: Default -> "hxxp://google.com/"
CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:inputType}{google:cursorPosition}{google:currentPageUrl}{google
ageClassification}{google:searchVersion}{google:sessionToken}{googlerefetchQuery}sugkey={google:suggestAPIKeyParameter}CHR Profile: C:\Users\jerry\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (pricechopp) - C:\Users\jerry\AppData\Local\Google\Chrome\User Data\Default\Extensions\akbhfeplmhgobbfpagoocjhoflolfeel [2014-08-05]
CHR Extension: (Google Drive) - C:\Users\jerry\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-08-04]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\jerry\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-08-05]
CHR Extension: (YouTube) - C:\Users\jerry\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-08-04]
CHR Extension: (Google Search) - C:\Users\jerry\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-08-04]
CHR Extension: (Gmail Offline) - C:\Users\jerry\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejidjjhkpiempkbhmpbfngldlkglhimk [2014-09-23]
CHR Extension: (priciecchop) - C:\Users\jerry\AppData\Local\Google\Chrome\User Data\Default\Extensions\hhjjeefmnjpgeblclenngnklodenplap [2014-08-05]
CHR Extension: (NextCoup) - C:\Users\jerry\AppData\Local\Google\Chrome\User Data\Default\Extensions\mfdjhdenipmoeffffojjehmkefiedeno [2014-08-05]
CHR Extension: (emails2docs) - C:\Users\jerry\AppData\Local\Google\Chrome\User Data\Default\Extensions\mokbchipfpaaoioeljkgpojddoecnbce [2014-09-23]
CHR Extension: (Google Wallet) - C:\Users\jerry\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-08-04]
CHR Extension: (Salesforce.com) - C:\Users\jerry\AppData\Local\Google\Chrome\User Data\Default\Extensions\ooaoeobbhfgkohkegpbidjjnkhjfccao [2014-08-04]
CHR Extension: (Gmail) - C:\Users\jerry\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-08-04]
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77128 2015-01-19] (Apple Inc.)
R2 MbaeSvc; C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae-svc.exe [555320 2014-12-10] (Malwarebytes Corporation)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23784 2014-08-22] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [368624 2014-08-22] (Microsoft Corporation)
S2 PnkBstrA; C:\windows\SysWOW64\PnkBstrA.exe [66872 2013-10-31] ()
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-26] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R1 ESProtectionDriver; C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae64.sys [63064 2014-12-10] ()
R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-02-26] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\windows\system32\drivers\mwac.sys [63704 2014-11-21] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [269008 2014-07-17] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [125584 2014-07-17] (Microsoft Corporation)
S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [54784 2012-12-13] (Apple, Inc.) [File not signed]
S3 RSUSBSTOR; System32\Drivers\RtsUStor.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-02-26 17:01 - 2015-02-26 17:02 - 00013069 _____ () C:\Users\jerry\Downloads\FRST.txt
2015-02-26 17:01 - 2015-02-26 17:01 - 00000000 ____D () C:\FRST
2015-02-26 17:00 - 2015-02-26 17:00 - 02087936 _____ (Farbar) C:\Users\jerry\Downloads\FRST64.exe
2015-02-26 16:59 - 2015-02-26 16:59 - 01127424 _____ (Farbar) C:\Users\jerry\Downloads\FRST.exe
2015-02-26 16:47 - 2015-02-26 16:48 - 00000000 ____D () C:\ProgramData\Malwarebytes Anti-Exploit
2015-02-26 16:47 - 2015-02-26 16:47 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Exploit
2015-02-26 16:47 - 2015-02-26 16:47 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Exploit
2015-02-26 16:43 - 2015-02-26 16:45 - 02967032 _____ (Malwarebytes ) C:\Users\jerry\Downloads\mbae-setup-1.05.1.1016.exe
2015-02-26 16:43 - 2015-02-26 16:45 - 00448512 _____ (OldTimer Tools) C:\Users\jerry\Downloads\TFC.exe
2015-02-26 16:33 - 2015-02-26 16:33 - 00002266 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2015-02-26 16:29 - 2015-02-26 16:33 - 00000000 ____D () C:\Program Files (x86)\Google
2015-02-26 16:28 - 2015-02-26 16:28 - 00000000 ____D () C:\Users\jerry\AppData\Local\Deployment
2015-02-26 16:28 - 2015-02-26 16:28 - 00000000 ____D () C:\Users\jerry\AppData\Local\Apps\2.0
2015-02-26 15:53 - 2015-02-26 15:53 - 00010902 _____ () C:\Users\jerry\Documents\cc_20150226_155313.reg
2015-02-26 15:52 - 2015-02-26 15:53 - 00110586 _____ () C:\Users\jerry\Documents\cc_20150226_155243.reg
2015-02-26 15:35 - 2015-02-26 15:38 - 05325352 _____ (Piriform Ltd) C:\Users\jerry\Downloads\ccsetup503pro.exe
2015-02-12 23:16 - 2015-02-26 16:29 - 00003640 _____ () C:\windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-02-12 23:10 - 2015-02-12 23:14 - 00000000 ____D () C:\Users\jerry\AppData\Roaming\Apple Computer
2015-02-12 23:10 - 2015-02-12 23:10 - 00000000 ____D () C:\Users\jerry\AppData\Local\Apple Computer
2015-02-12 23:09 - 2015-02-12 23:09 - 00001764 _____ () C:\Users\Public\Desktop\iTunes.lnk
2015-02-12 23:09 - 2015-02-12 23:09 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2015-02-12 23:08 - 2012-10-03 16:14 - 00033240 _____ (GEAR Software Inc.) C:\windows\system32\Drivers\GEARAspiWDM.sys
2015-02-12 23:06 - 2015-02-12 23:06 - 00000000 ____D () C:\Program Files\iPod
2015-02-12 23:06 - 2015-02-12 23:06 - 00000000 ____D () C:\Program Files (x86)\iTunes
2015-02-12 23:05 - 2015-02-12 23:08 - 00000000 ____D () C:\ProgramData\E1864A66-75E3-486a-BD95-D1B7D99A84A7
2015-02-12 23:03 - 2015-02-12 23:03 - 00002519 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk
2015-02-12 23:03 - 2015-02-12 23:03 - 00000000 ____D () C:\windows\System32\Tasks\Apple
2015-02-12 23:03 - 2015-02-12 23:03 - 00000000 ____D () C:\Users\jerry\AppData\Local\Apple
2015-02-12 23:02 - 2015-02-12 23:03 - 00000000 ____D () C:\Program Files (x86)\Apple Software Update
2015-02-12 23:00 - 2015-02-12 23:01 - 00000000 ____D () C:\Program Files\Bonjour
2015-02-12 23:00 - 2015-02-12 23:01 - 00000000 ____D () C:\Program Files (x86)\Bonjour
2015-02-12 22:59 - 2015-02-12 23:05 - 00000000 ____D () C:\Program Files\Common Files\Apple
2015-02-12 22:38 - 2015-02-12 22:40 - 152439600 _____ (Apple Inc.) C:\Users\jerry\Downloads\itunes6464setup.exe
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-02-26 16:57 - 2014-08-05 11:09 - 00129752 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2015-02-26 16:47 - 2013-04-21 18:53 - 00000892 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-02-26 16:46 - 2013-03-30 09:55 - 01770429 _____ () C:\windows\WindowsUpdate.log
2015-02-26 16:34 - 2013-04-21 18:53 - 00000896 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-02-26 16:29 - 2013-04-21 18:53 - 00003892 _____ () C:\windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-02-26 15:43 - 2013-04-24 20:09 - 00000000 ____D () C:\Program Files\CCleaner
2015-02-26 15:41 - 2013-04-24 20:09 - 00002772 _____ () C:\windows\System32\Tasks\CCleanerSkipUAC
2015-02-26 15:41 - 2013-04-24 20:09 - 00000833 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2015-02-13 00:47 - 2009-07-13 22:45 - 00018736 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-02-13 00:47 - 2009-07-13 22:45 - 00018736 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-02-12 23:50 - 2014-08-05 11:09 - 00001113 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2015-02-12 23:50 - 2014-08-05 11:09 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-02-12 23:50 - 2014-08-05 11:08 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2015-02-12 23:41 - 2009-07-13 22:57 - 00001547 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2015-02-12 22:58 - 2013-11-26 21:36 - 00000000 ____D () C:\ProgramData\Apple
2015-02-12 22:53 - 2014-09-12 09:39 - 00005617 _____ () C:\windows\system32\lvcoinst.log
2015-02-12 22:53 - 2014-09-12 09:39 - 00000000 ____D () C:\Program Files\Common Files\logishrd
2015-02-12 22:50 - 2014-09-12 08:29 - 00000000 ____D () C:\Program Files (x86)\Logitech
2015-02-12 22:44 - 2009-07-13 23:13 - 00782510 _____ () C:\windows\system32\PerfStringBackup.INI
2015-02-12 22:36 - 2009-07-13 23:08 - 00000006 ____H () C:\windows\Tasks\SA.DAT
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-02-13 00:41
==================== End Of Log ============================
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 25-02-2015 01
Ran by jerry at 2015-02-26 17:02:35
Running from C:\Users\jerry\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Microsoft Security Essentials (Enabled - Up to date) {4F35CFC4-45A3-FC37-EF17-759A02E39AB1}
AS: Microsoft Security Essentials (Enabled - Up to date) {F4542E20-6399-F3B9-D5A7-4EE87964D00C}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Adobe Flash Player 10 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 10.0.42.34 - Adobe Systems Incorporated)
Adobe Reader 9.3 (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-A93000000001}) (Version: 9.3.0 - Adobe Systems Incorporated)
Apple Application Support (32-bit) (HKLM-x32\...\{2FE00055-C4F3-4F7A-AEDD-E198D54CF12F}) (Version: 3.1.1 - Apple Inc.)
Apple Application Support (64-bit) (HKLM\...\{28791292-D18D-42FA-AE66-3D3D20AA8618}) (Version: 3.1.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{5ED7462B-EF58-4757-B609-53755021EC34}) (Version: 8.1.0.18 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (HKLM-x32\...\{3108C217-BE83-42E4-AE9E-A56A2A92E549}) (Version: 1.0.0.27 - Atheros Communications Inc.)
Atheros Driver Installation Program (HKLM-x32\...\{C3A32068-8AB1-4327-BB16-BED9C6219DC7}) (Version: 5.2 - Atheros)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
CCleaner (HKLM\...\CCleaner) (Version: 5.03 - Piriform)
Conexant HD Audio (HKLM\...\CNXT_AUDIO_HDA) (Version: 4.111.0.64 - Conexant)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 40.0.2214.115 - Google Inc.)
Google Update Helper (x32 Version: 1.3.25.5 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.26.9 - Google Inc.) Hidden
Intel(R) Graphics Media Accelerator Driver (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2086 - Intel Corporation)
Intel® Matrix Storage Manager (HKLM\...\{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}) (Version: - Intel Corporation)
iTunes (HKLM\...\{7B8D4E8A-EA2B-4A71-BFEB-A4AAAB87C5D0}) (Version: 12.1.0.71 - Apple Inc.)
Java 7 Update 51 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217045FF}) (Version: 7.0.510 - Oracle)
Java(TM) 6 Update 17 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83216017FF}) (Version: 6.0.170 - Sun Microsystems, Inc.)
Malwarebytes Anti-Exploit version 1.05.1.1016 (HKLM\...\Malwarebytes Anti-Exploit_is1) (Version: 1.05.1.1016 - Malwarebytes)
Malwarebytes Anti-Malware version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.6.305.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB973685) (HKLM-x32\...\{859DFA95-E4A6-48CD-B88E-A3E483E89B44}) (Version: 4.30.2107.0 - Microsoft Corporation)
PlayReady PC Runtime amd64 (HKLM\...\{BCA9334F-B6C9-4F65-9A73-AC5A329A4D04}) (Version: 1.3.0 - Microsoft Corporation)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.0.8.1 - Synaptics Incorporated)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
==================== Restore Points =========================
12-09-2014 16:05:37 Windows Update
12-09-2014 17:25:51 Installed Webassessor Sentinel Security Shield™ x64
13-09-2014 02:00:11 Windows Update
14-09-2014 02:00:12 Windows Update
23-09-2014 13:31:44 Windows Update
23-09-2014 13:57:38 Installed AT&T Connect Participant Application v10.7.114.
23-09-2014 14:07:00 Removed AT&T Connect Participant Application v10.7.114.
23-09-2014 14:10:03 Removed Bonjour
23-09-2014 14:12:53 Removed Microsoft Office File Validation Add-In
23-09-2014 14:13:17 Removed Microsoft PowerPoint Viewer
23-09-2014 14:15:15 Removed Microsoft Works
25-09-2014 12:45:57 Windows Update
23-10-2014 14:52:52 Scheduled Checkpoint
23-10-2014 14:53:18 Windows Update
12-02-2015 22:46:10 Removed Webassessor Sentinel Security Shield™ x64
12-02-2015 23:03:34 Installed iTunes
26-02-2015 16:11:32 Windows Update
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-13 20:34 - 2009-06-10 15:00 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {27E0CBD2-1912-421B-8B0D-48CBEB964A2F} - System32\Tasks\{8E77E671-FD11-402A-BB70-1B0DD76E39F3} => pcalua.exe -a C:\Users\jerry\Downloads\Impactor_0.9.14\impactor\installer_x86.exe -d C:\Users\jerry\Downloads\Impactor_0.9.14\impactor
Task: {502A5686-CC6E-4661-953C-A3BD84C4A245} - System32\Tasks\LaunchApp => C:\Program Files (x86)\MyPC Backup\MyPC Backup.exe <==== ATTENTION
Task: {939335F8-FEE1-4F7A-92AC-1AF8BB932045} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-02-26] (Google Inc.)
Task: {A2C5E0AA-82B4-4660-A0BF-285A1F418E2B} - System32\Tasks\{2DD3EE5F-22D2-4E9B-86C8-21F05D23691D} => pcalua.exe -a C:\Users\jennifer\Downloads\wlsetup-web.exe -d C:\Users\jennifer\Downloads
Task: {AE47C330-7824-4137-9889-803BEF5988C1} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {D3345348-5D94-4D6E-8D4F-3ED0BA4D362E} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-02-26] (Google Inc.)
Task: {E9E87C08-088E-4314-B079-0E20FFED6BD0} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2015-02-19] (Piriform Ltd)
Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) ==============
2015-01-20 22:35 - 2015-01-20 22:35 - 00085832 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2015-01-20 22:35 - 2015-01-20 22:35 - 01346344 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2015-02-26 16:33 - 2015-02-17 16:44 - 01117512 _____ () C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.115\libglesv2.dll
2015-02-26 16:33 - 2015-02-17 16:44 - 00211272 _____ () C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.115\libegl.dll
2015-02-26 16:33 - 2015-02-17 16:44 - 09171272 _____ () C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.115\pdf.dll
2015-02-26 16:33 - 2015-02-17 16:44 - 14965064 _____ () C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.115\PepperFlash\pepflashplayer.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) ===============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-1608575498-428315075-3764911856-1003\Control Panel\Desktop\\Wallpaper -> C:\Users\jerry\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.43.1
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
MSCONFIG\Services: ehRecvr => 3
MSCONFIG\Services: ehSched => 3
MSCONFIG\Services: Fax => 3
MSCONFIG\Services: HomeGroupListener => 3
MSCONFIG\Services: HomeGroupProvider => 3
MSCONFIG\Services: iphlpsvc => 2
MSCONFIG\Services: napagent => 3
MSCONFIG\Services: SCardSvr => 3
MSCONFIG\Services: SCPolicySvc => 3
MSCONFIG\Services: TabletInputService => 3
MSCONFIG\Services: WMPNetworkSvc => 2
MSCONFIG\Services: WPCSvc => 3
MSCONFIG\startupfolder: C:^Users^jerry^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Logitech . Product Registration.lnk => C:\windows\pss\Logitech . Product Registration.lnk.Startup
MSCONFIG\startupreg: LogitechVideoRepair => C:\Program Files (x86)\Logitech\Video\ISStart.exe
MSCONFIG\startupreg: LogitechVideoTray => C:\Program Files (x86)\Logitech\Video\LogiTray.exe
MSCONFIG\startupreg: Safer-Surf => C:\Program Files (x86)\ver5Safer-Surf\Safer-Surf.exe
==================== Accounts: =============================
Administrator (S-1-5-21-1608575498-428315075-3764911856-500 - Administrator - Disabled)
Guest (S-1-5-21-1608575498-428315075-3764911856-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1608575498-428315075-3764911856-1002 - Limited - Enabled)
jerry (S-1-5-21-1608575498-428315075-3764911856-1003 - Administrator - Enabled) => C:\Users\jerry
==================== Faulty Device Manager Devices =============
Name: Microsoft Teredo Tunneling Adapter
Description: Microsoft Teredo Tunneling Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
==================== Event log errors: =========================
Application errors:
==================
Error: (02/26/2015 04:18:36 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Activation context generation failed for "37.0.2062.124,language="*",type="win32",version="37.0.2062.124"1".
Dependent Assembly 37.0.2062.124,language="*",type="win32",version="37.0.2062.124" could not be found.
Please use sxstrace.exe for detailed diagnosis.
Error: (02/26/2015 04:15:32 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Activation context generation failed for "40.0.2214.111,language="*",type="win32",version="40.0.2214.111"1".
Dependent Assembly 40.0.2214.111,language="*",type="win32",version="40.0.2214.111" could not be found.
Please use sxstrace.exe for detailed diagnosis.
Error: (02/26/2015 04:15:32 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Activation context generation failed for "40.0.2214.111,language="*",type="win32",version="40.0.2214.111"1".
Dependent Assembly 40.0.2214.111,language="*",type="win32",version="40.0.2214.111" could not be found.
Please use sxstrace.exe for detailed diagnosis.
Error: (09/12/2014 09:01:07 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program msinfo32.exe version 6.1.7601.17514 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.
Process ID: 1380
Start Time: 01cfce9a0f701e65
Termination Time: 62
Application Path: C:\windows\system32\msinfo32.exe
Report Id: 969d1b33-3a8d-11e4-ae63-00266c513509
Error: (09/12/2014 08:33:57 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.
Details:
AddWin32ServiceFiles: Unable to back up image of service vulsrsebjh64 since QueryServiceConfig API failed
System Error:
The system cannot find the file specified.
.
Error: (09/12/2014 08:33:57 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.
Details:
AddWin32ServiceFiles: Unable to back up image of service SW-Sustainer since QueryServiceConfig API failed
System Error:
The system cannot find the file specified.
.
Error: (09/12/2014 08:33:56 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.
Details:
AddWin32ServiceFiles: Unable to back up image of service AllDaySavingsService64 since QueryServiceConfig API failed
System Error:
The system cannot find the file specified.
.
Error: (09/12/2014 08:33:56 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.
Details:
AddLegacyDriverFiles: Unable to back up image of binary netfilter64.
System Error:
The system cannot find the file specified.
.
Error: (09/12/2014 08:32:33 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.
Details:
AddWin32ServiceFiles: Unable to back up image of service vulsrsebjh64 since QueryServiceConfig API failed
System Error:
The system cannot find the file specified.
.
Error: (09/12/2014 08:32:33 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.
Details:
AddWin32ServiceFiles: Unable to back up image of service SW-Sustainer since QueryServiceConfig API failed
System Error:
The system cannot find the file specified.
.
System errors:
=============
Error: (02/26/2015 04:46:57 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The PnkBstrA service terminated unexpectedly. It has done this 1 time(s).
Error: (02/26/2015 03:09:41 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: %NT AUTHORITY60 has encountered an error trying to update signatures.
New Signature Version:
Previous Signature Version: 113.69.0.0
Update Source: %NT AUTHORITY51
Update Stage: 4.6.0305.00
Source Path: 4.6.0305.01
Signature Type: %NT AUTHORITY602
Update Type: %NT AUTHORITY604
User: NT AUTHORITY\NETWORK SERVICE
Current Engine Version: %NT AUTHORITY605
Previous Engine Version: %NT AUTHORITY606
Error code: %NT AUTHORITY607
Error description: %NT AUTHORITY608
Error: (02/26/2015 03:09:41 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: %NT AUTHORITY60 has encountered an error trying to update signatures.
New Signature Version:
Previous Signature Version: 1.191.4826.0
Update Source: %NT AUTHORITY51
Update Stage: 4.6.0305.00
Source Path: 4.6.0305.01
Signature Type: %NT AUTHORITY602
Update Type: %NT AUTHORITY604
User: NT AUTHORITY\NETWORK SERVICE
Current Engine Version: %NT AUTHORITY605
Previous Engine Version: %NT AUTHORITY606
Error code: %NT AUTHORITY607
Error description: %NT AUTHORITY608
Error: (02/26/2015 03:09:41 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: %NT AUTHORITY60 has encountered an error trying to update signatures.
New Signature Version:
Previous Signature Version: 1.191.4826.0
Update Source: %NT AUTHORITY51
Update Stage: 4.6.0305.00
Source Path: 4.6.0305.01
Signature Type: %NT AUTHORITY602
Update Type: %NT AUTHORITY604
User: NT AUTHORITY\NETWORK SERVICE
Current Engine Version: %NT AUTHORITY605
Previous Engine Version: %NT AUTHORITY606
Error code: %NT AUTHORITY607
Error description: %NT AUTHORITY608
Error: (02/26/2015 03:09:41 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: %NT AUTHORITY60 has encountered an error trying to update signatures.
New Signature Version:
Previous Signature Version: 1.191.4826.0
Update Source: %NT AUTHORITY59
Update Stage: 4.6.0305.00
Source Path: 4.6.0305.01
Signature Type: %NT AUTHORITY602
Update Type: %NT AUTHORITY604
User: NT AUTHORITY\SYSTEM
Current Engine Version: %NT AUTHORITY605
Previous Engine Version: %NT AUTHORITY606
Error code: %NT AUTHORITY607
Error description: %NT AUTHORITY608
Error: (02/26/2015 03:07:45 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: %NT AUTHORITY60 has encountered an error trying to update signatures.
New Signature Version:
Previous Signature Version: 113.69.0.0
Update Source: %NT AUTHORITY51
Update Stage: 4.6.0305.00
Source Path: 4.6.0305.01
Signature Type: %NT AUTHORITY602
Update Type: %NT AUTHORITY604
User: NT AUTHORITY\NETWORK SERVICE
Current Engine Version: %NT AUTHORITY605
Previous Engine Version: %NT AUTHORITY606
Error code: %NT AUTHORITY607
Error description: %NT AUTHORITY608
Error: (02/26/2015 03:07:45 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: %NT AUTHORITY60 has encountered an error trying to update signatures.
New Signature Version:
Previous Signature Version: 1.191.4826.0
Update Source: %NT AUTHORITY51
Update Stage: 4.6.0305.00
Source Path: 4.6.0305.01
Signature Type: %NT AUTHORITY602
Update Type: %NT AUTHORITY604
User: NT AUTHORITY\NETWORK SERVICE
Current Engine Version: %NT AUTHORITY605
Previous Engine Version: %NT AUTHORITY606
Error code: %NT AUTHORITY607
Error description: %NT AUTHORITY608
Error: (02/26/2015 03:07:45 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: %NT AUTHORITY60 has encountered an error trying to update signatures.
New Signature Version:
Previous Signature Version: 1.191.4826.0
Update Source: %NT AUTHORITY51
Update Stage: 4.6.0305.00
Source Path: 4.6.0305.01
Signature Type: %NT AUTHORITY602
Update Type: %NT AUTHORITY604
User: NT AUTHORITY\NETWORK SERVICE
Current Engine Version: %NT AUTHORITY605
Previous Engine Version: %NT AUTHORITY606
Error code: %NT AUTHORITY607
Error description: %NT AUTHORITY608
Error: (02/26/2015 03:07:45 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: %NT AUTHORITY60 has encountered an error trying to update signatures.
New Signature Version:
Previous Signature Version: 1.191.4826.0
Update Source: %NT AUTHORITY59
Update Stage: 4.6.0305.00
Source Path: 4.6.0305.01
Signature Type: %NT AUTHORITY602
Update Type: %NT AUTHORITY604
User: NT AUTHORITY\SYSTEM
Current Engine Version: %NT AUTHORITY605
Previous Engine Version: %NT AUTHORITY606
Error code: %NT AUTHORITY607
Error description: %NT AUTHORITY608
Error: (02/12/2015 10:46:10 PM) (Source: Schannel) (EventID: 4120) (User: NT AUTHORITY)
Description: The following fatal alert was generated: 10. The internal error state is 10.
Microsoft Office Sessions:
=========================
Error: (02/26/2015 04:18:36 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: 37.0.2062.124,language="*",type="win32",version="37.0.2062.124"C:\$Recycle.Bin\S-1-5-21-1608575498-428315075-3764911856-1003\$RATX73Q.exe
Error: (02/26/2015 04:15:32 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: 40.0.2214.111,language="*",type="win32",version="40.0.2214.111"C:\$Recycle.Bin\S-1-5-21-1608575498-428315075-3764911856-1003\$RMJIWFK.exe
Error: (02/26/2015 04:15:32 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: 40.0.2214.111,language="*",type="win32",version="40.0.2214.111"C:\$Recycle.Bin\S-1-5-21-1608575498-428315075-3764911856-1003\$RMJIWFK.exe
Error: (09/12/2014 09:01:07 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: msinfo32.exe6.1.7601.17514138001cfce9a0f701e6562C:\windows\system32\msinfo32.exe969d1b33-3a8d-11e4-ae63-00266c513509
Error: (09/12/2014 08:33:57 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description:
Details:
AddWin32ServiceFiles: Unable to back up image of service vulsrsebjh64 since QueryServiceConfig API failed
System Error:
The system cannot find the file specified.
Error: (09/12/2014 08:33:57 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description:
Details:
AddWin32ServiceFiles: Unable to back up image of service SW-Sustainer since QueryServiceConfig API failed
System Error:
The system cannot find the file specified.
Error: (09/12/2014 08:33:56 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description:
Details:
AddWin32ServiceFiles: Unable to back up image of service AllDaySavingsService64 since QueryServiceConfig API failed
System Error:
The system cannot find the file specified.
Error: (09/12/2014 08:33:56 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description:
Details:
AddLegacyDriverFiles: Unable to back up image of binary netfilter64.
System Error:
The system cannot find the file specified.
Error: (09/12/2014 08:32:33 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description:
Details:
AddWin32ServiceFiles: Unable to back up image of service vulsrsebjh64 since QueryServiceConfig API failed
System Error:
The system cannot find the file specified.
Error: (09/12/2014 08:32:33 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description:
Details:
AddWin32ServiceFiles: Unable to back up image of service SW-Sustainer since QueryServiceConfig API failed
System Error:
The system cannot find the file specified.
==================== Memory info ===========================
Processor: Intel(R) Celeron(R) CPU 900 @ 2.20GHz
Percentage of memory in use: 65%
Total physical RAM: 1915.98 MB
Available physical RAM: 662.13 MB
Total Pagefile: 3831.95 MB
Available Pagefile: 1905.42 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB
==================== Drives ================================
Drive c: (TI105847W0E) (Fixed) (Total:127.88 GB) (Free:96.23 GB) NTFS ==>[System with boot components (obtained from reading drive)]
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 232.9 GB) (Disk ID: A3418076)
Partition 1: (Active) - (Size=1.5 GB) - (Type=27)
Partition 2: (Not Active) - (Size=127.9 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=8.9 GB) - (Type=17)
==================== End Of Log ============================
- Feb 26, 2015
- 4
How long do i need to wait for a reply can these malwares keylog my password Id really like to use my laptop...
- Feb 26, 2015
- 4
Similar threads
