[RESOLVED] Major computer problem help please.

[ddpdave]

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 23-11-2014 01
Ran by Dave at 2014-11-23 17:17:38 Run:1
Running from C:\Users\Dave\Desktop
Loaded Profiles: Dave & Mcx1-DAVE-PC (Available profiles: Dave & Mcx1-DAVE-PC)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
HKLM-x32\...\Run: [] => [X]
HKU\S-1-5-21-2106700370-2949406046-2204505092-1006\...\Winlogon: [Shell] C:\Windows\eHome\McrMgr.exe [343552 2009-07-13] (Microsoft Corporation) <==== ATTENTION
HKU\S-1-5-21-2106700370-2949406046-2204505092-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
SearchScopes: HKU\S-1-5-21-2106700370-2949406046-2204505092-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO-x32: Windows Live Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll No File
BHO-x32: Adobe PDF Conversion Toolbar Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll No File
Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll No File
CHR HKLM-x32\...\Chrome\Extension: [blklojfklgnogjaijkibhfjepakiocng] - C:\Users\Dave\AppData\Local\CRE\blklojfklgnogjaijkibhfjepakiocng.crx []
C:\Users\Dave\AppData\Local\CRE\blklojfklgnogjaijkibhfjepakiocng.crx
S3 FLEXnet Licensing Service; "C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe" [X]
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
C:\Users\Dave\AppData\Local\Temp\Quarantine.exe
C:\Users\Dave\AppData\Local\Temp\sqlite3.dll
AlternateDataStreams: C:\ProgramData\TEMP:373E1720
*****************

HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\ => value deleted successfully.
HKU\S-1-5-21-2106700370-2949406046-2204505092-1006\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell => value deleted successfully.
"HKU\S-1-5-21-2106700370-2949406046-2204505092-1001\SOFTWARE\Policies\Microsoft\Internet Explorer" => Key deleted successfully.
"HKU\S-1-5-21-2106700370-2949406046-2204505092-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" => Key deleted successfully.
"HKCR\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" => Key not found.
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}" => Key deleted successfully.
"HKCR\Wow6432Node\CLSID\{9030D464-4C02-4ABF-8ECC-5164760863C6}" => Key deleted successfully.
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE7CD045-E861-484f-8273-0445EE161910}" => Key deleted successfully.
"HKCR\Wow6432Node\CLSID\{AE7CD045-E861-484f-8273-0445EE161910}" => Key Deleted successfully.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\\{47833539-D0C5-4125-9FA8-0819E2EAAC93} => value deleted successfully.
"HKCR\Wow6432Node\CLSID\{47833539-D0C5-4125-9FA8-0819E2EAAC93}" => Key Deleted successfully.
"HKLM\Software\Wow6432Node\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0" => Key deleted successfully.
"HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\blklojfklgnogjaijkibhfjepakiocng" => Key deleted successfully.
"C:\Users\Dave\AppData\Local\CRE\blklojfklgnogjaijkibhfjepakiocng.crx" => File/Directory not found.
"C:\Users\Dave\AppData\Local\CRE\blklojfklgnogjaijkibhfjepakiocng.crx" => File/Directory not found.
FLEXnet Licensing Service => Service deleted successfully.
catchme => Service deleted successfully.
Synth3dVsc => Service deleted successfully.
tsusbhub => Service deleted successfully.
VGPU => Service deleted successfully.
C:\Users\Dave\AppData\Local\Temp\Quarantine.exe => Moved successfully.
C:\Users\Dave\AppData\Local\Temp\sqlite3.dll => Moved successfully.
C:\ProgramData\TEMP => ":373E1720" ADS removed successfully.

==== End of Fixlog ====

[Broni]

How is computer doing?

Last scans...

Download Security Check from here or here and save it to your Desktop.

• Double-click SecurityCheck.exe
• Follow the onscreen instructions inside of the black box.
• A Notepad document should open automatically called checkup.txt; please post the contents of that document.

NOTE 1. If one of your security applications (e.g., third-party firewall) requests permission to allow DIG.EXE access the Internet, allow it to do so.
NOTE 2. SecurityCheck may produce some false warning(s), so leave the results reading to me.
NOTE 3. If you receive UNSUPPORTED OPERATING SYSTEM! ABORTED! message restart computer and Security Check should run


Please download Farbar Service Scanner (FSS) and run it on the computer with the issue.

• Make sure the following options are checked:
  
  
  • Internet Services
  • Windows Firewall
  • System Restore
  • Security Center
  • Windows Update
  • Windows Defender
  • Other Services
  
  
• Press "Scan".
• It will create a log (FSS.txt) in the same directory the tool is run.
• Please copy and paste the log to your reply.

Download Temp File Cleaner (TFC)
Alternate download: http://www.itxassociates.com/OT-Tools/TFC.exe

• Double click on TFC.exe to run the program.
• Click on Start button to begin cleaning process.
• TFC will close all running programs, and it may ask you to restart computer.

Download Sophos Free Virus Removal Tool and save it to your desktop.

• Double click the icon and select Run
• Click Next
• Select I accept the terms in this license agreement, then click Next twice
• Click Install
• Click Finish to launch the program
• Once the virus database has been updated click Start Scanning
• If any threats are found click Details, then View log file... (bottom left hand corner)
• Copy and paste the results in your reply
• Close the Notepad document, close the Threat Details screen, then click Start cleanup
• Click Exit to close the program

[ddpdave]

Results of screen317's Security Check version 0.99.90
Windows 7 Service Pack 1 x64 (UAC is disabled!)
Internet Explorer 11
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Enabled!
Windows Firewall Disabled!
avast! Antivirus
Antivirus up to date!
`````````Anti-malware/Other Utilities Check:`````````
Java 7 Update 67
Java(TM) 6 Update 17
Java version out of Date!
Adobe Flash Player 9 Flash Player out of Date!
Adobe Flash Player 15.0.0.223
Mozilla Firefox (33.1)
````````Process Check: objlist.exe by Laurent````````
Malwarebytes Anti-Malware mbamservice.exe
Malwarebytes Anti-Malware mbam.exe
mbamscheduler.exe
AVAST Software Avast AvastSvc.exe
AVAST Software Avast avastui.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: 18% Defragment your hard drive soon! (Do NOT defrag if SSD!)
````````````````````End of Log``````````````````````

[ddpdave]

Farbar Service Scanner Version: 21-07-2014
Ran by Dave (administrator) on 23-11-2014 at 21:08:45
Running from "C:\Users\Dave\Downloads"
Microsoft Windows 7 Ultimate Service Pack 1 (X64)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.


Windows Firewall:
=============

Firewall Disabled Policy:
==================
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall"=DWORD:0


System Restore:
============

System Restore Disabled Policy:
========================


Action Center:
============


Windows Update:
============

Windows Autoupdate Disabled Policy:
============================


Windows Defender:
==============

Other Services:
==============


File Check:
========
C:\Windows\System32\nsisvc.dll => File is digitally signed
C:\Windows\System32\drivers\nsiproxy.sys => File is digitally signed
C:\Windows\System32\dhcpcore.dll => File is digitally signed
C:\Windows\System32\drivers\afd.sys => File is digitally signed
C:\Windows\System32\drivers\tdx.sys => File is digitally signed
C:\Windows\System32\Drivers\tcpip.sys => File is digitally signed
C:\Windows\System32\dnsrslvr.dll => File is digitally signed
C:\Windows\System32\mpssvc.dll => File is digitally signed
C:\Windows\System32\bfe.dll => File is digitally signed
C:\Windows\System32\drivers\mpsdrv.sys => File is digitally signed
C:\Windows\System32\SDRSVC.dll => File is digitally signed
C:\Windows\System32\vssvc.exe => File is digitally signed
C:\Windows\System32\wscsvc.dll => File is digitally signed
C:\Windows\System32\wbem\WMIsvc.dll => File is digitally signed
C:\Windows\System32\wuaueng.dll => File is digitally signed
C:\Windows\System32\qmgr.dll => File is digitally signed
C:\Windows\System32\es.dll => File is digitally signed
C:\Windows\System32\cryptsvc.dll => File is digitally signed
C:\Program Files\Windows Defender\MpSvc.dll => File is digitally signed
C:\Windows\System32\ipnathlp.dll => File is digitally signed
C:\Windows\System32\iphlpsvc.dll => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed


**** End of log ****

[ddpdave]

I copied AFTER I ran cleanup by accident.

computer seems to still have the problem of C: drive shrinking slowly. Yesterday it didn't seem to but today it is.
Firefox takes up a lot of memory and so does svchost.exe

2014-11-24 02:27:56.116 Sophos Virus Removal Tool version 2.5.3
2014-11-24 02:27:56.116 Copyright (c) 2009-2014 Sophos Limited. All rights reserved.

2014-11-24 02:27:56.116 This tool will scan your computer for viruses and other threats. If it finds any, it will give you the option to remove them.

2014-11-24 02:27:56.116 Windows version 6.1 SP 1.0 Service Pack 1 build 7601 SM=0x100 PT=0x1 WOW64
2014-11-24 02:27:56.119 Checking for updates...
2014-11-24 02:28:00.450 Update progress: proxy server not available
2014-11-24 02:28:21.103 Option all = no
2014-11-24 02:28:21.103 Option recurse = yes
2014-11-24 02:28:21.103 Option archive = no
2014-11-24 02:28:21.103 Option service = yes
2014-11-24 02:28:21.103 Option confirm = yes
2014-11-24 02:28:21.103 Option sxl = yes
2014-11-24 02:28:21.106 Option max-data-age = 35
2014-11-24 02:28:21.106 Option EnableSafeClean = yes
2014-11-24 02:28:23.025 Option vdl-logging = yes
2014-11-24 02:28:23.077 Component SVRTcli.exe version 2.5
2014-11-24 02:28:23.078 Component control.dll version 2.5
2014-11-24 02:28:23.078 Component SVRTservice.exe version 2.5
2014-11-24 02:28:23.078 Component engine\osdp.dll version 1.44.1.2171
2014-11-24 02:28:23.078 Component engine\veex.dll version 3.56.0.2171
2014-11-24 02:28:23.078 Component engine\savi.dll version 8.1.4.2171
2014-11-24 02:28:23.078 Component rkdisk.dll version 1.5.30.0
2014-11-24 02:28:23.078 Version info: Product version 2.5
2014-11-24 02:28:23.084 Version info: Detection engine 3.56.0
2014-11-24 02:28:23.084 Version info: Detection data 5.04
2014-11-24 02:28:23.084 Version info: Build date 29/07/2014
2014-11-24 02:28:23.084 Version info: Data files added 984
2014-11-24 02:28:23.084 Version info: Last successful update (not yet updated)
2014-11-24 02:28:46.488 Downloading updates...
2014-11-24 02:28:46.496 Update progress: [I96736] Looking for package C1A903B2-E63E-483b-982D-04BB9C457C60 1.0
2014-11-24 02:28:46.496 Update progress: [I49502] Found supplement SAVIW32 LATEST
2014-11-24 02:28:46.496 Update progress: [I49502] Found supplement IDE505 LATEST
2014-11-24 02:28:46.496 Update progress: [I49502] Found supplement IDE506 LATEST
2014-11-24 02:28:46.496 Update progress: [I49502] Found supplement IDE507 LATEST
2014-11-24 02:28:46.496 Update progress: [I49502] Found supplement IDE508 LATEST
2014-11-24 02:28:46.496 Update progress: [I49502] Found supplement IDE509 LATEST
2014-11-24 02:28:46.496 Update progress: [I49502] Found supplement IDE510 LATEST
2014-11-24 02:28:46.496 Update progress: [I49502] Found supplement IDE511 LATEST
2014-11-24 02:28:46.496 Update progress: [I19463] Syncing product C1A903B2-E63E-483b-982D-04BB9C457C60 1
2014-11-24 02:28:46.496 Update progress: [I19463] Syncing product SAVIW32 46
2014-11-24 02:29:03.748 Update progress: [I19463] Syncing product IDE505 175
2014-11-24 02:29:11.641 Installing updates...
2014-11-24 02:29:14.464 Update progress: [I19463] Syncing product IDE506 201
2014-11-24 02:29:14.464 Update progress: [I19463] Syncing product IDE507 162
2014-11-24 02:29:14.464 Update progress: [I19463] Syncing product IDE508 184
2014-11-24 02:29:14.464 Update progress: [I19463] Syncing product IDE509 177
2014-11-24 02:29:14.464 Update progress: [I19463] Syncing product IDE510 87
2014-11-24 02:29:14.464 Update progress: [I19463] Syncing product IDE511 1
2014-11-24 02:29:48.769 Update successful
2014-11-24 02:30:08.941 Option all = no
2014-11-24 02:30:08.941 Option recurse = yes
2014-11-24 02:30:08.941 Option archive = no
2014-11-24 02:30:08.941 Option service = yes
2014-11-24 02:30:08.941 Option confirm = yes
2014-11-24 02:30:08.941 Option sxl = yes
2014-11-24 02:30:08.944 Option max-data-age = 35
2014-11-24 02:30:08.944 Option EnableSafeClean = yes
2014-11-24 02:30:09.138 Option vdl-logging = yes
2014-11-24 02:30:09.182 Component SVRTcli.exe version 2.5
2014-11-24 02:30:09.182 Component control.dll version 2.5
2014-11-24 02:30:09.182 Component SVRTservice.exe version 2.5
2014-11-24 02:30:09.183 Component engine\osdp.dll version 1.44.1.2171
2014-11-24 02:30:09.183 Component engine\veex.dll version 3.56.0.2171
2014-11-24 02:30:09.183 Component engine\savi.dll version 8.1.4.2171
2014-11-24 02:30:09.184 Component rkdisk.dll version 1.5.30.0
2014-11-24 02:30:09.184 Version info: Product version 2.5
2014-11-24 02:30:09.188 Version info: Detection engine 3.56.0
2014-11-24 02:30:09.188 Version info: Detection data 5.04G
2014-11-24 02:30:09.189 Version info: Build date 29/07/2014
2014-11-24 02:30:09.189 Version info: Data files added 984
2014-11-24 02:30:09.189 Version info: Last successful update 23/11/2014 9:29:48 PM

2014-11-24 02:44:54.190 Could not open C:\Boot\BCD
2014-11-24 02:44:57.034 Could not open C:\hiberfil.sys
2014-11-24 04:26:45.862 Could not open C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb
2014-11-24 04:26:45.909 Could not open C:\Windows\System32\catroot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb
2014-11-24 04:43:39.834 Could not open D:\pagefile.sys
2014-11-24 04:56:04.369 >>> Virus 'Troj/Keygen-FU' found in file G:\Programs\Microsoft Office VERSIONS\Office 2010 - No Key Needed\MS Office 2010 Lifetime Activation + UpdateAble (x86+x64)\Office 2010 Toolkit.exe
2014-11-24 04:56:04.369 >>> Virus 'Troj/Keygen-FU' found in file HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA
2014-11-24 04:56:04.369 >>> Virus 'Troj/Keygen-FU' found in file HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA
2014-11-24 04:56:04.369 >>> Virus 'Troj/Keygen-FU' found in file HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin
2014-11-24 04:56:04.369 >>> Virus 'Troj/Keygen-FU' found in file HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin
2014-11-24 04:56:04.369 >>> Virus 'Troj/Keygen-FU' found in file HKU\S-1-5-21-2106700370-2949406046-2204505092-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\WarnOnPostRedirect
2014-11-24 04:56:04.369 >>> Virus 'Troj/Keygen-FU' found in file HKU\S-1-5-21-2106700370-2949406046-2204505092-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\WarnOnPostRedirect
2014-11-24 04:56:04.369 >>> Virus 'Troj/Keygen-FU' found in file HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\WarnOnPostRedirect
2014-11-24 04:56:13.886 >>> Virus 'Troj/Keygen-FU' found in file G:\Programs\Microsoft Office VERSIONS\Office 2010 - No Key Needed\Office 2010 Toolkit and EZ-Activator v 2.1.6 Final\Office 2010 Toolkit.exe
2014-11-24 04:56:13.886 >>> Virus 'Troj/Keygen-FU' found in file HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA
2014-11-24 04:56:13.886 >>> Virus 'Troj/Keygen-FU' found in file HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA
2014-11-24 04:56:13.902 >>> Virus 'Troj/Keygen-FU' found in file HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin
2014-11-24 04:56:13.902 >>> Virus 'Troj/Keygen-FU' found in file HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin
2014-11-24 04:56:13.902 >>> Virus 'Troj/Keygen-FU' found in file HKU\S-1-5-21-2106700370-2949406046-2204505092-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\WarnOnPostRedirect
2014-11-24 04:56:13.902 >>> Virus 'Troj/Keygen-FU' found in file HKU\S-1-5-21-2106700370-2949406046-2204505092-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\WarnOnPostRedirect
2014-11-24 04:56:13.902 >>> Virus 'Troj/Keygen-FU' found in file HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\WarnOnPostRedirect
2014-11-24 05:00:29.111 Could not open LOGICAL:0008:00000000
2014-11-24 05:00:29.267 Could not open I:\
2014-11-24 05:00:29.330 Could not open LOGICAL:0009:00000000
2014-11-24 05:00:29.455 Could not open J:\
2014-11-24 05:00:29.517 Could not open LOGICAL:000A:00000000
2014-11-24 05:00:29.626 Could not open K:\
2014-11-24 05:00:29.689 Could not open LOGICAL:000C:00000000
2014-11-24 05:00:29.814 Could not open M:\
2014-11-24 05:00:29.814 Could not open LOGICAL:000D:00000000
2014-11-24 05:00:29.814 Could not open N:\
2014-11-24 05:00:29.939 Could not open PHYSICAL:0082:0000:0000:0001
2014-11-24 05:00:29.970 Could not open PHYSICAL:0083:0000:0000:0001
2014-11-24 05:00:30.001 Could not open PHYSICAL:0084:0000:0000:0001
2014-11-24 05:00:30.033 Could not open PHYSICAL:0085:0000:0000:0001
2014-11-24 05:00:30.064 Could not open PHYSICAL:0086:0000:0000:0001
2014-11-24 05:00:30.126 The following items will be cleaned up:
2014-11-24 05:00:30.126 Troj/Keygen-FU
2014-11-24 14:31:51.248 Threat 'Troj/Keygen-FU' has been cleaned up.
2014-11-24 14:31:51.263 File "G:\Programs\Microsoft Office VERSIONS\Office 2010 - No Key Needed\MS Office 2010 Lifetime Activation + UpdateAble (x86+x64)\Office 2010 Toolkit.exe" belongs to 'Troj/Keygen-FU'.
2014-11-24 14:31:51.294 File "G:\Programs\Microsoft Office VERSIONS\Office 2010 - No Key Needed\MS Office 2010 Lifetime Activation + UpdateAble (x86+x64)\Office 2010 Toolkit.exe" has been cleaned up.
2014-11-24 14:31:51.294 File "G:\Programs\Microsoft Office VERSIONS\Office 2010 - No Key Needed\Office 2010 Toolkit and EZ-Activator v 2.1.6 Final\Office 2010 Toolkit.exe" belongs to 'Troj/Keygen-FU'.
2014-11-24 14:31:51.294 File "G:\Programs\Microsoft Office VERSIONS\Office 2010 - No Key Needed\Office 2010 Toolkit and EZ-Activator v 2.1.6 Final\Office 2010 Toolkit.exe" has been cleaned up.
2014-11-24 14:31:51.294 Registry value "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA" belongs to 'Troj/Keygen-FU'.
2014-11-24 14:31:51.294 Registry value "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA" has been cleaned up.
2014-11-24 14:31:51.294 Registry value "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin" belongs to 'Troj/Keygen-FU'.
2014-11-24 14:31:51.294 Registry value "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin" has been cleaned up.
2014-11-24 14:31:51.294 Registry value "HKU\S-1-5-21-2106700370-2949406046-2204505092-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\WarnOnPostRedirect" belongs to 'Troj/Keygen-FU'.
2014-11-24 14:31:51.294 Registry value "HKU\S-1-5-21-2106700370-2949406046-2204505092-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\WarnOnPostRedirect" has been cleaned up.
2014-11-24 14:31:51.294 Registry value "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\WarnOnPostRedirect" belongs to 'Troj/Keygen-FU'.
2014-11-24 14:31:51.294 Registry value "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\WarnOnPostRedirect" has been cleaned up.
2014-11-24 14:31:51.326 Removal successful
2014-11-24 14:31:51.388 Contents of SafeClean bin directory:
2014-11-24 14:31:51.404 {
2014-11-24 14:31:51.404 RecordID : "0000000000000001",
2014-11-24 14:31:51.404 ItemType : "1",
2014-11-24 14:31:51.404 Location : "G:\Programs\Microsoft Office VERSIONS\Office 2010 - No Key Needed\MS Office 2010 Lifetime Activation + UpdateAble (x86+x64)\",
2014-11-24 14:31:51.404 FileName : "Office 2010 Toolkit.exe",
2014-11-24 14:31:51.404 ThreatName : "Troj/Keygen-FU",
2014-11-24 14:31:51.404 Checksum : "9722bf3ccdc97c94db8c54589de51f33da238a43dbf5bf7428ab7aca99ad9e7c",
2014-11-24 14:31:51.404 TimeStamp : "Mon Nov 24 09:31:23 2014"
2014-11-24 14:31:51.404 }
2014-11-24 14:31:51.404 {
2014-11-24 14:31:51.404 RecordID : "0000000000000002",
2014-11-24 14:31:51.404 ItemType : "1",
2014-11-24 14:31:51.404 Location : "G:\Programs\Microsoft Office VERSIONS\Office 2010 - No Key Needed\Office 2010 Toolkit and EZ-Activator v 2.1.6 Final\",
2014-11-24 14:31:51.404 FileName : "Office 2010 Toolkit.exe",
2014-11-24 14:31:51.404 ThreatName : "Troj/Keygen-FU",
2014-11-24 14:31:51.404 Checksum : "fd8330e87b43c7a37cec2ea3c267de41e39776e1267ae3b34fe6766aab077d46",
2014-11-24 14:31:51.404 TimeStamp : "Mon Nov 24 09:31:23 2014"
2014-11-24 14:31:51.404 }

[Broni]

Update Adobe Flash Player: http://get.adobe.com/flashplayer/
Make sure you UN-check Yes, install McAfee Security Scan Plus

NOTE 1: Beginning with Adobe Flash Version 11.3, the universal installer includes the 32-bit and 64-bit versions of the Flash Player.
NOTE 2: While installing make sure you UN-check any extra garbage which wants to install alongside.

Update your Java version here: http://www.java.com/en/download/manual.jsp
Alternate download: http://www.filehippo.com/search?q=java

Note 1: UNCHECK any pre-checked toolbar and/or software offered with the Java update. The pre-checked toolbars/software are not part of the Java update.

Note 2: If you're running 64-bit system make sure you install BOTH, 32-bit and 64-bit Java.

Note 3: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications. If you don't want to run another extra service, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click OK and restart your computer.

==========================================

Your computer is clean

1. This step will remove all cleaning tools we used, it'll reset restore points (so you won't get reinfected by accidentally using some older restore point) and it'll make some other minor adjustments...
This is a very crucial step so make sure you don't skip it.
Download DelFix by Xplode to your desktop. Delfix will delete all the used tools and logfiles.

Double-click Delfix.exe to start the tool.
Make sure the following items are checked:

• Activate UAC (optional; some users prefer to keep it off)
• Remove disinfection tools
• Create registry backup
• Purge System Restore
• Reset system settings

Now click "Run" and wait patiently.
Once finished a logfile will be created. You don't have to attach it to your next reply.

2. Make sure Windows Updates are current.

3. If any trojans, rootkits or bootkits were listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately!

4. Check if your browser plugins are up to date.
Firefox - https://www.mozilla.org/en-US/plugincheck/
other browsers: https://browsercheck.qualys.com/ (click on "Launch a quick scan now" link)

5. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.

6. Run Malwarebytes "Quick scan" once in a while to assure safety of your computer.

7. Run Temporary File Cleaner (TFC), AdwCleaner and Junkware Removal Tool (JRT) weekly (you need to redownload these tools since they were removed by DelFix).

8. Download and install Secunia Personal Software Inspector (PSI): http://secunia.com/vulnerability_scanning/personal/. The Secunia PSI is a FREE security tool designed to detect vulnerable and out-dated programs and plug-ins which expose your PC to attacks. Run it weekly.

9. (optional) If you want to keep all your programs up to date, download and install FileHippo Update Checker.
The Update Checker will scan your computer for installed software, check the versions and then send this information to FileHippo.com to see if there are any newer releases.

10. When installing\updating ANY program, make sure you always select "Custom " installation, so you can UN-check any possible "drive-by-install" (foistware), like toolbars etc., which may try to install along with the legitimate program. Do NOT click "Next" button without looking at any given page.

11. Read:
How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html
Simple and easy ways to keep your computer safe and secure on the Internet: http://www.bleepingcomputer.com/tuto...r-safe-online/
About those Toolbars and Add-ons - Potentially Unwanted Programs (PUPs) which change your browser settings: http://www.bleepingcomputer.com/foru.../#entry3187642

===========================================

Now...

In this forum, we make sure, your computer is free of malware and your computer is clean
Because the access to malware forum is very limited, your best option is to create new topic about your current issue, at Windows section.
You'll get more attention.

Good luck

[ddpdave]

Thanks a ton for this, I will finish this last part as soon as I get a chance. Question: how would I go about doing the same with my laptop computer which is responding slowly...doesn't have the shrinking hard drive but...
thanks

[Train]

Start a new thread for the laptop and follow the same initial instructions.,

[Broni]

Thanks Train

[ddpdave]

C: drive is starting to shrink again...argh!

[Broni]

How much?
More details please.

[ddpdave]

I would have 378mb left.
Start int explorer....I can hear the computer working....
all of a sudden I'll get a C:drive is really low, click here to free up some.

I'll open up my computer to track the status..
it will be 178mb or something...and dropping...176mb, 172mb, back up to 175mb

[Broni]

Your C partition is definitely to small - 44.44 GB
You have to have at least 10% (5GB) free for Windows to work properly.
378mb is way too little.
You have to make more space or repartition entire drive.

[ddpdave]

THat is clear. So its not a virus or something causing it to shrink? AT one point I had it at 3GB free.
Its TIME to reformat this computer me thinks. Then my laptop. They both are driving me nuts. I'm gonna just install the bare minimum I need. Thanks broni

[ddpdave]

Your C partition is definitely to small - 44.44 GB
You have to have at least 10% (5GB) free for Windows to work properly.
378mb is way too little.
You have to make more space or repartition entire drive.

I did try to make more room without success. I did delete adobe programs that got me up to 3GB free...but then it slowly swept away. I started installing all stuff to my D: drive.