Posted September 20, 20168 yr FPCH Staff This machine is probably OK, but it just seems a bit sluggish. I'd appreciate another look. Thanks. Malwarebytes Anti-Malware www.malwarebytes.org Scan Date: 9/19/2016 Scan Time: 11:50 AM Logfile: Administrator: Yes Version: 2.2.1.1043 Malware Database: v2016.09.19.06 Rootkit Database: v2016.08.15.01 License: Free Malware Protection: Disabled Malicious Website Protection: Disabled Self-protection: Disabled OS: Windows 7 Service Pack 1 CPU: x64 File System: NTFS User: Quintin Scan Type: Threat Scan Result: Completed Objects Scanned: 315198 Time Elapsed: 14 min, 23 sec Memory: Enabled Startup: Enabled Filesystem: Enabled Archives: Enabled Rootkits: Disabled Heuristics: Enabled PUP: Enabled PUM: Enabled Processes: 0 (No malicious items detected) Modules: 0 (No malicious items detected) Registry Keys: 1 PUP.Optional.W3i, HKU\S-1-5-21-791955194-1637552953-539721985-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{C9A7EA86-F8A9-430D-BDD0-D08AF2C7E806}, Quarantined, [e31f1d573961e2545691f4c6f50e916f], Registry Values: 1 PUP.Optional.W3i, HKU\S-1-5-21-791955194-1637552953-539721985-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{C9A7EA86-F8A9-430D-BDD0-D08AF2C7E806}|URL, http://search.yahoo.com/search?p={searchTerms}&ei=UTF-8&fr=w3i&type=W3i_DS,136,0_0,Search,20140414,20028,0,31,0, Quarantined, [e31f1d573961e2545691f4c6f50e916f] Registry Data: 0 (No malicious items detected) Folders: 5 PUP.Optional.ArcadeParlor, C:\Users\Quintin\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\{F32E7E42-9AFA-47CA-A0C4-D07EE651D404}, Quarantined, [ed15165e7d1d64d2e737941907fb3bc5], PUP.Optional.ArcadeParlor, C:\Users\Quintin\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\{F32E7E42-9AFA-47CA-A0C4-D07EE651D404}\chrome, Quarantined, [ed15165e7d1d64d2e737941907fb3bc5], PUP.Optional.ArcadeParlor, C:\Users\Quintin\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\{F32E7E42-9AFA-47CA-A0C4-D07EE651D404}\chrome\content, Quarantined, [ed15165e7d1d64d2e737941907fb3bc5], PUP.Optional.ArcadeParlor, C:\Users\Quintin\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\{F32E7E42-9AFA-47CA-A0C4-D07EE651D404}\skin, Quarantined, [ed15165e7d1d64d2e737941907fb3bc5], PUP.Optional.InstallX, C:\Users\Quintin\AppData\Roaming\InstallX Search Protect for Yahoo, Quarantined, [fa08591b31692e0810fe4175ec1604fc], Files: 25 PUP.Optional.SavePathDeals, C:\Program Files (x86)\SaveDailyDeals Updater\uninstall.exe, Quarantined, [38ca97dd47530333cfe35891d13003fd], PUP.Optional.SavePathDeals, C:\Program Files (x86)\SaveDailyDeals Updater\updater.exe, Quarantined, [3ec491e37b1f62d4dbd7e504b150669a], Adware.Gertokr, C:\Users\Quintin\AppData\Local\Temp\ct_2001.exe, Quarantined, [e121abc9c4d65bdb095907aa49b8728e], Adware.Gertokr, C:\Users\Quintin\AppData\Local\Temp\ct_2006.exe, Quarantined, [a85afe76aeec0036dc86b100fc05a957], Adware.Gertokr, C:\Users\Quintin\AppData\Local\Temp\ct_2013.exe, Quarantined, [4cb6f084603a2a0cf56daa074cb56a96], PUP.Optional.RocketTab, C:\Users\Quintin\AppData\Local\Temp\rto5wLyv2F.exe, Quarantined, [867cadc7c6d4ed49f3821d2d40c0837d], Trojan.Agent.SSA, C:\Users\Quintin\AppData\Local\Temp\sysad.exe, Quarantined, [f60c4f259dfdf83e67a147bb4db44eb2], Trojan.Agent, C:\Users\Quintin\AppData\Local\Temp\.exe, Quarantined, [5aa89bd94b4fe254a53bb49d5ca72dd3], PUP.Optional.BestPriceNinja, C:\Users\Quintin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_pstatic.bestpriceninja.com_0.localstorage, Quarantined, [59a990e41684a78f5994cc157b88e21e], PUP.Optional.BestPriceNinja, C:\Users\Quintin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_pstatic.bestpriceninja.com_0.localstorage-journal, Quarantined, [27dbcda72c6e90a634b9964bea19a35d], PUP.Optional.BestPriceNinja, C:\Users\Quintin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_pstatic.bestpriceninja.com_0.localstorage, Quarantined, [eb17db995a408caac52818c926dd54ac], PUP.Optional.BestPriceNinja, C:\Users\Quintin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_pstatic.bestpriceninja.com_0.localstorage-journal, Quarantined, [b151d2a2aded0c2a3ab3e4fdb44f5ba5], PUP.Optional.eShopComp, C:\Users\Quintin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_pstatic.eshopcomp.com_0.localstorage, Quarantined, [b34f44300496a49269230dd9ec17669a], PUP.Optional.eShopComp, C:\Users\Quintin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_pstatic.eshopcomp.com_0.localstorage-journal, Quarantined, [ac560b6918827fb7395320c690737f81], PUP.Optional.APNToolBar.Gen, C:\Users\Quintin\AppData\Local\Temp\ApnStub.exe, Quarantined, [eb17680c4258d95d90a519d97a89ca36], PUP.Optional.ArcadeParlor, C:\Users\Quintin\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\{F32E7E42-9AFA-47CA-A0C4-D07EE651D404}\chrome.manifest, Quarantined, [ed15165e7d1d64d2e737941907fb3bc5], PUP.Optional.ArcadeParlor, C:\Users\Quintin\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\{F32E7E42-9AFA-47CA-A0C4-D07EE651D404}\icon.png, Quarantined, [ed15165e7d1d64d2e737941907fb3bc5], PUP.Optional.ArcadeParlor, C:\Users\Quintin\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\{F32E7E42-9AFA-47CA-A0C4-D07EE651D404}\install.rdf, Quarantined, [ed15165e7d1d64d2e737941907fb3bc5], PUP.Optional.ArcadeParlor, C:\Users\Quintin\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\{F32E7E42-9AFA-47CA-A0C4-D07EE651D404}\chrome\content\arcadeparlor.js, Quarantined, [ed15165e7d1d64d2e737941907fb3bc5], PUP.Optional.ArcadeParlor, C:\Users\Quintin\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\{F32E7E42-9AFA-47CA-A0C4-D07EE651D404}\chrome\content\browser.xul, Quarantined, [ed15165e7d1d64d2e737941907fb3bc5], PUP.Optional.ArcadeParlor, C:\Users\Quintin\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\{F32E7E42-9AFA-47CA-A0C4-D07EE651D404}\skin\style.css, Quarantined, [ed15165e7d1d64d2e737941907fb3bc5], PUP.Optional.InstallX, C:\Users\Quintin\AppData\Roaming\InstallX Search Protect for Yahoo\config.xml, Quarantined, [fa08591b31692e0810fe4175ec1604fc], PUP.Optional.InstallX, C:\Users\Quintin\AppData\Roaming\InstallX Search Protect for Yahoo\searchprotector.exe, Quarantined, [fa08591b31692e0810fe4175ec1604fc], PUP.Optional.InstallX, C:\Users\Quintin\AppData\Roaming\InstallX Search Protect for Yahoo\searchprotector.zip, Quarantined, [fa08591b31692e0810fe4175ec1604fc], PUP.Optional.InstallX, C:\Users\Quintin\AppData\Roaming\InstallX Search Protect for Yahoo\SearchProtectorMonitor.log, Quarantined, [fa08591b31692e0810fe4175ec1604fc], Physical Sectors: 0 (No malicious items detected) (end) Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 18-09-2016 Ran by Quintin (administrator) on QUINTIN-PC (20-09-2016 12:04:24) Running from C:\Users\Quintin\Desktop Loaded Profiles: Quintin (Available Profiles: Quintin) Platform: Windows 7 Home Premium Service Pack 1 (X64) Language: English (United States) Internet Explorer Version 11 (Default browser: Chrome) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe (Emsisoft Ltd) C:\Program Files\Emsisoft Anti-Malware\a2service.exe (Microsoft Corporation) C:\Windows\System32\wlanext.exe (Andrea Electronics Corporation) C:\Program Files\IDT\WDM\AESTSr64.exe (Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Intel Corporation) C:\Windows\System32\igfxtray.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe (Alps Electric Co., Ltd.) C:\Program Files\DellTPad\Apoint.exe (Dell Inc.) C:\Program Files\Dell\QuickSet\quickset.exe (Intel® Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe (Microsoft Corporation) C:\Windows\System32\rundll32.exe (Microsoft Corporation.) C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\BBSvc.EXE (Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (Intel® Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe (Intel® Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe () C:\Program Files (x86)\Dell Stage\Dell Stage\stage_primary.exe (Emsisoft Ltd) C:\Program Files\Emsisoft Anti-Malware\a2guard.exe (Intel® Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe (SoftThinks SAS) C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe (RaMMicHaeL) C:\Program Files (x86)\Unchecky\bin\unchecky_svc.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (RaMMicHaeL) C:\Program Files (x86)\Unchecky\bin\unchecky_bg.exe (Emsisoft Ltd) C:\Program Files\Emsisoft Anti-Malware\a2start.exe (Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe (SoftThinks - Dell) C:\Program Files (x86)\Dell DataSafe Local Backup\Toaster.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE (Creative Technology Ltd) C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe (Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe () C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe () C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\STService.exe () C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe (Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe (Zedge.net) C:\Users\Quintin\AppData\Local\Apps\2.0\1M8L22ZT.DWV\JOKHBOAE.B6A\zedg..tion_4cd56dcfd1799009_0001.0002_ea3f01849f5e16c3\ZedgeTonesync.exe (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe (Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe (Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe (Alps Electric Co., Ltd.) C:\Program Files\DellTPad\ApMsgFwd.exe (Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\btplayerctrl.exe (Alps Electric Co., Ltd.) C:\Program Files\DellTPad\hidfind.exe (Alps Electric Co., Ltd.) C:\Program Files\DellTPad\ApntEx.exe () C:\Program Files (x86)\Dell Stage\Dell Stage\stage_secondary.exe (SoftThinks - Dell) C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpd.exe (Dell Inc.) C:\Program Files\Dell\DellDataVault\DellDataVaultWiz.exe (Dell Inc.) C:\Program Files (x86)\Dell Update\DellUpService.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe (Dell Inc.) C:\Program Files (x86)\Dell\SupportAssistAgent\bin\SupportAssistAgent.exe (Dell Inc.) C:\Program Files (x86)\Dell Update\DellUpTray.exe (PC-Doctor, Inc.) C:\Program Files\Dell\SupportAssist\koala.exe (PC-Doctor, Inc.) C:\Program Files\Dell\SupportAssist\pcdrcui.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe ==================== Registry (Whitelisted) =========================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [sysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [525312 2011-01-25] (IDT, Inc.) HKLM\...\Run: [Apoint] => C:\Program Files\DellTPad\Apoint.exe [609144 2011-04-12] (Alps Electric Co., Ltd.) HKLM\...\Run: [QuickSet] => C:\Program Files\Dell\QuickSet\QuickSet.exe [3666800 2011-01-21] (Dell Inc.) HKLM\...\Run: [intelTBRunOnce] => wscript.exe //b //nologo "C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs" HKLM\...\Run: [intelPAN] => C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe [1935120 2011-07-27] (Intel® Corporation) HKLM\...\Run: [bTMTrayAgent] => C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll [10365952 2011-05-19] (Intel Corporation) HKLM\...\Run: [DellStage] => C:\Program Files (x86)\Dell Stage\Dell Stage\stage_primary.exe [2055016 2011-04-29] () HKLM\...\Run: [emsisoft anti-malware] => c:\program files\emsisoft anti-malware\a2guard.exe [7241200 2016-07-26] (Emsisoft Ltd) HKLM-x32\...\Run: [Dell Webcam Central] => C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe [503942 2011-04-13] (Creative Technology Ltd) HKLM-x32\...\Run: [iAStorIcon] => C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe [283160 2010-11-06] (Intel Corporation) HKLM-x32\...\Run: [NUSB3MON] => C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-11-17] (Renesas Electronics Corporation) HKLM-x32\...\Run: [RoxWatchTray] => c:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe [240112 2010-11-25] (Sonic Solutions) HKLM-x32\...\Run: [Desktop Disc Tool] => c:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe [514544 2010-11-17] () HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [40336 2015-09-24] (Adobe Systems Incorporated) HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1022152 2014-12-19] (Adobe Systems Incorporated) HKLM-x32\...\Run: [AccuWeatherWidget] => C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe [885760 2011-04-29] () HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-04-23] (Apple Inc.) HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-05-26] (Apple Inc.) HKLM Group Policy restriction on software: %AppData%\*\{*}.exe HKLM Group Policy restriction on software: %AppData%\{*}.exe HKLM Group Policy restriction on software: %Temp%\wz*\{*}.exe HKLM Group Policy restriction on software: %Temp%\*.zip\{*}.exe HKLM Group Policy restriction on software: %Temp%\7z*\{*}.exe HKLM Group Policy restriction on software: %Temp%\Rar*\{*}.exe HKLM Group Policy restriction on software: %localappdata%\{*}.exe HKLM Group Policy restriction on software: %localappdata%\*\{*}.exe Winlogon\Notify\GoToAssist: C:\Program Files (x86)\Citrix\GoToAssist\514\G2AWinLogon_x64.dll [X] Winlogon\Notify\igfxcui: C:\windows\system32\igfxdev.dll (Intel Corporation) HKU\S-1-5-21-791955194-1637552953-539721985-1001\...\Run: [Facebook Update] => C:\Users\Quintin\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2012-07-11] (Facebook Inc.) HKU\S-1-5-21-791955194-1637552953-539721985-1001\...\Run: [ooVoo.exe] => C:\Program Files (x86)\ooVoo\oovoo.exe /minimized HKU\S-1-5-21-791955194-1637552953-539721985-1001\...\Run: [ZedgeToneSync] => C:\Users\Quintin\AppData\Local\Apps\2.0\Data\VDN1BQTD.ZTW\08DXTN6R.QPW\zedg..tion_4cd56dcfd1799009_0001.0002_ea3f01849f5e16c3\Data\ZedgeToneSync.appref-ms -startup HKU\S-1-5-21-791955194-1637552953-539721985-1001\...\MountPoints2: {b46d3f3a-cef1-11e1-b864-ac728988983d} - E:\setup.exe -a ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) ProxyServer: [s-1-5-21-791955194-1637552953-539721985-1001] => http=127.0.0.1:49168;https=127.0.0.1:49168 Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt Tcpip\Parameters: [DhcpNameServer] 192.168.0.1 Tcpip\..\Interfaces\{55518263-5D5C-464F-8199-FD4B89E8C6A1}: [DhcpNameServer] 67.142.181.10 67.142.181.11 Tcpip\..\Interfaces\{67104B88-6E59-48B3-A173-09886471A80F}: [DhcpNameServer] 192.168.0.1 Internet Explorer: ================== HKU\S-1-5-21-791955194-1637552953-539721985-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://www.google.com/ SearchScopes: HKLM -> {2F1E335A-858A-4BE9-8F6B-D0AF1D018B53} URL = hxxp://www.bing.com/search?q={searchTerms}&form=DLCDF8&pc=MDDC&src=IE-SearchBox SearchScopes: HKLM-x32 -> {2F1E335A-858A-4BE9-8F6B-D0AF1D018B53} URL = hxxp://www.bing.com/search?q={searchTerms}&form=DLCDF8&pc=MDDC&src=IE-SearchBox BHO: Bing Bar Helper -> {1dad3af3-ef2f-4f64-ac4b-11789189fcb6} -> C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\amd64\BingExt.dll [2014-03-11] (Microsoft Corporation.) BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21] (Microsoft Corp.) BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation) BHO: WOT Helper -> {C920E44A-7F78-4E64-BDD7-A57026E7FEB7} -> C:\Program Files\WOT\WOT.dll [2015-06-09] () BHO: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre6\bin\jp2ssv.dll => No File BHO-x32: Bing Bar Helper -> {1dad3af3-ef2f-4f64-ac4b-11789189fcb6} -> C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\BingExt.dll [2014-03-11] (Microsoft Corporation.) BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21] (Microsoft Corp.) BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation) BHO-x32: WOT Helper -> {C920E44A-7F78-4E64-BDD7-A57026E7FEB7} -> C:\Program Files (x86)\WOT\WOT.dll [2015-06-09] () BHO-x32: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll => No File Toolbar: HKLM - Bing Bar - {eec0f710-38b5-4aba-99bf-ec87564a4e13} - C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\amd64\BingExt.dll [2014-03-11] (Microsoft Corporation.) Toolbar: HKLM - WOT - {71576546-354D-41c9-AAE8-31F2EC22BF0D} - C:\Program Files\WOT\WOT.dll [2015-06-09] () Toolbar: HKLM-x32 - Bing Bar - {eec0f710-38b5-4aba-99bf-ec87564a4e13} - C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\BingExt.dll [2014-03-11] (Microsoft Corporation.) Toolbar: HKLM-x32 - WOT - {71576546-354D-41c9-AAE8-31F2EC22BF0D} - C:\Program Files (x86)\WOT\WOT.dll [2015-06-09] () Toolbar: HKU\S-1-5-21-791955194-1637552953-539721985-1001 -> WOT - {71576546-354D-41C9-AAE8-31F2EC22BF0D} - C:\Program Files\WOT\WOT.dll [2015-06-09] () Handler-x32: cozi - {5356518D-FE9C-4E08-9C1F-1E872ECD367F} - C:\Program Files (x86)\Cozi Express\CoziProtocolHandler.dll [2011-05-05] (Cozi Group, Inc.) Handler: wot - {C2A44D6B-CB9F-4663-88A6-DF2F26E4D952} - C:\Program Files\WOT\WOT.dll [2015-06-09] () Handler-x32: wot - {C2A44D6B-CB9F-4663-88A6-DF2F26E4D952} - C:\Program Files (x86)\WOT\WOT.dll [2015-06-09] () FireFox: ======== FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF64_23_0_0_162.dll [2016-09-20] () FF Plugin: @microsoft.com/GENUINE -> disabled [No File] FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-12] ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\windows\SysWOW64\Macromed\Flash\NPSWF32_23_0_0_162.dll [2016-09-20] () FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-02-21] () FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File] FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-12] ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2010-11-10] (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2010-11-10] (Microsoft Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-09-13] (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-09-13] (Google Inc.) FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll [2015-09-24] (Adobe Systems Inc.) FF Plugin HKU\S-1-5-21-791955194-1637552953-539721985-1001: @Skype Limited.com/Facebook Video Calling Plugin -> C:\Users\Quintin\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll [2014-07-24] (Skype Limited) Chrome: ======= CHR Profile: C:\Users\Quintin\AppData\Local\Google\Chrome\User Data\Default [2016-09-20] CHR Extension: (Google Slides) - C:\Users\Quintin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2016-02-08] CHR Extension: (Google Docs) - C:\Users\Quintin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2016-02-09] CHR Extension: (Google Drive) - C:\Users\Quintin\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-02-09] CHR Extension: (Adguard AdBlocker) - C:\Users\Quintin\AppData\Local\Google\Chrome\User Data\Default\Extensions\bgnkhhnnamicmpeenaelnjfhikgbkllg [2016-09-19] CHR Extension: (WOT: Web of Trust, Website Reputation Ratings) - C:\Users\Quintin\AppData\Local\Google\Chrome\User Data\Default\Extensions\bhmmomiinigofkjcapegjjndpbikblnp [2016-09-19] CHR Extension: (YouTube) - C:\Users\Quintin\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-02-09] CHR Extension: (Google Search) - C:\Users\Quintin\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2016-02-09] CHR Extension: (Google Sheets) - C:\Users\Quintin\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2016-02-08] CHR Extension: (Google Docs Offline) - C:\Users\Quintin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-09-13] CHR Extension: (Chrome Web Store Payments) - C:\Users\Quintin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-09-13] CHR Extension: (Gmail) - C:\Users\Quintin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-02-09] CHR Extension: (Chrome Media Router) - C:\Users\Quintin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2016-09-19] ==================== Services (Whitelisted) ======================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) R2 a2AntiMalware; C:\Program Files\Emsisoft Anti-Malware\a2service.exe [9331168 2016-07-26] (Emsisoft Ltd) R2 Bluetooth Device Monitor; C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe [921664 2011-05-19] (Intel Corporation) [File not signed] R3 Bluetooth Media Service; C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe [1335360 2011-05-19] (Intel Corporation) [File not signed] R2 Bluetooth OBEX Service; C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe [995392 2011-05-19] (Intel Corporation) [File not signed] S2 DellDataVault; C:\Program Files\Dell\DellDataVault\DellDataVault.exe [2572024 2016-03-10] (Dell Inc.) R2 DellDataVaultWiz; C:\Program Files\Dell\DellDataVault\DellDataVaultWiz.exe [202488 2016-03-10] (Dell Inc.) R2 DellUpdate; C:\Program Files (x86)\Dell Update\DellUpService.exe [237272 2015-08-27] (Dell Inc.) S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [340240 2011-07-27] () R2 SupportAssistAgent; C:\Program Files (x86)\Dell\SupportAssistAgent\bin\SupportAssistAgent.exe [31928 2016-03-14] (Dell Inc.) R2 Unchecky; C:\Program Files (x86)\Unchecky\bin\unchecky_svc.exe [243448 2016-09-19] (RaMMicHaeL) R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation) ===================== Drivers (Whitelisted) ========================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) R3 DDDriver; C:\Windows\System32\drivers\DDDriver64Dcsa.sys [32464 2016-01-05] (Dell Computer Corporation) R3 DellProf; C:\Windows\System32\drivers\DellProf.sys [24240 2016-01-05] (Dell Computer Corporation) S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3286016 2009-06-10] (Broadcom Corporation) R1 epp; C:\PROGRAM FILES\EMSISOFT ANTI-MALWARE\epp.sys [115832 2016-07-21] (Emsisoft Ltd) S3 RimUsb; C:\Windows\System32\Drivers\RimUsb_AMD64.sys [27520 2007-05-14] (Research In Motion Limited) ==================== NetSvcs (Whitelisted) =================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) ==================== One Month Created files and folders ======== (If an entry is included in the fixlist, the file/folder will be moved.) 2016-09-20 12:04 - 2016-09-20 12:04 - 00019482 _____ C:\Users\Quintin\Desktop\FRST.txt 2016-09-19 14:21 - 2016-09-19 14:21 - 00000000 ____D C:\ProgramData\Unchecky 2016-09-19 14:21 - 2016-09-19 14:21 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Unchecky 2016-09-19 14:21 - 2016-09-19 14:21 - 00000000 ____D C:\Program Files (x86)\Unchecky 2016-09-19 13:29 - 2016-09-19 13:29 - 00000000 ____D C:\Program Files\WOT 2016-09-19 13:29 - 2016-09-19 13:29 - 00000000 ____D C:\Program Files (x86)\WOT 2016-09-19 13:23 - 2016-09-20 11:56 - 00000000 ____D C:\ProgramData\Adguard 2016-09-19 13:23 - 2016-09-19 13:23 - 00000260 _____ C:\windows\SysWOW64\Drivers\vwifikerneldrv.sys 2016-09-19 13:23 - 2016-09-19 13:23 - 00000260 _____ C:\windows\SysWOW64\d3dx9_11.dll.tmp 2016-09-19 13:23 - 2016-09-19 13:23 - 00000260 _____ C:\ProgramData\fontcacheev1.dat 2016-09-19 13:23 - 2016-09-19 13:23 - 00000000 ____D C:\Performix LLC 2016-09-19 13:20 - 2016-09-19 13:20 - 00003292 _____ C:\windows\System32\Tasks\{1C24AA12-39B1-4B82-92D1-906D1878F75F} 2016-09-19 13:07 - 2016-09-19 13:07 - 00000000 ____D C:\ProgramData\Emsisoft 2016-09-19 12:44 - 2016-09-19 12:44 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Emsisoft Anti-Malware 2016-09-19 12:43 - 2016-09-20 12:01 - 00000000 ____D C:\Program Files\Emsisoft Anti-Malware 2016-09-19 12:34 - 2016-09-20 12:04 - 00000000 ____D C:\FRST 2016-09-19 12:34 - 2016-09-19 12:34 - 02400256 _____ (Farbar) C:\Users\Quintin\Desktop\FRST64.exe 2016-09-19 12:03 - 2016-09-19 12:03 - 00004036 _____ C:\windows\System32\Tasks\PCDoctorBackgroundMonitorTask 2016-09-19 12:03 - 2016-09-19 12:03 - 00003484 _____ C:\windows\System32\Tasks\PCDEventLauncherTask 2016-09-19 12:03 - 2016-09-19 12:03 - 00003352 _____ C:\windows\System32\Tasks\PCDDataUploadTask 2016-09-19 12:03 - 2016-09-19 12:03 - 00003226 _____ C:\windows\System32\Tasks\SystemToolsDailyTest 2016-09-19 12:03 - 2016-09-19 12:03 - 00000000 ____D C:\ProgramData\PC-Doctor for Windows 2016-09-19 12:03 - 2016-09-19 12:03 - 00000000 ____D C:\Program Files\Dell Support Center 2016-09-19 12:01 - 2016-09-19 12:01 - 00000000 __HDC C:\ProgramData\{05EE3202-A879-4F9D-895C-AC535855E0A9} 2016-09-19 11:58 - 2016-09-19 12:01 - 00000000 ____D C:\Users\Quintin\AppData\Roaming\PCDr 2016-09-19 11:48 - 2016-09-19 12:11 - 00192216 _____ (Malwarebytes) C:\windows\system32\Drivers\MBAMSwissArmy.sys 2016-09-19 11:48 - 2016-09-19 11:48 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware 2016-09-19 11:48 - 2016-09-19 11:48 - 00000000 ____D C:\ProgramData\Malwarebytes 2016-09-19 11:48 - 2016-09-19 11:48 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware 2016-09-19 11:48 - 2016-03-10 14:09 - 00064896 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys 2016-09-19 11:48 - 2016-03-10 14:08 - 00140672 _____ (Malwarebytes) C:\windows\system32\Drivers\mbamchameleon.sys 2016-09-19 11:48 - 2016-03-10 14:08 - 00027008 _____ (Malwarebytes) C:\windows\system32\Drivers\mbam.sys 2016-09-18 20:09 - 2016-09-19 12:02 - 00000000 ____D C:\ProgramData\PCDr 2016-09-18 18:17 - 2016-09-18 18:17 - 00000000 ____D C:\Users\Quintin\AppData\Local\ESET 2016-09-18 18:15 - 2016-09-20 11:54 - 00000000 ____D C:\GVTS 2016-09-18 18:09 - 2016-09-18 18:09 - 00000207 _____ C:\windows\tweaking.com-regbackup-QUINTIN-PC-Windows-7-Home-Premium-(64-bit).dat 2016-09-18 18:09 - 2016-09-18 18:09 - 00000000 ____D C:\RegBackup 2016-09-13 09:24 - 2016-09-13 09:26 - 00220282 _____ C:\windows\ntbtlog.txt ==================== One Month Modified files and folders ======== (If an entry is included in the fixlist, the file/folder will be moved.) 2016-09-20 12:02 - 2011-09-13 12:45 - 00000000 ____D C:\Program Files (x86)\Dell DataSafe Local Backup 2016-09-20 12:01 - 2016-02-08 22:42 - 00000894 _____ C:\windows\Tasks\GoogleUpdateTaskMachineCore.job 2016-09-20 12:01 - 2014-06-22 22:40 - 00000000 ____D C:\Users\Quintin\AppData\Local\Deployment 2016-09-20 12:00 - 2011-09-13 12:56 - 00000000 ____D C:\Users\Default\AppData\Local\SoftThinks 2016-09-20 12:00 - 2011-09-13 12:56 - 00000000 ____D C:\Users\Default User\AppData\Local\SoftThinks 2016-09-20 11:59 - 2013-06-17 20:47 - 00000830 _____ C:\windows\Tasks\Adobe Flash Player Updater.job 2016-09-20 11:59 - 2009-07-14 01:08 - 00000006 ____H C:\windows\Tasks\SA.DAT 2016-09-20 11:48 - 2016-02-08 22:42 - 00000898 _____ C:\windows\Tasks\GoogleUpdateTaskMachineUA.job 2016-09-20 11:34 - 2011-12-29 01:15 - 00000936 _____ C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-791955194-1637552953-539721985-1001UA.job 2016-09-20 10:59 - 2013-06-17 20:47 - 00796352 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe 2016-09-20 10:59 - 2013-06-17 20:47 - 00142528 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl 2016-09-20 10:59 - 2013-06-17 20:47 - 00003768 _____ C:\windows\System32\Tasks\Adobe Flash Player Updater 2016-09-20 10:59 - 2013-06-17 20:46 - 00000000 ____D C:\windows\system32\Macromed 2016-09-20 10:59 - 2011-09-13 12:08 - 00000000 ____D C:\windows\SysWOW64\Macromed 2016-09-20 10:25 - 2009-07-14 00:45 - 00028576 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2016-09-20 10:25 - 2009-07-14 00:45 - 00028576 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2016-09-19 12:10 - 2009-07-14 01:13 - 00782470 _____ C:\windows\system32\PerfStringBackup.INI 2016-09-19 12:10 - 2009-07-13 23:20 - 00000000 ____D C:\windows\inf 2016-09-19 12:06 - 2014-04-01 01:30 - 00000000 ____D C:\Program Files (x86)\SaveDailyDeals Updater 2016-09-19 12:06 - 2009-07-13 23:20 - 00000000 ____D C:\windows\system 2016-09-19 12:03 - 2011-09-13 12:15 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DELL 2016-09-18 20:06 - 2011-09-13 12:35 - 00000000 ____D C:\ProgramData\Sonic 2016-09-18 19:36 - 2016-02-08 22:43 - 00002116 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk 2016-09-18 19:36 - 2016-02-08 22:43 - 00002104 _____ C:\Users\Public\Desktop\Google Chrome.lnk 2016-09-18 18:06 - 2014-04-01 01:30 - 00000000 ____D C:\Users\Quintin\AppData\Roaming\Yahoo! 2016-09-18 18:06 - 2014-04-01 01:30 - 00000000 ____D C:\Users\Quintin\AppData\LocalLow\Yahoo! 2016-09-18 18:06 - 2014-04-01 01:30 - 00000000 ____D C:\Program Files (x86)\Yahoo! 2016-09-18 17:58 - 2011-09-13 12:43 - 00000000 ____D C:\ProgramData\McAfee 2016-09-13 10:03 - 2011-09-13 12:42 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk 2016-09-13 09:49 - 2011-09-13 12:39 - 00000000 ____D C:\ProgramData\Skype 2016-09-13 09:48 - 2011-12-29 00:45 - 00000000 ____D C:\Users\Quintin\AppData\Roaming\Skype 2016-09-13 09:43 - 2016-02-08 22:42 - 00003894 _____ C:\windows\System32\Tasks\GoogleUpdateTaskMachineUA 2016-09-13 09:43 - 2016-02-08 22:42 - 00003642 _____ C:\windows\System32\Tasks\GoogleUpdateTaskMachineCore 2016-09-13 09:43 - 2014-12-15 03:06 - 00000000 __SHD C:\Users\Quintin\AppData\Local\EmieBrowserModeList 2016-09-13 09:43 - 2014-06-04 17:53 - 00000000 __SHD C:\Users\Quintin\AppData\Local\EmieUserList 2016-09-13 09:43 - 2014-06-04 17:53 - 00000000 __SHD C:\Users\Quintin\AppData\Local\EmieSiteList 2016-09-13 09:25 - 2011-12-29 00:27 - 00000000 ____D C:\Users\Quintin ==================== Files in the root of some directories ======= 2013-02-02 01:02 - 2014-07-24 22:09 - 0004608 _____ () C:\Users\Quintin\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini 2011-12-29 01:22 - 2011-12-29 01:22 - 0000056 ____H () C:\ProgramData\ezsidmv.dat 2016-09-19 13:23 - 2016-09-19 13:23 - 0000260 _____ () C:\ProgramData\fontcacheev1.dat Files to move or delete: ==================== C:\ProgramData\fontcacheev1.dat Some files in TEMP: ==================== C:\Users\Quintin\AppData\Local\Temp\libeay32.dll C:\Users\Quintin\AppData\Local\Temp\msvcr120.dll C:\Users\Quintin\AppData\Local\Temp\ose00000.exe C:\Users\Quintin\AppData\Local\Temp\setup.exe C:\Users\Quintin\AppData\Local\Temp\sqlite3.dll ==================== Bamital & volsnap ================= (There is no automatic fix for files that do not pass verification.) C:\windows\system32\winlogon.exe => File is digitally signed C:\windows\system32\wininit.exe => File is digitally signed C:\windows\SysWOW64\wininit.exe => File is digitally signed C:\windows\explorer.exe => File is digitally signed C:\windows\SysWOW64\explorer.exe => File is digitally signed C:\windows\system32\svchost.exe => File is digitally signed C:\windows\SysWOW64\svchost.exe => File is digitally signed C:\windows\system32\services.exe => File is digitally signed C:\windows\system32\User32.dll => File is digitally signed C:\windows\SysWOW64\User32.dll => File is digitally signed C:\windows\system32\userinit.exe => File is digitally signed C:\windows\SysWOW64\userinit.exe => File is digitally signed C:\windows\system32\rpcss.dll => File is digitally signed C:\windows\system32\dnsapi.dll => File is digitally signed C:\windows\SysWOW64\dnsapi.dll => File is digitally signed C:\windows\system32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-12-15 08:09 ==================== End of FRST.txt ============================ Additional scan result of Farbar Recovery Scan Tool (x64) Version: 18-09-2016 Ran by Quintin (20-09-2016 12:05:19) Running from C:\Users\Quintin\Desktop Windows 7 Home Premium Service Pack 1 (X64) (2011-12-29 04:27:03) Boot Mode: Normal ========================================================== ==================== Accounts: ============================= Administrator (S-1-5-21-791955194-1637552953-539721985-500 - Administrator - Disabled) Guest (S-1-5-21-791955194-1637552953-539721985-501 - Limited - Disabled) HomeGroupUser$ (S-1-5-21-791955194-1637552953-539721985-1002 - Limited - Enabled) Quintin (S-1-5-21-791955194-1637552953-539721985-1001 - Administrator - Enabled) => C:\Users\Quintin ==================== Security Center ======================== (If an entry is included in the fixlist, it will be removed.) AV: Emsisoft Anti-Malware (Enabled - Up to date) {D1196F3E-3487-585D-3681-0661BD157EC3} AS: Emsisoft Anti-Malware (Enabled - Up to date) {6A788EDA-12BD-57D3-0C31-3D13C692347E} AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} ==================== Installed Programs ====================== (Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.) Adobe Flash Player 23 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 23.0.0.162 - Adobe Systems Incorporated) Adobe Flash Player 23 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 23.0.0.162 - Adobe Systems Incorporated) Adobe Reader X (10.1.16) MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}) (Version: 10.1.16 - Adobe Systems Incorporated) Advanced Audio FX Engine (HKLM-x32\...\Advanced Audio FX Engine) (Version: 1.12.05 - Creative Technology Ltd) Apple Application Support (HKLM-x32\...\{D9DAD0FF-495A-472B-9F10-BAE430A26682}) (Version: 3.0.3 - Apple Inc.) Apple Mobile Device Support (HKLM\...\{787136D2-F0F8-4625-AA3F-72D7795AC842}) (Version: 7.1.1.3 - Apple Inc.) Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.) Bing Bar (HKLM-x32\...\{3365E735-48A6-4194-9988-CE59AC5AE503}) (Version: 7.3.132.0 - Microsoft Corporation) Bing Rewards Client Installer (x32 Version: 16.0.345.0 - Microsoft Corporation) Hidden Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.) Cozi (HKLM-x32\...\{EA1F3D6C-A6F5-4CDC-B0D3-9C56C06B4D29}) (Version: 1.0.6505.38692 - Cozi Group, Inc.) D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden Dell Data Vault (Version: 4.3.8.0 - Dell Inc.) Hidden Dell DataSafe Local Backup - Support Software (HKLM-x32\...\{A9668246-FB70-4103-A1E3-66C9BC2EFB49}) (Version: 9.4.60 - Dell Inc.) Dell DataSafe Local Backup (HKLM-x32\...\{0ED7EE95-6A97-47AA-AD73-152C08A15B04}) (Version: 9.4.60 - Dell Inc.) Dell Edoc Viewer (HKLM\...\{8EBA8727-ADC2-477B-9D9A-1A1836BE4E05}) (Version: 1.0.0 - Dell Inc) Dell Getting Started Guide (HKLM-x32\...\{7DB9F1E5-9ACB-410D-A7DC-7A3D023CE045}) (Version: 1.00.0000 - Dell Inc.) Dell Home Systems Service Agreement (HKLM-x32\...\{AB2FDE4F-6BED-4E9E-B676-3DCCEBB1FBFE}) (Version: 2.0.0 - Dell Inc.) Dell MusicStage (HKLM-x32\...\{91AF2672-F5BC-42CF-8037-A9D2F92BBCC0}) (Version: 1.5.201.0 - Fingertapps) Dell Perks Webslice IE8 (HKLM-x32\...\{CF67ED0C-F85D-4791-AED3-3FE882EDB45D}) (Version: 8.0 - Nextjump Inc) Dell PhotoStage (HKLM-x32\...\{E4335E82-17B3-460F-9E70-39D9BC269DB3}) (Version: 1.5.0.65 - ArcSoft) Dell Stage (HKLM-x32\...\{E2EBA7C0-8072-447F-856D-FFEE8D15B23B}) (Version: 1.5.201.0 - Fingertapps) Dell SupportAssist (HKLM\...\PC-Doctor for Windows) (Version: 1.3.6817.133 - Dell) Dell SupportAssistAgent (HKLM-x32\...\{B57A8AFE-6735-4497-BD52-BD2F838F5CF0}) (Version: 1.2.1.31 - Dell) Dell Touchpad (HKLM\...\{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}) (Version: 7.1209.101.204 - ALPS ELECTRIC CO., LTD.) Dell Update (HKLM-x32\...\{DB82968B-57A4-4397-81A5-ECAB21B5DFCD}) (Version: 1.7.1015.0 - Dell Inc.) Dell VideoStage (HKLM-x32\...\InstallShield_{DCE0E79A-B9AC-41AC-98C1-7EF0538BCA7F}) (Version: 1.2.0.1712 - CyberLink Corp.) Dell VideoStage (x32 Version: 1.2.0.1712 - CyberLink Corp.) Hidden Dell Webcam Central (HKLM-x32\...\Dell Webcam Central) (Version: 2.00.44 - Creative Technology Ltd) DirectX 9 Runtime (x32 Version: 1.00.0000 - Sonic Solutions) Hidden eBay (HKLM-x32\...\{A8B88634-7F90-402F-B66A-86429755F6A5}) (Version: 1.4.0 - eBay Inc.) Emsisoft Anti-Malware (HKLM\...\{5502032C-88C1-4303-99FE-B5CBD7684CEA}_is1) (Version: 11.10 - Emsisoft Ltd.) Expert PDF 7 Reader (HKLM-x32\...\{FC279721-37A6-4777-AFD8-7A56681EBA14}) (Version: 7.0.1370.0 - Avanquest software) Facebook Video Calling 3.1.0.521 (HKLM-x32\...\{2091F234-EB58-4B80-8C96-8EB78C808CF7}) (Version: 3.1.521 - Skype Limited) Google Chrome (HKLM-x32\...\Google Chrome) (Version: 53.0.2785.116 - Google Inc.) Google Update Helper (x32 Version: 1.3.31.5 - Google Inc.) Hidden GoToAssist 8.0.0.514 (HKLM-x32\...\GoToAssist) (Version: - ) IDT Audio (HKLM-x32\...\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6324.0 - IDT) Intel PROSet Wireless (x32 Version: - ) Hidden Intel® Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation) Intel® Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 7.0.0.1118 - Intel Corporation) Intel® Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2361 - Intel Corporation) Intel® PROSet/Wireless Software for Bluetooth® Technology (HKLM\...\{7CE8BE79-ABC3-4B2C-9543-28ED2B0A9EA8}) (Version: 1.2.0.0587 - Intel Corporation) Intel® PROSet/Wireless WiFi Software (HKLM\...\{25FBDA9A-E868-4B3B-B9FF-D923818511A1}) (Version: 14.2.0000 - Intel Corporation) Intel® Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 10.1.0.1008 - Intel Corporation) Intel® Turbo Boost Technology Monitor 2.0 (HKLM\...\{B77EFA0B-9BD3-4122-9F9A-15A963B5EA24}) (Version: 2.1.23.0 - Intel) Intel® WiDi (HKLM-x32\...\{25680C01-6753-4FE9-A891-7857F26457C1}) (Version: 2.1.35.0 - Intel Corporation) Intel® Wireless Display (HKLM\...\{28EF7372-9087-4AC3-9B9F-D9751FCDF830}) (Version: - ) Internet Explorer (x32 Version: 8 - Microsoft Corporation) Hidden iTunes (HKLM\...\{5A68A656-979F-4168-8795-E2E368AA4DC2}) (Version: 11.2.2.3 - Apple Inc.) Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Malwarebytes Anti-Malware version 2.2.1.1043 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.1.1043 - Malwarebytes) Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation) Microsoft Office Home and Business 2010 (HKLM-x32\...\Office14.SingleImage) (Version: 14.0.7015.1000 - Microsoft Corporation) Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.41212.0 - Microsoft Corporation) Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{820B6609-4C97-3A2B-B644-573B06A0F0CC}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation) MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation) MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation) PhotoShowExpress (x32 Version: 2.0.063 - Sonic Solutions) Hidden Quickset64 (HKLM\...\{87CF757E-C1F1-4D22-865C-00C6950B5258}) (Version: 10.09.20 - Dell Inc.) RBVirtualFolder64Inst (Version: 1.00.0000 - Roxio, Inc.) Hidden Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.31.1025.2010 - Realtek) Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.7600.30126 - Realtek Semiconductor Corp.) Renesas Electronics USB 3.0 Host Controller Driver (HKLM-x32\...\InstallShield_{5442DAB8-7177-49E1-8B22-09A049EA5996}) (Version: 2.0.32.0 - Renesas Electronics Corporation) Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 2.0.32.0 - Renesas Electronics Corporation) Hidden Roxio Creator Starter (HKLM-x32\...\{6F0BBEFE-BE1C-419B-BA1F-D36C9E7915BC}) (Version: 12.1.77.0 - Roxio) Roxio File Backup (Version: 1.3.2 - Roxio) Hidden Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft) Sonic CinePlayer Decoder Pack (x32 Version: 4.3.0 - Sonic Solutions) Hidden ToneSync for Windows (HKU\S-1-5-21-791955194-1637552953-539721985-1001\...\c2c9648a374f64d1) (Version: 1.2.3.309 - Zedge Europe AS) TrustedID (HKLM-x32\...\{C16A92EF-017B-4839-9C75-FBADB5A1FA27}) (Version: 5.0 - TrustedID) Unchecky v0.4.2 (HKLM-x32\...\Unchecky) (Version: 0.4.2 - RaMMicHaeL) Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3508.1109 - Microsoft Corporation) Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation) WOT for Internet Explorer (HKLM\...\{373B90E1-A28C-434C-92B6-7281AFA6115A}) (Version: 15.6.9.0 - WOT Services Oy) ==================== Custom CLSID (Whitelisted): ========================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) ==================== Scheduled Tasks (Whitelisted) ============= (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) Task: {06F7A120-109A-4D05-9156-6B98322E00EA} - System32\Tasks\PCDoctorBackgroundMonitorTask => C:\Program Files\Dell\SupportAssist\uaclauncher.exe [2016-08-02] (PC-Doctor, Inc.) Task: {1031EF6E-4F63-4949-BFB1-72B73FEF8D0C} - System32\Tasks\PCDDataUploadTask => uaclauncher.exe Task: {225D8623-CCD0-4251-9603-97D4020C6986} - System32\Tasks\{1C24AA12-39B1-4B82-92D1-906D1878F75F} => pcalua.exe -a "C:\Users\Quintin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GY0ZFKYP\adguardInstaller.exe" -d C:\Users\Quintin\Desktop Task: {5BFEFFD9-D474-4A94-90BE-C0CBDF553F17} - \SaveDailyDeals\Updater\SaveDailyDeals updater -> No File Task: {62CAF204-B1AA-4F45-8764-99F54EBF790F} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-791955194-1637552953-539721985-1001UA => C:\Users\Quintin\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-07-11] (Facebook Inc.) Task: {68518828-3095-4577-8A93-EE7C055A3B28} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.) Task: {7C521014-C3D7-4988-9DC5-F2850EEF7BD9} - System32\Tasks\Dell SupportAssistAgent AutoUpdate => C:\Program Files (x86)\Dell\SupportAssistAgent\bin\SupportAssist.exe [2016-03-14] (Dell Inc.) Task: {91DBF53C-39D4-45A8-9167-A2EBB08785A0} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-02-08] (Google Inc.) Task: {9493F0D0-DBA4-4142-8774-B1677444C496} - System32\Tasks\{8580FEA6-DE0B-4CA7-A521-6ADDC2B03F13} => Iexplore.exe hxxp://ui.skype.com/ui/0/6.14.0.104/en/abandoninstall?page=tsProgressBar Task: {A986A591-C19F-430E-98D9-A5CB7E13EFE9} - System32\Tasks\PCDEventLauncherTask => C:\Program Files\Dell\SupportAssist\sessionchecker.exe [2016-08-02] (PC-Doctor, Inc.) Task: {AEDA5B93-33B8-4985-AA0A-A3AA57F884E6} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-02-08] (Google Inc.) Task: {DB644552-2130-4910-AB44-AC76E70A5FBB} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-791955194-1637552953-539721985-1001Core => C:\Users\Quintin\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-07-11] (Facebook Inc.) Task: {F963BC21-0FE7-4439-964B-DF85B6BA90A4} - System32\Tasks\SystemToolsDailyTest => uaclauncher.exe Task: {FF0B0A5D-D0A4-49FE-AA0A-ED721884E25E} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2016-09-20] (Adobe Systems Incorporated) (If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.) Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe Task: C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-791955194-1637552953-539721985-1001Core.job => C:\Users\Quintin\AppData\Local\Facebook\Update\FacebookUpdate.exe Task: C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-791955194-1637552953-539721985-1001UA.job => C:\Users\Quintin\AppData\Local\Facebook\Update\FacebookUpdate.exe Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe ==================== Shortcuts ============================= (The entries could be listed to be restored or removed.) ==================== Loaded Modules (Whitelisted) ============== 2011-07-27 21:07 - 2011-07-27 21:07 - 01501696 _____ () C:\Program Files\Common Files\Intel\WirelessCommon\Libeay32.dll 2011-09-13 14:36 - 2011-04-10 14:40 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll 2011-07-27 21:07 - 2011-07-27 21:07 - 01501696 _____ () C:\Program Files\Common Files\Intel\WirelessCommon\LIBEAY32.dll 2011-04-29 19:17 - 2011-04-29 19:17 - 02055016 _____ () C:\Program Files (x86)\Dell Stage\Dell Stage\stage_primary.exe 2010-11-17 11:35 - 2010-11-17 11:35 - 00514544 _____ () C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe 2011-09-13 12:45 - 2011-08-18 11:05 - 02751808 _____ () C:\Program Files (x86)\Dell DataSafe Local Backup\COMPONENTS\SCHEDULER\STSERVICE.EXE 2011-04-29 19:18 - 2011-04-29 19:18 - 00885760 _____ () C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe 2011-04-29 19:17 - 2011-04-29 19:17 - 01717096 _____ () C:\Program Files (x86)\Dell Stage\Dell Stage\stage_secondary.exe 2016-09-19 12:02 - 2016-08-01 15:37 - 00553720 _____ () C:\Program Files\Dell\SupportAssist\libAsapiCSharp.dll 2016-09-19 12:02 - 2016-08-01 15:37 - 00111352 _____ () C:\Program Files\Dell\SupportAssist\libCSharpCommonCS.dll 2016-09-19 12:02 - 2016-08-01 15:37 - 00086776 _____ () C:\Program Files\Dell\SupportAssist\libDataStoreCSharp.dll 2014-04-23 16:05 - 2014-04-23 16:05 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll 2014-04-23 16:04 - 2014-04-23 16:04 - 01044808 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll 2011-04-29 19:13 - 2011-04-29 19:13 - 07938048 _____ () C:\Program Files (x86)\Dell Stage\Dell Stage\QtGui4.dll 2011-04-29 19:13 - 2011-04-29 19:13 - 02225664 _____ () C:\Program Files (x86)\Dell Stage\Dell Stage\QtCore4.dll 2010-11-24 23:44 - 2010-11-24 23:44 - 00375280 _____ () c:\program files (x86)\common files\roxio shared\dllshared\SQLite352.dll 2011-04-29 19:13 - 2011-04-29 19:13 - 07938048 _____ () C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\QtGui4.dll 2011-04-29 19:13 - 2011-04-29 19:13 - 02225664 _____ () C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\QtCore4.dll 2014-12-13 04:37 - 2014-12-13 04:37 - 00169472 _____ () C:\windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\93182e9779b8be0f688fd0784df6d7fb\IsdiInterop.ni.dll 2011-09-13 12:07 - 2010-11-06 00:50 - 00058880 _____ () C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IsdiInterop.dll ==================== Alternate Data Streams (Whitelisted) ========= (If an entry is included in the fixlist, only the ADS will be removed.) ==================== Safe Mode (Whitelisted) =================== (If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.) HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys => ""="Driver" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\GoToAssist => ""="Service" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys => ""="Driver" ==================== Association (Whitelisted) =============== (If an entry is included in the fixlist, the registry item will be restored to default or removed.) ==================== Internet Explorer trusted/restricted =============== (If an entry is included in the fixlist, it will be removed from the registry.) ==================== Hosts content: ========================== (If needed Hosts: directive could be included in the fixlist to reset Hosts.) 2009-07-13 22:34 - 2016-09-20 12:00 - 00002024 ____A C:\windows\system32\Drivers\etc\hosts 0.0.0.0 0.0.0.0 # fix for traceroute and netstat display anomaly 0.0.0.0 tracking.opencandy.com.s3.amazonaws.com 0.0.0.0 media.opencandy.com 0.0.0.0 cdn.opencandy.com 0.0.0.0 tracking.opencandy.com 0.0.0.0 api.opencandy.com 0.0.0.0 api.recommendedsw.com 0.0.0.0 installer.betterinstaller.com 0.0.0.0 installer.filebulldog.com 0.0.0.0 d3oxtn1x3b8d7i.cloudfront.net 0.0.0.0 inno.bisrv.com 0.0.0.0 nsis.bisrv.com 0.0.0.0 cdn.file2desktop.com 0.0.0.0 cdn.goateastcach.us 0.0.0.0 cdn.guttastatdk.us 0.0.0.0 cdn.inskinmedia.com 0.0.0.0 cdn.insta.oibundles2.com 0.0.0.0 cdn.insta.playbryte.com 0.0.0.0 cdn.llogetfastcach.us 0.0.0.0 cdn.montiera.com 0.0.0.0 cdn.msdwnld.com 0.0.0.0 cdn.mypcbackup.com 0.0.0.0 cdn.ppdownload.com 0.0.0.0 cdn.riceateastcach.us 0.0.0.0 cdn.shyapotato.us 0.0.0.0 cdn.solimba.com 0.0.0.0 cdn.tuto4pc.com 0.0.0.0 cdn.appround.biz 0.0.0.0 cdn.bigspeedpro.com 0.0.0.0 cdn.bispd.com There are 4 more lines. ==================== Other Areas ============================ (Currently there is no automatic fix for this section.) HKU\S-1-5-21-791955194-1637552953-539721985-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Quintin\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg DNS Servers: 192.168.0.1 HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1) Windows Firewall is enabled. ==================== MSCONFIG/TASK MANAGER disabled items == ==================== FirewallRules (Whitelisted) =============== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) FirewallRules: [{4B19A5D2-CD7A-4DA9-AA48-9C9B3B0832A8}] => (Allow) C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe FirewallRules: [{AFF4E388-80EA-412A-9EA1-86079F7134B2}] => (Allow) C:\Program Files (x86)\Dell\VideoStage\VideoStage.exe FirewallRules: [{495E1061-8D63-4407-8265-9165157C0F5C}] => (Allow) C:\Program Files (x86)\Intel Corporation\Intel WiDi\WiDiApp.exe FirewallRules: [{C0563CCA-9EDB-444A-A2A5-C25A9297C409}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe FirewallRules: [{DF00304F-417A-4DB1-8C50-7F7E3742CBDF}] => (Allow) LPort=2869 FirewallRules: [{016EC762-411D-4F11-BD69-C3673B0895B6}] => (Allow) LPort=1900 FirewallRules: [{F48D3FB7-DCD0-43A1-8994-F48789F88223}] => (Allow) C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe FirewallRules: [{8BE98123-828B-477A-AE48-E2414DEF63C4}] => (Allow) C:\Program Files (x86)\Windows Live\Mesh\MOE.exe FirewallRules: [{8712E380-B185-49B0-98E6-F889A38EBC7B}] => (Allow) C:\Program Files\dell stage\dell stage\accuweather\accuweather.exe FirewallRules: [{8A990D55-EAA1-45B1-8F23-7DDAF4A33A92}] => (Allow) C:\Program Files\dell stage\musicstage\musicstageengine.exe FirewallRules: [{328A28CE-8217-4E31-8917-5D56586A61CE}] => (Allow) C:\Program Files\dell stage\dell stage\stage_primary.exe FirewallRules: [{07B785A0-63ED-4DFF-84DB-BE0AD0939516}] => (Allow) LPort=443 FirewallRules: [{485FA56F-7072-445B-BEA7-42E2DAEFD5E3}] => (Allow) LPort=443 FirewallRules: [{8028493D-420A-4A81-8ADD-91570701976B}] => (Allow) LPort=37674 FirewallRules: [{DF77BEF1-2EE9-4DA3-B9AF-0E3D203707C6}] => (Allow) LPort=37674 FirewallRules: [{3530C0C2-A853-44E7-BC45-7286B1B89D7C}] => (Allow) LPort=37675 FirewallRules: [{B5CAD8EE-0F6A-4730-A822-9F60FA64CD1B}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe FirewallRules: [{0BEC978B-7E32-4726-B74F-2907CD45069B}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe FirewallRules: [{1DB01A09-4B80-450D-B62E-C4CBB3BA38B0}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe FirewallRules: [{AA2EC203-656F-4BAA-BCFD-031A8C10EA6F}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe FirewallRules: [TCP Query User{696EDEA4-B659-4E29-B747-1AA92684E9E1}C:\program files (x86)\oovoo\oovoo.exe] => (Block) C:\program files (x86)\oovoo\oovoo.exe FirewallRules: [uDP Query User{B2AEE95A-2F6D-4657-82B6-46A67A5D35AB}C:\program files (x86)\oovoo\oovoo.exe] => (Block) C:\program files (x86)\oovoo\oovoo.exe FirewallRules: [{E1310681-A2E7-4097-BA96-DF038A0F2E6E}] => (Allow) C:\Program Files (x86)\iTunes\iTunes.exe FirewallRules: [{5CAA1F74-3C88-453A-BD68-A2FDDA012CB0}] => (Allow) C:\Users\Quintin\AppData\Local\Facebook\Video\Skype\FacebookVideoCalling.exe FirewallRules: [{AA8008C6-B8AD-4970-9CFF-0B507BF41E01}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe ==================== Restore Points ========================= 09-02-2016 06:51:58 Windows Update 09-02-2016 10:40:14 Dell Update: eDellRoot Removal 09-02-2016 10:41:33 Dell Update: DSD Cert Removal 06-04-2016 16:31:36 Windows Update 13-09-2016 09:40:46 Windows Update 13-09-2016 09:44:39 Removed Skype™ 7.0 13-09-2016 09:48:42 Removed Skype™ 7.0 13-09-2016 09:49:49 Removed Skype Toolbars 13-09-2016 09:51:06 Removed ooVoo 13-09-2016 09:56:57 Removed Java 6 Update 27 13-09-2016 09:57:51 Removed Java 6 Update 27 (64-bit) 18-09-2016 17:14:09 Windows Update 19-09-2016 13:28:48 Installed WOT for Internet Explorer ==================== Faulty Device Manager Devices ============= ==================== Event log errors: ========================= Application errors: ================== Error: (09/20/2016 12:00:32 PM) (Source: WinMgmt) (EventID: 10) (User: ) Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected. Error: (09/20/2016 11:52:47 AM) (Source: Application Error) (EventID: 1000) (User: ) Description: Faulting application name: esetonlinescanner_enu.exe, version: 2.0.12.0, time stamp: 0x57ac3e59 Faulting module name: esetonlinescanner_enu.exe, version: 2.0.12.0, time stamp: 0x57ac3e59 Exception code: 0xc0000005 Fault offset: 0x000361d1 Faulting process id: 0x18b8 Faulting application start time: 0x01d2134e764d9254 Faulting application path: C:\Users\Quintin\Downloads\esetonlinescanner_enu.exe Faulting module path: C:\Users\Quintin\Downloads\esetonlinescanner_enu.exe Report Id: 4641d528-7f4a-11e6-a391-ac728988983d Error: (09/20/2016 10:15:16 AM) (Source: Adguard) (EventID: 0) (User: ) Description: Switching logger to invalid state because of System.ArgumentException: Absolute path information is required. Source: mscorlib Stack trace: at System.Security.Util.StringExpressionSet.CreateListFromExpressions(String[] str, Boolean needFullPath) at System.Security.Permissions.FileIOPermission.AddPathList(FileIOPermissionAccess access, AccessControlActions control, String[] pathListOrig, Boolean checkForDuplicates, Boolean needFullPath, Boolean copyPathList) at System.Security.Permissions.FileIOPermission.AddPathList(FileIOPermissionAccess access, String[] pathListOrig, Boolean checkForDuplicates, Boolean needFullPath, Boolean copyPathList) at System.Security.Permissions.FileIOPermission..ctor(FileIOPermissionAccess access, String path) at Microsoft.VisualBasic.Logging.FileLogTraceListener.DemandWritePermission() at Microsoft.VisualBasic.Logging.FileLogTraceListener.set_Append(Boolean value) at Adguard.Commons.Utils.Logger..cctor() Error: (09/20/2016 10:14:37 AM) (Source: Adguard) (EventID: 0) (User: ) Description: Switching logger to invalid state because of System.ArgumentException: Absolute path information is required. Source: mscorlib Stack trace: at System.Security.Util.StringExpressionSet.CreateListFromExpressions(String[] str, Boolean needFullPath) at System.Security.Permissions.FileIOPermission.AddPathList(FileIOPermissionAccess access, AccessControlActions control, String[] pathListOrig, Boolean checkForDuplicates, Boolean needFullPath, Boolean copyPathList) at System.Security.Permissions.FileIOPermission.AddPathList(FileIOPermissionAccess access, String[] pathListOrig, Boolean checkForDuplicates, Boolean needFullPath, Boolean copyPathList) at System.Security.Permissions.FileIOPermission..ctor(FileIOPermissionAccess access, String path) at Microsoft.VisualBasic.Logging.FileLogTraceListener.DemandWritePermission() at Microsoft.VisualBasic.Logging.FileLogTraceListener.set_Append(Boolean value) at Adguard.Commons.Utils.Logger..cctor() Error: (09/20/2016 10:13:29 AM) (Source: WinMgmt) (EventID: 10) (User: ) Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected. Error: (09/20/2016 10:12:47 AM) (Source: Adguard) (EventID: 0) (User: ) Description: Switching logger to invalid state because of System.ArgumentException: Absolute path information is required. Source: mscorlib Stack trace: at System.Security.Util.StringExpressionSet.CreateListFromExpressions(String[] str, Boolean needFullPath) at System.Security.Permissions.FileIOPermission.AddPathList(FileIOPermissionAccess access, AccessControlActions control, String[] pathListOrig, Boolean checkForDuplicates, Boolean needFullPath, Boolean copyPathList) at System.Security.Permissions.FileIOPermission..ctor(FileIOPermissionAccess access, String path) at Microsoft.VisualBasic.Logging.FileLogTraceListener.DemandWritePermission() at Microsoft.VisualBasic.Logging.FileLogTraceListener.set_Append(Boolean value) at Adguard.Commons.Utils.Logger..cctor() Error: (09/19/2016 05:30:09 PM) (Source: WinMgmt) (EventID: 10) (User: ) Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected. Error: (09/19/2016 05:28:36 PM) (Source: Adguard) (EventID: 0) (User: ) Description: Switching logger to invalid state because of System.ArgumentException: Absolute path information is required. Source: mscorlib Stack trace: at System.Security.Util.StringExpressionSet.CreateListFromExpressions(String[] str, Boolean needFullPath) at System.Security.Permissions.FileIOPermission.AddPathList(FileIOPermissionAccess access, AccessControlActions control, String[] pathListOrig, Boolean checkForDuplicates, Boolean needFullPath, Boolean copyPathList) at System.Security.Permissions.FileIOPermission.AddPathList(FileIOPermissionAccess access, String[] pathListOrig, Boolean checkForDuplicates, Boolean needFullPath, Boolean copyPathList) at System.Security.Permissions.FileIOPermission..ctor(FileIOPermissionAccess access, String path) at Microsoft.VisualBasic.Logging.FileLogTraceListener.DemandWritePermission() at Microsoft.VisualBasic.Logging.FileLogTraceListener.set_Append(Boolean value) at Adguard.Commons.Utils.Logger..cctor() Error: (09/19/2016 05:28:28 PM) (Source: Adguard) (EventID: 0) (User: ) Description: Switching logger to invalid state because of System.ArgumentException: Absolute path information is required. Source: mscorlib Stack trace: at System.Security.Util.StringExpressionSet.CreateListFromExpressions(String[] str, Boolean needFullPath) at System.Security.Permissions.FileIOPermission.AddPathList(FileIOPermissionAccess access, AccessControlActions control, String[] pathListOrig, Boolean checkForDuplicates, Boolean needFullPath, Boolean copyPathList) at System.Security.Permissions.FileIOPermission.AddPathList(FileIOPermissionAccess access, String[] pathListOrig, Boolean checkForDuplicates, Boolean needFullPath, Boolean copyPathList) at System.Security.Permissions.FileIOPermission..ctor(FileIOPermissionAccess access, String path) at Microsoft.VisualBasic.Logging.FileLogTraceListener.DemandWritePermission() at Microsoft.VisualBasic.Logging.FileLogTraceListener.set_Append(Boolean value) at Adguard.Commons.Utils.Logger..cctor() Error: (09/19/2016 05:28:10 PM) (Source: Adguard) (EventID: 0) (User: ) Description: Switching logger to invalid state because of System.ArgumentException: Absolute path information is required. Source: mscorlib Stack trace: at System.Security.Util.StringExpressionSet.CreateListFromExpressions(String[] str, Boolean needFullPath) at System.Security.Permissions.FileIOPermission.AddPathList(FileIOPermissionAccess access, AccessControlActions control, String[] pathListOrig, Boolean checkForDuplicates, Boolean needFullPath, Boolean copyPathList) at System.Security.Permissions.FileIOPermission..ctor(FileIOPermissionAccess access, String path) at Microsoft.VisualBasic.Logging.FileLogTraceListener.DemandWritePermission() at Microsoft.VisualBasic.Logging.FileLogTraceListener.set_Append(Boolean value) at Adguard.Commons.Utils.Logger..cctor() System errors: ============= Error: (09/20/2016 11:57:30 AM) (Source: Service Control Manager) (EventID: 7031) (User: ) Description: The Adguard Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service. Error: (09/20/2016 10:52:15 AM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: The eapihdrv service failed to start due to the following error: This driver has been blocked from loading Error: (09/20/2016 10:52:15 AM) (Source: Application Popup) (EventID: 1060) (User: ) Description: \??\C:\Users\Quintin\AppData\Local\Temp\ehdrv.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver. Error: (09/20/2016 10:52:14 AM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: The eapihdrv service failed to start due to the following error: This driver has been blocked from loading Error: (09/20/2016 10:52:14 AM) (Source: Application Popup) (EventID: 1060) (User: ) Description: \??\C:\Users\Quintin\AppData\Local\Temp\ehdrv.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver. Error: (09/20/2016 10:52:14 AM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: The eapihdrv service failed to start due to the following error: This driver has been blocked from loading Error: (09/20/2016 10:52:14 AM) (Source: Application Popup) (EventID: 1060) (User: ) Description: \??\C:\Users\Quintin\AppData\Local\Temp\ehdrv.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver. Error: (09/20/2016 10:52:14 AM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: The eapihdrv service failed to start due to the following error: This driver has been blocked from loading Error: (09/20/2016 10:52:14 AM) (Source: Application Popup) (EventID: 1060) (User: ) Description: \??\C:\Users\Quintin\AppData\Local\Temp\ehdrv.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver. Error: (09/20/2016 10:52:14 AM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: The eapihdrv service failed to start due to the following error: This driver has been blocked from loading ==================== Memory info =========================== Processor: Intel® Core i5-2430M CPU @ 2.40GHz Percentage of memory in use: 33% Total physical RAM: 8099.17 MB Available physical RAM: 5355.35 MB Total Virtual: 16196.55 MB Available Virtual: 13112.21 MB ==================== Drives ================================ Drive c: (OS) (Fixed) (Total:581.42 GB) (Free:508.16 GB) NTFS ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 596.2 GB) (Disk ID: 10C622B9) Partition 1: (Not Active) - (Size=100 MB) - (Type=DE) Partition 2: (Active) - (Size=14.6 GB) - (Type=07 NTFS) Partition 3: (Not Active) - (Size=581.4 GB) - (Type=07 NTFS) ==================== End of Addition.txt ============================ # AdwCleaner v6.010 - Logfile created 18/09/2016 at 18:06:16 # Updated on 12/08/2016 by ToolsLib # Database : 2016-08-24.2 [Local] # Operating System : Windows 7 Home Premium Service Pack 1 (X64) # Username : Quintin - QUINTIN-PC # Running from : E:\_on site fixes\adwcleaner_6.010.exe # Mode: Clean # Support : https://toolslib.net/forum ***** [ Services ] ***** [-] Service deleted: YahooAUService ***** [ Folders ] ***** [-] Folder deleted: C:\Users\Quintin\AppData\Local\ArcadeParlor [-] Folder deleted: C:\Users\Quintin\AppData\LocalLow\Yahoo! Companion [-] Folder deleted: C:\Users\Quintin\AppData\LocalLow\Yahoo!\Companion [-] Folder deleted: C:\Users\Quintin\AppData\LocalLow\YahooCouponAddOn [-] Folder deleted: C:\Users\Quintin\AppData\Roaming\Yahoo!\Companion [-] Folder deleted: C:\Users\Quintin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ArcadeParlor [-] Folder deleted: C:\windows\SysNative\Tasks\savedailydeals [-] Folder deleted: C:\ProgramData\Yahoo! Companion [#] Folder deleted on reboot: C:\ProgramData\Application Data\Yahoo! Companion [-] Folder deleted: C:\Program Files (x86)\savedailydeals [-] Folder deleted: C:\Program Files (x86)\SaveValet [-] Folder deleted: C:\Program Files (x86)\Search Extensions [-] Folder deleted: C:\Program Files (x86)\Yahoo!\Companion [-] Folder deleted: C:\Users\Quintin\AppData\Local\Temp\AskSearch [-] Folder deleted: C:\Users\Quintin\AppData\Local\Temp\APNLogs [-] Folder deleted: C:\windows\SysWOW64\config\systemprofile\AppData\LocalLow\Yahoo! Companion [-] Folder deleted: C:\windows\SysWOW64\config\systemprofile\AppData\LocalLow\Yahoo!\Companion ***** [ Files ] ***** [-] File deleted: C:\Users\Public\Desktop\eBay.lnk [-] File deleted: C:\Program Files (x86)\Yahoo!\Common\unyt.exe ***** [ DLL ] ***** ***** [ WMI ] ***** ***** [ Shortcuts ] ***** ***** [ Scheduled Tasks ] ***** ***** [ Registry ] ***** [-] Key deleted: HKLM\SOFTWARE\Classes\Sample.BrowserHandler [-] Key deleted: HKLM\SOFTWARE\Classes\Sample.BrowserHandler.1 [-] Key deleted: HKLM\SOFTWARE\Classes\Sample.YTBPartnerSample [-] Key deleted: HKLM\SOFTWARE\Classes\Sample.YTBPartnerSample.1 [-] Key deleted: HKLM\SOFTWARE\Classes\YBrowserToolbar.YBrowserToolbar [-] Key deleted: HKLM\SOFTWARE\Classes\YBrowserToolbar.YBrowserToolbar.1 [-] Key deleted: HKLM\SOFTWARE\Classes\yt.CacheLoader [-] Key deleted: HKLM\SOFTWARE\Classes\yt.CacheLoader.1 [-] Key deleted: HKLM\SOFTWARE\Classes\yt.Clickstream [-] Key deleted: HKLM\SOFTWARE\Classes\yt.Clickstream.1 [-] Key deleted: HKLM\SOFTWARE\Classes\yt.YTBMButton [-] Key deleted: HKLM\SOFTWARE\Classes\yt.YTBMButton.1 [-] Key deleted: HKLM\SOFTWARE\Classes\yt.YTHelper [-] Key deleted: HKLM\SOFTWARE\Classes\yt.YTHelper.2 [-] Key deleted: HKLM\SOFTWARE\Classes\yt.YTNavAssistPlugin [-] Key deleted: HKLM\SOFTWARE\Classes\yt.YTNavAssistPlugin.1 [-] Key deleted: HKLM\SOFTWARE\Classes\yt.YToolbarBand [-] Key deleted: HKLM\SOFTWARE\Classes\yt.YToolbarBand.1 [-] Key deleted: HKLM\SOFTWARE\Classes\ytbbroker.YTBAutoSearchAssistant [-] Key deleted: HKLM\SOFTWARE\Classes\ytbbroker.YTBAutoSearchAssistant.1 [-] Key deleted: HKLM\SOFTWARE\Classes\ytbbroker.YTBAutoUpdaterAssistant [-] Key deleted: HKLM\SOFTWARE\Classes\ytbbroker.YTBAutoUpdaterAssistant.1 [-] Key deleted: HKLM\SOFTWARE\Classes\ytbbroker.YTBCustomizerAssistant [-] Key deleted: HKLM\SOFTWARE\Classes\ytbbroker.YTBCustomizerAssistant.1 [-] Key deleted: HKLM\SOFTWARE\Classes\ytbbroker.YTBGeneralAssistant [-] Key deleted: HKLM\SOFTWARE\Classes\ytbbroker.YTBGeneralAssistant.1 [-] Key deleted: HKLM\SOFTWARE\Classes\ytbbroker.YTBMessengerAssistant [-] Key deleted: HKLM\SOFTWARE\Classes\ytbbroker.YTBMessengerAssistant.1 [-] Key deleted: HKLM\SOFTWARE\Classes\ytbbroker.YTBSingleInstanceAssistant [-] Key deleted: HKLM\SOFTWARE\Classes\ytbbroker.YTBSingleInstanceAssistant.1 [-] Key deleted: HKLM\SOFTWARE\Classes\YTNavAssist.NameSpaceCF [-] Key deleted: HKLM\SOFTWARE\Classes\YTNavAssist.NameSpaceCF.1 [-] Key deleted: HKLM\SOFTWARE\Classes\YTNavAssist.NameSpacePP [-] Key deleted: HKLM\SOFTWARE\Classes\YTNavAssist.NameSpacePP.1 [-] Key deleted: [x64] HKLM\SOFTWARE\Classes\CLSID\{E16E8A02-5F7D-407E-B1DB-23A301DB5580} [-] Key deleted: [x64] HKLM\SOFTWARE\Classes\CLSID\{F0F12903-DE76-4DF7-BCDC-0A0689151189} [-] Key deleted: [x64] HKLM\SOFTWARE\Classes\Interface\{F56ACA29-1C99-40F1-AC64-2E44C4F6BC71} [-] Key deleted: [x64] HKLM\SOFTWARE\Classes\Interface\{12D3E096-0FDF-42CC-8F44-04944F9C1648} [-] Key deleted: [x64] HKLM\SOFTWARE\Classes\Interface\{22389F39-2CF4-47C4-B8B2-273BB16BF70C} [-] Key deleted: [x64] HKLM\SOFTWARE\Classes\Interface\{23E3CEB3-D63A-433E-A5D0-4DB1C501B915} [-] Key deleted: [x64] HKLM\SOFTWARE\Classes\Interface\{26A3152F-CF87-4C5B-8093-4D4B9EC084EB} [-] Key deleted: [x64] HKLM\SOFTWARE\Classes\Interface\{29E3319C-4B3C-479F-8692-BDD2CA30BEDD} [-] Key deleted: [x64] HKLM\SOFTWARE\Classes\Interface\{367BD1CD-74A3-451F-B1A4-6A2DE4129A2D} [-] Key deleted: [x64] HKLM\SOFTWARE\Classes\Interface\{49F018EE-F362-4B5B-8EC8-BCF9246ABF21} [-] Key deleted: [x64] HKLM\SOFTWARE\Classes\Interface\{63B73044-FC1A-4FE1-991B-FDBD4CDAA868} [-] Key deleted: [x64] HKLM\SOFTWARE\Classes\Interface\{7207E52B-821E-4C05-A8D6-2965B2BE77CF} [-] Key deleted: [x64] HKLM\SOFTWARE\Classes\Interface\{863FCF5D-DC39-4DA9-AF32-CB0025990EEE} [-] Key deleted: [x64] HKLM\SOFTWARE\Classes\Interface\{B09E015A-4D4E-4F8D-A436-95E19140947D} [-] Key deleted: [x64] HKLM\SOFTWARE\Classes\Interface\{B1E712C4-03AA-495F-B0F5-0F057E126E2A} [-] Key deleted: [x64] HKLM\SOFTWARE\Classes\Interface\{D13DC65C-C77B-4986-9078-DEA3D34C71BB} [-] Key deleted: [x64] HKLM\SOFTWARE\Classes\Interface\{371AD4A5-1520-4AA2-A8A4-F9AD3BAC6957} [-] Key deleted: [x64] HKLM\SOFTWARE\Classes\Interface\{7F124846-5453-4BB8-A41D-E11481FFC9DF} [-] Key deleted: [x64] HKLM\SOFTWARE\Classes\Interface\{8FD65019-BF09-45DA-AD81-E95AE911F1FD} [-] Key deleted: [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E16E8A02-5F7D-407E-B1DB-23A301DB5580} [-] Key deleted: [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F0F12903-DE76-4DF7-BCDC-0A0689151189} [-] Key deleted: HKLM\SOFTWARE\Classes\AppID\{1CAE874F-F5C7-4BCC-BA46-9AD26DF35B93} [-] Key deleted: HKLM\SOFTWARE\Classes\AppID\{EFC0651C-B6D7-49CD-A6E0-B1CE9AB5FE46} [-] Key deleted: HKLM\SOFTWARE\Classes\AppID\{7375D127-3955-4654-8E7D-1949A7A9C902} [-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4EFB-9B51-7695ECA05670} [-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{058F0E48-61CA-4964-9FBA-1978A1BB060D} [-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{18F33C35-8EF2-40D7-8BA4-932B0121B472} [-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{E16E8A02-5F7D-407E-B1DB-23A301DB5580} [-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88} [-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{F0F12903-DE76-4DF7-BCDC-0A0689151189} [-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{81017EA9-9AA8-4A6A-9734-7AF40E7D593F} [-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{1E57256D-9F39-4267-AB39-D7813D644C5A} [-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{31371420-098D-4C0E-A11E-EBEC2305DD01} [-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{3A06AA27-D94B-48C2-BB55-9FD0FF2120E3} [-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{46140CE4-76FE-440E-AE88-4C2272BC05C7} [-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{9F9C4C5C-2BA8-4E00-A697-9F710BB1026B} [-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{C60CCE95-6AF9-4E74-B66B-3212D19F1D2F} [-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{FBE30D66-39A2-4b72-8B43-6D4C335A6F34} [-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{F56ACA29-1C99-40F1-AC64-2E44C4F6BC71} [-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{12D3E096-0FDF-42CC-8F44-04944F9C1648} [-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{22389F39-2CF4-47C4-B8B2-273BB16BF70C} [-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{23E3CEB3-D63A-433E-A5D0-4DB1C501B915} [-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{26A3152F-CF87-4C5B-8093-4D4B9EC084EB} [-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{29E3319C-4B3C-479F-8692-BDD2CA30BEDD} [-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{367BD1CD-74A3-451F-B1A4-6A2DE4129A2D} [-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{49F018EE-F362-4B5B-8EC8-BCF9246ABF21} [-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{63B73044-FC1A-4FE1-991B-FDBD4CDAA868} [-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{7207E52B-821E-4C05-A8D6-2965B2BE77CF} [-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{863FCF5D-DC39-4DA9-AF32-CB0025990EEE} [-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{B09E015A-4D4E-4F8D-A436-95E19140947D} [-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{B1E712C4-03AA-495F-B0F5-0F057E126E2A} [-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{D13DC65C-C77B-4986-9078-DEA3D34C71BB} [-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{371AD4A5-1520-4AA2-A8A4-F9AD3BAC6957} [-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{7F124846-5453-4BB8-A41D-E11481FFC9DF} [-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{8FD65019-BF09-45DA-AD81-E95AE911F1FD} [-] Key deleted: HKLM\SOFTWARE\Classes\TypeLib\{003028C2-EA1C-4676-A316-B5CB50917002} [-] Key deleted: HKLM\SOFTWARE\Classes\TypeLib\{61A2027D-B837-4080-A925-6E30E10DEF32} [-] Key deleted: HKLM\SOFTWARE\Classes\TypeLib\{F6C2BABA-9E4C-425F-9AEC-24AB8F2B640D} [-] Key deleted: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670} [-] Key deleted: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E16E8A02-5F7D-407E-B1DB-23A301DB5580} [-] Key deleted: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F0F12903-DE76-4DF7-BCDC-0A0689151189} [-] Key deleted: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670} [-] Key deleted: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E16E8A02-5F7D-407E-B1DB-23A301DB5580} [-] Key deleted: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EF99BD32-C1FB-11D2-892F-0090271D4F88} [-] Key deleted: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F0F12903-DE76-4DF7-BCDC-0A0689151189} [-] Key deleted: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{02478D38-C3F9-4EFB-9B51-7695ECA05670} [-] Key deleted: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{E16E8A02-5F7D-407E-B1DB-23A301DB5580} [-] Key deleted: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EF99BD32-C1FB-11D2-892F-0090271D4F88} [-] Key deleted: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{F0F12903-DE76-4DF7-BCDC-0A0689151189} [-] Key deleted: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670} [-] Key deleted: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88} [-] Value deleted: HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{EF99BD32-C1FB-11D2-892F-0090271D4F88}] [-] Value deleted: HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{00000000-6E41-4FD3-8538-502F5495E5FC}] [-] Value deleted: HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{81017EA9-9AA8-4A6A-9734-7AF40E7D593F}] [-] Key deleted: HKU\.DEFAULT\Software\Yahoo\Companion [-] Key deleted: HKU\S-1-5-21-791955194-1637552953-539721985-1001\Software\APN [-] Key deleted: HKU\S-1-5-21-791955194-1637552953-539721985-1001\Software\AskToolbar [-] Key deleted: HKU\S-1-5-21-791955194-1637552953-539721985-1001\Software\RocketTabInstalled [-] Key deleted: HKU\S-1-5-21-791955194-1637552953-539721985-1001\Software\SaveDailyDeals [-] Key deleted: HKU\S-1-5-21-791955194-1637552953-539721985-1001\Software\SocialBit [-] Key deleted: HKU\S-1-5-21-791955194-1637552953-539721985-1001\Software\Yahoo\Companion [-] Key deleted: HKU\S-1-5-21-791955194-1637552953-539721985-1001\Software\Yahoo\YFriendsBar [-] Key deleted: HKU\S-1-5-21-791955194-1637552953-539721985-1001\Software\AppDataLow\Software\AskToolbar [-] Key deleted: HKU\S-1-5-21-791955194-1637552953-539721985-1001\Software\AppDataLow\Software\Yahoo\Companion [-] Key deleted: HKU\S-1-5-21-791955194-1637552953-539721985-1001\Software\Microsoft\Windows\CurrentVersion\Uninstall\{B74443DB-5A88-4583-860A-F0D06EF399E3} [-] Key deleted: HKCU\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-791955194-1637552953-539721985-1001\Software\SaveDailyDeals [#] Key deleted on reboot: HKU\S-1-5-18\Software\Yahoo\Companion [#] Key deleted on reboot: HKCU\Software\APN [#] Key deleted on reboot: HKCU\Software\AskToolbar [#] Key deleted on reboot: HKCU\Software\RocketTabInstalled [#] Key deleted on reboot: HKCU\Software\SaveDailyDeals [#] Key deleted on reboot: HKCU\Software\SocialBit [#] Key deleted on reboot: HKCU\Software\Yahoo\Companion [#] Key deleted on reboot: HKCU\Software\Yahoo\YFriendsBar [#] Key deleted on reboot: HKCU\Software\AppDataLow\Software\AskToolbar [#] Key deleted on reboot: HKCU\Software\AppDataLow\Software\Yahoo\Companion [-] Key deleted: HKLM\SOFTWARE\{F2E9660B-98AF-42c0-8258-9CDDF07BF95D} [-] Key deleted: HKLM\SOFTWARE\InstallIQ [-] Key deleted: HKLM\SOFTWARE\RocketTab [-] Key deleted: HKLM\SOFTWARE\Yahoo\Companion [#] Key deleted on reboot: HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{B74443DB-5A88-4583-860A-F0D06EF399E3} [-] Key deleted: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\RocketTab [-] Key deleted: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Yahoo! Companion [-] Key deleted: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Yahoo! Toolbar [-] Key deleted: HKU\S-1-5-21-791955194-1637552953-539721985-1001\Software\Microsoft\Internet Explorer\SearchScopes\{DF894452-B20A-466A-890C-D8F9061D3EB6} [#] Key deleted on reboot: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{DF894452-B20A-466A-890C-D8F9061D3EB6} [-] Key deleted: HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\ask.com [-] Key deleted: HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\bestpriceninja.com [-] Key deleted: HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\cmptch.com [-] Key deleted: HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\eshopcomp.com [-] Key deleted: HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\foxi69.tlscdn.com [-] Key deleted: HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\partners.cmptch.com [-] Key deleted: HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\pstatic.bestpriceninja.com [-] Key deleted: HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\pstatic.eshopcomp.com [-] Key deleted: HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\static.cmptch.com [-] Key deleted: HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\superfish.com [-] Key deleted: HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\tlscdn.com [-] Key deleted: HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\www.superfish.com [-] Key deleted: HKLM\SOFTWARE\Classes\AppID\yt.DLL [-] Key deleted: HKLM\SOFTWARE\Classes\AppID\ytbbroker.EXE ***** [ Web browsers ] ***** [-] [aol.com] [search Provider] Deleted: aol.com [-] [ask.com] [search Provider] Deleted: ask.com ************************* :: "Tracing" keys deleted :: Winsock settings cleared ************************* C:\AdwCleaner\AdwCleaner[C0].txt - [15590 Bytes] - [18/09/2016 18:06:16] C:\AdwCleaner\AdwCleaner[s0].txt - [15125 Bytes] - [18/09/2016 18:04:44] ########## EOF - C:\AdwCleaner\AdwCleaner[C0].txt - [15738 Bytes] ########## ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Junkware Removal Tool (JRT) by Thisisu Version: 6.9.1 (06.08.2015:1) OS: Windows 7 Home Premium x64 Ran by Quintin on Sun 09/18/2016 at 18:09:38.33 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~ Services ~~~ Tasks Successfully deleted: [Task] C:\windows\system32\tasks\PCDEventLauncherTask Successfully deleted: [Task] C:\windows\system32\tasks\PCDoctorBackgroundMonitorTask ~~~ Registry Values ~~~ Registry Keys Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{39AD0726-986D-40F9-972B-E3BFA24B7745} Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{39AD0726-986D-40F9-972B-E3BFA24B7745} Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{39AD0726-986D-40F9-972B-E3BFA24B7745} ~~~ Files ~~~ Folders Successfully deleted: [Empty Folder] C:\Users\Quintin\appdata\local\{A9058B48-689C-4E6B-9EC9-9418FDA9DBBA} Successfully deleted: [Folder] C:\ProgramData\pcdr Successfully deleted: [Folder] C:\Users\Quintin\AppData\Roaming\pcdr Successfully deleted: [Folder] C:\Users\Quintin\appdata\local\91364ae9-c95f-4397-9e62-349bec505709 [Adware.GamesBot] ~~~ Chrome [C:\Users\Quintin\appdata\local\Google\Chrome\User Data\Default\Preferences] - default search provider reset [C:\Users\Quintin\appdata\local\Google\Chrome\User Data\Default\Preferences] - Extensions Deleted: [C:\Users\Quintin\appdata\local\Google\Chrome\User Data\Default\Secure Preferences] - default search provider reset [C:\Users\Quintin\appdata\local\Google\Chrome\User Data\Default\Secure Preferences] - Extensions Deleted: [] ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Scan was completed on Sun 09/18/2016 at 18:13:28.32 End of JRT log ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
September 20, 20168 yr Hi Tony, This machine is probably OK, but it just seems a bit sluggish. There seems to be all sorts of leftovers on the system. McAfee Eset Possibly CrypoPrevent We'll sort those in the fix. One of the reasons for the sluggishness looks like the startup programs. These are not needed as they can be started manually if required: QuickSet Desktop Disc Tool Adobe Reader Speed Launcher Adobe ARM Facebook Update .... this is also running 4 tasks! (never understood why anyone would install this anyway) ZedgeToneSync These are what we term 'Users Choice' ..... it all depends on whether the user actually needs them to run: IntelTBRunOnce DellStage Dell Webcam Central RoxWatchTray This fix might help a little: Please download the attached fixlist.txt file (bottom of this post) and save it to the Desktop. NOTE. It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work. NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system Re-run FRST/FRST64 (which ever is installed ) and press the Fix button just once and wait. The tool will make a log on the Desktop (Fixlog.txt). Please post this in your next reply.fixlist.txt
September 21, 20168 yr Author FPCH Staff Thanks Starbuck. I installed CryptoPrevent. On the ESET, I haven't been able to get ESET's on-line scanner to complete a scan. It stops responding after an hour or so. At that point, it's about 98% complete as shown on the status bar.
September 21, 20168 yr Author FPCH Staff Fix result of Farbar Recovery Scan Tool (x64) Version: 20-09-2016 Ran by Quintin (21-09-2016 08:45:39) Run:1 Running from C:\Users\Quintin\Desktop Loaded Profiles: Quintin (Available Profiles: Quintin) Boot Mode: Normal ============================================== fixlist content: ***************** HKLM Group Policy restriction on software: %AppData%\*\{*}.exe HKLM Group Policy restriction on software: %AppData%\{*}.exe HKLM Group Policy restriction on software: %Temp%\wz*\{*}.exe HKLM Group Policy restriction on software: %Temp%\*.zip\{*}.exe HKLM Group Policy restriction on software: %Temp%\7z*\{*}.exe HKLM Group Policy restriction on software: %Temp%\Rar*\{*}.exe HKLM Group Policy restriction on software: %localappdata%\{*}.exe HKLM Group Policy restriction on software: %localappdata%\*\{*}.exe Winlogon\Notify\GoToAssist: C:\Program Files (x86)\Citrix\GoToAssist\514\G2AWinLogon_x64.dll [X] HKU\S-1-5-21-791955194-1637552953-539721985-1001\...\Run: [ooVoo.exe] => C:\Program Files (x86)\ooVoo\oovoo.exe /minimized ProxyServer: [s-1-5-21-791955194-1637552953-539721985-1001] => http=127.0.0.1:49168;https=127.0.0.1:49168 BHO: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre6\bin\jp2ssv.dll => No File BHO-x32: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll => No File 2016-09-19 12:06 - 2014-04-01 01:30 - 00000000 ____D C:\Program Files (x86)\SaveDailyDeals Updater 2016-09-18 17:58 - 2011-09-13 12:43 - 00000000 ____D C:\ProgramData\McAfee C:\ProgramData\fontcacheev1.dat C:\Users\Quintin\AppData\Local\Temp\libeay32.dll C:\Users\Quintin\AppData\Local\Temp\msvcr120.dll C:\Users\Quintin\AppData\Local\Temp\ose00000.exe C:\Users\Quintin\AppData\Local\Temp\setup.exe C:\Users\Quintin\AppData\Local\Temp\sqlite3.dll Task: {5BFEFFD9-D474-4A94-90BE-C0CBDF553F17} - \SaveDailyDeals\Updater\SaveDailyDeals updater -> No File Task: {06F7A120-109A-4D05-9156-6B98322E00EA} - System32\Tasks\PCDoctorBackgroundMonitorTask => C:\Program Files\Dell\SupportAssist\uaclauncher.exe [2016-08-02] (PC-Doctor, Inc.) Task: {1031EF6E-4F63-4949-BFB1-72B73FEF8D0C} - System32\Tasks\PCDDataUploadTask => uaclauncher.exe Task: {A986A591-C19F-430E-98D9-A5CB7E13EFE9} - System32\Tasks\PCDEventLauncherTask => C:\Program Files\Dell\SupportAssist\sessionchecker.exe [2016-08-02] (PC-Doctor, Inc.) Task: {F963BC21-0FE7-4439-964B-DF85B6BA90A4} - System32\Tasks\SystemToolsDailyTest => uaclauncher.exe FirewallRules: [TCP Query User{696EDEA4-B659-4E29-B747-1AA92684E9E1}C:\program files (x86)\oovoo\oovoo.exe] => (Block) C:\program files (x86)\oovoo\oovoo.exe FirewallRules: [uDP Query User{B2AEE95A-2F6D-4657-82B6-46A67A5D35AB}C:\program files (x86)\oovoo\oovoo.exe] => (Block) C:\program files (x86)\oovoo\oovoo.exe CMD: ipconfig /flushdns RemoveProxy: EmptyTemp: Hosts: ***************** HKLM Group Policy restriction on software: %AppData%\*\{*}.exe restored successfully HKLM Group Policy restriction on software: %AppData%\{*}.exe restored successfully HKLM Group Policy restriction on software: %Temp%\wz*\{*}.exe restored successfully HKLM Group Policy restriction on software: %Temp%\*.zip\{*}.exe restored successfully HKLM Group Policy restriction on software: %Temp%\7z*\{*}.exe restored successfully HKLM Group Policy restriction on software: %Temp%\Rar*\{*}.exe restored successfully HKLM Group Policy restriction on software: %localappdata%\{*}.exe restored successfully HKLM Group Policy restriction on software: %localappdata%\*\{*}.exe restored successfully "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\GoToAssist" => key removed successfully HKU\S-1-5-21-791955194-1637552953-539721985-1001\Software\Microsoft\Windows\CurrentVersion\Run\\ooVoo.exe => value removed successfully HKU\S-1-5-21-791955194-1637552953-539721985-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer => value removed successfully "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}" => key removed successfully "HKCR\CLSID\{DBC80044-A445-435b-BC74-9C25C1C588A9}" => key removed successfully "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}" => key removed successfully "HKCR\Wow6432Node\CLSID\{DBC80044-A445-435b-BC74-9C25C1C588A9}" => key removed successfully C:\Program Files (x86)\SaveDailyDeals Updater => moved successfully C:\ProgramData\McAfee => moved successfully C:\ProgramData\fontcacheev1.dat => moved successfully C:\Users\Quintin\AppData\Local\Temp\libeay32.dll => moved successfully C:\Users\Quintin\AppData\Local\Temp\msvcr120.dll => moved successfully C:\Users\Quintin\AppData\Local\Temp\ose00000.exe => moved successfully C:\Users\Quintin\AppData\Local\Temp\setup.exe => moved successfully C:\Users\Quintin\AppData\Local\Temp\sqlite3.dll => moved successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{5BFEFFD9-D474-4A94-90BE-C0CBDF553F17}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{5BFEFFD9-D474-4A94-90BE-C0CBDF553F17}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\SaveDailyDeals\Updater\SaveDailyDeals updater" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{06F7A120-109A-4D05-9156-6B98322E00EA}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{06F7A120-109A-4D05-9156-6B98322E00EA}" => key removed successfully C:\windows\System32\Tasks\PCDoctorBackgroundMonitorTask => moved successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\PCDoctorBackgroundMonitorTask" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{1031EF6E-4F63-4949-BFB1-72B73FEF8D0C}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{1031EF6E-4F63-4949-BFB1-72B73FEF8D0C}" => key removed successfully C:\windows\System32\Tasks\PCDDataUploadTask => moved successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\PCDDataUploadTask" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{A986A591-C19F-430E-98D9-A5CB7E13EFE9}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A986A591-C19F-430E-98D9-A5CB7E13EFE9}" => key removed successfully C:\windows\System32\Tasks\PCDEventLauncherTask => moved successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\PCDEventLauncherTask" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{F963BC21-0FE7-4439-964B-DF85B6BA90A4}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F963BC21-0FE7-4439-964B-DF85B6BA90A4}" => key removed successfully C:\windows\System32\Tasks\SystemToolsDailyTest => moved successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\SystemToolsDailyTest" => key removed successfully HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\TCP Query User{696EDEA4-B659-4E29-B747-1AA92684E9E1}C:\program files (x86)\oovoo\oovoo.exe => value removed successfully HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\UDP Query User{B2AEE95A-2F6D-4657-82B6-46A67A5D35AB}C:\program files (x86)\oovoo\oovoo.exe => value removed successfully ========= ipconfig /flushdns ========= Windows IP Configuration Successfully flushed the DNS Resolver Cache. ========= End of CMD: ========= ========= RemoveProxy: ========= HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value removed successfully HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value removed successfully HKU\S-1-5-21-791955194-1637552953-539721985-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value removed successfully HKU\S-1-5-21-791955194-1637552953-539721985-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value removed successfully ========= End of RemoveProxy: ========= C:\Windows\System32\Drivers\etc\hosts => moved successfully Hosts restored successfully. =========== EmptyTemp: ========== BITS transfer queue => 8388608 B DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 40259955 B Java, Flash, Steam htmlcache => 181871 B Windows/system/drivers => 1021289310 B Edge => 0 B Chrome => 383486638 B Firefox => 0 B Opera => 0 B Temp, IE cache, history, cookies, recent: Default => 0 B Public => 0 B ProgramData => 0 B systemprofile => 147237 B systemprofile32 => 76996 B LocalService => 0 B NetworkService => 18130 B Quintin => 249506762 B RecycleBin => 1765631665 B EmptyTemp: => 3.2 GB temporary data Removed. ================================ The system needed a reboot. ==== End of Fixlog 08:46:26 ====
September 21, 20168 yr Author FPCH Staff The machine is running well. Got a nice speed boost when I disabled ZedgeToneSync.
September 21, 20168 yr Hi Tony, I installed CryptoPrevent. I thought it had been installed at some point. As you know, CryptoPrevent writes Group Policies to stop the Ransomware.... What I was a bit concerned with was .... these are the CryptoPrevent Group Policies on this system: HKLM Group Policy restriction on software: %AppData%\*\{*}.exe <====== ATTENTION HKLM Group Policy restriction on software: %AppData%\{*}.exe <====== ATTENTION HKLM Group Policy restriction on software: %Temp%\wz*\{*}.exe <====== ATTENTION HKLM Group Policy restriction on software: %Temp%\*.zip\{*}.exe <====== ATTENTION HKLM Group Policy restriction on software: %Temp%\7z*\{*}.exe <====== ATTENTION HKLM Group Policy restriction on software: %Temp%\Rar*\{*}.exe <====== ATTENTION HKLM Group Policy restriction on software: %localappdata%\{*}.exe <====== ATTENTION HKLM Group Policy restriction on software: %localappdata%\*\{*}.exe <====== ATTENTION This is what I would have expected to see..... HKLM Group Policy restriction on software: *.zip*.exe <====== ATTENTION HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*\*.com <====== ATTENTION HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*.pif <====== ATTENTION HKLM Group Policy restriction on software: *.txt*.exe <====== ATTENTION HKLM Group Policy restriction on software: *.rtf*.pif <====== ATTENTION HKLM Group Policy restriction on software: *.jpeg*.scr <====== ATTENTION HKLM Group Policy restriction on software: *.wav*.com <====== ATTENTION HKLM Group Policy restriction on software: %userprofile%\AppData\*.pif <====== ATTENTION HKLM Group Policy restriction on software: %userprofile%\Appdata\Roaming\Microsoft\Windows\IEUpdate\*.exe <====== ATTENTION HKLM Group Policy restriction on software: *.jpg*.exe <====== ATTENTION HKLM Group Policy restriction on software: *.pptx*.scr <====== ATTENTION HKLM Group Policy restriction on software: *.png*.pif <====== ATTENTION HKLM Group Policy restriction on software: *.mp4*.pif <====== ATTENTION HKLM Group Policy restriction on software: *.rar*.exe <====== ATTENTION HKLM Group Policy restriction on software: *.bmp*.com <====== ATTENTION HKLM Group Policy restriction on software: *.divx*.scr <====== ATTENTION HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*\*.exe <====== ATTENTION HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*.scr <====== ATTENTION HKLM Group Policy restriction on software: *.doc*.com <====== ATTENTION HKLM Group Policy restriction on software: %allusersprofile%\*.scr <====== ATTENTION HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*\*.pif <====== ATTENTION HKLM Group Policy restriction on software: cipher.exe <====== ATTENTION HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*.pif <====== ATTENTION HKLM Group Policy restriction on software: %appdata%\*.exe <====== ATTENTION HKLM Group Policy restriction on software: *.png*.com <====== ATTENTION HKLM Group Policy restriction on software: *.pptx*.pif <====== ATTENTION HKLM Group Policy restriction on software: %userprofile%\AppData\*.scr <====== ATTENTION HKLM Group Policy restriction on software: %programdata%\Microsoft\Windows\Start Menu\Programs\Startup\*.com <====== ATTENTION HKLM Group Policy restriction on software: lsassvrtdbks.exe <====== ATTENTION HKLM Group Policy restriction on software: *.mp4*.com <====== ATTENTION HKLM Group Policy restriction on software: *.mp3*.pif <====== ATTENTION HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\*.exe <====== ATTENTION HKLM Group Policy restriction on software: *.ppt*.com <====== ATTENTION HKLM Group Policy restriction on software: %appdata%\*\*.exe <====== ATTENTION HKLM Group Policy restriction on software: *.zip*.pif <====== ATTENTION HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*\*.com <====== ATTENTION HKLM Group Policy restriction on software: *.divx*.pif <====== ATTENTION HKLM Group Policy restriction on software: %userprofile%\AppData\*.com <====== ATTENTION HKLM Group Policy restriction on software: *.rar*.pif <====== ATTENTION HKLM Group Policy restriction on software: *.pptx*.com <====== ATTENTION HKLM Group Policy restriction on software: *.wav*.scr <====== ATTENTION HKLM Group Policy restriction on software: *.rar*.com <====== ATTENTION HKLM Group Policy restriction on software: *.bmp*.pif <====== ATTENTION HKLM Group Policy restriction on software: *.pub*.scr <====== ATTENTION HKLM Group Policy restriction on software: *.xls*.com <====== ATTENTION HKLM Group Policy restriction on software: *.gif*.scr <====== ATTENTION HKLM Group Policy restriction on software: *.jpeg*.pif <====== ATTENTION HKLM Group Policy restriction on software: *.rtf*.com <====== ATTENTION HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*.scr <====== ATTENTION HKLM Group Policy restriction on software: *.xlsx*.scr <====== ATTENTION HKLM Group Policy restriction on software: *.pdf*.scr <====== ATTENTION HKLM Group Policy restriction on software: %systemdrive%\*\svchost.exe <====== ATTENTION HKLM Group Policy restriction on software: *.xlsx*.pif <====== ATTENTION HKLM Group Policy restriction on software: *.doc*.scr <====== ATTENTION HKLM Group Policy restriction on software: *.divx*.exe <====== ATTENTION HKLM Group Policy restriction on software: *.zip*.scr <====== ATTENTION HKLM Group Policy restriction on software: *.7z*.scr <====== ATTENTION HKLM Group Policy restriction on software: *.jpg*.pif <====== ATTENTION HKLM Group Policy restriction on software: *.png*.exe <====== ATTENTION HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\*.scr <====== ATTENTION HKLM Group Policy restriction on software: %userprofile%\*.scr <====== ATTENTION HKLM Group Policy restriction on software: *:\$Recycle.Bin <====== ATTENTION HKLM Group Policy restriction on software: %programdata%\*\svchost.exe <====== ATTENTION HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*\*.scr <====== ATTENTION HKLM Group Policy restriction on software: *.docx*.exe <====== ATTENTION HKLM Group Policy restriction on software: *.docx*.pif <====== ATTENTION HKLM Group Policy restriction on software: *.xlsx*.exe <====== ATTENTION HKLM Group Policy restriction on software: *.mp3*.com <====== ATTENTION HKLM Group Policy restriction on software: *?* <====== ATTENTION HKLM Group Policy restriction on software: %appdata%\*.com <====== ATTENTION HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*.exe <====== ATTENTION HKLM Group Policy restriction on software: *.mp4*.scr <====== ATTENTION HKLM Group Policy restriction on software: *.wmv*.scr <====== ATTENTION HKLM Group Policy restriction on software: %userprofile%\*.com <====== ATTENTION HKLM Group Policy restriction on software: *.txt*.pif <====== ATTENTION HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*.exe <====== ATTENTION HKLM Group Policy restriction on software: %appdata%\*\*.com <====== ATTENTION HKLM Group Policy restriction on software: syskey.exe <====== ATTENTION HKLM Group Policy restriction on software: *.docx*.com <====== ATTENTION HKLM Group Policy restriction on software: *.rar*.scr <====== ATTENTION HKLM Group Policy restriction on software: %userprofile%\AppData\Local\*.com <====== ATTENTION HKLM Group Policy restriction on software: *.wav*.exe <====== ATTENTION HKLM Group Policy restriction on software: *.pdf*.pif <====== ATTENTION HKLM Group Policy restriction on software: *.jpg*.com <====== ATTENTION HKLM Group Policy restriction on software: lsassw86s.exe <====== ATTENTION HKLM Group Policy restriction on software: *.pub*.exe <====== ATTENTION HKLM Group Policy restriction on software: %allusersprofile%\*.pif <====== ATTENTION HKLM Group Policy restriction on software: *.mp4*.exe <====== ATTENTION HKLM Group Policy restriction on software: %appdata%\*\*.pif <====== ATTENTION HKLM Group Policy restriction on software: *.txt*.com <====== ATTENTION HKLM Group Policy restriction on software: *.png*.scr <====== ATTENTION HKLM Group Policy restriction on software: *.docx*.scr <====== ATTENTION HKLM Group Policy restriction on software: vssadmin.exe <====== ATTENTION HKLM Group Policy restriction on software: *.ppt*.pif <====== ATTENTION HKLM Group Policy restriction on software: *.gif*.pif <====== ATTENTION HKLM Group Policy restriction on software: %userprofile%\AppData\*.exe <====== ATTENTION HKLM Group Policy restriction on software: *.7z*.com <====== ATTENTION HKLM Group Policy restriction on software: *.xls*.exe <====== ATTENTION HKLM Group Policy restriction on software: *.xlsx*.com <====== ATTENTION HKLM Group Policy restriction on software: C:\Users\*.exe <====== ATTENTION HKLM Group Policy restriction on software: *.avi*.scr <====== ATTENTION HKLM Group Policy restriction on software: %userprofile%\AppData\Local\*.pif <====== ATTENTION HKLM Group Policy restriction on software: %programdata%\Microsoft\Windows\Start Menu\Programs\Startup\*.exe <====== ATTENTION HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*\*.exe <====== ATTENTION HKLM Group Policy restriction on software: scsvserv.exe <====== ATTENTION HKLM Group Policy restriction on software: *.bmp*.scr <====== ATTENTION HKLM Group Policy restriction on software: *.divx*.com <====== ATTENTION HKLM Group Policy restriction on software: %appdata%\*.pif <====== ATTENTION HKLM Group Policy restriction on software: %programfiles(x86)%\*\svchost.exe <====== ATTENTION HKLM Group Policy restriction on software: *.zip*.com <====== ATTENTION HKLM Group Policy restriction on software: *.wmv*.com <====== ATTENTION HKLM Group Policy restriction on software: *.7z*.exe <====== ATTENTION HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\*.com <====== ATTENTION HKLM Group Policy restriction on software: C:\Users\*.pif <====== ATTENTION HKLM Group Policy restriction on software: %programfiles%\*\svchost.exe <====== ATTENTION HKLM Group Policy restriction on software: *.avi*.com <====== ATTENTION HKLM Group Policy restriction on software: *.doc*.exe <====== ATTENTION HKLM Group Policy restriction on software: *.bmp*.exe <====== ATTENTION HKLM Group Policy restriction on software: *.avi*.exe <====== ATTENTION HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\*.pif <====== ATTENTION HKLM Group Policy restriction on software: *.wav*.pif <====== ATTENTION HKLM Group Policy restriction on software: *.pdf*.com <====== ATTENTION HKLM Group Policy restriction on software: %userprofile%\AppData\Local\*.scr <====== ATTENTION HKLM Group Policy restriction on software: %appdata%\*.scr <====== ATTENTION HKLM Group Policy restriction on software: *.wma*.pif <====== ATTENTION HKLM Group Policy restriction on software: *.rtf*.scr <====== ATTENTION HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*.com <====== ATTENTION HKLM Group Policy restriction on software: %programdata%\Microsoft\Windows\Start Menu\Programs\Startup\*.scr <====== ATTENTION HKLM Group Policy restriction on software: %allusersprofile%\*.exe <====== ATTENTION HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*.com <====== ATTENTION HKLM Group Policy restriction on software: *.xls*.pif <====== ATTENTION HKLM Group Policy restriction on software: *.xls*.scr <====== ATTENTION HKLM Group Policy restriction on software: C:\Users\*.scr <====== ATTENTION HKLM Group Policy restriction on software: *.txt*.scr <====== ATTENTION HKLM Group Policy restriction on software: *.pub*.pif <====== ATTENTION HKLM Group Policy restriction on software: %programdata%\Microsoft\Windows\Start Menu\Programs\Startup\*.pif <====== ATTENTION HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*\*.pif <====== ATTENTION HKLM Group Policy restriction on software: *.wmv*.pif <====== ATTENTION HKLM Group Policy restriction on software: *.jpeg*.exe <====== ATTENTION HKLM Group Policy restriction on software: %appdata%\*\*.scr <====== ATTENTION HKLM Group Policy restriction on software: *.gif*.com <====== ATTENTION HKLM Group Policy restriction on software: %userprofile%\AppData\Local\*.exe <====== ATTENTION HKLM Group Policy restriction on software: *.rtf*.exe <====== ATTENTION HKLM Group Policy restriction on software: *.pptx*.exe <====== ATTENTION HKLM Group Policy restriction on software: *.wma*.scr <====== ATTENTION HKLM Group Policy restriction on software: *.gif*.exe <====== ATTENTION HKLM Group Policy restriction on software: *.jpg*.scr <====== ATTENTION HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*\*.scr <====== ATTENTION HKLM Group Policy restriction on software: *.ppt*.exe <====== ATTENTION HKLM Group Policy restriction on software: *.7z*.pif <====== ATTENTION HKLM Group Policy restriction on software: %allusersprofile%\*.com <====== ATTENTION HKLM Group Policy restriction on software: *.jpeg*.com <====== ATTENTION HKLM Group Policy restriction on software: *.avi*.pif <====== ATTENTION HKLM Group Policy restriction on software: *.wma*.com <====== ATTENTION HKLM Group Policy restriction on software: *.wma*.exe <====== ATTENTION HKLM Group Policy restriction on software: %userprofile%\*.pif <====== ATTENTION HKLM Group Policy restriction on software: *.doc*.pif <====== ATTENTION HKLM Group Policy restriction on software: *.mp3*.scr <====== ATTENTION HKLM Group Policy restriction on software: *.mp3*.exe <====== ATTENTION HKLM Group Policy restriction on software: *.wmv*.exe <====== ATTENTION HKLM Group Policy restriction on software: %userprofile%\*.exe <====== ATTENTION HKLM Group Policy restriction on software: *.pub*.com <====== ATTENTION HKLM Group Policy restriction on software: *.ppt*.scr <====== ATTENTION HKLM Group Policy restriction on software: *.pdf*.exe <====== ATTENTION Maybe it would be best to run CryptoPrevent again. Got a nice speed boost when I disabled ZedgeToneSync I thought it was a strange program..... I didn't think anyone made their own ringtones any more when they can be downloaded so easily. But it wasn't for me to question it. On the ESET, I haven't been able to get ESET's on-line scanner to complete a scan. Have you tried since the system has had a clean up? Did you disable Emsisoft first? Does it say at which file/folder it stalls? Does Emsisoft complete a full scan?
September 21, 20168 yr Author FPCH Staff I just tried the ESET scanner again. The ESET scan doesn't complete even with Emsisoft AntiMalware disabled. The Emsisoft scan finishes just fine. See the photo.
September 21, 20168 yr Hi Tony, What browser are you trying to run Eset with? It's just a thought but, The ESET Online Scanner is a 32-bit application, which means it must be run through in the 32-bit version of Internet Explorer, and as an Administrator. To do so, right-click on the Internet Explorer (32-bit) icon in the Start Menu and select "Run as administrator" from the context menu. Or use either Firefox or Chrome which almost certainly will be 32bit versions. That said, there's now a 64bit version of Chrome. So make sure you are not running the 64bit version..... Click on Google Chrome’s Main Menu button on the far right. From the context menu, click Help >> About Google Chrome. If 64-bit is not mentioned here, then you are running a 32-bit Google Chrome browser.
September 21, 20168 yr Author FPCH Staff That's the version of Chrome I'm running. 53.0.2785.116m. I tried the ESET scanner with IE (probably the 64-bit version) and with Chrome. I'm pretty sure it was Chrome that downloaded esetonlinescanner_enu.exe. I had similar results with both the IE scan and the exe that Chrome downloaded.
September 21, 20168 yr Author FPCH Staff Ran the ESET on-line scanner via IE 32-bit, Run as Administrator. Same issue.
September 21, 20168 yr Hi Tony, Ok, forget Eset Online Scanner for now. I've noticed this evening that a few others have had this problem in the last few days..... I think there's a problem at Esets end. Always seems to freeze at 80% - 98%. Let's try the new updated version of RogueKiller. Have just given this a try and it took about 50mins on my laptop. It's a very thorough scanner. Very similar to MBAM.... free version and paid version. Free version will remove anything that is found. Paid version has auto updating and access to alter scan settings. But the Free version will do us fine. Have just put this canned together..... Please download RogueKiller Anti-malware (Free) onto your desktop. Close all open programs and internet browsers. Double click on RogueKiller Anti-malware to install the tool. Vista/Windows 7/8/10 users right-click and select Run As Administrator. Select Accept the User Agreement then continue to click Next then finally click Install Click Finish . When the program opens..... click Start Scan On the next page....Click Start Scan Double check anything found and tick to select items to be removed Click Remove Selected When the items have been removed.... Click Open Report >> Open TXT. Copy and paste that report into your next reply. Thanks
September 22, 20168 yr Author FPCH Staff Thanks, Here it is. RogueKiller V12.6.3.0 (x64) [sep 19 2016] (Free) by Adlice Software mail : http://www.adlice.com/contact/ Feedback : http://forum.adlice.com Website : http://www.adlice.com/download/roguekiller/ Blog : http://www.adlice.com Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version Started in : Normal mode User : Quintin [Administrator] Started from : C:\Program Files\RogueKiller\RogueKiller64.exe Mode : Delete -- Date : 09/21/2016 20:44:08 (Duration : 00:15:24) ¤¤¤ Processes : 0 ¤¤¤ ¤¤¤ Registry : 3 ¤¤¤ [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{55518263-5D5C-464F-8199-FD4B89E8C6A1} | DhcpNameServer : 67.142.181.10 67.142.181.11 ([united States][united States]) -> Replaced () [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{55518263-5D5C-464F-8199-FD4B89E8C6A1} | DhcpNameServer : 67.142.181.10 67.142.181.11 ([united States][united States]) -> Replaced () [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Tcpip\Parameters\Interfaces\{55518263-5D5C-464F-8199-FD4B89E8C6A1} | DhcpNameServer : 67.142.181.10 67.142.181.11 ([united States][united States]) -> Replaced () ¤¤¤ Tasks : 0 ¤¤¤ ¤¤¤ Files : 0 ¤¤¤ ¤¤¤ WMI : 0 ¤¤¤ ¤¤¤ Hosts File : 0 ¤¤¤ ¤¤¤ Antirootkit : 0 (Driver: Loaded) ¤¤¤ ¤¤¤ Web browsers : 0 ¤¤¤ ¤¤¤ MBR Check : ¤¤¤ +++++ PhysicalDrive0: SAMSUNG HM641JI +++++ --- User --- [MBR] 8c805769fff726e863f1c5f6a219d23e [bSP] 8f32ea9d5fc232938f5144e2628dea57 : Windows Vista/7/8|VT.Unknown MBR Code Partition table: 0 - [XXXXXX] DELL-UTIL (0xde) [VISIBLE] Offset (sectors): 2048 | Size: 100 MB 1 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 206848 | Size: 15000 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader] 2 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 30926848 | Size: 595378 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader] User = LL1 ... OK User = LL2 ... OK
September 22, 20168 yr Author FPCH Staff Thank you. It's running well. You're the best! Also thanks for the new RogueKiller. - Tony
September 22, 20168 yr Hi Tony, Don't forget to clean up...... Step 1 Restart MBAM. Click on the History tab >> Quarantine Tick to select all items (if any there ) and then click the Delete button. Close MBAM. Step 2 Download Delfix and save it to your desktop. Ensure Remove disinfection tools is checked. Also place a checkmark next to: Create registry backup Purge system restore . Click the Run button. A reboot is required to finish the Delfix cleanup. Also thanks for the new RogueKiller. No problem. Just a quick explanation that may help you.... RogueKiller is compatible with Windows XP, Vista, 7, 8, 8.1, 10. Fully compatible 32/64 bits. The instructions I gave are for the 'Install' version. This version will work with 32bit or 64bit systems. There are separate 'portable' versions for 32bit and for 64bit which don't require that the tool is installed. You can find them here: http://www.adlice.com/download/roguekiller/ Just scroll down the page. If you need a full tutorial on the tool, there is one Here It may be of use to you. BTW: If you need to remove roguekiller antimalware ..... it'll be in the add/remove folder. But it can be left and updated/run just like MBAM. Glad I was able to help. Safe surfing.
