Spyware / Malware / Virus Removal

Slow or no internet access: 9YO XP Machine [Solved]

10 min read

Looking for the outcome? Ask AI

rockaway1 Topic Starter

Post #1February 20, 2016, 4:18 PM UTC

The system has unusually slow internet performance and many instances the pages don't load and we receive an error message such as: This webpage is not available ERR SSL Version Or Cipher Mismatch. This was returned when trying to access what the tech using Google chrome.
Some machine specs (don't laugh its my mom's laptop):
Windows XP SP3
AMD Sempron Processor 3300+
1.99 Ghz 384 MB RAM
48. GB storage, 16 GB used

Thanks again for all your assistance.

JB

Satchfan

Post #2February 20, 2016, 5:14 PM UTC last edited February 22, 2016, 10:20 AM UTC

This is a problem that Chrome and Internet Explorer have with Windows XP machines.

Firefox should be fine, (and in my opinion is far better/safer than Chrome). You can download Firefox here if you don't have it.

Hope that helps.

rockaway1

Post #3February 21, 2016, 3:56 PM UTC

Hi Satchfan:

Thanks for the tip. Before installing another browser I would like to take steps to identify and remove any malware which appears to be infecting this system. Can you help me with that or refer my post to another malware team member?

Thank you
JB

Satchfan

Post #4February 22, 2016, 10:19 AM UTC

Hello again rockaway1 and sorry for the delay but I missed your reply.

Let’s run some scans and see what is on your computer.

===================================================

Note: Please run these in the order given in the instructions.

===================================================

Download and run AdwCleaner

Download AdwCleaner from here and save it to your desktop.

run AdwCleaner
when it has finished, select Clean
if it asks to reboot, allow the reboot
on reboot a log will be produced; please attach the content of the log to your next reply.

===================================================

Download and run Junkware Removal Tool

[external image: thisisujrt.gif] Please download Junkware Removal Tool to your desktop.

shut down your protection software now to avoid potential conflicts.
run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator"
the tool will open and start scanning your system
please be patient as this can take a while to complete depending on your system's specifications
on completion, a log (JRT.txt) is saved to your desktop and will automatically open
post the contents of JRT.txt into your next message.

===================================================

Run Farbar Recovery Scan Tool

Please download Farbar Recovery Scan Tool and save it to your Desktop.

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
press Scan button
it will produce a log called Frst.txt in the same directory the tool is run from
please copy and paste log back here.
the first time the tool is run it generates another log (Addition.txt - also located in the same directory as FRST.exe/FRST64.exe). Please also paste that along with the Frst.txt into your reply.

Logs to include with next post:

AdwCleaner log
JRT.txt
Frst.txt
Addition.txt

Thanks

Satchfan

rockaway1

Post #5February 22, 2016, 10:48 PM UTC

Thanks for your help.
I've posted the logs below.
Though I have another problem which I posted in my first post.
When I try to reach WTT's website I receive the following message:
"This website is not available.
ERR SSL VERSION OR CIPHER MISMATCH
A secure connection cannot be established because the site uses an unsupported protocol or sipher suite.
This is likely to be caused when the server needs RC4, which is no longer considered secure.

Here are the logs.

Add cleaner
# AdwCleaner v5.036 - Logfile created 22/02/2016 at 16:50:07
# Updated 22/02/2016 by Xplode
# Database : 2016-02-22.2 [Server]
# Operating system : Microsoft Windows XP Service Pack 3 (x86)
# Username : Thelma Demner - LAPTOP
# Running from : C:\Documents and Settings\Thelma Demner\Desktop\adwcleaner_5.036.exe
# Option : Cleaning
# Support : http://toolslib.net/forum

***** [ Services ] *****

***** [ Folders ] *****

[-] Folder Deleted : C:\Documents and Settings\All Users\Application Data\Viewpoint
[-] Folder Deleted : C:\Documents and Settings\Thelma Demner\Application Data\Mysearchdial
[-] Folder Deleted : C:\Documents and Settings\Thelma Demner\Application Data\UpdaterEX
[-] Folder Deleted : C:\Program Files\BrowseMark
[-] Folder Deleted : C:\Program Files\Mysearchdial
[-] Folder Deleted : C:\Program Files\Viewpoint
[!] Folder Not Deleted : C:\Program Files\BrowseMark
[-] Folder Deleted : C:\Program Files\Common Files\Software Update Utility

***** [ Files ] *****

***** [ DLLs ] *****

***** [ Shortcuts ] *****

***** [ Scheduled tasks ] *****

***** [ Registry ] *****

[-] Key Deleted : HKLM\SOFTWARE\Classes\AppID\dnu.EXE
[-] Key Deleted : HKLM\SOFTWARE\Classes\AppID\esrv.EXE
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{1B00725B-C455-4DE6-BFB6-AD540AD427CD}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{03F998B2-0E00-11D3-A498-00104B6EB52E}
[-] Key Deleted : HKLM\SOFTWARE\MozillaPlugins\@viewpoint.com/VMP
[-] Key Deleted : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}
[-] Key Deleted : HKLM\SOFTWARE\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
[-] Key Deleted : HKLM\SOFTWARE\Classes\AppID\{6C259840-5BA8-46E6-8ED1-EF3BA47D8BA1}
[-] Key Deleted : HKLM\SOFTWARE\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}
[-] Key Deleted : HKLM\SOFTWARE\Classes\AppID\{C292AD0A-C11F-479B-B8DB-743E72D283B0}
[-] Key Deleted : HKLM\SOFTWARE\Classes\AppID\{CA5CAA63-B27C-4963-9BEC-CB16A36D56F8}
[-] Key Deleted : HKLM\SOFTWARE\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{03F998B2-0E00-11D3-A498-00104B6EB52E}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{1B00725B-C455-4DE6-BFB6-AD540AD427CD}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3004627E-F8E9-4E8B-909D-316753CBA923}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{4AA46D49-459F-4358-B4D1-169048547C23}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{4ED063C9-4A0B-4B44-A9DC-23AFF424A0D3}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{761F6A83-F007-49E4-8EAC-CDB6808EF06F}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{7B089B94-D1DC-4C6B-87E1-8156E22C1D96}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{AEAC172E-2E4B-4B92-9AF6-B0CDB1ACECDB}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{C358B3D0-B911-41E3-A276-E7D43A6BA56D}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{D40753C7-8A59-4C1F-BE88-C300F4624D5B}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E15A9BFD-D16D-496D-8222-44CADF316E70}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{EF5625A3-37AB-4BDB-9875-2A3D91CD0DFD}
[!] Key Not Deleted : HKLM\SOFTWARE\Classes\CLSID\{aeac172e-2e4b-4b92-9af6-b0cdb1acecdb}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{0400EBCA-042C-4000-AA89-9713FBEDB671}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{0BD19251-4B4B-4B94-AB16-617106245BB7}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{3281114F-BCAB-45E3-80D9-A6CD64D4E636}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{44533FCB-F9FB-436A-8B6B-CF637B2D465A}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{44B29DDD-CF7A-454A-A275-A322A398D93F}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{660E6F4F-840D-436D-B668-433D9591BAC5}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{A4DE94DB-DF03-45A3-8A5D-D1B7464B242D}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{AA0F50A8-2618-4AE4-A779-9F7378555A8F}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{B2DB115C-8278-4947-9A07-57B53D1C4215}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{B97FC455-DB33-431D-84DB-6F1514110BD5}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C67281E0-78F5-4E49-9FAE-4B1B2ADAF17B}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E72E9312-0367-4216-BFC7-21485FA8390B}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E7435878-65B9-44D1-A443-81754E5DFC90}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{F6CCB6C9-127E-44AE-8552-B94356F39FFE}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{FFD25630-2734-4AE9-88E6-21BF6525F3FE}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{BCAD45DB-5F28-4FED-8759-41E07EE6402F}
[-] Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
[-] Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{92380354-381A-471F-BE2E-DD9ACD9777EA}
[-] Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{C292AD0A-C11F-479B-B8DB-743E72D283B0}
[-] Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
[-] Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{FBC322D5-407E-4854-8C0B-555B951FD8E3}
[-] Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{0403706E-B8FA-450C-A865-018D5B28E9E1}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AEAC172E-2E4B-4B92-9AF6-B0CDB1ACECDB}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EF5625A3-37AB-4BDB-9875-2A3D91CD0DFD}
[!] Key Not Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{aeac172e-2e4b-4b92-9af6-b0cdb1acecdb}
[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3004627E-F8E9-4E8B-909D-316753CBA923}
[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AEAC172E-2E4B-4B92-9AF6-B0CDB1ACECDB}
[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EF5625A3-37AB-4BDB-9875-2A3D91CD0DFD}
[!] Key Not Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{aeac172e-2e4b-4b92-9af6-b0cdb1acecdb}
[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{3004627E-F8E9-4E8B-909D-316753CBA923}
[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AEAC172E-2E4B-4B92-9AF6-B0CDB1ACECDB}
[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EF5625A3-37AB-4BDB-9875-2A3D91CD0DFD}
[!] Key Not Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{aeac172e-2e4b-4b92-9af6-b0cdb1acecdb}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7B089B94-D1DC-4C6B-87E1-8156E22C1D96}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{219046AE-358F-4CF1-B1FD-2B4DE83642A8}
[-] Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{3004627E-F8E9-4E8B-909D-316753CBA923}]
[-] Key Deleted : HKCU\Software\BrowseMark
[-] Key Deleted : HKCU\Software\InstallCore
[-] Key Deleted : HKCU\Software\mysearchdial
[-] Key Deleted : HKCU\Software\UpdaterEX
[!] Key Not Deleted : HKCU\Software\BrowseMark
[!] Key Not Deleted : HKCU\Software\BrowseMark
[-] Key Deleted : HKLM\SOFTWARE\BrowseMark
[-] Key Deleted : HKLM\SOFTWARE\firstsearch
[-] Key Deleted : HKLM\SOFTWARE\InstallCore
[-] Key Deleted : HKLM\SOFTWARE\MetaStream
[-] Key Deleted : HKLM\SOFTWARE\mysearchdial
[-] Key Deleted : HKLM\SOFTWARE\Viewpoint
[!] Key Not Deleted : HKLM\SOFTWARE\BrowseMark
[!] Key Not Deleted : HKLM\SOFTWARE\BrowseMark
[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\UpdaterEX
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BrowseMark
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\mysearchdial
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SoftwareUpdUtility
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ViewpointMediaPlayer
[!] Key Not Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BrowseMark
[!] Key Not Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BrowseMark
[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\UpdaterEX
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\BrowseMark
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\mysearchdial
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\SoftwareUpdUtility
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\ViewpointMediaPlayer
[!] Key Not Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\BrowseMark
[!] Key Not Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\BrowseMark
[-] Key Deleted : HKU\.DEFAULT\Software\UpdaterEX
[-] Data Restored : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page]
[-] Data Restored : HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURls
[-] Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}
[-] Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{EB8E9551-3E72-4208-8651-EE8AC57D1E64}
[-] Data Restored : HKCU\Software\Microsoft\Internet Explorer\SearchScopes [DefaultScope]
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{262E1677-CBAD-40E0-B6F5-95E4D1B59A08}
[-] Data Restored : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes [DefaultScope]
[-] Key Deleted : HKCU\Software\Microsoft\Internet Explorer\DOMStorage\superfish.com
[-] Key Deleted : HKLM\SOFTWARE\Classes\AxMetaStream.MetaStreamCtl
[-] Key Deleted : HKLM\SOFTWARE\Classes\AxMetaStream.MetaStreamCtl.1
[-] Key Deleted : HKLM\SOFTWARE\Classes\AxMetaStream.MetaStreamCtlSecondary
[-] Key Deleted : HKLM\SOFTWARE\Classes\AxMetaStream.MetaStreamCtlSecondary.1

***** [ Web browsers ] *****

[-] [C:\Documents and Settings\Thelma Demner\Local Settings\Application Data\Google\Chrome\User Data\Default\Secure Preferences] [Startup_URLs] Deleted : hxxp://start.mysearchdial.com/?f=1&a;=dnldstr_14_16_ie&cd;=2XzuyEtN2Y1L1QzutDtDtCyE0AyDyC0F0D0DyEtB0DtAtA0FtN0D0Tzu0SzztAyBtN1L2XzutBtFtCzztFtBtFzztN1L1CzutCyEtDtAtDyD1V1QtN1L1G1B1V1N2Y1L1Qzu2StB0E0EyDtDtBtAyDtGyB0AzytDtGtC0B0A0AtG0AyCtDtAtGyC0EtDzyzzzz0E0AyCzzyEzy2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyE0ByEtD0E0DtDtCtG0D0DtC0AtGtB0C0CtDtG0FzyyByDtGtB0EtDyDyDyByCzzyE0C0EtD2Q&cr;=1119004242&ir;=
[-] [C:\Documents and Settings\Thelma Demner\Local Settings\Application Data\Google\Chrome\User Data\Default\Secure Preferences] [Homepage] Deleted : hxxp://start.mysearchdial.com/?f=1&a;=dnldstr_14_16_ie&cd;=2XzuyEtN2Y1L1QzutDtDtCyE0AyDyC0F0D0DyEtB0DtAtA0FtN0D0Tzu0SzztAyBtN1L2XzutBtFtCzztFtBtFzztN1L1CzutCyEtDtAtDyD1V1QtN1L1G1B1V1N2Y1L1Qzu2StB0E0EyDtDtBtAyDtGyB0AzytDtGtC0B0A0AtG0AyCtDtAtGyC0EtDzyzzzz0E0AyCzzyEzy2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyE0ByEtD0E0DtDtCtG0D0DtC0AtGtB0C0CtDtG0FzyyByDtGtB0EtDyDyDyByCzzyE0C0EtD2Q&cr;=1119004242&ir;=

*************************

:: "Tracing" keys removed
:: Winsock settings cleared

*************************

C:\AdwCleaner\AdwCleaner[C1].txt - [11493 bytes] - [22/02/2016 16:50:07]
C:\AdwCleaner\AdwCleaner[S1].txt - [11665 bytes] - [22/02/2016 16:47:51]

########## EOF - C:\AdwCleaner\AdwCleaner[C1].txt - [11641 bytes] ##########

JRT Log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.0.3 (02.09.2016)
Operating System: Microsoft Windows XP x86
Ran by [removed] (Administrator) on Mon 02/22/2016 at 17:04:32.15
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

File System: 35

Successfully deleted: C:\WINDOWS\Tasks\At1.job (Task)
Successfully deleted: C:\WINDOWS\Tasks\At2.job (Task)
Successfully deleted: C:\WINDOWS\Tasks\At3.job (Task)
Successfully deleted: C:\WINDOWS\wininit.ini (File)
Successfully deleted: C:\Documents and Settings\All Users\SPL10E.tmp (File)
Successfully deleted: C:\Documents and Settings\All Users\SPL10F.tmp (File)
Successfully deleted: C:\Documents and Settings\All Users\SPL113.tmp (File)
Successfully deleted: C:\Documents and Settings\All Users\SPL117.tmp (File)
Successfully deleted: C:\Documents and Settings\All Users\SPL120.tmp (File)
Successfully deleted: C:\Documents and Settings\All Users\SPL12F.tmp (File)
Successfully deleted: C:\Documents and Settings\All Users\SPL131.tmp (File)
Successfully deleted: C:\Documents and Settings\All Users\SPL142.tmp (File)
Successfully deleted: C:\Documents and Settings\All Users\SPL143.tmp (File)
Successfully deleted: C:\Documents and Settings\All Users\SPL144.tmp (File)
Successfully deleted: C:\Documents and Settings\All Users\SPL150.tmp (File)
Successfully deleted: C:\Documents and Settings\All Users\SPL155.tmp (File)
Successfully deleted: C:\Documents and Settings\All Users\SPL160.tmp (File)
Successfully deleted: C:\Documents and Settings\All Users\SPL174.tmp (File)
Successfully deleted: C:\Documents and Settings\All Users\SPL175.tmp (File)
Successfully deleted: C:\Documents and Settings\All Users\SPL178.tmp (File)
Successfully deleted: C:\Documents and Settings\All Users\SPL179.tmp (File)
Successfully deleted: C:\Documents and Settings\All Users\SPL17A.tmp (File)
Successfully deleted: C:\Documents and Settings\All Users\SPL183.tmp (File)
Successfully deleted: C:\Documents and Settings\All Users\SPL1A9.tmp (File)
Successfully deleted: C:\Documents and Settings\All Users\SPL2.tmp (File)
Successfully deleted: C:\Documents and Settings\All Users\SPL3.tmp (File)
Successfully deleted: C:\Documents and Settings\All Users\SPL7.tmp (File)
Successfully deleted: C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\89ABCDEF (Temporary Internet Files Folder)
Successfully deleted: C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\GHEJKLMN (Temporary Internet Files Folder)
Successfully deleted: C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\KPMRSTUR (Temporary Internet Files Folder)
Successfully deleted: C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\W1234167 (Temporary Internet Files Folder)
Successfully deleted: C:\WINDOWS\System32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\89ABCDEF (Temporary Internet Files Folder)
Successfully deleted: C:\WINDOWS\System32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\GHEJKLMN (Temporary Internet Files Folder)
Successfully deleted: C:\WINDOWS\System32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\KPMRSTUR (Temporary Internet Files Folder)
Successfully deleted: C:\WINDOWS\System32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\W1234167 (Temporary Internet Files Folder)

Registry: 3

Successfully deleted: HKCU\Software\Microsoft\Internet Explorer\Main\\Search Bar (Registry Value)
Successfully deleted: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{262E1677-CBAD-40E0-B6F5-95E4D1B59A08} (Registry Key)
Successfully deleted: HKLM\Software\Microsoft\Internet Explorer\Search\\SearchAssistant (Registry Value)

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Mon 02/22/2016 at 17:07:26.95
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

FRST Log

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:21-02-2016 01
Ran by [removed] (administrator) on LAPTOP (22-02-2016 17:27:10)
Running from C:\Documents and Settings\[removed]\Desktop
[removed] Platform: Microsoft Windows XP Home Edition Service Pack 3 (X86) Language: English (United States)
Internet Explorer Version 8 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(ATI Technologies Inc.) C:\WINDOWS\system32\ati2evxx.exe
(ATI Technologies Inc.) C:\WINDOWS\system32\ati2evxx.exe
(Sun Microsystems, Inc.) C:\Program Files\Java\jre6\bin\jqs.exe
(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe
( ) C:\WINDOWS\system32\lxdxcoms.exe
(NETGATE Technologies s.r.o.) C:\Program Files\NETGATE\Registry Cleaner\RegistryCleanerSrv.exe
(RealVNC Ltd) C:\Program Files\RealVNC\VNC Server\vncserver.exe
(RealVNC Ltd) C:\Program Files\RealVNC\VNC Server\vncserver.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
(ATI Technologies, Inc.) C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
(Sun Microsystems, Inc.) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(CyberLink Corp.) C:\Program Files\HP\QuickPlay\QPService.exe
() C:\Program Files\Lexmark 3600-4600 Series\lxdxmon.exe
() C:\Program Files\Lexmark 3600-4600 Series\lxdxmsdmon.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
(RealVNC Ltd) C:\Program Files\RealVNC\VNC Server\vncserver.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\…\Run: [ATIPTA] => C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe [344064 2005-11-11] (ATI Technologies, Inc.)
HKLM\…\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [254896 2012-09-17] (Sun Microsystems, Inc.)
HKLM\…\Run: [HP Software Update] => C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe [49152 2005-02-17] (Hewlett-Packard Co.)
HKLM\…\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [729178 2005-06-19] (Synaptics, Inc.)
HKLM\…\Run: [QPService] => C:\Program Files\HP\QuickPlay\QPService.exe [94208 2005-12-12] (CyberLink Corp.)
HKLM\…\Run: [Cpqset] => C:\Program Files\HPQ\Default Settings\cpqset.exe [233534 2005-08-01] ()
HKLM\…\Run: [RecGuard] => C:\Windows\SMINST\RecGuard.exe [1187840 2005-10-11] ()
HKLM\…\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1022152 2014-12-19] (Adobe Systems Incorporated)
HKLM\…\Run: [lxdxmon.exe] => C:\Program Files\Lexmark 3600-4600 Series\lxdxmon.exe [668328 2008-06-13] ()
HKLM\…\Run: [lxdxamon] => C:\Program Files\Lexmark 3600-4600 Series\lxdxamon.exe [16040 2008-06-13] ()
Winlogon\Notify\AtiExtEvent: C:\WINDOWS\system32\Ati2evxx.dll [2005-11-10] (ATI Technologies Inc.)
HKU\S-1-5-21-3680545734-3834015383-3748329811-1006\…\Run: [NETGATERegistryCleaner] => C:\Program Files\NETGATE\Registry Cleaner\RegistryCleaner.exe [1947608 2015-07-09] (NETGATE Technologies s.r.o.)
Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Photosmart Premier Fast Start.lnk [2006-02-16]
ShortcutTarget: HP Photosmart Premier Fast Start.lnk -> C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe (Hewlett-Packard Development Company, L.P.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 75.75.75.75 75.75.76.76
Tcpip\..\Interfaces\{BE1D0044-0C77-4CD6-B2F9-534103796D87}: [DhcpNameServer] 75.75.75.75 75.75.76.76

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKU\S-1-5-21-3680545734-3834015383-3748329811-1006\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar;=iesearch
HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURLs,Tabs: "hxxp://www.google.com" <======= ATTENTION
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-3680545734-3834015383-3748329811-1006 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre6\bin\ssv.dll [2014-05-14] (Sun Microsystems, Inc.)
BHO: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre6\bin\jp2ssv.dll [2014-05-14] (Sun Microsystems, Inc.)
BHO: JQSIEStartDetectorImpl Class -> {E7E6F031-17CE-4C07-BC86-EABFE594F69C} -> C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2014-05-14] (Sun Microsystems, Inc.)
Toolbar: HKU\S-1-5-21-3680545734-3834015383-3748329811-1006 -> No Name - {C4069E3A-68F1-403E-B40E-20066696354B} - No File
Toolbar: HKU\S-1-5-21-3680545734-3834015383-3748329811-1006 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_45-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0045-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_45-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_45-windows-i586.cab
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll [2001-06-20] (Microsoft Corporation)

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_8_800_94.dll [2014-04-21] ()
FF Plugin: @java.com/DTPlugin,version=1.6.0_45 -> C:\WINDOWS\system32\npdeployJava1.dll [2014-05-14] (Sun Microsystems, Inc.)
FF Plugin: @java.com/JavaPlugin -> C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll [2014-05-14] (Sun Microsystems, Inc.)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-02-19] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-02-19] (Google Inc.)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-08-05] (Adobe Systems Inc.)
FF HKLM\…\Firefox\Extensions: [[removed]] - C:\Program Files\Java\jre6\lib\deploy\jqs\ff
FF Extension: Java Quick Starter - C:\Program Files\Java\jre6\lib\deploy\jqs\ff [2014-05-14] [not signed]

Chrome:
=======
CHR Profile: C:\Documents and Settings\Thelma Demner\Local Settings\Application Data\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Documents and Settings\Thelma Demner\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-05-06]
CHR Extension: (Google Drive) - C:\Documents and Settings\Thelma Demner\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-11-19]
CHR Extension: (YouTube) - C:\Documents and Settings\Thelma Demner\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-10-23]
CHR Extension: (Google Search) - C:\Documents and Settings\Thelma Demner\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-11-19]
CHR Extension: (Google Docs Offline) - C:\Documents and Settings\Thelma Demner\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2015-11-19]
CHR Extension: (Chrome Web Store Payments) - C:\Documents and Settings\Thelma Demner\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-10-23]
CHR Extension: (Gmail) - C:\Documents and Settings\Thelma Demner\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-05-06]

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 hpqwmiex; C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe [98304 2005-11-28] (Hewlett-Packard Development Company, L.P.) [File not signed]
S3 IDriverT; C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [73728 2004-10-22] (Macrovision Corporation) [File not signed]
R2 JavaQuickStarterService; C:\Program Files\Java\jre6\bin\jqs.exe [158128 2014-05-14] (Sun Microsystems, Inc.)
R2 LightScribeService; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [73728 2005-11-15] (Hewlett-Packard Company) [File not signed]
S4 lxdxCATSCustConnectService; C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\\lxdxserv.exe [98984 2008-02-27] (Lexmark International, Inc.)
R2 lxdx_device; C:\WINDOWS\system32\lxdxcoms.exe [594600 2008-02-27] ( )
R2 NGRegClnSrv; C:\Program Files\NETGATE\Registry Cleaner\RegistryCleanerSrv.exe [473424 2013-02-21] (NETGATE Technologies s.r.o.)
R2 vncserver; C:\Program Files\RealVNC\VNC Server\vncserver.exe [3602752 2013-01-22] (RealVNC Ltd)

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R1 AmdK8; C:\WINDOWS\System32\DRIVERS\AmdK8.sys [36352 2005-03-09] (Advanced Micro Devices)
R3 BCM43XX; C:\WINDOWS\System32\DRIVERS\bcmwl5.sys [604928 2006-11-01] (Broadcom Corporation)
S3 BTWUSB; C:\WINDOWS\System32\Drivers\btwusb.sys [56648 2005-08-18] (Broadcom Corporation.) [File not signed]
R3 HSFHWATI; C:\WINDOWS\System32\DRIVERS\HSFHWATI.sys [231424 2005-08-22] (Conexant Systems, Inc.)
R0 PxHelp20; C:\WINDOWS\System32\Drivers\PxHelp20.sys [20640 2005-04-25] (Sonic Solutions) [File not signed]
S3 Rasirda; C:\WINDOWS\System32\DRIVERS\rasirda.sys [19584 2001-08-17] (Microsoft Corporation)
S3 SMCIRDA; C:\WINDOWS\System32\DRIVERS\smcirda.sys [35913 2001-08-17] (SMC)
R3 vncmirror; C:\WINDOWS\System32\DRIVERS\vncmirror.sys [4608 2013-01-22] (RealVNC Ltd.)
S1 eabfiltr; \??\C:\WINDOWS\system32\drivers\EABFiltr.sys [X]
U5 ScsiPort; C:\WINDOWS\system32\drivers\scsiport.sys [96384 2008-04-13] (Microsoft Corporation)
S3 wanatw; system32\DRIVERS\wanatw4.sys [X]
U1 WS2IFSL; no ImagePath

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-02-22 17:27 - 2016-02-22 17:27 - 00011523 _____ C:\Documents and Settings\Thelma Demner\Desktop\FRST.txt
2016-02-22 17:26 - 2016-02-22 17:27 - 00000000 ____D C:\FRST
2016-02-22 17:07 - 2016-02-22 17:07 - 00004190 _____ C:\Documents and Settings\Thelma Demner\Desktop\JRT.txt
2016-02-22 16:59 - 2016-02-22 16:59 - 01722368 _____ (Farbar) C:\Documents and Settings\Thelma Demner\Desktop\FRST.exe
2016-02-22 16:57 - 2016-02-22 16:57 - 01609216 _____ (Malwarebytes) C:\Documents and Settings\Thelma Demner\Desktop\JRT.exe
2016-02-22 16:52 - 2016-02-22 16:52 - 00011721 _____ C:\Documents and Settings\Thelma Demner\Desktop\AdwCleaner[C1].txt
2016-02-22 16:47 - 2016-02-22 16:50 - 00000000 ____D C:\AdwCleaner
2016-02-22 16:45 - 2016-02-22 16:45 - 01511936 _____ C:\Documents and Settings\Thelma Demner\Desktop\adwcleaner_5.036.exe

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-02-22 17:27 - 2014-04-16 23:06 - 00000000 ____D C:\Documents and Settings\Thelma Demner\Local Settings\Temp
2016-02-22 17:04 - 2006-02-16 04:36 - 00000000 ____D C:\Documents and Settings\All Users
2016-02-22 17:03 - 2014-04-24 10:37 - 00000000 ____D C:\Documents and Settings\All Users\Lx_cats
2016-02-22 16:57 - 2004-08-07 08:10 - 00471150 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2016-02-22 16:52 - 2014-04-16 23:06 - 00000000 ____D C:\Documents and Settings\Thelma Demner\Local Settings\Application Data\ApplicationHistory
2016-02-22 16:52 - 2014-04-16 21:49 - 00000000 ____D C:\temp
2016-02-22 16:52 - 2014-04-16 21:14 - 00000886 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2016-02-22 16:52 - 2014-04-16 21:14 - 00000882 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2016-02-22 16:52 - 2006-02-16 05:43 - 00000297 _____ C:\hpqp.ini
2016-02-22 16:52 - 2006-02-16 05:43 - 00000039 _____ C:\XP_TV.ini
2016-02-22 16:52 - 2004-08-07 08:16 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2016-02-22 16:51 - 2014-04-16 23:06 - 00000178 ___SH C:\Documents and Settings\Thelma Demner\ntuser.ini
2016-02-22 16:51 - 2004-08-07 08:16 - 00032570 _____ C:\WINDOWS\SchedLgU.Txt
2016-02-22 16:39 - 2014-04-21 09:14 - 00000830 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2016-02-22 16:33 - 2004-08-07 08:16 - 00001158 _____ C:\WINDOWS\system32\wpa.dbl
2016-02-20 11:23 - 2014-04-21 08:24 - 00000272 _____ C:\Documents and Settings\NetworkService\Application Data\WB.CFG
2016-02-19 16:23 - 2014-04-16 21:24 - 00000144 _____ C:\Documents and Settings\Thelma Demner\Application Data\WB.CFG
2016-02-19 16:06 - 2014-04-16 23:06 - 00000000 ____D C:\Documents and Settings\Thelma Demner\Local Settings\Application Data\Google
2016-02-19 15:58 - 2014-04-16 21:15 - 00001819 _____ C:\Documents and Settings\All Users\Start Menu\Programs\Google Chrome.lnk
2016-02-19 15:58 - 2014-04-16 21:15 - 00001813 _____ C:\Documents and Settings\All Users\Desktop\Google Chrome.lnk
2016-02-19 14:49 - 2014-04-24 10:27 - 00083839 _____ C:\WINDOWS\system32\LexFiles.ulf

==================== Files in the root of some directories =======

2014-04-16 21:24 - 2016-02-19 16:23 - 0000144 _____ () C:\Documents and Settings\Thelma Demner\Application Data\WB.CFG
2014-04-16 21:39 - 2014-04-16 21:39 - 0003584 _____ () C:\Documents and Settings\Thelma Demner\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-04-16 23:06 - 2014-04-17 07:09 - 0000136 _____ () C:\Documents and Settings\Thelma Demner\Local Settings\Application Data\fusioncache.dat
2014-04-24 10:37 - 2014-04-24 10:37 - 0000089 _____ () C:\Documents and Settings\All Users\lxdx.log
2014-04-24 10:50 - 2014-04-24 10:52 - 0000431 _____ () C:\Documents and Settings\All Users\lxdxDiagnostics.log
2014-04-24 10:49 - 2014-04-24 10:49 - 0000000 _____ () C:\Documents and Settings\All Users\UpdaterLog.txt
2006-02-16 05:02 - 2006-02-16 05:04 - 0000373 _____ () C:\Documents and Settings\All Users\Application Data\hpzinstall.log

Some files in TEMP:
====================
C:\Documents and Settings\Thelma Demner\Local Settings\Temp\AcsInstall.dll
C:\Documents and Settings\Thelma Demner\Local Settings\Temp\AOLFirewallMgr.dll
C:\Documents and Settings\Thelma Demner\Local Settings\Temp\AOLInstallerfw.dll
C:\Documents and Settings\Thelma Demner\Local Settings\Temp\SHFOLDER.DLL
C:\Documents and Settings\Thelma Demner\Local Settings\Temp\sqlite3.dll
C:\Documents and Settings\Thelma Demner\Local Settings\Temp\uninst.dll
C:\Documents and Settings\Thelma Demner\Local Settings\Temp\{9B992FC7-8500-4175-A922-45078D771768}-35.0.1916.153_chrome_installer.exe
C:\Documents and Settings\Thelma Demner\Local Settings\Temp\{A1ECD9F5-B9E9-4BF2-8B68-2F93AE468F44}-41.0.2272.89_chrome_installer.exe

==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed

==================== End of FRST.txt ============================

Addition Log

Additional scan result of Farbar Recovery Scan Tool (x86) Version:21-02-2016 01
Ran by [removed] (2016-02-22 17:28:01)
Running from C:\Documents and Settings\[removed]\Desktop
Microsoft Windows XP Home Edition Service Pack 3 (X86) (2014-04-17 04:05:47)
Boot Mode: Normal
==========================================================

==================== Accounts: =============================

Administrator (S-1-5-21-3680545734-3834015383-3748329811-500 - Administrator - Enabled)
ASPNET (S-1-5-21-3680545734-3834015383-3748329811-1004 - Limited - Enabled)
Guest (S-1-5-21-3680545734-3834015383-3748329811-501 - Limited - Disabled)
HelpAssistant (S-1-5-21-3680545734-3834015383-3748329811-1005 - Limited - Disabled)
SUPPORT_388945a0 (S-1-5-21-3680545734-3834015383-3748329811-1002 - Limited - Disabled)
Thelma Demner (S-1-5-21-3680545734-3834015383-3748329811-1006 - Administrator - Enabled) => %SystemDrive%\Documents and Settings\Thelma Demner

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

5 Card Slingo from Hewlett-Packard Laptops (remove only) (HKLM\…\5DE4D54F-AA79-43A4-9C8A-C173E7E2B025) (Version: - WildTangent)
Adobe Flash Player 11 Plugin (HKLM\…\Adobe Flash Player Plugin) (Version: 11.8.800.94 - Adobe Systems Incorporated)
Adobe Flash Player 13 ActiveX (HKLM\…\Adobe Flash Player ActiveX) (Version: 13.0.0.182 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.08) (HKLM\…\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.08 - Adobe Systems Incorporated)
Athlon 64 Processor Driver (HKLM\…\{C151CE54-E7EA-4804-854B-F515368B0798}) (Version: 1.2.2.2 - )
ATI Control Panel (HKLM\…\{0BEDBD4E-2D34-47B5-9973-57E62B29307C}) (Version: 6.14.10.5171 - )
ATI Display Driver (HKLM\…\ATI Display Driver) (Version: 8.193-051110a1-028580C-HP - )
Bejeweled 2 Deluxe from Hewlett-Packard Laptops (remove only) (HKLM\…\6E377D95-DF37-4E67-B64B-68C314600BCB) (Version: - WildTangent)
Big Kahuna Reef from Hewlett-Packard Laptops (remove only) (HKLM\…\7948472C-423F-4134-B68F-48D660A05D71) (Version: - WildTangent)
Blackhawk Striker 2 from Hewlett-Packard Laptops (remove only) (HKLM\…\384E0BF4-1E1F-45A6-B60E-42144A3F15CD) (Version: - WildTangent)
Blasterball 2 from Hewlett-Packard Laptops (remove only) (HKLM\…\9F3399B2-9ED6-4339-84A2-686432638B86) (Version: - WildTangent)
Boggle Supreme from Hewlett-Packard Laptops (remove only) (HKLM\…\5658FB14-16A4-4DAE-946B-1457BE31572E) (Version: - WildTangent)
Bookworm Deluxe from Hewlett-Packard Laptops (remove only) (HKLM\…\B0769D17-E72A-4E87-A83F-1F7A3F080008) (Version: - WildTangent)
Bounce Symphony from Hewlett-Packard Laptops (remove only) (HKLM\…\7A940E33-6993-404B-ABA6-ED62E8FBE615) (Version: - WildTangent)
Broadcom 802.11 Wireless LAN Adapter (HKLM\…\Broadcom 802.11b Network Adapter) (Version: 4.100.15.5 - Broadcom Corporation)
BufferChm (Version: 60.0.155.000 - Hewlett-Packard) Hidden
Chuzzle Deluxe from Hewlett-Packard Laptops (remove only) (HKLM\…\382C11F0-1A18-4F76-B8E0-15CA7F209C22) (Version: - WildTangent)
Conexant AC-Link Audio (HKLM\…\CNXT_AUDIO) (Version: - )
CP_AtenaShokunin1Config (Version: 60.0.155.000 - Hewlett-Packard) Hidden
CP_CalendarTemplates1 (Version: 60.0.155.000 - Hewlett-Packard) Hidden
cp_LightScribeConfig (Version: 60.0.155.000 - Hewlett-Packard) Hidden
cp_OnlineProjectsConfig (Version: 60.0.155.000 - Hewlett-Packard) Hidden
CP_Package_Basic1 (Version: 60.0.155.000 - Hewlett-Packard) Hidden
CP_Package_Variety1 (Version: 60.0.155.000 - Hewlett-Packard) Hidden
CP_Package_Variety2 (Version: 60.0.155.000 - Hewlett-Packard) Hidden
CP_Package_Variety3 (Version: 60.0.155.000 - Hewlett-Packard) Hidden
CP_Panorama1Config (Version: 60.0.155.000 - Hewlett-Packard) Hidden
cp_PosterPrintConfig (Version: 60.0.155.000 - Hewlett-Packard) Hidden
cp_UpdateProjectsConfig (Version: 60.0.155.000 - Hewlett-Packard) Hidden
Crystal Maze from Hewlett-Packard Laptops (remove only) (HKLM\…\E94C7046-2F7D-4D4D-B76F-C412DCCEAAC2) (Version: - WildTangent)
CueTour (Version: 60.0.155.000 - Hewlett-Packard) Hidden
Customer Experience Enhancement (HKLM\…\InstallShield_{23012310-3E05-46A5-88A9-C6CBCABCAC79}) (Version: Customer Experience Enhancement -1.0.0.1680 - Hewlett-Packard)
Customer Experience Enhancement (Version: Customer Experience Enhancement -1.0.0.1680 - Hewlett-Packard) Hidden
Destinations (Version: 60.0.155.000 - Hewlett-Packard) Hidden
DeviceManagementQFolder (Version: 1.00.0000 - Hewlett-Packard) Hidden
Easy Internet Sign-up (HKLM\…\InstallShield_{8105684D-8CA6-440D-8F58-7E5FD67A499D}) (Version: FE UI-4.1.0.1680 - Hewlett-Packard)
Easy Internet Sign-up (Version: FE UI-4.1.0.1680 - Hewlett-Packard) Hidden
FATE from Hewlett-Packard Laptops (remove only) (HKLM\…\6ECB6EE6-92E1-4525-AF3B-3CE51A7C5F89) (Version: - WildTangent)
Final Drive Nitro from Hewlett-Packard Laptops (remove only) (HKLM\…\320F055A-570F-4335-B026-16A836DB9549) (Version: - WildTangent)
Flip Words from Hewlett-Packard Laptops (remove only) (HKLM\…\F2566CC2-D4C4-44ED-A838-3F8288D8D3FE) (Version: - WildTangent)
FullDPAppQFolder (Version: 1.00.0000 - Hewlett-Packard) Hidden
Google Chrome (HKLM\…\Google Chrome) (Version: 48.0.2564.116 - Google Inc.)
Google Update Helper (Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (Version: 1.3.29.5 - Google Inc.) Hidden
Hoyle Card Games 2005 (HKLM\…\{EE8B9C76-1E07-4C26-8587-8184024FA345}) (Version: 1.0.0.0 - Sierra Entertainment, Inc.)
Hoyle Friday Night Poker (HKLM\…\{25CA5429-86C2-4FA3-B48A-74B0272280A1}) (Version: 2.0.0.0 - Sierra Entertainment, Inc.)
HP DVD Play 2.0 (HKLM\…\{45D707E9-F3C4-11D9-A373-0050BAE317E1}) (Version: - )
HP Game Console and games (HKLM\…\HP Game Console) (Version: - WildTangent)
HP Help and Support (HKLM\…\{A93C4E94-1005-489D-BEAA-B873C1AA6CFC}) (Version: 4.4.0002 - HPQ)
HP Imaging Device Functions 6.0 (HKLM\…\HP Imaging Device Functions) (Version: 6.0 - HP)
HP Photosmart Premier Software 6.0 (HKLM\…\HP Photo & Imaging) (Version: 6.0 - HP)
HP Rhapsody (HKLM\…\HP Rhapsody) (Version: - )
HP Software Update (HKLM\…\{BB85ED9C-AFC9-43BD-B8DC-258C3C7DF72E}) (Version: 3.0.7.006 - HEWLET~1|Hewlett-Packard)
HP User Guides 0025 (HKLM\…\{52AE81CB-B786-490E-93CF-240A9891B392}) (Version: 1.00.0000 - Hewlett-Packard)
HP User Guides–System Recovery (HKLM\…\{BC96BBA7-C634-460E-AD18-A0A994213F80}) (Version: 1.00.0001 - Hewlett-Packard)
HpSdpAppCoreApp (Version: 3.00.0000 - Hewlett-Packard) Hidden
Insaniquarium Deluxe from Hewlett-Packard Laptops (remove only) (HKLM\…\0E5266B4-9069-401A-93AE-5FF9F1712016) (Version: - WildTangent)
InstantShareDevices (Version: 60.0.155.000 - Hewlett-Packard) Hidden
J2SE Runtime Environment 5.0 Update 6 (HKLM\…\{3248F0A8-6813-11D6-A77B-00B0D0150060}) (Version: 1.5.0.60 - Sun Microsystems, Inc.)
Java(TM) 6 Update 45 (HKLM\…\{26A24AE4-039D-4CA4-87B4-2F83216045FF}) (Version: 6.0.450 - Oracle)
Jewel Quest from Hewlett-Packard Laptops (remove only) (HKLM\…\4C061F83-EE92-445A-A03F-184B0BD59242) (Version: - WildTangent)
Lemonade Tycoon 2 from Hewlett-Packard Laptops (remove only) (HKLM\…\E90E3AE9-73E4-4E5C-BB0F-673989A808D0) (Version: - WildTangent)
Lexibox Deluxe from Hewlett-Packard Laptops (remove only) (HKLM\…\5758A0E8-A112-4A1D-82EC-EC72F7F16B88) (Version: - WildTangent)
Lexmark 3600-4600 Series (HKLM\…\Lexmark 3600-4600 Series) (Version: - Lexmark International, Inc.)
LightScribe 1.4.56.1 (Version: 1.4.56.1 - Integrator) Hidden
Mah Jong Quest from Hewlett-Packard Laptops (remove only) (HKLM\…\E76A7EFF-7758-49EE-B3FA-9699830A2D6B) (Version: - WildTangent)
Microsoft .NET Framework 2.0 (HKLM\…\Microsoft .NET Framework 2.0) (Version: - Microsoft Corporation)
Microsoft Money 2006 (HKLM\…\Money2006b) (Version: 15 - Microsoft)
Microsoft Works (HKLM\…\{416D80BA-6F6D-4672-B7CF-F54DA2F80B44}) (Version: 08.04.0623 - Microsoft Corporation)
muvee autoProducer 4.5 (HKLM\…\{286F29AF-0BE2-4D5F-AB17-B7631A810553}) (Version: 4.50.050 - muvee Technologies)
NETGATE Registry Cleaner (HKLM\…\NETGATE Registry Cleaner_is1) (Version: - NETGATE Technologies s.r.o.)
Netscape Browser (remove only) (HKLM\…\Netscape Browser) (Version: - )
Oasis from Hewlett-Packard Laptops (remove only) (HKLM\…\E332F38A-75F6-4EF2-88CC-246E8A1CB5D7) (Version: - WildTangent)
Office 2003 Trial Assistant (HKLM\…\{47D2103B-FD51-4017-9C20-DD408B17D726}) (Version: 1.0.0 - Microsoft)
OptionalContentQFolder (Version: 1.00.0000 - Hewlett-Packard) Hidden
PhotoGallery (Version: 60.0.155.000 - Hewlett-Packard) Hidden
Polar Bowler from Hewlett-Packard Laptops (remove only) (HKLM\…\7F8C5718-1BA9-4AAE-96D2-2B04D05F2D54) (Version: - WildTangent)
Polar Golfer from Hewlett-Packard Laptops (remove only) (HKLM\…\D2E44AA4-8665-4490-A6C9-2D0744B47B27) (Version: - WildTangent)
Puzzle Express from Hewlett-Packard Laptops (remove only) (HKLM\…\EF860173-4FB7-4DE1-8BE8-5400F05A0DC5) (Version: - WildTangent)
RandMap (Version: 60.0.155.000 - Hewlett-Packard) Hidden
SCRABBLE from Hewlett-Packard Laptops (remove only) (HKLM\…\103EFD47-9F2C-4490-95DD-AE6C442AFB92) (Version: - WildTangent)
SkinsHP1 (Version: 60.0.155.000 - Hewlett-Packard) Hidden
Slingo Deluxe from Hewlett-Packard Laptops (remove only) (HKLM\…\C264D692-8E15-4141-96A2-5621332E5DD0) (Version: - WildTangent)
Slyder from Hewlett-Packard Laptops (remove only) (HKLM\…\B0202B33-E73D-4FCD-AC88-0B2971AFC116) (Version: - WildTangent)
Snowboard SuperJam (HKLM\…\DED8E2B5-BA9F-448F-84E8-0AEF79876F95) (Version: 10/14/2005 02:33 PM - WildTangent)
Soft Data Fax Modem with SmartCP (HKLM\…\CNXT_MODEM_PCI_VEN_1002&DEV;_4378) (Version: - )
Sonic Audio Module (HKLM\…\{AB708C9B-97C8-4AC9-899B-DBF226AC9382}) (Version: 2.0.4 - Sonic Solutions)
Sonic Copy Module (HKLM\…\{B12665F4-4E93-4AB4-B7FC-37053B524629}) (Version: 2.0.4 - Sonic Solutions)
Sonic Data Module (HKLM\…\{075473F5-846A-448B-BCB3-104AA1760205}) (Version: 2.0.4 - Sonic Solutions)
Sonic Express Labeler (HKLM\…\{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}) (Version: 2.0.0 - Sonic Solutions)
Sonic MyDVD Plus (HKLM\…\{21657574-BD54-48A2-9450-EB03B2C7FC29}) (Version: 6.2.0 - Sonic Solutions)
Sonic Update Manager (HKLM\…\{30465B6C-B53F-49A1-9EBA-A3F187AD502E}) (Version: 3.0.0 - Sonic Solutions)
Sonic_PrimoSDK (Version: 60.0.155.000 - Hewlett-Packard) Hidden
Super Granny from Hewlett-Packard Laptops (remove only) (HKLM\…\7ED8A70C-9597-40BE-AEA0-0573182F1F51) (Version: - WildTangent)
Synaptics Pointing Device Driver (HKLM\…\SynTPDeinstKey) (Version: 8.0.13.0 - Synaptics)
Texas Instruments PCIxx21/x515/xx12 drivers. (HKLM\…\InstallShield_{7B6CF9EB-CB2B-4A1A-81A9-BE1A9044690A}) (Version: 1.15.0000 - Texas Instruments Inc.)
TIPCI (Version: 1.15.0000 - Texas Instruments Inc.) Hidden
TourSetup (HKLM\…\{A01FC76F-CC09-4658-9E37-5C2F635EE708}) (Version: 1.0.0 - Microsoft)
Tradewinds from Hewlett-Packard Laptops (remove only) (HKLM\…\1C3FDBBA-EBF7-4CDB-AD8A-A1125734AF86) (Version: - WildTangent)
Unload (Version: 6.0.0 - Hewlett-Packard) Hidden
VNC Mirror Driver 1.8.0 (HKLM\…\VNCMirror_is1) (Version: 1.8.0 - RealVNC Ltd.)
VNC Printer Driver 1.8.0 (HKLM\…\VNCPrinter_is1) (Version: 1.8.0 - RealVNC Ltd.)
VNC Server 5.0.4 (HKLM\…\RealVNC_is1) (Version: 5.0.4 - RealVNC Ltd)
VNC Viewer 5.0.4 (HKLM\…\RealVNCViewer_is1) (Version: 5.0.4 - RealVNC Ltd)
WebFldrs XP (Version: 9.50.7523 - Microsoft Corporation) Hidden
Windows Internet Explorer 8 (HKLM\…\ie8) (Version: 20090308.140743 - Microsoft Corporation)
Windows Media Format Runtime (HKLM\…\Windows Media Format Runtime) (Version: - )
Windows Media Player 10 (HKLM\…\Windows Media Player) (Version: - )
Windows XP Service Pack 3 (HKLM\…\Windows XP Service Pack) (Version: 20080414.031525 - Microsoft Corporation)
Wireless Home Network Setup (HKLM\…\{09D8492A-C8E2-421E-927D-46800FB327A3}) (Version: 1.1.19.0 - Hewlett-Packard)
Zuma Deluxe from Hewlett-Packard Laptops (remove only) (HKLM\…\074EEF5F-3BE8-4112-B253-C5D6CDE2924C) (Version: - WildTangent)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe

==================== Shortcuts =============================

(The entries could be listed to be restored or removed.)

==================== Loaded Modules (Whitelisted) ==============

2014-04-24 10:34 - 2008-02-27 19:15 - 00115200 _____ () C:\WINDOWS\System32\spool\PRTPROCS\W32X86\lxdxdrpp.dll
2014-04-24 10:34 - 2008-02-27 19:10 - 00811008 _____ () C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\lxdxptpc.dll
2014-04-24 10:34 - 2008-02-27 19:15 - 00148992 _____ () C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\lxdxdrui.dll
2014-04-24 10:34 - 2008-02-27 19:15 - 00195072 _____ () C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\lxdxdr.dll
2014-04-24 10:34 - 2008-01-28 23:40 - 01339392 _____ () C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\lxdxHPEC.DLL
2014-04-24 10:34 - 2008-02-27 19:02 - 00589824 _____ () C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\lxdxdatr.dll
2006-02-16 05:42 - 2005-12-12 14:39 - 00167936 _____ () C:\Program Files\HP\QuickPlay\Kernel\common\CLDataSync.dll
2014-04-24 10:32 - 2008-06-13 11:04 - 00668328 _____ () C:\Program Files\Lexmark 3600-4600 Series\lxdxmon.exe
2014-04-24 10:32 - 2008-06-13 10:11 - 00380928 _____ () C:\Program Files\Lexmark 3600-4600 Series\lxdxscw.dll
2014-04-24 10:34 - 2008-02-27 19:02 - 00589824 _____ () C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdxdatr.dll
2014-04-24 10:34 - 2008-02-27 19:02 - 00073728 _____ () C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdxcats.dll
2014-04-24 10:32 - 2008-06-13 10:11 - 00782336 _____ () C:\Program Files\Lexmark 3600-4600 Series\lxdxDRS.dll
2014-04-24 10:32 - 2008-06-13 10:11 - 00081920 _____ () C:\Program Files\Lexmark 3600-4600 Series\lxdxcaps.dll
2014-04-24 10:32 - 2008-06-13 10:03 - 00069632 _____ () C:\Program Files\Lexmark 3600-4600 Series\lxdxcnv4.dll
2014-04-24 10:32 - 2008-06-13 11:04 - 00025256 _____ () C:\Program Files\Lexmark 3600-4600 Series\lxdxMsdMon.exe
2014-04-24 10:32 - 2008-02-27 18:40 - 00028672 _____ () C:\Program Files\Lexmark 3600-4600 Series\App4R.Monitor.Common.dll
2014-04-24 10:32 - 2008-02-27 18:40 - 00036864 _____ () C:\Program Files\Lexmark 3600-4600 Series\App4R.Monitor.Core.dll
2014-04-24 10:32 - 2008-02-27 18:40 - 00061440 _____ () C:\Program Files\Lexmark 3600-4600 Series\app4r.devmons.mcmdevmon.dll
2014-04-24 10:32 - 2007-11-22 11:55 - 00011776 _____ () C:\Program Files\Lexmark 3600-4600 Series\app4r.devmons.mcmdevmon.autoplayutil.dll
2006-02-16 04:50 - 2006-02-16 04:50 - 03379200 _____ () c:\windows\assembly\nativeimages1_v1.1.4322\mscorlib\1.0.5000.0__b77a5c561934e089_8dc0e193\mscorlib.dll
2006-02-16 04:50 - 2006-02-16 04:50 - 03014656 _____ () c:\windows\assembly\nativeimages1_v1.1.4322\system.windows.forms\1.0.5000.0__b77a5c561934e089_8e1a4dec\system.windows.forms.dll
2006-02-16 04:50 - 2006-02-16 04:50 - 00835584 _____ () c:\windows\assembly\nativeimages1_v1.1.4322\system.drawing\1.0.5000.0__b03f5f7f11d50a3a_3d77ff9a\system.drawing.dll
2006-02-16 04:50 - 2006-02-16 04:50 - 01953792 _____ () c:\windows\assembly\nativeimages1_v1.1.4322\system\1.0.5000.0__b77a5c561934e089_bf3a4b31\system.dll
2006-02-16 04:50 - 2006-02-16 04:50 - 02088960 _____ () c:\windows\assembly\nativeimages1_v1.1.4322\system.xml\1.0.5000.0__b77a5c561934e089_559ffaa6\system.xml.dll
2004-08-04 03:00 - 2008-04-14 04:41 - 00059904 _____ () C:\WINDOWS\system32\devenum.dll
2004-08-04 03:00 - 2008-04-14 04:42 - 00014336 _____ () C:\WINDOWS\system32\msdmo.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" value will be restored.)

==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)

==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2004-08-04 03:00 - 2004-08-04 03:00 - 00000734 ____A C:\WINDOWS\system32\Drivers\etc\hosts

127.0.0.1 localhost

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-3680545734-3834015383-3748329811-1006\Control Panel\Desktop\\Wallpaper ->
DNS Servers: 75.75.75.75 - 75.75.76.76
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

StandardProfile\AuthorizedApplications: [C:\Program Files\EarthLink TotalAccess\TaskPanl.exe] => Enabled:Earthlink
StandardProfile\AuthorizedApplications: [C:\Program Files\RealVNC\VNC Server\vncserver.exe] => Enabled:VNC Server
StandardProfile\AuthorizedApplications: [C:\Program Files\Common Files\AOL\acs\AOLDial.exe] => Enabled:AOL Connectivity Service Dialer
StandardProfile\AuthorizedApplications: [C:\Program Files\Common Files\AOL\acs\AOLacsd.exe] => Enabled:AOL Connectivity Service
StandardProfile\AuthorizedApplications: [C:\Program Files\Common Files\AOL\1398089556\ee\aolsoftware.exe] => Enabled:AOL Shared Components
StandardProfile\AuthorizedApplications: [C:\Program Files\AOL Desktop 9.7\waol.exe] => Enabled:AOL
StandardProfile\AuthorizedApplications: [C:\Program Files\Common Files\AOL\TopSpeed\3.0\aoltpsd3.exe] => Enabled:AOL TopSpeed
StandardProfile\AuthorizedApplications: [C:\Program Files\Common Files\AOL\Loader\aolload.exe] => Enabled:AOL Loader
StandardProfile\AuthorizedApplications: [C:\Program Files\Common Files\AOL\System Information\sinf.exe] => Enabled:AOL System Information
StandardProfile\AuthorizedApplications: [C:\Program Files\AOL Desktop 9.7\aolbrowser.exe] => Enabled:AOL Browser
StandardProfile\AuthorizedApplications: [C:\WINDOWS\system32\lxdxcoms.exe] => Enabled:3600-4600 Series Server
StandardProfile\AuthorizedApplications: [C:\Program Files\Lexmark 3600-4600 Series\lxdxmon.exe] => Enabled:Printer Device Monitor
StandardProfile\AuthorizedApplications: [C:\WINDOWS\system32\lxdxcfg.exe] => Enabled:Printer Communication System
StandardProfile\AuthorizedApplications: [C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdxpswx.exe] => Enabled:Printer Status Window Interface
StandardProfile\AuthorizedApplications: [C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdxtime.exe] => Enabled:Lexmark Connect Time Executable
StandardProfile\AuthorizedApplications: [C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdxjswx.exe] => Enabled:Job Status Window Interface
StandardProfile\AuthorizedApplications: [C:\Program Files\Lexmark 3600-4600 Series\Diagnostics\LXDXdiag.exe] => Enabled:
StandardProfile\AuthorizedApplications: [C:\Program Files\Google\Chrome\Application\chrome.exe] => Enabled:Google Chrome
StandardProfile\AuthorizedApplications: [C:\Program Files\Lexmark 3600-4600 Series\Wireless\lxdxwpss.exe] => Enabled:
StandardProfile\AuthorizedApplications: [C:\Program Files\AOL Desktop 9.8.0\waol.exe] => Enabled:AOL
StandardProfile\AuthorizedApplications: [C:\Documents and Settings\Thelma Demner\Local Settings\Temp\lxdx\wireless\lxdxwpss.exe] => Enabled:

==================== Restore Points =========================

05-01-2016 16:37:17 System Checkpoint
19-02-2016 15:07:03 System Checkpoint
20-02-2016 15:34:00 System Checkpoint
22-02-2016 17:04:43 JRT Pre-Junkware Removal

==================== Faulty Device Manager Devices =============

==================== Event log errors: =========================

Application errors:
==================
Error: (10/23/2015 04:12:05 PM) (Source: crypt32) (EventID: 8) (User: )
Description: Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>with error: The specified server cannot perform the requested operation.

Error: (10/23/2015 04:12:05 PM) (Source: crypt32) (EventID: 8) (User: )
Description: Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>with error: The specified server cannot perform the requested operation.

Error: (10/23/2015 04:12:05 PM) (Source: crypt32) (EventID: 8) (User: )
Description: Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>with error: The specified server cannot perform the requested operation.

Error: (10/23/2015 04:12:05 PM) (Source: crypt32) (EventID: 8) (User: )
Description: Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>with error: The specified server cannot perform the requested operation.

Error: (10/23/2015 04:12:05 PM) (Source: crypt32) (EventID: 8) (User: )
Description: Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>with error: The specified server cannot perform the requested operation.

Error: (10/23/2015 04:12:05 PM) (Source: crypt32) (EventID: 8) (User: )
Description: Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>with error: The specified server cannot perform the requested operation.

Error: (10/23/2015 04:12:05 PM) (Source: crypt32) (EventID: 8) (User: )
Description: Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>with error: The specified server cannot perform the requested operation.

Error: (10/23/2015 04:12:05 PM) (Source: crypt32) (EventID: 8) (User: )
Description: Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>with error: The specified server cannot perform the requested operation.

Error: (10/23/2015 04:12:05 PM) (Source: crypt32) (EventID: 8) (User: )
Description: Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>with error: The specified server cannot perform the requested operation.

Error: (10/23/2015 04:12:05 PM) (Source: crypt32) (EventID: 8) (User: )
Description: Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>with error: The specified server cannot perform the requested operation.

System errors:
=============
Error: (02/22/2016 04:53:47 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: The following boot-start or system-start driver(s) failed to load:
eabfiltr

Error: (02/22/2016 04:50:19 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The Application Layer Gateway Service service terminated unexpectedly. It has done this 1 time(s).

Error: (02/22/2016 04:50:19 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The hpqwmiex service terminated unexpectedly. It has done this 1 time(s).

Error: (02/22/2016 04:50:19 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The VNC Server service terminated unexpectedly. It has done this 1 time(s).

Error: (02/22/2016 04:50:19 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The NETGATE Registry Cleaner Service service terminated unexpectedly. It has done this 1 time(s).

Error: (02/22/2016 04:50:19 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The Windows User Mode Driver Framework service terminated unexpectedly. It has done this 1 time(s).

Error: (02/22/2016 04:50:19 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The lxdx_device service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.

Error: (02/22/2016 04:50:19 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The LightScribeService Direct Disc Labeling Service service terminated unexpectedly. It has done this 1 time(s).

Error: (02/22/2016 04:50:18 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Print Spooler service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.

Error: (02/22/2016 04:50:18 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The Java Quick Starter service terminated unexpectedly. It has done this 1 time(s).

==================== Memory info ===========================

Processor: Mobile AMD Sempron™ Processor 3300+
Percentage of memory in use: 80%
Total physical RAM: 382.17 MB
Available physical RAM: 75.34 MB
Total Virtual: 919.33 MB
Available Virtual: 429.36 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:48.47 GB) (Free:32.38 GB) NTFS ==>[drive with boot components (Windows XP)]
Drive d: (PRESARIO_RP) (Fixed) (Total:7.39 GB) (Free:0.93 GB) FAT32 ==>[drive with boot components (Windows XP)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 55.9 GB) (Disk ID: 94E494E4)
Partition 1: (Active) - (Size=48.5 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=7.4 GB) - (Type=0C)

==================== End of Addition.txt ============================

Satchfan

Post #6February 23, 2016, 9:57 AM UTC

Though I have another problem which I posted in my first post.
When I try to reach WTT's website I receive the following message:
"This website is not available.
ERR SSL VERSION OR CIPHER MISMATCH
A secure connection cannot be established because the site uses an unsupported protocol or sipher suite.
This is likely to be caused when the server needs RC4, which is no longer considered secure.

I mentioned in my first reply that this is likely a Chrome issue which is why I suggested trying Firefox.

There wasn’t any sign of infection in your logs but AdwCleaner did clear up some adware.Let’s tidy up what was found and have a further look.

===================================================

Registry cleaners

I see you are using a “Registry Cleaner”, NETGATE Registry Cleaner. It's not a good idea to use registry cleaners/boosters.

The usefulness of cleaning the registry is highly overrated and can be dangerous. In most cases, using a cleaner to remove obsolete, invalid and erroneous entries does not affect system performance but it can result in "unpredictable results". Unless you have a particular problem that requires a registry edit to correct it, (and you are expert in the registry), I would suggest you leave the registry alone.

I strongly advise you to get rid of NETGATE Registry Cleaner and any other cleaner/optimizer/booster/tuneup/tweak type utilities that you have on this or any other computer.

One of the malware experts, miekiemoes, has an excellent write-up here
Another from quietman7 here

===================================================

Run Farbar Recovery Scan Tool

Open notepad (Start >All Programs > Accessories > Notepad). Please copy the entire contents of the code box below and paste it into Notepad.

HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURLs,Tabs: "hxxp://www.google.com" <======= ATTENTION
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
Toolbar: HKU\S-1-5-21-3680545734-3834015383-3748329811-1006 -> No Name - {C4069E3A-68F1-403E-B40E-20066696354B} - No File
Toolbar: HKU\S-1-5-21-3680545734-3834015383-3748329811-1006 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
R2 NGRegClnSrv; C:\Program Files\NETGATE\Registry Cleaner\RegistryCleanerSrv.exe [473424 2013-02-21] (NETGATE Technologies s.r.o.)
S1 eabfiltr; \??\C:\WINDOWS\system32\drivers\EABFiltr.sys [X]
S3 wanatw; system32\DRIVERS\wanatw4.sys [X]
U1 WS2IFSL; no ImagePath
EmptyTemp:

NOTE: this script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

save the files as fixlist.txt in the same folder as FRST – NOTE: It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work
run FRST then click Fix just once and wait
it will create a log (Fixlog.txt); please post it to your reply.

================================================

Run Security Check

Download Security Check by screen317 from here or here.

save it to your Desktop.
double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
a Notepad document should open automatically called checkup.txt; please post the contents of that document.

NOTE: If you get the following message: UNSUPPORTED OPERATING SYSTEM! ABORTED!, try rebooting the system and then run SecurityCheck again.

Logs to include with next post:

Fixlog.txt
checkup.txt

Thanks

rockaway1

Post #7February 23, 2016, 4:47 PM UTC

Thanks for your help.

Here are the logs.

Fixlog

Results of screen317's Security Check version 1.014 — 12/23/15
Windows XP Service Pack 3 x86
Internet Explorer 8
``````````````Antivirus/Firewall Check:``````````````
Windows Security Center service is not running! This report may not be accurate!
Windows Firewall Enabled!
`````````Anti-malware/Other Utilities Check:`````````
Java(TM) 6 Update 45
Java version 32-bit out of Date!
Adobe Flash Player 11.8.800.94 Flash Player out of Date!
Adobe Reader XI
Mozilla Firefox (43.0.1)
Google Chrome (47.0.2526.106)
Google Chrome (48.0.2564.116)
````````Process Check: objlist.exe by Laurent````````
`````````````````System Health check`````````````````
Total Fragmentation on Drive C:: 5%
````````````````````End of Log``````````````````````

Checkup Log

rockaway1

Post #8February 23, 2016, 4:50 PM UTC

Sorry I posted the same checkup log twice.

This is the Fixlog.

Fix result of Farbar Recovery Scan Tool (x86) Version:21-02-2016 01
Ran by [removed] (2016-02-23 11:10:20) Run:1
Running from C:\Documents and Settings\[removed]\Desktop
[removed] Boot Mode: Normal

==============================================

fixlist content:
*****************
HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURLs,Tabs: "hxxp://www.google.com" <======= ATTENTION
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
Toolbar: HKU\S-1-5-21-3680545734-3834015383-3748329811-1006 -> No Name - {C4069E3A-68F1-403E-B40E-20066696354B} - No File
Toolbar: HKU\S-1-5-21-3680545734-3834015383-3748329811-1006 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
R2 NGRegClnSrv; C:\Program Files\NETGATE\Registry Cleaner\RegistryCleanerSrv.exe [473424 2013-02-21] (NETGATE Technologies s.r.o.)
S1 eabfiltr; \??\C:\WINDOWS\system32\drivers\EABFiltr.sys [X]
S3 wanatw; system32\DRIVERS\wanatw4.sys [X]
U1 WS2IFSL; no ImagePath
EmptyTemp:
*****************

HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURLs\\Tabs => value restored successfully
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value restored successfully
HKU\S-1-5-21-3680545734-3834015383-3748329811-1006\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{C4069E3A-68F1-403E-B40E-20066696354B} => value removed successfully.
HKCR\CLSID\{C4069E3A-68F1-403E-B40E-20066696354B} => key not found.
HKU\S-1-5-21-3680545734-3834015383-3748329811-1006\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} => value removed successfully.
HKCR\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F} => key not found.
NGRegClnSrv => service not found.
eabfiltr => service removed successfully.
wanatw => service removed successfully.
WS2IFSL => service removed successfully.
EmptyTemp: => 3 GB temporary data Removed.

The system needed a reboot.

==== End of Fixlog 11:11:11 ====

Satchfan

Post #9February 23, 2016, 5:28 PM UTC

Download Malwarebytes-Anti-Malware

Click here.

double-click mbam-setup.exe and follow the prompts to install the program – (Note: Vista & Windows 7 users, please right-click and select “Run as Administrator”)
select the “Scan” tab at the top
there are three scan types; choose Threat Scan, then click on Scan
when the scan is complete, if no malicious items are found you can close the program
if malicious items are found be sure that everything is checked and click Quarantine
when removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below)
the log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
copy and paste the contents of that report in your next reply and exit MBAM.

NOTE: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

When you post the log, an you tell me if you have installed Firefox and how the computer is running.

Satchfan

rockaway1

Post #10February 24, 2016, 5:18 AM UTC

Firefox does run better than IE and Chrome.

I've been able to connect with all URLS.

I'll let you know more in my next post.

I had a little trouble with the "quarantine" because there wasn't a button called "quarantine".

So I clicked the "remove" button and MBAM did state the 16 problems where quarantined.

Also, the log file didn't open so I went to the logs tab which showed the location of the files, but I couldn't find that folder.

I'm assuming it was hidden.

But I could export the log file to a txt file so I did. I hope this is the file you need to see.

Please let me know how it looks.

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 2/23/2016
Scan Time: 11:16:53 PM
Logfile: mbam log.txt
Administrator: Yes

Version: 2.2.0.1024
Malware Database: v2016.02.24.01
Rootkit Database: v2016.02.17.01
License: Trial
Malware Protection: Enabled
Malicious Website Protection: Enabled
Self-protection: Disabled

OS: Windows XP Service Pack 3
CPU: x86
File System: NTFS
User: Thelma Demner

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 294416
Time Elapsed: 23 min, 55 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 8
PUP.Optional.MySearchDial, HKU\S-1-5-21-3680545734-3834015383-3748329811-1006\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{77AA745B-F4F8-45DA-9B14-61D2D95054C8}, Quarantined, [364b075dabee0a2c665115925ca6fd03],
PUP.Optional.MySearchDial, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{77AA745B-F4F8-45DA-9B14-61D2D95054C8}, Quarantined, [364b075dabee0a2c665115925ca6fd03],
PUP.Optional.MySearchDial, HKLM\SOFTWARE\CLASSES\mysearchdial.mysearchdialdskBnd, Quarantined, [e99890d4d5c4a096f0c66c3bd929c937],
PUP.Optional.MySearchDial, HKLM\SOFTWARE\CLASSES\mysearchdial.mysearchdialdskBnd.1, Quarantined, [b3cee87c7920a4920aac9116e81a4cb4],
PUP.Optional.MySearchDial, HKLM\SOFTWARE\CLASSES\esrv.mysearchdialESrvc, Quarantined, [6819eb796f2a191d06b36a3dff0354ac],
PUP.Optional.MySearchDial, HKLM\SOFTWARE\CLASSES\esrv.mysearchdialESrvc.1, Quarantined, [f78a392b45548fa7ae0bf2b55ba7a25e],
PUP.Optional.MySearchDial, HKLM\SOFTWARE\CLASSES\mysearchdial.mysearchdialHlpr, Quarantined, [5a27b6ae1782f145b505e5c257ab39c7],
PUP.Optional.MySearchDial, HKLM\SOFTWARE\CLASSES\mysearchdial.mysearchdialHlpr.1, Quarantined, [5a274a1a37628ea8b1093c6be71b5fa1],

Registry Values: 0
(No malicious items detected)

Registry Data: 1
PUM.Optional.DisableStartMenuLogOff, HKU\S-1-5-21-3680545734-3834015383-3748329811-1006\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\ADVANCED|StartMenuLogoff, 1, Good: (0), Bad: (1),Replaced,[bac766feafeadc5aa8e2f105f212bc44]

Folders: 1
PUP.Optional.Updater, C:\Documents and Settings\NetworkService\Application Data\UpdaterEX\UpdateProc, Quarantined, [364ba1c3c6d33cfa0bca78773ec44fb1],

Files: 6
PUP.Optional.DealPly, C:\Documents and Settings\NetworkService\Application Data\UpdaterEX\UpdateProc\UpdateTask.exe, Quarantined, [4f32194b0b8e39fdeece09fd09f8e41c],
Adware.Finix, C:\Documents and Settings\Thelma Demner\My Documents\Downloads\Comcast_Desktop_Software_1401.exe, Quarantined, [8df4dd8778212c0a4c5720e3c93955ab],
PUP.Optional.Updater, C:\Documents and Settings\NetworkService\Application Data\UpdaterEX\UpdateProc\config.dat, Quarantined, [364ba1c3c6d33cfa0bca78773ec44fb1],
PUP.Optional.Updater, C:\Documents and Settings\NetworkService\Application Data\UpdaterEX\UpdateProc\info.dat, Quarantined, [364ba1c3c6d33cfa0bca78773ec44fb1],
PUP.Optional.Updater, C:\Documents and Settings\NetworkService\Application Data\UpdaterEX\UpdateProc\STTL.DAT, Quarantined, [364ba1c3c6d33cfa0bca78773ec44fb1],
PUP.Optional.Updater, C:\Documents and Settings\NetworkService\Application Data\UpdaterEX\UpdateProc\TTL.DAT, Quarantined, [364ba1c3c6d33cfa0bca78773ec44fb1],

Physical Sectors: 0
(No malicious items detected)

(end)

Satchfan

Post #11February 24, 2016, 9:31 AM UTC

I’m glad Firefox is proving to work OK and well done on getting it all sorted with MBAM, (I’ll have to revise my instructions).

Let’s run an online scan to be sure nothing is left.

Run ESET Online Scan

Note: This may take a long time so please be patient.

IMPORTANT Please make sure you uncheck the box next to Remove found threats. Eset will detect anything that looks even slightly suspicious, which could include legitimate program files. If you do not uncheck the box, Eset will automatically remove all suspicious files which could leave some of your software inoperable.

Note: You can use Internet Explorer, FireFox or Chrome for this scan. You will however need to disable your current installed Anti-Virus, how to do so can be read here.

Hold down Control and click on the following link to open ESET OnlineScan in a new window.

ESET OnlineScan

click the Run Eset online Scanner button
for alternate browsers only: (Microsoft Internet Explorer users can skip these steps)

o click on esetinstaller_enu.exe to download the ESET Smart Installer. Save it to your desktop.
o double click on the Eset installer icon on your desktop.
check Yes, I accept the Terms of Use
click the Start button
accept any security warnings from your browser
check Enable detection of potentially unwanted applications
click Advanced settings and select the following:

o   scan archives
o   scan for potentially unsafe applications
o   enable Anti-Stealth technology

Note: Do not check Remove found threats
ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
when the scan completes, push List of found threats
push Export to Text file and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.

Note - if ESET doesn't find any threats, no report will be created.
push the back button.
push Finish

When the scan is complete:

If no threats were found:

o   put a checkmark in "Uninstall application on close"
o   close program
o   report to me that nothing was found.

If threats were found:

o   click on "list of threats found"
o   click on "export to text file" and save it as ESET results and save to the desktop
o   click on back
o   put a checkmark in "Uninstall application on close"
o   click on finish
o   close program
o   copy and paste the report here.

Thanks

Satchfan

rockaway1

Post #12February 24, 2016, 5:18 PM UTC

Thanks for your help.

Here's the ESETScan log

C:\AdwCleaner\Quarantine\C\Documents and Settings\Thelma Demner\Application Data\Mysearchdial\UpdateProc\UpdateTask.exe.vir   a variant of Win32/DealPly.S potentially unwanted application
C:\AdwCleaner\Quarantine\C\Documents and Settings\Thelma Demner\Application Data\UpdaterEX\UpdateProc\UpdateTask.exe.vir   a variant of Win32/DealPly.O potentially unwanted application
C:\AdwCleaner\Quarantine\C\Program Files\BrowseMark\BrowseMark.FirstRun.exe.vir   a variant of MSIL/BrowseFox.D potentially unwanted application
C:\AdwCleaner\Quarantine\C\Program Files\BrowseMark\BrowseMarkBHO.dll.vir   a variant of Win32/BrowseFox.F potentially unwanted application
C:\AdwCleaner\Quarantine\C\Program Files\BrowseMark\BrowseMarkUninstall.exe.vir   Win32/BrowseFox.DC potentially unwanted application
C:\AdwCleaner\Quarantine\C\Program Files\BrowseMark\updateBrowseMark.exe.vir   a variant of Win32/BrowseFox.H potentially unwanted application
C:\AdwCleaner\Quarantine\C\Program Files\Mysearchdial\1.8.29.0\mysearchdialApp.dll.vir   a variant of Win32/Toolbar.Montiera.A potentially unwanted application
C:\AdwCleaner\Quarantine\C\Program Files\Mysearchdial\1.8.29.0\mysearchdialEng.dll.vir   a variant of Win32/Toolbar.Montiera.A potentially unwanted application
C:\AdwCleaner\Quarantine\C\Program Files\Mysearchdial\1.8.29.0\mysearchdialsrv.exe.vir   a variant of Win32/Toolbar.Montiera.A potentially unwanted application
C:\AdwCleaner\Quarantine\C\Program Files\Mysearchdial\1.8.29.0\mysearchdialTlbr.dll.vir   a variant of Win32/Toolbar.Montiera.F potentially unwanted application
C:\AdwCleaner\Quarantine\C\Program Files\Mysearchdial\1.8.29.0\uninstall.exe.vir   a variant of Win32/InstallCore.ACJ potentially unwanted application
C:\AdwCleaner\Quarantine\C\Program Files\Mysearchdial\1.8.29.0\bh\mysearchdial.dll.vir   a variant of Win32/Toolbar.Escort.A potentially unwanted application

Satchfan

Post #13February 24, 2016, 5:23 PM UTC last edited February 24, 2016, 5:25 PM UTC

That looks good as the result is only reporting what has already been quarantined: whatever is in these folders can't cause any harm and will be removed when we tidy up.

Are there any oustanding problems?

rockaway1

Post #14February 24, 2016, 6:53 PM UTC

Thanks for your help.
The only concern was Malwarebytes which was running in the background.
Based upon what I saw in task manager it was hogging ram and slowing down foxfire to a crawl. I deleted Malwarebytes and it solved the problem.
What's my next step? Do you suggest an antivirus?
Thanks
JB

Satchfan

Post #15February 24, 2016, 10:53 PM UTC last edited February 24, 2016, 10:53 PM UTC

Malwarebytes which was running in the background

Malwarebytes is a program that nobody should be without on their computer but, that constant running process can be stopped. Malwarebytes doesn’t run automatically in the background unless you installed the trial version, (or paid for the full version). If it is the standard unpaid-for version, it only runs when you launch it and click the Scan button.

I suggest you uninstall it and download it again. Check the install process and at the end, uncheck Enable free trial of Malwarebytes Anti-Malware Premium during the final stage of installation. Let me know how if you have any questions.

Do you suggest an antivirus?

That is an unquestionable necessity which I'll include when we finish up here.

.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Slow or no internet access: 9YO XP Machine [Solved]

✨ Ask AI

Ask AI