This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

My laptop is very slow [Solved]

13 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 11-02-2017 01
Ran by [removed] (12-02-2017 11:28:39)
Running from C:\Users\[removed]\Desktop
Windows 7 Home Premium Service Pack 1 (X64) (2009-12-14 16:10:34)
Boot Mode: Normal
==========================================================
 
 
==================== Accounts: =============================
 
Administrator (S-1-5-21-1265709536-822219978-4185131874-500 - Administrator - Disabled)
family (S-1-5-21-1265709536-822219978-4185131874-1003 - Limited - Enabled) => C:\Users\family
Guest (S-1-5-21-1265709536-822219978-4185131874-501 - Limited - Enabled) => C:\Users\Guest
HomeGroupUser$ (S-1-5-21-1265709536-822219978-4185131874-1002 - Limited - Enabled)
Sheena (S-1-5-21-1265709536-822219978-4185131874-1001 - Administrator - Enabled) => C:\Users\Sheena
 
==================== Security Center ========================
 
(If an entry is included in the fixlist, it will be removed.)
 
AV: Malwarebytes (Enabled - Up to date) {23007AD3-69FE-687C-2629-D584AFFAF72B}
AS: Malwarebytes (Enabled - Up to date) {98619B37-4FC4-67F2-1C99-EEF6D47DBD96}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 
==================== Installed Programs ======================
 
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 
Acer Arcade Deluxe (HKLM-x32\…\InstallShield_{2637C347-9DAD-11D6-9EA2-00055D0CA761}) (Version: 3.0.7020 - CyberLink Corp.)
Acer Arcade Deluxe (x32 Version: 3.0.7020 - CyberLink Corp.) Hidden
Acer Assist (HKLM-x32\…\Acer Assist) (Version:  - Acer Incorporated)
Acer ePower Management (HKLM-x32\…\{3DB0448D-AD82-4923-B305-D001E521A964}) (Version: 4.05.3002 - Acer Incorporated)
Acer eRecovery Management (HKLM-x32\…\{7F811A54-5A09-4579-90E1-C93498E230D9}) (Version: 4.05.3002 - Acer Incorporated)
Acer Games (HKLM-x32\…\WildTangent acer Master Uninstall) (Version: 1.0.0.80 - WildTangent)
Acer GridVista (HKLM-x32\…\GridVista) (Version: 3.01.0730 - Acer Inc.)
Acer Registration (HKLM-x32\…\Acer Registration) (Version: 1.02.3004 - Acer Incorporated)
Acer ScreenSaver (HKLM-x32\…\Acer Screensaver) (Version: 1.02.0804 - Acer Incorporated)
Acrobat.com (HKLM-x32\…\{287ECFA4-719A-2143-A09B-D6A12DE54E40}) (Version: 1.6.65 - Adobe Systems Incorporated)
Adobe AIR (HKLM-x32\…\Adobe AIR) (Version: 21.0.0.215 - Adobe Systems Incorporated)
Adobe Flash Media Live Encoder 3.2 (HKLM-x32\…\{0659E943-DDF4-44FC-9FEE-A13B09F8BB08}) (Version: 3.2.0 - Adobe Systems Incorporated)
Adobe Flash Player 21 ActiveX (HKLM-x32\…\Adobe Flash Player ActiveX) (Version: 21.0.0.242 - Adobe Systems Incorporated)
Adobe Reader 9.3.1 MUI (HKLM-x32\…\{AC76BA86-7AD7-FFFF-7B44-A91000000001}) (Version: 9.3.1 - Adobe Systems Incorporated)
ALPS Touch Pad Driver (HKLM\…\{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}) (Version: Version 7.102.2002.208 - Alps Electric)
Amazon Kindle For PC (HKU\S-1-5-21-1265709536-822219978-4185131874-1003\…\Amazon Kindle For PC) (Version:  - Amazon)
Amazon Kindle For PC (HKU\S-1-5-21-1265709536-822219978-4185131874-501\…\Amazon Kindle For PC) (Version:  - Amazon)
Apple Application Support (32-bit) (HKLM-x32\…\{29DB9165-5FC1-48F0-9188-26123F526848}) (Version: 5.0.1 - Apple Inc.)
Apple Application Support (64-bit) (HKLM\…\{5905C8CF-1C88-4478-A48E-4E458AD1BC7E}) (Version: 5.0.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\…\{2EF5D87E-B7BD-458F-8428-E4D0B8B4E65C}) (Version: 7.0.0.117 - Apple Inc.)
Apple Software Update (HKLM-x32\…\{FFD1F7F1-1AC9-4BC4-A908-0686D635ABAF}) (Version: 2.1.4.131 - Apple Inc.)
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (HKLM-x32\…\{3108C217-BE83-42E4-AE9E-A56A2A92E549}) (Version: 1.0.0.10 - Atheros Communications Inc.)
ATI Catalyst Install Manager (HKLM\…\{ACCA82EB-7088-919E-5E1C-100A24F11CCF}) (Version: 3.0.732.0 - ATI Technologies, Inc.)
Bejeweled (x32 Version: 2.2.0.82 - WildTangent) Hidden
Bonjour (HKLM\…\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
ccc-core-static (x32 Version: 2009.0729.2227.38498 - ATI) Hidden
Compatibility Pack for the 2007 Office system (HKLM-x32\…\{90120000-0020-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
eBay Worldwide (HKLM-x32\…\{AAF89271-2594-468D-B578-96B2E30C41C4}) (Version: 2.1.0703 - OEM)
eSobi v2 (HKLM-x32\…\InstallShield_{15D967B5-A4BE-42AE-9E84-64CD062B25AA}) (Version: 2.0.4.000274 - esobi Inc.)
eSobi v2 (x32 Version: 2.0.4.000274 - esobi Inc.) Hidden
GIMP 2.8.20 (HKLM\…\GIMP-2_is1) (Version: 2.8.20 - The GIMP Team)
Google Chrome (HKLM-x32\…\Google Chrome) (Version: 54.0.2840.99 - Google Inc.)
Google Toolbar for Internet Explorer (HKLM-x32\…\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.4601.54 - Google Inc.)
Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.22.3 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.32.7 - Google Inc.) Hidden
Haali Media Splitter (HKLM-x32\…\HaaliMkx) (Version:  - )
iCloud (HKLM\…\{EAFB2AD8-D92B-464C-8D97-B9CB94703C4A}) (Version: 3.0.2.163 - Apple Inc.)
Identity Card (HKLM-x32\…\Identity Card) (Version: 1.00.3001 - Acer Incorporated)
iTunes (HKLM\…\{A535111D-95C8-487F-869E-CE4C239972D2}) (Version: 11.1.1.11 - Apple Inc.)
Java(TM) 6 Update 23 (HKLM-x32\…\{26A24AE4-039D-4CA4-87B4-2F83216023FF}) (Version: 6.0.230 - Oracle)
Java(TM) 6 Update 3 (HKLM-x32\…\{3248F0A8-6813-11D6-A77B-00B0D0160030}) (Version: 1.6.0.30 - Sun Microsystems, Inc.)
Jewel Quest (x32 Version: 2.2.0.82 - WildTangent) Hidden
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Launch Manager (HKLM-x32\…\LManager) (Version: 3.0.00 - Acer Inc.)
magicJack (HKU\S-1-5-21-1265709536-822219978-4185131874-1003\…\magicJack) (Version: 2.0.6073.4252 - magicJack L.P.)
Malwarebytes version 3.0.6.1469 (HKLM\…\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 3.0.6.1469 - Malwarebytes)
McAfee WebAdvisor (HKLM-x32\…\{35ED3F83-4BDC-4c44-8EC6-6A8301C7413A}) (Version: 4.0.228 - McAfee, Inc.)
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Messenger Companion (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile (HKLM\…\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\…\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\…\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office Enterprise 2007 (HKLM-x32\…\ENTERPRISE) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (HKLM-x32\…\HOMESTUDENTR) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Outlook Connector (HKLM-x32\…\{95140000-007A-0409-0000-0000000FF1CE}) (Version: 14.0.5118.5000 - Microsoft Corporation)
Microsoft Office PowerPoint Viewer 2007 (English) (HKLM-x32\…\{95120000-00AF-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Suite Activation Assistant (HKLM-x32\…\{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}) (Version: 2.9 - Microsoft Corporation)
Microsoft Silverlight (HKLM\…\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\…\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\…\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM-x32\…\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\…\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\…\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\…\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\…\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\…\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319 (HKLM\…\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.30319 (HKLM-x32\…\{196BB40D-1578-3D01-B289-BEFC77A11A1E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\…\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\…\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Works (HKLM-x32\…\{67E03279-F703-408F-B4BF-46B5FC8D70CD}) (Version: 9.7.0621 - Microsoft Corporation)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\…\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\…\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MyWinLocker (HKLM-x32\…\{68301905-2DEA-41CE-A4D4-E8B443B099BA}) (Version: 3.1.72.0 - Egis Technology Inc.)
Norton Online Backup (HKLM-x32\…\{40A66DF6-22D3-44B5-A7D3-83B118A2C0DC}) (Version: 2.5.0.85 - Symantec Corporation)
NTI Backup Now 5 (HKLM-x32\…\InstallShield_{12EFA1A4-AC3B-443C-8143-237EDE760403}) (Version: 5.1.2.627 - NewTech Infosystems)
NTI Backup Now Standard (x32 Version: 5.1.2.627 - NewTech Infosystems) Hidden
NTI Media Maker 8 (HKLM-x32\…\InstallShield_{2413930C-8309-47A6-BC61-5EF27A4222BC}) (Version: 8.0.12.6619 - NewTech Infosystems)
NTI Media Maker 8 (x32 Version: 8.0.12.6619 - NewTech Infosystems) Hidden
OBS Studio (HKLM-x32\…\OBS Studio) (Version: 0.16.6 - OBS Project)
Photo Story 3 for Windows (HKLM-x32\…\{4F41AD68-89F2-4262-A32C-2F70B01FCE9E}) (Version: 3.0.1115.11 - Microsoft Corporation)
PlayOn (HKLM-x32\…\{439358C2-DB31-41A9-8F60-5ED24C09D4D8}) (Version: 3.6.35 - MediaMall Technologies, Inc.)
QuickTime 7 (HKLM-x32\…\{FF59BD75-466A-4D5A-AD23-AAD87C5FD44C}) (Version: 7.79.80.95 - Apple Inc.)
RadioBOSS 5.0.0.9 (HKLM-x32\…\RadioBOSS) (Version: 5.0.0.9 - DJSoft.Net)
Realtek High Definition Audio Driver (HKLM-x32\…\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5904 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Card Reader (HKLM-x32\…\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.7600.30102 - Realtek Semiconductor Corp.)
Safari (HKLM-x32\…\{C779648B-410E-4BBA-B75B-5815BCEFE71D}) (Version: 5.34.57.2 - Apple Inc.)
Skype Toolbars (HKLM-x32\…\{981029E0-7FC9-4CF3-AB39-6F133621921A}) (Version: 1.0.4051 - Skype Technologies S.A.)
Skype™ 7.28 (HKLM-x32\…\{FC965A47-4839-40CA-B618-18F486F042C6}) (Version: 7.28.101 - Skype Technologies S.A.)
SPSS 11.0.1 for Windows (HKLM-x32\…\SPSS for Windows 11.0) (Version:  - )
UNO Undercover (x32 Version: 2.2.0.87 - WildTangent) Hidden
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\…\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\…\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
VLC media player (HKLM-x32\…\VLC media player) (Version: 2.2.3 - VideoLAN)
vMix (HKLM-x32\…\{93D664E9-E81E-4277-9E90-6CDABAC7208F}_is1) (Version:  - StudioCoast)
vMix Social (HKLM-x32\…\{1A0C8557-EB4A-4DD1-B4F9-A974ADEFE05F}_is1) (Version:  - StudioCoast Pty Ltd)
Welcome Center (HKLM-x32\…\Acer Welcome Center) (Version: 1.00.3005 - Acer Incorporated)
Windows Live Essentials (HKLM-x32\…\WinLiveSuite) (Version: 15.4.3502.0922 - Microsoft Corporation)
Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\…\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Sync (HKLM-x32\…\{B10914FD-8812-47A4-85A1-50FCDE7F1F33}) (Version: 14.0.8117.416 - Microsoft Corporation)
Wondershare Flash Gallery Factory 4.7.2 trial version (HKLM-x32\…\Wondershare Flash Gallery Factory_is1) (Version: 4.7.2 - Wondershare Software Co.,Ltd.)
Wondershare Flash Gallery Factory Deluxe 5.2.0.9 (HKLM-x32\…\Wondershare Flash Gallery Factory Deluxe_is1) (Version: 5.2.0.9 - Wondershare Software Co.,Ltd.)
 
==================== Custom CLSID (Whitelisted): ==========================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
CustomCLSID: HKU\S-1-5-21-1265709536-822219978-4185131874-1001_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Sheena\AppData\Roaming\Dropbox\bin\Dropbox.exe /autoplay => No File
 
==================== Scheduled Tasks (Whitelisted) =============
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
Task: {18150E1A-1007-4AFF-9DE4-8583275819AD} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2015-08-27] (Apple Inc.)
Task: {1C3C4953-29CF-45AF-82CF-B0EA0569DC83} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-06-11] (Google Inc.)
Task: {2B055669-5C74-4116-93A4-60A7CF4F7B73} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-06-11] (Google Inc.)
Task: {36C11C12-1562-45B6-8529-42925F286860} - System32\Tasks\{BA10AC80-4ABD-451D-A621-B42D6558E721} => D:\Mosports.exe 
Task: {66CE7235-2CEB-4159-87F7-9E978ACE9D37} - System32\Tasks\{DC0BC773-F18B-4E2D-90C2-D855F493794A} => D:\Mosports.exe 
Task: {8734BAC3-D5C2-4FF5-A0A7-CBB5F0F55164} - System32\Tasks\AVAST Software\Avast settings backup => C:\Program Files\Common Files\AV\avast! Antivirus\backup.exe [2017-02-11] (AVAST Software)
Task: {978B5AC8-4A0C-459E-BEFC-A6DF335931CF} - System32\Tasks\{45E0C4E2-20E9-4D9A-9C61-D61BFF53A501} => C:\Program Files (x86)\Skype\Phone\Skype.exe [2016-09-12] (Skype Technologies S.A.)
Task: {F8E34C72-153B-417E-98E5-AA618A4480B7} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2016-06-29] (Adobe Systems Incorporated)
 
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
 
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
 
==================== Shortcuts =============================
 
(The entries could be listed to be restored or removed.)
 
==================== Loaded Modules (Whitelisted) ==============
 
2017-02-11 21:43 - 2017-01-20 07:47 - 02264352 _____ () C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\PoliciesControllerImpl.dll
2017-02-11 21:43 - 2017-01-20 07:47 - 02829776 _____ () C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\arwlib.dll
2017-02-11 21:43 - 2017-01-20 07:47 - 02254800 _____ () C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\MwacLib.dll
2009-07-07 17:09 - 2009-07-07 17:09 - 00016384 ____R () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll
2009-09-12 14:05 - 2009-09-12 14:05 - 00270336 _____ () C:\Windows\assembly\GAC_MSIL\CLI.Aspect.CrossDisplay.Graphics.Dashboard\1.0.0.0__90ba9c70f846762e\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2016-06-30 00:26 - 2014-08-06 18:54 - 01004032 _____ () C:\Program Files (x86)\vMix\filters64\vMixVideo.ax
2016-11-24 12:24 - 2016-11-08 17:03 - 02367080 _____ () C:\Program Files (x86)\Google\Chrome\Application\54.0.2840.99\libglesv2.dll
2016-11-24 12:24 - 2016-11-08 17:03 - 00107112 _____ () C:\Program Files (x86)\Google\Chrome\Application\54.0.2840.99\libegl.dll
2016-09-01 18:13 - 2016-09-01 18:13 - 00080184 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2016-09-01 18:13 - 2016-09-01 18:13 - 01041720 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2013-09-14 01:51 - 2013-09-14 01:51 - 00087952 _____ () C:\Program Files (x86)\Common Files\Apple\Internet Services\zlib1.dll
2013-09-14 01:50 - 2013-09-14 01:50 - 01242952 _____ () C:\Program Files (x86)\Common Files\Apple\Internet Services\libxml2.dll
 
==================== Alternate Data Streams (Whitelisted) =========
 
(If an entry is included in the fixlist, only the ADS will be removed.)
 
AlternateDataStreams: C:\ProgramData\Temp:A7D26093 [123]
 
==================== Safe Mode (Whitelisted) ===================
 
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcmscsvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MCODS => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MpfService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys => ""="Driver"
 
==================== Association (Whitelisted) ===============
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
 
 
==================== Internet Explorer trusted/restricted ===============
 
(If an entry is included in the fixlist, it will be removed from the registry.)
 
 
==================== Hosts content: ===============================
 
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 
2009-07-13 22:34 - 2009-06-10 17:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
 
 
==================== Other Areas ============================
 
(Currently there is no automatic fix for this section.)
 
HKU\S-1-5-21-1265709536-822219978-4185131874-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Sheena\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
HKU\S-1-5-21-1265709536-822219978-4185131874-1003\Control Panel\Desktop\\Wallpaper -> C:\Users\family\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
HKU\S-1-5-21-1265709536-822219978-4185131874-501\Control Panel\Desktop\\Wallpaper -> C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.1.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.
 
==================== MSCONFIG/TASK MANAGER disabled items ==
 
 
==================== FirewallRules (Whitelisted) ===============
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
FirewallRules: [{2976E300-F7C0-48F7-A792-61D6A9CE3A17}] => C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
FirewallRules: [{E61B4D61-FEE7-4076-94A4-2383DF4DF441}] => C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
FirewallRules: [{3B446CDF-A1B0-496E-8310-DF3331CD407C}] => C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
FirewallRules: [{393F48A2-D596-46C3-9D0A-0AF21AD0CBDC}] => C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
FirewallRules: [{95D9AD6E-EE0B-4902-80F1-1BB9D8EAE25D}] => C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\Acer Arcade Deluxe.exe
FirewallRules: [{AEB03DD5-661D-4681-93A1-3021E1BA0987}] => C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PlayMovie.exe
FirewallRules: [{3D633C66-3BBB-481F-9CD0-91C9C1AA0DD0}] => C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe
FirewallRules: [{118D5091-F8A1-4463-B4A4-68FE35D68DB0}] => C:\Program Files (x86)\Acer Arcade Deluxe\HomeMedia\HomeMedia.exe
FirewallRules: [{3E350925-D9A0-4FBA-975D-E9F9D1F0EBC2}] => C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{889B7E91-56F2-4F8C-9C6B-2A6B505A499B}] => C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
FirewallRules: [{CEA2F42F-3637-4819-A1A6-5163000702BC}] => svchost.exe
FirewallRules: [{B823BD40-3F1F-400C-B607-871CBEB8BEEE}] => C:\Program Files (x86)\Windows Live\Sync\WindowsLiveSync.exe
FirewallRules: [{40AEBA1F-C8F8-4D95-B0B0-16FD9F40C7CF}] => C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{6784307F-E494-49F6-8673-4B7D77EC3B62}] => LPort=2869
FirewallRules: [{B9A8CDD4-EF78-40FB-AFE3-E6E3A04DC4C5}] => LPort=1900
FirewallRules: [{F0FF10B9-69F0-4AE1-8B4D-83B87EF66B2C}] => C:\Program Files (x86)\Windows Live\Mesh\MOE.exe
FirewallRules: [{8DDE704B-360B-440E-B4B7-13D21435C558}] => C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{A57E3281-49F4-461C-898E-C5DD250509BE}] => C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{A58AC5ED-B48D-4A32-B924-8D6761A5441D}] => C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{D4E33361-19FD-4735-970A-ABC10B0E09D9}] => C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{B704A57A-0E7F-4324-8CAA-70FF594094CF}] => C:\Program Files (x86)\MediaMall\MediaMallServer.exe
FirewallRules: [{BBC4977C-E1D0-4E0D-9878-7D1B3814B0FA}] => C:\Program Files (x86)\MediaMall\SettingsManager.exe
FirewallRules: [{C23195B3-5B02-44DA-84AB-EBA5E447515B}] => C:\Program Files (x86)\iTunes\iTunes.exe
FirewallRules: [{B6ABB53C-ADC8-4274-8EE6-CDC9F3D8884C}] => C:\Program Files (x86)\vMix\vMix.exe
FirewallRules: [{7252CCA1-7F59-4221-AB1D-92FEF0D56282}] => C:\Program Files (x86)\vMix\vMix64.exe
FirewallRules: [{18C56921-98C9-490A-A33D-7BAE17F042B2}] => C:\Program Files (x86)\vMix\ndi\vMixNDIHelper.exe
FirewallRules: [{5043530F-FBA7-48BC-B0AC-E3ED3B9EEA61}] => C:\Program Files (x86)\vMix\vMixDesktopCapture.exe
FirewallRules: [{D3C9B908-7B46-4075-A6E1-B84D4C90195D}] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
 
==================== Restore Points =========================
 
30-06-2016 00:36:19 Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501
30-06-2016 00:54:21 Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501
30-06-2016 07:03:49 Removed Bonjour
24-11-2016 07:11:24 Windows Backup
24-11-2016 07:36:01 Installed Adobe Flash Media Live Encoder 3.2.
25-11-2016 08:59:33 Windows Update
10-02-2017 21:07:07 Windows Backup
11-02-2017 20:56:36 JRT Pre-Junkware Removal
 
==================== Faulty Device Manager Devices =============
 
 
==================== Event log errors: =========================
 
Application errors:
==================
Error: (02/12/2017 12:33:15 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 3557353
 
Error: (02/12/2017 12:33:15 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 3557353
 
Error: (02/12/2017 12:33:15 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
 
Error: (02/12/2017 12:33:13 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 3555934
 
Error: (02/12/2017 12:33:13 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 3555934
 
Error: (02/12/2017 12:33:13 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
 
Error: (02/12/2017 12:33:12 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 3554592
 
Error: (02/12/2017 12:33:12 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 3554592
 
Error: (02/12/2017 12:33:12 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
 
Error: (02/12/2017 12:33:11 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 3553375
 
 
System errors:
=============
Error: (02/12/2017 12:32:58 PM) (Source: atikmdag) (EventID: 10261) (User: )
Description: Display is not active
 
Error: (02/12/2017 12:32:53 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the BITS service.
 
Error: (02/12/2017 11:33:39 AM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the iphlpsvc service.
 
Error: (02/12/2017 10:17:22 AM) (Source: atikmdag) (EventID: 10261) (User: )
Description: Display is not active
 
Error: (02/12/2017 10:17:10 AM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the ShellHWDetection service.
 
Error: (02/12/2017 10:09:27 AM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Schedule service.
 
Error: (02/12/2017 07:37:45 AM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: The Norton Online Backup service hung on starting.
 
Error: (02/12/2017 07:31:33 AM) (Source: atikmdag) (EventID: 10261) (User: )
Description: Display is not active
 
Error: (02/12/2017 07:31:33 AM) (Source: atikmdag) (EventID: 19468) (User: )
Description: CPLIB :: General - Invalid Parameter
 
Error: (02/12/2017 07:20:32 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Application Experience service failed to start due to the following error: 
The service did not respond to the start or control request in a timely fashion.
 
 
CodeIntegrity:
===================================
  Date: 2016-09-24 20:16:42.229
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files (x86)\McAfee\SiteAdvisor\x64\mfesapsn.sys because the set of per-page image hashes could not be found on the system.
 
  Date: 2016-09-24 20:14:32.456
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\aswKbd.sys because the set of per-page image hashes could not be found on the system.
 
  Date: 2016-09-24 20:14:32.331
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\aswSnx.sys because the set of per-page image hashes could not be found on the system.
 
  Date: 2016-08-16 23:22:55.641
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files (x86)\McAfee\SiteAdvisor\x64\mfesapsn.sys because the set of per-page image hashes could not be found on the system.
 
  Date: 2016-08-16 23:20:55.003
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\aswKbd.sys because the set of per-page image hashes could not be found on the system.
 
  Date: 2016-08-16 23:20:54.457
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\aswSnx.sys because the set of per-page image hashes could not be found on the system.
 
  Date: 2016-08-16 12:10:55.899
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files (x86)\McAfee\SiteAdvisor\x64\mfesapsn.sys because the set of per-page image hashes could not be found on the system.
 
  Date: 2016-08-16 12:08:23.284
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\aswKbd.sys because the set of per-page image hashes could not be found on the system.
 
  Date: 2016-08-16 12:08:22.473
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\aswSnx.sys because the set of per-page image hashes could not be found on the system.
 
  Date: 2016-08-16 11:38:37.210
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files (x86)\McAfee\SiteAdvisor\x64\mfesapsn.sys because the set of per-page image hashes could not be found on the system.
 
 
==================== Memory info =========================== 
 
Processor: AMD Athlon™ Processor TF-20
Percentage of memory in use: 73%
Total physical RAM: 2812.05 MB
Available physical RAM: 750.14 MB
Total Virtual: 5622.28 MB
Available Virtual: 1691.36 MB
 
==================== Drives ================================
 
Drive c: (Acer) (Fixed) (Total:136.95 GB) (Free:64.85 GB) NTFS
 
==================== MBR & Partition Table ==================
 
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 149.1 GB) (Disk ID: 99D95CA4)
Partition 1: (Not Active) - (Size=12 GB) - (Type=27)
Partition 2: (Active) - (Size=102 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=136.9 GB) - (Type=07 NTFS)
 
==================== End of Addition.txt ============================

Looking better, I am posting a fix using FRST64, I am removing GameXNGO.exe from Startup as it uses a lot of system resources and can be slowing you down, if you want to keep it in startup then just delete that entry from my fix.  Just wanted add, you have some games installed, there not malicious but some games can slow down your system so I would look at the games you have installed and uninstall any that you no longer use, you can do this by going to Programs and Features in the Control Panel.

 

After the fix reboots your system, post the log and let me know if your system is running any better

 

 
Open notepad , Go to Start –> All Programs –> Accessories –> Notepad.
Please copy the entire contents Inside of the code box below beginning with START and ending with END
(To do this highlight the contents of the box, right click on it and select copy. Right-click in the open notepad and select Paste).
Name the file Fixlist, Save it to your desktop where you have FRST/FRST64 or the fix wont work, . Then open up FRST/FRST64 and click on FIX (Not Scan) It won't take long, after your computer reboots you will find a FIXLOG.TXT on your desktop, post it please
 
Start
CloseProcesses:
CreateRestorePoint: 
HKU\S-1-5-21-1265709536-822219978-4185131874-1001\…\Run: [GameXN GO] => "C:\ProgramData\GameXN\GameXNGO.exe" /startup
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  -> No File
ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} =>  -> No File
ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} =>  -> No File
ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} =>  -> No File
ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} =>  -> No File
URLSearchHook: HKLM-x32 - (No Name) - {f0381dbd-e018-4e07-ae40-d96ab15083f0} - No File
BHO: No Name -> {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} -> No File
Toolbar: HKU\S-1-5-21-1265709536-822219978-4185131874-1003 -> No Name - {F0381DBD-E018-4E07-AE40-D96AB15083F0} -  No File
Toolbar: HKU\S-1-5-21-1265709536-822219978-4185131874-501 -> No Name - {F0381DBD-E018-4E07-AE40-D96AB15083F0} -  No File
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
2017-02-12 11:02 - 2017-02-12 11:13 - 00028700 _____ C:\Users\Sheena\Desktop\FRST.txt
2017-02-11 13:47 - 2017-02-12 11:02 - 00000000 ____D C:\FRST
2017-02-10 23:19 - 2017-02-10 23:19 - 05198336 _____ (AVAST Software) C:\Users\Sheena\Downloads\aswMBR (1).exe
2017-02-11 21:04 - 2011-04-12 17:41 - 00000000 ____D C:\Users\Sheena\AppData\LocalLow\AF-HSS
EmptyTemp:
End
 
NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Try this new script

 

 

 

 

Start
HKU\S-1-5-21-1265709536-822219978-4185131874-1001\…\Run: [GameXN GO] => "C:\ProgramData\GameXN\GameXNGO.exe" /startup
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  -> No File
URLSearchHook: HKLM-x32 - (No Name) - {f0381dbd-e018-4e07-ae40-d96ab15083f0} - No File
BHO: No Name -> {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} -> No File
Toolbar: HKU\S-1-5-21-1265709536-822219978-4185131874-1003 -> No Name - {F0381DBD-E018-4E07-AE40-D96AB15083F0} -  No File
Toolbar: HKU\S-1-5-21-1265709536-822219978-4185131874-501 -> No Name - {F0381DBD-E018-4E07-AE40-D96AB15083F0} -  No File
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
2017-02-11 21:04 - 2011-04-12 17:41 - 00000000 ____D C:\Users\Sheena\AppData\LocalLow\AF-HSS
EmptyTemp:
End

 

Hi Ken,  it seem as if the application is freezing.  We have spent much time on this and I don't want to waste your time.

Should I try a factory restore?

Sometimes computers get gummed up with a lot of programs installed and along with malware a factory reset is the way to go, if you decide to do this besure to backup all your important docs and pics to a USB drive, external hard drive or a CD or you will lose them all, 

 

Let me ask you, how old is this computer ?  Did your computer getting slow happen gradually or did it come on all at once ?

 

Also sometimes a gummed up slow computer can be caused by a virus or malware, what we removed so far has really been just a bunch of garbage, nothing that serious.  aswMBR checks for a rootkit type of infection that hides from the operating system and it found none.

 

Its puzzling why all the other programs ran just fine even the FRST64 scan but not the fix.  Are you sure you have done it correctly, the script has to be in Notepad and named FIXLIST.TXT, any other word program wont work. Did you see the new script I posted, I eliminated some entires to make it easier for it to run. It also has to be on the desktop where you have FRST64 or it wont run, sometimes using your mouse to drag FIXLIST right next to FRST64 will help it along,

 

Here is the new script in case you missed it

 

Start
HKU\S-1-5-21-1265709536-822219978-4185131874-1001\...\Run: [GameXN GO] => "C:\ProgramData\GameXN\GameXNGO.exe" /startup
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  -> No File
URLSearchHook: HKLM-x32 - (No Name) - {f0381dbd-e018-4e07-ae40-d96ab15083f0} - No File
BHO: No Name -> {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} -> No File
Toolbar: HKU\S-1-5-21-1265709536-822219978-4185131874-1003 -> No Name - {F0381DBD-E018-4E07-AE40-D96AB15083F0} -  No File
Toolbar: HKU\S-1-5-21-1265709536-822219978-4185131874-501 -> No Name - {F0381DBD-E018-4E07-AE40-D96AB15083F0} -  No File
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
2017-02-11 21:04 - 2011-04-12 17:41 - 00000000 ____D C:\Users\Sheena\AppData\LocalLow\AF-HSS
EmptyTemp:
End

 

There is another program we can run to check for malware, let me know if you want to run it

Hi Ken, the computer is about 6 years old.  I am getting a failure  to update when I try running FRST64
Maybe we should try the other application.

Give this one a try

 

[external image: RK2_zps0modv4gs.jpg]
Download RogueKiller from Here or Here To your DESKTOP
  •  
  • Quit all programs that you may have started.
  • Please disconnect any USB or external drives from the computer before you run this scan!
  • For Windows Vista,  Windows 7, 8 or 10  right-click on RogueKiller and select "Run as  Administrator" to start the program.
  • For Windows XP, double-click on RogueKiller to start the program.
  • If the program has been blocked by malware, try to rename it to winlogon.exe, or change its file extension with .com (ex: Roguekiller.com)
  • If a message pops up telling you your running the 32 bit version just click on "Run Anyway"
  • The free version will not allow you to change any setting so just leave it all be.
  • The scan is triggered with the Start Scan button. The scan does not modify your system. 
  • Wait until the Status box shows "Scan Finished"
  • Click on "Report" and copy/paste the content of the Notepad into your next reply.
  • The log should be found in RKreport[1].txt on your Desktop
  • Exit/Close RogueKiller
 

Hi Ken

This is the info from the scan:

 

RogueKiller V12.9.8.0 (x64) [Feb 21 2017] (Free) by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Website : http://www.adlice.com/download/roguekiller/
Blog : http://www.adlice.com
 
Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User : Sheena [Administrator]
Started from : C:\Program Files\RogueKiller\RogueKiller64.exe
Mode : Scan – Date : 02/21/2017 22:48:32 (Duration : 05:31:57)
 
¤¤¤ Processes : 0 ¤¤¤
 
¤¤¤ Registry : 4 ¤¤¤
[PUM.HomePage] (X64) HKEY_USERS\S-1-5-21-1265709536-822219978-4185131874-1001\Software\Microsoft\Internet Explorer\Main | Default_Page_URL : http://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&m=aspire_5532&r=27361209d535l0324z195t47m2x291 -> Found
[PUM.HomePage] (X86) HKEY_USERS\S-1-5-21-1265709536-822219978-4185131874-1001\Software\Microsoft\Internet Explorer\Main | Default_Page_URL : http://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&m=aspire_5532&r=27361209d535l0324z195t47m2x291 -> Found
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{25B43BE2-156C-41BE-82C5-21FD7D02B0DA} | NameServer : 173.234.163.178,97.107.141.156 ([-][United States])  -> Found
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Tcpip\Parameters\Interfaces\{25B43BE2-156C-41BE-82C5-21FD7D02B0DA} | NameServer : 173.234.163.178,97.107.141.156 ([-][United States])  -> Found
 
¤¤¤ Tasks : 0 ¤¤¤
 
¤¤¤ Files : 0 ¤¤¤
 
¤¤¤ WMI : 0 ¤¤¤
 
¤¤¤ Hosts File : 0 ¤¤¤
 
¤¤¤ Antirootkit : 0 (Driver: Loaded) ¤¤¤
 
¤¤¤ Web browsers : 0 ¤¤¤
 
¤¤¤ MBR Check : ¤¤¤
+++++ PhysicalDrive0:  +++++
— User —
[MBR] 0598da11463406794391aab006899f3c
[BSP] c1a2f7bf1ab8866e91c87ce613895ab0 : Windows Vista/7/8|VT.Unknown MBR Code
Partition table:
0 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 63 | Size: 12291 MB
1 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 25173855 | Size: 101 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
2 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 25382700 | Size: 140232 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
User = LL1 … OK
User = LL2 … OK
 

Good Morning

 

Your log looks fine. Let me ask you if you use these because it looks like the computer your using is from Barbados

 

These are from the USA

 

Ubiquity Server Solutions Los Angeles
 
Linode LLC
 
Close all Programs
 
  •  
  • Right Click on RogueKiller and  select Run as Administrator'
  • After it has completed it's prescan, click on Scan
  • Click on the “Registry” tab
  • Put a checkmark in the following entries
 
 
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{25B43BE2-156C-41BE-82C5-21FD7D02B0DA} | NameServer : 173.234.163.178,97.107.141.156 ([-][United States])  -> Found
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Tcpip\Parameters\Interfaces\{25B43BE2-156C-41BE-82C5-21FD7D02B0DA} | NameServer : 173.234.163.178,97.107.141.156 ([-][United States])  -> Found
 
 
Then click on the Delete Button and post the log it produces

Hi Ken,

Here is the report.

 

RogueKiller V12.9.8.0 (x64) [Feb 21 2017] (Free) by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Website : http://www.adlice.com/download/roguekiller/
Blog : http://www.adlice.com
 
Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User : Sheena [Administrator]
Started from : C:\Program Files\RogueKiller\RogueKiller64.exe
Mode : Delete – Date : 02/22/2017 08:55:18 (Duration : 02:40:14)
 
¤¤¤ Processes : 0 ¤¤¤
 
¤¤¤ Registry : 4 ¤¤¤
[PUM.HomePage] (X64) HKEY_USERS\S-1-5-21-1265709536-822219978-4185131874-1001\Software\Microsoft\Internet Explorer\Main | Default_Page_URL : http://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&m=aspire_5532&r=27361209d535l0324z195t47m2x291 -> Not selected
[PUM.HomePage] (X86) HKEY_USERS\S-1-5-21-1265709536-822219978-4185131874-1001\Software\Microsoft\Internet Explorer\Main | Default_Page_URL : http://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&m=aspire_5532&r=27361209d535l0324z195t47m2x291 -> Not selected
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{25B43BE2-156C-41BE-82C5-21FD7D02B0DA} | NameServer : 173.234.163.178,97.107.141.156 ([-][United States])  -> Replaced ()
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Tcpip\Parameters\Interfaces\{25B43BE2-156C-41BE-82C5-21FD7D02B0DA} | NameServer : 173.234.163.178,97.107.141.156 ([-][United States])  -> Replaced ()
 
¤¤¤ Tasks : 0 ¤¤¤
 
¤¤¤ Files : 0 ¤¤¤
 
¤¤¤ WMI : 0 ¤¤¤
 
¤¤¤ Hosts File : 0 ¤¤¤
 
¤¤¤ Antirootkit : 0 (Driver: Loaded) ¤¤¤
 
¤¤¤ Web browsers : 0 ¤¤¤
 
¤¤¤ MBR Check : ¤¤¤
+++++ PhysicalDrive0:  +++++
— User —
[MBR] 0598da11463406794391aab006899f3c
[BSP] c1a2f7bf1ab8866e91c87ce613895ab0 : Windows Vista/7/8|VT.Unknown MBR Code
Partition table:
0 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 63 | Size: 12291 MB
1 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 25173855 | Size: 101 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
2 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 25382700 | Size: 140232 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
User = LL1 … OK
User = LL2 … OK
 

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI