Can't Remove "cdncache-a akamaihd" and "dynamic pricer" From Web Browsers

[sherri_zhu]

The malware on my laptop keeps opening unwanted websites under the new tab whenever I click on something. Tried Winzip Malware Protector, Microsoft Security Essential, CCcleaner, Hitman Pro, and Malwarebytes Anti-Malware. Have found many threats and fixed them all, however, the original problems remained.

 

Originally, there was also an "Open Software Updater" which seems to have disappeared after running all sorts of cleaners, but the redirecting virus stayed.

 

Attached please find FRST.txt and Addition.txt logs.

 

Thank you so much for your help!

Addition.txt

FRST.txt

[LiquidTension]

Hello sherri_zhu, welcome to Malwarebytes' Malware Removal forum!
 
My username is LiquidTension, but you can call me Adam. I will be assisting you with your malware-related problems.
If you would allow me to call you by your first name I would prefer that. 
 
General P2P/Piracy Notice: 
 

If you are using Peer to Peer (P2P) filesharing software such as uTorrent, BitTorrent or similar you must either fully uninstall or completely disable the programme(s) from running whilst receiving assistance at this forum. 
Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.
If you have illegal/cracked/keygen or similar software on the computer, please remove/uninstall the software now and read the policy on Piracy. Failure to do so will also result in your topic being closed.

 
======================================================
 
Please read through the points below to ensure this process moves as quickly and efficiently as possible.

• Please read through my instructions thoroughly, and ensure you carry out each step in the order specified.
• Please do not post logs using the CODE, QUOTE or ATTACHMENT format. Logs should be posted directly in plain text. If you receive an error whilst posting, please break the log in half and use multiple posts.
• Please do not run any tools or take any steps other than those I provide for you. Independent efforts may make matters worse, and will affect my ability in ascertaining the current situation & providing the best set of instructions for you.
• Please backup important documents before proceeding with my instructions.
• If you come across any issues whilst following my instructions, please stop and inform me of the issue in as much detail as possible. Please do not hesitate to ask before you run anything.
• Topics are locked if no response is made after 4 days. Please inform me if you will require additional time to complete my instructions.
• Ensure you are following this topic. Click  at the top of the page. 
   

======================================================
 
STEP 1
 Malwarebytes Anti-Malware (MBAM)

• If you have not downloaded and installed the updated Malwarebytes Anti-Malware 2.0 please do so now. 
• Open Malwarebytes Anti-Malware and click Update Now.
• Once updated, click the Settings tab and tick Scan for rootkits.
• Click the Scan tab, ensure Threat Scan is checked and click Scan Now.
• Note: You may see the following message, "Could not load DDA driver". Click Yes, allow your PC to reboot and continue afterwards. 
• If threats are detected, click the Apply Actions button. You will now be prompted to reboot. Click Yes.
• Upon completion of the scan (or after the reboot), click the History tab.
• Click Application Logs and double-click the Scan Log.
• Click Copy to Clipboard and paste the log in your next reply.
   

STEP 2
 AdwCleaner

• Please download AdwCleaner and save the file to your Desktop..
• Right-Click AdwCleaner.exe and select  Run as administrator to run the programme.
• Follow the prompts. 
• Click Scan. 
• Upon completion, click Report. A log (AdwCleaner[R0].txt) will open. Briefly check the log for anything you know to be legitimate. 
• Ensure anything you know to be legitimate does not have a checkmark, and click Clean. 
• Follow the prompts and allow your computer to reboot. 
• After rebooting, a log (AdwCleaner[s0].txt) will open. Copy the contents of the log and paste in your next reply.

-- File and registry key backups are made for anything removed using this tool. Should a legitimate entry be removed (otherwise known as a 'false-positive'), simple steps can be taken to restore the entry. Please do not overly concern yourself with the contents of AdwCleaner[R0].txt.
 

STEP 3
 Junkware Removal Tool (JRT)

• Please download Junkware Removal Tool and save the file to your Desktop.
• Note: If you unchecked any items in AdwCleaner, please backup the associated folders/files before running JRT.
• Temporarily disable your anti-virus software. For instructions, please refer to the following link.
• Right-Click JRT.exe and select  Run as administrator to run the programme.
• Follow the prompts and allow the scan to run uninterrupted. 
• Upon completion, a log (JRT.txt) will open on your desktop.
• Re-enable your anti-virus software.
• Copy the contents of JRT.txt and paste in your next reply.
   

STEP 4
 Farbar Recovery Scan Tool (FRST) Scan

• Right-Click FRST64.exe and select  Run as administrator to run the programme.
• Click Yes to the disclaimer.
• Ensure the Addition.txt box is checked.
• Click the Scan button and let the programme run.
• Upon completion, click OK, then OK on the Addition.txt pop up screen.
• Two logs (FRST.txt & Addition.txt) will now be open on your Desktop. Copy the contents of both logs and paste in your next reply. 
   

======================================================

STEP 5
 Logs
In your next reply please include the following logs. Please be sure to copy and paste the requested logs, as well as provide information on any questions I may have asked.

• MBAM log
• AdwCleaner[s0].txt
• JRT.txt
• FRST.txt
• Addition.txt

[sherri_zhu]

Hi Adam, my name is Sherri. Thank you so much for your prompt response. I could hardly believe my eyes -- I got a reply when the weekend is not over yet!!!

 

I'll follow your instructions step by step. Thank you again!!!

[LiquidTension]

OK, I'll look out for your logs, Sherri. 

[sherri_zhu]

I finished the first step and found the scan log, but couldn't copy and paste it here. Would you please tell me how to do it?

[sherri_zhu]

Sorry, just saw the button at the bottom.

[sherri_zhu]

Malwarebytes Anti-Malware

www.malwarebytes.org

 

Scan Date: 10/20/2014

Scan Time: 9:11:52 PM

Logfile: 

Administrator: Yes

 

Version: 2.00.3.1025

Malware Database: v2014.10.21.02

Rootkit Database: v2014.10.20.01

License: Trial

Malware Protection: Enabled

Malicious Website Protection: Enabled

Self-protection: Disabled

 

OS: Windows 7 Service Pack 1

CPU: x64

File System: NTFS

User: Sherri

 

Scan Type: Threat Scan

Result: Completed

Objects Scanned: 332957

Time Elapsed: 31 min, 47 sec

 

Memory: Enabled

Startup: Enabled

Filesystem: Enabled

Archives: Enabled

Rootkits: Enabled

Heuristics: Enabled

PUP: Enabled

PUM: Enabled

 

Processes: 0

(No malicious items detected)

 

Modules: 0

(No malicious items detected)

 

Registry Keys: 0

(No malicious items detected)

 

Registry Values: 0

(No malicious items detected)

 

Registry Data: 0

(No malicious items detected)

 

Folders: 0

(No malicious items detected)

 

Files: 2

PUP.Optional.InstallIQ.A, C:\Users\Sherri\Desktop\Icons\7zip_freely_d157185.exe, Quarantined, [89ce5eb991ebe155266e61ca639e9967], 

PUP.Optional.InstallIQ.A, C:\Users\Sherri\Desktop\Icons\gimp_freely_d157195.exe, Quarantined, [3027e82fc6b648eed7bd1a110ef3619f], 

 

Physical Sectors: 0

(No malicious items detected)

 

 

(end)

[sherri_zhu]

# AdwCleaner v4.001 - Report created 20/10/2014 at 23:18:55

# DB v2014-10-20.3

# Updated 20/10/2014 by Xplode

# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)

# Username : Sherri - SHERRI-PC

# Running from : C:\Users\Sherri\Desktop\AdwCleaner.exe

# Option : Clean

 

***** [ Services ] *****

 

 

***** [ Files / Folders ] *****

 

Folder Deleted : C:\Users\Sherri\AppData\Roaming\0D0S1L2Z1P1B0T1P1B2Z

[x] Not Deleted : C:\ProgramData\baidu

[x] Not Deleted : C:\Program Files (x86)\baidu

[x] Not Deleted : C:\Users\Sherri\AppData\LocalLow\baidu

[x] Not Deleted : C:\Users\Sherri\AppData\Roaming\baidu

Folder Deleted : C:\Users\Public\Device

Folder Deleted : C:\Users\Sherri\AppData\Roaming\DigitalSites

Folder Deleted : C:\windows\Installer\{7683B745-6060-41FD-AA75-0BBB383FEAD4}

Folder Deleted : C:\Users\Sherri\AppData\Local\PackageAware

Folder Deleted : C:\Users\Sherri\AppData\Roaming\pccustubinstaller

Folder Deleted : C:\ProgramData\PCFixSpeed

Folder Deleted : C:\Program Files (x86)\PCFixSpeed

Folder Deleted : C:\Program Files (x86)\predm

Folder Deleted : C:\Program Files (x86)\SweetIM

[x] Not Deleted : C:\ProgramData\tencent

Folder Deleted : C:\Program Files (x86)\tencent

Folder Deleted : C:\Program Files (x86)\Common Files\tencent

Folder Deleted : C:\windows\SysWOW64\config\systemprofile\AppData\Roaming\tencent

Folder Deleted : C:\Program Files\tencent

Folder Deleted : C:\Users\Public\Documents\tencent

Folder Deleted : C:\Users\Sherri\AppData\Local\tencent

Folder Deleted : C:\Users\Sherri\AppData\LocalLow\tencent

Folder Deleted : C:\Users\Sherri\AppData\Roaming\tencent

[x] Not Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip Malware Protector

[x] Not Deleted : C:\Program Files (x86)\WinZip Malware Protector

Folder Deleted : C:\Users\Sherri\AppData\Local\CheckCode

Folder Deleted : C:\Users\Sherri\AppData\Local\Google\Chrome\User Data\Default\Extensions\dajedkncpodkggklbegccjpmnglmnflm

File Deleted : C:\Users\Sherri\AppData\Local\CRE\bolmicibdhjnmppjidlkppdaeplaphpi.crx

File Deleted : C:\END

File Deleted : C:\windows\System32\roboot64.exe

File Deleted : C:\Users\Sherri\AppData\Roaming\Mozilla\Firefox\Profiles\f8676dxc.default\searchplugins\Askcom.xml

File Deleted : C:\Users\Sherri\AppData\Roaming\Mozilla\Firefox\Profiles\f8676dxc.default\searchplugins\MyStart.xml

File Deleted : C:\Users\Sherri\AppData\Roaming\Mozilla\Firefox\Profiles\f8676dxc.default\user.js

File Deleted : C:\Users\Sherri\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.superfish.com_0.localstorage

File Deleted : C:\Users\Sherri\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.superfish.com_0.localstorage-journal

 

***** [ Scheduled Tasks ] *****

 

Task Deleted : Digital Sites

Task Deleted : LaunchSignup

 

***** [ Shortcuts ] *****

 

 

***** [ Registry ] *****

 

Value Deleted : HKCU\Software\Mozilla\Firefox\Extensions [{ddb4644d-1a37-4e6d-8b6e-8e35e2a8ea6c}]

Key Deleted : HKCU\Software\Google\Chrome\Extensions\bakijjialdiiboeaknfpmflphhmljfkd

Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\bakijjialdiiboeaknfpmflphhmljfkd

Key Deleted : [x64] HKLM\SOFTWARE\Google\Chrome\Extensions\bakijjialdiiboeaknfpmflphhmljfkd

Key Deleted : HKCU\Software\Google\Chrome\Extensions\bolmicibdhjnmppjidlkppdaeplaphpi

Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\bolmicibdhjnmppjidlkppdaeplaphpi

Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\bopakagnckmlgajfccecajhnimjiiedh

Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl

Key Deleted : HKLM\SOFTWARE\Classes\sim-packages

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\AskSLib_RASAPI32

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\AskSLib_RASMANCS

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\DesktopWeatherAlertsApp_RASAPI32

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\DesktopWeatherAlertsApp_RASMANCS

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASAPI32

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASMANCS

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\tencentdl_RASAPI32

Key Deleted : HKLM\SOFTWARE\MozillaPlugins\@qq.com/TXSSO

Key Deleted : HKLM\SOFTWARE\MozillaPlugins\@VideoDownloadConverter_ScriptHelper.com/Plugin

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{6517DD27-EA6F-4947-9DEA-F9C487BB1020}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{5A4E3A41-FA55-4BDA-AED7-CEBE6E7BCB52}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{70DE12EA-79F4-46BC-9812-86DB50A2FD64}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{83335675-FCF0-45CE-A9E6-38C150EFBE63}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{EAAED308-7322-4B9B-965E-171933ADD473}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{4E6354DE-9115-4AEE-BD21-C46C3E8A49DB}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{7044CE4B-FE34-4DD1-A0FA-157E1E179ECA}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{FC073BDA-C115-4A1D-9DF9-9B5C461482E5}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{251DA1A7-5700-41FC-8129-9099B4B7E4D3}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{29A32150-EA24-42C2-882E-879152560C1E}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{6517DD27-EA6F-4947-9DEA-F9C487BB1020}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{9EE3E2DD-D4A6-4024-8AFD-C467485A0BC4}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{A2D733A7-73B0-4C6B-B0C7-06A432950B66}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{DA624F8F-98BF-4B03-AD11-A12D07119E81}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EAAED308-7322-4B9B-965E-171933ADD473}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{F464A68D-1CF2-4991-93AB-A84351D7F676}

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{2D6F0AC3-0C2E-4E07-8FDA-11268AB51211}

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{06E58E5E-F8CB-4049-991E-A41C03BD419E}

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{100EB1FD-D03E-47FD-81F3-EE91287F9465}

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{258C9770-1713-4021-8D7E-1F184A2BD754}

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{2EECD738-5844-4A99-B4B6-146BF802613B}

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{31CF9EBE-5755-4A1D-AC25-2834D952D9B4}

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{43D9E6F0-1776-4897-AE14-ECEDECBAFEC0}

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{5A074B29-F830-49DE-A31B-5BB9D7F6B407}

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{5AA2BA46-9913-4DC7-9620-69AB0FA17AE7}

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{74F475FA-6C75-43BD-AAB9-ECDA6184F600}

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{77FEF28E-EB96-44FF-B511-3185DEA48697}

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{855F3B16-6D32-4FE6-8A56-BBB695989046}

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{98889811-442D-49DD-99D7-DC866BE87DBC}

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{B580CF65-E151-49C3-B73F-70B13FCA8E86}

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{BDEA95CF-F0E6-41E0-BD3D-B00F39A4E939}

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{C451C08A-EC37-45DF-AAAD-18B51AB5E837}

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{CCC7A320-B3CA-4199-B1A6-9F516DD69829}

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{DCC70A83-E184-40A3-906B-779AF5E941C4}

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{31090377-0740-419E-BEFC-A56E50500D5B}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{17B10E59-09E1-4C39-A738-6774D7AB7778}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{4E6354DE-9115-4AEE-BD21-C46C3E8A49DB}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{7044CE4B-FE34-4DD1-A0FA-157E1E179ECA}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{FC073BDA-C115-4A1D-9DF9-9B5C461482E5}

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{31090377-0740-419E-BEFC-A56E50500D5B}

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{06E58E5E-F8CB-4049-991E-A41C03BD419E}

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{100EB1FD-D03E-47FD-81F3-EE91287F9465}

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{258C9770-1713-4021-8D7E-1F184A2BD754}

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{2EECD738-5844-4A99-B4B6-146BF802613B}

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{31CF9EBE-5755-4A1D-AC25-2834D952D9B4}

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{43D9E6F0-1776-4897-AE14-ECEDECBAFEC0}

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{5A074B29-F830-49DE-A31B-5BB9D7F6B407}

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{5AA2BA46-9913-4DC7-9620-69AB0FA17AE7}

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{74F475FA-6C75-43BD-AAB9-ECDA6184F600}

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{77FEF28E-EB96-44FF-B511-3185DEA48697}

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{855F3B16-6D32-4FE6-8A56-BBB695989046}

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{98889811-442D-49DD-99D7-DC866BE87DBC}

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{B580CF65-E151-49C3-B73F-70B13FCA8E86}

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{BDEA95CF-F0E6-41E0-BD3D-B00F39A4E939}

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{C451C08A-EC37-45DF-AAAD-18B51AB5E837}

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{CCC7A320-B3CA-4199-B1A6-9F516DD69829}

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{DCC70A83-E184-40A3-906B-779AF5E941C4}

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

Key Deleted : HKCU\Software\dsiteproducts

Key Deleted : HKCU\Software\powerpack

Key Deleted : HKCU\Software\Tencent

Key Deleted : HKCU\Software\AppDataLow\Tencent

Key Deleted : HKCU\Software\AppDataLow\Software\Tencent

Key Deleted : HKLM\SOFTWARE\CompeteInc

Key Deleted : HKLM\SOFTWARE\Freeze.com

Key Deleted : HKLM\SOFTWARE\Tencent

Key Deleted : HKLM\SOFTWARE\Upt

Key Deleted : HKLM\SOFTWARE\WinUpd

Key Deleted : HKLM\SOFTWARE\SI-App

Key Deleted : HKLM\SOFTWARE\RST

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Zip Opener Packages

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{7683B745-6060-41FD-AA75-0BBB383FEAD4}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{c3e85ee9-5892-4142-b537-bceb3dac4c3d}

Key Deleted : [x64] HKLM\SOFTWARE\Upt

Key Deleted : [x64] HKLM\SOFTWARE\WinUpd

Key Deleted : [x64] HKLM\SOFTWARE\SI-App

Key Deleted : [x64] HKLM\SOFTWARE\RST

Key Deleted : HKLM\SOFTWARE\Classes\Installer\Features\547B38670606DF14AA57B0BB83F3AE4D

Key Deleted : HKLM\SOFTWARE\Classes\Installer\Features\9EE58E3C298524145B73CBBED3CAC4D3

Key Deleted : HKLM\SOFTWARE\Classes\Installer\Products\547B38670606DF14AA57B0BB83F3AE4D

Key Deleted : HKLM\SOFTWARE\Classes\Installer\Products\9EE58E3C298524145B73CBBED3CAC4D3

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\07D5290CDBDAE4242926B8E6CA650501

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\08E33F7B61DEFF24BB9673ED7D467636

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0E3D8A5B48622A445A7DF73FEFF32C3F

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\34EDDB1BFB3A2D448845F3EFD0F15A43

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\427EA997C413D1D47907CBFC7B2DB432

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4318DF19719275242801CBE292063A4C

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\45FC115D1FEAEF849A4E1610D6EC8BF0

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\464AA55239C100F32AF2D438EDDC0F47

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\46A5861A389ADB844AF89E31BC9DF0A1

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\49B0E1A6FF50BBE4289E4E23DE6EA0C7

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4CCCAC049F34D0540AAC13011398BEDB

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5652BA3D5FB98AE31B337BF0AF939856

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5C4389D0BFB302C479DE4178BD5D9EBA

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5D2B09BDEF4FE54418E6F3373CDBC7AC

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\61B65D3397A1FBF4CB1571B5E4F6B5B0

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\68E8A05C60DD9254591DBD16C94EDDBF

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\697E782CF574CC34CBB9566440BA12BC

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6AE27A8613CF7EA4782F2886F67295E5

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\75D5168E5E176C24981B4E5DBD991078

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7CE172051F585E04187BCB97570BFA74

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\86A901BA5265452499DCBF719C378EE3

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\86EB95E1AFCBABE3DB9ECCC669B99494

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8724E58E6C7D00C48A0D4F3345EB2C26

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\88ABD1CD5C40EC84789A7F6EF86DAC5E

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\980289C22F80A7C4BB9323DC61255E4E

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9A4B7EF3789F871419D9302583B20C15

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A6C53B0F76C44004A8F36716213017DB

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\AB676B0E1B9EFA049B9F7DDDA9645734

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B31BBB0B825EDEF45AB0FE7099C68C81

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B471D8D7319336B4CA89374ED0D7B806

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B59F2D8189784CC46A4597F2842480B0

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BC30043663AA2CA4DA1DAA9CA5FDCC75

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BD746FB95FB8E5B45BF66BE54D5FD91F

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CCF399FCD6D2D3F46BF02A1378654FC9

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D149C1355C98DE24E82CEFBD996FE06A

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DB59FDB786388EA4D897F3EE715683AC

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DB8DAD19CFBCC2049A4477183787E8C5

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E1C820A74ED67374BA048B52CB3C3804

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EC65F200D112357449C8B1BC3CFA03D0

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F327D0C73C0973644A21E8CC852267A0

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F754C503375A13344B22388E18DFE87E

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FA96423FE2B98E248A3B23548D1E22D9

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FDC83385E6C239F4C876A77A37DF581D

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0FF2AEFF45EEA0A48A4B33C1973B6094

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\305B09CE8C53A214DB58887F62F25536

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\547B38670606DF14AA57B0BB83F3AE4D

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9EE58E3C298524145B73CBBED3CAC4D3

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\789034A89BAC50E4782F0A7BDBF75632

 

***** [ Browsers ] *****

 

-\\ Internet Explorer v11.0.9600.17344

 

 

-\\ Mozilla Firefox v32.0.3 (x86 en-US)

 

 

-\\ Google Chrome v38.0.2125.104

 

 

*************************

 

AdwCleaner[R0].txt - [19865 octets] - [20/10/2014 22:24:47]

AdwCleaner[s0].txt - [19617 octets] - [20/10/2014 23:18:55]

 

########## EOF - C:\AdwCleaner\AdwCleaner[s0].txt - [19678 octets] ##########

[sherri_zhu]

[sherri_zhu]

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 21-10-2014

Ran by Sherri (administrator) on SHERRI-PC on 20-10-2014 23:55:55

Running from C:\Users\Sherri\Desktop

Loaded Profile: Sherri (Available profiles: Sherri)

Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: English (United States)

Internet Explorer Version 11

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

 

==================== Processes (Whitelisted) =================

 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

 

(AMD) C:\Windows\System32\atiesrxx.exe

(AMD) C:\Windows\System32\atieclxx.exe

(ABBYY) C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(Beijing WatchData System Co., Ltd.) C:\Windows\SysWOW64\WatchData\Watchdata BOC CSP v3.3\BOCKeyMon.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe

(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe

(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe

(SEIKO EPSON CORPORATION) C:\Program Files\EPSON\EpsonCustomerParticipation\EPCP.exe

(Symantec Corporation) C:\Program Files (x86)\PC Checkup\SymcPCCULaunchSvc.exe

(Sogou.com Inc) C:\Program Files (x86)\SogouInput\Components\AddressSearch\OmniAddr\OmniAddrService.exe

(TOSHIBA Corporation) C:\Windows\System32\TODDSrv.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE

() C:\Windows\SysWOW64\DirectXJREScreenshot\DirectXJREScreenshot.exe

(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\BulletinBoard\TosNcCore.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe

(Microsoft Corporation) C:\Program Files\Microsoft IntelliPoint\ipoint.exe

(SEIKO EPSON CORPORATION) C:\Windows\System32\spool\drivers\x64\3\E_YATIHVA.EXE

(Sogou.com Inc.) C:\Program Files (x86)\SogouInput\Components\SGImeGuard\1.0.0.27\SGImeGuard.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe

(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe

(TOSHIBA Corporation) C:\Program Files (x86)\Toshiba\TOSHIBA Service Station\ToshibaServiceStation.exe

(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe

( Beijing WatchData System Co., Ltd.) C:\Windows\SysWOW64\WatchData\Watchdata BOC CSP v3.3\BOCCertMND.exe

(Hengbao) C:\Program Files (x86)\HBBOC\BOCu.exe

(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

(SEIKO EPSON CORPORATION) C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe

(SEIKO EPSON CORPORATION) C:\Program Files (x86)\Epson Software\FAX Utility\FUFAXRCV.exe

(SEIKO EPSON CORPORATION) C:\Program Files (x86)\Epson Software\FAX Utility\FUFAXSTM.exe

(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe

(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe

(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe

(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe

(TOSHIBA Corporation) C:\Program Files (x86)\Toshiba\TOSHIBA Service Station\TMachInfo.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe

(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

 

 

==================== Registry (Whitelisted) ==================

 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

 

HKLM\...\Run: [] => [X]

HKLM\...\Run: [smartAudio] => C:\Program Files\CONEXANT\SAII\SAIICpl.exe [316032 2010-12-14] (Conexant systems, Inc.)

HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [2588456 2010-11-11] (ELAN Microelectronics Corp.)

HKLM\...\Run: [TPwrMain] => C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE [590256 2011-05-17] (TOSHIBA Corporation)

HKLM\...\Run: [TCrdMain] => C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe [972672 2011-04-27] (TOSHIBA Corporation)

HKLM\...\Run: [TosVolRegulator] => C:\Program Files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe [24376 2009-11-11] (TOSHIBA Corporation)

HKLM\...\Run: [TosSENotify] => C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe [710560 2011-06-09] (TOSHIBA Corporation)

HKLM\...\Run: [TosNC] => C:\Program Files\Toshiba\BulletinBoard\TosNcCore.exe [596912 2011-06-28] (TOSHIBA Corporation)

HKLM\...\Run: [TosReelTimeMonitor] => C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe [38824 2011-06-28] (TOSHIBA Corporation)

HKLM\...\Run: [intelliPoint] => c:\Program Files\Microsoft IntelliPoint\ipoint.exe [2417032 2011-08-01] (Microsoft Corporation)

HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch

HKLM-x32\...\Run: [startCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [336384 2011-06-07] (Advanced Micro Devices, Inc.)

HKLM-x32\...\Run: [ToshibaServiceStation] => C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe [1298816 2011-07-11] (TOSHIBA Corporation)

HKLM-x32\...\Run: [NortonOnlineBackupReminder] => C:\Program Files (x86)\Toshiba\Toshiba Online Backup\Activation\TOBuActivation.exe [3218864 2011-06-22] (Toshiba)

HKLM-x32\...\Run: [ToshibaAppPlace] => C:\Program Files (x86)\Toshiba\Toshiba App Place\ToshibaAppPlace.exe [552960 2010-09-23] (Toshiba)

HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [wdcertm_nd33] => C:\Windows\SysWOW64\WatchData\Watchdata BOC CSP v3.3\BOCCertMND.exe [45212 2011-05-14] ( Beijing WatchData System Co., Ltd.)

HKLM-x32\...\Run: [HengBao UranuSafe CSP V5.0 For BOC] => C:\Program Files (x86)\HBBOC\BOCu.exe [259840 2012-04-11] (Hengbao)

HKLM-x32\...\Run: [EEventManager] => C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe [979328 2010-10-12] (SEIKO EPSON CORPORATION)

HKLM-x32\...\Run: [FUFAXRCV] => C:\Program Files (x86)\Epson Software\FAX Utility\FUFAXRCV.exe [495616 2011-03-09] (SEIKO EPSON CORPORATION)

HKLM-x32\...\Run: [FUFAXSTM] => C:\Program Files (x86)\Epson Software\FAX Utility\FUFAXSTM.exe [856064 2011-03-09] (SEIKO EPSON CORPORATION)

HKLM-x32\...\Run: [sunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)

HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-09-01] (Apple Inc.)

HKU\S-1-5-21-429594294-1317963213-1840044107-1001\...\Run: [EPLTarget\P0000000000000000] => C:\windows\system32\spool\DRIVERS\x64\3\E_YATIHVA.EXE [241280 2013-03-18] (SEIKO EPSON CORPORATION)

HKU\S-1-5-21-429594294-1317963213-1840044107-1001\...\Run: [imeGuardCom] => C:\Program Files (x86)\SogouInput\Components\SGImeGuard\1.0.0.27\SGImeGuard.exe [368760 2014-06-26] (Sogou.com Inc.)

HKU\S-1-5-21-429594294-1317963213-1840044107-1001\...\Run: [ctfmon] => C:\windows\system32\ctfmon.exe [9728 2009-07-13] (Microsoft Corporation)

HKU\S-1-5-21-429594294-1317963213-1840044107-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [6482200 2014-09-26] (Piriform Ltd)

HKU\S-1-5-21-429594294-1317963213-1840044107-1001\...\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [43816 2014-08-08] (Apple Inc.)

HKU\S-1-5-21-429594294-1317963213-1840044107-1001\...\Run: [ApplePhotoStreams] => C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [43816 2014-08-14] (Apple Inc.)

HKU\S-1-5-21-429594294-1317963213-1840044107-1001\...\MountPoints2: {5dbf5758-ec13-11e1-93b3-00266cd61d58} - E:\Setup.exe

HKU\S-1-5-21-429594294-1317963213-1840044107-1001\...\MountPoints2: {7a6537e1-3ff2-11e3-aedb-00266cd61d58} - E:\Setup.exe

HKU\S-1-5-21-429594294-1317963213-1840044107-1001\...\MountPoints2: {e5f869f5-ddd0-11e1-9444-00266cd61d58} - E:\Setup.exe

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk

ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.)

ShellIconOverlayIdentifiers: [ SkyDrivePro1 (ErrorConflict)] -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers: [ SkyDrivePro2 (SyncInProgress)] -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers: [ SkyDrivePro3 (InSync)] -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation)

BootExecute: wsusnative64autocheck autochk * bootdelete

 

==================== Internet (Whitelisted) ====================

 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

 

ProxyEnable: Internet Explorer proxy is enabled.

ProxyServer: http=127.0.0.1:28973

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://start.toshiba.com/?cid=C001B2Y

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.google.com

URLSearchHook: HKCU - (No Name) - {472734EA-242A-422b-ADF8-83D1E48CC825} - No File

StartMenuInternet: IEXPLORE.EXE - c:\program files (x86)\internet explorer\iexplore.exe

SearchScopes: HKLM - {{67A2568C-7A0A-4EED-AECC-B5405DE63B64}} URL = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSNO

SearchScopes: HKLM-x32 - {{67A2568C-7A0A-4EED-AECC-B5405DE63B64}} URL = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSNO

SearchScopes: HKCU - {B35D7A95-BE17-409C-835D-BE75C55EED9B} URL = http://www.google.com/search?sourceid=ie9&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSNO_enUS459

SearchScopes: HKCU - {{67A2568C-7A0A-4EED-AECC-B5405DE63B64}} URL = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSNO

BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\Office15\OCHelper.dll (Microsoft Corporation)

BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)

BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\Office15\URLREDIR.DLL (Microsoft Corporation)

BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation)

BHO-x32: 搜狗输入法地址栏搜索 -> {0C3ED74B-8703-4003-A1F4-2B2A0C450DD2} -> C:\Program Files (x86)\SogouInput\Components\AddressSearch\OmniAddr\OmniAddr.dll (Sogou.com Inc.)

BHO-x32: MSS+ Identifier -> {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} -> C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll (McAfee, Inc.)

BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)

BHO-x32: AgentForAndroid Class -> {50F4150A-48B2-417A-BE4C-C83F580FB904} -> C:\Program Files (x86)\Common Files\Tencent\QQPhoneManager\2.0.201.3180\npQQPhoneManagerExt.dll No File

BHO-x32: Java Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)

BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)

BHO-x32: C32C32B7-A92F-CC44-5B46-1E8538F7BBFC Class -> {C32C32B7-A92F-CC44-5B46-1E8538F7BBFC} -> C:\Program Files (x86)\QvodPlayer\AddIn\{C32C32B7-A92F-CC44-5B46-1E8538F7BBFC}\QvodAddr.dll No File

BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)

BHO-x32: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File

Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File

Toolbar: HKCU - No Name - {65F8A3D2-4C22-4A33-9633-73167EAEEC45} -  No File

DPF: HKLM-x32 {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

DPF: HKLM-x32 {82774781-8F4E-11D1-AB1C-0000F8773BF0} https://transfers.ds.microsoft.com/FTM/TransferSource/grTransferCtrl.cab

Handler: KuGoo - {6AC4FBC7-AA38-45EC-9634-D6D20B679EFC} -  No File

Handler: KuGoo3 - {6AC4FBC7-AA38-45EC-9634-D6D20B679EFC} -  No File

Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation)

Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)

Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: KuGoo - {6AC4FBC7-AA38-45EC-9634-D6D20B679EFC} - C:\Program Files (x86)\KuGou7\KuGoo3DownXControl.ocx (广州酷狗计算机科技有限公司)

Handler-x32: KuGoo3 - {6AC4FBC7-AA38-45EC-9634-D6D20B679EFC} - C:\Program Files (x86)\KuGou7\KuGoo3DownXControl.ocx (广州酷狗计算机科技有限公司)

Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Microsoft Office\Office15\MSOSB.DLL (Microsoft Corporation)

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)

Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)

Tcpip\Parameters: [DhcpNameServer] 209.18.47.61 209.18.47.62

Tcpip\..\Interfaces\{1681BAF4-FD59-41CD-A6E4-AE82C842F26D}: [NameServer] 5.135.12.56,199.203.35.78

 

FireFox:

========

FF ProfilePath: C:\Users\Sherri\AppData\Roaming\Mozilla\Firefox\Profiles\f8676dxc.default

FF DefaultSearchEngine: Yahoo! (SD)

FF SelectedSearchEngine: Yahoo! (SD)

FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF64_15_0_0_152.dll ()

FF Plugin: @microsoft.com/GENUINE -> disabled No File

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)

FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin: @qvod.com/QvodShare -> C:\Program Files (x86)\QvodPlayer\npShareModule_x64.dll No File

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll ()

FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\windows\system32\Adobe\Director\np32dsw.dll No File

FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()

FF Plugin-x32: @cfca.com/SecEditCtl.BOC,version=1.0.0.9 -> C:\windows\system32\npSecEditCtl.BOC.x86.dll No File

FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)

FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @kingsfot.com/npkws -> c:\program files (x86)\kingsoft\kingsoft antivirus\npkws.dll No File

FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File

FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll (Microsoft Corporation)

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Microsoft Office\Office15\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @qq.com/npAndroidAssistant -> C:\Program Files (x86)\Common Files\Tencent\QQPhoneManager\2.0.201.3180\npQQPhoneManagerExt.dll No File

FF Plugin-x32: @qq.com/npchrome -> C:\Program Files (x86)\Common Files\Tencent\Npchrome\npchrome.dll No File

FF Plugin-x32: @qq.com/npqscall -> C:\Program Files (x86)\Common Files\Tencent\NPQSCALL\npqscall.dll No File

FF Plugin-x32: @qq.com/npqscall,version=1.0.0 -> %commonprogramfiles%\tencent\NPQSCALL\npqscall.dll No File

FF Plugin-x32: @qq.com/QQPhotoDrawEx -> C:\Program Files (x86)\Tencent\Qzone\npQQPhotoDrawEx.dll No File

FF Plugin-x32: @qq.com/QzoneMusic -> C:\Program Files (x86)\Tencent\QQMusic\npQzoneMusic.dll No File

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.5\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.5\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npfetion.dll ( )

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)

FF SearchPlugin: C:\Users\Sherri\AppData\Roaming\Mozilla\Firefox\Profiles\f8676dxc.default\searchplugins\yahoo-sd.xml

FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2014-09-25]

FF HKCU\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi

FF Extension: No Name - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi [2014-04-04]

 

Chrome: 

=======

CHR HomePage: Default -> hxxp://www.msn.com/

CHR StartupUrls: Default -> "hxxp://www.msn.com/"

CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:inputType}{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}{google:searchVersion}{google:sessionToken}{google:prefetchQuery}sugkey={google:suggestAPIKeyParameter}

CHR Profile: C:\Users\Sherri\AppData\Local\Google\Chrome\User Data\Default

CHR Extension: (Google Drive) - C:\Users\Sherri\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-10-17]

CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Sherri\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-05-24]

CHR Extension: (YouTube) - C:\Users\Sherri\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2011-12-15]

CHR Extension: (Google Search) - C:\Users\Sherri\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2011-12-15]

CHR Extension: (Search by Image (by Google)) - C:\Users\Sherri\AppData\Local\Google\Chrome\User Data\Default\Extensions\dajedkncpodkggklbegccjpmnglmnflm [2013-10-17]

CHR Extension: (Click&Clean) - C:\Users\Sherri\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghgabhipcejejjmhhchfonmamedcbeod [2013-10-17]

CHR Extension: (AdBlock) - C:\Users\Sherri\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2014-10-18]

CHR Extension: (Google Wallet) - C:\Users\Sherri\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-23]

CHR Extension: (Click&Clean App) - C:\Users\Sherri\AppData\Local\Google\Chrome\User Data\Default\Extensions\pdabfienifkbhoihedcgeogidfmibmhp [2013-10-17]

CHR Extension: (Gmail) - C:\Users\Sherri\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2011-12-15]

 

==================== Services (Whitelisted) =================

 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

 

R2 ABBYY.Licensing.FineReader.Sprint.9.0; C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [759048 2009-05-14] (ABBYY)

R2 BOCMonitor; C:\Windows\SysWOW64\WatchData\Watchdata BOC CSP v3.3\BOCKeyMon.exe [69632 2011-05-12] (Beijing WatchData System Co., Ltd.) [File not signed]

R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)

R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)

R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2428088 2014-08-12] (Microsoft Corporation)

R2 DirectXJREScreenshot; C:\windows\SysWOW64\DirectXJREScreenshot\DirectXJREScreenshot.exe [60453 2014-10-07] () [File not signed]

S2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2014-10-01] (Malwarebytes Corporation)

S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [968504 2014-10-01] (Malwarebytes Corporation)

S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [289256 2014-04-09] (McAfee, Inc.)

R2 Norton PC Checkup Application Launcher; C:\Program Files (x86)\PC Checkup\SymcPCCULaunchSvc.exe [131512 2012-07-28] (Symantec Corporation)

R2 OmniAddrService; C:\Program Files (x86)\SogouInput\Components\AddressSearch\OmniAddr\OmniAddrService.exe [154352 2014-07-10] (Sogou.com Inc)

S2 PCCUJobMgr; C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.13.11\ccSvcHst.exe [126392 2011-07-19] (Symantec Corporation)

 

==================== Drivers (Whitelisted) ====================

 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

 

S3 hitmanpro37; C:\windows\system32\drivers\hitmanpro37.sys [32512 2014-10-18] ()

S3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25816 2014-10-01] (Malwarebytes Corporation)

S3 MBAMWebAccessControl; C:\windows\system32\drivers\mwac.sys [63704 2014-10-01] (Malwarebytes Corporation)

R2 ProtectorA; C:\windows\system32\drivers\ProtectorA.sys [22672 2012-01-11] (www.ISRA.org.cn)

S3 ksapi64; \??\C:\windows\system32\drivers\ksapi64.sys [X]

S1 QMUdisk; \??\C:\Program Files (x86)\Tencent\QQPCMgr\10.1.15257.227\QMUdisk64.sys [X]

 

==================== NetSvcs (Whitelisted) ===================

 

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)

 

 

==================== One Month Created Files and Folders ========

 

(If an entry is included in the fixlist, the file\folder will be moved.)

 

2014-10-20 23:55 - 2014-10-20 23:55 - 00000000 ____D () C:\Users\Sherri\Desktop\FRST-OlderVersion

2014-10-20 23:47 - 2014-10-20 23:47 - 00024750 _____ () C:\Users\Sherri\Desktop\JRT.txt

2014-10-20 23:37 - 2014-10-20 23:37 - 00000000 ____D () C:\windows\ERUNT

2014-10-20 23:35 - 2014-10-20 23:35 - 01705698 _____ (Thisisu) C:\Users\Sherri\Desktop\JRT.exe

2014-10-20 22:23 - 2014-10-20 23:19 - 00000000 ____D () C:\AdwCleaner

2014-10-20 22:22 - 2014-10-20 22:22 - 01962496 _____ () C:\Users\Sherri\Desktop\AdwCleaner.exe

2014-10-18 17:53 - 2014-10-18 17:54 - 00042532 _____ () C:\Users\Sherri\Desktop\Addition.txt

2014-10-18 17:51 - 2014-10-20 23:56 - 00027860 _____ () C:\Users\Sherri\Desktop\FRST.txt

2014-10-18 17:51 - 2014-10-20 23:56 - 00000000 ____D () C:\FRST

2014-10-18 17:50 - 2014-10-20 23:55 - 02110976 _____ (Farbar) C:\Users\Sherri\Desktop\FRST64.exe

2014-10-18 17:22 - 2014-10-18 17:22 - 00000000 ____D () C:\Users\Sherri\AppData\Local\VS Revo Group

2014-10-18 17:22 - 2014-10-18 17:22 - 00000000 ____D () C:\ProgramData\VS Revo Group

2014-10-18 16:57 - 2014-10-20 23:21 - 00002112 _____ () C:\windows\PFRO.log

2014-10-18 16:17 - 2014-10-20 23:25 - 00129752 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys

2014-10-18 16:16 - 2014-10-18 16:16 - 00001073 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-10-18 16:16 - 2014-10-18 16:16 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-10-18 16:16 - 2014-10-01 11:11 - 00093400 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys

2014-10-18 16:16 - 2014-10-01 11:11 - 00063704 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys

2014-10-18 16:16 - 2014-10-01 11:11 - 00025816 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys

2014-10-18 16:13 - 2014-10-18 16:15 - 19828376 _____ (Malwarebytes Corporation ) C:\Users\Sherri\Desktop\mbam-setup-2.0.3.1025.exe

2014-10-18 16:07 - 2014-10-20 23:21 - 00000448 _____ () C:\windows\setupact.log

2014-10-18 16:07 - 2014-10-18 16:07 - 00032512 _____ () C:\windows\system32\Drivers\hitmanpro37.sys

2014-10-18 16:07 - 2014-10-18 16:07 - 00000000 _____ () C:\windows\setuperr.log

2014-10-18 16:06 - 2014-10-18 16:07 - 00485136 _____ () C:\windows\system32\FNTCACHE.DAT

2014-10-18 16:04 - 2014-10-18 16:04 - 00039380 _____ () C:\windows\system32\.crusader

2014-10-18 15:49 - 2014-10-18 16:05 - 00000000 ____D () C:\ProgramData\HitmanPro

2014-10-18 15:48 - 2014-10-18 15:49 - 11194928 _____ (SurfRight B.V.) C:\Users\Sherri\Desktop\HitmanPro_x64.exe

2014-10-18 14:56 - 2014-10-18 14:56 - 00121120 _____ () C:\Users\Sherri\AppData\Local\GDIPFONTCACHEV1.DAT

2014-10-18 14:26 - 2014-10-20 23:26 - 00003116 _____ () C:\windows\System32\Tasks\WinZip Malware Protector_startup

2014-10-18 14:26 - 2014-10-18 14:50 - 00000000 ____D () C:\Program Files (x86)\WinZip Malware Protector

2014-10-18 14:26 - 2014-10-18 14:26 - 00001160 _____ () C:\Users\Public\Desktop\WinZip Malware Protector.lnk

2014-10-18 14:26 - 2014-10-18 14:26 - 00000000 ____D () C:\Users\Sherri\AppData\Roaming\Nico Mak Computing

2014-10-18 14:26 - 2014-10-18 14:26 - 00000000 ____D () C:\ProgramData\Nico Mak Computing

2014-10-18 14:26 - 2014-10-18 14:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip Malware Protector

2014-10-18 14:26 - 2013-03-15 17:10 - 00020480 _____ () C:\windows\system32\wsusnative64.exe

2014-10-18 14:24 - 2014-10-18 14:25 - 04894544 _____ (WinZip International LLC ) C:\Users\Sherri\Desktop\wzmalwareprotector_1.exe

2014-10-18 02:01 - 2014-10-18 14:22 - 00001945 _____ () C:\windows\epplauncher.mif

2014-10-17 22:56 - 2014-10-06 19:54 - 00378552 _____ (Microsoft Corporation) C:\windows\system32\iedkcs32.dll

2014-10-17 22:56 - 2014-10-06 19:04 - 00331448 _____ (Microsoft Corporation) C:\windows\SysWOW64\iedkcs32.dll

2014-10-17 22:56 - 2014-09-25 15:50 - 13619200 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll

2014-10-17 22:56 - 2014-09-25 15:46 - 00365056 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll

2014-10-17 22:56 - 2014-09-25 15:46 - 00243200 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll

2014-10-17 22:56 - 2014-09-25 15:46 - 00069632 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll

2014-10-17 22:56 - 2014-09-25 15:43 - 11807232 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll

2014-10-17 22:56 - 2014-09-25 15:32 - 02017280 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl

2014-10-17 22:56 - 2014-09-25 15:31 - 02108416 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl

2014-10-17 22:56 - 2014-09-18 19:25 - 23631360 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll

2014-10-17 22:56 - 2014-09-18 18:56 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb

2014-10-17 22:56 - 2014-09-18 18:55 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll

2014-10-17 22:56 - 2014-09-18 18:44 - 17484800 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll

2014-10-17 22:56 - 2014-09-18 18:41 - 02796032 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll

2014-10-17 22:56 - 2014-09-18 18:40 - 00547328 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll

2014-10-17 22:56 - 2014-09-18 18:40 - 00066048 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll

2014-10-17 22:56 - 2014-09-18 18:39 - 00048640 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll

2014-10-17 22:56 - 2014-09-18 18:38 - 00083968 _____ (Microsoft Corporation) C:\windows\system32\MshtmlDac.dll

2014-10-17 22:56 - 2014-09-18 18:36 - 05829632 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll

2014-10-17 22:56 - 2014-09-18 18:31 - 00051200 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll

2014-10-17 22:56 - 2014-09-18 18:30 - 00033792 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll

2014-10-17 22:56 - 2014-09-18 18:27 - 00595968 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll

2014-10-17 22:56 - 2014-09-18 18:26 - 00139264 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe

2014-10-17 22:56 - 2014-09-18 18:25 - 04201472 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll

2014-10-17 22:56 - 2014-09-18 18:25 - 00758272 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll

2014-10-17 22:56 - 2014-09-18 18:25 - 00111616 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe

2014-10-17 22:56 - 2014-09-18 18:18 - 00940032 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe

2014-10-17 22:56 - 2014-09-18 18:14 - 02724864 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb

2014-10-17 22:56 - 2014-09-18 18:14 - 00446464 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll

2014-10-17 22:56 - 2014-09-18 18:06 - 00072704 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll

2014-10-17 22:56 - 2014-09-18 18:02 - 00454656 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll

2014-10-17 22:56 - 2014-09-18 18:01 - 00195584 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll

2014-10-17 22:56 - 2014-09-18 18:01 - 00061952 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll

2014-10-17 22:56 - 2014-09-18 18:01 - 00051200 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieetwproxystub.dll

2014-10-17 22:56 - 2014-09-18 18:00 - 00085504 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll

2014-10-17 22:56 - 2014-09-18 17:59 - 00061952 _____ (Microsoft Corporation) C:\windows\SysWOW64\MshtmlDac.dll

2014-10-17 22:56 - 2014-09-18 17:58 - 00289280 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll

2014-10-17 22:56 - 2014-09-18 17:55 - 02187264 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll

2014-10-17 22:56 - 2014-09-18 17:54 - 00043008 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll

2014-10-17 22:56 - 2014-09-18 17:53 - 00032768 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll

2014-10-17 22:56 - 2014-09-18 17:51 - 00440320 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll

2014-10-17 22:56 - 2014-09-18 17:50 - 00112128 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieUnatt.exe

2014-10-17 22:56 - 2014-09-18 17:49 - 00597504 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9diag.dll

2014-10-17 22:56 - 2014-09-18 17:42 - 00731136 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll

2014-10-17 22:56 - 2014-09-18 17:42 - 00710656 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe

2014-10-17 22:56 - 2014-09-18 17:40 - 01249280 _____ (Microsoft Corporation) C:\windows\system32\mshtmlmedia.dll

2014-10-17 22:56 - 2014-09-18 17:36 - 00060416 _____ (Microsoft Corporation) C:\windows\SysWOW64\JavaScriptCollectionAgent.dll

2014-10-17 22:56 - 2014-09-18 17:33 - 02309632 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll

2014-10-17 22:56 - 2014-09-18 17:32 - 00164864 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll

2014-10-17 22:56 - 2014-09-18 17:20 - 00607744 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll

2014-10-17 22:56 - 2014-09-18 17:18 - 01068032 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmlmedia.dll

2014-10-17 22:56 - 2014-09-18 17:14 - 01447936 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll

2014-10-17 22:56 - 2014-09-18 16:59 - 01810944 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll

2014-10-17 22:56 - 2014-09-18 16:59 - 00775168 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll

2014-10-17 22:56 - 2014-09-18 16:53 - 01190400 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll

2014-10-17 22:56 - 2014-09-18 16:52 - 00678400 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dll

2014-10-17 22:54 - 2014-09-28 17:58 - 03198976 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys

2014-10-17 22:54 - 2014-06-18 15:23 - 01943696 _____ (Microsoft Corporation) C:\windows\system32\dfshim.dll

2014-10-17 22:54 - 2014-06-18 15:23 - 01131664 _____ (Microsoft Corporation) C:\windows\SysWOW64\dfshim.dll

2014-10-17 22:54 - 2014-06-18 15:23 - 00156824 _____ (Microsoft Corporation) C:\windows\SysWOW64\mscorier.dll

2014-10-17 22:54 - 2014-06-18 15:23 - 00156312 _____ (Microsoft Corporation) C:\windows\system32\mscorier.dll

2014-10-17 22:54 - 2014-06-18 15:23 - 00081560 _____ (Microsoft Corporation) C:\windows\SysWOW64\mscories.dll

2014-10-17 22:54 - 2014-06-18 15:23 - 00073880 _____ (Microsoft Corporation) C:\windows\system32\mscories.dll

2014-10-17 22:53 - 2014-10-09 19:05 - 00507392 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll

2014-10-17 22:53 - 2014-10-09 19:05 - 00276480 _____ (Microsoft Corporation) C:\windows\system32\generaltel.dll

2014-10-17 22:53 - 2014-10-09 19:00 - 00424448 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll

2014-10-17 22:49 - 2014-09-17 19:00 - 03241472 _____ (Microsoft Corporation) C:\windows\system32\msi.dll

2014-10-17 22:49 - 2014-09-17 18:32 - 02363904 _____ (Microsoft Corporation) C:\windows\SysWOW64\msi.dll

2014-10-17 22:49 - 2014-09-03 22:23 - 00424448 _____ (Microsoft Corporation) C:\windows\system32\rastls.dll

2014-10-17 22:49 - 2014-09-03 22:04 - 00372736 _____ (Microsoft Corporation) C:\windows\SysWOW64\rastls.dll

2014-10-17 22:48 - 2014-07-16 19:07 - 03722240 _____ (Microsoft Corporation) C:\windows\system32\mstscax.dll

2014-10-17 22:48 - 2014-07-16 19:07 - 01118720 _____ (Microsoft Corporation) C:\windows\system32\mstsc.exe

2014-10-17 22:48 - 2014-07-16 19:07 - 00681984 _____ (Microsoft Corporation) C:\windows\system32\termsrv.dll

2014-10-17 22:48 - 2014-07-16 19:07 - 00455168 _____ (Microsoft Corporation) C:\windows\system32\winlogon.exe

2014-10-17 22:48 - 2014-07-16 19:07 - 00235520 _____ (Microsoft Corporation) C:\windows\system32\winsta.dll

2014-10-17 22:48 - 2014-07-16 19:07 - 00150528 _____ (Microsoft Corporation) C:\windows\system32\rdpcorekmts.dll

2014-10-17 22:48 - 2014-07-16 19:07 - 00086528 _____ (Microsoft Corporation) C:\windows\system32\TSpkg.dll

2014-10-17 22:48 - 2014-07-16 19:07 - 00022016 _____ (Microsoft Corporation) C:\windows\system32\credssp.dll

2014-10-17 22:48 - 2014-07-16 18:40 - 00157696 _____ (Microsoft Corporation) C:\windows\SysWOW64\winsta.dll

2014-10-17 22:48 - 2014-07-16 18:39 - 03221504 _____ (Microsoft Corporation) C:\windows\SysWOW64\mstscax.dll

2014-10-17 22:48 - 2014-07-16 18:39 - 01051136 _____ (Microsoft Corporation) C:\windows\SysWOW64\mstsc.exe

2014-10-17 22:48 - 2014-07-16 18:39 - 00131584 _____ (Microsoft Corporation) C:\windows\SysWOW64\aaclient.dll

2014-10-17 22:48 - 2014-07-16 18:39 - 00065536 _____ (Microsoft Corporation) C:\windows\SysWOW64\TSpkg.dll

2014-10-17 22:48 - 2014-07-16 18:39 - 00017408 _____ (Microsoft Corporation) C:\windows\SysWOW64\credssp.dll

2014-10-17 22:48 - 2014-07-16 18:21 - 00212480 _____ (Microsoft Corporation) C:\windows\system32\Drivers\rdpwd.sys

2014-10-17 22:48 - 2014-07-16 18:21 - 00039936 _____ (Microsoft Corporation) C:\windows\system32\Drivers\tssecsrv.sys

2014-10-17 22:47 - 2014-09-12 18:58 - 00077312 _____ (Microsoft Corporation) C:\windows\system32\packager.dll

2014-10-17 22:47 - 2014-09-12 18:40 - 00067072 _____ (Microsoft Corporation) C:\windows\SysWOW64\packager.dll

2014-10-13 13:19 - 2014-10-13 23:06 - 00000000 ____D () C:\Users\Sherri\AppData\Local\Apple Computer

2014-10-13 13:19 - 2014-10-13 13:19 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes

2014-10-13 13:19 - 2012-08-21 13:01 - 00033240 _____ (GEAR Software Inc.) C:\windows\system32\Drivers\GEARAspiWDM.sys

2014-10-13 13:18 - 2014-10-13 13:18 - 00000000 ____D () C:\ProgramData\Apple Computer

2014-10-13 13:18 - 2014-10-13 13:18 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69

2014-10-13 13:18 - 2014-10-13 13:18 - 00000000 ____D () C:\Program Files\iTunes

2014-10-13 13:18 - 2014-10-13 13:18 - 00000000 ____D () C:\Program Files\iPod

2014-10-13 13:18 - 2014-10-13 13:18 - 00000000 ____D () C:\Program Files (x86)\iTunes

2014-10-13 01:46 - 2014-10-13 13:25 - 00000000 ____D () C:\Users\Sherri\AppData\Roaming\Apple Computer

2014-10-13 01:46 - 2014-10-13 13:14 - 00000000 ____D () C:\Program Files\Common Files\Apple

2014-10-13 01:46 - 2014-10-13 01:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iCloud

2014-10-13 01:45 - 2014-10-13 01:45 - 00002519 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk

2014-10-13 01:45 - 2014-10-13 01:45 - 00000000 ____D () C:\windows\System32\Tasks\Apple

2014-10-13 01:45 - 2014-10-13 01:45 - 00000000 ____D () C:\Users\Sherri\AppData\Local\Apple

2014-10-13 01:45 - 2014-10-13 01:45 - 00000000 ____D () C:\Program Files (x86)\Apple Software Update

2014-10-13 01:44 - 2014-10-13 13:14 - 00000000 ____D () C:\ProgramData\Apple

2014-10-13 01:44 - 2014-10-13 01:44 - 00000000 ____D () C:\Program Files\Bonjour

2014-10-13 01:44 - 2014-10-13 01:44 - 00000000 ____D () C:\Program Files (x86)\Bonjour

2014-10-09 03:29 - 2014-10-09 03:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome

2014-10-09 02:00 - 2014-10-09 02:00 - 00002774 _____ () C:\windows\System32\Tasks\CCleanerSkipUAC

2014-10-09 02:00 - 2014-10-09 02:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner

2014-10-07 10:23 - 2014-10-07 10:23 - 00000000 ____D () C:\windows\SysWOW64\DirectXJREScreenshot

2014-10-01 09:05 - 2014-09-24 19:08 - 00371712 _____ (Microsoft Corporation) C:\windows\system32\qdvd.dll

2014-10-01 09:05 - 2014-09-24 18:40 - 00519680 _____ (Microsoft Corporation) C:\windows\SysWOW64\qdvd.dll

2014-09-25 17:05 - 2014-09-25 17:06 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

2014-09-24 10:54 - 2014-09-09 15:11 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\tzres.dll

2014-09-24 10:54 - 2014-09-09 14:47 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\tzres.dll

 

==================== One Month Modified Files and Folders =======

 

(If an entry is included in the fixlist, the file\folder will be moved.)

 

2014-10-20 23:54 - 2011-08-23 11:17 - 02094427 _____ () C:\windows\WindowsUpdate.log

2014-10-20 23:35 - 2011-08-23 12:19 - 00000898 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-10-20 23:35 - 2011-08-23 12:19 - 00000894 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-10-20 23:30 - 2012-03-31 23:34 - 00000830 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job

2014-10-20 23:30 - 2009-07-13 21:45 - 00024608 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-10-20 23:30 - 2009-07-13 21:45 - 00024608 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-10-20 23:21 - 2009-07-13 22:08 - 00000006 ____H () C:\windows\Tasks\SA.DAT

2014-10-20 21:55 - 2011-11-26 01:13 - 00000000 ___RD () C:\Users\Sherri\Desktop\Icons

2014-10-20 20:02 - 2009-07-13 22:13 - 00782510 _____ () C:\windows\system32\PerfStringBackup.INI

2014-10-18 17:32 - 2014-05-12 22:51 - 00000000 ____D () C:\Users\Sherri\AppData\OICE_15_974FA576_32C1D314_33A6

2014-10-18 17:32 - 2012-10-21 00:13 - 00000000 ____D () C:\Users\Sherri\AppData\OICE_15_974FA576_32C1D314_1CAB

2014-10-18 17:32 - 2012-10-08 14:35 - 00000000 ____D () C:\Users\Sherri\AppData\OICE_15_974FA576_32C1D314_1EFC

2014-10-18 17:32 - 2012-10-08 14:21 - 00000000 ____D () C:\Users\Sherri\AppData\OICE_15_974FA576_32C1D314_9BC

2014-10-18 17:32 - 2012-10-08 14:06 - 00000000 ____D () C:\Users\Sherri\AppData\OICE_15_974FA576_32C1D314_335C

2014-10-18 17:32 - 2012-10-08 14:06 - 00000000 ____D () C:\Users\Sherri\AppData\OICE_15_974FA576_32C1D314_279A

2014-10-18 17:32 - 2012-01-15 14:00 - 00000000 ____D () C:\Users\Sherri\Desktop\Happiness Book2

2014-10-18 17:32 - 2011-12-05 00:15 - 00000000 ____D () C:\Users\Sherri\AppData\Roaming\KuGou7

2014-10-18 16:57 - 2009-07-13 20:20 - 00000000 ____D () C:\windows\system

2014-10-18 14:55 - 2011-12-06 21:23 - 00000000 ____D () C:\Users\Sherri\AppData\Local\CrashDumps

2014-10-18 14:55 - 2011-12-05 00:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\¿á¹·7

2014-10-18 14:55 - 2011-07-21 18:45 - 00000000 ____D () C:\windows\Panther

2014-10-18 04:12 - 2014-05-06 00:17 - 00000000 ___SD () C:\windows\system32\CompatTel

2014-10-18 03:52 - 2013-07-17 03:01 - 00000000 ____D () C:\windows\system32\MRT

2014-10-18 03:01 - 2012-02-17 21:26 - 103265616 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe

2014-10-18 01:40 - 2012-10-11 00:23 - 00000000 ____D () C:\Program Files (x86)\Avira

2014-10-17 22:25 - 2009-07-13 22:32 - 00000000 ____D () C:\windows\system32\FxsTmp

2014-10-15 20:49 - 2014-06-07 08:12 - 00000000 ____D () C:\Users\Public\SogouInput

2014-10-14 01:01 - 2014-08-27 11:12 - 00000000 ____D () C:\Users\Sherri\AppData\Roaming\KuGou8

2014-10-13 23:30 - 2011-08-23 12:19 - 00003894 _____ () C:\windows\System32\Tasks\GoogleUpdateTaskMachineUA

2014-10-13 23:30 - 2011-08-23 12:19 - 00003642 _____ () C:\windows\System32\Tasks\GoogleUpdateTaskMachineCore

2014-10-11 00:44 - 2012-01-29 21:58 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-10-11 00:42 - 2014-05-31 21:51 - 00000120 _____ () C:\Users\Sherri\AppData\Roaming\WB.CFG

2014-10-10 00:08 - 2012-06-05 01:37 - 00000000 ____D () C:\Users\Sherri\Documents\Tencent Files

2014-10-09 03:28 - 2011-08-23 12:19 - 00000000 ____D () C:\Program Files (x86)\Google

2014-10-09 03:23 - 2011-12-06 22:04 - 00000000 ___RD () C:\Users\Sherri\Desktop\Eric

2014-10-09 02:10 - 2012-10-12 23:59 - 00000000 ____D () C:\Users\Sherri\Tracing

2014-10-09 02:10 - 2011-11-25 15:44 - 00000000 ____D () C:\Users\Sherri\AppData\Roaming\Skype

2014-10-09 02:00 - 2012-01-30 00:09 - 00000000 ____D () C:\Program Files\CCleaner

2014-10-07 10:21 - 2011-07-21 18:55 - 00000000 ____D () C:\ProgramData\Adobe

2014-09-27 00:11 - 2012-06-27 16:03 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service

2014-09-25 00:04 - 2013-07-09 02:17 - 00000000 ____D () C:\Program Files\Microsoft Office 15

2014-09-23 12:52 - 2012-03-31 23:34 - 00701104 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe

2014-09-23 12:52 - 2012-03-31 23:34 - 00003768 _____ () C:\windows\System32\Tasks\Adobe Flash Player Updater

2014-09-23 12:52 - 2011-07-21 18:55 - 00071344 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl

2014-09-21 23:42 - 2010-11-20 20:27 - 00278152 ____N (Microsoft Corporation) C:\windows\system32\MpSigStub.exe

 

Files to move or delete:

====================

C:\Users\Sherri\mediaenchx32.dll

C:\Users\Sherri\mediaenchx321.dll

C:\Users\Sherri\mediaenchx322.dll

C:\Users\Sherri\mediaenchx323.dll

C:\Users\Sherri\webphonecfgb.dat

 

 

Some content of TEMP:

====================

C:\Users\Sherri\AppData\Local\Temp\Quarantine.exe

C:\Users\Sherri\AppData\Local\Temp\sqlite3.dll

 

 

==================== Bamital & volsnap Check =================

 

(There is no automatic fix for files that do not pass verification.)

 

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\SysWOW64\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed

 

 

LastRegBack: 2014-05-13 22:13

 

==================== End Of Log ============================

[sherri_zhu]

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 21-10-2014

Ran by Sherri at 2014-10-20 23:57:43

Running from C:\Users\Sherri\Desktop

Boot Mode: Normal

==========================================================

 

 

==================== Security Center ========================

 

(If an entry is included in the fixlist, it will be removed.)

 

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

 

==================== Installed Programs ======================

 

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

 

¿á¹·ÒôÀÖ (HKLM-x32\...\¿á¹·ÒôÀÖ) (Version: 7.6.21.15409 - ¿á¹·ÒôÀÖ)

7-Zip File Manager version 9.20 (HKLM-x32\...\{863448D4-F184-4B21-A46B-323C97A2D038}_is1) (Version: 9.20 - Download Freely, LLC)

ABBYY FineReader 9.0 Sprint (HKLM-x32\...\ABBYY FineReader 9.0 Sprint) (Version: 9.01.513.58212 - ABBYY)

ABBYY FineReader 9.0 Sprint (x32 Version: 9.01.513.58212 - ABBYY) Hidden

Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 3.5.0.600 - Adobe Systems Incorporated)

Adobe AIR (x32 Version: 3.5.0.600 - Adobe Systems Incorporated) Hidden

Adobe Flash Player 15 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 15.0.0.167 - Adobe Systems Incorporated)

Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.152 - Adobe Systems Incorporated)

Adobe Reader X (10.1.12) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AA1000000001}) (Version: 10.1.12 - Adobe Systems Incorporated)

Adobe Shockwave Player 11.6 (HKLM-x32\...\Adobe Shockwave Player) (Version: 11.6.4.634 - Adobe Systems, Inc.)

AMD Media Foundation Decoders (Version: 1.0.60607.2201 - ATI Technologies Inc.) Hidden

AMD VISION Engine Control Center (x32 Version: 2011.0607.2212.38019 - ATI) Hidden

Apple Application Support (HKLM-x32\...\{78002155-F025-4070-85B3-7C0453561701}) (Version: 3.0.6 - Apple Inc.)

Apple Mobile Device Support (HKLM\...\{B678797F-DF38-4556-8A31-8B818E261868}) (Version: 8.0.0.23 - Apple Inc.)

Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)

ATI Catalyst Install Manager (HKLM\...\{4ACA5AE7-E68C-5A48-F8E6-D67946267506}) (Version: 3.0.829.0 - ATI Technologies, Inc.)

BOCNET Security Applet 2.1 (HKLM\...\BOCNET Security Applet_is1) (Version:  - Bank of China, Inc.)

BOCNET USBKey Management Suit (HKLM\...\{51DD3A98-0A8B-4194-9628-F4B50A9AEC0A}) (Version: 1.0.0 - Beijing WatchData System Co., Ltd.)

BOCNET USBKey Management Suit (HKLM-x32\...\{007C14F9-7457-4b67-9220-5CC24C7A47CC}) (Version: 1.0.0 - Beijing WatchData System Co., Ltd.)

BOCNET USBKey management suit (HKLM-x32\...\BOCNET USBKey management suit) (Version: 5.0.5.32 - HengBao, Inc.)

Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)

Brownstone Equation Editor 5 (HKLM-x32\...\BREE5) (Version: 5.2 - Design Science, Inc.)

Catalyst Control Center - Branding (x32 Version: 1.00.0000 - ATI) Hidden

Catalyst Control Center Graphics Previews Common (x32 Version: 2011.0607.2212.38019 - ATI) Hidden

Catalyst Control Center InstallProxy (x32 Version: 2011.0607.2212.38019 - ATI Technologies, Inc.) Hidden

Catalyst Control Center Localization All (x32 Version: 2011.0607.2212.38019 - ATI) Hidden

CCC Help Chinese Standard (x32 Version: 2011.0607.2211.38019 - ATI) Hidden

CCC Help Chinese Traditional (x32 Version: 2011.0607.2211.38019 - ATI) Hidden

CCC Help Czech (x32 Version: 2011.0607.2211.38019 - ATI) Hidden

CCC Help Danish (x32 Version: 2011.0607.2211.38019 - ATI) Hidden

CCC Help Dutch (x32 Version: 2011.0607.2211.38019 - ATI) Hidden

CCC Help English (x32 Version: 2011.0607.2211.38019 - ATI) Hidden

CCC Help Finnish (x32 Version: 2011.0607.2211.38019 - ATI) Hidden

CCC Help French (x32 Version: 2011.0607.2211.38019 - ATI) Hidden

CCC Help German (x32 Version: 2011.0607.2211.38019 - ATI) Hidden

CCC Help Greek (x32 Version: 2011.0607.2211.38019 - ATI) Hidden

CCC Help Hungarian (x32 Version: 2011.0607.2211.38019 - ATI) Hidden

CCC Help Italian (x32 Version: 2011.0607.2211.38019 - ATI) Hidden

CCC Help Japanese (x32 Version: 2011.0607.2211.38019 - ATI) Hidden

CCC Help Korean (x32 Version: 2011.0607.2211.38019 - ATI) Hidden

CCC Help Norwegian (x32 Version: 2011.0607.2211.38019 - ATI) Hidden

CCC Help Polish (x32 Version: 2011.0607.2211.38019 - ATI) Hidden

CCC Help Portuguese (x32 Version: 2011.0607.2211.38019 - ATI) Hidden

CCC Help Russian (x32 Version: 2011.0607.2211.38019 - ATI) Hidden

CCC Help Spanish (x32 Version: 2011.0607.2211.38019 - ATI) Hidden

CCC Help Swedish (x32 Version: 2011.0607.2211.38019 - ATI) Hidden

CCC Help Thai (x32 Version: 2011.0607.2211.38019 - ATI) Hidden

CCC Help Turkish (x32 Version: 2011.0607.2211.38019 - ATI) Hidden

ccc-utility64 (Version: 2011.0607.2212.38019 - ATI) Hidden

CCleaner (HKLM\...\CCleaner) (Version: 4.18 - Piriform)

Chinese Simplified Fonts Support For Adobe Reader X (HKLM-x32\...\{AC76BA86-7AD7-2447-0000-A00000000003}) (Version: 10.0.0 - Adobe Systems Incorporated)

Conexant HD Audio (HKLM\...\CNXT_AUDIO_HDA) (Version: 8.54.1.0 - Conexant)

D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden

Epson Connect (HKLM-x32\...\{64BA551C-9AF6-495C-93F3-D1270E0045FC}) (Version:  - )

Epson Customer Participation (HKLM\...\{814FA673-A085-403C-9545-747FC1495069}) (Version: 1.0.0.0 - SEIKO EPSON CORPORATION)

Epson Download Navigator (HKLM-x32\...\{10F63395-157F-4B93-AB4D-702A2FF11942}) (Version: 1.0.1 - SEIKO EPSON CORPORATION)

Epson Event Manager (HKLM-x32\...\{FA9D303D-0FB2-49C7-9397-8E6B11EA892D}) (Version: 2.50.0001 - SEIKO EPSON CORPORATION)

Epson FAX Utility (HKLM-x32\...\{0CBE6C93-CB2E-4378-91EE-12BE6D4E2E4A}) (Version: 1.20.00 - SEIKO EPSON CORPORATION)

EPSON Scan (HKLM-x32\...\EPSON Scanner) (Version:  - Seiko Epson Corporation)

EPSON WorkForce 645 Series Printer Uninstall (HKLM\...\EPSON WorkForce 645 Series) (Version:  - SEIKO EPSON Corporation)

EpsonNet Print (HKLM-x32\...\{3E31400D-274E-4647-916C-2CACC3741799}) (Version: 2.4j - SEIKO EPSON CORPORATION)

ETDWare PS/2-X64 8.0.8.0_R01 (HKLM\...\Elantech) (Version: 8.0.8.0 - ELAN Microelectronic Corp.)

Google Chrome (HKLM-x32\...\Google Chrome) (Version: 38.0.2125.104 - Google Inc.)

Google Earth (HKLM-x32\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)

Google Update Helper (x32 Version: 1.3.25.5 - Google Inc.) Hidden

iCloud (HKLM\...\{6096C0CC-7E19-4355-87F0-627EC5AA146D}) (Version: 4.0.3.56 - Apple Inc.)

IEËÑË÷ÖúÊÖ (HKLM-x32\...\TXIEHlp) (Version: 3.0.3.10 - ÌÚѶ¹«Ë¾)

iTunes (HKLM\...\{F46AA0F1-E284-4878-A462-5F11B9166C0E}) (Version: 11.4.0.18 - Apple Inc.)

Java 7 Update 45 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217025FF}) (Version: 7.0.450 - Oracle)

Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden

Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Majestic Chess (HKLM-x32\...\{A25DAEDA-5558-4E1D-931A-5D57053FDFED}) (Version: 1.00.0000 - ValuSoft)

Malwarebytes Anti-Malware version 2.0.3.1025 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.3.1025 - Malwarebytes Corporation)

McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.8.150.1 - McAfee, Inc.)

Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden

Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft IntelliPoint 8.2 (HKLM\...\Microsoft IntelliPoint 8.2) (Version: 8.20.468.0 - Microsoft Corporation)

Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)

Microsoft Office Professional Plus 2013 - en-us (HKLM\...\ProPlusRetail - en-us) (Version: 15.0.4649.1003 - Microsoft Corporation)

Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)

Microsoft SkyDrive (HKCU\...\SkyDriveSetup.exe) (Version: 16.4.6003.0710 - Microsoft Corporation)

Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)

Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022.218 (HKLM-x32\...\{E503B4BF-F7BB-3D5F-8BC8-F694B1CFF942}) (Version: 9.0.21022.218 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Mozilla Firefox 32.0.3 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 32.0.3 (x86 en-US)) (Version: 32.0.3 - Mozilla)

Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)

MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden

MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden

Office 15 Click-to-Run Extensibility Component (Version: 15.0.4649.1003 - Microsoft Corporation) Hidden

Office 15 Click-to-Run Licensing Component (Version: 15.0.4649.1003 - Microsoft Corporation) Hidden

Office 15 Click-to-Run Localization Component (Version: 15.0.4649.1003 - Microsoft Corporation) Hidden

PlayReady PC Runtime amd64 (HKLM\...\{BCA9334F-B6C9-4F65-9A73-AC5A329A4D04}) (Version: 1.3.0 - Microsoft Corporation)

PlayReady PC Runtime x86 (HKLM-x32\...\{CCA5EAAD-92F4-4B7A-B5EE-14294C66AB61}) (Version: 1.3.0 - Microsoft Corporation)

QQ International (HKLM-x32\...\{3CA54984-A14B-42FE-9FF1-7EA90151D725}) (Version: 1.91.1213.0 - 腾讯科技(深圳)有限公司)

Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.7600.30124 - Realtek Semiconductor Corp.)

Realtek WLAN Driver (HKLM-x32\...\{9D3D8C60-A55F-4fed-B2B9-173001290E16}) (Version: 2.00.0016 - REALTEK Semiconductor Corp.)

SecEditCtl.BOC (only remove) (HKLM-x32\...\SecEditCtl.BOC01000009) (Version:  - CFCA)

SecondLifeViewer (remove only) (HKLM-x32\...\SecondLifeViewer) (Version:  - )

Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.3.16540.9015 - Microsoft Corporation)

Skype™ 6.11 (HKLM-x32\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.)

swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden

Toshiba App Place (HKLM-x32\...\{ED3CBA78-488F-4E8C-B33F-8E3BF4DDB4D2}) (Version: 1.0.6.3 - Toshiba)

TOSHIBA Application Installer (HKLM-x32\...\{970472D0-F5F9-4158-A6E3-1AE49EFEF2D3}) (Version: 9.0.1.2 - TOSHIBA)

TOSHIBA Assist (HKLM-x32\...\{C2A276E3-154E-44DC-AAF1-FFDD7FD30E35}) (Version: 4.2.3.0 - TOSHIBA CORPORATION)

TOSHIBA Bulletin Board (HKLM-x32\...\InstallShield_{1C8C049A-145F-4A6E-8290-B5C245EBE39D}) (Version: 1.6.10.64 - TOSHIBA Corporation)

TOSHIBA Bulletin Board (Version: 1.6.10.64 - TOSHIBA Corporation) Hidden

TOSHIBA Disc Creator (HKLM\...\{5DA0E02F-970B-424B-BF41-513A5018E4C0}) (Version: 2.1.0.11 for x64 - TOSHIBA Corporation)

TOSHIBA Face Recognition (HKLM-x32\...\InstallShield_{F67FA545-D8E5-4209-86B1-AEE045D1003F}) (Version: 3.1.17.64 - TOSHIBA Corporation)

TOSHIBA Face Recognition (Version: 3.1.17.64 - TOSHIBA Corporation) Hidden

TOSHIBA Hardware Setup (HKLM-x32\...\{97965331-BC5D-4D9F-B6DF-5C0A123E4AE0}) (Version: 2.1.0.3 - TOSHIBA Corporation)

TOSHIBA HDD/SSD Alert (HKLM\...\{D4322448-B6AF-4316-B859-D8A0E84DCB38}) (Version: 3.1.64.9 - TOSHIBA Corporation)

Toshiba Laptop Checkup (HKLM-x32\...\NortonPCCheckup) (Version: 2.0.13.11 - Symantec Corporation)

TOSHIBA Media Controller (HKLM-x32\...\{C7A4F26F-F9B0-41B2-8659-99181108CDE3}) (Version: 1.0.87.4 - TOSHIBA CORPORATION)

Toshiba Online Backup (HKLM-x32\...\{C57BCDE1-7CB9-467D-B3BA-7E119916CDC1}) (Version: 2.0.0.31 - Toshiba)

TOSHIBA Quality Application (HKLM-x32\...\{E69992ED-A7F6-406C-9280-1C156417BC49}) (Version: 1.0.3 - TOSHIBA)

TOSHIBA Recovery Media Creator (HKLM-x32\...\{B65BBB06-1F8E-48F5-8A54-B024A9E15FDF}) (Version: 2.1.5.5109a - TOSHIBA CORPORATION)

TOSHIBA ReelTime (HKLM-x32\...\InstallShield_{24811C12-F4A9-4D0F-8494-A7B8FE46123C}) (Version: 1.7.21.64 - TOSHIBA Corporation)

TOSHIBA ReelTime (Version: 1.7.21.64 - TOSHIBA Corporation) Hidden

TOSHIBA Service Station (HKLM-x32\...\{AC6569FA-6919-442A-8552-073BE69E247A}) (Version: 2.2.12 - TOSHIBA)

TOSHIBA Supervisor Password (HKLM-x32\...\{0AF17224-CF88-40B8-BB1A-D179369847B4}) (Version: 2.1.0.2 - TOSHIBA Corporation)

TOSHIBA Value Added Package (HKLM-x32\...\InstallShield_{066CFFF8-12BF-4390-A673-75F95EFF188E}) (Version: 1.6.1.64 - TOSHIBA Corporation)

TOSHIBA Value Added Package (Version: 1.6.1.64 - TOSHIBA Corporation) Hidden

TOSHIBA Value Added Package (x32 Version: 1.6.1.64 - TOSHIBA Corporation) Hidden

TOSHIBA Web Camera Application (HKLM-x32\...\InstallShield_{6F3C8901-EBD3-470D-87F8-AC210F6E5E02}) (Version: 2.0.3.3 - TOSHIBA Corporation)

TOSHIBA Web Camera Application (x32 Version: 2.0.3.3 - TOSHIBA Corporation) Hidden

TOSHIBARegistration (HKLM-x32\...\{5AF550B4-BB67-4E7E-82F1-2C4300279050}) (Version: 1.0.6 - TOSHIBA)

Windows Live Communications Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3538.0513 - Microsoft Corporation)

Windows Live Essentials (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Windows Live ID Sign-in Assistant (Version: 7.250.4232.0 - Microsoft Corporation) Hidden

Windows Live Installer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Windows Live Language Selector (Version: 15.4.3538.0513 - Microsoft Corporation) Hidden

Windows Live Mail (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Windows Live Mesh (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation)

Windows Live Messenger (x32 Version: 15.4.3538.0513 - Microsoft Corporation) Hidden

Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Windows Live Movie Maker (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Windows Live Photo Common (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Windows Live Photo Gallery (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Windows Live PIMT Platform (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden

Windows Live Remote Client (Version: 15.4.5722.2 - Microsoft Corporation) Hidden

Windows Live Remote Client Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden

Windows Live Remote Service (Version: 15.4.5722.2 - Microsoft Corporation) Hidden

Windows Live Remote Service Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden

Windows Live SOXE (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Windows Live UX Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden

Windows Live Writer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Windows Live Writer Resources (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Windows Media Player Firefox Plugin (HKLM-x32\...\{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}) (Version: 1.0.0.8 - Microsoft Corp)

WinRAR 4.20 (32-bit) (HKLM-x32\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)

WinZip Malware Protector (HKLM-x32\...\WinZip Malware Protector_is1) (Version: 2.1.1000.10740 - WinZip International LLC)

Wizard101 (HKLM-x32\...\{A9E27FF5-6294-46A8-B8FD-77B1DECA3021}) (Version: 1.0.0 - KingsIsle Entertainment, Inc.)

搜狗拼音输入法 7.1正式版 (HKLM-x32\...\Sogou Input) (Version: 7.1.0.2057 - Sogou.com)

 

==================== Custom CLSID (selected items): ==========================

 

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

 

CustomCLSID: HKU\S-1-5-21-429594294-1317963213-1840044107-1001_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32 -> C:\Users\Sherri\AppData\Local\Microsoft\SkyDrive\16.4.6003.0710\amd64\SkyDriveShell64.dll (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-429594294-1317963213-1840044107-1001_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32 -> C:\Users\Sherri\AppData\Local\Microsoft\SkyDrive\16.4.6003.0710\amd64\SkyDriveShell64.dll (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-429594294-1317963213-1840044107-1001_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 -> C:\Users\Sherri\AppData\Local\Microsoft\SkyDrive\16.4.6003.0710\amd64\SkyDriveShell64.dll (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-429594294-1317963213-1840044107-1001_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\Sherri\AppData\Local\Microsoft\SkyDrive\16.4.6003.0710\amd64\FileSyncApi64.dll (Microsoft Corporation)

 

==================== Restore Points  =========================

 

01-10-2014 16:05:26 Windows Update

01-10-2014 17:47:47 Windows Update

07-10-2014 17:26:37 Removed MySafeProxy for Internet Explorer

07-10-2014 17:42:56 CloudScout Parental Control

07-10-2014 17:48:09 Windows Update

09-10-2014 08:45:08 WinZip Registry Optimizer Thu, Oct 09, 14  01:44

11-10-2014 06:01:30 Windows Update

13-10-2014 08:45:24 Installed iCloud

13-10-2014 20:14:34 Installed iTunes

14-10-2014 06:13:51 Windows Update

18-10-2014 05:32:50 Windows Update

18-10-2014 07:52:41 WinZip Malware Protector

18-10-2014 10:00:25 Windows Update

18-10-2014 21:59:24 Removed Label@Once 1.0.

18-10-2014 23:01:48 Checkpoint by HitmanPro

18-10-2014 23:03:45 Checkpoint by HitmanPro

 

==================== Hosts content: ==========================

 

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

 

2009-07-13 19:34 - 2009-06-10 14:00 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts

 

==================== Scheduled Tasks (whitelisted) =============

 

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

 

Task: {1EB27F60-DC97-4DF2-BE33-2CFBAF8E5092} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office 15\root\Office15\msoia.exe [2014-08-27] (Microsoft Corporation)

Task: {1F5E260E-C9C6-4425-BAFC-CEB90470265F} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2014-08-12] (Microsoft Corporation)

Task: {3A363BB5-8A2B-466A-AE1D-A6636D68F0BF} - System32\Tasks\PC Checkup 3 Weekly Scan => C:\Program Files (x86)\PC Checkup\NLAppLauncher.exe [2012-07-28] (Symantec Corporation)

Task: {3B4B487D-E1EE-483D-9352-FC9C946FB814} - System32\Tasks\SogouImeMgr => C:\Program Files (x86)\SogouInput\SogouExe\SogouExe.exe [2014-06-04] (Sogou.com Inc.)

Task: {52A74689-6F71-46D3-8A1B-863C59CEDF69} - System32\Tasks\Microsoft\Microsoft Antimalware\Microsoft Antimalware Scheduled Scan => c:\Program Files\Microsoft Security Client\MpCmdRun.exe

Task: {69EFCB34-1D7F-4045-8B51-A64C998D6B21} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-13] (Google Inc.)

Task: {721A6D49-787E-4FE9-A2FD-A38476EDD3DD} - System32\Tasks\Microsoft_Hardware_Launch_IPoint_exe => c:\Program Files\Microsoft IntelliPoint\IPoint.exe [2011-08-01] (Microsoft Corporation)

Task: {795A690B-A137-4D3F-8D31-43A33A4A0F5F} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exe

Task: {8655645D-F349-4760-9B7F-2373467F1301} - System32\Tasks\Norton Security Scan for Sherri => C:\PROGRA~2\NORTON~2\Engine\372~1.5\Nss.exe

Task: {99E2108D-C808-4A9C-8E88-77799FA12005} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)

Task: {A2E86980-A762-4C1E-892A-6A494C80C604} - System32\Tasks\WinZip Malware Protector_startup => C:\Program Files (x86)\WinZip Malware Protector\WinZipMalwareProtector.exe [2013-03-26] (Nico Mak Computing)

Task: {B59DCC97-8002-4A55-AE2E-26DAED02B85F} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office 15\root\Office15\msoia.exe [2014-08-27] (Microsoft Corporation)

Task: {BC24C873-BBE0-409A-B63B-8E2D56F315D2} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-09-23] (Adobe Systems Incorporated)

Task: {BCCA0679-D890-4047-9323-93CBA5BDA52E} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-09-26] (Piriform Ltd)

Task: {DC4AE441-62EB-453E-8772-F018627C57AC} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-13] (Google Inc.)

Task: {E98887C0-2A89-44DA-8C17-6473D996507F} - System32\Tasks\{BD056A6D-F6E0-4C0C-8D72-C6FFEA81A051} => Iexplore.exe http://www.skype.com/go/downloading?source=lightinstaller&ver=5.5.0.119.259&LastError=404

Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\windows\Tasks\Norton Security Scan for Sherri.job => C:\PROGRA~2\NORTON~2\Engine\372~1.5\Nss.exe

 

==================== Loaded Modules (whitelisted) =============

 

2014-03-19 18:11 - 2014-05-20 09:19 - 00105640 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll

2014-10-07 10:23 - 2014-10-07 10:23 - 00060453 _____ () C:\windows\SysWOW64\DirectXJREScreenshot\DirectXJREScreenshot.exe

2010-11-18 17:18 - 2010-11-18 17:18 - 11190784 _____ () C:\Program Files\TOSHIBA\FlashCards\BlackPng.dll

2011-06-07 22:11 - 2011-06-07 22:11 - 00243712 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll

2011-03-22 10:17 - 2011-03-22 10:17 - 00016384 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll

2011-06-09 21:09 - 2011-06-09 21:09 - 00079784 _____ () C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosIPCWraper.dll

2014-09-24 22:19 - 2014-09-24 22:19 - 08894120 _____ () C:\Program Files\Microsoft Office 15\root\Office15\1033\GrooveIntlResource.dll

2014-07-31 12:16 - 2014-07-31 12:16 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll

2014-07-31 12:16 - 2014-07-31 12:16 - 01044776 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll

2012-08-03 19:03 - 2011-06-03 14:17 - 00040960 _____ () C:\Windows\SysWOW64\WatchData\Watchdata BOC CSP v3.3\UIResE3.DLL

2012-08-03 19:03 - 2011-06-03 14:17 - 00053248 _____ () C:\Windows\SysWOW64\WatchData\Watchdata BOC CSP v3.3\WDEvent.dll

2012-04-11 20:32 - 2012-04-11 20:32 - 00018432 _____ () C:\Program Files (x86)\HBBOC\BOC0409.hbl

2009-07-13 14:03 - 2009-07-13 18:15 - 00364544 _____ () C:\Windows\SysWOW64\msjetoledb40.dll

2014-09-24 22:19 - 2014-09-24 22:19 - 08894120 _____ () C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Microsoft Office\Office15\1033\GrooveIntlResource.dll

2014-10-18 04:07 - 2014-10-09 19:03 - 01042760 _____ () C:\Program Files (x86)\Google\Chrome\Application\38.0.2125.104\libglesv2.dll

2014-10-18 04:07 - 2014-10-09 19:03 - 00211272 _____ () C:\Program Files (x86)\Google\Chrome\Application\38.0.2125.104\libegl.dll

2014-10-18 04:07 - 2014-10-09 19:04 - 08910664 _____ () C:\Program Files (x86)\Google\Chrome\Application\38.0.2125.104\pdf.dll

2014-10-18 04:06 - 2014-10-09 19:03 - 01681224 _____ () C:\Program Files (x86)\Google\Chrome\Application\38.0.2125.104\ffmpegsumo.dll

2014-10-18 04:07 - 2014-10-09 19:04 - 14902600 _____ () C:\Program Files (x86)\Google\Chrome\Application\38.0.2125.104\PepperFlash\pepflashplayer.dll

 

==================== Alternate Data Streams (whitelisted) =========

 

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

 

AlternateDataStreams: C:\ProgramData\TEMP:373E1720

AlternateDataStreams: C:\ProgramData\TEMP:DFC5A2B2

 

==================== Safe Mode (whitelisted) ===================

 

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

 

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\QQPCRTP => ""="service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\QQPCRTP => ""="service"

 

==================== EXE Association (whitelisted) =============

 

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)

 

 

==================== MSCONFIG/TASK MANAGER disabled items =========

 

(Currently there is no automatic fix for this section.)

 

 

========================= Accounts: ==========================

 

Administrator (S-1-5-21-429594294-1317963213-1840044107-500 - Administrator - Disabled)

Guest (S-1-5-21-429594294-1317963213-1840044107-501 - Limited - Disabled)

HomeGroupUser$ (S-1-5-21-429594294-1317963213-1840044107-1002 - Limited - Enabled)

Sherri (S-1-5-21-429594294-1317963213-1840044107-1001 - Administrator - Enabled) => C:\Users\Sherri

 

==================== Faulty Device Manager Devices =============

 

Name: tencent QMUdisk

Description: tencent QMUdisk

Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}

Manufacturer: 

Service: QMUdisk

Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)

Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.

Devices stay in this state if they have been prepared for removal.

After you remove the device, this error disappears.Remove the device, and this error should be resolved.

 

Name: Teredo Tunneling Pseudo-Interface

Description: Microsoft Teredo Tunneling Adapter

Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}

Manufacturer: Microsoft

Service: tunnel

Problem: : This device cannot start. (Code10)

Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.

On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.

 

 

==================== Event log errors: =========================

 

Application errors:

==================

 

System errors:

=============

 

Microsoft Office Sessions:

=========================

 

CodeIntegrity Errors:

===================================

  Date: 2014-10-11 01:21:36.363

  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files (x86)\PCTRunner\pcwtc64f.sys because the set of per-page image hashes could not be found on the system.

 

  Date: 2014-10-11 01:21:34.044

  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files (x86)\PCTRunner\pcwtc64f.sys because the set of per-page image hashes could not be found on the system.

 

  Date: 2014-10-11 01:21:31.545

  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files (x86)\PCTRunner\pcwtc64f.sys because the set of per-page image hashes could not be found on the system.

 

  Date: 2014-10-11 00:56:25.690

  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files (x86)\PCTRunner\pcwtc64f.sys because the set of per-page image hashes could not be found on the system.

 

  Date: 2014-10-11 00:56:23.320

  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files (x86)\PCTRunner\pcwtc64f.sys because the set of per-page image hashes could not be found on the system.

 

  Date: 2014-10-11 00:56:21.065

  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files (x86)\PCTRunner\pcwtc64f.sys because the set of per-page image hashes could not be found on the system.

 

 

==================== Memory info =========================== 

 

Processor: AMD E-300 APU with Radeon HD Graphics

Percentage of memory in use: 44%

Total physical RAM: 3686.87 MB

Available physical RAM: 2064.6 MB

Total Pagefile: 7371.91 MB

Available Pagefile: 5284.98 MB

Total Virtual: 8192 MB

Available Virtual: 8191.86 MB

 

==================== Drives ================================

 

Drive c: (TI106232W0C) (Fixed) (Total:284.4 GB) (Free:192.25 GB) NTFS ==>[system with boot components (obtained from reading drive)]

 

==================== MBR & Partition Table ==================

 

========================================================

Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 298.1 GB) (Disk ID: D2F26588)

Partition 1: (Active) - (Size=1.5 GB) - (Type=27)

Partition 2: (Not Active) - (Size=284.4 GB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=12.2 GB) - (Type=17)

 

==================== End Of Log ============================

[LiquidTension]

Hi Sherri, 
 
Did you set this proxy?

• ProxyEnable: Internet Explorer proxy is enabled.
• ProxyServer: http=127.0.0.1:28973
   

Do you recognise these programmes?

• ¿á¹·ÒôÀÖ 
• IEËÑË÷ÖúÊÖ
• 搜狗拼音输入法 7.1正式版
   

STEP 1
 Folder Options 

• Press the Windows Key  + r on your keyboard at the same time. Type Control Folders and click OK.
• Click View. Under Hidden files and folders: 
• Place a checkmark next to Show hidden files, folders and drives.
• Remove the checkmark next to Hide extensions for known file types.
• Remove the checkmark next to Hide protected operating system Files (Recommended).
• Click Apply followed by OK.
   

STEP 2
 VirusTotal Upload

• Please go to VirusTotal.com.
• Click Choose File and locate the following file:
  • C:\windows\SysWOW64\DirectXJREScreenshot\DirectXJREScreenshot.exe
• ​Click Scan it!.
• If you receive the following notification: File already analysed click Reanalyse.
• Once the file has been analyzed, copy the page URL at the top of the window and paste in your next reply. 

[sherri_zhu]

https://www.virustotal.com/en/file/823fa7d400e34593715eb921688dde0043252461defcf7c56f490b41cc60e65b/analysis/1413913570/

 

"Did you set this proxy?

ProxyEnable: Internet Explorer proxy is enabled.

ProxyServer: http=127.0.0.1:28973"

 

NO, I DIDN'T SET IT.

 

"Do you recognise these programmes?

¿á¹·ÒôÀÖ 

IEËÑË÷ÖúÊÖ

搜狗拼音输入法 7.1正式版"

 

I RECOGNIZE THE FIRST AND THIRD, BUT DON'T RECOGNIZE THE MIDDLE ONE.

[LiquidTension]

Hi Sherri, 
 
Please provide an update on your computer after completing the steps below. Are there any outstanding issues?
 
STEP 1
 Uninstall Software

• Press the Windows Key  + r on your keyboard at the same time. Type appwiz.cpl and click OK.
• Search for the following programmes, right-click and click Uninstall.
• Note: Ensure you decline offers of additional software if applicable.
  • IEËÑË÷ÖúÊÖ
• Follow the prompts.
• Reboot if necessary.
   

STEP 2
 Farbar Recovery Scan Tool (FRST) Script

• Press the Windows Key  + r on your keyboard at the same time. Type Notepad and click OK.
• Copy the entire contents of the codebox below and paste into the Notepad document.
  

  startProxyEnable: Internet Explorer proxy is enabled.ProxyServer: http=127.0.0.1:28973() C:\Windows\SysWOW64\DirectXJREScreenshot\DirectXJREScreenshot.exeR2 DirectXJREScreenshot; C:\windows\SysWOW64\DirectXJREScreenshot\DirectXJREScreenshot.exe [60453 2014-10-07] () [File not signed]2014-10-07 10:23 - 2014-10-07 10:23 - 00000000 ____D () C:\windows\SysWOW64\DirectXJREScreenshot2014-10-07 10:23 - 2014-10-07 10:23 - 00060453 _____ () C:\windows\SysWOW64\DirectXJREScreenshot\DirectXJREScreenshot.exeHKLM\...\Run: [] => [X]HKU\S-1-5-21-429594294-1317963213-1840044107-1001\...\MountPoints2: {5dbf5758-ec13-11e1-93b3-00266cd61d58} - E:\Setup.exeHKU\S-1-5-21-429594294-1317963213-1840044107-1001\...\MountPoints2: {7a6537e1-3ff2-11e3-aedb-00266cd61d58} - E:\Setup.exeHKU\S-1-5-21-429594294-1317963213-1840044107-1001\...\MountPoints2: {e5f869f5-ddd0-11e1-9444-00266cd61d58} - E:\Setup.exeToolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No FileToolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No FileToolbar: HKCU - No Name - {65F8A3D2-4C22-4A33-9633-73167EAEEC45} -  No FileHandler: KuGoo - {6AC4FBC7-AA38-45EC-9634-D6D20B679EFC} -  No FileHandler: KuGoo3 - {6AC4FBC7-AA38-45EC-9634-D6D20B679EFC} -  No FileURLSearchHook: HKCU - (No Name) - {472734EA-242A-422b-ADF8-83D1E48CC825} - No FileBHO-x32: C32C32B7-A92F-CC44-5B46-1E8538F7BBFC Class -> {C32C32B7-A92F-CC44-5B46-1E8538F7BBFC} -> C:\Program Files (x86)\QvodPlayer\AddIn\{C32C32B7-A92F-CC44-5B46-1E8538F7BBFC}\QvodAddr.dll No FileC:\Program Files (x86)\QvodPlayerFF DefaultSearchEngine: Yahoo! (SD)FF SelectedSearchEngine: Yahoo! (SD)FF Plugin: @qvod.com/QvodShare -> C:\Program Files (x86)\QvodPlayer\npShareModule_x64.dll No FileFF Plugin-x32: @qq.com/npAndroidAssistant -> C:\Program Files (x86)\Common Files\Tencent\QQPhoneManager\2.0.201.3180\npQQPhoneManagerExt.dll No FileFF Plugin-x32: @qq.com/npchrome -> C:\Program Files (x86)\Common Files\Tencent\Npchrome\npchrome.dll No FileFF Plugin-x32: @qq.com/npqscall -> C:\Program Files (x86)\Common Files\Tencent\NPQSCALL\npqscall.dll No FileFF Plugin-x32: @qq.com/npqscall,version=1.0.0 -> %commonprogramfiles%\tencent\NPQSCALL\npqscall.dll No FileFF Plugin-x32: @qq.com/QQPhotoDrawEx -> C:\Program Files (x86)\Tencent\Qzone\npQQPhotoDrawEx.dll No FileFF Plugin-x32: @qq.com/QzoneMusic -> C:\Program Files (x86)\Tencent\QQMusic\npQzoneMusic.dll No FileFF SearchPlugin: C:\Users\Sherri\AppData\Roaming\Mozilla\Firefox\Profiles\f8676dxc.default\searchplugins\yahoo-sd.xmlFF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npfetion.dll ( )S1 QMUdisk; \??\C:\Program Files (x86)\Tencent\QQPCMgr\10.1.15257.227\QMUdisk64.sys [X]C:\Users\Sherri\mediaenchx32.dllC:\Users\Sherri\mediaenchx321.dllC:\Users\Sherri\mediaenchx322.dllC:\Users\Sherri\mediaenchx323.dllC:\Users\Sherri\webphonecfgb.dat2014-10-10 00:08 - 2012-06-05 01:37 - 00000000 ____D () C:\Users\Sherri\Documents\Tencent FilesAlternateDataStreams: C:\ProgramData\TEMP:373E1720AlternateDataStreams: C:\ProgramData\TEMP:DFC5A2B2HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\QQPCRTP => ""="service"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\QQPCRTP => ""="service"Tcpip\..\Interfaces\{1681BAF4-FD59-41CD-A6E4-AE82C842F26D}: [NameServer] 5.135.12.56,199.203.35.78CMD: ipconfig /flushdnsCMD: netsh winsock reset allCMD: netsh int ipv4 resetCMD: netsh int ipv6 resetEmptyTemp:end

• Click File, Save As and type fixlist.txt as the File Name. 
• Important: The file must be saved in the same location as FRST64.exe. 

NOTICE: This script is intended for use on this particular machine. Do not use this script on any other machine; doing so may cause damage to your Operating System.

• Right-Click FRST64.exe and select  Run as administrator to run the programme.
• Click Fix.
• A log (Fixlog.txt) will open on your desktop. Copy the contents of the log and paste in your next reply.
   

STEP 3
 Farbar Recovery Scan Tool (FRST) Scan

• Right-Click FRST64.exe and select  Run as administrator to run the programme.
• Click Yes to the disclaimer.
• Ensure the Addition.txt box is checked.
• Click the Scan button and let the programme run.
• Upon completion, click OK, then OK on the Addition.txt pop up screen.
• Two logs (FRST.txt & Addition.txt) will now be open on your Desktop. Attach both files in your next reply. 
   

======================================================
 
STEP 4
 Logs
In your next reply please include the following logs. Please be sure to copy and paste the requested logs, as well as provide information on any questions I may have asked.

• Did the programme uninstall OK?
• Fixlog.txt
• FRST.txt (attached)
• Addition.txt (attached)
• How is your computer performing?

[sherri_zhu]

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 21-10-2014

Ran by Sherri at 2014-10-21 23:59:55 Run:1

Running from C:\Users\Sherri\Desktop

Loaded Profile: Sherri (Available profiles: Sherri)

Boot Mode: Normal

==============================================

 

Content of fixlist:

*****************

start

ProxyEnable: Internet Explorer proxy is enabled.

ProxyServer: http=127.0.0.1:28973

() C:\Windows\SysWOW64\DirectXJREScreenshot\DirectXJREScreenshot.exe

R2 DirectXJREScreenshot; C:\windows\SysWOW64\DirectXJREScreenshot\DirectXJREScreenshot.exe [60453 2014-10-07] () [File not signed]

2014-10-07 10:23 - 2014-10-07 10:23 - 00000000 ____D () C:\windows\SysWOW64\DirectXJREScreenshot

2014-10-07 10:23 - 2014-10-07 10:23 - 00060453 _____ () C:\windows\SysWOW64\DirectXJREScreenshot\DirectXJREScreenshot.exe

HKLM\...\Run: [] => [X]

HKU\S-1-5-21-429594294-1317963213-1840044107-1001\...\MountPoints2: {5dbf5758-ec13-11e1-93b3-00266cd61d58} - E:\Setup.exe

HKU\S-1-5-21-429594294-1317963213-1840044107-1001\...\MountPoints2: {7a6537e1-3ff2-11e3-aedb-00266cd61d58} - E:\Setup.exe

HKU\S-1-5-21-429594294-1317963213-1840044107-1001\...\MountPoints2: {e5f869f5-ddd0-11e1-9444-00266cd61d58} - E:\Setup.exe

Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File

Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File

Toolbar: HKCU - No Name - {65F8A3D2-4C22-4A33-9633-73167EAEEC45} -  No File

Handler: KuGoo - {6AC4FBC7-AA38-45EC-9634-D6D20B679EFC} -  No File

Handler: KuGoo3 - {6AC4FBC7-AA38-45EC-9634-D6D20B679EFC} -  No File

URLSearchHook: HKCU - (No Name) - {472734EA-242A-422b-ADF8-83D1E48CC825} - No File

BHO-x32: C32C32B7-A92F-CC44-5B46-1E8538F7BBFC Class -> {C32C32B7-A92F-CC44-5B46-1E8538F7BBFC} -> C:\Program Files (x86)\QvodPlayer\AddIn\{C32C32B7-A92F-CC44-5B46-1E8538F7BBFC}\QvodAddr.dll No File

C:\Program Files (x86)\QvodPlayer

FF DefaultSearchEngine: Yahoo! (SD)

FF SelectedSearchEngine: Yahoo! (SD)

FF Plugin: @qvod.com/QvodShare -> C:\Program Files (x86)\QvodPlayer\npShareModule_x64.dll No File

FF Plugin-x32: @qq.com/npAndroidAssistant -> C:\Program Files (x86)\Common Files\Tencent\QQPhoneManager\2.0.201.3180\npQQPhoneManagerExt.dll No File

FF Plugin-x32: @qq.com/npchrome -> C:\Program Files (x86)\Common Files\Tencent\Npchrome\npchrome.dll No File

FF Plugin-x32: @qq.com/npqscall -> C:\Program Files (x86)\Common Files\Tencent\NPQSCALL\npqscall.dll No File

FF Plugin-x32: @qq.com/npqscall,version=1.0.0 -> %commonprogramfiles%\tencent\NPQSCALL\npqscall.dll No File

FF Plugin-x32: @qq.com/QQPhotoDrawEx -> C:\Program Files (x86)\Tencent\Qzone\npQQPhotoDrawEx.dll No File

FF Plugin-x32: @qq.com/QzoneMusic -> C:\Program Files (x86)\Tencent\QQMusic\npQzoneMusic.dll No File

FF SearchPlugin: C:\Users\Sherri\AppData\Roaming\Mozilla\Firefox\Profiles\f8676dxc.default\searchplugins\yahoo-sd.xml

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npfetion.dll ( )

S1 QMUdisk; \??\C:\Program Files (x86)\Tencent\QQPCMgr\10.1.15257.227\QMUdisk64.sys [X]

C:\Users\Sherri\mediaenchx32.dll

C:\Users\Sherri\mediaenchx321.dll

C:\Users\Sherri\mediaenchx322.dll

C:\Users\Sherri\mediaenchx323.dll

C:\Users\Sherri\webphonecfgb.dat

2014-10-10 00:08 - 2012-06-05 01:37 - 00000000 ____D () C:\Users\Sherri\Documents\Tencent Files

AlternateDataStreams: C:\ProgramData\TEMP:373E1720

AlternateDataStreams: C:\ProgramData\TEMP:DFC5A2B2

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\QQPCRTP => ""="service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\QQPCRTP => ""="service"

Tcpip\..\Interfaces\{1681BAF4-FD59-41CD-A6E4-AE82C842F26D}: [NameServer] 5.135.12.56,199.203.35.78

CMD: ipconfig /flushdns

CMD: netsh winsock reset all

CMD: netsh int ipv4 reset

CMD: netsh int ipv6 reset

EmptyTemp:

end

*****************

 

HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable => value deleted successfully.

HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer => value deleted successfully.

[3404] C:\Windows\SysWOW64\DirectXJREScreenshot\DirectXJREScreenshot.exe => Process closed successfully.

DirectXJREScreenshot => Unable to stop service

DirectXJREScreenshot => Service deleted successfully.

C:\windows\SysWOW64\DirectXJREScreenshot => Moved successfully.

"C:\windows\SysWOW64\DirectXJREScreenshot\DirectXJREScreenshot.exe" => File/Directory not found.

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\ => value deleted successfully.

"HKU\S-1-5-21-429594294-1317963213-1840044107-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5dbf5758-ec13-11e1-93b3-00266cd61d58}" => Key deleted successfully.

"HKCR\CLSID\{5dbf5758-ec13-11e1-93b3-00266cd61d58}" => Key not found.

"HKU\S-1-5-21-429594294-1317963213-1840044107-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7a6537e1-3ff2-11e3-aedb-00266cd61d58}" => Key deleted successfully.

"HKCR\CLSID\{7a6537e1-3ff2-11e3-aedb-00266cd61d58}" => Key not found.

"HKU\S-1-5-21-429594294-1317963213-1840044107-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e5f869f5-ddd0-11e1-9444-00266cd61d58}" => Key deleted successfully.

"HKCR\CLSID\{e5f869f5-ddd0-11e1-9444-00266cd61d58}" => Key not found.

HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} => value deleted successfully.

"HKCR\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}" => Key not found.

HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} => value deleted successfully.

"HKCR\CLSID\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}" => Key not found.

HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{65F8A3D2-4C22-4A33-9633-73167EAEEC45} => value deleted successfully.

"HKCR\CLSID\{65F8A3D2-4C22-4A33-9633-73167EAEEC45}" => Key not found.

"HKCR\PROTOCOLS\Handler\KuGoo" => Key deleted successfully.

"HKCR\CLSID\{6AC4FBC7-AA38-45EC-9634-D6D20B679EFC}" => Key not found.

"HKCR\PROTOCOLS\Handler\KuGoo3" => Key deleted successfully.

"HKCR\CLSID\{6AC4FBC7-AA38-45EC-9634-D6D20B679EFC}" => Key not found.

HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\\{472734EA-242A-422b-ADF8-83D1E48CC825} => value deleted successfully.

"HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C32C32B7-A92F-CC44-5B46-1E8538F7BBFC}" => Key deleted successfully.

"HKCR\Wow6432Node\CLSID\{C32C32B7-A92F-CC44-5B46-1E8538F7BBFC}" => Key deleted successfully.

"C:\Program Files (x86)\QvodPlayer" => File/Directory not found.

Firefox DefaultSearchEngine deleted successfully.

Firefox SelectedSearchEngine deleted successfully.

"HKLM\Software\MozillaPlugins\@qvod.com/QvodShare" => Key deleted successfully.

"HKLM\Software\Wow6432Node\MozillaPlugins\@qq.com/npAndroidAssistant" => Key deleted successfully.

"HKLM\Software\Wow6432Node\MozillaPlugins\@qq.com/npchrome" => Key deleted successfully.

"HKLM\Software\Wow6432Node\MozillaPlugins\@qq.com/npqscall" => Key deleted successfully.

"HKLM\Software\Wow6432Node\MozillaPlugins\@qq.com/npqscall,version=1.0.0" => Key deleted successfully.

"HKLM\Software\Wow6432Node\MozillaPlugins\@qq.com/QQPhotoDrawEx" => Key deleted successfully.

"HKLM\Software\Wow6432Node\MozillaPlugins\@qq.com/QzoneMusic" => Key deleted successfully.

C:\Users\Sherri\AppData\Roaming\Mozilla\Firefox\Profiles\f8676dxc.default\searchplugins\yahoo-sd.xml => Moved successfully.

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npfetion.dll ( ) => Error: No automatic fix found for this entry.

QMUdisk => Service deleted successfully.

C:\Users\Sherri\mediaenchx32.dll => Moved successfully.

C:\Users\Sherri\mediaenchx321.dll => Moved successfully.

C:\Users\Sherri\mediaenchx322.dll => Moved successfully.

C:\Users\Sherri\mediaenchx323.dll => Moved successfully.

C:\Users\Sherri\webphonecfgb.dat => Moved successfully.

C:\Users\Sherri\Documents\Tencent Files => Moved successfully.

C:\ProgramData\TEMP => ":373E1720" ADS removed successfully.

C:\ProgramData\TEMP => ":DFC5A2B2" ADS removed successfully.

"HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\QQPCRTP" => Key deleted successfully.

"HKLM\System\CurrentControlSet\Control\SafeBoot\Network\QQPCRTP" => Key deleted successfully.

HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{1681BAF4-FD59-41CD-A6E4-AE82C842F26D}\\NameServer => value deleted successfully.

 

=========  ipconfig /flushdns =========

 

 

Windows IP Configuration

 

Successfully flushed the DNS Resolver Cache.

 

========= End of CMD: =========

 

 

=========  netsh winsock reset all =========

 

 

Sucessfully reset the Winsock Catalog.

You must restart the computer in order to complete the reset.

 

 

========= End of CMD: =========

 

 

=========  netsh int ipv4 reset =========

 

Reseting Global, OK!

Reseting Interface, OK!

Restart the computer to complete this action.

 

 

========= End of CMD: =========

 

 

=========  netsh int ipv6 reset =========

 

Reseting Interface, OK!

Restart the computer to complete this action.

 

 

========= End of CMD: =========

 

EmptyTemp: => Removed 209.5 MB temporary data.

 

 

The system needed a reboot. 

 

==== End of Fixlog ====

[sherri_zhu]

Hi Adam,

 

I've found that "cdncache-a akamaihd" is still here which automatically opens ad websites under new tabs, and that "dynamic pricer" is replaced by "eDealsPop" and "Suggested Deals" to show pop-up ads.

 

An unusual thing happened -- my Gmail was unable to access Contacts.

 

Thank you so much for your continued help!

 

Best,

Sherri

 

Addition.txt

FRST.txt

[sherri_zhu]

Adam, I forgot to tell you that the program uninstalled okay.

[LiquidTension]

Hi Sherri,

Which browser do you experience these issues with? Do you experience the same issues using a different browser?

[sherri_zhu]

I'm using Chrome. Yes, I was experiencing the same issues with IE and Firefox.

[sherri_zhu]

Oh, the Gmail is able to access Contacts now.

[sherri_zhu]

I just tried IE again. When the ad websites opened up, Malwarebytes Anti-Malware showed a message noticing me about the website. I clicked on "Exclude the Website" and now it's been blocked!  But it didn't block it on Chrome. 

[LiquidTension]

Hi Sherri, 
 

Exclude the Website

By doing this, Malwarebytes will now no longer block the website. 

Open Malwarebytes > Settings > Web Exclusions > Remove the website. 

 

----------
 
Please uninstall the following programme: WinZip Malware Protector.
 
STEP 1
 Farbar Recovery Scan Tool (FRST) Script

• Press the Windows Key + r on your keyboard at the same time. Type Notepad and click OK.
• Copy the entire contents of the codebox below and paste into the Notepad document.
  

  start() C:\Users\Sherri\AppData\Local\FileLogSyntax\FileLogSyntax.exe() C:\Users\Sherri\AppData\Local\FileLogSyntax\GNURepositoryTask.exeProxyEnable: Internet Explorer proxy is enabled.ProxyServer: http=127.0.0.1:21930R2 FileLogSyntax.exe; C:\Users\Sherri\AppData\Local\FileLogSyntax\FileLogSyntax.exe [129061 2014-10-07] () [File not signed]2014-10-07 10:23 - 2014-10-07 11:28 - 00000000 ____D () C:\Users\Sherri\AppData\Local\FileLogSyntaxFolder: C:\Users\Sherri\AppData\OICE_15_974FA576_32C1D314_33A6Folder: C:\Users\Sherri\AppData\OICE_15_974FA576_32C1D314_1CABFolder: C:\Users\Sherri\AppData\OICE_15_974FA576_32C1D314_1EFCFolder: C:\Users\Sherri\AppData\OICE_15_974FA576_32C1D314_9BCFolder: C:\Users\Sherri\AppData\OICE_15_974FA576_32C1D314_335CFolder: C:\Users\Sherri\AppData\OICE_15_974FA576_32C1D314_279ACMD: ipconfig /flushdnsEmptyTemp:end

• Click File, Save As and type fixlist.txt as the File Name. 
• Important: The file must be saved in the same location as FRST64.exe. 

NOTICE: This script is intended for use on this particular machine. Do not use this script on any other machine; doing so may cause damage to your Operating System.

• Right-Click FRST64.exe and select  Run as administrator to run the programme.
• Click Fix.
• A log (Fixlog.txt) will open on your desktop. Copy the contents of the log and paste in your next reply.
   

STEP 2
 Browser Reset
 
Instructions on how to backup your Favourites/Bookmarks and other data can be found below.

•  Backup Internet Explorer Favourites
•  Backup Firefox Bookmarks
•  Backup Chrome Bookmarks

Proceed with the reset once done.

•  Internet Explorer: How to reset Internet Explorer settings
•  Firefox: Reset Firefox
•  Chrome: Chrome - Reset browser settings
   

STEP 3
 Folder Options 

• Press the Windows Key + r on your keyboard at the same time. Type Control Folders and click OK.
• Click View. Under Hidden files and folders: 
• Place a checkmark next to Show hidden files, folders and drives.
• Remove the checkmark next to Hide extensions for known file types.
• Remove the checkmark next to Hide protected operating system Files (Recommended).
• Click Apply followed by OK.
   

STEP 4
 VirusTotal Upload

• Please go to VirusTotal.com.
• Click Choose File and locate the following file:
  • C:\Users\Sherri\AppData\Roaming\WB.CFG
• ​Click Scan it!.
• If you receive the following notification: File already analysed click Reanalyse.
• Once the file has been analyzed, copy the page URL at the top of the window and paste in your next reply. 
   

======================================================
 
STEP 5
 Logs
In your next reply please include the following logs. Please be sure to copy and paste the requested logs, as well as provide information on any questions I may have asked.

• Did the programme uninstall OK?
• Fixlog.txt
• Did your browsers reset OK?
• VirusTotal Results

[sherri_zhu]

When I closed the IE tab which shows that Malwarebytes blocked the malicious website, "cdncache-a akamaihd" and pop-up ads came back again.

[LiquidTension]

Please proceed with my instructions above.

[sherri_zhu]

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 21-10-2014

Ran by Sherri at 2014-10-22 01:39:41 Run:2

Running from C:\Users\Sherri\Desktop

Loaded Profile: Sherri (Available profiles: Sherri)

Boot Mode: Normal

==============================================

 

Content of fixlist:

*****************

start

ProxyEnable: Internet Explorer proxy is enabled.

ProxyServer: http=127.0.0.1:21930

Folder: C:\Users\Sherri\AppData\OICE_15_974FA576_32C1D314_33A6

Folder: C:\Users\Sherri\AppData\OICE_15_974FA576_32C1D314_1CAB

Folder: C:\Users\Sherri\AppData\OICE_15_974FA576_32C1D314_1EFC

Folder: C:\Users\Sherri\AppData\OICE_15_974FA576_32C1D314_9BC

Folder: C:\Users\Sherri\AppData\OICE_15_974FA576_32C1D314_335C

Folder: C:\Users\Sherri\AppData\OICE_15_974FA576_32C1D314_279A

CMD: ipconfig /flushdns

EmptyTemp:

end

*****************

 

HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable => value deleted successfully.

HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer => value deleted successfully.

 

========================= Folder: C:\Users\Sherri\AppData\OICE_15_974FA576_32C1D314_33A6 ========================

 

 

====== End of Folder: ======

 

 

========================= Folder: C:\Users\Sherri\AppData\OICE_15_974FA576_32C1D314_1CAB ========================

 

2012-10-21 00:13 - 2012-10-21 00:13 - 0017341 ___RT () C:\Users\Sherri\AppData\OICE_15_974FA576_32C1D314_1CAB\586CD7EE.docx

2012-10-21 00:13 - 2012-10-21 00:13 - 0000000 _____ () C:\Users\Sherri\AppData\OICE_15_974FA576_32C1D314_1CAB\winword.exe_c2rdll(20121021001308544).log

 

====== End of Folder: ======

 

 

========================= Folder: C:\Users\Sherri\AppData\OICE_15_974FA576_32C1D314_1EFC ========================

 

2012-10-08 14:35 - 2012-10-08 14:35 - 0039936 ___RT () C:\Users\Sherri\AppData\OICE_15_974FA576_32C1D314_1EFC\C07745E7.doc

 

====== End of Folder: ======

 

 

========================= Folder: C:\Users\Sherri\AppData\OICE_15_974FA576_32C1D314_9BC ========================

 

2012-10-08 14:21 - 2012-10-08 14:21 - 0039936 ___RT () C:\Users\Sherri\AppData\OICE_15_974FA576_32C1D314_9BC\9BEEF36A.doc

 

====== End of Folder: ======

 

 

========================= Folder: C:\Users\Sherri\AppData\OICE_15_974FA576_32C1D314_335C ========================

 

2012-10-08 14:06 - 2012-10-08 14:06 - 0039936 ___RT () C:\Users\Sherri\AppData\OICE_15_974FA576_32C1D314_335C\E759A85F.doc

 

====== End of Folder: ======

 

 

========================= Folder: C:\Users\Sherri\AppData\OICE_15_974FA576_32C1D314_279A ========================

 

2012-10-08 14:06 - 2012-10-08 14:06 - 0039936 ___RT () C:\Users\Sherri\AppData\OICE_15_974FA576_32C1D314_279A\49F00271.doc

 

====== End of Folder: ======

 

 

=========  ipconfig /flushdns =========

 

 

Windows IP Configuration

 

Successfully flushed the DNS Resolver Cache.

 

========= End of CMD: =========

 

EmptyTemp: => Removed 68.9 MB temporary data.

 

 

The system needed a reboot. 

 

==== End of Fixlog ====