Spyware / Malware / Virus Removal

Black screen with flashing cursor [Solved]

6 min read

Looking for the outcome? Ask AI

ShawBuck Topic Starter

Post #1April 7, 2016, 12:51 AM UTC

I'm not sure if my wife's laptop is infected, or just getting old. Recently, when she tried booting up her computer, it would start going through the startup process then stop at a black screen with only a blinking cursor. Tried starting through safe mode, but the same thing would happen. I managed to do a system restore to get it working, but I'm guessing there's a little more to it. I sincerely any appreciate any help you can provide…below are the logs:

aswMBR LOGFILE

Run date: 2016-04-06 19:15:23

—————————–

19:15:23.535 OS Version: Windows x64 6.1.7601 Service Pack 1

19:15:23.535 Number of processors: 2 586 0x170A

19:15:23.535 ComputerName: DEBBIE-LAPTOP UserName: Debbie

19:15:26.203 Initialize success

19:15:26.308 VM: initialized successfully

19:15:26.308 VM: Intel CPU virtualization not supported

19:29:02.296 AVAST engine defs: 16033102

19:30:35.853 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1

19:30:35.853 Disk 0 Vendor: WDC_WD32 01.0 Size: 305245MB BusType: 3

19:30:35.979 Disk 0 MBR read successfully

19:30:35.979 Disk 0 MBR scan

19:30:36.057 Disk 0 Windows 7 default MBR code

19:30:36.057 Disk 0 Partition 1 00 27 Hidden NTFS WinRE NTFS 13312 MB offset 2048

19:30:36.135 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 100 MB offset 27265024

19:30:36.135 Disk 0 Boot: NTFS code=1

19:30:36.166 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 291831 MB offset 27469824

19:30:36.229 Disk 0 scanning C:\Windows\system32\drivers

19:30:57.413 Service scanning

19:31:38.691 Modules scanning

19:31:38.691 Disk 0 trace - called modules:

19:31:38.738 ntoskrnl.exe CLASSPNP.SYS disk.sys iaStor.sys hal.dll

19:31:38.738 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa80069da2f0]

19:31:38.754 3 CLASSPNP.SYS[fffff88001b2e43f] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0xfffffa80047a3050]

19:31:46.366 AVAST engine scan C:\Windows

19:31:51.436 AVAST engine scan C:\Windows\system32

19:35:06.127 File: C:\Windows\system32\MyOSProtect64.dll **INFECTED** Win32:Adware-gen [Adw]

19:39:58.861 AVAST engine scan C:\Windows\system32\drivers

19:40:19.640 AVAST engine scan C:\Users\Debbie

19:47:59.347 Disk 0 MBR has been saved successfully to "C:\Users\Debbie\Desktop\MBR.dat"

19:47:59.394 The log file has been saved successfully to "C:\Users\Debbie\Desktop\aswMBR.txt"

Run date: 2016-04-06 19:15:23

—————————–

19:15:23.535 OS Version: Windows x64 6.1.7601 Service Pack 1

19:15:23.535 Number of processors: 2 586 0x170A

19:15:23.535 ComputerName: DEBBIE-LAPTOP UserName: Debbie

19:15:26.203 Initialize success

19:15:26.308 VM: initialized successfully

19:15:26.308 VM: Intel CPU virtualization not supported

19:29:02.296 AVAST engine defs: 16033102

19:30:35.853 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1

19:30:35.853 Disk 0 Vendor: WDC_WD32 01.0 Size: 305245MB BusType: 3

19:30:35.979 Disk 0 MBR read successfully

19:30:35.979 Disk 0 MBR scan

19:30:36.057 Disk 0 Windows 7 default MBR code

19:30:36.057 Disk 0 Partition 1 00 27 Hidden NTFS WinRE NTFS 13312 MB offset 2048

19:30:36.135 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 100 MB offset 27265024

19:30:36.135 Disk 0 Boot: NTFS code=1

19:30:36.166 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 291831 MB offset 27469824

19:30:36.229 Disk 0 scanning C:\Windows\system32\drivers

19:30:57.413 Service scanning

19:31:38.691 Modules scanning

19:31:38.691 Disk 0 trace - called modules:

19:31:38.738 ntoskrnl.exe CLASSPNP.SYS disk.sys iaStor.sys hal.dll

19:31:38.738 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa80069da2f0]

19:31:38.754 3 CLASSPNP.SYS[fffff88001b2e43f] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0xfffffa80047a3050]

19:31:46.366 AVAST engine scan C:\Windows

19:31:51.436 AVAST engine scan C:\Windows\system32

19:35:06.127 File: C:\Windows\system32\MyOSProtect64.dll **INFECTED** Win32:Adware-gen [Adw]

19:39:58.861 AVAST engine scan C:\Windows\system32\drivers

19:40:19.640 AVAST engine scan C:\Users\Debbie

19:47:59.347 Disk 0 MBR has been saved successfully to "C:\Users\Debbie\Desktop\MBR.dat"

19:47:59.394 The log file has been saved successfully to "C:\Users\Debbie\Desktop\aswMBR.txt"

20:02:08.374 File: C:\Users\Debbie\AppData\Local\Temp\n3796\SafetySearch_1009-d179322a.exe **INFECTED** Win32:Dropper-gen [Drp]

20:22:03.450 AVAST engine scan C:\ProgramData

20:25:16.005 Disk 0 statistics 4261317/0/0 @ 1.19 MB/s

20:25:16.017 Scan finished successfully

20:27:32.831 Disk 0 MBR has been saved successfully to "C:\Users\Debbie\Desktop\MBR.dat"

20:27:32.890 The log file has been saved successfully to "C:\Users\Debbie\Desktop\aswMBR.txt"

FRST LOGFILE

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:05-03-2016 01

Ran by [removed] (administrator) on DEBBIE-LAPTOP (06-04-2016 20:33:10)

Running from C:\Users\[removed]\Downloads

[removed]

Platform: Windows 7 Home Premium Service Pack 1 (X64) Language: English (United States)

Internet Explorer Version 11 (Default browser: Chrome)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe

(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe

(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

(Egis Technology Inc.) C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe

(Intel Corporation) C:\Windows\System32\igfxtray.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxsrvc.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(ELAN Microelectronic Corp.) C:\Program Files\Elantech\ETDCtrl.exe

(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe

(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe

(ELAN Microelectronic Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe

(Garmin Ltd or its subsidiaries) C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe

(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe

(Egis Technology Inc.) C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe

(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe

(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe

(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMworker.exe

(Egis Technology Inc.) C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe

(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GREGsvc.exe

(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe

() C:\monitor.exe

(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe

(Acer Group) C:\Program Files\Acer\Acer Updater\UpdaterService.exe

(Yahoo! Inc.) C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe

(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe

(Intel Corporation) C:\Windows\System32\igfxext.exe

(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE

(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe

(Garmin Ltd or its subsidiaries) C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe

(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\…\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11057768 2010-07-06] (Realtek Semiconductor)

HKLM\…\Run: [mwlDaemon] => C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe [349552 2010-05-26] (Egis Technology Inc.)

HKLM\…\Run: [ETDWare] => C:\Program Files\Elantech\ETDCtrl.exe [649608 2010-04-13] (ELAN Microelectronic Corp.)

HKLM\…\Run: [Acer ePower Management] => C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [861216 2010-06-11] (Acer Incorporated)

HKLM\…\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1337000 2015-04-30] (Microsoft Corporation)

HKLM-x32\…\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2010-04-13] (Intel Corporation)

HKLM-x32\…\Run: [LManager] => C:\Program Files (x86)\Launch Manager\LManager.exe [968272 2010-06-22] (Dritek System Inc.)

HKLM-x32\…\Run: [SuiteTray] => C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe [337264 2010-05-26] (Egis Technology Inc.)

HKLM-x32\…\Run: [EgisUpdate] => C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe [201584 2010-03-11] (Egis Technology Inc.)

HKLM-x32\…\Run: [EgisTecPMMUpdate] => C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe [407920 2010-03-11] (Egis Technology Inc.)

HKLM-x32\…\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [35760 2011-01-31] (Adobe Systems Incorporated)

HKLM-x32\…\Run: [BackupManagerTray] => C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe [265984 2010-06-28] (NewTech Infosystems, Inc.)

HKLM-x32\…\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [932288 2010-09-21] (Adobe Systems Incorporated)

Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)

HKU\S-1-5-21-1899613811-3316350630-256103360-1001\…\Run: [GarminExpressTrayApp] => C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe [1093976 2013-09-19] (Garmin Ltd or its subsidiaries)

HKU\S-1-5-18\…\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [301568 2013-05-03] (Microsoft Corporation)

ShellIconOverlayIdentifiers: [egisPSDP] -> {30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} => C:\Program Files (x86)\EgisTec MyWinLocker\x64\psdprotect.dll [2010-05-26] (Egis Technology Inc.)

ShellIconOverlayIdentifiers-x32: [egisPSDP] -> {30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} => C:\Program Files (x86)\EgisTec MyWinLocker\x86\psdprotect.dll [2010-05-26] (Egis Technology Inc.)

GroupPolicy: Restriction - Chrome <======= ATTENTION

CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION

CHR HKU\S-1-5-21-1899613811-3316350630-256103360-1001\SOFTWARE\Policies\Google: Restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Winsock: Catalog9 01 C:\Windows\SysWOW64\MyOSProtect.dll [304776 2014-09-01] (MyOSCompany)

Winsock: Catalog9 02 C:\Windows\SysWOW64\MyOSProtect.dll [304776 2014-09-01] (MyOSCompany)

Winsock: Catalog9 03 C:\Windows\SysWOW64\MyOSProtect.dll [304776 2014-09-01] (MyOSCompany)

Winsock: Catalog9 04 C:\Windows\SysWOW64\MyOSProtect.dll [304776 2014-09-01] (MyOSCompany)

Winsock: Catalog9 15 C:\Windows\SysWOW64\MyOSProtect.dll [304776 2014-09-01] (MyOSCompany)

Winsock: Catalog9-x64 01 C:\Windows\system32\MyOSProtect64.dll [350768 2014-09-01] (MyOSCompany)

Winsock: Catalog9-x64 02 C:\Windows\system32\MyOSProtect64.dll [350768 2014-09-01] (MyOSCompany)

Winsock: Catalog9-x64 03 C:\Windows\system32\MyOSProtect64.dll [350768 2014-09-01] (MyOSCompany)

Winsock: Catalog9-x64 04 C:\Windows\system32\MyOSProtect64.dll [350768 2014-09-01] (MyOSCompany)

Winsock: Catalog9-x64 15 C:\Windows\system32\MyOSProtect64.dll [350768 2014-09-01] (MyOSCompany)

Tcpip\Parameters: [DhcpNameServer] 10.0.0.1

Tcpip\..\Interfaces\{639CDC1E-27C7-4026-A5AF-E0580F13F294}: [DhcpNameServer] 10.0.0.1

Internet Explorer:

==================

HKU\S-1-5-21-1899613811-3316350630-256103360-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.trovi.com/?gd=&ctid;=CT3330390&octid;=EB_ORIGINAL_CTID&ISID;=MAB60BA3E-3E5D-4F90-AEB7-49587C0A430B&SearchSource;=55&CUI;=&UM;=6&UP;=SPF41586E7-B920-4C10-9531-416302518A5B&SSPV;=

HKU\S-1-5-21-1899613811-3316350630-256103360-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l;=0409&m;=aspire_5736z&r;=27361210f365l0444z1i5v4712449o

HKU\S-1-5-21-1899613811-3316350630-256103360-1001\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxps://www.facebook.com/

hxxp://www.google.com/

URLSearchHook: HKU\S-1-5-21-1899613811-3316350630-256103360-1001 -> Default = {CFBFAE00-17A6-11D0-99CB-00C04FD64497}

URLSearchHook: HKU\S-1-5-21-1899613811-3316350630-256103360-1001 - (No Name) - {f897eb0e-a3a4-46c3-80eb-2729699d8892} - No File

SearchScopes: HKLM-x32 -> DefaultScope {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q;={searchTerms}&rls;=com.microsoft:{language}:{referrer:source?}&ie;={inputEncoding}&oe;={outputEncoding}&rlz;=1I7ACAW

SearchScopes: HKLM-x32 -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q;={searchTerms}&rls;=com.microsoft:{language}:{referrer:source?}&ie;={inputEncoding}&oe;={outputEncoding}&rlz;=1I7ACAW

SearchScopes: HKLM-x32 -> {ac2e4ae7-2d16-45ea-991c-2441dfd05696} URL = hxxp://search.mywebsearch.com/mywebsearch/GGmain.jhtml?id=XQxdm002Q0us&ptb;=D668C490-229E-47F4-94A4-DD3B058EE7E9&psa;=&ind;=2011090521&ptnrS;=XQxdm002Q0us&si;=CJGw15-3h6sCFWcbQgod-mSH0w&st;=sb&n;=77dece59&searchfor;={searchTerms}

SearchScopes: HKLM-x32 -> {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource;=4&ctid;=CT3061355

SearchScopes: HKU\S-1-5-21-1899613811-3316350630-256103360-1001 -> DefaultScope {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://www.trovi.com/Results.aspx?gd=&ctid;=CT3330390&octid;=EB_ORIGINAL_CTID&ISID;=MAB60BA3E-3E5D-4F90-AEB7-49587C0A430B&SearchSource;=58&CUI;=&UM;=6&UP;=SPF41586E7-B920-4C10-9531-416302518A5B&q;={searchTerms}&SSPV;=

SearchScopes: HKU\S-1-5-21-1899613811-3316350630-256103360-1001 -> {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://www.trovi.com/Results.aspx?gd=&ctid;=CT3330390&octid;=EB_ORIGINAL_CTID&ISID;=MAB60BA3E-3E5D-4F90-AEB7-49587C0A430B&SearchSource;=58&CUI;=&UM;=6&UP;=SPF41586E7-B920-4C10-9531-416302518A5B&q;={searchTerms}&SSPV;=

SearchScopes: HKU\S-1-5-21-1899613811-3316350630-256103360-1001 -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q;={searchTerms}&rls;=com.microsoft:{language}:{referrer:source?}&ie;={inputEncoding}&oe;={outputEncoding}&rlz;=1I7ACAW

SearchScopes: HKU\S-1-5-21-1899613811-3316350630-256103360-1001 -> {A7D1BBF7-77DC-4399-8474-F5B52E8A0714} URL = hxxp://search.yahoo.com/search?p={searchterms}&ei;=UTF-8&fr;=w3i&type;=W3i_DS,136,0_0,Search,20120938,17118,0,18,0

SearchScopes: HKU\S-1-5-21-1899613811-3316350630-256103360-1001 -> {ac2e4ae7-2d16-45ea-991c-2441dfd05696} URL = hxxp://search.mywebsearch.com/mywebsearch/GGmain.jhtml?id=XQxdm002Q0us&ptb;=D668C490-229E-47F4-94A4-DD3B058EE7E9&psa;=&ind;=2011090521&ptnrS;=XQxdm002Q0us&si;=CJGw15-3h6sCFWcbQgod-mSH0w&st;=sb&n;=77dece59&searchfor;={searchTerms}

SearchScopes: HKU\S-1-5-21-1899613811-3316350630-256103360-1001 -> {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL =

SearchScopes: HKU\S-1-5-21-1899613811-3316350630-256103360-1001 -> {F02F6974-32E8-4003-8AD7-6C1ED3CF3C05} URL = hxxp://www.mysearchresults.com/search?&c;=4200&t;=11&q;={searchTerms}

BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2016-04-06] (Google Inc.)

BHO-x32: &Yahoo;! Toolbar Helper -> {02478D38-C3F9-4efb-9B51-7695ECA05670} -> C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn1\yt.dll [2012-06-11] (Yahoo! Inc.)

BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-09-22] (Adobe Systems Incorporated)

BHO-x32: Qwiklinx -> {3E7C8B5A-96AB-438F-BF9B-782400655440} -> C:\Users\Debbie\AppData\Roaming\Qwiklinx\Qwiklinx.dll [2012-07-30] (Qwiklinx, Inc.)

BHO-x32: No Name -> {5C255C8A-E604-49b4-9D64-90988571CECB} -> No File

BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\ssv.dll [2014-12-11] (Oracle Corporation)

BHO-x32: Windows Live Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22] (Microsoft Corporation)

BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2016-04-06] (Google Inc.)

BHO-x32: Skype Browser Helper -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2011-07-11] (Skype Technologies S.A.)

BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\jp2ssv.dll [2014-12-11] (Oracle Corporation)

Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2016-04-06] (Google Inc.)

Toolbar: HKLM-x32 - Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn1\yt.dll [2012-06-11] (Yahoo! Inc.)

Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2016-04-06] (Google Inc.)

Toolbar: HKU\S-1-5-21-1899613811-3316350630-256103360-1001 -> Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2016-04-06] (Google Inc.)

Toolbar: HKU\S-1-5-21-1899613811-3316350630-256103360-1001 -> No Name - {F897EB0E-A3A4-46C3-80EB-2729699D8892} - No File

Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll [2009-07-26] (Microsoft Corporation)

Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll [2009-07-26] (Microsoft Corporation)

Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2011-07-11] (Skype Technologies S.A.)

FireFox:

========

FF Plugin: @microsoft.com/GENUINE -> disabled [No File]

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)

FF Plugin-x32: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll [2014-12-11] (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\plugin2\npjp2.dll [2014-12-11] (Oracle Corporation)

FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2009-07-10] (Microsoft Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-04-02] (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-04-02] (Google Inc.)

FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll [2011-09-28] ()

Chrome:

=======

CHR StartupUrls: Profile 1 -> "hxxps://www.google.com/"

CHR Profile: C:\Users\Debbie\AppData\Local\Google\Chrome\User Data\Profile 1

CHR Extension: (Google Slides) - C:\Users\Debbie\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-02-06]

CHR Extension: (Google Docs) - C:\Users\Debbie\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\aohghmighlieiainnegkcijnfilokake [2015-02-06]

CHR Extension: (Google Drive) - C:\Users\Debbie\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-11-18]

CHR Extension: (YouTube) - C:\Users\Debbie\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-11-18]

CHR Extension: (Google Search) - C:\Users\Debbie\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-11-18]

CHR Extension: (Google Sheets) - C:\Users\Debbie\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-02-06]

CHR Extension: (Google Docs Offline) - C:\Users\Debbie\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-04-06]

CHR Extension: (SlingPlayer for DISH Anywhere) - C:\Users\Debbie\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\jcnpmlegoehfgohpkmjhpohjchokamnn [2015-03-31]

CHR Extension: (Chrome Web Store Payments) - C:\Users\Debbie\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-04-06]

CHR Extension: (Gmail) - C:\Users\Debbie\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-03-31]

CHR HKLM-x32\…\Chrome\Extension: [dnfaglepmjgohnkcoieaijlheabmcdeo] - C:\Users\Debbie\AppData\Roaming\Qwiklinx\Qwiklinx.crx [2012-09-19]

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 Garmin Core Update Service; C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe [250200 2013-09-19] (Garmin Ltd or its subsidiaries)

R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23816 2015-04-30] (Microsoft Corporation)

S3 MWLService; C:\Program Files (x86)\EgisTec MyWinLocker\x86\MWLService.exe [305520 2010-05-26] (Egis Technology Inc.)

R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [366544 2015-04-30] (Microsoft Corporation)

S2 ProtectMonitor; C:\monitorsvc.exe [34244 2014-09-02] () [File not signed] <==== ATTENTION

S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

S2 Update Klip Pal; "C:\Program Files (x86)\Klip Pal\updateKlipPal.exe" [X]

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 ebdrv; C:\Windows\system32\DRIVERS\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)

R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [280376 2015-03-04] (Microsoft Corporation)

R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [124568 2015-03-04] (Microsoft Corporation)

U3 aswMBR; \??\C:\Users\Debbie\AppData\Local\Temp\aswMBR.sys [X]

U3 aswVmm; \??\C:\Users\Debbie\AppData\Local\Temp\aswVmm.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-04-06 20:33 - 2016-04-06 20:33 - 00020245 _____ C:\Users\Debbie\Downloads\FRST.txt

2016-04-06 20:31 - 2016-04-06 20:33 - 00000000 ____D C:\FRST

2016-04-06 19:47 - 2016-04-06 20:27 - 00004627 _____ C:\Users\Debbie\Desktop\aswMBR.txt

2016-04-06 19:47 - 2016-04-06 20:27 - 00000512 _____ C:\Users\Debbie\Desktop\MBR.dat

2016-04-06 19:47 - 2016-04-06 19:47 - 02374144 _____ (Farbar) C:\Users\Debbie\Downloads\FRST64.exe

2016-04-06 19:14 - 2016-04-06 19:14 - 05198336 _____ (AVAST Software) C:\Users\Debbie\Desktop\aswMBR.exe

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-04-06 20:15 - 2011-08-04 20:24 - 00000898 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2016-04-06 20:11 - 2012-04-29 19:22 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job

2016-04-06 20:01 - 2011-08-04 20:24 - 00000894 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2016-04-06 19:56 - 2009-07-14 01:13 - 00783400 _____ C:\Windows\system32\PerfStringBackup.INI

2016-04-06 19:56 - 2009-07-13 23:20 - 00000000 ____D C:\Windows\inf

2016-04-06 19:48 - 2009-07-14 01:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2016-04-06 19:34 - 2012-04-29 19:23 - 00002078 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk

2016-04-06 19:34 - 2012-04-29 19:23 - 00002066 _____ C:\Users\Public\Desktop\Google Chrome.lnk

2016-04-06 19:26 - 2009-07-14 00:45 - 00018736 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2016-04-06 19:26 - 2009-07-14 00:45 - 00018736 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2016-04-02 02:56 - 2016-01-10 22:41 - 00000000 ____D C:\8795b52e93712f92f941519da404bf31

2016-04-02 02:56 - 2015-05-14 01:24 - 00000000 ___SD C:\Windows\system32\GWX

2016-04-02 02:56 - 2012-05-17 16:51 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight

2016-04-02 02:56 - 2012-05-17 16:49 - 00000000 ____D C:\Program Files\Microsoft Silverlight

2016-04-02 02:56 - 2012-05-17 16:49 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight

2016-04-02 02:56 - 2009-07-13 23:20 - 00000000 ____D C:\Windows\servicing

2016-04-02 02:56 - 2009-07-13 23:20 - 00000000 ____D C:\Windows\registration

2016-04-02 02:56 - 2009-07-13 23:20 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared

2016-04-02 00:16 - 2010-12-25 18:57 - 00776014 _____ C:\Windows\SysWOW64\PerfStringBackup.INI

2016-04-02 00:14 - 2012-04-29 19:22 - 00797376 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2016-04-02 00:14 - 2012-04-29 19:22 - 00142528 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2016-04-02 00:14 - 2012-04-29 19:22 - 00003768 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater

2016-04-02 00:13 - 2015-11-18 20:17 - 19384512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe

2016-04-02 00:10 - 2011-08-04 20:24 - 00003894 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA

2016-04-02 00:10 - 2011-08-04 20:24 - 00003642 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore

2016-04-02 00:01 - 2010-12-25 18:43 - 00000000 ____D C:\Users\Debbie\AppData\Local\Google

2016-04-01 23:58 - 2010-12-25 18:34 - 00000000 ____D C:\Users\Debbie

2016-03-16 14:21 - 2010-12-25 19:20 - 00301728 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe

==================== Files in the root of some directories =======

2013-03-27 14:09 - 2011-09-05 21:11 - 0161728 _____ () C:\Program Files (x86)\v4res.dll

2013-02-20 17:28 - 2013-02-09 17:55 - 0114176 _____ () C:\Users\Debbie\AppData\Roaming\BabMaint.exe

2014-10-05 22:03 - 2014-10-05 22:03 - 1376256 _____ () C:\Users\Debbie\AppData\Local\ChromeHitoryDB

2013-03-27 14:05 - 2012-09-11 10:22 - 0196608 _____ () C:\Users\Debbie\AppData\Local\common_functions.dll

2013-03-06 18:44 - 2013-03-06 18:44 - 0005632 _____ () C:\Users\Debbie\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

2012-09-11 10:22 - 2012-09-11 10:22 - 0114688 _____ () C:\Users\Debbie\AppData\Local\ie_runner_app.exe

2013-03-27 14:05 - 2012-06-26 06:59 - 0940544 _____ (Apache Software Foundation) C:\Users\Debbie\AppData\Local\log4cxx.dll

2014-10-05 22:09 - 2014-10-05 22:14 - 0000003 _____ () C:\Users\Debbie\AppData\Local\proxy.log

Some files in TEMP:

====================

C:\Users\Debbie\AppData\Local\Temp\B6A7.exe

C:\Users\Debbie\AppData\Local\Temp\bpuninstall.exe

C:\Users\Debbie\AppData\Local\Temp\COMAP.EXE

C:\Users\Debbie\AppData\Local\Temp\DefaultTabSetup.exe

C:\Users\Debbie\AppData\Local\Temp\GLFE1AF.tmp.dll

C:\Users\Debbie\AppData\Local\Temp\GoogleToolbarInstaller.exe

C:\Users\Debbie\AppData\Local\Temp\Launcher.exe

C:\Users\Debbie\AppData\Local\Temp\MybabylonTB.exe

C:\Users\Debbie\AppData\Local\Temp\Offercast2802_WBV5_.exe

C:\Users\Debbie\AppData\Local\Temp\PDFCreator.exe

C:\Users\Debbie\AppData\Local\Temp\SearchWithGoogleUpdate.exe

C:\Users\Debbie\AppData\Local\Temp\SkypeSetup.exe

C:\Users\Debbie\AppData\Local\Temp\SpOrder.dll

C:\Users\Debbie\AppData\Local\Temp\STWSetup.exe

C:\Users\Debbie\AppData\Local\Temp\tbSmi0.dll

C:\Users\Debbie\AppData\Local\Temp\The_Weather_Channel_Application.exe

C:\Users\Debbie\AppData\Local\Temp\Toolbar_Toggle.exe

C:\Users\Debbie\AppData\Local\Temp\wget.exe

==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed

C:\Windows\system32\wininit.exe => File is digitally signed

C:\Windows\SysWOW64\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\system32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\system32\services.exe => File is digitally signed

C:\Windows\system32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\system32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\system32\rpcss.dll => File is digitally signed

C:\Windows\system32\dnsapi.dll => File is digitally signed

C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed

C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

==================== BCD ================================

Windows Boot Manager

——————–

identifier {bootmgr}

device partition=\Device\HarddiskVolume2

description Windows Boot Manager

locale en-US

inherit {globalsettings}

default {current}

resumeobject {ef74a698-c28f-11df-a78e-9c61b7454e05}

displayorder {current}

toolsdisplayorder {memdiag}

timeout 30

Windows Boot Loader

——————-

identifier {current}

device partition=C:

path \Windows\system32\winload.exe

description Windows 7

locale en-US

inherit {bootloadersettings}

recoverysequence {ef74a69a-c28f-11df-a78e-9c61b7454e05}

recoveryenabled Yes

osdevice partition=C:

systemroot \Windows

resumeobject {ef74a698-c28f-11df-a78e-9c61b7454e05}

nx OptIn

Windows Boot Loader

——————-

identifier {ef74a69a-c28f-11df-a78e-9c61b7454e05}

device ramdisk=[C:]\Recovery\ef74a69a-c28f-11df-a78e-9c61b7454e05\Winre.wim,{ef74a69b-c28f-11df-a78e-9c61b7454e05}

path \windows\system32\winload.exe

description Windows Recovery Environment

inherit {bootloadersettings}

osdevice ramdisk=[C:]\Recovery\ef74a69a-c28f-11df-a78e-9c61b7454e05\Winre.wim,{ef74a69b-c28f-11df-a78e-9c61b7454e05}

systemroot \windows

nx OptIn

winpe Yes

Resume from Hibernate

———————

identifier {ef74a698-c28f-11df-a78e-9c61b7454e05}

device partition=C:

path \Windows\system32\winresume.exe

description Windows Resume Application

locale en-US

inherit {resumeloadersettings}

filedevice partition=C:

filepath \hiberfil.sys

debugoptionenabled No

Windows Memory Tester

———————

identifier {memdiag}

device partition=\Device\HarddiskVolume2

path \boot\memtest.exe

description Windows Memory Diagnostic

locale en-US

inherit {globalsettings}

badmemoryaccess Yes

EMS Settings

————

identifier {emssettings}

bootems Yes

Debugger Settings

—————–

identifier {dbgsettings}

debugtype Serial

debugport 1

baudrate 115200

RAM Defects

———–

identifier {badmemory}

Global Settings

—————

identifier {globalsettings}

inherit {dbgsettings}

{emssettings}

{badmemory}

Boot Loader Settings

——————–

identifier {bootloadersettings}

inherit {globalsettings}

{hypervisorsettings}

Hypervisor Settings

——————-

identifier {hypervisorsettings}

hypervisordebugtype Serial

hypervisordebugport 1

hypervisorbaudrate 115200

Resume Loader Settings

———————-

identifier {resumeloadersettings}

inherit {globalsettings}

Device options

————–

identifier {ef74a69b-c28f-11df-a78e-9c61b7454e05}

description Ramdisk Options

ramdisksdidevice partition=C:

ramdisksdipath \Recovery\ef74a69a-c28f-11df-a78e-9c61b7454e05\boot.sdi

LastRegBack: 2015-11-20 03:52

==================== End of FRST.txt ============================

FRST - ADDITIONAL LOGFILE

Additional scan result of Farbar Recovery Scan Tool (x64) Version:05-03-2016 01

Ran by [removed] (2016-04-06 20:34:19)

Running from C:\Users\[removed]\Downloads

Windows 7 Home Premium Service Pack 1 (X64) (2010-12-25 22:34:50)

Boot Mode: Normal

==========================================================

==================== Accounts: =============================

Administrator (S-1-5-21-1899613811-3316350630-256103360-500 - Administrator - Disabled)

Debbie (S-1-5-21-1899613811-3316350630-256103360-1001 - Administrator - Enabled) => C:\Users\Debbie

Guest (S-1-5-21-1899613811-3316350630-256103360-501 - Limited - Disabled)

HomeGroupUser$ (S-1-5-21-1899613811-3316350630-256103360-1002 - Limited - Enabled)

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Microsoft Security Essentials (Enabled - Up to date) {B7ECF8CD-0188-6703-DBA4-AA65C6ACFB0A}

AS: Microsoft Security Essentials (Enabled - Up to date) {0C8D1929-27B2-688D-E114-9117BD2BB1B7}

AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Acer Backup Manager (HKLM-x32\…\InstallShield_{72B776E5-4530-4C4B-9453-751DF87D9D93}) (Version: 2.0.0.68 - NewTech Infosystems)

Acer Crystal Eye webcam (HKLM-x32\…\{51F026FA-5146-4232-A8BA-1364740BD053}) (Version: 1.0.4.2 - Liteon)

Acer ePower Management (HKLM-x32\…\{3DB0448D-AD82-4923-B305-D001E521A964}) (Version: 5.00.3005 - Acer Incorporated)

Acer eRecovery Management (HKLM-x32\…\{7F811A54-5A09-4579-90E1-C93498E230D9}) (Version: 4.05.3013 - Acer Incorporated)

Acer Registration (HKLM-x32\…\Acer Registration) (Version: 1.03.3003 - Acer Incorporated)

Acer ScreenSaver (HKLM-x32\…\Acer Screensaver) (Version: 1.1.0707.2010 - Acer Incorporated)

Acer Updater (HKLM-x32\…\{EE171732-BEB4-4576-887D-CB62727F01CA}) (Version: 1.02.3001 - Acer Incorporated)

Acrobat.com (HKLM-x32\…\{287ECFA4-719A-2143-A09B-D6A12DE54E40}) (Version: 1.6.65 - Adobe Systems Incorporated)

Adobe AIR (HKLM-x32\…\Adobe AIR) (Version: 3.1.0.4880 - Adobe Systems Incorporated)

Adobe Flash Player 21 ActiveX (HKLM-x32\…\Adobe Flash Player ActiveX) (Version: 21.0.0.197 - Adobe Systems Incorporated)

Adobe Reader 9.4.2 MUI (HKLM-x32\…\{AC76BA86-7AD7-FFFF-7B44-A91000000001}) (Version: 9.4.2 - Adobe Systems Incorporated)

AV Voice Changer Software 7.0 (HKLM-x32\…\AV Voice Changer Software 7.0) (Version: 7.0.47 - AVSOFT Corp.)

Backup Manager Basic (x32 Version: 2.0.0.68 - NewTech Infosystems) Hidden

Camtasia Studio 8 (HKLM-x32\…\{2EB28256-1D66-49F1-AF66-691BF9A27C79}) (Version: 8.0.2.918 - TechSmith Corporation)

Click to Call with Skype (HKLM-x32\…\{B6CF2967-C81E-40C0-9815-C05774FEF120}) (Version: 5.5.8013 - Skype Technologies S.A.)

CyberLink PowerDVD 9 (HKLM-x32\…\InstallShield_{A8516AC9-AAF1-47F9-9766-03E2D4CDBCF8}) (Version: 9.0.2829.50 - CyberLink Corp.)

Elevated Installer (x32 Version: 2.3.14.0 - Garmin Ltd or its subsidiaries) Hidden

eSobi v2 (HKLM-x32\…\InstallShield_{15D967B5-A4BE-42AE-9E84-64CD062B25AA}) (Version: 2.0.4.000274 - esobi Inc.)

eSobi v2 (x32 Version: 2.0.4.000274 - esobi Inc.) Hidden

ETDWare PS/2-x64 7.0.6.5_WHQL (HKLM\…\Elantech) (Version: 7.0.6.5 - ELAN Microelectronics Corp.)

Garmin Express (HKLM-x32\…\{9471d6bd-67a9-40f6-a420-2ae4f08ef003}) (Version: 2.3.14.0 - Garmin Ltd or its subsidiaries)

Garmin Express (x32 Version: 2.3.14.0 - Garmin Ltd or its subsidiaries) Hidden

Garmin Express Tray (x32 Version: 2.3.14.0 - Garmin Ltd or its subsidiaries) Hidden

Google Chrome (HKLM-x32\…\Google Chrome) (Version: 49.0.2623.110 - Google Inc.)

Google Toolbar for Internet Explorer (HKLM-x32\…\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.7210.1528 - Google Inc.)

Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden

Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden

Google Update Helper (x32 Version: 1.3.29.5 - Google Inc.) Hidden

Identity Card (HKLM-x32\…\Identity Card) (Version: 1.00.3003 - Acer Incorporated)

Intel(R) Graphics Media Accelerator Driver (HKLM\…\HDMI) (Version: 8.15.10.1892 - Intel Corporation)

Intel(R) Rapid Storage Technology (HKLM-x32\…\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 9.6.2.1001 - Intel Corporation)

Java 8 Update 25 (HKLM-x32\…\{26A24AE4-039D-4CA4-87B4-2F83218025F0}) (Version: 8.0.250 - Oracle Corporation)

Junk Mail filter update (x32 Version: 14.0.8089.726 - Microsoft Corporation) Hidden

Launch Manager (HKLM-x32\…\LManager) (Version: 4.0.12 - Acer Inc.)

Microsoft .NET Framework 4.5.2 (HKLM\…\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)

Microsoft Office 2010 (HKLM-x32\…\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)

Microsoft Office Click-to-Run 2010 (HKLM-x32\…\Office14.Click2Run) (Version: 14.0.4763.1000 - Microsoft Corporation)

Microsoft Office Starter 2010 - English (HKLM-x32\…\{90140011-0066-0409-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)

Microsoft PowerPoint Viewer (HKLM-x32\…\{95140000-00AF-0409-0000-0000000FF1CE}) (Version: 14.0.7015.1000 - Microsoft Corporation)

Microsoft Security Essentials (HKLM\…\Microsoft Security Client) (Version: 4.8.204.0 - Microsoft Corporation)

Microsoft Silverlight (HKLM\…\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40728.0 - Microsoft Corporation)

Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\…\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (HKLM-x32\…\{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\…\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\…\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

MusicOasis (HKLM-x32\…\MusicOasis) (Version: 1.0.3 - W3i, LLC)

MusicOasis (x32 Version: 1.0.3 - W3i, LLC) Hidden

MyWinLocker (x32 Version: 3.1.212.0 - Egis Technology Inc.) Hidden

MyWinLocker Suite (HKLM-x32\…\InstallShield_{738BF5C3-AF7B-4BB0-B7EF-E505EFC756BE}) (Version: 3.1.212.0 - Egis Technology Inc.)

MyWinLocker Suite (x32 Version: 3.1.212.0 - Egis Technology Inc.) Hidden

NTI Media Maker 9 (HKLM-x32\…\InstallShield_{D3D5C4E8-040F-4C6F-8105-41D43CF94F44}) (Version: 9.0.2.8928 - NTI Corporation)

NTI Media Maker 9 (x32 Version: 9.0.2.8928 - NTI Corporation) Hidden

Qwiklinx (HKLM-x32\…\{2E497885-E60B-420A-832D-0148B392E058}_is1) (Version: 1.2.0.1073 - Qwiklinx, Inc.) <==== ATTENTION

Realtek High Definition Audio Driver (HKLM-x32\…\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6151 - Realtek Semiconductor Corp.)

Realtek USB 2.0 Card Reader (HKLM-x32\…\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.7600.30121 - Realtek Semiconductor Corp.)

Shredder (Version: 2.0.8.3 - Egis Technology Inc.) Hidden

Shredder (x32 Version: 2.0.8.3 - Egis Technology Inc.) Hidden

Skype™ 7.0 (HKLM-x32\…\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.0.102 - Skype Technologies S.A.)

Update Installer for WildTangent Games App (x32 Version: - WildTangent) Hidden

Welcome Center (HKLM-x32\…\Acer Welcome Center) (Version: 1.02.3004 - Acer Incorporated)

WildTangent Games App (Acer Games) (HKLM-x32\…\{70B446D1-E03B-4ab0-9B3C-0832142C9AA8}.WildTangent Games App-acer) (Version: 4.0.5.36 - WildTangent)

Windows Live Essentials (HKLM-x32\…\WinLiveSuite_Wave3) (Version: 14.0.8089.0726 - Microsoft Corporation)

Windows Live Sign-in Assistant (HKLM-x32\…\{45338B07-A236-4270-9A77-EBB4115517B5}) (Version: 5.000.818.5 - Microsoft Corporation)

Windows Live Sync (HKLM-x32\…\{84EBDF39-4B33-49D7-A0BD-EB6E2C4E81C1}) (Version: 14.0.8089.726 - Microsoft Corporation)

Windows Live Upload Tool (HKLM-x32\…\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation)

Yahoo! Software Update (HKLM-x32\…\Yahoo! Software Update) (Version: - )

Yahoo! Toolbar (HKLM-x32\…\Yahoo! Companion) (Version: - Yahoo! Inc.)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {2F373E74-2A86-4815-91B0-54C6E4BE31AA} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-09-13] (Google Inc.)

Task: {385C5355-783E-48CA-BEBC-5799CD14BC01} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2016-04-02] (Adobe Systems Incorporated)

Task: {51E32AAD-85FB-4FF9-8A1B-FBEED274AF6F} - System32\Tasks\{4FA204F3-60A2-4BDF-91BB-0ADDE72671F1} => C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVH.EXE [2015-03-18] (Microsoft Corporation)

Task: {97BA4D50-E9EA-43C2-A1BC-11C9A0E6D762} - System32\Tasks\{BA64D830-E412-4168-B90F-7E1A4C056C46} => C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVH.EXE [2015-03-18] (Microsoft Corporation)

Task: {ED495C72-B444-47B5-BF63-F5303220F749} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-09-13] (Google Inc.)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Shortcuts =============================

(The entries could be listed to be restored or removed.)

ShortcutWithArgument: C:\Users\Public\Desktop\Netflix.lnk -> C:\ProgramData\OEM_E471269A730D\Netflix\StartURL.exe () -> hxxp://homepage.acer.com/redirect.aspx?rid=09000001

==================== Loaded Modules (Whitelisted) ==============

2014-09-02 15:55 - 2014-09-02 15:55 - 00487483 _____ () C:\monitor.exe

2010-07-23 03:00 - 2009-05-20 02:02 - 00072200 _____ () C:\Program Files (x86)\Launch Manager\CdDirIo.dll

2010-06-28 18:20 - 2010-06-28 18:20 - 00465576 _____ () C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\sqlite3.dll

2010-06-28 18:12 - 2010-06-28 18:12 - 01081600 _____ () C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\ACE.dll

2015-12-12 22:26 - 2015-12-04 17:32 - 01583432 _____ () C:\Program Files (x86)\Google\Chrome\Application\47.0.2526.80\libglesv2.dll

2015-12-12 22:26 - 2015-12-04 17:32 - 00081224 _____ () C:\Program Files (x86)\Google\Chrome\Application\47.0.2526.80\libegl.dll

2014-11-04 21:03 - 2014-11-04 21:03 - 00170496 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\89753abff3827095ec7f3d3fb79f744a\IsdiInterop.ni.dll

2010-07-23 02:29 - 2010-04-13 12:52 - 00058880 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll

2016-04-06 19:32 - 2016-04-05 12:27 - 17532096 _____ () C:\Users\Debbie\AppData\Local\Google\Chrome\User Data\PepperFlash\21.0.0.213\pepflashplayer.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\McMPFSvc => ""="Service"

==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)

==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-13 22:34 - 2014-10-05 22:16 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-1899613811-3316350630-256103360-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Debbie\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg

DNS Servers: 10.0.0.1

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 0) (ConsentPromptBehaviorUser: 3) (EnableLUA: 0)

Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\startupreg: Norton Online Backup => C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe

MSCONFIG\startupreg: Skype => "C:\Program Files (x86)\Skype\Phone\Skype.exe" /nosplash /minimized

MSCONFIG\startupreg: swg => "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [{4B9D92A7-B5CE-45B4-86F2-CF531E4781FD}] => (Allow) C:\Program Files\Common Files\mcafee\mcsvchost\McSvHost.exe

FirewallRules: [{2346A409-6660-46CD-8F23-6FE9FD6F27E2}] => (Allow) C:\Program Files\Common Files\mcafee\mcsvchost\McSvHost.exe

FirewallRules: [{9EED9F8B-CF06-4BB0-86E2-36E06A147805}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD9\PowerDVD9.EXE

FirewallRules: [{13769E7D-9CA6-4F1B-AAFA-FE7DCD1649CA}] => (Allow) C:\Program Files (x86)\Windows Live\Messenger\wlcsdk.exe

FirewallRules: [{D5087247-6B11-42C9-82FF-A5A76CA40F17}] => (Allow) C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe

FirewallRules: [{8D874767-346E-48D3-B78C-CDCE15E512E6}] => (Allow) svchost.exe

FirewallRules: [{8B9E874C-CD75-410D-B1B9-166BCCF7C4E2}] => (Allow) C:\Program Files (x86)\Windows Live\Sync\WindowsLiveSync.exe

FirewallRules: [{D036979F-4663-4384-8868-6419C37A5064}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe

FirewallRules: [{1C14E218-984C-426C-B964-A553FF841305}] => (Allow) C:\Program Files (x86)\Bench\Proxy\proc.exe

FirewallRules: [{F14E4A8C-7FC5-4ACD-BAA5-0F5363E048BD}] => (Allow) C:\Program Files (x86)\Bench\Proxy\pwdg.exe

FirewallRules: [{300D1CFD-6996-4FEC-97E8-43E08985DA27}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Restore Points =========================

20-11-2015 04:00:19 Windows Update

25-11-2015 00:03:22 Windows Update

30-11-2015 23:27:47 Windows Update

06-12-2015 22:31:16 Windows Update

10-01-2016 22:31:39 Windows Update

18-01-2016 17:32:22 Windows Update

02-04-2016 00:00:19 Windows Update

==================== Faulty Device Manager Devices =============

Name:

Description:

Class Guid:

Manufacturer:

Service:

Problem: : The drivers for this device are not installed. (Code 28)

Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

==================== Event log errors: =========================

Application errors:

==================

Error: (04/01/2016 10:00:44 PM) (Source: SecurityCenter) (EventID: 3) (User: )

Description: The Windows Security Center Service was unable to establish event queries with WMI to monitor third party AntiVirus, AntiSpyware and Firewall.

Error: (04/01/2016 10:00:44 PM) (Source: WinMgmt) (EventID: 29) (User: )

Description: 0x80041014

Error: (04/01/2016 10:00:38 PM) (Source: WinMgmt) (EventID: 29) (User: )

Description: 0x80041014

Error: (04/01/2016 10:00:33 PM) (Source: EventSystem) (EventID: 4610) (User: )

Description: d:\w7rtm\com\complus\src\events\tier2\service.cpp33380040155

Error: (04/01/2016 10:00:33 PM) (Source: EventSystem) (EventID: 4610) (User: )

Description: d:\w7rtm\com\complus\src\events\tier2\service.cpp20080040155

Error: (04/01/2016 09:58:32 PM) (Source: WinMgmt) (EventID: 29) (User: )

Description: 0x80041014

Error: (04/01/2016 09:57:56 PM) (Source: EventSystem) (EventID: 4610) (User: )

Description: d:\w7rtm\com\complus\src\events\tier2\service.cpp33380040155

Error: (04/01/2016 09:57:56 PM) (Source: EventSystem) (EventID: 4610) (User: )

Description: d:\w7rtm\com\complus\src\events\tier2\service.cpp20080040155

Error: (04/01/2016 09:22:47 PM) (Source: SecurityCenter) (EventID: 3) (User: )

Description: The Windows Security Center Service was unable to establish event queries with WMI to monitor third party AntiVirus, AntiSpyware and Firewall.

Error: (04/01/2016 09:22:47 PM) (Source: WinMgmt) (EventID: 29) (User: )

Description: 0x80041014

System errors:

=============

Error: (04/06/2016 07:58:35 PM) (Source: Service Control Manager) (EventID: 7006) (User: )

Description: The ScRegSetValueExW call failed for Start with the following error:

%%5

Error: (04/06/2016 07:50:42 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: The Garmin Core Update Service service failed to start due to the following error:

%%1053

Error: (04/06/2016 07:50:42 PM) (Source: Service Control Manager) (EventID: 7009) (User: )

Description: A timeout was reached (30000 milliseconds) while waiting for the Garmin Core Update Service service to connect.

Error: (04/06/2016 07:49:42 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: The Update Klip Pal service failed to start due to the following error:

%%2

Error: (04/06/2016 07:49:38 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: The Protect Monitor service failed to start due to the following error:

%%1053

Error: (04/06/2016 07:49:38 PM) (Source: Service Control Manager) (EventID: 7009) (User: )

Description: A timeout was reached (30000 milliseconds) while waiting for the Protect Monitor service to connect.

Error: (04/06/2016 07:49:32 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: The Garmin Core Update Service service failed to start due to the following error:

%%1053

Error: (04/06/2016 07:49:32 PM) (Source: Service Control Manager) (EventID: 7009) (User: )

Description: A timeout was reached (30000 milliseconds) while waiting for the Garmin Core Update Service service to connect.

Error: (04/02/2016 12:26:49 AM) (Source: Service Control Manager) (EventID: 7023) (User: )

Description: The Software Protection service terminated with the following error:

%%19

Error: (04/02/2016 12:26:47 AM) (Source: Service Control Manager) (EventID: 7023) (User: )

Description: The Windows Modules Installer service terminated with the following error:

%%16405

CodeIntegrity:

===================================

Date: 2015-08-23 10:45:45.335

Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files (x86)\Web Protect\pcwtc64f.sys because the set of per-page image hashes could not be found on the system.

Date: 2015-08-23 09:18:43.009

Date: 2015-08-21 15:29:50.156

Date: 2015-08-20 16:23:11.513

Date: 2015-08-17 10:14:52.719

Date: 2015-08-17 10:12:48.169

Date: 2015-08-17 00:25:14.490

Date: 2015-08-17 00:23:43.012

Date: 2015-05-23 11:40:13.561

Date: 2015-02-26 12:15:27.685

==================== Memory info ===========================

Processor: Pentium(R) Dual-Core CPU T4500 @ 2.30GHz

Percentage of memory in use: 64%

Total physical RAM: 4025.97 MB

Available physical RAM: 1446.03 MB

Total Virtual: 8050.15 MB

Available Virtual: 5227.7 MB

==================== Drives ================================

Drive c: (Acer) (Fixed) (Total:284.99 GB) (Free:168.48 GB) NTFS

==================== MBR & Partition Table ==================

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298.1 GB) (Disk ID: 9B983143)

Partition 1: (Not Active) - (Size=13 GB) - (Type=27)

Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=285 GB) - (Type=07 NTFS)

==================== End of Addition.txt ============================

Satchfan

Post #2April 7, 2016, 8:15 AM UTC last edited April 7, 2016, 8:15 AM UTC

Hello ShawBuck and welcome to the WTT forum.

My name is Satchfan and I would be glad to help you with your computer problem.

Please read the following guidelines which will help to make cleaning your machine easier:

please follow all instructions in the order posted
please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear
all logs/reports, etc. must be posted in Notepad. Please ensure that word wrap is unchecked. In Notepad click Format, uncheck Word wrap if it is checked
if you don't understand something, please don't hesitate to ask for clarification before proceeding
the fixes are specific to your problem and should only be used for this issue on this machine.
please reply within 3 days. If you do not reply within this period I will post a reminder but topics with no reply in 4 days will be closed!

IMPORTANT:

Please DO NOT install/uninstall any programs unless asked to.
Please DO NOT run any scans other than those requested

===================================================

Note: Please complete these tasks in the order given in the instructions.

===================================================

Download and run AdwCleaner

Download AdwCleaner from here and save it to your desktop.

run AdwCleaner
when it has finished, select Clean
if it asks to reboot, allow the reboot
on reboot a log will be produced; please attach the content of the log to your next reply.

===================================================

Download and run Junkware Removal Tool

Please download Junkware Removal Tool to your desktop.

shut down your protection software now to avoid potential conflicts.
run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator"
the tool will open and start scanning your system
please be patient as this can take a while to complete depending on your system's specifications
on completion, a log (JRT.txt) is saved to your desktop and will automatically open
post the contents of JRT.txt into your next message.

===================================================

Download Malwarebytes-Anti-Malware

Click here.

double-click mbam-setup.exe and follow the prompts to install the program – (Note: Vista & Windows 7, 8, 10 users, please right-click and select “Run as Administrator”)
select the “Scan” tab at the top
there are three scan types; choose Threat Scan, then click on Scan
when the scan is complete, if no malicious items are found you can close the program
if malicious items are found be sure that everything is checked and click Quarantine
when removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below)
the log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
copy and paste the contents of that report in your next reply and exit MBAM.

NOTE: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

Logs to include with next post:

AdwCleaner log
JRT.txt
Mbam.txt

Thanks

Satchfan

ShawBuck

Post #3April 8, 2016, 5:59 AM UTC

Thank you so much for your help. Hopefully the laptop isn't too bad.

Okay, strange thing happened after I ran the AdwCleaner. After reboot, I could not access the internet…even after rebooting again. So I re-ran the program and then was able to access the internet. Strange…so I am attached both logs for AdwCleaner, followed by the JRT and mbam logs:

AdwCleaner log #1

# AdwCleaner v5.109 - Logfile created 08/04/2016 at 00:06:59

# Updated 04/04/2016 by Xplode

# Database : 2016-04-07.1 [Server]

# Operating system : Windows 7 Home Premium Service Pack 1 (x64)

# Username : Debbie - DEBBIE-LAPTOP

# Running from : C:\Users\Debbie\Desktop\adwcleaner_5.109.exe

# Option : Clean

# Support : http://toolslib.net/forum

***** [ Services ] *****

[-] Service Deleted : ProtectMonitor

[-] Service Deleted : YahooAUService

[-] Service Deleted : Update Klip Pal

***** [ Folders ] *****

[-] Folder Deleted : C:\Program Files (x86)\Bench

[-] Folder Deleted : C:\Program Files (x86)\Conduit

[-] Folder Deleted : C:\Program Files (x86)\Free Offers from Freeze.com

[-] Folder Deleted : C:\Program Files (x86)\Qwiklinx

[-] Folder Deleted : C:\Program Files (x86)\Web Protect

[-] Folder Deleted : C:\Program Files (x86)\Yahoo!\Companion

[-] Folder Deleted : C:\Program Files (x86)\DictionaryBossEI

[-] Folder Deleted : C:\ProgramData\Babylon

[-] Folder Deleted : C:\ProgramData\Partner

[-] Folder Deleted : C:\ProgramData\Yahoo! Companion

[#] Folder Deleted : C:\ProgramData\Application Data\Babylon

[#] Folder Deleted : C:\ProgramData\Application Data\Partner

[#] Folder Deleted : C:\ProgramData\Application Data\Yahoo! Companion

[-] Folder Deleted : C:\Users\Debbie\AppData\Local\Conduit

[-] Folder Deleted : C:\Users\Debbie\AppData\Local\Temp\Klip Pal

[-] Folder Deleted : C:\Users\Debbie\AppData\Local\Temp\mt_ffx

[-] Folder Deleted : C:\Users\Debbie\AppData\LocalLow\BabylonToolbar

[-] Folder Deleted : C:\Users\Debbie\AppData\LocalLow\Conduit

[-] Folder Deleted : C:\Users\Debbie\AppData\LocalLow\Yahoo! Companion

[-] Folder Deleted : C:\Users\Debbie\AppData\LocalLow\Yahoo!\Companion

[-] Folder Deleted : C:\Users\Debbie\AppData\LocalLow\DictionaryBossEI

[-] Folder Deleted : C:\Users\Debbie\AppData\Roaming\BabSolution

[-] Folder Deleted : C:\Users\Debbie\AppData\Roaming\Babylon

[-] Folder Deleted : C:\Users\Debbie\AppData\Roaming\Qwiklinx

[-] Folder Deleted : C:\Users\Debbie\AppData\Roaming\Yahoo!\Companion

[-] Folder Deleted : C:\Users\Debbie\Documents\ShopToWin

***** [ Files ] *****

[-] File Deleted : C:\monitorsvc.exe

[-] File Deleted : C:\Program Files (x86)\Yahoo!\Common\unyt.exe

[-] File Deleted : C:\Users\Debbie\AppData\Local\Temp\launcher.exe

[-] File Deleted : C:\Users\Debbie\AppData\Roaming\BabMaint.exe

[-] File Deleted : C:\Windows\SysNative\MyOSProtect64.dll

[-] File Deleted : C:\Windows\SysNative\MyOSProtectOff.ini

[-] File Deleted : C:\Windows\SysWOW64\MyOSProtect.dll

[-] File Deleted : C:\Windows\SysWOW64\MyOSProtect.ini

[-] File Deleted : C:\Windows\SysWOW64\MyOSProtectOff.ini

***** [ DLLs ] *****

***** [ Shortcuts ] *****

***** [ Scheduled tasks ] *****

***** [ Registry ] *****

[-] Key Deleted : HKLM\SOFTWARE\Classes\AppID\yt.DLL

[-] Key Deleted : HKLM\SOFTWARE\Classes\AppID\ytbbroker.EXE

[-] Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT3061355

[-] Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\dnfaglepmjgohnkcoieaijlheabmcdeo

[-] Key Deleted : HKLM\SOFTWARE\Classes\FreeCauseURLSearchHook.FCToolbarURLSearchHook

[-] Key Deleted : HKLM\SOFTWARE\Classes\FreeCauseURLSearchHook.FCToolbarURLSearchHook.1

[-] Key Deleted : HKLM\SOFTWARE\Classes\IMsiDe1egate.Application.1

[-] Key Deleted : HKLM\SOFTWARE\Classes\Prod.cap

[-] Key Deleted : HKLM\SOFTWARE\Classes\protector_dll.Protector

[-] Key Deleted : HKLM\SOFTWARE\Classes\protector_dll.Protector.1

[-] Key Deleted : HKLM\SOFTWARE\Classes\protector_dll.ProtectorBho

[-] Key Deleted : HKLM\SOFTWARE\Classes\protector_dll.ProtectorBho.1

[-] Key Deleted : HKLM\SOFTWARE\Classes\protector_dll.ProtectorLib

[-] Key Deleted : HKLM\SOFTWARE\Classes\protector_dll.ProtectorLib.1

[-] Key Deleted : HKLM\SOFTWARE\Classes\QwiklinxBHO

[-] Key Deleted : HKLM\SOFTWARE\Classes\QwiklinxBHO.1

[-] Key Deleted : HKLM\SOFTWARE\Classes\YBrowserToolbar.YBrowserToolbar

[-] Key Deleted : HKLM\SOFTWARE\Classes\YBrowserToolbar.YBrowserToolbar.1

[-] Key Deleted : HKLM\SOFTWARE\Classes\yt.CacheLoader

[-] Key Deleted : HKLM\SOFTWARE\Classes\yt.CacheLoader.1

[-] Key Deleted : HKLM\SOFTWARE\Classes\yt.Clickstream

[-] Key Deleted : HKLM\SOFTWARE\Classes\yt.Clickstream.1

[-] Key Deleted : HKLM\SOFTWARE\Classes\yt.YTHelper

[-] Key Deleted : HKLM\SOFTWARE\Classes\yt.YTHelper.2

[-] Key Deleted : HKLM\SOFTWARE\Classes\yt.YToolbarBand

[-] Key Deleted : HKLM\SOFTWARE\Classes\yt.YToolbarBand.1

[-] Key Deleted : HKLM\SOFTWARE\Classes\ytbbroker.YTBAutoSearchAssistant

[-] Key Deleted : HKLM\SOFTWARE\Classes\ytbbroker.YTBAutoSearchAssistant.1

[-] Key Deleted : HKLM\SOFTWARE\Classes\ytbbroker.YTBAutoUpdaterAssistant

[-] Key Deleted : HKLM\SOFTWARE\Classes\ytbbroker.YTBAutoUpdaterAssistant.1

[-] Key Deleted : HKLM\SOFTWARE\Classes\ytbbroker.YTBCustomizerAssistant

[-] Key Deleted : HKLM\SOFTWARE\Classes\ytbbroker.YTBCustomizerAssistant.1

[-] Key Deleted : HKLM\SOFTWARE\Classes\ytbbroker.YTBGeneralAssistant

[-] Key Deleted : HKLM\SOFTWARE\Classes\ytbbroker.YTBGeneralAssistant.1

[-] Key Deleted : HKLM\SOFTWARE\Classes\ytbbroker.YTBMessengerAssistant

[-] Key Deleted : HKLM\SOFTWARE\Classes\ytbbroker.YTBMessengerAssistant.1

[-] Key Deleted : HKLM\SOFTWARE\Classes\ytbbroker.YTBSingleInstanceAssistant

[-] Key Deleted : HKLM\SOFTWARE\Classes\ytbbroker.YTBSingleInstanceAssistant.1

[-] Key Deleted : HKLM\SOFTWARE\Classes\YTNavAssist.NameSpaceCF

[-] Key Deleted : HKLM\SOFTWARE\Classes\YTNavAssist.NameSpaceCF.1

[-] Key Deleted : HKLM\SOFTWARE\Classes\YTNavAssist.NameSpacePP

[-] Key Deleted : HKLM\SOFTWARE\Classes\YTNavAssist.NameSpacePP.1

[-] Key Deleted : HKLM\SOFTWARE\Classes\AppID\{186E19A3-B909-4F48-B687-BB81EB8BC7CE}

[-] Key Deleted : HKLM\SOFTWARE\Classes\AppID\{72D89EBF-0C5D-4190-91FD-398E45F1D007}

[-] Key Deleted : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}

[-] Key Deleted : HKLM\SOFTWARE\Classes\AppID\{1CAE874F-F5C7-4BCC-BA46-9AD26DF35B93}

[-] Key Deleted : HKLM\SOFTWARE\Classes\AppID\{EFC0651C-B6D7-49CD-A6E0-B1CE9AB5FE46}

[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{058F0E48-61CA-4964-9FBA-1978A1BB060D}

[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{18F33C35-8EF2-40D7-8BA4-932B0121B472}

[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}

[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}

[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3E7C8B5A-96AB-438F-BF9B-782400655440}

[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{81017EA9-9AA8-4A6A-9734-7AF40E7D593F}

[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{1E57256D-9F39-4267-AB39-D7813D644C5A}

[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{31371420-098D-4C0E-A11E-EBEC2305DD01}

[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3A06AA27-D94B-48C2-BB55-9FD0FF2120E3}

[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{46140CE4-76FE-440E-AE88-4C2272BC05C7}

[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{9F9C4C5C-2BA8-4E00-A697-9F710BB1026B}

[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{C60CCE95-6AF9-4E74-B66B-3212D19F1D2F}

[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{FBE30D66-39A2-4b72-8B43-6D4C335A6F34}

[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{0FCE4F01-64EC-42F1-83E1-1E08D38605D2}

[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{1A2A195A-A0F9-4006-AF02-3F05EEFDE792}

[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{2D9DB233-DC4B-4677-946C-5FA5ABCF506B}

[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{3AE76A17-C344-4A83-81CE-65EFEE41E42D}

[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{4C0A69B0-CE97-42B7-86FC-08280C99C74D}

[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{4E9EB4D5-C929-4005-AC62-1856B1DA5A24}

[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{8FAF962C-3EDE-405E-B1D0-62B8235C6044}

[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C1F5E799-B218-4C32-B189-3C389BA140BB}

[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E2C1A522-B8E1-45D1-B316-F5625004A28C}

[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{F60C9408-3110-4C98-A139-ABE1EE1111DD}

[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{F56ACA29-1C99-40F1-AC64-2E44C4F6BC71}

[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{12D3E096-0FDF-42CC-8F44-04944F9C1648}

[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{22389F39-2CF4-47C4-B8B2-273BB16BF70C}

[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{23E3CEB3-D63A-433E-A5D0-4DB1C501B915}

[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{26A3152F-CF87-4C5B-8093-4D4B9EC084EB}

[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{29E3319C-4B3C-479F-8692-BDD2CA30BEDD}

[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{367BD1CD-74A3-451F-B1A4-6A2DE4129A2D}

[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{49F018EE-F362-4B5B-8EC8-BCF9246ABF21}

[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{63B73044-FC1A-4FE1-991B-FDBD4CDAA868}

[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{7207E52B-821E-4C05-A8D6-2965B2BE77CF}

[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{863FCF5D-DC39-4DA9-AF32-CB0025990EEE}

[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{B09E015A-4D4E-4F8D-A436-95E19140947D}

[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{B1E712C4-03AA-495F-B0F5-0F057E126E2A}

[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{D13DC65C-C77B-4986-9078-DEA3D34C71BB}

[-] Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{204C0025-C26A-43E2-853C-D8A8EB1BCE51}

[-] Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{003028C2-EA1C-4676-A316-B5CB50917002}

[-] Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{61A2027D-B837-4080-A925-6E30E10DEF32}

[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3E7C8B5A-96AB-438F-BF9B-782400655440}

[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A1E28287-1A31-4B0F-8D05-AA8C465D3C5A}

[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3E7C8B5A-96AB-438F-BF9B-782400655440}

[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{1EDE0D83-B129-4ABC-923B-725D5B0C0DAC}

[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{3E7C8B5A-96AB-438F-BF9B-782400655440}

[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

[-] Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID [{1EDE0D83-B129-4ABC-923B-725D5B0C0DAC}]

[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{3E7C8B5A-96AB-438F-BF9B-782400655440}

[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EFC0651C-B6D7-49CD-A6E0-B1CE9AB5FE46}

[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{272143f8-3dbe-424c-949f-20acd11e5a6d}

[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8c0cfcbe-d7e4-4778-8bfd-3a8d8b5a9ccd}

[-] Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{EF99BD32-C1FB-11D2-892F-0090271D4F88}]

[-] Key Deleted : HKLM64\SOFTWARE\Classes\Interface\{0FCE4F01-64EC-42F1-83E1-1E08D38605D2}

[-] Key Deleted : HKLM64\SOFTWARE\Classes\Interface\{1A2A195A-A0F9-4006-AF02-3F05EEFDE792}

[-] Key Deleted : HKLM64\SOFTWARE\Classes\Interface\{2D9DB233-DC4B-4677-946C-5FA5ABCF506B}

[-] Key Deleted : HKLM64\SOFTWARE\Classes\Interface\{3AE76A17-C344-4A83-81CE-65EFEE41E42D}

[-] Key Deleted : HKLM64\SOFTWARE\Classes\Interface\{4C0A69B0-CE97-42B7-86FC-08280C99C74D}

[-] Key Deleted : HKLM64\SOFTWARE\Classes\Interface\{4E9EB4D5-C929-4005-AC62-1856B1DA5A24}

[-] Key Deleted : HKLM64\SOFTWARE\Classes\Interface\{8FAF962C-3EDE-405E-B1D0-62B8235C6044}

[-] Key Deleted : HKLM64\SOFTWARE\Classes\Interface\{C1F5E799-B218-4C32-B189-3C389BA140BB}

[-] Key Deleted : HKLM64\SOFTWARE\Classes\Interface\{E2C1A522-B8E1-45D1-B316-F5625004A28C}

[-] Key Deleted : HKLM64\SOFTWARE\Classes\Interface\{F60C9408-3110-4C98-A139-ABE1EE1111DD}

[-] Key Deleted : HKLM64\SOFTWARE\Classes\Interface\{F56ACA29-1C99-40F1-AC64-2E44C4F6BC71}

[-] Key Deleted : HKLM64\SOFTWARE\Classes\Interface\{12D3E096-0FDF-42CC-8F44-04944F9C1648}

[-] Key Deleted : HKLM64\SOFTWARE\Classes\Interface\{22389F39-2CF4-47C4-B8B2-273BB16BF70C}

[-] Key Deleted : HKLM64\SOFTWARE\Classes\Interface\{23E3CEB3-D63A-433E-A5D0-4DB1C501B915}

[-] Key Deleted : HKLM64\SOFTWARE\Classes\Interface\{26A3152F-CF87-4C5B-8093-4D4B9EC084EB}

[-] Key Deleted : HKLM64\SOFTWARE\Classes\Interface\{29E3319C-4B3C-479F-8692-BDD2CA30BEDD}

[-] Key Deleted : HKLM64\SOFTWARE\Classes\Interface\{367BD1CD-74A3-451F-B1A4-6A2DE4129A2D}

[-] Key Deleted : HKLM64\SOFTWARE\Classes\Interface\{49F018EE-F362-4B5B-8EC8-BCF9246ABF21}

[-] Key Deleted : HKLM64\SOFTWARE\Classes\Interface\{63B73044-FC1A-4FE1-991B-FDBD4CDAA868}

[-] Key Deleted : HKLM64\SOFTWARE\Classes\Interface\{7207E52B-821E-4C05-A8D6-2965B2BE77CF}

[-] Key Deleted : HKLM64\SOFTWARE\Classes\Interface\{863FCF5D-DC39-4DA9-AF32-CB0025990EEE}

[-] Key Deleted : HKLM64\SOFTWARE\Classes\Interface\{B09E015A-4D4E-4F8D-A436-95E19140947D}

[-] Key Deleted : HKLM64\SOFTWARE\Classes\Interface\{B1E712C4-03AA-495F-B0F5-0F057E126E2A}

[-] Key Deleted : HKLM64\SOFTWARE\Classes\Interface\{D13DC65C-C77B-4986-9078-DEA3D34C71BB}

[-] Key Deleted : HKLM64\SOFTWARE\Classes\Interface\{8c0cfcbe-d7e4-4778-8bfd-3a8d8b5a9ccd}

[-] Key Deleted : HKCU\Software\BabylonToolbar

[-] Key Deleted : HKCU\Software\Cr_Installer

[-] Key Deleted : HKCU\Software\Default Tab

[-] Key Deleted : HKCU\Software\IM

[-] Key Deleted : HKCU\Software\ImInstaller

[-] Key Deleted : HKCU\Software\Optimizer Pro

[-] Key Deleted : HKCU\Software\Qwiklinx

[-] Key Deleted : HKCU\Software\UpdateFiles

[-] Key Deleted : HKCU\Software\WebProtect

[-] Key Deleted : HKCU\Software\Yahoo\Companion

[-] Key Deleted : HKCU\Software\Yahoo\YFriendsBar

[-] Key Deleted : HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}

[-] Key Deleted : HKCU\Software\AppDataLow\Software\CompeteInc

[-] Key Deleted : HKCU\Software\AppDataLow\Software\Conduit

[-] Key Deleted : HKCU\Software\AppDataLow\Software\Crossrider

[-] Key Deleted : HKCU\Software\AppDataLow\Software\Freecause

[-] Key Deleted : HKCU\Software\AppDataLow\Software\Yahoo\Companion

[-] Key Deleted : HKCU\Software\AppDataLow\Software\DictionaryBossEI

[-] Key Deleted : HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}

[-] Key Deleted : HKLM\SOFTWARE\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}

[-] Key Deleted : HKLM\SOFTWARE\{6791A2F3-FC80-475C-A002-C014AF797E9C}

[-] Key Deleted : HKLM\SOFTWARE\AdvertisingSupport

[-] Key Deleted : HKLM\SOFTWARE\Babylon

[-] Key Deleted : HKLM\SOFTWARE\CompeteInc

[-] Key Deleted : HKLM\SOFTWARE\Conduit

[-] Key Deleted : HKLM\SOFTWARE\Default Tab

[-] Key Deleted : HKLM\SOFTWARE\DefaultTab

[-] Key Deleted : HKLM\SOFTWARE\Freeze.com

AdwCleaner Log #2

# AdwCleaner v5.109 - Logfile created 08/04/2016 at 00:44:53

# Updated 04/04/2016 by Xplode

# Database : 2016-04-07.1 [Server]

# Operating system : Windows 7 Home Premium Service Pack 1 (x64)

# Username : Debbie - DEBBIE-LAPTOP

# Running from : C:\Users\Debbie\Desktop\adwcleaner_5.109.exe

# Option : Clean

# Support : http://toolslib.net/forum

***** [ Services ] *****

***** [ Folders ] *****

***** [ Files ] *****

***** [ DLLs ] *****

***** [ Shortcuts ] *****

***** [ Scheduled tasks ] *****

***** [ Registry ] *****

[-] Key Deleted : HKLM\SOFTWARE\Yahoo\Companion

[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{2E497885-E60B-420A-832D-0148B392E058}_is1

[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{EE171732-BEB4-4576-887D-CB62727F01CA}

[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Yahoo! Companion

[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Yahoo! Toolbar

[-] Key Deleted : HKU\.DEFAULT\Software\DefaultTab

[-] Key Deleted : HKU\.DEFAULT\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}

[-] Key Deleted : HKU\.DEFAULT\Software\AppDataLow\Software\DefaultTab

[-] Key Deleted : HKCU\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-1899613811-3316350630-256103360-1001\Software\Qwiklinx

[-] Data Restored : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page]

[-] Data Restored : HKU\S-1-5-21-1899613811-3316350630-256103360-1001\Software\Microsoft\Internet Explorer\Main [Start Page]

[-] Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}

[-] Data Restored : HKCU\Software\Microsoft\Internet Explorer\SearchScopes [DefaultScope]

[-] Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{ac2e4ae7-2d16-45ea-991c-2441dfd05696}

[-] Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{F02F6974-32E8-4003-8AD7-6C1ED3CF3C05}

[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{ac2e4ae7-2d16-45ea-991c-2441dfd05696}

[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}

[-] Data Restored : HKU\S-1-5-21-1899613811-3316350630-256103360-1001\Software\Microsoft\Internet Explorer\SearchScopes [DefaultScope]

[-] Key Deleted : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\ask.com

[-] Key Deleted : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\thetimesherald.com

[-] Key Deleted : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\www.ask.com

[-] Key Deleted : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\www.thetimesherald.com

***** [ Web browsers ] *****

*************************

:: "Tracing" keys deleted

:: Winsock settings cleared

*************************

C:\AdwCleaner\AdwCleaner[C1].txt - [15795 bytes] - [08/04/2016 00:06:59]

C:\AdwCleaner\AdwCleaner[C2].txt - [3024 bytes] - [08/04/2016 00:44:53]

C:\AdwCleaner\AdwCleaner[S1].txt - [19889 bytes] - [08/04/2016 00:03:10]

C:\AdwCleaner\AdwCleaner[S2].txt - [4126 bytes] - [08/04/2016 00:43:29]

########## EOF - C:\AdwCleaner\AdwCleaner[C2].txt - [3244 bytes] ##########

JRT Log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Malwarebytes

Version: 8.0.4 (03.14.2016)

Operating System: Windows 7 Home Premium x64

Ran by [removed] (Administrator) on Fri 04/08/2016 at 0:55:45.21

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

File System: 41

Successfully deleted: C:\user.js (File)

Successfully deleted: C:\Users\Debbie\AppData\Local\proxy.log (File)

Successfully deleted: C:\Users\Debbie\Appdata\LocalLow\dictionaryboss (Folder)

Successfully deleted: C:\Users\Debbie\Documents\optimizer pro (Folder)

Successfully deleted: C:\Windows\wininit.ini (File)

Successfully deleted: C:\Users\Debbie\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0PS72R2M (Temporary Internet Files Folder)

Successfully deleted: C:\Users\Debbie\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\62AXOPQ5 (Temporary Internet Files Folder)

Successfully deleted: C:\Users\Debbie\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\720HK4XY (Temporary Internet Files Folder)

Successfully deleted: C:\Users\Debbie\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\77HQ8N8G (Temporary Internet Files Folder)

Successfully deleted: C:\Users\Debbie\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DP2AK4V3 (Temporary Internet Files Folder)

Successfully deleted: C:\Users\Debbie\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E3GCNSCG (Temporary Internet Files Folder)

Successfully deleted: C:\Users\Debbie\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E9RTTHRN (Temporary Internet Files Folder)

Successfully deleted: C:\Users\Debbie\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FGAAPKCF (Temporary Internet Files Folder)

Successfully deleted: C:\Users\Debbie\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FZG8CKJ5 (Temporary Internet Files Folder)

Successfully deleted: C:\Users\Debbie\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LIXMVQOA (Temporary Internet Files Folder)

Successfully deleted: C:\Users\Debbie\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LY0EHJ1T (Temporary Internet Files Folder)

Successfully deleted: C:\Users\Debbie\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OE2180MR (Temporary Internet Files Folder)

Successfully deleted: C:\Users\Debbie\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\S13NC5P6 (Temporary Internet Files Folder)

Successfully deleted: C:\Users\Debbie\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UDSDWI3P (Temporary Internet Files Folder)

Successfully deleted: C:\Users\Debbie\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XJ7SNIIQ (Temporary Internet Files Folder)

Successfully deleted: C:\Users\Debbie\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YJALCXLB (Temporary Internet Files Folder)

Successfully deleted: C:\Windows\prefetch\GOOGLETOOLBARINSTALLER_UPDATE-4BB3E595.pf (File)

Successfully deleted: C:\Windows\prefetch\GOOGLETOOLBARMANAGER_A6282D74-8B7FCB84.pf (File)

Successfully deleted: C:\Windows\prefetch\GOOGLETOOLBARNOTIFIER.EXE-969E73DB.pf (File)

Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0PS72R2M (Temporary Internet Files Folder)

Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\62AXOPQ5 (Temporary Internet Files Folder)

Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\720HK4XY (Temporary Internet Files Folder)

Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\77HQ8N8G (Temporary Internet Files Folder)

Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DP2AK4V3 (Temporary Internet Files Folder)

Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E3GCNSCG (Temporary Internet Files Folder)

Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E9RTTHRN (Temporary Internet Files Folder)

Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FGAAPKCF (Temporary Internet Files Folder)

Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FZG8CKJ5 (Temporary Internet Files Folder)

Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LIXMVQOA (Temporary Internet Files Folder)

Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LY0EHJ1T (Temporary Internet Files Folder)

Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OE2180MR (Temporary Internet Files Folder)

Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\S13NC5P6 (Temporary Internet Files Folder)

Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UDSDWI3P (Temporary Internet Files Folder)

Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XJ7SNIIQ (Temporary Internet Files Folder)

Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YJALCXLB (Temporary Internet Files Folder)

Successfully deleted: C:\Windows\SysWOW64\sho9A25.tmp (File)

Registry: 2

Successfully deleted: HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{F897EB0E-A3A4-46C3-80EB-2729699D8892} (Registry Value)

Successfully deleted: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b} (Registry Key)

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on Fri 04/08/2016 at 0:59:43.79

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Mbam Log

I just spent the last 1/2 hour looking for the Mbam log and could not find it. There were 26 threats found and was cleaned. I rebooted the laptop, but did not see the logfile after reboot. I will re-run if necessary, just let me know.

Thanks.

ShawBuck

Post #4April 8, 2016, 6:17 AM UTC

I found out how to retrieve the mbam.txt file from another post where you provided instructions….so here it is. Thanks again for your help, let me know what to do next!

Mbam.txt

Malwarebytes Anti-Malware

www.malwarebytes.org

Scan Date: 4/8/2016

Scan Time: 1:06 AM

Logfile: mbam.txt

Administrator: Yes

Version: 2.2.1.1043

Malware Database: v2016.04.08.01

Rootkit Database: v2016.04.03.01

License: Free

Malware Protection: Disabled

Malicious Website Protection: Disabled

Self-protection: Disabled

OS: Windows 7 Service Pack 1

CPU: x64

File System: NTFS

User: Debbie

Scan Type: Threat Scan

Result: Completed

Objects Scanned: 337988

Time Elapsed: 12 min, 21 sec

Memory: Enabled

Startup: Enabled

Filesystem: Enabled

Archives: Enabled

Rootkits: Disabled

Heuristics: Enabled

PUP: Enabled

PUM: Enabled

Processes: 0

(No malicious items detected)

Modules: 0

(No malicious items detected)

Registry Keys: 15

PUP.Optional.ShopToWin, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{C111C814-FD58-0A04-3924-998B53830E29}, Quarantined, [124fd6d69603fd39af80577c1ee4d12f],

PUP.Optional.ShopToWin, HKLM\SOFTWARE\CLASSES\TYPELIB\{42855803-9685-5634-8D8E-37F3536D2EE3}, Quarantined, [124fd6d69603fd39af80577c1ee4d12f],

PUP.Optional.ShopToWin, HKLM\SOFTWARE\CLASSES\INTERFACE\{D6D7630D-7FC4-E651-A400-194EF0903B56}, Quarantined, [124fd6d69603fd39af80577c1ee4d12f],

PUP.Optional.ShopToWin, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{D6D7630D-7FC4-E651-A400-194EF0903B56}, Quarantined, [124fd6d69603fd39af80577c1ee4d12f],

PUP.Optional.ShopToWin, HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{D6D7630D-7FC4-E651-A400-194EF0903B56}, Quarantined, [124fd6d69603fd39af80577c1ee4d12f],

PUP.Optional.ShopToWin, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{42855803-9685-5634-8D8E-37F3536D2EE3}, Quarantined, [124fd6d69603fd39af80577c1ee4d12f],

PUP.Optional.ShopToWin, HKLM\SOFTWARE\CLASSES\WOW6432NODE\TYPELIB\{42855803-9685-5634-8D8E-37F3536D2EE3}, Quarantined, [124fd6d69603fd39af80577c1ee4d12f],

PUP.Optional.ShopToWin, HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{C111C814-FD58-0A04-3924-998B53830E29}, Quarantined, [124fd6d69603fd39af80577c1ee4d12f],

PUP.Optional.DefaultTab, HKU\S-1-5-18\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{7F6AFBF1-E065-4627-A2FD-810366367D01}, Quarantined, [c0a16c403663ee48d5c25285659d3fc1],

Trojan.Agent.BHO, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{F90A5A0D-CD98-49CC-9AA7-9CD11C7478BF}, Quarantined, [1c45fdaf9801cc6a27e655920ef422de],

Trojan.Agent.BHO, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{F90A5A0D-CD98-49CC-9AA7-9CD11C7478BF}, Quarantined, [1c45fdaf9801cc6a27e655920ef422de],

PUP.Optional.ShopToWin, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\PREAPPROVED\{5ABD6C72-FFD7-B634-A92B-D77D5960E009}, Quarantined, [8cd5ecc0495055e11af9407ba45ed12f],

PUP.Optional.SafetySearch, HKLM\SOFTWARE\WOW6432NODE\SafetySearch, Quarantined, [4d147d2ffc9d49ed18fb40f636ce619f],

PUP.Optional.CrossRider, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{21111111-1111-1111-1111-110011461139}, Quarantined, [baa7416bb1e88caaddcbca4c5ba97d83],

Registry Values: 4

PUP.Optional.Conduit, HKU\S-1-5-21-1899613811-3316350630-256103360-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\URLSEARCHHOOKS\{f897eb0e-a3a4-46c3-80eb-2729699d8892}, Quarantined, [85dc5f4d6b2eca6cca1710d8f60c4bb5],

PUP.Optional.Conduit, HKU\S-1-5-21-1899613811-3316350630-256103360-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\URLSEARCHHOOKS|{F897EB0E-A3A4-46C3-80EB-2729699D8892}, Quarantined, [85dc5f4d6b2eca6cca1710d8f60c4bb5],

PUP.Optional.CrossRider, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{21111111-1111-1111-1111-110011461139}|AppName, SavingsApp-bg.exe, Quarantined, [baa7416bb1e88caaddcbca4c5ba97d83]

PUP.Optional.W3i, HKU\S-1-5-21-1899613811-3316350630-256103360-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{A7D1BBF7-77DC-4399-8474-F5B52E8A0714}|URL, http://search.yahoo.com/search?p={searchterms}&ei=UTF-8&fr=w3i&type=W3i_DS,136,0_0,Search,20120938,17118,0,18,0,Quarantined, [223f4f5d2a6fab8bbdb5c57fd23233cd]

Registry Data: 0

(No malicious items detected)

Folders: 1

Rogue.Multiple, C:\ProgramData\374311380, Quarantined, [bea376360396082eae8114d50ef4d62a],

Files: 12

PUP.Optional.MindSpark, C:\Program Files (x86)\v4res.dll, Quarantined, [a3becce08a0f1a1ca45edc77679e7c84],

PUP.Optional.Loadshop, C:\monitor.exe, Quarantined, [51106745d4c51d197c57ec4437cbb54b],

PUP.Optional.ConduitTB.Gen, C:\Users\Debbie\AppData\Local\Temp\tbSmi0.dll, Quarantined, [233ef3b95049f442e91a212bae5753ad],

PUP.Optional.DefaultTab, C:\Users\Debbie\AppData\Local\Temp\DefaultTabSetup.exe, Quarantined, [f76aebc1cecb78beca660941d8297090],

PUP.Optional.Babylon, C:\Users\Debbie\AppData\Local\Temp\MybabylonTB.exe, Quarantined, [1b46901c5c3df541fc271813b74959a7],

PUP.Optional.APNToolBar, C:\Users\Debbie\AppData\Local\Temp\Offercast2802_WBV5_.exe, Quarantined, [85dc3a7251488fa7eae060e8cd34c23e],

PUP.Optional.Babylon, C:\Users\Debbie\AppData\Local\Temp\Toolbar_Toggle.exe, Quarantined, [5f0295179207b87eea39a28907f958a8],

PUP.Optional.GratifyingApps, C:\Users\Debbie\AppData\Local\Temp\n3796\SafetySearch_1009-d179322a.exe, Quarantined, [e37e7f2d386171c5c72dec5e38c9fd03],

PUP.Optional.Fusion, C:\Users\Debbie\Downloads\MPlayer_Setup.exe, Quarantined, [74ede9c3910876c03851b17b40c019e7],

PUP.Optional.OptimunInstaller, C:\Users\Debbie\Downloads\fl_setup.exe, Quarantined, [20419a12f6a3eb4b674463b0718f9f61],

PUP.Optional.ChromeHitory, C:\Users\Debbie\AppData\Local\ChromeHitoryDB, Quarantined, [3f225557f3a63ff7722e917eb84c0000],

PUP.Optional.MyOSProtect, C:\Windows\Temp\MyOSProtect.log, Quarantined, [e57cd3d98019ef47ce54b776f50f11ef],

Physical Sectors: 0

(No malicious items detected)

(end)

Satchfan

Post #5April 8, 2016, 8:29 AM UTC

Those cleaned up a lot so hopefully you've already seen an improvement.

Please run Farbar Recovery Scan Tool again and send the new log.

Thanks

Satchfan

ShawBuck

Post #6April 9, 2016, 2:26 AM UTC

Thanks Satchfan, it does seem to be working much more smoothly! Attached is the new FRST Log:

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:05-03-2016 01

Ran by [removed] (administrator) on DEBBIE-LAPTOP (08-04-2016 22:22:56)

Running from C:\Users\[removed]\Desktop