StephenL
Topic Starter
My laptop has become very slow. It is almost useless for even browsing.
Spyware / Malware / Virus Removal
My laptop is very slow [Solved]
13 min read
ken545
Lets run this program and let me see the logs so we can take a look and see if malware is envolved
Please download Farbar Recovery Scan Tool and save it to your DESKTOP
Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.
How to determine whether a computer is running a 32-bit version or 64-bit version of the Windows operating system
A simple way to check your system: Start –> Computer (right click) –> Properties
[external image: FRST_zps5d956a1a.jpg]
- Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
- Just keep the defaults as in the picture checkmarked
- Press Scan button.
- It will produce a log called FRST.txt in the same directory the tool is run from.
- Please copy and paste log back here.
- The first time the tool is run it generates another log (Addition.txt - also located in the same directory as FRST.exe/FRST64.exe). Please also paste that along with the FRST.txt into your reply.
StephenL
Hi Ken, thanksfor your assistance.
I am posting as instructed.
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 11-02-2017 01
Ran by [removed] (administrator) on SHEENA-PC (11-02-2017 13:48:58)
Running from C:\Users\[removed]\Desktop
[removed]
Platform: Windows 7 Home Premium Service Pack 1 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(AMD) C:\Windows\System32\atiesrxx.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GregHSRW.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee\SiteAdvisor\mcsacore.exe
(MediaMall Technologies, Inc.) C:\Program Files (x86)\MediaMall\MediaMallServer.exe
(Egis Technology Inc.) C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\MWLService.exe
(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
(Acer) C:\Program Files\Acer\Acer Updater\UpdaterService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.31.5\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.31.5\GoogleCrashHandler64.exe
(Symantec Corporation) C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee\MSC\mcsvrcnt.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee.com\Agent\mcagent.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
==================== Registry (Whitelisted) ====================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\…\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [7982112 2009-07-28] (Realtek Semiconductor)
HKLM\…\Run: [Acer ePower Management] => C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [828960 2009-08-06] (Acer Incorporated)
HKLM\…\Run: [mwlDaemon] => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe [349480 2009-08-06] (Egis Technology Inc.)
HKLM\…\Run: [Apoint] => C:\Program Files\Apoint2K\Apoint.exe [301056 2009-06-11] (Alps Electric Co., Ltd.)
HKLM-x32\…\Run: [EgisTecLiveUpdate] => C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe [199464 2009-08-04] (Egis Technology Inc.)
HKLM-x32\…\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [35760 2009-12-22] (Adobe Systems Incorporated)
HKLM-x32\…\Run: [LManager] => C:\Program Files (x86)\Launch Manager\LManager.exe [1157128 2009-07-27] (Dritek System Inc.)
HKLM-x32\…\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2009-07-30] (Advanced Micro Devices, Inc.)
HKLM-x32\…\Run: [ArcadeDeluxeAgent] => C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe [419112 2009-10-06] (CyberLink Corp.)
HKLM-x32\…\Run: [PlayMovie] => C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe [181480 2009-10-05] (Acer Corp.)
HKLM-x32\…\Run: [Acer Assist Launcher] => C:\Program Files (x86)\Acer\Acer Assist\launcher.exe [1261568 2007-11-19] ()
HKLM-x32\…\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM-x32\…\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [248552 2010-05-14] (Sun Microsystems, Inc.)
HKLM-x32\…\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [948672 2009-12-11] (Adobe Systems Incorporated)
HKLM-x32\…\Run: [Norton Online Backup] => C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe [2933184 2012-10-04] (Symantec Corporation)
HKLM-x32\…\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [67384 2016-09-01] (Apple Inc.)
HKLM-x32\…\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-10-01] (Apple Inc.)
HKU\S-1-5-21-1265709536-822219978-4185131874-1001\…\Run: [swg] => C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2009-08-21] (Google Inc.)
HKU\S-1-5-21-1265709536-822219978-4185131874-1001\…\Run: [MobileDocuments] => C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe
HKU\S-1-5-21-1265709536-822219978-4185131874-1001\…\Run: [GameXN GO] => "C:\ProgramData\GameXN\GameXNGO.exe" /startup
HKU\S-1-5-21-1265709536-822219978-4185131874-1001\…\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [59720 2013-09-14] (Apple Inc.)
HKU\S-1-5-21-1265709536-822219978-4185131874-1001\…\Run: [ApplePhotoStreams] => C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [59720 2013-09-15] (Apple Inc.)
HKU\S-1-5-21-1265709536-822219978-4185131874-1001\…\MountPoints2: {bcf38bff-0704-11e0-861d-0026222694fa} - E:\autorun.exe
HKU\S-1-5-18\…\RunOnce: [SPReview] => "C:\Windows\System32\SPReview\SPReview.exe" /sp:1 /errorfwlink:"hxxp://go.microsoft.com/fwlink/?LinkID=122915" /build:7601
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => -> No File
ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => -> No File
ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => -> No File
ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => -> No File
ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => -> No File
ShellIconOverlayIdentifiers: [egisPSDP] -> {30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x64\psdprotect.dll [2009-08-06] (Egis Technology Inc.)
ShellIconOverlayIdentifiers-x32: [egisPSDP] -> {30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\psdprotect.dll [2009-08-06] (Egis Technology Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\$McRebootA5E6DEAA56$.lnk [2017-02-11]
ShortcutTarget: $McRebootA5E6DEAA56$.lnk -> C:\Windows\System32\cmd.exe (Microsoft Corporation)
Startup: C:\Users\Sheena\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk [2010-08-16]
ShortcutTarget: OneNote 2007 Screen Clipper and Launcher.lnk -> C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 192.168.1.1
Tcpip\..\Interfaces\{25B43BE2-156C-41BE-82C5-21FD7D02B0DA}: [NameServer] 173.234.163.178,97.107.141.156
Tcpip\..\Interfaces\{BD7724F8-AA69-4AA5-BE41-83555D321D4A}: [DhcpNameServer] 192.168.1.1 192.168.1.1
Internet Explorer:
==================
HKU\S-1-5-21-1265709536-822219978-4185131874-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.yahoo.com/
HKU\S-1-5-21-1265709536-822219978-4185131874-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&m=aspire_5532&r=27361209d535l0324z195t47m2x291
URLSearchHook: HKLM-x32 - (No Name) - {f0381dbd-e018-4e07-ae40-d96ab15083f0} - No File
URLSearchHook: HKU\S-1-5-21-1265709536-822219978-4185131874-1001 - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
URLSearchHook: HKU\S-1-5-21-1265709536-822219978-4185131874-1001 - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
URLSearchHook: HKU\S-1-5-21-1265709536-822219978-4185131874-1001 - (No Name) - {f0381dbd-e018-4e07-ae40-d96ab15083f0} - No File
SearchScopes: HKLM-x32 -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW
SearchScopes: HKLM-x32 -> {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2765711
SearchScopes: HKU\S-1-5-21-1265709536-822219978-4185131874-1001 -> DefaultScope {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW_enBB358
SearchScopes: HKU\S-1-5-21-1265709536-822219978-4185131874-1001 -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW_enBB358
SearchScopes: HKU\S-1-5-21-1265709536-822219978-4185131874-1001 -> {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2765711
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21] (Microsoft Corp.)
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2013-11-05] (Google Inc.)
BHO: McAfee WebAdvisor BHO -> {B164E929-A1B6-4A06-B104-2CD0E90A88FF} -> c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll [2017-02-06] (McAfee, Inc.)
BHO: No Name -> {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} -> No File
BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-12-21] (Adobe Systems Incorporated)
BHO-x32: No Name -> {30F9B915-B755-4826-820B-08FBA6BD249D} -> No File
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21] (Microsoft Corp.)
BHO-x32: Windows Live Messenger Companion Helper -> {9FDDE16B-836F-4806-AB1F-1455CBEFF289} -> C:\Program Files (x86)\Windows Live\Companion\companioncore.dll [2010-11-10] (Microsoft Corporation)
BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2013-11-04] (Google Inc.)
BHO-x32: Skype add-on for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2010-02-08] (Skype Technologies S.A.)
BHO-x32: McAfee WebAdvisor BHO -> {B164E929-A1B6-4A06-B104-2CD0E90A88FF} -> c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll [2017-02-06] (McAfee, Inc.)
BHO-x32: Javaâ„¢ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll [2010-12-27] (Sun Microsystems, Inc.)
BHO-x32: No Name -> {f0381dbd-e018-4e07-ae40-d96ab15083f0} -> No File
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2013-11-05] (Google Inc.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2013-11-04] (Google Inc.)
Toolbar: HKU\S-1-5-21-1265709536-822219978-4185131874-1001 -> Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2013-11-05] (Google Inc.)
Toolbar: HKU\S-1-5-21-1265709536-822219978-4185131874-1001 -> No Name - {F0381DBD-E018-4E07-AE40-D96AB15083F0} - No File
DPF: HKLM-x32 {02BCC737-B171-4746-94C9-0D8A0B2C0089} hxxp://office.microsoft.com/sites/production/ieawsdc32.cab
DPF: HKLM-x32 {8100D56A-5661-482C-BEE8-AFECE305D968} hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
DPF: HKLM-x32 {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} hxxp://l.yimg.com/jh/games/web_games/popcap/bejeweled2/popcaploader_v6.cab
Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll [2017-02-06] (McAfee, Inc.)
Handler-x32: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll [2017-02-06] (McAfee, Inc.)
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll [2017-02-06] (McAfee, Inc.)
Handler-x32: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll [2017-02-06] (McAfee, Inc.)
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2010-02-08] (Skype Technologies S.A.)
FireFox:
========
FF HKLM\…\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files (x86)\McAfee\SiteAdvisor\saffplg.xpi
FF Extension: (McAfee WebAdvisor) - C:\Program Files (x86)\McAfee\SiteAdvisor\saffplg.xpi [2017-02-10]
FF HKLM-x32\…\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files (x86)\McAfee\SiteAdvisor\saffplg.xpi
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll [2014-02-13] ( Microsoft Corporation)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2013-10-01] ()
FF Plugin-x32: @java.com/JavaPlugin -> C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll [2010-12-27] (Sun Microsystems, Inc.)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll [2014-02-13] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2010-11-10] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2010-11-10] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-09-25] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-09-25] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.6 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-04-26] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.2.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-04-26] (VideoLAN)
Chrome:
=======
CHR DefaultProfile: Default
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\54.0.2840.99\ppGoogleNaClPluginChrome.dll => No File
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\54.0.2840.99\pdf.dll => No File
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\54.0.2840.99\gcswf32.dll => No File
CHR Plugin: (McAfee SiteAdvisor) - C:\Users\Sheena\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho\3.41.123.2_0\McChPlg.dll => No File
CHR Plugin: (McAfee SiteAdvisor) - C:\Program Files (x86)\McAfee\SiteAdvisor\npmcffplg32.dll (McAfee, Inc.)
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Java Deployment Toolkit 6.0.230.5) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll (Sun Microsystems, Inc.)
CHR Plugin: (Java(TM) Platform SE 6 U23) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll => No File
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll => No File
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll => No File
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll => No File
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll => No File
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll => No File
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll => No File
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll => No File
CHR Plugin: (Windows Live Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (iTunes Application Detector) - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrl.dll => No File
CHR Profile: C:\Users\Sheena\AppData\Local\Google\Chrome\User Data\Default [2017-02-11]
CHR Extension: (McAfee® WebAdvisor) - C:\Users\Sheena\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho [2017-02-10]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Sheena\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-02-11]
CHR Extension: (Chrome Media Router) - C:\Users\Sheena\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-02-11]
CHR HKLM\…\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - C:\Program Files (x86)\McAfee\SiteAdvisor\McChPlg.crx [2016-06-29]
CHR HKLM-x32\…\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - C:\Program Files (x86)\McAfee\SiteAdvisor\McChPlg.crx [2016-06-29]
==================== Services (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
S2 0306071486780525mcinstcleanup; C:\Windows\TEMP\030607~1.EXE [883024 2017-02-10] (McAfee, Inc.)
R2 McAfee SiteAdvisor Service; C:\Program Files (x86)\McAfee\SiteAdvisor\McSACore.exe [188352 2017-02-06] (McAfee, Inc.)
R2 MediaMall Server; C:\Program Files (x86)\MediaMall\MediaMallServer.exe [3895088 2013-03-23] (MediaMall Technologies, Inc.)
R2 MWLService; C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe [311592 2009-08-06] (Egis Technology Inc.)
U2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [3979712 2012-10-04] (Symantec Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
===================== Drivers (Whitelisted) ======================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
S3 InputFilter_Hid_FlexDef2b; C:\Windows\System32\DRIVERS\InputFilter_FlexDef2b.sys [17920 2010-06-19] (Siliten)
R3 mfesapsn; C:\Program Files (x86)\McAfee\SiteAdvisor\x64\mfesapsn.sys [46240 2016-06-06] (McAfee, Inc.)
R3 msvad_simple; C:\Windows\System32\drivers\povrtdev.sys [28528 2013-03-05] (MediaMall Technologies, Inc.)
S3 RimVSerPort; C:\Windows\System32\DRIVERS\RimSerial_AMD64.sys [31744 2009-01-09] (Research in Motion Ltd)
S3 mfeavfk; system32\drivers\mfeavfk.sys [X]
R1 mfehidk; system32\drivers\mfehidk.sys [X]
S3 mferkdk; system32\drivers\mferkdk.sys [X]
S3 mfesmfk; system32\drivers\mfesmfk.sys [X]
R4 MPFP; System32\Drivers\Mpfp.sys [X]
S3 RimUsb; System32\Drivers\RimUsb_AMD64.sys [X]
S3 RtsUIR; system32\DRIVERS\Rts516xIR.sys [X]
S3 USBCCID; system32\DRIVERS\RtsUCcid.sys [X]
U3 aswMBR; \??\C:\Users\Sheena\AppData\Local\Temp\aswMBR.sys [X] <==== ATTENTION
U3 aswVmm; \??\C:\Users\Sheena\AppData\Local\Temp\aswVmm.sys [X] <==== ATTENTION
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2017-02-11 13:48 - 2017-02-11 13:52 - 00022097 _____ C:\Users\Sheena\Desktop\FRST.txt
2017-02-11 13:47 - 2017-02-11 13:48 - 00000000 ____D C:\FRST
2017-02-11 13:33 - 2017-02-11 13:33 - 02421248 _____ (Farbar) C:\Users\Sheena\Desktop\FRST64.exe
2017-02-11 09:00 - 2017-02-11 09:00 - 01029654 _____ C:\Users\Sheena\Desktop\Frizzle.bmp
2017-02-11 05:54 - 2017-02-11 05:54 - 00002108 _____ C:\Users\Sheena\Desktop\aswMBR.txt
2017-02-11 05:54 - 2017-02-11 05:54 - 00000512 _____ C:\Users\Sheena\Desktop\MBR.dat
2017-02-10 23:19 - 2017-02-10 23:19 - 05198336 _____ (AVAST Software) C:\Users\Sheena\Downloads\aswMBR (1).exe
2017-02-10 23:17 - 2017-02-10 23:18 - 05198336 _____ (AVAST Software) C:\Users\Sheena\Downloads\aswMBR.exe
2017-02-10 20:43 - 2017-02-10 20:43 - 00000000 ____D C:\Users\family\AppData\Local\{730A6219-43E4-4B3F-B839-AFC3AF014377}
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2017-02-11 13:55 - 2016-06-29 19:23 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2017-02-11 13:46 - 2010-01-31 11:40 - 00000898 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2017-02-11 05:36 - 2010-01-31 11:40 - 00000894 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2017-02-10 23:17 - 2009-07-14 00:45 - 00009920 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2017-02-10 23:17 - 2009-07-14 00:45 - 00009920 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2017-02-10 22:35 - 2009-08-21 22:18 - 00000000 ____D C:\Program Files (x86)\McAfee
2017-02-10 21:59 - 2009-07-14 01:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2017-02-10 21:16 - 2011-02-07 15:47 - 00003934 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{4C1503E9-0D05-41EA-859A-B302FECF615E}
2017-02-10 20:41 - 2010-01-30 06:16 - 00000000 ____D C:\Users\family\Tracing
==================== Files in the root of some directories =======
2016-06-29 23:48 - 2016-06-29 23:51 - 6748160 _____ () C:\Program Files (x86)\GUT76EB.tmp
2012-09-29 15:15 - 2012-09-29 15:15 - 4096000 _____ () C:\Program Files (x86)\GUTE292.tmp
2009-12-30 15:33 - 2010-08-09 20:48 - 0000236 _____ () C:\Users\Sheena\AppData\Roaming\wklnhst.dat
2011-09-10 09:13 - 2011-09-10 09:35 - 0004608 _____ () C:\Users\Sheena\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2011-12-01 19:19 - 2011-12-01 19:19 - 0000000 _____ () C:\Users\Sheena\AppData\Local\{E7E2D897-A142-40E0-94B6-4C279C8EFCAC}
2009-09-12 14:15 - 2011-02-14 19:07 - 0007833 _____ () C:\ProgramData\ArcadeDeluxe3.log
2010-04-26 20:04 - 2010-04-26 20:04 - 0000056 ____H () C:\ProgramData\ezsidmv.dat
2009-12-31 18:14 - 2009-12-31 18:16 - 0000351 _____ () C:\ProgramData\hpzinstall.log
Some files in TEMP:
====================
2010-04-24 14:50 - 2010-04-24 14:50 - 1960304 _____ (Adobe Systems Incorporated) C:\Users\Guest\AppData\Local\Temp\FlashPlayerUpdate.exe
2011-02-14 18:46 - 2011-02-14 18:56 - 51126240 _____ ( ) C:\Users\Sheena\AppData\Local\Temp\181E.exe
2010-10-20 23:08 - 2010-10-20 23:08 - 2487632 _____ () C:\Users\Sheena\AppData\Local\Temp\AF-HSS.exe
2009-12-15 03:35 - 2009-12-15 03:35 - 0465408 _____ (Realtek Semiconductor Corp.) C:\Users\Sheena\AppData\Local\Temp\COMAP.EXE
2016-09-25 02:19 - 2012-07-30 06:45 - 3954224 _____ (GameXN AS) C:\Users\Sheena\AppData\Local\Temp\ezGameXN.dll
2010-01-15 21:51 - 2010-01-15 21:51 - 1956736 _____ (Adobe Systems Incorporated) C:\Users\Sheena\AppData\Local\Temp\FlashPlayerUpdate.exe
2010-08-19 07:49 - 2010-08-19 07:49 - 2826192 _____ (Adobe Systems, Inc.) C:\Users\Sheena\AppData\Local\Temp\FlashPlayerUpdate01.exe
2016-09-25 02:19 - 2011-09-05 13:23 - 0347008 _____ (EasyBits Software AS) C:\Users\Sheena\AppData\Local\Temp\GameXNGO.exe
2011-04-12 17:41 - 2010-10-18 12:27 - 0157536 _____ () C:\Users\Sheena\AppData\Local\Temp\GLF766C.tmp.ConduitEngineSetup.exe
2010-04-26 19:56 - 2010-04-26 19:56 - 0559280 _____ () C:\Users\Sheena\AppData\Local\Temp\GoogleChromeInstaller.exe
2010-04-05 21:24 - 2010-04-05 21:27 - 36224872 _____ (Microsoft Corporation) C:\Users\Sheena\AppData\Local\Temp\msg542A.exe
2011-04-19 22:13 - 2011-04-19 22:24 - 83249512 _____ (Microsoft Corporation) C:\Users\Sheena\AppData\Local\Temp\msgF210.exe
2011-05-19 18:33 - 2010-12-27 13:02 - 0469256 _____ (Microsoft Corporation) C:\Users\Sheena\AppData\Local\Temp\MSND682.exe
2011-03-14 12:23 - 2011-03-14 12:23 - 4446792 _____ (Conduit Ltd.) C:\Users\Sheena\AppData\Local\Temp\nsi1989.tmp.ConduitEngineEmbbed.exe
2011-09-05 13:22 - 2011-09-05 13:22 - 2524032 _____ (EasyBits Software AS) C:\Users\Sheena\AppData\Local\Temp\Refresh.exe
2010-05-29 08:31 - 2011-10-28 18:34 - 23803016 _____ (Skype Technologies S.A.) C:\Users\Sheena\AppData\Local\Temp\SkypeSetup.exe
2011-02-05 09:59 - 2011-02-05 09:59 - 0176128 _____ () C:\Users\Sheena\AppData\Local\Temp\_DelAll.EXE
2013-01-22 06:59 - 2013-01-22 06:59 - 0000000 _____ () C:\Users\Sheena\AppData\Local\Temp\{63E40967-4014-4EF5-AB66-6E980FA63EC2}-GoogleToolbarInstaller_updater_signed.exe
2013-12-15 02:58 - 2013-12-15 02:58 - 0000000 _____ () C:\Users\Sheena\AppData\Local\Temp\{A70DA7E2-FAE9-4676-8DE9-E4DB7F1F960E}-31.0.1650.63_chrome_installer.exe
2013-10-13 23:38 - 2013-10-13 23:48 - 0000000 _____ () C:\Users\Sheena\AppData\Local\Temp\{FC2F00E5-BD73-4826-8627-F657660CB4F8}-30.0.1599.69_29.0.1547.76_chrome_updater.exe
2011-08-17 19:59 - 2011-11-28 17:50 - 0286720 _____ (Symantec Corporation) C:\Users\Sheena\AppData\Local\Temp\~0000.dll
61712-93-00 59672:93 - 61712-93-00 27848:16353 - 0831488 _____ (Symantec Corporation) C:\Users\Sheena\AppData\Local\Temp\~0000.EXE
==================== Bamital & volsnap ======================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 11-02-2017 01
Ran by [removed] (11-02-2017 14:09:03)
Running from C:\Users\[removed]\Desktop
Windows 7 Home Premium Service Pack 1 (X64) (2009-12-14 16:10:34)
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
Administrator (S-1-5-21-1265709536-822219978-4185131874-500 - Administrator - Disabled)
family (S-1-5-21-1265709536-822219978-4185131874-1003 - Limited - Enabled) => C:\Users\family
Guest (S-1-5-21-1265709536-822219978-4185131874-501 - Limited - Enabled) => C:\Users\Guest
HomeGroupUser$ (S-1-5-21-1265709536-822219978-4185131874-1002 - Limited - Enabled)
Sheena (S-1-5-21-1265709536-822219978-4185131874-1001 - Administrator - Enabled) => C:\Users\Sheena
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AS: Windows Defender (Enabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: McAfee Personal Firewall (Enabled) {BE0ED752-0A0B-3FFF-80EC-B2269063014C}
==================== Installed Programs ======================
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Acer Arcade Deluxe (HKLM-x32\…\InstallShield_{2637C347-9DAD-11D6-9EA2-00055D0CA761}) (Version: 3.0.7020 - CyberLink Corp.)
Acer Arcade Deluxe (x32 Version: 3.0.7020 - CyberLink Corp.) Hidden
Acer Assist (HKLM-x32\…\Acer Assist) (Version: - Acer Incorporated)
Acer ePower Management (HKLM-x32\…\{3DB0448D-AD82-4923-B305-D001E521A964}) (Version: 4.05.3002 - Acer Incorporated)
Acer eRecovery Management (HKLM-x32\…\{7F811A54-5A09-4579-90E1-C93498E230D9}) (Version: 4.05.3002 - Acer Incorporated)
Acer Games (HKLM-x32\…\WildTangent acer Master Uninstall) (Version: 1.0.0.80 - WildTangent)
Acer GridVista (HKLM-x32\…\GridVista) (Version: 3.01.0730 - Acer Inc.)
Acer Registration (HKLM-x32\…\Acer Registration) (Version: 1.02.3004 - Acer Incorporated)
Acer ScreenSaver (HKLM-x32\…\Acer Screensaver) (Version: 1.02.0804 - Acer Incorporated)
Acer Updater (HKLM-x32\…\{EE171732-BEB4-4576-887D-CB62727F01CA}) (Version: 1.01.3014 - Acer Incorporated)
Acrobat.com (HKLM-x32\…\{287ECFA4-719A-2143-A09B-D6A12DE54E40}) (Version: 1.6.65 - Adobe Systems Incorporated)
Adobe AIR (HKLM-x32\…\Adobe AIR) (Version: 21.0.0.215 - Adobe Systems Incorporated)
Adobe Flash Media Live Encoder 3.2 (HKLM-x32\…\{0659E943-DDF4-44FC-9FEE-A13B09F8BB08}) (Version: 3.2.0 - Adobe Systems Incorporated)
Adobe Flash Player 21 ActiveX (HKLM-x32\…\Adobe Flash Player ActiveX) (Version: 21.0.0.242 - Adobe Systems Incorporated)
Adobe Reader 9.3.1 MUI (HKLM-x32\…\{AC76BA86-7AD7-FFFF-7B44-A91000000001}) (Version: 9.3.1 - Adobe Systems Incorporated)
ALPS Touch Pad Driver (HKLM\…\{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}) (Version: Version 7.102.2002.208 - Alps Electric)
Apple Application Support (32-bit) (HKLM-x32\…\{29DB9165-5FC1-48F0-9188-26123F526848}) (Version: 5.0.1 - Apple Inc.)
Apple Application Support (64-bit) (HKLM\…\{5905C8CF-1C88-4478-A48E-4E458AD1BC7E}) (Version: 5.0.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\…\{2EF5D87E-B7BD-458F-8428-E4D0B8B4E65C}) (Version: 7.0.0.117 - Apple Inc.)
Apple Software Update (HKLM-x32\…\{FFD1F7F1-1AC9-4BC4-A908-0686D635ABAF}) (Version: 2.1.4.131 - Apple Inc.)
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (HKLM-x32\…\{3108C217-BE83-42E4-AE9E-A56A2A92E549}) (Version: 1.0.0.10 - Atheros Communications Inc.)
ATI Catalyst Install Manager (HKLM\…\{ACCA82EB-7088-919E-5E1C-100A24F11CCF}) (Version: 3.0.732.0 - ATI Technologies, Inc.)
Bejeweled (x32 Version: 2.2.0.82 - WildTangent) Hidden
Bonjour (HKLM\…\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
ccc-core-static (x32 Version: 2009.0729.2227.38498 - ATI) Hidden
Compatibility Pack for the 2007 Office system (HKLM-x32\…\{90120000-0020-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
eBay Worldwide (HKLM-x32\…\{AAF89271-2594-468D-B578-96B2E30C41C4}) (Version: 2.1.0703 - OEM)
eSobi v2 (HKLM-x32\…\InstallShield_{15D967B5-A4BE-42AE-9E84-64CD062B25AA}) (Version: 2.0.4.000274 - esobi Inc.)
eSobi v2 (x32 Version: 2.0.4.000274 - esobi Inc.) Hidden
Google Chrome (HKLM-x32\…\Google Chrome) (Version: 54.0.2840.99 - Google Inc.)
Google Toolbar for Internet Explorer (HKLM-x32\…\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.4601.54 - Google Inc.)
Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.22.3 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.31.5 - Google Inc.) Hidden
Haali Media Splitter (HKLM-x32\…\HaaliMkx) (Version: - )
iCloud (HKLM\…\{EAFB2AD8-D92B-464C-8D97-B9CB94703C4A}) (Version: 3.0.2.163 - Apple Inc.)
Identity Card (HKLM-x32\…\Identity Card) (Version: 1.00.3001 - Acer Incorporated)
iTunes (HKLM\…\{A535111D-95C8-487F-869E-CE4C239972D2}) (Version: 11.1.1.11 - Apple Inc.)
Java(TM) 6 Update 23 (HKLM-x32\…\{26A24AE4-039D-4CA4-87B4-2F83216023FF}) (Version: 6.0.230 - Oracle)
Java(TM) 6 Update 3 (HKLM-x32\…\{3248F0A8-6813-11D6-A77B-00B0D0160030}) (Version: 1.6.0.30 - Sun Microsystems, Inc.)
Jewel Quest (x32 Version: 2.2.0.82 - WildTangent) Hidden
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Launch Manager (HKLM-x32\…\LManager) (Version: 3.0.00 - Acer Inc.)
McAfee WebAdvisor (HKLM-x32\…\{35ED3F83-4BDC-4c44-8EC6-6A8301C7413A}) (Version: 4.0.228 - McAfee, Inc.)
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Messenger Companion (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile (HKLM\…\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\…\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\…\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
Microsoft Office Enterprise 2007 (HKLM-x32\…\ENTERPRISE) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (HKLM-x32\…\HOMESTUDENTR) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Outlook Connector (HKLM-x32\…\{95140000-007A-0409-0000-0000000FF1CE}) (Version: 14.0.5118.5000 - Microsoft Corporation)
Microsoft Office PowerPoint Viewer 2007 (English) (HKLM-x32\…\{95120000-00AF-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Suite Activation Assistant (HKLM-x32\…\{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}) (Version: 2.9 - Microsoft Corporation)
Microsoft Silverlight (HKLM\…\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\…\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\…\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM-x32\…\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\…\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\…\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\…\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\…\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\…\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (HKLM\…\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319 (HKLM-x32\…\{196BB40D-1578-3D01-B289-BEFC77A11A1E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\…\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\…\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Works (HKLM-x32\…\{67E03279-F703-408F-B4BF-46B5FC8D70CD}) (Version: 9.7.0621 - Microsoft Corporation)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\…\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\…\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MyWinLocker (HKLM-x32\…\{68301905-2DEA-41CE-A4D4-E8B443B099BA}) (Version: 3.1.72.0 - Egis Technology Inc.)
Norton Online Backup (HKLM-x32\…\{40A66DF6-22D3-44B5-A7D3-83B118A2C0DC}) (Version: 2.5.0.85 - Symantec Corporation)
NTI Backup Now 5 (HKLM-x32\…\InstallShield_{12EFA1A4-AC3B-443C-8143-237EDE760403}) (Version: 5.1.2.627 - NewTech Infosystems)
NTI Backup Now Standard (x32 Version: 5.1.2.627 - NewTech Infosystems) Hidden
NTI Media Maker 8 (HKLM-x32\…\InstallShield_{2413930C-8309-47A6-BC61-5EF27A4222BC}) (Version: 8.0.12.6619 - NewTech Infosystems)
NTI Media Maker 8 (x32 Version: 8.0.12.6619 - NewTech Infosystems) Hidden
OBS Studio (HKLM-x32\…\OBS Studio) (Version: 0.16.6 - OBS Project)
Photo Story 3 for Windows (HKLM-x32\…\{4F41AD68-89F2-4262-A32C-2F70B01FCE9E}) (Version: 3.0.1115.11 - Microsoft Corporation)
PlayOn (HKLM-x32\…\{439358C2-DB31-41A9-8F60-5ED24C09D4D8}) (Version: 3.6.35 - MediaMall Technologies, Inc.)
QuickTime 7 (HKLM-x32\…\{FF59BD75-466A-4D5A-AD23-AAD87C5FD44C}) (Version: 7.79.80.95 - Apple Inc.)
RadioBOSS 5.0.0.9 (HKLM-x32\…\RadioBOSS) (Version: 5.0.0.9 - DJSoft.Net)
Realtek High Definition Audio Driver (HKLM-x32\…\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5904 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Card Reader (HKLM-x32\…\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.7600.30102 - Realtek Semiconductor Corp.)
Safari (HKLM-x32\…\{C779648B-410E-4BBA-B75B-5815BCEFE71D}) (Version: 5.34.57.2 - Apple Inc.)
Skype Toolbars (HKLM-x32\…\{981029E0-7FC9-4CF3-AB39-6F133621921A}) (Version: 1.0.4051 - Skype Technologies S.A.)
Skype™ 7.28 (HKLM-x32\…\{FC965A47-4839-40CA-B618-18F486F042C6}) (Version: 7.28.101 - Skype Technologies S.A.)
SPSS 11.0.1 for Windows (HKLM-x32\…\SPSS for Windows 11.0) (Version: - )
The Youth Assistant Special Edition (HKLM-x32\…\The Youth Assistant Special Edition) (Version: - )
UNO Undercover (x32 Version: 2.2.0.87 - WildTangent) Hidden
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\…\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\…\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
VLC media player (HKLM-x32\…\VLC media player) (Version: 2.2.3 - VideoLAN)
vMix (HKLM-x32\…\{93D664E9-E81E-4277-9E90-6CDABAC7208F}_is1) (Version: - StudioCoast)
vMix Social (HKLM-x32\…\{1A0C8557-EB4A-4DD1-B4F9-A974ADEFE05F}_is1) (Version: - StudioCoast Pty Ltd)
Welcome Center (HKLM-x32\…\Acer Welcome Center) (Version: 1.00.3005 - Acer Incorporated)
Windows Live Essentials (HKLM-x32\…\WinLiveSuite) (Version: 15.4.3502.0922 - Microsoft Corporation)
Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\…\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Sync (HKLM-x32\…\{B10914FD-8812-47A4-85A1-50FCDE7F1F33}) (Version: 14.0.8117.416 - Microsoft Corporation)
Wondershare Flash Gallery Factory 4.7.2 trial version (HKLM-x32\…\Wondershare Flash Gallery Factory_is1) (Version: 4.7.2 - Wondershare Software Co.,Ltd.)
Wondershare Flash Gallery Factory Deluxe 5.2.0.9 (HKLM-x32\…\Wondershare Flash Gallery Factory Deluxe_is1) (Version: 5.2.0.9 - Wondershare Software Co.,Ltd.)
==================== Custom CLSID (Whitelisted): ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
CustomCLSID: HKU\S-1-5-21-1265709536-822219978-4185131874-1001_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Sheena\AppData\Roaming\Dropbox\bin\Dropbox.exe /autoplay => No File
==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {18150E1A-1007-4AFF-9DE4-8583275819AD} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2015-08-27] (Apple Inc.)
Task: {1C3C4953-29CF-45AF-82CF-B0EA0569DC83} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-06-11] (Google Inc.)
Task: {2B055669-5C74-4116-93A4-60A7CF4F7B73} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-06-11] (Google Inc.)
Task: {36C11C12-1562-45B6-8529-42925F286860} - System32\Tasks\{BA10AC80-4ABD-451D-A621-B42D6558E721} => D:\Mosports.exe
Task: {66CE7235-2CEB-4159-87F7-9E978ACE9D37} - System32\Tasks\{DC0BC773-F18B-4E2D-90C2-D855F493794A} => D:\Mosports.exe
Task: {8734BAC3-D5C2-4FF5-A0A7-CBB5F0F55164} - System32\Tasks\AVAST Software\Avast settings backup => C:\Program Files\Common Files\AV\avast! Antivirus\backup.exe [2016-06-30] (AVAST Software)
Task: {978B5AC8-4A0C-459E-BEFC-A6DF335931CF} - System32\Tasks\{45E0C4E2-20E9-4D9A-9C61-D61BFF53A501} => C:\Program Files (x86)\Skype\Phone\Skype.exe [2016-09-12] (Skype Technologies S.A.)
Task: {F8E34C72-153B-417E-98E5-AA618A4480B7} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2016-06-29] (Adobe Systems Incorporated)
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
==================== Shortcuts =============================
(The entries could be listed to be restored or removed.)
==================== Loaded Modules (Whitelisted) ==============
2016-06-30 00:26 - 2014-08-06 18:54 - 01004032 _____ () C:\Program Files (x86)\vMix\filters64\vMixVideo.ax
2016-11-24 12:24 - 2016-11-08 17:03 - 02367080 _____ () C:\Program Files (x86)\Google\Chrome\Application\54.0.2840.99\libglesv2.dll
2016-11-24 12:24 - 2016-11-08 17:03 - 00107112 _____ () C:\Program Files (x86)\Google\Chrome\Application\54.0.2840.99\libegl.dll
2016-09-01 18:13 - 2016-09-01 18:13 - 00080184 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2016-09-01 18:13 - 2016-09-01 18:13 - 01041720 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
==================== Alternate Data Streams (Whitelisted) =========
(If an entry is included in the fixlist, only the ADS will be removed.)
AlternateDataStreams: C:\ProgramData\Temp:A7D26093 [123]
==================== Safe Mode (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcmscsvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MCODS => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MpfService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys => ""="Driver"
==================== Association (Whitelisted) ===============
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, it will be removed from the registry.)
==================== Hosts content: ===============================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-13 22:34 - 2009-06-10 17:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-1265709536-822219978-4185131874-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Sheena\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.1.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.
==================== MSCONFIG/TASK MANAGER disabled items ==
==================== FirewallRules (Whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
FirewallRules: [{2976E300-F7C0-48F7-A792-61D6A9CE3A17}] => C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
FirewallRules: [{E61B4D61-FEE7-4076-94A4-2383DF4DF441}] => C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
FirewallRules: [{3B446CDF-A1B0-496E-8310-DF3331CD407C}] => C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
FirewallRules: [{393F48A2-D596-46C3-9D0A-0AF21AD0CBDC}] => C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
FirewallRules: [{95D9AD6E-EE0B-4902-80F1-1BB9D8EAE25D}] => C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\Acer Arcade Deluxe.exe
FirewallRules: [{AEB03DD5-661D-4681-93A1-3021E1BA0987}] => C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PlayMovie.exe
FirewallRules: [{3D633C66-3BBB-481F-9CD0-91C9C1AA0DD0}] => C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe
FirewallRules: [{118D5091-F8A1-4463-B4A4-68FE35D68DB0}] => C:\Program Files (x86)\Acer Arcade Deluxe\HomeMedia\HomeMedia.exe
FirewallRules: [{3E350925-D9A0-4FBA-975D-E9F9D1F0EBC2}] => C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{889B7E91-56F2-4F8C-9C6B-2A6B505A499B}] => C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
FirewallRules: [{CEA2F42F-3637-4819-A1A6-5163000702BC}] => svchost.exe
FirewallRules: [{B823BD40-3F1F-400C-B607-871CBEB8BEEE}] => C:\Program Files (x86)\Windows Live\Sync\WindowsLiveSync.exe
FirewallRules: [{40AEBA1F-C8F8-4D95-B0B0-16FD9F40C7CF}] => C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{6784307F-E494-49F6-8673-4B7D77EC3B62}] => LPort=2869
FirewallRules: [{B9A8CDD4-EF78-40FB-AFE3-E6E3A04DC4C5}] => LPort=1900
FirewallRules: [{F0FF10B9-69F0-4AE1-8B4D-83B87EF66B2C}] => C:\Program Files (x86)\Windows Live\Mesh\MOE.exe
FirewallRules: [{8DDE704B-360B-440E-B4B7-13D21435C558}] => C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{A57E3281-49F4-461C-898E-C5DD250509BE}] => C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{A58AC5ED-B48D-4A32-B924-8D6761A5441D}] => C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{D4E33361-19FD-4735-970A-ABC10B0E09D9}] => C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{B704A57A-0E7F-4324-8CAA-70FF594094CF}] => C:\Program Files (x86)\MediaMall\MediaMallServer.exe
FirewallRules: [{BBC4977C-E1D0-4E0D-9878-7D1B3814B0FA}] => C:\Program Files (x86)\MediaMall\SettingsManager.exe
FirewallRules: [{C23195B3-5B02-44DA-84AB-EBA5E447515B}] => C:\Program Files (x86)\iTunes\iTunes.exe
FirewallRules: [{B6ABB53C-ADC8-4274-8EE6-CDC9F3D8884C}] => C:\Program Files (x86)\vMix\vMix.exe
FirewallRules: [{7252CCA1-7F59-4221-AB1D-92FEF0D56282}] => C:\Program Files (x86)\vMix\vMix64.exe
FirewallRules: [{18C56921-98C9-490A-A33D-7BAE17F042B2}] => C:\Program Files (x86)\vMix\ndi\vMixNDIHelper.exe
FirewallRules: [{5043530F-FBA7-48BC-B0AC-E3ED3B9EEA61}] => C:\Program Files (x86)\vMix\vMixDesktopCapture.exe
FirewallRules: [{D3C9B908-7B46-4075-A6E1-B84D4C90195D}] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
==================== Restore Points =========================
30-06-2016 00:36:19 Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501
30-06-2016 00:54:21 Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501
30-06-2016 07:03:49 Removed Bonjour
24-11-2016 07:11:24 Windows Backup
24-11-2016 07:36:01 Installed Adobe Flash Media Live Encoder 3.2.
25-11-2016 08:59:33 Windows Update
10-02-2017 21:07:07 Windows Backup
==================== Faulty Device Manager Devices =============
StephenL
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 11-02-2017 01
Ran by [removed] (11-02-2017 14:09:03)
Running from C:\Users\[removed]\Desktop
Windows 7 Home Premium Service Pack 1 (X64) (2009-12-14 16:10:34)
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
Administrator (S-1-5-21-1265709536-822219978-4185131874-500 - Administrator - Disabled)
family (S-1-5-21-1265709536-822219978-4185131874-1003 - Limited - Enabled) => C:\Users\family
Guest (S-1-5-21-1265709536-822219978-4185131874-501 - Limited - Enabled) => C:\Users\Guest
HomeGroupUser$ (S-1-5-21-1265709536-822219978-4185131874-1002 - Limited - Enabled)
Sheena (S-1-5-21-1265709536-822219978-4185131874-1001 - Administrator - Enabled) => C:\Users\Sheena
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AS: Windows Defender (Enabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: McAfee Personal Firewall (Enabled) {BE0ED752-0A0B-3FFF-80EC-B2269063014C}
==================== Installed Programs ======================
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Acer Arcade Deluxe (HKLM-x32\…\InstallShield_{2637C347-9DAD-11D6-9EA2-00055D0CA761}) (Version: 3.0.7020 - CyberLink Corp.)
Acer Arcade Deluxe (x32 Version: 3.0.7020 - CyberLink Corp.) Hidden
Acer Assist (HKLM-x32\…\Acer Assist) (Version: - Acer Incorporated)
Acer ePower Management (HKLM-x32\…\{3DB0448D-AD82-4923-B305-D001E521A964}) (Version: 4.05.3002 - Acer Incorporated)
Acer eRecovery Management (HKLM-x32\…\{7F811A54-5A09-4579-90E1-C93498E230D9}) (Version: 4.05.3002 - Acer Incorporated)
Acer Games (HKLM-x32\…\WildTangent acer Master Uninstall) (Version: 1.0.0.80 - WildTangent)
Acer GridVista (HKLM-x32\…\GridVista) (Version: 3.01.0730 - Acer Inc.)
Acer Registration (HKLM-x32\…\Acer Registration) (Version: 1.02.3004 - Acer Incorporated)
Acer ScreenSaver (HKLM-x32\…\Acer Screensaver) (Version: 1.02.0804 - Acer Incorporated)
Acer Updater (HKLM-x32\…\{EE171732-BEB4-4576-887D-CB62727F01CA}) (Version: 1.01.3014 - Acer Incorporated)
Acrobat.com (HKLM-x32\…\{287ECFA4-719A-2143-A09B-D6A12DE54E40}) (Version: 1.6.65 - Adobe Systems Incorporated)
Adobe AIR (HKLM-x32\…\Adobe AIR) (Version: 21.0.0.215 - Adobe Systems Incorporated)
Adobe Flash Media Live Encoder 3.2 (HKLM-x32\…\{0659E943-DDF4-44FC-9FEE-A13B09F8BB08}) (Version: 3.2.0 - Adobe Systems Incorporated)
Adobe Flash Player 21 ActiveX (HKLM-x32\…\Adobe Flash Player ActiveX) (Version: 21.0.0.242 - Adobe Systems Incorporated)
Adobe Reader 9.3.1 MUI (HKLM-x32\…\{AC76BA86-7AD7-FFFF-7B44-A91000000001}) (Version: 9.3.1 - Adobe Systems Incorporated)
ALPS Touch Pad Driver (HKLM\…\{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}) (Version: Version 7.102.2002.208 - Alps Electric)
Apple Application Support (32-bit) (HKLM-x32\…\{29DB9165-5FC1-48F0-9188-26123F526848}) (Version: 5.0.1 - Apple Inc.)
Apple Application Support (64-bit) (HKLM\…\{5905C8CF-1C88-4478-A48E-4E458AD1BC7E}) (Version: 5.0.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\…\{2EF5D87E-B7BD-458F-8428-E4D0B8B4E65C}) (Version: 7.0.0.117 - Apple Inc.)
Apple Software Update (HKLM-x32\…\{FFD1F7F1-1AC9-4BC4-A908-0686D635ABAF}) (Version: 2.1.4.131 - Apple Inc.)
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (HKLM-x32\…\{3108C217-BE83-42E4-AE9E-A56A2A92E549}) (Version: 1.0.0.10 - Atheros Communications Inc.)
ATI Catalyst Install Manager (HKLM\…\{ACCA82EB-7088-919E-5E1C-100A24F11CCF}) (Version: 3.0.732.0 - ATI Technologies, Inc.)
Bejeweled (x32 Version: 2.2.0.82 - WildTangent) Hidden
Bonjour (HKLM\…\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
ccc-core-static (x32 Version: 2009.0729.2227.38498 - ATI) Hidden
Compatibility Pack for the 2007 Office system (HKLM-x32\…\{90120000-0020-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
eBay Worldwide (HKLM-x32\…\{AAF89271-2594-468D-B578-96B2E30C41C4}) (Version: 2.1.0703 - OEM)
eSobi v2 (HKLM-x32\…\InstallShield_{15D967B5-A4BE-42AE-9E84-64CD062B25AA}) (Version: 2.0.4.000274 - esobi Inc.)
eSobi v2 (x32 Version: 2.0.4.000274 - esobi Inc.) Hidden
Google Chrome (HKLM-x32\…\Google Chrome) (Version: 54.0.2840.99 - Google Inc.)
Google Toolbar for Internet Explorer (HKLM-x32\…\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.4601.54 - Google Inc.)
Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.22.3 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.31.5 - Google Inc.) Hidden
Haali Media Splitter (HKLM-x32\…\HaaliMkx) (Version: - )
iCloud (HKLM\…\{EAFB2AD8-D92B-464C-8D97-B9CB94703C4A}) (Version: 3.0.2.163 - Apple Inc.)
Identity Card (HKLM-x32\…\Identity Card) (Version: 1.00.3001 - Acer Incorporated)
iTunes (HKLM\…\{A535111D-95C8-487F-869E-CE4C239972D2}) (Version: 11.1.1.11 - Apple Inc.)
Java(TM) 6 Update 23 (HKLM-x32\…\{26A24AE4-039D-4CA4-87B4-2F83216023FF}) (Version: 6.0.230 - Oracle)
Java(TM) 6 Update 3 (HKLM-x32\…\{3248F0A8-6813-11D6-A77B-00B0D0160030}) (Version: 1.6.0.30 - Sun Microsystems, Inc.)
Jewel Quest (x32 Version: 2.2.0.82 - WildTangent) Hidden
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Launch Manager (HKLM-x32\…\LManager) (Version: 3.0.00 - Acer Inc.)
McAfee WebAdvisor (HKLM-x32\…\{35ED3F83-4BDC-4c44-8EC6-6A8301C7413A}) (Version: 4.0.228 - McAfee, Inc.)
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Messenger Companion (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile (HKLM\…\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\…\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\…\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
Microsoft Office Enterprise 2007 (HKLM-x32\…\ENTERPRISE) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (HKLM-x32\…\HOMESTUDENTR) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Outlook Connector (HKLM-x32\…\{95140000-007A-0409-0000-0000000FF1CE}) (Version: 14.0.5118.5000 - Microsoft Corporation)
Microsoft Office PowerPoint Viewer 2007 (English) (HKLM-x32\…\{95120000-00AF-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Suite Activation Assistant (HKLM-x32\…\{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}) (Version: 2.9 - Microsoft Corporation)
Microsoft Silverlight (HKLM\…\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\…\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\…\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM-x32\…\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\…\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\…\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\…\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\…\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\…\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (HKLM\…\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319 (HKLM-x32\…\{196BB40D-1578-3D01-B289-BEFC77A11A1E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\…\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\…\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Works (HKLM-x32\…\{67E03279-F703-408F-B4BF-46B5FC8D70CD}) (Version: 9.7.0621 - Microsoft Corporation)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\…\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\…\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MyWinLocker (HKLM-x32\…\{68301905-2DEA-41CE-A4D4-E8B443B099BA}) (Version: 3.1.72.0 - Egis Technology Inc.)
Norton Online Backup (HKLM-x32\…\{40A66DF6-22D3-44B5-A7D3-83B118A2C0DC}) (Version: 2.5.0.85 - Symantec Corporation)
NTI Backup Now 5 (HKLM-x32\…\InstallShield_{12EFA1A4-AC3B-443C-8143-237EDE760403}) (Version: 5.1.2.627 - NewTech Infosystems)
NTI Backup Now Standard (x32 Version: 5.1.2.627 - NewTech Infosystems) Hidden
NTI Media Maker 8 (HKLM-x32\…\InstallShield_{2413930C-8309-47A6-BC61-5EF27A4222BC}) (Version: 8.0.12.6619 - NewTech Infosystems)
NTI Media Maker 8 (x32 Version: 8.0.12.6619 - NewTech Infosystems) Hidden
OBS Studio (HKLM-x32\…\OBS Studio) (Version: 0.16.6 - OBS Project)
Photo Story 3 for Windows (HKLM-x32\…\{4F41AD68-89F2-4262-A32C-2F70B01FCE9E}) (Version: 3.0.1115.11 - Microsoft Corporation)
PlayOn (HKLM-x32\…\{439358C2-DB31-41A9-8F60-5ED24C09D4D8}) (Version: 3.6.35 - MediaMall Technologies, Inc.)
QuickTime 7 (HKLM-x32\…\{FF59BD75-466A-4D5A-AD23-AAD87C5FD44C}) (Version: 7.79.80.95 - Apple Inc.)
RadioBOSS 5.0.0.9 (HKLM-x32\…\RadioBOSS) (Version: 5.0.0.9 - DJSoft.Net)
Realtek High Definition Audio Driver (HKLM-x32\…\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5904 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Card Reader (HKLM-x32\…\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.7600.30102 - Realtek Semiconductor Corp.)
Safari (HKLM-x32\…\{C779648B-410E-4BBA-B75B-5815BCEFE71D}) (Version: 5.34.57.2 - Apple Inc.)
Skype Toolbars (HKLM-x32\…\{981029E0-7FC9-4CF3-AB39-6F133621921A}) (Version: 1.0.4051 - Skype Technologies S.A.)
Skype™ 7.28 (HKLM-x32\…\{FC965A47-4839-40CA-B618-18F486F042C6}) (Version: 7.28.101 - Skype Technologies S.A.)
SPSS 11.0.1 for Windows (HKLM-x32\…\SPSS for Windows 11.0) (Version: - )
The Youth Assistant Special Edition (HKLM-x32\…\The Youth Assistant Special Edition) (Version: - )
UNO Undercover (x32 Version: 2.2.0.87 - WildTangent) Hidden
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\…\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\…\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
VLC media player (HKLM-x32\…\VLC media player) (Version: 2.2.3 - VideoLAN)
vMix (HKLM-x32\…\{93D664E9-E81E-4277-9E90-6CDABAC7208F}_is1) (Version: - StudioCoast)
vMix Social (HKLM-x32\…\{1A0C8557-EB4A-4DD1-B4F9-A974ADEFE05F}_is1) (Version: - StudioCoast Pty Ltd)
Welcome Center (HKLM-x32\…\Acer Welcome Center) (Version: 1.00.3005 - Acer Incorporated)
Windows Live Essentials (HKLM-x32\…\WinLiveSuite) (Version: 15.4.3502.0922 - Microsoft Corporation)
Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\…\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Sync (HKLM-x32\…\{B10914FD-8812-47A4-85A1-50FCDE7F1F33}) (Version: 14.0.8117.416 - Microsoft Corporation)
Wondershare Flash Gallery Factory 4.7.2 trial version (HKLM-x32\…\Wondershare Flash Gallery Factory_is1) (Version: 4.7.2 - Wondershare Software Co.,Ltd.)
Wondershare Flash Gallery Factory Deluxe 5.2.0.9 (HKLM-x32\…\Wondershare Flash Gallery Factory Deluxe_is1) (Version: 5.2.0.9 - Wondershare Software Co.,Ltd.)
==================== Custom CLSID (Whitelisted): ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
CustomCLSID: HKU\S-1-5-21-1265709536-822219978-4185131874-1001_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Sheena\AppData\Roaming\Dropbox\bin\Dropbox.exe /autoplay => No File
==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {18150E1A-1007-4AFF-9DE4-8583275819AD} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2015-08-27] (Apple Inc.)
Task: {1C3C4953-29CF-45AF-82CF-B0EA0569DC83} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-06-11] (Google Inc.)
Task: {2B055669-5C74-4116-93A4-60A7CF4F7B73} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-06-11] (Google Inc.)
Task: {36C11C12-1562-45B6-8529-42925F286860} - System32\Tasks\{BA10AC80-4ABD-451D-A621-B42D6558E721} => D:\Mosports.exe
Task: {66CE7235-2CEB-4159-87F7-9E978ACE9D37} - System32\Tasks\{DC0BC773-F18B-4E2D-90C2-D855F493794A} => D:\Mosports.exe
Task: {8734BAC3-D5C2-4FF5-A0A7-CBB5F0F55164} - System32\Tasks\AVAST Software\Avast settings backup => C:\Program Files\Common Files\AV\avast! Antivirus\backup.exe [2016-06-30] (AVAST Software)
Task: {978B5AC8-4A0C-459E-BEFC-A6DF335931CF} - System32\Tasks\{45E0C4E2-20E9-4D9A-9C61-D61BFF53A501} => C:\Program Files (x86)\Skype\Phone\Skype.exe [2016-09-12] (Skype Technologies S.A.)
Task: {F8E34C72-153B-417E-98E5-AA618A4480B7} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2016-06-29] (Adobe Systems Incorporated)
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
==================== Shortcuts =============================
(The entries could be listed to be restored or removed.)
==================== Loaded Modules (Whitelisted) ==============
2016-06-30 00:26 - 2014-08-06 18:54 - 01004032 _____ () C:\Program Files (x86)\vMix\filters64\vMixVideo.ax
2016-11-24 12:24 - 2016-11-08 17:03 - 02367080 _____ () C:\Program Files (x86)\Google\Chrome\Application\54.0.2840.99\libglesv2.dll
2016-11-24 12:24 - 2016-11-08 17:03 - 00107112 _____ () C:\Program Files (x86)\Google\Chrome\Application\54.0.2840.99\libegl.dll
2016-09-01 18:13 - 2016-09-01 18:13 - 00080184 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2016-09-01 18:13 - 2016-09-01 18:13 - 01041720 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
==================== Alternate Data Streams (Whitelisted) =========
(If an entry is included in the fixlist, only the ADS will be removed.)
AlternateDataStreams: C:\ProgramData\Temp:A7D26093 [123]
==================== Safe Mode (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcmscsvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MCODS => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MpfService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys => ""="Driver"
==================== Association (Whitelisted) ===============
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, it will be removed from the registry.)
==================== Hosts content: ===============================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-13 22:34 - 2009-06-10 17:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-1265709536-822219978-4185131874-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Sheena\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.1.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.
==================== MSCONFIG/TASK MANAGER disabled items ==
==================== FirewallRules (Whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
FirewallRules: [{2976E300-F7C0-48F7-A792-61D6A9CE3A17}] => C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
FirewallRules: [{E61B4D61-FEE7-4076-94A4-2383DF4DF441}] => C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
FirewallRules: [{3B446CDF-A1B0-496E-8310-DF3331CD407C}] => C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
FirewallRules: [{393F48A2-D596-46C3-9D0A-0AF21AD0CBDC}] => C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
FirewallRules: [{95D9AD6E-EE0B-4902-80F1-1BB9D8EAE25D}] => C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\Acer Arcade Deluxe.exe
FirewallRules: [{AEB03DD5-661D-4681-93A1-3021E1BA0987}] => C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PlayMovie.exe
FirewallRules: [{3D633C66-3BBB-481F-9CD0-91C9C1AA0DD0}] => C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe
FirewallRules: [{118D5091-F8A1-4463-B4A4-68FE35D68DB0}] => C:\Program Files (x86)\Acer Arcade Deluxe\HomeMedia\HomeMedia.exe
FirewallRules: [{3E350925-D9A0-4FBA-975D-E9F9D1F0EBC2}] => C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{889B7E91-56F2-4F8C-9C6B-2A6B505A499B}] => C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
FirewallRules: [{CEA2F42F-3637-4819-A1A6-5163000702BC}] => svchost.exe
FirewallRules: [{B823BD40-3F1F-400C-B607-871CBEB8BEEE}] => C:\Program Files (x86)\Windows Live\Sync\WindowsLiveSync.exe
FirewallRules: [{40AEBA1F-C8F8-4D95-B0B0-16FD9F40C7CF}] => C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{6784307F-E494-49F6-8673-4B7D77EC3B62}] => LPort=2869
FirewallRules: [{B9A8CDD4-EF78-40FB-AFE3-E6E3A04DC4C5}] => LPort=1900
FirewallRules: [{F0FF10B9-69F0-4AE1-8B4D-83B87EF66B2C}] => C:\Program Files (x86)\Windows Live\Mesh\MOE.exe
FirewallRules: [{8DDE704B-360B-440E-B4B7-13D21435C558}] => C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{A57E3281-49F4-461C-898E-C5DD250509BE}] => C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{A58AC5ED-B48D-4A32-B924-8D6761A5441D}] => C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{D4E33361-19FD-4735-970A-ABC10B0E09D9}] => C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{B704A57A-0E7F-4324-8CAA-70FF594094CF}] => C:\Program Files (x86)\MediaMall\MediaMallServer.exe
FirewallRules: [{BBC4977C-E1D0-4E0D-9878-7D1B3814B0FA}] => C:\Program Files (x86)\MediaMall\SettingsManager.exe
FirewallRules: [{C23195B3-5B02-44DA-84AB-EBA5E447515B}] => C:\Program Files (x86)\iTunes\iTunes.exe
FirewallRules: [{B6ABB53C-ADC8-4274-8EE6-CDC9F3D8884C}] => C:\Program Files (x86)\vMix\vMix.exe
FirewallRules: [{7252CCA1-7F59-4221-AB1D-92FEF0D56282}] => C:\Program Files (x86)\vMix\vMix64.exe
FirewallRules: [{18C56921-98C9-490A-A33D-7BAE17F042B2}] => C:\Program Files (x86)\vMix\ndi\vMixNDIHelper.exe
FirewallRules: [{5043530F-FBA7-48BC-B0AC-E3ED3B9EEA61}] => C:\Program Files (x86)\vMix\vMixDesktopCapture.exe
FirewallRules: [{D3C9B908-7B46-4075-A6E1-B84D4C90195D}] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
==================== Restore Points =========================
30-06-2016 00:36:19 Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501
30-06-2016 00:54:21 Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501
30-06-2016 07:03:49 Removed Bonjour
24-11-2016 07:11:24 Windows Backup
24-11-2016 07:36:01 Installed Adobe Flash Media Live Encoder 3.2.
25-11-2016 08:59:33 Windows Update
10-02-2017 21:07:07 Windows Backup
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (02/11/2017 01:46:29 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program Explorer.EXE version 6.1.7601.17567 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.
Process ID: 994
Start Time: 01d2840c58aea29f
Termination Time: 0
Application Path: C:\Windows\Explorer.EXE
Report Id:
Error: (02/11/2017 11:35:41 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 31372
Error: (02/11/2017 11:35:41 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 31372
Error: (02/11/2017 11:35:41 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (02/11/2017 11:35:26 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 15709
Error: (02/11/2017 11:35:26 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 15709
Error: (02/11/2017 11:35:26 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (02/11/2017 02:38:43 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 1154
Error: (02/11/2017 02:38:43 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 1154
Error: (02/11/2017 02:38:43 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
System errors:
=============
Error: (02/11/2017 01:41:00 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the ShellHWDetection service.
Error: (02/11/2017 01:12:33 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the ShellHWDetection service.
Error: (02/11/2017 01:11:02 PM) (Source: atikmdag) (EventID: 10261) (User: )
Description: Display is not active
Error: (02/11/2017 01:11:01 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the ShellHWDetection service.
Error: (02/11/2017 11:34:55 AM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the iphlpsvc service.
Error: (02/11/2017 10:12:02 AM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the ShellHWDetection service.
Error: (02/11/2017 10:01:31 AM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the ShellHWDetection service.
Error: (02/11/2017 07:37:17 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Multimedia Class Scheduler service failed to start due to the following error:
The service did not respond to the start or control request in a timely fashion.
Error: (02/11/2017 07:37:17 AM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the MMCSS service.
Error: (02/11/2017 06:59:03 AM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the iphlpsvc service.
CodeIntegrity:
===================================
Date: 2016-09-24 20:16:42.229
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files (x86)\McAfee\SiteAdvisor\x64\mfesapsn.sys because the set of per-page image hashes could not be found on the system.
Date: 2016-09-24 20:14:32.456
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\aswKbd.sys because the set of per-page image hashes could not be found on the system.
Date: 2016-09-24 20:14:32.331
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\aswSnx.sys because the set of per-page image hashes could not be found on the system.
Date: 2016-08-16 23:22:55.641
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files (x86)\McAfee\SiteAdvisor\x64\mfesapsn.sys because the set of per-page image hashes could not be found on the system.
Date: 2016-08-16 23:20:55.003
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\aswKbd.sys because the set of per-page image hashes could not be found on the system.
Date: 2016-08-16 23:20:54.457
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\aswSnx.sys because the set of per-page image hashes could not be found on the system.
Date: 2016-08-16 12:10:55.899
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files (x86)\McAfee\SiteAdvisor\x64\mfesapsn.sys because the set of per-page image hashes could not be found on the system.
Date: 2016-08-16 12:08:23.284
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\aswKbd.sys because the set of per-page image hashes could not be found on the system.
Date: 2016-08-16 12:08:22.473
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\aswSnx.sys because the set of per-page image hashes could not be found on the system.
Date: 2016-08-16 11:38:37.210
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files (x86)\McAfee\SiteAdvisor\x64\mfesapsn.sys because the set of per-page image hashes could not be found on the system.
==================== Memory info ===========================
Processor: AMD Athlonâ„¢ Processor TF-20
Percentage of memory in use: 63%
Total physical RAM: 2812.05 MB
Available physical RAM: 1022.81 MB
Total Virtual: 5622.28 MB
Available Virtual: 2383.66 MB
==================== Drives ================================
Drive c: (Acer) (Fixed) (Total:136.95 GB) (Free:65.95 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 149.1 GB) (Disk ID: 99D95CA4)
Partition 1: (Not Active) - (Size=12 GB) - (Type=27)
Partition 2: (Active) - (Size=102 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=136.9 GB) - (Type=07 NTFS)
==================== End of Addition.txt ============================
ken545
Hello,
Looking at some malware from conduit and popcaploader, lets do this
All our tools and scanners work more efficiently when run from the DESKTOP in lieu of being buried in some folder, so download and run these tools right from the DESKTOP
-AdwCleaner-by Xplode
Click on this link to download : ADWCleaner TO YOUR DESKTOP
Use my link only, do not do a search for AdwCleaner as there is a bogus copy going around by scammers
[external image: AdwCleaner4.201_zpsxrbk2llq.jpg]
- Close all open programs and internet browsers.
- Double click on AdwCleaner.exe to run the tool.
- Click on Scan.
- After the scan is complete click on "Clean"
- Confirm each time with Ok.
- Your computer will be rebooted automatically. A text file will open after the restart.
- Please post the content of that logfile with your next reply.
- You can find the logfile at C:\AdwCleaner[S1].txt as well.
===============================================================================
[external image: Capture_zpsge1t2tk9.jpg] Please download Junkware Removal Tool TO YOUR DESKTOP
- Download the one from Bleeping Computer
- Shut down your protection software now to avoid potential conflicts.
- Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
- The tool will open and start scanning your system.
- Please be patient as this can take a while to complete depending on your system's specifications.
- On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
- Post the contents of JRT.txt into your next message.
===============================================================================
Download Malwarebytes' Anti-Malware TO YOUR DESKTOP
- Windows XP : Double click on the icon to run it.
- Windows Vista, Windows 7 , 8, 8.1 and 10 : Right click and select "Run as Administrator"
[external image: MBAM305Good_zps6urblsu9.jpg]
- On the Dashboard click on Update Now
- Go to the Setting Tab
- Under Setting go to Detection and Protection
- Under PUP and PUM make sure both are set to show Treat Detections as Malware
- Go to Advanced setting and make sure Automatically Quarantine Detected Items is checked
- Then on the Dashboard click on Scan
- Make sure to select THREAT SCAN
- Then click on Scan
- When the scan is finished on the bottom right click on SAVE RESULTS then select Copy to Clipboard
- Please paste the log back into this thread for review
- Exit Malwarebytes
StephenL
Hi ken, after running Malwarebytes,. do I click the "Quarantine selected" button?
StephenL
# AdwCleaner v6.043 - Logfile created 11/02/2017 at 20:34:55
# Updated on 27/01/2017 by Malwarebytes
# Database : 2017-01-27.1 [Local]
# Operating System : Windows 7 Home Premium Service Pack 1 (X64)
# Username : Sheena - SHEENA-PC
# Running from : C:\Users\Sheena\Desktop\AdwCleaner.exe
# Mode: Clean
# Support : https://www.malwarebytes.com/support
***** [ Services ] *****
***** [ Folders ] *****
[-] Folder deleted: C:\Users\Sheena\AppData\Local\Conduit
[-] Folder deleted: C:\Users\Sheena\AppData\LocalLow\Conduit
[-] Folder deleted: C:\Users\Sheena\AppData\LocalLow\ConduitEngine
[-] Folder deleted: C:\Users\Sheena\AppData\LocalLow\PriceGong
[-] Folder deleted: C:\Users\family\AppData\LocalLow\Conduit
[-] Folder deleted: C:\Users\family\AppData\LocalLow\ConduitEngine
[-] Folder deleted: C:\Users\family\AppData\LocalLow\PriceGong
[-] Folder deleted: C:\Users\Guest\AppData\LocalLow\Conduit
[-] Folder deleted: C:\Users\Guest\AppData\LocalLow\ConduitEngine
[-] Folder deleted: C:\ProgramData\Partner
[#] Folder deleted on reboot: C:\ProgramData\Application Data\Partner
[-] Folder deleted: C:\Program Files (x86)\Conduit
***** [ Files ] *****
[-] File deleted: C:\Users\Public\Desktop\eBay.lnk
[-] File deleted: C:\Windows\Downloaded Program Files\popcaploader.inf
[-] File deleted: C:\Windows\SysWOW64\conduitEngine.tmp
***** [ DLL ] *****
***** [ WMI ] *****
***** [ Shortcuts ] *****
***** [ Scheduled Tasks ] *****
***** [ Registry ] *****
[-] Key deleted: HKLM\SOFTWARE\Classes\Toolbar.CT2765711
[-] Key deleted: HKLM\SOFTWARE\Classes\Conduit.Engine
[-] Key deleted: HKLM\SOFTWARE\Classes\PopCapLoader.PopCapLoaderCtrl2
[-] Key deleted: HKLM\SOFTWARE\Classes\PopCapLoader.PopCapLoaderCtrl2.1
[-] Key deleted: HKLM\SOFTWARE\Classes\protector_dll.Protector
[-] Key deleted: HKLM\SOFTWARE\Classes\protector_dll.Protector.1
[-] Key deleted: HKLM\SOFTWARE\Classes\protector_dll.ProtectorBho
[-] Key deleted: HKLM\SOFTWARE\Classes\protector_dll.ProtectorBho.1
[-] Key deleted: HKLM\SOFTWARE\Classes\protector_dll.ProtectorLib
[-] Key deleted: HKLM\SOFTWARE\Classes\protector_dll.ProtectorLib.1
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\Conduit.Engine
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\PopCapLoader.PopCapLoaderCtrl2
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\PopCapLoader.PopCapLoaderCtrl2.1
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\protector_dll.Protector
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\protector_dll.Protector.1
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\protector_dll.ProtectorBho
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\protector_dll.ProtectorBho.1
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\protector_dll.ProtectorLib
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\protector_dll.ProtectorLib.1
[-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
[-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{DF780F87-FF2B-4DF8-92D0-73DB16A1543A}
[-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{E4E3E0F8-CD30-4380-8CE9-B96904BDEFCA}
[-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{FE8A736F-4124-4D9C-B4B1-3B12381EFABE}
[-] Key deleted: HKLM\SOFTWARE\Classes\TypeLib\{C9C5DEAF-0A1F-4660-8279-9EDFAD6FEFE1}
[-] Key deleted: HKLM\SOFTWARE\Classes\TypeLib\{E69D4A59-73DE-4E38-9FB3-740EC4D9060D}
[-] Key deleted: HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{DF780F87-FF2B-4DF8-92D0-73DB16A1543A}
[-] Key deleted: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}
[-] Key deleted: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{30F9B915-B755-4826-820B-08FBA6BD249D}
[-] Key deleted: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DF780F87-FF2B-4DF8-92D0-73DB16A1543A}
[-] Key deleted: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}
[-] Key deleted: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{DF780F87-FF2B-4DF8-92D0-73DB16A1543A}
[-] Key deleted: HKU\S-1-5-21-1265709536-822219978-4185131874-1001\Software\Softonic
[-] Key deleted: HKU\S-1-5-21-1265709536-822219978-4185131874-1001\Software\YahooPartnerToolbar
[-] Key deleted: HKU\S-1-5-21-1265709536-822219978-4185131874-1001\Software\AppDataLow\Toolbar
[-] Key deleted: HKU\S-1-5-21-1265709536-822219978-4185131874-1001\Software\AppDataLow\Software\Conduit
[-] Key deleted: HKU\S-1-5-21-1265709536-822219978-4185131874-1001\Software\AppDataLow\Software\conduitEngine
[-] Key deleted: HKU\S-1-5-21-1265709536-822219978-4185131874-1001\Software\AppDataLow\Software\PriceGong
[#] Key deleted on reboot: HKCU\Software\Softonic
[#] Key deleted on reboot: HKCU\Software\YahooPartnerToolbar
[#] Key deleted on reboot: HKCU\Software\AppDataLow\Toolbar
[#] Key deleted on reboot: HKCU\Software\AppDataLow\Software\Conduit
[#] Key deleted on reboot: HKCU\Software\AppDataLow\Software\conduitEngine
[#] Key deleted on reboot: HKCU\Software\AppDataLow\Software\PriceGong
[-] Key deleted: HKLM\SOFTWARE\Conduit
[-] Key deleted: HKLM\SOFTWARE\conduitEngine
[-] Key deleted: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{EE171732-BEB4-4576-887D-CB62727F01CA}
[#] Key deleted on reboot: [x64] HKCU\Software\Softonic
[#] Key deleted on reboot: [x64] HKCU\Software\YahooPartnerToolbar
[#] Key deleted on reboot: [x64] HKCU\Software\AppDataLow\Toolbar
[#] Key deleted on reboot: [x64] HKCU\Software\AppDataLow\Software\Conduit
[#] Key deleted on reboot: [x64] HKCU\Software\AppDataLow\Software\conduitEngine
[#] Key deleted on reboot: [x64] HKCU\Software\AppDataLow\Software\PriceGong
[-] Key deleted: HKU\S-1-5-21-1265709536-822219978-4185131874-1001\Software\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}
[#] Key deleted on reboot: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}
[-] Key deleted: HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}
[#] Key deleted on reboot: [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}
***** [ Web browsers ] *****
[-] [C:\Users\Sheena\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Deleted: aol.com
[-] [C:\Users\Sheena\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Deleted: ask.com
[-] [C:\Users\family\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Deleted: aol.com
[-] [C:\Users\family\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Deleted: ask.com
*************************
:: "Tracing" keys deleted
:: Winsock settings cleared
*************************
C:\AdwCleaner\AdwCleaner[C0].txt - [6860 Bytes] - [11/02/2017 20:34:55]
C:\AdwCleaner\AdwCleaner[S0].txt - [6541 Bytes] - [11/02/2017 20:26:42]
########## EOF - C:\AdwCleaner\AdwCleaner[C0].txt - [7006 Bytes] ##########
StephenL
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.1.0 (12.05.2016)
Operating System: Windows 7 Home Premium x64
Ran by [removed] (Administrator) on Sat 02/11/2017 at 20:56:29.63
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
File System: 45
Failed to delete: C:\Users\Sheena\Appdata\LocalLow\af-hss (Folder)
Successfully deleted: C:\Users\Sheena\AppData\Local\{440D2A2F-969F-417A-BC77-271E6033396E} (Empty Folder)
Successfully deleted: C:\Windows\wininit.ini (File)
Successfully deleted: C:\Program Files (x86)\GUT76EB.tmp (File)
Successfully deleted: C:\Program Files (x86)\GUTE292.tmp (File)
Successfully deleted: C:\Users\Sheena\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0PS72R2M (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Sheena\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0XTKKITV (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Sheena\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3KJMOMW3 (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Sheena\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3YSX307Z (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Sheena\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4KNQASZ7 (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Sheena\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5K0U8XVP (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Sheena\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B3V3BHH4 (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Sheena\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\C1ULTT3T (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Sheena\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EMSRORI9 (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Sheena\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MJI01MIN (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Sheena\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MXODZ20L (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Sheena\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NG8H2WEZ (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Sheena\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NUD7LI52 (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Sheena\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\O04R8O6I (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Sheena\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OJN6V9WH (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Sheena\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OLD00D2I (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Sheena\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RIAWRNWC (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Sheena\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TCCSXQQ2 (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Sheena\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\W0XHU2F8 (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Sheena\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WVNPOV4J (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0PS72R2M (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0XTKKITV (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3KJMOMW3 (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3YSX307Z (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4KNQASZ7 (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5K0U8XVP (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B3V3BHH4 (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\C1ULTT3T (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EMSRORI9 (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MJI01MIN (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MXODZ20L (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NG8H2WEZ (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NUD7LI52 (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\O04R8O6I (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OJN6V9WH (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OLD00D2I (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RIAWRNWC (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TCCSXQQ2 (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\W0XHU2F8 (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WVNPOV4J (Temporary Internet Files Folder)
Registry: 3
Successfully deleted: HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{F0381DBD-E018-4E07-AE40-D96AB15083F0} (Registry Value)
Successfully deleted: HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{f0381dbd-e018-4e07-ae40-d96ab15083f0} (Registry Key)
Successfully deleted: HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{f0381dbd-e018-4e07-ae40-d96ab15083f0} (Registry Key)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Sat 02/11/2017 at 21:27:16.47
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
StephenL
Malwarebytes
www.malwarebytes.com
-Log Details-
Scan Date: 2/11/17
Scan Time: 10:00 PM
Logfile:
Administrator: Yes
-Software Information-
Version: 3.0.6.1469
Components Version: 1.0.50
Update Package Version: 1.0.1238
License: Trial
-System Information-
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: Sheena-PC\Sheena
-Scan Summary-
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 459310
Time Elapsed: 1 hr, 11 min, 24 sec
-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled
-Scan Details-
Process: 0
(No malicious items detected)
Module: 0
(No malicious items detected)
Registry Key: 8
PUP.Optional.ConduitTB, HKU\S-1-5-21-1265709536-822219978-4185131874-1003\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{30F9B915-B755-4826-820B-08FBA6BD249D}, No Action By User, [4514], [167822],1.0.1238
PUP.Optional.ConduitTB, HKU\S-1-5-21-1265709536-822219978-4185131874-501\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{30F9B915-B755-4826-820B-08FBA6BD249D}, No Action By User, [4514], [167822],1.0.1238
PUP.Optional.ConduitTB, HKU\S-1-5-21-1265709536-822219978-4185131874-1003\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{30F9B915-B755-4826-820B-08FBA6BD249D}, No Action By User, [4514], [167822],1.0.1238
PUP.Optional.ConduitTB, HKU\S-1-5-21-1265709536-822219978-4185131874-501\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{30F9B915-B755-4826-820B-08FBA6BD249D}, No Action By User, [4514], [167822],1.0.1238
PUP.Optional.ConduitTB.Gen, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{B0DE1BB9-550E-4670-823B-5B33D62A982F}, No Action By User, [13801], [236886],1.0.1238
PUP.Optional.ConduitTB.Gen, HKU\S-1-5-21-1265709536-822219978-4185131874-1003\SOFTWARE\APPDATALOW\SOFTWARE\conduitEngine, No Action By User, [13801], [234206],1.0.1238
PUP.Optional.PriceGong, HKU\S-1-5-21-1265709536-822219978-4185131874-1003\SOFTWARE\APPDATALOW\SOFTWARE\PriceGong, No Action By User, [3319], [241946],1.0.1238
PUP.Optional.ConduitTB.Gen, HKU\S-1-5-21-1265709536-822219978-4185131874-501\SOFTWARE\APPDATALOW\SOFTWARE\conduitEngine, No Action By User, [13801], [234206],1.0.1238
Registry Value: 3
PUP.Optional.ConduitTB, HKU\S-1-5-21-1265709536-822219978-4185131874-1003\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TOOLBAR\WEBBROWSER|{30F9B915-B755-4826-820B-08FBA6BD249D}, No Action By User, [4514], [167822],1.0.1238
PUP.Optional.ConduitTB, HKU\S-1-5-21-1265709536-822219978-4185131874-1003\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TOOLBAR\WEBBROWSER|{30F9B915-B755-4826-820B-08FBA6BD249D}, No Action By User, [4514], [167822],1.0.1238
PUP.Optional.ConduitTB.Gen, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{B0DE1BB9-550E-4670-823B-5B33D62A982F}|APPPATH, No Action By User, [13801], [236886],1.0.1238
Registry Data: 0
(No malicious items detected)
Data Stream: 0
(No malicious items detected)
Folder: 0
(No malicious items detected)
File: 5
PUP.Optional.Conduit, C:\USERS\SHEENA\APPDATA\LOCAL\TEMP\NSI1989.TMP.CONDUITENGINEEMBBED.EXE, No Action By User, [714], [121659],1.0.1238
PUP.Optional.Conduit, C:\USERS\SHEENA\APPDATA\LOCAL\TEMP\GLF766C.TMP.CONDUITENGINESETUP.EXE, No Action By User, [714], [121659],1.0.1238
PUP.Optional.Conduit, C:\USERS\SHEENA\APPDATA\LOCAL\TEMP\AF-HSS.EXE, No Action By User, [714], [111936],1.0.1238
PUP.Optional.Somoto, C:\USERS\SHEENA\DOWNLOADS\ETYPESETUP.EXE, No Action By User, [454], [77262],1.0.1238
PUP.Optional.Somoto, C:\USERS\SHEENA\DOWNLOADS\ETYPESETUP (1).EXE, No Action By User, [454], [77262],1.0.1238
Physical Sector: 0
(No malicious items detected)
(end)
ken545
Good Morning,
Sorry for the confusion with Malwarebytes , they just came out with a newer version so the instructions are a bit different ….my bad
Open Malwarebytes and click on Setting > Protection Tab and on the bottom make sure AUTOMATIC QUARANTINE is ON
Then run a new scan and let it remove those entries, post the log
When your finished running Malwarebytes, Right click on FRST64 and select RUN AS ADMINISTRATOR, make sure ADDITIONS IS CHECKED, then click on SCAN, post both new logs and lets see if there is anything we will have to remove manually
StephenL
Good Morning,
I think I have it now.
Malwarebytes
www.malwarebytes.com
-Log Details-
Scan Date: 2/11/17
Scan Time: 10:00 PM
Logfile: Malware.txt
Administrator: Yes
-Software Information-
Version: 3.0.6.1469
Components Version: 1.0.50
Update Package Version: 1.0.1238
License: Trial
-System Information-
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: Sheena-PC\Sheena
-Scan Summary-
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 459310
Time Elapsed: 1 hr, 11 min, 24 sec
-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled
-Scan Details-
Process: 0
(No malicious items detected)
Module: 0
(No malicious items detected)
Registry Key: 8
PUP.Optional.ConduitTB, HKU\S-1-5-21-1265709536-822219978-4185131874-1003\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{30F9B915-B755-4826-820B-08FBA6BD249D}, Quarantined, [4514], [167822],1.0.1238
PUP.Optional.ConduitTB, HKU\S-1-5-21-1265709536-822219978-4185131874-501\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{30F9B915-B755-4826-820B-08FBA6BD249D}, Quarantined, [4514], [167822],1.0.1238
PUP.Optional.ConduitTB, HKU\S-1-5-21-1265709536-822219978-4185131874-1003\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{30F9B915-B755-4826-820B-08FBA6BD249D}, Quarantined, [4514], [167822],1.0.1238
PUP.Optional.ConduitTB, HKU\S-1-5-21-1265709536-822219978-4185131874-501\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{30F9B915-B755-4826-820B-08FBA6BD249D}, Quarantined, [4514], [167822],1.0.1238
PUP.Optional.ConduitTB.Gen, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{B0DE1BB9-550E-4670-823B-5B33D62A982F}, Quarantined, [13801], [236886],1.0.1238
PUP.Optional.ConduitTB.Gen, HKU\S-1-5-21-1265709536-822219978-4185131874-1003\SOFTWARE\APPDATALOW\SOFTWARE\conduitEngine, Quarantined, [13801], [234206],1.0.1238
PUP.Optional.PriceGong, HKU\S-1-5-21-1265709536-822219978-4185131874-1003\SOFTWARE\APPDATALOW\SOFTWARE\PriceGong, Quarantined, [3319], [241946],1.0.1238
PUP.Optional.ConduitTB.Gen, HKU\S-1-5-21-1265709536-822219978-4185131874-501\SOFTWARE\APPDATALOW\SOFTWARE\conduitEngine, Quarantined, [13801], [234206],1.0.1238
Registry Value: 3
PUP.Optional.ConduitTB, HKU\S-1-5-21-1265709536-822219978-4185131874-1003\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TOOLBAR\WEBBROWSER|{30F9B915-B755-4826-820B-08FBA6BD249D}, Quarantined, [4514], [167822],1.0.1238
PUP.Optional.ConduitTB, HKU\S-1-5-21-1265709536-822219978-4185131874-1003\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TOOLBAR\WEBBROWSER|{30F9B915-B755-4826-820B-08FBA6BD249D}, Quarantined, [4514], [167822],1.0.1238
PUP.Optional.ConduitTB.Gen, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{B0DE1BB9-550E-4670-823B-5B33D62A982F}|APPPATH, Quarantined, [13801], [236886],1.0.1238
Registry Data: 0
(No malicious items detected)
Data Stream: 0
(No malicious items detected)
Folder: 0
(No malicious items detected)
File: 5
PUP.Optional.Conduit, C:\USERS\SHEENA\APPDATA\LOCAL\TEMP\NSI1989.TMP.CONDUITENGINEEMBBED.EXE, Quarantined, [714], [121659],1.0.1238
PUP.Optional.Conduit, C:\USERS\SHEENA\APPDATA\LOCAL\TEMP\GLF766C.TMP.CONDUITENGINESETUP.EXE, Quarantined, [714], [121659],1.0.1238
PUP.Optional.Conduit, C:\USERS\SHEENA\APPDATA\LOCAL\TEMP\AF-HSS.EXE, Quarantined, [714], [111936],1.0.1238
PUP.Optional.Somoto, C:\USERS\SHEENA\DOWNLOADS\ETYPESETUP.EXE, Quarantined, [454], [77262],1.0.1238
PUP.Optional.Somoto, C:\USERS\SHEENA\DOWNLOADS\ETYPESETUP (1).EXE, Quarantined, [454], [77262],1.0.1238
Physical Sector: 0
(No malicious items detected)
(end)
ken545
Lets see the new FRST64 and Additions logs please
StephenL
Hi Ken, here is the FRST64:
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 11-02-2017 01
Ran by [removed] (administrator) on SHEENA-PC (11-02-2017 13:48:58)
Running from C:\Users\[removed]\Desktop
[removed]
Platform: Windows 7 Home Premium Service Pack 1 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(AMD) C:\Windows\System32\atiesrxx.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GregHSRW.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee\SiteAdvisor\mcsacore.exe
(MediaMall Technologies, Inc.) C:\Program Files (x86)\MediaMall\MediaMallServer.exe
(Egis Technology Inc.) C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\MWLService.exe
(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
(Acer) C:\Program Files\Acer\Acer Updater\UpdaterService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.31.5\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.31.5\GoogleCrashHandler64.exe
(Symantec Corporation) C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee\MSC\mcsvrcnt.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee.com\Agent\mcagent.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
==================== Registry (Whitelisted) ====================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\…\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [7982112 2009-07-28] (Realtek Semiconductor)
HKLM\…\Run: [Acer ePower Management] => C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [828960 2009-08-06] (Acer Incorporated)
HKLM\…\Run: [mwlDaemon] => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe [349480 2009-08-06] (Egis Technology Inc.)
HKLM\…\Run: [Apoint] => C:\Program Files\Apoint2K\Apoint.exe [301056 2009-06-11] (Alps Electric Co., Ltd.)
HKLM-x32\…\Run: [EgisTecLiveUpdate] => C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe [199464 2009-08-04] (Egis Technology Inc.)
HKLM-x32\…\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [35760 2009-12-22] (Adobe Systems Incorporated)
HKLM-x32\…\Run: [LManager] => C:\Program Files (x86)\Launch Manager\LManager.exe [1157128 2009-07-27] (Dritek System Inc.)
HKLM-x32\…\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2009-07-30] (Advanced Micro Devices, Inc.)
HKLM-x32\…\Run: [ArcadeDeluxeAgent] => C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe [419112 2009-10-06] (CyberLink Corp.)
HKLM-x32\…\Run: [PlayMovie] => C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe [181480 2009-10-05] (Acer Corp.)
HKLM-x32\…\Run: [Acer Assist Launcher] => C:\Program Files (x86)\Acer\Acer Assist\launcher.exe [1261568 2007-11-19] ()
HKLM-x32\…\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM-x32\…\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [248552 2010-05-14] (Sun Microsystems, Inc.)
HKLM-x32\…\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [948672 2009-12-11] (Adobe Systems Incorporated)
HKLM-x32\…\Run: [Norton Online Backup] => C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe [2933184 2012-10-04] (Symantec Corporation)
HKLM-x32\…\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [67384 2016-09-01] (Apple Inc.)
HKLM-x32\…\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-10-01] (Apple Inc.)
HKU\S-1-5-21-1265709536-822219978-4185131874-1001\…\Run: [swg] => C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2009-08-21] (Google Inc.)
HKU\S-1-5-21-1265709536-822219978-4185131874-1001\…\Run: [MobileDocuments] => C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe
HKU\S-1-5-21-1265709536-822219978-4185131874-1001\…\Run: [GameXN GO] => "C:\ProgramData\GameXN\GameXNGO.exe" /startup
HKU\S-1-5-21-1265709536-822219978-4185131874-1001\…\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [59720 2013-09-14] (Apple Inc.)
HKU\S-1-5-21-1265709536-822219978-4185131874-1001\…\Run: [ApplePhotoStreams] => C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [59720 2013-09-15] (Apple Inc.)
HKU\S-1-5-21-1265709536-822219978-4185131874-1001\…\MountPoints2: {bcf38bff-0704-11e0-861d-0026222694fa} - E:\autorun.exe
HKU\S-1-5-18\…\RunOnce: [SPReview] => "C:\Windows\System32\SPReview\SPReview.exe" /sp:1 /errorfwlink:"hxxp://go.microsoft.com/fwlink/?LinkID=122915" /build:7601
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => -> No File
ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => -> No File
ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => -> No File
ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => -> No File
ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => -> No File
ShellIconOverlayIdentifiers: [egisPSDP] -> {30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x64\psdprotect.dll [2009-08-06] (Egis Technology Inc.)
ShellIconOverlayIdentifiers-x32: [egisPSDP] -> {30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\psdprotect.dll [2009-08-06] (Egis Technology Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\$McRebootA5E6DEAA56$.lnk [2017-02-11]
ShortcutTarget: $McRebootA5E6DEAA56$.lnk -> C:\Windows\System32\cmd.exe (Microsoft Corporation)
Startup: C:\Users\Sheena\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk [2010-08-16]
ShortcutTarget: OneNote 2007 Screen Clipper and Launcher.lnk -> C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 192.168.1.1
Tcpip\..\Interfaces\{25B43BE2-156C-41BE-82C5-21FD7D02B0DA}: [NameServer] 173.234.163.178,97.107.141.156
Tcpip\..\Interfaces\{BD7724F8-AA69-4AA5-BE41-83555D321D4A}: [DhcpNameServer] 192.168.1.1 192.168.1.1
Internet Explorer:
==================
HKU\S-1-5-21-1265709536-822219978-4185131874-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.yahoo.com/
HKU\S-1-5-21-1265709536-822219978-4185131874-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&m=aspire_5532&r=27361209d535l0324z195t47m2x291
URLSearchHook: HKLM-x32 - (No Name) - {f0381dbd-e018-4e07-ae40-d96ab15083f0} - No File
URLSearchHook: HKU\S-1-5-21-1265709536-822219978-4185131874-1001 - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
URLSearchHook: HKU\S-1-5-21-1265709536-822219978-4185131874-1001 - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
URLSearchHook: HKU\S-1-5-21-1265709536-822219978-4185131874-1001 - (No Name) - {f0381dbd-e018-4e07-ae40-d96ab15083f0} - No File
SearchScopes: HKLM-x32 -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW
SearchScopes: HKLM-x32 -> {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2765711
SearchScopes: HKU\S-1-5-21-1265709536-822219978-4185131874-1001 -> DefaultScope {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW_enBB358
SearchScopes: HKU\S-1-5-21-1265709536-822219978-4185131874-1001 -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW_enBB358
SearchScopes: HKU\S-1-5-21-1265709536-822219978-4185131874-1001 -> {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2765711
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21] (Microsoft Corp.)
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2013-11-05] (Google Inc.)
BHO: McAfee WebAdvisor BHO -> {B164E929-A1B6-4A06-B104-2CD0E90A88FF} -> c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll [2017-02-06] (McAfee, Inc.)
BHO: No Name -> {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} -> No File
BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-12-21] (Adobe Systems Incorporated)
BHO-x32: No Name -> {30F9B915-B755-4826-820B-08FBA6BD249D} -> No File
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21] (Microsoft Corp.)
BHO-x32: Windows Live Messenger Companion Helper -> {9FDDE16B-836F-4806-AB1F-1455CBEFF289} -> C:\Program Files (x86)\Windows Live\Companion\companioncore.dll [2010-11-10] (Microsoft Corporation)
BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2013-11-04] (Google Inc.)
BHO-x32: Skype add-on for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2010-02-08] (Skype Technologies S.A.)
BHO-x32: McAfee WebAdvisor BHO -> {B164E929-A1B6-4A06-B104-2CD0E90A88FF} -> c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll [2017-02-06] (McAfee, Inc.)
BHO-x32: Javaâ„¢ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll [2010-12-27] (Sun Microsystems, Inc.)
BHO-x32: No Name -> {f0381dbd-e018-4e07-ae40-d96ab15083f0} -> No File
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2013-11-05] (Google Inc.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2013-11-04] (Google Inc.)
Toolbar: HKU\S-1-5-21-1265709536-822219978-4185131874-1001 -> Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2013-11-05] (Google Inc.)
Toolbar: HKU\S-1-5-21-1265709536-822219978-4185131874-1001 -> No Name - {F0381DBD-E018-4E07-AE40-D96AB15083F0} - No File
DPF: HKLM-x32 {02BCC737-B171-4746-94C9-0D8A0B2C0089} hxxp://office.microsoft.com/sites/production/ieawsdc32.cab
DPF: HKLM-x32 {8100D56A-5661-482C-BEE8-AFECE305D968} hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
DPF: HKLM-x32 {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} hxxp://l.yimg.com/jh/games/web_games/popcap/bejeweled2/popcaploader_v6.cab
Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll [2017-02-06] (McAfee, Inc.)
Handler-x32: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll [2017-02-06] (McAfee, Inc.)
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll [2017-02-06] (McAfee, Inc.)
Handler-x32: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll [2017-02-06] (McAfee, Inc.)
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2010-02-08] (Skype Technologies S.A.)
FireFox:
========
FF HKLM\…\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files (x86)\McAfee\SiteAdvisor\saffplg.xpi
FF Extension: (McAfee WebAdvisor) - C:\Program Files (x86)\McAfee\SiteAdvisor\saffplg.xpi [2017-02-10]
FF HKLM-x32\…\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files (x86)\McAfee\SiteAdvisor\saffplg.xpi
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll [2014-02-13] ( Microsoft Corporation)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2013-10-01] ()
FF Plugin-x32: @java.com/JavaPlugin -> C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll [2010-12-27] (Sun Microsystems, Inc.)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll [2014-02-13] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2010-11-10] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2010-11-10] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-09-25] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-09-25] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.6 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-04-26] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.2.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-04-26] (VideoLAN)
Chrome:
=======
CHR DefaultProfile: Default
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\54.0.2840.99\ppGoogleNaClPluginChrome.dll => No File
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\54.0.2840.99\pdf.dll => No File
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\54.0.2840.99\gcswf32.dll => No File
CHR Plugin: (McAfee SiteAdvisor) - C:\Users\Sheena\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho\3.41.123.2_0\McChPlg.dll => No File
CHR Plugin: (McAfee SiteAdvisor) - C:\Program Files (x86)\McAfee\SiteAdvisor\npmcffplg32.dll (McAfee, Inc.)
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Java Deployment Toolkit 6.0.230.5) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll (Sun Microsystems, Inc.)
CHR Plugin: (Java(TM) Platform SE 6 U23) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll => No File
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll => No File
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll => No File
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll => No File
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll => No File
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll => No File
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll => No File
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll => No File
CHR Plugin: (Windows Live Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (iTunes Application Detector) - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrl.dll => No File
CHR Profile: C:\Users\Sheena\AppData\Local\Google\Chrome\User Data\Default [2017-02-11]
CHR Extension: (McAfee® WebAdvisor) - C:\Users\Sheena\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho [2017-02-10]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Sheena\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-02-11]
CHR Extension: (Chrome Media Router) - C:\Users\Sheena\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-02-11]
CHR HKLM\…\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - C:\Program Files (x86)\McAfee\SiteAdvisor\McChPlg.crx [2016-06-29]
CHR HKLM-x32\…\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - C:\Program Files (x86)\McAfee\SiteAdvisor\McChPlg.crx [2016-06-29]
==================== Services (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
S2 0306071486780525mcinstcleanup; C:\Windows\TEMP\030607~1.EXE [883024 2017-02-10] (McAfee, Inc.)
R2 McAfee SiteAdvisor Service; C:\Program Files (x86)\McAfee\SiteAdvisor\McSACore.exe [188352 2017-02-06] (McAfee, Inc.)
R2 MediaMall Server; C:\Program Files (x86)\MediaMall\MediaMallServer.exe [3895088 2013-03-23] (MediaMall Technologies, Inc.)
R2 MWLService; C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe [311592 2009-08-06] (Egis Technology Inc.)
U2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [3979712 2012-10-04] (Symantec Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
===================== Drivers (Whitelisted) ======================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
S3 InputFilter_Hid_FlexDef2b; C:\Windows\System32\DRIVERS\InputFilter_FlexDef2b.sys [17920 2010-06-19] (Siliten)
R3 mfesapsn; C:\Program Files (x86)\McAfee\SiteAdvisor\x64\mfesapsn.sys [46240 2016-06-06] (McAfee, Inc.)
R3 msvad_simple; C:\Windows\System32\drivers\povrtdev.sys [28528 2013-03-05] (MediaMall Technologies, Inc.)
S3 RimVSerPort; C:\Windows\System32\DRIVERS\RimSerial_AMD64.sys [31744 2009-01-09] (Research in Motion Ltd)
S3 mfeavfk; system32\drivers\mfeavfk.sys [X]
R1 mfehidk; system32\drivers\mfehidk.sys [X]
S3 mferkdk; system32\drivers\mferkdk.sys [X]
S3 mfesmfk; system32\drivers\mfesmfk.sys [X]
R4 MPFP; System32\Drivers\Mpfp.sys [X]
S3 RimUsb; System32\Drivers\RimUsb_AMD64.sys [X]
S3 RtsUIR; system32\DRIVERS\Rts516xIR.sys [X]
S3 USBCCID; system32\DRIVERS\RtsUCcid.sys [X]
U3 aswMBR; \??\C:\Users\Sheena\AppData\Local\Temp\aswMBR.sys [X] <==== ATTENTION
U3 aswVmm; \??\C:\Users\Sheena\AppData\Local\Temp\aswVmm.sys [X] <==== ATTENTION
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2017-02-11 13:48 - 2017-02-11 13:52 - 00022097 _____ C:\Users\Sheena\Desktop\FRST.txt
2017-02-11 13:47 - 2017-02-11 13:48 - 00000000 ____D C:\FRST
2017-02-11 13:33 - 2017-02-11 13:33 - 02421248 _____ (Farbar) C:\Users\Sheena\Desktop\FRST64.exe
2017-02-11 09:00 - 2017-02-11 09:00 - 01029654 _____ C:\Users\Sheena\Desktop\Frizzle.bmp
2017-02-11 05:54 - 2017-02-11 05:54 - 00002108 _____ C:\Users\Sheena\Desktop\aswMBR.txt
2017-02-11 05:54 - 2017-02-11 05:54 - 00000512 _____ C:\Users\Sheena\Desktop\MBR.dat
2017-02-10 23:19 - 2017-02-10 23:19 - 05198336 _____ (AVAST Software) C:\Users\Sheena\Downloads\aswMBR (1).exe
2017-02-10 23:17 - 2017-02-10 23:18 - 05198336 _____ (AVAST Software) C:\Users\Sheena\Downloads\aswMBR.exe
2017-02-10 20:43 - 2017-02-10 20:43 - 00000000 ____D C:\Users\family\AppData\Local\{730A6219-43E4-4B3F-B839-AFC3AF014377}
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2017-02-11 13:55 - 2016-06-29 19:23 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2017-02-11 13:46 - 2010-01-31 11:40 - 00000898 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2017-02-11 05:36 - 2010-01-31 11:40 - 00000894 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2017-02-10 23:17 - 2009-07-14 00:45 - 00009920 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2017-02-10 23:17 - 2009-07-14 00:45 - 00009920 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2017-02-10 22:35 - 2009-08-21 22:18 - 00000000 ____D C:\Program Files (x86)\McAfee
2017-02-10 21:59 - 2009-07-14 01:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2017-02-10 21:16 - 2011-02-07 15:47 - 00003934 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{4C1503E9-0D05-41EA-859A-B302FECF615E}
2017-02-10 20:41 - 2010-01-30 06:16 - 00000000 ____D C:\Users\family\Tracing
==================== Files in the root of some directories =======
2016-06-29 23:48 - 2016-06-29 23:51 - 6748160 _____ () C:\Program Files (x86)\GUT76EB.tmp
2012-09-29 15:15 - 2012-09-29 15:15 - 4096000 _____ () C:\Program Files (x86)\GUTE292.tmp
2009-12-30 15:33 - 2010-08-09 20:48 - 0000236 _____ () C:\Users\Sheena\AppData\Roaming\wklnhst.dat
2011-09-10 09:13 - 2011-09-10 09:35 - 0004608 _____ () C:\Users\Sheena\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2011-12-01 19:19 - 2011-12-01 19:19 - 0000000 _____ () C:\Users\Sheena\AppData\Local\{E7E2D897-A142-40E0-94B6-4C279C8EFCAC}
2009-09-12 14:15 - 2011-02-14 19:07 - 0007833 _____ () C:\ProgramData\ArcadeDeluxe3.log
2010-04-26 20:04 - 2010-04-26 20:04 - 0000056 ____H () C:\ProgramData\ezsidmv.dat
2009-12-31 18:14 - 2009-12-31 18:16 - 0000351 _____ () C:\ProgramData\hpzinstall.log
Some files in TEMP:
====================
2010-04-24 14:50 - 2010-04-24 14:50 - 1960304 _____ (Adobe Systems Incorporated) C:\Users\Guest\AppData\Local\Temp\FlashPlayerUpdate.exe
2011-02-14 18:46 - 2011-02-14 18:56 - 51126240 _____ ( ) C:\Users\Sheena\AppData\Local\Temp\181E.exe
2010-10-20 23:08 - 2010-10-20 23:08 - 2487632 _____ () C:\Users\Sheena\AppData\Local\Temp\AF-HSS.exe
2009-12-15 03:35 - 2009-12-15 03:35 - 0465408 _____ (Realtek Semiconductor Corp.) C:\Users\Sheena\AppData\Local\Temp\COMAP.EXE
2016-09-25 02:19 - 2012-07-30 06:45 - 3954224 _____ (GameXN AS) C:\Users\Sheena\AppData\Local\Temp\ezGameXN.dll
2010-01-15 21:51 - 2010-01-15 21:51 - 1956736 _____ (Adobe Systems Incorporated) C:\Users\Sheena\AppData\Local\Temp\FlashPlayerUpdate.exe
2010-08-19 07:49 - 2010-08-19 07:49 - 2826192 _____ (Adobe Systems, Inc.) C:\Users\Sheena\AppData\Local\Temp\FlashPlayerUpdate01.exe
2016-09-25 02:19 - 2011-09-05 13:23 - 0347008 _____ (EasyBits Software AS) C:\Users\Sheena\AppData\Local\Temp\GameXNGO.exe
2011-04-12 17:41 - 2010-10-18 12:27 - 0157536 _____ () C:\Users\Sheena\AppData\Local\Temp\GLF766C.tmp.ConduitEngineSetup.exe
2010-04-26 19:56 - 2010-04-26 19:56 - 0559280 _____ () C:\Users\Sheena\AppData\Local\Temp\GoogleChromeInstaller.exe
2010-04-05 21:24 - 2010-04-05 21:27 - 36224872 _____ (Microsoft Corporation) C:\Users\Sheena\AppData\Local\Temp\msg542A.exe
2011-04-19 22:13 - 2011-04-19 22:24 - 83249512 _____ (Microsoft Corporation) C:\Users\Sheena\AppData\Local\Temp\msgF210.exe
2011-05-19 18:33 - 2010-12-27 13:02 - 0469256 _____ (Microsoft Corporation) C:\Users\Sheena\AppData\Local\Temp\MSND682.exe
2011-03-14 12:23 - 2011-03-14 12:23 - 4446792 _____ (Conduit Ltd.) C:\Users\Sheena\AppData\Local\Temp\nsi1989.tmp.ConduitEngineEmbbed.exe
2011-09-05 13:22 - 2011-09-05 13:22 - 2524032 _____ (EasyBits Software AS) C:\Users\Sheena\AppData\Local\Temp\Refresh.exe
2010-05-29 08:31 - 2011-10-28 18:34 - 23803016 _____ (Skype Technologies S.A.) C:\Users\Sheena\AppData\Local\Temp\SkypeSetup.exe
2011-02-05 09:59 - 2011-02-05 09:59 - 0176128 _____ () C:\Users\Sheena\AppData\Local\Temp\_DelAll.EXE
2013-01-22 06:59 - 2013-01-22 06:59 - 0000000 _____ () C:\Users\Sheena\AppData\Local\Temp\{63E40967-4014-4EF5-AB66-6E980FA63EC2}-GoogleToolbarInstaller_updater_signed.exe
2013-12-15 02:58 - 2013-12-15 02:58 - 0000000 _____ () C:\Users\Sheena\AppData\Local\Temp\{A70DA7E2-FAE9-4676-8DE9-E4DB7F1F960E}-31.0.1650.63_chrome_installer.exe
2013-10-13 23:38 - 2013-10-13 23:48 - 0000000 _____ () C:\Users\Sheena\AppData\Local\Temp\{FC2F00E5-BD73-4826-8627-F657660CB4F8}-30.0.1599.69_29.0.1547.76_chrome_updater.exe
2011-08-17 19:59 - 2011-11-28 17:50 - 0286720 _____ (Symantec Corporation) C:\Users\Sheena\AppData\Local\Temp\~0000.dll
61712-93-00 59672:93 - 61712-93-00 27848:16353 - 0831488 _____ (Symantec Corporation) C:\Users\Sheena\AppData\Local\Temp\~0000.EXE
==================== Bamital & volsnap ======================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2013-12-15 04:05
==================== End of FRST.txt ============================
ken545
Stephant,
You need to run a NEW scan with FRST64, the log you just posted has the same date and time as the origanal one you posted earlier, also I need to see a new Additions log as well
Right click on FRST64 and select RUN AS ADMINISTRATOR, make sure ADDITIONS IS CHECKED, then click on SCAN, post both new logs
StephenL
Hi Kenny, hopefully I got it right this time.
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 11-02-2017 01
Ran by [removed] (administrator) on SHEENA-PC (12-02-2017 11:02:42)
Running from C:\Users\[removed]\Desktop
[removed]
Platform: Windows 7 Home Premium Service Pack 1 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GregHSRW.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee\SiteAdvisor\mcsacore.exe
(MediaMall Technologies, Inc.) C:\Program Files (x86)\MediaMall\MediaMallServer.exe
(Egis Technology Inc.) C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\MWLService.exe
(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
(Acer) C:\Program Files\Acer\Acer Updater\UpdaterService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe
(Egis Technology Inc.) C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\Apoint.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
(Google Inc.) C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.32.7\GoogleCrashHandler.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\ApntEx.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe
(Egis Technology Inc.) C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.32.7\GoogleCrashHandler64.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\APSDaemon.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreamsDownloader.exe
(CyberLink Corp.) C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe
(Acer Corp.) C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe
(Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Symantec Corporation) C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe
(Symantec Corporation) C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
==================== Registry (Whitelisted) ====================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\…\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [7982112 2009-07-28] (Realtek Semiconductor)
HKLM\…\Run: [Acer ePower Management] => C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [828960 2009-08-06] (Acer Incorporated)
HKLM\…\Run: [mwlDaemon] => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe [349480 2009-08-06] (Egis Technology Inc.)
HKLM\…\Run: [Apoint] => C:\Program Files\Apoint2K\Apoint.exe [301056 2009-06-11] (Alps Electric Co., Ltd.)
HKLM\…\Run: [Malwarebytes TrayApp] => C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\mbamtray.exe [2780112 2017-01-20] (Malwarebytes)
HKLM-x32\…\Run: [EgisTecLiveUpdate] => C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe [199464 2009-08-04] (Egis Technology Inc.)
HKLM-x32\…\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [35760 2009-12-22] (Adobe Systems Incorporated)
HKLM-x32\…\Run: [LManager] => C:\Program Files (x86)\Launch Manager\LManager.exe [1157128 2009-07-27] (Dritek System Inc.)
HKLM-x32\…\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2009-07-30] (Advanced Micro Devices, Inc.)
HKLM-x32\…\Run: [ArcadeDeluxeAgent] => C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe [419112 2009-10-06] (CyberLink Corp.)
HKLM-x32\…\Run: [PlayMovie] => C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe [181480 2009-10-05] (Acer Corp.)
HKLM-x32\…\Run: [Acer Assist Launcher] => C:\Program Files (x86)\Acer\Acer Assist\launcher.exe [1261568 2007-11-19] ()
HKLM-x32\…\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM-x32\…\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [248552 2010-05-14] (Sun Microsystems, Inc.)
HKLM-x32\…\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [948672 2009-12-11] (Adobe Systems Incorporated)
HKLM-x32\…\Run: [Norton Online Backup] => C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe [2933184 2012-10-04] (Symantec Corporation)
HKLM-x32\…\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [67384 2016-09-01] (Apple Inc.)
HKLM-x32\…\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-10-01] (Apple Inc.)
HKU\S-1-5-21-1265709536-822219978-4185131874-1001\…\Run: [swg] => C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2009-08-21] (Google Inc.)
HKU\S-1-5-21-1265709536-822219978-4185131874-1001\…\Run: [MobileDocuments] => C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe
HKU\S-1-5-21-1265709536-822219978-4185131874-1001\…\Run: [GameXN GO] => "C:\ProgramData\GameXN\GameXNGO.exe" /startup
HKU\S-1-5-21-1265709536-822219978-4185131874-1001\…\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [59720 2013-09-14] (Apple Inc.)
HKU\S-1-5-21-1265709536-822219978-4185131874-1001\…\Run: [ApplePhotoStreams] => C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [59720 2013-09-15] (Apple Inc.)
HKU\S-1-5-21-1265709536-822219978-4185131874-1001\…\MountPoints2: {bcf38bff-0704-11e0-861d-0026222694fa} - E:\autorun.exe
HKU\S-1-5-21-1265709536-822219978-4185131874-1003\…\Run: [swg] => C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2009-08-21] (Google Inc.)
HKU\S-1-5-21-1265709536-822219978-4185131874-1003\…\Run: [msnmsgr] => C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe [4240760 2010-11-10] (Microsoft Corporation)
HKU\S-1-5-21-1265709536-822219978-4185131874-1003\…\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [29635712 2016-09-12] (Skype Technologies S.A.)
HKU\S-1-5-21-1265709536-822219978-4185131874-1003\…\Run: [cdloader] => C:\Users\family\AppData\Roaming\mjusbsp\cdloader2.exe [50592 2011-08-23] (magicJack L.P.)
HKU\S-1-5-21-1265709536-822219978-4185131874-1003\…\MountPoints2: E - E:\autorun.exe
HKU\S-1-5-21-1265709536-822219978-4185131874-1003\…\MountPoints2: {8213841c-2953-11e0-9e33-0026222694fa} - E:\LaunchU3.exe
HKU\S-1-5-21-1265709536-822219978-4185131874-1003\…\MountPoints2: {bcf38bff-0704-11e0-861d-0026222694fa} - E:\autorun.exe
HKU\S-1-5-21-1265709536-822219978-4185131874-1003\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\System32\Acer.scr [442368 2009-07-30] ()
HKU\S-1-5-21-1265709536-822219978-4185131874-501\…\Run: [swg] => C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2009-08-21] (Google Inc.)
HKU\S-1-5-21-1265709536-822219978-4185131874-501\…\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [29635712 2016-09-12] (Skype Technologies S.A.)
HKU\S-1-5-21-1265709536-822219978-4185131874-501\…\MountPoints2: E - E:\autorun.exe
HKU\S-1-5-21-1265709536-822219978-4185131874-501\…\MountPoints2: {8213841c-2953-11e0-9e33-0026222694fa} - E:\LaunchU3.exe
HKU\S-1-5-21-1265709536-822219978-4185131874-501\…\MountPoints2: {bcf38bff-0704-11e0-861d-0026222694fa} - E:\autorun.exe
HKU\S-1-5-21-1265709536-822219978-4185131874-501\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\System32\Acer.scr [442368 2009-07-30] ()
HKU\S-1-5-18\…\RunOnce: [SPReview] => "C:\Windows\System32\SPReview\SPReview.exe" /sp:1 /errorfwlink:"hxxp://go.microsoft.com/fwlink/?LinkID=122915" /build:7601
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => -> No File
ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => -> No File
ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => -> No File
ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => -> No File
ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => -> No File
ShellIconOverlayIdentifiers: [egisPSDP] -> {30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x64\psdprotect.dll [2009-08-06] (Egis Technology Inc.)
ShellIconOverlayIdentifiers-x32: [egisPSDP] -> {30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\psdprotect.dll [2009-08-06] (Egis Technology Inc.)
Startup: C:\Users\Sheena\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk [2010-08-16]
ShortcutTarget: OneNote 2007 Screen Clipper and Launcher.lnk -> C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 192.168.1.1
Tcpip\..\Interfaces\{25B43BE2-156C-41BE-82C5-21FD7D02B0DA}: [NameServer] 173.234.163.178,97.107.141.156
Tcpip\..\Interfaces\{BD7724F8-AA69-4AA5-BE41-83555D321D4A}: [DhcpNameServer] 192.168.1.1 192.168.1.1
Internet Explorer:
==================
HKU\S-1-5-21-1265709536-822219978-4185131874-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.yahoo.com/
HKU\S-1-5-21-1265709536-822219978-4185131874-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&m=aspire_5532&r=27361209d535l0324z195t47m2x291
HKU\S-1-5-21-1265709536-822219978-4185131874-1003\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&m=aspire_5532&r=27361209d535l0324z195t47m2x291
HKU\S-1-5-21-1265709536-822219978-4185131874-1003\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&m=aspire_5532&r=27361209d535l0324z195t47m2x291
HKU\S-1-5-21-1265709536-822219978-4185131874-501\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&m=aspire_5532&r=27361209d535l0324z195t47m2x291
HKU\S-1-5-21-1265709536-822219978-4185131874-501\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&m=aspire_5532&r=27361209d535l0324z195t47m2x291
URLSearchHook: HKLM-x32 - (No Name) - {f0381dbd-e018-4e07-ae40-d96ab15083f0} - No File
URLSearchHook: HKU\S-1-5-21-1265709536-822219978-4185131874-1001 - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
URLSearchHook: HKU\S-1-5-21-1265709536-822219978-4185131874-1001 - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
URLSearchHook: HKU\S-1-5-21-1265709536-822219978-4185131874-1001 - (No Name) - {f0381dbd-e018-4e07-ae40-d96ab15083f0} - No File
URLSearchHook: HKU\S-1-5-21-1265709536-822219978-4185131874-1003 - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
URLSearchHook: HKU\S-1-5-21-1265709536-822219978-4185131874-1003 - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
URLSearchHook: HKU\S-1-5-21-1265709536-822219978-4185131874-501 - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
URLSearchHook: HKU\S-1-5-21-1265709536-822219978-4185131874-501 - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
SearchScopes: HKLM-x32 -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW
SearchScopes: HKU\S-1-5-21-1265709536-822219978-4185131874-1001 -> DefaultScope {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW_enBB358
SearchScopes: HKU\S-1-5-21-1265709536-822219978-4185131874-1001 -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW_enBB358
SearchScopes: HKU\S-1-5-21-1265709536-822219978-4185131874-1003 -> DefaultScope {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW_enBB358
SearchScopes: HKU\S-1-5-21-1265709536-822219978-4185131874-1003 -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW_enBB358
SearchScopes: HKU\S-1-5-21-1265709536-822219978-4185131874-501 -> DefaultScope {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW_enBB358
SearchScopes: HKU\S-1-5-21-1265709536-822219978-4185131874-501 -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW_enBB358
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21] (Microsoft Corp.)
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2013-11-05] (Google Inc.)
BHO: McAfee WebAdvisor BHO -> {B164E929-A1B6-4A06-B104-2CD0E90A88FF} -> c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll [2017-02-06] (McAfee, Inc.)
BHO: No Name -> {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} -> No File
BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-12-21] (Adobe Systems Incorporated)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21] (Microsoft Corp.)
BHO-x32: Windows Live Messenger Companion Helper -> {9FDDE16B-836F-4806-AB1F-1455CBEFF289} -> C:\Program Files (x86)\Windows Live\Companion\companioncore.dll [2010-11-10] (Microsoft Corporation)
BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2013-11-04] (Google Inc.)
BHO-x32: Skype add-on for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2010-02-08] (Skype Technologies S.A.)
BHO-x32: McAfee WebAdvisor BHO -> {B164E929-A1B6-4A06-B104-2CD0E90A88FF} -> c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll [2017-02-06] (McAfee, Inc.)
BHO-x32: Javaâ„¢ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll [2010-12-27] (Sun Microsystems, Inc.)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2013-11-05] (Google Inc.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2013-11-04] (Google Inc.)
Toolbar: HKU\S-1-5-21-1265709536-822219978-4185131874-1001 -> Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2013-11-05] (Google Inc.)
Toolbar: HKU\S-1-5-21-1265709536-822219978-4185131874-1003 -> Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2013-11-05] (Google Inc.)
Toolbar: HKU\S-1-5-21-1265709536-822219978-4185131874-1003 -> No Name - {F0381DBD-E018-4E07-AE40-D96AB15083F0} - No File
Toolbar: HKU\S-1-5-21-1265709536-822219978-4185131874-501 -> Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2013-11-05] (Google Inc.)
Toolbar: HKU\S-1-5-21-1265709536-822219978-4185131874-501 -> No Name - {F0381DBD-E018-4E07-AE40-D96AB15083F0} - No File
DPF: HKLM-x32 {02BCC737-B171-4746-94C9-0D8A0B2C0089} hxxp://office.microsoft.com/sites/production/ieawsdc32.cab
DPF: HKLM-x32 {8100D56A-5661-482C-BEE8-AFECE305D968} hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll [2017-02-06] (McAfee, Inc.)
Handler-x32: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll [2017-02-06] (McAfee, Inc.)
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll [2017-02-06] (McAfee, Inc.)
Handler-x32: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll [2017-02-06] (McAfee, Inc.)
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2010-02-08] (Skype Technologies S.A.)
FireFox:
========
FF HKLM\…\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files (x86)\McAfee\SiteAdvisor\saffplg.xpi
FF Extension: (McAfee WebAdvisor) - C:\Program Files (x86)\McAfee\SiteAdvisor\saffplg.xpi [2017-02-10]
FF HKLM-x32\…\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files (x86)\McAfee\SiteAdvisor\saffplg.xpi
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll [2014-02-13] ( Microsoft Corporation)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2013-10-01] ()
FF Plugin-x32: @java.com/JavaPlugin -> C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll [2010-12-27] (Sun Microsystems, Inc.)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll [2014-02-13] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2010-11-10] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2010-11-10] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2017-02-11] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2017-02-11] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.6 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-04-26] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.2.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-04-26] (VideoLAN)
Chrome:
=======
CHR DefaultProfile: Default
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\54.0.2840.99\ppGoogleNaClPluginChrome.dll => No File
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\54.0.2840.99\pdf.dll => No File
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\54.0.2840.99\gcswf32.dll => No File
CHR Plugin: (McAfee SiteAdvisor) - C:\Users\Sheena\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho\3.41.123.2_0\McChPlg.dll => No File
CHR Plugin: (McAfee SiteAdvisor) - C:\Program Files (x86)\McAfee\SiteAdvisor\npmcffplg32.dll (McAfee, Inc.)
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Java Deployment Toolkit 6.0.230.5) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll (Sun Microsystems, Inc.)
CHR Plugin: (Java(TM) Platform SE 6 U23) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll => No File
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll => No File
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll => No File
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll => No File
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll => No File
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll => No File
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll => No File
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll => No File
CHR Plugin: (Windows Live Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (iTunes Application Detector) - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrl.dll => No File
CHR Profile: C:\Users\Sheena\AppData\Local\Google\Chrome\User Data\Default [2017-02-12]
CHR Extension: (McAfee® WebAdvisor) - C:\Users\Sheena\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho [2017-02-10]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Sheena\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-02-11]
CHR Extension: (Chrome Media Router) - C:\Users\Sheena\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-02-11]
CHR HKLM\…\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - C:\Program Files (x86)\McAfee\SiteAdvisor\McChPlg.crx [2016-06-29]
CHR HKLM-x32\…\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - C:\Program Files (x86)\McAfee\SiteAdvisor\McChPlg.crx [2016-06-29]
==================== Services (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [4355024 2017-01-20] (Malwarebytes)
R2 McAfee SiteAdvisor Service; C:\Program Files (x86)\McAfee\SiteAdvisor\McSACore.exe [188352 2017-02-06] (McAfee, Inc.)
R2 MediaMall Server; C:\Program Files (x86)\MediaMall\MediaMallServer.exe [3895088 2013-03-23] (MediaMall Technologies, Inc.)
R2 MWLService; C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe [311592 2009-08-06] (Egis Technology Inc.)
U2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [3979712 2012-10-04] (Symantec Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
===================== Drivers (Whitelisted) ======================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R1 ESProtectionDriver; C:\Windows\system32\drivers\mbae64.sys [77416 2017-01-20] ()
S3 InputFilter_Hid_FlexDef2b; C:\Windows\System32\DRIVERS\InputFilter_FlexDef2b.sys [17920 2010-06-19] (Siliten)
R2 MBAMChameleon; C:\Windows\system32\drivers\MBAMChameleon.sys [176584 2017-02-11] (Malwarebytes)
R3 MBAMFarflt; C:\Windows\system32\drivers\farflt.sys [110536 2017-02-12] (Malwarebytes)
R3 MBAMProtection; C:\Windows\system32\drivers\mbam.sys [43968 2017-02-12] (Malwarebytes)
R0 MBAMSwissArmy; C:\Windows\System32\drivers\MBAMSwissArmy.sys [251848 2017-02-12] (Malwarebytes)
R3 MBAMWebProtection; C:\Windows\system32\drivers\mwac.sys [81696 2017-02-12] (Malwarebytes)
R3 mfesapsn; C:\Program Files (x86)\McAfee\SiteAdvisor\x64\mfesapsn.sys [46240 2016-06-06] (McAfee, Inc.)
R3 msvad_simple; C:\Windows\System32\drivers\povrtdev.sys [28528 2013-03-05] (MediaMall Technologies, Inc.)
S3 RimVSerPort; C:\Windows\System32\DRIVERS\RimSerial_AMD64.sys [31744 2009-01-09] (Research in Motion Ltd)
S3 RimUsb; System32\Drivers\RimUsb_AMD64.sys [X]
S3 RtsUIR; system32\DRIVERS\Rts516xIR.sys [X]
S3 USBCCID; system32\DRIVERS\RtsUCcid.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2017-02-12 11:02 - 2017-02-12 11:13 - 00028700 _____ C:\Users\Sheena\Desktop\FRST.txt
2017-02-12 08:54 - 2017-02-12 08:54 - 00003708 _____ C:\Users\Sheena\Desktop\Malware.txt
2017-02-12 06:14 - 2017-02-12 06:14 - 00002683 _____ C:\Users\Sheena\AppData\Local\recently-used.xbel
2017-02-12 05:57 - 2017-02-12 06:14 - 00000000 ____D C:\Users\Sheena\AppData\Local\gtk-2.0
2017-02-12 05:42 - 2017-02-12 05:42 - 00000000 ____D C:\Users\Sheena\.thumbnails
2017-02-12 04:21 - 2017-02-12 07:28 - 00000000 ____D C:\Users\Sheena\.gimp-2.8
2017-02-12 04:21 - 2017-02-12 04:21 - 00000000 ____D C:\Users\Sheena\AppData\Local\gegl-0.2
2017-02-12 04:21 - 2017-02-12 04:21 - 00000000 ____D C:\Users\Sheena\AppData\Local\fontconfig
2017-02-12 04:11 - 2017-02-12 04:11 - 00000898 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GIMP 2.lnk
2017-02-12 04:00 - 2017-02-12 04:12 - 00000000 ____D C:\Users\Sheena\Desktop\SCAN folder
2017-02-12 03:53 - 2017-02-12 04:07 - 00000000 ____D C:\Program Files\GIMP 2
2017-02-12 03:50 - 2017-02-12 03:51 - 77568952 _____ (The GIMP Team ) C:\Users\Sheena\Downloads\gimp-2.8.20-setup.exe
2017-02-11 21:49 - 2017-02-11 21:49 - 00176584 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMChameleon.sys
2017-02-11 21:48 - 2017-02-12 09:47 - 00081696 _____ (Malwarebytes) C:\Windows\system32\Drivers\mwac.sys
2017-02-11 21:48 - 2017-02-12 07:32 - 00110536 _____ (Malwarebytes) C:\Windows\system32\Drivers\farflt.sys
2017-02-11 21:47 - 2017-02-12 07:32 - 00251848 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2017-02-11 21:47 - 2017-02-12 07:32 - 00043968 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys
2017-02-11 21:43 - 2017-02-11 21:43 - 00001871 _____ C:\Users\Public\Desktop\Malwarebytes.lnk
2017-02-11 21:43 - 2017-02-11 21:43 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
2017-02-11 21:43 - 2017-02-11 21:43 - 00000000 ____D C:\ProgramData\Malwarebytes
2017-02-11 21:43 - 2017-02-11 21:43 - 00000000 ____D C:\Program Files\Malwarebytes
2017-02-11 21:43 - 2017-01-20 07:47 - 00077416 _____ C:\Windows\system32\Drivers\mbae64.sys
2017-02-11 20:13 - 2016-10-26 16:29 - 00485032 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2017-02-11 19:42 - 2017-02-11 20:34 - 00000000 ____D C:\AdwCleaner
2017-02-11 13:47 - 2017-02-12 11:02 - 00000000 ____D C:\FRST
2017-02-11 13:33 - 2017-02-11 13:33 - 02421248 _____ (Farbar) C:\Users\Sheena\Desktop\FRST64.exe
2017-02-10 23:19 - 2017-02-10 23:19 - 05198336 _____ (AVAST Software) C:\Users\Sheena\Downloads\aswMBR (1).exe
2017-02-10 23:17 - 2017-02-10 23:18 - 05198336 _____ (AVAST Software) C:\Users\Sheena\Downloads\aswMBR.exe
2017-02-10 20:43 - 2017-02-10 20:43 - 00000000 ____D C:\Users\family\AppData\Local\{730A6219-43E4-4B3F-B839-AFC3AF014377}
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2017-02-12 10:57 - 2016-06-29 19:23 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2017-02-12 07:45 - 2009-07-14 00:45 - 00009920 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2017-02-12 07:45 - 2009-07-14 00:45 - 00009920 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2017-02-12 07:33 - 2013-03-24 16:07 - 00000000 ____D C:\ProgramData\MediaMall
2017-02-12 07:31 - 2009-07-14 01:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2017-02-12 05:42 - 2009-12-14 12:10 - 00000000 ____D C:\Users\Sheena
2017-02-12 04:38 - 2010-08-14 23:38 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Youth Assistant SE
2017-02-12 04:38 - 2010-08-14 23:38 - 00000000 ____D C:\Program Files (x86)\Youth Assistant SE
2017-02-12 04:33 - 2010-08-15 00:26 - 00000032 _____ C:\Windows\hndt55x.INI
2017-02-11 23:14 - 2011-02-07 15:47 - 00003934 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{4C1503E9-0D05-41EA-859A-B302FECF615E}
2017-02-11 21:04 - 2011-04-12 17:41 - 00000000 ____D C:\Users\Sheena\AppData\LocalLow\AF-HSS
2017-02-11 20:43 - 2010-01-31 11:40 - 00003330 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2017-02-11 20:43 - 2010-01-31 11:40 - 00003202 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2017-02-11 20:40 - 2009-08-21 22:18 - 00000000 ____D C:\ProgramData\McAfee
2017-02-11 20:40 - 2009-08-21 22:18 - 00000000 ____D C:\Program Files (x86)\McAfee
2017-02-11 20:30 - 2009-07-14 01:32 - 00000000 ____D C:\Windows\Downloaded Program Files
2017-02-10 20:41 - 2010-01-30 06:16 - 00000000 ____D C:\Users\family\Tracing
==================== Files in the root of some directories =======
2009-12-30 15:33 - 2010-08-09 20:48 - 0000236 _____ () C:\Users\Sheena\AppData\Roaming\wklnhst.dat
2011-09-10 09:13 - 2011-09-10 09:35 - 0004608 _____ () C:\Users\Sheena\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2017-02-12 06:14 - 2017-02-12 06:14 - 0002683 _____ () C:\Users\Sheena\AppData\Local\recently-used.xbel
2011-12-01 19:19 - 2011-12-01 19:19 - 0000000 _____ () C:\Users\Sheena\AppData\Local\{E7E2D897-A142-40E0-94B6-4C279C8EFCAC}
2009-09-12 14:15 - 2011-02-14 19:07 - 0007833 _____ () C:\ProgramData\ArcadeDeluxe3.log
2010-04-26 20:04 - 2010-04-26 20:04 - 0000056 ____H () C:\ProgramData\ezsidmv.dat
2009-12-31 18:14 - 2009-12-31 18:16 - 0000351 _____ () C:\ProgramData\hpzinstall.log
Some files in TEMP:
====================
2010-04-24 14:50 - 2010-04-24 14:50 - 1960304 _____ (Adobe Systems Incorporated) C:\Users\Guest\AppData\Local\Temp\FlashPlayerUpdate.exe
2011-02-14 18:46 - 2011-02-14 18:56 - 51126240 _____ ( ) C:\Users\Sheena\AppData\Local\Temp\181E.exe
2009-12-15 03:35 - 2009-12-15 03:35 - 0465408 _____ (Realtek Semiconductor Corp.) C:\Users\Sheena\AppData\Local\Temp\COMAP.EXE
2016-09-25 02:19 - 2012-07-30 06:45 - 3954224 _____ (GameXN AS) C:\Users\Sheena\AppData\Local\Temp\ezGameXN.dll
2010-01-15 21:51 - 2010-01-15 21:51 - 1956736 _____ (Adobe Systems Incorporated) C:\Users\Sheena\AppData\Local\Temp\FlashPlayerUpdate.exe
2010-08-19 07:49 - 2010-08-19 07:49 - 2826192 _____ (Adobe Systems, Inc.) C:\Users\Sheena\AppData\Local\Temp\FlashPlayerUpdate01.exe
2016-09-25 02:19 - 2011-09-05 13:23 - 0347008 _____ (EasyBits Software AS) C:\Users\Sheena\AppData\Local\Temp\GameXNGO.exe
2010-04-26 19:56 - 2010-04-26 19:56 - 0559280 _____ () C:\Users\Sheena\AppData\Local\Temp\GoogleChromeInstaller.exe
2010-04-05 21:24 - 2010-04-05 21:27 - 36224872 _____ (Microsoft Corporation) C:\Users\Sheena\AppData\Local\Temp\msg542A.exe
2011-04-19 22:13 - 2011-04-19 22:24 - 83249512 _____ (Microsoft Corporation) C:\Users\Sheena\AppData\Local\Temp\msgF210.exe
2011-05-19 18:33 - 2010-12-27 13:02 - 0469256 _____ (Microsoft Corporation) C:\Users\Sheena\AppData\Local\Temp\MSND682.exe
2011-09-05 13:22 - 2011-09-05 13:22 - 2524032 _____ (EasyBits Software AS) C:\Users\Sheena\AppData\Local\Temp\Refresh.exe
2010-05-29 08:31 - 2011-10-28 18:34 - 23803016 _____ (Skype Technologies S.A.) C:\Users\Sheena\AppData\Local\Temp\SkypeSetup.exe
2011-02-05 09:59 - 2011-02-05 09:59 - 0176128 _____ () C:\Users\Sheena\AppData\Local\Temp\_DelAll.EXE
2013-01-22 06:59 - 2013-01-22 06:59 - 0000000 _____ () C:\Users\Sheena\AppData\Local\Temp\{63E40967-4014-4EF5-AB66-6E980FA63EC2}-GoogleToolbarInstaller_updater_signed.exe
2013-12-15 02:58 - 2013-12-15 02:58 - 0000000 _____ () C:\Users\Sheena\AppData\Local\Temp\{A70DA7E2-FAE9-4676-8DE9-E4DB7F1F960E}-31.0.1650.63_chrome_installer.exe
2013-10-13 23:38 - 2013-10-13 23:48 - 0000000 _____ () C:\Users\Sheena\AppData\Local\Temp\{FC2F00E5-BD73-4826-8627-F657660CB4F8}-30.0.1599.69_29.0.1547.76_chrome_updater.exe
2011-08-17 19:59 - 2011-11-28 17:50 - 0286720 _____ (Symantec Corporation) C:\Users\Sheena\AppData\Local\Temp\~0000.dll
62016-95-00 59976:95 - 62016-95-00 27848:16374 - 0831488 _____ (Symantec Corporation) C:\Users\Sheena\AppData\Local\Temp\~0000.EXE
==================== Bamital & volsnap ======================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2013-12-15 04:05
==================== End of FRST.txt ============================
Ask AI
AI can make mistakes. Check the cited posts. Archived advice can be out-of-date
Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI