What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

OMIGA-PLUS Virus [Solved]

6 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1

When I run an internet browser on this computer it opens with omega-plus.com.  We have reset home page but this overrides the reset and opens with omega-plus.com.  We ran malawarebytes which showed infected files which we quarantined.  However, when we restart the browser the omega-plus.com shows up as home page.

 

Please help, as I am not sure what else this virus may be doing and we have been unable to remove it.

 

Thanks for your help,

 

Brian

 

 

 

 

📎aswMBR.txt

 

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 28-01-2015
Ran by [removed] (administrator) on WRRUBIS-HP on 02-02-2015 14:52:21
Running from C:\Users\[removed]\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1PEL76Q7
[removed] Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: English (United States)
Internet Explorer Version 10 (Default browser: Opera)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgrsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgcsrva.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(DigitalPersona, Inc.) C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RTKAUDIOSERVICE64.EXE
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(DigitalPersona, Inc.) C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpCardEngine.exe
(DigitalPersona, Inc.) C:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe
(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgfws.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgidsagent.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgwdsvc.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(CryptoMill Technologies Ltd.) C:\Program Files (x86)\Hewlett-Packard\HP Trust Circles\CreoSvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.25.11\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.25.11\GoogleCrashHandler64.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\CORESHREDDER.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgui.exe
() C:\Program Files (x86)\AVG Web TuneUp\vprot.exe
() C:\Program Files (x86)\Hewlett-Packard\HP Theft Recovery\CtService.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgnsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgemca.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSMonitorServicePDVD12.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\HPFSService.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(PDF Complete Inc) C:\Program Files (x86)\PDF Complete\pdfsvc.exe
(DigitalPersona, Inc.) C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpAgent.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
(AVG Secure Search) C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.2.0\ToolbarUpdater.exe
() C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.2.0\loggingserver.exe
(Hewlett-Packard Development Company) C:\Program Files (x86)\Hewlett-Packard\HP Device Access Manager\HP.ProtectTools.DeviceAccessManager.ServiceHost.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(AVG Secure Search) C:\Program Files (x86)\AVG Web TuneUp\avgcefrend.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
(Microsoft Corporation) C:\Program Files (x86)\Internet Explorer\ielowutil.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(AVG Secure Search) C:\Program Files (x86)\AVG Web TuneUp\avgcefrend.exe
(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil64_16_0_0_296_ActiveX.exe
(AVAST Software) C:\Users\WRRUBIS\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\N8ARP0Q0\aswMBR.exe

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\…\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7194840 2013-07-26] (Realtek Semiconductor)
HKLM\…\Run: [] => [X]
HKLM\…\Run: [CryptoMill Refresh] => C:\Program Files\Hewlett-Packard\HP Trust Circles\ceflauncher -m refresh
HKLM\…\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1331288 2014-08-22] (Microsoft Corporation)
HKLM-x32\…\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [292848 2013-04-26] (Intel Corporation)
HKLM-x32\…\Run: [CLMLServer_For_P2G8] => c:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [111576 2013-08-05] (CyberLink)
HKLM-x32\…\Run: [CLVirtualDrive] => c:\Program Files (x86)\CyberLink\Power2Go8\VirtualDrive.exe [490760 2013-08-06] (CyberLink Corp.)
HKLM-x32\…\Run: [HP File Sanitizer] => C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\Coreshredder.exe [2213592 2013-09-17] (Hewlett-Packard)
HKLM-x32\…\Run: [PDF Complete] => C:\Program Files (x86)\PDF Complete\pdfsty.exe [683656 2013-07-18] (PDF Complete Inc)
HKLM-x32\…\Run: [AVG_UI] => C:\Program Files (x86)\AVG\AVG2015\avgui.exe [3667472 2014-12-18] (AVG Technologies CZ, s.r.o.)
HKLM-x32\…\Run: [vProt] => C:\Program Files (x86)\AVG Web TuneUp\vprot.exe [3081752 2015-01-17] ()
HKLM\…\Winlogon: [Userinit] C:\Windows\system32\userinit.exe,c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe,
Winlogon\Notify\igfxcui: C:\windows\system32\igfxdev.dll (Intel Corporation)
Lsa: [Notification Packages] DPPassFilter scecli
ShellIconOverlayIdentifiers: [+1TBIcon] -> {B9C55E85-DED6-4911-82F3-83CF1CAB2898} => C:\Program Files\Hewlett-Packard\HP Trust Circles\tbicon.dll (CryptoMill Technologies Ltd.)
ShellIconOverlayIdentifiers-x32: [+1TBIcon] -> {B9C55E85-DED6-4911-82F3-83CF1CAB2898} => C:\Program Files (x86)\Hewlett-Packard\HP Trust Circles\tbicon.dll (CryptoMill Technologies Ltd.)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page =
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page =
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKU\S-1-5-21-3022803814-498434483-4042170650-1001\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.foxnews.com/
SearchScopes: HKU\S-1-5-21-3022803814-498434483-4042170650-1001 -> {95B7759C-8C7F-4BF1-B163-73684A933233} URL = https://mysearch.avg.com/search?cid={5AD91581-2007-4E8B-B818-20D309EA9C84}∣=163e1478907847cdba6dd15a7de8851a-6827d938d0219b0dd963b6cc734766ed105ef06b⟨=en&ds;=AVG&coid;=avgtbavg&cmpid;=≺=fr&d;=2015-01-17 15:20:10&v;=4.0.5.7&pid;=wtu&sg;=&sap;=dsp&q;={searchTerms}
BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll (Hewlett-Packard)
BHO-x32: HP File Sanitizer -> {3134413B-49B4-425C-98A5-893C1F195601} -> C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\IEBHO.dll (Hewlett-Packard)
BHO-x32: Javaâ„¢ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll (Oracle Corporation)
BHO-x32: AVG Web TuneUp -> {95B7759C-8C7F-4BF1-B163-73684A933233} -> C:\Program Files (x86)\AVG Web TuneUp\4.0.5.7\AVG Web TuneUp.dll (AVG)
BHO-x32: Javaâ„¢ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Handler-x32: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\18.2.0\ViProtocol.dll (AVG Secure Search)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.254
Tcpip\..\Interfaces\{3E457FBA-28CF-4D64-AAE7-4D23FB67596C}: [NameServer] 8.8.8.8,8.8.4.4,4.2.2.1,4.2.2.2,208.67.222.222,208.67.220.220,8.26.56.26,8.20.247.20,156.154.70.1,156.154.71.1

FireFox:
========
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin -> C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\18.2.0\\npsitesafety.dll No File
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: digitalpersona.com/ChromeDPAgent -> c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\BrowserExt\components\npChromeDPAgent.dll (DigitalPersona, Inc.)
FF HKLM-x32\…\Firefox\Extensions: [dpmaxz_ng@jetpack] - c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\BrowserExt\dpchrome
FF Extension: HP Client Security Manager - c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\BrowserExt\dpchrome [2014-03-02]

Chrome:
=======
CHR HomePage: Default -> hxxp://isearch.omiga-plus.com/?type=hppp&ts;=1421326357&from;=ild&uid;=ST500DM002-1BD142_W3T3J4GK
CHR RestoreOnStartup: Default -> "hxxp://rts.dsrlte.com?affID=pr_953af01d-e3af-45d4-ab39-472d2beb9084"
CHR Profile: C:\Users\WRRUBIS\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\WRRUBIS\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-05-21]
CHR Extension: (Google Drive) - C:\Users\WRRUBIS\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-05-21]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\WRRUBIS\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-05-21]
CHR Extension: (YouTube) - C:\Users\WRRUBIS\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-05-21]
CHR Extension: (Google Search) - C:\Users\WRRUBIS\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-05-21]
CHR Extension: (VideoDownloadConverter) - C:\Users\WRRUBIS\AppData\Local\Google\Chrome\User Data\Default\Extensions\dpmccoingipfnbiilpihobmeikpgdcfi [2014-08-30]
CHR Extension: (HP Client Security Manager) - C:\Users\WRRUBIS\AppData\Local\Google\Chrome\User Data\Default\Extensions\ncffjdbbodifgldkcbhmiiljfcnbgjab [2014-05-21]
CHR Extension: (Google Wallet) - C:\Users\WRRUBIS\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-05-21]
CHR Extension: (Gmail) - C:\Users\WRRUBIS\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-05-21]
CHR HKLM-x32\…\Chrome\Extension: [ncffjdbbodifgldkcbhmiiljfcnbgjab] - c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\BrowserExt\dpchrome.crx [2013-11-21]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avgfws; C:\Program Files (x86)\AVG\AVG2015\avgfws.exe [1486664 2014-12-18] (AVG Technologies CZ, s.r.o.)
R2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2015\avgidsagent.exe [3432976 2014-12-18] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files (x86)\AVG\AVG2015\avgwdsvc.exe [298080 2014-12-18] (AVG Technologies CZ, s.r.o.)
R2 CreoService; C:\Program Files (x86)\Hewlett-Packard\HP Trust Circles\CreoSvc.exe [1390552 2013-10-02] (CryptoMill Technologies Ltd.)
R2 CtAgentService; C:\Program Files (x86)\Hewlett-Packard\HP Theft Recovery\CtService.exe [7168 2013-08-14] () [File not signed]
R2 CyberLink PowerDVD 12 Media Server Monitor Service; c:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSMonitorServicePDVD12.exe [77576 2013-08-12] (CyberLink)
R2 CyberLink PowerDVD 12 Media Server Service; c:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe [298760 2013-08-12] (CyberLink)
R2 DpHost; c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe [500048 2013-11-21] (DigitalPersona, Inc.)
S3 FLCDLOCK; c:\windows\SysWOW64\flcdlock.exe [567608 2013-11-20] (Hewlett-Packard Company)
R2 HP Support Assistant Service; C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [92160 2013-08-29] (Hewlett-Packard Company) [File not signed]
R2 HpDamServiceHost; c:\Program Files (x86)\Hewlett-Packard\HP Device Access Manager\HP.ProtectTools.DeviceAccessManager.ServiceHost.exe [18232 2013-11-15] (Hewlett-Packard Development Company)
R2 Intel(R) Capability Licensing Service Interface; c:\Program Files\Intel\iCLS Client\HeciServer.exe [733696 2013-05-11] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; c:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [822232 2013-05-11] (Intel(R) Corporation)
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [131544 2013-08-08] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-08-08] (Intel Corporation)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23784 2014-08-22] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [368624 2014-08-22] (Microsoft Corporation)
R2 pdfcDispatcher; C:\Program Files (x86)\PDF Complete\pdfsvc.exe [1143432 2013-07-18] (PDF Complete Inc)
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [246488 2013-06-18] (Realtek Semiconductor)
R2 vToolbarUpdater18.2.0; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.2.0\ToolbarUpdater.exe [1850392 2015-01-17] (AVG Secure Search)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2014-03-02] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [153368 2014-06-18] (AVG Technologies CZ, s.r.o.)
R1 Avgfwfd; C:\Windows\System32\DRIVERS\avgfwd6a.sys [57144 2013-09-26] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [260888 2014-12-08] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [203544 2014-11-18] (AVG Technologies CZ, s.r.o.)
R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [243480 2014-08-28] (AVG Technologies CZ, s.r.o.)
R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [313624 2014-07-18] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [124184 2014-10-05] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [31512 2014-06-18] (AVG Technologies CZ, s.r.o.)
R1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [274200 2014-10-10] (AVG Technologies CZ, s.r.o.)
R1 avgtp; C:\windows\system32\drivers\avgtpx64.sys [52000 2015-01-17] (AVG Technologies)
R1 CLVirtualDrive; C:\Windows\System32\DRIVERS\CLVirtualDrive.sys [90608 2011-12-27] (CyberLink)
S3 DAMDrv; C:\Windows\System32\DRIVERS\DAMDrv64.sys [65752 2013-10-07] (Hewlett-Packard Company)
R0 iaStorF; C:\Windows\System32\drivers\iaStorF.sys [28008 2013-09-20] (Intel Corporation)
R3 IceKore; C:\Windows\System32\DRIVERS\IceKore.sys [401368 2013-09-30] (CryptoMill Technologies Inc.)
S3 MBAMSwissArmy; C:\windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-01-27] (Malwarebytes Corporation)
R3 MEIx64; C:\Windows\system32\drivers\TeeDriverx64.sys [99288 2013-08-08] (Intel Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [269008 2014-07-17] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [125584 2014-07-17] (Microsoft Corporation)
R0 PinFile; C:\Windows\System32\DRIVERS\PinFile.sys [49856 2013-08-22] (WinMagic Inc.)
R0 SDDisk2K; C:\Windows\System32\DRIVERS\SDDisk2K.sys [228544 2013-08-22] (WinMagic Inc.)
R0 SDDToki; C:\Windows\System32\DRIVERS\SDDToki.sys [131264 2013-08-22] (WinMagic Inc.)
U3 aswMBR; \??\C:\Users\WRRUBIS\AppData\Local\Temp\aswMBR.sys [X]
U3 aswVmm; \??\C:\Users\WRRUBIS\AppData\Local\Temp\aswVmm.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)

==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-02 14:50 - 2015-02-02 14:52 - 00000000 ____D () C:\FRST
2015-02-02 14:48 - 2015-02-02 14:48 - 00000574 _____ () C:\Users\WRRUBIS\Desktop\aswMBR.txt
2015-01-27 15:04 - 2015-01-27 15:04 - 00880784 _____ (Google Inc.) C:\Users\WRRUBIS\Downloads\GoogleEarthSetup.exe
2015-01-24 04:39 - 2015-01-31 09:43 - 00000000 ____D () C:\windows\Minidump
2015-01-17 15:20 - 2015-01-17 19:39 - 00000000 ____D () C:\Users\WRRUBIS\AppData\Local\AVG Web TuneUp
2015-01-17 15:20 - 2015-01-17 16:08 - 00000000 ____D () C:\ProgramData\AVG Security Toolbar
2015-01-17 15:20 - 2015-01-17 15:20 - 00000000 ____D () C:\ProgramData\AVG Secure Search
2015-01-17 15:20 - 2015-01-17 15:19 - 00052000 _____ (AVG Technologies) C:\windows\system32\Drivers\avgtpx64.sys
2015-01-17 15:19 - 2015-01-17 15:20 - 00000000 ____D () C:\ProgramData\AVG Web TuneUp
2015-01-17 15:19 - 2015-01-17 15:19 - 00000000 ____D () C:\Program Files (x86)\AVG Web TuneUp
2015-01-17 14:10 - 2015-01-17 14:10 - 00000000 ____D () C:\Users\WRRUBIS\AppData\Roaming\Avg_Update_1014av
2015-01-17 14:09 - 2015-01-17 14:09 - 00000000 ____D () C:\ProgramData\Avg_Update_1014av
2015-01-17 12:03 - 2015-01-17 12:03 - 00000000 ____D () C:\Users\WRRUBIS\AppData\Roaming\AVG2015
2015-01-17 12:02 - 2015-01-17 12:02 - 00000000 ____D () C:\Users\WRRUBIS\AppData\Roaming\TuneUp Software
2015-01-17 12:02 - 2015-01-17 12:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG
2015-01-17 12:01 - 2015-01-17 12:03 - 00000000 ____D () C:\ProgramData\AVG2015
2015-01-17 12:01 - 2015-01-17 12:01 - 00000000 ___HD () C:\$AVG
2015-01-17 12:01 - 2015-01-17 12:01 - 00000000 ____D () C:\Program Files (x86)\AVG
2015-01-17 11:56 - 2015-02-02 14:09 - 00000000 ____D () C:\ProgramData\MFAData
2015-01-17 11:56 - 2015-01-17 12:09 - 00000000 ____D () C:\Users\WRRUBIS\AppData\Local\Avg2015
2015-01-17 11:56 - 2015-01-17 11:56 - 00000000 ____D () C:\Users\WRRUBIS\AppData\Local\MFAData
2015-01-15 12:14 - 2015-01-15 12:14 - 00000000 _____ () C:\autoexec.bat
2015-01-15 11:56 - 2015-01-27 14:56 - 00129752 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2015-01-15 11:56 - 2015-01-27 14:37 - 00001110 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2015-01-15 11:56 - 2015-01-27 14:37 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-01-15 11:56 - 2015-01-27 14:37 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2015-01-15 11:56 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys
2015-01-15 11:56 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys
2015-01-15 11:56 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
2015-01-15 10:06 - 2015-01-15 10:06 - 00000000 ____D () C:\Users\WRRUBIS\AppData\Roaming\vlc
2015-01-15 07:59 - 2015-01-15 07:59 - 00775968 _____ (Reimage®) C:\Users\WRRUBIS\Downloads\ReimageRepair_exe
2015-01-15 07:50 - 2015-01-15 07:50 - 00000000 ____D () C:\Users\WRRUBIS\AppData\Roaming\Opera Software
2015-01-15 07:50 - 2015-01-15 07:50 - 00000000 ____D () C:\Users\WRRUBIS\AppData\Local\Opera Software
2015-01-15 07:47 - 2015-01-23 15:51 - 00000000 ____D () C:\Program Files (x86)\Opera
2015-01-15 07:45 - 2015-02-02 07:49 - 00001344 _____ () C:\windows\Tasks\VRRFE.job
2015-01-15 07:45 - 2015-01-17 12:26 - 00000000 ____D () C:\Program Files (x86)\513a2189-0375-4b58-8eb2-161513165ccb
2015-01-15 07:45 - 2015-01-15 07:49 - 02010592 _____ () C:\Users\WRRUBIS\AppData\Roaming\VRRFE.exe
2015-01-15 07:45 - 2015-01-15 07:49 - 00004378 _____ () C:\windows\System32\Tasks\VRRFE
2015-01-15 07:44 - 2015-01-17 12:28 - 00000000 ____D () C:\Program Files (x86)\VipBoxSportsApp.com
2015-01-15 07:44 - 2015-01-15 07:48 - 00001131 _____ () C:\Users\WRRUBIS\Desktop\VipBoxSportsApp.lnk
2015-01-15 07:44 - 2015-01-15 07:44 - 00000000 ____D () C:\Users\WRRUBIS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VipBoxSportsApp.com
2015-01-14 02:55 - 2014-12-18 22:06 - 00210432 _____ (Microsoft Corporation) C:\windows\system32\profsvc.dll
2015-01-14 02:55 - 2014-12-18 20:46 - 00141312 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxdav.sys
2015-01-14 02:55 - 2014-12-12 00:35 - 05553592 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe
2015-01-14 02:55 - 2014-12-12 00:31 - 00503808 _____ (Microsoft Corporation) C:\windows\system32\srcore.dll
2015-01-14 02:55 - 2014-12-12 00:31 - 00296960 _____ (Microsoft Corporation) C:\windows\system32\rstrui.exe
2015-01-14 02:55 - 2014-12-12 00:31 - 00050176 _____ (Microsoft Corporation) C:\windows\system32\srclient.dll
2015-01-14 02:55 - 2014-12-12 00:11 - 03971512 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntkrnlpa.exe
2015-01-14 02:55 - 2014-12-12 00:11 - 03916728 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntoskrnl.exe
2015-01-14 02:55 - 2014-12-12 00:07 - 00043008 _____ (Microsoft Corporation) C:\windows\SysWOW64\srclient.dll
2015-01-14 02:55 - 2014-12-11 12:47 - 00052736 _____ (Microsoft Corporation) C:\windows\system32\TSWbPrxy.exe
2015-01-14 02:55 - 2014-12-05 23:17 - 00303616 _____ (Microsoft Corporation) C:\windows\system32\nlasvc.dll
2015-01-14 02:55 - 2014-12-05 22:50 - 00156672 _____ (Microsoft Corporation) C:\windows\SysWOW64\ncsi.dll
2015-01-14 02:55 - 2014-12-05 22:50 - 00052224 _____ (Microsoft Corporation) C:\windows\SysWOW64\nlaapi.dll
2015-01-07 09:24 - 2015-01-07 09:24 - 00000000 ____D () C:\windows\system32\appraiser
2015-01-07 09:13 - 2014-10-17 21:05 - 04121600 _____ (Microsoft Corporation) C:\windows\system32\mf.dll
2015-01-07 09:13 - 2014-10-17 20:33 - 03209728 _____ (Microsoft Corporation) C:\windows\SysWOW64\mf.dll
2015-01-07 09:13 - 2014-07-06 21:06 - 00206848 _____ (Microsoft Corporation) C:\windows\system32\mfps.dll
2015-01-07 09:13 - 2014-07-06 21:06 - 00055808 _____ (Microsoft Corporation) C:\windows\system32\rrinstaller.exe
2015-01-07 09:13 - 2014-07-06 21:06 - 00024576 _____ (Microsoft Corporation) C:\windows\system32\mfpmp.exe
2015-01-07 09:13 - 2014-07-06 21:02 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\mferror.dll
2015-01-07 09:13 - 2014-07-06 20:40 - 00103424 _____ (Microsoft Corporation) C:\windows\SysWOW64\mfps.dll
2015-01-07 09:13 - 2014-07-06 20:39 - 00050176 _____ (Microsoft Corporation) C:\windows\SysWOW64\rrinstaller.exe
2015-01-07 09:13 - 2014-07-06 20:39 - 00023040 _____ (Microsoft Corporation) C:\windows\SysWOW64\mfpmp.exe
2015-01-07 09:13 - 2014-07-06 20:37 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\mferror.dll

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-02 14:49 - 2014-05-21 10:03 - 00000898 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-02-02 14:48 - 2009-07-13 23:45 - 00027568 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-02-02 14:48 - 2009-07-13 23:45 - 00027568 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-02-02 14:28 - 2014-04-14 16:41 - 01053188 _____ () C:\windows\WindowsUpdate.log
2015-02-02 13:54 - 2014-07-23 13:28 - 00000830 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2015-02-02 08:49 - 2014-05-21 10:03 - 00000894 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-02-02 01:02 - 2014-04-14 16:42 - 00003942 _____ () C:\windows\System32\Tasks\User_Feed_Synchronization-{62E43B9A-607C-499F-9F47-AC332582638F}
2015-01-31 09:48 - 2009-07-14 00:13 - 00781790 _____ () C:\windows\system32\PerfStringBackup.INI
2015-01-31 09:44 - 2014-03-02 04:07 - 00000000 ____D () C:\ProgramData\PDFC
2015-01-31 09:43 - 2014-04-14 17:38 - 00320985 ____N () C:\windows\Minidump\013115-32058-01.dmp
2015-01-31 09:43 - 2014-03-02 04:06 - 00000225 _____ () C:\windows\CryptoMill_CreoService.log
2015-01-31 09:43 - 2009-07-14 00:08 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2015-01-31 09:43 - 2009-07-13 23:51 - 00042654 _____ () C:\windows\setupact.log
2015-01-27 15:28 - 2014-03-02 04:06 - 00000225 _____ () C:\windows\CryptoMill_CreoService.001
2015-01-27 15:28 - 2010-11-20 22:47 - 00280150 _____ () C:\windows\PFRO.log
2015-01-27 15:07 - 2014-07-09 14:13 - 00000000 ____D () C:\ProgramData\Oracle
2015-01-27 15:07 - 2014-07-09 14:13 - 00000000 ____D () C:\Program Files (x86)\Java
2015-01-27 15:06 - 2014-08-06 10:10 - 00272296 _____ (Oracle Corporation) C:\windows\SysWOW64\javaws.exe
2015-01-27 15:06 - 2014-08-06 10:10 - 00176552 _____ (Oracle Corporation) C:\windows\SysWOW64\javaw.exe
2015-01-27 15:06 - 2014-08-06 10:10 - 00176552 _____ (Oracle Corporation) C:\windows\SysWOW64\java.exe
2015-01-27 15:06 - 2014-08-06 10:10 - 00098216 _____ (Oracle Corporation) C:\windows\SysWOW64\WindowsAccessBridge-32.dll
2015-01-27 14:55 - 2014-03-02 04:06 - 00000225 _____ () C:\windows\CryptoMill_CreoService.002
2015-01-27 14:52 - 2014-08-30 07:51 - 00000000 ____D () C:\ProgramData\Systweak
2015-01-27 14:52 - 2014-08-30 07:50 - 00000000 ____D () C:\Users\WRRUBIS\AppData\Roaming\systweak
2015-01-27 14:52 - 2014-08-30 07:49 - 00000000 ____D () C:\Program Files (x86)\globalUpdate
2015-01-26 22:51 - 2014-05-21 10:04 - 00002377 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2015-01-24 15:54 - 2014-07-23 13:28 - 00003768 _____ () C:\windows\System32\Tasks\Adobe Flash Player Updater
2015-01-24 15:54 - 2014-04-14 16:49 - 00701616 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2015-01-24 15:54 - 2014-04-14 16:49 - 00071344 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-01-24 04:39 - 2014-04-14 17:38 - 00320153 ____N () C:\windows\Minidump\012415-117141-01.dmp
2015-01-24 04:39 - 2014-03-02 04:06 - 00000225 _____ () C:\windows\CryptoMill_CreoService.003
2015-01-23 16:13 - 2014-09-05 09:29 - 00000097 _____ () C:\windows\SASUI.ini
2015-01-20 13:06 - 2014-03-02 04:06 - 00000225 _____ () C:\windows\CryptoMill_CreoService.004
2015-01-17 15:37 - 2014-03-02 04:06 - 00000225 _____ () C:\windows\CryptoMill_CreoService.005
2015-01-17 15:33 - 2014-06-03 09:33 - 00000000 ____D () C:\windows\system32\MRT
2015-01-17 15:31 - 2014-06-03 09:33 - 113365784 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2015-01-15 11:57 - 2009-07-13 21:34 - 00000580 _____ () C:\windows\win.ini
2015-01-15 07:52 - 2014-04-14 16:42 - 00001619 _____ () C:\Users\WRRUBIS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-01-07 11:09 - 2009-07-13 22:20 - 00000000 ____D () C:\windows\rescache
2015-01-07 09:26 - 2009-07-13 23:45 - 00301952 _____ () C:\windows\system32\FNTCACHE.DAT
2015-01-07 09:24 - 2014-05-07 03:00 - 00000000 ___SD () C:\windows\system32\CompatTel
2015-01-07 09:24 - 2009-07-13 22:20 - 00000000 ____D () C:\windows\AppCompat
2015-01-07 09:18 - 2014-04-14 16:52 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-01-05 08:18 - 2014-04-14 16:48 - 00065200 _____ () C:\Users\WRRUBIS\AppData\Local\GDIPFONTCACHEV1.DAT

==================== Files in the root of some directories =======

2015-01-15 07:45 - 2015-01-15 07:49 - 0173024 _____ () C:\Program Files (x86)\Common Files\7bd3e3d7-3f18-4e2f-8da9-12acd7334a7f.dll
2014-09-01 03:18 - 2014-09-01 03:18 - 0001248 _____ () C:\Users\WRRUBIS\AppData\Roaming\VRRFE
2015-01-15 07:45 - 2015-01-15 07:49 - 2010592 _____ () C:\Users\WRRUBIS\AppData\Roaming\VRRFE.exe

Some content of TEMP:
====================
C:\Users\WRRUBIS\AppData\Local\Temp\BackupSetup.exe
C:\Users\WRRUBIS\AppData\Local\Temp\jre-8u31-windows-au.exe
C:\Users\WRRUBIS\AppData\Local\Temp\MouseKeyboardCenterx64_1033.exe

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2015-01-24 05:09

==================== End Of Log ============================

 

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 28-01-2015
Ran by [removed] at 2015-02-02 14:53:36
Running from C:\Users\[removed]\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1PEL76Q7
Boot Mode: Normal
==========================================================

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Microsoft Security Essentials (Enabled - Up to date) {4F35CFC4-45A3-FC37-EF17-759A02E39AB1}
AV: AVG Internet Security 2015 (Enabled - Up to date) {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}
AS: Microsoft Security Essentials (Enabled - Up to date) {F4542E20-6399-F3B9-D5A7-4EE87964D00C}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: AVG Internet Security 2015 (Enabled - Up to date) {B5F5C120-2089-702E-0001-553BB0D5A664}
FW: AVG Internet Security 2015 (Enabled) {36AFA1E1-4CDC-7EF8-11EE-C77C3581ABA2}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Flash Player 16 ActiveX (HKLM-x32\…\Adobe Flash Player ActiveX) (Version: 16.0.0.296 - Adobe Systems Incorporated)
AVG 2015 (HKLM\…\AVG) (Version: 2015.0.5645 - AVG Technologies)
AVG 2015 (Version: 15.0.4273 - AVG Technologies) Hidden
AVG 2015 (Version: 15.0.5645 - AVG Technologies) Hidden
AVG Web TuneUp (HKLM-x32\…\AVG Web TuneUp) (Version: 4.0.5.7 - AVG Technologies)
Bonjour (HKLM\…\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Canon Inkjet Printer Driver Add-On Module V2.00 (HKLM\…\CANONIJINBOXADDON200) (Version:  - )
CyberLink Power2Go 8 (HKLM-x32\…\InstallShield_{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}) (Version: 8.0.3.3207 - CyberLink Corp.)
CyberLink PowerDVD 12 (HKLM-x32\…\InstallShield_{B46BEA36-0B71-4A4E-AE41-87241643FA0A}) (Version: 12.0.2.3212 - CyberLink Corp.)
DirectX for Managed Code Update (Summer 2004) (x32 Version: 9.02.2904 - Microsoft) Hidden
Google Chrome (HKLM-x32\…\Google Chrome) (Version: 40.0.2214.93 - Google Inc.)
Google Earth (HKLM-x32\…\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Hewlett-Packard ACLM.NET v1.2.2.3 (x32 Version: 1.00.0000 - Hewlett-Packard Company) Hidden
HP Client Security Manager (HKLM\…\HPProtectTools) (Version: 8.3.2.1744 - Hewlett-Packard Company)
HP Device Access Manager (HKLM\…\{DBE16A07-DDFF-4453-807A-212EF93916E0}) (Version: 8.3.2.0 - Hewlett-Packard Company)
HP Documentation (HKLM-x32\…\{5FCDA690-8D3F-4855-BEC5-B69977D23529}) (Version: 1.1.0.0 - Hewlett-Packard)
HP Drive Encryption (HKLM\…\HPDriveEncryption) (Version: 8.6.5.142 - Hewlett-Packard Company)
HP File Sanitizer (HKLM-x32\…\{547607B0-3294-4ECA-8F5E-921404676CBB}) (Version: 8.4.13.1 - Hewlett-Packard Company)
HP Setup (HKLM-x32\…\{438363A8-F486-4C37-834C-4955773CB3D3}) (Version: 9.1.15453.4066 - Hewlett-Packard Company)
HP SoftPaq Download Manager (HKLM-x32\…\{49524B48-4FE9-4A62-A9FD-1F2258DF5489}) (Version: 3.4.12.0 - Hewlett-Packard Company)
HP Software Setup (HKLM-x32\…\{7561C06A-7797-4462-A7C3-86F45AE901CF}) (Version: 8.7.4 - Hewlett-Packard Company)
HP Support Assistant (HKLM-x32\…\{3AF15EEA-8EDF-4393-BB6C-CF8A9986486A}) (Version: 7.3.35.20 - Hewlett-Packard Company)
HP Support Information (HKLM-x32\…\{B2B7B1C8-7C8B-476C-BE2C-049731C55992}) (Version: 13.00.0000 - Hewlett-Packard)
HP Theft Recovery (HKLM-x32\…\InstallShield_{BAC712C6-4061-4C9F-AB58-A5C53E76704A}) (Version: 8.3.0.5 - Hewlett-Packard Company)
HP Trust Circles (HKLM-x32\…\HP Trust Circles) (Version: 8.3.6.16976 - Hewlett-Packard Company)
Intel(R) Management Engine Components (HKLM-x32\…\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.13.1706 - Intel Corporation)
Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM-x32\…\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 2.5.0.19 - Intel Corporation)
Java 8 Update 31 (HKLM-x32\…\{26A24AE4-039D-4CA4-87B4-2F83218031F0}) (Version: 8.0.310 - Oracle Corporation)
Malwarebytes Anti-Malware version 2.0.4.1028 (HKLM-x32\…\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\…\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Mouse and Keyboard Center (HKLM\…\Microsoft Mouse and Keyboard Center) (Version: 2.3.188.0 - Microsoft Corporation)
Microsoft Office (HKLM-x32\…\{90150000-0138-0409-0000-0000000FF1CE}) (Version: 15.0.4454.1510 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\…\{90120000-0012-0000-0000-0000000FF1CE}_STANDARD_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office File Validation Add-In (HKLM-x32\…\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Standard 2007 (HKLM-x32\…\STANDARD) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Security Essentials (HKLM\…\Microsoft Security Client) (Version: 4.6.305.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\…\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\…\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\…\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\…\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\…\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\…\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\…\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\…\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\…\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.51106 (HKLM-x32\…\{6e8f74e0-43bd-4dce-8477-6ff6828acc07}) (Version: 11.0.51106.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.51106 (HKLM-x32\…\{8e70e4e1-06d7-470b-9f74-a51bef21088e}) (Version: 11.0.51106.1 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\…\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\…\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\…\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
opensource (x32 Version: 1.0.14960.3876 - Your Company Name) Hidden
PDF Complete Corporate Edition (HKLM-x32\…\PDF Complete) (Version: 4.1.50 - PDF Complete, Inc)
Realtek Ethernet Controller Driver (HKLM-x32\…\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.74.815.2013 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\…\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7004 - Realtek Semiconductor Corp.)
Sapphire Management Suite 1.11.00 10222010 (HKLM-x32\…\{AC038193-1A1C-42A5-8D2A-5A84122F46D9}) (Version: 1.11.00 10222010 - VeriFone)
Skype™ 6.11 (HKLM-x32\…\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.)
TeamViewer 9 (HKLM-x32\…\TeamViewer 9) (Version: 9.0.32494 - TeamViewer)
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\…\{90120000-0012-0000-0000-0000000FF1CE}_STANDARD_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
VipBoxSportsApp (HKLM-x32\…\1ClickDownload) (Version: 2.1 Build 26473 - VipBoxSportsApp.com) <==== ATTENTION
Visual Studio 2012 x64 Redistributables (HKLM\…\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)
Visual Studio 2012 x86 Redistributables (HKLM-x32\…\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
VLC media player 2.1.3 (HKLM-x32\…\VLC media player) (Version: 2.1.3 - VideoLAN)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

==================== Restore Points  =========================

24-01-2015 05:16:15 Scheduled Checkpoint
25-01-2015 01:37:20 Windows Update
28-01-2015 15:41:36 Windows Update
01-02-2015 02:01:33 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-13 21:34 - 2009-06-10 16:00 - 00000824 ____N C:\windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {29041A48-2924-46CF-AA5F-686C8FE83ADD} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-05-21] (Google Inc.)
Task: {3088A1C8-C9DE-4658-AE0D-8C0C7C7B652B} - System32\Tasks\Microsoft_MKC_Logon_Task_itype.exe => c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2014-03-19] (Microsoft Corporation)
Task: {4CC01DFB-7B4C-4EC0-AA98-CE64DD54C5A7} - \Yahoo! Search Updater No Task File <==== ATTENTION
Task: {70806976-B102-4056-A3A4-E3094DF1EB2F} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-08-29] (Hewlett-Packard Company)
Task: {7F8B6B80-5AFE-4B37-8FA1-E339ABE72B8B} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-01-24] (Adobe Systems Incorporated)
Task: {80C1BDD4-1546-4874-BFD3-98FB234A29CC} - System32\Tasks\Microsoft_Hardware_Launch_ipoint_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2014-03-19] (Microsoft Corporation)
Task: {828809EE-B342-4530-942E-7D52B3C04BA5} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-08-29] (Hewlett-Packard Company)
Task: {AAA3916E-D0A3-4628-8EBD-8BC186AB6348} - \Yahoo! Search No Task File <==== ATTENTION
Task: {BB981459-4587-4C5A-B689-EB8B7DA2A963} - System32\Tasks\Microsoft_MKC_Logon_Task_ipoint.exe => c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2014-03-19] (Microsoft Corporation)
Task: {C41A48CE-A95F-4631-B488-5814B9277253} - System32\Tasks\VRRFE => C:\Users\WRRUBIS\AppData\Roaming\VRRFE.exe [2015-01-15] () <==== ATTENTION
Task: {D166A226-48CB-4F4B-BAC1-FF6FD982FCB2} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-05-21] (Google Inc.)
Task: {D22F0D63-28FC-497B-AA3F-738853E3ECA6} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater7\HPSFUpdater.exe [2012-11-29] (Hewlett-Packard Company)
Task: {DF3813E9-3847-470D-BF14-A234ED34D1EA} - System32\Tasks\LaunchSignup => C:\Program Files (x86)\MyPC Backup\Signup Wizard.exe <==== ATTENTION
Task: {F1EBE8EE-D620-439E-A132-E92B2E073339} - System32\Tasks\Microsoft_Hardware_Launch_mousekeyboardcenter_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\mousekeyboardcenter.exe [2014-03-19] (Microsoft)
Task: {FA7CD133-C0F8-433C-85E9-AD80B2D358E1} - System32\Tasks\Microsoft_Hardware_Launch_itype_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2014-03-19] (Microsoft Corporation)
Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\VRRFE.job => C:\Users\WRRUBIS\AppData\Roaming\VRRFE.exe <==== ATTENTION

==================== Loaded Modules (whitelisted) =============

2015-01-17 15:19 - 2015-01-17 15:19 - 03081752 _____ () C:\Program Files (x86)\AVG Web TuneUp\vprot.exe
2013-08-14 16:06 - 2013-08-14 16:06 - 00007168 _____ () C:\Program Files (x86)\Hewlett-Packard\HP Theft Recovery\CtService.exe
2015-01-17 15:20 - 2015-01-17 15:19 - 00159768 _____ () C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.2.0\loggingserver.exe
2014-03-02 04:04 - 2013-08-05 02:49 - 00627672 _____ () C:\Program Files (x86)\CyberLink\Power2Go8\CLMediaLibrary.dll
2013-08-05 18:48 - 2013-08-05 18:48 - 00016856 _____ () c:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvcPS.dll
2015-01-17 15:19 - 2015-01-17 15:19 - 01686552 _____ () C:\Program Files (x86)\AVG Web TuneUp\TBAPI.dll
2015-01-17 15:20 - 2015-01-17 15:19 - 00519704 _____ () C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.2.0\log4cplusU.dll
2015-01-17 15:19 - 2015-01-17 15:19 - 40630296 _____ () C:\Program Files (x86)\AVG Web TuneUp\libcef.dll
2014-03-02 04:01 - 2013-08-08 16:25 - 01242584 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)

==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

========================= Accounts: ==========================

Administrator (S-1-5-21-3022803814-498434483-4042170650-500 - Administrator - Disabled)
Guest (S-1-5-21-3022803814-498434483-4042170650-501 - Limited - Disabled)
WRRUBIS (S-1-5-21-3022803814-498434483-4042170650-1001 - Administrator - Enabled) => C:\Users\WRRUBIS

==================== Faulty Device Manager Devices =============

Name: Microsoft Teredo Tunneling Adapter
Description: Microsoft Teredo Tunneling Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.

==================== Event log errors: =========================

Application errors:
==================
Error: (02/02/2015 11:25:52 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: wmiprvse.exe, version: 6.1.7601.17514, time stamp: 0x4ce79d42
Faulting module name: ole32.dll, version: 6.1.7601.17514, time stamp: 0x4ce7c92c
Exception code: 0xc0000005
Fault offset: 0x0000000000028a29
Faulting process id: 0x63c
Faulting application start time: 0xwmiprvse.exe0
Faulting application path: wmiprvse.exe1
Faulting module path: wmiprvse.exe2
Report Id: wmiprvse.exe3

Error: (01/31/2015 09:45:50 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: IEXPLORE.EXE, version: 10.0.9200.17183, time stamp: 0x546ebc2a
Faulting module name: ntdll.dll, version: 6.1.7601.18247, time stamp: 0x521ea8e7
Exception code: 0xc0000374
Fault offset: 0x000ce753
Faulting process id: 0x1660
Faulting application start time: 0xIEXPLORE.EXE0
Faulting application path: IEXPLORE.EXE1
Faulting module path: IEXPLORE.EXE2
Report Id: IEXPLORE.EXE3

Error: (01/30/2015 02:11:04 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: IEXPLORE.EXE, version: 10.0.9200.17183, time stamp: 0x546ebc2a
Faulting module name: ntdll.dll, version: 6.1.7601.18247, time stamp: 0x521ea8e7
Exception code: 0xc0000374
Fault offset: 0x000ce753
Faulting process id: 0x43704
Faulting application start time: 0xIEXPLORE.EXE0
Faulting application path: IEXPLORE.EXE1
Faulting module path: IEXPLORE.EXE2
Report Id: IEXPLORE.EXE3

Error: (01/30/2015 10:42:55 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: wmiprvse.exe, version: 6.1.7601.17514, time stamp: 0x4ce79d42
Faulting module name: ole32.dll, version: 6.1.7601.17514, time stamp: 0x4ce7c92c
Exception code: 0xc0000005
Fault offset: 0x0000000000028a29
Faulting process id: 0x1fd0
Faulting application start time: 0xwmiprvse.exe0
Faulting application path: wmiprvse.exe1
Faulting module path: wmiprvse.exe2
Report Id: wmiprvse.exe3

Error: (01/30/2015 09:09:15 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: IEXPLORE.EXE, version: 10.0.9200.17183, time stamp: 0x546ebc2a
Faulting module name: ntdll.dll, version: 6.1.7601.18247, time stamp: 0x521ea8e7
Exception code: 0xc0000374
Fault offset: 0x000ce753
Faulting process id: 0x3e418
Faulting application start time: 0xIEXPLORE.EXE0
Faulting application path: IEXPLORE.EXE1
Faulting module path: IEXPLORE.EXE2
Report Id: IEXPLORE.EXE3

Error: (01/30/2015 09:06:19 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: IEXPLORE.EXE, version: 10.0.9200.17183, time stamp: 0x546ebc2a
Faulting module name: ntdll.dll, version: 6.1.7601.18247, time stamp: 0x521ea8e7
Exception code: 0xc0000374
Fault offset: 0x000ce753
Faulting process id: 0x3e6bc
Faulting application start time: 0xIEXPLORE.EXE0
Faulting application path: IEXPLORE.EXE1
Faulting module path: IEXPLORE.EXE2
Report Id: IEXPLORE.EXE3

Error: (01/28/2015 08:08:52 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program IEXPLORE.EXE version 10.0.9200.17183 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

Process ID: 1b14

Start Time: 01d03afa391def36

Termination Time: 19

Application Path: C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

Report Id:

Error: (01/24/2015 04:28:40 AM) (Source: Windows Search Service) (EventID: 3079) (User: )
Description: Notifications for the volume C:\ are not active.

Context: Windows Application

Details:
 Insufficient quota to complete the requested service.  (HRESULT : 0x800705ad) (0x800705ad)

Error: (01/22/2015 04:31:58 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: wmiprvse.exe, version: 6.1.7601.17514, time stamp: 0x4ce79d42
Faulting module name: ole32.dll, version: 6.1.7601.17514, time stamp: 0x4ce7c92c
Exception code: 0xc0000005
Fault offset: 0x0000000000028a29
Faulting process id: 0x2268
Faulting application start time: 0xwmiprvse.exe0
Faulting application path: wmiprvse.exe1
Faulting module path: wmiprvse.exe2
Report Id: wmiprvse.exe3

Error: (01/21/2015 07:59:12 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: IEXPLORE.EXE, version: 10.0.9200.17183, time stamp: 0x546ebc2a
Faulting module name: ntdll.dll, version: 6.1.7601.18247, time stamp: 0x521ea8e7
Exception code: 0xc0000374
Fault offset: 0x000ce753
Faulting process id: 0x160cc
Faulting application start time: 0xIEXPLORE.EXE0
Faulting application path: IEXPLORE.EXE1
Faulting module path: IEXPLORE.EXE2
Report Id: IEXPLORE.EXE3

System errors:
=============
Error: (01/31/2015 09:43:24 AM) (Source: BugCheck) (EventID: 1001) (User: )
Description: 0x000000d1 (0x00000000000001d8, 0x0000000000000002, 0x0000000000000000, 0xfffff880059035e0)C:\windows\Minidump\013115-32058-01.dmp013115-32058-01

Error: (01/31/2015 09:43:23 AM) (Source: EventLog) (EventID: 6008) (User: )
Description: The previous system shutdown at 9:41:31 AM on ‎1/‎31/‎2015 was unexpected.

Error: (01/24/2015 04:42:29 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The globalUpdate Update Service (globalUpdate) service failed to start due to the following error:
%%216

Error: (01/24/2015 04:40:16 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Util Reverse Page service failed to start due to the following error:
%%216

Error: (01/24/2015 04:40:15 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Util Rad Rater service failed to start due to the following error:
%%2

Error: (01/24/2015 04:40:15 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Update Reverse Page service failed to start due to the following error:
%%216

Error: (01/24/2015 04:40:13 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Update Rad Rater service failed to start due to the following error:
%%2

Error: (01/24/2015 04:40:07 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The IHProtect Service service failed to start due to the following error:
%%216

Error: (01/24/2015 04:39:41 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The WindowsMangerProtect Service service failed to start due to the following error:
%%216

Error: (01/24/2015 04:39:42 AM) (Source: BugCheck) (EventID: 1001) (User: )
Description: 0x000000d1 (0x00000000000001d8, 0x0000000000000002, 0x0000000000000000, 0xfffff8800592b5e0)C:\windows\Minidump\012415-117141-01.dmp012415-117141-01

Microsoft Office Sessions:
=========================

==================== Memory info ===========================

Processor: Intel(R) Core(TM) i5-4570 CPU @ 3.20GHz
Percentage of memory in use: 89%
Total physical RAM: 4024.18 MB
Available physical RAM: 406.68 MB
Total Pagefile: 8191.54 MB
Available Pagefile: 1232.15 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB

==================== Drives ================================

Drive c: (Windows ) (Fixed) (Total:454.05 GB) (Free:408.58 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (HP_RECOVERY) (Fixed) (Total:10.61 GB) (Free:1.17 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive e: (HP_TOOLS) (Fixed) (Total:0.09 GB) (Free:0.07 GB) FAT32

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: B8DA694F)
Partition 1: (Active) - (Size=1 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=454 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=10.6 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=100 MB) - (Type=0C)

==================== End Of Log ============================

 

 

Post #2

:welcome:

 

Hello Brian, lets do this

 

 
 
-AdwCleaner-by Xplode
 
Click on this link to download : ADWCleaner
Click on ONE of the Two Blue Download Now buttons That have a blue arrow beside them and save it to your desktop.
 
Do not click on any links in the top Advertisment.
 
  • Close all open programs and internet browsers.
  • Double click on AdwCleaner.exe to run the tool.
  • Click on Scan.
  • After the scan is complete click on "Clean"
  • Confirm each time with Ok.
  • Your computer will be rebooted automatically. A text file will open after the restart.
  • Please post the content of that logfile with your next reply.
  • You can find the logfile at C:\AdwCleaner[S1].txt as well.
    •  
     
    ===============================================================================
     
     
    [external image: thisisujrt.gif] Please download Junkware Removal Tool to your desktop.
    • Shut down your protection software now to avoid potential conflicts.
    • Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
    • The tool will open and start scanning your system.
    • Please be patient as this can take a while to complete depending on your system's specifications.
    • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
    • Post the contents of JRT.txt into your next message.
      •  
       
       
      Then open Malwarebytes, check for updates and run a new threat scan and post the log if it found threats if not not to worry but let me know if it did not
      Post #3
      Hi Ken,

      Great news!!!! It seems to have worked. Following are the logs you asked for and I will run malawarebytes and let you know if it finds anything.

      Thank you so much,

      Brian




      # AdwCleaner v4.109 - Report created 03/02/2015 at 13:20:14
      # Updated 24/01/2015 by Xplode
      # Database : 2015-02-02.1 [Live]
      # Operating System : Windows 7 Professional Service Pack 1 (64 bits)
      # Username : WRRUBIS - WRRUBIS-HP
      # Running from : C:\Users\WRRUBIS\Downloads\AdwCleaner.exe
      # Option : Clean

      ***** [ Services ] *****

      Service Deleted : vToolbarUpdater18.2.0

      ***** [ Files / Folders ] *****

      Folder Deleted : C:\ProgramData\AVG Secure Search
      Folder Deleted : C:\ProgramData\AVG Security Toolbar
      Folder Deleted : C:\ProgramData\Systweak
      Folder Deleted : C:\Program Files (x86)\globalUpdate
      Folder Deleted : C:\Program Files (x86)\Common Files\AVG Secure Search
      Folder Deleted : C:\Users\WRRUBIS\AppData\Local\globalUpdate
      Folder Deleted : C:\Users\WRRUBIS\AppData\Roaming\Systweak
      Folder Deleted : C:\Users\WRRUBIS\AppData\Local\Google\Chrome\User Data\Default\Extensions\ncffjdbbodifgldkcbhmiiljfcnbgjab
      File Deleted : C:\windows\System32\roboot64.exe
      File Deleted : C:\Users\WRRUBIS\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.superfish.com_0.localstorage
      File Deleted : C:\Users\WRRUBIS\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.superfish.com_0.localstorage-journal
      File Deleted : C:\Users\WRRUBIS\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_www.superfish.com_0.localstorage
      File Deleted : C:\Users\WRRUBIS\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_www.superfish.com_0.localstorage-journal

      ***** [ Scheduled Tasks ] *****

      Task Deleted : LaunchSignup
      Task Deleted : Yahoo! Search
      Task Deleted : Yahoo! Search Updater

      ***** [ Shortcuts ] *****

      Shortcut Disinfected : C:\Users\Public\Desktop\Google Chrome.lnk
      Shortcut Disinfected : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk
      Shortcut Disinfected : C:\Users\WRRUBIS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
      Shortcut Disinfected : C:\Users\WRRUBIS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk
      Shortcut Disinfected : C:\Users\WRRUBIS\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
      Shortcut Disinfected : C:\Users\WRRUBIS\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
      Shortcut Disinfected : C:\Users\WRRUBIS\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk

      ***** [ Registry ] *****

      Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\ncffjdbbodifgldkcbhmiiljfcnbgjab
      Key Deleted : HKCU\Software\MICROSOFT\INTERNET EXPLORER\DOMSTORAGE\superfish.com
      Key Deleted : HKLM\SOFTWARE\Classes\AppID\ViProtocol.DLL
      Key Deleted : HKLM\SOFTWARE\Classes\globalUpdate.OneClickProcessLauncherMachine
      Key Deleted : HKLM\SOFTWARE\Classes\globalUpdate.OneClickProcessLauncherMachine.1.0
      Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoCreateAsync
      Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoCreateAsync.1.0
      Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoreClass
      Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoreClass.1
      Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoreMachineClass
      Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoreMachineClass.1
      Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CredentialDialogMachine
      Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CredentialDialogMachine.1.0
      Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassMachine
      Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassMachine.1.0
      Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassMachineFallback
      Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassMachineFallback.1.0
      Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassSvc
      Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassSvc.1.0
      Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.ProcessLauncher
      Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.ProcessLauncher.1.0
      Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3COMClassService
      Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3COMClassService.1.0
      Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebMachine
      Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebMachine.1.0
      Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebMachineFallback
      Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebMachineFallback.1.0
      Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebSvc
      Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebSvc.1.0
      Key Deleted : HKLM\SOFTWARE\Classes\protocols\handler\viprotocol
      Key Deleted : HKLM\SOFTWARE\Classes\S
      Key Deleted : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi
      Key Deleted : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi.1
      Key Deleted : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE
      Key Deleted : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE.1
      Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [vProt]
      Key Deleted : HKLM\SOFTWARE\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin
      Key Deleted : HKCU\Software\Classes\keepmysearch
      Key Deleted : HKLM\SOFTWARE\Classes\AppID\{1FDFF5A2-7BB1-48E1-8081-7236812B12B2}
      Key Deleted : HKLM\SOFTWARE\Classes\AppID\{3278F5CF-48F3-4253-A6BB-004CE84AF492}
      Key Deleted : HKLM\SOFTWARE\Classes\AppID\{577975B8-C40E-43E6-B0DE-4C6B44088B52}
      Key Deleted : HKLM\SOFTWARE\Classes\AppID\{C007DADD-132A-624C-088E-59EE6CF0711F}
      Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{02A96331-0CA6-40E2-A87D-C224601985EB}
      Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
      Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3278F5CF-48F3-4253-A6BB-004CE84AF492}
      Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3B5702BA-7F4C-4D1A-B026-1E9A01D43978}
      Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
      Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{577975B8-C40E-43E6-B0DE-4C6B44088B52}
      Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{5E89ACE9-E16B-499A-87B4-0DBF742404C1}
      Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{69F256DF-BA98-45E9-86EA-FC3CFECF9D30}
      Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{6E87FC94-9866-49B9-8E93-5736D6DE3DD7}
      Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{7E49F793-B3CD-4BF7-8419-B34B8BD30E61}
      Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{834469E3-CA2B-4F21-A5CA-4F6F4DBCDE87}
      Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{8529FAA3-5BFD-43C1-AB35-B53C4B96C6E5}
      Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{933B95E2-E7B7-4AD9-B952-7AC336682AE3}
      Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}
      Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{ADBC39BE-3D20-4333-8D99-E91EB1B62474}
      Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{B658800C-F66E-4EF3-AB85-6C0C227862A9}
      Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E06CA7F5-BA34-4FF6-8D24-B1BDC594D91F}
      Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{F6421EE5-A5BE-4D31-81D5-C16B7BF48E4C}
      Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{FD8E81D0-F5FE-4CB1-9AEA-1E163D2BAB78}
      Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{459DD0F7-0D55-D3DC-67BC-E6BE37E9D762}
      Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220622172268}
      Key Deleted : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
      Key Deleted : HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
      Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
      Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
      Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{74FB6AFD-DD77-4CEB-83BD-AB2B63E63C93}
      Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
      Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}
      Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}
      Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{95B7759C-8C7F-4BF1-B163-73684A933233}
      Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{95B7759C-8C7F-4BF1-B163-73684A933233}
      Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5E89ACE9-E16B-499A-87B4-0DBF742404C1}
      Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220622172268}
      Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
      Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
      Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
      Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
      Key Deleted : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}
      Key Deleted : HKCU\Software\GlobalUpdate
      Key Deleted : HKCU\Software\InstalledBrowserExtensions
      Key Deleted : HKCU\Software\systweak
      Key Deleted : HKLM\SOFTWARE\GlobalUpdate
      Key Deleted : HKLM\SOFTWARE\InstalledBrowserExtensions
      Key Deleted : HKLM\SOFTWARE\SupDp
      Key Deleted : HKLM\SOFTWARE\systweak
      Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\1ClickDownload
      Key Deleted : [x64] HKLM\SOFTWARE\InstalledBrowserExtensions

      ***** [ Browsers ] *****

      -\\ Internet Explorer v10.0.9200.17183


      -\\ Google Chrome v40.0.2214.94

      [C:\Users\WRRUBIS\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [Search Provider] : hxxp://search.aol.com/aol/search?q={searchTerms}
      [C:\Users\WRRUBIS\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [Search Provider] : hxxp://www.ask.com/web?q={searchTerms}
      [C:\Users\WRRUBIS\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [Search Provider] : hxxp://isearch.omiga-plus.com/web/?type=dspp&ts=1421326357&from=ild&uid=ST500DM002-1BD142_W3T3J4GK&q={searchTerms}
      [C:\Users\WRRUBIS\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [Search Provider] : hxxp://isearch.omiga-plus.com/web/?type=dspp&ts=1421326357&from=ild&uid=ST500DM002-1BD142_W3T3J4GK&q={searchTerms}

      -\\ Opera v0.0.0.0

      [C:\Users\WRRUBIS\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [Search Provider] : hxxp://search.aol.com/aol/search?q={searchTerms}
      [C:\Users\WRRUBIS\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [Search Provider] : hxxp://www.ask.com/web?q={searchTerms}
      [C:\Users\WRRUBIS\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [Search Provider] : hxxp://isearch.omiga-plus.com/web/?type=dspp&ts=1421326357&from=ild&uid=ST500DM002-1BD142_W3T3J4GK&q={searchTerms}
      [C:\Users\WRRUBIS\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [Search Provider] : hxxp://isearch.omiga-plus.com/web/?type=dspp&ts=1421326357&from=ild&uid=ST500DM002-1BD142_W3T3J4GK&q={searchTerms}

      *************************

      AdwCleaner[R0].txt - [9723 octets] - [03/02/2015 13:15:10]
      AdwCleaner[S0].txt - [11264 octets] - [03/02/2015 13:20:14]

      ########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [11325 octets] ##########


      Junkware Removal Tool (JRT) by Thisisu
      Version: 6.4.2 (02.02.2015:1)
      OS: Windows 7 Professional x64
      Ran by [removed] on Tue 02/03/2015 at 13:30:12.50
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




      ~~~ Services



      ~~~ Registry Values

      Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\\Start Page
      Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Page_URL



      ~~~ Registry Keys



      ~~~ Files



      ~~~ Folders



      ~~~ Event Viewer Logs were cleared





      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      Scan was completed on Tue 02/03/2015 at 13:33:38.74
      End of JRT log
      Post #4

      Great, let me know what Malwarebytes found if anything, then run a new scan with FRST, be sure to checkmark Additions and post both new logs please

      Post #6
      Hi Ken,

      This is the FRST log you requested.

      Thanks very much.

      Brian


      Additional scan result of Farbar Recovery Scan Tool (x64) Version: 01-02-2015
      Ran by [removed] at 2015-02-03 14:19:24
      Running from C:\Users\[removed]\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EGFP5L9E
      Boot Mode: Normal
      ==========================================================


      ==================== Security Center ========================

      (If an entry is included in the fixlist, it will be removed.)

      AV: Microsoft Security Essentials (Enabled - Up to date) {4F35CFC4-45A3-FC37-EF17-759A02E39AB1}
      AV: AVG Internet Security 2015 (Enabled - Up to date) {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}
      AS: Microsoft Security Essentials (Enabled - Up to date) {F4542E20-6399-F3B9-D5A7-4EE87964D00C}
      AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
      AS: AVG Internet Security 2015 (Enabled - Up to date) {B5F5C120-2089-702E-0001-553BB0D5A664}
      FW: AVG Internet Security 2015 (Enabled) {36AFA1E1-4CDC-7EF8-11EE-C77C3581ABA2}

      ==================== Installed Programs ======================

      (Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

      Adobe Flash Player 16 ActiveX (HKLM-x32\…\Adobe Flash Player ActiveX) (Version: 16.0.0.296 - Adobe Systems Incorporated)
      AVG 2015 (HKLM\…\AVG) (Version: 2015.0.5645 - AVG Technologies)
      AVG 2015 (Version: 15.0.4281 - AVG Technologies) Hidden
      AVG 2015 (Version: 15.0.5645 - AVG Technologies) Hidden
      AVG Web TuneUp (HKLM-x32\…\AVG Web TuneUp) (Version: 4.0.5.7 - AVG Technologies)
      Bonjour (HKLM\…\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
      Canon Inkjet Printer Driver Add-On Module V2.00 (HKLM\…\CANONIJINBOXADDON200) (Version: - )
      CyberLink Power2Go 8 (HKLM-x32\…\InstallShield_{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}) (Version: 8.0.3.3207 - CyberLink Corp.)
      CyberLink PowerDVD 12 (HKLM-x32\…\InstallShield_{B46BEA36-0B71-4A4E-AE41-87241643FA0A}) (Version: 12.0.2.3212 - CyberLink Corp.)
      DirectX for Managed Code Update (Summer 2004) (x32 Version: 9.02.2904 - Microsoft) Hidden
      Google Chrome (HKLM-x32\…\Google Chrome) (Version: 40.0.2214.94 - Google Inc.)
      Google Earth (HKLM-x32\…\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
      Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
      Hewlett-Packard ACLM.NET v1.2.2.3 (x32 Version: 1.00.0000 - Hewlett-Packard Company) Hidden
      HP Client Security Manager (HKLM\…\HPProtectTools) (Version: 8.3.2.1744 - Hewlett-Packard Company)
      HP Device Access Manager (HKLM\…\{DBE16A07-DDFF-4453-807A-212EF93916E0}) (Version: 8.3.2.0 - Hewlett-Packard Company)
      HP Documentation (HKLM-x32\…\{5FCDA690-8D3F-4855-BEC5-B69977D23529}) (Version: 1.1.0.0 - Hewlett-Packard)
      HP Drive Encryption (HKLM\…\HPDriveEncryption) (Version: 8.6.5.142 - Hewlett-Packard Company)
      HP File Sanitizer (HKLM-x32\…\{547607B0-3294-4ECA-8F5E-921404676CBB}) (Version: 8.4.13.1 - Hewlett-Packard Company)
      HP Setup (HKLM-x32\…\{438363A8-F486-4C37-834C-4955773CB3D3}) (Version: 9.1.15453.4066 - Hewlett-Packard Company)
      HP SoftPaq Download Manager (HKLM-x32\…\{49524B48-4FE9-4A62-A9FD-1F2258DF5489}) (Version: 3.4.12.0 - Hewlett-Packard Company)
      HP Software Setup (HKLM-x32\…\{7561C06A-7797-4462-A7C3-86F45AE901CF}) (Version: 8.7.4 - Hewlett-Packard Company)
      HP Support Assistant (HKLM-x32\…\{3AF15EEA-8EDF-4393-BB6C-CF8A9986486A}) (Version: 7.3.35.20 - Hewlett-Packard Company)
      HP Support Information (HKLM-x32\…\{B2B7B1C8-7C8B-476C-BE2C-049731C55992}) (Version: 13.00.0000 - Hewlett-Packard)
      HP Theft Recovery (HKLM-x32\…\InstallShield_{BAC712C6-4061-4C9F-AB58-A5C53E76704A}) (Version: 8.3.0.5 - Hewlett-Packard Company)
      HP Trust Circles (HKLM-x32\…\HP Trust Circles) (Version: 8.3.6.16976 - Hewlett-Packard Company)
      Intel(R) Management Engine Components (HKLM-x32\…\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.13.1706 - Intel Corporation)
      Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM-x32\…\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 2.5.0.19 - Intel Corporation)
      Java 8 Update 31 (HKLM-x32\…\{26A24AE4-039D-4CA4-87B4-2F83218031F0}) (Version: 8.0.310 - Oracle Corporation)
      Malwarebytes Anti-Malware version 2.0.4.1028 (HKLM-x32\…\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
      Microsoft .NET Framework 4.5.1 (HKLM\…\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
      Microsoft Mouse and Keyboard Center (HKLM\…\Microsoft Mouse and Keyboard Center) (Version: 2.3.188.0 - Microsoft Corporation)
      Microsoft Office (HKLM-x32\…\{90150000-0138-0409-0000-0000000FF1CE}) (Version: 15.0.4454.1510 - Microsoft Corporation)
      Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\…\{90120000-0012-0000-0000-0000000FF1CE}_STANDARD_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
      Microsoft Office File Validation Add-In (HKLM-x32\…\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
      Microsoft Office Standard 2007 (HKLM-x32\…\STANDARD) (Version: 12.0.6612.1000 - Microsoft Corporation)
      Microsoft Security Essentials (HKLM\…\Microsoft Security Client) (Version: 4.6.305.0 - Microsoft Corporation)
      Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
      Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\…\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
      Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\…\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
      Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\…\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
      Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\…\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
      Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\…\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
      Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\…\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
      Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\…\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
      Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\…\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
      Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\…\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
      Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.51106 (HKLM-x32\…\{6e8f74e0-43bd-4dce-8477-6ff6828acc07}) (Version: 11.0.51106.1 - Microsoft Corporation)
      Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.51106 (HKLM-x32\…\{8e70e4e1-06d7-470b-9f74-a51bef21088e}) (Version: 11.0.51106.1 - Microsoft Corporation)
      Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\…\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
      MSXML 4.0 SP2 (KB954430) (HKLM-x32\…\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
      MSXML 4.0 SP2 (KB973688) (HKLM-x32\…\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
      opensource (x32 Version: 1.0.14960.3876 - Your Company Name) Hidden
      PDF Complete Corporate Edition (HKLM-x32\…\PDF Complete) (Version: 4.1.50 - PDF Complete, Inc)
      Realtek Ethernet Controller Driver (HKLM-x32\…\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.74.815.2013 - Realtek)
      Realtek High Definition Audio Driver (HKLM-x32\…\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7004 - Realtek Semiconductor Corp.)
      Sapphire Management Suite 1.11.00 10222010 (HKLM-x32\…\{AC038193-1A1C-42A5-8D2A-5A84122F46D9}) (Version: 1.11.00 10222010 - VeriFone)
      Skype™ 6.11 (HKLM-x32\…\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.)
      TeamViewer 9 (HKLM-x32\…\TeamViewer 9) (Version: 9.0.32494 - TeamViewer)
      Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\…\{90120000-0012-0000-0000-0000000FF1CE}_STANDARD_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
      Visual Studio 2012 x64 Redistributables (HKLM\…\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)
      Visual Studio 2012 x86 Redistributables (HKLM-x32\…\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
      VLC media player 2.1.3 (HKLM-x32\…\VLC media player) (Version: 2.1.3 - VideoLAN)

      ==================== Custom CLSID (selected items): ==========================

      (If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


      ==================== Restore Points =========================

      24-01-2015 05:16:15 Scheduled Checkpoint
      25-01-2015 01:37:20 Windows Update
      28-01-2015 15:41:36 Windows Update
      01-02-2015 02:01:33 Windows Update

      ==================== Hosts content: ==========================

      (If needed Hosts: directive could be included in the fixlist to reset Hosts.)

      2009-07-13 21:34 - 2009-06-10 16:00 - 00000824 ____N C:\windows\system32\Drivers\etc\hosts

      ==================== Scheduled Tasks (whitelisted) =============

      (If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

      Task: {29041A48-2924-46CF-AA5F-686C8FE83ADD} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-05-21] (Google Inc.)
      Task: {3088A1C8-C9DE-4658-AE0D-8C0C7C7B652B} - System32\Tasks\Microsoft_MKC_Logon_Task_itype.exe => c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2014-03-19] (Microsoft Corporation)
      Task: {70806976-B102-4056-A3A4-E3094DF1EB2F} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-08-29] (Hewlett-Packard Company)
      Task: {7F8B6B80-5AFE-4B37-8FA1-E339ABE72B8B} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-01-24] (Adobe Systems Incorporated)
      Task: {80C1BDD4-1546-4874-BFD3-98FB234A29CC} - System32\Tasks\Microsoft_Hardware_Launch_ipoint_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2014-03-19] (Microsoft Corporation)
      Task: {828809EE-B342-4530-942E-7D52B3C04BA5} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-08-29] (Hewlett-Packard Company)
      Task: {BB981459-4587-4C5A-B689-EB8B7DA2A963} - System32\Tasks\Microsoft_MKC_Logon_Task_ipoint.exe => c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2014-03-19] (Microsoft Corporation)
      Task: {C41A48CE-A95F-4631-B488-5814B9277253} - System32\Tasks\VRRFE => C:\Users\WRRUBIS\AppData\Roaming\VRRFE.exe [2015-01-15] () <==== ATTENTION
      Task: {D166A226-48CB-4F4B-BAC1-FF6FD982FCB2} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-05-21] (Google Inc.)
      Task: {D22F0D63-28FC-497B-AA3F-738853E3ECA6} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater7\HPSFUpdater.exe [2012-11-29] (Hewlett-Packard Company)
      Task: {F1EBE8EE-D620-439E-A132-E92B2E073339} - System32\Tasks\Microsoft_Hardware_Launch_mousekeyboardcenter_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\mousekeyboardcenter.exe [2014-03-19] (Microsoft)
      Task: {FA7CD133-C0F8-433C-85E9-AD80B2D358E1} - System32\Tasks\Microsoft_Hardware_Launch_itype_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2014-03-19] (Microsoft Corporation)
      Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
      Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
      Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
      Task: C:\windows\Tasks\VRRFE.job => C:\Users\WRRUBIS\AppData\Roaming\VRRFE.exe <==== ATTENTION

      ==================== Loaded Modules (whitelisted) =============

      2013-08-14 16:06 - 2013-08-14 16:06 - 00007168 _____ () C:\Program Files (x86)\Hewlett-Packard\HP Theft Recovery\CtService.exe
      2014-03-02 04:04 - 2013-08-05 02:49 - 00627672 _____ () C:\Program Files (x86)\CyberLink\Power2Go8\CLMediaLibrary.dll
      2013-08-05 18:48 - 2013-08-05 18:48 - 00016856 _____ () c:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvcPS.dll
      2015-01-17 15:19 - 2015-01-17 15:19 - 01686552 _____ () C:\Program Files (x86)\AVG Web TuneUp\TBAPI.dll
      2014-03-02 04:01 - 2013-08-08 16:25 - 01242584 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll

      ==================== Alternate Data Streams (whitelisted) =========

      (If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


      ==================== Safe Mode (whitelisted) ===================

      (If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


      ==================== EXE Association (whitelisted) =============

      (If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


      ==================== MSCONFIG/TASK MANAGER disabled items =========

      (Currently there is no automatic fix for this section.)


      ========================= Accounts: ==========================

      Administrator (S-1-5-21-3022803814-498434483-4042170650-500 - Administrator - Disabled)
      Guest (S-1-5-21-3022803814-498434483-4042170650-501 - Limited - Disabled)
      WRRUBIS (S-1-5-21-3022803814-498434483-4042170650-1001 - Administrator - Enabled) => C:\Users\WRRUBIS

      ==================== Faulty Device Manager Devices =============

      Name: Microsoft Teredo Tunneling Adapter
      Description: Microsoft Teredo Tunneling Adapter
      Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
      Manufacturer: Microsoft
      Service: tunnel
      Problem: : This device cannot start. (Code10)
      Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
      On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.


      ==================== Event log errors: =========================

      Application errors:
      ==================

      System errors:
      =============

      Microsoft Office Sessions:
      =========================

      ==================== Memory info ===========================

      Processor: Intel(R) Core(TM) i5-4570 CPU @ 3.20GHz
      Percentage of memory in use: 51%
      Total physical RAM: 4024.18 MB
      Available physical RAM: 1962.86 MB
      Total Pagefile: 8046.54 MB
      Available Pagefile: 5618.73 MB
      Total Virtual: 8192 MB
      Available Virtual: 8191.83 MB

      ==================== Drives ================================

      Drive c: (Windows ) (Fixed) (Total:454.05 GB) (Free:408.38 GB) NTFS ==>[System with boot components (obtained from reading drive)]
      Drive d: (HP_RECOVERY) (Fixed) (Total:10.61 GB) (Free:1.17 GB) NTFS ==>[System with boot components (obtained from reading drive)]
      Drive e: (HP_TOOLS) (Fixed) (Total:0.09 GB) (Free:0.07 GB) FAT32

      ==================== MBR & Partition Table ==================

      ========================================================
      Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: B8DA694F)
      Partition 1: (Active) - (Size=1 GB) - (Type=07 NTFS)
      Partition 2: (Not Active) - (Size=454 GB) - (Type=07 NTFS)
      Partition 3: (Not Active) - (Size=10.6 GB) - (Type=07 NTFS)
      Partition 4: (Not Active) - (Size=100 MB) - (Type=0C)

      ==================== End Of Log ============================
      Post #8

      Hi Ken, I will send those tomorrow as I am not at the computer.  How do I get the main FRST log?

       

      I really appreciate your help and as mentioned you seem to have cured the problem.  Will be making a donation.

       

      Brian

      Post #9

      First off your running FRST from your temp internet files, it has to be run from the deskop

      Running from C:\Users\[removed]\AppData\Local\Microsoft\Windows\Temporary Internet Files

       

      Redownload it to your desktop, open it, make sure Additions is checked and run a new scan and post both logs

       

      Link

       

      Please download Farbar Recovery Scan Tool and save it to your DESKTOP, you will need the 64 bit version

       

      Take your time because I will be offline in the am till most likely later in the evening

       

       

      Post #10
      Hi Ken,

      I hope these are what you need. Thanks.




      Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-02-2015
      Ran by [removed] (administrator) on WRRUBIS-HP on 04-02-2015 10:29:51
      Running from C:\Users\[removed]\Desktop
      [removed]
      Post #11

      Hi,

       

      Sorry for the late response but was out of town all day

       

      I am going to attach a FIXLIST file, you need to download and  save it to your desktop where you have FRST or the fix wont work, after you download it open up FRST and click on FIX (Not Scan) it wont take long, it will reboot your system and you will find a FIXLOG on your desktop, post it please

       

      You need to enable windows to show all files and folders, instructions Here
       
      Go to VirusTotal and submit these files for analysis, just use CHOOSE FILE  and then Scan It, if it says this file has been checked before, have them recheck it. When the scan is done just copy and paste the link back to this forum for me to see.
       
      C:\Program Files (x86)\Common Files\7bd3e3d7-3f18-4e2f-8da9-12acd7334a7f.dll <—This file
       
      If the site is busy you can try this one
      http://virusscan.jotti.org/en
       
       
       
       

      Attachments:

      Post #13

      Hi Ken,

       

      I apologise for not getting back to you sooner.  I will try to get the scans to you tomorrow, Saturday.

       

      Again, thanks for the help and time.

       

      Brian

      Post #14

      https://www.virustotal.com/en/file/4187127e0a0e89b666ea8108861c61261f2511f6f7b4c27c190ed54ee1b167d5/analysis/1423347515/

       

       

       

       

       

      Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 07-02-2015
      Ran by [removed] at 2015-02-07 17:10:07 Run:1
      Running from C:\Users\[removed]\Desktop
      [removed] Boot Mode: Normal
      ==============================================

      Content of fixlist:
      *****************
      Start
      CloseProcesses:
      GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
      CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
      CHR HomePage: Default -> hxxp://isearch.omiga-plus.com/?type=hppp&ts=1421326357&from=ild&uid=ST500DM002-1BD142_W3T3J4GK
      CHR RestoreOnStartup: Default -> "hxxp://rts.dsrlte.com?affID=pr_953af01d-e3af-45d4-ab39-472d2beb9084"
      2015-01-15 07:45 - 2015-02-04 07:49 - 00001344 _____ () C:\windows\Tasks\VRRFE.job
      2015-01-15 07:45 - 2015-01-15 07:49 - 02010592 _____ () C:\Users\WRRUBIS\AppData\Roaming\VRRFE.exe
      2015-01-15 07:45 - 2015-01-15 07:49 - 00004378 _____ () C:\windows\System32\Tasks\VRRFE
      Task: {C41A48CE-A95F-4631-B488-5814B9277253} - System32\Tasks\VRRFE => C:\Users\WRRUBIS\AppData\Roaming\VRRFE.exe [2015-01-15] () <==== ATTENTION
      Task: C:\windows\Tasks\VRRFE.job => C:\Users\WRRUBIS\AppData\Roaming\VRRFE.exe <==== ATTENTION
      CMD: ipconfig /flushdns
      Hosts:
      EmptyTemp:
      End

       

       

       

       

      *****************

      Processes closed successfully.
      C:\windows\system32\GroupPolicy\Machine => Moved successfully.
      C:\windows\system32\GroupPolicy\GPT.ini => Moved successfully.
      "HKLM\SOFTWARE\Policies\Google" => Key deleted successfully.
      Chrome HomePage deleted successfully.
      Chrome RestoreOnStartup deleted successfully.
      C:\windows\Tasks\VRRFE.job => Moved successfully.
      C:\Users\WRRUBIS\AppData\Roaming\VRRFE.exe => Moved successfully.
      C:\windows\System32\Tasks\VRRFE => Moved successfully.
      "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{C41A48CE-A95F-4631-B488-5814B9277253}" => Key deleted successfully.
      "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C41A48CE-A95F-4631-B488-5814B9277253}" => Key deleted successfully.
      C:\Windows\System32\Tasks\VRRFE not found.
      "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\VRRFE" => Key deleted successfully.
      C:\windows\Tasks\VRRFE.job not found.

      =========  ipconfig /flushdns =========

      Windows IP Configuration

      Post #15

      You didnt post the entire FIXLOG, please open it and on the top select EDIT …SELECT ALL     >>>>>    EDIT >>>COPY and post the entire log please

      Ask AI

      AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

      Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI