46 replies to this topic

[Satchfan]

Yes I'm still monitoring it.

 

Apologies for those instructions - since Malwarebytes has taken it over they've changed it.

 

• open adwcleaner.exe
• click on Settings
• click on the Application tab and scroll down to the bottom
• click on Remove.

Satchfan

[KelRenBen36]

Yes, that is correct, I click on Remove and nothing happens, except the button turns dark when I click.  I'll try running some of the other things.

 

EDIT:  Spoke too soon!  Security Center is off and still can't turn it on.

 

More:  Can't find how to install WOT for IE.  One download said not supported.

Edited by KelRenBen36, 08 August 2018 - 08:10 PM.

[Satchfan]

Since this issue appears to be resolved ... this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please follow the instructions here http://forums.whatth...ed_t106388.html
and start a New Topic.

[Satchfan]

This topic has been re-opened at the original poster's request.

[Satchfan]

• click on Start, then in the search box type CMD
• right-click, on cmd and from the menu that appears, click on Run as administrator
• type the following in the command prompt:

winmgmt /salvagerepository

 

You may have to run the command more than one time, since it will need to stop the WMI service first. Repeat it until the message 'WMI repository is consistent' appears.

 

[KelRenBen36]

I ran the command and immediately got the message mentioned.  I restarted the PC and don't see any messages in the systray but when I went to Services, both WMI and Security Center are stopped and I still can't start them.

[Satchfan]

Please run FRST again and make sure there is a checkmark next to ‘Addition.txt’ before you hit Scan.

If you no longer have it, you can download it again from here and save it on the desktop.

Logs to include with next post:

New Frst.txt
New Addition.txt

Thanks

Satchfan

[KelRenBen36]

Sorry, forgot to send this yesterday.

 

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 02.08.2018

Ran by Kelly (administrator) on KELLY-PC (10-08-2018 19:28:48)

Running from C:\Users\Kelly\Desktop

Loaded Profiles: Kelly (Available Profiles: Kelly)

Platform: Windows 7 Home Premium Service Pack 1 (X86) Language: English (United States)

Internet Explorer Version 11 (Default browser: Chrome)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/

 

==================== Processes (Whitelisted) =================

 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

 

(Microsoft Corporation) C:\Windows\System32\wlanext.exe

(Acronis) C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe

(Bitdefender) C:\Program Files\Bitdefender Antivirus Free\bdredline.exe

(Paramount Software UK Ltd) C:\Program Files\Macrium\Common\MacriumService.exe

(Bitdefender) C:\Program Files\Bitdefender Agent\ProductAgentService.exe

(Realtek) C:\Program Files\Realtek\USB Wireless LAN Utility\RtlService.exe

(Realtek Semiconductor Corp.) C:\Program Files\Realtek\USB Wireless LAN Utility\RtWLan.exe

() C:\Windows\runSW.exe

(DEVGURU Co., LTD.) C:\Program Files\Samsung\USB Drivers\27_ssconn\conn\ss_conn_service.exe

(Realtek) C:\Windows\SwUSB.exe

(TeamViewer GmbH) C:\Program Files\TeamViewer\TeamViewer_Service.exe

(Bitdefender) C:\Program Files\Bitdefender Antivirus Free\updatesrv.exe

(Bitdefender) C:\Program Files\Bitdefender Antivirus Free\vsserv.exe

(Bitdefender) C:\Program Files\Bitdefender Antivirus Free\vsservppl.exe

(Realtek Semiconductor) C:\Windows\RtHDVCpl.exe

(Intel Corporation) C:\Windows\System32\igfxtray.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(Acronis) C:\Program Files\Acronis\TrueImageWorkstation\TrueImageMonitor.exe

(Acronis) C:\Program Files\Acronis\TrueImageWorkstation\TimounterMonitor.exe

(Acronis) C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe

(Intel Corporation) C:\Windows\System32\igfxsrvc.exe

() C:\Program Files\Hostless Modem\Mobile Hotspot Admin\CheckNDISPort_df.exe

() C:\Program Files\Hostless Modem\Mobile Hotspot Admin\CancelAutoPlay_df.exe

(Hewlett-Packard) C:\Program Files\HP\HP Software Update\hpwuschd2.exe

(Logitech, Inc.) C:\Program Files\Logitech\SetPointP\SetPoint.exe

() C:\Program Files\EaseUS\EaseUS Partition Master 12.8\bin\TrayPopupE\TrayTipAgentE.exe

(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe

(OLYMPUS IMAGING CORP.) C:\Program Files\OLYMPUS\OLYMPUS Viewer 3\OV3Monitor.exe

(Mobile Stream) C:\Program Files\Mobile Stream\EasyTether\easytthr.exe

(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

(Nico Mak Computing) C:\Program Files\WinZip\FAHWindow32.exe

(Logitech, Inc.) C:\Program Files\Common Files\Logishrd\KHAL3\KHALMNPR.exe

(Nico Mak Computing) C:\Program Files\WinZip\WZUpdateNotifier.exe

(WinZip Computing, S.L.) C:\Program Files\WinZip\WzPreloader.exe

(Modos Inc.) C:\Users\Kelly\Documents\KeyboardIndicator\KeyboardIndicator.exe

(Microsoft Corporation) C:\Windows\System32\rundll32.exe

(Bitdefender) C:\Program Files\Bitdefender Antivirus Free\bdagent.exe

(Tweaking.com) C:\Program Files\Tweaking.com\Windows Repair (All in One)\WR_Tray_Icon.exe

(HP Inc.) C:\Program Files\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe

(TeamViewer GmbH) C:\Program Files\TeamViewer\TeamViewer.exe

(TeamViewer GmbH) C:\Program Files\TeamViewer\tv_w32.exe

(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe

(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe

(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil32_30_0_0_134_ActiveX.exe

(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

 

==================== Registry (Whitelisted) ===========================

 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

 

HKLM\...\Run: [RtHDVCpl] => C:\Windows\RtHDVCpl.exe [6183456 2008-06-13] (Realtek Semiconductor)

HKLM\...\Run: [TrueImageMonitor.exe] => C:\Program Files\Acronis\TrueImageWorkstation\TrueImageMonitor.exe [1129232 2007-01-31] (Acronis)

HKLM\...\Run: [AcronisTimounterMonitor] => C:\Program Files\Acronis\TrueImageWorkstation\TimounterMonitor.exe [1862112 2007-01-31] (Acronis)

HKLM\...\Run: [Acronis Scheduler2 Service] => C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe [140832 2007-01-31] (Acronis)

HKLM\...\Run: [OV3_Monitor] => C:\Program Files\OLYMPUS\OLYMPUS Viewer 3\FirstStart.exe [55656 2013-07-29] (OLYMPUS IMAGING CORP.)

HKLM\...\Run: [CheckNDISPortf0ac3e] => C:\Program Files\Hostless Modem\Mobile Hotspot Admin\CheckNDISPort_df.exe [465664 2014-03-26] ()

HKLM\...\Run: [CancelAutoPlay_df] => C:\Program Files\Hostless Modem\Mobile Hotspot Admin\CancelAutoPlay_df.exe [446720 2014-03-26] ()

HKLM\...\Run: [HP Software Update] => C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard)

HKLM\...\Run: [] => [X]

HKLM\...\Run: [EvtMgr6] => C:\Program Files\Logitech\SetPointP\SetPoint.exe [2312824 2015-08-25] (Logitech, Inc.)

HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch

HKLM\...\Run: [EaseUS EPM Tray Agent] => C:\Program Files\EaseUS\EaseUS Partition Master 12.8\bin\TrayPopupE\TrayTipAgentE.exe [255072 2014-11-18] ()

HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [601424 2018-07-07] (Oracle Corporation)

HKU\S-1-5-21-2863067232-3147982578-4033237767-1000\...\Run: [OV3_Monitor] => C:\Program Files\OLYMPUS\OLYMPUS Viewer 3\OV3Monitor.exe [420200 2013-07-29] (OLYMPUS IMAGING CORP.)

HKU\S-1-5-21-2863067232-3147982578-4033237767-1000\...\Run: [QuickenScheduledUpdates] => C:\Program Files\Quicken\bagent.exe [77184 2018-08-09] (Quicken Inc.)

HKU\S-1-5-21-2863067232-3147982578-4033237767-1000\...\Run: [EasyTether] => C:\Program Files\Mobile Stream\EasyTether\easytthr.exe [62464 2015-11-22] (Mobile Stream)

HKU\S-1-5-21-2863067232-3147982578-4033237767-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\Mystify.scr [221184 2010-11-20] (Microsoft Corporation)

Lsa: [Authentication Packages] msv1_0 relog_ap

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\FAH.lnk [2016-03-04]

ShortcutTarget: FAH.lnk -> C:\Program Files\WinZip\FAHConsole.exe (Nico Mak Computing)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk [2013-10-05]

ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office.lnk [2013-08-10]

ShortcutTarget: Microsoft Office.lnk -> C:\Program Files\Microsoft Office\Office\OSA9.EXE (Microsoft Corporation)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Update Notifier.lnk [2016-03-04]

ShortcutTarget: Update Notifier.lnk -> C:\Program Files\WinZip\WZUpdateNotifier.exe (Nico Mak Computing)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WinZip Preloader.lnk [2016-03-04]

ShortcutTarget: WinZip Preloader.lnk -> C:\Program Files\WinZip\WzPreloader.exe (WinZip Computing, S.L.)

Startup: C:\Users\Kelly\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\KeyboardIndicator.exe - Shortcut.lnk [2016-03-05]

ShortcutTarget: KeyboardIndicator.exe - Shortcut.lnk -> C:\Users\Kelly\Documents\KeyboardIndicator\KeyboardIndicator.exe (Modos Inc.)

Startup: C:\Users\Kelly\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Monitor Ink Alerts - HP DeskJet 2130 series.lnk [2018-08-10]

ShortcutTarget: Monitor Ink Alerts - HP DeskJet 2130 series.lnk -> C:\Program Files\HP\HP DeskJet 2130 series\Bin\HPStatusBL.dll (Hewlett-Packard Development Company, LP)

GroupPolicy: Restriction - Chrome <==== ATTENTION

 

==================== Internet (Whitelisted) ====================

 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

 

Winsock: Catalog5 08 C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL => No File 

Winsock: Catalog5 09 C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL => No File 

Tcpip\Parameters: [DhcpNameServer] 192.168.43.1

Tcpip\..\Interfaces\{13C13B63-E31B-4BD8-9090-B08648E77768}: [DhcpNameServer] 192.168.117.1

Tcpip\..\Interfaces\{4B9ACEAC-D5A7-4F2A-9C34-F32FBB654844}: [DhcpNameServer] 192.168.0.1 192.168.0.1

Tcpip\..\Interfaces\{7D8320DE-B1C5-48CA-8137-74E02E1F3A05}: [DhcpNameServer] 192.168.254.254

Tcpip\..\Interfaces\{E31D585E-87F2-44AC-ABF3-F848BEE1AD85}: [DhcpNameServer] 192.168.43.1

Tcpip\..\Interfaces\{E3DD0B0B-2050-4680-958F-F69FF4F3794F}: [DhcpNameServer] 192.168.42.129

 

Internet Explorer:

==================

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = 

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = 

HKU\S-1-5-21-2863067232-3147982578-4033237767-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pogo.com/

SearchScopes: HKU\S-1-5-21-2863067232-3147982578-4033237767-1000 -> DefaultScope {DBE1494B-8461-403F-9DB0-E3A56FA6416E} URL = hxxps://search.yahoo.com/search?p={searchTerms}&fr=yset_ie_syc_oracle&type=orcl_default

SearchScopes: HKU\S-1-5-21-2863067232-3147982578-4033237767-1000 -> {DBE1494B-8461-403F-9DB0-E3A56FA6416E} URL = hxxps://search.yahoo.com/search?p={searchTerms}&fr=yset_ie_syc_oracle&type=orcl_default

BHO: HP Print Enhancer -> {0347C33E-8762-4905-BF09-768834316C61} -> C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll [2009-10-22] (Hewlett-Packard Co.)

BHO: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_181\bin\ssv.dll [2018-07-23] (Oracle Corporation)

BHO: Logitech SetPoint -> {AF949550-9094-4807-95EC-D1C317803333} -> C:\Program Files\Logitech\SetPointP\SetPointSmooth.dll [2015-08-25] (Logitech, Inc.)

BHO: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_181\bin\jp2ssv.dll [2018-07-23] (Oracle Corporation)

BHO: HP Smart BHO Class -> {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} -> C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll [2009-10-22] (Hewlett-Packard Co.)

 

FireFox:

========

FF DefaultProfile: tjtyx2lb.default

FF ProfilePath: C:\Users\Kelly\AppData\Roaming\Mozilla\Firefox\Profiles\tjtyx2lb.default [2018-08-08]

FF HKLM\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3

FF Extension: (HP Smart Web Printing) - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2013-10-05] [Legacy] [not signed]

FF HKLM\...\Firefox\Extensions: [{F003DA68-8256-4b37-A6C4-350FA04494DF}] - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt

FF Extension: (Logitech SetPoint) - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt [2016-03-08] [Legacy] [not signed]

FF HKU\S-1-5-21-2863067232-3147982578-4033237767-1000\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_30_0_0_134.dll [2018-07-23] ()

FF Plugin: @java.com/DTPlugin,version=11.181.2 -> C:\Program Files\Java\jre1.8.0_181\bin\dtplugin\npDeployJava1.dll [2018-07-23] (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=11.181.2 -> C:\Program Files\Java\jre1.8.0_181\bin\plugin2\npjp2.dll [2018-07-23] (Oracle Corporation)

FF Plugin: @microsoft.com/GENUINE -> disabled [No File]

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.50907.0\npctrl.dll [2017-05-03] ( Microsoft Corporation)

FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.33.17\npGoogleUpdate3.dll [2018-05-17] (Google Inc.)

FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.33.17\npGoogleUpdate3.dll [2018-05-17] (Google Inc.)

FF Plugin: @videolan.org/vlc,version=2.1.0 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2013-09-22] (VideoLAN)

FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2018-06-29] (Adobe Systems Inc.)

 

Chrome: 

=======

CHR DefaultProfile: Default

CHR DefaultSearchURL: Default -> hxxps://search.yahoo.com/search?p={searchTerms}&fr=yset_chr_syc_oracle&type=default

CHR DefaultSearchKeyword: Default -> Yahoo

CHR DefaultSuggestURL: Default -> hxxps://search.yahoo.com/sugg/ie?output=fxjson&command={searchTerms}&nResults=10

CHR Profile: C:\Users\Kelly\AppData\Local\Google\Chrome\User Data\Default [2018-08-10]

CHR Extension: (WOT Web of Trust, Website Reputation Ratings) - C:\Users\Kelly\AppData\Local\Google\Chrome\User Data\Default\Extensions\bhmmomiinigofkjcapegjjndpbikblnp [2018-08-08]

CHR Extension: (Adblock Plus) - C:\Users\Kelly\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2018-07-26]

CHR Extension: (Adobe Acrobat) - C:\Users\Kelly\AppData\Local\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj [2018-07-26]

CHR Extension: (Chrome Web Store Payments) - C:\Users\Kelly\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2018-07-26]

CHR Extension: (Chrome Media Router) - C:\Users\Kelly\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2018-08-10]

CHR HKLM\...\Chrome\Extension: [commhkacjheiacaopdonmodahaoadoln] - hxxps://clients2.google.com/service/update2/crx

CHR HKLM\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - hxxps://clients2.google.com/service/update2/crx

CHR HKLM\...\Chrome\Extension: [gihfmmedoddijgnhkgfgnkeohkpbipol] - hxxps://clients2.google.com/service/update2/crx

 

==================== Services (Whitelisted) ====================

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

S2 AcronisOSSReinstallSvc; C:\Program Files\Common Files\Acronis\Acronis Disk Director\oss_reinstall_svc.exe [2217416 2007-02-22] ()

R2 AcrSch2Svc; C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe [407072 2007-01-31] (Acronis)

R2 bdredline; C:\Program Files\Bitdefender Antivirus Free\bdredline.exe [1929240 2018-03-22] (Bitdefender)

R2 HPSupportSolutionsFrameworkService; C:\Program Files\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe [333688 2018-06-13] (HP Inc.)

S2 HPTouchpointAnalyticsService; C:\Program Files\HP\HP Touchpoint Analytics Client\TouchpointAnalyticsClientService.exe [332216 2017-11-21] (HP Inc.)

R2 MacriumService; C:\Program Files\Macrium\Common\MacriumService.exe [3139328 2017-10-19] (Paramount Software UK Ltd)

S2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [4753104 2018-05-09] (Malwarebytes)

R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [44544 2008-12-03] (Hewlett-Packard) [File not signed]

R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [53760 2008-12-03] (Hewlett-Packard) [File not signed]

R2 ProductAgentService; C:\Program Files\Bitdefender Agent\ProductAgentService.exe [1275776 2018-05-16] (Bitdefender)

R2 RealtekWlanU; C:\Program Files\Realtek\USB Wireless LAN Utility\RtlService.exe [48856 2014-05-19] (Realtek)

S2 RTLDHCPService; C:\Program Files\Realtek\USB Wireless LAN Utility\RTLDHCP.exe [262360 2014-04-23] (Realtek)

R2 RunSwUSB; C:\Windows\runSW.exe [44760 2014-12-12] ()

R2 ss_conn_service; C:\Program Files\Samsung\USB Drivers\27_ssconn\conn\ss_conn_service.exe [752224 2017-01-15] (DEVGURU Co., LTD.)

R2 TeamViewer; C:\Program Files\TeamViewer\TeamViewer_Service.exe [7757552 2018-02-26] (TeamViewer GmbH)

R2 updatesrv; C:\Program Files\Bitdefender Antivirus Free\updatesrv.exe [236208 2018-05-14] (Bitdefender)

R2 vsserv; C:\Program Files\Bitdefender Antivirus Free\vsserv.exe [236208 2018-05-14] (Bitdefender)

R2 vsservppl; C:\Program Files\Bitdefender Antivirus Free\vsservppl.exe [236208 2018-05-14] (Bitdefender)

S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-26] (Microsoft Corporation)

 

===================== Drivers (Whitelisted) ======================

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

R0 atc; C:\Windows\System32\DRIVERS\atc.sys [1010256 2018-04-27] (BitDefender S.R.L. Bucharest, ROMANIA)

R0 avc3; C:\Windows\System32\DRIVERS\avc3.sys [1419144 2018-04-17] (BitDefender)

R0 BdDci; C:\Windows\System32\DRIVERS\bddci.sys [126056 2018-04-19] (Bitdefender)

R3 dg_ssudbus; C:\Windows\System32\DRIVERS\ssudbus.sys [109456 2017-05-18] (Samsung Electronics Co., Ltd.)

R3 easytether; C:\Windows\System32\DRIVERS\easytthr.sys [18632 2015-11-22] (Mobile Stream)

R3 edrsensor; C:\Windows\System32\DRIVERS\edrsensor.sys [208216 2018-04-19] (BitDefender S.R.L. Bucharest, ROMANIA)

S3 epmntdrv; C:\Windows\system32\epmntdrv.sys [21496 2016-01-14] ()

R0 EPMVolFlt; C:\Windows\System32\drivers\EPMVolFlt.sys [17736 2017-11-23] (Windows ® Codename Longhorn DDK provider)

S3 EuGdiDrv; C:\Windows\system32\EuGdiDrv.sys [10208 2016-07-11] () [File not signed]

R0 gzflt; C:\Windows\System32\drivers\gzflt.sys [157256 2018-05-29] (BitDefender LLC)

R3 LEqdUsb; C:\Windows\System32\Drivers\LEqdUsb.Sys [52368 2015-06-17] (Logitech, Inc.)

R3 LHidEqd; C:\Windows\System32\Drivers\LHidEqd.Sys [20240 2015-06-17] (Logitech, Inc.)

R0 pssnap; C:\Windows\System32\DRIVERS\pssnap.sys [16016 2015-10-12] (Windows ® Win 7 DDK provider)

R3 RtlWlanu; C:\Windows\System32\DRIVERS\rtwlanu.sys [2928856 2015-12-28] (Realtek Semiconductor Corporation )

R3 ssudmdm; C:\Windows\System32\DRIVERS\ssudmdm.sys [147344 2017-05-18] (Samsung Electronics Co., Ltd.)

R2 tifsfilter; C:\Windows\System32\DRIVERS\tifsfilt.sys [39712 2013-08-12] (Acronis)

R2 trufos; C:\Windows\System32\drivers\trufos.sys [520816 2018-04-25] (Bitdefender)

S3 usbrndis6; C:\Windows\System32\DRIVERS\usb80236.sys [15872 2013-02-11] (Microsoft Corporation)

 

==================== NetSvcs (Whitelisted) ===================

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

 

==================== One Month Created files and folders ========

 

(If an entry is included in the fixlist, the file/folder will be moved.)

 

2018-08-10 19:28 - 2018-08-10 19:29 - 000020096 _____ C:\Users\Kelly\Desktop\FRST.txt

2018-08-10 19:28 - 2018-08-10 19:28 - 000000000 ____D C:\FRST

2018-08-10 19:27 - 2018-08-10 19:27 - 001773056 _____ (Farbar) C:\Users\Kelly\Desktop\FRST.exe

2018-08-08 19:08 - 2018-08-08 19:08 - 002190552 _____ C:\Users\Kelly\Downloads\appmanagersetup_2.0_b4_292.exe

2018-08-08 19:08 - 2018-08-08 19:08 - 000002005 _____ C:\Users\Kelly\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FileHippo App Manager.lnk

2018-08-08 19:08 - 2018-08-08 19:08 - 000000000 ____D C:\Program Files\FileHippo.com

2018-08-08 18:58 - 2018-08-08 18:58 - 000000258 __RSH C:\ProgramData\ntuser.pol

2018-08-08 18:56 - 2018-08-08 18:59 - 000000000 ____D C:\ProgramData\TEMP

2018-08-08 18:56 - 2018-08-08 18:59 - 000000000 ____D C:\Program Files\SpywareBlaster

2018-08-08 18:56 - 2018-08-08 18:56 - 000001048 _____ C:\Users\Public\Desktop\SpywareBlaster.lnk

2018-08-08 18:56 - 2018-08-08 18:56 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SpywareBlaster

2018-08-08 18:55 - 2018-08-08 18:56 - 004291320 _____ (BrightFort LLC ) C:\Users\Kelly\Downloads\spywareblastersetup55.exe

2018-08-08 18:54 - 2018-08-08 18:54 - 000001135 _____ C:\DelFix.txt

2018-08-08 18:54 - 2018-08-08 18:54 - 000000000 ____D C:\Windows\ERUNT

2018-08-02 13:12 - 2018-06-13 08:55 - 012880384 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll

2018-08-02 13:12 - 2018-06-13 08:54 - 001499648 _____ (Microsoft Corporation) C:\Windows\system32\ExplorerFrame.dll

2018-08-02 13:12 - 2018-06-08 08:55 - 001417728 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll

2018-08-02 13:12 - 2018-06-08 08:55 - 001063424 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll

2018-08-02 13:12 - 2018-06-08 08:55 - 000655360 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll

2018-08-02 13:12 - 2018-06-08 08:55 - 000554496 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll

2018-08-02 13:12 - 2018-06-08 08:55 - 000400896 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll

2018-08-02 13:12 - 2018-06-08 08:55 - 000377344 _____ (Microsoft Corporation) C:\Windows\system32\rpcss.dll

2018-08-02 13:12 - 2018-06-08 08:55 - 000330240 _____ (Microsoft Corporation) C:\Windows\system32\zipfldr.dll

2018-08-02 13:12 - 2018-06-08 08:55 - 000261120 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll

2018-08-02 13:12 - 2018-06-08 08:55 - 000254464 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll

2018-08-02 13:12 - 2018-06-08 08:55 - 000172032 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll

2018-08-02 13:12 - 2018-06-08 08:55 - 000171008 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll

2018-08-02 13:12 - 2018-06-08 08:55 - 000070144 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll

2018-08-02 13:12 - 2018-06-08 08:55 - 000050176 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll

2018-08-02 13:12 - 2018-06-08 08:55 - 000043008 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll

2018-08-02 13:12 - 2018-06-08 08:54 - 000644096 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll

2018-08-02 13:12 - 2018-06-08 08:54 - 000269824 _____ (Microsoft Corporation) C:\Windows\system32\dnsapi.dll

2018-08-02 13:12 - 2018-06-08 08:54 - 000131584 _____ (Microsoft Corporation) C:\Windows\system32\dnsrslvr.dll

2018-08-02 13:12 - 2018-06-08 08:54 - 000006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll

2018-08-02 13:12 - 2018-06-08 08:29 - 000007168 _____ (Microsoft Corporation) C:\Windows\system32\comcat.dll

2018-08-02 13:12 - 2018-06-08 08:25 - 000271360 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe

2018-08-02 13:12 - 2018-06-08 08:24 - 000262656 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe

2018-08-02 13:12 - 2018-06-08 08:19 - 000022016 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe

2018-08-02 13:12 - 2018-06-07 08:57 - 000564736 _____ (Microsoft Corporation) C:\Windows\system32\MPSSVC.dll

2018-08-02 13:12 - 2018-04-25 08:54 - 000088576 _____ (Microsoft Corporation) C:\Windows\system32\wkssvc.dll

2018-08-02 13:11 - 2018-07-13 12:07 - 001309888 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys

2018-08-02 13:11 - 2018-07-13 12:06 - 000240832 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys

2018-08-02 13:11 - 2018-07-13 12:06 - 000187584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS

2018-08-02 13:11 - 2018-06-20 20:09 - 000002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll

2018-08-02 13:11 - 2018-06-20 17:00 - 000348824 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll

2018-08-02 13:11 - 2018-06-16 09:36 - 020286464 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2018-08-02 13:11 - 2018-06-16 09:19 - 002724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2018-08-02 13:11 - 2018-06-16 09:19 - 000004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll

2018-08-02 13:11 - 2018-06-16 09:06 - 000498176 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2018-08-02 13:11 - 2018-06-16 09:06 - 000062464 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2018-08-02 13:11 - 2018-06-16 09:05 - 000341504 _____ (Microsoft Corporation) C:\Windows\system32\html.iec

2018-08-02 13:11 - 2018-06-16 09:05 - 000047616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll

2018-08-02 13:11 - 2018-06-16 09:04 - 000064000 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll

2018-08-02 13:11 - 2018-06-16 09:02 - 002295296 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2018-08-02 13:11 - 2018-06-16 08:59 - 000047104 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2018-08-02 13:11 - 2018-06-16 08:59 - 000030720 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2018-08-02 13:11 - 2018-06-16 08:57 - 000476160 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2018-08-02 13:11 - 2018-06-16 08:56 - 000662016 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll

2018-08-02 13:11 - 2018-06-16 08:56 - 000115712 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2018-08-02 13:11 - 2018-06-16 08:56 - 000104960 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe

2018-08-02 13:11 - 2018-06-16 08:55 - 000620032 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2018-08-02 13:11 - 2018-06-16 08:49 - 000668160 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe

2018-08-02 13:11 - 2018-06-16 08:47 - 000416256 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll

2018-08-02 13:11 - 2018-06-16 08:42 - 000073216 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx

2018-08-02 13:11 - 2018-06-16 08:42 - 000060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll

2018-08-02 13:11 - 2018-06-16 08:41 - 000091136 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll

2018-08-02 13:11 - 2018-06-16 08:39 - 000168960 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2018-08-02 13:11 - 2018-06-16 08:38 - 000076288 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2018-08-02 13:11 - 2018-06-16 08:37 - 000279040 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2018-08-02 13:11 - 2018-06-16 08:36 - 000130048 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll

2018-08-02 13:11 - 2018-06-16 08:34 - 004496384 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2018-08-02 13:11 - 2018-06-16 08:32 - 013680128 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2018-08-02 13:11 - 2018-06-16 08:30 - 000230400 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll

2018-08-02 13:11 - 2018-06-16 08:29 - 000696320 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2018-08-02 13:11 - 2018-06-16 08:28 - 002060288 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2018-08-02 13:11 - 2018-06-16 08:28 - 000692224 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2018-08-02 13:11 - 2018-06-16 08:27 - 001155072 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll

2018-08-02 13:11 - 2018-06-16 08:08 - 002767872 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2018-08-02 13:11 - 2018-06-16 08:05 - 001313792 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2018-08-02 13:11 - 2018-06-16 08:04 - 000710144 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2018-08-02 13:11 - 2018-06-13 08:25 - 002404352 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2018-08-02 13:11 - 2018-06-08 09:02 - 004050624 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe

2018-08-02 13:11 - 2018-06-08 09:02 - 003962048 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe

2018-08-02 13:11 - 2018-06-08 09:02 - 000189632 _____ (Microsoft Corporation) C:\Windows\system32\halmacpi.dll

2018-08-02 13:11 - 2018-06-08 09:02 - 000189632 _____ (Microsoft Corporation) C:\Windows\system32\hal.dll

2018-08-02 13:11 - 2018-06-08 09:02 - 000137920 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys

2018-08-02 13:11 - 2018-06-08 09:02 - 000136384 _____ (Microsoft Corporation) C:\Windows\system32\halacpi.dll

2018-08-02 13:11 - 2018-06-08 09:02 - 000067264 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys

2018-08-02 13:11 - 2018-06-08 08:57 - 001310488 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll

2018-08-02 13:11 - 2018-06-08 08:55 - 000872448 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll

2018-08-02 13:11 - 2018-06-08 08:55 - 000294400 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll

2018-08-02 13:11 - 2018-06-08 08:55 - 000223232 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll

2018-08-02 13:11 - 2018-06-08 08:55 - 000146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll

2018-08-02 13:11 - 2018-06-08 08:55 - 000141312 _____ (Microsoft Corporation) C:\Windows\system32\rpchttp.dll

2018-08-02 13:11 - 2018-06-08 08:55 - 000099840 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll

2018-08-02 13:11 - 2018-06-08 08:55 - 000060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll

2018-08-02 13:11 - 2018-06-08 08:55 - 000026112 _____ (Microsoft Corporation) C:\Windows\system32\oleres.dll

2018-08-02 13:11 - 2018-06-08 08:55 - 000022016 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll

2018-08-02 13:11 - 2018-06-08 08:54 - 000690688 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll

2018-08-02 13:11 - 2018-06-08 08:54 - 000082432 _____ (Microsoft Corporation) C:\Windows\system32\bcrypt.dll

2018-08-02 13:11 - 2018-06-08 08:54 - 000050688 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll

2018-08-02 13:11 - 2018-06-08 08:54 - 000038912 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll

2018-08-02 13:11 - 2018-06-08 08:54 - 000017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll

2018-08-02 13:11 - 2018-06-08 08:54 - 000005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll

2018-08-02 13:11 - 2018-06-08 08:54 - 000004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll

2018-08-02 13:11 - 2018-06-08 08:54 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll

2018-08-02 13:11 - 2018-06-08 08:54 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll

2018-08-02 13:11 - 2018-06-08 08:54 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll

2018-08-02 13:11 - 2018-06-08 08:54 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll

2018-08-02 13:11 - 2018-06-08 08:54 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll

2018-08-02 13:11 - 2018-06-08 08:54 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll

2018-08-02 13:11 - 2018-06-08 08:54 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll

2018-08-02 13:11 - 2018-06-08 08:54 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll

2018-08-02 13:11 - 2018-06-08 08:54 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll

2018-08-02 13:11 - 2018-06-08 08:54 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll

2018-08-02 13:11 - 2018-06-08 08:54 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll

2018-08-02 13:11 - 2018-06-08 08:54 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll

2018-08-02 13:11 - 2018-06-08 08:54 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll

2018-08-02 13:11 - 2018-06-08 08:54 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll

2018-08-02 13:11 - 2018-06-08 08:54 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll

2018-08-02 13:11 - 2018-06-08 08:54 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll

2018-08-02 13:11 - 2018-06-08 08:54 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll

2018-08-02 13:11 - 2018-06-08 08:54 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll

2018-08-02 13:11 - 2018-06-08 08:54 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll

2018-08-02 13:11 - 2018-06-08 08:54 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll

2018-08-02 13:11 - 2018-06-08 08:54 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll

2018-08-02 13:11 - 2018-06-08 08:54 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll

2018-08-02 13:11 - 2018-06-08 08:28 - 000030720 _____ (Microsoft Corporation) C:\Windows\system32\dnscacheugc.exe

2018-08-02 13:11 - 2018-06-08 08:27 - 000097792 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe

2018-08-02 13:11 - 2018-06-08 08:27 - 000050688 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys

2018-08-02 13:11 - 2018-06-08 08:27 - 000050176 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe

2018-08-02 13:11 - 2018-06-08 08:27 - 000029696 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll

2018-08-02 13:11 - 2018-06-08 08:27 - 000016896 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe

2018-08-02 13:11 - 2018-06-08 08:24 - 000107008 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\videoprt.sys

2018-08-02 13:11 - 2018-06-08 08:21 - 000226304 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys

2018-08-02 13:11 - 2018-06-08 08:21 - 000124416 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys

2018-08-02 13:11 - 2018-06-08 08:21 - 000098304 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys

2018-08-02 13:11 - 2018-06-08 08:19 - 000069632 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe

2018-08-02 13:11 - 2018-06-08 08:19 - 000036352 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll

2018-08-02 13:11 - 2018-06-08 08:19 - 000015872 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll

2018-08-02 13:11 - 2018-06-08 08:19 - 000006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll

2018-08-02 13:11 - 2018-06-08 08:19 - 000004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll

2018-08-02 13:11 - 2018-06-08 08:19 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll

2018-08-02 13:11 - 2018-06-08 08:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll

2018-08-02 13:11 - 2018-06-07 08:57 - 000463360 _____ (Microsoft Corporation) C:\Windows\system32\FirewallAPI.dll

2018-08-02 13:11 - 2018-06-07 08:57 - 000089088 _____ (Microsoft Corporation) C:\Windows\system32\icfupgd.dll

2018-08-02 13:11 - 2018-06-07 08:34 - 000060416 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mpsdrv.sys

2018-08-02 13:11 - 2018-06-07 08:34 - 000018944 _____ (Microsoft Corporation) C:\Windows\system32\wfapigp.dll

2018-08-02 13:11 - 2018-05-02 08:30 - 000285184 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys

2018-08-02 13:11 - 2018-05-02 08:30 - 000259584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys

2018-08-02 13:11 - 2018-05-02 08:30 - 000076288 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys

2018-08-02 13:11 - 2018-05-02 08:30 - 000046592 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys

2018-08-02 13:11 - 2018-05-02 08:30 - 000024576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys

2018-08-02 13:11 - 2018-05-02 08:30 - 000020480 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys

2018-08-02 13:11 - 2018-05-02 08:29 - 000006016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys

2018-08-02 13:11 - 2018-04-26 06:05 - 000918296 _____ (Microsoft Corporation) C:\Windows\system32\ucrtbase.dll

2018-08-02 13:11 - 2018-04-26 06:05 - 000065880 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-private-l1-1-0.dll

2018-08-02 13:11 - 2018-04-26 06:05 - 000021848 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-math-l1-1-0.dll

2018-08-02 13:11 - 2018-04-26 06:05 - 000018776 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-multibyte-l1-1-0.dll

2018-08-02 13:11 - 2018-04-26 06:05 - 000017240 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-string-l1-1-0.dll

2018-08-02 13:11 - 2018-04-26 06:05 - 000017240 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-stdio-l1-1-0.dll

2018-08-02 13:11 - 2018-04-26 06:05 - 000015704 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0.dll

2018-08-02 13:11 - 2018-04-26 06:05 - 000015192 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-convert-l1-1-0.dll

2018-08-02 13:11 - 2018-04-26 06:05 - 000013656 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-time-l1-1-0.dll

2018-08-02 13:11 - 2018-04-26 06:05 - 000013656 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-2-0.dll

2018-08-02 13:11 - 2018-04-26 06:05 - 000013152 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-filesystem-l1-1-0.dll

2018-08-02 13:11 - 2018-04-26 06:05 - 000012120 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-process-l1-1-0.dll

2018-08-02 13:11 - 2018-04-26 06:05 - 000012120 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-conio-l1-1-0.dll

2018-08-02 13:11 - 2018-04-26 06:05 - 000011608 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-utility-l1-1-0.dll

2018-08-02 13:11 - 2018-04-26 06:05 - 000011608 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-locale-l1-1-0.dll

2018-08-02 13:11 - 2018-04-26 06:05 - 000011608 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-heap-l1-1-0.dll

2018-08-02 13:11 - 2018-04-26 06:05 - 000011608 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-environment-l1-1-0.dll

2018-08-02 13:11 - 2018-04-26 06:05 - 000011608 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-2-0.dll

2018-08-02 13:11 - 2018-04-26 06:05 - 000011608 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-1.dll

2018-08-02 13:11 - 2018-04-26 06:05 - 000011096 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l2-1-0.dll

2018-08-02 13:11 - 2018-04-26 06:05 - 000011096 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-timezone-l1-1-0.dll

2018-08-02 13:11 - 2018-04-26 06:05 - 000011096 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l2-1-0.dll

2018-08-02 13:11 - 2018-04-26 06:05 - 000011096 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-2-0.dll

2018-08-02 13:11 - 2018-04-25 08:17 - 000088576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dfsc.sys

2018-08-02 13:07 - 2018-06-13 10:59 - 000122560 _____ (Microsoft Corporation) C:\Windows\system32\CompatTelRunner.exe

2018-08-02 13:07 - 2018-06-13 08:53 - 000554496 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

2018-08-02 13:07 - 2018-06-08 06:05 - 002703872 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe

2018-08-02 13:07 - 2018-06-08 06:05 - 001359360 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll

2018-08-02 13:07 - 2018-06-08 06:05 - 000619520 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll

2018-08-02 13:07 - 2018-06-08 06:05 - 000517120 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll

2018-08-02 13:07 - 2018-06-08 06:05 - 000358912 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll

2018-08-02 13:07 - 2018-06-08 06:05 - 000353792 _____ (Microsoft Corporation) C:\Windows\system32\centel.dll

2018-08-02 13:07 - 2018-06-08 06:05 - 000246272 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll

2018-08-02 13:07 - 2018-06-08 06:05 - 000202752 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll

2018-08-02 11:21 - 2018-08-02 11:21 - 000000207 _____ C:\Windows\tweaking.com-regbackup-KELLY-PC-Windows-7-Home-Premium-(32-bit).dat

2018-08-02 11:20 - 2018-08-07 19:57 - 000188657 _____ C:\Windows\Tweaking.com - Windows Repair Setup Log.txt

2018-08-02 11:20 - 2018-08-02 11:20 - 000002128 _____ C:\Users\Kelly\Desktop\Tweaking.com - Windows Repair.lnk

2018-08-02 11:20 - 2018-08-02 11:20 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tweaking.com

2018-08-02 11:20 - 2018-08-02 11:20 - 000000000 ____D C:\Program Files\Tweaking.com

2018-08-02 11:19 - 2018-08-02 11:19 - 038150664 _____ (Tweaking.com) C:\Users\Kelly\Desktop\tweaking.com_windows_repair_aio_setup.exe

2018-07-30 11:56 - 2018-07-30 11:56 - 000000000 ____D C:\swsetup

2018-07-30 11:56 - 2018-07-30 11:56 - 000000000 ____D C:\Program Files\Intel

2018-07-30 11:56 - 2018-07-30 11:56 - 000000000 ____D C:\Intel

2018-07-30 11:53 - 2018-07-30 11:53 - 010607800 _____ (Hewlett-Packard ) C:\Users\Kelly\Downloads\sp47845.exe

2018-07-27 19:07 - 2018-07-28 14:08 - 000024688 _____ C:\Windows\system32\Drivers\TrueSight.sys

2018-07-27 19:06 - 2018-07-27 20:35 - 000000000 ____D C:\ProgramData\RogueKiller

2018-07-27 19:06 - 2018-07-27 19:06 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RogueKiller

2018-07-27 19:06 - 2018-07-27 19:06 - 000000000 ____D C:\Program Files\RogueKiller

2018-07-27 19:02 - 2018-07-27 19:02 - 000029025 _____ C:\ProgramData\agent.update.1532743337.bdinstall.bin

2018-07-27 18:59 - 2018-07-27 18:59 - 000001149 _____ C:\Users\Public\Desktop\Bitdefender Antivirus Free.lnk

2018-07-27 18:59 - 2018-07-27 18:59 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bitdefender Antivirus Free

2018-07-27 18:59 - 2018-05-29 05:04 - 000157256 _____ (BitDefender LLC) C:\Windows\system32\Drivers\gzflt.sys

2018-07-27 18:58 - 2018-04-27 06:29 - 001010256 _____ (BitDefender S.R.L. Bucharest, ROMANIA) C:\Windows\system32\Drivers\atc.sys

2018-07-27 18:58 - 2018-04-25 05:26 - 000520816 _____ (Bitdefender) C:\Windows\system32\Drivers\trufos.sys

2018-07-27 18:58 - 2018-04-19 11:15 - 000208216 _____ (BitDefender S.R.L. Bucharest, ROMANIA) C:\Windows\system32\Drivers\edrsensor.sys

2018-07-27 18:58 - 2018-04-19 05:11 - 000126056 _____ (Bitdefender) C:\Windows\system32\Drivers\bddci.sys

2018-07-27 18:58 - 2018-04-17 11:27 - 001419144 _____ (BitDefender) C:\Windows\system32\Drivers\avc3.sys

2018-07-27 18:35 - 2018-08-10 19:29 - 000000000 ____D C:\Program Files\Bitdefender Antivirus Free

2018-07-27 18:33 - 2018-07-27 19:02 - 000000000 ____D C:\Program Files\Bitdefender Agent

2018-07-27 18:33 - 2018-07-27 18:33 - 000047718 _____ C:\ProgramData\agent.1532741582.bdinstall.bin

2018-07-26 10:17 - 2018-07-26 10:20 - 000000000 ____D C:\AVG_Remover

2018-07-26 10:16 - 2018-07-26 10:16 - 007986864 _____ ( ) C:\Users\Kelly\Downloads\AVG_Remover.exe

2018-07-26 10:15 - 2018-07-26 10:16 - 000000079 _____ C:\Windows\wininit.ini

2018-07-24 08:38 - 2017-09-22 20:04 - 000000828 _____ C:\Windows\system32\Drivers\etc\hosts.20180724-083826.backup

2018-07-23 20:46 - 2018-07-26 10:21 - 000000000 ____D C:\Program Files\Spybot - Search & Destroy 2

2018-07-23 20:46 - 2018-07-26 10:16 - 000000000 ____D C:\ProgramData\Spybot - Search & Destroy

2018-07-23 20:42 - 2018-07-23 20:43 - 069910960 _____ (Safer-Networking Ltd. ) C:\Users\Kelly\Downloads\spybotsd-2.7.64.0.exe

2018-07-23 20:31 - 2018-07-24 16:25 - 000000000 ____D C:\Users\Kelly\AppData\LocalLow\Mozilla

2018-07-23 20:31 - 2018-07-23 20:35 - 000000000 ____D C:\Users\Kelly\AppData\Local\Mozilla

2018-07-23 20:31 - 2018-07-23 20:31 - 000001128 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox.lnk

2018-07-23 20:31 - 2018-07-23 20:31 - 000000000 ____D C:\Program Files\Mozilla Maintenance Service

2018-07-23 20:31 - 2018-07-23 20:31 - 000000000 ____D C:\Program Files\Mozilla Firefox

2018-07-23 20:25 - 2018-07-23 20:25 - 000000000 ____D C:\Program Files\Common Files\Oracle

2018-07-23 20:24 - 2018-07-23 20:24 - 000000000 ____D C:\Program Files\Common Files\Java

2018-07-12 17:01 - 2018-07-12 17:01 - 000145776 _____ C:\Windows\Minidump\071218-11296-01.dmp

 

==================== One Month Modified files and folders ========

 

(If an entry is included in the fixlist, the file/folder will be moved.)

 

2018-08-10 11:59 - 2018-02-11 19:24 - 000000320 _____ C:\Windows\Tasks\HPCeeScheduleForKelly.job

2018-08-10 11:47 - 2009-07-13 21:34 - 000021888 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2018-08-10 11:47 - 2009-07-13 21:34 - 000021888 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2018-08-10 11:33 - 2009-07-13 21:53 - 000000006 ____H C:\Windows\Tasks\SA.DAT

2018-08-09 21:29 - 2015-02-13 18:10 - 000016384 _____ C:\Users\Kelly\Documents\UserId.xls

2018-08-09 18:56 - 2015-03-14 15:27 - 000002177 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk

2018-08-08 10:07 - 2013-08-06 20:39 - 000121120 _____ C:\Users\Kelly\AppData\Local\GDIPFONTCACHEV1.DAT

2018-08-07 20:23 - 2009-07-13 21:33 - 000394888 _____ C:\Windows\system32\FNTCACHE.DAT

2018-08-07 20:15 - 2010-11-20 14:01 - 000781298 _____ C:\Windows\system32\PerfStringBackup.INI

2018-08-07 20:15 - 2009-07-13 19:37 - 000000000 ____D C:\Windows\inf

2018-08-06 11:21 - 2009-07-13 19:37 - 000000000 ____D C:\Windows\system32\NDF

2018-08-02 16:44 - 2009-07-13 19:37 - 000000000 ____D C:\Windows\rescache

2018-08-02 13:36 - 2014-12-20 18:30 - 000000000 ____D C:\Windows\system32\appraiser

2018-08-02 13:29 - 2013-08-14 19:04 - 000000000 ____D C:\Windows\system32\MRT

2018-08-02 13:24 - 2013-08-11 13:26 - 131626216 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe

2018-08-02 11:36 - 2009-07-13 19:04 - 000000855 _____ C:\Windows\system32\Drivers\etc\hosts_bak_274

2018-07-30 11:56 - 2011-09-27 11:48 - 000000000 ___HD C:\Program Files\InstallShield Installation Information

2018-07-26 17:06 - 2013-10-05 13:23 - 000000000 ____D C:\Users\Kelly\AppData\Roaming\Yahoo!

2018-07-26 16:43 - 2013-09-19 19:53 - 000000000 ____D C:\Users\Kelly\AppData\LocalLow\Temp

2018-07-26 10:14 - 2009-07-13 19:04 - 000000942 _____ C:\Windows\system32\Drivers\etc\hosts_bak_706

2018-07-25 17:09 - 2015-04-03 22:05 - 000000000 ____D C:\Program Files\Java

2018-07-24 08:38 - 2009-07-13 19:04 - 000454639 ____R C:\Windows\system32\Drivers\etc\hosts.20180726-101454.backup

2018-07-23 20:34 - 2015-04-19 17:17 - 000842240 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe

2018-07-23 20:34 - 2015-04-19 17:17 - 000175104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl

2018-07-23 20:34 - 2013-08-26 19:28 - 000000000 ____D C:\Users\Kelly\AppData\Local\Adobe

2018-07-23 20:34 - 2013-08-10 17:09 - 000000000 ____D C:\Windows\system32\Macromed

2018-07-23 20:31 - 2013-08-11 17:44 - 000000000 ____D C:\Users\Kelly\AppData\Roaming\Mozilla

2018-07-23 20:28 - 2013-08-13 14:58 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\IncrediMail

2018-07-23 20:25 - 2015-04-03 22:06 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java

2018-07-23 20:23 - 2015-04-03 22:06 - 000096632 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll

2018-07-12 17:01 - 2016-05-03 20:46 - 1067922273 _____ C:\Windows\MEMORY.DMP

2018-07-12 17:01 - 2016-05-03 20:46 - 000000000 ____D C:\Windows\Minidump

2018-07-12 09:30 - 2013-08-06 20:32 - 000000000 ____D C:\Program Files\TeamViewer

2018-07-11 11:10 - 2016-03-13 17:08 - 000002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk

2018-07-11 06:31 - 2018-06-14 09:14 - 000000000 ____D C:\ProgramData\BDLogging

 

==================== Files in the root of some directories =======

 

2013-08-11 17:48 - 2014-06-09 15:57 - 000198512 _____ () C:\Users\Kelly\Quicken 2008newOFXLOG.DAT

2013-08-11 17:48 - 2014-04-13 16:25 - 002218832 _____ () C:\Users\Kelly\Quicken 2008newOFXOLD.DAT

2016-12-01 13:59 - 2016-11-30 13:02 - 000012542 _____ () C:\Program Files\Common Files\client.wyc

 

==================== Bamital & volsnap ======================

 

(There is no automatic fix for files that do not pass verification.)

 

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\system32\winlogon.exe => File is digitally signed

C:\Windows\system32\wininit.exe => File is digitally signed

C:\Windows\system32\svchost.exe => File is digitally signed

C:\Windows\system32\services.exe => File is digitally signed

C:\Windows\system32\User32.dll => File is digitally signed

C:\Windows\system32\userinit.exe => File is digitally signed

C:\Windows\system32\rpcss.dll => File is digitally signed

C:\Windows\system32\dnsapi.dll => File is digitally signed

C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

 

LastRegBack: 2018-08-06 00:35

 

==================== End of FRST.txt ============================

 

 

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 02.08.2018

Ran by Kelly (10-08-2018 19:29:50)

Running from C:\Users\Kelly\Desktop

Windows 7 Home Premium Service Pack 1 (X86) (2013-08-07 03:26:02)

Boot Mode: Normal

==========================================================

 

 

==================== Accounts: =============================

 

Administrator (S-1-5-21-2863067232-3147982578-4033237767-500 - Administrator - Disabled)

ericjs (S-1-5-21-2863067232-3147982578-4033237767-1003 - Administrator - Enabled)

Guest (S-1-5-21-2863067232-3147982578-4033237767-501 - Limited - Disabled)

HomeGroupUser$ (S-1-5-21-2863067232-3147982578-4033237767-1002 - Limited - Enabled)

Kelly (S-1-5-21-2863067232-3147982578-4033237767-1000 - Administrator - Enabled) => C:\Users\Kelly

 

==================== Security Center ========================

 

(If an entry is included in the fixlist, it will be removed.)

 

 

==================== Installed Programs ======================

 

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

 

32 Bit HP CIO Components Installer (HKLM\...\{92127AF5-FDD8-4ADF-BC40-C356C9EE0B7D}) (Version: 6.1.1 - Hewlett-Packard) Hidden

Acronis Disk Director Suite (HKLM\...\{2300EE96-0A41-4FAB-BD03-989EC44577A0}) (Version: 10.0.2160 - Acronis)

Acronis True Image Workstation (HKLM\...\{2545228C-6A70-4A01-B936-6DA77984D298}) (Version: 9.1.3887 - Acronis)

Adobe Acrobat Reader DC (HKLM\...\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}) (Version: 18.011.20055 - Adobe Systems Incorporated)

Adobe Flash Player 30 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 30.0.0.134 - Adobe Systems Incorporated)

Adobe Flash Player 30 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 30.0.0.134 - Adobe Systems Incorporated)

Amazon Kindle (HKU\S-1-5-21-2863067232-3147982578-4033237767-1000\...\Amazon Kindle) (Version: 1.14.0.43019 - Amazon)

Bejeweled 2 Deluxe® (HKLM\...\Bejeweled 2 Deluxe®) (Version: 32.0.0.0 - Shockwave.com)

Bitdefender Agent (HKLM\...\Bitdefender Agent) (Version: 21.0.25.59 - Bitdefender)

Bitdefender Antivirus Free (HKLM\...\{1FCCF41D-5F00-4FE2-9653-162D0486C8B4}) (Version: 1.0.12.41 - Bitdefender)

BufferChm (HKLM\...\{FA0FF682-CC70-4C57-93CD-E276F3E7537E}) (Version: 140.0.212.000 - Hewlett-Packard) Hidden

Cisco EAP-FAST Module (HKLM\...\{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}) (Version: 2.2.14 - Cisco Systems, Inc.)

Cisco LEAP Module (HKLM\...\{AF312B06-5C5C-468E-89B3-BE6DE2645722}) (Version: 1.0.19 - Cisco Systems, Inc.)

Cisco PEAP Module (HKLM\...\{0A4EF0E6-A912-4CDE-A7F3-6E56E7C13A2F}) (Version: 1.1.6 - Cisco Systems, Inc.)

Copy (HKLM\...\{9BE466FF-70B7-4DA8-807C-DB4C3610FDAA}) (Version: 140.0.212.000 - Hewlett-Packard) Hidden

Destinations (HKLM\...\{BD7204BA-DD64-499E-9B55-6A282CDF4FA4}) (Version: 140.0.77.000 - Hewlett-Packard) Hidden

DeviceDiscovery (HKLM\...\{1458BB78-1DC5-4BC0-B9A3-2B644F5A8105}) (Version: 140.0.212.000 - Hewlett-Packard) Hidden

EaseUS Partition Master 12.8 (HKLM\...\EaseUS Partition Master_is1) (Version:  - EaseUS)

EasyTether (HKLM\...\{126F8B16-3BE0-4D4F-B9DB-61B49AA793B1}) (Version: 1.3.3 - Mobile Stream) Hidden

EasyTether (HKLM\...\{6f3b40d5-c81b-469b-a7a2-b560f8561a8c}) (Version: 1.3.3 - Mobile Stream)

EasyTether ADB USB driver (HKLM\...\{D68C899F-0BEC-4C3F-897D-0F0390894D4A}) (Version: 1.0.6 - Mobile Stream)

FileHippo App Manager (HKLM\...\FileHippo.com) (Version:  - FileHippo.com)

Google Chrome (HKLM\...\Google Chrome) (Version: 68.0.3440.106 - Google Inc.)

Google Update Helper (HKLM\...\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.33.17 - Google Inc.) Hidden

Google Update Helper (HKLM\...\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}) (Version: 1.3.25.11 - Google Inc.) Hidden

GPBaseService2 (HKLM\...\{BB3447F6-9553-4AA9-960E-0DB5310C5779}) (Version: 140.0.211.000 - Hewlett-Packard) Hidden

HP Customer Participation Program 14.0 (HKLM\...\HPExtendedCapabilities) (Version: 14.0 - HP)

HP DeskJet 2130 series Basic Device Software (HKLM\...\{8BECF3A4-E3DF-4A75-BB74-C7A50443A019}) (Version: 35.0.61.54677 - Hewlett-Packard Co.)

HP DeskJet 2130 series Help (HKLM\...\{1CDFD3C9-BDF8-4DDC-BDA2-EBC53F938B5F}) (Version: 35.0.0 - Hewlett Packard)

HP Imaging Device Functions 14.0 (HKLM\...\HP Imaging Device Functions) (Version: 14.0 - HP)

HP Photo Creations (HKLM\...\HP Photo Creations) (Version: 1.0.0.2024 - HP Photo Creations Powered by RocketLife)

HP Smart Web Printing 4.60 (HKLM\...\HP Smart Web Printing) (Version: 4.60 - HP)

HP Solution Center 14.0 (HKLM\...\HP Solution Center & Imaging Support Tools) (Version: 14.0 - HP)

HP Support Solutions Framework (HKLM\...\{F6A11738-3EE4-4573-AEA5-6CD5D491C167}) (Version: 12.9.24.3 - Hewlett-Packard Company)

HP Touchpoint Analytics Client (HKLM\...\{E5FB98E0-0784-44F0-8CEC-95CD4690C43F}) (Version: 4.0.2.1439 - HP Inc.)

HP Update (HKLM\...\{912D30CF-F39E-4B31-AD9A-123C6B794EE2}) (Version: 5.005.002.002 - Hewlett-Packard)

HPProductAssistant (HKLM\...\{150B6201-E9E6-4DFB-960E-CCBD53FBDDED}) (Version: 140.0.212.000 - Hewlett-Packard) Hidden

HPSSupply (HKLM\...\{AC35A885-0F8F-4857-B7DA-6E8DFB43E6B3}) (Version: 140.0.211.000 - Hewlett-Packard) Hidden

IncrediMail (HKLM\...\{35505AE1-27E2-4206-B3BF-58771803B8D0}) (Version: 6.6.0.5288 - IncrediMail) Hidden

Intel® Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version: 8.15.10.1930 - Intel Corporation)

Java 8 Update 181 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F32180181F0}) (Version: 8.0.1810.13 - Oracle Corporation)

Logitech SetPoint 6.67 (HKLM\...\sp6) (Version: 6.67.83 - Logitech)

Logitech Unifying Software 2.50 (HKLM\...\Logitech Unifying) (Version: 2.50.25 - Logitech)

Macrium Reflect Free Edition (HKLM\...\{EF9A9E57-9506-45D7-9C36-0ACC3341F737}) (Version: 6.3.1849 - Paramount Software (UK) Ltd.) Hidden

Macrium Reflect Free Edition (HKLM\...\MacriumReflect) (Version: 6.3 - Paramount Software (UK) Ltd.)

Malwarebytes version 3.5.1.2522 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 3.5.1.2522 - Malwarebytes)

MarketResearch (HKLM\...\{D360FA88-17C8-4F14-B67F-13AAF9607B12}) (Version: 140.0.212.000 - Hewlett-Packard) Hidden

Marxio Timer 1.11 (HKLM\...\Marxio Timer_is1) (Version:  - marxio-tools)

Microsoft .NET Framework 4.7.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.7.03062 - Microsoft Corporation)

Microsoft Office 2000 Premium (HKLM\...\{00000409-78E1-11D2-B60F-006097C998E7}) (Version: 9.00.2720 - Microsoft Corporation)

Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50907.0 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM\...\{CA8A885F-E95B-3FC6-BB91-F4D9377C7686}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Mobile Hotspot Admin (HKLM\...\{AEFF9E60-3E93-41EE-9895-311F7D1C5FFD}) (Version: 1.0.0.2 - ZTE Corporation)

Mozilla Firefox 61.0.1 (x86 en-US) (HKLM\...\Mozilla Firefox 61.0.1 (x86 en-US)) (Version: 61.0.1 - Mozilla)

Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 61.0.1 - Mozilla)

MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)

MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)

MSXML 4.0 SP2 Parser and SDK (HKLM\...\{716E0306-8318-4364-8B8F-0CC4E9376BAC}) (Version: 4.20.9818.0 - Microsoft Corporation)

OLYMPUS Digital Camera Updater (HKLM\...\{2A9E8F56-C31B-4DBB-BFE2-0F4EC8192355}) (Version: 1.0.3 - OLYMPUS IMAGING CORP.)

OLYMPUS Viewer 3 (HKLM\...\{B8737126-7348-4F84-93BF-D4A82E653CA7}) (Version: 1.1.0 - OLYMPUS IMAGING CORP.)

Paint Shop Pro 7 Try And Buy (HKLM\...\{D6DE02C7-1F47-11D4-9515-00105AE4B89A}) (Version: 7.0.4.0000 - Jasc Software Inc)

Product Improvement Study for HP DeskJet 2130 series (HKLM\...\{EFF29656-8F1A-4043-B2D0-9FB4619B45AF}) (Version: 35.0.61.54677 - Hewlett-Packard Co.)

Quicken 2017 (HKLM\...\{E5AE4F66-CDA1-432A-A69E-C685D454ABDA}) (Version: 26.1.17.2 - Quicken)

Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5645 - Realtek Semiconductor Corp.)

REALTEK Wireless LAN Driver and Utility (HKLM\...\{9C049509-055C-4CFF-A116-1D12312225EB}) (Version: 1.00.0267 - REALTEK Semiconductor Corp.)

RogueKiller version 12.12.28.0 (HKLM\...\8B3D7924-ED89-486B-8322-E8594065D5CB_is1) (Version: 12.12.28.0 - Adlice Software)

Samsung USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.63.0 - Samsung Electronics Co., Ltd.)

Serif CraftArtist (HKLM\...\{C1B148C9-FACF-45F1-8356-4E1C5E3DAA5B}) (Version: 1.0.6.046 - Serif (Europe) Ltd)

Serif CraftArtist Greeting Cards Collection (HKLM\...\{7C08721F-AC43-4198-A35B-93442DD10A26}) (Version: 1.0.2.014 - Serif (Europe) Ltd)

Serif Digital Scrapbook Artist 2 (HKLM\...\{1439B98F-681E-4D51-BB90-D04474E4C6EA}) (Version: 2.0.0.011 - Serif (Europe) Ltd)

Serif PagePlus Essentials (HKLM\...\{26F8F39E-C228-4E3C-93A5-061FCCBFC914}) (Version: 1.0.0.004 - Serif (Europe) Ltd)

Serif PhotoPlus Essentials (HKLM\...\{350FBF89-ED3D-48F9-90CC-A04A96E9F7AD}) (Version: 1.0.0.002 - Serif (Europe) Ltd)

Serif Scan, Stitch and Share (HKLM\...\{7395C21A-6E14-4A48-922C-29C6B61AEF36}) (Version: 1.0.0.010 - Serif (Europe) Ltd)

Shop for HP Supplies (HKLM\...\Shop for HP Supplies) (Version: 14.0 - HP)

Skype Click to Call (HKLM\...\{873F8E7C-10E6-449F-BD7E-5FBA7C8E1C9B}) (Version: 8.5.0.9167 - Microsoft Corporation)

SmartWebPrinting (HKLM\...\{8FF6F5CA-4E30-4E3B-B951-204CAAA2716A}) (Version: 140.0.186.000 - Hewlett-Packard) Hidden

SolutionCenter (HKLM\...\{5DCF0E4B-F8EA-4229-A0BD-5CA6D4AFB749}) (Version: 140.0.213.000 - Hewlett-Packard) Hidden

SpywareBlaster 5.5 (HKLM\...\SpywareBlaster_is1) (Version: 5.5.0 - BrightFort LLC)

Status (HKLM\...\{2FB9EA69-51D4-4913-9AD5-762C034DE811}) (Version: 140.0.212.000 - Hewlett-Packard) Hidden

swMSM (HKLM\...\{612C34C7-5E90-47D8-9B5C-0F717DD82726}) (Version: 12.0.0.1 - Adobe Systems, Inc) Hidden

TeamViewer 11 (HKLM\...\TeamViewer) (Version: 11.0.93231 - TeamViewer)

TrayApp (HKLM\...\{CD31E63D-47FD-491C-8117-CF201D0AFAB5}) (Version: 140.0.212.000 - Hewlett-Packard) Hidden

Tweaking.com - Windows Repair (HKLM\...\Tweaking.com - Windows Repair) (Version: 4.0.24 - Tweaking.com)

VLC media player 2.1.0 (HKLM\...\VLC media player) (Version: 2.1.0 - VideoLAN)

Windows Driver Package - OLYMPUS IMAGING CORP. Camera Communication Driver Package (09/09/2009 1.0.0.0) (HKLM\...\E77704EF5E71F4F18CADFBFA68595AFE036D5D97) (Version: 09/09/2009 1.0.0.0 - OLYMPUS IMAGING CORP.)

WinZip 20.0 (HKLM\...\{CD95F661-A5C4-44F5-A6AA-ECDD91C240EE}) (Version: 20.0.11659 - WinZip Computing, S.L. )

 

==================== Custom CLSID (Whitelisted): ==========================

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

ContextMenuHandlers1: [ReflectShellExt] -> {DEBB9B79-B3DD-47F4-9E5C-EA6975BAB611} => C:\Program Files\Macrium\Reflect\RContextMenu.dll [2015-10-12] (Paramount Software UK Ltd)

ContextMenuHandlers1: [WinZip] -> {E0D79304-84BE-11CE-9641-444553540000} => C:\Program Files\WinZip\wzshlstb.dll [2015-10-27] (WinZip Computing, S.L.)

ContextMenuHandlers2: [ReflectShellExt] -> {DEBB9B79-B3DD-47F4-9E5C-EA6975BAB611} => C:\Program Files\Macrium\Reflect\RContextMenu.dll [2015-10-12] (Paramount Software UK Ltd)

ContextMenuHandlers3: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2018-05-09] (Malwarebytes)

ContextMenuHandlers4: [MSSE] -> {0365FE2C-F183-4091-AC82-BFC39FB75C49} =>  -> No File

ContextMenuHandlers4: [Offline Files] -> {474C98EE-CF3D-41f5-80E3-4AAB0AB04301} =>  -> No File

ContextMenuHandlers4: [WinZip] -> {E0D79304-84BE-11CE-9641-444553540000} => C:\Program Files\WinZip\wzshlstb.dll [2015-10-27] (WinZip Computing, S.L.)

ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => C:\Windows\system32\igfxpph.dll [2009-09-23] (Intel Corporation)

ContextMenuHandlers6: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2018-05-09] (Malwarebytes)

ContextMenuHandlers6: [Offline Files] -> {474C98EE-CF3D-41f5-80E3-4AAB0AB04301} =>  -> No File

ContextMenuHandlers6: [WinZip] -> {E0D79304-84BE-11CE-9641-444553540000} => C:\Program Files\WinZip\wzshlstb.dll [2015-10-27] (WinZip Computing, S.L.)

 

==================== Scheduled Tasks (Whitelisted) =============

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

Task: {168A3118-57BE-47C7-AB33-CB7E904CEB98} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files\Hewlett-Packard\HP Support Framework\HPSF.exe [2018-05-04] (HP Inc.)

Task: {269E14E6-2B84-4C9F-8913-CFB2F6372CC2} - System32\Tasks\Hewlett-Packard\HP Active Health\HP Active Health Scan (HPSA) => C:\Program Files\Hewlett-Packard\HP Support Framework\Resources\HPActiveHealth\ActiveHealth.exe [2017-11-19] ()

Task: {2B0FC664-FA10-4061-84C3-C89F39D785ED} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Updater => C:\Program Files\Hewlett-Packard\HP Support Solutions\Modules\HPSSFUpdater.exe [2017-09-20] (HP Inc.)

Task: {313E0FE0-5721-4707-8D1E-85D40101D41B} - System32\Tasks\{9D14D06C-86D4-4B77-B23C-ACB04DCCA21C} => C:\Windows\system32\pcalua.exe -a "C:\Users\Kelly\Documents\NOISYKEY\Setup Keystroke events.exe" -d C:\Users\Kelly\Documents\NOISYKEY

Task: {35E625B9-9625-4261-9783-82A20587CF30} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Report => C:\Program Files\Hewlett-Packard\HP Support Solutions\Modules\HPSFReport.exe [2017-06-22] (HP Inc.)

Task: {414BC97D-1E25-4F22-AABC-4E2CDE5B708D} - System32\Tasks\Macrium-Backup-{42277FA4-C507-49FD-B8F6-CFA681E432E8} => C:\Program Files\Macrium\Reflect\Reflect.exe [2017-10-19] (Paramount Software UK Ltd)

Task: {417BA52E-8518-4C90-9E9D-97CE544D8651} - System32\Tasks\Bitdefender Agent WatchDog_65D6944A0EF74FDAB96E31112AD39864 => C:\Program Files\Bitdefender Agent\WatchDog.exe [2018-05-16] (Bitdefender)

Task: {52B39951-CAB8-4DF9-883C-BF8E774E1AD7} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Product Configurator => C:\Program Files\Hewlett-Packard\HP Support Framework\Resources\ProductConfig.exe [2018-06-27] (HP Inc.)

Task: {6644BACF-75B3-45CB-8429-40C4F293D93B} - System32\Tasks\HPCustPartic.exe_{3CDCED42-0320-482A-A452-DAD84F59E2BC} => C:\Program Files\HP\HP DeskJet 2130 series\Bin\HPCustPartic.exe [2015-04-09] (Hewlett-Packard Development Company, LP)

Task: {70977D8B-2211-4069-B3CE-2DFE7BACD59E} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_DeviceScan => C:\Program Files\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2018-06-28] (HP Inc.)

Task: {754D2583-743B-478A-89A5-0F26CE9E644F} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2018-07-23] (Adobe Systems Incorporated)

Task: {761A1DD7-42A4-4AAF-B1D9-58C892BF695A} - System32\Tasks\Games\UpdateCheck_S-1-5-21-2863067232-3147982578-4033237767-1000

Task: {8407D568-69B9-4172-89D5-49FA76098591} - System32\Tasks\Tweaking.com - Windows Repair Tray Icon => C:\Program Files\Tweaking.com\Windows Repair (All in One)\WR_Tray_Icon.exe [2017-05-02] (Tweaking.com)

Task: {8C7CED41-A967-45C0-AD33-70839ACC1C2F} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files\Hewlett-Packard\HP Support Framework\HPSF.exe [2018-05-04] (HP Inc.)

Task: {97A31412-4CAA-4632-A8E2-3383DB52AA0B} - System32\Tasks\{FED474CA-7330-4EE2-9C64-63C93D8AC268} => C:\Windows\system32\pcalua.exe -a "C:\Users\Kelly\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\81FE2OMM\JavaSetup8u65 (2).exe" -d C:\Users\Kelly\Desktop

Task: {C351D1B4-E611-40DA-8764-D98FA1984751} - System32\Tasks\Adobe Flash Player NPAPI Notifier => C:\Windows\system32\Macromed\Flash\FlashUtil32_30_0_0_134_Plugin.exe [2018-07-23] (Adobe Systems Incorporated)

Task: {CB9BC30D-6F27-43CF-B6C1-932AFFA8B3FB} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2018-03-21] (Adobe Systems Incorporated)

Task: {CCB4ED9F-CAB2-42D4-A39D-7636B010B759} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2015-03-14] (Google Inc.)

Task: {D7266DF5-1E08-4D3E-90FA-8C9F54612D95} - System32\Tasks\HPCeeScheduleForKelly => C:\Program Files\Hewlett-Packard\HP Ceement\HPCEE.exe [2015-06-16] (Hewlett-Packard)

Task: {E3E84C62-9B23-45DC-96D4-A79C252CE971} - System32\Tasks\HPCustParticipation HP DeskJet 2130 series => C:\Program Files\HP\HP DeskJet 2130 series\Bin\HPCustPartic.exe [2015-04-09] (Hewlett-Packard Development Company, LP)

Task: {EC39BA1D-56C7-43FA-B618-E66137F7A876} - System32\Tasks\{BB0EE357-10FA-4B1C-A910-4CFAF18582C9} => C:\Windows\system32\pcalua.exe -a D:\Setup.exe -d D:\

Task: {F27F4DDA-5130-43F4-ACED-5A2C7FD042AE} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Updater - Resources => C:\Program Files\Hewlett-Packard\HP Support Solutions\Modules\HPSSFUpdater.exe [2017-09-20] (HP Inc.)

Task: {F509EB99-B1B1-433E-AC05-EA23AB9BC4E1} - System32\Tasks\Macrium-Backup-{D95DA6AF-1CF8-4C4B-83E4-2494F63863AB} => C:\Program Files\Macrium\Reflect\Reflect.exe [2017-10-19] (Paramount Software UK Ltd)

Task: {F6DEECEB-32AB-4982-9E67-18FD2DE6B084} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2015-03-14] (Google Inc.)

 

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

 

Task: C:\Windows\Tasks\HPCeeScheduleForKelly.job => C:\Program Files\Hewlett-Packard\HP Ceement\HPCEE.exe

Task: C:\Windows\Tasks\Macrium-Backup-{42277FA4-C507-49FD-B8F6-CFA681E432E8}.job => C:\Program Files\Macrium\Reflect\Reflect.exej-e -w C:\Users\Kelly\Documents\Reflect\My Backup(1).xml

Task: C:\Windows\Tasks\Macrium-Backup-{D95DA6AF-1CF8-4C4B-83E4-2494F63863AB}.job => C:\Program Files\Macrium\Reflect\Reflect.exej-e -w C:\Users\Kelly\Documents\Reflect\My Backup(1).xml

 

==================== Shortcuts & WMI ========================

 

(The entries could be listed to be restored or removed.)

 

 

==================== Loaded Modules (Whitelisted) ==============

 

2018-04-20 10:20 - 2013-02-27 17:17 - 000221184 _____ () C:\Program Files\Realtek\USB Wireless LAN Utility\EnumDevLib.dll

2018-04-20 10:20 - 2014-12-12 17:24 - 000044760 _____ () C:\Windows\runSW.exe

2018-07-27 18:58 - 2017-11-21 19:55 - 000220096 _____ () C:\Program Files\Bitdefender Antivirus Free\txmlutil.dll

2018-07-27 18:58 - 2018-06-18 19:15 - 000848208 _____ () C:\Program Files\Bitdefender Antivirus Free\Signatures\OTEngines\OTEngines_000_000\ashttpbr.mdl

2018-07-27 18:58 - 2018-06-18 19:15 - 000470016 _____ () C:\Program Files\Bitdefender Antivirus Free\Signatures\OTEngines\OTEngines_000_000\ashttpdsp.mdl

2018-07-27 18:58 - 2018-06-18 19:15 - 002652424 _____ () C:\Program Files\Bitdefender Antivirus Free\Signatures\OTEngines\OTEngines_000_000\ashttpph.mdl

2018-07-27 18:58 - 2018-06-18 19:15 - 001290856 _____ () C:\Program Files\Bitdefender Antivirus Free\Signatures\OTEngines\OTEngines_000_000\ashttprbl.mdl

2015-03-18 13:56 - 2014-03-26 03:00 - 000465664 _____ () C:\Program Files\Hostless Modem\Mobile Hotspot Admin\CheckNDISPort_df.exe

2015-03-18 13:56 - 2014-03-26 03:00 - 000446720 _____ () C:\Program Files\Hostless Modem\Mobile Hotspot Admin\CancelAutoPlay_df.exe

2018-01-15 16:47 - 2014-11-18 15:44 - 000255072 _____ () C:\Program Files\EaseUS\EaseUS Partition Master 12.8\bin\TrayPopupE\TrayTipAgentE.exe

2018-01-15 16:47 - 2014-02-13 16:27 - 000222792 _____ () C:\Program Files\EaseUS\EaseUS Partition Master 12.8\bin\TrayPopupE\traynet.dll

2018-01-15 16:47 - 2014-02-13 16:27 - 000275528 _____ () C:\Program Files\EaseUS\EaseUS Partition Master 12.8\bin\TrayPopupE\libcurl.dll

2018-01-15 16:47 - 2014-02-13 16:27 - 000113166 _____ () C:\Program Files\EaseUS\EaseUS Partition Master 12.8\bin\TrayPopupE\zlib1.dll

2018-01-15 16:47 - 2014-02-13 16:27 - 000249928 _____ () C:\Program Files\EaseUS\EaseUS Partition Master 12.8\bin\TrayPopupE\uexper.dll

2013-10-21 15:56 - 2006-09-04 20:26 - 000014336 _____ () C:\Program Files\OLYMPUS\OLYMPUS Viewer 3\Tracer.dll

2013-10-21 15:56 - 2011-04-25 16:12 - 000118784 _____ () C:\Program Files\OLYMPUS\OLYMPUS Viewer 3\OlyPalm.dll

2013-10-21 15:56 - 2011-08-09 15:22 - 000450560 _____ () C:\Program Files\OLYMPUS\OLYMPUS Viewer 3\OSLite.dll

2018-08-09 18:56 - 2018-08-07 17:55 - 002260824 _____ () C:\Program Files\Google\Chrome\Application\68.0.3440.106\swiftshader\libglesv2.dll

2018-08-09 18:56 - 2018-08-07 17:55 - 000124248 _____ () C:\Program Files\Google\Chrome\Application\68.0.3440.106\swiftshader\libegl.dll

 

==================== Alternate Data Streams (Whitelisted) =========

 

(If an entry is included in the fixlist, only the ADS will be removed.)

 

AlternateDataStreams: C:\ProgramData\TEMP:5C321E34 [125]

 

==================== Safe Mode (Whitelisted) ===================

 

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" value will be restored.)

 

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"

 

==================== Association (Whitelisted) ===============

 

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)

 

 

==================== Internet Explorer trusted/restricted ===============

 

(If an entry is included in the fixlist, it will be removed from the registry.)

 

IE restricted site: HKU\S-1-5-21-2863067232-3147982578-4033237767-1000\...\008i.com -> 008i.com

IE restricted site: HKU\S-1-5-21-2863067232-3147982578-4033237767-1000\...\008k.com -> 008k.com

IE restricted site: HKU\S-1-5-21-2863067232-3147982578-4033237767-1000\...\00hq.com -> 00hq.com

IE restricted site: HKU\S-1-5-21-2863067232-3147982578-4033237767-1000\...\0190-dialers.com -> 0190-dialers.com

IE restricted site: HKU\S-1-5-21-2863067232-3147982578-4033237767-1000\...\01i.info -> 01i.info

IE restricted site: HKU\S-1-5-21-2863067232-3147982578-4033237767-1000\...\02pmnzy5eo29bfk4.com -> 02pmnzy5eo29bfk4.com

IE restricted site: HKU\S-1-5-21-2863067232-3147982578-4033237767-1000\...\0411dd.com -> 0411dd.com

IE restricted site: HKU\S-1-5-21-2863067232-3147982578-4033237767-1000\...\0511zfhl.com -> 0511zfhl.com

IE restricted site: HKU\S-1-5-21-2863067232-3147982578-4033237767-1000\...\05p.com -> 05p.com

IE restricted site: HKU\S-1-5-21-2863067232-3147982578-4033237767-1000\...\0632qyw.com -> 0632qyw.com

IE restricted site: HKU\S-1-5-21-2863067232-3147982578-4033237767-1000\...\07ic5do2myz3vzpk.com -> 07ic5do2myz3vzpk.com

IE restricted site: HKU\S-1-5-21-2863067232-3147982578-4033237767-1000\...\08nigbmwk43i01y6.com -> 08nigbmwk43i01y6.com

IE restricted site: HKU\S-1-5-21-2863067232-3147982578-4033237767-1000\...\093qpeuqpmz6ebfa.com -> 093qpeuqpmz6ebfa.com

IE restricted site: HKU\S-1-5-21-2863067232-3147982578-4033237767-1000\...\0calories.net -> 0calories.net

IE restricted site: HKU\S-1-5-21-2863067232-3147982578-4033237767-1000\...\0cj.net -> 0cj.net

IE restricted site: HKU\S-1-5-21-2863067232-3147982578-4033237767-1000\...\0scan.com -> 0scan.com

IE restricted site: HKU\S-1-5-21-2863067232-3147982578-4033237767-1000\...\1-britney-spears-nude.com -> 1-britney-spears-nude.com

IE restricted site: HKU\S-1-5-21-2863067232-3147982578-4033237767-1000\...\1-domains-registrations.com -> 1-domains-registrations.com

IE restricted site: HKU\S-1-5-21-2863067232-3147982578-4033237767-1000\...\1-se.com -> 1-se.com

IE restricted site: HKU\S-1-5-21-2863067232-3147982578-4033237767-1000\...\1001movie.com -> 1001movie.com

 

There are 6091 more sites.

 

 

==================== Hosts content: ===============================

 

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

 

2009-07-13 19:04 - 2018-08-07 20:16 - 000000855 _____ C:\Windows\system32\Drivers\etc\hosts

 

127.0.0.1       localhost

 

==================== Other Areas ============================

 

(Currently there is no automatic fix for this section.)

 

HKU\S-1-5-21-2863067232-3147982578-4033237767-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Kelly\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg

DNS Servers: 192.168.43.1

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)

Windows Firewall is enabled.

 

==================== MSCONFIG/TASK MANAGER disabled items ==

 

 

==================== FirewallRules (Whitelisted) ===============

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

FirewallRules: [{22659305-C4E5-4A49-9916-B651A65B36E5}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

FirewallRules: [{FC6FC25D-100A-4646-9DD6-5B6AE03C8BDA}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe

FirewallRules: [{4E0722CC-B7F4-47E1-A0AE-FBA21A5B5CB3}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hposid01.exe

FirewallRules: [{FF3BCC58-5738-406F-84DB-D8759D6F3D00}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe

FirewallRules: [{A5EB7281-EB00-4D62-B698-F649B0B2F9CA}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpqcopy2.exe

FirewallRules: [{A8F5416D-DEB3-40F6-B23A-228206C2B709}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe

FirewallRules: [{B46728D0-1944-4C9E-964B-0039AA484502}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe

FirewallRules: [{243F8B93-861A-4CFC-AF20-1CE54E3AABDD}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe

FirewallRules: [{92CE31E2-C870-45D7-B440-AAA74699FB72}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpqgplgtupl.exe

FirewallRules: [{C732706B-74B0-4411-B6E1-02C42F30ACBE}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe

FirewallRules: [{F638767A-C54E-41D8-9D2D-90B69B3EA31F}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpqusgm.exe

FirewallRules: [{886ACE18-3E84-4616-BCA3-58F263976D14}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpqusgh.exe

FirewallRules: [{AE254109-DBF0-4BE5-AEE5-FC728B6FDEB6}] => (Allow) C:\Program Files\HP\hp software update\hpwucli.exe

FirewallRules: [{C06D584F-32D3-4586-87E7-C1128DCA0F9F}] => (Allow) C:\Program Files\HP\digital imaging\smart web printing\smartwebprintexe.exe

FirewallRules: [{777CE107-D3E4-43CC-A92F-E32B44FDE2C8}] => (Allow) C:\Users\Kelly\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0OXDQXPU\incredimail_install.exe

FirewallRules: [{3E1867F9-4776-46CE-A077-C76F680430B8}] => (Allow) C:\Users\Kelly\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0OXDQXPU\incredimail_install.exe

FirewallRules: [{4CD2794D-B4C3-4094-BD7A-9B0877A40718}] => (Allow) C:\Program Files\IncrediMail\Bin\IncMail.exe

FirewallRules: [{A6F14044-70ED-4E40-B579-378F07A3EBB1}] => (Allow) C:\Program Files\IncrediMail\Bin\IncMail.exe

FirewallRules: [{951AFA79-AE85-4878-A3D6-20EAE6A148AB}] => (Allow) C:\Program Files\IncrediMail\Bin\ImApp.exe

FirewallRules: [{3C89F4A6-F5CD-4378-ADAA-E5CB6396D2F6}] => (Allow) C:\Program Files\IncrediMail\Bin\ImApp.exe

FirewallRules: [{4C7252F2-6B36-4CCB-BF93-0B99A017D996}] => (Allow) C:\Program Files\IncrediMail\Bin\ImpCnt.exe

FirewallRules: [{9AE336E2-4331-4F7D-B25B-1B9E23FE1C7C}] => (Allow) C:\Program Files\IncrediMail\Bin\ImpCnt.exe

FirewallRules: [{7C74D263-024A-4B4D-B5A3-3AA84C3321C1}] => (Allow) C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe

FirewallRules: [{8123B6AA-374E-4290-86E6-E8A8B966F060}] => (Allow) C:\Program Files\TeamViewer\Version8\TeamViewer.exe

FirewallRules: [{DB232870-003A-4DAA-9BC5-2AFAECB933C5}] => (Allow) C:\Program Files\TeamViewer\Version8\TeamViewer.exe

FirewallRules: [{8344B42B-0FDE-45B1-9101-F047D287247B}] => (Allow) C:\Program Files\TeamViewer\Version8\TeamViewer_Service.exe

FirewallRules: [{82023296-E2B6-4B45-BB03-DADCB278812A}] => (Allow) C:\Program Files\TeamViewer\Version8\TeamViewer_Service.exe

FirewallRules: [{65B15C61-76F8-4146-B377-5FC5E1E6599F}] => (Allow) C:\Program Files\HP\HP DeskJet 2130 series\Bin\USBSetup.exe

FirewallRules: [{1329971C-8115-4179-88AA-663C3A3C1B5F}] => (Allow) C:\Program Files\HP\HP DeskJet 2130 series\Bin\HPNetworkCommunicatorCom.exe

FirewallRules: [{E0F12348-1C51-4A33-9532-07E4CEB7047B}] => (Allow) C:\Program Files\TeamViewer\TeamViewer.exe

FirewallRules: [{C3E5F457-4C34-4827-A132-338F9E86E6AC}] => (Allow) C:\Program Files\TeamViewer\TeamViewer.exe

FirewallRules: [{89273056-1FB2-462A-94D3-F01426CD3D0F}] => (Allow) C:\Program Files\TeamViewer\TeamViewer_Service.exe

FirewallRules: [{C4E48EC2-9A8F-4633-BE4F-1D12C45BF3BB}] => (Allow) C:\Program Files\TeamViewer\TeamViewer_Service.exe

FirewallRules: [{AD9068D5-E587-4825-A3A1-A5306BEBF8C9}] => (Allow) C:\Program Files\TeamViewer\TeamViewer.exe

FirewallRules: [{4D575B87-341E-48E4-8D2D-8E01F08A41EA}] => (Allow) C:\Program Files\TeamViewer\TeamViewer.exe

FirewallRules: [{AD40DC6F-D953-463B-8669-E2A1C42A455C}] => (Allow) C:\Program Files\TeamViewer\TeamViewer_Service.exe

FirewallRules: [{CF738B92-AD08-4DB8-85D2-CE7EC8DD00A1}] => (Allow) C:\Program Files\TeamViewer\TeamViewer_Service.exe

FirewallRules: [{AAA584A9-6EB6-4D07-84BA-B5269FBCAB67}] => (Allow) C:\PROGRA~1\REALTEK\USBWIR~1\RtWlan.exe

FirewallRules: [{19EE029B-8525-4D92-A056-9CFE8AC5AEAE}] => (Allow) LPort=1542

FirewallRules: [{3F08B4D5-0D70-4091-9E43-B2430D7385C5}] => (Allow) LPort=1542

FirewallRules: [{33905E74-6D44-4245-83CE-3C749A3B99EB}] => (Allow) LPort=53

FirewallRules: [{5D820765-274F-40F7-9A45-23E3B902774D}] => (Allow) C:\PROGRA~1\REALTEK\USBWIR~1\Rtldhcp.exe

FirewallRules: [{62576861-CE0E-41A0-809D-BE06F92D9ED1}] => (Allow) C:\Program Files\Realtek\USB Wireless LAN Utility\RTLDHCP.exe

FirewallRules: [{5BB5594B-CB6C-4D92-9A5E-60AA4570C440}] => (Allow) C:\Program Files\Realtek\USB Wireless LAN Utility\RTLDHCP.exe

FirewallRules: [{C12FF814-B8F0-40C6-BA13-0524588ABFC7}] => (Allow) LPort=53

FirewallRules: [{554E8176-8F80-48A0-9509-D32E6AAB7E0A}] => (Allow) C:\Program Files\Realtek\USB Wireless LAN Utility\RTLDHCP.exe

FirewallRules: [{EEA17A97-54AB-43CB-A981-03564044C4AD}] => (Allow) C:\Program Files\Realtek\USB Wireless LAN Utility\RTLDHCP.exe

FirewallRules: [{01AE66D5-72F8-445A-93BC-6C5604497FC1}] => (Allow) C:\Program Files\Realtek\USB Wireless LAN Utility\RTLDHCP.exe

FirewallRules: [{B10BE374-7E6C-4D57-9CB4-C1BAD0883BAF}] => (Allow) C:\Program Files\Realtek\USB Wireless LAN Utility\RTLDHCP.exe

FirewallRules: [{8930E1DF-830D-486D-A8EC-395EEF3E79E8}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe

FirewallRules: [{E74BA614-FDAE-4BC6-8599-772D7B885F05}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe

FirewallRules: [{D767CDE9-C430-4DF9-9C82-3863FEF1A3BF}] => (Allow) C:\Program Files\Google\Chrome\Application\chrome.exe

 

==================== Restore Points =========================

 

Could not list restore points

Check "winmgmt" service or repair WMI.

 

 

==================== Faulty Device Manager Devices =============

 

Could not list Devices. Check "winmgmt" service or repair WMI.

 

 

==================== Event log errors: =========================

 

Application errors:

==================

Error: (08/10/2018 02:23:57 PM) (Source: Application Hang) (EventID: 1002) (User: )

Description: The program qw.exe version 26.1.17.2 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

 

Process ID: cf0

 

Start Time: 01d430f0091af4ac

 

Termination Time: 47

 

Application Path: C:\Program Files\Quicken\qw.exe

 

Report Id:

 

Error: (08/10/2018 11:36:05 AM) (Source: HPTouchpointAnalyticsService) (EventID: 0) (User: )

Description: Service cannot be started. System.ArgumentException: Management path 'root\wmi:MS_SystemInformation' not found!

   at HP.TouchpointAnalyticsClient.Commons.Utils.WmiUtils.GetSingleWmiValue[T](String managementClassPath, String property)

   at HP.TouchpointAnalyticsClient.Commons.Objects.Unit.CreateDefault()

   at HP.TouchpointAnalyticsClient.Service.ClientScheduler..ctor()

   at HP.TouchpointAnalyticsClient.Service.TouchpointAnalyticsClientService.OnStart(String[] args)

   at System.ServiceProcess.ServiceBase.ServiceQueuedMainCallback(Object state)

 

Error: (08/09/2018 06:04:18 PM) (Source: HPTouchpointAnalyticsService) (EventID: 0) (User: )

Description: Service cannot be started. System.ArgumentException: Management path 'root\wmi:MS_SystemInformation' not found!

   at HP.TouchpointAnalyticsClient.Commons.Utils.WmiUtils.GetSingleWmiValue[T](String managementClassPath, String property)

   at HP.TouchpointAnalyticsClient.Commons.Objects.Unit.CreateDefault()

   at HP.TouchpointAnalyticsClient.Service.ClientScheduler..ctor()

   at HP.TouchpointAnalyticsClient.Service.TouchpointAnalyticsClientService.OnStart(String[] args)

   at System.ServiceProcess.ServiceBase.ServiceQueuedMainCallback(Object state)

 

Error: (08/09/2018 05:45:53 PM) (Source: HPTouchpointAnalyticsService) (EventID: 0) (User: )

Description: Service cannot be started. System.ArgumentException: Management path 'root\wmi:MS_SystemInformation' not found!

   at HP.TouchpointAnalyticsClient.Commons.Utils.WmiUtils.GetSingleWmiValue[T](String managementClassPath, String property)

   at HP.TouchpointAnalyticsClient.Commons.Objects.Unit.CreateDefault()

   at HP.TouchpointAnalyticsClient.Service.ClientScheduler..ctor()

   at HP.TouchpointAnalyticsClient.Service.TouchpointAnalyticsClientService.OnStart(String[] args)

   at System.ServiceProcess.ServiceBase.ServiceQueuedMainCallback(Object state)

 

Error: (08/07/2018 08:26:16 PM) (Source: HPTouchpointAnalyticsService) (EventID: 0) (User: )

Description: Service cannot be started. System.ArgumentException: Management path 'root\wmi:MS_SystemInformation' not found!

   at HP.TouchpointAnalyticsClient.Commons.Utils.WmiUtils.GetSingleWmiValue[T](String managementClassPath, String property)

   at HP.TouchpointAnalyticsClient.Commons.Objects.Unit.CreateDefault()

   at HP.TouchpointAnalyticsClient.Service.ClientScheduler..ctor()

   at HP.TouchpointAnalyticsClient.Service.TouchpointAnalyticsClientService.OnStart(String[] args)

   at System.ServiceProcess.ServiceBase.ServiceQueuedMainCallback(Object state)

 

Error: (08/07/2018 08:24:17 PM) (Source: .NET Runtime Optimization Service) (EventID: 1103) (User: )

Description: .NET Runtime Optimization Service (clr_optimization_v2.0.50727_32) - Tried to start a service that wasn't the latest version of CLR Optimization service. Will shutdown

 

Error: (08/07/2018 08:23:31 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3009) (User: Kelly-PC)

Description: Installing the performance counter strings for service .NET CLR Networking 4.0.0.0 () failed. The first DWORD in the Data section contains the error code.

 

Error: (08/07/2018 08:23:31 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3009) (User: Kelly-PC)

Description: Installing the performance counter strings for service .NET Data Provider for Oracle () failed. The first DWORD in the Data section contains the error code.

 

 

System errors:

=============

Error: (08/10/2018 11:36:05 AM) (Source: Service Control Manager) (EventID: 7001) (User: )

Description: The Security Center service depends on the Windows Management Instrumentation service which failed to start because of the following error: 

The executable program that this service is configured to run in does not implement the service.

 

Error: (08/10/2018 11:36:02 AM) (Source: Service Control Manager) (EventID: 7001) (User: )

Description: The Security Center service depends on the Windows Management Instrumentation service which failed to start because of the following error: 

The executable program that this service is configured to run in does not implement the service.

 

Error: (08/10/2018 11:34:03 AM) (Source: DCOM) (EventID: 10005) (User: )

Description: DCOM got error "1083" attempting to start the service winmgmt with arguments "" in order to run the server:

{8BC3F05E-D86B-11D0-A075-00C04FB68820}

 

Error: (08/10/2018 11:34:02 AM) (Source: Service Control Manager) (EventID: 7026) (User: )

Description: The following boot-start or system-start driver(s) failed to load: 

atc

 

Error: (08/10/2018 11:34:02 AM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: The Realtek DHCP Service service terminated unexpectedly.  It has done this 1 time(s).

 

Error: (08/10/2018 11:34:02 AM) (Source: WMPNetworkSvc) (EventID: 14332) (User: )

Description: Service 'WMPNetworkSvc' did not start correctly because CoCreateInstance(CLSID_UPnPDeviceFinder) encountered error '0x80070420'. Verify that the UPnPHost service is running and that the UPnPHost component of Windows is installed properly.

 

Error: (08/10/2018 11:34:02 AM) (Source: DCOM) (EventID: 10005) (User: )

Description: DCOM got error "1083" attempting to start the service winmgmt with arguments "" in order to run the server:

{8BC3F05E-D86B-11D0-A075-00C04FB68820}

 

Error: (08/10/2018 11:33:50 AM) (Source: Service Control Manager) (EventID: 7001) (User: )

Description: The Malwarebytes Service service depends on the Windows Management Instrumentation service which failed to start because of the following error: 

The executable program that this service is configured to run in does not implement the service.

 

 

==================== Memory info =========================== 

 

Processor: Intel® Core™2 CPU 6300 @ 1.86GHz

Percentage of memory in use: 72%

Total physical RAM: 3063.31 MB

Available physical RAM: 834.66 MB

Total Virtual: 6124.97 MB

Available Virtual: 3070.15 MB

 

==================== Drives ================================

 

Drive c: (Windows) (Fixed) (Total:111.64 GB) (Free:62.09 GB) NTFS

Drive e: (System) (Fixed) (Total:0.15 GB) (Free:0.01 GB) NTFS ==>[system with boot components (obtained from drive)]

Drive f: (Backup) (Fixed) (Total:366.17 GB) (Free:316.43 GB) NTFS

Drive g: (System) (Fixed) (Total:0.15 GB) (Free:0.12 GB) NTFS ==>[system with boot components (obtained from drive)]

Drive h: (Windows) (Fixed) (Total:332.31 GB) (Free:286.38 GB) NTFS

 

 

==================== MBR & Partition Table ==================

 

========================================================

Disk: 0 (MBR Code: Windows 7/8/10) (Size: 698.6 GB) (Disk ID: A5856FA5)

Partition 1: (Active) - (Size=150 MB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=332.3 GB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=366.2 GB) - (Type=05)

 

========================================================

Disk: 1 (MBR Code: Windows 7/8/10) (Size: 111.8 GB) (Disk ID: 0021B2C5)

Partition 1: (Active) - (Size=150 MB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=111.6 GB) - (Type=07 NTFS)

 

==================== End of Addition.txt ============================

[Satchfan]

I haven’t checked the whole log but I’d like to see if we can solve the Security Centre problem first.

If this fix doesn’t work and, when I have checked the log and I’m confident that there are no remaining malware issues, I’ll refer you to the Windows forum where they are more expert than I am with these issues.

Let’s see what happens.

Run Farbar Recovery Scan Tool

• right-click FRST/FRST64 and select ‘Run as administrator’
• highlight the contents of the code box below, then press Ctrl+c):

Start::
CloseProcesses:
CMD: sc start DCOMLaunch
CMD: sc start RpcSs
CMD: sc config Winmgmt start= auto
CMD: sc start Winmgmt
CMD: sc config Wscsvc start= auto
CMD: sc start wscsvc End::

NOTE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

• in the FRST window, press the ‘Fix’ button once and wait
• please reboot the computer if requested
• it will create a log on your desktop, (Fixlog.txt); please post it to your reply.

Thanks

Satchfan

 

[KelRenBen36]

Fix result of Farbar Recovery Scan Tool (x86) Version: 02.08.2018

Ran by Kelly (11-08-2018 15:49:38) Run:1

Running from C:\Users\Kelly\Desktop

Loaded Profiles: Kelly (Available Profiles: Kelly)

Boot Mode: Normal

 

==============================================

 

fixlist content:

*****************

CloseProcesses:

CMD: sc start DCOMLaunch

CMD: sc start RpcSs

CMD: sc config Winmgmt start= auto

CMD: sc start Winmgmt

CMD: sc config Wscsvc start= auto

CMD: sc start wscsvc 

*****************

 

Processes closed successfully.

 

========= sc start DCOMLaunch =========

 

[SC] StartService FAILED 1056:

 

An instance of the service is already running.

 

 

========= End of CMD: =========

 

 

========= sc start RpcSs =========

 

[SC] StartService FAILED 1056:

 

An instance of the service is already running.

 

 

========= End of CMD: =========

 

 

========= sc config Winmgmt start= auto =========

 

[SC] ChangeServiceConfig SUCCESS

 

========= End of CMD: =========

 

 

========= sc start Winmgmt =========

 

[SC] StartService FAILED 1083:

 

The executable program that this service is configured to run in does not implement the service.

 

 

========= End of CMD: =========

 

 

========= sc config Wscsvc start= auto =========

 

[SC] ChangeServiceConfig SUCCESS

 

========= End of CMD: =========

 

 

========= sc start wscsvc =========

 

[SC] StartService FAILED 1068:

 

The dependency service or group failed to start.

 

 

========= End of CMD: =========

 

 

 

The system needed a reboot.

 

==== End of Fixlog 15:49:43 ====

[Satchfan]

Sorry for the delay but, presumably due to the weather, we had a power cut today and I’ve also been a bit busy.

Run Farbar Recovery Scan Tool

• right-click FRST/FRST64 and select ‘Run as administrator’
• highlight the contents of the code box below, then press Ctrl+c):

Start::
CloseProcesses:
Winsock: Catalog5 08 C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL => No File
Winsock: Catalog5 09 C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL => No File
CHR HKLM\...\Chrome\Extension: [commhkacjheiacaopdonmodahaoadoln] - hxxps://clients2.google.com/service/update2/crx
2018-07-26 10:17 - 2018-07-26 10:20 - 000000000 ____D C:\AVG_Remover
2018-07-26 10:16 - 2018-07-26 10:16 - 007986864 _____ ( ) C:\Users\Kelly\Downloads\AVG_Remover.exe
ContextMenuHandlers4: [MSSE] -> {0365FE2C-F183-4091-AC82-BFC39FB75C49} =>  -> No File
ContextMenuHandlers4: [Offline Files] -> {474C98EE-CF3D-41f5-80E3-4AAB0AB04301} =>  -> No File
Task: {97A31412-4CAA-4632-A8E2-3383DB52AA0B} - System32\Tasks\{FED474CA-7330-4EE2-9C64-63C93D8AC268} => C:\Windows\system32\pcalua.exe -a "C:\Users\Kelly\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\81FE2OMM\JavaSetup8u65 (2).exe" -d C:\Users\Kelly\Desktop
AlternateDataStreams: C:\ProgramData\TEMP:5C321E34 [125]
FirewallRules: [{777CE107-D3E4-43CC-A92F-E32B44FDE2C8}] => (Allow) C:\Users\Kelly\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0OXDQXPU\incredimail_install.exe
FirewallRules: [{3E1867F9-4776-46CE-A077-C76F680430B8}] => (Allow) C:\Users\Kelly\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0OXDQXPU\incredimail_install.exe
C:\Windows\system32\pcalua.exe -a "C:\Users\Kelly\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\81FE2OMM\JavaSetup8u65 (2).exe
C:\Users\Kelly\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0OXDQXPU\incredimail_install.exe
EmptyTemp:
End::

NOTE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

• in the FRST window, press the ‘Fix’ button once and wait
• please reboot the computer if requested
• please post (Fixlog.txt) into your next reply.

===================================================

Let’s try to rebuild the WMI repository:

• press the Windows key + R and type services.msc, then click OK
• in the list of services, scroll down to Windows Management Instrumentation, double-click on it and click on Stop
• click Apply, and then click OK
• using Windows explorer, (Windows key+E), locate C:\Windows\\System32\Wbem\Repository
• delete all of the files that are in the Repository folder
• restart the computer and see if that has resolved the problem.

Satchfan

 

[KelRenBen36]

Ran scan, rebooted.  Deleted repository files, rebooted.  No change.

 

Fix result of Farbar Recovery Scan Tool (x86) Version: 02.08.2018

Ran by Kelly (12-08-2018 21:00:42) Run:2

Running from C:\Users\Kelly\Desktop

Loaded Profiles: Kelly (Available Profiles: Kelly)

Boot Mode: Normal

 

==============================================

 

fixlist content:

*****************

CloseProcesses:

Winsock: Catalog5 08 C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL => No File

Winsock: Catalog5 09 C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL => No File

CHR HKLM\...\Chrome\Extension: [commhkacjheiacaopdonmodahaoadoln] - hxxps://clients2.google.com/service/update2/crx

2018-07-26 10:17 - 2018-07-26 10:20 - 000000000 ____D C:\AVG_Remover

2018-07-26 10:16 - 2018-07-26 10:16 - 007986864 _____ ( ) C:\Users\Kelly\Downloads\AVG_Remover.exe

ContextMenuHandlers4: [MSSE] -> {0365FE2C-F183-4091-AC82-BFC39FB75C49} =>  -> No File

ContextMenuHandlers4: [Offline Files] -> {474C98EE-CF3D-41f5-80E3-4AAB0AB04301} =>  -> No File

Task: {97A31412-4CAA-4632-A8E2-3383DB52AA0B} - System32\Tasks\{FED474CA-7330-4EE2-9C64-63C93D8AC268} => C:\Windows\system32\pcalua.exe -a "C:\Users\Kelly\AppData\Local\Microsoft\Windows\Temporary Internet

Files\Content.IE5\81FE2OMM\JavaSetup8u65 (2).exe" -d C:\Users\Kelly\Desktop

AlternateDataStreams: C:\ProgramData\TEMP:5C321E34 [125]

FirewallRules: [{777CE107-D3E4-43CC-A92F-E32B44FDE2C8}] => (Allow) C:\Users\Kelly\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0OXDQXPU\incredimail_install.exe

FirewallRules: [{3E1867F9-4776-46CE-A077-C76F680430B8}] => (Allow) C:\Users\Kelly\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0OXDQXPU\incredimail_install.exe

C:\Windows\system32\pcalua.exe -a "C:\Users\Kelly\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\81FE2OMM\JavaSetup8u65 (2).exe

C:\Users\Kelly\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0OXDQXPU\incredimail_install.exe

EmptyTemp:

 

*****************

 

Processes closed successfully.

"HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000008" => removed successfully.

"HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000009" => removed successfully.

"HKLM\SOFTWARE\Google\Chrome\Extensions\commhkacjheiacaopdonmodahaoadoln" => removed successfully.

C:\AVG_Remover => moved successfully

C:\Users\Kelly\Downloads\AVG_Remover.exe => moved successfully

"HKLM\Software\Classes\Directory\ShellEx\ContextMenuHandlers\MSSE" => removed successfully.

HKLM\Software\Classes\CLSID\{0365FE2C-F183-4091-AC82-BFC39FB75C49} => not found

"HKLM\Software\Classes\Directory\ShellEx\ContextMenuHandlers\Offline Files" => removed successfully.

HKLM\Software\Classes\CLSID\{474C98EE-CF3D-41f5-80E3-4AAB0AB04301} => not found

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{97A31412-4CAA-4632-A8E2-3383DB52AA0B}" => removed successfully.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{97A31412-4CAA-4632-A8E2-3383DB52AA0B}" => removed successfully.

C:\Windows\System32\Tasks\{FED474CA-7330-4EE2-9C64-63C93D8AC268} => moved successfully

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{FED474CA-7330-4EE2-9C64-63C93D8AC268}" => removed successfully.

Files\Content.IE5\81FE2OMM\JavaSetup8u65 (2).exe" -d C:\Users\Kelly\Desktop => Error: No automatic fix found for this entry.

C:\ProgramData\TEMP => ":5C321E34" ADS removed successfully.

"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{777CE107-D3E4-43CC-A92F-E32B44FDE2C8}" => removed successfully.

"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{3E1867F9-4776-46CE-A077-C76F680430B8}" => removed successfully.

"C:\Windows\system32\pcalua.exe -a C:\Users\Kelly\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\81FE2OMM\JavaSetup8u65 (2).exe" => not found

"C:\Users\Kelly\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0OXDQXPU\incredimail_install.exe" => not found

 

=========== EmptyTemp: ==========

 

BITS transfer queue => 8388608 B

DOMStoree, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 12753849 B

Java, Flash, Steam htmlcache => 1110 B

Windows/system/drivers => 1875179 B

Edge => 0 B

Chrome => 522067795 B

Firefox => 0 B

Opera => 0 B

 

Temp, IE cache, history, cookies, recent:

Users => 0 B

Default => 0 B

Public => 0 B

ProgramData => 0 B

systemprofile => 128 B

LocalService => 0 B

NetworkService => 0 B

Kelly => 174871485 B

 

RecycleBin => 126317431 B

EmptyTemp: => 807.1 MB temporary data Removed.

 

================================

 

 

The system needed a reboot.

 

==== End of Fixlog 21:02:24 ====

[Satchfan]

Can you check that Remote Procedure Call service is set to ‘Automatic’.

[KelRenBen36]

Yes it is Automatic and started.

[Satchfan]

One more thing before I decide on what to advise; are you on a server that is part of a network or is this a personal computer?