#2 Harddrive, harddrive D, deleted? Please help.

Greetings, new here and hoping i can get some constructive help with my current problem. I'm a bit of a novice on this area.

So I figured i had some kind of security issue, malware? when my browser started going ''Sup'' on occasion. Basically directing me places other than the ones i had clicked.
I downloaded MalwareBytes in an attempt to get rid of the problem. Set it to scan and shut down. Came home later and attempted to start my PC. No luck, it got stuck at starting windows for 15+ mins and i had to hold down the button. I start up again, it says it was aware that it cudnt start and started to run some stuff. I eventually got in, but when i wanted to start my work my shortcut for the program was gone. My #2 harddrive had been deleted. My main harddrive appears completely fine.

Specs:

Genuine windows 7 64bit
Intel (R) core (TM) i7-2600k CPU @ 3.40GHz 3.70GHz


Any insight would be greatly appreciated thank you. If you require any specific informations about specs and the like other than what little i've posted, just let me know.

 

Not sure how to edit? But in any case i ran a recovery software. One called Recuva. It seems like its found my files. I would like to know though is it safe to just recover them? Any idea why my PC deleted them in the first place ? How do i prevent it from happening again?

Thank you very much in advance for any insights.

 

Hi and welcome to Computer Help Forums.
I have to go out and someone should be along to help you shortly.

 

Thank you for the heads-up.

 

Greetings Starbuck. Done as you requested:



MiniToolBox by Farbar Version: 23-01-2014
Ran by Rafael (administrator) on 22-02-2014 at 18:56:56
Running from "D:\downloadz"
Microsoft Windows 7 Home Premium Service Pack 1 (X64)
Boot Mode: Normal
***************************************************************************

========================= Flush DNS: ===================================

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.
========================= Hosts content: =================================




========================= Event log errors: ===============================

Application errors:
==================
Error: (02/22/2014 06:21:42 PM) (Source: Microsoft-Windows-LoadPerf) (User: NT AUTHORITY)
Description: Unloading the performance counter strings for service WmiApRpl (WmiApRpl) failed. The first DWORD in the Data section contains the error code.

Error: (02/22/2014 06:21:42 PM) (Source: Microsoft-Windows-LoadPerf) (User: NT AUTHORITY)
Description: The performance strings in the Performance registry value is corrupted when process Performance extension counter provider. The BaseIndex value from the Performance registry is the first DWORD in the Data section, LastCounter value is the second DWORD in the Data section, and LastHelp value is the third DWORD in the Data section.

Error: (02/22/2014 06:17:38 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/22/2014 05:28:51 PM) (Source: Microsoft-Windows-LoadPerf) (User: NT AUTHORITY)
Description: Unloading the performance counter strings for service WmiApRpl (WmiApRpl) failed. The first DWORD in the Data section contains the error code.

Error: (02/22/2014 05:28:51 PM) (Source: Microsoft-Windows-LoadPerf) (User: NT AUTHORITY)
Description: The performance strings in the Performance registry value is corrupted when process Performance extension counter provider. The BaseIndex value from the Performance registry is the first DWORD in the Data section, LastCounter value is the second DWORD in the Data section, and LastHelp value is the third DWORD in the Data section.

Error: (02/22/2014 05:24:48 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/22/2014 00:30:39 AM) (Source: SideBySide) (User: )
Description: Activation context generation failed for "rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"1".
Dependent Assembly rpshellextension.1.0,language="*",type="win32",version="1.0.0.0" could not be found.
Please use sxstrace.exe for detailed diagnosis.

Error: (02/21/2014 08:32:21 PM) (Source: Microsoft-Windows-LoadPerf) (User: NT AUTHORITY)
Description: Unloading the performance counter strings for service WmiApRpl (WmiApRpl) failed. The first DWORD in the Data section contains the error code.

Error: (02/21/2014 08:32:21 PM) (Source: Microsoft-Windows-LoadPerf) (User: NT AUTHORITY)
Description: The performance strings in the Performance registry value is corrupted when process Performance extension counter provider. The BaseIndex value from the Performance registry is the first DWORD in the Data section, LastCounter value is the second DWORD in the Data section, and LastHelp value is the third DWORD in the Data section.

Error: (02/21/2014 08:26:28 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


System errors:
=============
Error: (02/22/2014 06:15:48 PM) (Source: Service Control Manager) (User: )
Description: The Windows Image Acquisition (WIA) service depends on the Shell Hardware Detection service which failed to start because of the following error:
%%1058

Error: (02/22/2014 06:15:47 PM) (Source: Service Control Manager) (User: )
Description: The DisplayFusionService service failed to start due to the following error:
%%2

Error: (02/22/2014 06:15:47 PM) (Source: Service Control Manager) (User: )
Description: The avast! Antivirus service failed to start due to the following error:
%%1053

Error: (02/22/2014 06:15:47 PM) (Source: Service Control Manager) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the avast! Antivirus service to connect.

Error: (02/22/2014 06:12:03 PM) (Source: cdrom) (User: )
Description: The device, \Device\CdRom0, has a bad block.

Error: (02/22/2014 06:11:58 PM) (Source: cdrom) (User: )
Description: The device, \Device\CdRom0, has a bad block.

Error: (02/22/2014 06:11:52 PM) (Source: cdrom) (User: )
Description: The device, \Device\CdRom0, has a bad block.

Error: (02/22/2014 06:11:45 PM) (Source: cdrom) (User: )
Description: The device, \Device\CdRom0, has a bad block.

Error: (02/22/2014 06:11:39 PM) (Source: cdrom) (User: )
Description: The device, \Device\CdRom0, has a bad block.

Error: (02/22/2014 06:11:34 PM) (Source: cdrom) (User: )
Description: The device, \Device\CdRom0, has a bad block.


Microsoft Office Sessions:
=========================
Error: (02/22/2014 06:21:42 PM) (Source: Microsoft-Windows-LoadPerf)(User: NT AUTHORITY)
Description: WmiApRplWmiApRpl8F20300004D070000

Error: (02/22/2014 06:21:42 PM) (Source: Microsoft-Windows-LoadPerf)(User: NT AUTHORITY)
Description: Performance1637070000000000000000000009030000

Error: (02/22/2014 06:17:38 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/22/2014 05:28:51 PM) (Source: Microsoft-Windows-LoadPerf)(User: NT AUTHORITY)
Description: WmiApRplWmiApRpl8F20300004D070000

Error: (02/22/2014 05:28:51 PM) (Source: Microsoft-Windows-LoadPerf)(User: NT AUTHORITY)
Description: Performance1637070000000000000000000009030000

Error: (02/22/2014 05:24:48 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/22/2014 00:30:39 AM) (Source: SideBySide)(User: )
Description: rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"C:\Windows\Installer\{3DC873BB-FFE3-46BF-9701-26B9AE371F9F}\recordingmanager.exe

Error: (02/21/2014 08:32:21 PM) (Source: Microsoft-Windows-LoadPerf)(User: NT AUTHORITY)
Description: WmiApRplWmiApRpl8F20300004D070000

Error: (02/21/2014 08:32:21 PM) (Source: Microsoft-Windows-LoadPerf)(User: NT AUTHORITY)
Description: Performance1637070000000000000000000009030000

Error: (02/21/2014 08:26:28 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


CodeIntegrity Errors:
===================================
Date: 2013-04-22 19:06:16.081
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\CTAFX64.dll because the set of per-page image hashes could not be found on the system.

Date: 2013-04-22 19:06:01.790
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\CTAFX64.dll because the set of per-page image hashes could not be found on the system.

Date: 2013-04-22 19:02:30.487
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\CTAFX64.dll because the set of per-page image hashes could not be found on the system.

Date: 2013-04-22 19:02:14.341
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\CTAFX64.dll because the set of per-page image hashes could not be found on the system.

Date: 2013-04-22 18:57:27.545
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\CTAFX64.dll because the set of per-page image hashes could not be found on the system.

Date: 2013-04-22 18:57:21.593
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\CTAFX64.dll because the set of per-page image hashes could not be found on the system.

Date: 2013-04-22 18:56:15.552
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\CTAFX64.dll because the set of per-page image hashes could not be found on the system.

Date: 2013-04-22 18:46:06.464
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\CTAFX64.dll because the set of per-page image hashes could not be found on the system.

Date: 2013-04-22 18:44:36.687
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\CTAFX64.dll because the set of per-page image hashes could not be found on the system.

Date: 2013-04-22 18:43:33.265
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\CTAFX64.dll because the set of per-page image hashes could not be found on the system.


========================= Memory info: ===================================

Percentage of memory in use: 47%
Total physical RAM: 8109.11 MB
Available physical RAM: 4244.43 MB
Total Pagefile: 13107.29 MB
Available Pagefile: 8651.49 MB
Total Virtual: 4095.88 MB
Available Virtual: 3957.27 MB

========================= Partitions: =====================================

1 Drive c: (Os) (Fixed) (Total:110.79 GB) (Free:1.83 GB) NTFS
2 Drive d: (Data) (Fixed) (Total:921.51 GB) (Free:904.89 GB) NTFS
3 Drive e: (ZOO_TYCN) (CDROM) (Total:0.53 GB) (Free:0 GB) CDFS

========================= Users: ========================================

User accounts for \\RAFAEL-PC

Administrator Guest raf2
Rafael UpdatusUser


**** End of log ****

 

Oh and the program was steam. But basically any program located on my D drive said the same.

 

hmm on second read that wall of text might not be the one u were after? I've had a look on my desktop but cudnt find any report.

 

can any1 help? : <

 

yeah dearie me didnt realise it had gotten that far.. Any tips on how to clean up my space on C drive then? I dont understand the lack of space. I practically have 1 game and a little bit of work on it


Malwarebytes log 1:

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Database version: v2014.02.22.03

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.16428
Rafael :: RAFAEL-PC [administrator]

22/02/2014 17:12:40
mbam-log-2014-02-22 (17-12-40).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 270587
Time elapsed: 2 minute(s), 42 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 31
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{BB74DE59-BC4C-4172-9AC4-73315F71CFFE} (PUP.Optional.WebSearchInfo) -> No action taken.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C} (PUP.Optional.Wajam.A) -> No action taken.
HKCR\AppID\{D616A4A2-7B38-4DBC-9093-6FE7A4A21B17} (PUP.Optional.Wajam.A) -> No action taken.
HKLM\SOFTWARE\SWEETIM (PUP.Optional.SweetIM.A) -> No action taken.
HKCU\SOFTWARE\SWEETIM (PUP.Optional.SweetIM.A) -> No action taken.
HKCU\Software\AppDataLow\SProtector (PUP.Optional.SProtector.A) -> No action taken.
HKCU\Software\AppDataLow\Software\PriceGong (PUP.Optional.PriceGong.A) -> No action taken.
HKLM\SOFTWARE\{6791A2F3-FC80-475C-A002-C014AF797E9C} (PUP.Optional.OptimzerPro.A) -> No action taken.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{1B307FE2-F065-CA7C-B80A-406DD3551030} (PUP.Optional.MultiPlug.A) -> No action taken.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E597EF89-D3DF-7708-E392-3D9C87CAB1AA} (PUP.Optional.MultiPlug.A) -> No action taken.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7F45BE26-1634-22BD-ACA6-C90C038AED60} (PUP.Optional.MultiPlug.A) -> No action taken.
HKCR\CLSID\{1B307FE2-F065-CA7C-B80A-406DD3551030} (PUP.Optional.MultiPlug.A) -> No action taken.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{2D471A31-4FA7-95BA-1880-D441113ED736} (PUP.Optional.MultiPlug.A) -> No action taken.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7F45BE26-1634-22BD-ACA6-C90C038AED60} (PUP.Optional.MultiPlug.A) -> No action taken.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1B307FE2-F065-CA7C-B80A-406DD3551030} (PUP.Optional.MultiPlug.A) -> No action taken.
HKCR\CLSID\{7F45BE26-1634-22BD-ACA6-C90C038AED60} (PUP.Optional.MultiPlug.A) -> No action taken.
HKCU\SOFTWARE\INSTALLCORE (PUP.Optional.InstallCore.A) -> No action taken.
HKCU\Software\InstallCore\1I1T1Q1S (PUP.Optional.InstallCore.A) -> No action taken.
HKLM\Software\InstallIQ (PUP.Optional.InstallBrain.A) -> No action taken.
HKLM\SOFTWARE\Google\Chrome\Extensions\pfmopbbadnfoelckkcmjjeaaegjpjjbk (PUP.Optional.Gophoto.A) -> No action taken.
HKCR\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3} (PUP.Optional.Delta.A) -> No action taken.
HKCR\Interface\{1231839B-064E-4788-B865-465A1B5266FD} (PUP.Optional.Delta.A) -> No action taken.
HKCU\SOFTWARE\DELTA\DELTA (PUP.Optional.Delta.A) -> No action taken.
HKCR\Typelib\{4599D05A-D545-4069-BB42-5895B4EAE05B} (PUP.Optional.Delta.A) -> No action taken.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{348C2DF3-1191-4C3E-92A6-B3A89A9D9C85} (PUP.Optional.Delta.A) -> No action taken.
HKLM\SOFTWARE\Delta\delta\Instl (PUP.Optional.Delta.A) -> No action taken.
HKCU\Software\Datamngr (PUP.Optional.DataMngr.A) -> No action taken.
HKCU\SOFTWARE\DataMngr_Toolbar (PUP.Optional.DataMngr.A) -> No action taken.
HKCU\Software\BabSolution\Updater (PUP.Optional.Babylon.A) -> No action taken.
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\bProtectSettings (PUP.Optional.BProtector.A) -> No action taken.
HKCU\Software\1ClickDownload (PUP.Optional.1ClickDownload.A) -> No action taken.

Registry Values Detected: 10
HKLM\Software\SweetIM|simapp_id (PUP.Optional.SweetIM.A) -> Data: 11111111 -> No action taken.
HKCU\Software\SweetIM|simapp_id (PUP.Optional.SweetIM.A) -> Data: 11111111 -> No action taken.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|Optimizer Pro (PUP.Optional.OptimizerPro) -> Data: C:\Program Files (x86)\Optimizer Pro\OptProLauncher.exe -> No action taken.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|NextLive (PUP.Optional.NextLive.A) -> Data: C:\Windows\SysWOW64\rundll32.exe "C:\Users\Rafael\AppData\Roaming\newnext.me\nengine.dll",EntryPoint -m l -> No action taken.
HKCU\Software\InstallCore|tb (PUP.Optional.InstallCore.A) -> Data: 0H1L1J1L1S1R1N -> No action taken.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar|{82E1477C-B154-48D3-9891-33D83C26BCD3} (PUP.Optional.Delta.A) -> Data: Delta Toolbar -> No action taken.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{82E1477C-B154-48D3-9891-33D83C26BCD3} (PUP.Optional.Delta.A) -> Data: -> No action taken.
HKCU\SOFTWARE\Delta\Delta|tlbrSrchUrl (PUP.Optional.Delta.A) -> Data: -> No action taken.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes|bProtectorDefaultScope (PUP.BProtector) -> Data: {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} -> No action taken.
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main|bProtector Start Page (PUP.BProtector) -> Data: http://www.delta-search.com/?affID=119776&babsrc=HP_ss&mntrId=74587c8e00000000000050e549419a4f -> No action taken.

Registry Data Items Detected: 1
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main|Start Page (PUP.Optional.StartPage) -> Bad: (http://www.delta-search.com/?affID=119776&babsrc=HP_ss&mntrId=74587c8e00000000000050e549419a4f) Good: (http://www.google.com) -> No action taken.

Folders Detected: 7
C:\Users\Rafael\AppData\Roaming\OPENCANDY\8CC0C2720AC342699F46C96E34EF7984 (PUP.Optional.OpenCandy) -> No action taken.
C:\Users\Rafael\AppData\Roaming\OPENCANDY (PUP.Optional.OpenCandy) -> No action taken.
C:\Users\Rafael\AppData\Roaming\OPENCANDY\OpenCandy_8CC0C2720AC342699F46C96E34EF7984 (PUP.Optional.OpenCandy) -> No action taken.
C:\Users\Rafael\AppData\Roaming\newnext.me (PUP.Optional.NextLive.A) -> No action taken.
C:\Users\Rafael\AppData\Roaming\newnext.me\cache (PUP.Optional.NextLive.A) -> No action taken.
C:\Users\Rafael\AppData\Roaming\FILE SCOUT (PUP.Optional.FileScout.A) -> No action taken.
C:\Users\Rafael\AppData\Roaming\Delta (PUP.Optional.Delta.A) -> No action taken.

Files Detected: 17
C:\Program Files (x86)\OPTIMIZER PRO\OPTPROLAUNCHER.EXE (PUP.Optional.OptimizerPro) -> No action taken.
C:\Users\Rafael\AppData\Roaming\OPENCANDY\8CC0C2720AC342699F46C96E34EF7984\PasswordBoxCHSTORE_p1v0.exe (PUP.Optional.OpenCandy) -> No action taken.
C:\Users\Rafael\AppData\Local\genienext\nengine.dll (PUP.Optional.NextLive.A) -> No action taken.
C:\Users\Rafael\AppData\Roaming\newnext.me\nengine.cookie (PUP.Optional.NextLive.A) -> No action taken.
C:\Users\Rafael\AppData\Roaming\newnext.me\cache\spark.bin (PUP.Optional.NextLive.A) -> No action taken.
C:\ProgramData\AuDobVViewer\1QmdsutZev.exe (PUP.Optional.MultiPlug.A) -> No action taken.
C:\ProgramData\AUDOBVVIEWER\1QMDSUTZEV.DLL (PUP.Optional.MultiPlug.A) -> No action taken.
C:\ProgramData\PrriceDownloauder\bbYlG.exe (PUP.Optional.MultiPlug.A) -> No action taken.
C:\ProgramData\AuDobVViewer\1QmdsutZev.x64.dll (PUP.Optional.MultiPlug.A) -> No action taken.
C:\ProgramData\PRRICEDOWNLOAUDER\bbYlG.dll (PUP.Optional.MultiPlug.A) -> No action taken.
C:\ProgramData\PrriceDownloauder\bbYlG.x64.dll (PUP.Optional.MultiPlug.A) -> No action taken.
C:\Users\Rafael\AppData\Roaming\FILE SCOUT\uninst.exe (PUP.Optional.FileScout.A) -> No action taken.
C:\Users\Rafael\AppData\Roaming\File Scout\filescout.exe (PUP.Optional.FileScout.A) -> No action taken.
C:\Users\Rafael\AppData\Roaming\Delta\sqlite3.dll (PUP.Optional.Delta.A) -> No action taken.
C:\Users\Rafael\AppData\Local\Google\Chrome\USER DATA\Default\BPROTECTORPREFERENCES (PUP.Optional.BProtector.A) -> No action taken.
C:\Users\Rafael\AppData\Local\Google\Chrome\USER DATA\Default\BPROTECTOR WEB DATA (PUP.Optional.BProtector.A) -> No action taken.
C:\Users\Rafael\AppData\Roaming\newnext.me\nengine.dll (PUP.Optional.NextLive.A) -> Quarantined and deleted successfully.

(end)





Log 2 :

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Database version: v2014.02.22.03

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.16428
Rafael :: RAFAEL-PC [administrator]

22/02/2014 17:18:52
mbam-log-2014-02-22 (17-18-52).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 268428
Time elapsed: 1 minute(s), 46 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 31
HKCR\CLSID\{1B307FE2-F065-CA7C-B80A-406DD3551030} (PUP.Optional.MultiPlug.A) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1B307FE2-F065-CA7C-B80A-406DD3551030} (PUP.Optional.MultiPlug.A) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{1B307FE2-F065-CA7C-B80A-406DD3551030} (PUP.Optional.MultiPlug.A) -> Quarantined and deleted successfully.
HKCR\CLSID\{7F45BE26-1634-22BD-ACA6-C90C038AED60} (PUP.Optional.MultiPlug.A) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7F45BE26-1634-22BD-ACA6-C90C038AED60} (PUP.Optional.MultiPlug.A) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7F45BE26-1634-22BD-ACA6-C90C038AED60} (PUP.Optional.MultiPlug.A) -> Quarantined and deleted successfully.
HKCR\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3} (PUP.Optional.Delta.A) -> Quarantined and deleted successfully.
HKCR\AppID\{D616A4A2-7B38-4DBC-9093-6FE7A4A21B17} (PUP.Optional.Wajam.A) -> Quarantined and deleted successfully.
HKCR\Typelib\{4599D05A-D545-4069-BB42-5895B4EAE05B} (PUP.Optional.Delta.A) -> Quarantined and deleted successfully.
HKCR\Interface\{1231839B-064E-4788-B865-465A1B5266FD} (PUP.Optional.Delta.A) -> Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C} (PUP.Optional.Wajam.A) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\{6791A2F3-FC80-475C-A002-C014AF797E9C} (PUP.Optional.OptimzerPro.A) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{348C2DF3-1191-4C3E-92A6-B3A89A9D9C85} (PUP.Optional.Delta.A) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E597EF89-D3DF-7708-E392-3D9C87CAB1AA} (PUP.Optional.MultiPlug.A) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{2D471A31-4FA7-95BA-1880-D441113ED736} (PUP.Optional.MultiPlug.A) -> Quarantined and deleted successfully.
HKCU\SOFTWARE\DataMngr_Toolbar (PUP.Optional.DataMngr.A) -> Quarantined and deleted successfully.
HKCU\SOFTWARE\DELTA\DELTA (PUP.Optional.Delta.A) -> Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{BB74DE59-BC4C-4172-9AC4-73315F71CFFE} (PUP.Optional.WebSearchInfo) -> Quarantined and deleted successfully.
HKCU\Software\1ClickDownload (PUP.Optional.1ClickDownload.A) -> Quarantined and deleted successfully.
HKCU\Software\Datamngr (PUP.Optional.DataMngr.A) -> Quarantined and deleted successfully.
HKCU\Software\AppDataLow\SProtector (PUP.Optional.SProtector.A) -> Quarantined and deleted successfully.
HKCU\Software\AppDataLow\Software\PriceGong (PUP.Optional.PriceGong.A) -> Quarantined and deleted successfully.
HKCU\Software\BabSolution\Updater (PUP.Optional.Babylon.A) -> Quarantined and deleted successfully.
HKCU\Software\InstallCore\1I1T1Q1S (PUP.Optional.InstallCore.A) -> Quarantined and deleted successfully.
HKCU\SOFTWARE\INSTALLCORE (PUP.Optional.InstallCore.A) -> Quarantined and deleted successfully.
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\bProtectSettings (PUP.Optional.BProtector.A) -> Quarantined and deleted successfully.
HKCU\SOFTWARE\SWEETIM (PUP.Optional.SweetIM.A) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Delta\delta\Instl (PUP.Optional.Delta.A) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Google\Chrome\Extensions\pfmopbbadnfoelckkcmjjeaaegjpjjbk (PUP.Optional.Gophoto.A) -> Quarantined and deleted successfully.
HKLM\Software\InstallIQ (PUP.Optional.InstallBrain.A) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\SWEETIM (PUP.Optional.SweetIM.A) -> Quarantined and deleted successfully.

Registry Values Detected: 10
HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{82E1477C-B154-48D3-9891-33D83C26BCD3} (PUP.Optional.Delta.A) -> Data: -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar|{82E1477C-B154-48D3-9891-33D83C26BCD3} (PUP.Optional.Delta.A) -> Data: Delta Toolbar -> Quarantined and deleted successfully.
HKCU\SOFTWARE\Delta\Delta|tlbrSrchUrl (PUP.Optional.Delta.A) -> Data: -> Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main|bProtector Start Page (PUP.BProtector) -> Data: http://www.delta-search.com/?affID=119776&babsrc=HP_ss&mntrId=74587c8e00000000000050e549419a4f -> Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes|bProtectorDefaultScope (PUP.BProtector) -> Data: {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} -> Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|Optimizer Pro (PUP.Optional.OptimizerPro) -> Data: C:\Program Files (x86)\Optimizer Pro\OptProLauncher.exe -> Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|NextLive (PUP.Optional.NextLive.A) -> Data: C:\Windows\SysWOW64\rundll32.exe "C:\Users\Rafael\AppData\Roaming\newnext.me\nengine.dll",EntryPoint -m l -> Quarantined and deleted successfully.
HKCU\Software\InstallCore|tb (PUP.Optional.InstallCore.A) -> Data: 0H1L1J1L1S1R1N -> Quarantined and deleted successfully.
HKCU\Software\SweetIM|simapp_id (PUP.Optional.SweetIM.A) -> Data: 11111111 -> Quarantined and deleted successfully.
HKLM\Software\SweetIM|simapp_id (PUP.Optional.SweetIM.A) -> Data: 11111111 -> Quarantined and deleted successfully.

Registry Data Items Detected: 1
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main|Start Page (PUP.Optional.StartPage) -> Bad: (http://www.delta-search.com/?affID=119776&babsrc=HP_ss&mntrId=74587c8e00000000000050e549419a4f) Good: (http://www.google.com) -> Quarantined and repaired successfully.

Folders Detected: 7
C:\Users\Rafael\AppData\Roaming\Delta (PUP.Optional.Delta.A) -> Quarantined and deleted successfully.
C:\Users\Rafael\AppData\Roaming\OPENCANDY (PUP.Optional.OpenCandy) -> Quarantined and deleted successfully.
C:\Users\Rafael\AppData\Roaming\OPENCANDY\8CC0C2720AC342699F46C96E34EF7984 (PUP.Optional.OpenCandy) -> Quarantined and deleted successfully.
C:\Users\Rafael\AppData\Roaming\OPENCANDY\OpenCandy_8CC0C2720AC342699F46C96E34EF7984 (PUP.Optional.OpenCandy) -> Quarantined and deleted successfully.
C:\Users\Rafael\AppData\Roaming\FILE SCOUT (PUP.Optional.FileScout.A) -> Quarantined and deleted successfully.
C:\Users\Rafael\AppData\Roaming\newnext.me (PUP.Optional.NextLive.A) -> Quarantined and deleted successfully.
C:\Users\Rafael\AppData\Roaming\newnext.me\cache (PUP.Optional.NextLive.A) -> Quarantined and deleted successfully.

Files Detected: 16
C:\ProgramData\AUDOBVVIEWER\1QMDSUTZEV.DLL (PUP.Optional.MultiPlug.A) -> Quarantined and deleted successfully.
C:\ProgramData\PRRICEDOWNLOAUDER\bbYlG.dll (PUP.Optional.MultiPlug.A) -> Quarantined and deleted successfully.
C:\ProgramData\AuDobVViewer\1QmdsutZev.exe (PUP.Optional.MultiPlug.A) -> Quarantined and deleted successfully.
C:\ProgramData\AuDobVViewer\1QmdsutZev.x64.dll (PUP.Optional.MultiPlug.A) -> Quarantined and deleted successfully.
C:\ProgramData\PrriceDownloauder\bbYlG.exe (PUP.Optional.MultiPlug.A) -> Quarantined and deleted successfully.
C:\ProgramData\PrriceDownloauder\bbYlG.x64.dll (PUP.Optional.MultiPlug.A) -> Quarantined and deleted successfully.
C:\Users\Rafael\AppData\Roaming\File Scout\filescout.exe (PUP.Optional.FileScout.A) -> Quarantined and deleted successfully.
C:\Users\Rafael\AppData\Local\genienext\nengine.dll (PUP.Optional.NextLive.A) -> Quarantined and deleted successfully.
C:\Users\Rafael\AppData\Roaming\Delta\sqlite3.dll (PUP.Optional.Delta.A) -> Quarantined and deleted successfully.
C:\Users\Rafael\AppData\Local\Google\Chrome\USER DATA\Default\BPROTECTOR WEB DATA (PUP.Optional.BProtector.A) -> Quarantined and deleted successfully.
C:\Users\Rafael\AppData\Local\Google\Chrome\USER DATA\Default\BPROTECTORPREFERENCES (PUP.Optional.BProtector.A) -> Quarantined and deleted successfully.
C:\Program Files (x86)\OPTIMIZER PRO\OPTPROLAUNCHER.EXE (PUP.Optional.OptimizerPro) -> Quarantined and deleted successfully.
C:\Users\Rafael\AppData\Roaming\OPENCANDY\8CC0C2720AC342699F46C96E34EF7984\PasswordBoxCHSTORE_p1v0.exe (PUP.Optional.OpenCandy) -> Quarantined and deleted successfully.
C:\Users\Rafael\AppData\Roaming\FILE SCOUT\uninst.exe (PUP.Optional.FileScout.A) -> Quarantined and deleted successfully.
C:\Users\Rafael\AppData\Roaming\newnext.me\nengine.cookie (PUP.Optional.NextLive.A) -> Quarantined and deleted successfully.
C:\Users\Rafael\AppData\Roaming\newnext.me\cache\spark.bin (PUP.Optional.NextLive.A) -> Quarantined and deleted successfully.

(end)



log 3

alwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Database version: v2014.02.22.03

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.16428
Rafael :: RAFAEL-PC [administrator]

22/02/2014 17:26:54
mbam-log-2014-02-22 (17-26-54).txt

Scan type: Full scan (C:\|D:\|E:\|)
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 570653
Time elapsed: 46 minute(s), 45 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 13
C:\Program Files (x86)\Optimizer Pro\OptimizerPro.exe (PUP.Optional.OptimizerPro) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Optimizer Pro\OptProGuard.exe (PUP.Optional.OptimizerPro) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Optimizer Pro\OptProReminder.exe (PUP.Optional.OptimizerPro) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Optimizer Pro\OptProSchedule.exe (PUP.Optional.OptimizerPro) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Optimizer Pro\OptProSmartScan.exe (PUP.Optional.OptimizerPro) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Optimizer Pro\OptProStart.exe (PUP.Optional.OptimizerPro) -> Quarantined and deleted successfully.
C:\Users\Rafael\AppData\Local\Google\Chrome\User Data\Default\File System\003\t\00\00000000 (PUP.Optional.Installrex) -> Quarantined and deleted successfully.
C:\Users\Rafael\AppData\Local\Google\Chrome\User Data\Default\File System\004\t\00\00000000 (PUP.Optional.OneClickDownloader.A) -> Quarantined and deleted successfully.
C:\Users\Rafael\AppData\Local\Google\Chrome\User Data\Default\File System\005\t\00\00000000 (PUP.Optional.OneClickDownloader.A) -> Quarantined and deleted successfully.
C:\Users\Rafael\AppData\Local\Mobogenie\Version\OldVersion\Mobogenie2.1.37.zip (PUP.Optional.NextLive.A) -> Quarantined and deleted successfully.
C:\Users\Rafael\AppData\Local\Mobogenie\Version\OldVersion\Mobogenie\nengine.dll (PUP.Optional.NextLive.A) -> Quarantined and deleted successfully.
C:\Users\Rafael\Desktop\emulation\Desmune\GBA_Rom_-_Pokemon_Emerald_386.gba.exe (PUP.Optional.4Shared) -> Quarantined and deleted successfully.
C:\Users\Rafael\Desktop\emulation\Desmune\Pokemon Naranja.exe (PUP.Optional.4Shared) -> Quarantined and deleted successfully.

(end)

 

The recovery software tool, recuva, that i put to work recovering my files, seems completely stuck at 2442 files. I'm aware this can take a long time, the estimation says 9 hours, but one file taking 2hours? I believe it is stuck. Any suggestions?

 

Try this is you want to break down everything that is there:
https://www.jam-software.com/treesize_free/

 

Thank you for the tips and the insights dudes. I've managed to clean it up. Turns out my torrent downloader wasnt sending all files to the correct places, that plus a lengthy registry cleanup has freed up some space on my C drive. I also ran various programs to get rid of malware and believe I have been successfull.

There is still one little bugger left though. It's a chrome extension that i cant disable or remove. Its name is, copy pasted: AuDobVViewer
It's a realy annoying one as when you google it it gives you adobe viewer results. Any tips on how to get rid of it?

Softwares I've run to try to get rid of it:
CCleaner
Malwarebytes
Adwcleaner

the latter of which practically resat my browser save for search history.

 

Number one I would uninstall any torrent downloader as leaving one installed or using one is guaranteed to thoroughly infect your computer, and had we known it was there we would not be able to help you.
Then I would hope to god you made a backup of your registry before using a reg cleaner on it because you have done something there that makes certain a full clean install is in your near future as reg cleaners do nothing good and always result in damage to your system registry no one can repair without a good backup. Once and for all let me say to anyone reading this thread reg cleaners do nothing good to a system because a registry has nothing in it that needs cleaning. You need to read every word on these links now (and then pray):
http://miekiemoes.blogspot.com/2008/02/registry-cleaners-and-system-tweaking_13.html

http://www.edbott.com/weblog/?p=643

http://support.microsoft.com/kb/2563254