Jump to content

Search the Community

Showing results for tags 'malwares'.

  • Search By Tags

    Type tags separated by commas.
  • Search By Author

Content Type


Forums

  • Announcements
    • Malwarebytes News
    • Beta Testing Program
  • Malware Removal Help
    • Windows Malware Removal Help & Support
    • Mac Malware Removal Help & Support
    • Mobile Malware Removal Help & Support
    • Malware Removal Self-Help Guides
  • Malwarebytes for Home Support
    • Malwarebytes for Windows Support Forum
    • Malwarebytes for Mac Support Forum
    • Malwarebytes for Android Support Forum
    • Malwarebytes for iOS Support
    • Malwarebytes Privacy
    • Malwarebytes Browser Guard
    • False Positives
    • Comments and Suggestions
  • Malwarebytes for Business Support
    • Malwarebytes Endpoint Protection
    • Malwarebytes Incident Response (includes Breach Remediation)
    • Malwarebytes Endpoint Security
    • Malwarebytes Business Products Comments and Suggestions
  • Malwarebytes Tools and Other Products
    • Malwarebytes AdwCleaner
    • Malwarebytes Junkware Removal Tool Support
    • Malwarebytes Anti-Rootkit BETA Support
    • Malwarebytes Techbench USB (Legacy)
    • Malwarebytes Secure Backup discontinued
    • Other Tools
    • Malwarebytes Tools Comments and Suggestions
  • General Computer Help and Security Updates
    • BSOD, Crashes, Kernel Debugging
    • General Windows PC Help
  • Research Center
    • Newest Rogue-Ransomware Threats
    • Newest Malware Threats
    • Newest Mobile Threats
    • Newest IP or URL Threats
    • Newest Mac Threats
    • Report Scam Phone Numbers
  • General
    • General Chat
    • Forums Announcements & Feedback

Find results in...

Find results that contain...


Date Created

  • Start

    End


Last Updated

  • Start

    End


Filter by number of...

Joined

  • Start

    End


Group


AIM


MSN


Website URL


ICQ


Yahoo


Jabber


Location


Interests

Found 12 results

  1. I downloaded a file (it was just called Setup.exe but when I ran the file multiple times it didn't seem to do anything) from a site that seemed safe but turns out it was infected with a bunch of trojans and random apps (I don't remember the other 2 and can't find them but one of them was MaskedVPN which took forever to fully remove). I've done a custom full scan with malwarebytes, ran rkill, hitmanpro, ESET and it says they've removed the trojans as it doesn't find anything else when I start a new scan. At a glance my pc seems fine as nothing changed aside from my ram usage being up by quite a bit (Usually around 20% when idle and is up to around 40% now). I was planning on doing a full system reset but I have a lot of files I need and have no clue how to back them up in case they're infected. What do you suggest I do?
  2. A friend of mine told me that the software was on but on total virus it detects it as a "Malware.Heuristic.1003" CL-Eye-Driver-5.3.0.0341-Emuline.zip
  3. Hello, before all, sorry if my english is bad. I've downloaded antimalwarebytes to find something wrong in my notebook because i'm having problems in some games and in web surfing. the scan showed me four malwares but i can't remove them and i'm scared to remove important files from my pc for error. i've followed the instructions of the topic "I'm infected - What do I do now?" and i'm now posting the results of the scans FRST and Additions. I hope you can help me, thank you. Addition.txt FRST.txt
  4. Hi, I've recently installed the microsoft office to my laptop, it comes with the Mircrosoft Toolkit 2.4.3. After when I am done setting up the softwares, I experienced multiple times of running programs not responding, internet pop-ups and having trouble logging into school's site. How can I go about removing the malwares and rectify the situation whereas keeping my mircrosoft offices?
  5. I have some problem on my Lenovo ThinkPad. It has some malware. It install things without my permission and it cannot be uninstalled. It is like whenever I uninstall it, it happens to be there again. It is irritating. I scanned it with the two AntiVirus apps I have (AVG and MBAM) and tried to uninstall it but nothing happened.
  6. Suspected virus - random Chrome pop ups - Resolved HijackThis Logs - Malwarebytes Forum https://forums.malwarebytes.org/index.php?/topic/124537-suspected-virus-random-chrome-pop-ups/ When clicking on certain websites that are completely safe and I have used before, pop ups such as "make money fast" or "try this miracle product" are appearing in a new tab. took little notice at first but is getting rather regularly now and more common, with sometimes every click for 4-5 clicks in a row opening up a tab. have norton and windows defender active but neither had any success. Note: did a bit of digging myself and found a post that sounds similar, started following the steps but soon realised that it might be different with each computer as I have no idea what to look for. sorry for keeping it short, just feel like the other post sums it up exactly
  7. Hello, I am having issues with multiple "dllhost.exe *32" COM Surrogate process running and these processes keep coming back even after manually stop them. I followed the instruction of previous topic post by some other member & I ran Farbar Recovery Scan, Malwarebyte Threat Scan and now ESET Online Scanner is scanning now & 18 infected files are detect yet, i will let you the complete details of scan once it completed .......I have a question, I download Fixlist file from previous topic and run the fix of Farbar Recovery Scan.....I dont know that i done correct or wrong I also completed the scan with MBAM and it detects some objects, i removed all detected object and resttart my computer but unfortunately i forgot to save MBAM log file. I remove MBAM after threat removal because my computer was working slow with MBAM so i removed it.......Sorry if i done wrong Below is FRST, Addition.txt, Fixlist is use and Fixlog details FRST Log Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 08-10-2014 01 Ran by Sharon (administrator) on SHARON-PC on 10-10-2014 17:58:55Running from C:\Users\Sharon\DesktopLoaded Profile: Sharon (Available profiles: Sharon)Platform: Windows Vista Home Premium Service Pack 2 (X64) OS Language: English (United States)Internet Explorer Version 8Boot Mode: NormalTutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (Microsoft Corporation) C:\Windows\System32\SLsvc.exe(ABBYY) C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe(Apple Inc.) C:\Program Files (x86)\Bonjour\mDNSResponder.exe(Citrix Online, LLC) C:\Program Files (x86)\Citrix\GoToAssist Remote Support Customer\758\g2ax_service.exe(Eastman Kodak Company) C:\Program Files (x86)\Kodak\AiO\Center\ekdiscovery.exe(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe(Citrix Online, LLC) C:\Program Files (x86)\Citrix\GoToAssist Remote Support Customer\758\g2ax_comm_customer.exe(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe(Citrix Online, LLC) C:\Program Files (x86)\Citrix\GoToAssist Remote Support Customer\758\g2ax_system_customer.exe(Seiko Epson Corporation) C:\Windows\System32\escsvc64.exe(Citrix Online, LLC) C:\Program Files (x86)\Citrix\GoToAssist Remote Support Customer\758\g2ax_host_service.exe(Citrix Online, LLC) C:\Program Files (x86)\Citrix\GoToAssist Remote Support Customer\758\g2ax_user_customer.exe(Intel Corporation) C:\Windows\System32\hkcmd.exe(Intel Corporation) C:\Windows\System32\igfxpers.exe(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe(Microsoft Corporation) C:\Windows\System32\rundll32.exe(Intel Corporation) C:\Windows\System32\igfxsrvc.exe(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Health Check\HPHC_Service.exe(Intuit Inc.) C:\Program Files (x86)\Common Files\Intuit\Update Service\IntuitUpdateService.exe(Citrix Online, LLC) C:\Program Files (x86)\Citrix\GoToAssist Remote Support Customer\758\g2ax_user_high_customer.exe(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\WPFFontCache_v0400.exe(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe(Microsoft Corporation) C:\Windows\System32\cmd.exe(Microsoft Corporation) C:\Windows\System32\cmd.exe(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe() C:\Users\Sharon\AppData\Roaming\Uhniovgi\maxee.exe(Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe(Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe(Microsoft Corporation) C:\Windows\System32\consent.exe() C:\Users\Sharon\AppData\Roaming\Uhniovgi\maxee.exe() C:\Users\Sharon\AppData\Roaming\Uhniovgi\maxee.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [Windows Defender] => C:\Program Files\Windows Defender\MSASCui.exe [1584184 2008-01-20] (Microsoft Corporation)HKLM\...\Run: [iAAnotif] => C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2008-12-04] (Intel Corporation)HKLM\...\Run: [EKIJ5000StatusMonitor] => C:\Windows\system32\spool\DRIVERS\x64\3\EKIJ5000MUI.exe [2023936 2009-08-03] (Eastman Kodak Company)HKLM-x32\...\Run: [] => [X]HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)HKLM-x32\...\Run: [Yquqedxenipu] => C:\Users\Sharon\AppData\Roaming\Uhniovgi\maxee.exe [291069 2014-04-17] ()HKLM Group Policy restriction on software: C:\Program Files\Windows Defender <====== ATTENTIONWinlogon\Notify\GoToAssist Express Customer: C:\Program Files (x86)\Citrix\GoToAssist Remote Support Customer\758\g2ax_winlogonx64.dll (Citrix Online, LLC)Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)HKU\S-1-5-19\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenterHKU\S-1-5-20\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenterHKU\S-1-5-21-3122679508-3511620857-1760614917-1000\...\Run: [Yquqedxenipu] => C:\Users\Sharon\AppData\Roaming\Uhniovgi\maxee.exe [291069 2014-04-17] ()HKU\S-1-5-21-3122679508-3511620857-1760614917-1000\...409d6c4515e9\InprocServer32: [Default-shell32] C:\Users\Sharon\AppData\Local\Temp\soupoqr\stdipwr\wow.dll ATTENTION! ====> ZeroAccess?HKU\S-1-5-21-3122679508-3511620857-1760614917-1000\...A8F59079A8D5}\localserver32: rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";eval("epdvnfou/xsjuf)(=tdsjqu!mbohvbhf>ktds (the data entry has 239 more characters). <==== Poweliks!Startup: C:\Users\Sharon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Epson scanner Registration.lnkShortcutTarget: Epson scanner Registration.lnk -> E:\Common\EpsonReg\US\EpsonReg.exe (No File)Startup: C:\Users\Sharon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Monitor Ink Alerts - HP Deskjet 1000 J110 series.lnkShortcutTarget: Monitor Ink Alerts - HP Deskjet 1000 J110 series.lnk -> C:\Program Files\HP\HP Deskjet 1000 J110 series\Bin\HPStatusBL.dll (Hewlett-Packard Co.)Startup: C:\Users\Sharon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote Table Of Contents.onetoc2 ()BootExecute: autocheck autochk * sdnclean64.exe ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=93&bd=Pavilion&pf=cndtHKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=93&bd=Pavilion&pf=cndtHKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=93&bd=Pavilion&pf=cndtHKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=93&bd=Pavilion&pf=cndtHKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=93&bd=Pavilion&pf=cndtStartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exeSearchScopes: HKLM - {379648A4-9AD1-4C0C-823B-64FC70F7B141} URL = http://www.ask.com/web?q={searchterms}&l=dis&o=ushpdSearchScopes: HKLM - {CD11E25A-D6A3-4080-8230-9C3BC5878831} URL = http://search.live.com/results.aspx?q={searchTerms}&FORM=HPDTDFSearchScopes: HKLM-x32 - {379648A4-9AD1-4C0C-823B-64FC70F7B141} URL = http://www.ask.com/web?q={searchterms}&l=dis&o=ushpdSearchScopes: HKLM-x32 - {CD11E25A-D6A3-4080-8230-9C3BC5878831} URL = http://search.live.com/results.aspx?q={searchTerms}&FORM=HPDTDFSearchScopes: HKCU - {379648A4-9AD1-4C0C-823B-64FC70F7B141} URL = SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)BHO: Google Toolbar Notifier BHO -> {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} -> C:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg64.dll (Google Inc.)BHO-x32: Java Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)BHO-x32: Google Toolbar Notifier BHO -> {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} -> C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll (Google Inc.)BHO-x32: Google Dictionary Compression sdch -> {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} -> C:\Program Files (x86)\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll (Google Inc.)BHO-x32: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)Toolbar: HKLM-x32 - No Name - {311B58DC-A4DC-4B04-B1B5-60299AD3D803} - No FileToolbar: HKCU - No Name - {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No FileToolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)Toolbar: HKCU - No Name - {F7E4B48A-9940-48D8-A732-246A2FDB7B40} - No FileToolbar: HKCU - No Name - {311B58DC-A4DC-4B04-B1B5-60299AD3D803} - No FileToolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No FileDPF: HKLM-x32 {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection2.cabDPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cabHandler: gopher - {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - No FileHandler-x32: gopher - {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\syswow64\urlmon.dll (Microsoft Corporation)Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txtTcpip\Parameters: [DhcpNameServer] 209.18.47.61 209.18.47.62 FireFox:========FF ProfilePath: C:\Users\Sharon\AppData\Roaming\Mozilla\Firefox\Profiles\cvrmozf5.defaultFF Plugin-x32: @java.com/DTPlugin,version=10.15.2 -> C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)FF Plugin-x32: @java.com/JavaPlugin,version=10.15.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)FF Plugin-x32: @mcafee.com/McAfeeMssPlugin -> C:\Program Files (x86)\McAfee Security Scan\3.0.318\npMcAfeeMss.dll No FileFF Plugin-x32: @mcafee.com/MVT -> C:\Program Files (x86)\McAfee\Supportability\MVT\NPMVTPlugin.dll (McAfee, Inc.)FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)FF Plugin-x32: @microsoft.com/WPF,version=3.5 -> c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)FF Plugin-x32: @videolan.org/vlc,version=2.1.2 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)FF Plugin HKCU: @citrixonline.com/appdetectorplugin -> C:\Users\Sharon\AppData\Local\Citrix\Plugins\104\npappdetector.dll (Citrix Online)FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np32dsw.dll (Macromedia, Inc.)FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\NPSWF32.dll (Macromedia, Inc.)FF Extension: Playtopus - C:\Users\Sharon\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\links@playtopus.com [2013-06-26]FF Extension: Video Downloader - C:\Users\Sharon\AppData\Roaming\Mozilla\Firefox\Profiles\cvrmozf5.default\Extensions\oqhnkpizab@oqhnkpizab.org.xpi [2013-07-24]FF HKLM-x32\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtensionFF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-09-15]FF HKLM-x32\...\Firefox\Extensions: [{7BA52691-1876-45ce-9EE6-54BCB3B04BBC}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\coFFPlgn Chrome: =======CHR HomePage: Default -> hxxp://rocket-find.com/?f=1&a=rckt_cmi_14_29_ie&cd=2XzuyEtN2Y1L1QzutDtDtByCtCzztCzyzzyDzz0AyEtAyDyDtN0D0Tzu0SzytBzztN1L2XzutBtFtBtCtFtCyEtFyEtN1L1CzutCyEtBzytDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2StB0BtCyDyDzztC0BtG0FtAyBtCtGtDtA0DyEtGyD0D0B0AtGyBtD0B0DtDzz0AzyzztB0FtC2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyCtDtBzztCtBtAyCtG0AyB0CzztG0C0C0FtBtG0AyDyE0CtGyD0A0CyCyDyEzyyE0A0CyEzz2Q&cr=516915441&ir=CHR StartupUrls: Default -> "hxxp://www.yahoo.com/"CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:inputType}{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}{google:searchVersion}{google:sessionToken}sugkey={google:suggestAPIKeyParameter}CHR Profile: C:\Users\Sharon\AppData\Local\Google\Chrome\User Data\DefaultCHR Extension: (Google Docs) - C:\Users\Sharon\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-03-16]CHR Extension: (Google Drive) - C:\Users\Sharon\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-03-16]CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Sharon\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-07-13]CHR Extension: (YouTube) - C:\Users\Sharon\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-03-16]CHR Extension: (Google Search) - C:\Users\Sharon\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-03-16]CHR Extension: (Google Wallet) - C:\Users\Sharon\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-01]CHR Extension: (Gmail) - C:\Users\Sharon\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-03-16] ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 ABBYY.Licensing.FineReader.Sprint.9.0; C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [759048 2009-05-14] (ABBYY)R2 EpsonScanSvc; C:\Windows\system32\EscSvc64.exe [135824 2011-12-12] (Seiko Epson Corporation)R3 GoToAssist Remote Support Customer; C:\Program Files (x86)\Citrix\GoToAssist Remote Support Customer\758\g2ax_service.exe [610888 2014-10-09] (Citrix Online, LLC)R2 HP Health Check Service; c:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exe [94208 2008-12-04] (Hewlett-Packard) [File not signed]R2 LightScribeService; c:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe [73728 2009-03-17] (Hewlett-Packard Company) [File not signed]S2 0109651412971787mcinstcleanup; C:\Users\Sharon\AppData\Local\Temp\010965~1.EXE -cleanup -nolog [X]S2 mfevtp; "C:\Windows\system32\mfevtps.exe" [X] ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) S2 mrtRate; C:\Windows\SysWow64\Drivers\mrtRate.sys [34916 1999-08-12] (Marimba, Inc.) [File not signed]S3 SWDUMon; C:\Windows\System32\DRIVERS\SWDUMon.sys [16152 2014-10-09] ()S0 mfeapfk; system32\drivers\mfeapfk.sys [X]R0 mfehidk; system32\drivers\mfehidk.sys [X]S0 mferkdet; system32\drivers\mferkdet.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2014-10-10 21:02 - 2014-10-10 21:02 - 00003732 _____ () C:\Windows\System32\Tasks\Security Center Update - 19907887412014-10-10 21:02 - 2014-10-10 21:02 - 00000808 _____ () C:\Windows\Tasks\Security Center Update - 1990788741.job2014-10-10 21:02 - 2014-10-10 21:02 - 00000000 ____D () C:\Users\Sharon\AppData\Roaming\Edpopob2014-10-10 17:58 - 2014-10-10 18:16 - 00017750 _____ () C:\Users\Sharon\Desktop\FRST.txt2014-10-10 17:58 - 2014-10-10 18:01 - 00000000 ____D () C:\FRST2014-10-10 17:56 - 2014-10-10 21:00 - 00000806 _____ () C:\Windows\Tasks\Security Center Update - 3010263955.job2014-10-10 17:56 - 2014-10-10 17:56 - 00003730 _____ () C:\Windows\System32\Tasks\Security Center Update - 30102639552014-10-10 17:56 - 2014-10-10 17:56 - 00000000 ____D () C:\Users\Sharon\AppData\Roaming\Qiqaaxu2014-10-10 17:56 - 2014-10-10 17:54 - 02109952 _____ (Farbar) C:\Users\Sharon\Desktop\FRST64.exe2014-10-10 17:55 - 2014-10-10 21:00 - 00000810 _____ () C:\Windows\Tasks\Security Center Update - 398391132.job2014-10-10 17:55 - 2014-10-10 17:55 - 00003734 _____ () C:\Windows\System32\Tasks\Security Center Update - 3983911322014-10-10 17:55 - 2014-10-10 17:55 - 00000000 ____D () C:\Users\Sharon\AppData\Roaming\Uhniovgi2014-10-10 17:51 - 2014-10-10 17:51 - 00081408 _____ () C:\Users\Sharon\AppData\Roaming\zvloglr.dll2014-10-10 17:51 - 2014-10-10 17:51 - 00003964 _____ () C:\Windows\System32\Tasks\{9C36FFDA-02CA-D98A-C551-06CFEF40C5BC}2014-10-10 17:51 - 2014-10-10 17:51 - 00000000 _____ () C:\Users\Sharon\AppData\Roaming\kdevr.dll2014-10-10 16:13 - 2014-10-10 16:13 - 00000820 _____ () C:\Users\Sharon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Temp File Cleaner.lnk2014-10-10 16:13 - 2014-10-10 16:13 - 00000790 _____ () C:\Users\Sharon\Desktop\Temp File Cleaner.lnk2014-10-10 16:13 - 2014-10-10 16:13 - 00000000 ____D () C:\Program Files\Temp File Cleaner2014-10-10 16:09 - 2014-10-10 16:09 - 00000000 ____D () C:\Program Files\McAfee.com2014-10-10 16:09 - 2014-10-10 16:09 - 00000000 ____D () C:\Program Files\McAfee2014-10-10 16:02 - 2014-06-20 10:30 - 00189912 _____ (McAfee, Inc.) C:\Windows\system32\mfevtps.exe.0538.deleteme2014-10-10 16:01 - 2014-10-10 16:09 - 00000000 ____D () C:\ProgramData\McAfee2014-10-10 16:01 - 2014-10-10 16:09 - 00000000 ____D () C:\Program Files\Common Files\McAfee2014-10-10 13:53 - 2014-10-10 13:50 - 01060352 _____ () C:\Users\Sharon\Desktop\MicrosoftFixit50472.msi2014-10-10 03:51 - 2014-10-10 03:51 - 605410472 _____ (Microsoft Corporation) C:\Users\Sharon\Downloads\Windows6.0-KB948465-X64.exe2014-10-10 03:44 - 2014-10-10 03:44 - 36138288 _____ (Microsoft Corporation) C:\Users\Sharon\Downloads\IE9-WindowsVista-x64-enu.exe2014-10-10 03:37 - 2014-10-10 04:23 - 00000134 _____ () C:\Users\Sharon\Desktop\Internet Explorer Troubleshooting.url2014-10-10 03:21 - 2014-10-10 16:03 - 00000000 ____D () C:\Program Files\stinger2014-10-10 03:18 - 2014-10-10 03:18 - 05296056 _____ (McAfee, Inc.) C:\Users\Sharon\Downloads\Setup_serial_IjwK7YhRXe9iDRq_S7TeGQ2_key.exe2014-10-10 03:02 - 2014-03-13 18:02 - 00450628 _____ () C:\Windows\system32\Drivers\etc\hosts.bak2014-10-10 03:01 - 2014-10-10 16:09 - 00000000 ____D () C:\Program Files (x86)\McAfee2014-10-10 03:01 - 2014-10-10 04:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee2014-10-10 03:01 - 2014-10-10 03:01 - 00000000 ____D () C:\Users\Sharon\AppData\Roaming\McAfee2014-10-10 02:56 - 2014-10-10 02:54 - 03480040 _____ (McAfee, Inc.) C:\Users\Sharon\Desktop\MCPR.exe2014-10-10 02:31 - 2014-10-10 02:31 - 00000000 ____D () C:\ProgramData\Malwarebytes2014-10-10 00:46 - 2014-10-10 00:46 - 00000000 ____D () C:\Users\Sharon\AppData\Roaming\addpcs2014-10-09 22:47 - 2014-10-09 23:46 - 00000000 ____D () C:\AdwCleaner2014-10-09 22:43 - 2014-10-07 14:11 - 04968160 _____ (TeamViewer) C:\Users\Sharon\Desktop\TeamViewerQS_en.exe2014-10-09 22:34 - 2014-10-09 22:34 - 00000000 ____D () C:\Users\Sharon\AppData\Local\LogMeIn Rescue Applet2014-10-09 18:50 - 2014-10-09 18:50 - 00000772 _____ () C:\Users\Public\Desktop\CCleaner.lnk2014-10-09 18:50 - 2014-10-09 18:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner2014-10-09 18:50 - 2014-10-09 18:50 - 00000000 ____D () C:\Program Files\CCleaner2014-10-09 17:43 - 2014-10-09 23:48 - 00000000 ____D () C:\Program Files\PC Optimizer Pro2014-10-09 17:17 - 2014-10-09 17:17 - 00001369 _____ () C:\Users\Sharon\Desktop\GoToAssist Customer.lnk2014-10-09 17:17 - 2014-10-09 17:17 - 00000000 ____D () C:\Users\Sharon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Citrix2014-10-09 17:17 - 2014-10-09 17:17 - 00000000 ____D () C:\Users\Sharon\AppData\Local\Citrix2014-10-09 17:17 - 2014-10-09 17:17 - 00000000 ____D () C:\Program Files (x86)\Citrix2014-10-09 17:15 - 2014-10-09 17:15 - 00000000 ____D () C:\Users\Sharon\AppData\Local\Apps\2.02014-10-09 17:14 - 2014-10-09 17:17 - 00000000 ____D () C:\Users\Sharon\AppData\Local\Deployment2014-10-09 17:04 - 2014-10-10 03:06 - 00000000 ____D () C:\Users\Sharon\AppData\Roaming\Otguise2014-10-09 17:04 - 2014-10-10 02:45 - 00000000 ____D () C:\Users\Sharon\AppData\Roaming\Ihuvar2014-10-09 17:02 - 2014-10-09 17:02 - 00000344 _____ () C:\Windows\Tasks\{F559D6F4-03BC-FB8E-356A-00FC41EA67C0}.job2014-10-09 17:02 - 2014-10-09 17:02 - 00000000 _____ () C:\Windows\system32\seetla.dll2014-10-09 16:04 - 2014-10-09 16:05 - 00292408 _____ (Citrix Online) C:\Users\Sharon\Downloads\GoToAssist Launcher.exe2014-10-09 15:39 - 2014-10-09 15:39 - 00000000 __SHD () C:\found.0002014-10-06 13:32 - 2014-10-10 02:45 - 00000000 ____D () C:\ProgramData\j9tbgsdger04r2014-10-05 15:30 - 2014-10-10 03:16 - 00000000 ____D () C:\Users\Sharon\Documents\PCSpeedClean2014-10-03 04:04 - 2014-10-03 04:04 - 00000000 ____D () C:\Windows\Sun2014-10-03 03:11 - 2014-10-03 03:11 - 00003370 _____ () C:\Windows\System32\Tasks\Performance Center@Logon2014-10-03 03:11 - 2014-10-03 03:11 - 00003150 _____ () C:\Windows\System32\Tasks\Performance Center_Sharon-PC@Sharon2014-10-02 18:15 - 2014-10-02 18:15 - 00000099 _____ () C:\Windows\Reimage.ini2014-09-24 03:00 - 2014-09-09 02:40 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll2014-09-24 03:00 - 2014-09-09 02:24 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll2014-09-17 23:54 - 2014-09-17 23:54 - 00000000 ____D () C:\Users\Sharon\AppData\Local\downloadius2014-09-12 04:03 - 2014-08-18 23:17 - 01491968 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll2014-09-12 04:03 - 2014-08-18 23:17 - 01147904 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll2014-09-12 04:03 - 2014-08-18 23:17 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\url.dll2014-09-12 04:03 - 2014-08-18 23:15 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll2014-09-12 04:03 - 2014-08-18 23:07 - 01068544 _____ (Microsoft Corporation) C:\Windows\system32\mstime.dll2014-09-12 04:03 - 2014-08-18 23:03 - 09326592 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll2014-09-12 04:03 - 2014-08-18 23:03 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll2014-09-12 04:03 - 2014-08-18 23:02 - 00742912 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll2014-09-12 04:03 - 2014-08-18 23:02 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll2014-09-12 04:03 - 2014-08-18 22:58 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll2014-09-12 04:03 - 2014-08-18 22:57 - 01538560 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl2014-09-12 04:03 - 2014-08-18 22:57 - 00219136 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll2014-09-12 04:03 - 2014-08-18 22:57 - 00132096 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll2014-09-12 04:03 - 2014-08-18 22:57 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll2014-09-12 04:03 - 2014-08-18 22:57 - 00031744 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll2014-09-12 04:03 - 2014-08-18 22:56 - 12473344 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll2014-09-12 04:03 - 2014-08-18 22:56 - 02358272 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll2014-09-12 04:03 - 2014-08-18 22:56 - 00459776 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll2014-09-12 04:03 - 2014-08-18 22:56 - 00252416 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll2014-09-12 04:03 - 2014-08-18 22:56 - 00072192 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll2014-09-12 04:03 - 2014-08-18 22:55 - 00023040 _____ (Microsoft Corporation) C:\Windows\system32\corpol.dll2014-09-12 04:03 - 2014-08-18 21:46 - 01214976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll2014-09-12 04:03 - 2014-08-18 21:46 - 00916992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll2014-09-12 04:03 - 2014-08-18 21:46 - 00105984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll2014-09-12 04:03 - 2014-08-18 21:44 - 00206848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll2014-09-12 04:03 - 2014-08-18 21:41 - 06003200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll2014-09-12 04:03 - 2014-08-18 21:41 - 00630784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstime.dll2014-09-12 04:03 - 2014-08-18 21:41 - 00630272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll2014-09-12 04:03 - 2014-08-18 21:41 - 00067072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll2014-09-12 04:03 - 2014-08-18 21:41 - 00055296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll2014-09-12 04:03 - 2014-08-18 21:40 - 01469440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl2014-09-12 04:03 - 2014-08-18 21:40 - 00043520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll2014-09-12 04:03 - 2014-08-18 21:40 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll2014-09-12 04:03 - 2014-08-18 21:39 - 11082752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll2014-09-12 04:03 - 2014-08-18 21:39 - 02005504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll2014-09-12 04:03 - 2014-08-18 21:39 - 00387584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll2014-09-12 04:03 - 2014-08-18 21:39 - 00184320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll2014-09-12 04:03 - 2014-08-18 21:39 - 00164352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll2014-09-12 04:03 - 2014-08-18 21:39 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll2014-09-12 04:03 - 2014-08-18 21:39 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll2014-09-12 04:03 - 2014-08-18 21:39 - 00055808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll2014-09-12 04:03 - 2014-08-18 21:38 - 00018944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\corpol.dll2014-09-12 04:03 - 2014-08-18 21:36 - 00479232 _____ (Microsoft Corporation) C:\Windows\system32\html.iec2014-09-12 04:03 - 2014-08-18 20:16 - 00162816 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe2014-09-12 04:03 - 2014-08-18 20:15 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe2014-09-12 04:03 - 2014-08-18 20:14 - 01638912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb2014-09-12 04:03 - 2014-08-18 20:14 - 00012288 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe2014-09-12 04:03 - 2014-08-18 20:10 - 00385024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec2014-09-12 04:03 - 2014-08-18 18:33 - 00174080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ie4uinit.exe2014-09-12 04:03 - 2014-08-18 18:33 - 00133632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe2014-09-12 04:03 - 2014-08-18 18:31 - 00013312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe2014-09-12 04:03 - 2014-08-18 18:30 - 01638912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2014-10-10 21:14 - 2014-07-16 13:43 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job2014-10-10 21:05 - 2013-09-07 21:17 - 00000000 ____D () C:\Users\Sharon\AppData\Local\CrashDumps2014-10-10 20:57 - 2014-07-24 20:27 - 00000000 ____D () C:\ProgramData\Windows Genuine Advantage2014-10-10 20:51 - 2010-01-10 12:42 - 00006000 _____ () C:\Users\Sharon\AppData\Local\d3d9caps.dat2014-10-10 20:42 - 2014-07-16 13:42 - 00000296 _____ () C:\Windows\Tasks\Rocket Updater.job2014-10-10 20:26 - 2012-03-14 12:56 - 00000898 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job2014-10-10 17:56 - 2006-11-02 11:22 - 00003616 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A02014-10-10 17:56 - 2006-11-02 11:22 - 00003616 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A02014-10-10 16:00 - 2009-05-27 08:56 - 01148630 ____N () C:\Windows\WindowsUpdate.log2014-10-10 15:57 - 2012-03-14 12:56 - 00000894 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job2014-10-10 15:56 - 2010-05-11 17:14 - 00000000 ____D () C:\ProgramData\Kodak2014-10-10 15:56 - 2006-11-02 11:42 - 00000006 ____H () C:\Windows\Tasks\SA.DAT2014-10-10 15:55 - 2006-11-02 11:42 - 00032572 _____ () C:\Windows\Tasks\SCHEDLGU.TXT2014-10-10 13:29 - 2013-08-03 21:32 - 00003986 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{ECEEEB37-047B-4EC4-968D-E55338B6D4D3}2014-10-10 13:29 - 2013-08-03 21:32 - 00000436 ____H () C:\Windows\Tasks\User_Feed_Synchronization-{ECEEEB37-047B-4EC4-968D-E55338B6D4D3}.job2014-10-10 03:17 - 2014-07-16 13:30 - 00000000 __SHD () C:\Windows\SysWOW64\AI_RecycleBin2014-10-10 03:13 - 2009-09-02 13:50 - 00098160 _____ () C:\Users\Sharon\AppData\Local\GDIPFONTCACHEV1.DAT2014-10-10 03:07 - 2006-11-02 11:21 - 00361608 _____ () C:\Windows\system32\FNTCACHE.DAT2014-10-10 03:06 - 2006-11-02 09:34 - 00000000 ____D () C:\Windows\tracing2014-10-10 03:02 - 2006-11-02 11:25 - 00000749 ___RH () C:\Windows\WindowsShell.Manifest2014-10-10 02:45 - 2014-06-05 22:28 - 00000000 ____D () C:\ProgramData\OruroPfuve2014-10-10 02:09 - 2009-05-13 08:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP2014-10-10 02:07 - 2009-05-13 08:16 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information2014-10-10 02:02 - 2009-05-13 08:03 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PC Help & Tools2014-10-10 01:57 - 2009-05-13 08:16 - 00000000 ____D () C:\Windows\Panther2014-10-10 01:29 - 2013-07-08 19:39 - 00000000 ____D () C:\Windows\Minidump2014-10-10 01:27 - 2009-05-13 08:22 - 00000000 ____D () C:\ProgramData\Temp2014-10-09 23:52 - 2014-08-26 22:11 - 00003378 _____ () C:\Windows\System32\Tasks\PCSpeedClean_Popup2014-10-09 23:48 - 2014-07-16 14:22 - 00016152 _____ () C:\Windows\system32\Drivers\SWDUMon.sys2014-10-09 23:48 - 2014-03-13 17:49 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 22014-10-09 23:45 - 2013-09-04 22:56 - 00000000 ____D () C:\Users\Sharon\AppData\Local\CRE2014-10-09 19:56 - 2012-11-07 17:34 - 00000000 ____D () C:\ProgramData\Yahoo!2014-10-09 19:56 - 2012-11-07 17:34 - 00000000 ____D () C:\Program Files (x86)\Yahoo!2014-10-09 19:55 - 2014-01-03 12:20 - 00016985 _____ () C:\Windows\wininit.ini2014-10-09 19:54 - 2013-09-09 22:11 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy2014-10-09 19:42 - 2009-05-13 08:01 - 00000000 ____D () C:\Program Files (x86)\Python2014-10-09 19:30 - 2010-01-14 12:28 - 00000000 ____D () C:\Users\Sharon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Hoyle®2014-10-09 19:30 - 2010-01-14 12:27 - 00000000 ____D () C:\Program Files (x86)\Encore2014-10-09 19:21 - 2012-08-16 12:39 - 00000000 ____D () C:\ProgramData\FilesOpened2014-10-09 19:20 - 2010-01-14 20:24 - 00000000 ____D () C:\Program Files (x86)\eGames2014-10-09 19:03 - 2009-10-24 18:00 - 00000000 ____D () C:\Program Files (x86)\Intuit2014-10-09 15:01 - 2012-11-10 00:03 - 00000290 _____ () C:\Windows\Tasks\FastAgain PC Booster_DEFAULT.job2014-10-09 12:45 - 2014-07-16 14:24 - 00000432 _____ () C:\Windows\Tasks\SlimCleaner Plus (Scheduled Scan - Sharon).job2014-10-09 09:23 - 2013-08-13 20:58 - 00000258 __RSH () C:\Users\Sharon\ntuser.pol2014-10-09 09:23 - 2009-09-02 12:33 - 00000000 ____D () C:\Users\Sharon2014-10-08 23:03 - 2012-11-10 00:03 - 00000298 _____ () C:\Windows\Tasks\FastAgain PC Booster_UPDATES.job2014-10-08 21:15 - 2012-03-14 12:53 - 00002425 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk2014-10-07 18:49 - 2010-05-11 17:22 - 00000426 _____ () C:\Windows\Tasks\AiO Home Center Registration Remind Task.job2014-10-07 18:49 - 2010-05-11 17:14 - 00245046 _____ () C:\Users\Sharon\AppData\Local\installer.log2014-10-06 17:24 - 2009-12-14 18:54 - 00000052 _____ () C:\Windows\SysWOW64\DOErrors.log2014-09-25 17:02 - 2009-09-02 14:23 - 00002569 _____ () C:\Users\Sharon\Desktop\Microsoft Office Excel 2007.lnk2014-09-25 17:01 - 2009-09-02 14:24 - 00002611 _____ () C:\Users\Sharon\Desktop\Microsoft Office Word 2007.lnk2014-09-17 23:55 - 2014-03-13 18:14 - 00001975 _____ () C:\Users\Sharon\Desktop\Google Chrome.lnk2014-09-15 09:06 - 2010-05-12 06:47 - 00278152 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe2014-09-12 04:28 - 2014-08-09 11:55 - 00000000 ____D () C:\Users\Sharon\AppData\Roaming\Ancuym2014-09-12 04:00 - 2014-02-26 04:07 - 00751766 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI2014-09-12 04:00 - 2006-11-02 08:46 - 00751766 _____ () C:\Windows\system32\PerfStringBackup.INI2014-09-12 03:02 - 2013-08-15 03:08 - 00000000 ____D () C:\Windows\system32\MRT2014-09-12 03:02 - 2006-11-02 08:35 - 101694776 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe Files to move or delete:====================C:\Windows\Tasks\{F559D6F4-03BC-FB8E-356A-00FC41EA67C0}.job ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signedC:\Windows\System32\wininit.exe => File is digitally signedC:\Windows\SysWOW64\wininit.exe => File is digitally signedC:\Windows\explorer.exe => File is digitally signedC:\Windows\SysWOW64\explorer.exe => File is digitally signedC:\Windows\System32\svchost.exe => File is digitally signedC:\Windows\SysWOW64\svchost.exe => File is digitally signedC:\Windows\System32\services.exe => File is digitally signedC:\Windows\System32\User32.dll => File is digitally signedC:\Windows\SysWOW64\User32.dll => File is digitally signedC:\Windows\System32\userinit.exe => File is digitally signedC:\Windows\SysWOW64\userinit.exe => File is digitally signedC:\Windows\System32\rpcss.dll => File is digitally signedC:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-10-10 16:02 ==================== End Of Log ============================ Addition.txt Additional scan result of Farbar Recovery Scan Tool (x64) Version: 08-10-2014 01Ran by Sharon at 2014-10-10 21:39:23Running from C:\Users\Sharon\DesktopBoot Mode: Normal========================================================== ==================== Security Center ======================== (If an entry is included in the fixlist, it will be removed.) ==================== Installed Programs ====================== (Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.) Update for Microsoft Office 2007 (KB2508958) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0C5823AA-7B6F-44E1-8D5B-8FD1FF0E6438}) (Version: - Microsoft)ABBYY FineReader 6.0 Sprint (HKLM-x32\...\{ACF60000-22B9-4CE9-98D6-2CCF359BAC07}) (Version: 6.00.2146.41621 - ABBYY Software House)ABBYY FineReader 9.0 Sprint (HKLM-x32\...\ABBYY FineReader 9.0 Sprint) (Version: 9.01.513.58212 - ABBYY)ABBYY FineReader 9.0 Sprint (x32 Version: 9.01.513.58212 - ABBYY) HiddenAcrobat.com (HKLM-x32\...\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 1.7.186 - Adobe Systems Incorporated)Acrobat.com (x32 Version: 1.7.186 - Adobe Systems Incorporated) HiddenActivation Assistant for the 2007 Microsoft Office suites (x32 Version: 1.0.1 - Microsoft Corporation) HiddenActiveCheck component for HP Active Support Library (x32 Version: 3.0.0.2 - Hewlett-Packard) HiddenAdobe AIR (HKLM-x32\...\Adobe AIR) (Version: 2.7.1.19610 - Adobe Systems Incorporated)Adobe AIR (x32 Version: 2.7.1.19610 - Adobe Systems Incorporated) HiddenAdobe Flash Player 11 ActiveX (HKLM-x32\...\{41042E28-CCA1-4147-869F-9E928B38F04C}) (Version: 11.9.900.170 - Adobe Systems Incorporated)Adobe Reader X (10.1.12) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AA1000000001}) (Version: 10.1.12 - Adobe Systems Incorporated)aiofw (x32 Version: 4.2.6.8 - Eastman Kodak Company) Hiddenaioprnt (Version: 4.2.7.4 - Eastman Kodak Company) Hiddenaioscnnr (x32 Version: 4.2.6.0 - Your Company Name) HiddenApple Application Support (HKLM-x32\...\{6A3F9D74-BB80-4451-8CA1-4B3A857F1359}) (Version: 2.0.1 - Apple Inc.)Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)Bonjour (HKLM\...\{DAE239CE-EB9D-4EB3-B0D4-528D6BAA48FD}) (Version: 1.0.106 - Apple Inc.)Brother HL-2140 (HKLM-x32\...\{C8A34CF0-F679-49C6-B772-1D1B8356F698}) (Version: 1.00 - Brother)CCleaner (HKLM\...\CCleaner) (Version: 4.17 - Piriform)center (x32 Version: 4.2.6.8 - Eastman Kodak Company) HiddenCompatibility Pack for the 2007 Office system (HKLM-x32\...\{90120000-0020-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)CyberLink DVD Suite Deluxe (HKLM-x32\...\InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}) (Version: 6.0.2602 - CyberLink Corp.)CyberLink DVD Suite Deluxe (x32 Version: 6.0.2602 - CyberLink Corp.) HiddenDirectX for Managed Code Update (Summer 2004) (x32 Version: 9.02.2904 - Microsoft) HiddenEpson Copy Utility 3.5 (HKLM-x32\...\{AA72FB28-73B4-49E5-B6B4-E78F44BBD0AD}) (Version: 3.5.0.0 - )Epson Event Manager (HKLM-x32\...\{8F01524C-0676-4CC1-B4AE-64753C723391}) (Version: 3.01.0005 - Seiko Epson Corporation)EPSON Scan (HKLM-x32\...\EPSON Scanner) (Version: - Seiko Epson Corporation)EPSON Scan PDF EXtensions (HKLM-x32\...\{F9956472-6E16-4F83-BF9A-F887EF4A45B7}) (Version: 1.03.0000 - SEIKO EPSON Corp.)EPSON WorkForce GT-1500 Scanner Driver Update version 3.0.2.0 (HKLM-x32\...\ScannerDriverUpdateEPSON WorkForce GT-1500_is1) (Version: 3.0.2.0 - Epson America Inc.)FinePix Studio (HKLM-x32\...\{E3B3AB03-8ABC-46CF-8CA9-DB5581E1F368}) (Version: - )FinePixViewer Resource (HKLM-x32\...\{B44529FF-501E-47CD-A06D-223C161BE058}) (Version: 1.2 - FUJIFILM Corporation)FinePixViewer Ver.5.5 (HKLM-x32\...\{24ED4D80-8294-11D5-96CD-0040266301AD}) (Version: 5.5 - FUJIFILM Corporation)GEAR driver installer for x86 and x64 (x32 Version: 4.008.5 - GEAR Software) HiddenGoogle Chrome (HKLM-x32\...\Google Chrome) (Version: 37.0.2062.124 - Google Inc.)Google Toolbar for Internet Explorer (HKLM-x32\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: - Google Inc.)Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) HiddenGoogle Update Helper (x32 Version: 1.3.24.15 - Google Inc.) HiddenGoToAssist Customer 2.2.0.758 (HKLM-x32\...\GoToAssist Express Customer) (Version: 2.2.0.758 - Citrix Online)HP Active Support Library (HKLM-x32\...\{0295F89F-F698-4101-9A7D-49F407EC2D82}) (Version: 3.1.10.1 - Hewlett-Packard)HP Advisor (HKLM-x32\...\{73A43E42-3658-4DD9-8551-FACDA3632538}) (Version: 3.1.1000.1002 - Hewlett-Packard)HP Customer Experience Enhancements (HKLM-x32\...\{B84739A3-F943-47E4-95D8-96381EF5AC48}) (Version: 5.7.0.2945 - Hewlett-Packard)HP Deskjet 1000 J110 series Basic Device Software (HKLM\...\{A3E89C5B-BB3A-433A-A878-D1310BB13EAD}) (Version: 28.0.1313.0 - Hewlett-Packard Co.)HP Deskjet 1000 J110 series Help (HKLM-x32\...\{DDDFCC77-7F9C-45E9-B38E-721BA599BA0C}) (Version: 140.0.65.65 - Hewlett Packard)HP Deskjet 1000 J110 series Product Improvement Study (HKLM\...\{EEC82191-E879-4906-9D6B-D9665CF030CD}) (Version: 28.0.1313.0 - Hewlett-Packard Co.)HP Games (HKLM-x32\...\WildTangent hp Master Uninstall) (Version: 1.0.0.66 - WildTangent)HP MediaSmart Demo (HKLM-x32\...\{290CA856-3737-4874-864B-BA142F4823C8}_is1) (Version: 1.0.0.0 - Hewlett-Packard Company)HP MediaSmart Music/Photo/Video (HKLM-x32\...\InstallShield_{B2EE25B9-5B00-4ACF-94F0-92433C28C39E}) (Version: 2.2.2809 - Hewlett-Packard)HP MediaSmart Music/Photo/Video (x32 Version: 2.2.2809 - Hewlett-Packard) HiddenHP MediaSmart SmartMenu (HKLM\...\{D2E8F543-D23A-4A38-AFFC-4BDEBFBA6FDA}) (Version: 2.1.12 - Hewlett-Packard)HP Odometer (HKLM-x32\...\{B8AC1A89-FFD1-4F97-8051-E505A160F562}) (Version: 2.10.0000 - Hewlett-Packard)HP Photo Creations (HKLM-x32\...\HP Photo Creations) (Version: 1.0.0.7702 - HP)HP Picasso Media Center Add-In (x32 Version: 1.0.0 - HP) HiddenHP Product Detection (HKLM-x32\...\{CAE7D1D9-3794-4169-B4DD-964ADBC534EE}) (Version: 9.7.2 - Hewlett-Packard Company)HP Recovery Manager RSS (x32 Version: 92.0.0.11 - Hewlet Packard Company) HiddenHP Remote Software (HKLM\...\{5F240DB8-0D74-4F13-86C3-929760392A8D}) (Version: 1.0.5.0 - Hewlett-Packard)HP Support Information (HKLM-x32\...\{1CC069FA-1A86-402E-9787-3F04E652C67A}) (Version: 10.1.0001 - Hewlett-Packard)HPAsset component for HP Active Support Library (x32 Version: 3.0.2.2 - Hewlett-Packard) HiddenIntel® Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version: - Intel Corporation)Intel® Matrix Storage Manager (HKLM\...\{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}) (Version: - Intel Corporation)ISIS Driver - EPSON GT-1500 v1.0 (HKLM-x32\...\{D41864EF-CC5D-4CF4-B0B9-CA3152164157}) (Version: 1.0 - EMC Captiva)Java 7 Update 15 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217015FF}) (Version: 7.0.150 - Oracle)Java Auto Updater (x32 Version: 2.1.9.0 - Sun Microsystems, Inc.) HiddenKODAK AiO Home Center (HKLM-x32\...\{E0F274B7-592B-4669-8FB8-8D9825A09858}) (Version: 4.2.7.7 - Eastman Kodak Company)ksDIP (x32 Version: 3.20.0000.0000 - Eastman Kodak Company) HiddenLabelPrint (HKLM-x32\...\InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.5.1402 - CyberLink Corp.)LabelPrint (x32 Version: 2.5.1402 - CyberLink Corp.) HiddenLightScribe System Software (HKLM-x32\...\{7F10292C-A190-4176-A665-A1ED3478DF86}) (Version: 1.18.3.2 - LightScribe)McAfee Virtual Technician (HKLM-x32\...\McAfee Virtual Technician) (Version: 7.5.0.3093 - McAfee, Inc.)Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version: - Microsoft Corporation)Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729 - Microsoft Corporation) HiddenMicrosoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) HiddenMicrosoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)Microsoft Office 2007 Service Pack 3 (SP3) (x32 Version: - Microsoft) HiddenMicrosoft Office Excel MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) HiddenMicrosoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)Microsoft Office Home and Student 2007 (HKLM-x32\...\HOMESTUDENTR) (Version: 12.0.6612.1000 - Microsoft Corporation)Microsoft Office Home and Student 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) HiddenMicrosoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) HiddenMicrosoft Office OneNote MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) HiddenMicrosoft Office PowerPoint MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) HiddenMicrosoft Office PowerPoint Viewer 2007 (English) (HKLM-x32\...\{95120000-00AF-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) HiddenMicrosoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) HiddenMicrosoft Office Proof (Spanish) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) HiddenMicrosoft Office Proofing (English) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) HiddenMicrosoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32 Version: - Microsoft) HiddenMicrosoft Office Shared 64-bit MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) HiddenMicrosoft Office Shared 64-bit Setup Metadata MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) HiddenMicrosoft Office Shared MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) HiddenMicrosoft Office Shared Setup Metadata MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) HiddenMicrosoft Office Word MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) HiddenMicrosoft Silverlight (HKLM-x32\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (HKLM\...\{B6E3757B-5E77-3915-866A-CCFC4B8D194C}) (Version: 8.0.50727.4053 - Microsoft Corporation)Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148 (HKLM\...\{EE936C7A-EA40-31D5-9B65-8E3E089C3828}) (Version: 9.0.30729.4148 - Microsoft Corporation)Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (HKLM-x32\...\{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}) (Version: 9.0.30729.4148 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (HKLM\...\{350AA351-21FA-3270-8B7A-835434E766AD}) (Version: 9.0.21022 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729 (HKLM\...\{4FFA2088-8317-3B14-93CD-4C699DB37843}) (Version: 9.0.30729 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319 (HKLM-x32\...\{196BB40D-1578-3D01-B289-BEFC77A11A1E}) (Version: 10.0.30319 - Microsoft Corporation)Microsoft Web Publishing Wizard 1.52 (HKLM-x32\...\WebPost) (Version: - )Microsoft Works (HKLM-x32\...\{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}) (Version: 9.7.0621 - Microsoft Corporation)Mozilla Firefox 23.0.1 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 23.0.1 (x86 en-US)) (Version: 23.0.1 - Mozilla)Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 23.0.1 - Mozilla)MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)PictureMover (HKLM-x32\...\{1896E712-2B3D-45eb-BCE9-542742A51032}) (Version: 3.3.1.12 - Hewlett-Packard Company)Playalot Games (HKLM-x32\...\{3A3532ED-A121-4297-AA4F-70B60E4BD631}) (Version: 1.0.0 - W3i, LLC)Playtopus (HKCU\...\Playtopus) (Version: - Playtopus)Power2Go (HKLM-x32\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.0.2602 - CyberLink Corp.)Power2Go (x32 Version: 6.0.2602 - CyberLink Corp.) HiddenPowerDirector (HKLM-x32\...\InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}) (Version: 7.0.2611 - CyberLink Corp.)PowerDirector (x32 Version: 7.0.2611 - CyberLink Corp.) HiddenPreReq (x32 Version: 3.20.0000.0000 - Eastman Kodak Company) HiddenPython 2.6.1 (HKLM-x32\...\{9CC89170-000B-457D-91F1-53691F85B223}) (Version: 2.6.1150 - Python Software Foundation)Quicken 2010 (HKLM-x32\...\{CCF6F57B-F6B4-4508-BF45-63AAC9DE416A}) (Version: 19.1.3.19 - Intuit)Quicken Basic 2000 (HKLM-x32\...\Quicken Basic 2000) (Version: - )QuickTime (HKLM-x32\...\{C9E14402-3631-4182-B377-6B0DFB1C0339}) (Version: 7.70.80.34 - Apple Inc.)Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5789 - Realtek Semiconductor Corp.)Shockwave (HKLM-x32\...\Shockwave) (Version: - )Solitaire Master 5 (HKLM-x32\...\Solitaire Master 5) (Version: - )Temp File Cleaner (HKLM\...\Temp File Cleaner) (Version: 4.3.0 - Addpcs, LLC)TurboTax 2009 (HKLM-x32\...\TurboTax 2009) (Version: - Intuit, Inc)TurboTax 2009 wctiper (x32 Version: 009.000.0682 - Intuit Inc.) HiddenTurboTax 2009 WinPerFedFormset (x32 Version: 009.000.1779 - Intuit Inc.) HiddenTurboTax 2009 WinPerReleaseEngine (x32 Version: 009.000.0311 - Intuit Inc.) HiddenTurboTax 2009 WinPerTaxSupport (x32 Version: 009.000.0227 - Intuit Inc.) HiddenTurboTax 2009 wnyiper (x32 Version: 009.000.0695 - Intuit Inc.) HiddenTurboTax 2009 wrapper (x32 Version: 009.000.0145 - Intuit Inc.) HiddenUpdate for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (HKLM-x32\...\{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}.KB963707) (Version: 1 - Microsoft Corporation)Update for Microsoft Office 2007 Help for Common Features (KB963673) (HKLM-x32\...\{90120000-006E-0409-0000-0000000FF1CE}_HOMESTUDENTR_{AB365889-0395-4FAD-B702-CA5985D53D42}) (Version: - Microsoft)Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version: - Microsoft)Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{90120000-002A-0000-1000-0000000FF1CE}_HOMESTUDENTR_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version: - Microsoft)Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version: - Microsoft)Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{E9A82945-BA29-4EE8-8F2A-2F49545E9CF2}) (Version: - Microsoft)Update for Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0409-0000-0000000FF1CE}_HOMESTUDENTR_{199DF7B6-169C-448C-B511-1054101BE9C9}) (Version: - Microsoft)Update for Microsoft Office OneNote 2007 Help (KB963670) (HKLM-x32\...\{90120000-00A1-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2744EF05-38E1-4D5D-B333-E021EDAEA245}) (Version: - Microsoft)Update for Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0409-0000-0000000FF1CE}_HOMESTUDENTR_{397B1D4F-ED7B-4ACA-A637-43B670843876}) (Version: - Microsoft)Update for Microsoft Office Script Editor Help (KB963671) (HKLM-x32\...\{90120000-006E-0409-0000-0000000FF1CE}_HOMESTUDENTR_{CD11C6A2-FFC6-4271-8EAB-79C3582F505C}) (Version: - Microsoft)Update for Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0409-0000-0000000FF1CE}_HOMESTUDENTR_{80E762AA-C921-4839-9D7D-DB62A72C0726}) (Version: - Microsoft)VLC media player 2.1.2 (HKLM-x32\...\VLC media player) (Version: 2.1.2 - VideoLAN)Yahoo! Detect (HKLM-x32\...\YTdetect) (Version: - )Yahoo! Toolbar (HKLM-x32\...\Yahoo! Companion) (Version: - Yahoo! Inc.) ==================== Custom CLSID (selected items): ========================== (If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.) CustomCLSID: HKU\S-1-5-21-3122679508-3511620857-1760614917-1000_Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\localserver32 -> rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";eval("epdvnfou/xsjuf)(=tdsjqu!mbohvbhf>ktds (the data entry has 247 more characters). <==== Poweliks?CustomCLSID: HKU\S-1-5-21-3122679508-3511620857-1760614917-1000_Classes\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32 -> C:\Users\Sharon\AppData\Local\Temp\soupoqr\stdipwr\wow.dll No File ==================== Restore Points ========================= Could not list Restore Points. Check "winmgmt" service or repair WMI. ==================== Hosts content: ========================== (If needed Hosts: directive could be included in the fixlist to reset Hosts.) 2006-11-02 08:34 - 2014-10-10 03:02 - 00450632 ____A C:\Windows\system32\Drivers\etc\hosts127.0.0.1 localhost127.0.0.1 www.007guard.com127.0.0.1 007guard.com127.0.0.1 008i.com127.0.0.1 www.008k.com127.0.0.1 008k.com127.0.0.1 www.00hq.com127.0.0.1 00hq.com127.0.0.1 010402.com127.0.0.1 www.032439.com127.0.0.1 032439.com127.0.0.1 www.0scan.com127.0.0.1 0scan.com127.0.0.1 1000gratisproben.com127.0.0.1 www.1000gratisproben.com127.0.0.1 1001namen.com127.0.0.1 www.1001namen.com127.0.0.1 100888290cs.com127.0.0.1 www.100888290cs.com127.0.0.1 www.100sexlinks.com127.0.0.1 100sexlinks.com127.0.0.1 10sek.com127.0.0.1 www.10sek.com127.0.0.1 www.1-2005-search.com127.0.0.1 1-2005-search.com127.0.0.1 123fporn.info127.0.0.1 www.123fporn.info127.0.0.1 123haustiereundmehr.com127.0.0.1 www.123haustiereundmehr.com There are 1000 more lines. ==================== Scheduled Tasks (whitelisted) ============= (If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.) Task: {02CE6A14-9918-43D2-B469-7588165AF243} - System32\Tasks\Scan the system (Spybot - Search & Destroy) => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exeTask: {03F02F2A-4205-4341-9EFF-28D21CA2869B} - System32\Tasks\Check for updates (Spybot - Search & Destroy) => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exeTask: {0A42D78F-C665-4CA0-85AB-819BF30D12C1} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)Task: {0AEAFAF6-F116-4A60-AFB4-C8B755A6E975} - System32\Tasks\Microsoft\Windows\MobilePC\TMMTask: {0FAA1680-4D44-4AD0-918A-B9190109F08E} - System32\Tasks\Security Center Update - 3010263955 => C:\Users\Sharon\AppData\Roaming\Qiqaaxu\talee.exe [2013-07-31] () <==== ATTENTIONTask: {105442AD-E4DD-4ED0-B61E-A134643ECB8B} - System32\Tasks\PCSpeedClean_Popup => C:\Program Files (x86)\PC Speed Clean\Splash.exeTask: {18DD8AB9-6084-435D-957D-3E39284E84B3} - System32\Tasks\Rocket Updater => C:\Users\Sharon\AppData\Roaming\ROCKET~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTIONTask: {192DDA2D-5815-47B8-983F-65744FEEC03A} - System32\Tasks\Microsoft\Windows\Shell\CrawlStartPagesTask: {1CFC9A8E-FAC8-4346-A91A-7E1CEDE17678} - System32\Tasks\DTReg => C:\Users\Sharon\AppData\Roaming\DefaultTab\DefaultTab\DTReg.exe <==== ATTENTIONTask: {254095AE-FB97-48EA-94A5-D8BF2AB79714} - System32\Tasks\Microsoft\Windows\RAC\RACAgent => C:\Windows\system32\RacAgent.exe [2008-01-20] (Microsoft Corporation)Task: {255718C8-317F-422C-AF8C-B1F3A09505E3} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-03-14] (Google Inc.)Task: {2B6185EF-F140-4A61-9909-D26A4DCBB631} - System32\Tasks\Security Center Update - 398391132 => C:\Users\Sharon\AppData\Roaming\Uhniovgi\maxee.exe [2014-04-17] () <==== ATTENTIONTask: {2BB45129-7013-450D-82D5-3BBD6D784400} - System32\Tasks\APSnotifierPP3 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTIONTask: {2C2ECC56-F0E0-4E98-AD4D-F8D3AA311064} - System32\Tasks\FastAgain PC Booster => C:\Program Files (x86)\FastAgain PC Booster\PCBooster.exeTask: {313668D2-6B9D-4765-85EE-CFE32497C141} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-07-16] (Adobe Systems Incorporated)Task: {32975251-CAE8-41EB-943B-C81278159174} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-03-14] (Google Inc.)Task: {32B4C94A-F0F3-42B7-A0F8-2D77BF02B22D} - System32\Tasks\Refresh immunization (Spybot - Search & Destroy) => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exeTask: {374F3482-606C-448A-A440-DE0754F6987A} - System32\Tasks\Performance Center_Sharon-PC@Sharon => C:\Program Files (x86)\Ascentive\Performance Center\APCMain.exeTask: {3A8728A2-0FA0-4B8F-BE97-DD4A5C19FF8D} - System32\Tasks\FastAgain PC Booster_UPDATES => C:\Program Files (x86)\FastAgain PC Booster\PCBooster.exeTask: {4AE3D503-C641-4986-BF61-A10273BEEC63} - System32\Tasks\AiO Home Center Registration Remind Task => C:\ProgramData\Kodak\Installer\Registration.exe [2009-08-05] (KODAK)Task: {4BA7005E-BEEC-4143-BA7A-60D6D7040E67} - \PC Performer No Task File <==== ATTENTIONTask: {51328E17-83ED-4D53-8C85-6C9D071CCED0} - System32\Tasks\Security Center Update - 1990788741 => C:\Users\Sharon\AppData\Roaming\Edpopob\ighoaz.exe [2013-08-31] () <==== ATTENTIONTask: {541B2805-D467-4B34-B6FC-DAE22CAB8009} - System32\Tasks\LaunchApp => C:\Program Files (x86)\MyPC Backup\MyPC Backup.exe <==== ATTENTIONTask: {54352893-4779-4C5E-9D9E-BA9ABBC48D87} - \Security Center Update - 697063983 No Task File <==== ATTENTIONTask: {54435C51-5DEC-4029-B594-7EF839CB1E8C} - System32\Tasks\{9C36FFDA-02CA-D98A-C551-06CFEF40C5BC} => C:\Users\Sharon\AppData\Roaming\zvloglr.dll [2014-10-10] ()Task: {58948AA3-4DF3-4D3A-84E1-8959E860B16B} - \RegClean Pro No Task File <==== ATTENTIONTask: {69ABADD9-FD22-419B-99DE-B367350AD5AA} - System32\Tasks\HPCustParticipation HP Deskjet 1000 J110 series => C:\Program Files\HP\HP Deskjet 1000 J110 series\Bin\HPCustPartic.exe [2012-10-02] (Hewlett-Packard Co.)Task: {735836CC-8231-418E-B028-CE5E9C32650C} - \Playtopus Updater No Task File <==== ATTENTIONTask: {7BC40770-4194-48B8-9928-D22E2262F376} - \PC Performer_DEFAULT No Task File <==== ATTENTIONTask: {7C638E5B-ECE5-4424-A7E5-2C913CA682E9} - System32\Tasks\Microsoft\Windows\NetworkAccessProtection\NAPStatus UITask: {7FC5C61E-B7D4-4776-A13F-C99CAE28ABB6} - \PC Performer_UPDATES No Task File <==== ATTENTIONTask: {9F1F0242-4DE4-449E-8C23-4F8716F92E9C} - System32\Tasks\Microsoft\Windows\Tcpip\WSHReset => C:\Windows\system32\netsh.exe [2006-11-02] (Microsoft Corporation)Task: {AE644FCA-D6E8-42AA-B3CC-46169528CDC7} - System32\Tasks\HP Health Check => c:\Program Files (x86)\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe [2008-12-04] (Hewlett-Packard)Task: {AFD4CF3D-ED08-4EA0-A869-42F2AA6DC024} - System32\Tasks\SlimCleaner Plus (Scheduled Scan - Sharon) => C:\Program Files\SlimCleaner Plus\SlimCleanerPlus.exeTask: {B01FC9A8-DCEC-4BB4-80EB-A7F3544A7242} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Signature Update => c:\program files\windows defender\MpCmdRun.exe [2008-01-20] (Microsoft Corporation)Task: {BB0944B5-F633-4559-BD0B-F4D1516F2214} - System32\Tasks\PCSpeedClean_Start => C:\Program Files (x86)\PC Speed Clean\PCSpeedClean.exeTask: {BF7E9A84-DBBC-45C4-B05F-41D3A1E4AB06} - System32\Tasks\Scheduled Update for Ask Toolbar => C:\Program Files (x86)\Ask.com\UpdateTask.exe <==== ATTENTIONTask: {D02B20DD-252F-4905-AD46-47226B27C549} - System32\Tasks\APSnotifierPP2 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTIONTask: {E010CE68-EDBA-49C5-92D5-1E9FEB7B6409} - \Security Center Update - 1913703763 No Task File <==== ATTENTIONTask: {E91D6474-70CC-42BE-80FF-8BED8AF557ED} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\system32\gatherWirelessInfo.vbs [2008-01-20] ()Task: {F2FBFBC8-815A-4A61-B923-D3A3B5CF9AEA} - \PastaQuotes No Task File <==== ATTENTIONTask: {F3B1433A-0EA0-4507-B0CD-35A624944C01} - System32\Tasks\Performance Center@Logon => C:\Program Files (x86)\Ascentive\Performance Center\APCMain.exeTask: {F6742C4D-1CFD-42F4-9D87-3A2FCD2E5DC5} - System32\Tasks\APSnotifierPP1 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTIONTask: {FDE15D5B-898A-4753-A69A-3E3B2DE04DF2} - System32\Tasks\FastAgain PC Booster_DEFAULT => C:\Program Files (x86)\FastAgain PC Booster\PCBooster.exeTask: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exeTask: C:\Windows\Tasks\AiO Home Center Registration Remind Task.job => C:\ProgramData\Kodak\Installer\Registration.exeTask: C:\Windows\Tasks\APSnotifierPP1.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTIONTask: C:\Windows\Tasks\APSnotifierPP2.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTIONTask: C:\Windows\Tasks\APSnotifierPP3.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTIONTask: C:\Windows\Tasks\FastAgain PC Booster_DEFAULT.job => C:\Program Files (x86)\FastAgain PC Booster\PCBooster.exeTask: C:\Windows\Tasks\FastAgain PC Booster_UPDATES.job => C:\Program Files (x86)\FastAgain PC Booster\PCBooster.exeTask: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exeTask: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exeTask: C:\Windows\Tasks\Rocket Updater.job => C:\Users\Sharon\AppData\Roaming\ROCKET~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTIONTask: C:\Windows\Tasks\Security Center Update - 1990788741.job => C:\Users\Sharon\AppData\Roaming\Edpopob\ighoaz.exe <==== ATTENTIONTask: C:\Windows\Tasks\Security Center Update - 3010263955.job => C:\Users\Sharon\AppData\Roaming\Qiqaaxu\talee.exe <==== ATTENTIONTask: C:\Windows\Tasks\Security Center Update - 398391132.job => C:\Users\Sharon\AppData\Roaming\Uhniovgi\maxee.exe <==== ATTENTIONTask: C:\Windows\Tasks\SlimCleaner Plus (Scheduled Scan - Sharon).job => C:\Program Files\SlimCleaner Plus\SlimCleanerPlus.exeTask: C:\Windows\Tasks\User_Feed_Synchronization-{ECEEEB37-047B-4EC4-968D-E55338B6D4D3}.job => C:\Windows\system32\msfeedssync.exeTask: C:\Windows\Tasks\{F559D6F4-03BC-FB8E-356A-00FC41EA67C0}.job => C:\Windows\system32\regsvr32.exe ==================== Loaded Modules (whitelisted) ============= 2014-04-17 15:08 - 2014-04-17 15:08 - 00291069 _____ () C:\Users\Sharon\AppData\Roaming\Uhniovgi\maxee.exe2009-06-29 15:14 - 2009-06-29 15:14 - 00012288 _____ () C:\Program Files (x86)\Kodak\AiO\Center\Logger.dll2010-01-14 11:06 - 2010-01-14 11:06 - 00854016 _____ () C:\Windows\assembly\GAC_32\System.Data.SQLite\1.0.61.0__db937bc2d44ff139\System.Data.SQLite.dll2010-01-14 11:06 - 2010-01-14 11:06 - 00471040 _____ () C:\Windows\assembly\GAC_MSIL\Intuit.Spc.Map.Reporter\5.0.104.0__7ce6deabcb36a8ea\Intuit.Spc.Map.Reporter.dll2013-12-08 20:18 - 2013-12-08 20:18 - 00498176 _____ () C:\Program Files (x86)\VideoLAN\VLC\axvlc.dll2013-12-08 20:18 - 2013-12-08 20:18 - 00113664 _____ () C:\Program Files (x86)\VideoLAN\VLC\libvlc.dll2013-12-08 20:19 - 2013-12-08 20:19 - 02342912 _____ () C:\Program Files (x86)\VideoLAN\VLC\libvlccore.dll ==================== Alternate Data Streams (whitelisted) ========= (If an entry is included in the fixlist, only the Alternate Data Streams will be removed.) ==================== Safe Mode (whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.) ==================== EXE Association (whitelisted) ============= (If an entry is included in the fixlist, the default will be restored. None default entries will be removed.) ==================== MSCONFIG/TASK MANAGER disabled items ========= (Currently there is no automatic fix for this section.) MSCONFIG\Services: BackupStack => 2MSCONFIG\Services: CltMngSvc => 2MSCONFIG\Services: DefaultTabUpdate => 2MSCONFIG\Services: gupdate => 2MSCONFIG\Services: gupdatem => 3MSCONFIG\Services: gusvc => 3MSCONFIG\Services: MozillaMaintenance => 3MSCONFIG\Services: YahooAUService => 2MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Event Reminder.lnk => C:\Windows\pss\Event Reminder.lnk.CommonStartupMSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^ExifLauncher2.lnk => C:\Windows\pss\ExifLauncher2.lnk.CommonStartupMSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^PictureMover.lnk => C:\Windows\pss\PictureMover.lnk.CommonStartupMSCONFIG\startupfolder: C:^Users^Sharon^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^MyPC Backup.lnk => C:\Windows\pss\MyPC Backup.lnk.StartupMSCONFIG\startupfolder: C:^Users^Sharon^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk => C:\Windows\pss\OneNote 2007 Screen Clipper and Launcher.lnk.StartupMSCONFIG\startupfolder: C:^Users^Sharon^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Socialbox.lnk => C:\Windows\pss\Socialbox.lnk.StartupMSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"MSCONFIG\startupreg: ApnUpdater => "C:\Program Files (x86)\Ask.com\Updater\Updater.exe"MSCONFIG\startupreg: BrStsWnd => "C:\Program Files (x86)\Brownie\BrstsW64.exe" AutorunMSCONFIG\startupreg: CLMLServer for HP TouchSmart => "c:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe"MSCONFIG\startupreg: Conime => %windir%\system32\conime.exeMSCONFIG\startupreg: DW7 => "C:\Program Files (x86)\The Weather Channel\The Weather Channel App\TWCApp.exe"MSCONFIG\startupreg: EEventManager => "C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe"MSCONFIG\startupreg: EKIJ5000StatusMonitor => C:\Windows\system32\spool\DRIVERS\x64\3\EKIJ5000MUI.exeMSCONFIG\startupreg: HP Health Check Scheduler => c:\Program Files (x86)\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exeMSCONFIG\startupreg: HP Remote Software => C:\Program Files\Hewlett-Packard\HP Remote\HP REMOTE V1.0.5.exeMSCONFIG\startupreg: HP Software Update => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exeMSCONFIG\startupreg: hpsysdrv => c:\program files (x86)\hewlett-packard\HP odometer\hpsysdrv.exeMSCONFIG\startupreg: Microsoft Default Manager => "c:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resumeMSCONFIG\startupreg: QuickTime Task => "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottimeMSCONFIG\startupreg: SmartMenu => %ProgramFiles%\Hewlett-Packard\HP MediaSmart\SmartMenu.exeMSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"MSCONFIG\startupreg: TSMAgent => "c:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe"MSCONFIG\startupreg: UpdateLBPShortCut => "c:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" "c:\Program Files (x86)\CyberLink\LabelPrint" UpdateWithCreateOnce "Software\CyberLink\LabelPrint\2.5"MSCONFIG\startupreg: UpdateP2GoShortCut => "c:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" "c:\Program Files (x86)\CyberLink\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0"MSCONFIG\startupreg: UpdatePDIRShortCut => "c:\Program Files (x86)\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe" "c:\Program Files (x86)\CyberLink\PowerDirector" UpdateWithCreateOnce "SOFTWARE\CyberLink\PowerDirector\7.0"MSCONFIG\startupreg: UpdatePSTShortCut => "c:\Program Files (x86)\CyberLink\CyberLink DVD Suite Deluxe\MUITransfer\MUIStartMenu.exe" "c:\Program Files (x86)\CyberLink\CyberLink DVD Suite Deluxe" UpdateWithCreateOnce "Software\CyberLink\PowerStarter" ========================= Accounts: ========================== Administrator (S-1-5-21-3122679508-3511620857-1760614917-500 - Administrator - Disabled)Guest (S-1-5-21-3122679508-3511620857-1760614917-501 - Limited - Disabled)Sharon (S-1-5-21-3122679508-3511620857-1760614917-1000 - Administrator - Enabled) => C:\Users\Sharon ==================== Faulty Device Manager Devices ============= Could not list Devices. Check "winmgmt" service or repair WMI. ==================== Event log errors: ========================= Application errors:==================Error: (10/10/2014 08:57:38 PM) (Source: Application Error) (EventID: 1000) (User: )Description: Faulting application msiexec.exe, version 5.0.0.0, time stamp 0x54344f7f, faulting module ntdll.dll, version 6.0.6002.18881, time stamp 0x51da3e00, exception code 0xc0000005, fault offset 0x0002d5d5,process id 0x20dc, application start time 0xmsiexec.exe0. Error: (10/10/2014 08:57:38 PM) (Source: Application Error) (EventID: 1000) (User: )Description: Faulting application msiexec.exe, version 5.0.0.0, time stamp 0x54252a2e, faulting module unknown, version 0.0.0.0, time stamp 0x00000000, exception code 0xc00000fd, fault offset 0x75849ba4,process id 0x34b0, application start time 0xmsiexec.exe0. Error: (10/10/2014 05:57:40 PM) (Source: Application Hang) (EventID: 1002) (User: )Description: The program Explorer.EXE version 6.0.6002.18005 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Problem Reports and Solutions control panel.Process ID: c80Start Time: 01cfe4c46b898d34Termination Time: 282 Error: (10/10/2014 04:04:46 PM) (Source: SecurityCenter) (EventID: 3) (User: )Description: The Windows Security Center Service was unable to establish event queries with WMI to monitor third party AntiVirus, AntiSpyware and Firewall. Error: (10/10/2014 03:58:36 PM) (Source: SecurityCenter) (EventID: 3) (User: )Description: The Windows Security Center Service was unable to establish event queries with WMI to monitor third party AntiVirus, AntiSpyware and Firewall. Error: (10/10/2014 03:56:27 PM) (Source: WinMgmt) (EventID: 28) (User: )Description: 0x8007007e Error: (10/10/2014 03:04:15 PM) (Source: SecurityCenter) (EventID: 3) (User: )Description: The Windows Security Center Service was unable to establish event queries with WMI to monitor third party AntiVirus, AntiSpyware and Firewall. Error: (10/10/2014 03:02:03 PM) (Source: WinMgmt) (EventID: 28) (User: )Description: 0x8007007e Error: (10/10/2014 01:53:51 PM) (Source: MsiInstaller) (EventID: 11720) (User: Sharon-PC)Description: Product: Microsoft Fix it 50472 -- Error 1720. There is a problem with this Windows Installer package. A script required for this install to complete could not be run. Contact your support personnel or package vendor. Custom action ProcessCheck script error -2147024770, : Line 18, Column 1, Error: (10/10/2014 01:29:29 PM) (Source: SecurityCenter) (EventID: 3) (User: )Description: The Windows Security Center Service was unable to establish event queries with WMI to monitor third party AntiVirus, AntiSpyware and Firewall. System errors:=============Error: (10/10/2014 04:11:32 PM) (Source: DCOM) (EventID: 10010) (User: )Description: {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} Error: (10/10/2014 04:09:45 PM) (Source: DCOM) (EventID: 10005) (User: )Description: 1053WSearch{7D096C5F-AC08-4F1F-BEB7-5C22C517CE39} Error: (10/10/2014 03:56:26 PM) (Source: Application Popup) (EventID: 1060) (User: )Description: \SystemRoot\SysWow64\Drivers\mrtRate.SYS has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver. Error: (10/10/2014 03:02:01 PM) (Source: Application Popup) (EventID: 1060) (User: )Description: \SystemRoot\SysWow64\Drivers\mrtRate.SYS has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver. Error: (10/10/2014 01:39:59 PM) (Source: DCOM) (EventID: 10010) (User: )Description: {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} Error: (10/10/2014 01:27:19 PM) (Source: Application Popup) (EventID: 1060) (User: )Description: \SystemRoot\SysWow64\Drivers\mrtRate.SYS has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver. Error: (10/10/2014 01:27:04 PM) (Source: Print) (EventID: 19) (User: NT AUTHORITY)Description: The print spooler failed to share printer HP Deskjet 1000 J110 series with shared resource name HP Deskjet 1000 J110 series. Error 2114. The printer cannot be used by others on the network. Error: (10/10/2014 09:29:12 AM) (Source: Application Popup) (EventID: 1060) (User: )Description: \SystemRoot\SysWow64\Drivers\mrtRate.SYS has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver. Error: (10/10/2014 09:29:00 AM) (Source: Print) (EventID: 19) (User: NT AUTHORITY)Description: The print spooler failed to share printer HP Deskjet 1000 J110 series with shared resource name HP Deskjet 1000 J110 series. Error 2114. The printer cannot be used by others on the network. Error: (10/10/2014 05:13:41 AM) (Source: DCOM) (EventID: 10005) (User: )Description: 1053WSearch{7D096C5F-AC08-4F1F-BEB7-5C22C517CE39} Microsoft Office Sessions:========================= CodeIntegrity Errors:=================================== Date: 2014-10-10 03:09:19.752 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system. Date: 2014-10-10 02:39:57.713 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys because the set of per-page image hashes could not be found on the system. Date: 2014-10-10 02:39:57.342 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys because the set of per-page image hashes could not be found on the system. Date: 2014-10-10 02:39:56.888 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys because the set of per-page image hashes could not be found on the system. Date: 2014-10-10 02:39:56.414 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys because the set of per-page image hashes could not be found on the system. Date: 2014-10-10 02:33:09.152 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system. Date: 2014-02-22 21:35:55.498 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Users\Sharon\AppData\Local\Temp\TEMP.^^^\SYMEVENT64x86.SYS because the set of per-page image hashes could not be found on the system. Date: 2014-02-22 21:35:55.201 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Users\Sharon\AppData\Local\Temp\TEMP.^^^\SYMEVENT64x86.SYS because the set of per-page image hashes could not be found on the system. Date: 2014-02-22 21:35:54.874 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Users\Sharon\AppData\Local\Temp\TEMP.^^^\SYMEVENT64x86.SYS because the set of per-page image hashes could not be found on the system. Date: 2014-02-22 21:35:54.562 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Users\Sharon\AppData\Local\Temp\TEMP.^^^\SYMEVENT64x86.SYS because the set of per-page image hashes could not be found on the system. ==================== Memory info =========================== Processor: Pentium® Dual-Core CPU E6300 @ 2.80GHzPercentage of memory in use: 76%Total physical RAM: 8181.33 MBAvailable physical RAM: 1902.52 MBTotal Pagefile: 16567.68 MBAvailable Pagefile: 9893.45 MBTotal Virtual: 8192 MBAvailable Virtual: 8191.82 MB ==================== Drives ================================ Drive c: (HP) (Fixed) (Total:917.84 GB) (Free:714.85 GB) NTFS ==>[Drive with boot components (obtained from BCD)]Drive d: (FACTORY_IMAGE) (Fixed) (Total:13.67 GB) (Free:1.89 GB) NTFS ==>[system with boot components (obtained from reading drive)] ==================== MBR & Partition Table ================== ========================================================Disk: 0 (Size: 931.5 GB) (Disk ID: 1549F232)Partition 1: (Active) - (Size=917.8 GB) - (Type=07 NTFS)Partition 3: (Not Active) - (Size=13.7 GB) - (Type=07 NTFS) ==================== End Of Log ============================ And the Fixlist i use StartHKLM\...D6A79037F57F\InprocServer32: [Default-fastprox] ATTENTION! ====> ZeroAccess?HKU\S-1-5-21-3287850538-662522702-2252149430-1000\...\MountPoints2: {9089bd59-fd7b-11e1-a068-f04da2fbeef7} - H:\setup.exe -aHKU\S-1-5-21-3287850538-662522702-2252149430-1000\...\MountPoints2: {e8ddc4a6-8e70-11e3-9d38-f04da2fbeef7} - "G:\WD SmartWare.exe" autoplay=trueHKU\S-1-5-21-3287850538-662522702-2252149430-1000\...409d6c4515e9\InprocServer32: [Default-shell32] \\?\globalroot\Device\HarddiskVolume3\Users\Haarstick Repair\AppData\Local\Temp\swqqwmy\sxxntfr\wow.dll ATTENTION! ====> ZeroAccess?FF DefaultSearchEngine: Conduit SearchFF SelectedSearchEngine: Conduit SearchC:\Users\Haarstick Repair\AppData\Local\Temp\scmrbix\shtrtrq\wow.dllC:\Users\Haarstick Repair\install_flashplayer12x32axau_gtbd_chrd_dn_aaa_aih.exeC:\Users\Haarstick Repair\AppData\Local\Temp\InstallFlashPlayer.exeEnd And here is the Fixlog Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 08-10-2014 01Ran by Sharon at 2014-10-10 22:51:13 Run:1Running from C:\Users\Sharon\DesktopLoaded Profile: Sharon (Available profiles: Sharon)Boot Mode: Normal============================================== Content of fixlist:*****************StartHKLM\...D6A79037F57F\InprocServer32: [Default-fastprox] ATTENTION! ====> ZeroAccess?HKU\S-1-5-21-3287850538-662522702-2252149430-1000\...\MountPoints2: {9089bd59-fd7b-11e1-a068-f04da2fbeef7} - H:\setup.exe -aHKU\S-1-5-21-3287850538-662522702-2252149430-1000\...\MountPoints2: {e8ddc4a6-8e70-11e3-9d38-f04da2fbeef7} - "G:\WD SmartWare.exe" autoplay=trueHKU\S-1-5-21-3287850538-662522702-2252149430-1000\...409d6c4515e9\InprocServer32: [Default-shell32] \\?\globalroot\Device\HarddiskVolume3\Users\Haarstick Repair\AppData\Local\Temp\swqqwmy\sxxntfr\wow.dll ATTENTION! ====> ZeroAccess?FF DefaultSearchEngine: Conduit SearchFF SelectedSearchEngine: Conduit SearchC:\Users\Haarstick Repair\AppData\Local\Temp\scmrbix\shtrtrq\wow.dllC:\Users\Haarstick Repair\install_flashplayer12x32axau_gtbd_chrd_dn_aaa_aih.exeC:\Users\Haarstick Repair\AppData\Local\Temp\InstallFlashPlayer.exeEnd***************** HKLM\Software\Classes\CLSID\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InprocServer32\\Default => Value was restored successfully."HKU\S-1-5-21-3287850538-662522702-2252149430-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9089bd59-fd7b-11e1-a068-f04da2fbeef7}" => Key not found."HKCR\CLSID\{9089bd59-fd7b-11e1-a068-f04da2fbeef7}" => Key not found."HKU\S-1-5-21-3287850538-662522702-2252149430-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e8ddc4a6-8e70-11e3-9d38-f04da2fbeef7}" => Key not found."HKCR\CLSID\{e8ddc4a6-8e70-11e3-9d38-f04da2fbeef7}" => Key not found."HKU\S-1-5-21-3287850538-662522702-2252149430-1000\Software\Classes\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}" => Key not found.Firefox DefaultSearchEngine deleted successfully.Firefox SelectedSearchEngine deleted successfully."C:\Users\Haarstick Repair\AppData\Local\Temp\scmrbix\shtrtrq\wow.dll" => File/Directory not found."C:\Users\Haarstick Repair\install_flashplayer12x32axau_gtbd_chrd_dn_aaa_aih.exe" => File/Directory not found."C:\Users\Haarstick Repair\AppData\Local\Temp\InstallFlashPlayer.exe" => File/Directory not found. ==== End of Fixlog ====
  8. I notice that, in almost all games a virus is added. Whenever, I've downloaded a game over Internet. I came across to such problems all the times. Why they do so with a Game Crack?
  9. I tried many times to remove Malwares in my flash disk but seems no hope. Here is MBAM log Flashdisk.txt
  10. Suddenly I find shortcuts in every folder I open and after deleting, those regenerate after a reboot. those show the target location to system 32. I ran AVG, Kaspersky, Avast and finally Malwarebytes to remove the malwares. In Avg bootscan I saw there are 10 different system 32 generic infections which i sent to chest and i deleted those. the second boot scan didn't show any infection. malwarebytes also doesn't show any infection but the problem exists. kaspersky deletes the trojans but can't disinfect even one of them. the problem continues.
  11. Hello, I have a problem with Malwarebytes Anti Malware. Whenever I run it, it detects 6 malware and when I want to delete them the software bugs then Windows says that the program not responding! Can you please help me?Here's the report I get in each flash exam : (It's in french) Malwarebytes Anti-Malware (PRO) 1.75.0.1300www.malwarebytes.org Version de la base de données: v2014.02.01.04 Windows Vista Service Pack 2 x86 NTFSInternet Explorer 9.0.8112.16421reda :: PC_DE_REDA [administrateur] Protection: Désactivé 01/02/2014 11:01:30MBAM-log-2014-02-01 (11-06-17).txt Type d'examen: Examen éclairOptions d'examen activées: Mémoire | Démarrage | Heuristique/Extra | Heuristique/Shuriken | PUP | PUMOptions d'examen désactivées: Registre | Système de fichiers | P2PElément(s) analysé(s): 246032Temps écoulé: 3 minute(s), 58 seconde(s) Processus mémoire détecté(s): 0(Aucun élément nuisible détecté) Module(s) mémoire détecté(s): 0(Aucun élément nuisible détecté) Clé(s) du Registre détectée(s): 0(Aucun élément nuisible détecté) Valeur(s) du Registre détectée(s): 0(Aucun élément nuisible détecté) Elément(s) de données du Registre détecté(s): 0(Aucun élément nuisible détecté) Dossier(s) détecté(s): 6C:\Users\reda\AppData\Roaming\Systweak\Advanced System Protector (PUP.Optional.AdvancedSystemProtector.A) -> Aucune action effectuée.C:\Users\reda\AppData\Roaming\Systweak\Advanced System Protector\Logs (PUP.Optional.AdvancedSystemProtector.A) -> Aucune action effectuée.C:\Users\reda\AppData\Roaming\Systweak\Advanced System Protector\Quarantine (PUP.Optional.AdvancedSystemProtector.A) -> Aucune action effectuée.C:\Users\reda\AppData\Roaming\Systweak\Advanced System Protector\Temp (PUP.Optional.AdvancedSystemProtector.A) -> Aucune action effectuée.C:\Users\reda\AppData\Roaming\Systweak\Advanced System Protector\Temp\Temp (PUP.Optional.AdvancedSystemProtector.A) -> Aucune action effectuée.C:\Users\reda\AppData\Local\Temp\CT3310393 (PUP.Optional.Conduit.A) -> Aucune action effectuée. Fichier(s) détecté(s): 0(Aucun élément nuisible détecté) (fin) Thanks for help!
  12. After running MBAM and listing down the infections detected, I think a "Select All" checkbox would help to select all the detected malwares at one go and remove. As of now, we have to manually select all the malwares detected and then remove them. It is fine when there are 1-2 malwares in the list, but when there are several detected, it becomes a hassle to manually select them and remove Thoughts?
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.