What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Viruses/Maleware (possible game site) - Cake Mania

9 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1 last edited

Hi, this is my sisters computer and i am trying to fix it. I actually plan on rebuilding the entire computer and formatting the hard drive so a FULL virus removal diagnostic is not necessary this time. All i want to find out is where these infections she got came from. There is a certain game online that she loves called "Cake Mania", i believe this to be the culprit but i am not sure. There are other associated game add-on's that she was not aware of.

 

Anyways how ever she downloaded these files, obviously came with some sort of bundle packed with other files that are malicious. After doing some research, it appears Cake mania is used as one of the top leading add-on's for advertising purposes so i can understand this being used an exploit for the nasty stuff.

 

Some information i read here

 

http://www.solvusoft.com/en/files/error-virus-removal/exe/windows/wildtangent-inc/third-party-application/cake-mania-wt-exe/

 

I can't verify the legitimacy of this website, just some information i found. After thorough researching on the web, i found other sources as well relating to Cake mania being an exe program that infects the computer. So i am going to give you a full log scan of FRST and i want you to look through the logs and let me know if any of the maleware/viruses that are installed on this machine, originated from any of these "video game" websites she visited.

 

She pleads to me that they are legitimate and nothing is wrong, but she does not know that much bout how viruses work. Once gain i am not looking for a thurough removal procedure, because i think it will be a waste of time since i am going to format the computer anyways. I just want to see where these viruses came from so i can relay the information to her and to stay away from these certain Game links.

 

Just want to add one more thing is that there appears to be a Folder on the desktop with no title and i can't even open it. I am sure this part of the maleware or virus infection.

 

 

Here is the scan:

 

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:21-02-2016 01
Ran by [removed] (administrator) on ASHLEY-PC (21-02-2016 15:49:51)
Running from C:\Users\[removed]\Desktop
[removed] Platform: Windows 7 Home Premium Service Pack 1 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(Emsisoft GmbH) C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe
(AMD) C:\Windows\System32\atieclxx.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
() C:\Program Files (x86)\Canon\IJPLM\ijplmsvc.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe
(RealNetworks, Inc.) C:\Program Files (x86)\Online Games Manager\ogmservice.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(CANON INC.) C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(© 2015 Microsoft Corporation) C:\Users\Ashley\AppData\Local\Microsoft\BingSvc\BingSvc.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.11.266\SSScheduler.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(CANON INC.) C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Microsoft Corporation) C:\Windows\splwow64.exe
(Emsisoft GmbH) C:\Program Files (x86)\Emsisoft Anti-Malware\a2wizard.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(RealNetworks, Inc.) C:\Windows\Temp\ogmtmp\Installer_cakemanialightscameraaction.exe


==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\…\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6548112 2012-06-11] (Realtek Semiconductor)
HKLM\…\Run: [CanonMyPrinter] => C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [2780776 2011-07-19] (CANON INC.)
HKLM\…\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2655520 2015-10-11] (NVIDIA Corporation)
HKLM\…\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM-x32\…\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2012-02-01] (Intel Corporation)
HKLM-x32\…\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291648 2012-05-20] (Intel Corporation)
HKLM-x32\…\Run: [CanonSolutionMenuEx] => C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE [1637496 2011-08-04] (CANON INC.)
HKLM-x32\…\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM-x32\…\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [596528 2015-12-22] (Oracle Corporation)
HKLM-x32\…\Run: [emsisoft anti-malware] => C:\Program Files (x86)\Emsisoft Anti-Malware\a2guard.exe [4997872 2014-12-31] (Emsisoft GmbH)
HKU\S-1-5-21-4195748419-181399314-3423926611-1000\…\Run: [BingSvc] => C:\Users\Ashley\AppData\Local\Microsoft\BingSvc\BingSvc.exe [144008 2015-11-11] (© 2015 Microsoft Corporation)
HKU\S-1-5-21-4195748419-181399314-3423926611-1000\…\RunOnce: [Application Restart #2] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [746648 2016-02-17] (Google Inc.)
HKU\S-1-5-21-4195748419-181399314-3423926611-1000\…\MountPoints2: {48961b91-3c99-11e5-9798-806e6f6e6963} - D:\Bin\ASSETUP.exe
ShellIconOverlayIdentifiers: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  No File
ShellIconOverlayIdentifiers: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} =>  No File
ShellIconOverlayIdentifiers: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} =>  No File
ShellIconOverlayIdentifiers: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  No File
ShellIconOverlayIdentifiers: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  No File
ShellIconOverlayIdentifiers-x32: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => C:\Users\Ashley\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\FileSyncShell.dll No File
ShellIconOverlayIdentifiers-x32: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} => C:\Users\Ashley\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\FileSyncShell.dll No File
ShellIconOverlayIdentifiers-x32: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} => C:\Users\Ashley\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\FileSyncShell.dll No File
ShellIconOverlayIdentifiers-x32: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => C:\Users\Ashley\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\FileSyncShell.dll No File
ShellIconOverlayIdentifiers-x32: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => C:\Users\Ashley\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\FileSyncShell.dll No File
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk [2015-12-17]
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.11.266\SSScheduler.exe (McAfee, Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Hosts: 0.0.0.1    mssplus.mcafee.com
Tcpip\Parameters: [DhcpNameServer] 192.168.44.1
Tcpip\..\Interfaces\{362EA565-D35C-4F42-A3AC-18C56AF1E554}: [DhcpNameServer] 192.168.44.1

Internet Explorer:
==================
HKU\S-1-5-21-4195748419-181399314-3423926611-1000\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxps://mysearch.avg.com/?cid={22F71FDD-EED0-4376-A556-38B69B8996BC}∣=3df3132073a347cdaa4431760f8a11c1-18856f0179efd7d73730d2ac1badce504c3e49c5⟨=en&ds;=AVG&coid;=avgtbavg&cmpid;=0915avt≺=fr&d;=2015-09-08 18:53:56&v;=4.1.6.294&pid;=wtu&sg;=&sap;=hp
SearchScopes: HKU\S-1-5-21-4195748419-181399314-3423926611-1000 -> DefaultScope {95B7759C-8C7F-4BF1-B163-73684A933233} URL = hxxps://mysearch.avg.com/search?cid={22F71FDD-EED0-4376-A556-38B69B8996BC}∣=3df3132073a347cdaa4431760f8a11c1-18856f0179efd7d73730d2ac1badce504c3e49c5⟨=en&ds;=AVG&coid;=avgtbavg&cmpid;=0915tb≺=fr&d;=2015-09-08 18:53:56&v;=4.1.6.294&pid;=wtu&sg;=&sap;=dsp&q;={searchTerms}
SearchScopes: HKU\S-1-5-21-4195748419-181399314-3423926611-1000 -> {95B7759C-8C7F-4BF1-B163-73684A933233} URL = hxxps://mysearch.avg.com/search?cid={22F71FDD-EED0-4376-A556-38B69B8996BC}∣=3df3132073a347cdaa4431760f8a11c1-18856f0179efd7d73730d2ac1badce504c3e49c5⟨=en&ds;=AVG&coid;=avgtbavg&cmpid;=0915tb≺=fr&d;=2015-09-08 18:53:56&v;=4.1.6.294&pid;=wtu&sg;=&sap;=dsp&q;={searchTerms}
BHO: Canon Easy-WebPrint EX BHO -> {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} -> C:\Program Files\Canon\Easy-WebPrint EX\ewpexbho.dll [2015-02-23] (CANON INC.)
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-18] (Microsoft Corporation)
BHO: No Name -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> No File
BHO-x32: Canon Easy-WebPrint EX BHO -> {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} -> C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll [2015-02-23] (CANON INC.)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-18] (Microsoft Corporation)
BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_71\bin\ssv.dll [2016-01-19] (Oracle Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_71\bin\jp2ssv.dll [2016-01-19] (Oracle Corporation)
Toolbar: HKLM - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll [2015-02-23] (CANON INC.)
Toolbar: HKLM-x32 - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll [2015-02-23] (CANON INC.)
Toolbar: HKU\S-1-5-21-4195748419-181399314-3423926611-1000 -> Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll [2015-02-23] (CANON INC.)
DPF: HKLM-x32 {149E45D8-163E-4189-86FC-45022AB2B6C9} file:///C:/Program%20Files%20(x86)/Cake%20Mania%203/Images/stg_drm.ocx
DPF: HKLM-x32 {CC450D71-CC90-424C-8638-1F2DBAC87A54} file:///C:/Program%20Files%20(x86)/Cake%20Mania%203/Images/armhelper.ocx

FireFox:
========
FF ProfilePath: C:\Users\Ashley\AppData\Roaming\Mozilla\Firefox\Profiles\p0m29lyl.default
FF DefaultSearchEngine: Yahoo!
FF DefaultSearchEngine.US: Yahoo!
FF SearchEngineOrder.3: Bing
FF SelectedSearchEngine: Yahoo!
FF Homepage: hxxps://search.yahoo.com/?type=926458&fr;=spigot-yhp-ff
hxxps://mysearch.avg.com/?cid={22F71FDD-EED0-4376-A556-38B69B8996BC}∣=3df3132073a347cdaa4431760f8a11c1-18856f0179efd7d73730d2ac1badce504c3e49c5⟨=en&ds;=AVG&coid;=avgtbavg&cmpid;=0915avt≺=fr&d;=2015-09-08 18:53:56&v;=4.1.6.294&pid;=wtu&sg;=&sap;=hp
FF Keyword.URL: hxxps://search.yahoo.com/search?fr=greentree_ff1&ei;=utf-8&ilc;=12&type;=926458&p;=
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_20_0_0_306.dll [2016-02-09] ()
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-11] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_20_0_0_306.dll [2016-02-09] ()
FF Plugin-x32: @canon.com/EPPEX -> C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL [2011-09-21] (CANON INC.)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2012-06-06] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2012-06-06] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.71.2 -> C:\Program Files (x86)\Java\jre1.8.0_71\bin\dtplugin\npDeployJava1.dll [2016-01-19] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.71.2 -> C:\Program Files (x86)\Java\jre1.8.0_71\bin\plugin2\npjp2.dll [2016-01-19] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-11] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @nexon.net/NxGame -> C:\ProgramData\NexonUS\NGM\npNxGameUS.dll [2015-08-07] (Nexon)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2015-11-02] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2015-11-02] (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-02-01] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-02-01] (Google Inc.)
FF Extension: WOT - C:\Users\Ashley\AppData\Roaming\Mozilla\Firefox\Profiles\p0m29lyl.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2016-02-17]
FF Extension: Bing Search - C:\Users\Ashley\AppData\Roaming\Mozilla\Firefox\Profiles\p0m29lyl.default\Extensions\[removed] [2015-08-10] [not signed]
FF Extension: Adblock Plus - C:\Users\Ashley\AppData\Roaming\Mozilla\Firefox\Profiles\p0m29lyl.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2016-02-17]

Chrome:
=======
CHR HomePage: Default -> msn.com/?pc=__PARAM__&ocid;=__PARAM__DHP&osmkt;=en-us
CHR StartupUrls: Default -> "hxxps://search.yahoo.com/?type=926458&fr;=yo-yhp-ch"
CHR DefaultSearchURL: Default -> hxxps://search.yahoo.com/search?fr=chr-yo_gc&ei;=utf-8&ilc;=12&type;=926458&p;={searchTerms}
CHR DefaultSearchKeyword: Default -> yahoo.com search
CHR DefaultSuggestURL: Default -> hxxps://ff.search.yahoo.com/gossip?output=fxjson&command;={searchTerms}
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\48.0.2564.116\ppGoogleNaClPluginChrome.dll => No File
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\48.0.2564.116\pdf.dll => No File
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\48.0.2564.116\gcswf32.dll => No File
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.99\npGoogleUpdate3.dll => No File
CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
CHR Profile: C:\Users\Ashley\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (YouTube) - C:\Users\Ashley\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-10-11]
CHR Extension: (Google Search) - C:\Users\Ashley\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2016-02-17]
CHR Extension: (Bing) - C:\Users\Ashley\AppData\Local\Google\Chrome\User Data\Default\Extensions\fcfenmboojpjinhpgggodefccipikbpd [2015-08-14]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Ashley\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-08-14]
CHR Extension: (Gmail) - C:\Users\Ashley\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-08-14]
CHR HKU\S-1-5-21-4195748419-181399314-3423926611-1000\SOFTWARE\Google\Chrome\Extensions\…\Chrome\Extension: [fcfenmboojpjinhpgggodefccipikbpd] - hxxps://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 a2AntiMalware; C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe [4920104 2014-12-31] (Emsisoft GmbH)
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1156384 2015-10-11] (NVIDIA Corporation)
R2 IJPLMSVC; C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE [140456 2011-09-06] ()
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-07-18] (Intel Corporation)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1135416 2015-10-05] (Malwarebytes)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.11.266\McCHSvc.exe [289256 2015-12-02] (McAfee, Inc.)
S3 npggsvc; C:\Windows\SysWOW64\GameMon.des [3587680 2015-10-07] (INCA Internet Co., Ltd.)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1873696 2015-10-11] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe [5568288 2015-10-11] (NVIDIA Corporation)
R2 ogmservice; C:\Program Files (x86)\Online Games Manager\ogmservice.exe [581568 2014-03-27] (RealNetworks, Inc.)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-26] (Microsoft Corporation)

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R3 a2acc; C:\PROGRAM FILES (X86)\EMSISOFT ANTI-MALWARE\a2accx64.sys [71472 2014-05-12] (Emsisoft GmbH)
R1 A2DDA; C:\Program Files (x86)\Emsisoft Anti-Malware\a2ddax64.sys [26176 2013-03-28] (Emsisoft GmbH)
R1 a2injectiondriver; C:\Program Files (x86)\Emsisoft Anti-Malware\a2dix64.sys [45208 2013-09-30] (Emsisoft GmbH)
R1 a2util; C:\Program Files (x86)\Emsisoft Anti-Malware\a2util64.sys [23088 2014-05-12] (Emsisoft GmbH)
R3 cleanhlp; C:\Program Files (x86)\Emsisoft Anti-Malware\cleanhlp64.sys [57024 2013-12-04] (Emsisoft GmbH)
S3 cpuz138; C:\Users\JEFF'S~1\AppData\Local\Temp\cpuz138\cpuz138_x64.sys [43304 2015-11-05] (CPUID)
S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-10-05] (Malwarebytes)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-10-05] (Malwarebytes Corporation)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [20768 2015-10-11] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [50472 2015-08-10] (NVIDIA Corporation)
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]
S3 MSICDSetup; \??\D:\CDriver64.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-02-21 15:49 - 2016-02-21 15:50 - 00020186 _____ C:\Users\Ashley\Desktop\FRST.txt
2016-02-21 15:49 - 2016-02-21 15:49 - 00000000 ____D C:\FRST
2016-02-21 15:48 - 2016-02-21 15:48 - 02371072 _____ (Farbar) C:\Users\Ashley\Downloads\FRST64.exe
2016-02-21 15:48 - 2016-02-21 15:48 - 02371072 _____ (Farbar) C:\Users\Ashley\Desktop\FRST64.exe
2016-02-21 15:45 - 2016-02-21 15:45 - 00001931 _____ C:\Users\Ashley\Desktop\Cake Mania To The Max.lnk
2016-02-19 21:52 - 2016-02-19 21:52 - 00408344 _____ C:\Windows\Minidump\021916-16380-01.dmp
2016-02-19 17:23 - 2016-02-19 17:23 - 00001734 _____ C:\Users\Ashley\Desktop\Cake Mania 3.lnk
2016-02-19 17:18 - 2016-02-19 17:18 - 00001755 _____ C:\Users\Ashley\Desktop\Cake Mania 2.lnk
2016-02-19 17:03 - 2016-02-19 17:03 - 00001726 _____ C:\Users\Ashley\Desktop\Cake Mania.lnk
2016-02-19 17:03 - 2016-02-19 17:03 - 00000000 ____D C:\Program Files (x86)\Online Games Manager
2016-02-19 02:24 - 2016-02-19 02:24 - 00000000 ____D C:\Users\Jeff's Admin\AppData\Roaming\Sun
2016-02-19 02:24 - 2016-02-19 02:24 - 00000000 ____D C:\Users\Jeff's Admin\.oracle_jre_usage
2016-02-17 21:58 - 2016-02-18 00:24 - 00000000 ____D C:\EEK
2016-02-17 21:58 - 2016-02-17 21:57 - 219367872 _____ C:\Users\Ashley\Desktop\EmsisoftEmergencyKit.exe
2016-02-17 21:57 - 2016-02-17 21:57 - 219367872 _____ C:\Users\Ashley\Downloads\EmsisoftEmergencyKit.exe
2016-02-17 21:53 - 2016-02-19 21:53 - 00000000 ____D C:\Program Files (x86)\Emsisoft Anti-Malware
2016-02-17 21:53 - 2016-02-17 21:53 - 00001091 _____ C:\Users\Public\Desktop\Emsisoft Anti-Malware.lnk
2016-02-17 21:53 - 2016-02-17 21:53 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Emsisoft Anti-Malware
2016-02-17 21:51 - 2016-02-17 21:51 - 00001079 _____ C:\Users\Public\Desktop\SpywareBlaster.lnk
2016-02-17 21:51 - 2016-02-17 21:51 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SpywareBlaster
2016-02-17 21:51 - 2016-02-17 21:51 - 00000000 ____D C:\Program Files (x86)\SpywareBlaster
2016-02-17 21:51 - 2009-03-24 12:52 - 00129872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSSTDFMT.DLL
2016-02-17 21:36 - 2016-02-17 21:36 - 00025078 _____ C:\Users\Ashley\Desktop\dds.txt
2016-02-17 21:36 - 2016-02-17 21:36 - 00009147 _____ C:\Users\Ashley\Desktop\attach.txt
2016-02-17 21:21 - 2016-02-17 21:22 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2016-02-17 21:21 - 2016-02-17 21:21 - 00001102 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2016-02-17 21:21 - 2016-02-17 21:21 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2016-02-17 21:21 - 2016-02-17 21:21 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2016-02-17 21:21 - 2015-10-05 09:50 - 00109272 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamchameleon.sys
2016-02-17 21:21 - 2015-10-05 09:50 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2016-02-17 21:21 - 2015-10-05 09:50 - 00025816 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys
2016-02-16 12:48 - 2016-02-16 12:48 - 00000000 ____D C:\Users\Ashley\AppData\Roaming\3671
2016-02-16 02:22 - 2016-02-21 15:45 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GameHouse
2016-02-16 02:22 - 2016-02-21 15:45 - 00000000 ____D C:\GameHouse Games
2016-02-16 02:22 - 2016-02-21 15:44 - 00000000 ____D C:\ProgramData\Trymedia
2016-02-16 02:22 - 2016-02-16 02:22 - 00001935 _____ C:\Users\Ashley\Desktop\Cake Mania Main Street.lnk
2016-02-16 02:22 - 2016-02-16 02:22 - 00000000 ____D C:\ProgramData\com.gamehouse.acid
2016-02-16 02:17 - 2016-02-21 15:45 - 00000000 ____D C:\Users\Ashley\AppData\Local\com.gamehouse.acid
2016-02-16 02:17 - 2016-02-16 02:17 - 00608760 _____ (RealNetworks, Inc.) C:\Users\Ashley\Downloads\Installer_cakemaniamainstreet.exe
2016-02-16 01:44 - 2016-02-16 01:44 - 00001927 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Game Manager.lnk
2016-02-16 01:44 - 2016-02-16 01:44 - 00001248 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\More Great Games.lnk
2016-02-16 01:44 - 2016-02-16 01:44 - 00000959 _____ C:\Users\Public\Desktop\Games.lnk
2016-02-16 01:44 - 2016-02-16 01:44 - 00000231 _____ C:\Users\Public\Desktop\More Great Games.url
2016-02-16 01:44 - 2016-02-16 01:44 - 00000000 ____D C:\Users\Ashley\AppData\Local\Big Fish
2016-02-16 01:44 - 2016-02-16 01:44 - 00000000 ____D C:\ProgramData\Big Fish
2016-02-16 01:44 - 2016-02-16 01:44 - 00000000 ____D C:\Program Files (x86)\bfgclient
2016-02-16 01:44 - 2016-02-16 01:44 - 00000000 ____D C:\BigFishCache
2016-02-16 01:35 - 2016-02-16 01:36 - 16651152 _____ C:\Users\Ashley\Downloads\Install_CakeMania.EXE
2016-02-16 01:27 - 2016-02-16 01:27 - 00618928 _____ C:\Users\Ashley\Downloads\MostFun-Cakemania.exe
2016-02-16 01:22 - 2016-02-17 21:46 - 00000000 ____D C:\Users\Ashley\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\iWin Games
2016-02-16 01:22 - 2016-02-16 01:22 - 00000000 ____D C:\Program Files (x86)\GMInstaller
2016-02-15 13:05 - 2016-02-15 13:05 - 00000000 ____D C:\ProgramData\Sandlot Games
2016-02-11 19:00 - 2016-02-17 21:41 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2016-02-09 21:11 - 2016-02-09 21:11 - 01190608 _____ (Adobe Systems Incorporated) C:\Users\Ashley\Downloads\flashplayer20_d_install.exe
2016-02-09 20:43 - 2016-02-19 17:17 - 00000000 ____D C:\Program Files (x86)\Cake Mania 3
2016-02-09 20:43 - 2016-02-09 20:43 - 00001045 _____ C:\Users\Teri\Desktop\Cake Mania 3.lnk
2016-02-09 20:43 - 2016-02-09 20:43 - 00001045 _____ C:\Users\Jeff's Admin\Desktop\Cake Mania 3.lnk
2016-02-09 20:43 - 2016-02-09 20:43 - 00001045 _____ C:\Users\Chuck\Desktop\Cake Mania 3.lnk
2016-02-09 20:43 - 2016-02-09 20:43 - 00000164 _____ C:\Users\Ashley\Desktop\More SpinTop Games.url
2016-02-09 20:43 - 2016-02-09 20:43 - 00000000 ____D C:\Users\Ashley\AppData\Roaming\SpinTop
2016-02-09 20:43 - 2016-02-09 20:43 - 00000000 ____D C:\Users\Ashley\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Cake Mania 3
2016-02-09 20:43 - 2016-02-09 20:43 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cake Mania 3
2016-02-09 20:39 - 2016-02-19 17:16 - 00000000 ____D C:\Program Files (x86)\Cake Mania 2
2016-02-09 20:39 - 2016-02-09 20:39 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cake Mania 2
2016-02-09 20:39 - 2016-02-09 20:39 - 00000000 ____D C:\Program Files (x86)\ReflexiveArcade
2016-02-09 20:37 - 2016-02-17 21:44 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PlayFirst
2016-02-09 20:37 - 2016-02-17 21:44 - 00000000 ____D C:\Program Files (x86)\PlayFirst
2016-02-09 20:37 - 2016-02-09 20:37 - 00000000 ____D C:\Users\Ashley\AppData\Roaming\PlayFirst
2016-02-04 02:20 - 2016-02-04 02:20 - 00000000 ____D C:\Users\Chuck\AppData\Roaming\Sun
2016-02-04 02:20 - 2016-02-04 02:20 - 00000000 ____D C:\Users\Chuck\.oracle_jre_usage
2016-01-31 23:22 - 2016-01-31 23:22 - 00000262 _____ C:\Users\Chuck\Desktop\Cave Junction Weather - AccuWeather Forecast for OR 97523.URL

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-02-21 15:08 - 2015-08-06 16:29 - 00000898 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2016-02-21 15:06 - 2015-11-09 12:46 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2016-02-21 14:27 - 2009-07-13 20:45 - 00022064 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2016-02-21 14:27 - 2009-07-13 20:45 - 00022064 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2016-02-21 12:08 - 2015-08-06 16:29 - 00000894 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2016-02-19 21:58 - 2009-07-13 21:13 - 00781782 _____ C:\Windows\system32\PerfStringBackup.INI
2016-02-19 21:58 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\inf
2016-02-19 21:54 - 2015-08-07 23:06 - 00000000 ____D C:\ProgramData\boost_interprocess
2016-02-19 21:52 - 2015-11-05 16:23 - 00000000 ____D C:\ProgramData\NVIDIA
2016-02-19 21:52 - 2015-08-14 09:21 - 699861936 _____ C:\Windows\MEMORY.DMP
2016-02-19 21:52 - 2015-08-14 09:21 - 00000000 ____D C:\Windows\Minidump
2016-02-19 21:52 - 2009-07-13 21:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-02-19 17:16 - 2015-08-21 01:25 - 00000000 ____D C:\ProgramData\Temp
2016-02-19 15:09 - 2015-08-06 16:29 - 00002212 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2016-02-19 15:09 - 2015-08-06 16:29 - 00002183 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2016-02-19 02:24 - 2015-09-07 16:41 - 00000000 ____D C:\Users\Jeff's Admin
2016-02-18 16:26 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\system32\NDF
2016-02-17 21:41 - 2015-08-06 17:02 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2016-02-17 21:40 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\PLA
2016-02-16 22:39 - 2015-08-21 01:37 - 00000000 ____D C:\Users\Ashley\AppData\Roaming\dvdcss
2016-02-16 02:19 - 2015-08-06 17:15 - 00000000 ____D C:\ProgramData\CanonIJPLM
2016-02-15 13:42 - 2015-08-06 16:21 - 00000000 ____D C:\Users\Ashley\AppData\Local\VirtualStore
2016-02-09 21:11 - 2015-08-10 22:57 - 00000000 ____D C:\Users\Ashley\AppData\Local\Adobe
2016-02-09 20:43 - 2009-07-13 21:32 - 00000000 ____D C:\Windows\Downloaded Program Files
2016-02-09 19:06 - 2015-11-09 12:46 - 00003768 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2016-02-09 19:06 - 2015-08-10 22:57 - 00796864 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2016-02-09 19:06 - 2015-08-10 22:57 - 00142528 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2016-02-04 02:20 - 2015-08-10 16:08 - 00000000 ____D C:\Users\Chuck
2016-02-01 12:03 - 2015-08-06 16:29 - 00003894 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2016-02-01 12:03 - 2015-08-06 16:29 - 00003642 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore

==================== Files in the root of some directories =======

2015-12-04 12:13 - 2015-12-04 12:13 - 0007605 _____ () C:\Users\Ashley\AppData\Local\Resmon.ResmonCfg

Some files in TEMP:
====================
C:\Users\Ashley\AppData\Local\Temp\BingSvc.exe
C:\Users\Ashley\AppData\Local\Temp\BSvcProcessor.exe
C:\Users\Ashley\AppData\Local\Temp\BSvcUpdater.exe
C:\Users\Ashley\AppData\Local\Temp\DefaultPack.EXE
C:\Users\Ashley\AppData\Local\Temp\jre-8u65-windows-au.exe
C:\Users\Ashley\AppData\Local\Temp\jre-8u66-windows-au.exe
C:\Users\Ashley\AppData\Local\Temp\MSETUP4.EXE
C:\Users\Ashley\AppData\Local\Temp\NGMDll.dll
C:\Users\Ashley\AppData\Local\Temp\NGMResource.dll
C:\Users\Ashley\AppData\Local\Temp\NGMSetup.exe
C:\Users\Ashley\AppData\Local\Temp\nsisdt.dll
C:\Users\Ashley\AppData\Local\Temp\ose00000.exe
C:\Users\Ashley\AppData\Local\Temp\unicows.dll
C:\Users\Ashley\AppData\Local\Temp\uninstall.exe
C:\Users\Ashley\AppData\Local\Temp\_is6132.exe
C:\Users\Chuck\AppData\Local\Temp\sfamcc00001.dll
C:\Users\Chuck\AppData\Local\Temp\sfextra.dll
C:\Users\Jeff's Admin\AppData\Local\Temp\UNINSTALL.EXE
C:\Users\Jeff's Admin\AppData\Local\Temp\_is212.exe


==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2016-02-18 03:06

==================== End of FRST.txt ============================

 

 

 

ADDITION:

 

Additional scan result of Farbar Recovery Scan Tool (x64) Version:21-02-2016 01
Ran by [removed] (2016-02-21 15:50:19)
Running from C:\Users\[removed]\Desktop
Windows 7 Home Premium Service Pack 1 (X64) (2015-08-07 00:21:06)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-4195748419-181399314-3423926611-500 - Administrator - Disabled)
Ashley (S-1-5-21-4195748419-181399314-3423926611-1000 - Administrator - Enabled) => C:\Users\Ashley
Chuck (S-1-5-21-4195748419-181399314-3423926611-1001 - Administrator - Enabled) => C:\Users\Chuck
Guest (S-1-5-21-4195748419-181399314-3423926611-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-4195748419-181399314-3423926611-1005 - Limited - Enabled)
Jeff's Admin (S-1-5-21-4195748419-181399314-3423926611-1003 - Administrator - Enabled) => C:\Users\Jeff's Admin
Teri (S-1-5-21-4195748419-181399314-3423926611-1002 - Limited - Enabled) => C:\Users\Teri

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Flash Player 20 NPAPI (HKLM-x32\…\Adobe Flash Player NPAPI) (Version: 20.0.0.306 - Adobe Systems Incorporated)
Aion (HKLM-x32\…\{98A1650A-2D15-4D03-B4C2-514EE9C9E47F}) (Version: 2.0 - NCsoft)
Aion (HKLM-x32\…\NCW-AION) (Version: 1.0.0.2 - NC Interactive, LLC)
Asmedia ASM104x USB 3.0 Host Controller Driver (HKLM-x32\…\{E4FB0B39-C991-4EE7-95DD-1A1A7857D33D}) (Version: 1.16.10.0 - Asmedia Technology)
ASUS Product Register Program (HKLM-x32\…\{49BE9B8A-E858-4533-A74A-64306C13DB59}) (Version: 1.0.014 - ASUS)
Big Fish: Game Manager (HKLM-x32\…\BFGC) (Version: 3.3.0.2 - )
Cake Mania (HKLM-x32\…\7256de9a7f18f12c57d6e924504e7579) (Version:  - GameHouse)
Cake Mania 2 (HKLM-x32\…\70d5ace86ae1d545f1fc629ca968a7e3) (Version:  - GameHouse)
Cake Mania 2 (HKLM-x32\…\Cake Mania 2_is1) (Version:  - )
Cake Mania 3 (HKLM-x32\…\ac01abb5591fe3b08e79b6c7a1752278) (Version:  - GameHouse)
Cake Mania 3 (HKLM-x32\…\Cake Mania 3) (Version:  - Spintop Media, Inc)
Cake Mania Main Street (HKLM-x32\…\6de74c5d7158675e51f084615969767e) (Version:  - GameHouse)
Cake Mania To The Max (HKLM-x32\…\f20a227801d66b00b5958deb9d744db6) (Version:  - GameHouse)
Canon Easy-PhotoPrint EX (HKLM-x32\…\Easy-PhotoPrint EX) (Version:  - )
Canon Easy-WebPrint EX (HKLM-x32\…\Easy-WebPrint EX) (Version: 1.6.0.0 - Canon Inc.)
Canon Inkjet Printer/Scanner/Fax Extended Survey Program (HKLM-x32\…\CANONIJPLM100) (Version:  - )
Canon MP Navigator EX 5.1 (HKLM-x32\…\MP Navigator EX 5.1) (Version:  - )
Canon MX510 series MP Drivers (HKLM\…\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MX510_series) (Version:  - )
Canon MX510 series On-screen Manual (HKLM-x32\…\Canon MX510 series On-screen Manual) (Version:  - )
Canon MX510 series User Registration (HKLM-x32\…\Canon MX510 series User Registration) (Version:  - )
Canon My Printer (HKLM-x32\…\CanonMyPrinter) (Version:  - )
Canon Solution Menu EX (HKLM-x32\…\CanonSolutionMenuEX) (Version:  - )
Canon Speed Dial Utility (HKLM-x32\…\Speed Dial Utility) (Version:  - )
CBR Reader (HKLM-x32\…\{EDAAC216-AC73-4152-9654-E12FE5A69F5D}_is1) (Version:  - cbrreader.com)
Core Temp 1.0 RC6 (HKLM\…\{086D343F-8E78-4AFC-81AC-D6D414AFD8AC}_is1) (Version: 1.0 - Alcpu)
CPUID CPU-Z 1.74 (HKLM\…\CPUID CPU-Z_is1) (Version:  - )
CPUID HWMonitor 1.28 (HKLM\…\CPUID HWMonitor_is1) (Version:  - )
DVD Decrypter (Remove Only) (HKLM-x32\…\DVD Decrypter) (Version:  - )
DVD Shrink 3.2 (HKLM-x32\…\DVD Shrink_is1) (Version:  - DVD Shrink)
DVDFab 9.1.2.2 (08/01/2014) (HKLM-x32\…\DVDFab 9_is1) (Version:  - Fengtao Software Inc.)
Emsisoft Anti-Malware (HKLM-x32\…\{5502032C-88C1-4303-99FE-B5CBD7684CEA}_is1) (Version: 9.0 - Emsisoft Ltd.)
Fiesta Online NA (HKLM-x32\…\Fiesta Online NA) (Version: 1.02.031 - Gamigo games)
Flyff (HKLM-x32\…\{48E3D369-48AA-4585-AE91-E64667682508}_is1) (Version: Flyff - WEBZEN Inc)
Google Chrome (HKLM-x32\…\Google Chrome) (Version: 48.0.2564.116 - Google Inc.)
Google Update Helper (x32 Version: 1.3.21.99 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.29.5 - Google Inc.) Hidden
Intel(R) Control Center (HKLM-x32\…\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1008 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\…\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1281 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\…\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.1.0.1006 - Intel Corporation)
Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM-x32\…\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 1.0.5.235 - Intel Corporation)
iReal Blu-ray Media Player (HKLM-x32\…\iReal Blu-ray Media Player) (Version: 3.1.9.1523 - iReal Software Inc.)
Java 8 Update 71 (HKLM-x32\…\{26A24AE4-039D-4CA4-87B4-2F83218071F0}) (Version: 8.0.710.15 - Oracle Corporation)
KCP-0.6.0.4 (HKLM-x32\…\Kawaii Codec Pack_is1) (Version: 0.6.0.4 - Haruhichan.com)
Malwarebytes Anti-Malware version 2.2.0.1024 (HKLM-x32\…\Malwarebytes Anti-Malware_is1) (Version: 2.2.0.1024 - Malwarebytes)
MapleStory (HKLM-x32\…\MapleStory) (Version:  - )
McAfee Security Scan Plus (HKLM\…\McAfee Security Scan) (Version: 3.11.266.3 - McAfee, Inc.)
Microsoft .NET Framework 4.5.2 (HKLM\…\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (HKLM-x32\…\Office14.PROPLUS) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\…\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.41212.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\…\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\…\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\…\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\…\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\…\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\…\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Mozilla Firefox 44.0.2 (x86 en-US) (HKLM-x32\…\Mozilla Firefox 44.0.2 (x86 en-US)) (Version: 44.0.2 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\…\MozillaMaintenanceService) (Version: 44.0.2.5884 - Mozilla)
MpcStar 5.4 (HKLM-x32\…\MpcStar) (Version: 5.4 - www.mpcstar.com)
NCSOFT Game Launcher (HKLM-x32\…\NCLauncher_NCWest) (Version:  - NCSOFT)
NCsoft Launcher (HKLM-x32\…\{D54640A3-2C2B-4CB1-9666-01E55F54E7F5}) (Version: 1.5.18003 - NCsoft)
Nexon Game Manager (HKLM-x32\…\{EA2DB6E0-72C5-4ef9-A3A0-E6705F4A6A9E}) (Version:  - )
Nexon Launcher (HKLM-x32\…\Nexon Nexon Launcher) (Version: 1.1.1 - Nexon)
NVIDIA 3D Vision Controller Driver 352.65 (HKLM\…\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 352.65 - NVIDIA Corporation)
NVIDIA 3D Vision Driver 358.87 (HKLM\…\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 358.87 - NVIDIA Corporation)
NVIDIA GeForce Experience 2.5.15.54 (HKLM\…\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.5.15.54 - NVIDIA Corporation)
NVIDIA Graphics Driver 358.87 (HKLM\…\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 358.87 - NVIDIA Corporation)
NVIDIA HD Audio Driver 1.3.34.4 (HKLM\…\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.34.4 - NVIDIA Corporation)
NVIDIA PhysX System Software 9.15.0428 (HKLM\…\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.15.0428 - NVIDIA Corporation)
Online Games Manager v1.30 (HKLM-x32\…\Online Games Manager) (Version: 1.30.14 - Real Networks, Inc.)
Realtek Ethernet Controller Driver (HKLM-x32\…\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.61.612.2012 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\…\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6657 - Realtek Semiconductor Corp.)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\…\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version:  - Microsoft)
SHIELD Streaming (Version: 4.1.500 - NVIDIA Corporation) Hidden
SHIELD Wireless Controller Driver (Version: 2.5.15.54 - NVIDIA Corporation) Hidden
SnapPlayer (HKLM-x32\…\{FF7991D3-7C6D-4C87-A541-545198F52E7D}) (Version: 1.1.5217.23103 - EMCP)
SpeedFan (remove only) (HKLM-x32\…\SpeedFan) (Version:  - )
SpywareBlaster 5.0 (HKLM-x32\…\SpywareBlaster_is1) (Version: 5.0.0 - BrightFort LLC)
Visual Studio 2012 x64 Redistributables (HKLM\…\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)
Visual Studio 2012 x86 Redistributables (HKLM-x32\…\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
WinRAR 5.21 (32-bit) (HKLM-x32\…\WinRAR archiver) (Version: 5.21.0 - win.rar GmbH)
Wizard101 (HKU\S-1-5-21-4195748419-181399314-3423926611-1000\…\{A9E27FF5-6294-46A8-B8FD-77B1DECA3021}) (Version: 1.0.0 - KingsIsle Entertainment, Inc.)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {6BA21ABF-195F-4120-9E94-19787B7FE76A} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-06] (Google Inc.)
Task: {E1B85295-DD7D-4EEC-8DE6-D72506497060} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-06] (Google Inc.)
Task: {F687AB71-0FEA-47E1-81CA-0EAC02A63558} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2016-02-09] (Adobe Systems Incorporated)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Shortcuts =============================

(The entries could be listed to be restored or removed.)

==================== Loaded Modules (Whitelisted) ==============

2015-11-05 16:22 - 2015-11-02 05:22 - 00116528 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2015-08-06 17:28 - 2011-09-06 03:32 - 00140456 _____ () C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE
2013-09-04 23:17 - 2013-09-04 23:17 - 04300456 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF
2010-10-20 14:23 - 2010-10-20 14:23 - 08801632 _____ () C:\Program Files\Microsoft Office\Office14\1033\GrooveIntlResource.dll
2015-11-05 16:23 - 2015-10-11 19:05 - 00013088 _____ () C:\Program Files (x86)\NVIDIA Corporation\Update Core\detoured.dll
2015-08-11 02:40 - 2015-08-11 02:40 - 00172544 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\1eeea3ab8d69ec722bdcb28b8eb8dd75\IsdiInterop.ni.dll
2015-08-06 16:43 - 2012-02-01 15:25 - 00059904 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll
2015-08-06 16:42 - 2012-07-17 19:55 - 01198912 ____R () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
2013-09-04 23:14 - 2013-09-04 23:14 - 04300456 _____ () C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
2010-10-20 14:45 - 2010-10-20 14:45 - 08801120 _____ () C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveIntlResource.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

AlternateDataStreams: C:\ProgramData\Temp:2CB9631F
AlternateDataStreams: C:\ProgramData\Temp:5C321E34
AlternateDataStreams: C:\ProgramData\Temp:85DA68FC
AlternateDataStreams: C:\ProgramData\Temp:CF6CEB7B

==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CleanHlp => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CleanHlp.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\CleanHlp => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\CleanHlp.sys => ""="Driver"

==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

IE trusted site: HKU\.DEFAULT\…\blueearth.net -> hxxp://graderdev.blueearth.net
IE trusted site: HKU\.DEFAULT\…\emcp.com -> hxxp://snap2010.emcp.com

==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-13 18:34 - 2015-12-17 09:28 - 00000860 ____A C:\Windows\system32\Drivers\etc\hosts

0.0.0.1    mssplus.mcafee.com

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-4195748419-181399314-3423926611-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Ashley\AppData\Roaming\Mozilla\Firefox\Desktop Background.bmp
DNS Servers: 192.168.44.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)


==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [{2FAE7561-3C42-44BC-BCD6-57882D78A2DF}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{3C34CD54-0D2F-4481-BDA0-4466E4D39E7B}] => (Allow) C:\ProgramData\NexonUS\NGM\NGM.exe
FirewallRules: [{B6F65DFB-CAD3-4833-ADDA-DB697D5E4CCE}] => (Allow) C:\ProgramData\NexonUS\NGM\NGM.exe
FirewallRules: [{FF4D220B-D8FE-4CB2-BFBC-E958CF6D04BC}] => (Allow) C:\Program Files (x86)\AVG\AVG2015\avgmfapx.exe
FirewallRules: [{47B183E4-C54A-4D2E-9DA8-E8712C2C2161}] => (Allow) C:\Program Files (x86)\AVG\AVG2015\avgmfapx.exe
FirewallRules: [{A271373A-0EDB-45CB-8016-13D2F19E4E98}] => (Allow) C:\Program Files (x86)\AVG\AVG2015\avgnsa.exe
FirewallRules: [{231F76BA-B7EC-473A-8942-96F4468A18D1}] => (Allow) C:\Program Files (x86)\AVG\AVG2015\avgnsa.exe
FirewallRules: [{A5525847-B4EF-4CD4-BE53-F570BB05F8E6}] => (Allow) C:\Program Files (x86)\AVG\AVG2015\avgdiagex.exe
FirewallRules: [{BE50391C-12EE-40AB-AC99-3129DCAEEC2C}] => (Allow) C:\Program Files (x86)\AVG\AVG2015\avgdiagex.exe
FirewallRules: [{2034310F-1578-4999-B69A-1CFEC76A57C6}] => (Allow) C:\Program Files (x86)\AVG\AVG2015\avgemca.exe
FirewallRules: [{C51AC0D0-584C-46DD-9FC4-EE3F1E465B0A}] => (Allow) C:\Program Files (x86)\AVG\AVG2015\avgemca.exe
FirewallRules: [{D8F6016D-DDD4-4B9C-A1D0-A06B0AE9F3D6}] => (Allow) C:\Users\Jeff's Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
FirewallRules: [{0821CCB9-BC87-4CA7-81B3-BE61DDD5F4DD}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{A777859F-B13D-4E0A-B576-3414B8748538}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{FFAFC1B6-D9A6-497C-A15D-89FCAC5FBB3E}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
FirewallRules: [{EE2E3416-B68A-4B2B-8476-B0644F2E5F64}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
FirewallRules: [{3E267EF2-5166-4370-9DCA-18CD1781A81A}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe
FirewallRules: [{527ABD89-E3F7-4712-87A5-CCFBE52D0D38}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{E5A5DA2D-7813-453C-82A1-35C4649C688D}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{076BB52A-E5D3-4094-A79D-992C27EAF359}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{B85FACAF-A1D8-4E73-B592-F88888EC71FE}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{A04FF9B3-4AD7-4F9D-9A30-1864917722C2}] => (Allow) C:\Users\Ashley\Downloads\CakeMania3Setup-77749524.exe
FirewallRules: [{5FF4791E-E2C9-40DC-BCE9-9B0D536AEAF8}] => (Allow) C:\Users\Ashley\Downloads\CakeMania3Setup-77749524.exe
FirewallRules: [{C76EC607-2543-4A04-93C9-F78CE0837F3B}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Restore Points =========================

17-02-2016 23:47:24 Scheduled Checkpoint

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (02/19/2016 09:54:11 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/18/2016 04:29:25 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/18/2016 03:39:33 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/18/2016 12:27:04 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/17/2016 10:10:10 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program IEXPLORE.EXE version 11.0.9600.18163 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

Process ID: 1160

Start Time: 01d16a123d181b93

Termination Time: 33

Application Path: C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

Report Id:

Error: (02/17/2016 09:42:54 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/17/2016 09:09:41 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: plugin-container.exe, version: 44.0.2.5884, time stamp: 0x56bbf417
Faulting module name: mozglue.dll, version: 44.0.2.5884, time stamp: 0x56bbe58e
Exception code: 0x80000003
Fault offset: 0x0000ed3b
Faulting process id: 0x14c0
Faulting application start time: 0xplugin-container.exe0
Faulting application path: plugin-container.exe1
Faulting module path: plugin-container.exe2
Report Id: plugin-container.exe3

Error: (02/16/2016 02:21:51 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/16/2016 01:44:53 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: bfgclient.exe, version: 3.3.0.2, time stamp: 0x53179a91
Faulting module name: ntdll.dll, version: 6.1.7601.19110, time stamp: 0x5684255b
Exception code: 0xc0000005
Fault offset: 0x00022312
Faulting process id: 0x1c4c
Faulting application start time: 0xbfgclient.exe0
Faulting application path: bfgclient.exe1
Faulting module path: bfgclient.exe2
Report Id: bfgclient.exe3

Error: (02/16/2016 01:44:48 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: bfgclient.exe, version: 3.3.0.2, time stamp: 0x53179a91
Faulting module name: bfgclient.exe, version: 3.3.0.2, time stamp: 0x53179a91
Exception code: 0xc0000005
Fault offset: 0x002863ea
Faulting process id: 0x1aa0
Faulting application start time: 0xbfgclient.exe0
Faulting application path: bfgclient.exe1
Faulting module path: bfgclient.exe2
Report Id: bfgclient.exe3


System errors:
=============
Error: (02/19/2016 09:52:38 PM) (Source: BugCheck) (EventID: 1001) (User: )
Description: 0x00000124 (0x0000000000000000, 0xfffffa8007872028, 0x00000000be000000, 0x0000000000800400)C:\Windows\MEMORY.DMP021916-16380-01

Error: (02/19/2016 09:52:25 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: The previous system shutdown at 9:46:15 PM on ‎2/‎19/‎2016 was unexpected.

Error: (02/18/2016 04:44:50 PM) (Source: NetBT) (EventID: 4321) (User: )
Description: The name "WORKGROUP      :1d" could not be registered on the interface with IP address 192.168.44.86.
The computer with the IP address 192.168.44.84 did not allow the name to be claimed by
this computer.

Error: (02/18/2016 04:26:57 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}

Error: (02/18/2016 03:37:45 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: The previous system shutdown at 5:59:08 AM on ‎2/‎18/‎2016 was unexpected.

Error: (02/18/2016 12:24:32 AM) (Source: DCOM) (EventID: 10010) (User: )
Description: {E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}

Error: (02/17/2016 11:42:51 PM) (Source: volsnap) (EventID: 36) (User: )
Description: The shadow copies of volume C: were aborted because the shadow copy storage could not grow due to a user imposed limit.

Error: (02/17/2016 09:40:31 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}

Error: (02/16/2016 02:19:05 AM) (Source: DCOM) (EventID: 10010) (User: )
Description: {E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}

Error: (02/15/2016 04:44:09 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the lmhosts service.


==================== Memory info ===========================

Processor: Intel(R) Core(TM) i3-3220 CPU @ 3.30GHz
Percentage of memory in use: 32%
Total physical RAM: 8134.48 MB
Available physical RAM: 5479.14 MB
Total Virtual: 16267.18 MB
Available Virtual: 12909.73 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:931.41 GB) (Free:684.31 GB) NTFS
Drive e: (System Reserved) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[system with boot components (obtained from drive)]
Drive f: () (Fixed) (Total:232.79 GB) (Free:204.69 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 232.9 GB) (Disk ID: B6ED2AF7)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=232.8 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: 8B964B56)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=931.4 GB) - (Type=07 NTFS)

==================== End of Addition.txt ============================

Post #2

Hello jeff

I am Marie Curie and will gladly help you with any malware-related problems.

I will be back with instructions shortly after I have analysed your logs. Please familiarize yourself with the following ground rules in the meanwhile.
 

  • Read my instructions thoroughly, carry out each step in the given order.

  • Do not make any changes to your system, or run any tools other than those I provided. Do not delete, fix, uninstall, or install anything unless I tell you to.

  • If you are unsure about anything or if you encounter any problems, please stop and inform me about it.

  • Stick with me until I tell you that your computer is clean. Absence of symptoms does not mean that your computer is free of malware.

  • Back up important files before we start.

 

Post #3 last edited

Hello jeff.

 

Your sister's computer does not have a malware infection. It has programmes on it that we call potentially unwanted, because they often arrive on the system without the user's knowledge, show advertisments or show other undesired behaviour.

 

Most of these programmes will be bundled by installers or updaters. If a user does not pay enough attention during the installation process, the programmes will be installed without knowledge of the user. Some installers will utilize psychological tricks to make you agree to the third-party programme installation like greying out the cancel button (making it seem unclickable), reversing questions, reversing buttons, hiding options by making the window too small. Most of these bundled installs can only be prevented by opting out of them.

 

This is also true for Cake Mania and other programmes that your sister installed. E.g. this site shows a detection of a cake-mania installer as software bundler: https://www.reasoncoresecurity.com/cakemania-setup.exe-0d9c88f492b6e62627c7ee4aad0bdfe4c836dd79.aspx
 

 

This is the Tightrope WebInstall which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent.

 

 

To prevent further unwanted programmes on the system, you should educate your sister to pay attention during installation and programme updates, to always use the custom installation option, to read all of the messages during the process carefully, and to opt-out of all additional offers.

 

In my opinion your sister can continue playing Cake Mania as long as she takes care during the installation.

 

Do you have any remaining issues or questions?

Post #4

Ohh i see. Well we had some heavily protected software used in the last clean-up process, something like Clicky and Crypto Prevent, which was supposed to block all those unnecessary Pup's and the extra check marked advertising programs. But yeah ok, that seems like something she would of done. Though from my experiences, finding a legitimate game or software from the original site you don't run into a bundled archive that is zipped with all kinds of extra stuff. I have seen it again and again in places like CNET or download.com, even when im trying to download certain encoding or decoding software.

 

Usually when downloading from an original source you get the installer just it self with no extra adds or advertising links. But Cake mania is the number top competitive advertising game being used online so i guess thats not suprising that it would be used as a means of downloading all other kinds of software and games.

 

I do have one more concern though, what bout the folder on the desktop that seems to have no title and will not open. I am very suspicious of that.

 

I'll send you a screen cap.

 

[external image: 9u5d1d.png]

 

Other then that, i would like some assistance of maybe some preventative measures to take and maybe some certain applications that you would recommend i use to prevent her from doing this. Like clicky may work. Also she mentioned that the computer it self disabled the antivirus, addblock, and all of the script blocking software i had in place, i am not sure how that happened. I am kind of puzzled on that.

Post #5

Let me look at the folder first. We will talk about preventive measures after that.

 

STEP 1
[external image: xlK5Hdb.png]Farbar Recovery Scan Tool (FRST) Script

  • Press the Windows Key [external image: pdKOQKY.png] + r on your keyboard at the same time. Type Notepad and click OK.
  • Copy the entire contents of the codebox below and paste into the Notepad document.
    start
Folder: C:\Users\Ashley\Desktop
Folder: C:\Users\Ashley\AppData\Roaming\3671
end
  • Click File, Save As and type fixlist.txt as the File Name.
  • Important: The file must be saved in the same location as FRST64.exe.

NOTICE: This script is intended for use on this particular machine. Do not use this script on any other machine; doing so may cause damage to your Operating System.


  • Double-Click FRST64.exe to run the programme.
  • Click Fix.
  • A log (Fixlog.txt) will open on your desktop. Copy the contents of the log and paste in your next reply.

 

 

Post #6 last edited

Fix result of Farbar Recovery Scan Tool (x64) Version:21-02-2016 01
Ran by [removed] (2016-02-23 07:31:40) Run:1
Running from C:\Users\[removed]\Desktop
[removed] Boot Mode: Normal
==============================================

fixlist content:
*****************
start
Folder: C:\Users\Ashley\Desktop
Folder: C:\Users\Ashley\AppData\Roaming\3671
end
*****************


========================= Folder: C:\Users\Ashley\Desktop ========================

2016-02-21 15:50 - 2016-02-21 15:50 - 0027146 _____ () C:\Users\Ashley\Desktop\Addition.txt
2015-08-24 14:27 - 2015-10-23 21:19 - 6283335 _____ () C:\Users\Ashley\Desktop\Anime Top 100 list.docx
2015-11-27 20:08 - 2015-11-27 20:08 - 0020808 _____ () C:\Users\Ashley\Desktop\Ashley.docx
2016-02-17 21:36 - 2016-02-17 21:36 - 0009147 _____ () C:\Users\Ashley\Desktop\attach.txt
2016-02-21 15:50 - 2016-02-21 15:50 - 0001971 _____ () C:\Users\Ashley\Desktop\Cake Mania - Lights, Camera, Action!.lnk
2016-02-19 17:18 - 2016-02-19 17:18 - 0001755 _____ () C:\Users\Ashley\Desktop\Cake Mania 2.lnk
2016-02-19 17:23 - 2016-02-19 17:23 - 0001734 _____ () C:\Users\Ashley\Desktop\Cake Mania 3.lnk
2016-02-16 02:22 - 2016-02-16 02:22 - 0001935 _____ () C:\Users\Ashley\Desktop\Cake Mania Main Street.lnk
2016-02-21 15:45 - 2016-02-21 15:45 - 0001931 _____ () C:\Users\Ashley\Desktop\Cake Mania To The Max.lnk
2016-02-19 17:03 - 2016-02-19 17:03 - 0001726 _____ () C:\Users\Ashley\Desktop\Cake Mania.lnk
2015-11-02 21:24 - 2015-11-02 21:24 - 0001194 _____ () C:\Users\Ashley\Desktop\Continue DVD Shrink Installation.lnk
2016-02-17 21:36 - 2016-02-17 21:36 - 0025078 _____ () C:\Users\Ashley\Desktop\dds.txt
2015-08-06 16:21 - 2015-10-14 10:40 - 0000282 ___SH () C:\Users\Ashley\Desktop\desktop.ini
2015-11-02 20:06 - 2015-11-02 20:06 - 0001972 _____ () C:\Users\Ashley\Desktop\DVD Decrypter.lnk
2015-11-02 21:25 - 2015-11-02 21:25 - 0000983 _____ () C:\Users\Ashley\Desktop\DVD Shrink 3.2.lnk
2016-02-17 21:58 - 2016-02-17 21:57 - 219367872 _____ () C:\Users\Ashley\Desktop\EmsisoftEmergencyKit.exe
2015-08-08 16:49 - 2015-08-08 16:49 - 0001661 _____ () C:\Users\Ashley\Desktop\Fiesta Online NA.lnk
2016-02-23 07:31 - 2016-02-23 07:31 - 0000089 _____ () C:\Users\Ashley\Desktop\fixlist.txt
2016-02-23 07:31 - 2016-02-23 07:31 - 0002434 _____ () C:\Users\Ashley\Desktop\Fixlog.txt
2016-02-21 15:49 - 2016-02-21 15:50 - 0033019 _____ () C:\Users\Ashley\Desktop\FRST.txt
2016-02-21 15:48 - 2016-02-21 15:48 - 2371072 _____ (Farbar) C:\Users\Ashley\Desktop\FRST64.exe
2015-08-21 01:35 - 2015-08-21 01:35 - 0001396 _____ () C:\Users\Ashley\Desktop\iReal Blu-ray Media Player.lnk
2016-02-09 20:43 - 2016-02-09 20:43 - 0000164 _____ () C:\Users\Ashley\Desktop\More SpinTop Games.url
2015-08-08 16:29 - 2015-08-08 16:29 - 0002079 _____ () C:\Users\Ashley\Desktop\Nexon Launcher.lnk
2015-08-07 23:34 - 2015-08-07 23:34 - 0000817 _____ () C:\Users\Ashley\Desktop\Play Wizard101.lnk
2015-08-07 13:19 - 2015-08-07 13:19 - 0001142 _____ () C:\Users\Ashley\Desktop\Welcome to ASUS Product Registration.lnk
2015-08-07 22:50 - 2015-08-07 23:10 - 0000000 ____D () C:\Users\Ashley\Desktop\MapleStory
2015-08-07 22:50 - 2015-08-07 22:50 - 1680370379 _____ (Nexon) C:\Users\Ashley\Desktop\MapleStory\MSSetupv164.exe
2015-08-07 22:54 - 2015-08-07 22:54 - 1677078815 _____ () C:\Users\Ashley\Desktop\MapleStory\MSSetupv164.z01
2015-08-07 22:54 - 2015-08-07 22:54 - 1677038344 _____ () C:\Users\Ashley\Desktop\MapleStory\MSSetupv164.z02
2015-08-07 22:54 - 2015-08-07 22:54 - 1676963301 _____ () C:\Users\Ashley\Desktop\MapleStory\MSSetupv164.z03
2015-08-07 22:54 - 2015-08-07 22:54 - 905855082 _____ () C:\Users\Ashley\Desktop\MapleStory\MSSetupv164.z04

====== End of Folder: ======


========================= Folder: C:\Users\Ashley\AppData\Roaming\3671 ========================


====== End of Folder: ======


==== End of Fixlog 07:31:40 ====

Post #7 last edited

Hi jeff.
 
The folder did not show up in the logs. Did I look into the correct userprofile (Ashley)?
Please log in as the user that has the empty folder on the desktop and do the following.
 
STEP 1
[external image: MgeHyNE.png]Batch File

  • Press the Windows Key [external image: pdKOQKY.png] + r on your keyboard at the same time. Type Notepad and click OK.
  • Copy the entire contents of the codebox below and paste into the Notepad document.
     
    @echo off
Dir /x /a /s "%userprofile%\Desktop\" > log.txt
Notepad.exe log.txt
Del log.txt
Del %0
  • Click Format. Ensure Wordwrap is unchecked.
  • Click File, Save As and name the file batchfile.bat.
  • Select All Files as the Save as type.
  • Save the file to your Desktop.
  • Locate batchfile.bat on your Desktop. Double-Click the file to run it.
  • Notepad will open with a log.txt. Please post the contents of the log in your next reply.
Post #8

 Volume in drive C has no label.
 Volume Serial Number is 98AC-B9BF

 Directory of C:\Users\Ashley\Desktop

02/24/2016  01:30 PM   

                       .
02/24/2016  01:30 PM                           ..
02/21/2016  03:50 PM            27,146              Addition.txt
10/23/2015  09:19 PM         6,283,335 ANIMET~1.DOC Anime Top 100 list.docx
11/27/2015  08:08 PM            20,808 ASHLEY~1.DOC Ashley.docx
02/17/2016  09:36 PM             9,147              attach.txt
02/24/2016  01:30 PM               100 BATCHF~1.BAT batchfile.bat
02/21/2016  03:50 PM             1,971 CAD3DE~1.LNK Cake Mania - Lights, Camera, Action!.lnk
02/19/2016  05:18 PM             1,755 CAKEMA~2.LNK Cake Mania 2.lnk
02/19/2016  05:23 PM             1,734 CAKEMA~3.LNK Cake Mania 3.lnk
02/16/2016  02:22 AM             1,935 CAKEMA~4.LNK Cake Mania Main Street.lnk
02/21/2016  03:45 PM             1,931 CA8807~1.LNK Cake Mania To The Max.lnk
02/19/2016  05:03 PM             1,726 CAKEMA~1.LNK Cake Mania.lnk
11/02/2015  09:24 PM             1,194 CONTIN~1.LNK Continue DVD Shrink Installation.lnk
02/17/2016  09:36 PM            25,078              dds.txt
10/14/2015  10:40 AM               282              desktop.ini
11/02/2015  08:06 PM             1,972 DVDDEC~1.LNK DVD Decrypter.lnk
11/02/2015  09:25 PM               983 DVDSHR~1.LNK DVD Shrink 3.2.lnk
02/17/2016  09:57 PM       219,367,872 EMSISO~1.EXE EmsisoftEmergencyKit.exe
08/08/2015  04:49 PM             1,661 FIESTA~1.LNK Fiesta Online NA.lnk
02/23/2016  07:31 AM             4,092              Fixlog.txt
02/21/2016  03:50 PM            33,019              FRST.txt
02/21/2016  03:48 PM         2,371,072              FRST64.exe
08/21/2015  01:35 AM             1,396 IREALB~1.LNK iReal Blu-ray Media Player.lnk
02/24/2016  01:30 PM                 0              log.txt
08/07/2015  11:10 PM              MAPLES~1     MapleStory
02/09/2016  08:43 PM               164 MORESP~1.URL More SpinTop Games.url
08/08/2015  04:29 PM             2,079 NEXONL~1.LNK Nexon Launcher.lnk
08/07/2015  11:34 PM               817 PLAYWI~1.LNK Play Wizard101.lnk
08/07/2015  01:19 PM             1,142 WELCOM~1.LNK Welcome to ASUS Product Registration.lnk
08/21/2015  01:22 AM             2,645 TORREN~1.LNK æTorrent.lnk
              28 File(s)    228,167,056 bytes

 Directory of C:\Users\Ashley\Desktop\MapleStory

08/07/2015  11:10 PM                           .
08/07/2015  11:10 PM                           ..
08/07/2015  10:50 PM     1,680,370,379 MSSETU~1.EXE MSSetupv164.exe
08/07/2015  10:54 PM     1,677,078,815 MSSETU~1.Z01 MSSetupv164.z01
08/07/2015  10:54 PM     1,677,038,344 MSSETU~1.Z02 MSSetupv164.z02
08/07/2015  10:54 PM     1,676,963,301 MSSETU~1.Z03 MSSetupv164.z03
08/07/2015  10:54 PM       905,855,082 MSSETU~1.Z04 MSSetupv164.z04
               5 File(s)  7,617,305,921 bytes

     Total Files Listed:
              33 File(s)  7,845,472,977 bytes
               5 Dir(s)  730,493,902,848 bytes free
 

Post #9

I went to folder options and unchecked hidden files and folders and the folder still shows up so its not a hidden file, its some sort of a Folder that is just stuck on the desktop. I can just forget bout it if you want, cause im going to reformat anyways, i just want to make sure its not part of those game installs that she has on the computer.

Post #10 last edited

There is no file or folder in the listing that looks like the culprit of that weird folder icon. This is probably a software bug. I can't tell you whether it is caused by any of the games or something else. Even if we find out why that is happening, it might not help to identify the programme that is causing this. I could look for more clues in the registry and the desktop.ini file and I can ask my colleagues. However, I don't know if that is so important for you that you want to go through this the next days.

 

I suggest that we close up this thread with security recommendations, and you may ask for the weird folder icon in the Windows section afterwards. That way more people are allowed to give input to your question, including the technical staff.

 

Do you have any other questions?

Post #12 last edited

I have compiled below a list of resources you may find useful. The articles document information on computer security, common attack vectors and how you can stay safe on the Internet.

  • Answers to common security questions - Best Practices by quietman7, MVP
  • How Malware Spreads - How did I get infected? by quietman7, MVP
  • Simple and easy ways to keep your computer safe and secure on the Internet by Lawrence Abrams, MVP
  • How to Prevent Malware by miekiemoes, MVP
  • How to backup and restore your data using Cobian Backup by YourHighness
  • Slow Computer/browser? It May Not Be Malware by quietman7, MVP
     

The following programmes come highly recommended in the security community.

  • [external image: KsUqI5A.png] AdBlock is a browser add-on that blocks annoying banners, pop-ups and video ads.
  • [external image: E8I37RF.png]CryptoPrevent places policy restrictions on loading points for ransomware (eg. CryptoWall), helping prevent the execution of malware. 
  • [external image: 7D2ig3K.png] Emsisoft Antimalware (free) acts as an additional on-demand scanner, and can be used in conjunction with your Anti-Virus. 
  • [external image: EG85Vjt.png] Malwarebytes Anti-Exploit (MBAE) is designed to prevent zero-day malware from exploiting vulnerable software.
  • [external image: 6YRrgUC.png] Malwarebytes Anti-Malware Premium (MBAM) works in real-time along side your Anti-Virus to prevent malware execution.
  • [external image: jv4nhMJ.png] NoScript is a Firefox add-on that blocks the actions of malicious scripts by using whitelisting and other technology. 
  • [external image: 3O8r9Uq.png] Sandboxie isolates programmes of your choice, preventing files from being written to your HDD unless approved by you. 
  • [external image: DgW1XL2.png] Secunia PSI will scan your computer for vulnerable software that is outdated, and automatically find the latest update for you.
  • [external image: j1OLIec.png] SpywareBlaster is a form of passive protection, designed to block the actions of malicious websites and tracking cookies.
  • [external image: sHjS79L.png] Unchecky automatically removes checkmarks for bunlded software in programme installers; helping you avoid adware and PUPs. 
  • [external image: JEP5iWI.png] Web of Trust (WOT) is a browser add-on designed to alert you before interacting with a potentially malicious website. 
     

Need a second opinion on a file or website? Scan the file/URL before clicking by using one of the following free online scanner services.

  • [external image: nWhGEI3.png] VirusTotal (File & URL)
  • [external image: MJUfyKX.png] Jotti's Malware Scan (File)
  • [external image: XeTvs74.png] Dr.Web Online Check (URL)
  • [external image: 5v676cC.png] Trend Micro Site Safety Center (URL)
  • [external image: 2tXp7dz.png] Norton Safe Web (URL)

– Please feel free to ask if you have any questions or concerns on computer security or the programmes above.

Post #13

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please follow the instructions here http://forums.whatth…ed_t106388.html
and start a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI