Badfinger Posted May 20, 2015 ID:963966 Share Posted May 20, 2015 I purchased this product because I started getting frequent page popups, which continued even after scanning with Norton, which I have used happily for a few years. One in particular is app.pckeeper.com, however there are a few others and they open quite frequently from what seems like just about any page. When I first purchased the product a few weeks ago it detected many problems which I removed. Since then, despite being run at least daily, it has only detected issues on two occasions that I can recall. And while the page popups seemed to stop for a while, they are back in full force. I purchased the premium version of this product to get rid of these things, but it does not seem to be helping. At this point, not really sure what I paid for. And yes, it is updated at least daily. By the way, I followed the directions I received in my initial post. I went to the "Available assitance" page, which directed me to the "I'm infected what do I do now" page. As per the instructions, I attempted to download the Farbar Recovery Scan Tool. However, my Norton detected a virus within the download. I noticed the post was from more than six years ago and has not been updated, so maybe someone should take a look at that. Please help, thanks. Link to post Share on other sites More sharing options...
kevinf80 Posted May 20, 2015 ID:963968 Share Posted May 20, 2015 Hello and welcome to Malwarebytes.org P2P/Piracy Warning: If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall them or completely disable them from running while being assisted here. Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.If you have illegal/cracked software, cracks, keygens etc. on the system, please remove or uninstall them now and read the policy on Piracy. Next, Change the download folder setting in the default Browser so all tools we may use are saved to the Desktop: Google Chrome - Click the "Customize and control Google Chrome" button in the upper right-corner of the browser. Choose Settings. at the bottom of the screen click the"Show advanced settings..." link. Scroll down to find the Downloads section and click the Change... button. Select your desktop and click OK. Mozilla Firefox - Click the "Open Menu" button in the upper right-corner of the browser. Choose Options. In the downloads section, click the Browse button, click on the Desktop folder and the click the "Select Folder" button. Click OK to get out of the Options menu. Internet Explorer - Click the Tools menu in the upper right-corner of the browser. Select View downloads. Select the Options link in the lower left of the window. Click Browse and select the Desktop and then choose the Select Folder button. Click OK to get out of the download options screen and then click Close to get out of the View Downloads screen.NOTE: IE8 Does not support changing download locations in this manner. You will need to download the tool(s) to the default folder, usually Downloads, then copy them to the desktop. Next, Follow the instructions in the following link to show hidden files: http://www.bleepingcomputer.com/tutorials/how-to-see-hidden-files-in-windows/ Next, Please open Malwarebytes Anti-Malware. On the Settings tab > Detection and Protection sub tab, Detection Options, tick the box "Scan for rootkits". Under Non-Malware Protection sub tab Change PUP and PUM entries to Treat detections as Malware Click on the Scan tab, then click on Scan Now >> . If an update is available, click the Update Now button. A Threat Scan will begin. With some infections, you may or may not see this message box. 'Could not load DDA driver' Click 'Yes' to this message, to allow the driver to load after a restart. Allow the computer to restart. Continue with the rest of these instructions. When the scan is complete, click Apply Actions. Wait for the prompt to restart the computer to appear, then click on Yes. After the restart once you are back at your desktop, open MBAM once more. To get the log from Malwarebytes do the following: Click on the History tab > Application Logs. Double click on the scan log which shows the Date and time of the scan just performed. Click Export > From export you have three options: Copy to Clipboard - if seleted right click to your reply and select "Paste" log will be pasted to your reply Text file (*.txt) - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply XML file (*.xml) - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply Recommend you use "Copy to Clipboard, then Right click to your reply > select "Paste" that will copy the log to your reply… If Malwarebytes is not installed follow these instructions first: Download Malwarebytes Anti-Malware to your desktop.Double-click mbam-setup and follow the prompts to install the program.At the end, be sure a checkmark is placed next to the following: Launch Malwarebytes Anti-MalwareA 14 day trial of the Premium features is pre-selected. You may deselect this if you wish, and it will not diminish the scanning and removal capabilities of the program.Click Finish. Follow the instructions above.... Next, Download Farbar Recovery Scan Tool and save it to your desktop. Note: You need to run the version compatible with your system (32 bit or 64 bit). If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version. If your security alerts to FRST either accept the alert or disable your security and allow FRST to run... Double-click to run it. When the tool opens click Yes to disclaimer.Press Scan button.It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply. Let me see those logs in your reply.... Thank you, Kevin... Link to post Share on other sites More sharing options...
Badfinger Posted May 26, 2015 Author ID:965159 Share Posted May 26, 2015 Okay, I've followed the instructions. Really hope you can help me, as these page popups are driving me nuts. As requested, logs are attached: Malwarebytes Anti-Malwarewww.malwarebytes.orgScan Date: 5/26/15Scan Time: 4:25:52 AMLogfile: scan may26.txtAdministrator: YesVersion: 2.01.6.1022Malware Database: v2015.05.26.01Rootkit Database: v2015.05.24.01License: PremiumMalware Protection: EnabledMalicious Website Protection: EnabledSelf-protection: DisabledOS: Windows 7 Service Pack 1CPU: x64File System: NTFSUser: JoeScan Type: Threat ScanResult: CompletedObjects Scanned: 367007Time Elapsed: 15 min, 6 secMemory: EnabledStartup: EnabledFilesystem: EnabledArchives: EnabledRootkits: EnabledHeuristics: EnabledPUP: EnabledPUM: EnabledProcesses: 0(No malicious items detected)Modules: 0(No malicious items detected)Registry Keys: 0(No malicious items detected)Registry Values: 0(No malicious items detected)Registry Data: 0(No malicious items detected)Folders: 0(No malicious items detected)Files: 0(No malicious items detected)Physical Sectors: 0(No malicious items detected)(end) Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 25-05-2015Ran by Joe (administrator) on JOE-PC on 26-05-2015 04:47:21Running from C:\Users\Joe\DesktopLoaded Profiles: Joe (Available Profiles: Joe)Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: English (United States)Internet Explorer Version 11 (Default browser: FF)Boot Mode: NormalTutorial for Farbar Recovery Scan Tool: http://www.FlashGet.com)FreeTorrentViewer (HKLM-x32\...\FreeTorrentViewer) (Version: 1.0.0.1 - Free Torrent Viewer)GoldWave v4.26 (HKLM-x32\...\GoldWave v4.26) (Version: - )Intel® Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)Intel® Desktop Utilities (HKLM-x32\...\{F01CBA59-B5BD-4608-A834-1CBE8C292A71}) (Version: 1.0.0 - Intel Corporation)Intel® Integrator Assistant (HKLM-x32\...\{D1A35687-AEA9-422C-B237-FC4F8136B6F6}) (Version: 1.0.0 - Intel Corporation)Intel® Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 7.0.0.1118 - Intel Corporation)Intel® Network Connections 15.6.25.0 (HKLM\...\PROSetDX) (Version: 15.6.25.0 - Intel)Intel® Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2219 - Intel Corporation)Intel® Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 10.0.0.1046 - Intel Corporation)Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) HiddenMacromedia Dreamweaver MX 2004 (HKLM-x32\...\{05BB2EC5-6BEF-4DDC-9E75-BEE7B161157A}) (Version: 7.0.1 - Macromedia)Macromedia Extension Manager (HKLM-x32\...\{A5BA14E0-7384-11D4-BAE7-00409631A2C8}) (Version: 1.5 - Macromedia)Malwarebytes Anti-Malware version 2.1.6.1022 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.6.1022 - Malwarebytes Corporation)Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)Microsoft Office Professional Plus 2010 (HKLM-x32\...\Office14.PROPLUSR) (Version: 14.0.7015.1000 - Microsoft Corporation)Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)Mozilla Firefox 38.0.1 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 38.0.1 (x86 en-US)) (Version: 38.0.1 - Mozilla)Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)MSXML 4.0 SP2 Parser and SDK (HKLM-x32\...\{716E0306-8318-4364-8B8F-0CC4E9376BAC}) (Version: 4.20.9818.0 - Microsoft Corporation)Norton 360 (HKLM-x32\...\N360) (Version: 21.7.0.11 - Symantec Corporation)PC Drummer Pro 5.07 (HKLM-x32\...\PC_Drummer_Pro_500) (Version: - )Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6215 - Realtek Semiconductor Corp.)Renesas Electronics USB 3.0 Host Controller Driver (HKLM-x32\...\InstallShield_{5442DAB8-7177-49E1-8B22-09A049EA5996}) (Version: 2.0.4.0 - Renesas Electronics Corporation)Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 2.0.4.0 - Renesas Electronics Corporation) HiddenService Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)VLC media player 2.1.3 (HKLM-x32\...\VLC media player) (Version: 2.1.3 - VideoLAN)Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3555.0308 - Microsoft Corporation)WinRAR 4.10 beta 2 (64-bit) (HKLM\...\WinRAR archiver) (Version: 4.10.2 - win.rar GmbH)Xvid Video Codec (HKLM-x32\...\Xvid Video Codec 1.3.2) (Version: 1.3.2 - Xvid Team)==================== Custom CLSID (Whitelisted): ==========================(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)==================== Restore Points =========================15-04-2015 21:51:25 Windows Update19-04-2015 14:25:27 before norton powerscan26-04-2015 18:05:45 Scheduled Checkpoint04-05-2015 00:09:55 Scheduled Checkpoint11-05-2015 20:48:19 Scheduled Checkpoint12-05-2015 23:00:36 Windows Update20-05-2015 00:00:04 Scheduled Checkpoint==================== Hosts content: ===============================(If needed Hosts: directive could be included in the fixlist to reset Hosts.)2009-07-13 23:34 - 2014-10-02 07:46 - 00000872 ____A C:\Windows\system32\Drivers\etc\hosts54.225.95.126 fhajokkdlhllmgenmniigcnlefjakobn==================== Scheduled Tasks (Whitelisted) =============(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)Task: {1EED4447-37B5-4070-94CB-BC09E6693D8A} - System32\Tasks\Norton WSC Integration => C:\Program Files (x86)\Norton 360\Engine\21.7.0.11\WSCStub.exe [2015-03-07] (Symantec Corporation)Task: {29DFFE8D-F562-4C27-8105-53E04CF93162} - System32\Tasks\Norton 360\Norton Error Processor => C:\Program Files (x86)\Norton 360\Engine\21.7.0.11\SymErr.exe [2014-01-30] (Symantec Corporation)Task: {7E2CD679-F292-4ECC-A797-5516D872812D} - System32\Tasks\{B27DA392-5589-48D1-8F42-DE33EA832063} => C:\Program Files (x86)\Macromedia\Dreamweaver MX 2004\Dreamweaver.exe [2004-03-02] (Macromedia, Inc.)Task: {8F91BC65-32DA-4F06-9521-97619E6A879C} - System32\Tasks\Norton 360\Norton Error Analyzer => C:\Program Files (x86)\Norton 360\Engine\21.7.0.11\SymErr.exe [2014-01-30] (Symantec Corporation)Task: {9130206E-A49D-4101-80D4-6D834BC598DE} - System32\Tasks\{7A8D4561-F3FA-4C60-9EA2-D41FB95C1380} => C:\Program Files (x86)\Macromedia\Dreamweaver MX 2004\Dreamweaver.exe [2004-03-02] (Macromedia, Inc.)Task: {A546135C-547F-43F2-B249-3D75243D3960} - System32\Tasks\{0691978E-8660-42BF-BE9D-E4CFADDC635F} => pcalua.exe -a C:\Users\Joe\Documents\MiscAPPS\IGrab.exe -d C:\Users\Joe\Documents\MiscAPPSTask: {BC54E958-2090-423E-A27F-1274EFB468D8} - System32\Tasks\0752ae01-0d82-4270-ab5c-cb57c42caca7 => C:\Program Files (x86)\TheTorntv V10\0752ae01-0d82-4270-ab5c-cb57c42caca7.exe <==== ATTENTIONTask: {BED2D55E-DFC3-4FD6-89DB-813650052A2E} - System32\Tasks\{C7433BA3-F07C-4FD3-BCD0-2B6462B9A338} => C:\Program Files (x86)\GoldWave\GoldWave.exe [2002-03-28] ()Task: {C69C19AF-DED0-4C9D-AB7F-F4464F8DA8EF} - System32\Tasks\{4ACC8B48-B444-418A-9D35-1F03B1153A7A} => C:\Program Files (x86)\Macromedia\Dreamweaver MX 2004\Dreamweaver.exe [2004-03-02] (Macromedia, Inc.)Task: {C918A116-0E83-41F3-A24F-78C878D8352B} - System32\Tasks\{E5A27FA1-DF32-4C39-B36C-29D0211A1F72} => C:\Program Files (x86)\Macromedia\Dreamweaver MX 2004\Dreamweaver.exe [2004-03-02] (Macromedia, Inc.)Task: {CE4A147D-6974-4E7B-B9E6-0B1E206650E0} - System32\Tasks\ef4a13d7-64f2-43b7-ae75-86a796c2d8c6 => C:\Program Files (x86)\TheTorntv V10\ef4a13d7-64f2-43b7-ae75-86a796c2d8c6.exe <==== ATTENTIONTask: {DF9B480C-DE78-47CE-84CE-3D434939B693} - System32\Tasks\{66296750-6AAE-409F-A42E-C3E9D30BB221} => C:\Program Files (x86)\Macromedia\Dreamweaver MX 2004\Dreamweaver.exe [2004-03-02] (Macromedia, Inc.)Task: {F1E863FF-87C9-4C35-BB42-46FF2E382D12} - System32\Tasks\{DF48C4F5-46BF-43AC-B181-49D7D65543C6} => C:\Program Files (x86)\Macromedia\Dreamweaver MX 2004\Dreamweaver.exe [2004-03-02] (Macromedia, Inc.)Task: C:\Windows\Tasks\0752ae01-0d82-4270-ab5c-cb57c42caca7.job => C:\Program Files (x86)\TheTorntv V10\0752ae01-0d82-4270-ab5c-cb57c42caca7.exe <==== ATTENTIONTask: C:\Windows\Tasks\ef4a13d7-64f2-43b7-ae75-86a796c2d8c6.job => C:\Program Files (x86)\TheTorntv V10\ef4a13d7-64f2-43b7-ae75-86a796c2d8c6.exeï/agentregpath='TheTorntv V10' /appid=63311 /srcid='001823' /subid='0' /zdata='0' /bic=4C6B9D8620814383849E703C059600A1IE /verifier=14a25080759a6038c8cf1df891dc95f9 /installerversion=1_35_09_29 /installationtime=1412246598 /statsdomain=http:/stats.newdatastatsserv.com /errorsdomain=http:/errors.newdatastatsserv.com /extensionname='Information' /torpedoiesleeps=1000 /torpedoieplugins=93-0,102-0,104-0,184-0 /monetizationdomain=http:/logs.newdatastatsserv.com <==== ATTENTION==================== Loaded Modules (Whitelisted) ==============2013-09-05 01:17 - 2013-09-05 01:17 - 04300456 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF2010-10-20 15:23 - 2010-10-20 15:23 - 08801632 _____ () C:\Program Files\Microsoft Office\Office14\1033\GrooveIntlResource.dll2011-10-22 00:12 - 2011-10-20 12:47 - 00193536 _____ () C:\Program Files\WinRAR\rarext.dll2010-01-22 16:56 - 2010-01-22 23:20 - 01033938 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ESET-phase2.exe2013-09-05 01:14 - 2013-09-05 01:14 - 04300456 _____ () C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF2010-10-20 15:45 - 2010-10-20 15:45 - 08801120 _____ () C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveIntlResource.dll2014-10-16 23:39 - 2014-10-16 23:39 - 00169472 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\ba8588c3319d63350220ec2ac3eb2c36\IsdiInterop.ni.dll2011-10-17 09:20 - 2010-09-13 18:28 - 00058880 _____ () C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IsdiInterop.dll2015-03-16 16:36 - 2015-03-16 16:36 - 16858288 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_134.dll==================== Alternate Data Streams (Whitelisted) =========(If an entry is included in the fixlist, only the ADS will be removed.)AlternateDataStreams: C:\Users\Joe\Documents\Bill's Grandchildren October 2010 b.eml:OECustomPropertyAlternateDataStreams: C:\Users\Joe\Documents\Bill's Grandchildren October 2010.eml:OECustomPropertyAlternateDataStreams: C:\Users\Joe\Documents\Brenda Best Update.eml:OECustomPropertyAlternateDataStreams: C:\Users\Joe\Documents\chinese torture.eml:OECustomPropertyAlternateDataStreams: C:\Users\Joe\Documents\Dark and Stormy Night Contest.eml:OECustomPropertyAlternateDataStreams: C:\Users\Joe\Documents\Dead President's Society.eml:OECustomPropertyAlternateDataStreams: C:\Users\Joe\Documents\Dutch Mason article.eml:OECustomPropertyAlternateDataStreams: C:\Users\Joe\Documents\fishing.eml:OECustomPropertyAlternateDataStreams: C:\Users\Joe\Documents\GerryG'sWebsite.eml:OECustomPropertyAlternateDataStreams: C:\Users\Joe\Documents\HELP PUBLICATIONS.eml:OECustomPropertyAlternateDataStreams: C:\Users\Joe\Documents\Household tips.eml:OECustomPropertyAlternateDataStreams: C:\Users\Joe\Documents\If I Knew....eml:OECustomPropertyAlternateDataStreams: C:\Users\Joe\Documents\important notice re e-mail from NBTEL.eml:OECustomPropertyAlternateDataStreams: C:\Users\Joe\Documents\Interesting beer article.eml:OECustomPropertyAlternateDataStreams: C:\Users\Joe\Documents\It's a bird... it's a plane... it's..._!.eml:OECustomPropertyAlternateDataStreams: C:\Users\Joe\Documents\Mainly For Engineers ___.eml:OECustomPropertyAlternateDataStreams: C:\Users\Joe\Documents\McAfee Antivirus - HelpDesk Call number 5303.eml:OECustomPropertyAlternateDataStreams: C:\Users\Joe\Documents\Media players.eml:OECustomPropertyAlternateDataStreams: C:\Users\Joe\Documents\pedals.eml:OECustomPropertyAlternateDataStreams: C:\Users\Joe\Documents\Pick up Lines.eml:OECustomPropertyAlternateDataStreams: C:\Users\Joe\Documents\Quotation Bill Toner.eml:OECustomPropertyAlternateDataStreams: C:\Users\Joe\Documents\The Parrot.eml:OECustomPropertyAlternateDataStreams: C:\Users\Joe\Documents\The Puppy - Lets see if you send it back.eml:OECustomPropertyAlternateDataStreams: C:\Users\Joe\Documents\This is absolutely adorable.eml:OECustomPropertyAlternateDataStreams: C:\Users\Joe\Documents\TroubleTree.eml:OECustomPropertyAlternateDataStreams: C:\Users\Joe\Documents\Weaver's Party.eml:OECustomPropertyAlternateDataStreams: C:\Users\Joe\Documents\Welcome to NBTel Internet _ Bienvenue à NBTel Internet.eml:OECustomPropertyAlternateDataStreams: C:\Users\Joe\Documents\Will Rogers.eml:OECustomPropertyAlternateDataStreams: C:\Users\Joe\Documents\worst pickup lines in recorded history.eml:OECustomProperty==================== Safe Mode (Whitelisted) ===================(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)==================== EXE Association (Whitelisted) ===============(If an entry is included in the fixlist, the registry item will be restored to default or removed.)==================== Internet Explorer trusted/restricted ===============(If an entry is included in the fixlist, it will be removed from the registry.)==================== Other Areas ============================(Currently there is no automatic fix for this section.)HKU\S-1-5-21-4049380915-4051730379-3028906647-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Joe\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpgDNS Servers: 192.168.2.1==================== MSCONFIG/TASK MANAGER Error getting ==(Currently there is no automatic fix for this section.)==================== FirewallRules (Whitelisted) ===============(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)FirewallRules: [{8C687DA2-999F-4331-9847-57C263A25D0F}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exeFirewallRules: [{D023D53A-CBE2-499F-8852-4D5BFF6DF116}] => (Allow) LPort=2869FirewallRules: [{1CE9CE70-AFCB-4E9D-9449-B7FA3B4CB68C}] => (Allow) LPort=1900FirewallRules: [{A3F45B79-136E-4C8F-B5FB-7ED090A64DC8}] => (Allow) C:\Users\Joe\AppData\Local\Temp\7zS6375\hppiw.exeFirewallRules: [{A525BED5-D330-40AB-8C6A-3642D25C90FC}] => (Allow) C:\Users\Joe\AppData\Local\Temp\7zS6375\hppiw.exeFirewallRules: [{070BD13E-F64F-4846-92E2-F806530318A0}] => (Allow) C:\Program Files (x86)\Bench\Proxy\proc.exeFirewallRules: [{378EEDA5-1526-497F-91FB-E787F3F0C996}] => (Allow) C:\Program Files (x86)\Bench\Proxy\pwdg.exeFirewallRules: [TCP Query User{B5DBF85B-8AB2-4619-964E-E1B1B0826272}C:\program files (x86)\flashget network\flashget 3\flashget3.exe] => (Allow) C:\program files (x86)\flashget network\flashget 3\flashget3.exeFirewallRules: [uDP Query User{E1F09786-DC0A-4D58-9659-D32A5964D7E7}C:\program files (x86)\flashget network\flashget 3\flashget3.exe] => (Allow) C:\program files (x86)\flashget network\flashget 3\flashget3.exeFirewallRules: [{D7E2D932-1890-45C6-A1FC-0BA6DCA94A5A}] => (Block) C:\program files (x86)\flashget network\flashget 3\flashget3.exeFirewallRules: [{93654F40-42FF-445F-80D5-329869DAFBDC}] => (Block) C:\program files (x86)\flashget network\flashget 3\flashget3.exeFirewallRules: [{CF2DB165-95C9-4D72-895D-DC16579AA678}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exeFirewallRules: [{0649870C-486A-4B77-B228-2D004E00CC65}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exeStandardProfile\AuthorizedApplications: [C:\Program Files (x86)\FlashGet Network\FlashGet 3\FlashGet3.exe] => Enabled:Flashget3==================== Faulty Device Manager Devices ================================= Event log errors: =========================Application errors:==================Error: (05/25/2015 09:41:29 PM) (Source: WinMgmt) (EventID: 10) (User: )Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003Error: (05/25/2015 11:02:06 AM) (Source: Application Error) (EventID: 1000) (User: )Description: Faulting application name: plugin-container.exe, version: 38.0.1.5611, time stamp: 0x55541a90Faulting module name: mozalloc.dll, version: 38.0.1.5611, time stamp: 0x55540a1eException code: 0x80000003Fault offset: 0x00001aa1Faulting process id: 0x15a8Faulting application start time: 0xplugin-container.exe0Faulting application path: plugin-container.exe1Faulting module path: plugin-container.exe2Report Id: plugin-container.exe3Error: (05/25/2015 01:49:29 AM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )Description: 90080108Error: (05/24/2015 08:31:54 PM) (Source: WinMgmt) (EventID: 10) (User: )Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003Error: (05/24/2015 06:11:02 AM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )Description: 90080108Error: (05/23/2015 08:20:16 PM) (Source: WinMgmt) (EventID: 10) (User: )Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003Error: (05/22/2015 09:06:46 PM) (Source: WinMgmt) (EventID: 10) (User: )Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003Error: (05/22/2015 05:22:57 AM) (Source: Application Error) (EventID: 1000) (User: )Description: Faulting application name: plugin-container.exe, version: 38.0.1.5611, time stamp: 0x55541a90Faulting module name: mozalloc.dll, version: 38.0.1.5611, time stamp: 0x55540a1eException code: 0x80000003Fault offset: 0x00001aa1Faulting process id: 0xcccFaulting application start time: 0xplugin-container.exe0Faulting application path: plugin-container.exe1Faulting module path: plugin-container.exe2Report Id: plugin-container.exe3Error: (05/22/2015 01:10:46 AM) (Source: WinMgmt) (EventID: 10) (User: )Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003Error: (05/21/2015 02:49:26 AM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )Description: 90080108System errors:=============Error: (05/25/2015 09:43:22 PM) (Source: Service Control Manager) (EventID: 7000) (User: )Description: The globalUpdate Update Service (globalUpdate) service failed to start due to the following error:%%2Error: (05/24/2015 08:33:50 PM) (Source: Service Control Manager) (EventID: 7000) (User: )Description: The globalUpdate Update Service (globalUpdate) service failed to start due to the following error:%%2Error: (05/23/2015 08:22:11 PM) (Source: Service Control Manager) (EventID: 7000) (User: )Description: The globalUpdate Update Service (globalUpdate) service failed to start due to the following error:%%2Error: (05/22/2015 09:08:40 PM) (Source: Service Control Manager) (EventID: 7000) (User: )Description: The globalUpdate Update Service (globalUpdate) service failed to start due to the following error:%%2Error: (05/22/2015 01:12:40 AM) (Source: Service Control Manager) (EventID: 7000) (User: )Description: The globalUpdate Update Service (globalUpdate) service failed to start due to the following error:%%2Error: (05/20/2015 11:52:12 PM) (Source: Service Control Manager) (EventID: 7000) (User: )Description: The globalUpdate Update Service (globalUpdate) service failed to start due to the following error:%%2Error: (05/20/2015 06:03:09 AM) (Source: Service Control Manager) (EventID: 7006) (User: )Description: The ScRegSetValueExW call failed for Description with the following error:%%5Error: (05/20/2015 06:03:09 AM) (Source: Service Control Manager) (EventID: 7006) (User: )Description: The ScRegSetValueExW call failed for Start with the following error:%%5Error: (05/20/2015 06:03:09 AM) (Source: Service Control Manager) (EventID: 7006) (User: )Description: The ScRegSetValueExW call failed for Description with the following error:%%5Error: (05/20/2015 06:03:09 AM) (Source: Service Control Manager) (EventID: 7006) (User: )Description: The ScRegSetValueExW call failed for Start with the following error:%%5Microsoft Office:=========================Error: (05/25/2015 09:41:29 PM) (Source: WinMgmt) (EventID: 10) (User: )Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003Error: (05/25/2015 11:02:06 AM) (Source: Application Error) (EventID: 1000) (User: )Description: plugin-container.exe38.0.1.561155541a90mozalloc.dll38.0.1.561155540a1e8000000300001aa115a801d096ef5fd696ffC:\Program Files (x86)\Mozilla Firefox\plugin-container.exeC:\Program Files (x86)\Mozilla Firefox\mozalloc.dll9fce66ba-02e6-11e5-a4c6-e06995e63139Error: (05/25/2015 01:49:29 AM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )Description: 90080108Error: (05/24/2015 08:31:54 PM) (Source: WinMgmt) (EventID: 10) (User: )Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003Error: (05/24/2015 06:11:02 AM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )Description: 90080108Error: (05/23/2015 08:20:16 PM) (Source: WinMgmt) (EventID: 10) (User: )Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003Error: (05/22/2015 09:06:46 PM) (Source: WinMgmt) (EventID: 10) (User: )Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003Error: (05/22/2015 05:22:57 AM) (Source: Application Error) (EventID: 1000) (User: )Description: plugin-container.exe38.0.1.561155541a90mozalloc.dll38.0.1.561155540a1e8000000300001aa1ccc01d0944897cad5c0C:\Program Files (x86)\Mozilla Firefox\plugin-container.exeC:\Program Files (x86)\Mozilla Firefox\mozalloc.dllbfd0276e-005b-11e5-9eb4-e06995e63139Error: (05/22/2015 01:10:46 AM) (Source: WinMgmt) (EventID: 10) (User: )Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003Error: (05/21/2015 02:49:26 AM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )Description: 90080108==================== Memory info ===========================Processor: Intel® Core i5-2500 CPU @ 3.30GHzPercentage of memory in use: 39%Total physical RAM: 8099.43 MBAvailable physical RAM: 4862.28 MBTotal Pagefile: 16197.05 MBAvailable Pagefile: 12805.59 MBTotal Virtual: 8192 MBAvailable Virtual: 8191.81 MB==================== Drives ================================Drive c: () (Fixed) (Total:931.41 GB) (Free:185.83 GB) NTFS==================== MBR & Partition Table ==========================================================================Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: E75C7192)Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)Partition 2: (Not Active) - (Size=931.4 GB) - (Type=07 NTFS)==================== End of log ============================ Link to post Share on other sites More sharing options...
kevinf80 Posted May 26, 2015 ID:965163 Share Posted May 26, 2015 Thanks for the logs, continue as follows please: Download attached fixlist.txt file (end of reply) and save it to the Desktop, or the folder you saved FRST into.NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work. Run FRST and press the Fix button just once and wait.The tool will make a log on the Desktop (Fixlog.txt) or the folder it was ran from. Please post it to your reply. Next, Download AdwCleaner by Xplode onto your Desktop. Double click on Adwcleaner.exe to run the tool. Click on Scan Once the scan is done, click on the Clean button. <<<--- Ensure this option is completed You will get a prompt asking to close all programs. Click OK. Click OK again to reboot your computer. A text file will open after the restart. Please post the content of that logfile in your reply. You can also find the logfile at C:\AdwCleaner[sn].txt. Where n in the scan reference number Next, Please download Junkware Removal Tool to your desktop.Shut down your protection software now to avoid potential conflicts. (re-enable when done)Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".The tool will open and start scanning your system.Please be patient as this can take a while to complete depending on your system's specifications.On completion, a log (JRT.txt) is saved to your desktop and will automatically open.Post the contents of JRT.txt into your next message. Next, Scan with ESET Online Scanner This step can only be done using Internet Explorer, Google Chrome or Mozilla Firefox.Temporary disable your AntiVirus and AntiSpyware protection - instructions here.Please visit ESET Online Scanner website. Click there Run ESET Online Scanner. If using Internet Explorer: Accept the Terms of Use and click Start.Allow the running of add-on.If using Mozilla Firefox or Google Chrome:Download esetsmartinstaller_enu.exe that you'll be given link to.Double click esetsmartinstaller_enu.exe.Allow the Terms of Use and click Start.To perform the scan:Make sure that Remove found threats is unchecked.Scan archives is checked.In Advanced Settings: Scan for potentially unwanted applications, Scan for potentially unsafe applications and Enable Anti-Stealth technology are checked.Under “Enable Stealth Technology select “Change” select any extra drives in that window.Click StartThe program will begin to download it's virus database. The speed may vary depending on your Internet connection.When completed, the program will begin to scan. This may take several hours. Please, be patient.Do not do anything on your machine as it may interrupt the scan.When the scan is done, click Finish.A logfile will be created at C:\Program Files (x86)\ESET\ESET Online Scanner. Open it using Notepad. Please include this logfile in your next reply. Don't forget to re-enable protection software! Post those logs, also let me know if there are any remaining issues or concerns... Thank you, Kevin... Fixlog.txt Link to post Share on other sites More sharing options...
Maurice Naggar Posted June 6, 2015 ID:967590 Share Posted June 6, 2015 Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread. Thanks! Link to post Share on other sites More sharing options...
Recommended Posts