Hello CTH team,
Speedbit has taken over my homepages on every browser and the browser search bar with its proprietary search. I have tried so many variations of systems restore points and removals (via adwcleaner, manual delete of suspect files, uninstalling mozilla.) I had minor success for a short while with mozilla (IE stayed infected with the adware) when i just used adwcleaner and manually deleted a file the cleaner couldnt do on its own. That is until I shut pc down, and upon turning it on the next day, my computer on boot up said something along the lines of "applying update... (Registry/system/..." with a ton file names appearing in the "...". the total number was 19094. Then it went into windows, i signed in, and all my hard work was for naught, every browser was infected. Now for some reason, the first load of chrome will be clean, without any hint of Speedbit. But if i close chrome and open again, or if I open IE first, then Chrome after, then Chrome will load with Speedbit.
Also, I figured since each time, and presently,my IE was infected, that I wouldn't bother deleting my old restore points yet.
I first got this adware while using webroot's secure anywhere antivirus. Webroot initially didnt pick it up, then after i tried restoring, it found some problems but failed to delete it. I then tried scanning with bitdefender and kaspersky, but neither could find an issue. I shucked my webroot av, had a stint with bitdefender free, and now with kaspersky Pure trial, which reads Speedbit app as safe. Please help.
Thanks for reading
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 12-02-2014 01
Ran by walta (administrator) on WALTA-PC on 13-02-2014 13:07:26
Running from C:\Users\walta\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: English(US)
Internet Explorer Version 11
Boot Mode: Normal
The only official download link for FRST:
Download link for 32-Bit version: http://www.bleepingcomputer.com/down...an-tool/dl/81/
Download link for 64-Bit Version: http://www.bleepingcomputer.com/down...an-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: http://www.geekstogo.com/forum/topic...ery-scan-tool/
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Sandboxie Holdings, LLC) C:\Program Files\Sandboxie\SbieSvc.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\avp.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Infowatch) C:\Program Files (x86)\Common Files\InfoWatch\CryptoStorage\ProtectedObjectsSrv. exe
(Acer Incorporated) C:\Program Files (x86)\eMachines\Registration\GregHSRW.exe
(Speedbit Ltd.) C:\Program Files\Common Files\SpeedBit\SBUpdate\sbu.exe
(Acer) C:\Program Files\eMachines\eMachines Updater\UpdaterService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
() C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt. exe
() C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Microsoft Corporation) C:\Program Files\Microsoft IntelliPoint\ipoint.exe
(Microsoft Corporation) C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
(Sandboxie Holdings, LLC) C:\Program Files\Sandboxie\SbieCtrl.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
() C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\avp.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Yahoo! Inc.) C:\Program Files (x86)\Yahoo!\Messenger\ymsgr_tray.exe
(Sandboxie Holdings, LLC) C:\Program Files\Sandboxie\SbieSvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
(Google Inc.) C:\Users\walta\AppData\Local\Google\Chrome\Applica tion\chrome.exe
(Google Inc.) C:\Users\walta\AppData\Local\Google\Chrome\Applica tion\chrome.exe
(Google Inc.) C:\Users\walta\AppData\Local\Google\Chrome\Applica tion\chrome.exe
(Google Inc.) C:\Users\walta\AppData\Local\Google\Chrome\Applica tion\chrome.exe
(Microsoft Corporation) C:\Program Files\Windows NT\Accessories\wordpad.exe
(Google Inc.) C:\Users\walta\AppData\Local\Google\Chrome\Applica tion\chrome.exe
(Google Inc.) C:\Users\walta\AppData\Local\Google\Chrome\Applica tion\chrome.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [7981088 2009-07-20] (Realtek Semiconductor)
HKLM\...\Run: [LogMeIn GUI] - "C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe"
HKLM\...\Run: [CanonSolutionMenu] - C:\Program Files (x86)\Canon\SolutionMenu\CNSLMAIN.exe [767312 2009-09-04] (CANON INC.)
HKLM\...\Run: [IntelliPoint] - c:\Program Files\Microsoft IntelliPoint\ipoint.exe [2417032 2011-08-01] (Microsoft Corporation)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [41208 2012-12-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59280 2012-08-27] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2012-04-18] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [421776 2012-09-09] (Apple Inc.)
HKLM-x32\...\Run: [DivXMediaServer] - C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe [450560 2013-05-19] (DivX, LLC)
HKLM-x32\...\Run: [DivXUpdate] - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1263952 2013-02-12] ()
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [AVP] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\avp.exe [356128 2013-11-11] (Kaspersky Lab ZAO)
HKU\S-1-5-21-446932383-4155311822-2791118767-1000\...\Run: [msnmsgr] - C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe [4272640 2012-09-12] (Microsoft Corporation)
HKU\S-1-5-21-446932383-4155311822-2791118767-1000\...\Run: [Google Update] - C:\Users\walta\AppData\Local\Google\Update\GoogleU pdate.exe [136176 2010-06-15] (Google Inc.)
HKU\S-1-5-21-446932383-4155311822-2791118767-1000\...\Run: [Messenger (Yahoo!)] - C:\Program Files (x86)\Yahoo!\Messenger\YahooMessenger.exe [6595928 2012-05-25] (Yahoo! Inc.)
HKU\S-1-5-21-446932383-4155311822-2791118767-1000\...\Run: [Jing] - C:\Program Files (x86)\TechSmith\Jing\Jing.exe [2909048 2012-12-04] (TechSmith Corporation)
HKU\S-1-5-21-446932383-4155311822-2791118767-1000\...\Run: [Vidalia] - "C:\Program Files (x86)\Vidalia Bundle\Vidalia\vidalia.exe"
HKU\S-1-5-21-446932383-4155311822-2791118767-1000\...\Run: [SandboxieControl] - C:\Program Files\Sandboxie\SbieCtrl.exe [759384 2013-07-08] (Sandboxie Holdings, LLC)
HKU\S-1-5-21-446932383-4155311822-2791118767-1004\...\RunOnce: [ScrSav] - C:\Program Files (x86)\eMachines\Screensaver\run_eMachines.exe [162336 2009-07-21] ()
==================== Internet (Whitelisted) ====================
ProxyServer: 127.0.0.1:8118
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
SearchScopes: HKLM-x32 - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.micros oft:{language}:{referrer:source?}&ie={inputEncodin g}&oe={outputEncoding}&rlz=1I7ACEW
SearchScopes: HKCU - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.micros oft:{language}:{referrer:source?}&ie={inputEncodin g}&oe={outputEncoding}&rlz=1I7ACEW_enUS364US365
BHO: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\x64\IEExt\ContentBlocker\ie_content_blocker_pl ugin.dll (Kaspersky Lab ZAO)
BHO: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_ plugin.dll (Kaspersky Lab ZAO)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\x64\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Kaspersky Passsword Manager Toolbar - {215BA832-75A3-426E-A4FC-7C5B58CE6A10} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\Kaspersky Password Manager\spIEBho.dll (Kaspersky Lab)
BHO-x32: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
BHO-x32: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\IEExt\ContentBlocker\ie_content_blocker_plugin .dll (Kaspersky Lab ZAO)
BHO-x32: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plug in.dll (Kaspersky Lab ZAO)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
Toolbar: HKLM-x32 - Kaspersky Passsword Manager Toolbar - {215BA832-75A3-426E-A4FC-7C5B58CE6A10} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\Kaspersky Password Manager\spIEBho.dll (Kaspersky Lab)
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
DPF: HKLM-x32 {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab
DPF: HKLM-x32 {82E5DF24-51E8-47CD-864A-F4BD5005AA73} https://www.icloud.com/system/iCloud.cab
DPF: HKLM-x32 {C345E174-3E87-4F41-A01C-B066A90A49B4} http://trial.trymicrosoftoffice.com/...soft/wrc32.ocx
DPF: HKLM-x32 {C3F79A2B-B9B4-4A66-B012-3EE46475B072} http://messenger.zone.msn.com/binary...t.cab56907.cab
DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
FireFox:
========
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_90 0_170.dll ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @java.com/DTPlugin,version=10.25.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_90 0_170.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6 - C:\Program Files (x86)\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.4 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 - C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp .dll ()
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @citrixonline.com/appdetectorplugin - C:\Users\walta\AppData\Local\Citrix\Plugins\94\npa ppdetector.dll (Citrix Online)
FF Plugin HKCU: @kaneva.com/KanevaPatch - C:\Program Files (x86)\Kaneva\npkanevapatch.dll (Kaneva, LLC.)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\walta\AppData\Local\Google\Update\1.3.22. 5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\walta\AppData\Local\Google\Update\1.3.22. 5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npkanevapatch.dll (Kaneva, LLC.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\NPOFF12.DLL (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin6.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin7.dll (Apple Inc.)
FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2013-12-29]
FF HKLM-x32\...\Firefox\Extensions: [{7BA52691-1876-45ce-9EE6-54BCB3B04BBC}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\coFFPlgn\
FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF Extension: DivX Plus Web Player HTML5 <video> - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2013-03-07]
FF HKLM-x32\...\Firefox\Extensions: [url_advisor@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\FFExt\url_advisor@kaspersky.com
FF Extension: Kaspersky URL Advisor - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\FFExt\url_advisor@kaspersky.com [2014-02-02]
FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\FFExt\virtual_keyboard@kaspersky.com
FF Extension: Virtual Keyboard - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\FFExt\virtual_keyboard@kaspersky.com [2014-02-02]
FF HKLM-x32\...\Firefox\Extensions: [content_blocker@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\FFExt\content_blocker@kaspersky.com
FF Extension: Content Blocker - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\FFExt\content_blocker@kaspersky.com [2014-02-02]
FF HKLM-x32\...\Firefox\Extensions: [anti_banner@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\FFExt\anti_banner@kaspersky.com
FF Extension: Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\FFExt\anti_banner@kaspersky.com [2014-02-02]
FF HKLM-x32\...\Firefox\Extensions: [online_banking@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\FFExt\online_banking@kaspersky.com
FF Extension: Safe Money - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\FFExt\online_banking@kaspersky.com [2014-02-02]
Chrome:
=======
CHR HomePage:
CHR RestoreOnStartup: "sync" : {
"dictionary" : false,
"keep_everything_synced" : false,
"preferences" : false,
"priority_preferences" : false,
"search_engines"
CHR DefaultSearchKeyword: speedbit.com
CHR DefaultSearchProvider: Speedbit Search
CHR DefaultSearchURL: http://go.speedbit.com/search.aspx?s=DAUb&q={searchTerms}
CHR DefaultNewTabURL:
CHR Extension: (Google Docs) - C:\Users\walta\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfi lokake [2014-02-13]
CHR Extension: (Google Drive) - C:\Users\walta\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigk jlhalf [2014-02-13]
CHR Extension: (YouTube) - C:\Users\walta\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldk acnbeo [2014-02-13]
CHR Extension: (Google Search) - C:\Users\walta\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljnie djpjpf [2014-02-13]
CHR Extension: (Kaspersky URL Advisor) - C:\Users\walta\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecp egganj [2012-12-05]
CHR Extension: (Safe Money) - C:\Users\walta\AppData\Local\Google\Chrome\User Data\Default\Extensions\hakdifolhalapjijoafobooafb ilfakh [2012-12-05]
CHR Extension: (Content Blocker) - C:\Users\walta\AppData\Local\Google\Chrome\User Data\Default\Extensions\hghkgaeecgjhjkannahfamoehj mkjail [2014-02-13]
CHR Extension: (Virtual Keyboard) - C:\Users\walta\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadma iegcmh [2012-12-05]
CHR Extension: (Google Wallet) - C:\Users\walta\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccm gmieda [2013-09-29]
CHR Extension: (Gmail) - C:\Users\walta\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoe jaedia [2014-02-13]
CHR Extension: (Anti-Banner) - C:\Users\walta\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampi nooman [2012-12-05]
CHR HKLM-x32\...\Chrome\Extension: [dchlnpcodkpfdpacogkljefecpegganj] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\ChromeExt\urladvisor.crx [2013-11-11]
CHR HKLM-x32\...\Chrome\Extension: [hakdifolhalapjijoafobooafbilfakh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\ChromeExt\online_banking_chrome.crx [2013-11-11]
CHR HKLM-x32\...\Chrome\Extension: [hghkgaeecgjhjkannahfamoehjmkjail] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\ChromeExt\content_blocker_chrome.crx [2013-11-11]
CHR HKLM-x32\...\Chrome\Extension: [jagncdcchgajhfhijbbhecadmaiegcmh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\ChromeExt\virtkbd.crx [2013-11-11]
CHR HKLM-x32\...\Chrome\Extension: [pjldcfjmnllhmgjclecdnfampinooman] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\ChromeExt\ab.crx [2013-11-11]
CHR StartMenuInternet: Google Chrome - C:\Users\walta\AppData\Local\Google\Chrome\Applica tion\chrome.exe
==================== Services (Whitelisted) =================
R2 AVP; C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\avp.exe [356128 2013-11-11] (Kaspersky Lab ZAO)
R2 CSObjectsSrv; C:\Program Files (x86)\Common Files\InfoWatch\CryptoStorage\ProtectedObjectsSrv. exe [818888 2013-09-25] (Infowatch)
R2 ForceWare Intelligent Application Manager (IAM); C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt. exe [625184 2009-04-19] ()
R2 Greg_Service; C:\Program Files (x86)\eMachines\Registration\GregHSRW.exe [1150496 2009-08-28] (Acer Incorporated)
R2 nSvcIp; C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe [207904 2009-04-19] ()
R2 SbieSvc; C:\Program Files\Sandboxie\SbieSvc.exe [183896 2013-07-08] (Sandboxie Holdings, LLC)
R2 SBUpd; C:\Program Files\Common Files\SpeedBit\SBUpdate\sbu.exe [2541176 2014-01-26] (Speedbit Ltd.)
R2 Updater Service; C:\Program Files\eMachines\eMachines Updater\UpdaterService.exe [240160 2009-07-03] (Acer)
==================== Drivers (Whitelisted) ====================
R0 CSCrySec; C:\Windows\System32\DRIVERS\CSCrySec.sys [84536 2011-06-02] (Infowatch)
R1 CSVirtualDiskDrv; C:\Windows\System32\DRIVERS\CSVirtualDiskDrv.sys [66616 2011-06-02] (Infowatch)
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [7717984 2013-11-11] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [626272 2013-11-11] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [28504 2012-08-02] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [29280 2013-11-11] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29280 2013-11-11] (Kaspersky Lab ZAO)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [54368 2013-11-11] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [178448 2013-11-11] (Kaspersky Lab ZAO)
S4 LMIRfsClientNP; No ImagePath
R0 nlem64nt; C:\Windows\System32\Drivers\nlem64nt.sys [72808 2009-10-13] ()
S3 radpms; C:\Windows\System32\DRIVERS\radpms.sys [14944 2011-09-16] (LogMeIn, Inc.)
R3 SbieDrv; C:\Program Files\Sandboxie\SbieDrv.sys [199384 2013-07-08] (Sandboxie Holdings, LLC)
R3 SBUpdd; C:\Program Files\Common Files\SpeedBit\SBUpdate\sbw.sys [41368 2014-01-26] ()
U5 klflt; C:\Windows\System32\Drivers\klflt.sys [90208 2013-11-11] (Kaspersky Lab ZAO)
S2 LMIInfo; \??\C:\Program Files (x86)\LogMeIn\x64\RaInfo.sys [X]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-02-13 13:03 - 2014-02-13 13:03 - 00000000 _____ () C:\Windows\setuperr.log
2014-02-13 13:03 - 2014-02-13 13:03 - 00000000 _____ () C:\Windows\setupact.log
2014-02-13 11:39 - 2014-02-13 13:07 - 00023577 _____ () C:\Users\walta\Downloads\FRST.txt
2014-02-13 11:39 - 2014-02-13 13:07 - 00000000 ____D () C:\FRST
2014-02-13 11:39 - 2014-02-13 11:40 - 00031896 _____ () C:\Users\walta\Downloads\Addition.txt
2014-02-13 11:38 - 2014-02-13 11:38 - 02152448 _____ (Farbar) C:\Users\walta\Downloads\FRST64.exe
2014-02-13 11:38 - 2014-02-13 11:38 - 02152448 _____ (Farbar) C:\Users\walta\Downloads\FRST64 (1).exe
2014-02-13 11:09 - 2014-02-13 11:09 - 00111224 _____ () C:\Users\walta\AppData\Local\GDIPFONTCACHEV1.DAT
2014-02-13 10:08 - 2014-02-13 10:08 - 01166132 _____ () C:\Users\walta\Desktop\adwcleaner.exe
2014-02-04 07:55 - 2014-02-04 07:55 - 00083538 _____ () C:\Users\walta\Downloads\Extras.Txt
2014-02-04 07:53 - 2014-02-04 07:53 - 00090116 _____ () C:\Users\walta\Downloads\OTL.Txt
2014-02-04 03:49 - 2014-02-13 11:08 - 00000000 ____D () C:\AdwCleaner
2014-02-03 21:15 - 2014-02-13 09:59 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-02-02 21:01 - 2014-02-02 21:01 - 00000000 ____D () C:\Users\walta\AppData\Roaming\Oracle
2014-02-02 20:58 - 2014-02-02 20:58 - 00005175 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log
2014-02-02 20:50 - 2014-02-02 10:57 - 00000000 ____D () C:\Users\walta\Documents\MPC-HC.1.7.3.x64
2014-02-02 20:49 - 2014-02-12 02:31 - 00000000 ____D () C:\Users\walta\AppData\Roaming\MPC-HC
2014-02-02 14:36 - 2014-02-02 14:36 - 00000000 ___SD () C:\Users\walta\Documents\Passwords Database
2014-02-02 14:27 - 2014-02-02 14:27 - 00002185 _____ () C:\Users\walta\Desktop\Safe Money.lnk
2014-02-02 14:26 - 2014-02-02 14:26 - 00001047 _____ () C:\Users\Public\Desktop\Kaspersky PURE 3.0.lnk
2014-02-02 14:26 - 2013-11-11 22:18 - 00064856 _____ (Kaspersky Lab) C:\Windows\system32\klfphc.dll
2014-02-02 14:25 - 2014-02-02 14:25 - 00000000 ____D () C:\Windows\ELAMBKUP
2014-02-02 14:25 - 2014-02-02 14:25 - 00000000 ____D () C:\Program Files (x86)\Kaspersky Lab
2014-02-02 14:25 - 2013-11-11 22:18 - 00626272 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klif.sys
2014-02-02 14:25 - 2013-11-11 22:18 - 00090208 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klflt.sys
2014-02-02 14:25 - 2011-06-02 14:39 - 00084536 _____ (Infowatch) C:\Windows\system32\Drivers\CSCrySec.sys
2014-02-02 14:25 - 2011-06-02 14:39 - 00066616 _____ (Infowatch) C:\Windows\system32\Drivers\CSVirtualDiskDrv.sys
2014-02-02 14:20 - 2014-02-02 14:21 - 193804024 _____ (Kaspersky Lab ZAO) C:\Users\walta\Downloads\pur13.0.2.558abcdEN_5352. exe
2014-02-01 12:22 - 2014-02-01 12:22 - 00000000 ____D () C:\Users\walta\AppData\Local\Skype
2014-02-01 12:20 - 2014-02-01 12:20 - 01659552 _____ (Skype Technologies S.A.) C:\Users\walta\Downloads\SkypeSetup.exe
2014-01-29 21:08 - 2014-02-02 00:11 - 00000000 ____D () C:\Program Files\PDF SUMATRA
2014-01-28 12:30 - 2014-01-28 12:30 - 00203046 _____ () C:\ProgramData\1390929988.bdinstall.bin
2014-01-28 12:28 - 2014-01-28 12:29 - 00000000 ____D () C:\Program Files\Bitdefender
2014-01-28 12:26 - 2014-02-02 00:05 - 00000000 ____D () C:\Users\walta\AppData\Roaming\QuickScan
2014-01-28 12:20 - 2014-01-28 12:20 - 00162208 _____ () C:\Users\walta\Downloads\Antivirus_Free_Edition.ex e
2014-01-28 12:19 - 2014-01-28 12:19 - 00000000 _____ () C:\Users\walta\Downloads\setup_11.0.1.1245.x01_201 4_01_28_19_37.exe
2014-01-28 08:57 - 2014-02-13 12:38 - 00000000 ____D () C:\ProgramData\Kaspersky Lab
2014-01-27 19:35 - 2014-01-27 19:35 - 00000000 _____ () C:\Windows\SysWOW64\FAP7C20.tmp
==================== One Month Modified Files and Folders =======
2014-02-13 13:07 - 2014-02-13 11:39 - 00023577 _____ () C:\Users\walta\Downloads\FRST.txt
2014-02-13 13:07 - 2014-02-13 11:39 - 00000000 ____D () C:\FRST
2014-02-13 13:03 - 2014-02-13 13:03 - 00000000 _____ () C:\Windows\setuperr.log
2014-02-13 13:03 - 2014-02-13 13:03 - 00000000 _____ () C:\Windows\setupact.log
2014-02-13 12:38 - 2014-01-28 08:57 - 00000000 ____D () C:\ProgramData\Kaspersky Lab
2014-02-13 12:38 - 2010-07-10 11:31 - 00000908 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-446932383-4155311822-2791118767-1000UA.job
2014-02-13 12:27 - 2013-02-14 19:45 - 01604535 _____ () C:\Windows\WindowsUpdate.log
2014-02-13 12:21 - 2010-01-26 14:52 - 00000898 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-02-13 12:17 - 2013-12-31 07:29 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-02-13 11:40 - 2014-02-13 11:39 - 00031896 _____ () C:\Users\walta\Downloads\Addition.txt
2014-02-13 11:38 - 2014-02-13 11:38 - 02152448 _____ (Farbar) C:\Users\walta\Downloads\FRST64.exe
2014-02-13 11:38 - 2014-02-13 11:38 - 02152448 _____ (Farbar) C:\Users\walta\Downloads\FRST64 (1).exe
2014-02-13 11:29 - 2012-11-12 10:32 - 00000000 ____D () C:\Users\walta\AppData\Roaming\vlc
2014-02-13 11:09 - 2014-02-13 11:09 - 00111224 _____ () C:\Users\walta\AppData\Local\GDIPFONTCACHEV1.DAT
2014-02-13 11:08 - 2014-02-04 03:49 - 00000000 ____D () C:\AdwCleaner
2014-02-13 11:08 - 2013-05-02 19:57 - 00000000 ____D () C:\Users\walta\Tracing
2014-02-13 10:52 - 2009-07-13 23:45 - 00009920 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-02-13 10:52 - 2009-07-13 23:45 - 00009920 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-02-13 10:44 - 2010-01-26 14:52 - 00000894 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-02-13 10:44 - 2009-07-14 00:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-02-13 10:38 - 2010-07-10 11:31 - 00000856 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-446932383-4155311822-2791118767-1000Core.job
2014-02-13 10:36 - 2013-12-29 01:56 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-02-13 10:33 - 2010-12-10 23:38 - 00000000 ____D () C:\Users\walta\AppData\Roaming\Mozilla
2014-02-13 10:33 - 2010-07-10 11:31 - 00003882 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-446932383-4155311822-2791118767-1000UA
2014-02-13 10:33 - 2010-07-10 11:31 - 00003486 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-446932383-4155311822-2791118767-1000Core
2014-02-13 10:08 - 2014-02-13 10:08 - 01166132 _____ () C:\Users\walta\Desktop\adwcleaner.exe
2014-02-13 10:05 - 2012-07-01 15:13 - 00000000 ____D () C:\Users\walta\AppData\Local\Windows Live
2014-02-13 10:01 - 2010-01-06 22:00 - 00000000 ____D () C:\Users\walta
2014-02-13 09:59 - 2014-02-03 21:15 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-02-13 09:59 - 2014-01-01 15:00 - 00000000 ____D () C:\Users\walta\AppData\Roaming\Microsoft\Windows\S tart Menu\Programs\proXPN
2014-02-13 09:59 - 2012-11-27 00:37 - 00000000 ____D () C:\Users\walta\Downloads\john179w2
2014-02-13 09:59 - 2012-11-27 00:33 - 00000000 ____D () C:\Users\walta\Downloads\john179j5w
2014-02-13 09:59 - 2012-01-02 08:59 - 00000000 ____D () C:\Program Files (x86)\CamStudio 2.6b
2014-02-13 09:59 - 2010-12-24 01:42 - 00000000 ____D () C:\Users\walta\AppData\Roaming\Microsoft\Windows\S tart Menu\Programs\Google Chrome
2014-02-13 09:59 - 2009-07-13 22:20 - 00000000 ____D () C:\Windows\registration
2014-02-13 09:59 - 2009-07-13 22:20 - 00000000 ____D () C:\Windows\AppCompat
2014-02-13 09:54 - 2013-07-21 10:49 - 00000000 ____D () C:\Program Files\Java
2014-02-13 09:53 - 2012-08-01 18:42 - 00000000 ____D () C:\Program Files (x86)\Java
2014-02-12 02:31 - 2014-02-02 20:49 - 00000000 ____D () C:\Users\walta\AppData\Roaming\MPC-HC
2014-02-04 07:55 - 2014-02-04 07:55 - 00083538 _____ () C:\Users\walta\Downloads\Extras.Txt
2014-02-04 07:53 - 2014-02-04 07:53 - 00090116 _____ () C:\Users\walta\Downloads\OTL.Txt
2014-02-03 00:24 - 2013-11-05 08:53 - 00000000 ____D () C:\Windows\system32\MRT
2014-02-02 21:01 - 2014-02-02 21:01 - 00000000 ____D () C:\Users\walta\AppData\Roaming\Oracle
2014-02-02 21:00 - 2013-10-29 19:53 - 00000000 ____D () C:\ProgramData\Oracle
2014-02-02 20:58 - 2014-02-02 20:58 - 00005175 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log
2014-02-02 20:51 - 2011-10-29 18:17 - 00000000 ____D () C:\Users\walta\AppData\Roaming\Media Player Classic
2014-02-02 16:44 - 2010-12-24 01:42 - 00002372 _____ () C:\Users\walta\Desktop\Google Chrome.lnk
2014-02-02 14:36 - 2014-02-02 14:36 - 00000000 ___SD () C:\Users\walta\Documents\Passwords Database
2014-02-02 14:27 - 2014-02-02 14:27 - 00002185 _____ () C:\Users\walta\Desktop\Safe Money.lnk
2014-02-02 14:26 - 2014-02-02 14:26 - 00001047 _____ () C:\Users\Public\Desktop\Kaspersky PURE 3.0.lnk
2014-02-02 14:25 - 2014-02-02 14:25 - 00000000 ____D () C:\Windows\ELAMBKUP
2014-02-02 14:25 - 2014-02-02 14:25 - 00000000 ____D () C:\Program Files (x86)\Kaspersky Lab
2014-02-02 14:21 - 2014-02-02 14:20 - 193804024 _____ (Kaspersky Lab ZAO) C:\Users\walta\Downloads\pur13.0.2.558abcdEN_5352. exe
2014-02-02 10:57 - 2014-02-02 20:50 - 00000000 ____D () C:\Users\walta\Documents\MPC-HC.1.7.3.x64
2014-02-02 00:11 - 2014-01-29 21:08 - 00000000 ____D () C:\Program Files\PDF SUMATRA
2014-02-02 00:11 - 2012-01-09 18:34 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-02-02 00:10 - 2011-03-12 08:22 - 00000000 ____D () C:\Users\walta\AppData\Roaming\Skype
2014-02-02 00:09 - 2011-12-05 07:40 - 00000000 ____D () C:\Program Files (x86)\Adobe
2014-02-02 00:09 - 2011-03-12 08:22 - 00000000 ____D () C:\ProgramData\Skype
2014-02-02 00:05 - 2014-01-28 12:26 - 00000000 ____D () C:\Users\walta\AppData\Roaming\QuickScan
2014-02-01 12:22 - 2014-02-01 12:22 - 00000000 ____D () C:\Users\walta\AppData\Local\Skype
2014-02-01 12:20 - 2014-02-01 12:20 - 01659552 _____ (Skype Technologies S.A.) C:\Users\walta\Downloads\SkypeSetup.exe
2014-01-28 19:56 - 2010-02-20 16:10 - 00000000 ____D () C:\Windows\Minidump
2014-01-28 12:30 - 2014-01-28 12:30 - 00203046 _____ () C:\ProgramData\1390929988.bdinstall.bin
2014-01-28 12:29 - 2014-01-28 12:28 - 00000000 ____D () C:\Program Files\Bitdefender
2014-01-28 12:23 - 2010-01-28 17:13 - 00000000 ____D () C:\Users\walta\AppData\Local\Adobe
2014-01-28 12:20 - 2014-01-28 12:20 - 00162208 _____ () C:\Users\walta\Downloads\Antivirus_Free_Edition.ex e
2014-01-28 12:19 - 2014-01-28 12:19 - 00000000 _____ () C:\Users\walta\Downloads\setup_11.0.1.1245.x01_201 4_01_28_19_37.exe
2014-01-28 12:12 - 2014-01-07 23:45 - 00000000 ____D () C:\Program Files (x86)\World of Warcraft
2014-01-28 12:12 - 2013-10-29 20:21 - 00000000 ____D () C:\ProgramData\SpeedBit
2014-01-28 12:12 - 2013-02-12 17:13 - 00000000 ____D () C:\Program Files (x86)\thinkTDA
2014-01-28 12:12 - 2012-11-28 22:45 - 00000000 ___RD () C:\Users\walta\Desktop\crap
2014-01-28 12:12 - 2012-11-20 18:57 - 00000000 ____D () C:\Users\walta\Desktop\bkck
2014-01-28 12:12 - 2011-07-23 14:12 - 00000000 ____D () C:\Program Files\Sandboxie
2014-01-28 12:12 - 2010-01-29 23:58 - 00000000 ____D () C:\Program Files (x86)\MyWebEx
2014-01-28 12:12 - 2010-01-26 17:21 - 00000000 ____D () C:\Users\walta\AppData\Local\Google
2014-01-27 19:35 - 2014-01-27 19:35 - 00000000 _____ () C:\Windows\SysWOW64\FAP7C20.tmp
2014-01-25 18:42 - 2012-11-20 18:57 - 00000000 ____D () C:\Users\walta\Documents\bkck
2014-01-16 09:59 - 2010-03-28 18:39 - 00270496 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
Files to move or delete:
====================
C:\Users\walta\Prodigio_windows-x64.exe
Some content of TEMP:
====================
C:\Users\walta\AppData\Local\Temp\JingSetup.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-02-08 00:12
==================== End Of Log ============================