Spyware / Malware / Virus Removal

PC and laptop both infected

3 min read

Looking for the outcome? Ask AI

machisan Topic Starter

Post #1December 31, 2016, 12:27 PM UTC last edited December 31, 2016, 1:00 PM UTC

Hi there. I will start with my PC first and then move onto my laptop in a new topic.

Both my computers appear to have an internet infection that only really causes me an issue when connected to the internet. I get a huge amount of pop ups and if i click on a link on any web page, i get redirected to an advert or a download for virus removal/protection.

Iam about to download the tools and post the scans.

Hopefully someone here can help me

Thankyou

Kevin

Run date: 2016-12-31 12:33:23

—————————–

12:33:23.131 OS Version: Windows x64 6.1.7601 Service Pack 1

12:33:23.131 Number of processors: 2 586 0x403

12:33:23.132 ComputerName: KEVIN-PC UserName: kevin

12:33:24.883 Initialize success

12:33:24.883 VM: initialized successfully

12:33:24.883 VM: Amd CPU BiosDisabled

12:39:17.494 AVAST engine defs: 16122701

12:39:22.166 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\00000056

12:39:22.168 Disk 0 Vendor: ST350041 JC45 Size: 476940MB BusType: 3

12:39:22.270 Disk 0 MBR read successfully

12:39:22.271 Disk 0 MBR scan

12:39:22.302 Disk 0 Windows 7 default MBR code

12:39:22.309 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 100 MB offset 2048

12:39:22.312 Disk 0 default boot code

12:39:22.345 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 476838 MB offset 206848

12:39:22.403 Disk 0 scanning C:\Windows\system32\drivers

12:39:35.938 Service scanning

12:40:04.951 Modules scanning

12:40:04.956 Disk 0 trace - called modules:

12:40:04.982 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys storport.sys hal.dll nvstor64.sys

12:40:04.986 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa80048cf060]

12:40:04.989 3 CLASSPNP.SYS[fffff8800145143f] -> nt!IofCallDriver -> [0xfffffa8003a96b00]

12:40:05.002 5 ACPI.sys[fffff88000ee67a1] -> nt!IofCallDriver -> \Device\00000056[0xfffffa8003a9b060]

12:40:06.320 AVAST engine scan C:\Windows

12:40:08.185 AVAST engine scan C:\Windows\system32

12:44:59.975 AVAST engine scan C:\Windows\system32\drivers

12:45:14.329 AVAST engine scan C:\Users\kevin

12:49:20.775 Disk 0 MBR has been saved successfully to "C:\Users\kevin\Documents\MBR.dat"

12:49:20.817 The log file has been saved successfully to "C:\Users\kevin\Documents\aswMBR.txt"

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 21-12-2016

Ran by [removed] (administrator) on KEVIN-PC (31-12-2016 12:52:28)

Running from C:\Users\[removed]\Downloads

[removed]

Platform: Windows 7 Home Premium Service Pack 1 (X64) Language: English (United States)

Internet Explorer Version 11 (Default browser: Chrome)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(Freemake) C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe

(Nero AG) C:\Program Files (x86)\HTC\HTC Sync Manager\HSMServiceEntry.exe

() C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe

(Alcatel-Lucent) C:\Program Files (x86)\Common Files\Motive\pcCMService.exe

(Alcatel-Lucent) C:\Program Files\Common Files\Motive\pcCMService.exe

(Amazon.com) C:\Program Files (x86)\Amazon\Amazon Unbox Video\ADVWindowsClientService.exe

() C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe

() C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe

(Alcatel-Lucent) C:\Program Files\BT Broadband Desktop Help\btbb\BTHelpNotifier.exe

(Greenshot) C:\Program Files\Greenshot\Greenshot.exe

(Dropbox, Inc.) C:\Users\kevin\AppData\Local\Dropbox\Update\DropboxUpdate.exe

() C:\Program Files (x86)\HTC\HTC Sync Manager\HTC Sync\adb.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

(Amazon.com) C:\Program Files (x86)\Amazon\Amazon Unbox Video\ADVWindowsClientSystemTray.exe

(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.11.376\SSScheduler.exe

(VIA) C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe

() C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe

(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe

(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe

(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MpCmdRun.exe

(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(AVAST Software) C:\Users\kevin\Downloads\aswMBR.exe

(Microsoft Corporation) C:\Windows\System32\prevhost.exe

(Microsoft Corporation) C:\Program Files\Windows Media Player\wmprph.exe

==================== Registry (Whitelisted) ====================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\…\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1340192 2016-01-29] (Microsoft Corporation)

HKLM\…\Run: [btbb_McciTrayApp] => C:\Program Files\BT Broadband Desktop Help\btbb\BTHelpNotifier.exe [2821808 2012-11-23] (Alcatel-Lucent)

HKLM\…\Run: [Greenshot] => C:\Program Files\Greenshot\Greenshot.exe [462848 2012-10-30] (Greenshot)

HKLM-x32\…\Run: [HDAudDeck] => C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe [2439072 2010-05-24] (VIA)

HKLM-x32\…\Run: [DivXUpdate] => C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1259376 2011-07-28] ()

HKLM-x32\…\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [60712 2014-10-11] (Apple Inc.)

HKLM-x32\…\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)

HKLM-x32\…\Run: [] => [X]

HKLM-x32\…\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-05-07] (Oracle Corporation)

HKLM-x32\…\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [157480 2014-10-15] (Apple Inc.)

Winlogon\Notify\GoToAssist: C:\Program Files (x86)\Citrix\GoToAssist\570\G2AWinLogon_x64.dll (Citrix Online, a division of Citrix Systems, Inc.)

HKU\S-1-5-21-3999677733-3138207020-536071805-1001\…\Run: [Dropbox Update] => C:\Users\kevin\AppData\Local\Dropbox\Update\DropboxUpdate.exe [143144 2016-12-10] (Dropbox, Inc.)

HKU\S-1-5-21-3999677733-3138207020-536071805-1001\…\Run: [GoogleChromeAutoLaunch_38E39AB3D236EEF2E02950920C757BFF] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [921192 2016-11-08] (Google Inc.)

HKU\S-1-5-21-3999677733-3138207020-536071805-1001\…\RunOnce: [Application Restart #1] => C:\Users\kevin\AppData\Local\Google\Chrome\Application\chrome.exe –flag-switches-begin –flag-switches-end –restore-last-session hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid;=SnapdoOCYB&co;=GB&u; (the data entry has 79 more characters).

HKU\S-1-5-21-3999677733-3138207020-536071805-1001\…\MountPoints2: {6bc0d4ba-7cf4-11e2-9e07-f46d04946a77} - E:\HTC_Sync_Manager_PC.exe

ShellIconOverlayIdentifiers: [ DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\kevin\AppData\Roaming\Dropbox\bin\DropboxExt64.3.0.dll [2016-12-21] (Dropbox, Inc.)

ShellIconOverlayIdentifiers: [ DropboxExt10] -> {FB314EE2-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\kevin\AppData\Roaming\Dropbox\bin\DropboxExt64.3.0.dll [2016-12-21] (Dropbox, Inc.)

ShellIconOverlayIdentifiers: [ DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\kevin\AppData\Roaming\Dropbox\bin\DropboxExt64.3.0.dll [2016-12-21] (Dropbox, Inc.)

ShellIconOverlayIdentifiers: [ DropboxExt3] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\kevin\AppData\Roaming\Dropbox\bin\DropboxExt64.3.0.dll [2016-12-21] (Dropbox, Inc.)

ShellIconOverlayIdentifiers: [ DropboxExt4] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\kevin\AppData\Roaming\Dropbox\bin\DropboxExt64.3.0.dll [2016-12-21] (Dropbox, Inc.)

ShellIconOverlayIdentifiers: [ DropboxExt5] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\kevin\AppData\Roaming\Dropbox\bin\DropboxExt64.3.0.dll [2016-12-21] (Dropbox, Inc.)

ShellIconOverlayIdentifiers: [ DropboxExt6] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\kevin\AppData\Roaming\Dropbox\bin\DropboxExt64.3.0.dll [2016-12-21] (Dropbox, Inc.)

ShellIconOverlayIdentifiers: [ DropboxExt7] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\kevin\AppData\Roaming\Dropbox\bin\DropboxExt64.3.0.dll [2016-12-21] (Dropbox, Inc.)

ShellIconOverlayIdentifiers: [ DropboxExt8] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\kevin\AppData\Roaming\Dropbox\bin\DropboxExt64.3.0.dll [2016-12-21] (Dropbox, Inc.)

ShellIconOverlayIdentifiers: [ DropboxExt9] -> {FB314EE1-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\kevin\AppData\Roaming\Dropbox\bin\DropboxExt64.3.0.dll [2016-12-21] (Dropbox, Inc.)

ShellIconOverlayIdentifiers-x32: [ DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\kevin\AppData\Roaming\Dropbox\bin\DropboxExt.3.0.dll [2016-12-21] (Dropbox, Inc.)

ShellIconOverlayIdentifiers-x32: [ DropboxExt10] -> {FB314EE2-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\kevin\AppData\Roaming\Dropbox\bin\DropboxExt.3.0.dll [2016-12-21] (Dropbox, Inc.)

ShellIconOverlayIdentifiers-x32: [ DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\kevin\AppData\Roaming\Dropbox\bin\DropboxExt.3.0.dll [2016-12-21] (Dropbox, Inc.)

ShellIconOverlayIdentifiers-x32: [ DropboxExt3] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\kevin\AppData\Roaming\Dropbox\bin\DropboxExt.3.0.dll [2016-12-21] (Dropbox, Inc.)

ShellIconOverlayIdentifiers-x32: [ DropboxExt4] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\kevin\AppData\Roaming\Dropbox\bin\DropboxExt.3.0.dll [2016-12-21] (Dropbox, Inc.)

ShellIconOverlayIdentifiers-x32: [ DropboxExt5] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\kevin\AppData\Roaming\Dropbox\bin\DropboxExt.3.0.dll [2016-12-21] (Dropbox, Inc.)

ShellIconOverlayIdentifiers-x32: [ DropboxExt6] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\kevin\AppData\Roaming\Dropbox\bin\DropboxExt.3.0.dll [2016-12-21] (Dropbox, Inc.)

ShellIconOverlayIdentifiers-x32: [ DropboxExt7] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\kevin\AppData\Roaming\Dropbox\bin\DropboxExt.3.0.dll [2016-12-21] (Dropbox, Inc.)

ShellIconOverlayIdentifiers-x32: [ DropboxExt8] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\kevin\AppData\Roaming\Dropbox\bin\DropboxExt.3.0.dll [2016-12-21] (Dropbox, Inc.)

ShellIconOverlayIdentifiers-x32: [ DropboxExt9] -> {FB314EE1-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\kevin\AppData\Roaming\Dropbox\bin\DropboxExt.3.0.dll [2016-12-21] (Dropbox, Inc.)

ShellIconOverlayIdentifiers-x32: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\kevin\AppData\Roaming\Dropbox\bin\DropboxExt.3.0.dll [2016-12-21] (Dropbox, Inc.)

ShellIconOverlayIdentifiers-x32: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\kevin\AppData\Roaming\Dropbox\bin\DropboxExt.3.0.dll [2016-12-21] (Dropbox, Inc.)

ShellIconOverlayIdentifiers-x32: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\kevin\AppData\Roaming\Dropbox\bin\DropboxExt.3.0.dll [2016-12-21] (Dropbox, Inc.)

ShellIconOverlayIdentifiers-x32: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\kevin\AppData\Roaming\Dropbox\bin\DropboxExt.3.0.dll [2016-12-21] (Dropbox, Inc.)

ShellIconOverlayIdentifiers-x32: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\kevin\AppData\Roaming\Dropbox\bin\DropboxExt.3.0.dll [2016-12-21] (Dropbox, Inc.)

ShellIconOverlayIdentifiers-x32: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\kevin\AppData\Roaming\Dropbox\bin\DropboxExt.3.0.dll [2016-12-21] (Dropbox, Inc.)

ShellIconOverlayIdentifiers-x32: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\kevin\AppData\Roaming\Dropbox\bin\DropboxExt.3.0.dll [2016-12-21] (Dropbox, Inc.)

ShellIconOverlayIdentifiers-x32: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\kevin\AppData\Roaming\Dropbox\bin\DropboxExt.3.0.dll [2016-12-21] (Dropbox, Inc.)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Amazon Unbox.lnk [2014-04-28]

ShortcutTarget: Amazon Unbox.lnk -> C:\Program Files (x86)\Amazon\Amazon Unbox Video\ADVWindowsClientSystemTray.exe (Amazon.com)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk [2016-08-12]

ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.11.376\SSScheduler.exe (McAfee, Inc.)

Startup: C:\Users\kevin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2016-08-12]

ShortcutTarget: Dropbox.lnk -> C:\Users\kevin\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Hosts: 0.0.0.1 mssplus.mcafee.com

Tcpip\Parameters: [DhcpNameServer] 192.168.1.254

Tcpip\..\Interfaces\{FA800E4B-643E-4C86-BAF0-59045F9E233A}: [DhcpNameServer] 192.168.1.254

Internet Explorer:

==================

HKU\S-1-5-21-3999677733-3138207020-536071805-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid;=SnapdoOCYB&co;=GB&userid;=a104ea72-9a10-622b-25b3-38a0828b7dfc&searchtype;=ds&q;={searchTerms}&installDate;=

HKU\S-1-5-21-3999677733-3138207020-536071805-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/en-gb/?ocid=iehp

URLSearchHook: HKLM-x32 - (No Name) - {687578b9-7132-4a7a-80e4-30ee31099e03} - No File

SearchScopes: HKLM-x32 -> DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snap.do/?publisher=SnapdoOCYB&dpid;=SnapdoOCYB&co;=GB&userid;=e7334c78-6978-4a90-9bd0-e472dab29d1a&searchtype;=ds&q;={searchTerms}&installDate;=04/03/2013

SearchScopes: HKLM-x32 -> {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snap.do/?publisher=SnapdoOCYB&dpid;=SnapdoOCYB&co;=GB&userid;=e7334c78-6978-4a90-9bd0-e472dab29d1a&searchtype;=ds&q;={searchTerms}&installDate;=04/03/2013

BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2011-06-06] (Adobe Systems Incorporated)

BHO-x32: DivX Plus Web Player HTML5 -> {326E768D-4182-46FD-9C16-1449A49795F4} -> C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll [2011-12-12] (DivX, LLC)

BHO-x32: TBSB01620 Class -> {58124A0B-DC32-4180-9BFF-E0E21AE34026} -> C:\Program Files (x86)\IMinent Toolbar\tbcore3.dll [2010-07-02] ()

BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2014-05-07] (Oracle Corporation)

BHO-x32: Ask Toolbar -> {D4027C7F-154A-4066-A1AD-4243D8127440} -> C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll [2013-03-31] (Ask)

BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2014-05-07] (Oracle Corporation)

BHO-x32: Yontoo -> {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} -> C:\Program Files (x86)\Yontoo\YontooIEClient.dll [2012-03-27] (Yontoo LLC)

Toolbar: HKLM - No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} - No File

Toolbar: HKLM-x32 - IMinent Toolbar - {977AE9CC-AF83-45E8-9E03-E2798216E2D5} - C:\Program Files (x86)\IMinent Toolbar\tbcore3.dll [2010-07-02] ()

Toolbar: HKLM-x32 - No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} - No File

Toolbar: HKLM-x32 - Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll [2013-03-31] (Ask)

Toolbar: HKU\S-1-5-21-3999677733-3138207020-536071805-1001 -> No Name - {977AE9CC-AF83-45E8-9E03-E2798216E2D5} - No File

Toolbar: HKU\S-1-5-21-3999677733-3138207020-536071805-1001 -> No Name - {687578B9-7132-4A7A-80E4-30EE31099E03} - No File

Toolbar: HKU\S-1-5-21-3999677733-3138207020-536071805-1001 -> No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} - No File

FireFox:

========

FF HKLM-x32\…\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5

FF Extension: (DivX Plus Web Player HTML5 &video;&) - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012-09-07] [not signed]

FF HKLM-x32\…\Firefox\Extensions: [[removed]] - C:\Program Files (x86)\Freemake\Freemake Video Converter\BrowserPlugin\Firefox

FF Extension: (Freemake Video Converter Plugin) - C:\Program Files (x86)\Freemake\Freemake Video Converter\BrowserPlugin\Firefox [2013-03-04] [not signed]

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll [2013-12-11] ()

FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll [2011-06-20] (DivX, LLC.)

FF Plugin: @microsoft.com/GENUINE -> disabled [No File]

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll [2013-12-11] ()

FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-02-18] ()

FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll [2011-12-13] (DivX, LLC)

FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll [2011-06-20] (DivX, LLC.)

FF Plugin-x32: @java.com/DTPlugin,version=10.60.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll [2014-05-07] (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.60.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll [2014-05-07] (Oracle Corporation)

FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)

FF Plugin-x32: @Motive.com/NpMotive,version=1.0 -> C:\Program Files (x86)\Common Files\Motive\npMotive.dll [2012-11-23] (Alcatel-Lucent)

FF Plugin-x32: @Motive.com/npMotiveRequest,version=1.0 -> C:\Program Files (x86)\Common Files\Motive\npMotiveRequest.dll [2012-11-23] (Alcatel-Lucent)

FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2013-01-18] (NVIDIA Corporation)

FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2013-01-18] (NVIDIA Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-31] (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-31] (Google Inc.)

FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll [2011-06-06] (Adobe Systems Inc.)

Chrome:

=======

CHR DefaultProfile: Default

CHR HomePage: Default -> hxxp://www.youtube.com/user/swiftmini?feature=mhee

CHR StartupUrls: Default -> "hxxp://www.google.co.uk/","hxxp://feed.snap.do/?publisher=SnapdoOCYB&dpid;=SnapdoOCYB&co;=GB&userid;=e7334c78-6978-4a90-9bd0-e472dab29d1a&searchtype;=hp&installDate;={installDate}","hxxp://feed.snap.do/?publisher=SnapdoOCYB&dpid;=SnapdoOCYB&co;=GB&userid;=e7334c78-6978-4a90-9bd0-e472dab29d1a&searchtype;=hp&installDate;=04/03/2013","hxxp://www.google.com/"

CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\54.0.2840.99\PepperFlash\pepflashplayer.dll => No File

CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\54.0.2840.99\ppGoogleNaClPluginChrome.dll => No File

CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\54.0.2840.99\pdf.dll => No File

CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)

CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll => No File

CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll => No File

CHR Plugin: (BT DesktopHelp plug-in) - C:\Program Files (x86)\Common Files\Motive\npMotive.dll (Alcatel-Lucent)

CHR Plugin: (BT Management plug-in) - C:\Program Files (x86)\Common Files\Motive\npMotiveRequest.dll (Alcatel-Lucent)

CHR Plugin: (DivX VOD Helper Plug-in) - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)

CHR Plugin: (DivX Plus Web Player) - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)

CHR Plugin: (Java(TM) Platform SE 7 U21) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

CHR Plugin: (McAfee Security Scanner +) - C:\Program Files (x86)\McAfee Security Scan\3.0.318\npMcAfeeMss.dll => No File

CHR Plugin: (NVIDIA 3D Vision) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)

CHR Plugin: (NVIDIA 3D VISION) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)

CHR Plugin: (Google Update) - C:\Users\kevin\AppData\Local\Google\Update\1.3.21.135\npGoogleUpdate3.dll => No File

CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_6_602_180.dll => No File

CHR Plugin: (Java Deployment Toolkit 7.0.210.11) - C:\Windows\SysWOW64\npDeployJava1.dll => No File

CHR Profile: C:\Users\kevin\AppData\Local\Google\Chrome\User Data\Default [2016-12-31]

CHR Extension: (Write Space) - C:\Users\kevin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aimodnlfiikjjnmdchihablmkdeobhad [2014-01-26]

CHR Extension: (Screenr) - C:\Users\kevin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ajmdmhlhifnkjklgeikfdmffiigfoged [2013-07-14]

CHR Extension: (Screenshot Webpages) - C:\Users\kevin\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdfnieppndfdhcgbmhfdlgdjegclkomk [2016-07-29]

CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\kevin\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2015-06-28]

CHR Extension: (Gliffy Diagrams) - C:\Users\kevin\AppData\Local\Google\Chrome\User Data\Default\Extensions\bhmicilclplefnflapjmnngmkkkkpfad [2016-12-10]

CHR Extension: (YouTube) - C:\Users\kevin\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-09-26]

CHR Extension: (Solitaire) - C:\Users\kevin\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpebaehgfgkcmmjjknibibbjacnplim [2016-12-31]

CHR Extension: (panda dumpling) - C:\Users\kevin\AppData\Local\Google\Chrome\User Data\Default\Extensions\caaclfkfmcnlppkambfehbfhlekhpenf [2015-08-22]

CHR Extension: (Adblock Plus) - C:\Users\kevin\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2016-12-10]

CHR Extension: (Look of Disapproval) - C:\Users\kevin\AppData\Local\Google\Chrome\User Data\Default\Extensions\cmomlddchhdnchpieaalgkpgaafohlbn [2014-06-10]

CHR Extension: (Google Search) - C:\Users\kevin\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-11-06]

CHR Extension: (Word Search) - C:\Users\kevin\AppData\Local\Google\Chrome\User Data\Default\Extensions\dnjkggjhcbohgnikmegjkodmakmimlkj [2015-08-10]

CHR Extension: (Mahjong Solitaire) - C:\Users\kevin\AppData\Local\Google\Chrome\User Data\Default\Extensions\eogmadihniohlnmipdhchaoagjhfnohc [2016-07-29]

CHR Extension: (Scrabble Crosswords) - C:\Users\kevin\AppData\Local\Google\Chrome\User Data\Default\Extensions\eolpgfckobmnjjjfbkjgnpfgggcgjeji [2015-08-13]

CHR Extension: (Facebook for Chrome) - C:\Users\kevin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gdalhedleemkkdjddjgfjmcnbpejpapp [2015-08-27]

CHR Extension: (UNO 3D HD) - C:\Users\kevin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gdkfcgceminipbgjnnimdkejmlaecebj [2015-08-11]

CHR Extension: (Vimeo™ Download Videos) - C:\Users\kevin\AppData\Local\Google\Chrome\User Data\Default\Extensions\geeljcibkkackafmeepgadbfgmpjmdeg [2014-01-26]

CHR Extension: (Resume (CV) Maker) - C:\Users\kevin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gpbnepipgmcpkdglgbcfmcecaoflaemc [2015-06-27]

CHR Extension: (Inkscape on rollApp) - C:\Users\kevin\AppData\Local\Google\Chrome\User Data\Default\Extensions\icjinnaagdniegmfejingjjhljhmkopj [2015-08-28]

CHR Extension: (Yahtzee) - C:\Users\kevin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihojcamicnohnlcgilfkliehaefbgmpf [2015-08-13]

CHR Extension: (Zip, UnZip App) - C:\Users\kevin\AppData\Local\Google\Chrome\User Data\Default\Extensions\iiaianhgacnhnnhejddkghikgnhgpeaa [2015-06-27]

CHR Extension: (Freemake Video Converter) - C:\Users\kevin\AppData\Local\Google\Chrome\User Data\Default\Extensions\jbolfgndggfhhpbnkgnpjkfhinclbigj [2013-05-12]

CHR Extension: (F1 News) - C:\Users\kevin\AppData\Local\Google\Chrome\User Data\Default\Extensions\jchepaljijgokkoflakjioknkfolenbk [2016-12-10]

CHR Extension: (Lexifind Scrabble Helper FREE Version) - C:\Users\kevin\AppData\Local\Google\Chrome\User Data\Default\Extensions\kcnjcdapiblbampkmbiahekeaefdepfj [2015-08-13]

CHR Extension: (Start - A Better New Tab) - C:\Users\kevin\AppData\Local\Google\Chrome\User Data\Default\Extensions\kgifkabikplflflabkllnpidlbjjpgbp [2015-06-28]

CHR Extension: (eBay for Chrome) - C:\Users\kevin\AppData\Local\Google\Chrome\User Data\Default\Extensions\khhckppjhonfmcpegdjdibmngahahhck [2016-12-31]

CHR Extension: (Canva) - C:\Users\kevin\AppData\Local\Google\Chrome\User Data\Default\Extensions\mbcfmcoibkecmionmehabndbljdleekf [2015-06-27]

CHR Extension: (Quick Note) - C:\Users\kevin\AppData\Local\Google\Chrome\User Data\Default\Extensions\mijlebbfndhelmdpmllgcfadlkankhok [2014-11-12]

CHR Extension: (Cookie Connect) - C:\Users\kevin\AppData\Local\Google\Chrome\User Data\Default\Extensions\mpoilodbijciooacaoceknhbmnhnaaeg [2015-09-14]

CHR Extension: (MONOPOLY: The World Edition) - C:\Users\kevin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nkedhiolniniodbokjinplhaleemnfbe [2014-10-01]

CHR Extension: (Chrome Web Store Payments) - C:\Users\kevin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-07-29]

CHR Extension: (DivX Plus Web Player HTML5 ) - C:\Users\kevin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm [2013-05-12]

CHR Extension: (Instagram for Chrome) - C:\Users\kevin\AppData\Local\Google\Chrome\User Data\Default\Extensions\opnbmdkdflhjiclaoiiifmheknpccalb [2016-12-10]

CHR Extension: (20-20 3D Viewer for IKEA) - C:\Users\kevin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pfhldcakmgpmglboaclpfdedehjblalp [2014-11-03]

CHR Extension: (Gmail) - C:\Users\kevin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-06-28]

CHR Extension: (Chrome Media Router) - C:\Users\kevin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2016-12-31]

CHR Extension: (Type Fu) - C:\Users\kevin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pofoighmmpljaikjiidkkfhldjndfdbk [2016-12-31]

CHR HKLM-x32\…\Chrome\Extension: [edmgmpmklgfbohogafcfobonnkogchec] - C:\Program Files (x86)\Common Files\Motive\extensions\MotiveRequest.crx [2012-12-13]

CHR HKLM-x32\…\Chrome\Extension: [jbolfgndggfhhpbnkgnpjkfhinclbigj] - C:\Program Files (x86)\Freemake\Freemake Video Converter\BrowserPlugin\Chrome\Freemake.Plugin.Chrome.crx [2013-03-04]

CHR HKLM-x32\…\Chrome\Extension: [niapdbllcanepiiimjjndipklodoedlc] - C:\Users\kevin\AppData\Local\Temp\YontooLayers.crx

CHR HKLM-x32\…\Chrome\Extension: [nneajnkjbffgblleaoojgaacokifdkhm] - C:\Program Files (x86)\DivX\DivX Plus Web Player\chrome\DivXHTML5\DivXHTML5.crx [2011-12-12]

CHR HKLM-x32\…\Chrome\Extension: [pmlghpafmmnmmkjdhacccolfgnkiboco] - C:\Program Files (x86)\1ClickDownload\oneclickdownloader10.crx

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 ADVService; C:\Program Files (x86)\Amazon\Amazon Unbox Video\ADVWindowsClientService.exe [25704 2011-11-23] (Amazon.com) [File not signed]

S2 BT Help Wizard; C:\Program Files (x86)\BT Broadband Desktop Help\btbb\MA\8.3.1.7.bt.1.3\ma\bin\MAHostService.exe [321024 2013-10-02] (Alcatel-Lucent) [File not signed]

R2 ForceWare Intelligent Application Manager (IAM); C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe [496232 2010-01-21] ()

R2 Freemake Improver; C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe [101888 2013-03-01] (Freemake) [File not signed]

R2 HTCMonitorService; C:\Program Files (x86)\HTC\HTC Sync Manager\HSMServiceEntry.exe [87368 2012-07-16] (Nero AG)

S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.11.376\McCHSvc.exe [327944 2016-07-19] (McAfee, Inc.)

R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2016-01-29] (Microsoft Corporation)

R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [374344 2016-01-29] (Microsoft Corporation)

R2 nSvcIp; C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe [209000 2010-01-21] ()

R2 PassThru Service; C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe [166912 2012-10-08] () [File not signed]

R2 pcCMService; C:\Program Files (x86)\Common Files\Motive\pcCMService.exe [369152 2012-10-31] (Alcatel-Lucent) [File not signed]

R2 pcCMService64; C:\Program Files\Common Files\Motive\pcCMService.exe [460288 2012-10-31] (Alcatel-Lucent) [File not signed]

S3 SolidWorks Licensing Service; C:\Program Files (x86)\Common Files\SolidWorks Shared\Service\SolidWorksLicensing.exe [79360 2012-09-25] (SolidWorks) [File not signed]

S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 CH341SER_A64; C:\Windows\System32\Drivers\CH341S64.SYS [58368 2009-06-02] (www.winchiphead.com)

R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [289120 2015-11-13] (Microsoft Corporation)

S3 MREMP50; C:\Program Files (x86)\Common Files\Motive\MREMP50.sys [21248 2013-03-24] (Printing Communications Assoc., Inc. (PCAUSA)) [File not signed]

S3 MREMP50a64; C:\Program Files\Common Files\Motive\MREMP50a64.SYS [43008 2013-03-24] (Printing Communications Assoc., Inc. (PCAUSA))

S3 MRESP50; C:\Program Files (x86)\Common Files\Motive\MRESP50.sys [20096 2013-03-24] (Printing Communications Assoc., Inc. (PCAUSA)) [File not signed]

S3 MRESP50a64; C:\Program Files\Common Files\Motive\MRESP50a64.SYS [40960 2013-03-24] (Printing Communications Assoc., Inc. (PCAUSA))

R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-07-16] ()

R3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [133816 2015-11-13] (Microsoft Corporation)

S3 MREMPR5; \??\C:\PROGRA~1\COMMON~1\Motive\MREMPR5.SYS [X]

S3 MRENDIS5; \??\C:\PROGRA~1\COMMON~1\Motive\MRENDIS5.SYS [X]

U3 aswMBR; \??\C:\Users\kevin\AppData\Local\Temp\aswMBR.sys [X]

U3 aswVmm; \??\C:\Users\kevin\AppData\Local\Temp\aswVmm.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-12-31 12:52 - 2016-12-31 12:55 - 00032204 _____ C:\Users\kevin\Downloads\FRST.txt

2016-12-31 12:51 - 2016-12-31 12:52 - 00000000 ____D C:\FRST

2016-12-31 12:49 - 2016-12-31 12:49 - 00001932 _____ C:\Users\kevin\Documents\aswMBR.txt

2016-12-31 12:49 - 2016-12-31 12:49 - 00000512 _____ C:\Users\kevin\Documents\MBR.dat

2016-12-31 12:28 - 2016-12-31 12:28 - 02420736 _____ (Farbar) C:\Users\kevin\Downloads\FRST64.exe

2016-12-31 12:27 - 2016-12-31 12:27 - 05198336 _____ (AVAST Software) C:\Users\kevin\Downloads\aswMBR.exe

2016-12-31 12:21 - 2016-12-31 12:21 - 00000000 ____D C:\Users\kevin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox

2016-12-31 10:35 - 2016-12-31 10:46 - 00288968 _____ C:\Users\kevin\Desktop\Dot Rotten - Petrol Bomb Instrumental.mp3.sfk

2016-12-27 22:07 - 2016-12-27 22:19 - 00323488 _____ C:\Users\kevin\Desktop\Rebound X - Rhythm 'N' Gash (Instrumental).mp3.sfk

2016-12-18 19:18 - 2016-12-18 19:18 - 00327848 _____ C:\Users\kevin\Desktop\Danny Weed - Creeper (Instrumental).mp3.sfk

2016-12-12 18:32 - 2016-12-12 19:01 - 00000000 ____D C:\Users\kevin\Desktop\pembrey 2016

2016-12-10 14:53 - 2016-12-31 09:27 - 00000000 ____D C:\Users\kevin\Desktop\BMX footage

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-12-31 12:40 - 2015-06-27 20:25 - 00000918 _____ C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-3999677733-3138207020-536071805-1001UA.job

2016-12-31 12:29 - 2015-08-22 23:08 - 00002195 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk

2016-12-31 12:29 - 2015-08-22 23:08 - 00002183 _____ C:\Users\Public\Desktop\Google Chrome.lnk

2016-12-31 12:21 - 2015-08-22 23:06 - 00003330 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA

2016-12-31 12:21 - 2015-08-22 23:06 - 00003202 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore

2016-12-31 12:21 - 2013-10-09 19:24 - 00000000 ____D C:\Users\kevin\AppData\Roaming\Dropbox

2016-12-31 12:17 - 2009-07-14 04:45 - 00021888 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2016-12-31 12:17 - 2009-07-14 04:45 - 00021888 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2016-12-31 12:07 - 2013-10-09 19:30 - 00000000 ___RD C:\Users\kevin\Dropbox

2016-12-31 12:06 - 2013-02-22 16:19 - 00000000 ____D C:\Users\kevin\AppData\Local\HTC MediaHub

2016-12-31 12:03 - 2011-06-24 14:13 - 00000000 ____D C:\ProgramData\NVIDIA

2016-12-31 12:03 - 2009-07-14 05:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2016-12-30 17:40 - 2015-06-27 20:25 - 00000866 _____ C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-3999677733-3138207020-536071805-1001Core.job

2016-12-28 15:08 - 2009-07-14 05:13 - 00778834 _____ C:\Windows\system32\PerfStringBackup.INI

2016-12-28 15:08 - 2009-07-14 03:20 - 00000000 ____D C:\Windows\inf

2016-12-27 20:51 - 2016-07-24 18:46 - 00000000 ____D C:\Users\kevin\Desktop\modified mania 2016

2016-12-18 15:36 - 2012-09-25 18:08 - 00000000 ____D C:\Users\kevin\AppData\Roaming\SolidWorks

2016-12-10 19:38 - 2011-06-27 18:38 - 04937141 ____H C:\Users\kevin\AppData\Local\IconCache.db.backup

2016-12-10 18:31 - 2009-07-14 03:20 - 00000000 ____D C:\Windows\rescache

2016-12-10 17:35 - 2015-06-27 20:25 - 00003892 _____ C:\Windows\System32\Tasks\DropboxUpdateTaskUserS-1-5-21-3999677733-3138207020-536071805-1001UA

2016-12-10 17:35 - 2015-06-27 20:25 - 00003496 _____ C:\Windows\System32\Tasks\DropboxUpdateTaskUserS-1-5-21-3999677733-3138207020-536071805-1001Core

2016-12-10 16:41 - 2011-06-29 19:40 - 00000000 ____D C:\Users\kevin\AppData\Roaming\Sony

==================== Files in the root of some directories =======

2013-11-23 17:56 - 2013-11-23 17:56 - 0000075 _____ () C:\Users\kevin\AppData\Roaming\Camdata.ini

2013-11-23 17:56 - 2013-11-23 17:56 - 0000408 _____ () C:\Users\kevin\AppData\Roaming\CamLayout.ini

2013-11-23 17:56 - 2013-11-23 17:56 - 0000408 _____ () C:\Users\kevin\AppData\Roaming\CamShapes.ini

2013-11-23 17:56 - 2013-11-23 17:56 - 0004535 _____ () C:\Users\kevin\AppData\Roaming\CamStudio.cfg

2011-06-29 19:58 - 2011-06-29 19:58 - 0000032 _____ () C:\Users\kevin\AppData\Roaming\data.dat

2009-07-13 20:46 - 2009-06-10 21:22 - 0077112 _____ (Microsoft Corporation) C:\Users\kevin\AppData\Roaming\system32.exe

2013-11-23 17:51 - 2013-11-23 17:51 - 0000096 _____ () C:\Users\kevin\AppData\Roaming\version2.xml

2015-09-22 17:44 - 2015-09-22 17:44 - 0031855 _____ () C:\Users\kevin\AppData\Local\recently-used.xbel

2013-01-19 21:03 - 2013-02-21 21:54 - 0000000 _____ () C:\Users\kevin\AppData\Local\Temptable.xml

Files to move or delete:

====================

C:\Users\kevin\tsMS.reg

C:\Users\kevin\AppData\Roaming\data.dat

Some files in TEMP:

====================

C:\Users\kevin\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpljshdt.dll

C:\Users\kevin\AppData\Local\Temp\uttFC4F.tmp.exe

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed

C:\Windows\system32\wininit.exe => File is digitally signed

C:\Windows\SysWOW64\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\system32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\system32\services.exe => File is digitally signed

C:\Windows\system32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\system32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\system32\rpcss.dll => File is digitally signed

C:\Windows\system32\dnsapi.dll => File is digitally signed

C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed

C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2016-12-10 18:24

==================== End of FRST.txt ============================

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 21-12-2016

Ran by [removed] (31-12-2016 12:55:59)

Running from C:\Users\[removed]\Downloads

Windows 7 Home Premium Service Pack 1 (X64) (2011-06-27 16:59:29)

Boot Mode: Normal

==========================================================

==================== Accounts: =============================

Administrator (S-1-5-21-3999677733-3138207020-536071805-500 - Administrator - Disabled)

Guest (S-1-5-21-3999677733-3138207020-536071805-501 - Limited - Disabled)

HomeGroupUser$ (S-1-5-21-3999677733-3138207020-536071805-1003 - Limited - Enabled)

kevin (S-1-5-21-3999677733-3138207020-536071805-1001 - Administrator - Enabled) => C:\Users\kevin

UpdatusUser (S-1-5-21-3999677733-3138207020-536071805-1000 - Limited - Enabled) => C:\Users\UpdatusUser

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Microsoft Security Essentials (Enabled - Up to date) {768124D7-F5F7-6D2F-DDC2-94DFA4017C95}

AS: Microsoft Security Essentials (Enabled - Up to date) {CDE0C533-D3CD-62A1-E772-AFADDF863628}

AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe AIR (HKLM-x32\…\Adobe AIR) (Version: 2.7.0.19530 - Adobe Systems Incorporated)

Adobe Flash Player 11 ActiveX (HKLM-x32\…\Adobe Flash Player ActiveX) (Version: 11.9.900.170 - Adobe Systems Incorporated)

Adobe Flash Player 11 Plugin (HKLM-x32\…\Adobe Flash Player Plugin) (Version: 11.9.900.170 - Adobe Systems Incorporated)

Adobe Reader X (10.1.0) (HKLM-x32\…\{AC76BA86-7AD7-1033-7B44-AA1000000001}) (Version: 10.1.0 - Adobe Systems Incorporated)

Amazon Unbox Video (HKLM-x32\…\InstallShield_{54A4839E-87F8-4BD1-9682-A349E9943F0A}) (Version: 2.2.0.153 - Amazon.com)

Amazon Unbox Video (x32 Version: 2.2.0.153 - Amazon.com) Hidden

Apple Application Support (HKLM-x32\…\{83CAF0DE-8D3B-4C37-A631-2B8F16EC3031}) (Version: 3.1 - Apple Inc.)

Apple Mobile Device Support (HKLM\…\{BDD99690-3541-4619-9D2A-3CDDB3E15F9E}) (Version: 8.0.5.6 - Apple Inc.)

Apple Software Update (HKLM-x32\…\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)

Ask Toolbar (HKLM-x32\…\{86D4B82A-ABED-442A-BE86-96357B70F4FE}) (Version: 1.15.23.0 - Ask.com) <==== ATTENTION

Bonjour (HKLM\…\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)

BT Desktop Help (HKLM-x32\…\BT Desktop Help) (Version: - )

BTHomeHub (HKLM-x32\…\BTHomeHub) (Version: - British Telecommunications Plc.)

CamStudio 2.7.2 (HKLM\…\{04B83666-3A62-452B-85D3-70F8117F2329}_is1) (Version: 2.7.2 - CamStudio Open Source)

CCleaner (HKLM\…\CCleaner) (Version: 4.10 - Piriform)

DivX Setup (HKLM-x32\…\DivX Setup) (Version: 2.6.1.9 - DivX, LLC)

Dropbox (HKU\S-1-5-21-3999677733-3138207020-536071805-1001\…\Dropbox) (Version: 16.4.30 - Dropbox, Inc.)

DWGeditor (x32 Version: 18.00.5035 - SolidWorks) Hidden

EaseUS Data Recovery Wizard 9.0 (HKLM\…\EaseUS Data Recovery Wizard 9.0_is1) (Version: - EaseUS)

Freemake Video Converter version 3.2.1 (HKLM-x32\…\Freemake Video Converter_is1) (Version: 3.2.1 - Ellora Assets Corporation)

Google Chrome (HKLM-x32\…\Google Chrome) (Version: 55.0.2883.87 - Google Inc.)

Google SketchUp Pro 8 (HKLM-x32\…\{964D07BE-460C-4862-B59C-49575B8F46DC}) (Version: 3.0.11752 - Google, Inc.)

Google Update Helper (x32 Version: 1.3.32.7 - Google Inc.) Hidden

GoToAssist Corporate (HKLM-x32\…\GoToAssist) (Version: 9.0.0.570 - Citrix Online, a division of Citrix Systems, Inc.)

GoToAssist Corporate (x32 Version: 9.0.570 - Citrix) Hidden

Greenshot 1.0.6.2228 (HKLM\…\Greenshot_is1) (Version: 1.0.6.2228 - Greenshot)

HTC Sync Manager (HKLM-x32\…\{7477F26F-CC6A-4F68-8C9D-496DBFF45E05}) (Version: 1.1.27.0 - HTC)

IMinent Toolbar (HKLM-x32\…\{A76AA284-E52D-47E6-9E4F-B85DBF8E35C3}) (Version: 3.26.0 - IMinent) <==== ATTENTION

Inkscape 0.91 (HKLM\…\{81922150-317E-4BB0-A31D-FF1C14F707C5}) (Version: 0.91 - inkscape.org)

IPTInstaller (HKLM-x32\…\{6965F2F4-1CD2-4F42-A8EF-9EF433F9AA72}) (Version: 4.0.4 - HTC)

iTunes (HKLM\…\{2ABBBD91-91E5-4AD7-929A-FE15D1DC0576}) (Version: 12.0.1.26 - Apple Inc.)

Java 7 Update 60 (HKLM-x32\…\{26A24AE4-039D-4CA4-87B4-2F83217025FF}) (Version: 7.0.600 - Oracle)

Kodi (HKU\S-1-5-21-3999677733-3138207020-536071805-1001\…\Kodi) (Version: - XBMC-Foundation)

McAfee Security Scan Plus (HKLM\…\McAfee Security Scan) (Version: 3.11.376.2 - McAfee, Inc.)

Microsoft .NET Framework 4 Client Profile (HKLM\…\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)

Microsoft .NET Framework 4 Extended (HKLM\…\Microsoft .NET Framework 4 Extended) (Version: 4.0.30319 - Microsoft Corporation)

Microsoft Expression Encoder 4 (HKLM-x32\…\Encoder_4.0.3205.0) (Version: 4.0.3205.0 - Microsoft Corporation)

Microsoft Expression Encoder 4 Screen Capture Codec (HKLM-x32\…\{F9EC30D1-F688-4708-9850-CB5120074AAA}) (Version: 4.0.3205.0 - Microsoft Corporation)

Microsoft Office 2003 Web Components (HKLM-x32\…\{90120000-00A4-0409-0000-0000000FF1CE}) (Version: 12.0.6213.1000 - Microsoft Corporation)

Microsoft Office Project 2007 Service Pack 3 (SP3) (HKLM-x32\…\{90120000-003B-0000-0000-0000000FF1CE}_PRJPRO_{8446EB22-A746-46DC-B1BD-E0DFA1F3CDDA}) (Version: - Microsoft)

Microsoft Office Project Professional 2007 (HKLM-x32\…\PRJPRO) (Version: 12.0.6612.1000 - Microsoft Corporation)

Microsoft Security Essentials (HKLM\…\Microsoft Security Client) (Version: 4.9.218.0 - Microsoft Corporation)

Microsoft Silverlight (HKLM\…\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40728.0 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\…\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\…\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\…\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\…\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\…\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\…\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\…\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\…\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319 (HKLM-x32\…\{196BB40D-1578-3D01-B289-BEFC77A11A1E}) (Version: 10.0.30319 - Microsoft Corporation)

Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\…\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)

Microsoft Visual Studio 2005 Remote Debugger Light (x64) - ENU (HKLM\…\Microsoft Visual Studio 2005 Remote Debugger Light (x64) - ENU) (Version: - Microsoft Corporation)

Microsoft Visual Studio 2005 Tools for Applications - ENU (HKLM-x32\…\Microsoft Visual Studio 2005 Tools for Applications - ENU) (Version: - Microsoft Corporation)

MSXML 4.0 SP2 (KB954430) (HKLM-x32\…\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)

MSXML 4.0 SP2 (KB973688) (HKLM-x32\…\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)

NVIDIA 3D Vision Controller Driver 285.62 (HKLM\…\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 285.62 - NVIDIA Corporation)

NVIDIA 3D Vision Driver 311.06 (HKLM\…\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 311.06 - NVIDIA Corporation)

NVIDIA Drivers (HKLM\…\NVIDIA Drivers) (Version: 1.10.57.35 - NVIDIA Corporation)

NVIDIA ForceWare Network Access Manager (HKLM-x32\…\{7CFA46E3-CC2F-4355-82AE-6012DC3633FD}) (Version: 1.00.7325.0 - NVIDIA Corporation)

NVIDIA Graphics Driver 311.06 (HKLM\…\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 311.06 - NVIDIA Corporation)

NVIDIA HD Audio Driver 1.2.23.3 (HKLM\…\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.2.23.3 - NVIDIA Corporation)

NVIDIA PhysX System Software 9.10.0514 (HKLM\…\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.10.0514 - NVIDIA Corporation)

NVIDIA Update 1.11.3 (HKLM\…\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 1.11.3 - NVIDIA Corporation)

PhotoView 360 (x32 Version: 18.00.5035 - SolidWorks Corporation) Hidden

Platform (x32 Version: 1.34 - VIA Technologies, Inc.) Hidden

QuickTime (HKLM-x32\…\{B67BAFBA-4C9F-48FA-9496-933E3B255044}) (Version: 7.74.80.86 - Apple Inc.)

SignCut (HKLM-x32\…\SignCut) (Version: 1.96 - Whisqu Graphic AB)

SolidWorks 2010 x64 Edition SP0 (HKLM-x32\…\SolidWorks Installation Manager 20100-40000-1100-100) (Version: 18.0.0.5035 - SolidWorks Corporation)

SolidWorks 2010 x64 Edition SP0 (Version: 18.100.5035 - SolidWorks) Hidden

SolidWorks 2011 API SDK (HKLM-x32\…\{4AD8D884-5065-47DA-9730-C0C59B9E3CA6}) (Version: 19.20.49 - SolidWorks Corporation)

SolidWorks eDrawings 2010 (x32 Version: 10.0.727 - Dassault Systèmes SolidWorks Corp.) Hidden

SolidWorks Explorer 2010 SP0 x64 Edition (Version: 18.00.5035 - SolidWorks Corporation) Hidden

SusProg3D (HKLM-x32\…\SusProg3D_is1) (Version: 4.515 - SusProg)

TunerStudio MS 2.6.01 (HKLM-x32\…\{16994070-EF3D-486D-9C26-5D5A76481726}_is1) (Version: - EFI Analytics)

Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\…\{90120000-003B-0000-0000-0000000FF1CE}_PRJPRO_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)

VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0 - DivX, Inc) Hidden

Vegas Pro 10.0 (64-bit) (HKLM\…\{C616FD4F-11F5-11E0-A38F-0013D3D69929}) (Version: 10.0.470 - Sony)

VIA Platform Device Manager (HKLM-x32\…\InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}) (Version: 1.34 - VIA Technologies, Inc.)

VLC media player 1.0.0 (HKLM-x32\…\VLC media player) (Version: 1.0.0 - VideoLAN Team)

Yontoo 1.10.02 (HKLM\…\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}) (Version: 1.10.02 - Yontoo LLC) <==== ATTENTION

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-3999677733-3138207020-536071805-1001_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\kevin\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-3999677733-3138207020-536071805-1001_Classes\CLSID\{0F22A205-CFB0-4679-8499-A6F44A80A208}\InprocServer32 -> C:\Users\kevin\AppData\Local\Google\Update\1.3.25.5\psuser_64.dll => No File

CustomCLSID: HKU\S-1-5-21-3999677733-3138207020-536071805-1001_Classes\CLSID\{1423F872-3F7F-4E57-B621-8B1A9D49B448}\InprocServer32 -> C:\Users\kevin\AppData\Local\Google\Update\1.3.27.5\psuser_64.dll => No File

CustomCLSID: HKU\S-1-5-21-3999677733-3138207020-536071805-1001_Classes\CLSID\{355EC88A-02E2-4547-9DEE-F87426484BD1}\InprocServer32 -> C:\Users\kevin\AppData\Local\Google\Update\1.3.23.9\psuser_64.dll => No File

CustomCLSID: HKU\S-1-5-21-3999677733-3138207020-536071805-1001_Classes\CLSID\{90B3DFBF-AF6A-4EA0-8899-F332194690F8}\InprocServer32 -> C:\Users\kevin\AppData\Local\Google\Update\1.3.24.15\psuser_64.dll => No File

CustomCLSID: HKU\S-1-5-21-3999677733-3138207020-536071805-1001_Classes\CLSID\{D0336C0B-7919-4C04-8CCE-2EBAE2ECE8C9}\InprocServer32 -> C:\Users\kevin\AppData\Local\Google\Update\1.3.25.11\psuser_64.dll => No File

CustomCLSID: HKU\S-1-5-21-3999677733-3138207020-536071805-1001_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\kevin\AppData\Roaming\Dropbox\bin\DropboxExt64.3.0.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-3999677733-3138207020-536071805-1001_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\kevin\AppData\Roaming\Dropbox\bin\DropboxExt64.3.0.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-3999677733-3138207020-536071805-1001_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\kevin\AppData\Roaming\Dropbox\bin\DropboxExt64.3.0.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-3999677733-3138207020-536071805-1001_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\kevin\AppData\Roaming\Dropbox\bin\DropboxExt64.3.0.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-3999677733-3138207020-536071805-1001_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\kevin\AppData\Roaming\Dropbox\bin\DropboxExt64.3.0.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-3999677733-3138207020-536071805-1001_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\kevin\AppData\Roaming\Dropbox\bin\DropboxExt64.3.0.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-3999677733-3138207020-536071805-1001_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\kevin\AppData\Roaming\Dropbox\bin\DropboxExt64.3.0.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-3999677733-3138207020-536071805-1001_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\kevin\AppData\Roaming\Dropbox\bin\DropboxExt64.3.0.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-3999677733-3138207020-536071805-1001_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\kevin\AppData\Roaming\Dropbox\bin\DropboxExt64.3.0.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-3999677733-3138207020-536071805-1001_Classes\CLSID\{FB314EE1-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\kevin\AppData\Roaming\Dropbox\bin\DropboxExt64.3.0.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-3999677733-3138207020-536071805-1001_Classes\CLSID\{FB314EE2-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\kevin\AppData\Roaming\Dropbox\bin\DropboxExt64.3.0.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-3999677733-3138207020-536071805-1001_Classes\CLSID\{FBC9D74C-AF55-4309-9FB2-C426E071637F}\InprocServer32 -> C:\Users\kevin\AppData\Roaming\Dropbox\bin\DropboxExt64.3.0.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-3999677733-3138207020-536071805-1001_Classes\CLSID\{FE498BAB-CB4C-4F88-AC3F-3641AAAF5E9E}\InprocServer32 -> C:\Users\kevin\AppData\Local\Google\Update\1.3.24.7\psuser_64.dll => No File

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {256223DB-9722-4CEF-A51F-5CCFA1297292} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-12-11] (Adobe Systems Incorporated)

Task: {476E0548-D492-4E81-A9BF-EDC63CB081B1} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-07-07] (Adobe Systems Incorporated)

Task: {8A6CAD68-4D98-4259-B699-191E4DDD7840} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3999677733-3138207020-536071805-1001Core => C:\Users\kevin\AppData\Local\Google\Update\GoogleUpdate.exe

Task: {96F26F73-D02F-46EA-ABAF-5745FBB524C7} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)

Task: {AC8761CE-2411-4BFE-A3DC-2661FC3EE6A0} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-01-21] (Piriform Ltd)

Task: {C5DC6DB2-5D0E-4353-BACC-7525C0153A34} - System32\Tasks\DropboxUpdateTaskUserS-1-5-21-3999677733-3138207020-536071805-1001UA => C:\Users\kevin\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2016-12-10] (Dropbox, Inc.)

Task: {D31F21AC-0D8A-48DC-A8F4-0BBA70C37A54} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-22] (Google Inc.)

Task: {D7F38EAF-760F-46B9-98B4-483F7FFD95AC} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-22] (Google Inc.)

Task: {DAE22E81-F099-4E2E-8957-85FD8E6A6F79} - System32\Tasks\DropboxUpdateTaskUserS-1-5-21-3999677733-3138207020-536071805-1001Core => C:\Users\kevin\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2016-12-10] (Dropbox, Inc.)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-3999677733-3138207020-536071805-1001Core.job => C:\Users\kevin\AppData\Local\Dropbox\Update\DropboxUpdate.exe

Task: C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-3999677733-3138207020-536071805-1001UA.job => C:\Users\kevin\AppData\Local\Dropbox\Update\DropboxUpdate.exe

==================== Shortcuts =============================

(The entries could be listed to be restored or removed.)

ShortcutWithArgument: C:\Users\Public\Desktop\My BT.LNK -> C:\Program Files (x86)\BTHomeHub\Launcher\LaunchHM.exe (British Telecommunications plc) -> hxxp://www.bt.com/mybt

==================== Loaded Modules (Whitelisted) ==============

2011-12-29 10:17 - 2013-01-18 15:00 - 00087328 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll

2012-10-08 17:04 - 2012-10-08 17:04 - 00166912 _____ () C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe

2011-06-24 12:19 - 2010-01-21 00:53 - 00496232 _____ () C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe

2011-06-24 12:19 - 2010-01-21 00:52 - 00076392 _____ () C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nv_common.dll

2011-06-24 12:19 - 2010-01-21 00:53 - 00731752 _____ () C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\SpecialCase.dll

2011-06-24 12:19 - 2010-01-21 00:53 - 00209000 _____ () C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe

2012-09-26 18:14 - 2012-09-26 18:14 - 00168864 _____ () C:\Program Files (x86)\HTC\HTC Sync Manager\HTC Sync\adb.exe

2011-06-24 12:18 - 2010-05-24 09:10 - 00076192 ____R () C:\Program Files (x86)\VIA\VIAudioi\VDeck\QsApoApi64.dll

2011-06-24 12:18 - 2010-05-24 09:10 - 00383904 ____R () C:\Program Files (x86)\VIA\VIAudioi\VDeck\Dts2ApoApi64.dll

2011-06-24 12:18 - 2010-05-24 09:10 - 00103328 ____R () C:\Program Files (x86)\VIA\VIAudioi\VDeck\VMicApi.dll

2011-06-24 12:18 - 2010-05-24 09:10 - 64641440 ____R () C:\Program Files (x86)\VIA\VIAudioi\VDeck\Skin.dll

2011-07-28 23:08 - 2011-07-28 23:08 - 01259376 _____ () C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe

2014-10-11 13:06 - 2014-10-11 13:06 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll

2014-10-11 13:05 - 2014-10-11 13:05 - 01044776 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll

2012-09-26 18:11 - 2012-09-26 18:11 - 00024496 _____ () C:\Program Files (x86)\HTC\HTC Sync Manager\DbAccess.dll

2012-09-26 18:12 - 2012-09-26 18:12 - 00466256 _____ () C:\Program Files (x86)\HTC\HTC Sync Manager\sqlite3.dll

2012-09-26 18:12 - 2012-09-26 18:12 - 00043944 _____ () C:\Program Files (x86)\HTC\HTC Sync Manager\NAdvLog.dll

2012-09-26 18:12 - 2012-09-26 18:12 - 00035776 _____ () C:\Program Files (x86)\HTC\HTC Sync Manager\NFileCacheDBAccess.dll

2012-09-26 18:15 - 2012-09-26 18:15 - 00223152 _____ () C:\Program Files (x86)\HTC\HTC Sync Manager\DevConnMon.dll

2011-11-23 20:21 - 2011-11-23 20:21 - 00105576 ____R () C:\Program Files (x86)\Amazon\Amazon Unbox Video\LimelightDownloadManager.dll

2011-07-28 23:09 - 2011-07-28 23:09 - 00096112 _____ () C:\Program Files (x86)\DivX\DivX Update\DivXUpdateCheck.dll

2016-12-10 17:34 - 2016-11-08 20:29 - 01819240 _____ () C:\Program Files (x86)\Google\Chrome\Application\54.0.2840.99\libglesv2.dll

2016-12-10 17:34 - 2016-11-08 20:29 - 00093288 _____ () C:\Program Files (x86)\Google\Chrome\Application\54.0.2840.99\libegl.dll

2016-12-31 12:26 - 2016-12-11 12:37 - 17833560 _____ () C:\Users\kevin\AppData\Local\Google\Chrome\User Data\PepperFlash\24.0.0.186\pepflashplayer.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\GoToAssist => ""="Service"

==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)

==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 02:34 - 2016-08-12 22:21 - 00000863 ____A C:\Windows\system32\Drivers\etc\hosts

0.0.0.1 mssplus.mcafee.com

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-3999677733-3138207020-536071805-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\kevin\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg

DNS Servers: 192.168.1.254

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 0) (ConsentPromptBehaviorUser: 3) (EnableLUA: 0)

Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

MSCONFIG\startupreg: ApnUpdater => "C:\Program Files (x86)\Ask.com\Updater\Updater.exe"

MSCONFIG\startupreg: Browser Infrastructure Helper => C:\Users\kevin\AppData\Local\Smartbar\Application\SnapDo.exe startup

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [{791B2637-F949-450B-9793-5995784E53F4}] => C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe

FirewallRules: [{32213C58-2344-4247-810D-96E1669B1E8D}] => C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe

FirewallRules: [{2D5233C4-F80E-469B-AC81-326EEF1B0B90}] => C:\Program Files (x86)\uTorrent\uTorrent.exe

FirewallRules: [{5CAA67CA-FC9B-422F-8151-B190F207C018}] => C:\Program Files (x86)\uTorrent\uTorrent.exe

FirewallRules: [{58238F68-1B01-4592-808E-2BAA9DE34996}] => C:\Program Files\SolidWorks Corp\SolidWorks\swScheduler\DTSCoordinatorService.exe

FirewallRules: [{7523F139-B0AB-43B7-AFF7-09E377A1AD42}] => C:\Program Files\SolidWorks Corp\SolidWorks\swScheduler\DTSCoordinatorService.exe

FirewallRules: [{7C9FE937-E8AE-47C9-9114-7554CFA29758}] => C:\Program Files (x86)\HTC\HTC Sync Manager\HTCSyncManager.exe

FirewallRules: [{C190277C-31E1-4357-85FB-8958F57E60D1}] => C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe

FirewallRules: [{23BB780D-D0A6-4B55-AC89-1810350DFB3A}] => C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe

FirewallRules: [{40B5088D-6C1E-459E-BC59-E6D592FD10FF}] => C:\Users\kevin\AppData\Roaming\Dropbox\bin\Dropbox.exe

FirewallRules: [{BEAACFD1-DD1A-4936-97C3-B56961590FA7}] => C:\Users\kevin\AppData\Roaming\Dropbox\bin\Dropbox.exe

FirewallRules: [{1918DFCF-4C12-47AC-A982-D92D4DD1E966}] => C:\Program Files (x86)\BT Broadband Desktop Help\btbb\BTHelpBrowser.exe

FirewallRules: [{7EE15858-E86C-4AF5-979C-24F0BD4E47BA}] => C:\Program Files (x86)\BT Broadband Desktop Help\btbb\BTHelpBrowser.exe

FirewallRules: [{64CCB95A-EC33-495A-BAAA-FEE7413A1A06}] => C:\Program Files\BT Broadband Desktop Help\btbb\BTHelpNotifier.exe

FirewallRules: [{C0CE9890-4546-4F6F-9D88-FD770FBEDF97}] => C:\Program Files\BT Broadband Desktop Help\btbb\BTHelpNotifier.exe

FirewallRules: [{739BCB9E-5C28-4323-A9CE-311C49065519}] => C:\Program Files (x86)\BT Broadband Desktop Help\btbb\MA\8.3.1.7.bt.1.3\ma\bin\node.exe

FirewallRules: [{2B557234-983D-42CA-81EE-4F106F539418}] => C:\Program Files (x86)\BT Broadband Desktop Help\btbb\MA\8.3.1.7.bt.1.3\ma\bin\node.exe

FirewallRules: [TCP Query User{917BE447-112B-4DBE-B444-FE4FD9D96220}C:\program files\bt broadband desktop help\btbb\bthelpnotifier.exe] => C:\program files\bt broadband desktop help\btbb\bthelpnotifier.exe

FirewallRules: [UDP Query User{3DDFB4BA-E300-4191-B013-89E9E6E5A5AC}C:\program files\bt broadband desktop help\btbb\bthelpnotifier.exe] => C:\program files\bt broadband desktop help\btbb\bthelpnotifier.exe

FirewallRules: [TCP Query User{241A051B-BB73-4645-935B-C3C331722110}C:\program files (x86)\videolan\vlc\vlc.exe] => C:\program files (x86)\videolan\vlc\vlc.exe

FirewallRules: [UDP Query User{D687CE88-8554-4F5C-9231-3AC3F0E9195C}C:\program files (x86)\videolan\vlc\vlc.exe] => C:\program files (x86)\videolan\vlc\vlc.exe

FirewallRules: [{1B698881-56D8-456E-9B0B-CB2CCC7F8B04}] => C:\Users\kevin\AppData\Roaming\uTorrent\uTorrent.exe

FirewallRules: [{F90703D8-6D67-4FF0-B427-BC4D236BD24D}] => C:\Users\kevin\AppData\Roaming\uTorrent\uTorrent.exe

FirewallRules: [{E2CA78F0-5164-4ED1-BE07-426E95EBACD2}] => C:\Program Files\Bonjour\mDNSResponder.exe

FirewallRules: [{F7C373AD-B3B1-4230-ABE6-BD1EA5BF4ADB}] => C:\Program Files\Bonjour\mDNSResponder.exe

FirewallRules: [{A842DE7D-7AE4-41B6-A4EF-ECE330A66A23}] => C:\Program Files (x86)\Bonjour\mDNSResponder.exe

FirewallRules: [{C792ED52-85A5-442E-92BF-5165BD83F9CF}] => C:\Program Files (x86)\Bonjour\mDNSResponder.exe

FirewallRules: [{2DCD1EB1-65EE-4B70-98C9-8A988346CA39}] => C:\Program Files (x86)\iTunes\iTunes.exe

FirewallRules: [TCP Query User{00AD0A43-CDC8-4467-B4B2-35D48FE29E42}C:\program files (x86)\kodi\kodi.exe] => C:\program files (x86)\kodi\kodi.exe

FirewallRules: [UDP Query User{B99A0B7F-C978-486B-90A2-982A35FE19EA}C:\program files (x86)\kodi\kodi.exe] => C:\program files (x86)\kodi\kodi.exe

FirewallRules: [TCP Query User{D440C9D1-95F7-49B5-983A-766CE61E15A2}C:\users\kevin\appdata\roaming\dropbox\bin\dropbox.exe] => C:\users\kevin\appdata\roaming\dropbox\bin\dropbox.exe

FirewallRules: [UDP Query User{965572E7-7085-413D-B953-C45E443F01E3}C:\users\kevin\appdata\roaming\dropbox\bin\dropbox.exe] => C:\users\kevin\appdata\roaming\dropbox\bin\dropbox.exe

FirewallRules: [{1982DF6C-2A1F-4496-91EB-E427C1B8A825}] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Restore Points =========================

11-11-2015 20:55:35 Windows Update

11-11-2015 22:17:19 Windows Update

19-11-2015 13:45:42 Windows Update

19-11-2015 15:06:46 Windows Update

02-01-2016 21:36:27 Windows Update

29-07-2016 03:34:57 Scheduled Checkpoint

29-07-2016 22:17:46 Windows Update

10-12-2016 18:31:20 Scheduled Checkpoint

==================== Faulty Device Manager Devices =============

==================== Event log errors: =========================

Application errors:

==================

Error: (12/31/2016 12:05:11 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (12/31/2016 09:23:15 AM) (Source: WinMgmt) (EventID: 10) (User: )

Error: (12/30/2016 04:54:27 PM) (Source: WinMgmt) (EventID: 10) (User: )

Error: (12/30/2016 09:29:15 AM) (Source: WinMgmt) (EventID: 10) (User: )

Error: (12/28/2016 03:05:01 PM) (Source: WinMgmt) (EventID: 10) (User: )

Error: (12/27/2016 08:14:19 PM) (Source: WinMgmt) (EventID: 10) (User: )

Error: (12/18/2016 07:17:36 PM) (Source: WinMgmt) (EventID: 10) (User: )

Error: (12/18/2016 02:55:41 PM) (Source: WinMgmt) (EventID: 10) (User: )

Error: (12/12/2016 06:30:20 PM) (Source: WinMgmt) (EventID: 10) (User: )

Error: (12/12/2016 06:26:38 PM) (Source: WinMgmt) (EventID: 10) (User: )

System errors:

=============

Error: (12/31/2016 12:05:53 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: The NVIDIA Update Service Daemon service failed to start due to the following error:

The service did not start due to a logon failure.

Error: (12/31/2016 12:05:53 PM) (Source: Service Control Manager) (EventID: 7038) (User: )

Description: The nvUpdatusService service was unable to log on as .\UpdatusUser with the currently configured password due to the following error:

Logon failure: the specified account password has expired.

To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC).

Error: (12/31/2016 12:03:49 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )

Description: Microsoft Antimalware has encountered an error trying to update signatures.

New Signature Version:

Previous Signature Version: 115.26.0.0

Update Source: Microsoft Malware Protection Center

Update Stage: Search

Source Path: http://go.microsoft.com/fwlink/?LinkID=260974&clcid;=0x409&NRI;=true&arch;=x64ŋ=0.0.0.0&sig;=0.0.0.0∏=EDB4FA23-53B8-4AFA-8C5D-99752CCA7094

Signature Type: Network Inspection System

Update Type: Full

User: NT AUTHORITY\NETWORK SERVICE

Current Engine Version:

Previous Engine Version: 2.1.11804.0

Error code: 0x80072ee7

Error description: The server name or address could not be resolved

Error: (12/31/2016 12:03:49 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )

Description: Microsoft Antimalware has encountered an error trying to update signatures.

New Signature Version:

Previous Signature Version: 1.213.1613.0

Update Source: Microsoft Malware Protection Center

Update Stage: Search

Source Path: http://go.microsoft.com/fwlink/?LinkID=121721&clcid;=0x409&arch;=x64ŋ=1.1.12400.0&avdelta;=1.213.1613.0&asdelta;=1.213.1613.0∏=EDB4FA23-53B8-4AFA-8C5D-99752CCA7094

Signature Type: AntiSpyware

Update Type: Full

User: NT AUTHORITY\NETWORK SERVICE

Current Engine Version:

Previous Engine Version: 1.1.12400.0

Error code: 0x80072ee7

Error description: The server name or address could not be resolved

Error: (12/31/2016 12:03:49 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )

Description: Microsoft Antimalware has encountered an error trying to update signatures.

New Signature Version:

Previous Signature Version: 1.213.1613.0

Update Source: Microsoft Malware Protection Center

Update Stage: Search

Source Path: http://go.microsoft.com/fwlink/?LinkID=121721&clcid;=0x409&arch;=x64ŋ=1.1.12400.0&avdelta;=1.213.1613.0&asdelta;=1.213.1613.0∏=EDB4FA23-53B8-4AFA-8C5D-99752CCA7094

Signature Type: AntiVirus

Update Type: Full

User: NT AUTHORITY\NETWORK SERVICE

Current Engine Version:

Previous Engine Version: 1.1.12400.0

Error code: 0x80072ee7

Error description: The server name or address could not be resolved

Error: (12/31/2016 12:03:49 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )

Description: Microsoft Antimalware has encountered an error trying to update signatures.

New Signature Version:

Previous Signature Version: 1.213.1613.0

Update Source: Microsoft Update Server

Update Stage: Search

Source Path: http://www.microsoft.com

Signature Type: AntiVirus

Update Type: Full

User: NT AUTHORITY\SYSTEM

Current Engine Version:

Previous Engine Version: 1.1.12400.0

Error code: 0x8024402c

Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.

Error: (12/31/2016 09:23:52 AM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: The NVIDIA Update Service Daemon service failed to start due to the following error:

The service did not start due to a logon failure.

Error: (12/31/2016 09:23:52 AM) (Source: Service Control Manager) (EventID: 7038) (User: )

Description: The nvUpdatusService service was unable to log on as .\UpdatusUser with the currently configured password due to the following error:

Logon failure: the specified account password has expired.

To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC).

Error: (12/31/2016 09:21:50 AM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )

Description: Microsoft Antimalware has encountered an error trying to update signatures.

New Signature Version:

Previous Signature Version: 115.26.0.0

Update Source: Microsoft Malware Protection Center

Update Stage: Search

Source Path: http://go.microsoft.com/fwlink/?LinkID=260974&clcid;=0x409&NRI;=true&arch;=x64ŋ=0.0.0.0&sig;=0.0.0.0∏=EDB4FA23-53B8-4AFA-8C5D-99752CCA7094

Signature Type: Network Inspection System

Update Type: Full

User: NT AUTHORITY\NETWORK SERVICE

Current Engine Version:

Previous Engine Version: 2.1.11804.0

Error code: 0x80072ee7

Error description: The server name or address could not be resolved

Error: (12/31/2016 09:21:50 AM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )

Description: Microsoft Antimalware has encountered an error trying to update signatures.

New Signature Version:

Previous Signature Version: 1.213.1613.0

Update Source: Microsoft Malware Protection Center

Update Stage: Search

Source Path: http://go.microsoft.com/fwlink/?LinkID=121721&clcid;=0x409&arch;=x64ŋ=1.1.12400.0&avdelta;=1.213.1613.0&asdelta;=1.213.1613.0∏=EDB4FA23-53B8-4AFA-8C5D-99752CCA7094

Signature Type: AntiSpyware

Update Type: Full

User: NT AUTHORITY\NETWORK SERVICE

Current Engine Version:

Previous Engine Version: 1.1.12400.0

Error code: 0x80072ee7

Error description: The server name or address could not be resolved

==================== Memory info ===========================

Processor: AMD Phenom™ II X2 555 Processor

Percentage of memory in use: 62%

Total physical RAM: 4095.23 MB

Available physical RAM: 1545.98 MB

Total Virtual: 8188.64 MB

Available Virtual: 5288.66 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:465.66 GB) (Free:133.17 GB) NTFS

==================== MBR & Partition Table ==================

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 02626CF7)

Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=465.7 GB) - (Type=07 NTFS)

==================== End of Addition.txt ============================

machisan

Post #2December 31, 2016, 12:51 PM UTC last edited December 31, 2016, 1:01 PM UTC

please delete

Juliet

Post #3January 1, 2017, 4:36 AM UTC

I'm a little confused but, you want to continue with this?

Please go to add/remove programs list and look for the below items.
Once/If found, select uninstall/delete, If one is not found continue to the next.

Ask Toolbar (HKLM-x32\…\{86D4B82A-ABED-442A-BE86-96357B70F4FE}) (Version: 1.15.23.0 - Ask.com) <==== ATTENTION
IMinent Toolbar (HKLM-x32\…\{A76AA284-E52D-47E6-9E4F-B85DBF8E35C3}) (Version: 3.26.0 - IMinent) <==== ATTENTION
Java 7 Update 60 (HKLM-x32\…\{26A24AE4-039D-4CA4-87B4-2F83217025FF}) (Version: 7.0.600 - Oracle)
Yontoo 1.10.02 (HKLM\…\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}) (Version: 1.10.02 - Yontoo LLC) <==== ATTENTION

~~~~~~~~~~~~~~~~~~

Please print out or make a copy in notepad of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.

**
Running from C:\Users\[removed]\Downloads

It's best we move Farbar's to desktop.

Please go to your downloads folder, locate Farbar Recovery Scan Tool, right click and select CUT
Go to an open spot on your desktop, right click and select PASTE
You should now have Farbar Recovery Scan Tool on your desktop.

Please open Notepad *Do Not Use Wordpad!* or use any other text editor than Notepad or the script will fail. (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the quote box below:
To do this highlight the contents of the box and right click on it and select copy.
Paste this into the open notepad. save it to the Desktop as fixlist.txt
NOTE. It's important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work.
It needs to be saved Next to the "Farbar Recovery Scan Tool" (If asked to overwrite existing one please allow)

[external image: FRSTfix.JPG]

start
CreateRestorePoint:
CloseProcesses:
HKU\S-1-5-21-3999677733-3138207020-536071805-1001\…\RunOnce: [Application Restart #1] => C:\Users\kevin\AppData\Local\Google\Chrome\Application\chrome.exe –flag-switches-begin –flag-switches-end –restore-last-session hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=GB&u (the data entry has 79 more characters).
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
HKU\S-1-5-21-3999677733-3138207020-536071805-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=GB&userid=a104ea72-9a10-622b-25b3-38a0828b7dfc&searchtype=ds&q={searchTerms}&installDate=
URLSearchHook: HKLM-x32 - (No Name) - {687578b9-7132-4a7a-80e4-30ee31099e03} - No File
SearchScopes: HKLM-x32 -> DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snap.do/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=GB&userid=e7334c78-6978-4a90-9bd0-e472dab29d1a&searchtype=ds&q={searchTerms}&installDate=04/03/2013
SearchScopes: HKLM-x32 -> {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snap.do/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=GB&userid=e7334c78-6978-4a90-9bd0-e472dab29d1a&searchtype=ds&q={searchTerms}&installDate=04/03/2013
BHO-x32: TBSB01620 Class -> {58124A0B-DC32-4180-9BFF-E0E21AE34026} -> C:\Program Files (x86)\IMinent Toolbar\tbcore3.dll [2010-07-02] ()
BHO-x32: Java Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2014-05-07] (Oracle Corporation)
BHO-x32: Ask Toolbar -> {D4027C7F-154A-4066-A1AD-4243D8127440} -> C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll [2013-03-31] (Ask)
BHO-x32: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2014-05-07] (Oracle Corporation)
BHO-x32: Yontoo -> {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} -> C:\Program Files (x86)\Yontoo\YontooIEClient.dll [2012-03-27] (Yontoo LLC)
Toolbar: HKLM - No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} - No File
Toolbar: HKLM-x32 - IMinent Toolbar - {977AE9CC-AF83-45E8-9E03-E2798216E2D5} - C:\Program Files (x86)\IMinent Toolbar\tbcore3.dll [2010-07-02] ()
Toolbar: HKLM-x32 - No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} - No File
Toolbar: HKLM-x32 - Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll [2013-03-31] (Ask)
Toolbar: HKU\S-1-5-21-3999677733-3138207020-536071805-1001 -> No Name - {977AE9CC-AF83-45E8-9E03-E2798216E2D5} - No File
Toolbar: HKU\S-1-5-21-3999677733-3138207020-536071805-1001 -> No Name - {687578B9-7132-4A7A-80E4-30EE31099E03} - No File
Toolbar: HKU\S-1-5-21-3999677733-3138207020-536071805-1001 -> No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
FF Plugin-x32: @java.com/DTPlugin,version=10.60.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll [2014-05-07] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.60.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll [2014-05-07] (Oracle Corporation)
HR StartupUrls: Default -> "hxxp://www.google.co.uk/","hxxp://feed.snap.do/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=GB&userid=e7334c78-6978-4a90-9bd0-e472dab29d1a&searchtype=hp&installDate={installDate}","hxxp://feed.snap.do/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=GB&userid=e7334c78-6978-4a90-9bd0-e472dab29d1a&searchtype=hp&installDate=04/03/2013","hxxp://www.google.com/"
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\54.0.2840.99\PepperFlash\pepflashplayer.dll => No File
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\54.0.2840.99\ppGoogleNaClPluginChrome.dll => No File
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\54.0.2840.99\pdf.dll => No File
HR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll => No File
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll => No File
CHR Plugin: (Google Update) - C:\Users\kevin\AppData\Local\Google\Update\1.3.21.135\npGoogleUpdate3.dll => No File
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_6_602_180.dll => No File
CHR Plugin: (Java Deployment Toolkit 7.0.210.11) - C:\Windows\SysWOW64\npDeployJava1.dll => No File
CHR HKLM-x32\…\Chrome\Extension: [jbolfgndggfhhpbnkgnpjkfhinclbigj] - C:\Program Files (x86)\Freemake\Freemake Video Converter\BrowserPlugin\Chrome\Freemake.Plugin.Chrome.crx [2013-03-04]
CHR HKLM-x32\…\Chrome\Extension: [niapdbllcanepiiimjjndipklodoedlc] - C:\Users\kevin\AppData\Local\Temp\YontooLayers.crx

Open FRST/FRST64 and press the > Fix < button just once and wait.
If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.
~~~~~~~~~~~~~~~~~~`

[external image: BY4dvz9.png]AdwCleaner

Please download AdwCleaner and save the file to your Desktop.
In order to use AdwCleaner, you have to agree the Eula:
Right-click AdwCleaner.exe and select [external image: AVOiBNU.jpg] Run as administrator to run the programme.
Follow the prompts.
Click [external image: A49sxPr.png]Scan.
Upon completion, click [external image: 6cyn5v5.png]Logfile. A log (AdwCleaner[S1].txt) will open. Briefly check the log for anything you know to be legitimate.
Return to AdwCleaner. Ensure anything you know to be legitimate does not have a checkmark under the corresponding tab.
Click [external image: MqHawIb.png]Clean.
Follow the prompts and allow your computer to reboot.
After the reboot, a log (AdwCleaner[C1].txt) will open. Copy the contents of the log and paste in your next reply.

– File and folder backups are made for items removed using this programme. Should a legitimate file or folder be removed (otherwise known as a 'false-positive'), simple steps can be taken to restore the item. Please do not overly concern yourself with the contents of AdwCleaner[C1].txt.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Please download Junkware Removal Tool
or from here http://downloads.malwarebytes.org/file/jrt
to your desktop.

Shut down your protection software now to avoid potential conflicts.
Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
The tool will open and start scanning your system.
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next message.

~~
please post
Fixlog.txt
AdwCleaner[C1].txt
JRT.txt

machisan

Post #4January 1, 2017, 4:05 PM UTC

Hi Juliet, Thankyou very much for your help and sorry for confusing you. My reply post was an accident and could be deleted if need be

Fix result of Farbar Recovery Scan Tool (x64) Version: 21-12-2016

Ran by [removed] (01-01-2017 15:25:04) Run:3

Running from C:\Users\[removed]\Desktop

[removed]

Boot Mode: Normal

==============================================

fixlist content:

*****************

start

CreateRestorePoint:

CloseProcesses:

CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION

URLSearchHook: HKLM-x32 - (No Name) - {687578b9-7132-4a7a-80e4-30ee31099e03} - No File

BHO-x32: TBSB01620 Class -> {58124A0B-DC32-4180-9BFF-E0E21AE34026} -> C:\Program Files (x86)\IMinent Toolbar\tbcore3.dll [2010-07-02] ()

BHO-x32: Java Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2014-05-07] (Oracle Corporation)

BHO-x32: Ask Toolbar -> {D4027C7F-154A-4066-A1AD-4243D8127440} -> C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll [2013-03-31] (Ask)

BHO-x32: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2014-05-07] (Oracle Corporation)