NotReallyBob

Yes you can mark it as closed.

I thank you for your time. I was able to use RoguekillerCMD to fix the issue. I apologize if offended you. If this were an issue I was being compensated for I have not problem passing the benefit or compensation to others for the help solving an issue.

I handle the website for a company. They asked for help with one of the user computers.

here is the log RogueKiller V10.0.4.0 [Oct 29 2014] by Adlice Software mail : http://www.adlice.com/contact/ Feedback : http://forum.adlice.com Website : http://www.adlice.com/softwares/roguekiller/ Blog : http://www.adlice.com Operating System : Windows 7 (6.1.7601 Service Pack 1) 32 bits version Started in : Normal mode User : admin [Administrator] Mode : Scan -- Date : 10/29/2014 13:19:09 ¤¤¤ Processes : 1 ¤¤¤ [Proc.Svchost] svchost.exe -- [x] -> Killed [TermThr] ¤¤¤ Registry : 6 ¤¤¤ [PUM.HomePage] HKEY_USERS\S-1-5-21-3368086640-2439188754-4288494395-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main | Start Page : http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome -> Found [PUM.SearchPage] HKEY_USERS\S-1-5-21-3368086640-2439188754-4288494395-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main | Search Page : http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch -> Found [PUM.SearchPage] HKEY_USERS\S-1-5-21-3368086640-2439188754-4288494395-1012\Software\Microsoft\Internet Explorer\Main | Search Page : http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch -> Found [PUM.SearchPage] HKEY_USERS\S-1-5-21-3368086640-2439188754-4288494395-1012-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main | Search Page : http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch -> Found [PUM.DesktopIcons] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> Found [PUM.DesktopIcons] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1 -> Found ¤¤¤ Tasks : 0 ¤¤¤ ¤¤¤ Files : 0 ¤¤¤ ¤¤¤ Hosts File : 0 ¤¤¤ ¤¤¤ Antirootkit : 0 (Driver: Loaded) ¤¤¤ ¤¤¤ Web browsers : 0 ¤¤¤ ¤¤¤ MBR Check : ¤¤¤ +++++ PhysicalDrive0: HITACHI HDS725050KLA360 ATA Device +++++ --- User --- [MBR] 30e50a02b01be0ee8681f0dfa702683a [bSP] 711de694e41ac6657848d06f889100c1 : Windows Vista/7/8 MBR Code Partition table: 0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 63 | Size: 101 MB 1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 208845 | Size: 476835 MB User = LL1 ... OK User = LL2 ... OK ============================================ RKreport_DEL_10282014_232552.log - RKreport_DEL_10282014_234522.log - RKreport_DEL_10282014_234528.log - RKreport_SCN_10282014_232358.log RKreport_SCN_10282014_234336.log

Looks like I have a client with Poweliks issues. I run MBAM, Avast, even MSE. I scan with Farbar. I have attached the scan results. Looking for some help please. FRST.txt Addition.txt