[ti]SOLVED[/ti]System infected : fake plugin activity 2 detected

new

opaben
New Helpee

Posts: 9

[ti]SOLVED[/ti]System infected : fake plugin activity 2 detected Apr 20, 2015 2:47:46 GMT -8

Post by opaben on Apr 20, 2015 2:47:46 GMT -8

I also suffer from this nasty piece of malware and hope you can help me out.
I am running windows 7 32 bits and the warning is generated bij Norton 360.
I was reading the post of somebody else about the same problem, I already downloaded the FRST and am ready to generate the txt files.

Please let me know what else I have to do? what other information about my system (if any) do you need?

Thanks a lot for helping.

kind regards,

Opaben

Last Edit: Jun 8, 2015 23:10:17 GMT -8 by delphie

Quads
Malware Removalists

In New Zealand

Posts: 9,387

[ti]SOLVED[/ti]System infected : fake plugin activity 2 detected Apr 20, 2015 10:23:35 GMT -8

Post by Quads on Apr 20, 2015 10:23:35 GMT -8

Do Not use any tools or any programs for cleaning used until being asked / instructed to do so!!!!!.

Malware removal can be difficult over a forum as it is, without a user doing their own actions, the tools used are more advanced and thus have added danger that comes with that. This board is protected so that only Malware removers, Admin and Mods can reply to a users thread but all members can create a thread asking for removal of Infection(s)

Make changes to your computer only when the Malware Expert specifically states it. The Malware Experts request specific steps to be followed, as some malware removal requires multiple steps and evaluations along the way. When you take other advice or make other changes, this often negates the work done by the expert, and can sometimes result in an inoperable system.

This also includes any tools or steps other than those the from the Malware Expert. We need to be certain about the state of your system to see what actually is going on, and what is required to fix the system while not harming the rest of the system. Most often, well-intentioned independent efforts can make things much worse. The malware remediation tools are more advanced than othe tools, and can often create bigger problems when used without expert guidance.

Follow all the directions in order, and to the end. Please perform all steps in the order they are listed in each set of instructions. As you might imagine, some steps are a bit complicated. If things are not clear, be sure to stop and let the Malware Expert know the problem. We don't mind clarifying a situation, as others might have the same question. If a tool does not run as expected, don't force it. Stop the steps, and update the forum topic with the current situation. It is better stop and let us know, than to force a tool to run and cause bigger problems.

Also, when your computer is clean and we are finished, the Expert will tell you we are finished. Malware removal is a process that requires verification, and we want to be sure your system is completely clean before we're done.

When describing your problem, provide as much information as possible, as soon as possible. Explain as best you can what happens with your computer, e.g. it beeps three times, black screen with cursor then goes no further, system gets stuck at the Windows startup logo, etc. This helps the expert to understand what is happening to the system and what may be wrong. If your computer cannot start up successfully please provide details about your installed Windows Operating System, including the Version, Edition and if it is a 32bit or a 64bit system. (e.g. Windows Vista Home Premium 32-bit)

When the user follow instructions and things still go a little haywire, and it does happen, it is up to us to sort the extra problem out.

Take longer to read if your language is not English, so that hopefully it is understood.

Reply stating you have read the post fully.

I also if it is busy (have a lot of systems at once to deal with) like being in a supermarket checkout line, waiting their turn, I use the forum like a checkout line.

opaben New Helpee Posts: 9	[ti]SOLVED[/ti]System infected : fake plugin activity 2 detected Apr 21, 2015 1:33:49 GMT -8 Select Post Deselect Post Link to Post Member Give Gift Back to Top Post by opaben on Apr 21, 2015 1:33:49 GMT -8 Thanks Quads, I have fully read your post. I must add that I did run CCleaner and Malwarebytes, latest versions. I also use JV16 to keep the register updated. Nothing helped however.
	Last Edit: Apr 21, 2015 4:19:54 GMT -8 by opaben

Quads
Malware Removalists

In New Zealand

Posts: 9,387

[ti]SOLVED[/ti]System infected : fake plugin activity 2 detected Apr 21, 2015 11:23:22 GMT -8

Post by Quads on Apr 21, 2015 11:23:22 GMT -8

Read Slowly and all of it.

Please download www.bleepingcomputer.com/download/farbar-recovery-scan-tool/ You need to download the 32 bit version.

Place FRST.exe onto your desktop from where ever it downloaded to.

Start FRST that is on your Desktop

The tool will start to run.
When the tool opens click Yes to disclaimer. (if it does)

Press Scan button.

It will make a logs (FRST.txt and addition.txt) on your Desktop Please attach the log in your reply back. Or open the logs in notepad and copy the logs and paste back in a message as a reply.

IF ADDITION.txt does not want to upload

go to Wikisend wikisend.com/ OR go to pastebin.com

and upload the addition.txt there, then post the download link back in a message

Quads

opaben
New Helpee

Posts: 9

[ti]SOLVED[/ti]System infected : fake plugin activity 2 detected Apr 22, 2015 2:45:19 GMT -8

Post by opaben on Apr 22, 2015 2:45:19 GMT -8

Thanks Quads,

wikisend downloadlink addition.txt: wikisend.com/download/164174/Addition.txt or the forumlink: Addition.txt

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 20-04-2015
Ran by Bens (administrator) on BENS-PC on 22-04-2015 12:35:26
Running from C:\Users\Bens\Downloads\FRST-OlderVersion\FRST-OlderVersion
Loaded Profiles: Bens (Available profiles: Bens)
Platform: Microsoft Windows 7 Professional Service Pack 1 (X86) OS Language: Nederlands (Nederland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Logitech Inc.) C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Google Inc.) C:\Program Files\Google\Update\1.3.26.9\GoogleCrashHandler.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Update Core\NvBackend.exe
(Hola Networks Ltd.) C:\Program Files\Hola\app\hola_svc.exe
(Hola Networks Ltd.) C:\Program Files\Hola\app\hola_updater.exe
(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe
(Symantec Corporation) C:\Program Files\Norton 360\Engine\21.7.0.11\n360.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(DEVGURU Co., LTD.) C:\Program Files\Samsung\USB Drivers\25_escape\conn\ss_conn_service.exe
(StarWind Software) C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
(TomTom) C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe
(Company) C:\Program Files\Popcorn Time\Updater.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Symantec Corporation) C:\Program Files\Norton 360\Engine\21.7.0.11\n360.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Nero AG) C:\Program Files\Nero\Update\NASvc.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [] => [X]
HKLM\...\Run: [NvBackend] => C:\Program Files\NVIDIA Corporation\Update Core\NvBackend.exe [2403104 2014-07-25] (NVIDIA Corporation)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [335232 2015-04-10] (Oracle Corporation)
HKU\S-1-5-21-1327697534-1420294755-2536658182-1001\...\Run: [Google Update] => C:\Users\Bens\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2014-04-27] (Google Inc.)
HKU\S-1-5-21-1327697534-1420294755-2536658182-1001\...\Run: [OfficeSyncProcess] => C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE [720064 2014-10-14] (Microsoft Corporation)
HKU\S-1-5-21-1327697534-1420294755-2536658182-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner.exe [5529880 2015-03-13] (Piriform Ltd)
HKU\S-1-5-21-1327697534-1420294755-2536658182-1001\...\Policies\Explorer: [NofolderOptions] 0
HKU\S-1-5-21-1327697534-1420294755-2536658182-1001\...\MountPoints2: {2cd1b334-c006-11e3-b413-806e6f6e6963} - F:\sources\sperr32.exe x64
Startup: C:\Users\Bens\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Schermopname en Snel starten.lnk [2014-04-13]
ShortcutTarget: OneNote 2010 Schermopname en Snel starten.lnk -> C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation)
ShellIconOverlayIdentifiers: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Bens\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-04-02] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Bens\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-04-02] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Bens\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-04-02] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Bens\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-04-02] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Bens\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-04-02] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Bens\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-04-02] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Bens\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-04-02] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Bens\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-04-02] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [OverlayExcluded] -> {4433A54A-1AC8-432F-90FC-85F045CF383C} => C:\Program Files\Norton 360\Engine\21.7.0.11\buShell.dll [2015-03-07] (Symantec Corporation)
ShellIconOverlayIdentifiers: [OverlayPending] -> {F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225} => C:\Program Files\Norton 360\Engine\21.7.0.11\buShell.dll [2015-03-07] (Symantec Corporation)
ShellIconOverlayIdentifiers: [OverlayProtected] -> {476D0EA3-80F9-48B5-B70B-05E677C9C148} => C:\Program Files\Norton 360\Engine\21.7.0.11\buShell.dll [2015-03-07] (Symantec Corporation)
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
HKU\S-1-5-21-1327697534-1420294755-2536658182-1001\Software\Microsoft\Internet Explorer\Main,Start Page = msn.com/
HKU\S-1-5-21-1327697534-1420294755-2536658182-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = nl.msn.com/?ocid=iehp
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-09-23] (Adobe Systems Incorporated)
BHO: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files\Norton 360\Engine\21.7.0.11\coIEPlg.dll [2015-03-05] (Symantec Corporation)
BHO: Norton Vulnerability Protection -> {6D53EC84-6AAE-4787-AEEE-F4628F01010C} -> C:\Program Files\Norton 360\Engine\21.7.0.11\IPS\IPSBHO.DLL [2015-03-05] (Symantec Corporation)
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_45\bin\ssv.dll [2015-04-21] (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-04-21] (Oracle Corporation)
Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360\Engine\21.7.0.11\coIEPlg.dll [2015-03-05] (Symantec Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 212.54.44.54 212.54.40.25

FireFox:
========
FF ProfilePath: C:\Users\Bens\AppData\Roaming\Mozilla\Firefox\Profiles\7t9mcwh0.default-1429611296416
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_17_0_0_169.dll [2015-04-14] ()
FF Plugin: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-04-21] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-04-21] (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin: @nvidia.com/3DVision -> C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll [2015-02-04] (NVIDIA Corporation)
FF Plugin: @nvidia.com/3DVisionStreaming -> C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2015-02-04] (NVIDIA Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-04-21] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-04-21] (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.1.3 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-07-23] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-07-23] (VideoLAN)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-1327697534-1420294755-2536658182-1001: @fuze.com/Fuze,platform=x86,version=15.02.11674.0 -> C:\Users\Bens\AppData\Local\FuzeBox\Fuze\npfuzex86.dll [2015-02-11] (FuzeBox)
FF Plugin HKU\S-1-5-21-1327697534-1420294755-2536658182-1001: @hola.org/vlc,version=1.6.520 -> C:\Users\Bens\AppData\Local\Hola\firefox\app\vlc [2015-02-03] ()
FF Plugin HKU\S-1-5-21-1327697534-1420294755-2536658182-1001: @skype Limited.com/Facebook Video Calling Plugin -> C:\Users\Bens\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll [2014-07-24] (Skype Limited)
FF Plugin HKU\S-1-5-21-1327697534-1420294755-2536658182-1001: @talk.google.com/GoogleTalkPlugin -> C:\Users\Bens\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll [2015-04-17] (Google)
FF Plugin HKU\S-1-5-21-1327697534-1420294755-2536658182-1001: @talk.google.com/O1DPlugin -> C:\Users\Bens\AppData\Roaming\Mozilla\plugins\npo1d.dll [2015-04-17] (Google)
FF Plugin HKU\S-1-5-21-1327697534-1420294755-2536658182-1001: @tools.google.com/Google Update;version=3 -> C:\Users\Bens\AppData\Local\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-21] (Google Inc.)
FF Plugin HKU\S-1-5-21-1327697534-1420294755-2536658182-1001: @tools.google.com/Google Update;version=9 -> C:\Users\Bens\AppData\Local\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-21] (Google Inc.)
FF Plugin ProgramFiles/Appdata: C:\Users\Bens\AppData\Roaming\mozilla\plugins\npgoogletalk.dll [2015-04-17] (Google)
FF Plugin ProgramFiles/Appdata: C:\Users\Bens\AppData\Roaming\mozilla\plugins\npo1d.dll [2015-04-17] (Google)
FF HKLM\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.5.0.19\coFFPlgn
FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.5.0.19\coFFPlgn [2015-04-22]

Chrome:
=======
CHR Profile: C:\Users\Bens\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Slides) - C:\Users\Bens\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-04-21]
CHR Extension: (Google Docs) - C:\Users\Bens\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-04-21]
CHR Extension: (Google Drive) - C:\Users\Bens\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-04-21]
CHR Extension: (YouTube) - C:\Users\Bens\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-04-21]
CHR Extension: (Google Search) - C:\Users\Bens\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-04-21]
CHR Extension: (Google Sheets) - C:\Users\Bens\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-04-21]
CHR Extension: (Norton Identity Safe) - C:\Users\Bens\AppData\Local\Google\Chrome\User Data\Default\Extensions\iikflkcanblccfahdhdonehdalibjnif [2015-04-21]
CHR Extension: (Norton Security Toolbar) - C:\Users\Bens\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk [2015-04-21]
CHR Extension: (Google Wallet) - C:\Users\Bens\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-04-21]
CHR Extension: (Gmail) - C:\Users\Bens\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-04-21]
CHR HKLM\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - clients2.google.com/service/update2/crx
CHR HKLM\...\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files\Norton 360\Engine\21.7.0.11\Exts\Chrome.crx [2015-04-14]

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S2 AxAutoMntSrv; C:\Program Files\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe [75624 2012-01-05] (Alcohol Soft Development Team)
R2 hola_svc; C:\Program Files\Hola\app\hola_svc.exe [6653928 2015-01-05] (Hola Networks Ltd.)
R2 hola_updater; C:\Program Files\Hola\app\hola_updater.exe [6653928 2015-01-05] (Hola Networks Ltd.)
R2 LightScribeService; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [73728 2011-03-04] (Hewlett-Packard Company) [File not signed]
S2 MBAMService; C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe [1080120 2015-03-17] (Malwarebytes Corporation)
R2 N360; C:\Program Files\Norton 360\Engine\21.7.0.11\N360.exe [265000 2015-03-07] (Symantec Corporation)
R2 NAUpdate; C:\Program Files\Nero\Update\NASvc.exe [773968 2014-01-27] (Nero AG)
R2 NvNetworkService; C:\Program Files\NVIDIA Corporation\NetService\NvNetworkService.exe [1720608 2014-07-25] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [17536800 2014-07-25] (NVIDIA Corporation)
R2 ss_conn_service; C:\Program Files\Samsung\USB Drivers\25_escape\conn\ss_conn_service.exe [743688 2014-10-13] (DEVGURU Co., LTD.)
R2 StarWindServiceAE; C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe [370688 2009-12-23] (StarWind Software) [File not signed]
R2 UMVPFSrv; C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe [450848 2012-01-18] (Logitech Inc.)
R2 Update service; C:\Program Files\Popcorn Time\Updater.exe [335360 2014-12-08] (Company) [File not signed]
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-27] (Microsoft Corporation)
S2 22c5205d; "C:\Windows\system32\rundll32.exe" "c:\Program Files\VideoCnv\Zet.dll",serv

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R1 AsIO; C:\Windows\System32\drivers\AsIO.sys [12400 2007-12-17] ()
R1 BHDrvx86; C:\Program Files\Norton 360\NortonData\21.5.0.19\Definitions\BASHDefs\20150408.001\BHDrvx86.sys [1172184 2015-04-08] (Symantec Corporation)
S3 BlueletAudio; C:\Windows\System32\DRIVERS\blueletaudio.sys [20480 2005-05-31] (IVT Corporation) [File not signed]
S3 BT; C:\Windows\System32\DRIVERS\btnetdrv.sys [10804 2005-04-30] (IVT Corporation) [File not signed]
S3 Btcsrusb; C:\Windows\System32\Drivers\btcusb.sys [23000 2005-05-31] (IVT Corporation) [File not signed]
S3 BTHidEnum; C:\Windows\System32\DRIVERS\vbtenum.sys [11860 2005-04-30] () [File not signed]
R0 BTHidMgr; C:\Windows\System32\Drivers\BTHidMgr.sys [28271 2005-04-30] (IVT Corporation) [File not signed]
R1 ccSet_N360; C:\Windows\system32\drivers\N360\1507000.00B\ccSetx86.sys [127064 2014-02-21] (Symantec Corporation)
R1 eeCtrl; C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [378672 2015-02-10] (Symantec Corporation)
R1 ElbyCDIO; C:\Windows\System32\Drivers\ElbyCDIO.sys [30616 2013-02-25] (Elaborate Bytes AG)
R3 EraserUtilRebootDrv; C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [111408 2015-04-14] (Symantec Corporation)
R1 IDSVix86; C:\Program Files\Norton 360\NortonData\21.5.0.19\Definitions\IPSDefs\20150420.001\IDSvix86.sys [505048 2015-04-13] (Symantec Corporation)
R3 LUsbFilt; C:\Windows\System32\Drivers\LUsbFilt.Sys [28944 2008-02-29] (Logitech, Inc.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2015-03-17] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2015-03-17] (Malwarebytes Corporation)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [6504 2009-05-13] ()
R3 NAVENG; C:\Program Files\Norton 360\NortonData\21.5.0.19\Definitions\VirusDefs\20150420.041\NAVENG.SYS [95704 2015-04-14] (Symantec Corporation)
R3 NAVEX15; C:\Program Files\Norton 360\NortonData\21.5.0.19\Definitions\VirusDefs\20150420.041\NAVEX15.SYS [1636696 2015-04-14] (Symantec Corporation)
R3 netr28u; C:\Windows\System32\DRIVERS\netr28u.sys [657408 2009-07-14] (Ralink Technology Corp.)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19232 2014-07-25] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad32v.sys [34080 2014-03-31] (NVIDIA Corporation)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [320120 2014-04-10] (Duplex Secure Ltd.)
R1 SRTSP; C:\Windows\System32\Drivers\N360\1507000.00B\SRTSP.SYS [664792 2014-08-26] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\N360\1507000.00B\SRTSPX.SYS [32984 2014-08-26] (Symantec Corporation)
R0 SymDS; C:\Windows\System32\drivers\N360\1507000.00B\SYMDS.SYS [367704 2014-07-23] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\N360\1507000.00B\SYMEFA.SYS [936152 2014-07-23] (Symantec Corporation)
R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT.SYS [142936 2014-04-09] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\N360\1507000.00B\Ironx86.SYS [209624 2014-08-06] (Symantec Corporation)
R1 SymNetS; C:\Windows\System32\Drivers\N360\1507000.00B\SYMNETS.SYS [447704 2014-07-23] (Symantec Corporation)
S3 VComm; C:\Windows\System32\DRIVERS\VComm.sys [61312 2004-10-19] (IVT Corporation) [File not signed]
S3 VcommMgr; C:\Windows\System32\Drivers\VcommMgr.sys [82148 2005-03-25] (IVT Corporation) [File not signed]
U3 auigtn2b; C:\Windows\system32\Drivers\auigtn2b.sys [0 ] (Advanced Micro Devices) <==== ATTENTION (zero size file/folder)
S2 ASPI32; No ImagePath

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)

==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-22 12:20 - 2015-04-22 12:31 - 00000000 ____D () C:\Users\Bens\Downloads\FRST-OlderVersion
2015-04-21 14:57 - 2015-04-21 15:38 - 00000000 ____D () C:\Users\Bens\.HelloNzb
2015-04-21 14:46 - 2015-04-21 14:46 - 00000000 ____D () C:\Users\Bens\AppData\Roaming\Andy
2015-04-21 14:46 - 2015-04-21 14:46 - 00000000 ____D () C:\Users\Bens\Andy
2015-04-21 14:40 - 2015-04-21 14:40 - 00000000 ____D () C:\ProgramData\Sun
2015-04-21 14:40 - 2015-04-21 14:40 - 00000000 ____D () C:\Program Files\Common Files\Java
2015-04-21 14:40 - 2015-04-21 14:39 - 00096680 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2015-04-21 14:39 - 2015-04-21 14:43 - 00000000 ____D () C:\ProgramData\Oracle
2015-04-21 14:39 - 2015-04-21 14:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2015-04-21 14:39 - 2015-04-21 14:39 - 00000000 ____D () C:\Program Files\Java
2015-04-21 14:36 - 2015-04-21 14:36 - 04188115 _____ () C:\Users\Bens\Downloads\HelloNzb.exe
2015-04-21 12:18 - 2015-04-21 12:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-04-21 12:17 - 2015-04-22 12:22 - 00001040 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-04-21 12:17 - 2015-04-22 12:22 - 00001036 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-04-21 12:12 - 2015-04-21 12:12 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2015-04-20 15:34 - 2014-05-08 11:06 - 02742784 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2015-04-20 15:34 - 2014-05-08 11:06 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\RdpGroupPolicyExtension.dll
2015-04-20 12:17 - 2015-04-22 12:35 - 00000000 ____D () C:\FRST
2015-04-20 10:18 - 2013-10-02 02:42 - 00049152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\TsUsbFlt.sys
2015-04-20 10:18 - 2013-10-02 02:32 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyControl.exe
2015-04-20 10:18 - 2013-10-02 02:30 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyExtension.dll
2015-04-20 10:18 - 2013-10-02 02:14 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\MsRdpWebAccess.dll
2015-04-20 10:18 - 2013-10-02 02:14 - 00017920 _____ (Microsoft Corporation) C:\Windows\system32\wksprtPS.dll
2015-04-20 10:18 - 2013-10-02 01:58 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll
2015-04-20 10:18 - 2013-10-02 01:45 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbGDCoInstaller.dll
2015-04-20 10:18 - 2013-10-02 01:08 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\rdvidcrl.dll
2015-04-20 10:18 - 2013-10-02 01:00 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2015-04-20 10:18 - 2013-10-02 00:53 - 00350208 _____ (Microsoft Corporation) C:\Windows\system32\wksprt.exe
2015-04-20 10:18 - 2013-10-02 00:34 - 01068544 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe
2015-04-20 10:18 - 2013-10-01 22:55 - 05698048 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2015-04-20 10:18 - 2012-08-23 16:48 - 00221184 _____ (Microsoft Corporation) C:\Windows\system32\rdpudd.dll
2015-04-20 10:18 - 2012-08-23 16:44 - 00014848 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpvideominiport.sys
2015-04-20 10:18 - 2012-08-23 13:12 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\rdpendp_winip.dll
2015-04-20 10:15 - 2015-02-04 01:57 - 00606920 _____ (NVIDIA Corporation) C:\Windows\system32\nvStreaming.exe
2015-04-20 06:57 - 2015-04-20 06:57 - 00000000 ____D () C:\Users\Bens\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Andy
2015-04-20 06:56 - 2015-04-20 08:58 - 00000000 ____D () C:\Users\Bens\VirtualBox VMs
2015-04-19 20:59 - 2015-04-19 20:59 - 00000000 ____D () C:\NVIDIA
2015-04-19 20:52 - 2015-04-20 06:57 - 00000000 ____D () C:\Users\Bens\.VirtualBox
2015-04-19 20:40 - 2014-11-21 15:16 - 00744520 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxDrv.sys
2015-04-19 20:40 - 2014-11-21 15:16 - 00104384 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxUSBMon.sys
2015-04-19 20:39 - 2015-04-19 20:39 - 00000000 ____D () C:\Users\Bens\.android
2015-04-19 20:39 - 2015-04-19 20:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Andy
2015-04-19 20:38 - 2015-04-19 20:38 - 00642316 _____ () C:\ProgramData\AndyDrivers.zip
2015-04-19 20:38 - 2015-04-19 20:38 - 00000000 ____D () C:\Program Files\AndyOfflineInstaller43
2015-04-19 20:37 - 2015-04-19 20:52 - 00000000 ____D () C:\Program Files\Andy
2015-04-19 20:37 - 2015-04-19 20:37 - 00000003 _____ () C:\Users\Bens\Downloads\tmp.txt
2015-04-17 21:11 - 2014-10-13 07:57 - 00184192 _____ (DEVGURU Co., LTD.(www.devguru.co.kr)) C:\Windows\system32\Drivers\ssudmdm.sys
2015-04-17 21:11 - 2014-10-13 07:57 - 00089856 _____ (DEVGURU Co., LTD.(www.devguru.co.kr)) C:\Windows\system32\Drivers\ssudbus.sys
2015-04-17 14:43 - 2015-04-22 12:15 - 00003115 _____ () C:\Windows\setupact.log
2015-04-17 14:43 - 2015-04-20 11:33 - 00005414 _____ () C:\Windows\PFRO.log
2015-04-17 14:43 - 2015-04-17 14:43 - 00000000 _____ () C:\Windows\setuperr.log
2015-04-17 12:09 - 2015-04-17 12:09 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-04-17 12:07 - 2015-04-17 12:07 - 00001080 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2015-04-17 12:07 - 2015-04-17 12:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-04-17 12:07 - 2015-04-17 12:07 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-04-17 12:07 - 2015-04-17 12:07 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware
2015-04-17 12:07 - 2015-03-17 06:15 - 00092888 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-04-17 12:07 - 2015-03-17 06:15 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-04-17 12:07 - 2015-03-17 06:15 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-04-15 16:57 - 2015-04-17 13:53 - 00000000 ____D () C:\Program Files\compaareiNNbbuy
2015-04-15 16:57 - 2015-04-15 16:57 - 00000000 ____D () C:\Program Files\Keep Last Two Tabs
2015-04-15 16:57 - 2015-04-15 16:57 - 00000000 ____D () C:\Program Files\compareEnbuy
2015-04-15 15:52 - 2015-04-15 16:07 - 00000000 ____D () C:\ProgramData\clone.AD
2015-04-15 15:52 - 2015-04-15 15:52 - 00000000 ____D () C:\Users\Bens\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VobSub
2015-04-15 15:52 - 2015-04-15 15:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VobSub
2015-04-15 15:52 - 2015-04-15 15:52 - 00000000 ____D () C:\Program Files\VobSub
2015-04-15 15:50 - 2015-04-15 15:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Xvid
2015-04-15 15:50 - 2015-04-15 15:50 - 00000000 ____D () C:\Program Files\Xvid
2015-04-15 15:50 - 2015-04-15 15:50 - 00000000 ____D () C:\Program Files\Gabest
2015-04-15 15:50 - 2009-06-07 16:25 - 00077824 _____ () C:\Windows\system32\xvid.ax
2015-04-15 15:50 - 2009-06-07 16:24 - 00180224 _____ () C:\Windows\system32\xvidvfw.dll
2015-04-15 15:50 - 2009-06-07 16:16 - 00819200 _____ () C:\Windows\system32\xvidcore.dll
2015-04-15 15:49 - 2015-04-15 15:49 - 00001964 _____ () C:\Users\Bens\Desktop\avi.NET.lnk
2015-04-15 15:49 - 2015-04-15 15:49 - 00000000 ____D () C:\Users\Bens\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\clone.AD
2015-04-15 15:49 - 2015-04-15 15:49 - 00000000 ____D () C:\Program Files\clone.AD
2015-04-15 15:48 - 2015-04-15 15:48 - 00000000 ____D () C:\Users\Bens\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AviSynth 2.5
2015-04-15 15:48 - 2015-04-15 15:48 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AviSynth 2.5
2015-04-15 15:48 - 2015-04-15 15:48 - 00000000 ____D () C:\Program Files\AviSynth 2.5
2015-04-15 15:45 - 2015-04-15 15:45 - 00000000 ____D () C:\Users\Bens\Downloads\avi.NET.3510
2015-04-15 15:14 - 2015-02-26 05:11 - 02381312 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-04-15 10:50 - 2015-04-15 10:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2015-04-15 08:51 - 2015-04-15 08:56 - 00000000 ___SD () C:\Windows\system32\GWX
2015-04-15 08:49 - 2015-04-17 13:53 - 00000000 ____D () C:\Program Files\joianoThheashop
2015-04-15 08:49 - 2015-04-15 08:49 - 00000000 ____D () C:\Program Files\WasteNoTime
2015-04-15 08:49 - 2015-04-15 08:49 - 00000000 ____D () C:\Program Files\bigdeaLa
2015-04-15 08:48 - 2015-04-17 13:53 - 00000000 ____D () C:\Program Files\browsse2bbuy
2015-04-14 22:21 - 2015-04-14 22:21 - 00000000 ___RD () C:\Program Files\Skype
2015-04-14 22:21 - 2015-04-14 22:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2015-04-14 22:21 - 2015-04-14 22:21 - 00000000 ____D () C:\Program Files\Common Files\Skype
2015-04-14 22:19 - 2015-03-23 05:06 - 00860160 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-04-14 22:19 - 2015-03-23 05:06 - 00630784 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-04-14 22:19 - 2015-03-23 05:06 - 00576000 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-04-14 22:19 - 2015-03-23 05:06 - 00331264 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-04-14 22:19 - 2015-03-23 05:06 - 00202752 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-04-14 22:19 - 2015-03-23 05:06 - 00159744 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2015-04-14 22:19 - 2015-03-23 05:06 - 00026112 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2015-04-14 22:19 - 2015-03-23 04:59 - 00896000 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-04-14 22:19 - 2015-03-17 07:01 - 03976632 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2015-04-14 22:19 - 2015-03-17 07:01 - 03920824 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-04-14 22:19 - 2015-03-17 07:01 - 00137656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-04-14 22:19 - 2015-03-17 07:01 - 00067512 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-04-14 22:19 - 2015-03-17 06:59 - 01306112 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-04-14 22:19 - 2015-03-17 06:57 - 01061376 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-04-14 22:19 - 2015-03-17 06:57 - 00550912 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-04-14 22:19 - 2015-03-17 06:57 - 00400896 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-04-14 22:19 - 2015-03-17 06:57 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-04-14 22:19 - 2015-03-17 06:57 - 00248832 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-04-14 22:19 - 2015-03-17 06:57 - 00221184 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-04-14 22:19 - 2015-03-17 06:57 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-04-14 22:19 - 2015-03-17 06:57 - 00100352 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-04-14 22:19 - 2015-03-17 06:57 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-04-14 22:19 - 2015-03-17 06:57 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-04-14 22:19 - 2015-03-17 06:57 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-04-14 22:19 - 2015-03-17 06:57 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-04-14 22:19 - 2015-03-17 06:56 - 00262656 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-04-14 22:19 - 2015-03-17 06:56 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-04-14 22:19 - 2015-03-17 06:56 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-04-14 22:19 - 2015-03-17 06:56 - 00038912 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-04-14 22:19 - 2015-03-17 06:56 - 00022528 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-04-14 22:19 - 2015-03-17 06:56 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-04-14 22:19 - 2015-03-17 06:53 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-04-14 22:19 - 2015-03-17 06:53 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-04-14 22:19 - 2015-03-17 06:50 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-04-14 22:19 - 2015-03-17 06:50 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-04-14 22:19 - 2015-03-04 06:16 - 00249784 _____ (Microsoft Corporation) C:\Windows\system32\clfs.sys
2015-04-14 22:19 - 2015-03-04 06:10 - 00058880 _____ (Microsoft Corporation) C:\Windows\system32\clfsw32.dll
2015-04-14 22:19 - 2015-02-03 05:12 - 01230848 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2015-04-14 22:19 - 2015-01-17 04:30 - 00828928 _____ (Microsoft Corporation) C:\Windows\system32\msctf.dll
2015-04-14 22:18 - 2015-04-02 01:49 - 00342704 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-04-14 22:18 - 2015-03-25 05:00 - 03088384 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2015-04-14 22:18 - 2015-03-25 05:00 - 02020864 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2015-04-14 22:18 - 2015-03-25 05:00 - 00566784 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2015-04-14 22:18 - 2015-03-25 05:00 - 00173056 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2015-04-14 22:18 - 2015-03-25 05:00 - 00131584 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2015-04-14 22:18 - 2015-03-25 05:00 - 00092672 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2015-04-14 22:18 - 2015-03-25 05:00 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2015-04-14 22:18 - 2015-03-25 05:00 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2015-04-14 22:18 - 2015-03-25 05:00 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2015-04-14 22:18 - 2015-03-25 05:00 - 00029696 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2015-04-14 22:18 - 2015-03-25 05:00 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\wu.upgrade.ps.dll
2015-04-14 22:18 - 2015-03-13 05:42 - 19695616 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-04-14 22:18 - 2015-03-13 05:42 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-04-14 22:18 - 2015-03-13 05:42 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-04-14 22:18 - 2015-03-13 05:28 - 00503296 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-04-14 22:18 - 2015-03-13 05:28 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-04-14 22:18 - 2015-03-13 05:27 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-04-14 22:18 - 2015-03-13 05:27 - 00047616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-04-14 22:18 - 2015-03-13 05:26 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-04-14 22:18 - 2015-03-13 05:22 - 02278400 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-04-14 22:18 - 2015-03-13 05:20 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-04-14 22:18 - 2015-03-13 05:20 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-04-14 22:18 - 2015-03-13 05:17 - 00478208 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-04-14 22:18 - 2015-03-13 05:16 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-04-14 22:18 - 2015-03-13 05:16 - 00102912 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-04-14 22:18 - 2015-03-13 05:15 - 00620032 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-04-14 22:18 - 2015-03-13 05:09 - 00667648 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-04-14 22:18 - 2015-03-13 05:06 - 00418304 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-04-14 22:18 - 2015-03-13 05:01 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-04-14 22:18 - 2015-03-13 04:57 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-04-14 22:18 - 2015-03-13 04:56 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-04-14 22:18 - 2015-03-13 04:54 - 00285696 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-04-14 22:18 - 2015-03-13 04:49 - 04305408 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-04-14 22:18 - 2015-03-13 04:44 - 00689152 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-04-14 22:18 - 2015-03-13 04:43 - 02052608 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-04-14 22:18 - 2015-03-13 04:43 - 00685568 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-04-14 22:18 - 2015-03-13 04:42 - 01155072 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-04-14 22:18 - 2015-03-13 04:34 - 12825600 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-04-14 22:18 - 2015-03-13 04:20 - 01888256 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-04-14 22:18 - 2015-03-13 04:16 - 01311232 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-04-14 22:18 - 2015-03-13 04:14 - 00710144 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-04-14 22:18 - 2015-03-05 06:06 - 00305152 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2015-04-14 22:18 - 2015-02-13 07:26 - 12875264 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2015-04-14 22:17 - 2015-02-25 05:03 - 00514560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\http.sys
2015-04-14 22:17 - 2015-02-20 06:13 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2015-04-14 22:17 - 2015-02-20 06:13 - 00034304 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2015-04-14 22:17 - 2015-02-20 06:13 - 00026624 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2015-04-14 22:17 - 2015-02-20 06:13 - 00010240 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2015-04-14 22:17 - 2015-02-20 05:09 - 00299008 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2015-04-14 22:17 - 2015-02-04 04:54 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2015-04-14 22:17 - 2015-02-03 05:16 - 00078784 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mountmgr.sys
2015-04-14 22:17 - 2015-02-03 05:12 - 11411968 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2015-04-14 22:17 - 2015-02-03 05:12 - 03209728 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll
2015-04-14 22:17 - 2015-02-03 05:12 - 01329664 _____ (Microsoft Corporation) C:\Windows\system32\quartz.dll
2015-04-14 22:17 - 2015-02-03 05:12 - 01174528 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2015-04-14 22:17 - 2015-02-03 05:12 - 01005056 _____ (Microsoft Corporation) C:\Windows\system32\cryptui.dll
2015-04-14 22:17 - 2015-02-03 05:12 - 00988160 _____ (Microsoft Corporation) C:\Windows\system32\drmv2clt.dll
2015-04-14 22:17 - 2015-02-03 05:12 - 00744960 _____ (Microsoft Corporation) C:\Windows\system32\blackbox.dll
2015-04-14 22:17 - 2015-02-03 05:12 - 00617984 _____ (Microsoft Corporation) C:\Windows\system32\wmdrmsdk.dll
2015-04-14 22:17 - 2015-02-03 05:12 - 00519680 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2015-04-14 22:17 - 2015-02-03 05:12 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msscp.dll
2015-04-14 22:17 - 2015-02-03 05:12 - 00489984 _____ (Microsoft Corporation) C:\Windows\system32\evr.dll
2015-04-14 22:17 - 2015-02-03 05:12 - 00475136 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2015-04-14 22:17 - 2015-02-03 05:12 - 00442880 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll
2015-04-14 22:17 - 2015-02-03 05:12 - 00406016 _____ (Microsoft Corporation) C:\Windows\system32\drmmgrtn.dll
2015-04-14 22:17 - 2015-02-03 05:12 - 00374784 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll
2015-04-14 22:17 - 2015-02-03 05:12 - 00354816 _____ (Microsoft Corporation) C:\Windows\system32\mfplat.dll
2015-04-14 22:17 - 2015-02-03 05:12 - 00275968 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll
2015-04-14 22:17 - 2015-02-03 05:12 - 00265216 _____ (Microsoft Corporation) C:\Windows\system32\msnetobj.dll
2015-04-14 22:17 - 2015-02-03 05:12 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll
2015-04-14 22:17 - 2015-02-03 05:12 - 00179200 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2015-04-14 22:17 - 2015-02-03 05:12 - 00171520 _____ (Microsoft Corporation) C:\Windows\system32\ubpm.dll
2015-04-14 22:17 - 2015-02-03 05:12 - 00157184 _____ (Microsoft Corporation) C:\Windows\system32\pcasvc.dll
2015-04-14 22:17 - 2015-02-03 05:12 - 00143872 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2015-04-14 22:17 - 2015-02-03 05:12 - 00103936 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2015-04-14 22:17 - 2015-02-03 05:12 - 00103424 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll
2015-04-14 22:17 - 2015-02-03 05:12 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\cryptsp.dll
2015-04-14 22:17 - 2015-02-03 05:12 - 00050688 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
2015-04-14 22:17 - 2015-02-03 05:12 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
2015-04-14 22:17 - 2015-02-03 05:12 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\pcadm.dll
2015-04-14 22:17 - 2015-02-03 05:12 - 00027648 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
2015-04-14 22:17 - 2015-02-03 05:12 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\msmmsp.dll
2015-04-14 22:17 - 2015-02-03 05:12 - 00008192 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll
2015-04-14 22:17 - 2015-02-03 05:12 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx
2015-04-14 22:17 - 2015-02-03 05:12 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll
2015-04-14 22:17 - 2015-02-03 05:11 - 12625408 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2015-04-14 22:17 - 2015-02-03 05:11 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\audiodg.exe
2015-04-14 22:17 - 2015-02-03 05:11 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
2015-04-14 22:17 - 2015-02-03 05:11 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\rrinstaller.exe
2015-04-14 22:17 - 2015-02-03 05:11 - 00023040 _____ (Microsoft Corporation) C:\Windows\system32\mfpmp.exe
2015-04-14 22:17 - 2015-02-03 05:11 - 00016896 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
2015-04-14 22:17 - 2015-02-03 05:11 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\pcawrk.exe
2015-04-14 22:17 - 2015-02-03 05:11 - 00008192 _____ (Microsoft Corporation) C:\Windows\system32\pcalua.exe
2015-04-14 22:17 - 2015-02-03 05:10 - 00008704 _____ (Microsoft Corporation) C:\Windows\system32\pcaevts.dll
2015-04-14 22:17 - 2015-02-03 05:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\mferror.dll
2015-04-14 22:17 - 2015-02-03 05:00 - 00593920 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\PEAuth.sys
2015-04-14 22:17 - 2015-02-03 04:26 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
2015-04-14 22:17 - 2015-01-31 01:56 - 00370488 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2015-04-14 22:17 - 2014-11-01 00:22 - 00521384 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
2015-04-14 22:16 - 2015-03-10 05:08 - 01237504 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2015-04-14 22:16 - 2015-03-10 05:05 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2015-04-14 20:25 - 2015-04-17 09:26 - 00000020 _____ () C:\Users\Bens\AppData\Roaming\appdataFr3.bin
2015-04-14 20:14 - 2015-01-09 04:48 - 00635904 _____ (Microsoft Corporation) C:\Windows\system32\perftrack.dll
2015-04-14 20:14 - 2015-01-09 04:48 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\wdi.dll
2015-04-14 20:14 - 2015-01-09 04:48 - 00027136 _____ (Microsoft Corporation) C:\Windows\system32\powertracker.dll

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-22 12:28 - 2014-04-11 20:01 - 00000940 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-04-22 12:25 - 2014-04-27 00:10 - 00001062 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1327697534-1420294755-2536658182-1001UA.job
2015-04-22 12:25 - 2014-04-09 19:56 - 00000000 ____D () C:\Users\Bens\AppData\Roaming\Mozilla
2015-04-22 12:25 - 2014-04-09 18:47 - 01636473 _____ () C:\Windows\WindowsUpdate.log
2015-04-22 12:24 - 2009-07-14 06:34 - 00031104 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-04-22 12:24 - 2009-07-14 06:34 - 00031104 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-04-22 12:15 - 2014-04-10 12:38 - 00000000 ____D () C:\ProgramData\NVIDIA
2015-04-22 12:15 - 2014-04-09 19:55 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2015-04-22 12:15 - 2014-04-09 19:09 - 00000000 _____ () C:\Windows\system32\Drivers\lvuvc.hs
2015-04-22 12:15 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-04-21 16:24 - 2014-04-27 00:10 - 00001010 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1327697534-1420294755-2536658182-1001Core.job
2015-04-21 15:15 - 2014-04-10 19:40 - 00000000 ____D () C:\Users\Bens\Downloads\programmas
2015-04-21 14:57 - 2014-04-09 19:03 - 00000000 ____D () C:\Users\Bens
2015-04-21 14:42 - 2014-04-26 20:37 - 00000924 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1327697534-1420294755-2536658182-1001UA.job
2015-04-21 14:12 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\rescache
2015-04-20 13:42 - 2011-04-12 06:48 - 00745748 _____ () C:\Windows\system32\perfh013.dat
2015-04-20 13:42 - 2011-04-12 06:48 - 00153700 _____ () C:\Windows\system32\perfc013.dat
2015-04-20 13:42 - 2010-11-20 23:01 - 01670888 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-04-20 11:34 - 2009-07-14 04:37 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
2015-04-20 11:31 - 2011-04-12 06:47 - 00000000 ____D () C:\Windows\system32\Drivers\nl-NL
2015-04-20 11:31 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\nl-NL
2015-04-20 10:34 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\Microsoft.NET
2015-04-20 10:18 - 2014-04-09 19:09 - 00007519 _____ () C:\Windows\system32\lvcoinst.log
2015-04-20 10:16 - 2014-04-10 12:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
2015-04-20 10:15 - 2014-04-10 12:25 - 00000000 ____D () C:\Program Files\NVIDIA Corporation
2015-04-20 05:50 - 2014-04-27 00:03 - 00000000 ___RD () C:\Users\Bens\Dropbox
2015-04-20 05:50 - 2014-04-27 00:01 - 00000000 ____D () C:\Users\Bens\AppData\Roaming\Dropbox
2015-04-19 20:42 - 2014-04-26 20:37 - 00000902 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1327697534-1420294755-2536658182-1001Core.job
2015-04-17 13:53 - 2014-08-28 17:29 - 00000000 ____D () C:\Users\Bens\AppData\Roaming\systweak
2015-04-16 08:12 - 2009-07-14 06:33 - 00520496 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-04-15 16:57 - 2015-01-26 08:46 - 00000000 ____D () C:\ProgramData\9455899666934413749
2015-04-15 13:43 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\AppCompat
2015-04-15 10:56 - 2014-04-09 19:34 - 00000000 ____D () C:\Windows\Minidump
2015-04-15 10:50 - 2014-11-27 17:49 - 00000969 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2015-04-15 10:50 - 2014-11-27 17:49 - 00000000 ____D () C:\Program Files\CCleaner
2015-04-15 10:33 - 2015-02-24 20:18 - 00000000 ____D () C:\Program Files\cOmpaaRenbuY
2015-04-15 09:41 - 2014-04-13 18:52 - 00011980 _____ () C:\Users\Bens\Documents\meterstanden-eigenprogje.xlsx
2015-04-15 08:51 - 2014-12-10 17:29 - 00000000 ____D () C:\Windows\system32\appraiser
2015-04-15 08:51 - 2014-05-06 12:51 - 00000000 ___SD () C:\Windows\system32\CompatTel
2015-04-15 08:43 - 2014-04-09 23:20 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-04-15 08:28 - 2014-08-26 16:24 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton 360
2015-04-15 08:28 - 2014-04-09 19:13 - 00000000 ____D () C:\Windows\system32\Drivers\N360
2015-04-15 08:27 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\tracing
2015-04-14 22:30 - 2014-04-14 15:18 - 00000000 ____D () C:\Windows\system32\MRT
2015-04-14 22:21 - 2014-04-10 13:25 - 00002709 _____ () C:\Users\Public\Desktop\Skype.lnk
2015-04-14 22:21 - 2014-04-10 13:25 - 00000000 ____D () C:\ProgramData\Skype
2015-04-14 22:20 - 2009-07-14 04:04 - 00000478 _____ () C:\Windows\win.ini
2015-04-14 21:33 - 2014-04-10 17:03 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2015-04-14 21:33 - 2014-04-10 17:03 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2015-04-14 20:25 - 2014-12-12 10:16 - 00000000 ____D () C:\ProgramData\chepsales4all
2015-04-14 20:13 - 2014-04-27 00:03 - 00001013 _____ () C:\Users\Bens\Desktop\Dropbox.lnk
2015-04-14 20:13 - 2014-04-27 00:02 - 00000000 ____D () C:\Users\Bens\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-04-01 11:22 - 2014-04-14 15:18 - 125832184 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

==================== Files in the root of some directories =======

2014-04-10 08:33 - 2014-04-10 08:33 - 0000024 ___SH () C:\Users\Bens\AppData\Roaming\1D959CA221C7573.sys
2014-11-03 12:01 - 2014-11-03 12:01 - 0000004 _____ () C:\Users\Bens\AppData\Roaming\appdataFr2.bin
2015-04-14 20:25 - 2015-04-17 09:26 - 0000020 _____ () C:\Users\Bens\AppData\Roaming\appdataFr3.bin
2014-04-10 19:39 - 2014-04-10 19:39 - 0087608 _____ () C:\Users\Bens\AppData\Roaming\inst.exe
2014-04-10 19:39 - 2014-04-10 19:39 - 0007887 _____ () C:\Users\Bens\AppData\Roaming\pcouffin.cat
2014-04-10 19:39 - 2014-04-10 19:39 - 0001144 _____ () C:\Users\Bens\AppData\Roaming\pcouffin.inf
2014-04-10 19:39 - 2014-04-10 19:39 - 0000055 _____ () C:\Users\Bens\AppData\Roaming\pcouffin.log
2014-04-10 19:39 - 2014-04-10 19:39 - 0047360 _____ (VSO Software) C:\Users\Bens\AppData\Roaming\pcouffin.sys
2014-04-10 08:33 - 2014-04-10 08:33 - 0000024 ___SH () C:\Users\Bens\AppData\Roaming\System5908ConfigCollection.dat
2014-04-26 12:44 - 2014-04-26 12:44 - 0000022 ___SH () C:\Users\Bens\AppData\Roaming\System8638Conf Collection
2014-04-26 12:44 - 2014-04-26 12:44 - 0000022 ___SH () C:\Users\Bens\AppData\Roaming\Win3944_ConfigDB.dlx
2014-12-07 13:51 - 2014-12-07 13:51 - 0003584 _____ () C:\Users\Bens\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2015-04-19 20:09 - 2015-04-19 20:36 - 0000600 _____ () C:\Users\Bens\AppData\Local\PUTTY.RND
2014-05-11 20:01 - 2014-05-20 19:50 - 0000084 ___SH () C:\ProgramData\.zreglib
2014-05-30 20:16 - 2014-05-30 20:16 - 0000057 _____ () C:\ProgramData\Ament.ini
2015-04-19 20:38 - 2015-04-19 20:38 - 0642316 _____ () C:\ProgramData\AndyDrivers.zip

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2015-04-15 13:37

==================== End Of Log ============================

I had to switch off Norton 360's sonar alarm because it kept removing frst.exe

Hope you can make something of it, thanks again.

dbrisen
Malware Removalists

Posts: 3,688

[ti]SOLVED[/ti]System infected : fake plugin activity 2 detected Apr 24, 2015 8:41:08 GMT -8

Post by dbrisen on Apr 24, 2015 8:41:08 GMT -8

First, Some Uninstalls >>>>

Please go to START (Windows Orb) >> Control Panel >> Uninstall a Program or Programs and Features[/i][/b] and remove the following (if listed):

ClipCnv
compaareiNNbbuy
Hola™ 1.6.98 - Better Internet
Smart File Advisor 1.2.0
VideoCnv

To do so, left clicking on the name once and then click Uninstall/Change at the bar above the list window.

Follow the prompts of the uninstaller BUT please read carefully any questions it asks before answering; some uninstallers will try and deceive you into keeping the software.

Second, run the following FRST script >>>>

Open notepad. Please copy the contents of the quote box below. To do this highlight the contents of the box and right click on it and select copy. Paste this into the open notepad. Save it to your desktop as fixlist.txt

Start
CreateRestorePoint:
CloseProcesses:
HKLM\...\Run: [] => [X]
HKU\S-1-5-21-1327697534-1420294755-2536658182-1001\...\Policies\Explorer: [NofolderOptions] 0
HKU\S-1-5-21-1327697534-1420294755-2536658182-1001\...\MountPoints2: {2cd1b334-c006-11e3-b413-806e6f6e6963} - F:\sources\sperr32.exe x64
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin HKU\S-1-5-21-1327697534-1420294755-2536658182-1001: @hola.org/vlc,version=1.6.520 -> C:\Users\Bens\AppData\Local\Hola\firefox\app\vlc [2015-02-03] ()
CHR Extension: (Norton Identity Safe) - C:\Users\Bens\AppData\Local\Google\Chrome\User Data\Default\Extensions\iikflkcanblccfahdhdonehdalibjnif [2015-04-21]
CHR HKLM\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - clients2.google.com/service/update2/crx
R2 hola_svc; C:\Program Files\Hola\app\hola_svc.exe [6653928 2015-01-05] (Hola Networks Ltd.)
R2 hola_updater; C:\Program Files\Hola\app\hola_updater.exe [6653928 2015-01-05] (Hola Networks Ltd.)
S2 22c5205d; "C:\Windows\system32\rundll32.exe" "c:\Program Files\VideoCnv\Zet.dll",serv
U3 auigtn2b; C:\Windows\system32\Drivers\auigtn2b.sys [0 ] (Advanced Micro Devices) <==== ATTENTION (zero size file/folder)
S2 ASPI32; No ImagePath
2015-04-15 16:57 - 2015-04-17 13:53 - 00000000 ____D () C:\Program Files\compaareiNNbbuy
2015-04-15 16:57 - 2015-04-15 16:57 - 00000000 ____D () C:\Program Files\Keep Last Two Tabs
2015-04-15 16:57 - 2015-04-15 16:57 - 00000000 ____D () C:\Program Files\compareEnbuy
2015-04-15 08:49 - 2015-04-17 13:53 - 00000000 ____D () C:\Program Files\joianoThheashop
2015-04-15 08:49 - 2015-04-15 08:49 - 00000000 ____D () C:\Program Files\WasteNoTime
2015-04-15 08:49 - 2015-04-15 08:49 - 00000000 ____D () C:\Program Files\bigdeaLa
2015-04-15 08:48 - 2015-04-17 13:53 - 00000000 ____D () C:\Program Files\browsse2bbuy
2015-04-15 16:57 - 2015-01-26 08:46 - 00000000 ____D () C:\ProgramData\9455899666934413749
2015-04-15 10:33 - 2015-02-24 20:18 - 00000000 ____D () C:\Program Files\cOmpaaRenbuY
2015-04-14 20:25 - 2014-12-12 10:16 - 00000000 ____D () C:\ProgramData\chepsales4all
C:\Program Files\Hola
Task: {11F2E61C-9EC6-463F-A0C6-F761EC493583} - System32\Tasks\{1E036D3A-272F-4666-9902-6B6A6D4E52B0} => pcalua.exe -a "C:\Users\Bens\Downloads\avi.NET.3510\VobSub v2.2.3.exe" -d C:\Users\Bens\Downloads\avi.NET.3510
Task: {1CD61E5C-A846-4847-A286-6E87C4E1A730} - System32\Tasks\LaunchSignup => C:\Program Files\MyPC Backup\Signup Wizard.exe <==== ATTENTION
C:\Program Files\MyPC Backup
Task: {4078A13A-7A80-4687-9836-0296410C3D98} - System32\Tasks\AppCloudUpdater => C:\Users\Bens\AppData\Roaming\APPCLO~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: {69271D32-0283-4111-9EAB-EE4E0B810FBD} - System32\Tasks\{9DA8E150-706D-4A70-B524-73473A44DB39} => pcalua.exe -a G:\setup.exe -d G:\
Task: {9CD792FB-7C95-4AB7-ABE5-95B40C76E377} - System32\Tasks\{9C2DF5ED-90EB-4BDE-B36C-32868FAB40B7} => pcalua.exe -a C:\Medion\Setup.exe -d C:\Medion
Task: C:\Windows\Tasks\AppCloudUpdater.job => C:\Users\Bens\AppData\Roaming\APPCLO~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
C:\Users\Bens\AppData\Roaming\APPCLO~1
AlternateDataStreams: C:\Windows:31C7ED549BD4EC1D
AlternateDataStreams: C:\Windows\system32\msln.exe:659adf0548cd6caab6fc7dd29adfa2ef
IE trusted site: HKU\S-1-5-21-1327697534-1420294755-2536658182-1001\...\hola.org -> hxxp://hola.org
RemoveProxy:
Reboot:
end

NOTE. It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Start FRST that is on the desktop by right clicking on file and selecting "Run as Administrator..." and press the Fix button just once and wait.

If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.

Along with the Fixlog.txt log file, please tell me how the uninstalls went and how your system is running now.

I will not provide malware removal by PM; please post in your thread on the Malware Removal board.
My help is always free but if you would like to help encourage me or show your thanks -----> DONATE

opaben
New Helpee

Posts: 9

[ti]SOLVED[/ti]System infected : fake plugin activity 2 detected Apr 25, 2015 8:06:48 GMT -8

Post by opaben on Apr 25, 2015 8:06:48 GMT -8

thanks,
seems it is gone. I could remove 3 of the 4 programs, the 2 **Cnv said that the file could not be found.
Thanks again for your help.

the fixlog:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 24-04-2015
Ran by Bens at 2015-04-25 17:58:57 Run:1
Running from C:\Users\Bens\Downloads
Loaded Profiles: Bens (Available profiles: Bens)
Boot Mode: Normal

==============================================

Content of fixlist:
*****************
Start
CreateRestorePoint:
CloseProcesses:
HKLM\...\Run: [] => [X]
HKU\S-1-5-21-1327697534-1420294755-2536658182-1001\...\Policies\Explorer: [NofolderOptions] 0
HKU\S-1-5-21-1327697534-1420294755-2536658182-1001\...\MountPoints2: {2cd1b334-c006-11e3-b413-806e6f6e6963} - F:\sources\sperr32.exe x64
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin HKU\S-1-5-21-1327697534-1420294755-2536658182-1001: @hola.org/vlc,version=1.6.520 -> C:\Users\Bens\AppData\Local\Hola\firefox\app\vlc [2015-02-03] ()
CHR Extension: (Norton Identity Safe) - C:\Users\Bens\AppData\Local\Google\Chrome\User Data\Default\Extensions\iikflkcanblccfahdhdonehdalibjnif [2015-04-21]
CHR HKLM\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - clients2.google.com/service/update2/crx
R2 hola_svc; C:\Program Files\Hola\app\hola_svc.exe [6653928 2015-01-05] (Hola Networks Ltd.)
R2 hola_updater; C:\Program Files\Hola\app\hola_updater.exe [6653928 2015-01-05] (Hola Networks Ltd.)
S2 22c5205d; "C:\Windows\system32\rundll32.exe" "c:\Program Files\VideoCnv\Zet.dll",serv
U3 auigtn2b; C:\Windows\system32\Drivers\auigtn2b.sys [0 ] (Advanced Micro Devices) <==== ATTENTION (zero size file/folder)
S2 ASPI32; No ImagePath
2015-04-15 16:57 - 2015-04-17 13:53 - 00000000 ____D () C:\Program Files\compaareiNNbbuy
2015-04-15 16:57 - 2015-04-15 16:57 - 00000000 ____D () C:\Program Files\Keep Last Two Tabs
2015-04-15 16:57 - 2015-04-15 16:57 - 00000000 ____D () C:\Program Files\compareEnbuy
2015-04-15 08:49 - 2015-04-17 13:53 - 00000000 ____D () C:\Program Files\joianoThheashop
2015-04-15 08:49 - 2015-04-15 08:49 - 00000000 ____D () C:\Program Files\WasteNoTime
2015-04-15 08:49 - 2015-04-15 08:49 - 00000000 ____D () C:\Program Files\bigdeaLa
2015-04-15 08:48 - 2015-04-17 13:53 - 00000000 ____D () C:\Program Files\browsse2bbuy
2015-04-15 16:57 - 2015-01-26 08:46 - 00000000 ____D () C:\ProgramData\9455899666934413749
2015-04-15 10:33 - 2015-02-24 20:18 - 00000000 ____D () C:\Program Files\cOmpaaRenbuY
2015-04-14 20:25 - 2014-12-12 10:16 - 00000000 ____D () C:\ProgramData\chepsales4all
C:\Program Files\Hola
Task: {11F2E61C-9EC6-463F-A0C6-F761EC493583} - System32\Tasks\{1E036D3A-272F-4666-9902-6B6A6D4E52B0} => pcalua.exe -a "C:\Users\Bens\Downloads\avi.NET.3510\VobSub v2.2.3.exe" -d C:\Users\Bens\Downloads\avi.NET.3510
Task: {1CD61E5C-A846-4847-A286-6E87C4E1A730} - System32\Tasks\LaunchSignup => C:\Program Files\MyPC Backup\Signup Wizard.exe <==== ATTENTION
C:\Program Files\MyPC Backup
Task: {4078A13A-7A80-4687-9836-0296410C3D98} - System32\Tasks\AppCloudUpdater => C:\Users\Bens\AppData\Roaming\APPCLO~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: {69271D32-0283-4111-9EAB-EE4E0B810FBD} - System32\Tasks\{9DA8E150-706D-4A70-B524-73473A44DB39} => pcalua.exe -a G:\setup.exe -d G:\
Task: {9CD792FB-7C95-4AB7-ABE5-95B40C76E377} - System32\Tasks\{9C2DF5ED-90EB-4BDE-B36C-32868FAB40B7} => pcalua.exe -a C:\Medion\Setup.exe -d C:\Medion
Task: C:\Windows\Tasks\AppCloudUpdater.job => C:\Users\Bens\AppData\Roaming\APPCLO~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
C:\Users\Bens\AppData\Roaming\APPCLO~1
AlternateDataStreams: C:\Windows:31C7ED549BD4EC1D
AlternateDataStreams: C:\Windows\system32\msln.exe:659adf0548cd6caab6fc7dd29adfa2ef
IE trusted site: HKU\S-1-5-21-1327697534-1420294755-2536658182-1001\...\hola.org -> hxxp://hola.org
RemoveProxy:
Reboot:
end
*****************

Restore point was successfully created.
Processes closed successfully.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\ => value deleted successfully.
HKU\S-1-5-21-1327697534-1420294755-2536658182-1001\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\\NofolderOptions => value deleted successfully.
"HKU\S-1-5-21-1327697534-1420294755-2536658182-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2cd1b334-c006-11e3-b413-806e6f6e6963}" => Key deleted successfully.
HKCR\CLSID\{2cd1b334-c006-11e3-b413-806e6f6e6963} => Key not found.
"HKLM\SOFTWARE\Policies\Google" => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully.
"HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" => Key deleted successfully.
HKCR\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => Key not found.
"HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE" => Key deleted successfully.
"HKU\S-1-5-21-1327697534-1420294755-2536658182-1001\Software\MozillaPlugins\@hola.org/vlc,version=1.6.520" => Key deleted successfully.
FF Plugin HKU\S-1-5-21-1327697534-1420294755-2536658182-1001: @hola.org/vlc,version=1.6.520 -> C:\Users\Bens\AppData\Local\Hola\firefox\app\vlc [2015-02-03] () not found.
C:\Users\Bens\AppData\Local\Google\Chrome\User Data\Default\Extensions\iikflkcanblccfahdhdonehdalibjnif => Moved successfully.
"HKLM\SOFTWARE\Google\Chrome\Extensions\iikflkcanblccfahdhdonehdalibjnif" => Key deleted successfully.
hola_svc => Service not found.
hola_updater => Service not found.
22c5205d => Service deleted successfully.
auigtn2b => Service not found.
ASPI32 => Service deleted successfully.
C:\Program Files\compaareiNNbbuy => Moved successfully.
C:\Program Files\Keep Last Two Tabs => Moved successfully.
C:\Program Files\compareEnbuy => Moved successfully.
C:\Program Files\joianoThheashop => Moved successfully.
C:\Program Files\WasteNoTime => Moved successfully.
C:\Program Files\bigdeaLa => Moved successfully.
C:\Program Files\browsse2bbuy => Moved successfully.
C:\ProgramData\9455899666934413749 => Moved successfully.
C:\Program Files\cOmpaaRenbuY => Moved successfully.
C:\ProgramData\chepsales4all => Moved successfully.
C:\Program Files\Hola => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{11F2E61C-9EC6-463F-A0C6-F761EC493583}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{11F2E61C-9EC6-463F-A0C6-F761EC493583}" => Key deleted successfully.
C:\Windows\System32\Tasks\{1E036D3A-272F-4666-9902-6B6A6D4E52B0} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{1E036D3A-272F-4666-9902-6B6A6D4E52B0}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{1CD61E5C-A846-4847-A286-6E87C4E1A730}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{1CD61E5C-A846-4847-A286-6E87C4E1A730}" => Key deleted successfully.
C:\Windows\System32\Tasks\LaunchSignup => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\LaunchSignup" => Key deleted successfully.
"C:\Program Files\MyPC Backup" => File/Directory not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{4078A13A-7A80-4687-9836-0296410C3D98}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{4078A13A-7A80-4687-9836-0296410C3D98}" => Key deleted successfully.
C:\Windows\System32\Tasks\AppCloudUpdater => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\AppCloudUpdater" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{69271D32-0283-4111-9EAB-EE4E0B810FBD}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{69271D32-0283-4111-9EAB-EE4E0B810FBD}" => Key deleted successfully.
C:\Windows\System32\Tasks\{9DA8E150-706D-4A70-B524-73473A44DB39} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{9DA8E150-706D-4A70-B524-73473A44DB39}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{9CD792FB-7C95-4AB7-ABE5-95B40C76E377}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{9CD792FB-7C95-4AB7-ABE5-95B40C76E377}" => Key deleted successfully.
C:\Windows\System32\Tasks\{9C2DF5ED-90EB-4BDE-B36C-32868FAB40B7} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{9C2DF5ED-90EB-4BDE-B36C-32868FAB40B7}" => Key deleted successfully.
C:\Windows\Tasks\AppCloudUpdater.job => Moved successfully.
"C:\Users\Bens\AppData\Roaming\APPCLO~1" => File/Directory not found.
C:\Windows => ":31C7ED549BD4EC1D" ADS removed successfully.
C:\Windows\system32\msln.exe => ":659adf0548cd6caab6fc7dd29adfa2ef" ADS removed successfully.
"HKU\S-1-5-21-1327697534-1420294755-2536658182-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\hola.org" => Key deleted successfully.

========= RemoveProxy: =========

HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value deleted successfully.
HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value deleted successfully.
HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer => value deleted successfully.
HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer => value deleted successfully.
HKU\S-1-5-21-1327697534-1420294755-2536658182-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value deleted successfully.
HKU\S-1-5-21-1327697534-1420294755-2536658182-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value deleted successfully.

========= End of RemoveProxy: =========

The system needed a reboot.

==== End of Fixlog 17:59:18 ====

dbrisen
Malware Removalists

Posts: 3,688

[ti]SOLVED[/ti]System infected : fake plugin activity 2 detected Apr 25, 2015 23:31:06 GMT -8

Post by dbrisen on Apr 25, 2015 23:31:06 GMT -8

Read carefully

Download Adwcleaner from here to your desktop and run a scan.

You may have to right click adwcleaner.exe and choose "Run as Administrator" from the menu. (Click the Scan button to start the scanning).

It will create a log after it is finished scanning. If not (or if it just asks for you to uncheck what you don't wanted deleted), there is a LogFile button in the middle of the main window; click that and it will make the log file.

Once the report file is made, you can leave AdwCleaner running (but don't delete anything yet) or you can close it down (we can always get a fresh scan done before the deletions).

ONE SCAN ONLY, PLEASE

Attach or paste the log back here for review and further instructions. Thanks.

opaben
New Helpee

Posts: 9

[ti]SOLVED[/ti]System infected : fake plugin activity 2 detected Apr 26, 2015 9:37:15 GMT -8

Post by opaben on Apr 26, 2015 9:37:15 GMT -8

here is the report:

# AdwCleaner v4.202 - Logbestand aangemaakt 26/04/2015 op 19:34:01
# Laatste update 23/04/2015 door Xplode
# Database : 2015-04-23.2 [Server]
# Besturingssysteem : Windows 7 Professional Service Pack 1 (x86)
# Gebruikersnaam : Bens - BENS-PC
# Gestart vanuit : C:\Users\Bens\Downloads\adwcleaner_4.202.exe
# Optie : Scannen

***** [ Services ] *****

***** [ Bestanden / Mappen ] *****

Bestand Gevonden : C:\END
Bestand Gevonden : C:\Windows\system32\roboot.exe
Map Gevonden : C:\Program Files\browse2biuy
Map Gevonden : C:\Program Files\browseu2buy
Map Gevonden : C:\Program Files\crazyloWWerpriece
Map Gevonden : C:\Program Files\ffunshopper
Map Gevonden : C:\Program Files\ggetiit4cheaopeer
Map Gevonden : C:\Program Files\MarkketcOMpaarE
Map Gevonden : C:\ProgramData\833a1aa5c75c39b5
Map Gevonden : C:\ProgramData\cheapdeal
Map Gevonden : C:\ProgramData\crazylowerprice
Map Gevonden : C:\ProgramData\dipobeagemobmlfiglhdigfafigmelpc
Map Gevonden : C:\ProgramData\nicedeal
Map Gevonden : C:\ProgramData\simplitec
Map Gevonden : C:\Users\Bens\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk
Map Gevonden : C:\Users\Bens\AppData\Local\Hola
Map Gevonden : C:\Users\Bens\AppData\Roaming\Systweak

***** [ Geplande taken ] *****

***** [ Snelkoppelingen ] *****

***** [ Register ] *****

Sleutel Gevonden : HKCU\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}
Sleutel Gevonden : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player Packages
Sleutel Gevonden : HKCU\Software\Myfree Codec
Sleutel Gevonden : HKCU\Software\systweak
Sleutel Gevonden : HKLM\SOFTWARE\{12A61307-94CD-4F8E-94BC-918E511FAA81}
Sleutel Gevonden : HKLM\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}
Sleutel Gevonden : HKLM\SOFTWARE\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
Sleutel Gevonden : HKLM\SOFTWARE\Classes\AppID\{4D076AB4-7562-427A-B5D2-BD96E19DEE56}
Sleutel Gevonden : HKLM\SOFTWARE\Classes\AppID\{C292AD0A-C11F-479B-B8DB-743E72D283B0}
Sleutel Gevonden : HKLM\SOFTWARE\Classes\AppID\esrv.EXE
Sleutel Gevonden : HKLM\SOFTWARE\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Sleutel Gevonden : HKLM\SOFTWARE\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}
Sleutel Gevonden : HKLM\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}
Sleutel Gevonden : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Sleutel Gevonden : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}
Sleutel Gevonden : HKLM\SOFTWARE\Classes\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}
Sleutel Gevonden : HKLM\SOFTWARE\Classes\TypeLib\{11549FE4-7C5A-4C17-9FC3-56FC5162A994}
Sleutel Gevonden : HKLM\SOFTWARE\Classes\TypeLib\{230332DF-D235-47EE-BC42-60860EF144CD}
Sleutel Gevonden : HKLM\SOFTWARE\Classes\TypeLib\{89310413-97E0-4F09-AA75-390A7F4D4918}
Sleutel Gevonden : HKLM\SOFTWARE\Classes\TypeLib\{C1EC170E-C5ED-4100-9078-559C31AFDBF5}
Sleutel Gevonden : HKLM\SOFTWARE\Classes\TypeLib\{C292AD0A-C11F-479B-B8DB-743E72D283B0}
Sleutel Gevonden : HKLM\SOFTWARE\Classes\TypeLib\{C4D1C553-99C0-48E5-B0A7-B1E00163715C}
Sleutel Gevonden : HKLM\SOFTWARE\Google\Chrome\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk
Sleutel Gevonden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}{22c5205d}
Sleutel Gevonden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}{5e9aae86}
Sleutel Gevonden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{37476589-E48E-439E-A706-56189E2ED4C4}_is1
Sleutel Gevonden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{7D367FDF-8E9F-EE67-25C5-ECABBBAD5692}
Sleutel Gevonden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D11ED002-6B5F-0D8B-FFCE-C72742F2ABA3}
Sleutel Gevonden : HKLM\SOFTWARE\Myfree Codec
Sleutel Gevonden : HKLM\SOFTWARE\systweak

***** [ Webbrowsers ] *****

-\\ Internet Explorer v11.0.9600.17728

-\\ Mozilla Firefox v37.0.2 (x86 nl)

-\\ Google Chrome v42.0.2311.90

[C:\Users\Bens\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] - Gevonden [Extension] : mkfokfffehpeedafpekjeddnmnjhmcmk

*************************

AdwCleaner[R0].txt - [4283 bytes] - [26/04/2015 19:34:01]

########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [4342 bytes] ##########

dbrisen
Malware Removalists

Posts: 3,688

[ti]SOLVED[/ti]System infected : fake plugin activity 2 detected Apr 26, 2015 14:58:42 GMT -8

Post by dbrisen on Apr 26, 2015 14:58:42 GMT -8

FIRST

Please run AdwCleaner again (if you don't have it running from the last scan) and

a) Click the Scan Button and wait for the scan to finish, (If Adwcleaner has been left open at the finish of the scan this is already done).

b) Make sure in your case all the items under each TAB are ticked / checked then.

c) Click the Clean Button and Adwcleaner will process all the items ticked / checked and then may ask for the system to be restarted.

d) It should create a new log afterwards (with S0 in the name).

e) Please attach or copy the log into your reply here.

SECOND

Malwarebytes' Anti-Malware
Please download the latest version of Malwarebytes' Anti-Malware from Here (I see that you have this installed but I believe there is a newer version available; should be v2.1.6.1022)

Double Click on the mbam-setup.exe file to install the application.

Do not check on the Trial of Professional version. Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.

If an update is found, it will download and install the latest version.

When the main screen opens, if the database is out of date, you can click on the Fix Now banner or the Update Now link

Once the program has loaded and updated, select "Scan Now >>" to start the scan.

The scan may take some time to finish, so please be patient.

If any malware is found, you will be presented with a screen like the one below.

Please click on the Save results > link in the bottom right hand corner and select the Text file(*.txt) from the dropdown list. I would suggest you save the file on your desktop (as we need the report attached here for review and it is easy to find on the desktop).

After you have saved the report file, return to the Potential Threats Detected page and click on Cancel. You can close MBAM after that.

Please attach the report file to a post here; I will review the file and script what needs to be removed.

[ti]SOLVED[/ti]System infected : fake plugin activity 2 detected

Post by opaben on Apr 20, 2015 2:47:46 GMT -8

Post by Quads on Apr 20, 2015 10:23:35 GMT -8

Post by opaben on Apr 21, 2015 1:33:49 GMT -8

Post by Quads on Apr 21, 2015 11:23:22 GMT -8

Post by opaben on Apr 22, 2015 2:45:19 GMT -8

Post by dbrisen on Apr 24, 2015 8:41:08 GMT -8

Post by opaben on Apr 25, 2015 8:06:48 GMT -8

Post by dbrisen on Apr 25, 2015 23:31:06 GMT -8

Post by opaben on Apr 26, 2015 9:37:15 GMT -8

Post by dbrisen on Apr 26, 2015 14:58:42 GMT -8