Help with Removing edeals

[bowden769]

Hi

I have being trying to remove edeals for my pc today.

I have removed it from the control panel also the extensions from IE, GC and Firefox. But it still comes up.

Also i used CCleaner, Cloud System Booster, Malwarebytes and MSE. Along with numerous google searches..

I am also have problems with my internet connection it keeps change to proxy servers.

Its really starting to annoy me

Any help would be greatly received

 

[AddRAM]

Re install windows

You downloaded and installed and did not pay attention to the checkboxes

But, you can try a system restore.

 

[bowden769]

I was afraid some one would say that

How do i go about it then, i dont want to lose all my music, docs, and photos?

 

[AddRAM]

A system restore ?

You won`t loose anything.

You should back up all your data now, before you attempt anything.

 

[fireberd]

I had some success getting rid of junk that Malwarebytes and others wouldn't with "Hitman Pro"

HitmanPro 3 - SurfRight

 

[NimoTony]

READ THIS

Remove "Ads by eDeals" virus (Easy Removal Guide)

 

[bowden769]

READ THIS

Remove "Ads by eDeals" virus (Easy Removal Guide)

I have done that, with no luck ??

 

[NimoTony]

do you follow ALL 6 steps?

 

[bowden769]

I don't think i have ever backed up before, certainly never in the 3 year of owned the PC.

But i think fireberd may have solved my problem, done a scan and removed 47 items that the others did not pick up...........

Fingers crossed

Ben

 

[PSCO2007]

Not having a backup is a recipe for disaster.

Had you done this, you could have just restored a clean image.

Here's what you need to do -

You can use Macrium ( free) to create the image.

http://www.majorgeeks.com/content/pa...2270j1060538j7


Be careful when downloading to always click "custom" and decline any of the crap it wants to add - i.e. changing search engines, home page, etc.

Make a boot cd( instructions on main page) and also after creating the image, do a Verify.

I do this by clicking Restore and browsing for the created image and you will see a link to Verify.

Put the image on [FONT=inherit !important]a different internal hdd and if you have an external hdd[/FONT], put one there as well.

Do an image backup periodically, (I do it once a week or after any major changes).

 

[bowden769]

it back again lol

Help me please

 

[Jacee]

First, let's clean the 'dirty' DNS cache and restore MS's Hosts file.

Copy and paste these lines in Note pad.

@Echo on
pushd\windows\system32\drivers\etc
attrib -h -s -r hosts
echo 127.0.0.1 localhost>HOSTS
attrib +r +h +s hosts
popd
ipconfig /release
ipconfig /renew
ipconfig /flushdns
netsh winsock reset all
netsh int ip reset all
shutdown -r -t 1
del %0

Save as flush.bat to your desktop.

Windows 7... right click the .bat file and choose to run as Administrator. Your computer will reboot itself.

Next, download AdwCleaner by Xplode and save to your Desktop.
Step 1.

• Double click on AdwCleaner.exe to run the tool.
  Vista/Windows 7/8 users right-click and select Run As Administrator.
  
• Click on the Scan button.
• AdwCleaner will begin...be patient as the scan may take some time to complete.
• After the scan has finished, click on the Report button...a logfile (AdwCleaner[R#].txt) will open in Notepad for review (where the largest value of # represents the most recent report).
• The contents of the log file may be confusing. Unless you see a program name that you know should not be removed, don't worry about it. If you see an entry you want to keep, let me know about it.
• Copy and paste the contents of that logfile in your next reply.
• A copy of all logfiles are saved in the C:\AdwCleaner folder which was created when running the tool.

Step 2.
Using AdwCleaner v3: Scan & Clean:
This time click on the Clean button.
Press OK when asked to close all programs and follow the onscreen prompts.
Press OK again to allow AdwCleaner to restart the computer and complete the removal process.
After rebooting, a logfile report (AdwCleaner[S#].txt) will open automatically (where the largest value of # represents the most recent report).
Copy and paste the contents of that logfile in your next reply.
A copy of that logfile will also be saved in the C:\AdwCleaner folder

******Post both .txt logs

 

[bowden769]

***** [ Services ] *****


***** [ Files / Folders ] *****

File Found : C:\Users\Bowden\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.superfish.com_0.localstorage
File Found : C:\Users\Bowden\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.superfish.com_0.localstorage-journal

***** [ Scheduled tasks ] *****


***** [ Shortcuts ] *****


***** [ Registry ] *****

Data Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyEnable] - 1
Data Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyOverride] - <local>;*origin.com;*ea.com;*akamaihd.net
Data Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyServer] - hxxp=127.0.0.1:12671

***** [ Web browsers ] *****

-\\ Internet Explorer v11.0.9600.17631


-\\ Mozilla Firefox v35.0.1 (x86 en-US)


-\\ Google Chrome v40.0.2214.111

*************************

AdwCleaner[R0].txt - [6149 bytes] - [03/01/2015 19:26:19]
AdwCleaner[R1].txt - [1981 bytes] - [13/02/2015 18:05:19]
AdwCleaner[R2].txt - [1392 bytes] - [13/02/2015 21:46:37]
AdwCleaner[S0].txt - [5959 bytes] - [03/01/2015 19:27:26]
AdwCleaner[S1].txt - [2077 bytes] - [13/02/2015 18:07:06]

########## EOF - C:\AdwCleaner\AdwCleaner[R2].txt - [1569 bytes] ##########


file from adwcleaner

How to get v3?

 

[bowden769]

after reboot report


# Option : Cleaning

***** [ Services ] *****


***** [ Files / Folders ] *****

File Deleted : C:\Users\Bowden\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.superfish.com_0.localstorage
File Deleted : C:\Users\Bowden\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.superfish.com_0.localstorage-journal

***** [ Scheduled tasks ] *****


***** [ Shortcuts ] *****


***** [ Registry ] *****

Data Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyOverride] - <local>;*origin.com;*ea.com;*akamaihd.net
Data Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyServer] - hxxp=127.0.0.1:12671
Data Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyEnable] - 1

***** [ Web browsers ] *****

-\\ Internet Explorer v11.0.9600.17631


-\\ Mozilla Firefox v35.0.1 (x86 en-US)


-\\ Google Chrome v40.0.2214.111


*************************

AdwCleaner[R0].txt - [6149 bytes] - [03/01/2015 19:26:19]
AdwCleaner[R1].txt - [1981 bytes] - [13/02/2015 18:05:19]
AdwCleaner[R2].txt - [1648 bytes] - [13/02/2015 21:46:37]
AdwCleaner[S0].txt - [5959 bytes] - [03/01/2015 19:27:26]
AdwCleaner[S1].txt - [2077 bytes] - [13/02/2015 18:07:06]
AdwCleaner[S2].txt - [1585 bytes] - [13/02/2015 21:52:54]

########## EOF - C:\AdwCleaner\AdwCleaner[S2].txt - [1644 bytes] ##########

 

[Jacee]

Please download TFC by Old Timer TFC - Temp File Cleaner by OldTimer - Geeks to Go Forum and save it to your desktop.
Save any unsaved work. TFC will close ALL open programs including your browser! This will also eliminate all desktop shortcuts, so just be aware!

Using Vista/Windows 7 right-click on the file and choose Run As Administrator.
Click the Start button to begin the cleaning process and let it run uninterrupted to completion.

Important! Manually reboot the machine to ensure a complete clean.

Once rebooted, tell me if you still have edeals showing up.

 

[bowden769]

yep still got edeals

i am growing to love it now lol

 

[Jacee]

Let's see where it might be hiding......
Download DDS from one of these links:
DDS.com
DDS.pif

• Disable any script blocking protection
• Double click the dds icon to run the tool.
• When done, DDS will open two (2) logs:
  1. DDS.txt
  2. Attach.txt <--- will be minimized in the task tray
• Save both reports to your desktop.

Include the contents of both logs in your next post.

 

[bowden769]

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2012-11-20.01)
.
Microsoft Windows 7 Home Premium
Boot Device: \Device\HarddiskVolume1
Install Date: 18/12/2011 01:45:42
System Uptime: 23/02/2015 20:00:04 (0 hours ago)
.
Motherboard: LENOVO | | To be filled by O.E.M.
Processor: Intel(R) Core(TM) i5-2320 CPU @ 3.00GHz | CPU 1 | 3001/100mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 906 GiB total, 780.878 GiB free.
D: is CDROM ()
.
==== Disabled Device Manager Items =============
.
Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}
Description: Microsoft Teredo Tunneling Adapter
Device ID: ROOT\*TEREDO\0000
Manufacturer: Microsoft
Name: Teredo Tunneling Pseudo-Interface
PNP Device ID: ROOT\*TEREDO\0000
Service: tunnel
.
==== System Restore Points ===================
.
RP469: 12/02/2015 19:25:58 - Scheduled Checkpoint
RP470: 12/02/2015 21:53:37 - Windows Update
RP471: 13/02/2015 17:55:03 - Checkpoint by HitmanPro
RP472: 13/02/2015 18:41:25 - Checkpoint by HitmanPro
RP473: 13/02/2015 18:41:38 - Checkpoint by HitmanPro
RP474: 13/02/2015 23:33:41 - Windows Update
RP475: 20/02/2015 14:42:37 - Windows Backup
RP476: 20/02/2015 21:50:53 - Windows Update
.
==== Installed Programs ======================
.
Adobe AIR
Adobe Download Assistant
Adobe Flash Player 16 ActiveX
Adobe Flash Player 16 NPAPI
Adobe Reader 64-bit fixes
Adobe Reader XI (11.0.09)
Adobe Refresh Manager
aioscnnr
Apple Application Support
Apple Mobile Device Support
Apple Software Update
BBC iPlayer Downloads
Bonjour
C4USelfUpdater
CameraHelperMsi
CCleaner
center
Cloud System Booster
D3DX10
Dropbox
erLT
essentials
FAT Sorter
Free MP3 WMA OGG Converter 8.9.1
Garmin BaseCamp
Garmin Communicator Plugin
Garmin Communicator Plugin x64
Garmin USB Drivers
Garmin WebUpdater
Genesys USB Mass Storage Device
Google Chrome
Google Earth
Google Update Helper
Intel(R) Control Center
Intel(R) Management Engine Components
Intel(R) Network Connections Drivers
Intel(R) Processor Graphics
iTunes
Junk Mail filter update
Kodak AIO Printer
KODAK AiO Software
Lenovo Driver and Application Installation
Lenovo Dynamic Brightness System
Lenovo EE Boot Optimizer
Lenovo Eye Distance System
Lenovo Power2Go
Lenovo Rescue System
Lenovo Screensaver
Lenovo Tinian Fn PS/2 Keyboard Driver
Logitech Vid HD
Logitech Webcam Software
LVT
LWS Facebook
LWS Gallery
LWS Help_main
LWS Launcher
LWS Motion Detection
LWS Pictures And Video
LWS Twitter
LWS Video Mask Maker
LWS VideoEffects
LWS Webcam Software
LWS WLM Plugin
LWS YouTube Plugin
Malwarebytes Anti-Malware version 2.0.4.1028
Mesh Runtime
Microsoft .NET Framework 4.5.1
Microsoft Application Error Reporting
Microsoft Office Click-to-Run 2010
Microsoft Office Starter 2010 - English
Microsoft Security Client
Microsoft Security Essentials
Microsoft Silverlight
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2005 Redistributable (x64)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
Microsoft_VC80_CRT_x86
Microsoft_VC90_CRT_x86
Mozilla Firefox 35.0.1 (x86 en-US)
Mozilla Maintenance Service
Mp3tag v2.57
MSVCRT
MSVCRT_amd64
MyDriveConnect 3.3.0.1812
ocr
Picasa 3
PreReq
PrintProjects
Realtek High Definition Audio Driver
Security Update for CAPICOM (KB931906)
Security Update for Microsoft .NET Framework 4.5.1 (KB2894854v2)
Security Update for Microsoft .NET Framework 4.5.1 (KB2898869)
Security Update for Microsoft .NET Framework 4.5.1 (KB2901126)
Security Update for Microsoft .NET Framework 4.5.1 (KB2931368)
Security Update for Microsoft .NET Framework 4.5.1 (KB2972107)
Security Update for Microsoft .NET Framework 4.5.1 (KB2972216)
Security Update for Microsoft .NET Framework 4.5.1 (KB2978128)
Security Update for Microsoft .NET Framework 4.5.1 (KB2979578v2)
TomTom HOME
TomTom HOME Visual Studio Merge Modules
UK Truck Simulator 1.02
Visual Studio C++ 10.0 Runtime
Windows Driver Package - Garmin (grmnusb) GARMIN Devices (04/19/2012 2.3.1.0)
Windows Live Communications Platform
Windows Live Essentials
Windows Live ID Sign-in Assistant
Windows Live Installer
Windows Live Language Selector
Windows Live Mail
Windows Live Mesh
Windows Live Mesh ActiveX Control for Remote Connections
Windows Live Messenger
Windows Live MIME IFilter
Windows Live Movie Maker
Windows Live Photo Common
Windows Live Photo Gallery
Windows Live PIMT Platform
Windows Live Remote Client
Windows Live Remote Client Resources
Windows Live Remote Service
Windows Live Remote Service Resources
Windows Live SOXE
Windows Live SOXE Definitions
Windows Live UX Platform
Windows Live UX Platform Language Pack
Windows Live Writer
Windows Live Writer Resources
WinZip 16.0
.
==== Event Viewer Messages From Past Week ========
.
23/02/2015 20:02:22, Error: Service Control Manager [7022] - The appsambaRecovery.exe service hung on starting.
21/02/2015 08:52:56, Error: Service Control Manager [7006] - The ScRegSetValueExW call failed for FailureCommand with the following error: Access is denied.
21/02/2015 08:52:52, Error: Service Control Manager [7006] - The ScRegSetValueExW call failed for Start with the following error: Access is denied.
20/02/2015 21:38:43, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the wauctla Service service to connect.
20/02/2015 21:38:43, Error: Service Control Manager [7000] - The wauctla Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
.
==== End Of File ===========================

 

[bowden769]

DDS (Ver_2012-11-20.01) - NTFS_AMD64
Internet Explorer: 11.0.9600.17631
Run by Bowden at 20:06:02 on 2015-02-23
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.44.1033.18.4008.1428 [GMT 0:00]
.
AV: Microsoft Security Essentials *Enabled/Updated* {B7ECF8CD-0188-6703-DBA4-AA65C6ACFB0A}
SP: Microsoft Security Essentials *Enabled/Updated* {0C8D1929-27B2-688D-E114-9117BD2BB1B7}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\windows\system32\lsm.exe
C:\windows\system32\svchost.exe -k DcomLaunch
C:\windows\system32\svchost.exe -k RPCSS
c:\Program Files\Microsoft Security Client\MsMpEng.exe
C:\windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\windows\system32\svchost.exe -k LocalService
C:\windows\system32\svchost.exe -k netsvcs
C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
C:\windows\system32\svchost.exe -k NetworkService
C:\windows\System32\spoolsv.exe
C:\windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\windows\system32\taskhost.exe
C:\windows\system32\taskeng.exe
C:\Program Files (x86)\Anvisoft\Cloud System Booster\CSBSvc.exe
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\windows\system32\Dwm.exe
C:\windows\Explorer.EXE
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
C:\Users\Bowden\AppData\Local\appsambaRecovery\appsambaRecovery.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\jmesoft\Service.exe
C:\Program Files (x86)\Kodak\AiO\Center\EKAiOHostService.exe
C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
C:\Windows\SysWOW64\UMonit.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe
C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
C:\windows\system32\svchost.exe -k imgsvc
C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe
C:\Program Files (x86)\Logitech\Vid HD\Vid.exe
C:\Program Files (x86)\MyDrive Connect\MyDriveConnect.exe
C:\Program Files\CCleaner\CCleaner64.exe
C:\Program Files (x86)\Anvisoft\Cloud System Booster\CloudSystemBooster.exe
C:\Users\Bowden\AppData\Roaming\Dropbox\bin\Dropbox.exe
C:\windows\wauctla.exe
C:\Windows\jmesoft\hotkey.exe
C:\Windows\jmesoft\JME_LOAD.exe
C:\Program Files\Lenovo\Lenovo Eye Distance System\Lenovo Eye Distance System.exe
C:\Program Files\Lenovo\Lenovo Brightness System\Lenovo Dynamic Brightness System.exe
C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvc.exe
C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe
C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKStatusMonitor.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files (x86)\AirPrint\airprint.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
C:\Program Files\iPod\bin\iPodService.exe
c:\Program Files\Microsoft Security Client\NisSrv.exe
C:\windows\system32\SearchIndexer.exe
C:\windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Users\Bowden\AppData\Local\appsambaRecovery\defaultremote_86.exe
C:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\windows\system32\SearchProtocolHost.exe
C:\windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
C:\windows\System32\svchost.exe -k LocalServicePeerNet
C:\windows\system32\wbem\wmiprvse.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\windows\SysWOW64\frozentwextRec\frozentwextRec.exe
C:\windows\SysWOW64\keyboardhotstartapi\keyboardhotstartapi.exe
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
C:\windows\system32\sppsvc.exe
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
C:\windows\system32\wbem\wmiprvse.exe
C:\windows\system32\sdclt.exe
C:\windows\system32\SearchFilterHost.exe
C:\windows\servicing\TrustedInstaller.exe
C:\windows\System32\cscript.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.lenovo.com
uSearch Bar = Preserve
uDefault_Page_URL = hxxp://www.lenovo.com
mStart Page = Google
mDefault_Page_URL = Google
mDefault_Search_URL = Google
uProxyServer = hxxp=127.0.0.1:11378
uProxyOverride = <local>;*origin.com;*ea.com;*akamaihd.net
uSearchAssistant = hxxp://www.google.com
mWinlogon: Userinit = userinit.exe,
BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
uRun: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
uRun: [TomTomHOME.exe] "C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe"
uRun: [Logitech Vid] "C:\Program Files (x86)\Logitech\Vid HD\Vid.exe" -bootmode
uRun: [MyDriveConnect.exe] C:\Program Files (x86)\MyDrive Connect\MyDriveConnect.exe
uRun: [CCleaner Monitoring] "C:\Program Files\CCleaner\CCleaner64.exe" /MONITOR
uRun: [CloudSystemBooster] "C:\Program Files (x86)\Anvisoft\Cloud System Booster\CloudSystemBooster.exe" /hide /autorun
mRun: [jmekey] C:\windows\jmesoft\hotkey.exe
mRun: [jmesoft] C:\Windows\jmesoft\ServiceLoader.exe
mRun: [Lenovo Eye Distance System] C:\Program Files\Lenovo\Lenovo Eye Distance System\Lenovo Eye Distance System.exe 1
mRun: [Lenovo Dynamic Brightness System] C:\Program Files\Lenovo\Lenovo Brightness System\Lenovo Dynamic Brightness System.exe 1
mRun: [SetDefaultSCR] C:\Program Files (x86)\Lenovo\Lenovo Screensaver\SetDefaultSCR.exe
mRun: [CLMLServer] "C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvc.exe"
mRun: [UpdateP2GoShortCut] "C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\Lenovo\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0"
mRun: [UpdatePRCShortCut] "C:\Program Files\Lenovo\OneKey App\Lenovo Rescue System\MUITransfer\MUIStartMenu.exe" "C:\Program Files\Lenovo\OneKey App\Lenovo Rescue System" UpdateWithCreateOnce "Software\Lenovo\OneKey App\OneKey Recovery"
mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
mRun: [LWS] C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe -hide
mRun: [EKStatusMonitor] C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKStatusMonitor.exe
mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
dRunOnce: [KodakHomeCenter] "C:\Program Files (x86)\Kodak\AiO\Center\AiOHomeCenter.exe"
StartupFolder: C:\Users\Bowden\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Dropbox.lnk - C:\Users\Bowden\AppData\Roaming\Dropbox\bin\Dropbox.exe
uPolicies-Explorer: NoDrives = dword:0
uPolicies-Explorer: NoDriveTypeAutoRun = dword:145
mPolicies-Explorer: NoActiveDesktop = dword:1
mPolicies-Explorer: NoActiveDesktopChanges = dword:1
mPolicies-System: ConsentPromptBehaviorAdmin = dword:0
mPolicies-System: ConsentPromptBehaviorUser = dword:3
mPolicies-System: EnableLUA = dword:0
mPolicies-System: EnableUIADesktopToggle = dword:0
mPolicies-System: PromptOnSecureDesktop = dword:0
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
TCP: NameServer = 192.168.1.254
TCP: Interfaces\{D259C353-2F3D-44CE-A8D9-B65881961F19} : DHCPNameServer = 192.168.1.254
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
SSODL: WebCheck - <orphaned>
mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.115\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome
x64-mStart Page = hxxp://www.lenovo.com
x64-mDefault_Page_URL = hxxp://www.lenovo.com
x64-mDefault_Search_URL = Google
x64-BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
x64-Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s
x64-Run: [UMonit] C:\windows\SysWOW64\UMonit.exe
x64-Run: [Lenovo EE Boot Optimizer] C:\Program Files (x86)\Lenovo\Boot Optimizer\PopWnd.exe
x64-Run: [IgfxTray] C:\windows\System32\igfxtray.exe
x64-Run: [HotKeysCmds] C:\windows\System32\hkcmd.exe
x64-Run: [Persistence] C:\windows\System32\igfxpers.exe
x64-Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
x64-Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - <orphaned>
x64-Notify: igfxcui - igfxdev.dll
x64-SSODL: WebCheck - <orphaned>

 

[bowden769]

================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\Bowden\AppData\Roaming\Mozilla\Firefox\Profiles\y2qawbuv.default-1423850533726\
FF - plugin: C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL
FF - plugin: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll
FF - plugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll
FF - plugin: C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll
FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrlui.dll
FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: C:\windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll
FF - plugin: C:\windows\SysWOW64\npdeployJava1.dll
FF - plugin: C:\windows\SysWOW64\npmproxy.dll
.
============= SERVICES / DRIVERS ===============
.
R0 fbfmon;fbfmon;C:\windows\System32\drivers\fbfmon.sys [2011-10-18 57952]
R0 MpFilter;Microsoft Malware Protection Driver;C:\windows\System32\drivers\MpFilter.sys [2014-11-15 274696]
R0 WinI2C-DDC;WinI2C-DDC Kernel Mode Driver;C:\windows\System32\drivers\ddcdrv.sys [2011-10-18 20832]
R1 BPntDrv;BPntDrv;C:\windows\System32\drivers\BPntDrv.sys [2011-10-18 13408]
R2 AirPrint;AirPrint;C:\Program Files (x86)\AirPrint\airprint.exe -R _ipp._tcp,_universal -s --> C:\Program Files (x86)\AirPrint\airprint.exe -R _ipp._tcp,_universal -s [?]
R2 AnviCsbSvc;Anvi Cloud System Booster Speed Service;C:\Program Files (x86)\Anvisoft\Cloud System Booster\CSBSvc.exe [2014-8-20 42680]
R2 appsambaRecovery.exe;appsambaRecovery.exe;C:\Users\Bowden\AppData\Local\appsambaRecovery\appsambaRecovery.exe [2015-2-8 211968]
R2 cvhsvc;Client Virtualization Handler;C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE [2013-4-22 822504]
R2 frozentwextRec;frozentwextRec;C:\Windows\SysWOW64\frozentwextRec\frozentwextRec.exe [2015-1-1 68608]
R2 JME Keyboard;JME Keyboard Driver;C:\Windows\jmesoft\Service.exe [2011-10-18 32768]
R2 keyboardhotstartapi;keyboardhotstartapi;C:\Windows\SysWOW64\keyboardhotstartapi\keyboardhotstartapi.exe [2015-1-17 83456]
R2 Kodak AiO Network Discovery Service;Kodak AiO Network Discovery Service;C:\Program Files (x86)\Kodak\AiO\Center\EKAiOHostService.exe [2013-3-15 395640]
R2 Kodak AiO Status Monitor Service;Kodak AiO Status Monitor Service;C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe [2013-1-15 780152]
R2 NisDrv;Microsoft Network Inspection System;C:\windows\System32\drivers\NisDrvWFP.sys [2011-4-27 124560]
R2 sftlist;Application Virtualization Client;C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2013-6-26 523944]
R2 TomTomHOMEService;TomTomHOMEService;C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe [2014-6-5 93040]
R2 UMVPFSrv;UMVPFSrv;C:\Program Files (x86)\Common Files\LogiShrd\LVMVFM\UMVPFSrv.exe [2012-1-18 450848]
R2 UNS;Intel(R) Management and Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2011-10-18 2655768]
R2 wauctla Service;wauctla Service;C:\Windows\wauctla.exe [2015-2-8 188928]
R3 GeneStor;Genesys Logic Storage Driver;C:\windows\System32\drivers\GeneStor.sys [2011-10-18 57856]
R3 IntcDAud;Intel(R) Display Audio;C:\windows\System32\drivers\IntcDAud.sys [2011-4-11 317440]
R3 NisSrv;Microsoft Network Inspection;C:\Program Files\Microsoft Security Client\NisSrv.exe [2015-1-30 366512]
R3 Sftfs;Sftfs;C:\windows\System32\drivers\Sftfslh.sys [2013-6-26 767144]
R3 Sftplay;Sftplay;C:\windows\System32\drivers\Sftplaylh.sys [2013-6-26 273576]
R3 Sftredir;Sftredir;C:\windows\System32\drivers\Sftredirlh.sys [2013-6-26 28840]
R3 Sftvol;Sftvol;C:\windows\System32\drivers\Sftvollh.sys [2013-6-26 23208]
R3 sftvsa;Application Virtualization Service Agent;C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2013-6-26 207528]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2013-9-11 105144]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2013-9-11 124088]
S3 IEEtwCollectorService;Internet Explorer ETW Collector Service;C:\windows\System32\ieetwcollector.exe [2015-2-12 114688]
S3 LVPr2M64;Logitech LVPr2M64 Driver;C:\windows\System32\drivers\LVPr2M64.sys [2010-5-7 30304]
S3 LVRS64;Logitech RightSound Filter Driver;C:\windows\System32\drivers\lvrs64.sys [2012-1-18 351136]
S3 LVUVC64;Logitech HD Webcam C270(UVC);C:\windows\System32\drivers\lvuvc64.sys [2012-1-18 4865568]
S3 TsUsbFlt;TsUsbFlt;C:\windows\System32\drivers\TsUsbFlt.sys [2010-11-21 59392]
S3 TsUsbGD;Remote Desktop Generic USB Device;C:\windows\System32\drivers\TsUsbGD.sys [2010-11-21 31232]
S3 USBAAPL64;Apple Mobile USB Driver;C:\windows\System32\drivers\usbaapl64.sys [2014-7-28 54784]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\windows\System32\Wat\WatAdminSvc.exe [2011-12-22 1255736]
S3 WSDScan;WSD Scan Support via UMB;C:\windows\System32\drivers\WSDScan.sys [2009-7-14 25088]
S3 wsvd;wsvd;C:\windows\System32\drivers\wsvd.sys [2009-7-21 121840]
S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;C:\windows\System32\drivers\yk62x64.sys [2009-6-10 389120]
S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-23 57184]
.
=============== Created Last 30 ================
.
2015-02-21 08:53:00 11910896 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{46DCFBDA-D4B5-43DE-9B88-D2AD5AB9D1AD}\mpengine.dll
2015-02-15 13:45:04 11870360 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2015-02-13 18:28:42 -------- d-----w- C:\Program Files\HitmanPro
2015-02-13 18:00:10 814080 ----a-w- C:\windows\System32\jscript9diag.dll
2015-02-13 18:00:10 620032 ----a-w- C:\windows\SysWow64\jscript9diag.dll
2015-02-13 18:00:10 6041600 ----a-w- C:\windows\System32\jscript9.dll
2015-02-13 18:00:10 4300800 ----a-w- C:\windows\SysWow64\jscript9.dll
2015-02-12 19:06:59 968704 ----a-w- C:\windows\System32\MsSpellCheckingFacility.exe
2015-02-12 18:57:16 1188440 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{769B7427-8D9D-4558-8EE2-84B072C1D10E}\gapaengine.dll
2015-02-12 18:57:00 341504 ----a-w- C:\windows\System32\schannel.dll
2015-02-12 18:57:00 248832 ----a-w- C:\windows\SysWow64\schannel.dll
2015-02-12 18:56:59 728064 ----a-w- C:\windows\System32\kerberos.dll
2015-02-12 18:56:59 550912 ----a-w- C:\windows\SysWow64\kerberos.dll
2015-02-12 18:56:59 259584 ----a-w- C:\windows\SysWow64\msv1_0.dll
2015-02-12 18:56:58 86528 ----a-w- C:\windows\System32\TSpkg.dll
2015-02-12 18:56:58 65536 ----a-w- C:\windows\SysWow64\TSpkg.dll
2015-02-12 18:56:58 314880 ----a-w- C:\windows\System32\msv1_0.dll
2015-02-12 18:56:58 309760 ----a-w- C:\windows\System32\ncrypt.dll
2015-02-12 18:56:58 221184 ----a-w- C:\windows\SysWow64\ncrypt.dll
2015-02-12 18:56:58 210944 ----a-w- C:\windows\System32\wdigest.dll
2015-02-12 18:56:57 172032 ----a-w- C:\windows\SysWow64\wdigest.dll
2015-02-12 18:56:56 22016 ----a-w- C:\windows\System32\credssp.dll
2015-02-12 18:56:56 17408 ----a-w- C:\windows\SysWow64\credssp.dll
2015-02-12 18:25:31 187904 ----a-w- C:\windows\System32\cryptsvc.dll
2015-02-12 18:25:31 1480192 ----a-w- C:\windows\System32\crypt32.dll
2015-02-12 18:25:30 229376 ----a-w- C:\windows\System32\wintrust.dll
2015-02-12 18:25:30 1174528 ----a-w- C:\windows\SysWow64\crypt32.dll
2015-02-12 18:25:29 179200 ----a-w- C:\windows\SysWow64\wintrust.dll
2015-02-12 18:25:29 143872 ----a-w- C:\windows\SysWow64\cryptsvc.dll
2015-02-12 18:25:25 861696 ----a-w- C:\windows\System32\oleaut32.dll
2015-02-12 18:25:25 571904 ----a-w- C:\windows\SysWow64\oleaut32.dll
2015-02-12 18:25:24 3722752 ----a-w- C:\windows\System32\mstscax.dll
2015-02-12 18:25:24 3221504 ----a-w- C:\windows\SysWow64\mstscax.dll
2015-02-12 18:25:23 131584 ----a-w- C:\windows\SysWow64\aaclient.dll
2015-02-12 18:24:26 406528 ----a-w- C:\windows\System32\scesrv.dll
2015-02-12 18:24:26 308224 ----a-w- C:\windows\SysWow64\scesrv.dll
2015-02-12 18:24:21 5554112 ----a-w- C:\windows\System32\ntoskrnl.exe
2015-02-12 18:24:20 3972544 ----a-w- C:\windows\SysWow64\ntkrnlpa.exe
2015-02-12 18:24:20 3917760 ----a-w- C:\windows\SysWow64\ntoskrnl.exe
2015-02-12 18:24:19 503808 ----a-w- C:\windows\System32\srcore.dll
2015-02-12 18:24:19 50176 ----a-w- C:\windows\System32\srclient.dll
2015-02-12 18:24:19 43008 ----a-w- C:\windows\SysWow64\srclient.dll
2015-02-12 18:24:19 296960 ----a-w- C:\windows\System32\rstrui.exe
2015-02-12 18:23:09 3201536 ----a-w- C:\windows\System32\win32k.sys
2015-02-08 10:57:54 188928 ----a-w- C:\windows\wauctla.exe
2015-02-08 10:57:48 -------- d-----w- C:\Users\Bowden\AppData\Local\appsambaRecovery
.
==================== Find3M ====================
.
2015-02-13 18:31:14 129752 ----a-w- C:\windows\System32\drivers\MBAMSwissArmy.sys
2015-02-04 21:08:17 71344 ----a-w- C:\windows\SysWow64\FlashPlayerCPLApp.cpl
2015-02-04 21:08:17 701616 ----a-w- C:\windows\SysWow64\FlashPlayerApp.exe
2015-01-22 20:09:35 12872 ----a-w- C:\windows\System32\bootdelete.exe
2015-01-15 08:14:17 155072 ----a-w- C:\windows\System32\drivers\ksecpkg.sys
2015-01-15 08:14:16 95680 ----a-w- C:\windows\System32\drivers\ksecdd.sys
2015-01-15 08:09:58 29184 ----a-w- C:\windows\System32\sspisrv.dll
2015-01-15 08:09:58 136192 ----a-w- C:\windows\System32\sspicli.dll
2015-01-15 08:09:57 28160 ----a-w- C:\windows\System32\secur32.dll
2015-01-15 08:09:51 1461760 ----a-w- C:\windows\System32\lsasrv.dll
2015-01-15 08:09:15 31232 ----a-w- C:\windows\System32\lsass.exe
2015-01-15 08:08:59 64000 ----a-w- C:\windows\System32\auditpol.exe
2015-01-15 08:06:22 60416 ----a-w- C:\windows\System32\msobjs.dll
2015-01-15 08:06:11 146432 ----a-w- C:\windows\System32\msaudite.dll
2015-01-15 08:04:23 686080 ----a-w- C:\windows\System32\adtschema.dll
2015-01-15 07:42:59 22016 ----a-w- C:\windows\SysWow64\secur32.dll
2015-01-15 07:42:05 50176 ----a-w- C:\windows\SysWow64\auditpol.exe
2015-01-15 07:41:53 96768 ----a-w- C:\windows\SysWow64\sspicli.dll
2015-01-15 07:39:53 60416 ----a-w- C:\windows\SysWow64\msobjs.dll
2015-01-15 07:39:36 146432 ----a-w- C:\windows\SysWow64\msaudite.dll
2015-01-15 07:37:55 686080 ----a-w- C:\windows\SysWow64\adtschema.dll
2015-01-15 04:22:18 458824 ----a-w- C:\windows\System32\drivers\cng.sys
2015-01-13 03:10:22 1424384 ----a-w- C:\windows\System32\WindowsCodecs.dll
2015-01-13 02:49:19 1230336 ----a-w- C:\windows\SysWow64\WindowsCodecs.dll
2015-01-12 03:05:32 2724864 ----a-w- C:\windows\System32\mshtml.tlb
2015-01-12 03:05:19 4096 ----a-w- C:\windows\System32\ieetwcollectorres.dll
2015-01-12 02:49:42 66560 ----a-w- C:\windows\System32\iesetup.dll
2015-01-12 02:48:57 48640 ----a-w- C:\windows\System32\ieetwproxystub.dll
2015-01-12 02:48:52 584192 ----a-w- C:\windows\System32\vbscript.dll
2015-01-12 02:47:25 88064 ----a-w- C:\windows\System32\MshtmlDac.dll
2015-01-12 02:34:42 144384 ----a-w- C:\windows\System32\ieUnatt.exe
2015-01-12 02:34:30 114688 ----a-w- C:\windows\System32\ieetwcollector.exe
2015-01-12 02:21:19 2724864 ----a-w- C:\windows\SysWow64\mshtml.tlb
2015-01-12 02:13:27 77824 ----a-w- C:\windows\System32\JavaScriptCollectionAgent.dll
2015-01-12 02:08:09 503296 ----a-w- C:\windows\SysWow64\vbscript.dll
2015-01-12 02:07:51 62464 ----a-w- C:\windows\SysWow64\iesetup.dll
2015-01-12 02:07:06 47616 ----a-w- C:\windows\SysWow64\ieetwproxystub.dll
2015-01-12 02:05:36 64000 ----a-w- C:\windows\SysWow64\MshtmlDac.dll
2015-01-12 01:55:47 115712 ----a-w- C:\windows\SysWow64\ieUnatt.exe
2015-01-12 01:46:29 1359360 ----a-w- C:\windows\System32\mshtmlmedia.dll
2015-01-12 01:46:00 2125824 ----a-w- C:\windows\System32\inetcpl.cpl
2015-01-12 01:40:43 60416 ----a-w- C:\windows\SysWow64\JavaScriptCollectionAgent.dll
2015-01-12 01:27:32 2358272 ----a-w- C:\windows\System32\wininet.dll
2015-01-12 01:23:09 2052608 ----a-w- C:\windows\SysWow64\inetcpl.cpl
2015-01-12 01:22:17 1155072 ----a-w- C:\windows\SysWow64\mshtmlmedia.dll
2015-01-12 01:00:17 1888256 ----a-w- C:\windows\SysWow64\wininet.dll
2014-12-31 11:14:31 298120 ------w- C:\windows\System32\MpSigStub.exe
2014-12-19 03:06:55 210432 ----a-w- C:\windows\System32\profsvc.dll
2014-12-19 01:46:45 141312 ----a-w- C:\windows\System32\drivers\mrxdav.sys
2014-12-11 17:47:12 52736 ----a-w- C:\windows\System32\TSWbPrxy.exe
2014-12-06 04:17:27 303616 ----a-w- C:\windows\System32\nlasvc.dll
2014-12-06 03:50:19 52224 ----a-w- C:\windows\SysWow64\nlaapi.dll
2014-12-06 03:50:18 156672 ----a-w- C:\windows\SysWow64\ncsi.dll
.
============= FINISH: 20:08:38.43 ===============