Broni

Administrators
  • Content count

    20,618
  • Joined

  • Last visited

  • Time Online

    10082d 14h 44m 12s

2 Followers

About Broni

  • Rank
    Malware Annihilator
  • Birthday 09/01/1954

Profile Information

  • Gender
    Male
  • Location
    Daly City, CA
  • OS
    Windows 10
  • Computer specs
    Windows 10 64-bit

    HP h8-1414 Envy
    AMD Six-Core FX-6120
    10GB of RAM
    1TB Hard drive
    AMD Radeon HD 7450 (1GB)
    dual - 27" Samsung LCD & 23" Acer S232HL LED

Profile Fields

  • Country

Recent Profile Visitors

23,349 profile views
  1. Uninstall following unwanted programs: DNS Unlocker FromDocToPDF Internet Explorer Toolbar Genieo Uninstall Helper VideoDownloadConverter Internet Explorer Toolbar WSE_Vosteran Download RogueKiller from one of the following links and save it to your Desktop: Link 1 Link 2 Close all the running programs Double click on downloaded setup.exe file to install the program. Click on Start Scan button. Click on another Start Scan button. Wait until the Status box shows Scan Finished Click on Delete. Wait until the Status box shows Deleting Finished. Click on Report and copy/paste the content of the Notepad into your next reply. RKreport.txt could also be found on your desktop. If more than one log is produced post all logs. Please download Malwarebytes Anti-Malware (MBAM) to your desktop. NOTE. If you already have MBAM 2.0 installed scroll down. Double-click mbam-setup-2.0.0.1000.exe and follow the prompts to install the program. At the end, be sure a checkmark is placed next to the following: Launch Malwarebytes Anti-Malware A 14 day trial of the Premium features is pre-selected. You may deselect this if you wish, and it will not diminish the scanning and removal capabilities of the program. Click Finish. On the Dashboard, click the 'Update Now >>' link After the update completes, click the 'Scan Now >>' button. Or, on the Dashboard, click the Scan Now >> button. If an update is available, click the Update Now button. A Threat Scan will begin. When the scan is complete, if there have been detections, click Apply Actions to allow MBAM to clean what was detected. In most cases, a restart will be required. Wait for the prompt to restart the computer to appear, then click on Yes. If you already have MBAM 2.0 installed: On the Dashboard, click the 'Update Now >>' link After the update completes, click the 'Scan Now >>' button. Or, on the Dashboard, click the Scan Now >> button. If an update is available, click the Update Now button. A Threat Scan will begin. When the scan is complete, if there have been detections, click Apply Actions to allow MBAM to clean what was detected. In most cases, a restart will be required. Wait for the prompt to restart the computer to appear, then click on Yes. How to get logs: (Export log to save as txt) After the restart once you are back at your desktop, open MBAM once more. Click on the History tab > Application Logs. Double click on the Scan Log which shows the Date and time of the scan just performed. Click 'Export'. Click 'Text file (*.txt)' In the Save File dialog box which appears, click on Desktop. In the File name: box type a name for your scan log. A message box named 'File Saved' should appear stating "Your file has been successfully exported". Click Ok Attach that saved log to your next reply. (Copy to clipboard for pasting into forum replies or tickets) After the restart once you are back at your desktop, open MBAM once more. Click on the History tab > Application Logs. Double click on the Scan Log which shows the Date and time of the scan just performed. Click 'Copy to Clipboard' Paste the contents of the clipboard into your reply. Please download AdwCleaner by Xplode onto your desktop. Close all open programs and internet browsers. Double click on adwcleaner.exe to run the tool. Click on Scan button. When the scan has finished click on Clean button. Your computer will be rebooted automatically. A text file will open after the restart. Please post the contents of that logfile with your next reply. You can find the logfile at C:\AdwCleaner[S1].txt as well. Please download Junkware Removal Tool to your desktop. Shut down your protection software now to avoid potential conflicts. Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator". The tool will open and start scanning your system. Please be patient as this can take a while to complete depending on your system's specifications. On completion, a log (JRT.txt) is saved to your desktop and will automatically open. Post the contents of JRT.txt into your next message.
  2. Additional scan result of Farbar Recovery Scan Tool (x64) Version: 28-09-2016 Ran by Jim (28-09-2016 14:16:49) Running from C:\Users\Jim\Desktop Windows 7 Home Premium Service Pack 1 (X64) (2009-12-30 22:16:24) Boot Mode: Normal ========================================================== ==================== Accounts: ============================= Administrator (S-1-5-21-2315446114-1940609226-871389059-500 - Administrator - Disabled) Guest (S-1-5-21-2315446114-1940609226-871389059-501 - Limited - Disabled) HomeGroupUser$ (S-1-5-21-2315446114-1940609226-871389059-1002 - Limited - Enabled) Jim (S-1-5-21-2315446114-1940609226-871389059-1001 - Administrator - Enabled) => C:\Users\Jim ==================== Security Center ======================== (If an entry is included in the fixlist, it will be removed.) AV: Norton Internet Security (Disabled - Out of date) {63DF5164-9100-186D-2187-8DC619EFD8BF} AV: Avast Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B} AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AS: Avast Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736} AS: Norton Internet Security (Disabled - Up to date) {D8BEB080-B73A-17E3-1B37-B6B462689202} FW: Norton Internet Security (Disabled) {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4} ==================== Installed Programs ====================== (Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.) Activate Norton Online Backup (HKLM-x32\...\{C57BCDE1-7CB9-467D-B3BA-7E119916CDC1}) (Version: 1.1.20.0 - Symantec) Activation Assistant for the 2007 Microsoft Office suites (HKLM-x32\...\Activation Assistant for the 2007 Microsoft Office suites) (Version: - Microsoft Corporation) Activation Assistant for the 2007 Microsoft Office suites (x32 Version: 1.0.1 - Microsoft Corporation) Hidden Adobe Acrobat Reader DC (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}) (Version: 15.016.20041 - Adobe Systems Incorporated) Adobe Flash Player 21 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 21.0.0.242 - Adobe Systems Incorporated) Apple Application Support (HKLM-x32\...\{B3575D00-27EF-49C2-B9E0-14B3D954E992}) (Version: 1.5.2 - Apple Inc.) Apple Mobile Device Support (HKLM\...\{439760BC-7737-4386-9B1D-A90A3E8A22EA}) (Version: 3.4.1.2 - Apple Inc.) Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.) ArcSoft Panorama Maker 5 (HKLM-x32\...\{F18046C5-1C4E-4BE1-A3D6-A6F970E2E8E8}) (Version: 5.0.1.25 - ArcSoft) ATI Catalyst Install Manager (HKLM\...\{F9F4430E-80DE-EC0F-BF8E-476352C8F954}) (Version: 3.0.765.0 - ATI Technologies, Inc.) Avast Free Antivirus (HKLM-x32\...\Avast) (Version: 12.3.2280 - AVAST Software) Bonjour (HKLM\...\{CA0D2F09-F811-48D4-843E-C87696C6A9D9}) (Version: 3.0.0.2 - Apple Inc.) ccc-core-static (x32 Version: 2010.0310.1824.32984 - ATI) Hidden Compatibility Pack for the 2007 Office system (HKLM-x32\...\{90120000-0020-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation) Concert Vault Download Manager (HKLM-x32\...\{A8AD7F7C-7EB5-4E54-99C8-6C490EF5C537}_is1) (Version: - Bill Graham Archives, LLC) CWA Reminder by We-Care.com v4.1.26.3 (HKLM-x32\...\{26B4D0E1-6F6D-48DF-8719-80276A259F7E}) (Version: 4.1.26.3 - We-Care.com) CyberLink DVD Suite Deluxe (HKLM-x32\...\InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}) (Version: 6.0.3101 - CyberLink Corp.) DirectX for Managed Code Update (Summer 2004) (x32 Version: 9.02.2904 - Microsoft) Hidden DNS Unlocker version 1.4 (HKLM-x32\...\{E1527582-8509-4011-B922-29E3FB548882}_is1) (Version: 1.4 - ) <==== ATTENTION DnsBasic 1.0 build 123 (HKLM-x32\...\DnsBasic) (Version: - ) Expert PDF 7 Reader (HKLM-x32\...\{FC279721-37A6-4777-AFD8-7A56681EBA14}) (Version: 7.0.1370.0 - Avanquest software) File Uploader (HKLM-x32\...\{237CD223-1B9D-47E8-A76C-E478B83CCEA2}) (Version: 1.2.3 - Nikon) Flash Player Pro V5.4 (HKLM-x32\...\Flash Player Pro_is1) (Version: - FlashPlayerPro.com) FromDocToPDF Internet Explorer Toolbar (HKLM-x32\...\FromDocToPDF_65bar Uninstall Internet Explorer) (Version: - Mindspark Interactive Network) <==== ATTENTION FUJIFILM MyFinePix Studio 4.1 (HKLM-x32\...\MyFinePix Studio_is1) (Version: - ) Genieo (HKU\S-1-5-21-2315446114-1940609226-871389059-1001\...\genieo) (Version: 1.0.213 - Genieo Innovation Ltd.) <==== ATTENTION Google Chrome (HKLM-x32\...\Google Chrome) (Version: 53.0.2785.116 - Google Inc.) Google Toolbar for Internet Explorer (HKLM-x32\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.7619.1252 - Google Inc.) Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden Google Update Helper (x32 Version: 1.3.31.5 - Google Inc.) Hidden Hardware Diagnostic Tools (HKLM\...\PC-Doctor for Windows) (Version: 6.0.5434.08 - PC-Doctor, Inc.) Hewlett-Packard ACLM.NET v1.2.2.3 (x32 Version: 1.00.0000 - Hewlett-Packard Company) Hidden Homepage Protection (HKLM-x32\...\Homepage Protection) (Version: - AOL Products) HP Advisor (HKLM-x32\...\{40FB8D7C-6FF8-4AF2-BC8B-0B1DB32AF04B}) (Version: 3.3.12286.3436 - Hewlett-Packard) HP Easy Backup (HKLM-x32\...\{67431FA8-4B89-42DD-A68E-30D77F6C8D99}_is1) (Version: 1.0.8.0 - Hewlett-Packard) HP Games (HKLM-x32\...\WildTangent hp Master Uninstall) (Version: 1.0.0.71 - WildTangent) HP MediaSmart Demo (HKLM-x32\...\{9DEF9686-CCB2-47B7-BF83-B49EA21FA016}) (Version: 1.00.0000 - Hewlett-Packard) HP MediaSmart DVD (HKLM-x32\...\InstallShield_{DCCAD079-F92C-44DA-B258-624FC6517A5A}) (Version: 3.0.3420 - Hewlett-Packard) HP MediaSmart Movie Themes (HKLM-x32\...\InstallShield_{3023EBDA-BF1B-4831-B347-E5018555F26E}) (Version: 3.0.3102 - Hewlett-Packard) HP MediaSmart Music/Photo/Video (HKLM-x32\...\InstallShield_{B2EE25B9-5B00-4ACF-94F0-92433C28C39E}) (Version: 3.1.3601 - Hewlett-Packard) HP MediaSmart SmartMenu (HKLM\...\{26280024-DFB7-4967-90DB-7F9C6660D01E}) (Version: 3.0.28.2 - Hewlett-Packard) HP Odometer (HKLM-x32\...\{B8AC1A89-FFD1-4F97-8051-E505A160F562}) (Version: 2.10.0000 - Hewlett-Packard) HP Remote Solution (HKLM-x32\...\HP Remote Solution) (Version: 1.1.9.0 - TopSeed) HP Setup (HKLM-x32\...\{F3B912F5-EB57-45AA-B3D1-EB532BCF6EF8}) (Version: 1.2.3220.3079 - Hewlett-Packard) HP Support Assistant (HKLM-x32\...\{79C54A05-F146-4EA0-8A70-D4EFE6181E52}) (Version: 8.2.8.25 - Hewlett-Packard Company) HP Support Information (HKLM-x32\...\{B9A03B7B-E0FF-4FB3-BA83-762E58A1B0AA}) (Version: 10.1.0002 - Hewlett-Packard) HP Support Solutions Framework (HKLM-x32\...\{55065080-504F-43BB-BE00-36B80D7D39A5}) (Version: 12.4.18.7 - Hewlett-Packard Company) HP Update (HKLM-x32\...\{D46D081B-F60E-467E-A7C4-117B70D76731}) (Version: 5.001.000.014 - Hewlett-Packard) HydraVision (x32 Version: 4.2.162.0 - ATI Technologies Inc.) Hidden iTunes (HKLM\...\{997C9EC4-B53D-479D-81B7-0AEC8D174BA1}) (Version: 10.4.1.10 - Apple Inc.) Java 8 Update 101 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F32180101F0}) (Version: 8.0.1010.13 - Oracle Corporation) LabelPrint (HKLM-x32\...\InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.5.1901 - CyberLink Corp.) LabelPrint (x32 Version: 2.5.1901 - CyberLink Corp.) Hidden LightScribe System Software (HKLM-x32\...\{DD6C316A-FE75-4FBB-9D22-4C1920232B72}) (Version: 1.18.5.1 - LightScribe) Like 1.4 (HKLM-x32\...\Like) (Version: 1.4 - Like) McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.11.309.1 - McAfee, Inc.) Microsoft .NET Framework 4.6.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.6.01055 - Microsoft Corporation) Microsoft Live Search Toolbar (HKLM-x32\...\{DF802C05-4660-418c-970C-B988ADB1D316}) (Version: 3.0.560.0 - Microsoft Live Search Toolbar) Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft) Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft) Microsoft Office Enterprise 2007 (HKLM-x32\...\ENTERPRISE) (Version: 12.0.6612.1000 - Microsoft Corporation) Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation) Microsoft Office Home and Student 2007 (HKLM-x32\...\HOMESTUDENTR) (Version: 12.0.6612.1000 - Microsoft Corporation) Microsoft Office PowerPoint Viewer 2007 (English) (HKLM-x32\...\{95120000-00AF-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation) Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.41212.0 - Microsoft Corporation) Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (HKLM\...\{B6E3757B-5E77-3915-866A-CCFC4B8D194C}) (Version: 8.0.50727.4053 - Microsoft Corporation) Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation) Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148 (HKLM\...\{EE936C7A-EA40-31D5-9B65-8E3E089C3828}) (Version: 9.0.30729.4148 - Microsoft Corporation) Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (HKLM-x32\...\{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}) (Version: 9.0.30729.4148 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (HKLM\...\{350AA351-21FA-3270-8B7A-835434E766AD}) (Version: 9.0.21022 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation) MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation) MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation) NETGEAR A6200 Genie (HKLM-x32\...\{48E61F3E-61D4-42A3-9D29-D0CF40838779}) (Version: 18.0.0.0 - NETGEAR) Nikon Message Center (HKLM-x32\...\{D2FCC1AE-6311-47C5-8130-C6C66D77DD71}) (Version: 0.92.000 - Nikon) Nikon Transfer (HKLM-x32\...\{E9757890-7EC5-46C8-99AB-B00F07B6525C}) (Version: 1.5.2 - Nikon) Norton Internet Security (HKLM-x32\...\NIS) (Version: 16.8.3.6 - Symantec Corporation) Norton Security Scan (HKLM-x32\...\NSS) (Version: 4.3.1.3 - Symantec Corporation) NpackdCL (HKLM-x32\...\{C32CA36A-DA63-4D55-9B17-87C61033137D}) (Version: 1.18.7 - Npackd) Picture Control Utility (HKLM-x32\...\{87441A59-5E64-4096-A170-14EFE67200C3}) (Version: 1.1.9 - Nikon) PictureMover (HKLM-x32\...\{1896E712-2B3D-45eb-BCE9-542742A51032}) (Version: 3.3.1.19 - Hewlett-Packard Company) PlayMemories Home (HKLM-x32\...\{1E5C7043-09C5-4974-A69F-A5271FD82BBC}) (Version: 7.0.00.11271 - Sony Corporation) Power2Go (HKLM-x32\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.0.3101 - CyberLink Corp.) Power2Go (x32 Version: 6.0.3101 - CyberLink Corp.) Hidden PowerDirector (HKLM-x32\...\InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}) (Version: 7.0.3101 - CyberLink Corp.) PowerDirector (x32 Version: 7.0.3101 - CyberLink Corp.) Hidden PowerRecover (x32 Version: 5.5.1923 - CyberLink Corp.) Hidden QuickTime (HKLM-x32\...\{C9E14402-3631-4182-B377-6B0DFB1C0339}) (Version: 7.70.80.34 - Apple Inc.) RAIDXpert (HKLM-x32\...\InstallShield_{8B76B8E9-F773-4B75-A08C-120079EB765E}) (Version: 2.4.1540.26 - AMD) RAIDXpert (x32 Version: 2.4.1540.26 - AMD) Hidden Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5882 - Realtek Semiconductor Corp.) SafeZone Stable 1.51.2220.53 (x32 Version: 1.51.2220.53 - Avast Software) Hidden Speedly Bandwith Monitor (HKLM-x32\...\{F42A1869-5C2D-4DBB-909C-F78DF900E348}_is1) (Version: 1.0 - Speedly WebApps LTD.) Uninstall Helper (HKLM-x32\...\Uninstall Helper 2.0.1.0) (Version: 2.0.1.0 - InstallX, LLC) <==== ATTENTION Uninstall Helper (x32 Version: 2.0.1.0 - InstallX, LLC) Hidden <==== ATTENTION Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft) Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft) VideoDownloadConverter Internet Explorer Toolbar (HKLM-x32\...\VideoDownloadConverter_4zbar Uninstall Internet Explorer) (Version: - Mindspark Interactive Network) <==== ATTENTION ViewNX (HKLM-x32\...\{F007CBCE-D714-4C0B-8CE9-9B0D78116468}) (Version: 1.5.1 - Nikon) Vz In Home Agent (HKLM-x32\...\{141F2872-D2F9-4A89-95D3-E222D1CBCC56}) (Version: 7.01.20 - Verizon) Windows 7 Upgrade Advisor (HKLM-x32\...\{AB05F2C8-F608-403b-95E1-FD8ADFACD31E}) (Version: 2.0.5000.0 - Microsoft Corporation) WSE_Vosteran (HKLM-x32\...\WSE_Vosteran) (Version: - WSE_Vosteran) <==== ATTENTION ==================== Custom CLSID (Whitelisted): ========================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) ==================== Scheduled Tasks (Whitelisted) ============= (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) Task: {04557D1C-1C79-4574-A68A-7CF6E8C1C9AF} - \Microsoft\Windows\Windows Activation Technologies\ValidationTask -> No File <==== ATTENTION Task: {0A0FB6C1-077B-4C74-8BFA-31193B46FB73} - System32\Tasks\Test TimeTrigger => C:\Users\Jim\AppData\Local\Temp\Runner.exe [2012-11-02] () <==== ATTENTION Task: {0D041BC6-F27F-4A5E-B3CD-9BF4D9A08686} - System32\Tasks\Games\UpdateCheck_S-1-5-21-2315446114-1940609226-871389059-1001 Task: {1839A8FF-463C-4E8A-B017-6FD7D9DF3CD3} - System32\Tasks\GoogleUpdateTaskMachineUA1d218e2a87d8e1a => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-28] (Google Inc.) Task: {1A0DB777-F22D-4DAC-8556-F23C8800AE5D} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2016-04-22] (Adobe Systems Incorporated) Task: {26B98853-DC09-4861-9782-A1450FEE90D3} - System32\Tasks\SafeZone scheduled Autoupdate 1475081779 => C:\Program Files\AVAST Software\SZBrowser\launcher.exe [2016-08-09] (Avast Software) Task: {2D3D71A9-9D07-4FB1-836C-D55F2E8027F1} - \RocketTab -> No File <==== ATTENTION Task: {2F57269B-1E09-4E2D-AB1E-B0FDAC7D279C} - \Microsoft\Windows\WindowsBackup\ConfigNotification -> No File <==== ATTENTION Task: {3575F5F8-AFC2-4F37-ADE7-10FB73FD4B6F} - System32\Tasks\GoogleUpdateTaskMachineCore1d218e2a77a181c => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-28] (Google Inc.) Task: {3AB1F8B3-1424-491D-914F-7A8659B6879E} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-28] (Google Inc.) Task: {3E0149EE-14B8-4F92-8BF0-DAE229C044BF} - System32\Tasks\WSE_Vosteran => C:\Users\Jim\AppData\Roaming\WSE_VO~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION Task: {3E49246D-54CC-44BC-BC0F-0CAC24B53B19} - System32\Tasks\JimApostleshipsSquanderingV2 => Rundll32.exe JiujitsusDescriptions.dll,main 7 1 <==== ATTENTION Task: {45E910BD-069D-4047-AEA9-B66ABD3F3044} - \RocketTab Update Task -> No File <==== ATTENTION Task: {4913FA19-0655-4B14-B044-F89FB41B63C7} - System32\Tasks\Norton Security Scan for Jim => C:\Program Files (x86)\Norton Security Scan\Engine\4.3.1.3\Nss.exe [2015-10-16] (Symantec Corporation) Task: {560A4267-FC4C-4D4E-B561-D60B8B8CC98F} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Active Health Launcher => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPActiveHealth\ActiveHealth.exe [2016-03-02] (Hewlett-Packard) Task: {57427962-ABE0-4258-BAB9-4E1E67E76FAB} - System32\Tasks\PCDRScheduledMaintenance => C:\Program Files\PC-Doctor for Windows\pcdr5cuiw32.exe [2009-07-02] (PC-Doctor, Inc.) Task: {59F6E013-1AA2-42A1-8EE0-36940043A9E8} - System32\Tasks\CLMLSvc => c:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe [2009-12-01] (CyberLink) Task: {5FC0D737-A579-4D6F-B77A-8DE873040468} - System32\Tasks\{201B6283-4059-D4A2-62EC-A8DD4582CA3A} => Regsvr32.exe /s /n /i:"/rt" "C:\PROGRA~3\cb92a2c\6bd64317.dll" <==== ATTENTION Task: {69B0885E-C6F2-4904-8433-701239EF21C0} - System32\Tasks\NSManager => C:\Users\Jim\AppData\Local\NSManager\manager.exe [2014-03-18] () Task: {6FB07659-5D2A-469B-B75E-054F8F42C63B} - System32\Tasks\DVDAgent => c:\Program Files (x86)\Hewlett-Packard\Media\DVD\DVDAgent.exe [2009-10-20] (CyberLink Corp.) Task: {6FE07659-C4ED-428A-AB56-CBA142BDBD34} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2016-02-18] (Hewlett-Packard Company) Task: {84945224-D8CF-4693-98F4-D5B9517FD502} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-28] (Google Inc.) Task: {9987ED54-8A85-4327-92F5-A464E5B65202} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Updater => C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSSFUpdater.exe [2016-05-04] (Hewlett-Packard) Task: {9A2D1C0F-B50B-4A2F-A4E3-088D6883B66E} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2016-05-15] (Adobe Systems Incorporated) Task: {9BE12C31-95B8-44DA-B2D5-521062CD938E} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.) Task: {A8616754-4947-4B4F-A8C4-26751B2A88AD} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2016-09-28] (AVAST Software) Task: {AC4E5ACF-89F7-4220-BA21-81EE183975E2} - \Microsoft\Windows\Application Experience\AitAgent -> No File <==== ATTENTION Task: {C7C85714-1665-4E7B-ABB1-8A940DA5BEBC} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Report => C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSFReport.exe [2016-04-06] (Hewlett-Packard) Task: {CEE64558-E1A7-4D9D-80A7-2001912BE5B5} - \Microsoft\Windows\MemoryDiagnostic\CorruptionDetector -> No File <==== ATTENTION Task: {D9031980-1059-4C8D-B6E4-A5863574D144} - System32\Tasks\SlimCleaner Plus (Scheduled Scan - Jim) => C:\Program Files\SlimCleaner Plus\SlimCleanerPlus.exe Task: {D9310EDA-5099-46F7-BAB3-E811702042FA} - System32\Tasks\PriceFountainUpdateVer => C:\Users\Jim\AppData\Roaming\PRICEF~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION Task: {E3E20E2B-F4BA-4CDB-A927-1EE12AE10C4A} - System32\Tasks\DNSLOCKINGTON => C:\Program Files (x86)\DNS Unlocker\dnslockington.exe [2016-03-01] () <==== ATTENTION Task: {E74E99A3-7E88-42C7-8177-B1B23C8315BA} - System32\Tasks\Hewlett-Packard\HP Active Health\HP Active Health Scan (HPSA) => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPActiveHealth\ActiveHealth.exe [2016-03-02] (Hewlett-Packard) Task: {EEB10E4A-0FFF-4719-92B7-21F9734DEF9D} - System32\Tasks\AVAST Software\Avast settings backup => C:\Program Files\Common Files\AV\avast! Antivirus\backup.exe [2016-09-28] (AVAST Software) Task: {F31A627B-F05A-4845-AAFF-7F4336F90971} - \Microsoft\Windows\Windows Activation Technologies\ValidationTaskDeadline -> No File <==== ATTENTION Task: {FA2BC0A6-8D4B-458A-85C8-2B8C72487513} - \Microsoft\Windows\MemoryDiagnostic\DecompressionFailureDetector -> No File <==== ATTENTION (If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.) Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore1d218e2a77a181c.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA1d218e2a87d8e1a.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\Norton Security Scan for Jim.job => C:\PROGRA~2\NORTON~3\Engine\431~1.3\Nss.exe Task: C:\Windows\Tasks\PCDRScheduledMaintenance.job => C:\Program Files\PC-Doctor for Windows\pcdr5cuiw32.exe5-fh scripts\monthly.xml Task: C:\Windows\Tasks\PriceFountainUpdateVer.job => C:\Users\Jim\AppData\Roaming\PRICEF~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION Task: C:\Windows\Tasks\SlimCleaner Plus (Scheduled Scan - Jim).job => C:\Program Files\SlimCleaner Plus\SlimCleanerPlus.exe Task: C:\Windows\Tasks\WSE_Vosteran.job => C:\Users\Jim\AppData\Roaming\WSE_VO~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION ==================== Shortcuts ============================= (The entries could be listed to be restored or removed.) ShortcutWithArgument: C:\Users\Jim\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\RebateAll\RebateAll.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> hxxp://rebateall.com/activation2/?dp=0DyEzzyDyCyE0AyD0EyC0ByE0E0A0Dzz ShortcutWithArgument: C:\Users\Jim\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Genieo\Genieo.lnk -> C:\Users\Jim\AppData\Roaming\Genieo\Application\TrayUi\bin\gentray.exe () -> hxxp://127.0.0.1:1886/extensions/redirect_to_startpage ShortcutWithArgument: C:\Users\Jim\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\RebateAll.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> hxxp://rebateall.com/activation2/?dp=0DyEzzyDyCyE0AyD0EyC0ByE0E0A0Dzz ==================== Loaded Modules (Whitelisted) ============== 2009-03-16 03:47 - 2009-03-16 03:47 - 00065536 _____ () C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpert.exe 2009-09-04 11:29 - 2008-09-30 21:59 - 00192512 _____ () C:\Program Files (x86)\Hewlett-Packard\HP Easy Backup\HPBtnSrv.exe 2013-06-27 17:35 - 2012-07-27 13:27 - 00025888 _____ () C:\Program Files (x86)\NETGEAR\A6200\WifiService.exe 2009-07-08 17:35 - 2009-07-08 17:35 - 00610360 _____ () C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe 2009-05-26 04:36 - 2009-05-26 04:36 - 00656896 _____ () C:\Program Files (x86)\Hewlett-Packard\HP Remote Solution\HP_Remote_Solution.exe 2010-01-12 12:49 - 2010-01-12 12:49 - 00098304 ____R () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll 2010-04-18 09:13 - 2010-04-18 09:13 - 00270336 _____ () C:\Windows\assembly\GAC_MSIL\CLI.Aspect.CrossDisplay.Graphics.Dashboard\1.0.0.0__90ba9c70f846762e\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll 2009-03-16 03:47 - 2009-03-16 03:47 - 00122880 _____ () C:\Windows\SysWOW64\WinMsgBalloonServer.exe 2009-03-16 03:47 - 2009-03-16 03:47 - 00139264 _____ () C:\Windows\SysWOW64\WinMsgBalloonClient.exe 2009-07-13 17:03 - 2009-07-13 21:15 - 00364544 _____ () C:\Windows\SysWOW64\msjetoledb40.dll 2013-06-27 17:35 - 2012-08-08 15:46 - 00106496 _____ () C:\Program Files (x86)\NETGEAR\A6200\GWlanController.dll 2013-06-27 17:35 - 2012-07-27 19:11 - 00018944 _____ () C:\Program Files (x86)\NETGEAR\A6200\GWPSController.dll 2011-05-26 13:42 - 2011-05-26 13:42 - 00067872 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll 2016-09-28 12:54 - 2016-09-28 12:54 - 00169064 _____ () C:\Program Files\AVAST Software\Avast\JsonRpcServer.dll 2016-09-28 12:54 - 2016-09-28 12:54 - 03080312 _____ () C:\Program Files\AVAST Software\Avast\defs\16090499\algo.dll 2016-09-28 12:54 - 2016-09-28 12:54 - 00482928 _____ () C:\Program Files\AVAST Software\Avast\ffl2.dll 2016-09-28 12:55 - 2016-09-28 12:55 - 03118360 _____ () C:\Program Files\AVAST Software\Avast\defs\16092801\algo.dll 2016-09-28 12:54 - 2016-09-28 12:54 - 48936448 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll ==================== Alternate Data Streams (Whitelisted) ========= (If an entry is included in the fixlist, only the ADS will be removed.) ==================== Safe Mode (Whitelisted) =================== (If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.) HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SymEFA.sys => ""="FSFilter Activity Monitor" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SymEFA.sys => ""="FSFilter Activity Monitor" ==================== Association (Whitelisted) =============== (If an entry is included in the fixlist, the registry item will be restored to default or removed.) ==================== Internet Explorer trusted/restricted =============== (If an entry is included in the fixlist, it will be removed from the registry.) IE trusted site: HKU\S-1-5-21-2315446114-1940609226-871389059-1001\...\genieo.com -> hxxp://search.genieo.com ==================== Hosts content: =============================== (If needed Hosts: directive could be included in the fixlist to reset Hosts.) 2009-07-13 22:34 - 2016-04-07 16:49 - 00000865 ____A C:\Windows\system32\Drivers\etc\hosts 0.0.0.1 mssplus.mcafee.com ==================== Other Areas ============================ (Currently there is no automatic fix for this section.) HKU\S-1-5-21-2315446114-1940609226-871389059-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Jim\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg DNS Servers: 75.75.75.75 - 75.75.76.76 HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1) Windows Firewall is enabled. ==================== MSCONFIG/TASK MANAGER disabled items == ==================== FirewallRules (Whitelisted) =============== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) FirewallRules: [{019460B8-5075-4749-9D04-9F26EB2F6D54}] => (Allow) c:\Program Files (x86)\CyberLink\PowerDirector\PDR.EXE FirewallRules: [{11F351AB-8F91-49BE-9BC9-80C0DFDB5080}] => (Allow) C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\HPTouchSmartMusic.exe FirewallRules: [{0CAB6E91-0DF6-472F-8B28-563C83D7E908}] => (Allow) C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\HPTouchSmartPhoto.exe FirewallRules: [{157D9A58-D21A-4799-B962-2BCD18DC1F06}] => (Allow) C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\HPTouchSmartVideo.exe FirewallRules: [{FEC33458-FBA2-4CD8-AF3E-CF679E84BA72}] => (Allow) C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe FirewallRules: [{B5D1A974-A83B-42B9-9FBF-58E5BB5DC99C}] => (Allow) C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe FirewallRules: [{4C7CF1A5-7989-4349-BCBD-41EBE9BFA1F8}] => (Allow) c:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\HPTouchSmartMusic.exe FirewallRules: [{70C28E69-F702-4DDE-ADE3-787A35AC128E}] => (Allow) c:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\HPTouchSmartPhoto.exe FirewallRules: [{92503AF0-6A78-4C1D-9B8C-AD8D6CEFE825}] => (Allow) c:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\HPTouchSmartVideo.exe FirewallRules: [{F774E6EC-0D32-49BE-92E4-91983C67539C}] => (Allow) c:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe FirewallRules: [{D3F6CEFC-71B5-4B4E-9E74-59426C5BDEF2}] => (Allow) c:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe FirewallRules: [{0505C7A3-1E03-4339-8089-2B3152BA9413}] => (Allow) c:\Program Files (x86)\Hewlett-Packard\Media\DVD\HPTouchSmartMusic.exe FirewallRules: [{FE1B080E-82F8-4021-B6FA-1418B1D9CDF6}] => (Allow) c:\Program Files (x86)\Hewlett-Packard\Media\DVD\HPTouchSmartPhoto.exe FirewallRules: [{CC7BF35B-CE54-4E93-BF6C-D526CD29AFE1}] => (Allow) c:\Program Files (x86)\Hewlett-Packard\Media\DVD\HPTouchSmartVideo.exe FirewallRules: [{EC1FABAA-2991-44C1-B8B8-124E0FF83DAE}] => (Allow) c:\Program Files (x86)\Hewlett-Packard\Media\DVD\TSMAgent.exe FirewallRules: [{420300CA-BE4F-4B1C-A6C2-6B53EAC0820F}] => (Allow) c:\Program Files (x86)\Hewlett-Packard\Media\DVD\Kernel\CLML\CLMLSvc.exe FirewallRules: [{16CBA6D3-BA16-4A6E-B535-05F6F93FBC55}] => (Allow) c:\Program Files (x86)\Hewlett-Packard\Media\DVD\HPDVDSmart.exe FirewallRules: [{ED60A52D-586B-4142-AC67-3BDEE32B21D2}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe FirewallRules: [{E998E2FD-6A68-4773-8563-A17FA75B0644}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe FirewallRules: [{42910CDE-32C9-4463-B9BB-92E220D86CF7}] => (Allow) C:\Program Files (x86)\iTunes\iTunes.exe FirewallRules: [{500E04FE-3776-4EC3-BA41-9C4899CD8C10}] => (Allow) LPort=1886 FirewallRules: [{634B9D22-5E0A-4AEF-A6D4-E4C47458B314}] => (Allow) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPDeviceDetection3.exe FirewallRules: [{004B0E5B-3F30-4010-905B-5D8AD3FA1D8E}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe ==================== Restore Points ========================= 31-05-2016 08:41:12 Windows Update 08-06-2016 18:40:49 Scheduled Checkpoint 22-06-2016 15:39:42 Scheduled Checkpoint 26-08-2016 12:41:57 Scheduled Checkpoint 07-09-2016 14:48:53 Scheduled Checkpoint 14-09-2016 18:13:19 Scheduled Checkpoint 24-09-2016 13:25:27 Scheduled Checkpoint 27-09-2016 13:28:56 Windows Update 27-09-2016 18:24:37 Installed Windows 7 Upgrade Advisor ==================== Faulty Device Manager Devices ============= Name: Atheros 802.11 a/b/g/n Dualband Wireless Network Module Description: Atheros 802.11 a/b/g/n Dualband Wireless Network Module Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318} Manufacturer: Atheros Communications Inc. Service: athr Problem: : This device is disabled. (Code 22) Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions. ==================== Event log errors: ========================= Application errors: ================== Error: (09/28/2016 12:55:16 PM) (Source: SideBySide) (EventID: 33) (User: ) Description: Activation context generation failed for "C:\Program Files\AVAST Software\Avast\setup\iplugins\IStats.dll". Dependent Assembly Avast.VC110.CRT,processorArchitecture="x86",publicKeyToken="2036b14a11e83e4a",type="win32",version="11.0.60610.1" could not be found. Please use sxstrace.exe for detailed diagnosis. Error: (09/28/2016 12:48:38 PM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: mDNSCoreMachineSleep: mDNS_Unlock: Locking failure! mDNS_busy (1) != mDNS_reentrancy (0) Error: (09/28/2016 12:48:38 PM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: mDNSCoreMachineSleep: mDNS_Lock: Locking failure! mDNS_busy (1) != mDNS_reentrancy (0) Error: (09/28/2016 09:40:23 AM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: mDNSCoreMachineSleep: mDNS_Unlock: Locking failure! mDNS_busy (1) != mDNS_reentrancy (0) Error: (09/28/2016 09:40:23 AM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: mDNSCoreMachineSleep: mDNS_Lock: Locking failure! mDNS_busy (1) != mDNS_reentrancy (0) Error: (09/27/2016 03:03:14 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Faulting application name: AppIntegrator64.exe, version: 1.0.7.247, time stamp: 0x558188e3 Faulting module name: AssistMonitor64.dll, version: 1.0.7.247, time stamp: 0x558188bd Exception code: 0xc0000005 Fault offset: 0x00000000000051e0 Faulting process id: 0xd80 Faulting application start time: 0x01d218f1bc69d15d Faulting application path: C:\Program Files (x86)\FromDocToPDF_65\bar\1.bin\AppIntegrator64.exe Faulting module path: C:\Program Files (x86)\FromDocToPDF_65\bar\1.bin\AssistMonitor64.dll Report Id: 09ee850d-84e5-11e6-833a-d48564a5e6b4 Error: (09/27/2016 01:46:02 PM) (Source: Application Hang) (EventID: 1002) (User: ) Description: The program IEXPLORE.EXE version 11.0.9600.18315 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel. Process ID: 10c8 Start Time: 01d218e3979bd6b9 Termination Time: 0 Application Path: C:\Program Files\Internet Explorer\IEXPLORE.EXE Report Id: Error: (09/27/2016 01:45:59 PM) (Source: Application Hang) (EventID: 1002) (User: ) Description: The program IEXPLORE.EXE version 11.0.9600.18315 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel. Process ID: dec Start Time: 01d218e397a7bd9b Termination Time: 15 Application Path: C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE Report Id: Error: (09/27/2016 12:35:25 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Faulting application name: AppIntegrator64.exe, version: 1.0.7.247, time stamp: 0x558188e3 Faulting module name: ntdll.dll, version: 6.1.7601.23418, time stamp: 0x5708a857 Exception code: 0xc0000374 Fault offset: 0x00000000000bf262 Faulting process id: 0x10dc Faulting application start time: 0x01d218dd1de0a4c8 Faulting application path: C:\Program Files (x86)\FromDocToPDF_65\bar\1.bin\AppIntegrator64.exe Faulting module path: C:\Windows\SYSTEM32\ntdll.dll Report Id: 63c57018-84d0-11e6-b2a6-d48564a5e6b4 Error: (09/27/2016 12:21:26 PM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: mDNSCoreMachineSleep: mDNS_Unlock: Locking failure! mDNS_busy (1) != mDNS_reentrancy (0) System errors: ============= Error: (09/28/2016 10:20:37 AM) (Source: Schannel) (EventID: 4120) (User: NT AUTHORITY) Description: The following fatal alert was generated: 10. The internal error state is 10. Error: (09/27/2016 05:51:48 PM) (Source: Service Control Manager) (EventID: 7034) (User: ) Description: The Speedly FastIP service terminated unexpectedly. It has done this 1 time(s). Error: (09/27/2016 05:51:26 PM) (Source: Service Control Manager) (EventID: 7001) (User: ) Description: The Peer Networking Grouping service depends on the Peer Name Resolution Protocol service which failed to start because of the following error: %%-2140993535 Error: (09/27/2016 05:51:24 PM) (Source: Service Control Manager) (EventID: 7023) (User: ) Description: The Peer Name Resolution Protocol service terminated with the following error: %%-2140993535 Error: (09/27/2016 05:51:24 PM) (Source: PNRPSvc) (EventID: 102) (User: ) Description: The Peer Name Resolution Protocol cloud did not start because the creation of the default identity failed with error code: 0x80630801. Error: (09/27/2016 05:49:23 PM) (Source: Service Control Manager) (EventID: 7001) (User: ) Description: The Peer Networking Grouping service depends on the Peer Name Resolution Protocol service which failed to start because of the following error: %%-2140993535 Error: (09/27/2016 05:49:23 PM) (Source: Service Control Manager) (EventID: 7023) (User: ) Description: The Peer Name Resolution Protocol service terminated with the following error: %%-2140993535 Error: (09/27/2016 05:49:23 PM) (Source: PNRPSvc) (EventID: 102) (User: ) Description: The Peer Name Resolution Protocol cloud did not start because the creation of the default identity failed with error code: 0x80630801. Error: (09/27/2016 05:47:06 PM) (Source: Service Control Manager) (EventID: 7001) (User: ) Description: The Peer Networking Grouping service depends on the Peer Name Resolution Protocol service which failed to start because of the following error: %%-2140993535 Error: (09/27/2016 05:47:06 PM) (Source: Service Control Manager) (EventID: 7023) (User: ) Description: The Peer Name Resolution Protocol service terminated with the following error: %%-2140993535 ==================== Memory info =========================== Processor: AMD Phenom(tm) II X4 910 Processor Percentage of memory in use: 32% Total physical RAM: 8183.89 MB Available physical RAM: 5490.27 MB Total Virtual: 16365.97 MB Available Virtual: 12520.93 MB ==================== Drives ================================ Drive c: (HP) (Fixed) (Total:919.08 GB) (Free:769.79 GB) NTFS Drive d: (FACTORY_IMAGE) (Fixed) (Total:12.33 GB) (Free:2.22 GB) NTFS ==>[system with boot components (obtained from drive)] Drive e: (Cubensis Around World 07) (CDROM) (Total:2.5 GB) (Free:0 GB) UDF ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (Size: 931.5 GB) (Disk ID: 1549F232) Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=919.1 GB) - (Type=07 NTFS) Partition 3: (Not Active) - (Size=12.3 GB) - (Type=07 NTFS) ==================== End of Addition.txt ============================
  3. Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 28-09-2016 Ran by Jim (administrator) on JIM-PC (28-09-2016 14:16:15) Running from C:\Users\Jim\Desktop Loaded Profiles: Jim (Available Profiles: Jim) Platform: Windows 7 Home Premium Service Pack 1 (X64) Language: English (United States) Internet Explorer Version 11 (Default browser: IE) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (AMD) C:\Windows\System32\atiesrxx.exe (ArcSoft Inc.) C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (AMD) C:\Windows\System32\atieclxx.exe (AMD) C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpertService.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe () C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpert.exe (Apple Inc.) C:\Program Files (x86)\Bonjour\mDNSResponder.exe () C:\Program Files (x86)\Hewlett-Packard\HP Easy Backup\HPBtnSrv.exe (Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe (Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\16.8.3.6\ccSvcHst.exe (Sony Corporation) C:\Program Files (x86)\Sony\PlayMemories Home\PMBDeviceInfoProvider.exe () C:\Program Files (x86)\NETGEAR\A6200\WifiService.exe (Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\16.8.3.6\ccSvcHst.exe () C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe ( ) C:\Program Files (x86)\VideoDownloadConverter_4z\bar\1.bin\AppIntegrator64.exe (NETGEAR,Inc.) C:\Program Files (x86)\NETGEAR\A6200\A6200.exe (Home) C:\Windows\Temp\_avast_\unp187644914.tmp (© 2015 Microsoft Corporation) C:\Users\Jim\AppData\Local\Microsoft\BingSvc\BingSvc.exe (McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.11.309\SSScheduler.exe (Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Odometer\hpsysdrv.exe () C:\Program Files (x86)\Hewlett-Packard\HP Remote Solution\HP_Remote_Solution.exe (Hewlett-Packard) C:\Program Files (x86)\hp\HP Software Update\hpwuschd2.exe (ArcSoft Inc.) C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (Nikon Corporation) C:\Program Files (x86)\Common Files\Nikon\Monitor\NkMonitor.exe (ArcSoft Inc.) C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac (Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe (Sony Corporation) C:\Program Files (x86)\Sony\PlayMemories Home\PMBVolumeWatcher.exe (VER_COMPANY_NAME) C:\Program Files (x86)\VideoDownloadConverter_4z\bar\1.bin\4zbrmon.exe (VER_COMPANY_NAME) C:\Program Files (x86)\VideoDownloadConverter_4z\bar\1.bin\4zbrmon64.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe () C:\Windows\SysWOW64\WinMsgBalloonServer.exe () C:\Windows\SysWOW64\WinMsgBalloonClient.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe (Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe (Google Inc.) C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser_32.exe (Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil64_21_0_0_242_ActiveX.exe ==================== Registry (Whitelisted) ==================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [SmartMenu] => C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe [610360 2009-07-08] () HKLM\...\Run: [GENIE] => C:\Program Files (x86)\NETGEAR\A6200\A6200.exe [7831840 2012-08-07] (NETGEAR,Inc.) HKLM\...\Run: [LanuchApp] => C:\Program Files (x86)\NETGEAR\A6200\LanuchApp.exe [15136 2012-07-11] () HKLM-x32\...\Run: [hpsysdrv] => c:\program files (x86)\hewlett-packard\HP odometer\hpsysdrv.exe [62768 2008-11-20] (Hewlett-Packard) HKLM-x32\...\Run: [HP Remote Solution] => C:\Program Files (x86)\Hewlett-Packard\HP Remote Solution\HP_Remote_Solution.exe [656896 2009-05-26] () HKLM-x32\...\Run: [HP Software Update] => c:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [54576 2008-12-08] (Hewlett-Packard) HKLM-x32\...\Run: [] => [X] HKLM-x32\...\Run: [NortonOnlineBackupReminder] => C:\Program Files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe [581480 2009-05-12] (Symantec Corporation) HKLM-x32\...\Run: [UpdatePRCShortCut] => C:\Program Files (x86)\Hewlett-Packard\Recovery\MUITransfer\MUIStartMenu.exe [222504 2009-05-20] (CyberLink Corp.) HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation) HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-03-10] (Advanced Micro Devices, Inc.) HKLM-x32\...\Run: [ArcSoft Connection Service] => C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe [207424 2010-10-27] (ArcSoft Inc.) HKLM-x32\...\Run: [Nikon Transfer Monitor] => C:\Program Files (x86)\Common Files\Nikon\Monitor\NkMonitor.exe [479232 2009-09-15] (Nikon Corporation) HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2011-07-05] (Apple Inc.) HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [421736 2011-08-19] (Apple Inc.) HKLM-x32\...\Run: [PMBVolumeWatcher] => C:\Program Files (x86)\Sony\PlayMemories Home\PMBVolumeWatcher.exe [739936 2012-11-27] (Sony Corporation) HKLM-x32\...\Run: [VideoDownloadConverter EPM Support] => C:\Program Files (x86)\VideoDownloadConverter_4z\bar\1.bin\4zmedint.exe [12872 2014-02-09] (Mindspark Interactive Network, Inc.) HKLM-x32\...\Run: [VideoDownloadConverter_4z Browser Plugin Loader] => C:\Program Files (x86)\VideoDownloadConverter_4z\bar\1.bin\4zbrmon.exe [61512 2014-02-09] (VER_COMPANY_NAME) HKLM-x32\...\Run: [VideoDownloadConverter_4z Browser Plugin Loader 64] => C:\Program Files (x86)\VideoDownloadConverter_4z\bar\1.bin\4zbrmon64.exe [71752 2014-02-09] (VER_COMPANY_NAME) HKLM-x32\...\Run: [FromDocToPDF EPM Support] => C:\Program Files (x86)\FromDocToPDF_65\bar\1.bin\65medint.exe [12824 2015-07-01] (Mindspark) HKLM-x32\...\Run: [FromDocToPDF AppIntegrator 32-bit] => C:\Program Files (x86)\FromDocToPDF_65\bar\1.bin\AppIntegrator.exe [230424 2015-07-01] (Mindspark) HKLM-x32\...\Run: [FromDocToPDF AppIntegrator 64-bit] => C:\Program Files (x86)\FromDocToPDF_65\bar\1.bin\AppIntegrator64.exe [265752 2015-07-01] (Mindspark) HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [598552 2016-06-22] (Oracle Corporation) HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [9103976 2016-09-28] (AVAST Software) HKU\S-1-5-21-2315446114-1940609226-871389059-1001\...\Run: [BingSvc] => C:\Users\Jim\AppData\Local\Microsoft\BingSvc\BingSvc.exe [144008 2016-03-30] (© 2015 Microsoft Corporation) HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [301568 2013-05-22] (Microsoft Corporation) ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2016-09-28] (AVAST Software) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk [2016-04-07] ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.11.309\SSScheduler.exe (McAfee, Inc.) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\PictureMover.lnk [2009-09-04] ShortcutTarget: PictureMover.lnk -> C:\Program Files (x86)\PictureMover\Bin\PictureMover.exe (Hewlett-Packard Company) BootExecute: autocheck autochk * aswBoot.exe /M:1ae2b93075d /wow /dir:"C:\Program Files\AVAST Software\Avast" GroupPolicy\User: Restriction <======= ATTENTION CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) Hosts: 0.0.0.1 mssplus.mcafee.com Tcpip\Parameters: [DhcpNameServer] 75.75.75.75 75.75.76.76 Tcpip\Parameters: [NameServer] 82.163.143.171 82.163.142.173 Tcpip\..\Interfaces\{3F15B4B8-496F-4121-AD1B-5162465E2AEF}: [DhcpNameServer] 75.75.75.75 75.75.76.76 Tcpip\..\Interfaces\{4E9E9965-AC80-44BB-B8F8-8EA14267791C}: [NameServer] 8.38.77.107,5.79.84.141 Tcpip\..\Interfaces\{4E9E9965-AC80-44BB-B8F8-8EA14267791C}: [DhcpNameServer] 75.75.76.76 75.75.75.75 Tcpip\..\Interfaces\{89C0993D-28CD-4FFE-9FF0-76DE86D3212C}: [NameServer] 8.38.77.107,5.79.84.141 Tcpip\..\Interfaces\{89C0993D-28CD-4FFE-9FF0-76DE86D3212C}: [DhcpNameServer] 75.75.76.76 75.75.75.75 Internet Explorer: ================== HKU\S-1-5-21-2315446114-1940609226-871389059-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://securityresponse.symantec.com/avcenter/fix_homepage/ HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=5.5&ar=msnhome HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=5.5&ar=msnhome HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://securityresponse.symantec.com/avcenter/fix_homepage/ HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://search.msn.com/spbasic.htm HKU\S-1-5-19\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=5.5&ar=msnhome HKU\S-1-5-19\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKU\S-1-5-19\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://securityresponse.symantec.com/avcenter/fix_homepage/ HKU\S-1-5-19\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKU\S-1-5-19\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://search.msn.com/spbasic.htm HKU\S-1-5-20\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=5.5&ar=msnhome HKU\S-1-5-20\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKU\S-1-5-20\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://securityresponse.symantec.com/avcenter/fix_homepage/ HKU\S-1-5-20\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKU\S-1-5-20\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://search.msn.com/spbasic.htm HKU\S-1-5-21-2315446114-1940609226-871389059-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_US&c=94&bd=Pavilion&pf=cndt HKU\S-1-5-21-2315446114-1940609226-871389059-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=5.5&ar=msnhome HKU\S-1-5-21-2315446114-1940609226-871389059-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKU\S-1-5-21-2315446114-1940609226-871389059-1001\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKU\S-1-5-21-2315446114-1940609226-871389059-1001\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://search.msn.com/spbasic.htm HKU\S-1-5-21-2315446114-1940609226-871389059-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/?pc=UE07&ocid=UE07DHP URLSearchHook: HKU\S-1-5-21-2315446114-1940609226-871389059-1001 - (No Name) - {81017EA9-9AA8-4A6A-9734-7AF40E7D593F} - No File URLSearchHook: HKU\S-1-5-21-2315446114-1940609226-871389059-1001 - (No Name) - {93a3111f-4f74-4ed8-895e-d9708497629e} - C:\Program Files (x86)\VideoDownloadConverter_4z\bar\1.bin\4zSrcAs.dll (Mindspark) URLSearchHook: HKU\S-1-5-21-2315446114-1940609226-871389059-1001 - (No Name) - {4c60e5ab-5c68-4c59-abaa-885010b24b32} - C:\Program Files (x86)\FromDocToPDF_65\bar\1.bin\65SrcAs.dll (Mindspark) SearchScopes: HKLM -> DefaultScope {751E1E44-2443-40CE-91E5-06921FFAE97A} URL = hxxp://www.bing.com/search?q={searchTerms}&FORM=HPDTDF&pc=HPDTDF&src=IE-SearchBox SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKLM -> {070A1E7C-8DAA-4F73-BC1C-D4DCEF374C5B} URL = hxxp://www.ask.com/web?q={searchterms}&l=dis&o=ushpd SearchScopes: HKLM -> {751E1E44-2443-40CE-91E5-06921FFAE97A} URL = hxxp://www.bing.com/search?q={searchTerms}&FORM=HPDTDF&pc=HPDTDF&src=IE-SearchBox SearchScopes: HKLM -> {DC91FAFB-6CEA-49E5-BB74-9CEE75D09B77} URL = SearchScopes: HKLM -> {fcd9f10e-0daa-405f-bca0-0dd3f37c59d9} URL = SearchScopes: HKLM-x32 -> DefaultScope {1D10DBF3-DB06-4C02-9B55-B65B58CBA9A5} URL = SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKLM-x32 -> {070A1E7C-8DAA-4F73-BC1C-D4DCEF374C5B} URL = hxxp://www.ask.com/web?q={searchterms}&l=dis&o=ushpd SearchScopes: HKLM-x32 -> {48D2C190-C6E8-496D-95D4-AC34920C8AC8} URL = hxxp://www.safesear.ch/web/?type=20140329-155-sshome-ie-df&q={searchTerms} SearchScopes: HKLM-x32 -> {751E1E44-2443-40CE-91E5-06921FFAE97A} URL = hxxp://www.bing.com/search?q={searchTerms}&FORM=HPDTDF&pc=HPDTDF&src=IE-SearchBox SearchScopes: HKLM-x32 -> {cf6e4b1c-dbde-457e-9cef-ab8ecac8a5e8} URL = hxxp://search.tb.ask.com/search/GGmain.jhtml?p2=^HJ^xdm003^YYA^us&si=CJLvhpvWv7wCFedlOgodPSwAFQ&ptb=EC60D4C3-F6B1-4FED-BA51-A4CC05B9CB7C&ind=2014020913&n=780b8531&psa=&st=sb&searchfor={searchTerms} SearchScopes: HKU\.DEFAULT -> {4C4C7AAB-5854-4241-A414-E2F1EF119C4A} URL = hxxp://www.dnsbasic.com/?prt=DNSBASIC123&sp=&keywords={searchTerms} SearchScopes: HKU\S-1-5-21-2315446114-1940609226-871389059-1001 -> DefaultScope {48D2C190-C6E8-496D-95D4-AC34920C8AC8} URL = hxxp://www.bing.com/search?FORM=INCOH2&PC=IC05&PTAG=ICO-a1b7a107&q={searchTerms} SearchScopes: HKU\S-1-5-21-2315446114-1940609226-871389059-1001 -> {070A1E7C-8DAA-4F73-BC1C-D4DCEF374C5B} URL = hxxp://www.ask.com/web?q={searchterms}&l=dis&o=ushpd SearchScopes: HKU\S-1-5-21-2315446114-1940609226-871389059-1001 -> {1D10DBF3-DB06-4C02-9B55-B65B58CBA9A5} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3298566&CUI=UN71502717923516254&UM=2 SearchScopes: HKU\S-1-5-21-2315446114-1940609226-871389059-1001 -> {48D2C190-C6E8-496D-95D4-AC34920C8AC8} URL = hxxp://www.bing.com/search?FORM=INCOH2&PC=IC05&PTAG=ICO-a1b7a107&q={searchTerms} SearchScopes: HKU\S-1-5-21-2315446114-1940609226-871389059-1001 -> {4C4C7AAB-5854-4241-A414-E2F1EF119C4A} URL = hxxp://www.dnsbasic.com/?prt=dnsbsc50r1&sp=bing&keywords={searchTerms} SearchScopes: HKU\S-1-5-21-2315446114-1940609226-871389059-1001 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = SearchScopes: HKU\S-1-5-21-2315446114-1940609226-871389059-1001 -> {cf6e4b1c-dbde-457e-9cef-ab8ecac8a5e8} URL = hxxp://search.tb.ask.com/search/GGmain.jhtml?p2=^HJ^xdm003^YYA^us&si=CJLvhpvWv7wCFedlOgodPSwAFQ&ptb=EC60D4C3-F6B1-4FED-BA51-A4CC05B9CB7C&ind=2014020913&n=780b8531&psa=&st=sb&searchfor={searchTerms} SearchScopes: HKU\S-1-5-21-2315446114-1940609226-871389059-1001 -> {DC91FAFB-6CEA-49E5-BB74-9CEE75D09B77} URL = hxxp://www.safesear.ch/web/?type=20140329-155-sshome-ie-df&q={searchTerms} SearchScopes: HKU\S-1-5-21-2315446114-1940609226-871389059-1001 -> {FCAD211E-DA94-458D-84A4-71745EA804CD} URL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=UTF-8&fr=w3i&type=W3i_DS,136,0_0,Search,20130520,19890,0,18,0 SearchScopes: HKU\S-1-5-21-2315446114-1940609226-871389059-1001 -> {fcd9f10e-0daa-405f-bca0-0dd3f37c59d9} URL = hxxp://Vosteran.com/results.php?f=4&q={searchTerms}&a=vst_dnldkng_14_49_ch&cd=2XzuyEtN2Y1L1Qzuzy0C0DtAyC0Dzy0A0CzztC0E0E0A0DzztN0D0Tzu0StCtDyBtDtN1L2XzutAtFyCtFtCtDtFtCtDtN1L1CzutCyEtBzytDyD1V1BtN1L1G1B1V1N2Y1L1Qzu2SyDtC0A0FzytC0EtAtGzy0Dzz0EtGzyyB0DtCtG0EyD0D0BtGyEyB0F0Ezyzy0FtCtC0D0DtA2QtN1M1F1B2Z1V1N2Y1L1Qzu2StC0FyCyBtC0CyD0BtGzytD0FzytGyEtC0C0CtG0AyCtByCtGyE0EtDyB0F0EtBtCzzzyyC0E2Q&cr=1770978288&ir= BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2016-09-28] (AVAST Software) BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2016-04-21] (Google Inc.) BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll [2016-02-25] (HP) BHO-x32: No Name -> {02478D38-C3F9-4efb-9B51-7695ECA05670} -> No File BHO-x32: Like.BHO -> {2159cb25-ef9a-54c1-b43c-e30d1a4a8277} -> C:\Windows\system32\mscoree.dll [2010-11-04] (Microsoft Corporation) BHO-x32: No Name -> {312f84fb-8970-4fd3-bddb-7012eac4afc9} -> No File BHO-x32: Symantec NCO BHO -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton Internet Security\Engine\16.8.3.6\coIEPlg.dll [2011-09-21] (Symantec Corporation) BHO-x32: Symantec Intrusion Prevention -> {6D53EC84-6AAE-4787-AEEE-F4628F01010C} -> C:\Program Files (x86)\Norton Internet Security\Engine\16.8.3.6\IPSBHO.DLL [2009-08-22] (Symantec Corporation) BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation) BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_101\bin\ssv.dll [2016-09-27] (Oracle Corporation) BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2016-09-28] (AVAST Software) BHO-x32: No Name -> {a235e1e3-6296-4710-af39-104a7faa6c7c} -> No File BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2016-04-21] (Google Inc.) BHO-x32: Microsoft Live Search Toolbar Helper -> {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -> c:\Program Files (x86)\MSN\Toolbar\3.0.0560.0\msneshellx.dll [2009-04-07] (Microsoft Corp.) BHO-x32: WeCareReminder Class -> {D824F0DE-3D60-4F57-9EB1-66033ECD8ABB} -> C:\ProgramData\WeCareReminder\IEHelperv2.5.0.dll [2014-01-21] (We-Care.com) BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_101\bin\jp2ssv.dll [2016-09-27] (Oracle Corporation) BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll [2016-02-25] (HP) Toolbar: HKLM - No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} - No File Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2016-04-21] (Google Inc.) Toolbar: HKLM-x32 - Microsoft Live Search Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - c:\Program Files (x86)\MSN\Toolbar\3.0.0560.0\msneshellx.dll [2009-04-07] (Microsoft Corp.) Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\16.8.3.6\coIEPlg.dll [2011-09-21] (Symantec Corporation) Toolbar: HKLM-x32 - No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} - No File Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2016-04-21] (Google Inc.) Toolbar: HKU\S-1-5-21-2315446114-1940609226-871389059-1001 -> No Name - {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File Toolbar: HKU\S-1-5-21-2315446114-1940609226-871389059-1001 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File Toolbar: HKU\S-1-5-21-2315446114-1940609226-871389059-1001 -> Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2016-04-21] (Google Inc.) DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab Handler-x32: symres - {AA1061FE-6C41-421f-9344-69640C9732AB} - C:\Program Files (x86)\Norton Internet Security\Engine\16.8.3.6\coIEPlg.dll [2011-09-21] (Symantec Corporation) StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe hxxp://www.safesear.ch/?type=20140329-155-ie-sm FireFox: ======== FF Plugin: @microsoft.com/GENUINE -> disabled [No File] FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-12] ( Microsoft Corporation) FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2011-07-29] () FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 -> C:\Windows\SysWOW64\npDeployJava1.dll [2014-03-29] (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=11.101.2 -> C:\Program Files (x86)\Java\jre1.8.0_101\bin\plugin2\npjp2.dll [2016-09-27] (Oracle Corporation) FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File] FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-12] ( Microsoft Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-09-27] (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-09-27] (Google Inc.) FF Plugin-x32: @VideoDownloadConverter_4z.com/Plugin -> C:\Program Files (x86)\VideoDownloadConverter_4z\bar\1.bin\NP4zStub.dll [2014-02-09] (Mindspark) FF Plugin-x32: @VideoDownloadConverter_ScriptHelper.com/Plugin -> C:\Program Files (x86)\VideoDownloadConverter\npVDCPlugin.dll [2013-08-26] (Mindspark) FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2016-05-03] (Adobe Systems Inc.) FF HKLM\...\Firefox\Extensions: [sp@avast.com] - C:\Program Files\AVAST Software\Avast\SafePrice\FF FF Extension: (Avast SafePrice) - C:\Program Files\AVAST Software\Avast\SafePrice\FF [2016-09-28] FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF FF Extension: (Avast Online Security) - C:\Program Files\AVAST Software\Avast\WebRep\FF [2016-09-28] FF HKLM-x32\...\Firefox\Extensions: [{7BA52691-1876-45ce-9EE6-54BCB3B04BBC}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\coFFPlgn FF Extension: (Norton Toolbar) - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\coFFPlgn [2011-10-12] [not signed] FF HKLM-x32\...\Firefox\Extensions: [{635abd67-4fe9-1b23-4f01-e679fa7484c1}] - 0\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} => not found FF HKLM-x32\...\Firefox\Extensions: [{jid1-eFRcA0eiPxecTQ@jetpack}] - 0\extensions\{jid1-eFRcA0eiPxecTQ@jetpack} => not found FF HKLM-x32\...\Firefox\Extensions: [sp@avast.com] - C:\Program Files\AVAST Software\Avast\SafePrice\FF FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF StartMenuInternet: FIREFOX.EXE - C:\Program Files (x86)\Mozilla Firefox\firefox.exe hxxp://www.safesear.ch/?type=20140329-155-ff-sm Chrome: ======= CHR HomePage: Default -> msn.com/?pc=__PARAM__&ocid=__PARAM__DHP&osmkt=en-us CHR StartupUrls: Default -> "hxxp://www.bing.com/search?FORM=INCOH1&PC=IC03&PTAG=ICO-a1b7a107" CHR DefaultSearchURL: Default -> hxxp://www.bing.com/search?FORM=INCOH2&PC=IC03&PTAG=ICO-a1b7a107&q={searchTerms} CHR DefaultSearchKeyword: Default -> search provided by bing.com CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?client=chrome&hl={language}&q={searchTerms} CHR Profile: C:\Users\Jim\AppData\Local\Google\Chrome\User Data\Default [2016-09-27] CHR Extension: (We-Care Reminder) - C:\Users\Jim\AppData\Local\Google\Chrome\User Data\Default\Extensions\ippkomaaonokjnfjoikaemidanojkfmm [2015-02-15] [UpdateUrl: hxxp://plugin.we-care.com/chrome-updates.xml] <==== ATTENTION CHR Extension: (Chrome Web Store Payments) - C:\Users\Jim\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-04-04] CHR Profile: C:\Users\Jim\AppData\Local\Google\Chrome\User Data\System Profile [2015-05-02] CHR Extension: (Google Docs) - C:\Users\Jim\AppData\Local\Google\Chrome\User Data\System Profile\Extensions\aohghmighlieiainnegkcijnfilokake [2015-05-02] CHR Extension: (Google Drive) - C:\Users\Jim\AppData\Local\Google\Chrome\User Data\System Profile\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-05-02] CHR Extension: (YouTube) - C:\Users\Jim\AppData\Local\Google\Chrome\User Data\System Profile\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-05-02] CHR Extension: (Google Search) - C:\Users\Jim\AppData\Local\Google\Chrome\User Data\System Profile\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-05-02] CHR Extension: (MixiDJ V30) - C:\Users\Jim\AppData\Local\Google\Chrome\User Data\System Profile\Extensions\fdkednngfjmpnljkolbapdednncafhen [2015-05-02] [UpdateUrl: hxxp://autoupdate.chromewebtb.conduit-services.com/sb/?productId=CT3298566&extensionData=\u003Cextension_data>] <==== ATTENTION CHR Extension: (Google Sheets) - C:\Users\Jim\AppData\Local\Google\Chrome\User Data\System Profile\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-05-02] CHR Extension: (Bookmark Manager) - C:\Users\Jim\AppData\Local\Google\Chrome\User Data\System Profile\Extensions\gmlllbghnfkpflemihljekbapjopfjik [2015-05-02] CHR Extension: (We-Care.com Reminder) - C:\Users\Jim\AppData\Local\Google\Chrome\User Data\System Profile\Extensions\ippkomaaonokjnfjoikaemidanojkfmm [2015-05-02] [UpdateUrl: hxxp://plugin.we-care.com/chrome-updates.xml] <==== ATTENTION CHR Extension: (Google Wallet) - C:\Users\Jim\AppData\Local\Google\Chrome\User Data\System Profile\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-05-02] CHR Extension: (Gmail) - C:\Users\Jim\AppData\Local\Google\Chrome\User Data\System Profile\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-05-02] CHR HKLM\...\Chrome\Extension: [Äÿ] - <no Path/update_url> CHR HKU\S-1-5-21-2315446114-1940609226-871389059-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [fcfenmboojpjinhpgggodefccipikbpd] - hxxps://clients2.google.com/service/update2/crx CHR HKU\S-1-5-21-2315446114-1940609226-871389059-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [fdkednngfjmpnljkolbapdednncafhen] - C:\Users\Jim\AppData\Local\CRE\fdkednngfjmpnljkolbapdednncafhen.crx <not found> CHR HKU\S-1-5-21-2315446114-1940609226-871389059-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [Äÿ] - <no Path/update_url> CHR HKLM-x32\...\Chrome\Extension: [fdkednngfjmpnljkolbapdednncafhen] - C:\Users\Jim\AppData\Local\CRE\fdkednngfjmpnljkolbapdednncafhen.crx <not found> CHR HKLM-x32\...\Chrome\Extension: [ippkomaaonokjnfjoikaemidanojkfmm] - C:\ProgramData\WeCareReminder\\wecarereminderro.crx [2013-09-27] CHR HKLM-x32\...\Chrome\Extension: [Äÿ] - <no Path/update_url> ==================== Services (Whitelisted) ==================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) R2 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.) R2 AMD_RAIDXpert; C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpertService.exe [122880 2009-03-16] (AMD) [File not signed] R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [197128 2016-09-28] (AVAST Software) R2 HPBtnSrv; C:\Program Files (x86)\Hewlett-Packard\HP Easy Backup\HPBtnSrv.exe [192512 2008-09-30] () [File not signed] R2 HPSupportSolutionsFrameworkService; C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe [28552 2016-04-26] (Hewlett-Packard Company) S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed] R2 LightScribeService; c:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe [73728 2009-05-18] (Hewlett-Packard Company) [File not signed] S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.11.309\McCHSvc.exe [293128 2016-03-11] (McAfee, Inc.) R2 Norton Internet Security; C:\Program Files (x86)\Norton Internet Security\Engine\16.8.3.6\ccSvcHst.exe [117648 2011-09-21] (Symantec Corporation) R2 PMBDeviceInfoProvider; C:\Program Files (x86)\Sony\PlayMemories Home\PMBDeviceInfoProvider.exe [479840 2012-11-27] (Sony Corporation) S2 Speedly_FastIP; C:\Windows\SysWOW64\Speedly_FastIP.exe [144504 2014-11-20] () S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation) R2 WNDA6200; C:\Program Files (x86)\NETGEAR\A6200\WifiService.exe [25888 2012-07-27] () ===================== Drivers (Whitelisted) ====================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) S3 A6200; C:\Windows\System32\DRIVERS\bcmwlhigh664.sys [2263144 2012-07-31] (Broadcom Corporation) R3 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [37656 2016-09-28] (AVAST Software) S1 aswKbd; C:\Windows\system32\drivers\aswKbd.sys [37144 2016-09-28] (AVAST Software) R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [108816 2016-09-28] (AVAST Software) R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [103064 2016-09-28] (AVAST Software) S0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [74544 2016-09-28] (AVAST Software) R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [969184 2016-09-28] (AVAST Software) R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [513632 2016-09-28] (AVAST Software) R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [163416 2016-09-28] (AVAST Software) R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [292704 2016-09-28] (AVAST Software) R1 BHDrvx64; C:\Windows\System32\Drivers\NISx64\1008030.006\BHDrvx64.sys [334384 2009-08-22] (Symantec Corporation) R1 ccHP; C:\Windows\System32\Drivers\NISx64\1008030.006\ccHPx64.sys [561800 2011-10-11] (Symantec Corporation) S3 ebdrv; C:\Windows\system32\DRIVERS\evbda.sys [3286016 2009-06-10] (Broadcom Corporation) R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [498512 2015-07-27] (Symantec Corporation) R1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\ipsdefs\20151110.005\IDSvia64.sys [767224 2015-10-16] (Symantec Corporation) S3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20151110.017\ENG64.SYS [138488 2015-10-16] (Symantec Corporation) S3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20151110.017\EX64.SYS [2148080 2015-10-16] (Symantec Corporation) R1 NPF; C:\Windows\System32\drivers\npf.sys [35344 2010-06-26] (CACE Technologies, Inc.) S3 SRTSP; C:\Windows\System32\Drivers\NISx64\1008030.006\SRTSP64.SYS [476720 2009-08-22] (Symantec Corporation) R1 SRTSPX; C:\Windows\system32\drivers\NISx64\1008030.006\SRTSPX64.SYS [32304 2009-08-22] (Symantec Corporation) U1 staport; no ImagePath R0 SymEFA; C:\Windows\System32\drivers\NISx64\1008030.006\SYMEFA64.SYS [402992 2009-08-22] (Symantec Corporation) R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [172592 2009-12-30] (Symantec Corporation) S3 SYMFW; C:\Windows\System32\Drivers\NISx64\1008030.006\SYMFW.SYS [120952 2011-09-21] (Symantec Corporation) R1 SymIM; C:\Windows\System32\DRIVERS\SymIMv.sys [31280 2009-08-22] (Symantec Corporation) S3 SYMNDISV; C:\Windows\System32\Drivers\NISx64\1008030.006\SYMNDISV.SYS [56952 2011-09-21] (Symantec Corporation) R1 SYMTDI; C:\Windows\System32\Drivers\NISx64\1008030.006\SYMTDI.SYS [279160 2011-09-21] (Symantec Corporation) S3 BCM42RLY; system32\drivers\BCM42RLY.sys [X] S3 EraserUtilRebootDrv; \??\C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) ==================== One Month Created files and folders ======== (If an entry is included in the fixlist, the file/folder will be moved.) 2016-09-28 14:16 - 2016-09-28 14:16 - 00033986 _____ C:\Users\Jim\Desktop\FRST.txt 2016-09-28 14:16 - 2016-09-28 14:16 - 00000000 ____D C:\FRST 2016-09-28 14:13 - 2016-09-28 14:13 - 02404352 _____ (Farbar) C:\Users\Jim\Desktop\FRST64.exe 2016-09-28 13:30 - 2016-09-28 12:55 - 00969184 _____ (AVAST Software) C:\Windows\system32\Drivers\asw7677.tmp 2016-09-28 13:30 - 2016-09-28 12:55 - 00513632 _____ (AVAST Software) C:\Windows\system32\Drivers\asw85A8.tmp 2016-09-28 13:30 - 2016-09-28 12:55 - 00037144 _____ (AVAST Software) C:\Windows\system32\Drivers\asw730C.tmp 2016-09-28 13:30 - 2016-09-28 12:54 - 00391496 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe 2016-09-28 13:30 - 2016-09-28 12:54 - 00292704 _____ (AVAST Software) C:\Windows\system32\Drivers\asw880A.tmp 2016-09-28 13:30 - 2016-09-28 12:54 - 00163416 _____ (AVAST Software) C:\Windows\system32\Drivers\asw8B07.tmp 2016-09-28 13:30 - 2016-09-28 12:54 - 00108816 _____ (AVAST Software) C:\Windows\system32\Drivers\asw8078.tmp 2016-09-28 13:30 - 2016-09-28 12:54 - 00103064 _____ (AVAST Software) C:\Windows\system32\Drivers\asw7ADB.tmp 2016-09-28 13:30 - 2016-09-28 12:54 - 00074544 _____ (AVAST Software) C:\Windows\system32\Drivers\asw82DA.tmp 2016-09-28 13:30 - 2016-09-28 12:54 - 00037656 _____ (AVAST Software) C:\Windows\system32\Drivers\asw7E55.tmp 2016-09-28 12:56 - 2016-09-28 13:30 - 00003872 _____ C:\Windows\System32\Tasks\SafeZone scheduled Autoupdate 1475081779 2016-09-28 12:56 - 2016-09-28 12:56 - 00001045 _____ C:\Users\Public\Desktop\Avast SafeZone Browser.lnk 2016-09-28 12:56 - 2016-09-28 12:56 - 00001045 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast SafeZone Browser.lnk 2016-09-28 12:55 - 2016-09-28 13:32 - 00001924 _____ C:\Users\Public\Desktop\Avast Free Antivirus.lnk 2016-09-28 12:55 - 2016-09-28 13:30 - 00044952 _____ () C:\Windows\system32\Drivers\staport.sys.147508170083902 2016-09-28 12:55 - 2016-09-28 12:55 - 00044952 _____ () C:\Windows\system32\Drivers\staport.sys.147508170083902.147508384466702 2016-09-28 12:55 - 2016-09-28 12:55 - 00037144 _____ (AVAST Software) C:\Windows\system32\Drivers\aswKbd.sys 2016-09-28 12:55 - 2016-09-28 12:55 - 00000000 ____D C:\Users\Jim\AppData\Roaming\AVAST Software 2016-09-28 12:55 - 2016-09-28 12:55 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVAST Software 2016-09-28 12:54 - 2016-09-28 13:30 - 00969560 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys.147508384579007 2016-09-28 12:54 - 2016-09-28 13:30 - 00969184 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys 2016-09-28 12:54 - 2016-09-28 13:30 - 00513632 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys 2016-09-28 12:54 - 2016-09-28 13:30 - 00513496 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys.147508384627410 2016-09-28 12:54 - 2016-09-28 13:30 - 00003922 _____ C:\Windows\System32\Tasks\avast! Emergency Update 2016-09-28 12:54 - 2016-09-28 12:54 - 00969560 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys.147508170536307 2016-09-28 12:54 - 2016-09-28 12:54 - 00513496 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys.147508170633010 2016-09-28 12:54 - 2016-09-28 12:54 - 00292704 _____ (AVAST Software) C:\Windows\system32\Drivers\aswVmm.sys 2016-09-28 12:54 - 2016-09-28 12:54 - 00163416 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys 2016-09-28 12:54 - 2016-09-28 12:54 - 00108816 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys 2016-09-28 12:54 - 2016-09-28 12:54 - 00103064 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys 2016-09-28 12:54 - 2016-09-28 12:54 - 00074544 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRvrt.sys 2016-09-28 12:54 - 2016-09-28 12:54 - 00053208 _____ (AVAST Software) C:\Windows\avastSS.scr 2016-09-28 12:54 - 2016-09-28 12:54 - 00037656 _____ (AVAST Software) C:\Windows\system32\Drivers\aswHwid.sys 2016-09-28 12:54 - 2016-09-28 12:54 - 00000000 ____D C:\Windows\System32\Tasks\AVAST Software 2016-09-28 12:54 - 2016-09-28 12:54 - 00000000 ____D C:\Program Files\Common Files\AV 2016-09-28 12:53 - 2016-09-28 12:55 - 00000000 ____D C:\ProgramData\AVAST Software 2016-09-28 12:53 - 2016-09-28 12:55 - 00000000 ____D C:\Program Files\AVAST Software 2016-09-27 18:25 - 2016-09-27 18:25 - 00002129 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows 7 Upgrade Advisor.lnk 2016-09-27 18:25 - 2016-09-27 18:25 - 00002117 _____ C:\Users\Public\Desktop\Windows 7 Upgrade Advisor.lnk 2016-09-27 18:25 - 2016-09-27 18:25 - 00000000 ____D C:\Users\Jim\AppData\Local\Microsoft Corporation 2016-09-27 18:25 - 2016-09-27 18:25 - 00000000 ____D C:\Program Files (x86)\Microsoft Windows 7 Upgrade Advisor 2016-09-27 13:42 - 2014-03-29 13:28 - 00867240 _____ (Oracle Corporation) C:\Windows\SysWOW64\npDeployJava1.dll 2016-09-27 13:42 - 2014-03-29 13:28 - 00789416 _____ (Oracle Corporation) C:\Windows\SysWOW64\deployJava1.dll 2016-09-27 13:41 - 2016-09-27 13:44 - 00000000 ____D C:\ProgramData\Oracle 2016-09-27 13:41 - 2016-09-27 13:41 - 00000000 ____D C:\Users\Jim\AppData\Roaming\Sun 2016-09-27 13:41 - 2016-09-27 13:41 - 00000000 ____D C:\Users\Jim\.oracle_jre_usage 2016-09-27 13:41 - 2016-09-27 13:41 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java 2016-09-27 13:14 - 2016-09-28 13:24 - 00000894 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore1d218e2a77a181c.job 2016-09-27 13:14 - 2016-09-28 13:22 - 00000898 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA1d218e2a87d8e1a.job 2016-09-27 13:14 - 2016-09-27 13:14 - 00003894 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA1d218e2a87d8e1a 2016-09-27 13:14 - 2016-09-27 13:14 - 00003642 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore1d218e2a77a181c ==================== One Month Modified files and folders ======== (If an entry is included in the fixlist, the file/folder will be moved.) 2016-09-28 14:07 - 2014-12-06 15:07 - 00000284 _____ C:\Windows\Tasks\WSE_Vosteran.job 2016-09-28 13:27 - 2014-04-12 09:37 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job 2016-09-28 09:46 - 2009-07-14 00:45 - 00018736 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2016-09-28 09:46 - 2009-07-14 00:45 - 00018736 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2016-09-28 09:40 - 2015-07-02 09:27 - 00000362 _____ C:\Windows\Tasks\SlimCleaner Plus (Scheduled Scan - Jim).job 2016-09-27 18:14 - 2009-07-13 23:20 - 00000000 ____D C:\Windows\system32\NDF 2016-09-27 17:53 - 2008-09-19 06:55 - 00014466 _____ C:\Windows\SysWOW64\NapaSet.txt 2016-09-27 17:51 - 2009-07-14 01:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2016-09-27 15:01 - 2010-05-17 21:48 - 00000898 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2016-09-27 15:01 - 2010-05-17 21:48 - 00000894 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2016-09-27 13:42 - 2014-03-29 13:28 - 00000000 ____D C:\Program Files (x86)\Java 2016-09-27 13:41 - 2014-03-29 13:28 - 00269888 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe 2016-09-27 13:41 - 2014-03-29 13:28 - 00097856 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll 2016-09-27 13:41 - 2009-12-30 18:16 - 00000000 ____D C:\Users\Jim 2016-09-27 13:20 - 2014-08-14 10:35 - 00002116 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk 2016-09-27 13:20 - 2014-08-14 10:35 - 00002104 _____ C:\Users\Public\Desktop\Google Chrome.lnk 2016-09-27 12:29 - 2016-03-12 14:07 - 00000000 ____D C:\Users\Jim\AppData\Local\ElevatedDiagnostics 2016-09-27 08:59 - 2014-03-29 19:08 - 00000444 ____H C:\Windows\Tasks\Norton Security Scan for Jim.job 2016-09-26 11:35 - 2013-05-18 12:32 - 00000000 ____D C:\ProgramData\Yahoo! ==================== Files in the root of some directories ======= 2010-05-05 08:52 - 2010-05-05 08:52 - 0000268 ___RH () C:\Users\Jim\AppData\Roaming\Authentication 2010-05-05 08:55 - 2010-05-05 08:55 - 0000268 ___RH () C:\Users\Jim\AppData\Roaming\Automator 2014-12-06 16:07 - 2015-06-27 09:36 - 0000212 _____ () C:\Users\Jim\AppData\Roaming\WB.CFG 2014-12-17 11:07 - 2014-12-17 11:07 - 0000002 _____ () C:\Users\Jim\AppData\Local\DSI.DAT 2014-12-17 11:07 - 2014-12-17 11:07 - 0022528 _____ () C:\Users\Jim\AppData\Local\dsisetup5416379362.exe 2010-09-04 08:27 - 2010-09-04 08:27 - 5164825 _____ () C:\Users\Jim\AppData\Local\tmpDSC00122[1].0 2010-09-04 08:27 - 2010-09-04 08:27 - 1051973 _____ () C:\Users\Jim\AppData\Local\tmpDSC00122[1].1 2010-09-04 08:27 - 2010-09-04 08:27 - 1040285 _____ () C:\Users\Jim\AppData\Local\tmpDSC00122[1].2 2010-09-04 08:27 - 2010-09-04 08:27 - 1054348 _____ () C:\Users\Jim\AppData\Local\tmpDSC00122[1].JPG 2010-06-02 16:49 - 2010-06-02 16:49 - 3060798 _____ () C:\Users\Jim\AppData\Local\tmpDSCN0146[1].JPG 2010-06-02 16:49 - 2010-06-02 16:49 - 0011256 _____ () C:\Users\Jim\AppData\Local\tmpDSCN0146[1]_navi.JPG 2013-05-26 12:36 - 2013-05-26 12:36 - 2936994 _____ () C:\Users\Jim\AppData\Local\tmpDSCN0182.0 2013-05-26 12:36 - 2013-05-26 12:36 - 0982682 _____ () C:\Users\Jim\AppData\Local\tmpDSCN0182.1 2013-05-26 12:36 - 2013-05-26 12:36 - 0973820 _____ () C:\Users\Jim\AppData\Local\tmpDSCN0182.JPG 2015-01-04 17:42 - 2015-01-04 17:42 - 2865711 _____ () C:\Users\Jim\AppData\Local\tmpDSCN0187.0 2015-01-04 17:42 - 2015-01-04 17:42 - 0637883 _____ () C:\Users\Jim\AppData\Local\tmpDSCN0187.1 2015-01-04 17:42 - 2015-01-04 17:42 - 0639068 _____ () C:\Users\Jim\AppData\Local\tmpDSCN0187.2 2015-01-04 17:42 - 2015-01-04 17:42 - 0644040 _____ () C:\Users\Jim\AppData\Local\tmpDSCN0187.3 2015-01-04 17:42 - 2015-01-04 17:42 - 2865711 _____ () C:\Users\Jim\AppData\Local\tmpDSCN0187.JPG 2010-08-15 06:06 - 2010-08-15 06:06 - 2835935 _____ () C:\Users\Jim\AppData\Local\tmpDSCN0193.0 2010-08-15 06:06 - 2010-08-15 06:06 - 1007402 _____ () C:\Users\Jim\AppData\Local\tmpDSCN0193.JPG 2013-05-26 09:55 - 2013-05-26 09:55 - 2505717 _____ () C:\Users\Jim\AppData\Local\tmpDSCN1767.0 2013-05-26 09:55 - 2013-05-26 09:55 - 0623029 _____ () C:\Users\Jim\AppData\Local\tmpDSCN1767.JPG 2011-02-13 15:48 - 2011-02-13 15:48 - 0118897 _____ () C:\Users\Jim\AppData\Local\tmpIMAGE001[1].JPG 2015-05-13 19:08 - 2015-05-13 19:08 - 0007467 _____ () C:\Users\Jim\AppData\Local\tmpIMAGE004.JPG 2015-05-13 19:08 - 2015-05-13 19:08 - 0006395 _____ () C:\Users\Jim\AppData\Local\tmpIMAGE004_navi.JPG 2016-04-18 18:37 - 2016-04-18 18:37 - 0205927 _____ () C:\Users\Jim\AppData\Local\tmpKATE-UPTON7.0 2016-04-18 18:37 - 2016-04-18 18:37 - 0108448 _____ () C:\Users\Jim\AppData\Local\tmpKATE-UPTON7.1 2016-04-18 18:37 - 2016-04-18 18:37 - 0108065 _____ () C:\Users\Jim\AppData\Local\tmpKATE-UPTON7.2 2016-04-18 18:37 - 2016-04-18 18:37 - 0109605 _____ () C:\Users\Jim\AppData\Local\tmpKATE-UPTON7.3 2016-04-18 18:37 - 2016-04-18 18:37 - 0205927 _____ () C:\Users\Jim\AppData\Local\tmpKATE-UPTON7.JPG 2013-05-19 13:02 - 2013-05-19 13:02 - 0000000 _____ () C:\ProgramData\22203e593f31_c 2010-05-05 08:52 - 2010-05-05 08:52 - 0000268 ___RH () C:\ProgramData\Basic Synth 2010-05-05 08:55 - 2010-05-05 08:55 - 0000268 ___RH () C:\ProgramData\Basics 2010-05-05 08:52 - 2014-03-20 09:35 - 0000020 ____H () C:\ProgramData\PKP_DLdu.DAT 2010-05-05 08:55 - 2015-05-25 11:48 - 0000020 ____H () C:\ProgramData\PKP_DLdw.DAT Some files in TEMP: ==================== C:\Users\Jim\AppData\Local\Temp\BingSvc.exe C:\Users\Jim\AppData\Local\Temp\BSvcProcessor.exe C:\Users\Jim\AppData\Local\Temp\BSvcUpdater.exe C:\Users\Jim\AppData\Local\Temp\checktbexist.exe C:\Users\Jim\AppData\Local\Temp\FastFreeConverterUpdt_v4.0.exe C:\Users\Jim\AppData\Local\Temp\FastFreeConverterUpdt_v4.1.exe C:\Users\Jim\AppData\Local\Temp\FlashPlayerUpdate.exe C:\Users\Jim\AppData\Local\Temp\FlashPlayerUpdate01.exe C:\Users\Jim\AppData\Local\Temp\FlashPlayerUpdate02.exe C:\Users\Jim\AppData\Local\Temp\FlashPlayerUpdate03.exe C:\Users\Jim\AppData\Local\Temp\helper.exe C:\Users\Jim\AppData\Local\Temp\HPHelpUpdater.exe C:\Users\Jim\AppData\Local\Temp\HPSFUpdater.exe C:\Users\Jim\AppData\Local\Temp\JiujitsusDescriptions.dll C:\Users\Jim\AppData\Local\Temp\jre-8u101-windows-au.exe C:\Users\Jim\AppData\Local\Temp\jreInstall.exe C:\Users\Jim\AppData\Local\Temp\mconduitinstaller.exe C:\Users\Jim\AppData\Local\Temp\ose00000.exe C:\Users\Jim\AppData\Local\Temp\PreferencesJson.exe C:\Users\Jim\AppData\Local\Temp\Resource.exe C:\Users\Jim\AppData\Local\Temp\Runner.exe C:\Users\Jim\AppData\Local\Temp\sp44460.exe C:\Users\Jim\AppData\Local\Temp\sp46257.exe C:\Users\Jim\AppData\Local\Temp\sp49905.exe.exe C:\Users\Jim\AppData\Local\Temp\sp52594.exe.exe C:\Users\Jim\AppData\Local\Temp\sp53904.exe C:\Users\Jim\AppData\Local\Temp\sp54931.exe C:\Users\Jim\AppData\Local\Temp\sp58915.exe C:\Users\Jim\AppData\Local\Temp\sp64126.exe C:\Users\Jim\AppData\Local\Temp\sqlite-3.7.2-sqlitejdbc.dll C:\Users\Jim\AppData\Local\Temp\sqlite3.exe C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite10199.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite10956.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite11361.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite11548.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite12670.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite12743.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite13288.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite13334.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite14636.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite14665.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite15215.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite15537.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite15775.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite16945.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite17119.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite17659.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite17708.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite17974.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite17990.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite18731.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite19274.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite19311.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite19414.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite20446.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite20668.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite21543.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite22086.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite22450.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite24119.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite24611.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite24664.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite26104.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite27065.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite27192.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite27654.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite28030.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite28158.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite28746.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite30024.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite30296.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite30739.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite30779.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite31376.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite32617.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite32866.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite33159.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite33938.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite34040.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite34413.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite34741.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite35237.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite36099.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite36601.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite37166.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite37190.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite37655.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite39182.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite39579.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite40266.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite40743.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite41045.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite41349.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite41578.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite41614.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite43428.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite43509.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite43809.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite46476.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite46762.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite47376.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite48173.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite48205.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite48663.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite48843.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite49910.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite4ac86c24-ff11-4d44-961c-cf8209b8f3fc.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite50066.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite52299.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite54092.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite54152.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite54285.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite54962.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite55040.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite55399.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite55951.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite56100.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite56320.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite57086.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite57939.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite58252.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite58275.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite58401.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite58622.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite58898.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite58976.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite59178.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite59331.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite59861.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite59902.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite60323.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite60403.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite61346.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite61834.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite61909.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite63646.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite64648.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite65535.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite65680.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite66388.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite66714.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite68404.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite68821.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite71699.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite72113.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite72520.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite73139.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite73358.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite74327.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite74495.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite75356.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite75774.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite76962.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite77246.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite78868.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite80200.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite81093.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite81270.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite82455.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite82482.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite83648.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite84678.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite85034.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite85229.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite85957.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite87084.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite87209.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite87478.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite88139.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite88704.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite88796.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite89813.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite89861.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite90145.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite90204.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite91035.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite91727.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite92148.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite92200.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite95219.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite96815.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite97020.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite97117.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite99196.dll C:\Users\Jim\AppData\Local\Temp\System.Data.SQLite99332.dll C:\Users\Jim\AppData\Local\Temp\ToolbarHelper.exe C:\Users\Jim\AppData\Local\Temp\UninstallHPSA.exe C:\Users\Jim\AppData\Local\Temp\UninstallHPTCA.exe C:\Users\Jim\AppData\Local\Temp\WRupdate2084235.exe ==================== Bamital & volsnap ====================== (There is no automatic fix for files that do not pass verification.) C:\Windows\system32\winlogon.exe => File is digitally signed C:\Windows\system32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\system32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\system32\services.exe => File is digitally signed C:\Windows\system32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\system32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\system32\rpcss.dll => File is digitally signed C:\Windows\system32\dnsapi.dll => File is digitally signed C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2016-09-27 09:56 ==================== End of FRST.txt ============================
  4. Welcome aboard Please, observe following rules: Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer. If you're stuck, or you're not sure about certain step, always ask before doing anything else. Please refrain from running any tools, fixes or applying any changes to your computer other than those I suggest. Never run more than one scan at a time. Keep updating me regarding your computer behavior, good, or bad. The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know. If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum. I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me. ======================================= Please observe forum rules. All logs have to be pasted not attached. Thank you :)
  5. Welcome mikew

    Hello mikew, Welcome to Smartest Computing. Please feel free to browse around and get to know the others. If you have any questions please don't hesitate to ask. mikew joined on the 09/28/2016. View Member
  6. Football aka soccer topic

    I just watched Borussia's game. Great football! Hmmm...not sure. That's very unfriendly territory for English teams. Will see.
  7. Football aka soccer topic

    Watched any CL game?
  8. Football aka soccer topic

    WOW! What a shocker! How stupid a man can be? Insanity!
  9. Exercise or not?

    :)
  10. Welcome Unicode4all

    Hello Unicode4all, Welcome to Smartest Computing. Please feel free to browse around and get to know the others. If you have any questions please don't hesitate to ask. Unicode4all joined on the 09/26/2016. View Member
  11. Phone's secret codes

    Interesting :)
  12. Football aka soccer topic

    I know you're a happy camper but what about Gunners making my day by destroying Chelsea? Yes!!!!!!!!
  13. 9/22/16

    You're very welcome