What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Needing help removing malware! [Solved]

15 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16

Ill try to be as clear as i can be

 

1. Based on my knowledge on this topic i guess i dont use the US Dns, but im not really sure about it tbh.

 

2. Right now i just use this one, my other computer inst with me.

 

3. Since i basically just use Chrome i only noticed the issue on it, Internet Explorer i dont use at all and Mozilla almost the same case.

Post #17
 
Close all Programs
 
  •  
  • Right Click on RogueKiller and  select Run as Administrator'
  • After it has completed it's prescan, click on Scan
  • Click on the “Registry” tab
  • Put a checkmark in the following entries
 
 
[PUP] (X64) HKEY_CLASSES_ROOT\CLSID\{10ECCE17-29B5-4880-A8F5-EAD298611484} (C:\Program Files\Reimage\Reimage Repair\REI_Axcontrol.dll) -> Encontrado
 
[PUP] (X64) HKEY_CLASSES_ROOT\CLSID\{801B440B-1EE3-49B0-B05D-2AB076D4E8CB} (C:\Program Files\Reimage\Reimage Repair\REI_Axcontrol.dll) -> Encontrado
 
[PUP] (X64) HKEY_CLASSES_ROOT\CLSID\{BAC72C85-CEC6-4B86-AF06-FA20C259FAB8} (C:\Program Files (x86)\Amazon\Amazon1ButtonApp\Amazon1ButtonBrowserHelper64.dll) -> Encontrado
 
[PUP] (X64) HKEY_CLASSES_ROOT\CLSID\{BD6ECB00-7C4A-4F97-B425-44117F2A7AAE} (C:\Program Files (x86)\Amazon\Amazon1ButtonApp\AmazonAppIE64.dll) -> Encontrado
 
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{8f82adbe-70a3-44cb-b770-7b5996b48056} | DhcpNameServer : [removed] ([United States])  -> Encontrado
 
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{8f82adbe-70a3-44cb-b770-7b5996b48056} | DhcpNameServer : [removed] ([United States])  -> Encontrado
 
  •  
  • Then click on the Browser Tab
  • Put a checkmark in the following entries.
 
 
[PUP][FIREFX:Addon] iz0nvtgx.default : Amazon Assistant for Firefox [[removed]] -> Encontrado
 
Then click on the Delete Button and post the log it produces
Post #21
There it is:
 
RogueKiller V12.4.3.0 (x64) [Aug  8 2016] (Free) por Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Site : http://www.adlice.com/download/roguekiller/
Blog : http://www.adlice.com
 
Sistema Operativo : Windows 10 (10.0.10240) 64 bits version
Iniciou : Modo normal
Utilizador : Rafael Sobreiro [Administrador]
Começado de : C:\Program Files\RogueKiller\RogueKiller64.exe
Modo : Examinar – Data : 08/11/2016 15:26:49
 
¤¤¤ Processos : 0 ¤¤¤
 
¤¤¤ Registo : 10 ¤¤¤
[PUM.HomePage] (X64) HKEY_USERS\S-1-5-21-1796416936-1353488523-4272779061-1001\Software\Microsoft\Internet Explorer\Main | Start Page : http://acer15.msn.com/?pc=ACTE -> Encontrado
[PUM.HomePage] (X86) HKEY_USERS\S-1-5-21-1796416936-1353488523-4272779061-1001\Software\Microsoft\Internet Explorer\Main | Start Page : http://acer15.msn.com/?pc=ACTE -> Encontrado
[PUM.HomePage] (X64) HKEY_USERS\S-1-5-21-1796416936-1353488523-4272779061-1001\Software\Microsoft\Internet Explorer\Main | Default_Page_URL : http://acer15.msn.com/?pc=ACTE -> Encontrado
[PUM.HomePage] (X86) HKEY_USERS\S-1-5-21-1796416936-1353488523-4272779061-1001\Software\Microsoft\Internet Explorer\Main | Default_Page_URL : http://acer15.msn.com/?pc=ACTE -> Encontrado
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{2b7bdd77-99c4-428f-ae3d-281d34bf9c0b} | NameServer : 87.103.113.145 87.103.113.177 ([Portugal][-])  -> Encontrado
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{2b7bdd77-99c4-428f-ae3d-281d34bf9c0b} | DhcpNameServer : [removed] [removed] ([Portugal][-])  -> Encontrado
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{ae3a38cb-4f1d-46c8-9663-cf415c79f774} | NameServer : 87.103.113.145 87.103.113.177 ([Portugal][-])  -> Encontrado
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{2b7bdd77-99c4-428f-ae3d-281d34bf9c0b} | NameServer : 87.103.113.145 87.103.113.177 ([Portugal][-])  -> Encontrado
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{2b7bdd77-99c4-428f-ae3d-281d34bf9c0b} | DhcpNameServer : [removed] [removed] ([Portugal][-])  -> Encontrado
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{ae3a38cb-4f1d-46c8-9663-cf415c79f774} | NameServer : 87.103.113.145 87.103.113.177 ([Portugal][-])  -> Encontrado
 
¤¤¤ Tarefas : 0 ¤¤¤
 
¤¤¤ Arquivos : 0 ¤¤¤
 
¤¤¤ Arquivos de hosts : 0 ¤¤¤
 
¤¤¤ Antirootkit : 0 (Driver: Carregado) ¤¤¤
 
¤¤¤ Navegadores : 0 ¤¤¤
 
¤¤¤ Verificação da MBR : ¤¤¤
+++++ PhysicalDrive0: WDC WD10JPVX-22JC3T0 +++++
— User —
[MBR] b2169a057b41c22351bb3b360bb27e01
[BSP] 297b5600252179c19596fa379783d7be : Empty|VT.Unknown MBR Code
Partition table:
0 - [MAN-MOUNT] EFI system partition | Offset (sectors): 2048 | Size: 100 MB
1 - [MAN-MOUNT] Microsoft reserved partition | Offset (sectors): 206848 | Size: 16 MB
2 - Basic data partition | Offset (sectors): 239616 | Size: 953252 MB
3 - [SYSTEM][MAN-MOUNT] Basic data partition | Offset (sectors): 1952499712 | Size: 500 MB
User = LL1 … OK
User = LL2 … OK
Post #23 last edited

the problem seems to continue to be here, maybe if i re-start the computer it may helps, but i have no clue why this keeps happening after deleting the stuff

Post #24

Most times after a fix a restart helps. If not use RevoUninstaller ( the free version ) to uninstall Chome and all of its files and folders and registry entries.  Then when we are sure its all gone we can reinstall it if you like or you can just use Firefox or Edge

 

 

 

http://www.revouninstaller.com/revo_uninstaller_free_download.html

Post #26

No, not yet, you will need the 64 bit version of SystemLook

 

Please download SystemLook  and save it to your Desktop
 
32 Bit Version
64 Bit Version
 
  •  
  • Double-click SystemLook.exe to run it.
  • Copy the content of the following codebox into the main textfield:
:folderfind
Chrome
:filefind
Chrome
:regfind
Chrome
  • Click the Look button to start the scan.
  • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Note: The log can also be found on your Desktop entitled SystemLook.txt
Post #29

Agreed, ill just leave a second run i did with Malwarebytes:

 

Malwarebytes Anti-Malware
www.malwarebytes.org

Data da Verificação: 11/08/2016
Hora da Verificação: 17:40
Ficheiro de Relatório: 2nd Malwarebytes log.txt
Administrador: Sim

Versão: 2.2.1.1043
Base de Dados de Malware: v2016.08.11.09
Base de dados de Rootkits: v2016.08.09.01
Licença: Versão de Avaliação Grátis
Proteção contra Malware: Ativado
Proteção contra Websites Maliciosos: Ativado
Autoproteção: Desativado

SO: Windows 10
CPU: x64
Sistema de Ficheiros: NTFS
Utilizador: Rafael Sobreiro

Tipo de Verificação: Verificação de Ameaças
Resultado: Concluída
Objetos Verificados: 305346
Tempo Decorrido: 9 min, 9 s

Memória: Ativado
Arranque: Ativado
Sistema de Ficheiros: Ativado
Arquivos: Ativado
Rootkits: Desativado
Heurísticos: Ativado
PPI: Ativado
MPI: Ativado

Processos: 0
(Nenhum item malicioso detetado)

Módulos: 0
(Nenhum item malicioso detetado)

Chaves de Registo: 0
(Nenhum item malicioso detetado)

Valores de Registo: 0
(Nenhum item malicioso detetado)

Dados de Registo: 0
(Nenhum item malicioso detetado)

Pastas: 0
(Nenhum item malicioso detetado)

Ficheiros: 6
PUP.Optional.PricePeep, C:\Users\Rafael Sobreiro\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_static.pricepeep00.pricepeep.net_0.localstorage, , [c510ae9b2d6de452edc88e22b350c739],
PUP.Optional.PricePeep, C:\Users\Rafael Sobreiro\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_static.pricepeep00.pricepeep.net_0.localstorage-journal, , [bb1a0742efab36006550dad6ee154ab6],
PUP.Optional.ReMarkIt.PrxySvrRST, C:\Users\Rafael Sobreiro\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_static.re-markit00.re-markit.co_0.localstorage, , [973e4603702a1e18f599717def14c53b],
PUP.Optional.ReMarkIt.PrxySvrRST, C:\Users\Rafael Sobreiro\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_static.re-markit00.re-markit.co_0.localstorage-journal, , [cf063415cfcb0135bbd38a64d82b57a9],
PUP.Optional.Yontoo, C:\Users\Rafael Sobreiro\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_static.coupontime00.coupontime.co_0.localstorage, , [0ec7e96002989f97f908970dd82c6c94],
PUP.Optional.Yontoo, C:\Users\Rafael Sobreiro\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_static.coupontime00.coupontime.co_0.localstorage-journal, , [e7ee0c3ddbbfa096ca37abf9b54f2bd5],

Sectores Físicos: 0
(Nenhum item malicioso detetado)


(end)

Post #30

New log from SystemLock:

 

SystemLook 30.07.11 by jpshortstuff
Log created at 18:03 on 11/08/2016 by Rafael Sobreiro
Administrator - Elevation successful

========== folderfind ==========

Searching for "Chrome"
C:\AdwCleaner\FileQuarantine\C\Users\Rafael Sobreiro\AppData\Local\Google\Chrome    d——    [16:07 08/08/2016]
C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\[removed]\chrome    d——    [05:21 03/08/2016]
C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\[removed]\browser\chrome    d——    [05:21 03/08/2016]
C:\Program Files (x86)\Mozilla Firefox\distribution\extensions\[removed]\browser\defaults\profile\chrome    d——    [05:21 03/08/2016]
C:\ProgramData\O949\[removed]\chrome    d——    [13:08 22/12/2015]
C:\ProgramData\O949\[removed]\browser\chrome    d——    [13:08 22/12/2015]
C:\ProgramData\O949\[removed]\browser\defaults\profile\chrome    d——    [13:08 22/12/2015]
C:\ProgramData\O949\[removed]\chrome    d——    [13:08 22/12/2015]
C:\ProgramData\O949\[removed]\browser\chrome    d——    [13:08 22/12/2015]
C:\ProgramData\O949\[removed]\browser\defaults\profile\chrome    d——    [13:08 22/12/2015]
C:\ProgramData\O949\[removed]\chrome    d——    [13:08 22/12/2015]
C:\ProgramData\O949\[removed]\browser\chrome    d——    [13:08 22/12/2015]
C:\ProgramData\O949\[removed]\browser\defaults\profile\chrome    d——    [13:08 22/12/2015]
C:\ProgramData\O949\[removed]\chrome    d——    [13:08 22/12/2015]
C:\ProgramData\O949\[removed]\browser\chrome    d——    [13:08 22/12/2015]
C:\ProgramData\O949\[removed]\browser\defaults\profile\chrome    d——    [13:08 22/12/2015]
C:\ProgramData\O949\[removed]\chrome    d——    [13:08 22/12/2015]
C:\ProgramData\O949\[removed]\browser\chrome    d——    [13:08 22/12/2015]
C:\ProgramData\O949\[removed]\browser\defaults\profile\chrome    d——    [13:08 22/12/2015]
C:\ProgramData\O949\[removed]\chrome    d——    [13:08 22/12/2015]
C:\ProgramData\O949\[removed]\browser\chrome    d——    [13:08 22/12/2015]
C:\ProgramData\O949\[removed]\browser\defaults\profile\chrome    d——    [13:08 22/12/2015]
C:\ProgramData\O949\[removed]\chrome    d——    [13:08 22/12/2015]
C:\ProgramData\O949\[removed]\browser\chrome    d——    [13:08 22/12/2015]
C:\ProgramData\O949\[removed]\browser\defaults\profile\chrome    d——    [13:08 22/12/2015]
C:\ProgramData\O949\[removed]\chrome    d——    [13:08 22/12/2015]
C:\ProgramData\O949\[removed]\browser\chrome    d——    [13:08 22/12/2015]
C:\ProgramData\O949\[removed]\browser\defaults\profile\chrome    d——    [13:08 22/12/2015]
C:\ProgramData\O949\[removed]\chrome    d——    [13:08 22/12/2015]
C:\ProgramData\O949\[removed]\browser\chrome    d——    [13:08 22/12/2015]
C:\ProgramData\O949\[removed]\browser\defaults\profile\chrome    d——    [13:08 22/12/2015]
C:\ProgramData\O949\[removed]\chrome    d——    [13:08 22/12/2015]
C:\ProgramData\O949\[removed]\browser\chrome    d——    [13:08 22/12/2015]
C:\ProgramData\O949\[removed]\browser\defaults\profile\chrome    d——    [13:08 22/12/2015]
C:\ProgramData\O949\[removed]\chrome    d——    [13:08 22/12/2015]
C:\ProgramData\O949\[removed]\browser\chrome    d——    [13:08 22/12/2015]
C:\ProgramData\O949\[removed]\browser\defaults\profile\chrome    d——    [13:08 22/12/2015]
C:\ProgramData\O949\[removed]\chrome    d——    [13:08 22/12/2015]
C:\ProgramData\O949\[removed]\browser\chrome    d——    [13:08 22/12/2015]
C:\ProgramData\O949\[removed]\browser\defaults\profile\chrome    d——    [13:08 22/12/2015]
C:\ProgramData\O949\[removed]\chrome    d——    [13:08 22/12/2015]
C:\ProgramData\O949\[removed]\browser\chrome    d——    [13:08 22/12/2015]
C:\ProgramData\O949\[removed]\browser\defaults\profile\chrome    d——    [13:08 22/12/2015]
C:\ProgramData\O949\[removed]\chrome    d——    [13:08 22/12/2015]
C:\ProgramData\O949\[removed]\browser\chrome    d——    [13:08 22/12/2015]
C:\ProgramData\O949\[removed]\browser\defaults\profile\chrome    d——    [13:08 22/12/2015]
C:\ProgramData\O949\[removed]\chrome    d——    [13:08 22/12/2015]
C:\ProgramData\O949\[removed]\browser\chrome    d——    [13:08 22/12/2015]
C:\ProgramData\O949\[removed]\browser\defaults\profile\chrome    d——    [13:08 22/12/2015]
C:\ProgramData\O949\[removed]\chrome    d——    [13:08 22/12/2015]
C:\ProgramData\O949\[removed]\browser\chrome    d——    [13:08 22/12/2015]
C:\ProgramData\O949\[removed]\browser\defaults\profile\chrome    d——    [13:08 22/12/2015]
C:\ProgramData\O949\[removed]\chrome    d——    [13:08 22/12/2015]
C:\ProgramData\O949\[removed]\browser\chrome    d——    [13:08 22/12/2015]
C:\ProgramData\O949\[removed]\browser\defaults\profile\chrome    d——    [13:08 22/12/2015]
C:\ProgramData\O949\[removed]\chrome    d——    [13:08 22/12/2015]
C:\ProgramData\O949\[removed]\browser\chrome    d——    [13:08 22/12/2015]
C:\ProgramData\O949\[removed]\browser\defaults\profile\chrome    d——    [13:08 22/12/2015]
C:\ProgramData\O949\[removed]\chrome    d——    [13:08 22/12/2015]
C:\ProgramData\O949\[removed]\browser\chrome    d——    [13:08 22/12/2015]
C:\ProgramData\O949\[removed]\browser\defaults\profile\chrome    d——    [13:08 22/12/2015]
C:\ProgramData\O949\[removed]\chrome    d——    [13:08 22/12/2015]
C:\ProgramData\O949\[removed]\browser\chrome    d——    [13:08 22/12/2015]
C:\ProgramData\O949\[removed]\browser\defaults\profile\chrome    d——    [13:08 22/12/2015]
C:\ProgramData\O949\[removed]\chrome    d——    [13:08 22/12/2015]
C:\ProgramData\O949\[removed]\browser\chrome    d——    [13:08 22/12/2015]
C:\ProgramData\O949\[removed]\browser\defaults\profile\chrome    d——    [13:08 22/12/2015]
C:\ProgramData\O949\[removed]\chrome    d——    [13:08 22/12/2015]
C:\ProgramData\O949\[removed]\browser\chrome    d——    [13:08 22/12/2015]
C:\ProgramData\O949\[removed]\browser\defaults\profile\chrome    d——    [13:08 22/12/2015]
C:\ProgramData\O949\[removed]\chrome    d——    [13:08 22/12/2015]
C:\ProgramData\O949\[removed]\browser\chrome    d——    [13:08 22/12/2015]
C:\ProgramData\O949\[removed]\browser\defaults\profile\chrome    d——    [13:08 22/12/2015]
C:\ProgramData\O949\[removed]\chrome    d——    [13:08 22/12/2015]
C:\ProgramData\O949\[removed]\browser\chrome    d——    [13:08 22/12/2015]
C:\ProgramData\O949\[removed]\browser\defaults\profile\chrome    d——    [13:08 22/12/2015]
C:\ProgramData\O949\[removed]\chrome    d——    [13:08 22/12/2015]
C:\ProgramData\O949\[removed]\browser\chrome    d——    [13:08 22/12/2015]
C:\ProgramData\O949\[removed]\browser\defaults\profile\chrome    d——    [13:08 22/12/2015]
C:\ProgramData\O949\[removed]\chrome    d——    [13:08 22/12/2015]
C:\ProgramData\O949\[removed]\browser\chrome    d——    [13:08 22/12/2015]
C:\ProgramData\O949\[removed]\browser\defaults\profile\chrome    d——    [13:08 22/12/2015]
C:\ProgramData\O949\[removed]\chrome    d——    [13:08 22/12/2015]
C:\ProgramData\O949\[removed]\browser\chrome    d——    [13:09 22/12/2015]
C:\ProgramData\O949\[removed]\browser\defaults\profile\chrome    d——    [13:09 22/12/2015]
C:\ProgramData\O949\[removed]\chrome    d——    [13:09 22/12/2015]
C:\ProgramData\O949\[removed]\browser\chrome    d——    [13:09 22/12/2015]
C:\ProgramData\O949\[removed]\browser\defaults\profile\chrome    d——    [13:09 22/12/2015]
C:\ProgramData\O949\[removed]\chrome    d——    [13:09 22/12/2015]
C:\ProgramData\O949\[removed]\browser\chrome    d——    [13:09 22/12/2015]
C:\ProgramData\O949\[removed]\browser\defaults\profile\chrome    d——    [13:09 22/12/2015]
C:\ProgramData\O949\[removed]\chrome    d——    [13:09 22/12/2015]
C:\ProgramData\O949\[removed]\browser\chrome    d——    [13:09 22/12/2015]
C:\ProgramData\O949\[removed]\browser\defaults\profile\chrome    d——    [13:09 22/12/2015]
C:\ProgramData\O949\[removed]\chrome    d——    [13:09 22/12/2015]
C:\ProgramData\O949\[removed]\browser\chrome    d——    [13:09 22/12/2015]
C:\ProgramData\O949\[removed]\browser\defaults\profile\chrome    d——    [13:09 22/12/2015]
C:\Riot Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.1.211\deploy\mod\chrome    d——    [23:09 22/07/2016]
C:\Users\All Users\O949\[removed]\chrome    d——    [13:08 22/12/2015]
C:\Users\All Users\O949\[removed]\browser\chrome    d——    [13:08 22/12/2015]
C:\Users\All Users\O949\[removed]\browser\defaults\profile\chrome    d——    [13:08 22/12/2015]
C:\Users\All Users\O949\[removed]\chrome    d——    [13:08 22/12/2015]
C:\Users\All Users\O949\[removed]\browser\chrome    d——    [13:08 22/12/2015]
C:\Users\All Users\O949\[removed]\browser\defaults\profile\chrome    d——    [13:08 22/12/2015]
C:\Users\All Users\O949\[removed]\chrome    d——    [13:08 22/12/2015]
C:\Users\All Users\O949\[removed]\browser\chrome    d——    [13:08 22/12/2015]
C:\Users\All Users\O949\[removed]\browser\defaults\profile\chrome    d——    [13:08 22/12/2015]
C:\Users\All Users\O949\[removed]\chrome    d——    [13:08 22/12/2015]
C:\Users\All Users\O949\[removed]\browser\chrome    d——    [13:08 22/12/2015]
C:\Users\All Users\O949\[removed]\browser\defaults\profile\chrome    d——    [13:08 22/12/2015]
C:\Users\All Users\O949\[removed]\chrome    d——    [13:08 22/12/2015]
C:\Users\All Users\O949\[removed]\browser\chrome    d——    [13:08 22/12/2015]
C:\Users\All Users\O949\[removed]\browser\defaults\profile\chrome    d——    [13:08 22/12/2015]
C:\Users\All Users\O949\[removed]\chrome    d——    [13:08 22/12/2015]
C:\Users\All Users\O949\[removed]\browser\chrome    d——    [13:08 22/12/2015]
C:\Users\All Users\O949\[removed]\browser\defaults\profile\chrome    d——    [13:08 22/12/2015]
C:\Users\All Users\O949\[removed]\chrome    d——    [13:08 22/12/2015]
C:\Users\All Users\O949\[removed]\browser\chrome    d——    [13:08 22/12/2015]
C:\Users\All Users\O949\[removed]\browser\defaults\profile\chrome    d——    [13:08 22/12/2015]
C:\Users\All Users\O949\[removed]\chrome    d——    [13:08 22/12/2015]
C:\Users\All Users\O949\[removed]\browser\chrome    d——    [13:08 22/12/2015]
C:\Users\All Users\O949\[removed]\browser\defaults\profile\chrome    d——    [13:08 22/12/2015]
C:\Users\All Users\O949\[removed]\chrome    d——    [13:08 22/12/2015]
C:\Users\All Users\O949\[removed]\browser\chrome    d——    [13:08 22/12/2015]
C:\Users\All Users\O949\[removed]\browser\defaults\profile\chrome    d——    [13:08 22/12/2015]
C:\Users\All Users\O949\[removed]\chrome    d——    [13:08 22/12/2015]
C:\Users\All Users\O949\[removed]\browser\chrome    d——    [13:08 22/12/2015]
C:\Users\All Users\O949\[removed]\browser\defaults\profile\chrome    d——    [13:08 22/12/2015]
C:\Users\All Users\O949\[removed]\chrome    d——    [13:08 22/12/2015]
C:\Users\All Users\O949\[removed]\browser\chrome    d——    [13:08 22/12/2015]
C:\Users\All Users\O949\[removed]\browser\defaults\profile\chrome    d——    [13:08 22/12/2015]
C:\Users\All Users\O949\[removed]\chrome    d——    [13:08 22/12/2015]
C:\Users\All Users\O949\[removed]\browser\chrome    d——    [13:08 22/12/2015]
C:\Users\All Users\O949\[removed]\browser\defaults\profile\chrome    d——    [13:08 22/12/2015]
C:\Users\All Users\O949\[removed]\chrome    d——    [13:08 22/12/2015]
C:\Users\All Users\O949\[removed]\browser\chrome    d——    [13:08 22/12/2015]
C:\Users\All Users\O949\[removed]\browser\defaults\profile\chrome    d——    [13:08 22/12/2015]
C:\Users\All Users\O949\[removed]\chrome    d——    [13:08 22/12/2015]
C:\Users\All Users\O949\[removed]\browser\chrome    d——    [13:08 22/12/2015]
C:\Users\All Users\O949\[removed]\browser\defaults\profile\chrome    d——    [13:08 22/12/2015]
C:\Users\All Users\O949\[removed]\chrome    d——    [13:08 22/12/2015]
C:\Users\All Users\O949\[removed]\browser\chrome    d——    [13:08 22/12/2015]
C:\Users\All Users\O949\[removed]\browser\defaults\profile\chrome    d——    [13:08 22/12/2015]
C:\Users\All Users\O949\[removed]\chrome    d——    [13:08 22/12/2015]
C:\Users\All Users\O949\[removed]\browser\chrome    d——    [13:08 22/12/2015]
C:\Users\All Users\O949\[removed]\browser\defaults\profile\chrome    d——    [13:08 22/12/2015]
C:\Users\All Users\O949\[removed]\chrome    d——    [13:08 22/12/2015]
C:\Users\All Users\O949\[removed]\browser\chrome    d——    [13:08 22/12/2015]
C:\Users\All Users\O949\[removed]\browser\defaults\profile\chrome    d——    [13:08 22/12/2015]
C:\Users\All Users\O949\[removed]\chrome    d——    [13:08 22/12/2015]
C:\Users\All Users\O949\[removed]\browser\chrome    d——    [13:08 22/12/2015]
C:\Users\All Users\O949\[removed]\browser\defaults\profile\chrome    d——    [13:08 22/12/2015]
C:\Users\All Users\O949\[removed]\chrome    d——    [13:08 22/12/2015]
C:\Users\All Users\O949\[removed]\browser\chrome    d——    [13:08 22/12/2015]
C:\Users\All Users\O949\[removed]\browser\defaults\profile\chrome    d——    [13:08 22/12/2015]
C:\Users\All Users\O949\[removed]\chrome    d——    [13:08 22/12/2015]
C:\Users\All Users\O949\[removed]\browser\chrome    d——    [13:08 22/12/2015]
C:\Users\All Users\O949\[removed]\browser\defaults\profile\chrome    d——    [13:08 22/12/2015]
C:\Users\All Users\O949\[removed]\chrome    d——    [13:08 22/12/2015]
C:\Users\All Users\O949\[removed]\browser\chrome    d——    [13:08 22/12/2015]
C:\Users\All Users\O949\[removed]\browser\defaults\profile\chrome    d——    [13:08 22/12/2015]
C:\Users\All Users\O949\[removed]\chrome    d——    [13:08 22/12/2015]
C:\Users\All Users\O949\[removed]\browser\chrome    d——    [13:08 22/12/2015]
C:\Users\All Users\O949\[removed]\browser\defaults\profile\chrome    d——    [13:08 22/12/2015]
C:\Users\All Users\O949\[removed]\chrome    d——    [13:08 22/12/2015]
C:\Users\All Users\O949\[removed]\browser\chrome    d——    [13:08 22/12/2015]
C:\Users\All Users\O949\[removed]\browser\defaults\profile\chrome    d——    [13:08 22/12/2015]
C:\Users\All Users\O949\[removed]\chrome    d——    [13:08 22/12/2015]
C:\Users\All Users\O949\[removed]\browser\chrome    d——    [13:08 22/12/2015]
C:\Users\All Users\O949\[removed]\browser\defaults\profile\chrome    d——    [13:08 22/12/2015]
C:\Users\All Users\O949\[removed]\chrome    d——    [13:08 22/12/2015]
C:\Users\All Users\O949\[removed]\browser\chrome    d——    [13:08 22/12/2015]
C:\Users\All Users\O949\[removed]\browser\defaults\profile\chrome    d——    [13:08 22/12/2015]
C:\Users\All Users\O949\[removed]\chrome    d——    [13:08 22/12/2015]
C:\Users\All Users\O949\[removed]\browser\chrome    d——    [13:08 22/12/2015]
C:\Users\All Users\O949\[removed]\browser\defaults\profile\chrome    d——    [13:08 22/12/2015]
C:\Users\All Users\O949\[removed]\chrome    d——    [13:08 22/12/2015]
C:\Users\All Users\O949\[removed]\browser\chrome    d——    [13:09 22/12/2015]
C:\Users\All Users\O949\[removed]\browser\defaults\profile\chrome    d——    [13:09 22/12/2015]
C:\Users\All Users\O949\[removed]\chrome    d——    [13:09 22/12/2015]
C:\Users\All Users\O949\[removed]\browser\chrome    d——    [13:09 22/12/2015]
C:\Users\All Users\O949\[removed]\browser\defaults\profile\chrome    d——    [13:09 22/12/2015]
C:\Users\All Users\O949\[removed]\chrome    d——    [13:09 22/12/2015]
C:\Users\All Users\O949\[removed]\browser\chrome    d——    [13:09 22/12/2015]
C:\Users\All Users\O949\[removed]\browser\defaults\profile\chrome    d——    [13:09 22/12/2015]
C:\Users\All Users\O949\[removed]\chrome    d——    [13:09 22/12/2015]
C:\Users\All Users\O949\[removed]\browser\chrome    d——    [13:09 22/12/2015]
C:\Users\All Users\O949\[removed]\browser\defaults\profile\chrome    d——    [13:09 22/12/2015]
C:\Users\All Users\O949\[removed]\chrome    d——    [13:09 22/12/2015]
C:\Users\All Users\O949\[removed]\browser\chrome    d——    [13:09 22/12/2015]
C:\Users\All Users\O949\[removed]\browser\defaults\profile\chrome    d——    [13:09 22/12/2015]
C:\Users\Rafael Sobreiro\AppData\Local\Google\Chrome    d——    [18:14 17/07/2016]
C:\Users\Rafael Sobreiro\AppData\Roaming\Mozilla\Firefox\Profiles\iz0nvtgx.default\storage\permanent\chrome    d——    [22:22 04/08/2016]
C:\Windows\System32\config\systemprofile\AppData\Local\Google\Chrome    d——    [12:23 09/08/2016]

========== filefind ==========

Searching for "Chrome"
No files found.

========== regfind ==========

Searching for "Chrome"
[HKEY_CURRENT_USER\SOFTWARE\Google\Chrome]
[HKEY_CURRENT_USER\SOFTWARE\JavaSoft\DeploymentProperties]
"deployment.browser.path"="C:\Program Files (x86)\Google\Chrome\Application\chrome.exe"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\39f0a6c3_0]
@="{2}.\\?\hdaudio#func_01&ven_10ec&dev_0255&subsys_1025100c&rev_1000#{6994ad04-93ef-11d0-a3cc-00a0c9223196}\singlelineouttopo/00010001|\Device\HarddiskVolume3\Program Files (x86)\Google\Chrome\Application\chrome.exe%b{00000000-0000-0000-0000-000000000000}"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.com/fwlink/?LinkID=219472&clcid=0x409\OpenWithList]
"a"="chrome.exe"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.com/windows\OpenWithList]
"a"="chrome.exe"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice]
"ProgId"="ChromeHTML"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice]
"ProgId"="ChromeHTML"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithList]
"c"="chrome.exe"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.php?showtopic=130809&view=getnewpost\OpenWithList]
"a"="chrome.exe"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\OpenWithList]
"b"="chrome.exe"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt\OpenWithList]
"b"="chrome.exe"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wifi/\OpenWithList]
"a"="chrome.exe"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Roaming\OpenWith\FileExts\.htm\UserChoice]
"ProgId"="ChromeHTML"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Roaming\OpenWith\FileExts\.html\UserChoice]
"ProgId"="ChromeHTML"
[HKEY_CURRENT_USER\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration]
[HKEY_CURRENT_USER\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache]
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe.FriendlyAppName"="Google Chrome"
[HKEY_CURRENT_USER\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache]
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe.ApplicationCompany"="Google Inc."
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d8a04f01-4570-45cc-bffa-37c79cf7208c}]
@="Chrome Controls"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{d8a04f01-4570-45cc-bffa-37c79cf7208c}]
@="Chrome Controls"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DiskSnapshot\v2\0\.?program files*?google?chrome*]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RADAR\HeapLeakDetection\DiagnosedApplications\chrome.exe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\chrome.exe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Chrome]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\chrome.exe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{d8a04f01-4570-45cc-bffa-37c79cf7208c}]
@="Chrome Controls"
[HKEY_USERS\.DEFAULT\Software\Google\Chrome]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\http\OpenWithList]
"a"="chrome.exe"
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice]
"ProgId"="ChromeHTML"
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\https\UserChoice]
"ProgId"="ChromeHTML"
[HKEY_USERS\S-1-5-21-1796416936-1353488523-4272779061-1001\SOFTWARE\Google\Chrome]
[HKEY_USERS\S-1-5-21-1796416936-1353488523-4272779061-1001\SOFTWARE\JavaSoft\DeploymentProperties]
"deployment.browser.path"="C:\Program Files (x86)\Google\Chrome\Application\chrome.exe"
[HKEY_USERS\S-1-5-21-1796416936-1353488523-4272779061-1001\SOFTWARE\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\39f0a6c3_0]
@="{2}.\\?\hdaudio#func_01&ven_10ec&dev_0255&subsys_1025100c&rev_1000#{6994ad04-93ef-11d0-a3cc-00a0c9223196}\singlelineouttopo/00010001|\Device\HarddiskVolume3\Program Files (x86)\Google\Chrome\Application\chrome.exe%b{00000000-0000-0000-0000-000000000000}"
[HKEY_USERS\S-1-5-21-1796416936-1353488523-4272779061-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.com/fwlink/?LinkID=219472&clcid=0x409\OpenWithList]
"a"="chrome.exe"
[HKEY_USERS\S-1-5-21-1796416936-1353488523-4272779061-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.com/windows\OpenWithList]
"a"="chrome.exe"
[HKEY_USERS\S-1-5-21-1796416936-1353488523-4272779061-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice]
"ProgId"="ChromeHTML"
[HKEY_USERS\S-1-5-21-1796416936-1353488523-4272779061-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice]
"ProgId"="ChromeHTML"
[HKEY_USERS\S-1-5-21-1796416936-1353488523-4272779061-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithList]
"c"="chrome.exe"
[HKEY_USERS\S-1-5-21-1796416936-1353488523-4272779061-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.php?showtopic=130809&view=getnewpost\OpenWithList]
"a"="chrome.exe"
[HKEY_USERS\S-1-5-21-1796416936-1353488523-4272779061-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\OpenWithList]
"b"="chrome.exe"
[HKEY_USERS\S-1-5-21-1796416936-1353488523-4272779061-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt\OpenWithList]
"b"="chrome.exe"
[HKEY_USERS\S-1-5-21-1796416936-1353488523-4272779061-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wifi/\OpenWithList]
"a"="chrome.exe"
[HKEY_USERS\S-1-5-21-1796416936-1353488523-4272779061-1001\SOFTWARE\Microsoft\Windows\Roaming\OpenWith\FileExts\.htm\UserChoice]
"ProgId"="ChromeHTML"
[HKEY_USERS\S-1-5-21-1796416936-1353488523-4272779061-1001\SOFTWARE\Microsoft\Windows\Roaming\OpenWith\FileExts\.html\UserChoice]
"ProgId"="ChromeHTML"
[HKEY_USERS\S-1-5-21-1796416936-1353488523-4272779061-1001\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration]
[HKEY_USERS\S-1-5-21-1796416936-1353488523-4272779061-1001\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache]
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe.FriendlyAppName"="Google Chrome"
[HKEY_USERS\S-1-5-21-1796416936-1353488523-4272779061-1001\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache]
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe.ApplicationCompany"="Google Inc."
[HKEY_USERS\S-1-5-21-1796416936-1353488523-4272779061-1001_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration]
[HKEY_USERS\S-1-5-21-1796416936-1353488523-4272779061-1001_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache]
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe.FriendlyAppName"="Google Chrome"
[HKEY_USERS\S-1-5-21-1796416936-1353488523-4272779061-1001_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache]
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe.ApplicationCompany"="Google Inc."
[HKEY_USERS\S-1-5-18\Software\Google\Chrome]
[HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\http\OpenWithList]
"a"="chrome.exe"
[HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice]
"ProgId"="ChromeHTML"
[HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\https\UserChoice]
"ProgId"="ChromeHTML"

-= EOF =-

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI