Spyware / Malware / Virus Removal

Yahoo, pop-ups, and underlines--Oh My! [Solved]

13 min read

Looking for the outcome? Ask AI

Clstlg Topic Starter

Post #1April 23, 2015, 11:16 PM UTC

My children's computer is very infected.

They use Firefox as their browser and Yahoo has set itself up as the homepage. I can't get it to change to another homepage through the normal methods. They've been plagued with pop-ups despite having AdBlock Plus and AdBlock Plus Pop Up Addon installed. There are blue links and underlines on everything!

AVG is set up to run once a day. Malwarebytes is supposed to be run weekly, but I suspect that hasn't happened as regularly as it should.

When I was informed about the problem, I ran AVG, Malwarebytes, and SuperAntiSpyware to little good.

So here I am…I need help please.

I've run the aswMBR, but it keeps stopping. Below is what I have…

Thank you for your help.

Clstlg

aswMBR version 1.0.1.2252 Copyright© 2014 AVAST Software
Run date: 2015-04-23 15:02:25
—————————–
15:02:25.917    OS Version: Windows x64 6.2.9200
15:02:25.918    Number of processors: 4 586 0x1001
15:02:25.919    ComputerName: GOODWINPC UserName: Goodwin
15:02:29.517    Initialize success
15:02:29.588    VM: initialized successfully
15:02:29.589    VM: Amd CPU supported
15:11:08.019    AVAST engine defs: 15042301
15:14:48.683    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\00000032
15:14:48.685    Disk 0 Vendor: ST2000DM001-1CH164 HP33 Size: 1907729MB BusType: 11
15:14:48.790    Disk 0 MBR read successfully
15:14:48.792    Disk 0 MBR scan
15:14:48.796    Disk 0 unknown MBR code
15:14:48.798    Disk 0 Partition 1 00     EE          GPT           1907729 MB offset 1
15:14:48.826    Disk 0 scanning C:\windows\system32\drivers
15:14:59.961    Service scanning
15:15:19.599    Modules scanning
15:15:19.605    Disk 0 trace - called modules:
15:15:19.620    ntoskrnl.exe CLASSPNP.SYS disk.sys storport.sys hal.dll storahci.sys
15:15:19.625    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8008081060]
15:15:19.629    3 CLASSPNP.SYS[fffff88001001e0a] -> nt!IofCallDriver -> \Device\00000032[0xfffffa80076187f0]
15:15:21.111    AVAST engine scan C:\windows
15:15:23.603    AVAST engine scan C:\windows\system32
15:18:11.832    AVAST engine scan C:\windows\system32\drivers
15:18:28.585    AVAST engine scan C:\Users\Goodwin
15:42:15.644    File: C:\Users\Goodwin\AppData\Local\Temp\nsh988.tmp\spext.dll **INFECTED** Win32:Adware-BIY [PUP]
15:56:15.572    Disk 0 statistics 5190429/0/0 @ 1.58 MB/s
15:56:15.577    Scan stopped
15:56:20.822    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\00000032
15:56:20.826    Disk 0 Vendor: ST2000DM001-1CH164 HP33 Size: 1907729MB BusType: 11
15:56:20.935    Disk 0 MBR read successfully
15:56:20.940    Disk 0 MBR scan
15:56:20.947    Disk 0 unknown MBR code
15:56:20.976    Disk 0 Partition 1 00     EE          GPT           1907729 MB offset 1
15:56:21.021    Disk 0 scanning C:\windows\system32\drivers
15:56:21.025    Service scanning
15:56:44.450    Modules scanning
15:56:44.457    Disk 0 trace - called modules:
15:56:44.489    ntoskrnl.exe CLASSPNP.SYS disk.sys storport.sys hal.dll storahci.sys
15:56:44.493    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8008081060]
15:56:44.497    3 CLASSPNP.SYS[fffff88001001e0a] -> nt!IofCallDriver -> \Device\00000032[0xfffffa80076187f0]
15:56:46.363    AVAST engine scan C:\windows
15:57:44.551    Disk 0 statistics 5238650/0/0 @ 1.54 MB/s
15:57:44.559    Scan stopped
15:57:50.854    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\00000032
15:57:50.858    Disk 0 Vendor: ST2000DM001-1CH164 HP33 Size: 1907729MB BusType: 11
15:57:50.959    Disk 0 MBR read successfully
15:57:50.962    Disk 0 MBR scan
15:57:50.968    Disk 0 unknown MBR code
15:57:50.977    Disk 0 Partition 1 00     EE          GPT           1907729 MB offset 1
15:57:51.024    Disk 0 scanning C:\windows\system32\drivers
15:57:51.028    Service scanning
15:58:12.175    Modules scanning
15:58:12.184    Disk 0 trace - called modules:
15:58:12.221    ntoskrnl.exe CLASSPNP.SYS disk.sys storport.sys hal.dll storahci.sys
15:58:12.225    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8008081060]
15:58:12.229    3 CLASSPNP.SYS[fffff88001001e0a] -> nt!IofCallDriver -> \Device\00000032[0xfffffa80076187f0]
15:58:13.987    AVAST engine scan C:\windows
16:03:12.165    AVAST engine scan C:\windows\system32
16:07:10.991    AVAST engine scan C:\windows\system32\drivers
16:07:28.912    AVAST engine scan C:\Users\Goodwin
16:13:13.832    Disk 0 MBR has been saved successfully to "C:\Users\Goodwin\Desktop\MBR.dat"
16:13:13.839    The log file has been saved successfully to "C:\Users\Goodwin\Desktop\aswMBR.txt"

ken545

Post #2April 24, 2015, 10:03 PM UTC

aswMBR is showing an infected file, I am sure its related to a bogus program, run this scanner and post both logs please, it looks like you may need the 64 bit version of FRST

Please download Farbar Recovery Scan Tool and save it to your DESKTOP

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

How to determine whether a computer is running a 32-bit version or 64-bit version of the Windows operating system

A simple way to check your system: Start –> Computer (right click) –> Properties

[external image: FRST_zps5d956a1a.jpg]

Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.

Please make sure All Users is checked

Just keep the defaults as in the picture checkmarked

Press Scan button.

It will produce a log called FRST.txt in the same directory the tool is run from.

Please copy and paste log back here.

The first time the tool is run it generates another log (Addition.txt - also located in the same directory as FRST.exe/FRST64.exe). Please also paste that along with the FRST.txt into your reply.

Clstlg

Post #3April 24, 2015, 10:58 PM UTC

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 24-04-2015
Ran by [removed] at 2015-04-24 15:56:22
Running from C:\Users\[removed]\Downloads
Boot Mode: Normal
==========================================================

==================== Accounts: =============================

Administrator (S-1-5-21-2247873678-407546785-3609120540-500 - Administrator - Disabled)
Gabrielle (S-1-5-21-2247873678-407546785-3609120540-1002 - Limited - Enabled) => C:\Users\Gabrielle
Goodwin (S-1-5-21-2247873678-407546785-3609120540-1001 - Administrator - Enabled) => C:\Users\Goodwin
Grey (S-1-5-21-2247873678-407546785-3609120540-1003 - Limited - Enabled) => C:\Users\Grey
Guest (S-1-5-21-2247873678-407546785-3609120540-501 - Limited - Disabled)
Miichael (S-1-5-21-2247873678-407546785-3609120540-1004 - Limited - Enabled) => C:\Users\Miichael

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: AVG AntiVirus Free Edition 2014 (Enabled - Up to date) {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: AVG AntiVirus Free Edition 2014 (Enabled - Up to date) {B5F5C120-2089-702E-0001-553BB0D5A664}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Flash Player 17 NPAPI (HKLM-x32\…\Adobe Flash Player NPAPI) (Version: 17.0.0.169 - Adobe Systems Incorporated)
AMD Catalyst Install Manager (HKLM\…\{BFDEF3C4-C349-AE43-4D36-8814E4A9DC87}) (Version: 8.0.881.0 - Advanced Micro Devices, Inc.)
AVG 2014 (HKLM\…\AVG) (Version: 2014.0.4800 - AVG Technologies)
AVG 2014 (Version: 14.0.4311 - AVG Technologies) Hidden
AVG 2014 (Version: 14.0.4800 - AVG Technologies) Hidden
AVG Web TuneUp (HKLM-x32\…\AVG Web TuneUp) (Version: 4.1.0.411 - AVG Technologies)
BioWare Premium Module: Neverwinter Nights(TM) Kingmaker (HKLM-x32\…\Neverwinter Nights(TM) Kingmaker) (Version: - BioWare Corp.)
Bonjour (HKLM\…\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Civilization V Deluxe Edition (HKLM-x32\…\{8BCC07D2-4841-4450-81AA-A074C0969C44}_is1) (Version: 1.0.0.0 - Catalog Games by Donald Dark)
Compatibility Pack for the 2007 Office system (HKLM-x32\…\{90120000-0020-0409-0000-0000000FF1CE}) (Version: 12.0.6514.5001 - Microsoft Corporation)
CrimeWatch (HKLM-x32\…\CrimeWatch) (Version: 3.0.51 - Great Apps)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
davehope.co.uk Product Key Finder (HKLM-x32\…\Product Key Finder_is1) (Version: - davehope.co.uk)
Download Updater (AOL Inc.) (HKLM-x32\…\SoftwareUpdUtility) (Version: - AOL Inc.) <==== ATTENTION
DownloadTerms (HKU\S-1-5-21-2247873678-407546785-3609120540-1001\…\DownloadTerms) (Version: 1.0 - Unlimited Downloads, LLC) <==== ATTENTION
Fallen Enchantress: Legendary Heroes (HKLM-x32\…\Steam App 228260) (Version: - Stardock Entertainment)
GameSpy Arcade (HKLM-x32\…\GameSpy Arcade) (Version: - )
Google Drive (HKLM-x32\…\{56D4499E-AC3E-4B8D-91C9-C700C148C44B}) (Version: 1.13.5782.599 - Google, Inc.)
Google Earth (HKLM-x32\…\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (x32 Version: 1.3.22.3 - Google Inc.) Hidden
Hewlett-Packard ACLM.NET v1.2.2.3 (x32 Version: 1.00.0000 - Hewlett-Packard Company) Hidden
Hoyle Board Games 2005 (HKLM-x32\…\{FB1CCBED-FA66-4D30-BFD7-EF20AD0A81FE}) (Version: 1.0.0.0 - Sierra Entertainment, Inc.)
Hoyle Puzzle Games 2005 (HKLM-x32\…\{A3EAB67E-9B37-4B74-AFE6-D418D5F6F3D4}) (Version: 1.0.0.0 - Sierra Entertainment, Inc.)
HP Connected Music (Meridian - installer) (HKLM-x32\…\StartHPConnectedMusic) (Version: v1.0 - Meridian Audio Ltd)
HP Connected Music (Meridian - player) (HKU\S-1-5-21-2247873678-407546785-3609120540-1001\…\HPConnectedMusic) (Version: 1.1 (build 71) hp - Meridian Audio Ltd)
HP Connected Remote (HKLM-x32\…\{F243A34B-AB7F-4065-B770-B85B767C247C}) (Version: 1.0.1206 - Hewlett-Packard)
HP Deskjet 2540 series Basic Device Software (HKLM\…\{6A79CD11-0C1C-4E24-A8C6-46A02F680346}) (Version: 32.2.188.47710 - Hewlett-Packard Co.)
HP Deskjet 2540 series Help (HKLM-x32\…\{4539575D-C09D-4E71-B207-0F2D6BD74DA2}) (Version: 30.0.0 - Hewlett Packard)
HP Keyboard (HKLM-x32\…\{B40D7926-AE5F-41EA-8AC6-56C0E2F00E9D}) (Version: 1.5.0.7 - Hewlett-Packard)
HP MyRoom (HKLM-x32\…\{9C35EDE5-4B0F-45E7-A438-314BA889948E}) (Version: 9.0.0.0 - Hewlett-Packard Company)
HP Photo Creations (HKLM-x32\…\HP Photo Creations) (Version: 1.0.0.7702 - HP)
HP Quick Start (HKLM-x32\…\{574F0207-8E98-46CD-8F79-318348C98C46}) (Version: 1.0.4660.30220 - Hewlett-Packard)
HP Registration Service (HKLM\…\{E4D6CCF2-0AAF-4B9C-9DE5-893EDC9B4BAA}) (Version: 1.0.5976.4186 - Hewlett-Packard)
HP Support Assistant (HKLM-x32\…\{E35A3B13-78CD-4967-8AC8-AA9FDA693EDE}) (Version: 7.4.45.4 - Hewlett-Packard Company)
HP Support Information (HKLM-x32\…\{B2B7B1C8-7C8B-476C-BE2C-049731C55992}) (Version: 12.00.0000 - Hewlett-Packard)
HP Update (HKLM-x32\…\{912D30CF-F39E-4B31-AD9A-123C6B794EE2}) (Version: 5.005.002.002 - Hewlett-Packard)
IDT Audio (HKLM-x32\…\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6482.0 - IDT)
IMVU Avatar Chat Software (HKU\S-1-5-21-2247873678-407546785-3609120540-1001\…\IMVU Avatar chat client software BETA) (Version: - )
iWin Games (HKLM-x32\…\iWinArcade) (Version: 2.91 - )
Java 7 Update 51 (HKLM-x32\…\{26A24AE4-039D-4CA4-87B4-2F83217025FF}) (Version: 7.0.510 - Oracle)
Kerbal Space Program Demo (HKLM-x32\…\Steam App 231410) (Version: - Squad)
KeyFinder Thing (HKLM-x32\…\KeyFinder Thing_is1) (Version: 3.1.6.0 - KeyFinder Thing)
lucky leap 1.0.0 (HKLM\…\lucky leap) (Version: 1.0.0 - luckyleap)
Magical Diary Demo 1.05 (HKLM-x32\…\Magical Diary - Horse Hall - Demo_is1) (Version: - Hanako Games)
Mahjong Quest 2 (remove only) (HKLM-x32\…\Mahjong Quest 2) (Version: - )
Malwarebytes Anti-Malware version 2.0.4.1028 (HKLM-x32\…\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Microsoft Office 365 - en-us (HKLM\…\O365HomePremRetail - en-us) (Version: 15.0.4701.1002 - Microsoft Corporation)
Microsoft Silverlight (HKLM\…\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SkyDrive (HKU\S-1-5-21-2247873678-407546785-3609120540-1001\…\SkyDriveSetup.exe) (Version: 17.0.2003.1112 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\…\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\…\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (HKLM\…\{350AA351-21FA-3270-8B7A-835434E766AD}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\…\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\…\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\…\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\…\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\…\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\…\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\…\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\…\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\…\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Works 6-9 Converter (HKLM-x32\…\{95140000-0137-0409-0000-0000000FF1CE}) (Version: 14.0.6120.5002 - Microsoft Corporation)
Minecraft (HKLM-x32\…\{1C16BCA3-EBC1-49F6-8623-8FBFB9CCC872}) (Version: 1.0.3.0 - Mojang)
Mini Nutcracker 2.0 (HKLM-x32\…\Mini Nutcracker_is1) (Version: - )
Mozilla Firefox 37.0.1 (x86 en-US) (HKLM-x32\…\Mozilla Firefox 37.0.1 (x86 en-US)) (Version: 37.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\…\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
Mozilla Thunderbird 31.6.0 (x86 en-US) (HKLM-x32\…\Mozilla Thunderbird 31.6.0 (x86 en-US)) (Version: 31.6.0 - Mozilla)
NETGEAR Genie (HKLM-x32\…\NETGEAR Genie) (Version: 2.3.1.46 - NETGEAR Inc.)
Neverwinter Nights (HKLM-x32\…\{C1583439-B034-4881-819C-D52A0587662B}) (Version: - )
NoLimits 2 Roller Coaster Simulation Demo (HKLM-x32\…\Steam App 319260) (Version: - Ole Lange)
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4701.1002 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4701.1002 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4701.1002 - Microsoft Corporation) Hidden
Open Office Packages (HKU\S-1-5-21-2247873678-407546785-3609120540-1001\…\Open Office Packages) (Version: - ) <==== ATTENTION
OpenAL (HKLM-x32\…\OpenAL) (Version: - )
OpenOffice 4.0.0 (HKLM-x32\…\{55E61709-D7D4-43C0-B45D-BFAF5C09A02D}) (Version: 4.00.9702 - Apache Software Foundation)
Product Improvement Study for HP Deskjet 2540 series (HKLM\…\{DF34643B-A745-430C-B27B-A48F853C81E4}) (Version: 32.2.188.47710 - Hewlett-Packard Co.)
QuickShare (HKLM-x32\…\{232F1B14-7126-491F-AC8C-6123BA58FDE2}) (Version: 1.135.60.12323 - Linkury Inc.) <==== ATTENTION
Ralink Bluetooth Stack (HKLM\…\{C079427A-BB28-5168-3DB1-DC6608D226D4}) (Version: 11.0.748.2 - Mediatek)
Ralink RT3290 802.11bgn Wi-Fi Adapter (HKLM-x32\…\{8FC4F1DD-F7FD-4766-804D-3C8FF1D309AF}) (Version: 5.0.37.0 - Mediatek)
RE: Alistair++ 1 (HKLM-x32\…\RE: Alistair++) (Version: 1 - sakevisual)
Recover Keys (HKLM-x32\…\Recover Keys_is1) (Version: 7.0.3.87 - Recover Keys)
Recovery Manager (x32 Version: 5.5.0.5530 - CyberLink Corp.) Hidden
RemooveAdsTube (HKLM-x32\…\{B2F90C69-01B1-A3BD-92BF-12482B317A19}) (Version: - RemoveAdsTube) <==== ATTENTION
Rhapsody (HKLM-x32\…\Rhapsody) (Version: - )
ROBLOX Player (HKLM-x32\…\{373B1718-8CC5-4567-8EE2-9033AD08A680}) (Version: - ROBLOX Corporation)
ROBLOX Player for Goodwin (HKU\S-1-5-21-2247873678-407546785-3609120540-1001\…\{373B1718-8CC5-4567-8EE2-9033AD08A680}) (Version: - ROBLOX Corporation)
ROBLOX Player for Grey (HKU\S-1-5-21-2247873678-407546785-3609120540-1003\…\{373B1718-8CC5-4567-8EE2-9033AD08A680}) (Version: - ROBLOX Corporation)
ROBLOX Studio for Goodwin (HKU\S-1-5-21-2247873678-407546785-3609120540-1001\…\{2922D6F1-2865-4EFA-97A9-94EEAB3AFA14}) (Version: - ROBLOX Corporation)
Sanctum with Game Auto-Reconnect 1.70 (HKLM-x32\…\Sanctum with Game Auto-Reconnect 1.70) (Version: - )
Sanctum18 (HKLM-x32\…\Sanctum18) (Version: - )
Sid Meier's Civilization V (HKLM-x32\…\Steam App 8930) (Version: - 2K Games, Inc.)
Space Empires V (HKLM-x32\…\Steam App 1690) (Version: - Malfador Machinations)
Stardock Central (HKU\S-1-5-21-2247873678-407546785-3609120540-1001\…\Stardock Central) (Version: - Stardock Corporation)
Steam (HKLM-x32\…\Steam) (Version: - Valve Corporation)
SUPERAntiSpyware (HKLM\…\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}) (Version: 6.0.1186 - SUPERAntiSpyware.com)
Talisman: Digital Edition (HKLM-x32\…\Steam App 247000) (Version: - Nomad Games Limited)
Talisman: Prologue (HKLM-x32\…\Steam App 258200) (Version: - Nomad Games)
TeleTech WB ISA (HKLM-x32\…\TeleTech ISA) (Version: 1.0.3 - TeleTech)
Unity Web Player (HKU\S-1-5-21-2247873678-407546785-3609120540-1001\…\UnityWebPlayer) (Version: - Unity Technologies ApS)
Visual Studio 2010 x64 Redistributables (HKLM\…\{21B133D6-5979-47F0-BE1C-F6A6B304693F}) (Version: 13.0.0.1 - AVG Technologies)
Visual Studio 2012 x64 Redistributables (HKLM\…\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)
Visual Studio 2012 x86 Redistributables (HKLM-x32\…\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
Warlords IV (HKLM-x32\…\{7B31DF8A-8B77-497F-8180-E710A01635F1}) (Version: W4PCA0.8 - )
Windows Live Essentials (HKLM-x32\…\WinLiveSuite) (Version: 15.4.3555.0308 - Microsoft Corporation)
Windows Media Player Firefox Plugin (HKLM-x32\…\{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}) (Version: 1.0.0.8 - Microsoft Corp)
Wizard101 (HKLM-x32\…\{A9E27FF5-6294-46A8-B8FD-77B1DECA3021}) (Version: 1.0.0 - KingsIsle Entertainment, Inc.)
World Dance (HKLM-x32\…\{C83C2005-B030-11D5-8CE8-0003470BB21B}) (Version: 1.00.0000 - iSeeSoft, LLC)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-2247873678-407546785-3609120540-1001_Classes\CLSID\{50455C37-81A6-4986-86CC-A5175EDBE3A8}\InprocServer32 -> C:\Program Files (x86)\TNT2\2.0.0.1976\IEToolbar64.dll No File
CustomCLSID: HKU\S-1-5-21-2247873678-407546785-3609120540-1001_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32 -> C:\Users\Goodwin\AppData\Local\Microsoft\SkyDrive\17.0.2003.1112\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2247873678-407546785-3609120540-1001_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32 -> C:\Users\Goodwin\AppData\Local\Microsoft\SkyDrive\17.0.2003.1112\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2247873678-407546785-3609120540-1001_Classes\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32 -> C:\Users\Goodwin\AppData\Local\Microsoft\SkyDrive\17.0.2003.1112\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2247873678-407546785-3609120540-1001_Classes\CLSID\{DEE03C2B-0C0C-41A9-9877-FD4B4D7B6EA3}\InprocServer32 -> C:\Users\Goodwin\AppData\Local\Roblox\Versions\version-1cfeb951d6084e36\RobloxProxy64.dll (ROBLOX Corporation)
CustomCLSID: HKU\S-1-5-21-2247873678-407546785-3609120540-1001_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 -> C:\Users\Goodwin\AppData\Local\Microsoft\SkyDrive\17.0.2003.1112\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2247873678-407546785-3609120540-1001_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\Goodwin\AppData\Local\Microsoft\SkyDrive\17.0.2003.1112\amd64\FileSyncApi64.dll (Microsoft Corporation)

==================== Restore Points =========================

09-04-2015 06:21:01 Scheduled Checkpoint
11-04-2015 01:01:26 Installed Minecraft
14-04-2015 13:47:03 Windows Update
17-04-2015 15:12:14 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2012-07-25 22:26 - 2012-07-25 22:26 - 00000824 ____N C:\windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {00B7DEA8-ECBC-4E8F-BE06-4DF0B01FFE7E} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater7\HPSFUpdater.exe [2014-05-12] (Hewlett-Packard Company)
Task: {0F940933-53AA-4DD4-96A3-D20C5CEF3701} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-08-02] (Google Inc.)
Task: {13953CC8-3301-433F-89DA-E0DB3FE971A8} - System32\Tasks\RunAsStdUser Task => C:\Program Files (x86)\iWin Games\iWinGames.exe [2013-08-02] (iWin Inc.)
Task: {18AE6B43-6BBB-4C61-A78F-7031EF8320F3} - System32\Tasks\HPCeeScheduleForGoodwin => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2011-07-15] (Hewlett-Packard)
Task: {1EC67692-D030-4F2A-8862-4524D73443FE} - System32\Tasks\{D3D8769E-0C05-4832-8F78-4BEE75247A8B} => pcalua.exe -a I:\autorun.exe -d I:\
Task: {2346F637-175A-43B4-8D22-FFC94C952433} - System32\Tasks\HP AR Program Upload - 87c2b8b94a234ec1b1f2df9570ef26898a7e79ef6bf947298632f7a38de543f0 => C:\Program Files\HP\HP Deskjet 2540 series\bin\HPRewards.exe [2014-03-06] (TODO: )
Task: {34AD8598-3124-41FF-98FD-19572B8E227D} - System32\Tasks\HP AR Program Upload - 2c9e641036574d038458ec7eda3f44b340af2e07a949462385c4b4a33f2fba9e => C:\Program Files\HP\HP Deskjet 2540 series\bin\HPRewards.exe [2014-03-06] (TODO: )
Task: {363F7E37-9355-4908-9823-E1F70EC833F9} - System32\Tasks\{69CB7144-9591-4F36-A9AC-3FFB3521CCFE} => pcalua.exe -a I:\AutoPlayStarter.exe -d I:\
Task: {36C125E2-F728-46D5-93B2-FBFC268E9FC6} - System32\Tasks\0215tb_RML => C:\Program Files (x86)\AVG Web TuneUp\AVG-Secure-Search-Update_0215tb.exe [2015-02-25] ()
Task: {5C1BEA64-AAEF-463C-A8C9-6E3C8B66005F} - System32\Tasks\HPCustParticipation HP Deskjet 2540 series => C:\Program Files\HP\HP Deskjet 2540 series\Bin\HPCustPartic.exe [2014-03-06] (Hewlett-Packard Co.)
Task: {7239477C-31B1-4599-97B0-CB3D129B5393} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonx86\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe [2015-02-10] (Microsoft Corporation)
Task: {73CE9EFF-C7CA-46E4-BB10-11DC0FD70670} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-02-10] (Microsoft Corporation)
Task: {76F4FA71-A3B9-4521-94DB-4B5E61F5EEF9} - System32\Tasks\{48D6A4D4-FA1F-4FC8-B848-1AE9DB6E8076} => pcalua.exe -a I:\setup.exe -d I:\
Task: {8DD9F642-6BA9-4ED3-B0DB-CB76EF25607A} - System32\Tasks\HP AR Program Upload - 5cbdb67a0cdc4b40967efcd569863e1f83b5cb5fe05c4715b233b819873d2b0f => C:\Program Files\HP\HP Deskjet 2540 series\bin\HPRewards.exe [2014-03-06] (TODO: )
Task: {97C8247E-A647-4537-8FA9-E933B3753E1C} - System32\Tasks\NetEngine => C:\ProgramData\NetEngine\bin\D7\netengine.exe <==== ATTENTION
Task: {9D8714B9-5D3A-42B5-9294-B20268508356} - System32\Tasks\{F6A31C4C-AC87-4C93-B143-02929BFDA4C6} => pcalua.exe -a I:\AutoPlayStarter.exe -d I:\
Task: {AD0FC7E1-FD46-444F-9F86-6BB6906B56B2} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\windows\system32\MRT.exe [2015-04-14] (Microsoft Corporation)
Task: {AD2886B7-F49E-46BD-BB2C-D3E0330ED9FF} - System32\Tasks\{B2ABEF8F-C628-491B-8733-300970C339E9} => pcalua.exe -a I:\AutoPlayStarter.exe -d I:\
Task: {C2E170F4-488E-4A96-BF14-5DE45542AF5C} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-11-04] (Hewlett-Packard Company)
Task: {C7EF3903-8E0C-420B-A73E-A597DFF78A66} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_CN3B72BGPZ => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2015-03-30] (Hewlett-Packard)
Task: {CA1A5AE0-6527-4DCE-8ED2-646FC94F28D5} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-08-02] (Google Inc.)
Task: {CB800876-2E21-4D3E-937B-221E06947511} - System32\Tasks\Microsoft\Windows\Setup\Windows Upgrade Notification Task => C:\windows\System32\NotificationUI.exe [2015-03-04] (Microsoft Corporation)
Task: {D1C1A1A8-1D4F-4674-9918-27940067E0DD} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-11-04] (Hewlett-Packard Company)
Task: {E59944E8-D99D-454D-AD63-D3FCF731790D} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-04-14] (Adobe Systems Incorporated)
Task: {EC89A5D9-EEC5-456D-883A-3A93D38EA4D8} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_DeviceScan => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2015-03-30] (Hewlett-Packard)
Task: {FC17416F-ED36-4D20-99D8-F1D382C2F649} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-02-10] (Microsoft Corporation)
Task: C:\windows\Tasks\0215tb_RML.job => C:\Program Files (x86)\AVG Web TuneUp\AVG-Secure-Search-Update_0215tb.exe
Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\HPCeeScheduleForGoodwin.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe

==================== Loaded Modules (whitelisted) ==============

2015-03-03 09:32 - 2015-03-03 09:32 - 00620056 _____ () C:\Program Files (x86)\AVG Web TuneUp\WtuSystemSupport.exe
2014-03-19 15:13 - 2014-05-20 08:19 - 00105640 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
2015-03-03 09:32 - 2015-03-03 09:32 - 00159768 _____ () C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.4.0\loggingserver.exe
2013-11-01 16:48 - 2013-11-01 16:48 - 00016632 _____ () C:\windows\system32\BsHelpCSps.dll
2012-08-29 11:02 - 2012-08-29 11:02 - 00120224 _____ () c:\Program Files (x86)\Hewlett-Packard\HP Connected Remote\HPItunesModule.dll
2012-08-29 11:02 - 2012-08-29 11:02 - 00048544 _____ () c:\Program Files (x86)\Hewlett-Packard\HP Connected Remote\HPItunesProxy.dll
2012-08-29 11:02 - 2012-08-29 11:02 - 00180224 _____ () c:\Program Files (x86)\Hewlett-Packard\HP Connected Remote\zxing.dll
2015-03-17 16:33 - 2015-01-27 08:29 - 08898720 _____ () C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\1033\GrooveIntlResource.dll
2013-11-01 16:48 - 2013-11-01 16:48 - 00371448 _____ () C:\windows\system32\BsExtendFunc.dll
2013-11-01 16:48 - 2013-11-01 16:48 - 00029432 _____ () C:\windows\system32\BsTrace.dll
2013-11-01 16:48 - 2013-11-01 16:48 - 00062200 _____ () C:\windows\system32\BlueSoleilCSps.dll
2014-12-15 12:18 - 2015-03-03 09:32 - 03033112 _____ () C:\Program Files (x86)\AVG Web TuneUp\vprot.exe
2014-11-06 08:28 - 2014-11-06 08:28 - 00105216 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\genie2_tray.exe
2012-07-04 22:37 - 2012-07-04 22:37 - 00369664 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2012-05-04 17:42 - 2012-05-04 17:42 - 00098304 _____ () c:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\BrandingNet4.dll
2013-11-01 16:48 - 2013-11-01 16:48 - 00029432 _____ () C:\windows\SYSTEM32\BsTrace.dll
2013-11-01 16:48 - 2013-11-01 16:48 - 00016632 _____ () C:\windows\SYSTEM32\BsHelpCSps.dll
2013-11-01 16:48 - 2013-11-01 16:48 - 00062200 _____ () C:\windows\SYSTEM32\BlueSoleilCSps.dll
2013-05-24 11:22 - 2013-05-24 11:22 - 00334648 _____ () C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\Driver\USB\tl_filter.dll
2011-07-05 11:53 - 2011-07-05 11:53 - 00012800 _____ () C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\Driver\AMP\IVTAMPRL.dll
2015-03-03 09:32 - 2015-03-03 09:32 - 00519704 _____ () C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.4.0\log4cplusU.dll
2014-04-04 23:49 - 2015-03-09 23:37 - 00775680 _____ () C:\Program Files (x86)\Steam\SDL2.dll
2015-02-07 19:47 - 2014-12-01 17:29 - 05002752 _____ () C:\Program Files (x86)\Steam\v8.dll
2014-06-13 10:40 - 2015-04-13 16:44 - 02371776 _____ () C:\Program Files (x86)\Steam\video.dll
2015-02-07 19:47 - 2014-12-01 17:29 - 01612800 _____ () C:\Program Files (x86)\Steam\icui18n.dll
2015-02-07 19:47 - 2014-12-01 17:29 - 01210368 _____ () C:\Program Files (x86)\Steam\icuuc.dll
2014-10-15 15:28 - 2014-12-01 14:31 - 02396672 _____ () C:\Program Files (x86)\Steam\libavcodec-56.dll
2014-10-15 15:28 - 2014-12-01 14:31 - 00479744 _____ () C:\Program Files (x86)\Steam\libavformat-56.dll
2014-10-15 15:28 - 2014-12-01 14:31 - 00332800 _____ () C:\Program Files (x86)\Steam\libavresample-2.dll
2014-10-15 15:28 - 2014-12-01 14:31 - 00442880 _____ () C:\Program Files (x86)\Steam\libavutil-54.dll
2014-10-15 15:28 - 2014-12-01 14:31 - 00485888 _____ () C:\Program Files (x86)\Steam\libswscale-3.dll
2014-04-04 23:49 - 2015-04-13 16:44 - 00702656 _____ () C:\Program Files (x86)\Steam\bin\chromehtml.DLL
2013-09-28 18:13 - 2013-09-28 18:13 - 00544817 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\libgcc_s_dw2-1.dll
2013-09-28 18:13 - 2013-09-28 18:13 - 00989805 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\libstdc++-6.dll
2013-09-28 18:14 - 2013-09-28 18:14 - 03369922 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\icuin51.dll
2013-09-28 18:14 - 2013-09-28 18:14 - 01978690 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\icuuc51.dll
2013-09-28 18:14 - 2013-09-28 18:14 - 22378434 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\icudt51.dll
2013-09-28 18:14 - 2013-09-28 18:14 - 01233408 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\platforms\qwindows.dll
2014-11-17 02:46 - 2014-11-17 02:46 - 00639488 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\Genie.dll
2014-11-10 02:55 - 2014-11-10 02:55 - 01686016 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\SvtNetworkTool.dll
2014-11-05 00:36 - 2014-11-05 00:36 - 00192512 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_Airprint.dll
2014-11-05 00:37 - 2014-11-05 00:37 - 00632832 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_Internet.dll
2014-11-14 03:53 - 2014-11-14 03:53 - 06499840 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_Map.dll
2014-06-29 18:55 - 2014-06-29 18:55 - 00068608 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\QRCode.dll
2014-06-29 19:05 - 2014-06-29 19:05 - 01183232 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\qwt.dll
2014-11-07 02:13 - 2014-11-07 02:13 - 02475520 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_MyMedia.dll
2012-10-15 13:27 - 2012-10-15 13:27 - 00111616 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\libvlc.dll
2012-10-15 13:28 - 2012-10-15 13:28 - 02286592 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\libvlccore.dll
2014-11-17 00:00 - 2014-11-17 00:00 - 01056768 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_NetworkProblem.dll
2014-09-11 01:39 - 2014-09-11 01:39 - 00144896 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\DragonNetTool.dll
2014-11-05 00:51 - 2014-11-05 00:51 - 01191424 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_ParentalControl.dll
2014-11-16 23:21 - 2014-11-16 23:21 - 10374656 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_Resource.dll
2014-11-16 23:18 - 2014-11-16 23:18 - 02496512 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_RouterConfiguration.dll
2014-11-06 02:39 - 2014-11-06 02:39 - 00200192 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_Statistics.dll
2014-11-05 00:58 - 2014-11-05 00:58 - 00889344 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_Ui.dll
2014-11-05 01:00 - 2014-11-05 01:00 - 00435712 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\GeniePlugin_Wireless.dll
2013-09-28 18:13 - 2013-09-28 18:13 - 00051200 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\imageformats\qgif.dll
2013-09-28 18:13 - 2013-09-28 18:13 - 00052224 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\imageformats\qico.dll
2013-09-28 18:13 - 2013-09-28 18:13 - 00261120 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\imageformats\qjpeg.dll
2013-09-28 18:13 - 2013-09-28 18:13 - 00046080 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\imageformats\qsvg.dll
2014-06-29 18:55 - 2014-06-29 18:55 - 00081408 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\DiagnosePlugin.dll
2014-11-03 01:23 - 2014-11-03 01:23 - 00143360 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\DiagnoseDll.dll
2014-09-03 23:00 - 2014-09-03 23:00 - 00072192 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\SVTUtils.dll
2014-09-03 23:00 - 2014-09-03 23:00 - 00074240 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\NetcardApi.dll
2014-09-03 23:00 - 2014-09-03 23:00 - 00136704 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\airprintdll.dll
2012-10-15 13:28 - 2012-10-15 13:28 - 00219648 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\plugins\access\libdshow_plugin.dll
2012-10-15 13:28 - 2012-10-15 13:28 - 00049664 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\plugins\audio_output\libaout_directx_plugin.dll
2012-10-15 13:28 - 2012-10-15 13:28 - 00051200 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\plugins\audio_output\libwaveout_plugin.dll
2012-10-15 13:28 - 2012-10-15 13:28 - 00070144 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\plugins\video_output\libdirectx_plugin.dll
2013-09-28 18:13 - 2013-09-28 18:13 - 00040960 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\printsupport\windowsprintersupport.dll
2014-11-05 00:59 - 2014-11-05 00:59 - 00642048 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\InnerPlugin_Update.dll
2014-11-05 01:01 - 2014-11-05 01:01 - 00458752 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\InnerPlugin_WirelessExport.dll
2014-06-29 19:33 - 2014-06-29 19:33 - 00046080 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\WSetupApiPlugin.dll
2014-09-03 23:00 - 2014-09-03 23:00 - 00066560 _____ () C:\Program Files (x86)\NETGEAR Genie\bin\WSetupDll.dll
2014-12-15 12:18 - 2015-03-03 09:32 - 40630296 _____ () C:\Program Files (x86)\AVG Web TuneUp\libcef.dll
2014-04-04 23:49 - 2015-02-24 18:58 - 34641288 _____ () C:\Program Files (x86)\Steam\bin\libcef.dll
2015-03-03 09:32 - 2015-03-03 09:32 - 01794584 _____ () C:\Program Files (x86)\Common Files\AVG Secure Search\ScriptHelperInstaller\18.4.0\avgtbr.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\CBSWFP => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\svcinf => ""="service"

==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)

==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, the associated entry will be removed from the registry.)

IE trusted site: HKU\S-1-5-21-2247873678-407546785-3609120540-1001\…\rhapsody.com -> hxxps://rhap-app-4-0.rhapsody.com

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-2247873678-407546785-3609120540-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Goodwin\Pictures\Fall 2014\IMG_2116.JPG
HKU\S-1-5-21-2247873678-407546785-3609120540-1002\Control Panel\Desktop\\Wallpaper -> C:\Users\Gabrielle\Desktop\Gabrielle Images\Rainy Day Two.jpg
HKU\S-1-5-21-2247873678-407546785-3609120540-1003\Control Panel\Desktop\\Wallpaper -> C:\windows\web\wallpaper\HP\HP_Svinoya_Norway_Sunset.jpg
HKU\S-1-5-21-2247873678-407546785-3609120540-1004\Control Panel\Desktop\\Wallpaper -> C:\windows\web\wallpaper\HP\HP_Svinoya_Norway_Sunset.jpg
DNS Servers: 192.168.1.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-2247873678-407546785-3609120540-1001\…\StartupApproved\StartupFolder: => "Send to OneNote.lnk"

==================== Faulty Device Manager Devices =============

==================== Event log errors: =========================

Application errors:
==================
Error: (04/24/2015 03:56:32 PM) (Source: ATIeRecord) (EventID: 16386) (User: )
Description: ATI EEU Client has failed to start

Error: (04/24/2015 03:56:17 PM) (Source: ATIeRecord) (EventID: 16386) (User: )
Description: ATI EEU Client has failed to start

Error: (04/24/2015 03:56:02 PM) (Source: ATIeRecord) (EventID: 16386) (User: )
Description: ATI EEU Client has failed to start

Error: (04/24/2015 03:55:47 PM) (Source: ATIeRecord) (EventID: 16386) (User: )
Description: ATI EEU Client has failed to start

Error: (04/24/2015 03:55:32 PM) (Source: ATIeRecord) (EventID: 16386) (User: )
Description: ATI EEU Client has failed to start

Error: (04/24/2015 03:55:17 PM) (Source: ATIeRecord) (EventID: 16386) (User: )
Description: ATI EEU Client has failed to start

Error: (04/24/2015 03:55:02 PM) (Source: ATIeRecord) (EventID: 16386) (User: )
Description: ATI EEU Client has failed to start

Error: (04/24/2015 03:54:47 PM) (Source: ATIeRecord) (EventID: 16386) (User: )
Description: ATI EEU Client has failed to start

Error: (04/24/2015 03:54:32 PM) (Source: ATIeRecord) (EventID: 16386) (User: )
Description: ATI EEU Client has failed to start

Error: (04/24/2015 03:54:17 PM) (Source: ATIeRecord) (EventID: 16386) (User: )
Description: ATI EEU Client has failed to start

System errors:
=============
Error: (04/23/2015 02:31:30 PM) (Source: Schannel) (EventID: 4102) (User: NT AUTHORITY)
Description: A fatal error occurred when attempting to access the SSL server credential private key. The error code returned from the cryptographic module is 0x8009030d. The internal error state is 10001.

Error: (04/23/2015 09:26:50 AM) (Source: Schannel) (EventID: 4102) (User: NT AUTHORITY)
Description: A fatal error occurred when attempting to access the SSL server credential private key. The error code returned from the cryptographic module is 0x8009030d. The internal error state is 10001.

Error: (04/22/2015 10:46:54 AM) (Source: Schannel) (EventID: 4102) (User: NT AUTHORITY)
Description: A fatal error occurred when attempting to access the SSL server credential private key. The error code returned from the cryptographic module is 0x8009030d. The internal error state is 10001.

Error: (04/22/2015 10:44:20 AM) (Source: EventLog) (EventID: 6008) (User: )
Description: The previous system shutdown at 10:10:27 AM on ‎4/‎22/‎2015 was unexpected.

Error: (04/22/2015 04:23:25 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The NETGEARGenieDaemon service terminated unexpectedly. It has done this 1 time(s).

Error: (04/19/2015 01:16:21 PM) (Source: Schannel) (EventID: 4102) (User: NT AUTHORITY)
Description: A fatal error occurred when attempting to access the SSL server credential private key. The error code returned from the cryptographic module is 0x8009030d. The internal error state is 10001.

Error: (04/19/2015 01:13:39 PM) (Source: BugCheck) (EventID: 1001) (User: )
Description: 0x0000000a (0xfffffa80212b4178, 0x0000000000000002, 0x0000000000000001, 0xfffff80013524b6f)C:\windows\Minidump\041915-27924-01.dmp041915-27924-01

Error: (04/19/2015 01:13:38 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: The previous system shutdown at 1:25:59 AM on ‎4/‎19/‎2015 was unexpected.

Error: (04/19/2015 01:13:10 PM) (Source: Microsoft-Windows-Kernel-Boot) (EventID: 16) (User: NT AUTHORITY)
Description: 32212254733957120

Error: (04/18/2015 09:29:33 PM) (Source: Schannel) (EventID: 4102) (User: NT AUTHORITY)
Description: A fatal error occurred when attempting to access the SSL server credential private key. The error code returned from the cryptographic module is 0x8009030d. The internal error state is 10001.

Microsoft Office Sessions:
=========================
Error: (04/24/2015 03:56:32 PM) (Source: ATIeRecord) (EventID: 16386) (User: )
Description:

Error: (04/24/2015 03:56:17 PM) (Source: ATIeRecord) (EventID: 16386) (User: )
Description:

Error: (04/24/2015 03:56:02 PM) (Source: ATIeRecord) (EventID: 16386) (User: )
Description:

Error: (04/24/2015 03:55:47 PM) (Source: ATIeRecord) (EventID: 16386) (User: )
Description:

Error: (04/24/2015 03:55:32 PM) (Source: ATIeRecord) (EventID: 16386) (User: )
Description:

Error: (04/24/2015 03:55:17 PM) (Source: ATIeRecord) (EventID: 16386) (User: )
Description:

Error: (04/24/2015 03:55:02 PM) (Source: ATIeRecord) (EventID: 16386) (User: )
Description:

Error: (04/24/2015 03:54:47 PM) (Source: ATIeRecord) (EventID: 16386) (User: )
Description:

Error: (04/24/2015 03:54:32 PM) (Source: ATIeRecord) (EventID: 16386) (User: )
Description:

Error: (04/24/2015 03:54:17 PM) (Source: ATIeRecord) (EventID: 16386) (User: )
Description:

==================== Memory info ===========================

Processor: AMD A10-5700 APU with Radeon™ HD Graphics
Percentage of memory in use: 38%
Total physical RAM: 7575.3 MB
Available physical RAM: 4693.16 MB
Total Pagefile: 8263.3 MB
Available Pagefile: 4699.66 MB
Total Virtual: 8192 MB
Available Virtual: 8191.77 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:1850.69 GB) (Free:1704.34 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (Recovery Image) (Fixed) (Total:10.85 GB) (Free:1.32 GB) NTFS ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 1863 GB) (Disk ID: EDF89B76)

Partition: GPT Partition Type.

==================== End Of Log ============================

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 24-04-2015
Ran by [removed] (administrator) on GOODWINPC on 24-04-2015 15:55:29
Running from C:\Users\[removed]\Downloads
[removed] Platform: Windows 8 (X64) OS Language: English (United States)
Internet Explorer Version 10 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgrsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgcsrva.exe
() C:\Program Files (x86)\AVG Web TuneUp\WtuSystemSupport.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
(SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCore64.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe
(IVT Corporation) C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BlueSoleilCS.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgnsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgemca.exe
(iWin Inc.) C:\Program Files (x86)\iWin Games\iWinTrusted.exe
(NETGEAR) C:\Program Files (x86)\NETGEAR Genie\bin\NETGEARGenieDaemon64.exe
(AVG Secure Search) C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.4.0\ToolbarUpdater.exe
() C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.4.0\loggingserver.exe
(IVT Corporation) C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BsHelpCS.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.22.3\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.22.3\GoogleCrashHandler64.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Connected Remote\HPConnectedRemoteService.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe\LiveComm.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe
(NETGEAR Inc.) C:\Program Files (x86)\NETGEAR Genie\bin\NETGEARGenie.exe
(SUPERAntiSpyware) C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Keyboard\BATINDICATOR.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Keyboard\BATINDICATOR_HIDList.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgui.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
() C:\Program Files (x86)\AVG Web TuneUp\vprot.exe
(AVG Secure Search) C:\Program Files (x86)\AVG Web TuneUp\avgcefrend.exe
(Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
(Microsoft Corporation) C:\Windows\splwow64.exe
() C:\Program Files (x86)\NETGEAR Genie\bin\genie2_tray.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Microsoft Corporation) C:\Program Files (x86)\Internet Explorer\ielowutil.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgcsrva.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_17_0_0_169.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_17_0_0_169.exe

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\…\Run: [BeatsOSDApp] => C:\Program Files\IDT\WDM\beats64.exe [41664 2013-10-21] (Hewlett-Packard )
HKLM\…\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [1703424 2013-10-21] (IDT, Inc.)
HKLM-x32\…\Run: [StartCCC] => c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642728 2012-07-05] (Advanced Micro Devices, Inc.)
HKLM-x32\…\Run: [BATINDICATOR] => C:\Program Files (x86)\Hewlett-Packard\HP Keyboard\BATINDICATOR.exe [2068992 2011-12-14] (Hewlett-Packard)
HKLM-x32\…\Run: [BATINDICATORHL] => C:\Program Files (x86)\Hewlett-Packard\HP Keyboard\BATINDICATOR_HIDList.exe [557056 2010-07-23] (Hewlett-Packard)
HKLM-x32\…\Run: [OSDTool] => C:\Program Files (x86)\Hewlett-Packard\HP Keyboard\CNYHKEY.exe [2101248 2012-06-13] (Hewlett-Packard)
HKLM-x32\…\Run: [AVG_UI] => C:\Program Files (x86)\AVG\AVG2014\avgui.exe [5188112 2014-12-16] (AVG Technologies CZ, s.r.o.)
HKLM-x32\…\Run: [BtTray] => C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BtTray.exe [387832 2013-11-01] (IVT Corporation)
HKLM-x32\…\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard)
HKLM-x32\…\Run: [] => [X]
HKLM-x32\…\Run: [vProt] => C:\Program Files (x86)\AVG Web TuneUp\vprot.exe [3033112 2015-03-03] ()
HKU\S-1-5-21-2247873678-407546785-3609120540-1001\…\Run: [Steam] => C:\Program Files (x86)\Steam\Steam.exe [2889408 2015-04-13] (Valve Corporation)
HKU\S-1-5-21-2247873678-407546785-3609120540-1001\…\Run: [NETGEARGenie] => C:\Program Files (x86)\NETGEAR Genie\bin\NETGEARGenie.exe [602880 2014-11-06] (NETGEAR Inc.)
HKU\S-1-5-21-2247873678-407546785-3609120540-1001\…\Run: [PCKeeper2] => "C:\Program Files\Kromtech\PCKeeper\PCKeeper.exe" /autorun
HKU\S-1-5-21-2247873678-407546785-3609120540-1001\…\Run: [AVG-Secure-Search-Update_0215tb] => C:\Program Files (x86)\AVG Web TuneUp\AVG-Secure-Search-Update_0215tb.exe [2794520 2015-02-25] ()
HKU\S-1-5-21-2247873678-407546785-3609120540-1001\…\Run: [SUPERAntiSpyware] => C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [7806232 2015-03-25] (SUPERAntiSpyware)
HKU\S-1-5-21-2247873678-407546785-3609120540-1001\…\MountPoints2: {fd88e5da-e8e8-11e3-be9d-689423bdcec6} - "J:\AutoRun.exe"
HKU\S-1-5-21-2247873678-407546785-3609120540-1001\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\windows\system32\PhotoScreensaver.scr [593408 2012-07-25] (Microsoft Corporation)
HKU\S-1-5-21-2247873678-407546785-3609120540-1003\…\Run: [PCKeeper2] => "C:\Program Files\Kromtech\PCKeeper\PCKeeper.exe" /autorun
HKU\S-1-5-21-2247873678-407546785-3609120540-1004\…\Run: [PCKeeper2] => "C:\Program Files\Kromtech\PCKeeper\PCKeeper.exe" /autorun
AppInit_DLLs-x32: c:\progra~2\gssupp~1\assist~1.dll => "c:\progra~2\gssupp~1\assist~1.dll" File Not Found
Startup: C:\Users\Goodwin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Monitor Ink Alerts - HP Deskjet 2540 series.lnk [2015-01-23]
ShortcutTarget: Monitor Ink Alerts - HP Deskjet 2540 series.lnk -> C:\Program Files\HP\HP Deskjet 2540 series\Bin\HPStatusBL.dll (Hewlett-Packard Co.)
Startup: C:\Users\Goodwin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PowerReg Scheduler.exe [2013-07-03] ()
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/HPDSK13/1
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/HPDSK13/1
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/HPDSK13/1
HKU\S-1-5-21-2247873678-407546785-3609120540-1001\Software\Microsoft\Internet Explorer\Main,Start Page = https://mysearch.avg.com/?cid={8A1915EA-EAFD-4D4E-B3F9-355573EEF5E8}∣=943370b2cdd947d39dceb9dd65592735-bed90b2cf893da7edd93107e74d0b04c7115a0b5⟨=en&ds;=AVG&coid;=avgtbavg&cmpid;=≺=fr&d;=2014-12-1511:13:26&v;=4.1.0.411&pid;=wtu&sg;=&sap;=hp
HKU\S-1-5-21-2247873678-407546785-3609120540-1002\Software\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/HPDSK13/1
HKU\S-1-5-21-2247873678-407546785-3609120540-1002\Software\Microsoft\Internet Explorer\Main,First Home Page = http://g.msn.com/HPDSK13/1
HKU\S-1-5-21-2247873678-407546785-3609120540-1002\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/HPDSK13/1
HKU\S-1-5-21-2247873678-407546785-3609120540-1003\Software\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/HPDSK13/1
HKU\S-1-5-21-2247873678-407546785-3609120540-1003\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/HPDSK13/1
HKU\S-1-5-21-2247873678-407546785-3609120540-1004\Software\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/HPDSK13/1
HKU\S-1-5-21-2247873678-407546785-3609120540-1004\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/HPDSK13/1
URLSearchHook: [S-1-5-21-2247873678-407546785-3609120540-1002_classes] ATTENTION ==> Default URLSearchHook is missing.
URLSearchHook: [S-1-5-21-2247873678-407546785-3609120540-1003_classes] ATTENTION ==> Default URLSearchHook is missing.
URLSearchHook: [S-1-5-21-2247873678-407546785-3609120540-1004_classes] ATTENTION ==> Default URLSearchHook is missing.
SearchScopes: HKLM -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = http://search.ask.com/web?q={searchterms}&l;=dis&o;=HPDTDF
SearchScopes: HKLM -> {A210BAD6-1EFD-4F4C-B7AF-1718D54CC8AD} URL = http://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag;=hp-us1-vsb-20&link;%5Fcode=qs&index;=aps&field-keywords;={searchTerms}
SearchScopes: HKLM -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = http://search.yahoo.com/search?p={searchTerms}&ei;={inputEncoding}&fr;=chr-hp-psg&type;=HPDTDF
SearchScopes: HKLM -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.com/rover/1/711-154371-11896-2/4?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword;={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {BB82DE59-BC4C-4172-9AC4-73315F71CFFE} URL = http://websearch.coolsearches.info/?l=1&q;={searchTerms}&pid;=24375&r;=2015/04/05&hid;=11580261625207231028≶=EN&cc;=US&unqvl;=85
SearchScopes: HKLM-x32 -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = http://search.ask.com/web?q={searchterms}&l;=dis&o;=HPDTDF
SearchScopes: HKLM-x32 -> {A210BAD6-1EFD-4F4C-B7AF-1718D54CC8AD} URL = http://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag;=hp-us1-vsb-20&link;%5Fcode=qs&index;=aps&field-keywords;={searchTerms}
SearchScopes: HKLM-x32 -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = http://search.yahoo.com/search?p={searchTerms}&ei;={inputEncoding}&fr;=chr-hp-psg&type;=HPDTDF
SearchScopes: HKLM-x32 -> {BB82DE59-BC4C-4172-9AC4-73315F71CFFE} URL = http://websearch.coolsearches.info/?l=1&q;={searchTerms}&pid;=24375&r;=2015/04/05&hid;=11580261625207231028≶=EN&cc;=US&unqvl;=85
SearchScopes: HKLM-x32 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.com/rover/1/711-154371-11896-2/4?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword;={searchTerms}
SearchScopes: HKU\S-1-5-21-2247873678-407546785-3609120540-1001 -> DefaultScope {95B7759C-8C7F-4BF1-B163-73684A933233} URL = https://mysearch.avg.com/search?cid={8A1915EA-EAFD-4D4E-B3F9-355573EEF5E8}∣=943370b2cdd947d39dceb9dd65592735-bed90b2cf893da7edd93107e74d0b04c7115a0b5⟨=en&ds;=AVG&coid;=avgtbavg&cmpid;=≺=fr&d;=2014-12-1511:13:26&v;=4.1.0.411&pid;=wtu&sg;=&sap;=dsp&q;={searchTerms}
SearchScopes: HKU\S-1-5-21-2247873678-407546785-3609120540-1001 -> {02D7B29A-37A4-4EE1-9335-1412FB70FA1F} URL = http://search.findwide.com/serp?guid={596259CD-BACA-4776-9B42-4E8021D67F4E}&k;={searchTerms}
SearchScopes: HKU\S-1-5-21-2247873678-407546785-3609120540-1001 -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = http://search.ask.com/web?q={searchterms}&l;=dis&o;=HPDTDF
SearchScopes: HKU\S-1-5-21-2247873678-407546785-3609120540-1001 -> {64800F42-8D73-4AA4-A732-5402AE691582} URL = http://search.yahoo.com/search?p={searchTerms}&fr;=tightropetb&type;=11083
SearchScopes: HKU\S-1-5-21-2247873678-407546785-3609120540-1001 -> {8DF8537F-918F-4FD6-9D5A-072FAD5D7380} URL = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource;=4&ctid;=CT3298573&CUI;=UN13063974532427279&UM;=2
SearchScopes: HKU\S-1-5-21-2247873678-407546785-3609120540-1001 -> {95B7759C-8C7F-4BF1-B163-73684A933233} URL = https://mysearch.avg.com/search?cid={8A1915EA-EAFD-4D4E-B3F9-355573EEF5E8}∣=943370b2cdd947d39dceb9dd65592735-bed90b2cf893da7edd93107e74d0b04c7115a0b5⟨=en&ds;=AVG&coid;=avgtbavg&cmpid;=≺=fr&d;=2014-12-1511:13:26&v;=4.1.0.411&pid;=wtu&sg;=&sap;=dsp&q;={searchTerms}
SearchScopes: HKU\S-1-5-21-2247873678-407546785-3609120540-1001 -> {A210BAD6-1EFD-4F4C-B7AF-1718D54CC8AD} URL = http://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag;=hp-us1-vsb-20&link;%5Fcode=qs&index;=aps&field-keywords;={searchTerms}
SearchScopes: HKU\S-1-5-21-2247873678-407546785-3609120540-1001 -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = http://us.yhs4.search.yahoo.com/yhs/search?p={searchTerms}&ei;=UTF-8&hspart;=w3i&hsimp;=yhs-synd1&type;=W3i_DS,221,0_0,Search,20130625,0,0,6,7635
SearchScopes: HKU\S-1-5-21-2247873678-407546785-3609120540-1001 -> {BB82DE59-BC4C-4172-9AC4-73315F71CFFE} URL = http://websearch.coolsearches.info/?l=1&q;={searchTerms}&pid;=24375&r;=2015/04/05&hid;=11580261625207231028≶=EN&cc;=US&unqvl;=85
SearchScopes: HKU\S-1-5-21-2247873678-407546785-3609120540-1001 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.com/rover/1/711-154371-11896-2/4?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword;={searchTerms}
SearchScopes: HKU\S-1-5-21-2247873678-407546785-3609120540-1002 -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = http://search.ask.com/web?q={searchterms}&l;=dis&o;=HPDTDF
SearchScopes: HKU\S-1-5-21-2247873678-407546785-3609120540-1002 -> {A210BAD6-1EFD-4F4C-B7AF-1718D54CC8AD} URL = http://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag;=hp-us1-vsb-20&link;%5Fcode=qs&index;=aps&field-keywords;={searchTerms}
SearchScopes: HKU\S-1-5-21-2247873678-407546785-3609120540-1002 -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = http://search.yahoo.com/search?p={searchTerms}&ei;={inputEncoding}&fr;=chr-hp-psg&type;=HPDTDF
SearchScopes: HKU\S-1-5-21-2247873678-407546785-3609120540-1002 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.com/rover/1/711-154371-11896-2/4?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword;={searchTerms}
SearchScopes: HKU\S-1-5-21-2247873678-407546785-3609120540-1003 -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = http://search.ask.com/web?q={searchterms}&l;=dis&o;=HPDTDF
SearchScopes: HKU\S-1-5-21-2247873678-407546785-3609120540-1003 -> {A210BAD6-1EFD-4F4C-B7AF-1718D54CC8AD} URL = http://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag;=hp-us1-vsb-20&link;%5Fcode=qs&index;=aps&field-keywords;={searchTerms}
SearchScopes: HKU\S-1-5-21-2247873678-407546785-3609120540-1003 -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = http://search.yahoo.com/search?p={searchTerms}&ei;={inputEncoding}&fr;=chr-hp-psg&type;=HPDTDF
SearchScopes: HKU\S-1-5-21-2247873678-407546785-3609120540-1003 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.com/rover/1/711-154371-11896-2/4?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword;={searchTerms}
SearchScopes: HKU\S-1-5-21-2247873678-407546785-3609120540-1004 -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = http://search.ask.com/web?q={searchterms}&l;=dis&o;=HPDTDF
SearchScopes: HKU\S-1-5-21-2247873678-407546785-3609120540-1004 -> {A210BAD6-1EFD-4F4C-B7AF-1718D54CC8AD} URL = http://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag;=hp-us1-vsb-20&link;%5Fcode=qs&index;=aps&field-keywords;={searchTerms}
SearchScopes: HKU\S-1-5-21-2247873678-407546785-3609120540-1004 -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = http://search.yahoo.com/search?p={searchTerms}&ei;={inputEncoding}&fr;=chr-hp-psg&type;=HPDTDF
SearchScopes: HKU\S-1-5-21-2247873678-407546785-3609120540-1004 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.com/rover/1/711-154371-11896-2/4?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword;={searchTerms}
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2015-02-10] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2015-02-10] (Microsoft Corporation)
BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll [2013-08-28] (Hewlett-Packard)
BHO-x32: No Name -> {02478D38-C3F9-4efb-9B51-7695ECA05670} -> No File
BHO-x32: DownloadTerms -> {2C4BA31C-0C15-11E2-90C7-9BFCBEB168B3} -> C:\Users\Goodwin\AppData\Local\DownloadTerms\temp.dat [2013-03-20] ()
BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2013-12-18] (Oracle Corporation)
BHO-x32: AVG Web TuneUp -> {95B7759C-8C7F-4BF1-B163-73684A933233} -> C:\Program Files (x86)\AVG Web TuneUp\4.1.0.411\AVG Web TuneUp.dll [2015-03-03] (AVG)
BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2013-12-18] (Oracle Corporation)
BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll [2013-08-28] (Hewlett-Packard)
Toolbar: HKLM - FindWide Toolbar - {50455C37-81A6-4986-86CC-A5175EDBE3A8} - C:\Program Files (x86)\TNT2\2.0.0.1976\IEToolbar64.dll No File
Toolbar: HKLM-x32 - FindWide Toolbar - {50455C37-81A6-4986-86CC-A5175EDBE3A8} - C:\Program Files (x86)\TNT2\2.0.0.1976\ietoolbar.dll No File
Toolbar: HKU\S-1-5-21-2247873678-407546785-3609120540-1001 -> No Name - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No File
Toolbar: HKU\S-1-5-21-2247873678-407546785-3609120540-1001 -> FindWide Toolbar - {50455C37-81A6-4986-86CC-A5175EDBE3A8} - C:\Program Files (x86)\TNT2\2.0.0.1976\IEToolbar64.dll No File
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2015-02-03] (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\windows\SysWow64\skype4com.dll [2013-11-01] (Skype Technologies)
Handler-x32: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\18.2.0\ViProtocol.dll [2014-12-15] (AVG Secure Search)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\Goodwin\AppData\Roaming\Mozilla\Firefox\Profiles\rwhwkby3.default
FF DefaultSearchEngine: Yahoo:
FF DefaultSearchEngine,S: WebSearch
FF DefaultSearchEngine.US: Google
FF SearchEngineOrder.1: WebSearch
FF SearchEngineOrder.1,S: WebSearch
FF SelectedSearchEngine: Yahoo:
FF SelectedSearchEngine,S: WebSearch
FF Homepage: hxxp://services.freshy.com/general/newhometab.php?hometab=home&partner;=11083&guid;={596259CD-BACA-4776-9B42-4E8021D67F4E}&i;=
FF Keyword.URL: hxxp://search.findwide.com/serp?guid={596259CD-BACA-4776-9B42-4E8021D67F4E}&k;=
FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF64_17_0_0_169.dll [2015-04-14] ()
FF Plugin: @java.com/DTPlugin,version=10.40.2 -> C:\windows\system32\npDeployJava1.dll [2013-09-29] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_169.dll [2015-04-14] ()
FF Plugin-x32: @avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin -> C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\18.4.0\\npsitesafety.dll No File
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2013-10-07] (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll [2013-12-18] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll [2013-12-18] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2013-07-11] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll [2013-12-06] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll [2013-12-06] (Google Inc.)
FF Plugin HKU\S-1-5-21-2247873678-407546785-3609120540-1001: @nsroblox.roblox.com/launcher -> C:\Users\Goodwin\AppData\Local\Roblox\Versions\version-1cfeb951d6084e36\\NPRobloxProxy.dll [2013-01-01] ( ROBLOX Corporation)
FF Plugin HKU\S-1-5-21-2247873678-407546785-3609120540-1001: @nsroblox.roblox.com/launcher64 -> C:\Users\Goodwin\AppData\Local\Roblox\Versions\version-1cfeb951d6084e36\\NPRobloxProxy64.dll [2013-01-01] ( ROBLOX Corporation)
FF Plugin HKU\S-1-5-21-2247873678-407546785-3609120540-1001: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Goodwin\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2013-07-20] (Unity Technologies ApS)
FF Plugin HKU\S-1-5-21-2247873678-407546785-3609120540-1003: @nsroblox.roblox.com/launcher -> C:\Users\Grey\AppData\Local\Roblox\Versions\version-dd7ca4fae8d24153\\NPRobloxProxy.dll [2013-01-01] ( ROBLOX Corporation)
FF user.js: detected! => C:\Users\Goodwin\AppData\Roaming\Mozilla\Firefox\Profiles\rwhwkby3.default\user.js [2015-04-14]
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll [2007-04-10] (Microsoft Corporation)
FF SearchPlugin: C:\Users\Goodwin\AppData\Roaming\Mozilla\Firefox\Profiles\rwhwkby3.default\searchplugins\avg-secure-search.xml [2015-03-03]
FF SearchPlugin: C:\Users\Goodwin\AppData\Roaming\Mozilla\Firefox\Profiles\rwhwkby3.default\searchplugins\yahoo-1.xml [2015-04-19]
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\safeguard-secure-search.xml [2014-08-26]
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\wtu-secure-search.xml [2015-03-03]
FF Extension: AVG Web TuneUp - C:\Users\Goodwin\AppData\Roaming\Mozilla\Firefox\Profiles\rwhwkby3.default\Extensions\avg@toolbar [2014-12-15]
FF Extension: Adblock Plus Pop-up Addon - C:\Users\Goodwin\AppData\Roaming\Mozilla\Firefox\Profiles\rwhwkby3.default\Extensions\[removed] [2015-04-22]
FF Extension: CrushArcade - C:\Users\Goodwin\AppData\Roaming\Mozilla\Firefox\Profiles\rwhwkby3.default\Extensions\{cf8452e1-0ddb-44d2-95eb-4cb8e7a35707}.xpi [2015-04-21]
FF Extension: Adblock Plus - C:\Users\Goodwin\AppData\Roaming\Mozilla\Firefox\Profiles\rwhwkby3.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2015-04-22]
FF ExtraCheck: C:\Program Files (x86)\mozilla firefox\firefox.cfg [2015-04-06] <==== ATTENTION

Chrome:
=======
CHR Profile: C:\Users\Goodwin\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (safe save) - C:\Users\Goodwin\AppData\Local\Google\Chrome\User Data\Default\Extensions\hnmphaciaonoedmeffcjbedblhedgjai [2013-07-20]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [172344 2014-07-22] (SUPERAntiSpyware.com)
R2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe [3247120 2014-12-16] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe [289328 2014-12-16] (AVG Technologies CZ, s.r.o.)
R2 BlueSoleilCS; C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BlueSoleilCS.exe [1706744 2013-11-01] (IVT Corporation)
R3 BsHelpCS; C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BsHelpCS.exe [145656 2013-11-01] (IVT Corporation)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2714800 2015-02-10] (Microsoft Corporation)
R2 HP Support Assistant Service; C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [92160 2013-11-04] (Hewlett-Packard Company) [File not signed]
R2 HPConnectedRemote; c:\Program Files (x86)\Hewlett-Packard\HP Connected Remote\HPConnectedRemoteService.exe [35232 2012-08-29] (Hewlett-Packard)
R2 NETGEARGenieDaemon; C:\Program Files (x86)\NETGEAR Genie\bin\NETGEARGenieDaemon64.exe [232192 2014-11-06] (NETGEAR)
R2 STacSV; C:\Program Files\IDT\WDM\STacSV64.exe [333824 2013-10-21] (IDT, Inc.) [File not signed]
R2 vToolbarUpdater18.4.0; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.4.0\ToolbarUpdater.exe [1875480 2015-03-03] (AVG Secure Search)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16024 2015-01-31] (Microsoft Corporation)
R2 WtuSystemSupport; C:\Program Files (x86)\AVG Web TuneUp\WtuSystemSupport.exe [620056 2015-03-03] ()

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S0 Avgboota; C:\Windows\System32\DRIVERS\avgboota.sys [20496 2013-09-04] (AVG Technologies CZ, s.r.o.)
R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [152344 2014-06-30] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [244504 2014-07-21] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [190744 2014-06-17] (AVG Technologies CZ, s.r.o.)
R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [237848 2014-10-24] (AVG Technologies CZ, s.r.o.)
R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [328984 2014-06-17] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [123672 2014-10-29] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [31512 2014-06-17] (AVG Technologies CZ, s.r.o.)
R1 Avgwfpa; C:\Windows\system32\DRIVERS\avgwfpa.sys [270104 2014-06-30] (AVG Technologies CZ, s.r.o.)
U5 BlueletAudio; C:\Windows\System32\Drivers\BlueletAudio.sys [33968 2012-12-19] (IVT Corporation)
R3 BtAudioBusSrv; C:\Windows\System32\Drivers\BtAudioBus.sys [23136 2012-06-15] (IVT Corporation)
U4 BthAvrcpTg; No ImagePath
U4 BthHFEnum; No ImagePath
U4 bthhfhid; No ImagePath
R3 BthL2caScoIfSrv; C:\Windows\System32\Drivers\BtL2caScoIf.sys [54064 2013-04-26] (Ralink Corporation)
R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [202752 2012-07-25] (Microsoft Corporation)
R3 btUrbFilterDrv; C:\Windows\System32\Drivers\IvtUrbBtFlt.sys [49584 2013-03-25] (Ralink Corporation)
S3 CpqDfw; C:\Windows\System32\drivers\CpqDfw.sys [27456 2012-05-29] (Windows (R) Codename Longhorn DDK provider)
S3 MBAMSwissArmy; C:\windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-04-22] (Malwarebytes Corporation)
R2 NPF; C:\windows\system32\drivers\npf.sys [35344 2014-11-20] (CACE Technologies, Inc.)
R3 rtbth; C:\Windows\System32\drivers\rtbth.sys [1204424 2013-12-02] (Ralink Technology, Corp.)
R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
U5 BlueletAudio; C:\Windows\SysWOW64\Drivers\BlueletAudio.sys [33968 2012-12-19] (IVT Corporation)
S3 cqcpu; system32\drivers\cqcpu.sys [X]
S3 TCFilter; system32\drivers\tcfilter.sys [X]
U3 aswMBR; \??\C:\Users\Goodwin\AppData\Local\Temp\aswMBR.sys [X]
U3 aswVmm; \??\C:\Users\Goodwin\AppData\Local\Temp\aswVmm.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)

==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-24 15:55 - 2015-04-24 15:55 - 00030008 _____ () C:\Users\Goodwin\Downloads\FRST.txt
2015-04-24 15:55 - 2015-04-24 15:55 - 00000000 ____D () C:\FRST
2015-04-24 15:54 - 2015-04-24 15:54 - 02099712 _____ (Farbar) C:\Users\Goodwin\Downloads\FRST64.exe
2015-04-23 16:13 - 2015-04-23 16:13 - 00003884 _____ () C:\Users\Goodwin\Desktop\aswMBR.txt
2015-04-23 16:13 - 2015-04-23 16:13 - 00000512 _____ () C:\Users\Goodwin\Desktop\MBR.dat
2015-04-23 15:01 - 2015-04-23 15:02 - 05198336 _____ (AVAST Software) C:\Users\Goodwin\Downloads\aswMBR.exe
2015-04-23 09:28 - 2015-04-23 09:28 - 00000000 ____D () C:\SUPERDelete
2015-04-23 09:26 - 2015-04-24 15:53 - 00000000 ____D () C:\Program Files\SUPERAntiSpyware
2015-04-23 09:26 - 2015-04-23 09:26 - 00001810 _____ () C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
2015-04-23 09:26 - 2015-04-23 09:26 - 00000000 ____D () C:\Users\Goodwin\AppData\Roaming\SUPERAntiSpyware.com
2015-04-23 09:26 - 2015-04-23 09:26 - 00000000 ____D () C:\ProgramData\SUPERAntiSpyware.com
2015-04-23 09:26 - 2015-04-23 09:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware
2015-04-23 09:19 - 2015-04-23 09:20 - 21718656 _____ (SUPERAntiSpyware) C:\Users\Goodwin\Downloads\SUPERAntiSpyware.exe
2015-04-23 07:02 - 2015-04-23 07:02 - 00000000 _____ () C:\autoexec.bat
2015-04-23 06:58 - 2015-04-23 06:59 - 03109248 _____ (Enigma Software Group USA, LLC.) C:\Users\Goodwin\Downloads\SpyHunter-Installer.exe
2015-04-18 15:33 - 2015-04-18 15:33 - 00012872 _____ () C:\Users\Goodwin\Desktop\Gabrielle's summer reading 2015.odt
2015-04-18 15:27 - 2015-04-18 15:27 - 00015060 _____ () C:\Users\Goodwin\Desktop\Grey's Summer Reading 2015.odt
2015-04-18 15:21 - 2015-04-18 15:32 - 00013696 _____ () C:\Users\Goodwin\Desktop\Moo's Summer Reading 2015.odt
2015-04-18 15:11 - 2015-04-18 15:11 - 00016814 _____ () C:\Users\Goodwin\Desktop\Summer Classic Movies.ods
2015-04-17 15:15 - 2015-04-17 15:15 - 00497216 _____ () C:\windows\system32\FNTCACHE.DAT
2015-04-14 23:49 - 2015-04-14 23:49 - 00019310 _____ () C:\Users\Goodwin\Desktop\Superivision Report form for Deon Goodwin 4-12-2015.odt
2015-04-14 22:56 - 2015-04-14 22:56 - 00003436 _____ () C:\windows\System32\Tasks\NetEngine
2015-04-14 22:56 - 2015-04-14 22:56 - 00000000 ____D () C:\ProgramData\Radio
2015-04-14 22:56 - 2015-04-14 22:56 - 00000000 ____D () C:\ProgramData\NetEngine
2015-04-14 17:11 - 2015-04-14 22:56 - 00000000 ____D () C:\ProgramData\T122078ED
2015-04-14 17:06 - 2015-04-22 10:37 - 00000000 ____D () C:\Program Files (x86)\TNT2
2015-04-14 17:06 - 2015-04-19 00:17 - 00000000 ____D () C:\Users\Goodwin\AppData\Local\CrimeWatch
2015-04-14 17:06 - 2015-04-19 00:17 - 00000000 ____D () C:\ProgramData\CrimeWatch
2015-04-14 17:06 - 2015-04-14 23:43 - 00000000 ____D () C:\ProgramData\BJjoVxLmenb
2015-04-14 17:06 - 2015-04-14 17:06 - 00000000 ____D () C:\Users\Goodwin\AppData\Local\TNT2
2015-04-14 13:09 - 2015-03-17 00:00 - 06971712 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe
2015-04-14 13:09 - 2015-03-16 23:52 - 01822696 _____ (Microsoft Corporation) C:\windows\system32\ntdll.dll
2015-04-14 13:09 - 2015-02-24 00:58 - 00861696 _____ (Microsoft Corporation) C:\windows\system32\Drivers\http.sys
2015-04-14 13:08 - 2015-03-16 21:45 - 01409496 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntdll.dll
2015-04-14 13:01 - 2015-03-09 22:27 - 19292672 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2015-04-14 13:01 - 2015-03-04 00:29 - 00361280 _____ (Microsoft Corporation) C:\windows\system32\Drivers\clfs.sys
2015-04-14 13:01 - 2015-03-03 23:39 - 00074752 _____ (Microsoft Corporation) C:\windows\system32\clfsw32.dll
2015-04-14 13:01 - 2015-03-03 21:52 - 00057856 _____ (Microsoft Corporation) C:\windows\SysWOW64\clfsw32.dll
2015-04-14 13:00 - 2015-03-09 22:28 - 02237952 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2015-04-14 13:00 - 2015-03-09 22:28 - 01409024 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2015-04-14 13:00 - 2015-03-09 22:28 - 00600576 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll
2015-04-14 13:00 - 2015-03-09 22:27 - 15409152 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2015-04-14 13:00 - 2015-03-09 22:27 - 03959296 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2015-04-14 13:00 - 2015-03-09 22:27 - 00949760 _____ (Microsoft Corporation) C:\windows\system32\inetcomm.dll
2015-04-14 13:00 - 2015-03-09 22:27 - 00855552 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll
2015-04-14 13:00 - 2015-03-09 22:27 - 00603136 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2015-04-14 13:00 - 2015-03-09 20:49 - 14373376 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2015-04-14 13:00 - 2015-03-09 20:49 - 02864640 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2015-04-14 13:00 - 2015-03-09 20:49 - 01763328 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2015-04-14 13:00 - 2015-03-09 20:49 - 01181696 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2015-04-14 13:00 - 2015-03-09 20:49 - 00737280 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcomm.dll
2015-04-14 13:00 - 2015-03-09 20:49 - 00690688 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll
2015-04-14 13:00 - 2015-03-09 20:49 - 00523776 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll
2015-04-14 13:00 - 2015-03-09 20:49 - 00493056 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2015-04-14 13:00 - 2015-03-09 20:48 - 13767680 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2015-04-12 12:51 - 2015-04-12 12:51 - 00000000 ____D () C:\Users\Goodwin\AppData\Roaming\java
2015-04-11 01:01 - 2015-04-12 12:50 - 00000000 ____D () C:\Program Files (x86)\Minecraft
2015-04-11 01:01 - 2015-04-11 01:01 - 02314240 _____ () C:\Users\Goodwin\Downloads\MinecraftInstaller.msi
2015-04-11 01:01 - 2015-04-11 01:01 - 00000923 _____ () C:\Users\Public\Desktop\Minecraft.lnk
2015-04-11 01:01 - 2015-04-11 01:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Minecraft
2015-04-07 16:54 - 2015-04-14 12:53 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2015-04-06 08:47 - 2015-04-06 08:47 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-04-04 22:04 - 2015-04-05 09:01 - 00000000 ____D () C:\ProgramData\{8f1297ea-4105-7266-8f12-297ea4105fa9}

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-24 15:55 - 2015-02-25 20:02 - 00002738 _____ () C:\windows\System32\Tasks\0215tb_RML
2015-04-24 15:55 - 2015-02-25 20:02 - 00000374 _____ () C:\windows\Tasks\0215tb_RML.job
2015-04-24 15:55 - 2012-07-26 01:12 - 00000000 ____D () C:\windows\system32\sru
2015-04-24 15:53 - 2014-02-10 19:53 - 00000272 _____ () C:\windows\SysWOW64\LOCALSERVICE.INI
2015-04-24 15:53 - 2014-02-10 19:53 - 00000043 _____ () C:\windows\SysWOW64\LOCALDEVICE.INI
2015-04-24 15:53 - 2013-11-20 11:44 - 00001060 _____ () C:\windows\SysWOW64\bscs.ini
2015-04-24 11:27 - 2013-06-28 01:07 - 00000830 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2015-04-24 10:52 - 2013-08-02 07:36 - 00000920 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-04-24 10:44 - 2013-06-22 23:00 - 00000000 ____D () C:\ProgramData\MFAData
2015-04-24 10:42 - 2012-07-26 00:28 - 00876558 _____ () C:\windows\system32\PerfStringBackup.INI
2015-04-24 00:46 - 2014-03-24 19:01 - 00003178 _____ () C:\windows\System32\Tasks\HPCeeScheduleForGoodwin
2015-04-24 00:46 - 2014-03-24 19:01 - 00000360 _____ () C:\windows\Tasks\HPCeeScheduleForGoodwin.job
2015-04-24 00:46 - 2013-06-15 21:37 - 00000000 ____D () C:\Users\Goodwin
2015-04-23 23:34 - 2013-06-15 21:39 - 00003938 _____ () C:\windows\System32\Tasks\User_Feed_Synchronization-{88775236-30DB-4E0B-9B77-3E30665BA9EC}
2015-04-23 23:32 - 2014-04-04 23:45 - 00000000 ____D () C:\Program Files (x86)\Steam
2015-04-23 19:59 - 2013-11-29 20:59 - 00000000 ____D () C:\Users\Goodwin\AppData\Local\NETGEARGenie
2015-04-23 17:52 - 2013-08-02 07:36 - 00000916 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-04-23 14:36 - 2014-03-21 17:31 - 00000000 ____D () C:\Users\Goodwin\AppData\Local\CrashDumps
2015-04-23 14:29 - 2012-07-26 00:22 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2015-04-23 14:28 - 2012-08-01 19:02 - 01316450 _____ () C:\windows\PFRO.log
2015-04-23 14:28 - 2012-07-25 22:26 - 00786432 ___SH () C:\windows\system32\config\BBI
2015-04-23 09:28 - 2013-09-28 16:20 - 00000000 ____D () C:\Users\Goodwin\AppData\Local\Conduit
2015-04-22 19:10 - 2013-07-13 15:20 - 00000000 ____D () C:\Users\Goodwin\AppData\Roaming\.minecraft
2015-04-22 10:13 - 2014-05-19 11:32 - 00129752 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2015-04-21 00:29 - 2014-12-25 17:02 - 00000000 ____D () C:\Users\Goodwin\AppData\Roaming\Talisman
2015-04-20 18:17 - 2013-06-27 22:58 - 00000052 _____ () C:\windows\SysWOW64\DOErrors.log
2015-04-20 16:41 - 2015-03-11 20:38 - 00017262 _____ () C:\Users\Goodwin\Desktop\LEWIS AND CLARK 2015 cast.odt
2015-04-19 20:58 - 2013-06-15 21:45 - 00003598 _____ () C:\windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2247873678-407546785-3609120540-1001
2015-04-19 20:39 - 2013-06-16 22:39 - 00000000 ___RD () C:\Users\Goodwin\Desktop\Gabrielle's stuff
2015-04-19 13:13 - 2014-11-28 10:56 - 00000000 ____D () C:\windows\Minidump
2015-04-19 13:13 - 2013-05-08 14:18 - 00126739 ____N () C:\windows\Minidump\041915-27924-01.dmp
2015-04-19 00:17 - 2013-07-13 15:18 - 00000000 ____D () C:\Program Files (x86)\MyPC Backup
2015-04-18 21:25 - 2013-05-08 14:18 - 00138643 ____N () C:\windows\Minidump\041815-42791-01.dmp
2015-04-18 19:05 - 2013-06-15 21:37 - 02025126 _____ () C:\windows\WindowsUpdate.log
2015-04-18 07:20 - 2014-01-11 17:58 - 00000000 ____D () C:\Users\Goodwin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Roblox
2015-04-18 07:15 - 2012-07-26 00:21 - 01400384 _____ () C:\windows\setupact.log
2015-04-17 22:10 - 2012-07-26 01:12 - 00000000 ____D () C:\windows\rescache
2015-04-17 15:21 - 2012-07-25 22:26 - 00262144 ___SH () C:\windows\system32\config\ELAM
2015-04-17 15:14 - 2013-06-27 23:01 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-04-16 01:42 - 2012-07-26 00:59 - 00000000 ____D () C:\windows\CbsTemp
2015-04-14 23:43 - 2014-05-08 09:51 - 00000000 ____D () C:\ProgramData\AVG2014
2015-04-14 23:42 - 2014-05-08 09:42 - 00000000 ____D () C:\Users\Goodwin\AppData\Local\Avg2014
2015-04-14 14:00 - 2013-08-14 20:42 - 00000000 ____D () C:\windows\system32\MRT
2015-04-14 13:53 - 2013-06-29 12:39 - 128913832 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2015-04-14 13:27 - 2013-06-28 01:07 - 00003718 _____ () C:\windows\System32\Tasks\Adobe Flash Player Updater
2015-04-13 15:07 - 2014-10-18 14:09 - 00791520 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2015-04-13 15:07 - 2014-10-18 14:09 - 00177632 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-03-26 14:40 - 2013-07-03 09:38 - 00000000 ____D () C:\Users\Goodwin\Desktop\Grey's Stuff

==================== Files in the root of some directories =======

2014-05-09 17:30 - 2014-06-02 16:58 - 0000000 _____ () C:\Program Files (x86)\Mozilla Firefoxsafeguard-secure-search.xml
2013-12-06 19:02 - 2013-12-06 19:02 - 0005120 _____ () C:\Users\Goodwin\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-11-04 01:22 - 2014-11-04 01:22 - 0000017 _____ () C:\Users\Goodwin\AppData\Local\resmon.resmoncfg
2014-02-20 16:35 - 2014-02-20 16:35 - 0000057 _____ () C:\ProgramData\Ament.ini
2013-06-15 21:38 - 2013-06-15 21:38 - 0000141 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.351.64.bc

Some content of TEMP:
====================
C:\Users\Goodwin\AppData\Local\Temp\2D62_avg_free_stb_all_2013_2899.exe
C:\Users\Goodwin\AppData\Local\Temp\air771F.exe
C:\Users\Goodwin\AppData\Local\Temp\CertificatesDLL.dll
C:\Users\Goodwin\AppData\Local\Temp\comver.dll
C:\Users\Goodwin\AppData\Local\Temp\dgrn.exe
C:\Users\Goodwin\AppData\Local\Temp\Extract.exe
C:\Users\Goodwin\AppData\Local\Temp\HPHelpUpdater.exe
C:\Users\Goodwin\AppData\Local\Temp\HPInstaller.exe
C:\Users\Goodwin\AppData\Local\Temp\HPPSdr.exe
C:\Users\Goodwin\AppData\Local\Temp\MouseKeyboardCenterx64_1033.exe
C:\Users\Goodwin\AppData\Local\Temp\OfficeSetup.exe
C:\Users\Goodwin\AppData\Local\Temp\oi_{E6E2A0D8-0171-49E1-88F1-3C386E4B7FC4}.exe
C:\Users\Goodwin\AppData\Local\Temp\Resource.exe
C:\Users\Goodwin\AppData\Local\Temp\sp58915.exe
C:\Users\Goodwin\AppData\Local\Temp\SP59485.exe
C:\Users\Goodwin\AppData\Local\Temp\SP62736.exe
C:\Users\Goodwin\AppData\Local\Temp\SP62764.exe
C:\Users\Goodwin\AppData\Local\Temp\SP63146.exe
C:\Users\Goodwin\AppData\Local\Temp\sp64126.exe
C:\Users\Goodwin\AppData\Local\Temp\SP65050.exe
C:\Users\Goodwin\AppData\Local\Temp\SP65052.exe
C:\Users\Goodwin\AppData\Local\Temp\UNINSTALL.EXE
C:\Users\Goodwin\AppData\Local\Temp\UninstallHPSA.exe
C:\Users\Goodwin\AppData\Local\Temp\vcredist_x64.exe
C:\Users\Goodwin\AppData\Local\Temp\WiseUpdX.exe
C:\Users\Goodwin\AppData\Local\Temp\_isB02.exe

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2015-04-22 03:00

==================== End Of Log ============================

ken545

Post #4April 24, 2015, 11:21 PM UTC

Did you purchase this program, you may want to rethink it if you did not

http://www.2-spyware.com/remove-pckeeper.html

These to I would go into Programs and Features in the Control Panel and uninstall them

Download Updater (AOL Inc.) (HKLM-x32\…\SoftwareUpdUtility) (Version: - AOL Inc.) <==== ATTENTION

DownloadTerms (HKU\S-1-5-21-2247873678-407546785-3609120540-1001\…\DownloadTerms) (Version: 1.0 - Unlimited Downloads, LLC) <==== ATTENTION

-AdwCleaner-by Xplode

Click on this link to download : ADWCleaner To your Desktop

Click on ONE of the Two Blue Download Now buttons That have a blue arrow beside them and save it to your desktop.

Use my link only, do not do a search for AdwCleaner as there is a bogus copy going around by scammers

Do not click on any links in the top Advertisment.

[external image: AdwCleaner4.201_zpsxrbk2llq.jpg]

Close all open programs and internet browsers.

Double click on AdwCleaner.exe to run the tool.

Click on Scan.

After the scan is complete click on "Clean"

Confirm each time with Ok.

Your computer will be rebooted automatically. A text file will open after the restart.

Please post the content of that logfile with your next reply.

You can find the logfile at C:\AdwCleaner[S1].txt as well.

===============================================================================

[external image: thisisujrt.gif] Please download Junkware Removal Tool to your desktop.

Shut down your protection software now to avoid potential conflicts.

Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".

The tool will open and start scanning your system.

Please be patient as this can take a while to complete depending on your system's specifications.

On completion, a log (JRT.txt) is saved to your desktop and will automatically open.

Post the contents of JRT.txt into your next message.

===============================================================================

Download Malwarebytes' Anti-Malware to your desktop. <———

Windows XP : Double click on the icon to run it.

Windows Vista, Windows 7 & 8 : Right click and select "Run as Administrator"

[external image: MBAM2010601022_zpsyvzbaddn.jpg]

On the Dashboard click on Update Now

Go to the Setting Tab

Under Setting go to Detection and Protection

Under PUP and PUM make sure both are set to show Treat Detections as Malware

Go to Advanced setting and make sure Automatically Quarantine Detected Items is checked

Then on the Dashboard click on Scan

Make sure to select THREAT SCAN

Then click on Scan

When the scan is finished and the log pops up…select Copy to Clipboard

Please paste the log back into this thread for review

Exit Malwarebytes

Clstlg

Post #5April 24, 2015, 11:48 PM UTC

# AdwCleaner v4.202 - Logfile created 24/04/2015 at 16:40:34
# Updated 23/04/2015 by Xplode
# Database : 2015-04-23.2 [Server]
# Operating system : Windows 8 (x64)
# Username : Goodwin - GOODWINPC
# Running from : C:\Users\Goodwin\Downloads\adwcleaner_4.202.exe
# Option : Cleaning

***** [ Services ] *****

[#] Service Deleted : vToolbarUpdater18.4.0

***** [ Files / Folders ] *****

Folder Deleted : C:\ProgramData\AVG Secure Search
Folder Deleted : C:\ProgramData\AVG Security Toolbar
Folder Deleted : C:\ProgramData\Conduit
Folder Deleted : C:\ProgramData\QuickSet
Folder Deleted : C:\ProgramData\SoftWarehouse
Folder Deleted : C:\ProgramData\StarApp
Folder Deleted : C:\ProgramData\Kromtech
Folder Deleted : C:\ProgramData\CrimeWatch
Folder Deleted : C:\ProgramData\NetEngine
Folder Deleted : C:\ProgramData\{8f1297ea-4105-7266-8f12-297ea4105fa9}
Folder Deleted : C:\Program Files (x86)\AVG SafeGuard toolbar
Folder Deleted : C:\Program Files (x86)\AVG Security Toolbar
Folder Deleted : C:\Program Files (x86)\Conduit
Folder Deleted : C:\Program Files (x86)\MyPC Backup
Folder Deleted : C:\Program Files (x86)\SearchProtect
Folder Deleted : C:\Program Files (x86)\iWin.com Games
Folder Deleted : C:\Program Files (x86)\TNT2
Folder Deleted : C:\Program Files (x86)\Common Files\AVG Secure Search
Folder Deleted : C:\windows\SysWOW64\ARFC
Folder Deleted : C:\windows\SysWOW64\jmdp
Folder Deleted : C:\windows\SysWOW64\WNLT
Folder Deleted : C:\Users\Goodwin\AppData\Local\Temp\AirInstaller
Folder Deleted : C:\Users\Goodwin\AppData\Local\Conduit
Folder Deleted : C:\Users\Goodwin\AppData\Local\DownloadTerms
Folder Deleted : C:\Users\Goodwin\AppData\Local\Kromtech
Folder Deleted : C:\Users\Goodwin\AppData\Local\TNT2
Folder Deleted : C:\Users\Goodwin\AppData\Local\CrimeWatch
Folder Deleted : C:\Users\Goodwin\AppData\LocalLow\Conduit
Folder Deleted : C:\Users\Goodwin\AppData\Roaming\iWin
Folder Deleted : C:\Users\Goodwin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\iWin.com Games
Folder Deleted : C:\Users\Grey\AppData\LocalLow\AVG SafeGuard toolbar
Folder Deleted : C:\Users\Goodwin\AppData\Roaming\Mozilla\Firefox\Profiles\rwhwkby3.default\Extensions\Avg@toolbar
Folder Deleted : C:\Users\Goodwin\AppData\Local\Google\Chrome\User Data\Default\Extensions\hnmphaciaonoedmeffcjbedblhedgjai
File Deleted : C:\END
File Deleted : C:\Users\Goodwin\AppData\Local\Temp\Uninstall.exe
File Deleted : C:\windows\System32\dmwu.exe
File Deleted : C:\windows\System32\ImhxxpComm.dll
File Deleted : C:\Users\Goodwin\AppData\LocalLow\SkwConfig.bin
File Deleted : C:\Program Files (x86)\Mozilla Firefox\browser\nsprotector.js
File Deleted : C:\Users\Goodwin\AppData\Roaming\Mozilla\Firefox\Profiles\rwhwkby3.default\searchplugins\avg-secure-search.xml
File Deleted : C:\Program Files (x86)\Mozilla Firefox\browser\searchplugins\safeguard-secure-search.xml
File Deleted : C:\Program Files (x86)\Mozilla Firefox\browser\searchplugins\wtu-secure-search.xml
File Deleted : C:\Users\Goodwin\AppData\Roaming\Mozilla\Firefox\Profiles\rwhwkby3.default\user.js

***** [ Scheduled tasks ] *****

Task Deleted : RunAsStdUser Task
Task Deleted : NetEngine

***** [ Shortcuts ] *****

***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Classes\AppID\ScriptHelper.EXE
Key Deleted : HKLM\SOFTWARE\Classes\AppID\ViProtocol.DLL
Key Deleted : HKLM\SOFTWARE\Classes\iesmartbar.bandobjectattribute
Key Deleted : HKLM\SOFTWARE\Classes\iesmartbar.dockingpanel
Key Deleted : HKLM\SOFTWARE\Classes\iesmartbar.iesmartbar
Key Deleted : HKLM\SOFTWARE\Classes\iesmartbar.iesmartbarbandobject
Key Deleted : HKLM\SOFTWARE\Classes\iesmartbar.smartbardisplaystate
Key Deleted : HKLM\SOFTWARE\Classes\iesmartbar.smartbarmenuform
Key Deleted : HKLM\SOFTWARE\Classes\PCProxy.DataContainer
Key Deleted : HKLM\SOFTWARE\Classes\protocols\handler\viprotocol
Key Deleted : HKLM\SOFTWARE\Classes\S
Key Deleted : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi
Key Deleted : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi.1
Key Deleted : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE
Key Deleted : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE.1
Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [vProt]
Key Deleted : HKLM\SOFTWARE\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin
Key Deleted : HKCU\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{1FDFF5A2-7BB1-48E1-8081-7236812B12B2}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{9DC8FA51-B596-4F77-802C-5B295919C205}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{BB711CB0-C70B-482E-9852-EC05EBD71DBB}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{058F0E48-61CA-4964-9FBA-1978A1BB060D}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{18F33C35-8EF2-40D7-8BA4-932B0121B472}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{2C4BA31C-0C15-11E2-90C7-9BFCBEB168B3}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{408CFAD9-8F13-4747-8EC7-770A339C7237}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{56561B2A-FB5D-363A-9631-4C03D6054209}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{933B95E2-E7B7-4AD9-B952-7AC336682AE3}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{A717364F-69F3-3A24-ADD5-3901A57F880E}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{B658800C-F66E-4EF3-AB85-6C0C227862A9}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{CCB08265-B35D-30B2-A6AF-6986CA957358}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{CD92622E-49B9-33B7-98D1-EC51049457D7}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E041E037-FA4B-364A-B440-7A1051EA0301}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{FB684D26-01F4-4D9D-87CB-F486BEBA56DC}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{0FCE4F01-64EC-42F1-83E1-1E08D38605D2}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{1A2A195A-A0F9-4006-AF02-3F05EEFDE792}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{22511E2E-7970-414E-BC7C-28D16C4AF54D}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{23C5311E-016D-4999-BCB1-499898429D6C}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{2C4B6DB8-6413-403B-A038-16A352CFE8B9}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{2D9DB233-DC4B-4677-946C-5FA5ABCF506B}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{3AE76A17-C344-4A83-81CE-65EFEE41E42D}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{46803190-228D-470E-90FE-F5E0CEA9C4F2}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{4C0A69B0-CE97-42B7-86FC-08280C99C74D}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{4E9EB4D5-C929-4005-AC62-1856B1DA5A24}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{5180FE16-2E09-497B-9C8B-5A6F029ECECB}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{8FAF962C-3EDE-405E-B1D0-62B8235C6044}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{A4F6E1B3-469E-46EF-A936-FBA9D5EFD2B9}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C1F5E799-B218-4C32-B189-3C389BA140BB}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C97AF157-6A27-4F57-9D47-E2D3E4761B77}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E3ED53C5-7AD5-4DF5-9734-AFB6E7E5D9DB}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{ED0D2C81-7DB5-4599-B7C0-1033418B5672}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{F60C9408-3110-4C98-A139-ABE1EE1111DD}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{07CAC314-E962-4F78-89AB-DD002F2490EE}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{74FB6AFD-DD77-4CEB-83BD-AB2B63E63C93}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2C4BA31C-0C15-11E2-90C7-9BFCBEB168B3}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2C4BA31C-0C15-11E2-90C7-9BFCBEB168B3}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{2C4BA31C-0C15-11E2-90C7-9BFCBEB168B3}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}]
Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{56561B2A-FB5D-363A-9631-4C03D6054209}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{A717364F-69F3-3A24-ADD5-3901A57F880E}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE91F9CE-0900-4E2A-B673-F3F6E4FC54D9}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{CCB08265-B35D-30B2-A6AF-6986CA957358}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{CD92622E-49B9-33B7-98D1-EC51049457D7}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{E041E037-FA4B-364A-B440-7A1051EA0301}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{E3ED53C5-7AD5-4DF5-9734-AFB6E7E5D9DB}
Key Deleted : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}
Key Deleted : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Deleted : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}
Key Deleted : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{BB82DE59-BC4C-4172-9AC4-73315F71CFFE}
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{02D7B29A-37A4-4EE1-9335-1412FB70FA1F}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{8DF8537F-918F-4FD6-9D5A-072FAD5D7380}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{BB82DE59-BC4C-4172-9AC4-73315F71CFFE}
Key Deleted : HKCU\Software\AVG Security Toolbar
Key Deleted : HKCU\Software\Conduit
Key Deleted : HKCU\Software\IM
Key Deleted : HKCU\Software\ImInstaller
Key Deleted : HKCU\Software\lucky leap
Key Deleted : HKCU\Software\usyndication.com
Key Deleted : HKCU\Software\AppDataLow\{4A0F38A9-FE55-4B89-B73F-E60FDC0F72E9}
Key Deleted : HKCU\Software\AppDataLow\Toolbar
Key Deleted : HKCU\Software\AppDataLow\Software\Conduit
Key Deleted : HKLM\SOFTWARE\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
Key Deleted : HKLM\SOFTWARE\{4A0F38A9-FE55-4B89-B73F-E60FDC0F72E9}
Key Deleted : HKLM\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}
Key Deleted : HKLM\SOFTWARE\Conduit
Key Deleted : HKLM\SOFTWARE\SearchProtect
Key Deleted : HKU\.DEFAULT\Software\AVG SafeGuard toolbar
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Open Office Packages
Key Deleted : [x64] HKLM\SOFTWARE\Tarma Installer
Key Deleted : [x64] HKLM\SOFTWARE\WNLT
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\lucky leap
Data Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows [AppInit_DLLs] - c:\progra~2\gssupp~1\assist~1.dll
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3152E1F19977892449DC968802CE8964
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\649A52D257CA5DB4EAAE8BA9EB23E467
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\5E8031606EB60A64C882918F8FF38DD4

***** [ Web browsers ] *****

-\\ Internet Explorer v10.0.9200.17267

-\\ Mozilla Firefox v37.0.2 (x86 en-US)

[rwhwkby3.default\prefs.js] - Line Deleted : user_pref("Smartbar.ConduitHomepagesList", "");
[rwhwkby3.default\prefs.js] - Line Deleted : user_pref("Smartbar.ConduitSearchEngineList", "");
[rwhwkby3.default\prefs.js] - Line Deleted : user_pref("Smartbar.ConduitSearchUrlList", "");
[rwhwkby3.default\prefs.js] - Line Deleted : user_pref("Smartbar.keywordURLSelectedCTID", "CT3310511");
[rwhwkby3.default\prefs.js] - Line Deleted : user_pref("avg.wtu.ext.setting_hp_list", "[{\"name\":\"AVG Secure Search\",\"value\":\"hxxps://mysearch.avg.com\"},{\"name\":\"Google\",\"value\":\"hxxp://www.google.com\"},{\"name\":\"Yahoo\",\"value[…]
[rwhwkby3.default\prefs.js] - Line Deleted : user_pref("browser.search.defaultenginename,S", "WebSearch");
[rwhwkby3.default\prefs.js] - Line Deleted : user_pref("browser.search.hiddenOneOffs", "Yahoo:,Bing,Amazon.com,eBay,Twitter,Wikipedia (en),DuckDuckGo,AVG Secure Search,WebSearch,Yahoo!");
[rwhwkby3.default\prefs.js] - Line Deleted : user_pref("browser.search.order.1", "WebSearch");
[rwhwkby3.default\prefs.js] - Line Deleted : user_pref("browser.search.order.1,S", "WebSearch");
[rwhwkby3.default\prefs.js] - Line Deleted : user_pref("browser.search.selectedEngine,S", "WebSearch");
[rwhwkby3.default\prefs.js] - Line Deleted : user_pref("extensions.51eb66201f10d.scode", "if(window.self.location.protocol.indexOf('hxxp')>-1 && window.self==window.top){var script=document.createElement('script');script.type='text/javascript';s[…]
[rwhwkby3.default\prefs.js] - Line Deleted : user_pref("extensions.b0bVTH5RIrkG.scode", "(function(){try{var url=window.self.location.href;if(url.indexOf(\"acebook\")>-1url.indexOf(\"txtlnkusaolp00000800\")>-1url.indexOf(\"sumorobo\")>-1ur[…]
[rwhwkby3.default\prefs.js] - Line Deleted : user_pref("keyword.URL", "hxxp://search.findwide.com/serp?guid={596259CD-BACA-4776-9B42-4E8021D67F4E}&k=");
[rwhwkby3.default\prefs.js] - Line Deleted : user_pref("plugin.state.npconduitfirefoxplugin", 0);
[rwhwkby3.default\prefs.js] - Line Deleted : user_pref("smartbar.addressBarOwnerCTID", "CT3310511");
[rwhwkby3.default\prefs.js] - Line Deleted : user_pref("smartbar.conduitHomepageList", "hxxp://search.conduit.com/?UM=2&ctid=CT3310511&SearchSource=13&CUI=UN36880920472838514");
[rwhwkby3.default\prefs.js] - Line Deleted : user_pref("smartbar.conduitSearchAddressUrlList", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3310511&SearchSource=2&CUI=UN36880920472838514&UM=2&q=");
[rwhwkby3.default\prefs.js] - Line Deleted : user_pref("smartbar.defaultSearchOwnerCTID", "CT3310511");
[rwhwkby3.default\prefs.js] - Line Deleted : user_pref("smartbar.homePageOwnerCTID", "CT3310511");
[rwhwkby3.default\prefs.js] - Line Deleted : user_pref("smartbar.machineId", "I3PAUDOMN3ADVNSUH6XGCSNMT6XQDTKQP1VBJEILAEU7I0YC5QXPHO4K08TYE0PZJP9QBNTI+HUONLSJHHP8GG");

-\\ Google Chrome v

[C:\Users\Goodwin\AppData\Local\Google\Chrome\User Data\Default\Preferences] - Deleted [Startup_URLs] : hxxp://websearch.coolsearches.info/?pid=24375&r=2015/04/05&hid=11580261625207231028&lg=EN&cc=US&unqvl=85

*************************

AdwCleaner[R0].txt - [17412 bytes] - [24/04/2015 16:38:20]
AdwCleaner[S0].txt - [16670 bytes] - [24/04/2015 16:40:34]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [16730 bytes] ##########

Clstlg

Post #6April 24, 2015, 11:51 PM UTC

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.6.2 (04.24.2015:1)
OS: Windows 8 x64
Ran by [removed] on Fri 04/24/2015 at 16:46:45.05
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Tasks

Successfully deleted: [Task] C:\windows\system32\tasks\Optimize Start Menu Cache Files-S-1-5-21-2247873678-407546785-3609120540-1001
Successfully deleted: [Task] C:\windows\system32\tasks\Optimize Start Menu Cache Files-S-1-5-21-2247873678-407546785-3609120540-1002
Successfully deleted: [Task] C:\windows\system32\tasks\Optimize Start Menu Cache Files-S-1-5-21-2247873678-407546785-3609120540-1003
Successfully deleted: [Task] C:\windows\system32\tasks\Optimize Start Menu Cache Files-S-1-5-21-2247873678-407546785-3609120540-1004

~~~ Registry Values

Successfully repaired: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-19\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-20\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-21-2247873678-407546785-3609120540-1001\Software\Microsoft\Internet Explorer\Main\\Start Page

~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Eventlog\Application\Update lucky leap

~~~ Files

~~~ Folders

Successfully deleted: [Empty Folder] C:\Users\Goodwin\appdata\local\{66D8E1DD-70D7-401B-8928-9FE8404C3E79}
Successfully deleted: [Empty Folder] C:\Users\Goodwin\appdata\local\{79462267-CBF5-4B3D-A5EC-2DE52AA35F6F}

~~~ FireFox

Successfully deleted the following from C:\Users\Goodwin\AppData\Roaming\mozilla\firefox\profiles\rwhwkby3.default\prefs.js

user_pref(CT3298573.UserID, UN27680946203108919);
user_pref(CT3298573.fullUserID, UN27680946203108919.IN.20130928182017);
user_pref(CT3310511_Firefox.csv, [{\from\:\Abs Layer\,\action\:\loading toolbar\,\time\:1380502715171,\isWithState\:\\,\timeFromStart\:0,\timeFromPrev\:0}
user_pref(avg.wtu.ext.dnsWhiteList, toolbarhome.com,avg.com);
user_pref(avg.wtu.ext.extHomepage, hxxps://mysearch.avg.com?pid=wtu&sg=&cid=%7B0da51585-64b8-42ce-a5e1-95990002ec91%7D&mid=943370b2cdd947d39dceb9dd65592735-bed90b2cf893da7e
user_pref(avg.wtu.ext.extParams, {\action\:\extParams\,\data\:{\searchParams\:{\pid\:\wtu\,\cid\:\{0da51585-64b8-42ce-a5e1-95990002ec91}\,\mid\:\943370b2
user_pref(avg.wtu.ext.guardWhiteList, toolbarhome.com,avg.com);
Emptied folder: C:\Users\Goodwin\AppData\Roaming\mozilla\firefox\profiles\rwhwkby3.default\minidumps [56 files]

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Fri 04/24/2015 at 16:50:21.69
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Clstlg

Post #7April 25, 2015, 12:23 AM UTC

Did you purchase this program, you may want to rethink it if you did not

I'm pretty sure we didn't buy that…I didn't even know it was on the computer. Are you saying to uninstall it?

I have the free version of Malwarebytes…it won't let me click anything in advanced settings.

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 4/24/2015
Scan Time: 4:56:56 PM
Logfile: malware.txt
Administrator: Yes

Version: 2.00.4.1028
Malware Database: v2015.04.24.08
Rootkit Database: v2015.04.21.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 8
CPU: x64
File System: NTFS
User: Goodwin

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 494910
Time Elapsed: 24 min, 21 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 2
PUP.Optional.CoolSearches.A, C:\Users\Goodwin\AppData\Local\Google\Chrome\User Data\Default\Preferences, Good: (), Bad: ({"extensions":{"settings":{"hnmphaciaonoedmeffcjbedblhedgjai":{"ack_external":true,"active_permissions":{"api":["contextMenus","cookies","management","notifications","storage","tabs"],"explicit_host":["http://*/*","https://*/*"],"scriptable_host":["http://*/*","https://*/*"]},"from_bookmark":false,"from_webstore":false,"granted_permissions":{"api":["contextMenus","cookies","management","notifications","storage","tabs"],"explicit_host":["http://*/*","https://*/*"],"scriptable_host":["http://*/*","https://*/*"]},"location":1,"manifest":{"background":{"page":"background.html"},"content_scripts":[{"all_frames":true,"exclude_globs":["http://search.snapdo.com/*"],"js":["content.js"],"matches":["http://*/*","https://*/*"],"run_at":"document_end"}],"description":"","key":"MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDfEowQeyoQ/zjux4Vwb+CjO+AWgSOVPjTgaWUwQQKMQF8JPYAEXBh2vUeryjHYhJE9v7Cyjg88s8BRfTUGPXXeISiyjSLzC/Xf+QvhzRsslAQGJDtNLojamgJVdoESzXdBLzIeEuWb4SW6CrhXshVK7imylS/rkh18dxwz6Dp2ywIDAQAB","manifest_version":2,"name":"safe save","permissions":["http://*/*","https://*/*","tabs","cookies","management","notifications","contextMenus","management","storage"],"version":"1.5"},"path":"hnmphaciaonoedmeffcjbedblhedgjai\\1","state":1,"was_installed_by_default":false},"mhdoalfjomgiohmljhhfdipjlbejaejm":{"ack_external":true,"active_permissions":{"api":["plugin","tabs","notifications"],"explicit_host":["https://*/*","http://*/*"],"scriptable_host":["http://*/*","https://*/*","file://*/*"]},"creation_flags":1,"exclude_from_sideload_wipeout":true,"from_bookmark":false,"from_webstore":false,"granted_permissions":{"api":["plugin","tabs","notifications"],"explicit_host":["https://*/*","http://*/*"],"scriptable_host":["http://*/*","https://*/*","file://*/*"]},"install_time":"130280078159177619","location":1,"manifest":{"background_page":"back.html","content_scripts":[{"all_frames":false,"js":["inpage.js"],"matches":["http://*/*","https://*/*","file://*/*"],"run_at":"document_start"}],"description":"GetItHD","icons":{"128":"icon.png","16":"icon.png","32":"icon.png","48":"icon.png"},"key":"MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC++Bk9QiZKXPb9dGaehqZdV1HUdf8t3Ow71vvZkPpXJRJGxbfc7wqQ+GMF5SOk4cuDilMIel/a25/HTkxC8yxnjBlPaidzyFEscLCkHWMBfdT1aWnx09kgimaA7+7bA26ApNY/25Q3upwzNI1XFcIiddwmCeRAF4fbPtBp1kg3LQIDAQAB","name":"GetItHD","permissions":["tabs","https://*/*","http://*/*","notifications"],"plugins":[{"path":"chromeNPAPIYTG.dll","public":true}],"version":"2.0.3"},"path":"mhdoalfjomgiohmljhhfdipjlbejaejm\\2.0.3_0","state":1,"was_installed_by_default":false},"ndibdjnfmopecpmkdieinmbadjfpblof":null}},"homepage_is_newtabpage":false,"session":{"restore_on_startup":4,"restore_on_startup_migrated":true,"startup_urls":["http://websearch.coolsearches.info/?pid=24375&r=2015/04/05&hid=11580261625207231028&lg=EN&cc=US&unqvl=85"],"startup_urls_migration_time":2147483647,"urls_to_restore_on_startup":[]}}), Replaced,[f347b0bf4446bf77e6a9cd77ea1cdb25]
PUP.Optional.Freshy.A, C:\Users\Goodwin\AppData\Roaming\Mozilla\Firefox\Profiles\rwhwkby3.default\prefs.js, Good: (), Bad: (user_pref("browser.startup.homepage", "http://services.freshy.com/general/newhometab.php?hometab=home&partner=11083&guid={596259CD-BACA-4776-9B42-4E8021D67F4E}&i=");),Replaced,[81b9cfa06c1e0135c535a4a0f412738d]

Physical Sectors: 0
(No malicious items detected)

(end)

ken545

Post #8April 25, 2015, 12:32 AM UTC

Yes I would uninstall that program, it brings other garbage with it when you download it

That garbage that Malwarebytes found, open Malwarebytes and check for updates and run another scan and make sure that junk is gone, let me know because Malwarebytes needs to come back clean

After you run Malwarebytes, open up FRST64, checkmark Additions and run a new scan and post both the FRST64 and the Additions logs please

Clstlg

Post #9April 25, 2015, 12:40 AM UTC

Hmmm…I'm not seeing PCKeeper on my list of installed programs. Is it under another name perhaps?

I have Malwarebytes running now…

ken545

Post #10April 25, 2015, 12:50 AM UTC

I dont see it on your list either, nice people right, install a program and then there is no uninstall option. We can take it out with FRST in a bit

Clstlg

Post #11April 25, 2015, 1:04 AM UTC

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 4/24/2015
Scan Time: 5:39:15 PM
Logfile:
Administrator: Yes

Version: 2.00.4.1028
Malware Database: v2015.04.24.08
Rootkit Database: v2015.04.21.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 8
CPU: x64
File System: NTFS
User: Goodwin

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 494924
Time Elapsed: 23 min, 35 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 1
PUP.Optional.Freshy.A, C:\Users\Goodwin\AppData\Roaming\Mozilla\Firefox\Profiles\rwhwkby3.default\prefs.js, Good: (), Bad: (user_pref("browser.startup.homepage", "http://services.freshy.com/general/newhometab.php?hometab=home&partner=11083&guid={596259CD-BACA-4776-9B42-4E8021D67F4E}&i=");),Replaced,[fe3c680766248fa75f9b063e976fe020]

Physical Sectors: 0
(No malicious items detected)

(end)

Clstlg

Post #12April 25, 2015, 1:05 AM UTC

Looks like another one popped up. :/

Do you want me to run it again?

ken545

Post #13April 25, 2015, 1:13 AM UTC

Why dont you do this since Malwarebytes is the free version, you can still download and install the free version

Download and run their removal utility HERE

It will ask to restart your computer (please allow it to).

Then download Malwarebytes' Anti-Malware Version 2.1.6 from HERE

On the Dashboard click on Update Now

Go to the Setting Tab

Under Setting go to Detection and Protection

Under PUP and PUM make sure both are set to show Threat Detections as Malware

Go to Advanced setting and make sure Automatically Quarantine Detected Items is checked

Then on the Dashboard click on Scan

Make sure to select THREAT SCAN

Then click on Scan

When the scan is finished and the log pops up…select Copy to Clipboard

Please paste the log back into this thread for review

Exit Malwarebytes

Clstlg

Post #14April 25, 2015, 1:58 AM UTC

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 4/24/2015
Scan Time: 6:27:49 PM
Logfile:
Administrator: Yes

Version: 2.01.6.1022
Malware Database: v2015.04.24.08
Rootkit Database: v2015.04.21.01
License: Trial
Malware Protection: Enabled
Malicious Website Protection: Enabled
Self-protection: Disabled

OS: Windows 8
CPU: x64
File System: NTFS
User: Goodwin

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 502659
Time Elapsed: 28 min, 31 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 1
PUP.Optional.Freshy.A, C:\Users\Goodwin\AppData\Roaming\Mozilla\Firefox\Profiles\rwhwkby3.default\prefs.js, Good: (), Bad: (user_pref("browser.startup.homepage", "http://services.freshy.com/general/newhometab.php?hometab=home&partner=11083&guid={596259CD-BACA-4776-9B42-4E8021D67F4E}&i=");),Replaced,[1d4b5f11addd7bbb14e62f15f115ab55]

Physical Sectors: 0
(No malicious items detected)

(end)

Clstlg

Post #15April 25, 2015, 1:58 AM UTC

That is the same PUP as the last two times…where is it coming from?

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Yahoo, pop-ups, and underlines--Oh My! [Solved]

✨ Ask AI

Ask AI